summaryrefslogtreecommitdiff
Commit message (Collapse)AuthorAgeFilesLines
...
* - djm@cvs.openbsd.org 2014/07/18 02:46:01djm2014-07-182-1/+8
| | | | | | [ssh-agent.c] restore umask around listener socket creation (dropped in streamlocal patch merge)
* - djm@cvs.openbsd.org 2014/07/17 07:22:19djm2014-07-183-8/+73
| | | | | | | [mux.c ssh.c] reflect stdio-forward ("ssh -W host:port ...") failures in exit status. previously we were always returning 0. bz#2255 reported by Brendan Germain; ok dtucker
* - djm@cvs.openbsd.org 2014/07/17 00:12:03djm2014-07-182-3/+8
| | | | | [key.c] silence "incorrect passphrase" error spam; reported and ok dtucker@
* - djm@cvs.openbsd.org 2014/07/17 00:10:18djm2014-07-182-2/+7
| | | | | [mux.c] preserve errno across syscall
* - djm@cvs.openbsd.org 2014/07/17 00:10:56djm2014-07-182-2/+7
| | | | | [sandbox-systrace.c] ifdef SYS_sendsyslog so this will compile without patching on -stable
* - jmc@cvs.openbsd.org 2014/07/16 14:48:57djm2014-07-182-2/+9
| | | | | | | | [ssh.1] add the streamlocal* options to ssh's -o list; millert says they're irrelevant for scp/sftp; ok markus millert
* - millert@cvs.openbsd.org 2014/07/15 15:54:14djm2014-07-1844-449/+1312
| | | | | | | | | | | | | | | | [PROTOCOL auth-options.c auth-passwd.c auth-rh-rsa.c auth-rhosts.c] [auth-rsa.c auth.c auth1.c auth2-hostbased.c auth2-kbdint.c auth2-none.c] [auth2-passwd.c auth2-pubkey.c auth2.c canohost.c channels.c channels.h] [clientloop.c misc.c misc.h monitor.c mux.c packet.c readconf.c] [readconf.h servconf.c servconf.h serverloop.c session.c ssh-agent.c] [ssh.c ssh_config.5 sshconnect.c sshconnect1.c sshconnect2.c sshd.c] [sshd_config.5 sshlogin.c] Add support for Unix domain socket forwarding. A remote TCP port may be forwarded to a local Unix domain socket and vice versa or both ends may be a Unix domain socket. This is a reimplementation of the streamlocal patches by William Ahern from: http://www.25thandclement.com/~william/projects/streamlocal.html OK djm@ markus@
* - tedu@cvs.openbsd.org 2014/07/11 13:54:34djm2014-07-162-8/+12
| | | | | | [myproposal.h] by popular demand, add back hamc-sha1 to server proposal for better compat with many clients still in use. ok deraadt
* - deraadt@cvs.openbsd.org 2014/07/11 08:09:54djm2014-07-162-1/+8
| | | | | | | [sandbox-systrace.c] Permit use of SYS_sendsyslog from inside the sandbox. Clock is ticking, update your kernels and sshd soon.. libc will start using sendsyslog() in about 4 days.
* - (djm) [digest-openssl.c] Preserve array order when disabling digests.djm2014-07-162-4/+15
| | | | Reported by Petr Lautrbach.
* - (djm) [configure.ac] Delay checks for arc4random* until after libcryptodjm2014-07-152-6/+13
| | | | has been located; fixes builds agains libressl-portable
* - OpenBSD CVS Syncdjm2014-07-102-3/+10
| | | | | | | - benno@cvs.openbsd.org 2014/07/09 14:15:56 [ssh-add.c] fix ssh-add crash while loading more than one key ok markus@
* - djm@cvs.openbsd.org 2014/07/07 08:15:26djm2014-07-092-3/+5
| | | | | | [multiplex.sh] remove forced-fatal that I stuck in there to test the new cleanup logic and forgot to remove...
