summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
-rw-r--r--cipher.c13
-rw-r--r--cipher.h3
-rw-r--r--kex.c7
-rw-r--r--packet.c38
-rw-r--r--readconf.c12
-rw-r--r--servconf.c9
-rw-r--r--ssh.c19
-rw-r--r--sshconnect2.c6
8 files changed, 91 insertions, 16 deletions
diff --git a/cipher.c b/cipher.c
index 25f98ba8e..820bc6ace 100644
--- a/cipher.c
+++ b/cipher.c
@@ -1,4 +1,4 @@
1/* $OpenBSD: cipher.c,v 1.113 2019/09/06 05:23:55 djm Exp $ */ 1/* $OpenBSD: cipher.c,v 1.114 2020/01/23 10:24:29 dtucker Exp $ */
2/* 2/*
3 * Author: Tatu Ylonen <ylo@cs.hut.fi> 3 * Author: Tatu Ylonen <ylo@cs.hut.fi>
4 * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland 4 * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
@@ -143,6 +143,17 @@ cipher_alg_list(char sep, int auth_only)
143 return ret; 143 return ret;
144} 144}
145 145
146const char *
147compression_alg_list(int compression)
148{
149#ifdef WITH_ZLIB
150 return compression ? "zlib@openssh.com,zlib,none" :
151 "none,zlib@openssh.com,zlib";
152#else
153 return "none";
154#endif
155}
156
146u_int 157u_int
147cipher_blocksize(const struct sshcipher *c) 158cipher_blocksize(const struct sshcipher *c)
148{ 159{
diff --git a/cipher.h b/cipher.h
index 5843aab49..1a591cd7f 100644
--- a/cipher.h
+++ b/cipher.h
@@ -1,4 +1,4 @@
1/* $OpenBSD: cipher.h,v 1.54 2019/09/06 05:23:55 djm Exp $ */ 1/* $OpenBSD: cipher.h,v 1.55 2020/01/23 10:24:29 dtucker Exp $ */
2 2
3/* 3/*
4 * Author: Tatu Ylonen <ylo@cs.hut.fi> 4 * Author: Tatu Ylonen <ylo@cs.hut.fi>
@@ -54,6 +54,7 @@ const struct sshcipher *cipher_by_name(const char *);
54const char *cipher_warning_message(const struct sshcipher_ctx *); 54const char *cipher_warning_message(const struct sshcipher_ctx *);
55int ciphers_valid(const char *); 55int ciphers_valid(const char *);
56char *cipher_alg_list(char, int); 56char *cipher_alg_list(char, int);
57const char *compression_alg_list(int);
57int cipher_init(struct sshcipher_ctx **, const struct sshcipher *, 58int cipher_init(struct sshcipher_ctx **, const struct sshcipher *,
58 const u_char *, u_int, const u_char *, u_int, int); 59 const u_char *, u_int, const u_char *, u_int, int);
59int cipher_crypt(struct sshcipher_ctx *, u_int, u_char *, const u_char *, 60int cipher_crypt(struct sshcipher_ctx *, u_int, u_char *, const u_char *,
diff --git a/kex.c b/kex.c
index 2195cea4e..ce85f0439 100644
--- a/kex.c
+++ b/kex.c
@@ -1,4 +1,4 @@
1/* $OpenBSD: kex.c,v 1.155 2019/10/08 22:40:39 dtucker Exp $ */ 1/* $OpenBSD: kex.c,v 1.156 2020/01/23 10:24:29 dtucker Exp $ */
2/* 2/*
3 * Copyright (c) 2000, 2001 Markus Friedl. All rights reserved. 3 * Copyright (c) 2000, 2001 Markus Friedl. All rights reserved.
