summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorchristos <christos@NetBSD.org>2016-03-11 01:55:00 +0000
committerchristos <christos@NetBSD.org>2016-03-11 01:55:00 +0000
commitcf995d1fb3744c4f3e1dc0922ea643fa508ef44d (patch)
tree4effb480cb5baf6f5a7d174ae400f70299aef042
parentcc17346bfb9185eb08ac016a4556edd46bb82965 (diff)
merge conflicts
-rw-r--r--crypto/external/bsd/openssh/dist/auth-bsdauth.c9
-rw-r--r--crypto/external/bsd/openssh/dist/auth-krb5.c9
-rw-r--r--crypto/external/bsd/openssh/dist/auth-options.c116
-rw-r--r--crypto/external/bsd/openssh/dist/auth.h8
-rw-r--r--crypto/external/bsd/openssh/dist/auth2-pubkey.c41
-rw-r--r--crypto/external/bsd/openssh/dist/authfd.c25
-rw-r--r--crypto/external/bsd/openssh/dist/authfd.h8
-rw-r--r--crypto/external/bsd/openssh/dist/authfile.c32
-rw-r--r--crypto/external/bsd/openssh/dist/bitmap.c6
-rw-r--r--crypto/external/bsd/openssh/dist/channels.c21
-rw-r--r--crypto/external/bsd/openssh/dist/cipher.c10
-rw-r--r--crypto/external/bsd/openssh/dist/clientloop.c98
-rw-r--r--crypto/external/bsd/openssh/dist/clientloop.h4
-rw-r--r--crypto/external/bsd/openssh/dist/dh.h11
-rw-r--r--crypto/external/bsd/openssh/dist/kex.c179
-rw-r--r--crypto/external/bsd/openssh/dist/kex.h13
-rw-r--r--crypto/external/bsd/openssh/dist/kexc25519s.c11
-rw-r--r--crypto/external/bsd/openssh/dist/kexdhs.c11
-rw-r--r--crypto/external/bsd/openssh/dist/kexecdhs.c11
-rw-r--r--crypto/external/bsd/openssh/dist/kexgexs.c11
-rw-r--r--crypto/external/bsd/openssh/dist/key.c11
-rw-r--r--crypto/external/bsd/openssh/dist/key.h7
-rw-r--r--crypto/external/bsd/openssh/dist/krl.c28
-rw-r--r--crypto/external/bsd/openssh/dist/misc.c74
-rw-r--r--crypto/external/bsd/openssh/dist/moduli-gen/moduli.153649
-rw-r--r--crypto/external/bsd/openssh/dist/monitor.c42
-rw-r--r--crypto/external/bsd/openssh/dist/monitor_wrap.c10
-rw-r--r--crypto/external/bsd/openssh/dist/monitor_wrap.h6
-rw-r--r--crypto/external/bsd/openssh/dist/mux.c21
-rw-r--r--crypto/external/bsd/openssh/dist/myproposal.h25
-rw-r--r--crypto/external/bsd/openssh/dist/opacket.c4
-rw-r--r--crypto/external/bsd/openssh/dist/opacket.h4
-rw-r--r--crypto/external/bsd/openssh/dist/packet.c307
-rw-r--r--crypto/external/bsd/openssh/dist/packet.h13
-rw-r--r--crypto/external/bsd/openssh/dist/readconf.c105
-rw-r--r--crypto/external/bsd/openssh/dist/readconf.h12
-rw-r--r--crypto/external/bsd/openssh/dist/readpass.c9
-rw-r--r--crypto/external/bsd/openssh/dist/scp.17
-rw-r--r--crypto/external/bsd/openssh/dist/scp.c21
-rw-r--r--crypto/external/bsd/openssh/dist/servconf.c57
-rw-r--r--crypto/external/bsd/openssh/dist/serverloop.c34
-rw-r--r--crypto/external/bsd/openssh/dist/session.c31
-rw-r--r--crypto/external/bsd/openssh/dist/sftp-client.c27
-rw-r--r--crypto/external/bsd/openssh/dist/sftp-server-main.c9
-rw-r--r--crypto/external/bsd/openssh/dist/sftp-server.c14
-rw-r--r--crypto/external/bsd/openssh/dist/sftp.17
-rw-r--r--crypto/external/bsd/openssh/dist/sftp.c8
-rw-r--r--crypto/external/bsd/openssh/dist/ssh-add.c40
-rw-r--r--crypto/external/bsd/openssh/dist/ssh-agent.117
-rw-r--r--crypto/external/bsd/openssh/dist/ssh-agent.c32
-rw-r--r--crypto/external/bsd/openssh/dist/ssh-dss.c16
-rw-r--r--crypto/external/bsd/openssh/dist/ssh-ecdsa.c19
-rw-r--r--crypto/external/bsd/openssh/dist/ssh-keygen.120
-rw-r--r--crypto/external/bsd/openssh/dist/ssh-keygen.c375
-rw-r--r--crypto/external/bsd/openssh/dist/ssh-keyscan.110
-rw-r--r--crypto/external/bsd/openssh/dist/ssh-keyscan.c82
-rw-r--r--crypto/external/bsd/openssh/dist/ssh-keysign.88
-rw-r--r--crypto/external/bsd/openssh/dist/ssh-keysign.c36
-rw-r--r--crypto/external/bsd/openssh/dist/ssh-pkcs11-client.c9
-rw-r--r--crypto/external/bsd/openssh/dist/ssh-pkcs11-helper.c8
-rw-r--r--crypto/external/bsd/openssh/dist/ssh-pkcs11.c13
-rw-r--r--crypto/external/bsd/openssh/dist/ssh-rsa.c154
-rw-r--r--crypto/external/bsd/openssh/dist/ssh.199
-rw-r--r--crypto/external/bsd/openssh/dist/ssh.c132
-rw-r--r--crypto/external/bsd/openssh/dist/ssh.h12
-rw-r--r--crypto/external/bsd/openssh/dist/ssh2.h5
-rw-r--r--crypto/external/bsd/openssh/dist/ssh_api.c21
-rw-r--r--crypto/external/bsd/openssh/dist/ssh_config8
-rw-r--r--crypto/external/bsd/openssh/dist/ssh_config.5145
-rw-r--r--crypto/external/bsd/openssh/dist/sshbuf-getput-basic.c10
-rw-r--r--crypto/external/bsd/openssh/dist/sshbuf-getput-crypto.c4
-rw-r--r--crypto/external/bsd/openssh/dist/sshbuf-misc.c12
-rw-r--r--crypto/external/bsd/openssh/dist/sshbuf.c10
-rw-r--r--crypto/external/bsd/openssh/dist/sshbuf.h37
-rw-r--r--crypto/external/bsd/openssh/dist/sshconnect.c75
-rw-r--r--crypto/external/bsd/openssh/dist/sshconnect.h6
-rw-r--r--crypto/external/bsd/openssh/dist/sshconnect1.c20
-rw-r--r--crypto/external/bsd/openssh/dist/sshconnect2.c278
-rw-r--r--crypto/external/bsd/openssh/dist/sshd.857
-rw-r--r--crypto/external/bsd/openssh/dist/sshd.c88
-rw-r--r--crypto/external/bsd/openssh/dist/sshd_config6
-rw-r--r--crypto/external/bsd/openssh/dist/sshd_config.566
-rw-r--r--crypto/external/bsd/openssh/dist/ssherr.c6
-rw-r--r--crypto/external/bsd/openssh/dist/sshkey.c215
-rw-r--r--crypto/external/bsd/openssh/dist/sshlogin.c11
-rw-r--r--crypto/external/bsd/openssh/dist/version.h8
-rw-r--r--crypto/external/bsd/openssh/dist/xmalloc.c17
-rw-r--r--crypto/external/bsd/openssh/dist/xmalloc.h5
88 files changed, 2373 insertions, 1395 deletions
diff --git a/crypto/external/bsd/openssh/dist/auth-bsdauth.c b/crypto/external/bsd/openssh/dist/auth-bsdauth.c
index 75500724cc0..5667e0b305a 100644
--- a/crypto/external/bsd/openssh/dist/auth-bsdauth.c
+++ b/crypto/external/bsd/openssh/dist/auth-bsdauth.c
@@ -1,5 +1,6 @@
-/* $NetBSD: auth-bsdauth.c,v 1.4 2015/04/03 23:58:19 christos Exp $ */
-/* $OpenBSD: auth-bsdauth.c,v 1.13 2014/06/24 01:13:21 djm Exp $ */
+/* $NetBSD: auth-bsdauth.c,v 1.5 2016/03/11 01:55:00 christos Exp $ */
+/* $OpenBSD: auth-bsdauth.c,v 1.14 2015/10/20 23:24:25 mmcc Exp $ */
+
/*
* Copyright (c) 2001 Markus Friedl. All rights reserved.
*
@@ -25,7 +26,7 @@
*/
#include "includes.h"
-__RCSID("$NetBSD: auth-bsdauth.c,v 1.4 2015/04/03 23:58:19 christos Exp $");
+__RCSID("$NetBSD: auth-bsdauth.c,v 1.5 2016/03/11 01:55:00 christos Exp $");
#include <sys/types.h>
#include <stdarg.h>
#include <stdio.h>
@@ -102,7 +103,7 @@ bsdauth_respond(void *ctx, u_int numresponses, char **responses)
if (!authctxt->valid)
return -1;
- if (authctxt->as == 0)
+ if (authctxt->as == NULL)
error("bsdauth_respond: no bsd auth session");
if (numresponses != 1)
diff --git a/crypto/external/bsd/openssh/dist/auth-krb5.c b/crypto/external/bsd/openssh/dist/auth-krb5.c
index ff533e81ca9..dc6ea29314e 100644
--- a/crypto/external/bsd/openssh/dist/auth-krb5.c
+++ b/crypto/external/bsd/openssh/dist/auth-krb5.c
@@ -1,9 +1,10 @@
-/* $NetBSD: auth-krb5.c,v 1.7 2015/04/03 23:58:19 christos Exp $ */
-/* $OpenBSD: auth-krb5.c,v 1.20 2013/07/20 01:55:13 djm Exp $ */
+/* $NetBSD: auth-krb5.c,v 1.8 2016/03/11 01:55:00 christos Exp $ */
+/* $OpenBSD: auth-krb5.c,v 1.21 2016/01/27 06:44:58 djm Exp $ */
+
/*
* Kerberos v5 authentication and ticket-passing routines.
*
- * $FreeBSD: src/crypto/openssh/auth-krb5.c,v 1.6 2001/02/13 16:58:04 assar Exp $
+ * From: FreeBSD: src/crypto/openssh/auth-krb5.c,v 1.6 2001/02/13 16:58:04 assar
*/
/*
* Copyright (c) 2002 Daniel Kouril. All rights reserved.
@@ -30,7 +31,7 @@
*/
#include "includes.h"
-__RCSID("$NetBSD: auth-krb5.c,v 1.7 2015/04/03 23:58:19 christos Exp $");
+__RCSID("$NetBSD: auth-krb5.c,v 1.8 2016/03/11 01:55:00 christos Exp $");
#include <sys/types.h>
#include <pwd.h>
#include <stdarg.h>
diff --git a/crypto/external/bsd/openssh/dist/auth-options.c b/crypto/external/bsd/openssh/dist/auth-options.c
index 104c4917bc2..5bddf0e062f 100644
--- a/crypto/external/bsd/openssh/dist/auth-options.c
+++ b/crypto/external/bsd/openssh/dist/auth-options.c
@@ -1,5 +1,6 @@
-/* $NetBSD: auth-options.c,v 1.11 2015/08/13 10:33:21 christos Exp $ */
-/* $OpenBSD: auth-options.c,v 1.68 2015/07/03 03:43:18 djm Exp $ */
+/* $NetBSD: auth-options.c,v 1.12 2016/03/11 01:55:00 christos Exp $ */
+/* $OpenBSD: auth-options.c,v 1.70 2015/12/10 17:08:40 mmcc Exp $ */
+
/*
* Author: Tatu Ylonen <ylo@cs.hut.fi>
* Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
@@ -12,7 +13,7 @@
*/
#include "includes.h"
-__RCSID("$NetBSD: auth-options.c,v 1.11 2015/08/13 10:33:21 christos Exp $");
+__RCSID("$NetBSD: auth-options.c,v 1.12 2016/03/11 01:55:00 christos Exp $");
#include <sys/types.h>
#include <sys/queue.h>
@@ -76,19 +77,45 @@ auth_clear_options(void)
free(ce->s);
free(ce);
}
- if (forced_command) {
- free(forced_command);
- forced_command = NULL;
- }
- if (authorized_principals) {
- free(authorized_principals);
- authorized_principals = NULL;
- }
+ free(forced_command);
+ forced_command = NULL;
+ free(authorized_principals);
+ authorized_principals = NULL;
forced_tun_device = -1;
channel_clear_permitted_opens();
}
/*
+ * Match flag 'opt' in *optsp, and if allow_negate is set then also match
+ * 'no-opt'. Returns -1 if option not matched, 1 if option matches or 0
+ * if negated option matches.
+ * If the option or negated option matches, then *optsp is updated to
+ * point to the first character after the option and, if 'msg' is not NULL
+ * then a message based on it added via auth_debug_add().
+ */
+static int
+match_flag(const char *opt, int allow_negate, const char **optsp, const char *msg)
+{
+ size_t opt_len = strlen(opt);
+ const char *opts = *optsp;
+ int negate = 0;
+
+ if (allow_negate && strncasecmp(opts, "no-", 3) == 0) {
+ opts += 3;
+ negate = 1;
+ }
+ if (strncasecmp(opts, opt, opt_len) == 0) {
+ *optsp = opts + opt_len;
+ if (msg != NULL) {
+ auth_debug_add("%s %s.", msg,
+ negate ? "disabled" : "enabled");
+ }
+ return negate ? 0 : 1;
+ }
+ return -1;
+}
+
+/*
* return 1 if access is granted, 0 if not.
* side effect: sets key option flags
*/
@@ -97,7 +124,7 @@ auth_parse_options(struct passwd *pw, const char *opts, const char *file,
u_long linenum)
{
const char *cp;
- int i;
+ int i, r;
/* reset options */
auth_clear_options();
@@ -106,52 +133,48 @@ auth_parse_options(struct passwd *pw, const char *opts, const char *file,
return 1;
while (*opts && *opts != ' ' && *opts != '\t') {
- cp = "cert-authority";
- if (strncasecmp(opts, cp, strlen(cp)) == 0) {
- key_is_cert_authority = 1;
- opts += strlen(cp);
+ if ((r = match_flag("cert-authority", 0, &opts, NULL)) != -1) {
+ key_is_cert_authority = r;
goto next_option;
}
- cp = "no-port-forwarding";
- if (strncasecmp(opts, cp, strlen(cp)) == 0) {
- auth_debug_add("Port forwarding disabled.");
+ if ((r = match_flag("restrict", 0, &opts, NULL)) != -1) {
+ auth_debug_add("Key is restricted.");
no_port_forwarding_flag = 1;
- opts += strlen(cp);
+ no_agent_forwarding_flag = 1;
+ no_x11_forwarding_flag = 1;
+ no_pty_flag = 1;
+ no_user_rc = 1;
goto next_option;
}
- cp = "no-agent-forwarding";
- if (strncasecmp(opts, cp, strlen(cp)) == 0) {
- auth_debug_add("Agent forwarding disabled.");
- no_agent_forwarding_flag = 1;
- opts += strlen(cp);
+ if ((r = match_flag("port-forwarding", 1, &opts,
+ "Port forwarding")) != -1) {
+ no_port_forwarding_flag = r != 1;
goto next_option;
}
- cp = "no-X11-forwarding";
- if (strncasecmp(opts, cp, strlen(cp)) == 0) {
- auth_debug_add("X11 forwarding disabled.");
- no_x11_forwarding_flag = 1;
- opts += strlen(cp);
+ if ((r = match_flag("agent-forwarding", 1, &opts,
+ "Agent forwarding")) != -1) {
+ no_agent_forwarding_flag = r != 1;
goto next_option;
}
- cp = "no-pty";
- if (strncasecmp(opts, cp, strlen(cp)) == 0) {
- auth_debug_add("Pty allocation disabled.");
- no_pty_flag = 1;
- opts += strlen(cp);
+ if ((r = match_flag("x11-forwarding", 1, &opts,
+ "X11 forwarding")) != -1) {
+ no_x11_forwarding_flag = r != 1;
goto next_option;
}
- cp = "no-user-rc";
- if (strncasecmp(opts, cp, strlen(cp)) == 0) {
- auth_debug_add("User rc file execution disabled.");
- no_user_rc = 1;
- opts += strlen(cp);
+ if ((r = match_flag("pty", 1, &opts,
+ "PTY allocation")) != -1) {
+ no_pty_flag = r != 1;
+ goto next_option;
+ }
+ if ((r = match_flag("user-rc", 1, &opts,
+ "User rc execution")) != -1) {
+ no_user_rc = r != 1;
goto next_option;
}
cp = "command=\"";
if (strncasecmp(opts, cp, strlen(cp)) == 0) {
opts += strlen(cp);
- if (forced_command != NULL)
- free(forced_command);
+ free(forced_command);
forced_command = xmalloc(strlen(opts) + 1);
i = 0;
while (*opts) {
@@ -181,8 +204,7 @@ auth_parse_options(struct passwd *pw, const char *opts, const char *file,
cp = "principals=\"";
if (strncasecmp(opts, cp, strlen(cp)) == 0) {
opts += strlen(cp);
- if (authorized_principals != NULL)
- free(authorized_principals);
+ free(authorized_principals);
authorized_principals = xmalloc(strlen(opts) + 1);
i = 0;
while (*opts) {
@@ -568,8 +590,7 @@ parse_option_list(struct sshbuf *oblob, struct passwd *pw,
free(*cert_forced_command);
*cert_forced_command = NULL;
}
- if (name != NULL)
- free(name);
+ free(name);
sshbuf_free(data);
sshbuf_free(c);
return ret;
@@ -613,8 +634,7 @@ auth_cert_options(struct sshkey *k, struct passwd *pw)
no_user_rc |= cert_no_user_rc;
/* CA-specified forced command supersedes key option */
if (cert_forced_command != NULL) {
- if (forced_command != NULL)
- free(forced_command);
+ free(forced_command);
forced_command = cert_forced_command;
}
return 0;
diff --git a/crypto/external/bsd/openssh/dist/auth.h b/crypto/external/bsd/openssh/dist/auth.h
index bde1d3090af..271a93891bf 100644
--- a/crypto/external/bsd/openssh/dist/auth.h
+++ b/crypto/external/bsd/openssh/dist/auth.h
@@ -1,5 +1,5 @@
-/* $NetBSD: auth.h,v 1.11 2015/07/03 00:59:59 christos Exp $ */
-/* $OpenBSD: auth.h,v 1.84 2015/05/08 06:41:56 djm Exp $ */
+/* $NetBSD: auth.h,v 1.12 2016/03/11 01:55:00 christos Exp $ */
+/* $OpenBSD: auth.h,v 1.86 2015/12/04 16:41:28 markus Exp $ */
/*
* Copyright (c) 2000 Markus Friedl. All rights reserved.
@@ -188,8 +188,6 @@ int auth2_challenge(Authctxt *, char *);
void auth2_challenge_stop(Authctxt *);
int bsdauth_query(void *, char **, char **, u_int *, char ***, u_int **);
int bsdauth_respond(void *, u_int, char **);
-int skey_query(void *, char **, char **, u_int *, char ***, u_int **);
-int skey_respond(void *, u_int, char **);
int allowed_user(struct passwd *);
struct passwd * getpwnamallow(const char *user);
@@ -216,7 +214,7 @@ Key *get_hostkey_private_by_type(int, int, struct ssh *);
int get_hostkey_index(Key *, int, struct ssh *);
int ssh1_session_key(BIGNUM *);
int sshd_hostkey_sign(Key *, Key *, u_char **, size_t *,
- const u_char *, size_t, u_int);
+ const u_char *, size_t, const char *, u_int);
/* debug messages during authentication */
void auth_debug_add(const char *fmt,...) __attribute__((format(printf, 1, 2)));
diff --git a/crypto/external/bsd/openssh/dist/auth2-pubkey.c b/crypto/external/bsd/openssh/dist/auth2-pubkey.c
index 82f0c411280..b42ba48b568 100644
--- a/crypto/external/bsd/openssh/dist/auth2-pubkey.c
+++ b/crypto/external/bsd/openssh/dist/auth2-pubkey.c
@@ -1,5 +1,6 @@
-/* $NetBSD: auth2-pubkey.c,v 1.13 2015/07/06 15:09:17 christos Exp $ */
-/* $OpenBSD: auth2-pubkey.c,v 1.53 2015/06/15 18:44:22 jsing Exp $ */
+/* $NetBSD: auth2-pubkey.c,v 1.14 2016/03/11 01:55:00 christos Exp $ */
+/* $OpenBSD: auth2-pubkey.c,v 1.55 2016/01/27 00:53:12 djm Exp $ */
+
/*
* Copyright (c) 2000 Markus Friedl. All rights reserved.
*
@@ -25,7 +26,7 @@
*/
#include "includes.h"
-__RCSID("$NetBSD: auth2-pubkey.c,v 1.13 2015/07/06 15:09:17 christos Exp $");
+__RCSID("$NetBSD: auth2-pubkey.c,v 1.14 2016/03/11 01:55:00 christos Exp $");
#include <sys/types.h>
#include <sys/stat.h>
#include <sys/wait.h>
@@ -84,19 +85,19 @@ userauth_pubkey(Authctxt *authctxt)
{
Buffer b;
Key *key = NULL;
- char *pkalg, *userstyle;
+ char *pkalg, *userstyle, *fp = NULL;
u_char *pkblob, *sig;
u_int alen, blen, slen;
int have_sig, pktype;
int authenticated = 0;
if (!authctxt->valid) {
- debug2("userauth_pubkey: disabled because of invalid user");
+ debug2("%s: disabled because of invalid user", __func__);
return 0;
}
have_sig = packet_get_char();
if (datafellows & SSH_BUG_PKAUTH) {
- debug2("userauth_pubkey: SSH_BUG_PKAUTH");
+ debug2("%s: SSH_BUG_PKAUTH", __func__);
/* no explicit pkalg given */
pkblob = packet_get_string(&blen);
buffer_init(&b);
@@ -111,18 +112,18 @@ userauth_pubkey(Authctxt *authctxt)
pktype = key_type_from_name(pkalg);
if (pktype == KEY_UNSPEC) {
/* this is perfectly legal */
- logit("userauth_pubkey: unsupported public key algorithm: %s",
- pkalg);
+ logit("%s: unsupported public key algorithm: %s",
+ __func__, pkalg);
goto done;
}
key = key_from_blob(pkblob, blen);
if (key == NULL) {
- error("userauth_pubkey: cannot decode key: %s", pkalg);
+ error("%s: cannot decode key: %s", __func__, pkalg);
goto done;
}
if (key->type != pktype) {
- error("userauth_pubkey: type mismatch for decoded key "
- "(received %d, expected %d)", key->type, pktype);
+ error("%s: type mismatch for decoded key "
+ "(received %d, expected %d)", __func__, key->type, pktype);
goto done;
}
if (key_type_plain(key->type) == KEY_RSA &&
@@ -131,6 +132,7 @@ userauth_pubkey(Authctxt *authctxt)
"signature scheme");
goto done;
}
+ fp = sshkey_fingerprint(key, options.fingerprint_hash, SSH_FP_DEFAULT);
if (auth2_userkey_already_used(authctxt, key)) {
logit("refusing previously-used %s key", key_type(key));
goto done;
@@ -143,6 +145,8 @@ userauth_pubkey(Authctxt *authctxt)
}
if (have_sig) {
+ debug3("%s: have signature for %s %s",
+ __func__, sshkey_type(key), fp);
sig = packet_get_string(&slen);
packet_check_eom();
buffer_init(&b);
@@ -188,7 +192,8 @@ userauth_pubkey(Authctxt *authctxt)
buffer_free(&b);
free(sig);
} else {
- debug("test whether pkalg/pkblob are acceptable");
+ debug("%s: test whether pkalg/pkblob are acceptable for %s %s",
+ __func__, sshkey_type(key), fp);
packet_check_eom();
/* XXX fake reply and always send PK_OK ? */
@@ -211,11 +216,12 @@ userauth_pubkey(Authctxt *authctxt)
if (authenticated != 1)
auth_clear_options();
done:
- debug2("userauth_pubkey: authenticated %d pkalg %s", authenticated, pkalg);
+ debug2("%s: authenticated %d pkalg %s", __func__, authenticated, pkalg);
if (key != NULL)
key_free(key);
free(pkalg);
free(pkblob);
+ free(fp);
return authenticated;
}
@@ -881,8 +887,9 @@ check_authkeys_file(FILE *f, char *file, Key* key, struct passwd *pw)
free(fp);
continue;
}
- verbose("Accepted certificate ID \"%s\" "
+ verbose("Accepted certificate ID \"%s\" (serial %llu) "
"signed by %s CA %s via %s", key->cert->key_id,
+ (unsigned long long)key->cert->serial,
key_type(found), fp, file);
free(fp);
found_key = 1;
@@ -960,8 +967,10 @@ user_cert_trusted_ca(struct passwd *pw, Key *key)
if (auth_cert_options(key, pw) != 0)
goto out;
- verbose("Accepted certificate ID \"%s\" signed by %s CA %s via %s",
- key->cert->key_id, key_type(key->cert->signature_key), ca_fp,
+ verbose("Accepted certificate ID \"%s\" (serial %llu) signed by "
+ "%s CA %s via %s", key->cert->key_id,
+ (unsigned long long)key->cert->serial,
+ key_type(key->cert->signature_key), ca_fp,
options.trusted_user_ca_keys);
ret = 1;
diff --git a/crypto/external/bsd/openssh/dist/authfd.c b/crypto/external/bsd/openssh/dist/authfd.c
index 3f0f0ab090c..20d02452b86 100644
--- a/crypto/external/bsd/openssh/dist/authfd.c
+++ b/crypto/external/bsd/openssh/dist/authfd.c
@@ -1,5 +1,6 @@
-/* $NetBSD: authfd.c,v 1.10 2015/08/13 10:33:21 christos Exp $ */
-/* $OpenBSD: authfd.c,v 1.98 2015/07/03 03:43:18 djm Exp $ */
+/* $NetBSD: authfd.c,v 1.11 2016/03/11 01:55:00 christos Exp $ */
+/* $OpenBSD: authfd.c,v 1.100 2015/12/04 16:41:28 markus Exp $ */
+
/*
* Author: Tatu Ylonen <ylo@cs.hut.fi>
* Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
@@ -37,7 +38,7 @@
*/
#include "includes.h"
-__RCSID("$NetBSD: authfd.c,v 1.10 2015/08/13 10:33:21 christos Exp $");
+__RCSID("$NetBSD: authfd.c,v 1.11 2016/03/11 01:55:00 christos Exp $");
#include <sys/types.h>
#include <sys/un.h>
#include <sys/socket.h>
@@ -426,11 +427,24 @@ ssh_decrypt_challenge(int sock, struct sshkey* key, BIGNUM *challenge,
}
#endif
+/* encode signature algoritm in flag bits, so we can keep the msg format */
+static u_int
+agent_encode_alg(struct sshkey *key, const char *alg)
+{
+ if (alg != NULL && key->type == KEY_RSA) {
+ if (strcmp(alg, "rsa-sha2-256") == 0)
+ return SSH_AGENT_RSA_SHA2_256;
+ else if (strcmp(alg, "rsa-sha2-512") == 0)
+ return SSH_AGENT_RSA_SHA2_512;
+ }
+ return 0;
+}
+
/* ask agent to sign data, returns err.h code on error, 0 on success */
int
ssh_agent_sign(int sock, struct sshkey *key,
u_char **sigp, size_t *lenp,
- const u_char *data, size_t datalen, u_int compat)
+ const u_char *data, size_t datalen, const char *alg, u_int compat)
{
struct sshbuf *msg;
u_char *blob = NULL, type;
@@ -449,12 +463,13 @@ ssh_agent_sign(int sock, struct sshkey *key,
return SSH_ERR_ALLOC_FAIL;
if ((r = sshkey_to_blob(key, &blob, &blen)) != 0)
goto out;
+ flags |= agent_encode_alg(key, alg);
if ((r = sshbuf_put_u8(msg, SSH2_AGENTC_SIGN_REQUEST)) != 0 ||
(r = sshbuf_put_string(msg, blob, blen)) != 0 ||
(r = sshbuf_put_string(msg, data, datalen)) != 0 ||
(r = sshbuf_put_u32(msg, flags)) != 0)
goto out;
- if ((r = ssh_request_reply(sock, msg, msg) != 0))
+ if ((r = ssh_request_reply(sock, msg, msg)) != 0)
goto out;
if ((r = sshbuf_get_u8(msg, &type)) != 0)
goto out;
diff --git a/crypto/external/bsd/openssh/dist/authfd.h b/crypto/external/bsd/openssh/dist/authfd.h
index 8bb480d0534..f466fbe4342 100644
--- a/crypto/external/bsd/openssh/dist/authfd.h
+++ b/crypto/external/bsd/openssh/dist/authfd.h
@@ -1,5 +1,5 @@
-/* $NetBSD: authfd.h,v 1.5 2015/04/03 23:58:19 christos Exp $ */
-/* $OpenBSD: authfd.h,v 1.38 2015/01/14 20:05:27 djm Exp $ */
+/* $NetBSD: authfd.h,v 1.6 2016/03/11 01:55:00 christos Exp $ */
+/* $OpenBSD: authfd.h,v 1.39 2015/12/04 16:41:28 markus Exp $ */
/*
* Author: Tatu Ylonen <ylo@cs.hut.fi>
@@ -42,7 +42,7 @@ int ssh_decrypt_challenge(int sock, struct sshkey* key, BIGNUM *challenge,
u_char session_id[16], u_char response[16]);
int ssh_agent_sign(int sock, struct sshkey *key,
u_char **sigp, size_t *lenp,
- const u_char *data, size_t datalen, u_int compat);
+ const u_char *data, size_t datalen, const char *alg, u_int compat);
/* Messages for the authentication agent connection. */
#define SSH_AGENTC_REQUEST_RSA_IDENTITIES 1
@@ -87,5 +87,7 @@ int ssh_agent_sign(int sock, struct sshkey *key,
#define SSH_COM_AGENT2_FAILURE 102
#define SSH_AGENT_OLD_SIGNATURE 0x01
+#define SSH_AGENT_RSA_SHA2_256 0x02
+#define SSH_AGENT_RSA_SHA2_512 0x04
#endif /* AUTHFD_H */
diff --git a/crypto/external/bsd/openssh/dist/authfile.c b/crypto/external/bsd/openssh/dist/authfile.c
index e86860facd5..249a9612c88 100644
--- a/crypto/external/bsd/openssh/dist/authfile.c
+++ b/crypto/external/bsd/openssh/dist/authfile.c
@@ -1,5 +1,6 @@
-/* $NetBSD: authfile.c,v 1.12 2015/08/13 10:33:21 christos Exp $ */
-/* $OpenBSD: authfile.c,v 1.116 2015/07/09 09:49:46 markus Exp $ */
+/* $NetBSD: authfile.c,v 1.13 2016/03/11 01:55:00 christos Exp $ */
+/* $OpenBSD: authfile.c,v 1.120 2015/12/11 04:21:11 mmcc Exp $ */
+
/*
* Copyright (c) 2000, 2013 Markus Friedl. All rights reserved.
*
@@ -25,7 +26,7 @@
*/
#include "includes.h"
-__RCSID("$NetBSD: authfile.c,v 1.12 2015/08/13 10:33:21 christos Exp $");
+__RCSID("$NetBSD: authfile.c,v 1.13 2016/03/11 01:55:00 christos Exp $");
#include <sys/types.h>
#include <sys/stat.h>
#include <sys/uio.h>
@@ -240,8 +241,7 @@ sshkey_load_private_type_fd(int fd, int type, const char *passphrase,
/* success */
r = 0;
out:
- if (buffer != NULL)
- sshbuf_free(buffer);
+ sshbuf_free(buffer);
return r;
}
@@ -269,14 +269,13 @@ sshkey_load_private(const char *filename, const char *passphrase,
goto out;
}
if ((r = sshkey_load_file(fd, buffer)) != 0 ||
- (r = sshkey_parse_private_fileblob(buffer, passphrase, filename,
- keyp, commentp)) != 0)
+ (r = sshkey_parse_private_fileblob(buffer, passphrase, keyp,
+ commentp)) != 0)
goto out;
r = 0;
out:
close(fd);
- if (buffer != NULL)
- sshbuf_free(buffer);
+ sshbuf_free(buffer);
return r;
}
@@ -423,10 +422,8 @@ sshkey_load_cert(const char *filename, struct sshkey **keyp)
r = 0;
out:
- if (file != NULL)
- free(file);
- if (pub != NULL)
- sshkey_free(pub);
+ free(file);
+ sshkey_free(pub);
return r;
}
@@ -471,10 +468,8 @@ sshkey_load_private_cert(int type, const char *filename, const char *passphrase,
*keyp = key;
key = NULL;
out:
- if (key != NULL)
- sshkey_free(key);
- if (cert != NULL)
- sshkey_free(cert);
+ sshkey_free(key);
+ sshkey_free(cert);
return r;
}
@@ -535,8 +530,7 @@ sshkey_in_file(struct sshkey *key, const char *filename, int strict_type,
}
r = SSH_ERR_KEY_NOT_FOUND;
out:
- if (pub != NULL)
- sshkey_free(pub);
+ sshkey_free(pub);
fclose(f);
return r;
}
diff --git a/crypto/external/bsd/openssh/dist/bitmap.c b/crypto/external/bsd/openssh/dist/bitmap.c
index 9c6b1a4db75..a89684f0373 100644
--- a/crypto/external/bsd/openssh/dist/bitmap.c
+++ b/crypto/external/bsd/openssh/dist/bitmap.c
@@ -1,4 +1,4 @@
-/* $NetBSD: bitmap.c,v 1.2 2015/04/03 23:58:19 christos Exp $ */
+/* $NetBSD: bitmap.c,v 1.3 2016/03/11 01:55:00 christos Exp $ */
/*
* Copyright (c) 2015 Damien Miller <djm@mindrot.org>
*
@@ -15,7 +15,7 @@
* OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
*/
#include "includes.h"
-__RCSID("$NetBSD: bitmap.c,v 1.2 2015/04/03 23:58:19 christos Exp $");
+__RCSID("$NetBSD: bitmap.c,v 1.3 2016/03/11 01:55:00 christos Exp $");
#include <sys/types.h>
#include <string.h>
@@ -54,7 +54,7 @@ void
bitmap_free(struct bitmap *b)
{
if (b != NULL && b->d != NULL) {
- memset(b->d, 0, b->len);
+ explicit_bzero(b->d, b->len);
free(b->d);
}
free(b);
diff --git a/crypto/external/bsd/openssh/dist/channels.c b/crypto/external/bsd/openssh/dist/channels.c
index 048e031d002..680ebb831aa 100644
--- a/crypto/external/bsd/openssh/dist/channels.c
+++ b/crypto/external/bsd/openssh/dist/channels.c
@@ -1,5 +1,6 @@
-/* $NetBSD: channels.c,v 1.14 2015/07/03 00:59:59 christos Exp $ */
-/* $OpenBSD: channels.c,v 1.347 2015/07/01 02:26:31 djm Exp $ */
+/* $NetBSD: channels.c,v 1.15 2016/03/11 01:55:00 christos Exp $ */
+/* $OpenBSD: channels.c,v 1.349 2016/02/05 13:28:19 naddy Exp $ */
+
/*
* Author: Tatu Ylonen <ylo@cs.hut.fi>
* Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
@@ -41,7 +42,7 @@
*/
#include "includes.h"
-__RCSID("$NetBSD: channels.c,v 1.14 2015/07/03 00:59:59 christos Exp $");
+__RCSID("$NetBSD: channels.c,v 1.15 2016/03/11 01:55:00 christos Exp $");
#include <sys/param.h>
#include <sys/types.h>
#include <sys/param.h> /* MIN MAX */
@@ -662,7 +663,7 @@ channel_open_message(void)
case SSH_CHANNEL_INPUT_DRAINING:
case SSH_CHANNEL_OUTPUT_DRAINING:
snprintf(buf, sizeof buf,
- " #%d %.300s (t%d r%d i%d/%d o%d/%d fd %d/%d cc %d)\r\n",
+ " #%d %.300s (t%d r%d i%u/%d o%u/%d fd %d/%d cc %d)\r\n",
c->self, c->remote_name,
c->type, c->remote_id,
c->istate, buffer_len(&c->input),
@@ -1912,13 +1913,13 @@ read_mux(Channel *c, u_int need)
if (buffer_len(&c->input) < need) {
rlen = need - buffer_len(&c->input);
len = read(c->rfd, buf, MIN(rlen, CHAN_RBUF));
+ if (len < 0 && (errno == EINTR || errno == EAGAIN))
+ return buffer_len(&c->input);
if (len <= 0) {
- if (errno != EINTR && errno != EAGAIN) {
- debug2("channel %d: ctl read<=0 rfd %d len %d",
- c->self, c->rfd, len);
- chan_read_failed(c);
- return 0;
- }
+ debug2("channel %d: ctl read<=0 rfd %d len %d",
+ c->self, c->rfd, len);
+ chan_read_failed(c);
+ return 0;
} else
buffer_append(&c->input, buf, len);
}
diff --git a/crypto/external/bsd/openssh/dist/cipher.c b/crypto/external/bsd/openssh/dist/cipher.c
index aa0accc132b..27d038f435e 100644
--- a/crypto/external/bsd/openssh/dist/cipher.c
+++ b/crypto/external/bsd/openssh/dist/cipher.c
@@ -1,5 +1,6 @@
-/* $NetBSD: cipher.c,v 1.7 2015/04/03 23:58:19 christos Exp $ */
-/* $OpenBSD: cipher.c,v 1.100 2015/01/14 10:29:45 djm Exp $ */
+/* $NetBSD: cipher.c,v 1.8 2016/03/11 01:55:00 christos Exp $ */
+/* $OpenBSD: cipher.c,v 1.101 2015/12/10 17:08:40 mmcc Exp $ */
+
/*
* Author: Tatu Ylonen <ylo@cs.hut.fi>
* Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
@@ -37,7 +38,7 @@
*/
#include "includes.h"
-__RCSID("$NetBSD: cipher.c,v 1.7 2015/04/03 23:58:19 christos Exp $");
+__RCSID("$NetBSD: cipher.c,v 1.8 2016/03/11 01:55:00 christos Exp $");
#include <sys/types.h>
#include <string.h>
@@ -357,8 +358,7 @@ cipher_init(struct sshcipher_ctx *cc, const struct sshcipher *cipher,
if (cipher->discard_len > 0) {
if ((junk = malloc(cipher->discard_len)) == NULL ||
(discard = malloc(cipher->discard_len)) == NULL) {
- if (junk != NULL)
- free(junk);
+ free(junk);
ret = SSH_ERR_ALLOC_FAIL;
goto bad;
}
diff --git a/crypto/external/bsd/openssh/dist/clientloop.c b/crypto/external/bsd/openssh/dist/clientloop.c
index 639621950a6..a08f3151141 100644
--- a/crypto/external/bsd/openssh/dist/clientloop.c
+++ b/crypto/external/bsd/openssh/dist/clientloop.c
@@ -1,5 +1,6 @@
-/* $NetBSD: clientloop.c,v 1.17 2016/01/19 17:10:55 christos Exp $ */
-/* $OpenBSD: clientloop.c,v 1.275 2015/07/10 06:21:53 markus Exp $ */
+/* $NetBSD: clientloop.c,v 1.18 2016/03/11 01:55:00 christos Exp $ */
+/* $OpenBSD: clientloop.c,v 1.284 2016/02/08 10:57:07 djm Exp $ */
+
/*
* Author: Tatu Ylonen <ylo@cs.hut.fi>
* Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
@@ -61,7 +62,7 @@
*/
#include "includes.h"
-__RCSID("$NetBSD: clientloop.c,v 1.17 2016/01/19 17:10:55 christos Exp $");
+__RCSID("$NetBSD: clientloop.c,v 1.18 2016/03/11 01:55:00 christos Exp $");
#include <sys/param.h> /* MIN MAX */
#include <sys/types.h>
@@ -164,8 +165,6 @@ static u_int x11_refuse_time; /* If >0, refuse x11 opens after this time. */
static void client_init_dispatch(void);
int session_ident = -1;
-int session_resumed = 0;
-
/* Track escape per proto2 channel */
struct escape_filter_ctx {
int escape_pending;
@@ -316,8 +315,9 @@ client_x11_get_proto(const char *display, const char *xauth_path,
proto[0] = data[0] = xauthfile[0] = xauthdir[0] = '\0';
if (!client_x11_display_valid(display)) {
- logit("DISPLAY \"%s\" invalid; disabling X11 forwarding",
- display);
+ if (display != NULL)
+ logit("DISPLAY \"%s\" invalid; disabling X11 forwarding",
+ display);
return -1;
}
if (xauth_path != NULL && stat(xauth_path, &st) == -1) {
@@ -334,17 +334,21 @@ client_x11_get_proto(const char *display, const char *xauth_path,
* is not perfect.
*/
if (strncmp(display, "localhost:", 10) == 0) {
- snprintf(xdisplay, sizeof(xdisplay), "unix:%s",
- display + 10);
+ if ((r = snprintf(xdisplay, sizeof(xdisplay), "unix:%s",
+ display + 10)) < 0 ||
+ (size_t)r >= sizeof(xdisplay)) {
+ error("%s: display name too long", __func__);
+ return -1;
+ }
display = xdisplay;
}
if (trusted == 0) {
/*
* Generate an untrusted X11 auth cookie.
*
- * The authentication cookie should briefly outlive
- * ssh's willingness to forward X11 connections to
- * avoid nasty fail-open behaviour in the X server.
+ * The authentication cookie should briefly outlive
+ * ssh's willingness to forward X11 connections to
+ * avoid nasty fail-open behaviour in the X server.
*/
mktemp_proto(xauthdir, sizeof(xauthdir));
if (mkdtemp(xauthdir) == NULL) {
@@ -366,7 +370,6 @@ client_x11_get_proto(const char *display, const char *xauth_path,
x11_timeout_real = UINT_MAX;
else
x11_timeout_real = timeout + X11_TIMEOUT_SLACK;
-
if ((r = snprintf(cmd, sizeof(cmd),
"%s -f %s generate %s " SSH_X11_PROTO
" untrusted timeout %u 2>" _PATH_DEVNULL,
@@ -1496,13 +1499,45 @@ client_loop(int have_pty, int escape_char_arg, int ssh2_chan_id)
{
fd_set *readset = NULL, *writeset = NULL;
double start_time, total_time;
- int r, max_fd = 0, max_fd2 = 0, len, rekeying = 0;
+ int r, max_fd = 0, max_fd2 = 0, len;
u_int64_t ibytes, obytes;
u_int nalloc = 0;
char buf[100];
debug("Entering interactive session.");
+#ifdef __OpenBSD__
+ if (options.control_master &&
+ ! option_clear_or_none(options.control_path)) {
+ debug("pledge: id");
+ if (pledge("stdio rpath wpath cpath unix inet dns proc exec id tty",
+ NULL) == -1)
+ fatal("%s pledge(): %s", __func__, strerror(errno));
+
+ } else if (options.forward_x11 || options.permit_local_command) {
+ debug("pledge: exec");
+ if (pledge("stdio rpath wpath cpath unix inet dns proc exec tty",
+ NULL) == -1)
+ fatal("%s pledge(): %s", __func__, strerror(errno));
+
+ } else if (options.update_hostkeys) {
+ debug("pledge: filesystem full");
+ if (pledge("stdio rpath wpath cpath unix inet dns proc tty",
+ NULL) == -1)
+ fatal("%s pledge(): %s", __func__, strerror(errno));
+
+ } else if (! option_clear_or_none(options.proxy_command)) {
+ debug("pledge: proc");
+ if (pledge("stdio cpath unix inet dns proc tty", NULL) == -1)
+ fatal("%s pledge(): %s", __func__, strerror(errno));
+
+ } else {
+ debug("pledge: network");
+ if (pledge("stdio unix inet dns tty", NULL) == -1)
+ fatal("%s pledge(): %s", __func__, strerror(errno));
+ }
+#endif
+
start_time = get_current_time();
/* Initialize variables. */
@@ -1581,10 +1616,15 @@ client_loop(int have_pty, int escape_char_arg, int ssh2_chan_id)
if (compat20 && session_closed && !channel_still_open())
break;
- rekeying = (active_state->kex != NULL && !active_state->kex->done);
-
- if (rekeying) {
+ if (ssh_packet_is_rekeying(active_state)) {
debug("rekeying in progress");
+ } else if (need_rekeying) {
+ /* manual rekey request */
+ debug("need rekeying");
+ if ((r = kex_start_rekex(active_state)) != 0)
+ fatal("%s: kex_start_rekex: %s", __func__,
+ ssh_err(r));
+ need_rekeying = 0;
} else {
/*
* Make packets of buffered stdin data, and buffer
@@ -1615,24 +1655,14 @@ client_loop(int have_pty, int escape_char_arg, int ssh2_chan_id)
*/
max_fd2 = max_fd;
client_wait_until_can_do_something(&readset, &writeset,
- &max_fd2, &nalloc, rekeying);
+ &max_fd2, &nalloc, ssh_packet_is_rekeying(active_state));
if (quit_pending)
break;
/* Do channel operations unless rekeying in progress. */
- if (!rekeying) {
+ if (!ssh_packet_is_rekeying(active_state))
channel_after_select(readset, writeset);
- if (need_rekeying || packet_need_rekeying()) {
- debug("need rekeying");
- if (active_state->kex != NULL)
- active_state->kex->done = 0;
- if ((r = kex_send_kexinit(active_state)) != 0)
- fatal("%s: kex_send_kexinit: %s",
- __func__, ssh_err(r));
- need_rekeying = 0;
- }
- }
/* Buffer input from the connection. */
client_process_net_input(readset);
@@ -1650,14 +1680,6 @@ client_loop(int have_pty, int escape_char_arg, int ssh2_chan_id)
client_process_output(writeset);
}
- if (session_resumed) {
- connection_in = packet_get_connection_in();
- connection_out = packet_get_connection_out();
- max_fd = MAX(max_fd, connection_out);
- max_fd = MAX(max_fd, connection_in);
- session_resumed = 0;
- }
-
/*
* Send as much buffered packet data as possible to the
* sender.
@@ -1751,7 +1773,7 @@ client_loop(int have_pty, int escape_char_arg, int ssh2_chan_id)
}
/* Clear and free any buffers. */
- memset(buf, 0, sizeof(buf));
+ explicit_bzero(buf, sizeof(buf));
buffer_free(&stdin_buffer);
buffer_free(&stdout_buffer);
buffer_free(&stderr_buffer);
diff --git a/crypto/external/bsd/openssh/dist/clientloop.h b/crypto/external/bsd/openssh/dist/clientloop.h
index e73226008db..008b946c8b7 100644
--- a/crypto/external/bsd/openssh/dist/clientloop.h
+++ b/crypto/external/bsd/openssh/dist/clientloop.h
@@ -1,5 +1,5 @@
-/* $NetBSD: clientloop.h,v 1.11 2016/01/19 17:10:55 christos Exp $ */
-/* $OpenBSD: clientloop.h,v 1.31 2013/06/02 23:36:29 dtucker Exp $ */
+/* $NetBSD: clientloop.h,v 1.12 2016/03/11 01:55:00 christos Exp $ */
+/* $OpenBSD: clientloop.h,v 1.32 2016/01/13 23:04:47 djm Exp $ */
/*
* Author: Tatu Ylonen <ylo@cs.hut.fi>
diff --git a/crypto/external/bsd/openssh/dist/dh.h b/crypto/external/bsd/openssh/dist/dh.h
index 676dedc5d23..38e26641d26 100644
--- a/crypto/external/bsd/openssh/dist/dh.h
+++ b/crypto/external/bsd/openssh/dist/dh.h
@@ -1,5 +1,5 @@
-/* $NetBSD: dh.h,v 1.5 2015/07/03 01:00:00 christos Exp $ */
-/* $OpenBSD: dh.h,v 1.13 2015/05/27 23:39:18 dtucker Exp $ */
+/* $NetBSD: dh.h,v 1.6 2016/03/11 01:55:00 christos Exp $ */
+/* $OpenBSD: dh.h,v 1.14 2015/10/16 22:32:22 djm Exp $ */
/*
* Copyright (c) 2000 Niels Provos. All rights reserved.
@@ -45,8 +45,11 @@ int dh_pub_is_valid(DH *, BIGNUM *);
u_int dh_estimate(int);
-/* Min and max values from RFC4419. */
-#define DH_GRP_MIN 1024
+/*
+ * Max value from RFC4419.
+ * Miniumum increased in light of DH precomputation attacks.
+ */
+#define DH_GRP_MIN 2048
#define DH_GRP_MAX 8192
/*
diff --git a/crypto/external/bsd/openssh/dist/kex.c b/crypto/external/bsd/openssh/dist/kex.c
index 952ec64d728..1257cd67edb 100644
--- a/crypto/external/bsd/openssh/dist/kex.c
+++ b/crypto/external/bsd/openssh/dist/kex.c
@@ -1,5 +1,6 @@
-/* $NetBSD: kex.c,v 1.13 2016/01/14 22:30:04 christos Exp $ */
-/* $OpenBSD: kex.c,v 1.109 2015/07/30 00:01:34 djm Exp $ */
+/* $NetBSD: kex.c,v 1.14 2016/03/11 01:55:00 christos Exp $ */
+/* $OpenBSD: kex.c,v 1.117 2016/02/08 10:57:07 djm Exp $ */
+
/*
* Copyright (c) 2000, 2001 Markus Friedl. All rights reserved.