* - djm@cvs.openbsd.org 2014/07/06 07:42:03djm2014-07-093-8/+26
| | | | | | | | [multiplex.sh test-exec.sh] add a hook to the cleanup() function to kill $SSH_PID if it is set use it to kill the mux master started in multiplex.sh (it was being left around on fatal failures)
* - djm@cvs.openbsd.org 2014/07/09 03:02:15djm2014-07-092-6/+15
| | | | | | [key.c] downgrade more error() to debug() to better match what old authfile.c did; suppresses spurious errors with hostbased authentication enabled
* - djm@cvs.openbsd.org 2014/07/09 01:45:10djm2014-07-092-8/+20
| | | | | | [sftp.c] more useful error message when GLOB_NOSPACE occurs; bz#2254, patch from Orion Poplawski
* - djm@cvs.openbsd.org 2014/07/07 08:19:12djm2014-07-092-4/+14
| | | | | | [ssh_config.5] mention that ProxyCommand is executed using shell "exec" to avoid a lingering process; bz#1977
* - djm@cvs.openbsd.org 2014/07/05 23:11:48djm2014-07-052-1/+7
| | | | | [channels.c] fix remote-forward cancel regression; ok markus@
* - djm@cvs.openbsd.org 2014/07/03 23:18:35djm2014-07-052-5/+7
| | | | | [authfile.h] remove leakmalloc droppings
* - djm@cvs.openbsd.org 2014/07/03 22:40:43djm2014-07-036-10/+37
| | | | | | | [servconf.c servconf.h session.c sshd.8 sshd_config.5] Add a sshd_config PermitUserRC option to control whether ~/.ssh/rc is executed, mirroring the no-user-rc authorized_keys option; bz#2160; ok markus@
* - djm@cvs.openbsd.org 2014/07/03 22:33:41djm2014-07-032-3/+20
| | | | | | | [channels.c] allow explicit ::1 and 127.0.0.1 forwarding bind addresses when GatewayPorts=no; allows client to choose address family; bz#2222 ok markus@
* - djm@cvs.openbsd.org 2014/07/03 22:23:46djm2014-07-032-5/+23
| | | | | | [sshconnect.c] when rekeying, skip file/DNS lookup if it is the same as the key sent during initial key exchange. bz#2154 patch from Iain Morgan; ok markus@
* - jsing@cvs.openbsd.org 2014/07/03 12:42:16djm2014-07-032-3/+15
| | | | | | | | [cipher-chachapoly.c] Call chacha_ivsetup() immediately before chacha_encrypt_bytes() - this makes it easier to verify that chacha_encrypt_bytes() is only called once per chacha_ivsetup() call. ok djm@
* - djm@cvs.openbsd.org 2014/07/03 11:16:55djm2014-07-035-8/+26
| | | | | | | [auth.c auth.h auth1.c auth2.c] make the "Too many authentication failures" message include the user, source address, port and protocol in a format similar to the authentication success / failure messages; bz#2199, ok dtucker
* - jmc@cvs.openbsd.org 2014/07/03 07:45:27djm2014-07-032-3/+6
| | | | | [ssh_config.5] escape %C since groff thinks it part of an Rs/Re block;
* - djm@cvs.openbsd.org 2014/07/03 06:39:19djm2014-07-033-12/+55
| | | | | | | | | | | | [ssh.c ssh_config.5] Add a %C escape sequence for LocalCommand and ControlPath that expands to a unique identifer based on a has of the tuple of (local host, remote user, hostname, port). Helps avoid exceeding sockaddr_un's miserly pathname limits for mux control paths. bz#2220, based on patch from mancha1 AT zoho.com; ok markus@
* - djm@cvs.openbsd.org 2014/07/03 05:38:17djm2014-07-032-2/+8
| | | | | | [ssh.1] document that -g will only work in the multiplexed case if applied to the mux master
* - djm@cvs.openbsd.org 2014/07/03 05:32:36djm2014-07-032-2/+12
| | | | | | [ssh_config.5] mention '%%' escape sequence in HostName directives and how it may be used to specify IPv6 link-local addresses
