libssh

Mentors: Student: Nikhil Venkatesan

The SSH client obtains its configuration either from command line arguments or from configuration files such as ~/.ssh/config and /etc/ssh/ssh_config. These files are parsed by the SSH client implementation (for example OpenSSH or clients built on top of libssh) and the parsed options are applied to the session configuration. Libssh follows a parsing architecture that slightly differs from OpenSSH. As a result, configuration files may be interpreted differently by the two implementations. Additionally, OpenSSH usually tends to be one-step ahead in introducing new configuration options, and libssh is having a hard time catching up with them. In such cases, libssh should ideally ignore unsupported options gracefully rather than misinterpreting them or causing unexpected behavior. Due to these differences, the same configuration file can produce different parsing results between OpenSSH and libssh. Since OpenSSH is the most widely used SSH implementation, such divergences may cause inconvenience for users and reduce configuration compatibility. This project focuses on building a differential fuzzer that compares how OpenSSH and libssh parse SSH configuration files. The fuzzer will mutate configuration inputs and identify cases where the two implementations behave differently. Based on the discovered divergences, libssh’s configuration parser will be refined to align its behavior more closely with OpenSSH. Finally, regression tests will be introduced for the discovered issues to ensure that future changes do not reintroduce the same bugs.

Mentors: Student: Praneeth Sarode

This project aims to implement client-side support for FIDO/U2F authentication in libssh using the libfido2 library. It will introduce functionality to detect and interact with FIDO authenticators, perform user presence or verification (e.g., touch or PIN), and use these devices for SSH authentication. The final deliverables will include a working implementation, unit and integration tests against an openSSH server, and examples for using the added code.

Mentors: Student: Francesco Rollo

This project aims to significantly enhance libssh capability to handle OpenSSH certificates. Currently, libssh only supports certificates as opaque blobs for basic interoperability with some compatible OpenSSH servers. This implies that there is no control over the certificate attributes, thus preventing both user and host authentication by means of certificates. This project entails the development of a parsing mechanism for extracting certificate contents, along with a proper system to manage them. The deliverables are a set of new APIs for handling certificate-based user and host authentication, combined with an entire key revocation control infrastructure.

Mentors: Student: Gauravsingh Sisodia

This project will set up Kerberos as part of the test suite using cwrap wrappers and write tests for the "gssapi-with-mic" user authentication method. It will also implement and test GSSAPI Key Exchange and “gssapi-keyex” user authentication method from RFC 4462 for both the libssh client and server.

Mentors: Student: Eshan Kelkar

This project aims to create async SFTP client API's for libSSH. Currently sftp_write is the only way of uploading files over SFTP using libssh but sftp_write is a synchronous write. Providing an asynchronous api for upload will make the upload process much more faster. A high level API which will internally use the low level async API for uploads and downloads will also be created which will make uploads/downloads easier for the user and more efficient since the async API is used internally. The set of deliverables for this project will be : a low level async API for writing, a high level API for upload and download, tests for the created API's, benchmark code to analyse performance of the API's, documentation for the created API's.