| Age | Commit message (Collapse) | Author |
|---|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Add ssh_trpt_test_lib:instantiate/2, ssh_test_lib:default_algoritms/2 and algo_intersection/2
ssh_to_openssh_SUITE uses only algos that sshd and ssh client supports
raised timeout limit in ssh_basic_SUITE:ssh_connect_arg4_timeout
Break out ssh_renegotiate_SUITE from ssh_basic_SUITE
Move std_daemon/4 to ssh_test_lib.erl
Add ssh_algorithms_SUITE
Add ssh_options_SUITE
Add assymetric testing of algorithms
Add openssh tests to ssh_algorithms_SUITE
Remove algo tests from ssh_sftp_SUITE (now in ssh_algorithms_SUITE)
Removed kex algo tests from in ssh_basic_SUITE because they are now in ssh_algorithm_SUITE.
fixed test case ssh_protocol_SUITE:no_common_alg_server_disconnects/1
|
|
Adds ecdh-sha2-nistp256
ecdh-sha2-nistp384
ecdh-sha2-nistp512
and OTP-12938
hmac-sha2-512
|
|
A new experimental option 'max_random_length_padding', not documented so it might change...
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
DO NOT USE IN PRODUCTION!!!
It is not enabled by default, but may be enabled with the option
{preferred_algorithms, [{kex, ['diffie-hellman-group-exchange-sha256']}]}
|
|
DO NOT USE IN PRODUCTION!!!
This is a bug fixing of the previously partly impelmented kex algorithm.
There are more things to do, for example genrate/select better g,p pair obeying the min||n||max request.
It is not enabled by default, but may be enabled with the option
{preferred_algorithms, [{kex, ['diffie-hellman-group-exchange-sha1']}]}
|
|
|
|
Ssh_sftp.erl handled incorrectly unicode data in ssh_ftp:write_file.
There was also problems with some deeper iolists.
|
|
|
|
Conflicts:
lib/ssh/test/ssh_basic_SUITE.erl
|
|
* hans/ssh/unknown_msgfun/OTP-12813:
ssh: Option unexpectedfun for ssh:daemon and ssh:connect
|
|
* hans/ssh/no_erlint_func/OTP-11697:
ssh: Replace erlint/1 in ssh_message.erl and ssh_auth.erl
|
|
This option has a fun as value. The fun will be called when an
unexpected message arrives. The fun returns either 'skip' or 'report'
to guide the connection_handler what to do.
One usage is to filter out messages that are not wanted in the error
logger as info reports. An example of such a message is the 'etimedout'
tcp error message that will be received if a connection has keep_alive
and the peer is restarted.
|
|
|
|
|
|
|
|
In the old times there was no binary notation which handled this particulary case, but now we can write big-signed-integer-unit:8 directly in binaries.
The undocumented internal function ssh_bits:erlint/1 is removed.
|
|
* ia/ssh/name-spaces/OTP-12675:
ssh: Correct Makefile
ssh: Add profile option
|
|
* hans/ssh/check_dirs/OTP-12788:
ssh: Check that user_dir and system_dir exists and are readable
|
|
|
|
|
|
The ssh application does not have any external include files
|
|
To enable the ssh daemon to run in a virtualized environment, where
there can be more that one server that has the same ip-address
and port, we add a new option profile. The profile name will be
used in concatenation with ip-address and port to identify the
ssh daemon instance.
The name profile was chosen as there is a similar concept in the HTTP client
in inets where profile names can be used to instantiate client configurations.
Also the same type of option has been added to the HTTP server in inets.
|
|
|
|
Conflicts:
OTP_VERSION
lib/inets/test/httpd_SUITE.erl
lib/inets/vsn.mk
lib/ssh/src/ssh.erl
lib/ssh/vsn.mk
lib/ssl/src/ssl.appup.src
lib/ssl/vsn.mk
|
|
* hans/ssh/codenomicon_degradation/OTP-12784:
ssh: update ssh version
ssh: Plain text message returned for invalid version exchange
ssh: Implement keyboard_interactive on server side
ssh: Check e and f parameters in kexdh
ssh: Set max num algoritms in msg_kexinit negotiation
|
|
This is how OpenSSH does. The bytes returned will be put on the
user's tty, so it is better with text than a ssh_msg_disconnect
|
|
|
|
rfc 4253 says in section 8 that:
"Values of 'e' or 'f' that are not in the range [1, p-1] MUST NOT be
sent or accepted by either side. If this condition is violated, the
key exchange fails."
This commit implements the reception check.
|
|
This is to prevent some dos-attac scenarios. The limit is hard-coded.
|
|
If something bad happens and the socket is closed the
call inet:getopts(Socket, [recbuf]) may return {ok, []}. We
want to treat this as a fatal error and terminate gracefully.
The same goes for the case that inet:getopts returns {error, Reason}
that was not handled either.
|
|
The 'compression' option was used in the test cases. The new option 'preferred_algorithms' is
much more powerful and can be used as a replacement.
|
|
This option enables the user to define which algorithms that
are to be used as well as their precedences in the negotiation
between server and client.
|
|
This option is set internaly but there is no reason to set it when calling a function.
|
|
In RFC 4253, sections 7.1 & 9 describe rekeying with
special attention to the protocol messages that may be
received and may not be sent during rekeying.
This patch fixes a number of problems during rekeying
caused by data & requests received from the network, and/or data & requests sent by the user.
|
|
When in the connected state, an received KEXINIT
message MUST be responded to with KEXINIT. After that,
the client may continue with KEXDH_INIT (or similar).
See the first paragraph on RFC 4253 sec. 9.
|
