tyler.durden
/
openssh-portable
mirror of https://github.com/PowerShell/openssh-portable.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
9,137 Commits 7 Branches 18 Tags 96 MiB
Commit Graph

9137 Commits

Author SHA1 Message Date
markus@openbsd.org cb1f94431e upstream: ssh/xmss: fix build; ok djm@ 
OpenBSD-Commit-ID: c9374ca41d4497f1c673ab681cc33f6e7c5dd186
 2018-03-23 11:05:39 +11:00
markus@openbsd.org 27979da9e4 upstream: ssh/xmss: fix deserialize for certs; ok djm@ 
OpenBSD-Commit-ID: f44c41636c16ec83502039828beaf521c057dddc
 2018-03-23 11:05:39 +11:00
Darren Tucker c6cb2565c9 Save $? before case statement. 
In some shells (FreeBSD 9, ash) the case statement resets $?, so save
for later testing.
 2018-03-22 17:00:28 +11:00
djm@openbsd.org 4c4e7f783b upstream: rename recently-added "valid-before" key restriction to 
"expiry-time" as the former is confusing wrt similar terminology in X.509;
pointed out by jsing@

OpenBSD-Regress-ID: ac8b41dbfd90cffd525d58350c327195b0937793
 2018-03-14 18:55:47 +11:00
djm@openbsd.org 500396b204 upstream: check valid-before option in authorized_keys 
OpenBSD-Regress-ID: 7e1e4a84f7f099a290e5a4cbf4196f90ff2d7e11
 2018-03-14 18:55:47 +11:00
djm@openbsd.org a76b5d26c2 upstream: explicitly specify RSA/SHA-2 keytype here too 
OpenBSD-Regress-ID: 74d7b24e8c72c27af6b481198344eb077e993a62
 2018-03-14 18:55:47 +11:00
djm@openbsd.org 3a43297ce2 upstream: exlicitly include RSA/SHA-2 keytypes in 
PubkeyAcceptedKeyTypes here

OpenBSD-Regress-ID: 954d19e0032a74e31697fb1dc7e7d3d1b2d65fe9
 2018-03-14 18:55:47 +11:00
jmc@openbsd.org 037fdc1dc2 upstream: sort expiry-time; 
OpenBSD-Commit-ID: 8c7d82ee1e63e26ceb2b3d3a16514019f984f6bf
 2018-03-14 18:55:33 +11:00
djm@openbsd.org abc0fa38c9 upstream: rename recently-added "valid-before" key restriction to 
"expiry-time" as the former is confusing wrt similar terminology in X.509;
pointed out by jsing@

OpenBSD-Commit-ID: 376939466a1f562f3950a22314bc6505733aaae6
 2018-03-14 18:55:33 +11:00
djm@openbsd.org bf0fbf2b11 upstream: add valid-before="[time]" authorized_keys option. A 
simple way of giving a key an expiry date. ok markus@

OpenBSD-Commit-ID: 1793b4dd5184fa87f42ed33c7b0f4f02bc877947
 2018-03-14 18:55:32 +11:00
Darren Tucker fbd733ab7a Add AC_LANG_PROGRAM to AC_COMPILE_IFELSE. 
The recently added MIPS ABI tests need AC_LANG_PROGRAM to prevent
warnings from autoconf.  Pointed out by klausz at haus-gisela.de.
 2018-03-12 19:17:26 +11:00
djm@openbsd.org c7c458e826 upstream: revert recent strdelim() change, it causes problems with 
some configs.

revision 1.124
date: 2018/03/02 03:02:11;  author: djm;  state: Exp;  lines: +19 -8;  commitid: nNRsCijZiGG6SUTT;
Allow escaped quotes \" and \' in ssh_config and sshd_config quotes
option strings. bz#1596 ok markus@

OpenBSD-Commit-ID: 59c40b1b81206d713c06b49d8477402c86babda5
 2018-03-12 11:48:15 +11:00
jmc@openbsd.org 0bcd871ccd upstream: move the input format details to -f; remove the output 
format details and point to sshd(8), where it is documented;

ok dtucker

OpenBSD-Commit-ID: 95f17e47dae02a6ac7329708c8c893d4cad0004a
 2018-03-12 11:48:15 +11:00
Vicente Olivert Riera 45011511a0 configure.ac: properly set seccomp_audit_arch for MIPS64 
Currently seccomp_audit_arch is set to AUDIT_ARCH_MIPS64 or
AUDIT_ARCH_MIPSEL64 (depending on the endinness) when openssh is built
for MIPS64. However, that's only valid for n64 ABI. The right macros for
n32 ABI defined in seccomp.h are AUDIT_ARCH_MIPS64N32 and
AUDIT_ARCH_MIPSEL64N32, for big and little endian respectively.

