37035c07d4
s/--with-ssh1/--without-ssh1/
2015-07-01 10:49:37 +10:00
5c15e22c69
fix syntax error
2015-06-18 15:07:56 +10:00
99f33d7304
aarch64 support for seccomp-bpf sandbox
...
Also resort and tidy syscall list. Based on patches by Jakub Jelen
bz#2361; ok dtucker@
2015-06-17 10:50:51 +10:00
6397eedf95
Remove unneeded backslashes. Patch from Ángel González
2015-06-03 21:41:11 -07:00
0c2a81dfc2
re-enable SSH protocol 1 at compile time
2015-05-29 17:08:28 +10:00
408f4c2ad4
Look for '${host}-ar' before 'ar'.
...
This changes configure.ac to look for '${host}-ar' as set by
AC_CANONICAL_HOST before looking for the unprefixed 'ar'.
Useful when cross-compiling when all your binutils are prefixed.
Patch from moben at exherbo org via astrand at lysator liu se and
bz#2352.
2015-04-17 09:39:58 +10:00
2aa9da1a3b
upstream commit
...
Compile-time disable SSH protocol 1. You can turn it
back on using the Makefile.inc knob if you need it to talk to ancient
devices.
2015-03-27 12:00:37 +11:00
00797e86b2
check for crypt and DES_crypt in openssl block
...
fixes builds on systems that use DES_crypt; based on patch
from Roumen Petrov
2015-03-04 05:02:45 +11:00
e50e8c97a9
Add null declaration of AI_NUMERICINFO.
...
Some platforms (older FreeBSD and DragonFly versions) do have
getaddrinfo() but do not have AI_NUMERICINFO. so define it to zero
in those cases.
2015-02-21 15:10:33 +11:00
72ef7c148c
support --without-openssl at configure time
...
Disables and removes dependency on OpenSSL. Many features don't
work and the set of crypto options is greatly restricted. This
will only work on system with native arc4random or /dev/urandom.
Considered highly experimental for now.
2015-01-15 02:28:36 +11:00
76c0480a85
add --without-ssh1 option to configure
...
Allows disabling support for SSH protocol 1.
2015-01-13 19:38:18 +11:00
642652d280
Add reallocarray to compat library
2014-12-10 01:32:23 +11:00
7d0ba53366
include version number in OpenSSL-too-old error
2014-10-30 10:45:41 +11:00
3d673d103b
- (djm) [openbsd-compat/explicit_bzero.c] implement explicit_bzero()
...
using memset_s() where possible; improve fallback to indirect bzero
via a volatile pointer to give it more of a chance to avoid being
optimised away.
2014-08-27 06:32:01 +10:00
d244a5816f
- (djm) [configure.ac] We now require a working vsnprintf everywhere (not
...
just for systems that lack asprintf); check for it always and extend
test to catch more brokenness. Fixes builds on Solaris <= 9
2014-08-23 17:06:49 +10:00
394a60f259
- (djm) [configure.ac] double braces to appease autoconf
2014-08-22 18:06:20 +10:00
6d62784b89
- (djm) [configure.ac] include leading zero characters in OpenSSL version
...
number; fixes test for unsupported versions
2014-08-22 17:36:19 +10:00
2195847e50
- (djm) [configure.ac] Check OpenSSL version is supported at configure time;
...
suggested by Kevin Brott
2014-08-20 11:05:03 +10:00
00f9cd2307
- (djm) [configure.ac] Delay checks for arc4random* until after libcrypto
...
has been located; fixes builds agains libressl-portable
2014-07-15 10:41:38 +10:00
8da0fa2493
- (djm) [digest-openssl.c configure.ac] Disable RIPEMD160 if libcrypto
...
doesn't support it.
2014-07-03 11:54:19 +10:00
f9696566fb
- (dtucker) [configure.ac] Remove tcpwrappers support, support has already
...
been removed from sshd.c.
2014-06-13 11:06:04 +10:00
6482d90a65
- (djm) [configure.ac openbsd-compat/bsd-cygwin_util.c]
...