*
@@ -25,7 +26,7 @@
*/
#include "includes.h"
-__RCSID("$NetBSD: kex.c,v 1.13 2016/01/14 22:30:04 christos Exp $");
+__RCSID("$NetBSD: kex.c,v 1.14 2016/03/11 01:55:00 christos Exp $");
#include <sys/param.h> /* MAX roundup */
#include <signal.h>
@@ -59,6 +60,19 @@ __RCSID("$NetBSD: kex.c,v 1.13 2016/01/14 22:30:04 christos Exp $");
static int kex_choose_conf(struct ssh *);
static int kex_input_newkeys(int, u_int32_t, void *);
+static const char *proposal_names[PROPOSAL_MAX] = {
+ "KEX algorithms",
+ "host key algorithms",
+ "ciphers ctos",
+ "ciphers stoc",
+ "MACs ctos",
+ "MACs stoc",
+ "compression ctos",
+ "compression stoc",
+ "languages ctos",
+ "languages stoc",
+};
+
struct kexalg {
const char *name;
u_int type;
@@ -251,16 +265,16 @@ kex_buf2prop(struct sshbuf *raw, int *first_kex_follows, char ***propp)
for (i = 0; i < PROPOSAL_MAX; i++) {
if ((r = sshbuf_get_cstring(b, &(proposal[i]), NULL)) != 0)
goto out;
- debug2("kex_parse_kexinit: %s", proposal[i]);
+ debug2("%s: %s", proposal_names[i], proposal[i]);
}
/* first kex follows / reserved */
- if ((r = sshbuf_get_u8(b, &v)) != 0 ||
- (r = sshbuf_get_u32(b, &i)) != 0)
+ if ((r = sshbuf_get_u8(b, &v)) != 0 || /* first_kex_follows */
+ (r = sshbuf_get_u32(b, &i)) != 0) /* reserved */
goto out;
if (first_kex_follows != NULL)
- *first_kex_follows = i;
- debug2("kex_parse_kexinit: first_kex_follows %d ", v);
- debug2("kex_parse_kexinit: reserved %u ", i);
+ *first_kex_follows = v;
+ debug2("first_kex_follows %d ", v);
+ debug2("reserved %u ", i);
r = 0;
*propp = proposal;
out:
@@ -286,7 +300,14 @@ kex_prop_free(char **proposal)
static int
kex_protocol_error(int type, u_int32_t seq, void *ctxt)
{
- error("Hm, kex protocol error: type %d seq %u", type, seq);
+ struct ssh *ssh = active_state; /* XXX */
+ int r;
+
+ error("kex protocol error: type %d seq %u", type, seq);
+ if ((r = sshpkt_start(ssh, SSH2_MSG_UNIMPLEMENTED)) != 0 ||
+ (r = sshpkt_put_u32(ssh, seq)) != 0 ||
+ (r = sshpkt_send(ssh)) != 0)
+ return r;
return 0;
}
@@ -298,6 +319,20 @@ kex_reset_dispatch(struct ssh *ssh)
ssh_dispatch_set(ssh, SSH2_MSG_KEXINIT, &kex_input_kexinit);
}
+static int
+kex_send_ext_info(struct ssh *ssh)
+{
+ int r;
+
+ if ((r = sshpkt_start(ssh, SSH2_MSG_EXT_INFO)) != 0 ||
+ (r = sshpkt_put_u32(ssh, 1)) != 0 ||
+ (r = sshpkt_put_cstring(ssh, "server-sig-algs")) != 0 ||
+ (r = sshpkt_put_cstring(ssh, "rsa-sha2-256,rsa-sha2-512")) != 0 ||
+ (r = sshpkt_send(ssh)) != 0)
+ return r;
+ return 0;
+}
+
int
kex_send_newkeys(struct ssh *ssh)
{
@@ -310,9 +345,51 @@ kex_send_newkeys(struct ssh *ssh)
debug("SSH2_MSG_NEWKEYS sent");
debug("expecting SSH2_MSG_NEWKEYS");
ssh_dispatch_set(ssh, SSH2_MSG_NEWKEYS, &kex_input_newkeys);
+ if (ssh->kex->ext_info_c)
+ if ((r = kex_send_ext_info(ssh)) != 0)
+ return r;
return 0;
}
+int
+kex_input_ext_info(int type, u_int32_t seq, void *ctxt)
+{
+ struct ssh *ssh = ctxt;
+ struct kex *kex = ssh->kex;
+ u_int32_t i, ninfo;
+ char *name, *val, *found;
+ int r;
+
+ debug("SSH2_MSG_EXT_INFO received");
+ ssh_dispatch_set(ssh, SSH2_MSG_EXT_INFO, &kex_protocol_error);
+ if ((r = sshpkt_get_u32(ssh, &ninfo)) != 0)
+ return r;
+ for (i = 0; i < ninfo; i++) {
+ if ((r = sshpkt_get_cstring(ssh, &name, NULL)) != 0)
+ return r;
+ if ((r = sshpkt_get_cstring(ssh, &val, NULL)) != 0) {
+ free(name);
+ return r;
+ }
+ debug("%s: %s=<%s>", __func__, name, val);
+ if (strcmp(name, "server-sig-algs") == 0) {
+ found = match_list("rsa-sha2-256", val, NULL);
+ if (found) {
+ kex->rsa_sha2 = 256;
+ free(found);
+ }
+ found = match_list("rsa-sha2-512", val, NULL);
+ if (found) {
+ kex->rsa_sha2 = 512;
+ free(found);
+ }
+ }
+ free(name);
+ free(val);
+ }
+ return sshpkt_get_end(ssh);
+}
+
static int
kex_input_newkeys(int type, u_int32_t seq, void *ctxt)
{
@@ -452,7 +529,7 @@ kex_free_newkeys(struct newkeys *newkeys)
newkeys->enc.key = NULL;
}
if (newkeys->enc.iv) {
- explicit_bzero(newkeys->enc.iv, newkeys->enc.block_size);
+ explicit_bzero(newkeys->enc.iv, newkeys->enc.iv_len);
free(newkeys->enc.iv);
newkeys->enc.iv = NULL;
}
@@ -493,6 +570,8 @@ kex_free(struct kex *kex)
free(kex->client_version_string);
free(kex->server_version_string);
free(kex->failed_choice);
+ free(kex->hostkey_alg);
+ free(kex->name);
free(kex);
}
@@ -511,6 +590,25 @@ kex_setup(struct ssh *ssh, const char *proposal[PROPOSAL_MAX])
return 0;
}
+/*
+ * Request key re-exchange, returns 0 on success or a ssherr.h error
+ * code otherwise. Must not be called if KEX is incomplete or in-progress.
+ */
+int
+kex_start_rekex(struct ssh *ssh)
+{
+ if (ssh->kex == NULL) {
+ error("%s: no kex", __func__);
+ return SSH_ERR_INTERNAL_ERROR;
+ }
+ if (ssh->kex->done == 0) {
+ error("%s: requested twice", __func__);
+ return SSH_ERR_INTERNAL_ERROR;
+ }
+ ssh->kex->done = 0;
+ return kex_send_kexinit(ssh);
+}
+
static int
choose_enc(struct sshenc *enc, char *client, char *server)
{
@@ -576,6 +674,7 @@ choose_kex(struct kex *k, char *client, char *server)
k->name = match_list(client, server, NULL);
+ debug("kex: algorithm: %s", k->name ? k->name : "(no match)");
if (k->name == NULL)
return SSH_ERR_NO_KEX_ALG_MATCH;
if ((kexalg = kex_alg_by_name(k->name)) == NULL)
@@ -589,15 +688,16 @@ choose_kex(struct kex *k, char *client, char *server)
static int
choose_hostkeyalg(struct kex *k, char *client, char *server)
{
- char *hostkeyalg = match_list(client, server, NULL);
+ k->hostkey_alg = match_list(client, server, NULL);
- if (hostkeyalg == NULL)
+ debug("kex: host key algorithm: %s",
+ k->hostkey_alg ? k->hostkey_alg : "(no match)");
+ if (k->hostkey_alg == NULL)
return SSH_ERR_NO_HOSTKEY_ALG_MATCH;
- k->hostkey_type = sshkey_type_from_name(hostkeyalg);
+ k->hostkey_type = sshkey_type_from_name(k->hostkey_alg);
if (k->hostkey_type == KEY_UNSPEC)
return SSH_ERR_INTERNAL_ERROR;
- k->hostkey_nid = sshkey_ecdsa_nid_from_name(hostkeyalg);
- free(hostkeyalg);
+ k->hostkey_nid = sshkey_ecdsa_nid_from_name(k->hostkey_alg);
return 0;
}
@@ -637,8 +737,11 @@ kex_choose_conf(struct ssh *ssh)
int log_flag = 0;
int r, first_kex_follows;
- if ((r = kex_buf2prop(kex->my, NULL, &my)) != 0 ||
- (r = kex_buf2prop(kex->peer, &first_kex_follows, &peer)) != 0)
+ debug2("local %s KEXINIT proposal", kex->server ? "server" : "client");
+ if ((r = kex_buf2prop(kex->my, NULL, &my)) != 0)
+ goto out;
+ debug2("peer %s KEXINIT proposal", kex->server ? "client" : "server");
+ if ((r = kex_buf2prop(kex->peer, &first_kex_follows, &peer)) != 0)
goto out;
if (kex->server) {
@@ -649,7 +752,30 @@ kex_choose_conf(struct ssh *ssh)
sprop=peer;
}
+ /* Check whether client supports ext_info_c */
+ if (kex->server) {
+ char *ext;
+
+ ext = match_list("ext-info-c", peer[PROPOSAL_KEX_ALGS], NULL);
+ if (ext) {
+ kex->ext_info_c = 1;
+ free(ext);
+ }
+ }
+
/* Algorithm Negotiation */
+ if ((r = choose_kex(kex, cprop[PROPOSAL_KEX_ALGS],
+ sprop[PROPOSAL_KEX_ALGS])) != 0) {
+ kex->failed_choice = peer[PROPOSAL_KEX_ALGS];
+ peer[PROPOSAL_KEX_ALGS] = NULL;
+ goto out;
+ }
+ if ((r = choose_hostkeyalg(kex, cprop[PROPOSAL_SERVER_HOST_KEY_ALGS],
+ sprop[PROPOSAL_SERVER_HOST_KEY_ALGS])) != 0) {
+ kex->failed_choice = peer[PROPOSAL_SERVER_HOST_KEY_ALGS];
+ peer[PROPOSAL_SERVER_HOST_KEY_ALGS] = NULL;
+ goto out;
+ }
for (mode = 0; mode < MODE_MAX; mode++) {
if ((newkeys = calloc(1, sizeof(*newkeys))) == NULL) {
r = SSH_ERR_ALLOC_FAIL;
@@ -694,7 +820,7 @@ kex_choose_conf(struct ssh *ssh)
fatal("Pre-authentication none cipher requests are not allowed.");
}
}
- debug("kex: %s %s %s %s",
+ debug("kex: %s cipher: %s MAC: %s compression: %s",
ctos ? "client->server" : "server->client",
newkeys->enc.name,
authlen == 0 ? newkeys->mac.name : "<implicit>",
@@ -714,18 +840,6 @@ kex_choose_conf(struct ssh *ssh)
}
log_flag = 1;
}
- if ((r = choose_kex(kex, cprop[PROPOSAL_KEX_ALGS],
- sprop[PROPOSAL_KEX_ALGS])) != 0) {
- kex->failed_choice = peer[PROPOSAL_KEX_ALGS];
- peer[PROPOSAL_KEX_ALGS] = NULL;
- goto out;
- }
- if ((r = choose_hostkeyalg(kex, cprop[PROPOSAL_SERVER_HOST_KEY_ALGS],
- sprop[PROPOSAL_SERVER_HOST_KEY_ALGS])) != 0) {
- kex->failed_choice = peer[PROPOSAL_SERVER_HOST_KEY_ALGS];
- peer[PROPOSAL_SERVER_HOST_KEY_ALGS] = NULL;
- goto out;
- }
need = dh_need = 0;
for (mode = 0; mode < MODE_MAX; mode++) {
newkeys = kex->newkeys[mode];
@@ -811,8 +925,7 @@ derive_key(struct ssh *ssh, int id, u_int need, u_char *hash, u_int hashlen,
digest = NULL;
r = 0;
out:
- if (digest)
- free(digest);
+ free(digest);
ssh_digest_free(hashctx);
return r;
}
diff --git a/crypto/external/bsd/openssh/dist/kex.h b/crypto/external/bsd/openssh/dist/kex.h
index 007e6e761f0..ceff811785e 100644
--- a/crypto/external/bsd/openssh/dist/kex.h
+++ b/crypto/external/bsd/openssh/dist/kex.h
@@ -1,5 +1,5 @@
-/* $NetBSD: kex.h,v 1.11 2016/01/14 22:30:04 christos Exp $ */
-/* $OpenBSD: kex.h,v 1.73 2015/07/30 00:01:34 djm Exp $ */
+/* $NetBSD: kex.h,v 1.12 2016/03/11 01:55:00 christos Exp $ */
+/* $OpenBSD: kex.h,v 1.76 2016/02/08 10:57:07 djm Exp $ */
/*
* Copyright (c) 2000, 2001 Markus Friedl. All rights reserved.
@@ -115,9 +115,12 @@ struct kex {
u_int dh_need;
int server;
char *name;
+ char *hostkey_alg;
int hostkey_type;
int hostkey_nid;
u_int kex_type;
+ int rsa_sha2;
+ int ext_info_c;
struct sshbuf *my;
struct sshbuf *peer;
sig_atomic_t done;
@@ -131,8 +134,8 @@ struct kex {
struct sshkey *(*load_host_public_key)(int, int, struct ssh *);
struct sshkey *(*load_host_private_key)(int, int, struct ssh *);
int (*host_key_index)(struct sshkey *, int, struct ssh *);
- int (*sign)(struct sshkey *, struct sshkey *,
- u_char **, size_t *, const u_char *, size_t, u_int);
+ int (*sign)(struct sshkey *, struct sshkey *, u_char **, size_t *,
+ const u_char *, size_t, const char *, u_int);
int (*kex[KEX_MAX])(struct ssh *);
/* kex specific state */
DH *dh; /* DH */
@@ -159,9 +162,11 @@ void kex_prop_free(char **);
int kex_send_kexinit(struct ssh *);
int kex_input_kexinit(int, u_int32_t, void *);
+int kex_input_ext_info(int, u_int32_t, void *);
int kex_derive_keys(struct ssh *, u_char *, u_int, const struct sshbuf *);
int kex_derive_keys_bn(struct ssh *, u_char *, u_int, const BIGNUM *);
int kex_send_newkeys(struct ssh *);
+int kex_start_rekex(struct ssh *);
int kexdh_client(struct ssh *);
int kexdh_server(struct ssh *);
diff --git a/crypto/external/bsd/openssh/dist/kexc25519s.c b/crypto/external/bsd/openssh/dist/kexc25519s.c
index fabb10b45c3..590928a409b 100644
--- a/crypto/external/bsd/openssh/dist/kexc25519s.c
+++ b/crypto/external/bsd/openssh/dist/kexc25519s.c
@@ -1,5 +1,6 @@
-/* $NetBSD: kexc25519s.c,v 1.4 2015/07/03 01:00:00 christos Exp $ */
-/* $OpenBSD: kexc25519s.c,v 1.9 2015/04/27 00:37:53 dtucker Exp $ */
+/* $NetBSD: kexc25519s.c,v 1.5 2016/03/11 01:55:00 christos Exp $ */
+/* $OpenBSD: kexc25519s.c,v 1.10 2015/12/04 16:41:28 markus Exp $ */
+
/*
* Copyright (c) 2001 Markus Friedl. All rights reserved.
* Copyright (c) 2010 Damien Miller. All rights reserved.
@@ -25,7 +26,7 @@
* THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
*/
#include "includes.h"
-__RCSID("$NetBSD: kexc25519s.c,v 1.4 2015/07/03 01:00:00 christos Exp $");
+__RCSID("$NetBSD: kexc25519s.c,v 1.5 2016/03/11 01:55:00 christos Exp $");
#include <sys/types.h>
#include <stdio.h>
@@ -135,8 +136,8 @@ input_kex_c25519_init(int type, u_int32_t seq, void *ctxt)
}
/* sign H */
- if ((r = kex->sign(server_host_private, server_host_public,
- &signature, &slen, hash, hashlen, ssh->compat)) < 0)
+ if ((r = kex->sign(server_host_private, server_host_public, &signature,
+ &slen, hash, hashlen, kex->hostkey_alg, ssh->compat)) < 0)
goto out;
/* send server hostkey, ECDH pubkey 'Q_S' and signed H */
diff --git a/crypto/external/bsd/openssh/dist/kexdhs.c b/crypto/external/bsd/openssh/dist/kexdhs.c
index c34304a88f1..1f4a235aafa 100644
--- a/crypto/external/bsd/openssh/dist/kexdhs.c
+++ b/crypto/external/bsd/openssh/dist/kexdhs.c
@@ -1,5 +1,6 @@
-/* $NetBSD: kexdhs.c,v 1.8 2015/04/03 23:58:19 christos Exp $ */
-/* $OpenBSD: kexdhs.c,v 1.22 2015/01/26 06:10:03 djm Exp $ */
+/* $NetBSD: kexdhs.c,v 1.9 2016/03/11 01:55:00 christos Exp $ */
+/* $OpenBSD: kexdhs.c,v 1.23 2015/12/04 16:41:28 markus Exp $ */
+
/*
* Copyright (c) 2001 Markus Friedl. All rights reserved.
*
@@ -25,7 +26,7 @@
*/
#include "includes.h"
-__RCSID("$NetBSD: kexdhs.c,v 1.8 2015/04/03 23:58:19 christos Exp $");
+__RCSID("$NetBSD: kexdhs.c,v 1.9 2016/03/11 01:55:00 christos Exp $");
#include <sys/types.h>
#include <string.h>
#include <signal.h>
@@ -178,8 +179,8 @@ input_kex_dh_init(int type, u_int32_t seq, void *ctxt)
}
/* sign H */
- if ((r = kex->sign(server_host_private, server_host_public,
- &signature, &slen, hash, hashlen, ssh->compat)) < 0)
+ if ((r = kex->sign(server_host_private, server_host_public, &signature,
+ &slen, hash, hashlen, kex->hostkey_alg, ssh->compat)) < 0)
goto out;
/* destroy_sensitive_data(); */
diff --git a/crypto/external/bsd/openssh/dist/kexecdhs.c b/crypto/external/bsd/openssh/dist/kexecdhs.c
index 62b344fb3e1..8ec9cedfc96 100644
--- a/crypto/external/bsd/openssh/dist/kexecdhs.c
+++ b/crypto/external/bsd/openssh/dist/kexecdhs.c
@@ -1,5 +1,6 @@
-/* $NetBSD: kexecdhs.c,v 1.5 2015/04/03 23:58:19 christos Exp $ */
-/* $OpenBSD: kexecdhs.c,v 1.14 2015/01/26 06:10:03 djm Exp $ */
+/* $NetBSD: kexecdhs.c,v 1.6 2016/03/11 01:55:00 christos Exp $ */
+/* $OpenBSD: kexecdhs.c,v 1.15 2015/12/04 16:41:28 markus Exp $ */
+
/*
* Copyright (c) 2001 Markus Friedl. All rights reserved.
* Copyright (c) 2010 Damien Miller. All rights reserved.
@@ -26,7 +27,7 @@
*/
#include "includes.h"
-__RCSID("$NetBSD: kexecdhs.c,v 1.5 2015/04/03 23:58:19 christos Exp $");
+__RCSID("$NetBSD: kexecdhs.c,v 1.6 2016/03/11 01:55:00 christos Exp $");
#include <sys/types.h>
#include <string.h>
#include <signal.h>
@@ -168,8 +169,8 @@ input_kex_ecdh_init(int type, u_int32_t seq, void *ctxt)
}
/* sign H */
- if ((r = kex->sign(server_host_private, server_host_public,
- &signature, &slen, hash, hashlen, ssh->compat)) < 0)
+ if ((r = kex->sign(server_host_private, server_host_public, &signature,
+ &slen, hash, hashlen, kex->hostkey_alg, ssh->compat)) < 0)
goto out;
/* destroy_sensitive_data(); */
diff --git a/crypto/external/bsd/openssh/dist/kexgexs.c b/crypto/external/bsd/openssh/dist/kexgexs.c
index 8309f4487bf..88d78c5b211 100644
--- a/crypto/external/bsd/openssh/dist/kexgexs.c
+++ b/crypto/external/bsd/openssh/dist/kexgexs.c
@@ -1,5 +1,6 @@
-/* $NetBSD: kexgexs.c,v 1.9 2015/07/03 01:00:00 christos Exp $ */
-/* $OpenBSD: kexgexs.c,v 1.25 2015/04/13 02:04:08 djm Exp $ */
+/* $NetBSD: kexgexs.c,v 1.10 2016/03/11 01:55:00 christos Exp $ */
+/* $OpenBSD: kexgexs.c,v 1.26 2015/12/04 16:41:28 markus Exp $ */
+
/*
* Copyright (c) 2000 Niels Provos. All rights reserved.
* Copyright (c) 2001 Markus Friedl. All rights reserved.
@@ -26,7 +27,7 @@
*/
#include "includes.h"
-__RCSID("$NetBSD: kexgexs.c,v 1.9 2015/07/03 01:00:00 christos Exp $");
+__RCSID("$NetBSD: kexgexs.c,v 1.10 2016/03/11 01:55:00 christos Exp $");
#include <sys/param.h> /* MIN MAX */
#include <stdio.h>
@@ -218,8 +219,8 @@ input_kex_dh_gex_init(int type, u_int32_t seq, void *ctxt)
}
/* sign H */
- if ((r = kex->sign(server_host_private, server_host_public,
- &signature, &slen, hash, hashlen, ssh->compat)) < 0)
+ if ((r = kex->sign(server_host_private, server_host_public, &signature,
+ &slen, hash, hashlen, kex->hostkey_alg, ssh->compat)) < 0)
goto out;
/* destroy_sensitive_data(); */
diff --git a/crypto/external/bsd/openssh/dist/key.c b/crypto/external/bsd/openssh/dist/key.c
index c7675d1596d..00a7fa1d756 100644
--- a/crypto/external/bsd/openssh/dist/key.c
+++ b/crypto/external/bsd/openssh/dist/key.c
@@ -1,11 +1,12 @@
-/* $NetBSD: key.c,v 1.17 2015/08/13 10:33:21 christos Exp $ */
-/* $OpenBSD: key.c,v 1.128 2015/07/03 03:43:18 djm Exp $ */
+/* $NetBSD: key.c,v 1.18 2016/03/11 01:55:00 christos Exp $ */
+/* $OpenBSD: key.c,v 1.129 2015/12/04 16:41:28 markus Exp $ */
+
/*
* placed in the public domain
*/
#include "includes.h"
-__RCSID("$NetBSD: key.c,v 1.17 2015/08/13 10:33:21 christos Exp $");
+__RCSID("$NetBSD: key.c,v 1.18 2016/03/11 01:55:00 christos Exp $");
#include <sys/param.h>
#include <sys/types.h>
#include <errno.h>
@@ -134,7 +135,7 @@ key_to_blob(const Key *key, u_char **blobp, u_int *lenp)
int
key_sign(const Key *key, u_char **sigp, u_int *lenp,
- const u_char *data, u_int datalen)
+ const u_char *data, u_int datalen, const char *alg)
{
int r;
u_char *sig;
@@ -145,7 +146,7 @@ key_sign(const Key *key, u_char **sigp, u_int *lenp,
if (lenp != NULL)
*lenp = 0;
if ((r = sshkey_sign(key, &sig, &siglen,
- data, datalen, datafellows)) != 0) {
+ data, datalen, alg, datafellows)) != 0) {
fatal_on_fatal_errors(r, __func__, 0);
error("%s: %s", __func__, ssh_err(r));
return -1;
diff --git a/crypto/external/bsd/openssh/dist/key.h b/crypto/external/bsd/openssh/dist/key.h
index 08c7796a8d5..e23729e3c3c 100644
--- a/crypto/external/bsd/openssh/dist/key.h
+++ b/crypto/external/bsd/openssh/dist/key.h
@@ -1,5 +1,5 @@
-/* $NetBSD: key.h,v 1.10 2015/08/13 10:33:21 christos Exp $ */
-/* $OpenBSD: key.h,v 1.48 2015/07/03 03:43:18 djm Exp $ */
+/* $NetBSD: key.h,v 1.11 2016/03/11 01:55:00 christos Exp $ */
+/* $OpenBSD: key.h,v 1.49 2015/12/04 16:41:28 markus Exp $ */
/*
* Copyright (c) 2000, 2001 Markus Friedl. All rights reserved.
@@ -85,7 +85,8 @@ int key_ec_validate_private(const EC_KEY *);
Key *key_from_blob(const u_char *, u_int);
int key_to_blob(const Key *, u_char **, u_int *);
-int key_sign(const Key *, u_char **, u_int *, const u_char *, u_int);
+int key_sign(const Key *, u_char **, u_int *, const u_char *, u_int,
+ const char *);
int key_verify(const Key *, const u_char *, u_int, const u_char *, u_int);
void key_private_serialize(const Key *, struct sshbuf *);
diff --git a/crypto/external/bsd/openssh/dist/krl.c b/crypto/external/bsd/openssh/dist/krl.c
index 6cbace67901..64d52304e20 100644
--- a/crypto/external/bsd/openssh/dist/krl.c
+++ b/crypto/external/bsd/openssh/dist/krl.c
@@ -1,4 +1,5 @@
-/* $NetBSD: krl.c,v 1.7 2015/08/13 10:33:21 christos Exp $ */
+/* $NetBSD: krl.c,v 1.8 2016/03/11 01:55:00 christos Exp $ */
+
/*
* Copyright (c) 2012 Damien Miller <djm@mindrot.org>
*
@@ -16,9 +17,9 @@
*/
#include <sys/cdefs.h>
-__RCSID("$NetBSD: krl.c,v 1.7 2015/08/13 10:33:21 christos Exp $");
+__RCSID("$NetBSD: krl.c,v 1.8 2016/03/11 01:55:00 christos Exp $");
-/* $OpenBSD: krl.c,v 1.33 2015/07/03 03:43:18 djm Exp $ */
+/* $OpenBSD: krl.c,v 1.37 2015/12/31 00:33:52 djm Exp $ */
#include "includes.h"
#include <sys/param.h> /* MIN */
@@ -729,7 +730,7 @@ ssh_krl_to_blob(struct ssh_krl *krl, struct sshbuf *buf,
if ((r = sshbuf_put(buf, KRL_MAGIC, sizeof(KRL_MAGIC) - 1)) != 0 ||
(r = sshbuf_put_u32(buf, KRL_FORMAT_VERSION)) != 0 ||
(r = sshbuf_put_u64(buf, krl->krl_version)) != 0 ||
- (r = sshbuf_put_u64(buf, krl->generated_date) != 0) ||
+ (r = sshbuf_put_u64(buf, krl->generated_date)) != 0 ||
(r = sshbuf_put_u64(buf, krl->flags)) != 0 ||
(r = sshbuf_put_string(buf, NULL, 0)) != 0 ||
(r = sshbuf_put_cstring(buf, krl->comment)) != 0)
@@ -778,7 +779,7 @@ ssh_krl_to_blob(struct ssh_krl *krl, struct sshbuf *buf,
goto out;
if ((r = sshkey_sign(sign_keys[i], &sblob, &slen,
- sshbuf_ptr(buf), sshbuf_len(buf), 0)) != 0)
+ sshbuf_ptr(buf), sshbuf_len(buf), NULL, 0)) != 0)
goto out;
KRL_DBG(("%s: signature sig len %zu", __func__, slen));
if ((r = sshbuf_put_string(buf, sblob, slen)) != 0)
@@ -832,10 +833,8 @@ parse_revoked_certs(struct sshbuf *buf, struct ssh_krl *krl)
goto out;
while (sshbuf_len(buf) > 0) {
- if (subsect != NULL) {
- sshbuf_free(subsect);
- subsect = NULL;
- }
+ sshbuf_free(subsect);
+ subsect = NULL;
if ((r = sshbuf_get_u8(buf, &type)) != 0 ||
(r = sshbuf_froms(buf, &subsect)) != 0)
goto out;
@@ -1023,7 +1022,7 @@ ssh_krl_from_blob(struct sshbuf *buf, struct ssh_krl **krlp,
}
/* Check signature over entire KRL up to this point */
if ((r = sshkey_verify(key, blob, blen,
- sshbuf_ptr(buf), sshbuf_len(buf) - sig_off, 0)) != 0)
+ sshbuf_ptr(buf), sig_off, 0)) != 0)
goto out;
/* Check if this key has already signed this KRL */
for (i = 0; i < nca_used; i++) {
@@ -1044,7 +1043,6 @@ ssh_krl_from_blob(struct sshbuf *buf, struct ssh_krl **krlp,
ca_used = tmp_ca_used;
ca_used[nca_used++] = key;
key = NULL;
- break;
}
if (sshbuf_len(copy) != 0) {
@@ -1065,10 +1063,8 @@ ssh_krl_from_blob(struct sshbuf *buf, struct ssh_krl **krlp,
if ((r = sshbuf_consume(copy, sects_off)) != 0)
goto out;
while (sshbuf_len(copy) > 0) {
- if (sect != NULL) {
- sshbuf_free(sect);
- sect = NULL;
- }
+ sshbuf_free(sect);
+ sect = NULL;
if ((r = sshbuf_get_u8(copy, &type)) != 0 ||
(r = sshbuf_froms(copy, &sect)) != 0)
goto out;
@@ -1111,7 +1107,7 @@ ssh_krl_from_blob(struct sshbuf *buf, struct ssh_krl **krlp,
r = SSH_ERR_INVALID_FORMAT;
goto out;
}
- if (sshbuf_len(sect) > 0) {
+ if (sect != NULL && sshbuf_len(sect) > 0) {
error("KRL section contains unparsed data");
r = SSH_ERR_INVALID_FORMAT;
goto out;
diff --git a/crypto/external/bsd/openssh/dist/misc.c b/crypto/external/bsd/openssh/dist/misc.c
index 4ecc0946236..0cafa27ae91 100644
--- a/crypto/external/bsd/openssh/dist/misc.c
+++ b/crypto/external/bsd/openssh/dist/misc.c
@@ -1,5 +1,6 @@
-/* $NetBSD: misc.c,v 1.11 2015/07/03 01:00:00 christos Exp $ */
-/* $OpenBSD: misc.c,v 1.97 2015/04/24 01:36:00 deraadt Exp $ */
+/* $NetBSD: misc.c,v 1.12 2016/03/11 01:55:00 christos Exp $ */
+/* $OpenBSD: misc.c,v 1.101 2016/01/20 09:22:39 dtucker Exp $ */
+
/*
* Copyright (c) 2000 Markus Friedl. All rights reserved.
* Copyright (c) 2005,2006 Damien Miller. All rights reserved.
@@ -26,10 +27,11 @@
*/
#include "includes.h"
-__RCSID("$NetBSD: misc.c,v 1.11 2015/07/03 01:00:00 christos Exp $");
+__RCSID("$NetBSD: misc.c,v 1.12 2016/03/11 01:55:00 christos Exp $");
#include <sys/types.h>
#include <sys/ioctl.h>
#include <sys/socket.h>
+#include <sys/time.h>
#include <sys/un.h>
#include <net/if.h>
@@ -596,6 +598,8 @@ percent_expand(const char *string, ...)
/* %% case */
if (*string == '%')
goto append;
+ if (*string == '\0')
+ fatal("%s: invalid format", __func__);
for (j = 0; j < num_keys; j++) {
if (strchr(keys[j].key, *string) != NULL) {
i = strlcat(buf, keys[j].repl, sizeof(buf));
@@ -640,35 +644,38 @@ int
tun_open(int tun, int mode)
{
struct ifreq ifr;
- int fd = -1, sock, flag;
- const char *tunbase = mode == SSH_TUNMODE_ETHERNET ? "tap" : "tun";
+ char name[100];
+ int fd = -1, sock;
+ const char *tunbase = "tun";
+
+ if (mode == SSH_TUNMODE_ETHERNET)
+ tunbase = "tap";
/* Open the tunnel device */
if (tun <= SSH_TUNID_MAX) {
- snprintf(ifr.ifr_name, sizeof(ifr.ifr_name),
- "/dev/%s%d", tunbase, tun);
- fd = open(ifr.ifr_name, O_RDWR);
+ snprintf(name, sizeof(name), "/dev/%s%d", tunbase, tun);
+ fd = open(name, O_RDWR);
} else if (tun == SSH_TUNID_ANY) {
for (tun = 100; tun >= 0; tun--) {
- snprintf(ifr.ifr_name, sizeof(ifr.ifr_name),
- "/dev/%s%d", tunbase, tun);
- if ((fd = open(ifr.ifr_name, O_RDWR)) >= 0)
+ snprintf(name, sizeof(name), "/dev/%s%d",
+ tunbase, tun);
+ if ((fd = open(name, O_RDWR)) >= 0)
break;
}
} else {
debug("%s: invalid tunnel %u", __func__, tun);
- return (-1);
+ return -1;
}
if (fd < 0) {
- debug("%s: %s open failed: %s", __func__, ifr.ifr_name,
- strerror(errno));
- return (-1);
+ debug("%s: %s open: %s", __func__, name, strerror(errno));
+ return -1;
}
+#ifdef TUNSIFHEAD
/* Turn on tunnel headers */
- flag = 1;
+ int flag = 1;
if (mode != SSH_TUNMODE_ETHERNET &&
ioctl(fd, TUNSIFHEAD, &flag) == -1) {
debug("%s: ioctl(%d, TUNSIFHEAD, 1): %s", __func__, fd,
@@ -676,34 +683,31 @@ tun_open(int tun, int mode)
close(fd);
return -1;
}
+#endif
debug("%s: %s mode %d fd %d", __func__, ifr.ifr_name, mode, fd);
- /* Set the tunnel device operation mode */
+ /* Bring interface up if it is not already */
snprintf(ifr.ifr_name, sizeof(ifr.ifr_name), "%s%d", tunbase, tun);
if ((sock = socket(PF_UNIX, SOCK_STREAM, 0)) == -1)
goto failed;
- if (ioctl(sock, SIOCGIFFLAGS, &ifr) == -1)
+ if (ioctl(sock, SIOCGIFFLAGS, &ifr) == -1) {
+ debug("%s: get interface %s flags: %s", __func__,
+ ifr.ifr_name, strerror(errno));
goto failed;
+ }
-#if 0
- /* Set interface mode */
- ifr.ifr_flags &= ~IFF_UP;
- if (mode == SSH_TUNMODE_ETHERNET)
- ifr.ifr_flags |= IFF_LINK0;
- else
- ifr.ifr_flags &= ~IFF_LINK0;
- if (ioctl(sock, SIOCSIFFLAGS, &ifr) == -1)
- goto failed;
-#endif
-
- /* Bring interface up */
- ifr.ifr_flags |= IFF_UP;
- if (ioctl(sock, SIOCSIFFLAGS, &ifr) == -1)
- goto failed;
+ if (!(ifr.ifr_flags & IFF_UP)) {
+ ifr.ifr_flags |= IFF_UP;
+ if (ioctl(sock, SIOCSIFFLAGS, &ifr) == -1) {
+ debug("%s: activate interface %s: %s", __func__,
+ ifr.ifr_name, strerror(errno));
+ goto failed;
+ }
+ }
close(sock);
- return (fd);
+ return fd;
failed:
if (fd >= 0)
@@ -712,7 +716,7 @@ tun_open(int tun, int mode)
close(sock);
debug("%s: failed to set %s mode %d: %s", __func__, ifr.ifr_name,
mode, strerror(errno));
- return (-1);
+ return -1;
}
void
diff --git a/crypto/external/bsd/openssh/dist/moduli-gen/moduli.1536 b/crypto/external/bsd/openssh/dist/moduli-gen/moduli.1536
deleted file mode 100644
index 4d949808f77..00000000000
--- a/crypto/external/bsd/openssh/dist/moduli-gen/moduli.1536
+++ /dev/null
@@ -1,49 +0,0 @@
-20150522025931 2 6 100 1535 5 F4EE15F22E5F49997A027769656DF0240598C9470C7D67A7D7DA2777883C1C243A6F3D04E1CFA6A0350B165ECABE89A684C11ABB7E5B93B54FD6EAC85BBA9F23C6306E485BB9AC5515ABC739CE9B1A79F7DEF6D00B643856DB903E23E7F985EDCAFF867FE15498E7EF6A91057DE337A9AAEDE941C934E65243AC7888A33C78FB2490BBA2BA06F18ECC51DE9AA54BADD061CC5BE1EA060CC3217CA11E26772BD088898D2882CB49A9FF40168E49AE6A90EE1F61132E1B6E4E7F99797DAD18DA1F
-20150522025936 2 6 100 1535 2 F4EE15F22E5F49997A027769656DF0240598C9470C7D67A7D7DA2777883C1C243A6F3D04E1CFA6A0350B165ECABE89A684C11ABB7E5B93B54FD6EAC85BBA9F23C6306E485BB9AC5515ABC739CE9B1A79F7DEF6D00B643856DB903E23E7F985EDCAFF867FE15498E7EF6A91057DE337A9AAEDE941C934E65243AC7888A33C78FB2490BBA2BA06F18ECC51DE9AA54BADD061CC5BE1EA060CC3217CA11E26772BD088898D2882CB49A9FF40168E49AE6A90EE1F61132E1B6E4E7F99797DAD3763B3
-20150522025942 2 6 100 1535 2 F4EE15F22E5F49997A027769656DF0240598C9470C7D67A7D7DA2777883C1C243A6F3D04E1CFA6A0350B165ECABE89A684C11ABB7E5B93B54FD6EAC85BBA9F23C6306E485BB9AC5515ABC739CE9B1A79F7DEF6D00B643856DB903E23E7F985EDCAFF867FE15498E7EF6A91057DE337A9AAEDE941C934E65243AC7888A33C78FB2490BBA2BA06F18ECC51DE9AA54BADD061CC5BE1EA060CC3217CA11E26772BD088898D2882CB49A9FF40168E49AE6A90EE1F61132E1B6E4E7F99797DAD702B8B
-20150522025943 2 6 100 1535 2 F4EE15F22E5F49997A027769656DF0240598C9470C7D67A7D7DA2777883C1C243A6F3D04E1CFA6A0350B165ECABE89A684C11ABB7E5B93B54FD6EAC85BBA9F23C6306E485BB9AC5515ABC739CE9B1A79F7DEF6D00B643856DB903E23E7F985EDCAFF867FE15498E7EF6A91057DE337A9AAEDE941C934E65243AC7888A33C78FB2490BBA2BA06F18ECC51DE9AA54BADD061CC5BE1EA060CC3217CA11E26772BD088898D2882CB49A9FF40168E49AE6A90EE1F61132E1B6E4E7F99797DAD77C283
-20150522025947 2 6 100 1535 2 F4EE15F22E5F49997A027769656DF0240598C9470C7D67A7D7DA2777883C1C243A6F3D04E1CFA6A0350B165ECABE89A684C11ABB7E5B93B54FD6EAC85BBA9F23C6306E485BB9AC5515ABC739CE9B1A79F7DEF6D00B643856DB903E23E7F985EDCAFF867FE15498E7EF6A91057DE337A9AAEDE941C934E65243AC7888A33C78FB2490BBA2BA06F18ECC51DE9AA54BADD061CC5BE1EA060CC3217CA11E26772BD088898D2882CB49A9FF40168E49AE6A90EE1F61132E1B6E4E7F99797DAD96C25B
-20150522025953 2 6 100 1535 2 F4EE15F22E5F49997A027769656DF0240598C9470C7D67A7D7DA2777883C1C243A6F3D04E1CFA6A0350B165ECABE89A684C11ABB7E5B93B54FD6EAC85BBA9F23C6306E485BB9AC5515ABC739CE9B1A79F7DEF6D00B643856DB903E23E7F985EDCAFF867FE15498E7EF6A91057DE337A9AAEDE941C934E65243AC7888A33C78FB2490BBA2BA06F18ECC51DE9AA54BADD061CC5BE1EA060CC3217CA11E26772BD088898D2882CB49A9FF40168E49AE6A90EE1F61132E1B6E4E7F99797DADD9B3DB
-20150522025956 2 6 100 1535 5 F4EE15F22E5F49997A027769656DF0240598C9470C7D67A7D7DA2777883C1C243A6F3D04E1CFA6A0350B165ECABE89A684C11ABB7E5B93B54FD6EAC85BBA9F23C6306E485BB9AC5515ABC739CE9B1A79F7DEF6D00B643856DB903E23E7F985EDCAFF867FE15498E7EF6A91057DE337A9AAEDE941C934E65243AC7888A33C78FB2490BBA2BA06F18ECC51DE9AA54BADD061CC5BE1EA060CC3217CA11E26772BD088898D2882CB49A9FF40168E49AE6A90EE1F61132E1B6E4E7F99797DADE84F07
-20150522025957 2 6 100 1535 2 F4EE15F22E5F49997A027769656DF0240598C9470C7D67A7D7DA2777883C1C243A6F3D04E1CFA6A0350B165ECABE89A684C11ABB7E5B93B54FD6EAC85BBA9F23C6306E485BB9AC5515ABC739CE9B1A79F7DEF6D00B643856DB903E23E7F985EDCAFF867FE15498E7EF6A91057DE337A9AAEDE941C934E65243AC7888A33C78FB2490BBA2BA06F18ECC51DE9AA54BADD061CC5BE1EA060CC3217CA11E26772BD088898D2882CB49A9FF40168E49AE6A90EE1F61132E1B6E4E7F99797DADEC1DB3
-20150522030001 2 6 100 1535 5 F4EE15F22E5F49997A027769656DF0240598C9470C7D67A7D7DA2777883C1C243A6F3D04E1CFA6A0350B165ECABE89A684C11ABB7E5B93B54FD6EAC85BBA9F23C6306E485BB9AC5515ABC739CE9B1A79F7DEF6D00B643856DB903E23E7F985EDCAFF867FE15498E7EF6A91057DE337A9AAEDE941C934E65243AC7888A33C78FB2490BBA2BA06F18ECC51DE9AA54BADD061CC5BE1EA060CC3217CA11E26772BD088898D2882CB49A9FF40168E49AE6A90EE1F61132E1B6E4E7F99797DAE0E297F
-20150522030004 2 6 100 1535 2 F4EE15F22E5F49997A027769656DF0240598C9470C7D67A7D7DA2777883C1C243A6F3D04E1CFA6A0350B165ECABE89A684C11ABB7E5B93B54FD6EAC85BBA9F23C6306E485BB9AC5515ABC739CE9B1A79F7DEF6D00B643856DB903E23E7F985EDCAFF867FE15498E7EF6A91057DE337A9AAEDE941C934E65243AC7888A33C78FB2490BBA2BA06F18ECC51DE9AA54BADD061CC5BE1EA060CC3217CA11E26772BD088898D2882CB49A9FF40168E49AE6A90EE1F61132E1B6E4E7F99797DAE2A1E23
-20150522030005 2 6 100 1535 2 F4EE15F22E5F49997A027769656DF0240598C9470C7D67A7D7DA2777883C1C243A6F3D04E1CFA6A0350B165ECABE89A684C11ABB7E5B93B54FD6EAC85BBA9F23C6306E485BB9AC5515ABC739CE9B1A79F7DEF6D00B643856DB903E23E7F985EDCAFF867FE15498E7EF6A91057DE337A9AAEDE941C934E65243AC7888A33C78FB2490BBA2BA06F18ECC51DE9AA54BADD061CC5BE1EA060CC3217CA11E26772BD088898D2882CB49A9FF40168E49AE6A90EE1F61132E1B6E4E7F99797DAE2ADE53
-20150522030008 2 6 100 1535 5 F4EE15F22E5F49997A027769656DF0240598C9470C7D67A7D7DA2777883C1C243A6F3D04E1CFA6A0350B165ECABE89A684C11ABB7E5B93B54FD6EAC85BBA9F23C6306E485BB9AC5515ABC739CE9B1A79F7DEF6D00B643856DB903E23E7F985EDCAFF867FE15498E7EF6A91057DE337A9AAEDE941C934E65243AC7888A33C78FB2490BBA2BA06F18ECC51DE9AA54BADD061CC5BE1EA060CC3217CA11E26772BD088898D2882CB49A9FF40168E49AE6A90EE1F61132E1B6E4E7F99797DAE47B9F7
-20150522030009 2 6 100 1535 2 F4EE15F22E5F49997A027769656DF0240598C9470C7D67A7D7DA2777883C1C243A6F3D04E1CFA6A0350B165ECABE89A684C11ABB7E5B93B54FD6EAC85BBA9F23C6306E485BB9AC5515ABC739CE9B1A79F7DEF6D00B643856DB903E23E7F985EDCAFF867FE15498E7EF6A91057DE337A9AAEDE941C934E65243AC7888A33C78FB2490BBA2BA06F18ECC51DE9AA54BADD061CC5BE1EA060CC3217CA11E26772BD088898D2882CB49A9FF40168E49AE6A90EE1F61132E1B6E4E7F99797DAE4E1343
-20150522030014 2 6 100 1535 2 F4EE15F22E5F49997A027769656DF0240598C9470C7D67A7D7DA2777883C1C243A6F3D04E1CFA6A0350B165ECABE89A684C11ABB7E5B93B54FD6EAC85BBA9F23C6306E485BB9AC5515ABC739CE9B1A79F7DEF6D00B643856DB903E23E7F985EDCAFF867FE15498E7EF6A91057DE337A9AAEDE941C934E65243AC7888A33C78FB2490BBA2BA06F18ECC51DE9AA54BADD061CC5BE1EA060CC3217CA11E26772BD088898D2882CB49A9FF40168E49AE6A90EE1F61132E1B6E4E7F99797DAE715CBB
-20150522030016 2 6 100 1535 5 F4EE15F22E5F49997A027769656DF0240598C9470C7D67A7D7DA2777883C1C243A6F3D04E1CFA6A0350B165ECABE89A684C11ABB7E5B93B54FD6EAC85BBA9F23C6306E485BB9AC5515ABC739CE9B1A79F7DEF6D00B643856DB903E23E7F985EDCAFF867FE15498E7EF6A91057DE337A9AAEDE941C934E65243AC7888A33C78FB2490BBA2BA06F18ECC51DE9AA54BADD061CC5BE1EA060CC3217CA11E26772BD088898D2882CB49A9FF40168E49AE6A90EE1F61132E1B6E4E7F99797DAE7BC9EF
-20150522030018 2 6 100 1535 2 F4EE15F22E5F49997A027769656DF0240598C9470C7D67A7D7DA2777883C1C243A6F3D04E1CFA6A0350B165ECABE89A684C11ABB7E5B93B54FD6EAC85BBA9F23C6306E485BB9AC5515ABC739CE9B1A79F7DEF6D00B643856DB903E23E7F985EDCAFF867FE15498E7EF6A91057DE337A9AAEDE941C934E65243AC7888A33C78FB2490BBA2BA06F18ECC51DE9AA54BADD061CC5BE1EA060CC3217CA11E26772BD088898D2882CB49A9FF40168E49AE6A90EE1F61132E1B6E4E7F99797DAE84579B
-20150522030019 2 6 100 1535 2 F4EE15F22E5F49997A027769656DF0240598C9470C7D67A7D7DA2777883C1C243A6F3D04E1CFA6A0350B165ECABE89A684C11ABB7E5B93B54FD6EAC85BBA9F23C6306E485BB9AC5515ABC739CE9B1A79F7DEF6D00B643856DB903E23E7F985EDCAFF867FE15498E7EF6A91057DE337A9AAEDE941C934E65243AC7888A33C78FB2490BBA2BA06F18ECC51DE9AA54BADD061CC5BE1EA060CC3217CA11E26772BD088898D2882CB49A9FF40168E49AE6A90EE1F61132E1B6E4E7F99797DAE8A564B
-20150522030023 2 6 100 1535 5 F4EE15F22E5F49997A027769656DF0240598C9470C7D67A7D7DA2777883C1C243A6F3D04E1CFA6A0350B165ECABE89A684C11ABB7E5B93B54FD6EAC85BBA9F23C6306E485BB9AC5515ABC739CE9B1A79F7DEF6D00B643856DB903E23E7F985EDCAFF867FE15498E7EF6A91057DE337A9AAEDE941C934E65243AC7888A33C78FB2490BBA2BA06F18ECC51DE9AA54BADD061CC5BE1EA060CC3217CA11E26772BD088898D2882CB49A9FF40168E49AE6A90EE1F61132E1B6E4E7F99797DAEAF7AD7
-20150522030025 2 6 100 1535 2 F4EE15F22E5F49997A027769656DF0240598C9470C7D67A7D7DA2777883C1C243A6F3D04E1CFA6A0350B165ECABE89A684C11ABB7E5B93B54FD6EAC85BBA9F23C6306E485BB9AC5515ABC739CE9B1A79F7DEF6D00B643856DB903E23E7F985EDCAFF867FE15498E7EF6A91057DE337A9AAEDE941C934E65243AC7888A33C78FB2490BBA2BA06F18ECC51DE9AA54BADD061CC5BE1EA060CC3217CA11E26772BD088898D2882CB49A9FF40168E49AE6A90EE1F61132E1B6E4E7F99797DAEB9DC53
-20150522030027 2 6 100 1535 5 F4EE15F22E5F49997A027769656DF0240598C9470C7D67A7D7DA2777883C1C243A6F3D04E1CFA6A0350B165ECABE89A684C11ABB7E5B93B54FD6EAC85BBA9F23C6306E485BB9AC5515ABC739CE9B1A79F7DEF6D00B643856DB903E23E7F985EDCAFF867FE15498E7EF6A91057DE337A9AAEDE941C934E65243AC7888A33C78FB2490BBA2BA06F18ECC51DE9AA54BADD061CC5BE1EA060CC3217CA11E26772BD088898D2882CB49A9FF40168E49AE6A90EE1F61132E1B6E4E7F99797DAECD976F
-20150522030034 2 6 100 1535 2 F4EE15F22E5F49997A027769656DF0240598C9470C7D67A7D7DA2777883C1C243A6F3D04E1CFA6A0350B165ECABE89A684C11ABB7E5B93B54FD6EAC85BBA9F23C6306E485BB9AC5515ABC739CE9B1A79F7DEF6D00B643856DB903E23E7F985EDCAFF867FE15498E7EF6A91057DE337A9AAEDE941C934E65243AC7888A33C78FB2490BBA2BA06F18ECC51DE9AA54BADD061CC5BE1EA060CC3217CA11E26772BD088898D2882CB49A9FF40168E49AE6A90EE1F61132E1B6E4E7F99797DAF07F063
-20150522030034 2 6 100 1535 2 F4EE15F22E5F49997A027769656DF0240598C9470C7D67A7D7DA2777883C1C243A6F3D04E1CFA6A0350B165ECABE89A684C11ABB7E5B93B54FD6EAC85BBA9F23C6306E485BB9AC5515ABC739CE9B1A79F7DEF6D00B643856DB903E23E7F985EDCAFF867FE15498E7EF6A91057DE337A9AAEDE941C934E65243AC7888A33C78FB2490BBA2BA06F18ECC51DE9AA54BADD061CC5BE1EA060CC3217CA11E26772BD088898D2882CB49A9FF40168E49AE6A90EE1F61132E1B6E4E7F99797DAF08ACBB
