Compare commits
| Author | SHA1 | Date | |
|---|---|---|---|
 曾志威
|
0890deb31a | ||
|
曾志威
|
13918238eb |
+2
-6
@@ -13,10 +13,6 @@ steps:
|
||||
password:
|
||||
from_secret: docker_password
|
||||
registry: https://registry.cn-hangzhou.aliyuncs.com
|
||||
repo: registry.cn-hangzhou.aliyuncs.com/loghub/nginx
|
||||
repo: registry.cn-hangzhou.aliyuncs.com/loghub/mongo
|
||||
tags:
|
||||
- 1.29.4
|
||||
|
||||
volumes:
|
||||
- name: ruoyi_cache
|
||||
temp: {}
|
||||
- 8
|
||||
|
||||
+66
-151
@@ -1,162 +1,77 @@
|
||||
FROM alpine:3.23
|
||||
# https://www.mongodb.com/zh-cn/docs/v8.2/tutorial/install-mongodb-on-red-hat/#install-mongodb-community-edition
|
||||
# https://repo.mongodb.org/yum/redhat/9/mongodb-org/8.2/x86_64/RPMS/
|
||||
|
||||
ENV LANG=en_US.UTF-8
|
||||
ENV NGINX_VERSION=1.29.4
|
||||
ENV NGX_DEVEL_KIT_VERSION=0.3.4
|
||||
ENV LUA_NGINX_MODULE_VERSION=0.10.29
|
||||
ENV HEADERS_MORE_VERSION=0.39
|
||||
ENV LUA_RESTY_CORE=0.1.32
|
||||
ENV LUA_RESTY_LRUCACHE=0.15
|
||||
ENV LUA_RESTY_UPSTREAM_HEALTHCHECK=0.08
|
||||
FROM oraclelinux:9-slim-fips
|
||||
|
||||
# 1. 更新系统并安装核心依赖
|
||||
# add our user and group first to make sure their IDs get assigned consistently, regardless of whatever dependencies get added
|
||||
# RUN set -eux; \
|
||||
# groupadd --gid 999 --system mongodb; \
|
||||
# useradd --uid 999 --system --gid mongodb --home-dir /data/db mongodb; \
|
||||
# mkdir -p /data/db /data/configdb; \
|
||||
# chown -R mongodb:mongodb /data/db /data/configdb
|
||||
|
||||
|
||||
RUN set -eux; \
|
||||
apk update; \
|
||||
apk upgrade ;
|
||||
microdnf update -y; \
|
||||
microdnf upgrade -y;
|
||||
|
||||
# # Install LUAJIT and LUARestyCore
|
||||
# RUN apk update && apk add --no-cache luajit lua-resty-core
|
||||
|
||||
RUN set -eux; \
|
||||
CONFIG="\
|
||||
--prefix=/etc/nginx \
|
||||
--sbin-path=/usr/sbin/nginx \
|
||||
--conf-path=/etc/nginx/nginx.conf \
|
||||
--error-log-path=/var/log/nginx/error.log \
|
||||
--http-log-path=/var/log/nginx/access.log \
|
||||
--pid-path=/var/run/nginx.pid \
|
||||
--lock-path=/var/run/nginx.lock \
|
||||
--http-client-body-temp-path=/var/cache/nginx/client_temp \
|
||||
--http-proxy-temp-path=/var/cache/nginx/proxy_temp \
|
||||
--http-fastcgi-temp-path=/var/cache/nginx/fastcgi_temp \
|
||||
--http-uwsgi-temp-path=/var/cache/nginx/uwsgi_temp \
|
||||
--http-scgi-temp-path=/var/cache/nginx/scgi_temp \
|
||||
--user=nginx \
|
||||
--group=nginx \
|
||||
--with-http_ssl_module \
|
||||
--with-http_realip_module \
|
||||
--with-http_addition_module \
|
||||
--with-http_sub_module \
|
||||
--with-http_dav_module \
|
||||
--with-http_flv_module \
|
||||
--with-http_mp4_module \
|
||||
--with-http_gunzip_module \
|
||||
--with-http_gzip_static_module \
|
||||
--with-http_random_index_module \
|
||||
--with-http_secure_link_module \
|
||||
--with-http_stub_status_module \
|
||||
--with-http_auth_request_module \
|
||||
--with-threads \
|
||||
--with-stream \
|
||||
--with-stream_ssl_module \
|
||||
--with-http_slice_module \
|
||||
--with-mail \
|
||||
--with-mail_ssl_module \
|
||||
--with-file-aio \
|
||||
--with-http_v2_module \
|
||||
--with-ld-opt='-Wl,-rpath,/usr/lib' \
|
||||
--add-module=/tmp/ngx_devel_kit-${NGX_DEVEL_KIT_VERSION} \
|
||||
--add-module=/tmp/lua-nginx-module-${LUA_NGINX_MODULE_VERSION} \
|
||||
--add-module=/tmp/headers-more-nginx-module-${HEADERS_MORE_VERSION} \
|
||||
"\
|
||||
&& addgroup -S nginx \
|
||||
&& adduser -D -S -h /var/cache/nginx -s /sbin/nologin -G nginx nginx \
|
||||
&& apk add --no-cache --virtual .build-deps \
|
||||
gcc \
|
||||
libc-dev \
|
||||
make \
|
||||
openssl-dev \
|
||||
pcre-dev \
|
||||
zlib-dev \
|
||||
linux-headers \
|
||||
curl \
|
||||
gnupg \
|
||||
luajit-dev \
|
||||
pax-utils \
|
||||
&& export LUAJIT_LIB=/usr/lib \
|
||||
&& export LUAJIT_INC=/usr/include/luajit-2.1 \
|
||||
&& curl -fSL https://github.com/simpl/ngx_devel_kit/archive/v${NGX_DEVEL_KIT_VERSION}.tar.gz -o /tmp/ndk.tar.gz \
|
||||
&& tar -xvf /tmp/ndk.tar.gz -C /tmp \
|
||||
&& curl -fSL https://github.com/openresty/lua-nginx-module/archive/v${LUA_NGINX_MODULE_VERSION}.tar.gz -o /tmp/lua-nginx.tar.gz \
|
||||
&& tar -xvf /tmp/lua-nginx.tar.gz -C /tmp \
|
||||
&& curl -fSL https://github.com/openresty/headers-more-nginx-module/archive/v${HEADERS_MORE_VERSION}.tar.gz -o /tmp/headers-more.tar.gz \
|
||||
&& tar -xvf /tmp/headers-more.tar.gz -C /tmp \
|
||||
&& curl -fSL https://nginx.org/download/nginx-$NGINX_VERSION.tar.gz -o nginx.tar.gz \
|
||||
&& export GNUPGHOME="$(mktemp -d)" \
|
||||
&& mkdir -p /usr/src \
|
||||
&& tar -zxC /usr/src -f nginx.tar.gz \
|
||||
&& rm nginx.tar.gz \
|
||||
&& cd /usr/src/nginx-$NGINX_VERSION \
|
||||
&& ./configure $CONFIG --with-debug \
|
||||
&& make -j$(getconf _NPROCESSORS_ONLN) \
|
||||
&& mv objs/nginx objs/nginx-debug \
|
||||
&& ./configure $CONFIG \
|
||||
&& make -j$(getconf _NPROCESSORS_ONLN) \
|
||||
&& make install \
|
||||
&& mkdir -p /usr/local/share/lua/5.1 \
|
||||
&& curl -fSL https://github.com/openresty/lua-resty-core/archive/v${LUA_RESTY_CORE}.tar.gz -o /tmp/lua-resty-core.tar.gz \
|
||||
&& tar -xvf /tmp/lua-resty-core.tar.gz -C /tmp \
|
||||
&& cp -r /tmp/lua-resty-core-${LUA_RESTY_CORE}/lib/resty /usr/local/share/lua/5.1/ \
|
||||
&& rm -rf /tmp/lua-resty-core-${LUA_RESTY_CORE} \
|
||||
&& rm -rf /tmp/lua-resty-core.tar.gz \
|
||||
&& curl -fSL https://github.com/openresty/lua-resty-lrucache/archive/v${LUA_RESTY_LRUCACHE}.tar.gz -o /tmp/lrucache.tar.gz \
|
||||
&& tar -xzf /tmp/lrucache.tar.gz -C /tmp \
|
||||
&& cp -r /tmp/lua-resty-lrucache-${LUA_RESTY_LRUCACHE}/lib/resty /usr/local/share/lua/5.1/ \
|
||||
&& rm -rf /tmp/lua-resty-lrucache-${LUA_RESTY_LRUCACHE} \
|
||||
&& rm -rf /tmp/lrucache.tar.gz \
|
||||
&& curl -fSL https://github.com/openresty/lua-resty-upstream-healthcheck/archive/v${LUA_RESTY_UPSTREAM_HEALTHCHECK}.tar.gz -o /tmp/healthcheck.tar.gz \
|
||||
&& tar -xzf /tmp/healthcheck.tar.gz -C /tmp \
|
||||
&& cp -r /tmp/lua-resty-upstream-healthcheck-${LUA_RESTY_UPSTREAM_HEALTHCHECK}/lib/resty /usr/local/share/lua/5.1/ \
|
||||
&& rm -rf /tmp/lua-resty-upstream-healthcheck-${LUA_RESTY_UPSTREAM_HEALTHCHECK} \
|
||||
&& rm -rf /tmp/healthcheck.tar.gz \
|
||||
&& mkdir -p /var/cache/nginx/client_temp \
|
||||
/var/cache/nginx/proxy_temp \
|
||||
/var/cache/nginx/fastcgi_temp \
|
||||
/var/cache/nginx/uwsgi_temp \
|
||||
/var/cache/nginx/scgi_temp \
|
||||
&& rm -rf /etc/nginx/html/ \
|
||||
&& mkdir /etc/nginx/conf.d/ \
|
||||
&& mkdir -p /usr/share/nginx/html/ \
|
||||
&& chown -R nginx:nginx /var/cache/nginx \
|
||||
&& install -m644 html/index.html /usr/share/nginx/html/ \
|
||||
&& install -m644 html/50x.html /usr/share/nginx/html/ \
|
||||
&& install -m755 objs/nginx-debug /usr/sbin/nginx-debug \
|
||||
&& strip /usr/sbin/nginx* \
|
||||
&& rm -rf /usr/src/nginx-$NGINX_VERSION \
|
||||
&& rm -f /tmp/ndk.tar.gz \
|
||||
&& rm -f /tmp/lua-nginx.tar.gz \
|
||||
&& rm -f /tmp/headers-more.tar.gz \
|
||||
&& rm -rf /tmp/ngx_devel_kit-${NGX_DEVEL_KIT_VERSION} \
|
||||
&& rm -rf /tmp/lua-nginx-module-${LUA_NGINX_MODULE_VERSION} \
|
||||
&& rm -rf /tmp/headers-more-nginx-module-${HEADERS_MORE_VERSION} \
|
||||
\
|
||||
# Bring in gettext so we can get `envsubst`, then throw
|
||||
# the rest away. To do this, we need to install `gettext`
|
||||
# then move `envsubst` out of the way so `gettext` can
|
||||
# be deleted completely, then move `envsubst` back.
|
||||
&& apk add --no-cache --virtual .gettext gettext \
|
||||
&& mv /usr/bin/envsubst /tmp/ \
|
||||
&& runDeps="$( \
|
||||
scanelf --needed --nobanner /usr/sbin/nginx /tmp/envsubst \
|
||||
| awk '{ gsub(/,/, "\nso:", $2); print "so:" $2 }' \
|
||||
| sort -u \
|
||||
| xargs -r apk info --installed \
|
||||
| sort -u \
|
||||
)" \
|
||||
\
|
||||
&& apk add --no-cache --virtual .nginx-rundeps $runDeps \
|
||||
&& apk del .build-deps \
|
||||
&& apk del .gettext \
|
||||
&& mv /tmp/envsubst /usr/local/bin/ \
|
||||
\
|
||||
# forward request and error logs to docker log collector
|
||||
&& ln -sf /dev/stdout /var/log/nginx/access.log \
|
||||
&& ln -sf /dev/stderr /var/log/nginx/error.log
|
||||
{ \
|
||||
echo '[mongodb-org-8.2]'; \
|
||||
echo 'name=MongoDB Repository'; \
|
||||
echo 'baseurl=https://repo.mongodb.org/yum/redhat/9/mongodb-org/8.2/x86_64/'; \
|
||||
echo 'gpgcheck=1'; \
|
||||
echo 'enabled=1'; \
|
||||
echo 'gpgkey=https://pgp.mongodb.com/server-8.0.asc'; \
|
||||
} | tee /etc/yum.repos.d/mongodb-org-8.2.repo
|
||||
|
||||
COPY nginx.conf /etc/nginx/nginx.conf
|
||||
COPY nginx.vh.default.conf /etc/nginx/conf.d/default.conf
|
||||
RUN set -eux; \
|
||||
microdnf install -y \
|
||||
"mongodb-org-server"
|
||||
|
||||
EXPOSE 80 443
|
||||
# RUN set -eux; \
|
||||
# microdnf install -y \
|
||||
# "mongodb-org" \
|
||||
# "mongodb-org-database" \
|
||||
# "mongodb-mongosh" \
|
||||
# "mongodb-org-tools" ; \
|
||||
# mv /etc/mongod.conf /etc/mongod.conf.orig
|
||||
|
||||
CMD ["nginx", "-g", "daemon off;"]
|
||||
# COPY bin/ /usr/bin/
|
||||
# RUN set -eux; \
|
||||
# chmod +x /usr/bin/mongotop; \
|
||||
# chmod +x /usr/bin/bsondump; \
|
||||
# chmod +x /usr/bin/mongodump; \
|
||||
# chmod +x /usr/bin/mongoexport; \
|
||||
# chmod +x /usr/bin/mongofiles; \
|
||||
# chmod +x /usr/bin/mongoimport; \
|
||||
# chmod +x /usr/bin/mongorestore; \
|
||||
# chmod +x /usr/bin/mongostat;
|
||||
|
||||
|
||||
# RUN set -eux; \
|
||||
# microdnf -y install curl-7.76.1-35.el9_7.3 libcurl-7.76.1-35.el9_7.3;
|
||||
|
||||
RUN set -eux; \
|
||||
microdnf clean all ;
|
||||
|
||||
RUN set -eux; \
|
||||
rpm -e --nodeps expat glib2 curl libcurl libssh libssh-config
|
||||
|
||||
COPY usr/lib64/ /usr/lib64/
|
||||
|
||||
VOLUME /data/db /data/configdb
|
||||
ENV HOME=/data/db
|
||||
|
||||
EXPOSE 27017
|
||||
CMD ["mongod", "--bind_ip_all"]
