From 023b327acc85474414b8935401fd90238f89b5bb Mon Sep 17 00:00:00 2001 From: Kamil Dudka Date: Wed, 15 Aug 2018 13:56:12 +0200 Subject: [PATCH] Resolves: #1595135 - scp/sftp: fix infinite connect loop on invalid private key --- 0002-curl-7.61.0-libssh.patch | 130 ++++++++++++++++++++++++++++++++++ curl.spec | 15 ++-- 2 files changed, 141 insertions(+), 4 deletions(-) create mode 100644 0002-curl-7.61.0-libssh.patch diff --git a/0002-curl-7.61.0-libssh.patch b/0002-curl-7.61.0-libssh.patch new file mode 100644 index 0000000..75966b4 --- /dev/null +++ b/0002-curl-7.61.0-libssh.patch @@ -0,0 +1,130 @@ +From 155d4ffb7d40daf2afa0102f91f810675220ab6e Mon Sep 17 00:00:00 2001 +From: Kamil Dudka +Date: Tue, 14 Aug 2018 13:14:49 +0200 +Subject: [PATCH] ssh-libssh: reduce excessive verbose output about pubkey auth + +The verbose message "Authentication using SSH public key file" was +printed each time the ssh_userauth_publickey_auto() was called, which +meant each time a packet was transferred over network because the API +operates in non-blocking mode. + +This patch makes sure that the verbose message is printed just once +(when the authentication state is entered by the SSH state machine). + +Upstream-commit: 1e843a31a49484aeddf8f358e71392205f5fd6b1 +Signed-off-by: Kamil Dudka +--- + lib/ssh-libssh.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/lib/ssh-libssh.c b/lib/ssh-libssh.c +index cecf477ac..f40f074b9 100644 +--- a/lib/ssh-libssh.c ++++ b/lib/ssh-libssh.c +@@ -618,6 +618,7 @@ static CURLcode myssh_statemach_act(struct connectdata *conn, bool *block) + sshc->auth_methods = ssh_userauth_list(sshc->ssh_session, NULL); + if(sshc->auth_methods & SSH_AUTH_METHOD_PUBLICKEY) { + state(conn, SSH_AUTH_PKEY_INIT); ++ infof(data, "Authentication using SSH public key file\n"); + } + else if(sshc->auth_methods & SSH_AUTH_METHOD_GSSAPI_MIC) { + state(conn, SSH_AUTH_GSSAPI); +@@ -670,8 +671,6 @@ static CURLcode myssh_statemach_act(struct connectdata *conn, bool *block) + + } + else { +- infof(data, "Authentication using SSH public key file\n"); +- + rc = ssh_userauth_publickey_auto(sshc->ssh_session, NULL, + data->set.ssl.key_passwd); + if(rc == SSH_AUTH_AGAIN) { +-- +2.17.1 + +From 4b445519694ab620bd6376066844a7076e8ce4ab Mon Sep 17 00:00:00 2001 +From: Kamil Dudka +Date: Tue, 14 Aug 2018 12:47:18 +0200 +Subject: [PATCH] ssh-libssh: fix infinite connect loop on invalid private key + +Added test 656 (based on test 604) to verify the fix. + +Bug: https://bugzilla.redhat.com/1595135 + +Closes #2879 + +Upstream-commit: a4c7911a48dadb4f68ba6b38bb1bf3f061b747f6 +Signed-off-by: Kamil Dudka +--- + lib/ssh-libssh.c | 1 + + tests/data/Makefile.inc | 2 +- + tests/data/test656 | 33 +++++++++++++++++++++++++++++++++ + 3 files changed, 35 insertions(+), 1 deletion(-) + create mode 100644 tests/data/test656 + +diff --git a/lib/ssh-libssh.c b/lib/ssh-libssh.c +index f40f074b9..12d618cfe 100644 +--- a/lib/ssh-libssh.c ++++ b/lib/ssh-libssh.c +@@ -663,6 +663,7 @@ static CURLcode myssh_statemach_act(struct connectdata *conn, bool *block) + if(rc != SSH_OK) { + failf(data, "Could