To reflect the support for multiple container engines, and to make
terminology more consistent and implementation-agnostic.
Also:
- add FIXME for `docker-machine ip` command that has been dropped
upstream.
Follow-up to 9bd1f16dc2#2605Closes#2609
To use a key type that is:
- supported by all backends.
- can be generated with the most recent `ssh-keygen` version.
- here to stay for the foreseeable future.
(DSA is scheduled for removal from the libssh2 codebase.)
Cherry-picked from #2598Closes#2604
In some cases this is binary, in others it's textual.
To better see what's in the keys, to debug them, and debug code dealing
with them. It's a manual script, not run automatically by this repo.
Closes#2574
Implement server hostkey verification for the six ECDSA/RSA OpenSSH
certificate hostkey variants:
- `ecdsa-sha2-nistp256-cert-v01@openssh.com`
- `ecdsa-sha2-nistp384-cert-v01@openssh.com`
- `ecdsa-sha2-nistp521-cert-v01@openssh.com`
- `ssh-rsa-cert-v01@openssh.com`
- `rsa-sha2-256-cert-v01@openssh.com`
- `rsa-sha2-512-cert-v01@openssh.com`
This fixes#2434, where these algorithms were advertised and accepted as
preferences but had `NULL` hostkey `init`/`sig_verify` callbacks. A
certificate-only hostkey offer therefore caused
`LIBSSH2_ERROR_KEX_FAILURE (-5)`.
## Implementation
- ECDSA certificate parsing uses one shared init path for all three
curves. It validates the certificate type, nonce, inner curve name, and
EC point before constructing the verification context.
- RSA certificate parsing uses one shared init path for all three RSA
signature variants.
- Per-algorithm RSA `sig_verify` callbacks remain distinct.
- Per `PROTOCOL.certkeys`, the RSA/SHA-2 certificate blob itself carries
the type string `ssh-rsa-cert-v01@openssh.com`; the negotiated SHA-2
algorithm is represented by KEXINIT and the exchange signature.
- Certificate CA trust validation remains out of scope, consistent with
existing plain-hostkey handling.
## Tests
- Host CA fixtures (`keys/ca_host_ecdsa`, `keys/ca_host_rsa`) and
CA-signed host certificates for the ECDSA P-256 and RSA host keys in the
Docker OpenSSH fixture.
- The certificate algorithms are exercised through `test_read_algos.txt`
and `FIXTURE_TEST_HOSTKEY`: `ecdsa-sha2-nistp256-cert-v01@openssh.com`,
`rsa-sha2-256-cert-v01@openssh.com`,
`rsa-sha2-512-cert-v01@openssh.com`, `ssh-rsa-cert-v01@openssh.com`,
plus the pre-existing `ssh-ed25519-cert-v01@openssh.com`.
- The ECDSA P-384/P-521 certificate variants share the same codepath and
are covered by it; only P-256 is tested directly to keep the fixture
matrix lean (per maintainer review feedback).
- Disabled-backend skip entries in `tests/session_fixture.c` for the new
certificate algorithms.
- Preserved the existing ed25519 certificate test path.
Fixes#2434
Follow-up to 6036e57720#2513
Follow-up to 65a276e8fe#2064Closes#2539
`libssh2_channel_get_exit_status()` returns 0 both for a real exit
status of 0 and for a channel that never received an `exit-status`
request. A server that force-closes a session, like OpenSSH under
`ChannelTimeout`, makes a still-running command look like a clean exit
0. Reproduction with the stock `example/ssh2_exec` is in #2515.
This adds `libssh2_channel_has_exit_status()`, returning 1 once the
request arrived, the name you suggested.
The new field sits in `_LIBSSH2_CHANNEL` in `libssh2_priv.h` and callers
only ever hold a pointer, so no ABI change.
`libssh2_channel_get_exit_signal()` already lets a caller see whether
that request arrived by leaving the pointer NULL, exit-status was the
odd one out.
Man page and a `test_exit_status` covering both states are included.
Follow-up to 77bd3c1215Fixes#2515Closes#2516
- add host CA keys.
- add ed25519 signed hostkey for tests.
- make hostkey tests recognize it and skip hash checks.
- make existing tests select hostkey algos.
- add `ssh-ed25519-cert-v01@openssh.com` to the list of tested algos.
(exclude for unsupported backends.)
Ref: #2434
Inspired-by: #2435
Credits-to: Pier Carlo Cadoppi
Follow-up to 65a276e8fe#2064Closes#2513
Also: regen ed25519 key to have an empty comment like its siblings.
To be used for generating host certificate keys.
Ref: 65a276e8fe#2064
Ref: #2435Closes#2511
They are supported via the backends, except OS/400 which has its own
parser, leaving libgcrypt and WinCNG (untested) without support. With
mbedTLS PKCS8 encryption (aes-128-cbc) requires 3.6.0+.
Add RSA, ECDSA and ED25519 keys.
What I find interesting in PKCS8 private keys, is the easy way to
inspect the ASN.1 content (`openssl asn1parse -dump -in <fn>`). I could
not find similar tooling for PEM and OpenSSH files.
Also:
- tests/openssh_server/authorized_keys: sync up comments with private
keys and the generator script.
Ref: https://github.com/Mbed-TLS/mbedtls/releases/tag/v3.6.0Closes#2500
To improve coverage. This is the 'EC PRIVATE KEY` format, not tested
before. The encrypted flavor probably should not be used nowadays due to
its dependence on MD5, and thus also only tested in one job. Also use
this opportunity to introduce ECDSA 521 into the mix.
