Skip to content

Commit 5c1ad8d

Browse files
rapier1rapier1
committed
This is the 18.1.0 release of HPN-SSH based on OpenSSH 9.4. The major changes
included in this release are the introduction of a parallel ChaCha20-Poly1305 cipher called [email protected]. This is now the default cipher used by HPN-SSH. You may use the serial version of the cipher by explcitly calling it with [email protected] if you perfer. However, this will only have an impact on the local instantiation of hpnssh or hpnsshd. To use serial ChaCha20 on both ends of the connection you must run both the server and client with the serial version. We have also imrpoved the efficacy of the Poly1305 MAC by using OpenSSL functions to compute the MAC instead of the portable C implementation included in OpenSSH. Our implemtation of Poly1305 will fall back to the portable implementation if the OpenSSL EVP is not available. There have been other minor changes to improve code readability, improve compatibility with LibreSSL, support Alpine more gracefully, and so forth. Lastly, the versioning scheme as been normalize to Major.Minor.Fix. For example, this version is 18.1.0 meaning that it is the 18th Major release, the 1st minor release, and there 0 fixes/patches applied. In this scheme a minor bug fix will increment the Fix value. A forward port to a new version of OpenSSH or a performance improvement will increment the Minor value (and reset the Fix value). The introduction of a major change or functionality will increment the Major value while resetting both Minor and Fix to 1 and 0 respectively. Okayed by [email protected] and [email protected]
2 parents ab94957 + e1c4cf3 commit 5c1ad8d

File tree

123 files changed

+3688
-2245
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

123 files changed

+3688
-2245
lines changed

‎.depend‎

Lines changed: 6 additions & 4 deletions
Large diffs are not rendered by default.

‎.github/ci-status.md‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,6 @@ master :
66
[![Fuzzing Status](https://oss-fuzz-build-logs.storage.googleapis.com/badges/openssh.svg)](https://bugs.chromium.org/p/oss-fuzz/issues/list?sort=-opened&can=1&q=proj:openssh)
77
[![Coverity Status](https://scan.coverity.com/projects/21341/badge.svg)](https://scan.coverity.com/projects/openssh-portable)
88

9-
9.2 :
10-
[![C/C++ CI](https://github.com/openssh/openssh-portable/actions/workflows/c-cpp.yml/badge.svg?branch=V_9_2)](https://github.com/openssh/openssh-portable/actions/workflows/c-cpp.yml?query=branch:V_9_2)
11-
[![C/C++ CI self-hosted](https://github.com/openssh/openssh-portable-selfhosted/actions/workflows/selfhosted.yml/badge.svg?branch=V_9_2)](https://github.com/openssh/openssh-portable-selfhosted/actions/workflows/selfhosted.yml?query=branch:V_9_2)
9+
9.3 :
10+
[![C/C++ CI](https://github.com/openssh/openssh-portable/actions/workflows/c-cpp.yml/badge.svg?branch=V_9_3)](https://github.com/openssh/openssh-portable/actions/workflows/c-cpp.yml?query=branch:V_9_3)
11+
[![C/C++ CI self-hosted](https://github.com/openssh/openssh-portable-selfhosted/actions/workflows/selfhosted.yml/badge.svg?branch=V_9_3)](https://github.com/openssh/openssh-portable-selfhosted/actions/workflows/selfhosted.yml?query=branch:V_9_3)