|
||||
|
||||
|
||||
# docker build -t registry.cn-shanghai.aliyuncs.com/hub_z/mongo:8.2 .
|
||||
# docker push registry.cn-shanghai.aliyuncs.com/hub_z/mongo:8.2
|
||||
# syft --scope squashed registry.cn-shanghai.aliyuncs.com/hub_z/mongo:8.2 -o spdx-json=mongo.json
|
||||
|
||||
# rpmextract.sh libcurl-7.76.1-35.el9_7.3.x86_64.rpm
|
||||
|
||||
|
||||
@@ -0,0 +1,14 @@
|
||||
|
||||
services:
|
||||
mongo:
|
||||
image: registry.cn-shanghai.aliyuncs.com/hub_z/mongo:8.0
|
||||
container_name: mongo
|
||||
network_mode: "host"
|
||||
restart: unless-stopped # 除非手动停止，否则自动重启
|
||||
volumes:
|
||||
- ./data/db:/data/db
|
||||
environment:
|
||||
- MONGO_INITDB_ROOT_USERNAME=root
|
||||
- MONGO_INITDB_ROOT_PASSWORD=gd5A3EbMcXD#oq2!
|
||||
- TZ=Asia/Shanghai
|
||||
# command: mongod --dbpath /data/db --replSet rs1 --bind_ip_all --wiredTigerCacheSizeGB 1 --auth --keyFile /mongodb-keyfile
|
||||
@@ -0,0 +1,420 @@
|
||||
#!/usr/bin/env bash
|
||||
set -Eeuo pipefail
|
||||
|
||||
if [ "${1:0:1}" = '-' ]; then
|
||||
set -- mongod "$@"
|
||||
fi
|
||||
|
||||
originalArgOne="$1"
|
||||
|
||||
# allow the container to be started with `--user`
|
||||
# all mongo* commands should be dropped to the correct user
|
||||
if [[ "$originalArgOne" == mongo* ]] && [ "$(id -u)" = '0' ]; then
|
||||
if [ "$originalArgOne" = 'mongod' ]; then
|
||||
find -L /data/configdb /data/db \! -user mongodb -exec chown mongodb '{}' +
|
||||
fi
|
||||
|
||||
# make sure we can write to stdout and stderr as "mongodb"
|
||||
# (for our "initdb" code later; see "--logpath" below)
|
||||
chown --dereference mongodb "/proc/$$/fd/1" "/proc/$$/fd/2" || :
|
||||
# ignore errors thanks to https://github.com/docker-library/mongo/issues/149
|
||||
|
||||
exec gosu mongodb "$BASH_SOURCE" "$@"
|
||||
fi
|
||||
|
||||
dpkgArch="$(dpkg --print-architecture)"
|
||||
case "$dpkgArch" in
|
||||
amd64) # https://github.com/docker-library/mongo/issues/485#issuecomment-891991814
|
||||
if ! grep -qE '^flags.* avx( .*|$)' /proc/cpuinfo; then
|
||||
{
|
||||
echo
|
||||
echo 'WARNING: MongoDB 5.0+ requires a CPU with AVX support, and your current system does not appear to have that!'
|
||||
echo ' see https://jira.mongodb.org/browse/SERVER-54407'
|
||||
echo ' see also https://www.mongodb.com/community/forums/t/mongodb-5-0-cpu-intel-g4650-compatibility/116610/2'
|
||||
echo ' see also https://github.com/docker-library/mongo/issues/485#issuecomment-891991814'
|
||||
echo
|
||||
} >&2
|
||||
fi
|
||||
;;
|
||||
|
||||
arm64) # https://github.com/docker-library/mongo/issues/485#issuecomment-970864306
|
||||
# https://en.wikichip.org/wiki/arm/armv8#ARMv8_Extensions_and_Processor_Features
|
||||
# http://javathunderx.blogspot.com/2018/11/cheat-sheet-for-cpuinfo-features-on.html
|
||||
if ! grep -qE '^Features.* (fphp|dcpop|sha3|sm3|sm4|asimddp|sha512|sve)( .*|$)' /proc/cpuinfo; then
|
||||
{
|
||||
echo
|
||||
echo 'WARNING: MongoDB requires ARMv8.2-A or higher, and your current system does not appear to implement any of the common features for that!'
|
||||
echo ' applies to all versions ≥5.0, any of 4.4 ≥4.4.19'
|
||||
echo ' see https://jira.mongodb.org/browse/SERVER-71772'
|
||||
echo ' see https://jira.mongodb.org/browse/SERVER-55178'
|
||||
echo ' see also https://en.wikichip.org/wiki/arm/armv8#ARMv8_Extensions_and_Processor_Features'
|
||||
echo ' see also https://github.com/docker-library/mongo/issues/485#issuecomment-970864306'
|
||||
echo
|
||||
} >&2
|
||||
fi
|
||||
;;
|
||||
esac
|
||||
|
||||
# you should use numactl to start your mongod instances, including the config servers, mongos instances, and any clients.
|
||||
# https://docs.mongodb.com/manual/administration/production-notes/#configuring-numa-on-linux
|
||||
if [[ "$originalArgOne" == mongo* ]]; then
|
||||
numa='numactl --interleave=all'
|
||||
if $numa true &> /dev/null; then
|
||||
set -- $numa "$@"
|
||||
fi
|
||||
fi
|
||||
|
||||
# usage: file_env VAR [DEFAULT]
|
||||
# ie: file_env 'XYZ_DB_PASSWORD' 'example'
|
||||
# (will allow for "$XYZ_DB_PASSWORD_FILE" to fill in the value of
|
||||
# "$XYZ_DB_PASSWORD" from a file, especially for Docker's secrets feature)
|
||||
file_env() {
|
||||
local var="$1"
|
||||
local fileVar="${var}_FILE"
|
||||
local def="${2:-}"
|
||||
if [ "${!var:-}" ] && [ "${!fileVar:-}" ]; then
|
||||
echo >&2 "error: both $var and $fileVar are set (but are exclusive)"
|
||||
exit 1
|
||||
fi
|
||||
local val="$def"
|
||||
if [ "${!var:-}" ]; then
|
||||
val="${!var}"
|
||||
elif [ "${!fileVar:-}" ]; then
|
||||
val="$(< "${!fileVar}")"
|
||||
fi
|
||||
export "$var"="$val"
|
||||
unset "$fileVar"
|
||||
}
|
||||
|
||||
# see https://github.com/docker-library/mongo/issues/147 (mongod is picky about duplicated arguments)
|
||||
_mongod_hack_have_arg() {
|
||||
local checkArg="$1"; shift
|
||||
local arg
|
||||
for arg; do
|
||||
case "$arg" in
|
||||
"$checkArg"|"$checkArg"=*)
|
||||
return 0
|
||||
;;
|
||||
esac
|
||||
done
|
||||
return 1
|
||||
}
|
||||
# _mongod_hack_get_arg_val '--some-arg' "$@"
|
||||
_mongod_hack_get_arg_val() {
|
||||
local checkArg="$1"; shift
|
||||
while [ "$#" -gt 0 ]; do
|
||||
local arg="$1"; shift
|
||||
case "$arg" in
|
||||
"$checkArg")
|
||||
echo "$1"
|
||||
return 0
|
||||
;;
|
||||
"$checkArg"=*)
|
||||
echo "${arg#$checkArg=}"
|
||||
return 0
|
||||
;;
|
||||
esac
|
||||
done
|
||||
return 1
|
||||
}
|
||||
declare -a mongodHackedArgs
|
||||
# _mongod_hack_ensure_arg '--some-arg' "$@"
|
||||
# set -- "${mongodHackedArgs[@]}"
|
||||
_mongod_hack_ensure_arg() {
|
||||
local ensureArg="$1"; shift
|
||||
mongodHackedArgs=( "$@" )
|
||||
if ! _mongod_hack_have_arg "$ensureArg" "$@"; then
|
||||
mongodHackedArgs+=( "$ensureArg" )
|
||||
fi
|
||||
}
|
||||
# _mongod_hack_ensure_no_arg '--some-unwanted-arg' "$@"
|
||||
# set -- "${mongodHackedArgs[@]}"
|
||||
_mongod_hack_ensure_no_arg() {
|
||||
local ensureNoArg="$1"; shift
|
||||
mongodHackedArgs=()
|
||||
while [ "$#" -gt 0 ]; do
|
||||
local arg="$1"; shift
|
||||
if [ "$arg" = "$ensureNoArg" ]; then
|
||||
continue
|
||||
fi
|
||||
mongodHackedArgs+=( "$arg" )
|
||||
done
|
||||
}
|
||||
# _mongod_hack_ensure_no_arg '--some-unwanted-arg' "$@"
|
||||
# set -- "${mongodHackedArgs[@]}"
|
||||
_mongod_hack_ensure_no_arg_val() {
|
||||
local ensureNoArg="$1"; shift
|
||||
mongodHackedArgs=()
|
||||
while [ "$#" -gt 0 ]; do
|
||||
local arg="$1"; shift
|
||||
case "$arg" in
|
||||
"$ensureNoArg")
|
||||
shift # also skip the value
|
||||
continue
|
||||
;;
|
||||
"$ensureNoArg"=*)
|
||||
# value is already included
|
||||
continue
|
||||
;;
|
||||
esac
|
||||
mongodHackedArgs+=( "$arg" )
|
||||
done
|
||||
}
|
||||
# _mongod_hack_ensure_arg_val '--some-arg' 'some-val' "$@"
|
||||
# set -- "${mongodHackedArgs[@]}"
|
||||
_mongod_hack_ensure_arg_val() {
|
||||
local ensureArg="$1"; shift
|
||||
local ensureVal="$1"; shift
|
||||
_mongod_hack_ensure_no_arg_val "$ensureArg" "$@"
|
||||
mongodHackedArgs+=( "$ensureArg" "$ensureVal" )
|
||||
}
|
||||
|
||||
# _js_escape 'some "string" value'
|
||||
_js_escape() {
|
||||
jq --null-input --arg 'str' "$1" '$str'
|
||||
}
|
||||
|
||||
: "${TMPDIR:=/tmp}"
|
||||
jsonConfigFile="$TMPDIR/docker-entrypoint-config.json"
|
||||
tempConfigFile="$TMPDIR/docker-entrypoint-temp-config.json"
|
||||
_parse_config() {
|
||||
if [ -s "$tempConfigFile" ]; then
|
||||
return 0
|
||||
fi
|
||||
|
||||
local configPath
|
||||
if configPath="$(_mongod_hack_get_arg_val --config "$@")" && [ -s "$configPath" ]; then
|
||||
# if --config is specified, parse it into a JSON file so we can remove a few problematic keys (especially SSL-related keys)
|
||||
# see https://docs.mongodb.com/manual/reference/configuration-options/
|
||||
if grep -vEm1 '^[[:space:]]*(#|$)' "$configPath" | grep -qE '^[[:space:]]*[^=:]+[[:space:]]*='; then
|
||||
# if the first non-comment/non-blank line of the config file looks like "foo = ...", this is probably the 2.4 and older "ini-style config format"
|
||||
# mongod tries to parse config as yaml and then falls back to ini-style parsing
|
||||
# https://github.com/mongodb/mongo/blob/r6.0.3/src/mongo/util/options_parser/options_parser.cpp#L1883-L1894
|
||||
echo >&2
|
||||
echo >&2 "WARNING: it appears that '$configPath' is in the older INI-style format (replaced by YAML in MongoDB 2.6)"
|
||||
echo >&2 ' This script does not parse the older INI-style format, and thus will ignore it.'
