tyler.durden
/
openssh-portable
mirror of https://github.com/PowerShell/openssh-portable.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
5,762 Commits 6 Branches 20 Tags 97 MiB
Commit Graph

5278 Commits

Author SHA1 Message Date
Damien Miller 9aa72ba57a - naddy@cvs.openbsd.org 2009/01/24 17:10:22 
[ssh_config.5 sshd_config.5]
     sync list of preferred ciphers; ok djm@
 2009-01-28 16:34:00 +11:00
Damien Miller 67081b5148 - djm@cvs.openbsd.org 2009/01/23 07:58:11 
[myproposal.h]
     prefer CTR modes and revised arcfour (i.e w/ discard) modes to CBC
     modes; ok markus@
 2009-01-28 16:33:31 +11:00
Damien Miller e37dde06a6 - djm@cvs.openbsd.org 2009/01/22 10:09:16 
[auth-options.c]
     another chunk of a2port() diff that got away. wtfdjm??
 2009-01-28 16:33:01 +11:00
Damien Miller 3dc71ad865 - djm@cvs.openbsd.org 2009/01/22 10:02:34 
[clientloop.c misc.c readconf.c readconf.h servconf.c servconf.h]
     [serverloop.c ssh-keyscan.c ssh.c sshd.c]
     make a2port() return -1 when it encounters an invalid port number
     rather than 0, which it will now treat as valid (needed for future work)
     adjust current consumers of a2port() to check its return value is <= 0,
     which in turn required some things to be converted from u_short => int
     make use of int vs. u_short consistent in some other places too
     feedback & ok markus@
 2009-01-28 16:31:22 +11:00
Damien Miller 9576ac4afc - djm@cvs.openbsd.org 2009/01/22 09:49:57 
[channels.c]
     oops! I committed the wrong version of the Channel->path diff,
     it was missing some tweaks suggested by stevesk@
 2009-01-28 16:30:33 +11:00
Damien Miller a1c1b6c86d - djm@cvs.openbsd.org 2009/01/22 09:46:01 
[channels.c channels.h session.c]
     make Channel->path an allocated string, saving a few bytes here and
     there and fixing bz#1380 in the process; ok markus@
 2009-01-28 16:29:49 +11:00
Damien Miller 5bc6aae3db - stevesk@cvs.openbsd.org 2009/01/15 17:38:43 
[readconf.c]
     1) use obsolete instead of alias for consistency
     2) oUserKnownHostsFile not obsolete but oGlobalKnownHostsFile2 is
        so move the comment.
     3) reorder so like options are together
     ok djm@
 2009-01-28 16:27:31 +11:00
Damien Miller 1781f53d75 - djm@cvs.openbsd.org 2009/01/14 01:38:06 
[channels.c]
     support SOCKS4A protocol, from dwmw2 AT infradead.org via bz#1482;
     "looks ok" markus@
 2009-01-28 16:24:41 +11:00
Damien Miller ccf7e224ab - djm@cvs.openbsd.org 2009/01/01 21:17:36 
[kexgexs.c]
     fix hash calculation for KEXGEX: hash over the original client-supplied
     values and not the sanity checked versions that we acutally use;
     bz#1540 reported by john.smith AT arrows.demon.co.uk
     ok markus@
 2009-01-28 16:23:06 +11:00
Damien Miller 7a60621d13 - djm@cvs.openbsd.org 2009/01/01 21:14:35 
[channels.c]
     call channel destroy callbacks on receipt of open failure messages.
     fixes client hangs when connecting to a server that has MaxSessions=0
     set spotted by imorgan AT nas.nasa.gov; ok markus@
 2009-01-28 16:22:34 +11:00
Damien Miller 17819015f0 - okan@cvs.openbsd.org 2008/12/30 00:46:56 
[sshd_config.5]
     add AllowAgentForwarding to available Match keywords list
     ok djm
 2009-01-28 16:20:17 +11:00
Damien Miller a70ac76a87 - stevesk@cvs.openbsd.org 2008/12/29 02:23:26 
[pathnames.h]
     no need to escape single quotes in comments
 2009-01-28 16:19:52 +11:00
Damien Miller b2c17d4b17 - stevesk@cvs.openbsd.org 2008/12/29 01:12:36 
[ssh-keyscan.1]
     fix example, default key type is rsa for 3+ years; from
     frederic.perrin@resel.fr
 2009-01-28 16:18:03 +11:00
Damien Miller 7375fe2c6d - stevesk@cvs.openbsd.org 2008/12/10 03:55:20 
[addrmatch.c]
     o cannot be NULL here but use xfree() to be consistent; ok djm@
 2009-01-28 16:16:00 +11:00
Damien Miller b3f2c9fcaf - stevesk@cvs.openbsd.org 2008/12/09 22:37:33 
[clientloop.c]
     fix typo in error message
 2009-01-28 16:15:30 +11:00
Damien Miller 62fd18a2b7 - sobrado@cvs.openbsd.org 2008/12/09 15:35:00 
[sftp.1 sftp.c]
     update for the synopses displayed by the 'help' command, there are a
     few missing flags; add 'bye' to the output of 'help'; sorting and spacing.
     jmc@ suggested replacing .Oo/.Oc with a single .Op macro.
