tyler.durden
/
openssh-portable
mirror of https://github.com/PowerShell/openssh-portable.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
6,186 Commits 6 Branches 20 Tags 99 MiB
Commit Graph

5694 Commits

Author SHA1 Message Date
Darren Tucker 261d93a5cf - (dtucker) [configure.ac defines.h loginrec.c logintest.c] Bug #1732: enable 
utmpx support on FreeBSD where possible.  Patch from Ed Schouten, ok djm@
 2010-04-09 18:13:27 +10:00
Darren Tucker c4ccb12ee4 - (dtucker) [configure.ac] Bug #1744: use pkg-config for libedit flags if we 
have it and the path is not provided to --with-libedit.  Based on a patch
   from Iain Morgan.
 2010-04-09 14:04:35 +10:00
Darren Tucker 537d4dcfa0 - (dtucker) [contrib/cygwin/Makefile] Don't overwrite files with the wrong 
ones.  Based on a patch from Roumen Petrov.
 2010-04-09 13:35:23 +10:00
Darren Tucker ce3754bbf3 - dtucker@cvs.openbsd.org 2010/03/26 01:06:13 
[ssh_config.5]
     Reformat default value of PreferredAuthentications entry (current
     formatting implies ", " is acceptable as a separator, which it's not.
     ok djm@
 2010-03-26 12:09:13 +11:00
Damien Miller 9c60f24f01 - djm@cvs.openbsd.org 2010/03/26 00:26:58 
[ssh.1]
     mention that -S none disables connection sharing; from Colin Watson
 2010-03-26 11:28:35 +11:00
Damien Miller df08341060 - (djm) [contrib/ssh-copy-id] Don't blow up when the agent has no keys; 
bz#1723 patch from Adeodato Simó via Colin Watson; ok dtucker@
 2010-03-26 11:18:27 +11:00
Darren Tucker ffd1eaadb0 - (dtucker) Bug #1725: explicitly link libX11 into gnome-ssh-askpass2 using 
pkg-config, patch from Colin Watson.  Needed for newer linkers (ie gold).
 2010-03-26 11:16:39 +11:00
Damien Miller 6480c63b75 - (djm) [channels.c] Check for EPFNOSUPPORT as a socket() errno; bz#1721 
ok dtucker@
 2010-03-26 11:09:44 +11:00
Damien Miller 8b90642fcf - (djm) [session.c] Allow ChrootDirectory to work on SELinux platforms - 
set up SELinux execution context before chroot() call. From Russell
   Coker via Colin watson; bz#1726 ok dtucker@
 2010-03-26 11:04:09 +11:00
Damien Miller 44451d0af8 - djm@cvs.openbsd.org 2010/03/25 23:38:28 
[servconf.c]
     from portable: getcwd(NULL, 0) doesn't work on all platforms, so
     use a stack buffer; ok dtucker@
 2010-03-26 10:40:04 +11:00
Darren Tucker a83d90fbab - (dtucker) [configure.ac] Bug #1741: Add section for Haiku, patch originally 
by Ingo Weinhold via Scott McCreary, ok djm@
 2010-03-26 10:27:33 +11:00
Damien Miller 7d09b8f8d9 - (djm) [openbsd-compat/bsd-arc4random.c] Fix preprocessor detection 
for arc4random_buf() and arc4random_uniform(); from Josh Gilkerson
 2010-03-26 08:52:02 +11:00
Darren Tucker 62131dc6e2 - (dtucker) [contrib/cygwin/ssh-host-config] Mount the Windows directory 
containing the services file explicitely case-insensitive.  This allows to
   tweak the Windows services file reliably.  Patch from vinschen at redhat.
 2010-03-24 13:03:32 +11:00
Damien Miller b086d4ac70 - (djm) [README contrib/caldera/openssh.spec contrib/redhat/openssh.spec] 
[contrib/suse/openssh.spec] Crank version numbers
 2010-03-22 06:11:55 +11:00
Damien Miller 13a9f7247a - djm@cvs.openbsd.org 2010/03/16 16:36:49 
[version.h]
     crank version to openssh-5.5 since we have a few fixes since 5.4;
     requested deraadt@ kettenis@
 2010-03-22 05:59:22 +11:00
Damien Miller 33334b27bc - stevesk@cvs.openbsd.org 2010/03/16 15:46:52 
[auth-options.c]
     spelling in error message. ok djm kettenis
 2010-03-22 05:59:02 +11:00
Damien Miller 1cfbfaf4a0 - stevesk@cvs.openbsd.org 2010/03/15 19:40:02 
[key.c key.h ssh-keygen.c]
     also print certificate type (user or host) for ssh-keygen -L
     ok djm kettenis
 2010-03-22 05:58:24 +11:00
Damien Miller 5a5d94b12f - jmc@cvs.openbsd.org 2010/03/13 23:38:13 
[ssh-keygen.1]
     fix a formatting error (args need quoted); noted by stevesk
 2010-03-22 05:57:49 +11:00
Damien Miller 1b61a2825e - djm@cvs.openbsd.org 2010/03/13 21:45:46 
[ssh-keygen.1]
     Certificates are named *-cert.pub, not *_cert.pub; committing a diff
     from stevesk@ ok me
 2010-03-22 05:55:06 +11:00
Damien Miller 8ddc71c13d - djm@cvs.openbsd.org 2010/03/13 21:10:38 
[clientloop.c]
     protocol conformance fix: send language tag when disconnecting normally;
     spotted by 1.41421 AT gmail.com, ok markus@ deraadt@
 2010-03-22 05:54:02 +11:00
Damien Miller 4a5f0d325b - markus@cvs.openbsd.org 2010/03/12 11:37:40 
[servconf.c]
     do not prepend AuthorizedKeysFile with getcwd(), unbreaks relative paths
     free() (not xfree()) the buffer returned by getcwd()
 2010-03-22 05:53:04 +11:00
Damien Miller c4cb47bc53 - djm@cvs.openbsd.org 2010/03/12 01:06:25 
[servconf.c]
     unbreak AuthorizedKeys option with a $HOME-relative path; reported by
     vinschen AT redhat.com, ok dtucker@
 2010-03-22 05:52:26 +11:00
Damien Miller e513a91195 - djm@cvs.openbsd.org 2010/03/10 23:27:17 
[auth2-pubkey.c]
     correct certificate logging and make it more consistent between
     authorized_keys and TrustedCAKeys; ok markus@
 2010-03-22 05:51:21 +11:00
Damien Miller 77497e1318 - jmc@cvs.openbsd.org 2010/03/10 07:40:35 
[ssh-keygen.1]
     typos; from Ross Richardson
     closes prs 6334 and 6335
 2010-03-22 05:50:51 +11:00
Damien Miller c59e2443d3 - jmc@cvs.openbsd.org 2010/03/08 09:41:27 
[ssh-keygen.1]
     sort the list of constraints (to -O); ok djm
 2010-03-22 05:50:31 +11:00
Damien Miller 1f574b2546 - (djm) [Makefile.in] Respecify -lssh after -lopenbsd-compat for 
ssh-pkcs11-helper to repair static builds (we do the same for
   ssh-keyscan). Reported by felix-mindrot AT fefe.de
 2010-03-14 08:41:34 +11:00
Damien Miller 47f9a4106a - (djm) [ssh-pkcs11-helper.c] Move #ifdef to after #defines to fix 
compilation failure when !HAVE_DLOPEN. Reported by felix-mindrot