|
||||
echo >&2
|
||||
return 1
|
||||
fi
|
||||
if [ "$mongoShell" = 'mongo' ]; then
|
||||
"$mongoShell" --norc --nodb --quiet --eval "load('/js-yaml.js'); printjson(jsyaml.load(cat($(_js_escape "$configPath"))))" > "$jsonConfigFile"
|
||||
else
|
||||
# https://www.mongodb.com/docs/manual/reference/method/js-native/#std-label-native-in-mongosh
|
||||
"$mongoShell" --norc --nodb --quiet --eval "load('/js-yaml.js'); JSON.stringify(jsyaml.load(fs.readFileSync($(_js_escape "$configPath"), 'utf8')))" > "$jsonConfigFile"
|
||||
fi
|
||||
if [ "$(head -c1 "$jsonConfigFile")" != '{' ] || [ "$(tail -c2 "$jsonConfigFile")" != '}' ]; then
|
||||
# if the file doesn't start with "{" and end with "}", it's *probably* an error ("uncaught exception: YAMLException: foo" for example), so we should print it out
|
||||
echo >&2 'error: unexpected "js-yaml.js" output while parsing config:'
|
||||
cat >&2 "$jsonConfigFile"
|
||||
exit 1
|
||||
fi
|
||||
jq 'del(.systemLog, .processManagement, .net, .security, .replication)' "$jsonConfigFile" > "$tempConfigFile"
|
||||
return 0
|
||||
fi
|
||||
|
||||
return 1
|
||||
}
|
||||
dbPath=
|
||||
_dbPath() {
|
||||
if [ -n "$dbPath" ]; then
|
||||
echo "$dbPath"
|
||||
return
|
||||
fi
|
||||
|
||||
if ! dbPath="$(_mongod_hack_get_arg_val --dbpath "$@")"; then
|
||||
if _parse_config "$@"; then
|
||||
dbPath="$(jq -r '.storage.dbPath // empty' "$jsonConfigFile")"
|
||||
fi
|
||||
fi
|
||||
|
||||
if [ -z "$dbPath" ]; then
|
||||
if _mongod_hack_have_arg --configsvr "$@" || {
|
||||
_parse_config "$@" \
|
||||
&& clusterRole="$(jq -r '.sharding.clusterRole // empty' "$jsonConfigFile")" \
|
||||
&& [ "$clusterRole" = 'configsvr' ]
|
||||
}; then
|
||||
# if running as config server, then the default dbpath is /data/configdb
|
||||
# https://docs.mongodb.com/manual/reference/program/mongod/#cmdoption-mongod-configsvr
|
||||
dbPath=/data/configdb
|
||||
fi
|
||||
fi
|
||||
|
||||
: "${dbPath:=/data/db}"
|
||||
|
||||
echo "$dbPath"
|
||||
}
|
||||
|
||||
if [ "$originalArgOne" = 'mongod' ]; then
|
||||
file_env 'MONGO_INITDB_ROOT_USERNAME'
|
||||
file_env 'MONGO_INITDB_ROOT_PASSWORD'
|
||||
|
||||
mongoShell='mongo'
|
||||
if ! command -v "$mongoShell" > /dev/null; then
|
||||
mongoShell='mongosh'
|
||||
fi
|
||||
|
||||
# pre-check a few factors to see if it's even worth bothering with initdb
|
||||
shouldPerformInitdb=
|
||||
if [ "$MONGO_INITDB_ROOT_USERNAME" ] && [ "$MONGO_INITDB_ROOT_PASSWORD" ]; then
|
||||
# if we have a username/password, let's set "--auth"
|
||||
_mongod_hack_ensure_arg '--auth' "$@"
|
||||
set -- "${mongodHackedArgs[@]}"
|
||||
shouldPerformInitdb='true'
|
||||
elif [ "$MONGO_INITDB_ROOT_USERNAME" ] || [ "$MONGO_INITDB_ROOT_PASSWORD" ]; then
|
||||
cat >&2 <<-'EOF'
|
||||
|
||||
error: missing 'MONGO_INITDB_ROOT_USERNAME' or 'MONGO_INITDB_ROOT_PASSWORD'
|
||||
both must be specified for a user to be created
|
||||
|
||||
EOF
|
||||
exit 1
|
||||
fi
|
||||
|
||||
if [ -z "$shouldPerformInitdb" ]; then
|
||||
# if we've got any /docker-entrypoint-initdb.d/* files to parse later, we should initdb
|
||||
for f in /docker-entrypoint-initdb.d/*; do
|
||||
case "$f" in
|
||||
*.sh|*.js) # this should match the set of files we check for below
|
||||
shouldPerformInitdb="$f"
|
||||
break
|
||||
;;
|
||||
esac
|
||||
done
|
||||
fi
|
||||
|
||||
# check for a few known paths (to determine whether we've already initialized and should thus skip our initdb scripts)
|
||||
if [ -n "$shouldPerformInitdb" ]; then
|
||||
dbPath="$(_dbPath "$@")"
|
||||
for path in \
|
||||
"$dbPath/WiredTiger" \
|
||||
"$dbPath/journal" \
|
||||
"$dbPath/local.0" \
|
||||
"$dbPath/storage.bson" \
|
||||
; do
|
||||
if [ -e "$path" ]; then
|
||||
shouldPerformInitdb=
|
||||
break
|
||||
fi
|
||||
done
|
||||
fi
|
||||
|
||||
if [ -n "$shouldPerformInitdb" ]; then
|
||||
mongodHackedArgs=( "$@" )
|
||||
if _parse_config "$@"; then
|
||||
_mongod_hack_ensure_arg_val --config "$tempConfigFile" "${mongodHackedArgs[@]}"
|
||||
fi
|
||||
_mongod_hack_ensure_arg_val --bind_ip 127.0.0.1 "${mongodHackedArgs[@]}"
|
||||
_mongod_hack_ensure_arg_val --port 27017 "${mongodHackedArgs[@]}"
|
||||
_mongod_hack_ensure_no_arg --bind_ip_all "${mongodHackedArgs[@]}"
|
||||
|
||||
# remove "--auth" and "--replSet" for our initial startup (see https://docs.mongodb.com/manual/tutorial/enable-authentication/#start-mongodb-without-access-control)
|
||||
# https://github.com/docker-library/mongo/issues/211
|
||||
_mongod_hack_ensure_no_arg --auth "${mongodHackedArgs[@]}"
|
||||
# "keyFile implies security.authorization"
|
||||
# https://docs.mongodb.com/manual/reference/configuration-options/#mongodb-setting-security.keyFile
|
||||
_mongod_hack_ensure_no_arg_val --keyFile "${mongodHackedArgs[@]}"
|
||||
if [ "$MONGO_INITDB_ROOT_USERNAME" ] && [ "$MONGO_INITDB_ROOT_PASSWORD" ]; then
|
||||
_mongod_hack_ensure_no_arg_val --replSet "${mongodHackedArgs[@]}"
|
||||
fi
|
||||
|
||||
# "BadValue: need sslPEMKeyFile when SSL is enabled" vs "BadValue: need to enable SSL via the sslMode flag when using SSL configuration parameters"
|
||||
tlsMode='disabled'
|
||||
if _mongod_hack_have_arg '--tlsCertificateKeyFile' "$@"; then
|
||||
tlsMode='allowTLS'
|
||||
fi
|
||||
_mongod_hack_ensure_arg_val --tlsMode "$tlsMode" "${mongodHackedArgs[@]}"
|
||||
|
||||
if stat "/proc/$$/fd/1" > /dev/null && [ -w "/proc/$$/fd/1" ]; then
|
||||
# https://github.com/mongodb/mongo/blob/38c0eb538d0fd390c6cb9ce9ae9894153f6e8ef5/src/mongo/db/initialize_server_global_state.cpp#L237-L251
|
||||
# https://github.com/docker-library/mongo/issues/164#issuecomment-293965668
|
||||
_mongod_hack_ensure_arg_val --logpath "/proc/$$/fd/1" "${mongodHackedArgs[@]}"
|
||||
else
|
||||
initdbLogPath="$(_dbPath "$@")/docker-initdb.log"
|
||||
echo >&2 "warning: initdb logs cannot write to '/proc/$$/fd/1', so they are in '$initdbLogPath' instead"
|
||||
_mongod_hack_ensure_arg_val --logpath "$initdbLogPath" "${mongodHackedArgs[@]}"
|
||||
fi
|
||||
_mongod_hack_ensure_arg --logappend "${mongodHackedArgs[@]}"
|
||||
|
||||
pidfile="$TMPDIR/docker-entrypoint-temp-mongod.pid"
|
||||
rm -f "$pidfile"
|
||||
_mongod_hack_ensure_arg_val --pidfilepath "$pidfile" "${mongodHackedArgs[@]}"
|
||||
|
||||
"${mongodHackedArgs[@]}" --fork
|
||||
|
||||
mongo=( "$mongoShell" --host 127.0.0.1 --port 27017 --quiet )
|
||||
|
||||
# check to see that our "mongod" actually did start up (catches "--help", "--version", slow prealloc, etc)
|
||||
# https://jira.mongodb.org/browse/SERVER-16292
|
||||
tries=30
|
||||
while true; do
|
||||
if ! { [ -s "$pidfile" ] && ps "$(< "$pidfile")" &> /dev/null; }; then
|
||||
# bail ASAP if "mongod" isn't even running
|
||||
echo >&2
|
||||
echo >&2 "error: $originalArgOne does not appear to have stayed running -- perhaps it had an error?"
|
||||
echo >&2
|
||||
exit 1
|
||||
fi
|
||||
if "${mongo[@]}" 'admin' --eval 'quit(0)' &> /dev/null; then
|
||||
# success!
|
||||
break
|
||||
fi
|
||||
(( tries-- ))
|
||||
if [ "$tries" -le 0 ]; then
|
||||
echo >&2
|
||||
echo >&2 "error: $originalArgOne does not appear to have accepted connections quickly enough -- perhaps it had an error?"
|
||||
echo >&2
|
||||
exit 1
|
||||
fi
|
||||
sleep 1
|
||||
done
|
||||
|
||||
if [ "$MONGO_INITDB_ROOT_USERNAME" ] && [ "$MONGO_INITDB_ROOT_PASSWORD" ]; then
|
||||
rootAuthDatabase='admin'
|
||||
|
||||
"${mongo[@]}" "$rootAuthDatabase" <<-EOJS
|
||||
db.createUser({
|
||||
user: $(_js_escape "$MONGO_INITDB_ROOT_USERNAME"),
|
||||
pwd: $(_js_escape "$MONGO_INITDB_ROOT_PASSWORD"),
|
||||
roles: [ { role: 'root', db: $(_js_escape "$rootAuthDatabase") } ]
|
||||
})
|
||||
EOJS
|
||||
fi
|
||||
|
||||
export MONGO_INITDB_DATABASE="${MONGO_INITDB_DATABASE:-test}"
|
||||
|
||||
echo
|
||||
for f in /docker-entrypoint-initdb.d/*; do
|
||||
case "$f" in
|
||||
*.sh) echo "$0: running $f"; . "$f" ;;
|
||||
*.js) echo "$0: running $f"; "${mongo[@]}" "$MONGO_INITDB_DATABASE" "$f"; echo ;;
|
||||
*) echo "$0: ignoring $f" ;;
|
||||
esac
|
||||
echo
|
||||
done
|
||||
|
||||
"${mongodHackedArgs[@]}" --shutdown
|
||||
rm -f "$pidfile"
|
||||
|
||||
echo
|
||||
echo 'MongoDB init process complete; ready for start up.'
|
||||
echo
|
||||
fi
|
||||
|
||||
# MongoDB defaults to localhost-only binding
|
||||
haveBindIp=
|
||||
if _mongod_hack_have_arg --bind_ip "$@" || _mongod_hack_have_arg --bind_ip_all "$@"; then
|
||||
haveBindIp=1
|
||||
elif _parse_config "$@" && jq --exit-status '.net.bindIp // .net.bindIpAll' "$jsonConfigFile" > /dev/null; then
|
||||
haveBindIp=1
|
||||
fi
|
||||
if [ -z "$haveBindIp" ]; then
|
||||
# so if no "--bind_ip" is specified, let's add "--bind_ip_all"
|
||||
set -- "$@" --bind_ip_all
|
||||
fi
|
||||
|
||||
unset "${!MONGO_INITDB_@}"
|
||||
fi
|
||||
|
||||
rm -f "$jsonConfigFile" "$tempConfigFile"
|
||||
|
||||
exec "$@"
|
||||
@@ -0,0 +1,4 @@
|
||||
# Parse system-wide crypto configuration file
|
||||
Include /etc/crypto-policies/back-ends/libssh.config
|
||||
# Parse OpenSSH configuration file for consistency
|
||||
Include /etc/ssh/ssh_config
|
||||
@@ -0,0 +1,2 @@
|
||||
# Parse system-wide crypto configuration file
|
||||
Include /etc/crypto-policies/back-ends/libssh.config
|
||||
Binary file not shown.