4 * 4 *
@@ -798,11 +798,14 @@ choose_comp(struct sshcomp *comp, char *client, char *server)
798 798
799 if (name == NULL) 799 if (name == NULL)
800 return SSH_ERR_NO_COMPRESS_ALG_MATCH; 800 return SSH_ERR_NO_COMPRESS_ALG_MATCH;
801#ifdef WITH_ZLIB
801 if (strcmp(name, "zlib@openssh.com") == 0) { 802 if (strcmp(name, "zlib@openssh.com") == 0) {
802 comp->type = COMP_DELAYED; 803 comp->type = COMP_DELAYED;
803 } else if (strcmp(name, "zlib") == 0) { 804 } else if (strcmp(name, "zlib") == 0) {
804 comp->type = COMP_ZLIB; 805 comp->type = COMP_ZLIB;
805 } else if (strcmp(name, "none") == 0) { 806 } else
807#endif /* WITH_ZLIB */
808 if (strcmp(name, "none") == 0) {
806 comp->type = COMP_NONE; 809 comp->type = COMP_NONE;
807 } else { 810 } else {
808 error("%s: unsupported compression scheme %s", __func__, name); 811 error("%s: unsupported compression scheme %s", __func__, name);
diff --git a/packet.c b/packet.c
index 2b50ef415..cffadd9a4 100644
--- a/packet.c
+++ b/packet.c
@@ -1,4 +1,4 @@
1/* $OpenBSD: packet.c,v 1.287 2019/12/16 13:58:53 tobhe Exp $ */ 1/* $OpenBSD: packet.c,v 1.288 2020/01/23 10:24:29 dtucker Exp $ */
2/* 2/*
3 * Author: Tatu Ylonen <ylo@cs.hut.fi> 3 * Author: Tatu Ylonen <ylo@cs.hut.fi>
4 * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland 4 * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
@@ -76,7 +76,9 @@
76# endif 76# endif
77#endif 77#endif
78 78
79#ifdef WITH_ZLIB
79#include <zlib.h> 80#include <zlib.h>
81#endif
80 82
81#include "xmalloc.h" 83#include "xmalloc.h"
82#include "compat.h" 84#include "compat.h"
@@ -150,9 +152,11 @@ struct session_state {
150 /* Scratch buffer for packet compression/decompression. */ 152 /* Scratch buffer for packet compression/decompression. */
151 struct sshbuf *compression_buffer; 153 struct sshbuf *compression_buffer;
152 154
155#ifdef WITH_ZLIB
153 /* Incoming/outgoing compression dictionaries */ 156 /* Incoming/outgoing compression dictionaries */
154 z_stream compression_in_stream; 157 z_stream compression_in_stream;
155 z_stream compression_out_stream; 158 z_stream compression_out_stream;
159#endif
156 int compression_in_started; 160 int compression_in_started;
157 int compression_out_started; 161 int compression_out_started;
158 int compression_in_failures; 162 int compression_in_failures;
@@ -609,7 +613,8 @@ ssh_packet_close_internal(struct ssh *ssh, int do_close)
609 state->newkeys[mode] = NULL; 613 state->newkeys[mode] = NULL;
610 ssh_clear_newkeys(ssh, mode); /* next keys */ 614 ssh_clear_newkeys(ssh, mode); /* next keys */
611 } 615 }
612 /* compression state is in shared mem, so we can only release it once */ 616#ifdef WITH_ZLIB
617 /* comression state is in shared mem, so we can only release it once */
613 if (do_close && state->compression_buffer) { 618 if (do_close && state->compression_buffer) {
614 sshbuf_free(state->compression_buffer); 619 sshbuf_free(state->compression_buffer);
615 if (state->compression_out_started) { 620 if (state->compression_out_started) {
@@ -635,6 +640,7 @@ ssh_packet_close_internal(struct ssh *ssh, int do_close)
635 inflateEnd(stream); 640 inflateEnd(stream);
636 } 641 }
637 } 642 }
643#endif /* WITH_ZLIB */
638 cipher_free(state->send_context); 644 cipher_free(state->send_context);
639 cipher_free(state->receive_context); 645 cipher_free(state->receive_context);
640 state->send_context = state->receive_context = NULL; 646 state->send_context = state->receive_context = NULL;
@@ -690,6 +696,7 @@ ssh_packet_init_compression(struct ssh *ssh)
690 return 0; 696 return 0;
691} 697}
692 698
699#ifdef WITH_ZLIB
693static int 700static int
694start_compression_out(struct ssh *ssh, int level) 701start_compression_out(struct ssh *ssh, int level)
