summaryrefslogtreecommitdiff
Commit message (Collapse)AuthorAgeFilesLines
* update version numbersV_8_4_P1V_8_4Damien Miller2020-09-273-3/+3
|
* upstream: openssh 8.4djm@openbsd.org2020-09-271-2/+2
| | | | OpenBSD-Commit-ID: a29e5b372d2c00e297da8a35a3b87c9beb3b4a58
* sync with upstream ssh-copy-id rev f0da1a1b7Damien Miller2020-09-222-79/+81
|
* upstream: close stdin when forking after authentication too; ok markusdjm@openbsd.org2020-09-211-2/+3
| | | | OpenBSD-Commit-ID: 43db17e4abc3e6b4a7b033aa8cdab326a7cb6c24
* upstream: close stdout/stderr after "ssh -f ..." forkingdjm@openbsd.org2020-09-211-6/+21
| | | | | | bz#3137, ok markus OpenBSD-Commit-ID: e2d83cc4dea1665651a7aa924ad1ed6bcaaab3e2
* .dependDamien Miller2020-09-201-2/+2
|
* upstream: cap channel input buffer size at 16MB; avoids high memory usedjm@openbsd.org2020-09-202-2/+8
| | | | | | | | | | | when peer advertises a large window but is slow to consume the data we send (e.g. because of a slow network) reported by Pierre-Yves David fix with & ok markus@ OpenBSD-Commit-ID: 1452771f5e5e768876d3bfe2544e3866d6ade216
* libfido2 1.5.0 is recommendedDamien Miller2020-09-181-1/+2
|
* upstream: handle multiple messages in a single read()djm@openbsd.org2020-09-181-6/+13
| | | | | | PR#183 by Dennis Kaarsemaker; feedback and ok markus@ OpenBSD-Commit-ID: 8570bb4d02d00cf70b98590716ea6a7d1cce68d1
* configure.ac: add missing includespedro martelletto2020-09-181-10/+51
| | | | | | | | | | when testing, make sure to include the relevant header files that declare the types of the functions used by the test: - stdio.h for printf(); - stdlib.h for exit(); - string.h for strcmp(); - unistd.h for unlink(), _exit(), fork(), getppid(), sleep().
* upstream: tweak the client hostkey preference ordering algorithm todjm@openbsd.org2020-09-181-3/+38
| | | | | | | | | prefer the default ordering if the user has a key that matches the best-preference default algorithm. feedback and ok markus@ OpenBSD-Commit-ID: a92dd7d7520ddd95c0a16786a7519e6d0167d35f
* control over the colours in gnome-ssh-askpass[23]Damien Miller2020-09-181-0/+57
| | | | | | Optionally set the textarea colours via $GNOME_SSH_ASKPASS_FG_COLOR and $GNOME_SSH_ASKPASS_BG_COLOR. These accept the usual three or six digit hex colours.
* focus improvement for gnome-ssh-askpass[23]Damien Miller2020-09-181-5/+37
| | | | | | When serving a SSH_ASKPASS_PROMPT=none information dialog, ensure then <enter> doesn't immediately close the dialog. Instead, require an explicit <tab> to reach the close button, or <esc>.
* upstream: Remove unused buf, last user was removed when switchingdtucker@openbsd.org2020-09-161-3/+1
| | | | | | to the sshbuf API. Patch from Sebastian Andrzej Siewior. OpenBSD-Commit-ID: 250fa17f0cec01039cc4abd95917d9746e24c889
* upstream: For the hostkey confirmation message:djm@openbsd.org2020-09-161-2/+2
| | | | | | | | | > Are you sure you want to continue connecting (yes/no/[fingerprint])? compare the fingerprint case sensitively; spotted Patrik Lundin ok dtucker OpenBSD-Commit-ID: 73097afee1b3a5929324e345ba4a4a42347409f2
* New config-build-time dependency on automake.Darren Tucker2020-09-111-3/+4
|
* Add aclocal.m4 and config.h.in~ to .gitignore.Darren Tucker2020-09-111-0/+2
| | | | aclocal.m4 is now generated by autoreconf.
