Skip to content

Commit a054656

Browse files
rapier1rapier1
committed
Porting HPN-SSH to split sshd listener.
OpenSSH is splitting sshd into a listener and an session daemon. This commit is a first pass at porting HPN-SSH into that configuration. It current passes all regression tests. Functionality tests have not yet been conducted.
2 parents 24a1f3e + 783d8b2 commit a054656

File tree

128 files changed

+13533
-1043
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

128 files changed

+13533
-1043
lines changed

‎.depend‎

Lines changed: 21 additions & 11 deletions
Large diffs are not rendered by default.

‎.github/FUNDING.yml‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
# These are supported funding model platforms
2+
3+
github: [rapier1] # Replace with up to 4 GitHub Sponsors-enabled usernames e.g., [user1, user2]
4+
patreon: # Replace with a single Patreon username
5+
open_collective: # Replace with a single Open Collective username
6+
ko_fi: # Replace with a single Ko-fi username
7+
tidelift: # Replace with a single Tidelift platform-name/package-name e.g., npm/babel
8+
community_bridge: # Replace with a single Community Bridge project-name e.g., cloud-foundry
9+
liberapay: # Replace with a single Liberapay username
10+
issuehunt: # Replace with a single IssueHunt username
11+
otechie: # Replace with a single Otechie username
12+
custom: # Replace with up to 4 custom sponsorship URLs e.g., ['link1', 'link2']

‎.github/configs‎

Lines changed: 12 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -187,7 +187,7 @@ case "$config" in
187187
LIBCRYPTOFLAGS="--without-openssl"
188188
TEST_TARGET=t-exec
189189
;;
190-
valgrind-[1-5]|valgrind-unit)
190+
valgrind-[1-7]|valgrind-unit)
191191
# rlimit sandbox and FORTIFY_SOURCE confuse Valgrind.
192192
CONFIGFLAGS="--without-sandbox --without-hardening"
193193
CONFIGFLAGS="$CONFIGFLAGS --with-cppflags=-D_FORTIFY_SOURCE=0"
@@ -198,17 +198,19 @@ case "$config" in
198198
# won't reliably pass, and the unit tests run longer than allowed
199199
# by github so split into separate tests.
200200
tests2="integrity try-ciphers"
201-
tests3="krl forward-control sshsig agent-restrict kextype sftp"
202-
tests4="cert-userkey cert-hostkey kextype sftp-perm keygen-comment percent"
201+
tests3="krl forward-control sshsig"
202+
tests4="cert-userkey cert-hostkey"
203203
tests5="rekey"
204+
tests6="agent-restrict kextype sftp"
205+
tests7="kextype sftp-perm keygen-comment percent"
204206
case "$config" in
205207
valgrind-1)
206208
# All tests except agent-timeout (which is flaky under valgrind),
207209
# connection-timeout (which doesn't work since it's so slow)
208210
# and hostbased (since valgrind won't let ssh exec keysign).
209211
# Slow ones are run separately to increase parallelism.
210212
SKIP_LTESTS="agent-timeout connection-timeout hostbased"
211-
SKIP_LTESTS="$SKIP_LTESTS ${tests2} ${tests3} ${tests4} ${tests5}"
213+
SKIP_LTESTS="$SKIP_LTESTS ${tests2} ${tests3} ${tests4} ${tests5} ${tests6} ${tests7}"
212214
;;
213215
valgrind-2)
214216
LTESTS="${tests2}"
@@ -222,6 +224,12 @@ case "$config" in
222224
valgrind-5)
223225
LTESTS="${tests5}"
224226
;;
227+
valgrind-6)
228+
LTESTS="${tests6}"
229+
;;
230+
valgrind-7)
231+
LTESTS="${tests7}"
232+
;;
225233
valgrind-unit)
226234
TEST_TARGET="unit USE_VALGRIND=1"
227235
;;

‎.github/configure.sh‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -17,5 +17,5 @@ if [ "x$LDFLAGS" != "x" ]; then
1717
printf "LDFLAGS='$LDFLAGS' "
1818
fi
1919

20-
echo ./configure ${CONFIGFLAGS}
21-
./configure ${CONFIGFLAGS} 2>&1
20+
echo ./configure ${CONFIGFLAGS} --with-privsep-user=sshd
21+
./configure ${CONFIGFLAGS} --with-privsep-user=sshd

