Skip to content

Commit 3928cc8

Browse files
tgauthtgauth
committed
re-merge 9.2
2 parents 94adf70 + 12f321c commit 3928cc8

File tree

135 files changed

+8199
-6216
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

135 files changed

+8199
-6216
lines changed

‎.depend

Lines changed: 2 additions & 6 deletions
Large diffs are not rendered by default.

‎.github/ci-status.md

Lines changed: 9 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,10 @@
1-
[![C/C++ CI](https://github.com/openssh/openssh-portable/actions/workflows/c-cpp.yml/badge.svg)](https://github.com/openssh/openssh-portable/actions/workflows/c-cpp.yml)
2-
[![C/C++ CI self-hosted](https://github.com/openssh/openssh-portable-selfhosted/actions/workflows/selfhosted.yml/badge.svg)](https://github.com/openssh/openssh-portable-selfhosted/actions/workflows/selfhosted.yml)
3-
[![Upstream self-hosted](https://github.com/openssh/openssh-portable-selfhosted/actions/workflows/upstream.yml/badge.svg)](https://github.com/openssh/openssh-portable-selfhosted/actions/workflows/upstream.yml)
1+
master :
2+
[![C/C++ CI](https://github.com/openssh/openssh-portable/actions/workflows/c-cpp.yml/badge.svg)](https://github.com/openssh/openssh-portable/actions/workflows/c-cpp.yml?query=branch:master)
3+
[![C/C++ CI self-hosted](https://github.com/openssh/openssh-portable-selfhosted/actions/workflows/selfhosted.yml/badge.svg)](https://github.com/openssh/openssh-portable-selfhosted/actions/workflows/selfhosted.yml?query=branch:master)
4+
[![Upstream self-hosted](https://github.com/openssh/openssh-portable-selfhosted/actions/workflows/upstream.yml/badge.svg)](https://github.com/openssh/openssh-portable-selfhosted/actions/workflows/upstream.yml?query=branch:master)
5+
[![CIFuzz](https://github.com/openssh/openssh-portable/actions/workflows/cifuzz.yml/badge.svg)](https://github.com/openssh/openssh-portable/actions/workflows/cifuzz.yml)
46
[![Fuzzing Status](https://oss-fuzz-build-logs.storage.googleapis.com/badges/openssh.svg)](https://bugs.chromium.org/p/oss-fuzz/issues/list?sort=-opened&can=1&q=proj:openssh)
7+
8+
9.1 :
9+
[![C/C++ CI](https://github.com/openssh/openssh-portable/actions/workflows/c-cpp.yml/badge.svg?branch=V_9_1)](https://github.com/openssh/openssh-portable/actions/workflows/c-cpp.yml?query=branch:V_9_1)
10+
[![C/C++ CI self-hosted](https://github.com/openssh/openssh-portable-selfhosted/actions/workflows/selfhosted.yml/badge.svg?branch=V_9_1)](https://github.com/openssh/openssh-portable-selfhosted/actions/workflows/selfhosted.yml?query=branch:V_9_1)

‎.github/configs

Lines changed: 33 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -9,10 +9,13 @@
99
# LTESTS
1010