* Quote the definition of OSSH_CHECK_HEADER_FOR_FIELDSebastian Andrzej Siewior2020-09-111-1/+1
| | | | | | | | | | autoreconf complains about underquoted definition of OSSH_CHECK_HEADER_FOR_FIELD after aclocal.m4 has been and now is beeing recreated. Quote OSSH_CHECK_HEADER_FOR_FIELD as suggested. Signed-off-by: Sebastian Andrzej Siewior <sebastian@breakpoint.cc>
* Move the local m4 macrosSebastian Andrzej Siewior2020-09-113-1/+2
| | | | | | | | | | | | | The `aclocal' step is skipped during `autoreconf' because aclocal.m4 is present. Move the current aclocal.m4 which contains local macros into the m4/ folder. With this change the aclocal.m4 will be re-created during changes to the m4/ macro. This is needed so the `aclocal' can fetch m4 macros from the system if they are references in the configure script. This is a prerequisite to use PKG_CHECK_MODULES. Signed-off-by: Sebastian Andrzej Siewior <sebastian@breakpoint.cc>
* Remove HAVE_MMAP and BROKEN_MMAPSebastian Andrzej Siewior2020-09-112-13/+0
| | | | | | | | | | | | | BROKEN_MMAP is no longer defined since commit 1cfd5c06efb12 ("Remove portability support for mmap") this commit also removed other HAVE_MMAP user. I didn't find anything that defines HAVE_MMAP. The check does not trigger because compression on server side is by default COMP_DELAYED (2) so it never triggers. Remove remaining HAVE_MMAP and BROKEN_MMAP bits. Signed-off-by: Sebastian Andrzej Siewior <sebastian@breakpoint.cc>
* upstream: adapt to SSH_SK_VERSION_MAJOR crankdjm@openbsd.org2020-09-091-1/+1
| | | | OpenBSD-Regress-ID: 0f3e76bdc8f9dbd9d22707c7bdd86051d5112ab8
* upstream: Ensure that address/mask mismatches are flagged atdtucker@openbsd.org2020-09-091-1/+13
| | | | | | config-check time. ok djm@ OpenBSD-Regress-ID: 8f5f4c2c0bf00e6ceae7a1755a444666de0ea5c2
* upstream: when writing an attestation blob for a FIDO key, record alldjm@openbsd.org2020-09-096-118/+96
| | | | | | | | | | the data needed to verify the attestation. Previously we were missing the "authenticator data" that is included in the signature. spotted by Ian Haken feedback Pedro Martelletto and Ian Haken; ok markus@ OpenBSD-Commit-ID: 8439896e63792b2db99c6065dd9a45eabbdb7e0a
* configure.ac: fix libfido2 back-compatpedro martelletto2020-09-022-1/+2
| | | | | | - HAVE_FIDO_CRED_PROD -> HAVE_FIDO_CRED_PROT; - check for fido_dev_get_touch_begin(), so that HAVE_FIDO_DEV_GET_TOUCH_BEGIN gets defined.
* upstream: refuse to add verify-required (PINful) FIDO keys todjm@openbsd.org2020-08-311-7/+16
| | | | | | ssh-agent until the agent supports them properly OpenBSD-Commit-ID: 125bd55a8df32c87c3ec33c6ebe437673a3d037e
* upstream: Add RCS IDs to the few files that are missing them; fromdjm@openbsd.org2020-08-316-0/+7
| | | | | | Pedro Martelletto OpenBSD-Commit-ID: 39aa37a43d0c75ec87f1659f573d3b5867e4a3b3
* upstream: Check that the addresses supplied to Match Address anddtucker@openbsd.org2020-08-311-1/+8
| | | | | | | | Match LocalAddress are valid when parsing in config-test mode. This will catch address/mask mismatches before they cause problems at runtime. Found by Daniel Stocker, ok djm@ OpenBSD-Commit-ID: 2d0b10c69fad5d8fda4c703e7c6804935289378b
* upstream: sentence fix; from pedro martellettojmc@openbsd.org2020-08-311-2/+2
| | | | OpenBSD-Commit-ID: f95b84a1e94e9913173229f3787448eea2f8a575
* tweak back-compat for older libfido2Damien Miller2020-08-272-6/+21
|
* upstream: debug()-print a little info about FIDO-specific keydjm@openbsd.org2020-08-271-2/+6
| | | | | | fields via "ssh-keygen -vyf /path/key" OpenBSD-Commit-ID: cf315c4fe77db43947d111b00155165cb6b577cf
* upstream: skip a bit more FIDO token selection logic when only adjm@openbsd.org2020-08-271-1/+8
| | | | | | | | single token is attached. with Pedro Martelletto OpenBSD-Commit-ID: e4a324bd9814227ec1faa8cb619580e661cca9ac
* upstream: tweak previous;jmc@openbsd.org2020-08-272-6/+6
| | | | OpenBSD-Commit-ID: 92714b6531e244e4da401b2defaa376374e24be7
* upstream: adapt to API changesdjm@openbsd.org2020-08-272-6/+7
| | | | OpenBSD-Regress-ID: 5f147990cb67094fe554333782ab268a572bb2dd
* degrade semi-gracefully when libfido2 is too oldDamien Miller2020-08-272-3/+29
|
* upstream: dummy firmware needs to match API version numner crank (fordjm@openbsd.org2020-08-271-1/+1
| | | | | | verify-required resident keys) even though it doesn't implement this feature OpenBSD-Regress-ID: 86579ea2891e18e822e204413d011b2ae0e59657
* upstream: remove unreachable code I forgot to delete in r1.334djm@openbsd.org2020-08-271-13/+1
| | | | OpenBSD-Commit-ID: 9ed6078251a0959ee8deda443b9ae42484fd8b18
* upstream: Request PIN ahead of time for certain FIDO actionsdjm@openbsd.org2020-08-272-19/+23