‎.github/run_test.sh‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -8,11 +8,10 @@ set -ex
88

99
# If we want to test hostbased auth, set up the host for it.
1010
if [ ! -z "$SUDO" ] && [ ! -z "$TEST_SSH_HOSTBASED_AUTH" ]; then
11-
sshconf=/usr/local/etc
11+
sshconf=/usr/local/etc/hpnssh
1212
$SUDO mkdir -p "${sshconf}"
1313
hostname | $SUDO tee $sshconf/shosts.equiv >/dev/null
1414
echo "EnableSSHKeysign yes" | $SUDO tee $sshconf/ssh_config >/dev/null
15-
$SUDO mkdir -p $sshconf
1615
$SUDO cp -p /etc/ssh/ssh_host*key* $sshconf
1716
$SUDO make install
1817
for key in $sshconf/ssh_host*key*.pub; do

‎.github/setup_ci.sh‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -27,6 +27,7 @@ esac
2727
TARGETS=$@
2828

2929
INSTALL_FIDO_PPA="no"
30+
#COPY_PAM_MODULE="no"
3031
export DEBIAN_FRONTEND=noninteractive
3132

3233
set -e
@@ -163,6 +164,14 @@ if [ "yes" = "$INSTALL_FIDO_PPA" ]; then
163164
sudo apt-add-repository -y ppa:yubico/stable
164165
fi
165166

167+
#need to copy the pam modules for sshd to hpnsshd on
168+
#macos with pam.
169+
#if [ "yes" = "$COPY_PAM_MODULE" ]; then
170+
# if [ `uname` = "Darwin" }; then
171+
# sudo cp /etc/pam.d/sshd /etc/pam.d/hpnsshd
172+
# fi
173+
#fi
174+
166175
tries=3
167176
while [ ! -z "$PACKAGES" ] && [ "$tries" -gt "0" ]; do
168177
case "$PACKAGER" in

‎.github/workflows/c-cpp.yml‎

Lines changed: 43 additions & 52 deletions
Original file line numberDiff line numberDiff line change
@@ -2,8 +2,10 @@ name: C/C++ CI
22

33
on:
44
push:
5+
branches: [ master, pre-stage, release_candidates, dev_major, dev_minor ]
56
paths: [ '**.c', '**.h', '**.m4', '**.sh', '**/Makefile.in', 'configure.ac', '.github/configs', '.github/workflows/c-cpp.yaml' ]
67
pull_request:
8+
branches: [ master, release_candidates ]
79
paths: [ '**.c', '**.h', '**.m4', '**.sh', '**/Makefile.in', 'configure.ac', '.github/configs', '.github/workflows/c-cpp.yaml' ]
810

