imrcpan/freebsd
1
0 Fork 0
mirror of https://github.com/freebsd/freebsd-src.git synced 2026-10-28 11:25:21 +01:00
Code Issues Packages Projects Releases Wiki Activity
Files
bb5c77e9d281d6def6835d48249898764bc6a5fe
freebsd/crypto/openssh/.github/workflows/vm.yml
T
Ed Maste bb5c77e9d2 OpenSSH: Update to 10.4p1 
Full release notes are available at
https://www.openssh.com/txt/release-10.4

Selected highlights from the release notes:

Potentially-incompatible changes
--------------------------------

 * sshd(8): configuration dump mode ("sshd -G") now writes directives
   in mixed case (e.g. "PubkeyAuthentication") whereas previously it
   emitted only lower-case names.

 * ssh(1), sshd(8): make the transport protocol stricter by
   disconnecting if the peer sends non-KEX messages during a post-
   authentication key re-exchange. Previously a malicious peer could
   continue sending non-key exchange messages without penalty. These
   would be buffered, causing memory to be wasted up until the
   connection terminated or the server/client hit a memory limit.
   Implementations that do not restrict messages sent during key
   exchange as per RFC4253 section 7.1 may be disconnected.
   Reported by Marko Jevtic.

Changes since OpenSSH 10.3
==========================

This release contains a number of security fixes as well as general
bugfixes and a couple of new features.

Security
========

 * sftp(1): when downloading files on the command-line using
   "sftp host:/path .", a malicious server could cause the file to
   be downloaded to an unexpected location. This issue was identified
   by the Swival Security Scanner.

 * scp(1): when copying files between two remote destinations, do
   not allow a malicious server to write files to the parent
   directory of the intended target directory.  This issue was
   identified by the Swival Security Scanner.

 * sshd(8): DisableForwarding=yes didn't override PermitTunnel=yes
   as it was documented to do. Note that PermitTunnel is not enabled
   by default. Reported independently by Huzaifa Sidhpurwala of
   Redhat and Marko Jevtic.

 * sshd(8): avoid a potential pre-authentication denial of service
   when GSSAPIAuthentication was enabled (this feature is off by
   default). This was not mitigated by MaxAuthTries, but would be
   penalised by PerSourcePenalties. This was reported by Manfred
   Kaiser of the milCERT AT (Austrian Ministry of Defence).

 * sshd(8): fix a number of cases where the minimum authentication
   delay was not being enforced. Reported by the Orange Cyberdefense
   Vulnerability Team.

 * ssh(1): fix a possible client-side use-after-free if the server
   changes its host key during a key reexchange. This was reported by
   Zhenpeng (Leo) Lin of Depthfirst.

New features
------------

 * All: add experimental support for a composite post-quantum
   signature scheme that combines ML-DSA 44 and Ed25519 as specified
   in draft-miller-sshm-mldsa44-ed25519-composite-sigs.

   This scheme is not enabled by default. To use it, you'll need
   to add it to HostKeyAlgorithms, PubkeyAcceptedAlgorithms, etc.
   Keys may be generated using "ssh-keygen -t mldsa44-ed25519".

Bugfixes
--------

 * sshd(8): avoid sending observably different messages for valid vs
   invalid users in GSSAPIAuthentication (disabled by default).

 * ssh(1), sshd(8): fix several bugs that incorrectly
   classified bulk traffic as interactive. bz3972, bz3958

 * ssh-keygen(1), ssh-add(1): skip unsupported key types when
   downloading resident keys from a FIDO token. Previously, downloads
   would abort when one was encountered. GHPR657

Sponsored by:	The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D58083
2026-07-09 17:17:11 +00:00