     ok jmc@
 2009-01-28 16:14:09 +11:00
Damien Miller c30def96e2 - djm@cvs.openbsd.org 2008/12/09 04:32:22 
[auth2-chall.c]
     replace by-hand string building with xasprinf(); ok deraadt@
 2009-01-28 16:13:39 +11:00
Damien Miller b53d8a1882 - stevesk@cvs.openbsd.org 2008/12/09 03:20:42 
[channels.c servconf.c]
     channel_print_adm_permitted_opens() should deal with all the printing
     for that config option.  suggested by markus@; ok markus@ djm@
     dtucker@
 2009-01-28 16:13:04 +11:00
Damien Miller 0266677f0f - (djm) [contrib/ssh-copy-id.1 contrib/ssh-copy-id] bz#1492: Make 
ssh-copy-id copy id_rsa.pub by default (instead of the legacy "identity"
   key). Patch from cjwatson AT debian.org
 2009-01-21 20:29:20 +11:00
Damien Miller 819dbb633a - (djm) [channels.c] bz#1419: support "on demand" X11 forwarding via 
launchd on OS X; patch from vgiffin AT apple.com, slightly tweaked;
   ok dtucker@
 2009-01-21 16:46:26 +11:00
Damien Miller 1598d6bc55 - (djm) [uidswap.c] bz#1412: Support >16 supplemental groups in OS X. 
Patch based on one from vgiffin AT apple.com; ok dtucker@
 2009-01-21 16:04:24 +11:00
Tim Rice 2676791c38 - (tim) [configure.ac] Move check_for_libcrypt_later=1 in *-*-sysv5*) section. 
OpenServer 6 doesn't need libcrypt.
 2009-01-07 20:50:08 -08:00
Tim Rice 351529ce30 - (tim) [configure.ac defines.h openbsd-compat/port-uw.c 
openbsd-compat/xcrypt.c] Add SECUREWARE support to OpenServer 6 SVR5 ABI.
   OK djm@ dtucker@
 2009-01-07 10:04:12 -08:00
Damien Miller 7ebfad789f - djm@cvs.openbsd.org 2008/12/09 03:02:37 
[sftp.1 sftp.c]
     correct sftp(1) and corresponding usage syntax;
     bz#1518 patch from imorgan AT nas.nasa.gov; ok deraadt@ improved diff jmc@
 2008-12-09 14:12:33 +11:00
Damien Miller 0d772d9d11 - djm@cvs.openbsd.org 2008/12/09 02:58:16 
[readconf.c]
     don't leave junk (free'd) pointers around in Forward *fwd argument on
     failure; avoids double-free in ~C -L handler when given an invalid
     forwarding specification; bz#1539 report from adejong AT debian.org
     via Colin Watson; ok markus@ dtucker@
 2008-12-09 14:12:05 +11:00
Damien Miller 1be2cc4496 - djm@cvs.openbsd.org 2008/12/09 02:39:59 
[sftp.c]
     Deal correctly with failures in remote stat() operation in sftp,
     correcting fail-on-error behaviour in batchmode. bz#1541 report and
     fix from anedvedicky AT gmail.com; ok markus@
 2008-12-09 14:11:49 +11:00
Damien Miller 586b00532f - djm@cvs.openbsd.org 2008/12/09 02:38:18 
[clientloop.c]
     The ~C escape handler does not work correctly for multiplexed sessions -
     it opens a commandline on the master session, instead of on the slave
     that requested it. Disable it on slave sessions until such time as it
     is fixed; bz#1543 report from Adrian Bridgett via Colin Watson
     ok markus@
 2008-12-09 14:11:32 +11:00
Damien Miller 16a73076b7 - markus@cvs.openbsd.org 2008/12/02 19:09:38 
[channels.c]
     s/remote_id/id/ to be more consistent with other code; ok djm@
 2008-12-08 09:55:25 +11:00
Damien Miller 5a33ec68bc - markus@cvs.openbsd.org 2008/12/02 19:08:59 
[serverloop.c]
     backout 1.149, since it's not necessary and openssh clients send
     broken CHANNEL_FAILURE/SUCCESS messages since about 2004; ok djm@
 2008-12-08 09:55:02 +11:00
Damien Miller 8533c7801d - markus@cvs.openbsd.org 2008/12/02 19:01:07 
[clientloop.c]
     we have to use the recipient's channel number (RFC 4254) for
     SSH2_MSG_CHANNEL_SUCCESS/SSH2_MSG_CHANNEL_FAILURE messages,
     otherwise we trigger 'Non-public channel' error messages on sshd
     systems with clientkeepalive enabled; noticed by sturm; ok djm;
 2008-12-08 09:54:40 +11:00
Damien Miller 7df2e40074 - (djm) [configure.ac] bz#1538: better test for ProPolice/SSP: actually 
use some stack in main().
   Report and suggested fix from vapier AT gentoo.org
 2008-12-08 09:35:36 +11:00
Darren Tucker 23645649bb - dtucker@cvs.openbsd.org 2008/11/30 11:59:26 
[monitor_fdpass.c]
     Retry sendmsg/recvmsg on EAGAIN and EINTR; ok djm@
 2008-12-01 21:42:13 +11:00
Darren Tucker 99d11a3ed2 - markus@cvs.openbsd.org 2008/11/21 15:47:38 
[packet.c]
     packet_disconnect() on padding error, too.  should reduce the success
     probability for the CPNI-957037 Plaintext Recovery Attack to 2^-18
     ok djm@
 2008-12-01 21:40:48 +11:00
Darren Tucker 83795d61d2 - (dtucker) [contrib/cygwin/{Makefile,ssh-host-config}] Add new doc files 
and tweak the is-sshd-running check in ssh-host-config.  Patch from
   vinschen at redhat com.
