Commit Graph

11305 Commits

Author SHA1 Message Date
djm@openbsd.org ace19b34cc upstream: better error message for ~user failures when the
sftp-server lacks the expand-path extension; ok deraadt@

OpenBSD-Commit-ID: 9c1d965d389411f7e86f0a445158bf09b8f9e4bc
2021-09-19 17:21:59 +10:00
djm@openbsd.org 6b1238ba97 upstream: make some more scp-in-SFTP mode better match Unix idioms
suggested by deraadt@

OpenBSD-Commit-ID: 0f2439404ed4cf0b0be8bf49a1ee734836e1ac87
2021-09-19 17:21:59 +10:00
djm@openbsd.org e694f8ac44 upstream: allow log_stderr==2 to prefix log messages with argv[0]
use this to make scp's SFTP mode error messages more scp-like

prompted by and ok deraadt@

OpenBSD-Commit-ID: 0e821dbde423fc2280e47414bdc22aaa5b4e0733
2021-09-19 17:21:59 +10:00
Darren Tucker 8a7a06ee50 Test against LibreSSL 3.2.6, 3.3.4, 3.4.0. 2021-09-17 13:03:31 +10:00
djm@openbsd.org c25c84074a upstream: missing space character in ssh -G output broke the
t-sshcfgparse regression test; spotted by anton@

OpenBSD-Commit-ID: bcc36fae2f233caac4baa8e58482da4aa350eed0
2021-09-16 15:38:16 +10:00
djm@openbsd.org a4bee1934b upstream: allow CanonicalizePermittedCNAMEs=none in ssh_config; ok
markus@

OpenBSD-Commit-ID: 668a82ba8e56d731b26ffc5703213bfe071df623
2021-09-16 15:38:16 +10:00
mbuhl@openbsd.org d0fffc88c8 upstream: put back the mux_ctx memleak fix for SSH_CHANNEL_MUX_CLIENT
OK mfriedl@

OpenBSD-Commit-ID: 1aba1da828956cacaadb81a637338734697d9798
2021-09-15 15:58:18 +10:00
schwarze@openbsd.org 19b3d846f0 upstream: Do not ignore SIGINT while waiting for input if editline(3)
is not used. Instead, in non-interactive mode, exit sftp(1), like for other
serious errors. As pointed out by dtucker@, when compiled without editline(3)
support in portable OpenSSH, the el == NULL branch is also used for
interactive mode. In that case, discard the input line and provide a fresh
prompt to the user just like in the case where editline(3) is used. OK djm@

OpenBSD-Commit-ID: 7d06f4d3ebba62115527fafacf38370d09dfb393
2021-09-11 20:26:51 +10:00
djm@openbsd.org ba61123eef upstream: when using SFTP protocol, continue transferring files after a
transfer error occurs. This matches original scp/rcp behaviour. ok dtucker@

OpenBSD-Commit-ID: dfe4558d71dd09707e9b5d6e7d2e53b793da69fa
2021-09-11 10:41:39 +10:00
dtucker@openbsd.org b0ec59a708 upstream: Document that non-interactive commands are run via the user's
shell using the -c flag.  ok jmc@

OpenBSD-Commit-ID: 4f0d912077732eead10423afd1acf4fc0ceec477
2021-09-10 22:05:35 +10:00
dtucker@openbsd.org 66a658b5d9 upstream: Document behaviour of arguments following non-interactive
commands. Prompted by github PR#139 from EvanTheB, feedback & ok djm@ jmc@

OpenBSD-Commit-ID: fc758d1fe0471dfab4304fcad6cd4ecc3d79162a
2021-09-10 20:34:09 +10:00
dtucker@openbsd.org 1d47e28e40 upstream: Clarify which file's attributes -p preserves, and that
it's specifically the file mode bits. bz#3340 from calestyo at scientia.net,
ok djm@ jmc@

OpenBSD-Commit-ID: f09e6098ed1c4be00c730873049825f8ee7cb884
2021-09-10 20:34:09 +10:00
djm@openbsd.org b344db7a41 upstream: openssh-7.4 was incorrectly listed twice; spotted by
Dmitry Belyavskiy, ok dtucker@

OpenBSD-Commit-ID: 4b823ae448f6e899927ce7b04225ac9e489f58ef
2021-09-10 20:34:09 +10:00
jmc@openbsd.org 9136d6239a upstream: - move CAVEATS to its correct order - use the term
"legacy" protocol rather than "original", as the latter made the text
misleading - uppercase SCP

ok djm

OpenBSD-Commit-ID: 8479255746d5fa76a358ee59e7340fecf4245ff0
2021-09-10 20:34:09 +10:00
David Carlier 2d678c5e3b Disable tracing on FreeBSD using procctl.
Placed at the start of platform_disable_tracing() to prevent declaration
after code errors from strict C89 compilers (in the unlikely event that
more than one method is enabled).
2021-09-09 18:13:27 +10:00
djm@openbsd.org 73050fa38f upstream: Use the SFTP protocol by default. The original scp/rcp
protocol remains available via the -O flag.