   AT fefe.de
 2010-03-14 08:37:49 +11:00
Tim Rice 4e0cea82dd - (tim) [contrib/cygwin/Makefile] Fix list of documentation files to install 
on a Cygwin installation. Patch from Corinna Vinschen.
 2010-03-11 22:35:19 -08:00
Tim Rice ded8fa0bc9 - (tim) [Makefile.in] Add missing $(EXEEXT) to install targets. 
Patch from Corinna Vinschen.
 2010-03-11 22:32:02 -08:00
Tim Rice 2bde3eec69 - (tim) [openssh/Makefile.in] Now that scard is gone, no need to 
make $(datadir)
 2010-03-11 22:18:13 -08:00
Tim Rice fa233ba73b - (tim) [contrib/suse/openssh.spec] crank version number here too. 
report by imorgan AT nas.nasa.gov
 2010-03-10 16:12:02 -08:00
Darren Tucker c9fe39b1a4 - (dtucker) [configure.ac] Use a proper AC_CHECK_DECL for BROKEN_GETADDRINFO 
so setting it in CFLAGS correctly skips IPv6 tests.
 2010-03-09 20:42:30 +11:00
Damien Miller 081c976e1c - djm@cvs.openbsd.org 2010/03/08 00:28:55 
[ssh-keygen.1]
     document permit-agent-forwarding certificate constraint; patch from
     stevesk@
 2010-03-08 11:30:00 +11:00
Damien Miller 958678726c - (djm) Release OpenSSH-5.4p1 2010-03-08 09:50:17 +11:00
Damien Miller 6bf31786cf - (djm) [README contrib/caldera/openssh.spec contrib/redhat/openssh.spec] 
crank version numbers
 2010-03-08 09:41:02 +11:00
Damien Miller 3e1ee491f3 - djm@cvs.openbsd.org 2010/03/07 22:16:01 
[ssh-keygen.c]
     make internal strptime string match strftime format;
     suggested by vinschen AT redhat.com and markus@
 2010-03-08 09:24:11 +11:00
Damien Miller b3bc331e09 - (djm) OpenBSD CVS Sync 
- djm@cvs.openbsd.org 2010/03/07 22:01:32
     [version.h]
     openssh-5.4
 2010-03-08 09:03:33 +11:00
Darren Tucker cd70e1b813 - dtucker@cvs.openbsd.org 2010/03/07 11:57:13 
[auth-rhosts.c monitor.c monitor_wrap.c session.c auth-options.c sshd.c]
     Hold authentication debug messages until after successful authentication.
     Fixes an info leak of environment variables specified in authorized_keys,
     reported by Jacob Appelbaum.  ok djm@
 2010-03-07 23:05:17 +11:00
Darren Tucker ac0c4c9c1d - (dtucker) [session.c] Also initialize creds to NULL for handing to 
setpcred.
 2010-03-07 13:32:16 +11:00
Darren Tucker c738e6c646 - (dtucker) [session.c] Bug #1567: move setpcred call to before chroot and 
do not set real uid, since that's needed for the chroot, and will be set
   by permanently_set_uid.
 2010-03-07 13:21:12 +11:00
Darren Tucker b3d20a3ff0 - (dtucker) [auth.c] Bug #1710: call setauthdb on AIX before getpwuid so that 
it gets the passwd struct from the LAM that knows about the user which is
   not necessarily the default.  Patch from Alexandre Letourneau.
 2010-03-07 11:56:59 +11:00
Damien Miller 5059d8d7e6 - djm@cvs.openbsd.org 2010/03/05 10:28:21 
[ssh-add.1 ssh.1 ssh_config.5]
     mention loading of certificate files from [private]-cert.pub when
     they are present; feedback and ok jmc@
 2010-03-05 21:31:11 +11:00
Damien Miller 922b541329 - jmc@cvs.openbsd.org 2010/03/05 08:31:20 
[ssh.1]
     document certificate authentication; help/ok djm
 2010-03-05 21:30:54 +11:00
Damien Miller 98339054f9 - jmc@cvs.openbsd.org 2010/03/05 06:50:35 
[ssh.1 sshd.8]
     tweak previous;
 2010-03-05 21:30:35 +11:00
Damien Miller 9527f228ae - (djm) [configure.ac] set -fno-strict-aliasing for gcc4; ok dtucker@ 2010-03-05 15:04:35 +11:00
Damien Miller b068d0ad6d - djm@cvs.openbsd.org 2010/03/05 02:58:11 
[auth.c]
     make the warning for a revoked key louder and more noticable
 2010-03-05 14:03:03 +11:00
Damien Miller 48b6021721 - (djm) [ssh-rand-helper.c] declare optind, avoiding compilation failure 
on some platforms
 2010-03-05 11:40:19 +11:00
Damien Miller 689b872842 - djm@cvs.openbsd.org 2010/03/04 23:27:25 
[auth-options.c ssh-keygen.c]
     "force-command" is not spelled "forced-command"; spotted by
     imorgan AT nas.nasa.gov
 2010-03-05 10:42:24 +11:00
Damien Miller a7dab8bfe5 - djm@cvs.openbsd.org 2010/03/04 23:19:29 
[ssh.1 sshd.8]
     move section on CA and revoked keys from ssh.1 to sshd.8's known hosts
     format section and rework it a bit; requested by jmc@
 2010-03-05 10:42:05 +11:00
Damien Miller c6db99ec14 - djm@cvs.openbsd.org 2010/03/04 23:17:25 
[sshd_config.5]
     missing word; spotted by jmc@
 2010-03-05 10:41:45 +11:00
Damien Miller 8f6c337563 - jmc@cvs.openbsd.org 2010/03/04 22:52:40 
[ssh-keygen.1]
     fix Bk/Ek;
 2010-03-05 10:41:26 +11:00
Tim Rice 179eee081a - (tim) [ssh-pkcs11.c] Fix "non-constant initializer" errors in older 
compilers. OK djm@
 2010-03-04 12:48:05 -08:00
Damien Miller f2b70cad75 - djm@cvs.openbsd.org 2010/03/04 20:35:08 
[ssh-keygen.1 ssh-keygen.c]
     Add a -L flag to print the contents of a certificate; ok markus@
 2010-03-05 07:39:35 +11:00
Damien Miller 72b33820af - jmc@cvs.openbsd.org 2010/03/04 12:51:25 
[ssh.1 sshd_config.5]
     tweak previous;
 2010-03-05 07:39:01 +11:00
Damien Miller 700dcfa3e0 - djm@cvs.openbsd.org 2010/03/04 10:38:23 
[regress/cert-hostkey.sh regress/cert-userkey.sh]
     additional regression tests for revoked keys and TrustedUserCAKeys
 2010-03-04 21:58:01 +11:00
Damien Miller 017d1e777e - djm@cvs.openbsd.org 2010/03/03 00:47:23 
[regress/cert-hostkey.sh regress/cert-userkey.sh]
     add an extra test to ensure that authentication with the wrong
     certificate fails as it should (and it does)
 2010-03-04 21:57:21 +11:00
Damien Miller 1aed65eb27 - djm@cvs.openbsd.org 2010/03/04 10:36:03 
[auth-rh-rsa.c auth-rsa.c auth.c auth.h auth2-hostbased.c auth2-pubkey.c]
     [authfile.c authfile.h hostfile.c hostfile.h servconf.c servconf.h]
     [ssh-keygen.c ssh.1 sshconnect.c sshd_config.5]
     Add a TrustedUserCAKeys option to sshd_config to specify CA keys that
     are trusted to authenticate users (in addition than doing it per-user
     in authorized_keys).

