summaryrefslogtreecommitdiff
Commit message (Collapse)AuthorAgeFilesLines
...
* | Fallback for key gen without hard link support (#89)Matt Robinson2020-03-141-8/+21
|/ | | | | | Add a non-atomic fallback for key generation on platforms where link() is not permitted (such as most stock Android installs) or on filesystems without hard link support (such as FAT).
* MOTD enabled by default as the manpage says (#87)zciendor2020-03-141-1/+1
| | | | The man page (https://github.com/mkj/dropbear/blob/master/dropbear.8) says MOTD will be printed by default for any login shell, but it was disabled at compile time. Probably happened by accident when this code was moved from `options.h` to `default_options.h`.
* Add Ed25519 support (#91)Vladislav Grishenko2020-03-1130-946/+1289
| | | | | | | | | | | | | | | | * Add support for Ed25519 as a public key type Ed25519 is a elliptic curve signature scheme that offers better security than ECDSA and DSA and good performance. It may be used for both user and host keys. OpenSSH key import and fuzzer are not supported yet. Initially inspired by Peter Szabo. * Add curve25519 and ed25519 fuzzers * Add import and export of Ed25519 keys
* bring back fsync_parent_dirMatt Johnston2019-10-181-0/+4
|
* Bring back Dropbear patch to avoid setting AR/LD/RANLIB in LTMMatt Johnston2019-09-171-3/+4
|
* Prime-related bugfixes (#81)Steffen Jaeckel2019-09-173-34/+18
| | | | | | | | | | | * Merge pull request #180 from czurnieden/isprimeerror Fixed bug in mp_prime_isprime (cherry picked from commit f3ff7064f3301a2fc11b84d389fd67769862d437) * do 2 MR rounds for numbers >=2048bits * back-port modified mp_prime_next_prime()
* update ltm to 1.1.0 and enable FIPS 186.4 compliant key-generation (#79)Steffen Jaeckel2019-09-16214-26304/+17787
| | | | | | | | | | | | | | | | | | | | | | * make key-generation compliant to FIPS 186.4 * fix includes in tommath_class.h * update fuzzcorpus instead of error-out * fixup fuzzing make-targets * update Makefile.in * apply necessary patches to ltm sources * clean-up not required ltm files * update to vanilla ltm 1.1.0 this already only contains the required files * remove set/get double
* Rename EPKA -> PluginMatt Johnston2019-05-1511-81/+81
|
* External Public-Key Authentication API (#72)fabriziobertocci2019-05-1512-11/+355
| | | | | | | | | | | | | | | | | | | | | | * Implemented dynamic loading of an external plug-in shared library to delegate public key authentication * Moved conditional compilation of the plugin infrastructure into the configure.ac script to be able to add -ldl to dropbear build only when the flag is enabled * Added tags file to the ignore list * Updated API to have the constructor to return function pointers in the pliugin instance. Added support for passing user name to the checkpubkey function. Added options to the session returned by the plugin and have dropbear to parse and process them * Added -rdynamic to the linker flags when EPKA is enabled * Changed the API to pass a previously created session to the checkPubKey function (created during preauth) * Added documentation to the API * Added parameter addrstring to plugin creation function * Modified the API to retrieve the auth options. Instead of having them as field of the EPKASession struct, they are stored internally (plugin-dependent) in the plugin/session and retrieved through a pointer to a function (in the session) * Changed option string to be a simple char * instead of unsigned char *
