Commit Graph

552 Commits

Author SHA1 Message Date
markus@openbsd.org da0a9afcc4 upstream: ssh: add PermitRemoteOpen for remote dynamic forwarding
with SOCKS ok djm@, dtucker@

OpenBSD-Commit-ID: 64fe7b6360acc4ea56aa61b66498b5ecc0a96a7c
2021-02-17 15:03:41 +11:00
djm@openbsd.org 69338ab46a upstream: whitespace
OpenBSD-Commit-ID: 544bb092e03fcbecb420196cd0f70af13ea868ad
2021-02-05 13:38:57 +11:00
djm@openbsd.org 4ca6a1fac3 upstream: remove global variable used to stash compat flags and use the
purpose-built ssh->compat variable instead; feedback/ok markus@

OpenBSD-Commit-ID: 7c4f200e112dae6bcf99f5bae1a5629288378a06
2021-01-27 20:28:25 +11:00
dtucker@openbsd.org e9f78d6b06 upstream: Rename HostbasedKeyTypes (ssh) and
HostbasedAcceptedKeyTypes (sshd) to HostbasedAcceptedAlgorithms, which more
accurately reflects its effect. This matches a previous change to
PubkeyAcceptedAlgorithms.  The previous names are retained as aliases.  ok
djm@

OpenBSD-Commit-ID: 49451c382adc6e69d3fa0e0663eeef2daa4b199e
2021-01-26 22:50:40 +11:00
dtucker@openbsd.org ee9c0da803 upstream: Rename PubkeyAcceptedKeyTypes keyword to
PubkeyAcceptedAlgorithms. While the two were originally equivalent, this
actually specifies the signature algorithms that are accepted.  Some key
types (eg RSA) can be used by multiple algorithms (eg ssh-rsa, rsa-sha2-512)
so the old name is becoming increasingly misleading.  The old name is
retained as an alias. Prompted by bz#3253, help & ok djm@, man page help jmc@

OpenBSD-Commit-ID: 0346b2f73f54c43d4e001089759d149bfe402ca5
2021-01-22 15:03:56 +11:00
djm@openbsd.org 0f504f592d upstream: plumb ssh_conn_info through to sshconnect.c; feedback/ok
markus@

OpenBSD-Commit-ID: e8d14a09cda3f1dc55df08f8a4889beff74e68b0
2020-12-21 10:52:28 +11:00
djm@openbsd.org 729b05f59d upstream: allow UserKnownHostsFile=none; feedback and ok markus@
OpenBSD-Commit-ID: c46d515eac94a35a1d50d5fd71c4b1ca53334b48
2020-12-21 10:52:28 +11:00
djm@openbsd.org d060bc7f6e upstream: refactor client percent_expand() argument passing;
consolidate the common arguments into a single struct and pass that around
instead of using a bunch of globals. ok markus@

OpenBSD-Commit-ID: 035e6d7ca9145ad504f6af5a021943f1958cd19b
2020-12-21 10:52:27 +11:00
djm@openbsd.org 43026da035 upstream: prepare readconf.c for fuzzing; remove fatal calls and
fix some (one-off) memory leaks; ok markus@

OpenBSD-Commit-ID: 91c6aec57b0e7aae9190de188e9fe8933aad5ec5
2020-12-21 10:52:22 +11:00
dtucker@openbsd.org 819b44e8b9 upstream: Prevent integer overflow when ridiculously large
ConnectTimeout is specified, capping the effective value (for most platforms)
at 24 days. bz#3229, ok djm@

OpenBSD-Commit-ID: 62d4c4b7b87d111045f8e9f28b5b532d17ac5bc0
2020-11-13 09:58:55 +11:00
dtucker@openbsd.org 4d94b031ff upstream: Replace WITH_OPENSSL ifdefs in log calls with a macro.
The log calls are themselves now macros, and preprocessor directives inside
macro arguments are undefined behaviour which some compilers (eg old GCCs)
choke on.  It also makes the code tidier.  ok deraadt@

OpenBSD-Commit-ID: cc12a9029833d222043aecd252d654965c351a69
2020-11-09 00:02:27 +11:00
djm@openbsd.org 816036f142 upstream: use the new variant log macros instead of prepending
__func__ and appending ssh_err(r) manually; ok markus@

OpenBSD-Commit-ID: 1f14b80bcfa85414b2a1a6ff714fb5362687ace8
2020-10-18 23:46:29 +11:00
djm@openbsd.org 793b583d09 upstream: LogVerbose keyword for ssh and sshd
Allows forcing maximum debug logging by file/function/line pattern-
lists.

ok markus@

OpenBSD-Commit-ID: c294c25732d1b4fe7e345cb3e044df00531a6356
2020-10-17 00:43:17 +11:00
kn@openbsd.org a336ce8c2c upstream: Zap unused family parameter from ssh_connect_direct()
sshconnect.c r1.241 from 2013 made it unused;  found while reading code.

