Commit Graph

12135 Commits

Author SHA1 Message Date
Vivian Thiebaut 602a02995a
Handle Path Variable: Prepend System path to User path () 2022-02-07 15:00:39 -08:00
Tess Gauthier c2765de0f7
change build tools chocolatey install error message () 2022-02-07 10:27:45 -08:00
pedro martelletto a1bcbf04a7 fix typos in previous 2022-02-07 21:26:14 +11:00
Damien Miller 56192518e3 compat code for fido_assert_set_clientdata() 2022-02-07 12:53:47 +11:00
djm@openbsd.org d6b5aa08fd upstream: use libfido2 1.8.0+ fido_assert_set_clientdata() instead
of manually hashing data outselves. Saves a fair bit of code and makes life
easier for some -portable platforms.

OpenBSD-Commit-ID: 351dfaaa5ab1ee928c0e623041fca28078cff0e0
2022-02-07 12:35:46 +11:00
jsg@openbsd.org 86cc93fd3c upstream: remove please from manual pages ok jmc@ sthen@ millert@
OpenBSD-Commit-ID: 6543acb00f4f38a23472538e1685c013ca1a99aa
2022-02-07 12:27:48 +11:00
dtucker@openbsd.org ad16a84e64 upstream: Since they are deprecated, move DSA to the end of the
default list of public keys so that they will be tried last.  From github
PR#295 from "ProBackup-nl", ok djm@

OpenBSD-Commit-ID: 7e5d575cf4971d4e2de92e0b6d6efaba53598bf0
2022-02-07 12:27:48 +11:00
Tess Gauthier 9d733203d6
fix folder permissions for programdata\ssh during server install () 2022-02-04 16:22:59 -08:00
Andrew 762704b8b0
Switched to use MS mirror of libfido2 () 2022-02-04 13:07:05 -08:00
vthiebaut10 66b991a47c
New SSH connections have updated environment variables () 2022-02-04 09:58:11 -08:00
Damien Miller 253de42753 portable-specific string array constification
from Mike Frysinger
2022-02-02 16:52:07 +11:00
djm@openbsd.org dfdcc2220c upstream: test 'ssh-keygen -Y find-principals' with wildcard
principals; from Fabian Stelzer

OpenBSD-Regress-ID: fbe4da5f0032e7ab496527a5bf0010fd700f8f40
2022-02-02 16:51:04 +11:00
dtucker@openbsd.org 968e508967 upstream: Enable all supported ciphers and macs in the server
before trying to benchmark them.  Increase the data file size to get more
signal.

OpenBSD-Regress-ID: dc3697d9f7defdfc51c608782c8e750128e46eb6
2022-02-02 16:51:04 +11:00
bagajjal 0d88c342a5
Spin up ssh-sk-helper in user context when called from ssh-agent () 2022-02-01 18:46:19 -08:00
djm@openbsd.org 15b7199a1f upstream: allow 'ssh-keygen -Y find-principals' to match wildcard
principals in allowed_signers files; from Fabian Stelzer

OpenBSD-Commit-ID: 1e970b9c025b80717dddff5018fe5e6f470c5098
2022-02-02 10:38:59 +11:00
djm@openbsd.org 541667fe6d upstream: mark const string array contents const too, i.e. static
const char *array => static const char * const array from Mike Frysinger

OpenBSD-Commit-ID: a664e31ea6a795d7c81153274a5f47b22bdc9bc1
2022-02-02 10:38:59 +11:00
djm@openbsd.org 8cfa73f8a2 upstream: better match legacy scp behaviour: show un-expanded paths
in error messages. Spotted by and ok tb@

OpenBSD-Commit-ID: 866c8ffac5bd7d38ecbfc3357c8adfa58af637b7
2022-02-02 10:38:59 +11:00
dtucker@openbsd.org 4e62c13ab4 upstream: Remove explicit kill of privsep preauth child's PID in
SIGALRM handler. It's no longer needed since the child will get terminated by
the SIGTERM to the process group that cleans up any auth helpers, it
simplifies the signal handler and removes the risk of a race when updating
the PID. Based on analysis by HerrSpace in github PR#289, ok djm@

OpenBSD-Commit-ID: 2be1ffa28b4051ad9e33bb4371e2ec8a31d6d663
2022-02-01 19:20:30 +11:00
guenther@openbsd.org 2a7ccd2ec4 upstream: When it's the possessive of 'it', it's spelled "its",
without the apostrophe.

OpenBSD-Commit-ID: fb6ab9c65bd31de831da1eb4631ddac018c5fae7
2022-02-01 19:20:30 +11:00
Alex James 8a0848cdd3 sandbox-seccomp-filter: allow gettid
Some allocators (such as Scudo) use gettid while tracing allocations [1].
Allow gettid in preauth to prevent sshd from crashing with Scudo.

