390 Commits

Author	SHA1	Message	Date
Tess Gauthier	f71f81eb0f	Merge 9.2 (#657) ... * upstream: attemp FIDO key signing without PIN and use the error code returned to fall back only if necessary. Avoids PIN prompts for FIDO tokens that don't require them; part of GHPR#302 OpenBSD-Commit-ID: 4f752aaf9f2e7c28bcaaf3d4f8fc290131bd038e * Install Cygwin packages based on OS not config. * initial list of allowed signers * upstream: whitespace OpenBSD-Commit-ID: d297e4387935d4aef091c5e9432578c2e513f538 * upstream: whitespace OpenBSD-Commit-ID: a5d015efbfd228dc598ffdef612d2da3a579e5d8 * Add cygwin-release test target. This also moves the cygwin package install from the workflow file to setup_ci.sh so that we can install different sets of Cygwin packages for different test configs. * Add Windows 2022 test targets. * Add libcrypt-devel to cygwin-release deps. Based on feedback from vinschen at redhat.com. * cross-sign allowed_signers with PGP key Provides continuity of trust from legacy PGP release key to the SSHSIG signing keys that we will use henceforth for git signing. * additional keys * upstream: whitespace OpenBSD-Commit-ID: c2bcbf93610d3d62ed206cdf9bf9ff98c6aaf232 * Move sftp from valgrind-2 to 3 to rebalance. * upstream: sk-usbhid: fix key_lookup() on tokens with built-in UV explicitly test whether the token performs built-in UV (e.g. biometric tokens) and enable UV in that case. From Pedro Martelletto via GHPR#388 OpenBSD-Commit-ID: 007eb7e387d27cf3029ab06b88224e03eca62ccd * Remove arc4random_uniform from arc4random.c This was previously moved into its own file (matching OpenBSD) which prematurely committed in commit 73541f2. * Move OPENBSD ORIGINAL marker. Putting this after the copyright statement (which doesn't change) instead of before the version identifier (which does) prevents merge conflicts when resyncing changes. * Resync arc4random with OpenBSD. This brings us up to current, including djm's random-reseeding change, as prompted by logan at cyberstorm.mu in bz#3467. It brings the platform-specific hooks from LibreSSL Portable, simplified to match our use case. ok djm@. * Remove DEF_WEAK, it's already in defines.h. * openbsd-compat/bsd-asprintf: add <stdio.h> include for vsnprintf Fixes the following build failure with Clang 15 on musl: ``` bsd-asprintf.c:51:8: error: call to undeclared library function 'vsnprintf' with type 'int (char *, unsigned long, const char *, struct __va_list_tag *)'; ISO C99 and laterclang -O2 -pipe -fdiagnostics-color=always -frecord-gcc-switches -pipe -Wunknown-warning-option -Qunused-arguments -Wall -Wpointer-arith -Wuninitialized -Wsign-compare -Wformat-security -Wsizeof-pointer-memaccess -Wno-pointer-sign -Wno-unused-result -Wmisleading-indentation -Wbitwise-instead-of-logical -fno-strict-aliasing -mretpoline -ftrapv -fzero-call-used-regs=all -fno-builtin-memset -fstack-protector-strong -fPIE -I. -I. -D_XOPEN_SOURCE=600 -D_BSD_SOURCE -D_DEFAULT_SOURCE -DSSHDIR=\"/etc/ssh\" -D_PATH_SSH_PROGRAM=\"/usr/bin/ssh\" -D_PATH_SSH_ASKPASS_DEFAULT=\"/usr/lib/misc/ssh-askpass\" -D_PATH_SFTP_SERVER=\"/usr/lib/misc/sftp-server\" -D_PATH_SSH_KEY_SIGN=\"/usr/lib/misc/ssh-keysign\" -D_PATH_SSH_PKCS11_HELPER=\"/usr/lib/misc/ssh-pkcs11-helper\" -D_PATH_SSH_SK_HELPER=\"/usr/lib/misc/ssh-sk-helper\" -D_PATH_SSH_PIDDIR=\"/run\" -D_PATH_PRIVSEP_CHROOT_DIR=\"/var/empty\" -DHAVE_CONFIG_H -c cipher-aes.c -o cipher-aes.o do not support implicit function declarations [-Wimplicit-function-declaration] ret = vsnprintf(string, INIT_SZ, fmt, ap2); ^ bsd-asprintf.c:51:8: note: include the header <stdio.h> or explicitly provide a declaration for 'vsnprintf' 1 error generated. ``` * upstream: notifier_complete(NULL, ...) is a noop, so no need to test that ctx!=NULL; from Corinna Vinschen OpenBSD-Commit-ID: ade2f2e9cc519d01a586800c25621d910bce384a * upstream: fix repeated words ok miod@ jmc@ OpenBSD-Commit-ID: 6765daefe26a6b648cc15cadbbe337596af709b7 * upstream: .Li -> .Vt where appropriate; from josiah frentsos, tweaked by schwarze ok schwarze OpenBSD-Commit-ID: 565046e3ce68b46c2f440a93d67c2a92726de8ed * upstream: ssh-agent: attempt FIDO key signing without PIN and use the error to determine whether a PIN is required and prompt only if necessary. from Corinna Vinschen OpenBSD-Commit-ID: dd6be6a0b7148608e834ee737c3479b3270b00dd * upstream: a little extra debugging OpenBSD-Commit-ID: edf1601c1d0905f6da4c713f4d9cecc7d1c0295a * upstream: sk_enroll: never drop SSH_SK_USER_VERIFICATION_REQD flag from response Now that all FIDO signing calls attempt first without PIN and then fall back to trying PIN only if that attempt fails, we can remove the hack^wtrick that removed the UV flag from the keys returned during enroll. By Corinna Vinschen OpenBSD-Commit-ID: 684517608c8491503bf80cd175425f0178d91d7f * upstream: sftp: Don't attempt to complete arguments for non-existent commands If user entered a non-existent command (e.g. because they made a typo) there is no point in trying to complete its arguments. Skip calling complete_match() if that's the case. From Michal Privoznik OpenBSD-Commit-ID: cf39c811a68cde2aeb98fc85addea4000ef6b07a * upstream: sftp: Be a bit more clever about completions There are commands (e.g. "get" or "put") that accept two arguments, a local path and a remote path. However, the way current completion is written doesn't take this distinction into account and always completes remote or local paths. By expanding CMD struct and "cmds" array this distinction can be reflected and with small adjustment to completer code the correct path can be completed. By Michal Privoznik, ok dtucker@ OpenBSD-Commit-ID: 1396d921c4eb1befd531f5c4a8ab47e7a74b610b * upstream: correct error value OpenBSD-Commit-ID: 780efcbad76281f11f14b2a5ff04eb6db3dfdad4 * upstream: actually hook up restrict_websafe; the command-line flag was never actually used. Spotted by Matthew Garrett OpenBSD-Commit-ID: 0b363518ac4c2819dbaa3dfad4028633ab9cdff1 * upstream: Add a sshkey_check_rsa_length() call for checking the length of an RSA key; ok markus@ OpenBSD-Commit-ID: de77cd5b11594297eda82edc594b0d32b8535134 * upstream: add a RequiredRSASize for checking RSA key length in ssh(1). User authentication keys that fall beneath this limit will be ignored. If a host presents a host key beneath this limit then the connection will be terminated (unfortunately there are no fallbacks in the protocol for host authentication). feedback deraadt, Dmitry Belyavskiy; ok markus@ OpenBSD-Commit-ID: 430e339b2a79fa9ecc63f2837b06fdd88a7da13a * upstream: Add RequiredRSASize for sshd(8); RSA keys that fall beneath this limit will be ignored for user and host-based authentication. Feedback deraadt@ ok markus@ OpenBSD-Commit-ID: 187931dfc19d51873df5930a04f2d972adf1f7f1 * upstream: better debugging for connect_next() OpenBSD-Commit-ID: d16a307a0711499c971807f324484ed3a6036640 * upstream: sftp-server(8): add a "users-groups-by-id@openssh.com" extension request that allows the client to obtain user/group names that correspond to a set of uids/gids. Will be used to make directory listings more useful and consistent in sftp(1). ok markus@ OpenBSD-Commit-ID: 7ebabde0bcb95ef949c4840fe89e697e30df47d3 * upstream: extend sftp-common.c:extend ls_file() to support supplied user/group names; ok markus@ OpenBSD-Commit-ID: c70c70498b1fdcf158531117e405b6245863bfb0 * upstream: sftp client library support for users-groups-by-id@openssh.com; ok markus@ OpenBSD-Commit-ID: ddb2f33a2da6349a9a89a8b5bcb9ca7c999394de * upstream: use users-groups-by-id@openssh.com sftp-server extension (when available) to fill in user/group names for directory listings. Implement a client-side cache of see uid/gid=>user/group names. ok markus@ OpenBSD-Commit-ID: f239aeeadfa925a37ceee36ee8b256b8ccf4466e * avoid Wuninitialized false positive in gcc-12ish * no need for glob.h here it also causes portability problems * upstream: add RequiredRSASize to the list of keywords accepted by -o; spotted by jmc@ OpenBSD-Commit-ID: fe871408cf6f9d3699afeda876f8adbac86a035e * upstream: Fix typo. From AlexanderStohr via github PR#343. OpenBSD-Commit-ID: a134c9b4039e48803fc6a87f955b0f4a03181497 * upstream: openssh-9.1 OpenBSD-Commit-ID: 5a467b2ee81da01a86adf1ad93b62b1728494e56 * crank versions in RPM spec files * update release notes URL * update .depend * remove mention of --with-security-key-builtin it is enabled by default when libfido2 is installed * mention libfido2 autodetection * whitespace at EOL * Test commits to all branches of portable. Only test OpenBSD upstream on commits to master since that's what it tracks. * Add 9.1 branch to CI status page. * Add LibreSSL 3.6.0 to test suite. While there, bump OpenSSL to latest 1.1.1q release. * upstream: honour user's umask if it is more restrictive then the ssh default (022); based on patch from Alex Henrie, ok dtucker@ deraadt@ OpenBSD-Commit-ID: fe1b9e15fc9a4f49fc338e848ce14d8727abe82d * skip bsd-poll.h if poll.h found; ok dtucker * Fix snprintf configure test for clang 15 Clang 15 -Wimplicit-int defaults to an error in C99 mode and above. A handful of tests have "main(..." and not "int main(..." which caused the tests to produce incorrect results. * undef _get{short,long} before redefining * revert c64b62338b4 and guard POLL* defines instead c64b62338b4 broke OSX builds, which do have poll.h but lack ppoll(2) Spotted by dtucker * OpenSSL dev branch now identifies as 3.2.0. * upstream: document "-O no-restrict-websafe"; spotted by Ross L Richardson OpenBSD-Commit-ID: fe9eaa50237693a14ebe5b5614bf32a02145fe8b * upstream: ssh-agent.1: - use Nm not Xr for self-ref - while here, wrap a long line ssh-agent.c: - add -O to usage() OpenBSD-Commit-ID: 855dac4695cef22e96d69c53436496bc408ca389 * upstream: use correct type with sizeof ok djm@ OpenBSD-Commit-ID: d6c882c2e8a42ff831a5b3cbc2c961ecb2dd6143 * upstream: when scp(1) is using the SFTP protocol for transport (the default), better match scp/rcp's handling of globs that don't match the globbed characters but do match literally (e.g. trying to transfer "foo.[1]"). Previously scp(1) in SFTP mode would not match these pathnames but legacy scp/rcp mode would. Reported by Michael Yagliyan in bz3488; ok dtucker@ OpenBSD-Commit-ID: d8a3773f53015ba811fddba7473769a2fd343e11 * upstream: regress test for unmatched glob characters; fails before previous commit but passes now. bz3488; prodded by dtucker@ OpenBSD-Regress-ID: 0cc5cc9ea4a6fd170dc61b9212f15badaafb3bbd * upstream: Be more paranoid with host/domain names coming from the never write a name with bad characters to a known_hosts file. reported by David Leadbeater, ok deraadt@ OpenBSD-Commit-ID: ba9b25fa8b5490b49398471e0c9657b0cbc7a5ad * upstream: begin big refactor of sshkey Move keytype data and some of the type-specific code (allocation, cleanup, etc) out into each key type's implementation. Subsequent commits will move more, with the goal of having each key-*.c file owning as much of its keytype's implementation as possible. lots of feedback + ok markus@ OpenBSD-Commit-ID: 0f2b4334f73914344e9e5b3d33522d41762a57ec * upstream: factor out sshkey_equal_public() feedback/ok markus@ OpenBSD-Commit-ID: 1368ba114cb37732fe6ec3d89c7e6d27ea6fdc94 * upstream: factor out public key serialization feedback/ok markus@ OpenBSD-Commit-ID: a3570c4b97290c5662890aea7328d87f55939033 * upstream: refactor and simplify sshkey_read() feedback/ok markus@ OpenBSD-Commit-ID: 0d93b7a56e31cd06a8bb0d2191d084ce254b0971 * upstream: factor out key generation feedback/ok markus@ OpenBSD-Commit-ID: 5b4211bff4de8d9adb84bc72857a8c42c44e7ceb * upstream: refactor sshkey_from_private() feedback/ok markus@ OpenBSD-Commit-ID: e5dbe7a3545930c50f70ee75c867a1e08b382b53 * upstream: refactor sshkey_from_blob_internal() feedback/ok markus@ OpenBSD-Commit-ID: 1f46c0cbb8060ee9666a02749594ad6658c8e283 * upstream: refactor sshkey_sign() and sshkey_verify() feedback/ok markus@ OpenBSD-Commit-ID: 368e662c128c99d05cc043b1308d2b6c71a4d3cc * upstream: refactor certify feedback/ok markus@ OpenBSD-Commit-ID: 35d742992e223eaca3537e6fb3d3002c08eed4f6 * upstream: refactor sshkey_private_serialize_opt() feedback/ok markus@ OpenBSD-Commit-ID: 61e0fe989897901294efe7c3b6d670cefaf44cbd * upstream: refactor sshkey_private_deserialize