11509 Commits

Author SHA1 Message Date
djm@openbsd.org
555294a727 upstream: Allow "SendEnv -PATTERN" to clear environment variables
previously labeled for sendind. bz#1285 ok dtucker@

OpenBSD-Commit-ID: f6fec9e3d0f366f15903094fbe1754cb359a0df9
2018-04-06 23:15:29 +10:00
djm@openbsd.org
40f5f03544 upstream: relax checking of authorized_keys environment="..."
options to allow underscores in variable names (regression introduced in
7.7). bz2851, ok deraadt@

OpenBSD-Commit-ID: 69690ffe0c97ff393f2c76d25b4b3d2ed4e4ac9c
2018-04-06 14:20:33 +10:00
djm@openbsd.org
30fd7f9af0 upstream: add a couple of missed options to the config dump; patch
from Jakub Jelen via bz2835

OpenBSD-Commit-ID: 5970adadf6ef206bee0dddfc75d24c2019861446
2018-04-06 14:20:33 +10:00
djm@openbsd.org
8d6829be32 upstream: ssh does not accept -oInclude=... on the commandline, the
Include keyword is for configuration files only. bz#2840, patch from Jakub
Jelen

OpenBSD-Commit-ID: 32d052b4a7a7f22df35fe3f71c368c02b02cacb0
2018-04-06 14:20:33 +10:00
djm@openbsd.org
00c5222ddc upstream: We don't offer CBC cipher by default any more. Spotted by
Renaud Allard (via otto@)

OpenBSD-Commit-ID: a559b1eef741557dd959ae378b665a2977d92dca
2018-04-06 14:20:33 +10:00
job@openbsd.org
5ee8448ad7 upstream: Update default IPQoS in ssh(1), sshd(8) to DSCP AF21 for
interactive and CS1 for bulk

AF21 was selected as this is the highest priority within the low-latency
service class (and it is higher than what we have today). SSH is elastic
and time-sensitive data, where a user is waiting for a response via the
network in order to continue with a task at hand. As such, these flows
should be considered foreground traffic, with delays or drops to such
traffic directly impacting user-productivity.

For bulk SSH traffic, the CS1 "Lower Effort" marker was chosen to enable
networks implementing a scavanger/lower-than-best effort class to
discriminate scp(1) below normal activities, such as web surfing. In
general this type of bulk SSH traffic is a background activity.

An advantage of using "AF21" for interactive SSH and "CS1" for bulk SSH
is that they are recognisable values on all common platforms (IANA
https://www.iana.org/assignments/dscp-registry/dscp-registry.xml), and
for AF21 specifically a definition of the intended behavior exists
https://tools.ietf.org/html/rfc4594#section-4.7 in addition to the definition
of the Assured Forwarding PHB group https://tools.ietf.org/html/rfc2597, and
for CS1 (Lower Effort) there is https://tools.ietf.org/html/rfc3662

The first three bits of "AF21" map to the equivalent IEEEE 802.1D PCP, IEEE
802.11e, MPLS EXP/CoS and IP Precedence value of 2 (also known as "Immediate",
or "AC_BE"), and CS1's first 3 bits map to IEEEE 802.1D PCP, IEEE 802.11e,
MPLS/CoS and IP Precedence value 1 ("Background" or "AC_BK").

OK deraadt@, "no objection" djm@

OpenBSD-Commit-ID: d11d2a4484f461524ef0c20870523dfcdeb52181
2018-04-06 14:20:33 +10:00
dtucker@openbsd.org
424b544fbd upstream: Import regenerated moduli file.
OpenBSD-Commit-ID: 1de0e85522051eb2ffa00437e1885e9d7b3e0c2e
2018-04-06 14:20:33 +10:00
dtucker@openbsd.org
323f66ce93 upstream: Add test for username options parsing order, prompted by
bz#2849.

