8667 lines
284 KiB
Plaintext
8667 lines
284 KiB
Plaintext
|
commit fa41f6592ff1b6ead4a652ac75af31eabb05b912
|
|||
|
|
Author: Damien Miller <djm@mindrot.org>
|
|||
|
|
Date: Mon Jul 1 14:33:26 2024 +1000
|
|||
|
|
|
|||
|
|
version numbers
|
|||
|
|
|
|||
|
|
commit bfebb8a5130a792c5356bd06e1ddef72a0a0449f
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Mon Jul 1 04:31:59 2024 +0000
|
|||
|
|
|
|||
|
|
upstream: openssh-9.8
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: 5f8b89e38a4c5f7c6d52ffa19f796d49f36fab19
|
|||
|
|
|
|||
|
|
commit 146c420d29d055cc75c8606327a1cf8439fe3a08
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Mon Jul 1 04:31:17 2024 +0000
|
|||
|
|
|
|||
|
|
upstream: when sending ObscureKeystrokeTiming chaff packets, we
|
|||
|
|
|
|||
|
|
can't rely on channel_did_enqueue to tell that there is data to send. This
|
|||
|
|
flag indicates that the channels code enqueued a packet on _this_ ppoll()
|
|||
|
|
iteration, not that data was enqueued in _any_ ppoll() iteration in the
|
|||
|
|
timeslice. ok markus@
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: 009b74fd2769b36b5284a0188ade182f00564136
|
|||
|
|
|
|||
|
|
commit 637e4dfea4ed81264e264b6200172ce319c64ead
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Mon Jul 1 03:10:19 2024 +0000
|
|||
|
|
|
|||
|
|
upstream: use "lcd" to change directory before "lls" rather then "cd",
|
|||
|
|
|
|||
|
|
since the directory we're trying to list is local. Spotted by Corinna
|
|||
|
|
Vinschen
|
|||
|
|
|
|||
|
|
OpenBSD-Regress-ID: 821feca4a4bebe491944e624c8f7f2990b891415
|
|||
|
|
|
|||
|
|
commit c8cfe258cee0b8466ea84597bf15e1fcff3bc328
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Thu Jun 27 23:01:15 2024 +0000
|
|||
|
|
|
|||
|
|
upstream: delete obsolete comment
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: 5fb04f298ed155053f3fbfdf0c6fe7cdf84bbfa2
|
|||
|
|
|
|||
|
|
commit 94b9d37100f6fa536aaa1d1a0e4926fe44fbf04d
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Thu Jun 27 22:36:44 2024 +0000
|
|||
|
|
|
|||
|
|
upstream: retire unused API
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: 3e30d7b0615e2707f6bbe70f61b1c2f72f78161b
|
|||
|
|
|
|||
|
|
commit 268c3a7f5783e731ed60f4e28da66ee3743581d3
|
|||
|
|
Author: jmc@openbsd.org <jmc@openbsd.org>
|
|||
|
|
Date: Thu Jun 27 21:02:16 2024 +0000
|
|||
|
|
|
|||
|
|
upstream: ssl(8) no longer contains a HISTORY section;
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: 83b7ff34433d79595e9c2a5d2a561a6660251245
|
|||
|
|
|
|||
|
|
commit 12b6cc09ce6c430681f03af2a8069e37a664690b
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Wed Jun 26 23:47:46 2024 +0000
|
|||
|
|
|
|||
|
|
upstream: move child process waitpid() loop out of SIGCHLD handler;
|
|||
|
|
|
|||
|
|
ok deraadt
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: 65815a39564e431414aed7c5ace8076f4e9ca741
|
|||
|
|
|
|||
|
|
commit d6bcd13297c2ab8b528df5a6898f994734849031
|
|||
|
|
Author: deraadt@openbsd.org <deraadt@openbsd.org>
|
|||
|
|
Date: Wed Jun 26 23:16:52 2024 +0000
|
|||
|
|
|
|||
|
|
upstream: Instead of using possibly complex ssh_signal(), write all
|
|||
|
|
|
|||
|
|
the parts of the grace_alarm_handler() using the exact things allowed by the
|
|||
|
|
signal-safe rules. This is a good rule of thumb: Handlers should be written
|
|||
|
|
to either set a global volatile sig_atomic_t inspected from outside, and/or
|
|||
|
|
directly perform only safe operations listed in our sigaction(2) manual page.
|
|||
|
|
ok djm markus
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: 14168ae8368aab76e4ed79e17a667cb46f404ecd
|
|||
|
|
|
|||
|
|
commit b8793e2b0851f7d71b97554fa5260b23796d6277
|
|||
|
|
Author: deraadt@openbsd.org <deraadt@openbsd.org>
|
|||
|
|
Date: Wed Jun 26 23:14:14 2024 +0000
|
|||
|
|
|
|||
|
|
upstream: save_errno wrappers inside two small signal handlers that
|
|||
|
|
|
|||
|
|
perform system calls, for systems with libc that do perform libc sigtramps.
|
|||
|
|
ok djm markus
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: 7749b56419a7c9dcfe4c6c04811e429813346c62
|
|||
|
|
|
|||
|
|
commit f23e9332c4c8df37465c4a4f38275ea98980ed7e
|
|||
|
|
Author: jmc@openbsd.org <jmc@openbsd.org>
|
|||
|
|
Date: Mon Jun 24 06:59:39 2024 +0000
|
|||
|
|
|
|||
|
|
upstream: - uppercase start of sentence - correct sentence grammar
|
|||
|
|
|
|||
|
|
ok djm
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: 1ec4b0fdb633a43667f2c8fff1d600bd647dde25
|
|||
|
|
|
|||
|
|
commit 1839e3eb71a759aa795602c1e4196300f4ac2615
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Mon Jun 24 04:05:11 2024 +0000
|
|||
|
|
|
|||
|
|
upstream: mention SshdSessionPath option
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: c29734d36c21003973b15c1c9965c35f36cef30c
|
|||
|
|
|
|||
|
|
commit 603193e32aef5db7d60c58066d5de89806e79312
|
|||
|
|
Author: Darren Tucker <dtucker@dtucker.net>
|
|||
|
|
Date: Thu Jun 20 18:45:14 2024 +1000
|
|||
|
|
|
|||
|
|
Rerun upstream tests on .sh file changes too.
|
|||
|
|
|
|||
|
|
commit dbbf9337c19381786a8e5a8a49152fe6b80c780d
|
|||
|
|
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
|||
|
|
Date: Thu Jun 20 08:23:18 2024 +0000
|
|||
|
|
|
|||
|
|
upstream: Work around dbclient cipher/mac query bug.
|
|||
|
|
|
|||
|
|
Unlike earlier versions, recent Dropbear (at least v2024.85) requires
|
|||
|
|
a host arg when querying supported ciphers and macs via "-c/-m
|
|||
|
|
help". Earlier versions accept but do not require it, so always
|
|||
|
|
provide it. If these queries fail, skip the test with a warning.
|
|||
|
|
|
|||
|
|
OpenBSD-Regress-ID: 98eb863a3f0363416922efb273885e6b3c7f68d4
|
|||
|
|
|
|||
|
|
commit 8de2c8cebc46bbdb94b7a2c120fcadfb66a3cccc
|
|||
|
|
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
|||
|
|
Date: Thu Jun 20 08:18:34 2024 +0000
|
|||
|
|
|
|||
|
|
upstream: Remove dropbear key types not supported
|
|||
|
|
|
|||
|
|
by current OpenSSH. Allows subsequent test runs to work if OpenSSH is
|
|||
|
|
rebuilt w/out OpenSSL.
|
|||
|
|
|
|||
|
|
OpenBSD-Regress-ID: e0129eb2b1d31771105903a8055216fbba20a770
|
|||
|
|
|
|||
|
|
commit e9b6471c59b21e5d9ef1b3832d4bf727338add85
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Thu Jun 20 00:18:05 2024 +0000
|
|||
|
|
|
|||
|
|
upstream: stricter check for overfull tables in penalty record path
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: 7df01e648a0723418c554e64a9f2b6d38db060a6
|
|||
|
|
|
|||
|
|
commit d9336d344eb2a1e898c5e66147b3f108c7214694
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Wed Jun 19 23:24:47 2024 +0000
|
|||
|
|
|
|||
|
|
upstream: put back reaping of preauth child process when writes
|
|||
|
|
|
|||
|
|
from the monitor fail. Not sure how this got lost in the avalanche of
|
|||
|
|
patches.
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: eb7eb36371e1ac01050b32b70fb2b3e5d98e72f5
|
|||
|
|
|
|||
|
|
commit 579d9adb70ec0206a788eb5c63804c31a67e9310
|
|||
|
|
Author: naddy@openbsd.org <naddy@openbsd.org>
|
|||
|
|
Date: Mon Jun 17 13:50:18 2024 +0000
|
|||
|
|
|
|||
|
|
upstream: remove one more mention of DSA
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: 8515f55a15f02836ba657df341415f63c60526ca
|
|||
|
|
|
|||
|
|
commit 7089b5f8436ef0b8d3d3ad9ce01045fb9e7aab15
|
|||
|
|
Author: Darren Tucker <dtucker@dtucker.net>
|
|||
|
|
Date: Wed Jun 19 23:09:05 2024 +1000
|
|||
|
|
|
|||
|
|
Move -f to the place needed to restart sshd.
|
|||
|
|
|
|||
|
|
commit d5f83cfd852b14a25f347f082ab539a9454702ad
|
|||
|
|
Author: Darren Tucker <dtucker@dtucker.net>
|
|||
|
|
Date: Wed Jun 19 21:04:01 2024 +1000
|
|||
|
|
|
|||
|
|
Need to supply "-f" to restart sshd.
|
|||
|
|
|
|||
|
|
commit fad34b4ca25c0ef31e5aa841d461b6f21da5b8c1
|
|||
|
|
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
|||
|
|
Date: Wed Jun 19 10:15:51 2024 +0000
|
|||
|
|
|
|||
|
|
upstream: Provide defaults for ciphers and macs
|
|||
|
|
|
|||
|
|
if querying for them fails since on some versions of Dropbear (at least
|
|||
|
|
v2024.85) "-m help" doesn't seem to work. Enable all supported pubkey
|
|||
|
|
algorithms in the server.
|
|||
|
|
|
|||
|
|
OpenBSD-Regress-ID: 4f95556a49ee9f621789f25217c367a33d2745ca
|
|||
|
|
|
|||
|
|
commit 5521060e35ada9f957cecdddc06d0524e75409ef
|
|||
|
|
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
|||
|
|
Date: Wed Jun 19 10:10:46 2024 +0000
|
|||
|
|
|
|||
|
|
upstream: Use ed25519 keys for kex tests
|
|||
|
|
|
|||
|
|
since that's supported by OpenSSH even when built without OpenSSL.
|
|||
|
|
Only test diffie-hellman kex if OpenSSH is compiled with support for it.
|
|||
|
|
|
|||
|
|
OpenBSD-Regress-ID: a5d09ef9bbd171f9e4ec73ed0d9eeb49a8878e97
|
|||
|
|
|
|||
|
|
commit dbd3b833f6e3815e58f2dc6e14f61a51bcd4d6bd
|
|||
|
|
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
|||
|
|
Date: Wed Jun 19 10:08:34 2024 +0000
|
|||
|
|
|
|||
|
|
upstream: Rework dropbear key setup
|
|||
|
|
|
|||
|
|
to always generate ed25519 keys, other types only if OpenSSH has support
|
|||
|
|
for the corresponding key type.
|
|||
|
|
|
|||
|
|
OpenBSD-Regress-ID: 8f91f12604cddb9f8d93aa34f3f93a3f6074395d
|
|||
|
|
|
|||
|
|
commit d6218504e11ae9148adf410fc69b0710a052be36
|
|||
|
|
Author: Darren Tucker <dtucker@dtucker.net>
|
|||
|
|
Date: Wed Jun 19 20:20:24 2024 +1000
|
|||
|
|
|
|||
|
|
Restart sshd after installing it for testing.
|
|||
|
|
|
|||
|
|
When installing an sshd built without OpenSSL the mismatch between
|
|||
|
|
the running sshd and newly installed sshd-session will cause the
|
|||
|
|
remainder of the test to fail.
|
|||
|
|
|
|||
|
|
commit 786a4465b6bb702daf4fb17b7c3bcb42b52f0b46
|
|||
|
|
Author: Darren Tucker <dtucker@dtucker.net>
|
|||
|
|
Date: Tue Jun 18 19:59:59 2024 +1000
|
|||
|
|
|
|||
|
|
Remove macos-11 runner.
|
|||
|
|
|
|||
|
|
Github is retiring them soon.
|
|||
|
|
|
|||
|
|
commit df1c72a55edbebac14363b57de66ac6a147ecc67
|
|||
|
|
Author: Damien Miller <djm@mindrot.org>
|
|||
|
|
Date: Wed Jun 19 09:34:34 2024 +1000
|
|||
|
|
|
|||
|
|
PAMServiceName may appear in a Match block
|
|||
|
|
|
|||
|
|
commit de1c2e70e5a5dc3c8d2fe04b24cc93d8ef6930e7
|
|||
|
|
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
|||
|
|
Date: Tue Jun 18 08:11:48 2024 +0000
|
|||
|
|
|
|||
|
|
upstream: Re-enable ssh-dss tests
|
|||
|
|
|
|||
|
|
... if ssh is compiled with DSA support
|
|||
|
|
|
|||
|
|
OpenBSD-Regress-ID: bbfaf8c17f2b50a2d46ac35cb97af99b990c990d
|
|||
|
|
|
|||
|
|
commit dabc2c7cf3c141e8e5d5a1a60d6c1d2d2422cf43
|
|||
|
|
Author: anton@openbsd.org <anton@openbsd.org>
|
|||
|
|
Date: Tue Jun 18 06:14:27 2024 +0000
|
|||
|
|
|
|||
|
|
upstream: Stop using DSA in dropbear interop tests.
|
|||
|
|
|
|||
|
|
OpenBSD-Regress-ID: abfd4457d99d8cc1417fd22ca2c570270f74c1cf
|
|||
|
|
|
|||
|
|
commit 761438012710169445acc179e3870c53c862bda0
|
|||
|
|
Author: Damien Miller <djm@mindrot.org>
|
|||
|
|
Date: Tue Jun 18 12:29:45 2024 +1000
|
|||
|
|
|
|||
|
|
missed a bit of DSA in the fuzzer
|
|||
|
|
|
|||
|
|
commit 3f9cc47da588e8de520720e59f98438043fdaf93
|
|||
|
|
Author: Damien Miller <djm@mindrot.org>
|
|||
|
|
Date: Tue Jun 18 09:35:53 2024 +1000
|
|||
|
|
|
|||
|
|
DSA support is disabled, so remove from fuzzers
|
|||
|
|
|
|||
|
|
commit 00eb95957dea5484b2c7c043f7d2bbc87301bef2
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Mon Jun 17 08:30:29 2024 +0000
|
|||
|
|
|
|||
|
|
upstream: disable the DSA signature algorithm by default; ok
|
|||
|
|
|
|||
|
|
markus@
|
|||
|
|
|
|||
|
|
(yes, I know this expands to "the Digitial Signature Algorithm
|
|||
|
|
signature algorithm)
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: 961ef594e46dd2dcade8dd5721fa565cee79ffed
|
|||
|
|
|
|||
|
|
commit 5603befe11c9464ea26fe77cbacc95a7cc0b1ea7
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Mon Jun 17 08:28:31 2024 +0000
|
|||
|
|
|
|||
|
|
upstream: promote connection-closed messages from verbose to info
|
|||
|
|
|
|||
|
|
log level; they could be the only record of the connection terminating if the
|
|||
|
|
client doesn't send a SSH2_MSG_DISCONNECT message. ok dtucker@
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: 0c8bfaf5e9fdff945cee09ac21e641f6c5d65d3c
|
|||
|
|
|
|||
|
|
commit b00331402fe5c60d577f3ffcc35e49286cdc6b47
|
|||
|
|
Author: Damien Miller <djm@mindrot.org>
|
|||
|
|
Date: Mon Jun 17 17:02:18 2024 +1000
|
|||
|
|
|
|||
|
|
propagate PAM crashes to PerSourcePenalties
|
|||
|
|
|
|||
|
|
If the PAM subprocess crashes, exit with a crash status that will be
|
|||
|
|
picked up by the sshd(8) listener process where it can be used by
|
|||
|
|
PerSourcePenalties to block the client. This is similar handling to
|
|||
|
|
the privsep preauth process.
|
|||
|
|
|
|||
|
|
commit 1c207f456ace38987deda047758d13fbf857f948
|
|||
|
|
Author: Damien Miller <djm@mindrot.org>
|
|||
|
|
Date: Mon Jun 17 15:06:01 2024 +1000
|
|||
|
|
|
|||
|
|
minix doesn't have loopback, so skip penalty tests
|
|||
|
|
|
|||
|
|
pointed out by dtucker@
|
|||
|
|
|
|||
|
|
commit 48443d202eaec52d4d39defdd709a4499a7140c6
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Sun Jun 16 11:54:49 2024 +0000
|
|||
|
|
|
|||
|
|
upstream: same treatment for this test
|
|||
|
|
|
|||
|
|
OpenBSD-Regress-ID: d0cc9efca7833e673ea7b0cb3a679a3acee8d4c7
|
|||
|
|
|
|||
|
|
commit 45562a95ea11d328c22d97bf39401cd29684fb1f
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Sun Jun 16 08:18:06 2024 +0000
|
|||
|
|
|
|||
|
|
upstream: penalty test is still a bit racy
|
|||
|
|
|
|||
|
|
OpenBSD-Regress-ID: 90c9ac224db454637baf1ebee5857e007321e824
|
|||
|
|
|
|||
|
|
commit 8d0f7eb147ef72d18acb16c0b18672d44941a8ca
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Sat Jun 15 03:59:10 2024 +0000
|
|||
|
|
|
|||
|
|
upstream: crank up penalty timeouts so this should work on even the
|
|||
|
|
|
|||
|
|
slowest of test builders
|
|||
|
|
|
|||
|
|
OpenBSD-Regress-ID: 70bda39c83e3fc9d0f3c1fad4542ed33e173d468
|
|||
|
|
|
|||
|
|
commit 93c75471a1202ab3e29db6938648d4e2602c0475
|
|||
|
|
Author: jmc@openbsd.org <jmc@openbsd.org>
|
|||
|
|
Date: Fri Jun 14 05:20:34 2024 +0000
|
|||
|
|
|
|||
|
|
upstream: sort -q in the options list;
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: 6839b38378f38f754de638a5e988c13b4164cc7c
|
|||
|
|
|
|||
|
|
commit dd7807bbe80a93ffb4616f2bd5cf83ad5a5595fb
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Fri Jun 14 05:01:22 2024 +0000
|
|||
|
|
|
|||
|
|
upstream: clarify KEXAlgorithms supported vs available. Inspired by
|
|||
|
|
|
|||
|
|
bz3701 from Colin Watson.
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: e698e69bea19bd52971d253f2b1094490c4701f7
|
|||
|
|
|
|||
|
|
commit d172ad56df85b68316dbadbedad16761a1265874
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Fri Jun 14 05:00:42 2024 +0000
|
|||
|
|
|
|||
|
|
upstream: ssh-keyscan -q man bits
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: ba28d0e1ac609a4c99c453e57e86560c79079db1
|
|||
|
|
|
|||
|
|
commit 092e4ff9ccaacbe035f286feb1b56ed499604743
|
|||
|
|
Author: Damien Miller <djm@mindrot.org>
|
|||
|
|
Date: Fri Jun 14 14:46:35 2024 +1000
|
|||
|
|
|
|||
|
|
skip penalty-expire test in valgrind test env
|
|||
|
|
|
|||
|
|
commit 2866ad08a9c50d7b67ce9424ca990532b806a21a
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Fri Jun 14 04:43:11 2024 +0000
|
|||
|
|
|
|||
|
|
upstream: split the PerSourcePenalties test in two: one tests penalty
|
|||
|
|
|
|||
|
|
enforcement but not penalty expiry, the other tests penalty expiry.
|
|||
|
|
|
|||
|
|
This lets us disable the expiry testing in certain CI test environments.
|
|||
|
|
|
|||
|
|
OpenBSD-Regress-ID: f56811064f3e3cb52ee73a206b8c2a06af1c8791
|
|||
|
|
|
|||
|
|
commit b2c64bc170d75823622a37cab3ca1804ca87ad16
|
|||
|
|
Author: Damien Miller <djm@mindrot.org>
|
|||
|
|
Date: Fri Jun 14 14:19:23 2024 +1000
|
|||
|
|
|
|||
|
|
add a sshd_config PamServiceName option
|
|||
|
|
|
|||
|
|
Allows selecting which PAM service name to use when UsePAM is
|
|||
|
|
enabled. Defaults to "sshd" unless overridden at compile time
|
|||
|
|
by defining SSHD_PAM_SERVICE.
|
|||
|
|
|
|||
|
|
bz2102, ok dtucker@
|
|||
|
|
|
|||
|
|
commit 9f032a4dd17bf0ae6066223d82aa5e784285d987
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Fri Jun 14 00:26:12 2024 +0000
|
|||
|
|
|
|||
|
|
upstream: don't redirect stderr for ssh-keyscan we expect to succeed
|
|||
|
|
|
|||
|
|
OpenBSD-Regress-ID: 8878b8eb4e070ed2e343166d3eb86db4a08a216c
|
|||
|
|
|
|||
|
|
commit 1e84d0cf40e94ae3a77d6a7ca8c036d8e3d55a40
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Fri Jun 14 00:25:25 2024 +0000
|
|||
|
|
|
|||
|
|
upstream: make host/banner comments go to stderr instead of stdout,
|
|||
|
|
|
|||
|
|
so they are useful as comments without extra shell redirection and so they
|
|||
|
|
don't clutter actual errors on stderr.
|
|||
|
|
|
|||
|
|
Add a -q flag to shut them up.
|
|||
|
|
|
|||
|
|
ok dtucker@
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: bec813de56a71adb5c1a76adcf49621130d24264
|
|||
|
|
|
|||
|
|
commit 3e806d011855d6bd648ec95b9df630ebbd11c3bf
|
|||
|
|
Author: naddy@openbsd.org <naddy@openbsd.org>
|
|||
|
|
Date: Thu Jun 13 15:06:33 2024 +0000
|
|||
|
|
|
|||
|
|
upstream: separate keywords with comma
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: d65a99666202a8188c4991c18d14374a229f7be5
|
|||
|
|
|
|||
|
|
commit abfd1f7a3cbd0a92581a0febba254b2f6649c0d9
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Fri Jun 14 00:23:55 2024 +0000
|
|||
|
|
|
|||
|
|
upstream: specify an algorithm for ssh-keyscan, otherwise it will make
|
|||
|
|
|
|||
|
|
multiple attempts simultaneously and confuse the test
|
|||
|
|
|
|||
|
|
OpenBSD-Regress-ID: 6e910f3315c4345053db1bf5cbf61826b194d0b9
|
|||
|
|
|
|||
|
|
commit a8fbe2f7d0d96d299ee8e69769e3b51067978748
|
|||
|
|
Author: Damien Miller <djm@mindrot.org>
|
|||
|
|
Date: Thu Jun 13 16:41:29 2024 +1000
|
|||
|
|
|
|||
|
|
sshd: don't use argv[0] as PAM service name
|
|||
|
|
|
|||
|
|
sshd would implicitly use argv[0] as the PAM service name to
|
|||
|
|
allow people to select different PAM service names by making
|
|||
|
|
differently-named copies/links to the sshd binary.
|
|||
|
|
|
|||
|
|
Splitting sshd into sshd/sshd-session broke this, as the process
|
|||
|
|
that starts PAM is always sshd-session and the user has no control
|
|||
|
|
over this.
|
|||
|
|
|
|||
|
|
Hardcode "sshd" as the default PAM service name unless/until we
|
|||
|
|
figure out a better way. Should unbreak OSX integration tests.
|
|||
|
|
|
|||
|
|
commit bf204bd05c3ae650f87e2b96527688579f59774c
|
|||
|
|
Author: Damien Miller <djm@mindrot.org>
|
|||
|
|
Date: Thu Jun 13 15:00:28 2024 +1000
|
|||
|
|
|
|||
|
|
prepare for checking in autogenerated files
|
|||
|
|
|
|||
|
|
We plan to check in automatically generated files (config.h.in, etc) on
|
|||
|
|
release branches. These files are normally ignored by .gitignore, but
|
|||
|
|
this shuffles the contents of this file to make it easy to un-ignore
|
|||
|
|
them.
|
|||
|
|
|
|||
|
|
commit 425f79a837489904c343b349ef00e09aeaa4e752
|
|||
|
|
Author: Damien Miller <djm@mindrot.org>
|
|||
|
|
Date: Thu Jun 13 14:41:33 2024 +1000
|
|||
|
|
|
|||
|
|
typo in comment
|
|||
|
|
|
|||
|
|
commit afe10313c1fa8d478af399ee7d54c8f85503013b
|
|||
|
|
Author: Damien Miller <djm@mindrot.org>
|
|||
|
|
Date: Thu Jun 13 14:35:25 2024 +1000
|
|||
|
|
|
|||
|
|
fix PTY allocation on Cygwin, broken by sshd split
|
|||
|
|
|
|||
|
|
Cygwin doesn't support FD passing and so used to disable post-auth
|
|||
|
|
privilege separation entirely because privsep requires PTY allocation
|
|||
|
|
to happen in the privileged monitor process with the PTY file
|
|||
|
|
descriptors being passed back to the unprivileged process.
|
|||
|
|
|
|||
|
|
This brings back a minimal version of the previous special treatment
|
|||
|
|
for Cygwin (and any other platform that sets DISABLE_FD_PASSING):
|
|||
|
|
privilege separation remains enabled, but PTY allocation happens in
|
|||
|
|
the post-auth user process rather than the monitor.
|
|||
|
|
|
|||
|
|
This either requires PTY allocation to not need privilege to begin
|
|||
|
|
with (this appears to be the case on Cygwin), or the post-auth
|
|||
|
|
privsep process retain privilege (other platforms that set the
|
|||
|
|
DISABLE_FD_PASSING option).
|
|||
|
|
|
|||
|
|
Keeping privileges here is bad, but the non-Cygwin systems that set
|
|||
|
|
DISABLE_FD_PASSING are so deeply legacy that this is likely to be the
|
|||
|
|
least of their problems.
|
|||
|
|
|
|||
|
|
commit f66d4df5749551380a8c4ae642347675a0b6a2e9
|
|||
|
|
Author: Damien Miller <djm@mindrot.org>
|
|||
|
|
Date: Thu Jun 13 11:33:09 2024 +1000
|
|||
|
|
|
|||
|
|
delay lookup of privsep user until config loaded
|
|||
|
|
|
|||
|
|
sshd-session attempting to use options.kerberos_authentication to
|
|||
|
|
decide whether it needed to lookup the privsep user before the
|
|||
|
|
configuration was loaded. This caused it to get a placeholder value
|
|||
|
|
that caused it always to try to lookup the privsep user, breaking at
|
|||
|
|
least one test environment.
|
|||
|
|
|
|||
|
|
commit f1c42858b94f5d9b58867b34dce3afb39c6b56a8
|
|||
|
|
Author: Damien Miller <djm@mindrot.org>
|
|||
|
|
Date: Thu Jun 13 11:16:57 2024 +1000
|
|||
|
|
|
|||
|
|
missing file for PerSourcePenalties regress test
|
|||
|
|
|
|||
|
|
commit 4de80ff4e6fab5a6bb0028e7d57c6c23d1485adb
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Wed Jun 12 22:36:00 2024 +0000
|
|||
|
|
|
|||
|
|
upstream: split PerSourcePenalties address tracking. Previously it
|
|||
|
|
|
|||
|
|
used one shared table and overflow policy for IPv4 and IPv6 addresses, now it
|
|||
|
|
will use separate tables and optionally different overflow policies.
|
|||
|
|
|
|||
|
|
This prevents misbehaviour from IPv6 addresses (which are vastly easier
|
|||
|
|
to obtain many of) from affecting IPv4 connections and may allow for
|
|||
|
|
stricter overflow policies.
|
|||
|
|
|
|||
|
|
ok deraadt@
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: 12637ed0aa4d5f1f3e702da42ea967cbd8bfdfd9
|
|||
|
|
|
|||
|
|
commit 06ab4c6931b0aaa4334db2faaa7e1069e76d0df6
|
|||
|
|
Author: jmc@openbsd.org <jmc@openbsd.org>
|
|||
|
|
Date: Tue Jun 11 05:24:39 2024 +0000
|
|||
|
|
|
|||
|
|
upstream: do not mark up "(default: 20ms)";
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: 54151ecdecfa1b67dcdda4fd24826ef6e2148ad4
|
|||
|
|
|
|||
|
|
commit cfe243cd9fde148ed060637876e27bb55ac78be9
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Tue Jun 11 02:54:51 2024 +0000
|
|||
|
|
|
|||
|
|
upstream: reap preauth net child if it hangs up during privsep message
|
|||
|
|
|
|||
|
|
send, not just message receive
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: 02a093f4ab4f8f83f0cd1ea2bb35b9ca420448f0
|
|||
|
|
|
|||
|
|
commit b0a711c00b9c64afd1c9d6fb538275c6604a2676
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Tue Jun 11 01:58:27 2024 +0000
|
|||
|
|
|
|||
|
|
upstream: fix PIDFILE handling, broken for SUDO=doas in last commit
|
|||
|
|
|
|||
|
|
here
|
|||
|
|
|
|||
|
|
OpenBSD-Regress-ID: 96fec579af228f87a036e94801eb294af9074625
|
|||
|
|
|
|||
|
|
commit 90fb801e2d9241be50a2a7ff79428386442a041f
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Tue Jun 11 02:00:30 2024 +0000
|
|||
|
|
|
|||
|
|
upstream: reap the pre-auth [net] child if it hangs up during privsep
|
|||
|
|
|
|||
|
|
message sending, not just receiving
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: f7341605bf08c4c15830910446e6775323f2f8cb
|
|||
|
|
|
|||
|
|
commit ef878d58798f6688c7f4d4e417dc0c29023ea831
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Tue Jun 11 01:23:25 2024 +0000
|
|||
|
|
|
|||
|
|
upstream: a little more RB_TREE paranoia
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: 8dc2fd21eebd8830c4a4d25461ac4fe228e11156
|
|||
|
|
|
|||
|
|
commit fc4e96b2174d6a894d2033421699d091679baced
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Tue Jun 11 01:22:25 2024 +0000
|
|||
|
|
|
|||
|
|
upstream: fix off-by-one comparison for PerSourcePenalty
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: af4f5d01c41ef870b23e55655bfbf73474a6c02b
|
|||
|
|
|
|||
|
|
commit 82c836df4ff41145553cd7adb11c5b985aeaa06f
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Tue Jun 11 01:21:41 2024 +0000
|
|||
|
|
|
|||
|
|
upstream: move tree init before possible early return
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: 72e2c5b69f151c08a7c5bf5ad929b97a92c273df
|
|||
|
|
|
|||
|
|
commit a2300f015cc4939c4d9c564b58b74e71202dc978
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Tue Jun 11 01:07:35 2024 +0000
|
|||
|
|
|
|||
|
|
upstream: update to mention that PerSourcePenalties default to
|
|||
|
|
|
|||
|
|
being enabled and document the default values for each parameter.
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: b981288bddfb097aad269f62df4081c688ce0034
|
|||
|
|
|
|||
|
|
commit 41987efd356d3fc30139aeab4b09374acf8f91a0
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Tue Jun 11 00:44:52 2024 +0000
|
|||
|
|
|
|||
|
|
upstream: reap the [net] child if it hangs up while writing privsep
|
|||
|
|
|
|||
|
|
message payloads, not just the message header
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: 24dbd400aa381ac96be7ed2dd49018487dfef6ce
|
|||
|
|
|
|||
|
|
commit 6211aa085fa91155a24922e5329576ac9a8f3175
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Tue Jun 11 00:40:21 2024 +0000
|
|||
|
|
|
|||
|
|
upstream: log waitpid() status for abnormal exits
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: b317930e06b51819c1a2bc6a4359764fecfb1c2d
|
|||
|
|
|
|||
|
|
commit a59634c7adb9ae988748d99963dfafb3070d8d41
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Tue Jun 11 00:36:20 2024 +0000
|
|||
|
|
|
|||
|
|
upstream: correct error message
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: 581f60f73099083392887206860229ab104620ed
|
|||
|
|
|
|||
|
|
commit fa7d7a667f2ee031e72873e36de2d2a36bca973b
|
|||
|
|
Author: deraadt@openbsd.org <deraadt@openbsd.org>
|
|||
|
|
Date: Fri Jun 7 13:23:30 2024 +0000
|
|||
|
|
|
|||
|
|
upstream: avoid shadowing issues which some compilers won't accept
|
|||
|
|
|
|||
|
|
ok djm
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: 1e89572397dda83433d58c4fa6333a08f51170d4
|
|||
|
|
|
|||
|
|
commit 3ad4cd9eeca5c9bc6706db44b6de88e2e4513fd6
|
|||
|
|
Author: jmc@openbsd.org <jmc@openbsd.org>
|
|||
|
|
Date: Thu Jun 6 21:14:49 2024 +0000
|
|||
|
|
|
|||
|
|
upstream: escape the final dot at eol in "e.g." to avoid double
|
|||
|
|
|
|||
|
|
spacing;
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: 0a9fb10bc9f7d577afe2da3f498a08bc431115b9
|
|||
|
|
|
|||
|
|
commit 0e0c69761a4c33ccd4a256560f522784a753d1a8
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Thu Jun 6 20:25:48 2024 +0000
|
|||
|
|
|
|||
|
|
upstream: enable PerSourcePenalties by default.
|
|||
|
|
|
|||
|
|
ok markus
|
|||
|
|
|
|||
|
|
NB. if you run a sshd that accepts connections from behind large NAT
|
|||
|
|
blocks, proxies or anything else that aggregates many possible users
|
|||
|
|
behind few IP addresses, then this change may cause legitimate traffic
|
|||
|
|
to be denied.
|
|||
|
|
|
|||
|
|
Please read the PerSourcePenalties, PerSourcePenaltyExemptList and
|
|||
|
|
PerSourceNetBlockSize options in sshd_config(5) for how to tune your
|
|||
|
|
sshd(8) for your specific circumstances.
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: 24a0e5c23d37e5a63e16d2c6da3920a51078f6ce
|
|||
|
|
|
|||
|
|
commit bd1f74741daabeaf20939a85cd8cec08c76d0bec
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Thu Jun 6 20:20:42 2024 +0000
|
|||
|
|
|
|||
|
|
upstream: mention that PerSourcePenalties don't affect concurrent
|
|||
|
|
|
|||
|
|
in-progress connections.
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: 20389da6264f2c97ac3463edfaa1182c212d420c
|
|||
|
|
|
|||
|
|
commit 9774b938578327d88a651f4c63c504809717590a
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Thu Jun 6 19:49:25 2024 +0000
|
|||
|
|
|
|||
|
|
upstream: regress test for PerSourcePenalties
|
|||
|
|
|
|||
|
|
OpenBSD-Regress-ID: a1af13d411b25a727742644459d26480b9a1b0f1
|
|||
|
|
|
|||
|
|
commit b8ebd86cefe9812204a10c028dc90de29918667d
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Thu Jun 6 19:48:40 2024 +0000
|
|||
|
|
|
|||
|
|
upstream: make sure logs are saved from sshd run via start_sshd
|
|||
|
|
|
|||
|
|
OpenBSD-Regress-ID: de4ef0e32e3ab85ff3a6c36eb08d1909c0dd1b4a
|
|||
|
|
|
|||
|
|
commit d7b2070bdaa4ebbfafb9975c1d5a62b73289d31f
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Thu Jun 6 19:47:48 2024 +0000
|
|||
|
|
|
|||
|
|
upstream: simplify
|
|||
|
|
|
|||
|
|
OpenBSD-Regress-ID: 50316e0d1ae0c0a057a45af042253e54ce23d11c
|
|||
|
|
|
|||
|
|
commit e6ea3d224513b6bfb93818809d4c7397f5995ba2
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Thu Jun 6 18:48:13 2024 +0000
|
|||
|
|
|
|||
|
|
upstream: prepare for PerSourcePenalties being enabled by default
|
|||
|
|
|
|||
|
|
in future
|
|||
|
|
|
|||
|
|
OpenBSD-Regress-ID: 5236c6d1c823997aac5a35e2915da30f1903bec7
|
|||
|
|
|
|||
|
|
commit c0cb3b8c837761816a60a3cdb54062668df09652
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Thu Jun 6 19:50:01 2024 +0000
|
|||
|
|
|
|||
|
|
upstream: disable stderr redirection before closing fds
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: d42cb895ee4542098050367fc35321c9303f003a
|
|||
|
|
|
|||
|
|
commit 81c1099d22b81ebfd20a334ce986c4f753b0db29
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Thu Jun 6 17:15:25 2024 +0000
|
|||
|
|
|
|||
|
|
upstream: Add a facility to sshd(8) to penalise particular
|
|||
|
|
|
|||
|
|
problematic client behaviours, controlled by two new sshd_config(5) options:
|
|||
|
|
PerSourcePenalties and PerSourcePenaltyExemptList.
|
|||
|
|
|
|||
|
|
When PerSourcePenalties are enabled, sshd(8) will monitor the exit
|
|||
|
|
status of its child pre-auth session processes. Through the exit
|
|||
|
|
status, it can observe situations where the session did not
|
|||
|
|
authenticate as expected. These conditions include when the client
|
|||
|
|
repeatedly attempted authentication unsucessfully (possibly indicating
|
|||
|
|
an attack against one or more accounts, e.g. password guessing), or
|
|||
|
|
when client behaviour caused sshd to crash (possibly indicating
|
|||
|
|
attempts to exploit sshd).
|
|||
|
|
|
|||
|
|
When such a condition is observed, sshd will record a penalty of some
|
|||
|
|
duration (e.g. 30 seconds) against the client's address. If this time
|
|||
|
|
is above a minimum threshold specified by the PerSourcePenalties, then
|
|||
|
|
connections from the client address will be refused (along with any
|
|||
|
|
others in the same PerSourceNetBlockSize CIDR range).
|
|||
|
|
|
|||
|
|
Repeated offenses by the same client address will accrue greater
|
|||
|
|
penalties, up to a configurable maximum. A PerSourcePenaltyExemptList
|
|||
|
|
option allows certain address ranges to be exempt from all penalties.
|
|||
|
|
|
|||
|
|
We hope these options will make it significantly more difficult for
|
|||
|
|
attackers to find accounts with weak/guessable passwords or exploit
|
|||
|
|
bugs in sshd(8) itself.
|
|||
|
|
|
|||
|
|
PerSourcePenalties is off by default, but we expect to enable it
|
|||
|
|
automatically in the near future.
|
|||
|
|
|
|||
|
|
much feedback markus@ and others, ok markus@
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: 89ded70eccb2b4926ef0366a4d58a693de366cca
|
|||
|
|
|
|||
|
|
commit 916b0b6174e203cf2c5ec9bcf409472eb7ffbf43
|
|||
|
|
Author: Damien Miller <djm@mindrot.org>
|
|||
|
|
Date: Fri Jun 7 03:31:02 2024 +1000
|
|||
|
|
|
|||
|
|
whitespace
|
|||
|
|
|
|||
|
|
commit 49b55e44182b8294419aa580cbf043d5b9e3d953
|
|||
|
|
Author: deraadt@openbsd.org <deraadt@openbsd.org>
|
|||
|
|
Date: Tue Jun 4 15:14:45 2024 +0000
|
|||
|
|
|
|||
|
|
upstream: enable -fret-clean on amd64, for libc libcrypto ld.so
|
|||
|
|
|
|||
|
|
kernel, and all the ssh tools. The dynamic objects are entirely ret-clean,
|
|||
|
|
static binaries will contain a blend of cleaning and non-cleaning callers.
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: 112aacedd3b61cc5c34b1fa6d9fb759214179172
|
|||
|
|
|
|||
|
|
commit cc80d51d034bcb24fd0f2564a4bdf1612000a2a2
|
|||
|
|
Author: Damien Miller <djm@mindrot.org>
|
|||
|
|
Date: Wed Jun 5 02:21:30 2024 +1000
|
|||
|
|
|
|||
|
|
remove PRIVSEP macros for osx
|
|||
|
|
|
|||
|
|
commit 8785491123d4d722b310c20f383570be758f8263
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Sat Jun 1 07:03:37 2024 +0000
|
|||
|
|
|
|||
|
|
upstream: be really strict with fds reserved for communication with the
|
|||
|
|
|
|||
|
|
separate sshd-session process - reserve them early and fatal if we can't
|
|||
|
|
dup2(2) them later. The pre-split fallback to re-reading the configuration
|
|||
|
|
files is not possible, so sshd-session absolutely requires the fd the
|
|||
|
|
configuration is passed over to be in order.
|
|||
|
|
|
|||
|
|
ok deraadt@
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: 308a98ef3c8a6665ebf92c7c9a0fc9600ccd7065
|
|||
|
|
|
|||
|
|
commit f1c8918cb98459910fb159373baea053ba4108c0
|
|||
|
|
Author: Damien Miller <djm@mindrot.org>
|
|||
|
|
Date: Fri May 31 19:12:26 2024 +1000
|
|||
|
|
|
|||
|
|
depend
|
|||
|
|
|
|||
|
|
commit 94b4866cb1f4b0ed29a9f367047b30f81002316f
|
|||
|
|
Author: Damien Miller <djm@mindrot.org>
|
|||
|
|
Date: Fri May 31 19:11:14 2024 +1000
|
|||
|
|
|
|||
|
|
rename need_privsep to need_chroot
|
|||
|
|
|
|||
|
|
privsep is mandatory, chroot is optional (disabled when running
|
|||
|
|
sshd as non-root)
|
|||
|
|
|
|||
|
|
commit e68a95142e5024b144f8eeccd5ffdee42c34f44c
|
|||
|
|
Author: Damien Miller <djm@mindrot.org>
|
|||
|
|
Date: Fri May 31 19:05:34 2024 +1000
|
|||
|
|
|
|||
|
|
remove remaining use_privsep mention
|
|||
|
|
|
|||
|
|
commit b21d271f651d2536dca819cc6d74032fe98634db
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Fri May 31 09:01:08 2024 +0000
|
|||
|
|
|
|||
|
|
upstream: warn when -r (deprecated option to disable re-exec) is
|
|||
|
|
|
|||
|
|
passed
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: 73145ef5150edbe3ce7889f0844ed8fa6155f551
|
|||
|
|
|
|||
|
|
commit a4b5bc246cbca476deeeb4462aa31746a56e3021
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Fri May 31 08:49:35 2024 +0000
|
|||
|
|
|
|||
|
|
upstream: typos
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: edfa72eb06bfa65da30fabf7d2fe76d2d33f77bf
|
|||
|
|
|
|||
|
|
commit 8054b906983ceaed01fabd8188d3dac24c05ba39
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Mon May 27 01:52:26 2024 +0000
|
|||
|
|
|
|||
|
|
upstream: don't need sys/queue.h here
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: dd137396828171eb19e4911581812ca58de6c578
|
|||
|
|
|
|||
|
|
commit 210d4239733da6180ce853538aeb9413d5c62ad5
|
|||
|
|
Author: naddy@openbsd.org <naddy@openbsd.org>
|
|||
|
|
Date: Sun May 26 20:35:12 2024 +0000
|
|||
|
|
|
|||
|
|
upstream: remove references to SSH1 and DSA server keys
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: 57cc1c98d4f998981473734f144b904af7d178a2
|
|||
|
|
|
|||
|
|
commit f0b9261d7fdd0ef86806b49fe76344bd16770cd0
|
|||
|
|
Author: jsg@openbsd.org <jsg@openbsd.org>
|
|||
|
|
Date: Thu May 23 23:47:16 2024 +0000
|
|||
|
|
|
|||
|
|
upstream: remove unused struct fwd_perm_list, no decl with complete
|
|||
|
|
|
|||
|
|
type ok djm@
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: 416fb3970b7e73c76d2963c4f00cf96f2b2ee2fb
|
|||
|
|
|
|||
|
|
commit 2477a98c3ef78e63b11a1393656e00288f52ae97
|
|||
|
|
Author: naddy@openbsd.org <naddy@openbsd.org>
|
|||
|
|
Date: Wed May 22 15:24:55 2024 +0000
|
|||
|
|
|
|||
|
|
upstream: Do not pass -Werror twice when building with clang.
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: 5f378c38ad8976d507786dc4db9283a879ec8cd0
|
|||
|
|
|
|||
|
|
commit 435844f5675245b4271f8581f15e6d1f34fde3bc
|
|||
|
|
Author: miod@openbsd.org <miod@openbsd.org>
|
|||
|
|
Date: Wed May 22 11:49:36 2024 +0000
|
|||
|
|
|
|||
|
|
upstream: Do not pass -Werror if building with gcc 3, for asn1.h
|
|||
|
|
|
|||
|
|
and bio.h cause (admittedly bogus) warnings with gcc 3.
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: fb39324748824cb0387e9d67c41d1bef945c54ea
|
|||
|
|
|
|||
|
|
commit fc5dc092830de23767c6ef67baa18310a64ee533
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Wed May 22 04:20:00 2024 +0000
|
|||
|
|
|
|||
|
|
upstream: this test has been broken since 2014, and has been
|
|||
|
|
|
|||
|
|
testing the same key exchange algorithm repeatedly instead of testing all of
|
|||
|
|
them. Spotted by nreilly AT blackberry.com in bz3692
|
|||
|
|
|
|||
|
|
Who broke the test? me.
|
|||
|
|
|
|||
|
|
OpenBSD-Regress-ID: 48f4f5946276f975667141957d25441b3c9a50e2
|
|||
|
|
|
|||
|
|
commit fd4816791beaed2fdae7eea3e1494d1972b2a39d
|
|||
|
|
Author: anton@openbsd.org <anton@openbsd.org>
|
|||
|
|
Date: Sun May 19 19:10:01 2024 +0000
|
|||
|
|
|
|||
|
|
upstream: Add missing kex-names.c source file required since the
|
|||
|
|
|
|||
|
|
ssh split.
|
|||
|
|
|
|||
|
|
OpenBSD-Regress-ID: ca666223f828fc4b069cb9016bff1eb50faf9fbb
|
|||
|
|
|
|||
|
|
commit beccb7319c5449f6454889013403c336446d622e
|
|||
|
|
Author: naddy@openbsd.org <naddy@openbsd.org>
|
|||
|
|
Date: Fri May 17 14:42:00 2024 +0000
|
|||
|
|
|
|||
|
|
upstream: remove duplicate copy of relink kit for sshd-session
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: 6d2ded4cd91d4d727c2b26e099b91ea935bed504
|
|||
|
|
|
|||
|
|
commit dcd79fa141311c287e0595ede684b7116122fae0
|
|||
|
|
Author: jsg@openbsd.org <jsg@openbsd.org>
|
|||
|
|
Date: Fri May 17 06:42:04 2024 +0000
|
|||
|
|
|
|||
|
|
upstream: remove prototypes with no matching function; ok djm@
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: 6d9065dadea5f14a01bece0dbfe2fba1be31c693
|
|||
|
|
|
|||
|
|
commit 6454a05e7c6574d70adf17efe505a8581a86ca4f
|
|||
|
|
Author: jsg@openbsd.org <jsg@openbsd.org>
|
|||
|
|
Date: Fri May 17 06:38:00 2024 +0000
|
|||
|
|
|
|||
|
|
upstream: remove externs for removed vars; ok djm@
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: f51ea791d45c15d4927eb4ae7d877ccc1e5a2aab
|
|||
|
|
|
|||
|
|
commit f3e4db4601ef7d2feb1d6f7447e432aaf353a616
|
|||
|
|
Author: deraadt@openbsd.org <deraadt@openbsd.org>
|
|||
|
|
Date: Fri May 17 06:11:17 2024 +0000
|
|||
|
|
|
|||
|
|
upstream: -Werror was turned on (probably just for development),
|
|||
|
|
|
|||
|
|
and this is a simple way to satisfy older gcc.
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: 7f698df54384b437ce33ab7405f0b86c87019e86
|
|||
|
|
|
|||
|
|
commit 24a1f3e5ad6f4a49377d4c74c36637e9a239efd0
|
|||
|
|
Author: Damien Miller <djm@mindrot.org>
|
|||
|
|
Date: Fri May 17 14:50:43 2024 +1000
|
|||
|
|
|
|||
|
|
attempt at updating RPM specs for sshd-session
|
|||
|
|
|
|||
|
|
commit 17b566eeb7a0c6acc9c48b35c08885901186f861
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Fri May 17 04:42:13 2024 +0000
|
|||
|
|
|
|||
|
|
upstream: g/c unused variable
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: aa6ef0778a1f1bde0d73efba72a777c48d2bd010
|
|||
|
|
|
|||
|
|
commit 01fb82eb2aa0a4eaf5c394ea8bb37ea4c26f8a3f
|
|||
|
|
Author: jsg@openbsd.org <jsg@openbsd.org>
|
|||
|
|
Date: Fri May 17 02:39:11 2024 +0000
|
|||
|
|
|
|||
|
|
upstream: spelling; ok djm@
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: bdea29bb3ed2a5a7782999c4c663b219d2270483
|
|||
|
|
|
|||
|
|
commit b88b690e99145a021fc1a1a116a11e0bce0594e7
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Fri May 17 01:45:22 2024 +0000
|
|||
|
|
|
|||
|
|
upstream: allow overriding the sshd-session binary path
|
|||
|
|
|
|||
|
|
OpenBSD-Regress-ID: 5058cd1c4b6ca1a15474e33546142931d9f964da
|
|||
|
|
|
|||
|
|
commit a68f80f2511f0e0c5cef737a8284cc2dfabad818
|
|||
|
|
Author: anton@openbsd.org <anton@openbsd.org>
|
|||
|
|
Date: Wed Apr 3 06:01:11 2024 +0000
|
|||
|
|
|
|||
|
|
upstream: Since ssh-agent(1) is only readable by root by now, use
|
|||
|
|
|
|||
|
|
ssh(1) while generating data in tests.
|
|||
|
|
|
|||
|
|
OpenBSD-Regress-ID: 24eb40de2e6b0ace185caaba35e2d470331ffe68
|
|||
|
|
|
|||
|
|
commit 92e55890314ce2b0be21a43ebcbc043b4abc232f
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Fri May 17 01:17:40 2024 +0000
|
|||
|
|
|
|||
|
|
upstream: fix incorrect debug option name introduce in previous
|
|||
|
|
|
|||
|
|
commit
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: 66d69e22b1c072c694a7267c847f212284614ed3
|
|||
|
|
|
|||
|
|
commit 4ad72878af7b6ec28da6e230e36a91650ebe84c1
|
|||
|
|
Author: deraadt@openbsd.org <deraadt@openbsd.org>
|
|||
|
|
Date: Fri May 17 00:33:25 2024 +0000
|
|||
|
|
|
|||
|
|
upstream: construct and install a relink-kit for sshd-session ok
|
|||
|
|
|
|||
|
|
djm
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: 8b3820adb4da4e139c4b3cffbcc0bde9f08bf0c6
|
|||
|
|
|
|||
|
|
commit 02e679a2cb3f6df8e9dbb1519ed578226485157f
|
|||
|
|
Author: Damien Miller <djm@mindrot.org>
|
|||
|
|
Date: Fri May 17 12:21:27 2024 +1000
|
|||
|
|
|
|||
|
|
Makefile support for sshd-session
|
|||
|
|
|
|||
|
|
commit c0416035c5eaf70a8450d11c8833c5f7068ee7ad
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Fri May 17 00:32:32 2024 +0000
|
|||
|
|
|
|||
|
|
upstream: missing files from previous
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: 4b7be4434d8799f02365552b641a7a70a7ebeb2f
|
|||
|
|
|
|||
|
|
commit 03e3de416ed7c34faeb692967737be4a7bbe2eb5
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Fri May 17 00:30:23 2024 +0000
|
|||
|
|
|
|||
|
|
upstream: Start the process of splitting sshd into separate
|
|||
|
|
|
|||
|
|
binaries. This step splits sshd into a listener and a session binary. More
|
|||
|
|
splits are planned.
|
|||
|
|
|
|||
|
|
After this changes, the listener binary will validate the configuration,
|
|||
|
|
load the hostkeys, listen on port 22 and manage MaxStartups only. All
|
|||
|
|
session handling will be performed by a new sshd-session binary that the
|
|||
|
|
listener fork+execs.
|
|||
|
|
|
|||
|
|
This reduces the listener process to the minimum necessary and sets us
|
|||
|
|
up for future work on the sshd-session binary.
|
|||
|
|
|
|||
|
|
feedback/ok markus@ deraadt@
|
|||
|
|
|
|||
|
|
NB. if you're updating via source, please restart sshd after installing,
|
|||
|
|
otherwise you run the risk of locking yourself out.
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: 43c04a1ab96cdbdeb53d2df0125a6d42c5f19934
|
|||
|
|
|
|||
|
|
commit 1c0d81357921f8d3bab06841df649edac515ae5b
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Thu May 9 09:46:47 2024 +0000
|
|||
|
|
|
|||
|
|
upstream: simplify exit message handling, which was more complicated
|
|||
|
|
|
|||
|
|
than it needed to be because of unexpunged ssh1 remnants. ok markus@
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: 8b0cd2c0dee75fb053718f442aa89510b684610b
|
|||
|
|
|
|||
|
|
commit cbbbf76aa6cd54fce32eacce1300e7abcf9461d4
|
|||
|
|
Author: tobias@openbsd.org <tobias@openbsd.org>
|
|||
|
|
Date: Mon May 6 19:26:17 2024 +0000
|
|||
|
|
|
|||
|
|
upstream: remove SSH1 leftovers
|
|||
|
|
|
|||
|
|
Authored with Space Meyer <git at the-space dot agency>
|
|||
|
|
|
|||
|
|
ok djm
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: 81db602e4cb407baae472689db1c222ed7b2afa3
|
|||
|
|
|
|||
|
|
commit bc5dcb8ab9a4e8af54a724883732af378f42ea78
|
|||
|
|
Author: tobias@openbsd.org <tobias@openbsd.org>
|
|||
|
|
Date: Tue Apr 30 15:40:43 2024 +0000
|
|||
|
|
|
|||
|
|
upstream: never close stdin
|
|||
|
|
|
|||
|
|
The sanitise_stdfd call makes sure that standard file descriptors are
|
|||
|
|
open (if they were closed, they are connected with /dev/null).
|
|||
|
|
|
|||
|
|
Do not close stdin in any case to prevent error messages when stdin is
|
|||
|
|
read multiple times and to prevent later usage of fd 0 for connections,
|
|||
|
|
e.g.
|
|||
|
|
|
|||
|
|
echo localhost | ssh-keyscan -f - -f -
|
|||
|
|
|
|||
|
|
While at it, make stdin-related error messages nicer.
|
|||
|
|
|
|||
|
|
Authored with Max Kunzelmann <maxdev at posteo dot de>
|
|||
|
|
|
|||
|
|
ok djm
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: 48e9b7938e2fa2f9bd47e6de6df66a31e0b375d3
|
|||
|
|
|
|||
|
|
commit 6a42b70e56bef1aacdcdf06352396e837883e84f
|
|||
|
|
Author: Damien Miller <djm@mindrot.org>
|
|||
|
|
Date: Wed May 8 09:43:59 2024 +1000
|
|||
|
|
|
|||
|
|
sync getrrsetbyname.c with recent upstream changes
|
|||
|
|
|
|||
|
|
commit 385ecb31e147dfea59c1c488a1d2011d3867e60e
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Tue Apr 30 06:23:51 2024 +0000
|
|||
|
|
|
|||
|
|
upstream: fix home-directory extension implementation, it always
|
|||
|
|
|
|||
|
|
returned the current user's home directory contrary to the spec.
|
|||
|
|
|
|||
|
|
Patch from Jakub Jelen via GHPR477
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: 5afd775eab7f9cbe222d7fbae4c793de6c3b3d28
|
|||
|
|
|
|||
|
|
commit 14e2b16bc67ffcc188906f65008667e22f73d103
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Tue Apr 30 06:16:55 2024 +0000
|
|||
|
|
|
|||
|
|
upstream: flush stdout after writing "sftp>" prompt when not using
|
|||
|
|
|
|||
|
|
editline.
|
|||
|
|
|
|||
|
|
From Alpine Linux via GHPR480
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: 80bdc7ffe0358dc090eb9b93e6dedb2b087b24cd
|
|||
|
|
|
|||
|
|
commit 2e69a724051488e3fb3cd11531c4b5bc1764945b
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Tue Apr 30 05:53:03 2024 +0000
|
|||
|
|
|
|||
|
|
upstream: stricter validation of messaging socket fd number; disallow
|
|||
|
|
|
|||
|
|
usage of stderr. Based on GHPR492 by RealHurrison
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: 73dbbe82ea16f73ce1d044d3232bc869ae2f2ce8
|
|||
|
|
|
|||
|
|
commit da757b022bf18c6f7d04e685a10cd96ed00f83da
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Tue Apr 30 05:45:56 2024 +0000
|
|||
|
|
|
|||
|
|
upstream: add missing reserved fields to key constraint protocol
|
|||
|
|
|
|||
|
|
documentation.
|
|||
|
|
|
|||
|
|
from Wiktor Kwapisiewicz via GHPR487
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: 0dfb69998cfdb3fa00cbb0e7809e7d2f6126e3df
|
|||
|
|
|
|||
|
|
commit 16d0b82fa08038f35f1b3630c70116979f49784f
|
|||
|
|
Author: Damien Miller <djm@mindrot.org>
|
|||
|
|
Date: Tue Apr 30 12:39:34 2024 +1000
|
|||
|
|
|
|||
|
|
depend
|
|||
|
|
|
|||
|
|
commit 66aaa678dbe59aa21d0d9d89a3596ecedde0254b
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Tue Apr 30 02:14:10 2024 +0000
|
|||
|
|
|
|||
|
|
upstream: correctly restore sigprocmask around ppoll() reported
|
|||
|
|
|
|||
|
|
by Tõivo Leedjärv; ok deraadt@
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: c0c0f89de5294a166578f071eade2501929c4686
|
|||
|
|
|
|||
|
|
commit 80fb0eb21551aed3aebb009ab20aeffeb01e44e0
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Tue Apr 30 02:10:49 2024 +0000
|
|||
|
|
|
|||
|
|
upstream: add explict check for server hostkey type against
|
|||
|
|
|
|||
|
|
HostkeyAlgorithms. Allows HostkeyAlgorithms to disable implicit fallback from
|
|||
|
|
certificate keys to plain keys. ok markus@
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: 364087e4a395ff9b2f42bf3aefdb2090bb23643a
|
|||
|
|
|
|||
|
|
commit 5b28096d31ff7d80748fc845553a4aef5bb05d86
|
|||
|
|
Author: jsg@openbsd.org <jsg@openbsd.org>
|
|||
|
|
Date: Tue Apr 23 13:34:50 2024 +0000
|
|||
|
|
|
|||
|
|
upstream: correct indentation; no functional change ok tb@
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: dd9702fd43de546bc6a3f4f025c74d6f3692a0d4
|
|||
|
|
|
|||
|
|
commit fd3cb8a82784e05f621dea5b56ac6f89bc53c067
|
|||
|
|
Author: semarie@openbsd.org <semarie@openbsd.org>
|
|||
|
|
Date: Thu Apr 4 16:00:51 2024 +0000
|
|||
|
|
|
|||
|
|
upstream: set right mode on ssh-agent at boot-time
|
|||
|
|
|
|||
|
|
which sthen@
|
|||
|
|
ok deraadt@
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: 662b5056a2c6171563e1626f9c69f27862b5e7af
|
|||
|
|
|
|||
|
|
commit 54343a260e3aa4bceca1852dde31cd08e2abd82b
|
|||
|
|
Author: deraadt@openbsd.org <deraadt@openbsd.org>
|
|||
|
|
Date: Tue Apr 2 12:22:38 2024 +0000
|
|||
|
|
|
|||
|
|
upstream: Oops, incorrect hex conversion spotted by claudio.
|
|||
|
|
|
|||
|
|
While here try to improve how it reads a bit better. Surprising the
|
|||
|
|
regression tests didn't spot this error, maybe it fails to roundtrip the
|
|||
|
|
values.