feedback/ok markus@ OpenBSD-Commit-ID: f5ca6932fdaf840a5e8250becb38315a29b5fc9f * fix merge botch * upstream: allow ssh-keyscan(1) to accept CIDR address ranges, e.g. ssh-keyscan 192.168.0.0/24 If a CIDR range is passed, then it will be expanded to all possible addresses in the range including the all-0s and all-1s addresses. bz#976 feedback/ok markus@ OpenBSD-Commit-ID: ce6c5211f936ac0053fd4a2ddb415277931e6c4b * upstream: put sshkey_check_rsa_length() back in sshkey.c to unbreak OPENSSL=no builds OpenBSD-Commit-ID: 99eec58abe382ecd14b14043b195ee1babb9cf6e * OpenSSL dev branch is 302 not 320. While there, also accept 301 which it shat it was previously. * upstream: Use variable for diff options instead of unconditionally specifying "-rN". This will make life easier in -portable where not all diff's understand -N. OpenBSD-Regress-ID: 8b8a407115546be1c6d72d350b1e4f1f960d3cd3 * Check for sockaddr_in.sin_len. If found, set SOCK_HAS_LEN which is used in addr.c. Should fix keyscan tests on platforms with this (eg old NetBSD). * Always use compat getentropy. Have it call native getentropy and fall back as required. Should fix issues of platforms where libc has getentropy but it is not implemented in the kernel. Based on github PR#354 from simsergey. * Include time.h when defining timegm. Fixes build on some platforms eg recent AIX. * Compat tests need libcrypto. This was moved to CHANNELLIBS during the libs refactor. Spotted by rapier at psc.edu. * Run compat regress tests too. * Add tests for OpenSSL 3.0.7 and LibreSSL 3.6.1. * Only run opensslver tests if built with OpenSSL. * Increase selfhosted job timeout. The default job timeout of 360 (6h) is not enough to complete the regress tests for some of the slow VMs depending on the load on the host. Increase to 600 (10h). * Fix compat regress to work with non-GNU make. * Link libssh into compat tests. The cygwin compat code uses xmalloc, so add libssh.a so pick up that. * Rerun tests on changes to Makefile.in in any dir. * upstream: replace recently-added valid_domain() check for hostnames going to known_hosts with a more relaxed check for bad characters; previous commit broke address literals. Reported by/feedback from florian@ OpenBSD-Commit-ID: 10b86dc6a4b206adaa0c11b58b6d5933898d43e0 * Don't run openbsd-compat tests on Cygwin. Add "compat-tests" to the default TEST_TARGET so we can override as necessary. Override TEST_TARGET for Cygwin as the tests don't currently compile there. * Fix broken zlib link. * configure.ac: Add <pty.h> include for openpty Another Clang 16ish fix (which makes -Wimplicit-function-declaration an error by default). github PR#355. See: 2efd71da49b9cfeab7987058cf5919e473ff466b See: be197635329feb839865fdc738e34e24afd1fca8 * configure.ac: Fix -Wstrict-prototypes Clang 16 now warns on this and it'll be removed in C23, so let's just be future proof. It also reduces noise when doing general Clang 16 porting work (which is a big job as it is). github PR#355. Signed-off-by: Sam James <sam@gentoo.org> * Fix setres*id checks to work with clang-16. glibc has the prototypes for setresuid and setresgid behind _GNU_SOURCE, and clang 16 will error out on implicit function definitions, so add _GNU_SOURCE and the required headers to the configure checks. From sam at @gentoo.org via bz#3497. * Fix tracing disable on FreeBSD. Some versions of FreeBSD do not support using id 0 to refer to the current pid for procctl, so pass getpid() explicitly. From emaste at freebsd.org. * Use "prohibit-password" in -portable comments. "without-password" is the deprecated alias for "prohibit-password", so we should reference the latter. From emaste at freebsd.org. * Link to branch-specific queries for V_9_1 status. * upstream: Fix typo. From pablomh via -portable github PR#344. OpenBSD-Commit-ID: d056ee2e73691dc3ecdb44a6de68e6b88cd93827 * upstream: Import regenerated moduli. OpenBSD-Commit-ID: b0e54ee4d703bd6929bbc624068666a7a42ecb1f * Add CIFuzz integration * Run cifuzz workflow on the actions as regular CI. * Whitespace change to trigger CIFuzz workflow. * Do not run CIFuzz on selfhosted tree. We already run it on the regular tree, no need to double up. * Add CIFuzz status badge. * Branch-specific links for master status badges. * Fix merge conflict. * upstream: fix parsing of hex cert expiry time; was checking whether the start time began with "0x", not the expiry time. from Ed Maste OpenBSD-Commit-ID: 6269242c3e1a130b47c92cfca4d661df15f05739 * upstream: Check for and disallow MaxStartups values less than or equal to zero during config parsing, rather than faling later at runtime. bz#3489, ok djm@ OpenBSD-Commit-ID: d79c2b7a8601eb9be493629a91245d761154308b * upstream: Remove some set but otherwise unused variables, spotted in -portable by clang 16's -Wunused-but-set-variable. ok djm@ OpenBSD-Commit-ID: 3d943ddf2369b38fbf89f5f19728e7dc1daf3982 * upstream: The IdentityFile option in ssh_config can also be used to specify a public key file, as documented in ssh.1 for the -i option. Document this also for IdentityFile in ssh_config.5, for documentation completeness. From laalsaas at systemli.org via portable github PR#352, ok jmc@ djm@ OpenBSD-Commit-ID: 2f943be9f96e60ef81a9a4faa25b009999f9883b * Split out rekey test since it runs the longest. * Update checkout and upload actions. Update actions/checkout and actions/upload-artifact to main branch for compatibility with node.js v16. * Add valrind-5 test here too. * Run vm startup and shutdown from runner temp dir. Should work even if the github workspace dir is on a stale sshfs mount. * Shutdown any VM before trying to check out repo. In the case where the previous run did not clean up, the checkout will fail as it'll leave a stale mount. * Avoid assuming layout of fd_set POSIX doesn't specify the internal layout of the fd_set object, so let's not assume it is just a bit mask. This increases compatibility with systems that have a different layout. The assumption is also worthless as we already refuse to use file descriptors over FD_SETSIZE anyway. Meaning that the default size of fd_set is quite sufficient. * Fix comment text. From emaste at freebsd.org. * Defer seed_rng until after closefrom call. seed_rng will initialize OpenSSL, and some engine providers (eg Intel's QAT) will open descriptors for their own use. bz#3483, patch from joel.d.schuetze at intel.com, ok djm@ * upstream: typo in comment OpenBSD-Commit-ID: 39c58f41e0f32d1ff31731fa6f5bbbc3ad25084a * upstream: rename client_global_hostkeys_private_confirm() to client_global_hostkeys_prove_confirm(), as it handles the "hostkeys-prove00@openssh.com" message; no functional change OpenBSD-Commit-ID: 31e09bd3cca6eed26855b88fb8beed18e9bd026d * upstream: Remove errant colon and simplify format string in error messages. Patch from vapier at chromium.org. OpenBSD-Commit-ID: fc28466ebc7b74e0072331947a89bdd239c160d3 * upstream: Fix typo in fatal error message. Patch from vapier at chromium.org. OpenBSD-Commit-ID: 8a0c164a6a25eef0eedfc30df95bfa27644e35cf * Skip reexec test on OpenSSL 1.1.1 specifically. OpenSSL 1.1.1 has a bug in its RNG that breaks reexec fallback, so skip that test. See bz#3483 for details. * Remove seed passing over reexec. This was added for the benefit of platforms using ssh-rand-helper to prevent a delay on each connection as sshd reseeded itself. ssh-random-helper is long gone, and since the re-exec happens before the chroot the re-execed sshd can reseed itself normally. ok djm@ * upstream: Handle dynamic remote port forwarding in escape commandline's -R processing. bz#3499, ok djm@ OpenBSD-Commit-ID: 194ee4cfe7ed0e2b8ad0727f493c798a50454208 * Add dfly62 test target. * If we haven't found it yet, recheck for sys/stat.h. On some very old platforms, sys/stat.h needs sys/types.h, however autoconf 2.71's AC_CHECK_INCLUDES_DEFAULT checks for them in the opposite order, which in combination with modern autoconf's "present but cannot be compiled" behaviour causes it to not be detected. * Add fallback for old platforms w/out MAP_ANON. * Remove explicit "default" test config argument. Not specifying the test config implicitly selects default args. * Remove unused self-hosted test targets. * Rename "os" in matrix to "target". This is in preparation to distinguish this from the host that the runner runs on in case where they are separate (eg VMs). * Add "libvirt" label to dfly30. * Make "config" in matrix singular and pass in env. This will allow the startup scripts to adapt their behaviour based on the type and config. * Run vmstartup from temp dir. This will allow us to create ephemeral disk images per-runner. * Rework how selfhosted tests interact with runners. Previously there was one runner per test target (mostly VMs). This had a few limitations: - multiple tests that ran on the same target (eg multiple build configs) were serialized on availability or that runner. - it needed manual balancing of VMs over host machines. To address this, make VMs that use ephemeral disks (ie most of them) all use a pool of runners with the "libvirt" label. This requires that we distinguish between "host" and "target" for those. Native runners and VMs with persistent disks (eg the constantly-updated snapshot ones) specify the same host and target. This should improve test throughput. * Skip unit tests on slow riscv64 hardware. * Use -fzero-call-used-regs=used on clang 15. clang 15 seems to have a problem with -fzero-call-used-reg=all which causes spurious "incorrect signature" failures with ED25519. On those versions, use -fzero-call-used-regs=used instead. (We may add exceptions later if specific versions prove to be OK). Also move the GCC version check to match. Initial investigation by Daniel Pouzzner (douzzer at mega nu), workaround suggested by Bill Wendling (morbo at google com). bz#3475, ok djm@ * upstream: In channel_request_remote_forwarding the parameters for permission_set_add are leaked as they are also duplicated in the call. Found by CodeChecker. ok djm OpenBSD-Commit-ID: 4aef50fa9be7c0b138188814c8fe3dccc196f61e * upstream: New EnableEscapeCommandline ssh_config(5) option This option (default "no") controls whether the ~C escape is available. Turning it off by default means we will soon be able to use a stricter default pledge(2) in the client. feedback deraadt@ dtucker@; tested in snaps for a while OpenBSD-Commit-ID: 7e277595d60acb8263118dcb66554472257b387a * upstream: tighten pledge(2) after session establishment feedback, ok & testing in snaps deraadt@ OpenBSD-Commit-ID: aecf4d49d28586dfbcc74328d9333398fef9eb58 * upstream: Add void to client_repledge args to fix compiler warning. ok djm@ OpenBSD-Commit-ID: 7e964a641ce4a0a0a11f047953b29929d7a4b866 * upstream: Log output of ssh-agent and ssh-add This should make debugging easier. OpenBSD-Regress-ID: 5974b02651f428d7e1079b41304c498ca7e306c8 * upstream: Clean up ssh-add and ssh-agent logs. OpenBSD-Regress-ID: 9eda8e4c3714d7f943ab2e73ed58a233bd29cd2c * Restore ssh-agent permissions on exit. ...enough that subsequent builds can overwrite ssh-agent if necessary. * upstream: make struct sshbuf private and remove an unused field; ok dtucker OpenBSD-Commit-ID: c7a3d77c0b8c153d463398606a8d57569186a0c3 * upstream: Remove duplicate includes. Patch from AtariDreams via github PR#364. OpenBSD-Commit-ID: b9186638a05cb8b56ef7c0de521922b6723644ea * Fix typo in comment. Spotted by tim@ * Update autotools Regenerate config files using latest autotools * disable SANDBOX_SECCOMP_FILTER_DEBUG It was mistakenly enabled in 2580916e4872 Reported by Peter sec-openssh-com.22.fichtner AT 0sg.net * Add SANDBOX_DEBUG to the kitchensink test build. * upstream: Fix comment typo. OpenBSD-Regress-ID: 3b04faced6511bb5e74648c6a4ef4bf2c4decf03 * upstream: remove '?' from getopt(3) loops userspace: remove vestigial '?' cases from top-level getopt(3) loops getopt(3) returns '?' when it encounters a flag not present in the in the optstring or if a flag is missing its option argument. We can handle this case with the "default" failure case with no loss of legibility. Hence, remove all the redundant "case '?':" lines. Prompted by dlg@. With help from dlg@ and millert@. Link: https://marc.info/?l=openbsd-tech&m=167011979726449&w=2 