summaryrefslogtreecommitdiff
path: root/compat.h
Commit message (Collapse)AuthorAgeFilesLines
* upstream: Refactor creation of KEX proposal.dtucker@openbsd.org2023-03-061-4/+2
| | | | | | | | | | This adds kex_proposal_populate_entries (and corresponding free) which populates the KEX proposal array with dynamically allocated strings. This replaces the previous mix of static and dynamic that has been the source of previous leaks and bugs. Remove unused compat functions. With & ok djm@. OpenBSD-Commit-ID: f2f99da4aae2233cb18bf9c749320c5e040a9c7b
* upstream: Remove now-unused compat bit SSH_BUG_RSASIGMD5. The codedtucker@openbsd.org2023-02-171-2/+2
| | | | | | | to set this was removed in OpenSSH 7.7 when support for SSH implementations dating back to before RFC standardization were removed. "burn it all" djm@ OpenBSD-Commit-ID: 6330935fbe23dd00be79891505e06d1ffdac7cda
* upstream: Remove now-unused compat bit SSH_BUG_BIGENDIANAES. Thisdtucker@openbsd.org2023-02-171-2/+2
| | | | | | | was previously set for OpenSSH 2.3 (released in 2000) but this check was removed in OpenSSH 7.7 (2018). ok djm@ deraadt@ OpenBSD-Commit-ID: 326426ea328707fc9e83305291ab135c87f678af
* upstream: Remove SSH_BUG_PASSWORDPAD compat bitdtucker@openbsd.org2023-02-161-2/+2
| | | | | | since it's no longer used. ok markus@ OpenBSD-Commit-ID: b92c21f56fe4b7f9a54790d6a9650725c226820b
* upstream: Remove SSH_BUG_IGNOREMSG compat flagdtucker@openbsd.org2023-02-161-2/+2
| | | | | | | since it's only applicable to SSH1 and thus no longer used. ok markus@ "kill it with fire" djm@ OpenBSD-Commit-ID: ea13318b1937795d9db4790d3ce0a6ed01584dab
* upstream: Client-side workaround for a bug in OpenSSH 7.4: this releasedjm@openbsd.org2021-06-061-2/+2
| | | | | | | | | | | | allows RSA/SHA2 signatures for public key authentication but fails to advertise this correctly via SSH2_MSG_EXT_INFO. This causes clients of these server to incorrectly match PubkeyAcceptedAlgorithms and potentially refuse to offer valid keys. Reported by and based on patch from Gordon Messmer via bz3213, thanks also for additional analysis by Jakub Jelen. ok dtucker OpenBSD-Commit-ID: d6d0b7351d5d44c45f3daaa26efac65847a564f7
* upstream: remove global variable used to stash compat flags and use thedjm@openbsd.org2021-01-271-6/+6
| | | | | | purpose-built ssh->compat variable instead; feedback/ok markus@ OpenBSD-Commit-ID: 7c4f200e112dae6bcf99f5bae1a5629288378a06
* upstream: Remove now-unused proto_spec and associated definitions.dtucker@openbsd.org2020-06-041-7/+1
| | | | | | ok djm@ OpenBSD-Commit-ID: 2e2b18e3aa6ee22a7b69c39f2d3bd679ec35c362
* upstream: revert compat.[ch] section of the following change. Itdjm@openbsd.org2018-08-131-10/+4
| | | | | | | | | | | | causes double-free under some circumstances. -- date: 2018/07/31 03:07:24; author: djm; state: Exp; lines: +33 -18; commitid: f7g4UI8eeOXReTPh; fix some memory leaks spotted by Coverity via Jakub Jelen in bz#2366 feedback and ok dtucker@ OpenBSD-Commit-ID: 1e77547f60fdb5e2ffe23e2e4733c54d8d2d1137
* upstream: fix some memory leaks spotted by Coverity via Jakub Jelendjm@openbsd.org2018-07-311-4/+10
| | | | | | in bz#2366 feedback and ok dtucker@ OpenBSD-Commit-ID: 8402bbae67d578bedbadb0ce68ff7c5a136ef563
* upstream: Improve strictness and control over RSA-SHA2 signaturedjm@openbsd.org2018-07-031-2/+2