OK djm

OpenBSD-Commit-ID: 219ba6d7f9925d0b7992918612680399d86712b5
2020-10-14 11:57:13 +11:00
djm@openbsd.org 396d32f3a1 upstream: There are lots of place where we want to redirect stdin,
stdout and/or stderr to /dev/null. Factor all these out to a single
stdfd_devnull() function that allows selection of which of these to redirect.
ok markus@

OpenBSD-Commit-ID: 3033ba5a4c47cacfd5def020d42cabc52fad3099
2020-10-03 19:34:24 +10:00
djm@openbsd.org 0a4a5571ad upstream: close stdin when forking after authentication too; ok markus
OpenBSD-Commit-ID: 43db17e4abc3e6b4a7b033aa8cdab326a7cb6c24
2020-09-21 17:30:27 +10:00
djm@openbsd.org d14fe25e6c upstream: close stdout/stderr after "ssh -f ..." forking
bz#3137, ok markus

OpenBSD-Commit-ID: e2d83cc4dea1665651a7aa924ad1ed6bcaaab3e2
2020-09-21 09:32:48 +10:00
dtucker@openbsd.org ced327b9fb upstream: Also compare username when checking for JumpHost loops.
bz#3057, ok djm@

OpenBSD-Commit-ID: 9bbc1d138adb34c54f3c03a15a91f75dbf418782
2020-08-03 14:27:18 +10:00
dtucker@openbsd.org 8df5774a42 upstream: Add a '%k' TOKEN that expands to the effective HostKey of
the destination.  This allows, eg, keeping host keys in individual files
using "UserKnownHostsFile ~/.ssh/known_hosts.d/%k". bz#1654, ok djm@, jmc@
(man page bits)

OpenBSD-Commit-ID: 7084d723c9cc987a5c47194219efd099af5beadc
2020-07-17 13:52:46 +10:00
dtucker@openbsd.org c4f239944a upstream: Add %-TOKEN, environment variable and tilde expansion to
UserKnownHostsFile, allowing the file to be automagically split up in the
configuration (eg bz#1654).  ok djm@, man page parts jmc@

OpenBSD-Commit-ID: 7e1b406caf147638bb51558836a72d6cc0bd1b18
2020-07-17 13:52:46 +10:00
djm@openbsd.org 6d755706a0 upstream: some language improvements; ok markus
OpenBSD-Commit-ID: 939d787d571b4d5da50b3b721fd0b2ac236acaa8
2020-07-15 15:07:42 +10:00
dtucker@openbsd.org 74344c3ca4 upstream: Defer creation of ~/.ssh by ssh(1) until we attempt to
write to it so we don't leave an empty .ssh directory when it's not needed.
Use the same function to replace the code in ssh-keygen that does the same
thing. bz#3156, ok djm@

OpenBSD-Commit-ID: 59c073b569be1a60f4de36f491a4339bc4ae870f
2020-06-26 15:24:27 +10:00
dtucker@openbsd.org 2f648cf222 upstream: Correct historical comment: provos@ modified OpenSSH to
work with SSLeay (very quickly replaced by OpenSSL) not SSL in general.  ok
deraadt, historical context markus@

OpenBSD-Commit-ID: 7209e07a2984b50411ed8ca5a4932da5030d2b90
2020-06-05 13:28:29 +10:00
dtucker@openbsd.org 4a1b46e6d0 upstream: Allow some keywords to expand shell-style ${ENV}
environment variables on the client side.  The supported keywords are
CertificateFile, ControlPath, IdentityAgent and IdentityFile, plus
LocalForward and RemoteForward when used for Unix domain socket paths.  This
would for example allow forwarding of Unix domain socket paths that change at
runtime.  bz#3140, ok djm@

OpenBSD-Commit-ID: a4a2e801fc2d4df2fe0e58f50d9c81b03822dffa
2020-05-29 15:46:47 +10:00
dtucker@openbsd.org 990687a033 upstream: Add TOKEN percent expansion to LocalFoward and RemoteForward
when used for Unix domain socket forwarding.  Factor out the code for the
config keywords that use the most common subset of TOKENS into its own
function. bz#3014, ok jmc@ (man page bits) djm@

