mirror of
https://github.com/freebsd/freebsd-src
synced 2024-07-21 10:19:04 +00:00
38a52bd3b5
Release notes are available at https://www.openssh.com/txt/release-9.1 9.1 contains fixes for three minor memory safety problems; these have lready been merged to the copy of OpenSSH 9.0 that is in the FreeBSD base system. Some highlights copied from the release notes: Potentially-incompatible changes -------------------------------- * ssh(1), sshd(8): SetEnv directives in ssh_config and sshd_config are now first-match-wins to match other directives. Previously if an environment variable was multiply specified the last set value would have been used. bz3438 * ssh-keygen(8): ssh-keygen -A (generate all default host key types) will no longer generate DSA keys, as these are insecure and have not been used by default for some years. New features ------------ * ssh(1), sshd(8): add a RequiredRSASize directive to set a minimum RSA key length. Keys below this length will be ignored for user authentication and for host authentication in sshd(8). * sftp-server(8): add a "users-groups-by-id@openssh.com" extension request that allows the client to obtain user/group names that correspond to a set of uids/gids. * sftp(1): use "users-groups-by-id@openssh.com" sftp-server extension (when available) to fill in user/group names for directory listings. * sftp-server(8): support the "home-directory" extension request defined in draft-ietf-secsh-filexfer-extensions-00. This overlaps a bit with the existing "expand-path@openssh.com", but some other clients support it. * ssh-keygen(1), sshd(8): allow certificate validity intervals, sshsig verification times and authorized_keys expiry-time options to accept dates in the UTC time zone in addition to the default of interpreting them in the system time zone. YYYYMMDD and YYMMDDHHMM[SS] dates/times will be interpreted as UTC if suffixed with a 'Z' character. Also allow certificate validity intervals to be specified in raw seconds-since-epoch as hex value, e.g. -V 0x1234:0x4567890. This is intended for use by regress tests and other tools that call ssh-keygen as part of a CA workflow. bz3468 * sftp(1): allow arguments to the sftp -D option, e.g. sftp -D "/usr/libexec/sftp-server -el debug3" * ssh-keygen(1): allow the existing -U (use agent) flag to work with "-Y sign" operations, where it will be interpreted to require that the private keys is hosted in an agent; bz3429 MFC after: 2 weeks Relnotes: Yes Sponsored by: The FreeBSD Foundation
126 lines
3.2 KiB
Bash
126 lines
3.2 KiB
Bash
# $OpenBSD: envpass.sh,v 1.5 2022/06/03 04:31:54 djm Exp $
|
|
# Placed in the Public Domain.
|
|
|
|
tid="environment passing"
|
|
|
|
# NB accepted env vars are in test-exec.sh (_XXX_TEST_* and _XXX_TEST)
|
|
|
|
# Prepare a custom config to test for a configuration parsing bug fixed in 4.0
|
|
cat << EOF > $OBJ/ssh_proxy_envpass
|
|
Host test-sendenv-confparse-bug
|
|
SendEnv *
|
|
EOF
|
|
cat $OBJ/ssh_proxy >> $OBJ/ssh_proxy_envpass
|
|
cp $OBJ/sshd_proxy $OBJ/sshd_proxy_bak
|
|
|
|
trace "pass env, don't accept"
|
|
verbose "test $tid: pass env, don't accept"
|
|
_TEST_ENV=blah ${SSH} -oSendEnv="*" -F $OBJ/ssh_proxy_envpass otherhost \
|
|
sh << 'EOF'
|
|
test -z "$_TEST_ENV"
|
|
EOF
|
|
r=$?
|
|
if [ $r -ne 0 ]; then
|
|
fail "environment found"
|
|
fi
|
|
|
|
trace "setenv, don't accept"
|
|
verbose "test $tid: setenv, don't accept"
|
|
${SSH} -oSendEnv="*" -F $OBJ/ssh_proxy_envpass -oSetEnv="_TEST_ENV=blah" \
|
|
otherhost \
|
|
sh << 'EOF'
|
|
test -z "$_TEST_ENV"
|
|
EOF
|
|
r=$?
|
|
if [ $r -ne 0 ]; then
|
|
fail "environment found"
|
|
fi
|
|
|
|
trace "don't pass env, accept"
|
|
verbose "test $tid: don't pass env, accept"
|
|
_XXX_TEST_A=1 _XXX_TEST_B=2 ${SSH} -F $OBJ/ssh_proxy_envpass otherhost \
|
|
sh << 'EOF'
|
|
test -z "$_XXX_TEST_A" && test -z "$_XXX_TEST_B"
|
|
EOF
|
|
r=$?
