This repository has been archived by the owner on May 6, 2022. It is now read-only.
-
Notifications
You must be signed in to change notification settings - Fork 5
/
ChangeLog
3655 lines (3418 loc) · 159 KB
/
ChangeLog
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
20130801
- (djm) [channels.c channels.h] bz#2135: On Solaris, isatty() on a non-
blocking connecting socket will clear any stored errno that might
otherwise have been retrievable via getsockopt(). A hack to limit writes
to TTYs on AIX was triggering this. Since only AIX needs the hack, wrap
it in an #ifdef. Diagnosis and patch from Ivo Raisr.
- (djm) [sshlogin.h] Fix prototype merge botch from 2006; bz#2134
20130725
- (djm) OpenBSD CVS Sync
- djm@cvs.openbsd.org 2013/07/20 22:20:42
[krl.c]
fix verification error in (as-yet usused) KRL signature checking path
- djm@cvs.openbsd.org 2013/07/22 05:00:17
[umac.c]
make MAC key, data to be hashed and nonce for final hash const;
checked with -Wcast-qual
- djm@cvs.openbsd.org 2013/07/22 12:20:02
[umac.h]
oops, forgot to commit corresponding header change;
spotted by jsg and jasper
- djm@cvs.openbsd.org 2013/07/25 00:29:10
[ssh.c]
daemonise backgrounded (ControlPersist'ed) multiplexing master to ensure
it is fully detached from its controlling terminal. based on debugging
- djm@cvs.openbsd.org 2013/07/25 00:56:52
[sftp-client.c sftp-client.h sftp.1 sftp.c]
sftp support for resuming partial downloads; patch mostly by Loganaden
Velvindron/AfriNIC with some tweaks by me; feedback and ok dtucker@
"Just be careful" deraadt@
- djm@cvs.openbsd.org 2013/07/25 00:57:37
[version.h]
openssh-6.3 for release
- dtucker@cvs.openbsd.org 2013/05/30 20:12:32
[regress/test-exec.sh]
use ssh and sshd as testdata since it needs to be >256k for the rekey test
- dtucker@cvs.openbsd.org 2013/06/10 21:56:43
[regress/forwarding.sh]
Add test for forward config parsing
- djm@cvs.openbsd.org 2013/06/21 02:26:26
[regress/sftp-cmds.sh regress/test-exec.sh]
unbreak sftp-cmds for renamed test data (s/ls/data/)
- (tim) [sftp-client.c] Use of a gcc extension trips up native compilers on
Solaris and UnixWare. Feedback and OK djm@
- (tim) [regress/forwarding.sh] Fix for building outside source tree.
20130720
- (djm) OpenBSD CVS Sync
- markus@cvs.openbsd.org 2013/07/19 07:37:48
[auth.h kex.h kexdhs.c kexecdhs.c kexgexs.c monitor.c servconf.c]
[servconf.h session.c sshd.c sshd_config.5]
add ssh-agent(1) support to sshd(8); allows encrypted hostkeys,
or hostkeys on smartcards; most of the work by Zev Weiss; bz #1974
ok djm@
- djm@cvs.openbsd.org 2013/07/20 01:43:46
[umac.c]
use a union to ensure correct alignment; ok deraadt
- djm@cvs.openbsd.org 2013/07/20 01:44:37
[ssh-keygen.c ssh.c]
More useful error message on missing current user in /etc/passwd
- djm@cvs.openbsd.org 2013/07/20 01:50:20
[ssh-agent.c]
call cleanup_handler on SIGINT when in debug mode to ensure sockets
are cleaned up on manual exit; bz#2120
- djm@cvs.openbsd.org 2013/07/20 01:55:13
[auth-krb5.c gss-serv-krb5.c gss-serv.c]
fix kerberos/GSSAPI deprecation warnings and linking; "looks okay" millert@
20130718
- (djm) OpenBSD CVS Sync
- dtucker@cvs.openbsd.org 2013/06/10 19:19:44
[readconf.c]
revert 1.203 while we investigate crashes reported by okan@
- guenther@cvs.openbsd.org 2013/06/17 04:48:42
[scp.c]
Handle time_t values as long long's when formatting them and when
parsing them from remote servers.
Improve error checking in parsing of 'T' lines.
ok dtucker@ deraadt@
- markus@cvs.openbsd.org 2013/06/20 19:15:06
[krl.c]
don't leak the rdata blob on errors; ok djm@
- djm@cvs.openbsd.org 2013/06/21 00:34:49
[auth-rsa.c auth.h auth2-hostbased.c auth2-pubkey.c monitor.c]
for hostbased authentication, print the client host and user on
the auth success/failure line; bz#2064, ok dtucker@
- djm@cvs.openbsd.org 2013/06/21 00:37:49
[ssh_config.5]
explicitly mention that IdentitiesOnly can be used with IdentityFile
to control which keys are offered from an agent.