-20150522030037 2 6 100 1535 5 F4EE15F22E5F49997A027769656DF0240598C9470C7D67A7D7DA2777883C1C243A6F3D04E1CFA6A0350B165ECABE89A684C11ABB7E5B93B54FD6EAC85BBA9F23C6306E485BB9AC5515ABC739CE9B1A79F7DEF6D00B643856DB903E23E7F985EDCAFF867FE15498E7EF6A91057DE337A9AAEDE941C934E65243AC7888A33C78FB2490BBA2BA06F18ECC51DE9AA54BADD061CC5BE1EA060CC3217CA11E26772BD088898D2882CB49A9FF40168E49AE6A90EE1F61132E1B6E4E7F99797DAF192C07
-20150522030039 2 6 100 1535 2 F4EE15F22E5F49997A027769656DF0240598C9470C7D67A7D7DA2777883C1C243A6F3D04E1CFA6A0350B165ECABE89A684C11ABB7E5B93B54FD6EAC85BBA9F23C6306E485BB9AC5515ABC739CE9B1A79F7DEF6D00B643856DB903E23E7F985EDCAFF867FE15498E7EF6A91057DE337A9AAEDE941C934E65243AC7888A33C78FB2490BBA2BA06F18ECC51DE9AA54BADD061CC5BE1EA060CC3217CA11E26772BD088898D2882CB49A9FF40168E49AE6A90EE1F61132E1B6E4E7F99797DAF241333
-20150522030040 2 6 100 1535 2 F4EE15F22E5F49997A027769656DF0240598C9470C7D67A7D7DA2777883C1C243A6F3D04E1CFA6A0350B165ECABE89A684C11ABB7E5B93B54FD6EAC85BBA9F23C6306E485BB9AC5515ABC739CE9B1A79F7DEF6D00B643856DB903E23E7F985EDCAFF867FE15498E7EF6A91057DE337A9AAEDE941C934E65243AC7888A33C78FB2490BBA2BA06F18ECC51DE9AA54BADD061CC5BE1EA060CC3217CA11E26772BD088898D2882CB49A9FF40168E49AE6A90EE1F61132E1B6E4E7F99797DAF255B3B
-20150522030044 2 6 100 1535 5 F4EE15F22E5F49997A027769656DF0240598C9470C7D67A7D7DA2777883C1C243A6F3D04E1CFA6A0350B165ECABE89A684C11ABB7E5B93B54FD6EAC85BBA9F23C6306E485BB9AC5515ABC739CE9B1A79F7DEF6D00B643856DB903E23E7F985EDCAFF867FE15498E7EF6A91057DE337A9AAEDE941C934E65243AC7888A33C78FB2490BBA2BA06F18ECC51DE9AA54BADD061CC5BE1EA060CC3217CA11E26772BD088898D2882CB49A9FF40168E49AE6A90EE1F61132E1B6E4E7F99797DAF3DEC37
-20150522030048 2 6 100 1535 2 F4EE15F22E5F49997A027769656DF0240598C9470C7D67A7D7DA2777883C1C243A6F3D04E1CFA6A0350B165ECABE89A684C11ABB7E5B93B54FD6EAC85BBA9F23C6306E485BB9AC5515ABC739CE9B1A79F7DEF6D00B643856DB903E23E7F985EDCAFF867FE15498E7EF6A91057DE337A9AAEDE941C934E65243AC7888A33C78FB2490BBA2BA06F18ECC51DE9AA54BADD061CC5BE1EA060CC3217CA11E26772BD088898D2882CB49A9FF40168E49AE6A90EE1F61132E1B6E4E7F99797DAF60F05B
-20150522030049 2 6 100 1535 5 F4EE15F22E5F49997A027769656DF0240598C9470C7D67A7D7DA2777883C1C243A6F3D04E1CFA6A0350B165ECABE89A684C11ABB7E5B93B54FD6EAC85BBA9F23C6306E485BB9AC5515ABC739CE9B1A79F7DEF6D00B643856DB903E23E7F985EDCAFF867FE15498E7EF6A91057DE337A9AAEDE941C934E65243AC7888A33C78FB2490BBA2BA06F18ECC51DE9AA54BADD061CC5BE1EA060CC3217CA11E26772BD088898D2882CB49A9FF40168E49AE6A90EE1F61132E1B6E4E7F99797DAF6255DF
-20150522030055 2 6 100 1535 5 F4EE15F22E5F49997A027769656DF0240598C9470C7D67A7D7DA2777883C1C243A6F3D04E1CFA6A0350B165ECABE89A684C11ABB7E5B93B54FD6EAC85BBA9F23C6306E485BB9AC5515ABC739CE9B1A79F7DEF6D00B643856DB903E23E7F985EDCAFF867FE15498E7EF6A91057DE337A9AAEDE941C934E65243AC7888A33C78FB2490BBA2BA06F18ECC51DE9AA54BADD061CC5BE1EA060CC3217CA11E26772BD088898D2882CB49A9FF40168E49AE6A90EE1F61132E1B6E4E7F99797DAF8EE01F
-20150522030059 2 6 100 1535 2 F4EE15F22E5F49997A027769656DF0240598C9470C7D67A7D7DA2777883C1C243A6F3D04E1CFA6A0350B165ECABE89A684C11ABB7E5B93B54FD6EAC85BBA9F23C6306E485BB9AC5515ABC739CE9B1A79F7DEF6D00B643856DB903E23E7F985EDCAFF867FE15498E7EF6A91057DE337A9AAEDE941C934E65243AC7888A33C78FB2490BBA2BA06F18ECC51DE9AA54BADD061CC5BE1EA060CC3217CA11E26772BD088898D2882CB49A9FF40168E49AE6A90EE1F61132E1B6E4E7F99797DAFAD237B
-20150522030104 2 6 100 1535 5 F4EE15F22E5F49997A027769656DF0240598C9470C7D67A7D7DA2777883C1C243A6F3D04E1CFA6A0350B165ECABE89A684C11ABB7E5B93B54FD6EAC85BBA9F23C6306E485BB9AC5515ABC739CE9B1A79F7DEF6D00B643856DB903E23E7F985EDCAFF867FE15498E7EF6A91057DE337A9AAEDE941C934E65243AC7888A33C78FB2490BBA2BA06F18ECC51DE9AA54BADD061CC5BE1EA060CC3217CA11E26772BD088898D2882CB49A9FF40168E49AE6A90EE1F61132E1B6E4E7F99797DAFD13587
-20150522030105 2 6 100 1535 5 F4EE15F22E5F49997A027769656DF0240598C9470C7D67A7D7DA2777883C1C243A6F3D04E1CFA6A0350B165ECABE89A684C11ABB7E5B93B54FD6EAC85BBA9F23C6306E485BB9AC5515ABC739CE9B1A79F7DEF6D00B643856DB903E23E7F985EDCAFF867FE15498E7EF6A91057DE337A9AAEDE941C934E65243AC7888A33C78FB2490BBA2BA06F18ECC51DE9AA54BADD061CC5BE1EA060CC3217CA11E26772BD088898D2882CB49A9FF40168E49AE6A90EE1F61132E1B6E4E7F99797DAFD2BE6F
-20150522030108 2 6 100 1535 5 F4EE15F22E5F49997A027769656DF0240598C9470C7D67A7D7DA2777883C1C243A6F3D04E1CFA6A0350B165ECABE89A684C11ABB7E5B93B54FD6EAC85BBA9F23C6306E485BB9AC5515ABC739CE9B1A79F7DEF6D00B643856DB903E23E7F985EDCAFF867FE15498E7EF6A91057DE337A9AAEDE941C934E65243AC7888A33C78FB2490BBA2BA06F18ECC51DE9AA54BADD061CC5BE1EA060CC3217CA11E26772BD088898D2882CB49A9FF40168E49AE6A90EE1F61132E1B6E4E7F99797DAFECF32F
-20150522030112 2 6 100 1535 5 F4EE15F22E5F49997A027769656DF0240598C9470C7D67A7D7DA2777883C1C243A6F3D04E1CFA6A0350B165ECABE89A684C11ABB7E5B93B54FD6EAC85BBA9F23C6306E485BB9AC5515ABC739CE9B1A79F7DEF6D00B643856DB903E23E7F985EDCAFF867FE15498E7EF6A91057DE337A9AAEDE941C934E65243AC7888A33C78FB2490BBA2BA06F18ECC51DE9AA54BADD061CC5BE1EA060CC3217CA11E26772BD088898D2882CB49A9FF40168E49AE6A90EE1F61132E1B6E4E7F99797DAFFDEED7
-20150522030115 2 6 100 1535 2 F4EE15F22E5F49997A027769656DF0240598C9470C7D67A7D7DA2777883C1C243A6F3D04E1CFA6A0350B165ECABE89A684C11ABB7E5B93B54FD6EAC85BBA9F23C6306E485BB9AC5515ABC739CE9B1A79F7DEF6D00B643856DB903E23E7F985EDCAFF867FE15498E7EF6A91057DE337A9AAEDE941C934E65243AC7888A33C78FB2490BBA2BA06F18ECC51DE9AA54BADD061CC5BE1EA060CC3217CA11E26772BD088898D2882CB49A9FF40168E49AE6A90EE1F61132E1B6E4E7F99797DB01CAA63
-20150522030116 2 6 100 1535 5 F4EE15F22E5F49997A027769656DF0240598C9470C7D67A7D7DA2777883C1C243A6F3D04E1CFA6A0350B165ECABE89A684C11ABB7E5B93B54FD6EAC85BBA9F23C6306E485BB9AC5515ABC739CE9B1A79F7DEF6D00B643856DB903E23E7F985EDCAFF867FE15498E7EF6A91057DE337A9AAEDE941C934E65243AC7888A33C78FB2490BBA2BA06F18ECC51DE9AA54BADD061CC5BE1EA060CC3217CA11E26772BD088898D2882CB49A9FF40168E49AE6A90EE1F61132E1B6E4E7F99797DB01F3647
-20150522030119 2 6 100 1535 5 F4EE15F22E5F49997A027769656DF0240598C9470C7D67A7D7DA2777883C1C243A6F3D04E1CFA6A0350B165ECABE89A684C11ABB7E5B93B54FD6EAC85BBA9F23C6306E485BB9AC5515ABC739CE9B1A79F7DEF6D00B643856DB903E23E7F985EDCAFF867FE15498E7EF6A91057DE337A9AAEDE941C934E65243AC7888A33C78FB2490BBA2BA06F18ECC51DE9AA54BADD061CC5BE1EA060CC3217CA11E26772BD088898D2882CB49A9FF40168E49AE6A90EE1F61132E1B6E4E7F99797DB034B30F
-20150522030122 2 6 100 1535 5 F4EE15F22E5F49997A027769656DF0240598C9470C7D67A7D7DA2777883C1C243A6F3D04E1CFA6A0350B165ECABE89A684C11ABB7E5B93B54FD6EAC85BBA9F23C6306E485BB9AC5515ABC739CE9B1A79F7DEF6D00B643856DB903E23E7F985EDCAFF867FE15498E7EF6A91057DE337A9AAEDE941C934E65243AC7888A33C78FB2490BBA2BA06F18ECC51DE9AA54BADD061CC5BE1EA060CC3217CA11E26772BD088898D2882CB49A9FF40168E49AE6A90EE1F61132E1B6E4E7F99797DB04822EF
-20150522030124 2 6 100 1535 5 F4EE15F22E5F49997A027769656DF0240598C9470C7D67A7D7DA2777883C1C243A6F3D04E1CFA6A0350B165ECABE89A684C11ABB7E5B93B54FD6EAC85BBA9F23C6306E485BB9AC5515ABC739CE9B1A79F7DEF6D00B643856DB903E23E7F985EDCAFF867FE15498E7EF6A91057DE337A9AAEDE941C934E65243AC7888A33C78FB2490BBA2BA06F18ECC51DE9AA54BADD061CC5BE1EA060CC3217CA11E26772BD088898D2882CB49A9FF40168E49AE6A90EE1F61132E1B6E4E7F99797DB0528867
-20150522030131 2 6 100 1535 2 F4EE15F22E5F49997A027769656DF0240598C9470C7D67A7D7DA2777883C1C243A6F3D04E1CFA6A0350B165ECABE89A684C11ABB7E5B93B54FD6EAC85BBA9F23C6306E485BB9AC5515ABC739CE9B1A79F7DEF6D00B643856DB903E23E7F985EDCAFF867FE15498E7EF6A91057DE337A9AAEDE941C934E65243AC7888A33C78FB2490BBA2BA06F18ECC51DE9AA54BADD061CC5BE1EA060CC3217CA11E26772BD088898D2882CB49A9FF40168E49AE6A90EE1F61132E1B6E4E7F99797DB08D3CAB
-20150522030136 2 6 100 1535 5 F4EE15F22E5F49997A027769656DF0240598C9470C7D67A7D7DA2777883C1C243A6F3D04E1CFA6A0350B165ECABE89A684C11ABB7E5B93B54FD6EAC85BBA9F23C6306E485BB9AC5515ABC739CE9B1A79F7DEF6D00B643856DB903E23E7F985EDCAFF867FE15498E7EF6A91057DE337A9AAEDE941C934E65243AC7888A33C78FB2490BBA2BA06F18ECC51DE9AA54BADD061CC5BE1EA060CC3217CA11E26772BD088898D2882CB49A9FF40168E49AE6A90EE1F61132E1B6E4E7F99797DB0B10C6F
-20150522030138 2 6 100 1535 5 F4EE15F22E5F49997A027769656DF0240598C9470C7D67A7D7DA2777883C1C243A6F3D04E1CFA6A0350B165ECABE89A684C11ABB7E5B93B54FD6EAC85BBA9F23C6306E485BB9AC5515ABC739CE9B1A79F7DEF6D00B643856DB903E23E7F985EDCAFF867FE15498E7EF6A91057DE337A9AAEDE941C934E65243AC7888A33C78FB2490BBA2BA06F18ECC51DE9AA54BADD061CC5BE1EA060CC3217CA11E26772BD088898D2882CB49A9FF40168E49AE6A90EE1F61132E1B6E4E7F99797DB0C688A7
-20150522030140 2 6 100 1535 2 F4EE15F22E5F49997A027769656DF0240598C9470C7D67A7D7DA2777883C1C243A6F3D04E1CFA6A0350B165ECABE89A684C11ABB7E5B93B54FD6EAC85BBA9F23C6306E485BB9AC5515ABC739CE9B1A79F7DEF6D00B643856DB903E23E7F985EDCAFF867FE15498E7EF6A91057DE337A9AAEDE941C934E65243AC7888A33C78FB2490BBA2BA06F18ECC51DE9AA54BADD061CC5BE1EA060CC3217CA11E26772BD088898D2882CB49A9FF40168E49AE6A90EE1F61132E1B6E4E7F99797DB0CCDF9B
-20150522030141 2 6 100 1535 2 F4EE15F22E5F49997A027769656DF0240598C9470C7D67A7D7DA2777883C1C243A6F3D04E1CFA6A0350B165ECABE89A684C11ABB7E5B93B54FD6EAC85BBA9F23C6306E485BB9AC5515ABC739CE9B1A79F7DEF6D00B643856DB903E23E7F985EDCAFF867FE15498E7EF6A91057DE337A9AAEDE941C934E65243AC7888A33C78FB2490BBA2BA06F18ECC51DE9AA54BADD061CC5BE1EA060CC3217CA11E26772BD088898D2882CB49A9FF40168E49AE6A90EE1F61132E1B6E4E7F99797DB0CFD81B
-20150522030145 2 6 100 1535 2 F4EE15F22E5F49997A027769656DF0240598C9470C7D67A7D7DA2777883C1C243A6F3D04E1CFA6A0350B165ECABE89A684C11ABB7E5B93B54FD6EAC85BBA9F23C6306E485BB9AC5515ABC739CE9B1A79F7DEF6D00B643856DB903E23E7F985EDCAFF867FE15498E7EF6A91057DE337A9AAEDE941C934E65243AC7888A33C78FB2490BBA2BA06F18ECC51DE9AA54BADD061CC5BE1EA060CC3217CA11E26772BD088898D2882CB49A9FF40168E49AE6A90EE1F61132E1B6E4E7F99797DB0F59763
-20150522030148 2 6 100 1535 2 F4EE15F22E5F49997A027769656DF0240598C9470C7D67A7D7DA2777883C1C243A6F3D04E1CFA6A0350B165ECABE89A684C11ABB7E5B93B54FD6EAC85BBA9F23C6306E485BB9AC5515ABC739CE9B1A79F7DEF6D00B643856DB903E23E7F985EDCAFF867FE15498E7EF6A91057DE337A9AAEDE941C934E65243AC7888A33C78FB2490BBA2BA06F18ECC51DE9AA54BADD061CC5BE1EA060CC3217CA11E26772BD088898D2882CB49A9FF40168E49AE6A90EE1F61132E1B6E4E7F99797DB10339FB
-20150522030149 2 6 100 1535 2 F4EE15F22E5F49997A027769656DF0240598C9470C7D67A7D7DA2777883C1C243A6F3D04E1CFA6A0350B165ECABE89A684C11ABB7E5B93B54FD6EAC85BBA9F23C6306E485BB9AC5515ABC739CE9B1A79F7DEF6D00B643856DB903E23E7F985EDCAFF867FE15498E7EF6A91057DE337A9AAEDE941C934E65243AC7888A33C78FB2490BBA2BA06F18ECC51DE9AA54BADD061CC5BE1EA060CC3217CA11E26772BD088898D2882CB49A9FF40168E49AE6A90EE1F61132E1B6E4E7F99797DB10E3ACB
-20150522030150 2 6 100 1535 2 F4EE15F22E5F49997A027769656DF0240598C9470C7D67A7D7DA2777883C1C243A6F3D04E1CFA6A0350B165ECABE89A684C11ABB7E5B93B54FD6EAC85BBA9F23C6306E485BB9AC5515ABC739CE9B1A79F7DEF6D00B643856DB903E23E7F985EDCAFF867FE15498E7EF6A91057DE337A9AAEDE941C934E65243AC7888A33C78FB2490BBA2BA06F18ECC51DE9AA54BADD061CC5BE1EA060CC3217CA11E26772BD088898D2882CB49A9FF40168E49AE6A90EE1F61132E1B6E4E7F99797DB11127F3
-20150522030159 2 6 100 1535 2 F4EE15F22E5F49997A027769656DF0240598C9470C7D67A7D7DA2777883C1C243A6F3D04E1CFA6A0350B165ECABE89A684C11ABB7E5B93B54FD6EAC85BBA9F23C6306E485BB9AC5515ABC739CE9B1A79F7DEF6D00B643856DB903E23E7F985EDCAFF867FE15498E7EF6A91057DE337A9AAEDE941C934E65243AC7888A33C78FB2490BBA2BA06F18ECC51DE9AA54BADD061CC5BE1EA060CC3217CA11E26772BD088898D2882CB49A9FF40168E49AE6A90EE1F61132E1B6E4E7F99797DB15B8BDB
diff --git a/crypto/external/bsd/openssh/dist/monitor.c b/crypto/external/bsd/openssh/dist/monitor.c
index 3eb9722a2cf..612da1ab89a 100644
--- a/crypto/external/bsd/openssh/dist/monitor.c
+++ b/crypto/external/bsd/openssh/dist/monitor.c
@@ -1,5 +1,6 @@
-/* $NetBSD: monitor.c,v 1.17 2016/01/14 22:30:04 christos Exp $ */
-/* $OpenBSD: monitor.c,v 1.150 2015/06/22 23:42:16 djm Exp $ */
+/* $NetBSD: monitor.c,v 1.18 2016/03/11 01:55:00 christos Exp $ */
+/* $OpenBSD: monitor.c,v 1.157 2016/02/15 23:32:37 djm Exp $ */
+
/*
* Copyright 2002 Niels Provos <provos@citi.umich.edu>
* Copyright 2002 Markus Friedl <markus@openbsd.org>
@@ -27,7 +28,7 @@
*/
#include "includes.h"
-__RCSID("$NetBSD: monitor.c,v 1.17 2016/01/14 22:30:04 christos Exp $");
+__RCSID("$NetBSD: monitor.c,v 1.18 2016/03/11 01:55:00 christos Exp $");
#include <sys/types.h>
#include <sys/wait.h>
#include <sys/socket.h>
@@ -465,15 +466,10 @@ monitor_sync(struct monitor *pmonitor)
static void *
mm_zalloc(struct mm_master *mm, u_int ncount, u_int size)
{
- size_t len = (size_t) size * ncount;
- void *address;
-
- if (len == 0 || ncount > SIZE_MAX / size)
+ if (size == 0 || ncount == 0 || ncount > SIZE_MAX / size)
fatal("%s: mm_zalloc(%u, %u)", __func__, ncount, size);
- address = mm_malloc(mm, len);
-
- return (address);
+ return mm_malloc(mm, size * ncount);
}
static void
@@ -668,18 +664,19 @@ mm_answer_sign(int sock, Buffer *m)
struct ssh *ssh = active_state; /* XXX */
extern int auth_sock; /* XXX move to state struct? */
struct sshkey *key;
- struct sshbuf *sigbuf;
- u_char *p;
- u_char *signature;
- size_t datlen, siglen;
- uint32_t keyid;
+ struct sshbuf *sigbuf = NULL;
+ u_char *p = NULL, *signature = NULL;
+ char *alg = NULL;
+ size_t datlen, siglen, alglen;
int r, is_proof = 0;
+ uint32_t keyid;
const char proof_req[] = "hostkeys-prove-00@openssh.com";
debug3("%s", __func__);
if ((r = sshbuf_get_u32(m, &keyid)) != 0 ||
- (r = sshbuf_get_string(m, &p, &datlen)) != 0)
+ (r = sshbuf_get_string(m, &p, &datlen)) != 0 ||
+ (r = sshbuf_get_cstring(m, &alg, &alglen)) != 0)
fatal("%s: buffer error: %s", __func__, ssh_err(r));
/*
@@ -706,7 +703,7 @@ mm_answer_sign(int sock, Buffer *m)
fatal("%s: sshbuf_new", __func__);
if ((r = sshbuf_put_cstring(sigbuf, proof_req)) != 0 ||
(r = sshbuf_put_string(sigbuf, session_id2,
- session_id2_len) != 0) ||
+ session_id2_len)) != 0 ||
(r = sshkey_puts(key, sigbuf)) != 0)
fatal("%s: couldn't prepare private key "
"proof buffer: %s", __func__, ssh_err(r));
@@ -726,14 +723,14 @@ mm_answer_sign(int sock, Buffer *m)
}
if ((key = get_hostkey_by_index(keyid)) != NULL) {
- if ((r = sshkey_sign(key, &signature, &siglen, p, datlen,
+ if ((r = sshkey_sign(key, &signature, &siglen, p, datlen, alg,
datafellows)) != 0)
fatal("%s: sshkey_sign failed: %s",
__func__, ssh_err(r));
} else if ((key = get_hostkey_public_by_index(keyid, ssh)) != NULL &&
auth_sock > 0) {
if ((r = ssh_agent_sign(auth_sock, key, &signature, &siglen,
- p, datlen, datafellows)) != 0) {
+ p, datlen, alg, datafellows)) != 0) {
fatal("%s: ssh_agent_sign failed: %s",
__func__, ssh_err(r));
}
@@ -747,6 +744,7 @@ mm_answer_sign(int sock, Buffer *m)
if ((r = sshbuf_put_string(m, signature, siglen)) != 0)
fatal("%s: buffer error: %s", __func__, ssh_err(r));
+ free(alg);
free(p);
free(signature);
@@ -947,7 +945,7 @@ mm_answer_bsdauthrespond(int sock, Buffer *m)
char *response;
int authok;
- if (authctxt->as == 0)
+ if (authctxt->as == NULL)
fatal("%s: no bsd auth session", __func__);
response = buffer_get_string(m, NULL);
@@ -1424,7 +1422,7 @@ mm_answer_keyverify(int sock, Buffer *m)
__func__, key, (verified == 1) ? "verified" : "unverified");
/* If auth was successful then record key to ensure it isn't reused */
- if (verified == 1)
+ if (verified == 1 && key_blobtype == MM_USERKEY)
auth2_record_userkey(authctxt, key);
else
key_free(key);
@@ -1865,7 +1863,7 @@ monitor_apply_keystate(struct monitor *pmonitor)
sshbuf_free(child_state);
child_state = NULL;
- if ((kex = ssh->kex) != 0) {
+ if ((kex = ssh->kex) != NULL) {
/* XXX set callbacks */
#ifdef WITH_OPENSSL
kex->kex[KEX_DH_GRP1_SHA1] = kexdh_server;
diff --git a/crypto/external/bsd/openssh/dist/monitor_wrap.c b/crypto/external/bsd/openssh/dist/monitor_wrap.c
index 2127334504a..3b468e25c24 100644
--- a/crypto/external/bsd/openssh/dist/monitor_wrap.c
+++ b/crypto/external/bsd/openssh/dist/monitor_wrap.c
@@ -1,5 +1,6 @@
-/* $NetBSD: monitor_wrap.c,v 1.13 2016/01/14 22:30:04 christos Exp $ */
-/* $OpenBSD: monitor_wrap.c,v 1.85 2015/05/01 03:23:51 djm Exp $ */
+/* $NetBSD: monitor_wrap.c,v 1.14 2016/03/11 01:55:00 christos Exp $ */
+/* $OpenBSD: monitor_wrap.c,v 1.87 2016/01/14 16:17:40 markus Exp $ */
+
/*
* Copyright 2002 Niels Provos <provos@citi.umich.edu>
* Copyright 2002 Markus Friedl <markus@openbsd.org>
@@ -27,7 +28,7 @@
*/
#include "includes.h"
-__RCSID("$NetBSD: monitor_wrap.c,v 1.13 2016/01/14 22:30:04 christos Exp $");
+__RCSID("$NetBSD: monitor_wrap.c,v 1.14 2016/03/11 01:55:00 christos Exp $");
#include <sys/types.h>
#include <sys/uio.h>
#include <sys/queue.h>
@@ -215,7 +216,7 @@ mm_choose_dh(int min, int nbits, int max)
int
mm_key_sign(Key *key, u_char **sigp, u_int *lenp,
- const u_char *data, u_int datalen)
+ const u_char *data, u_int datalen, const char *hostkey_alg)
{
struct kex *kex = *pmonitor->m_pkex;
Buffer m;
@@ -225,6 +226,7 @@ mm_key_sign(Key *key, u_char **sigp, u_int *lenp,
buffer_init(&m);
buffer_put_int(&m, kex->host_key_index(key, 0, active_state));
buffer_put_string(&m, data, datalen);
+ buffer_put_cstring(&m, hostkey_alg);
mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_SIGN, &m);
diff --git a/crypto/external/bsd/openssh/dist/monitor_wrap.h b/crypto/external/bsd/openssh/dist/monitor_wrap.h
index fec03b48cb5..c2bcd547052 100644
--- a/crypto/external/bsd/openssh/dist/monitor_wrap.h
+++ b/crypto/external/bsd/openssh/dist/monitor_wrap.h
@@ -1,5 +1,5 @@
-/* $NetBSD: monitor_wrap.h,v 1.9 2015/07/03 01:00:00 christos Exp $ */
-/* $OpenBSD: monitor_wrap.h,v 1.27 2015/05/01 03:23:51 djm Exp $ */
+/* $NetBSD: monitor_wrap.h,v 1.10 2016/03/11 01:55:00 christos Exp $ */
+/* $OpenBSD: monitor_wrap.h,v 1.29 2015/12/04 16:41:28 markus Exp $ */
/*
* Copyright 2002 Niels Provos <provos@citi.umich.edu>
@@ -41,7 +41,7 @@ struct Authctxt;
void mm_log_handler(LogLevel, const char *, void *);
int mm_is_monitor(void);
DH *mm_choose_dh(int, int, int);
-int mm_key_sign(Key *, u_char **, u_int *, const u_char *, u_int);
+int mm_key_sign(Key *, u_char **, u_int *, const u_char *, u_int, const char *);
void mm_inform_authserv(char *, char *);
struct passwd *mm_getpwnamallow(const char *);
char *mm_auth2_read_banner(void);
diff --git a/crypto/external/bsd/openssh/dist/mux.c b/crypto/external/bsd/openssh/dist/mux.c
index d2ec45fff0a..66188038f98 100644
--- a/crypto/external/bsd/openssh/dist/mux.c
+++ b/crypto/external/bsd/openssh/dist/mux.c
@@ -1,5 +1,6 @@
-/* $NetBSD: mux.c,v 1.14 2016/01/19 17:10:55 christos Exp $ */
-/* $OpenBSD: mux.c,v 1.54 2015/08/19 23:18:26 djm Exp $ */
+/* $NetBSD: mux.c,v 1.15 2016/03/11 01:55:00 christos Exp $ */
+/* $OpenBSD: mux.c,v 1.58 2016/01/13 23:04:47 djm Exp $ */
+
/*
* Copyright (c) 2002-2008 Damien Miller <djm@openbsd.org>
*
@@ -32,7 +33,7 @@
*/
#include "includes.h"
-__RCSID("$NetBSD: mux.c,v 1.14 2016/01/19 17:10:55 christos Exp $");
+__RCSID("$NetBSD: mux.c,v 1.15 2016/03/11 01:55:00 christos Exp $");
#include <sys/types.h>
#include <sys/queue.h>
#include <sys/stat.h>
@@ -1730,7 +1731,7 @@ mux_client_forward(int fd, int cancel_flag, u_int ftype, struct Forward *fwd)
fwd->connect_host ? fwd->connect_host : "",
fwd->connect_port);
if (muxclient_command == SSHMUX_COMMAND_FORWARD)
- fprintf(stdout, "%u\n", fwd->allocated_port);
+ fprintf(stdout, "%i\n", fwd->allocated_port);
break;
case MUX_S_PERMISSION_DENIED:
e = buffer_get_string(&m, NULL);
@@ -1875,6 +1876,11 @@ mux_client_request_session(int fd)
}
muxclient_request_id++;
+#ifdef __OpenBSD__
+ if (pledge("stdio proc tty", NULL) == -1)
+ fatal("%s pledge(): %s", __func__, strerror(errno));
+#endif
+
signal(SIGHUP, control_client_sighandler);
signal(SIGINT, control_client_sighandler);
signal(SIGTERM, control_client_sighandler);
@@ -1982,6 +1988,11 @@ mux_client_request_stdio_fwd(int fd)
mm_send_fd(fd, STDOUT_FILENO) == -1)
fatal("%s: send fds failed", __func__);
+#ifdef __OpenBSD__
+ if (pledge("stdio proc tty", NULL) == -1)
+ fatal("%s pledge(): %s", __func__, strerror(errno));
+#endif
+
debug3("%s: stdio forward request sent", __func__);
/* Read their reply */
@@ -2154,7 +2165,7 @@ muxclient(const char *path)
case SSHMUX_COMMAND_ALIVE_CHECK:
if ((pid = mux_client_request_alive(sock)) == 0)
fatal("%s: master alive check failed", __func__);
- fprintf(stderr, "Master running (pid=%d)\r\n", pid);
+ fprintf(stderr, "Master running (pid=%u)\r\n", pid);
exit(0);
case SSHMUX_COMMAND_TERMINATE:
mux_client_request_terminate(sock);
diff --git a/crypto/external/bsd/openssh/dist/myproposal.h b/crypto/external/bsd/openssh/dist/myproposal.h
index 3b431d5692e..e59c3a37696 100644
--- a/crypto/external/bsd/openssh/dist/myproposal.h
+++ b/crypto/external/bsd/openssh/dist/myproposal.h
@@ -1,5 +1,5 @@
-/* $NetBSD: myproposal.h,v 1.12 2015/08/13 10:33:21 christos Exp $ */
-/* $OpenBSD: myproposal.h,v 1.47 2015/07/10 06:21:53 markus Exp $ */
+/* $NetBSD: myproposal.h,v 1.13 2016/03/11 01:55:00 christos Exp $ */
+/* $OpenBSD: myproposal.h,v 1.50 2016/02/09 05:30:04 djm Exp $ */
/*
* Copyright (c) 2000 Markus Friedl. All rights reserved.
@@ -51,6 +51,8 @@
"ecdsa-sha2-nistp384," \
"ecdsa-sha2-nistp521," \
"ssh-ed25519," \
+ "rsa-sha2-512," \
+ "rsa-sha2-256," \
"ssh-rsa"
#define KEX_SERVER_ENCRYPT \
@@ -59,9 +61,7 @@
"aes128-gcm@openssh.com,aes256-gcm@openssh.com"
#define KEX_CLIENT_ENCRYPT KEX_SERVER_ENCRYPT "," \
- "arcfour256,arcfour128," \
- "aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc," \
- "aes192-cbc,aes256-cbc,arcfour,rijndael-cbc@lysator.liu.se"
+ "aes128-cbc,aes192-cbc,aes256-cbc,3des-cbc"
#define KEX_SERVER_MAC \
"umac-64-etm@openssh.com," \
@@ -75,18 +75,9 @@
"hmac-sha2-512," \
"hmac-sha1"
-#define KEX_CLIENT_MAC KEX_SERVER_MAC "," \
- "hmac-md5-etm@openssh.com," \
- "hmac-ripemd160-etm@openssh.com," \
- "hmac-sha1-96-etm@openssh.com," \
- "hmac-md5-96-etm@openssh.com," \
- "hmac-md5," \
- "hmac-ripemd160," \
- "hmac-ripemd160@openssh.com," \
- "hmac-sha1-96," \
- "hmac-md5-96"
-
-#else
+#define KEX_CLIENT_MAC KEX_SERVER_MAC
+
+#else /* WITH_OPENSSL */
#define KEX_SERVER_KEX \
"curve25519-sha256@libssh.org"
diff --git a/crypto/external/bsd/openssh/dist/opacket.c b/crypto/external/bsd/openssh/dist/opacket.c
index 489656aa19b..e15148473a3 100644
--- a/crypto/external/bsd/openssh/dist/opacket.c
+++ b/crypto/external/bsd/openssh/dist/opacket.c
@@ -1,8 +1,8 @@
-/* $NetBSD: opacket.c,v 1.4 2016/01/14 22:30:04 christos Exp $ */
+/* $NetBSD: opacket.c,v 1.5 2016/03/11 01:55:00 christos Exp $ */
/* Written by Markus Friedl. Placed in the public domain. */
#include "includes.h"
-__RCSID("$NetBSD: opacket.c,v 1.4 2016/01/14 22:30:04 christos Exp $");
+__RCSID("$NetBSD: opacket.c,v 1.5 2016/03/11 01:55:00 christos Exp $");
#include "ssherr.h"
#include "packet.h"
diff --git a/crypto/external/bsd/openssh/dist/opacket.h b/crypto/external/bsd/openssh/dist/opacket.h
index 08b286cb0d7..2d255078cfb 100644
--- a/crypto/external/bsd/openssh/dist/opacket.h
+++ b/crypto/external/bsd/openssh/dist/opacket.h
@@ -1,4 +1,4 @@
-/* $NetBSD: opacket.h,v 1.3 2016/01/14 22:30:04 christos Exp $ */
+/* $NetBSD: opacket.h,v 1.4 2016/03/11 01:55:00 christos Exp $ */
#ifndef _OPACKET_H
/* Written by Markus Friedl. Placed in the public domain. */
@@ -128,8 +128,6 @@ void packet_read_expect(int expected_type);
sshpkt_add_padding(active_state, (pad))
#define packet_send_ignore(nbytes) \
ssh_packet_send_ignore(active_state, (nbytes))
-#define packet_need_rekeying() \
- ssh_packet_need_rekeying(active_state)
#define packet_set_server() \
ssh_packet_set_server(active_state)
#define packet_set_authenticated() \
diff --git a/crypto/external/bsd/openssh/dist/packet.c b/crypto/external/bsd/openssh/dist/packet.c
index 7d418f7e5f5..430c78fba03 100644
--- a/crypto/external/bsd/openssh/dist/packet.c
+++ b/crypto/external/bsd/openssh/dist/packet.c
@@ -1,5 +1,6 @@
-/* $NetBSD: packet.c,v 1.22 2016/01/14 22:30:04 christos Exp $ */
-/* $OpenBSD: packet.c,v 1.214 2015/08/20 22:32:42 deraadt Exp $ */
+/* $NetBSD: packet.c,v 1.23 2016/03/11 01:55:00 christos Exp $ */
+/* $OpenBSD: packet.c,v 1.229 2016/02/17 22:20:14 djm Exp $ */
+
/*
* Author: Tatu Ylonen <ylo@cs.hut.fi>
* Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
@@ -39,7 +40,7 @@
*/
#include "includes.h"
-__RCSID("$NetBSD: packet.c,v 1.22 2016/01/14 22:30:04 christos Exp $");
+__RCSID("$NetBSD: packet.c,v 1.23 2016/03/11 01:55:00 christos Exp $");
#include <sys/param.h> /* MIN roundup */
#include <sys/types.h>
#include <sys/queue.h>
@@ -177,8 +178,7 @@ struct session_state {
struct packet_state p_read, p_send;
/* Volume-based rekeying */
- u_int64_t max_blocks_in, max_blocks_out;
- u_int32_t rekey_limit;
+ u_int64_t max_blocks_in, max_blocks_out, rekey_limit;
/* Time-based rekeying */
u_int32_t rekey_interval; /* how often in seconds */
@@ -257,6 +257,14 @@ ssh_alloc_session_state(void)
return NULL;
}
+/* Returns nonzero if rekeying is in progress */
+int
+ssh_packet_is_rekeying(struct ssh *ssh)
+{
+ return compat20 &&
+ (ssh->state->rekeying || (ssh->kex != NULL && ssh->kex->done == 0));
+}
+
/*
* Sets the descriptors used for communication. Disables encryption until
* packet_set_encryption_key is called.
@@ -334,7 +342,8 @@ ssh_packet_stop_discard(struct ssh *ssh)
sshbuf_ptr(state->incoming_packet), PACKET_MAX_SIZE,
NULL, 0);
}
- logit("Finished discarding for %.200s", ssh_remote_ipaddr(ssh));
+ logit("Finished discarding for %.200s port %d",
+ ssh_remote_ipaddr(ssh), ssh_remote_port(ssh));
return SSH_ERR_MAC_INVALID;
}
@@ -446,16 +455,30 @@ ssh_packet_get_connection_out(struct ssh *ssh)
const char *
ssh_remote_ipaddr(struct ssh *ssh)
{
+ const int sock = ssh->state->connection_in;
+
/* Check whether we have cached the ipaddr. */
- if (ssh->remote_ipaddr == NULL)
- ssh->remote_ipaddr = ssh_packet_connection_is_on_socket(ssh) ?
- get_peer_ipaddr(ssh->state->connection_in) :
- strdup("UNKNOWN");
- if (ssh->remote_ipaddr == NULL)
- return "UNKNOWN";
+ if (ssh->remote_ipaddr == NULL) {
+ if (ssh_packet_connection_is_on_socket(ssh)) {
+ ssh->remote_ipaddr = get_peer_ipaddr(sock);
+ ssh->remote_port = get_sock_port(sock, 0);
+ } else {
+ ssh->remote_ipaddr = strdup("UNKNOWN");
+ ssh->remote_port = 0;
+ }
+ }
return ssh->remote_ipaddr;
}
+/* Returns the port number of the remote host. */
+
+int
+ssh_remote_port(struct ssh *ssh)
+{
+ (void)ssh_remote_ipaddr(ssh); /* Will lookup and cache. */
+ return ssh->remote_port;
+}
+
/* Closes the connection and clears and frees internal data structures. */
void
@@ -510,10 +533,8 @@ ssh_packet_close(struct ssh *ssh)
error("%s: cipher_cleanup failed: %s", __func__, ssh_err(r));
if ((r = cipher_cleanup(&state->receive_context)) != 0)
error("%s: cipher_cleanup failed: %s", __func__, ssh_err(r));
- if (ssh->remote_ipaddr) {
- free(ssh->remote_ipaddr);
- ssh->remote_ipaddr = NULL;
- }
+ free(ssh->remote_ipaddr);
+ ssh->remote_ipaddr = NULL;
free(ssh->state);
ssh->state = NULL;
}
@@ -932,7 +953,12 @@ ssh_set_newkeys(struct ssh *ssh, int mode)
max_blocks = &state->max_blocks_in;
}
if (state->newkeys[mode] != NULL) {
- debug("set_newkeys: rekeying");
+ debug("set_newkeys: rekeying, input %llu bytes %llu blocks, "
+ "output %llu bytes %llu blocks",
+ (unsigned long long)state->p_read.bytes,
+ (unsigned long long)state->p_read.blocks,
+ (unsigned long long)state->p_send.bytes,
+ (unsigned long long)state->p_send.blocks);
if ((r = cipher_cleanup(cc)) != 0)
return r;
enc = &state->newkeys[mode]->enc;
@@ -1000,9 +1026,55 @@ ssh_set_newkeys(struct ssh *ssh, int mode)
if (state->rekey_limit)
*max_blocks = MIN(*max_blocks,
state->rekey_limit / enc->block_size);
+ debug("rekey after %llu blocks", (unsigned long long)*max_blocks);
return 0;
}
+#define MAX_PACKETS (1U<<31)
+static int
+ssh_packet_need_rekeying(struct ssh *ssh, u_int outbound_packet_len)
+{
+ struct session_state *state = ssh->state;
+ u_int32_t out_blocks;
+
+ /* XXX client can't cope with rekeying pre-auth */
+ if (!state->after_authentication)
+ return 0;
+
+ /* Haven't keyed yet or KEX in progress. */
+ if (ssh->kex == NULL || ssh_packet_is_rekeying(ssh))
+ return 0;
+
+ /* Peer can't rekey */
+ if (ssh->compat & SSH_BUG_NOREKEY)
+ return 0;
+
+ /*
+ * Permit one packet in or out per rekey - this allows us to
+ * make progress when rekey limits are very small.
+ */
+ if (state->p_send.packets == 0 && state->p_read.packets == 0)
+ return 0;
+
+ /* Time-based rekeying */
+ if (state->rekey_interval != 0 &&
+ state->rekey_time + state->rekey_interval <= monotime())
+ return 1;
+
+ /* Always rekey when MAX_PACKETS sent in either direction */
+ if (state->p_send.packets > MAX_PACKETS ||
+ state->p_read.packets > MAX_PACKETS)
+ return 1;
+
+ /* Rekey after (cipher-specific) maxiumum blocks */
+ out_blocks = roundup(outbound_packet_len,
+ state->newkeys[MODE_OUT]->enc.block_size);
+ return (state->max_blocks_out &&
+ (state->p_send.blocks + out_blocks > state->max_blocks_out)) ||
+ (state->max_blocks_in &&
+ (state->p_read.blocks > state->max_blocks_in));
+}
+
/*
* Delayed compression for SSH2 is enabled after authentication:
* This happens on the server side after a SSH2_MSG_USERAUTH_SUCCESS is sent,
@@ -1041,6 +1113,20 @@ ssh_packet_enable_delayed_compress(struct ssh *ssh)
return 0;
}
+/* Used to mute debug logging for noisy packet types */
+static int
+ssh_packet_log_type(u_char type)
+{
+ switch (type) {
+ case SSH2_MSG_CHANNEL_DATA:
+ case SSH2_MSG_CHANNEL_EXTENDED_DATA:
+ case SSH2_MSG_CHANNEL_WINDOW_ADJUST:
+ return 0;
+ default:
+ return 1;
+ }
+}
+
/*
* Finalize packet in SSH2 format (compress, mac, encrypt, enqueue)
*/
@@ -1069,7 +1155,8 @@ ssh_packet_send2_wrapped(struct ssh *ssh)
aadlen = (mac && mac->enabled && mac->etm) || authlen ? 4 : 0;
type = (sshbuf_ptr(state->outgoing_packet))[5];
-
+ if (ssh_packet_log_type(type))
+ debug3("send packet: type %u", type);
#ifdef PACKET_DEBUG
fprintf(stderr, "plain: ");
sshbuf_dump(state->outgoing_packet, stderr);
@@ -1195,35 +1282,59 @@ debug("mac %p, %d %d", mac, mac? mac->enabled : -1, mac ? mac->etm : -1);
return len - 4;
}
+/* returns non-zero if the specified packet type is usec by KEX */
+static int
+ssh_packet_type_is_kex(u_char type)
+{
+ return
+ type >= SSH2_MSG_TRANSPORT_MIN &&
+ type <= SSH2_MSG_TRANSPORT_MAX &&
+ type != SSH2_MSG_SERVICE_REQUEST &&
+ type != SSH2_MSG_SERVICE_ACCEPT &&
+ type != SSH2_MSG_EXT_INFO;
+}
+
int
ssh_packet_send2(struct ssh *ssh)
{
struct session_state *state = ssh->state;
struct packet *p;
u_char type;
- int r;
+ int r, need_rekey;
int packet_length;
+ if (sshbuf_len(state->outgoing_packet) < 6)
+ return SSH_ERR_INTERNAL_ERROR;
type = sshbuf_ptr(state->outgoing_packet)[5];
+ need_rekey = !ssh_packet_type_is_kex(type) &&
+ ssh_packet_need_rekeying(ssh, sshbuf_len(state->outgoing_packet));
- /* during rekeying we can only send key exchange messages */
- if (state->rekeying) {
- if ((type < SSH2_MSG_TRANSPORT_MIN) ||
- (type > SSH2_MSG_TRANSPORT_MAX) ||
- (type == SSH2_MSG_SERVICE_REQUEST) ||
- (type == SSH2_MSG_SERVICE_ACCEPT)) {
- debug("enqueue packet: %u", type);
- p = calloc(1, sizeof(*p));
- if (p == NULL)
- return SSH_ERR_ALLOC_FAIL;
- p->type = type;
- p->payload = state->outgoing_packet;
- TAILQ_INSERT_TAIL(&state->outgoing, p, next);
- state->outgoing_packet = sshbuf_new();
- if (state->outgoing_packet == NULL)
- return SSH_ERR_ALLOC_FAIL;
- return sshbuf_len(state->outgoing_packet);
+ /*
+ * During rekeying we can only send key exchange messages.
+ * Queue everything else.
+ */
+ if ((need_rekey || state->rekeying) && !ssh_packet_type_is_kex(type)) {
+ if (need_rekey)
+ debug3("%s: rekex triggered", __func__);
+ debug("enqueue packet: %u", type);
+ p = calloc(1, sizeof(*p));
+ if (p == NULL)
+ return SSH_ERR_ALLOC_FAIL;
+ p->type = type;
+ p->payload = state->outgoing_packet;
+ TAILQ_INSERT_TAIL(&state->outgoing, p, next);
+ state->outgoing_packet = sshbuf_new();
+ if (state->outgoing_packet == NULL)
+ return SSH_ERR_ALLOC_FAIL;
+ if (need_rekey) {
+ /*
+ * This packet triggered a rekey, so send the
+ * KEXINIT now.
+ * NB. reenters this function via kex_start_rekex().
+ */
+ return kex_start_rekex(ssh);
}
+ return 0;
}
/* rekeying starts with sending KEXINIT */
@@ -1241,10 +1352,22 @@ ssh_packet_send2(struct ssh *ssh)
state->rekey_time = monotime();
while ((p = TAILQ_FIRST(&state->outgoing))) {
type = p->type;
+ /*
+ * If this packet triggers a rekex, then skip the
+ * remaining packets in the queue for now.
+ * NB. re-enters this function via kex_start_rekex.
+ */
+ if (ssh_packet_need_rekeying(ssh,
+ sshbuf_len(p->payload))) {
+ debug3("%s: queued packet triggered rekex",
+ __func__);
+ return kex_start_rekex(ssh);
+ }
debug("dequeue packet: %u", type);
sshbuf_free(state->outgoing_packet);
state->outgoing_packet = p->payload;
TAILQ_REMOVE(&state->outgoing, p, next);
+ memset(p, 0, sizeof(*p));
free(p);
if ((r = ssh_packet_send2_wrapped(ssh)) < 0)
return r;
@@ -1264,7 +1387,7 @@ int
ssh_packet_read_seqnr(struct ssh *ssh, u_char *typep, u_int32_t *seqnr_p)
{
struct session_state *state = ssh->state;
- int len, r, ms_remain = 0;
+ int len, r, ms_remain;
fd_set *setp;
char buf[8192];
struct timeval timeout, start, *timeoutp = NULL;
@@ -1575,6 +1698,7 @@ ssh_packet_read_poll2(struct ssh *ssh, u_char *typep, u_int32_t *seqnr_p)
logit("Bad packet length %u.", state->packlen);
if ((r = sshpkt_disconnect(ssh, "Packet corrupt")) != 0)
return r;
+ return SSH_ERR_CONN_CORRUPT;
}
sshbuf_reset(state->incoming_packet);
} else if (state->packlen == 0) {
@@ -1727,6 +1851,8 @@ ssh_packet_read_poll2(struct ssh *ssh, u_char *typep, u_int32_t *seqnr_p)
*/
if ((r = sshbuf_get_u8(state->incoming_packet, typep)) != 0)
goto out;
+ if (ssh_packet_log_type(*typep))
+ debug3("receive packet: type %u", *typep);
if (*typep < SSH2_MSG_MIN || *typep >= SSH2_MSG_LOCAL_MIN) {
if ((r = sshpkt_disconnect(ssh,
"Invalid ssh2 packet type: %d", *typep)) != 0 ||
@@ -1746,6 +1872,13 @@ ssh_packet_read_poll2(struct ssh *ssh, u_char *typep, u_int32_t *seqnr_p)
#endif
/* reset for next packet */
state->packlen = 0;
+
+ /* do we need to rekey? */
+ if (ssh_packet_need_rekeying(ssh, 0)) {
+ debug3("%s: rekex triggered", __func__);
+ if ((r = kex_start_rekex(ssh)) != 0)
+ return r;
+ }
out:
return r;
}
@@ -1776,8 +1909,7 @@ ssh_packet_read_poll_seqnr(struct ssh *ssh, u_char *typep, u_int32_t *seqnr_p)
if ((r = sshpkt_get_u8(ssh, NULL)) != 0 ||
(r = sshpkt_get_string(ssh, &msg, NULL)) != 0 ||
(r = sshpkt_get_string(ssh, NULL, NULL)) != 0) {
- if (msg)
- free(msg);
+ free(msg);
return r;
}
debug("Remote: %.900s", msg);
@@ -1791,8 +1923,9 @@ ssh_packet_read_poll_seqnr(struct ssh *ssh, u_char *typep, u_int32_t *seqnr_p)
do_log2(ssh->state->server_side &&
reason == SSH2_DISCONNECT_BY_APPLICATION ?