ok naddy@ millert@ dlg@ OpenBSD-Commit-ID: b2f89346538ce4f5b33ab8011a23e0626a67e66e * upstream: Add server debugging for hostbased auth. auth_debug_add queues messages about the auth process which is sent to the client after successful authentication. This also sends those to the server debug log to aid in debugging. From bz#3507, ok djm@ OpenBSD-Commit-ID: 46ff67518cccf9caf47e06393e2a121ee5aa258a * upstream: Warn if no host keys for hostbased auth can be loaded. OpenBSD-Commit-ID: 2a0a13132000cf8d3593133c1b49768aa3c95977 * use calloc for allocating arc4random structs ok dtucker * Move obsdsnap test VMs to ephemeral runners. * Run upstream obsdsnap tests on ephemeral runners. * obsdsnap test VMs runs-on libvirt too. * Fetch regress logs from obj dir. * Set group perms on regress dir. This ensures that the tests don't fail due to StrictMode checks. * Use sudo when resetting perms on directories. * Add tests for LibreSSL 3.7.0 and OpenSSL 1.1.1s. * Simply handling of SSH_CONNECTION PAM env var. Prompted by bz#3508: there's no need to cache the value of sshpam_conninfo so remove the global. While there, add check of return value from pam_putenv. ok djm@ * upstream: The idiomatic way of coping with signed char vs unsigned char (which did not come from stdio read functions) in the presence of ctype macros, is to always cast to (unsigned char). casting to (int) for a "macro" which is documented to take int, is weird. And sadly wrong, because of the sing extension risk.. same diff from florian OpenBSD-Commit-ID: 65b9a49a68e22ff3a0ebd593f363e9f22dd73fea * upstream: add a -X option to both scp(1) and sftp(1) to allow control over some SFTP protocol knobs: the copy buffer length and the number of inflight requests, both of which are used during upload/download. Previously these could be controlled in sftp(1) using the -b/-R options. This makes them available in both SFTP protocol clients using the same option character sequence. ok dtucker@ OpenBSD-Commit-ID: 27502bffc589776f5da1f31df8cb51abe9a15f1c * upstream: add -X to usage(); OpenBSD-Commit-ID: 1bdc3df7de11d766587b0428318336dbffe4a9d0 * upstream: Clear signal mask early in main(); sshd may have been started with one or more signals masked (sigprocmask(2) is not cleared on fork/exec) and this could interfere with various things, e.g. the login grace timer. Execution environments that fail to clear the signal mask before running sshd are clearly broken, but apparently they do exist. Reported by Sreedhar Balasubramanian; ok dtucker@ OpenBSD-Commit-ID: 77078c0b1c53c780269fc0c416f121d05e3010ae * upstream: Mention that scp uses the SFTP protocol and remove reference to legacy flag. Spotted by, feedback and ok jmc@ OpenBSD-Commit-ID: 9dfe04966f52e941966b46c7a2972147f95281b3 * upstream: spelling fixes; from paul tagliamonte amendments to his diff are noted on tech OpenBSD-Commit-ID: d776dd03d0b882ca9c83b84f6b384f6f9bd7de4a * upstream: fix bug in PermitRemoteOpen which caused it to ignore its first argument unless it was one of the special keywords "any" or "none". Reported by Georges Chaudy in bz3515; ok dtucker@ OpenBSD-Commit-ID: c5678a39f1ff79993d5ae3cfac5746a4ae148ea5 * upstream: regression test for PermitRemoteOpen OpenBSD-Regress-ID: 8271aafbf5c21950cd5bf966f08e585cebfe630c * upstream: suppress "Connection closed" message when in quiet mode OpenBSD-Commit-ID: 8a3ab7176764da55f60bfacfeae9b82d84e3908f * upstream: add ptimeout API for keeping track of poll/ppoll timeouts; ok dtucker markus OpenBSD-Commit-ID: 3335268ca135b3ec15a947547d7cfbb8ff929ead * upstream: replace manual poll/ppoll timeout math with ptimeout API feedback markus / ok markus dtucker OpenBSD-Commit-ID: c5ec4f2d52684cdb788cd9cbc1bcf89464014be2 * upstream: Add channel_force_close() This will forcibly close an open channel by simulating read/write errors, draining the IO buffers and calling the detach function. Previously the detach function was only ever called during channel garbage collection, but there was no way to signal the user of a channel (e.g. session.c) that its channel was being closed deliberately (vs. by the usual state-machine logic). So this adds an extra "force" argument to the channel cleanup callback to indicate this condition. ok markus dtucker OpenBSD-Commit-ID: 23052707a42bdc62fda2508636e624afd466324b * upstream: tweak channel ctype names These are now used by sshd_config:ChannelTimeouts to specify timeouts by channel type, so force them all to use a similar format without whitespace. ok dtucker markus OpenBSD-Commit-ID: 66834765bb4ae14f96d2bb981ac98a7dae361b65 * upstream: Add channel_set_xtype() This sets an "extended" channel type after channel creation (e.g. "session:subsystem:sftp") that will be used for setting channel inactivity timeouts. ok markus dtucker OpenBSD-Commit-ID: 42564aa92345045b4a74300528f960416a15d4ca * upstream: Implement channel inactivity timeouts This adds a sshd_config ChannelTimeouts directive that allows channels that have not seen traffic in a configurable interval to be automatically closed. Different timeouts may be applied to session, X11, agent and TCP forwarding channels. Note: this only affects channels over an opened SSH connection and not the connection itself. Most clients close the connection when their channels go away, with a notable exception being ssh(1) in multiplexing mode. ok markus dtucker OpenBSD-Commit-ID: ae8bba3ed9d9f95ff2e2dc8dcadfa36b48e6c0b8 * unbreak scp on NetBSD 4.x e555d5cad5 effectively increased the default copy buffer size for SFTP transfers. This caused NetBSD 4.x to hang during the "copy local file to remote file in place" scp.sh regression test. This puts back the original 32KB copy buffer size until we can properly figure out why. lots of debugging assistance from dtucker@ * upstream: Copy bytes from the_banana[] rather than banana() Fixes test failure due to segfault seen on arm64 with xonly snap. ok djm OpenBSD-Regress-ID: 86e2aa4bbd1dff1bc4ebb2969c0d6474485be046 * upstream: unit tests for misc.c:ptimeout_* API OpenBSD-Regress-ID: 01f8fb12d08e5aaadd4bd4e71f456b6588be9a94 * upstream: fix typo in verbose logging OpenBSD-Regress-ID: 0497cdb66e003b2f50ed77291a9104fba2e017e9 * upstream: regression test for ChannelTimeout OpenBSD-Regress-ID: 280bfbefcfa415428ad744e43f69a8dede8ad685 * upstream: Save debug logs from ssh for debugging purposes. OpenBSD-Regress-ID: 109e40b06de1c006a3b8e0d8745b790b2c5870a0 * Set OPENSSL_BIN from OpenSSL directory. * Check openssl_bin path is executable before using. * Use autoconf to find openssl binary. It's possible to install an OpenSSL in a path not in the system's default library search path. OpenSSH can still use this (eg if you specify an rpath) but the openssl binary there may not work. If one is available on the system path just use that. * Use our own netcat for dynamic-forward test. That way we can be surer about its behaviour rather than trying to second-guess the behaviour of various netcat implementations. * upstream: When OpenSSL is not available, skip parts of percent test that require it. Based on github pr#368 from ren mingshuai. OpenBSD-Regress-ID: 49a375b2cf61ccb95b52e75e2e025cd10988ebb2 * don't test IPv6 addresses if platform lacks support * Skip dynamic-forward test on minix3. This test relies on loopback addresses which minix does not have. Previously the test would not run at all since it also doesn't have netcat, but now we use our own netcat it tries and fails. * try to improve logging for dynamic-forward test previously the logs from the ssh used to exercise the forwarding channel would clobber the logs from the ssh actually doing the forwarding * upstream: tweak previous; ok djm OpenBSD-Commit-ID: 229c493452766d70a78b0f02f6ff9894f9028858 * upstream: Switch scp from using pipes to a socketpair for communication with it's ssh sub-processes. We no longer need to reserve two descriptors to ensure that we don't end up using fd 0-2 unexpectedly, that is handled by sanitise_stdfd() in main(). Based on an original diff from djm@. OK deraadt@ djm@ OpenBSD-Commit-ID: b80c372faac462471e955ddeab9480d668a2e48d * add back use of pipes in scp.c under USE_PIPES This matches sftp.c which prefers socketpair but uses pipes on some older platforms. * remove buffer len workaround for NetBSD 4.x Switching to from pipes to a socketpair for communicating with the ssh process avoids the (kernel bug?) problem. * upstream: rewrite this test to use a multiplexed ssh session so we can control its lifecycle without risk of race conditions; fixes some of the Github integration tests for openssh-portable OpenBSD-Regress-ID: 5451cad59ba0d43ae9eeda48ec80f54405fee969 * upstream: remove whitespace at EOL from code extracted from SUPERCOP OpenBSD-Commit-ID: 1ec524ff2fbb9387d731601437c82008f35a60f4 * upstream: ignore bogus upload/download buffer lengths in the limits extension OpenBSD-Commit-ID: c5b023e0954693ba9a5376e4280c739b5db575f8 * upstream: clamp the minimum buffer lengths and number of inflight requests too OpenBSD-Commit-ID: c4965f62fa0ba850940fd66ae3f60cf516bbcd56 * upstream: avoid printf("%s", NULL) if using ssh -oUserKnownHostsFile=none and a hostkey in one of the system known hosts file changes; ok dtucker@ OpenBSD-Commit-ID: 7ca87614bfc6da491315536a7f2301434a9fe614 * upstream: Add a "Host" line to the output of ssh -G showing the original host arg. Inspired by patch from vincent at bernat.ch via bz#3343, ok djm@ OpenBSD-Commit-ID: 59c0f60a222113a44d0650cd394376e3beecc883 * Remove skipping test when scp not in path. An upcoming change renders this obsolete by adding scp's path to the test sshd's PATH, and removing this first will make the subsequent sync easier. * upstream: Add scp's path to test sshd's PATH. If the scp we're testing is fully qualified (eg it's not in the system PATH) then add its path to the under-test sshd's PATH so we can find it. Prompted by bz#3518. OpenBSD-Regress-ID: 7df4f5a0be3aa135495b7e5a6719d3cbc26cc4c0 * upstream: Move scp path setting to a helper function. The previous commit to add scp to the test sshd's path causes the t-envpass test to fail when the test scp is given using a fully qualified path. Put this in a helper function and only call it from the scp tests. OpenBSD-Regress-ID: 7533dc1c4265c1de716abb062957994195b36df4 * Retry package installation 3 times. When setting up the CI environment, retry package installation 3 times before going up. Should help prevent spurious failures during infrastructure issues. * upstream: Document "UserKnownHostsFile none". ok djm@ OpenBSD-Commit-ID: f695742d39e34ecdcc3c861c3739a84648a4bce5 * upstream: fix double phrase in previous; OpenBSD-Commit-ID: 671e6c8dc5e9230518b2bbfa143daaa88adc66c2 * upstream: Instead of skipping the all-tokens test if we don't have OpenSSL (since we use it to compute the hash), put the hash at the end and just omit it if we don't have it. Prompted by bz#3521. OpenBSD-Regress-ID: c79ecba64250ed3b6417294b6c965e6b12ca5eea * upstream: Shell syntax fix. From ren mingshuai vi github PR#369. OpenBSD-Regress-ID: 6696b2eeefe128099fc3d7ea9f23252cc35156f9 * Allow writev is seccomp sandbox. This seems to be used by recent glibcs at least in some configurations. From bz#3512, ok djm@ * upstream: update OpenSSH's Ed25519 code to the last version of SUPERCOP (20221122) and change the import approach to the same one we use for Streamlined NTRUPrime: use a shell script to extract the bits we need from SUPERCOP, make some minor adjustments and squish them all into a single file. ok tb@ tobhe@ OpenBSD-Commit-ID: 1bc0fd624cb6af440905b8ba74ac7c03311b8e3b * upstream: adapt to ed25519 changes in src/usr.bin/ssh OpenBSD-Regress-ID: 4b3e7ba7ee486ae8a0b4790f8112eded2bb7dcd5 * upstream: Add a sshd_config UnusedConnectionTimeout option to terminate client connections that have no open channels for some length of time. This complements the recently-added ChannelTimeout option that terminates inactive channels after a timeout. ok markus@ OpenBSD-Commit-ID: ca983be74c0350364c11f8ba3bd692f6f24f5da9 * upstream: unbreak test: cannot access shell positional parameters past $9 without wrapping the position in braces (i.e. need ${10}, etc.) OpenBSD-Regress-ID: 3750ec98d5d409ce6a93406fedde6f220d2ea2ac * upstream: regression test for UnusedConnectionTimeout OpenBSD-Regress-ID: 7f29001374a68e71e5e078f69e4520cf4bcca084 * upstream: also check that an active session inhibits UnusedConnectionTimeout idea markus@ OpenBSD-Regress-ID: 55c0fb61f3bf9e092b0a53f9041d3d2012f14003 * upstream: For "ssh -V" always exit 0, there is no need to check opt again. This was missed when the fallthrough in the switch case above it was removed. OK deraadt@ OpenBSD-Commit-ID: 5583e5d8f6d62a8a4215cfa95a69932f344c8120 * upstream: Add a -V (version) option to sshd like the ssh client has. OK markus@ deraadt@ OpenBSD-Commit-ID: abe990ec3e636fb040132aab8cbbede98f0c413e * upstream: when restoring non-blocking mode to stdio fds, restore exactly the flags that ssh started with and don't just clobber them with zero, as this could also remove the append flag from the set; bz3523; ok dtucker@ OpenBSD-Commit-ID: 1336b03e881db7564a4b66014eb24c5230e9a0c0 * Skip connection-timeout when missing FD passing. This tests uses multiplexing which uses file descriptor passing, so skip it if we don't have that. Fixes test failures on Cygwin. * Skip connection-timeout test under Valgrind. Valgrind slows things down so much that the timeout test fails. Skip this test until we figure out if we can make it work. * upstream: tweak previous; ok djm OpenBSD-Commit-ID: df71ce4180c58202dfdc1d92626cfe900b91b7c3 * upstream: Create and install sshd random relink kit. ../Makefile.inc and Makfile are concatenated for reuse, which hopefully won't be too fragile, we'll see if we need a different approach. The resulting sshd binary is tested with the new sshd -V option before installation. As the binary layout is now semi-unknown (meaning relative, fixed, and gadget offsets are not precisely known), change the filesystem permissions to 511 to prevent what I call "logged in BROP". I have ideas for improving this further but this is a first step ok djm OpenBSD-Commit-ID: 1e0a2692b7e20b126dda60bf04999d1d30d959d8 * upstream: delete useless dependency OpenBSD-Commit-ID: e1dc11143f83082e3154d6094f9136d0dc2637ad * fix libfido2 detection without pkg-config Place libfido2 before additional libraries (that it may depend upon) and not after. bz3530 from James Zhang; ok dtucker@ * Skip connection-timeout test on minix3. Minix 3's Unix domain sockets don't seem to work the way we expect, so skip connection-timeout test on that platform. While there, group together all similarly skipped tests and explicitly comment. * upstream: fix double-free caused by compat_kex_proposal(); bz3522 by dtucker@, ok me OpenBSD-Commit-ID: 2bfc37cd2d41f67dad64c17a64cf2cd3806a5c80 * upstream: openssh-9.2 OpenBSD-Commit-ID: f7389f32413c74d6e2055f05cf65e7082de03923 * upstream: Check if we can copy sshd or need to use sudo to do so during reexec test. Skip test if neither can work. Patch from anton@, tweaks from me. OpenBSD-Regress-ID: 731b96ae74d02d5744e1f1a8e51d09877ffd9b6d * upstream: test compat_kex_proposal(); by dtucker@ OpenBSD-Regress-ID: 0e404ee264db546f9fdbf53390689ab5f8d38bf2 * adapt compat_kex_proposal() test to portable * update version in README * crank versions in RPM specs * remove files from libssh project * re-merge arc4random.c * re-merge misc.c * remove unused files from libssh.vcxproj * fix outstanding merge conflicts * fix build errors * modify upstream workflows to trigger on workflow dispatch instead of all PRs * fix scp client hanging with pipes * fix some failing bash tests * make bash test compatible with Windows * address scp's sftp mode buf len limitations * address review feedback * address review feedback * update comment --------- Signed-off-by: Sam James <sam@gentoo.org> Co-authored-by: djm@openbsd.org <djm@openbsd.org> Co-authored-by: Darren Tucker <dtucker@dtucker.net> Co-authored-by: Damien Miller <djm@mindrot.org> Co-authored-by: Sam James <sam@gentoo.org> Co-authored-by: jsg@openbsd.org <jsg@openbsd.org> Co-authored-by: jmc@openbsd.org <jmc@openbsd.org> Co-authored-by: dtucker@openbsd.org <dtucker@openbsd.org> Co-authored-by: Harmen Stoppels <harmenstoppels@gmail.com> Co-authored-by: Rochdi Nassah <rochdinassah.1998@gmail.com> Co-authored-by: David Korczynski <david@adalogics.com> Co-authored-by: Pierre Ossman <ossman@cendio.se> Co-authored-by: mbuhl@openbsd.org <mbuhl@openbsd.org> Co-authored-by: Rose <83477269+AtariDreams@users.noreply.github.com> Co-authored-by: cheloha@openbsd.org <cheloha@openbsd.org> Co-authored-by: deraadt@openbsd.org <deraadt@openbsd.org> Co-authored-by: tb@openbsd.org <tb@openbsd.org> Co-authored-by: millert@openbsd.org <millert@openbsd.org>	2023-02-09 16:57:36 -05:00
Tess Gauthier	316ebdca0c	Merge 9.1 (#626) ... * upstream: fix poll() spin when a channel's output fd closes without data in the channel buffer. Introduce more exact packing of channel fds into the pollfd array. fixes bz3405 and bz3411; ok deraadt@ markus@ OpenBSD-Commit-ID: 06740737849c9047785622ad5d472cb6a3907d10 * upstream: select post-quantum KEX sntrup761x25519-sha512@openssh.com as the default; ok markus@ OpenBSD-Commit-ID: f02d99cbfce22dffec2e2ab1b60905fbddf48fb9 * upstream: add support for the "corp-data" protocol extension to allow server-side copies to be performed without having to go via the client. Patch by Mike Frysinger, ok dtucker@ OpenBSD-Commit-ID: 00aa510940fedd66dab1843b58682de4eb7156d5 * upstream: add a sftp client "cp" command that supports server-side copying of files. Useful for this task and for testing the copy-data extension. Patch from Mike Frysinger; ok dtucker@ OpenBSD-Commit-ID: 1bb1b950af0d49f0d5425b1f267e197aa1b57444 * depend * Skip slow tests on (very) slow test targets. * Set Makefile SHELL as determined by configure. This should improve compatibility for users with non-POSIX shells. If using Makefile.in directly (eg make -f Makefile.in distprep) then SHELL will need to be specified on the command line (along with MANFMT in that particular case). ok djm@ * Use bash or ksh if available for SH in Makefile. * Increase test timeout to allow slow VMs to finish * Only run regression tests on slow VMs. * Only return events from ppoll that were requested. If the underlying system's select() returns bits that were not in the request set, our ppoll() implementation can return revents for events not requested, which can apparently cause a hang. Only return revents for activity in the requested event set. bz#3416, analysis and fix by yaroslav.kuzmin at vmssoftware com, ok djm@ * Specify TEST_SHELL=bash on AIX. The system shells cause the agent-restrict test to fail due to some quoting so explicitly specify bash until we can get configure to autmatically work around that. * Disable security key on fbsd6 test host. * upstream: man pages: add missing commas between subordinate and main clauses jmc@ dislikes a comma before "then" in a conditional, so leave those untouched. ok jmc@ OpenBSD-Commit-ID: 9520801729bebcb3c9fe43ad7f9776ab4dd05ea3 * upstream: ssh: document sntrup761x25519-sha512@openssh.com as default KEX OpenBSD-Commit-ID: 12545bfa10bcbf552d04d9d9520d0f4e98b0e171 * upstream: openssh-9.0 OpenBSD-Commit-ID: 0dfb461188f4513ec024c1534da8c1ce14c20b64 * update version numbers for release * update build-aux files to match autoconf-2.71 i.e. config.guess, config.sub and install-sh * Revert "update build-aux files to match autoconf-2.71" This reverts commit 0a8ca39fac6ad19096b6c263436f8b2dd51606f2. It turns out that the checked-in copies of these files are actually newer than autoconf-2.71's copies, so this was effectively a downgrade. Spotted by Bo Anderson via github * upstream: two defensive changes from Tobias Stoeckmann via GHPR287 enforce stricter invarient for sshbuf_set_parent() - never allow a buffer to have a previously-set parent changed. In sshbuf_reset(), if the reallocation fails, then zero the entire buffer and not the (potentially smaller) default initial alloc size. OpenBSD-Commit-ID: 14583203aa5d50ad38d2e209ae10abaf8955e6a9 * upstream: Note that curve25519-sha256 was later published in RFC8731. ok djm@ OpenBSD-Commit-ID: 2ac2b5d642d4cf5918eaec8653cad9a4460b2743 * upstream: clear io_want/io_ready flags at start of poll() cycle; avoids plausible spin during rekeying if channel io_want flags are reused across cycles. ok markus@ deraadt@ OpenBSD-Commit-ID: 91034f855b7c73cd2591657c49ac30f10322b967 * Retire fbsd6 test VM. It's long since out of support, relatively slow (it's i686) and the compiler has trouble with PIE. * Resync moduli.5 with upstream. 1.18: remove duplicate publication year; carsten dot kunze at arcor dot de 1.19: ssh-keygen's -G/-T have been replaced with -M generate/screen. * upstream: Correct path for system known hosts file in description of IgnoreUserKnownHosts. Patch from Martin Vahlensieck via tech@ OpenBSD-Commit-ID: 9b7784f054fa5aa4d63cb36bd563889477127215 * upstream: list the correct version number for when usage of the sftp protocol became default and fix a typo from ed maste OpenBSD-Commit-ID: 24e1795ed2283fdeacf16413c2f07503bcdebb31 * upstream: Import regenerated moduli OpenBSD-Commit-ID: f9a0726d957cf10692a231996a1f34e7f9cdfeb0 * upstream: Try to continue running local I/O for channels in state OPEN during SSH transport rekeying. The most visible benefit is that it should make ~-escapes work in the client (e.g. to exit) if the connection happened to have stalled during a rekey event. Based work by and ok dtucker@ OpenBSD-Commit-ID: a66e8f254e92edd4ce09c9f750883ec8f1ea5f45 * upstream: Import regenerated moduli OpenBSD-Commit-ID: f9a0726d957cf10692a231996a1f34e7f9cdfeb0 * upstream: regression test for sftp cp command OpenBSD-Regress-ID: c96bea9edde3a384b254785e7f9b2b24a81cdf82 * upstream: Simplify forward-control test. Since we no longer need to support SSH1 we don't need to run shell commands on the other end of the connection and can use ssh -N instead. This also makes the test less racy. OpenBSD-Regress-ID: 32e94ce272820cc398f30b848b2b0f080d10302c * upstream: Use ssh -f and ControlPersist .. to start up test forwards and ssh -O stop to shut them down intead of sleep loops. This speeds up the test by an order of magnitude. OpenBSD-Regress-ID: eb3db5f805100919b092a3b2579c611fba3e83e7 * upstream: It looks like we can't completely avoid waiting for processes to exit so retrieve the pid via controlmaster and use that. OpenBSD-Regress-ID: 8246f00f22b14e49d2ff1744c94897ead33d457b * Cache timezone data in capsicum sandbox. From emaste at freebsd.org, originally part of FreeBSD commit r339216 / fc3c19a9 with autoconf bits added by me. * Include stdlib.h for free() prototype. ... which is used inside the CUSTOM_SYS_AUTH_GET_LASTLOGIN_MSG block. * Update OpenSSL and LibreSSL versions in tests. * Add debian-riscv64 test target. * upstream: Avoid an unnecessary xstrdup in rm_env() when matching patterns. Since match_pattern() doesn't modify its arguments (they are const), there is no need to make an extra copy of the strings in options->send_env. From Martin Vahlensieck OpenBSD-Commit-ID: 2c9db31e3f4d3403b49642c64ee048b2a0a39351 * upstream: Add missing includes of stdlib.h and stdint.h. We need stdlib.h for malloc(3) and stdint.h for SIZE_MAX. Unlike the other xmss files, ssh-xmss.c does not include xmss_commons.h so ssh-xmss.c must include those headers itself. From Martin Vahlensieck OpenBSD-Commit-ID: 70e28a9818cee3da1be2ef6503d4b396dd421e6b * upstream: Remove unnecessary includes: openssl/hmac.h and openssl/evp.h. From Martin Vahlensieck. OpenBSD-Commit-ID: a6debb5fb0c8a44e43e8d5ca7cc70ad2f3ea31c3 * upstream: Check sshauthopt_new() for NULL. bz#3425, from tessgauthier at microsoft.com. ok djm@ OpenBSD-Commit-ID: af0315bc3e44aa406daa7e0ae7c2d719a974483f * upstream: Add authfd path to debug output. ok markus@ OpenBSD-Commit-ID: f735a17d1a6f2bee63bfc609d76ef8db8c090890 * upstream: avoid printing hash algorithm twice; from lucas AT sexy.is OpenBSD-Commit-ID: 9d24671e10a84141b7c504396cabad600e47a941 * upstream: fix memleak on session-bind path; from Pedro Martelletto, ok dtucker@ OpenBSD-Commit-ID: e85899a26ba402b4c0717b531317e8fc258f0a7e * upstream: Don't leak SK device. Patch from Pedro Martelletto via github PR#316. ok djm@ OpenBSD-Commit-ID: 17d11327545022e727d95fd08b213171c5a4585d * upstream: mention that the helpers are