518 lines
18 KiB
YAML
Raw Blame History

# For testing, you can set variables in your repo (Repo -> Settings ->
# Security -> Actions -> Variables) to restrict the tests that are run
# The supported variables are:
#
# RUN_ONLY_PLATFORM: run only tests on specified platform.
name: CI VM
on:
push:
paths: [ '**.c', '**.h', '**.m4', '**.sh', '**/Makefile.in', 'configure.ac', '.github/configs', '.github/workflows/vm.yml' ]
pull_request:
paths: [ '**.c', '**.h', '**.m4', '**.sh', '**/Makefile.in', 'configure.ac', '.github/configs', '.github/workflows/vm.yml' ]
jobs:
dragonflybsd:
name: "dragonflybsd-${{ matrix.target }}"
if: github.repository != 'openssh/openssh-portable-selfhosted' && (vars.RUN_ONLY_PLATFORM == '' || vars.RUN_ONLY_PLATFORM == 'dragonflybsd')
strategy:
fail-fast: false
matrix:
target:
- "6.4.2"
config: [default]
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # main
- name: autoreconf
run: sh -c autoreconf
- name: start DragonFlyBSD ${{ matrix.target }} VM
uses: vmactions/dragonflybsd-vm@4ba8127bd95c94b66fc4b885e37c99955ba308ea # v1
with:
release: ${{ matrix.target }}
usesh: true
prepare: |
timeout 600 pkg install -y sudo || pkg install -y sudo
pw useradd builder -m
echo "builder ALL=(ALL:ALL) NOPASSWD: ALL" >>/usr/local/etc/sudoers
mkdir -p /var/empty /usr/local/etc
cp $GITHUB_WORKSPACE/moduli /usr/local/etc/moduli
- name: set file perms
shell: dragonflybsd {0}
run: cd $GITHUB_WORKSPACE && chown -R builder .
- name: configure
shell: dragonflybsd {0}
run: cd $GITHUB_WORKSPACE && sudo -u builder ./configure --with-ssl-dir=/usr/local
- name: make clean
shell: dragonflybsd {0}
run: cd $GITHUB_WORKSPACE && sudo -u builder make clean
- name: make
shell: dragonflybsd {0}
run: cd $GITHUB_WORKSPACE && sudo -u builder make -j4
- name: make tests
shell: dragonflybsd {0}
run: |
cd $GITHUB_WORKSPACE
sudo -u builder env SUDO=sudo make tests
- name: "PAM: configure"
shell: dragonflybsd {0}
run: cd $GITHUB_WORKSPACE && sudo -u builder ./configure --with-ssl-dir=/usr/local --with-pam
- name: "PAM: make clean"
shell: dragonflybsd {0}
run: cd $GITHUB_WORKSPACE && sudo -u builder make clean
- name: "PAM: make"
shell: dragonflybsd {0}
run: cd $GITHUB_WORKSPACE && sudo -u builder make -j4
- name: "PAM: make t-exec"
shell: dragonflybsd {0}
run: |
cd $GITHUB_WORKSPACE
sudo -u builder env SUDO=sudo SSHD_CONFOPTS="UsePam yes" make t-exec
freebsd:
name: "freebsd-${{ matrix.target }}"
if: github.repository != 'openssh/openssh-portable-selfhosted' && (vars.RUN_ONLY_PLATFORM == '' || vars.RUN_ONLY_PLATFORM == 'freebsd')
strategy:
fail-fast: false
matrix:
target:
- "12.4"
- "13.5"
- "14.4"
- "15.0"
config: [default]
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # main
- name: autoreconf
run: sh -c autoreconf
- name: start FreeBSD ${{ matrix.target }} VM
uses: vmactions/freebsd-vm@b84ab5559b5a1bb4b8ee2737d2506a16e1737636 # v1
with:
release: ${{ matrix.target }}
usesh: true
prepare: |
case $(uname -r) in
12.*)
timeout 600 ftp ftp://ftp.sudo.ws/pub/sudo/sudo-1.8.32.tar.gz || \
ftp ftp://ftp.sudo.ws/pub/sudo/sudo-1.8.32.tar.gz
