Skip to content

Commit 6eaf450

Browse files
author
roman
committed
config UPDATE add support for libssh params
Added identities for libssh's host-key, key exchange, encryption and mac algs.
1 parent 21420ea commit 6eaf450

File tree

2 files changed

+189
-10
lines changed

2 files changed

+189
-10
lines changed

‎modules/libnetconf2-netconf-server.yang

Lines changed: 151 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,22 @@ module libnetconf2-netconf-server {
1111
prefix ct;
1212
}
1313

14+
import iana-ssh-public-key-algs {
15+
prefix sshpka;
16+
}
17+
18+
import iana-ssh-key-exchange-algs {
19+
prefix sshkea;
20+
}
21+
22+
import iana-ssh-encryption-algs {
23+
prefix sshea;
24+
}
25+
26+
import iana-ssh-mac-algs {
27+
prefix sshma;
28+
}
29+
1430
/*
1531
identity ed25519-private-key-format {
1632
base ct:private-key-format;
@@ -81,6 +97,141 @@ module libnetconf2-netconf-server {
8197
The Secure Shell (SSH) Transport Layer Protocol";
8298
}
8399

100+
identity openssh-ssh-ed25519-cert-v01 {
101+
base sshpka:public-key-alg-base;
102+
description
103+
"[email protected]";
104+
reference
105+
"OpenSSH PROTOCOL.certkeys:
106+
https://cvsweb.openbsd.org/src/usr.bin/ssh/PROTOCOL.certkeys?annotate=HEAD";
107+
}
108+
109+
identity openssh-ecdsa-sha2-nistp521-cert-v01 {
110+
base sshpka:public-key-alg-base;
111+
description
112+
"[email protected]";
113+
reference
114+
"OpenSSH PROTOCOL.certkeys:
115+
https://cvsweb.openbsd.org/src/usr.bin/ssh/PROTOCOL.certkeys?annotate=HEAD";
116+
}
117+
118+
identity openssh-ecdsa-sha2-nistp384-cert-v01 {
119+
base sshpka:public-key-alg-base;
120+
description
121+
"[email protected]";
122+
reference
123+
"OpenSSH PROTOCOL.certkeys:
124+
https://cvsweb.openbsd.org/src/usr.bin/ssh/PROTOCOL.certkeys?annotate=HEAD";
125+
}
126+
127+
identity openssh-ecdsa-sha2-nistp256-cert-v01 {
128+
base sshpka:public-key-alg-base;
129+
description
130+
"[email protected]";
131+
reference
132+
"OpenSSH PROTOCOL.certkeys:
133+
https://cvsweb.openbsd.org/src/usr.bin/ssh/PROTOCOL.certkeys?annotate=HEAD";
134+
}
135+
136+
identity openssh-rsa-sha2-512-cert-v01 {
137+
base sshpka:public-key-alg-base;
138+
description
139+
"[email protected]";
140+
reference
141+
"OpenSSH PROTOCOL.certkeys:
142+
https://cvsweb.openbsd.org/src/usr.bin/ssh/PROTOCOL.certkeys?annotate=HEAD";
143+
}
144+
145+
identity openssh-rsa-sha2-256-cert-v01 {
146+
base sshpka:public-key-alg-base;
147+
description
148+
"[email protected]";
149+
reference
150+
"OpenSSH PROTOCOL.certkeys:
151+
https://cvsweb.openbsd.org/src/usr.bin/ssh/PROTOCOL.certkeys?annotate=HEAD";
152+
}
153+
154+
identity openssh-ssh-rsa-cert-v01 {
155+
base sshpka:public-key-alg-base;
156+
description
157+
"[email protected]";
158+
reference
159+
"OpenSSH PROTOCOL.certkeys:
160+
https://cvsweb.openbsd.org/src/usr.bin/ssh/PROTOCOL.certkeys?annotate=HEAD";
161+
}
162+
163+
identity openssh-ssh-dss-cert-v01 {
164+
base sshpka:public-key-alg-base;
165+
description
166+
"[email protected]";
167+
reference
168+
"OpenSSH PROTOCOL.certkeys:
169+
https://cvsweb.openbsd.org/src/usr.bin/ssh/PROTOCOL.certkeys?annotate=HEAD";
170+
}
171+
172+
identity libssh-curve25519-sha256 {
173+
base sshkea:key-exchange-alg-base;
174+
description
175+
"[email protected]";
176+
reference
177+
"[email protected] specification:
178+
https://git.libssh.org/projects/libssh.git/tree/doc/[email protected]";
179+
}
180+
181+
identity openssh-chacha20-poly1305 {
182+
base sshea:encryption-alg-base;
183+
description
184+
"[email protected]";
185+
reference
186+
"OpenSSH PROTOCOL.chacha20poly1305:
187+
https://cvsweb.openbsd.org/src/usr.bin/ssh/PROTOCOL.chacha20poly1305?annotate=HEAD";
188+
}
189+
190+
identity openssh-aes256-gcm {
191+
base sshea:encryption-alg-base;
192+
description
193+
"[email protected]";
194+
reference
195+
"OpenSSH PROTOCOL, Section 1.6:
196+
https://cvsweb.openbsd.org/src/usr.bin/ssh/PROTOCOL?annotate=HEAD";
197+
}
198+
199+
identity openssh-aes128-gcm {
200+
base sshea:encryption-alg-base;
201+
description
202+
"[email protected]";
203+
reference
204+
"OpenSSH PROTOCOL, Section 1.6:
205+
https://cvsweb.openbsd.org/src/usr.bin/ssh/PROTOCOL?annotate=HEAD";
206+
}
207+
208+
identity openssh-hmac-sha2-256-etm {
209+
base sshma:mac-alg-base;
210+
description
211+
"[email protected]";
212+
reference
213+
"OpenSSH PROTOCOL:
214+
https://cvsweb.openbsd.org/src/usr.bin/ssh/PROTOCOL?annotate=HEAD";
215+
}
216+
217+
identity openssh-hmac-sha2-512-etm {
218+
base sshma:mac-alg-base;
219+
description
220+
"[email protected]";
221+
reference
222+
"OpenSSH PROTOCOL:
223+
https://cvsweb.openbsd.org/src/usr.bin/ssh/PROTOCOL?annotate=HEAD";
224+
}
225+
226+
identity openssh-hmac-sha1-etm {
227+
base sshma:mac-alg-base;
228+
description
229+
"[email protected]";
230+
reference
231+
"OpenSSH PROTOCOL:
232+
https://cvsweb.openbsd.org/src/usr.bin/ssh/PROTOCOL?annotate=HEAD";
233+
}
234+
84235
augment "/ncs:netconf-server/ncs:listen/ncs:endpoint/ncs:transport/ncs:ssh/ncs:ssh/ncs:ssh-server-parameters/ncs:client-authentication" {
85236
leaf auth-attempts {
86237
type uint16;