SYSLOG_LEVEL_INFO : SYSLOG_LEVEL_ERROR,
- "Received disconnect from %s: %u: %.400s",
- ssh_remote_ipaddr(ssh), reason, msg);
+ "Received disconnect from %s port %d:"
+ "%u: %.400s", ssh_remote_ipaddr(ssh),
+ ssh_remote_port(ssh), reason, msg);
free(msg);
return SSH_ERR_DISCONNECTED;
case SSH2_MSG_UNIMPLEMENTED:
@@ -1820,8 +1953,9 @@ ssh_packet_read_poll_seqnr(struct ssh *ssh, u_char *typep, u_int32_t *seqnr_p)
case SSH_MSG_DISCONNECT:
if ((r = sshpkt_get_string(ssh, &msg, NULL)) != 0)
return r;
- error("Received disconnect from %s: %.400s",
- ssh_remote_ipaddr(ssh), msg);
+ error("Received disconnect from %s port %d: "
+ "%.400s", ssh_remote_ipaddr(ssh),
+ ssh_remote_port(ssh), msg);
free(msg);
return SSH_ERR_DISCONNECTED;
default:
@@ -1911,19 +2045,22 @@ sshpkt_fatal(struct ssh *ssh, const char *tag, int r)
{
switch (r) {
case SSH_ERR_CONN_CLOSED:
- logit("Connection closed by %.200s", ssh_remote_ipaddr(ssh));
+ logit("Connection closed by %.200s port %d",
+ ssh_remote_ipaddr(ssh), ssh_remote_port(ssh));
cleanup_exit(255);
case SSH_ERR_CONN_TIMEOUT:
- logit("Connection to %.200s timed out", ssh_remote_ipaddr(ssh));
+ logit("Connection %s %.200s port %d timed out",
+ ssh->state->server_side ? "from" : "to",
+ ssh_remote_ipaddr(ssh), ssh_remote_port(ssh));
cleanup_exit(255);
case SSH_ERR_DISCONNECTED:
- logit("Disconnected from %.200s",
- ssh_remote_ipaddr(ssh));
+ logit("Disconnected from %.200s port %d",
+ ssh_remote_ipaddr(ssh), ssh_remote_port(ssh));
cleanup_exit(255);
case SSH_ERR_SYSTEM_ERROR:
if (errno == ECONNRESET) {
- logit("Connection reset by %.200s",
- ssh_remote_ipaddr(ssh));
+ logit("Connection reset by %.200s port %d",
+ ssh_remote_ipaddr(ssh), ssh_remote_port(ssh));
cleanup_exit(255);
}
/* FALLTHROUGH */
@@ -1933,15 +2070,17 @@ sshpkt_fatal(struct ssh *ssh, const char *tag, int r)
case SSH_ERR_NO_KEX_ALG_MATCH:
case SSH_ERR_NO_HOSTKEY_ALG_MATCH:
if (ssh && ssh->kex && ssh->kex->failed_choice) {
- fatal("Unable to negotiate with %.200s: %s. "
+ fatal("Unable to negotiate with %.200s port %d: %s. "
"Their offer: %s", ssh_remote_ipaddr(ssh),
- ssh_err(r), ssh->kex->failed_choice);
+ ssh_remote_port(ssh), ssh_err(r),
+ ssh->kex->failed_choice);
}
/* FALLTHROUGH */
default:
- fatal("%s%sConnection to %.200s: %s",
+ fatal("%s%sConnection %s %.200s port %d: %s",
tag != NULL ? tag : "", tag != NULL ? ": " : "",
- ssh_remote_ipaddr(ssh), ssh_err(r));
+ ssh->state->server_side ? "from" : "to",
+ ssh_remote_ipaddr(ssh), ssh_remote_port(ssh), ssh_err(r));
}
}
@@ -2033,7 +2172,13 @@ ssh_packet_write_wait(struct ssh *ssh)
NFDBITS), sizeof(fd_mask));
if (setp == NULL)
return SSH_ERR_ALLOC_FAIL;
- bytes_sent += ssh_packet_write_poll(ssh);
+
+ if ((r = ssh_packet_write_poll(ssh)) < 0) {
+ free(setp);
+ return r;
+ }
+ bytes_sent += r;
+
while (ssh_packet_have_data_to_write(ssh)) {
memset(setp, 0, howmany(state->connection_out + 1,
NFDBITS) * sizeof(fd_mask));
@@ -2215,41 +2360,10 @@ ssh_packet_send_ignore(struct ssh *ssh, int nbytes)
}
}
-int rekey_requested = 0;
void
-ssh_packet_request_rekeying(void)
-{
- rekey_requested = 1;
-}
-
-#define MAX_PACKETS (1U<<31)
-int
-ssh_packet_need_rekeying(struct ssh *ssh)
+ssh_packet_set_rekey_limits(struct ssh *ssh, u_int64_t bytes, time_t seconds)
{
- struct session_state *state = ssh->state;
-
- if (ssh->compat & SSH_BUG_NOREKEY)
- return 0;
- if (rekey_requested == 1)
- {
- rekey_requested = 0;
- return 1;
- }
- return
- (state->p_send.packets > MAX_PACKETS) ||
- (state->p_read.packets > MAX_PACKETS) ||
- (state->max_blocks_out &&
- (state->p_send.blocks > state->max_blocks_out)) ||
- (state->max_blocks_in &&
- (state->p_read.blocks > state->max_blocks_in)) ||
- (state->rekey_interval != 0 && state->rekey_time +
- state->rekey_interval <= monotime());
-}
-
-void
-ssh_packet_set_rekey_limits(struct ssh *ssh, u_int32_t bytes, time_t seconds)
-{
- debug3("rekey after %lld bytes, %d seconds", (long long)bytes,
+ debug3("rekey after %llu bytes, %d seconds", (unsigned long long)bytes,
(int)seconds);
ssh->state->rekey_limit = bytes;
ssh->state->rekey_interval = seconds;
@@ -2376,8 +2490,7 @@ newkeys_to_blob(struct sshbuf *m, struct ssh *ssh, int mode)
goto out;
r = sshbuf_put_stringb(m, b);
out:
- if (b != NULL)
- sshbuf_free(b);
+ sshbuf_free(b);
return r;
}
@@ -2408,7 +2521,7 @@ ssh_packet_get_state(struct ssh *ssh, struct sshbuf *m)
if ((r = kex_to_blob(m, ssh->kex)) != 0 ||
(r = newkeys_to_blob(m, ssh, MODE_OUT)) != 0 ||
(r = newkeys_to_blob(m, ssh, MODE_IN)) != 0 ||
- (r = sshbuf_put_u32(m, state->rekey_limit)) != 0 ||
+ (r = sshbuf_put_u64(m, state->rekey_limit)) != 0 ||
(r = sshbuf_put_u32(m, state->rekey_interval)) != 0 ||
(r = sshbuf_put_u32(m, state->p_send.seqnr)) != 0 ||
(r = sshbuf_put_u64(m, state->p_send.blocks)) != 0 ||
@@ -2507,10 +2620,8 @@ newkeys_from_blob(struct sshbuf *m, struct ssh *ssh, int mode)
newkey = NULL;
r = 0;
out:
- if (newkey != NULL)
- free(newkey);
- if (b != NULL)
- sshbuf_free(b);
+ free(newkey);
+ sshbuf_free(b);
return r;
}
@@ -2543,10 +2654,8 @@ kex_from_blob(struct sshbuf *m, struct kex **kexp)
out:
if (r != 0 || kexp == NULL) {
if (kex != NULL) {
- if (kex->my != NULL)
- sshbuf_free(kex->my);
- if (kex->peer != NULL)
- sshbuf_free(kex->peer);
+ sshbuf_free(kex->my);
+ sshbuf_free(kex->peer);
free(kex);
}
if (kexp != NULL)
@@ -2591,7 +2700,7 @@ ssh_packet_set_state(struct ssh *ssh, struct sshbuf *m)
if ((r = kex_from_blob(m, &ssh->kex)) != 0 ||
(r = newkeys_from_blob(m, ssh, MODE_OUT)) != 0 ||
(r = newkeys_from_blob(m, ssh, MODE_IN)) != 0 ||
- (r = sshbuf_get_u32(m, &state->rekey_limit)) != 0 ||
+ (r = sshbuf_get_u64(m, &state->rekey_limit)) != 0 ||
(r = sshbuf_get_u32(m, &state->rekey_interval)) != 0 ||
(r = sshbuf_get_u32(m, &state->p_send.seqnr)) != 0 ||
(r = sshbuf_get_u64(m, &state->p_send.blocks)) != 0 ||
diff --git a/crypto/external/bsd/openssh/dist/packet.h b/crypto/external/bsd/openssh/dist/packet.h
index 39f16880e60..da2fc9c3fda 100644
--- a/crypto/external/bsd/openssh/dist/packet.h
+++ b/crypto/external/bsd/openssh/dist/packet.h
@@ -1,5 +1,5 @@
-/* $NetBSD: packet.h,v 1.11 2015/04/11 21:14:31 joerg Exp $ */
-/* $OpenBSD: packet.h,v 1.66 2015/01/30 01:13:33 djm Exp $ */
+/* $NetBSD: packet.h,v 1.12 2016/03/11 01:55:00 christos Exp $ */
+/* $OpenBSD: packet.h,v 1.70 2016/02/08 10:57:07 djm Exp $ */
/*
* Author: Tatu Ylonen <ylo@cs.hut.fi>
@@ -73,6 +73,7 @@ int ssh_packet_get_connection_in(struct ssh *);
int ssh_packet_get_connection_out(struct ssh *);
void ssh_packet_close(struct ssh *);
void ssh_packet_set_encryption_key(struct ssh *, const u_char *, u_int, int);
+int ssh_packet_is_rekeying(struct ssh *);
void ssh_packet_set_protocol_flags(struct ssh *, u_int);
u_int ssh_packet_get_protocol_flags(struct ssh *);
int ssh_packet_start_compression(struct ssh *, int);
@@ -132,15 +133,11 @@ int ssh_packet_get_state(struct ssh *, struct sshbuf *);
int ssh_packet_set_state(struct ssh *, struct sshbuf *);
const char *ssh_remote_ipaddr(struct ssh *);
+int ssh_remote_port(struct ssh *);
-int ssh_packet_need_rekeying(struct ssh *);
-void ssh_packet_set_rekey_limits(struct ssh *, u_int32_t, time_t);
+void ssh_packet_set_rekey_limits(struct ssh *, u_int64_t, time_t);
time_t ssh_packet_get_rekey_timeout(struct ssh *);
-/* XXX FIXME */
-void ssh_packet_backup_state(struct ssh *, struct ssh *);
-void ssh_packet_restore_state(struct ssh *, struct ssh *);
-
void *ssh_packet_get_input(struct ssh *);
void *ssh_packet_get_output(struct ssh *);
diff --git a/crypto/external/bsd/openssh/dist/readconf.c b/crypto/external/bsd/openssh/dist/readconf.c
index a071ea1a64a..928cbf4594a 100644
--- a/crypto/external/bsd/openssh/dist/readconf.c
+++ b/crypto/external/bsd/openssh/dist/readconf.c
@@ -1,5 +1,6 @@
-/* $NetBSD: readconf.c,v 1.17 2016/01/14 22:30:04 christos Exp $ */
-/* $OpenBSD: readconf.c,v 1.239 2015/07/30 00:01:34 djm Exp $ */
+/* $NetBSD: readconf.c,v 1.18 2016/03/11 01:55:00 christos Exp $ */
+/* $OpenBSD: readconf.c,v 1.250 2016/02/08 23:40:12 djm Exp $ */
+
/*
* Author: Tatu Ylonen <ylo@cs.hut.fi>
* Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
@@ -14,7 +15,7 @@
*/
#include "includes.h"
-__RCSID("$NetBSD: readconf.c,v 1.17 2016/01/14 22:30:04 christos Exp $");
+__RCSID("$NetBSD: readconf.c,v 1.18 2016/03/11 01:55:00 christos Exp $");
#include <sys/types.h>
#include <sys/stat.h>
#include <sys/socket.h>
@@ -137,6 +138,7 @@ typedef enum {
oAFSTokenPassing,
#endif
oIdentityFile, oHostName, oPort, oCipher, oRemoteForward, oLocalForward,
+ oCertificateFile, oAddKeysToAgent,
oUser, oEscapeChar, oRhostsRSAAuthentication, oProxyCommand,
oGlobalKnownHostsFile, oUserKnownHostsFile, oConnectionAttempts,
oBatchMode, oCheckHostIP, oStrictHostKeyChecking, oCompression,
@@ -215,6 +217,8 @@ static struct {
{ "identityfile", oIdentityFile },
{ "identityfile2", oIdentityFile }, /* obsolete */
{ "identitiesonly", oIdentitiesOnly },
+ { "certificatefile", oCertificateFile },
+ { "addkeystoagent", oAddKeysToAgent },
{ "hostname", oHostName },
{ "hostkeyalias", oHostKeyAlias },
{ "proxycommand", oProxyCommand },
@@ -273,6 +277,7 @@ static struct {
{ "localcommand", oLocalCommand },
{ "permitlocalcommand", oPermitLocalCommand },
{ "visualhostkey", oVisualHostKey },
+ { "useroaming", oDeprecated },
{ "kexalgorithms", oKexAlgorithms },
{ "ipqos", oIPQoS },
{ "requesttty", oRequestTTY },
@@ -383,6 +388,30 @@ clear_forwardings(Options *options)
}
void
+add_certificate_file(Options *options, const char *path, int userprovided)
+{
+ int i;
+
+ if (options->num_certificate_files >= SSH_MAX_CERTIFICATE_FILES)
+ fatal("Too many certificate files specified (max %d)",
+ SSH_MAX_CERTIFICATE_FILES);
+
+ /* Avoid registering duplicates */
+ for (i = 0; i < options->num_certificate_files; i++) {
+ if (options->certificate_file_userprovided[i] == userprovided &&
+ strcmp(options->certificate_files[i], path) == 0) {
+ debug2("%s: ignoring duplicate key %s", __func__, path);
+ return;
+ }
+ }
+
+ options->certificate_file_userprovided[options->num_certificate_files] =
+ userprovided;
+ options->certificate_files[options->num_certificate_files++] =
+ xstrdup(path);
+}
+
+void
add_identity_file(Options *options, const char *dir, const char *filename,
int userprovided)
{
@@ -434,7 +463,6 @@ static int
execute_in_shell(const char *cmd)
{
const char *shell;
- char *command_string;
pid_t pid;
int devnull, status;
extern uid_t original_real_uid;
@@ -442,12 +470,6 @@ execute_in_shell(const char *cmd)
if ((shell = getenv("SHELL")) == NULL)
shell = _PATH_BSHELL;
- /*
- * Use "exec" to avoid "sh -c" processes on some platforms
- * (e.g. Solaris)
- */
- xasprintf(&command_string, "exec %s", cmd);
-
/* Need this to redirect subprocess stdin/out */
if ((devnull = open(_PATH_DEVNULL, O_RDWR)) == -1)
fatal("open(/dev/null): %s", strerror(errno));
@@ -473,7 +495,7 @@ execute_in_shell(const char *cmd)
argv[0] = __UNCONST(shell);
argv[1] = __UNCONST("-c");
- argv[2] = command_string;
+ argv[2] = xstrdup(cmd);
argv[3] = NULL;
execv(argv[0], argv);
@@ -488,7 +510,6 @@ execute_in_shell(const char *cmd)
fatal("%s: fork: %.100s", __func__, strerror(errno));
close(devnull);
- free(command_string);
while (waitpid(pid, &status, 0) == -1) {
if (errno != EINTR && errno != EAGAIN)
@@ -521,12 +542,15 @@ match_cfg_line(Options *options, char **condition, struct passwd *pw,
*/
port = options->port <= 0 ? default_ssh_port() : options->port;
ruser = options->user == NULL ? pw->pw_name : options->user;
- if (options->hostname != NULL) {
+ if (post_canon) {
+ host = xstrdup(options->hostname);
+ } else if (options->hostname != NULL) {
/* NB. Please keep in sync with ssh.c:main() */
host = percent_expand(options->hostname,
"h", host_arg, (char *)NULL);
- } else
+ } else {
host = xstrdup(host_arg);
+ }
debug2("checking match for '%s' host %s originally %s",
cp, host, original_host);
@@ -712,6 +736,15 @@ static const struct multistate multistate_yesnoask[] = {
{ "ask", 2 },
{ NULL, -1 }
};
+static const struct multistate multistate_yesnoaskconfirm[] = {
+ { "true", 1 },
+ { "false", 0 },
+ { "yes", 1 },
+ { "no", 0 },
+ { "ask", 2 },
+ { "confirm", 3 },
+ { NULL, -1 }
+};
static const struct multistate multistate_addressfamily[] = {
{ "inet", AF_INET },
{ "inet6", AF_INET6 },
@@ -1014,16 +1047,12 @@ parse_time:
if (scan_scaled(arg, &val64) == -1)
fatal("%.200s line %d: Bad number '%s': %s",
filename, linenum, arg, strerror(errno));
- /* check for too-large or too-small limits */
- if (val64 > UINT_MAX)
- fatal("%.200s line %d: RekeyLimit too large",
- filename, linenum);
if (val64 != 0 && val64 < 16)
fatal("%.200s line %d: RekeyLimit too small",
filename, linenum);
}
if (*activep && options->rekey_limit == -1)
- options->rekey_limit = (u_int32_t)val64;
+ options->rekey_limit = val64;
if (s != NULL) { /* optional rekey interval present */
if (strcmp(s, "none") == 0) {
(void)strdelim(&s); /* discard */
@@ -1048,6 +1077,24 @@ parse_time:
}
break;
+ case oCertificateFile:
+ arg = strdelim(&s);
+ if (!arg || *arg == '\0')
+ fatal("%.200s line %d: Missing argument.",
+ filename, linenum);
+ if (*activep) {
+ intptr = &options->num_certificate_files;
+ if (*intptr >= SSH_MAX_CERTIFICATE_FILES) {
+ fatal("%.200s line %d: Too many certificate "
+ "files specified (max %d).",
+ filename, linenum,
+ SSH_MAX_CERTIFICATE_FILES);
+ }
+ add_certificate_file(options, arg,
+ flags & SSHCONF_USERCONF);
+ }
+ break;
+
case oXAuthLocation:
charptr=&options->xauth_location;
goto parse_string;
@@ -1568,6 +1615,11 @@ parse_keytypes:
charptr = &options->pubkey_key_types;
goto parse_keytypes;
+ case oAddKeysToAgent:
+ intptr = &options->add_keys_to_agent;
+ multistate_ptr = multistate_yesnoaskconfirm;
+ goto parse_multistate;
+
case oDeprecated:
debug("%s line %d: Deprecated option \"%s\"",
filename, linenum, keyword);
@@ -1706,6 +1758,7 @@ initialize_options(Options * options)
options->hostkeyalgorithms = NULL;
options->protocol = SSH_PROTO_UNKNOWN;
options->num_identity_files = 0;
+ options->num_certificate_files = 0;
options->hostname = NULL;
options->host_key_alias = NULL;
options->proxy_command = NULL;
@@ -1741,6 +1794,7 @@ initialize_options(Options * options)
options->tun_remote = -1;
options->local_command = NULL;
options->permit_local_command = -1;
+ options->add_keys_to_agent = -1;
options->visual_host_key = -1;
options->ip_qos_interactive = -1;
options->ip_qos_bulk = -1;
@@ -1864,6 +1918,8 @@ fill_default_options(Options * options)
/* options->hostkeyalgorithms, default set in myproposals.h */
if (options->protocol == SSH_PROTO_UNKNOWN)
options->protocol = SSH_PROTO_2;
+ if (options->add_keys_to_agent == -1)
+ options->add_keys_to_agent = 0;
if (options->num_identity_files == 0) {
if (options->protocol & SSH_PROTO_1) {
add_identity_file(options, "~/",
@@ -2363,6 +2419,10 @@ dump_client_config(Options *o, const char *host)
int i;
char vbuf[5];
+ /* This is normally prepared in ssh_kex2 */
+ if (kex_assemble_names(KEX_DEFAULT_PK_ALG, &o->hostkeyalgorithms) != 0)
+ fatal("%s: kex_assemble_names failed", __func__);
+
/* Most interesting options first: user, host, port */
dump_cfg_string(oUser, o->user);
dump_cfg_string(oHostName, host);
@@ -2423,7 +2483,7 @@ dump_client_config(Options *o, const char *host)
dump_cfg_string(oBindAddress, o->bind_address);
dump_cfg_string(oCiphers, o->ciphers ? o->ciphers : KEX_CLIENT_ENCRYPT);
dump_cfg_string(oControlPath, o->control_path);
- dump_cfg_string(oHostKeyAlgorithms, o->hostkeyalgorithms ? o->hostkeyalgorithms : KEX_DEFAULT_PK_ALG);
+ dump_cfg_string(oHostKeyAlgorithms, o->hostkeyalgorithms);
dump_cfg_string(oHostKeyAlias, o->host_key_alias);
dump_cfg_string(oHostbasedKeyTypes, o->hostbased_key_types);
dump_cfg_string(oKbdInteractiveDevices, o->kbd_interactive_devices);
@@ -2434,6 +2494,7 @@ dump_client_config(Options *o, const char *host)
dump_cfg_string(oPKCS11Provider, o->pkcs11_provider);
dump_cfg_string(oPreferredAuthentications, o->preferred_authentications);
dump_cfg_string(oProxyCommand, o->proxy_command);
+ dump_cfg_string(oPubkeyAcceptedKeyTypes, o->pubkey_key_types);
dump_cfg_string(oRevokedHostKeys, o->revoked_host_keys);
dump_cfg_string(oXAuthLocation, o->xauth_location);
@@ -2502,8 +2563,8 @@ dump_client_config(Options *o, const char *host)
printf("%s\n", iptos2str(o->ip_qos_bulk));
/* oRekeyLimit */
- printf("rekeylimit %lld %d\n",
- (long long)o->rekey_limit, o->rekey_interval);
+ printf("rekeylimit %llu %d\n",
+ (unsigned long long)o->rekey_limit, o->rekey_interval);
/* oStreamLocalBindMask */
printf("streamlocalbindmask 0%o\n",
diff --git a/crypto/external/bsd/openssh/dist/readconf.h b/crypto/external/bsd/openssh/dist/readconf.h
index 15c2d3058aa..6d756c67f2d 100644
--- a/crypto/external/bsd/openssh/dist/readconf.h
+++ b/crypto/external/bsd/openssh/dist/readconf.h
@@ -1,5 +1,5 @@
-/* $NetBSD: readconf.h,v 1.14 2016/01/14 22:30:04 christos Exp $ */
-/* $OpenBSD: readconf.h,v 1.110 2015/07/10 06:21:53 markus Exp $ */
+/* $NetBSD: readconf.h,v 1.15 2016/03/11 01:55:00 christos Exp $ */
+/* $OpenBSD: readconf.h,v 1.113 2016/01/14 16:17:40 markus Exp $ */
/*
* Author: Tatu Ylonen <ylo@cs.hut.fi>
@@ -110,6 +110,13 @@ typedef struct {
int identity_file_userprovided[SSH_MAX_IDENTITY_FILES];
struct sshkey *identity_keys[SSH_MAX_IDENTITY_FILES];
+ int num_certificate_files; /* Number of extra certificates for ssh. */
+ char *certificate_files[SSH_MAX_CERTIFICATE_FILES];
+ int certificate_file_userprovided[SSH_MAX_CERTIFICATE_FILES];
+ struct sshkey *certificates[SSH_MAX_CERTIFICATE_FILES];
+
+ int add_keys_to_agent;
+
/* Local TCP/IP forward requests. */
int num_local_forwards;
struct Forward *local_forwards;
@@ -210,5 +217,6 @@ void dump_client_config(Options *o, const char *host);
void add_local_forward(Options *, const struct Forward *);
void add_remote_forward(Options *, const struct Forward *);
void add_identity_file(Options *, const char *, const char *, int);
+void add_certificate_file(Options *, const char *, int);
#endif /* READCONF_H */
diff --git a/crypto/external/bsd/openssh/dist/readpass.c b/crypto/external/bsd/openssh/dist/readpass.c
index cd8eefd13d9..90e3c73664c 100644
--- a/crypto/external/bsd/openssh/dist/readpass.c
+++ b/crypto/external/bsd/openssh/dist/readpass.c
@@ -1,5 +1,6 @@
-/* $NetBSD: readpass.c,v 1.6 2015/04/03 23:58:19 christos Exp $ */
-/* $OpenBSD: readpass.c,v 1.50 2014/02/02 03:44:31 djm Exp $ */
+/* $NetBSD: readpass.c,v 1.7 2016/03/11 01:55:00 christos Exp $ */
+/* $OpenBSD: readpass.c,v 1.51 2015/12/11 00:20:04 mmcc Exp $ */
+
/*
* Copyright (c) 2001 Markus Friedl. All rights reserved.
*
@@ -25,7 +26,7 @@
*/
#include "includes.h"
-__RCSID("$NetBSD: readpass.c,v 1.6 2015/04/03 23:58:19 christos Exp $");
+__RCSID("$NetBSD: readpass.c,v 1.7 2016/03/11 01:55:00 christos Exp $");
#include <sys/types.h>
#include <sys/wait.h>
@@ -76,7 +77,7 @@ ssh_askpass(const char *askpass, const char *msg)
close(p[0]);
if (dup2(p[1], STDOUT_FILENO) < 0)
fatal("ssh_askpass: dup2: %s", strerror(errno));
- execlp(askpass, askpass, msg, (char *) 0);
+ execlp(askpass, askpass, msg, (char *)NULL);
fatal("ssh_askpass: exec(%s): %s", askpass, strerror(errno));
}
close(p[1]);
diff --git a/crypto/external/bsd/openssh/dist/scp.1 b/crypto/external/bsd/openssh/dist/scp.1
index 353880e0cce..76cac61153a 100644
--- a/crypto/external/bsd/openssh/dist/scp.1
+++ b/crypto/external/bsd/openssh/dist/scp.1
@@ -1,4 +1,4 @@
-.\" $NetBSD: scp.1,v 1.10 2015/08/13 10:33:21 christos Exp $
+.\" $NetBSD: scp.1,v 1.11 2016/03/11 01:55:00 christos Exp $
.\" -*- nroff -*-
.\"
.\" scp.1
@@ -10,9 +10,9 @@
.\"
.\" Created: Sun May 7 00:14:37 1995 ylo
.\"
-.\" $OpenBSD: scp.1,v 1.67 2015/07/10 06:21:53 markus Exp $
+.\" $OpenBSD: scp.1,v 1.68 2015/09/25 18:19:54 jmc Exp $
.\"
-.Dd July 10 2015
+.Dd September 25 2015
.Dt SCP 1
.Os
.Sh NAME
@@ -135,6 +135,7 @@ For full details of the options listed below, and their possible values, see
.It CanonicalizeHostname
.It CanonicalizeMaxDots
.It CanonicalizePermittedCNAMEs
+.It CertificateFile
.It ChallengeResponseAuthentication
.It CheckHostIP
.It Cipher
diff --git a/crypto/external/bsd/openssh/dist/scp.c b/crypto/external/bsd/openssh/dist/scp.c
index 54b9ca70357..8c11ca0ec7b 100644
--- a/crypto/external/bsd/openssh/dist/scp.c
+++ b/crypto/external/bsd/openssh/dist/scp.c
@@ -1,5 +1,6 @@
-/* $NetBSD: scp.c,v 1.12 2015/07/03 01:00:00 christos Exp $ */
-/* $OpenBSD: scp.c,v 1.182 2015/04/24 01:36:00 deraadt Exp $ */
+/* $NetBSD: scp.c,v 1.13 2016/03/11 01:55:00 christos Exp $ */
+/* $OpenBSD: scp.c,v 1.184 2015/11/27 00:49:31 deraadt Exp $ */
+
/*
* scp - secure remote copy. This is basically patched BSD rcp which
* uses ssh to do the data transfer (instead of using rcmd).
@@ -73,7 +74,7 @@
*/
#include "includes.h"
-__RCSID("$NetBSD: scp.c,v 1.12 2015/07/03 01:00:00 christos Exp $");
+__RCSID("$NetBSD: scp.c,v 1.13 2016/03/11 01:55:00 christos Exp $");
#include <sys/param.h> /* roundup MAX */
#include <sys/types.h>
#include <sys/poll.h>
@@ -473,6 +474,18 @@ main(int argc, char **argv)
if (!isatty(STDOUT_FILENO))
showprogress = 0;
+ if (pflag) {
+ /* Cannot pledge: -p allows setuid/setgid files... */
+ } else {
+#ifdef __OpenBSD__
+ if (pledge("stdio rpath wpath cpath fattr tty proc exec",
+ NULL) == -1) {
+ perror("pledge");
+ exit(1);
+ }
+#endif
+ }
+
remin = STDIN_FILENO;
remout = STDOUT_FILENO;
@@ -856,7 +869,7 @@ rsource(char *name, struct stat *statp)
return;
}
last = strrchr(name, '/');
- if (last == 0)
+ if (last == NULL)
last = name;
else
last++;
diff --git a/crypto/external/bsd/openssh/dist/servconf.c b/crypto/external/bsd/openssh/dist/servconf.c
index 39a45e02c04..b2ee610fc43 100644
--- a/crypto/external/bsd/openssh/dist/servconf.c
+++ b/crypto/external/bsd/openssh/dist/servconf.c
@@ -1,6 +1,6 @@
-/* $NetBSD: servconf.c,v 1.19 2015/08/13 10:33:21 christos Exp $ */
+/* $NetBSD: servconf.c,v 1.20 2016/03/11 01:55:00 christos Exp $ */
-/* $OpenBSD: servconf.c,v 1.280 2015/08/06 14:53:21 deraadt Exp $ */
+/* $OpenBSD: servconf.c,v 1.285 2016/02/17 05:29:04 djm Exp $ */
/*
* Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
* All rights reserved
@@ -13,7 +13,7 @@
*/
#include "includes.h"
-__RCSID("$NetBSD: servconf.c,v 1.19 2015/08/13 10:33:21 christos Exp $");
+__RCSID("$NetBSD: servconf.c,v 1.20 2016/03/11 01:55:00 christos Exp $");
#include <sys/types.h>
#include <sys/socket.h>
#include <sys/queue.h>
@@ -220,6 +220,20 @@ option_clear_or_none(const char *o)
return o == NULL || strcasecmp(o, "none") == 0;
}
+static void
+assemble_algorithms(ServerOptions *o)
+{
+ if (kex_assemble_names(KEX_SERVER_ENCRYPT, &o->ciphers) != 0 ||
+ kex_assemble_names(KEX_SERVER_MAC, &o->macs) != 0 ||
+ kex_assemble_names(KEX_SERVER_KEX, &o->kex_algorithms) != 0 ||
+ kex_assemble_names(KEX_DEFAULT_PK_ALG,
+ &o->hostkeyalgorithms) != 0 ||
+ kex_assemble_names(KEX_DEFAULT_PK_ALG,
+ &o->hostbased_key_types) != 0 ||
+ kex_assemble_names(KEX_DEFAULT_PK_ALG, &o->pubkey_key_types) != 0)
+ fatal("kex_assemble_names failed");
+}
+
void
fill_default_server_options(ServerOptions *options)
{
@@ -306,8 +320,6 @@ fill_default_server_options(ServerOptions *options)
options->hostbased_authentication = 0;
if (options->hostbased_uses_name_from_packet_only == -1)
options->hostbased_uses_name_from_packet_only = 0;
- if (options->hostkeyalgorithms == NULL)
- options->hostkeyalgorithms = xstrdup(KEX_DEFAULT_PK_ALG);
if (options->rsa_authentication == -1)
options->rsa_authentication = 1;
if (options->pubkey_authentication == -1)
@@ -463,18 +475,11 @@ fill_default_server_options(ServerOptions *options)
if (options->fingerprint_hash == -1)
options->fingerprint_hash = SSH_FP_HASH_DEFAULT;
- if (kex_assemble_names(KEX_SERVER_ENCRYPT, &options->ciphers) != 0 ||
- kex_assemble_names(KEX_SERVER_MAC, &options->macs) != 0 ||
- kex_assemble_names(KEX_SERVER_KEX, &options->kex_algorithms) != 0 ||
- kex_assemble_names(KEX_DEFAULT_PK_ALG,
- &options->hostbased_key_types) != 0 ||
- kex_assemble_names(KEX_DEFAULT_PK_ALG,
- &options->pubkey_key_types) != 0)
- fatal("%s: kex_assemble_names failed", __func__);
+ assemble_algorithms(options);
- /* Turn privilege separation on by default */
+ /* Turn privilege separation and sandboxing on by default */
if (use_privsep == -1)
- use_privsep = PRIVSEP_NOSANDBOX;
+ use_privsep = PRIVSEP_ON;
#define CLEAR_ON_NONE(v) \
do { \
@@ -489,6 +494,8 @@ fill_default_server_options(ServerOptions *options)
CLEAR_ON_NONE(options->trusted_user_ca_keys);
CLEAR_ON_NONE(options->revoked_keys_file);
CLEAR_ON_NONE(options->authorized_principals_file);
+ CLEAR_ON_NONE(options->adm_forced_command);
+ CLEAR_ON_NONE(options->chroot_directory);
for (i = 0; i < options->num_host_key_files; i++)
CLEAR_ON_NONE(options->host_key_files[i]);
for (i = 0; i < options->num_host_cert_files; i++)
@@ -1484,16 +1491,12 @@ process_server_config_line(ServerOptions *options, char *line,
if (scan_scaled(arg, &val64) == -1)
fatal("%.200s line %d: Bad number '%s': %s",
filename, linenum, arg, strerror(errno));
- /* check for too-large or too-small limits */
- if (val64 > UINT_MAX)
- fatal("%.200s line %d: RekeyLimit too large",
- filename, linenum);
if (val64 != 0 && val64 < 16)
fatal("%.200s line %d: RekeyLimit too small",
filename, linenum);
}
if (*activep && options->rekey_limit == -1)
- options->rekey_limit = (u_int32_t)val64;
+ options->rekey_limit = val64;
if (cp != NULL) { /* optional rekey interval present */
if (strcmp(cp, "none") == 0) {
(void)strdelim(&cp); /* discard */
@@ -2299,6 +2302,9 @@ copy_set_server_options(ServerOptions *dst, ServerOptions *src, int preauth)
/* See comment in servconf.h */
COPY_MATCH_STRING_OPTS();
+ /* Arguments that accept '+...' need to be expanded */
+ assemble_algorithms(dst);
+
/*
* The only things that should be below this point are string options
* which are only used after authentication.
@@ -2306,8 +2312,17 @@ copy_set_server_options(ServerOptions *dst, ServerOptions *src, int preauth)
if (preauth)
return;
+ /* These options may be "none" to clear a global setting */
M_CP_STROPT(adm_forced_command);
+ if (option_clear_or_none(dst->adm_forced_command)) {
+ free(dst->adm_forced_command);
+ dst->adm_forced_command = NULL;
+ }
M_CP_STROPT(chroot_directory);
+ if (option_clear_or_none(dst->chroot_directory)) {
+ free(dst->chroot_directory);
+ dst->chroot_directory = NULL;
+ }
}
#undef M_CP_INTOPT
@@ -2618,7 +2633,7 @@ dump_config(ServerOptions *o)
printf("ipqos %s ", iptos2str(o->ip_qos_interactive));
printf("%s\n", iptos2str(o->ip_qos_bulk));
- printf("rekeylimit %lld %d\n", (long long)o->rekey_limit,
+ printf("rekeylimit %llu %d\n", (unsigned long long)o->rekey_limit,
o->rekey_interval);
channel_print_adm_permitted_opens();
diff --git a/crypto/external/bsd/openssh/dist/serverloop.c b/crypto/external/bsd/openssh/dist/serverloop.c
index 379c7b5f057..cf0d976f0d3 100644
--- a/crypto/external/bsd/openssh/dist/serverloop.c
+++ b/crypto/external/bsd/openssh/dist/serverloop.c
@@ -1,5 +1,6 @@
-/* $NetBSD: serverloop.c,v 1.13 2016/01/14 22:30:04 christos Exp $ */
-/* $OpenBSD: serverloop.c,v 1.178 2015/02/20 22:17:21 djm Exp $ */
+/* $NetBSD: serverloop.c,v 1.14 2016/03/11 01:55:00 christos Exp $ */
+/* $OpenBSD: serverloop.c,v 1.182 2016/02/08 10:57:07 djm Exp $ */
+
/*
* Author: Tatu Ylonen <ylo@cs.hut.fi>
* Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
@@ -37,7 +38,7 @@
*/
#include "includes.h"
-__RCSID("$NetBSD: serverloop.c,v 1.13 2016/01/14 22:30:04 christos Exp $");
+__RCSID("$NetBSD: serverloop.c,v 1.14 2016/03/11 01:55:00 christos Exp $");
#include <sys/param.h> /* MIN MAX */
#include <sys/types.h>
#include <sys/wait.h>
@@ -806,7 +807,7 @@ void
server_loop2(Authctxt *authctxt)
{
fd_set *readset = NULL, *writeset = NULL;
- int rekeying = 0, max_fd;
+ int max_fd;
u_int nalloc = 0;
u_int64_t rekey_timeout_ms = 0;
double start_time, total_time;
@@ -835,11 +836,11 @@ server_loop2(Authctxt *authctxt)
for (;;) {
process_buffered_input_packets();
- rekeying = (active_state->kex != NULL && !active_state->kex->done);
-
- if (!rekeying && packet_not_very_much_data_to_write())
+ if (!ssh_packet_is_rekeying(active_state) &&
+ packet_not_very_much_data_to_write())
channel_output_poll();
- if (options.rekey_interval > 0 && compat20 && !rekeying)
+ if (options.rekey_interval > 0 && compat20 &&
+ !ssh_packet_is_rekeying(active_state))
rekey_timeout_ms = packet_get_rekey_timeout() * 1000;
else
rekey_timeout_ms = 0;
@@ -854,18 +855,8 @@ server_loop2(Authctxt *authctxt)
}
collect_children();
- if (!rekeying) {
+ if (!ssh_packet_is_rekeying(active_state))
channel_after_select(readset, writeset);
- if (packet_need_rekeying()) {
- int r;
- debug("need rekeying");
- if (active_state->kex)
- active_state->kex->done = 0;
- if ((r = kex_send_kexinit(active_state)) != 0)
- logit("%s: kex_send_kexinit: %s",
- __func__, ssh_err(r));
- }
- }
process_input(readset);
if (connection_closed)
break;
@@ -1195,7 +1186,7 @@ server_input_hostkeys_prove(struct sshbuf **respp)
ssh->kex->session_id, ssh->kex->session_id_len)) != 0 ||
(r = sshkey_puts(key, sigbuf)) != 0 ||
(r = ssh->kex->sign(key_prv, key_pub, &sig, &slen,
- sshbuf_ptr(sigbuf), sshbuf_len(sigbuf), 0)) != 0 ||
+ sshbuf_ptr(sigbuf), sshbuf_len(sigbuf), NULL, 0)) != 0 ||
(r = sshbuf_put_string(resp, sig, slen)) != 0) {
error("%s: couldn't prepare signature: %s",
__func__, ssh_err(r));
@@ -1256,7 +1247,8 @@ server_input_global_request(int type, u_int32_t seq, void *ctxt)
free(fwd.listen_host);
if ((resp = sshbuf_new()) == NULL)
fatal("%s: sshbuf_new", __func__);
- if ((r = sshbuf_put_u32(resp, allocated_listen_port)) != 0)
+ if (allocated_listen_port != 0 &&
+ (r = sshbuf_put_u32(resp, allocated_listen_port)) != 0)
fatal("%s: sshbuf_put_u32: %s", __func__, ssh_err(r));
} else if (strcmp(rtype, "cancel-tcpip-forward") == 0) {
struct Forward fwd;
diff --git a/crypto/external/bsd/openssh/dist/session.c b/crypto/external/bsd/openssh/dist/session.c
index 27f35d89529..a9f2af9ae30 100644
--- a/crypto/external/bsd/openssh/dist/session.c
+++ b/crypto/external/bsd/openssh/dist/session.c
@@ -1,5 +1,6 @@
-/* $NetBSD: session.c,v 1.17 2016/02/04 15:04:11 seanb Exp $ */
-/* $OpenBSD: session.c,v 1.278 2015/04/24 01:36:00 deraadt Exp $ */
+/* $NetBSD: session.c,v 1.18 2016/03/11 01:55:00 christos Exp $ */
+/* $OpenBSD: session.c,v 1.280 2016/02/16 03:37:48 djm Exp $ */
+
/*
* Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
* All rights reserved
@@ -35,7 +36,7 @@
*/
#include "includes.h"
-__RCSID("$NetBSD: session.c,v 1.17 2016/02/04 15:04:11 seanb Exp $");
+__RCSID("$NetBSD: session.c,v 1.18 2016/03/11 01:55:00 christos Exp $");
#include <sys/types.h>
#include <sys/wait.h>
#include <sys/un.h>
@@ -147,6 +148,7 @@ login_cap_t *lc;
#endif
static int is_child = 0;
+static int in_chroot = 0;
/* Name and directory of socket for authentication agent forwarding. */
static char *auth_sock_name = NULL;
@@ -768,8 +770,8 @@ int
do_exec(Session *s, const char *command)
{
int ret;
- const char *forced = NULL;
- char session_type[1024], *tty = NULL;
+ const char *forced = NULL, *tty = NULL;
+ char session_type[1024];
if (options.adm_forced_command) {
original_command = command;
@@ -804,13 +806,14 @@ do_exec(Session *s, const char *command)
tty += 5;
}
- verbose("Starting session: %s%s%s for %s from %.200s port %d",
+ verbose("Starting session: %s%s%s for %s from %.200s port %d id %d",
session_type,
tty == NULL ? "" : " on ",
tty == NULL ? "" : tty,
s->pw->pw_name,
get_remote_ipaddr(),
- get_remote_port());
+ get_remote_port(),
+ s->self);
#ifdef GSSAPI
if (options.gss_authentication) {
@@ -1459,7 +1462,7 @@ do_setusercontext(struct passwd *pw)
}
# endif /* USE_PAM */
#endif
- if (options.chroot_directory != NULL &&
+ if (!in_chroot && options.chroot_directory != NULL &&
strcasecmp(options.chroot_directory, "none") != 0) {
tmp = tilde_expand_filename(options.chroot_directory,
pw->pw_uid);
@@ -1471,6 +1474,7 @@ do_setusercontext(struct passwd *pw)
/* Make sure we don't attempt to chroot again */
free(options.chroot_directory);
options.chroot_directory = NULL;
+ in_chroot = 1;
}
#ifdef HAVE_LOGIN_CAP
@@ -1680,11 +1684,11 @@ do_child(Session *s, const char *command)
if (chdir(pw->pw_dir) < 0) {
/* Suppress missing homedir warning for chroot case */
r = login_getcapbool(lc, "requirehome", 0);
- if (r || options.chroot_directory == NULL ||
- strcasecmp(options.chroot_directory, "none") == 0)
+ if (r || !in_chroot) {
fprintf(stderr, "Could not chdir to home "
"directory %s: %s\n", pw->pw_dir,
strerror(errno));
+ }
if (r)
exit(1);
}
@@ -2392,7 +2396,12 @@ session_close(Session *s)
{
u_int i;
- debug("session_close: session %d pid %ld", s->self, (long)s->pid);
+ verbose("Close session: user %s from %.200s port %d id %d",
+ s->pw->pw_name,
+ get_remote_ipaddr(),
+ get_remote_port(),
+ s->self);
+
if (s->ttyfd != -1)
session_pty_cleanup(s);
free(s->term);
diff --git a/crypto/external/bsd/openssh/dist/sftp-client.c b/crypto/external/bsd/openssh/dist/sftp-client.c
index 2fce7ff4053..5bddef7eb43 100644
--- a/crypto/external/bsd/openssh/dist/sftp-client.c
+++ b/crypto/external/bsd/openssh/dist/sftp-client.c
@@ -1,5 +1,6 @@
-/* $NetBSD: sftp-client.c,v 1.14 2015/07/03 01:00:00 christos Exp $ */
-/* $OpenBSD: sftp-client.c,v 1.120 2015/05/28 04:50:53 djm Exp $ */
+/* $NetBSD: sftp-client.c,v 1.15 2016/03/11 01:55:00 christos Exp $ */
+/* $OpenBSD: sftp-client.c,v 1.121 2016/02/11 02:21:34 djm Exp $ */
+
/*
* Copyright (c) 2001-2004 Damien Miller <djm@openbsd.org>
*
@@ -22,7 +23,7 @@
/* XXX: copy between two remote sites */
#include "includes.h"
-__RCSID("$NetBSD: sftp-client.c,v 1.14 2015/07/03 01:00:00 christos Exp $");
+__RCSID("$NetBSD: sftp-client.c,v 1.15 2016/03/11 01:55:00 christos Exp $");
#include <sys/param.h> /* MIN MAX */
#include <sys/types.h>
#include <sys/poll.h>
@@ -1752,7 +1753,7 @@ do_upload(struct sftp_conn *conn, const char *local_path,
if (fsync_flag)
(void)do_fsync(conn, handle, handle_len);
- if (do_close(conn, handle, handle_len) != SSH2_FX_OK)
+ if (do_close(conn, handle, handle_len) != 0)
status = SSH2_FX_FAILURE;
free(handle);
@@ -1765,12 +1766,11 @@ upload_dir_internal(struct sftp_conn *conn, const char *src, const char *dst,
int depth, int preserve_flag, int print_flag, int resume, int fsync_flag)
{
int ret = 0;
- u_int status;
DIR *dirp;
struct dirent *dp;
char *filename, *new_src, *new_dst;
struct stat sb;
- Attrib a;
+ Attrib a, *dirattrib;
if (depth >= MAX_DIR_DEPTH) {
error("Maximum directory depth exceeded: %d levels", depth);
@@ -1797,17 +1797,18 @@ upload_dir_internal(struct sftp_conn *conn, const char *src, const char *dst,
if (!preserve_flag)
a.flags &= ~SSH2_FILEXFER_ATTR_ACMODTIME;
- status = do_mkdir(conn, dst, &a, 0);
/*
- * we lack a portable status for errno EEXIST,
- * so if we get a SSH2_FX_FAILURE back we must check
- * if it was created successfully.
+ * sftp lacks a portable status value to match errno EEXIST,
+ * so if we get a failure back then we must check whether
+ * the path already existed and is a directory.
*/
- if (status != SSH2_FX_OK) {
- if (status != SSH2_FX_FAILURE)
+ if (do_mkdir(conn, dst, &a, 0) != 0) {
+ if ((dirattrib = do_stat(conn, dst, 0)) == NULL)
return -1;
- if (do_stat(conn, dst, 0) == NULL)
+ if (!S_ISDIR(dirattrib->perm)) {
+ error("\"%s\" exists but is not a directory", dst);
return -1;
+ }
}
if ((dirp = opendir(src)) == NULL) {
diff --git a/crypto/external/bsd/openssh/dist/sftp-server-main.c b/crypto/external/bsd/openssh/dist/sftp-server-main.c
index 2b8b73a7a34..727a2d37057 100644
--- a/crypto/external/bsd/openssh/dist/sftp-server-main.c
+++ b/crypto/external/bsd/openssh/dist/sftp-server-main.c
@@ -1,5 +1,6 @@
-/* $NetBSD: sftp-server-main.c,v 1.4 2015/04/03 23:58:19 christos Exp $ */
-/* $OpenBSD: sftp-server-main.c,v 1.4 2009/02/21 19:32:04 tobias Exp $ */
+/* $NetBSD: sftp-server-main.c,v 1.5 2016/03/11 01:55:00 christos Exp $ */
+/* $OpenBSD: sftp-server-main.c,v 1.5 2016/02/15 09:47:49 dtucker Exp $ */
+
/*
* Copyright (c) 2008 Markus Friedl. All rights reserved.
*
@@ -17,7 +18,7 @@
*/
#include "includes.h"
-__RCSID("$NetBSD: sftp-server-main.c,v 1.4 2015/04/03 23:58:19 christos Exp $");
+__RCSID("$NetBSD: sftp-server-main.c,v 1.5 2016/03/11 01:55:00 christos Exp $");
#include <sys/types.h>
#include <pwd.h>
#include <stdarg.h>
@@ -28,6 +29,7 @@ __RCSID("$NetBSD: sftp-server-main.c,v 1.4 2015/04/03 23:58:19 christos Exp $");
#include "log.h"
#include "sftp.h"
#include "misc.h"
+#include "xmalloc.h"
void
cleanup_exit(int i)
@@ -40,6 +42,7 @@ main(int argc, char **argv)
{
struct passwd *user_pw;
+ ssh_malloc_init(); /* must be called before any mallocs */
/* Ensure that fds 0, 1 and 2 are open or directed to /dev/null */
sanitise_stdfd();
diff --git a/crypto/external/bsd/openssh/dist/sftp-server.c b/crypto/external/bsd/openssh/dist/sftp-server.c
index 37a6ad58eed..9c0a9170c72 100644
--- a/crypto/external/bsd/openssh/dist/sftp-server.c
+++ b/crypto/external/bsd/openssh/dist/sftp-server.c
@@ -1,5 +1,6 @@
-/* $NetBSD: sftp-server.c,v 1.13 2015/08/21 08:20:59 christos Exp $ */
-/* $OpenBSD: sftp-server.c,v 1.107 2015/08/20 22:32:42 deraadt Exp $ */
+/* $NetBSD: sftp-server.c,v 1.14 2016/03/11 01:55:00 christos Exp $ */
+/* $OpenBSD: sftp-server.c,v 1.109 2016/02/15 09:47:49 dtucker Exp $ */
+
/*
* Copyright (c) 2000-2004 Markus Friedl. All rights reserved.
*
@@ -17,7 +18,7 @@
*/
#include "includes.h"
-__RCSID("$NetBSD: sftp-server.c,v 1.13 2015/08/21 08:20:59 christos Exp $");
+__RCSID("$NetBSD: sftp-server.c,v 1.14 2016/03/11 01:55:00 christos Exp $");
#include <sys/param.h> /* MIN */
#include <sys/types.h>
#include <sys/stat.h>
@@ -1486,6 +1487,7 @@ sftp_server_main(int argc, char **argv, struct passwd *user_pw)
extern char *optarg;
extern char *__progname;
+ ssh_malloc_init(); /* must be called before any mallocs */
log_init(__progname, log_level, log_facility, log_stderr);
pw = pwcopy(user_pw);
@@ -1587,9 +1589,8 @@ sftp_server_main(int argc, char **argv, struct passwd *user_pw)
if ((oqueue = sshbuf_new()) == NULL)
fatal("%s: sshbuf_new failed", __func__);
- set_size = howmany(max + 1, NFDBITS) * sizeof(fd_mask);
- rset = xmalloc(set_size);
- wset = xmalloc(set_size);
+ rset = xcalloc(howmany(max + 1, NFDBITS), sizeof(fd_mask));
+ wset = xcalloc(howmany(max + 1, NFDBITS), sizeof(fd_mask));
if (homedir != NULL) {
if (chdir(homedir) != 0) {
@@ -1598,6 +1599,7 @@ sftp_server_main(int argc, char **argv, struct passwd *user_pw)
}
}
+ set_size = howmany(max + 1, NFDBITS) * sizeof(fd_mask);
for (;;) {
memset(rset, 0, set_size);
memset(wset, 0, set_size);
diff --git a/crypto/external/bsd/openssh/dist/sftp.1 b/crypto/external/bsd/openssh/dist/sftp.1
index c9810107cf4..b81a962bb8e 100644
--- a/crypto/external/bsd/openssh/dist/sftp.1
+++ b/crypto/external/bsd/openssh/dist/sftp.1
@@ -1,5 +1,5 @@
-.\" $NetBSD: sftp.1,v 1.11 2015/04/03 23:58:19 christos Exp $
-.\" $OpenBSD: sftp.1,v 1.101 2015/01/30 11:43:14 djm Exp $
+.\" $NetBSD: sftp.1,v 1.12 2016/03/11 01:55:00 christos Exp $
+.\" $OpenBSD: sftp.1,v 1.102 2015/09/25 18:19:54 jmc Exp $
.\"
.\" Copyright (c) 2001 Damien Miller. All rights reserved.