911
jobs:
@@ -17,52 +19,41 @@ jobs:
1719
target:
1820
- ubuntu-20.04
1921
- ubuntu-22.04
20-
- macos-11
2122
- macos-12
2223
- macos-13
2324
- macos-14
2425
- windows-2019
2526
- windows-2022
2627
config: [default]
2728
# Then we include any extra configs we want to test for specific VMs.
28-
# Valgrind slows things down quite a bit, so start them first.
2929
include:
30-
- { target: windows-2019, config: cygwin-release }
31-
- { target: windows-2022, config: cygwin-release }
32-
- { target: ubuntu-20.04, config: valgrind-1 }
33-
- { target: ubuntu-20.04, config: valgrind-2 }
34-
- { target: ubuntu-20.04, config: valgrind-3 }
35-
- { target: ubuntu-20.04, config: valgrind-4 }
36-
- { target: ubuntu-20.04, config: valgrind-5 }
37-
- { target: ubuntu-20.04, config: valgrind-unit }
38-
- { target: ubuntu-20.04, config: c89 }
39-
- { target: ubuntu-20.04, config: clang-6.0 }
40-
- { target: ubuntu-20.04, config: clang-8 }
41-
- { target: ubuntu-20.04, config: clang-9 }
42-
- { target: ubuntu-20.04, config: clang-10 }
43-
- { target: ubuntu-20.04, config: clang-11 }
44-
- { target: ubuntu-20.04, config: clang-12-Werror }
45-
- { target: ubuntu-20.04, config: clang-sanitize-address }
46-
- { target: ubuntu-20.04, config: clang-sanitize-undefined }
47-
- { target: ubuntu-20.04, config: gcc-sanitize-address }
48-
- { target: ubuntu-20.04, config: gcc-sanitize-undefined }
49-
- { target: ubuntu-20.04, config: gcc-7 }
50-
- { target: ubuntu-20.04, config: gcc-8 }
51-
- { target: ubuntu-20.04, config: gcc-10 }
30+
- { target: ubuntu-22.04, config: valgrind-1 }
31+
- { target: ubuntu-22.04, config: valgrind-2 }
32+
- { target: ubuntu-22.04, config: valgrind-3 }
33+
- { target: ubuntu-22.04, config: valgrind-4 }
34+
# - { target: ubuntu-22.04, config: valgrind-5 }
35+
- { target: ubuntu-22.04, config: valgrind-6 }
36+
- { target: ubuntu-22.04, config: valgrind-7 }
37+
# binn.c no longer works with c89 so remove this test.
38+
# - { target: ubuntu-22.04, config: c89 }
39+
- { target: ubuntu-22.04, config: clang-6.0 }
40+
- { target: ubuntu-22.04, config: clang-8 }
41+
- { target: ubuntu-22.04, config: clang-9 }
42+
- { target: ubuntu-22.04, config: clang-10 }
43+
- { target: ubuntu-22.04, config: clang-11 }
44+
- { target: ubuntu-22.04, config: clang-12-Werror }
45+
- { target: ubuntu-22.04, config: gcc-7 }
46+
- { target: ubuntu-22.04, config: gcc-8 }
47+
- { target: ubuntu-22.04, config: gcc-10 }
5248
- { target: ubuntu-22.04, config: gcc-11-Werror }
5349
- { target: ubuntu-22.04, config: gcc-12-Werror }
54-
- { target: ubuntu-20.04, config: pam }
55-
- { target: ubuntu-20.04, config: kitchensink }
50+
- { target: ubuntu-22.04, config: pam }
51+
- { target: ubuntu-22.04, config: kitchensink }
5652
- { target: ubuntu-22.04, config: hardenedmalloc }
57-
- { target: ubuntu-20.04, config: tcmalloc }
58-
- { target: ubuntu-20.04, config: musl }
59-
- { target: ubuntu-latest, config: boringssl }
53+
- { target: ubuntu-22.04, config: tcmalloc }
54+
# musl doesn't work because it doesn't know about linux/tcp.h
55+
# - { target: ubuntu-20.04, config: musl }
6056
- { target: ubuntu-latest, config: libressl-master }
61-
- { target: ubuntu-latest, config: libressl-3.2.6 }
62-
- { target: ubuntu-latest, config: libressl-3.3.6 }
63-
- { target: ubuntu-latest, config: libressl-3.4.3 }
64-
- { target: ubuntu-latest, config: libressl-3.5.3 }
65-
- { target: ubuntu-latest, config: libressl-3.6.1 }
6657
- { target: ubuntu-latest, config: libressl-3.7.2 }
6758
- { target: ubuntu-latest, config: libressl-3.8.4 }
6859
- { target: ubuntu-latest, config: libressl-3.9.1 }
@@ -94,26 +85,26 @@ jobs:
9485
- { target: ubuntu-latest, config: putty-0.80 }
9586
- { target: ubuntu-latest, config: putty-snapshot }
9687
- { target: ubuntu-latest, config: zlib-develop }
97-
- { target: ubuntu-22.04, config: pam }
98-
- { target: ubuntu-22.04, config: krb5 }
99-
- { target: ubuntu-22.04, config: heimdal }
100-
- { target: ubuntu-22.04, config: libedit }
101-
- { target: ubuntu-22.04, config: sk }
102-
- { target: ubuntu-22.04, config: selinux }
103-
- { target: ubuntu-22.04, config: kitchensink }
104-
- { target: ubuntu-22.04, config: without-openssl }
105-
- { target: macos-11, config: pam }
106-
- { target: macos-12, config: pam }
107-
- { target: macos-13, config: pam }
108-
- { target: macos-14, config: pam }
88+
- { target: ubuntu-24.04, config: pam }
89+
- { target: ubuntu-24.04, config: krb5 }
90+
- { target: ubuntu-24.04, config: heimdal }
91+
- { target: ubuntu-24.04, config: libedit }
92+
- { target: ubuntu-24.04, config: sk }
93+
- { target: ubuntu-24.04, config: selinux }
94+
- { target: ubuntu-24.04, config: kitchensink }
95+
- { target: ubuntu-24.04, config: without-openssl }
96+
- { target: ubuntu-24.04, config: clang-sanitize-address }
97+
- { target: ubuntu-24.04, config: clang-sanitize-undefined }
98+
- { target: ubuntu-24.04, config: gcc-sanitize-address }
99+
- { target: ubuntu-24.04, config: gcc-sanitize-undefined }
100+
# we know pam doesn't work because we can't install a new pam file
101+
# for hpnssh via the CI test methods
102+
# - { target: macos-12, config: pam }
103+
# - { target: macos-13, config: pam }
104+
# - { target: macos-14, config: pam }
105+
>>>>>>> master
109106
runs-on: ${{ matrix.target }}
110107
steps:
111-
- name: set cygwin git params
112-
if: ${{ startsWith(matrix.target, 'windows') }}
113-
run: git config --global core.autocrlf input
114-
- name: install cygwin
115-
if: ${{ startsWith(matrix.target, 'windows') }}
116-
uses: cygwin/cygwin-install-action@master
117108
- uses: actions/checkout@main
118109
- name: setup CI system
119110
run: sh ./.github/setup_ci.sh ${{ matrix.config }}

