Skip to content

Commit 6f608a7

Browse files
committed
First pass at porting HPN-SSH to 9.5p1. This will end up being
18.2.0
2 parents 5c1ad8d + 80a2f64 commit 6f608a7

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

51 files changed

+1183
-512
lines changed

.github/ci-status.md

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,10 @@ master :
66
[![Fuzzing Status](https://oss-fuzz-build-logs.storage.googleapis.com/badges/openssh.svg)](https://bugs.chromium.org/p/oss-fuzz/issues/list?sort=-opened&can=1&q=proj:openssh)
77
[![Coverity Status](https://scan.coverity.com/projects/21341/badge.svg)](https://scan.coverity.com/projects/openssh-portable)
88

9+
9.4 :
10+
[![C/C++ CI](https://github.com/openssh/openssh-portable/actions/workflows/c-cpp.yml/badge.svg?branch=V_9_4)](https://github.com/openssh/openssh-portable/actions/workflows/c-cpp.yml?query=branch:V_9_4)
11+
[![C/C++ CI self-hosted](https://github.com/openssh/openssh-portable-selfhosted/actions/workflows/selfhosted.yml/badge.svg?branch=V_9_4)](https://github.com/openssh/openssh-portable-selfhosted/actions/workflows/selfhosted.yml?query=branch:V_9_4)
12+
913
9.3 :
1014
[![C/C++ CI](https://github.com/openssh/openssh-portable/actions/workflows/c-cpp.yml/badge.svg?branch=V_9_3)](https://github.com/openssh/openssh-portable/actions/workflows/c-cpp.yml?query=branch:V_9_3)
1115
[![C/C++ CI self-hosted](https://github.com/openssh/openssh-portable-selfhosted/actions/workflows/selfhosted.yml/badge.svg?branch=V_9_3)](https://github.com/openssh/openssh-portable-selfhosted/actions/workflows/selfhosted.yml?query=branch:V_9_3)

.github/configs

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -30,6 +30,13 @@ case "$config" in
3030
default|sol64)
3131
;;
3232
c89)
33+
# If we don't have LLONG_MAX, configure will figure out that it can
34+
# get it by setting -std=gnu99, at which point we won't be testing
35+
# C89 any more. To avoid this, feed it in via CFLAGS.
36+
llong_max=`gcc -E -dM - </dev/null | \
37+
awk '$2=="__LONG_LONG_MAX__"{print $3}'`
38+
CPPFLAGS="-DLLONG_MAX=${llong_max}"
39+
3340
CC="gcc"
3441
CFLAGS="-Wall -std=c89 -pedantic -Werror=vla"
3542
CONFIGFLAGS="--without-zlib"
@@ -213,6 +220,10 @@ case "$config" in
213220
;;
214221
esac
215222
;;
223+
zlib-develop)
224+
INSTALL_ZLIB=develop
225+
CONFIGFLAGS="--with-zlib=/opt/zlib --with-rpath=-Wl,-rpath,"
226+
;;
216227
*)
217228
echo "Unknown configuration $config"
218229
exit 1

.github/setup_ci.sh

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -135,6 +135,8 @@ for TARGET in $TARGETS; do
135135
valgrind*)
136136
PACKAGES="$PACKAGES valgrind"
137137
;;
138+
zlib-*)
139+
;;
138140
*) echo "Invalid option '${TARGET}'"
139141
exit 1
140142
;;
@@ -224,3 +226,9 @@ if [ ! -z "${INSTALL_BORINGSSL}" ]; then
224226
cp ${HOME}/boringssl/build/crypto/libcrypto.a /opt/boringssl/lib &&
225227
cp -r ${HOME}/boringssl/include /opt/boringssl)
226228
fi
229+
230+
if [ ! -z "${INSTALL_ZLIB}" ]; then
231+
(cd ${HOME} && git clone https://github.com/madler/zlib.git &&
232+
cd ${HOME}/zlib && ./configure && make &&
233+
sudo make install prefix=/opt/zlib)
234+
fi