.\"
@@ -23,7 +23,7 @@
.\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
.\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
.\"
-.Dd January 30 2015
+.Dd September 25 2015
.Dt SFTP 1
.Os
.Sh NAME
@@ -199,6 +199,7 @@ For full details of the options listed below, and their possible values, see
.It CanonicalizeHostname
.It CanonicalizeMaxDots
.It CanonicalizePermittedCNAMEs
+.It CertificateFile
.It ChallengeResponseAuthentication
.It CheckHostIP
.It Cipher
diff --git a/crypto/external/bsd/openssh/dist/sftp.c b/crypto/external/bsd/openssh/dist/sftp.c
index cc27489a956..dfda5f76ae7 100644
--- a/crypto/external/bsd/openssh/dist/sftp.c
+++ b/crypto/external/bsd/openssh/dist/sftp.c
@@ -1,5 +1,6 @@
-/* $NetBSD: sftp.c,v 1.17 2015/12/16 13:23:38 christos Exp $ */
-/* $OpenBSD: sftp.c,v 1.171 2015/08/20 22:32:42 deraadt Exp $ */
+/* $NetBSD: sftp.c,v 1.18 2016/03/11 01:55:00 christos Exp $ */
+/* $OpenBSD: sftp.c,v 1.172 2016/02/15 09:47:49 dtucker Exp $ */
+
/*
* Copyright (c) 2001-2004 Damien Miller <djm@openbsd.org>
*
@@ -17,7 +18,7 @@
*/
#include "includes.h"
-__RCSID("$NetBSD: sftp.c,v 1.17 2015/12/16 13:23:38 christos Exp $");
+__RCSID("$NetBSD: sftp.c,v 1.18 2016/03/11 01:55:00 christos Exp $");
#include <sys/param.h> /* MIN MAX */
#include <sys/types.h>
#include <sys/ioctl.h>
@@ -2235,6 +2236,7 @@ main(int argc, char **argv)
size_t num_requests = DEFAULT_NUM_REQUESTS;
long long limit_kbps = 0;
+ ssh_malloc_init(); /* must be called before any mallocs */
/* Ensure that fds 0, 1 and 2 are open or directed to /dev/null */
sanitise_stdfd();
setlocale(LC_CTYPE, "");
diff --git a/crypto/external/bsd/openssh/dist/ssh-add.c b/crypto/external/bsd/openssh/dist/ssh-add.c
index 325be3fe73b..d7bebeaf785 100644
--- a/crypto/external/bsd/openssh/dist/ssh-add.c
+++ b/crypto/external/bsd/openssh/dist/ssh-add.c
@@ -1,5 +1,6 @@
-/* $NetBSD: ssh-add.c,v 1.12 2015/08/13 10:33:21 christos Exp $ */
-/* $OpenBSD: ssh-add.c,v 1.123 2015/07/03 03:43:18 djm Exp $ */
+/* $NetBSD: ssh-add.c,v 1.13 2016/03/11 01:55:00 christos Exp $ */
+/* $OpenBSD: ssh-add.c,v 1.128 2016/02/15 09:47:49 dtucker Exp $ */
+
/*
* Author: Tatu Ylonen <ylo@cs.hut.fi>
* Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
@@ -37,7 +38,7 @@
*/
#include "includes.h"
-__RCSID("$NetBSD: ssh-add.c,v 1.12 2015/08/13 10:33:21 christos Exp $");
+__RCSID("$NetBSD: ssh-add.c,v 1.13 2016/03/11 01:55:00 christos Exp $");
#include <sys/types.h>
#include <sys/stat.h>
@@ -88,7 +89,7 @@ static int lifetime = 0;
/* User has to confirm key use */
static int confirm = 0;
-/* we keep a cache of one passphrases */
+/* we keep a cache of one passphrase */
static char *pass = NULL;
static void
clear_pass(void)
@@ -145,10 +146,8 @@ delete_file(int agent_fd, const char *filename, int key_only)
certpath, ssh_err(r));
out:
- if (cert != NULL)
- sshkey_free(cert);
- if (public != NULL)
- sshkey_free(public);
+ sshkey_free(cert);
+ sshkey_free(public);
free(certpath);
free(comment);
@@ -213,35 +212,32 @@ add_file(int agent_fd, const char *filename, int key_only)
close(fd);
/* At first, try empty passphrase */
- if ((r = sshkey_parse_private_fileblob(keyblob, "", filename,
- &private, &comment)) != 0 && r != SSH_ERR_KEY_WRONG_PASSPHRASE) {
+ if ((r = sshkey_parse_private_fileblob(keyblob, "", &private,
+ &comment)) != 0 && r != SSH_ERR_KEY_WRONG_PASSPHRASE) {
fprintf(stderr, "Error loading key \"%s\": %s\n",
filename, ssh_err(r));
goto fail_load;
}
/* try last */
if (private == NULL && pass != NULL) {
- if ((r = sshkey_parse_private_fileblob(keyblob, pass, filename,
- &private, &comment)) != 0 &&
- r != SSH_ERR_KEY_WRONG_PASSPHRASE) {
+ if ((r = sshkey_parse_private_fileblob(keyblob, pass, &private,
+ &comment)) != 0 && r != SSH_ERR_KEY_WRONG_PASSPHRASE) {
fprintf(stderr, "Error loading key \"%s\": %s\n",
filename, ssh_err(r));
goto fail_load;
}
}
- if (comment == NULL)
- comment = xstrdup(filename);
if (private == NULL) {
/* clear passphrase since it did not work */
clear_pass();
- snprintf(msg, sizeof msg, "Enter passphrase for %.200s%s: ",
- comment, confirm ? " (will confirm each use)" : "");
+ snprintf(msg, sizeof msg, "Enter passphrase for %s%s: ",
+ filename, confirm ? " (will confirm each use)" : "");
for (;;) {
pass = read_passphrase(msg, RP_ALLOW_STDIN);
if (strcmp(pass, "") == 0)
goto fail_load;
if ((r = sshkey_parse_private_fileblob(keyblob, pass,
- filename, &private, NULL)) == 0)
+ &private, &comment)) == 0)
break;
else if (r != SSH_ERR_KEY_WRONG_PASSPHRASE) {
fprintf(stderr,
@@ -249,16 +245,17 @@ add_file(int agent_fd, const char *filename, int key_only)
filename, ssh_err(r));
fail_load:
clear_pass();
- free(comment);
sshbuf_free(keyblob);
return -1;
}
clear_pass();
snprintf(msg, sizeof msg,
- "Bad passphrase, try again for %.200s%s: ", comment,
+ "Bad passphrase, try again for %s%s: ", filename,
confirm ? " (will confirm each use)" : "");
}
}
+ if (comment == NULL || *comment == '\0')
+ comment = xstrdup(filename);
sshbuf_free(keyblob);
if ((r = ssh_add_identity_constrained(agent_fd, private, comment,
@@ -381,7 +378,7 @@ list_identities(int agent_fd, int do_fp)
if (do_fp) {
fp = sshkey_fingerprint(idlist->keys[i],
fingerprint_hash, SSH_FP_DEFAULT);
- printf("%d %s %s (%s)\n",
+ printf("%u %s %s (%s)\n",
sshkey_size(idlist->keys[i]),
fp == NULL ? "(null)" : fp,
idlist->comments[i],
@@ -480,6 +477,7 @@ main(int argc, char **argv)
int r, i, ch, deleting = 0, ret = 0, key_only = 0;
int xflag = 0, lflag = 0, Dflag = 0;
+ ssh_malloc_init(); /* must be called before any mallocs */
/* Ensure that fds 0, 1 and 2 are open or directed to /dev/null */
sanitise_stdfd();
diff --git a/crypto/external/bsd/openssh/dist/ssh-agent.1 b/crypto/external/bsd/openssh/dist/ssh-agent.1
index 978bec08709..b61133bc0fa 100644
--- a/crypto/external/bsd/openssh/dist/ssh-agent.1
+++ b/crypto/external/bsd/openssh/dist/ssh-agent.1
@@ -1,5 +1,5 @@
-.\" $NetBSD: ssh-agent.1,v 1.9 2015/07/03 01:00:00 christos Exp $
-.\" $OpenBSD: ssh-agent.1,v 1.59 2015/04/24 06:26:49 jmc Exp $
+.\" $NetBSD: ssh-agent.1,v 1.10 2016/03/11 01:55:00 christos Exp $
+.\" $OpenBSD: ssh-agent.1,v 1.62 2015/11/15 23:54:15 jmc Exp $
.\"
.\" Author: Tatu Ylonen <ylo@cs.hut.fi>
.\" Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
@@ -35,7 +35,7 @@
.\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
.\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
.\"
-.Dd April 24 2015
+.Dd November 15 2015
.Dt SSH-AGENT 1
.Os
.Sh NAME
@@ -44,7 +44,7 @@
.Sh SYNOPSIS
.Nm ssh-agent
.Op Fl c | s
-.Op Fl Dd
+.Op Fl \&Dd
.Op Fl a Ar bind_address
.Op Fl E Ar fingerprint_hash
.Op Fl t Ar life
@@ -67,6 +67,13 @@ machines using
.Pp
The agent initially does not have any private keys.
Keys are added using
+.Xr ssh 1
+(see
+.Cm AddKeysToAgent
+in
+.Xr ssh_config 5
+for details)
+or
.Xr ssh-add 1 .
Multiple identities may be stored in
.Nm
@@ -131,7 +138,7 @@ overrides this value.
Without this option the default maximum lifetime is forever.
.El
.Pp
-If a commandline is given, this is executed as a subprocess of the agent.
+If a command line is given, this is executed as a subprocess of the agent.
When the command dies, so does the agent.
.Pp
The idea is that the agent is run in the user's local PC, laptop, or
diff --git a/crypto/external/bsd/openssh/dist/ssh-agent.c b/crypto/external/bsd/openssh/dist/ssh-agent.c
index 7708e961132..631b0e26379 100644
--- a/crypto/external/bsd/openssh/dist/ssh-agent.c
+++ b/crypto/external/bsd/openssh/dist/ssh-agent.c
@@ -1,5 +1,6 @@
-/* $NetBSD: ssh-agent.c,v 1.16 2015/08/13 10:33:21 christos Exp $ */
-/* $OpenBSD: ssh-agent.c,v 1.204 2015/07/08 20:24:02 markus Exp $ */
+/* $NetBSD: ssh-agent.c,v 1.17 2016/03/11 01:55:00 christos Exp $ */
+/* $OpenBSD: ssh-agent.c,v 1.212 2016/02/15 09:47:49 dtucker Exp $ */
+
/*
* Author: Tatu Ylonen <ylo@cs.hut.fi>
* Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
@@ -36,7 +37,7 @@
*/
#include "includes.h"
-__RCSID("$NetBSD: ssh-agent.c,v 1.16 2015/08/13 10:33:21 christos Exp $");
+__RCSID("$NetBSD: ssh-agent.c,v 1.17 2016/03/11 01:55:00 christos Exp $");
#include <sys/param.h> /* MIN MAX */
#include <sys/types.h>
#include <sys/time.h>
@@ -355,6 +356,18 @@ process_authentication_challenge1(SocketEntry *e)
}
#endif
+static const char *
+agent_decode_alg(struct sshkey *key, u_int flags)
+{
+ if (key->type == KEY_RSA) {
+ if (flags & SSH_AGENT_RSA_SHA2_256)
+ return "rsa-sha2-256";
+ else if (flags & SSH_AGENT_RSA_SHA2_512)
+ return "rsa-sha2-512";
+ }
+ return NULL;
+}
+
/* ssh2 only */
static void
process_sign_request2(SocketEntry *e)
@@ -376,7 +389,7 @@ process_sign_request2(SocketEntry *e)
if (flags & SSH_AGENT_OLD_SIGNATURE)
compat = SSH_BUG_SIGBLOB;
if ((r = sshkey_from_blob(blob, blen, &key)) != 0) {
- error("%s: cannot parse key blob: %s", __func__, ssh_err(ok));
+ error("%s: cannot parse key blob: %s", __func__, ssh_err(r));
goto send;
}
if ((id = lookup_identity(key, 2)) == NULL) {
@@ -388,8 +401,8 @@ process_sign_request2(SocketEntry *e)
goto send;
}
if ((r = sshkey_sign(id->key, &signature, &slen,
- data, dlen, compat)) != 0) {
- error("%s: sshkey_sign: %s", __func__, ssh_err(ok));
+ data, dlen, agent_decode_alg(key, flags), compat)) != 0) {
+ error("%s: sshkey_sign: %s", __func__, ssh_err(r));
goto send;
}
/* Success */
@@ -1196,6 +1209,7 @@ main(int ac, char **av)
void (*f_setenv)(const char *, const char *);
void (*f_unsetenv)(const char *);
+ ssh_malloc_init(); /* must be called before any mallocs */
/* Ensure that fds 0, 1 and 2 are open or directed to /dev/null */
sanitise_stdfd();
@@ -1340,6 +1354,7 @@ main(int ac, char **av)
SSH_AUTHSOCKET_ENV_NAME, socket_name,
SSH_AUTHSOCKET_ENV_NAME);
printf("echo Agent pid %ld;\n", (long)parent_pid);
+ fflush(stdout);
goto skip;
}
pid = fork();
@@ -1445,6 +1460,11 @@ skip:
signal(SIGTERM, cleanup_handler);
nalloc = 0;
+#ifdef __OpenBSD__
+ if (pledge("stdio cpath unix id proc exec", NULL) == -1)
+ fatal("%s: pledge: %s", __progname, strerror(errno));
+#endif
+
while (1) {
prepare_select(&readsetp, &writesetp, &max_fd, &nalloc, &tvp);
result = select(max_fd + 1, readsetp, writesetp, NULL, tvp);
diff --git a/crypto/external/bsd/openssh/dist/ssh-dss.c b/crypto/external/bsd/openssh/dist/ssh-dss.c
index e17a50aeb4a..143040190cb 100644
--- a/crypto/external/bsd/openssh/dist/ssh-dss.c
+++ b/crypto/external/bsd/openssh/dist/ssh-dss.c
@@ -1,5 +1,6 @@
-/* $NetBSD: ssh-dss.c,v 1.7 2015/04/03 23:58:19 christos Exp $ */
-/* $OpenBSD: ssh-dss.c,v 1.32 2014/06/24 01:13:21 djm Exp $ */
+/* $NetBSD: ssh-dss.c,v 1.8 2016/03/11 01:55:00 christos Exp $ */
+/* $OpenBSD: ssh-dss.c,v 1.34 2015/12/11 04:21:12 mmcc Exp $ */
+
/*
* Copyright (c) 2000 Markus Friedl. All rights reserved.
*
@@ -25,7 +26,7 @@
*/
#include "includes.h"
-__RCSID("$NetBSD: ssh-dss.c,v 1.7 2015/04/03 23:58:19 christos Exp $");
+__RCSID("$NetBSD: ssh-dss.c,v 1.8 2016/03/11 01:55:00 christos Exp $");
#include <sys/types.h>
#include <openssl/bn.h>
@@ -119,8 +120,7 @@ ssh_dss_sign(const struct sshkey *key, u_char **sigp, size_t *lenp,
explicit_bzero(digest, sizeof(digest));
if (sig != NULL)
DSA_SIG_free(sig);
- if (b != NULL)
- sshbuf_free(b);
+ sshbuf_free(b);
return ret;
}
@@ -206,10 +206,8 @@ ssh_dss_verify(const struct sshkey *key,
explicit_bzero(digest, sizeof(digest));
if (sig != NULL)
DSA_SIG_free(sig);
- if (b != NULL)
- sshbuf_free(b);
- if (ktype != NULL)
- free(ktype);
+ sshbuf_free(b);
+ free(ktype);
if (sigblob != NULL) {
explicit_bzero(sigblob, len);
free(sigblob);
diff --git a/crypto/external/bsd/openssh/dist/ssh-ecdsa.c b/crypto/external/bsd/openssh/dist/ssh-ecdsa.c
index e07daf4967b..03a6592a0b6 100644
--- a/crypto/external/bsd/openssh/dist/ssh-ecdsa.c
+++ b/crypto/external/bsd/openssh/dist/ssh-ecdsa.c
@@ -1,5 +1,6 @@
-/* $NetBSD: ssh-ecdsa.c,v 1.6 2015/04/03 23:58:19 christos Exp $ */
-/* $OpenBSD: ssh-ecdsa.c,v 1.11 2014/06/24 01:13:21 djm Exp $ */
+/* $NetBSD: ssh-ecdsa.c,v 1.7 2016/03/11 01:55:00 christos Exp $ */
+/* $OpenBSD: ssh-ecdsa.c,v 1.12 2015/12/11 04:21:12 mmcc Exp $ */
+
/*
* Copyright (c) 2000 Markus Friedl. All rights reserved.
* Copyright (c) 2010 Damien Miller. All rights reserved.
@@ -26,7 +27,7 @@
*/
#include "includes.h"
-__RCSID("$NetBSD: ssh-ecdsa.c,v 1.6 2015/04/03 23:58:19 christos Exp $");
+__RCSID("$NetBSD: ssh-ecdsa.c,v 1.7 2016/03/11 01:55:00 christos Exp $");
#include <sys/types.h>
#include <openssl/bn.h>
@@ -98,10 +99,8 @@ ssh_ecdsa_sign(const struct sshkey *key, u_char **sigp, size_t *lenp,
ret = 0;
out:
explicit_bzero(digest, sizeof(digest));
- if (b != NULL)
- sshbuf_free(b);
- if (bb != NULL)
- sshbuf_free(bb);
+ sshbuf_free(b);
+ sshbuf_free(bb);
if (sig != NULL)
ECDSA_SIG_free(sig);
return ret;
@@ -178,10 +177,8 @@ ssh_ecdsa_verify(const struct sshkey *key,
out:
explicit_bzero(digest, sizeof(digest));
- if (sigbuf != NULL)
- sshbuf_free(sigbuf);
- if (b != NULL)
- sshbuf_free(b);
+ sshbuf_free(sigbuf);
+ sshbuf_free(b);
if (sig != NULL)
ECDSA_SIG_free(sig);
free(ktype);
diff --git a/crypto/external/bsd/openssh/dist/ssh-keygen.1 b/crypto/external/bsd/openssh/dist/ssh-keygen.1
index 4f19c62760f..68b1dfaba07 100644
--- a/crypto/external/bsd/openssh/dist/ssh-keygen.1
+++ b/crypto/external/bsd/openssh/dist/ssh-keygen.1
@@ -1,5 +1,5 @@
-.\" $NetBSD: ssh-keygen.1,v 1.15 2015/08/21 08:20:59 christos Exp $
-.\" $OpenBSD: ssh-keygen.1,v 1.127 2015/08/20 19:20:06 naddy Exp $
+.\" $NetBSD: ssh-keygen.1,v 1.16 2016/03/11 01:55:00 christos Exp $
+.\" $OpenBSD: ssh-keygen.1,v 1.130 2016/02/17 07:38:19 jmc Exp $
.\"
.\" -*- nroff -*-
.\"
@@ -38,7 +38,7 @@
.\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
.\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
.\"
-.Dd August 20 2015
+.Dd February 17 2016
.Dt SSH-KEYGEN 1
.Os
.Sh NAME
@@ -144,8 +144,12 @@
generates, manages and converts authentication keys for
.Xr ssh 1 .
.Nm
-can create RSA keys for use by SSH protocol version 1 and
-DSA, ECDSA, Ed25519 or RSA keys for use by SSH protocol version 2.
+can create keys for use by SSH protocol versions 1 and 2.
+Protocol 1 should not be used
+and is only offered to support legacy devices.
+It suffers from a number of cryptographic weaknesses
+and doesn't support many of the advanced features available for protocol 2.
+.Pp
The type of key to be generated is specified with the
.Fl t
option.
@@ -379,7 +383,7 @@ using the format described in the
.Sx KEY REVOCATION LISTS
section.
.It Fl L
-Prints the contents of a certificate.
+Prints the contents of one or more certificates.
.It Fl l
Show fingerprint of specified public key file.
Private RSA1 keys are also supported.
@@ -477,7 +481,7 @@ At present, no options are valid for host keys.
.It Fl o
Causes
.Nm
-to save SSH protocol 2 private keys using the new OpenSSH format rather than
+to save private keys using the new OpenSSH format rather than
the more compatible PEM format.
The new format has increased resistance to brute-force password cracking
but is not supported by versions of OpenSSH prior to 6.5.
@@ -787,7 +791,7 @@ It is also possible, given a KRL, to test whether it revokes a particular key
(or keys).
The
.Fl Q
-flag will query an existing KRL, testing each key specified on the commandline.
+flag will query an existing KRL, testing each key specified on the command line.
If any key listed on the command line has been revoked (or an error encountered)
then
.Nm
diff --git a/crypto/external/bsd/openssh/dist/ssh-keygen.c b/crypto/external/bsd/openssh/dist/ssh-keygen.c
index b6e8c10d586..e8304d40081 100644
--- a/crypto/external/bsd/openssh/dist/ssh-keygen.c
+++ b/crypto/external/bsd/openssh/dist/ssh-keygen.c
@@ -1,5 +1,6 @@
-/* $NetBSD: ssh-keygen.c,v 1.19 2015/08/21 08:20:59 christos Exp $ */
-/* $OpenBSD: ssh-keygen.c,v 1.277 2015/08/19 23:17:51 djm Exp $ */
+/* $NetBSD: ssh-keygen.c,v 1.20 2016/03/11 01:55:00 christos Exp $ */
+/* $OpenBSD: ssh-keygen.c,v 1.288 2016/02/15 09:47:49 dtucker Exp $ */
+
/*
* Author: Tatu Ylonen <ylo@cs.hut.fi>
* Copyright (c) 1994 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
@@ -14,7 +15,7 @@
*/
#include "includes.h"
-__RCSID("$NetBSD: ssh-keygen.c,v 1.19 2015/08/21 08:20:59 christos Exp $");
+__RCSID("$NetBSD: ssh-keygen.c,v 1.20 2016/03/11 01:55:00 christos Exp $");
#include <sys/types.h>
#include <sys/socket.h>
#include <sys/stat.h>
@@ -517,7 +518,7 @@ do_convert_private_ssh2_from_blob(u_char *blob, u_int blen)
sshbuf_free(b);
/* try the key */
- if (sshkey_sign(key, &sig, &slen, data, sizeof(data), 0) != 0 ||
+ if (sshkey_sign(key, &sig, &slen, data, sizeof(data), NULL, 0) != 0 ||
sshkey_verify(key, sig, slen, data, sizeof(data), 0) != 0) {
sshkey_free(key);
free(sig);
@@ -798,116 +799,162 @@ do_download(struct passwd *pw)
#endif /* ENABLE_PKCS11 */
}
-__dead static void
-do_fingerprint(struct passwd *pw)
+static struct sshkey *
+try_read_key(char **cpp)
{
- FILE *f;
- struct sshkey *public;
- char *comment = NULL, *cp, *ep, line[16*1024], *fp, *ra;
- int r, i, skip = 0, num = 0, invalid = 1;
+ struct sshkey *ret;
+ int r;
+
+ if ((ret = sshkey_new(KEY_RSA1)) == NULL)
+ fatal("sshkey_new failed");
+ /* Try RSA1 */
+ if ((r = sshkey_read(ret, cpp)) == 0)
+ return ret;
+ /* Try modern */
+ sshkey_free(ret);
+ if ((ret = sshkey_new(KEY_UNSPEC)) == NULL)
+ fatal("sshkey_new failed");
+ if ((r = sshkey_read(ret, cpp)) == 0)
+ return ret;
+ /* Not a key */
+ sshkey_free(ret);
+ return NULL;
+}
+
+static __dead void
+fingerprint_one_key(const struct sshkey *public, const char *comment)
+{
+ char *fp = NULL, *ra = NULL;
enum sshkey_fp_rep rep;
int fptype;
- struct stat st;
fptype = print_bubblebabble ? SSH_DIGEST_SHA1 : fingerprint_hash;
rep = print_bubblebabble ? SSH_FP_BUBBLEBABBLE : SSH_FP_DEFAULT;
- if (!have_identity)
- ask_filename(pw, "Enter file in which the key is");
+ fp = sshkey_fingerprint(public, fptype, rep);
+ ra = sshkey_fingerprint(public, fingerprint_hash, SSH_FP_RANDOMART);
+ if (fp == NULL || ra == NULL)
+ fatal("%s: sshkey_fingerprint failed", __func__);
+ printf("%u %s %s (%s)\n", sshkey_size(public), fp,
+ comment ? comment : "no comment", sshkey_type(public));
+ if (log_level >= SYSLOG_LEVEL_VERBOSE)
+ printf("%s\n", ra);
+ free(ra);
+ free(fp);
+}
+
+static void
+fingerprint_private(const char *path)
+{
+ struct stat st;
+ char *comment = NULL;
+ struct sshkey *public = NULL;
+ int r;
+
if (stat(identity_file, &st) < 0)
- fatal("%s: %s", identity_file, strerror(errno));
- if ((r = sshkey_load_public(identity_file, &public, &comment)) != 0)
- debug2("Error loading public key \"%s\": %s",
- identity_file, ssh_err(r));
- else {
- fp = sshkey_fingerprint(public, fptype, rep);
- ra = sshkey_fingerprint(public, fingerprint_hash,
- SSH_FP_RANDOMART);
- if (fp == NULL || ra == NULL)
- fatal("%s: sshkey_fingerprint fail", __func__);
- printf("%u %s %s (%s)\n", sshkey_size(public), fp, comment,
- sshkey_type(public));
- if (log_level >= SYSLOG_LEVEL_VERBOSE)
- printf("%s\n", ra);
- sshkey_free(public);
- free(comment);
- free(ra);
- free(fp);
- exit(0);
- }
- if (comment) {
- free(comment);
- comment = NULL;
+ fatal("%s: %s", path, strerror(errno));
+ if ((r = sshkey_load_public(path, &public, &comment)) != 0) {
+ debug("load public \"%s\": %s", path, ssh_err(r));
+ if ((r = sshkey_load_private(path, NULL,
+ &public, &comment)) != 0) {
+ debug("load private \"%s\": %s", path, ssh_err(r));
+ fatal("%s is not a key file.", path);
+ }
}
- if ((f = fopen(identity_file, "r")) == NULL)
- fatal("%s: %s: %s", __progname, identity_file, strerror(errno));
+ fingerprint_one_key(public, comment);
+ sshkey_free(public);
+ free(comment);
+}
- while (fgets(line, sizeof(line), f)) {
- if ((cp = strchr(line, '\n')) == NULL) {
- error("line %d too long: %.40s...",
- num + 1, line);
- skip = 1;
+static void
+do_fingerprint(struct passwd *pw)
+{
+ FILE *f;
+ struct sshkey *public = NULL;
+ char *comment = NULL, *cp, *ep, line[SSH_MAX_PUBKEY_BYTES];
+ int i, invalid = 1;
+ const char *path;
+ long int lnum = 0;
+
+ if (!have_identity)
+ ask_filename(pw, "Enter file in which the key is");
+ path = identity_file;
+
+ if (strcmp(identity_file, "-") == 0) {
+ f = stdin;
+ path = "(stdin)";
+ } else if ((f = fopen(path, "r")) == NULL)
+ fatal("%s: %s: %s", __progname, path, strerror(errno));
+
+ while (read_keyfile_line(f, path, line, sizeof(line), &lnum) == 0) {
+ cp = line;
+ cp[strcspn(cp, "\n")] = '\0';
+ /* Trim leading space and comments */
+ cp = line + strspn(line, " \t");
+ if (*cp == '#' || *cp == '\0')
continue;
+
+ /*
+ * Input may be plain keys, private keys, authorized_keys
+ * or known_hosts.
+ */
+
+ /*
+ * Try private keys first. Assume a key is private if
+ * "SSH PRIVATE KEY" appears on the first line and we're
+ * not reading from stdin (XXX support private keys on stdin).
+ */
+ if (lnum == 1 && strcmp(identity_file, "-") != 0 &&
+ strstr(cp, "PRIVATE KEY") != NULL) {
+ fclose(f);
+ fingerprint_private(path);
+ exit(0);
}
- num++;
- if (skip) {
- skip = 0;
+
+ /*
+ * If it's not a private key, then this must be prepared to
+ * accept a public key prefixed with a hostname or options.
+ * Try a bare key first, otherwise skip the leading stuff.
+ */
+ if ((public = try_read_key(&cp)) == NULL) {
+ i = strtol(cp, &ep, 10);
+ if (i == 0 || ep == NULL ||
+ (*ep != ' ' && *ep != '\t')) {
+ int quoted = 0;
+
+ comment = cp;
+ for (; *cp && (quoted || (*cp != ' ' &&
+ *cp != '\t')); cp++) {
+ if (*cp == '\\' && cp[1] == '"')
+ cp++; /* Skip both */
+ else if (*cp == '"')
+ quoted = !quoted;
+ }
+ if (!*cp)
+ continue;
+ *cp++ = '\0';
+ }
+ }
+ /* Retry after parsing leading hostname/key options */
+ if (public == NULL && (public = try_read_key(&cp)) == NULL) {
+ debug("%s:%ld: not a public key", path, lnum);
continue;
}
- *cp = '\0';
- /* Skip leading whitespace, empty and comment lines. */
- for (cp = line; *cp == ' ' || *cp == '\t'; cp++)
+ /* Find trailing comment, if any */
+ for (; *cp == ' ' || *cp == '\t'; cp++)
;
- if (!*cp || *cp == '\n' || *cp == '#')
- continue;
- i = strtol(cp, &ep, 10);
- if (i == 0 || ep == NULL || (*ep != ' ' && *ep != '\t')) {
- int quoted = 0;
+ if (*cp != '\0' && *cp != '#')
comment = cp;
- for (; *cp && (quoted || (*cp != ' ' &&
- *cp != '\t')); cp++) {
- if (*cp == '\\' && cp[1] == '"')
- cp++; /* Skip both */
- else if (*cp == '"')
- quoted = !quoted;
- }
- if (!*cp)
- continue;
- *cp++ = '\0';
- }
- ep = cp;
- if ((public = sshkey_new(KEY_RSA1)) == NULL)
- fatal("sshkey_new failed");
- if ((r = sshkey_read(public, &cp)) != 0) {
- cp = ep;
- sshkey_free(public);
- if ((public = sshkey_new(KEY_UNSPEC)) == NULL)
- fatal("sshkey_new failed");
- if ((r = sshkey_read(public, &cp)) != 0) {
- sshkey_free(public);
- continue;
- }
- }
- comment = *cp ? cp : comment;
- fp = sshkey_fingerprint(public, fptype, rep);
- ra = sshkey_fingerprint(public, fingerprint_hash,
- SSH_FP_RANDOMART);
- if (fp == NULL || ra == NULL)
- fatal("%s: sshkey_fingerprint fail", __func__);
- printf("%u %s %s (%s)\n", sshkey_size(public), fp,
- comment ? comment : "no comment", sshkey_type(public));
- if (log_level >= SYSLOG_LEVEL_VERBOSE)
- printf("%s\n", ra);
- free(ra);
- free(fp);
+
+ fingerprint_one_key(public, comment);
sshkey_free(public);
- invalid = 0;
+ invalid = 0; /* One good key in the file is sufficient */
}
fclose(f);
if (invalid)
- fatal("%s is not a public key file.", identity_file);
+ fatal("%s is not a public key file.", path);
exit(0);
}
@@ -1173,8 +1220,11 @@ do_known_hosts(struct passwd *pw, const char *name)
foreach_options |= print_fingerprint ? HKF_WANT_PARSE_KEY : 0;
if ((r = hostkeys_foreach(identity_file,
hash_hosts ? known_hosts_hash : known_hosts_find_delete, &ctx,
- name, NULL, foreach_options)) != 0)
+ name, NULL, foreach_options)) != 0) {
+ if (inplace)
+ unlink(tmp);
fatal("%s: hostkeys_foreach failed: %s", __func__, ssh_err(r));
+ }
if (inplace)
fclose(ctx.out);
@@ -1372,9 +1422,11 @@ do_change_comment(struct passwd *pw)
identity_file, ssh_err(r));
}
}
- /* XXX what about new-format keys? */
- if (private->type != KEY_RSA1) {
- error("Comments are only supported for RSA1 keys.");
+
+ if (private->type != KEY_RSA1 && private->type != KEY_ED25519 &&
+ !use_new_format) {
+ error("Comments are only supported for RSA1 or keys stored in "
+ "the new format (-o).");
explicit_bzero(passphrase, strlen(passphrase));
sshkey_free(private);
exit(1);
@@ -1430,44 +1482,6 @@ do_change_comment(struct passwd *pw)
exit(0);
}
-static const char *
-fmt_validity(u_int64_t valid_from, u_int64_t valid_to)
-{
- char from[32], to[32];
- static char ret[64];
- time_t tt;
- struct tm *tm;
-
- *from = *to = '\0';
- if (valid_from == 0 && valid_to == 0xffffffffffffffffULL)
- return "forever";
-
- if (valid_from != 0) {
- /* XXX revisit INT_MAX in 2038 :) */
- tt = valid_from > INT_MAX ? INT_MAX : valid_from;
- tm = localtime(&tt);
- strftime(from, sizeof(from), "%Y-%m-%dT%H:%M:%S", tm);
- }
- if (valid_to != 0xffffffffffffffffULL) {
- /* XXX revisit INT_MAX in 2038 :) */
- tt = valid_to > INT_MAX ? INT_MAX : valid_to;
- tm = localtime(&tt);
- strftime(to, sizeof(to), "%Y-%m-%dT%H:%M:%S", tm);
- }
-
- if (valid_from == 0) {
- snprintf(ret, sizeof(ret), "before %s", to);
- return ret;
- }
- if (valid_to == 0xffffffffffffffffULL) {
- snprintf(ret, sizeof(ret), "after %s", from);
- return ret;
- }
-
- snprintf(ret, sizeof(ret), "from %s to %s", from, to);
- return ret;
-}
-
static void
add_flag_option(struct sshbuf *c, const char *name)
{
@@ -1561,7 +1575,7 @@ do_ca_sign(struct passwd *pw, int argc, char **argv)
int r, i, fd;
u_int n;
struct sshkey *ca, *public;
- char *otmp, *tmp, *cp, *out, *comment, **plist = NULL;
+ char valid[64], *otmp, *tmp, *cp, *out, *comment, **plist = NULL;
FILE *f;
#ifdef ENABLE_PKCS11
@@ -1636,13 +1650,15 @@ do_ca_sign(struct passwd *pw, int argc, char **argv)
fclose(f);
if (!quiet) {
+ sshkey_format_cert_validity(public->cert,
+ valid, sizeof(valid));
logit("Signed %s key %s: id \"%s\" serial %llu%s%s "
- "valid %s", sshkey_cert_type(public),
+ "valid %s", sshkey_cert_type(public),
out, public->cert->key_id,
(unsigned long long)public->cert->serial,
cert_principals != NULL ? " for " : "",
cert_principals != NULL ? cert_principals : "",
- fmt_validity(cert_valid_from, cert_valid_to));
+ valid);
}
sshkey_free(public);
@@ -1677,7 +1693,7 @@ parse_absolute_time(const char *s)
const char *fmt;
/*
- * POSIX strptime says "The application shall ensure that there
+ * POSIX strptime says "The application shall ensure that there
* is white-space or other non-alphanumeric characters between
* any two conversion specifications" so arrange things this way.
*/
@@ -1840,32 +1856,19 @@ show_options(struct sshbuf *optbuf, int in_critical)
sshbuf_free(options);
}
-__dead static void
-do_show_cert(struct passwd *pw)
+static void
+print_cert(struct sshkey *key)
{
- struct sshkey *key;
- struct stat st;
- char *key_fp, *ca_fp;
+ char valid[64], *key_fp, *ca_fp;
u_int i;
- int r;
-
- if (!have_identity)
- ask_filename(pw, "Enter file in which the key is");
- if (stat(identity_file, &st) < 0)
- fatal("%s: %s: %s", __progname, identity_file, strerror(errno));
- if ((r = sshkey_load_public(identity_file, &key, NULL)) != 0)
- fatal("Cannot load public key \"%s\": %s",
- identity_file, ssh_err(r));
- if (!sshkey_is_cert(key))
- fatal("%s is not a certificate", identity_file);
key_fp = sshkey_fingerprint(key, fingerprint_hash, SSH_FP_DEFAULT);
ca_fp = sshkey_fingerprint(key->cert->signature_key,
fingerprint_hash, SSH_FP_DEFAULT);
if (key_fp == NULL || ca_fp == NULL)
fatal("%s: sshkey_fingerprint fail", __func__);
+ sshkey_format_cert_validity(key->cert, valid, sizeof(valid));
- printf("%s:\n", identity_file);
printf(" Type: %s %s certificate\n", sshkey_ssh_name(key),
sshkey_cert_type(key));
printf(" Public key: %s %s\n", sshkey_type(key), key_fp);
@@ -1873,8 +1876,7 @@ do_show_cert(struct passwd *pw)
sshkey_type(key->cert->signature_key), ca_fp);
printf(" Key ID: \"%s\"\n", key->cert->key_id);
printf(" Serial: %llu\n", (unsigned long long)key->cert->serial);
- printf(" Valid: %s\n",
- fmt_validity(key->cert->valid_after, key->cert->valid_before));
+ printf(" Valid: %s\n", valid);
printf(" Principals: ");
if (key->cert->nprincipals == 0)
printf("(none)\n");
@@ -1898,7 +1900,60 @@ do_show_cert(struct passwd *pw)
printf("\n");
show_options(key->cert->extensions, 0);
}
- exit(0);
+}
+
+static void
+do_show_cert(struct passwd *pw)
+{
+ struct sshkey *key = NULL;
+ struct stat st;
+ int r, is_stdin = 0, ok = 0;
+ FILE *f;
+ char *cp, line[SSH_MAX_PUBKEY_BYTES];
+ const char *path;
+ long int lnum = 0;
+
+ if (!have_identity)
+ ask_filename(pw, "Enter file in which the key is");
+ if (strcmp(identity_file, "-") != 0 && stat(identity_file, &st) < 0)
+ fatal("%s: %s: %s", __progname, identity_file, strerror(errno));
+
+ path = identity_file;
+ if (strcmp(path, "-") == 0) {
+ f = stdin;
+ path = "(stdin)";
+ is_stdin = 1;
+ } else if ((f = fopen(identity_file, "r")) == NULL)
+ fatal("fopen %s: %s", identity_file, strerror(errno));
+
+ while (read_keyfile_line(f, path, line, sizeof(line), &lnum) == 0) {
+ sshkey_free(key);
+ key = NULL;
+ /* Trim leading space and comments */
+ cp = line + strspn(line, " \t");
+ if (*cp == '#' || *cp == '\0')
+ continue;
+ if ((key = sshkey_new(KEY_UNSPEC)) == NULL)
+ fatal("key_new");
+ if ((r = sshkey_read(key, &cp)) != 0) {
+ error("%s:%lu: invalid key: %s", path,
+ lnum, ssh_err(r));
+ continue;
+ }
+ if (!sshkey_is_cert(key)) {
+ error("%s:%lu is not a certificate", path, lnum);
+ continue;
+ }
+ ok = 1;
+ if (!is_stdin && lnum == 1)
+ printf("%s:\n", path);
+ else
+ printf("%s:%lu:\n", path, lnum);
+ print_cert(key);
+ }
+ sshkey_free(key);
+ fclose(f);
+ exit(ok ? 0 : 1);
}
#ifdef WITH_OPENSSL
@@ -2103,8 +2158,7 @@ do_gen_krl(struct passwd *pw, int updating, int argc, char **argv)
close(fd);
sshbuf_free(kbuf);
ssh_krl_free(krl);
- if (ca != NULL)
- sshkey_free(ca);
+ sshkey_free(ca);
}
__dead static void
@@ -2200,6 +2254,7 @@ main(int argc, char **argv)
extern int optind;
extern char *optarg;
+ ssh_malloc_init(); /* must be called before any mallocs */
/* Ensure that fds 0, 1 and 2 are open or directed to /dev/null */
sanitise_stdfd();
diff --git a/crypto/external/bsd/openssh/dist/ssh-keyscan.1 b/crypto/external/bsd/openssh/dist/ssh-keyscan.1
index 08bce60b1a2..d7b83120edf 100644
--- a/crypto/external/bsd/openssh/dist/ssh-keyscan.1
+++ b/crypto/external/bsd/openssh/dist/ssh-keyscan.1
@@ -1,5 +1,5 @@
-.\" $NetBSD: ssh-keyscan.1,v 1.10 2015/04/03 23:58:19 christos Exp $
-.\" $OpenBSD: ssh-keyscan.1,v 1.36 2014/08/30 15:33:50 sobrado Exp $
+.\" $NetBSD: ssh-keyscan.1,v 1.11 2016/03/11 01:55:00 christos Exp $
+.\" $OpenBSD: ssh-keyscan.1,v 1.38 2015/11/08 23:24:03 jmc Exp $
.\"
.\" Copyright 1995, 1996 by David Mazieres <dm@lcs.mit.edu>.
.\"
@@ -7,7 +7,7 @@
.\" permitted provided that due credit is given to the author and the
.\" OpenBSD project by leaving this copyright notice intact.
.\"
-.Dd August 30 2014
+.Dd November 8 2015
.Dt SSH-KEYSCAN 1
.Os
.Sh NAME
@@ -16,7 +16,7 @@
.Sh SYNOPSIS
.Nm ssh-keyscan
.Bk -words
-.Op Fl 46Hv
+.Op Fl 46cHv
.Op Fl f Ar file
.Op Fl p Ar port
.Op Fl T Ar timeout
@@ -55,6 +55,8 @@ to use IPv4 addresses only.
Forces
.Nm
to use IPv6 addresses only.
+.It Fl c
+Request certificates from target hosts instead of plain keys.
.It Fl f Ar file
Read hosts or
.Dq addrlist namelist
diff --git a/crypto/external/bsd/openssh/dist/ssh-keyscan.c b/crypto/external/bsd/openssh/dist/ssh-keyscan.c
index eafa4a5d985..12ecb1e88f3 100644
--- a/crypto/external/bsd/openssh/dist/ssh-keyscan.c
+++ b/crypto/external/bsd/openssh/dist/ssh-keyscan.c
@@ -1,5 +1,6 @@
-/* $NetBSD: ssh-keyscan.c,v 1.14 2015/07/03 01:00:00 christos Exp $ */
-/* $OpenBSD: ssh-keyscan.c,v 1.101 2015/04/10 00:08:55 djm Exp $ */
+/* $NetBSD: ssh-keyscan.c,v 1.15 2016/03/11 01:55:00 christos Exp $ */
+/* $OpenBSD: ssh-keyscan.c,v 1.105 2016/02/15 09:47:49 dtucker Exp $ */
+
/*
* Copyright 1995, 1996 by David Mazieres <dm@lcs.mit.edu>.
*
@@ -9,7 +10,7 @@
*/
#include "includes.h"
-__RCSID("$NetBSD: ssh-keyscan.c,v 1.14 2015/07/03 01:00:00 christos Exp $");
+__RCSID("$NetBSD: ssh-keyscan.c,v 1.15 2016/03/11 01:55:00 christos Exp $");
#include <sys/param.h>
#include <sys/types.h>
@@ -59,6 +60,7 @@ int ssh_port = SSH_DEFAULT_PORT;
#define KT_ECDSA 8
#define KT_ED25519 16
+int get_cert = 0;
int get_keytypes = KT_RSA|KT_ECDSA|KT_ED25519;
int hash_hosts = 0; /* Hash hostname on output */
@@ -254,11 +256,32 @@ keygrab_ssh2(con *c)
int r;
enable_compat20();
- myproposal[PROPOSAL_SERVER_HOST_KEY_ALGS] =
- c->c_keytype == KT_DSA ? "ssh-dss" :
- (c->c_keytype == KT_RSA ? "ssh-rsa" :
- (c->c_keytype == KT_ED25519 ? "ssh-ed25519" :
- "ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521"));
+ switch (c->c_keytype) {
+ case KT_DSA:
+ myproposal[PROPOSAL_SERVER_HOST_KEY_ALGS] = get_cert ?
+ "ssh-dss-cert-v01@openssh.com" : "ssh-dss";
+ break;
+ case KT_RSA:
+ myproposal[PROPOSAL_SERVER_HOST_KEY_ALGS] = get_cert ?
+ "ssh-rsa-cert-v01@openssh.com" : "ssh-rsa";
+ break;
+ case KT_ED25519:
+ myproposal[PROPOSAL_SERVER_HOST_KEY_ALGS] = get_cert ?
+ "ssh-ed25519-cert-v01@openssh.com" : "ssh-ed25519";
+ break;
+ case KT_ECDSA:
+ myproposal[PROPOSAL_SERVER_HOST_KEY_ALGS] = get_cert ?
+ "ecdsa-sha2-nistp256-cert-v01@openssh.com,"
+ "ecdsa-sha2-nistp384-cert-v01@openssh.com,"
+ "ecdsa-sha2-nistp521-cert-v01@openssh.com" :
+ "ecdsa-sha2-nistp256,"
+ "ecdsa-sha2-nistp384,"
+ "ecdsa-sha2-nistp521";
+ break;
+ default:
+ fatal("unknown key type %d", c->c_keytype);
+ break;
+ }
if ((r = kex_setup(c->c_ssh, myproposal)) != 0) {
free(c->c_ssh);
fprintf(stderr, "kex_setup: %s\n", ssh_err(r));
@@ -281,27 +304,39 @@ keygrab_ssh2(con *c)
}
static void
-keyprint(con *c, struct sshkey *key)
+keyprint_one(char *host, struct sshkey *key)
{
- char *host = c->c_output_name ? c->c_output_name : c->c_name;
- int r;
- char *hostport = NULL;
+ char *hostport;
- if (!key)
- return;
if (hash_hosts && (host = host_hash(host, NULL, 0)) == NULL)
fatal("host_hash failed");
hostport = put_host_port(host, ssh_port);
- fprintf(stdout, "%s ", hostport);
-
- if ((r = sshkey_write(key, stdout)) != 0)
- fprintf(stderr, "key_write failed: %s", ssh_err(r));
-
+ if (!get_cert)
+ fprintf(stdout, "%s ", hostport);
+ sshkey_write(key, stdout);
fputs("\n", stdout);
free(hostport);
}
+static void
+keyprint(con *c, struct sshkey *key)
+{
+ char *hosts = c->c_output_name ? c->c_output_name : c->c_name;
+ char *host, *ohosts;
+
+ if (key == NULL)
+ return;
+ if (get_cert || (!hash_hosts && ssh_port == SSH_DEFAULT_PORT)) {
+ keyprint_one(hosts, key);
+ return;
+ }
+ ohosts = hosts = xstrdup(hosts);
+ while ((host = strsep(&hosts, ",")) != NULL)
+ keyprint_one(host, key);
+ free(ohosts);
+}
+
static int
tcpconnect(char *host)
{
@@ -358,6 +393,7 @@ conalloc(char *iname, char *oname, int keytype)
if (fdcon[s].c_status)
fatal("conalloc: attempt to reuse fdno %d", s);
+ debug3("%s: oname %s kt %d", __func__, oname, keytype);
fdcon[s].c_fd = s;
fdcon[s].c_status = CS_CON;
fdcon[s].c_namebase = namebase;
@@ -628,7 +664,7 @@ __dead static void
usage(void)
{
fprintf(stderr,
- "usage: %s [-46Hv] [-f file] [-p port] [-T timeout] [-t type]\n"
+ "usage: %s [-46cHv] [-f file] [-p port] [-T timeout] [-t type]\n"
"\t\t [host | addrlist namelist] ...\n",
__progname);
exit(1);
@@ -646,6 +682,7 @@ main(int argc, char **argv)
extern int optind;
extern char *optarg;
+ ssh_malloc_init(); /* must be called before any mallocs */
TAILQ_INIT(&tq);
/* Ensure that fds 0, 1 and 2 are open or directed to /dev/null */
@@ -654,11 +691,14 @@ main(int argc, char **argv)
if (argc <= 1)
usage();
- while ((opt = getopt(argc, argv, "Hv46p:T:t:f:")) != -1) {
+ while ((opt = getopt(argc, argv, "cHv46p:T:t:f:")) != -1) {
switch (opt) {
case 'H':
hash_hosts = 1;
break;
+ case 'c':
+ get_cert = 1;
+ break;
case 'p':
ssh_port = a2port(optarg);
if (ssh_port <= 0) {
diff --git a/crypto/external/bsd/openssh/dist/ssh-keysign.8 b/crypto/external/bsd/openssh/dist/ssh-keysign.8
index 1e2e536269c..3ee9db2eb98 100644
--- a/crypto/external/bsd/openssh/dist/ssh-keysign.8
+++ b/crypto/external/bsd/openssh/dist/ssh-keysign.8
@@ -1,5 +1,5 @@
-.\" $NetBSD: ssh-keysign.8,v 1.9 2015/04/03 23:58:19 christos Exp $
-.\" $OpenBSD: ssh-keysign.8,v 1.14 2013/12/07 11:58:46 naddy Exp $
+.\" $NetBSD: ssh-keysign.8,v 1.10 2016/03/11 01:55:00 christos Exp $
+.\" $OpenBSD: ssh-keysign.8,v 1.15 2016/02/17 07:38:19 jmc Exp $
.\"
.\" Copyright (c) 2002 Markus Friedl. All rights reserved.
.\"
@@ -23,7 +23,7 @@
.\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
.\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
.\"
-.Dd December 7 2013
+.Dd February 17 2016
.Dt SSH-KEYSIGN 8
.Os
.Sh NAME
@@ -36,7 +36,7 @@
is used by
.Xr ssh 1
to access the local host keys and generate the digital signature
-required during host-based authentication with SSH protocol version 2.
+required during host-based authentication.
.Pp
.Nm
is disabled by default and can only be enabled in the
diff --git a/crypto/external/bsd/openssh/dist/ssh-keysign.c b/crypto/external/bsd/openssh/dist/ssh-keysign.c
index e4143e5d41e..36e27763568 100644
--- a/crypto/external/bsd/openssh/dist/ssh-keysign.c
+++ b/crypto/external/bsd/openssh/dist/ssh-keysign.c
@@ -1,5 +1,6 @@
-/* $NetBSD: ssh-keysign.c,v 1.10 2015/08/13 10:33:21 christos Exp $ */
-/* $OpenBSD: ssh-keysign.c,v 1.49 2015/07/03 03:56:25 djm Exp $ */
+/* $NetBSD: ssh-keysign.c,v 1.11 2016/03/11 01:55:00 christos Exp $ */
+/* $OpenBSD: ssh-keysign.c,v 1.52 2016/02/15 09:47:49 dtucker Exp $ */
+
/*
* Copyright (c) 2002 Markus Friedl. All rights reserved.
*
@@ -25,7 +26,7 @@
*/
#include "includes.h"
-__RCSID("$NetBSD: ssh-keysign.c,v 1.10 2015/08/13 10:33:21 christos Exp $");
+__RCSID("$NetBSD: ssh-keysign.c,v 1.11 2016/03/11 01:55:00 christos Exp $");
#include <sys/types.h>
#include <openssl/evp.h>
@@ -37,6 +38,7 @@ __RCSID("$NetBSD: ssh-keysign.c,v 1.10 2015/08/13 10:33:21 christos Exp $");
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
+#include <errno.h>
#include "xmalloc.h"
#include "log.h"
@@ -54,6 +56,8 @@ __RCSID("$NetBSD: ssh-keysign.c,v 1.10 2015/08/13 10:33:21 christos Exp $");
#include "sshkey.h"
#include "ssherr.h"
+extern char *__progname;
+
/* XXX readconf.c needs these */
uid_t original_real_uid;
@@ -169,7 +173,11 @@ main(int argc, char **argv)
char *host, *fp;
size_t slen, dlen;
- key = NULL; /* XXX gcc */
+ ssh_malloc_init(); /* must be called before any mallocs */
+#ifdef __OpenBSD__
+ if (pledge("stdio rpath getpw dns id", NULL) != 0)
+ fatal("%s: pledge: %s", __progname, strerror(errno));
+#endif
/* Ensure that stdin and stdout are connected */
if ((fd = open(_PATH_DEVNULL, O_RDWR)) < 2)
@@ -231,23 +239,28 @@ main(int argc, char **argv)
if (!found)
fatal("no hostkey found");
+#ifdef __OpenBSD__
+ if (pledge("stdio dns", NULL) != 0)
+ fatal("%s: pledge: %s", __progname, strerror(errno));
+#endif
+
if ((b = sshbuf_new()) == NULL)
- fatal("%s: sshbuf_new failed", __func__);
+ fatal("%s: sshbuf_new failed", __progname);
if (ssh_msg_recv(STDIN_FILENO, b) < 0)
fatal("ssh_msg_recv failed");
if ((r = sshbuf_get_u8(b, &rver)) != 0)
- fatal("%s: buffer error: %s", __func__, ssh_err(r));
+ fatal("%s: buffer error: %s", __progname, ssh_err(r));
if (rver != version)
fatal("bad version: received %d, expected %d", rver, version);
if ((r = sshbuf_get_u32(b, (u_int *)&fd)) != 0)
- fatal("%s: buffer error: %s", __func__, ssh_err(r));
+ fatal("%s: buffer error: %s", __progname, ssh_err(r));
if (fd < 0 || fd == STDIN_FILENO || fd == STDOUT_FILENO)
fatal("bad fd");
if ((host = get_local_name(fd)) == NULL)
fatal("cannot get local name for fd");
if ((r = sshbuf_get_string(b, &data, &dlen)) != 0)
- fatal("%s: buffer error: %s", __func__, ssh_err(r));
+ fatal("%s: buffer error: %s", __progname, ssh_err(r));
if (valid_request(pw, host, &key, data, dlen) < 0)
fatal("not a valid request");
free(host);
@@ -263,19 +276,20 @@ main(int argc, char **argv)
if (!found) {
if ((fp = sshkey_fingerprint(key, options.fingerprint_hash,
SSH_FP_DEFAULT)) == NULL)
- fatal("%s: sshkey_fingerprint failed", __func__);
+ fatal("%s: sshkey_fingerprint failed", __progname);
fatal("no matching hostkey found for key %s %s",
sshkey_type(key), fp ? fp : "");
}
- if ((r = sshkey_sign(keys[i], &signature, &slen, data, dlen, 0)) != 0)
+ if ((r = sshkey_sign(keys[i], &signature, &slen, data, dlen, NULL, 0))
+ != 0)
fatal("sshkey_sign failed: %s", ssh_err(r));
free(data);
/* send reply */
sshbuf_reset(b);
if ((r = sshbuf_put_string(b, signature, slen)) != 0)
- fatal("%s: buffer error: %s", __func__, ssh_err(r));
+ fatal("%s: buffer error: %s", __progname, ssh_err(r));
if (ssh_msg_send(STDOUT_FILENO, version, b) == -1)
fatal("ssh_msg_send failed");
diff --git a/crypto/external/bsd/openssh/dist/ssh-pkcs11-client.c b/crypto/external/bsd/openssh/dist/ssh-pkcs11-client.c
index 6a5940a1c9c..1582f6a5af5 100644
--- a/crypto/external/bsd/openssh/dist/ssh-pkcs11-client.c
+++ b/crypto/external/bsd/openssh/dist/ssh-pkcs11-client.c
@@ -1,5 +1,6 @@
-/* $NetBSD: ssh-pkcs11-client.c,v 1.6 2015/04/03 23:58:19 christos Exp $ */
-/* $OpenBSD: ssh-pkcs11-client.c,v 1.5 2014/06/24 01:13:21 djm Exp $ */
+/* $NetBSD: ssh-pkcs11-client.c,v 1.7 2016/03/11 01:55:00 christos Exp $ */
+/* $OpenBSD: ssh-pkcs11-client.c,v 1.6 2015/12/11 00:20:04 mmcc Exp $ */
+
/*
* Copyright (c) 2010 Markus Friedl. All rights reserved.