‎.github/configs‎

Lines changed: 48 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -81,7 +81,8 @@ case "$config" in
8181
CFLAGS="-fsanitize=memory -fsanitize-memory-track-origins -fno-omit-frame-pointer"
8282
LDFLAGS="-fsanitize=memory"
8383
CPPFLAGS='-Dchroot=chdir -Dexplicit_bzero=bzero -DMSAN_OPTIONS=\"log_path='$SANLOGS'/msan.log\"'
84-
CONFIGFLAGS="--without-openssl --without-zlib --without-shadow"
84+
CONFIGFLAGS="--without-zlib --without-shadow"
85+
LIBCRYPTOFLAGS="--without-openssl"
8586
TEST_TARGET="t-exec"
8687
;;
8788
*-sanitize-undefined)
@@ -139,6 +140,10 @@ case "$config" in
139140
CONFIGFLAGS="--with-pam"
140141
SSHD_CONFOPTS="UsePam yes"
141142
;;
143+
boringssl)
144+
CONFIGFLAGS="--disable-pkcs11"
145+
LIBCRYPTOFLAGS="--with-ssl-dir=/opt/boringssl --with-rpath=-Wl,-rpath,"
146+
;;
142147
libressl-*)
143148
LIBCRYPTOFLAGS="--with-ssl-dir=/opt/libressl --with-rpath=-Wl,-rpath,"
144149
;;
@@ -160,7 +165,7 @@ case "$config" in
160165
LIBCRYPTOFLAGS="--without-openssl"
161166
TEST_TARGET=t-exec
162167
;;
163-
valgrind-[1-5]|valgrind-unit)
168+
valgrind-[1-7]|valgrind-unit)
164169
# rlimit sandbox and FORTIFY_SOURCE confuse Valgrind.
165170
CONFIGFLAGS="--without-sandbox --without-hardening"
166171
CONFIGFLAGS="$CONFIGFLAGS --with-cppflags=-D_FORTIFY_SOURCE=0"
@@ -171,17 +176,19 @@ case "$config" in
171176
# won't reliably pass, and the unit tests run longer than allowed
172177
# by github so split into separate tests.
173178
tests2="integrity try-ciphers"
174-
tests3="krl forward-control sshsig agent-restrict kextype sftp"
175-
tests4="cert-userkey cert-hostkey kextype sftp-perm keygen-comment percent"
179+
tests3="krl forward-control sshsig"
180+
tests4="cert-userkey cert-hostkey"
176181
tests5="rekey"
182+
tests6="agent-restrict kextype sftp"
183+
tests7="kextype sftp-perm keygen-comment percent"
177184
case "$config" in
178185
valgrind-1)
179186
# All tests except agent-timeout (which is flaky under valgrind),
180187
# connection-timeout (which doesn't work since it's so slow)
181188
# and hostbased (since valgrind won't let ssh exec keysign).
182189
# Slow ones are run separately to increase parallelism.
183190
SKIP_LTESTS="agent-timeout connection-timeout hostbased"
184-
SKIP_LTESTS="$SKIP_LTESTS ${tests2} ${tests3} ${tests4} ${tests5}"
191+
SKIP_LTESTS="$SKIP_LTESTS ${tests2} ${tests3} ${tests4} ${tests5} ${tests6} ${tests7}"
185192
;;
186193
valgrind-2)
187194
LTESTS="${tests2}"
@@ -195,6 +202,12 @@ case "$config" in
195202
valgrind-5)
196203
LTESTS="${tests5}"
197204
;;
205+
valgrind-6)
206+
LTESTS="${tests6}"
207+
;;
208+
valgrind-7)
209+
LTESTS="${tests7}"
210+
;;
198211
valgrind-unit)
199212
TEST_TARGET="unit USE_VALGRIND=1"
200213
;;
@@ -209,13 +222,15 @@ esac
209222
# The Solaris 64bit targets are special since they need a non-flag arg.
210223
case "$config" in
211224
sol64*)
212-
CONFIGFLAGS="x86_64 --with-cflags=-m64 --with-ldflags=-m64 ${CONFIGFLAGS}"
213-
LIBCRYPTOFLAGS="--with-ssl-dir=/usr/local/ssl64"
225+
CONFIGFLAGS="--target=x86_64 --with-cflags=-m64 --with-ldflags=-m64 ${CONFIGFLAGS}"
226+
LIBCRYPTOFLAGS="--with-ssl-dir=/usr/local/ssl64 --with-rpath=-Wl,-rpath,"
214227
;;
215228
esac
216229

217230
case "${TARGET_HOST}" in
218231
aix*)
232+
CONFIGFLAGS="--disable-security-key"
233+
LIBCRYPTOFLAGS="--without-openssl"
219234
# These are slow real or virtual machines so skip the slowest tests
220235
# (which tend to be thw ones that transfer lots of data) so that the
221236
# test run does not time out.
@@ -240,7 +255,8 @@ case "${TARGET_HOST}" in
240255
SKIP_LTESTS="forwarding multiplex proxy-connect hostkey-agent agent-ptrace"
241256
;;
242257
minix3)
243-
LIBCRYPTOFLAGS="--without-openssl --disable-security-key"
258+
CONFIGFLAGS="${CONFIGFLAGS} --disable-security-key"
259+
LIBCRYPTOFLAGS="--without-openssl"
244260
# Minix does not have a loopback interface so we have to skip any
245261
# test that relies on one.
246262
# Also, Minix seems to be very limited in the number of select()
@@ -264,7 +280,8 @@ case "${TARGET_HOST}" in
264280
CONFIGFLAGS="${CONFIGFLAGS} --without-hardening --disable-security-key"
265281
;;
266282
openwrt-*)
267-
CONFIGFLAGS="${CONFIGFLAGS} --without-openssl --without-zlib"
283+
CONFIGFLAGS="${CONFIGFLAGS} --without-zlib"
284+
LIBCRYPTOFLAGS="--without-openssl"
268285
TEST_TARGET="t-exec"
269286
;;
270287
sol10|sol11)
@@ -278,7 +295,8 @@ case "${TARGET_HOST}" in
278295
;;
279296
esac
280297