* - djm@cvs.openbsd.org 2014/07/03 04:36:45djm2014-07-032-1/+5
| | | | | [digest.h] forward-declare struct sshbuf so consumers don't need to include sshbuf.h
* - djm@cvs.openbsd.org 2014/07/03 03:47:27djm2014-07-032-26/+49
| | | | | | | [ssh-keygen.c] When hashing or removing hosts using ssh-keygen, don't choke on @revoked markers and don't remove @cert-authority markers; bz#2241, reported by mlindgren AT runelind.net
* - djm@cvs.openbsd.org 2014/07/03 03:34:09djm2014-07-034-7/+12
| | | | | | [gss-serv.c session.c ssh-keygen.c] standardise on NI_MAXHOST for gethostname() string lengths; about 1/2 the cases were using it already. Fixes bz#2239 en passant
* - djm@cvs.openbsd.org 2014/07/03 03:26:43djm2014-07-032-8/+16
| | | | | | | [digest-openssl.c] use EVP_Digest() for one-shot hash instead of creating, updating, finalising and destroying a context. bz#2231, based on patch from Timo Teras
* - djm@cvs.openbsd.org 2014/07/03 03:15:01djm2014-07-032-1/+9
| | | | | | | | [ssh-add.c] make stdout line-buffered; saves partial output getting lost when ssh-add fatal()s part-way through (e.g. when listing keys from an agent that supports key types that ssh-add doesn't); bz#2234, reported by Phil Pennock
* - djm@cvs.openbsd.org 2014/07/03 03:11:03djm2014-07-032-1/+15
| | | | | | | | [ssh-agent.c] Only cleanup agent socket in the main agent process and not in any subprocesses it may have started (e.g. forked askpass). Fixes agent sockets being zapped when askpass processes fatal(); bz#2236 patch from Dmitry V. Levin
* - djm@cvs.openbsd.org 2014/07/03 01:45:38djm2014-07-032-8/+22
| | | | | | [sshkey.c] make Ed25519 keys' title fit properly in the randomart border; bz#2247 based on patch from Christian Hesse
* - (djm) [monitor_fdpass.c] Use sys/poll.h if poll.h doesn't exist;djm2014-07-032-3/+10
| | | | bz#2237
* - (djm) [digest-openssl.c configure.ac] Disable RIPEMD160 if libcryptodjm2014-07-033-2/+16
| | | | doesn't support it.
* - (djm) [regress/Makefile] fix execution of sshkey unit/fuzz testdjm2014-07-022-1/+3
|
* - (djm) [sshkey.c] Conditionalise inclusion of util.hdjm2014-07-022-0/+3
|
* - djm@cvs.openbsd.org 2014/06/24 01:14:17djm2014-07-0289-11/+1898
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | [Makefile.in regress/Makefile regress/unittests/Makefile] [regress/unittests/sshkey/Makefile] [regress/unittests/sshkey/common.c] [regress/unittests/sshkey/common.h] [regress/unittests/sshkey/mktestdata.sh] [regress/unittests/sshkey/test_file.c] [regress/unittests/sshkey/test_fuzz.c] [regress/unittests/sshkey/test_sshkey.c] [regress/unittests/sshkey/tests.c] [regress/unittests/sshkey/testdata/dsa_1] [regress/unittests/sshkey/testdata/dsa_1-cert.fp] [regress/unittests/sshkey/testdata/dsa_1-cert.pub] [regress/unittests/sshkey/testdata/dsa_1.fp] [regress/unittests/sshkey/testdata/dsa_1.fp.bb] [regress/unittests/sshkey/testdata/dsa_1.param.g] [regress/unittests/sshkey/testdata/dsa_1.param.priv] [regress/unittests/sshkey/testdata/dsa_1.param.pub] [regress/unittests/sshkey/testdata/dsa_1.pub] [regress/unittests/sshkey/testdata/dsa_1_pw] [regress/unittests/sshkey/testdata/dsa_2] [regress/unittests/sshkey/testdata/dsa_2.fp] [regress/unittests/sshkey/testdata/dsa_2.fp.bb] [regress/unittests/sshkey/testdata/dsa_2.pub] [regress/unittests/sshkey/testdata/dsa_n] [regress/unittests/sshkey/testdata/dsa_n_pw] [regress/unittests/sshkey/testdata/ecdsa_1] [regress/unittests/sshkey/testdata/ecdsa_1-cert.fp] [regress/unittests/sshkey/testdata/ecdsa_1-cert.pub] [regress/unittests/sshkey/testdata/ecdsa_1.fp] [regress/unittests/sshkey/testdata/ecdsa_1.fp.bb] [regress/unittests/sshkey/testdata/ecdsa_1.param.curve] [regress/unittests/sshkey/testdata/ecdsa_1.param.priv] [regress/unittests/sshkey/testdata/ecdsa_1.param.pub] [regress/unittests/sshkey/testdata/ecdsa_1.pub] [regress/unittests/sshkey/testdata/ecdsa_1_pw] [regress/unittests/sshkey/testdata/ecdsa_2] [regress/unittests/sshkey/testdata/ecdsa_2.fp] [regress/unittests/sshkey/testdata/ecdsa_2.fp.bb] [regress/unittests/sshkey/testdata/ecdsa_2.param.curve] [regress/unittests/sshkey/testdata/ecdsa_2.param.priv] [regress/unittests/sshkey/testdata/ecdsa_2.param.pub] [regress/unittests/sshkey/testdata/ecdsa_2.pub] [regress/unittests/sshkey/testdata/ecdsa_n] [regress/unittests/sshkey/testdata/ecdsa_n_pw] [regress/unittests/sshkey/testdata/ed25519_1] [regress/unittests/sshkey/testdata/ed25519_1-cert.fp] [regress/unittests/sshkey/testdata/ed25519_1-cert.pub] [regress/unittests/sshkey/testdata/ed25519_1.fp] [regress/unittests/sshkey/testdata/ed25519_1.fp.bb] [regress/unittests/sshkey/testdata/ed25519_1.pub] [regress/unittests/sshkey/testdata/ed25519_1_pw] [regress/unittests/sshkey/testdata/ed25519_2] [regress/unittests/sshkey/testdata/ed25519_2.fp] [regress/unittests/sshkey/testdata/ed25519_2.fp.bb] [regress/unittests/sshkey/testdata/ed25519_2.pub] [regress/unittests/sshkey/testdata/pw] [regress/unittests/sshkey/testdata/rsa1_1] [regress/unittests/sshkey/testdata/rsa1_1.fp] [regress/unittests/sshkey/testdata/rsa1_1.fp.bb] [regress/unittests/sshkey/testdata/rsa1_1.param.n] [regress/unittests/sshkey/testdata/rsa1_1.pub] [regress/unittests/sshkey/testdata/rsa1_1_pw] [regress/unittests/sshkey/testdata/rsa1_2] [regress/unittests/sshkey/testdata/rsa1_2.fp] [regress/unittests/sshkey/testdata/rsa1_2.fp.bb] [regress/unittests/sshkey/testdata/rsa1_2.param.n] [regress/unittests/sshkey/testdata/rsa1_2.pub] [regress/unittests/sshkey/testdata/rsa_1] [regress/unittests/sshkey/testdata/rsa_1-cert.fp] [regress/unittests/sshkey/testdata/rsa_1-cert.pub] [regress/unittests/sshkey/testdata/rsa_1.fp] [regress/unittests/sshkey/testdata/rsa_1.fp.bb] [regress/unittests/sshkey/testdata/rsa_1.param.n] [regress/unittests/sshkey/testdata/rsa_1.param.p] [regress/unittests/sshkey/testdata/rsa_1.param.q] [regress/unittests/sshkey/testdata/rsa_1.pub] [regress/unittests/sshkey/testdata/rsa_1_pw] [regress/unittests/sshkey/testdata/rsa_2] [regress/unittests/sshkey/testdata/rsa_2.fp] [regress/unittests/sshkey/testdata/rsa_2.fp.bb] [regress/unittests/sshkey/testdata/rsa_2.param.n] [regress/unittests/sshkey/testdata/rsa_2.param.p] [regress/unittests/sshkey/testdata/rsa_2.param.q] [regress/unittests/sshkey/testdata/rsa_2.pub] [regress/unittests/sshkey/testdata/rsa_n] [regress/unittests/sshkey/testdata/rsa_n_pw] unit and fuzz tests for new key API
* - djm@cvs.openbsd.org 2014/06/24 01:04:43djm2014-07-022-1/+7
| | | | | [regress/krl.sh] regress test for broken consecutive revoked serial number ranges
* - djm@cvs.openbsd.org 2014/05/21 07:04:21djm2014-07-022-4/+7
| | | | | [regress/integrity.sh] when failing because of unexpected output, show the offending output
* - djm@cvs.openbsd.org 2014/04/30 05:32:00djm2014-07-022-1/+8
| | | | | | [regress/Makefile] unit tests for new buffer API; including basic fuzz testing NB. Id sync only.