 2008-12-01 21:34:28 +11:00
Darren Tucker d3782b4e76 cmsg thing was originally spotted by des 2008-11-23 19:05:53 +11:00
Darren Tucker 69087eae6d - (dtucker) [monitor_fdpass.c] Reduce diff vs OpenBSD by moving some 
declarations, removing an unnecessary union member and adding whitespace.
    ok djm some time ago.
 2008-11-23 14:03:19 +11:00
Tim Rice 0f4d2c02f2 - (tim) [addrmatch.c configure.ac] Some platforms do not have sin6_scope_id 
member of sockaddr_in6. Also reported in Bug 1491 by David Leonard. OK and
   feedback by djm@
 2008-11-18 21:26:41 -08:00
Damien Miller edecb37a4b test commit 2008-11-19 11:54:24 +11:00
Darren Tucker 4a6f62d4ae - djm@cvs.openbsd.org 2008/11/10 02:06:35 
[regress/putty-ciphers.sh]
     PuTTY supports AES CTR modes, so interop test against them too
 2008-11-11 16:55:25 +11:00
Darren Tucker 22662e880f - stevesk@cvs.openbsd.org 2008/11/11 03:55:11 
[channels.c]
     for sshd -T print 'permitopen any' vs. 'permitopen' for case of no
     permitopen's; ok and input dtucker@
 2008-11-11 16:40:22 +11:00
Darren Tucker 49c31c4225 - stevesk@cvs.openbsd.org 2008/11/11 02:58:09 
[servconf.c]
     USE_AFS not referenced so remove #ifdef.  fixes sshd -T not printing
     kerberosgetafstoken. ok dtucker@
     (Id sync only, we still want the ifdef in portable)
 2008-11-11 16:39:44 +11:00
Darren Tucker 63917bd0da - tobias@cvs.openbsd.org 2008/11/09 12:34:47 
[session.c ssh.1]
     typo fixed (overriden -> overridden)
     ok espie, jmc
 2008-11-11 16:33:48 +11:00
Darren Tucker c6d744e9cd - dtucker@cvs.openbsd.org 2008/11/07 23:34:48 
[auth2-jpake.c]
     Move JPAKE define to make life easier for portable.  ok djm@
 2008-11-11 16:33:03 +11:00
Darren Tucker b57fab6b0b - stevesk@cvs.openbsd.org 2008/11/07 18:50:18 
[nchan.c]
     add space to some log/debug messages for readability; ok djm@ markus@
 2008-11-11 16:32:25 +11:00
Darren Tucker e15fb09847 - stevesk@cvs.openbsd.org 2008/11/07 00:42:12 
[ssh-keygen.c]
     spelling/typo in comment
 2008-11-11 16:31:43 +11:00
Darren Tucker ff4350e1b8 - (dtucker) OpenBSD CVS Sync 
- jmc@cvs.openbsd.org 2008/11/05 11:22:54
     [servconf.c]
     passord -> password;
     fixes user/5975 from Rene Maroufi
 2008-11-11 16:31:05 +11:00
Damien Miller 0164cb8a87 - stevesk@cvs.openbsd.org 2008/11/05 03:23:09 
[clientloop.c ssh.1]
     add dynamic forward escape command line; ok djm@
 2008-11-05 16:30:31 +11:00
Damien Miller 1a0442fce8 - stevesk@cvs.openbsd.org 2008/11/04 19:18:00 
[readconf.c]
     because parse_forward() is now used to parse all forward types (DLR),
     and it malloc's space for host variables, we don't need to malloc
     here.  fixes small memory leaks.

     previously dynamic forwards were not parsed in parse_forward() and
     space was not malloc'd in that case.

     ok djm@
 2008-11-05 16:30:06 +11:00
Damien Miller 01ed2272a1 - djm@cvs.openbsd.org 2008/11/04 08:22:13 
[auth.h auth2.c monitor.c monitor.h monitor_wrap.c monitor_wrap.h]
     [readconf.c readconf.h servconf.c servconf.h ssh2.h ssh_config.5]
     [sshconnect2.c sshd_config.5 jpake.c jpake.h schnorr.c auth2-jpake.c]
     [Makefile.in]
     Add support for an experimental zero-knowledge password authentication
     method using the J-PAKE protocol described in F. Hao, P. Ryan,
     "Password Authenticated Key Exchange by Juggling", 16th Workshop on
     Security Protocols, Cambridge, April 2008.

     This method allows password-based authentication without exposing
     the password to the server. Instead, the client and server exchange
     cryptographic proofs to demonstrate of knowledge of the password while
     revealing nothing useful to an attacker or compromised endpoint.

     This is experimental, work-in-progress code and is presently
     compiled-time disabled (turn on -DJPAKE in Makefile.inc).

