Resolves: #1595135 - scp/sftp: fix infinite connect loop on invalid private key
This commit is contained in:
Kamil Dudka
parent
178b0fc823
commit
023b327acc
130
0002-curl-7.61.0-libssh.patch
Normal file
130
0002-curl-7.61.0-libssh.patch
Normal file
@ -0,0 +1,130 @@
|
||||
From 155d4ffb7d40daf2afa0102f91f810675220ab6e Mon Sep 17 00:00:00 2001
|
||||
From: Kamil Dudka <kdudka@redhat.com>
|
||||
Date: Tue, 14 Aug 2018 13:14:49 +0200
|
||||
Subject: [PATCH] ssh-libssh: reduce excessive verbose output about pubkey auth
|
||||
|
||||
The verbose message "Authentication using SSH public key file" was
|
||||
printed each time the ssh_userauth_publickey_auto() was called, which
|
||||
meant each time a packet was transferred over network because the API
|
||||
operates in non-blocking mode.
|
||||
|
||||
This patch makes sure that the verbose message is printed just once
|
||||
(when the authentication state is entered by the SSH state machine).
|
||||
|
||||
Upstream-commit: 1e843a31a49484aeddf8f358e71392205f5fd6b1
|
||||
Signed-off-by: Kamil Dudka <kdudka@redhat.com>
|
||||
---
|
||||
lib/ssh-libssh.c | 3 +--
|
||||
1 file changed, 1 insertion(+), 2 deletions(-)
|
||||
|
||||
diff --git a/lib/ssh-libssh.c b/lib/ssh-libssh.c
|
||||
index cecf477ac..f40f074b9 100644
|
||||
--- a/lib/ssh-libssh.c
|
||||
+++ b/lib/ssh-libssh.c
|
||||
@@ -618,6 +618,7 @@ static CURLcode myssh_statemach_act(struct connectdata *conn, bool *block)
|
||||
sshc->auth_methods = ssh_userauth_list(sshc->ssh_session, NULL);
|
||||
if(sshc->auth_methods & SSH_AUTH_METHOD_PUBLICKEY) {
|
||||
state(conn, SSH_AUTH_PKEY_INIT);
|
||||
+ infof(data, "Authentication using SSH public key file\n");
|
||||
}
|
||||
else if(sshc->auth_methods & SSH_AUTH_METHOD_GSSAPI_MIC) {
|
||||
state(conn, SSH_AUTH_GSSAPI);
|
||||
@@ -670,8 +671,6 @@ static CURLcode myssh_statemach_act(struct connectdata *conn, bool *block)
|
||||
|
||||
}
|
||||
else {
|
||||
- infof(data, "Authentication using SSH public key file\n");
|
||||
-
|
||||
rc = ssh_userauth_publickey_auto(sshc->ssh_session, NULL,
|
||||
data->set.ssl.key_passwd);
|
||||
if(rc == SSH_AUTH_AGAIN) {
|
||||
--
|
||||
2.17.1
|
||||
|
||||
From 4b445519694ab620bd6376066844a7076e8ce4ab Mon Sep 17 00:00:00 2001
|
||||
From: Kamil Dudka <kdudka@redhat.com>
|
||||
Date: Tue, 14 Aug 2018 12:47:18 +0200
|
||||
Subject: [PATCH] ssh-libssh: fix infinite connect loop on invalid private key
|
||||
|
||||
Added test 656 (based on test 604) to verify the fix.
|
||||
|
||||
Bug: https://bugzilla.redhat.com/1595135
|
||||
|
||||
Closes #2879
|
||||
|
||||
Upstream-commit: a4c7911a48dadb4f68ba6b38bb1bf3f061b747f6
|
||||
Signed-off-by: Kamil Dudka <kdudka@redhat.com>
|
||||
---
|
||||
lib/ssh-libssh.c | 1 +
|
||||
tests/data/Makefile.inc | 2 +-
|
||||
tests/data/test656 | 33 +++++++++++++++++++++++++++++++++
|
||||
3 files changed, 35 insertions(+), 1 deletion(-)
|
||||
create mode 100644 tests/data/test656
|
||||
|
||||
diff --git a/lib/ssh-libssh.c b/lib/ssh-libssh.c
|
||||
index f40f074b9..12d618cfe 100644
|
||||
--- a/lib/ssh-libssh.c
|
||||
+++ b/lib/ssh-libssh.c
|
||||
@@ -663,6 +663,7 @@ static CURLcode myssh_statemach_act(struct connectdata *conn, bool *block)
|
||||
if(rc != SSH_OK) {
|
||||
failf(data, "Could not load private key file %s",
|
||||
data->set.str[STRING_SSH_PRIVATE_KEY]);
|
||||
+ MOVE_TO_ERROR_STATE(CURLE_LOGIN_DENIED);
|
||||
break;
|
||||
}
|
||||
|
||||
diff --git a/tests/data/Makefile.inc b/tests/data/Makefile.inc
|
||||
index 20274b37c..518a5a543 100644
|
||||
--- a/tests/data/Makefile.inc
|
||||
+++ b/tests/data/Makefile.inc
|
||||