not load private key file %s", + data->set.str[STRING_SSH_PRIVATE_KEY]); ++ MOVE_TO_ERROR_STATE(CURLE_LOGIN_DENIED); + break; + } + +diff --git a/tests/data/Makefile.inc b/tests/data/Makefile.inc +index 20274b37c..518a5a543 100644 +--- a/tests/data/Makefile.inc ++++ b/tests/data/Makefile.inc +@@ -83,7 +83,7 @@ test617 test618 test619 test620 test621 test622 test623 test624 test625 \ + test626 test627 test628 test629 test630 test631 test632 test633 test634 \ + test635 test636 test637 test638 test639 test640 test641 test642 \ + test643 test644 test645 test646 test647 test648 test649 test650 test651 \ +-test652 test653 test654 test655 \ ++test652 test653 test654 test655 test656 \ + \ + test700 test701 test702 test703 test704 test705 test706 test707 test708 \ + test709 test710 test711 test712 test713 test714 test715 \ +diff --git a/tests/data/test656 b/tests/data/test656 +new file mode 100644 +index 000000000..4107d3d17 +--- /dev/null ++++ b/tests/data/test656 +@@ -0,0 +1,33 @@ ++ ++ ++ ++SFTP ++FAILURE ++ ++ ++ ++# ++# Client-side ++ ++ ++sftp ++ ++ ++SFTP retrieval with nonexistent private key file ++ ++ ++--key DOES_NOT_EXIST --pubkey curl_client_key.pub -u %USER: sftp://%HOSTIP:%SSHPORT%PWD/not-a-valid-file-moooo --insecure --connect-timeout 8 ++ ++ ++ ++# ++# Verify data after the test has been "shot" ++ ++ ++disable ++ ++ ++67 ++ ++ ++ +-- +2.17.1 + diff --git a/curl.spec b/curl.spec index db7d3a4..8c2b8bb 100644 --- a/curl.spec +++ b/curl.spec @@ -1,13 +1,16 @@ Summary: A utility for getting files from remote servers (FTP, HTTP, and others) Name: curl Version: 7.61.0 -Release: 5%{?dist} +Release: 6%{?dist} License: MIT Source: https://curl.haxx.se/download/%{name}-%{version}.tar.xz # ssl: set engine implicitly when a PKCS#11 URI is provided (#1219544) Patch1: 0001-curl-7.61.0-pkcs11.patch +# scp/sftp: fix infinite connect loop on invalid private key (#1595135) +Patch2: 0002-curl-7.61.0-libssh.patch + # patch making libcurl multilib ready Patch101: 0101-curl-7.32.0-multilib.patch @@ -23,7 +26,7 @@ Patch104: 0104-curl-7.19.7-localhost6.patch Provides: curl-full = %{version}-%{release} Provides: webclient URL: https://curl.haxx.se/ -#BuildRequires: automake +BuildRequires: automake BuildRequires: brotli-devel BuildRequires: coreutils BuildRequires: gcc @@ -159,6 +162,7 @@ be installed. # upstream patches %patch1 -p1 +%patch2 -p1 # Fedora patches %patch101 -p1 @@ -170,8 +174,8 @@ be installed. sed -e '1 s|^#!/.*python|#!%{__python3}|' -i tests/*.py # regenerate Makefile.in files -#aclocal -I m4 -#automake +aclocal -I m4 +automake # disable test 1112 (#565305), test 1455 (occasionally fails with 'bind failed # with errno 98: Address already in use' in Koji environment), and test 1801 @@ -325,6 +329,9 @@ rm -f ${RPM_BUILD_ROOT}%{_libdir}/libcurl.la %{_libdir}/libcurl.so.4.[0-9].[0-9].minimal %changelog +* Wed Aug 15 2018 Kamil Dudka - 7.61.0-6 +- scp/sftp: fix infinite connect loop on invalid private key (#1595135) + * Thu Aug 09 2018 Kamil Dudka - 7.61.0-5 - ssl: set engine implicitly when a PKCS#11 URI is provided (#1219544)