external/openssh: update to 6.8p1.
In preparation for some updates to external/openssh to make it work with
BoringSSL, this change updates the code to a recent version. The current
version (5.9p1) is coming up on four years old now.
* Confirmed that f5c67b478bef9992de9e9ec91ce10af4f6205e0d matches
OpenSSH 5.9p1 exactly (save for the removal of the scard
subdirectory).
* Downloaded openssh-6.8p1.tar.gz (SHA256:
3ff64ce73ee124480b5bf767b9830d7d3c03bbcb6abe716b78f0192c37ce160e)
and verified with PGP signature. (I've verified Damien's key in
person previously.)
* Applied changes between f5c67b478bef9992de9e9ec91ce10af4f6205e0d and
OpenSSH 5.9p1 to 6.8p1 and updated the build as best I can. The
ugliest change is probably the duplication of umac.c to umac128.c
because Android conditionally compiles that file twice. See the
comment in those files.
Change-Id: I63cb07a8118afb5a377f116087a0882914cea486
diff --git a/packet.h b/packet.h
index 90eec17..7b06544 100644
--- a/packet.h
+++ b/packet.h
@@ -1,4 +1,4 @@
-/* $OpenBSD: packet.h,v 1.56 2011/05/06 21:14:05 djm Exp $ */
+/* $OpenBSD: packet.h,v 1.66 2015/01/30 01:13:33 djm Exp $ */
/*
* Author: Tatu Ylonen <ylo@cs.hut.fi>
@@ -18,110 +18,189 @@
#include <termios.h>
-#include <openssl/bn.h>
-#ifdef OPENSSL_HAS_ECC
-#include <openssl/ec.h>
-#endif
+#ifdef WITH_OPENSSL
+# include <openssl/bn.h>
+# ifdef OPENSSL_HAS_ECC
+# include <openssl/ec.h>
+# else /* OPENSSL_HAS_ECC */
+# define EC_KEY void
+# define EC_GROUP void
+# define EC_POINT void
+# endif /* OPENSSL_HAS_ECC */
+#else /* WITH_OPENSSL */
+# define BIGNUM void
+# define EC_KEY void
+# define EC_GROUP void
+# define EC_POINT void
+#endif /* WITH_OPENSSL */
-void packet_set_connection(int, int);
-void packet_set_timeout(int, int);
-void packet_set_nonblocking(void);
-int packet_get_connection_in(void);
-int packet_get_connection_out(void);
-void packet_close(void);
-void packet_set_encryption_key(const u_char *, u_int, int);
-u_int packet_get_encryption_key(u_char *);
-void packet_set_protocol_flags(u_int);
-u_int packet_get_protocol_flags(void);
-void packet_start_compression(int);
-void packet_set_interactive(int, int, int);
-int packet_is_interactive(void);
-void packet_set_server(void);
-void packet_set_authenticated(void);
+#include <signal.h>
+#include "openbsd-compat/sys-queue.h"
-void packet_start(u_char);
-void packet_put_char(int ch);
-void packet_put_int(u_int value);
-void packet_put_int64(u_int64_t value);
-void packet_put_bignum(BIGNUM * value);
-void packet_put_bignum2(BIGNUM * value);
-#ifdef OPENSSL_HAS_ECC
-void packet_put_ecpoint(const EC_GROUP *, const EC_POINT *);
-#endif
-void packet_put_string(const void *buf, u_int len);
-void packet_put_cstring(const char *str);
-void packet_put_raw(const void *buf, u_int len);
-void packet_send(void);
+struct kex;
+struct sshkey;
+struct sshbuf;
+struct session_state; /* private session data */
-int packet_read(void);
-void packet_read_expect(int type);
-int packet_read_poll(void);
-void packet_process_incoming(const char *buf, u_int len);
-int packet_read_seqnr(u_int32_t *seqnr_p);
-int packet_read_poll_seqnr(u_int32_t *seqnr_p);
+#include "dispatch.h" /* typedef, DISPATCH_MAX */
-u_int packet_get_char(void);
-u_int packet_get_int(void);
-u_int64_t packet_get_int64(void);
-void packet_get_bignum(BIGNUM * value);
-void packet_get_bignum2(BIGNUM * value);
-#ifdef OPENSSL_HAS_ECC