     "just commit it.  It isn't too intrusive." deraadt@
 2008-11-05 16:20:46 +11:00
Damien Miller 6f66d34308 - djm@cvs.openbsd.org 2008/11/04 07:58:09 
[auth.c]
     need unistd.h for close() prototype
     (ID sync only)
 2008-11-05 16:12:54 +11:00
Damien Miller 7fc5c0f621 - OpenBSD CVS Sync 
- djm@cvs.openbsd.org 2008/11/03 08:59:41
     [servconf.c]
     include MaxSessions in sshd -T output; patch from imorgan AT nas.nasa.gov
 2008-11-05 16:12:11 +11:00
Damien Miller 250071fd77 - (djm) [contrib/sshd.pam.generic contrib/caldera/sshd.pam] 
[contrib/redhat/sshd.pam] Move pam_nologin to account group from
   incorrect auth group in example files;
   patch from imorgan AT nas.nasa.gov
 2008-11-03 20:18:12 +11:00
Damien Miller 85dec73463 - (djm) [contrib/caldera/ssh-host-keygen contrib/suse/rc.sshd] 
Make example scripts generate keys with default sizes rather than fixed,
   non-default 1024 bits; patch from imorgan AT nas.nasa.gov
 2008-11-03 20:16:01 +11:00
Damien Miller f4b39538f4 - stevesk@cvs.openbsd.org 2008/11/03 02:44:41 
[readconf.c]
     fix comment
 2008-11-03 19:28:21 +11:00
Damien Miller a279d252ab - stevesk@cvs.openbsd.org 2008/11/03 01:07:02 
[readconf.c]
     remove valueless comment
 2008-11-03 19:28:07 +11:00
Damien Miller 660d7dabc0 - stevesk@cvs.openbsd.org 2008/11/02 00:16:16 
[ttymodes.c]
     protocol 2 tty modes support is now 7.5 years old so remove these
     debug3()s; ok deraadt@
 2008-11-03 19:27:52 +11:00
Damien Miller a699d952e5 - stevesk@cvs.openbsd.org 2008/11/01 17:40:33 
[clientloop.c readconf.c readconf.h ssh.c]
     merge dynamic forward parsing into parse_forward(); 'i think this is OK' djm@
 2008-11-03 19:27:34 +11:00
Damien Miller c1719f7f0d - sobrado@cvs.openbsd.org 2008/11/01 11:14:36 
[ssh-keyscan.1 ssh-keyscan.c]
     the ellipsis is not an optional argument; while here, improve spacing.
 2008-11-03 19:27:07 +11:00
Damien Miller a009433333 - stevesk@cvs.openbsd.org 2008/11/01 06:43:33 
[channels.c]
     fix some typos in log messages; ok djm@
 2008-11-03 19:26:35 +11:00
Damien Miller f7475d7e97 - djm@cvs.openbsd.org 2008/11/01 04:50:08 
[sshconnect2.c]
     sprinkle ARGSUSED on dispatch handlers
     nuke stale unusued prototype
 2008-11-03 19:26:18 +11:00
Damien Miller 2b20a92b7b - stevesk@cvs.openbsd.org 2008/10/31 15:05:34 
[dispatch.c]
     remove unused #define DISPATCH_MIN; ok markus@
 2008-11-03 19:26:00 +11:00
Damien Miller e7261c7e36 - stevesk@cvs.openbsd.org 2008/10/30 19:31:16 
[clientloop.c sshd.c]
     don't need to #include "monitor_fdpass.h"
 2008-11-03 19:25:40 +11:00
Damien Miller a414cd3b19 - stevesk@cvs.openbsd.org 2008/10/17 18:36:24 
[ssh_config.5]
     correct and clarify VisualHostKey; ok jmc@
 2008-11-03 19:25:21 +11:00
Damien Miller ece92c8c5e - stevesk@cvs.openbsd.org 2008/10/14 18:11:33 
[sshconnect.c]
     use #define ROQUIET here; no binary change. ok dtucker@
 2008-11-03 19:25:03 +11:00
Damien Miller 2f54adabbb - stevesk@cvs.openbsd.org 2008/10/10 05:00:12 
[key.c]
     typo in error message; ok djm@
 2008-11-03 19:24:16 +11:00
Damien Miller b4acb47f5f - stevesk@cvs.openbsd.org 2008/10/10 04:55:16 
[scp.c]
     spelling in comment; ok djm@
 2008-11-03 19:23:45 +11:00
Damien Miller c13c3ee44a - jmc@cvs.openbsd.org 2008/10/09 06:54:22 
[ssh.c]
     add -y to usage();
 2008-11-03 19:23:28 +11:00
Damien Miller 51bde6000a - djm@cvs.openbsd.org 2008/10/09 03:50:54 
[servconf.c sshd_config.5]
     support setting PermitEmptyPasswords in a Match block
     requested in PR3891; ok dtucker@
 2008-11-03 19:23:10 +11:00
Damien Miller e272a5bb29 - djm@cvs.openbsd.org 2008/10/08 23:34:03 
[ssh.1 ssh.c]
     Add -y option to force logging via syslog rather than stderr.
     Useful for daemonised ssh connection (ssh -f). Patch originally from
     and ok'd by markus@
 2008-11-03 19:22:37 +11:00
Damien Miller c4d1b36cc2 aadt@cvs.openbsd.org 2008/10/03 23:56:28 
[sshconnect2.c]
     Repair strnvis() buffersize of 4*n+1, with termination gauranteed by the
     function.
     spotted by des@freebsd, who commited an incorrect fix to the freebsd tree
     and (as is fairly typical) did not report the problem to us.  But this fix
     is correct.