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: 866cfcc1955aef8f3fc32da0b70c353a1b859f2e
|
|||
|
|
|
|||
|
|
commit ec78c31409590ad74efc194f886273ed080a545a
|
|||
|
|
Author: deraadt@openbsd.org <deraadt@openbsd.org>
|
|||
|
|
Date: Tue Apr 2 10:02:08 2024 +0000
|
|||
|
|
|
|||
|
|
upstream: for parse_ipqos(), use strtonum() instead of mostly
|
|||
|
|
|
|||
|
|
idiomatic strtoul(), but wow it's so gross. ok djm
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: cec14a76af2eb7b225300c80fc0e21052be67b05
|
|||
|
|
|
|||
|
|
commit 8176e1a6c2e6da9361a7abb6fbf6c23c299f495b
|
|||
|
|
Author: deraadt@openbsd.org <deraadt@openbsd.org>
|
|||
|
|
Date: Tue Apr 2 09:56:58 2024 +0000
|
|||
|
|
|
|||
|
|
upstream: can shortcut by returning strtonum() value directly; ok
|
|||
|
|
|
|||
|
|
djm
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: 7bb2dd3d6d1f288dac14247d1de446e3d7ba8b8e
|
|||
|
|
|
|||
|
|
commit 9f543d7022a781f80bb696f9d73f1d1c6f9e31d6
|
|||
|
|
Author: deraadt@openbsd.org <deraadt@openbsd.org>
|
|||
|
|
Date: Tue Apr 2 09:52:14 2024 +0000
|
|||
|
|
|
|||
|
|
upstream: rewrite convtime() to use a isdigit-scanner and
|
|||
|
|
|
|||
|
|
strtonum() instead of strange strtoul can might be fooled by garage
|
|||
|
|
characters. passes regress/usr.bin/ssh/unittests/misc ok djm
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: 4b1ef826bb16047aea3f3bdcb385b72ffd450abc
|
|||
|
|
|
|||
|
|
commit 8673137f780d8d9e4cda3c4605cb5d88d5cea271
|
|||
|
|
Author: claudio@openbsd.org <claudio@openbsd.org>
|
|||
|
|
Date: Tue Apr 2 09:48:24 2024 +0000
|
|||
|
|
|
|||
|
|
upstream: Remove unused ptr[3] char array in pkcs11_decode_hex.
|
|||
|
|
|
|||
|
|
OK deraadt@
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: 3d14433e39fd558f662d3b0431c4c555ef920481
|
|||
|
|
|
|||
|
|
commit c7fec708f331f108343d69e4d74c9a5d86d6cfe7
|
|||
|
|
Author: deraadt@openbsd.org <deraadt@openbsd.org>
|
|||
|
|
Date: Tue Apr 2 09:32:28 2024 +0000
|
|||
|
|
|
|||
|
|
upstream: Replace non-idiomatic strtoul(, 16) to parse a region
|
|||
|
|
|
|||
|
|
of 2-character hex sequences with a low-level replacement designed just for
|
|||
|
|
the task. ok djm
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: 67bab8b8a4329a19a0add5085eacd6f4cc215e85
|
|||
|
|
|
|||
|
|
commit 019a5f483b0f588da6270ec401d0b4bb35032f3f
|
|||
|
|
Author: deraadt@openbsd.org <deraadt@openbsd.org>
|
|||
|
|
Date: Tue Apr 2 09:29:31 2024 +0000
|
|||
|
|
|
|||
|
|
upstream: Use strtonum() instead of severely non-idomatic
|
|||
|
|
|
|||
|
|
strtoul() In particular this will now reject trailing garbage, ie.
|
|||
|
|
'12garbage'. ok djm
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: c82d95e3ccbfedfc91a8041c2f8bf0cf987d1501
|
|||
|
|
|
|||
|
|
commit 8231ca046fa39ea4eb99b79e0a6e09dec50ac952
|
|||
|
|
Author: deraadt@openbsd.org <deraadt@openbsd.org>
|
|||
|
|
Date: Mon Apr 1 15:50:17 2024 +0000
|
|||
|
|
|
|||
|
|
upstream: also create a relink kit for ssh-agent, since it is a
|
|||
|
|
|
|||
|
|
long-running setgid program carrying keys with some (not very powerful)
|
|||
|
|
communication channels. solution for testing the binary from dtucker.
|
|||
|
|
agreement from djm. Will add it into /etc/rc in a few days.
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: 2fe8d707ae35ba23c7916adcb818bb5b66837ba0
|
|||
|
|
|
|||
|
|
commit bf7bf50bd6a14e49c9c243cb8f4de31e555a5a2e
|
|||
|
|
Author: deraadt@openbsd.org <deraadt@openbsd.org>
|
|||
|
|
Date: Mon Apr 1 15:48:16 2024 +0000
|
|||
|
|
|
|||
|
|
upstream: new-style relink kit for sshd. The old scheme created
|
|||
|
|
|
|||
|
|
a Makefile by concatenating two Makefiles and was incredibly fragile. In the
|
|||
|
|
new way a narrow-purposed install.sh script is created and shipped with the
|
|||
|
|
objects. A recently commited /etc/rc script understands these files.
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: ef9341d5a50f0d33e3a6fbe995e92964bc7ef2d3
|
|||
|
|
|
|||
|
|
commit 00e63688920905e326d8667cb47f17a156b6dc8f
|
|||
|
|
Author: renmingshuai <renmingshuai@huawei.com>
|
|||
|
|
Date: Fri Apr 12 10:20:49 2024 +0800
|
|||
|
|
|
|||
|
|
Shell syntax fix (leftover from a sync).
|
|||
|
|
|
|||
|
|
Signed-off-by: renmingshuai <renmingshuai@huawei.com>
|
|||
|
|
|
|||
|
|
commit 2eded551ba96e66bc3afbbcc883812c2eac02bd7
|
|||
|
|
Author: Darren Tucker <dtucker@dtucker.net>
|
|||
|
|
Date: Thu Apr 25 13:20:19 2024 +1000
|
|||
|
|
|
|||
|
|
Merge flags for OpenSSL 3.x versions.
|
|||
|
|
|
|||
|
|
OpenSSL has moved to 3.4 which we don't currently accept. Based on
|
|||
|
|
the OpenSSL versioning policy[0] it looks like all of the 3.x versions
|
|||
|
|
should work with OpenSSH, so remove the distinction in configure and
|
|||
|
|
accept all of them.
|
|||
|
|
|
|||
|
|
[0] https://openssl.org/policies/general/versioning-policy.html
|
|||
|
|
|
|||
|
|
commit 8673245918081c6d1dc7fb3733c8eb2c5a902c5e
|
|||
|
|
Author: Darren Tucker <dtucker@dtucker.net>
|
|||
|
|
Date: Thu Apr 25 13:19:03 2024 +1000
|
|||
|
|
|
|||
|
|
Remove 9.6 branch from status page.
|
|||
|
|
|
|||
|
|
commit 70d43049747fa3c66cf876d52271859407cec2fa
|
|||
|
|
Author: Darren Tucker <dtucker@dtucker.net>
|
|||
|
|
Date: Thu Apr 25 13:16:58 2024 +1000
|
|||
|
|
|
|||
|
|
Update LibreSSL and OpenSSL versions tested.
|
|||
|
|
|
|||
|
|
Update LibreSSL versions to current releases (3.8.4 & 3.9.1).
|
|||
|
|
Add newly-released OpenSSL 3.3.0, and add tests against the 3.1 and
|
|||
|
|
3.3 branches.
|
|||
|
|
|
|||
|
|
commit 88351eca17dcc55189991ba60e50819b6d4193c1
|
|||
|
|
Author: 90 <hi@90.gripe>
|
|||
|
|
Date: Fri Apr 5 19:36:06 2024 +0100
|
|||
|
|
|
|||
|
|
Fix missing header for systemd notification
|
|||
|
|
|
|||
|
|
commit 08f579231cd38a1c657aaa6ddeb8ab57a1fd4f5c
|
|||
|
|
Author: Damien Miller <djm@mindrot.org>
|
|||
|
|
Date: Wed Apr 3 14:40:32 2024 +1100
|
|||
|
|
|
|||
|
|
notify systemd on listen and reload
|
|||
|
|
|
|||
|
|
Standalone implementation that does not depend on libsystemd.
|
|||
|
|
With assistance from Luca Boccassi, and feedback/testing from Colin
|
|||
|
|
Watson. bz2641
|
|||
|
|
|
|||
|
|
commit 43e7c1c07cf6aae7f4394ca8ae91a3efc46514e2
|
|||
|
|
Author: Darren Tucker <dtucker@dtucker.net>
|
|||
|
|
Date: Sun Mar 31 21:51:57 2024 +1100
|
|||
|
|
|
|||
|
|
Port changes from selfhosted to upstream tests.
|
|||
|
|
|
|||
|
|
Should get them working again.
|
|||
|
|
|
|||
|
|
commit 281ea25a44bff53eefb4af7bab7aa670b1f8b6b2
|
|||
|
|
Author: Darren Tucker <dtucker@dtucker.net>
|
|||
|
|
Date: Sat Mar 30 18:20:16 2024 +1100
|
|||
|
|
|
|||
|
|
Check if OpenSSL implementation supports DSA.
|
|||
|
|
|
|||
|
|
If --enable/disable-dsa-keys is not specified, set based on what OpenSSL
|
|||
|
|
supports. If specified as enabled, but not supported by OpenSSL error
|
|||
|
|
out. ok djm@
|
|||
|
|
|
|||
|
|
commit 2d2c068de8d696fe3246f390b146197f51ea1e83
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Sat Mar 30 05:56:22 2024 +0000
|
|||
|
|
|
|||
|
|
upstream: in OpenSSH private key format, correct type for subsequent
|
|||
|
|
|
|||
|
|
private keys in blob. From Jakub Jelen via GHPR430
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: d17dbf47554de2d752061592f95b5d772baab50b
|
|||
|
|
|
|||
|
|
commit c2c0bdd3e96b3ef66d77fccb85ff4962dc76caf0
|
|||
|
|
Author: Eero Häkkinen <Eero+git@xn--Hkkinen-5wa.fi>
|
|||
|
|
Date: Sat Sep 16 00:55:08 2023 +0300
|
|||
|
|
|
|||
|
|
Expose SSH_AUTH_INFO_0 always to PAM auth modules.
|
|||
|
|
|
|||
|
|
This changes SSH_AUTH_INFO_0 to be exposed to PAM auth modules also
|
|||
|
|
when a password authentication method is in use and not only
|
|||
|
|
when a keyboard-interactive authentication method is in use.
|
|||
|
|
|
|||
|
|
commit 02c5ad23124ae801cf248d99ea5068fc4331ca01
|
|||
|
|
Author: Darren Tucker <dtucker@dtucker.net>
|
|||
|
|
Date: Wed Mar 27 17:42:58 2024 +1100
|
|||
|
|
|
|||
|
|
Rearrange selfhosted VM scheduling.
|
|||
|
|
|
|||
|
|
Instead of trying to infer the type of the self hosted tests in each of
|
|||
|
|
the driver scripts (inconsistently...), set one of the following
|
|||
|
|
variables to "true" in the workflow:
|
|||
|
|
|
|||
|
|
VM: tests run in a virtual machine.
|
|||
|
|
EPHEMERAL: tests run on an ephemeral virtual machine.
|
|||
|
|
PERSISTENT: tests run on a persistent virtual machine
|
|||
|
|
REMOTE: tests run on a physical remote host.
|
|||
|
|
|
|||
|
|
EPHEMERAL VMs can have multiple instances of any given VM can exist
|
|||
|
|
simultaneously and are run by a runner pool. The other types have a
|
|||
|
|
dedicated runner instance and can only run a single test at a time.
|
|||
|
|
|
|||
|
|
Other settings:
|
|||
|
|
SSHFS: We need to sshfs mount over the repo so the workflow can collect
|
|||
|
|
build artifacts. This also implies the tests must be run over ssh.
|
|||
|
|
DEBUG_ACTIONS: enable "set -x" in scripts for debugging.
|
|||
|
|
|
|||
|
|
commit cd8a72707c02615365d0851ac51063ab6bfe258f
|
|||
|
|
Author: Damien Miller <djm@mindrot.org>
|
|||
|
|
Date: Sat Mar 30 16:05:59 2024 +1100
|
|||
|
|
|
|||
|
|
add new token-based signing key for dtucker@
|
|||
|
|
|
|||
|
|
Verified in person and via signature with old key.
|
|||
|
|
Will remove old key in a bit.
|
|||
|
|
|
|||
|
|
commit 8d0e46c1ddb5b7f0992591b0dc5d8aaa77cc9dba
|
|||
|
|
Author: Alkaid <zgf574564920@gmail.com>
|
|||
|
|
Date: Tue Mar 12 03:59:12 2024 -0700
|
|||
|
|
|
|||
|
|
Fix OpenSSL ED25519 support detection
|
|||
|
|
|
|||
|
|
Wrong function signature in configure.ac prevents openssh from enabling
|
|||
|
|
the recently new support for ED25519 priv keys in PEM PKCS8 format.
|
|||
|
|
|
|||
|
|
commit 697359be9c23ee43618243cdbcc9c7981e766752
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Sat Mar 30 04:27:44 2024 +0000
|
|||
|
|
|
|||
|
|
upstream: allow WAYLAND_DISPLAY to enable SSH_ASKPASS
|
|||
|
|
|
|||
|
|
From dkg via GHPR479; ok dtucker@
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: 1ac1f9c45da44eabbae89375393c662349239257
|
|||
|
|
|
|||
|
|
commit 7844705b0364574cc70b941be72036c2c2966363
|
|||
|
|
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
|||
|
|
Date: Fri Mar 29 10:40:07 2024 +0000
|
|||
|
|
|
|||
|
|
upstream: Use egrep instead of grep -E.
|
|||
|
|
|
|||
|
|
Some plaforms don't have the latter so this makes things easier
|
|||
|
|
in -portable.
|
|||
|
|
|
|||
|
|
OpenBSD-Regress-ID: ff82260eb0db1f11130200b25d820cf73753bbe3
|
|||
|
|
|
|||
|
|
commit 22b2b6c555334bffdf357a2e4aa74308b03b83c3
|
|||
|
|
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
|||
|
|
Date: Tue Mar 26 08:09:16 2024 +0000
|
|||
|
|
|
|||
|
|
upstream: test -h is the POSIXly way of testing for a symlink. Reduces
|
|||
|
|
|
|||
|
|
diff vs Portable.
|
|||
|
|
|
|||
|
|
OpenBSD-Regress-ID: 6f31cd6e231e3b8c5c2ca0307573ccb7484bff7d
|
|||
|
|
|
|||
|
|
commit edcff77f82c2bb2b5653b36f1e47274c5ef3e8be
|
|||
|
|
Author: Darren Tucker <dtucker@dtucker.net>
|
|||
|
|
Date: Tue Mar 26 18:58:58 2024 +1100
|
|||
|
|
|
|||
|
|
Fix name of OpenBSD upstream CI jobs.
|
|||
|
|
|
|||
|
|
commit 861b084429940e024f1b6e9c2779eac95d7a45db
|
|||
|
|
Author: Darren Tucker <dtucker@dtucker.net>
|
|||
|
|
Date: Tue Mar 26 18:55:33 2024 +1100
|
|||
|
|
|
|||
|
|
Resync with upstream: ${} around DATAFILE.
|
|||
|
|
|
|||
|
|
commit 63f248c7693e7f0a3b9a13d2980ac9a7e37f2aea
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Mon Mar 25 19:28:09 2024 +0000
|
|||
|
|
|
|||
|
|
upstream: optional debugging
|
|||
|
|
|
|||
|
|
OpenBSD-Regress-ID: b4852bf97ac8fb2e3530f2d5f999edd66058d7bc
|
|||
|
|
|
|||
|
|
commit 16e2ebe06a62f09d4877b769876d92d6008a896f
|
|||
|
|
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
|||
|
|
Date: Mon Mar 25 06:05:42 2024 +0000
|
|||
|
|
|
|||
|
|
upstream: Verify string returned from local shell command.
|
|||
|
|
|
|||
|
|
OpenBSD-Regress-ID: 5039bde24d33d809aebfa8d3ad7fe9053224e6f8
|
|||
|
|
|
|||
|
|
commit b326f7a1f39ff31324cc3fe2735178fb474c04a4
|
|||
|
|
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
|||
|
|
Date: Mon Mar 25 03:30:31 2024 +0000
|
|||
|
|
|
|||
|
|
upstream: Improve shell portability: grep -q is not portable so
|
|||
|
|
|
|||
|
|
redirect stdout, and use printf instead of relying on echo to do \n
|
|||
|
|
substitution. Reduces diff vs Portable.
|
|||
|
|
|
|||
|
|
Also resync somewhat with upstream.
|
|||
|
|
|
|||
|
|
OpenBSD-Regress-ID: 9ae876a8ec4c4725f1e9820a0667360ee2398337
|
|||
|
|
|
|||
|
|
commit dbf2e319f0c582613fa45a735ea3c242ce56946b
|
|||
|
|
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
|||
|
|
Date: Mon Mar 25 02:07:08 2024 +0000
|
|||
|
|
|
|||
|
|
upstream: Save error code from SSH for use inside case statement,
|
|||
|
|
|
|||
|
|
from portable. In some shells, "case" will reset the value of $?, so save it
|
|||
|
|
first.
|
|||
|
|
|
|||
|
|
OpenBSD-Regress-ID: da32e5be19299cb4f0f7de7f29c11257a62d6949
|
|||
|
|
|
|||
|
|
commit d2c8c4fa7def4fb057ed05b3db57b62c810a26f6
|
|||
|
|
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
|||
|
|
Date: Mon Mar 25 01:40:47 2024 +0000
|
|||
|
|
|
|||
|
|
upstream: Increase timeout. Resyncs with portable where some of
|
|||
|
|
|
|||
|
|
the test VMs are slow enough for this to matter.
|
|||
|
|
|
|||
|
|
OpenBSD-Regress-ID: 6a83a693602eb0312f06a4ad2cd6f40d99d24b26
|
|||
|
|
|
|||
|
|
commit 83621b63514a84791623db3efb59d38bc4bf9563
|
|||
|
|
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
|||
|
|
Date: Mon Mar 25 01:28:29 2024 +0000
|
|||
|
|
|
|||
|
|
upstream: In PuTTY interop test, don't assume the PuTTY major
|
|||
|
|
|
|||
|
|
version is 0. Patch from cjwatson at debian.org via bz#3671.
|
|||
|
|
|
|||
|
|
OpenBSD-Regress-ID: 835ed03c1b04ad46be82e674495521f11b840191
|
|||
|
|
|
|||
|
|
commit 8a421b927700f3834b4d985778e252b8e3299f83
|
|||
|
|
Author: Darren Tucker <dtucker@dtucker.net>
|
|||
|
|
Date: Tue Mar 26 18:38:14 2024 +1100
|
|||
|
|
|
|||
|
|
Really mkdir /usr/local/etc in CI tests.
|
|||
|
|
|
|||
|
|
commit 2946ed522c47ce045314533d426b4e379f745e59
|
|||
|
|
Author: Darren Tucker <dtucker@dtucker.net>
|
|||
|
|
Date: Tue Mar 26 17:19:09 2024 +1100
|
|||
|
|
|
|||
|
|
Better short name for OpenBSD upstream CI jobs too.
|
|||
|
|
|
|||
|
|
commit 18dbe8eff647aacb82d7e86b4ce63d5beee11f25
|
|||
|
|
Author: Darren Tucker <dtucker@dtucker.net>
|
|||
|
|
Date: Tue Mar 26 17:13:52 2024 +1100
|
|||
|
|
|
|||
|
|
Ensure /usr/local/etc exists before using in tests.
|
|||
|
|
|
|||
|
|
commit 5fc1085128e3348bb1b5ee4d955cc767b019b3ad
|
|||
|
|
Author: Darren Tucker <dtucker@dtucker.net>
|
|||
|
|
Date: Tue Mar 26 16:50:46 2024 +1100
|
|||
|
|
|
|||
|
|
Be more specific about when to rerun workflows.
|
|||
|
|
|
|||
|
|
commit 5516923e8ae3da0823fea0d7d28aa813627142c0
|
|||
|
|
Author: Darren Tucker <dtucker@dtucker.net>
|
|||
|
|
Date: Tue Mar 26 16:35:27 2024 +1100
|
|||
|
|
|
|||
|
|
Add short names for test jobs on github CI.
|
|||
|
|
|
|||
|
|
commit dc37d2d2470b4a9cedcee9ac926b7362214e3305
|
|||
|
|
Author: Darren Tucker <dtucker@dtucker.net>
|
|||
|
|
Date: Tue Mar 26 16:26:14 2024 +1100
|
|||
|
|
|
|||
|
|
If we're using xpg4's id, remember to pass args.
|
|||
|
|
|
|||
|
|
commit fe169487937780392b23d3ff3c00e5898c10f784
|
|||
|
|
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
|||
|
|
Date: Tue Mar 26 01:23:11 2024 +0000
|
|||
|
|
|
|||
|
|
upstream: Import regenerated moduli.
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: ad3d1486d105b008c93e952d158e5af4d9d4c531
|
|||
|
|
|
|||
|
|
commit 151146f03b490d19145cd421763aa7d42f5c50e2
|
|||
|
|
Author: job@openbsd.org <job@openbsd.org>
|
|||
|
|
Date: Thu Mar 14 06:23:14 2024 +0000
|
|||
|
|
|
|||
|
|
upstream: Clarify how literal IPv6 addresses can be used in -J mode
|
|||
|
|
|
|||
|
|
OK djm@
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: 524ddae97746b3563ad4a887dfd0a6e6ba114c50
|
|||
|
|
|
|||
|
|
commit 0d5bdc87a675271862b67eb6a9fb13a202fb4894
|
|||
|
|
Author: Darren Tucker <dtucker@dtucker.net>
|
|||
|
|
Date: Mon Mar 25 16:14:21 2024 +1100
|
|||
|
|
|
|||
|
|
Add Mac OS X 14 test targets.
|
|||
|
|
|
|||
|
|
commit 2d7964a03e1f50a48040ec6912c0a956df909d21
|
|||
|
|
Author: Darren Tucker <dtucker@dtucker.net>
|
|||
|
|
Date: Mon Mar 25 14:05:40 2024 +1100
|
|||
|
|
|
|||
|
|
Move xpg4 'id' handling into test-exec.sh.
|
|||
|
|
|
|||
|
|
Handle replacement of 'id' the same way as we do other Portable specific
|
|||
|
|
replacements in test-exec.sh. This brings percent.sh back into sync
|
|||
|
|
with upstream.
|
|||
|
|
|
|||
|
|
commit 75d1d49ed10d978171cdafad28bdbffdbd48f41e
|
|||
|
|
Author: Darren Tucker <dtucker@dtucker.net>
|
|||
|
|
Date: Mon Mar 25 10:38:03 2024 +1100
|
|||
|
|
|
|||
|
|
Update branches shown on ci-status to 9.7 and 9.6.
|
|||
|
|
|
|||
|
|
commit f9193f03db0029fc9c31fbdb5c66a2737446bd8f
|
|||
|
|
Author: Darren Tucker <dtucker@dtucker.net>
|
|||
|
|
Date: Mon Mar 25 09:28:02 2024 +1100
|
|||
|
|
|
|||
|
|
Improve detection of -fzero-call-used-regs=used.
|
|||
|
|
|
|||
|
|
Should better detect problems with gcc 13 on m68k. bz#3673 from Colin
|
|||
|
|
Watson via bz#3673 and https://gcc.gnu.org/bugzilla/show_bug.cgi?id=110934
|
|||
|
|
|
|||
|
|
Signed-off-by: Darren Tucker <dtucker@dtucker.net>
|
|||
|
|
|
|||
|
|
commit 86bdd3853f4d32c85e295e6216a2fe0953ad93f0
|
|||
|
|
Author: Damien Miller <djm@mindrot.org>
|
|||
|
|
Date: Mon Mar 11 16:20:49 2024 +1100
|
|||
|
|
|
|||
|
|
version number in README
|
|||
|
|
|
|||
|
|
commit 282721418e6465bc39ccfd39bb0133e670ee4423
|
|||
|
|
Author: Damien Miller <djm@mindrot.org>
|
|||
|
|
Date: Mon Mar 11 16:20:08 2024 +1100
|
|||
|
|
|
|||
|
|
crank RPM spec versions
|
|||
|
|
|
|||
|
|
commit 3876a3bbd2ca84d23ba20f8b69ba83270c04ce3a
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Mon Mar 11 04:59:47 2024 +0000
|
|||
|
|
|
|||
|
|
upstream: openssh-9.7
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: 618ececf58b8cdae016b149787af06240f7b0cbc
|
|||
|
|
|
|||
|
|
commit 8fc109cc614954a8eb2738c48c0db36a62af9a06
|
|||
|
|
Author: Darren Tucker <dtucker@dtucker.net>
|
|||
|
|
Date: Mon Mar 11 12:59:26 2024 +1100
|
|||
|
|
|
|||
|
|
Test against current OpenSSL and LibreSSL releases.
|
|||
|
|
|
|||
|
|
Add LibreSSL 3.9.0, bump older branches to their respective current
|
|||
|
|
releases.
|
|||
|
|
|
|||
|
|
commit 26b09b45fec7b88ba09042c09be4157e58e231e2
|
|||
|
|
Author: Damien Miller <djm@mindrot.org>
|
|||
|
|
Date: Sun Mar 10 16:24:57 2024 +1100
|
|||
|
|
|
|||
|
|
quote regexes used to test for algorithm support
|
|||
|
|
|
|||
|
|
Fixes test failures on Solaris 8 reported by Tom G. Christensen
|
|||
|
|
|
|||
|
|
commit a6a740a4948d10a622b505135bb485c10f21db5e
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Sat Mar 9 05:12:13 2024 +0000
|
|||
|
|
|
|||
|
|
upstream: avoid logging in signal handler by converting mainloop to
|
|||
|
|
|
|||
|
|
ppoll() bz3670, reported by Ben Hamilton; ok dtucker@
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: e58f18042b86425405ca09e6e9d7dfa1df9f5f7f
|
|||
|
|
|
|||
|
|
commit cd82f7526e0481720567ae41db7849ab1c27e27b
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Fri Mar 8 22:16:32 2024 +0000
|
|||
|
|
|
|||
|
|
upstream: skip more whitespace, fixes find-principals on
|
|||
|
|
|
|||
|
|
allowed_signers files with blank lines; reported by Wiktor Kwapisiewicz
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: b3a22a2afd753d70766f34bc7f309c03706b5298
|
|||
|
|
|
|||
|
|
commit 2f9d2af5cb19905d87f37d1e11c9f035ac5daf3b
|
|||
|
|
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
|||
|
|
Date: Fri Mar 8 11:34:10 2024 +0000
|
|||
|
|
|
|||
|
|
upstream: Invoke ProxyCommand that uses stderr redirection via
|
|||
|
|
|
|||
|
|
$TEST_SHELL. Fixes test when run by a user whose login shell is tcsh.
|
|||
|
|
Found by vinschen at redhat.com.
|
|||
|
|
|
|||
|
|
OpenBSD-Regress-ID: f68d79e7f00caa8d216ebe00ee5f0adbb944062a
|
|||
|
|
|
|||
|
|
commit 9b3f0beb4007a7e01dfedabb429097fb593deae6
|
|||
|
|
Author: Darren Tucker <dtucker@dtucker.net>
|
|||
|
|
Date: Thu Mar 7 17:18:14 2024 +1100
|
|||
|
|
|
|||
|
|
Prefer openssl binary from --with-ssl-dir directory.
|
|||
|
|
|
|||
|
|
Use openssl in the directory specified by --with-ssl-dir as long
|
|||
|
|
as it's functional. Reported by The Doctor.
|
|||
|
|
|
|||
|
|
commit c47e1c9c7911f38b2fc2fb01b1f6ae3a3121a838
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Wed Mar 6 02:59:59 2024 +0000
|
|||
|
|
|
|||
|
|
upstream: fix memory leak in mux proxy mode when requesting forwarding.
|
|||
|
|
|
|||
|
|
found by RASU JSC, reported by Maks Mishin in GHPR#467
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: 97d96a166b1ad4b8d229864a553e3e56d3116860
|
|||
|
|
|
|||
|
|
commit 242742827fea4508e68097c128e802edc79addb5
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Wed Mar 6 00:31:04 2024 +0000
|
|||
|
|
|
|||
|
|
upstream: wrap a few PKCS#11-specific bits in ENABLE_PKCS11
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: 463e4a69eef3426a43a2b922c4e7b2011885d923
|
|||
|
|
|
|||
|
|
commit d52b6509210e2043f33e5a1de58dd4a0d5d48c2a
|
|||
|
|
Author: Damien Miller <djm@mindrot.org>
|
|||
|
|
Date: Wed Mar 6 11:31:36 2024 +1100
|
|||
|
|
|
|||
|
|
disable RSA tests when algorithm is not supported
|
|||
|
|
|
|||
|
|
Unbreaks "make test" when compiled --without-openssl.
|
|||
|
|
|
|||
|
|
Similar treatment to how we do DSA and ECDSA.
|
|||
|
|
|
|||
|
|
commit 668d270a6c77e8b5a1da26ecad2e6de9f62c8fe4
|
|||
|
|
Author: Damien Miller <djm@mindrot.org>
|
|||
|
|
Date: Wed Mar 6 10:33:20 2024 +1100
|
|||
|
|
|
|||
|
|
add a --without-retpoline configure option
|
|||
|
|
|
|||
|
|
discussed with deraadt and dtucker a while ago
|
|||
|
|
|
|||
|
|
commit 3deb501f86fc47e175ef6a3eaba9b9846a80d444
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Mon Mar 4 04:13:18 2024 +0000
|
|||
|
|
|
|||
|
|
upstream: fix leak of CanonicalizePermittedCNAMEs on error path;
|
|||
|
|
|
|||
|
|
spotted by Coverity (CID 438039)
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: 208839699939721f452a4418afc028a9f9d3d8af
|
|||
|
|
|
|||
|
|
commit 65a44a8a4f7d902a64d4e60eda84384b2e2a24a2
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Mon Mar 4 02:16:11 2024 +0000
|
|||
|
|
|
|||
|
|
upstream: Separate parsing of string array options from applying them
|
|||
|
|
|
|||
|
|
to the active configuration. This fixes the config parser from erroneously
|
|||
|
|
rejecting cases like:
|
|||
|
|
|
|||
|
|
AuthenticationMethods password
|
|||
|
|
Match User ivy
|
|||
|
|
AuthenticationMethods any
|
|||
|
|
|
|||
|
|
bz3657 ok markus@
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: 7f196cba634c2a3dba115f3fac3c4635a2199491
|
|||
|
|
|
|||
|
|
commit 6886e1b1f55c90942e4e6deed930f8ac32e0f938
|
|||
|
|
Author: Darren Tucker <dtucker@dtucker.net>
|
|||
|
|
Date: Thu Feb 22 17:59:35 2024 +1100
|
|||
|
|
|
|||
|
|
Add nbsd10 test target.
|
|||
|
|
|
|||
|
|
commit d86bf8a3f6ea4fa7887406c2aa9959db71fa41be
|
|||
|
|
Author: Damien Miller <djm@mindrot.org>
|
|||
|
|
Date: Thu Feb 22 12:06:10 2024 +1100
|
|||
|
|
|
|||
|
|
more descriptive configure test name
|
|||
|
|
|
|||
|
|
commit 9ee335aacc9f5bdc4cc2c19fafb45e27be7d234e
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Wed Feb 21 06:17:29 2024 +0000
|
|||
|
|
|
|||
|
|
upstream: explain arguments of internal-sftp GHPR#454 from Niklas
|
|||
|
|
|
|||
|
|
Hambüchen
|
|||
|
|
MIME-Version: 1.0
|
|||
|
|
Content-Type: text/plain; charset=UTF-8
|
|||
|
|
Content-Transfer-Encoding: 8bit
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: 0335d641ae6b5b6201b9ffd5dd06345ebbd0a3f3
|
|||
|
|
|
|||
|
|
commit d1164cb1001dd208fee88aaa9b43d5e6fd917274
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Wed Feb 21 06:06:43 2024 +0000
|
|||
|
|
|
|||
|
|
upstream: clarify permissions requirements for ChrootDirectory Part
|
|||
|
|
|
|||
|
|
of GHPR#454 from Niklas Hambüchen
|
|||
|
|
MIME-Version: 1.0
|
|||
|
|
Content-Type: text/plain; charset=UTF-8
|
|||
|
|
Content-Transfer-Encoding: 8bit
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: d37bc8786317a11649c62ff5e2936441186ef7a0
|
|||
|
|
|
|||
|
|
commit d410e17d186552d0717f18217d0d049486754365
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Wed Feb 21 06:05:06 2024 +0000
|
|||
|
|
|
|||
|
|
upstream: .Cm for a keyword. Part of GHPR#454 from Niklas Hambüchen
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: d59c52559f926fa82859035d79749fbb4a3ce18a
|
|||
|
|
|
|||
|
|
commit ab73f9678ebf06b32d6361b88b50b42775e0565b
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Wed Feb 21 06:01:13 2024 +0000
|
|||
|
|
|
|||
|
|
upstream: fix typo in match directive predicate (s/tagged/tag) GHPR#462
|
|||
|
|
|
|||
|
|
from Tobias Manske
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: 05b23b772677d48aa82eefd7ebebd369ae758908
|
|||
|
|
|
|||
|
|
commit 9844aa2521ccfb1a2d73745680327b79e0574445
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Wed Feb 21 05:57:34 2024 +0000
|
|||
|
|
|
|||
|
|
upstream: fix proxy multiplexing mode, broken when keystroke timing
|
|||
|
|
|
|||
|
|
obfuscation was added. GHPR#463 from montag451
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: 4e412d59b3f557d431f1d81c715a3bc0491cc677
|
|||
|
|
|
|||
|
|
commit ee6d932acb532f80b11bb7cf161668c70ec8a117
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Tue Feb 20 04:10:03 2024 +0000
|
|||
|
|
|
|||
|
|
upstream: don't append a gratuitous space to the end of subsystem
|
|||
|
|
|
|||
|
|
arguments; bz3667
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: e11023aeb3f30b77a674e37b8292c862926d5dc6
|
|||
|
|
|
|||
|
|
commit e27f032aa8fcbae9b2e7c451baaf4b8ac6fa3d45
|
|||
|
|
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
|||
|
|
Date: Mon Feb 19 09:25:52 2024 +0000
|
|||
|
|
|
|||
|
|
upstream: Always define puttysetup function.
|
|||
|
|
|
|||
|
|
OpenBSD-Regress-ID: b4c0ccfa4006a1bc5dfd99ccf21c854d3ce2aee0
|
|||
|
|
|
|||
|
|
commit 84046f9991abef5f46b040b10cf3d494f933a17b
|
|||
|
|
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
|||
|
|
Date: Fri Feb 9 08:56:59 2024 +0000
|
|||
|
|
|
|||
|
|
upstream: Exapnd PuTTY test coverage.
|
|||
|
|
|
|||
|
|
Expand the set of ciphers, MACs and KEX methods in the PuTTY interop
|
|||
|
|
tests.
|
|||
|
|
|
|||
|
|
OpenBSD-Regress-ID: dd28d97d48efe7329a396d0d505ee2907bf7fc57
|
|||
|
|
|
|||
|
|
commit bbf541ee2afe07b08a8b56fa0dc6f38fcfceef2a
|
|||
|
|
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
|||
|
|
Date: Fri Feb 9 08:47:42 2024 +0000
|
|||
|
|
|
|||
|
|
upstream: Factor out PuTTY setup.
|
|||
|
|
|
|||
|
|
Factor out PuTTY and call only when needed.
|
|||
|
|
|
|||
|
|
This allows us to avoid PuTTY key setup when it's not needed, which
|
|||
|
|
speeds up the overall test run by a couple of percent.
|
|||
|
|
|
|||
|
|
OpenBSD-Regress-ID: c25eaccc3c91bc874400f7c85ce40e9032358c1c
|
|||
|
|
|
|||
|
|
commit d31c21c57fb4245271680a1e5043cf6470a96766
|
|||
|
|
Author: naddy@openbsd.org <naddy@openbsd.org>
|
|||
|
|
Date: Sat Feb 10 11:28:52 2024 +0000
|
|||
|
|
|
|||
|
|
upstream: clean sshd random relinking kit; ok miod@
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: 509bb19bb9762a4b3b589af98bac2e730541b6d4
|
|||
|
|
|
|||
|
|
commit 4dbc5a363ff53a2fcecf6bc3bcc038badc12f118
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Fri Feb 2 00:13:34 2024 +0000
|
|||
|
|
|
|||
|
|
upstream: whitespace
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: b24680bc755b621ea801ff8edf6f0f02b68edae1
|
|||
|
|
|
|||
|
|
commit efde85dda2130272af24cc346f6c3cd326182ff1
|
|||
|
|
Author: Darren Tucker <dtucker@dtucker.net>
|
|||
|
|
Date: Mon Feb 19 17:29:31 2024 +1100
|
|||
|
|
|
|||
|
|
Improve error message for OpenSSL header check.
|
|||
|
|
|
|||
|
|
bz#3668, ok djm@
|
|||
|
|
|
|||
|
|
commit cbbdf868bce431a59e2fa36ca244d5739429408d
|
|||
|
|
Author: Darren Tucker <dtucker@dtucker.net>
|
|||
|
|
Date: Wed Feb 7 13:45:02 2024 +1100
|
|||
|
|
|
|||
|
|
Interop test against PuTTY snapshot and releases.
|
|||
|
|
|
|||
|
|
commit 91898bf786b0f149f962c4c96c08a46f29888c10
|
|||
|
|
Author: Darren Tucker <dtucker@dtucker.net>
|
|||
|
|
Date: Tue Feb 6 16:21:05 2024 +1100
|
|||
|
|
|
|||
|
|
Put privsep dir on OS X on /usr/local.
|
|||
|
|
|
|||
|
|
On some runners we can't create /var/empty, so put it some place we can
|
|||
|
|
write. Should fix test breakage on Max OS X 11.
|
|||
|
|
|
|||
|
|
commit be5ed8ebed8388c5056bfde4688308cc873c18b9
|
|||
|
|
Author: Darren Tucker <dtucker@dtucker.net>
|
|||
|
|
Date: Tue Feb 6 11:19:42 2024 +1100
|
|||
|
|
|
|||
|
|
Add --disable-fd-passing option.
|
|||
|
|
|
|||
|
|
.. and enable for the minix3 test VM. This will cause it to more reliably
|
|||
|
|
skip tests that need FD passing and should fix the current test breakage.
|
|||
|
|
|
|||
|
|
commit 0f6a8a0d0a518fd78c4cbebfdac990a57a1c4e41
|
|||
|
|
Author: Darren Tucker <dtucker@dtucker.net>
|
|||
|
|
Date: Tue Feb 6 11:18:44 2024 +1100
|
|||
|
|
|
|||
|
|
Use "skip" function instead doing it ourselves.
|
|||
|
|
|
|||
|
|
commit 3ad669f81aabbd2ba9fbd472903f680f598e1e99
|
|||
|
|
Author: Damien Miller <djm@mindrot.org>
|
|||
|
|
Date: Thu Feb 1 14:01:18 2024 +1100
|
|||
|
|
|
|||
|
|
ignore some vim droppings
|
|||
|
|
|
|||
|
|
commit c283f29d23611a06bbee06bcf458f2fffad721d9
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Thu Feb 1 02:37:33 2024 +0000
|
|||
|
|
|
|||
|
|
upstream: whitespace
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: bf9e4a1049562ee4322684fbdce07142f04fdbb7
|
|||
|
|
|
|||
|
|
commit 0d96b1506b2f4757fefa5d1f884d49e96a6fd4c3
|
|||
|
|
Author: Damien Miller <djm@mindrot.org>
|
|||
|
|
Date: Tue Jan 16 14:40:18 2024 +1100
|
|||
|
|
|
|||
|
|
skip tests that use multiplexing on Windows
|
|||
|
|
|
|||
|
|
Some tests here use multiplexing, skip these if DISABLE_FD_PASSING
|
|||
|
|
is set. Should unbreak tests on Windows.
|
|||
|
|
|
|||
|
|
commit 50080fa42f5f744b798ee29400c0710f1b59f50e
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Thu Jan 11 04:50:28 2024 +0000
|
|||
|
|
|
|||
|
|
upstream: don't disable RSA test when DSA is disabled; bug introduced
|
|||
|
|
|
|||
|
|
in last commit
|
|||
|
|
|
|||
|
|
OpenBSD-Regress-ID: 8780a7250bf742b33010e9336359a1c516f2d7b5
|
|||
|
|
|
|||
|
|
commit 415c94ce17288e0cdcb9e58cc91fba78d33c8457
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Thu Jan 11 01:45:58 2024 +0000
|
|||
|
|
|
|||
|
|
upstream: make DSA testing optional, defaulting to on
|
|||
|
|
|
|||
|
|
ok markus
|
|||
|
|
|
|||
|
|
OpenBSD-Regress-ID: dfc27b5574e3f19dc4043395594cea5f90b8572a
|
|||
|
|
|
|||
|
|
commit f9311e8921d92c5efca767227a497ab63280ac39
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Thu Jan 11 01:51:16 2024 +0000
|
|||
|
|
|
|||
|
|
upstream: ensure key_fd is filled when DSA is disabled; spotted by
|
|||
|
|
|
|||
|
|
tb@
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: 9dd417b6eec3cf67e870f147464a8d93f076dce7
|
|||
|
|
|
|||
|
|
commit 4e838120a759d187b036036610402cbda33f3203
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Thu Jan 11 01:45:36 2024 +0000
|
|||
|
|
|
|||
|
|
upstream: make DSA key support compile-time optional, defaulting to
|
|||
|
|
|
|||
|
|
on
|
|||
|
|
|
|||
|
|
ok markus@
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: 4f8e98fc1fd6de399d0921d5b31b3127a03f581d
|
|||
|
|
|
|||
|
|
commit afcc9028bfc411bc26d20bba803b83f90cb84e26
|
|||
|
|
Author: jmc@openbsd.org <jmc@openbsd.org>
|
|||
|
|
Date: Wed Jan 10 06:33:13 2024 +0000
|
|||
|
|
|
|||
|
|
upstream: fix incorrect capitalisation;
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: cb07eb06e15fa2334660ac73e98f29b6a1931984
|
|||
|
|
|
|||
|
|
commit 9707c8170c0c1baeb1e06e5a53f604498193885f
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Tue Jan 9 22:19:36 2024 +0000
|
|||
|
|
|
|||
|
|
upstream: extend ChannelTimeout regression test to exercise multiplexed
|
|||
|
|
|
|||
|
|
connections and the new "global" timeout type. ok dtucker@
|
|||
|
|
|
|||
|
|
OpenBSD-Regress-ID: f10d19f697024e9941acad7c2057f73d6eacb8a2
|
|||
|
|
|
|||
|
|
commit b31b12d28de96e1d43581d32f34da8db27e11c03
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Tue Jan 9 22:19:00 2024 +0000
|
|||
|
|
|
|||
|
|
upstream: add a "global" ChannelTimeout type to ssh(1) and sshd(8)
|
|||
|
|
|
|||
|
|
that watches all open channels and will close all open channels if there is
|
|||
|
|
no traffic on any of them for the specified interval. This is in addition to
|
|||
|
|
the existing per-channel timeouts added a few releases ago.
|
|||
|
|
|
|||
|
|
This supports use-cases like having a session + x11 forwarding channel
|
|||
|
|
open where one may be idle for an extended period but the other is
|
|||
|
|
actively used. The global timeout would allow closing both channels when
|
|||
|
|
both have been idle for too long.
|
|||
|
|
|
|||
|
|
ok dtucker@
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: 0054157d24d2eaa5dc1a9a9859afefc13d1d7eb3
|
|||
|
|
|
|||
|
|
commit 602f4beeeda5bb0eca181f8753d923a2997d0a51
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Tue Jan 9 21:39:14 2024 +0000
|
|||
|
|
|
|||
|
|
upstream: adapt ssh_api.c code for kex-strict
|
|||
|
|
|
|||
|
|
from markus@ ok me
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: 4d9f256852af2a5b882b12cae9447f8f00f933ac
|
|||
|
|
|
|||
|
|
commit 42ba34aba8708cf96583ff52975d95a8b47d990d
|
|||
|
|
Author: Damien Miller <djm@mindrot.org>
|
|||
|
|
Date: Mon Jan 8 16:26:37 2024 +1100
|
|||
|
|
|
|||
|
|
nite that recent OSX tun/tap is unsupported
|
|||
|
|
|
|||
|
|
commit 690bc125f9a3b20e47745fa8f5b5e1fd5820247f
|
|||
|
|
Author: Sevan Janiyan <venture37@geeklan.co.uk>
|
|||
|
|
Date: Wed Dec 27 04:57:49 2023 +0000
|
|||
|
|
|
|||
|
|
README.platform: update tuntap url
|
|||
|
|
|
|||
|
|
commit 6b8be2ccd7dd091808f86af52066b0c2ec30483a
|
|||
|
|
Author: Rose <83477269+AtariDreams@users.noreply.github.com>
|
|||
|
|
Date: Tue Dec 19 11:48:20 2023 -0500
|
|||
|
|
|
|||
|
|
Fix compilation error in ssh-pcks11-client.c
|
|||
|
|
|
|||
|
|
Compilation fails becaus of an undefined reference to helper_by_ec,
|
|||
|
|
because we forgot the preprocessor conditional that excludes that function
|
|||
|
|
from being called in unsupported configurations.
|
|||
|
|
|
|||
|
|
commit 219c8134157744886ee6ac5b8c1650abcd981f4c
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Mon Jan 8 05:11:18 2024 +0000
|
|||
|
|
|
|||
|
|
upstream: Remove outdated note from PROTOCOL.mux
|
|||
|
|
|
|||
|
|
Port forward close by control master is already implemented
|
|||
|
|
by `mux_master_process_close_fwd` in `mux.c`
|
|||
|
|
|
|||
|
|
GHPR442 from bigb4ng
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: ad0734fe5916d2dc7dd02b588906cea4df0482fb
|
|||
|
|
|
|||
|
|
commit 4c3cf362631ccc4ffd422e572f075d5d594feace
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Mon Jan 8 05:05:15 2024 +0000
|
|||
|
|
|
|||
|
|
upstream: fix missing field in users-groups-by-id@openssh.com reply
|
|||
|
|
|
|||
|
|
documentation
|
|||
|
|
|
|||
|
|
GHPR441 from TJ Saunders
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: ff5733ff6ef4cd24e0758ebeed557aa91184c674
|
|||
|
|
|
|||
|
|
commit f64cede2a3c298b50a2659a8b53eb3ab2c0b8d23
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Mon Jan 8 04:10:03 2024 +0000
|
|||
|
|
|
|||
|
|
upstream: make kex-strict section more explicit about its intent:
|
|||
|
|
|
|||
|
|
banning all messages not strictly required in KEX
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: fc33a2d7f3b7013a7fb7500bdbaa8254ebc88116
|
|||
|
|
|
|||
|
|
commit 698fe6fd61cbcb8e3e0e874a561d4335a49fbde5
|
|||
|
|
Author: Damien Miller <djm@mindrot.org>
|
|||
|
|
Date: Mon Jan 8 14:46:19 2024 +1100
|
|||
|
|
|
|||
|
|
update fuzzer example makefile to clang16
|
|||
|
|
|
|||
|
|
commit fc332cb2d602c60983a8ec9f89412754ace06425
|
|||
|
|
Author: Damien Miller <djm@mindrot.org>
|
|||
|
|
Date: Mon Jan 8 14:45:49 2024 +1100
|
|||
|
|
|
|||
|
|
unbreak fuzzers - missing pkcs11_make_cert()
|
|||
|
|
|
|||
|
|
provide stub for use in fuzzer harness
|
|||
|
|
|
|||
|
|
commit 9ea0a4524ae3276546248a926b6641b2fbc8421b
|
|||
|
|
Author: Damien Miller <djm@mindrot.org>
|
|||
|
|
Date: Mon Jan 8 14:45:14 2024 +1100
|
|||
|
|
|
|||
|
|
unbreak fuzzers for clang16
|
|||
|
|
|
|||
|
|
getopt() needs a throw() attribute to compile, so supply one when compiling
|
|||
|
|
things with C++
|
|||
|
|
|
|||
|
|
commit a72833d00788ef91100c643536ac08ada46440e1
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Mon Jan 8 00:34:33 2024 +0000
|
|||
|
|
|
|||
|
|
upstream: remove ext-info-* in the kex.c code, not in callers;
|
|||
|
|
|
|||
|
|
with/ok markus@
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: c06fe2d3a0605c517ff7d65e38ec7b2d1b0b2799
|
|||
|
|
|
|||
|
|
commit 86f9e96d9bcfd1f5cd4bf8fb57a9b4c242df67df
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Mon Jan 8 00:30:39 2024 +0000
|
|||
|
|
|
|||
|
|
upstream: fix typo; spotted by Albert Chin
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: 77140b520a43375b886e535eb8bd842a268f9368
|
|||
|
|
|
|||
|
|
commit f0cbd26ec91bd49719fb3eea7ca44d2380318b9a
|
|||
|
|
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
|||
|
|
Date: Thu Jan 4 09:51:49 2024 +0000
|
|||
|
|
|
|||
|
|
upstream: Import regenerated moduli.