| | | | | | | | | | | | | | | | | | | | | | | In ssh, when an agent fails to return a RSA-SHA2 signature when requested and falls back to RSA-SHA1 instead, retry the signature to ensure that the public key algorithm sent in the SSH_MSG_USERAUTH matches the one in the signature itself. In sshd, strictly enforce that the public key algorithm sent in the SSH_MSG_USERAUTH message matches what appears in the signature. Make the sshd_config PubkeyAcceptedKeyTypes and HostbasedAcceptedKeyTypes options control accepted signature algorithms (previously they selected supported key types). This allows these options to ban RSA-SHA1 in favour of RSA-SHA2. Add new signature algorithms "rsa-sha2-256-cert-v01@openssh.com" and "rsa-sha2-512-cert-v01@openssh.com" to force use of RSA-SHA2 signatures with certificate keys. feedback and ok markus@ OpenBSD-Commit-ID: c6e9f6d45eed8962ad502d315d7eaef32c419dde
* upstream: Don't send IUTF8 to servers that don't like them.dtucker@openbsd.org2018-02-161-2/+2
| | | | | | | | Some SSH servers eg "ConfD" drop the connection if the client sends the new IUTF8 (RFC8160) terminal mode even if it's not set. Add a bug bit for such servers and avoid sending IUTF8 to them. ok djm@ OpenBSD-Commit-ID: 26425855402d870c3c0a90491e72e2a8a342ceda
* upstream commitdjm@openbsd.org2018-01-231-14/+14
| | | | | | | | | | | | | Drop compatibility hacks for some ancient SSH implementations, including ssh.com <=2.* and OpenSSH <= 3.*. These versions were all released in or before 2001 and predate the final SSH RFCs. The hacks in question aren't necessary for RFC- compliant SSH implementations. ok markus@ OpenBSD-Commit-ID: 4be81c67db57647f907f4e881fb9341448606138
* upstream commitdjm@openbsd.org2017-05-011-5/+1
| | | | | | | | remove compat20/compat13/compat15 variables ok markus@ Upstream-ID: 43802c035ceb3fef6c50c400e4ecabf12354691c
* upstream commitdtucker@openbsd.org2015-05-271-1/+2
| | | | | | | | Cap DH-GEX group size at 4kbits for Cisco implementations. Some of them will choke when asked for preferred sizes >4k instead of returning the 4k group that they do have. bz#2209, ok djm@ Upstream-ID: 54b863a19713446b7431f9d06ad0532b4fcfef8d
* upstream commitdtucker@openbsd.org2015-04-131-1/+2
| | | | | | | Don't send hostkey advertisments (hostkeys-00@openssh.com) to current versions of Tera Term as they can't handle them. Newer versions should be OK. Patch from Bryan Drewery and IWAMOTO Kouichi, ok djm@
* upstream commitmarkus@openbsd.org2015-01-201-2/+2
| | | | store compat flags in struct ssh; ok djm@
* - djm@cvs.openbsd.org 2014/04/18 23:52:25Damien Miller2014-04-201-1/+3
| | | | | | | | | | | | [compat.c compat.h sshconnect2.c sshd.c version.h] OpenSSH 6.5 and 6.6 have a bug that causes ~0.2% of connections using the curve25519-sha256@libssh.org KEX exchange method to fail when connecting with something that implements the spec properly. Disable this KEX method when speaking to one of the affected versions. reported by Aris Adamantiadis; ok markus@
* - djm@cvs.openbsd.org 2013/12/30 23:52:28Damien Miller2013-12-311-1/+2
| | | | | | | | | [auth2-hostbased.c auth2-pubkey.c compat.c compat.h ssh-rsa.c] [sshconnect.c sshconnect2.c sshd.c] refuse RSA keys from old proprietary clients/servers that use the obsolete RSA+MD5 signature scheme. it will still be possible to connect with these clients/servers but only DSA keys will be accepted, and we'll deprecate them entirely in a future release. ok markus@
* - markus@cvs.openbsd.org 2011/09/23 07:45:05Darren Tucker2011-10-021-1/+2