     ok djm
 2008-11-03 19:22:09 +11:00
Damien Miller 49b78d4fbc - jmc@cvs.openbsd.org 2008/10/03 13:08:12 
[sshd.8]
     do not give an example of how to chmod files: we can presume the user
     knows that. removes an ambiguity in the permission of authorized_keys;
     ok deraadt
 2008-11-03 19:21:21 +11:00
Damien Miller d58f56000c - millert@cvs.openbsd.org 2008/10/02 14:39:35 
[session.c]
     Convert an unchecked strdup to xstrdup.  OK deraadt@
 2008-11-03 19:20:49 +11:00
Damien Miller 456e6f0ebb - markus@cvs.openbsd.org 2008/09/11 14:22:37 
[compat.c compat.h nchan.c ssh.c]
     only send eow and no-more-sessions requests to openssh 5 and newer;
     fixes interop problems with broken ssh v2 implementations; ok djm@
 2008-11-03 19:20:10 +11:00
Damien Miller 15bce6b8f0 - djm@cvs.openbsd.org 2008/09/06 12:24:13 
[kex.c]
     OpenSSL 0.9.8h supplies a real EVP_sha256 so we do not need our
     replacement anymore
     (ID sync only for portable - we still need this)
 2008-11-03 19:19:12 +11:00
Damien Miller ad793d59a9 - djm@cvs.openbsd.org 2008/08/21 04:09:57 
[session.c]
     allow ForceCommand internal-sftp with arguments. based on patch from
     michael.barabanov AT gmail.com; ok markus@
 2008-11-03 19:17:57 +11:00
Damien Miller fa51b1626c - krw@cvs.openbsd.org 2008/08/02 04:29:51 
[ssh_config.5]
     whitepsace -> whitespace. From Matthew Clarke via bugs@.
 2008-11-03 19:17:33 +11:00
Damien Miller c674d580dc - markus@cvs.openbsd.org 2008/07/31 14:48:28 
[sshconnect2.c]
     don't allocate space for empty banners; report t8m at centrum.cz;
     ok deraadt
 2008-11-03 19:16:57 +11:00
Damien Miller c6aadd994d - grunk@cvs.openbsd.org 2008/07/25 07:05:16 
[key.c]
     In random art visualization, make sure to use the end marker only at the
     end.  Initial diff by Dirk Loss, tweaks and ok djm@
 2008-11-03 19:16:20 +11:00
Damien Miller 9f6fb56ab8 - grunk@cvs.openbsd.org 2008/07/25 06:56:35 
[ssh_config]
     Add VisualHostKey to example file, ok djm@
 2008-11-03 19:15:44 +11:00
Darren Tucker c570ff7fa4 - (dtucker) [config.guess config.sub] Update to latest versions from 
http://git.savannah.gnu.org/gitweb/ (2008-04-14 and 2008-06-16
   respectively).
 2008-09-06 18:20:57 +10:00
Darren Tucker 661f63b7d2 - (dtucker) [openbsd-compat/bsd-poll.c] correctly check for number of FDs 
larger than FD_SETSIZE (OpenSSH only ever uses poll with one fd).  Patch
   from Nicholas Marriott.
 2008-08-30 07:32:37 +10:00
Damien Miller 212f0b0879 - (djm) [servconf.c] Print UsePAM option in config test mode (when it 
has been compiled in); report from nix-corp AT esperi.org.uk
   ok dtucker@
 2008-07-23 17:42:29 +10:00
Damien Miller 6ef430dcc3 - djm@cvs.openbsd.org 2008/07/23 07:36:55 
[servconf.c]
     do not try to print options that have been compile-time disabled
     in config test mode (sshd -T); report from nix-corp AT esperi.org.uk
     ok dtucker@
 2008-07-23 17:40:04 +10:00
Damien Miller 8f42e9b75a - (djm) Release OpenSSH-5.1 2008-07-21 18:22:25 +10:00
Damien Miller 1f8909c2c2 - (djm) [README contrib/caldera/openssh.spec contrib/redhat/openssh.spec] 
[contrib/suse/openssh.spec] Update version number in README and RPM specs
 2008-07-21 18:21:52 +10:00
Damien Miller aaae43e7d3 - djm@cvs.openbsd.org 2008/07/21 08:19:07 
[version.h]
     openssh-5.1
 2008-07-21 18:21:05 +10:00
Damien Miller aa5f433287 - jmc@cvs.openbsd.org 2008/07/18 22:51:01 
[sftp-server.8]
     no need for .Pp before or after .Sh;
 2008-07-21 18:20:39 +10:00
Damien Miller 2e28d8622d - (djm) [sshconnect2.c] vis.h isn't available everywhere 2008-07-17 19:15:43 +10:00
Darren Tucker 9a3f2b4cc3 - (dtucker) [openbsd-compat/bsd-cygwin_util.c] Remove long-unneeded compat 
code, replace with equivalent cygwin library call.  Patch from vinschen
   at redhat.comi, ok djm@.
 2008-07-17 19:03:49 +10:00
Damien Miller a1d03a5069 - djm@cvs.openbsd.org 2008/07/17 08:51:07 
[auth2-hostbased.c]
     strip trailing '.' from hostname when HostbasedUsesNameFromPacketOnly=yes
     report and patch from res AT qoxp.net (bz#1200); ok markus@
 2008-07-17 18:57:19 +10:00
Damien Miller 7ba0ca7f6f - djm@cvs.openbsd.org 2008/07/17 08:48:00 
[sshconnect2.c]
     strnvis preauth banner; pointed out by mpf@ ok markus@
 2008-07-17 18:57:06 +10:00
Damien Miller 6ef17495e9 - djm@cvs.openbsd.org 2008/07/16 11:52:19 
[channels.c]
     this loop index should be automatic, not static
 2008-07-16 22:42:06 +10:00
Damien Miller b9d3bee003 - djm@cvs.openbsd.org 2008/07/16 11:51:14 
[clientloop.c]
     rename variable first_gc -> last_gc (since it is actually the last
     in the list).