* Added signature for changeset ebcdb893992dMatt Johnston2019-03-271-0/+1
|
* Added tag DROPBEAR_2019.78 for changeset 009d52ae26d3Matt Johnston2019-03-270-0/+0
|
* Bump to 2019.78DROPBEAR_2019.78Matt Johnston2019-03-273-1/+12
|
* Fix regression where TTY modes weren't reset for clientMatt Johnston2019-03-241-5/+5
|
* Added signature for changeset 07b0d56d186dMatt Johnston2019-03-231-0/+1
|
* Added tag DROPBEAR_2019.77 for changeset 6d1bbe7d5fa5Matt Johnston2019-03-230-0/+0
|
* 2019.77DROPBEAR_2019.77Matt Johnston2019-03-233-1/+47
|
* use "openssl sha256"Matt Johnston2019-03-231-1/+1
|
* Update config.sub to 2019-01-05 and config.guess to 2019-03-04Matt Johnston2019-03-232-1678/+1767
|
* fix constness build errorMatt Johnston2019-03-212-2/+2
|
* limit password length to 100Matt Johnston2019-03-212-1/+12
|
* Increase MAX_USERNAME_LEN to 100Matt Johnston2019-03-201-1/+1
|
* dropbearconvert: keyimport.c: fix BER encoding of secp521r1 keys (#69)Christian Hohnst?dt2019-03-201-1/+3
| | | | | | | | | | | | | | | | | | | keysizes >= 128 octets will be encoded with a 3 byte header which must be accounted by the optional-header Reproduce: master:~/build/dropbear$ ./dropbearkey -t ecdsa -s 521 -f K Generating 521 bit ecdsa key, this may take a while... master:~/build/dropbear$ ./dropbearconvert d o K L Key is a ecdsa-sha2-nistp521 key Wrote key to 'L' master:~/build/dropbear$ openssl ec < L read EC key unable to load Key 139769806448384:error:0D07209B:asn1 encoding routines:ASN1_get_object:too long:crypto/asn1/asn1_lib.c:91:
* support openssh long option -o Port=XXXX (#68)xcko2019-03-201-0/+6
|
* cygwin competibility fix (#64)karel-m2019-03-201-1/+5
|
* drop obsolete definition for MAX_KEXHASHBUF (#65)Andre McCurdy2019-03-201-3/+0
| | | | | | | | The last code to make use of MAX_KEXHASHBUF was removed in 2005: https://github.com/mkj/dropbear/commit/736f370dce614b717193f45d084e9e009de723ce Signed-off-by: Andre McCurdy <armccurdy@gmail.com>
* Add a sanity check for DROPBEAR_SVR_MULTIUSER==0 modeMatt Johnston2019-03-202-1/+13
|
* Support servers without multiple user support (#76)Patrick Stewart2019-03-205-1/+18
|
* packet: remove stale comment about "packet_type" (#63)Konstantin Demin2019-03-201-2/+0
| | | | | | clean up after 7f15910541 Signed-off-by: Konstantin Demin <rockdrilla@gmail.com>
* fix some gcc warnings (#73)Fran?ois Perrad2019-03-202-3/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * tweak string size fix gcc8 warnings ``` svr-agentfwd.c: In function 'bindagent': svr-agentfwd.c:254:53: warning: '%s' directive output may be truncated writing up to 107 bytes into a region of size between 0 and 107 [-Wformat-truncation=] snprintf(addr.sun_path, sizeof(addr.sun_path), "%s/%s", path, sockfile); ^~ ~~~~~~~~ svr-agentfwd.c:254:2: note: 'snprintf' output between 2 and 216 bytes into a destination of size 108 snprintf(addr.sun_path, sizeof(addr.sun_path), "%s/%s", path, sockfile); ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ``` * cleanup signed/unsigned comparison fix gcc8 warnings ``` scp.c: In function 'do_local_cmd': scp.c:132:17: warning: comparison of integer expressions of different signedness: 'u_int' {aka 'unsigned int'} and 'int' [-Wsign-compare] for (i = 0; i < a->num; i++) ^ scpmisc.c: In function 'addargs': scpmisc.c:161:25: warning: comparison of integer expressions of different signedness: 'int' and 'u_int' {aka 'unsigned int'} [-Wsign-compare] } else if (args->num+2 >= nalloc) ^~ scpmisc.c: In function 'replacearg': scpmisc.c:183:12: warning: comparison of integer expressions of different signedness: 'u_int' {aka 'unsigned int'} and 'int' [-Wsign-compare] if (which >= args->num) ^~ scpmisc.c: In function 'freeargs': scpmisc.c:196:17: warning: comparison of integer expressions of different signedness: 'u_int' {aka 'unsigned int'} and 'int' [-Wsign-compare] for (i = 0; i < args->num; i++) ^ ``` see https://cvsweb.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/misc.h.diff?r1=1.16&r2=1.17