[openbsd-compat/bsd-cygwin_util.h] On Cygwin, determine privilege
separation user at runtime, since it may need to be a domain account.
Patch from Corinna Vinschen.
2014-05-27 14:34:42 +10:00
18912775cb
- (djm) [commit configure.ac defines.h sshpty.c] don't attempt to use
...
vhangup on Linux. It doens't work for non-root users, and for them
it just messes up the tty settings.
2014-05-21 17:06:46 +10:00
e5b9f0f2ee
- (djm) [Makefile.in configure.ac sshbuf-getput-basic.c]
...
[sshbuf-getput-crypto.c sshbuf.c] compilation and portability fixes
2014-05-15 14:58:07 +10:00
b9c566788a
- (djm) [configure.ac] Unconditionally define WITH_OPENSSL until we write
...
portability glue to support building without libcrypto
2014-05-15 14:43:37 +10:00
03ae081aea
20140221
...
- (tim) [configure.ac] Fix cut-and-paste error. Patch from Bryan Drewery.
2014-02-21 09:09:34 -08:00
4a20959d2e
- (dtucker) [configure.ac openbsd-compat/openssl-compat.{c,h}] Add compat
...
code for older OpenSSL versions that don't have EVP_MD_CTX_copy_ex.
2014-02-13 16:38:32 +11:00
1d2c456426
- tedu@cvs.openbsd.org 2014/01/31 16:39:19
...
[auth2-chall.c authfd.c authfile.c bufaux.c bufec.c canohost.c]
[channels.c cipher-chachapoly.c clientloop.c configure.ac hostfile.c]
[kexc25519.c krl.c monitor.c sandbox-systrace.c session.c]
[sftp-client.c ssh-keygen.c ssh.c sshconnect2.c sshd.c sshlogin.c]
[openbsd-compat/explicit_bzero.c openbsd-compat/openbsd-compat.h]
replace most bzero with explicit_bzero, except a few that cna be memset
ok djm dtucker
2014-02-04 11:18:20 +11:00
f5bbd3b657
- (djm) [configure.ac atomicio.c] Kludge around NetBSD offering
...
different symbols for 'read' when various compiler flags are
in use, causing atomicio.c comparisons against it to break and
read/write operations to hang; ok dtucker
2014-01-30 11:26:46 +11:00
c2868192dd
- (djm) [configure.ac] Only check for width-specified integer types
...
in headers that actually exist. patch from Tom G. Christensen;
ok dtucker@
2014-01-30 10:21:19 +11:00
c161fc90fc
- (djm) [configure.ac] Fix broken shell test '==' vs '='; patch from
...
Tom G. Christensen
2014-01-29 21:01:33 +11:00
ab03949058
- (djm) [configure.ac] Search for inet_ntop in libnsl and libresovl;
...
ok dtucker
2014-01-28 15:07:10 +11:00
5b447c0aac
- (djm) [configure.ac] correct AC_DEFINE for previous.
2014-01-26 09:46:53 +11:00
2035b2236d
- (djm) [configure.ac sandbox-capsicum.c sandbox-rlimit.c] Disable
...
RLIMIT_NOFILE pseudo-sandbox on FreeBSD. In some configurations,
libc will attempt to open additional file descriptors for crypto
offload and crash if they cannot be opened.
2014-01-26 09:39:53 +11:00
603b8f47f1
- (djm) [configure.ac] autoconf sets finds to 'yes' not '1', so test
...
against the correct thing.
2014-01-25 13:16:59 +11:00
c96d85376d
- (djm) [configure.ac] Do not attempt to use capsicum sandbox unless
...
sys/capability.h exists and cap_rights_limit is in libc. Fixes
build on FreeBSD9x which provides the header but not the libc
support.
2014-01-25 13:12:28 +11:00
f62ecef993
- (djm) [configure.ac] Fix detection of capsicum sandbox on FreeBSD
2014-01-25 12:34:38 +11:00
42a0925301
- (dtucker) [configure.ac] NetBSD's (and FreeBSD's) strnvis is gratuitously
...
incompatible with OpenBSD's despite post-dating it by more than a decade.