tar xfz sudo-1.8.32.tar.gz
(cd sudo-1.8.32 && ./configure --sysconfdir=/usr/local/etc && make && make install)
;;
*)
timeout 600 pkg install -y sudo || pkg install -y sudo
;;
esac
openssl rand -base64 9 >$GITHUB_WORKSPACE/regress/password
pw useradd builder -m -h0 <$GITHUB_WORKSPACE/regress/password
chown builder $GITHUB_WORKSPACE/regress/password
echo "builder ALL=(ALL:ALL) NOPASSWD: ALL" >>/usr/local/etc/sudoers
mkdir -p /var/empty /usr/local/etc
cp $GITHUB_WORKSPACE/moduli /usr/local/etc/moduli
- name: set file perms
shell: freebsd {0}
run: cd $GITHUB_WORKSPACE && chown -R builder .
- name: configure
shell: freebsd {0}
run: cd $GITHUB_WORKSPACE && sudo -u builder ./configure
- name: make clean
shell: freebsd {0}
run: cd $GITHUB_WORKSPACE && sudo -u builder make clean
- name: make
shell: freebsd {0}
run: cd $GITHUB_WORKSPACE && sudo -u builder make -j4
- name: make tests
shell: freebsd {0}
run: |
cd $GITHUB_WORKSPACE
sudo -u builder env SUDO=sudo make tests SKIP_LTESTS=scp3
- name: "PAM: configure"
shell: freebsd {0}
run: cd $GITHUB_WORKSPACE && sudo -u builder ./configure --with-pam --with-audit=bsm
- name: "PAM: make clean"
shell: freebsd {0}
run: cd $GITHUB_WORKSPACE && sudo -u builder make clean
- name: "PAM: make"
shell: freebsd {0}
run: cd $GITHUB_WORKSPACE && sudo -u builder make -j4
- name: "PAM: make t-exec UsePAM=no"
shell: freebsd {0}
run: |
cd $GITHUB_WORKSPACE
sudo -u builder env SUDO=sudo make t-exec SKIP_LTESTS=scp3
- name: "PAM: make t-exec UsePAM=yes"
shell: freebsd {0}
run: |
cd $GITHUB_WORKSPACE
cp regress/password regress/kbdintpw
sudo -u builder env SUDO=sudo TEST_SSH_SSHD_CONFOPTS="UsePam yes" make t-exec SKIP_LTESTS=scp3
netbsd:
name: "netbsd-${{ matrix.target }}"
if: github.repository != 'openssh/openssh-portable-selfhosted' && (vars.RUN_ONLY_PLATFORM == '' || vars.RUN_ONLY_PLATFORM == 'netbsd')
strategy:
fail-fast: false
matrix:
target:
- "9.0"
- "9.4"
- "10.0"
- "10.1"
config: [default]
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # main
- name: autoreconf
run: sh -c autoreconf
- name: start NetBSD ${{ matrix.target }} VM
uses: vmactions/netbsd-vm@99816dccf75edf233ed6cd00a159e3a5b85ea373 # v1
with:
release: ${{ matrix.target }}
usesh: true
sync: scp
copyback: false
prepare: |
case "$(uname -r)" in
9.*) export PKG_PATH="ftp://ftp.NetBSD.org/pub/pkgsrc/packages/NetBSD/$(uname -p)/9.0_2026Q1/All" ;;
esac
timeout 600 /usr/sbin/pkg_add sudo || /usr/sbin/pkg_add sudo
openssl rand -base64 9 >$GITHUB_WORKSPACE/regress/password
pw=$(tr -d '\n' <$GITHUB_WORKSPACE/regress/password | pwhash)
/usr/sbin/useradd -m -p "${pw}" builder
echo "builder ALL=(ALL:ALL) NOPASSWD: ALL" >>/usr/pkg/etc/sudoers
mkdir -p /var/empty /usr/local/etc
cp $GITHUB_WORKSPACE/moduli /usr/local/etc/moduli
- name: set file perms
shell: netbsd {0}
run: cd $GITHUB_WORKSPACE && /sbin/chown -R builder .
- name: configure
shell: netbsd {0}
run: cd $GITHUB_WORKSPACE && sudo -u builder ./configure
- name: make clean
shell: netbsd {0}
run: cd $GITHUB_WORKSPACE && sudo -u builder make clean
- name: make
shell: netbsd {0}