[1]: https://github.com/llvm/llvm-project/blob/llvmorg-13.0.0/compiler-rt/lib/gwp_asan/common.cpp#L46
2022-01-31 16:45:10 +11:00
pedro martelletto f82b197a3e
bump LibreSSL to 3.4.2.0 and fetch libfido2 from developers.yubico.com () 2022-01-28 14:41:23 -08:00
djm@openbsd.org b30d32159d upstream: add a ssh_packet_process_read() function that reads from
a fd directly into the transport input buffer.

Use this in the client and server mainloops to avoid unnecessary
copying. It also lets us use a more greedy read size without penalty.

Yields a 2-3% performance gain on cipher-speed.sh (in a fairly
unscientific test tbf)

feedback dtucker@ ok markus@

OpenBSD-Commit-ID: df4112125bf79d8e38e79a77113e1b373078e632
2022-01-25 12:18:35 +11:00
djm@openbsd.org a1a8efeaaa upstream: Use sshbuf_read() to read directly into the channel input
buffer rather than into a stack buffer that needs to be copied again;
Improves performance by about 1% on cipher-speed.sh feedback dtucker@ ok
markus@

OpenBSD-Commit-ID: bf5e6e3c821ac3546dc8241d8a94e70d47716572
2022-01-25 12:13:05 +11:00
Damien Miller 29a76994e2 depend 2022-01-25 11:52:34 +11:00
djm@openbsd.org 754e0d5c77 upstream: Add a sshbuf_read() that attempts to read(2) directly in
to a sshbuf; ok markus@

OpenBSD-Commit-ID: 2d8f249040a4279f3bc23c018947384de8d4a45b
2022-01-25 10:45:47 +11:00
djm@openbsd.org c7964fb982 upstream: add a helper for writing an error message to the
stderr_buf and setting quit_pending; no functional change but saves a bunch
of boilerplate

OpenBSD-Commit-ID: 0747657cad6b9eabd514a6732adad537568e232d
2022-01-25 10:45:39 +11:00
djm@openbsd.org d23b4f7fdb upstream: correct comment and use local variable instead of long
indirection; spotted by dtucker@

OpenBSD-Commit-ID: 5f65f5f69db2b7d80a0a81b08f390a63f8845965
2022-01-25 10:33:03 +11:00
deraadt@openbsd.org d069b020a0 upstream: When poll(2) returns -1, for some error conditions
pfd[].revents is not cleared.  There are subtle errors in various programs.
In this particular case, the program should error out. ok djm millert

OpenBSD-Commit-ID: 00f839b16861f7fb2adcf122e95e8a82fa6a375c
2022-01-25 10:33:03 +11:00
Damien Miller e204b34337 restore tty force-read hack
This portable-specific hack fixes a hang on exit for ttyful sessions
on Linux and some SysVish Unix variants. It was accidentally disabled
in commit 5c79952dfe (a precursor to the mainloop poll(2) conversion).

Spotted by John in bz3383
2022-01-22 11:38:21 +11:00
Tess Gauthier 1fa768f365
detect add-type edge case with powershell 7 () 2022-01-21 11:33:53 -08:00
pedro martelletto af7130c91b
ssh-sk-helper: check RP ID against ssh: prefix () 2022-01-21 11:33:17 -08:00
Corinna Vinschen 68085066b6 Fix signedness bug in Cygwin code
The Cygwin-specific pattern match code has a bug.  It checks
the size_t value returned by mbstowcs for being < 0.  The right
thing to do is to check against (size_t) -1.  Fix that.

Signed-off-by: Corinna Vinschen <vinschen@redhat.com>
2022-01-21 09:53:07 +11:00
Darren Tucker 2e5cfed513 Improve compatibility of early exit trap handling.
Dash (as used by the github runners) has some differences in its trap
builtin:
 - it doesn't have -p (which is fine, that's not in posix).
 - it doesn't work in a subshell (which turns out to be in compliance
   with posix, which means bash isn't).
 - it doesn't work in a pipeline, ie "trap|cat" produces no output.
2022-01-20 13:43:54 +11:00
Darren Tucker 3fe6800b60 Move more tests out of valgrind-1 runner. 2022-01-20 00:49:57 +11:00
Darren Tucker 20da6ed136 Invoke EXIT handler early when using Valgrind.
When using Valgrind, we need to wait for all invoked programs to
complete before checking their valgrind logs.  Some tests, notably
agent-restrict, set an EXIT trap handler to clean up things like
ssh-agent, but those do not get invoked until test-exec.sh exits.
This causes the Valgrind wait to deadlock, so if present invoke
the EXIT handler before checking the Valgrind logs.
2022-01-19 15:37:39 +11:00
hamletg d4b3264993
Fix linux build () 2022-01-18 11:47:03 -08:00
Darren Tucker ad2e0580c8 Remove line leftover from upstream sync. 2022-01-18 12:55:21 +11:00
djm@openbsd.org d1051c0f11 upstream: when decompressing zlib compressed packets, use
Z_SYNC_FLUSH instead of Z_PARTIAL_FLUSH as the latter is not actually
specified as a valid mode for inflate(). There should be no practical change
in behaviour as the compression side ensures a flush that should make all
data available to the receiver in all cases.