1111
config=$1
12+
if [ "$config" = "" ]; then
13+
config="default"
14+
fi
1215

1316
unset CC CFLAGS CPPFLAGS LDFLAGS LTESTS SUDO
1417

15-
TEST_TARGET="tests"
18+
TEST_TARGET="tests compat-tests"
1619
LTESTS=""
1720
SKIP_LTESTS=""
1821
SUDO=sudo # run with sudo by default
@@ -108,7 +111,7 @@ case "$config" in
108111
kitchensink)
109112
CONFIGFLAGS="--with-kerberos5 --with-libedit --with-pam"
110113
CONFIGFLAGS="${CONFIGFLAGS} --with-security-key-builtin --with-selinux"
111-
CONFIGFLAGS="${CONFIGFLAGS} --with-cflags=-DSK_DEBUG"
114+
CFLAGS="-DSK_DEBUG -DSANDBOX_SECCOMP_FILTER_DEBUG"
112115
;;
113116
hardenedmalloc)
114117
CONFIGFLAGS="--with-ldflags=-lhardened_malloc"
@@ -141,6 +144,11 @@ case "$config" in
141144
;;
142145
openssl-*)
143146
LIBCRYPTOFLAGS="--with-ssl-dir=/opt/openssl --with-rpath=-Wl,-rpath,"
147+
# OpenSSL 1.1.1 specifically has a bug in its RNG that breaks reexec
148+
# fallback. See https://bugzilla.mindrot.org/show_bug.cgi?id=3483
149+
if [ "$config" = "openssl-1.1.1" ]; then
150+
SKIP_LTESTS="reexec"
151+
fi
144152
;;
145153
selinux)
146154
CONFIGFLAGS="--with-selinux"
@@ -152,7 +160,7 @@ case "$config" in
152160
LIBCRYPTOFLAGS="--without-openssl"
153161
TEST_TARGET=t-exec
154162
;;
155-
valgrind-[1-4]|valgrind-unit)
163+
valgrind-[1-5]|valgrind-unit)
156164
# rlimit sandbox and FORTIFY_SOURCE confuse Valgrind.
157165
CONFIGFLAGS="--without-sandbox --without-hardening"
158166
CONFIGFLAGS="$CONFIGFLAGS --with-cppflags=-D_FORTIFY_SOURCE=0"
@@ -161,16 +169,19 @@ case "$config" in
161169
export TEST_SSH_ELAPSED_TIMES
162170
# Valgrind slows things down enough that the agent timeout test
163171
# won't reliably pass, and the unit tests run longer than allowed
164-
# by github so split into three separate tests.
165-
tests2="rekey integrity try-ciphers"
172+
# by github so split into separate tests.
173+
tests2="integrity try-ciphers"
166174
tests3="krl forward-control sshsig agent-restrict kextype sftp"
167175
tests4="cert-userkey cert-hostkey kextype sftp-perm keygen-comment percent"
176+
tests5="rekey"
168177
case "$config" in
169178
valgrind-1)
170-
# All tests except agent-timeout (which is flaky under valgrind)
179+
# All tests except agent-timeout (which is flaky under valgrind),
180+
# connection-timeout (which doesn't work since it's so slow)
171181
# and hostbased (since valgrind won't let ssh exec keysign).
172182
# Slow ones are run separately to increase parallelism.
173-
SKIP_LTESTS="agent-timeout hostbased ${tests2} ${tests3} ${tests4}"
183+
SKIP_LTESTS="agent-timeout connection-timeout hostbased"
184+
SKIP_LTESTS="$SKIP_LTESTS ${tests2} ${tests3} ${tests4} ${tests5}"
174185
;;
175186
valgrind-2)
176187
LTESTS="${tests2}"
@@ -181,6 +192,9 @@ case "$config" in
181192
valgrind-4)
182193
LTESTS="${tests4}"
183194
;;
195+
valgrind-5)
196+
LTESTS="${tests5}"
197+
;;
184198
valgrind-unit)
185199
TEST_TARGET="unit USE_VALGRIND=1"
186200
;;
@@ -210,6 +224,10 @@ case "${TARGET_HOST}" in
210224
TEST_TARGET="t-exec TEST_SHELL=bash"
211225
SKIP_LTESTS="rekey sftp"
212226
;;
227+
debian-riscv64)
228+
# This machine is fairly slow, so skip the unit tests.
229+
TEST_TARGET="t-exec"
230+
;;
213231
dfly58*|dfly60*)
214232
# scp 3-way connection hangs on these so skip until sorted.
215233
SKIP_LTESTS=scp3
@@ -227,12 +245,15 @@ case "${TARGET_HOST}" in
227245
# test that relies on one.
228246
# Also, Minix seems to be very limited in the number of select()
229247
# calls that can be operating concurrently, so prune additional tests for that.
230-
T="addrmatch agent-restrict brokenkeys cfgmatch cfgmatchlisten cfgparse connect
231-
connect-uri exit-status forward-control forwarding hostkey-agent
232-
key-options keyscan knownhosts-command login-timeout multiplex
248+
T="addrmatch agent-restrict brokenkeys cfgmatch cfgmatchlisten cfgparse
249+
connect connect-uri exit-status forwarding hostkey-agent
250+
key-options keyscan knownhosts-command login-timeout
233251
reconfigure reexec rekey scp scp-uri scp3 sftp sftp-badcmds
234252
sftp-batch sftp-cmds sftp-glob sftp-perm sftp-uri stderr-data
235253
transfer"
254+
# Unix domain sockets don't work quite like we expect, so also skip any tests
255+
# that use multiplexing.
256+
T="$T connection-timeout dynamic-forward forward-control multiplex"
236257
SKIP_LTESTS="$(echo $T)"
237258
TEST_TARGET=t-exec
238259
SUDO=""
@@ -260,6 +281,8 @@ esac
260281
case "`./config.guess`" in
261282
*cygwin)
262283
SUDO=""
284+
# Don't run compat tests on cygwin as they don't currently compile.
285+
TEST_TARGET="tests"
263286
;;
264287
*-darwin*)
265288
# Unless specified otherwise, build without OpenSSL on Mac OS since