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: 5a636f6ca7f25bfe775df4952f7aac90a7fcbbee
|
|||
|
|
|
|||
|
|
commit 64ddf776531ca4933832beecc8b7ebe1b937e081
|
|||
|
|
Author: jsg@openbsd.org <jsg@openbsd.org>
|
|||
|
|
Date: Wed Dec 20 00:06:25 2023 +0000
|
|||
|
|
|
|||
|
|
upstream: spelling; ok markus@
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: 9d01f2e9d59a999d5d42fc3b3efcf8dfb892e31b
|
|||
|
|
|
|||
|
|
commit 503fbe9ea238a4637e8778208bde8c09bcf78475
|
|||
|
|
Author: jmc@openbsd.org <jmc@openbsd.org>
|
|||
|
|
Date: Tue Dec 19 06:57:34 2023 +0000
|
|||
|
|
|
|||
|
|
upstream: sort -C, and add to usage(); ok djm
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: 80141b2a5d60c8593e3c65ca3c53c431262c812f
|
|||
|
|
|
|||
|
|
commit 5413b1c7ff5a19c6a7d44bd98c5a83eb47819ba6
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Tue Dec 19 06:41:14 2023 +0000
|
|||
|
|
|
|||
|
|
upstream: correct section numbers; from Ed Maste
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: e289576ee5651528404cb2fb68945556052cf83f
|
|||
|
|
|
|||
|
|
commit 430ef864645cff83a4022f5b050174c840e275da
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Mon Dec 18 15:58:56 2023 +0000
|
|||
|
|
|
|||
|
|
upstream: match flag type (s/int/u_int)
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: 9422289747c35ccb7b31d0e1888ccd5e74ad566a
|
|||
|
|
|
|||
|
|
commit 1036d77b34a5fa15e56f516b81b9928006848cbd
|
|||
|
|
Author: Damien Miller <djm@mindrot.org>
|
|||
|
|
Date: Fri Dec 22 17:56:26 2023 +1100
|
|||
|
|
|
|||
|
|
better detection of broken -fzero-call-used-regs
|
|||
|
|
|
|||
|
|
gcc 13.2.0 on ppc64le refuses to compile some function, including
|
|||
|
|
cipher.c:compression_alg_list() with an error:
|
|||
|
|
|
|||
|
|
> sorry, unimplemented: argument ‘used’ is not supportedcw
|
|||
|
|
> for ‘-fzero-call-used-regs’ on this target
|
|||
|
|
|
|||
|
|
This extends the autoconf will-it-work test with a similarly-
|
|||
|
|
structured function that seems to catch this.
|
|||
|
|
|
|||
|
|
Spotted/tested by Colin Watson; bz3645
|
|||
|
|
|
|||
|
|
commit 8241b9c0529228b4b86d88b1a6076fb9f97e4a99
|
|||
|
|
Author: Damien Miller <djm@mindrot.org>
|
|||
|
|
Date: Tue Dec 19 01:59:50 2023 +1100
|
|||
|
|
|
|||
|
|
crank versions
|
|||
|
|
|
|||
|
|
commit 2f2c65cb5f1518a9c556d3e8efa27ea0ca305c6b
|
|||
|
|
Author: Damien Miller <djm@mindrot.org>
|
|||
|
|
Date: Tue Dec 19 01:59:06 2023 +1100
|
|||
|
|
|
|||
|
|
depend
|
|||
|
|
|
|||
|
|
commit e48cdee8e19059203b1aeeabec2350b8375fa61f
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Mon Dec 18 14:50:08 2023 +0000
|
|||
|
|
|
|||
|
|
upstream: regress test for agent PKCS#11-backed certificates
|
|||
|
|
|
|||
|
|
OpenBSD-Regress-ID: 38f681777cb944a8cc3bf9d0ad62959a16764df9
|
|||
|
|
|
|||
|
|
commit 2f512f862df1d5f456f82a0334c9e8cc7208a2a1
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Mon Dec 18 14:49:39 2023 +0000
|
|||
|
|
|
|||
|
|
upstream: regress test for constrained PKCS#11 keys
|
|||
|
|
|
|||
|
|
OpenBSD-Regress-ID: b2f26ae95d609d12257b43aef7cd7714c82618ff
|
|||
|
|
|
|||
|
|
commit cdddd66412ca5920ed4d3ebbfa6ace12dbd9b82f
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Mon Dec 18 14:48:44 2023 +0000
|
|||
|
|
|
|||
|
|
upstream: openssh-9.6
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: 21759837cf0e0092d9a2079f8fb562071c11016b
|
|||
|
|
|
|||
|
|
commit 6d51feab157cedf1e7ef5b3f8781ca8ff9c4ab1b
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Mon Dec 18 14:48:08 2023 +0000
|
|||
|
|
|
|||
|
|
upstream: ssh-agent: record failed session-bind attempts
|
|||
|
|
|
|||
|
|
Record failed attempts to session-bind a connection and refuse signing
|
|||
|
|
operations on that connection henceforth.
|
|||
|
|
|
|||
|
|
Prevents a future situation where we add a new hostkey type that is not
|
|||
|
|
recognised by an older ssh-agent, that consequently causes session-bind
|
|||
|
|
to fail (this situation is only likely to arise when people mix ssh(1)
|
|||
|
|
and ssh-agent(1) of different versions on the same host). Previously,
|
|||
|
|
after such a failure the agent socket would be considered unbound and
|
|||
|
|
not subject to restriction.
|
|||
|
|
|
|||
|
|
Spotted by Jann Horn
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: b0fdd023e920aa4831413f640de4c5307b53552e
|
|||
|
|
|
|||
|
|
commit 7ef3787c84b6b524501211b11a26c742f829af1a
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Mon Dec 18 14:47:44 2023 +0000
|
|||
|
|
|
|||
|
|
upstream: ban user/hostnames with most shell metacharacters
|
|||
|
|
|
|||
|
|
This makes ssh(1) refuse user or host names provided on the
|
|||
|
|
commandline that contain most shell metacharacters.
|
|||
|
|
|
|||
|
|
Some programs that invoke ssh(1) using untrusted data do not filter
|
|||
|
|
metacharacters in arguments they supply. This could create
|
|||
|
|
interactions with user-specified ProxyCommand and other directives
|
|||
|
|
that allow shell injection attacks to occur.
|
|||
|
|
|
|||
|
|
It's a mistake to invoke ssh(1) with arbitrary untrusted arguments,
|
|||
|
|
but getting this stuff right can be tricky, so this should prevent
|
|||
|
|
most obvious ways of creating risky situations. It however is not
|
|||
|
|
and cannot be perfect: ssh(1) has no practical way of interpreting
|
|||
|
|
what shell quoting rules are in use and how they interact with the
|
|||
|
|
user's specified ProxyCommand.
|
|||
|
|
|
|||
|
|
To allow configurations that use strange user or hostnames to
|
|||
|
|
continue to work, this strictness is applied only to names coming
|
|||
|
|
from the commandline. Names specified using User or Hostname
|
|||
|
|
directives in ssh_config(5) are not affected.
|
|||
|
|
|
|||
|
|
feedback/ok millert@ markus@ dtucker@ deraadt@
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: 3b487348b5964f3e77b6b4d3da4c3b439e94b2d9
|
|||
|
|
|
|||
|
|
commit 0cb50eefdd29f0fec31d0e71cc4b004a5f704e67
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Mon Dec 18 14:47:20 2023 +0000
|
|||
|
|
|
|||
|
|
upstream: stricter handling of channel window limits
|
|||
|
|
|
|||
|
|
This makes ssh/sshd more strict in handling non-compliant peers that
|
|||
|
|
send more data than the advertised channel window allows. Previously
|
|||
|
|
the additional data would be silently discarded. This change will
|
|||
|
|
cause ssh/sshd to terminate the connection if the channel window is
|
|||
|
|
exceeded by more than a small grace allowance.
|
|||
|
|
|
|||
|
|
ok markus@
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: 811e21b41831eba3dd7f67b3d409a438f20d3037
|
|||
|
|
|
|||
|
|
commit 4448a2938abc76e6bd33ba09b2ec17a216dfb491
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Mon Dec 18 14:46:56 2023 +0000
|
|||
|
|
|
|||
|
|
upstream: Make it possible to load certs from PKCS#11 tokens
|
|||
|
|
|
|||
|
|
Adds a protocol extension to allow grafting certificates supplied by
|
|||
|
|
ssh-add to keys loaded from PKCS#11 tokens in the agent.
|
|||
|
|
|
|||
|
|
feedback/ok markus@
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: bb5433cd28ede2bc910996eb3c0b53e20f86037f
|
|||
|
|
|
|||
|
|
commit 881d9c6af9da4257c69c327c4e2f1508b2fa754b
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Mon Dec 18 14:46:12 2023 +0000
|
|||
|
|
|
|||
|
|
upstream: apply destination constraints to all p11 keys
|
|||
|
|
|
|||
|
|
Previously applied only to the first key returned from each token.
|
|||
|
|
|
|||
|
|
ok markus@
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: 36df3afb8eb94eec6b2541f063d0d164ef8b488d
|
|||
|
|
|
|||
|
|
commit a7ed931caeb68947d30af8a795f4108b6efad761
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Mon Dec 18 14:45:49 2023 +0000
|
|||
|
|
|
|||
|
|
upstream: add "ext-info-in-auth@openssh.com" extension
|
|||
|
|
|
|||
|
|
This adds another transport protocol extension to allow a sshd to send
|
|||
|
|
SSH2_MSG_EXT_INFO during user authentication, after the server has
|
|||
|
|
learned the username that is being logged in to.
|
|||
|
|
|
|||
|
|
This lets sshd to update the acceptable signature algoritms for public
|
|||
|
|
key authentication, and allows these to be varied via sshd_config(5)
|
|||
|
|
"Match" directives, which are evaluated after the server learns the
|
|||
|
|
username being authenticated.
|
|||
|
|
|
|||
|
|
Full details in the PROTOCOL file
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: 1de7da7f2b6c32a46043d75fcd49b0cbb7db7779
|
|||
|
|
|
|||
|
|
commit 1edb00c58f8a6875fad6a497aa2bacf37f9e6cd5
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Mon Dec 18 14:45:17 2023 +0000
|
|||
|
|
|
|||
|
|
upstream: implement "strict key exchange" in ssh and sshd
|
|||
|
|
|
|||
|
|
This adds a protocol extension to improve the integrity of the SSH
|
|||
|
|
transport protocol, particular in and around the initial key exchange
|
|||
|
|
(KEX) phase.
|
|||
|
|
|
|||
|
|
Full details of the extension are in the PROTOCOL file.
|
|||
|
|
|
|||
|
|
with markus@
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: 2a66ac962f0a630d7945fee54004ed9e9c439f14
|
|||
|
|
|
|||
|
|
commit 59d691b886c79e70b1d1c4ab744e81fd176222fd
|
|||
|
|
Author: Damien Miller <djm@mindrot.org>
|
|||
|
|
Date: Mon Dec 18 14:49:11 2023 +1100
|
|||
|
|
|
|||
|
|
better detection of broken -fzero-call-used-regs
|
|||
|
|
|
|||
|
|
Use OSSH_CHECK_CFLAG_LINK() for detection of these flags and extend
|
|||
|
|
test program to exercise varargs, which seems to catch more stuff.
|
|||
|
|
|
|||
|
|
ok dtucker@
|
|||
|
|
|
|||
|
|
commit aa7b21708511a6d4aed3839fc9f6e82e849dd4a1
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Wed Dec 13 03:28:19 2023 +0000
|
|||
|
|
|
|||
|
|
upstream: when invoking KnownHostsCommand to determine the order of
|
|||
|
|
|
|||
|
|
host key algorithms to request, ensure that the hostname passed to the
|
|||
|
|
command is decorated with the port number for ports other than 22.
|
|||
|
|
|
|||
|
|
This matches the behaviour of KnownHostsCommand when invoked to look
|
|||
|
|
up the actual host key.
|
|||
|
|
|
|||
|
|
bz3643, ok dtucker@
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: 5cfabc0b7c6c7ab473666df314f377b1f15420b1
|
|||
|
|
|
|||
|
|
commit 4086bd6652c0badccc020218a62190a7798fb72c
|
|||
|
|
Author: markus@openbsd.org <markus@openbsd.org>
|
|||
|
|
Date: Fri Dec 8 09:18:39 2023 +0000
|
|||
|
|
|
|||
|
|
upstream: prevent leak in sshsig_match_principals; ok djm@
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: 594f61ad4819ff5c72dfe99ba666a17f0e1030ae
|
|||
|
|
|
|||
|
|
commit 19d3ee2f3adf7d9a606ff015c1e153744702c4c9
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Wed Dec 6 21:06:48 2023 +0000
|
|||
|
|
|
|||
|
|
upstream: short circuit debug log processing early if we're not going
|
|||
|
|
|
|||
|
|
to log anything. From Kobe Housen
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: 2bcddd695872a1bef137cfff7823044dcded90ea
|
|||
|
|
|
|||
|
|
commit 947affad4831df015c498c00c6351ea6f13895d5
|
|||
|
|
Author: Darren Tucker <dtucker@dtucker.net>
|
|||
|
|
Date: Mon Nov 27 09:37:28 2023 +1100
|
|||
|
|
|
|||
|
|
Add tests for OpenSSL 3.2.0 and 3.2 stable branch.
|
|||
|
|
|
|||
|
|
commit 747dce36206675ca6b885010a835733df469351b
|
|||
|
|
Author: Darren Tucker <dtucker@dtucker.net>
|
|||
|
|
Date: Sat Nov 25 09:03:38 2023 +1100
|
|||
|
|
|
|||
|
|
Use non-zero arg in compiler test program.
|
|||
|
|
|
|||
|
|
Now that we're running the test program, passing zero to the test function
|
|||
|
|
can cause divide-by-zero exceptions which might show up in logs.
|
|||
|
|
|
|||
|
|
commit 3d44a5c56585d1c351dbc006240a591b6da502b1
|
|||
|
|
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
|||
|
|
Date: Fri Nov 24 00:31:30 2023 +0000
|
|||
|
|
|
|||
|
|
upstream: Plug mem leak of msg when processing a quit message.
|
|||
|
|
|
|||
|
|
Coverity CID#427852, ok djm@
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: bf85362addbe2134c3d8c4b80f16601fbff823b7
|
|||
|
|
|
|||
|
|
commit 1d7f9b6e297877bd00973e6dc5c0642dbefc3b5f
|
|||
|
|
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
|||
|
|
Date: Thu Nov 23 03:37:05 2023 +0000
|
|||
|
|
|
|||
|
|
upstream: Include existing mux path in debug message.
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: 1c3641be10c2f4fbad2a1b088a441d072e18bf16
|
|||
|
|
|
|||
|
|
commit f29934066bd0e561a2e516b7e584fb92d2eedee0
|
|||
|
|
Author: Darren Tucker <dtucker@dtucker.net>
|
|||
|
|
Date: Thu Nov 23 19:41:27 2023 +1100
|
|||
|
|
|
|||
|
|
Add an Ubuntu 22.04 test VM.
|
|||
|
|
|
|||
|
|
This is the same version as Github's runners so most of the testing on
|
|||
|
|
it is over there, but having a local VM makes debugging much easier.
|
|||
|
|
|
|||
|
|
commit a93284a780cd3972afe5f89086b75d564ba157f3
|
|||
|
|
Author: Darren Tucker <dtucker@dtucker.net>
|
|||
|
|
Date: Thu Nov 23 19:36:22 2023 +1100
|
|||
|
|
|
|||
|
|
Add gcc-12 -Werror test on Ubuntu 22.04.
|
|||
|
|
|
|||
|
|
Explictly specify gcc-11 on Ubuntu 22.04 (it's the system compiler).
|
|||
|
|
|
|||
|
|
commit 670f5a647e98b6fd95ad64f789f87ee3274b481b
|
|||
|
|
Author: Darren Tucker <dtucker@dtucker.net>
|
|||
|
|
Date: Thu Nov 23 19:34:57 2023 +1100
|
|||
|
|
|
|||
|
|
Check return value from write to prevent warning.
|
|||
|
|
|
|||
|
|
... and since we're testing for flags with -Werror, this caused
|
|||
|
|
configure to mis-detect compiler flags.
|
|||
|
|
|
|||
|
|
commit cea007d691cfedfa07a5b8599f97ce0511f53fc9
|
|||
|
|
Author: Darren Tucker <dtucker@dtucker.net>
|
|||
|
|
Date: Wed Nov 22 21:18:55 2023 +1100
|
|||
|
|
|
|||
|
|
Run compiler test program when compiling natively.
|
|||
|
|
|
|||
|
|
ok djm@
|
|||
|
|
|
|||
|
|
commit ee0d305828f13536c0a416bbf9c3e81039d9ea55
|
|||
|
|
Author: Darren Tucker <dtucker@dtucker.net>
|
|||
|
|
Date: Wed Nov 22 21:18:07 2023 +1100
|
|||
|
|
|
|||
|
|
Factor out compiler test program into a macro.
|
|||
|
|
|
|||
|
|
ok djm@
|
|||
|
|
|
|||
|
|
commit de304c76316b029df460673725a9104224b9959b
|
|||
|
|
Author: Darren Tucker <dtucker@dtucker.net>
|
|||
|
|
Date: Wed Nov 22 08:55:36 2023 +1100
|
|||
|
|
|
|||
|
|
Add fbsd14 VM to test pool.
|
|||
|
|
|
|||
|
|
commit 99a2df5e1994cdcb44ba2187b5f34d0e9190be91
|
|||
|
|
Author: Darren Tucker <dtucker@dtucker.net>
|
|||
|
|
Date: Tue Nov 21 16:19:29 2023 +1100
|
|||
|
|
|
|||
|
|
Expand -fzero-call-used-regs test to cover gcc 11.
|
|||
|
|
|
|||
|
|
It turns out that gcc also has some problems with -fzero-call-used-regs,
|
|||
|
|
at least v11 on mips. Previously the test in OSSH_CHECK_CFLAG_COMPILE
|
|||
|
|
was sufficient to catch it with "=all", but not sufficient for "=used".
|
|||
|
|
Expand the testcase and include it in the other tests for good measure.
|
|||
|
|
See bz#3629. ok djm@.
|
|||
|
|
|
|||
|
|
commit ff220d4010717f7bfbbc02a2400666fb9d24f250
|
|||
|
|
Author: Darren Tucker <dtucker@dtucker.net>
|
|||
|
|
Date: Tue Nov 21 14:04:34 2023 +1100
|
|||
|
|
|
|||
|
|
Stop using -fzero-call-used-regs=all
|
|||
|
|
|
|||
|
|
... since it seems to be problematic with several different versions of
|
|||
|
|
clang. Only use -fzero-call-used-regs=used which is less
|
|||
|
|
problematic, except with Apple's clang where we don't use it at all.
|
|||
|
|
bz#3629, ok djm@
|
|||
|
|
|
|||
|
|
commit 2a19e02f36b16f0f6cc915f7d1e60ead5e36303b
|
|||
|
|
Author: Darren Tucker <dtucker@dtucker.net>
|
|||
|
|
Date: Tue Nov 21 14:02:18 2023 +1100
|
|||
|
|
|
|||
|
|
Allow for vendor prefix on clang version numbers.
|
|||
|
|
|
|||
|
|
Correctly detects the version of OpenBSD's native clang, as well as
|
|||
|
|
Apple's. Spotted tb@, ok djm@.
|
|||
|
|
|
|||
|
|
commit c52db0114826d73eff6cdbf205e9c1fa4f7ca6c6
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Mon Nov 20 02:50:00 2023 +0000
|
|||
|
|
|
|||
|
|
upstream: set errno=EAFNOSUPPORT when filtering addresses that don't
|
|||
|
|
|
|||
|
|
match AddressFamily; yields slightly better error message if no address
|
|||
|
|
matches. bz#3526
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: 29cea900ddd8b04a4d1968da5c4a893be2ebd9e6
|
|||
|
|
|
|||
|
|
commit 26f3f3bbc69196d908cad6558c8c7dc5beb8d74a
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Wed Nov 15 23:03:38 2023 +0000
|
|||
|
|
|
|||
|
|
upstream: when connecting via socket (the default case), filter
|
|||
|
|
|
|||
|
|
addresses by AddressFamily if one was specified. Fixes the case where, if
|
|||
|
|
CanonicalizeHostname is enabled, ssh may ignore AddressFamily. bz5326; ok
|
|||
|
|
dtucker
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: 6c7d7751f6cd055126b2b268a7b64dcafa447439
|
|||
|
|
|
|||
|
|
commit 050c335c8da43741ed0df2570ebfbd5d1dfd0a31
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Wed Nov 15 22:51:49 2023 +0000
|
|||
|
|
|
|||
|
|
upstream: when deciding whether to enable keystroke timing
|
|||
|
|
|
|||
|
|
obfuscation, only consider enabling it when a channel with a tty is open.
|
|||
|
|
|
|||
|
|
Avoids turning on the obfucation when X11 forwarding only is in use,
|
|||
|
|
which slows it right down. Reported by Roger Marsh
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: c292f738db410f729190f92de100c39ec931a4f1
|
|||
|
|
|
|||
|
|
commit 676377ce67807a24e08a54cd60ec832946cc6cae
|
|||
|
|
Author: tobhe@openbsd.org <tobhe@openbsd.org>
|
|||
|
|
Date: Mon Nov 13 09:18:19 2023 +0000
|
|||
|
|
|
|||
|
|
upstream: Make sure sftp_get_limits() only returns 0 if 'limits'
|
|||
|
|
|
|||
|
|
was initialized. This fixes a potential uninitialized use of 'limits' in
|
|||
|
|
sftp_init() if sftp_get_limits() returned early because of an unexpected
|
|||
|
|
message type.
|
|||
|
|
|
|||
|
|
ok djm@
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: 1c177d7c3becc1d71bc8763eecf61873a1d3884c
|
|||
|
|
|
|||
|
|
commit 64e0600f23c6dec36c3875392ac95b8a9100c2d6
|
|||
|
|
Author: Darren Tucker <dtucker@dtucker.net>
|
|||
|
|
Date: Mon Nov 13 20:03:31 2023 +1100
|
|||
|
|
|
|||
|
|
Test current releases of LibreSSL and OpenSSL.
|
|||
|
|
|
|||
|
|
Retire some of the older releases.
|
|||
|
|
|
|||
|
|
commit c8ed7cc545879ac15f6ce428be4b29c35598bb2a
|
|||
|
|
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
|||
|
|
Date: Wed Nov 1 02:08:38 2023 +0000
|
|||
|
|
|
|||
|
|
upstream: Specify ssh binary to use
|
|||
|
|
|
|||
|
|
... instead of relying on installed one. Fixes test failures in -portable
|
|||
|
|
when running tests prior to installation.
|
|||
|
|
|
|||
|
|
OpenBSD-Regress-ID: b6d6ba71c23209c616efc805a60d9a445d53a685
|
|||
|
|
|
|||
|
|
commit e9fc2c48121cada1b4dcc5dadea5d447fe0093c3
|
|||
|
|
Author: Darren Tucker <dtucker@dtucker.net>
|
|||
|
|
Date: Wed Nov 1 13:11:31 2023 +1100
|
|||
|
|
|
|||
|
|
Put long-running test targets on hipri runners.
|
|||
|
|
|
|||
|
|
Some of the selfhosted test targets take a long time to run for various
|
|||
|
|
reasons, so label them for "libvirt-hipri" runners so that they can
|
|||
|
|
start immediately. This should reduce the time to complete all tests.
|
|||
|
|
|
|||
|
|
commit 7ddf27668f0e21233f08c0ab2fe9ee3fdd6ab1e2
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Wed Nov 1 00:29:46 2023 +0000
|
|||
|
|
|
|||
|
|
upstream: add some tests of forced commands overriding Subsystem
|
|||
|
|
|
|||
|
|
directives
|
|||
|
|
|
|||
|
|
OpenBSD-Regress-ID: eb48610282f6371672bdf2a8b5d2aa33cfbd322b
|
|||
|
|
|
|||
|
|
commit fb06f9b5a065dfbbef5916fc4accc03c0bf026dd
|
|||
|
|
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
|||
|
|
Date: Tue Oct 31 04:15:40 2023 +0000
|
|||
|
|
|
|||
|
|
upstream: Don't try to use sudo inside sshd log wrapper.
|
|||
|
|
|
|||
|
|
We still need to check if we're using sudo since we don't want to chown
|
|||
|
|
unecessarily, as on some platforms this causes an error which pollutes
|
|||
|
|
stderr. We also don't want to unnecessarily invoke sudo, since it's
|
|||
|
|
running in the context of the proxycommand, on *other* platforms it
|
|||
|
|
may not be able to authenticate, and if we're using SUDO then it should
|
|||
|
|
already be privileged.
|
|||
|
|
|
|||
|
|
OpenBSD-Regress-ID: 70d58df7503db699de579a9479300e5f3735f4ee
|
|||
|
|
|
|||
|
|
commit fc3cc33e88c242c704781c6c48087838f1dcfa2a
|
|||
|
|
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
|||
|
|
Date: Tue Oct 31 02:58:45 2023 +0000
|
|||
|
|
|
|||
|
|
upstream: Only try to chmod logfile if we have sudo. If we don't have
|
|||
|
|
|
|||
|
|
sudo then we won't need to chmod.
|
|||
|
|
|
|||
|
|
OpenBSD-Regress-ID: dbad2f5ece839658ef8af3376cb1fb1cabe2e324
|
|||
|
|
|
|||
|
|
commit 3a506598fddd3f18f9095af3fe917f24cbdd32e0
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Mon Oct 30 23:00:25 2023 +0000
|
|||
|
|
|
|||
|
|
upstream: move PKCS#11 setup code to test-exec.sh so it can be reused
|
|||
|
|
|
|||
|
|
elsewhere
|
|||
|
|
|
|||
|
|
OpenBSD-Regress-ID: 1d29e6be40f994419795d9e660a8d07f538f0acb
|
|||
|
|
|
|||
|
|
commit f82fa227a52661c37404a6d33bbabf14fed05db0
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Mon Oct 30 17:32:00 2023 +0000
|
|||
|
|
|
|||
|
|
upstream: tidy and refactor PKCS#11 setup code
|
|||
|
|
|
|||
|
|
Replace the use of a perl script to delete the controlling TTY with a
|
|||
|
|
SSH_ASKPASS script to directly load the PIN.
|
|||
|
|
|
|||
|
|
Move PKCS#11 setup code to functions in anticipation of it being used
|
|||
|
|
elsewhere in additional tests.
|
|||
|
|
|
|||
|
|
Reduce stdout spam
|
|||
|
|
|
|||
|
|
OpenBSD-Regress-ID: 07705c31de30bab9601a95daf1ee6bef821dd262
|
|||
|
|
|
|||
|
|
commit 3cf698c6d4ffa9be1da55672a3519e2135a6366a
|
|||
|
|
Author: Darren Tucker <dtucker@dtucker.net>
|
|||
|
|
Date: Mon Oct 30 21:35:03 2023 +1100
|
|||
|
|
|
|||
|
|
Add obsd74 test VM and retire obsd69 and obsd70.
|
|||
|
|
|
|||
|
|
commit 3e21d58a09894acb38dc69ed615d101131f473d0
|
|||
|
|
Author: Darren Tucker <dtucker@dtucker.net>
|
|||
|
|
Date: Mon Oct 30 18:34:12 2023 +1100
|
|||
|
|
|
|||
|
|
Add OpenSSL 3.3.0 as a known dev version.
|
|||
|
|
|
|||
|
|
commit 917ba181c2cbdb250a443589ec732aa36fd51ffa
|
|||
|
|
Author: Darren Tucker <dtucker@dtucker.net>
|
|||
|
|
Date: Mon Oct 30 13:32:03 2023 +1100
|
|||
|
|
|
|||
|
|
Restore nopasswd sudo rule on Mac OS X.
|
|||
|
|
|
|||
|
|
This seems to be missing from some (but not all) github runners, so
|
|||
|
|
restore it if it seems to be missing.
|
|||
|
|
|
|||
|
|
commit c5698abad6d4ec98ca20bcaaabaeacd5e1ec3f4f
|
|||
|
|
Author: Darren Tucker <dtucker@dtucker.net>
|
|||
|
|
Date: Mon Oct 30 13:26:52 2023 +1100
|
|||
|
|
|
|||
|
|
Don't exit early when setting up on Mac OS X.
|
|||
|
|
|
|||
|
|
We probably need some of the other bits in there (specifically, setting
|
|||
|
|
the perms on the home directory) so make it less of a special snowflake.
|
|||
|
|
|
|||
|
|
commit 1d6a878ceba60b9dc14037dddc8f036070c0065f
|
|||
|
|
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
|||
|
|
Date: Sun Oct 29 06:22:07 2023 +0000
|
|||
|
|
|
|||
|
|
upstream: Only try to chown logfiles that exist to prevent spurious
|
|||
|
|
|
|||
|
|
errors.
|
|||
|
|
|
|||
|
|
OpenBSD-Regress-ID: f1b20a476734e885078c481f1324c9ea03af991e
|
|||
|
|
|
|||
|
|
commit e612376427a66f835e284f6b426d16d7c85301bc
|
|||
|
|
Author: anton@openbsd.org <anton@openbsd.org>
|
|||
|
|
Date: Thu Oct 26 18:52:45 2023 +0000
|
|||
|
|
|
|||
|
|
upstream: make use of bsd.regress.mk in extra and interop targets; ok
|
|||
|
|
|
|||
|
|
dtucker@
|
|||
|
|
|
|||
|
|
OpenBSD-Regress-ID: 7ea21b5f6fc4506165093b2123d88d20ff13a4f0
|
|||
|
|
|
|||
|
|
commit ea0039173957d0edcd6469b9614dcedb44dcb4f9
|
|||
|
|
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
|||
|
|
Date: Thu Oct 26 12:44:07 2023 +0000
|
|||
|
|
|
|||
|
|
upstream: Skip conch interop tests when not enabled instead of fatal.
|
|||
|
|
|
|||
|
|
OpenBSD-Regress-ID: b0abf81c24ac6c21f367233663228ba16fa96a46
|
|||
|
|
|
|||
|
|
commit d220b9ed5494252b26b95f05be118472bc3ab5c0
|
|||
|
|
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
|||
|
|
Date: Wed Oct 25 05:38:08 2023 +0000
|
|||
|
|
|
|||
|
|
upstream: Import regenerated moduli.
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: 95f5dd6107e8902b87dc5b005ef2b53f1ff378b8
|
|||
|
|
|
|||
|
|
commit a611e4db4009447a0151f31a44e235ca32ed4429
|
|||
|
|
Author: anton@openbsd.org <anton@openbsd.org>
|
|||
|
|
Date: Wed Oct 25 08:01:59 2023 +0000
|
|||
|
|
|
|||
|
|
upstream: ssh conch interop tests requires a controlling terminal;
|
|||
|
|
|
|||
|
|
ok dtucker@
|
|||
|
|
|
|||
|
|
OpenBSD-Regress-ID: cbf2701bc347c2f19d907f113779c666f1ecae4a
|
|||
|
|
|
|||
|
|
commit da951b5e08c167acb5d6e2eec6f146502f5d6ed8
|
|||
|
|
Author: anton@openbsd.org <anton@openbsd.org>
|
|||
|
|
Date: Mon Oct 23 11:30:49 2023 +0000
|
|||
|
|
|
|||
|
|
upstream: Use private key that is allowed by sshd defaults in conch
|
|||
|
|
|
|||
|
|
interop tests.
|
|||
|
|
|
|||
|
|
ok dtucker@
|
|||
|
|
|
|||
|
|
OpenBSD-Regress-ID: 3b7f65c8f409c328bcd4b704f60cb3d31746f045
|
|||
|
|
|
|||
|
|
commit 1ca166dbb3c0ce632b98869cd955f69320aa6fe8
|
|||
|
|
Author: Darren Tucker <dtucker@dtucker.net>
|
|||
|
|
Date: Fri Oct 20 20:43:00 2023 +1100
|
|||
|
|
|
|||
|
|
Install Dropbear for interop testing.
|
|||
|
|
|
|||
|
|
commit f993bb58351c5cb71e61aede63805a34a6d4daea
|
|||
|
|
Author: Darren Tucker <dtucker@dtucker.net>
|
|||
|
|
Date: Fri Oct 20 20:39:03 2023 +1100
|
|||
|
|
|
|||
|
|
Resync PuTTY and Conch path handling with upstream.
|
|||
|
|
|
|||
|
|
Now that configure finds these for us we can remove these -portable
|
|||
|
|
specific changes.
|
|||
|
|
|
|||
|
|
commit ff85becd5f5f06a76efa45d30fb204a3c5e5215c
|
|||
|
|
Author: Darren Tucker <dtucker@dtucker.net>
|
|||
|
|
Date: Fri Oct 20 20:35:46 2023 +1100
|
|||
|
|
|
|||
|
|
Have configure find PuTTY and Conch binaries.
|
|||
|
|
|
|||
|
|
This will let us remove some -portable specific changes from
|
|||
|
|
test-exec.sh.
|
|||
|
|
|
|||
|
|
commit c54a50359b9cecddbf3ffcdc26efcb3cd6071ec1
|
|||
|
|
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
|||
|
|
Date: Fri Oct 20 07:37:07 2023 +0000
|
|||
|
|
|
|||
|
|
upstream: Allow overriding the locations of the Dropbear binaries
|
|||
|
|
|
|||
|
|
similar to what we do for the PuTTY ones.
|
|||
|
|
|
|||
|
|
OpenBSD-Regress-ID: 7de0e00518fb0c8fdc5f243b7f82f523c936049c
|
|||
|
|
|
|||
|
|
commit fbaa707d455a61d0aef8ae65e02a25bac5351e5c
|
|||
|
|
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
|||
|
|
Date: Fri Oct 20 06:56:45 2023 +0000
|
|||
|
|
|
|||
|
|
upstream: Add interop test with Dropbear.
|
|||
|
|
|
|||
|
|
Right now this is only dbclient not the Dropbear server since it won't
|
|||
|
|
currently run as a ProxyCommand.
|
|||
|
|
|
|||
|
|
OpenBSD-Regress-ID: 8cb898c414fcdb252ca6328896b0687acdaee496
|
|||
|
|
|
|||
|
|
commit c2003d0dbdcdb61ca336c3f90c5c2b4a09c8e73f
|
|||
|
|
Author: Fabio Pedretti <pedretti.fabio@gmail.com>
|
|||
|
|
Date: Mon Oct 16 11:59:53 2023 +0200
|
|||
|
|
|
|||
|
|
Update openssl-devel dependency in RPM spec.
|
|||
|
|
|
|||
|
|
Since openssh 9.4p1, openssl >= 1.1.1 is required, so
|
|||
|
|
build with --without-openssl elsewhere.
|
|||
|
|
According to https://repology.org/project/openssl/versions
|
|||
|
|
openssl 1.1.1 is available on fedora >= 29 and rhel >= 8.
|
|||
|
|
Successfully build tested, installed and run on rhel 6
|
|||
|
|
|
|||
|
|
commit 064e09cd632721c7e6889904e07767443ee23821
|
|||
|
|
Author: Fabio Pedretti <pedretti.fabio@gmail.com>
|
|||
|
|
Date: Mon Oct 16 10:13:06 2023 +0200
|
|||
|
|
|
|||
|
|
Remove reference of dropped sshd.pam.old file
|
|||
|
|
|
|||
|
|
The file was removed in openssh 8.8
|
|||
|
|
|
|||
|
|
commit 62db354b696b378a164b6e478cb6b0171dcb0c3d
|
|||
|
|
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
|||
|
|
Date: Mon Oct 16 08:40:00 2023 +0000
|
|||
|
|
|
|||
|
|
upstream: Move declaration of "len" into the block where it's used.
|
|||
|
|
|
|||
|
|
This lets us compile Portable with -Werror with when OpenSSL doesn't have
|
|||
|
|
Ed25519 support.
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: e02e4b4af351946562a7caee905da60eff16ba29
|
|||
|
|
|
|||
|
|
commit 6eee8c972d5901d10e80634a006b4e346b2c8c19
|
|||
|
|
Author: Damien Miller <djm@mindrot.org>
|
|||
|
|
Date: Fri Oct 13 15:15:05 2023 +1100
|
|||
|
|
|
|||
|
|
run t-extra regress tests
|
|||
|
|
|
|||
|
|
This exposes the t-extra regress tests (including agent-pkcs11.sh) as
|
|||
|
|
a new extra-tests target in the top level Makefile and runs them by
|
|||
|
|
default. ok dtucker@
|
|||
|
|
|
|||
|
|
commit 637624dbbac13f2bc3c8ec5b15c9d627d07f2935
|
|||
|
|
Author: Darren Tucker <dtucker@dtucker.net>
|
|||
|
|
Date: Thu Oct 12 22:01:23 2023 +1100
|
|||
|
|
|
|||
|
|
Don't use make -j2.
|
|||
|
|
|
|||
|
|
While we have 2 cores available on github runners, not using it means
|
|||
|
|
that the most recent log message is the actual failure, rather than
|
|||
|
|
having to search back through the log for it.
|
|||
|
|
|
|||
|
|
commit 971e0cfcfd52ef1d73cf5244074c306a60006e89
|
|||
|
|
Author: Darren Tucker <dtucker@dtucker.net>
|
|||
|
|
Date: Thu Oct 12 16:23:05 2023 +1100
|
|||
|
|
|
|||
|
|
Correct arg order for ED255519 AC_LINK_IFELSE test.
|
|||
|
|
|
|||
|
|
commit c616e64688b2a0c1b4daad69b056099be998d121
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Thu Oct 12 03:51:08 2023 +0000
|
|||
|
|
|
|||
|
|
upstream: typos and extra debug trace calls
|
|||
|
|
|
|||
|
|
OpenBSD-Regress-ID: 98a2a6b9333743274359e3c0f0e65cf919a591d1
|
|||
|
|
|
|||
|
|
commit c49a3fbf10162128c67c59562348de2041188974
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Thu Oct 12 03:48:53 2023 +0000
|
|||
|
|
|
|||
|
|
upstream: ensure logs are owned by correct user; feedback/ok
|
|||
|
|
|
|||
|
|
dtucker@
|
|||
|
|
|
|||
|
|
OpenBSD-Regress-ID: c3297af8f07717f1d400a5d34529962f1a76b5a3
|
|||
|
|
|
|||
|
|
commit 5ec0ed79ac074c3437b25f6cba8b8cf21c8d4587
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Thu Oct 12 03:36:32 2023 +0000
|
|||
|
|
|
|||
|
|
upstream: 64 %-expansion keys ought to be enough for anybody; ok
|
|||
|
|
|
|||
|
|
dtucker (we just hit the previous limit in some cases)
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: 84070f8001ec22ff5d669f836b62f206e08c5787
|
|||
|
|
|
|||
|
|
commit f59a94e22e46db2c23eddeb871aa9e8d93ab0016
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Thu Oct 12 02:48:43 2023 +0000
|
|||
|
|
|
|||
|
|
upstream: don't dereference NULL pointer when hashing jumphost
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: 251c0263e1759a921341c7efe7f1d4c73e1c70f4
|
|||
|
|
|
|||
|
|
commit 281c79168edcc303abfd5bca983616eaa24c5f32
|
|||
|
|
Author: Damien Miller <djm@mindrot.org>
|
|||
|
|
Date: Thu Oct 12 13:20:01 2023 +1100
|
|||
|
|
|
|||
|
|
Solaris: prefer PRIV_XPOLICY to PRIV_LIMIT
|
|||
|
|
|
|||
|
|
If the system support PRIV_XPOLICY and one is set, then don't
|
|||
|
|
modify PRIV_LIMIT. bz2833, patch from Ron Jordan, ok dtucker@
|
|||
|
|
|
|||
|
|
commit 98fc34df837f3a3b79d2a111b96fe8a39adcab55
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Thu Oct 12 02:18:18 2023 +0000
|
|||
|
|
|
|||
|
|
upstream: add %j token that expands to the configured ProxyJump
|
|||
|
|
|
|||
|
|
hostname (or the empty string if this option is not being used). bz3610, ok
|
|||
|
|
dtucker
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: ce9983f7efe6a178db90dc5c1698df025df5e339
|
|||
|
|
|
|||
|
|
commit 7f3180be8a85320b5d3221714b40c16e66881249
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Thu Oct 12 02:15:53 2023 +0000
|
|||
|
|
|
|||
|
|
upstream: release GSS OIDs only at end of authentication; bz2982,
|
|||
|
|
|
|||
|
|
ok dtucker@
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: 0daa41e0525ae63cae4483519ecaa37ac485d94c
|
|||
|
|
|
|||
|
|
commit a612b93de5d86e955bfb6e24278f621118eea500
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Thu Oct 12 02:12:53 2023 +0000
|
|||
|
|
|
|||
|
|
upstream: mask SIGINT/TERM/QUIT/HUP before checking quit_pending
|
|||
|
|
|
|||
|
|
and use ppoll() to unmask them in the mainloop. Avoids race condition between
|
|||
|
|
signaling ssh to exit and polling. bz3531; ok dtucker
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: 5c14e1aabcddedb95cdf972283d9c0d5083229e7
|
|||
|
|
|
|||
|
|
commit 531b27a006116fe7aff325510aaa576f24844452
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Wed Oct 11 23:23:58 2023 +0000
|
|||
|
|
|
|||
|
|
upstream: sync usage() with ssh.1; spotted by kn@
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: 191a85639477dcb5fa1616d270d93b7c8d5c1dfd
|
|||
|
|
|
|||
|
|
commit 64f7ca881b19be754425dca60d1590d306c9d1d0
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Wed Oct 11 23:14:33 2023 +0000
|
|||
|
|
|
|||
|
|
upstream: ssh -Q does not make sense with other command-line options,
|
|||
|
|
|
|||
|
|
so give it its own line in the manpage
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: 00a747f0655c12122bbb77c2796be0013c105361
|
|||
|
|
|
|||
|
|
commit a752a6c0e1001f93696d7025f0c867f0376e2ecf
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Wed Oct 11 22:42:26 2023 +0000
|
|||
|
|
|
|||
|
|
upstream: add ChannelTimeout support to the client, mirroring the
|
|||
|
|
|
|||
|
|
same option in the server. ok markus@
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: 55630b26f390ac063980cfe7ad8c54b03284ef02
|
|||
|
|
|
|||
|
|
commit 76e91e7238cdc5662bc818e2a48d466283840d23
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Wed Oct 11 22:41:05 2023 +0000
|
|||
|
|
|
|||
|
|
upstream: add support for reading ED25519 private keys in PEM PKCS8
|
|||
|
|
|
|||
|
|
format; ok markus@ tb@
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: 01b85c91757e6b057e9b23b8a23f96415c3c7174
|
|||
|
|
|
|||
|
|
commit fc77c8e352c0f44125425c05265e3a00c183d78a
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Wed Oct 11 06:40:54 2023 +0000
|
|||
|
|
|
|||
|
|
upstream: mention "none" is a valid argument to IdentityFile; bz3080
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: 1b4fb590ef731099349a7d468b77f02b240ac926
|
|||
|
|
|
|||
|
|
commit c97520d23d1fe53d30725a2af25d2dddd6f2faff
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Wed Oct 11 05:42:08 2023 +0000
|
|||
|
|
|
|||
|
|
upstream: in olde rcp/scp protocol mode, when rejecting a path from the
|
|||
|
|
|
|||
|
|
server as not matching the glob that the client sent, log (at debug level)
|
|||
|
|
the received pathname as well as the list of possible expected paths expanded
|
|||
|
|
from the glob. bz2966
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: 0bd8db8a595334ca86bca8f36e23fc0395315765
|
|||
|
|
|
|||
|
|
commit 208c2b719879805983398160791d6a1ef9c2c3fc
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Wed Oct 11 04:46:29 2023 +0000
|
|||
|
|
|
|||
|
|
upstream: s/%.100s/%s/ in SSH- banner construction as there's no
|
|||
|
|
|
|||
|
|
reason to limit its size: the version string bring included is a compile time
|
|||
|
|
constant going into an allocated banner string.
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: 0ef73304b9bf3e534c60900cd84ab699f859ebcd
|
|||
|
|
|
|||
|
|
commit 0354790826b97c41bbd171a965574e159b58d83e
|
|||
|
|
Author: tb@openbsd.org <tb@openbsd.org>
|
|||
|
|
Date: Tue Oct 10 06:49:54 2023 +0000
|
|||
|
|
|
|||
|
|
upstream: Garbage collect cipher_get_keyiv_len()
|
|||
|
|
|
|||
|
|
This is a compat20 leftover, unused since 2017.
|
|||
|
|
|
|||
|
|
ok djm
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: 91fa5497c9dc6883064624ac27813a567883fdce
|
|||
|
|
|
|||
|
|
commit 8d29ee4115001a02641386ae394992c65ed279e0
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Tue Oct 10 03:57:45 2023 +0000
|
|||
|
|
|
|||
|
|
upstream: Reserve a range of "local extension" message numbers that
|
|||
|
|
|
|||
|
|
OpenSSH promises not to use (comment change only)
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: e61795b453d4892d2c99ce1039112c4a00250e03
|
|||
|
|
|
|||
|
|
commit 90b0d73d63a706e85f6431f05a62d2ce1b476472
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Fri Oct 6 03:32:15 2023 +0000
|
|||
|
|
|
|||
|
|
upstream: typo in error message
|
|||
|
|
|
|||
|
|
OpenBSD-Regress-ID: 6a8edf0dc39941298e3780b147b10c0a600b4fee
|
|||
|
|
|
|||
|
|
commit e84517f51532ec913d8fb01a8aab7307134774bb
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Fri Oct 6 03:25:14 2023 +0000
|
|||
|
|
|
|||
|
|
upstream: Perform the softhsm2 setup as discrete steps rather than
|
|||
|
|
|
|||
|
|
as a long shell pipeline. Makes it easier to figure out what has happened
|
|||
|
|
when it breaks.
|
|||
|
|
|
|||
|
|
OpenBSD-Regress-ID: b3f1292115fed65765d0a95414df16e27772d81c
|
|||
|
|
|
|||
|
|
commit cb54becff4d776238e0e9072943ba0872260535d
|
|||
|
|
Author: claudio@openbsd.org <claudio@openbsd.org>
|
|||
|
|
Date: Sun Sep 24 08:14:13 2023 +0000
|
|||
|
|
|
|||
|
|
upstream: REGRESS_FAIL_EARLY defaults to yes now. So no need to
|
|||
|
|
|
|||
|
|
overload the value here anymore. OK tb@ bluhm@
|
|||
|
|
|
|||
|
|
OpenBSD-Regress-ID: f063330f1bebbcd373100afccebc91a965b14496
|
|||
|
|
|
|||
|
|
commit f01f5137ceba65baf34ceac5a298c12ac01b1fef
|
|||
|
|
Author: jmc@openbsd.org <jmc@openbsd.org>
|
|||
|
|
Date: Wed Oct 4 05:42:10 2023 +0000
|
|||
|
|
|
|||
|
|
upstream: spelling fix;
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: 493f95121567e5ab0d9dd1150f873b5535ca0195
|
|||
|
|
|
|||
|
|
commit 80a2f64b8c1d27383cc83d182b73920d1e6a91f1
|
|||
|
|
Author: Damien Miller <djm@mindrot.org>
|
|||
|
|
Date: Wed Oct 4 15:34:10 2023 +1100
|
|||
|
|
|
|||
|
|
crank version numbers
|
|||
|
|
|
|||
|
|
commit f65f187b105d9b5c12fd750a211397d08c17c6d4
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Wed Oct 4 04:04:09 2023 +0000
|
|||
|
|
|
|||
|
|
upstream: openssh-9.5
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: 5e0af680480bd3b6f5560cf840ad032d48fd6b16
|
|||
|
|
|
|||
|
|
commit ffe27e54a4bb18d5d3bbd3f4cc93a41b8d94dfd2
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Wed Oct 4 04:03:50 2023 +0000
|
|||
|
|
|
|||
|
|
upstream: add some cautionary text about % token expansion and
|
|||
|
|
|
|||
|
|
shell metacharacters; based on report from vinci AT protonmail.ch
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: aa1450a54fcee2f153ef70368d90edb1e7019113
|
|||
|
|
|
|||
|
|
commit 60ec3d54fd1ebfe2dda75893fa1e870b8dffbb0d
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Tue Oct 3 23:56:10 2023 +0000
|
|||
|
|
|
|||
|
|
upstream: fix link to agent draft; spotted by Jann Horn
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: ff5bda21a83ec013db683e282256a85201d2dc4b
|
|||
|
|
|
|||
|
|
commit 12e2d4b13f6f63ce2de13cbfcc9e4d0d4b4ab231
|
|||
|
|
Author: Damien Miller <djm@mindrot.org>
|
|||
|
|
Date: Wed Oct 4 10:54:04 2023 +1100
|
|||
|
|
|
|||
|
|
use portable provider allowlist path in manpage
|
|||
|
|
|
|||
|
|
spotted by Jann Horn
|
|||
|
|
|
|||
|
|
commit 6c2c6ffde75df95fd838039850d3dd3d84956d87
|
|||
|
|
Author: deraadt@openbsd.org <deraadt@openbsd.org>
|
|||
|
|
Date: Tue Sep 19 20:37:07 2023 +0000
|
|||
|
|
|
|||
|
|
upstream: typo; from Jim Spath
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: 2f5fba917b5d4fcf93d9e0b0756c7f63189e228e
|
|||
|
|
|
|||
|
|
commit b6b49130a0089b297245ee39e769231d7c763014
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Sun Sep 10 23:12:32 2023 +0000
|
|||
|
|
|
|||
|
|
upstream: rename remote_glob() -> sftp_glob() to match other API
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: d9dfb3708d824ec02970a84d96cf5937e0887229
|
|||
|
|
|
|||
|
|
commit 21b79af6c8d2357c822c84cef3fbdb8001ed263b
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Sun Sep 10 03:51:55 2023 +0000
|
|||
|
|
|
|||
|
|
upstream: typo in comment
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: 69285e0ce962a7c6b0ab5f17a293c60a0a360a18
|
|||
|
|
|
|||
|
|
commit 41232d25532b4d2ef6c5db62efc0cf50a79d26ca
|
|||
|
|
Author: Darren Tucker <dtucker@dtucker.net>
|
|||
|
|
Date: Sun Sep 10 15:45:38 2023 +1000
|
|||
|
|
|
|||
|
|
Use zero-call-used-regs=used with Apple compilers.
|
|||
|
|
|
|||
|
|
Apple's versions of clang have version numbers that do not match the
|
|||
|
|
corresponding upstream clang versions. Unfortunately, they do still
|
|||
|
|
have the clang-15 zero-call-used-regs=all bug, so for now use the value
|
|||
|
|
that doesn't result in segfaults. We could allowlist future versions
|
|||
|
|
that are known to work. bz#3584 (and probably also our github CI
|
|||
|
|
failures).
|
|||
|
|
|
|||
|
|
commit 90ccc5918ea505bf156c31148b6b59a1bf5d6dc6
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Sun Sep 10 03:25:53 2023 +0000
|
|||
|
|
|
|||
|
|
upstream: randomise keystroke obfuscation intervals and average
|
|||
|
|
|
|||
|
|
interval rate. ok dtucker@
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: 05f61d051ab418fcfc4857ff306e420037502382
|
|||
|
|
|
|||
|
|
commit bd1b9e52f5fa94d87223c90905c5fdc1a7c32aa6
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Fri Sep 8 06:34:24 2023 +0000
|
|||
|
|
|
|||
|
|
upstream: fix sizeof(*ptr) instead sizeof(ptr) in realloc (pointer here
|
|||
|
|
|
|||
|
|
is char**, so harmless); spotted in CID 416964
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: c61caa4a5a667ee20bb1042098861e6c72c69002
|
|||
|
|
|
|||
|
|
commit c4f966482983e18601eec70a1563115de836616f
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Fri Sep 8 06:10:57 2023 +0000
|
|||
|
|
|
|||
|
|
upstream: regress test recursive remote-remote directories copies where
|
|||
|
|
|
|||
|
|
the directory contains a symlink to another directory.
|
|||
|
|
|
|||
|
|
also remove errant `set -x` that snuck in at some point
|
|||
|
|
|
|||
|
|
OpenBSD-Regress-ID: 1c94a48bdbd633ef2285954ee257725cd7bc456f
|
|||
|
|
|
|||
|
|
commit 5e1dfe5014ebc194641678303e22ab3bba15f4e5
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Fri Sep 8 06:10:02 2023 +0000
|
|||
|
|
|
|||
|
|
upstream: fix recursive remote-remote copies of directories that
|
|||
|
|
|
|||
|
|
contain symlinks to other directories (similar to bz3611)
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: 7e19d2ae09b4f941bf8eecc3955c9120171da37f
|
|||
|
|
|
|||
|
|
commit 7c0ce2bf98b303b6ad91493ee3247d96c18ba1f6
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Fri Sep 8 05:50:57 2023 +0000
|
|||
|
|
|
|||
|
|
upstream: regress test for recursive copies of directories containing
|
|||
|
|
|
|||
|
|
symlinks to other directories. bz3611, ok dtucker@
|
|||
|
|
|
|||
|
|
OpenBSD-Regress-ID: eaa4c29cc5cddff4e72a16bcce14aeb1ecfc94b9
|
|||
|
|
|
|||
|
|
commit 2de990142a83bf60ef694378b8598706bc654b08
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Fri Sep 8 05:56:13 2023 +0000
|
|||
|
|
|
|||
|
|
upstream: the sftp code was one of my first contributions to
|
|||
|
|
|
|||
|
|
OpenSSH and it shows - the function names are terrible.
|
|||
|
|
|
|||
|
|
Rename do_blah() to sftp_blah() to make them less so.
|
|||
|
|
|
|||
|
|
Completely mechanical except for sftp_stat() and sftp_lstat() which
|
|||
|
|
change from returning a pointer to a static variable (error-prone) to
|
|||
|
|
taking a pointer to a caller-provided receiver.
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: eb54d6a72d0bbba4d623e2175cf5cc4c75dc2ba4
|
|||
|
|
|
|||
|
|
commit 249d8bd0472b53e3a2a0e138b4c030a31e83346a
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Fri Sep 8 05:50:12 2023 +0000
|
|||
|
|
|
|||
|
|
upstream: fix scp in SFTP mode recursive upload and download of
|
|||
|
|
|
|||
|
|
directories that contain symlinks to other directories. In scp mode, the
|
|||
|
|
links would be followed, but in SFTP mode they were not. bz3611, ok dtucker@
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: 9760fda668eaa94a992250d7670dfbc62a45197c
|
|||
|
|
|
|||
|
|
commit 0e1f4401c466fa4fdaea81b6dadc8dd1fc4cf0af
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Wed Sep 6 23:36:09 2023 +0000
|
|||
|
|
|
|||
|
|
upstream: regression test for override of subsystem in match blocks
|
|||
|
|
|
|||
|
|
OpenBSD-Regress-ID: 5f8135da3bfda71067084c048d717b0e8793e87c
|
|||
|
|
|
|||
|
|
commit 8a1450c62035e834d8a79a5d0d1c904236f9dcfe
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Wed Sep 6 23:35:35 2023 +0000
|
|||
|
|
|
|||
|
|
upstream: allow override of Sybsystem directives in sshd Match
|
|||
|
|
|
|||
|
|
blocks
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: 3911d18a826a2d2fe7e4519075cf3e57af439722
|
|||
|
|
|
|||
|
|
commit 6e52826e2a74d077147a82ead8d4fbd5b54f4e3b
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Wed Sep 6 23:26:37 2023 +0000
|
|||
|
|
|
|||
|
|
upstream: allocate the subsystems array as necessary and remove the
|
|||
|
|
|
|||
|
|
fixed limit of subsystems. Saves a few kb of memory in the server and makes
|
|||
|
|
it more like the other options.
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: e683dfca6bdcbc3cc339bb6c6517c0c4736a547f
|
|||
|
|
|
|||
|
|
commit e19069c9fac4c111d6496b19c7f7db43b4f07b4f
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Wed Sep 6 23:23:53 2023 +0000
|
|||
|
|
|
|||
|
|
upstream: preserve quoting of Subsystem commands and arguments.
|
|||
|
|
|
|||
|
|
This may change behaviour of exotic configurations, but the most common
|
|||
|
|
subsystem configuration (sftp-server) is unlikely to be affected.
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: 8ffa296aeca981de5b0945242ce75aa6dee479bf
|
|||
|
|
|
|||
|
|
commit 52dfe3c72d98503d8b7c6f64fc7e19d685636c0b
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Wed Sep 6 23:21:36 2023 +0000
|
|||
|
|
|
|||
|
|
upstream: downgrade duplicate Subsystem directives from being a
|
|||
|
|
|
|||
|
|
fatal error to being a debug message to match behaviour with just about all
|
|||
|
|
other directives.