used by ssh(1), ssh-agent(1) and ssh-keygen(1). Previously only ssh(1) was mentioned. From Pedro Martelletto OpenBSD-Commit-ID: 30f880f989d4b329589c1c404315685960a5f153 * Remove now-empty int32_minmax.inc. * Only run tests when source files change. Also run tests on changes to V_9_0 branch. * Add Mac OS X 12 test target. * upstream: be stricter in which characters will be accepted in specifying a mask length; allow only 0-9. From khaleesicodes via GHPR#278; ok dtucker@ OpenBSD-Commit-ID: e267746c047ea86665cdeccef795a8a56082eeb2 * upstream: fix some integer overflows in sieve_large() that show up when trying to generate modp groups > 16k bits. Reported via GHPR#306 by Bertram Felgenhauer, but fixed in a different way. feedback/ok tb@ OpenBSD-Commit-ID: 81cbc6dd3a21c57bd6fadea10e44afe37bca558e * upstream: remove an obsolete rsa1 format example from an example; from megan batty ok djm OpenBSD-Commit-ID: db2c89879c29bf083df996bd830abfb1e70d62bf * upstream: Add FIDO AUTHENTICATOR section and explain a bit how FIDO works. The wording came mostly from the 8.2 OpenSSH release notes, addapted to fit the man page. Then move the -O bits into the new section as is already done for CERTIFICATES and MODULI GENERATION. Finally we can explain the trade-offs of resident keys. While here, consistently refer to the FIDO thingies as "FIDO authenticators", not "FIDO tokens". input & OK jmc, naddy OpenBSD-Commit-ID: dd98748d7644df048f78dcf793b3b63db9ab1d25 * upstream: make sure stdout is non-blocking; ok djm@ OpenBSD-Commit-ID: 64940fffbd1b882eda2d7c8c7a43c79368309c0d * upstream: mux.c: mark argument as const; from Martin Vahlensieck OpenBSD-Commit-ID: 69a1a93a55986c7c2ad9f733c093b46a47184341 * upstream: channel_new no longer frees remote_name. So update the comment accordingly. As remote_name is not modified, it can be const as well. From Martin Vahlensieck OpenBSD-Commit-ID: e4e10dc8dc9f40c166ea5a8e991942bedc75a76a * upstream: sshkey_unshield_private() contains a exact duplicate of the code in private2_check_padding(). Pull private2_check_padding() up so the code can be reused. From Martin Vahlensieck, ok deraadt@ OpenBSD-Commit-ID: 876884c3f0e62e8fd8d1594bab06900f971c9c85 * Add ubsan minimal testcase on OpenBSD. As suggested by djm@. * Note that, for now, we need variadic macros. * Also retest OpenBSD upstream on .yml changes. * upstream: When performing operations that glob(3) a remote path, ensure that the implicit working directory used to construct that path escapes glob(3) characters. This prevents glob characters from being processed in places they shouldn't, e.g. "cd /tmp/a*/", "get *.txt" should have the get operation treat the path "/tmp/a*" literally and not attempt to expand it. Reported by Lusia Kundel; ok markus@ OpenBSD-Commit-ID: 4f647f58482cbad3d58b1eab7f6a1691433deeef * Remove duplicate bcrypt_pbkdf.o from Makefile bcrypt_pbkdf.o is duplicated in the openbsd-compat Makefile's object file list. * upstream: improve error message when 'ssh-keygen -Y sign' is unable to load a private key; bz3429, reported by Adam Szkoda ok dtucker@ OpenBSD-Commit-ID: bb57b285e67bea536ef81b1055467be2fc380e74 * upstream: Allow existing -U (use agent) flag to work with "-Y sign" operations, where it will be interpreted to require that the private keys is hosted in an agent; bz3429, suggested by Adam Szkoda; ok dtucker@ OpenBSD-Commit-ID: a7bc69873b99c32c42c7628ed9ea91565ba08c2f * upstream: Remove errant apostrophe. From haruyama at queen-ml org. OpenBSD-Commit-ID: dc6b294567cb84b384ad6ced9ca469f2bbf0bd10 * upstream: arrange for scp, when in sftp mode, to not ftruncate(3) files early previous behavious of unconditionally truncating the destination file would cause "scp ~/foo localhost:" and "scp localhost:foo ~/" to delete all the contents of their destination. spotted by solene@ sthen@, also bz3431; ok dtucker@ OpenBSD-Commit-ID: ca39fdd39e0ec1466b9666f15cbcfddea6aaa179 * upstream: fix in-place copies; r1.163 incorrectly skipped truncation in all cases, not just at the start of a transfer. This could cause overwrites of larger files to leave junk at the end. Spotted by tb@ OpenBSD-Commit-ID: b189f19cd68119548c8e24e39c79f61e115bf92c * upstream: Only run agent-ptrace.sh if gdb is available as all architectures do not ship with gdb. OpenBSD-Regress-ID: ec53e928803e6b87f9ac142d38888ca79a45348d * upstream: regress test for in-place transfers and clobbering larger files with smaller ones; would have caught last regression in scp(1) OpenBSD-Regress-ID: 19de4e88dd3a4f7e5c1618c9be3c32415bd93bc2 * configure.ac: Add missing AC_DEFINE for caph_cache_tzdata test causing HAVE_CAPH_CACHE_TZDATA to be missing from config.h.in. Spotted by Bryan Drewery * upstream: make SSHBUF_DBG/SSHBUF_TELL (off by default and only enabled via #define) dump to stderr rather than stdout OpenBSD-Commit-ID: 10298513ee32db8390aecb0397d782d68cb14318 * upstream: revert previous; it was broken (spotted by Theo) OpenBSD-Commit-ID: 457c79afaca2f89ec2606405c1059b98b30d8b0d * upstream: Note that ProxyJump also accepts the same tokens as ProxyCommand. From pallxk via github PR#305. OpenBSD-Commit-ID: 7115ac351b129205f1f1ffa6bbfd62abd76be7c5 * upstream: Avoid kill with -1 argument. The out_ctx label can be reached before fork has been called. If this happens, then kill -1 would be called, sending SIGTERM to all processes reachable by the current process. From tobias@ and c3h2_ctf via github PR#286, ok djm@ OpenBSD-Commit-ID: 6277af1207d81202f5daffdccfeeaed4c763b1a8 * upstream: f sshpkt functions fail, then password is not cleared with freezero. Unconditionally call freezero to guarantee that password is removed from RAM. From tobias@ and c3h2_ctf via github PR#286, ok djm@ OpenBSD-Commit-ID: 6b093619c9515328e25b0f8093779c52402c89cd * upstream: refactor authorized_keys/principals handling remove "struct ssh *" from arguments - this was only used to pass the remote host/address. These can be passed in instead and the resulting code is less tightly coupled to ssh_api.[ch] ok dtucker@ OpenBSD-Commit-ID: 9d4373d013edc4cc4b5c21a599e1837ac31dda0d * upstream: split the low-level file handling functions out from auth2-pubkey.c Put them in a new auth2-pubkeyfile.c to make it easier to refer to them (e.g. in unit/fuzz tests) without having to refer to everything else pubkey auth brings in. ok dtucker@ OpenBSD-Commit-ID: 3fdca2c61ad97dc1b8d4a7346816f83dc4ce2217 * fuzzer for authorized_keys parsing mostly redundant to authopt_fuzz, but it's sensitive code so IMO it makes sense to test this layer too * Test against LibreSSL 3.5.3. * Test against OpenSSL 1.1.1o and 3.0.3. * fix some bugs in the fuzzer * upstream: keywords ref ssh_config.5; from caspar schutijser OpenBSD-Commit-ID: f146a19d7d5c9374c3b9c520da43b2732d7d1a4e * upstream: ssh-keygen: implement "verify-required" certificate option. This was already documented when support for user-verified FIDO keys was added, but the ssh-keygen(1) code was missing. ok djm@ OpenBSD-Commit-ID: f660f973391b593fea4b7b25913c9a15c3eb8a06 * upstream: ssh-keygen -A: do not generate DSA keys by default. Based on github PR#303 from jsegitz with man page text from jmc@, ok markus@ djm@ OpenBSD-Commit-ID: 5c4c57bdd7063ff03381cfb6696659dd3f9f5b9f * upstream: Add period at end of "not known by any other names" message. github PR#320 from jschauma, ok djm@ OpenBSD-Commit-ID: bd60809803c4bfd3ebb7c5c4d918b10e275266f2 * upstream: Add missing *-sk types to ssh-keyscan manpage. From skazi0 via github PR#294. OpenBSD-Commit-ID: fda2c869cdb871f3c90a89fb3f985370bb5d25c0 * upstream: Make SetEnv directives first-match-wins in both sshd_config and sshd_config; previously if the same name was reused then the last would win (which is the opposite to how the config is supposed to work). While there, make the ssh_config parsing more like sshd_config. bz3438, ok dtucker OpenBSD-Commit-ID: 797909c1e0262c0d00e09280459d7ab00f18273b * upstream: test setenv in both client and server, test first-match-wins too OpenBSD-Regress-ID: 4c8804f9db38a02db480b9923317457b377fe34b * upstream: move auth_openprincipals() and auth_openkeyfile() over to auth2-pubkeyfile.c too; they make more sense there. OpenBSD-Commit-ID: 9970d99f900e1117fdaab13e9e910a621b7c60ee * upstream: make sure that UseDNS hostname lookup happens in the monitor and not in the pledge(2)'d unprivileged process; fixes regression caused by recent refactoring spotted by henning@ OpenBSD-Commit-ID: a089870b95101cd8881a2dff65b2f1627d13e88d * fix possible NULL deref when built without FIDO Analysis/fix from kircher in bz3443; ok dtucker@ * automatically enable built-in FIDO support If libfido2 is found and usable, then enable the built-in security key support unless --without-security-key-builtin was requested. ok dtucker@ * upstream: Log an error if pipe() fails while accepting a connection. bz#3447, from vincent-openssh at vinc17 net, ok djm@ OpenBSD-Commit-ID: 9d59f19872b94900a5c79da2d57850241ac5df94 * upstream: Don't attempt to fprintf a null identity comment. From Martin Vahlensieck via tech@. OpenBSD-Commit-ID: 4c54d20a8e8e4e9912c38a7b4ef5bfc5ca2e05c2 * upstream: Make sure not to fclose() the same fd twice in case of an error. ok dtucker@ OpenBSD-Commit-ID: e384c4e05d5521e7866b3d53ca59acd2a86eef99 * upstream: make it clear that RekeyLimit applies to both transmitted and received data. GHPR#328 from Jan Pazdziora OpenBSD-Commit-ID: d180a905fec9ff418a75c07bb96ea41c9308c3f9 * request 1.1x API compatibility for OpenSSL >=3.x idea/patch from Pedro Martelletto via GHPR#322; ok dtucker@ * fix broken case statement in previous * Disable SK support if FIDO libs not found. * Zero out LIBFIDO2 when SK support not usable. Prevents us from trying to link them into ssh-sk-helper and failing to build. * upstream: Don't leak the strings allocated by order_hostkeyalgs() and list_hostkey_types() that are passed to compat_pkalg_proposal(). Part of github PR#324 from ZoltanFridrich, ok djm@ OpenBSD-Commit-ID: b2f6e5f60f2bba293b831654328a8a0035ef4a1b * upstream: Roll back previous KEX changes as they aren't safe until compat_pkalg_proposal and friends always allocate their returned strings. Reported by Qualys. OpenBSD-Commit-ID: 1c7a88a0d5033f42f88ab9bec58ef1cf72c81ad0 * upstream: allow arguments to sftp -D option, e.g. sftp -D "/usr/libexec/sftp-server -el debug3" ok markus@ OpenBSD-Commit-ID: 5a002b9f3a7aef2731fc0ffa9c921cf15f38ecce * Update OpenSSL tests to the most recent releases. * upstream: reflect the update to -D arg name in usage(); OpenBSD-Commit-ID: abdcde4f92b1ef094ae44210ee99d3b0155aad9c * upstream: ignore SIGPIPE earlier in main(), specifically before muxclient() which performs operations that could cause one; Reported by Noam Lewis via bz3454, ok dtucker@ OpenBSD-Commit-ID: 63d8e13276869eebac6d7a05d5a96307f9026e47 * upstream: Always return allocated strings from the kex filtering so that we can free them later. Fix one leak in compat_kex_proposal. Based on github PR#324 from ZoltanFridrich with some simplications by me. ok djm@ OpenBSD-Commit-ID: 9171616da3307612d0ede086fd511142f91246e4 * upstream: Don't leak the strings allocated by order_hostkeyalgs() and list_hostkey_types() that are passed to compat_pkalg_proposal(). Part of github PR#324 from ZoltanFridrich, ok djm@ This is a roll-forward of the previous rollback now that the required changes in compat.c have been done. OpenBSD-Commit-ID: c7cd93730b3b9f53cdad3ae32462922834ef73eb * upstream: bump up loglevel from debug to info when unable to open authorized keys/principals file for errno != ENOENT; bz2042 ok dtucker OpenBSD-Commit-ID: e79aa550d91ade6a80f081bda689da24c086d66b * Skip select+rlimit check if sandboxing is disabled It's not needed in that case, and the test can fail when being built with some compiler memory sanitizer flags. bz#3441 * upstream: use consistent field names (s/char/byte) in format description OpenBSD-Commit-ID: 3de33572733ee7fcfd7db33d37db23d2280254f0 * upstream: Remove leftover line. Remove extra line leftover from merge conflict. ok djm@ OpenBSD-Commit-ID: 460e2290875d7ae64971a7e669c244b1d1c0ae2e * Move checks for pollfd.fd and nfds_t. Move the checks for struct pollfd.fd and nfds_t to before the sandboxing checks. This groups all