-void packet_get_ecpoint(const EC_GROUP *, EC_POINT *);
-#endif
-void *packet_get_raw(u_int *length_ptr);
-void *packet_get_string(u_int *length_ptr);
-char *packet_get_cstring(u_int *length_ptr);
-void *packet_get_string_ptr(u_int *length_ptr);
-void packet_disconnect(const char *fmt,...) __attribute__((format(printf, 1, 2)));
-void packet_send_debug(const char *fmt,...) __attribute__((format(printf, 1, 2)));
+struct key_entry {
+ TAILQ_ENTRY(key_entry) next;
+ struct sshkey *key;
+};
-void set_newkeys(int mode);
-int packet_get_keyiv_len(int);
-void packet_get_keyiv(int, u_char *, u_int);
-int packet_get_keycontext(int, u_char *);
-void packet_set_keycontext(int, u_char *);
-void packet_get_state(int, u_int32_t *, u_int64_t *, u_int32_t *, u_int64_t *);
-void packet_set_state(int, u_int32_t, u_int64_t, u_int32_t, u_int64_t);
-int packet_get_ssh1_cipher(void);
-void packet_set_iv(int, u_char *);
-void *packet_get_newkeys(int);
+struct ssh {
+ /* Session state */
+ struct session_state *state;
-void packet_write_poll(void);
-void packet_write_wait(void);
-int packet_have_data_to_write(void);
-int packet_not_very_much_data_to_write(void);
+ /* Key exchange */
+ struct kex *kex;
-int packet_connection_is_on_socket(void);
-int packet_remaining(void);
-void packet_send_ignore(int);
-void packet_add_padding(u_char);
+ /* cached remote ip address and port*/
+ char *remote_ipaddr;
+ int remote_port;
+
+ /* Dispatcher table */
+ dispatch_fn *dispatch[DISPATCH_MAX];
+ /* number of packets to ignore in the dispatcher */
+ int dispatch_skip_packets;
+
+ /* datafellows */
+ int compat;
+
+ /* Lists for private and public keys */
+ TAILQ_HEAD(, key_entry) private_keys;
+ TAILQ_HEAD(, key_entry) public_keys;
+
+ /* APP data */
+ void *app_data;
+};
+
+struct ssh *ssh_alloc_session_state(void);
+struct ssh *ssh_packet_set_connection(struct ssh *, int, int);
+void ssh_packet_set_timeout(struct ssh *, int, int);
+int ssh_packet_stop_discard(struct ssh *);
+int ssh_packet_connection_af(struct ssh *);
+void ssh_packet_set_nonblocking(struct ssh *);
+int ssh_packet_get_connection_in(struct ssh *);
+int ssh_packet_get_connection_out(struct ssh *);
+void ssh_packet_close(struct ssh *);
+void ssh_packet_set_encryption_key(struct ssh *, const u_char *, u_int, int);
+void ssh_packet_set_protocol_flags(struct ssh *, u_int);
+u_int ssh_packet_get_protocol_flags(struct ssh *);
+int ssh_packet_start_compression(struct ssh *, int);
+void ssh_packet_set_tos(struct ssh *, int);
+void ssh_packet_set_interactive(struct ssh *, int, int, int);
+int ssh_packet_is_interactive(struct ssh *);
+void ssh_packet_set_server(struct ssh *);
+void ssh_packet_set_authenticated(struct ssh *);
+
+int ssh_packet_send1(struct ssh *);
+int ssh_packet_send2_wrapped(struct ssh *);
+int ssh_packet_send2(struct ssh *);
+
+int ssh_packet_read(struct ssh *);
+int ssh_packet_read_expect(struct ssh *, u_int type);
+int ssh_packet_read_poll(struct ssh *);
+int ssh_packet_read_poll1(struct ssh *, u_char *);
+int ssh_packet_read_poll2(struct ssh *, u_char *, u_int32_t *seqnr_p);
+int ssh_packet_process_incoming(struct ssh *, const char *buf, u_int len);
+int ssh_packet_read_seqnr(struct ssh *, u_char *, u_int32_t *seqnr_p);
+int ssh_packet_read_poll_seqnr(struct ssh *, u_char *, u_int32_t *seqnr_p);
+
+const void *ssh_packet_get_string_ptr(struct ssh *, u_int *length_ptr);
+void ssh_packet_disconnect(struct ssh *, const char *fmt, ...)