Binary file not shown.
Binary file not shown.
-88
@@ -1,88 +0,0 @@
|
||||
# nginx.conf -- docker-openresty
|
||||
#
|
||||
# This file is installed to:
|
||||
# `/usr/local/openresty/nginx/conf/nginx.conf`
|
||||
# and is the file loaded by nginx at startup,
|
||||
# unless the user specifies otherwise.
|
||||
#
|
||||
# It tracks the upstream OpenResty's `nginx.conf`, but removes the `server`
|
||||
# section and adds this directive:
|
||||
# `include /etc/nginx/conf.d/*.conf;`
|
||||
#
|
||||
# The `docker-openresty` file `nginx.vh.default.conf` is copied to
|
||||
# `/etc/nginx/conf.d/default.conf`. It contains the `server section
|
||||
# of the upstream `nginx.conf`.
|
||||
#
|
||||
# See https://github.com/openresty/docker-openresty/blob/master/README.md#nginx-config-files
|
||||
#
|
||||
|
||||
#user nobody;
|
||||
#worker_processes 1;
|
||||
|
||||
# Enables the use of JIT for regular expressions to speed-up their processing.
|
||||
pcre_jit on;
|
||||
|
||||
#error_log logs/error.log;
|
||||
#error_log logs/error.log notice;
|
||||
#error_log logs/error.log info;
|
||||
|
||||
#pid logs/nginx.pid;
|
||||
|
||||
events {
|
||||
worker_connections 1024;
|
||||
}
|
||||
|
||||
|
||||
http {
|
||||
include mime.types;
|
||||
default_type application/octet-stream;
|
||||
|
||||
# Enables or disables the use of underscores in client request header fields.
|
||||
# When the use of underscores is disabled, request header fields whose names contain underscores are marked as invalid and become subject to the ignore_invalid_headers directive.
|
||||
# underscores_in_headers off;
|
||||
|
||||
#log_format main '$remote_addr - $remote_user [$time_local] "$request" '
|
||||
# '$status $body_bytes_sent "$http_referer" '
|
||||
# '"$http_user_agent" "$http_x_forwarded_for"';
|
||||
|
||||
#access_log logs/access.log main;
|
||||
|
||||
# Log in JSON Format
|
||||
# log_format nginxlog_json escape=json '{ "timestamp": "$time_iso8601", '
|
||||
# '"remote_addr": "$remote_addr", '
|
||||
# '"body_bytes_sent": $body_bytes_sent, '
|
||||
# '"request_time": $request_time, '
|
||||
# '"response_status": $status, '
|
||||
# '"request": "$request", '
|
||||
# '"request_method": "$request_method", '
|
||||
# '"host": "$host",'
|
||||
# '"upstream_addr": "$upstream_addr",'
|
||||
# '"http_x_forwarded_for": "$http_x_forwarded_for",'
|
||||
# '"http_referrer": "$http_referer", '
|
||||
# '"http_user_agent": "$http_user_agent", '
|
||||
# '"http_version": "$server_protocol", '
|
||||
# '"nginx_access": true }';
|
||||
# access_log /dev/stdout nginxlog_json;
|
||||
|
||||
# # See Move default writable paths to a dedicated directory (#119)
|
||||
# # https://github.com/openresty/docker-openresty/issues/119
|
||||
client_body_temp_path /var/cache/nginx/client_temp;
|
||||
proxy_temp_path /var/cache/nginx/proxy_temp;
|
||||
fastcgi_temp_path /var/cache/nginx/fastcgi_temp;
|
||||
uwsgi_temp_path /var/cache/nginx/uwsgi_temp;
|
||||
scgi_temp_path /var/cache/nginx/scgi_temp;
|
||||
|
||||
sendfile on;
|
||||
#tcp_nopush on;
|
||||
|
||||
#keepalive_timeout 0;
|
||||
keepalive_timeout 65;
|
||||
|
||||
#gzip on;
|
||||
include /etc/nginx/conf.d/*.conf;
|
||||
|
||||
# Don't reveal OpenResty version to clients.
|
||||
# server_tokens off;
|
||||
}
|
||||
|
||||
include /etc/nginx/conf.d/*.main;
|
||||
@@ -1,58 +0,0 @@
|
||||
# nginx.vh.default.conf -- docker-openresty
|
||||
#
|
||||
# This file is installed to:
|
||||
# `/etc/nginx/conf.d/default.conf`
|
||||
#
|
||||
# It tracks the `server` section of the upstream OpenResty's `nginx.conf`.
|
||||
#
|
||||
# This config (and any other configs in `etc/nginx/conf.d/`) is loaded by
|
||||
# default by the `include` directive in `/usr/local/openresty/nginx/conf/nginx.conf`.
|
||||
#
|
||||
# See https://github.com/openresty/docker-openresty/blob/master/README.md#nginx-config-files
|
||||
#
|
||||
|
||||
|
||||
server {
|
||||
listen 80;
|
||||
server_name localhost;
|
||||
|
||||
#charset koi8-r;
|
||||
#access_log /var/log/nginx/host.access.log main;
|
||||
|
||||
location / {
|
||||
root /usr/local/openresty/nginx/html;
|
||||
index index.html index.htm;
|
||||
}
|
||||
|
||||
#error_page 404 /404.html;
|
||||
|
||||
# redirect server error pages to the static page /50x.html
|
||||
#
|
||||
error_page 500 502 503 504 /50x.html;
|
||||
location = /50x.html {
|
||||
root /usr/local/openresty/nginx/html;
|
||||
}
|
||||
|
||||
# proxy the PHP scripts to Apache listening on 127.0.0.1:80
|
||||
#
|
||||
#location ~ \.php$ {
|
||||
# proxy_pass http://127.0.0.1;
|
||||
#}
|
||||
|
||||
# pass the PHP scripts to FastCGI server listening on 127.0.0.1:9000
|
||||
#
|
||||
#location ~ \.php$ {
|
||||
# root /usr/local/openresty/nginx/html;
|
||||
# fastcgi_pass 127.0.0.1:9000;
|
||||
# fastcgi_index index.php;
|
||||
# fastcgi_param SCRIPT_FILENAME /scripts$fastcgi_script_name;
|
||||
# include fastcgi_params;
|
||||
#}
|
||||
|
||||
# deny access to .htaccess files, if Apache's document root
|
||||
# concurs with nginx's one
|
||||
#
|
||||
#location ~ /\.ht {
|
||||
# deny all;
|
||||
#}
|
||||
}
|
||||
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
@@ -0,0 +1,15 @@
|
||||
Author(s):
|
||||
Aris Adamantiadis <aris@0xbadc0de.be> (project initiator)
|
||||
|
||||
Andreas Schneider <asn@cryptomilk.org> (developer)
|
||||
|
||||
Nick Zitzmann <seiryu (at) comcast (dot) net> (mostly client SFTP stuff)
|
||||
|
||||
Norbert Kiesel <nkiesel (at) tbdnetworks (dot) com> (getaddrinfo and other patches)
|
||||
|
||||
Jean-Philippe Garcia Ballester <giga (at) le-pec (dot) org> (Port to libgcrypt and configure.in voodoo, debian packaging)
|
||||
|
||||
Contributor(s):
|
||||
|
||||
Laurent Bigonville <bigon (at) bigon (dot) be> (debian packaging)
|
||||
|
||||
@@ -0,0 +1,24 @@
|
||||
Some parts are under the BSDv2 License :
|
||||
|
||||
|
||||
Copyright (c) 2000 Markus Friedl. All rights reserved.
|
||||
Redistribution and use in source and binary forms, with or without
|
||||
modification, are permitted provided that the following conditions
|
||||
are met:
|
||||
1. Redistributions of source code must retain the above copyright
|
||||
notice, this list of conditions and the following disclaimer.
|
||||
2. Redistributions in binary form must reproduce the above copyright
|
||||
notice, this list of conditions and the following disclaimer in the
|
||||
documentation and/or other materials provided with the distribution.
|
||||
|
||||
THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
|
||||
IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
|
||||
OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
|
||||
IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
|
||||
INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
|
||||
NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
|
||||
DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
|
||||
THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
|
||||
(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
|
||||
THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
|
||||
|
||||
@@ -0,0 +1,586 @@
|
||||
CHANGELOG
|
||||
=========
|
||||
|
||||
version 0.10.4 (released 2022-09-07)
|
||||
* Fixed issues with KDF on big endian
|
||||
|
||||
version 0.10.3 (released 2022-09-05)
|
||||
* Fixed possible infinite loop in known hosts checking
|
||||
|
||||
version 0.10.2 (released 2022-09-02)
|
||||
* Fixed tilde expansion when handling include directives
|
||||
* Fixed building the shared torture library
|
||||
* Made rekey test more robust (fixes running on i586 build systems e.g koji)
|
||||
|
||||
version 0.10.1 (released 2022-08-30)
|
||||
* Fixed proxycommand support
|
||||
* Fixed musl libc support
|
||||
|
||||
version 0.10.0 (released 2022-08-26)
|
||||
* Added support for OpenSSL 3.0
|
||||
* Added support for mbedTLS 3
|
||||
* Added support for Smart Cards (through openssl pkcs11 engine)
|
||||
* Added support for chacha20-poly1305@openssh.com with libgcrypt
|
||||
* Added support ed25519 keys in PEM files
|
||||
* Added support for sk-ecdsa and sk-ed25519 (server side)
|
||||
* Added support for limiting RSA key sizes and not accepting small one by
|
||||
default
|
||||
* Added support for ssh-agent on Windows
|
||||
* Added ssh_userauth_publickey_auto_get_current_identity() API
|
||||
* Added ssh_vlog() API
|
||||
* Added ssh_send_issue_banner() API
|
||||
* Added ssh_session_set_disconnect_message() API
|
||||
* Added new configuration options:
|
||||
+ IdentityAgent
|
||||
+ ModuliFile
|
||||
* Provided X11 client example
|
||||
* Disabled DSA support at build time by default (will be removed in the next
|
||||
release)
|
||||
* Deprecated the SCP API!