the sandbox checks together so we can skip them all when sandboxing is disabled. * Skip all rlimit tests when sandboxing disabled. The rlimit tests can hang when being run with some compiler sanitizers so skip all of them if sandbox=no. * Add clang sanitizer tests. * upstream: Add TEST_REGRESS_CACHE_DIR. If set, it is used to cache regress test names that have succeeded and skip those on a re-run. OpenBSD-Regress-ID: a7570dd29a58df59f2cca647c3c2ec989b49f247 * Move sanitizer logs into regress for collection. * Add GCC address sanitizer build/test. * Update sanitizer test targets: - remove clang-sanitize-memory for now. It takes so long that the test times out. - add gcc sanitize-address and sanitize-undefined test targets. * Test against openssl-3.0.5. * Move unset to before we set anything. * Refuse to use OpenSSL 3.0.4 due to potential RCE. OpenSSL has a potential RCE in its RSA implementation (CVE-2022-2274) so refuse to use that specific version. * Capture stderr output from configure. * Only refuse to use OpenSSL 3.0.4 on x86_64. The potential RCE only impacts x86_64, so only refuse to use it if we're targetting a potentially impacted architecture. ok djm@ * Remove special casing of crypt(). Configure goes to some lengths to pick crypt() from either libcrypt or OpenSSL's libcrypto because they can more or less featureful (eg supporting md5-style passwords). OpenSSL removed its crypt() interface in 2002: https://github.com/openssl/openssl/commit/69deec58 so these hijinks should no longer be necessary. This also only links sshd with libcrypt which is the only thing that needs it. ok djm@ * Clarify README.md text. Clarify the text about the implications of building without OpenSSL, and prefix the "configure --help" example command with a "./" so it's likely to work as-is in more shells. From bz#3461. * Split README.platform into its own line. README.platform has general platform-specific information, having it following text about FIDO2 on the same line could imply that it only has information about FIDO2. * Return ERANGE from getcwd() if buffer size is 1. If getcwd() is supplied a buffer size of exactly 1 and a path of "/", it could result in a nul byte being written out of array bounds. POSIX says it should return ERANGE if the path will not fit in the available buffer (with terminating nul). 1 byte cannot fit any possible path with its nul, so immediately return ERANGE in that case. OpenSSH never uses getcwd() with this buffer size, and all current (and even quite old) platforms that we are currently known to work on have a native getcwd() so this code is not used on those anyway. Reported by Qualys, ok djm@ * Remove unintended changes. I inadvertently included a couple of local changes with the OpenSSL 3.0.4 change. Revert, anything that should be there will be committed separately. * Add AUDIT_ARCH_PPC to supported seccomp arches. Patch from dries.deschout at dodeco.eu. * Rename bbone test target to ARM. * Move vmshutdown to first step. If a previous run on a physical runner has failed to clean up, the next run will fail because it'll try to check out the code to a broken directory mount. Make cleanup the first step. * upstream: pull passphrase reading and confirmation into a separate function so it can be used for FIDO2 PINs; no functional change OpenBSD-Commit-ID: bf34f76b8283cc1d3f54633e0d4f13613d87bb2f * upstream: when enrolling a resident key on a security token, check if a credential with matching application and user ID strings already exists. if so, prompt the user for confirmation before overwriting the credential. patch from Pedro Martelletto via GHPR329 NB. cranks SSH_SK_VERSION_MAJOR, so any third-party FIDO middleware implementations will need to adjust OpenBSD-Commit-ID: e45e9f1bf2b2f32d9850669e7a8dbd64acc5fca4 * upstream: sk-usbhid: preserve error code returned by key_lookup() it conveys useful information, such as the supplied pin being wrong. Part of GHPR329 from Pedro Martelletto OpenBSD-Commit-ID: c0647eb9290f793add363d81378439b273756c1b * upstream: ssh-keygen: fix touch prompt, pin retries; part of GHPR329 from Pedro Martelletto OpenBSD-Commit-ID: 75d1005bd2ef8f29fa834c90d2684e73556fffe8 * crank SSH_SK_VERSION_MAJOR in sk-dummy.so * Skip scp3 test if there's no scp on remote path. scp -3 ends up using the scp that's in the remote path and will fail if one is not available. Based on a patch from rapier at psc.edu. * Convert "have_prog" function into "which". "which" and its behaviour is not standardized, so convert the existing have_prog function into "which" so we can rely on it being available and what its semantics are. Add a have_prog wrapper that maintains the existing behaviour. * upstream: Test TEST_SSH_ELAPSED_TIMES for empty string not executable. No-op on most platforms but should prevent warnings in -portable on systems that don't have 'date %s'. OpenBSD-Regress-ID: e39d79867b8065e33d0c5926fa1a31f85659d2a4 * upstream: Restore missing "!" in TEST_SSH_ELAPSED_TIMES test. OpenBSD-Regress-ID: 38783f9676ec348c5a792caecee9a16e354b37b0 * Remove workarounds for OpenSSL missing AES-GCM. We have some compatibility hacks that were added to support OpenSSL versions that do not support AES GCM mode. Since that time, however, the minimum OpenSSL version that we support has moved to 1.0.1 which *does* have GCM, so this is no longer needed. ok djm@ * Remove workarounds for OpenSSL missing AES-CTR. We have some compatibility hacks that were added to support OpenSSL versions that do not support AES CTR mode. Since that time, however, the minimum OpenSSL version that we support has moved to 1.0.1 which *does* have CTR, so this is no longer needed. ok djm@ * Do not link scp, sftp and sftp-server w/ zlib. Some of our binaries (eg sftp, sftp-server, scp) do not interact with the channels code and thus do use libraries such as zlib and libcrypto although they are linked with them. This adds a CHANNELLIBS and starts by moving zlib into it, which means the aformentioned binaries are no longer linked against zlib. ok djm@ * Group libcrypto and PRNGD checks together. They're related more than the libcrypt or libiaf checks which are currently between them. ok djm@ * Remove seed_rng calls from scp, sftp, sftp-server. These binaries don't use OpenSSL's random functions. The next step will be to stop linking them against libcrypto. ok djm@ * Move libcrypto into CHANNELLIBS. This will result in sftp, sftp-server and scp no longer being linked against libcrypto. ok djm@ * Move stale-configure check as early as possible. We added a check in Makefile to catch the case where configure needs to be rebuilt, however this did not happen until a build was attempted in which case all of the work done by configure was wasted. Move this check to the start of configure to catch it as early as possible. ok djm@ * Remove deprecated MacOS 10.15 runners. * upstream: avoid double-free in error path introduced in r1.70; report and fix based on GHPR#332 by v-rzh ok dtucker@ OpenBSD-Commit-ID: 3d21aa127b1f37cfc5bdc21461db369a663a951f * Include CHANNEL and FIDO2 libs in configure output * Factor out getrnd() and rename to getentropy(). Factor out the arc4random seeding into its own file and change the interface to match getentropy. Use native getentropy if available. This will make it easier to resync OpenBSD changes to arc4random. Prompted by bz#3467, ok djm@. * compat code for fido_dev_is_winhello() Signed-off-by: Corinna Vinschen <vinschen@redhat.com> * check_sk_options: add temporary WinHello workaround Up to libfido 1.10.0, WinHello advertises "clientPin" rather than "uv" capability. This is fixed in 1.11.0. For the time being, workaround it here. Signed-off-by: Corinna Vinschen <vinschen@redhat.com> * sk_sign: set FIDO2 uv attribute explicitely for WinHello WinHello via libfido2 performs user verification by default. However, if we stick to that, there's no way to differentiate between keys created with or without "-O verify-required". Set FIDO2 uv attribute explicitely to FIDO_OPT_FALSE, then check if user verification has been requested. Signed-off-by: Corinna Vinschen <vinschen@redhat.com> * upstream: don't prompt for FIDO passphrase before attempting to enroll the credential, just let the enroll operating fail and we'll attempt to get a PIN anyway. Might avoid some unneccessary PIN prompts. Part of GHPR#302 from Corinna Vinschen; ok dtucker@ OpenBSD-Commit-ID: bd5342ffc353ee37d39617906867c305564d1ce2 * Give unused param a name. Fixes builds on platforms that do have fido2 but don't have fido_dev_is_winhello. * Actually put HAVE_STDINT_H around the stdint.h. * Rename our getentropy to prevent possible loops. Since arc4random seeds from getentropy, and we use OpenSSL for that if enabled, there's the possibility that if we build on a system that does not have getentropy then run on a system that does have it, then OpenSSL could end up calling our getentropy and getting stuck in a loop. Pointed out by deraadt@, ok djm@ * Test hostbased auth on github runners. * fix SANDBOX_SECCOMP_FILTER_DEBUG * Fix conditional for running hostbased tests. * upstream: allow certificate validity intervals, sshsig verification times and authorized_keys expiry-time options to accept dates in the UTC time zone in addition to the default of interpreting them in the system time zone. YYYYMMDD and YYMMDDHHMM[SS] dates/times will be interpreted as UTC if suffixed with a 'Z' character. Also allow certificate validity intervals to be specified in raw seconds-since-epoch as hex value, e.g. -V 0x1234:0x4567890. This is intended for use by regress tests and other tools that call ssh-keygen as part of a CA workflow. bz3468 ok dtucker OpenBSD-Commit-ID: 454db1cdffa9fa346aea5211223a2ce0588dfe13 * upstream: add some tests for parse_absolute_time(), including cases where it is forced to the UTC timezone. bz3468 ok dtucker OpenBSD-Regress-ID: ea07ca31c2f3847a38df028ca632763ae44e8759 * Skip hostbased during Valgrind tests. Valgrind doesn't let ssh exec ssh-keysign (because it's setuid) so skip it during the Valgrind based tests. See https://bugs.kde.org/show_bug.cgi?id=119404 for a discussion of this (ironically there the problematic binary was ssh(1) back when it could still be setuid). * Rerun tests if any .github config file changes. * Add a timegm implementation from Heimdal via Samba. Fixes build on (at least Solaris 10). * Replace deprecated ubuntu-18.04 runners with 22.04 * upstream: sftp-server: support home-directory request Add support to the sftp-server for the home-directory extension defined in draft-ietf-secsh-filexfer-extensions-00. This overlaps a bit with the existing expand-path@openssh.com, but uses a more official protocol name, and so is a bit more likely to be implemented by non-OpenSSH clients. From Mike Frysinger, ok dtucker@ OpenBSD-Commit-ID: bfc580d05cc0c817831ae7ecbac4a481c23566ab * fido_dev_is_winhello: return 0, not "false" "false" is not used anywhere in OpenSSH, so return 0 like everywhere else. Signed-off-by: Corinna Vinschen <vinschen@redhat.com> * Revert "check_sk_options: add temporary WinHello workaround" Cygwin now comes with libfido2 1.11.0, so this workaround isn't required anymore. This reverts commit 242c044ab111a37aad3b0775727c36a4c5f0102c. Signed-off-by: Corinna Vinschen <vinschen@redhat.com> * upstream: use .Cm for "sign"; from josiah frentsos OpenBSD-Commit-ID: 7f80a53d54857ac6ae49ea6ad93c5bd12231d1e4 * upstream: add an extra flag to sk_probe() to indicate whether we're probing for a FIDO resident key or not. Unused here, but will make like easier for portable OpenBSD-Commit-ID: 432c8ff70e270378df9dbceb9bdeaa5b43b5a832 * on Cygwin, prefer WinHello FIDO device If no FIDO device was explictly specified, then prefer the windows://hello FIDO device. An exception to this is when probing resident FIDO keys, in which case hardware FIDO devices are preferred. * Check for perms to run agent-getpeereid test. Ubuntu 22.04 defaults to private home dirs which prevents "nobody" running ssh-add during the agent-getpeereid test. Check for this and add the necessary permissions. * upstream: double free() in error path; from Eusgor via GHPR333 OpenBSD-Commit-ID: 39f35e16ba878c8d02b4d01d8826d9b321be26d4 * Add