OpenBSD-Commit-ID: bffc9f7e7b5cf420309a057408bef55171fd0b97
2020-04-10 11:47:19 +10:00
djm@openbsd.org 8162402698 upstream: r1.522 deleted one too many lines; repair
OpenBSD-Commit-ID: 1af8851fd7a99e4a887b19aa8f4c41a6b3d25477
2020-04-03 17:09:42 +11:00
djm@openbsd.org ebd29e9012 upstream: fix debug statement
OpenBSD-Commit-ID: 42c6edeeda5ce88b51a20d88c93be3729ce6b916
2020-04-03 15:35:28 +11:00
djm@openbsd.org 7b4d8999f2 upstream: the tunnel-forwarding vs ExitOnForwardFailure fix that I
committed earlier had an off-by-one. Fix this and add some debugging that
would have made it apparent sooner.

OpenBSD-Commit-ID: 082f8f72b1423bd81bbdad750925b906e5ac6910
2020-04-03 15:35:28 +11:00
djm@openbsd.org 663e84bb53 upstream: make failures when establishing "Tunnel" forwarding terminate
the connection when ExitOnForwardFailure is enabled; bz3116; ok dtucker

OpenBSD-Commit-ID: ef4b4808de0a419c17579b1081da768625c1d735
2020-04-03 13:42:33 +11:00
dtucker@openbsd.org ed833da176 upstream: Make with config keywords support which
percent_expansions more consistent.  - %C is moved into its own function and
added to Match Exec.  - move the common (global) options into a macro.  This
is ugly but it's    the least-ugly way I could come up with.  - move
IdentityAgent and ForwardAgent percent expansion to before the    config dump
to make it regression-testable.  - document all of the above

ok jmc@ for man page bits, "makes things less terrible" djm@ for the rest.

OpenBSD-Commit-ID: 4b65664bd6d8ae2a9afaf1a2438ddd1b614b1d75
2020-04-03 13:33:37 +11:00
markus@openbsd.org 31f1ee5496 upstream: initialize cname in case ai_canonname is NULL or too
long; ok djm

OpenBSD-Commit-ID: c27984636fdb1035d1642283664193e91aab6e37
2020-03-13 13:13:30 +11:00
dtucker@openbsd.org de1f3564cd upstream: Detect and prevent simple configuration loops when using
ProxyJump. bz#3057, ok djm@

OpenBSD-Commit-ID: 077d21c564c886c98309d871ed6f8ef267b9f037
2020-02-18 20:23:25 +11:00
dtucker@openbsd.org d4d9e1d405 upstream: Add ssh -Q key-sig for all key and signature types.
Teach ssh -Q to accept ssh_config(5) and sshd_config(5) algorithm keywords as
an alias for the corresponding query.  Man page help jmc@, ok djm@.

OpenBSD-Commit-ID: 1e110aee3db2fc4bc5bee2d893b7128fd622e0f8
2020-02-07 15:03:20 +11:00
naddy@openbsd.org a47f6a6c0e upstream: Replace "security key" with "authenticator" in program
messages.

This replaces "security key" in error/usage/verbose messages and
distinguishes between "authenticator" and "authenticator-hosted key".

ok djm@

OpenBSD-Commit-ID: 7c63800e9c340c59440a054cde9790a78f18592e
2020-02-07 09:52:59 +11:00
djm@openbsd.org 156bef36f9 upstream: disable UpdateHostKeys=ask when in quiet mode; "work for
me" matthieu@

OpenBSD-Commit-ID: 60d7b5eb91accf935ed9852650a826d86db2ddc7
2020-01-29 18:52:55 +11:00
markus@openbsd.org da22216b5d upstream: disable UpdateHostKeys=ask if command is specified; ok
djm@ sthen@

OpenBSD-Commit-ID: e5bcc45eadb78896637d4143d289f1e42c2ef5d7
2020-01-28 12:52:46 +11:00
djm@openbsd.org 7955633a55 upstream: allow UpdateKnownHosts=yes to function when multiple
known_hosts files are in use. When updating host keys, ssh will now search
subsequent known_hosts files, but will add new/changed host keys to the first
specified file only. bz#2738

ok markus@

OpenBSD-Commit-ID: 6ded6d878a03e57d5aa20bab9c31f92e929dbc6c
2020-01-25 11:35:56 +11:00
djm@openbsd.org 89a8d4525e upstream: expose PKCS#11 key labels/X.509 subjects as comments
Extract the key label or X.509 subject string when PKCS#11 keys
are retrieved from the token and plumb this through to places where
it may be used as a comment.