.github/workflows/c-cpp.yml

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -68,6 +68,7 @@ jobs:
6868
- { target: ubuntu-latest, config: openssl-3.1.0 }
6969
- { target: ubuntu-latest, config: openssl-1.1.1_stable }
7070
- { target: ubuntu-latest, config: openssl-3.0 } # stable branch
71+
- { target: ubuntu-latest, config: zlib-develop }
7172
- { target: ubuntu-22.04, config: pam }
7273
- { target: ubuntu-22.04, config: krb5 }
7374
- { target: ubuntu-22.04, config: heimdal }

.github/workflows/selfhosted.yml

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -40,6 +40,8 @@ jobs:
4040
- obsd67
4141
- obsd69
4242
- obsd70
43+
- obsd72
44+
- obsd73
4345
- obsdsnap
4446
- obsdsnap-i386
4547
- openindiana
@@ -76,6 +78,7 @@ jobs:
7678
- { target: ARM64, config: default, host: ARM64 }
7779
- { target: ARM64, config: pam, host: ARM64 }
7880
- { target: debian-riscv64, config: default, host: debian-riscv64 }
81+
- { target: obsd-arm64, config: default, host: obsd-arm64 }
7982
- { target: openwrt-mips, config: default, host: openwrt-mips }
8083
- { target: openwrt-mipsel, config: default, host: openwrt-mipsel }
8184
steps:

PROTOCOL

Lines changed: 34 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -104,6 +104,39 @@ http://git.libssh.org/users/aris/libssh.git/plain/doc/[email protected]
104104

105105
This is identical to curve25519-sha256 as later published in RFC8731.
106106

107+
1.9 transport: ping facility
108+
109+
OpenSSH implements a transport level ping message SSH2_MSG_PING
110+
and a corresponding SSH2_MSG_PONG reply.
111+
112+
#define SSH2_MSG_PING 192
113+
#define SSH2_MSG_PONG 193
114+
115+
The ping message is simply:
116+
117+
byte SSH_MSG_PING
118+
string data
119+
120+
The reply copies the data (which may be the empty string) from the
121+
ping:
122+
123+
byte SSH_MSG_PONG
124+
string data
125+
126+
Replies are sent in order. They are sent immediately except when rekeying
127+
is in progress, in which case they are queued until rekeying completes.
128+
129+
The server advertises support for these messages using the
130+
SSH2_MSG_EXT_INFO mechanism (RFC8308), with the following message:
131+
132+
133+
string "0" (version)
134+
135+
The ping/reply message is implemented at the transport layer rather
136+
than as a named global or channel request to allow pings with very
137+
short packet lengths, which would not be possible with other
138+
approaches.
139+
107140
2. Connection protocol changes
108141

109142
2.1. connection: Channel write close extension "[email protected]"
@@ -712,4 +745,4 @@ master instance and later clients.
712745
OpenSSH extends the usual agent protocol. These changes are documented
713746
in the PROTOCOL.agent file.
714747

715-
$OpenBSD: PROTOCOL,v 1.48 2022/11/07 01:53:01 dtucker Exp $
748+
$OpenBSD: PROTOCOL,v 1.49 2023/08/28 03:28:43 djm Exp $

PROTOCOL.agent

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
The SSH agent protocol is described in
2-
https://tools.ietf.org/html/draft-miller-ssh-agent-04
2+
https://tools.ietf.org/html/draft-miller-ssh-agent
33

44
This file documents OpenSSH's extensions to the agent protocol.
55

@@ -81,4 +81,4 @@ the constraint is:
8181

8282
This option is only valid for XMSS keys.
8383

84-
$OpenBSD: PROTOCOL.agent,v 1.19 2023/04/12 08:53:54 jsg Exp $
84+
$OpenBSD: PROTOCOL.agent,v 1.20 2023/10/03 23:56:10 djm Exp $

README

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
See https://www.openssh.com/releasenotes.html#9.4p1 for the release
1+
See https://www.openssh.com/releasenotes.html#9.5p1 for the release
22
notes.
33

44
Please read https://www.openssh.com/report.html for bug reporting

auth2.c

Lines changed: 9 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
/* $OpenBSD: auth2.c,v 1.166 2023/03/08 04:43:12 guenther Exp $ */
1+
/* $OpenBSD: auth2.c,v 1.167 2023/08/28 09:48:11 djm Exp $ */
22
/*
33
* Copyright (c) 2000 Markus Friedl. All rights reserved.
44
*
@@ -225,6 +225,7 @@ input_service_request(int type, u_int32_t seq, struct ssh *ssh)
225225
}
226226