Cygwin (on windows-2019) test target. In addition to installing the requisite Cygwin packages, we also need to explicitly invoke "sh" for steps that run other scripts since the runner environment doesn't understand #! paths. * Add a bit more debug output. * Fix cygwin conditional steps. * upstream: Strictly enforce the maximum allowed SSH2 banner size in ssh-keyscan and prevent a one-byte buffer overflow. Patch from Qualys, ok djm@ OpenBSD-Commit-ID: 6ae664f9f4db6e8a0589425f74cd0bbf3aeef4e4 * upstream: remove incorrect check that can break enrolling a resident key (introduced in r1.40) OpenBSD-Commit-ID: 4cab364d518470e29e624af3d3f9ffa9c92b6f01 * upstream: attemp FIDO key signing without PIN and use the error code returned to fall back only if necessary. Avoids PIN prompts for FIDO tokens that don't require them; part of GHPR#302 OpenBSD-Commit-ID: 4f752aaf9f2e7c28bcaaf3d4f8fc290131bd038e * Install Cygwin packages based on OS not config. * initial list of allowed signers * upstream: whitespace OpenBSD-Commit-ID: d297e4387935d4aef091c5e9432578c2e513f538 * upstream: whitespace OpenBSD-Commit-ID: a5d015efbfd228dc598ffdef612d2da3a579e5d8 * Add cygwin-release test target. This also moves the cygwin package install from the workflow file to setup_ci.sh so that we can install different sets of Cygwin packages for different test configs. * Add Windows 2022 test targets. * Add libcrypt-devel to cygwin-release deps. Based on feedback from vinschen at redhat.com. * cross-sign allowed_signers with PGP key Provides continuity of trust from legacy PGP release key to the SSHSIG signing keys that we will use henceforth for git signing. * additional keys * upstream: whitespace OpenBSD-Commit-ID: c2bcbf93610d3d62ed206cdf9bf9ff98c6aaf232 * Move sftp from valgrind-2 to 3 to rebalance. * upstream: sk-usbhid: fix key_lookup() on tokens with built-in UV explicitly test whether the token performs built-in UV (e.g. biometric tokens) and enable UV in that case. From Pedro Martelletto via GHPR#388 OpenBSD-Commit-ID: 007eb7e387d27cf3029ab06b88224e03eca62ccd * Remove arc4random_uniform from arc4random.c This was previously moved into its own file (matching OpenBSD) which prematurely committed in commit 73541f2. * Move OPENBSD ORIGINAL marker. Putting this after the copyright statement (which doesn't change) instead of before the version identifier (which does) prevents merge conflicts when resyncing changes. * Resync arc4random with OpenBSD. This brings us up to current, including djm's random-reseeding change, as prompted by logan at cyberstorm.mu in bz#3467. It brings the platform-specific hooks from LibreSSL Portable, simplified to match our use case. ok djm@. * Remove DEF_WEAK, it's already in defines.h. * openbsd-compat/bsd-asprintf: add <stdio.h> include for vsnprintf Fixes the following build failure with Clang 15 on musl: ``` bsd-asprintf.c:51:8: error: call to undeclared library function 'vsnprintf' with type 'int (char *, unsigned long, const char *, struct __va_list_tag *)'; ISO C99 and laterclang -O2 -pipe -fdiagnostics-color=always -frecord-gcc-switches -pipe -Wunknown-warning-option -Qunused-arguments -Wall -Wpointer-arith -Wuninitialized -Wsign-compare -Wformat-security -Wsizeof-pointer-memaccess -Wno-pointer-sign -Wno-unused-result -Wmisleading-indentation -Wbitwise-instead-of-logical -fno-strict-aliasing -mretpoline -ftrapv -fzero-call-used-regs=all -fno-builtin-memset -fstack-protector-strong -fPIE -I. -I. -D_XOPEN_SOURCE=600 -D_BSD_SOURCE -D_DEFAULT_SOURCE -DSSHDIR=\"/etc/ssh\" -D_PATH_SSH_PROGRAM=\"/usr/bin/ssh\" -D_PATH_SSH_ASKPASS_DEFAULT=\"/usr/lib/misc/ssh-askpass\" -D_PATH_SFTP_SERVER=\"/usr/lib/misc/sftp-server\" -D_PATH_SSH_KEY_SIGN=\"/usr/lib/misc/ssh-keysign\" -D_PATH_SSH_PKCS11_HELPER=\"/usr/lib/misc/ssh-pkcs11-helper\" -D_PATH_SSH_SK_HELPER=\"/usr/lib/misc/ssh-sk-helper\" -D_PATH_SSH_PIDDIR=\"/run\" -D_PATH_PRIVSEP_CHROOT_DIR=\"/var/empty\" -DHAVE_CONFIG_H -c cipher-aes.c -o cipher-aes.o do not support implicit function declarations [-Wimplicit-function-declaration] ret = vsnprintf(string, INIT_SZ, fmt, ap2); ^ bsd-asprintf.c:51:8: note: include the header <stdio.h> or explicitly provide a declaration for 'vsnprintf' 1 error generated. ``` * upstream: notifier_complete(NULL, ...) is a noop, so no need to test that ctx!=NULL; from Corinna Vinschen OpenBSD-Commit-ID: ade2f2e9cc519d01a586800c25621d910bce384a * fix pester test failures * upstream: fix repeated words ok miod@ jmc@ OpenBSD-Commit-ID: 6765daefe26a6b648cc15cadbbe337596af709b7 * upstream: .Li -> .Vt where appropriate; from josiah frentsos, tweaked by schwarze ok schwarze OpenBSD-Commit-ID: 565046e3ce68b46c2f440a93d67c2a92726de8ed * upstream: ssh-agent: attempt FIDO key signing without PIN and use the error to determine whether a PIN is required and prompt only if necessary. from Corinna Vinschen OpenBSD-Commit-ID: dd6be6a0b7148608e834ee737c3479b3270b00dd * upstream: a little extra debugging OpenBSD-Commit-ID: edf1601c1d0905f6da4c713f4d9cecc7d1c0295a * upstream: sk_enroll: never drop SSH_SK_USER_VERIFICATION_REQD flag from response Now that all FIDO signing calls attempt first without PIN and then fall back to trying PIN only if that attempt fails, we can remove the hack^wtrick that removed the UV flag from the keys returned during enroll. By Corinna Vinschen OpenBSD-Commit-ID: 684517608c8491503bf80cd175425f0178d91d7f * define HAVE_KILLPG * upstream: sftp: Don't attempt to complete arguments for non-existent commands If user entered a non-existent command (e.g. because they made a typo) there is no point in trying to complete its arguments. Skip calling complete_match() if that's the case. From Michal Privoznik OpenBSD-Commit-ID: cf39c811a68cde2aeb98fc85addea4000ef6b07a * upstream: sftp: Be a bit more clever about completions There are commands (e.g. "get" or "put") that accept two arguments, a local path and a remote path. However, the way current completion is written doesn't take this distinction into account and always completes remote or local paths. By expanding CMD struct and "cmds" array this distinction can be reflected and with small adjustment to completer code the correct path can be completed. By Michal Privoznik, ok dtucker@ OpenBSD-Commit-ID: 1396d921c4eb1befd531f5c4a8ab47e7a74b610b * upstream: correct error value OpenBSD-Commit-ID: 780efcbad76281f11f14b2a5ff04eb6db3dfdad4 * upstream: actually hook up restrict_websafe; the command-line flag was never actually used. Spotted by Matthew Garrett OpenBSD-Commit-ID: 0b363518ac4c2819dbaa3dfad4028633ab9cdff1 * upstream: Add a sshkey_check_rsa_length() call for checking the length of an RSA key; ok markus@ OpenBSD-Commit-ID: de77cd5b11594297eda82edc594b0d32b8535134 * upstream: add a RequiredRSASize for checking RSA key length in ssh(1). User authentication keys that fall beneath this limit will be ignored. If a host presents a host key beneath this limit then the connection will be terminated (unfortunately there are no fallbacks in the protocol for host authentication). feedback deraadt, Dmitry Belyavskiy; ok markus@ OpenBSD-Commit-ID: 430e339b2a79fa9ecc63f2837b06fdd88a7da13a * upstream: Add RequiredRSASize for sshd(8); RSA keys that fall beneath this limit will be ignored for user and host-based authentication. Feedback deraadt@ ok markus@ OpenBSD-Commit-ID: 187931dfc19d51873df5930a04f2d972adf1f7f1 * upstream: better debugging for connect_next() OpenBSD-Commit-ID: d16a307a0711499c971807f324484ed3a6036640 * upstream: sftp-server(8): add a "users-groups-by-id@openssh.com" extension request that allows the client to obtain user/group names that correspond to a set of uids/gids. Will be used to make directory listings more useful and consistent in sftp(1). ok markus@ OpenBSD-Commit-ID: 7ebabde0bcb95ef949c4840fe89e697e30df47d3 * upstream: extend sftp-common.c:extend ls_file() to support supplied user/group names; ok markus@ OpenBSD-Commit-ID: c70c70498b1fdcf158531117e405b6245863bfb0 * upstream: sftp client library support for users-groups-by-id@openssh.com; ok markus@ OpenBSD-Commit-ID: ddb2f33a2da6349a9a89a8b5bcb9ca7c999394de * upstream: use users-groups-by-id@openssh.com sftp-server extension (when available) to fill in user/group names for directory listings. Implement a client-side cache of see uid/gid=>user/group names. ok markus@ OpenBSD-Commit-ID: f239aeeadfa925a37ceee36ee8b256b8ccf4466e * avoid Wuninitialized false positive in gcc-12ish * no need for glob.h here it also causes portability problems * add debug on appveyor * add sleep to pester test * upstream: add RequiredRSASize to the list of keywords accepted by -o; spotted by jmc@ OpenBSD-Commit-ID: fe871408cf6f9d3699afeda876f8adbac86a035e * upstream: Fix typo. From AlexanderStohr via github PR#343. OpenBSD-Commit-ID: a134c9b4039e48803fc6a87f955b0f4a03181497 * upstream: openssh-9.1 OpenBSD-Commit-ID: 5a467b2ee81da01a86adf1ad93b62b1728494e56 * crank versions in RPM spec files * update release notes URL * update .depend * fix 9.1 compilation errors * disable -p pester tests due to unreliability on older Windows versions * remove extra sleep time from debugging scp pester tests * modify -p tests to only run for Windows OS version 10 and above * add windows specific code back into method moved from auth.c to auth2-pubkeyfile.c * add preprocessor for WinHello * revert preprocessor definition for winhello * add windows preprocessor definition in key_lookup * remove rdp block from appveyor since we are no longer debugging * add ifdef to sftp-server.c * make key_lookup compatible with winhello * appveyor.yml * increase debug of failing pester test * add #ifdef SUPPORT_CRLF back into auth_check_principals_line method that was moved/renamed * modify new scp.sh tests for windows * remove in place tests from scp.sh * remove rdp debug from appveyor * retrigger appveyor * change check of OS version in scp test Signed-off-by: Corinna Vinschen <vinschen@redhat.com> Co-authored-by: djm@openbsd.org <djm@openbsd.org> Co-authored-by: Damien Miller <djm@mindrot.org> Co-authored-by: Darren Tucker <dtucker@dtucker.net> Co-authored-by: naddy@openbsd.org <naddy@openbsd.org> Co-authored-by: dtucker@openbsd.org <dtucker@openbsd.org> Co-authored-by: tj@openbsd.org <tj@openbsd.org> Co-authored-by: millert@openbsd.org <millert@openbsd.org> Co-authored-by: jmc@openbsd.org <jmc@openbsd.org> Co-authored-by: florian@openbsd.org <florian@openbsd.org> Co-authored-by: markus@openbsd.org <markus@openbsd.org> Co-authored-by: Tobias Heider <me@tobhe.de> Co-authored-by: anton@openbsd.org <anton@openbsd.org> Co-authored-by: Tim Rice <tim@multitalents.net> Co-authored-by: tobhe@openbsd.org <tobhe@openbsd.org> Co-authored-by: Corinna Vinschen <vinschen@redhat.com> Co-authored-by: Sam James <sam@gentoo.org> Co-authored-by: jsg@openbsd.org <jsg@openbsd.org>	2022-11-02 12:06:45 -04:00
jsg@openbsd.org	86cc93fd3c	upstream: remove please from manual pages ok jmc@ sthen@ millert@ ... OpenBSD-Commit-ID: 6543acb00f4f38a23472538e1685c013ca1a99aa	2022-02-07 12:27:48 +11:00
dtucker@openbsd.org	ad16a84e64	upstream: Since they are deprecated, move DSA to the end of the ... default list of public keys so that they will be tried last. From github PR#295 from "ProBackup-nl", ok djm@ OpenBSD-Commit-ID: 7e5d575cf4971d4e2de92e0b6d6efaba53598bf0	2022-02-07 12:27:48 +11:00
dtucker@openbsd.org	66a658b5d9	upstream: Document behaviour of arguments following non-interactive ... commands. Prompted by github PR#139 from EvanTheB, feedback & ok djm@ jmc@ OpenBSD-Commit-ID: fc758d1fe0471dfab4304fcad6cd4ecc3d79162a	2021-09-10 20:34:09 +10:00
dtucker@openbsd.org	8d1d9eb6de	upstream: Mention using ssh -i for specifying the public key file ... in the case where the private key is loaded into ssh-agent but is not present locally. Based on patch from rafork via github PR#215, ok jmc@ OpenBSD-Commit-ID: 2282e83b0ff78d2efbe705883b67240745fa5bb2	2021-09-03 17:33:08 +10:00
jmc@openbsd.org	4455aec2e4	upstream: no need to talk about version 2 with the -Q option, so ... rewrite the text to read better; issue reported by debian at helgefjell de ok djm dtucker OpenBSD-Commit-ID: 59fe2e8219c37906740ad062e0fdaea487dbe9cf	2021-08-03 09:39:57 +10:00