* use strlcpy & strlcat (#74)Fran?ois Perrad2019-03-202-5/+6
| | | | | | | | | | | | | | | | | | | | | * refactor checkpubkeyperms() with safe BSD functions fix gcc8 warnings ``` svr-authpubkey.c: In function 'checkpubkeyperms': svr-authpubkey.c:427:2: warning: 'strncat' specified bound 5 equals source length [-Wstringop-overflow=] strncat(filename, "/.ssh", 5); /* strlen("/.ssh") == 5 */ ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~ svr-authpubkey.c:433:2: warning: 'strncat' specified bound 16 equals source length [-Wstringop-overflow=] strncat(filename, "/authorized_keys", 16); ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ``` see https://www.sudo.ws/todd/papers/strlcpy.html * restore strlcpy in xstrdup see original https://cvsweb.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/xmalloc.c?rev=1.16
* Fix for issue successfull login of disabled user (#78)vincentto132019-03-201-0/+1
| | | | | | | | | | | | | This commit introduces fix for scenario: 1. Root login disabled on dropbear 2. PAM authentication model enabled While login as root user, after prompt for password user is being notified about login failrue, but after second attempt of prompt for password within same session, login becames succesfull. Signed-off-by: Pawel Rapkiewicz <pawel.rapkiewicz@gmail.com>
* Add missing word to readme (#77)Michael Jones2019-03-201-1/+1
|
* add missing initializer (#71)Fran?ois Perrad2019-01-071-0/+1
|
* mergeMatt Johnston2018-11-1411-35/+58
|\
| * Split ChanType closehandler() and cleanup() so that dbclient doesn'tMatt Johnston2018-11-1410-31/+58
| | | | | | | | lose exit status messages
| * Remove some cluttering TRACE printoutsMatt Johnston2018-11-141-4/+0
| |
* | Remove incorrect _POSIX_C_SOURCEMatt Johnston2018-11-062-8/+0
|/
* - Add adaptive authentication failure delayMatt Johnston2018-11-056-48/+95
| | | | - Rework monotonic_now/gettime_wrapper and use clock_gettime on more platforms
* merge remote forward fixMatt Johnston2018-09-074-6/+12
|\
| * FIx remote forward listenersMatt Johnston2018-09-074-6/+12
| |
* | Merge writev #include fixMatt Johnston2018-08-2648-133/+1756
|\ \ | |/ |/|
| * Merge bugfix delay invalid usersMatt Johnston2018-08-2348-133/+1756
| |\
| | * avoid extended regex features to avoid caring about sed -r vs -EMatt Johnston2018-07-241-1/+1
| | |
| | * Fix leaks in kex fuzzersMatt Johnston2018-03-092-2/+10
| | |
| | * move dictionaries to corpus repoMatt Johnston2018-03-093-78/+0
| | |
| | * avoid leak of ecdh public keyMatt Johnston2018-03-081-0/+3
| | |
| | * kexhashbuf was much to small in kex fuzzersMatt Johnston2018-03-082-4/+2
| | |
| | * Disable wrapfds outside of fuzzed codeMatt Johnston2018-03-081-0/+6
| | |
| | * It turns out you can't have a single-quote in an #errorMatt Johnston2018-03-081-1/+1
| | |
| | * Only advertise a single server ecdsa key when -R (generate as required) isMatt Johnston2018-03-081-24/+35
| | | | | | | | | | | | specified. Fixes -R now that default ecdsa key size has changed.
View Lorry Controller Status