‎.github/setup_ci.sh

Lines changed: 16 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -139,16 +139,29 @@ if [ "yes" = "$INSTALL_FIDO_PPA" ]; then
139139
sudo apt-add-repository -y ppa:yubico/stable
140140
fi
141141

142-
if [ "x" != "x$PACKAGES" ]; then
142+
tries=3
143+
while [ ! -z "$PACKAGES" ] && [ "$tries" -gt "0" ]; do
143144
case "$PACKAGER" in
144145
apt)
145146
sudo apt update -qq
146-
sudo apt install -qy $PACKAGES
147+
if sudo apt install -qy $PACKAGES; then
148+
PACKAGES=""
149+
fi
147150
;;
148151
setup)
149-
/cygdrive/c/setup.exe -q -P `echo "$PACKAGES" | tr ' ' ,`
152+
if /cygdrive/c/setup.exe -q -P `echo "$PACKAGES" | tr ' ' ,`; then
153+
PACKAGES=""
154+
fi
150155
;;
151156
esac
157+
if [ ! -z "$PACKAGES" ]; then
158+
sleep 90
159+
fi
160+
tries=$(($tries - 1))
161+
done
162+
if [ ! -z "$PACKAGES" ]; then
163+
echo "Package installation failed."
164+
exit 1
152165
fi
153166

154167
if [ "${INSTALL_HARDENED_MALLOC}" = "yes" ]; then

‎.github/workflows/c-cpp.yml

Lines changed: 79 additions & 79 deletions
Original file line numberDiff line numberDiff line change
@@ -1,118 +1,118 @@
11
name: C/C++ CI
22