     Add a RevokedKeys option to sshd_config and a @revoked marker to
     known_hosts to allow keys to me revoked and banned for user or host
     authentication.

     feedback and ok markus@
 2010-03-04 21:53:35 +11:00
Damien Miller 2befbad9b3 - djm@cvs.openbsd.org 2010/03/04 01:44:57 
[key.c]
     use buffer_get_string_ptr_ret() where we are checking the return
     value explicitly instead of the fatal()-causing buffer_get_string_ptr()
 2010-03-04 21:52:18 +11:00
Damien Miller fe588e3c84 - djm@cvs.openbsd.org 2010/03/03 22:50:40 
[PROTOCOL.certkeys]
     s/similar same/similar/; from imorgan AT nas.nasa.gov
 2010-03-04 21:52:00 +11:00
Damien Miller cd38c9c555 - djm@cvs.openbsd.org 2010/03/03 22:49:50 
[sshd.8]
     the authorized_keys option for CA keys is "cert-authority", not
     "from=cert-authority". spotted by imorgan AT nas.nasa.gov
 2010-03-04 21:51:37 +11:00
Damien Miller 41396573af - OpenBSD CVS Sync 
- djm@cvs.openbsd.org 2010/03/03 01:44:36
     [auth-options.c key.c]
     reject strings with embedded ASCII nul chars in certificate key IDs,
     principal names and constraints
 2010-03-04 21:51:11 +11:00
Damien Miller e1abf4d6bc - (djm) [regress/Makefile] Cleanup sshd_proxy_orig 2010-03-04 21:41:29 +11:00
Damien Miller d45f3b6cc7 - (djm) [.cvsignore] Ignore ssh-pkcs11-helper 2010-03-04 21:09:46 +11:00
Damien Miller 661ffc1fd6 - (djm) [contrib/redhat/openssh.spec] Replace obsolete BuildPreReq 
on XFree86-devel with neutral /usr/include/X11/Xlib.h;
   imorgan AT nas.nasa.gov in bz#1731
 2010-03-04 21:09:24 +11:00
Damien Miller 910f209c1d - (djm) [ssh-keygen.c] Use correct local variable, instead of 
maybe-undefined global "optarg"
 2010-03-04 14:17:22 +11:00
Damien Miller 386dbc05e9 - (djm) [regress/cert-userkey.sh] s/echo -n/echon/ here too 2010-03-03 13:22:41 +11:00
Damien Miller fb84e5950e - djm@cvs.openbsd.org 2010/03/02 23:20:57 
[ssh-keygen.c]
     POSIX strptime is stricter than OpenBSD's so do a little dance to
     appease it.
 2010-03-03 10:26:04 +11:00
Damien Miller 0bd41861bb - otto@cvs.openbsd.org 2010/03/01 11:07:06 
[ssh-add.c]
     zap what seems to be a left-over debug message; ok markus@
 2010-03-03 10:25:41 +11:00
Damien Miller 15f5b560b1 - jmc@cvs.openbsd.org 2010/02/26 22:09:28 
[ssh-keygen.1 ssh.1 sshd.8]
     tweak previous;
 2010-03-03 10:25:21 +11:00
Damien Miller 25b97dd454 - (djm) [PROTOCOL.certkeys] Add RCS Ident 2010-03-03 10:24:00 +11:00
Tim Rice c5b0cb3b7d - (tim) [config.guess config.sub] Bug 1722: Update to latest versions from 
http://git.savannah.gnu.org/gitweb/ (2009-12-30 and 2010-01-22
   respectively).
 2010-03-01 15:57:42 -08:00
Darren Tucker 9af0cb9acc - (dtucker) [openbsd-compat/port-linux.c] Make failure to write to the OOM 
adjust log at verbose only, since according to cjwatson in bug #1470
   some virtualization platforms don't allow writes.
 2010-03-01 15:52:49 +11:00
Darren Tucker c614c78c53 - (dtucker) [regress/{cert-hostkey,cfgmatch,cipher-speed}.sh} Replace 
"echo -n" with "echon" for portability.
 2010-03-01 12:49:05 +11:00
Tim Rice bff24b8ad2 - (tim) [ssh-pkcs11-helper.c] Move declarations before calling functions 
to make older compilers (gcc 2.95) happy.
 2010-02-28 14:51:56 -08:00
Damien Miller acc9b29486 - (djm) [auth.c] On Cygwin, refuse usernames that have differences in 
case from that matched in the system password database. On this
   platform, passwords are stored case-insensitively, but sshd requires
   exact case matching for Match blocks in sshd_config(5). Based on
   a patch from vinschen AT redhat.com.
 2010-03-01 04:36:54 +11:00
Damien Miller d05951fcee - (djm) [openbsd-compat/bsd-cygwin_util.c] Reduce the set of environment 
variables copied into sshd child processes. From vinschen AT redhat.com
 2010-02-28 03:29:33 +11:00
Damien Miller 09a24db2d7 - (djm) [ssh-pkcs11-helper.c ] Ensure RNG is initialised and seeded 2010-02-28 03:28:05 +11:00
Damien Miller 58ac6de964 - djm@cvs.openbsd.org 2010/02/26 20:33:21 
[Makefile regress/cert-hostkey.sh regress/cert-userkey.sh]
     regression tests for certified keys
 2010-02-27 07:57:12 +11:00
Damien Miller 0a80ca190a - OpenBSD CVS Sync 
- djm@cvs.openbsd.org 2010/02/26 20:29:54
     [PROTOCOL PROTOCOL.agent PROTOCOL.certkeys addrmatch.c auth-options.c]
     [auth-options.h auth.h auth2-pubkey.c authfd.c dns.c dns.h hostfile.c]
     [hostfile.h kex.h kexdhs.c kexgexs.c key.c key.h match.h monitor.c]
     [myproposal.h servconf.c servconf.h ssh-add.c ssh-agent.c ssh-dss.c]
     [ssh-keygen.1 ssh-keygen.c ssh-rsa.c ssh.1 ssh.c ssh2.h sshconnect.c]
     [sshconnect2.c sshd.8 sshd.c sshd_config.5]
     Add support for certificate key types for users and hosts.

     OpenSSH certificate key types are not X.509 certificates, but a much
     simpler format that encodes a public key, identity information and
     some validity constraints and signs it with a CA key. CA keys are
     regular SSH keys. This certificate style avoids the attack surface
     of X.509 certificates and is very easy to deploy.

