external/openssh: update to 6.8p1.
In preparation for some updates to external/openssh to make it work with
BoringSSL, this change updates the code to a recent version. The current
version (5.9p1) is coming up on four years old now.
* Confirmed that f5c67b478bef9992de9e9ec91ce10af4f6205e0d matches
OpenSSH 5.9p1 exactly (save for the removal of the scard
subdirectory).
* Downloaded openssh-6.8p1.tar.gz (SHA256:
3ff64ce73ee124480b5bf767b9830d7d3c03bbcb6abe716b78f0192c37ce160e)
and verified with PGP signature. (I've verified Damien's key in
person previously.)
* Applied changes between f5c67b478bef9992de9e9ec91ce10af4f6205e0d and
OpenSSH 5.9p1 to 6.8p1 and updated the build as best I can. The
ugliest change is probably the duplication of umac.c to umac128.c
because Android conditionally compiles that file twice. See the
comment in those files.
Change-Id: I63cb07a8118afb5a377f116087a0882914cea486
diff --git a/key.h b/key.h
index ec5ac5e..89fd5cf 100644
--- a/key.h
+++ b/key.h
@@ -1,4 +1,4 @@
-/* $OpenBSD: key.h,v 1.33 2010/10/28 11:22:09 djm Exp $ */
+/* $OpenBSD: key.h,v 1.47 2015/01/28 22:36:00 djm Exp $ */
/*
* Copyright (c) 2000, 2001 Markus Friedl. All rights reserved.
@@ -26,126 +26,80 @@
#ifndef KEY_H
#define KEY_H
-#include "buffer.h"
-#include <openssl/rsa.h>
-#include <openssl/dsa.h>
-#ifdef OPENSSL_HAS_ECC
-#include <openssl/ec.h>
+#include "sshkey.h"
+
+typedef struct sshkey Key;
+
+#define types sshkey_types
+#define fp_type sshkey_fp_type
+#define fp_rep sshkey_fp_rep
+
+#ifndef SSH_KEY_NO_DEFINE
+#define key_new sshkey_new
+#define key_free sshkey_free
+#define key_equal_public sshkey_equal_public
+#define key_equal sshkey_equal
+#define key_type sshkey_type
+#define key_cert_type sshkey_cert_type
+#define key_ssh_name sshkey_ssh_name
+#define key_ssh_name_plain sshkey_ssh_name_plain
+#define key_type_from_name sshkey_type_from_name
+#define key_ecdsa_nid_from_name sshkey_ecdsa_nid_from_name
+#define key_type_is_cert sshkey_type_is_cert
+#define key_size sshkey_size
+#define key_ecdsa_bits_to_nid sshkey_ecdsa_bits_to_nid
+#define key_ecdsa_key_to_nid sshkey_ecdsa_key_to_nid
+#define key_is_cert sshkey_is_cert
+#define key_type_plain sshkey_type_plain
+#define key_cert_is_legacy sshkey_cert_is_legacy
+#define key_curve_name_to_nid sshkey_curve_name_to_nid
+#define key_curve_nid_to_bits sshkey_curve_nid_to_bits
+#define key_curve_nid_to_name sshkey_curve_nid_to_name
+#define key_ec_nid_to_hash_alg sshkey_ec_nid_to_hash_alg
+#define key_dump_ec_point sshkey_dump_ec_point
+#define key_dump_ec_key sshkey_dump_ec_key
#endif
-typedef struct Key Key;
-enum types {
- KEY_RSA1,
- KEY_RSA,
- KEY_DSA,
- KEY_ECDSA,
- KEY_RSA_CERT,
- KEY_DSA_CERT,
- KEY_ECDSA_CERT,
- KEY_RSA_CERT_V00,
- KEY_DSA_CERT_V00,
- KEY_UNSPEC
-};
-enum fp_type {
- SSH_FP_SHA1,
- SSH_FP_MD5
-};
-enum fp_rep {
- SSH_FP_HEX,
- SSH_FP_BUBBLEBABBLE,
- SSH_FP_RANDOMART
-};
-
-/* key is stored in external hardware */
-#define KEY_FLAG_EXT 0x0001
-
-#define CERT_MAX_PRINCIPALS 256
-struct KeyCert {
- Buffer certblob; /* Kept around for use on wire */
- u_int type; /* SSH2_CERT_TYPE_USER or SSH2_CERT_TYPE_HOST */
- u_int64_t serial;
- char *key_id;
- u_int nprincipals;
- char **principals;
- u_int64_t valid_after, valid_before;
- Buffer critical;
- Buffer extensions;
- Key *signature_key;
-};
-
-struct Key {
- int type;
- int flags;
- RSA *rsa;
- DSA *dsa;
- int ecdsa_nid; /* NID of curve */
-#ifdef OPENSSL_HAS_ECC
- EC_KEY *ecdsa;
-#else
- void *ecdsa;
-#endif
- struct KeyCert *cert;
-};
-
-Key *key_new(int);