- djm@cvs.openbsd.org 2013/06/21 05:42:32
[dh.c]
sprinkle in some error() to explain moduli(5) parse failures
- djm@cvs.openbsd.org 2013/06/21 05:43:10
[scp.c]
make this -Wsign-compare clean after time_t conversion
- djm@cvs.openbsd.org 2013/06/22 06:31:57
[scp.c]
improved time_t overflow check suggested by guenther@
- jmc@cvs.openbsd.org 2013/06/27 14:05:37
[ssh-keygen.1 ssh.1 ssh_config.5 sshd.8 sshd_config.5]
do not use Sx for sections outwith the man page - ingo informs me that
stuff like html will render with broken links;
issue reported by Eric S. Raymond, via djm
- markus@cvs.openbsd.org 2013/07/02 12:31:43
[dh.c]
remove extra whitespace
- djm@cvs.openbsd.org 2013/07/12 00:19:59
[auth-options.c auth-rsa.c bufaux.c buffer.h channels.c hostfile.c]
[hostfile.h mux.c packet.c packet.h roaming_common.c serverloop.c]
fix pointer-signedness warnings from clang/llvm-3.3; "seems nice" deraadt@
- djm@cvs.openbsd.org 2013/07/12 00:20:00
[sftp.c ssh-keygen.c ssh-pkcs11.c]
fix pointer-signedness warnings from clang/llvm-3.3; "seems nice" deraadt@
- djm@cvs.openbsd.org 2013/07/12 00:43:50
[misc.c]
in ssh_gai_strerror() don't fallback to strerror for EAI_SYSTEM when
errno == 0. Avoids confusing error message in some broken resolver
cases. bz#2122 patch from plautrba AT redhat.com; ok dtucker
- djm@cvs.openbsd.org 2013/07/12 05:42:03
[ssh-keygen.c]
do_print_resource_record() can never be called with a NULL filename, so
don't attempt (and bungle) asking for one if it has not been specified
bz#2127 ok dtucker@
- djm@cvs.openbsd.org 2013/07/12 05:48:55
[ssh.c]
set TCP nodelay for connections started with -N; bz#2124 ok dtucker@
- schwarze@cvs.openbsd.org 2013/07/16 00:07:52
[scp.1 sftp-server.8 ssh-keyscan.1 ssh-keysign.8 ssh-pkcs11-helper.8]
use .Mt for email addresses; from Jan Stary <hans at stare dot cz>; ok jmc@
- djm@cvs.openbsd.org 2013/07/18 01:12:26
[ssh.1]
be more exact wrt perms for ~/.ssh/config; bz#2078
20130702
- (dtucker) [contrib/cygwin/README contrib/cygwin/ssh-host-config
contrib/cygwin/ssh-user-config] Modernizes and improve readability of
the Cygwin README file (which hasn't been updated for ages), drop
unsupported OSes from the ssh-host-config help text, and drop an
unneeded option from ssh-user-config. Patch from vinschen at redhat com.
20130610
- (djm) OpenBSD CVS Sync
- dtucker@cvs.openbsd.org 2013/06/07 15:37:52
[channels.c channels.h clientloop.c]
Add an "ABANDONED" channel state and use for mux sessions that are
disconnected via the ~. escape sequence. Channels in this state will
be able to close if the server responds, but do not count as active channels.
This means that if you ~. all of the mux clients when using ControlPersist
on a broken network, the backgrounded mux master will exit when the
Control Persist time expires rather than hanging around indefinitely.
bz#1917, also reported and tested by tedu@. ok djm@ markus@.
- (dtucker) [Makefile.in configure.ac fixalgorithms] Remove unsupported
algorithms (Ciphers, MACs and HostKeyAlgorithms) from man pages.
- (dtucker) [myproposal.h] Do not advertise AES GSM ciphers if we don't have
the required OpenSSL support. Patch from naddy at freebsd.
- (dtucker) [myproposal.h] Make the conditional algorithm support consistent
and add some comments so it's clear what goes where.
20130605
- (dtucker) [myproposal.h] Enable sha256 kex methods based on the presence of
the necessary functions, not from the openssl version.
- (dtucker) [contrib/ssh-copy-id] bz#2117: Use portable operator in test.