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: fc90ed2cc0c18d4eb8e33d2c5e98d25f282588ce
|
|||
|
|
|
|||
|
|
commit 1ee0a16e07b6f0847ff463d7b5221c4bf1876e25
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Wed Sep 6 23:18:15 2023 +0000
|
|||
|
|
|
|||
|
|
upstream: handle cr+lf (instead of just cr) in sshsig signature
|
|||
|
|
|
|||
|
|
files
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: 647460a212b916540016d066568816507375fd7f
|
|||
|
|
|
|||
|
|
commit e1c284d60a928bcdd60bc575c6f9604663502770
|
|||
|
|
Author: job@openbsd.org <job@openbsd.org>
|
|||
|
|
Date: Mon Sep 4 10:29:58 2023 +0000
|
|||
|
|
|
|||
|
|
upstream: Generate Ed25519 keys when invoked without arguments
|
|||
|
|
|
|||
|
|
Ed25519 public keys are very convenient due to their small size.
|
|||
|
|
OpenSSH has supported Ed25519 since version 6.5 (January 2014).
|
|||
|
|
|
|||
|
|
OK djm@ markus@ sthen@ deraadt@
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: f498beaad19c8cdcc357381a60df4a9c69858b3f
|
|||
|
|
|
|||
|
|
commit 694150ad92765574ff82a18f4e86322bd3231e68
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Mon Sep 4 00:08:14 2023 +0000
|
|||
|
|
|
|||
|
|
upstream: trigger keystroke timing obfucation only if the channels
|
|||
|
|
|
|||
|
|
layer enqueud some data in the last poll() cycle; this avoids triggering the
|
|||
|
|
obfuscatior for non-channels data like ClientAlive probes and also fixes a
|
|||
|
|
related problem were the obfucations would be triggered on fully quiescent
|
|||
|
|
connections.
|
|||
|
|
|
|||
|
|
Based on / tested by naddy@
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: d98f32dc62d7663ff4660e4556e184032a0db123
|
|||
|
|
|
|||
|
|
commit b5fd97896b59a3a46245cf438cc8b16c795d9f74
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Mon Sep 4 00:04:02 2023 +0000
|
|||
|
|
|
|||
|
|
upstream: avoid bogus "obfuscate_keystroke_timing: stopping ..."
|
|||
|
|
|
|||
|
|
debug messages when keystroke timing obfuscation was never started; spotted
|
|||
|
|
by naddy@
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: 5c270d35f7d2974db5c1646e9c64188f9393be31
|
|||
|
|
|
|||
|
|
commit ccf7d913db34e49b7a6db1b8331bd402004c840d
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Mon Sep 4 00:01:46 2023 +0000
|
|||
|
|
|
|||
|
|
upstream: make channel_output_poll() return a flag indicating
|
|||
|
|
|
|||
|
|
whether channel data was enqueued. Will be used to improve keystroke timing
|
|||
|
|
obfuscation. Problem spotted by / tested by naddy@
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: f9776c7b0065ba7c3bbe50431fd3b629f44314d0
|
|||
|
|
|
|||
|
|
commit 43254b326ac6e2131dbd750f9464dc62c14bd5a7
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Sun Sep 3 23:59:32 2023 +0000
|
|||
|
|
|
|||
|
|
upstream: set interactive mode for ControlPersist sessions if they
|
|||
|
|
|
|||
|
|
originally requested a tty; enables keystroke timing obfuscation for most
|
|||
|
|
ControlPersist sessions. Spotted by naddy@
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: 72783a26254202e2f3f41a2818a19956fe49a772
|
|||
|
|
|
|||
|
|
commit ff3eda68ceb2e2bb8f48e3faceb96076c3e85c20
|
|||
|
|
Author: Darren Tucker <dtucker@dtucker.net>
|
|||
|
|
Date: Thu Aug 31 23:02:35 2023 +1000
|
|||
|
|
|
|||
|
|
Set LLONG_MAX for C89 test.
|
|||
|
|
|
|||
|
|
If we don't have LLONG_MAX, configure will figure out that it can get it
|
|||
|
|
by setting -std=gnu99, at which point we won't be testing C89 any more.
|
|||
|
|
To avoid this, feed it in via CFLAGS.
|
|||
|
|
|
|||
|
|
commit f98031773db361424d59e3301aa92aacf423d920
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Tue Aug 29 02:50:10 2023 +0000
|
|||
|
|
|
|||
|
|
upstream: make PerSourceMaxStartups first-match-wins; ok dtucker@
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: dac0c24cb709e3c595b8b4f422a0355dc5a3b4e7
|
|||
|
|
|
|||
|
|
commit cfa66857db90cd908de131e0041a50ffc17c7df8
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Mon Aug 28 09:52:09 2023 +0000
|
|||
|
|
|
|||
|
|
upstream: descriptive text shouldn't be under .Cm
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: b1afaeb456a52bc8a58f4f9f8b2f9fa8f6bf651b
|
|||
|
|
|
|||
|
|
commit 01dbf3d46651b7d6ddf5e45d233839bbfffaeaec
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Mon Aug 28 09:48:11 2023 +0000
|
|||
|
|
|
|||
|
|
upstream: limit artificial login delay to a reasonable maximum (5s)
|
|||
|
|
|
|||
|
|
and don't delay at all for the "none" authentication mechanism. Patch by
|
|||
|
|
Dmitry Belyavskiy in bz3602 with polish/ok dtucker@
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: 85b364676dd84cf1de0e98fc2fbdcb1a844ce515
|
|||
|
|
|
|||
|
|
commit 528da5b9d7c5da01ed7a73ff21c722e1b5326006
|
|||
|
|
Author: jmc@openbsd.org <jmc@openbsd.org>
|
|||
|
|
Date: Mon Aug 28 05:32:28 2023 +0000
|
|||
|
|
|
|||
|
|
upstream: add spacing for punctuation when macro args;
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: e80343c16ce0420b2aec98701527cf90371bd0db
|
|||
|
|
|
|||
|
|
commit 3867361ca691d0956ef7d5fb8181cf554a91d84a
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Mon Aug 28 04:06:52 2023 +0000
|
|||
|
|
|
|||
|
|
upstream: explicit long long type in timing calculations (doesn't
|
|||
|
|
|
|||
|
|
matter, since the range is pre-clamped)
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: f786ed902d04a5b8ecc581d068fea1a79aa772de
|
|||
|
|
|
|||
|
|
commit 7603ba71264e7fa938325c37eca993e2fa61272f
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Mon Aug 28 03:31:16 2023 +0000
|
|||
|
|
|
|||
|
|
upstream: Add keystroke timing obfuscation to the client.
|
|||
|
|
|
|||
|
|
This attempts to hide inter-keystroke timings by sending interactive
|
|||
|
|
traffic at fixed intervals (default: every 20ms) when there is only a
|
|||
|
|
small amount of data being sent. It also sends fake "chaff" keystrokes
|
|||
|
|
for a random interval after the last real keystroke. These are
|
|||
|
|
controlled by a new ssh_config ObscureKeystrokeTiming keyword/
|
|||
|
|
|
|||
|
|
feedback/ok markus@
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: 02231ddd4f442212820976068c34a36e3c1b15be
|
|||
|
|
|
|||
|
|
commit dce6d80d2ed3cad2c516082682d5f6ca877ef714
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Mon Aug 28 03:28:43 2023 +0000
|
|||
|
|
|
|||
|
|
upstream: Introduce a transport-level ping facility
|
|||
|
|
|
|||
|
|
This adds a pair of SSH transport protocol messages SSH2_MSG_PING/PONG
|
|||
|
|
to implement a ping capability. These messages use numbers in the "local
|
|||
|
|
extensions" number space and are advertised using a "ping@openssh.com"
|
|||
|
|
ext-info message with a string version number of "0".
|
|||
|
|
|
|||
|
|
ok markus@
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: b6b3c4cb2084c62f85a8dc67cf74954015eb547f
|
|||
|
|
|
|||
|
|
commit d2d247938b38b928f8a6e1a47a330c5584d3a358
|
|||
|
|
Author: tobhe@openbsd.org <tobhe@openbsd.org>
|
|||
|
|
Date: Mon Aug 21 21:16:18 2023 +0000
|
|||
|
|
|
|||
|
|
upstream: Log errors in kex_exchange_identification() with level
|
|||
|
|
|
|||
|
|
verbose instead of error to reduce preauth log spam. All of those get logged
|
|||
|
|
with a more generic error message by sshpkt_fatal().
|
|||
|
|
|
|||
|
|
feedback from sthen@
|
|||
|
|
ok djm@
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: bd47dab4695b134a44c379f0e9a39eed33047809
|
|||
|
|
|
|||
|
|
commit 9d7193a8359639801193ad661a59d1ae4dc3d302
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Mon Aug 21 04:59:54 2023 +0000
|
|||
|
|
|
|||
|
|
upstream: correct math for ClientAliveInterval that caused the
|
|||
|
|
|
|||
|
|
probes to be sent less frequently than configured; from Dawid Majchrzak
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: 641153e7c05117436ddfc58267aa267ca8b80038
|
|||
|
|
|
|||
|
|
commit 3c6ab63b383b0b7630da175941e01de9db32a256
|
|||
|
|
Author: Darren Tucker <dtucker@dtucker.net>
|
|||
|
|
Date: Fri Aug 25 14:48:02 2023 +1000
|
|||
|
|
|
|||
|
|
Include Portable version in sshd version string.
|
|||
|
|
|
|||
|
|
bz#3608, ok djm@
|
|||
|
|
|
|||
|
|
commit 17fa6cd10a26e193bb6f65d21264d2fe553bcd87
|
|||
|
|
Author: Darren Tucker <dtucker@dtucker.net>
|
|||
|
|
Date: Mon Aug 21 19:47:58 2023 +1000
|
|||
|
|
|
|||
|
|
obsd-arm64 host is real hardware...
|
|||
|
|
|
|||
|
|
so put in the correct config location.
|
|||
|
|
|
|||
|
|
commit 598ca75c85acaaacee5ef954251e489cc20d7be9
|
|||
|
|
Author: Darren Tucker <dtucker@dtucker.net>
|
|||
|
|
Date: Mon Aug 21 18:38:36 2023 +1000
|
|||
|
|
|
|||
|
|
Add OpenBSD ARM64 test host.
|
|||
|
|
|
|||
|
|
commit 1acac79bfbe207e8db639e8043524962037c8feb
|
|||
|
|
Author: Darren Tucker <dtucker@dtucker.net>
|
|||
|
|
Date: Mon Aug 21 18:05:26 2023 +1000
|
|||
|
|
|
|||
|
|
Add test for zlib development branch.
|
|||
|
|
|
|||
|
|
commit 84efebf352fc700e9040c8065707c63caedd36a3
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Mon Aug 21 04:36:46 2023 +0000
|
|||
|
|
|
|||
|
|
upstream: want stdlib.h for free(3)
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: 743af3c6e3ce5e6cecd051668f0327a01f44af29
|
|||
|
|
|
|||
|
|
commit cb4ed12ffc332d1f72d054ed92655b5f1c38f621
|
|||
|
|
Author: Darren Tucker <dtucker@dtucker.net>
|
|||
|
|
Date: Sat Aug 19 07:39:08 2023 +1000
|
|||
|
|
|
|||
|
|
Fix zlib version check for 1.3 and future version.
|
|||
|
|
|
|||
|
|
bz#3604.
|
|||
|
|
|
|||
|
|
commit 25b75e21f16bccdaa472ea1889b293c9bd51a87b
|
|||
|
|
Author: Darren Tucker <dtucker@dtucker.net>
|
|||
|
|
Date: Mon Aug 14 11:10:08 2023 +1000
|
|||
|
|
|
|||
|
|
Add 9.4 branch to CI status page.
|
|||
|
|
|
|||
|
|
commit 803e22eabd3ba75485eedd8b7b44d6ace79f2052
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Fri Aug 18 01:37:41 2023 +0000
|
|||
|
|
|
|||
|
|
upstream: fix regression in OpenSSH 9.4 (mux.c r1.99) that caused
|
|||
|
|
|
|||
|
|
multiplexed sessions to ignore SIGINT under some circumstances. Reported by /
|
|||
|
|
feedback naddy@, ok dtucker@
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: 4d5c6c894664f50149153fd4764f21f43e7d7e5a
|
|||
|
|
|
|||
|
|
commit e706bca324a70f68dadfd0ec69edfdd486eed23a
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Wed Aug 16 16:14:11 2023 +0000
|
|||
|
|
|
|||
|
|
upstream: defence-in-depth MaxAuthTries check in monitor; ok markus
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: 65a4225dc708e2dae71315adf93677edace46c21
|
|||
|
|
|
|||
|
|
commit d1ab7eb90474df656d5e9935bae6df0bd000d343
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Mon Aug 14 03:37:00 2023 +0000
|
|||
|
|
|
|||
|
|
upstream: add message number of SSH2_MSG_NEWCOMPRESS defined in RFC8308
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: 6c984171c96ed67effd7b5092f3d3975d55d6028
|
|||
|
|
|
|||
|
|
commit fa8da52934cb7dff6f660a143276bdb28bb9bbe1
|
|||
|
|
Author: Darren Tucker <dtucker@dtucker.net>
|
|||
|
|
Date: Sun Aug 13 15:01:27 2023 +1000
|
|||
|
|
|
|||
|
|
Add obsd72 and obsd73 test targets.
|
|||
|
|
|
|||
|
|
commit f9f18006678d2eac8b0c5a5dddf17ab7c50d1e9f
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Thu Aug 10 23:05:48 2023 +0000
|
|||
|
|
|
|||
|
|
upstream: better debug logging of sessions' exit status
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: 82237567fcd4098797cbdd17efa6ade08e1a36b0
|
|||
|
|
|
|||
|
|
commit a8c57bcb077f0cfdffcf9f23866bf73bb93e185c
|
|||
|
|
Author: naddy@openbsd.org <naddy@openbsd.org>
|
|||
|
|
Date: Thu Aug 10 14:37:32 2023 +0000
|
|||
|
|
|
|||
|
|
upstream: drop a wayward comma, ok jmc@
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: 5c11fbb9592a29b37bbf36f66df50db9d38182c6
|
|||
|
|
|
|||
|
|
commit e962f9b318a238db1becc53c2bf79dd3a49095b4
|
|||
|
|
Author: Damien Miller <djm@mindrot.org>
|
|||
|
|
Date: Thu Aug 10 11:10:22 2023 +1000
|
|||
|
|
|
|||
|
|
depend
|
|||
|
|
|
|||
|
|
commit 0fcb60bf83130dfa428bc4422b3a3ac20fb528af
|
|||
|
|
Author: Damien Miller <djm@mindrot.org>
|
|||
|
|
Date: Thu Aug 10 11:05:42 2023 +1000
|
|||
|
|
|
|||
|
|
update versions in RPM specs
|
|||
|
|
|
|||
|
|
commit d0cee4298491314f09afa1c4383a66d913150b26
|
|||
|
|
Author: Damien Miller <djm@mindrot.org>
|
|||
|
|
Date: Thu Aug 10 11:05:14 2023 +1000
|
|||
|
|
|
|||
|
|
update version in README
|
|||
|
|
|
|||
|
|
commit 78b4dc6684f4d35943b46b24ee645edfdb9974f5
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Thu Aug 10 01:01:07 2023 +0000
|
|||
|
|
|
|||
|
|
upstream: openssh-9.4
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: 71fc1e01a4c4ea061b252bd399cda7be757e6e35
|
|||
|
|
|
|||
|
|
commit 58ca4f0aa8c4306ac0a629c9a85fb1efaf4ff092
|
|||
|
|
Author: Darren Tucker <dtucker@dtucker.net>
|
|||
|
|
Date: Thu Aug 10 11:30:24 2023 +1000
|
|||
|
|
|
|||
|
|
Only include unistd.h once.
|
|||
|
|
|
|||
|
|
commit 3961ed02dc578517a9d2535128cff5c3a5460d28
|
|||
|
|
Author: Damien Miller <djm@mindrot.org>
|
|||
|
|
Date: Thu Aug 10 09:08:49 2023 +1000
|
|||
|
|
|
|||
|
|
wrap poll.h include in HAVE_POLL_H
|
|||
|
|
|
|||
|
|
commit e535fbe2af893046c28adfcd787c1fdbae36a24a
|
|||
|
|
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
|||
|
|
Date: Fri Aug 4 06:32:40 2023 +0000
|
|||
|
|
|
|||
|
|
upstream: Apply ConnectTimeout to multiplexing local socket
|
|||
|
|
|
|||
|
|
connections. If the multiplex socket exists but the connection times out,
|
|||
|
|
ssh will fall back to a direct connection the same way it would if the socket
|
|||
|
|
did not exist at all. ok djm@
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: 2fbe1a36d4a24b98531b2d298a6557c8285dc1b4
|
|||
|
|
|
|||
|
|
commit 9d92e7b24848fcc605945f7c2e3460c7c31832ce
|
|||
|
|
Author: Darren Tucker <dtucker@dtucker.net>
|
|||
|
|
Date: Thu Aug 3 19:35:33 2023 +1000
|
|||
|
|
|
|||
|
|
Fix RNG seeding for OpenSSL w/out self seeding.
|
|||
|
|
|
|||
|
|
When sshd is built with an OpenSSL that does not self-seed, it would
|
|||
|
|
fail in the preauth privsep process while handling a new connection.
|
|||
|
|
Sanity checked by djm@
|
|||
|
|
|
|||
|
|
commit f70010d9b0b3e7e95de8aa0b961e1d74362cfb5d
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Wed Aug 2 23:04:38 2023 +0000
|
|||
|
|
|
|||
|
|
upstream: CheckHostIP has defaulted to 'no' for a while; make the
|
|||
|
|
|
|||
|
|
commented- out config option match. From Ed Maste
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: e66e934c45a9077cb1d51fc4f8d3df4505db58d9
|
|||
|
|
|
|||
|
|
commit c88a8788f9865d02b986d00405b9f0be65ad0b5a
|
|||
|
|
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
|||
|
|
Date: Tue Aug 1 08:15:04 2023 +0000
|
|||
|
|
|
|||
|
|
upstream: remove unnecessary if statement.
|
|||
|
|
|
|||
|
|
github PR#422 from eyalasulin999, ok djm@
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: 2b6b0dde4407e039f58f86c8d2ff584a8205ea55
|
|||
|
|
|
|||
|
|
commit 77b8b865cd5a8c79a47605c0c5b2bacf4692c4d5
|
|||
|
|
Author: jmc@openbsd.org <jmc@openbsd.org>
|
|||
|
|
Date: Fri Jul 28 05:42:36 2023 +0000
|
|||
|
|
|
|||
|
|
upstream: %C is a callable macro in mdoc(7)
|
|||
|
|
|
|||
|
|
so, as we do for %D, escape it;
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: 538cfcddbbb59dc3a8739604319491dcb8e0c0c9
|
|||
|
|
|
|||
|
|
commit e0f91aa9c2fbfc951e9ced7e1305455fc614d3f2
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Fri Jul 28 05:33:15 2023 +0000
|
|||
|
|
|
|||
|
|
upstream: don't need to start a command here; use ssh -N instead.
|
|||
|
|
|
|||
|
|
Fixes failure on cygwin spotted by Darren
|
|||
|
|
|
|||
|
|
OpenBSD-Regress-ID: ff678a8cc69160a3b862733d935ec4a383f93cfb
|
|||
|
|
|
|||
|
|
commit f446a44f30bc680e0d026a4204844b02646c1c2d
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Wed May 17 05:52:01 2023 +0000
|
|||
|
|
|
|||
|
|
upstream: add LTESTS_FROM variable to allow skipping of tests up to
|
|||
|
|
|
|||
|
|
a specific point. e.g. "make LTESTS_FROM=t-sftp" will only run the sftp.sh
|
|||
|
|
test and subsequent ones. ok dtucker@
|
|||
|
|
|
|||
|
|
OpenBSD-Regress-ID: 07f653de731def074b29293db946042706fcead3
|
|||
|
|
|
|||
|
|
commit 8eb8899d612440a9b608bee7f916081d3d0b7812
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Fri May 12 06:37:42 2023 +0000
|
|||
|
|
|
|||
|
|
upstream: test ChrootDirectory in Match block
|
|||
|
|
|
|||
|
|
OpenBSD-Regress-ID: a6150262f39065939f025e546af2a346ffe674c1
|
|||
|
|
|
|||
|
|
commit e43f43d3f19516222e9a143468ea0dc1b3ab67b6
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Fri May 12 06:36:27 2023 +0000
|
|||
|
|
|
|||
|
|
upstream: better error messages
|
|||
|
|
|
|||
|
|
OpenBSD-Regress-ID: 55e4186604e80259496d841e690ea2090981bc7a
|
|||
|
|
|
|||
|
|
commit 6958f00acf3b9e0b3730f7287e69996bcf3ceda4
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Thu Jul 27 22:26:49 2023 +0000
|
|||
|
|
|
|||
|
|
upstream: don't incorrectly truncate logged strings retrieved from
|
|||
|
|
|
|||
|
|
PKCS#11 modules; based on GHPR406 by Jakub Jelen; ok markus
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: 7ed1082f23a13b38c373008f856fd301d50012f9
|
|||
|
|
|
|||
|
|
commit d1ffde6b55170cd4b9a72bfd9a3f17508e6cf714
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Thu Jul 27 22:25:17 2023 +0000
|
|||
|
|
|
|||
|
|
upstream: make sshd_config AuthorizedPrincipalsCommand and
|
|||
|
|
|
|||
|
|
AuthorizedKeysCommand accept the %D (routing domain) and a new %C (connection
|
|||
|
|
address/port 4-tuple) as expansion sequences; ok markus
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: ee9a48bf1a74c4ace71b69de69cfdaa2a7388565
|
|||
|
|
|
|||
|
|
commit 999a2886ca1844a7a74b905e5f2c8c701f9838cd
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Thu Jul 27 22:23:05 2023 +0000
|
|||
|
|
|
|||
|
|
upstream: increase default KDF work-factor for OpenSSH format
|
|||
|
|
|
|||
|
|
private keys from 16 to 24; { feedback ok } x { deraadt markus }
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: a3afb1383f8ff0a49613d449f02395d9e8d4a9ec
|
|||
|
|
|
|||
|
|
commit 0fa803a1dd1c7b546c166000e23a869cf6c4ec10
|
|||
|
|
Author: Darren Tucker <dtucker@dtucker.net>
|
|||
|
|
Date: Thu Jul 27 02:25:09 2023 +1000
|
|||
|
|
|
|||
|
|
Prefer OpenSSL's SHA256 in sk-dummy.so
|
|||
|
|
|
|||
|
|
Previously sk-dummy.so used libc's (or compat's) SHA256 since it may be
|
|||
|
|
built without OpenSSL. In many cases, however, including both libc's
|
|||
|
|
and OpenSSL's headers together caused conflicting definitions.
|
|||
|
|
|
|||
|
|
We tried working around this (on OpenSSL <1.1 you could define
|
|||
|
|
OPENSSL_NO_SHA, NetBSD had USE_LIBC_SHA2, various #define hacks) with
|
|||
|
|
varying levels of success. Since OpenSSL >=1.1 removed OPENSSL_NO_SHA
|
|||
|
|
and including most OpenSSL headers would bring sha.h in, even if it
|
|||
|
|
wasn't used directly this was a constant hassle.
|
|||
|
|
|
|||
|
|
Admit defeat and use OpenSSL's SHA256 unless we aren't using OpenSSL at
|
|||
|
|
all. ok djm@
|
|||
|
|
|
|||
|
|
commit 36cdb5dbf55c99c0faad06066f56a7c341258c1f
|
|||
|
|
Author: Darren Tucker <dtucker@dtucker.net>
|
|||
|
|
Date: Thu Jul 27 10:29:44 2023 +1000
|
|||
|
|
|
|||
|
|
Retire dfly58 test VM. Add dfly64.
|
|||
|
|
|
|||
|
|
commit 2d34205dab08ede9b0676efa57647fc49e6decbe
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Wed Jul 26 23:06:00 2023 +0000
|
|||
|
|
|
|||
|
|
upstream: make ssh -f (fork after authentication) work properly in
|
|||
|
|
|
|||
|
|
multiplexed cases (inc. ControlPersist). bz3589 bz3589 Based on patches by
|
|||
|
|
Peter Chubb; ok dtucker@
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: a7a2976a54b93e6767dc846b85647e6ec26969ac
|
|||
|
|
|
|||
|
|
commit 076aeda86a7ee9be8fd2f0181ec7b9729a6ceb37
|
|||
|
|
Author: naddy@openbsd.org <naddy@openbsd.org>
|
|||
|
|
Date: Sun Jul 23 20:04:45 2023 +0000
|
|||
|
|
|
|||
|
|
upstream: man page typos; ok jmc@
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: e6ddfef94b0eb867ad88abe07cedc8ed581c07f0
|
|||
|
|
|
|||
|
|
commit 135e7d5fe31f700e6dfc61ce914970c5ee7175ba
|
|||
|
|
Author: jmc@openbsd.org <jmc@openbsd.org>
|
|||
|
|
Date: Thu Jul 20 05:43:39 2023 +0000
|
|||
|
|
|
|||
|
|
upstream: tweak the allow-remote-pkcs11 text;
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: bc965460a89edf76865b7279b45cf9cbdebd558a
|
|||
|
|
|
|||
|
|
commit 5f83342b61d1f76c141de608ed2bd293990416bd
|
|||
|
|
Author: Darren Tucker <dtucker@dtucker.net>
|
|||
|
|
Date: Tue Jul 25 13:00:22 2023 +1000
|
|||
|
|
|
|||
|
|
Handle a couple more OpenSSL no-ecc cases.
|
|||
|
|
|
|||
|
|
ok djm@
|
|||
|
|
|
|||
|
|
commit edc2ef4e418e514c99701451fae4428ec04ce538
|
|||
|
|
Author: Damien Miller <djm@mindrot.org>
|
|||
|
|
Date: Thu Jul 20 12:53:44 2023 +1000
|
|||
|
|
|
|||
|
|
depend
|
|||
|
|
|
|||
|
|
commit 51fda734e0d3c2df256fc03e8b060c4305be6e59
|
|||
|
|
Author: Damien Miller <djm@mindrot.org>
|
|||
|
|
Date: Thu Jul 20 12:53:21 2023 +1000
|
|||
|
|
|
|||
|
|
Bring back OPENSSL_HAS_ECC to ssh-pkcs11-client
|
|||
|
|
|
|||
|
|
commit 099cdf59ce1e72f55d421c8445bf6321b3004755
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Wed Jul 19 14:03:45 2023 +0000
|
|||
|
|
|
|||
|
|
upstream: Separate ssh-pkcs11-helpers for each p11 module
|
|||
|
|
|
|||
|
|
Make ssh-pkcs11-client start an independent helper for each provider,
|
|||
|
|
providing better isolation between modules and reliability if a single
|
|||
|
|
module misbehaves.
|
|||
|
|
|
|||
|
|
This also implements reference counting of PKCS#11-hosted keys,
|
|||
|
|
allowing ssh-pkcs11-helper subprocesses to be automatically reaped
|
|||
|
|
when no remaining keys reference them. This fixes some bugs we have
|
|||
|
|
that make PKCS11 keys unusable after they have been deleted, e.g.
|
|||
|
|
https://bugzilla.mindrot.org/show_bug.cgi?id=3125
|
|||
|
|
|
|||
|
|
ok markus@
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: 0ce188b14fe271ab0568f4500070d96c5657244e
|
|||
|
|
|
|||
|
|
commit 29ef8a04866ca14688d5b7fed7b8b9deab851f77
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Wed Jul 19 14:02:27 2023 +0000
|
|||
|
|
|
|||
|
|
upstream: Ensure FIDO/PKCS11 libraries contain expected symbols
|
|||
|
|
|
|||
|
|
This checks via nlist(3) that candidate provider libraries contain one
|
|||
|
|
of the symbols that we will require prior to dlopen(), which can cause
|
|||
|
|
a number of side effects, including execution of constructors.
|
|||
|
|
|
|||
|
|
Feedback deraadt; ok markus
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: 1508a5fbd74e329e69a55b56c453c292029aefbe
|
|||
|
|
|
|||
|
|
commit 1f2731f5d7a8f8a8385c6031667ed29072c0d92a
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Wed Jul 19 13:56:33 2023 +0000
|
|||
|
|
|
|||
|
|
upstream: Disallow remote addition of FIDO/PKCS11 provider
|
|||
|
|
|
|||
|
|
libraries to ssh-agent by default.
|
|||
|
|
|
|||
|
|
The old behaviour of allowing remote clients from loading providers
|
|||
|
|
can be restored using `ssh-agent -O allow-remote-pkcs11`.
|
|||
|
|
|
|||
|
|
Detection of local/remote clients requires a ssh(1) that supports
|
|||
|
|
the `session-bind@openssh.com` extension. Forwarding access to a
|
|||
|
|
ssh-agent socket using non-OpenSSH tools may circumvent this control.
|
|||
|
|
|
|||
|
|
ok markus@
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: 4c2bdf79b214ae7e60cc8c39a45501344fa7bd7c
|
|||
|
|
|
|||
|
|
commit 892506b13654301f69f9545f48213fc210e5c5cc
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Wed Jul 19 13:55:53 2023 +0000
|
|||
|
|
|
|||
|
|
upstream: terminate process if requested to load a PKCS#11 provider
|
|||
|
|
|
|||
|
|
that isn't a PKCS#11 provider; from / ok markus@
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: 39532cf18b115881bb4cfaee32084497aadfa05c
|
|||
|
|
|
|||
|
|
commit f3f56df8ec476b2de6cbdbdfdb77a2a61087829d
|
|||
|
|
Author: Damien Miller <djm@mindrot.org>
|
|||
|
|
Date: Wed Jul 19 12:07:18 2023 +1000
|
|||
|
|
|
|||
|
|
agent_fuzz doesn't want stdint.h conditionalised
|
|||
|
|
|
|||
|
|
commit 750911fd31d307a767cc86e3bfa90bbbb77b1a25
|
|||
|
|
Author: Damien Miller <djm@mindrot.org>
|
|||
|
|
Date: Tue Jul 18 15:41:12 2023 +1000
|
|||
|
|
|
|||
|
|
conditionalise stdint.h inclusion on HAVE_STDINT_H
|
|||
|
|
|
|||
|
|
fixes build on AIX5 at least
|
|||
|
|
|
|||
|
|
commit ff047504fa6e008c4092f8929881816b8993bea0
|
|||
|
|
Author: Damien Miller <djm@mindrot.org>
|
|||
|
|
Date: Tue Jul 18 15:30:45 2023 +1000
|
|||
|
|
|
|||
|
|
conditionalise match localnetwork on ifaddrs.h
|
|||
|
|
|
|||
|
|
Fixes build breakage on platforms that lack getifaddrs()
|
|||
|
|
|
|||
|
|
commit b87b03282e466ca2927954ce93f5dbf0bfdc68f6
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Mon Jul 17 06:16:33 2023 +0000
|
|||
|
|
|
|||
|
|
upstream: missing match localnetwork negation check
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: 9a08ed8dae27d3f38cf280f1b28d4e0ff41a737a
|
|||
|
|
|
|||
|
|
commit 6d6e185ba29ef4274164b77eab4dc763907f8821
|
|||
|
|
Author: jmc@openbsd.org <jmc@openbsd.org>
|
|||
|
|
Date: Mon Jul 17 05:41:53 2023 +0000
|
|||
|
|
|
|||
|
|
upstream: - add -P to usage() - sync the arg name to -J in usage()
|
|||
|
|
|
|||
|
|
with that in ssh.1 - reformat usage() to match what "man ssh" does on 80width
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: 5235dd7aa42e5bf90ae54579d519f92fc107036e
|
|||
|
|
|
|||
|
|
commit f1a9898283a0638667b587ee4a950afd61ab51b0
|
|||
|
|
Author: jmc@openbsd.org <jmc@openbsd.org>
|
|||
|
|
Date: Mon Jul 17 05:38:10 2023 +0000
|
|||
|
|
|
|||
|
|
upstream: -P before -p in SYNOPSIS;
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: 535f5257c779e26c6a662a038d241b017f8cab7c
|
|||
|
|
|
|||
|
|
commit eef4d7e873568e1c84c36bb4034e2c3378250a61
|
|||
|
|
Author: jsg@openbsd.org <jsg@openbsd.org>
|
|||
|
|
Date: Mon Jul 17 05:36:14 2023 +0000
|
|||
|
|
|
|||
|
|
upstream: configuation -> configuration
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: 4776ced33b780f1db0b2902faec99312f26a726b
|
|||
|
|
|
|||
|
|
commit dc1dbe94cf6532bd546a3373ad436404f8850e5f
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Mon Jul 17 05:26:38 2023 +0000
|
|||
|
|
|
|||
|
|
upstream: move other RCSIDs to before their respective license blocks
|
|||
|
|
|
|||
|
|
too no code change
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: ef5bf46b57726e4260a63b032b0b5ac3b4fe9cd4
|
|||
|
|
|
|||
|
|
commit ebe11044681caff78834ca6b78311ad19c1860b8
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Mon Jul 17 05:22:30 2023 +0000
|
|||
|
|
|
|||
|
|
upstream: Move RCSID to before license block and away from #includes,
|
|||
|
|
|
|||
|
|
where it caused merge conflict in -portable for each commit :(
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: 756ebac963df3245258b962e88150ebab9d5fc20
|
|||
|
|
|
|||
|
|
commit 05c08e5f628de3ecf6f7ea20947735bcfa3201e0
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Mon Jul 17 05:20:15 2023 +0000
|
|||
|
|
|
|||
|
|
upstream: return SSH_ERR_KRL_BAD_MAGIC when a KRL doesn't contain a
|
|||
|
|
|
|||
|
|
valid magic number and not SSH_ERR_MESSAGE_INCOMPLETE; the former is needed
|
|||
|
|
to fall back to text revocation lists in some cases; fixes t-cert-hostkey.
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: 5c670a6c0f027e99b7774ef29f18ba088549c7e1
|
|||
|
|
|
|||
|
|
commit c6fad2c3d19b74f0bd0af1ef040fc74f3a1d9ebb
|
|||
|
|
Author: Damien Miller <djm@mindrot.org>
|
|||
|
|
Date: Mon Jul 17 14:56:14 2023 +1000
|
|||
|
|
|
|||
|
|
avoid AF_LINK on platforms that don't define it
|
|||
|
|
|
|||
|
|
commit 919bc3d3b712c920de1ae6be5ac6561c98886d7e
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Mon Jul 17 04:08:31 2023 +0000
|
|||
|
|
|
|||
|
|
upstream: Add support for configuration tags to ssh(1).
|
|||
|
|
|
|||
|
|
This adds a ssh_config(5) "Tag" directive and corresponding
|
|||
|
|
"Match tag" predicate that may be used to select blocks of
|
|||
|
|
configuration similar to the pf.conf(5) keywords of the same
|
|||
|
|
name.
|
|||
|
|
|
|||
|
|
ok markus
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: dc08358e70e702b59ac3e591827e5a96141b06a3
|
|||
|
|
|
|||
|
|
commit 3071d85a47061c1bdaf11a0ac233b501ecba862c
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Mon Jul 17 04:04:36 2023 +0000
|
|||
|
|
|
|||
|
|
upstream: add a "match localnetwork" predicate.
|
|||
|
|
|
|||
|
|
This allows matching on the addresses of available network interfaces
|
|||
|
|
and may be used to vary the effective client configuration based on
|
|||
|
|
network location (e.g. to use a ProxyJump when not on a particular
|
|||
|
|
network).
|
|||
|
|
|
|||
|
|
ok markus@
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: cffb6ff9a3803abfc52b5cad0aa190c5e424c139
|
|||
|
|
|
|||
|
|
commit beec17bb311365b75a0a5941418d4b96df7d7888
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Mon Jul 17 04:01:10 2023 +0000
|
|||
|
|
|
|||
|
|
upstream: remove vestigal support for KRL signatures
|
|||
|
|
|
|||
|
|
When the KRL format was originally defined, it included support for
|
|||
|
|
signing of KRL objects. However, the code to sign KRLs and verify KRL
|
|||
|
|
signatues was never completed in OpenSSH.
|
|||
|
|
|
|||
|
|
Now, some years later, we have SSHSIG support in ssh-keygen that is
|
|||
|
|
more general, well tested and actually works. So this removes the
|
|||
|
|
semi-finished KRL signing/verification support from OpenSSH and
|
|||
|
|
refactors the remaining code to realise the benefit - primarily, we
|
|||
|
|
no longer need to perform multiple parsing passes over KRL objects.
|
|||
|
|
|
|||
|
|
ok markus@
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: 517437bab3d8180f695c775410c052340e038804
|
|||
|
|
|
|||
|
|
commit 449566f64c21b4578d5c0c431badd0328adc53ed
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Mon Jul 17 03:57:21 2023 +0000
|
|||
|
|
|
|||
|
|
upstream: Support for KRL extensions.
|
|||
|
|
|
|||
|
|
This defines wire formats for optional KRL extensions and implements
|
|||
|
|
parsing of the new submessages. No actual extensions are supported at
|
|||
|
|
this point.
|
|||
|
|
|
|||
|
|
ok markus
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: ae2fcde9a22a9ba7f765bd4f36b3f5901d8c3fa7
|
|||
|
|
|
|||
|
|
commit 18ea857770e84825a3a6238bb37f54864487b59f
|
|||
|
|
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
|||
|
|
Date: Fri Jul 14 07:44:21 2023 +0000
|
|||
|
|
|
|||
|
|
upstream: Include stdint.h for SIZE_MAX. Fixes OPENSSL=no build.
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: e7c31034a5434f2ead3579b13a7892960651e6b0
|
|||
|
|
|
|||
|
|
commit 20b768fcd13effe0f2d3619661b6c8592c773553
|
|||
|
|
Author: Darren Tucker <dtucker@dtucker.net>
|
|||
|
|
Date: Fri Jul 14 17:07:32 2023 +1000
|
|||
|
|
|
|||
|
|
Fix typo in declaration of nmesg.
|
|||
|
|
|
|||
|
|
commit 4b94d09542e36ebde2eb9ad89bc68431609932de
|
|||
|
|
Author: Damien Miller <djm@mindrot.org>
|
|||
|
|
Date: Fri Jul 14 15:34:47 2023 +1000
|
|||
|
|
|
|||
|
|
portable-specific int overflow defence-in-depth
|
|||
|
|
|
|||
|
|
These too are unreachable, but we want the code to be safe regardless of
|
|||
|
|
context. Reported by Yair Mizrahi @ JFrog
|
|||
|
|
|
|||
|
|
commit 2ee48adb9fc8692e8d6ac679dcc9f35e89ad68f0
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Fri Jul 14 05:31:44 2023 +0000
|
|||
|
|
|
|||
|
|
upstream: add defence-in-depth checks for some unreachable integer
|
|||
|
|
|
|||
|
|
overflows reported by Yair Mizrahi @ JFrog; feedback/ok millert@
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: 52af085f4e7ef9f9d8423d8c1840a6a88bda90bd
|
|||
|
|
|
|||
|
|
commit 4b43bc358ae6f6b19a973679246dc5172f6ac41b
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Mon Jul 10 04:51:26 2023 +0000
|
|||
|
|
|
|||
|
|
upstream: misplaced debug message
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: d0f12af0a5067a756aa707bc39a83fa6f58bf7e5
|
|||
|
|
|
|||
|
|
commit 8c7203bcee4c4f98a22487b4631fe068b992099b
|
|||
|
|
Author: Damien Miller <djm@mindrot.org>
|
|||
|
|
Date: Wed Jul 12 11:41:19 2023 +1000
|
|||
|
|
|
|||
|
|
replace deprecate selinux matchpathcon function
|
|||
|
|
|
|||
|
|
This function is apparently deprecated. Documentation on what is the
|
|||
|
|
supposed replacement is is non-existent, so this follows the approach
|
|||
|
|
glibc used https://sourceware.org/git/?p=glibc.git;a=patch;h=f278835f59
|
|||
|
|
|
|||
|
|
ok dtucker@
|
|||
|
|
|
|||
|
|
commit 7e8800f5d701efffa39ccb63ca1e095ea777c31a
|
|||
|
|
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
|||
|
|
Date: Thu Jul 6 22:17:59 2023 +0000
|
|||
|
|
|
|||
|
|
upstream: minleft and maxsign are u_int so cast appropriately. Prompted
|
|||
|
|
|
|||
|
|
by github PR#410, ok deraadt.
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: 0514cd51db3ec60239966622a0d3495b15406ddd
|
|||
|
|
|
|||
|
|
commit 94842bfe9b09fc93189c6ed0dc9bbebc1d44a426
|
|||
|
|
Author: dlg@openbsd.org <dlg@openbsd.org>
|
|||
|
|
Date: Tue Jul 4 03:59:21 2023 +0000
|
|||
|
|
|
|||
|
|
upstream: add support for unix domain sockets to ssh -W
|
|||
|
|
|
|||
|
|
ok djm@ dtucker@
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: 3e6d47567b895c7c28855c7bd614e106c987a6d8
|
|||
|
|
|
|||
|
|
commit a95fc5eed09a0238fb127b6c50e8498432b79dae
|
|||
|
|
Author: David Seifert <soap@gentoo.org>
|
|||
|
|
Date: Fri May 12 14:06:01 2023 +0200
|
|||
|
|
|
|||
|
|
gss-serv.c: `MAXHOSTNAMELEN` -> `HOST_NAME_MAX`
|
|||
|
|
|
|||
|
|
`MAXHOSTNAMELEN` is not defined in POSIX, which breaks on musl:
|
|||
|
|
https://pubs.opengroup.org/onlinepubs/9699919799/functions/gethostname.html
|
|||
|
|
|
|||
|
|
Bug: https://bugs.gentoo.org/834044
|
|||
|
|
|
|||
|
|
commit 8a6cd08850f576e7527c52a1b086cae82fab290e
|
|||
|
|
Author: Darren Tucker <dtucker@dtucker.net>
|
|||
|
|
Date: Fri Jun 23 09:49:02 2023 +1000
|
|||
|
|
|
|||
|
|
Update runner OS version for hardenedmalloc test.
|
|||
|
|
|
|||
|
|
Hardenedmalloc dropped support for "legacy glibc" versions in their
|
|||
|
|
64dad0a69 so use a newer Ubuntu version for the runner for that test.
|
|||
|
|
|
|||
|
|
commit cfca6f17e64baed6822bb927ed9f372ce64d9c5b
|
|||
|
|
Author: Damien Miller <djm@mindrot.org>
|
|||
|
|
Date: Thu Jun 22 15:04:03 2023 +1000
|
|||
|
|
|
|||
|
|
handle sysconf(SC_OPEN_MAX) returning > INT_MAX;
|
|||
|
|
|
|||
|
|
bz3581; ok dtucker
|
|||
|
|
|
|||
|
|
commit c1c2ca1365b3f7b626683690bd2c68265f6d8ffd
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Wed Jun 21 05:10:26 2023 +0000
|
|||
|
|
|
|||
|
|
upstream: better validate CASignatureAlgorithms in ssh_config and
|
|||
|
|
|
|||
|
|
sshd_config.
|
|||
|
|
|
|||
|
|
Previously this directive would accept certificate algorithm names, but
|
|||
|
|
these were unusable in practice as OpenSSH does not support CA chains.
|
|||
|
|
|
|||
|
|
part of bz3577; ok dtucker@
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: a992d410c8a78ec982701bc3f91043dbdb359912
|
|||
|
|
|
|||
|
|
commit 4e73cd0f4ab3e5b576c56cac9732da62c8fc0565
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Wed Jun 21 05:08:32 2023 +0000
|
|||
|
|
|
|||
|
|
upstream: make `ssh -Q CASignatureAlgorithms` only list signature
|
|||
|
|
|
|||
|
|
algorithms that are valid for CA signing. Previous behaviour was to list all
|
|||
|
|
signing algorithms, including certificate algorithms (OpenSSH certificates do
|
|||
|
|
not support CA chains). part of bz3577; ok dtucker@
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: 99c2b072dbac0f44fd1f2269e3ff6c1b5d7d3e59
|
|||
|
|
|
|||
|
|
commit a69062f1695ac9c3c3dea29d3044c72aaa6af0ea
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Wed Jun 21 05:06:04 2023 +0000
|
|||
|
|
|
|||
|
|
upstream: handle rlimits > INT_MAX (rlim_t is u64); ok dtucker
|
|||
|
|
|
|||
|
|
bz3581
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: 31cf59c041becc0e5ccb0a77106f812c4cd1cd74
|
|||
|
|
|
|||
|
|
commit 8d33f2aa6bb895a7f85a47189913639086347b75
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Tue Jun 20 23:59:33 2023 +0000
|
|||
|
|
|
|||
|
|
upstream: prepare for support for connecting to unix domain sockets
|
|||
|
|
|
|||
|
|
using ssh -W by explicitly decoding PORT_STREAMLOCAL (a negative number) from
|
|||
|
|
the u32 that's passed over the multiplexing socket; previously code would
|
|||
|
|
just cast, which is UB.
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: e5ac5f40d354096c51e8c118a5c1b2d2b7a31384
|
|||
|
|
|
|||
|
|
commit b4ac435b4e67f8eb5932d8f59eb5b3cf7dc38df0
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Tue Jun 20 00:05:09 2023 +0000
|
|||
|
|
|
|||
|
|
upstream: reset comment=NULL for each key in do_fingerprint();
|
|||
|
|
|
|||
|
|
fixes "no comment" not showing on when running `ssh-keygen -l` on multiple
|
|||
|
|
keys where one has a comment and other following keys do not. Patch from
|
|||
|
|
Markus Kuhn via GHPR407, bz3580
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: 3cce84456fdcd67dc6b84e369f92c6686d111d9b
|
|||
|
|
|
|||
|
|
commit b53a809a549dcd4fbde554c6aa283e597b15ea33
|
|||
|
|
Author: millert@openbsd.org <millert@openbsd.org>
|
|||
|
|
Date: Mon Jun 5 13:24:36 2023 +0000
|
|||
|
|
|
|||
|
|
upstream: Store timeouts as int, not u_int as they are limited to
|
|||
|
|
|
|||
|
|
INT_MAX. Fixes sign compare warnings systems with 32-bit time_t due to type
|
|||
|
|
promotion. OK djm@
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: 48081e9ad35705c5f1705711704a4c2ff94e87b7
|
|||
|
|
|
|||
|
|
commit 2709809fd616a0991dc18e3a58dea10fb383c3f0
|
|||
|
|
Author: Philip Hands <phil@hands.com>
|
|||
|
|
Date: Wed May 24 19:41:14 2023 +0200
|
|||
|
|
|
|||
|
|
fixup! if -s & -p specified, mention 'sftp -P' on
|
|||
|
|
|
|||
|
|
success
|
|||
|
|
|
|||
|
|
SSH-Copy-ID-Upstream: 32686e7c65b4fa2846e474d3315102dfa0f043b0
|
|||
|
|
|
|||
|
|
commit 204e0bf05161b7641500d7ab266c21217412379f
|
|||
|
|
Author: Darren Tucker <dtucker@dtucker.net>
|
|||
|
|
Date: Tue Aug 3 21:25:48 2021 +1000
|
|||
|
|
|
|||
|
|
Make ssh-copy-id(1) consistent with OpenSSH.
|
|||
|
|
|
|||
|
|
This makes the ssh-copy-id man page more consistent with the rest of the
|
|||
|
|
OpenSSH man pages:
|
|||
|
|
- new sentence, new line
|
|||
|
|
- no sentences >80
|
|||
|
|
- N.B. -> NB
|
|||
|
|
- zap unused .Pp
|
|||
|
|
- zap trailing whitespace
|
|||
|
|
|
|||
|
|
Report from Debian via mindrot bz#3331, diff from jmc at openbsd.org.
|
|||
|
|
|
|||
|
|
SSH-Copy-ID-Upstream: d8974cfb6242316460ed22a1ccc662800a50c5d3
|
|||
|
|
|
|||
|
|
commit 9de79df66d1430d290fab670bb4b18612875e518
|
|||
|
|
Author: Philip Hands <phil@hands.com>
|
|||
|
|
Date: Wed May 24 11:45:43 2023 +0200
|
|||
|
|
|
|||
|
|
if -s & -p specified, mention 'sftp -P' on success
|
|||
|
|
|
|||
|
|
This was inspired by this:
|
|||
|
|
https://github.com/openssh/openssh-portable/pull/321
|
|||
|
|
but I thought that it was better to not do the sed patching.
|
|||
|
|
|
|||
|
|
BTW the reason one can get away with using $SSH_OPTS throughout, despite
|
|||
|
|
the lowercase -p in there, even if sftp is in use, is that the sftp call
|
|||
|
|
is using the already-established ssh master connection, so the port was
|
|||
|
|
passed to the earlier ssh.
|
|||
|
|
|
|||
|
|
SSH-Copy-ID-Upstream: 1c124d9bfafdbe28a00b683367ebf5750ce12eb2
|
|||
|
|
|
|||
|
|
commit 801cda54c00e0f4e7d89345a90874c8d05dc233a
|
|||
|
|
Author: Philip Hands <phil@hands.com>
|
|||
|
|
Date: Tue May 23 23:07:11 2023 +0200
|
|||
|
|
|
|||
|
|
drop whitespace
|
|||
|
|
|
|||
|
|
SSH-Copy-ID-Upstream: e604fae1cdee35c18055d35dcec530cf12ef00ad
|
|||
|
|
|
|||
|
|
commit 288482f53613f3e74544eb92deeb24f7c7f1f371
|
|||
|
|
Author: Philip Hands <phil@hands.com>
|
|||
|
|
Date: Tue May 23 20:52:13 2023 +0200
|
|||
|
|
|
|||
|
|
make -x also apply to the target script
|
|||
|
|
|
|||
|
|
SSH-Copy-ID-Upstream: 3c4214704f427bd0654adf9b0fc079253db21cf4
|
|||
|
|
|
|||
|
|
commit b79e7b88ed44f0e4339f0ff35c96c78a92175a8d
|
|||
|
|
Author: Philip Hands <phil@hands.com>
|
|||
|
|
Date: Tue May 23 16:46:42 2023 +0200
|
|||
|
|
|
|||
|
|
add -t option to specify the target path
|
|||
|
|
|
|||
|
|
Allow the default target path (.ssh/authorized_files) to be over-riden
|
|||
|
|
|
|||
|
|
This was inspired by this MR from Panagiotis Cheilaris <philaris@cs.ntua.gr>
|
|||
|
|
|
|||
|
|
https://gitlab.com/phil_hands/ssh-copy-id/-/merge_requests/8
|
|||
|
|
|
|||
|
|
SSH-Copy-ID-Upstream: a942a0e076874adb6d8b2f0fb76d6c7918190fcd
|
|||
|
|
|
|||
|
|
commit 914f4ad138714c471ba72fb6d5496b6235320edd
|
|||
|
|
Author: Carlos Rodríguez Gili <carlos.rodriguez-gili@upc.edu>
|
|||
|
|
Date: Tue Apr 20 19:23:57 2021 +0200
|
|||
|
|
|
|||
|
|
Fix test error for /bin/sh on Solaris 10 and older
|
|||
|
|
|
|||
|
|
On Solaris 10 and older targets /bin/sh is not POSIX-compliant.
|
|||
|
|
Test -z `...` fails with error 'sh: test: argument expected'.
|
|||
|
|
Using quotes around backticks fixes this and doesn't break
|
|||
|
|
POSIX compatibility.
|
|||
|
|
|
|||
|
|
SSH-Copy-ID-Upstream: 98394072a3f985b2650c1e8eab2fef84e38cc065
|
|||
|
|
|
|||
|
|
commit bd382dca316c721aed1e45edcf4c4e0f6374afb0
|
|||
|
|
Author: Jakub Jelen <jjelen@redhat.com>
|
|||
|
|
Date: Tue Mar 2 21:34:05 2021 +0000
|
|||
|
|
|
|||
|
|
Remove outdated comment
|
|||
|
|
|
|||
|
|
The commit b068122 removed the code dropping the trailing colon, but the comment stayed leaving the code confusing for future readers
|
|||
|
|
|
|||
|
|
SSH-Copy-ID-Upstream: 930d39f238117cd53810240ec989d0356aa1c1f6
|
|||
|
|
|
|||
|
|
commit bdcaf7939029433635d63aade8f9ac762aca2bbe
|
|||
|
|
Author: Darren Tucker <dtucker@dtucker.net>
|
|||
|
|
Date: Wed May 10 18:50:46 2023 +1000
|
|||
|
|
|
|||
|
|
Special case OpenWrt instead of Dropbear.
|
|||
|
|
|
|||
|
|
OpenWrt overrides the location of authorized_keys for root. Currently we
|
|||
|
|
assume that all Dropbear installations behave this way, which is not the
|
|||
|
|
case. Check for OpenWrt and root user before using that location instead
|
|||
|
|
of assuming that for all Dropbear servers. Prompted by Github PR#250.
|
|||
|
|
|
|||
|
|
SSH-Copy-ID-Upstream: 0e1f5d443a9967483c33945793107ae3f3e4af2d
|
|||
|
|
|
|||
|
|
commit cf84498f67abe93f813a296167b406a0db7b288e
|
|||
|
|
Author: Philip Hands <phil@hands.com>
|
|||
|
|
Date: Thu May 18 18:20:55 2023 +0200
|
|||
|
|
|
|||
|
|
ssh-copy-id: add -x option (for debugging)
|
|||
|
|
|
|||
|
|
This option causes the ssh-copy-id to run with set -x
|
|||
|
|
|
|||
|
|
SSH-Copy-ID-Upstream: a0ee367ea8c0a29c8b4515245e408d2d349e7844
|
|||
|
|
|
|||
|
|
commit b4a1efdcb88f03394c08e7f68ed4e11676830002
|
|||
|
|
Author: Philip Hands <phil@hands.com>
|
|||
|
|
Date: Thu May 18 17:14:41 2023 +0200
|
|||
|
|
|
|||
|
|
update copyright notices
|
|||
|
|
|
|||
|
|
SSH-Copy-ID-Upstream: c284ed33b361814ea48ff68cbd01ca525b2bf117
|
|||
|
|
|
|||
|
|
commit fcd78e31cdd45a7e69ccfe6d8a3b1037dc1de290
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Wed May 24 23:01:06 2023 +0000
|
|||
|
|
|
|||
|
|
upstream: fix AuthorizedPrincipalsCommand when AuthorizedKeysCommand
|
|||
|
|
|
|||
|
|
appears previously in configuration. Reported by John Meyers in bz3574 ok
|
|||
|
|
dtucker@
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: 1c92e4517284386703936e1d3abaa36cfacf1951
|
|||
|
|
|
|||
|
|
commit 5ec5504f1d328d5bfa64280cd617c3efec4f78f3
|
|||
|
|
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
|||
|
|
Date: Wed May 10 10:04:20 2023 +0000
|
|||
|
|
|
|||
|
|
upstream: Remove unused prototypes for ssh1 RSA functions.
|
|||
|
|
|
|||
|
|
From lengyijun via github PR#396.
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: 379a5afa8b7a0f3cba0c8a9bcceb4e5e33a5c1ef
|
|||
|
|
|
|||
|
|
commit fbf362b3891ae4b36052d1b39f37fc618b41c476
|
|||
|
|
Author: Darren Tucker <dtucker@dtucker.net>
|
|||
|
|
Date: Tue May 9 19:26:56 2023 +1000
|
|||
|
|
|
|||
|
|
main(void) to prevent unused variable warning.
|
|||
|
|
|
|||
|
|
commit baf854c8bb0a6d0af5c696c801e631a48dabbaba
|
|||
|
|
Author: Darren Tucker <dtucker@dtucker.net>
|
|||
|
|
Date: Tue May 9 19:25:45 2023 +1000
|
|||
|
|
|
|||
|
|
Remove warning pragma since clang doesn't like it.
|
|||
|
|
|
|||
|
|
commit 5fbb7a1349fbbb48ccb1b8cafff2c1854370d87d
|
|||
|
|
Author: Darren Tucker <dtucker@dtucker.net>
|
|||
|
|
Date: Tue May 9 17:13:33 2023 +1000
|
|||
|
|
|
|||
|
|
Suppress warning for snprintf truncation test.
|
|||
|
|
|
|||
|
|
commit 47742c513e4e045ecc985c6483fc5c8b050acda2
|
|||
|
|
Author: Darren Tucker <dtucker@dtucker.net>
|
|||
|
|
Date: Tue May 9 17:12:50 2023 +1000
|
|||
|
|
|
|||
|
|
Update OpenSSL compat test for 3.x.
|
|||
|
|
|
|||
|
|
commit 86ad25d455a2313126125540e61e0f9314283f88
|
|||
|
|
Author: Darren Tucker <dtucker@dtucker.net>
|
|||
|
|
Date: Mon May 8 20:23:08 2023 +1000
|
|||
|
|
|
|||
|
|
Add macos13 PAM test target.
|
|||
|
|
|
|||
|
|
commit 77cca2c4b13bc6e5f389565583b6202b0d1bccc2
|
|||
|
|
Author: Darren Tucker <dtucker@dtucker.net>
|
|||
|
|
Date: Mon May 8 20:14:46 2023 +1000
|
|||
|
|
|
|||
|
|
Skip agent-peereid test on macos13.
|
|||
|
|
|
|||
|
|
sudo -S nobody doesn't work on the github runners (probably a
|
|||
|
|
permission issue) so skip that test.
|
|||
|
|
|
|||
|
|
commit b356b8e91678ea295bcf44df5248c3fbf499fdcf
|
|||
|
|
Author: Darren Tucker <dtucker@dtucker.net>
|
|||
|
|
Date: Mon May 8 20:14:28 2023 +1000
|
|||
|
|
|
|||
|
|
Include config.guess in debug output.
|
|||
|
|
|
|||
|
|
commit b7afd8a4ecaca8afd3179b55e9db79c0ff210237
|
|||
|
|
Author: Darren Tucker <dtucker@dtucker.net>
|
|||
|
|
Date: Mon May 8 20:12:59 2023 +1000
|
|||
|
|
|
|||
|
|
Handle OpenSSL >=3 ABI compatibility.
|
|||
|
|
|
|||
|
|
Beyond OpenSSL 3.0, the ABI compatibility guarantees are wider (only
|
|||
|
|
major must match instead of major and minor in earlier versions).
|
|||
|
|
bz#3548, ok djm@
|
|||
|
|
|
|||
|
|
commit 0e9e2663eb2c6e9c3e10d15d70418312ae67e542
|
|||
|
|
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
|||
|
|
Date: Mon May 1 08:57:29 2023 +0000
|
|||
|
|
|
|||
|
|
upstream: Import regenerated moduli.
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: 3d5f811cfcaed8cc4a97e1db49ac61bdf118113c
|
|||
|
|
|
|||
|
|
commit d9687f49682e1e93383fc15ab2018850b2ef38c3
|
|||
|
|
Author: Darren Tucker <dtucker@dtucker.net>
|
|||
|
|
Date: Mon May 1 11:45:14 2023 +1000
|
|||
|
|
|
|||
|
|
Add macos-13 test target.
|
|||
|
|
|
|||
|
|
Also flatten OS list for clarity.
|
|||
|
|
|
|||
|
|
commit aacfd6767497b8fa6d41ecdd3f8e265d1e9ef1f6
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Sun Apr 30 22:54:22 2023 +0000
|
|||
|
|
|
|||
|
|
upstream: adjust ftruncate() logic to handle servers that reorder
|
|||
|
|
|
|||
|
|
requests.
|
|||
|
|
|
|||
|
|
sftp/scp will ftruncate the destination file after a transfer completes,
|
|||
|
|
to deal with the case where a longer destination file already existed.
|
|||
|
|
We tracked the highest contiguous block transferred to deal with this
|
|||
|
|
case, but our naive tracking doesn't deal with servers that reorder
|
|||
|
|
requests - a misfeature strictly permitted by the protocol but seldom
|
|||
|
|
implemented.
|
|||
|
|
|
|||
|
|
Adjust the logic to ftruncate() at the highest absolute block received
|
|||
|
|
when the transfer is successful. feedback deraadt@ ok markus@
|
|||
|
|
|
|||
|
|
prompted by https://github.com/openssh/openssh-portable/commit/9b733#commitcomment-110679778
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: 4af7fac75958ad8507b4fea58706f3ff0cfddb1b
|
|||
|
|
|
|||
|
|
commit c8eb3941758615c8284a48fff47872db926da63c
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Wed Apr 26 01:36:03 2023 +0000
|
|||
|
|
|
|||
|
|
upstream: Check for ProxyJump=none in CanonicalizeHostname logic.
|
|||
|
|
|
|||
|
|
Previously ssh would incorrectly refuse to canonicalise the hostname
|
|||
|
|
if ProxyJump was explicitly set to "none" when CanonicalizeHostname=yes
|
|||
|
|
|
|||
|
|
bz3567; ok dtucker
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: 80a58e43c3a32f97361282f756ec8d3f37989efd
|
|||
|
|
|
|||
|
|
commit ac383f3a5c6f529a2e8a5bc44af79a08c7da294e
|
|||
|
|
Author: jsg@openbsd.org <jsg@openbsd.org>
|
|||
|
|
Date: Wed Apr 12 14:22:04 2023 +0000
|
|||
|
|
|
|||
|
|
upstream: remove duplicate signal.h include
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: 30c0a34d74d91ddd0e6992525da70d3293392f70
|
|||
|
|
|
|||
|
|
commit 740dafa20f3f3d325f6f5d44e990b8c8a6d3d816
|
|||
|
|
Author: jsg@openbsd.org <jsg@openbsd.org>
|
|||
|
|
Date: Wed Apr 12 08:53:54 2023 +0000
|
|||
|
|
|
|||
|
|
upstream: fix double words ok dtucker@
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: 44d3223902fbce5276422bdc8063ab72a4078489
|
|||
|
|
|
|||
|
|
commit 6452f89577ec4f22440c31b8e19b061d1a7c4b2a
|
|||
|
|
Author: Darren Tucker <dtucker@dtucker.net>
|
|||
|
|
Date: Tue Apr 11 16:49:19 2023 +1000
|
|||
|
|
|
|||
|
|
Test against LibreSSL 3.7.2.
|
|||
|
|
|
|||
|
|
commit 2138f6be595ca106fe4805a1e3ab9c4d8acc697b
|
|||
|
|
Author: Damien Miller <djm@mindrot.org>
|
|||
|
|
Date: Thu Apr 6 14:33:10 2023 +1000
|
|||
|
|
|
|||
|
|
remove unused upper-case const strings in fmtfp
|
|||
|
|
|
|||
|
|
no float format that uses upper-case is supported nor are hex floats.
|
|||
|
|
ok dtucker
|
|||
|
|
|
|||
|
|
commit 484c5e6168fdb22cbcd73c4ff987cf9ca47989ca
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Thu Apr 6 03:56:02 2023 +0000
|
|||
|
|
|
|||
|
|
upstream: simplify sshsig_find_principals() similar to what happened to
|
|||
|
|
|
|||
|
|
sshsig_check_allowed_keys() in r1.31, removing some dead code
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: a493e628d4d6c08f878c276d998f4313ba61702d
|
|||
|
|
|
|||
|
|
commit 3a7b110fbc7e096423f8f7b459deffe4c65d70f4
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Thu Apr 6 03:21:31 2023 +0000
|
|||
|
|
|
|||
|
|
upstream: remove redundant ssh!=NULL check; we'd already
|
|||
|
|
|
|||
|
|
dereferenced it
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: 852bf12591ec5a9fb12dcbde9b1fd3945ad0df3c
|
|||
|
|
|
|||
|
|
commit 2519110659a1efac6c976895a86659d1b341c91b
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Thu Apr 6 03:19:32 2023 +0000
|
|||
|
|
|
|||
|
|
upstream: match_user() shouldn't be called with user==NULL unless
|
|||
|
|
|
|||
|
|
host and ipaddr are also NULL
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: fa3518346c21483e9e01a2e4b9436ae501daf8ea
|
|||
|
|
|
|||
|
|
commit 3b9ceaad7ad63c1c03c2a89e148340ad3a62a482
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Thu Apr 6 03:12:32 2023 +0000
|
|||
|
|
|
|||
|
|
upstream: don't care about glob() return value here.