*
@@ -16,7 +17,7 @@
* OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
*/
#include "includes.h"
-__RCSID("$NetBSD: ssh-pkcs11-client.c,v 1.6 2015/04/03 23:58:19 christos Exp $");
+__RCSID("$NetBSD: ssh-pkcs11-client.c,v 1.7 2016/03/11 01:55:00 christos Exp $");
#include <sys/types.h>
#include <sys/time.h>
@@ -170,7 +171,7 @@ pkcs11_start_helper(void)
close(pair[0]);
close(pair[1]);
execlp(_PATH_SSH_PKCS11_HELPER, _PATH_SSH_PKCS11_HELPER,
- (char *) 0);
+ (char *)NULL);
fprintf(stderr, "exec: %s: %s\n", _PATH_SSH_PKCS11_HELPER,
strerror(errno));
_exit(1);
diff --git a/crypto/external/bsd/openssh/dist/ssh-pkcs11-helper.c b/crypto/external/bsd/openssh/dist/ssh-pkcs11-helper.c
index 9ec0469e5bf..9a37f438666 100644
--- a/crypto/external/bsd/openssh/dist/ssh-pkcs11-helper.c
+++ b/crypto/external/bsd/openssh/dist/ssh-pkcs11-helper.c
@@ -1,5 +1,6 @@
-/* $NetBSD: ssh-pkcs11-helper.c,v 1.9 2015/08/21 08:20:59 christos Exp $ */
-/* $OpenBSD: ssh-pkcs11-helper.c,v 1.11 2015/08/20 22:32:42 deraadt Exp $ */
+/* $NetBSD: ssh-pkcs11-helper.c,v 1.10 2016/03/11 01:55:00 christos Exp $ */
+/* $OpenBSD: ssh-pkcs11-helper.c,v 1.12 2016/02/15 09:47:49 dtucker Exp $ */
+
/*
* Copyright (c) 2010 Markus Friedl. All rights reserved.
*
@@ -16,7 +17,7 @@
* OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
*/
#include "includes.h"
-__RCSID("$NetBSD: ssh-pkcs11-helper.c,v 1.9 2015/08/21 08:20:59 christos Exp $");
+__RCSID("$NetBSD: ssh-pkcs11-helper.c,v 1.10 2016/03/11 01:55:00 christos Exp $");
#include <sys/types.h>
#include <sys/queue.h>
@@ -276,6 +277,7 @@ main(int argc, char **argv)
char buf[4*4096];
extern char *__progname;
+ ssh_malloc_init(); /* must be called before any mallocs */
TAILQ_INIT(&pkcs11_keylist);
pkcs11_init(0);
diff --git a/crypto/external/bsd/openssh/dist/ssh-pkcs11.c b/crypto/external/bsd/openssh/dist/ssh-pkcs11.c
index 6d8bfa4f09d..2b55e720167 100644
--- a/crypto/external/bsd/openssh/dist/ssh-pkcs11.c
+++ b/crypto/external/bsd/openssh/dist/ssh-pkcs11.c
@@ -1,5 +1,6 @@
-/* $NetBSD: ssh-pkcs11.c,v 1.9 2015/08/13 10:33:21 christos Exp $ */
-/* $OpenBSD: ssh-pkcs11.c,v 1.21 2015/07/18 08:02:17 djm Exp $ */
+/* $NetBSD: ssh-pkcs11.c,v 1.10 2016/03/11 01:55:00 christos Exp $ */
+/* $OpenBSD: ssh-pkcs11.c,v 1.22 2016/02/12 00:20:30 djm Exp $ */
+
/*
* Copyright (c) 2010 Markus Friedl. All rights reserved.
*
@@ -16,7 +17,7 @@
* OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
*/
#include "includes.h"
-__RCSID("$NetBSD: ssh-pkcs11.c,v 1.9 2015/08/13 10:33:21 christos Exp $");
+__RCSID("$NetBSD: ssh-pkcs11.c,v 1.10 2016/03/11 01:55:00 christos Exp $");
#include <sys/types.h>
#include <sys/queue.h>
@@ -318,8 +319,10 @@ pkcs11_rsa_wrap(struct pkcs11_provider *provider, CK_ULONG slotidx,
k11->slotidx = slotidx;
/* identify key object on smartcard */
k11->keyid_len = keyid_attrib->ulValueLen;
- k11->keyid = xmalloc(k11->keyid_len);
- memcpy(k11->keyid, keyid_attrib->pValue, k11->keyid_len);
+ if (k11->keyid_len > 0) {
+ k11->keyid = xmalloc(k11->keyid_len);
+ memcpy(k11->keyid, keyid_attrib->pValue, k11->keyid_len);
+ }
k11->orig_finish = def->finish;
memcpy(&k11->rsa_method, def, sizeof(k11->rsa_method));
k11->rsa_method.name = "pkcs11";
diff --git a/crypto/external/bsd/openssh/dist/ssh-rsa.c b/crypto/external/bsd/openssh/dist/ssh-rsa.c
index 3c57730cb69..a2c086c7402 100644
--- a/crypto/external/bsd/openssh/dist/ssh-rsa.c
+++ b/crypto/external/bsd/openssh/dist/ssh-rsa.c
@@ -1,5 +1,6 @@
-/* $NetBSD: ssh-rsa.c,v 1.8 2015/07/03 01:00:00 christos Exp $ */
-/* $OpenBSD: ssh-rsa.c,v 1.53 2015/06/15 01:32:50 djm Exp $ */
+/* $NetBSD: ssh-rsa.c,v 1.9 2016/03/11 01:55:00 christos Exp $ */
+/* $OpenBSD: ssh-rsa.c,v 1.58 2015/12/11 04:21:12 mmcc Exp $ */
+
/*
* Copyright (c) 2000, 2003 Markus Friedl <markus@openbsd.org>
*
@@ -17,7 +18,7 @@
*/
#include "includes.h"
-__RCSID("$NetBSD: ssh-rsa.c,v 1.8 2015/07/03 01:00:00 christos Exp $");
+__RCSID("$NetBSD: ssh-rsa.c,v 1.9 2016/03/11 01:55:00 christos Exp $");
#include <sys/types.h>
#include <openssl/evp.h>
@@ -34,16 +35,56 @@ __RCSID("$NetBSD: ssh-rsa.c,v 1.8 2015/07/03 01:00:00 christos Exp $");
static int openssh_RSA_verify(int, u_char *, size_t, u_char *, size_t, RSA *);
+static const char *
+rsa_hash_alg_ident(int hash_alg)
+{
+ switch (hash_alg) {
+ case SSH_DIGEST_SHA1:
+ return "ssh-rsa";
+ case SSH_DIGEST_SHA256:
+ return "rsa-sha2-256";
+ case SSH_DIGEST_SHA512:
+ return "rsa-sha2-512";
+ }
+ return NULL;
+}
+
+static int
+rsa_hash_alg_from_ident(const char *ident)
+{
+ if (strcmp(ident, "ssh-rsa") == 0)
+ return SSH_DIGEST_SHA1;
+ if (strcmp(ident, "rsa-sha2-256") == 0)
+ return SSH_DIGEST_SHA256;
+ if (strcmp(ident, "rsa-sha2-512") == 0)
+ return SSH_DIGEST_SHA512;
+ return -1;
+}
+
+static int
+rsa_hash_alg_nid(int type)
+{
+ switch (type) {
+ case SSH_DIGEST_SHA1:
+ return NID_sha1;
+ case SSH_DIGEST_SHA256:
+ return NID_sha256;
+ case SSH_DIGEST_SHA512:
+ return NID_sha512;
+ default:
+ return -1;
+ }
+}
+
/* RSASSA-PKCS1-v1_5 (PKCS #1 v2.0 signature) with SHA1 */
int
ssh_rsa_sign(const struct sshkey *key, u_char **sigp, size_t *lenp,
- const u_char *data, size_t datalen, u_int compat)
+ const u_char *data, size_t datalen, const char *alg_ident)
{
- int hash_alg;
u_char digest[SSH_DIGEST_MAX_LENGTH], *sig = NULL;
size_t slen;
u_int dlen, len;
- int nid, ret = SSH_ERR_INTERNAL_ERROR;
+ int nid, hash_alg, ret = SSH_ERR_INTERNAL_ERROR;
struct sshbuf *b = NULL;
if (lenp != NULL)
@@ -51,16 +92,21 @@ ssh_rsa_sign(const struct sshkey *key, u_char **sigp, size_t *lenp,
if (sigp != NULL)
*sigp = NULL;
- if (key == NULL || key->rsa == NULL ||
- sshkey_type_plain(key->type) != KEY_RSA)
+ if (alg_ident == NULL || strlen(alg_ident) == 0 ||
+ strncmp(alg_ident, "ssh-rsa-cert", strlen("ssh-rsa-cert")) == 0)
+ hash_alg = SSH_DIGEST_SHA1;
+ else
+ hash_alg = rsa_hash_alg_from_ident(alg_ident);
+ if (key == NULL || key->rsa == NULL || hash_alg == -1 ||
+ sshkey_type_plain(key->type) != KEY_RSA ||
+ BN_num_bits(key->rsa->n) < SSH_RSA_MINIMUM_MODULUS_SIZE)
return SSH_ERR_INVALID_ARGUMENT;
slen = RSA_size(key->rsa);
if (slen <= 0 || slen > SSHBUF_MAX_BIGNUM)
return SSH_ERR_INVALID_ARGUMENT;
/* hash the data */
- hash_alg = SSH_DIGEST_SHA1;
- nid = NID_sha1;
+ nid = rsa_hash_alg_nid(hash_alg);
if ((dlen = ssh_digest_bytes(hash_alg)) == 0)
return SSH_ERR_INTERNAL_ERROR;
if ((ret = ssh_digest_memory(hash_alg, data, datalen,
@@ -89,7 +135,7 @@ ssh_rsa_sign(const struct sshkey *key, u_char **sigp, size_t *lenp,
ret = SSH_ERR_ALLOC_FAIL;
goto out;
}
- if ((ret = sshbuf_put_cstring(b, "ssh-rsa")) != 0 ||
+ if ((ret = sshbuf_put_cstring(b, rsa_hash_alg_ident(hash_alg))) != 0 ||
(ret = sshbuf_put_string(b, sig, slen)) != 0)
goto out;
len = sshbuf_len(b);
@@ -109,15 +155,13 @@ ssh_rsa_sign(const struct sshkey *key, u_char **sigp, size_t *lenp,
explicit_bzero(sig, slen);
free(sig);
}
- if (b != NULL)
- sshbuf_free(b);
+ sshbuf_free(b);
return ret;
}
int
ssh_rsa_verify(const struct sshkey *key,
- const u_char *signature, size_t signaturelen,
- const u_char *data, size_t datalen, u_int compat)
+ const u_char *sig, size_t siglen, const u_char *data, size_t datalen)
{
char *ktype = NULL;
int hash_alg, ret = SSH_ERR_INTERNAL_ERROR;
@@ -130,13 +174,13 @@ ssh_rsa_verify(const struct sshkey *key,
BN_num_bits(key->rsa->n) < SSH_RSA_MINIMUM_MODULUS_SIZE)
return SSH_ERR_INVALID_ARGUMENT;
- if ((b = sshbuf_from(signature, signaturelen)) == NULL)
+ if ((b = sshbuf_from(sig, siglen)) == NULL)
return SSH_ERR_ALLOC_FAIL;
if (sshbuf_get_cstring(b, &ktype, NULL) != 0) {
ret = SSH_ERR_INVALID_FORMAT;
goto out;
}
- if (strcmp("ssh-rsa", ktype) != 0) {
+ if ((hash_alg = rsa_hash_alg_from_ident(ktype)) == -1) {
ret = SSH_ERR_KEY_TYPE_MISMATCH;
goto out;
}
@@ -165,7 +209,6 @@ ssh_rsa_verify(const struct sshkey *key,
explicit_bzero(sigblob, diff);
len = modlen;
}
- hash_alg = SSH_DIGEST_SHA1;
if ((dlen = ssh_digest_bytes(hash_alg)) == 0) {
ret = SSH_ERR_INTERNAL_ERROR;
goto out;
@@ -181,10 +224,8 @@ ssh_rsa_verify(const struct sshkey *key,
explicit_bzero(sigblob, len);
free(sigblob);
}
- if (ktype != NULL)
- free(ktype);
- if (b != NULL)
- sshbuf_free(b);
+ free(ktype);
+ sshbuf_free(b);
explicit_bzero(digest, sizeof(digest));
return ret;
}
@@ -194,6 +235,7 @@ ssh_rsa_verify(const struct sshkey *key,
* http://www.rsasecurity.com/rsalabs/pkcs/pkcs-1/
* ftp://ftp.rsasecurity.com/pub/pkcs/pkcs-1/pkcs-1v2-1.asn
*/
+
/*
* id-sha1 OBJECT IDENTIFIER ::= { iso(1) identified-organization(3)
* oiw(14) secsig(3) algorithms(2) 26 }
@@ -207,25 +249,71 @@ static const u_char id_sha1[] = {
0x04, 0x14 /* Octet string, length 0x14 (20), followed by sha1 hash */
};
+/*
+ * See http://csrc.nist.gov/groups/ST/crypto_apps_infra/csor/algorithms.html
+ * id-sha256 OBJECT IDENTIFIER ::= { joint-iso-itu-t(2) country(16) us(840)
+ * organization(1) gov(101) csor(3) nistAlgorithm(4) hashAlgs(2)
+ * id-sha256(1) }
+ */
+static const u_char id_sha256[] = {
+ 0x30, 0x31, /* type Sequence, length 0x31 (49) */
+ 0x30, 0x0d, /* type Sequence, length 0x0d (13) */
+ 0x06, 0x09, /* type OID, length 0x09 */
+ 0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x01, /* id-sha256 */
+ 0x05, 0x00, /* NULL */
+ 0x04, 0x20 /* Octet string, length 0x20 (32), followed by sha256 hash */
+};
+
+/*
+ * See http://csrc.nist.gov/groups/ST/crypto_apps_infra/csor/algorithms.html
+ * id-sha512 OBJECT IDENTIFIER ::= { joint-iso-itu-t(2) country(16) us(840)
+ * organization(1) gov(101) csor(3) nistAlgorithm(4) hashAlgs(2)
+ * id-sha256(3) }
+ */
+static const u_char id_sha512[] = {
+ 0x30, 0x51, /* type Sequence, length 0x51 (81) */
+ 0x30, 0x0d, /* type Sequence, length 0x0d (13) */
+ 0x06, 0x09, /* type OID, length 0x09 */
+ 0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x03, /* id-sha512 */
+ 0x05, 0x00, /* NULL */
+ 0x04, 0x40 /* Octet string, length 0x40 (64), followed by sha512 hash */
+};
+
+static int
+rsa_hash_alg_oid(int hash_alg, const u_char **oidp, size_t *oidlenp)
+{
+ switch (hash_alg) {
+ case SSH_DIGEST_SHA1:
+ *oidp = id_sha1;
+ *oidlenp = sizeof(id_sha1);
+ break;
+ case SSH_DIGEST_SHA256:
+ *oidp = id_sha256;
+ *oidlenp = sizeof(id_sha256);
+ break;
+ case SSH_DIGEST_SHA512:
+ *oidp = id_sha512;
+ *oidlenp = sizeof(id_sha512);
+ break;
+ default:
+ return SSH_ERR_INVALID_ARGUMENT;
+ }
+ return 0;
+}
+
static int
openssh_RSA_verify(int hash_alg, u_char *hash, size_t hashlen,
u_char *sigbuf, size_t siglen, RSA *rsa)
{
- size_t ret, rsasize = 0, oidlen = 0, hlen = 0;
- int len, oidmatch, hashmatch;
+ size_t rsasize = 0, oidlen = 0, hlen = 0;
+ int ret, len, oidmatch, hashmatch;
const u_char *oid = NULL;
u_char *decrypted = NULL;
+ if ((ret = rsa_hash_alg_oid(hash_alg, &oid, &oidlen)) != 0)
+ return ret;
ret = SSH_ERR_INTERNAL_ERROR;
- switch (hash_alg) {
- case SSH_DIGEST_SHA1:
- oid = id_sha1;
- oidlen = sizeof(id_sha1);
- hlen = 20;
- break;
- default:
- goto done;
- }
+ hlen = ssh_digest_bytes(hash_alg);
if (hashlen != hlen) {
ret = SSH_ERR_INVALID_ARGUMENT;
goto done;
diff --git a/crypto/external/bsd/openssh/dist/ssh.1 b/crypto/external/bsd/openssh/dist/ssh.1
index d8b466db21f..361fd9b354a 100644
--- a/crypto/external/bsd/openssh/dist/ssh.1
+++ b/crypto/external/bsd/openssh/dist/ssh.1
@@ -1,4 +1,4 @@
-.\" $NetBSD: ssh.1,v 1.16 2015/08/13 10:33:21 christos Exp $
+.\" $NetBSD: ssh.1,v 1.17 2016/03/11 01:55:00 christos Exp $
.\" -*- nroff -*-
.\"
.\" Author: Tatu Ylonen <ylo@cs.hut.fi>
@@ -35,8 +35,8 @@
.\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
.\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
.\"
-.\" $OpenBSD: ssh.1,v 1.361 2015/07/20 18:44:12 millert Exp $
-.Dd July 20 2015
+.\" $OpenBSD: ssh.1,v 1.369 2016/02/17 07:38:19 jmc Exp $
+.Dd February 17 2016
.Dt SSH 1
.Os
.Sh NAME
@@ -60,7 +60,7 @@
.Op Fl O Ar ctl_cmd
.Op Fl o Ar option
.Op Fl p Ar port
-.Op Fl Q Cm cipher | cipher-auth | mac | kex | key | protocol-version
+.Op Fl Q Ar query_option
.Op Fl R Ar address
.Op Fl S Ar ctl_path
.Op Fl W Ar host : Ns Ar port
@@ -72,8 +72,7 @@
.Nm
(SSH client) is a program for logging into a remote machine and for
executing commands on a remote machine.
-It is intended to replace rlogin and rsh,
-and provide secure encrypted communications between
+It is intended to provide secure encrypted communications between
two untrusted hosts over an insecure network.
X11 connections, arbitrary TCP ports and
.Ux Ns -domain
@@ -87,7 +86,7 @@ connects and logs into the specified
name).
The user must prove
his/her identity to the remote machine using one of several methods
-depending on the protocol version used (see below).
+(see below).
.Pp
If
.Ar command
@@ -306,6 +305,9 @@ It is possible to have multiple
.Fl i
options (and multiple identities specified in
configuration files).
+If no certificates have been explicitly specified by the
+.Cm CertificateFile
+directive,
.Nm
will also try to load certificate information from the filename obtained
by appending
@@ -402,17 +404,15 @@ in
for details.
.Pp
.It Fl m Ar mac_spec
-Additionally, for protocol version 2 a comma-separated list of MAC
-(message authentication code) algorithms can
-be specified in order of preference.
+A comma-separated list of MAC (message authentication code) algorithms,
+specified in order of preference.
See the
.Cm MACs
keyword for more information.
.Pp
.It Fl N
Do not execute a remote command.
-This is useful for just forwarding ports
-(protocol version 2 only).
+This is useful for just forwarding ports.
.Pp
.It Fl n
Redirects stdin from
@@ -462,6 +462,7 @@ For full details of the options listed below, and their possible values, see
.Xr ssh_config 5 .
.Pp
.Bl -tag -width Ds -offset indent -compact
+.It AddKeysToAgent
.It AddressFamily
.It BatchMode
.It BindAddress
@@ -470,6 +471,7 @@ For full details of the options listed below, and their possible values, see
.It CanonicalizeHostname
.It CanonicalizeMaxDots
.It CanonicalizePermittedCNAMEs
+.It CertificateFile
.It ChallengeResponseAuthentication
.It CheckHostIP
.It Cipher
@@ -552,7 +554,7 @@ Port to connect to on the remote host.
This can be specified on a
per-host basis in the configuration file.
.Pp
-.It Fl Q Cm cipher | cipher-auth | mac | kex | key | protocol-version
+.It Fl Q Ar query_option
Queries
.Nm
for the algorithms supported for the specified version 2.
@@ -566,7 +568,11 @@ The available features are:
.Ar kex
(key exchange algorithms),
.Ar key
-(key types) and
+(key types),
+.Ar key-cert
+(certificate key types),
+.Ar key-plain
+(non-certificate key types), and
.Ar protocol-version
(supported SSH protocol versions).
.Pp
@@ -658,8 +664,8 @@ for details.
.Pp
.It Fl s
May be used to request invocation of a subsystem on the remote system.
-Subsystems are a feature of the SSH2 protocol which facilitate the use
-of SSH as a secure transport for other applications (eg.\&
+Subsystems facilitate the use of SSH
+as a secure transport for other applications (e.g.\&
.Xr sftp 1 ) .
The subsystem is specified as the remote command.
.Pp
@@ -704,7 +710,6 @@ Implies
.Cm ExitOnForwardFailure
and
.Cm ClearAllForwardings .
-Works with Protocol version 2 only.
.Pp
.It Fl w Xo
.Ar local_tun Ns Op : Ns Ar remote_tun
@@ -789,15 +794,10 @@ or the
and
.Fl 2
options (see above).
-Both protocols support similar authentication methods,
-but protocol 2 is the default since
-it provides additional mechanisms for confidentiality
-(the traffic is encrypted using AES, 3DES, Blowfish, CAST128, or Arcfour)
-and integrity (hmac-md5, hmac-sha1,
-hmac-sha2-256, hmac-sha2-512,
-umac-64, umac-128, hmac-ripemd160).
-Protocol 1 lacks a strong mechanism for ensuring the
-integrity of the connection.
+Protocol 1 should not be used
+and is only offered to support legacy devices.
+It suffers from a number of cryptographic weaknesses
+and doesn't support many of the advanced features available for protocol 2.
.Pp
The methods available for authentication are:
GSSAPI-based authentication,
@@ -806,8 +806,9 @@ public key authentication,
challenge-response authentication,
and password authentication.
Authentication methods are tried in the order specified above,
-though protocol 2 has a configuration option to change the default order:
-.Cm PreferredAuthentications .
+though
+.Cm PreferredAuthentications
+can be used to change the default order.
.Pp
Host-based authentication works as follows:
If the machine the user logs in from is listed in
@@ -851,8 +852,6 @@ The server knows the public key, and only the user knows the private key.
.Nm
implements public key authentication protocol automatically,
using one of the DSA, ECDSA, Ed25519 or RSA algorithms.
-Protocol 1 is restricted to using only RSA keys,
-but protocol 2 may use any.
The HISTORY section of
.Xr ssl 8
contains a brief discussion of the DSA and RSA algorithms.
@@ -874,26 +873,26 @@ This stores the private key in
.Pa ~/.ssh/identity
(protocol 1),
.Pa ~/.ssh/id_dsa
-(protocol 2 DSA),
+(DSA),
.Pa ~/.ssh/id_ecdsa
-(protocol 2 ECDSA),
+(ECDSA),
.Pa ~/.ssh/id_ed25519
-(protocol 2 Ed25519),
+(Ed25519),
or
.Pa ~/.ssh/id_rsa
-(protocol 2 RSA)
+(RSA)
and stores the public key in
.Pa ~/.ssh/identity.pub
(protocol 1),
.Pa ~/.ssh/id_dsa.pub
-(protocol 2 DSA),
+(DSA),
.Pa ~/.ssh/id_ecdsa.pub
-(protocol 2 ECDSA),
+(ECDSA),
.Pa ~/.ssh/id_ed25519.pub
-(protocol 2 Ed25519),
+(Ed25519),
or
.Pa ~/.ssh/id_rsa.pub
-(protocol 2 RSA)
+(RSA)
in the user's home directory.
The user should then copy the public key
to
@@ -921,14 +920,16 @@ The most convenient way to use public key or certificate authentication
may be with an authentication agent.
See
.Xr ssh-agent 1
+and (optionally) the
+.Cm AddKeysToAgent
+directive in
+.Xr ssh_config 5
for more information.
.Pp
Challenge-response authentication works as follows:
The server sends an arbitrary
.Qq challenge
text, and prompts for a response.
-Protocol 2 allows multiple challenges and responses;
-protocol 1 is restricted to just one challenge/response.
Examples of challenge-response authentication include
.Bx
Authentication (see
@@ -1027,7 +1028,7 @@ at logout when waiting for forwarded connection / X11 sessions to terminate.
Display a list of escape characters.
.It Cm ~B
Send a BREAK to the remote system
-(only useful for SSH protocol version 2 and if the peer supports it).
+(only useful if the peer supports it).
.It Cm ~C
Open command line.
Currently this allows the addition of port forwardings using the
@@ -1060,7 +1061,7 @@ Basic help is available, using the
option.
.It Cm ~R
Request rekeying of the connection
-(only useful for SSH protocol version 2 and if the peer supports it).
+(only useful if the peer supports it).
.It Cm ~V
Decrease the verbosity
.Pq Ic LogLevel
@@ -1528,20 +1529,6 @@ The file format and configuration options are described in
.It Pa /etc/ssh/ssh_host_rsa_key
These files contain the private parts of the host keys
and are used for host-based authentication.
-If protocol version 1 is used,
-.Nm
-must be setuid root, since the host key is readable only by root.
-For protocol version 2,
-.Nm
-uses
-.Xr ssh-keysign 8
-to access the host keys,
-eliminating the requirement that
-.Nm
-be setuid root when host-based authentication is used.
-By default
-.Nm
-is not setuid root.
.Pp
.It Pa /etc/ssh/ssh_known_hosts
Systemwide list of known host keys.
diff --git a/crypto/external/bsd/openssh/dist/ssh.c b/crypto/external/bsd/openssh/dist/ssh.c
index e01d1c5a605..a8cb7e68c16 100644
--- a/crypto/external/bsd/openssh/dist/ssh.c
+++ b/crypto/external/bsd/openssh/dist/ssh.c
@@ -1,5 +1,6 @@
-/* $NetBSD: ssh.c,v 1.21 2016/01/19 17:10:55 christos Exp $ */
-/* $OpenBSD: ssh.c,v 1.420 2015/07/30 00:01:34 djm Exp $ */
+/* $NetBSD: ssh.c,v 1.22 2016/03/11 01:55:00 christos Exp $ */
+/* $OpenBSD: ssh.c,v 1.436 2016/02/15 09:47:49 dtucker Exp $ */
+
/*
* Author: Tatu Ylonen <ylo@cs.hut.fi>
* Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
@@ -42,7 +43,7 @@
*/
#include "includes.h"
-__RCSID("$NetBSD: ssh.c,v 1.21 2016/01/19 17:10:55 christos Exp $");
+__RCSID("$NetBSD: ssh.c,v 1.22 2016/03/11 01:55:00 christos Exp $");
#include <sys/types.h>
#include <sys/param.h>
#include <sys/ioctl.h>
@@ -193,11 +194,9 @@ usage(void)
fprintf(stderr,
"usage: ssh [-1246AaCfGgKkMNnqsTtVvXxYy] [-b bind_address] [-c cipher_spec]\n"
" [-D [bind_address:]port] [-E log_file] [-e escape_char]\n"
-" [-F configfile] [-I pkcs11] [-i identity_file]\n"
-" [-L address] [-l login_name] [-m mac_spec]\n"
-" [-O ctl_cmd] [-o option] [-p port]\n"
-" [-Q cipher | cipher-auth | mac | kex | key]\n"
-" [-R address] [-S ctl_path] [-W host:port]\n"
+" [-F configfile] [-I pkcs11] [-i identity_file] [-L address]\n"
+" [-l login_name] [-m mac_spec] [-O ctl_cmd] [-o option] [-p port]\n"
+" [-Q query_option] [-R address] [-S ctl_path] [-W host:port]\n"
" [-w local_tun[:remote_tun]] [user@]hostname [command]\n"
);
exit(255);
@@ -242,7 +241,7 @@ resolve_host(const char *name, int port, int logerr, char *cname, size_t clen)
if (port <= 0)
port = default_ssh_port();
- snprintf(strport, sizeof strport, "%u", port);
+ snprintf(strport, sizeof strport, "%d", port);
memset(&hints, 0, sizeof(hints));
hints.ai_family = options.address_family == -1 ?
AF_UNSPEC : options.address_family;
@@ -396,6 +395,17 @@ resolve_canonicalize(char **hostp, int port)
return addrs;
}
+ /* If domain name is anchored, then resolve it now */
+ if ((*hostp)[strlen(*hostp) - 1] == '.') {
+ debug3("%s: name is fully qualified", __func__);
+ fullhost = xstrdup(*hostp);
+ if ((addrs = resolve_host(fullhost, port, 0,
+ newname, sizeof(newname))) != NULL)
+ goto found;
+ free(fullhost);
+ goto notfound;
+ }
+
/* Don't apply canonicalization to sufficiently-qualified hostnames */
ndots = 0;
for (cp = *hostp; *cp != '\0'; cp++) {
@@ -419,6 +429,7 @@ resolve_canonicalize(char **hostp, int port)
free(fullhost);
continue;
}
+ found:
/* Remove trailing '.' */
fullhost[strlen(fullhost) - 1] = '\0';
/* Follow CNAME if requested */
@@ -430,6 +441,7 @@ resolve_canonicalize(char **hostp, int port)
*hostp = fullhost;
return addrs;
}
+ notfound:
if (!options.canonicalize_fallback_local)
fatal("%s: Could not resolve host \"%s\"", __progname, *hostp);
debug2("%s: host %s not found in any suffix", __func__, *hostp);
@@ -496,7 +508,7 @@ main(int ac, char **av)
int i, r, opt, exit_status, use_syslog, config_test = 0;
char *p, *cp, *line, *argv0, buf[PATH_MAX], *host_arg, *logfile;
char thishost[NI_MAXHOST], shorthost[NI_MAXHOST], portstr[NI_MAXSERV];
- char cname[NI_MAXHOST];
+ char cname[NI_MAXHOST], uidstr[32], *conn_hash_hex;
struct stat st;
struct passwd *pw;
int timeout_ms;
@@ -506,8 +518,8 @@ main(int ac, char **av)
struct addrinfo *addrs = NULL;
struct ssh_digest_ctx *md;
u_char conn_hash[SSH_DIGEST_MAX_LENGTH];
- char *conn_hash_hex;
+ ssh_malloc_init(); /* must be called before any mallocs */
/* Ensure that fds 0, 1 and 2 are open or directed to /dev/null */
sanitise_stdfd();
@@ -603,7 +615,7 @@ main(int ac, char **av)
use_syslog = 1;
break;
case 'E':
- logfile = xstrdup(optarg);
+ logfile = optarg;
break;
case 'G':
config_test = 1;
@@ -680,16 +692,18 @@ main(int ac, char **av)
options.gss_deleg_creds = 1;
break;
case 'i':
- if (stat(optarg, &st) < 0) {
+ p = tilde_expand_filename(optarg, original_real_uid);
+ if (stat(p, &st) < 0)
fprintf(stderr, "Warning: Identity file %s "
- "not accessible: %s.\n", optarg,
+ "not accessible: %s.\n", p,
strerror(errno));
- break;
- }
- add_identity_file(&options, NULL, optarg, 1);
+ else
+ add_identity_file(&options, NULL, p, 1);
+ free(p);
break;
case 'I':
#ifdef ENABLE_PKCS11
+ free(options.pkcs11_provider);
options.pkcs11_provider = xstrdup(optarg);
#else
fprintf(stderr, "no support for PKCS#11.\n");
@@ -774,6 +788,7 @@ main(int ac, char **av)
if (ciphers_valid(*optarg == '+' ?
optarg + 1 : optarg)) {
/* SSH2 only */
+ free(options.ciphers);
options.ciphers = xstrdup(optarg);
options.cipher = SSH_CIPHER_INVALID;
break;
@@ -793,9 +808,10 @@ main(int ac, char **av)
options.ciphers = xstrdup(KEX_CLIENT_ENCRYPT);
break;
case 'm':
- if (mac_valid(optarg))
+ if (mac_valid(optarg)) {
+ free(options.macs);
options.macs = xstrdup(optarg);
- else {
+ } else {
fprintf(stderr, "Unknown mac type '%s'\n",
optarg);
exit(255);
@@ -877,8 +893,7 @@ main(int ac, char **av)
subsystem_flag = 1;
break;
case 'S':
- if (options.control_path != NULL)
- free(options.control_path);
+ free(options.control_path);
options.control_path = xstrdup(optarg);
break;
case 'b':
@@ -960,10 +975,8 @@ main(int ac, char **av)
*/
if (use_syslog && logfile != NULL)
fatal("Can't specify both -y and -E");
- if (logfile != NULL) {
+ if (logfile != NULL)
log_redirect_stderr_to(logfile);
- free(logfile);
- }
log_init(argv0,
options.log_level == -1 ? SYSLOG_LEVEL_INFO : options.log_level,
SYSLOG_FACILITY_USER, !use_syslog);
@@ -1064,6 +1077,9 @@ main(int ac, char **av)
"disabling");
options.update_hostkeys = 0;
}
+ if (options.connection_attempts <= 0)
+ fatal("Invalid number of ConnectionAttempts");
+
if (original_effective_uid != 0)
options.use_privileged_port = 0;
@@ -1098,6 +1114,7 @@ main(int ac, char **av)
strlcpy(shorthost, thishost, sizeof(shorthost));
shorthost[strcspn(thishost, ".")] = '\0';
snprintf(portstr, sizeof(portstr), "%d", options.port);
+ snprintf(uidstr, sizeof(uidstr), "%d", pw->pw_uid);
if ((md = ssh_digest_start(SSH_DIGEST_SHA1)) == NULL ||
ssh_digest_update(md, thishost, strlen(thishost)) < 0 ||
@@ -1140,6 +1157,7 @@ main(int ac, char **av)
"p", portstr,
"r", options.user,
"u", pw->pw_name,
+ "i", uidstr,
(char *)NULL);
free(cp);
}
@@ -1160,6 +1178,7 @@ main(int ac, char **av)
* have yet resolved the hostname. Do so now.
*/
if (addrs == NULL && options.proxy_command == NULL) {
+ debug2("resolving \"%s\" port %d", host, options.port);
if ((addrs = resolve_host(host, options.port, 1,
cname, sizeof(cname))) == NULL)
cleanup_exit(255); /* resolve_host logs the error */
@@ -1201,8 +1220,10 @@ main(int ac, char **av)
sizeof(Key));
PRIV_START;
+#if WITH_SSH1
sensitive_data.keys[0] = key_load_private_type(KEY_RSA1,
_PATH_HOST_KEY_FILE, "", NULL, NULL);
+#endif
sensitive_data.keys[1] = key_load_private_cert(KEY_ECDSA,
_PATH_HOST_ECDSA_KEY_FILE, "", NULL);
sensitive_data.keys[2] = key_load_private_cert(KEY_ED25519,
@@ -1313,6 +1334,10 @@ main(int ac, char **av)
options.identity_keys[i] = NULL;
}
}
+ for (i = 0; i < options.num_certificate_files; i++) {
+ free(options.certificate_files[i]);
+ options.certificate_files[i] = NULL;
+ }
exit_status = compat20 ? ssh_session2() : ssh_session();
packet_close();
@@ -1964,25 +1989,30 @@ ssh_session2(void)
options.escape_char : SSH_ESCAPECHAR_NONE, id);
}
+/* Loads all IdentityFile and CertificateFile keys */
static void
load_public_identity_files(void)
{
char *filename, *cp, thishost[NI_MAXHOST];
char *pwdir = NULL, *pwname = NULL;
- int i = 0;
Key *public;
struct passwd *pw;
- u_int n_ids;
+ int i;
+ u_int n_ids, n_certs;
char *identity_files[SSH_MAX_IDENTITY_FILES];
Key *identity_keys[SSH_MAX_IDENTITY_FILES];
+ char *certificate_files[SSH_MAX_CERTIFICATE_FILES];
+ struct sshkey *certificates[SSH_MAX_CERTIFICATE_FILES];
#ifdef ENABLE_PKCS11
Key **keys;
int nkeys;
#endif /* PKCS11 */
- n_ids = 0;
+ n_ids = n_certs = 0;
memset(identity_files, 0, sizeof(identity_files));
memset(identity_keys, 0, sizeof(identity_keys));
+ memset(certificate_files, 0, sizeof(certificate_files));
+ memset(certificates, 0, sizeof(certificates));
#ifdef ENABLE_PKCS11
if (options.pkcs11_provider != NULL &&
@@ -2014,6 +2044,7 @@ load_public_identity_files(void)
if (n_ids >= SSH_MAX_IDENTITY_FILES ||
strcasecmp(options.identity_files[i], "none") == 0) {
free(options.identity_files[i]);
+ options.identity_files[i] = NULL;
continue;
}
cp = tilde_expand_filename(options.identity_files[i],
@@ -2032,7 +2063,12 @@ load_public_identity_files(void)
if (++n_ids >= SSH_MAX_IDENTITY_FILES)
continue;
- /* Try to add the certificate variant too */
+ /*
+ * If no certificates have been explicitly listed then try
+ * to add the default certificate variant too.
+ */
+ if (options.num_certificate_files != 0)
+ continue;
xasprintf(&cp, "%s-cert", filename);
public = key_load_public(cp, NULL);
debug("identity file %s type %d", cp,
@@ -2049,14 +2085,50 @@ load_public_identity_files(void)
continue;
}
identity_keys[n_ids] = public;
- /* point to the original path, most likely the private key */
- identity_files[n_ids] = xstrdup(filename);
+ identity_files[n_ids] = cp;
n_ids++;
}
+
+ if (options.num_certificate_files > SSH_MAX_CERTIFICATE_FILES)
+ fatal("%s: too many certificates", __func__);
+ for (i = 0; i < options.num_certificate_files; i++) {
+ cp = tilde_expand_filename(options.certificate_files[i],
+ original_real_uid);
+ filename = percent_expand(cp, "d", pwdir,
+ "u", pwname, "l", thishost, "h", host,
+ "r", options.user, (char *)NULL);
+ free(cp);
+
+ public = key_load_public(filename, NULL);
+ debug("certificate file %s type %d", filename,
+ public ? public->type : -1);
+ free(options.certificate_files[i]);
+ options.certificate_files[i] = NULL;
+ if (public == NULL) {
+ free(filename);
+ continue;
+ }
+ if (!key_is_cert(public)) {
+ debug("%s: key %s type %s is not a certificate",
+ __func__, filename, key_type(public));
+ key_free(public);
+ free(filename);
+ continue;
+ }
+ certificate_files[n_certs] = filename;
+ certificates[n_certs] = public;
+ ++n_certs;
+ }
+
options.num_identity_files = n_ids;
memcpy(options.identity_files, identity_files, sizeof(identity_files));
memcpy(options.identity_keys, identity_keys, sizeof(identity_keys));
+ options.num_certificate_files = n_certs;
+ memcpy(options.certificate_files,
+ certificate_files, sizeof(certificate_files));
+ memcpy(options.certificates, certificates, sizeof(certificates));
+
explicit_bzero(pwname, strlen(pwname));
free(pwname);
explicit_bzero(pwdir, strlen(pwdir));
diff --git a/crypto/external/bsd/openssh/dist/ssh.h b/crypto/external/bsd/openssh/dist/ssh.h
index c8bffcc0465..1552e62f976 100644
--- a/crypto/external/bsd/openssh/dist/ssh.h
+++ b/crypto/external/bsd/openssh/dist/ssh.h
@@ -1,5 +1,5 @@
-/* $NetBSD: ssh.h,v 1.6 2015/08/13 10:33:21 christos Exp $ */
-/* $OpenBSD: ssh.h,v 1.81 2015/08/04 05:23:06 djm Exp $ */
+/* $NetBSD: ssh.h,v 1.7 2016/03/11 01:55:00 christos Exp $ */
+/* $OpenBSD: ssh.h,v 1.83 2015/12/11 03:19:09 djm Exp $ */
/*
* Author: Tatu Ylonen <ylo@cs.hut.fi>
@@ -20,6 +20,12 @@
#define SSH_DEFAULT_PORT 22
/*
+ * Maximum number of certificate files that can be specified
+ * in configuration files or on the command line.
+ */
+#define SSH_MAX_CERTIFICATE_FILES 100
+
+/*
* Maximum number of RSA authentication identity files that can be specified
* in configuration files or on the command line.
*/
@@ -30,7 +36,7 @@
* Current value permits 16kbit RSA and RSA1 keys and 8kbit DSA keys, with
* some room for options and comments.
*/
-#define SSH_MAX_PUBKEY_BYTES 8192
+#define SSH_MAX_PUBKEY_BYTES 16384
/*
* Major protocol version. Different version indicates major incompatibility
diff --git a/crypto/external/bsd/openssh/dist/ssh2.h b/crypto/external/bsd/openssh/dist/ssh2.h
index 407e550d4ea..769d73f6608 100644
--- a/crypto/external/bsd/openssh/dist/ssh2.h
+++ b/crypto/external/bsd/openssh/dist/ssh2.h
@@ -1,5 +1,5 @@
-/* $NetBSD: ssh2.h,v 1.7 2016/01/14 22:30:04 christos Exp $ */
-/* $OpenBSD: ssh2.h,v 1.15 2014/01/29 06:18:35 djm Exp $ */
+/* $NetBSD: ssh2.h,v 1.8 2016/03/11 01:55:00 christos Exp $ */
+/* $OpenBSD: ssh2.h,v 1.17 2016/01/14 16:17:40 markus Exp $ */
/*
* Copyright (c) 2000 Markus Friedl. All rights reserved.
@@ -81,6 +81,7 @@
#define SSH2_MSG_DEBUG 4
#define SSH2_MSG_SERVICE_REQUEST 5
#define SSH2_MSG_SERVICE_ACCEPT 6
+#define SSH2_MSG_EXT_INFO 7
/* transport layer: alg negotiation */
diff --git a/crypto/external/bsd/openssh/dist/ssh_api.c b/crypto/external/bsd/openssh/dist/ssh_api.c
index 66a9cc7da9c..130b8416eb8 100644
--- a/crypto/external/bsd/openssh/dist/ssh_api.c
+++ b/crypto/external/bsd/openssh/dist/ssh_api.c
@@ -1,5 +1,6 @@
-/* $NetBSD: ssh_api.c,v 1.2 2015/04/03 23:58:19 christos Exp $ */
-/* $OpenBSD: ssh_api.c,v 1.4 2015/02/16 22:13:32 djm Exp $ */
+/* $NetBSD: ssh_api.c,v 1.3 2016/03/11 01:55:00 christos Exp $ */
+/* $OpenBSD: ssh_api.c,v 1.5 2015/12/04 16:41:28 markus Exp $ */
+
/*
* Copyright (c) 2012 Markus Friedl. All rights reserved.
*
@@ -17,7 +18,7 @@
*/
#include "includes.h"
-__RCSID("$NetBSD: ssh_api.c,v 1.2 2015/04/03 23:58:19 christos Exp $");
+__RCSID("$NetBSD: ssh_api.c,v 1.3 2016/03/11 01:55:00 christos Exp $");
#include "ssh1.h" /* For SSH_MSG_NONE */
#include "ssh_api.h"
@@ -42,8 +43,8 @@ int _ssh_order_hostkeyalgs(struct ssh *);
int _ssh_verify_host_key(struct sshkey *, struct ssh *);
struct sshkey *_ssh_host_public_key(int, int, struct ssh *);
struct sshkey *_ssh_host_private_key(int, int, struct ssh *);
-int _ssh_host_key_sign(struct sshkey *, struct sshkey *, u_char **,
- size_t *, const u_char *, size_t, u_int);
+int _ssh_host_key_sign(struct sshkey *, struct sshkey *,
+ u_char **, size_t *, const u_char *, size_t, const char *, u_int);
/*
* stubs for the server side implementation of kex.
@@ -51,7 +52,7 @@ int _ssh_host_key_sign(struct sshkey *, struct sshkey *, u_char **,
*/
int use_privsep = 0;
int mm_sshkey_sign(struct sshkey *, u_char **, u_int *,
- u_char *, u_int, u_int);
+ u_char *, u_int, char *, u_int);
DH *mm_choose_dh(int, int, int);
/* Define these two variables here so that they are part of the library */
@@ -60,7 +61,7 @@ u_int session_id2_len = 0;
int
mm_sshkey_sign(struct sshkey *key, u_char **sigp, u_int *lenp,
- u_char *data, u_int datalen, u_int compat)
+ u_char *data, u_int datalen, char *alg, u_int compat)
{
return (-1);
}
@@ -526,8 +527,8 @@ _ssh_order_hostkeyalgs(struct ssh *ssh)
int
_ssh_host_key_sign(struct sshkey *privkey, struct sshkey *pubkey,
- u_char **signature, size_t *slen,
- const u_char *data, size_t dlen, u_int compat)
+ u_char **signature, size_t *slen, const u_char *data, size_t dlen,
+ const char *alg, u_int compat)
{
- return sshkey_sign(privkey, signature, slen, data, dlen, compat);
+ return sshkey_sign(privkey, signature, slen, data, dlen, alg, compat);
}
diff --git a/crypto/external/bsd/openssh/dist/ssh_config b/crypto/external/bsd/openssh/dist/ssh_config
index 18a2f5e0ca9..e314ba66086 100644
--- a/crypto/external/bsd/openssh/dist/ssh_config
+++ b/crypto/external/bsd/openssh/dist/ssh_config
@@ -1,5 +1,5 @@
-# $NetBSD: ssh_config,v 1.8 2015/04/03 23:58:19 christos Exp $
-# $OpenBSD: ssh_config,v 1.28 2013/09/16 11:35:43 sthen Exp $
+# $NetBSD: ssh_config,v 1.9 2016/03/11 01:55:00 christos Exp $
+# $OpenBSD: ssh_config,v 1.30 2016/02/20 23:06:23 sobrado Exp $
# This is the ssh client system-wide configuration file. See
# ssh_config(5) for more information. This file provides defaults for
@@ -33,8 +33,10 @@
# IdentityFile ~/.ssh/identity
# IdentityFile ~/.ssh/id_rsa
# IdentityFile ~/.ssh/id_dsa
+# IdentityFile ~/.ssh/id_ecdsa
+# IdentityFile ~/.ssh/id_ed25519
# Port 22
-# Protocol 2,1
+# Protocol 2
# Cipher 3des
# Ciphers aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-cbc,3des-cbc
# MACs hmac-md5,hmac-sha1,hmac-ripemd160
diff --git a/crypto/external/bsd/openssh/dist/ssh_config.5 b/crypto/external/bsd/openssh/dist/ssh_config.5
index 9d59f5d605c..503b5128a48 100644
--- a/crypto/external/bsd/openssh/dist/ssh_config.5
+++ b/crypto/external/bsd/openssh/dist/ssh_config.5
@@ -1,4 +1,4 @@
-.\" $NetBSD: ssh_config.5,v 1.16 2015/08/21 08:20:59 christos Exp $
+.\" $NetBSD: ssh_config.5,v 1.17 2016/03/11 01:55:00 christos Exp $
.\" -*- nroff -*-
.\"
.\" Author: Tatu Ylonen <ylo@cs.hut.fi>
@@ -35,8 +35,8 @@
.\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
.\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
.\"
-.\" $OpenBSD: ssh_config.5,v 1.215 2015/08/14 15:32:41 jmc Exp $
-.Dd August 14 2015
+.\" $OpenBSD: ssh_config.5,v 1.228 2016/02/20 23:01:46 sobrado Exp $
+.Dd Februar 20 2016
.Dt SSH_CONFIG 5
.Os
.Sh NAME
@@ -141,7 +141,7 @@ or
keyword) to be used only when the conditions following the
.Cm Match
keyword are satisfied.
-Match conditions are specified using one or more critera
+Match conditions are specified using one or more criteria
or the single token
.Cm all
which always matches.
@@ -223,6 +223,39 @@ keyword matches against the name of the local user running
(this keyword may be useful in system-wide
.Nm
files).
+.It Cm AddKeysToAgent
+Specifies whether keys should be automatically added to a running
+.Xr ssh-agent 1 .
+If this option is set to
+.Dq yes
+and a key is loaded from a file, the key and its passphrase are added to
+the agent with the default lifetime, as if by
+.Xr ssh-add 1 .
+If this option is set to
+.Dq ask ,
+.Nm ssh
+will require confirmation using the
+.Ev SSH_ASKPASS
+program before adding a key (see
+.Xr ssh-add 1
+for details).
+If this option is set to
+.Dq confirm ,
+each use of the key must be confirmed, as if the
+.Fl c
+option was specified to
+.Xr ssh-add 1 .
+If this option is set to
+.Dq no ,
+no keys are added to the agent.
+The argument must be
+.Dq yes ,
+.Dq confirm ,
+.Dq ask ,
+or
+.Dq no .
+The default is
+.Dq no .
.It Cm AddressFamily
Specifies which address family to use when connecting.
Valid arguments are
@@ -231,6 +264,8 @@ Valid arguments are
(use IPv4 only), or
.Dq inet6
(use IPv6 only).
+The default is
+.Dq any .
.It Cm BatchMode
If set to
.Dq yes ,
@@ -327,6 +362,41 @@ to be canonicalized to names in the
or
.Dq *.c.example.com
domains.
+.It Cm CertificateFile
+Specifies a file from which the user's certificate is read.
+A corresponding private key must be provided separately in order
+to use this certificate either
+from an
+.Cm IdentityFile
+directive or
+.Fl i
+flag to
+.Xr ssh 1 ,
+via
+.Xr ssh-agent 1 ,
+or via a
+.Cm PKCS11Provider .