-void key_add_private(Key *);
-Key *key_new_private(int);
-void key_free(Key *);
-Key *key_demote(const Key *);
-int key_equal_public(const Key *, const Key *);
-int key_equal(const Key *, const Key *);
-char *key_fingerprint(Key *, enum fp_type, enum fp_rep);
-u_char *key_fingerprint_raw(Key *, enum fp_type, u_int *);
-const char *key_type(const Key *);
-const char *key_cert_type(const Key *);
-int key_write(const Key *, FILE *);
-int key_read(Key *, char **);
-u_int key_size(const Key *);
+void key_add_private(Key *);
+Key *key_new_private(int);
+void key_free(Key *);
+Key *key_demote(const Key *);
+int key_write(const Key *, FILE *);
+int key_read(Key *, char **);
Key *key_generate(int, u_int);
Key *key_from_private(const Key *);
-int key_type_from_name(char *);
-int key_is_cert(const Key *);
-int key_type_plain(int);
int key_to_certified(Key *, int);
int key_drop_cert(Key *);
int key_certify(Key *, Key *);
-void key_cert_copy(const Key *, struct Key *);
+void key_cert_copy(const Key *, Key *);
int key_cert_check_authority(const Key *, int, int, const char *,
const char **);
-int key_cert_is_legacy(Key *);
+char *key_alg_list(int, int);
-int key_ecdsa_nid_from_name(const char *);
-int key_curve_name_to_nid(const char *);
-const char * key_curve_nid_to_name(int);
-u_int key_curve_nid_to_bits(int);
-int key_ecdsa_bits_to_nid(int);
-#ifdef OPENSSL_HAS_ECC
-int key_ecdsa_key_to_nid(EC_KEY *);
-const EVP_MD * key_ec_nid_to_evpmd(int nid);
-int key_ec_validate_public(const EC_GROUP *, const EC_POINT *);
-int key_ec_validate_private(const EC_KEY *);
-#endif
+#if defined(WITH_OPENSSL) && defined(OPENSSL_HAS_ECC)
+int key_ec_validate_public(const EC_GROUP *, const EC_POINT *);
+int key_ec_validate_private(const EC_KEY *);
+#endif /* defined(WITH_OPENSSL) && defined(OPENSSL_HAS_ECC) */
-Key *key_from_blob(const u_char *, u_int);
-int key_to_blob(const Key *, u_char **, u_int *);
-const char *key_ssh_name(const Key *);
-const char *key_ssh_name_plain(const Key *);
-int key_names_valid2(const char *);
+Key *key_from_blob(const u_char *, u_int);
+int key_to_blob(const Key *, u_char **, u_int *);
int key_sign(const Key *, u_char **, u_int *, const u_char *, u_int);
int key_verify(const Key *, const u_char *, u_int, const u_char *, u_int);
-int ssh_dss_sign(const Key *, u_char **, u_int *, const u_char *, u_int);
-int ssh_dss_verify(const Key *, const u_char *, u_int, const u_char *, u_int);
-int ssh_ecdsa_sign(const Key *, u_char **, u_int *, const u_char *, u_int);
-int ssh_ecdsa_verify(const Key *, const u_char *, u_int, const u_char *, u_int);
-int ssh_rsa_sign(const Key *, u_char **, u_int *, const u_char *, u_int);
-int ssh_rsa_verify(const Key *, const u_char *, u_int, const u_char *, u_int);
+void key_private_serialize(const Key *, struct sshbuf *);
+Key *key_private_deserialize(struct sshbuf *);
-#if defined(OPENSSL_HAS_ECC) && (defined(DEBUG_KEXECDH) || defined(DEBUG_PK))
-void key_dump_ec_point(const EC_GROUP *, const EC_POINT *);
-void key_dump_ec_key(const EC_KEY *);
-#endif
+/* authfile.c */
+int key_save_private(Key *, const char *, const char *, const char *,
+ int, const char *, int);
+int key_load_file(int, const char *, struct sshbuf *);
+Key *key_load_cert(const char *);
+Key *key_load_public(const char *, char **);
+Key *key_load_private(const char *, const char *, char **);
+Key *key_load_private_cert(int, const char *, const char *, int *);
+Key *key_load_private_type(int, const char *, const char *, char **, int *);
+int key_perm_ok(int, const char *);
#endif