summaryrefslogtreecommitdiff
path: root/usr.bin/ssh/kex.c
AgeCommit message (Collapse)Author
2020-03-13use sshpkt_fatal() for kex_exchange_identification() errors.Damien Miller
This ensures that the logged errors are consistent with other transport- layer errors and that the relevant IP addresses are logged. bz3129 ok dtucker@
2020-02-26change explicit_bzero();free() to freezero()Jonathan Gray
While freezero() returns early if the pointer is NULL the tests for NULL in callers are left to avoid warnings about passing an uninitialised size argument across a function boundry. ok deraadt@ djm@
2020-01-23Make zlib optional. This adds a "ZLIB" build time option that allowsDarren Tucker
building without zlib compression and associated options. With feedback from markus@, ok djm@
2019-10-08Correct type for end-of-list sentinel; fixes initializer warnings onDarren Tucker
some platforms. ok deraadt.
2019-09-06Allow prepending a list of algorithms to the default set by startingChristian Weisgerber
the list with the '^' character, e.g. HostKeyAlgorithms ^ssh-ed25519 Ciphers ^aes128-gcm@openssh.com,aes256-gcm@openssh.com ok djm@ dtucker@
2019-09-06better error code for bad arguments; inspired byDamien Miller
https://github.com/openssh/openssh-portable/pull/144 by Ed Maste
2019-09-05sprinkle in some explicit errors here, otherwise the percolate allDamien Miller
the way up to dispatch_run_fatal() and lose all meaninful context to help with bz#3063; ok dtucker@
2019-09-05only send ext_info for KEX_INITIAL; bz#2929 ok dtuckerDamien Miller
2019-01-21fix reversed arguments to kex_load_hostkey(); manifested as errors inDamien Miller
cert-hostkey.sh regress failures.
2019-01-21rename kex->kem_client_pub -> kex->client_pub now that KEM has been renamedDamien Miller
to kexgen from markus@ ok djm@
2019-01-21remove kex_derive_keys_bn wrapper; no unused since the DH-like KEXDamien Miller
methods have moved to KEM from markus@ ok djm@
2019-01-21Add support for a PQC KEX/KEM: sntrup4591761x25519-sha512@tinyssh.orgDamien Miller
using the Streamlined NTRU Prime 4591^761 implementation from SUPERCOP coupled with X25519 as a stop-loss. Not enabled by default. introduce KEM API; a simplified framework for DH-ish KEX methods. from markus@ feedback & ok djm@
2019-01-21factor out kex_verify_hostkey() - again, duplicated almost exactlyDamien Miller
across client and server for several KEX methods. from markus@ ok djm@
2019-01-21factor out kex_load_hostkey() - this is duplicated in both the client andDamien Miller
server implementations for most KEX methods. from markus@ ok djm@
2019-01-21save the derived session id in kex_derive_keys() rather than making eachDamien Miller
kex method implementation do it. from markus@ ok djm@
2018-12-27move client/server SSH-* banners to buffers under ssh->kex and factorDamien Miller
out the banner exchange. This eliminates some common code from the client and server. Also be more strict about handling \r characters - these should only be accepted immediately before \n (pointed out by Jann Horn). Inspired by a patch from Markus Schmidt. (lots of) feedback and ok markus@
2018-12-07only consider the ext-info-c extension during the initial KEX. It shouldn'tDamien Miller
be sent in subsequent ones, but if it is present we should ignore it. This prevents sshd from sending a SSH_MSG_EXT_INFO for REKEX for buggy these clients. Reported by Jakub Jelen via bz2929; ok dtucker@
2018-07-09Revert previous two commitsStefan Fritsch
It turns out we still support pre-auth compression on the client. Therefore revert the previous two commits: date: 2018/07/06 09:06:14; author: sf; commitid: yZVYKIRtUZWD9CmE; Rename COMP_DELAYED to COMP_ZLIB Only delayed compression is supported nowadays. ok markus@ date: 2018/07/06 09:05:01; author: sf; commitid: rEGuT5UgI9f6kddP; Remove leftovers from pre-authentication compression Support for this has been removed in 2016. COMP_DELAYED will be renamed in a later commit. ok markus@
2018-07-06Rename COMP_DELAYED to COMP_ZLIBStefan Fritsch
Only delayed compression is supported nowadays. ok markus@
2018-07-06Remove leftovers from pre-authentication compressionStefan Fritsch
Support for this has been removed in 2016. COMP_DELAYED will be renamed in a later commit. ok markus@
2018-07-04repair PubkeyAcceptedKeyTypes (and friends) after RSA signature work -Damien Miller
returns ability to add/remove/specify algorithms by wildcard. Algorithm lists are now fully expanded when the server/client configs are finalised, so errors are reported early and the config dumps (e.g. "ssh -G ...") now list the actual algorithms selected. Clarify that, while wildcards are accepted in algorithm lists, they aren't full pattern-lists that support negation. (lots of) feedback, ok markus@
2018-07-03Improve strictness and control over RSA-SHA2 signature types:Damien Miller
In ssh, when an agent fails to return a RSA-SHA2 signature when requested and falls back to RSA-SHA1 instead, retry the signature to ensure that the public key algorithm sent in the SSH_MSG_USERAUTH matches the one in the signature itself. In sshd, strictly enforce that the public key algorithm sent in the SSH_MSG_USERAUTH message matches what appears in the signature. Make the sshd_config PubkeyAcceptedKeyTypes and HostbasedAcceptedKeyTypes options control accepted signature algorithms (previously they selected supported key types). This allows these options to ban RSA-SHA1 in favour of RSA-SHA2. Add new signature algorithms "rsa-sha2-256-cert-v01@openssh.com" and "rsa-sha2-512-cert-v01@openssh.com" to force use of RSA-SHA2 signatures with certificate keys. feedback and ok markus@