Because of that an sshd built for MIPS64 n32 rejects connection attempts
and the output of strace reveals that the problem is related to seccomp
audit:

[pid   194] prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, {len=57,
filter=0x555d5da0}) = 0
[pid   194] write(7, "\0\0\0]\0\0\0\5\0\0\0Ulist_hostkey_types: "..., 97) = ?
[pid   193] <... poll resumed> )        = 2 ([{fd=5, revents=POLLIN|POLLHUP},
{fd=6, revents=POLLHUP}])
[pid   194] +++ killed by SIGSYS +++

This patch fixes that problem by setting the right value to
seccomp_audit_arch taking into account the MIPS64 ABI.

Signed-off-by: Vicente Olivert Riera <Vincent.Riera@imgtec.com>
 2018-03-08 13:03:06 +11:00
Vicente Olivert Riera 580086704c configure.ac: detect MIPS ABI 
Signed-off-by: Vicente Olivert Riera <Vincent.Riera@imgtec.com>
 2018-03-08 13:02:48 +11:00
Alan Yee cd4e937aa7 Use https URLs for links that support it. 2018-03-08 10:41:30 +11:00
Darren Tucker c0a0c3fc4a Disable UTMPX on SunOS4. 2018-03-05 20:03:07 +11:00
Darren Tucker 58fd4c5c01 Check for and work around buggy fflush(NULL). 
Some really old platforms (eg SunOS4) segfault on fflush(NULL) so check
for and work around.  With klausz at haus-gisela.de.
 2018-03-05 19:28:08 +11:00
Darren Tucker 71e48bc794 Remove extra XMSS #endif 
Extra #endif breaks compile with -DWITH_XMSS.  Pointed out by Jack
Schmidt via github.
 2018-03-05 10:22:32 +11:00
dtucker@openbsd.org 055e09e221 upstream: Update RSA minimum modulus size to 1024. sshkey.h rev 1.18 
bumped the minimum from 768 to 1024, update man page accordingly.

OpenBSD-Commit-ID: 27563ab4e866cd2aac40a5247876f6787c08a338
 2018-03-04 12:48:08 +11:00
djm@openbsd.org 7e4fadd324 upstream: for the pty control tests, just check that the PTY path 
points to something in /dev (rather than checking the device node itself);
makes life easier for portable, where systems with dynamic ptys can delete
nodes before we get around to testing their existence.

OpenBSD-Regress-ID: b1e455b821e62572bccd98102f8dd9d09bb94994
 2018-03-04 12:47:42 +11:00
Darren Tucker 13ef4cf53f Update PAM password change to new opts API. 2018-03-03 16:21:20 +11:00
Darren Tucker 33561e68e0 Add strndup for platforms that need it. 
Some platforms don't have strndup, which includes Solaris 10, NetBSD 3
and FreeBSD 6.
 2018-03-03 14:58:34 +11:00
Darren Tucker e8a17feba9 Flatten and alphabetize object file lists. 
This will make maintenance and changes easier.  "no objection" tim@
 2018-03-03 14:58:34 +11:00
djm@openbsd.org de1920d743 upstream: unit tests for new authorized_keys options API 
OpenBSD-Regress-ID: 820f9ec9c6301f6ca330ad4052d85f0e67d0bdc1
 2018-03-03 14:39:25 +11:00
djm@openbsd.org dc3e92df17 upstream: fix testing of pty option, include positive test and 
testing of restrict keyword

OpenBSD-Regress-ID: 4268f27c2706a0a95e725d9518c5bcbec9814c6d
 2018-03-03 14:38:26 +11:00
djm@openbsd.org 3d1edd1ebb upstream: better testing for port-forwarding and restrict flags in 
authorized_keys

OpenBSD-Regress-ID: ee771df8955f2735df54746872c6228aff381daa
 2018-03-03 14:38:26 +11:00
djm@openbsd.org 7c85685760 upstream: switch over to the new authorized_keys options API and 
remove the legacy one.

Includes a fairly big refactor of auth2-pubkey.c to retain less state
between key file lines.

feedback and ok markus@

OpenBSD-Commit-ID: dece6cae0f47751b9892080eb13d6625599573df
 2018-03-03 14:37:16 +11:00
djm@openbsd.org 90c4bec8b5 upstream: Introduce a new API for handling authorized_keys options. 
This API parses options to a dedicated structure rather than the old API's
approach of setting global state. It also includes support for merging
options, e.g. from authorized_keys, authorized_principals and/or
certificates.

feedback and ok markus@

OpenBSD-Commit-ID: 98badda102cd575210d7802943e93a34232c80a2
 2018-03-03 14:22:11 +11:00
djm@openbsd.org 2607438076 upstream: warn when the agent returns a signature type that was 
different to what was requested. This might happen when an old/non-OpenSSH
agent is asked to make a rsa-sha2-256/512 signature but only supports
ssh-rsa. bz#2799 feedback and ok markus@