run: cd $GITHUB_WORKSPACE && sudo -u builder make -j4
- name: make tests
shell: netbsd {0}
run: |
cd $GITHUB_WORKSPACE
sudo -u builder env SUDO=sudo make tests
- name: "PAM: configure"
shell: netbsd {0}
run: cd $GITHUB_WORKSPACE && sudo -u builder ./configure --with-pam
- name: "PAM: make clean"
shell: netbsd {0}
run: cd $GITHUB_WORKSPACE && sudo -u builder make clean
- name: "PAM: make"
shell: netbsd {0}
run: cd $GITHUB_WORKSPACE && sudo -u builder make -j4
- name: "PAM: make t-exec UsePAM=no"
shell: netbsd {0}
run: |
cd $GITHUB_WORKSPACE
sudo -u builder env SUDO=sudo make t-exec
- name: "PAM: make t-exec UsePAM=yes"
shell: netbsd {0}
run: |
cd $GITHUB_WORKSPACE
cp regress/password regress/kbdintpw
sudo -u builder env SUDO=sudo TEST_SSH_SSHD_CONFOPTS="UsePam yes" make t-exec
omnios:
name: "omnios-${{ matrix.target }}"
if: github.repository != 'openssh/openssh-portable-selfhosted' && (vars.RUN_ONLY_PLATFORM == '' || vars.RUN_ONLY_PLATFORM == 'omnios')
strategy:
fail-fast: false
matrix:
target:
- "r151056-build"
- "r151058-build"
config: [default]
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # main
- name: autoreconf
run: sh -c autoreconf
- name: start OmniOS ${{ matrix.target }} VM
uses: vmactions/omnios-vm@7f2be0b927aad1a78498c8aeeac4c4ce1fabd322 # v1
with:
release: ${{ matrix.target }}
usesh: true
prepare: |
set -x
if [ ! -x $(which gcc 2>/dev/null) ]; then
timeout 900 pfexec pkg refresh || pfexec pkg refresh
timeout 900 pfexec pkg install build-essential || pfexec pkg install build-essential
fi
useradd -m builder
sed -e "s/^root.*ALL$/root ALL=(ALL) NOPASSWD: ALL/" /etc/sudoers >>/tmp/sudoers
mv /tmp/sudoers /etc/sudoers
echo "builder ALL=(ALL) NOPASSWD: ALL" >>/etc/sudoers
mkdir -p /var/empty /usr/local/etc
cp $GITHUB_WORKSPACE/moduli /usr/local/etc/moduli
- name: set file perms
shell: omnios {0}
run: cd $GITHUB_WORKSPACE && chown -R builder .
- name: configure
shell: omnios {0}
run: cd $GITHUB_WORKSPACE && sudo -u builder ./configure
- name: make clean
shell: omnios {0}
run: cd $GITHUB_WORKSPACE && sudo -u builder make clean
- name: make
shell: omnios {0}
run: cd $GITHUB_WORKSPACE && sudo -u builder make
- name: make tests
shell: omnios {0}
run: |
cd $GITHUB_WORKSPACE
sudo -u builder make tests
openbsd:
name: "openbsd-${{ matrix.target }}"
if: github.repository != 'openssh/openssh-portable-selfhosted' && (vars.RUN_ONLY_PLATFORM == '' || vars.RUN_ONLY_PLATFORM == 'openbsd')
strategy:
fail-fast: false
matrix:
target:
- "7.3"
- "7.5"
- "7.6"
- "7.7"
- "7.8"
- "7.9"
config: [default]
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # main
- name: autoreconf
run: sh -c autoreconf
- name: start OpenBSD ${{ matrix.target }} VM
uses: vmactions/openbsd-vm@18edb32f4e48dae5865d7b8b3a9587bc01218a20 # v1
with:
release: ${{ matrix.target }}
usesh: true
prepare: |
useradd -m builder
echo "permit nopass keepenv root" >/etc/doas.conf
echo "permit nopass keepenv builder" >>/etc/doas.conf
ls -l /etc/doas.conf
chown root:wheel /etc/doas.conf
chmod 644 /etc/doas.conf
mkdir -p /var/empty /usr/local/etc
cp $GITHUB_WORKSPACE/moduli /usr/local/etc/moduli