Also:
- test_auth_pubkey_ok_rsa_encrypted: require `LIBSSH2_AES_CBC`.
Closes#2499
Make it 256-bit to add variation.
Choose aes256-ctr for encryption to keep it compatible with mbedTLS,
which lacks AES-GCM support. (The other alternative, chacha-poly, has
decryption broken for keys.)
Closes#2486
The committed key was in reality `rsa-sha2-512`, not `rsa-sha2-256`, as
the filenames suggested.
Also set the type explicitly to `rsa-sha2-512`, to avoid relying on
ssh-keygen's default (`rsa-sha2-512`).
```shell
$ grep -E -o ' .+ ' id_rsa_sha2_512_signed-cert.pub | base64 -d | strings | grep -i rsa
```
Bug: #2474
Follow-up to 3a6ab70dcf#1314Closes#2479
Also:
- replace the prefix `key_` with `id_` to match defaults and make them
easier to identify.
- rename `gen_keys.sh` to `keys-generate.sh`.
- include `keys-generate.sh` in tarball.
Closes#2471
Replace with `ssh2_deb()`.
Also:
- adjust checksrc options to verify.
- checksrc-all.pl: fix an issue preventing picking up `tests/.checksrc`.
Follow-up to c090b696c6#1556
Follow-up to af1e591eee#796Closes#1997
To render in Git webviews as-is, to make it easier to edit, verify,
and to sync up with curl.
- add options to not build the `.3` man pages:
- autotools: `--disable-docs`
- cmake: `LIBSSH2_BUILD_DOCS=OFF`
- building `.3` man pages requires Perl after this patch.
- drop `mansyntax` and the shell / `grep` / GNU `man` tool requirements with it.
- scripts and most logic were copied from curl.
- add `cd2nroff` from curl, with edits to relax curl-specific checks.
- used `nroff2cd` (from curl) to convert from `.3` to `.md`. Then
manually fixed copyrights, inline function references and a couple
of other things.
Credits-to: Daniel Stenberg
Ref: eefcc1bda4
Ref: https://github.com/curl/curl/pull/12730
Ref: https://github.com/libssh2/www/issues/25#issuecomment-3289431671Closes#1660
Replicating OpenSSH's behavior to handle RSA certificate authentication
differently based on the remote server version.
1. For OpenSSH versions >= 7.8, ascertain server's support for RSA Cert
types by checking if the certificate's signature type is present in
the `server-sig-algs`.
2. For OpenSSH versions < 7.8, Set the "SSH_BUG_SIGTYPE" flag when the
RSA key in question is a certificate to ignore `server-sig-algs` and
only offer ssh-rsa signature algorithm for RSA certs.
This arises from the fact that OpenSSH versions up to 7.7 accept
RSA-SHA2 keys but not RSA-SHA2 certificate types. Although OpenSSH <=7.7
includes RSA-SHA2 keys in the `server-sig-algs`, versions <=7.7 do not
actually support RSA certs. Therefore, server sending RSA-SHA2 keys in
`server-sig-algs` should not be interpreted as indicating support for
RSA-SHA2 certs. So, `server-sig-algs` are ignored when the RSA key in
question is a cert, and the remote server version is 7.7 or below.
Relevant sections of the OpenSSH source code:
<https://github.com/openssh/openssh-portable/blob/V_8_9_P1/sshconnect2.c#L1191-L1197>
<https://github.com/openssh/openssh-portable/blob/master/compat.c#L43>
Assisted-by: Will Cosgrove
Reviewed-by: Viktor Szakats
- All files have prominent copyright and SPDX identifier
- If not embedded in the file, in the .reuse/dep5 file
- All used licenses are in LICENSES/ (not shipped in tarballs)
- A new REUSE CI job verify that all files are OK
Assisted-by: Viktor Szakats
Closes#1084
`DYN=1` means to build examples/tests against the shared libssh2.
Before this patch this was broken for building tests. This patch skips
building tests that require the static libssh2 library, so the build now
succeeds.
Also move the list of tests that require static lib from
`CMakeLists.txt` to `Makefile.inc`, so that we can reuse it in
`Makefile.mk`.
Couldn't find a way to also reuse it in `Makefile.am`. Move the
`Makefile.am` specific definitions close to the shared list, to make it
easier to keep them synced.
Cherry-picked from #1036
Merge the loop executing multiple tests and the script that actually
launches the tests into a single script. This same script is now called
from both autotools and CMake. autotools loads the list of tests from
`Makefile.inc`, CMake passes it via the command-line. It's also possible
to call the script manually with a custom list of tests or individual
ones.
With this setup we're now launching a single sshd session for all tests,
instead of launching and killing it for each test. This did not improve
reliability of these test on CI machines, and it's easy to go back to
the previous behaviour if necessary.
Also:
- allow passing custom sshd options via `SSHD_FLAGS`.
- add `SSHD_TESTS_LIMIT_TO` to limit the number of tests to its value.
E.g. `SSHD_TESTS_LIMIT_TO=1` executes the first test only. Meant for
debugging.
- use `ssh` to test the connection (if available) instead of fixed
amount of wait. Made to also work on Windows.
- set `PermitRootLogin yes` in `sshd`, to allow running tests as root.
- show `sshd` path and version.
Cherry-picked from #1017 (the last one)
Closes#1024
Instead of assembling the list using `$(wildcard ...)`.
Also split off a `tests/Makefile.inc` from `tests/Makefile.am`. With its
simpler syntax, this also allows to delete some complexity from the
CMake loader.
Cherry-picked from #1017