Note that ~user/ prefixed paths in SFTP mode require a protocol extension
that was first shipped in OpenSSH 8.7.

ok deraadt, after baking in snaps for a while without incident

OpenBSD-Commit-ID: 23588976e28c281ff5988da0848cb821fec9213c
2021-09-09 12:35:37 +10:00
Darren Tucker c4565e69ff Really fix test on OpenSSL 1.1.1 stable. 2021-09-08 21:09:49 +10:00
Darren Tucker 79f1bb5f56 Correct OpenSSL 1.1.1 stable identifier. 2021-09-08 18:51:39 +10:00
Darren Tucker b6255593ed Increment nfds when coming from startup_pipe.
If we have to increase nfds because startup_pipe[0] is above any of the
descriptors passed in the fd_sets, we also need to add 1 to nfds since
select takes highest FD number plus one.  bz#3345 from yaroslav.kuzmin
at vmssoftware.com.
2021-09-08 18:39:44 +10:00
Darren Tucker a3e92a6794 Tests for OpenSSL 3.0.0 release & 1.1.1 branch. 2021-09-08 13:45:10 +10:00
djm@openbsd.org 4afe431da9 upstream: correct my mistake in previous fix; spotted by halex
OpenBSD-Commit-ID: 3cc62d92e3f70006bf02468fc146bfc36fffa183
2021-09-08 13:31:42 +10:00
djm@openbsd.org ca0e455b93 upstream: avoid NULL deref in -Y find-principals. Report and fix
from Carlo Marcelo Arenas Belón
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

OpenBSD-Commit-ID: 6238486f8ecc888d6ccafcd9ad99e621bb41f1e0
2021-09-07 16:05:37 +10:00
millert@openbsd.org 37616807f1 upstream: revision 1.381 neglected to remove
sChallengeResponseAuthentication from the enum.  Noticed by
christos@zoulas.com.  OK dtucker@

OpenBSD-Commit-ID: b533283a4dd6d04a867da411a4c7a8fbc90e34ff
2021-09-07 16:05:36 +10:00
Darren Tucker 7acb3578cd Correct version_num for OpenSSL dev branch. 2021-09-05 20:45:42 +10:00
Darren Tucker 65bb011113 Test against OpenSSL 3 branch as well as dev.
Now that OpenSSL development has moved to 3.1, test against the most
recent version of the openssl-3.0 branch too.
2021-09-05 19:43:13 +10:00
Darren Tucker 864ed0d5e0 OpenSSL development is now 3.1.* 2021-09-05 19:33:22 +10:00
dtucker@openbsd.org a60209a586 upstream: Use .Cm instead of .Dq in StrictHostKeyChecking list for
consistency. Patch from scop via github PR#257, ok jmc@

OpenBSD-Commit-ID: 3652a91564570779431802c31224fb4a9cf39872
2021-09-03 18:08:46 +10:00
dtucker@openbsd.org 8d1d9eb6de upstream: Mention using ssh -i for specifying the public key file
in the case where the private key is loaded into ssh-agent but is not present
locally.  Based on patch from rafork via github PR#215, ok jmc@

OpenBSD-Commit-ID: 2282e83b0ff78d2efbe705883b67240745fa5bb2
2021-09-03 17:33:08 +10:00
dtucker@openbsd.org eb4362e5e3 upstream: Refer to KEX "algorithms" instead of "methods" to match
other references and improve consistency.  Patch from scop via github PR#241,
ok djm@

OpenBSD-Commit-ID: 840bc94ff6861b28d8603c8e8c16499bfb65e32c
2021-09-03 17:33:08 +10:00
dtucker@openbsd.org b3318946ce upstream: Remove redundant attrib_clear in upload_dir_internal.
The subsequent call to stat_to_attrib clears the struct as its first step
anyway. From pmeinhardt via github PR#220, ok djm@

OpenBSD-Commit-ID: f5234fc6d7425b607e179acb3383f21716f3029e
2021-09-03 17:32:31 +10:00
dtucker@openbsd.org 7cc3fe2889 upstream: Add test for client termination status on signal.
Based on patch from Alexxz via github PR#235 with some tweaks, to
match patch in bz#3281.