- name: set file perms
shell: openbsd {0}
run: cd $GITHUB_WORKSPACE && chown -R builder .
- name: configure
shell: openbsd {0}
run: cd $GITHUB_WORKSPACE && doas -u builder ./configure
- name: make clean
shell: openbsd {0}
run: cd $GITHUB_WORKSPACE && doas -u builder make clean
- name: make
shell: openbsd {0}
run: cd $GITHUB_WORKSPACE && doas -u builder make -j4
- name: make tests
shell: openbsd {0}
run: |
cd $GITHUB_WORKSPACE
doas -u builder env SUDO=doas make tests
openbsd-current-upstream:
# This job is special, and tests OpenBSD -current, both the underlying
# plaform (the latest snapshot) and most recent upstream code (or at least
# the most recent code in the github mirror) instead of OpenSSH Portable.
name: "openbsd-current-upstream"
if: github.repository != 'openssh/openssh-portable-selfhosted' && (vars.RUN_ONLY_PLATFORM == '' || vars.RUN_ONLY_PLATFORM == 'openbsd')
strategy:
fail-fast: false
runs-on: ubuntu-latest
steps:
- name: start OpenBSD VM
uses: vmactions/openbsd-vm@18edb32f4e48dae5865d7b8b3a9587bc01218a20 # v1
with:
copyback: false
nat: |
"20022": "22"
usesh: true
prepare: |
timeout 600 pkg_add git || pkg_add git
useradd -g wobj -m builder
echo "permit nopass keepenv root" >/etc/doas.conf
echo "permit nopass keepenv builder" >>/etc/doas.conf
ls -l /etc/doas.conf
chown root:wheel /etc/doas.conf
chmod 644 /etc/doas.conf
touch /etc/ssh/ssh_known_hosts
- name: fetch sysupgrade version
run: |
ver=$(curl -s https://cdn.openbsd.org/pub/OpenBSD/snapshots/amd64/BUILDINFO)
echo "SNAPSHOT_VERSION=${ver}" >> $GITHUB_ENV
- name: check for cached sysupgrade
id: cache-sysupgrade
uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
with:
key: openbsd-sysupgrade ${{ env.SNAPSHOT_VERSION }}
path: /tmp/_sysupgrade/
- name: push sysupgrade from cache to VM
if: steps.cache-sysupgrade.outputs.cache-hit == 'true'
run: rsync -av /tmp/_sysupgrade/ openbsd:/home/_sysupgrade/
- name: upgrade to latest snapshot
run: ssh -q openbsd sysupgrade -s -k || true
- name: wait for upgrade
run: |
SECONDS=0; sleep 10; while ! ssh -q -oConnectTimeout=1 openbsd true; do sleep 10; echo waited ${SECONDS}s; done
ssh -q openbsd uname -a
- name: retrieve sysupgrade from VM to cache
if: steps.cache-sysupgrade.outputs.cache-hit != 'true'
run: |
mkdir -p /tmp/_sysupgrade/
rsync -av openbsd:/home/_sysupgrade/ /tmp/_sysupgrade/
- name: save sysupgrade to cache
if: steps.cache-sysupgrade.outputs.cache-hit != 'true'
uses: actions/cache/save@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
with:
key: openbsd-sysupgrade ${{ env.SNAPSHOT_VERSION }}
path: /tmp/_sysupgrade/
- name: checkout upstream source
shell: openbsd {0}
run: |
umask 022
cd /usr
rm -rf src/*
git clone --no-checkout --depth=1 --filter=tree:0 https://github.com/openbsd/src.git
cd /usr/src
git sparse-checkout set --no-cone Makefile usr.bin/Makefile usr.bin/Makefile.inc usr.bin/ssh usr.bin/nc regress/usr.bin/ssh
git checkout
git log -n1
chown -R builder /usr/src
chmod -R go-w /usr/src/ /usr/obj/
- name: make ssh
shell: openbsd {0}
run: |
cd /usr/src/usr.bin/ssh && make -j4 || make
make install