‎src/server_config.c

Lines changed: 38 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -29,28 +29,28 @@
2929
/* All libssh supported host-key, key-exchange, encryption and mac algorithms as of version 0.10.90 */
3030

3131
static const char *supported_hostkey_algs[] = {
32-
"ssh-ed25519-cert-v01@openssh.com", "ecdsa-sha2-nistp521-cert-v01@openssh.com",
33-
"ecdsa-sha2-nistp384-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com",
34-
"rsa-sha2-512-cert-v01@openssh.com", "rsa-sha2-256-cert-v01@openssh.com",
35-
"ssh-rsa-cert-v01@openssh.com", "ssh-dss-cert-v01@openssh.com",
32+
"openssh-ssh-ed25519-cert-v01", "openssh-ecdsa-sha2-nistp521-cert-v01",
33+
"openssh-ecdsa-sha2-nistp384-cert-v01", "openssh-ecdsa-sha2-nistp256-cert-v01",
34+
"openssh-rsa-sha2-512-cert-v01", "openssh-rsa-sha2-256-cert-v01",
35+
"openssh-ssh-rsa-cert-v01", "openssh-ssh-dss-cert-v01",
3636
"ssh-ed25519", "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256",
3737
"rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss", NULL
3838
};
3939

4040
static const char *supported_kex_algs[] = {
41-
"diffie-hellman-group-exchange-sha1", "curve25519-sha256", "curve25519-sha256@libssh.org",
41+
"diffie-hellman-group-exchange-sha1", "curve25519-sha256", "libssh-curve25519-sha256",
4242
"ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group18-sha512",
4343
"diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", NULL
4444
};
4545

4646
static const char *supported_encryption_algs[] = {
47-
"chacha20-poly1305@openssh.com", "aes256-gcm@openssh.com", "aes128-gcm@openssh.com",
47+
"openssh-chacha20-poly1305", "openssh-aes256-gcm", "openssh-aes128-gcm",
4848
"aes256-ctr", "aes192-ctr", "aes128-ctr", "aes256-cbc", "aes192-cbc", "aes128-cbc",
4949
"blowfish-cbc", "triple-des-cbc", "none", NULL
5050
};
5151

5252
static const char *supported_mac_algs[] = {
53-
"hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com",
53+
"openssh-hmac-sha2-256-etm", "openssh-hmac-sha2-512-etm", "openssh-hmac-sha1-etm",
5454
"hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", NULL
5555
};
5656

@@ -1609,11 +1609,38 @@ nc_server_config_none(const struct lyd_node *node, NC_OPERATION op)
16091609
}
16101610

16111611
static int
1612-
nc_server_config_transport_params(const char *alg, char **alg_store, NC_OPERATION op)
1612+
nc_server_config_transport_params(const char *algorithm, char **alg_store, NC_OPERATION op)
16131613
{
16141614
int ret = 0, alg_found = 0;
1615-
char *substr, *haystack;
1616-
size_t alg_len = strlen(alg);
1615+
char *substr, *haystack, *alg = NULL;
1616+
size_t alg_len;
1617+
1618+
if (!strncmp(algorithm, "openssh-", 8)) {
1619+
/* if the name starts with openssh, convert it to it's original libssh accepted form */
1620+
asprintf(&alg, "%[email protected]", algorithm + 8);
1621+
if (!alg) {
1622+
ERRMEM;
1623+
ret = 1;
1624+
goto cleanup;
1625+
}
1626+
} else if (!strncmp(algorithm, "libssh-", 7)) {
1627+
/* if the name starts with libssh, convert it to it's original libssh accepted form */
1628+
asprintf(&alg, "%[email protected]", algorithm + 7);
1629+
if (!alg) {
1630+
ERRMEM;
1631+
ret = 1;
1632+
goto cleanup;
1633+
}
1634+
} else {
1635+
alg = strdup(algorithm);
1636+
if (!alg) {
1637+
ERRMEM;
1638+
ret = 1;
1639+
goto cleanup;
1640+
}
1641+
}
1642+
1643+
alg_len = strlen(alg);
16171644

16181645
if ((op == NC_OP_CREATE) || (op == NC_OP_REPLACE)) {
16191646
if (!*alg_store) {
@@ -1660,6 +1687,7 @@ nc_server_config_transport_params(const char *alg, char **alg_store, NC_OPERATIO
16601687
}
16611688

16621689
cleanup:
1690+
free(alg);
16631691
return ret;
16641692
}
16651693

0 commit comments

Comments
 (0)