227227
#define MIN_FAIL_DELAY_SECONDS 0.005
228+
#define MAX_FAIL_DELAY_SECONDS 5.0
228229
static double
229230
user_specific_delay(const char *user)
230231
{
@@ -250,6 +251,12 @@ ensure_minimum_time_since(double start, double seconds)
250251
struct timespec ts;
251252
double elapsed = monotime_double() - start, req = seconds, remain;
252253

254+
if (elapsed > MAX_FAIL_DELAY_SECONDS) {
255+
debug3_f("elapsed %0.3lfms exceeded the max delay "
256+
"requested %0.3lfms)", elapsed*1000, req*1000);
257+
return;
258+
}
259+
253260
/* if we've already passed the requested time, scale up */
254261
while ((remain = seconds - elapsed) < 0.0)
255262
seconds *= 2;
@@ -346,7 +353,7 @@ input_userauth_request(int type, u_int32_t seq, struct ssh *ssh)
346353
debug2("input_userauth_request: try method %s", method);
347354
authenticated = m->userauth(ssh, method);
348355
}
349-
if (!authctxt->authenticated)
356+
if (!authctxt->authenticated && strcmp(method, "none") != 0)
350357
ensure_minimum_time_since(tstart,
351358
user_specific_delay(authctxt->user));
352359
userauth_finish(ssh, authenticated, method, NULL);

channels.c

Lines changed: 25 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
/* $OpenBSD: channels.c,v 1.432 2023/07/04 03:59:21 dlg Exp $ */
1+
/* $OpenBSD: channels.c,v 1.433 2023/09/04 00:01:46 djm Exp $ */
22
/*
33
* Author: Tatu Ylonen <[email protected]>
44
* Copyright (c) 1995 Tatu Ylonen <[email protected]>, Espoo, Finland
@@ -2330,9 +2330,9 @@ channel_check_window(struct ssh *ssh, Channel *c)
23302330
{
23312331
int r;
23322332

2333-
/* going back to a set denominator of 2. Prior versions had a
2334-
* dynamic denominator based on the size of the buffer. This may
2335-
* have been helpful in some situations but it isn't helping in
2333+
/* going back to a set denominator of 2. Prior versions had a
2334+
* dynamic denominator based on the size of the buffer. This may
2335+
* have been helpful in some situations but it isn't helping in
23362336
* the general case -cjr 6/30/23 */
23372337
if (c->type == SSH_CHANNEL_OPEN &&
23382338
!(c->flags & (CHAN_CLOSE_SENT|CHAN_CLOSE_RCVD)) &&
@@ -2944,8 +2944,9 @@ channel_after_poll(struct ssh *ssh, struct pollfd *pfd, u_int npfd)
29442944

29452945
/*
29462946
* Enqueue data for channels with open or draining c->input.
2947+
* Returns non-zero if a packet was enqueued.
29472948
*/
2948-
static void
2949+
static int
29492950
channel_output_poll_input_open(struct ssh *ssh, Channel *c)
29502951
{
29512952
size_t len, plen;
@@ -2966,7 +2967,7 @@ channel_output_poll_input_open(struct ssh *ssh, Channel *c)
29662967
else
29672968
chan_ibuf_empty(ssh, c);
29682969
}
2969-
return;
2970+
return 0;
29702971
}
29712972

29722973
if (!c->have_remote_id)
@@ -2983,7 +2984,7 @@ channel_output_poll_input_open(struct ssh *ssh, Channel *c)
29832984
*/
29842985
if (plen > c->remote_window || plen > c->remote_maxpacket) {
29852986
debug("channel %d: datagram too big", c->self);
2986-
return;
2987+
return 0;
29872988
}
29882989
/* Enqueue it */
29892990
if ((r = sshpkt_start(ssh, SSH2_MSG_CHANNEL_DATA)) != 0 ||
@@ -2992,6 +2993,7 @@ channel_output_poll_input_open(struct ssh *ssh, Channel *c)
29922993
(r = sshpkt_send(ssh)) != 0)
29932994
fatal_fr(r, "channel %i: send datagram", c->self);
29942995
c->remote_window -= plen;
2996+
return 1;
29952997
}
29962998