2018-02-07Remove all guards for calls to OpenSSL free functions - all of theseJoel Sing
functions handle NULL, from at least OpenSSL 1.0.1g onwards. Prompted by dtucker@ asking about guards for RSA_free(), when looking at openssh-portable pr#84 on github. ok deraadt@ dtucker@
2018-01-23Drop compatibility hacks for some ancient SSH implementations, includingDamien Miller
ssh.com <=2.* and OpenSSH <= 3.*. These versions were all released in or before 2001 and predate the final SSH RFCs. The hacks in question aren't necessary for RFC- compliant SSH implementations. ok markus@
2017-06-13Do not require that unknown EXT_INFO extension values not containDamien Miller
\0 characters. This would cause fatal connection errors if an implementation sent e.g. string-encoded sub-values inside a value. Reported by Denis Bider; ok markus@
2017-05-30protocol handlers all get struct ssh passed; ok djm@Markus Friedl
2017-04-30unifdef WITH_SSH1Damien Miller
ok markus@
2017-03-15disallow KEXINIT before NEWKEYS; ok djm; report by vegard.nossum at oracle.comMarkus Friedl
2017-03-10fix regression in 7.4 server-sig-algs, where we were accidentallyDamien Miller
excluding SHA2 RSA signature methods. bz#2680, patch from Nuno Goncalves; ok dtucker@
2017-03-10Plug some mem leaks mostly on error paths. From jjelen at redhat.comDarren Tucker
via bz#2687, ok djm@
2017-02-03support =- for removing methods from algorithms lists, e.g.Damien Miller
Ciphers=-*cbc; suggested by Cristian Ionescu-Idbohrn in bz#2671 "I like it" markus@
2016-10-10Unregister the KEXINIT handler after message has been received.Markus Friedl
Otherwise an unauthenticated peer can repeat the KEXINIT and cause allocation of up to 128MB -- until the connection is closed. Reported by shilei-c at 360.cn
2016-09-28put back some pre-auth zlib bits that I shouldn't have removed -Damien Miller
they are still used by the client. Spotted by naddy@
2016-09-28restore pre-auth compression support in the client -- the previousDamien Miller
commit was intended to remove it from the server only. remove a few server-side pre-auth compression bits that escaped adjust wording of Compression directive in sshd_config(5) pointed out by naddy@ ok markus@
2016-09-22support plain curve25519-sha256 KEX algorithm now that it isDamien Miller
approaching standardisation (same algorithm is currently supported as curve25519-sha256@libssh.org)
2016-09-21correctly return errors from kex_send_ext_info(). Fix from Sami FarinDamien Miller
via https://github.com/openssh/openssh-portable/pull/50
2016-09-19move inbound NEWKEYS handling to kex layer; otherwise early NEWKEYS causesMarkus Friedl
NULL deref; found by Robert Swiecki/honggfuzz; fixed with & ok djm@
2016-09-12list all supported signature algorithms in the server-sig-algsDamien Miller
Reported by mb AT smartftp.com in bz#2547 and (independantly) Ron Frederick; ok markus@
2016-09-12Add MAXIMUM(), MINIMUM(), and ROUNDUP() to misc.h, then use those definitionsTheo de Raadt
rather than pulling <sys/param.h> and unknown namespace pollution. ok djm markus dtucker
2016-09-06update ext_info_c every time we receive a kexinit msg; fixes sending ofMarkus Friedl
ext_info if privsep is disabled; report Aris Adamantiadis & Mancha; ok djm@
2016-05-02add support for additional fixed DH groups fromDamien Miller
draft-ietf-curdle-ssh-kex-sha2-03 diffie-hellman-group14-sha256 (2K group) diffie-hellman-group16-sha512 (4K group) diffie-hellman-group18-sha512 (8K group) based on patch from Mark D. Baushke and Darren Tucker ok markus@
2016-02-08refactor activation of rekeyingDamien Miller
This makes automatic rekeying internal to the packet code (previously the server and client loops needed to assist). In doing to it makes application of rekey limits more accurate by accounting for packets about to be sent as well as packets queued during rekeying events themselves. Based on a patch from dtucker@ which was in turn based on a patch Aleksander Adamowski in bz#2521; ok markus@
2016-01-14remove roaming support; ok djm@Markus Friedl
2015-12-13unbreak connections with peers that set first_kex_follows;Damien Miller
fix from Matt Johnston va bz#2515
2015-12-10Remove NULL-checks before free().mmcc
ok dtucker@
2015-12-04implement SHA2-{256,512} for RSASSA-PKCS1-v1_5 signatures (user and host auth)Markus Friedl
based on draft-rsa-dsa-sha2-256-03.txt and draft-ssh-ext-info-04.txt; with & ok djm@
2015-11-13send SSH2_MSG_UNIMPLEMENTED replies to unexpected messages duringDamien Miller
KEX; bz#2949, ok dtucker@
2015-10-13free the correct IV length, don't assume it's always the cipherDamien Miller
blocksize; ok dtucker@
2015-08-21Improve printing of KEX offers and decisionsDamien Miller
The debug output now labels the client and server offers and the negotiated options. ok markus@
2015-07-30Allow ssh_config and sshd_config kex parameters options be prefixedDamien Miller
by a '+' to indicate that the specified items be appended to the default rather than replacing it. approach suggested by dtucker@, feedback dlg@, ok markus@
generated by cgit v1.2.3 (git 2.25.1) at 2024-12-11 19:05:23 +0000