     Certified host keys allow automatic acceptance of new host keys
     when a CA certificate is marked as sh/known_hosts.
     see VERIFYING HOST KEYS in ssh(1) for details.

     Certified user keys allow authentication of users when the signing
     CA key is marked as trusted in authorized_keys. See "AUTHORIZED_KEYS
     FILE FORMAT" in sshd(8) for details.

     Certificates are minted using ssh-keygen(1), documentation is in
     the "CERTIFICATES" section of that manpage.

     Documentation on the format of certificates is in the file
     PROTOCOL.certkeys

     feedback and ok markus@
 2010-02-27 07:55:05 +11:00
Damien Miller d27d85d532 contrib/caldera/openssh.spec 
contrib/redhat/openssh.spec
contrib/suse/openssh.spec
 2010-02-24 18:21:45 +11:00
Damien Miller 43001b3b3b - (djm) [Makefile.in ssh-pkcs11-helper.8] Add manpage for PKCS#11 helper 2010-02-24 18:18:51 +11:00
Damien Miller cfa42d2fd2 - markus@cvs.openbsd.org 2010/02/08 10:52:47 
[regress/agent-pkcs11.sh]
     test for PKCS#11 support (currently disabled)
 2010-02-24 17:31:20 +11:00
Damien Miller c1739211a6 - djm@cvs.openbsd.org 2010/02/24 06:21:56 
[regress/test-exec.sh]
     wait for sshd to fully stop in cleanup() function; avoids races in tests
     that do multiple start_sshd/cleanup cycles; "I hate pidfiles" deraadt@
 2010-02-24 17:29:34 +11:00
Damien Miller 8f9492c90d - djm@cvs.openbsd.org 2010/02/09 06:29:02 
[regress/Makefile]
     turn on all the malloc(3) checking options when running regression
     tests. this has caught a few bugs for me in the past; ok dtucker@
 2010-02-24 17:28:45 +11:00
Damien Miller bb4ae5583b - djm@cvs.openbsd.org 2010/02/09 04:57:36 
[regress/addrmatch.sh]
     clean up droppings
 2010-02-24 17:26:38 +11:00
Damien Miller 0dff9c7e6d - dtucker@cvs.openbsd.org 2010/01/11 02:53:44 
[regress/forwarding.sh]
     regress test for stdio forwarding
 2010-02-24 17:25:58 +11:00
Damien Miller b6bd3c2ca8 - dtucker@cvs.openbsd.org 2009/11/09 04:20:04 
[regress/Makefile]
     add regression test for ssh-keygen pubkey conversions
 2010-02-24 17:24:56 +11:00
Damien Miller a80f1404bb - djm@cvs.openbsd.org 2010/02/11 20:37:47 
[pathnames.h]
     correct comment
 2010-02-24 17:17:58 +11:00
Damien Miller 05abd2c968 - (djm) [pkcs11.h ssh-pkcs11-client.c ssh-pkcs11-helper.c ssh-pkcs11.c] 
[ssh-pkcs11.h] Add $OpenBSD$ RCS idents so we can sync portable
 2010-02-24 17:16:08 +11:00
Damien Miller b3c9f78711 - (djm) [configure.ac] Enable PKCS#11 support only when we find a working 
dlopen()
 2010-02-12 10:11:34 +11:00
Damien Miller dfa4156dbd - (djm) [ssh-pkcs11-client.c ssh-pkcs11-helper.c ssh-pkcs11.c] 
Use ssh_get_progname to fill __progname
 2010-02-12 10:06:28 +11:00
Damien Miller 8ad0fbd98e - (djm) [ssh-pkcs11-client.c ssh-pkcs11-helper.c ssh-pkcs11.c] 
Make it compile on OSX
 2010-02-12 09:49:06 +11:00
Damien Miller d8f6002272 - (djm) [INSTALL Makefile.in README.smartcard configure.ac scard-opensc.c] 
[scard.c scard.h pkcs11.h scard/Makefile.in scard/Ssh.bin.uu scard/Ssh.java]
   Remove obsolete smartcard support
 2010-02-12 09:34:22 +11:00
Damien Miller d400da5ba8 - jmc@cvs.openbsd.org 2010/02/11 13:23:29 
[ssh.1]
     libarary -> library;
 2010-02-12 09:26:23 +11:00
Damien Miller a761844455 - markus@cvs.openbsd.org 2010/02/10 23:20:38 
[ssh-add.1 ssh-keygen.1 ssh.1 ssh_config.5]
     pkcs#11 is no longer optional; improve wording; ok jmc@
 2010-02-12 09:26:02 +11:00
Damien Miller 47cf16b8df - djm@cvs.openbsd.org 2010/02/09 06:18:46 
[auth.c]
     unbreak ChrootDirectory+internal-sftp by skipping check for executable
     shell when chrooting; reported by danh AT wzrd.com; ok dtucker@
 2010-02-12 09:25:29 +11:00
Damien Miller 8922106fe9 - djm@cvs.openbsd.org 2010/02/09 03:56:28 
[buffer.c buffer.h]
     constify the arguments to buffer_len, buffer_ptr and buffer_dump
 2010-02-12 09:23:40 +11:00
Damien Miller 86cbb44d47 - djm@cvs.openbsd.org 2010/02/09 00:50:59 
[ssh-keygen.c]
     fix -Wall
 2010-02-12 09:22:57 +11:00
Damien Miller a183c6edee - djm@cvs.openbsd.org 2010/02/09 00:50:36 
[ssh-agent.c]
     fallout from PKCS#11: unbreak -D
 2010-02-12 09:22:31 +11:00
Damien Miller 048dc93617 - jmc@cvs.openbsd.org 2010/02/08 22:03:05 
[ssh-add.1 ssh-keygen.1 ssh.1 ssh.c]
     tweak previous; ok markus
 2010-02-12 09:22:04 +11:00
Damien Miller 7ea845e48d - markus@cvs.openbsd.org 2010/02/08 10:50:20 
[pathnames.h readconf.c readconf.h scp.1 sftp.1 ssh-add.1 ssh-add.c]
     [ssh-agent.c ssh-keygen.1 ssh-keygen.c ssh.1 ssh.c ssh_config.5]
     replace our obsolete smartcard code with PKCS#11.
        ftp://ftp.rsasecurity.com/pub/pkcs/pkcs-11/v2-20/pkcs-11v2-20.pdf
     ssh(1) and ssh-keygen(1) use dlopen(3) directly to talk to a PKCS#11
     provider (shared library) while ssh-agent(1) delegates PKCS#11 to
     a forked a ssh-pkcs11-helper process.
     PKCS#11 is currently a compile time option.
     feedback and ok djm@; inspired by patches from Alon Bar-Lev
`
 2010-02-12 09:21:02 +11:00
Damien Miller 17751bcab2 - djm@cvs.openbsd.org 2010/02/02 22:49:34 
[bufaux.c]
     make buffer_get_string_ret() really non-fatal in all cases (it was
     using buffer_get_int(), which could fatal() on buffer empty);
     ok markus dtucker
 2010-02-12 07:35:08 +11:00
Damien Miller 1d2bfc4118 - (djm) add -lselinux to LIBS before calling AC_CHECK_FUNCS for 
getseuserbyname; patch from calebcase AT gmail.com via
   cjwatson AT debian.org
 2010-02-10 10:19:29 +11:00
Damien Miller d636943d08 - djm@cvs.openbsd.org 2010/01/30 21:12:08 
[channels.c]
     fake local addr:port when stdio fowarding as some servers (Tectia at
     least) validate that they are well-formed;
     reported by imorgan AT nas.nasa.gov
     ok dtucker
 2010-02-02 17:02:07 +11:00
Damien Miller 74d9825c0f - djm@cvs.openbsd.org 2010/01/30 21:08:33 
[sshd.8]
     debug output goes to stderr, not "the system log"; ok markus dtucker
 2010-02-02 17:01:46 +11:00
Damien Miller c3ca35f424 - djm@cvs.openbsd.org 2010/01/30 02:54:53 
[mux.c]
     don't mark channel as read failed if it is already closing; suppresses
     harmless error messages when connecting to SSH.COM Tectia server
     report by imorgan AT nas.nasa.gov
 2010-01-30 17:42:01 +11:00
Damien Miller 0dac03febd - djm@cvs.openbsd.org 2010/01/29 20:16:17 
[mux.c]
     kill correct channel (was killing already-dead mux channel, not
     its session channel)
 2010-01-30 17:36:33 +11:00
Damien Miller 133d9d313e - djm@cvs.openbsd.org 2010/01/29 00:20:41 
[sshd.c]
     set FD_CLOEXEC on sock_in/sock_out; bz#1706 from jchadima AT redhat.com
     ok dtucker@
 2010-01-30 17:30:04 +11:00
Damien Miller 36f57ebf3b - djm@cvs.openbsd.org 2010/01/28 00:21:18 
[clientloop.c]
     downgrade an error() to a debug() - this particular case can be hit in
     normal operation for certain sequences of mux slave vs session closure
     and is harmless
 2010-01-30 17:28:34 +11:00
Darren Tucker 19d32cb934 - (dtucker) [openbsd-compat/openssl-compat.c] Bug #1707: Call OPENSSL_config() 
after registering the hardware engines, which causes the openssl.cnf file to
   be processed.  See OpenSSL's man page for OPENSSL_config(3) for details.
   Patch from Solomon Peachy, ok djm@.
 2010-01-29 10:54:11 +11:00
Damien Miller a1162985a5 - djm@cvs.openbsd.org 2010/01/27 19:21:39 
[sftp.c]
     add missing "p" flag to getopt optstring;
     bz#1704 from imorgan AT nas.nasa.gov
 2010-01-28 06:27:54 +11:00
Damien Miller a21cdfac2f - djm@cvs.openbsd.org 2010/01/27 13:26:17 
[mux.c]
     fix bug introduced in mux rewrite:

     In a mux master, when a socket to a mux slave closes before its server
     session (as may occur when the slave has been signalled), gracefully
     close the server session rather than deleting its channel immediately.
     A server may have more messages on that channel to send (e.g. an exit
     message) that will fatal() the client if they are sent to a channel that
     has been prematurely deleted.

     spotted by imorgan AT nas.nasa.gov
 2010-01-28 06:26:59 +11:00
Damien Miller 45a81a0e18 - djm@cvs.openbsd.org 2010/01/26 02:15:20 
[mux.c]
     -Wuninitialized and remove a // comment; from portable
     (Id sync only)
 2010-01-28 06:26:20 +11:00
Damien Miller e1537f951f - djm@cvs.openbsd.org 2010/01/26 01:28:35 
[channels.c channels.h clientloop.c clientloop.h mux.c nchan.c ssh.c]
     rewrite ssh(1) multiplexing code to a more sensible protocol.

     The new multiplexing code uses channels for the listener and
     accepted control sockets to make the mux master non-blocking, so
     no stalls when processing messages from a slave.

     avoid use of fatal() in mux master protocol parsing so an errant slave
     process cannot take down a running master.

     implement requesting of port-forwards over multiplexed sessions. Any
     port forwards requested by the slave are added to those the master has
     established.

     add support for stdio forwarding ("ssh -W host:port ...") in mux slaves.

     document master/slave mux protocol so that other tools can use it to
     control a running ssh(1). Note: there are no guarantees that this
     protocol won't be incompatibly changed (though it is versioned).