OpenBSD-Commit-ID: 760c0f9438c5c58abc16b5f98008ff2d95cb13ce
 2018-03-03 14:20:47 +11:00
jmc@openbsd.org f493d2b0b6 upstream: apply a lick of paint; tweaks/ok dtucker 
OpenBSD-Commit-ID: 518a6736338045e0037f503c21027d958d05e703
 2018-03-03 14:20:47 +11:00
djm@openbsd.org 713d9cb510 upstream: Allow escaped quotes \" and \' in ssh_config and 
sshd_config quotes option strings. bz#1596 ok markus@

OpenBSD-Commit-ID: dd3a29fc2dc905e8780198e5a6a30b096de1a1cb
 2018-03-02 14:39:17 +11:00
djm@openbsd.org 94b4e2d29a upstream: refactor sshkey_read() to make it a little more, err, 
readable. ok markus

OpenBSD-Commit-ID: 2e9247b5762fdac3b6335dc606d3822121714c28
 2018-03-02 14:39:16 +11:00
markus@openbsd.org 5886b92968 upstream: missing #ifdef for _PATH_HOST_XMSS_KEY_FILE; report by 
jmc@

OpenBSD-Commit-ID: 9039cb69a3f9886bfef096891a9e7fcbd620280b
 2018-03-02 14:30:15 +11:00
dtucker@openbsd.org 3b36bed3d2 upstream: Remove unneeded (local) include. ok markus@ 
OpenBSD-Commit-ID: 132812dd2296b1caa8cb07d2408afc28e4e60f93
 2018-03-02 14:30:02 +11:00
dtucker@openbsd.org 27b9f3950e upstream: Add $OpenBSD$ markers to xmss files to help keep synced 
with portable. ok djm@.

OpenBSD-Commit-ID: 5233a27aafd1dfadad4b957225f95ae51eb365c1
 2018-03-02 14:29:25 +11:00
dtucker@openbsd.org afd830847a upstream: Add newline at end of file to prevent compiler warnings. 
OpenBSD-Commit-ID: 52f247d4eafe840c7c14c8befa71a760a8eeb063
 2018-03-02 14:29:01 +11:00
Darren Tucker 941e0d3e9b Add WITH_XMSS, move to prevent conflicts. 
Add #ifdef WITH_XMSS to ssh-xmss.c, move it in the other files to after
includes.h so it's less likely to conflict and will pick up WITH_XMSS if
added to config.h.
 2018-02-28 19:59:35 +11:00
Darren Tucker a10d8552d0 Conditionally compile XMSS code. 
The XMSS code is currently experimental and, unlike the rest of OpenSSH
cannot currently be compiled with a c89 compiler.
 2018-02-28 16:52:12 +11:00
Darren Tucker 146c3bd28c Check dlopen has RTLD_NOW before enabling pkcs11. 2018-02-27 15:28:31 +11:00
Darren Tucker 1323f120d0 Check for attributes on prototype args. 
Some compilers (gcc 2.9.53, 3.0 and probably others, see gcc bug #3481)
do not accept __attribute__ on function pointer prototype args.  Check for
this and hide them if they're not accepted.
 2018-02-27 08:51:56 +11:00
Darren Tucker f0b245b043 Check if HAVE_DECL_BZERO correctly. 2018-02-27 08:51:52 +11:00
Darren Tucker c7ef4a3991 Wrap <stdint.h> in #ifdef HAVE_STDINT_H. 2018-02-26 17:42:56 +11:00
Darren Tucker ac53ce46cf Replace $(CURDIR) with $(PWD). 
The former doesn't work on Solaris or BSDs.
 2018-02-26 16:24:23 +11:00
Darren Tucker 534b2680a1 Comment out hexdump(). 
Nothing currently uses them but they cause conflicts on at least
FreeBSD, possibly others.  ok djm@
 2018-02-26 14:51:59 +11:00
Darren Tucker 5aea4aa522 typo: missing ; 2018-02-26 14:39:14 +11:00
Darren Tucker cd3ab57f9b Hook up flock() compat code. 
Also a couple of minor changes: fail if we can't lock instead of
silently succeeding, and apply a couple of minor style fixes.
 2018-02-26 14:37:06 +11:00
Darren Tucker b087998d1b Import flock() compat from NetBSD. 
From NetBSD's src/trunk/tools/compat/flock.c, no OpenSSH changes yet.
 2018-02-26 14:27:02 +11:00
Darren Tucker 89212533dd Fix breakage when REGRESSTMP not set. 
BUILDDIR is not set where used for REGRESSTMP, use make's CURDIR
instead.  Pointed out by djm@.
 2018-02-26 12:32:14 +11:00
Damien Miller f885474137 XMSS-related files get includes.h 2018-02-26 12:18:14 +11:00