695{ 702{
@@ -821,6 +828,33 @@ uncompress_buffer(struct ssh *ssh, struct sshbuf *in, struct sshbuf *out)
821 /* NOTREACHED */ 828 /* NOTREACHED */
822} 829}
823 830
831#else /* WITH_ZLIB */
832
833static int
834start_compression_out(struct ssh *ssh, int level)
835{
836 return SSH_ERR_INTERNAL_ERROR;
837}
838
839static int
840start_compression_in(struct ssh *ssh)
841{
842 return SSH_ERR_INTERNAL_ERROR;
843}
844
845static int
846compress_buffer(struct ssh *ssh, struct sshbuf *in, struct sshbuf *out)
847{
848 return SSH_ERR_INTERNAL_ERROR;
849}
850
851static int
852uncompress_buffer(struct ssh *ssh, struct sshbuf *in, struct sshbuf *out)
853{
854 return SSH_ERR_INTERNAL_ERROR;
855}
856#endif /* WITH_ZLIB */
857
824void 858void
825ssh_clear_newkeys(struct ssh *ssh, int mode) 859ssh_clear_newkeys(struct ssh *ssh, int mode)
826{ 860{
diff --git a/readconf.c b/readconf.c
index 59443bfdb..b25984548 100644
--- a/readconf.c
+++ b/readconf.c
@@ -1,4 +1,4 @@
1/* $OpenBSD: readconf.c,v 1.321 2020/01/23 07:10:22 dtucker Exp $ */ 1/* $OpenBSD: readconf.c,v 1.322 2020/01/23 10:24:29 dtucker Exp $ */
2/* 2/*
3 * Author: Tatu Ylonen <ylo@cs.hut.fi> 3 * Author: Tatu Ylonen <ylo@cs.hut.fi>
4 * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland 4 * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
@@ -837,6 +837,13 @@ static const struct multistate multistate_canonicalizehostname[] = {
837 { "always", SSH_CANONICALISE_ALWAYS }, 837 { "always", SSH_CANONICALISE_ALWAYS },
838 { NULL, -1 } 838 { NULL, -1 }
839}; 839};
840static const struct multistate multistate_compression[] = {
841#ifdef WITH_ZLIB
842 { "yes", COMP_ZLIB },
843#endif
844 { "no", COMP_NONE },
845 { NULL, -1 }
846};
840 847
841/* 848/*
842 * Processes a single option line as used in the configuration files. This 849 * Processes a single option line as used in the configuration files. This
@@ -1046,7 +1053,8 @@ parse_time:
1046 1053
1047 case oCompression: 1054 case oCompression:
1048 intptr = &options->compression; 1055 intptr = &options->compression;
1049 goto parse_flag; 1056 multistate_ptr = multistate_compression;
1057 goto parse_multistate;
1050 1058
1051 case oTCPKeepAlive: 1059 case oTCPKeepAlive:
1052 intptr = &options->tcp_keep_alive; 1060 intptr = &options->tcp_keep_alive;
diff --git a/servconf.c b/servconf.c
index 1a4c49907..1e0718139 100644
--- a/servconf.c
+++ b/servconf.c
@@ -1,5 +1,5 @@
1 1
2/* $OpenBSD: servconf.c,v 1.358 2020/01/23 02:46:49 dtucker Exp $ */ 2/* $OpenBSD: servconf.c,v 1.359 2020/01/23 10:24:29 dtucker Exp $ */
3/* 3/*
4 * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland 4 * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
5 * All rights reserved 5 * All rights reserved
@@ -384,7 +384,12 @@ fill_default_server_options(ServerOptions *options)
384 options->permit_user_env_whitelist = NULL; 384 options->permit_user_env_whitelist = NULL;
385 } 385 }
386 if (options->compression == -1) 386 if (options->compression == -1)
387#ifdef WITH_ZLIB
387 options->compression = COMP_DELAYED; 388 options->compression = COMP_DELAYED;
389#else
390 options->compression = COMP_NONE;
391#endif
392
388 if (options->rekey_limit == -1) 393 if (options->rekey_limit == -1)
389 options->rekey_limit = 0; 394 options->rekey_limit = 0;
390 if (options->rekey_interval == -1) 395 if (options->rekey_interval == -1)
@@ -1213,8 +1218,10 @@ static const struct multistate multistate_permitrootlogin[] = {
1213 { NULL, -1 } 1218 { NULL, -1 }
1214}; 1219};
1215static const struct multistate multistate_compression[] = { 1220static const struct multistate multistate_compression[] = {
1221#ifdef WITH_ZLIB
1216 { "yes", COMP_DELAYED }, 1222 { "yes", COMP_DELAYED },
