summaryrefslogtreecommitdiff
path: root/session.h
Commit message (Collapse)AuthorAgeFilesLines
* added option to disable trivial auth methods (#128)Manfred Kaiser2021-08-191-0/+1
| | | | | | | | * added option to disable trivial auth methods * rename argument to match with other ssh clients * fixed trivial auth detection for pubkeys
* Get client fuzzer building and starting (fails straight away)Matt Johnston2020-10-181-0/+2
|
* merge rsa-sha256Matt Johnston2020-05-261-7/+11
|\
| * send and handle SSH_MSG_EXT_INFO only at the correct pointMatt Johnston2020-05-241-7/+5
| | | | | | | | | | - other fixes for rsa pubkey auth - only include ext-info handling when rsa pubkey auth is compiled
| * ext-info handling for server-sig-algsMatt Johnston2020-05-191-7/+4
| | | | | | | | only client side is handled
| * split signkey_type and signature_type for RSA sha1 vs sha256Matt Johnston2020-05-171-2/+10
| |
| * use sigtype where appropriateMatt Johnston2020-04-061-1/+2
| |
* | CBC mode cleanup (#95)Vladislav Grishenko2020-05-251-0/+2
| | | | | | | | | | | | * Fix CBC mode can't be fully disabled * Fix CBC mode can't be the only mode
* | Add Chacha20-Poly1305, AES128-GCM and AES256-GCM support (#93)Vladislav Grishenko2020-05-251-0/+8
|/ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * Add Chacha20-Poly1305 authenticated encryption * Add general AEAD approach. * Add chacha20-poly1305@openssh.com algo using LibTomCrypt chacha and poly1305 routines. Chacha20-Poly1305 is generally faster than AES256 on CPU w/o dedicated AES instructions, having the same key size. Compiling in will add ~5,5kB to binary size on x86-64. function old new delta chacha_crypt - 1397 +1397 _poly1305_block - 608 +608 poly1305_done - 595 +595 dropbear_chachapoly_crypt - 457 +457 .rodata 26976 27392 +416 poly1305_process - 290 +290 poly1305_init - 221 +221 chacha_setup - 218 +218 encrypt_packet 1068 1270 +202 dropbear_chachapoly_getlength - 147 +147 decrypt_packet 756 897 +141 chacha_ivctr64 - 137 +137 read_packet 543 637 +94 dropbear_chachapoly_start - 94 +94 read_kex_algos 792 880 +88 chacha_keystream - 69 +69 dropbear_mode_chachapoly - 48 +48 sshciphers 280 320 +40 dropbear_mode_none 24 48 +24 dropbear_mode_ctr 24 48 +24 dropbear_mode_cbc 24 48 +24 dropbear_chachapoly_mac - 24 +24 dropbear_chachapoly - 24 +24 gen_new_keys 848 854 +6 ------------------------------------------------------------------------------ (add/remove: 14/0 grow/shrink: 10/0 up/down: 5388/0) Total: 5388 bytes * Add AES128-GCM and AES256-GCM authenticated encryption * Add general AES-GCM mode. * Add aes128-gcm@openssh.com and aes256-gcm@openssh.com algo using LibTomCrypt gcm routines. AES-GCM is combination of AES CTR mode and GHASH, slower than AES-CTR on CPU w/o dedicated AES/GHASH instructions therefore disabled by default. Compiling in will add ~6kB to binary size on x86-64. function old new delta gcm_process - 1060 +1060 .rodata 26976 27808 +832 gcm_gf_mult - 820 +820 gcm_add_aad - 660 +660 gcm_shift_table - 512 +512 gcm_done - 471 +471 gcm_add_iv - 384 +384 gcm_init - 347 +347 dropbear_gcm_crypt - 309 +309 encrypt_packet 1068 1270 +202 decrypt_packet 756 897 +141 gcm_reset - 118 +118 read_packet 543 637 +94 read_kex_algos 792 880 +88 sshciphers 280 360 +80 gcm_mult_h - 80 +80 dropbear_gcm_start - 62 +62 dropbear_mode_gcm - 48 +48 dropbear_mode_none 24 48 +24 dropbear_mode_ctr 24 48 +24 dropbear_mode_cbc 24 48 +24 dropbear_ghash - 24 +24 dropbear_gcm_getlength - 24 +24 gen_new_keys 848 854 +6 ------------------------------------------------------------------------------ (add/remove: 14/0 grow/shrink: 10/0 up/down: 6434/0) Total: 6434 bytes
* Rename EPKA -> PluginMatt Johnston2019-05-151-6/+6
|
* External Public-Key Authentication API (#72)fabriziobertocci2019-05-151-0/+15