| | | | | | | | | | When we know that a particular action will require a PIN, such as downloading resident keys or generating a verify-required key, request the PIN before attempting it. joint work with Pedro Martelletto; ok markus@ OpenBSD-Commit-ID: 863182d38ef075bad1f7d20ca485752a05edb727
* upstream: preserve verify-required for resident FIDO keysdjm@openbsd.org2020-08-273-6/+10
| | | | | | | | | | | When downloading a resident, verify-required key from a FIDO token, preserve the verify-required in the private key that is written to disk. Previously we weren't doing that because of lack of support in the middleware API. from Pedro Martelletto; ok markus@ and myself OpenBSD-Commit-ID: 201c46ccdd227cddba3d64e1bdbd082afa956517
* upstream: major rework of FIDO token selection logicdjm@openbsd.org2020-08-272-253/+332
| | | | | | | | | | | | | | | | | | | | | | When PINs are in use and multiple FIDO tokens are attached to a host, we cannot just blast requests at all attached tokens with the PIN specified as this will cause the per-token PIN failure counter to increment. If this retry counter hits the token's limit (usually 3 attempts), then the token will lock itself and render all (web and SSH) of its keys invalid. We don't want this. So this reworks the key selection logic for the specific case of multiple keys being attached. When multiple keys are attached and the operation requires a PIN, then the user must touch the key that they wish to use first in order to identify it. This may require multiple touches, but only if there are multiple keys attached AND (usually) the operation requires a PIN. The usual case of a single key attached should be unaffected. Work by Pedro Martelletto; ok myself and markus@ OpenBSD-Commit-ID: 637d3049ced61b7a9ee796914bbc4843d999a864
* upstream: support for requiring user verified FIDO keys in sshddjm@openbsd.org2020-08-279-25/+88
| | | | | | | | | | | | | This adds a "verify-required" authorized_keys flag and a corresponding sshd_config option that tells sshd to require that FIDO keys verify the user identity before completing the signing/authentication attempt. Whether or not user verification was performed is already baked into the signature made on the FIDO token, so this is just plumbing that flag through and adding ways to require it. feedback and ok markus@ OpenBSD-Commit-ID: 3a2313aae153e043d57763d766bb6d55c4e276e6
* upstream: support for user-verified FIDO keysdjm@openbsd.org2020-08-2716-90/+164
| | | | | | | | | | | | | | | | | FIDO2 supports a notion of "user verification" where the user is required to demonstrate their identity to the token before particular operations (e.g. signing). Typically this is done by authenticating themselves using a PIN that has been set on the token. This adds support for generating and using user verified keys where the verification happens via PIN (other options might be added in the future, but none are in common use now). Practically, this adds another key generation option "verify-required" that yields a key that requires a PIN before each authentication. feedback markus@ and Pedro Martelletto; ok markus@ OpenBSD-Commit-ID: 57fd461e4366f87c47502c5614ec08573e6d6a15
* upstream: ssh-keyscan(1): simplify conloop() with timercmp(3),cheloha@openbsd.org2020-08-271-13/+5
| | | | | | timersub(3); ok djm@ OpenBSD-Commit-ID: a102acb544f840d33ad73d40088adab4a687fa27
* upstream: let ssh_config(5)'s AddKeysToAgent keyword accept a timedjm@openbsd.org2020-08-274-27/+89
| | | | | | | | limit for keys in addition to its current flag options. Time-limited keys will automatically be removed from ssh-agent after their expiry time has passed; ok markus@ OpenBSD-Commit-ID: 792e71cacbbc25faab5424cf80bee4a006119f94
* upstream: let the "Confirm user presence for key ..." ssh-askpassdjm@openbsd.org2020-08-271-9/+14
| | | | | | notification respect $SSH_ASKPASS_REQUIRE; ok markus@ OpenBSD-Commit-ID: 7c1a616b348779bda3b9ad46bf592741f8e206c1
* Remove check for 'ent' command.Darren Tucker2020-08-212-3/+0
| | | | | It was added in 8d1fd57a9 for measuring entropy of ssh_prng_cmds which has long since been removed and there are no other references to it.
* Wrap stdint.h include in ifdef HAVE_STDINT_H.Darren Tucker2020-08-171-0/+2
|
* sync memmem.c with OpenBSDDamien Miller2020-08-101-47/+167
|
* Always send any PAM account messages.Darren Tucker2020-08-071-13/+13
| | | | | If the PAM account stack reaturns any messages, send them to the user not just if the check succeeds. bz#2049, ok djm@
* Output test debug logs on failure.Darren Tucker2020-08-071-0/+11
|
* Add ability to specify exact test target.Darren Tucker2020-08-072-1/+24
|
View Lorry Controller Status