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: 85bb82fea90478a482e9f65a1bec0aa24227fd66
|
|||
|
|
|
|||
|
|
commit 09d8da0849e2791b2500267cda333cd238f38754
|
|||
|
|
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
|||
|
|
Date: Mon Apr 3 08:10:54 2023 +0000
|
|||
|
|
|
|||
|
|
upstream: Move up null check and simplify process_escapes.
|
|||
|
|
|
|||
|
|
Based on Coverity CID 291863 which points out we check the channel
|
|||
|
|
pointer for NULLness after dereferencing it. Move this to the start
|
|||
|
|
of the function, and while there simplify initialization of efc a bit.
|
|||
|
|
ok djm@
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: de36e5ad6fde0fe263ca134e986b9095dc59380a
|
|||
|
|
|
|||
|
|
commit b36b162be5e6206f12b734222b7bc517c13a6bc8
|
|||
|
|
Author: Damien Miller <djm@mindrot.org>
|
|||
|
|
Date: Fri Mar 31 14:51:20 2023 +1100
|
|||
|
|
|
|||
|
|
need va_end() after va_copy(); ok dtucker
|
|||
|
|
|
|||
|
|
spotted by Coverity
|
|||
|
|
|
|||
|
|
commit f703757234a5c585553e72bba279b255a272750a
|
|||
|
|
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
|||
|
|
Date: Fri Mar 31 05:56:36 2023 +0000
|
|||
|
|
|
|||
|
|
upstream: Explicitly ignore return from waitpid here too.
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: eef2403df083c61028969fc679ee370373eacacb
|
|||
|
|
|
|||
|
|
commit 6b73aa29035991d1448a1a76f63ac152a6bf931c
|
|||
|
|
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
|||
|
|
Date: Fri Mar 31 04:45:08 2023 +0000
|
|||
|
|
|
|||
|
|
upstream: Explictly ignore return codes
|
|||
|
|
|
|||
|
|
where we don't check them.
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: 1ffb03038ba1b6b72667be50cf5e5e396b5f2740
|
|||
|
|
|
|||
|
|
commit 6f0308a3e717ebe68eeb3f95253612fab5dbf20e
|
|||
|
|
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
|||
|
|
Date: Fri Mar 31 04:42:29 2023 +0000
|
|||
|
|
|
|||
|
|
upstream: Return immediately from get_sock_port
|
|||
|
|
|
|||
|
|
if sock <0 so we don't call getsockname on a negative FD. From Coverity
|
|||
|
|
CID 291840, ok djm@
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: de1c1130646230c2eda559831fc6bfd1b61d9618
|
|||
|
|
|
|||
|
|
commit 1c1124dc901fca1ea2cb762044b8f1a5793a2bed
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Fri Mar 31 04:23:02 2023 +0000
|
|||
|
|
|
|||
|
|
upstream: don't leak arg2 on parse_pubkey_algos error path; ok
|
|||
|
|
|
|||
|
|
dtucker@
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: 7d0270ad3dd102412ca76add2b3760518abdef75
|
|||
|
|
|
|||
|
|
commit 8ba2d4764bb6a4701cd447d8b52604622ffe65f4
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Fri Mar 31 04:22:27 2023 +0000
|
|||
|
|
|
|||
|
|
upstream: clamp max number of GSSAPI mechanisms to 2048; ok dtucker
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: ce66db603a913d3dd57063e330cb5494d70722c4
|
|||
|
|
|
|||
|
|
commit 1883841fc13d0eada8743cac5d3abe142ee2efa7
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Fri Mar 31 04:21:56 2023 +0000
|
|||
|
|
|
|||
|
|
upstream: don't print key if printing hostname failed; with/ok
|
|||
|
|
|
|||
|
|
dtucker@
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: ad42971a6ee5a46feab2d79f7f656f8cf4b119f3
|
|||
|
|
|
|||
|
|
commit c6011129cafe4c411f6ef670a4cf271314708eb8
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Fri Mar 31 04:04:15 2023 +0000
|
|||
|
|
|
|||
|
|
upstream: remove redundant test
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: 6a0b719f9b1ae9d42ad8c5b144c7962c93792f7c
|
|||
|
|
|
|||
|
|
commit 4fb29eeafb40a2076c0dbe54e46b687c318f87aa
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Fri Mar 31 04:00:37 2023 +0000
|
|||
|
|
|
|||
|
|
upstream: don't attempt to decode a ridiculous number of
|
|||
|
|
|
|||
|
|
attributes; harmless because of bounds elsewhere, but better to be explicit
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: 1a34f4b6896155b80327d15dc7ccf294b538a9f2
|
|||
|
|
|
|||
|
|
commit fc437c154ef724621a4af236de9bc7e51a8381ae
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Fri Mar 31 03:22:49 2023 +0000
|
|||
|
|
|
|||
|
|
upstream: remove unused variable; prompted by Coverity CID 291879
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: 4c7d20ef776887b0ba1aabcfc1b14690e4ad0a40
|
|||
|
|
|
|||
|
|
commit 0eb8131e4a53b33a8fc9b9ab694e6b6778b87ade
|
|||
|
|
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
|||
|
|
Date: Fri Mar 31 00:44:29 2023 +0000
|
|||
|
|
|
|||
|
|
upstream: Check fd against >=0 instead of >0 in error path. The
|
|||
|
|
|
|||
|
|
dup could in theory return fd 0 although currently it doesn't in practice.
|
|||
|
|
From Dmitry Belyavskiy vi github PR#238.
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: 4a95f3f7330394dffee5c749d52713cbf3b54846
|
|||
|
|
|
|||
|
|
commit 7174ba6f8a431ca4257767a260fc50e204068242
|
|||
|
|
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
|||
|
|
Date: Thu Mar 30 07:19:50 2023 +0000
|
|||
|
|
|
|||
|
|
upstream: Ignore return value from muxclient(). It normally loops
|
|||
|
|
|
|||
|
|
without returning, but it if returns on failure we immediately exit.
|
|||
|
|
Coverity CID 405050.
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: ab3fde6da384ea588226037c38635a6b2e015295
|
|||
|
|
|
|||
|
|
commit a4c1c2513e36f111eeaa1322c510067930e5e51e
|
|||
|
|
Author: Damien Miller <djm@mindrot.org>
|
|||
|
|
Date: Fri Mar 31 14:17:22 2023 +1100
|
|||
|
|
|
|||
|
|
don't call connect() on negative socket
|
|||
|
|
|
|||
|
|
Coverity CID 405037
|
|||
|
|
|
|||
|
|
commit 34ee842cdd981a759fe8f0d4a37521f9a1c63170
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Thu Mar 30 03:05:01 2023 +0000
|
|||
|
|
|
|||
|
|
upstream: return SSH_ERR_KEY_NOT_FOUND if the allowed_signers file
|
|||
|
|
|
|||
|
|
is empty, not SSH_ERR_INTERNAL_ERROR. Also remove some dead code spotted
|
|||
|
|
by Coverity; with/ok dtucker@
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: 898a1e817cda9869554b1f586a434f67bcc3b650
|
|||
|
|
|
|||
|
|
commit f108e77a9dc9852e72215af1bf27731c48434557
|
|||
|
|
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
|||
|
|
Date: Thu Mar 30 00:49:37 2023 +0000
|
|||
|
|
|
|||
|
|
upstream: Remove dead code from inside if block.
|
|||
|
|
|
|||
|
|
The only way the if statement can be true is if both dup()s fail, and
|
|||
|
|
in that case the tmp2 can never be set. Coverity CID 291805, ok djm@
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: c0d6089b3fb725015462040cd94e23237449f0c8
|
|||
|
|
|
|||
|
|
commit 05b8e88ebe23db690abbfb1a91111abea09cde08
|
|||
|
|
Author: Darren Tucker <dtucker@dtucker.net>
|
|||
|
|
Date: Thu Mar 30 13:53:29 2023 +1100
|
|||
|
|
|
|||
|
|
child_set_eng: verify both env pointer and count.
|
|||
|
|
|
|||
|
|
If child_set env was called with a NULL env pointer and a non-zero count
|
|||
|
|
it would end up in a null deref, although we don't currently do this.
|
|||
|
|
Prompted by Coverity CID 291850, tweak & ok djm@
|
|||
|
|
|
|||
|
|
commit 28f1b8ef9b84b8cd2f6c9889a0c60aa4a90dadfa
|
|||
|
|
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
|||
|
|
Date: Wed Mar 29 01:07:48 2023 +0000
|
|||
|
|
|
|||
|
|
upstream: Ignore return from sshpkt_disconnect
|
|||
|
|
|
|||
|
|
since we set our own return value for the function. Coverity CID 291797,
|
|||
|
|
ok djm@
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: 710b57ba954c139240895e23feea41f203201f04
|
|||
|
|
|
|||
|
|
commit c3da05d95922f5550bcc7815e799474d6a160175
|
|||
|
|
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
|||
|
|
Date: Wed Mar 29 00:59:08 2023 +0000
|
|||
|
|
|
|||
|
|
upstream: Plug potential mem leak in process_put.
|
|||
|
|
|
|||
|
|
It allocates abs_dst inside a loop but only frees it on exit, so free
|
|||
|
|
inside the loop if necessary. Coverity CID 291837, ok djm@
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: a01616503a185519b16f00dde25d34ceaf4ae1a3
|
|||
|
|
|
|||
|
|
commit 13ae327eae598b1043e5ec30e4b170edb3c898a5
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Wed Mar 29 00:18:35 2023 +0000
|
|||
|
|
|
|||
|
|
upstream: fix memory leak; Coverity CID 291848
|
|||
|
|
|
|||
|
|
with/ok dtucker@
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: 37f80cb5d075ead5a00ad1b74175684ab1156ff8
|
|||
|
|
|
|||
|
|
commit 9ffa76e1284c85bf459c3dcb8e995733a8967e1b
|
|||
|
|
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
|||
|
|
Date: Tue Mar 28 07:44:32 2023 +0000
|
|||
|
|
|
|||
|
|
upstream: Plug more mem leaks in sftp by making
|
|||
|
|
|
|||
|
|
make_absolute_pwd_glob work in the same way as make_absolute: you
|
|||
|
|
pass it a dynamically allocated string and it either returns it, or
|
|||
|
|
frees it and allocates a new one. Patch from emaste at freebsd.org and
|
|||
|
|
https://reviews.freebsd.org/D37253 ok djm@
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: 85f7404e9d47fd28b222fbc412678f3361d2dffc
|
|||
|
|
|
|||
|
|
commit 82b2b8326962b1a98af279bc5bbbbbcab15b3e45
|
|||
|
|
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
|||
|
|
Date: Tue Mar 28 06:12:38 2023 +0000
|
|||
|
|
|
|||
|
|
upstream: Remove compat code for OpenSSL < 1.1.*
|
|||
|
|
|
|||
|
|
since -portable no longer supports them.
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: ea2893783331947cd29a67612b4e56f818f185ff
|
|||
|
|
|
|||
|
|
commit b500afcf00ae1b6b73b2ccf171111dfbfeaef74d
|
|||
|
|
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
|||
|
|
Date: Mon Mar 27 23:56:54 2023 +0000
|
|||
|
|
|
|||
|
|
upstream: Remove compat code for OpenSSL 1.0.*
|
|||
|
|
|
|||
|
|
versions now that -portable has dropped support for those versions.
|
|||
|
|
|
|||
|
|
OpenBSD-Regress-ID: 82a8eacd87aec28e4aa19f17246ddde9d5ce7fe7
|
|||
|
|
|
|||
|
|
commit 727560e6011efcb36d2f3ac6910444bc775abaa1
|
|||
|
|
Author: Darren Tucker <dtucker@dtucker.net>
|
|||
|
|
Date: Tue Mar 28 18:06:42 2023 +1100
|
|||
|
|
|
|||
|
|
Prevent conflicts between Solaris SHA2 and OpenSSL.
|
|||
|
|
|
|||
|
|
We used to prevent conflicts between native SHA2 headers and OpenSSL's
|
|||
|
|
by setting OPENSSL_NO_SHA but that was removed prior to OpenSSL 1.1.0
|
|||
|
|
|
|||
|
|
commit 46db8e14b7f186d32173dcdecd5b785334429b8b
|
|||
|
|
Author: Darren Tucker <dtucker@dtucker.net>
|
|||
|
|
Date: Tue Mar 28 12:44:03 2023 +1100
|
|||
|
|
|
|||
|
|
Remove HEADER_SHA_H from previous...
|
|||
|
|
|
|||
|
|
since it causes more problems than it solves.
|
|||
|
|
|
|||
|
|
commit 72bd68d37387aa5f81da928f6e82f1c88ed8f674
|
|||
|
|
Author: Darren Tucker <dtucker@dtucker.net>
|
|||
|
|
Date: Tue Mar 28 10:35:18 2023 +1100
|
|||
|
|
|
|||
|
|
Replace OPENSSL_NO_SHA with HEADER_SHA_H.
|
|||
|
|
|
|||
|
|
Since this test doesn't use OpenSSL's SHA2 and may cause conflicts we
|
|||
|
|
don't want to include it, but OPENSSL_NO_SHA was removed beginning in
|
|||
|
|
OpenSSL's 1.1 series.
|
|||
|
|
|
|||
|
|
commit 99668f2e6e0deb833e46cfab56db59ff0fc28c7e
|
|||
|
|
Author: Darren Tucker <dtucker@dtucker.net>
|
|||
|
|
Date: Tue Mar 28 09:50:06 2023 +1100
|
|||
|
|
|
|||
|
|
Configure with --target instead of deprecated form.
|
|||
|
|
|
|||
|
|
commit f751d9306c62cd1061f966e6a7483d9bab9c379b
|
|||
|
|
Author: Darren Tucker <dtucker@dtucker.net>
|
|||
|
|
Date: Mon Mar 27 22:05:29 2023 +1100
|
|||
|
|
|
|||
|
|
Pass rpath when building 64bit Solaris.
|
|||
|
|
|
|||
|
|
commit a64b935cd450ee8d04c26c9cd728629cf9ca5c91
|
|||
|
|
Author: Darren Tucker <dtucker@dtucker.net>
|
|||
|
|
Date: Mon Mar 27 19:21:19 2023 +1100
|
|||
|
|
|
|||
|
|
Explicitly disable OpenSSL on AIX test VM.
|
|||
|
|
|
|||
|
|
commit 7ebc6f060fc2f70495a56e16d210baae6424cd96
|
|||
|
|
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
|||
|
|
Date: Mon Mar 27 03:56:50 2023 +0000
|
|||
|
|
|
|||
|
|
upstream: Add RevokedHostKeys to percent expansion test.
|
|||
|
|
|
|||
|
|
OpenBSD-Regress-ID: c077fd12a38005dd53d878c5b944154dec88d2ff
|
|||
|
|
|
|||
|
|
commit f1a17de150f8d309d0c52f9abfaebf11c51a8537
|
|||
|
|
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
|||
|
|
Date: Mon Mar 27 03:56:11 2023 +0000
|
|||
|
|
|
|||
|
|
upstream: Add tilde and environment variable expansion to
|
|||
|
|
|
|||
|
|
RevokedHostKeys. bz#3552, ok djm@
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: ce5d8e0219b63cded594c17d4c2958c06918ec0d
|
|||
|
|
|
|||
|
|
commit 009eb4cb48a9708ab9174684dcbcc0f942907abe
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Mon Mar 27 03:31:05 2023 +0000
|
|||
|
|
|
|||
|
|
upstream: fix test: getnameinfo returns a non-zero value on error, not
|
|||
|
|
|
|||
|
|
(neccessarily) -1. From GHPR#384
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: d35e2b71268f66f5543a7ea68751972b3ae22b25
|
|||
|
|
|
|||
|
|
commit 4f0a676486700f10a4788f7e9426e94e39c1c89e
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Mon Mar 27 03:25:08 2023 +0000
|
|||
|
|
|
|||
|
|
upstream: scp: when copying local->remote, check that source file
|
|||
|
|
|
|||
|
|
exists before opening SFTP connection to the server. Based on GHPR#370 ok
|
|||
|
|
dtucker, markus
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: b4dd68e15bfe22ce4fac9960a1066a2b721e54fb
|
|||
|
|
|
|||
|
|
commit 154d8baf631327163571760c2c524bc93c37567c
|
|||
|
|
Author: Darren Tucker <dtucker@dtucker.net>
|
|||
|
|
Date: Mon Mar 27 12:22:30 2023 +1100
|
|||
|
|
|
|||
|
|
Also look for gdb error message from OpenIndiana.
|
|||
|
|
|
|||
|
|
commit fbd3811ddb2b6ce2e6dba91fde7352c8978e5412
|
|||
|
|
Author: Darren Tucker <dtucker@dtucker.net>
|
|||
|
|
Date: Mon Mar 27 11:08:00 2023 +1100
|
|||
|
|
|
|||
|
|
Explicitly disable security key test on aix51 VM.
|
|||
|
|
|
|||
|
|
We don't know how to build the shared objects required for the security
|
|||
|
|
key tests so skip them.
|
|||
|
|
|
|||
|
|
commit 4922ac3be8a996780ef3dc220411da2e27c29d9c
|
|||
|
|
Author: Darren Tucker <dtucker@dtucker.net>
|
|||
|
|
Date: Sun Mar 26 14:49:43 2023 +1100
|
|||
|
|
|
|||
|
|
Split libcrypto and other config flags.
|
|||
|
|
|
|||
|
|
This should allow the automatic OpenSSL version selection in the tests
|
|||
|
|
to work better.
|
|||
|
|
|
|||
|
|
commit 4a948b1469f185e871160a2d70e2a0fce2858f9e
|
|||
|
|
Author: Darren Tucker <dtucker@dtucker.net>
|
|||
|
|
Date: Sun Mar 26 14:39:45 2023 +1100
|
|||
|
|
|
|||
|
|
Specify test target if we build without OpenSSL.
|
|||
|
|
|
|||
|
|
When we decide we can't use the versions of OpenSSL available, also
|
|||
|
|
restrict the tests we run to avoid the ones that need OpenSSL.
|
|||
|
|
|
|||
|
|
commit b308c636f5b5d89eecb98be00b3d56306a005a09
|
|||
|
|
Author: Darren Tucker <dtucker@dtucker.net>
|
|||
|
|
Date: Sun Mar 26 14:22:53 2023 +1100
|
|||
|
|
|
|||
|
|
Find suitable OpenSSL version.
|
|||
|
|
|
|||
|
|
Check the installed OpenSSL versions for a suitable one, and if there
|
|||
|
|
isn't (and we don't have a specific version configured) then build
|
|||
|
|
without OpenSSL.
|
|||
|
|
|
|||
|
|
commit 021ea5c2860f133f44790970968e0e73208b3a87
|
|||
|
|
Author: Damien Miller <djm@mindrot.org>
|
|||
|
|
Date: Fri Mar 24 15:02:52 2023 +1100
|
|||
|
|
|
|||
|
|
Github testing support for BoringSSL
|
|||
|
|
|
|||
|
|
commit 9a97cd106466a2a9bda2bfaa4c48c4f1b2cc9c1b
|
|||
|
|
Author: Damien Miller <djm@mindrot.org>
|
|||
|
|
Date: Fri Mar 24 15:34:29 2023 +1100
|
|||
|
|
|
|||
|
|
BoringSSL doesn't support EC_POINT_point2bn()
|
|||
|
|
|
|||
|
|
so don't invoke it in unittest
|
|||
|
|
|
|||
|
|
commit cc5969c033a032d126ff78e5d95cf20abbede4c7
|
|||
|
|
Author: Damien Miller <djm@mindrot.org>
|
|||
|
|
Date: Fri Mar 24 15:34:05 2023 +1100
|
|||
|
|
|
|||
|
|
another ERR_load_CRYPTO_strings() vestige
|
|||
|
|
|
|||
|
|
commit 4974293899a068133e976f81d6693670d2b576ca
|
|||
|
|
Author: Damien Miller <djm@mindrot.org>
|
|||
|
|
Date: Fri Mar 24 15:24:05 2023 +1100
|
|||
|
|
|
|||
|
|
don't use obsolete ERR_load_CRYPTO_strings()
|
|||
|
|
|
|||
|
|
OpenSSL (and elsewhere in OpenSSH) uses ERR_load_crypto_strings()
|
|||
|
|
|
|||
|
|
commit 3c527d55f906e6970d17c4cab6db90ae9e013235
|
|||
|
|
Author: Damien Miller <djm@mindrot.org>
|
|||
|
|
Date: Fri Mar 24 15:23:05 2023 +1100
|
|||
|
|
|
|||
|
|
Allow building with BoringSSL
|
|||
|
|
|
|||
|
|
commit b7e27cfd7f163fc16b4c5d041cc28ee488a5eeec
|
|||
|
|
Author: Damien Miller <djm@mindrot.org>
|
|||
|
|
Date: Fri Mar 24 15:21:18 2023 +1100
|
|||
|
|
|
|||
|
|
put back SSLeay_version compat in configure test
|
|||
|
|
|
|||
|
|
Needed to detect old versions and give good "your version is bad"
|
|||
|
|
messages at configure time; spotted by dtucker@
|
|||
|
|
|
|||
|
|
commit 7280401bdd77ca54be6867a154cc01e0d72612e0
|
|||
|
|
Author: Damien Miller <djm@mindrot.org>
|
|||
|
|
Date: Fri Mar 24 13:56:25 2023 +1100
|
|||
|
|
|
|||
|
|
remove support for old libcrypto
|
|||
|
|
|
|||
|
|
OpenSSH now requires LibreSSL 3.1.0 or greater or
|
|||
|
|
OpenSSL 1.1.1 or greater
|
|||
|
|
|
|||
|
|
with/ok dtucker@
|
|||
|
|
|
|||
|
|
commit abda22fb48302f2142233f71d27c74040288c518
|
|||
|
|
Author: Darren Tucker <dtucker@dtucker.net>
|
|||
|
|
Date: Sun Mar 19 15:36:13 2023 +1100
|
|||
|
|
|
|||
|
|
Test latest OpenSSL 1.1, 3.0 and LibreSSL 3.7.
|
|||
|
|
|
|||
|
|
commit 610ac1cb077cd5a1ebfc21612154bfa13d2ec825
|
|||
|
|
Author: Darren Tucker <dtucker@dtucker.net>
|
|||
|
|
Date: Thu Mar 16 21:38:04 2023 +1100
|
|||
|
|
|
|||
|
|
Show 9.3 branch instead of 9.2.
|
|||
|
|
|
|||
|
|
commit cb30fbdbee869f1ce11f06aa97e1cb8717a0b645
|
|||
|
|
Author: Damien Miller <djm@mindrot.org>
|
|||
|
|
Date: Thu Mar 16 08:28:19 2023 +1100
|
|||
|
|
|
|||
|
|
depend
|
|||
|
|
|
|||
|
|
commit 1dba63eb10c40b6fda9f5012ed6ae87e2d3d028e
|
|||
|
|
Author: Damien Miller <djm@mindrot.org>
|
|||
|
|
Date: Thu Mar 16 08:27:54 2023 +1100
|
|||
|
|
|
|||
|
|
crank version
|
|||
|
|
|
|||
|
|
commit ba7532d0dac9aaf0ad7270664c43837fc9f64a5f
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Wed Mar 15 21:19:57 2023 +0000
|
|||
|
|
|
|||
|
|
upstream: openssh-9.3
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: 8011495f2449c1029bb316bd015eab2e00509848
|
|||
|
|
|
|||
|
|
commit 6fd4daafb949b66bf555f3100f715a9ec64c3390
|
|||
|
|
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
|||
|
|
Date: Tue Mar 14 07:28:47 2023 +0000
|
|||
|
|
|
|||
|
|
upstream: Free KRL ptr in addition to its contents.
|
|||
|
|
|
|||
|
|
From Coverity CID 291841, ok djm@
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: f146ba08b1b43af4e0d7ad8c4dae3748b4fa31b6
|
|||
|
|
|
|||
|
|
commit 1d270bd303afaf6d94e9098cbbf18e5e539e2088
|
|||
|
|
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
|||
|
|
Date: Tue Mar 14 07:26:25 2023 +0000
|
|||
|
|
|
|||
|
|
upstream: Check pointer for NULL before deref.
|
|||
|
|
|
|||
|
|
None of the existing callers seem to do that, but it's worth checking.
|
|||
|
|
From Coverity CID 291834, ok djm@
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: a0a97113f192a7cb1a2c97b932f677f573cda7a4
|
|||
|
|
|
|||
|
|
commit d95af508e78c0cd3dce56b83853baaa59ae295cf
|
|||
|
|
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
|||
|
|
Date: Sun Mar 12 10:40:39 2023 +0000
|
|||
|
|
|
|||
|
|
upstream: Limit number of entries in SSH2_MSG_EXT_INFO
|
|||
|
|
|
|||
|
|
request. This is already constrained by the maximum SSH packet size but this
|
|||
|
|
makes it explicit. Prompted by Coverity CID 291868, ok djm@ markus@
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: aea023819aa44a2dcb9dd0fbec10561896fc3a09
|
|||
|
|
|
|||
|
|
commit 8f287ba60d342b3e2f750e7332d2131e3ec7ecd0
|
|||
|
|
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
|||
|
|
Date: Sun Mar 12 09:41:18 2023 +0000
|
|||
|
|
|
|||
|
|
upstream: calloc can return NULL but xcalloc can't.
|
|||
|
|
|
|||
|
|
From Coverity CID 291881, ok djm@
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: 50204b755f66b2ec7ac3cfe379d07d85ca161d2b
|
|||
|
|
|
|||
|
|
commit 83a56a49fd50f4acf900f934279482e4ef329715
|
|||
|
|
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
|||
|
|
Date: Fri Mar 10 07:17:08 2023 +0000
|
|||
|
|
|
|||
|
|
upstream: Explicitly ignore return from fcntl
|
|||
|
|
|
|||
|
|
(... FD_CLOEXEC) here too. Coverity CID 291853.
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: 99d8b3da9d0be1d07ca8dd8e98800a890349e9b5
|
|||
|
|
|
|||
|
|
commit 0fda9d704d3bbf54a5e64ce02a6fecb11fe7f047
|
|||
|
|
Author: Damien Miller <djm@mindrot.org>
|
|||
|
|
Date: Fri Mar 10 15:59:46 2023 +1100
|
|||
|
|
|
|||
|
|
bounds checking for getrrsetbyname() replacement;
|
|||
|
|
|
|||
|
|
Spotted by Coverity in CID 405033; ok millert@
|
|||
|
|
|
|||
|
|
commit 89b8df518f21677045599df0ad3e5dd0f39909b5
|
|||
|
|
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
|||
|
|
Date: Fri Mar 10 04:06:21 2023 +0000
|
|||
|
|
|
|||
|
|
upstream: Plug mem leak on error path. Coverity CID 405026, ok djm@.
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: 8212ca05d01966fb5e72205c592b2257708a2aac
|
|||
|
|
|
|||
|
|
commit bf4dae0ad192c3e2f03f7223834b00d88ace3d3e
|
|||
|
|
Author: Darren Tucker <dtucker@dtucker.net>
|
|||
|
|
Date: Fri Mar 10 14:46:57 2023 +1100
|
|||
|
|
|
|||
|
|
Add prototypes for mkstemp replacements.
|
|||
|
|
|
|||
|
|
Should prevent warnings due to our wrapper function.
|
|||
|
|
|
|||
|
|
commit 4e04d68d6a33cdc73b831fd4b5e6124175555d3d
|
|||
|
|
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
|||
|
|
Date: Fri Mar 10 03:01:51 2023 +0000
|
|||
|
|
|
|||
|
|
upstream: Expliticly ignore return code from fcntl(.. FD_CLOEXEC) since
|
|||
|
|
|
|||
|
|
there's not much we can do anyway. From Coverity CID 291857, ok djm@
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: 051429dd07af8db3fec10d82cdc78d90bb051729
|
|||
|
|
|
|||
|
|
commit d6d38fd77cbe091c59e1bb720c3a494df4990640
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Fri Mar 10 02:32:04 2023 +0000
|
|||
|
|
|
|||
|
|
upstream: Like sshd_config, some ssh_config options are not
|
|||
|
|
|
|||
|
|
first-match-wins. sshd_config.5 was fixed in r1.348, this is the same for
|
|||
|
|
this file
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: 7be55b9351cde449b136afcc52d07aa4113b215e
|
|||
|
|
|
|||
|
|
commit 7187d3f86bf8f2066cc9941f217d23b0cacae25e
|
|||
|
|
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
|||
|
|
Date: Fri Mar 10 02:24:56 2023 +0000
|
|||
|
|
|
|||
|
|
upstream: Remove no-op (int) > INT_MAX checks
|
|||
|
|
|
|||
|
|
since they can never be true. From Coverity CID 405031, ok djm@
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: 9df3783b181e056595e2bb9edf7ed41d61cf8e84
|
|||
|
|
|
|||
|
|
commit 77adde4305542ebe3005dd456122624fe2347b01
|
|||
|
|
Author: Darren Tucker <dtucker@dtucker.net>
|
|||
|
|
Date: Fri Mar 10 13:27:29 2023 +1100
|
|||
|
|
|
|||
|
|
Wrap mkstemp calls with umask set/restore.
|
|||
|
|
|
|||
|
|
glibc versions 2.06 and earlier did not set a umask on files created by
|
|||
|
|
mkstemp created the world-writable. Wrap mkstemp to set and restore
|
|||
|
|
the umask. From Coverity (CIDs 291826 291886 291891), ok djm@
|
|||
|
|
|
|||
|
|
commit 633d3dc2a1e9e2a013d019a0576a0771c8423713
|
|||
|
|
Author: jcs@openbsd.org <jcs@openbsd.org>
|
|||
|
|
Date: Thu Mar 9 21:06:24 2023 +0000
|
|||
|
|
|
|||
|
|
upstream: modify parentheses in conditionals to make it clearer what is
|
|||
|
|
|
|||
|
|
being assigned and what is being checked
|
|||
|
|
|
|||
|
|
ok djm dtucker
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: 19c10baa46ae559474409f75a5cb3d0eade7a9b8
|
|||
|
|
|
|||
|
|
commit 733030840c4772f858de95d5940ec0c37663e8b0
|
|||
|
|
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
|||
|
|
Date: Thu Mar 9 07:11:05 2023 +0000
|
|||
|
|
|
|||
|
|
upstream: Re-split the merge of the reorder-hostkeys test.
|
|||
|
|
|
|||
|
|
In the kex_proposal_populate_entries change I merged the the check for
|
|||
|
|
reordering hostkeys with the actual reordering, but kex_assemble_names
|
|||
|
|
mutates options.hostkeyalgorithms which renders the check ineffective.
|
|||
|
|
Put the check back where it was. Spotted and tested by jsg@, ok djm@
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: a7469f25a738db5567395d1881e32479a7ffc9de
|
|||
|
|
|
|||
|
|
commit 54ac4ab2b53ce9fcb66b8250dee91c070e4167ed
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Thu Mar 9 06:58:26 2023 +0000
|
|||
|
|
|
|||
|
|
upstream: include destination constraints for smartcard keys too.
|
|||
|
|
|
|||
|
|
Spotted by Luci Stanescu; ok deraadt@ markus@
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: add879fac6903a1cb1d1e42c4309e5359c3d870f
|
|||
|
|
|
|||
|
|
commit bfd1ad01d974a316b60622759ad17537fa2d92b4
|
|||
|
|
Author: Darren Tucker <dtucker@dtucker.net>
|
|||
|
|
Date: Thu Mar 9 18:24:54 2023 +1100
|
|||
|
|
|
|||
|
|
Limit the number of PAM environment variables.
|
|||
|
|
|
|||
|
|
xcalloc has its own limits, but these are specific to PAM. From
|
|||
|
|
Coverity CID 405198, ok djm@
|
|||
|
|
|
|||
|
|
commit a231414970e01a35f45a295d5f93698fa1249b28
|
|||
|
|
Author: Darren Tucker <dtucker@dtucker.net>
|
|||
|
|
Date: Thu Mar 9 18:19:44 2023 +1100
|
|||
|
|
|
|||
|
|
Limit the number of PAM environment variables.
|
|||
|
|
|
|||
|
|
From Coverity CID 405194, tweaks and ok djm@
|
|||
|
|
|
|||
|
|
commit 36c6c3eff5e4a669ff414b9daf85f919666e8e03
|
|||
|
|
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
|||
|
|
Date: Wed Mar 8 06:21:32 2023 +0000
|
|||
|
|
|
|||
|
|
upstream: Plug mem leak. Coverity CID 405196, ok djm@
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: 175f09349387c292f626da68f65f334faaa085f2
|
|||
|
|
|
|||
|
|
commit dfb9b736e1ccf9e6b03eea21cd961f4fd0634c98
|
|||
|
|
Author: tb@openbsd.org <tb@openbsd.org>
|
|||
|
|
Date: Wed Mar 8 05:33:53 2023 +0000
|
|||
|
|
|
|||
|
|
upstream: ssh-pkcs11: synchronize error messages with errors
|
|||
|
|
|
|||
|
|
A handful of error messages contained incorrect function names or
|
|||
|
|
otherwise inaccurate descriptions. Fix them to match reality.
|
|||
|
|
|
|||
|
|
input/ok djm
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: 165a15db52f75b31e1804b043480c36af09f3411
|
|||
|
|
|
|||
|
|
commit 51875897b81b5c21b80c256a29597916edbde454
|
|||
|
|
Author: guenther@openbsd.org <guenther@openbsd.org>
|
|||
|
|
Date: Wed Mar 8 04:43:12 2023 +0000
|
|||
|
|
|
|||
|
|
upstream: Delete obsolete /* ARGSUSED */ lint comments.
|
|||
|
|
|
|||
|
|
ok miod@ millert@
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: 7be168a570264d59e96a7d2d22e927d45fee0e4c
|
|||
|
|
|
|||
|
|
commit a76085bda883c2104afb33ab0334eca190927362
|
|||
|
|
Author: Darren Tucker <dtucker@dtucker.net>
|
|||
|
|
Date: Wed Mar 8 17:25:37 2023 +1100
|
|||
|
|
|
|||
|
|
Extra brackets to prevent warning.
|
|||
|
|
|
|||
|
|
commit 147ae57d4dfa0508109f93b78a7d8b92819e1f83
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Wed Mar 8 00:05:58 2023 +0000
|
|||
|
|
|
|||
|
|
upstream: use RSA/SHA256 when testing usability of private key in
|
|||
|
|
|
|||
|
|
agent; with/ok dtucker
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: fe1382e2fdf23fcae631308e72342bad56066a56
|
|||
|
|
|
|||
|
|
commit 27fd251bc906a763e70ce0f27c8abdf8bbd1e416
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Wed Mar 8 00:05:37 2023 +0000
|
|||
|
|
|
|||
|
|
upstream: use RSA/SHA256 when testing usability of private key;
|
|||
|
|
|
|||
|
|
based on fix in bz3546 by Dmitry Belyavskiy; with/ok dtucker
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: 0ef414cc363a832f9fab92a5da0234448bce2eba
|
|||
|
|
|
|||
|
|
commit eee9f3fc3d52ae7d2106929bb06b7f291fb0b81a
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Tue Mar 7 21:47:42 2023 +0000
|
|||
|
|
|
|||
|
|
upstream: refactor to be more readable top to bottom. Prompted by
|
|||
|
|
|
|||
|
|
Coverity CID 405048 which was a false-positive fd leak; ok dtucker@
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: fc55ec2af622a017defb9b768bf26faefc792c00
|
|||
|
|
|
|||
|
|
commit 42a06b29a4c99272bf690f9b3be520b08b448dc5
|
|||
|
|
Author: Darren Tucker <dtucker@dtucker.net>
|
|||
|
|
Date: Tue Mar 7 18:34:41 2023 +1100
|
|||
|
|
|
|||
|
|
Add header changes missed in previous.
|
|||
|
|
|
|||
|
|
commit 4710077096edff2e6926dd5b15bf586491d317db
|
|||
|
|
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
|||
|
|
Date: Tue Mar 7 06:09:14 2023 +0000
|
|||
|
|
|
|||
|
|
upstream: Fix mem leak in environment setup.
|
|||
|
|
|
|||
|
|
From jjelen at redhat.com via bz#2687, ok djm@
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: 9f9e4ba3cac003e6f81da3bcebd1b9ec43e7f353
|
|||
|
|
|
|||
|
|
commit 03acc50d0ccb78fc91d1570de1cd0fdfea646028
|
|||
|
|
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
|||
|
|
Date: Mon Mar 6 12:15:47 2023 +0000
|
|||
|
|
|
|||
|
|
upstream: Unit test for kex_proposal_populate_entries.
|
|||
|
|
|
|||
|
|
OpenBSD-Regress-ID: bdb211d80d572a08bf14b49fe2a58b9ff265c006
|
|||
|
|
|
|||
|
|
commit 3f9231c2e1f374ebb08016ba00ea97b47c0ed20b
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Tue Mar 7 05:37:26 2023 +0000
|
|||
|
|
|
|||
|
|
upstream: fix memory leak in process_read() path; Spotted by James
|
|||
|
|
|
|||
|
|
Robinson in GHPR363; ok markus@
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: cdc2d98e6478b7e7f3a36976845adae3820429d8
|
|||
|
|
|
|||
|
|
commit c5e6e890839ec520ab9301a92cba56303749dea2
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Tue Mar 7 01:30:52 2023 +0000
|
|||
|
|
|
|||
|
|
upstream: correct size for array argument when changing
|
|||
|
|
|
|||
|
|
UMAC_OUTPUT_LEN Coverity CID 291845; ok dtucker@
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: 2eb017d10705bb623d4418691f961c930eafaec0
|
|||
|
|
|
|||
|
|
commit 9641753e0fd146204d57b2a4165f552a81afade4
|
|||
|
|
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
|||
|
|
Date: Mon Mar 6 12:14:48 2023 +0000
|
|||
|
|
|
|||
|
|
upstream: Refactor creation of KEX proposal.
|
|||
|
|
|
|||
|
|
This adds kex_proposal_populate_entries (and corresponding free) which
|
|||
|
|
populates the KEX proposal array with dynamically allocated strings.
|
|||
|
|
This replaces the previous mix of static and dynamic that has been the
|
|||
|
|
source of previous leaks and bugs. Remove unused compat functions.
|
|||
|
|
With & ok djm@.
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: f2f99da4aae2233cb18bf9c749320c5e040a9c7b
|
|||
|
|
|
|||
|
|
commit aa59d6a489fb20973fa461d0fdb1110db412947b
|
|||
|
|
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
|||
|
|
Date: Sun Mar 5 09:24:35 2023 +0000
|
|||
|
|
|
|||
|
|
upstream: Fix mem and FILE leaks in moduli screening.
|
|||
|
|
|
|||
|
|
If multiple -Ocheckpoint= options are passed, the earlier ones would
|
|||
|
|
be overwritten and leaked. If we use an input file that wasn't stdin,
|
|||
|
|
close that. From Coverity CIDs 291884 and 291894.
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: a4d9d15f572926f841788912e2b282485ad09e8b
|
|||
|
|
|
|||
|
|
commit 23b8cb41767af99a1aac24589d1882d9c8c2c205
|
|||
|
|
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
|||
|
|
Date: Sun Mar 5 08:18:58 2023 +0000
|
|||
|
|
|
|||
|
|
upstream: Plug mem leak in moduli checkpoint option parsing.
|
|||
|
|
|
|||
|
|
From Coverity CID 291894.
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: 9b1aba2d049741ae21c8dc4560a7e29ab17310f4
|
|||
|
|
|
|||
|
|
commit fc7f8f2188d4a4fc8ba77eddbe863c7665666db5
|
|||
|
|
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
|||
|
|
Date: Sun Mar 5 05:34:09 2023 +0000
|
|||
|
|
|
|||
|
|
upstream: Remove unused compat.h includes.
|
|||
|
|
|
|||
|
|
We've previously removed a lot of the really old compatibility code,
|
|||
|
|
and with it went the need to include compat.h in most of the files that
|
|||
|
|
have it.
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: 5af8baa194be00a3092d17598e88a5b29f7ea2b4
|
|||
|
|
|
|||
|
|
commit 6c165c36246d8004c20e1df5cec4961a5ac422d6
|
|||
|
|
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
|||
|
|
Date: Sat Mar 4 03:22:59 2023 +0000
|
|||
|
|
|
|||
|
|
upstream: Use time_t for x11 timeout.
|
|||
|
|
|
|||
|
|
Use time_t instead of u_int for remaining x11 timeout checks for 64bit
|
|||
|
|
time_t safety. From Coverity CIDs 405197 and 405028, ok djm@
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: 356685bfa1fc3d81bd95722d3fc47101cc1a4972
|
|||
|
|
|
|||
|
|
commit 4a3918f51bd2d968387e7aa87e33b32c78077fb4
|
|||
|
|
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
|||
|
|
Date: Fri Mar 3 10:23:42 2023 +0000
|
|||
|
|
|
|||
|
|
upstream: Ensure ms_remain is always initialized
|
|||
|
|
|
|||
|
|
similar to what we do in ssh_packet_write_wait. bz#2687, from jjelen
|
|||
|
|
at redhat.com.
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: a50e0541cf823f8d1c72f71ccde925d3dbe6dfac
|
|||
|
|
|
|||
|
|
commit e44846a4487d2885ac7f2610be09b1e2bf52249b
|
|||
|
|
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
|||
|
|
Date: Fri Mar 3 09:48:51 2023 +0000
|
|||
|
|
|
|||
|
|
upstream: Check for non-NULL before string
|
|||
|
|
|
|||
|
|
comparison. From jjelen at redhat.com via bz#2687.
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: 0d9b2e0cac88a311b5766b1aef737082583c285f
|
|||
|
|
|
|||
|
|
commit 1842d523fae63b862ce8e60725c9b606cddb86a6
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Fri Mar 3 05:00:34 2023 +0000
|
|||
|
|
|
|||
|
|
upstream: guard against getsockname(-1, ...) from Coverity CID
|
|||
|
|
|
|||
|
|
291832
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: e58d5227327917d189229b7f0b37d2780f360d5f
|
|||
|
|
|
|||
|
|
commit 78571a5fe9847d40d7f220c92b707574ae9ec4ce
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Fri Mar 3 04:36:20 2023 +0000
|
|||
|
|
|
|||
|
|
upstream: some options are not first-match-wins. Mention that there
|
|||
|
|
|
|||
|
|
are exceptions at the start of the manpage and label some of them in the
|
|||
|
|
option description.
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: 3b74728446fa6fc8742769eeb8c3674e233e84c4
|
|||
|
|
|
|||
|
|
commit d1c1b3272e8895a96c4f5889bd6e07a8525bd9f1
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Fri Mar 3 04:34:49 2023 +0000
|
|||
|
|
|
|||
|
|
upstream: actually print "channeltimeout none" in config dump mode;
|
|||
|
|
|
|||
|
|
spotted via Coverity CID 405022
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: b074b52bf138b75f08264e8da15880b29c7a630f
|
|||
|
|
|
|||
|
|
commit 8bf61e95610b48192d4e1720cc15d9004617301d
|
|||
|
|
Author: Darren Tucker <dtucker@dtucker.net>
|
|||
|
|
Date: Fri Mar 3 14:50:03 2023 +1100
|
|||
|
|
|
|||
|
|
Add Coverity badges.
|
|||
|
|
|
|||
|
|
commit 93291bd723959adf462b1df958106cf07a7734dd
|
|||
|
|
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
|||
|
|
Date: Fri Mar 3 03:12:24 2023 +0000
|
|||
|
|
|
|||
|
|
upstream: Check return values of dup2. Spotted by Coverity, ok djm@
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: 19fb1b53072826d00c67df677731d2f6c1dd602b
|
|||
|
|
|
|||
|
|
commit e37261dff33af23f37202cfce0848d36f5c1055c
|
|||
|
|
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
|||
|
|
Date: Fri Mar 3 02:37:58 2023 +0000
|
|||
|
|
|
|||
|
|
upstream: Use time_t for x11_refuse_time timeout. We need
|
|||
|
|
|
|||
|
|
SSH_TIME_T_MAX for this, so move from misc.c to misc.h so it's available.
|
|||
|
|
Fixes a Coverity warning for 64bit time_t safety, ok djm@
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: c69c4c3152cdaab953706db4ccf4d5fd682f7d8d
|
|||
|
|
|
|||
|
|
commit 32755a98c29114b13f4c9d47454bbb265b932ad7
|
|||
|
|
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
|||
|
|
Date: Fri Mar 3 02:34:29 2023 +0000
|
|||
|
|
|
|||
|
|
upstream: Check return value from fctnl and warn on failure.
|
|||
|
|
|
|||
|
|
Spotted by Coverity, ok djm@
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: 2097c7db3cf657f1e3a6c5077041bacc63143cab
|
|||
|
|
|
|||
|
|
commit 5fc60e8246c36b8255f72a937ebe9787b39648c6
|
|||
|
|
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
|||
|
|
Date: Thu Mar 2 11:10:27 2023 +0000
|
|||
|
|
|
|||
|
|
upstream: Remove SUDO in proxy command wrapper. Anything that needs
|
|||
|
|
|
|||
|
|
sudo is already run by it, and it breaks if root isn't in sudoers.
|
|||
|
|
|
|||
|
|
OpenBSD-Regress-ID: 6cf22fda32a89c16915f31a6ed9bbdbef2a3bac9
|
|||
|
|
|
|||
|
|
commit 0d514659b23a257247491179cfbb53a6dd64e164
|
|||
|
|
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
|||
|
|
Date: Thu Mar 2 08:24:41 2023 +0000
|
|||
|
|
|
|||
|
|
upstream: Fix breakage on dhgex test.
|
|||
|
|
|
|||
|
|
This was due to the sshd logs being written to the wrong log file.
|
|||
|
|
While there, make save_debug_logs less verbose, write the name of the
|
|||
|
|
tarball to regress.log and use $SUDO to remove the old symlinks (which
|
|||
|
|
shouldn't be needed, but won't hurt). Initial problem spotted by anton@.
|
|||
|
|
|
|||
|
|
OpenBSD-Regress-ID: 9c44fb9cd418e6ff31165e7a6c1f9f11a6d19f5b
|
|||
|
|
|
|||
|
|
commit 860201201d4ae655702807966901682cff30a171
|
|||
|
|
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
|||
|
|
Date: Thu Mar 2 08:14:52 2023 +0000
|
|||
|
|
|
|||
|
|
upstream: Quote grep and log message better.
|
|||
|
|
|
|||
|
|
OpenBSD-Regress-ID: 3823d9063127169736aa274b1784cb28e15b64d4
|
|||
|
|
|
|||
|
|
commit 03a03c6002525f5ad9c8fc874a5d5826a35d9858
|
|||
|
|
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
|||
|
|
Date: Thu Mar 2 06:41:56 2023 +0000
|
|||
|
|
|
|||
|
|
upstream: Always call fclose on checkpoints.
|
|||
|
|
|
|||
|
|
In the case of an fprintf failure we would not call fclose which would
|
|||
|
|
leak the FILE pointer. While we're there, try to clean up the temp file
|
|||
|
|
on failure. Spotted by Coverity, ok djm@
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: 73c7ccc5d4fcc235f54c6b20767a2815408525ef
|
|||
|
|
|
|||
|
|
commit 13fe8f9785e6d90400ce548939a0b0ddc11fcb3c
|
|||
|
|
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
|||
|
|
Date: Wed Mar 1 21:54:50 2023 +0000
|
|||
|
|
|
|||
|
|
upstream: Remove old log symlinks
|
|||
|
|
|
|||
|
|
before creating new ones. In -portable some platforms don't like
|
|||
|
|
overwriting existing symlinks.
|
|||
|
|
|
|||
|
|
OpenBSD-Regress-ID: 7e7ddc0beb73e945e1c4c58d51c8a125b518120f
|
|||
|
|
|
|||
|
|
commit 131fcbcaffd1e3bcf5ab766ec497b5d768955310
|
|||
|
|
Author: Darren Tucker <dtucker@dtucker.net>
|
|||
|
|
Date: Wed Mar 1 23:23:02 2023 +1100
|
|||
|
|
|
|||
|
|
Adjust test jobs for new log directory.
|
|||
|
|
|
|||
|
|
commit a6f4ac8a2baf77e5361cfa017d0dc250d1409bec
|
|||
|
|
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
|||
|
|
Date: Wed Mar 1 09:29:32 2023 +0000
|
|||
|
|
|
|||
|
|
upstream: Rework logging for the regression tests.
|
|||
|
|
|
|||
|
|
Previously we would log to ssh.log and sshd.log, but that is insufficient
|
|||
|
|
for tests that have more than one concurent ssh/sshd.
|
|||
|
|
|
|||
|
|
Instead, we'll log to separate datestamped files in a $OBJ/log/ and
|
|||
|
|
leave a symlink at the previous location pointing at the most recent
|
|||
|
|
instance with an entry in regress.log showing which files were created
|
|||
|
|
at each point. This should be sufficient to reconstruct what happened
|
|||
|
|
even for tests that use multiple instances of each program. If the test
|
|||
|
|
fails, tar up all of the logs for later analysis.
|
|||
|
|
|
|||
|
|
This will let us also capture the output from some of the other tools
|
|||
|
|
which was previously sent to /dev/null although most of those will be
|
|||
|
|
in future commits.
|
|||
|
|
|
|||
|
|
OpenBSD-Regress-ID: f802aa9e7fa51d1a01225c05fb0412d015c33e24
|
|||
|
|
|
|||
|
|
commit 8ead62ed5e86c7df597d8604f332f49cd1527b85
|
|||
|
|
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
|||
|
|
Date: Tue Feb 28 21:31:50 2023 +0000
|
|||
|
|
|
|||
|
|
upstream: fatal out if allocating banner string fails to avoid
|
|||
|
|
|
|||
|
|
potential null deref later in sscanf. Spotted by Coverity, ok deraadt@
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: 74e8d228ac00552e96e9e968dfcccf8dd1f46ad5
|
|||
|
|
|
|||
|
|
commit 44ca56ba0b3f531f1d85730cc701097cd49e6868
|
|||
|
|
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
|||
|
|
Date: Tue Feb 28 08:45:24 2023 +0000
|
|||
|
|
|
|||
|
|
upstream: Explicitly ignore return from fchmod
|
|||
|
|
|
|||
|
|
similar to other calls to prevent warning.
