summaryrefslogtreecommitdiff
Commit message (Collapse)AuthorAgeFilesLines
* Add clang sanitizer tests.Darren Tucker2022-07-034-1/+64
|
* Skip all rlimit tests when sandboxing disabled.Darren Tucker2022-07-031-11/+9
| | | | | The rlimit tests can hang when being run with some compiler sanitizers so skip all of them if sandbox=no.
* Move checks for pollfd.fd and nfds_t.Darren Tucker2022-07-031-20/+20
| | | | | | Move the checks for struct pollfd.fd and nfds_t to before the sandboxing checks. This groups all the sandbox checks together so we can skip them all when sandboxing is disabled.
* upstream: Remove leftover line.dtucker@openbsd.org2022-07-011-3/+1
| | | | | | Remove extra line leftover from merge conflict. ok djm@ OpenBSD-Commit-ID: 460e2290875d7ae64971a7e669c244b1d1c0ae2e
* upstream: use consistent field names (s/char/byte)djm@openbsd.org2022-07-011-6/+6
| | | | | | in format description OpenBSD-Commit-ID: 3de33572733ee7fcfd7db33d37db23d2280254f0
* Skip select+rlimit check if sandboxing is disabledDarren Tucker2022-07-011-4/+8
| | | | | It's not needed in that case, and the test can fail when being built with some compiler memory sanitizer flags. bz#3441
* upstream: bump up loglevel from debug to info when unable to opendjm@openbsd.org2022-07-011-5/+9
| | | | | | authorized keys/principals file for errno != ENOENT; bz2042 ok dtucker OpenBSD-Commit-ID: e79aa550d91ade6a80f081bda689da24c086d66b
* upstream: Don't leak the strings allocated by order_hostkeyalgs()dtucker@openbsd.org2022-07-012-12/+21
| | | | | | | | | | and list_hostkey_types() that are passed to compat_pkalg_proposal(). Part of github PR#324 from ZoltanFridrich, ok djm@ This is a roll-forward of the previous rollback now that the required changes in compat.c have been done. OpenBSD-Commit-ID: c7cd93730b3b9f53cdad3ae32462922834ef73eb
* upstream: Always return allocated strings from the kex filtering sodtucker@openbsd.org2022-07-011-4/+11
| | | | | | | that we can free them later. Fix one leak in compat_kex_proposal. Based on github PR#324 from ZoltanFridrich with some simplications by me. ok djm@ OpenBSD-Commit-ID: 9171616da3307612d0ede086fd511142f91246e4
* upstream: ignore SIGPIPE earlier in main(), specifically beforedjm@openbsd.org2022-07-011-2/+3
| | | | | | | muxclient() which performs operations that could cause one; Reported by Noam Lewis via bz3454, ok dtucker@ OpenBSD-Commit-ID: 63d8e13276869eebac6d7a05d5a96307f9026e47
* upstream: reflect the update to -D arg name in usage();jmc@openbsd.org2022-07-011-2/+2
| | | | OpenBSD-Commit-ID: abdcde4f92b1ef094ae44210ee99d3b0155aad9c
* Update OpenSSL tests to the most recent releases.Darren Tucker2022-06-291-2/+2
|
* upstream: allow arguments to sftp -D option, e.g. sftp -Ddjm@openbsd.org2022-06-282-11/+15
| | | | | | | | "/usr/libexec/sftp-server -el debug3" ok markus@ OpenBSD-Commit-ID: 5a002b9f3a7aef2731fc0ffa9c921cf15f38ecce
* upstream: Roll back previous KEX changes as they aren't safe untildtucker@openbsd.org2022-06-282-12/+6
| | | | | | | compat_pkalg_proposal and friends always allocate their returned strings. Reported by Qualys. OpenBSD-Commit-ID: 1c7a88a0d5033f42f88ab9bec58ef1cf72c81ad0
* upstream: Don't leak the strings allocated by order_hostkeyalgs()dtucker@openbsd.org2022-06-282-6/+12
| | | | | | | and list_hostkey_types() that are passed to compat_pkalg_proposal(). Part of github PR#324 from ZoltanFridrich, ok djm@ OpenBSD-Commit-ID: b2f6e5f60f2bba293b831654328a8a0035ef4a1b
* Zero out LIBFIDO2 when SK support not usable.Darren Tucker2022-06-251-1/+1
| | | | | Prevents us from trying to link them into ssh-sk-helper and failing to build.