| | | | | | | | | | | [mux.c readconf.h channels.h compat.h compat.c ssh.c readconf.c channels.c version.h] unbreak remote portforwarding with dynamic allocated listen ports: 1) send the actual listen port in the open message (instead of 0). this allows multiple forwardings with a dynamic listen port 2) update the matching permit-open entry, so we can identify where to connect to report: den at skbkontur.ru and P. Szczygielski feedback and ok djm@
* - markus@cvs.openbsd.org 2008/09/11 14:22:37Damien Miller2008-11-031-1/+2
| | | | | | [compat.c compat.h nchan.c ssh.c] only send eow and no-more-sessions requests to openssh 5 and newer; fixes interop problems with broken ssh v2 implementations; ok djm@
* - djm@cvs.openbsd.org 2006/12/12 03:58:42Damien Miller2007-01-051-1/+2
| | | | | | | | | [channels.c compat.c compat.h] bz #1019: some ssh.com versions apparently can't cope with the remote port forwarding bind_address being a hostname, so send them an address for cases where they are not explicitly specified (wildcard or localhost bind). reported by daveroth AT acm.org; ok dtucker@ deraadt@
* - djm@cvs.openbsd.org 2006/03/25 22:22:43Damien Miller2006-03-261-1/+1
| | | | | | | | | | | | | | [atomicio.h auth-options.h auth.h auth2-gss.c authfd.h authfile.h] [bufaux.h buffer.h canohost.h channels.h cipher.h clientloop.h] [compat.h compress.h crc32.c crc32.h deattack.h dh.h dispatch.h] [dns.c dns.h getput.h groupaccess.h gss-genr.c gss-serv-krb5.c] [gss-serv.c hostfile.h includes.h kex.h key.h log.h mac.h match.h] [misc.h monitor.h monitor_fdpass.h monitor_mm.h monitor_wrap.h msg.h] [myproposal.h packet.h pathnames.h progressmeter.h readconf.h rsa.h] [scard.h servconf.h serverloop.h session.h sftp-common.h sftp.h] [ssh-gss.h ssh.h ssh1.h ssh2.h sshconnect.h sshlogin.h sshpty.h] [ttymodes.h uidswap.h uuencode.h xmalloc.h] standardise spacing in $OpenBSD$ tags; requested by deraadt@
* - djm@cvs.openbsd.org 2005/03/01 10:09:52Damien Miller2005-03-011-1/+2
| | | | | | | | | | [auth-options.c channels.c channels.h clientloop.c compat.c compat.h] [misc.c misc.h readconf.c readconf.h servconf.c ssh.1 ssh.c ssh_config.5] [sshd_config.5] bz#413: allow optional specification of bind address for port forwardings. Patch originally by Dan Astorian, but worked on by several people Adds GatewayPorts=clientspecified option on server to allow remote forwards to bind to client-specified ports.
* - deraadt@cvs.openbsd.org 2004/07/11 17:48:47Darren Tucker2004-07-171-2/+2
| | | | | | | | [channels.c cipher.c clientloop.c clientloop.h compat.h moduli.c readconf.c nchan.c pathnames.h progressmeter.c readconf.h servconf.c session.c sftp-client.c sftp.c ssh-agent.1 ssh-keygen.c ssh.c ssh1.h sshd.c ttymodes.h] spaces
* - markus@cvs.openbsd.org 2003/11/02 11:01:03Darren Tucker2003-11-031-2/+1
| | | | | [auth2-gss.c compat.c compat.h sshconnect2.c] remove support for SSH_BUG_GSSAPI_BER; simon@sxw.org.uk
* - markus@cvs.openbsd.org 2003/08/29 10:03:15Damien Miller2003-09-021-5/+4
| | | | | [compat.c compat.h] SSH_BUG_K5USER is unused; ok henning@
* - markus@cvs.openbsd.org 2003/08/22 10:56:09Darren Tucker2003-08-261-1/+2
| | | | | | | | | [auth2.c auth2-gss.c auth.h compat.c compat.h gss-genr.c gss-serv-krb5.c gss-serv.c monitor.c monitor.h monitor_wrap.c monitor_wrap.h readconf.c readconf.h servconf.c servconf.h session.c session.h ssh-gss.h ssh_config.5 sshconnect2.c sshd_config sshd_config.5] support GSS API user authentication; patches from Simon Wilkinson, stripped down and tested by Jakob and myself.