| | | | | | | | | | | | | | | | | | | | | | * Implemented dynamic loading of an external plug-in shared library to delegate public key authentication * Moved conditional compilation of the plugin infrastructure into the configure.ac script to be able to add -ldl to dropbear build only when the flag is enabled * Added tags file to the ignore list * Updated API to have the constructor to return function pointers in the pliugin instance. Added support for passing user name to the checkpubkey function. Added options to the session returned by the plugin and have dropbear to parse and process them * Added -rdynamic to the linker flags when EPKA is enabled * Changed the API to pass a previously created session to the checkPubKey function (created during preauth) * Added documentation to the API * Added parameter addrstring to plugin creation function * Modified the API to retrieve the auth options. Instead of having them as field of the EPKASession struct, they are stored internally (plugin-dependent) in the plugin/session and retrieved through a pointer to a function (in the session) * Changed option string to be a simple char * instead of unsigned char *
* use a full prototype (#56)Fran?ois Perrad2018-02-201-1/+1
|
* include config.h for options.h. don't need to include options.h whenMatt Johnston2018-02-181-1/+0
| | | | includes.h brings it in
* make signal flags volatile, simplify handlingMatt Johnston2018-02-141-5/+6
|
* Remove none cipherMatt Johnston2018-02-091-2/+0
|
* Convert #ifdef to #if, other build changesMatt Johnston2016-05-041-5/+5
|
* fix empty C prototypesFrancois Perrad2016-01-011-10/+10
|
* A few minor style fixesMatt Johnston2015-12-151-1/+1
|
* Client: kill proxy command when exiting application.Konstantin Tokarev2015-12-031-1/+3
|
* fix build when ENABLE_CLI_INTERACT_AUTH is disabledMike Frysinger2015-10-211-2/+1
| | | | | | The session.h defines clientsession.cipher_none_after_auth only when ENABLE_CLI_INTERACT_AUTH is defined, but cli-session.c will always try to set that member. export cipher_none_after_auth all the time.
* Fix problem where auth timeout wasn't checked when waiting for identMatt Johnston2015-08-031-5/+5
|
* Turn sshsession's remoteident attribute into char *Ga?l PORTAY2015-05-021-1/+1
|
* Turn cleantext()'s dirtytext argument into char *Ga?l PORTAY2015-05-021-1/+1
|
* Make main socket nonblocking. Limit writequeue size.Matt Johnston2015-03-201-0/+1
|
* Fix pubkey auth after change to reuse ses.readbuf as ses.payloadMatt Johnston2015-03-011-1/+4
| | | | (4d7b4c5526c5)
* A bit of a bodge to avoid memcpy if zlib is disabledMatt Johnston2015-03-011-0/+1
|
* merge from defaultMatt Johnston2015-02-281-6/+6
|\
| * Add more ATTRIB_NORETURN annotations, from Thorsten HorstmannMatt Johnston2015-02-241-3/+3
| |
| * DROPBEAR_ prefix for include guards to avoid collisionsThorsten Horstmann2015-02-241-3/+3
| |
* | Move generic network routines to netio.cMatt Johnston2015-02-201-0/+1
| |
* | In theory TFO should work. Needs platform cleanup and testingMatt Johnston2015-02-191-1/+1
| |
* | async connections workingMatt Johnston2015-02-181-0/+1
| |
* | work in progress for async connectMatt Johnston2015-02-181-0/+2
|/
* Make keepalive handling more robust, this should now match what OpenSSH doesMatt Johnston2014-08-191-1/+1
|
* Don't send SSH_MSG_UNIMPLEMENTED for keepalive responsesMatt Johnston2014-08-131-0/+1
|
* Make sure the check_close() handler runs when a server child process exitsMatt Johnston2014-07-281-0/+1
|
* Set tcp priority as follows:Matt Johnston2014-07-161-1/+5
| | | | | | | | if (connecting || ptys || x11) tos = LOWDELAY; else if (tcp_forwards) tos = 0; else tos = BULK; TCP forwards could be either lowdelay or bulk, hence the default priority.
* Fix auth timeout regressionMatt Johnston2014-07-091-5/+5
|
* Make -K keepalive behave like OpenSSH's ServerAliveIntervalMatt Johnston2014-07-091-5/+8
|
* Add new monotonic_now() wrapper so that timeouts are unaffected byMatt Johnston2014-03-131-3/+4
| | | | system clock changes
* requirenext doesn't need two valuesMatt Johnston2014-01-231-3/+2
|
* DROPBEAR_CLI_AUTH_IMMEDIATE fixed, now enabled by defaultMatt Johnston2014-01-171-0/+2
|
* use oldstyle commentsMatt Johnston2013-11-141-1/+1
|
* curve25519Matt Johnston2013-11-081-0/+1
|
* merge in HEADMatt Johnston2013-05-211-16/+16
|\
| * requirenext fixup for firstkexfollowsMatt Johnston2013-04-141-2/+3
| |
| * Take transmit and receive keys into use separatelyMatt Johnston2013-04-041-0/+1
| |
| * merge kexguess branchMatt Johnston2013-04-031-3/+2
| |\
| | * Run the cleanup handler also when we close due to TCP connection being closedMatt Johnston2013-04-011-2/+2
| | |
| * | Don't usually need to recalculate dh_e for the repeated kexdh_init packetMatt Johnston2013-04-031-0/+1
| | |
View Lorry Controller Status