based on https://github.com/openssh/openssh-portable/pull/138
by Danielle Church

feedback and ok markus@

OpenBSD-Commit-ID: cae1fda10d9e10971dea29520916e27cfec7ca35
2020-01-25 11:35:55 +11:00
dtucker@openbsd.org 7f8e66fea8 upstream: Make zlib optional. This adds a "ZLIB" build time option
that allows building without zlib compression and associated options.  With
feedback from markus@, ok djm@

OpenBSD-Commit-ID: 44c6e1133a90fd15a3aa865bdedc53bab28b7910
2020-01-23 21:53:54 +11:00
dtucker@openbsd.org 3bf2a6ac79 upstream: Replace all calls to signal(2) with a wrapper around
sigaction(2). This wrapper blocks all other signals during the handler
preventing races between handlers, and sets SA_RESTART which should reduce
the potential for short read/write operations.

OpenBSD-Commit-ID: 5e047663fd77a40d7b07bdabe68529df51fd2519
2020-01-23 18:51:25 +11:00
beck@openbsd.org 2ab335712d upstream: fix CanonicalizeHostname, broken by rev 1.507
Issue noticed and reported by Pierre-Olivier Martel <pom@apple.com>
ok dtucker@ markus@ djm@

OpenBSD-Commit-ID: 749f3168ec520609c35b0c4e1984e5fa47f16094
2020-01-06 13:12:46 +11:00
djm@openbsd.org 40be78f503 upstream: Allow forwarding a different agent socket to the path
specified by $SSH_AUTH_SOCK, by extending the existing ForwardAgent option to
accepting an explicit path or the name of an environment variable in addition
to yes/no.

Patch by Eric Chiang, manpage by me; ok markus@

OpenBSD-Commit-ID: 98f2ed80bf34ea54d8b2ddd19ac14ebbf40e9265
2019-12-21 13:22:07 +11:00
naddy@openbsd.org 189550f5bc upstream: additional missing stdarg.h includes when built without
WITH_OPENSSL; ok djm@

OpenBSD-Commit-ID: 881f9a2c4e2239849cee8bbf4faec9bab128f55b
2019-11-20 09:27:29 +11:00
djm@openbsd.org 884416bdb1 upstream: ssh client support for U2F/FIDO keys
OpenBSD-Commit-ID: eb2cfa6cf7419a1895e06e398ea6d41516c5b0bc
2019-11-01 09:46:09 +11:00
djm@openbsd.org fbe24b1429 upstream: allow %n to be expanded in ProxyCommand strings
From Zachary Harmany via github.com/openssh/openssh-portable/pull/118
ok dtucker@

OpenBSD-Commit-ID: 7eebf1b7695f50c66d42053d352a4db9e8fb84b6
2019-09-13 14:28:44 +10:00
naddy@openbsd.org 91a2135f32 upstream: Allow prepending a list of algorithms to the default set
by starting the list with the '^' character, e.g.

HostKeyAlgorithms ^ssh-ed25519
Ciphers ^aes128-gcm@openssh.com,aes256-gcm@openssh.com

ok djm@ dtucker@

OpenBSD-Commit-ID: 1e1996fac0dc8a4b0d0ff58395135848287f6f97
2019-09-08 14:49:04 +10:00
deraadt@openbsd.org 4d28fa78ab upstream: When system calls indicate an error they return -1, not
some arbitrary value < 0.  errno is only updated in this case.  Change all
(most?) callers of syscalls to follow this better, and let's see if this
strictness helps us in the future.

OpenBSD-Commit-ID: 48081f00db7518e3b712a49dca06efc2a5428075
2019-07-05 11:10:39 +10:00
djm@openbsd.org cb8f56570f upstream: slightly more instructive error message when the user
specifies multiple -J options on the commandline. bz3015 ok dtucker@

OpenBSD-Commit-ID: 181c15a65cac3b575819bc8d9a56212c3c748179
2019-06-14 14:15:01 +10:00
jmc@openbsd.org 7349149da1 upstream: Hostname->HostName cleanup; from lauri tirkkonen ok
dtucker

OpenBSD-Commit-ID: 4ade73629ede63b691f36f9a929f943d4e7a44e4
2019-06-14 13:01:28 +10:00
otto@openbsd.org 0323d9b619 upstream: Replace calls to ssh_malloc_init() by a static init of
malloc_options. Prepares for changes in the way malloc is initialized.  ok
guenther@ dtucker@

OpenBSD-Commit-ID: 154f4e3e174f614b09f792d4d06575e08de58a6b
2019-06-08 00:25:42 +10:00