|
||||
* Deprecated old pubkey, privatekey API
|
||||
* Avoided some needless large stack buffers to minimize memory footprint
|
||||
* Removed support for OpenSSL < 1.0.1
|
||||
* Fixed parsing username@host in login name
|
||||
* Free global init mutex in the destructor on Windows
|
||||
* Fixed PEM parsing in mbedtls to support both legacy and new PKCS8 formats
|
||||
|
||||
version 0.9.6 (released 2021-08-26)
|
||||
* CVE-2021-3634: Fix possible heap-buffer overflow when rekeying with
|
||||
different key exchange mechanism
|
||||
* Fix several memory leaks on error paths
|
||||
* Reset pending_call_state on disconnect
|
||||
* Fix handshake bug with AEAD ciphers and no HMAC overlap
|
||||
* Use OPENSSL_CRYPTO_LIBRARIES in CMake
|
||||
* Ignore request success and failure message if they are not expected
|
||||
* Support more identity files in configuration
|
||||
* Avoid setting compiler flags directly in CMake
|
||||
* Support build directories with special characters
|
||||
* Include stdlib.h to avoid crash in Windows
|
||||
* Fix sftp_new_channel constructs an invalid object
|
||||
* Fix Ninja multiple rules error
|
||||
* Several tests fixes
|
||||
|
||||
version 0.9.5 (released 2020-09-10)
|
||||
* CVE-2020-16135: Avoid null pointer dereference in sftpserver (T232)
|
||||
* Improve handling of library initialization (T222)
|
||||
* Fix parsing of subsecond times in SFTP (T219)
|
||||
* Make the documentation reproducible
|
||||
* Remove deprecated API usage in OpenSSL
|
||||
* Fix regression of ssh_channel_poll_timeout() returning SSH_AGAIN
|
||||
* Define version in one place (T226)
|
||||
* Prevent invalid free when using different C runtimes than OpenSSL (T229)
|
||||
* Compatibility improvements to testsuite
|
||||
|
||||
version 0.9.4 (released 2020-04-09)
|
||||
* Fixed CVE-2020-1730 - Possible DoS in client and server when handling
|
||||
AES-CTR keys with OpenSSL
|
||||
* Added diffie-hellman-group14-sha256
|
||||
* Fixed serveral possible memory leaks
|
||||
|
||||
version 0.9.3 (released 2019-12-10)
|
||||
* Fixed CVE-2019-14889 - SCP: Unsanitized location leads to command execution
|
||||
* SSH-01-003 Client: Missing NULL check leads to crash in erroneous state
|
||||
* SSH-01-006 General: Various unchecked Null-derefs cause DOS
|
||||
* SSH-01-007 PKI Gcrypt: Potential UAF/double free with RSA pubkeys
|
||||
* SSH-01-010 SSH: Deprecated hash function in fingerprinting
|
||||
* SSH-01-013 Conf-Parsing: Recursive wildcards in hostnames lead to DOS
|
||||
* SSH-01-014 Conf-Parsing: Integer underflow leads to OOB array access
|
||||
* SSH-01-001 State Machine: Initial machine states should be set explicitly
|
||||
* SSH-01-002 Kex: Differently bound macros used to iterate same array
|
||||
* SSH-01-005 Code-Quality: Integer sign confusion during assignments
|
||||
* SSH-01-008 SCP: Protocol Injection via unescaped File Names
|
||||
* SSH-01-009 SSH: Update documentation which RFCs are implemented
|
||||
* SSH-01-012 PKI: Information leak via uninitialized stack buffer
|
||||
|
||||
version 0.9.2 (released 2019-11-07)
|
||||
* Fixed libssh-config.cmake
|
||||
* Fixed issues with rsa algorithm negotiation (T191)
|
||||
* Fixed detection of OpenSSL ed25519 support (T197)
|
||||
|
||||
version 0.9.1 (released 2019-10-25)
|
||||
* Added support for Ed25519 via OpenSSL
|
||||
* Added support for X25519 via OpenSSL
|
||||
* Added support for localuser in Match keyword
|
||||
* Fixed Match keyword to be case sensitive
|
||||
* Fixed compilation with LibreSSL
|
||||
* Fixed error report of channel open (T75)
|
||||
* Fixed sftp documentation (T137)
|
||||
* Fixed known_hosts parsing (T156)
|
||||
* Fixed build issue with MinGW (T157)
|
||||
* Fixed build with gcc 9 (T164)
|
||||
* Fixed deprecation issues (T165)
|
||||
* Fixed known_hosts directory creation (T166)
|
||||
|
||||
version 0.9.0 (released 2019-02-xx)
|
||||
* Added support for AES-GCM
|
||||
* Added improved rekeying support
|
||||
* Added performance improvements
|
||||
* Disabled blowfish support by default
|
||||
* Fixed several ssh config parsing issues
|
||||
* Added support for DH Group Exchange KEX
|
||||
* Added support for Encrypt-then-MAC mode
|
||||
* Added support for parsing server side configuration file
|
||||
* Added support for ECDSA/Ed25519 certificates
|
||||
* Added FIPS 140-2 compatibility
|
||||
* Improved known_hosts parsing
|
||||
* Improved documentation
|
||||
* Improved OpenSSL API usage for KEX, DH, and signatures
|
||||
|
||||
version 0.8.0 (released 2018-08-10)
|
||||
* Removed support for deprecated SSHv1 protocol
|
||||
* Added new connector API for clients
|
||||
* Added new known_hosts parsing API
|
||||
* Added support for OpenSSL 1.1
|
||||
* Added support for chacha20-poly1305 cipher
|
||||
* Added crypto backend for mbedtls crypto library
|
||||
* Added ECDSA support with gcrypt backend
|
||||
* Added advanced client and server testing using cwrap.org
|
||||
* Added support for curve25519-sha256 alias
|
||||
* Added support for global known_hosts file
|
||||
* Added support for symbol versioning
|
||||
* Improved ssh_config parsing
|
||||
* Improved threading support
|
||||
|
||||
version 0.7.5 (released 2017-04-13)
|
||||
* Fixed a memory allocation issue with buffers
|
||||
* Fixed PKI on Windows
|
||||
* Fixed some SSHv1 functions
|
||||
* Fixed config hostname expansion
|
||||
|
||||
version 0.7.4 (released 2017-02-03)
|
||||
* Added id_ed25519 to the default identity list
|
||||
* Fixed sftp EOF packet handling
|
||||
* Fixed ssh_send_banner() to confirm with RFC 4253
|
||||
* Fixed some memory leaks
|
||||
|
||||
version 0.7.3 (released 2016-01-23)
|
||||
* Fixed CVE-2016-0739
|
||||
* Fixed ssh-agent on big endian
|
||||
* Fixed some documentation issues
|
||||
|
||||
version 0.7.2 (released 2015-09-15)
|
||||
* Fixed OpenSSL detection on Windows
|
||||
* Fixed return status for ssh_userauth_agent()
|
||||
* Fixed KEX to prefer hmac-sha2-256
|
||||
* Fixed sftp packet handling
|
||||
* Fixed return values of ssh_key_is_(public|private)
|
||||
* Fixed bug in global success reply
|
||||
|
||||
version 0.7.1 (released 2015-06-30)
|
||||
* Fixed SSH_AUTH_PARTIAL auth with auto public key
|
||||
* Fixed memory leak in session options
|
||||
* Fixed allocation of ed25519 public keys
|
||||
* Fixed channel exit-status and exit-signal
|
||||
* Reintroduce ssh_forward_listen()
|
||||
|
||||
version 0.7.0 (released 2015-05-11)
|
||||
* Added support for ed25519 keys
|
||||
* Added SHA2 algorithms for HMAC
|
||||
* Added improved and more secure buffer handling code
|
||||
* Added callback for auth_none_function
|
||||
* Added support for ECDSA private key signing
|
||||
* Added more tests
|
||||
* Fixed a lot of bugs
|
||||
* Improved API documentation
|
||||
|
||||
version 0.6.5 (released 2015-04-29)
|
||||
* Fixed CVE-2015-3146
|
||||
* Fixed port handling in config file
|
||||
* Fixed the build with libgcrypt
|
||||
* Fixed SFTP endian issues (rlo #179)
|
||||
* Fixed uninitilized sig variable (rlo #167)
|
||||
* Fixed polling issues which could result in a hang
|
||||
* Fixed handling of EINTR in ssh_poll() (rlo #186)
|
||||
* Fixed C99 issues with __func__
|
||||
* Fixed some memory leaks
|
||||
* Improved macro detection on Windows
|
||||
|
||||
version 0.6.4 (released 2014-12-19)
|
||||
* Fixed CVE-2014-8132.
|
||||
* Added SHA-2 for session ID signing with ECDSA keys.
|
||||
* Added support for ECDSA host keys.
|
||||
* Added support for more ECDSA hostkey algorithms.
|
||||
* Added ssh_pki_key_ecdsa_name() API.
|
||||
* Fixed setting the bindfd only after successful listen.
|
||||
* Fixed issues with user created sockets.
|
||||
* Fixed several issues in libssh C++ wrapper.
|
||||
* Fixed several documentation issues.
|
||||
* Fixed channel exit-signal request.
|
||||
* Fixed X11 request screen number in messages.
|
||||
* Fixed several memory leaks.
|
||||
|
||||
version 0.6.3 (released 2014-03-04)
|
||||
* Fixed CVE-2014-0017.
|
||||
* Fixed memory leak with ecdsa signatures.
|
||||
|
||||
version 0.6.2 (released 2014-03-04)
|
||||
* security: fix for vulnerability CVE-2014-0017
|
||||
|
||||
version 0.6.1 (released 2014-02-08)
|
||||
* Added support for libgcrypt 1.6.
|
||||
* Added ssh_channel_accept_forward().
|
||||
* Added known_hosts heuristic during connection (#138).
|
||||
* Added getters for session cipher names.
|
||||
* Fixed decrypt of zero length buffer.
|
||||
* Fixed padding in RSA signature blobs.
|
||||
* Fixed DSA signature extraction.
|
||||
* Fixed some memory leaks.
|
||||
* Fixed read of non-connected socket.
|
||||
* Fixed thread dectection.
|
||||
|
||||
version 0.6.0 (released 2014-01-08)
|
||||
* Added new publicy key API.
|
||||
* Added new userauth API.
|
||||
* Added ssh_get_publickey_hash() function.
|
||||
* Added ssh_get_poll_flags() function.
|
||||
* Added gssapi-mic userauth.
|
||||
* Added GSSAPIServerIdentity option.
|
||||
* Added GSSAPIClientIdentity option.
|
||||
* Added GSSAPIDelegateCredentials option.
|
||||
* Added new callback based server API.
|
||||
* Added Elliptic Curve DSA (ECDSA) support (with OpenSSL).
|
||||
* Added Elliptic Curve Diffie Hellman (ECDH) support.
|
||||
* Added Curve25519 for ECDH key exchange.
|
||||
* Added improved logging system.
|
||||
* Added SSH-agent forwarding.
|
||||
* Added key-reexchange.
|
||||
* Added more unit tests.
|
||||
* Improved documentation.
|
||||
* Fixed timeout handling.
|
||||
|
||||
version 0.5.5 (released 2013-07-26)
|
||||
* BUG 103: Fix ProxyCommand parsing.
|
||||
* Fix setting -D_FORTIFY_SOURCE=2.
|
||||
* Fix pollset error return if emtpy.
|
||||
* Fix NULL pointer checks in channel functions.
|
||||
* Several bugfixes.
|
||||
|
||||
version 0.5.4 (released 2013-01-22)
|
||||
* CVE-2013-0176 - NULL dereference leads to denial of service
|
||||
* Fixed several NULL pointer dereferences in SSHv1.
|
||||
* Fixed a free crash bug in options parsing.
|
||||
|
||||
version 0.5.3 (released 2012-11-20)
|
||||
* CVE-2012-4559 Fixed multiple double free() flaws.
|
||||
* CVE-2012-4560 Fixed multiple buffer overflow flaws.
|
||||
* CVE-2012-4561 Fixed multiple invalid free() flaws.
|
||||
* BUG #84 - Fix bug in sftp_mkdir not returning on error.
|
||||
* BUG #85 - Fixed a possible channel infinite loop if the connection dropped.
|
||||
* BUG #88 - Added missing channel request_state and set it to accepted.
|
||||
* BUG #89 - Reset error state to no error on successful SSHv1 authentiction.
|
||||
* Fixed a possible use after free in ssh_free().
|
||||
* Fixed multiple possible NULL pointer dereferences.
|
||||
* Fixed multiple memory leaks in error paths.
|
||||
* Fixed timeout handling.
|
||||
* Fixed regression in pre-connected socket setting.
|
||||
* Handle all unknown global messages.
|
||||
|
||||
version 0.5.2 (released 2011-09-17)
|
||||
* Increased window size x10.
|
||||
* Fixed SSHv1.
|
||||
* Fixed bugged lists.
|
||||
* Fixed use-after-free + inconsistent callbacks call in poll.
|
||||
* Fixed scp documentation.
|
||||
* Fixed possible infinite loop in channel_read().
|
||||
* Fixed handling of short reads of sftp_async_read().
|
||||
* Fixed handling request service timeout in blocking mode.
|
||||
* Fixed ssh_auth_list() documentation.
|
||||
* Fixed incorrect return values in ssh_channel_write().
|
||||
* Fixed an infinite loop in the termination callback.
|
||||
* Fixed handling of SSH_AGAIN in channel_open().
|
||||
* Fixed "status -5 inflating zlib packet"
|
||||
|
||||
version 0.5.1 (released 2011-08-09)
|
||||
* Added checks for NULL pointers in string.c.
|
||||
* Set the channel max packet size to 32768.
|
||||
* Don't (de)compress empty buffers.
|
||||
* Fixed ssh_scp_write so it works when doing recursive copy.
|
||||
* Fixed another source of endless wait.
|
||||
* Fixed an endless loop in case of a channel_open error.
|
||||
* Fixed session timeout handling.
|
||||
* Fixed ssh_channel_from_local() loop.
|
||||
* Fixed permissions of scp example when we copy a file.
|
||||
* Workaround ssh_get_user_home_dir on LDAP users.
|
||||
* Added pkg-config support for libssh_threads.
|
||||
* Fixed compilation without server and sftp modes.
|
||||
* Fix static .lib overwriting on Windows.
|
||||
|
||||
version 0.5.0 (released 2011-06-01)
|
||||
* Added ssh_ prefix to all functions.
|
||||
* Added complete Windows support.
|
||||
* Added improved server support.
|
||||
* Added unit tests for a lot of functions.
|
||||
* Added asynchronous service request.
|
||||
* Added a multiplatform ssh_getpass() function.
|
||||
* Added a tutorial.
|
||||
* Added a lot of documentation.
|
||||
* Fixed a lot of bugs.
|
||||
* Fixed several memory leaks.
|
||||
|
||||
version 0.4.8 (released 2011-01-15)
|
||||
* Fixed memory leaks in session signing.
|
||||
* Fixed memory leak in ssh_print_hexa.
|
||||
* Fixed problem with ssh_connect w/ timeout and fd > 1024.
|
||||
* Fixed some warnings on OS/2.
|
||||
* Fixed installation path for OS/2.
|
||||
|
||||
version 0.4.7 (released 2010-12-28)
|
||||
* Fixed a possible memory leak in ssh_get_user_home().
|
||||
* Fixed a memory leak in sftp_xstat.
|
||||
* Fixed uninitialized fd->revents member.
|
||||
* Fixed timout value in ssh_channel_accept().
|
||||
* Fixed length checks in ssh_analyze_banner().
|
||||
* Fixed a possible data overread and crash bug.
|
||||
* Fixed setting max_fd which breaks ssh_select().
|
||||
* Fixed some pedantic build warnings.
|
||||
* Fixed a memory leak with session->bindaddr.
|
||||
|
||||
version 0.4.6 (released 2010-09-03)
|
||||
* Added a cleanup function to free the ws2_32 library.
|
||||
* Fixed build with gcc 3.4.