repoted by lamm AT ibm.com via bz3372; ok markus

OpenBSD-Commit-ID: 67cfc1fa8261feae6d2cc0c554711c97867cc81b
2022-01-18 11:15:23 +11:00
djm@openbsd.org d5981b1883 upstream: make most of the sftp errors more idiomatic, following
the general form of "[local/remote] operation path: error message"; ok markus

OpenBSD-Commit-ID: 61364cd5f3a9fecaf8d63b4c38a42c0c91f8b571
2022-01-18 11:15:23 +11:00
djm@openbsd.org ac7c9ec894 upstream: when transferring multiple files in SFTP mode, create the
destination directory if it doesn't already exist to match olde-scp(1)
behaviour. noticed by deraadt@ ok markus@

OpenBSD-Commit-ID: cf44dfa231d4112f697c24ff39d7ecf2e6311407
2022-01-18 10:00:41 +11:00
djm@openbsd.org 39d17e189f upstream: allow pin-required FIDO keys to be added to ssh-agent(1).
ssh-askpass will be used to request the PIN at authentication time.

From Pedro Martelletto, ok djm

OpenBSD-Commit-ID: de8189fcd35b45f632484864523c1655550e2950
2022-01-18 10:00:35 +11:00
djm@openbsd.org 52423f64e1 upstream: ssh-sk: free a resident key's user id
From Pedro Martelletto; ok dtucker & me

OpenBSD-Commit-ID: 47be40d602b7a6458c4c71114df9b53d149fc2e9
2022-01-14 14:40:40 +11:00
djm@openbsd.org 014e2f147a upstream: sshsk_load_resident: don't preallocate resp
resp is allocated by client_converse(), at which point we lose
the original pointer.

From Pedro Martelletto; ok dtucker & me

OpenBSD-Commit-ID: 1f1b5ea3282017d6584dfed4f8370dc1db1f44b1
2022-01-14 14:40:40 +11:00
djm@openbsd.org c88265f207 upstream: sshsk_sign: trim call to sshkey_fingerprint()
the resulting fingerprint doesn't appear to be used for anything,
and we end up leaking it.

from Pedro Martelletto; ok dtucker & me

OpenBSD-Commit-ID: 5625cf6c68f082bc2cbbd348e69a3ed731d2f9b7
2022-01-14 14:40:40 +11:00
djm@openbsd.org 1cd1b2eac3 upstream: use status error message to communicate ~user expansion
failures; provides better experience for scp in sftp mode, where ~user paths
are more likely to be used; spotted jsg, feedback jsg & deraadt ok jsg &
markus

(forgot to include this file in previous commit)

OpenBSD-Commit-ID: d37cc4c8c861ce48cd6ea9899e96aaac3476847b
2022-01-14 14:40:34 +11:00
Damien Miller a1d42a6ce0 fix edge case in poll(2) wrapper
Correct handling of select(2) exceptfds. These should only be consulted
for POLLPRI flagged pfds and not unconditionally converted to POLLERR.

with and ok dtucker@
2022-01-14 14:09:38 +11:00
Darren Tucker 976b9588b4 Wrap OpenSSL includes in unit tests in ifdef.
Fixes unit test on systems that do not have OpenSSL headers installed.
2022-01-14 13:47:27 +11:00
Darren Tucker c171879374 Remove sort wrapper.
agent-restrict now takes care of this itself.
2022-01-13 16:01:41 +11:00
dtucker@openbsd.org 9cc2654403 upstream: Set LC_ALL in both local and remote shells so that sorted
output matches regardless of what the user's shell sets it to.  ok djm@

OpenBSD-Regress-ID: 4e97dd69a68b05872033175a4c2315345d01837f
2022-01-13 16:01:41 +11:00
dtucker@openbsd.org 7a75f748cb upstream: Avoid %'s in commands (not used in OpenBSD, but used in
-portable's Valgrind test) being interpretted as printf format strings.

OpenBSD-Regress-ID: dc8655db27ac4acd2c386c4681bf42a10d80b043
2022-01-13 15:49:38 +11:00