 2008-07-16 22:40:52 +10:00
Damien Miller 94717b0be1 - djm@cvs.openbsd.org 2008/07/15 02:23:14 
[sftp.1]
     number of pipelined requests is now 64;
     prodded by Iain.Morgan AT nasa.gov
 2008-07-16 21:17:23 +10:00
Damien Miller c4657ef181 - (djm) [openbsd-compat/fake-rfc2553.c openbsd-compat/fake-rfc2553.h] 
return EAI_FAMILY when trying to lookup unsupported address family;
   from vinschen AT redhat.com
 2008-07-14 21:37:36 +10:00
Damien Miller 1fc231cbb5 - (djm) [contrib/cygwin/Makefile contrib/cygwin/ssh-host-config] 
[contrib/cygwin/ssh-user-config contrib/cygwin/sshd-inetd]
   Revamped and simplified Cygwin ssh-host-config script that uses
   unified csih configuration tool. Requires recent Cygwin.
   Patch from vinschen AT redhat.com
 2008-07-14 12:12:52 +10:00
Damien Miller 276571c29d - djm@cvs.openbsd.org 2008/07/14 01:55:56 
[sftp-server.8]
     mention requirement for /dev/log inside chroot when using sftp-server
     with ChrootDirectory
 2008-07-14 12:09:57 +10:00
Damien Miller 36d7056f4d - (djm) [umac.c] Rename variable s/buffer_ptr/bufp/ to avoid clash; 
reported by cristian.ionescu-idbohrn AT axis.com
 2008-07-14 12:04:43 +10:00
Damien Miller 639ce593d4 - (djm) [openbsd-compat/rresvport.c] Add unistd.h for missing close() 
prototype; reported by cristian.ionescu-idbohrn AT axis.com
 2008-07-14 12:03:27 +10:00
Damien Miller ce02e5e09e - (djm) [openbsd-compat/bindresvport.c] Rename variables s/sin/in/ to 
avoid clash with sin(3) function; reported by
   cristian.ionescu-idbohrn AT axis.com
 2008-07-14 12:02:24 +10:00
Damien Miller 7f980d1ac7 - djm@cvs.openbsd.org 2008/07/13 22:16:03 
[sftp.c]
     increase number of piplelined requests so they properly fill the
     (recently increased) channel window. prompted by rapier AT psc.edu;
     ok markus@
 2008-07-14 11:29:24 +10:00
Damien Miller 163886ff71 - djm@cvs.openbsd.org 2008/07/13 22:13:07 
[channels.c]
     use struct sockaddr_storage instead of struct sockaddr for accept(2)
     address argument. from visibilis AT yahoo.com in bz#1485; ok markus@
 2008-07-14 11:28:58 +10:00
Damien Miller 81dec0589a - sthen@cvs.openbsd.org 2008/07/13 21:22:52 
[ssh-keygen.c]
     Change "ssh-keygen -F [host] -l" to not display random art unless
     -v is also specified, making it consistent with the manual and other
     uses of -l.
     ok grunk@
 2008-07-14 11:28:29 +10:00
Damien Miller a034baf1b9 - djm@cvs.openbsd.org 2008/07/12 05:33:41 
[scp.1]
     better description for -i flag:
     s/RSA authentication/public key authentication/
 2008-07-12 17:12:49 +10:00
Damien Miller 2bcb866327 - (djm) OpenBSD CVS Sync 
- djm@cvs.openbsd.org 2008/07/12 04:52:50
     [channels.c]
     unbreak; move clearing of cctx struct to before first use
     reported by dkrause@
 2008-07-12 17:12:29 +10:00
Damien Miller b61f3fc31f - markus@cvs.openbsd.org 2008/07/10 18:08:11 
[clientloop.c monitor.c monitor_wrap.c packet.c packet.h sshd.c]
     sync v1 and v2 traffic accounting; add it to sshd, too;
     ok djm@, dtucker@
 2008-07-11 17:36:48 +10:00
Damien Miller dda5fffb84 - markus@cvs.openbsd.org 2008/07/10 18:05:58 
[channels.c]
     missing bzero; from mickey; ok djm@
 2008-07-11 17:35:37 +10:00
Damien Miller 87dd5f2804 - stevesk@cvs.openbsd.org 2008/07/07 23:32:51 
[key.c]
     /*NOTREACHED*/ for lint warning:
       warning: function key_equal falls off bottom without returning value
     ok djm@
 2008-07-11 17:35:09 +10:00
Damien Miller 2f7faf19d5 - stevesk@cvs.openbsd.org 2008/07/07 00:31:41 
[ttymodes.c]
     we don't need arg after the debug3() was removed.  from lint.
     ok djm@
 2008-07-11 17:34:35 +10:00
Damien Miller 73193b3693 - (djm) [configure.ac] Add -Wformat-security to CFLAGS for gcc 3.x and 4.x 2008-07-09 21:07:19 +10:00
Damien Miller 7acf550aeb - (djm) [auth.c] Missing unistd.h for close() 2008-07-09 20:54:37 +10:00
Damien Miller 773a7b98f9 - (djm) [auth1.c] Fix format string vulnerability in protocol 1 PAM 
account check failure path. The vulnerable format buffer is supplied
   from PAM and should not contain attacker-supplied data.