|
||||
* Fixed the Windows build on Vista and newer.
|
||||
* Fixed the usage of WSAPoll() on Windows.
|
||||
* Fixed "@deprecated" in doxygen
|
||||
* Fixed some mingw warnings.
|
||||
* Fixed handling of opened channels.
|
||||
* Fixed keepalive problem on older openssh servers.
|
||||
* Fixed testing for big endian on Windows.
|
||||
* Fixed the Windows preprocessor macros and defines.
|
||||
|
||||
version 0.4.5 (released 2010-07-13)
|
||||
* Added option to bind a client to an ip address.
|
||||
* Fixed the ssh socket polling function.
|
||||
* Fixed Windows related bugs in bsd_poll().
|
||||
* Fixed serveral build warnings.
|
||||
|
||||
version 0.4.4 (released 2010-06-01)
|
||||
* Fixed a bug in the expand function for escape sequences.
|
||||
* Fixed a bug in the tilde expand function.
|
||||
* Fixed a bug in setting the options.
|
||||
|
||||
version 0.4.3 (released 2010-05-18)
|
||||
* Added global/keepalive responses.
|
||||
* Added runtime detection of WSAPoll().
|
||||
* Added a select(2) based poll-emulation if poll(2) is not available.
|
||||
* Added a function to expand an escaped string.
|
||||
* Added a function to expand the tilde from a path.
|
||||
* Added a proxycommand support.
|
||||
* Added ssh_privatekey_type public function
|
||||
* Added the possibility to define _OPENSSL_DIR and _ZLIB_DIR.
|
||||
* Fixed sftp_chown.
|
||||
* Fixed sftp_rename on protocol version 3.
|
||||
* Fixed a blocking bug in channel_poll.
|
||||
* Fixed config parsing wich has overwritten user specified values.
|
||||
* Fixed hashed [host]:port format in knownhosts
|
||||
* Fixed Windows build.
|
||||
* Fixed doublefree happening after a negociation error.
|
||||
* Fixed aes*-ctr with <= OpenSSL 0.9.7b.
|
||||
* Fixed some documentation.
|
||||
* Fixed exec example which has broken read usage.
|
||||
* Fixed broken algorithm choice for server.
|
||||
* Fixed a typo that we don't export all symbols.
|
||||
* Removed the unneeded dependency to doxygen.
|
||||
* Build examples only on the Linux plattform.
|
||||
|
||||
version 0.4.2 (released 2010-03-15)
|
||||
* Added owner and group information in sftp attributes.
|
||||
* Added missing SSH_OPTIONS_FD option.
|
||||
* Added printout of owner and group in the sftp example.
|
||||
* Added a prepend function for ssh_list.
|
||||
* Added send back replies to openssh's keepalives.
|
||||
* Fixed documentation in scp code
|
||||
* Fixed longname parsing, this only workings with readdir.
|
||||
* Fixed and added support for several identity files.
|
||||
* Fixed sftp_parse_longname() on Windows.
|
||||
* Fixed a race condition bug in ssh_scp_close()
|
||||
* Remove config support for SSHv1 Cipher variable.
|
||||
* Rename ssh_list_add to ssh_list_append.
|
||||
* Rename ssh_list_get_head to ssh_list_pop_head
|
||||
|
||||
version 0.4.1 (released 2010-02-13)
|
||||
* Added support for aes128-ctr, aes192-ctr and aes256-ctr encryption.
|
||||
* Added an example for exec.
|
||||
* Added private key type detection feature in privatekey_from_file().
|
||||
* Fixed zlib compression fallback.
|
||||
* Fixed kex bug that client preference should be prioritary
|
||||
* Fixed known_hosts file set by the user.
|
||||
* Fixed a memleak in channel_accept().
|
||||
* Fixed underflow when leave_function() are unbalanced
|
||||
* Fixed memory corruption in handle_channel_request_open().
|
||||
* Fixed closing of a file handle case of errors in privatekey_from_file().
|
||||
* Fixed ssh_get_user_home_dir() to be thread safe.
|
||||
* Fixed the doxygen documentation.
|
||||
|
||||
version 0.4.0 (released 2009-12-10)
|
||||
* Added scp support.
|
||||
* Added support for sending signals (RFC 4254, section 6.9).
|
||||
* Added MSVC support.
|
||||
* Added support for ~/.ssh/config.
|
||||
* Added sftp extension support.
|
||||
* Added X11 forwarding support for client.
|
||||
* Added forward listening.
|
||||
* Added support for openssh extensions (statvfs, fstatvfs).
|
||||
* Added a cleaned up interface for setting options.
|
||||
* Added a generic way to handle sockets asynchronously.
|
||||
* Added logging of the sftp flags used to open a file.
|
||||
* Added full poll() support and poll-emulation for win32.
|
||||
* Added missing 64bit functions in sftp.
|
||||
* Added support for ~/ and SSH_DIR/ in filenames instead of %s/.
|
||||
* Fixed Fix channel_get_exit_status bug.
|
||||
* Fixed calltrace logging to make it optional.
|
||||
* Fixed compilation on Solaris.
|
||||
* Fixed resolving of ip addresses.
|
||||
* Fixed libssh compilation without server support.
|
||||
* Fixed possible memory corruptions (ticket #14).
|
||||
|
||||
version 0.3.4 (released 2009-09-14)
|
||||
* Added ssh_basename and ssh_dirname.
|
||||
* Added a portable ssh_mkdir function.
|
||||
* Added a sftp_tell64() function.
|
||||
* Added missing NULL pointer checks to crypt_set_algorithms_server.
|
||||
* Fixed ssh_write_knownhost if ~/.ssh doesn't exist.
|
||||
* Fixed a possible integer overflow in buffer_get_data().
|
||||
* Fixed possible security bug in packet_decrypt().
|
||||
* Fixed a possible stack overflow in agent code.
|
||||
|
||||
version 0.3.3 (released 2009-08-18)
|
||||
* Fixed double free pointer crash in dsa_public_to_string.
|
||||
* Fixed channel_get_exit_status bug.
|
||||
* Fixed ssh_finalize which didn't clear the flag.
|
||||
* Fixed memory leak introduced by previous bugfix.
|
||||
* Fixed channel_poll broken when delayed EOF recvd.
|
||||
* Fixed stupid "can't parse known host key" bug.
|
||||
* Fixed possible memory corruption (ticket #14).
|
||||
|
||||
version 0.3.2 (released 2009-08-05)
|
||||
* Added ssh_init() function.
|
||||
* Added sftp_readlink() function.
|
||||
* Added sftp_symlink() function.
|
||||
* Fixed ssh_write_knownhost().
|
||||
* Fixed compilation on Solaris.
|
||||
* Fixed SSHv1 compilation.
|
||||
|
||||
version 0.3.1 (released 2009-07-14)
|
||||
* Added return code SSH_SERVER_FILE_NOT_FOUND.
|
||||
* Fixed compilation of SSHv1.
|
||||
* Fixed several memory leaks.
|
||||
* Fixed possible infinite loops.
|
||||
* Fixed a possible crash bug.
|
||||
* Fixed build warnings.
|
||||
* Fixed cmake on BSD.
|
||||
|
||||
version 0.3 (released 2009-05-21)
|
||||
* Added support for ssh-agent authentication.
|
||||
* Added POSIX like sftp implementation.
|
||||
* Added error checking to all functions.
|
||||
* Added const to arguments where it was needed.
|
||||
* Added a channel_get_exit_status() function.
|
||||
* Added a channel_read_buffer() function, channel_read() is now
|
||||
a POSIX like function.
|
||||
* Added a more generic auth callback function.
|
||||
* Added printf attribute checking for log and error functions.
|
||||
* Added runtime function tracer support.
|
||||
* Added NSIS build support with CPack.
|
||||
* Added openssh hashed host support.
|
||||
* Added API documentation for all public functions.
|
||||
* Added asynchronous SFTP read function.
|
||||
* Added a ssh_bind_set_fd() function.
|
||||
* Fixed known_hosts parsing.
|
||||
* Fixed a lot of build warnings.
|
||||
* Fixed the Windows build.
|
||||
* Fixed a lot of memory leaks.
|
||||
* Fixed a double free corruption in the server support.
|
||||
* Fixed the "ssh_accept:" bug in server support.
|
||||
* Fixed important channel bugs.
|
||||
* Refactored the socket handling.
|
||||
* Switched to CMake build system.
|
||||
* Improved performance.
|
||||
|
||||
version 0.2 (released 2007-11-29)
|
||||
* General cleanup
|
||||
* More comprehensive API
|
||||
* Up-to-date Doxygen documentation of each public function
|
||||
* Basic server-based support
|
||||
* Libgcrypt support (alternative to openssl and its license)
|
||||
* SSH1 support (disabled by default)
|
||||
* Added 3des-cbc
|
||||
* A lot of bugfixes
|
||||
|
||||
version 0.11-dev
|
||||
* Server implementation development.
|
||||
* Small bug corrected when connecting to sun ssh servers.
|
||||
* Channel weirdness corrected (writing huge data packets)
|
||||
* Channel_read_nonblocking added
|
||||
* Channel bug where stderr wasn't correctly read fixed.
|
||||
* Added sftp_file_set_nonblocking(), which is nonblocking SFTP IO
|
||||
* Connect_status callback.
|
||||
* Priv.h contains the internal functions, libssh.h the public interface
|
||||
* Options_set_timeout (thx marcelo) really working.
|
||||
* Tcp tunneling through channel_open_forward.
|
||||
* Channel_request_exec()
|
||||
* Channel_request_env()
|
||||
* Ssh_get_pubkey_hash()
|
||||
* Ssh_is_server_known()
|
||||
* Ssh_write_known_host()
|
||||
* Options_set_ssh_dir
|
||||
* How could this happen ! there weren't any channel_close !
|
||||
* Nasty channel_free bug resolved.
|
||||
* Removed the unsigned long all around the code. use only u8,u32 & u64.
|
||||
* It now compiles and runs under amd64 !
|
||||
* Channel_request_pty_size
|
||||
* Channel_change_pty_size
|
||||
* Options_copy()
|
||||
* Ported the doc to an HTML file.
|
||||
* Small bugfix in packet.c
|
||||
* Prefixed error constants with SSH_
|
||||
* Sftp_stat, sftp_lstat, sftp_fstat. thanks Michel Bardiaux for the patch.
|
||||
* Again channel number mismatch fixed.
|
||||
* Fixed a bug in ssh_select making the select fail when a signal has been
|
||||
caught.
|
||||
* Keyboard-interactive authentication working.
|
||||
|
||||
version 0.1 (released 2004-03-05)
|
||||
* Begining of sftp subsystem implementation.
|
||||
* Some cleanup into channels implementation
|
||||
* Now every channel functions is called by its CHANNEL handler.
|
||||
* Added channel_poll() and channel_read().
|
||||
* Changed the client so it uses the new channel_poll and channel_read interface
|
||||
* Small use-after-free bug with channels resolved
|
||||
* Changed stupidities in lot of function names.
|
||||
* Removed a debug output file opened by default.
|
||||
* Added API.txt, the libssh programmer handbook.
|
||||
* Various bug fixes from Nick Zitzmann.
|
||||
* Developed a cryptographic structure for handling protocols.
|
||||
* An autoconf script which took me half of a day to set up.
|
||||
* A ssh_select wrapper has been written.
|
||||
|
||||
version 0.0.4 (released 2003-10-10)
|
||||
* Some terminal code (eof handling) added
|
||||
* Channels bugfix (it still needs some tweaking though)
|
||||
* Zlib support
|
||||
* Added a wrapper.c file. The goal is to provide a similar API to every
|
||||
cryptographic functions. bignums and sha/md5 are wrapped now.
|
||||
* More work than it first looks.
|
||||
* Support for other crypto libs planed (lighter libs)
|
||||
* Fixed stupid select() bug.
|
||||
* Libssh now compiles and links with openssl 0.9.6
|
||||
* RSA pubkey authentication code now works !
|
||||
|
||||
version 0.0.3 (released 2003-09-15)
|
||||
* Added install target in makefile
|
||||
* Some cleanup in headers files and source code
|
||||
* Change default banner and project name to libssh.
|
||||
* New file auth.c to support more and more authentication ways
|
||||
* Bugfix(read offbyone) in send_kex
|
||||
* A base64 parser. don't read the source, it's awful. pure 0xbadc0de.
|
||||
* Changed the client filename to "ssh". logic isn't it ?
|
||||
* Dss publickey authentication ! still need to wait for the rsa one
|
||||
* Bugfix in packet.c
|
||||
* New misc.c contains misc functions
|
||||
|
||||
version 0.0.2 (released 2003-09-03)
|
||||
* Initial release.
|
||||
* Client supports both ssh and dss hostkey verification, but doesn't compare them to openssh's files. (~/.ssh/known_hosts)
|
||||
* The only supported authentication method is password.
|
||||
* Compiles on linux and openbsd. freebsd and netbsd should work, too
|
||||
* Lot of work which hasn't been discussed here.