+.Pp
+The file name may use the tilde
+syntax to refer to a user's home directory or one of the following
+escape characters:
+.Ql %d
+(local user's home directory),
+.Ql %u
+(local user name),
+.Ql %l
+(local host name),
+.Ql %h
+(remote host name) or
+.Ql %r
+(remote user name).
+.Pp
+It is possible to have multiple certificate files specified in
+configuration files; these certificates will be tried in sequence.
+Multiple
+.Cm CertificateFile
+directives will add to the list of certificates used for
+authentication.
.It Cm ChallengeResponseAuthentication
Specifies whether to use challenge-response authentication.
The argument to this keyword must be
@@ -420,9 +490,7 @@ The default is:
chacha20-poly1305@openssh.com,
aes128-ctr,aes192-ctr,aes256-ctr,
aes128-gcm@openssh.com,aes256-gcm@openssh.com,
-arcfour256,arcfour128,
-aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,
-aes192-cbc,aes256-cbc,arcfour
+aes128-cbc,aes192-cbc,aes256-cbc,3des-cbc
.Ed
.Pp
The list of available ciphers may also be obtained using the
@@ -540,8 +608,11 @@ the destination port,
.Ql %r
by the remote login username,
.Ql %u
-by the username of the user running
-.Xr ssh 1 , and
+by the username and
+.Ql %i
+by the numeric user ID (uid) of the user running
+.Xr ssh 1 ,
+and
.Ql \&%C
by a hash of the concatenation: %l%h%p%r.
It is recommended that any
@@ -641,7 +712,14 @@ data).
Specifies whether
.Xr ssh 1
should terminate the connection if it cannot set up all requested
-dynamic, tunnel, local, and remote port forwardings.
+dynamic, tunnel, local, and remote port forwardings, (e.g.\&
+if either end is unable to bind and listen on a specified port).
+Note that
+.Cm ExitOnForwardFailure
+does not apply to connections made over port forwardings and will not,
+for example, cause
+.Xr ssh 1
+to exit if TCP connections to the ultimate forwarding destination fail.
The argument must be
.Dq yes
or
@@ -750,12 +828,10 @@ The default is
Specifies whether user authentication based on GSSAPI is allowed.
The default is
.Dq no .
-Note that this option applies to protocol version 2 only.
.It Cm GSSAPIDelegateCredentials
Forward (delegate) credentials to the server.
The default is
.Dq no .
-Note that this option applies to protocol version 2 only.
.It Cm HashKnownHosts
Indicates that
.Xr ssh 1
@@ -782,9 +858,6 @@ or
.Dq no .
The default is
.Dq no .
-This option applies to protocol version 2 only and
-is similar to
-.Cm RhostsRSAAuthentication .
.It Cm HostbasedKeyTypes
Specifies the key types that will be used for hostbased authentication
as a comma-separated pattern list.
@@ -809,7 +882,7 @@ option of
.Xr ssh 1
may be used to list supported key types.
.It Cm HostKeyAlgorithms
-Specifies the protocol version 2 host key algorithms
+Specifies the host key algorithms
that the client wants to use in order of preference.
Alternately if the specified value begins with a
.Sq +
@@ -861,9 +934,13 @@ specifications).
.It Cm IdentitiesOnly
Specifies that
.Xr ssh 1
-should only use the authentication identity files configured in the
+should only use the authentication identity and certificate files explicitly
+configured in the
.Nm
-files,
+files
+or passed on the
+.Xr ssh 1
+command-line,
even if
.Xr ssh-agent 1
or a
@@ -893,6 +970,8 @@ Additionally, any identities represented by the authentication agent
will be used for authentication unless
.Cm IdentitiesOnly
is set.
+If no certificates have been explicitly specified by
+.Cm CertificateFile ,
.Xr ssh 1
will try to load certificate information from the filename obtained by
appending
@@ -926,6 +1005,11 @@ differs from that of other configuration directives).
may be used in conjunction with
.Cm IdentitiesOnly
to select which identities in an agent are offered during authentication.
+.Cm IdentityFile
+may also be used in conjunction with
+.Cm CertificateFile
+in order to provide any certificate also needed for authentication with
+the identity.
.It Cm IgnoreUnknown
Specifies a pattern-list of unknown options to be ignored if they are
encountered in configuration parsing.
@@ -1085,8 +1169,7 @@ DEBUG2 and DEBUG3 each specify higher levels of verbose output.
.It Cm MACs
Specifies the MAC (message authentication code) algorithms
in order of preference.
-The MAC algorithm is used in protocol version 2
-for data integrity protection.
+The MAC algorithm is used for data integrity protection.
Multiple algorithms must be comma-separated.
If the specified value begins with a
.Sq +
@@ -1102,13 +1185,9 @@ The default is:
.Bd -literal -offset indent
umac-64-etm@openssh.com,umac-128-etm@openssh.com,
hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,
+hmac-sha1-etm@openssh.com,
umac-64@openssh.com,umac-128@openssh.com,
-hmac-sha2-256,hmac-sha2-512,
-hmac-md5-etm@openssh.com,hmac-sha1-etm@openssh.com,
-hmac-ripemd160-etm@openssh.com,
-hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,
-hmac-md5,hmac-sha1,hmac-ripemd160,
-hmac-sha1-96,hmac-md5-96
+hmac-sha2-256,hmac-sha2-512,hmac-sha1
.Ed
.Pp
The list of available MAC algorithms may also be obtained using the
@@ -1162,8 +1241,7 @@ private RSA key.
Specifies the port number to connect on the remote host.
The default is 22.
.It Cm PreferredAuthentications
-Specifies the order in which the client should try protocol 2
-authentication methods.
+Specifies the order in which the client should try authentication methods.
This allows a client to prefer one method (e.g.\&
.Cm keyboard-interactive )
over another method (e.g.\&
@@ -1189,6 +1267,9 @@ will try version 2 and fall back to version 1
if version 2 is not available.
The default is
.Sq 2 .
+Protocol 1 suffers from a number of cryptographic weaknesses and should
+not be used.
+It is only offered to support legacy devices.
.It Cm ProxyCommand
Specifies the command to use to connect to the server.
The command
@@ -1269,7 +1350,6 @@ or
.Dq no .
The default is
.Dq yes .
-This option applies to protocol version 2 only.
.It Cm RekeyLimit
Specifies the maximum amount of data that may be transmitted before the
session key is renegotiated, optionally followed a maximum amount of
@@ -1295,7 +1375,6 @@ is
.Dq default none ,
which means that rekeying is performed after the cipher's default amount
of data has been sent or received and no time based rekeying is done.
-This option applies to protocol version 2 only.
.It Cm RemoteForward
Specifies that a TCP port on the remote machine be forwarded over
the secure channel to the specified host and port from the local machine.
@@ -1388,7 +1467,6 @@ Note that this option applies to protocol version 1 only.
Specifies what variables from the local
.Xr environ 7
should be sent to the server.
-Note that environment passing is only supported for protocol 2.
The server must also support it, and the server must be configured to
accept these environment variables.
Note that the
@@ -1436,7 +1514,6 @@ If, for example,
.Cm ServerAliveCountMax
is left at the default, if the server becomes unresponsive,
ssh will disconnect after approximately 45 seconds.
-This option applies to protocol version 2 only.
.It Cm ServerAliveInterval
Sets a timeout interval in seconds after which if no data has been received
from the server,
@@ -1445,7 +1522,6 @@ will send a message through the encrypted
channel to request a response from the server.
The default
is 0, indicating that these messages will not be sent to the server.
-This option applies to protocol version 2 only.
.It Cm StreamLocalBindMask
Sets the octal file creation mode mask
.Pq umask
@@ -1577,7 +1653,7 @@ Enabling this option allows learning alternate hostkeys for a server
and supports graceful key rotation by allowing a server to send replacement
public keys before old ones are removed.
Additional hostkeys are only accepted if the key used to authenticate the
-host was already trusted or explicity accepted by the user.
+host was already trusted or explicitly accepted by the user.
If
.Cm UpdateHostKeys
is set to
@@ -1642,7 +1718,6 @@ or
.Dq ask .
The default is
.Dq no .
-Note that this option applies to protocol version 2 only.
.Pp
See also VERIFYING HOST KEYS in
.Xr ssh 1 .
diff --git a/crypto/external/bsd/openssh/dist/sshbuf-getput-basic.c b/crypto/external/bsd/openssh/dist/sshbuf-getput-basic.c
index e78964a8a9a..f4eb2803251 100644
--- a/crypto/external/bsd/openssh/dist/sshbuf-getput-basic.c
+++ b/crypto/external/bsd/openssh/dist/sshbuf-getput-basic.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: sshbuf-getput-basic.c,v 1.4 2015/01/14 15:02:39 djm Exp $ */
+/* $OpenBSD: sshbuf-getput-basic.c,v 1.5 2015/10/20 23:24:25 mmcc Exp $ */
/*
* Copyright (c) 2011 Damien Miller
*
@@ -15,7 +15,7 @@
* OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
*/
#include "includes.h"
-__RCSID("$NetBSD: sshbuf-getput-basic.c,v 1.3 2015/04/03 23:58:19 christos Exp $");
+__RCSID("$NetBSD: sshbuf-getput-basic.c,v 1.4 2016/03/11 01:55:00 christos Exp $");
#include <sys/types.h>
#include <stdlib.h>
@@ -131,7 +131,7 @@ sshbuf_get_string_direct(struct sshbuf *buf, const u_char **valp, size_t *lenp)
*lenp = 0;
if ((r = sshbuf_peek_string_direct(buf, &p, &len)) < 0)
return r;
- if (valp != 0)
+ if (valp != NULL)
*valp = p;
if (lenp != NULL)
*lenp = len;
@@ -168,7 +168,7 @@ sshbuf_peek_string_direct(const struct sshbuf *buf, const u_char **valp,
SSHBUF_DBG(("SSH_ERR_MESSAGE_INCOMPLETE"));
return SSH_ERR_MESSAGE_INCOMPLETE;
}
- if (valp != 0)
+ if (valp != NULL)
*valp = p + 4;
if (lenp != NULL)
*lenp = len;
@@ -448,7 +448,7 @@ sshbuf_get_bignum2_bytes_direct(struct sshbuf *buf,
d++;
len--;
}
- if (valp != 0)
+ if (valp != NULL)
*valp = d;
if (lenp != NULL)
*lenp = len;
diff --git a/crypto/external/bsd/openssh/dist/sshbuf-getput-crypto.c b/crypto/external/bsd/openssh/dist/sshbuf-getput-crypto.c
index 9756d4868b2..7c20d49b0c2 100644
--- a/crypto/external/bsd/openssh/dist/sshbuf-getput-crypto.c
+++ b/crypto/external/bsd/openssh/dist/sshbuf-getput-crypto.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: sshbuf-getput-crypto.c,v 1.4 2015/01/14 15:02:39 djm Exp $ */
+/* $OpenBSD: sshbuf-getput-crypto.c,v 1.5 2016/01/12 23:42:54 djm Exp $ */
/*
* Copyright (c) 2011 Damien Miller
*
@@ -15,7 +15,7 @@
* OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
*/
#include "includes.h"
-__RCSID("$NetBSD: sshbuf-getput-crypto.c,v 1.4 2016/01/19 17:10:55 christos Exp $");
+__RCSID("$NetBSD: sshbuf-getput-crypto.c,v 1.5 2016/03/11 01:55:00 christos Exp $");
#include <sys/types.h>
#include <stdlib.h>
diff --git a/crypto/external/bsd/openssh/dist/sshbuf-misc.c b/crypto/external/bsd/openssh/dist/sshbuf-misc.c
index 6d720e6999f..c1777957a6e 100644
--- a/crypto/external/bsd/openssh/dist/sshbuf-misc.c
+++ b/crypto/external/bsd/openssh/dist/sshbuf-misc.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: sshbuf-misc.c,v 1.4 2015/03/24 20:03:44 markus Exp $ */
+/* $OpenBSD: sshbuf-misc.c,v 1.5 2015/10/05 17:11:21 djm Exp $ */
/*
* Copyright (c) 2011 Damien Miller
*
@@ -15,7 +15,7 @@
* OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
*/
#include "includes.h"
-__RCSID("$NetBSD: sshbuf-misc.c,v 1.4 2015/07/03 01:00:00 christos Exp $");
+__RCSID("$NetBSD: sshbuf-misc.c,v 1.5 2016/03/11 01:55:00 christos Exp $");
#include <sys/types.h>
#include <sys/socket.h>
@@ -101,7 +101,7 @@ sshbuf_dtob64(struct sshbuf *buf)
if (SIZE_MAX / 2 <= len || (ret = malloc(plen)) == NULL)
return NULL;
if ((r = b64_ntop(p, len, ret, plen)) == -1) {
- bzero(ret, plen);
+ explicit_bzero(ret, plen);
free(ret);
return NULL;
}
@@ -120,16 +120,16 @@ sshbuf_b64tod(struct sshbuf *buf, const char *b64)
if ((p = malloc(plen)) == NULL)
return SSH_ERR_ALLOC_FAIL;
if ((nlen = b64_pton(b64, p, plen)) < 0) {
- bzero(p, plen);
+ explicit_bzero(p, plen);
free(p);
return SSH_ERR_INVALID_FORMAT;
}
if ((r = sshbuf_put(buf, p, nlen)) < 0) {
- bzero(p, plen);
+ explicit_bzero(p, plen);
free(p);
return r;
}
- bzero(p, plen);
+ explicit_bzero(p, plen);
free(p);
return 0;
}
diff --git a/crypto/external/bsd/openssh/dist/sshbuf.c b/crypto/external/bsd/openssh/dist/sshbuf.c
index 539c7ad9c51..1c14a3abf4b 100644
--- a/crypto/external/bsd/openssh/dist/sshbuf.c
+++ b/crypto/external/bsd/openssh/dist/sshbuf.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: sshbuf.c,v 1.3 2015/01/20 23:14:00 deraadt Exp $ */
+/* $OpenBSD: sshbuf.c,v 1.6 2016/01/12 23:42:54 djm Exp $ */
/*
* Copyright (c) 2011 Damien Miller
*
@@ -15,7 +15,7 @@
* OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
*/
#include "includes.h"
-__RCSID("$NetBSD: sshbuf.c,v 1.4 2016/01/19 17:10:55 christos Exp $");
+__RCSID("$NetBSD: sshbuf.c,v 1.5 2016/03/11 01:55:00 christos Exp $");
#include <sys/param.h> /* roundup */
#include <sys/types.h>
@@ -163,10 +163,8 @@ sshbuf_free(struct sshbuf *buf)
* If we are a child, the free our parent to decrement its reference
* count and possibly free it.
*/
- if (buf->parent != NULL) {
- sshbuf_free(buf->parent);
- buf->parent = NULL;
- }
+ sshbuf_free(buf->parent);
+ buf->parent = NULL;
/*
* If we are a parent with still-extant children, then don't free just
* yet. The last child's call to sshbuf_free should decrement our
diff --git a/crypto/external/bsd/openssh/dist/sshbuf.h b/crypto/external/bsd/openssh/dist/sshbuf.h
index 7e5fdc9ebf9..6ee274b9abe 100644
--- a/crypto/external/bsd/openssh/dist/sshbuf.h
+++ b/crypto/external/bsd/openssh/dist/sshbuf.h
@@ -1,4 +1,4 @@
-/* $OpenBSD: sshbuf.h,v 1.4 2015/01/14 15:02:39 djm Exp $ */
+/* $OpenBSD: sshbuf.h,v 1.6 2015/12/10 07:01:35 mmcc Exp $ */
/*
* Copyright (c) 2011 Damien Miller
*
@@ -116,12 +116,12 @@ size_t sshbuf_len(const struct sshbuf *buf);
size_t sshbuf_avail(const struct sshbuf *buf);
/*
- * Returns a read-only pointer to the start of the the data in buf
+ * Returns a read-only pointer to the start of the data in buf
*/
const u_char *sshbuf_ptr(const struct sshbuf *buf);
/*
- * Returns a mutable pointer to the start of the the data in buf, or
+ * Returns a mutable pointer to the start of the data in buf, or
* NULL if the buffer is read-only.
*/
u_char *sshbuf_mutable_ptr(const struct sshbuf *buf);
@@ -253,26 +253,29 @@ int sshbuf_b64tod(struct sshbuf *buf, const char *b64);
#define POKE_U64(p, v) \
do { \
- ((u_char *)(p))[0] = (((u_int64_t)(v)) >> 56) & 0xff; \
- ((u_char *)(p))[1] = (((u_int64_t)(v)) >> 48) & 0xff; \
- ((u_char *)(p))[2] = (((u_int64_t)(v)) >> 40) & 0xff; \
- ((u_char *)(p))[3] = (((u_int64_t)(v)) >> 32) & 0xff; \
- ((u_char *)(p))[4] = (((u_int64_t)(v)) >> 24) & 0xff; \
- ((u_char *)(p))[5] = (((u_int64_t)(v)) >> 16) & 0xff; \
- ((u_char *)(p))[6] = (((u_int64_t)(v)) >> 8) & 0xff; \
- ((u_char *)(p))[7] = ((u_int64_t)(v)) & 0xff; \
+ const u_int64_t __v = (v); \
+ ((u_char *)(p))[0] = (__v >> 56) & 0xff; \
+ ((u_char *)(p))[1] = (__v >> 48) & 0xff; \
+ ((u_char *)(p))[2] = (__v >> 40) & 0xff; \
+ ((u_char *)(p))[3] = (__v >> 32) & 0xff; \
+ ((u_char *)(p))[4] = (__v >> 24) & 0xff; \
+ ((u_char *)(p))[5] = (__v >> 16) & 0xff; \
+ ((u_char *)(p))[6] = (__v >> 8) & 0xff; \
+ ((u_char *)(p))[7] = __v & 0xff; \
} while (0)
#define POKE_U32(p, v) \
do { \
- ((u_char *)(p))[0] = (((u_int64_t)(v)) >> 24) & 0xff; \
- ((u_char *)(p))[1] = (((u_int64_t)(v)) >> 16) & 0xff; \
- ((u_char *)(p))[2] = (((u_int64_t)(v)) >> 8) & 0xff; \
- ((u_char *)(p))[3] = ((u_int64_t)(v)) & 0xff; \
+ const u_int32_t __v = (v); \
+ ((u_char *)(p))[0] = (__v >> 24) & 0xff; \
+ ((u_char *)(p))[1] = (__v >> 16) & 0xff; \
+ ((u_char *)(p))[2] = (__v >> 8) & 0xff; \
+ ((u_char *)(p))[3] = __v & 0xff; \
} while (0)
#define POKE_U16(p, v) \
do { \
- ((u_char *)(p))[0] = (((u_int64_t)(v)) >> 8) & 0xff; \
- ((u_char *)(p))[1] = ((u_int64_t)(v)) & 0xff; \
+ const u_int16_t __v = (v); \
+ ((u_char *)(p))[0] = (__v >> 8) & 0xff; \
+ ((u_char *)(p))[1] = __v & 0xff; \
} while (0)
/* Internal definitions follow. Exposed for regress tests */
diff --git a/crypto/external/bsd/openssh/dist/sshconnect.c b/crypto/external/bsd/openssh/dist/sshconnect.c
index f4652a92a65..ece650a43a5 100644
--- a/crypto/external/bsd/openssh/dist/sshconnect.c
+++ b/crypto/external/bsd/openssh/dist/sshconnect.c
@@ -1,5 +1,6 @@
-/* $NetBSD: sshconnect.c,v 1.15 2016/01/19 17:10:55 christos Exp $ */
-/* $OpenBSD: sshconnect.c,v 1.263 2015/08/20 22:32:42 deraadt Exp $ */
+/* $NetBSD: sshconnect.c,v 1.16 2016/03/11 01:55:00 christos Exp $ */
+/* $OpenBSD: sshconnect.c,v 1.271 2016/01/14 22:56:56 markus Exp $ */
+
/*
* Author: Tatu Ylonen <ylo@cs.hut.fi>
* Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
@@ -15,7 +16,7 @@
*/
#include "includes.h"
-__RCSID("$NetBSD: sshconnect.c,v 1.15 2016/01/19 17:10:55 christos Exp $");
+__RCSID("$NetBSD: sshconnect.c,v 1.16 2016/03/11 01:55:00 christos Exp $");
#include <sys/param.h> /* roundup */
#include <sys/types.h>
#include <sys/param.h>
@@ -59,6 +60,7 @@ __RCSID("$NetBSD: sshconnect.c,v 1.15 2016/01/19 17:10:55 christos Exp $");
#include "version.h"
#include "authfile.h"
#include "ssherr.h"
+#include "authfd.h"
char *client_version_string = NULL;
char *server_version_string = NULL;
@@ -162,6 +164,7 @@ ssh_proxy_fdpass_connect(const char *host, u_short port,
if ((sock = mm_receive_fd(sp[1])) == -1)
fatal("proxy dialer did not pass back a connection");
+ close(sp[1]);
while (waitpid(pid, NULL, 0) == -1)
if (errno != EINTR)
@@ -454,7 +457,9 @@ ssh_connect_direct(const char *host, struct addrinfo *aitop,
char ntop[NI_MAXHOST], strport[NI_MAXSERV];
struct addrinfo *ai;
- debug2("ssh_connect: needpriv %d", needpriv);
+ debug2("%s: needpriv %d", __func__, needpriv);
+ memset(ntop, 0, sizeof(ntop));
+ memset(strport, 0, sizeof(strport));
for (attempt = 0; attempt < connection_attempts; attempt++) {
if (attempt > 0) {
@@ -473,7 +478,7 @@ ssh_connect_direct(const char *host, struct addrinfo *aitop,
if (getnameinfo(ai->ai_addr, ai->ai_addrlen,
ntop, sizeof(ntop), strport, sizeof(strport),
NI_NUMERICHOST|NI_NUMERICSERV) != 0) {
- error("ssh_connect: getnameinfo failed");
+ error("%s: getnameinfo failed", __func__);
continue;
}
debug("Connecting to %.200s [%.100s] port %s.",
@@ -934,7 +939,7 @@ check_host_key(char *hostname, struct sockaddr *hostaddr, u_short port,
options.fingerprint_hash, SSH_FP_RANDOMART);
if (fp == NULL || ra == NULL)
fatal("%s: sshkey_fingerprint fail", __func__);
- logit("Host key fingerprint is %s\n%s\n", fp, ra);
+ logit("Host key fingerprint is %s\n%s", fp, ra);
free(ra);
free(fp);
}
@@ -1245,8 +1250,9 @@ fail:
int
verify_host_key(char *host, struct sockaddr *hostaddr, Key *host_key)
{
+ u_int i;
int r = -1, flags = 0;
- char *fp = NULL;
+ char valid[64], *fp = NULL, *cafp = NULL;
struct sshkey *plain = NULL;
if ((fp = sshkey_fingerprint(host_key,
@@ -1256,8 +1262,31 @@ verify_host_key(char *host, struct sockaddr *hostaddr, Key *host_key)
goto out;
}
- debug("Server host key: %s %s",
- compat20 ? sshkey_ssh_name(host_key) : sshkey_type(host_key), fp);
+ if (sshkey_is_cert(host_key)) {
+ if ((cafp = sshkey_fingerprint(host_key->cert->signature_key,
+ options.fingerprint_hash, SSH_FP_DEFAULT)) == NULL) {
+ error("%s: fingerprint CA key: %s",
+ __func__, ssh_err(r));
+ r = -1;
+ goto out;
+ }
+ sshkey_format_cert_validity(host_key->cert,
+ valid, sizeof(valid));
+ debug("Server host certificate: %s %s, serial %llu "
+ "ID \"%s\" CA %s %s valid %s",
+ sshkey_ssh_name(host_key), fp,
+ (unsigned long long)host_key->cert->serial,
+ host_key->cert->key_id,
+ sshkey_ssh_name(host_key->cert->signature_key), cafp,
+ valid);
+ for (i = 0; i < host_key->cert->nprincipals; i++) {
+ debug2("Server host certificate hostname: %s",
+ host_key->cert->principals[i]);
+ }
+ } else {
+ debug("Server host key: %s %s", compat20 ?
+ sshkey_ssh_name(host_key) : sshkey_type(host_key), fp);
+ }
if (sshkey_equal(previous_host_key, host_key)) {
debug2("%s: server host key %s %s matches cached key",
@@ -1322,6 +1351,7 @@ verify_host_key(char *host, struct sockaddr *hostaddr, Key *host_key)
out:
sshkey_free(plain);
free(fp);
+ free(cafp);
if (r == 0 && host_key != NULL) {
key_free(previous_host_key);
previous_host_key = key_from_private(host_key);
@@ -1496,3 +1526,30 @@ ssh_local_cmd(const char *args)
return (WEXITSTATUS(status));
}
+
+void
+maybe_add_key_to_agent(char *authfile, Key *private, char *comment,
+ char *passphrase)
+{
+ int auth_sock = -1, r;
+
+ if (options.add_keys_to_agent == 0)
+ return;
+
+ if ((r = ssh_get_authentication_socket(&auth_sock)) != 0) {
+ debug3("no authentication agent, not adding key");
+ return;
+ }
+
+ if (options.add_keys_to_agent == 2 &&
+ !ask_permission("Add key %s (%s) to agent?", authfile, comment)) {
+ debug3("user denied adding this key");
+ return;
+ }
+
+ if ((r = ssh_add_identity_constrained(auth_sock, private, comment, 0,
+ (options.add_keys_to_agent == 3))) == 0)
+ debug("identity added to agent: %s", authfile);
+ else
+ debug("could not add identity to agent: %s (%d)", authfile, r);
+}
diff --git a/crypto/external/bsd/openssh/dist/sshconnect.h b/crypto/external/bsd/openssh/dist/sshconnect.h
index 33df6a7593a..3d6667a155c 100644
--- a/crypto/external/bsd/openssh/dist/sshconnect.h
+++ b/crypto/external/bsd/openssh/dist/sshconnect.h
@@ -1,5 +1,5 @@
-/* $NetBSD: sshconnect.h,v 1.6 2015/04/03 23:58:19 christos Exp $ */
-/* $OpenBSD: sshconnect.h,v 1.28 2013/10/16 02:31:47 djm Exp $ */
+/* $NetBSD: sshconnect.h,v 1.7 2016/03/11 01:55:00 christos Exp $ */
+/* $OpenBSD: sshconnect.h,v 1.29 2015/11/15 22:26:49 jcs Exp $ */
/*
* Copyright (c) 2000 Markus Friedl. All rights reserved.
@@ -56,6 +56,8 @@ void ssh_userauth2(const char *, const char *, char *, Sensitive *);
void ssh_put_password(char *);
int ssh_local_cmd(const char *);
+void maybe_add_key_to_agent(char *, Key *, char *, char *);
+
/*
* Macros to raise/lower permissions.
*/
diff --git a/crypto/external/bsd/openssh/dist/sshconnect1.c b/crypto/external/bsd/openssh/dist/sshconnect1.c
index 58bab1d31b9..059ecae9cb7 100644
--- a/crypto/external/bsd/openssh/dist/sshconnect1.c
+++ b/crypto/external/bsd/openssh/dist/sshconnect1.c
@@ -1,5 +1,6 @@
-/* $NetBSD: sshconnect1.c,v 1.6 2015/04/03 23:58:19 christos Exp $ */
-/* $OpenBSD: sshconnect1.c,v 1.77 2015/01/14 20:05:27 djm Exp $ */
+/* $NetBSD: sshconnect1.c,v 1.7 2016/03/11 01:55:00 christos Exp $ */
+/* $OpenBSD: sshconnect1.c,v 1.78 2015/11/15 22:26:49 jcs Exp $ */
+
/*
* Author: Tatu Ylonen <ylo@cs.hut.fi>
* Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
@@ -15,7 +16,7 @@
*/
#include "includes.h"
-__RCSID("$NetBSD: sshconnect1.c,v 1.6 2015/04/03 23:58:19 christos Exp $");
+__RCSID("$NetBSD: sshconnect1.c,v 1.7 2016/03/11 01:55:00 christos Exp $");
#include <sys/types.h>
#include <sys/socket.h>
#include <sys/stat.h>
@@ -354,7 +355,7 @@ try_rsa_authentication(int idx)
{
BIGNUM *challenge;
Key *public, *private;
- char buf[300], *passphrase, *comment, *authfile;
+ char buf[300], *passphrase = NULL, *comment, *authfile;
int i, perm_ok = 1, type, quit;
public = options.identity_keys[idx];
@@ -416,13 +417,20 @@ try_rsa_authentication(int idx)
debug2("no passphrase given, try next key");
quit = 1;
}
- explicit_bzero(passphrase, strlen(passphrase));
- free(passphrase);
if (private != NULL || quit)
break;
debug2("bad passphrase given, try again...");
}
}
+
+ if (private != NULL)
+ maybe_add_key_to_agent(authfile, private, comment, passphrase);
+
+ if (passphrase != NULL) {
+ explicit_bzero(passphrase, strlen(passphrase));
+ free(passphrase);
+ }
+
/* We no longer need the comment. */
free(comment);
diff --git a/crypto/external/bsd/openssh/dist/sshconnect2.c b/crypto/external/bsd/openssh/dist/sshconnect2.c
index d141c5ac9d4..f0b0f20e582 100644
--- a/crypto/external/bsd/openssh/dist/sshconnect2.c
+++ b/crypto/external/bsd/openssh/dist/sshconnect2.c
@@ -1,5 +1,6 @@
-/* $NetBSD: sshconnect2.c,v 1.24 2016/01/19 17:10:55 christos Exp $ */
-/* $OpenBSD: sshconnect2.c,v 1.226 2015/07/30 00:01:34 djm Exp $ */
+/* $NetBSD: sshconnect2.c,v 1.25 2016/03/11 01:55:00 christos Exp $ */
+/* $OpenBSD: sshconnect2.c,v 1.239 2016/02/23 01:34:14 djm Exp $ */
+
/*
* Copyright (c) 2000 Markus Friedl. All rights reserved.
* Copyright (c) 2008 Damien Miller. All rights reserved.
@@ -26,7 +27,7 @@
*/
#include "includes.h"
-__RCSID("$NetBSD: sshconnect2.c,v 1.24 2016/01/19 17:10:55 christos Exp $");
+__RCSID("$NetBSD: sshconnect2.c,v 1.25 2016/03/11 01:55:00 christos Exp $");
#include <sys/types.h>
#include <sys/socket.h>
#include <sys/wait.h>
@@ -163,14 +164,16 @@ void
ssh_kex2(char *host, struct sockaddr *hostaddr, u_short port)
{
const char *myproposal[PROPOSAL_MAX] = { KEX_CLIENT };
+ char *s;
struct kex *kex;
int r;
xxx_host = host;
xxx_hostaddr = hostaddr;
- myproposal[PROPOSAL_KEX_ALGS] = compat_kex_proposal(
- options.kex_algorithms);
+ if ((s = kex_names_cat(options.kex_algorithms, "ext-info-c")) == NULL)
+ fatal("%s: kex_names_cat", __func__);
+ myproposal[PROPOSAL_KEX_ALGS] = compat_kex_proposal(s);
myproposal[PROPOSAL_ENC_ALGS_CTOS] =
compat_cipher_proposal(options.ciphers);
myproposal[PROPOSAL_ENC_ALGS_STOC] =
@@ -221,6 +224,12 @@ ssh_kex2(char *host, struct sockaddr *hostaddr, u_short port)
dispatch_run(DISPATCH_BLOCK, &kex->done, active_state);
+ /* remove ext-info from the KEX proposals for rekeying */
+ myproposal[PROPOSAL_KEX_ALGS] =
+ compat_kex_proposal(options.kex_algorithms);
+ if ((r = kex_prop2buf(kex->my, myproposal)) != 0)
+ fatal("kex_prop2buf: %s", ssh_err(r));
+
session_id2 = kex->session_id;
session_id2_len = kex->session_id_len;
@@ -283,6 +292,8 @@ struct cauthmethod {
int *batch_flag; /* flag in option struct that disables method */
};
+int input_userauth_service_accept(int, u_int32_t, void *);
+int input_userauth_ext_info(int, u_int32_t, void *);
int input_userauth_success(int, u_int32_t, void *);
int input_userauth_success_unexpected(int, u_int32_t, void *);
int input_userauth_failure(int, u_int32_t, void *);
@@ -313,7 +324,7 @@ void userauth(Authctxt *, char *);
static int sign_and_send_pubkey(Authctxt *, Identity *);
static void pubkey_prepare(Authctxt *);
static void pubkey_cleanup(Authctxt *);
-static Key *load_identity_file(char *, int);
+static Key *load_identity_file(Identity *);
static Authmethod *authmethod_get(char *authlist);
static Authmethod *authmethod_lookup(const char *name);
@@ -366,30 +377,12 @@ void
ssh_userauth2(const char *local_user, const char *server_user, char *host,
Sensitive *sensitive)
{
+ struct ssh *ssh = active_state;
Authctxt authctxt;
- int type;
+ int r;
if (options.challenge_response_authentication)
options.kbd_interactive_authentication = 1;
-
- packet_start(SSH2_MSG_SERVICE_REQUEST);
- packet_put_cstring("ssh-userauth");
- packet_send();
- debug("SSH2_MSG_SERVICE_REQUEST sent");
- packet_write_wait();
- type = packet_read();
- if (type != SSH2_MSG_SERVICE_ACCEPT)
- fatal("Server denied authentication request: %d", type);
- if (packet_remaining() > 0) {
- char *reply = packet_get_string(NULL);
- debug2("service_accept: %s", reply);
- free(reply);
- } else {
- debug2("buggy server: service_accept w/o service");
- }
- packet_check_eom();
- debug("SSH2_MSG_SERVICE_ACCEPT received");
-
if (options.preferred_authentications == NULL)
options.preferred_authentications = authmethods_get();
@@ -411,17 +404,18 @@ ssh_userauth2(const char *local_user, const char *server_user, char *host,
if (authctxt.method == NULL)
fatal("ssh_userauth2: internal error: cannot send userauth none request");
- /* initial userauth request */
- userauth_none(&authctxt);
+ if ((r = sshpkt_start(ssh, SSH2_MSG_SERVICE_REQUEST)) != 0 ||
+ (r = sshpkt_put_cstring(ssh, "ssh-userauth")) != 0 ||
+ (r = sshpkt_send(ssh)) != 0)
+ fatal("%s: %s", __func__, ssh_err(r));
- dispatch_init(&input_userauth_error);
- dispatch_set(SSH2_MSG_USERAUTH_SUCCESS, &input_userauth_success);
- dispatch_set(SSH2_MSG_USERAUTH_FAILURE, &input_userauth_failure);
- dispatch_set(SSH2_MSG_USERAUTH_BANNER, &input_userauth_banner);
- dispatch_run(DISPATCH_BLOCK, &authctxt.success, &authctxt); /* loop until success */
+ ssh_dispatch_init(ssh, &input_userauth_error);
+ ssh_dispatch_set(ssh, SSH2_MSG_EXT_INFO, &input_userauth_ext_info);
+ ssh_dispatch_set(ssh, SSH2_MSG_SERVICE_ACCEPT, &input_userauth_service_accept);
+ ssh_dispatch_run(ssh, DISPATCH_BLOCK, &authctxt.success, &authctxt); /* loop until success */
pubkey_cleanup(&authctxt);
- dispatch_range(SSH2_MSG_USERAUTH_MIN, SSH2_MSG_USERAUTH_MAX, NULL);
+ ssh_dispatch_range(ssh, SSH2_MSG_USERAUTH_MIN, SSH2_MSG_USERAUTH_MAX, NULL);
/* if the user wants to use the none cipher do it */
/* post authentication and only if the right conditions are met */
@@ -429,17 +423,7 @@ ssh_userauth2(const char *local_user, const char *server_user, char *host,
/* tty allocated */
if ((options.none_switch == 1) && (options.none_enabled == 1))
{
- if (!tty_flag) /* no null on tty sessions */
- {
- const char *myproposal[PROPOSAL_MAX] = { KEX_CLIENT };
- debug("Requesting none rekeying...");
- myproposal[PROPOSAL_ENC_ALGS_STOC] = "none";
- myproposal[PROPOSAL_ENC_ALGS_CTOS] = "none";
- kex_prop2buf(active_state->kex->my, myproposal);
- ssh_packet_request_rekeying();
- fprintf(stderr, "WARNING: ENABLED NONE CIPHER\n");
- }
- else
+ if (tty_flag) /* no null on tty sessions */
{
/* requested NONE cipher when in a tty */
debug("Cannot switch to NONE cipher with tty allocated");
@@ -449,6 +433,47 @@ ssh_userauth2(const char *local_user, const char *server_user, char *host,
debug("Authentication succeeded (%s).", authctxt.method->name);
}
+/* ARGSUSED */
+int
+input_userauth_service_accept(int type, u_int32_t seqnr, void *ctxt)
+{
+ Authctxt *authctxt = ctxt;
+ struct ssh *ssh = active_state;
+ int r;
+
+ if (ssh_packet_remaining(ssh) > 0) {
+ char *reply;
+
+ if ((r = sshpkt_get_cstring(ssh, &reply, NULL)) != 0)
+ goto out;
+ debug2("service_accept: %s", reply);
+ free(reply);
+ } else {
+ debug2("buggy server: service_accept w/o service");
+ }
+ if ((r = sshpkt_get_end(ssh)) != 0)
+ goto out;
+ debug("SSH2_MSG_SERVICE_ACCEPT received");
+
+ /* initial userauth request */
+ userauth_none(authctxt);
+
+ ssh_dispatch_set(ssh, SSH2_MSG_EXT_INFO, &input_userauth_error);
+ ssh_dispatch_set(ssh, SSH2_MSG_USERAUTH_SUCCESS, &input_userauth_success);
+ ssh_dispatch_set(ssh, SSH2_MSG_USERAUTH_FAILURE, &input_userauth_failure);
+ ssh_dispatch_set(ssh, SSH2_MSG_USERAUTH_BANNER, &input_userauth_banner);
+ r = 0;
+ out:
+ return r;
+}
+
+/* ARGSUSED */
+int
+input_userauth_ext_info(int type, u_int32_t seqnr, void *ctxt)
+{
+ return kex_input_ext_info(type, seqnr, active_state);
+}
+
void
userauth(Authctxt *authctxt, char *authlist)
{
@@ -1002,29 +1027,48 @@ input_userauth_passwd_changereq(int type, u_int32_t seqnr, void *ctxt)
return 0;
}
+static const char *
+identity_sign_encode(struct identity *id)
+{
+ struct ssh *ssh = active_state;
+
+ if (id->key->type == KEY_RSA) {
+ switch (ssh->kex->rsa_sha2) {
+ case 256:
+ return "rsa-sha2-256";
+ case 512:
+ return "rsa-sha2-512";
+ }
+ }
+ return key_ssh_name(id->key);
+}
+
static int
identity_sign(struct identity *id, u_char **sigp, size_t *lenp,
const u_char *data, size_t datalen, u_int compat)
{
Key *prv;
int ret;
+ const char *alg;
+
+ alg = identity_sign_encode(id);
/* the agent supports this key */
- if (id->agent_fd)
+ if (id->agent_fd != -1)
return ssh_agent_sign(id->agent_fd, id->key, sigp, lenp,
- data, datalen, compat);
+ data, datalen, alg, compat);
/*
* we have already loaded the private key or
* the private key is stored in external hardware
*/
if (id->isprivate || (id->key->flags & SSHKEY_FLAG_EXT))
- return (sshkey_sign(id->key, sigp, lenp, data, datalen,
+ return (sshkey_sign(id->key, sigp, lenp, data, datalen, alg,
compat));
/* load the private key from the file */
- if ((prv = load_identity_file(id->filename, id->userprovided)) == NULL)
- return (-1); /* XXX return decent error code */
- ret = sshkey_sign(prv, sigp, lenp, data, datalen, compat);
+ if ((prv = load_identity_file(id)) == NULL)
+ return SSH_ERR_KEY_NOT_FOUND;
+ ret = sshkey_sign(prv, sigp, lenp, data, datalen, alg, compat);
sshkey_free(prv);
return (ret);
}
@@ -1033,18 +1077,17 @@ static int
sign_and_send_pubkey(Authctxt *authctxt, Identity *id)
{
Buffer b;
+ Identity *private_id;
u_char *blob, *signature;
- u_int bloblen;
size_t slen;
- u_int skip = 0;
- int ret = -1;
- int have_sig = 1;
+ u_int bloblen, skip = 0;
+ int matched, ret = -1, have_sig = 1;
char *fp;
if ((fp = sshkey_fingerprint(id->key, options.fingerprint_hash,
SSH_FP_DEFAULT)) == NULL)
return 0;
- debug3("sign_and_send_pubkey: %s %s", key_type(id->key), fp);
+ debug3("%s: %s %s", __func__, key_type(id->key), fp);
free(fp);
if (key_to_blob(id->key, &blob, &bloblen) == 0) {
@@ -1072,14 +1115,46 @@ sign_and_send_pubkey(Authctxt *authctxt, Identity *id)
} else {
buffer_put_cstring(&b, authctxt->method->name);
buffer_put_char(&b, have_sig);
- buffer_put_cstring(&b, key_ssh_name(id->key));
+ buffer_put_cstring(&b, identity_sign_encode(id));
}
buffer_put_string(&b, blob, bloblen);
+ /*
+ * If the key is an certificate, try to find a matching private key
+ * and use it to complete the signature.
+ * If no such private key exists, return failure and continue with
+ * other methods of authentication.
+ */
+ if (key_is_cert(id->key)) {
+ matched = 0;
+ TAILQ_FOREACH(private_id, &authctxt->keys, next) {
+ if (sshkey_equal_public(id->key, private_id->key) &&
+ id->key->type != private_id->key->type) {
+ id = private_id;
+ matched = 1;
+ break;
+ }
+ }
+ if (matched) {
+ debug2("%s: using private key \"%s\"%s for "
+ "certificate", __func__, id->filename,
+ id->agent_fd != -1 ? " from agent" : "");
+ } else {
+ /* XXX maybe verbose/error? */
+ debug("%s: no private key for certificate "
+ "\"%s\"", __func__, id->filename);
+ free(blob);
+ buffer_free(&b);
+ return 0;
+ }
+ }
+
/* generate signature */
ret = identity_sign(id, &signature, &slen,
buffer_ptr(&b), buffer_len(&b), datafellows);
if (ret != 0) {
+ if (ret != SSH_ERR_KEY_NOT_FOUND)
+ error("%s: signing failed: %s", __func__, ssh_err(ret));
free(blob);
buffer_free(&b);
return 0;
@@ -1142,7 +1217,7 @@ send_pubkey_test(Authctxt *authctxt, Identity *id)
packet_put_cstring(authctxt->method->name);
packet_put_char(have_sig);
if (!(datafellows & SSH_BUG_PKAUTH))
- packet_put_cstring(key_ssh_name(id->key));
+ packet_put_cstring(identity_sign_encode(id));
packet_put_string(blob, bloblen);
free(blob);
packet_send();
@@ -1150,20 +1225,20 @@ send_pubkey_test(Authctxt *authctxt, Identity *id)
}
static Key *
-load_identity_file(char *filename, int userprovided)
+load_identity_file(Identity *id)
{
- Key *private;
- char prompt[300], *passphrase;
+ Key *private = NULL;
+ char prompt[300], *passphrase, *comment;
int r, perm_ok = 0, quit = 0, i;
struct stat st;
- if (stat(filename, &st) < 0) {
- (userprovided ? logit : debug3)("no such identity: %s: %s",
- filename, strerror(errno));
+ if (stat(id->filename, &st) < 0) {
+ (id->userprovided ? logit : debug3)("no such identity: %s: %s",
+ id->filename, strerror(errno));
return NULL;
}
snprintf(prompt, sizeof prompt,
- "Enter passphrase for key '%.100s': ", filename);
+ "Enter passphrase for key '%.100s': ", id->filename);
for (i = 0; i <= options.number_of_password_prompts; i++) {
if (i == 0)
passphrase = xstrdup("");
@@ -1175,8 +1250,8 @@ load_identity_file(char *filename, int userprovided)
break;
}
}
- switch ((r = sshkey_load_private_type(KEY_UNSPEC, filename,
- passphrase, &private, NULL, &perm_ok))) {
+ switch ((r = sshkey_load_private_type(KEY_UNSPEC, id->filename,
+ passphrase, &private, &comment, &perm_ok))) {
case 0:
break;
case SSH_ERR_KEY_WRONG_PASSPHRASE:
@@ -1190,20 +1265,25 @@ load_identity_file(char *filename, int userprovided)
case SSH_ERR_SYSTEM_ERROR:
if (errno == ENOENT) {
debug2("Load key \"%s\": %s",
- filename, ssh_err(r));
+ id->filename, ssh_err(r));
quit = 1;
break;
}
/* FALLTHROUGH */
default:
- error("Load key \"%s\": %s", filename, ssh_err(r));
+ error("Load key \"%s\": %s", id->filename, ssh_err(r));
quit = 1;
break;
}
+ if (!quit && private != NULL && id->agent_fd == -1 &&
+ !(id->key && id->isprivate))
+ maybe_add_key_to_agent(id->filename, private, comment,
+ passphrase);
if (i > 0) {
explicit_bzero(passphrase, strlen(passphrase));
free(passphrase);
}
+ free(comment);
if (private != NULL || quit)
break;
}
@@ -1212,9 +1292,11 @@ load_identity_file(char *filename, int userprovided)
/*
* try keys in the following order:
- * 1. agent keys that are found in the config file
- * 2. other agent keys
- * 3. keys that are only listed in the config file
+ * 1. certificates listed in the config file
+ * 2. other input certificates
+ * 3. agent keys that are found in the config file
+ * 4. other agent keys
+ * 5. keys that are only listed in the config file
*/
static void
pubkey_prepare(Authctxt *authctxt)
@@ -1222,7 +1304,7 @@ pubkey_prepare(Authctxt *authctxt)
struct identity *id, *id2, *tmp;
struct idlist agent, files, *preferred;
struct sshkey *key;
- int agent_fd, i, r, found;
+ int agent_fd = -1, i, r, found;
size_t j;
struct ssh_identitylist *idlist;
@@ -1240,6 +1322,7 @@ pubkey_prepare(Authctxt *authctxt)
continue;
options.identity_keys[i] = NULL;
id = xcalloc(1, sizeof(*id));
+ id->agent_fd = -1;
id->key = key;
id->filename = xstrdup(options.identity_files[i]);
id->userprovided = options.identity_file_userprovided[i];
@@ -1268,6 +1351,19 @@ pubkey_prepare(Authctxt *authctxt)
free(id);
}
}
+ /* list of certificates specified by user */
+ for (i = 0; i < options.num_certificate_files; i++) {
+ key = options.certificates[i];
+ if (!key_is_cert(key) || key->cert == NULL ||
+ key->cert->type != SSH2_CERT_TYPE_USER)
+ continue;
+ id = xcalloc(1, sizeof(*id));
+ id->agent_fd = -1;
+ id->key = key;
+ id->filename = xstrdup(options.certificate_files[i]);
+ id->userprovided = options.certificate_file_userprovided[i];
+ TAILQ_INSERT_TAIL(preferred, id, next);
+ }
/* list of keys supported by the agent */
if ((r = ssh_get_authentication_socket(&agent_fd)) != 0) {
if (r != SSH_ERR_AGENT_NOT_PRESENT)
@@ -1318,9 +1414,23 @@ pubkey_prepare(Authctxt *authctxt)
TAILQ_REMOVE(&files, id, next);
TAILQ_INSERT_TAIL(preferred, id, next);
}
- TAILQ_FOREACH(id, preferred, next) {
- debug2("key: %s (%p),%s", id->filename, id->key,
- id->userprovided ? " explicit" : "");
+ /* finally, filter by PubkeyAcceptedKeyTypes */
+ TAILQ_FOREACH_SAFE(id, preferred, next, id2) {
+ if (id->key != NULL &&
+ match_pattern_list(sshkey_ssh_name(id->key),
+ options.pubkey_key_types, 0) != 1) {
+ debug("Skipping %s key %s - "
+ "not in PubkeyAcceptedKeyTypes",
+ sshkey_ssh_name(id->key), id->filename);
+ TAILQ_REMOVE(preferred, id, next);
+ sshkey_free(id->key);
+ free(id->filename);
+ memset(id, 0, sizeof(*id));
+ continue;
+ }
+ debug2("key: %s (%p)%s%s", id->filename, id->key,
+ id->userprovided ? ", explicit" : "",
+ id->agent_fd != -1 ? ", agent" : "");
}
}
@@ -1334,8 +1444,7 @@ pubkey_cleanup(Authctxt *authctxt)
for (id = TAILQ_FIRST(&authctxt->keys); id;
id = TAILQ_FIRST(&authctxt->keys)) {
TAILQ_REMOVE(&authctxt->keys, id, next);
- if (id->key)
- sshkey_free(id->key);
+ sshkey_free(id->key);
free(id->filename);
free(id);
}
@@ -1346,12 +1455,6 @@ try_identity(Identity *id)
{
if (!id->key)
return (0);
- if (match_pattern_list(sshkey_ssh_name(id->key),
- options.pubkey_key_types, 0) != 1) {
- debug("Skipping %s key %s for not in PubkeyAcceptedKeyTypes",
- sshkey_ssh_name(id->key), id->filename);
- return (0);
- }
if (key_type_plain(id->key->type) == KEY_RSA &&
(datafellows & SSH_BUG_RSASIGMD5) != 0) {
debug("Skipped %s key %s for RSA/MD5 server",
@@ -1386,8 +1489,7 @@ userauth_pubkey(Authctxt *authctxt)
}
} else {
debug("Trying private key: %s", id->filename);
- id->key = load_identity_file(id->filename,
- id->userprovided);
+ id->key = load_identity_file(id);
if (id->key != NULL) {
if (try_identity(id)) {
id->isprivate = 1;
@@ -1547,7 +1649,7 @@ ssh_keysign(struct sshkey *key, u_char **sigp, size_t *lenp,
fatal("%s: closefrom: %s", __func__, strerror(errno));
debug3("%s: [child] pid=%ld, exec %s",
__func__, (long)getpid(), _PATH_SSH_KEY_SIGN);
- execl(_PATH_SSH_KEY_SIGN, _PATH_SSH_KEY_SIGN, (char *) 0);
+ execl(_PATH_SSH_KEY_SIGN, _PATH_SSH_KEY_SIGN, (char *)NULL);
fatal("%s: exec(%s): %s", __func__, _PATH_SSH_KEY_SIGN,
strerror(errno));
}
@@ -1719,7 +1821,7 @@ userauth_hostbased(Authctxt *authctxt)
r = ssh_keysign(private, &sig, &siglen,
sshbuf_ptr(b), sshbuf_len(b));
else if ((r = sshkey_sign(private, &sig, &siglen,
- sshbuf_ptr(b), sshbuf_len(b), datafellows)) != 0)
+ sshbuf_ptr(b), sshbuf_len(b), NULL, datafellows)) != 0)
debug("%s: sshkey_sign: %s", __func__, ssh_err(r));
if (r != 0) {
error("sign using hostkey %s %s failed",
diff --git a/crypto/external/bsd/openssh/dist/sshd.8 b/crypto/external/bsd/openssh/dist/sshd.8
index 70f988a1368..56ba8f5a85b 100644
--- a/crypto/external/bsd/openssh/dist/sshd.8
+++ b/crypto/external/bsd/openssh/dist/sshd.8
@@ -1,4 +1,4 @@
-.\" $NetBSD: sshd.8,v 1.15 2015/08/13 10:33:21 christos Exp $
+.\" $NetBSD: sshd.8,v 1.16 2016/03/11 01:55:00 christos Exp $
.\" -*- nroff -*-
.\"
.\" Author: Tatu Ylonen <ylo@cs.hut.fi>
@@ -35,8 +35,8 @@
.\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
.\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
.\"
-.\" $OpenBSD: sshd.8,v 1.280 2015/07/03 03:49:45 djm Exp $
-.Dd July 3 2015
+.\" $OpenBSD: sshd.8,v 1.284 2016/02/17 07:38:19 jmc Exp $
+.Dd February 17 2016
.Dt SSHD 8
.Os
.Sh NAME
@@ -277,14 +277,12 @@ though this can be changed via the
.Cm Protocol
option in
.Xr sshd_config 5 .