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: fdc5287dcee0860b5a493186414226c655b0eb0a
|
|||
|
|
|
|||
|
|
commit 803392933a3a6f09f834aa5f0c2aab06a3b382f4
|
|||
|
|
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
|||
|
|
Date: Mon Feb 27 22:12:40 2023 +0000
|
|||
|
|
|
|||
|
|
upstream: Plug mem leak on globbed ls error path.
|
|||
|
|
|
|||
|
|
Spotted by Coverity, ok deraadt@
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: de28476025db29820a9a2e56e98b964d8a02861c
|
|||
|
|
|
|||
|
|
commit aa33b4d396abf47a2a45f982f28d054fb1dcb5c3
|
|||
|
|
Author: Darren Tucker <dtucker@dtucker.net>
|
|||
|
|
Date: Mon Feb 27 21:04:22 2023 +1100
|
|||
|
|
|
|||
|
|
Cast time_t's in debug output to long long.
|
|||
|
|
|
|||
|
|
Should fix Coverity warning about truncation of 64bit time_t.
|
|||
|
|
|
|||
|
|
commit b0fd60a9de62a03189ad57d0c07f0ac51dc00e95
|
|||
|
|
Author: Darren Tucker <dtucker@dtucker.net>
|
|||
|
|
Date: Mon Feb 27 17:28:59 2023 +1100
|
|||
|
|
|
|||
|
|
Do shadow expiry calcs using "long long".
|
|||
|
|
|
|||
|
|
Coverity flags these as potentially not 64bit time_t safe so use
|
|||
|
|
long long for the calculations and debug output. ok djm@
|
|||
|
|
|
|||
|
|
commit 01dbeb3084d714bbd001ff9d03b9de542e8cdf58
|
|||
|
|
Author: Damien Miller <djm@mindrot.org>
|
|||
|
|
Date: Mon Feb 27 17:07:52 2023 +1100
|
|||
|
|
|
|||
|
|
avoid clash between for getopt's struct option
|
|||
|
|
|
|||
|
|
Since we don't use getopt_long() nothing outside the getopt()
|
|||
|
|
implementation itself uses this structure, so move it into the
|
|||
|
|
source to remove it from visibility and clashes with libc's
|
|||
|
|
|
|||
|
|
ok dtucker@
|
|||
|
|
|
|||
|
|
commit eb88d07c43afe407094e7d609248d85a15e148ef
|
|||
|
|
Author: Darren Tucker <dtucker@dtucker.net>
|
|||
|
|
Date: Sat Feb 25 14:45:41 2023 +1100
|
|||
|
|
|
|||
|
|
Revert explicit chmods on private keys.
|
|||
|
|
|
|||
|
|
This should no longer be needed on Cygwin test runners due to previous
|
|||
|
|
commit.
|
|||
|
|
|
|||
|
|
commit 52b75db61030a6c8baf66b73644380cf3f58e26a
|
|||
|
|
Author: Darren Tucker <dtucker@dtucker.net>
|
|||
|
|
Date: Sat Feb 25 14:43:28 2023 +1100
|
|||
|
|
|
|||
|
|
Remove extended ACLs from working dirs.
|
|||
|
|
|
|||
|
|
This should allow umask to work as expected and prevent tests from
|
|||
|
|
failing due to excessive permissions on private keys.
|
|||
|
|
|
|||
|
|
commit 0c5d4c843df5605b043a758d69f9a611ef63c479
|
|||
|
|
Author: Darren Tucker <dtucker@dtucker.net>
|
|||
|
|
Date: Fri Feb 24 13:44:13 2023 +1100
|
|||
|
|
|
|||
|
|
Explicitly set permissions on user and host keys.
|
|||
|
|
|
|||
|
|
On cygwin, the umask might not be sufficient. Should fix tests on
|
|||
|
|
Github runners.
|
|||
|
|
|
|||
|
|
commit 6c9fc9d7a9f7abf82c3294d74e6d4a25735862ce
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Wed Feb 22 03:56:43 2023 +0000
|
|||
|
|
|
|||
|
|
upstream: fix progressmeter corruption on wide displays; bz3534
|
|||
|
|
|
|||
|
|
feedback/ok dtucker@
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: f4affee067cec7c182f3e0b307d758e0472762a3
|
|||
|
|
|
|||
|
|
commit fe0bd3cde9665d364e5eedd2c2c2e60d4cdc3786
|
|||
|
|
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
|||
|
|
Date: Tue Feb 21 06:48:18 2023 +0000
|
|||
|
|
|
|||
|
|
upstream: fseek to end of known_hosts before writing to it.
|
|||
|
|
|
|||
|
|
POSIX and ANSI C require that applications call fseek or similar between
|
|||
|
|
read and writing to a RW file. OpenBSD doesn't enforce this, but some
|
|||
|
|
(System V derived) platforms need this to prevent it from writing a
|
|||
|
|
spurious extra byte (in this case, a newline). ok djm@ deraadt@
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: 33e680dcd8110582a93a40a8491024e961f45137
|
|||
|
|
|
|||
|
|
commit 357fb8ae14c07cd025eeed66e73de91bab569849
|
|||
|
|
Author: Darren Tucker <dtucker@dtucker.net>
|
|||
|
|
Date: Tue Feb 21 17:51:09 2023 +1100
|
|||
|
|
|
|||
|
|
Also run unit tests on AIX VMs.
|
|||
|
|
|
|||
|
|
In the past these tests took too long, but these days it only adds
|
|||
|
|
about 5 min to the run.
|
|||
|
|
|
|||
|
|
commit 17781aaa5188ee1477f7779b280d105512e3dbed
|
|||
|
|
Author: Darren Tucker <dtucker@dtucker.net>
|
|||
|
|
Date: Tue Feb 21 17:38:55 2023 +1100
|
|||
|
|
|
|||
|
|
Wrap stdint.h inside ifdef.
|
|||
|
|
|
|||
|
|
commit ef798bad38505f7bf1b5fa5c0843dfc5a2b192b9
|
|||
|
|
Author: Mayank Sharma <mayank.fit2010@gmail.com>
|
|||
|
|
Date: Mon Feb 20 17:37:15 2023 +0530
|
|||
|
|
|
|||
|
|
Add includes to ptimeout test.
|
|||
|
|
|
|||
|
|
Fixes test failures on AIX due to type mismatches.
|
|||
|
|
|
|||
|
|
commit ab69dda05d5268454209f529fa80f477e60d846a
|
|||
|
|
Author: Darren Tucker <dtucker@dtucker.net>
|
|||
|
|
Date: Mon Feb 20 18:24:39 2023 +1100
|
|||
|
|
|
|||
|
|
Always use the openssl binary configure tells us.
|
|||
|
|
|
|||
|
|
This fixes tests on platforms that do not have the openssl tool
|
|||
|
|
installed at all.
|
|||
|
|
|
|||
|
|
commit 2a7e3449908571af601a4c2d12ab140096442e47
|
|||
|
|
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
|||
|
|
Date: Fri Feb 17 04:22:50 2023 +0000
|
|||
|
|
|
|||
|
|
upstream: Remove now-unused compat bit SSH_BUG_RSASIGMD5. The code
|
|||
|
|
|
|||
|
|
to set this was removed in OpenSSH 7.7 when support for SSH implementations
|
|||
|
|
dating back to before RFC standardization were removed. "burn it all" djm@
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: 6330935fbe23dd00be79891505e06d1ffdac7cda
|
|||
|
|
|
|||
|
|
commit 0833ccf2c8b7ae08b296c06f17bd53e3ab94b0b0
|
|||
|
|
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
|||
|
|
Date: Fri Feb 17 03:06:18 2023 +0000
|
|||
|
|
|
|||
|
|
upstream: Remove now-unused compat bit SSH_BUG_BIGENDIANAES. This
|
|||
|
|
|
|||
|
|
was previously set for OpenSSH 2.3 (released in 2000) but this check was
|
|||
|
|
removed in OpenSSH 7.7 (2018). ok djm@ deraadt@
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: 326426ea328707fc9e83305291ab135c87f678af
|
|||
|
|
|
|||
|
|
commit c81c2bea6e828d52b62b448b4ffdd3c163177975
|
|||
|
|
Author: Damien Miller <djm@mindrot.org>
|
|||
|
|
Date: Fri Feb 17 10:12:40 2023 +1100
|
|||
|
|
|
|||
|
|
whitespace fixes
|
|||
|
|
|
|||
|
|
commit 500f90b39db5f0014e6b0c49ff1f45c994b69293
|
|||
|
|
Author: Damien Miller <djm@mindrot.org>
|
|||
|
|
Date: Fri Feb 17 10:02:08 2023 +1100
|
|||
|
|
|
|||
|
|
whitespace at EOL
|
|||
|
|
|
|||
|
|
commit 68350152406339170721c15e97afdf827a5e4001
|
|||
|
|
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
|||
|
|
Date: Thu Feb 16 10:10:00 2023 +0000
|
|||
|
|
|
|||
|
|
upstream: Remove SSH_BUG_PASSWORDPAD compat bit
|
|||
|
|
|
|||
|
|
since it's no longer used. ok markus@
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: b92c21f56fe4b7f9a54790d6a9650725c226820b
|
|||
|
|
|
|||
|
|
commit 537cccd804eaf65f32bdce037cc31db4e0ab0f44
|
|||
|
|
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
|||
|
|
Date: Thu Feb 16 07:55:15 2023 +0000
|
|||
|
|
|
|||
|
|
upstream: Remove SSH_BUG_IGNOREMSG compat flag
|
|||
|
|
|
|||
|
|
since it's only applicable to SSH1 and thus no longer used. ok markus@
|
|||
|
|
"kill it with fire" djm@
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: ea13318b1937795d9db4790d3ce0a6ed01584dab
|
|||
|
|
|
|||
|
|
commit 285cf6cd4b91a0a0ce33193c358c99085af33e43
|
|||
|
|
Author: jmc@openbsd.org <jmc@openbsd.org>
|
|||
|
|
Date: Fri Feb 10 06:41:53 2023 +0000
|
|||
|
|
|
|||
|
|
upstream: space between macro and punctuation; sort usage();
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: 6141610cfca037700730e41f868d1d9124958f8c
|
|||
|
|
|
|||
|
|
commit d39a96f70f81878c77336ed35f5c648c1804b71a
|
|||
|
|
Author: jmc@openbsd.org <jmc@openbsd.org>
|
|||
|
|
Date: Fri Feb 10 06:40:48 2023 +0000
|
|||
|
|
|
|||
|
|
upstream: space between macro and punctuation;
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: abc95e550be9e6d9a7ff64b65c104c7be21ab19e
|
|||
|
|
|
|||
|
|
commit 16e82bf53fc34e43e3b948d43b68d5b27a7335e6
|
|||
|
|
Author: jmc@openbsd.org <jmc@openbsd.org>
|
|||
|
|
Date: Fri Feb 10 06:39:27 2023 +0000
|
|||
|
|
|
|||
|
|
upstream: sort SYNOPSIS;
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: dacd9da33277d5669a51213d880632599c890c1e
|
|||
|
|
|
|||
|
|
commit d9685121ff6d57b8797411f3cb123884a4b96e30
|
|||
|
|
Author: Darren Tucker <dtucker@dtucker.net>
|
|||
|
|
Date: Sat Feb 11 12:32:19 2023 +1100
|
|||
|
|
|
|||
|
|
Improve seccomp compat on older systems.
|
|||
|
|
|
|||
|
|
Check if flags to mmap and madvise are defined before using them.
|
|||
|
|
Should fix problems building on older Linux systems that don't have
|
|||
|
|
these. bz#3537, with & ok djm@.
|
|||
|
|
|
|||
|
|
commit 6180b0fa4f7996687678702806257e661fd5931e
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Fri Feb 10 05:06:03 2023 +0000
|
|||
|
|
|
|||
|
|
upstream: test -Ohashalg=... and that the default output contains both
|
|||
|
|
|
|||
|
|
specified hash algorithms; prompted by dtucker@
|
|||
|
|
|
|||
|
|
OpenBSD-Regress-ID: 26f309208c8d8b8fa9c5f419767b85f1e9b22f51
|
|||
|
|
|
|||
|
|
commit d651f5c9fe37e61491eee46c49ba9fa03dbc0e6a
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Fri Feb 10 04:56:30 2023 +0000
|
|||
|
|
|
|||
|
|
upstream: let ssh-keygen and ssh-keyscan accept
|
|||
|
|
|
|||
|
|
-Ohashalg=sha1|sha256 when outputting SSHFP fingerprints to allow algorithm
|
|||
|
|
selection. bz3493 ok dtucker@
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: e6e07fe21318a873bd877f333e189eb963a11b3d
|
|||
|
|
|
|||
|
|
commit 18938d11a90b74d63c20b2d3c965d5bd64786ab1
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Fri Feb 10 04:47:19 2023 +0000
|
|||
|
|
|
|||
|
|
upstream: add a `sshd -G` option that parses and prints the
|
|||
|
|
|
|||
|
|
effective configuration without attempting to load private keys and perform
|
|||
|
|
other checks. This allows usage of the option before keys have been
|
|||
|
|
generated.
|
|||
|
|
|
|||
|
|
bz3460 feedback/ok dtucker@
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: 774504f629023fc25a559ab1d95401adb3a7fb29
|
|||
|
|
|
|||
|
|
commit df7d3dbf7194db8e97730ee0425d4d9d7bdb8b10
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Fri Feb 10 04:40:28 2023 +0000
|
|||
|
|
|
|||
|
|
upstream: make `ssh -Q CASignatureAlgorithms` work as the manpage says
|
|||
|
|
|
|||
|
|
it should bz3532
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: 0ddb17b3fcbd99bfb5baea4ac5e449620cbd3adc
|
|||
|
|
|
|||
|
|
commit d3b8d4198b6595f23b5859d43dc8fc701f97429b
|
|||
|
|
Author: Darren Tucker <dtucker@dtucker.net>
|
|||
|
|
Date: Fri Feb 10 14:26:44 2023 +1100
|
|||
|
|
|
|||
|
|
Add CentOS 7 test targets.
|
|||
|
|
|
|||
|
|
commit 22efb01e355bba4755b730ed417f91c081445bfc
|
|||
|
|
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
|||
|
|
Date: Thu Feb 9 09:55:33 2023 +0000
|
|||
|
|
|
|||
|
|
upstream: Test adding terminating newline to known_hosts.
|
|||
|
|
|
|||
|
|
OpenBSD-Regress-ID: 5fc3010ac450195b3fbdeb68e875564968800365
|
|||
|
|
|
|||
|
|
commit caec6da1a583ed8c32c6ad3b81bbcaab46ac8b61
|
|||
|
|
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
|||
|
|
Date: Wed Feb 8 08:06:03 2023 +0000
|
|||
|
|
|
|||
|
|
upstream: ssh-agent doesn't actually take -v,
|
|||
|
|
|
|||
|
|
so the recently-added ones will result in the test not cleaning up
|
|||
|
|
after itself. Patch from cjwatson at debian.org vi bz#3536.
|
|||
|
|
|
|||
|
|
OpenBSD-Regress-ID: 1fc8283568f5bf2f918517c2c1e778072cf61b1a
|
|||
|
|
|
|||
|
|
commit 3c379c9a849a635cc7f05cbe49fe473ccf469ef9
|
|||
|
|
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
|||
|
|
Date: Thu Feb 9 09:54:11 2023 +0000
|
|||
|
|
|
|||
|
|
upstream: Ensure that there is a terminating newline when adding a new
|
|||
|
|
|
|||
|
|
entry to known_hosts. bz#3529, with git+openssh at limpsquid.nl, ok deraadt@
|
|||
|
|
markus@
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: fa8d90698da1886570512b96f051e266eac105e0
|
|||
|
|
|
|||
|
|
commit 95b6bbd2553547260b324b39d602061c88b774bc
|
|||
|
|
Author: Darren Tucker <dtucker@dtucker.net>
|
|||
|
|
Date: Tue Feb 7 08:43:47 2023 +1100
|
|||
|
|
|
|||
|
|
Replace 9.1 with 9.2 on CI status page.
|
|||
|
|
|
|||
|
|
commit 195313dfe10a23c82e9d56d5fdd2f59beee1bdcf
|
|||
|
|
Author: Damien Miller <djm@mindrot.org>
|
|||
|
|
Date: Fri Feb 3 16:33:09 2023 +1100
|
|||
|
|
|
|||
|
|
harden Linux seccomp sandbox
|
|||
|
|
|
|||
|
|
Linux mmap(2) and madvise(2) syscalls support quite a number of funky
|
|||
|
|
flags that we don't expect that sshd/libc will ever need. We can
|
|||
|
|
exclude this kernel attack surface by filtering the mmap(2) flags
|
|||
|
|
and the madvise(2) advice arguments.
|
|||
|
|
|
|||
|
|
Similarly, the sandboxed process in sshd is a single-threaded program
|
|||
|
|
that does not use shared memory for synchronisation or communication.
|
|||
|
|
Therefore, there should be no reason for the advanced priority
|
|||
|
|
inheritance futex(2) operations to be necessary. These can also be
|
|||
|
|
excluded.
|
|||
|
|
|
|||
|
|
Motivated by Jann Horn pointing out that there have been kernel bugs
|
|||
|
|
in nearby Linux kernel code, e.g. CVE-2020-29368, CVE-2020-29374 and
|
|||
|
|
CVE-2022-42703.
|
|||
|
|
|
|||
|
|
Feedback Jann Horn, ok dtucker@
|
|||
|
|
|
|||
|
|
commit 6dfb65de949cdd0a5d198edee9a118f265924f33
|
|||
|
|
Author: Damien Miller <djm@mindrot.org>
|
|||
|
|
Date: Thu Feb 2 23:21:54 2023 +1100
|
|||
|
|
|
|||
|
|
crank versions in RPM specs
|
|||
|
|
|
|||
|
|
commit d07cfb11a0ca574eb68a3931d8c46fbe862a2021
|
|||
|
|
Author: Damien Miller <djm@mindrot.org>
|
|||
|
|
Date: Thu Feb 2 23:21:45 2023 +1100
|
|||
|
|
|
|||
|
|
update version in README
|
|||
|
|
|
|||
|
|
commit 9fe207565b4ab0fe5d1ac5bb85e39188d96fb214
|
|||
|
|
Author: Damien Miller <djm@mindrot.org>
|
|||
|
|
Date: Thu Feb 2 23:17:49 2023 +1100
|
|||
|
|
|
|||
|
|
adapt compat_kex_proposal() test to portable
|
|||
|
|
|
|||
|
|
commit 903c556b938fff2d7bff8da2cc460254430963c5
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Thu Feb 2 12:12:52 2023 +0000
|
|||
|
|
|
|||
|
|
upstream: test compat_kex_proposal(); by dtucker@
|
|||
|
|
|
|||
|
|
OpenBSD-Regress-ID: 0e404ee264db546f9fdbf53390689ab5f8d38bf2
|
|||
|
|
|
|||
|
|
commit 405fba71962dec8409c0c962408e09049e5624b5
|
|||
|
|
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
|||
|
|
Date: Thu Jan 19 07:53:45 2023 +0000
|
|||
|
|
|
|||
|
|
upstream: Check if we can copy sshd or need to use sudo to do so
|
|||
|
|
|
|||
|
|
during reexec test. Skip test if neither can work. Patch from anton@, tweaks
|
|||
|
|
from me.
|
|||
|
|
|
|||
|
|
OpenBSD-Regress-ID: 731b96ae74d02d5744e1f1a8e51d09877ffd9b6d
|
|||
|
|
|
|||
|
|
commit b2a2a8f69fd7737ea17dc044353c514f2f962f35
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Thu Feb 2 12:10:22 2023 +0000
|
|||
|
|
|
|||
|
|
upstream: openssh-9.2
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: f7389f32413c74d6e2055f05cf65e7082de03923
|
|||
|
|
|
|||
|
|
commit 12da7823336434a403f25c7cc0c2c6aed0737a35
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Thu Feb 2 12:10:05 2023 +0000
|
|||
|
|
|
|||
|
|
upstream: fix double-free caused by compat_kex_proposal(); bz3522
|
|||
|
|
|
|||
|
|
by dtucker@, ok me
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: 2bfc37cd2d41f67dad64c17a64cf2cd3806a5c80
|
|||
|
|
|
|||
|
|
commit 79efd95ab5ff99f4cb3a955e2d713b3f54fb807e
|
|||
|
|
Author: Darren Tucker <dtucker@dtucker.net>
|
|||
|
|
Date: Wed Feb 1 17:17:26 2023 +1100
|
|||
|
|
|
|||
|
|
Skip connection-timeout test on minix3.
|
|||
|
|
|
|||
|
|
Minix 3's Unix domain sockets don't seem to work the way we expect, so
|
|||
|
|
skip connection-timeout test on that platform. While there, group
|
|||
|
|
together all similarly skipped tests and explicitly comment.
|
|||
|
|
|
|||
|
|
commit 6b508c4e039619842bcf5a16f8a6b08dd6bec44a
|
|||
|
|
Author: Damien Miller <djm@mindrot.org>
|
|||
|
|
Date: Wed Feb 1 12:12:05 2023 +1100
|
|||
|
|
|
|||
|
|
fix libfido2 detection without pkg-config
|
|||
|
|
|
|||
|
|
Place libfido2 before additional libraries (that it may depend upon)
|
|||
|
|
and not after. bz3530 from James Zhang; ok dtucker@
|
|||
|
|
|
|||
|
|
commit 358e300fed5e6def233a2c06326e51e20ebed621
|
|||
|
|
Author: deraadt@openbsd.org <deraadt@openbsd.org>
|
|||
|
|
Date: Wed Jan 18 20:56:36 2023 +0000
|
|||
|
|
|
|||
|
|
upstream: delete useless dependency
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: e1dc11143f83082e3154d6094f9136d0dc2637ad
|
|||
|
|
|
|||
|
|
commit a4cb9be1b021b511e281ee55c356f964487d9e82
|
|||
|
|
Author: deraadt@openbsd.org <deraadt@openbsd.org>
|
|||
|
|
Date: Wed Jan 18 20:43:15 2023 +0000
|
|||
|
|
|
|||
|
|
upstream: Create and install sshd random relink kit.
|
|||
|
|
|
|||
|
|
../Makefile.inc and Makfile are concatenated for reuse, which hopefully won't
|
|||
|
|
be too fragile, we'll see if we need a different approach. The resulting sshd
|
|||
|
|
binary is tested with the new sshd -V option before installation. As the
|
|||
|
|
binary layout is now semi-unknown (meaning relative, fixed, and gadget
|
|||
|
|
offsets are not precisely known), change the filesystem permissions to 511 to
|
|||
|
|
prevent what I call "logged in BROP". I have ideas for improving this further
|
|||
|
|
but this is a first step ok djm
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: 1e0a2692b7e20b126dda60bf04999d1d30d959d8
|
|||
|
|
|
|||
|
|
commit bc7de6f91a9a0ae2f148a9d31a4027d441a51999
|
|||
|
|
Author: jmc@openbsd.org <jmc@openbsd.org>
|
|||
|
|
Date: Wed Jan 18 06:55:32 2023 +0000
|
|||
|
|
|
|||
|
|
upstream: tweak previous; ok djm
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: df71ce4180c58202dfdc1d92626cfe900b91b7c3
|
|||
|
|
|
|||
|
|
commit a20b7e999773e6333c8aa9b0a7fa41966e63b037
|
|||
|
|
Author: Darren Tucker <dtucker@dtucker.net>
|
|||
|
|
Date: Tue Jan 31 19:35:44 2023 +1100
|
|||
|
|
|
|||
|
|
Skip connection-timeout test under Valgrind.
|
|||
|
|
|
|||
|
|
Valgrind slows things down so much that the timeout test fails. Skip
|
|||
|
|
this test until we figure out if we can make it work.
|
|||
|
|
|
|||
|
|
commit c3ffb54b4fc5e608206037921db6ccbc2f5ab25f
|
|||
|
|
Author: Darren Tucker <dtucker@dtucker.net>
|
|||
|
|
Date: Wed Jan 25 21:58:40 2023 +1100
|
|||
|
|
|
|||
|
|
Skip connection-timeout when missing FD passing.
|
|||
|
|
|
|||
|
|
This tests uses multiplexing which uses file descriptor passing, so
|
|||
|
|
skip it if we don't have that. Fixes test failures on Cygwin.
|
|||
|
|
|
|||
|
|
commit 35253af01d8c0ab444c8377402121816e71c71f5
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Wed Jan 18 02:00:10 2023 +0000
|
|||
|
|
|
|||
|
|
upstream: when restoring non-blocking mode to stdio fds, restore
|
|||
|
|
|
|||
|
|
exactly the flags that ssh started with and don't just clobber them with
|
|||
|
|
zero, as this could also remove the append flag from the set;
|
|||
|
|
|
|||
|
|
bz3523; ok dtucker@
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: 1336b03e881db7564a4b66014eb24c5230e9a0c0
|
|||
|
|
|
|||
|
|
commit 7d17ea151c0b2519f023bd9cc7f141128833ac47
|
|||
|
|
Author: millert@openbsd.org <millert@openbsd.org>
|
|||
|
|
Date: Wed Jan 18 01:50:21 2023 +0000
|
|||
|
|
|
|||
|
|
upstream: Add a -V (version) option to sshd like the ssh client
|
|||
|
|
|
|||
|
|
has. OK markus@ deraadt@
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: abe990ec3e636fb040132aab8cbbede98f0c413e
|
|||
|
|
|
|||
|
|
commit 62360feb7f08f2a4c6fc36f3b3449309203c42c9
|
|||
|
|
Author: millert@openbsd.org <millert@openbsd.org>
|
|||
|
|
Date: Tue Jan 17 18:52:44 2023 +0000
|
|||
|
|
|
|||
|
|
upstream: For "ssh -V" always exit 0, there is no need to check opt
|
|||
|
|
|
|||
|
|
again. This was missed when the fallthrough in the switch case above it was
|
|||
|
|
removed. OK deraadt@
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: 5583e5d8f6d62a8a4215cfa95a69932f344c8120
|
|||
|
|
|
|||
|
|
commit 12492c0abf1eb415d08a897cc1d8b9e789888230
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Tue Jan 17 10:15:10 2023 +0000
|
|||
|
|
|
|||
|
|
upstream: also check that an active session inhibits
|
|||
|
|
|
|||
|
|
UnusedConnectionTimeout idea markus@
|
|||
|
|
|
|||
|
|
OpenBSD-Regress-ID: 55c0fb61f3bf9e092b0a53f9041d3d2012f14003
|
|||
|
|
|
|||
|
|
commit cef2593c33ac46a58238ff998818754eabdf64ff
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Tue Jan 17 10:02:34 2023 +0000
|
|||
|
|
|
|||
|
|
upstream: regression test for UnusedConnectionTimeout
|
|||
|
|
|
|||
|
|
OpenBSD-Regress-ID: 7f29001374a68e71e5e078f69e4520cf4bcca084
|
|||
|
|
|
|||
|
|
commit aff9493a89c71d6a080419b49ac64eead9730491
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Mon Jan 16 04:11:29 2023 +0000
|
|||
|
|
|
|||
|
|
upstream: unbreak test: cannot access shell positional parameters
|
|||
|
|
|
|||
|
|
past $9 without wrapping the position in braces (i.e. need ${10}, etc.)
|
|||
|
|
|
|||
|
|
OpenBSD-Regress-ID: 3750ec98d5d409ce6a93406fedde6f220d2ea2ac
|
|||
|
|
|
|||
|
|
commit 0293c19807f83141cdf33b443154459f9ee471f6
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Tue Jan 17 09:44:48 2023 +0000
|
|||
|
|
|
|||
|
|
upstream: Add a sshd_config UnusedConnectionTimeout option to terminate
|
|||
|
|
|
|||
|
|
client connections that have no open channels for some length of time. This
|
|||
|
|
complements the recently-added ChannelTimeout option that terminates inactive
|
|||
|
|
channels after a timeout.
|
|||
|
|
|
|||
|
|
ok markus@
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: ca983be74c0350364c11f8ba3bd692f6f24f5da9
|
|||
|
|
|
|||
|
|
commit 8ec2e3123802d2beeca06c1644b0b647f6d36dab
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Sun Jan 15 23:35:10 2023 +0000
|
|||
|
|
|
|||
|
|
upstream: adapt to ed25519 changes in src/usr.bin/ssh
|
|||
|
|
|
|||
|
|
OpenBSD-Regress-ID: 4b3e7ba7ee486ae8a0b4790f8112eded2bb7dcd5
|
|||
|
|
|
|||
|
|
commit 9fbbfeca1ce4c7ec0001c827bbf4189a3ba0964b
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Sun Jan 15 23:05:32 2023 +0000
|
|||
|
|
|
|||
|
|
upstream: update OpenSSH's Ed25519 code to the last version of SUPERCOP
|
|||
|
|
|
|||
|
|
(20221122) and change the import approach to the same one we use for
|
|||
|
|
Streamlined NTRUPrime: use a shell script to extract the bits we need from
|
|||
|
|
SUPERCOP, make some minor adjustments and squish them all into a single file.
|
|||
|
|
|
|||
|
|
ok tb@ tobhe@
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: 1bc0fd624cb6af440905b8ba74ac7c03311b8e3b
|
|||
|
|
|
|||
|
|
commit 6283f4bd83eee714d0f5fc55802eff836b06fea8
|
|||
|
|
Author: Darren Tucker <dtucker@dtucker.net>
|
|||
|
|
Date: Sat Jan 14 22:02:44 2023 +1100
|
|||
|
|
|
|||
|
|
Allow writev is seccomp sandbox.
|
|||
|
|
|
|||
|
|
This seems to be used by recent glibcs at least in some configurations.
|
|||
|
|
From bz#3512, ok djm@
|
|||
|
|
|
|||
|
|
commit 923c3f437f439cfca238fba37e97a7041782f615
|
|||
|
|
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
|||
|
|
Date: Sat Jan 14 10:05:54 2023 +0000
|
|||
|
|
|
|||
|
|
upstream: Shell syntax fix. From ren mingshuai vi github PR#369.
|
|||
|
|
|
|||
|
|
OpenBSD-Regress-ID: 6696b2eeefe128099fc3d7ea9f23252cc35156f9
|
|||
|
|
|
|||
|
|
commit 4d87a00f704e0365e11c3c38b170c1275ec461fc
|
|||
|
|
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
|||
|
|
Date: Sat Jan 14 09:57:08 2023 +0000
|
|||
|
|
|
|||
|
|
upstream: Instead of skipping the all-tokens test if we don't have
|
|||
|
|
|
|||
|
|
OpenSSL (since we use it to compute the hash), put the hash at the end and
|
|||
|
|
just omit it if we don't have it. Prompted by bz#3521.
|
|||
|
|
|
|||
|
|
OpenBSD-Regress-ID: c79ecba64250ed3b6417294b6c965e6b12ca5eea
|
|||
|
|
|
|||
|
|
commit b05406d6f93b8c8ec11ec8b27e7c76cc7a5a55fb
|
|||
|
|
Author: jmc@openbsd.org <jmc@openbsd.org>
|
|||
|
|
Date: Fri Jan 13 07:13:40 2023 +0000
|
|||
|
|
|
|||
|
|
upstream: fix double phrase in previous;
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: 671e6c8dc5e9230518b2bbfa143daaa88adc66c2
|
|||
|
|
|
|||
|
|
commit 40564812b659c530eb1f4b62d09e85612aef3107
|
|||
|
|
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
|||
|
|
Date: Fri Jan 13 03:16:29 2023 +0000
|
|||
|
|
|
|||
|
|
upstream: Document "UserKnownHostsFile none". ok djm@
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: f695742d39e34ecdcc3c861c3739a84648a4bce5
|
|||
|
|
|
|||
|
|
commit d03e245e034019a37388f6f5f893ce848ab6d2e2
|
|||
|
|
Author: Darren Tucker <dtucker@dtucker.net>
|
|||
|
|
Date: Fri Jan 13 23:02:34 2023 +1100
|
|||
|
|
|
|||
|
|
Retry package installation 3 times.
|
|||
|
|
|
|||
|
|
When setting up the CI environment, retry package installation 3 times
|
|||
|
|
before going up. Should help prevent spurious failures during
|
|||
|
|
infrastructure issues.
|
|||
|
|
|
|||
|
|
commit 625f6bc39840167dafb3bf5b6a3e18503ac986e8
|
|||
|
|
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
|||
|
|
Date: Fri Jan 13 04:47:34 2023 +0000
|
|||
|
|
|
|||
|
|
upstream: Move scp path setting to a helper function. The previous
|
|||
|
|
|
|||
|
|
commit to add scp to the test sshd's path causes the t-envpass test to fail
|
|||
|
|
when the test scp is given using a fully qualified path. Put this in a
|
|||
|
|
helper function and only call it from the scp tests.
|
|||
|
|
|
|||
|
|
OpenBSD-Regress-ID: 7533dc1c4265c1de716abb062957994195b36df4
|
|||
|
|
|
|||
|
|
commit 6e6f88647042b3cde54a628545c2f5fb656a9327
|
|||
|
|
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
|||
|
|
Date: Fri Jan 13 04:23:00 2023 +0000
|
|||
|
|
|
|||
|
|
upstream: Add scp's path to test sshd's PATH.
|
|||
|
|
|
|||
|
|
If the scp we're testing is fully qualified (eg it's not in the system
|
|||
|
|
PATH) then add its path to the under-test sshd's PATH so we can find
|
|||
|
|
it. Prompted by bz#3518.
|
|||
|
|
|
|||
|
|
OpenBSD-Regress-ID: 7df4f5a0be3aa135495b7e5a6719d3cbc26cc4c0
|
|||
|
|
|
|||
|
|
commit 8a5e99a70fcf9b022a8aa175ebf6a71f58511da3
|
|||
|
|
Author: Darren Tucker <dtucker@dtucker.net>
|
|||
|
|
Date: Fri Jan 13 15:49:48 2023 +1100
|
|||
|
|
|
|||
|
|
Remove skipping test when scp not in path.
|
|||
|
|
|
|||
|
|
An upcoming change renders this obsolete by adding scp's path to the
|
|||
|
|
test sshd's PATH, and removing this first will make the subsequent sync
|
|||
|
|
easier.
|
|||
|
|
|
|||
|
|
commit 41f36dd896c8fb8337d403fcf476762986976e9d
|
|||
|
|
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
|||
|
|
Date: Fri Jan 13 02:58:20 2023 +0000
|
|||
|
|
|
|||
|
|
upstream: Add a "Host" line to the output of ssh -G showing the
|
|||
|
|
|
|||
|
|
original host arg. Inspired by patch from vincent at bernat.ch via bz#3343,
|
|||
|
|
ok djm@
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: 59c0f60a222113a44d0650cd394376e3beecc883
|
|||
|
|
|
|||
|
|
commit f673b49f3be3eb51074fbb8a405beb6cd0f7d93e
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Fri Jan 13 02:44:02 2023 +0000
|
|||
|
|
|
|||
|
|
upstream: avoid printf("%s", NULL) if using ssh
|
|||
|
|
|
|||
|
|
-oUserKnownHostsFile=none and a hostkey in one of the system known hosts file
|
|||
|
|
changes; ok dtucker@
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: 7ca87614bfc6da491315536a7f2301434a9fe614
|
|||
|
|
|
|||
|
|
commit 93fc7c576563e3d88a1dc019dd213f65607784cc
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Wed Jan 11 05:39:38 2023 +0000
|
|||
|
|
|
|||
|
|
upstream: clamp the minimum buffer lengths and number of inflight
|
|||
|
|
|
|||
|
|
requests too
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: c4965f62fa0ba850940fd66ae3f60cf516bbcd56
|
|||
|
|
|
|||
|
|
commit 48bf234322e639d279c5a28435eae50155e9b514
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Wed Jan 11 05:36:50 2023 +0000
|
|||
|
|
|
|||
|
|
upstream: ignore bogus upload/download buffer lengths in the limits
|
|||
|
|
|
|||
|
|
extension
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: c5b023e0954693ba9a5376e4280c739b5db575f8
|
|||
|
|
|
|||
|
|
commit 36b00d31833ca74cb0f7c7d8eda1bde55700f929
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Wed Jan 11 02:13:52 2023 +0000
|
|||
|
|
|
|||
|
|
upstream: remove whitespace at EOL from code extracted from SUPERCOP
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: 1ec524ff2fbb9387d731601437c82008f35a60f4
|
|||
|
|
|
|||
|
|
commit d888de06c5e4d7dbf2f2b85f2b5bf028c570cf78
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Wed Jan 11 00:51:27 2023 +0000
|
|||
|
|
|
|||
|
|
upstream: rewrite this test to use a multiplexed ssh session so we can
|
|||
|
|
|
|||
|
|
control its lifecycle without risk of race conditions; fixes some of the
|
|||
|
|
Github integration tests for openssh-portable
|
|||
|
|
|
|||
|
|
OpenBSD-Regress-ID: 5451cad59ba0d43ae9eeda48ec80f54405fee969
|
|||
|
|
|
|||
|
|
commit 4bcc737a35fdd9cc4af7423d6c23dfd0c7ef4786
|
|||
|
|
Author: Damien Miller <djm@mindrot.org>
|
|||
|
|
Date: Wed Jan 11 11:45:17 2023 +1100
|
|||
|
|
|
|||
|
|
remove buffer len workaround for NetBSD 4.x
|
|||
|
|
|
|||
|
|
Switching to from pipes to a socketpair for communicating with the
|
|||
|
|
ssh process avoids the (kernel bug?) problem.
|
|||
|
|
|
|||
|
|
commit f5154d2aac3e6a32a1b13dec23a701a087850cdc
|
|||
|
|
Author: Damien Miller <djm@mindrot.org>
|
|||
|
|
Date: Wed Jan 11 11:44:19 2023 +1100
|
|||
|
|
|
|||
|
|
add back use of pipes in scp.c under USE_PIPES
|
|||
|
|
|
|||
|
|
This matches sftp.c which prefers socketpair but uses pipes on
|
|||
|
|
some older platforms.
|
|||
|
|
|
|||
|
|
commit eec737b59cf13841de46134967a206607000acd4
|
|||
|
|
Author: millert@openbsd.org <millert@openbsd.org>
|
|||
|
|
Date: Tue Jan 10 23:22:15 2023 +0000
|
|||
|
|
|
|||
|
|
upstream: Switch scp from using pipes to a socketpair for
|
|||
|
|
|
|||
|
|
communication with it's ssh sub-processes. We no longer need to reserve two
|
|||
|
|
descriptors to ensure that we don't end up using fd 0-2 unexpectedly, that is
|
|||
|
|
handled by sanitise_stdfd() in main(). Based on an original diff from djm@.
|
|||
|
|
OK deraadt@ djm@
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: b80c372faac462471e955ddeab9480d668a2e48d
|
|||
|
|
|
|||
|
|
commit d213d126a4a343abd3a1eb13687d39c1891fe5c8
|
|||
|
|
Author: jmc@openbsd.org <jmc@openbsd.org>
|
|||
|
|
Date: Fri Jan 6 08:44:11 2023 +0000
|
|||
|
|
|
|||
|
|
upstream: tweak previous; ok djm
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: 229c493452766d70a78b0f02f6ff9894f9028858
|
|||
|
|
|
|||
|
|
commit 4a5590a5ee47b7dfd49773e9fdba48ad3089fe64
|
|||
|
|
Author: Damien Miller <djm@mindrot.org>
|
|||
|
|
Date: Mon Jan 9 16:33:56 2023 +1100
|
|||
|
|
|
|||
|
|
try to improve logging for dynamic-forward test
|
|||
|
|
|
|||
|
|
previously the logs from the ssh used to exercise the forwarding
|
|||
|
|
channel would clobber the logs from the ssh actually doing the
|
|||
|
|
forwarding
|
|||
|
|
|
|||
|
|
commit 715bc25dcfccf9fb2bee820155fe071d01a618db
|
|||
|
|
Author: Darren Tucker <dtucker@dtucker.net>
|
|||
|
|
Date: Sat Jan 7 23:24:50 2023 +1100
|
|||
|
|
|
|||
|
|
Skip dynamic-forward test on minix3.
|
|||
|
|
|
|||
|
|
This test relies on loopback addresses which minix does not have.
|
|||
|
|
Previously the test would not run at all since it also doesn't have
|
|||
|
|
netcat, but now we use our own netcat it tries and fails.
|
|||
|
|
|
|||
|
|
commit dd1249bd5c45128a908395c61b26996a70f82205
|
|||
|
|
Author: Damien Miller <djm@mindrot.org>
|
|||
|
|
Date: Sun Jan 8 12:08:59 2023 +1100
|
|||
|
|
|
|||
|
|
don't test IPv6 addresses if platform lacks support
|
|||
|
|
|
|||
|
|
commit d77fc611a62f2dfee0b654c31a50a814b13310dd
|
|||
|
|
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
|||
|
|
Date: Fri Jan 6 12:33:33 2023 +0000
|
|||
|
|
|
|||
|
|
upstream: When OpenSSL is not available, skip parts of percent test
|
|||
|
|
|
|||
|
|
that require it. Based on github pr#368 from ren mingshuai.
|
|||
|
|
|
|||
|
|
OpenBSD-Regress-ID: 49a375b2cf61ccb95b52e75e2e025cd10988ebb2
|
|||
|
|
|
|||
|
|
commit 1cd2aac312af9172f1b5cb06c2e1cd090abb83cf
|
|||
|
|
Author: Darren Tucker <dtucker@dtucker.net>
|
|||
|
|
Date: Sat Jan 7 23:01:11 2023 +1100
|
|||
|
|
|
|||
|
|
Use our own netcat for dynamic-forward test.
|
|||
|
|
|
|||
|
|
That way we can be surer about its behaviour rather than trying to
|
|||
|
|
second-guess the behaviour of various netcat implementations.
|
|||
|
|
|
|||
|
|
commit 26cab41c05d7b0859d2a1ea5b6ed253d91848a80
|
|||
|
|
Author: Darren Tucker <dtucker@dtucker.net>
|
|||
|
|
Date: Sat Jan 7 14:30:43 2023 +1100
|
|||
|
|
|
|||
|
|
Use autoconf to find openssl binary.
|
|||
|
|
|
|||
|
|
It's possible to install an OpenSSL in a path not in the system's
|
|||
|
|
default library search path. OpenSSH can still use this (eg if you
|
|||
|
|
specify an rpath) but the openssl binary there may not work. If one is
|
|||
|
|
available on the system path just use that.
|
|||
|
|
|
|||
|
|
commit 5532e010a0eeb6aa264396514f9aed7948471538
|
|||
|
|
Author: Darren Tucker <dtucker@dtucker.net>
|
|||
|
|
Date: Sat Jan 7 10:34:18 2023 +1100
|
|||
|
|
|
|||
|
|
Check openssl_bin path is executable before using.
|
|||
|
|
|
|||
|
|
commit 5d7b16cff48598d5908db970bfdc9ff9326142c8
|
|||
|
|
Author: Darren Tucker <dtucker@dtucker.net>
|
|||
|
|
Date: Fri Jan 6 23:19:07 2023 +1100
|
|||
|
|
|
|||
|
|
Set OPENSSL_BIN from OpenSSL directory.
|
|||
|
|
|
|||
|
|
commit 344a0e8240eaf08da5d46a5e3a9ecad6e4f64c35
|
|||
|
|
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
|||
|
|
Date: Fri Jan 6 08:50:33 2023 +0000
|
|||
|
|
|
|||
|
|
upstream: Save debug logs from ssh for debugging purposes.
|
|||
|
|
|
|||
|
|
OpenBSD-Regress-ID: 109e40b06de1c006a3b8e0d8745b790b2c5870a0
|
|||
|
|
|
|||
|
|
commit e1ef172646f7f49c80807eea90225ef5e0be55a8
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Fri Jan 6 08:07:39 2023 +0000
|
|||
|
|
|
|||
|
|
upstream: regression test for ChannelTimeout
|
|||
|
|
|
|||
|
|
OpenBSD-Regress-ID: 280bfbefcfa415428ad744e43f69a8dede8ad685
|
|||
|
|
|
|||
|
|
commit 2393ea8daf25853459eb07a528d7577688847777
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Fri Jan 6 07:18:18 2023 +0000
|
|||
|
|
|
|||
|
|
upstream: fix typo in verbose logging
|
|||
|
|
|
|||
|
|
OpenBSD-Regress-ID: 0497cdb66e003b2f50ed77291a9104fba2e017e9
|
|||
|
|
|
|||
|
|
commit 161a5378a3cc2e7aa3f9674cb7f4686ae6ce9586
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Fri Jan 6 02:59:50 2023 +0000
|
|||
|
|
|
|||
|
|
upstream: unit tests for misc.c:ptimeout_* API
|
|||
|
|
|
|||
|
|
OpenBSD-Regress-ID: 01f8fb12d08e5aaadd4bd4e71f456b6588be9a94
|
|||
|
|
|
|||
|
|
commit 018d671d78145f03d6f07ae9d64d51321da70325
|
|||
|
|
Author: tb@openbsd.org <tb@openbsd.org>
|
|||
|
|
Date: Wed Jan 4 22:48:57 2023 +0000
|
|||
|
|
|
|||
|
|
upstream: Copy bytes from the_banana[] rather than banana()
|
|||
|
|
|
|||
|
|
Fixes test failure due to segfault seen on arm64 with xonly snap.
|
|||
|
|
|
|||
|
|
ok djm
|
|||
|
|
|
|||
|
|
OpenBSD-Regress-ID: 86e2aa4bbd1dff1bc4ebb2969c0d6474485be046
|
|||
|
|
|
|||
|
|
commit ab6bb69e251faa8b24f81b25c72ec0120f20cad4
|
|||
|
|
Author: Damien Miller <djm@mindrot.org>
|
|||
|
|
Date: Fri Jan 6 19:13:36 2023 +1100
|
|||
|
|
|
|||
|
|
unbreak scp on NetBSD 4.x
|
|||
|
|
|
|||
|
|
e555d5cad5 effectively increased the default copy buffer size for SFTP
|
|||
|
|
transfers. This caused NetBSD 4.x to hang during the "copy local file to
|
|||
|
|
remote file in place" scp.sh regression test.
|
|||
|
|
|
|||
|
|
This puts back the original 32KB copy buffer size until we can properly
|
|||
|
|
figure out why.
|
|||
|
|
|
|||
|
|
lots of debugging assistance from dtucker@
|
|||
|
|
|
|||
|
|
commit 2d1ff2b9431393ad99ef496d5e3b9dd0d4f5ac8c
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Fri Jan 6 02:47:18 2023 +0000
|
|||
|
|
|
|||
|
|
upstream: Implement channel inactivity timeouts
|
|||
|
|
|
|||
|
|
This adds a sshd_config ChannelTimeouts directive that allows channels that
|
|||
|
|
have not seen traffic in a configurable interval to be automatically closed.
|
|||
|
|
Different timeouts may be applied to session, X11, agent and TCP forwarding
|
|||
|
|
channels.
|
|||
|
|
|
|||
|
|
Note: this only affects channels over an opened SSH connection and not
|
|||
|
|
the connection itself. Most clients close the connection when their channels
|
|||
|
|
go away, with a notable exception being ssh(1) in multiplexing mode.
|
|||
|
|
|
|||
|
|
ok markus dtucker
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: ae8bba3ed9d9f95ff2e2dc8dcadfa36b48e6c0b8
|
|||
|
|
|
|||
|
|
commit 0e34348d0bc0b1522f75d6212a53d6d1d1367980
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Fri Jan 6 02:42:34 2023 +0000
|
|||
|
|
|
|||
|
|
upstream: Add channel_set_xtype()
|
|||
|
|
|
|||
|
|
This sets an "extended" channel type after channel creation (e.g.
|
|||
|
|
"session:subsystem:sftp") that will be used for setting channel inactivity
|
|||
|
|
timeouts.
|
|||
|
|
|
|||
|
|
ok markus dtucker
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: 42564aa92345045b4a74300528f960416a15d4ca
|
|||
|
|
|
|||
|
|
commit ceedf09b2977f3a756c759a6e7eb8f8e9db86a18
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Fri Jan 6 02:41:49 2023 +0000
|
|||
|
|
|
|||
|
|
upstream: tweak channel ctype names
|
|||
|
|
|
|||
|
|
These are now used by sshd_config:ChannelTimeouts to specify timeouts by
|
|||
|
|
channel type, so force them all to use a similar format without whitespace.
|
|||
|
|
|
|||
|
|
ok dtucker markus
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: 66834765bb4ae14f96d2bb981ac98a7dae361b65
|
|||
|
|
|
|||
|
|
commit c60438158ad4b2f83d8504257aba1be7d0b0bb4b
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Fri Jan 6 02:39:59 2023 +0000
|
|||
|
|
|
|||
|
|
upstream: Add channel_force_close()
|
|||
|
|
|
|||
|
|
This will forcibly close an open channel by simulating read/write errors,
|
|||
|
|
draining the IO buffers and calling the detach function.
|
|||
|
|
|
|||
|
|
Previously the detach function was only ever called during channel garbage
|
|||
|
|
collection, but there was no way to signal the user of a channel (e.g.
|
|||
|
|
session.c) that its channel was being closed deliberately (vs. by the
|
|||
|
|
usual state-machine logic). So this adds an extra "force" argument to the
|
|||
|
|
channel cleanup callback to indicate this condition.
|
|||
|
|
|
|||
|
|
ok markus dtucker
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: 23052707a42bdc62fda2508636e624afd466324b
|
|||
|
|
|
|||
|
|
commit d478cdc7ad6edd4b1bcd1e86fb2f23194ff33d5a
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Fri Jan 6 02:38:23 2023 +0000
|
|||
|
|
|
|||
|
|
upstream: replace manual poll/ppoll timeout math with ptimeout API
|
|||
|
|
|
|||
|
|
feedback markus / ok markus dtucker
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: c5ec4f2d52684cdb788cd9cbc1bcf89464014be2
|
|||
|
|
|
|||
|
|
commit 4adf3817a24efe99b06e62630577d683c7cd8065
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Fri Jan 6 02:37:04 2023 +0000
|
|||
|
|
|
|||
|
|
upstream: add ptimeout API for keeping track of poll/ppoll
|
|||
|
|
|
|||
|
|
timeouts; ok dtucker markus
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: 3335268ca135b3ec15a947547d7cfbb8ff929ead
|
|||
|
|
|
|||
|
|
commit 8c7c69d32375d2f3ce9da0109c9bffc560842316
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Thu Jan 5 05:49:13 2023 +0000
|
|||
|
|
|
|||
|
|
upstream: suppress "Connection closed" message when in quiet mode
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: 8a3ab7176764da55f60bfacfeae9b82d84e3908f
|
|||
|
|
|
|||
|
|
commit 845ceecea2ac311b0c267f9ecbd34862e1876fc6
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Mon Jan 2 07:03:57 2023 +0000
|
|||
|
|
|
|||
|
|
upstream: regression test for PermitRemoteOpen
|
|||
|
|
|
|||
|
|
OpenBSD-Regress-ID: 8271aafbf5c21950cd5bf966f08e585cebfe630c
|
|||
|
|
|
|||
|
|
commit b3daa8dc582348d6ab8150bc1e571b7aa08c5388
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Mon Jan 2 07:03:30 2023 +0000
|
|||
|
|
|
|||
|
|
upstream: fix bug in PermitRemoteOpen which caused it to ignore its
|
|||
|
|
|
|||
|
|
first argument unless it was one of the special keywords "any" or "none".
|
|||
|
|
|
|||
|
|
Reported by Georges Chaudy in bz3515; ok dtucker@
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: c5678a39f1ff79993d5ae3cfac5746a4ae148ea5
|
|||
|
|
|
|||
|
|
commit 0872663a7be0301bcc3d49acdbc9b740a3d972d4
|
|||
|
|
Author: jmc@openbsd.org <jmc@openbsd.org>
|
|||
|
|
Date: Mon Dec 26 19:16:03 2022 +0000
|
|||
|
|
|
|||
|
|
upstream: spelling fixes; from paul tagliamonte amendments to his
|
|||
|
|
|
|||
|
|
diff are noted on tech
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: d776dd03d0b882ca9c83b84f6b384f6f9bd7de4a
|
|||
|
|
|
|||
|
|
commit 797da2812a71785b34890bb6eb44767a7d09cd34
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Fri Dec 16 07:13:22 2022 +0000
|
|||
|
|
|
|||
|
|
upstream: Mention that scp uses the SFTP protocol and remove
|
|||
|
|
|
|||
|
|
reference to legacy flag. Spotted by, feedback and ok jmc@
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: 9dfe04966f52e941966b46c7a2972147f95281b3
|
|||
|
|
|
|||
|
|
commit 93f2ce8c050a7a2a628646c00b40b9b53fef93ef
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Fri Dec 16 06:56:47 2022 +0000
|
|||
|
|
|
|||
|
|
upstream: Clear signal mask early in main(); sshd may have been
|
|||
|
|
|
|||
|
|
started with one or more signals masked (sigprocmask(2) is not cleared
|
|||
|
|
on fork/exec) and this could interfere with various things, e.g. the
|
|||
|
|
login grace timer.
|
|||
|
|
|
|||
|
|
Execution environments that fail to clear the signal mask before running
|
|||
|
|
sshd are clearly broken, but apparently they do exist.
|
|||
|
|
|
|||
|
|
Reported by Sreedhar Balasubramanian; ok dtucker@
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: 77078c0b1c53c780269fc0c416f121d05e3010ae
|
|||
|
|
|
|||
|
|
commit 4acfaabfae41badb9d334a2ee88c5c6ad041c0d5
|
|||
|
|
Author: jmc@openbsd.org <jmc@openbsd.org>
|
|||
|
|
Date: Fri Dec 16 06:52:48 2022 +0000
|
|||
|
|
|
|||
|
|
upstream: add -X to usage();
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: 1bdc3df7de11d766587b0428318336dbffe4a9d0
|
|||
|
|
|
|||
|
|
commit e555d5cad5afae7d5ef2bbc02ca591178fe16fed
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Fri Dec 16 03:40:03 2022 +0000
|
|||
|
|
|
|||
|
|
upstream: add a -X option to both scp(1) and sftp(1) to allow
|
|||
|
|
|
|||
|
|
control over some SFTP protocol knobs: the copy buffer length and
|
|||
|
|
the number of inflight requests, both of which are used during
|
|||
|
|
upload/download.
|
|||
|
|
|
|||
|
|
Previously these could be controlled in sftp(1) using the -b/-R options.
|
|||
|
|
This makes them available in both SFTP protocol clients using the same
|
|||
|
|
option character sequence.
|
|||
|
|
|
|||
|
|
ok dtucker@
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: 27502bffc589776f5da1f31df8cb51abe9a15f1c
|
|||
|
|
|
|||
|
|
commit 5a7a7acab2f466dc1d7467b5d05d35268c3137aa
|
|||
|
|
Author: deraadt@openbsd.org <deraadt@openbsd.org>
|
|||
|
|
Date: Thu Dec 15 18:20:39 2022 +0000
|
|||
|
|
|
|||
|
|
upstream: The idiomatic way of coping with signed char vs unsigned
|
|||
|
|
|
|||
|
|
char (which did not come from stdio read functions) in the presence of
|
|||
|
|
ctype macros, is to always cast to (unsigned char). casting to (int)
|
|||
|
|
for a "macro" which is documented to take int, is weird. And sadly wrong,
|
|||
|
|
because of the sing extension risk.. same diff from florian
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: 65b9a49a68e22ff3a0ebd593f363e9f22dd73fea
|
|||
|
|
|
|||
|
|
commit b0b58222c7cc62efd8212c4fb65a545f58ebb22d
|
|||
|
|
Author: Darren Tucker <dtucker@dtucker.net>
|
|||
|
|
Date: Mon Dec 19 18:49:51 2022 +1100
|
|||
|
|
|
|||
|
|
Simply handling of SSH_CONNECTION PAM env var.
|
|||
|
|
|
|||
|
|
Prompted by bz#3508: there's no need to cache the value of
|
|||
|
|
sshpam_conninfo so remove the global. While there, add check of
|
|||
|
|
return value from pam_putenv. ok djm@
|
|||
|
|
|
|||
|
|
commit ed8444572ae684fdb892f97bae342c6cb6456f04
|
|||
|
|
Author: Darren Tucker <dtucker@dtucker.net>
|
|||
|
|
Date: Mon Dec 19 18:42:34 2022 +1100
|
|||
|
|
|
|||
|
|
Add tests for LibreSSL 3.7.0 and OpenSSL 1.1.1s.
|
|||
|
|
|
|||
|
|
commit abb9a8aaddfcacbd12641f6e4f203da0fa85a287
|
|||
|
|
Author: Darren Tucker <dtucker@dtucker.net>
|
|||
|
|
Date: Sun Dec 18 21:36:25 2022 +1100
|
|||
|
|
|
|||
|
|
Use sudo when resetting perms on directories.
|
|||
|
|
|
|||
|
|
commit 2f5664c5908d84697cbe91302d5d5c4d83cb2121
|
|||
|
|
Author: Darren Tucker <dtucker@dtucker.net>
|
|||
|
|
Date: Sun Dec 18 21:19:33 2022 +1100
|
|||
|
|
|
|||
|
|
Set group perms on regress dir.
|
|||
|
|
|
|||
|
|
This ensures that the tests don't fail due to StrictMode checks.
|
|||
|
|
|
|||
|
|
commit 137196300fc1540affadde880210f02ba6cb4abf
|
|||
|
|
Author: Darren Tucker <dtucker@dtucker.net>
|
|||
|
|
Date: Sun Dec 18 21:13:42 2022 +1100
|
|||
|
|
|
|||
|
|
Fetch regress logs from obj dir.
|
|||
|
|
|
|||
|
|
commit 5f93c4836527d9fda05de8944a1c7b4a205080c7
|
|||
|
|
Author: Darren Tucker <dtucker@dtucker.net>
|
|||
|
|
Date: Tue Dec 13 20:59:54 2022 +1100
|
|||
|
|
|
|||
|
|
obsdsnap test VMs runs-on libvirt too.
|
|||
|
|
|
|||
|
|
commit 8386886fb1ab7fda73069fb0db1dbe0e5a52f758
|
|||
|
|
Author: Darren Tucker <dtucker@dtucker.net>
|
|||
|
|
Date: Tue Dec 13 20:55:37 2022 +1100
|
|||
|
|
|
|||
|
|
Run upstream obsdsnap tests on ephemeral runners.
|
|||
|
|
|
|||
|
|
commit b6e01459b55ece85d7f296b2bc719d1841e1009e
|
|||
|
|
Author: Darren Tucker <dtucker@dtucker.net>
|
|||
|
|
Date: Tue Dec 13 20:48:56 2022 +1100
|
|||
|
|
|
|||
|
|
Move obsdsnap test VMs to ephemeral runners.
|
|||
|
|
|
|||
|
|
commit ea6fdf9a1aa71a411f7db218a986392c4fb55693
|
|||
|
|
Author: Damien Miller <djm@mindrot.org>
|
|||
|
|
Date: Fri Dec 9 18:00:21 2022 +1100
|
|||
|
|
|
|||
|
|
use calloc for allocating arc4random structs
|
|||
|
|
|
|||
|
|
ok dtucker
|
|||
|
|
|
|||
|
|
commit 4403b62f5548e91389cb3339d26a9d0c4bb07b34
|
|||
|
|
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
|||
|
|
Date: Fri Dec 9 00:22:29 2022 +0000
|
|||
|
|
|
|||
|
|
upstream: Warn if no host keys for hostbased auth can be loaded.