|
|
if [ $r -ne 0 ]; then
|
|
fail "environment found"
|
|
fi
|
|
|
|
trace "pass single env, accept single env"
|
|
verbose "test $tid: pass single env, accept single env"
|
|
_XXX_TEST=blah ${SSH} -oSendEnv="_XXX_TEST" -F $OBJ/ssh_proxy_envpass \
|
|
otherhost sh << 'EOF'
|
|
test X"$_XXX_TEST" = X"blah"
|
|
EOF
|
|
r=$?
|
|
if [ $r -ne 0 ]; then
|
|
fail "environment not found"
|
|
fi
|
|
|
|
trace "pass multiple env, accept multiple env"
|
|
verbose "test $tid: pass multiple env, accept multiple env"
|
|
_XXX_TEST_A=1 _XXX_TEST_B=2 ${SSH} -oSendEnv="_XXX_TEST_*" \
|
|
-F $OBJ/ssh_proxy_envpass otherhost \
|
|
sh << 'EOF'
|
|
test X"$_XXX_TEST_A" = X"1" -a X"$_XXX_TEST_B" = X"2"
|
|
EOF
|
|
r=$?
|
|
if [ $r -ne 0 ]; then
|
|
fail "environment not found"
|
|
fi
|
|
|
|
trace "setenv, accept"
|
|
verbose "test $tid: setenv, accept"
|
|
${SSH} -F $OBJ/ssh_proxy_envpass \
|
|
-oSetEnv="_XXX_TEST_A=1 _XXX_TEST_B=2" otherhost \
|
|
sh << 'EOF'
|
|
test X"$_XXX_TEST_A" = X"1" -a X"$_XXX_TEST_B" = X"2"
|
|
EOF
|
|
r=$?
|
|
if [ $r -ne 0 ]; then
|
|
fail "environment not found"
|
|
fi
|
|
trace "setenv, first match wins"
|
|
verbose "test $tid: setenv, first match wins"
|
|
${SSH} -F $OBJ/ssh_proxy_envpass \
|
|
-oSetEnv="_XXX_TEST_A=1 _XXX_TEST_A=11 _XXX_TEST_B=2" otherhost \
|
|
sh << 'EOF'
|
|
test X"$_XXX_TEST_A" = X"1" -a X"$_XXX_TEST_B" = X"2"
|
|
EOF
|
|
r=$?
|
|
if [ $r -ne 0 ]; then
|
|
fail "environment not found"
|
|
fi
|
|
|
|
trace "server setenv wins"
|
|
verbose "test $tid: server setenv wins"
|
|
cp $OBJ/sshd_proxy_bak $OBJ/sshd_proxy
|
|
echo "SetEnv _XXX_TEST_A=23" >> $OBJ/sshd_proxy
|
|
${SSH} -F $OBJ/ssh_proxy_envpass \
|
|
-oSetEnv="_XXX_TEST_A=1 _XXX_TEST_B=2" otherhost \
|
|
sh << 'EOF'
|
|
test X"$_XXX_TEST_A" = X"23" -a X"$_XXX_TEST_B" = X"2"
|
|
EOF
|
|
r=$?
|
|
if [ $r -ne 0 ]; then
|
|
fail "environment not found"
|
|
fi
|
|
|
|
trace "server setenv first match wins"
|
|
verbose "test $tid: server setenv wins"
|
|
cp $OBJ/sshd_proxy_bak $OBJ/sshd_proxy
|
|
echo "SetEnv _XXX_TEST_A=23 _XXX_TEST_A=42" >> $OBJ/sshd_proxy
|
|
${SSH} -F $OBJ/ssh_proxy_envpass \
|
|
-oSetEnv="_XXX_TEST_A=1 _XXX_TEST_B=2" otherhost \
|
|
sh << 'EOF'
|
|
test X"$_XXX_TEST_A" = X"23" -a X"$_XXX_TEST_B" = X"2"
|
|
EOF
|
|
r=$?
|
|
if [ $r -ne 0 ]; then
|
|
fail "environment not found"
|
|
fi
|
|
|
|
|
|
rm -f $OBJ/ssh_proxy_envpass
|