281-
case "`./config.guess`" in
298+
host=`./config.guess`
299+
case "$host" in
282300
*cygwin)
283301
SUDO=""
284302
# Don't run compat tests on cygwin as they don't currently compile.
@@ -289,17 +307,34 @@ case "`./config.guess`" in
289307
# modern versions don't ship with libcrypto.
290308
LIBCRYPTOFLAGS="--without-openssl"
291309
TEST_TARGET=t-exec
310+
case "$host" in
311+
*-darwin22.*)
312+
# sudo -S nobody doesn't work on macos 13 for some reason.
313+
SKIP_LTESTS="agent-getpeereid" ;;
314+
esac
292315
;;
293316
esac
294317

295-
# If we have a local openssl/libressl, use that.
318+
# Unless specifically configured, search for a suitable version of OpenSSL,
319+
# otherwise build without it.
296320
if [ -z "${LIBCRYPTOFLAGS}" ]; then
321+
LIBCRYPTOFLAGS="--without-openssl"
297322
# last-match
298-
for i in /usr/local /usr/local/ssl /usr/local/opt/openssl; do
323+
for i in /usr /usr/local /usr/local/ssl /usr/local/opt/openssl; do
324+
ver="none"
299325
if [ -x ${i}/bin/openssl ]; then
300-
LIBCRYPTOFLAGS="--with-ssl-dir=${i}"
326+
ver="$(${i}/bin/openssl version)"
301327
fi
328+
case "$ver" in
329+
none) ;;
330+
"OpenSSL 0."*|"OpenSSL 1.0."*|"OpenSSL 1.1.0"*) ;;
331+
"LibreSSL 2."*|"LibreSSL 3.0."*) ;;
332+
*) LIBCRYPTOFLAGS="--with-ssl-dir=${i}" ;;
333+
esac
302334
done
335+
if [ "${LIBCRYPTOFLAGS}" = "--without-openssl" ]; then
336+
TEST_TARGET="t-exec"
337+
fi
303338
fi
304339

305340
CONFIGFLAGS="${CONFIGFLAGS} ${LIBCRYPTOFLAGS}"

‎.github/setup_ci.sh‎

Lines changed: 26 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,9 @@ PACKAGES=""
44

55
. .github/configs $@
66

7-
case "`./config.guess`" in
7+
host=`./config.guess`
8+
echo "config.guess: $host"
9+
case "$host" in
810
*cygwin)
911
PACKAGER=setup
1012
echo Setting CYGWIN system environment variable.
@@ -26,6 +28,7 @@ esac
2628
TARGETS=$@
2729

2830
INSTALL_FIDO_PPA="no"
31+
#COPY_PAM_MODULE="no"
2932
export DEBIAN_FRONTEND=noninteractive
3033

3134
#echo "Setting up for '$TARGETS'"
@@ -85,6 +88,7 @@ for TARGET in $TARGETS; do
8588
esac
8689
;;
8790
*pam)
91+
# COPY_PAM_MODULE="yes"
8892
PACKAGES="$PACKAGES libpam0g-dev"
8993
;;
9094
sk)
@@ -124,6 +128,10 @@ for TARGET in $TARGETS; do
124128
esac
125129
PACKAGES="${PACKAGES} putty-tools"
126130
;;
131+
boringssl)
132+
INSTALL_BORINGSSL=1
133+
PACKAGES="${PACKAGES} cmake ninja-build"
134+
;;
127135
valgrind*)
128136
PACKAGES="$PACKAGES valgrind"
129137
;;
@@ -139,6 +147,14 @@ if [ "yes" = "$INSTALL_FIDO_PPA" ]; then
139147
sudo apt-add-repository -y ppa:yubico/stable
140148
fi
141149

150+
#need to copy the pam modules for sshd to hpnsshd on
151+
#macos with pam.
152+
#if [ "yes" = "$COPY_PAM_MODULE" ]; then
153+
# if [ `uname` = "Darwin" }; then
154+
# sudo cp /etc/pam.d/sshd /etc/pam.d/hpnsshd
155+
# fi
156+
#fi
157+
142158
tries=3
143159
while [ ! -z "$PACKAGES" ] && [ "$tries" -gt "0" ]; do
144160
case "$PACKAGER" in
@@ -199,3 +215,12 @@ if [ ! -z "${INSTALL_LIBRESSL}" ]; then
199215
./configure --prefix=/opt/libressl && make -j2 && sudo make install)
200216
fi
201217
fi
218+
219+
if [ ! -z "${INSTALL_BORINGSSL}" ]; then
220+
(cd ${HOME} && git clone https://boringssl.googlesource.com/boringssl &&
221+
cd ${HOME}/boringssl && mkdir build && cd build &&
222+
cmake -GNinja -DCMAKE_POSITION_INDEPENDENT_CODE=ON .. && ninja &&
223+
mkdir -p /opt/boringssl/lib &&
224+
cp ${HOME}/boringssl/build/crypto/libcrypto.a /opt/boringssl/lib &&
225+
cp -r ${HOME}/boringssl/include /opt/boringssl)
226+
fi