/etc/rc.d/sshd restart
- name: make nc
shell: openbsd {0}
run: cd /usr/src/usr.bin/nc && make && make install
- name: make tests
shell: openbsd {0}
run: |
cd /usr/src/regress/usr.bin/ssh
make obj
doas -u builder env SUDO=doas TEST_SSH_UNSAFE_PERMISSIONS=yes TEST_SSH_FAIL_FATAL=yes TEST_SSH_HOSTBASED_AUTH=setupandrun make
- name: retrieve logs
if: failure()
run: |
rsync -a openbsd:/usr/obj/regress/usr.bin/ssh/ regress-logs/
for i in regress-logs/failed*.log; do echo ===; echo LOGFILE: $i; echo ===; cat $i; echo; done
- name: save logs
if: failure()
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # main
with:
name: openbsd-current-upstream-logs
path: regress-logs/*.log
solaris:
name: "solaris-${{ matrix.target }}"
if: github.repository != 'openssh/openssh-portable-selfhosted' && (vars.RUN_ONLY_PLATFORM == '' || vars.RUN_ONLY_PLATFORM == 'solaris')
strategy:
fail-fast: false
matrix:
target:
- "11.4-gcc"
- "11.4-clang-19"
config: [default]
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # main
- name: autoreconf
run: sh -c autoreconf
- name: start Solaris ${{ matrix.target }} VM
uses: vmactions/solaris-vm@d30dd6c228c8661ade859e36ead7660b9a62efcc # v1
with:
release: ${{ matrix.target }}
usesh: true
prepare: |
echo Setting up user builder.
useradd -m builder
openssl rand -base64 9 >$GITHUB_WORKSPACE/regress/password
chown builder $GITHUB_WORKSPACE/regress/password
pw=$(tr -d '\n' <$GITHUB_WORKSPACE/regress/password | openssl passwd -6 -stdin)
passwd -p "$pw" builder
echo Setting up sudo.
sed -e "s/^root.*ALL$/root ALL=(ALL) NOPASSWD: ALL/" /etc/sudoers >>/tmp/sudoers
mv /tmp/sudoers /etc/sudoers
echo "builder ALL=(ALL) NOPASSWD: ALL" >/etc/sudoers.d/builder
echo 'Testing sudo config for root->builder.'
sudo -u builder id
echo 'Testing sudo config for builder->root.'
sudo -u builder sudo id
echo Creating directories.
mkdir -p /var/empty /usr/local/etc
cp $GITHUB_WORKSPACE/moduli /usr/local/etc/moduli
- name: set file perms
shell: solaris {0}
run: cd $GITHUB_WORKSPACE && chown -R builder .
- name: configure
shell: solaris {0}
run: cd $GITHUB_WORKSPACE && sudo -u builder ./configure
- name: make clean
shell: solaris {0}
run: cd $GITHUB_WORKSPACE && sudo -u builder make clean
- name: make
shell: solaris {0}
run: cd $GITHUB_WORKSPACE && sudo -u builder make
- name: make tests
shell: solaris {0}
run: |
cd $GITHUB_WORKSPACE
sudo -u builder env SUDO=sudo make tests
- name: "PAM: configure"
shell: solaris {0}
run: cd $GITHUB_WORKSPACE && sudo -u builder ./configure --with-pam
- name: "PAM: make clean"
shell: solaris {0}
run: cd $GITHUB_WORKSPACE && sudo -u builder make clean
- name: "PAM: make"
shell: solaris {0}
run: cd $GITHUB_WORKSPACE && sudo -u builder make
- name: "PAM: make t-exec UsePAM=no"
shell: solaris {0}
run: |
cd $GITHUB_WORKSPACE
sudo -u builder env SUDO=sudo make t-exec
- name: "PAM: make t-exec UsePAM=yes"
shell: solaris {0}
run: |
cd $GITHUB_WORKSPACE
cp regress/password regress/kbdintpw
sudo -u builder env SUDO=sudo TEST_SSH_SSHD_CONFOPTS="UsePam yes" make t-exec
Reference in new issue View Git Blame Copy Permalink