OpenBSD-Regress-ID: d87c7446fb8b5f8b45894fbbd6875df326e729e2
2021-09-03 14:35:07 +10:00
deraadt@openbsd.org 5428b0d239 upstream: sys/param.h is not needed for any visible reason
OpenBSD-Commit-ID: 8bdea2d0c75692e4c5777670ac039d4b01c1f368
2021-09-03 14:20:22 +10:00
Shchelkunov Artem 1ff38f34b4 Fix memory leak in error path.
*info is allocated via xstrdup but was leaked in the PAM_AUTH_ERR path.
From github PR#266.
2021-09-03 13:42:08 +10:00
dtucker@openbsd.org cb37e2f0c0 upstream: Fix ssh-rsa fallback for old PuTTY interop tests.
OpenBSD-Regress-ID: a19ac929da604843a5b5f0f48d2c0eb6e0773d37
2021-09-01 13:32:45 +10:00
dtucker@openbsd.org 8b02ef0f28 upstream: Add a function to skip remaining tests.
Many tests skip tests for various reasons but not in a consistent way and
don't always clean up, so add that and switch the tests that do that over.

OpenBSD-Regress-ID: 72d2ec90a3ee8849486956a808811734281af735
2021-09-01 11:40:43 +10:00
dtucker@openbsd.org d486845c07 upstream: Specify path to PuTTY keys.
Portable needs this and it makes no difference on OpenBSD, so resync
them.  (Id sync only, Portable already had this.)

OpenBSD-Regress-ID: 33f6f66744455886d148527af8368811e4264162
2021-09-01 11:40:17 +10:00
dtucker@openbsd.org d22b299115 upstream: Better compat tests with old PuTTY.
When running PuTTY interop tests and using a PuTTY version older than
0.76, re-enable the ssh-rsa host key algorithm (the 256 and 512 variants
of RSA were added some time between 0.73 and 0.76).

OpenBSD-Regress-ID: e6138d6987aa705fa1e4f216db0bb386e1ff38e1
2021-08-31 17:08:38 +10:00
Darren Tucker 87ad70d605 Resync PuTTY interop tests.
Resync behaviour when REGRESS_INTEROP_PUTTY is not set with OpenBSD.
2021-08-31 17:04:50 +10:00
dtucker@openbsd.org e47b82a7bf upstream: Specify hostkeyalgorithms in SSHFP test.
Specify host key algorithms in sshd's default set for the SSHFP test,
from djm@.  Make the reason for when the test is skipped a bit clearer.

OpenBSD-Regress-ID: 4f923dfc761480d5411de17ea6f0b30de3e32cea
2021-08-31 12:02:12 +10:00
djm@openbsd.org 7db3e0a9e8 upstream: adapt to RSA/SHA1 deprectation
OpenBSD-Regress-ID: 952397c39a22722880e4de9d1c50bb1a14f907bb
2021-08-30 11:26:02 +10:00
djm@openbsd.org 2344750250 upstream: After years of forewarning, disable the RSA/SHA-1
signature algorithm by default. It is feasible to create colliding SHA1
hashes, so we need to deprecate its use.

RSA/SHA-256/512 remains available and will be transparently selected
instead of RSA/SHA1 for most SSH servers released in the last five+
years. There is no need to regenerate RSA keys.

The use of RSA/SHA1 can be re-enabled by adding "ssh-rsa" to the
PubkeyAcceptedAlgorithms directives on the client and server.

ok dtucker deraadt

OpenBSD-Commit-ID: 189bcc4789c7254e09e23734bdd5def8354ff1d5
2021-08-30 09:58:15 +10:00
djm@openbsd.org 56c4455d3b upstream: wrap at 80 columns
OpenBSD-Commit-ID: 47ca2286d6b52a9747f34da16d742879e1a37bf0
2021-08-30 09:58:15 +10:00
Darren Tucker 95401eea85 Replace shell function with ssh-keygen -A.
Prevents the init script in the SysV package from trying (and failing)
to generate unsupported key types.  Remove now-unused COMMENT_OUT_ECC.
ok tim@
2021-08-20 18:14:13 +10:00
Darren Tucker d83ec9ed99 Remove obsolete Redhat PAM config and init script. 2021-08-20 15:39:05 +10:00
Damien Miller e1a596186c depend 2021-08-20 14:03:49 +10:00
Damien Miller 5450606c8f update version numbers 2021-08-20 13:59:43 +10:00
djm@openbsd.org feee2384ab upstream: openssh-8.7
OpenBSD-Commit-ID: 8769dff0fd76ae3193d77bf83b439adee0f300cd
2021-08-20 13:26:52 +10:00
Darren Tucker 9a2ed62173 Also check pid in pselect_notify_setup.
Spotted by djm@.
2021-08-20 10:48:13 +10:00
Darren Tucker deaadcb93c Prefix pselect functions to clarify debug messages 2021-08-20 08:39:33 +10:00
Darren Tucker 10e45654cf Fix race in pselect replacement code.
On the second and subsequent calls to pselect the notify_pipe was not
added to the select readset, opening up a race that om G. Christensen
discovered on multiprocessor Solaris <=9 systems.

Also reinitialize notify_pipe if the pid changes.  This will prevent a
parent and child from using the same FD, although this is not an issue
in the current structure it might be in future.
2021-08-20 08:30:42 +10:00