33
on:
4-
push:
5-
branches: [ master, ci, V_9_0 ]
6-
paths: [ '**.c', '**.h', '**.m4', '**.sh', '.github/**', 'Makefile.in', 'configure.ac' ]
7-
pull_request:
8-
branches: [ master ]
9-
paths: [ '**.c', '**.h', '**.m4', '**.sh', '.github/**', 'Makefile.in', 'configure.ac' ]
10-
4+
workflow_dispatch:
5+
116
jobs:
127
ci:
138
if: github.repository != 'openssh/openssh-portable-selfhosted'
149
strategy:
1510
fail-fast: false
1611
matrix:
1712
# First we test all OSes in the default configuration.
18-
os: [ubuntu-20.04, ubuntu-22.04, macos-11, macos-12, windows-2019, windows-2022]
19-
configs: [default]
13+
target: [ubuntu-20.04, ubuntu-22.04, macos-11, macos-12, windows-2019, windows-2022]
14+
config: [default]
2015
# Then we include any extra configs we want to test for specific VMs.
2116
# Valgrind slows things down quite a bit, so start them first.
2217
include:
23-
- { os: windows-2019, configs: cygwin-release }
24-
- { os: windows-2022, configs: cygwin-release }
25-
- { os: ubuntu-20.04, configs: valgrind-1 }
26-
- { os: ubuntu-20.04, configs: valgrind-2 }
27-
- { os: ubuntu-20.04, configs: valgrind-3 }
28-
- { os: ubuntu-20.04, configs: valgrind-4 }
29-
- { os: ubuntu-20.04, configs: valgrind-unit }
30-
- { os: ubuntu-20.04, configs: c89 }
31-
- { os: ubuntu-20.04, configs: clang-6.0 }
32-
- { os: ubuntu-20.04, configs: clang-8 }
33-
- { os: ubuntu-20.04, configs: clang-9 }
34-
- { os: ubuntu-20.04, configs: clang-10 }
35-
- { os: ubuntu-20.04, configs: clang-11 }
36-
- { os: ubuntu-20.04, configs: clang-12-Werror }
37-
- { os: ubuntu-20.04, configs: clang-sanitize-address }
38-
- { os: ubuntu-20.04, configs: clang-sanitize-undefined }
39-
- { os: ubuntu-20.04, configs: gcc-sanitize-address }
40-
- { os: ubuntu-20.04, configs: gcc-sanitize-undefined }
41-
- { os: ubuntu-20.04, configs: gcc-7 }
42-
- { os: ubuntu-20.04, configs: gcc-8 }
43-
- { os: ubuntu-20.04, configs: gcc-10 }
44-
- { os: ubuntu-20.04, configs: gcc-11-Werror }
45-
- { os: ubuntu-20.04, configs: pam }
46-
- { os: ubuntu-20.04, configs: kitchensink }
47-
- { os: ubuntu-20.04, configs: hardenedmalloc }
48-
- { os: ubuntu-20.04, configs: tcmalloc }
49-
- { os: ubuntu-20.04, configs: musl }
50-
- { os: ubuntu-latest, configs: libressl-master }
51-
- { os: ubuntu-latest, configs: libressl-2.2.9 }
52-
- { os: ubuntu-latest, configs: libressl-2.8.3 }
53-
- { os: ubuntu-latest, configs: libressl-3.0.2 }
54-
- { os: ubuntu-latest, configs: libressl-3.2.6 }
55-
- { os: ubuntu-latest, configs: libressl-3.3.6 }
56-
- { os: ubuntu-latest, configs: libressl-3.4.3 }
57-
- { os: ubuntu-latest, configs: libressl-3.5.3 }
58-
- { os: ubuntu-latest, configs: openssl-master }
59-
- { os: ubuntu-latest, configs: openssl-noec }
60-
- { os: ubuntu-latest, configs: openssl-1.0.1 }
61-
- { os: ubuntu-latest, configs: openssl-1.0.1u }
62-
- { os: ubuntu-latest, configs: openssl-1.0.2u }
63-
- { os: ubuntu-latest, configs: openssl-1.1.0h }
64-
- { os: ubuntu-latest, configs: openssl-1.1.1 }
65-
- { os: ubuntu-latest, configs: openssl-1.1.1k }
66-
- { os: ubuntu-latest, configs: openssl-1.1.1n }
67-
- { os: ubuntu-latest, configs: openssl-1.1.1p }
68-
- { os: ubuntu-latest, configs: openssl-3.0.0 }
69-
- { os: ubuntu-latest, configs: openssl-3.0.5 }