* - markus@cvs.openbsd.org 2003/04/01 10:31:26Damien Miller2003-04-011-1/+2
| | | | | | [compat.c compat.h kex.c] bugfix causes stalled connections for ssh.com < 3.0; noticed by ho@; tested by ho@ and myself
* - (djm) OpenBSD CVS SyncDamien Miller2002-09-301-1/+2
| | | | | | | - mickey@cvs.openbsd.org 2002/09/27 10:42:09 [compat.c compat.h sshd.c] add a generic match for a prober, such as sie big brother; idea from stevesk@; markus@ ok
* - markus@cvs.openbsd.org 2002/04/10 08:21:47Ben Lindstrom2002-04-101-1/+2
| | | | | | | [auth1.c compat.c compat.h] strip '@' from username only for KerbV and known broken clients, bug #204 Don't mind me.. I just commited a changelog with no patch. <sigh>
* - markus@cvs.openbsd.org 2002/03/25 21:13:51Ben Lindstrom2002-03-261-1/+2
| | | | | | [channels.c channels.h compat.c compat.h nchan.c] don't send stderr data after EOF, accept this from older known (broken) sshd servers only, fixes http://bugzilla.mindrot.org/show_bug.cgi?id=179
* - stevesk@cvs.openbsd.org 2002/03/04 17:27:39Ben Lindstrom2002-03-051-1/+2
| | | | | | | | | | | [auth-krb5.c auth-options.h auth.h authfd.h authfile.h bufaux.h buffer.h channels.h cipher.h compat.h compress.h crc32.h deattack.c getput.h groupaccess.c misc.c mpaux.h packet.h readconf.h rsa.h scard.h servconf.h ssh-agent.c ssh.h ssh2.h sshpty.h sshtty.c ttymodes.h uuencode.c xmalloc.h] $OpenBSD$ and RCSID() cleanup: don't use RCSID() in .h files; add missing RCSID() to .c files and remove dup /*$OpenBSD$*/ from .c files. ok markus@
* - markus@cvs.openbsd.org 2001/09/20 13:50:40Ben Lindstrom2001-09-201-1/+2
| | | | | | [compat.c compat.h ssh.c] bug compat: request a dummy channel for -N (no shell) sessions + cleanup; vinschen@redhat.com
* - markus@cvs.openbsd.org 2001/06/26 17:27:25Ben Lindstrom2001-07-041-5/+6
| | | | | | | | | | | | | [authfd.h authfile.h auth.h auth-options.h bufaux.h buffer.h canohost.h channels.h cipher.h clientloop.h compat.h compress.h crc32.h deattack.h dh.h dispatch.h groupaccess.c groupaccess.h hostfile.h kex.h key.h log.c log.h mac.h misc.c misc.h mpaux.h packet.h radix.h readconf.h readpass.h rsa.h servconf.h serverloop.h session.h sftp-common.c sftp-common.h sftp-glob.h sftp-int.h sshconnect.h ssh-dss.h sshlogin.h sshpty.h ssh-rsa.h sshtty.h tildexpand.h uidswap.h uuencode.h xmalloc.h] remove comments from .h, since they are cut&paste from the .c files and out of sync
* - itojun@cvs.openbsd.org 2001/06/26 06:32:58Ben Lindstrom2001-07-041-4/+4
| | | | | | | | | | | [atomicio.h authfd.h authfile.h auth.h auth-options.h bufaux.h buffer.h canohost.h channels.h cipher.h clientloop.h compat.h compress.h crc32.h deattack.h dh.h dispatch.h groupaccess.h hostfile.h kex.h key.h log.h mac.h match.h misc.h mpaux.h packet.h radix.h readconf.h readpass.h rsa.h] prototype pedant. not very creative... - () -> (void) - no variable names
* - markus@cvs.openbsd.org 2001/06/25 08:25:41Ben Lindstrom2001-07-041-2/+2
| | | | | | | [channels.c channels.h cipher.c clientloop.c compat.c compat.h hostfile.c kex.c kex.h key.c key.h nchan.c packet.c serverloop.c session.c session.h sftp-server.c ssh-add.c ssh-agent.c uuencode.h] update copyright for 2001
* - markus@cvs.openbsd.org 2001/04/30 15:50:46Ben Lindstrom2001-04-301-1/+2
| | | | | [compat.c compat.h kex.c] allow interop with weaker key generation used by ssh-2.0.x, x < 10
* - markus@cvs.openbsd.org 2001/04/29 19:16:52Ben Lindstrom2001-04-291-18/+19
| | | | | [channels.c clientloop.c compat.c compat.h serverloop.c] more ssh.com-2.0.x bug-compat; from per@appgate.com
* - markus@cvs.openbsd.org 2001/04/12 19:15:26Ben Lindstrom2001-04-121-1/+2
| | | | | | | | | | [auth-rhosts.c auth.h auth2.c buffer.c canohost.c canohost.h compat.c compat.h hostfile.c pathnames.h readconf.c readconf.h servconf.c servconf.h ssh.c sshconnect.c sshconnect.h sshconnect1.c sshconnect2.c sshd_config] implement HostbasedAuthentication (= RhostRSAAuthentication for ssh v2) similar to RhostRSAAuthentication unless you enable (the experimental) HostbasedUsesNameFromPacketOnly option. please test. :)
* - markus@cvs.openbsd.org 2001/04/05 11:09:17Ben Lindstrom2001-04-051-1/+2
| | | | | [clientloop.c compat.c compat.h] add SSH_BUG_NOREKEY and detect broken (=all old) openssh versions.