+ __attribute__((format(printf, 2, 3)))
+ __attribute__((noreturn));
+void ssh_packet_send_debug(struct ssh *, const char *fmt, ...) __attribute__((format(printf, 2, 3)));
+
+int ssh_set_newkeys(struct ssh *, int mode);
+void ssh_packet_get_bytes(struct ssh *, u_int64_t *, u_int64_t *);
+
+typedef void *(ssh_packet_comp_alloc_func)(void *, u_int, u_int);
+typedef void (ssh_packet_comp_free_func)(void *, void *);
+void ssh_packet_set_compress_hooks(struct ssh *, void *,
+ ssh_packet_comp_alloc_func *, ssh_packet_comp_free_func *);
+
+int ssh_packet_write_poll(struct ssh *);
+int ssh_packet_write_wait(struct ssh *);
+int ssh_packet_have_data_to_write(struct ssh *);
+int ssh_packet_not_very_much_data_to_write(struct ssh *);
+
+int ssh_packet_connection_is_on_socket(struct ssh *);
+int ssh_packet_remaining(struct ssh *);
+void ssh_packet_send_ignore(struct ssh *, int);
void tty_make_modes(int, struct termios *);
void tty_parse_modes(int, int *);
-void packet_set_alive_timeouts(int);
-int packet_inc_alive_timeouts(void);
-int packet_set_maxsize(u_int);
-u_int packet_get_maxsize(void);
+void ssh_packet_set_alive_timeouts(struct ssh *, int);
+int ssh_packet_inc_alive_timeouts(struct ssh *);
+int ssh_packet_set_maxsize(struct ssh *, u_int);
+u_int ssh_packet_get_maxsize(struct ssh *);
-/* don't allow remaining bytes after the end of the message */
-#define packet_check_eom() \
-do { \
- int _len = packet_remaining(); \
- if (_len > 0) { \
- logit("Packet integrity error (%d bytes remaining) at %s:%d", \
- _len ,__FILE__, __LINE__); \
- packet_disconnect("Packet integrity error."); \
- } \
-} while (0)
+int ssh_packet_get_state(struct ssh *, struct sshbuf *);
+int ssh_packet_set_state(struct ssh *, struct sshbuf *);
-int packet_need_rekeying(void);
-void packet_set_rekey_limit(u_int32_t);
+const char *ssh_remote_ipaddr(struct ssh *);
-void packet_backup_state(void);
-void packet_restore_state(void);
+int ssh_packet_need_rekeying(struct ssh *);
+void ssh_packet_set_rekey_limits(struct ssh *, u_int32_t, time_t);
+time_t ssh_packet_get_rekey_timeout(struct ssh *);
-void *packet_get_input(void);
-void *packet_get_output(void);
+/* XXX FIXME */
+void ssh_packet_backup_state(struct ssh *, struct ssh *);
+void ssh_packet_restore_state(struct ssh *, struct ssh *);
+
+void *ssh_packet_get_input(struct ssh *);
+void *ssh_packet_get_output(struct ssh *);
+
+/* new API */
+int sshpkt_start(struct ssh *ssh, u_char type);
+int sshpkt_send(struct ssh *ssh);
+int sshpkt_disconnect(struct ssh *, const char *fmt, ...)
+ __attribute__((format(printf, 2, 3)));
+int sshpkt_add_padding(struct ssh *, u_char);
+void sshpkt_fatal(struct ssh *ssh, const char *tag, int r);
+
+int sshpkt_put(struct ssh *ssh, const void *v, size_t len);
+int sshpkt_putb(struct ssh *ssh, const struct sshbuf *b);
+int sshpkt_put_u8(struct ssh *ssh, u_char val);
+int sshpkt_put_u32(struct ssh *ssh, u_int32_t val);
+int sshpkt_put_u64(struct ssh *ssh, u_int64_t val);
+int sshpkt_put_string(struct ssh *ssh, const void *v, size_t len);
+int sshpkt_put_cstring(struct ssh *ssh, const void *v);
+int sshpkt_put_stringb(struct ssh *ssh, const struct sshbuf *v);
+int sshpkt_put_ec(struct ssh *ssh, const EC_POINT *v, const EC_GROUP *g);
+int sshpkt_put_bignum1(struct ssh *ssh, const BIGNUM *v);
+int sshpkt_put_bignum2(struct ssh *ssh, const BIGNUM *v);
+
+int sshpkt_get(struct ssh *ssh, void *valp, size_t len);
+int sshpkt_get_u8(struct ssh *ssh, u_char *valp);
+int sshpkt_get_u32(struct ssh *ssh, u_int32_t *valp);
+int sshpkt_get_u64(struct ssh *ssh, u_int64_t *valp);
+int sshpkt_get_string(struct ssh *ssh, u_char **valp, size_t *lenp);
+int sshpkt_get_string_direct(struct ssh *ssh, const u_char **valp, size_t *lenp);
+int sshpkt_get_cstring(struct ssh *ssh, char **valp, size_t *lenp);
+int sshpkt_get_ec(struct ssh *ssh, EC_POINT *v, const EC_GROUP *g);
+int sshpkt_get_bignum1(struct ssh *ssh, BIGNUM *v);
+int sshpkt_get_bignum2(struct ssh *ssh, BIGNUM *v);
+int sshpkt_get_end(struct ssh *ssh);
+const u_char *sshpkt_ptr(struct ssh *, size_t *lenp);
+
+/* OLD API */
+extern struct ssh *active_state;
+#include "opacket.h"
+
+#if !defined(WITH_OPENSSL)
+# undef BIGNUM
+# undef EC_KEY
+# undef EC_GROUP
+# undef EC_POINT
+#elif !defined(OPENSSL_HAS_ECC)
+# undef EC_KEY
+# undef EC_GROUP
+# undef EC_POINT
+#endif
#endif /* PACKET_H */