OpenBSD-Regress-ID: 6985cd32f38596882a3ac172ff8c510693b65283
2018-04-06 14:19:51 +10:00
Damien Miller
e8f474554e Expose SSH_AUTH_INFO_0 to PAM auth modules
bz#2408, patch from Radoslaw Ejsmont; ok dtucker@
2018-04-06 14:11:44 +10:00
Manoj Ampalam
1616b21ecb
Added support for hard links over sftp
https://github.com/PowerShell/Win32-OpenSSH/issues/1119
Added link() support using the CreateHardLink() function.
Made readlink() and link() declarations consistent with other functions.
2018-04-05 09:57:41 -07:00
Bryan Berns
14ba410250 Removed Problematic Debug Statements
- Removed debug statements that were interfering with APC wakeup due to the way that logging works in atomicio6().
- Filled in a missing parameter in a debug statement.
2018-04-03 23:17:44 -04:00
Manoj Ampalam
20c34c7808
Merge pull request #298 from manojampalam/up_merge
Ported upstream changes (OpenSSH 7.7p1)
2018-04-02 22:42:57 -07:00
Manoj Ampalam
a871e28338 updated appveyor to reflect the version change 2018-04-02 22:38:37 -07:00
Manoj Ampalam
32a7aec453 Ported upstream changes (7.7) 2018-04-02 22:30:15 -07:00
Darren Tucker
014ba209cf Import regenerated moduli file. 2018-04-03 12:18:00 +10:00
Manoj Ampalam
6c9f57ac09 :missed changes to auth.c 2018-04-02 13:15:17 -07:00
Manoj Ampalam
2474b9130b Merge branch 'master' of https://github.com/openssh/openssh-portable into up_merge 2018-04-02 13:13:47 -07:00
Damien Miller
a0349a1cc4 update versions in .spec files 2018-04-02 15:38:28 +10:00
Damien Miller
816ad38f79 update version number 2018-04-02 15:38:20 +10:00
Bryan Berns
bd6408058a Reworked Path Resolution Function
- Reworked resolved_path() into resolved_path_utf16() that combined utf16 conversion and path conditioning into a single function.  This eliminated the previously non-threadsafe resolved_path() function.
- Adjusted functions to use resolved_path_utf16().
- Collapsed copy_file() function that was only used once.
- Corrected compilation errors when debug4() and debug5() are enabled.
2018-04-01 23:41:09 -04:00
Bryan Berns
296c6934bc Added link() Support
- Added link() support using the CreateHardLink() function.
- Made readlink() and link() declarations consistent with other functions.
2018-03-31 07:52:58 -04:00
Manoj Ampalam
c1aaa5d5a3 updates to uninstall-sshd.ps1, cranked version to 7.6.1.0 (#295) v7.6.1.0 2018-03-30 19:45:11 -07:00
Yanbing
f291d2438f
Added config files to enabled VSTS build, compliance tests, Code signing. (#296)
Added config files to enabled VSTS build, compliance tests, Code signing.
2018-03-30 19:44:07 -07:00
Daniel Sweet
11726e3c8e Follow POSIX write/append semantics in fileio_open (#276)
fileio_open previously treated all O_CREAT flags as CREATE_* flags in
CreateFile; CREATE_* always truncates files but O_CREAT only truncates
files when O_TRUNC is also set on POSIX platforms. This becomes
noticeable under SFTP sessions where remote files are opened with
O_APPEND: the file is instead truncated as in O_CREAT | O_TRUNC.

https://github.com/PowerShell/Win32-OpenSSH/issues/1078
2018-03-30 12:37:07 -07:00
revngnr
f607a0be96 Bandwidth limits don't work correctly for sftp client (#278)
Fixes following issues:
- gettimeofday : Incorrect converting 100ns intervals (from GetSystemTimeAsFileTime) to timeval.
(us % RATE_DIFF) means number of microseconds but it may be great than 10**6
- nanosleep : SetWaitableTimer works with 100ns intervals but get nanoseconnds (only part of timespec) Missed CloseHandle call in WaitForSingleObject error case.


https://github.com/PowerShell/Win32-OpenSSH/issues/1094
2018-03-30 09:45:44 -07:00
Darren Tucker
2c71ca1dd1 Disable native strndup and strnlen on AIX.
On at least some revisions of AIX, strndup returns unterminated strings
under some conditions, apparently because strnlen returns incorrect
values in those cases.  Disable both on AIX and use the replacements
from openbsd-compat.  Fixes problem with ECDSA keys there, ok djm.
2018-03-30 18:23:07 +11:00
Manoj Ampalam
71eaeec511 Added hotfix branch for auto commit validation 2018-03-29 12:04:48 -07:00
Bryan Berns
993cce0798 Added symlink() Implementation; Revised readlink() (#289)
- Added implementation of symlink() using native CreateSymbolicLink() function.
- Added unit tests for symlink behavior in readlink(), lstat, stat(), and symlink().
- Reworked readlink() to be more inline with POSIX readlink() behavior.
- Reworked symlink handling in stat/lstat due to revised readlink().
- Added additional error handling to readlink().
- Added symlink() Implementation - Memory Leak Fix
- Modified fileio_readlink() to properly free a temporary buffer it creates.
2018-03-29 10:54:38 -07:00
bagajjal
00b869dbd8 Use libre ssl official release binaries (#294)
- Use LibreSSL release binaries. Update paths.target
- Update paths.targets to remove onecore specific changes
- Minor changes
2018-03-29 10:23:05 -07:00
bagajjal
be0a2ff29d Fix shellhost infiniteloop issue (ssh.exe -t user@ip dir) (#292)
Fix for PowerShell/Win32-OpenSSH#892
Fixed warning messages in latest code.
2018-03-26 21:32:30 -07:00
Yanbing
952650633d
Update compiler and link options (#293)
* add additionaloptions for ClCompiler and linker for APIscan compliance test
2018-03-26 16:21:56 -07:00
Darren Tucker
6b5a17bc14 Include ssh_api.h for struct ssh.
struct ssh is needed by implementations of sys_auth_passwd() that were
converted in commit bba02a50.  Needed to fix build on AIX, I assume for
the other platforms too (although it should be harmless if not needed).
2018-03-26 13:24:41 +11:00
Darren Tucker
bc3f80e4d1 Remove UNICOS code missed during removal.
Fixes compile error on AIX.
2018-03-26 13:24:28 +11:00
markus@openbsd.org
9d57762c24 upstream: openssh-7.7
OpenBSD-Commit-ID: 274e614352460b9802c905f38fb5ea7ed5db3d41
2018-03-26 09:38:44 +11:00
Damien Miller
4b7d8acdbb Remove authinfo.sh test dependency on printenv
Some platforms lack printenv in the default $PATH.
Reported by Tom G. Christensen
2018-03-26 09:38:44 +11:00
Tim Rice
4afeaf3dcb Use libiaf on all sysv5 systems 2018-03-25 10:00:21 -07:00
Tim Rice
bba02a5094 modified: auth-sia.c
modified:   openbsd-compat/port-aix.c
	modified:   openbsd-compat/port-uw.c