* - djm@cvs.openbsd.org 2014/06/30 12:54:39djm2014-07-022-1/+13
| | | | | | | | | | | | | | [key.c] suppress spurious error message when loading key with a passphrase; reported by kettenis@ ok markus@ - djm@cvs.openbsd.org 2014/07/02 04:59:06 [cipher-3des1.c] fix ssh protocol 1 on the server that regressed with the sshkey change (sometimes fatal() after auth completed), make file return useful status codes. NB. Id sync only for these two. They were bundled into the sshkey merge above, since it was easier to sync the entire file and then apply portable-specific changed atop it.
* - markus@cvs.openbsd.org 2014/06/27 18:50:39djm2014-07-022-5/+8
| | | | | [ssh-add.c] fix loading of private keys
* - markus@cvs.openbsd.org 2014/06/27 16:41:56djm2014-07-025-32/+83
| | | | | | [channels.c channels.h clientloop.c ssh.c] fix remote fwding with same listen port but different listen address with gerhard@, ok djm@
* - deraadt@cvs.openbsd.org 2014/06/25 14:16:09djm2014-07-022-1/+6
| | | | | | [sshbuf.c] unblock SIGSEGV before raising it ok djm
* - djm@cvs.openbsd.org 2014/06/24 02:21:01djm2014-07-022-3/+11
| | | | | | [scp.c] when copying local->remote fails during read, don't send uninitialised heap to the remote end. Reported by Jann Horn
* - djm@cvs.openbsd.org 2014/06/24 02:19:48djm2014-07-022-5/+15
| | | | | | | | [ssh.c] don't fatal() when hostname canonicalisation fails with a ProxyCommand in use; continue and allow the ProxyCommand to connect anyway (e.g. to a host with a name outside the DNS behind a bastion)
* - djm@cvs.openbsd.org 2014/06/24 01:13:21djm2014-07-0249-4873/+5812
| | | | | | | | | | | | | | | | | | | | | | | [Makefile.in auth-bsdauth.c auth-chall.c auth-options.c auth-rsa.c [auth2-none.c auth2-pubkey.c authfile.c authfile.h cipher-3des1.c [cipher-chachapoly.c cipher-chachapoly.h cipher.c cipher.h [digest-libc.c digest-openssl.c digest.h dns.c entropy.c hmac.h [hostfile.c key.c key.h krl.c monitor.c packet.c rsa.c rsa.h [ssh-add.c ssh-agent.c ssh-dss.c ssh-ecdsa.c ssh-ed25519.c [ssh-keygen.c ssh-pkcs11-client.c ssh-pkcs11-helper.c ssh-pkcs11.c [ssh-rsa.c sshbuf-misc.c sshbuf.h sshconnect.c sshconnect1.c [sshconnect2.c sshd.c sshkey.c sshkey.h [openbsd-compat/openssl-compat.c openbsd-compat/openssl-compat.h] New key API: refactor key-related functions to be more library-like, existing API is offered as a set of wrappers. with and ok markus@ Thanks also to Ben Hawkes, David Tomaschik, Ivan Fratric, Matthew Dempsky and Ron Bowes for a detailed review a few months ago. NB. This commit also removes portable OpenSSH support for OpenSSL <0.9.8e.
View Lorry Controller Status