|
||||
@@ -0,0 +1,44 @@
|
||||
_ _ _ _
|
||||
(_) (_) (_) (_)
|
||||
(_) _ (_) _ _ _ _ _ (_) _
|
||||
(_) (_) (_)(_) _ (_)(_) (_)(_) (_)(_) _
|
||||
(_) (_) (_) (_) _ (_) _ (_) (_) (_)
|
||||
(_) (_) (_)(_)(_) (_)(_) (_)(_) (_) (_).org
|
||||
|
||||
The SSH library
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
1* Why ?
|
||||
-_-_-_-_-_
|
||||
|
||||
Why not ? :) I've began to work on my own implementation of the ssh protocol
|
||||
because i didn't like the currently public ones.
|
||||
Not any allowed you to import and use the functions as a powerful library,
|
||||
and so i worked on a library-based SSH implementation which was non-existing
|
||||
in the free and open source software world.
|
||||
|
||||
|
||||
2* How/Who ?
|
||||
-_-_-_-_-_-_-_
|
||||
|
||||
If you downloaded this file, you must know what it is : a library for
|
||||
accessing ssh client services through C libraries calls in a simple manner.
|
||||
Everybody can use this software under the terms of the LGPL - see the COPYING
|
||||
file
|
||||
|
||||
If you ask yourself how to compile libssh, please read INSTALL before anything.
|
||||
|
||||
3* Where ?
|
||||
-_-_-_-_-_-_
|
||||
|
||||
https://www.libssh.org
|
||||
|
||||
4* Contributing
|
||||
-_-_-_-_-_-_-_-_-_
|
||||
|
||||
Please read the file 'CONTRIBUTING.md' next to this README file. It explains
|
||||
our copyright policy and how you should send patches for upstream inclusion.
|
||||
|
||||
Have fun and happy libssh hacking!
|
||||
|
||||
The libssh Team
|
||||
@@ -0,0 +1,22 @@
|
||||
COPYRIGHT AND PERMISSION NOTICE
|
||||
|
||||
Copyright (c) 1996 - 2021, Daniel Stenberg, <daniel@haxx.se>, and many
|
||||
contributors, see the THANKS file.
|
||||
|
||||
All rights reserved.
|
||||
|
||||
Permission to use, copy, modify, and distribute this software for any purpose
|
||||
with or without fee is hereby granted, provided that the above copyright
|
||||
notice and this permission notice appear in all copies.
|
||||
|
||||
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
|
||||
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
|
||||
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS. IN
|
||||
NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM,
|
||||
DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
|
||||
OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE
|
||||
OR OTHER DEALINGS IN THE SOFTWARE.
|
||||
|
||||
Except as contained in this notice, the name of a copyright holder shall not
|
||||
be used in advertising or otherwise to promote the sale, use or other dealings
|
||||
in this Software without prior written authorization of the copyright holder.
|
||||
@@ -0,0 +1,469 @@
|
||||
GNU LESSER GENERAL PUBLIC LICENSE
|
||||
Version 2.1, February 1999
|
||||
|
||||
Copyright (C) 1991, 1999 Free Software Foundation, Inc.
|
||||
59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
|
||||
Everyone is permitted to copy and distribute verbatim copies
|
||||
of this license document, but changing it is not allowed.
|
||||
|
||||
[This is the first released version of the Lesser GPL. It also counts
|
||||
as the successor of the GNU Library Public License, version 2, hence
|
||||
the version number 2.1.]
|
||||
|
||||
Preamble
|
||||
|
||||
The licenses for most software are designed to take away your
|
||||
freedom to share and change it. By contrast, the GNU General Public
|
||||
Licenses are intended to guarantee your freedom to share and change
|
||||
free software--to make sure the software is free for all its users.
|
||||
|
||||
This license, the Lesser General Public License, applies to some
|
||||
specially designated software packages--typically libraries--of the
|
||||
Free Software Foundation and other authors who decide to use it. You
|
||||
can use it too, but we suggest you first think carefully about whether
|
||||
this license or the ordinary General Public License is the better
|
||||
strategy to use in any particular case, based on the explanations below.
|
||||
|
||||
When we speak of free software, we are referring to freedom of use,
|
||||
not price. Our General Public Licenses are designed to make sure that
|
||||
you have the freedom to distribute copies of free software (and charge
|
||||
for this service if you wish); that you receive source code or can get
|
||||
it if you want it; that you can change the software and use pieces of
|
||||
it in new free programs; and that you are informed that you can do
|
||||
these things.
|
||||
|
||||
To protect your rights, we need to make restrictions that forbid
|
||||
distributors to deny you these rights or to ask you to surrender these
|
||||
rights. These restrictions translate to certain responsibilities for
|
||||
you if you distribute copies of the library or if you modify it.
|
||||
|
||||
For example, if you distribute copies of the library, whether gratis
|
||||
or for a fee, you must give the recipients all the rights that we gave
|
||||
you. You must make sure that they, too, receive or can get the source
|
||||
code. If you link other code with the library, you must provide
|
||||
complete object files to the recipients, so that they can relink them
|
||||
with the library after making changes to the library and recompiling
|
||||
it. And you must show them these terms so they know their rights.
|
||||
|
||||
We protect your rights with a two-step method: (1) we copyright the
|
||||
library, and (2) we offer you this license, which gives you legal
|
||||
permission to copy, distribute and/or modify the library.
|
||||
|
||||
To protect each distributor, we want to make it very clear that
|
||||
there is no warranty for the free library. Also, if the library is
|
||||
modified by someone else and passed on, the recipients should know
|
||||
that what they have is not the original version, so that the original
|
||||
author's reputation will not be affected by problems that might be
|
||||
introduced by others.
|
||||
|
||||
Finally, software patents pose a constant threat to the existence of
|
||||
any free program. We wish to make sure that a company cannot
|
||||
effectively restrict the users of a free program by obtaining a
|
||||
restrictive license from a patent holder. Therefore, we insist that
|
||||
any patent license obtained for a version of the library must be
|
||||
consistent with the full freedom of use specified in this license.
|
||||
|
||||
Most GNU software, including some libraries, is covered by the
|
||||
ordinary GNU General Public License. This license, the GNU Lesser
|
||||
General Public License, applies to certain designated libraries, and
|
||||
is quite different from the ordinary General Public License. We use
|
||||
this license for certain libraries in order to permit linking those
|
||||
libraries into non-free programs.
|
||||
|
||||
When a program is linked with a library, whether statically or using
|
||||
a shared library, the combination of the two is legally speaking a
|
||||
combined work, a derivative of the original library. The ordinary
|
||||
General Public License therefore permits such linking only if the
|
||||
entire combination fits its criteria of freedom. The Lesser General
|
||||
Public License permits more lax criteria for linking other code with
|
||||
the library.
|
||||
|
||||
We call this license the "Lesser" General Public License because it
|
||||
does Less to protect the user's freedom than the ordinary General
|
||||
Public License. It also provides other free software developers Less
|
||||
of an advantage over competing non-free programs. These disadvantages
|
||||
are the reason we use the ordinary General Public License for many
|
||||
libraries. However, the Lesser license provides advantages in certain
|
||||
special circumstances.
|
||||
|
||||
For example, on rare occasions, there may be a special need to
|
||||
encourage the widest possible use of a certain library, so that it becomes
|
||||
a de-facto standard. To achieve this, non-free programs must be
|
||||
allowed to use the library. A more frequent case is that a free
|
||||
library does the same job as widely used non-free libraries. In this
|
||||
case, there is little to gain by limiting the free library to free
|
||||
software only, so we use the Lesser General Public License.
|
||||
|
||||
In other cases, permission to use a particular library in non-free
|
||||
programs enables a greater number of people to use a large body of
|
||||
free software. For example, permission to use the GNU C Library in
|
||||
non-free programs enables many more people to use the whole GNU
|
||||
operating system, as well as its variant, the GNU/Linux operating
|
||||
system.
|
||||
|
||||
Although the Lesser General Public License is Less protective of the
|
||||
users' freedom, it does ensure that the user of a program that is
|
||||
linked with the Library has the freedom and the wherewithal to run
|
||||
that program using a modified version of the Library.
|
||||
|
||||
The precise terms and conditions for copying, distribution and
|
||||
modification follow. Pay close attention to the difference between a
|
||||
"work based on the library" and a "work that uses the library". The
|
||||
former contains code derived from the library, whereas the latter must
|
||||
be combined with the library in order to run.
|
||||
|
||||
GNU LESSER GENERAL PUBLIC LICENSE
|
||||
TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION
|
||||
|
||||
0. This License Agreement applies to any software library or other
|
||||
program which contains a notice placed by the copyright holder or
|
||||
other authorized party saying it may be distributed under the terms of
|
||||
this Lesser General Public License (also called "this License").
|
||||
Each licensee is addressed as "you".
|
||||
|
||||
A "library" means a collection of software functions and/or data
|
||||
prepared so as to be conveniently linked with application programs
|
||||
(which use some of those functions and data) to form executables.
|
||||
|
||||
The "Library", below, refers to any such software library or work
|
||||
which has been distributed under these terms. A "work based on the
|
||||
Library" means either the Library or any derivative work under
|
||||
copyright law: that is to say, a work containing the Library or a
|
||||
portion of it, either verbatim or with modifications and/or translated
|
||||
straightforwardly into another language. (Hereinafter, translation is
|
||||
included without limitation in the term "modification".)
|
||||
|
||||
"Source code" for a work means the preferred form of the work for
|
||||
making modifications to it. For a library, complete source code means
|
||||
all the source code for all modules it contains, plus any associated
|
||||
interface definition files, plus the scripts used to control compilation
|
||||
and installation of the library.
|
||||
|
||||
Activities other than copying, distribution and modification are not
|
||||
covered by this License; they are outside its scope. The act of
|
||||
running a program using the Library is not restricted, and output from
|
||||
such a program is covered only if its contents constitute a work based
|
||||
on the Library (independent of the use of the Library in a tool for
|
||||
writing it). Whether that is true depends on what the Library does
|
||||
and what the program that uses the Library does.
|
||||
|
||||
1. You may copy and distribute verbatim copies of the Library's
|
||||
complete source code as you receive it, in any medium, provided that
|
||||
you conspicuously and appropriately publish on each copy an
|
||||
appropriate copyright notice and disclaimer of warranty; keep intact
|
||||
all the notices that refer to this License and to the absence of any
|
||||
warranty; and distribute a copy of this License along with the
|
||||
Library.
|
||||
|
||||
You may charge a fee for the physical act of transferring a copy,
|
||||
and you may at your option offer warranty protection in exchange for a
|
||||
fee.
|
||||
|
||||
2. You may modify your copy or copies of the Library or any portion
|
||||
of it, thus forming a work based on the Library, and copy and
|
||||
distribute such modifications or work under the terms of Section 1
|
||||
above, provided that you also meet all of these conditions:
|
||||
|
||||
a) The modified work must itself be a software library.
|
||||
|
||||
b) You must cause the files modified to carry prominent notices
|
||||
stating that you changed the files and the date of any change.
|
||||
|
||||
c) You must cause the whole of the work to be licensed at no
|
||||
charge to all third parties under the terms of this License.
|
||||
|
||||
d) If a facility in the modified Library refers to a function or a
|
||||
table of data to be supplied by an application program that uses
|
||||
the facility, other than as an argument passed when the facility
|
||||
is invoked, then you must make a good faith effort to ensure that,
|
||||
in the event an application does not supply such function or
|
||||
table, the facility still operates, and performs whatever part of
|
||||
its purpose remains meaningful.
|
||||
|
||||
(For example, a function in a library to compute square roots has
|
||||
a purpose that is entirely well-defined independent of the
|
||||
application. Therefore, Subsection 2d requires that any
|
||||
application-supplied function or table used by this function must
|
||||
be optional: if the application does not supply it, the square
|
||||
root function must still compute square roots.)
|
||||
|
||||
These requirements apply to the modified work as a whole. If
|
||||
identifiable sections of that work are not derived from the Library,
|
||||
and can be reasonably considered independent and separate works in
|
||||
themselves, then this License, and its terms, do not apply to those
|
||||
sections when you distribute them as separate works. But when you
|
||||
distribute the same sections as part of a whole which is a work based
|
||||
on the Library, the distribution of the whole must be on the terms of
|
||||
this License, whose permissions for other licensees extend to the
|
||||
entire whole, and thus to each and every part regardless of who wrote
|
||||
it.
|
||||
|
||||
Thus, it is not the intent of this section to claim rights or contest
|
||||
your rights to work written entirely by you; rather, the intent is to
|
||||
exercise the right to control the distribution of derivative or
|
||||
collective works based on the Library.
|
||||
|
||||
In addition, mere aggregation of another work not based on the Library
|
||||
with the Library (or with a work based on the Library) on a volume of
|
||||
a storage or distribution medium does not bring the other work under
|
||||
the scope of this License.
|
||||
|
||||
3. You may opt to apply the terms of the ordinary GNU General Public
|
||||
License instead of this License to a given copy of the Library. To do
|
||||
this, you must alter all the notices that refer to this License, so
|
||||
that they refer to the ordinary GNU General Public License, version 2,
|
||||
instead of to this License. (If a newer version than version 2 of the
|
||||
ordinary GNU General Public License has appeared, then you can specify
|
||||
that version instead if you wish.) Do not make any other change in
|
||||
these notices.
