tyler.durden
/
openssh-portable
mirror of https://github.com/PowerShell/openssh-portable.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
6,861 Commits 6 Branches 20 Tags 98 MiB
Commit Graph

524 Commits

Author SHA1 Message Date
Darren Tucker e194ba4111 - (dtucker) [configure.ac readconf.c servconf.c 
openbsd-compat/openbsd-compat.h] Add compat bits for scan_scaled.
 2013-05-16 20:47:31 +10:00
Darren Tucker c54e3e0741 - (dtucker) [configure.ac] Add -Werror to the -Qunused-arguments test so 
we don't get a warning on compilers that *don't* support it.  Add
   -Wno-unknown-warning-option.  Move both to the start of the list for
   maximum noise suppression.  Tested with gcc 4.6.3, gcc 2.95.4 and clang 2.9.
 2013-05-10 18:53:14 +10:00
Darren Tucker abbc7a7c02 - (dtucker) [configure.ac] Enable -Wsizeof-pointer-memaccess if the compiler 
supports it.  Mentioned by Colin Watson in bz#2100, ok djm.
 2013-05-10 13:54:23 +10:00
Damien Miller 6332da2ae8 - (djm) [auth.c configure.ac misc.c monitor.c monitor_wrap.c] Support 
platforms, such as Android, that lack struct passwd.pw_gecos. Report
   and initial patch from Nathan Osman bz#2086; feedback tim@ ok dtucker@
 2013-04-23 14:25:52 +10:00
Darren Tucker ce1c9574fc - (dtucker) [configure.ac] Use -Qunused-arguments to suppress warnings from 
unused argument warnings (in particular, -fno-builtin-memset) from clang.
 2013-04-18 21:36:19 +10:00
Darren Tucker c8a0f27c6d - (dtucker) [configure.ac] Add stdlib.h to zlib check for exit() prototype. 2013-03-22 12:49:14 +11:00
Damien Miller 63b4bcd04e - (djm) [configure.ac log.c scp.c sshconnect2.c openbsd-compat/vis.c] 
[openbsd-compat/vis.h] FreeBSD's strnvis isn't compatible with OpenBSD's
   so mark it as broken. Patch from des AT des.no
 2013-03-20 12:55:14 +11:00
Tim Rice aa86c3970f - (tim) [configure.ac] OpenServer 5 wants lastlog even though it has none 
of the bits the configure test looks for.
 2013-03-16 20:55:46 -07:00
Damien Miller f4db77d766 - (djm) [configure.ac openbsd-compat/bsd-misc.c openbsd-compat/bsd-misc.h] 
Add a usleep replacement for platforms that lack it; ok dtucker
 2013-03-15 10:34:25 +11:00
Damien Miller a2438bbd28 - (djm) [configure.ac] Disable utmp, wtmp and/or lastlog if the platform 
is unable to successfully compile them. Based on patch from des AT
    des.no
 2013-03-15 10:23:07 +11:00
Darren Tucker aa97d13fa2 - (dtucker) [auth.c configure.ac platform.c platform.h] Accept uid 2 ("bin") 
in addition to root as an owner of system directories on AIX and HP-UX.
   ok djm@
 2013-03-12 11:31:05 +11:00
Damien Miller e4f4347822 - (djm) [configure.ac] Add a timeout to the select/rlimit test to give it a 
chance to complete on broken systems; ok dtucker@
 2013-03-08 12:14:22 +11:00
Darren Tucker ff008ded7f - (dtucker) [configure.ac] test that we can set number of file descriptors 
to zero with setrlimit before enabling the rlimit sandbox.  This affects
   (at least) HPUX 11.11.
 2013-03-06 17:48:48 +11:00
Darren Tucker 5f0e54c892 - (dtucker) [configure.ac] use "=" for shell test and not "==". Spotted by 
Kevin Brott.
 2013-03-05 19:57:39 +11:00
Darren Tucker 03978c61f3 - (dtucker) [configure.ac ssh-gss.h] bz#2073: additional #includes needed 
to use Solaris native GSS libs.  Patch from Pierre Ossman.
 2013-02-25 11:24:44 +11:00
Damien Miller b87f6b70f8 - (djm) [configure.ac includes.h loginrec.c mux.c sftp.c] Prefer 
bsd/libutil.h to libutil.h to avoid deprecation warnings on Ubuntu.
   ok tim
 2013-02-23 09:12:23 +11:00
Damien Miller 91f40d8592 - (djm) [configure.ac sandbox-seccomp-filter.c] Support for Linux 
seccomp-bpf sandbox on ARM. Patch from shawnlandden AT gmail.com;