* - provos@cvs.openbsd.org 2001/03/27 17:46:50Ben Lindstrom2001-03-291-1/+2
| | | | | | [compat.c compat.h dh.c dh.h ssh2.h sshconnect2.c sshd.c version.h] make dh group exchange more flexible, allow min and max group size, okay markus@, deraadt@
* - markus@cvs.openbsd.org 2001/03/27 10:57:00Ben Lindstrom2001-03-291-1/+2
| | | | | | [compat.c compat.h ssh-rsa.c] some older systems use NID_md5 instead of NID_sha1 for RSASSA-PKCS1-v1_5 signatures in SSH protocol 2, ok djm@
* - djm@cvs.openbsd.org 2001/03/23 11:04:07Ben Lindstrom2001-03-241-1/+3
| | | | | [compat.c compat.h sshconnect2.c sshd.c] Compat for OpenSSH with broken Rijndael/AES. ok markus@
* - deraadt@cvs.openbsd.org 2001/03/18 23:30:55Damien Miller2001-03-191-1/+2
| | | | | | [compat.c compat.h sshd.c] specifically version match on ssh scanners. do not log scan information to the console
* - deraadt@cvs.openbsd.org 2001/03/10 15:31:00Ben Lindstrom2001-03-101-1/+2
| | | | | | [compat.c compat.h sshconnect.c] all known netscreen ssh versions, and older versions of OSU ssh cannot handle password padding (newer OSU is fixed)
* - markus@cvs.openbsd.org 2001/03/08 21:42:33Ben Lindstrom2001-03-091-1/+2
| | | | | | | [compat.c compat.h readconf.h ssh.c sshconnect1.c sshconnect2.c] implement client side of SSH2_MSG_USERAUTH_PK_OK (test public key -> no need to do enter passphrase or do expensive sign operations if the server does not accept key).
* - OpenBSD CVS Sync:Damien Miller2001-02-191-9/+10
| | | | | | | | | | | | | | | | | | | | | | | | | - reinhard@cvs.openbsd.org 2001/02/17 08:24:40 [sftp.1] typo - deraadt@cvs.openbsd.org 2001/02/17 16:28:58 [ssh.c] cleanup -V output; noted by millert - deraadt@cvs.openbsd.org 2001/02/17 16:48:48 [sshd.8] it's the OpenSSH one - markus@cvs.openbsd.org 2001/02/18 11:33:54 [dispatch.c] typo, SSH2_MSG_KEXINIT, from aspa@kronodoc.fi - markus@cvs.openbsd.org 2001/02/19 02:53:32 [compat.c compat.h serverloop.c] ssh-1.2.{18-22} has broken handling of ignore messages; report from itojun@ - markus@cvs.openbsd.org 2001/02/19 03:35:23 [version.h] OpenSSH_2.5.1 adds bug compat with 1.2.{18-22} - deraadt@cvs.openbsd.org 2001/02/19 03:36:25 [scp.c] np is changed by recursion; vinschen@redhat.com
* - (bal) OpenBSD SyncBen Lindstrom2001-01-091-1/+2
| | | | | | | | | | | | | | | | | | | | | | | - markus@cvs.openbsd.org 2001/01/08 22:29:05 [auth2.c compat.c compat.h servconf.c servconf.h sshd.8 sshd_config version.h] implement option 'Banner /etc/issue.net' for ssh2, move version to 2.3.1 (needed for bugcompat detection, 2.3.0 would fail if Banner is enabled). - markus@cvs.openbsd.org 2001/01/08 22:03:23 [channels.c ssh-keyscan.c] O_NDELAY -> O_NONBLOCK; thanks stevesk@pobox.com - markus@cvs.openbsd.org 2001/01/08 21:55:41 [sshconnect1.c] more cleanups and fixes from stevesk@pobox.com: 1) try_agent_authentication() for loop will overwrite key just allocated with key_new(); don't alloc 2) call ssh_close_authentication_connection() before exit try_agent_authentication() 3) free mem on bad passphrase in try_rsa_authentication() - markus@cvs.openbsd.org 2001/01/08 21:48:17 [kex.c] missing free; thanks stevesk@pobox.com
* 20001207Ben Lindstrom2000-12-071-1/+2
| | | | | | | - (bal) OpenSSH CVS updates: - markus@cvs.openbsd.org 2000/12/06 22:58:14 [compat.c compat.h packet.c] disable debug messages for ssh.com/f-secure 2.0.1x, 2.1.0
View Lorry Controller Status