* Disable SK support if FIDO libs not found.Darren Tucker2022-06-251-0/+1
|
* fix broken case statement in previousDamien Miller2022-06-241-0/+1
|
* request 1.1x API compatibility for OpenSSL >=3.xDamien Miller2022-06-241-2/+7
| | | | idea/patch from Pedro Martelletto via GHPR#322; ok dtucker@
* upstream: make it clear that RekeyLimit applies to both transmitteddjm@openbsd.org2022-06-242-10/+10
| | | | | | and received data. GHPR#328 from Jan Pazdziora OpenBSD-Commit-ID: d180a905fec9ff418a75c07bb96ea41c9308c3f9
* upstream: Make sure not to fclose() the same fd twice in case of antobhe@openbsd.org2022-06-241-7/+12
| | | | | | | | error. ok dtucker@ OpenBSD-Commit-ID: e384c4e05d5521e7866b3d53ca59acd2a86eef99
* upstream: Don't attempt to fprintf a null identity comment. Fromdtucker@openbsd.org2022-06-241-3/+3
| | | | | | Martin Vahlensieck via tech@. OpenBSD-Commit-ID: 4c54d20a8e8e4e9912c38a7b4ef5bfc5ca2e05c2
* upstream: Log an error if pipe() fails while accepting adtucker@openbsd.org2022-06-241-3/+7
| | | | | | connection. bz#3447, from vincent-openssh at vinc17 net, ok djm@ OpenBSD-Commit-ID: 9d59f19872b94900a5c79da2d57850241ac5df94
* automatically enable built-in FIDO supportDamien Miller2022-06-241-31/+34
| | | | | | | | If libfido2 is found and usable, then enable the built-in security key support unless --without-security-key-builtin was requested. ok dtucker@
* fix possible NULL deref when built without FIDODamien Miller2022-06-241-1/+2
| | | | Analysis/fix from kircher in bz3443; ok dtucker@
* upstream: make sure that UseDNS hostname lookup happens in the monitordjm@openbsd.org2022-06-165-27/+20
| | | | | | | and not in the pledge(2)'d unprivileged process; fixes regression caused by recent refactoring spotted by henning@ OpenBSD-Commit-ID: a089870b95101cd8881a2dff65b2f1627d13e88d
* upstream: move auth_openprincipals() and auth_openkeyfile() over todjm@openbsd.org2022-06-033-61/+60
| | | | | | auth2-pubkeyfile.c too; they make more sense there. OpenBSD-Commit-ID: 9970d99f900e1117fdaab13e9e910a621b7c60ee
* upstream: test setenv in both client and server, test first-match-winsdjm@openbsd.org2022-06-032-4/+79
| | | | | | too OpenBSD-Regress-ID: 4c8804f9db38a02db480b9923317457b377fe34b
* upstream: Make SetEnv directives first-match-wins in bothdjm@openbsd.org2022-06-037-42/+58
| | | | | | | | | | | sshd_config and sshd_config; previously if the same name was reused then the last would win (which is the opposite to how the config is supposed to work). While there, make the ssh_config parsing more like sshd_config. bz3438, ok dtucker OpenBSD-Commit-ID: 797909c1e0262c0d00e09280459d7ab00f18273b
* upstream: Add missing *-sk types to ssh-keyscan manpage. Fromdtucker@openbsd.org2022-06-031-3/+7
| | | | | | skazi0 via github PR#294. OpenBSD-Commit-ID: fda2c869cdb871f3c90a89fb3f985370bb5d25c0
* upstream: Add period at end of "not known by any other names"dtucker@openbsd.org2022-06-031-2/+2
| | | | | | message. github PR#320 from jschauma, ok djm@ OpenBSD-Commit-ID: bd60809803c4bfd3ebb7c5c4d918b10e275266f2
* upstream: ssh-keygen -A: do not generate DSA keys by default.dtucker@openbsd.org2022-06-032-7/+6
| | | | | | | Based on github PR#303 from jsegitz with man page text from jmc@, ok markus@ djm@ OpenBSD-Commit-ID: 5c4c57bdd7063ff03381cfb6696659dd3f9f5b9f
* upstream: ssh-keygen: implement "verify-required" certificate option.naddy@openbsd.org2022-06-031-1/+11
| | | | | | | | | This was already documented when support for user-verified FIDO keys was added, but the ssh-keygen(1) code was missing. ok djm@ OpenBSD-Commit-ID: f660f973391b593fea4b7b25913c9a15c3eb8a06
* upstream: keywords ref ssh_config.5;jmc@openbsd.org2022-06-031-4/+7
| | | | | | from caspar schutijser OpenBSD-Commit-ID: f146a19d7d5c9374c3b9c520da43b2732d7d1a4e