70-
- { os: ubuntu-latest, configs: openssl-1.1.1_stable } # stable branch
71-
- { os: ubuntu-latest, configs: openssl-3.0 } # stable branch
72-
- { os: ubuntu-22.04, configs: pam }
73-
- { os: ubuntu-22.04, configs: krb5 }
74-
- { os: ubuntu-22.04, configs: heimdal }
75-
- { os: ubuntu-22.04, configs: libedit }
76-
- { os: ubuntu-22.04, configs: sk }
77-
- { os: ubuntu-22.04, configs: selinux }
78-
- { os: ubuntu-22.04, configs: kitchensink }
79-
- { os: ubuntu-22.04, configs: without-openssl }
80-
- { os: macos-11, configs: pam }
81-
- { os: macos-12, configs: pam }
82-
runs-on: ${{ matrix.os }}
18+
- { target: windows-2019, config: cygwin-release }
19+
- { target: windows-2022, config: cygwin-release }
20+
- { target: ubuntu-20.04, config: valgrind-1 }
21+
- { target: ubuntu-20.04, config: valgrind-2 }
22+
- { target: ubuntu-20.04, config: valgrind-3 }
23+
- { target: ubuntu-20.04, config: valgrind-4 }
24+
- { target: ubuntu-20.04, config: valgrind-5 }
25+
- { target: ubuntu-20.04, config: valgrind-unit }
26+
- { target: ubuntu-20.04, config: c89 }
27+
- { target: ubuntu-20.04, config: clang-6.0 }
28+
- { target: ubuntu-20.04, config: clang-8 }
29+
- { target: ubuntu-20.04, config: clang-9 }
30+
- { target: ubuntu-20.04, config: clang-10 }
31+
- { target: ubuntu-20.04, config: clang-11 }
32+
- { target: ubuntu-20.04, config: clang-12-Werror }
33+
- { target: ubuntu-20.04, config: clang-sanitize-address }
34+
- { target: ubuntu-20.04, config: clang-sanitize-undefined }
35+
- { target: ubuntu-20.04, config: gcc-sanitize-address }
36+
- { target: ubuntu-20.04, config: gcc-sanitize-undefined }
37+
- { target: ubuntu-20.04, config: gcc-7 }
38+
- { target: ubuntu-20.04, config: gcc-8 }
39+
- { target: ubuntu-20.04, config: gcc-10 }
40+
- { target: ubuntu-20.04, config: gcc-11-Werror }
41+
- { target: ubuntu-20.04, config: pam }
42+
- { target: ubuntu-20.04, config: kitchensink }
43+
- { target: ubuntu-20.04, config: hardenedmalloc }
44+
- { target: ubuntu-20.04, config: tcmalloc }
45+
- { target: ubuntu-20.04, config: musl }
46+
- { target: ubuntu-latest, config: libressl-master }
47+
- { target: ubuntu-latest, config: libressl-2.2.9 }
48+
- { target: ubuntu-latest, config: libressl-2.8.3 }
49+
- { target: ubuntu-latest, config: libressl-3.0.2 }
50+
- { target: ubuntu-latest, config: libressl-3.2.6 }
51+
- { target: ubuntu-latest, config: libressl-3.3.6 }
52+
- { target: ubuntu-latest, config: libressl-3.4.3 }
53+
- { target: ubuntu-latest, config: libressl-3.5.3 }
54+
- { target: ubuntu-latest, config: libressl-3.6.1 }
55+
- { target: ubuntu-latest, config: libressl-3.7.0 }
56+
- { target: ubuntu-latest, config: openssl-master }
57+
- { target: ubuntu-latest, config: openssl-noec }
58+
- { target: ubuntu-latest, config: openssl-1.0.1 }
59+
- { target: ubuntu-latest, config: openssl-1.0.1u }
60+
- { target: ubuntu-latest, config: openssl-1.0.2u }
61+
- { target: ubuntu-latest, config: openssl-1.1.0h }
62+
- { target: ubuntu-latest, config: openssl-1.1.1 }
63+
- { target: ubuntu-latest, config: openssl-1.1.1k }
64+
- { target: ubuntu-latest, config: openssl-1.1.1n }
65+
- { target: ubuntu-latest, config: openssl-1.1.1q }
66+
- { target: ubuntu-latest, config: openssl-1.1.1s }
67+