     feedback Salvador Fandino, dtucker@
     channel changes ok markus@
 2010-01-26 13:26:22 +11:00
Damien Miller f589fd1ea8 - dtucker@cvs.openbsd.org 2010/01/18 01:50:27 
[roaming_client.c]
     s/long long unsigned/unsigned long long/, from tim via portable
     (Id sync only, change already in portable)
 2010-01-26 12:53:06 +11:00
Damien Miller 2e68d793d6 - tedu@cvs.openbsd.org 2010/01/17 21:49:09 
[ssh-agent.1]
     Correct and clarify ssh-add's password asking behavior.
     Improved text dtucker and ok jmc
 2010-01-26 12:51:13 +11:00
Tim Rice 6761c7417d - (tim) [configure.ac] Due to constraints in Windows Sockets in terms of 
socket inheritance, reduce the default SO_RCVBUF/SO_SNDBUF buffer size
   in Cygwin to 65535. Patch from Corinna Vinschen.
 2010-01-22 10:25:15 -08:00
Tim Rice 7bb7471b80 Reword comment in last commit for additional clearity. 2010-01-17 22:49:57 -08:00
Tim Rice 641ebf1f86 - (tim) [configure.ac] Use the C99-conforming functions snprintf() and 
vsnprintf() named _xsnprintf() and _xvsnprintf() on SVR5 systems.
 2010-01-17 17:05:39 -08:00
Tim Rice 7ab7b9346d - (tim) [configure.ac] OpenServer 5 needs BROKEN_GETADDRINFO too. 2010-01-17 12:48:22 -08:00
Tim Rice 33e48ac7b2 Oops, forgot to document second change to roaming_client.c 
s/long long unsigned/unsigned long long/ to keep USL compilers happy.
 2010-01-17 07:12:40 -08:00
Tim Rice f37756759f - (tim) [roaming_client.c] Use of <sys/queue.h> is not really portable so 
we use "openbsd-compat/sys-queue.h"
 2010-01-16 16:48:39 -08:00
Tim Rice 4a7db1ca2f - (tim) [configure.ac] Define BROKEN_GETADDRINFO on SVR5 systems. The native 
getaddrinfo() is too old and limited for addr_pton() in addrmatch.c.
 2010-01-16 12:23:25 -08:00
Tim Rice 999aaf4182 - (tim) [regress/portnum.sh] Shell portability fix. 2010-01-16 11:37:53 -08:00
Darren Tucker 4e21855422 - (dtucker) [openbsd-compat/openbsd-compat.h] Typo. 2010-01-16 23:58:37 +11:00
Darren Tucker 612e400c68 - (dtucker) [openbsd-compat/pwcache.c] Shrink ifdef area to prevent unused 
variable warnings.
 2010-01-16 13:53:52 +11:00
Darren Tucker dab129bef5 - markus@cvs.openbsd.org 2010/01/15 09:24:23 
[sftp-common.c]
     unused
 2010-01-16 13:43:50 +11:00
Darren Tucker 69371b511b - (dtucker) [openbsd-compat/openbsd-compat.h] Fix prototypes, spotted by 
Tim.
 2010-01-16 13:30:30 +11:00
Darren Tucker 2563e3f272 - (dtucker) [openbsd-compat/openbsd-compat.h] Prototypes for user_from_uid 
and group_from_gid.
 2010-01-16 11:53:07 +11:00
Darren Tucker ca94485a48 - (dtucker) [openbsd-compat/pwcache.c] Pull in includes.h and thus defines.h 
so we correctly detect whether or not we have a native user_from_uid.
 2010-01-16 11:48:27 +11:00
Darren Tucker 7fa3a856ea typo 2010-01-15 13:12:10 +11:00
Darren Tucker 909a390bb8 - (dtucker) [configure.ac openbsd-compat/{Makefile.in,pwcache.c} Portability 
for pwcache.  Also, added caching of negative hits.
 2010-01-15 12:38:30 +11:00
Darren Tucker 9d1fd5bc10 - (dtucker) [openbsd-compat.c/pwcache.c] Pull in pwcache.c from OpenBSD (no 
changes yet but there will be some to come).
 2010-01-15 12:14:45 +11:00
Darren Tucker b8b17e984a - guenther@cvs.openbsd.org 2010/01/15 00:05:22 
[sftp.c]
     Reset SIGTERM to SIG_DFL before executing ssh, so that even if sftp
     inherited SIGTERM as ignored it will still be able to kill the ssh it
     starts.
     ok dtucker@
 2010-01-15 11:46:03 +11:00
Darren Tucker a788de2066 - dtucker@cvs.openbsd.org 2010/01/14 23:41:49 
[sftp-common.c]
     use user_from{uid,gid} to lookup up ids since it keeps a small cache.
     ok djm
 2010-01-15 11:45:33 +11:00
Darren Tucker 94881d8dbb - djm@cvs.openbsd.org 2010/01/13 23:47:26 
[auth.c]
     when using ChrootDirectory, make sure we test for the existence of the
     user's shell inside the chroot; bz #1679, patch from alex AT rtfs.hu;
     ok dtucker
 2010-01-15 11:44:46 +11:00
Darren Tucker 75fe626489 - jmc@cvs.openbsd.org 2010/01/13 12:48:34 
[sftp.1 sftp.c]
     sftp.1: put ls -h in the right place
     sftp.c: as above, plus add -p to get/put, and shorten their arg names
     to keep the help usage nicely aligned
     ok djm
 2010-01-15 11:42:51 +11:00
Damien Miller 6abc9f68aa - (djm) [platform.h] Add missing prototype for 
platform_krb5_get_principal_name
 2010-01-14 12:44:16 +11:00
Tim Rice d4a7fcbc46 - (tim) [defines.h] openbsd-compat/readpassphrase.c now needs _NSIG. 
feedback and ok dtucker@
 2010-01-13 15:44:34 -08:00
Darren Tucker 096630d06c - (dtucker) [sftp-common.c] Wrap include of util.h in an ifdef. 2010-01-13 23:00:38 +11:00
Darren Tucker 9c3ba07f60 - djm@cvs.openbsd.org 2010/01/13 04:10:50 
[sftp.c]
     don't append a space after inserting a completion of a directory (i.e.
     a path ending in '/') for a slightly better user experience; ok dtucker@
 2010-01-13 22:45:03 +11:00
Darren Tucker 88b6fb2b55 - djm@cvs.openbsd.org 2010/01/13 03:48:13 
[servconf.c servconf.h sshd.c]
     avoid run-time failures when specifying hostkeys via a relative
     path by prepending the cwd in these cases; bz#1290; ok dtucker@
 2010-01-13 22:44:29 +11:00
Darren Tucker 2901e2daeb - djm@cvs.openbsd.org 2010/01/13 01:40:16 
[sftp.c sftp-server.c sftp.1 sftp-common.c sftp-common.h]
     support '-h' (human-readable units) for sftp's ls command, just like
     ls(1); ok dtucker@
 2010-01-13 22:44:06 +11:00
Darren Tucker daaa450051 - dtucker@cvs.openbsd.org 2010/01/13 01:20:20 
[canohost.c ssh-keysign.c sshconnect2.c]
     Make HostBased authentication work with a ProxyCommand.  bz #1569, patch
     from imorgan at nas nasa gov, ok djm@
 2010-01-13 22:43:33 +11:00
Darren Tucker 561724f38d - dtucker@cvs.openbsd.org 2010/01/13 01:10:56 
[key.c]
     Ignore and log any Protocol 1 keys where the claimed size is not equal to
     the actual size.  Noted by Derek Martin, ok djm@
 2010-01-13 22:43:05 +11:00
Darren Tucker e2b3674172 - (dtucker) OpenBSD CVS Sync 
- dtucker@cvs.openbsd.org 2010/01/13 00:19:04
     [sshconnect.c auth.c]
     Fix a couple of typos/mispellings in comments
 2010-01-13 22:42:34 +11:00
Darren Tucker d59487a33b - (dtucker) [openbsd-compat/readpassphrase.c] Update to OpenBSD's r1.22. 
Fixes bz #1590, where sometimes you could not interrupt a connection while
   ssh was prompting for a passphrase or password.
 2010-01-13 21:32:44 +11:00
