Add MAXIMUM(), MINIMUM(), and ROUNDUP() to misc.h, then
use those definitions rather than pulling <sys/param.h> and unknown namespace
pollution. ok djm markus dtucker
Upstream-ID: 712cafa816c9f012a61628b66b9fbd5687223fb8
update ext_info_c every time we receive a kexinit msg;
fixes sending of ext_info if privsep is disabled; report Aris Adamantiadis &
Mancha; ok djm@
Upstream-ID: 2ceaa1076e19dbd3542254b4fb8e42d608f28856
remove 3des-cbc from the client's default proposal;
64-bit block ciphers are not safe in 2016 and we don't want to wait until
attacks like sweet32 are extended to SSH.
As 3des-cbc was the only mandatory cipher in the SSH RFCs, this may
cause problems connecting to older devices using the defaults, but
it's highly likely that such devices already need explicit
configuration for KEX and hostkeys anyway.
ok deraadt, markus, dtucker
Upstream-ID: a505dfe65c6733af0f751b64cbc4bb7e0761bc2f
restrict monitor auth calls to be allowed only when their
respective authentication methods are enabled in the configuration.
prompted by Solar Designer; ok markus dtucker
Upstream-ID: 6eb3f89332b3546d41d6dbf5a8e6ff920142b553
fix uninitialised optlen in getsockopt() call; harmless
on Unix/BSD but potentially crashy on Cygwin. Reported by James Slepicka ok
deraadt@
Upstream-ID: 1987ccee508ba5b18f016c85100d7ac3f70ff965
add a sIgnore opcode that silently ignores options and
use it to suppress noisy deprecation warnings for the Protocol directive.
req henning, ok markus
Upstream-ID: 9fe040aca3d6ff393f6f7e60045cdd821dc4cbe0
remove Protocol directive from client/server configs that
causes spammy deprecation warnings
hardcode SSH_PROTOCOLS=2, since that's all we support on the server
now (the client still may support both, so it could get confused)
Upstream-Regress-ID: c16662c631af51633f9fd06aca552a70535de181
fix negated address matching where the address list
consists of a single negated match, e.g. "Match addr !192.20.0.1"
Report and patch from Jakub Jelen. bz#2397 ok dtucker@
Upstream-ID: 01dcac3f3e6ca47518cf293e31c73597a4bb40d8
fix matching for pattern lists that contain a single
negated match, e.g. "Host !example"
report and patch from Robin Becker. bz#1918 ok dtucker@
Upstream-ID: 05a0cb323ea4bc20e98db099b42c067bfb9ea1ea
remove UseLogin option and support for having /bin/login
manage login sessions; ok deraadt markus dtucker
Upstream-ID: bea7213fbf158efab7e602d9d844fba4837d2712
Catch up with the SSH1 code removal and delete all
mention of protocol 1 particularities, key files and formats, command line
options, and configuration keywords from the server documentation and
examples. ok jmc@
Upstream-ID: 850328854675b4b6a0d4a90f0b4a9dd9ca4e905f
Remove more SSH1 server code: * Drop sshd's -k option. *
Retire configuration keywords that only apply to protocol 1, as well as the
"protocol" keyword. * Remove some related vestiges of protocol 1 support.
ok markus@
Upstream-ID: 9402f82886de917779db12f8ee3f03d4decc244d
When using clang with -ftrapv or -sanitize=integer the tests would pass
but linking would fail with "undefined reference to __mulodi4".
Explicitly test for this before enabling -trapv.
Our explicit_bzero successfully confused clang -fsanitize-memory
in to thinking that memset is never called to initialise memory.
Ensure that it is called in a way that the compiler recognises.
Use 2001:db8::/32, the official IPv6 subnet for
configuration examples.
This makes the IPv6 example consistent with IPv4, and removes a dubious
mention of a 6bone subnet.
ok sthen@ millert@
Upstream-ID: b027f3d0e0073419a132fd1bf002e8089b233634
Fix bug introduced in rev 1.467 which causes
"buffer_get_bignum_ret: incomplete message" errors when built with WITH_SSH1
and run such that no Protocol 1 ephemeral host key is generated (eg "Protocol
2", no SSH1 host key supplied). Reported by rainer.laatsch at t-online.de,
ok deraadt@
Upstream-ID: aa6b132da5c325523aed7989cc5a320497c919dc
NetBSD added an strnvis and unfortunately made it incompatible with the
existing one in OpenBSD and Linux's libbsd (the former having existed
for over ten years). Despite this incompatibility being reported during
development (see http://gnats.netbsd.org/44977) they still shipped it.
Even more unfortunately FreeBSD and later MacOS picked up this incompatible
implementation. Try to detect this mess, and assume the only safe option
if we're cross compiling.
OpenBSD 2.9 (2001): strnvis(char *dst, const char *src, size_t dlen, int flag);
NetBSD 6.0 (2012): strnvis(char *dst, size_t dlen, const char *src, int flag);
ok djm@
dtucker@openbsd.org
deraadt@openbsd.org
jmc@openbsd.org
markus@openbsd.org
djm@openbsd.org
Darren Tucker
Damien Miller
guenther@openbsd.org
otto@openbsd.org
naddy@openbsd.org
jca@openbsd.org