* fix some bugs in the fuzzerDamien Miller2022-05-301-1/+6
|
* Test against OpenSSL 1.1.1o and 3.0.3.Darren Tucker2022-05-271-1/+2
|
* Test against LibreSSL 3.5.3.Darren Tucker2022-05-271-1/+1
|
* fuzzer for authorized_keys parsingDamien Miller2022-05-272-1/+80
| | | | | mostly redundant to authopt_fuzz, but it's sensitive code so IMO it makes sense to test this layer too
* upstream: split the low-level file handling functions out fromdjm@openbsd.org2022-05-275-402/+465
| | | | | | | | | | | | auth2-pubkey.c Put them in a new auth2-pubkeyfile.c to make it easier to refer to them (e.g. in unit/fuzz tests) without having to refer to everything else pubkey auth brings in. ok dtucker@ OpenBSD-Commit-ID: 3fdca2c61ad97dc1b8d4a7346816f83dc4ce2217
* upstream: refactor authorized_keys/principals handlingdjm@openbsd.org2022-05-276-57/+77
| | | | | | | | | | remove "struct ssh *" from arguments - this was only used to pass the remote host/address. These can be passed in instead and the resulting code is less tightly coupled to ssh_api.[ch] ok dtucker@ OpenBSD-Commit-ID: 9d4373d013edc4cc4b5c21a599e1837ac31dda0d
* upstream: f sshpkt functions fail, then password is not cleareddtucker@openbsd.org2022-05-271-4/+6
| | | | | | | | | with freezero. Unconditionally call freezero to guarantee that password is removed from RAM. From tobias@ and c3h2_ctf via github PR#286, ok djm@ OpenBSD-Commit-ID: 6b093619c9515328e25b0f8093779c52402c89cd
* upstream: Avoid kill with -1 argument. The out_ctx label can bedtucker@openbsd.org2022-05-271-2/+3
| | | | | | | | | reached before fork has been called. If this happens, then kill -1 would be called, sending SIGTERM to all processes reachable by the current process. From tobias@ and c3h2_ctf via github PR#286, ok djm@ OpenBSD-Commit-ID: 6277af1207d81202f5daffdccfeeaed4c763b1a8
* upstream: Note that ProxyJump also accepts the same tokens asdtucker@openbsd.org2022-05-271-3/+5
| | | | | | ProxyCommand. From pallxk via github PR#305. OpenBSD-Commit-ID: 7115ac351b129205f1f1ffa6bbfd62abd76be7c5
* upstream: revert previous; it was broken (spotted by Theo)djm@openbsd.org2022-05-254-36/+35
| | | | OpenBSD-Commit-ID: 457c79afaca2f89ec2606405c1059b98b30d8b0d
* upstream: make SSHBUF_DBG/SSHBUF_TELL (off by default and only enableddjm@openbsd.org2022-05-254-35/+36
| | | | | | via #define) dump to stderr rather than stdout OpenBSD-Commit-ID: 10298513ee32db8390aecb0397d782d68cb14318
* configure.ac: Add missing AC_DEFINE for caph_cache_tzdata test causingTim Rice2022-05-241-1/+5
| | | | | HAVE_CAPH_CACHE_TZDATA to be missing from config.h.in. Spotted by Bryan Drewery
* upstream: regress test for in-place transfers and clobbering largerdjm@openbsd.org2022-05-161-1/+26
| | | | | | files with smaller ones; would have caught last regression in scp(1) OpenBSD-Regress-ID: 19de4e88dd3a4f7e5c1618c9be3c32415bd93bc2
* upstream: Only run agent-ptrace.sh if gdb is available as allanton@openbsd.org2022-05-161-1/+1
| | | | | | architectures do not ship with gdb. OpenBSD-Regress-ID: ec53e928803e6b87f9ac142d38888ca79a45348d
* upstream: fix in-place copies; r1.163 incorrectly skipped truncation indjm@openbsd.org2022-05-161-5/+8
| | | | | | | all cases, not just at the start of a transfer. This could cause overwrites of larger files to leave junk at the end. Spotted by tb@ OpenBSD-Commit-ID: b189f19cd68119548c8e24e39c79f61e115bf92c
* upstream: arrange for scp, when in sftp mode, to not ftruncate(3) filesdjm@openbsd.org2022-05-134-43/+64
| | | | | | | | | | | | early previous behavious of unconditionally truncating the destination file would cause "scp ~/foo localhost:" and "scp localhost:foo ~/" to delete all the contents of their destination. spotted by solene@ sthen@, also bz3431; ok dtucker@ OpenBSD-Commit-ID: ca39fdd39e0ec1466b9666f15cbcfddea6aaa179
View Lorry Controller Status