‎.github/workflows/c-cpp.yml‎

Lines changed: 28 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@ name: C/C++ CI
22

33
on:
44
push:
5-
branches: [ master, pre-stage ]
5+
branches: [ master, pre-stage, '*RC*', dev_major, dev_minor ]
66
paths: [ '**.c', '**.h', '**.m4', '**.sh', '.github/**', '**/Makefile.in', 'configure.ac' ]
77
pull_request:
88
branches: [ master ]
@@ -15,10 +15,22 @@ jobs:
1515
fail-fast: false
1616
matrix:
1717
# First we test all OSes in the default configuration.
18-
target: [ubuntu-20.04, ubuntu-22.04, macos-11, macos-12]
18+
target:
19+
- ubuntu-20.04
20+
- ubuntu-22.04
21+
- macos-11
22+
- macos-12
23+
- macos-13
1924
config: [default]
2025
# Then we include any extra configs we want to test for specific VMs.
2126
include:
27+
- { target: ubuntu-20.04, config: valgrind-1 }
28+
- { target: ubuntu-20.04, config: valgrind-2 }
29+
- { target: ubuntu-20.04, config: valgrind-3 }
30+
- { target: ubuntu-20.04, config: valgrind-4 }
31+
- { target: ubuntu-20.04, config: valgrind-5 }
32+
- { target: ubuntu-20.04, config: valgrind-6 }
33+
- { target: ubuntu-20.04, config: valgrind-7 }
2234
- { target: ubuntu-20.04, config: c89 }
2335
- { target: ubuntu-20.04, config: clang-6.0 }
2436
- { target: ubuntu-20.04, config: clang-8 }
@@ -36,19 +48,24 @@ jobs:
3648
- { target: ubuntu-20.04, config: gcc-11-Werror }
3749
- { target: ubuntu-20.04, config: pam }
3850
- { target: ubuntu-20.04, config: kitchensink }
39-
- { target: ubuntu-20.04, config: hardenedmalloc }
51+
- { target: ubuntu-22.04, config: hardenedmalloc }
4052
- { target: ubuntu-20.04, config: tcmalloc }
53+
# musl doesn't work because it doesn't know about linux/tcp.h
54+
# - { target: ubuntu-20.04, config: musl }
55+
- { target: ubuntu-latest, config: libressl-master }
56+
- { target: ubuntu-latest, config: libressl-3.7.2 }
57+
- { target: ubuntu-latest, config: libressl-3.7.1 }
58+
- { target: ubuntu-latest, config: libressl-3.8.0 }
4159
- { target: ubuntu-latest, config: openssl-master }
4260
- { target: ubuntu-latest, config: openssl-noec }
43-
- { target: ubuntu-latest, config: openssl-1.1.0h }
4461
- { target: ubuntu-latest, config: openssl-1.1.1 }
4562
- { target: ubuntu-latest, config: openssl-1.1.1k }
4663
- { target: ubuntu-latest, config: openssl-1.1.1n }
4764
- { target: ubuntu-latest, config: openssl-1.1.1q }
48-
- { target: ubuntu-latest, config: openssl-1.1.1s }
65+
- { target: ubuntu-latest, config: openssl-1.1.1t }
4966
- { target: ubuntu-latest, config: openssl-3.0.0 }
50-
- { target: ubuntu-latest, config: openssl-3.0.5 }
5167
- { target: ubuntu-latest, config: openssl-3.0.7 }
68+
- { target: ubuntu-latest, config: openssl-3.1.0 }
5269
- { target: ubuntu-latest, config: openssl-1.1.1_stable }
5370
- { target: ubuntu-latest, config: openssl-3.0 } # stable branch
5471
- { target: ubuntu-22.04, config: pam }
@@ -59,8 +76,11 @@ jobs:
5976
- { target: ubuntu-22.04, config: selinux }
6077
- { target: ubuntu-22.04, config: kitchensink }
6178
- { target: ubuntu-22.04, config: without-openssl }
62-
- { target: macos-11, config: pam }
63-
- { target: macos-12, config: pam }
79+
# we know pam doesn't work because we can't install a new pam file
80+
# for hpnssh via the CI test methods
81+
# - { target: macos-11, config: pam }
82+
# - { target: macos-12, config: pam }
83+
# - { target: macos-13, config: pam }
6484
runs-on: ${{ matrix.target }}
6585
steps:
6686
- uses: actions/checkout@main

0 commit comments

Comments
 (0)