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: 2a0a13132000cf8d3593133c1b49768aa3c95977
|
|||
|
|
|
|||
|
|
commit a6183e25e3f1842e21999fe88bc40bb99b121dc3
|
|||
|
|
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
|||
|
|
Date: Fri Dec 9 00:17:40 2022 +0000
|
|||
|
|
|
|||
|
|
upstream: Add server debugging for hostbased auth.
|
|||
|
|
|
|||
|
|
auth_debug_add queues messages about the auth process which is sent to
|
|||
|
|
the client after successful authentication. This also sends those to
|
|||
|
|
the server debug log to aid in debugging. From bz#3507, ok djm@
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: 46ff67518cccf9caf47e06393e2a121ee5aa258a
|
|||
|
|
|
|||
|
|
commit b85c3581c16aaf6e83b9a797c80705a56b1f312e
|
|||
|
|
Author: cheloha@openbsd.org <cheloha@openbsd.org>
|
|||
|
|
Date: Sun Dec 4 23:50:49 2022 +0000
|
|||
|
|
|
|||
|
|
upstream: remove '?' from getopt(3) loops
|
|||
|
|
|
|||
|
|
userspace: remove vestigial '?' cases from top-level getopt(3) loops
|
|||
|
|
|
|||
|
|
getopt(3) returns '?' when it encounters a flag not present in the in
|
|||
|
|
the optstring or if a flag is missing its option argument. We can
|
|||
|
|
handle this case with the "default" failure case with no loss of
|
|||
|
|
legibility. Hence, remove all the redundant "case '?':" lines.
|
|||
|
|
|
|||
|
|
Prompted by dlg@. With help from dlg@ and millert@.
|
|||
|
|
|
|||
|
|
Link: https://marc.info/?l=openbsd-tech&m=167011979726449&w=2
|
|||
|
|
|
|||
|
|
ok naddy@ millert@ dlg@
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: b2f89346538ce4f5b33ab8011a23e0626a67e66e
|
|||
|
|
|
|||
|
|
commit 9a067e8d28a2249fd73f004961e30c113ee85e5d
|
|||
|
|
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
|||
|
|
Date: Wed Dec 7 11:45:43 2022 +0000
|
|||
|
|
|
|||
|
|
upstream: Fix comment typo.
|
|||
|
|
|
|||
|
|
OpenBSD-Regress-ID: 3b04faced6511bb5e74648c6a4ef4bf2c4decf03
|
|||
|
|
|
|||
|
|
commit ce3c3e78ce45d68a82c7c8dc89895f297a67f225
|
|||
|
|
Author: Darren Tucker <dtucker@dtucker.net>
|
|||
|
|
Date: Wed Dec 7 18:58:25 2022 +1100
|
|||
|
|
|
|||
|
|
Add SANDBOX_DEBUG to the kitchensink test build.
|
|||
|
|
|
|||
|
|
commit bc234605fa3eb10f56bf0d74c8ecb0d91ada9d05
|
|||
|
|
Author: Damien Miller <djm@mindrot.org>
|
|||
|
|
Date: Wed Dec 7 18:38:25 2022 +1100
|
|||
|
|
|
|||
|
|
disable SANDBOX_SECCOMP_FILTER_DEBUG
|
|||
|
|
|
|||
|
|
It was mistakenly enabled in 2580916e4872
|
|||
|
|
|
|||
|
|
Reported by Peter sec-openssh-com.22.fichtner AT 0sg.net
|
|||
|
|
|
|||
|
|
commit b087c5cfa011b27992e01589314fec830266f99d
|
|||
|
|
Author: Rose <83477269+AtariDreams@users.noreply.github.com>
|
|||
|
|
Date: Tue Nov 29 15:12:54 2022 -0500
|
|||
|
|
|
|||
|
|
Update autotools
|
|||
|
|
|
|||
|
|
Regenerate config files using latest autotools
|
|||
|
|
|
|||
|
|
commit d63f5494978a185c7421d492b9c2f6f05bb54138
|
|||
|
|
Author: Darren Tucker <dtucker@dtucker.net>
|
|||
|
|
Date: Tue Dec 6 12:22:36 2022 +1100
|
|||
|
|
|
|||
|
|
Fix typo in comment. Spotted by tim@
|
|||
|
|
|
|||
|
|
commit 73dcca12115aa12ed0d123b914d473c384e52651
|
|||
|
|
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
|||
|
|
Date: Sun Dec 4 11:03:11 2022 +0000
|
|||
|
|
|
|||
|
|
upstream: Remove duplicate includes.
|
|||
|
|
|
|||
|
|
Patch from AtariDreams via github PR#364.
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: b9186638a05cb8b56ef7c0de521922b6723644ea
|
|||
|
|
|
|||
|
|
commit 3cec15543010bc8d6997d896b1717a650afb7e92
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Fri Dec 2 04:40:27 2022 +0000
|
|||
|
|
|
|||
|
|
upstream: make struct sshbuf private
|
|||
|
|
|
|||
|
|
and remove an unused field; ok dtucker
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: c7a3d77c0b8c153d463398606a8d57569186a0c3
|
|||
|
|
|
|||
|
|
commit 5796bf8ca9535f9fa7d01829a540d2550e05c860
|
|||
|
|
Author: Darren Tucker <dtucker@dtucker.net>
|
|||
|
|
Date: Fri Dec 2 11:43:36 2022 +1100
|
|||
|
|
|
|||
|
|
Restore ssh-agent permissions on exit.
|
|||
|
|
|
|||
|
|
...enough that subsequent builds can overwrite ssh-agent if necessary.
|
|||
|
|
|
|||
|
|
commit ccf5a13868cbb4659107458cac1e017c98abcbda
|
|||
|
|
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
|||
|
|
Date: Thu Dec 1 02:22:13 2022 +0000
|
|||
|
|
|
|||
|
|
upstream: Clean up ssh-add and ssh-agent logs.
|
|||
|
|
|
|||
|
|
OpenBSD-Regress-ID: 9eda8e4c3714d7f943ab2e73ed58a233bd29cd2c
|
|||
|
|
|
|||
|
|
commit 7a8b40cf6a5eda80173140cc6750a6db8412fa87
|
|||
|
|
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
|||
|
|
Date: Thu Dec 1 02:19:29 2022 +0000
|
|||
|
|
|
|||
|
|
upstream: Log output of ssh-agent and ssh-add
|
|||
|
|
|
|||
|
|
This should make debugging easier.
|
|||
|
|
|
|||
|
|
OpenBSD-Regress-ID: 5974b02651f428d7e1079b41304c498ca7e306c8
|
|||
|
|
|
|||
|
|
commit 4a1805d532616233dd6072e5cd273b96dd3062e6
|
|||
|
|
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
|||
|
|
Date: Tue Nov 29 22:41:14 2022 +0000
|
|||
|
|
|
|||
|
|
upstream: Add void to client_repledge args to fix compiler warning. ok djm@
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: 7e964a641ce4a0a0a11f047953b29929d7a4b866
|
|||
|
|
|
|||
|
|
commit 815c4704930aa449edf6e812e99d69e9ffd31f01
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Mon Nov 28 01:38:22 2022 +0000
|
|||
|
|
|
|||
|
|
upstream: tighten pledge(2) after session establishment
|
|||
|
|
|
|||
|
|
feedback, ok & testing in snaps deraadt@
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: aecf4d49d28586dfbcc74328d9333398fef9eb58
|
|||
|
|
|
|||
|
|
commit f7cebbbf407d772ed71403d314343766782fe540
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Mon Nov 28 01:37:36 2022 +0000
|
|||
|
|
|
|||
|
|
upstream: New EnableEscapeCommandline ssh_config(5) option
|
|||
|
|
|
|||
|
|
This option (default "no") controls whether the ~C escape is available.
|
|||
|
|
Turning it off by default means we will soon be able to use a stricter
|
|||
|
|
default pledge(2) in the client.
|
|||
|
|
|
|||
|
|
feedback deraadt@ dtucker@; tested in snaps for a while
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: 7e277595d60acb8263118dcb66554472257b387a
|
|||
|
|
|
|||
|
|
commit d323f7ecf52e3d4ec1f4939bf31693e02f891dca
|
|||
|
|
Author: mbuhl@openbsd.org <mbuhl@openbsd.org>
|
|||
|
|
Date: Fri Nov 18 19:47:40 2022 +0000
|
|||
|
|
|
|||
|
|
upstream: In channel_request_remote_forwarding the parameters for
|
|||
|
|
|
|||
|
|
permission_set_add are leaked as they are also duplicated in the call. Found
|
|||
|
|
by CodeChecker. ok djm
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: 4aef50fa9be7c0b138188814c8fe3dccc196f61e
|
|||
|
|
|
|||
|
|
commit 62cc33e6eed847aafdc29e34aa69e9bd82a0ee16
|
|||
|
|
Author: Darren Tucker <dtucker@dtucker.net>
|
|||
|
|
Date: Wed Nov 30 11:23:11 2022 +1100
|
|||
|
|
|
|||
|
|
Use -fzero-call-used-regs=used on clang 15.
|
|||
|
|
|
|||
|
|
clang 15 seems to have a problem with -fzero-call-used-reg=all which
|
|||
|
|
causes spurious "incorrect signature" failures with ED25519. On those
|
|||
|
|
versions, use -fzero-call-used-regs=used instead. (We may add exceptions
|
|||
|
|
later if specific versions prove to be OK). Also move the GCC version
|
|||
|
|
check to match.
|
|||
|
|
|
|||
|
|
Initial investigation by Daniel Pouzzner (douzzer at mega nu), workaround
|
|||
|
|
suggested by Bill Wendling (morbo at google com). bz#3475, ok djm@
|
|||
|
|
|
|||
|
|
commit f84b9cffd52c9c5c359a54a1929f9948e803ab1d
|
|||
|
|
Author: Darren Tucker <dtucker@dtucker.net>
|
|||
|
|
Date: Mon Nov 28 21:09:28 2022 +1100
|
|||
|
|
|
|||
|
|
Skip unit tests on slow riscv64 hardware.
|
|||
|
|
|
|||
|
|
commit 9f2747e0bed3faca92679eae69aef10c95dc82f5
|
|||
|
|
Author: Darren Tucker <dtucker@dtucker.net>
|
|||
|
|
Date: Sun Nov 27 15:26:22 2022 +1100
|
|||
|
|
|
|||
|
|
Rework how selfhosted tests interact with runners.
|
|||
|
|
|
|||
|
|
Previously there was one runner per test target (mostly VMs). This had
|
|||
|
|
a few limitations:
|
|||
|
|
- multiple tests that ran on the same target (eg multiple build
|
|||
|
|
configs) were serialized on availability or that runner.
|
|||
|
|
- it needed manual balancing of VMs over host machines.
|
|||
|
|
|
|||
|
|
To address this, make VMs that use ephemeral disks (ie most of them)
|
|||
|
|
all use a pool of runners with the "libvirt" label. This requires that
|
|||
|
|
we distinguish between "host" and "target" for those. Native runners
|
|||
|
|
and VMs with persistent disks (eg the constantly-updated snapshot ones)
|
|||
|
|
specify the same host and target.
|
|||
|
|
|
|||
|
|
This should improve test throughput.
|
|||
|
|
|
|||
|
|
commit d664ddaec87bdc7385be8ef7f1337793e1679d48
|
|||
|
|
Author: Darren Tucker <dtucker@dtucker.net>
|
|||
|
|
Date: Sun Nov 27 12:19:37 2022 +1100
|
|||
|
|
|
|||
|
|
Run vmstartup from temp dir.
|
|||
|
|
|
|||
|
|
This will allow us to create ephemeral disk images per-runner.
|
|||
|
|
|
|||
|
|
commit 0fa16e952b1fc1c4cf65e3dd138b0e87003e2e45
|
|||
|
|
Author: Darren Tucker <dtucker@dtucker.net>
|
|||
|
|
Date: Sun Nov 27 12:14:00 2022 +1100
|
|||
|
|
|
|||
|
|
Make "config" in matrix singular and pass in env.
|
|||
|
|
|
|||
|
|
This will allow the startup scripts to adapt their behaviour based on
|
|||
|
|
the type and config.
|
|||
|
|
|
|||
|
|
commit e8857043af54809187be1e8b06749db61112899f
|
|||
|
|
Author: Darren Tucker <dtucker@dtucker.net>
|
|||
|
|
Date: Sun Nov 27 11:42:22 2022 +1100
|
|||
|
|
|
|||
|
|
Add "libvirt" label to dfly30.
|
|||
|
|
|
|||
|
|
commit 9775473d84902dc37753686cd10ae71fbe67efda
|
|||
|
|
Author: Darren Tucker <dtucker@dtucker.net>
|
|||
|
|
Date: Sun Nov 27 09:28:20 2022 +1100
|
|||
|
|
|
|||
|
|
Rename "os" in matrix to "target".
|
|||
|
|
|
|||
|
|
This is in preparation to distinguish this from the host that the runner
|
|||
|
|
runs on in case where they are separate (eg VMs).
|
|||
|
|
|
|||
|
|
commit 04fd00ceff39f4544ced6f5342060abe584835d0
|
|||
|
|
Author: Darren Tucker <dtucker@dtucker.net>
|
|||
|
|
Date: Sun Nov 27 09:23:04 2022 +1100
|
|||
|
|
|
|||
|
|
Remove unused self-hosted test targets.
|
|||
|
|
|
|||
|
|
commit c9d9fcad2a11c1cd1550a541f44091d65f0b5584
|
|||
|
|
Author: Darren Tucker <dtucker@dtucker.net>
|
|||
|
|
Date: Sun Nov 27 09:16:15 2022 +1100
|
|||
|
|
|
|||
|
|
Remove explicit "default" test config argument.
|
|||
|
|
|
|||
|
|
Not specifying the test config implicitly selects default args.
|
|||
|
|
|
|||
|
|
commit 15a01cf15f396f87c6d221c5a6af98331c818962
|
|||
|
|
Author: Darren Tucker <dtucker@dtucker.net>
|
|||
|
|
Date: Wed Nov 23 13:18:54 2022 +1100
|
|||
|
|
|
|||
|
|
Add fallback for old platforms w/out MAP_ANON.
|
|||
|
|
|
|||
|
|
commit 6b9bbbfe8b26db6e9a30a7e08c223e85421aed98
|
|||
|
|
Author: Darren Tucker <dtucker@dtucker.net>
|
|||
|
|
Date: Wed Nov 23 13:09:11 2022 +1100
|
|||
|
|
|
|||
|
|
If we haven't found it yet, recheck for sys/stat.h.
|
|||
|
|
|
|||
|
|
On some very old platforms, sys/stat.h needs sys/types.h, however
|
|||
|
|
autoconf 2.71's AC_CHECK_INCLUDES_DEFAULT checks for them in the
|
|||
|
|
opposite order, which in combination with modern autoconf's
|
|||
|
|
"present but cannot be compiled" behaviour causes it to not be
|
|||
|
|
detected.
|
|||
|
|
|
|||
|
|
commit 8926956f22639132a9f2433fcd25224e01b900f5
|
|||
|
|
Author: Darren Tucker <dtucker@dtucker.net>
|
|||
|
|
Date: Fri Nov 11 11:25:37 2022 +1100
|
|||
|
|
|
|||
|
|
Add dfly62 test target.
|
|||
|
|
|
|||
|
|
commit 650de7ecd3567b5a5dbf16dd1eb598bd8c20bca8
|
|||
|
|
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
|||
|
|
Date: Thu Nov 10 23:03:10 2022 +0000
|
|||
|
|
|
|||
|
|
upstream: Handle dynamic remote port forwarding in escape commandline's
|
|||
|
|
|
|||
|
|
-R processing. bz#3499, ok djm@
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: 194ee4cfe7ed0e2b8ad0727f493c798a50454208
|
|||
|
|
|
|||
|
|
commit 5372db7e7985ba2c00f20fdff8942145ca99e033
|
|||
|
|
Author: Darren Tucker <dtucker@dtucker.net>
|
|||
|
|
Date: Thu Nov 10 12:44:51 2022 +1100
|
|||
|
|
|
|||
|
|
Remove seed passing over reexec.
|
|||
|
|
|
|||
|
|
This was added for the benefit of platforms using ssh-rand-helper to
|
|||
|
|
prevent a delay on each connection as sshd reseeded itself.
|
|||
|
|
|
|||
|
|
ssh-random-helper is long gone, and since the re-exec happens before the
|
|||
|
|
chroot the re-execed sshd can reseed itself normally. ok djm@
|
|||
|
|
|
|||
|
|
commit ca98d3f8c64cfc51af81e1b01c36a919d5947ec2
|
|||
|
|
Author: Darren Tucker <dtucker@dtucker.net>
|
|||
|
|
Date: Wed Nov 9 20:59:20 2022 +1100
|
|||
|
|
|
|||
|
|
Skip reexec test on OpenSSL 1.1.1 specifically.
|
|||
|
|
|
|||
|
|
OpenSSL 1.1.1 has a bug in its RNG that breaks reexec fallback, so skip
|
|||
|
|
that test. See bz#3483 for details.
|
|||
|
|
|
|||
|
|
commit 5ec4ebc2548e5f7f1b55b2a5cef5b67bdca8146f
|
|||
|
|
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
|||
|
|
Date: Wed Nov 9 09:04:12 2022 +0000
|
|||
|
|
|
|||
|
|
upstream: Fix typo in fatal error message.
|
|||
|
|
|
|||
|
|
Patch from vapier at chromium.org.
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: 8a0c164a6a25eef0eedfc30df95bfa27644e35cf
|
|||
|
|
|
|||
|
|
commit e6abafe9a6d809422d3432b95b3f9747b0acaa71
|
|||
|
|
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
|||
|
|
Date: Wed Nov 9 09:01:52 2022 +0000
|
|||
|
|
|
|||
|
|
upstream: Remove errant colon and simplify format
|
|||
|
|
|
|||
|
|
string in error messages. Patch from vapier at chromium.org.
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: fc28466ebc7b74e0072331947a89bdd239c160d3
|
|||
|
|
|
|||
|
|
commit db2027a687516f87c3fb141e87154bb3d8a7807c
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Wed Nov 9 01:37:44 2022 +0000
|
|||
|
|
|
|||
|
|
upstream: rename client_global_hostkeys_private_confirm() to
|
|||
|
|
|
|||
|
|
client_global_hostkeys_prove_confirm(), as it handles the
|
|||
|
|
"hostkeys-prove00@openssh.com" message; no functional change
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: 31e09bd3cca6eed26855b88fb8beed18e9bd026d
|
|||
|
|
|
|||
|
|
commit 1c2be7c2004cf1abcd172fee9fe3eab57cd4c426
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Wed Nov 9 00:15:59 2022 +0000
|
|||
|
|
|
|||
|
|
upstream: typo in comment
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: 39c58f41e0f32d1ff31731fa6f5bbbc3ad25084a
|
|||
|
|
|
|||
|
|
commit cf1a9852d7fc93e4abc4168aed09529a57427cdc
|
|||
|
|
Author: Darren Tucker <dtucker@dtucker.net>
|
|||
|
|
Date: Wed Nov 9 09:23:47 2022 +1100
|
|||
|
|
|
|||
|
|
Defer seed_rng until after closefrom call.
|
|||
|
|
|
|||
|
|
seed_rng will initialize OpenSSL, and some engine providers (eg Intel's
|
|||
|
|
QAT) will open descriptors for their own use. bz#3483, patch from
|
|||
|
|
joel.d.schuetze at intel.com, ok djm@
|
|||
|
|
|
|||
|
|
commit dffa64480163fbf76af7e4fb62c26bb0dd6642aa
|
|||
|
|
Author: Darren Tucker <dtucker@dtucker.net>
|
|||
|
|
Date: Wed Nov 9 08:27:47 2022 +1100
|
|||
|
|
|
|||
|
|
Fix comment text. From emaste at freebsd.org.
|
|||
|
|
|
|||
|
|
commit d9df5689c29823ab830ec4f54c83c6cc3c0077ad
|
|||
|
|
Author: Pierre Ossman <ossman@cendio.se>
|
|||
|
|
Date: Wed Jul 6 13:52:10 2022 +0200
|
|||
|
|
|
|||
|
|
Avoid assuming layout of fd_set
|
|||
|
|
|
|||
|
|
POSIX doesn't specify the internal layout of the fd_set object, so let's
|
|||
|
|
not assume it is just a bit mask. This increases compatibility with
|
|||
|
|
systems that have a different layout.
|
|||
|
|
|
|||
|
|
The assumption is also worthless as we already refuse to use file
|
|||
|
|
descriptors over FD_SETSIZE anyway. Meaning that the default size of
|
|||
|
|
fd_set is quite sufficient.
|
|||
|
|
|
|||
|
|
commit 419aa8a312e8d8f491933ca3d5933e602cb05aae
|
|||
|
|
Author: Darren Tucker <dtucker@dtucker.net>
|
|||
|
|
Date: Tue Nov 8 12:42:52 2022 +1100
|
|||
|
|
|
|||
|
|
Shutdown any VM before trying to check out repo.
|
|||
|
|
|
|||
|
|
In the case where the previous run did not clean up, the checkout will
|
|||
|
|
fail as it'll leave a stale mount.
|
|||
|
|
|
|||
|
|
commit a32c07cbb78f65d8527642b96474a83b413f8108
|
|||
|
|
Author: Darren Tucker <dtucker@dtucker.net>
|
|||
|
|
Date: Tue Nov 8 11:33:25 2022 +1100
|
|||
|
|
|
|||
|
|
Run vm startup and shutdown from runner temp dir.
|
|||
|
|
|
|||
|
|
Should work even if the github workspace dir is on a stale sshfs mount.
|
|||
|
|
|
|||
|
|
commit 2b40a7dfcdb8e616155b9504145aa52b271455aa
|
|||
|
|
Author: Darren Tucker <dtucker@dtucker.net>
|
|||
|
|
Date: Tue Nov 8 11:03:31 2022 +1100
|
|||
|
|
|
|||
|
|
Add valrind-5 test here too.
|
|||
|
|
|
|||
|
|
commit 2ea03d1f6d0a05ee2b63ed2dc0f2d54f1e4655a1
|
|||
|
|
Author: Darren Tucker <dtucker@dtucker.net>
|
|||
|
|
Date: Tue Nov 8 09:21:10 2022 +1100
|
|||
|
|
|
|||
|
|
Update checkout and upload actions.
|
|||
|
|
|
|||
|
|
Update actions/checkout and actions/upload-artifact to main branch for
|
|||
|
|
compatibility with node.js v16.
|
|||
|
|
|
|||
|
|
commit 4e316ff0f18a118232bb9ac6512ee62773a9e8ea
|
|||
|
|
Author: Darren Tucker <dtucker@dtucker.net>
|
|||
|
|
Date: Tue Nov 8 09:17:04 2022 +1100
|
|||
|
|
|
|||
|
|
Split out rekey test since it runs the longest.
|
|||
|
|
|
|||
|
|
commit 21625a6424258a92a96a3bb73ae6aabc5ed8a6b4
|
|||
|
|
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
|||
|
|
Date: Mon Nov 7 10:09:28 2022 +0000
|
|||
|
|
|
|||
|
|
upstream: The IdentityFile option in ssh_config can also be used to
|
|||
|
|
|
|||
|
|
specify a public key file, as documented in ssh.1 for the -i option. Document
|
|||
|
|
this also for IdentityFile in ssh_config.5, for documentation completeness.
|
|||
|
|
From laalsaas at systemli.org via portable github PR#352, ok jmc@ djm@
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: 2f943be9f96e60ef81a9a4faa25b009999f9883b
|
|||
|
|
|
|||
|
|
commit 747691604d3325ed2b62bad85b6fd8563ad32f6c
|
|||
|
|
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
|||
|
|
Date: Mon Nov 7 10:05:38 2022 +0000
|
|||
|
|
|
|||
|
|
upstream: Remove some set but otherwise unused variables, spotted
|
|||
|
|
|
|||
|
|
in -portable by clang 16's -Wunused-but-set-variable. ok djm@
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: 3d943ddf2369b38fbf89f5f19728e7dc1daf3982
|
|||
|
|
|
|||
|
|
commit 1d78d25653805aefc7a8dd9d86cd7359ada3823c
|
|||
|
|
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
|||
|
|
Date: Mon Nov 7 10:02:59 2022 +0000
|
|||
|
|
|
|||
|
|
upstream: Check for and disallow MaxStartups values less than or
|
|||
|
|
|
|||
|
|
equal to zero during config parsing, rather than faling later at runtime.
|
|||
|
|
bz#3489, ok djm@
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: d79c2b7a8601eb9be493629a91245d761154308b
|
|||
|
|
|
|||
|
|
commit a00f59a645072e5f5a8d207af15916a7b23e2642
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Mon Nov 7 04:04:40 2022 +0000
|
|||
|
|
|
|||
|
|
upstream: fix parsing of hex cert expiry time; was checking whether the
|
|||
|
|
|
|||
|
|
start time began with "0x", not the expiry time.
|
|||
|
|
|
|||
|
|
from Ed Maste
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: 6269242c3e1a130b47c92cfca4d661df15f05739
|
|||
|
|
|
|||
|
|
commit f58acaf8c7315483f4ac87d46a1aa2142a713cd8
|
|||
|
|
Author: Darren Tucker <dtucker@dtucker.net>
|
|||
|
|
Date: Mon Nov 7 15:10:59 2022 +1100
|
|||
|
|
|
|||
|
|
Fix merge conflict.
|
|||
|
|
|
|||
|
|
commit 162e5741020a8d996c0c12b988b118e71ed728e6
|
|||
|
|
Author: Darren Tucker <dtucker@dtucker.net>
|
|||
|
|
Date: Mon Nov 7 15:04:33 2022 +1100
|
|||
|
|
|
|||
|
|
Branch-specific links for master status badges.
|
|||
|
|
|
|||
|
|
commit e4b7c12ab24579312aa3ed38ce7041a439ec2d56
|
|||
|
|
Author: Darren Tucker <dtucker@dtucker.net>
|
|||
|
|
Date: Mon Nov 7 14:46:38 2022 +1100
|
|||
|
|
|
|||
|
|
Add CIFuzz status badge.
|
|||
|
|
|
|||
|
|
commit b496b9f831acd1e5bcd875e26e797488beef494a
|
|||
|
|
Author: Darren Tucker <dtucker@dtucker.net>
|
|||
|
|
Date: Mon Nov 7 14:45:16 2022 +1100
|
|||
|
|
|
|||
|
|
Do not run CIFuzz on selfhosted tree.
|
|||
|
|
|
|||
|
|
We already run it on the regular tree, no need to double up.
|
|||
|
|
|
|||
|
|
commit 2138b1c4ddb300129a41a5104627b0d561184c7b
|
|||
|
|
Author: Darren Tucker <dtucker@dtucker.net>
|
|||
|
|
Date: Mon Nov 7 14:41:58 2022 +1100
|
|||
|
|
|
|||
|
|
Whitespace change to trigger CIFuzz workflow.
|
|||
|
|
|
|||
|
|
commit 4670b97ef87c7b0f21283c9b07c7191be88dda05
|
|||
|
|
Author: Darren Tucker <dtucker@dtucker.net>
|
|||
|
|
Date: Mon Nov 7 14:34:04 2022 +1100
|
|||
|
|
|
|||
|
|
Run cifuzz workflow on the actions as regular CI.
|
|||
|
|
|
|||
|
|
commit 79391e66ce851ace1baf3c6a35e83a23f08ec2ba
|
|||
|
|
Author: David Korczynski <david@adalogics.com>
|
|||
|
|
Date: Tue Nov 30 11:45:20 2021 +0000
|
|||
|
|
|
|||
|
|
Add CIFuzz integration
|
|||
|
|
|
|||
|
|
commit c1893364a0be243270014d7d34362a8101d55112
|
|||
|
|
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
|||
|
|
Date: Mon Nov 7 02:21:22 2022 +0000
|
|||
|
|
|
|||
|
|
upstream: Import regenerated moduli.
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: b0e54ee4d703bd6929bbc624068666a7a42ecb1f
|
|||
|
|
|
|||
|
|
commit 5c3f18fb994ef27e685b205ee2351851b80fdbd1
|
|||
|
|
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
|||
|
|
Date: Mon Nov 7 01:53:01 2022 +0000
|
|||
|
|
|
|||
|
|
upstream: Fix typo. From pablomh via -portable github PR#344.
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: d056ee2e73691dc3ecdb44a6de68e6b88cd93827
|
|||
|
|
|
|||
|
|
commit e1c6fcc142066417c9832e634463faa3dd5d116c
|
|||
|
|
Author: Darren Tucker <dtucker@dtucker.net>
|
|||
|
|
Date: Mon Nov 7 12:46:58 2022 +1100
|
|||
|
|
|
|||
|
|
Link to branch-specific queries for V_9_1 status.
|
|||
|
|
|
|||
|
|
commit 4f4a5fad6d8892c3f8ee9cd81ec7de6458210c9f
|
|||
|
|
Author: Darren Tucker <dtucker@dtucker.net>
|
|||
|
|
Date: Sun Nov 6 10:55:59 2022 +1100
|
|||
|
|
|
|||
|
|
Use "prohibit-password" in -portable comments.
|
|||
|
|
|
|||
|
|
"without-password" is the deprecated alias for "prohibit-password",
|
|||
|
|
so we should reference the latter. From emaste at freebsd.org.
|
|||
|
|
|
|||
|
|
commit 0f7e1eba55259ec037f515000b4c4afbf446230a
|
|||
|
|
Author: Darren Tucker <dtucker@dtucker.net>
|
|||
|
|
Date: Sun Nov 6 10:50:01 2022 +1100
|
|||
|
|
|
|||
|
|
Fix tracing disable on FreeBSD.
|
|||
|
|
|
|||
|
|
Some versions of FreeBSD do not support using id 0 to refer to the
|
|||
|
|
current pid for procctl, so pass getpid() explicitly. From
|
|||
|
|
emaste at freebsd.org.
|
|||
|
|
|
|||
|
|
commit 32fddb982fd61b11a2f218a115975a87ab126d43
|
|||
|
|
Author: Darren Tucker <dtucker@dtucker.net>
|
|||
|
|
Date: Mon Nov 7 10:39:01 2022 +1100
|
|||
|
|
|
|||
|
|
Fix setres*id checks to work with clang-16.
|
|||
|
|
|
|||
|
|
glibc has the prototypes for setresuid and setresgid behind _GNU_SOURCE,
|
|||
|
|
and clang 16 will error out on implicit function definitions, so add
|
|||
|
|
_GNU_SOURCE and the required headers to the configure checks. From
|
|||
|
|
sam at @gentoo.org via bz#3497.
|
|||
|
|
|
|||
|
|
commit 12af712d116f42164bcfa56db901d06e4fa27199
|
|||
|
|
Author: Sam James <sam@gentoo.org>
|
|||
|
|
Date: Sun Nov 6 04:52:38 2022 +0000
|
|||
|
|
|
|||
|
|
configure.ac: Fix -Wstrict-prototypes
|
|||
|
|
|
|||
|
|
Clang 16 now warns on this and it'll be removed in C23, so let's
|
|||
|
|
just be future proof. It also reduces noise when doing general
|
|||
|
|
Clang 16 porting work (which is a big job as it is). github PR#355.
|
|||
|
|
|
|||
|
|
Signed-off-by: Sam James <sam@gentoo.org>
|
|||
|
|
|
|||
|
|
commit 40b0a5eb6e3edfa2886b60c09c7803353b0cc7f5
|
|||
|
|
Author: Sam James <sam@gentoo.org>
|
|||
|
|
Date: Sun Nov 6 04:47:35 2022 +0000
|
|||
|
|
|
|||
|
|
configure.ac: Add <pty.h> include for openpty
|
|||
|
|
|
|||
|
|
Another Clang 16ish fix (which makes -Wimplicit-function-declaration
|
|||
|
|
an error by default). github PR#355.
|
|||
|
|
|
|||
|
|
See: 2efd71da49b9cfeab7987058cf5919e473ff466b
|
|||
|
|
See: be197635329feb839865fdc738e34e24afd1fca8
|
|||
|
|
|
|||
|
|
commit 6b17e128879ec6cc32ca2c28b5d894b4aa72e32d
|
|||
|
|
Author: Rochdi Nassah <rochdinassah.1998@gmail.com>
|
|||
|
|
Date: Fri Oct 28 01:26:31 2022 +0100
|
|||
|
|
|
|||
|
|
Fix broken zlib link.
|
|||
|
|
|
|||
|
|
commit 99500df246ccb736ddbdd04160dcc82165d81a77
|
|||
|
|
Author: Darren Tucker <dtucker@dtucker.net>
|
|||
|
|
Date: Fri Nov 4 16:59:26 2022 +1100
|
|||
|
|
|
|||
|
|
Don't run openbsd-compat tests on Cygwin.
|
|||
|
|
|
|||
|
|
Add "compat-tests" to the default TEST_TARGET so we can override as
|
|||
|
|
necessary. Override TEST_TARGET for Cygwin as the tests don't currently
|
|||
|
|
compile there.
|
|||
|
|
|
|||
|
|
commit 3cae9f92a31897409666aa1e6f696f779759332b
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Thu Nov 3 21:59:20 2022 +0000
|
|||
|
|
|
|||
|
|
upstream: replace recently-added valid_domain() check for hostnames
|
|||
|
|
|
|||
|
|
going to known_hosts with a more relaxed check for bad characters; previous
|
|||
|
|
commit broke address literals. Reported by/feedback from florian@
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: 10b86dc6a4b206adaa0c11b58b6d5933898d43e0
|
|||
|
|
|
|||
|
|
commit 9655217231c9056200bea7ae2dffcc9c0c3eb265
|
|||
|
|
Author: Darren Tucker <dtucker@dtucker.net>
|
|||
|
|
Date: Thu Nov 3 23:07:50 2022 +1100
|
|||
|
|
|
|||
|
|
Rerun tests on changes to Makefile.in in any dir.
|
|||
|
|
|
|||
|
|
commit 3500f0405a3ab16b59a26f3508c4257a3fc3bce6
|
|||
|
|
Author: Darren Tucker <dtucker@dtucker.net>
|
|||
|
|
Date: Thu Nov 3 23:04:08 2022 +1100
|
|||
|
|
|
|||
|
|
Link libssh into compat tests.
|
|||
|
|
|
|||
|
|
The cygwin compat code uses xmalloc, so add libssh.a so pick up that.
|
|||
|
|
|
|||
|
|
commit ec59effcf65b8a4c85d47ff5a271123259dd0ab8
|
|||
|
|
Author: Darren Tucker <dtucker@dtucker.net>
|
|||
|
|
Date: Thu Nov 3 21:44:23 2022 +1100
|
|||
|
|
|
|||
|
|
Fix compat regress to work with non-GNU make.
|
|||
|
|
|
|||
|
|
commit 73550a218e7dfbbd599534cbf856309bc924f6fd
|
|||
|
|
Author: Darren Tucker <dtucker@dtucker.net>
|
|||
|
|
Date: Thu Nov 3 13:41:16 2022 +1100
|
|||
|
|
|
|||
|
|
Increase selfhosted job timeout.
|
|||
|
|
|
|||
|
|
The default job timeout of 360 (6h) is not enough to complete the
|
|||
|
|
regress tests for some of the slow VMs depending on the load on the host.
|
|||
|
|
Increase to 600 (10h).
|
|||
|
|
|
|||
|
|
commit db97d8d0b90c6ce52b94b153d6f8f5f7d3b11777
|
|||
|
|
Author: Darren Tucker <dtucker@dtucker.net>
|
|||
|
|
Date: Thu Nov 3 10:00:43 2022 +1100
|
|||
|
|
|
|||
|
|
Only run opensslver tests if built with OpenSSL.
|
|||
|
|
|
|||
|
|
commit ba053709638dff2f6603df0c1f340352261d63ea
|
|||
|
|
Author: Darren Tucker <dtucker@dtucker.net>
|
|||
|
|
Date: Wed Nov 2 14:16:04 2022 +1100
|
|||
|
|
|
|||
|
|
Add tests for OpenSSL 3.0.7 and LibreSSL 3.6.1.
|
|||
|
|
|
|||
|
|
commit edd24101c7e17d1a8f6576e1aaf62233b47ad6f5
|
|||
|
|
Author: Darren Tucker <dtucker@dtucker.net>
|
|||
|
|
Date: Thu Nov 3 08:17:39 2022 +1100
|
|||
|
|
|
|||
|
|
Run compat regress tests too.
|
|||
|
|
|
|||
|
|
commit fe88d67e7599b0bc73f6e4524add28d743e7f977
|
|||
|
|
Author: Darren Tucker <dtucker@dtucker.net>
|
|||
|
|
Date: Thu Nov 3 08:14:05 2022 +1100
|
|||
|
|
|
|||
|
|
Compat tests need libcrypto.
|
|||
|
|
|
|||
|
|
This was moved to CHANNELLIBS during the libs refactor. Spotted by
|
|||
|
|
rapier at psc.edu.
|
|||
|
|
|
|||
|
|
commit 96b519726b7944eee3c23a54eee3d5c031ba1533
|
|||
|
|
Author: Darren Tucker <dtucker@dtucker.net>
|
|||
|
|
Date: Thu Nov 3 04:24:39 2022 +1100
|
|||
|
|
|
|||
|
|
Include time.h when defining timegm.
|
|||
|
|
|
|||
|
|
Fixes build on some platforms eg recent AIX.
|
|||
|
|
|
|||
|
|
commit da6038bd5cd55eb212eb2aec1fc8ae79bbf76156
|
|||
|
|
Author: Darren Tucker <dtucker@dtucker.net>
|
|||
|
|
Date: Tue Nov 1 19:10:30 2022 +1100
|
|||
|
|
|
|||
|
|
Always use compat getentropy.
|
|||
|
|
|
|||
|
|
Have it call native getentropy and fall back as required. Should fix
|
|||
|
|
issues of platforms where libc has getentropy but it is not implemented
|
|||
|
|
in the kernel. Based on github PR#354 from simsergey.
|
|||
|
|
|
|||
|
|
commit 5ebe18cab6be3247b44c807ac145164010465b82
|
|||
|
|
Author: Darren Tucker <dtucker@dtucker.net>
|
|||
|
|
Date: Wed Nov 2 10:51:48 2022 +1100
|
|||
|
|
|
|||
|
|
Check for sockaddr_in.sin_len.
|
|||
|
|
|
|||
|
|
If found, set SOCK_HAS_LEN which is used in addr.c. Should fix keyscan
|
|||
|
|
tests on platforms with this (eg old NetBSD).
|
|||
|
|
|
|||
|
|
commit a1febadf426536612c2734168d409147c392e7cf
|
|||
|
|
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
|||
|
|
Date: Sun Oct 30 18:42:07 2022 +0000
|
|||
|
|
|
|||
|
|
upstream: Use variable for diff options
|
|||
|
|
|
|||
|
|
instead of unconditionally specifying "-rN". This will make life easier
|
|||
|
|
in -portable where not all diff's understand -N.
|
|||
|
|
|
|||
|
|
OpenBSD-Regress-ID: 8b8a407115546be1c6d72d350b1e4f1f960d3cd3
|
|||
|
|
|
|||
|
|
commit f6d3ed9a8a9280cbb68d6a499850cfe810e92bd0
|
|||
|
|
Author: Darren Tucker <dtucker@dtucker.net>
|
|||
|
|
Date: Mon Oct 31 05:13:02 2022 +1100
|
|||
|
|
|
|||
|
|
OpenSSL dev branch is 302 not 320.
|
|||
|
|
|
|||
|
|
While there, also accept 301 which it shat it was previously.
|
|||
|
|
|
|||
|
|
commit 25c8a2bbcc10c493d27faea57c42a6bf13fa51f2
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Fri Oct 28 02:47:04 2022 +0000
|
|||
|
|
|
|||
|
|
upstream: put sshkey_check_rsa_length() back in sshkey.c to unbreak
|
|||
|
|
|
|||
|
|
OPENSSL=no builds
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: 99eec58abe382ecd14b14043b195ee1babb9cf6e
|
|||
|
|
|
|||
|
|
commit 1192588546c29ceec10775125f396555ea71850f
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Fri Oct 28 02:29:34 2022 +0000
|
|||
|
|
|
|||
|
|
upstream: allow ssh-keyscan(1) to accept CIDR address ranges, e.g.
|
|||
|
|
|
|||
|
|
ssh-keyscan 192.168.0.0/24
|
|||
|
|
|
|||
|
|
If a CIDR range is passed, then it will be expanded to all possible
|
|||
|
|
addresses in the range including the all-0s and all-1s addresses.
|
|||
|
|
|
|||
|
|
bz#976 feedback/ok markus@
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: ce6c5211f936ac0053fd4a2ddb415277931e6c4b
|
|||
|
|
|
|||
|
|
commit 64af4209309461c79c39eda2d13f9d77816c6398
|
|||
|
|
Author: Damien Miller <djm@mindrot.org>
|
|||
|
|
Date: Fri Oct 28 12:54:35 2022 +1100
|
|||
|
|
|
|||
|
|
fix merge botch
|
|||
|
|
|
|||
|
|
commit 27267642699342412964aa785b98afd69d952c88
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Fri Oct 28 00:44:44 2022 +0000
|
|||
|
|
|
|||
|
|
upstream: refactor sshkey_private_deserialize
|
|||
|
|
|
|||
|
|
feedback/ok markus@
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: f5ca6932fdaf840a5e8250becb38315a29b5fc9f
|
|||
|
|
|
|||
|
|
commit 2519a7077a9332f70935e5242ba91ee670ed6b87
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Fri Oct 28 00:44:17 2022 +0000
|
|||
|
|
|
|||
|
|
upstream: refactor sshkey_private_serialize_opt()
|
|||
|
|
|
|||
|
|
feedback/ok markus@
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: 61e0fe989897901294efe7c3b6d670cefaf44cbd
|
|||
|
|
|
|||
|
|
commit 11a768adf98371fe4e43f3b06014024c033385d5
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Fri Oct 28 00:43:30 2022 +0000
|
|||
|
|
|
|||
|
|
upstream: refactor certify
|
|||
|
|
|
|||
|
|
feedback/ok markus@
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: 35d742992e223eaca3537e6fb3d3002c08eed4f6
|
|||
|
|
|
|||
|
|
commit 3fbc58bb249d967cc43ebdc554f6781bb73d4a58
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Fri Oct 28 00:43:08 2022 +0000
|
|||
|
|
|
|||
|
|
upstream: refactor sshkey_sign() and sshkey_verify()
|
|||
|
|
|
|||
|
|
feedback/ok markus@
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: 368e662c128c99d05cc043b1308d2b6c71a4d3cc
|
|||
|
|
|
|||
|
|
commit a1deb6cdbbe6afaab74ecb08fcb62db5739267be
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Fri Oct 28 00:41:52 2022 +0000
|
|||
|
|
|
|||
|
|
upstream: refactor sshkey_from_blob_internal()
|
|||
|
|
|
|||
|
|
feedback/ok markus@
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: 1f46c0cbb8060ee9666a02749594ad6658c8e283
|
|||
|
|
|
|||
|
|
commit 7d00799c935271ce89300494c5677190779f6453
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Fri Oct 28 00:41:17 2022 +0000
|
|||
|
|
|
|||
|
|
upstream: refactor sshkey_from_private()
|
|||
|
|
|
|||
|
|
feedback/ok markus@
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: e5dbe7a3545930c50f70ee75c867a1e08b382b53
|
|||
|
|
|
|||
|
|
commit 262647c2e920492ca57f1b9320d74f4a0f6e482b
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Fri Oct 28 00:39:29 2022 +0000
|
|||
|
|
|
|||
|
|
upstream: factor out key generation
|
|||
|
|
|
|||
|
|
feedback/ok markus@
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: 5b4211bff4de8d9adb84bc72857a8c42c44e7ceb
|
|||
|
|
|
|||
|
|
commit 401c74e7dc15eab60540653d2f94d9306a927bab
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Fri Oct 28 00:38:58 2022 +0000
|
|||
|
|
|
|||
|
|
upstream: refactor and simplify sshkey_read()
|
|||
|
|
|
|||
|
|
feedback/ok markus@
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: 0d93b7a56e31cd06a8bb0d2191d084ce254b0971
|
|||
|
|
|
|||
|
|
commit 591fed94e66a016acf87f4b7cd416ce812f2abe8
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Fri Oct 28 00:37:24 2022 +0000
|
|||
|
|
|
|||
|
|
upstream: factor out public key serialization
|
|||
|
|
|
|||
|
|
feedback/ok markus@
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: a3570c4b97290c5662890aea7328d87f55939033
|
|||
|
|
|
|||
|
|
commit 1e78844ae2b2dc01ba735d5ae740904c57e13685
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Fri Oct 28 00:36:31 2022 +0000
|
|||
|
|
|
|||
|
|
upstream: factor out sshkey_equal_public()
|
|||
|
|
|
|||
|
|
feedback/ok markus@
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: 1368ba114cb37732fe6ec3d89c7e6d27ea6fdc94
|
|||
|
|
|
|||
|
|
commit 25de1c01a8b9a2c8ab9b1da22444a03e89c982de
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Fri Oct 28 00:35:40 2022 +0000
|
|||
|
|
|
|||
|
|
upstream: begin big refactor of sshkey
|
|||
|
|
|
|||
|
|
Move keytype data and some of the type-specific code (allocation,
|
|||
|
|
cleanup, etc) out into each key type's implementation. Subsequent
|
|||
|
|
commits will move more, with the goal of having each key-*.c file
|
|||
|
|
owning as much of its keytype's implementation as possible.
|
|||
|
|
|
|||
|
|
lots of feedback + ok markus@
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: 0f2b4334f73914344e9e5b3d33522d41762a57ec
|
|||
|
|
|
|||
|
|
commit 445363433ba20b8a3e655b113858c836da46a1cb
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Mon Oct 24 22:43:36 2022 +0000
|
|||
|
|
|
|||
|
|
upstream: Be more paranoid with host/domain names coming from the
|
|||
|
|
|
|||
|
|
never write a name with bad characters to a known_hosts file.
|
|||
|
|
|
|||
|
|
reported by David Leadbeater, ok deraadt@
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: ba9b25fa8b5490b49398471e0c9657b0cbc7a5ad
|
|||
|
|
|
|||
|
|
commit 7190154de2c9fe135f0cc1ad349cb2fa45152b89
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Mon Oct 24 21:52:50 2022 +0000
|
|||
|
|
|
|||
|
|
upstream: regress test for unmatched glob characters; fails before
|
|||
|
|
|
|||
|
|
previous commit but passes now. bz3488; prodded by dtucker@
|
|||
|
|
|
|||
|
|
OpenBSD-Regress-ID: 0cc5cc9ea4a6fd170dc61b9212f15badaafb3bbd
|
|||
|
|
|
|||
|
|
commit a4821a592456c3add3cd325db433110cdaaa3e5c
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Mon Oct 24 21:51:55 2022 +0000
|
|||
|
|
|
|||
|
|
upstream: when scp(1) is using the SFTP protocol for transport (the
|
|||
|
|
|
|||
|
|
default), better match scp/rcp's handling of globs that don't match the
|
|||
|
|
globbed characters but do match literally (e.g. trying to transfer
|
|||
|
|
"foo.[1]").
|
|||
|
|
|
|||
|
|
Previously scp(1) in SFTP mode would not match these pathnames but
|
|||
|
|
legacy scp/rcp mode would.
|
|||
|
|
|
|||
|
|
Reported by Michael Yagliyan in bz3488; ok dtucker@
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: d8a3773f53015ba811fddba7473769a2fd343e11
|
|||
|
|
|
|||
|
|
commit 18376847b8043ba967eabbe23692ef74c9a3fddc
|
|||
|
|
Author: jsg@openbsd.org <jsg@openbsd.org>
|
|||
|
|
Date: Thu Oct 13 09:09:28 2022 +0000
|
|||
|
|
|
|||
|
|
upstream: use correct type with sizeof ok djm@
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: d6c882c2e8a42ff831a5b3cbc2c961ecb2dd6143
|
|||
|
|
|
|||
|
|
commit 4a4883664d6b4e9e4e459a8cdc16bd8d4b735de9
|
|||
|
|
Author: jmc@openbsd.org <jmc@openbsd.org>
|
|||
|
|
Date: Fri Oct 7 06:00:58 2022 +0000
|
|||
|
|
|
|||
|
|
upstream: ssh-agent.1: - use Nm not Xr for self-ref - while here,
|
|||
|
|
|
|||
|
|
wrap a long line
|
|||
|
|
|
|||
|
|
ssh-agent.c:
|
|||
|
|
- add -O to usage()
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: 855dac4695cef22e96d69c53436496bc408ca389
|
|||
|
|
|
|||
|
|
commit 9fd2441113fce2a83fc7470968c3b27809cc7f10
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Fri Oct 7 04:06:26 2022 +0000
|
|||
|
|
|
|||
|
|
upstream: document "-O no-restrict-websafe"; spotted by Ross L
|
|||
|
|
|
|||
|
|
Richardson
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: fe9eaa50237693a14ebe5b5614bf32a02145fe8b
|
|||
|
|
|
|||
|
|
commit 614252b05d70f798a0929b1cd3d213030ad4d007
|
|||
|
|
Author: Darren Tucker <dtucker@dtucker.net>
|
|||
|
|
Date: Tue Oct 18 06:29:16 2022 +1100
|
|||
|
|
|
|||
|
|
OpenSSL dev branch now identifies as 3.2.0.
|
|||
|
|
|
|||
|
|
commit 195e5a65fd793a738ea8451ebfdd1919db5aff3e
|
|||
|
|
Author: Damien Miller <djm@mindrot.org>
|
|||
|
|
Date: Mon Oct 17 09:41:47 2022 +1100
|
|||
|
|
|
|||
|
|
revert c64b62338b4 and guard POLL* defines instead
|
|||
|
|
|
|||
|
|
c64b62338b4 broke OSX builds, which do have poll.h but lack ppoll(2)
|
|||
|
|
Spotted by dtucker
|
|||
|
|
|
|||
|
|
commit bc2e480d99613bd59720edae244d1764636544c4
|
|||
|
|
Author: Damien Miller <djm@mindrot.org>
|
|||
|
|
Date: Fri Oct 14 14:52:22 2022 +1100
|
|||
|
|
|
|||
|
|
undef _get{short,long} before redefining
|
|||
|
|
|
|||
|
|
commit 5eb796a369c64f18d55a6ae9b1fa9b35eea237fb
|
|||
|
|
Author: Harmen Stoppels <harmenstoppels@gmail.com>
|
|||
|
|
Date: Thu Oct 13 16:08:46 2022 +0200
|
|||
|
|
|
|||
|
|
Fix snprintf configure test for clang 15
|
|||
|
|
|
|||
|
|
Clang 15 -Wimplicit-int defaults to an error in C99 mode and above.
|
|||
|
|
A handful of tests have "main(..." and not "int main(..." which caused
|
|||
|
|
the tests to produce incorrect results.
|
|||
|
|
|
|||
|
|
commit c64b62338b46ffa08839f05f21ad69fa6234dc17
|
|||
|
|
Author: Damien Miller <djm@mindrot.org>
|
|||
|
|
Date: Mon Oct 10 12:32:43 2022 +1100
|
|||
|
|
|
|||
|
|
skip bsd-poll.h if poll.h found; ok dtucker
|
|||
|
|
|
|||
|
|
commit 5ee2b8ccfcf4b606f450eb0ff2305e311f68b0be
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Thu Oct 6 22:42:37 2022 +0000
|
|||
|
|
|
|||
|
|
upstream: honour user's umask if it is more restrictive then the ssh
|
|||
|
|
|
|||
|
|
default (022); based on patch from Alex Henrie, ok dtucker@ deraadt@
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: fe1b9e15fc9a4f49fc338e848ce14d8727abe82d
|
|||
|
|
|
|||
|
|
commit a75cffc2700cebd3e2dd9093f7f7388d2be95cb7
|
|||
|
|
Author: Darren Tucker <dtucker@dtucker.net>
|
|||
|
|
Date: Fri Oct 7 03:54:56 2022 +1100
|
|||
|
|
|
|||
|
|
Add LibreSSL 3.6.0 to test suite.
|
|||
|
|
|
|||
|
|
While there, bump OpenSSL to latest 1.1.1q release.
|
|||
|
|
|
|||
|
|
commit fcc0f0c0e96a30076683fea9a7c9eedc72931742
|
|||
|
|
Author: Darren Tucker <dtucker@dtucker.net>
|
|||
|
|
Date: Thu Oct 6 21:18:16 2022 +1100
|
|||
|
|
|
|||
|
|
Add 9.1 branch to CI status page.
|
|||
|
|
|
|||
|
|
commit ef211eee63821d894a8bf81f22bfba9f6899d0fe
|
|||
|
|
Author: Darren Tucker <dtucker@dtucker.net>
|
|||
|
|
Date: Tue Oct 4 23:20:23 2022 +1100
|
|||
|
|
|
|||
|
|
Test commits to all branches of portable.
|
|||
|
|
|
|||
|
|
Only test OpenBSD upstream on commits to master since that's what it
|
|||
|
|
tracks.
|
|||
|
|
|
|||
|
|
commit fe646de03cafb6593ff4e4954bca9ec4b4b753a8
|
|||
|
|
Author: Damien Miller <djm@mindrot.org>
|
|||
|
|
Date: Wed Oct 5 03:47:26 2022 +1100
|
|||
|
|
|
|||
|
|
whitespace at EOL
|
|||
|
|
|
|||
|
|
commit a6e1852d10c63a830196e82168dadd957aaf28ec
|
|||
|
|
Author: Damien Miller <djm@mindrot.org>
|
|||
|
|
Date: Wed Oct 5 03:40:01 2022 +1100
|
|||
|
|
|
|||
|
|
mention libfido2 autodetection
|
|||
|
|
|
|||
|
|
commit 7360c2c206f33d309edbaf64036c96fadf74d640
|
|||
|
|
Author: Damien Miller <djm@mindrot.org>
|
|||
|
|
Date: Wed Oct 5 03:37:36 2022 +1100
|
|||
|
|
|
|||
|
|
remove mention of --with-security-key-builtin
|
|||
|
|
|
|||
|
|
it is enabled by default when libfido2 is installed
|
|||
|
|
|
|||
|
|
commit 0ffb46f2ee2ffcc4daf45ee679e484da8fcf338c
|
|||
|
|
Author: Damien Miller <djm@mindrot.org>
|
|||
|
|
Date: Tue Oct 4 01:51:42 2022 +1100
|
|||
|
|
|
|||
|
|
update .depend
|
|||
|
|
|
|||
|
|
commit 657e676ff696c7bb787bffb0e249ea1be3b474e1
|
|||
|
|
Author: Damien Miller <djm@mindrot.org>
|
|||
|
|
Date: Tue Oct 4 01:45:52 2022 +1100
|
|||
|
|
|
|||
|
|
update release notes URL
|
|||
|
|
|
|||
|
|
commit f059da2b29840c0f048448809c317ce2ae014da7
|
|||
|
|
Author: Damien Miller <djm@mindrot.org>
|
|||
|
|
Date: Tue Oct 4 01:45:41 2022 +1100
|
|||
|
|
|
|||
|
|
crank versions in RPM spec files
|
|||
|
|
|
|||
|
|
commit b51f3f172d87cbdb80ca4eb7b2149e56a7647557
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Mon Sep 26 22:18:40 2022 +0000
|
|||
|
|
|
|||
|
|
upstream: openssh-9.1
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: 5a467b2ee81da01a86adf1ad93b62b1728494e56
|
|||
|
|
|
|||
|
|
commit 4cf8d0c0f3030f594a238bab21a0695735515487
|
|||
|
|
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
|||
|
|
Date: Wed Sep 21 22:26:50 2022 +0000
|
|||
|
|
|
|||
|
|
upstream: Fix typo. From AlexanderStohr via github PR#343.