 2008-07-09 20:54:05 +10:00
Damien Miller d9648eee7c - (djm) [Makefile.in] Print "all tests passed" when all regress tests pass 2008-07-09 00:21:12 +10:00
Damien Miller c9c96f2e28 - djm@cvs.openbsd.org 2008/07/05 05:16:01 
[PROTOCOL]
     grammar
 2008-07-05 15:17:48 +10:00
Damien Miller ff2e492028 - (djm) [configure.ac] unbreak: remove extra closing brace 2008-07-05 09:52:03 +10:00
Damien Miller 42743cb6ba - (djm) [Makefile.in] Pass though pass to conch for interop tests 2008-07-05 09:50:23 +10:00
Damien Miller 0b4d48ba74 - djm@cvs.openbsd.org 2008/07/04 23:30:16 
[auth1.c auth2.c]
     Make protocol 1 MaxAuthTries logic match protocol 2's.
     Do not treat the first protocol 2 authentication attempt as
     a failure IFF it is for method "none".
     Makes MaxAuthTries' user-visible behaviour identical for
     protocol 1 vs 2.
     ok dtucker@
 2008-07-05 09:44:53 +10:00
Damien Miller d874fa517b - OpenBSD CVS Sync 
- djm@cvs.openbsd.org 2008/07/04 23:08:25
     [packet.c]
     handle EINTR in packet_write_poll()l ok dtucker@
 2008-07-05 09:40:56 +10:00
Damien Miller 20d1694719 - (djm) [atomicio.c configure.ac] Disable poll() fallback in atomiciov for 
Tru64. readv doesn't seem to be a comparable object there.
   bz#1386, patch from dtucker@ ok me
 2008-07-05 09:36:58 +10:00
Damien Miller 22989f1b5e - (djm) [auth.c] Fixed test for locked account on HP/UX with shadowed 
passwords disabled. bz#1083 report & patch from senthilkumar_sen AT
   hotpop.com, w/ dtucker@
 2008-07-05 08:59:43 +10:00
Damien Miller d8968adb5f - (djm) [atomicio.c channels.c clientloop.c defines.h includes.h] 
[packet.c scp.c serverloop.c sftp-client.c ssh-agent.c ssh-keyscan.c]
   [sshd.c] Explicitly handle EWOULDBLOCK wherever we handle EAGAIN, on
   some platforms (HP nonstop) it is a distinct errno;
   bz#1467 reported by sconeu AT yahoo.com; ok dtucker@
 2008-07-04 23:10:49 +10:00
Darren Tucker b01bac109b - djm@cvs.openbsd.org 2008/06/30 10:43:03 
[regress/conch-ciphers.sh]
     explicitly disable conch options that could interfere with the test
 2008-07-04 17:11:30 +10:00
Darren Tucker 5d6d70a842 - djm@cvs.openbsd.org 2008/06/30 10:31:11 
[putty-transfer.sh putty-kex.sh putty-ciphers.sh]
     remove "set -e" left over from debugging
 2008-07-04 17:10:30 +10:00
Darren Tucker 8c7a14ea28 - djm@cvs.openbsd.org 2008/06/30 08:07:34 
[key-options.sh]
     shell portability: use "=" instead of "==" in test(1) expressions,
     double-quote string with backslash escaped /
 2008-07-04 17:08:58 +10:00
Darren Tucker f7fa706e70 - (dtucker) [sftp-server.c] Bug #1447: fall back to racy rename if link 
returns EXDEV.  Patch from Mike Garrison, ok djm@
 2008-07-04 14:10:19 +10:00
Darren Tucker 2784f1fcc3 - dtucker@cvs.openbsd.org 2008/07/04 03:47:02 
[monitor.c]
     Make debug a little clearer.  ok djm@
 2008-07-04 13:51:45 +10:00
Darren Tucker b03fd02aed - djm@cvs.openbsd.org 2008/07/04 03:44:59 
[servconf.c groupaccess.h groupaccess.c]
     support negation of groups in "Match group" block (bz#1315); ok dtucker@
 2008-07-04 13:51:12 +10:00
Darren Tucker f5cafb0c85 - otto@cvs.openbsd.org 2008/07/03 21:46:58 
[auth2-pubkey.c]
     avoid nasty double free; ok dtucker@ djm@
 2008-07-04 12:54:25 +10:00
Darren Tucker 9a2a60986b - djm@cvs.openbsd.org 2008/07/02 13:47:39 
[ssh.1 ssh.c]
     When forking after authentication ("ssh -f") with ExitOnForwardFailure
     enabled, delay the fork until after replies for any -R forwards have
     been seen. Allows for robust detection of -R forward failure when
     using -f (similar to bz#92); ok dtucker@
 2008-07-04 12:53:50 +10:00
Darren Tucker 7c99b1ceda - djm@cvs.openbsd.org 2008/07/02 13:30:34 
[auth2.c]
     really really remove the freebie "none" auth try for protocol 2
 2008-07-04 12:53:23 +10:00
Darren Tucker 4230a5dc30 - djm@cvs.openbsd.org 2008/07/02 12:36:39 
[auth2-none.c auth2.c]
     Make protocol 2 MaxAuthTries behaviour a little more sensible:
     Check whether client has exceeded MaxAuthTries before running
     an authentication method and skip it if they have, previously it
     would always allow one try (for "none" auth).
     Preincrement failure count before post-auth test - previously this
     checked and postincremented, also to allow one "none" try.
     Together, these two changes always count the "none" auth method
     which could be skipped by a malicious client (e.g. an SSH worm)
     to get an extra attempt at a real auth method. They also make
     MaxAuthTries=0 a useful way to block users entirely (esp. in a
     sshd_config Match block).
     Also, move sending of any preauth banner from "none" auth method
     to the first call to input_userauth_request(), so worms that skip
     the "none" method get to see it too.