@@ -83,7 +83,7 @@ test617 test618 test619 test620 test621 test622 test623 test624 test625 \
|
||||
test626 test627 test628 test629 test630 test631 test632 test633 test634 \
|
||||
test635 test636 test637 test638 test639 test640 test641 test642 \
|
||||
test643 test644 test645 test646 test647 test648 test649 test650 test651 \
|
||||
-test652 test653 test654 test655 \
|
||||
+test652 test653 test654 test655 test656 \
|
||||
\
|
||||
test700 test701 test702 test703 test704 test705 test706 test707 test708 \
|
||||
test709 test710 test711 test712 test713 test714 test715 \
|
||||
diff --git a/tests/data/test656 b/tests/data/test656
|
||||
new file mode 100644
|
||||
index 000000000..4107d3d17
|
||||
--- /dev/null
|
||||
+++ b/tests/data/test656
|
||||
@@ -0,0 +1,33 @@
|
||||
+<testcase>
|
||||
+<info>
|
||||
+<keywords>
|
||||
+SFTP
|
||||
+FAILURE
|
||||
+</keywords>
|
||||
+</info>
|
||||
+
|
||||
+#
|
||||
+# Client-side
|
||||
+<client>
|
||||
+<server>
|
||||
+sftp
|
||||
+</server>
|
||||
+ <name>
|
||||
+SFTP retrieval with nonexistent private key file
|
||||
+ </name>
|
||||
+ <command>
|
||||
+--key DOES_NOT_EXIST --pubkey curl_client_key.pub -u %USER: sftp://%HOSTIP:%SSHPORT%PWD/not-a-valid-file-moooo --insecure --connect-timeout 8
|
||||
+</command>
|
||||
+</client>
|
||||
+
|
||||
+#
|
||||
+# Verify data after the test has been "shot"
|
||||
+<verify>
|
||||
+<valgrind>
|
||||
+disable
|
||||
+</valgrind>
|
||||
+<errorcode>
|
||||
+67
|
||||
+</errorcode>
|
||||
+</verify>
|
||||
+</testcase>
|
||||
--
|
||||
2.17.1
|
||||
|
||||
15
curl.spec
15
curl.spec
@ -1,13 +1,16 @@
|
||||
Summary: A utility for getting files from remote servers (FTP, HTTP, and others)
|
||||
Name: curl
|
||||
Version: 7.61.0
|
||||
Release: 5%{?dist}
|
||||
Release: 6%{?dist}
|
||||
License: MIT
|
||||
Source: https://curl.haxx.se/download/%{name}-%{version}.tar.xz
|
||||
|
||||
# ssl: set engine implicitly when a PKCS#11 URI is provided (#1219544)
|
||||
Patch1: 0001-curl-7.61.0-pkcs11.patch
|
||||
|
||||
# scp/sftp: fix infinite connect loop on invalid private key (#1595135)
|
||||
Patch2: 0002-curl-7.61.0-libssh.patch
|
||||
|
||||
# patch making libcurl multilib ready
|
||||
Patch101: 0101-curl-7.32.0-multilib.patch
|
||||
|
||||
@ -23,7 +26,7 @@ Patch104: 0104-curl-7.19.7-localhost6.patch
|
||||
Provides: curl-full = %{version}-%{release}
|
||||
Provides: webclient
|
||||
URL: https://curl.haxx.se/
|
||||
#BuildRequires: automake
|
||||
BuildRequires: automake
|
||||
BuildRequires: brotli-devel
|
||||
BuildRequires: coreutils
|
||||
BuildRequires: gcc
|
||||
@ -159,6 +162,7 @@ be installed.
|
||||
|
||||
# upstream patches
|
||||
%patch1 -p1
|
||||
%patch2 -p1
|
||||
|
||||
# Fedora patches
|
||||
%patch101 -p1
|
||||
@ -170,8 +174,8 @@ be installed.
|
||||
sed -e '1 s|^#!/.*python|#!%{__python3}|' -i tests/*.py
|
||||
|
||||
# regenerate Makefile.in files
|
||||
#aclocal -I m4
|
||||
#automake
|
||||
aclocal -I m4
|
||||
automake
|
||||
|
||||
# disable test 1112 (#565305), test 1455 (occasionally fails with 'bind failed
|
||||
# with errno 98: Address already in use' in Koji environment), and test 1801
|
||||
@ -325,6 +329,9 @@ rm -f ${RPM_BUILD_ROOT}%{_libdir}/libcurl.la
|
||||
%{_libdir}/libcurl.so.4.[0-9].[0-9].minimal
|
||||
|
||||
%changelog
|
||||
* Wed Aug 15 2018 Kamil Dudka <kdudka@redhat.com> - 7.61.0-6
|
||||
- scp/sftp: fix infinite connect loop on invalid private key (#1595135)
|
||||
|
||||
* Thu Aug 09 2018 Kamil Dudka <kdudka@redhat.com> - 7.61.0-5
|
||||
- ssl: set engine implicitly when a PKCS#11 URI is provided (#1219544)
|
||||
|
||||
|
||||
Loading…
Reference in New Issue
Block a user