|
||||
|
||||
Once this change is made in a given copy, it is irreversible for
|
||||
that copy, so the ordinary GNU General Public License applies to all
|
||||
subsequent copies and derivative works made from that copy.
|
||||
|
||||
This option is useful when you wish to copy part of the code of
|
||||
the Library into a program that is not a library.
|
||||
|
||||
4. You may copy and distribute the Library (or a portion or
|
||||
derivative of it, under Section 2) in object code or executable form
|
||||
under the terms of Sections 1 and 2 above provided that you accompany
|
||||
it with the complete corresponding machine-readable source code, which
|
||||
must be distributed under the terms of Sections 1 and 2 above on a
|
||||
medium customarily used for software interchange.
|
||||
|
||||
If distribution of object code is made by offering access to copy
|
||||
from a designated place, then offering equivalent access to copy the
|
||||
source code from the same place satisfies the requirement to
|
||||
distribute the source code, even though third parties are not
|
||||
compelled to copy the source along with the object code.
|
||||
|
||||
5. A program that contains no derivative of any portion of the
|
||||
Library, but is designed to work with the Library by being compiled or
|
||||
linked with it, is called a "work that uses the Library". Such a
|
||||
work, in isolation, is not a derivative work of the Library, and
|
||||
therefore falls outside the scope of this License.
|
||||
|
||||
However, linking a "work that uses the Library" with the Library
|
||||
creates an executable that is a derivative of the Library (because it
|
||||
contains portions of the Library), rather than a "work that uses the
|
||||
library". The executable is therefore covered by this License.
|
||||
Section 6 states terms for distribution of such executables.
|
||||
|
||||
When a "work that uses the Library" uses material from a header file
|
||||
that is part of the Library, the object code for the work may be a
|
||||
derivative work of the Library even though the source code is not.
|
||||
Whether this is true is especially significant if the work can be
|
||||
linked without the Library, or if the work is itself a library. The
|
||||
threshold for this to be true is not precisely defined by law.
|
||||
|
||||
If such an object file uses only numerical parameters, data
|
||||
structure layouts and accessors, and small macros and small inline
|
||||
functions (ten lines or less in length), then the use of the object
|
||||
file is unrestricted, regardless of whether it is legally a derivative
|
||||
work. (Executables containing this object code plus portions of the
|
||||
Library will still fall under Section 6.)
|
||||
|
||||
Otherwise, if the work is a derivative of the Library, you may
|
||||
distribute the object code for the work under the terms of Section 6.
|
||||
Any executables containing that work also fall under Section 6,
|
||||
whether or not they are linked directly with the Library itself.
|
||||
|
||||
6. As an exception to the Sections above, you may also combine or
|
||||
link a "work that uses the Library" with the Library to produce a
|
||||
work containing portions of the Library, and distribute that work
|
||||
under terms of your choice, provided that the terms permit
|
||||
modification of the work for the customer's own use and reverse
|
||||
engineering for debugging such modifications.
|
||||
|
||||
You must give prominent notice with each copy of the work that the
|
||||
Library is used in it and that the Library and its use are covered by
|
||||
this License. You must supply a copy of this License. If the work
|
||||
during execution displays copyright notices, you must include the
|
||||
copyright notice for the Library among them, as well as a reference
|
||||
directing the user to the copy of this License. Also, you must do one
|
||||
of these things:
|
||||
|
||||
a) Accompany the work with the complete corresponding
|
||||
machine-readable source code for the Library including whatever
|
||||
changes were used in the work (which must be distributed under
|
||||
Sections 1 and 2 above); and, if the work is an executable linked
|
||||
with the Library, with the complete machine-readable "work that
|
||||
uses the Library", as object code and/or source code, so that the
|
||||
user can modify the Library and then relink to produce a modified
|
||||
executable containing the modified Library. (It is understood
|
||||
that the user who changes the contents of definitions files in the
|
||||
Library will not necessarily be able to recompile the application
|
||||
to use the modified definitions.)
|
||||
|
||||
b) Use a suitable shared library mechanism for linking with the
|
||||
Library. A suitable mechanism is one that (1) uses at run time a
|
||||
copy of the library already present on the user's computer system,
|
||||
rather than copying library functions into the executable, and (2)
|
||||
will operate properly with a modified version of the library, if
|
||||
the user installs one, as long as the modified version is
|
||||
interface-compatible with the version that the work was made with.
|
||||
|
||||
c) Accompany the work with a written offer, valid for at
|
||||
least three years, to give the same user the materials
|
||||
specified in Subsection 6a, above, for a charge no more
|
||||
than the cost of performing this distribution.
|
||||
|
||||
d) If distribution of the work is made by offering access to copy
|
||||
from a designated place, offer equivalent access to copy the above
|
||||
specified materials from the same place.
|
||||
|
||||
e) Verify that the user has already received a copy of these
|
||||
materials or that you have already sent this user a copy.
|
||||
|
||||
For an executable, the required form of the "work that uses the
|
||||
Library" must include any data and utility programs needed for
|
||||
reproducing the executable from it. However, as a special exception,
|
||||
the materials to be distributed need not include anything that is
|
||||
normally distributed (in either source or binary form) with the major
|
||||
components (compiler, kernel, and so on) of the operating system on
|
||||
which the executable runs, unless that component itself accompanies
|
||||
the executable.
|
||||
|
||||
It may happen that this requirement contradicts the license
|
||||
restrictions of other proprietary libraries that do not normally
|
||||
accompany the operating system. Such a contradiction means you cannot
|
||||
use both them and the Library together in an executable that you
|
||||
distribute.
|
||||
|
||||
7. You may place library facilities that are a work based on the
|
||||
Library side-by-side in a single library together with other library
|
||||
facilities not covered by this License, and distribute such a combined
|
||||
library, provided that the separate distribution of the work based on
|
||||
the Library and of the other library facilities is otherwise
|
||||
permitted, and provided that you do these two things:
|
||||
|
||||
a) Accompany the combined library with a copy of the same work
|
||||
based on the Library, uncombined with any other library
|
||||
facilities. This must be distributed under the terms of the
|
||||
Sections above.
|
||||
|
||||
b) Give prominent notice with the combined library of the fact
|
||||
that part of it is a work based on the Library, and explaining
|
||||
where to find the accompanying uncombined form of the same work.
|
||||
|
||||
8. You may not copy, modify, sublicense, link with, or distribute
|
||||
the Library except as expressly provided under this License. Any
|
||||
attempt otherwise to copy, modify, sublicense, link with, or
|
||||
distribute the Library is void, and will automatically terminate your
|
||||
rights under this License. However, parties who have received copies,
|
||||
or rights, from you under this License will not have their licenses
|
||||
terminated so long as such parties remain in full compliance.
|
||||
|
||||
9. You are not required to accept this License, since you have not
|
||||
signed it. However, nothing else grants you permission to modify or
|
||||
distribute the Library or its derivative works. These actions are
|
||||
prohibited by law if you do not accept this License. Therefore, by
|
||||
modifying or distributing the Library (or any work based on the
|
||||
Library), you indicate your acceptance of this License to do so, and
|
||||
all its terms and conditions for copying, distributing or modifying
|
||||
the Library or works based on it.
|
||||
|
||||
10. Each time you redistribute the Library (or any work based on the
|
||||
Library), the recipient automatically receives a license from the
|
||||
original licensor to copy, distribute, link with or modify the Library
|
||||
subject to these terms and conditions. You may not impose any further
|
||||
restrictions on the recipients' exercise of the rights granted herein.
|
||||
You are not responsible for enforcing compliance by third parties with
|
||||
this License.
|
||||
|
||||
11. If, as a consequence of a court judgment or allegation of patent
|
||||
infringement or for any other reason (not limited to patent issues),
|
||||
conditions are imposed on you (whether by court order, agreement or
|
||||
otherwise) that contradict the conditions of this License, they do not
|
||||
excuse you from the conditions of this License. If you cannot
|
||||
distribute so as to satisfy simultaneously your obligations under this
|
||||
License and any other pertinent obligations, then as a consequence you
|
||||
may not distribute the Library at all. For example, if a patent
|
||||
license would not permit royalty-free redistribution of the Library by
|
||||
all those who receive copies directly or indirectly through you, then
|
||||
the only way you could satisfy both it and this License would be to
|
||||
refrain entirely from distribution of the Library.
|
||||
|
||||
If any portion of this section is held invalid or unenforceable under any
|
||||
particular circumstance, the balance of the section is intended to apply,
|
||||
and the section as a whole is intended to apply in other circumstances.
|
||||
|
||||
It is not the purpose of this section to induce you to infringe any
|
||||
patents or other property right claims or to contest validity of any
|
||||
such claims; this section has the sole purpose of protecting the
|
||||
integrity of the free software distribution system which is
|
||||
implemented by public license practices. Many people have made
|
||||
generous contributions to the wide range of software distributed
|
||||
through that system in reliance on consistent application of that
|
||||
system; it is up to the author/donor to decide if he or she is willing
|
||||
to distribute software through any other system and a licensee cannot
|
||||
impose that choice.
|
||||
|
||||
This section is intended to make thoroughly clear what is believed to
|
||||
be a consequence of the rest of this License.
|
||||
|
||||
12. If the distribution and/or use of the Library is restricted in
|
||||
certain countries either by patents or by copyrighted interfaces, the
|
||||
original copyright holder who places the Library under this License may add
|
||||
an explicit geographical distribution limitation excluding those countries,
|
||||
so that distribution is permitted only in or among countries not thus
|
||||
excluded. In such case, this License incorporates the limitation as if
|
||||
written in the body of this License.
|
||||
|
||||
13. The Free Software Foundation may publish revised and/or new
|
||||
versions of the Lesser General Public License from time to time.
|
||||
Such new versions will be similar in spirit to the present version,
|
||||
but may differ in detail to address new problems or concerns.
|
||||
|
||||
Each version is given a distinguishing version number. If the Library
|
||||
specifies a version number of this License which applies to it and
|
||||
"any later version", you have the option of following the terms and
|
||||
conditions either of that version or of any later version published by
|
||||
the Free Software Foundation. If the Library does not specify a
|
||||
license version number, you may choose any version ever published by
|
||||
the Free Software Foundation.
|
||||
|
||||
14. If you wish to incorporate parts of the Library into other free
|
||||
programs whose distribution conditions are incompatible with these,
|
||||
write to the author to ask for permission. For software which is
|
||||
copyrighted by the Free Software Foundation, write to the Free
|
||||
Software Foundation; we sometimes make exceptions for this. Our
|
||||
decision will be guided by the two goals of preserving the free status
|
||||
of all derivatives of our free software and of promoting the sharing
|
||||
and reuse of software generally.
|
||||
|
||||
NO WARRANTY
|
||||
|
||||
15. BECAUSE THE LIBRARY IS LICENSED FREE OF CHARGE, THERE IS NO
|
||||
WARRANTY FOR THE LIBRARY, TO THE EXTENT PERMITTED BY APPLICABLE LAW.
|
||||
EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR
|
||||
OTHER PARTIES PROVIDE THE LIBRARY "AS IS" WITHOUT WARRANTY OF ANY
|
||||
KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE
|
||||
IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
|
||||
PURPOSE. THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE
|
||||
LIBRARY IS WITH YOU. SHOULD THE LIBRARY PROVE DEFECTIVE, YOU ASSUME
|
||||
THE COST OF ALL NECESSARY SERVICING, REPAIR OR CORRECTION.
|
||||
|
||||
16. IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN
|
||||
WRITING WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MAY MODIFY
|
||||
AND/OR REDISTRIBUTE THE LIBRARY AS PERMITTED ABOVE, BE LIABLE TO YOU
|
||||
FOR DAMAGES, INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR
|
||||
CONSEQUENTIAL DAMAGES ARISING OUT OF THE USE OR INABILITY TO USE THE
|
||||
LIBRARY (INCLUDING BUT NOT LIMITED TO LOSS OF DATA OR DATA BEING
|
||||
RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD PARTIES OR A
|
||||
FAILURE OF THE LIBRARY TO OPERATE WITH ANY OTHER SOFTWARE), EVEN IF
|
||||
SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH
|
||||
DAMAGES.
|
||||
|
||||
Linking with OpenSSL
|
||||
|
||||
17. In addition, as a special exception, we give permission to link the code
|
||||
of its release of libssh with the OpenSSL project's "OpenSSL" library (or with
|
||||
modified versions of it that use the same license as the "OpenSSL" library),
|
||||
and distribute the linked executables. You must obey the GNU Lesser General
|
||||
Public License in all respects for all of the code used other than "OpenSSL".
|
||||
If you modify this file, you may extend this exception to your version of the
|
||||
file, but you are not obligated to do so. If you do not wish to do so, delete
|
||||
this exception statement from your version.
|
||||
|
||||
END OF TERMS AND CONDITIONS
|
||||
Reference in New Issue
Block a user