 2008-07-02 22:56:09 +10:00
Darren Tucker 33c787f23c - dtucker@cvs.openbsd.org 2008/07/02 12:03:51 
[auth-rsa.c auth.c auth2-pubkey.c auth.h]
     Merge duplicate host key file checks, based in part on a patch from Rob
     Holland via bz #1348 .  Also checks for non-regular files during protocol
     1 RSA auth.  ok djm@
 2008-07-02 22:37:30 +10:00
Darren Tucker 7499b0cca0 - djm@cvs.openbsd.org 2008/07/02 02:24:18 
[sshd_config sshd_config.5 sshd.8 servconf.c]
     increase default size of ssh protocol 1 ephemeral key from 768 to 1024
     bits; prodded by & ok dtucker@ ok deraadt@
 2008-07-02 22:35:43 +10:00
Darren Tucker f2e21dec68 - stevesk@cvs.openbsd.org 2008/07/01 23:12:47 
[PROTOCOL.agent]
     fix some typos; ok djm@
 2008-07-02 22:35:00 +10:00
Darren Tucker d7bdc0c8e8 - dtucker@cvs.openbsd.org 2008/07/01 07:24:22 
[sshconnect.c sshd.c]
     Send CR LF during protocol banner exchanges, but only for Protocol 2 only,
     in order to comply with RFC 4253.  bz #1443, ok djm@
 2008-07-02 22:34:30 +10:00
Darren Tucker 068e01f53f - dtucker@cvs.openbsd.org 2008/07/01 07:20:52 
[sshconnect.c]
     Check ExitOnForwardFailure if forwardings are disabled due to a failed
     host key check.  ok djm@
 2008-07-02 22:33:55 +10:00
Darren Tucker 1f781b194f - djm@cvs.openbsd.org 2008/06/30 12:18:34 
[PROTOCOL]
     clarify that eow@openssh.com is only sent on session channels
 2008-07-02 22:33:16 +10:00
Darren Tucker 8748b96522 - djm@cvs.openbsd.org 2008/06/30 12:16:02 
[nchan.c]
     only send eow@openssh.com notifications for session channels; ok! markus@
 2008-07-02 22:32:43 +10:00
Darren Tucker 8810dd41b9 - djm@cvs.openbsd.org 2008/06/30 12:15:39 
[serverloop.c]
     only pass channel requests on session channels through to the session
     channel handler, avoiding spurious log messages; ok! markus@
 2008-07-02 22:32:14 +10:00
Darren Tucker 00f00f0451 - djm@cvs.openbsd.org 2008/06/30 08:05:59 
[PROTOCOL.agent]
      typo: s/constraint_date/constraint_data/
 2008-07-02 22:31:31 +10:00
Damien Miller a766cea689 - (djm) [regress/Makefile] search for conch by path, like we do putty 2008-06-30 08:12:37 +10:00
Damien Miller 4268a136d4 - djm@cvs.openbsd.org 2008/06/28 13:57:25 
[regress/Makefile regress/test-exec.sh regress/conch-ciphers.sh]
     very basic regress test against Twisted Conch in "make interop"
     target (conch is available in ports/devel/py-twisted/conch);
     ok markus@
 2008-06-30 08:07:56 +10:00
Damien Miller d9bfce83b7 - dtucker@cvs.openbsd.org 2008/06/11 23:11:40 
[Makefile]
     Don't run cipher-speed test by default; mistakenly enabled by me
 2008-06-30 08:06:51 +10:00
Damien Miller 2e80cf2b63 - dtucker@cvs.openbsd.org 2008/06/10 23:13:43 
[regress/Makefile regress/key-options.sh]
     Add regress test for key options.  ok djm@
 2008-06-30 08:06:25 +10:00
Damien Miller 1e18beb1e7 - djm@cvs.openbsd.org 2008/06/28 14:08:30 
[PROTOCOL PROTOCOL.agent]
     document the protocol used by ssh-agent; "looks ok" markus@
 2008-06-30 00:07:00 +10:00
Damien Miller 471db5c2eb - djm@cvs.openbsd.org 2008/06/28 14:05:15 
[ssh-agent.c]
     reset global compat flag after processing a protocol 2 signature
     request with the legacy DSA encoding flag set; ok markus
 2008-06-30 00:05:48 +10:00
Damien Miller 1cfadabc0e - djm@cvs.openbsd.org 2008/06/28 13:58:23 
[ssh-agent.c]
     refuse to add a key that has unknown constraints specified;
     ok markus
 2008-06-30 00:05:21 +10:00
Damien Miller bd45afb5ad - djm@cvs.openbsd.org 2008/06/28 07:25:07 
[PROTOCOL]
     spelling fixes
 2008-06-30 00:04:57 +10:00
Damien Miller 8639920a9b - jmc@cvs.openbsd.org 2008/06/26 21:11:46 
[ssh.1]
     add VisualHostKey to the list of options listed in -o;
 2008-06-30 00:04:31 +10:00
Damien Miller 1028824e5c - grunk@cvs.openbsd.org 2008/06/26 11:46:31 
[readconf.c readconf.h ssh.1 ssh_config.5 sshconnect.c]
     Move SSH Fingerprint Visualization away from sharing the config option
     CheckHostIP to an own config option named VisualHostKey.
     While there, fix the behaviour that ssh would draw a random art picture
     on every newly seen host even when the option was not enabled.
     prodded by deraadt@, discussions,
     help and ok markus@ djm@ dtucker@
 2008-06-30 00:04:03 +10:00