Declare it as broken, and document FreeBSD's as the same. ok djm@
2014-01-23 23:14:39 +11:00
5c2ff5e31f
- (djm) [configure.ac aclocal.m4] More tests to detect fallout from
...
platform hardening options: include some long long int arithmatic
to detect missing support functions for -ftrapv in libgcc and
equivalents, actually test linking when -ftrapv is supplied and
set either both -pie/-fPIE or neither. feedback and ok dtucker@
2014-01-22 21:30:12 +11:00
852472a54b
- (djm) [configure.ac] Unless specifically requested, only attempt
...
to build Position Independent Executables on gcc >= 4.x; ok dtucker
2014-01-22 16:31:18 +11:00
096118dc73
- (dtucker) [configure.ac] Make PIE a configure-time option which defaults
...
to on platforms where it's known to be reliably detected and off elsewhere.
Works around platforms such as FreeBSD 9.1 where it does not interop with
-ftrapv (it seems to work but fails when trying to link ssh). ok djm@
2014-01-21 12:48:51 +11:00
fdce373166
- (dtucker) [configure.ac] On Cygwin the getopt variables (like optargs,
...
optind) are defined in getopt.h already. Unfortunately they are defined as
"declspec(dllimport)" for historical reasons, because the GNU linker didn't
allow auto-import on PE/COFF targets way back when. The problem is the
dllexport attributes collide with the definitions in the various source
files in OpenSSH, which obviousy define the variables without
declspec(dllimport). The least intrusive way to get rid of these warnings
is to disable warnings for GCC compiler attributes when building on Cygwin.
Patch from vinschen at redhat.com.
2014-01-18 21:12:42 +11:00
9edcbff46f
- (dtucker) [configure.ac] Have --without-toolchain-hardening not turn off
...
stack-protector since that has a separate flag that's been around a while.
2014-01-17 21:54:32 +11:00
6d725687c4
- (dtucker) [configure.ac] Also look in inttypes.h for uintXX_t types.
2014-01-17 19:17:34 +11:00
a5cf1e220d
- (dtucker) [configure.ac openbsd-compat/bsd-statvfs.c
...
openbsd-compat/bsd-statvfs.h] Implement enough of statvfs on top of statfs
to be useful (and for the regression tests to pass) on platforms that
have statfs and fstatfs. ok djm@
2014-01-17 18:10:58 +11:00
d23a91ffb2
- (dtucker) [configure.ac digest.c openbsd-compat/openssl-compat.c
...
openbsd-compat/openssl-compat.h] Add compatibility layer for older
openssl versions. ok djm@
2014-01-17 17:32:30 +11:00
868ea1ea1c
- (djm) [Makefile.in configure.ac sandbox-capsicum.c sandbox-darwin.c]
...
[sandbox-null.c sandbox-rlimit.c sandbox-seccomp-filter.c]
[sandbox-systrace.c ssh-sandbox.h sshd.c] Support preauth sandboxing
using the Capsicum API introduced in FreeBSD 10. Patch by Dag-Erling
Smorgrav, updated by Loganaden Velvindron @ AfriNIC; ok dtucker@
2014-01-17 16:47:04 +11:00
c548722361
- (dtucker) [configure.ac] Split AC_CHECK_FUNCS for OpenSSL functions into
...
separate lines and alphabetize for easier diffing of changes.
2014-01-17 15:12:16 +11:00
fd994379dd
- (dtucker) [aclocal.m4 configure.ac] Add some additional compiler/toolchain
...
hardening flags including -fstack-protector-strong. These default to on
if the toolchain supports them, but there is a configure-time knob
(--without-hardening) to disable them if necessary. ok djm@
2014-01-17 09:53:24 +11:00
1fcec9d4f2
- (dtucker) [configure.ac] bz#2178: Don't try to use BSM on Solaris versions
...
greater than 11 either rather than just 11. Patch from Tomas Kuthan.
2013-12-19 11:00:12 +11:00
Damien Miller
Tim Rice
Darren Tucker
djm@openbsd.org