- { target: ubuntu-latest, config: openssl-3.0.0 }
68+
- { target: ubuntu-latest, config: openssl-3.0.5 }
69+
- { target: ubuntu-latest, config: openssl-3.0.7 }
70+
- { target: ubuntu-latest, config: openssl-1.1.1_stable }
71+
- { target: ubuntu-latest, config: openssl-3.0 } # stable branch
72+
- { target: ubuntu-22.04, config: pam }
73+
- { target: ubuntu-22.04, config: krb5 }
74+
- { target: ubuntu-22.04, config: heimdal }
75+
- { target: ubuntu-22.04, config: libedit }
76+
- { target: ubuntu-22.04, config: sk }
77+
- { target: ubuntu-22.04, config: selinux }
78+
- { target: ubuntu-22.04, config: kitchensink }
79+
- { target: ubuntu-22.04, config: without-openssl }
80+
- { target: macos-11, config: pam }
81+
- { target: macos-12, config: pam }
82+
runs-on: ${{ matrix.target }}
8383
steps:
8484
- name: set cygwin git params
85-
if: ${{ startsWith(matrix.os, 'windows') }}
85+
if: ${{ startsWith(matrix.target, 'windows') }}
8686
run: git config --global core.autocrlf input
8787
- name: install cygwin
88-
if: ${{ startsWith(matrix.os, 'windows') }}
88+
if: ${{ startsWith(matrix.target, 'windows') }}
8989
uses: cygwin/cygwin-install-action@master
90-
- uses: actions/checkout@v2
90+
- uses: actions/checkout@main
9191
- name: setup CI system
92-
run: sh ./.github/setup_ci.sh ${{ matrix.configs }}
92+
run: sh ./.github/setup_ci.sh ${{ matrix.config }}
9393
- name: autoreconf
9494
run: sh -c autoreconf
9595
- name: configure
96-
run: sh ./.github/configure.sh ${{ matrix.configs }}
96+
run: sh ./.github/configure.sh ${{ matrix.config }}
9797
- name: save config
98-
uses: actions/upload-artifact@v2
98+
uses: actions/upload-artifact@main
9999
with:
100-
name: ${{ matrix.os }}-${{ matrix.configs }}-config
100+
name: ${{ matrix.target }}-${{ matrix.config }}-config
101101
path: config.h
102102
- name: make clean
103103
run: make clean
104104
- name: make
105105
run: make -j2
106106
- name: make tests
107-
run: sh ./.github/run_test.sh ${{ matrix.configs }}
107+
run: sh ./.github/run_test.sh ${{ matrix.config }}
108108
env:
109109
TEST_SSH_UNSAFE_PERMISSIONS: 1
110110
TEST_SSH_HOSTBASED_AUTH: yes
111111
- name: save logs
112112
if: failure()
113-
uses: actions/upload-artifact@v2
113+
uses: actions/upload-artifact@main
114114
with:
115-
name: ${{ matrix.os }}-${{ matrix.configs }}-logs
115+
name: ${{ matrix.target }}-${{ matrix.config }}-logs
116116
path: |
117117
config.h
118118
config.log

‎.github/workflows/cifuzz.yml

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
name: CIFuzz
2+
on:
3+
workflow_dispatch:
4+
5+
jobs:
6+
Fuzzing:
7+
if: github.repository != 'openssh/openssh-portable-selfhosted'
8+
runs-on: ubuntu-latest
9+
steps:
10+
- name: Build Fuzzers
11+
id: build
12+
uses: google/oss-fuzz/infra/cifuzz/actions/build_fuzzers@master
13+
with:
14+
oss-fuzz-project-name: 'openssh'
15+
dry-run: false
16+
language: c++
17+
- name: Run Fuzzers
18+
uses: google/oss-fuzz/infra/cifuzz/actions/run_fuzzers@master
19+
with:
20+
oss-fuzz-project-name: 'openssh'
21+
fuzz-seconds: 600
22+
dry-run: false
23+
language: c++
24+
- name: Upload Crash
25+
uses: actions/upload-artifact@main
26+
if: failure() && steps.build.outcome == 'success'
27+
with:
28+
name: artifacts
29+
path: ./out/artifacts

0 commit comments

Comments
 (0)