Darren Tucker 1035cb4729 - (dtucker) [openbsd-compat/readpassphrase.c] Update to OpenBSD's r1.21. 2010-01-13 18:32:59 +11:00
Darren Tucker ab3c2cab18 - (dtucker) [openbsd-compat/readpassphrase.c] Resync against OpenBSD's r1.18: missing restore of SIGTTOU and some whitespace. 2010-01-13 18:27:32 +11:00
Darren Tucker a8f20cff82 - (dtucker) [monitor_fdpass.c] Wrap poll.h include in ifdefs. 2010-01-13 10:54:46 +11:00
Darren Tucker 09aa4c000e - dtucker@cvs.openbsd.org 2010/01/12 08:33:17 
[session.c]
     Add explicit stat so we reliably detect nologin with bad perms.
     ok djm markus
 2010-01-12 19:51:48 +11:00
Darren Tucker ebc71d908c - djm@cvs.openbsd.org 2010/01/12 01:36:08 
[buffer.h bufaux.c]
     add a buffer_get_string_ptr_ret() that does the same as
     buffer_get_string_ptr() but does not fatal() on error; ok dtucker@
 2010-01-12 19:45:59 +11:00
Darren Tucker 1b0c2455da - dtucker@cvs.openbsd.org 2010/01/12 01:31:05 
[session.c]
     Do not allow logins if /etc/nologin exists but is not readable by the user
     logging in.  Noted by Jan.Pechanec at Sun, ok djm@ deraadt@
 2010-01-12 19:45:26 +11:00
Darren Tucker c6cc90b465 - djm@cvs.openbsd.org 2010/01/12 00:59:29 
[roaming_common.c]
     delete with extreme prejudice a debug() that fired with every keypress;
     ok dtucker deraadt
 2010-01-12 19:43:46 +11:00
Darren Tucker e371a13238 - djm@cvs.openbsd.org 2010/01/12 00:58:25 
[monitor_fdpass.c]
     avoid spinning when fd passing on nonblocking sockets by calling poll()
     in the EINTR/EAGAIN path, much like we do in atomicio; ok dtucker@
 2010-01-12 19:43:12 +11:00
Darren Tucker 69c01b1c4a - dtucker@cvs.openbsd.org 2010/01/12 00:16:47 
[authfile.c]
     Fix bug introduced in r1.78 (incorrect brace location) that broke key auth.
     Patch from joachim joachimschipper nl.
 2010-01-12 19:42:29 +11:00
Darren Tucker d04758dc4c - djm@cvs.openbsd.org 2010/01/11 10:51:07 
[ssh-keygen.c]
     when converting keys, truncate key comments at 72 chars as per RFC4716;
     bz#1630 reported by tj AT castaglia.org; ok markus@
 2010-01-12 19:41:57 +11:00
Darren Tucker d4c86b1325 - dtucker@cvs.openbsd.org 2010/01/11 04:46:45 
[authfile.c sshconnect2.c]
     Do not prompt for a passphrase if we fail to open a keyfile, and log the
     reason the open failed to debug.
     bz #1693, found by tj AT castaglia org, ok djm@
 2010-01-12 19:41:22 +11:00
Darren Tucker 7ad8dd21da - dtucker@cvs.openbsd.org 2010/01/11 01:39:46 
[ssh_config channels.c ssh.1 channels.h ssh.c]
     Add a 'netcat mode' (ssh -W).  This connects stdio on the client to a
     single port forward on the server.  This allows, for example, using ssh as
     a ProxyCommand to route connections via intermediate servers.
     bz #1618, man page help from jmc@, ok markus@
 2010-01-12 19:40:27 +11:00
Darren Tucker 43551527dc - dtucker@cvs.openbsd.org 2010/01/10 07:15:56 
[auth.c]
     Output a debug if we can't open an existing keyfile.  bz#1694, ok djm@
 2010-01-10 19:27:17 +11:00
Darren Tucker d3300454d8 - dtucker@cvs.openbsd.org 2010/01/10 03:51:17 
[servconf.c]
     Add ChrootDirectory to sshd.c test-mode output
 2010-01-10 19:26:43 +11:00
Darren Tucker 7bd98e7f74 - dtucker@cvs.openbsd.org 2010/01/09 23:04:13 
[channels.c ssh.1 servconf.c sshd_config.5 sshd.c channels.h servconf.h
     ssh-keyscan.1 ssh-keyscan.c readconf.c sshconnect.c misc.c ssh.c
     readconf.h scp.1 sftp.1 ssh_config.5 misc.h]
     Remove RoutingDomain from ssh since it's now not needed.  It can be
     replaced with "route exec" or "nc -V" as a proxycommand.  "route exec"
     also ensures that trafic such as DNS lookups stays withing the specified
     routingdomain.  For example (from reyk):
     # route -T 2 exec /usr/sbin/sshd
     or inherited from the parent process
     $ route -T 2 exec sh
     $ ssh 10.1.2.3
     ok deraadt@ markus@ stevesk@ reyk@
 2010-01-10 10:31:12 +11:00
Darren Tucker 8c65f646a9 - (dtucker) [configure.ac misc.c readconf.c servconf.c ssh-keyscan.c] 
Remove hacks add for RoutingDomain in preparation for its removal.
 2010-01-10 10:26:57 +11:00
Darren Tucker 269275c90c - (dtucker) [defines.h] Remove now-undeeded PRIu64 define. 2010-01-09 22:33:37 +11:00
Darren Tucker 2c671bf6a8 - dtucker@cvs.openbsd.org 2010/01/09 11:17:56 
[sshd.c]
     Afer sshd receives a SIGHUP, ignore subsequent HUPs while sshd re-execs
     itself.  Prevents two HUPs in quick succession from resulting in sshd
     dying.  bz#1692, patch from Colin Watson via Ubuntu.
 2010-01-09 22:28:43 +11:00
Darren Tucker 70cc092817 - dtucker@cvs.openbsd.org 2010/01/09 11:13:02 
[sftp.c]
     Prevent sftp from derefing a null pointer when given a "-" without a
     command.  Also, allow whitespace to follow a "-".  bz#1691, path from
     Colin Watson via Debian.  ok djm@ deraadt@
 2010-01-09 22:28:03 +11:00
Darren Tucker 4b28251df4 - dtucker@cvs.openbsd.org 2010/01/09 05:17:00 
[roaming_client.c]
     Remove a PRIu64 format string that snuck in with roaming.  ok djm@
 2010-01-09 22:27:06 +11:00
Darren Tucker 37c1b3d6fc - djm@cvs.openbsd.org 2010/01/09 05:04:24 
[mux.c sshpty.h clientloop.c sshtty.c]
     quell tc[gs]etattr warnings when forcing a tty (ssh -tt), since we
     usually don't actually have a tty to read/set; bz#1686 ok dtucker@
 2010-01-09 22:26:23 +11:00
Darren Tucker 838891fe85 - jmc@cvs.openbsd.org 2010/01/09 03:36:00 
[sftp-server.8]
     bad place to forget a comma...
 2010-01-09 22:25:46 +11:00
Darren Tucker a2e10485c5 - djm@cvs.openbsd.org 2010/01/09 00:57:10 
[PROTOCOL]
     tweak language
 2010-01-09 22:25:14 +11:00
Darren Tucker db7bf82544 - djm@cvs.openbsd.org 2010/01/09 00:20:26 
[sftp-server.c sftp-server.8]
     add a 'read-only' mode to sftp-server(8) that disables open in write mode
     and all other fs-modifying protocol methods. bz#430 ok dtucker@
 2010-01-09 22:24:33 +11:00
Darren Tucker 0b8a2262ac - (dtucker) [loginrec.c] Use the SUSv3 specified name for the user name 
when using utmpx.  Patch from Ed Schouten.
 2010-01-09 18:18:04 +11:00
Darren Tucker 11b5c07941 - (dtucker) [roaming_client.c] Wrap inttypes.h in an ifdef. 2010-01-09 16:40:48 +11:00
Darren Tucker 709d0ce672 - (dtucker) [defines.h] define PRIu64 for platforms that don't have it. 2010-01-09 09:25:54 +11:00
Darren Tucker 9eba40cec9 - (dtucker) Wrap use of IPPROTO_IPV6 in an ifdef for platforms that don't 
have it.
 2010-01-09 09:02:07 +11:00