1217 { "delayed", COMP_DELAYED }, 1223 { "delayed", COMP_DELAYED },
1224#endif
1218 { "no", COMP_NONE }, 1225 { "no", COMP_NONE },
1219 { NULL, -1 } 1226 { NULL, -1 }
1220}; 1227};
diff --git a/ssh.c b/ssh.c
index c0511f2a0..851d85b50 100644
--- a/ssh.c
+++ b/ssh.c
@@ -1,4 +1,4 @@
1/* $OpenBSD: ssh.c,v 1.512 2020/01/23 07:10:22 dtucker Exp $ */ 1/* $OpenBSD: ssh.c,v 1.513 2020/01/23 10:24:29 dtucker Exp $ */
2/* 2/*
3 * Author: Tatu Ylonen <ylo@cs.hut.fi> 3 * Author: Tatu Ylonen <ylo@cs.hut.fi>
4 * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland 4 * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
@@ -602,6 +602,7 @@ main(int ac, char **av)
602 struct addrinfo *addrs = NULL; 602 struct addrinfo *addrs = NULL;
603 struct ssh_digest_ctx *md; 603 struct ssh_digest_ctx *md;
604 u_char conn_hash[SSH_DIGEST_MAX_LENGTH]; 604 u_char conn_hash[SSH_DIGEST_MAX_LENGTH];
605 size_t n, len;
605 606
606 /* Ensure that fds 0, 1 and 2 are open or directed to /dev/null */ 607 /* Ensure that fds 0, 1 and 2 are open or directed to /dev/null */
607 sanitise_stdfd(); 608 sanitise_stdfd();
@@ -753,10 +754,16 @@ main(int ac, char **av)
753 cp = sshkey_alg_list(0, 1, 1, '\n'); 754 cp = sshkey_alg_list(0, 1, 1, '\n');
754 else if (strcmp(optarg, "protocol-version") == 0) 755 else if (strcmp(optarg, "protocol-version") == 0)
755 cp = xstrdup("2"); 756 cp = xstrdup("2");
756 else if (strcmp(optarg, "help") == 0) { 757 else if (strcmp(optarg, "compression") == 0) {
758 cp = xstrdup(compression_alg_list(0));
759 len = strlen(cp);
760 for (n = 0; n < len; n++)
761 if (cp[n] == ',')
762 cp[n] = '\n';
763 } else if (strcmp(optarg, "help") == 0) {
757 cp = xstrdup( 764 cp = xstrdup(
758 "cipher\ncipher-auth\nkex\nkey\n" 765 "cipher\ncipher-auth\ncompression\nkex\n"
759 "key-cert\nkey-plain\nmac\n" 766 "key\nkey-cert\nkey-plain\nmac\n"
760 "protocol-version\nsig"); 767 "protocol-version\nsig");
761 } 768 }
762 if (cp == NULL) 769 if (cp == NULL)
@@ -959,7 +966,11 @@ main(int ac, char **av)
959 break; 966 break;
960 967
961 case 'C': 968 case 'C':
969#ifdef WITH_ZLIB
962 options.compression = 1; 970 options.compression = 1;
971#else
972 error("Compression not supported, disabling.");
973#endif
963 break; 974 break;
964 case 'N': 975 case 'N':
965 no_shell_flag = 1; 976 no_shell_flag = 1;
diff --git a/sshconnect2.c b/sshconnect2.c
index 8d13310f2..3b84a2d56 100644
--- a/sshconnect2.c
+++ b/sshconnect2.c
@@ -1,4 +1,4 @@
1/* $OpenBSD: sshconnect2.c,v 1.317 2020/01/23 07:10:22 dtucker Exp $ */ 1/* $OpenBSD: sshconnect2.c,v 1.318 2020/01/23 10:24:30 dtucker Exp $ */
2/* 2/*
3 * Copyright (c) 2000 Markus Friedl. All rights reserved. 3 * Copyright (c) 2000 Markus Friedl. All rights reserved.
4 * Copyright (c) 2008 Damien Miller. All rights reserved. 4 * Copyright (c) 2008 Damien Miller. All rights reserved.
@@ -174,8 +174,8 @@ ssh_kex2(struct ssh *ssh, char *host, struct sockaddr *hostaddr, u_short port)
174 myproposal[PROPOSAL_ENC_ALGS_STOC] = 174 myproposal[PROPOSAL_ENC_ALGS_STOC] =
175 compat_cipher_proposal(options.ciphers); 175 compat_cipher_proposal(options.ciphers);
176 myproposal[PROPOSAL_COMP_ALGS_CTOS] = 176 myproposal[PROPOSAL_COMP_ALGS_CTOS] =
177 myproposal[PROPOSAL_COMP_ALGS_STOC] = options.compression ? 177 myproposal[PROPOSAL_COMP_ALGS_STOC] =
178 "zlib@openssh.com,zlib,none" : "none,zlib@openssh.com,zlib"; 178 (char *)compression_alg_list(options.compression);
179 myproposal[PROPOSAL_MAC_ALGS_CTOS] = 179 myproposal[PROPOSAL_MAC_ALGS_CTOS] =
180 myproposal[PROPOSAL_MAC_ALGS_STOC] = options.macs; 180 myproposal[PROPOSAL_MAC_ALGS_STOC] = options.macs;
181 if (options.hostkeyalgorithms != NULL) { 181 if (options.hostkeyalgorithms != NULL) {