       ok dtucker
 2013-02-22 11:37:00 +11:00
Darren Tucker a2b5a4c746 - (dtucker) [configure.ac] bz#2073: look for Solaris' differently-named 
libgss too.  Patch from Pierre Ossman, ok djm.
 2013-02-22 10:43:15 +11:00
Darren Tucker 964de184a8 - (dtucker) [Makefile.in configure.ac] bz#2072: don't link krb5 libs to 
ssh(1) since they're not needed.  Patch from Pierre Ossman.
 2013-02-22 10:39:59 +11:00
Darren Tucker 8e6fb780e5 - (dtucker) [configure.ac openbsd-compat/Makefile.in openbsd-compat/strtoull.c 
openbsd-compat/openbsd-compat.h] Add strtoull to compat library for
   platforms that don't have it.
 2013-02-15 12:13:01 +11:00
Darren Tucker 3c4a24c3e3 - (dtucker) [configure.ac openbsd-compat/bsd-misc.c openbsd-compat/bsd-misc.h] 
Use getpgrp() if we don't have getpgid() (old BSDs, maybe others).
 2013-02-15 11:41:35 +11:00
Damien Miller b6f73b3af6 - (djm) [configure.ac openbsd-compat/openssl-compat.h] Repair build on old 
libcrypto that lacks EVP_CIPHER_CTX_ctrl
 2013-02-11 10:39:12 +11:00
Darren Tucker 951b53b1be - (dtucker) [configure.ac openbsd-compat/sys-tree.h] Test if compiler allows 
__attribute__ on return values and work around if necessary.  ok djm@
 2013-02-08 11:50:09 +11:00
Damien Miller 5c3bbd76aa - (djm) [configure.ac] Don't probe seccomp capability of running kernel 
at configure time; the seccomp sandbox will fall back to rlimit at
       runtime anyway. Patch from plautrba AT redhat.com in bz#2011
 2013-02-07 10:11:05 +11:00
Damien Miller d522c68872 - (djm) [cipher.c configure.ac openbsd-compat/openssl-compat.h] 
Fix merge botch, automatically detect AES-GCM in OpenSSL, move a little
   cipher compat code to openssl-compat.h
 2013-01-09 16:42:47 +11:00
Damien Miller 25a02b0c95 - (djm) [configure.ac cipher-ctr.c] Adapt EVP AES CTR change to retain our 
compat code for older OpenSSL
 2012-12-13 08:18:56 +11:00
Damien Miller 8b48982a56 - (djm) [configure.ac] Revert previous. configure.ac already does this 
for us.
 2012-12-03 12:35:55 +11:00
Damien Miller 03af12e930 - (djm) [configure.ac] Turn on -g for gcc compilers. Helps pre-installation 
debugging. ok dtucker@
 2012-12-03 11:55:53 +11:00
Damien Miller 77eab7b024 - (djm) [configure.ac] Recursively expand $(bindir) to ensure it has no 
unexpanded $(prefix) embedded. bz#2007 patch from nix-corp AT
   esperi.org.uk; ok dtucker@
 2012-07-06 11:49:28 +10:00
Darren Tucker 34f702ae64 - (dtucker) [configure.ac openbsd-compat/bsd-misc.h] Add setlinebuf for 
platforms that don't have it.  "looks good" tim@
 2012-07-04 08:50:09 +10:00
Darren Tucker d545a4b974 - (dtucker) [configure.ac sandbox-rlimit.c] Test whether or not 
setrlimit(RLIMIT_FSIZE, rl_zero) and skip it if it's not supported.  Its
   benefit is minor, so it's not worth disabling the sandbox if it doesn't
   work.
 2012-07-03 22:48:31 +10:00
Darren Tucker 60395f91c6 - (dtucker) [configure.ac] Detect platforms that can't use select(2) with 
setrlimit(RLIMIT_NOFILE, rl_zero) and disable the rlimit sandbox on those.
 2012-07-03 14:31:18 +10:00
Darren Tucker 593538911a - (dtucker) [configure.ac contrib/Makefile] bz#1996: use AC_PATH_TOOL to find 
pkg-config so it does the right thing when cross-compiling.  Patch from
   cjwatson at debian org.
 2012-05-19 15:24:37 +10:00
Darren Tucker d0494fdb29 - (dtucker) [configure.ac] bz#2010: fix non-portable shell construct. Patch 
from cjwatson at debian org.
 2012-05-19 14:25:39 +10:00
Darren Tucker e1a3ddf992 - (dtucker) [configure.ac] Include <sys/param.h> rather than <sys/types.h> 
to fix building on some plaforms.  Fom bowman at math utah edu and
   des at des no.
 2012-05-04 11:05:45 +10:00