Darren Tucker 340d1688e6 - dtucker@cvs.openbsd.org 2010/01/08 21:50:49 
[sftp.c]
     Fix two warnings: possibly used unitialized and use a nul byte instead of
     NULL pointer.  ok djm@
 2010-01-09 08:54:31 +11:00
Darren Tucker 1a8f535b97 - (dtucker) [roaming_serv.c] Include includes.h for u_intXX_t types. 2010-01-08 20:45:42 +11:00
Darren Tucker cb5a1b6f70 - (dtucker] [misc.c] Shrink the area covered by USE_ROUTINGDOMAIN more 
to eliminate an unused variable warning.
 2010-01-08 20:09:01 +11:00
Darren Tucker e83c3ea4b8 - (dtucker) [misc.c] Move the routingdomain ifdef to allow the socket to 
be created.
 2010-01-08 20:03:56 +11:00
Darren Tucker 843f0fa16d - (dtucker) [sftp.c] Expand ifdef for libedit to cover complete_is_remote 
too.
 2010-01-08 19:56:33 +11:00
Darren Tucker 1f5e3dc274 - (dtucker) [configure.ac misc.c readconf.c servconf.c ssh-keyscan.c] Make 
RoutingDomain an unsupported option on platforms that don't have it.
 2010-01-08 19:53:52 +11:00
Darren Tucker e67f7db968 - (dtucker) [sftp.c] ifdef out the sftp completion bits for platforms that 
don't have libedit.
 2010-01-08 19:50:02 +11:00
Darren Tucker dce7a92c7a - (dtucker) [Makefile.in] .c files do not belong in the OBJ lines. 2010-01-08 19:27:57 +11:00
Darren Tucker 8cbd403fde - (dtucker) [Makefile.in added roaming_client.c roaming_serv.c] Import new 
files for roaming and add to Makefile.
 2010-01-08 19:13:25 +11:00
Darren Tucker aaf51d2d5b - djm@cvs.openbsd.org 2010/01/04 02:25:15 
[sftp-server.c]
     bz#1566 don't unnecessarily dup() in and out fds for sftp-server;
     ok markus@
 2010-01-08 19:04:49 +11:00
Darren Tucker 909d858d6b - djm@cvs.openbsd.org 2010/01/04 02:03:57 
[sftp.c]
     Implement tab-completion of commands, local and remote filenames for sftp.
     Hacked on and off for some time by myself, mouring, Carlos Silva (via 2009
     Google Summer of Code) and polished to a fine sheen by myself again.
     It should deal more-or-less correctly with the ikky corner-cases presented
     by quoted filenames, but the UI could still be slightly improved.
     In particular, it is quite slow for remote completion on large directories.
     bz#200; ok markus@
 2010-01-08 19:02:40 +11:00
Darren Tucker 0c348f5b9e - dtucker@cvs.openbsd.org 2010/01/04 01:45:30 
[sshconnect2.c]
     Don't escape backslashes in the SSH2 banner.  bz#1533, patch from
     Michal Gorny via Gentoo.
 2010-01-08 18:58:05 +11:00
Darren Tucker 98e5d9a0d3 - jmc@cvs.openbsd.org 2009/12/29 18:03:32 
[sshd_config.5 ssh_config.5]
     sort previous;
 2010-01-08 18:57:39 +11:00
Darren Tucker 535b5e1721 - stevesk@cvs.openbsd.org 2009/12/29 16:38:41 
[sshd_config.5 readconf.c ssh_config.5 scp.1 servconf.c sftp.1 ssh.1]
     Rename RDomain config option to RoutingDomain to be more clear and
     consistent with other options.
     NOTE: if you currently use RDomain in the ssh client or server config,
     or ssh/sshd -o, you must update to use RoutingDomain.
     ok markus@ djm@
 2010-01-08 18:56:48 +11:00
Darren Tucker 75456e8ab2 - stevesk@cvs.openbsd.org 2009/12/25 19:40:21 
[readconf.c servconf.c misc.h ssh-keyscan.c misc.c]
     validate routing domain is in range 0-RT_TABLEID_MAX.
     'Looks right' deraadt@
 2010-01-08 18:55:58 +11:00
Darren Tucker f2705c8b7d - djm@cvs.openbsd.org 2009/12/20 23:20:40 
[PROTOCOL]
     fix an incorrect magic number and typo in PROTOCOL; bz#1688
     report and fix from ueno AT unixuser.org
 2010-01-08 18:54:17 +11:00
Darren Tucker b8c884a0ba - guenther@cvs.openbsd.org 2009/12/20 07:28:36 
[ssh.c sftp.c scp.c]
     When passing user-controlled options with arguments to other programs,
     pass the option and option argument as separate argv entries and
     not smashed into one (e.g., as -l foo and not -lfoo).  Also, always
     pass a "--" argument to stop option parsing, so that a positional
     argument that starts with a '-' isn't treated as an option.  This
     fixes some error cases as well as the handling of hostnames and
     filenames that start with a '-'.
     Based on a diff by halex@
     ok halex@ djm@ deraadt@
 2010-01-08 18:53:43 +11:00
Darren Tucker 57e0d01260 - markus@cvs.openbsd.org 2009/12/11 18:16:33 
[key.c]
     switch from 35 to the more common value of RSA_F4 == (2**16)+1 == 65537
     for the RSA public exponent; discussed with provos; ok djm@
 2010-01-08 18:52:27 +11:00
Darren Tucker b5082e90a1 - dtucker@cvs.openbsd.org 2009/12/06 23:53:54 
[sftp.c]
     fix potential divide-by-zero in sftp's "df" output when talking to a server
     that reports zero files on the filesystem (Unix filesystems always have at
     least the root inode).  From Steve McClellan at radisys, ok djm@
 2010-01-08 18:51:47 +11:00
Darren Tucker 75694dbe77 - djm@cvs.openbsd.org 2009/12/06 23:53:45 
[roaming_common.c]
     use socklen_t for getsockopt optlen parameter; reported by
     Steve.McClellan AT radisys.com, ok dtucker@
 2010-01-08 18:51:14 +11:00
Darren Tucker 5246df47a4 - dtucker@cvs.openbsd.org 2009/12/06 23:41:15 
[sshconnect2.c]
     zap unused variable and strlen; from Steve McClellan, ok djm
 2010-01-08 18:50:46 +11:00
Darren Tucker c4dc4f5bac - halex@cvs.openbsd.org 2009/11/22 13:18:00 
[sftp.c]
     make passing of zero-length arguments to ssh safe by
     passing "-<switch>" "<value>" rather than "-<switch><value>"
     ok dtucker@, guenther@, djm@
 2010-01-08 18:50:04 +11:00
Darren Tucker 70d87693f4 - djm@cvs.openbsd.org 2009/11/20 03:24:07 
[misc.c]
     correct off-by-one in percent_expand(): we would fatal() when trying
     to expand EXPAND_MAX_KEYS, allowing only EXPAND_MAX_KEYS-1 to actually
     work.  Note that nothing in OpenSSH actually uses close to this limit at
     present.  bz#1607 from Jan.Pechanec AT Sun.COM
 2010-01-08 18:49:16 +11:00
Darren Tucker ab79169e29 - dtucker@cvs.openbsd.org 2009/11/20 00:59:36 
[sshconnect2.c]
     Use the HostKeyAlias when prompting for passwords.  bz#1039, ok djm@
 2010-01-08 18:48:02 +11:00
Darren Tucker 210631922f - djm@cvs.openbsd.org 2009/11/20 00:54:01 
[sftp.c]
     bz#1588 change "Connecting to host..." message to "Connected to host."
     and delay it until after the sftp protocol connection has been established.
     Avoids confusing sequence of messages when the underlying ssh connection
     experiences problems. ok dtucker@
 2010-01-08 17:10:36 +11:00