djm@openbsd.org	a917e973a1	upstream: Add a ForkAfterAuthentication ssh_config(5) counterpart ... to the ssh(1) -f flag. Last part of GHPR231 from Volker Diels-Grabsch. ok dtucker OpenBSD-Commit-ID: b18aeda12efdebe2093d55263c90fe4ea0bce0d3	2021-07-23 14:07:19 +10:00
djm@openbsd.org	e0c5088f1c	upstream: Add a StdinNull directive to ssh_config(5) that allows ... the config file to do the same thing as -n does on the ssh(1) commandline. Patch from Volker Diels-Grabsch via GHPR231; ok dtucker OpenBSD-Commit-ID: 66ddf3f15c76796d4dcd22ff464aed1edd62468e	2021-07-23 14:07:19 +10:00
djm@openbsd.org	eda8909d1b	upstream: add a SessionType directive to ssh_config, allowing the ... configuration file to offer equivalent control to the -N (no session) and -s (subsystem) command-line flags. Part of GHPR#231 by Volker Diels-Grabsch with some minor tweaks; feedback and ok dtucker@ OpenBSD-Commit-ID: 726ee931dd4c5cc7f1d7a187b26f41257f9a2d12	2021-07-14 09:49:47 +10:00
Darren Tucker	53237ac789	Sync remaining ChallengeResponse removal. ... These were omitted from commit 88868fd131.	2021-07-03 19:23:28 +10:00
dtucker@openbsd.org	2a5704ec14	upstream: Use better language to refer to the user. From l1ving ... via github PR#250, ok jmc@ OpenBSD-Commit-ID: 07ca3526626996613e128aeddf7748c93c4d6bbf	2021-06-25 16:32:34 +10:00
markus@openbsd.org	da0a9afcc4	upstream: ssh: add PermitRemoteOpen for remote dynamic forwarding ... with SOCKS ok djm@, dtucker@ OpenBSD-Commit-ID: 64fe7b6360acc4ea56aa61b66498b5ecc0a96a7c	2021-02-17 15:03:41 +11:00
naddy@openbsd.org	507b448a24	upstream: move HostbasedAcceptedAlgorithms to the right place in ... alphabetical order OpenBSD-Commit-ID: d766820d33dd874d944c14b0638239adb522c7ec	2021-01-27 11:45:50 +11:00
dtucker@openbsd.org	e9f78d6b06	upstream: Rename HostbasedKeyTypes (ssh) and ... HostbasedAcceptedKeyTypes (sshd) to HostbasedAcceptedAlgorithms, which more accurately reflects its effect. This matches a previous change to PubkeyAcceptedAlgorithms. The previous names are retained as aliases. ok djm@ OpenBSD-Commit-ID: 49451c382adc6e69d3fa0e0663eeef2daa4b199e	2021-01-26 22:50:40 +11:00
dtucker@openbsd.org	b55b7565f1	upstream: PubkeyAcceptedKeyTypes->PubkeyAcceptedAlgorithms ... here too. OpenBSD-Commit-ID: 3b64a640f8ce8c21d9314da9df7ce2420eefde3a	2021-01-22 15:05:00 +11:00
djm@openbsd.org	da4bf0db94	upstream: add a ssh_config KnownHostsCommand that allows the client ... to obtain known_hosts data from a command in addition to the usual files. The command accepts bunch of %-expansions, including details of the connection and the offered server host key. Note that the command may be invoked up to three times per connection (see the manpage for details). ok markus@ OpenBSD-Commit-ID: 2433cff4fb323918ae968da6ff38feb99b4d33d0	2020-12-22 15:43:59 +11:00
jmc@openbsd.org	69924a92c3	upstream: start sentence with capital letter; ... OpenBSD-Commit-ID: ab06581d51b2b4cc1b4aab781f7f3cfa56cad973	2020-07-17 13:23:34 +10:00
djm@openbsd.org	aaa8b609a7	upstream: allow some additional control over the use of ssh-askpass ... via $SSH_ASKPASS_REQUIRE, including force-enable/disable. bz#69 ok markus@ OpenBSD-Commit-ID: 3a1e6cbbf6241ddc4405c4246caa2c249f149eb2	2020-07-15 15:08:10 +10:00
djm@openbsd.org	267cbc87b5	upstream: mention that /etc/hosts.equiv and /etc/shosts.equiv are ... not considered for HostbasedAuthentication when the target user is root; bz3148 OpenBSD-Commit-ID: fe4c1256929e53f23af17068fbef47852f4bd752	2020-04-17 14:03:36 +10:00
naddy@openbsd.org	30144865bf	upstream: document -F none; with jmc@ ... OpenBSD-Commit-ID: 0eb93b75473d2267aae9200e02588e57778c84f2	2020-02-18 20:23:25 +11:00
dtucker@openbsd.org	d4d9e1d405	upstream: Add ssh -Q key-sig for all key and signature types. ... Teach ssh -Q to accept ssh_config(5) and sshd_config(5) algorithm keywords as an alias for the corresponding query. Man page help jmc@, ok djm@. OpenBSD-Commit-ID: 1e110aee3db2fc4bc5bee2d893b7128fd622e0f8	2020-02-07 15:03:20 +11:00
naddy@openbsd.org	141df487ba	upstream: Replace the term "security key" with "(FIDO) ... authenticator". The polysemous use of "key" was too confusing. Input from markus@. ok jmc@ OpenBSD-Commit-ID: 12eea973a44c8232af89f86e4269d71ae900ca8f	2019-12-30 14:31:40 +11:00
jmc@openbsd.org	483cc723d1	upstream: tweak the Nd lines for a bit of consistency; ok markus ... OpenBSD-Commit-ID: 876651bdde06bc1e72dd4bd7ad599f42a6ce5a16	2019-12-11 19:08:22 +11:00
jmc@openbsd.org	d39a865b7a	upstream: improve the text for -A a little; input from naddy and ... djm OpenBSD-Commit-ID: f9cdfb1d6dbb9887c4bf3bb25f9c7a94294c988d	2019-11-29 11:17:39 +11:00
naddy@openbsd.org	f0edda81c5	upstream: more missing mentions of ed25519-sk; ok djm@ ... OpenBSD-Commit-ID: f242e53366f61697dffd53af881bc5daf78230ff	2019-11-20 09:27:29 +11:00
djm@openbsd.org	6bff9521ab	upstream: directly support U2F/FIDO2 security keys in OpenSSH by ... linking against the (previously external) USB HID middleware. The dlopen() capability still exists for alternate middlewares, e.g. for Bluetooth, NFC and test/debugging. OpenBSD-Commit-ID: 14446cf170ac0351f0d4792ba0bca53024930069	2019-11-15 09:57:30 +11:00
naddy@openbsd.org	aa4c640dc3	upstream: Fill in missing man page bits for U2F security key support: ... Mention the new key types, the ~/.ssh/id_ecdsa_sk file, ssh's SecurityKeyProvider keyword, the SSH_SK_PROVIDER environment variable, and ssh-keygen's new -w and -x options. Copy the ssh-sk-helper man page from ssh-pkcs11-helper with minimal substitutions. ok djm@ OpenBSD-Commit-ID: ef2e8f83d0c0ce11ad9b8c28945747e5ca337ac4	2019-11-08 14:09:32 +11:00
jmc@openbsd.org	7349149da1	upstream: Hostname->HostName cleanup; from lauri tirkkonen ok ... dtucker OpenBSD-Commit-ID: 4ade73629ede63b691f36f9a929f943d4e7a44e4	2019-06-14 13:01:28 +10:00
jmc@openbsd.org	1b1332b5bb	upstream: benno helped me clean up the tcp forwarding section; ... OpenBSD-Commit-ID: d4bec27edefde636fb632b7f0b7c656b9c7b7f08	2019-03-26 10:20:22 +11:00
naddy@openbsd.org	c13b74530f	upstream: PKCS#11 support is no longer limited to RSA; ok benno@ ... kn@ OpenBSD-Commit-ID: 1a9bec64d530aed5f434a960e7515a3e80cbc826	2019-03-08 14:58:30 +11:00
djm@openbsd.org	7a2cb18a21	upstream: Mention that configuration for the destination host is ... not applied to any ProxyJump/-J hosts. This has confused a few people... OpenBSD-Commit-ID: 03f4f641df6ca236c1bfc69836a256b873db868b	2019-01-22 23:04:54 +11:00
jmc@openbsd.org	e6933a2ffa	upstream: reorder CASignatureAlgorithms, and add them to the ... various -o lists; ok djm OpenBSD-Commit-ID: ecb88baecc3c54988b4d1654446ea033da359288	2018-09-21 09:41:10 +10:00
djm@openbsd.org	357128ac48	upstream: Add "ssh -Q sig" to allow listing supported signature ... algorithms ok markus@ OpenBSD-Commit-ID: 7a8c6eb6c249dc37823ba5081fce64876d10fe2b	2018-09-12 16:49:21 +10:00
djm@openbsd.org	247766cd31	upstream: ssh -MM requires confirmation for all operations that ... change the multiplexing state, not just new sessions. mention that confirmation is checked via ssh-askpass OpenBSD-Commit-ID: 0f1b45551ebb9cc5c9a4fe54ad3b23ce90f1f5c2	2018-09-09 14:50:32 +10:00
dtucker@openbsd.org	95d41e90ea	upstream: Deprecate UsePrivilegedPort now that support for running ... ssh(1) setuid has been removed, remove supporting code and clean up references to it in the man pages We have not shipped ssh(1) the setuid bit since 2002. If ayone really needs to make connections from a low port number this can be implemented via a small setuid ProxyCommand. ok markus@ jmc@ djm@ OpenBSD-Commit-ID: d03364610b7123ae4c6792f5274bd147b6de717e	2018-07-19 21:44:21 +10:00
jmc@openbsd.org	acf4260f09	upstream: sort previous; ... OpenBSD-Commit-ID: 27d80d8b8ca99bc33971dee905e8ffd0053ec411	2018-06-11 09:50:06 +10:00
djm@openbsd.org	7082bb58a2	upstream: add a SetEnv directive to ssh_config that allows setting ... environment variables for the remote session (subject to the server accepting them) refactor SendEnv to remove the arbitrary limit of variable names. ok markus@ OpenBSD-Commit-ID: cfbb00d9b0e10c1ffff1d83424351fd961d1f2be	2018-06-09 13:11:00 +10:00
djm@openbsd.org	f18bc97151	upstream: Emphasise that -w implicitly sets Tunnel=point-to-point ... and that users should specify an explicit Tunnel directive if they don't want this. bz#2365. OpenBSD-Commit-ID: 1a8d9c67ae213ead180481900dbbb3e04864560d	2018-05-22 10:15:18 +10:00
djm@openbsd.org	8d6829be32	upstream: ssh does not accept -oInclude=... on the commandline, the ... Include keyword is for configuration files only. bz#2840, patch from Jakub Jelen OpenBSD-Commit-ID: 32d052b4a7a7f22df35fe3f71c368c02b02cacb0	2018-04-06 14:20:33 +10:00
jmc@openbsd.org	7d330a1ac0	upstream: some cleanup for BindInterface and ssh-keyscan; ... OpenBSD-Commit-ID: 1a719ebeae22a166adf05bea5009add7075acc8c	2018-02-26 11:32:29 +11:00
djm@openbsd.org	ac2e3026bb	upstream: Add BindInterface ssh_config directive and -B ... command-line argument to ssh(1) that directs it to bind its outgoing connection to the address of the specified network interface. BindInterface prefers to use addresses that aren't loopback or link- local, but will fall back to those if no other addresses of the required family are available on that interface. Based on patch by Mike Manning in bz#2820, ok dtucker@ OpenBSD-Commit-ID: c5064d285c2851f773dd736a2c342aa384fbf713	2018-02-23 13:37:49 +11:00
djm@openbsd.org@openbsd.org	ecbf005b8f	upstream commit ... Private keys in PEM format have been encrypted by AES-128 for a while (not 3DES). bz#2788 reported by Calum Mackay OpenBSD-Commit-ID: bd33da7acbbb3c882f0a0ee56007a35ce0d8a11a	2017-11-03 16:20:41 +11:00
jmc@openbsd.org@openbsd.org	0b2e2896b9	upstream commit ... tweak the uri text, specifically removing some markup to make it a bit more readable; issue reported by - and diff ok - millert OpenBSD-Commit-ID: 8b56a20208040b2d0633536fd926e992de37ef3f	2017-10-31 09:08:50 +11:00
djm@openbsd.org	b7548b12a6	upstream commit ... Expose devices allocated for tun/tap forwarding. At the client, the device may be obtained from a new %T expansion for LocalCommand. At the server, the allocated devices will be listed in a SSH_TUNNEL variable exposed to the environment of any user sessions started after the tunnel forwarding was established. ok markus Upstream-ID: e61e53f8ae80566e9ddc0d67a5df5bdf2f3c9f9e	2017-10-23 16:14:30 +11:00
millert@openbsd.org	887669ef03	upstream commit ... Add URI support to ssh, sftp and scp. For example ssh://user@host or sftp://user@host/path. The connection parameters described in draft-ietf-secsh-scp-sftp-ssh-uri-04 are not implemented since the ssh fingerprint format in the draft uses md5 with no way to specify the hash function type. OK djm@ Upstream-ID: 4ba3768b662d6722de59e6ecb00abf2d4bf9cacc	2017-10-23 16:10:08 +11:00
djm@openbsd.org	10727487be	upstream commit ... mention SSH_USER_AUTH in the list of environment variables Upstream-ID: 1083397c3ee54b4933121ab058c70a0fc6383691	2017-10-20 12:01:03 +11:00
markus@openbsd.org	609d7a66ce	upstream commit ... Add 'reverse' dynamic forwarding which combines dynamic forwarding (-D) with remote forwarding (-R) where the remote-forwarded port expects SOCKS-requests. The SSH server code is unchanged and the parsing happens at the SSH clients side. Thus the full SOCKS-request is sent over the forwarded channel and the client parses c->output. Parsing happens in channel_before_prepare_select(), _before_ the select bitmask is computed in the pre[] handlers, but after network input processing in the post[] handlers. help and ok djm@ Upstream-ID: aa25a6a3851064f34fe719e0bf15656ad5a64b89	2017-09-22 09:14:53 +10:00
djm@openbsd.org	7f5637c4a6	upstream commit ... in description of public key authentication, mention that the server will send debug messages to the client for some error conditions after authentication has completed. bz#2709 ok dtucker Upstream-ID: 750127dbd58c5a2672c2d28bc35fe221fcc8d1dd	2017-06-10 16:40:10 +10:00
bluhm@openbsd.org	1112b534a6	upstream commit ... Add RemoteCommand option to specify a command in the ssh config file instead of giving it on the client's command line. This command will be executed on the remote host. The feature allows to automate tasks using ssh config. OK markus@ Upstream-ID: 5d982fc17adea373a9c68cae1021ce0a0904a5ee	2017-05-31 10:51:09 +10:00