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: a134c9b4039e48803fc6a87f955b0f4a03181497
|
|||
|
|
|
|||
|
|
commit 8179fed3264d5919899900ed8881d5f9bb57ca33
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Mon Sep 19 21:39:16 2022 +0000
|
|||
|
|
|
|||
|
|
upstream: add RequiredRSASize to the list of keywords accepted by
|
|||
|
|
|
|||
|
|
-o; spotted by jmc@
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: fe871408cf6f9d3699afeda876f8adbac86a035e
|
|||
|
|
|
|||
|
|
commit 5f954929e9f173dd1e279e07d0e8b14fa845814d
|
|||
|
|
Author: Damien Miller <djm@mindrot.org>
|
|||
|
|
Date: Mon Sep 19 20:59:34 2022 +1000
|
|||
|
|
|
|||
|
|
no need for glob.h here
|
|||
|
|
|
|||
|
|
it also causes portability problems
|
|||
|
|
|
|||
|
|
commit 03d94a47207d58b3db37eba4f87eb6ae5a63168a
|
|||
|
|
Author: Damien Miller <djm@mindrot.org>
|
|||
|
|
Date: Mon Sep 19 20:59:04 2022 +1000
|
|||
|
|
|
|||
|
|
avoid Wuninitialized false positive in gcc-12ish
|
|||
|
|
|
|||
|
|
commit 9d952529113831fb3071ab6e408d2726fd72e771
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Mon Sep 19 10:46:00 2022 +0000
|
|||
|
|
|
|||
|
|
upstream: use users-groups-by-id@openssh.com sftp-server extension
|
|||
|
|
|
|||
|
|
(when available) to fill in user/group names for directory listings.
|
|||
|
|
Implement a client-side cache of see uid/gid=>user/group names. ok markus@
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: f239aeeadfa925a37ceee36ee8b256b8ccf4466e
|
|||
|
|
|
|||
|
|
commit 8ff680368b0bccf88ae85d4c99de69387fbad7a6
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Mon Sep 19 10:43:12 2022 +0000
|
|||
|
|
|
|||
|
|
upstream: sftp client library support for
|
|||
|
|
|
|||
|
|
users-groups-by-id@openssh.com; ok markus@
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: ddb2f33a2da6349a9a89a8b5bcb9ca7c999394de
|
|||
|
|
|
|||
|
|
commit 488f6e1c582212c2374a4bf8cd1b703d2e70fb8b
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Mon Sep 19 10:41:58 2022 +0000
|
|||
|
|
|
|||
|
|
upstream: extend sftp-common.c:extend ls_file() to support supplied
|
|||
|
|
|
|||
|
|
user/group names; ok markus@
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: c70c70498b1fdcf158531117e405b6245863bfb0
|
|||
|
|
|
|||
|
|
commit 74b77f7497dba3a58315c8f308883de448078057
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Mon Sep 19 10:40:52 2022 +0000
|
|||
|
|
|
|||
|
|
upstream: sftp-server(8): add a "users-groups-by-id@openssh.com"
|
|||
|
|
|
|||
|
|
extension request that allows the client to obtain user/group names that
|
|||
|
|
correspond to a set of uids/gids.
|
|||
|
|
|
|||
|
|
Will be used to make directory listings more useful and consistent
|
|||
|
|
in sftp(1).
|
|||
|
|
|
|||
|
|
ok markus@
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: 7ebabde0bcb95ef949c4840fe89e697e30df47d3
|
|||
|
|
|
|||
|
|
commit 231a346c0c67cc7ca098360f9a554fa7d4f1eddb
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Mon Sep 19 08:49:50 2022 +0000
|
|||
|
|
|
|||
|
|
upstream: better debugging for connect_next()
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: d16a307a0711499c971807f324484ed3a6036640
|
|||
|
|
|
|||
|
|
commit 1875042c52a3b950ae5963c9ca3774a4cc7f0380
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Sat Sep 17 10:34:29 2022 +0000
|
|||
|
|
|
|||
|
|
upstream: Add RequiredRSASize for sshd(8); RSA keys that fall
|
|||
|
|
|
|||
|
|
beneath this limit will be ignored for user and host-based authentication.
|
|||
|
|
|
|||
|
|
Feedback deraadt@ ok markus@
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: 187931dfc19d51873df5930a04f2d972adf1f7f1
|
|||
|
|
|
|||
|
|
commit 54b333d12e55e6560b328c737d514ff3511f1afd
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Sat Sep 17 10:33:18 2022 +0000
|
|||
|
|
|
|||
|
|
upstream: add a RequiredRSASize for checking RSA key length in
|
|||
|
|
|
|||
|
|
ssh(1). User authentication keys that fall beneath this limit will be
|
|||
|
|
ignored. If a host presents a host key beneath this limit then the connection
|
|||
|
|
will be terminated (unfortunately there are no fallbacks in the protocol for
|
|||
|
|
host authentication).
|
|||
|
|
|
|||
|
|
feedback deraadt, Dmitry Belyavskiy; ok markus@
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: 430e339b2a79fa9ecc63f2837b06fdd88a7da13a
|
|||
|
|
|
|||
|
|
commit 07d8771bacfefbcfb37fa8a6dc6103bcc097e0ab
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Sat Sep 17 10:30:45 2022 +0000
|
|||
|
|
|
|||
|
|
upstream: Add a sshkey_check_rsa_length() call for checking the
|
|||
|
|
|
|||
|
|
length of an RSA key; ok markus@
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: de77cd5b11594297eda82edc594b0d32b8535134
|
|||
|
|
|
|||
|
|
commit 3991a0cf947cf3ae0f0373bcec5a90e86a7152f5
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Sat Sep 17 10:11:29 2022 +0000
|
|||
|
|
|
|||
|
|
upstream: actually hook up restrict_websafe; the command-line flag
|
|||
|
|
|
|||
|
|
was never actually used. Spotted by Matthew Garrett
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: 0b363518ac4c2819dbaa3dfad4028633ab9cdff1
|
|||
|
|
|
|||
|
|
commit 30b2a7e4291fb9e357f80a237931ff008d686d3b
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Fri Sep 16 06:55:37 2022 +0000
|
|||
|
|
|
|||
|
|
upstream: correct error value
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: 780efcbad76281f11f14b2a5ff04eb6db3dfdad4
|
|||
|
|
|
|||
|
|
commit ac1ec9545947d9f9657259f55d04cb49d3a94c8a
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Fri Sep 16 03:33:14 2022 +0000
|
|||
|
|
|
|||
|
|
upstream: sftp: Be a bit more clever about completions
|
|||
|
|
|
|||
|
|
There are commands (e.g. "get" or "put") that accept two
|
|||
|
|
arguments, a local path and a remote path. However, the way
|
|||
|
|
current completion is written doesn't take this distinction into
|
|||
|
|
account and always completes remote or local paths.
|
|||
|
|
|
|||
|
|
By expanding CMD struct and "cmds" array this distinction can be
|
|||
|
|
reflected and with small adjustment to completer code the correct
|
|||
|
|
path can be completed.
|
|||
|
|
|
|||
|
|
By Michal Privoznik, ok dtucker@
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: 1396d921c4eb1befd531f5c4a8ab47e7a74b610b
|
|||
|
|
|
|||
|
|
commit 590db83384f9d99fc51c84505792d26d1ef60df9
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Fri Sep 16 03:13:34 2022 +0000
|
|||
|
|
|
|||
|
|
upstream: sftp: Don't attempt to complete arguments for
|
|||
|
|
|
|||
|
|
non-existent commands
|
|||
|
|
|
|||
|
|
If user entered a non-existent command (e.g. because they made a
|
|||
|
|
typo) there is no point in trying to complete its arguments. Skip
|
|||
|
|
calling complete_match() if that's the case.
|
|||
|
|
|
|||
|
|
From Michal Privoznik
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: cf39c811a68cde2aeb98fc85addea4000ef6b07a
|
|||
|
|
|
|||
|
|
commit ff9809fdfd1d9a91067bb14a77d176002edb153c
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Wed Sep 14 00:14:37 2022 +0000
|
|||
|
|
|
|||
|
|
upstream: sk_enroll: never drop SSH_SK_USER_VERIFICATION_REQD flag
|
|||
|
|
|
|||
|
|
from response
|
|||
|
|
|
|||
|
|
Now that all FIDO signing calls attempt first without PIN and then
|
|||
|
|
fall back to trying PIN only if that attempt fails, we can remove the
|
|||
|
|
hack^wtrick that removed the UV flag from the keys returned during
|
|||
|
|
enroll.
|
|||
|
|
|
|||
|
|
By Corinna Vinschen
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: 684517608c8491503bf80cd175425f0178d91d7f
|
|||
|
|
|
|||
|
|
commit 940dc10729cb5a95b7ee82c10184e2b9621c8a1d
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Wed Sep 14 00:13:13 2022 +0000
|
|||
|
|
|
|||
|
|
upstream: a little extra debugging
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: edf1601c1d0905f6da4c713f4d9cecc7d1c0295a
|
|||
|
|
|
|||
|
|
commit 4b5f91cb959358141181b934156513fcb8a6c1e3
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Wed Sep 14 00:02:03 2022 +0000
|
|||
|
|
|
|||
|
|
upstream: ssh-agent: attempt FIDO key signing without PIN and use
|
|||
|
|
|
|||
|
|
the error to determine whether a PIN is required and prompt only if
|
|||
|
|
necessary. from Corinna Vinschen
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: dd6be6a0b7148608e834ee737c3479b3270b00dd
|
|||
|
|
|
|||
|
|
commit 113523bf0bc33600b07ebb083572c8c346b6fdf4
|
|||
|
|
Author: jmc@openbsd.org <jmc@openbsd.org>
|
|||
|
|
Date: Sun Sep 11 06:38:11 2022 +0000
|
|||
|
|
|
|||
|
|
upstream: .Li -> .Vt where appropriate; from josiah frentsos,
|
|||
|
|
|
|||
|
|
tweaked by schwarze
|
|||
|
|
|
|||
|
|
ok schwarze
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: 565046e3ce68b46c2f440a93d67c2a92726de8ed
|
|||
|
|
|
|||
|
|
commit 86af013b56cecb5ee58ae0bd9d495cd586fc5918
|
|||
|
|
Author: jsg@openbsd.org <jsg@openbsd.org>
|
|||
|
|
Date: Sat Sep 10 08:50:53 2022 +0000
|
|||
|
|
|
|||
|
|
upstream: fix repeated words ok miod@ jmc@
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: 6765daefe26a6b648cc15cadbbe337596af709b7
|
|||
|
|
|
|||
|
|
commit 0ba39b93b326a7d5dfab776cc9b9d326161a9b16
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Fri Sep 9 03:31:42 2022 +0000
|
|||
|
|
|
|||
|
|
upstream: notifier_complete(NULL, ...) is a noop, so no need to test
|
|||
|
|
|
|||
|
|
that ctx!=NULL; from Corinna Vinschen
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: ade2f2e9cc519d01a586800c25621d910bce384a
|
|||
|
|
|
|||
|
|
commit be197635329feb839865fdc738e34e24afd1fca8
|
|||
|
|
Author: Sam James <sam@gentoo.org>
|
|||
|
|
Date: Thu Sep 8 02:49:29 2022 +0100
|
|||
|
|
|
|||
|
|
openbsd-compat/bsd-asprintf: add <stdio.h> include for vsnprintf
|
|||
|
|
|
|||
|
|
Fixes the following build failure with Clang 15 on musl:
|
|||
|
|
```
|
|||
|
|
bsd-asprintf.c:51:8: error: call to undeclared library function 'vsnprintf' with type 'int (char *, unsigned long, const char *, struct __va_list_tag *)'; ISO C99 and laterclang -O2 -pipe -fdiagnostics-color=always -frecord-gcc-switches -pipe -Wunknown-warning-option -Qunused-arguments -Wall -Wpointer-arith -Wuninitialized -Wsign-compare -Wformat-security -Wsizeof-pointer-memaccess -Wno-pointer-sign -Wno-unused-result -Wmisleading-indentation -Wbitwise-instead-of-logical -fno-strict-aliasing -mretpoline -ftrapv -fzero-call-used-regs=all -fno-builtin-memset -fstack-protector-strong -fPIE -I. -I. -D_XOPEN_SOURCE=600 -D_BSD_SOURCE -D_DEFAULT_SOURCE -DSSHDIR=\"/etc/ssh\" -D_PATH_SSH_PROGRAM=\"/usr/bin/ssh\" -D_PATH_SSH_ASKPASS_DEFAULT=\"/usr/lib/misc/ssh-askpass\" -D_PATH_SFTP_SERVER=\"/usr/lib/misc/sftp-server\" -D_PATH_SSH_KEY_SIGN=\"/usr/lib/misc/ssh-keysign\" -D_PATH_SSH_PKCS11_HELPER=\"/usr/lib/misc/ssh-pkcs11-helper\" -D_PATH_SSH_SK_HELPER=\"/usr/lib/misc/ssh-sk-helper\" -D_PATH_SSH_PIDDIR=\"/run\" -D_PATH_PRIVSEP_CHROOT_DIR=\"/var/empty\" -DHAVE_CONFIG_H -c cipher-aes.c -o cipher-aes.o
|
|||
|
|
do not support
|
|||
|
|
implicit function declarations [-Wimplicit-function-declaration]
|
|||
|
|
ret = vsnprintf(string, INIT_SZ, fmt, ap2);
|
|||
|
|
^
|
|||
|
|
bsd-asprintf.c:51:8: note: include the header <stdio.h> or explicitly provide a declaration for 'vsnprintf'
|
|||
|
|
1 error generated.
|
|||
|
|
```
|
|||
|
|
|
|||
|
|
commit 6cb6f660bb35f77a0456dd2581ddf39c29398a5e
|
|||
|
|
Author: Darren Tucker <dtucker@dtucker.net>
|
|||
|
|
Date: Fri Sep 2 16:43:27 2022 +1000
|
|||
|
|
|
|||
|
|
Remove DEF_WEAK, it's already in defines.h.
|
|||
|
|
|
|||
|
|
commit ce39e7d8b70c4726defde5d3bc4cb7d40d131153
|
|||
|
|
Author: Darren Tucker <dtucker@dtucker.net>
|
|||
|
|
Date: Fri Sep 2 14:28:14 2022 +1000
|
|||
|
|
|
|||
|
|
Resync arc4random with OpenBSD.
|
|||
|
|
|
|||
|
|
This brings us up to current, including djm's random-reseeding change,
|
|||
|
|
as prompted by logan at cyberstorm.mu in bz#3467. It brings the
|
|||
|
|
platform-specific hooks from LibreSSL Portable, simplified to match our
|
|||
|
|
use case. ok djm@.
|
|||
|
|
|
|||
|
|
commit beaddde26f30e2195b8aa4f3193970e140e17305
|
|||
|
|
Author: Darren Tucker <dtucker@dtucker.net>
|
|||
|
|
Date: Fri Sep 2 14:20:04 2022 +1000
|
|||
|
|
|
|||
|
|
Move OPENBSD ORIGINAL marker.
|
|||
|
|
|
|||
|
|
Putting this after the copyright statement (which doesn't change)
|
|||
|
|
instead of before the version identifier (which does) prevents merge
|
|||
|
|
conflicts when resyncing changes.
|
|||
|
|
|
|||
|
|
commit c83e467ead67a8cb48ef4bec8085d6fb880a2ff4
|
|||
|
|
Author: Darren Tucker <dtucker@dtucker.net>
|
|||
|
|
Date: Fri Sep 2 14:17:28 2022 +1000
|
|||
|
|
|
|||
|
|
Remove arc4random_uniform from arc4random.c
|
|||
|
|
|
|||
|
|
This was previously moved into its own file (matching OpenBSD) which
|
|||
|
|
prematurely committed in commit 73541f2.
|
|||
|
|
|
|||
|
|
commit 5f45c2395c60865e59fa44152ff1d003a128c5bc
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Fri Sep 2 04:20:02 2022 +0000
|
|||
|
|
|
|||
|
|
upstream: sk-usbhid: fix key_lookup() on tokens with built-in UV
|
|||
|
|
|
|||
|
|
explicitly test whether the token performs built-in UV (e.g. biometric
|
|||
|
|
tokens) and enable UV in that case. From Pedro Martelletto via GHPR#388
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: 007eb7e387d27cf3029ab06b88224e03eca62ccd
|
|||
|
|
|
|||
|
|
commit 03277a4aa49b80af541a3e691f264c0c0d8f9cec
|
|||
|
|
Author: Darren Tucker <dtucker@dtucker.net>
|
|||
|
|
Date: Wed Aug 31 20:26:30 2022 +1000
|
|||
|
|
|
|||
|
|
Move sftp from valgrind-2 to 3 to rebalance.
|
|||
|
|
|
|||
|
|
commit fcf5365da69c516817321ba89c3a91df98d098df
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Wed Aug 31 02:56:40 2022 +0000
|
|||
|
|
|
|||
|
|
upstream: whitespace
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: c2bcbf93610d3d62ed206cdf9bf9ff98c6aaf232
|
|||
|
|
|
|||
|
|
commit e60136a3d7a223dd8e84ba8a6895bc3142360993
|
|||
|
|
Author: Damien Miller <djm@mindrot.org>
|
|||
|
|
Date: Mon Aug 29 13:27:45 2022 +1000
|
|||
|
|
|
|||
|
|
additional keys
|
|||
|
|
|
|||
|
|
commit 2b02dcb505288c462d1b5dd1ac04e603d01340eb
|
|||
|
|
Author: Damien Miller <djm@mindrot.org>
|
|||
|
|
Date: Mon Aug 29 13:23:43 2022 +1000
|
|||
|
|
|
|||
|
|
cross-sign allowed_signers with PGP key
|
|||
|
|
|
|||
|
|
Provides continuity of trust from legacy PGP release key to
|
|||
|
|
the SSHSIG signing keys that we will use henceforth for git
|
|||
|
|
signing.
|
|||
|
|
|
|||
|
|
commit 51b345f177ae981b8755f6bdf8358b1cc5e83d67
|
|||
|
|
Author: Darren Tucker <dtucker@dtucker.net>
|
|||
|
|
Date: Sat Aug 27 21:49:27 2022 +1000
|
|||
|
|
|
|||
|
|
Add libcrypt-devel to cygwin-release deps.
|
|||
|
|
|
|||
|
|
Based on feedback from vinschen at redhat.com.
|
|||
|
|
|
|||
|
|
commit 9f81736cf16dd8dda1c8942f1973a5f80b8cd78c
|
|||
|
|
Author: Darren Tucker <dtucker@dtucker.net>
|
|||
|
|
Date: Sat Aug 27 09:37:40 2022 +1000
|
|||
|
|
|
|||
|
|
Add Windows 2022 test targets.
|
|||
|
|
|
|||
|
|
commit 85e1a69243f12be8520438ad6a3cfdc0b7fcbb2d
|
|||
|
|
Author: Darren Tucker <dtucker@dtucker.net>
|
|||
|
|
Date: Fri Aug 26 16:26:06 2022 +1000
|
|||
|
|
|
|||
|
|
Add cygwin-release test target.
|
|||
|
|
|
|||
|
|
This also moves the cygwin package install from the workflow file to
|
|||
|
|
setup_ci.sh so that we can install different sets of Cygwin packages
|
|||
|
|
for different test configs.
|
|||
|
|
|
|||
|
|
commit 92382dbe8bf9ea1225b16858f9b9b208c15c7e8d
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Fri Aug 26 08:16:27 2022 +0000
|
|||
|
|
|
|||
|
|
upstream: whitespace
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: a5d015efbfd228dc598ffdef612d2da3a579e5d8
|
|||
|
|
|
|||
|
|
commit 70a5de0a50e84d7250eb4e4537f765599f64c4af
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Fri Aug 26 08:12:56 2022 +0000
|
|||
|
|
|
|||
|
|
upstream: whitespace
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: d297e4387935d4aef091c5e9432578c2e513f538
|
|||
|
|
|
|||
|
|
commit 3a683a19fd116ea15ebf8aa13d02646cceb302a9
|
|||
|
|
Author: Damien Miller <djm@mindrot.org>
|
|||
|
|
Date: Fri Aug 26 14:23:55 2022 +1000
|
|||
|
|
|
|||
|
|
initial list of allowed signers
|
|||
|
|
|
|||
|
|
commit 6851f4b8c3fc1b3e1114c56106e4dc31369c8513
|
|||
|
|
Author: Darren Tucker <dtucker@dtucker.net>
|
|||
|
|
Date: Fri Aug 19 17:22:18 2022 +1000
|
|||
|
|
|
|||
|
|
Install Cygwin packages based on OS not config.
|
|||
|
|
|
|||
|
|
commit f96480906893ed93665df8cdf9065865c51c1475
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Fri Aug 19 06:07:47 2022 +0000
|
|||
|
|
|
|||
|
|
upstream: attemp FIDO key signing without PIN and use the error
|
|||
|
|
|
|||
|
|
code returned to fall back only if necessary. Avoids PIN prompts for FIDO
|
|||
|
|
tokens that don't require them; part of GHPR#302
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: 4f752aaf9f2e7c28bcaaf3d4f8fc290131bd038e
|
|||
|
|
|
|||
|
|
commit 5453333b5d28e313284cb9aae82899704103f98d
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Fri Aug 19 05:53:28 2022 +0000
|
|||
|
|
|
|||
|
|
upstream: remove incorrect check that can break enrolling a
|
|||
|
|
|
|||
|
|
resident key (introduced in r1.40)
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: 4cab364d518470e29e624af3d3f9ffa9c92b6f01
|
|||
|
|
|
|||
|
|
commit ff89b1bed80721295555bd083b173247a9c0484e
|
|||
|
|
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
|||
|
|
Date: Fri Aug 19 04:02:46 2022 +0000
|
|||
|
|
|
|||
|
|
upstream: Strictly enforce the maximum allowed SSH2 banner size in
|
|||
|
|
|
|||
|
|
ssh-keyscan and prevent a one-byte buffer overflow. Patch from Qualys, ok
|
|||
|
|
djm@
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: 6ae664f9f4db6e8a0589425f74cd0bbf3aeef4e4
|
|||
|
|
|
|||
|
|
commit 1b470b9036639cef4f32fb303bb35ea0b711178d
|
|||
|
|
Author: Darren Tucker <dtucker@dtucker.net>
|
|||
|
|
Date: Fri Aug 19 15:18:09 2022 +1000
|
|||
|
|
|
|||
|
|
Fix cygwin conditional steps.
|
|||
|
|
|
|||
|
|
commit fd6ee741ab16714b7035d60aca924123ba28135a
|
|||
|
|
Author: Darren Tucker <dtucker@dtucker.net>
|
|||
|
|
Date: Fri Aug 19 15:12:57 2022 +1000
|
|||
|
|
|
|||
|
|
Add a bit more debug output.
|
|||
|
|
|
|||
|
|
commit a9305c4c739f4d91a3d3a92c0b6d4949404a36c5
|
|||
|
|
Author: Darren Tucker <dtucker@dtucker.net>
|
|||
|
|
Date: Fri Aug 12 15:08:47 2022 +1000
|
|||
|
|
|
|||
|
|
Add Cygwin (on windows-2019) test target.
|
|||
|
|
|
|||
|
|
In addition to installing the requisite Cygwin packages, we also need to
|
|||
|
|
explicitly invoke "sh" for steps that run other scripts since the runner
|
|||
|
|
environment doesn't understand #! paths.
|
|||
|
|
|
|||
|
|
commit 5062ad48814b06162511c4f5924a33d97b6b2566
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Fri Aug 19 03:06:30 2022 +0000
|
|||
|
|
|
|||
|
|
upstream: double free() in error path; from Eusgor via GHPR333
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: 39f35e16ba878c8d02b4d01d8826d9b321be26d4
|
|||
|
|
|
|||
|
|
commit 5a5c580b48fc6006bdfa731fc2f6d4945c2c0e4e
|
|||
|
|
Author: Darren Tucker <dtucker@dtucker.net>
|
|||
|
|
Date: Thu Aug 18 21:36:39 2022 +1000
|
|||
|
|
|
|||
|
|
Check for perms to run agent-getpeereid test.
|
|||
|
|
|
|||
|
|
Ubuntu 22.04 defaults to private home dirs which prevents "nobody"
|
|||
|
|
running ssh-add during the agent-getpeereid test. Check for this and
|
|||
|
|
add the necessary permissions.
|
|||
|
|
|
|||
|
|
commit cd06a76b7ccc706e2bb4f1cc4aa9e9796a28a812
|
|||
|
|
Author: Damien Miller <djm@mindrot.org>
|
|||
|
|
Date: Wed Aug 17 16:04:16 2022 +1000
|
|||
|
|
|
|||
|
|
on Cygwin, prefer WinHello FIDO device
|
|||
|
|
|
|||
|
|
If no FIDO device was explictly specified, then prefer the
|
|||
|
|
windows://hello FIDO device. An exception to this is when
|
|||
|
|
probing resident FIDO keys, in which case hardware FIDO
|
|||
|
|
devices are preferred.
|
|||
|
|
|
|||
|
|
commit 47f72f534ac5cc2cd3027675a3df7b00a8f77575
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Wed Aug 17 06:01:57 2022 +0000
|
|||
|
|
|
|||
|
|
upstream: add an extra flag to sk_probe() to indicate whether we're
|
|||
|
|
|
|||
|
|
probing for a FIDO resident key or not. Unused here, but will make like
|
|||
|
|
easier for portable
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: 432c8ff70e270378df9dbceb9bdeaa5b43b5a832
|
|||
|
|
|
|||
|
|
commit edb0bcb3c79b16031dc87a8e57aecc3c4a3414f0
|
|||
|
|
Author: jmc@openbsd.org <jmc@openbsd.org>
|
|||
|
|
Date: Tue Aug 16 20:24:08 2022 +0000
|
|||
|
|
|
|||
|
|
upstream: use .Cm for "sign"; from josiah frentsos
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: 7f80a53d54857ac6ae49ea6ad93c5bd12231d1e4
|
|||
|
|
|
|||
|
|
commit cccb011e130cbbac538b1689d10e4a067298df8b
|
|||
|
|
Author: Corinna Vinschen <vinschen@redhat.com>
|
|||
|
|
Date: Thu Aug 11 20:19:35 2022 +0200
|
|||
|
|
|
|||
|
|
Revert "check_sk_options: add temporary WinHello workaround"
|
|||
|
|
|
|||
|
|
Cygwin now comes with libfido2 1.11.0, so this workaround
|
|||
|
|
isn't required anymore.
|
|||
|
|
|
|||
|
|
This reverts commit 242c044ab111a37aad3b0775727c36a4c5f0102c.
|
|||
|
|
|
|||
|
|
Signed-off-by: Corinna Vinschen <vinschen@redhat.com>
|
|||
|
|
|
|||
|
|
commit 9468cd7cf9d989dfa2ac20e2a0268ba6e93bfa5a
|
|||
|
|
Author: Corinna Vinschen <vinschen@redhat.com>
|
|||
|
|
Date: Thu Aug 11 20:18:17 2022 +0200
|
|||
|
|
|
|||
|
|
fido_dev_is_winhello: return 0, not "false"
|
|||
|
|
|
|||
|
|
"false" is not used anywhere in OpenSSH, so return 0 like
|
|||
|
|
everywhere else.
|
|||
|
|
|
|||
|
|
Signed-off-by: Corinna Vinschen <vinschen@redhat.com>
|
|||
|
|
|
|||
|
|
commit 730a80609472ee0451c99482d75c9c41f3ebc42d
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Fri Aug 12 05:20:28 2022 +0000
|
|||
|
|
|
|||
|
|
upstream: sftp-server: support home-directory request
|
|||
|
|
|
|||
|
|
Add support to the sftp-server for the home-directory extension defined
|
|||
|
|
in draft-ietf-secsh-filexfer-extensions-00. This overlaps a bit with the
|
|||
|
|
existing expand-path@openssh.com, but uses a more official protocol name,
|
|||
|
|
and so is a bit more likely to be implemented by non-OpenSSH clients.
|
|||
|
|
|
|||
|
|
From Mike Frysinger, ok dtucker@
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: bfc580d05cc0c817831ae7ecbac4a481c23566ab
|
|||
|
|
|
|||
|
|
commit 5e820bf79ce3ce99ef7e98b0ab642b0a0a4f396c
|
|||
|
|
Author: Darren Tucker <dtucker@dtucker.net>
|
|||
|
|
Date: Fri Aug 12 14:56:55 2022 +1000
|
|||
|
|
|
|||
|
|
Replace deprecated ubuntu-18.04 runners with 22.04
|
|||
|
|
|
|||
|
|
commit 87b0d9c1b789d3ff958ec45df2ac912e24461bae
|
|||
|
|
Author: Darren Tucker <dtucker@dtucker.net>
|
|||
|
|
Date: Thu Aug 11 22:48:23 2022 +1000
|
|||
|
|
|
|||
|
|
Add a timegm implementation from Heimdal via Samba.
|
|||
|
|
|
|||
|
|
Fixes build on (at least Solaris 10).
|
|||
|
|
|
|||
|
|
commit d0c4fa58594577994921b593f10037c5282597ca
|
|||
|
|
Author: Darren Tucker <dtucker@dtucker.net>
|
|||
|
|
Date: Thu Aug 11 14:23:58 2022 +1000
|
|||
|
|
|
|||
|
|
Rerun tests if any .github config file changes.
|
|||
|
|
|
|||
|
|
commit 113fe6c77ab43769fc61e953d07cb619fd7ea54b
|
|||
|
|
Author: Darren Tucker <dtucker@dtucker.net>
|
|||
|
|
Date: Thu Aug 11 13:33:51 2022 +1000
|
|||
|
|
|
|||
|
|
Skip hostbased during Valgrind tests.
|
|||
|
|
|
|||
|
|
Valgrind doesn't let ssh exec ssh-keysign (because it's setuid) so skip
|
|||
|
|
it during the Valgrind based tests.
|
|||
|
|
|
|||
|
|
See https://bugs.kde.org/show_bug.cgi?id=119404 for a discussion of this
|
|||
|
|
(ironically there the problematic binary was ssh(1) back when it could
|
|||
|
|
still be setuid).
|
|||
|
|
|
|||
|
|
commit b98a42afb69d60891eb0488935990df6ee571c4d
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Thu Aug 11 01:57:50 2022 +0000
|
|||
|
|
|
|||
|
|
upstream: add some tests for parse_absolute_time(), including cases
|
|||
|
|
|
|||
|
|
where it is forced to the UTC timezone. bz3468 ok dtucker
|
|||
|
|
|
|||
|
|
OpenBSD-Regress-ID: ea07ca31c2f3847a38df028ca632763ae44e8759
|
|||
|
|
|
|||
|
|
commit ec1ddb72a146fd66d18df9cd423517453a5d8044
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Thu Aug 11 01:56:51 2022 +0000
|
|||
|
|
|
|||
|
|
upstream: allow certificate validity intervals, sshsig verification
|
|||
|
|
|
|||
|
|
times and authorized_keys expiry-time options to accept dates in the UTC time
|
|||
|
|
zone in addition to the default of interpreting them in the system time zone.
|
|||
|
|
YYYYMMDD and YYMMDDHHMM[SS] dates/times will be interpreted as UTC if
|
|||
|
|
suffixed with a 'Z' character.
|
|||
|
|
|
|||
|
|
Also allow certificate validity intervals to be specified in raw
|
|||
|
|
seconds-since-epoch as hex value, e.g. -V 0x1234:0x4567890. This
|
|||
|
|
is intended for use by regress tests and other tools that call
|
|||
|
|
ssh-keygen as part of a CA workflow.
|
|||
|
|
|
|||
|
|
bz3468 ok dtucker
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: 454db1cdffa9fa346aea5211223a2ce0588dfe13
|
|||
|
|
|
|||
|
|
commit 4df246ec75751da7eb925e1880498300d8bda187
|
|||
|
|
Author: Darren Tucker <dtucker@dtucker.net>
|
|||
|
|
Date: Thu Aug 11 10:23:55 2022 +1000
|
|||
|
|
|
|||
|
|
Fix conditional for running hostbased tests.
|
|||
|
|
|
|||
|
|
commit 2580916e48721802220c61ce9e0df1297c00bc07
|
|||
|
|
Author: Damien Miller <djm@mindrot.org>
|
|||
|
|
Date: Thu Aug 11 08:58:28 2022 +1000
|
|||
|
|
|
|||
|
|
fix SANDBOX_SECCOMP_FILTER_DEBUG
|
|||
|
|
|
|||
|
|
commit fdbd5bf507fc271ff813714fab8a72ff2c6cb5ca
|
|||
|
|
Author: Darren Tucker <dtucker@dtucker.net>
|
|||
|
|
Date: Wed Aug 10 17:35:52 2022 +1000
|
|||
|
|
|
|||
|
|
Test hostbased auth on github runners.
|
|||
|
|
|
|||
|
|
commit 7e2f51940ba48a1c0fae1107801ea643fa83c971
|
|||
|
|
Author: Darren Tucker <dtucker@dtucker.net>
|
|||
|
|
Date: Wed Aug 10 17:25:24 2022 +1000
|
|||
|
|
|
|||
|
|
Rename our getentropy to prevent possible loops.
|
|||
|
|
|
|||
|
|
Since arc4random seeds from getentropy, and we use OpenSSL for that
|
|||
|
|
if enabled, there's the possibility that if we build on a system that
|
|||
|
|
does not have getentropy then run on a system that does have it, then
|
|||
|
|
OpenSSL could end up calling our getentropy and getting stuck in a loop.
|
|||
|
|
Pointed out by deraadt@, ok djm@
|
|||
|
|
|
|||
|
|
commit 7a01f61be8d0aca0e975e7417f26371495fe7674
|
|||
|
|
Author: Darren Tucker <dtucker@dtucker.net>
|
|||
|
|
Date: Mon Aug 8 12:17:04 2022 +1000
|
|||
|
|
|
|||
|
|
Actually put HAVE_STDINT_H around the stdint.h.
|
|||
|
|
|
|||
|
|
commit 73541f29f0b50480da6c20dceb7a7191bd8ea7d3
|
|||
|
|
Author: Darren Tucker <dtucker@dtucker.net>
|
|||
|
|
Date: Mon Aug 8 10:30:34 2022 +1000
|
|||
|
|
|
|||
|
|
Give unused param a name.
|
|||
|
|
|
|||
|
|
Fixes builds on platforms that do have fido2 but don't have
|
|||
|
|
fido_dev_is_winhello.
|
|||
|
|
|
|||
|
|
commit 2a108c0ea960381bd9b14ee0d84e818a23df4482
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Fri Aug 5 05:01:40 2022 +0000
|
|||
|
|
|
|||
|
|
upstream: don't prompt for FIDO passphrase before attempting to enroll
|
|||
|
|
|
|||
|
|
the credential, just let the enroll operating fail and we'll attempt to get a
|
|||
|
|
PIN anyway. Might avoid some unneccessary PIN prompts.
|
|||
|
|
|
|||
|
|
Part of GHPR#302 from Corinna Vinschen; ok dtucker@
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: bd5342ffc353ee37d39617906867c305564d1ce2
|
|||
|
|
|
|||
|
|
commit 2886975c0ad9244e60dc5e4be34fde3aa573a4b5
|
|||
|
|
Author: Corinna Vinschen <vinschen@redhat.com>
|
|||
|
|
Date: Fri Feb 11 14:33:41 2022 +0100
|
|||
|
|
|
|||
|
|
sk_sign: set FIDO2 uv attribute explicitely for WinHello
|
|||
|
|
|
|||
|
|
WinHello via libfido2 performs user verification by default.
|
|||
|
|
However, if we stick to that, there's no way to differentiate
|
|||
|
|
between keys created with or without "-O verify-required".
|
|||
|
|
Set FIDO2 uv attribute explicitely to FIDO_OPT_FALSE, then check
|
|||
|
|
if user verification has been requested.
|
|||
|
|
|
|||
|
|
Signed-off-by: Corinna Vinschen <vinschen@redhat.com>
|
|||
|
|
|
|||
|
|
commit 242c044ab111a37aad3b0775727c36a4c5f0102c
|
|||
|
|
Author: Corinna Vinschen <vinschen@redhat.com>
|
|||
|
|
Date: Tue Feb 15 11:28:08 2022 +0100
|
|||
|
|
|
|||
|
|
check_sk_options: add temporary WinHello workaround
|
|||
|
|
|
|||
|
|
Up to libfido 1.10.0, WinHello advertises "clientPin" rather
|
|||
|
|
than "uv" capability. This is fixed in 1.11.0. For the time
|
|||
|
|
being, workaround it here.
|
|||
|
|
|
|||
|
|
Signed-off-by: Corinna Vinschen <vinschen@redhat.com>
|
|||
|
|
|
|||
|
|
commit 78774c08cc4b4997382975b0f414a86e06b6780c
|
|||
|
|
Author: Corinna Vinschen <vinschen@redhat.com>
|
|||
|
|
Date: Thu Feb 10 18:19:29 2022 +0100
|
|||
|
|
|
|||
|
|
compat code for fido_dev_is_winhello()
|
|||
|
|
|
|||
|
|
Signed-off-by: Corinna Vinschen <vinschen@redhat.com>
|
|||
|
|
|
|||
|
|
commit 3d3a932a019aedfb891e0779bb4990cd5008a390
|
|||
|
|
Author: Darren Tucker <dtucker@dtucker.net>
|
|||
|
|
Date: Fri Aug 5 13:12:27 2022 +1000
|
|||
|
|
|
|||
|
|
Factor out getrnd() and rename to getentropy().
|
|||
|
|
|
|||
|
|
Factor out the arc4random seeding into its own file and change the
|
|||
|
|
interface to match getentropy. Use native getentropy if available.
|
|||
|
|
This will make it easier to resync OpenBSD changes to arc4random.
|
|||
|
|
Prompted by bz#3467, ok djm@.
|
|||
|
|
|
|||
|
|
commit 9385d277b787403be9dfcb229cf372202496d2f3
|
|||
|
|
Author: Darren Tucker <dtucker@dtucker.net>
|
|||
|
|
Date: Thu Aug 4 18:55:48 2022 +1000
|
|||
|
|
|
|||
|
|
Include CHANNEL and FIDO2 libs in configure output
|
|||
|
|
|
|||
|
|
commit 141535b904b6fba01724444f38193a8599201f82
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Mon Aug 1 11:09:26 2022 +0000
|
|||
|
|
|
|||
|
|
upstream: avoid double-free in error path introduced in r1.70; report
|
|||
|
|
|
|||
|
|
and fix based on GHPR#332 by v-rzh ok dtucker@
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: 3d21aa127b1f37cfc5bdc21461db369a663a951f
|
|||
|
|
|
|||
|
|
commit dba7099ffcba3ca07b3946f017ba6a4c3158d9b1
|
|||
|
|
Author: Darren Tucker <dtucker@dtucker.net>
|
|||
|
|
Date: Wed Jul 27 18:40:12 2022 +1000
|
|||
|
|
|
|||
|
|
Remove deprecated MacOS 10.15 runners.
|
|||
|
|
|
|||
|
|
commit 722a56439aa5972c830e4a9a724cf52aff4a950a
|
|||
|
|
Author: Darren Tucker <dtucker@dtucker.net>
|
|||
|
|
Date: Wed Jul 27 18:31:14 2022 +1000
|
|||
|
|
|
|||
|
|
Move stale-configure check as early as possible.
|
|||
|
|
|
|||
|
|
We added a check in Makefile to catch the case where configure needs to
|
|||
|
|
be rebuilt, however this did not happen until a build was attempted in
|
|||
|
|
which case all of the work done by configure was wasted. Move this check
|
|||
|
|
to the start of configure to catch it as early as possible. ok djm@
|
|||
|
|
|
|||
|
|
commit 099d6b56288b421ba38531d26dc1bd6bb685e311
|
|||
|
|
Author: Darren Tucker <dtucker@dtucker.net>
|
|||
|
|
Date: Fri Jul 22 10:47:19 2022 +1000
|
|||
|
|
|
|||
|
|
Move libcrypto into CHANNELLIBS.
|
|||
|
|
|
|||
|
|
This will result in sftp, sftp-server and scp no longer being linked
|
|||
|
|
against libcrypto. ok djm@
|
|||
|
|
|
|||
|
|
commit 1bdf86725b77733bb5f17c54888b88a10b2f6538
|
|||
|
|
Author: Darren Tucker <dtucker@dtucker.net>
|
|||
|
|
Date: Fri Jul 22 10:45:47 2022 +1000
|
|||
|
|
|
|||
|
|
Remove seed_rng calls from scp, sftp, sftp-server.
|
|||
|
|
|
|||
|
|
These binaries don't use OpenSSL's random functions. The next step
|
|||
|
|
will be to stop linking them against libcrypto. ok djm@
|
|||
|
|
|
|||
|
|
commit d73f77b8cb9b422f1ac4facee7890aa10ff2bc21
|
|||
|
|
Author: Darren Tucker <dtucker@dtucker.net>
|
|||
|
|
Date: Fri Jul 22 09:51:51 2022 +1000
|
|||
|
|
|
|||
|
|
Group libcrypto and PRNGD checks together.
|
|||
|
|
|
|||
|
|
They're related more than the libcrypt or libiaf checks which are
|
|||
|
|
currently between them. ok djm@
|
|||
|
|
|
|||
|
|
commit f117e372b3f42f2fbdb0a578d063b2609ab58e1f
|
|||
|
|
Author: Darren Tucker <dtucker@dtucker.net>
|
|||
|
|
Date: Fri Jul 22 09:24:45 2022 +1000
|
|||
|
|
|
|||
|
|
Do not link scp, sftp and sftp-server w/ zlib.
|
|||
|
|
|
|||
|
|
Some of our binaries (eg sftp, sftp-server, scp) do not interact with
|
|||
|
|
the channels code and thus do use libraries such as zlib and libcrypto
|
|||
|
|
although they are linked with them. This adds a CHANNELLIBS and starts
|
|||
|
|
by moving zlib into it, which means the aformentioned binaries are no
|
|||
|
|
longer linked against zlib. ok djm@
|
|||
|
|
|
|||
|
|
commit 800c2483e68db38bd1566ff69677124be974aceb
|
|||
|
|
Author: Darren Tucker <dtucker@dtucker.net>
|
|||
|
|
Date: Mon Jul 25 21:49:04 2022 +1000
|
|||
|
|
|
|||
|
|
Remove workarounds for OpenSSL missing AES-CTR.
|
|||
|
|
|
|||
|
|
We have some compatibility hacks that were added to support OpenSSL
|
|||
|
|
versions that do not support AES CTR mode. Since that time, however,
|
|||
|
|
the minimum OpenSSL version that we support has moved to 1.0.1 which
|
|||
|
|
*does* have CTR, so this is no longer needed. ok djm@
|
|||
|
|
|
|||
|
|
commit b7c56b65c12f51fe0dbae798d19c8f58224a5d95
|
|||
|
|
Author: Darren Tucker <dtucker@dtucker.net>
|
|||
|
|
Date: Mon Jul 25 21:43:00 2022 +1000
|
|||
|
|
|
|||
|
|
Remove workarounds for OpenSSL missing AES-GCM.
|
|||
|
|
|
|||
|
|
We have some compatibility hacks that were added to support OpenSSL
|
|||
|
|
versions that do not support AES GCM mode. Since that time, however,
|
|||
|
|
the minimum OpenSSL version that we support has moved to 1.0.1 which
|
|||
|
|
*does* have GCM, so this is no longer needed. ok djm@
|
|||
|
|
|
|||
|
|
commit 5a4a9f7a968fbf92cc1eac519c65638e79ae9f1f
|
|||
|
|
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
|||
|
|
Date: Mon Jul 25 07:12:45 2022 +0000
|
|||
|
|
|
|||
|
|
upstream: Restore missing "!" in TEST_SSH_ELAPSED_TIMES test.
|
|||
|
|
|
|||
|
|
OpenBSD-Regress-ID: 38783f9676ec348c5a792caecee9a16e354b37b0
|
|||
|
|
|
|||
|
|
commit 0ff886be132299386cc29d87c2aa16ff68a1aa08
|
|||
|
|
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
|||
|
|
Date: Sun Jul 24 23:29:10 2022 +0000
|
|||
|
|
|
|||
|
|
upstream: Test TEST_SSH_ELAPSED_TIMES for empty string not
|
|||
|
|
|
|||
|
|
executable. No-op on most platforms but should prevent warnings in -portable
|
|||
|
|
on systems that don't have 'date %s'.
|
|||
|
|
|
|||
|
|
OpenBSD-Regress-ID: e39d79867b8065e33d0c5926fa1a31f85659d2a4
|
|||
|
|
|
|||
|
|
commit f69319ad8ad1dd50f90bbcf5912e11cc8ed3e037
|
|||
|
|
Author: Darren Tucker <dtucker@dtucker.net>
|
|||
|
|
Date: Sat Jul 23 14:38:22 2022 +1000
|
|||
|
|
|
|||
|
|
Convert "have_prog" function into "which".
|
|||
|
|
|
|||
|
|
"which" and its behaviour is not standardized, so convert the existing
|
|||
|
|
have_prog function into "which" so we can rely on it being available
|
|||
|
|
and what its semantics are. Add a have_prog wrapper that maintains the
|
|||
|
|
existing behaviour.
|
|||
|
|
|
|||
|
|
commit ea7ecc2c3ae39fdf5c6ad97b7bc0b47a98847f43
|
|||
|
|
Author: Darren Tucker <dtucker@dtucker.net>
|
|||
|
|
Date: Sat Jul 23 14:36:38 2022 +1000
|
|||
|
|
|
|||
|
|
Skip scp3 test if there's no scp on remote path.
|
|||
|
|
|
|||
|
|
scp -3 ends up using the scp that's in the remote path and will fail if
|
|||
|
|
one is not available. Based on a patch from rapier at psc.edu.
|
|||
|
|
|
|||
|
|
commit c46f6fed419167c1671e4227459e108036c760f8
|
|||
|
|
Author: Damien Miller <djm@mindrot.org>
|
|||
|
|
Date: Wed Jul 20 13:39:14 2022 +1000
|
|||
|
|
|
|||
|
|
crank SSH_SK_VERSION_MAJOR in sk-dummy.so
|
|||
|
|
|
|||
|
|
commit f208e3b9ffb5ee76cf9c95df7ff967adc7f51c7d
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Wed Jul 20 03:33:22 2022 +0000
|
|||
|
|
|
|||
|
|
upstream: ssh-keygen: fix touch prompt, pin retries;
|
|||
|
|
|
|||
|
|
part of GHPR329 from Pedro Martelletto
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: 75d1005bd2ef8f29fa834c90d2684e73556fffe8
|
|||
|
|
|
|||
|
|
commit 8638a2ce7e90c8a51d9af3143404282126c524f8
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Wed Jul 20 03:31:42 2022 +0000
|
|||
|
|
|
|||
|
|
upstream: sk-usbhid: preserve error code returned by key_lookup()
|
|||
|
|
|
|||
|
|
it conveys useful information, such as the supplied pin being wrong.
|
|||
|
|
|
|||
|
|
Part of GHPR329 from Pedro Martelletto
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: c0647eb9290f793add363d81378439b273756c1b
|
|||
|
|
|
|||
|
|
commit 9ab929ca2d820520327b41929372bcb9e261534c
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Wed Jul 20 03:29:14 2022 +0000
|
|||
|
|
|
|||
|
|
upstream: when enrolling a resident key on a security token, check
|
|||
|
|
|
|||
|
|
if a credential with matching application and user ID strings already exists.
|
|||
|
|
if so, prompt the user for confirmation before overwriting the credential.
|
|||
|
|
|
|||
|
|
patch from Pedro Martelletto via GHPR329
|
|||
|
|
|
|||
|
|
NB. cranks SSH_SK_VERSION_MAJOR, so any third-party FIDO middleware
|
|||
|
|
implementations will need to adjust
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: e45e9f1bf2b2f32d9850669e7a8dbd64acc5fca4
|
|||
|
|
|
|||
|
|
commit 5bcfc788b38d5b64e4c347bdc04bd9a01bbc36da
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Wed Jul 20 03:13:04 2022 +0000
|
|||
|
|
|
|||
|
|
upstream: pull passphrase reading and confirmation into a separate
|
|||
|
|
|
|||
|
|
function so it can be used for FIDO2 PINs; no functional change
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: bf34f76b8283cc1d3f54633e0d4f13613d87bb2f
|
|||
|
|
|
|||
|
|
commit eb679e2959bdb15454eb94751930eb4c9110da94
|
|||
|
|
Author: Darren Tucker <dtucker@dtucker.net>
|
|||
|
|
Date: Fri Jul 15 21:31:48 2022 +1000
|
|||
|
|
|
|||
|
|
Move vmshutdown to first step.
|
|||
|
|
|
|||
|
|
If a previous run on a physical runner has failed to clean up, the next
|
|||
|
|
run will fail because it'll try to check out the code to a broken
|
|||
|
|
directory mount. Make cleanup the first step.
|
|||
|
|
|
|||
|
|
commit 46b91b70ff3cb9c147e2875ef5dc609fd64c0c96
|
|||
|
|
Author: Darren Tucker <dtucker@dtucker.net>
|
|||
|
|
Date: Fri Jul 15 20:25:27 2022 +1000
|
|||
|
|
|
|||
|
|
Rename bbone test target to ARM.
|
|||
|
|
|
|||
|
|
commit 751d22cdeffed9fe921db78eedc32a29f9e80510
|
|||
|
|
Author: Darren Tucker <dtucker@dtucker.net>
|
|||
|
|
Date: Fri Jul 15 13:37:29 2022 +1000
|
|||
|
|
|
|||
|
|
Add AUDIT_ARCH_PPC to supported seccomp arches.
|
|||
|
|
|
|||
|
|
Patch from dries.deschout at dodeco.eu.
|
|||
|
|
|
|||
|
|
commit a061792a6e8d235fc40a9b5d4c22a1762bb75a7b
|
|||
|
|
Author: Darren Tucker <dtucker@dtucker.net>
|
|||
|
|
Date: Thu Jul 14 19:20:24 2022 +1000
|
|||
|
|
|
|||
|
|
Remove unintended changes.
|
|||
|
|
|
|||
|
|
I inadvertently included a couple of local changes with the OpenSSL
|
|||
|
|
3.0.4 change. Revert, anything that should be there will be committed
|
|||
|
|
separately.
|
|||
|
|
|
|||
|
|
commit 527cb43fa1b4e55df661feabbac51b8e608b6519
|
|||
|
|
Author: Darren Tucker <dtucker@dtucker.net>
|
|||
|
|
Date: Thu Jul 14 11:22:08 2022 +1000
|
|||
|
|
|
|||
|
|
Return ERANGE from getcwd() if buffer size is 1.
|
|||
|
|
|
|||
|
|
If getcwd() is supplied a buffer size of exactly 1 and a path of "/", it
|
|||
|
|
could result in a nul byte being written out of array bounds. POSIX says
|
|||
|
|
it should return ERANGE if the path will not fit in the available buffer
|
|||
|
|
(with terminating nul). 1 byte cannot fit any possible path with its nul,
|
|||
|
|
so immediately return ERANGE in that case.
|
|||
|
|
|
|||
|
|
OpenSSH never uses getcwd() with this buffer size, and all current
|
|||
|
|
(and even quite old) platforms that we are currently known to work
|
|||
|
|
on have a native getcwd() so this code is not used on those anyway.
|
|||
|
|
Reported by Qualys, ok djm@
|
|||
|
|
|
|||
|
|
commit 36857fefd8849c4b0e877cfd9d1eb22f79b76650
|
|||
|
|
Author: Darren Tucker <dtucker@dtucker.net>
|
|||
|
|
Date: Thu Jul 14 10:02:35 2022 +1000
|
|||
|
|
|
|||
|
|
Split README.platform into its own line.
|
|||
|
|
|
|||
|
|
README.platform has general platform-specific information, having it
|
|||
|
|
following text about FIDO2 on the same line could imply that it only
|
|||
|
|
has information about FIDO2.
|
|||
|
|
|
|||
|
|
commit 00a496c6c14f2d41f2a9365714d494dd5f3aac9f
|
|||
|
|
Author: Darren Tucker <dtucker@dtucker.net>
|
|||
|
|
Date: Thu Jul 14 09:56:01 2022 +1000
|
|||
|
|
|
|||
|
|
Clarify README.md text.
|
|||
|
|
|
|||
|
|
Clarify the text about the implications of building without OpenSSL, and
|
|||
|
|
prefix the "configure --help" example command with a "./" so it's likely
|
|||
|
|
to work as-is in more shells. From bz#3461.
|
|||
|
|
|
|||
|
|
commit f40b52f21fbc52eb513279168a49d3285c65256c
|
|||
|
|
Author: Darren Tucker <dtucker@dtucker.net>
|
|||
|
|
Date: Tue Jul 12 19:48:44 2022 +1000
|
|||
|
|
|
|||
|
|
Remove special casing of crypt().
|
|||
|
|
|
|||
|
|
Configure goes to some lengths to pick crypt() from either libcrypt
|
|||
|
|
or OpenSSL's libcrypto because they can more or less featureful (eg
|
|||
|
|
supporting md5-style passwords).
|
|||
|
|
|
|||
|
|
OpenSSL removed its crypt() interface in 2002:
|
|||
|
|
https://github.com/openssl/openssl/commit/69deec58 so these hijinks
|
|||
|
|
should no longer be necessary. This also only links sshd with libcrypt
|
|||
|
|
which is the only thing that needs it. ok djm@
|
|||
|
|
|
|||
|
|
commit 76f4e48631d7b09fb243b47d7b393d100d3741b7
|
|||
|
|
Author: Darren Tucker <dtucker@dtucker.net>
|
|||
|
|
Date: Wed Jul 13 13:17:47 2022 +1000
|
|||
|
|
|
|||
|
|
Only refuse to use OpenSSL 3.0.4 on x86_64.
|
|||
|
|
|
|||
|
|
The potential RCE only impacts x86_64, so only refuse to use it if we're
|
|||
|
|
targetting a potentially impacted architecture. ok djm@
|
|||
|
|
|
|||
|
|
commit e75bbc1d88491fa85e61b2cc8783d4bbd00cd131
|
|||
|
|
Author: Darren Tucker <dtucker@dtucker.net>
|
|||
|
|
Date: Tue Jul 12 14:37:15 2022 +1000
|
|||
|
|
|
|||
|
|
Capture stderr output from configure.
|
|||
|
|
|
|||
|
|
commit d9eaea4bea6271bcee6a2b9428f1271faf2d033b
|
|||
|
|
Author: Darren Tucker <dtucker@dtucker.net>
|
|||
|
|
Date: Tue Jul 12 12:54:49 2022 +1000
|
|||
|
|
|
|||
|
|
Refuse to use OpenSSL 3.0.4 due to potential RCE.
|
|||
|
|
|
|||
|
|
OpenSSL has a potential RCE in its RSA implementation (CVE-2022-2274)
|
|||
|
|
so refuse to use that specific version.
|
|||
|
|
|
|||
|
|
commit fb2f3a61bf3d28fff285524535f7ffcd177c9235
|
|||
|
|
Author: Darren Tucker <dtucker@dtucker.net>
|
|||
|
|
Date: Tue Jul 12 12:54:24 2022 +1000
|
|||
|
|
|
|||
|
|
Move unset to before we set anything.
|
|||
|
|
|
|||
|
|
commit c483a5c0fb8e8b8915fad85c5f6113386a4341ca
|
|||
|
|
Author: Darren Tucker <dtucker@dtucker.net>
|
|||
|
|
Date: Wed Jul 6 11:52:54 2022 +1000
|
|||
|
|
|
|||
|
|
Test against openssl-3.0.5.
|
|||
|
|
|
|||
|
|
commit 669a56bcfe73f8b985f2bba476ba834d55253acf
|
|||
|
|
Author: Darren Tucker <dtucker@dtucker.net>
|
|||
|
|
Date: Tue Jul 5 18:35:53 2022 +1000
|
|||
|
|
|
|||
|
|
Update sanitizer test targets:
|
|||
|
|
|
|||
|
|
- remove clang-sanitize-memory for now. It takes so long that the test
|
|||
|
|
times out.
|
|||
|
|
- add gcc sanitize-address and sanitize-undefined test targets.
|
|||
|
|
|
|||
|
|
commit 48cc68b69118b3ce8d07fd4f82e00d58667d5379
|
|||
|
|
Author: Darren Tucker <dtucker@dtucker.net>
|
|||
|
|
Date: Tue Jul 5 16:23:28 2022 +1000
|
|||
|
|
|
|||
|
|
Add GCC address sanitizer build/test.
|
|||
|
|
|
|||
|
|
commit 55c60bdd39b82457e92efa77da8d16cfa6a49391
|
|||
|
|
Author: Darren Tucker <dtucker@dtucker.net>
|
|||
|
|
Date: Tue Jul 5 12:02:33 2022 +1000
|
|||
|
|
|
|||
|
|
Move sanitizer logs into regress for collection.
|
|||
|
|
|
|||
|
|
commit 35ef2b3b6ef198f8574904a45780487ec2f17858
|
|||
|
|
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
|||
|
|
Date: Mon Jul 4 09:10:31 2022 +0000
|
|||
|
|
|
|||
|
|
upstream: Add TEST_REGRESS_CACHE_DIR.
|
|||
|
|
|
|||
|
|
If set, it is used to cache regress test names that have succeeded and
|
|||
|
|
skip those on a re-run.
|
|||
|
|
|
|||
|
|
OpenBSD-Regress-ID: a7570dd29a58df59f2cca647c3c2ec989b49f247
|
|||
|
|
|
|||
|
|
commit 7394ed80c4de8b228a43c8956cf2fa1b9c6b2622
|
|||
|
|
Author: Darren Tucker <dtucker@dtucker.net>
|
|||
|
|
Date: Sun Jul 3 21:46:44 2022 +1000
|
|||
|
|
|
|||
|
|
Add clang sanitizer tests.
|
|||
|
|
|
|||
|
|
commit bfce0e66b6017a9bfab450b9dc7d4b16f90de817
|
|||
|
|
Author: Darren Tucker <dtucker@dtucker.net>
|
|||
|
|
Date: Sun Jul 3 18:14:09 2022 +1000
|
|||
|
|
|
|||
|
|
Skip all rlimit tests when sandboxing disabled.
|
|||
|
|
|
|||
|
|
The rlimit tests can hang when being run with some compiler sanitizers
|
|||
|
|
so skip all of them if sandbox=no.
|
|||
|
|
|
|||
|
|
commit 6208d611520f9ea94d5369f9da404b709930029d
|
|||
|
|
Author: Darren Tucker <dtucker@dtucker.net>
|
|||
|
|
Date: Sun Jul 3 17:54:49 2022 +1000
|
|||
|
|
|
|||
|
|
Move checks for pollfd.fd and nfds_t.
|
|||
|
|
|
|||
|
|
Move the checks for struct pollfd.fd and nfds_t to before the sandboxing
|
|||
|
|
checks. This groups all the sandbox checks together so we can skip them
|
|||
|
|
all when sandboxing is disabled.
|
|||
|
|
|
|||
|
|
commit 322964f8f2e9c321e77ebae1e4d2cd0ccc5c5a0b
|
|||
|
|
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
|||
|
|
Date: Fri Jul 1 05:08:23 2022 +0000
|
|||
|
|
|
|||
|
|
upstream: Remove leftover line.
|
|||
|
|
|
|||
|
|
Remove extra line leftover from merge conflict. ok djm@
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: 460e2290875d7ae64971a7e669c244b1d1c0ae2e
|
|||
|
|
|
|||
|
|
commit 7ec81daad0e03a64e8d91c5590960c48c1a899a3
|
|||
|
|
Author: djm@openbsd.org <djm@openbsd.org>
|
|||
|
|
Date: Fri Jul 1 04:45:50 2022 +0000
|
|||
|
|
|
|||
|
|
upstream: use consistent field names (s/char/byte)
|
|||
|
|
|
|||
|
|
in format description
|
|||
|
|
|
|||
|
|
OpenBSD-Commit-ID: 3de33572733ee7fcfd7db33d37db23d2280254f0
|