29972999
/* Enqueue packet for buffered data. */
@@ -3000,7 +3002,7 @@ channel_output_poll_input_open(struct ssh *ssh, Channel *c)
30003002
if (len > c->remote_maxpacket)
30013003
len = c->remote_maxpacket;
30023004
if (len == 0)
3003-
return;
3005+
return 0;
30043006
if ((r = sshpkt_start(ssh, SSH2_MSG_CHANNEL_DATA)) != 0 ||
30053007
(r = sshpkt_put_u32(ssh, c->remote_id)) != 0 ||
30063008
(r = sshpkt_put_string(ssh, sshbuf_ptr(c->input), len)) != 0 ||
@@ -3009,19 +3011,21 @@ channel_output_poll_input_open(struct ssh *ssh, Channel *c)
30093011
if ((r = sshbuf_consume(c->input, len)) != 0)
30103012
fatal_fr(r, "channel %i: consume", c->self);
30113013
c->remote_window -= len;
3014+
return 1;
30123015
}
30133016

30143017
/*
30153018
* Enqueue data for channels with open c->extended in read mode.
3019+
* Returns non-zero if a packet was enqueued.
30163020
*/
3017-
static void
3021+
static int
30183022
channel_output_poll_extended_read(struct ssh *ssh, Channel *c)
30193023
{
30203024
size_t len;
30213025
int r;
30223026

30233027
if ((len = sshbuf_len(c->extended)) == 0)
3024-
return;
3028+
return 0;
30253029

30263030
debug2("channel %d: rwin %u elen %zu euse %d", c->self,
30273031
c->remote_window, sshbuf_len(c->extended), c->extended_usage);
@@ -3030,7 +3034,7 @@ channel_output_poll_extended_read(struct ssh *ssh, Channel *c)
30303034
if (len > c->remote_maxpacket)
30313035
len = c->remote_maxpacket;
30323036
if (len == 0)
3033-
return;
3037+
return 0;
30343038
if (!c->have_remote_id)
30353039
fatal_f("channel %d: no remote id", c->self);
30363040
if ((r = sshpkt_start(ssh, SSH2_MSG_CHANNEL_EXTENDED_DATA)) != 0 ||
@@ -3043,15 +3047,20 @@ channel_output_poll_extended_read(struct ssh *ssh, Channel *c)
30433047
fatal_fr(r, "channel %i: consume", c->self);
30443048
c->remote_window -= len;
30453049
debug2("channel %d: sent ext data %zu", c->self, len);
3050+
return 1;
30463051
}
30473052

3048-
/* If there is data to send to the connection, enqueue some of it now. */
3049-
void
3053+
/*
3054+
* If there is data to send to the connection, enqueue some of it now.
3055+
* Returns non-zero if data was enqueued.
3056+
*/
3057+
int
30503058
channel_output_poll(struct ssh *ssh)
30513059
{
30523060
struct ssh_channels *sc = ssh->chanctxt;
30533061
Channel *c;
30543062
u_int i;
3063+
int ret = 0;
30553064

30563065
for (i = 0; i < sc->channels_alloc; i++) {
30573066
c = sc->channels[i];
@@ -3074,12 +3083,13 @@ channel_output_poll(struct ssh *ssh)
30743083
/* Get the amount of buffered data for this channel. */
30753084
if (c->istate == CHAN_INPUT_OPEN ||
30763085
c->istate == CHAN_INPUT_WAIT_DRAIN)
3077-
channel_output_poll_input_open(ssh, c);
3086+
ret |= channel_output_poll_input_open(ssh, c);
30783087
/* Send extended data, i.e. stderr */
30793088
if (!(c->flags & CHAN_EOF_SENT) &&
30803089
c->extended_usage == CHAN_EXTENDED_READ)
3081-
channel_output_poll_extended_read(ssh, c);
3090+
ret |= channel_output_poll_extended_read(ssh, c);
30823091
}
3092+
return ret;
30833093
}
30843094

30853095
/* -- mux proxy support */

0 commit comments

Comments
 (0)