Damien Miller 398c0ffe0e - (djm) [configure.ac] Fix compilation error on FreeBSD, whose libutil 
contains openpty() but not login()
 2012-04-19 21:46:35 +10:00
Damien Miller e0956e3834 - (djm) [Makefile.in configure.ac sandbox-seccomp-filter.c] Add sandbox 
mode for Linux's new seccomp filter; patch from Will Drewry; feedback
   and ok dtucker@
 2012-04-04 11:27:54 +10:00
Darren Tucker 93a2d41505 - (dtucker) [audit-bsm.c configure.ac] bug #1968: enable workarounds for BSM 
audit breakage in Solaris 11.  Patch from Magnus Johansson.
 2012-02-24 10:40:41 +11:00
Darren Tucker e9b3ad73ba - (dtucker) [configure.ac mac.c openbsd-compat/openssl-compat.h] Add 
null implementation of HMAC_CTX_init for the benefit of old versions
   of OpenSSL that don't have it.
 2012-01-17 14:03:34 +11:00
Darren Tucker 4a725ef6a5 - (dtucker) [configure.ac] Set _FORTIFY_SOURCE. ok djm@ 2011-11-21 16:38:48 +11:00
Darren Tucker aa3cbd1b5b - (dtucker) [INSTALL LICENCE configure.ac openbsd-compat/Makefile.in 
openbsd-compat/getrrsetbyname-ldns.c openbsd-compat/getrrsetbyname.c]
   bz 1320: Add optional support for LDNS, a BSD licensed DNS resolver library
   which supports DNSSEC.  Patch from Simon Vallet (svallet at genoscope cns fr)
   with some rework from myself and djm.  ok djm.
 2011-11-04 11:25:24 +11:00
Darren Tucker b0b29cc0c5 remove SELECT_REQUIRED_FDS added erroneously with strnlen. spotted by tim 2011-10-02 18:49:24 +11:00
Darren Tucker b54f50e5d0 - (dtucker) [configure.ac openbsd-compat/Makefile.in 
openbsd-compat/strnlen.c] Add strnlen to the compat library.
 2011-09-29 23:17:18 +10:00
Damien Miller 5ffe1c4b43 - (djm) [configure.ac defines.h] No need to detect sizeof(char); patch 
from des AT des.no
 2011-09-29 11:11:51 +10:00
Tim Rice a6e60616be - (tim) [configure.ac] Typo in error message spotted by Andy Tsouladze 2011-08-17 21:48:22 -07:00
Damien Miller 1a91c0f163 - (djm) [configure.ac] error out if the host lacks the necessary bits for 
an explicitly requested sandbox type
 2011-08-17 11:59:25 +10:00
Damien Miller cd5e52ee78 - (djm) [configure.ac Makefile.in sandbox-darwin.c] Add a sandbox for 
Darwin/OS X using sandbox_init() + setrlimit(); feedback and testing
   markus@
 2011-06-27 07:18:18 +10:00
Damien Miller 69ff1df952 - djm@cvs.openbsd.org 2011/06/22 21:57:01 
[servconf.c servconf.h sshd.c sshd_config.5 sandbox-rlimit.c]
     [sandbox-systrace.c sandbox.h configure.ac Makefile.in]
     introduce sandboxing of the pre-auth privsep child using systrace(4).

     This introduces a new "UsePrivilegeSeparation=sandbox" option for
     sshd_config that applies mandatory restrictions on the syscalls the
     privsep child can perform. This prevents a compromised privsep child
     from being used to attack other hosts (by opening sockets and proxying)
     or probing local kernel attack surface.

     The sandbox is implemented using systrace(4) in unsupervised "fast-path"
     mode, where a list of permitted syscalls is supplied. Any syscall not
     on the list results in SIGKILL being sent to the privsep child. Note
     that this requires a kernel with the new SYSTR_POLICY_KILL option.

     UsePrivilegeSeparation=sandbox will become the default in the future
     so please start testing it now.

     feedback dtucker@; ok markus@
 2011-06-23 08:30:03 +10:00
Damien Miller c09182f613 - (djm) [configure.ac] enable setproctitle emulation for OS X 2011-06-03 12:11:38 +10:00
Tim Rice 90f42b0705 - (tim) [configure.ac defines.h] Run test program to detect system mail 
directory. Add --with-maildir option to override. Fixed OpenServer 6
   getting it wrong. Fixed many systems having MAIL=/var/mail//username
   ok dtucker
 2011-06-02 18:17:49 -07:00