	propogate changes to auth-passwd.c in commit
	7c856857607112a3dfe6414696bf4c7ab7fb0cb3 to other providers
	of sys_auth_passwd()
2018-03-25 09:17:33 -07:00
markus@openbsd.org
d7a7a39168 upstream: openssh-7.7
OpenBSD-Commit-ID: 274e614352460b9802c905f38fb5ea7ed5db3d41
2018-03-25 09:48:48 +11:00
markus@openbsd.org
9efcaaac31 upstream: fix bogus warning when signing cert keys using agent;
from djm; ok deraadt dtucker

OpenBSD-Commit-ID: 12e50836ba2040042383a8b71e12d7ea06e9633d
2018-03-25 09:47:30 +11:00
Darren Tucker
393436024d Replace /dev/stdin with "-".
For some reason sftp -b doesn't work with /dev/stdin on Cygwin, as noted
and suggested by vinschen at redhat.com.
2018-03-25 09:40:46 +11:00
Darren Tucker
b5974de1a1 Provide $OBJ to paths in PuTTY interop tests. 2018-03-23 13:21:14 +11:00
dtucker@openbsd.org
dc31e79454 upstream: Tell puttygen to use /dev/urandom instead of /dev/random. On
OpenBSD they are both non-blocking, but on many other -portable platforms it
blocks, stalling tests.

OpenBSD-Regress-ID: 397d0d4c719c353f24d79f5b14775e0cfdf0e1cc
2018-03-23 11:05:39 +11:00
markus@openbsd.org
cb1f94431e upstream: ssh/xmss: fix build; ok djm@
OpenBSD-Commit-ID: c9374ca41d4497f1c673ab681cc33f6e7c5dd186
2018-03-23 11:05:39 +11:00
markus@openbsd.org
27979da9e4 upstream: ssh/xmss: fix deserialize for certs; ok djm@
OpenBSD-Commit-ID: f44c41636c16ec83502039828beaf521c057dddc
2018-03-23 11:05:39 +11:00
Darren Tucker
c6cb2565c9 Save $? before case statement.
In some shells (FreeBSD 9, ash) the case statement resets $?, so save
for later testing.
2018-03-22 17:00:28 +11:00
Bryan Berns
59971b42ee Updated Signal Handler (#287)
https://github.com/PowerShell/Win32-OpenSSH/issues/1096
https://github.com/PowerShell/Win32-OpenSSH/issues/191

- Updated wait_for_multiple_objects_enhanced() to handle a no-event request while alterable.
- Simplified wait_for_any_event() to by taking advantage of no-event alterable request in wait_for_multiple_objects_enhanced().
- Updated wait_for_any_event() to use MAX_CHILDREN limit instead of MAXIMUM_WAIT_OBJECTS limit.
- Removed unnecessary ZeroMemory() call.
- Created distinct definition MAXIMUM_WAIT_OBJECTS_ENHANCED
 and modified functions to use it.
- Upped w32_select() event limit.
- Modified wait_for_multiple_objects_enhanced() to allow for 0 millisecond wait.
2018-03-20 09:49:09 -07:00
Manoj Ampalam
7a8e119275
Fix for orphaned unprivileged workers on sshd login timeout (#290)
Issue: When sshd times out due to login grace timeout, it leaves behind the unprivileged worker orphaned.
Fix: Add missing child's reference in monitor.
2018-03-20 09:41:52 -07:00
Bryan Berns
966d8c4129 Unit Test Updates / Small Bug Fixes (#288)
- Updated socketio_WSARecv() to prevent attempted buffer overrun.
- Updated w32_rename() to handle error when input parameters are null.
- Updated file verify success on dup() test.
2018-03-16 09:32:26 -07:00
Bryan Berns
d43856a300 Added Symbolic Link Support (#285)
Created readlink() implementation.
Separated, corrected lstat() implementation.
Added symlink file type indicator to returned request data.
2018-03-15 17:13:13 -07:00
Bryan Berns
0dc5a971bd Allow More Child Processes (#284)
- Added wait_for_multiple_objects_enhanced() function that can logically handle wait-any on many children (system resources permitting).
- Added unit tests for wait_for_multiple_objects_enhanced().
- Incorporated use of wait_for_multiple_objects_enhanced() into main signal handler.
- Upped max child processes to 500.
2018-03-14 11:10:27 -07:00