-Protocol 2 supports DSA, ECDSA, Ed25519 and RSA keys;
-protocol 1 only supports RSA keys.
-For both protocols,
-each host has a host-specific key,
-normally 2048 bits,
-used to identify the host.
+Protocol 1 should not be used
+and is only offered to support legacy devices.
.Pp
-Forward security for protocol 1 is provided through
+Each host has a host-specific key,
+used to identify the host.
+Partial forward security for protocol 1 is provided through
an additional server key,
normally 1024 bits,
generated when the server starts.
@@ -445,7 +443,7 @@ does not exist either, xauth is used to add the cookie.
.Cm AuthorizedKeysFile
specifies the files containing public keys for
public key authentication;
-if none is specified, the default is
+if this option is not specified, the default is
.Pa ~/.ssh/authorized_keys
and
.Pa ~/.ssh/authorized_keys2 .
@@ -497,6 +495,10 @@ No spaces are permitted, except within double quotes.
The following option specifications are supported (note
that option keywords are case-insensitive):
.Bl -tag -width Ds
+.It Cm agent-forwarding
+Enable authentication agent forwarding previously disabled by the
+.Cm restrict
+option.
.It Cm cert-authority
Specifies that the listed key is a certification authority (CA) that is
trusted to validate signed certificates for user authentication.
@@ -591,6 +593,9 @@ they must be literal domains or addresses.
A port specification of
.Cm *
matches any port.
+.It Cm port-forwarding
+Enable port forwarding previously disabled by the
+.Cm restrict
.It Cm principals="principals"
On a
.Cm cert-authority
@@ -602,12 +607,33 @@ This option is ignored for keys that are not marked as trusted certificate
signers using the
.Cm cert-authority
option.
+.It Cm pty
+Permits tty allocation previously disabled by the
+.Cm restrict
+option.
+.It Cm restrict
+Enable all restrictions, i.e. disable port, agent and X11 forwarding,
+as well as disabling PTY allocation
+and execution of
+.Pa ~/.ssh/rc .
+If any future restriction capabilities are added to authorized_keys files
+they will be included in this set.
.It Cm tunnel="n"
Force a
.Xr tun 4
device on the server.
Without this option, the next available device will be used if
the client requests a tunnel.
+.It Cm user-rc
+Enables execution of
+.Pa ~/.ssh/rc
+previously disabled by the
+.Cm restrict
+option.
+.It Cm X11-forwarding
+Permits X11 forwarding previously disabled by the
+.Cm restrict
+option.
.El
.Pp
An example authorized_keys file:
@@ -622,6 +648,10 @@ permitopen="192.0.2.1:80",permitopen="192.0.2.2:25" ssh-dss
AAAAB5...21S==
tunnel="0",command="sh /etc/netstart tun0" ssh-rsa AAAA...==
jane@example.net
+restrict,command="uptime" ssh-rsa AAAA1C8...32Tv==
+user@example.net
+restrict,pty,command="nethack" ssh-rsa AAAA1f8...IrrC5==
+user@example.net
.Ed
.Sh SSH_KNOWN_HOSTS FILE FORMAT
The
@@ -831,9 +861,12 @@ This file is for host-based authentication (see
It should only be writable by root.
.Pp
.It Pa /etc/moduli
-Contains Diffie-Hellman groups used for the "Diffie-Hellman Group Exchange".
+Contains Diffie-Hellman groups used for the "Diffie-Hellman Group Exchange"
+key exchange method.
The file format is described in
.Xr moduli 5 .
+If no usable groups are found in this file then fixed internal groups will
+be used.
.Pp
.It Pa /etc/motd
See
diff --git a/crypto/external/bsd/openssh/dist/sshd.c b/crypto/external/bsd/openssh/dist/sshd.c
index dc5374a43a0..5dd33cb09d3 100644
--- a/crypto/external/bsd/openssh/dist/sshd.c
+++ b/crypto/external/bsd/openssh/dist/sshd.c
@@ -1,5 +1,6 @@
-/* $NetBSD: sshd.c,v 1.23 2016/01/14 22:30:04 christos Exp $ */
-/* $OpenBSD: sshd.c,v 1.458 2015/08/20 22:32:42 deraadt Exp $ */
+/* $NetBSD: sshd.c,v 1.24 2016/03/11 01:55:00 christos Exp $ */
+/* $OpenBSD: sshd.c,v 1.465 2016/02/15 09:47:49 dtucker Exp $ */
+
/*
* Author: Tatu Ylonen <ylo@cs.hut.fi>
* Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
@@ -44,7 +45,7 @@
*/
#include "includes.h"
-__RCSID("$NetBSD: sshd.c,v 1.23 2016/01/14 22:30:04 christos Exp $");
+__RCSID("$NetBSD: sshd.c,v 1.24 2016/03/11 01:55:00 christos Exp $");
#include <sys/types.h>
#include <sys/param.h>
#include <sys/ioctl.h>
@@ -626,33 +627,32 @@ privsep_preauth_child(void)
/* Demote the private keys to public keys. */
demote_sensitive_data();
- if ((pw = getpwnam(SSH_PRIVSEP_USER)) == NULL)
- fatal("Privilege separation user %s does not exist",
- SSH_PRIVSEP_USER);
- explicit_bzero(pw->pw_passwd, strlen(pw->pw_passwd));
- endpwent();
+ /* Demote the child */
+ if (getuid() == 0 || geteuid() == 0) {
+ if ((pw = getpwnam(SSH_PRIVSEP_USER)) == NULL)
+ fatal("Privilege separation user %s does not exist",
+ SSH_PRIVSEP_USER);
+ explicit_bzero(pw->pw_passwd, strlen(pw->pw_passwd));
+ endpwent();
- pfilter_init();
+ /* Change our root directory */
+ if (chroot(_PATH_PRIVSEP_CHROOT_DIR) == -1)
+ fatal("chroot(\"%s\"): %s", _PATH_PRIVSEP_CHROOT_DIR,
+ strerror(errno));
+ if (chdir("/") == -1)
+ fatal("chdir(\"/\"): %s", strerror(errno));
- /* Change our root directory */
- if (chroot(_PATH_PRIVSEP_CHROOT_DIR) == -1)
- fatal("chroot(\"%s\"): %s", _PATH_PRIVSEP_CHROOT_DIR,
- strerror(errno));
- if (chdir("/") == -1)
- fatal("chdir(\"/\"): %s", strerror(errno));
-
- /* Drop our privileges */
- debug3("privsep user:group %u:%u", (u_int)pw->pw_uid,
- (u_int)pw->pw_gid);
-#if 0
- /* XXX not ready, too heavy after chroot */
- do_setusercontext(pw);
-#else
- gidset[0] = pw->pw_gid;
- if (setgroups(1, gidset) < 0)
- fatal("setgroups: %.100s", strerror(errno));
- permanently_set_uid(pw);
-#endif
+ /*
+ * Drop our privileges
+ * NB. Can't use setusercontext() after chroot.
+ */
+ debug3("privsep user:group %u:%u", (u_int)pw->pw_uid,
+ (u_int)pw->pw_gid);
+ gidset[0] = pw->pw_gid;
+ if (setgroups(1, gidset) < 0)
+ fatal("setgroups: %.100s", strerror(errno));
+ permanently_set_uid(pw);
+ }
}
static int
@@ -718,9 +718,7 @@ privsep_preauth(Authctxt *authctxt)
/* Arrange for logging to be sent to the monitor */
set_log_handler(mm_log_handler, pmonitor);
- /* Demote the child */
- if (getuid() == 0 || geteuid() == 0)
- privsep_preauth_child();
+ privsep_preauth_child();
setproctitle("%s", "[net]");
if (box != NULL)
ssh_sandbox_child(box);
@@ -807,6 +805,12 @@ list_hostkey_types(void)
buffer_append(&b, ",", 1);
p = key_ssh_name(key);
buffer_append(&b, p, strlen(p));
+
+ /* for RSA we also support SHA2 signatures */
+ if (key->type == KEY_RSA) {
+ p = ",rsa-sha2-512,rsa-sha2-256";
+ buffer_append(&b, p, strlen(p));
+ }
break;
}
/* If the private key has a cert peer, then list that too */
@@ -1235,8 +1239,7 @@ server_accept_loop(int *sock_in, int *sock_out, int *newsock, int *config_s)
for (;;) {
if (received_sighup)
sighup_restart();
- if (fdset != NULL)
- free(fdset);
+ free(fdset);
fdset = xcalloc(howmany(maxfd + 1, NFDBITS),
sizeof(fd_mask));
@@ -1440,6 +1443,7 @@ main(int ac, char **av)
Authctxt *authctxt;
struct connection_info *connection_info = get_connection_info(0, 0);
+ ssh_malloc_init(); /* must be called before any mallocs */
/* Save argv. */
saved_argv = av;
rexec_argc = ac;
@@ -1482,7 +1486,7 @@ main(int ac, char **av)
no_daemon_flag = 1;
break;
case 'E':
- logfile = xstrdup(optarg);
+ logfile = optarg;
/* FALLTHROUGH */
case 'e':
log_stderr = 1;
@@ -1586,10 +1590,8 @@ main(int ac, char **av)
#endif
/* If requested, redirect the logs to the specified logfile. */
- if (logfile != NULL) {
+ if (logfile != NULL)
log_redirect_stderr_to(logfile);
- free(logfile);
- }
/*
* Force logging to stderr until we have loaded the private host
* key (unless started from inetd)
@@ -2425,24 +2427,26 @@ do_ssh1_kex(void)
int
sshd_hostkey_sign(Key *privkey, Key *pubkey, u_char **signature, size_t *slen,
- const u_char *data, size_t dlen, u_int flag)
+ const u_char *data, size_t dlen, const char *alg, u_int flag)
{
int r;
u_int xxx_slen, xxx_dlen = dlen;
if (privkey) {
- if (PRIVSEP(key_sign(privkey, signature, &xxx_slen, data, xxx_dlen) < 0))
+ if (PRIVSEP(key_sign(privkey, signature, &xxx_slen, data, xxx_dlen,
+ alg) < 0))
fatal("%s: key_sign failed", __func__);
if (slen)
*slen = xxx_slen;
} else if (use_privsep) {
- if (mm_key_sign(pubkey, signature, &xxx_slen, data, xxx_dlen) < 0)
+ if (mm_key_sign(pubkey, signature, &xxx_slen, data, xxx_dlen,
+ alg) < 0)
fatal("%s: pubkey_sign failed", __func__);
if (slen)
*slen = xxx_slen;
} else {
if ((r = ssh_agent_sign(auth_sock, pubkey, signature, slen,
- data, dlen, datafellows)) != 0)
+ data, dlen, alg, datafellows)) != 0)
fatal("%s: ssh_agent_sign failed: %s",
__func__, ssh_err(r));
}
@@ -2487,7 +2491,7 @@ do_ssh2_kex(void)
}
if (options.rekey_limit || options.rekey_interval)
- packet_set_rekey_limits((u_int32_t)options.rekey_limit,
+ packet_set_rekey_limits(options.rekey_limit,
(time_t)options.rekey_interval);
myproposal[PROPOSAL_SERVER_HOST_KEY_ALGS] = compat_pkalg_proposal(
diff --git a/crypto/external/bsd/openssh/dist/sshd_config b/crypto/external/bsd/openssh/dist/sshd_config
index 444fe7d529d..388bf09dafc 100644
--- a/crypto/external/bsd/openssh/dist/sshd_config
+++ b/crypto/external/bsd/openssh/dist/sshd_config
@@ -1,5 +1,5 @@
-# $NetBSD: sshd_config,v 1.15 2015/08/13 10:33:21 christos Exp $
-# $OpenBSD: sshd_config,v 1.97 2015/08/06 14:53:21 deraadt Exp $
+# $NetBSD: sshd_config,v 1.16 2016/03/11 01:55:00 christos Exp $
+# $OpenBSD: sshd_config,v 1.98 2016/02/17 05:29:04 djm Exp $
# This is the sshd server system-wide configuration file. See
# sshd_config(5) for more information.
@@ -87,7 +87,7 @@ AuthorizedKeysFile .ssh/authorized_keys
#PrintLastLog yes
#TCPKeepAlive yes
#UseLogin no
-UsePrivilegeSeparation sandbox
+#UsePrivilegeSeparation sandbox
UsePam yes
#PermitUserEnvironment no
#Compression delayed
diff --git a/crypto/external/bsd/openssh/dist/sshd_config.5 b/crypto/external/bsd/openssh/dist/sshd_config.5
index ea0859533cf..02860809407 100644
--- a/crypto/external/bsd/openssh/dist/sshd_config.5
+++ b/crypto/external/bsd/openssh/dist/sshd_config.5
@@ -1,4 +1,4 @@
-.\" $NetBSD: sshd_config.5,v 1.20 2015/08/21 08:20:59 christos Exp $
+.\" $NetBSD: sshd_config.5,v 1.21 2016/03/11 01:55:00 christos Exp $
.\" -*- nroff -*-
.\"
.\" Author: Tatu Ylonen <ylo@cs.hut.fi>
@@ -35,8 +35,8 @@
.\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
.\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
.\"
-.\" $OpenBSD: sshd_config.5,v 1.211 2015/08/14 15:32:41 jmc Exp $
-.Dd August 14 2015
+.\" $OpenBSD: sshd_config.5,v 1.220 2016/02/17 08:57:34 djm Exp $
+.Dd February 17 2016
.Dt SSHD_CONFIG 5
.Os
.Sh NAME
@@ -72,8 +72,7 @@ See
in
.Xr ssh_config 5
for how to configure the client.
-Note that environment passing is only supported for protocol 2, and
-that the
+The
.Ev TERM
environment variable is always sent whenever the client
requests a pseudo-terminal as it is required by the protocol.
@@ -228,7 +227,7 @@ of
.Dq publickey,publickey
will require successful authentication using two different public keys.
.Pp
-This option is only available for SSH protocol 2 and will yield a fatal
+This option will yield a fatal
error if enabled if protocol 1 is also enabled.
Note that each authentication method listed should also be explicitly enabled
in the configuration.
@@ -287,6 +286,9 @@ After expansion,
is taken to be an absolute path or one relative to the user's home
directory.
Multiple files may be listed, separated by whitespace.
+Alternately this option may be set to
+.Dq none
+to skip checking for user keys in files.
The default is
.Dq .ssh/authorized_keys .ssh/authorized_keys2 .
.It Cm AuthorizedPrincipalsCommand
@@ -372,7 +374,6 @@ authentication is allowed.
If the argument is
.Dq none
then no banner is displayed.
-This option is only available for protocol version 2.
By default, no banner is displayed.
.It Cm ChallengeResponseAuthentication
Specifies whether challenge-response authentication is allowed.
@@ -432,10 +433,12 @@ Misconfiguration can lead to unsafe environments which
.Xr sshd 8
cannot detect.
.Pp
-The default is not to
+The default is
+.Dq none ,
+indicating not to
.Xr chroot 2 .
.It Cm Ciphers
-Specifies the ciphers allowed for protocol version 2.
+Specifies the ciphers allowed.
Multiple ciphers must be comma-separated.
If the specified value begins with a
.Sq +
@@ -516,7 +519,6 @@ If
.Cm ClientAliveCountMax
is left at the default, unresponsive SSH clients
will be disconnected after approximately 45 seconds.
-This option applies to protocol version 2 only.
.It Cm ClientAliveInterval
Sets a timeout interval in seconds after which if no data has been received
from the client,
@@ -525,7 +527,6 @@ will send a message through the encrypted
channel to request a response from the client.
The default
is 0, indicating that these messages will not be sent to the client.
-This option applies to protocol version 2 only.
.It Cm Compression
Specifies whether compression is allowed, or delayed until
the user has authenticated successfully.
@@ -599,6 +600,8 @@ Specifying a command of
will force the use of an in-process sftp server that requires no support
files when used with
.Cm ChrootDirectory .
+The default is
+.Dq none .
.It Cm GatewayPorts
Specifies whether remote hosts are allowed to connect to ports
forwarded for the client.
@@ -623,13 +626,11 @@ The default is
Specifies whether user authentication based on GSSAPI is allowed.
The default is
.Dq no .
-Note that this option applies to protocol version 2 only.
.It Cm GSSAPICleanupCredentials
Specifies whether to automatically destroy the user's credentials cache
on logout.
The default is
.Dq yes .
-Note that this option applies to protocol version 2 only.
.It Cm GSSAPIStrictAcceptorCheck
Determines whether to be strict about the identity of the GSSAPI acceptor
a client authenticates against.
@@ -672,9 +673,6 @@ may be used to list supported key types.
Specifies whether rhosts or /etc/hosts.equiv authentication together
with successful public key client host authentication is allowed
(host-based authentication).
-This option is similar to
-.Cm RhostsRSAAuthentication
-and applies to protocol version 2 only.
The default is
.Dq no .
.It Cm HostbasedUsesNameFromPacketOnly
@@ -745,7 +743,7 @@ is specified, the location of the socket will be read from the
.Ev SSH_AUTH_SOCK
environment variable.
.It Cm HostKeyAlgorithms
-Specifies the protocol version 2 host key algorithms
+Specifies the host key algorithms
that the server offers.
The default for this option is:
.Bd -literal -offset 3n
@@ -968,8 +966,7 @@ DEBUG2 and DEBUG3 each specify higher levels of debugging output.
Logging with a DEBUG level violates the privacy of users and is not recommended.
.It Cm MACs
Specifies the available MAC (message authentication code) algorithms.
-The MAC algorithm is used in protocol version 2
-for data integrity protection.
+The MAC algorithm is used for data integrity protection.
Multiple algorithms must be comma-separated.
If the specified value begins with a
.Sq +
@@ -1025,8 +1022,9 @@ The default is:
.Bd -literal -offset indent
umac-64-etm@openssh.com,umac-128-etm@openssh.com,
hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,
+hmac-sha1-etm@openssh.com,
umac-64@openssh.com,umac-128@openssh.com,
-hmac-sha2-256,hmac-sha2-512
+hmac-sha2-256,hmac-sha2-512,hmac-sha1
.Ed
.Pp
The list of available MAC algorithms may also be obtained using the
@@ -1096,6 +1094,8 @@ Available keywords are
.Cm AuthorizedKeysCommand ,
.Cm AuthorizedKeysCommandUser ,
.Cm AuthorizedKeysFile ,
+.Cm AuthorizedPrincipalsCommand ,
+.Cm AuthorizedPrincipalsCommandUser ,
.Cm AuthorizedPrincipalsFile ,
.Cm Banner ,
.Cm ChrootDirectory ,
@@ -1139,7 +1139,15 @@ Once the number of failures reaches half this value,
additional failures are logged.
The default is 6.
.It Cm MaxSessions
-Specifies the maximum number of open sessions permitted per network connection.
+Specifies the maximum number of open shell, login or subsystem (e.g. sftp)
+sessions permitted per network connection.
+Multiple sessions may be established by clients that support connection
+multiplexing.
+Setting
+.Cm MaxSessions
+to 1 will effectively disable session multiplexing, whereas setting it to 0
+will prevent all shell, login and subsystem sessions while still permitting
+forwarding.
The default is 10.
.It Cm MaxStartups
Specifies the maximum number of concurrent unauthenticated connections to the
@@ -1329,6 +1337,10 @@ and
Multiple versions must be comma-separated.
The default is
.Sq 2 .
+Protocol 1 suffers from a number of cryptographic weaknesses and should
+not be used.
+It is only offered to support legacy devices.
+.Pp
Note that the order of the protocol list does not indicate preference,
because the client selects among multiple protocol versions offered
by the server.
@@ -1363,7 +1375,6 @@ may be used to list supported key types.
Specifies whether public key authentication is allowed.
The default is
.Dq yes .
-Note that this option applies to protocol version 2 only.
.It Cm RekeyLimit
Specifies the maximum amount of data that may be transmitted before the
session key is renegotiated, optionally followed a maximum amount of
@@ -1389,7 +1400,6 @@ is
.Dq default none ,
which means that rekeying is performed after the cipher's default amount
of data has been sent or received and no time based rekeying is done.
-This option applies to protocol version 2 only.
.It Cm RevokedKeys
Specifies revoked public keys file, or
.Dq none
@@ -1476,7 +1486,6 @@ This may simplify configurations using
to force a different filesystem root on clients.
.Pp
By default no subsystems are defined.
-Note that this option applies to protocol version 2 only.
.It Cm SyslogFacility
Gives the facility code that is used when logging messages from
.Xr sshd 8 .
@@ -1565,14 +1574,19 @@ After successful authentication, another process will be created that has
the privilege of the authenticated user.
The goal of privilege separation is to prevent privilege
escalation by containing any corruption within the unprivileged processes.
-The default is
-.Dq yes .
+The argument must be
+.Dq yes ,
+.Dq no ,
+or
+.Dq sandbox .
If
.Cm UsePrivilegeSeparation
is set to
.Dq sandbox
then the pre-authentication unprivileged process is subject to additional
restrictions.
+The default is
+.Dq sandbox .
.It Cm VersionAddendum
Optionally specifies additional text to append to the SSH protocol banner
sent by the server upon connection.
diff --git a/crypto/external/bsd/openssh/dist/ssherr.c b/crypto/external/bsd/openssh/dist/ssherr.c
index b3b07a40bae..f7b7d82bbb6 100644
--- a/crypto/external/bsd/openssh/dist/ssherr.c
+++ b/crypto/external/bsd/openssh/dist/ssherr.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: ssherr.c,v 1.4 2015/02/16 22:13:32 djm Exp $ */
+/* $OpenBSD: ssherr.c,v 1.5 2015/09/13 14:39:16 tim Exp $ */
/*
* Copyright (c) 2011 Damien Miller
*
@@ -15,7 +15,7 @@
* OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
*/
#include "includes.h"
-__RCSID("$NetBSD: ssherr.c,v 1.3 2015/04/03 23:58:19 christos Exp $");
+__RCSID("$NetBSD: ssherr.c,v 1.4 2016/03/11 01:55:00 christos Exp $");
#include <errno.h>
#include <stdio.h>
@@ -107,7 +107,7 @@ ssh_err(int n)
case SSH_ERR_NEED_REKEY:
return "rekeying not supported by peer";
case SSH_ERR_PASSPHRASE_TOO_SHORT:
- return "passphrase is too short (minimum four characters)";
+ return "passphrase is too short (minimum five characters)";
case SSH_ERR_FILE_CHANGED:
return "file changed while reading";
case SSH_ERR_KEY_UNKNOWN_CIPHER:
diff --git a/crypto/external/bsd/openssh/dist/sshkey.c b/crypto/external/bsd/openssh/dist/sshkey.c
index 091b556d6c4..3e01501b206 100644
--- a/crypto/external/bsd/openssh/dist/sshkey.c
+++ b/crypto/external/bsd/openssh/dist/sshkey.c
@@ -1,5 +1,6 @@
-/* $NetBSD: sshkey.c,v 1.6 2015/08/21 08:20:59 christos Exp $ */
-/* $OpenBSD: sshkey.c,v 1.21 2015/08/19 23:19:01 djm Exp $ */
+/* $NetBSD: sshkey.c,v 1.7 2016/03/11 01:55:00 christos Exp $ */
+/* $OpenBSD: sshkey.c,v 1.31 2015/12/11 04:21:12 mmcc Exp $ */
+
/*
* Copyright (c) 2000, 2001 Markus Friedl. All rights reserved.
* Copyright (c) 2008 Alexander von Gernler. All rights reserved.
@@ -26,7 +27,7 @@
* THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
*/
#include "includes.h"
-__RCSID("$NetBSD: sshkey.c,v 1.6 2015/08/21 08:20:59 christos Exp $");
+__RCSID("$NetBSD: sshkey.c,v 1.7 2016/03/11 01:55:00 christos Exp $");
#include <sys/param.h> /* MIN MAX */
#include <sys/types.h>
@@ -82,28 +83,31 @@ struct keytype {
int type;
int nid;
int cert;
+ int sigonly;
};
static const struct keytype keytypes[] = {
- { "ssh-ed25519", "ED25519", KEY_ED25519, 0, 0 },
+ { "ssh-ed25519", "ED25519", KEY_ED25519, 0, 0, 0 },
{ "ssh-ed25519-cert-v01@openssh.com", "ED25519-CERT",
- KEY_ED25519_CERT, 0, 1 },
+ KEY_ED25519_CERT, 0, 1, 0 },
#ifdef WITH_OPENSSL
- { NULL, "RSA1", KEY_RSA1, 0, 0 },
- { "ssh-rsa", "RSA", KEY_RSA, 0, 0 },
- { "ssh-dss", "DSA", KEY_DSA, 0, 0 },
- { "ecdsa-sha2-nistp256", "ECDSA", KEY_ECDSA, NID_X9_62_prime256v1, 0 },
- { "ecdsa-sha2-nistp384", "ECDSA", KEY_ECDSA, NID_secp384r1, 0 },
- { "ecdsa-sha2-nistp521", "ECDSA", KEY_ECDSA, NID_secp521r1, 0 },
- { "ssh-rsa-cert-v01@openssh.com", "RSA-CERT", KEY_RSA_CERT, 0, 1 },
- { "ssh-dss-cert-v01@openssh.com", "DSA-CERT", KEY_DSA_CERT, 0, 1 },
+ { NULL, "RSA1", KEY_RSA1, 0, 0, 0 },
+ { "ssh-rsa", "RSA", KEY_RSA, 0, 0, 0 },
+ { "rsa-sha2-256", "RSA", KEY_RSA, 0, 0, 1 },
+ { "rsa-sha2-512", "RSA", KEY_RSA, 0, 0, 1 },
+ { "ssh-dss", "DSA", KEY_DSA, 0, 0, 0 },
+ { "ecdsa-sha2-nistp256", "ECDSA", KEY_ECDSA, NID_X9_62_prime256v1, 0, 0 },
+ { "ecdsa-sha2-nistp384", "ECDSA", KEY_ECDSA, NID_secp384r1, 0, 0 },
+ { "ecdsa-sha2-nistp521", "ECDSA", KEY_ECDSA, NID_secp521r1, 0, 0 },
+ { "ssh-rsa-cert-v01@openssh.com", "RSA-CERT", KEY_RSA_CERT, 0, 1, 0 },
+ { "ssh-dss-cert-v01@openssh.com", "DSA-CERT", KEY_DSA_CERT, 0, 1, 0 },
{ "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ECDSA-CERT",
- KEY_ECDSA_CERT, NID_X9_62_prime256v1, 1 },
+ KEY_ECDSA_CERT, NID_X9_62_prime256v1, 1, 0 },
{ "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ECDSA-CERT",
- KEY_ECDSA_CERT, NID_secp384r1, 1 },
+ KEY_ECDSA_CERT, NID_secp384r1, 1, 0 },
{ "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ECDSA-CERT",
- KEY_ECDSA_CERT, NID_secp521r1, 1 },
+ KEY_ECDSA_CERT, NID_secp521r1, 1, 0 },
#endif /* WITH_OPENSSL */
- { NULL, NULL, -1, -1, 0 }
+ { NULL, NULL, -1, -1, 0, 0 }
};
const char *
@@ -191,7 +195,7 @@ key_alg_list(int certs_only, int plain_only)
const struct keytype *kt;
for (kt = keytypes; kt->type != -1; kt++) {
- if (kt->name == NULL)
+ if (kt->name == NULL || kt->sigonly)
continue;
if ((certs_only && !kt->cert) || (plain_only && kt->cert))
continue;
@@ -400,20 +404,14 @@ cert_free(struct sshkey_cert *cert)
if (cert == NULL)
return;
- if (cert->certblob != NULL)
- sshbuf_free(cert->certblob);
- if (cert->critical != NULL)
- sshbuf_free(cert->critical);
- if (cert->extensions != NULL)
- sshbuf_free(cert->extensions);
- if (cert->key_id != NULL)
- free(cert->key_id);
+ sshbuf_free(cert->certblob);
+ sshbuf_free(cert->critical);
+ sshbuf_free(cert->extensions);
+ free(cert->key_id);
for (i = 0; i < cert->nprincipals; i++)
free(cert->principals[i]);
- if (cert->principals != NULL)
- free(cert->principals);
- if (cert->signature_key != NULL)
- sshkey_free(cert->signature_key);
+ free(cert->principals);
+ sshkey_free(cert->signature_key);
explicit_bzero(cert, sizeof(*cert));
free(cert);
}
@@ -1193,7 +1191,7 @@ read_decimal_bignum(char **cpp, BIGNUM *v)
return SSH_ERR_BIGNUM_TOO_LARGE;
if (cp[e] == '\0')
skip = 0;
- else if (index(" \t\r\n", cp[e]) == NULL)
+ else if (strchr(" \t\r\n", cp[e]) == NULL)
return SSH_ERR_INVALID_FORMAT;
cp[e] = '\0';
if (BN_dec2bn(&v, cp) <= 0)
@@ -1209,11 +1207,10 @@ sshkey_read(struct sshkey *ret, char **cpp)
{
struct sshkey *k;
int retval = SSH_ERR_INVALID_FORMAT;
- char *cp, *space;
+ char *ep, *cp, *space;
int r, type, curve_nid = -1;
struct sshbuf *blob;
#ifdef WITH_SSH1
- char *ep;
u_long bits;
#endif /* WITH_SSH1 */
@@ -1224,7 +1221,7 @@ sshkey_read(struct sshkey *ret, char **cpp)
#ifdef WITH_SSH1
/* Get number of bits. */
bits = strtoul(cp, &ep, 10);
- if (*cp == '\0' || index(" \t\r\n", *ep) == NULL ||
+ if (*cp == '\0' || strchr(" \t\r\n", *ep) == NULL ||
bits == 0 || bits > SSHBUF_MAX_BIGNUM * 8)
return SSH_ERR_INVALID_FORMAT; /* Bad bit count... */
/* Get public exponent, public modulus. */
@@ -1232,10 +1229,10 @@ sshkey_read(struct sshkey *ret, char **cpp)
return r;
if ((r = read_decimal_bignum(&ep, ret->rsa->n)) < 0)
return r;
- *cpp = ep;
/* validate the claimed number of bits */
if (BN_num_bits(ret->rsa->n) != (int)bits)
return SSH_ERR_KEY_BITS_MISMATCH;
+ *cpp = ep;
retval = 0;
#endif /* WITH_SSH1 */
break;
@@ -1273,9 +1270,9 @@ sshkey_read(struct sshkey *ret, char **cpp)
*space++ = '\0';
while (*space == ' ' || *space == '\t')
space++;
- *cpp = space;
+ ep = space;
} else
- *cpp = cp + strlen(cp);
+ ep = cp + strlen(cp);
if ((r = sshbuf_b64tod(blob, cp)) != 0) {
sshbuf_free(blob);
return r;
@@ -1306,8 +1303,9 @@ sshkey_read(struct sshkey *ret, char **cpp)
ret->cert = k->cert;
k->cert = NULL;
}
+ switch (sshkey_type_plain(ret->type)) {
#ifdef WITH_OPENSSL
- if (sshkey_type_plain(ret->type) == KEY_RSA) {
+ case KEY_RSA:
if (ret->rsa != NULL)
RSA_free(ret->rsa);
ret->rsa = k->rsa;
@@ -1315,8 +1313,8 @@ sshkey_read(struct sshkey *ret, char **cpp)
#ifdef DEBUG_PK
RSA_print_fp(stderr, ret->rsa, 8);
#endif
- }
- if (sshkey_type_plain(ret->type) == KEY_DSA) {
+ break;
+ case KEY_DSA:
if (ret->dsa != NULL)
DSA_free(ret->dsa);
ret->dsa = k->dsa;
@@ -1324,8 +1322,8 @@ sshkey_read(struct sshkey *ret, char **cpp)
#ifdef DEBUG_PK
DSA_print_fp(stderr, ret->dsa, 8);
#endif
- }
- if (sshkey_type_plain(ret->type) == KEY_ECDSA) {
+ break;
+ case KEY_ECDSA:
if (ret->ecdsa != NULL)
EC_KEY_free(ret->ecdsa);
ret->ecdsa = k->ecdsa;
@@ -1335,16 +1333,18 @@ sshkey_read(struct sshkey *ret, char **cpp)
#ifdef DEBUG_PK
sshkey_dump_ec_key(ret->ecdsa);
#endif
- }
+ break;
#endif /* WITH_OPENSSL */
- if (sshkey_type_plain(ret->type) == KEY_ED25519) {
+ case KEY_ED25519:
free(ret->ed25519_pk);
ret->ed25519_pk = k->ed25519_pk;
k->ed25519_pk = NULL;
#ifdef DEBUG_PK
/* XXX */
#endif
+ break;
}
+ *cpp = ep;
retval = 0;
/*XXXX*/
sshkey_free(k);
@@ -1686,7 +1686,7 @@ sshkey_cert_copy(const struct sshkey *from_key, struct sshkey *to_key)
if ((ret = sshbuf_putb(to->certblob, from->certblob)) != 0 ||
(ret = sshbuf_putb(to->critical, from->critical)) != 0 ||
- (ret = sshbuf_putb(to->extensions, from->extensions) != 0))
+ (ret = sshbuf_putb(to->extensions, from->extensions)) != 0)
return ret;
to->serial = from->serial;
@@ -1727,9 +1727,7 @@ sshkey_from_private(const struct sshkey *k, struct sshkey **pkp)
struct sshkey *n = NULL;
int ret = SSH_ERR_INTERNAL_ERROR;
- if (pkp != NULL)
- *pkp = NULL;
-
+ *pkp = NULL;
switch (k->type) {
#ifdef WITH_OPENSSL
case KEY_DSA:
@@ -2139,7 +2137,7 @@ sshkey_froms(struct sshbuf *buf, struct sshkey **keyp)
int
sshkey_sign(const struct sshkey *key,
u_char **sigp, size_t *lenp,
- const u_char *data, size_t datalen, u_int compat)
+ const u_char *data, size_t datalen, const char *alg, u_int compat)
{
if (sigp != NULL)
*sigp = NULL;
@@ -2157,7 +2155,7 @@ sshkey_sign(const struct sshkey *key,
return ssh_ecdsa_sign(key, sigp, lenp, data, datalen, compat);
case KEY_RSA_CERT:
case KEY_RSA:
- return ssh_rsa_sign(key, sigp, lenp, data, datalen, compat);
+ return ssh_rsa_sign(key, sigp, lenp, data, datalen, alg);
#endif /* WITH_OPENSSL */
case KEY_ED25519:
case KEY_ED25519_CERT:
@@ -2187,7 +2185,7 @@ sshkey_verify(const struct sshkey *key,
return ssh_ecdsa_verify(key, sig, siglen, data, dlen, compat);
case KEY_RSA_CERT:
case KEY_RSA:
- return ssh_rsa_verify(key, sig, siglen, data, dlen, compat);
+ return ssh_rsa_verify(key, sig, siglen, data, dlen);
#endif /* WITH_OPENSSL */
case KEY_ED25519:
case KEY_ED25519_CERT:
@@ -2204,9 +2202,7 @@ sshkey_demote(const struct sshkey *k, struct sshkey **dkp)
struct sshkey *pk;
int ret = SSH_ERR_INTERNAL_ERROR;
- if (dkp != NULL)
- *dkp = NULL;
-
+ *dkp = NULL;
if ((pk = calloc(1, sizeof(*pk))) == NULL)
return SSH_ERR_ALLOC_FAIL;
pk->type = k->type;
@@ -2419,7 +2415,7 @@ sshkey_certify(struct sshkey *k, struct sshkey *ca)
/* Sign the whole mess */
if ((ret = sshkey_sign(ca, &sig_blob, &sig_len, sshbuf_ptr(cert),
- sshbuf_len(cert), 0)) != 0)
+ sshbuf_len(cert), NULL, 0)) != 0)
goto out;
/* Append signature and we are done */
@@ -2429,12 +2425,9 @@ sshkey_certify(struct sshkey *k, struct sshkey *ca)
out:
if (ret != 0)
sshbuf_reset(cert);
- if (sig_blob != NULL)
- free(sig_blob);
- if (ca_blob != NULL)
- free(ca_blob);
- if (principals != NULL)
- sshbuf_free(principals);
+ free(sig_blob);
+ free(ca_blob);
+ sshbuf_free(principals);
return ret;
}
@@ -2495,6 +2488,43 @@ sshkey_cert_check_authority(const struct sshkey *k,
return 0;
}
+size_t
+sshkey_format_cert_validity(const struct sshkey_cert *cert, char *s, size_t l)
+{
+ char from[32], to[32], ret[64];
+ time_t tt;
+ struct tm *tm;
+
+ *from = *to = '\0';
+ if (cert->valid_after == 0 &&
+ cert->valid_before == 0xffffffffffffffffULL)
+ return strlcpy(s, "forever", l);
+
+ if (cert->valid_after != 0) {
+ /* XXX revisit INT_MAX in 2038 :) */
+ tt = cert->valid_after > INT_MAX ?
+ INT_MAX : cert->valid_after;
+ tm = localtime(&tt);
+ strftime(from, sizeof(from), "%Y-%m-%dT%H:%M:%S", tm);
+ }
+ if (cert->valid_before != 0xffffffffffffffffULL) {
+ /* XXX revisit INT_MAX in 2038 :) */
+ tt = cert->valid_before > INT_MAX ?
+ INT_MAX : cert->valid_before;
+ tm = localtime(&tt);
+ strftime(to, sizeof(to), "%Y-%m-%dT%H:%M:%S", tm);
+ }
+
+ if (cert->valid_after == 0)
+ snprintf(ret, sizeof(ret), "before %s", to);
+ else if (cert->valid_before == 0xffffffffffffffffULL)
+ snprintf(ret, sizeof(ret), "after %s", from);
+ else
+ snprintf(ret, sizeof(ret), "from %s to %s", from, to);
+
+ return strlcpy(s, ret, l);
+}
+
int
sshkey_private_serialize(const struct sshkey *key, struct sshbuf *b)
{
@@ -2655,7 +2685,7 @@ sshkey_private_deserialize(struct sshbuf *buf, struct sshkey **kp)
goto out;
}
if ((r = sshkey_ec_validate_public(EC_KEY_get0_group(k->ecdsa),
- EC_KEY_get0_public_key(k->ecdsa)) != 0) ||
+ EC_KEY_get0_public_key(k->ecdsa))) != 0 ||
(r = sshkey_ec_validate_private(k->ecdsa)) != 0)
goto out;
break;
@@ -2673,7 +2703,7 @@ sshkey_private_deserialize(struct sshbuf *buf, struct sshkey **kp)
goto out;
}
if ((r = sshkey_ec_validate_public(EC_KEY_get0_group(k->ecdsa),
- EC_KEY_get0_public_key(k->ecdsa)) != 0) ||
+ EC_KEY_get0_public_key(k->ecdsa))) != 0 ||
(r = sshkey_ec_validate_private(k->ecdsa)) != 0)
goto out;
break;
@@ -2694,10 +2724,10 @@ sshkey_private_deserialize(struct sshbuf *buf, struct sshkey **kp)
case KEY_RSA_CERT:
if ((r = sshkey_froms(buf, &k)) != 0 ||
(r = sshkey_add_private(k)) != 0 ||
- (r = sshbuf_get_bignum2(buf, k->rsa->d) != 0) ||
- (r = sshbuf_get_bignum2(buf, k->rsa->iqmp) != 0) ||
- (r = sshbuf_get_bignum2(buf, k->rsa->p) != 0) ||
- (r = sshbuf_get_bignum2(buf, k->rsa->q) != 0) ||
+ (r = sshbuf_get_bignum2(buf, k->rsa->d)) != 0 ||
+ (r = sshbuf_get_bignum2(buf, k->rsa->iqmp)) != 0 ||
+ (r = sshbuf_get_bignum2(buf, k->rsa->p)) != 0 ||
+ (r = sshbuf_get_bignum2(buf, k->rsa->q)) != 0 ||
(r = rsa_generate_additional_parameters(k->rsa)) != 0)
goto out;
break;
@@ -3384,9 +3414,9 @@ sshkey_private_rsa1_to_blob(struct sshkey *key, struct sshbuf *blob,
/* Store public key. This will be in plain text. */
if ((r = sshbuf_put_u32(encrypted, BN_num_bits(key->rsa->n))) != 0 ||
- (r = sshbuf_put_bignum1(encrypted, key->rsa->n) != 0) ||
- (r = sshbuf_put_bignum1(encrypted, key->rsa->e) != 0) ||
- (r = sshbuf_put_cstring(encrypted, comment) != 0))
+ (r = sshbuf_put_bignum1(encrypted, key->rsa->n)) != 0 ||
+ (r = sshbuf_put_bignum1(encrypted, key->rsa->e)) != 0 ||
+ (r = sshbuf_put_cstring(encrypted, comment)) != 0)
goto out;
/* Allocate space for the private part of the key in the buffer. */
@@ -3407,10 +3437,8 @@ sshkey_private_rsa1_to_blob(struct sshkey *key, struct sshbuf *blob,
out:
explicit_bzero(&ciphercontext, sizeof(ciphercontext));
explicit_bzero(buf, sizeof(buf));
- if (buffer != NULL)
- sshbuf_free(buffer);
- if (encrypted != NULL)
- sshbuf_free(encrypted);
+ sshbuf_free(buffer);
+ sshbuf_free(encrypted);
return r;
}
@@ -3558,10 +3586,8 @@ sshkey_parse_public_rsa1_fileblob(struct sshbuf *blob,
pub = NULL;
out:
- if (copy != NULL)
- sshbuf_free(copy);
- if (pub != NULL)
- sshkey_free(pub);
+ sshbuf_free(copy);
+ sshkey_free(pub);
return r;
}
@@ -3673,14 +3699,10 @@ sshkey_parse_private_rsa1(struct sshbuf *blob, const char *passphrase,
}
out:
explicit_bzero(&ciphercontext, sizeof(ciphercontext));
- if (comment != NULL)
- free(comment);
- if (prv != NULL)
- sshkey_free(prv);
- if (copy != NULL)
- sshbuf_free(copy);
- if (decrypted != NULL)
- sshbuf_free(decrypted);
+ free(comment);
+ sshkey_free(prv);
+ sshbuf_free(copy);
+ sshbuf_free(decrypted);
return r;
}
#endif /* WITH_SSH1 */
@@ -3768,8 +3790,7 @@ sshkey_parse_private_pem_fileblob(struct sshbuf *blob, int type,
BIO_free(bio);
if (pk != NULL)
EVP_PKEY_free(pk);
- if (prv != NULL)
- sshkey_free(prv);
+ sshkey_free(prv);
return r;
}
#endif /* WITH_OPENSSL */
@@ -3778,8 +3799,6 @@ int
sshkey_parse_private_fileblob_type(struct sshbuf *blob, int type,
const char *passphrase, struct sshkey **keyp, char **commentp)
{
- int r;
-
*keyp = NULL;
if (commentp != NULL)
*commentp = NULL;
@@ -3801,8 +3820,8 @@ sshkey_parse_private_fileblob_type(struct sshbuf *blob, int type,
return sshkey_parse_private2(blob, type, passphrase,
keyp, commentp);
case KEY_UNSPEC:
- if ((r = sshkey_parse_private2(blob, type, passphrase, keyp,
- commentp)) == 0)
+ if (sshkey_parse_private2(blob, type, passphrase, keyp,
+ commentp) == 0)
return 0;
#ifdef WITH_OPENSSL
return sshkey_parse_private_pem_fileblob(blob, type,
@@ -3817,10 +3836,8 @@ sshkey_parse_private_fileblob_type(struct sshbuf *blob, int type,
int
sshkey_parse_private_fileblob(struct sshbuf *buffer, const char *passphrase,
- const char *filename, struct sshkey **keyp, char **commentp)
+ struct sshkey **keyp, char **commentp)
{
- int r;
-
if (keyp != NULL)
*keyp = NULL;
if (commentp != NULL)
@@ -3828,13 +3845,11 @@ sshkey_parse_private_fileblob(struct sshbuf *buffer, const char *passphrase,
#ifdef WITH_SSH1
/* it's a SSH v1 key if the public key part is readable */
- if ((r = sshkey_parse_public_rsa1_fileblob(buffer, NULL, NULL)) == 0) {
+ if (sshkey_parse_public_rsa1_fileblob(buffer, NULL, NULL) == 0) {
return sshkey_parse_private_fileblob_type(buffer, KEY_RSA1,
passphrase, keyp, commentp);
}
#endif /* WITH_SSH1 */
- if ((r = sshkey_parse_private_fileblob_type(buffer, KEY_UNSPEC,
- passphrase, keyp, commentp)) == 0)
- return 0;
- return r;
+ return sshkey_parse_private_fileblob_type(buffer, KEY_UNSPEC,
+ passphrase, keyp, commentp);
}
diff --git a/crypto/external/bsd/openssh/dist/sshlogin.c b/crypto/external/bsd/openssh/dist/sshlogin.c
index 45b7f8e721d..37ffaefdfd3 100644
--- a/crypto/external/bsd/openssh/dist/sshlogin.c
+++ b/crypto/external/bsd/openssh/dist/sshlogin.c
@@ -1,5 +1,6 @@
-/* $NetBSD: sshlogin.c,v 1.6 2015/04/03 23:58:19 christos Exp $ */
-/* $OpenBSD: sshlogin.c,v 1.31 2015/01/20 23:14:00 deraadt Exp $ */
+/* $NetBSD: sshlogin.c,v 1.7 2016/03/11 01:55:00 christos Exp $ */
+/* $OpenBSD: sshlogin.c,v 1.32 2015/12/26 20:51:35 guenther Exp $ */
+
/*
* Author: Tatu Ylonen <ylo@cs.hut.fi>
* Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
@@ -41,7 +42,7 @@
*/
#include "includes.h"
-__RCSID("$NetBSD: sshlogin.c,v 1.6 2015/04/03 23:58:19 christos Exp $");
+__RCSID("$NetBSD: sshlogin.c,v 1.7 2016/03/11 01:55:00 christos Exp $");
#include <sys/param.h>
#include <sys/types.h>
#include <sys/socket.h>
@@ -108,7 +109,7 @@ get_last_login_time(uid_t uid, const char *logname,
if (fd < 0)
return 0;
- pos = (long) uid * sizeof(ll);
+ pos = (off_t)uid * sizeof(ll);
r = lseek(fd, pos, SEEK_SET);
if (r == -1) {
error("%s: lseek: %s", __func__, strerror(errno));
@@ -216,7 +217,7 @@ record_login(pid_t pid, const char *tty, const char *user, uid_t uid,
strncpy(ll.ll_host, host, sizeof(ll.ll_host));
fd = open(_PATH_LASTLOG, O_RDWR);
if (fd >= 0) {
- lseek(fd, (off_t) ((long) uid * sizeof(ll)), SEEK_SET);
+ lseek(fd, (off_t)uid * sizeof(ll), SEEK_SET);
if (write(fd, &ll, sizeof(ll)) != sizeof(ll))
logit("Could not write %.100s: %.100s", _PATH_LASTLOG, strerror(errno));
close(fd);
diff --git a/crypto/external/bsd/openssh/dist/version.h b/crypto/external/bsd/openssh/dist/version.h
index 7eca106a507..2705c90fa4a 100644
--- a/crypto/external/bsd/openssh/dist/version.h
+++ b/crypto/external/bsd/openssh/dist/version.h
@@ -1,8 +1,8 @@
-/* $NetBSD: version.h,v 1.19 2016/01/19 17:10:55 christos Exp $ */
-/* $OpenBSD: version.h,v 1.75 2015/08/21 03:45:26 djm Exp $ */
+/* $NetBSD: version.h,v 1.20 2016/03/11 01:55:00 christos Exp $ */
+/* $OpenBSD: version.h,v 1.76 2016/02/23 09:14:34 djm Exp $ */
-#define __OPENSSH_VERSION "OpenSSH_7.1"
-#define __NETBSDSSH_VERSION "NetBSD_Secure_Shell-20160119"
+#define __OPENSSH_VERSION "OpenSSH_7.2"
+#define __NETBSDSSH_VERSION "NetBSD_Secure_Shell-20160310"
#define SSH_HPN "-hpn13v14"
#define SSH_LPK "-lpk"
/*
diff --git a/crypto/external/bsd/openssh/dist/xmalloc.c b/crypto/external/bsd/openssh/dist/xmalloc.c
index 35c3485bd54..8bc3c417c3d 100644
--- a/crypto/external/bsd/openssh/dist/xmalloc.c
+++ b/crypto/external/bsd/openssh/dist/xmalloc.c
@@ -1,5 +1,6 @@
-/* $NetBSD: xmalloc.c,v 1.6 2015/07/03 01:00:00 christos Exp $ */
-/* $OpenBSD: xmalloc.c,v 1.32 2015/04/24 01:36:01 deraadt Exp $ */
+/* $NetBSD: xmalloc.c,v 1.7 2016/03/11 01:55:00 christos Exp $ */
+/* $OpenBSD: xmalloc.c,v 1.33 2016/02/15 09:47:49 dtucker Exp $ */
+
/*
* Author: Tatu Ylonen <ylo@cs.hut.fi>
* Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
@@ -15,7 +16,7 @@
*/
#include "includes.h"
-__RCSID("$NetBSD: xmalloc.c,v 1.6 2015/07/03 01:00:00 christos Exp $");
+__RCSID("$NetBSD: xmalloc.c,v 1.7 2016/03/11 01:55:00 christos Exp $");
#include <sys/param.h>
#include <stdarg.h>
#include <stdint.h>
@@ -26,6 +27,16 @@ __RCSID("$NetBSD: xmalloc.c,v 1.6 2015/07/03 01:00:00 christos Exp $");
#include "xmalloc.h"
#include "log.h"
+void
+ssh_malloc_init(void)
+{
+#ifndef __NetBSD__
+ extern char *malloc_options;
+
+ malloc_options = "S";
+#endif
+}
+
void *
xmalloc(size_t size)
{
diff --git a/crypto/external/bsd/openssh/dist/xmalloc.h b/crypto/external/bsd/openssh/dist/xmalloc.h
index 2633fb69372..3c5851b3233 100644
--- a/crypto/external/bsd/openssh/dist/xmalloc.h
+++ b/crypto/external/bsd/openssh/dist/xmalloc.h
@@ -1,5 +1,5 @@
-/* $NetBSD: xmalloc.h,v 1.6 2015/07/03 01:00:00 christos Exp $ */
-/* $OpenBSD: xmalloc.h,v 1.15 2015/04/24 01:36:01 deraadt Exp $ */
+/* $NetBSD: xmalloc.h,v 1.7 2016/03/11 01:55:00 christos Exp $ */
+/* $OpenBSD: xmalloc.h,v 1.16 2016/02/15 09:47:49 dtucker Exp $ */
/*
* Author: Tatu Ylonen <ylo@cs.hut.fi>
@@ -17,6 +17,7 @@
* called by a name other than "ssh" or "Secure Shell".
*/
+void ssh_malloc_init(void);
void *xmalloc(size_t);
void *xcalloc(size_t, size_t);
void *xreallocarray(void *, size_t, size_t);