‎.github/workflows/cifuzz.yml‎

Lines changed: 6 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,26 +1,27 @@
11
name: CIFuzz
22
on:
33
push:
4-
paths: [ '**.c', '**.h', '**.m4', '**.sh', '**/Makefile.in', 'configure.ac', '.github/configs', '.github/workflows/cifuzz.yml' ]
4+
branches: [master, dev_minor, dev_major, release_candidates]
5+
paths: [ '**.c', '**.h', '**.m4', '**.sh', '.github/**', '**/Makefile.in', 'configure.ac' ]
56
pull_request:
67
paths: [ '**.c', '**.h', '**.m4', '**.sh', '**/Makefile.in', 'configure.ac', '.github/configs', '.github/workflows/cifuzz.yml' ]
78

89
jobs:
910
Fuzzing:
10-
if: github.repository != 'openssh/openssh-portable-selfhosted'
11+
if: github.repository != 'rapier1/hpn-ssh-selfhosted'
1112
runs-on: ubuntu-latest
1213
steps:
1314
- name: Build Fuzzers
1415
id: build
1516
uses: google/oss-fuzz/infra/cifuzz/actions/build_fuzzers@master
1617
with:
17-
oss-fuzz-project-name: 'openssh'
18+
oss-fuzz-project-name: 'hpn-ssh'
1819
dry-run: false
1920
language: c++
2021
- name: Run Fuzzers
2122
uses: google/oss-fuzz/infra/cifuzz/actions/run_fuzzers@master
2223
with:
23-
oss-fuzz-project-name: 'openssh'
24+
oss-fuzz-project-name: 'hpn-ssh'
2425
fuzz-seconds: 600
2526
dry-run: false
2627
language: c++
@@ -29,4 +30,4 @@ jobs:
2930
if: failure() && steps.build.outcome == 'success'
3031
with:
3132
name: artifacts
32-
path: ./out/artifacts
33+
path: ./out/artifacts

‎.github/workflows/github-repo-stats.yml‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
name: github-repo-stats
2+
3+
on:
4+
schedule:
5+
# Run this once per day, towards the end of the day for keeping the most
6+
# recent data point most meaningful (hours are interpreted in UTC).
7+
- cron: "0 23 * * *"
8+
workflow_dispatch: # Allow for running this manually.
9+
10+
jobs:
11+
j1:
12+
name: github-repo-stats
13+
runs-on: ubuntu-latest
14+
steps:
15+
- name: run-ghrs
16+
# Use latest release.
17+
uses: jgehrcke/github-repo-stats@RELEASE
18+
with:
19+
ghtoken: ${{ secrets.ghrs_github_api_token }}

‎.github/workflows/upstream.yml‎

Lines changed: 0 additions & 67 deletions
This file was deleted.

0 commit comments

Comments
 (0)