Patch from cjwatson at debian.
- (dtucker) [regress/forwarding.sh] For (as yet unknown) reason, the
forwarding test is extremely slow copying data on some machines so switch
back to copying the much smaller ls binary until we can figure out why
this is.
- (dtucker) [Makefile.in] append $CFLAGS to compiler options when building
modpipe in case there's anything in there we need.
- (dtucker) OpenBSD CVS Sync
- dtucker@cvs.openbsd.org 2013/06/02 21:01:51
[channels.h]
typo in comment
- dtucker@cvs.openbsd.org 2013/06/02 23:36:29
[clientloop.h clientloop.c mux.c]
No need for the mux cleanup callback to be visible so restore it to static
and call it through the detach_user function pointer. ok djm@
- dtucker@cvs.openbsd.org 2013/06/03 00:03:18
[mac.c]
force the MAC output to be 64-bit aligned so umac won't see unaligned
accesses on strict-alignment architectures. bz#2101, patch from
tomas.kuthan at oracle.com, ok djm@
- dtucker@cvs.openbsd.org 2013/06/04 19:12:23
[scp.c]
use MAXPATHLEN for buffer size instead of fixed value. ok markus
- dtucker@cvs.openbsd.org 2013/06/04 20:42:36
[sftp.c]
Make sftp's libedit interface marginally multibyte aware by building up
the quoted string by character instead of by byte. Prevents failures
when linked against a libedit built with wide character support (bz#1990).
"looks ok" djm
- dtucker@cvs.openbsd.org 2013/06/05 02:07:29
[mux.c]
fix leaks in mux error paths, from Zhenbo Xu, found by Melton. bz#1967,
ok djm
- dtucker@cvs.openbsd.org 2013/06/05 02:27:50
[sshd.c]
When running sshd -D, close stderr unless we have explicitly requesting
logging to stderr. From james.hunt at ubuntu.com via bz#1976, djm's patch
so, err, ok dtucker.
- dtucker@cvs.openbsd.org 2013/06/05 12:52:38
[sshconnect2.c]
Fix memory leaks found by Zhenbo Xu and the Melton tool. bz#1967, ok djm
- dtucker@cvs.openbsd.org 2013/06/05 22:00:28
[readconf.c]
plug another memleak. bz#1967, from Zhenbo Xu, detected by Melton, ok djm
- (dtucker) [configure.ac sftp.c openbsd-compat/openbsd-compat.h] Cater for
platforms that don't have multibyte character support (specifically,
mblen).
20130602
- (tim) [Makefile.in] Make Solaris, UnixWare, & OpenServer linkers happy
linking regress/modpipe.
- (dtucker) OpenBSD CVS Sync
- dtucker@cvs.openbsd.org 2013/06/02 13:33:05
[progressmeter.c]
Add misc.h for monotime prototype. (ID sync only).
- dtucker@cvs.openbsd.org 2013/06/02 13:35:58
[ssh-agent.c]
Make parent_alive_interval time_t to avoid signed/unsigned comparison
- (dtucker) [configure.ac] sys/un.h needs sys/socket.h on some platforms
to prevent noise from configure. Patch from Nathan Osman. (bz#2114).
- (dtucker) [configure.ac] bz#2111: don't try to use lastlog on Android.
Patch from Nathan Osman.
- (tim) [configure.ac regress/Makefile] With rev 1.47 of test-exec.sh we
need a shell that can handle "[ file1 -nt file2 ]". Rather than keep
dealing with shell portability issues in regression tests, we let
configure find us a capable shell on those platforms with an old /bin/sh.
- (tim) [aclocal.m4] Enhance OSSH_CHECK_CFLAG_COMPILE to check stderr.
feedback and ok dtucker
- (tim) [regress/sftp-chroot.sh] skip if no sudo. ok dtucker
- (dtucker) [configure.ac] Some platforms need sys/types.h before sys/un.h.
- (dtucker) [configure.ac] Some other platforms need sys/types.h before
sys/socket.h.
20130601
- (dtucker) [configure.ac openbsd-compat/xcrypt.c] bz#2112: fall back to
using openssl's DES_crypt function on platorms that don't have a native
one, eg Android. Based on a patch from Nathan Osman.
- (dtucker) [configure.ac defines.h] Test for fd_mask, howmany and NFDBITS
rather than trying to enumerate the plaforms that don't have them.
Based on a patch from Nathan Osman, with help from tim@.
- (dtucker) OpenBSD CVS Sync
- djm@cvs.openbsd.org 2013/05/17 00:13:13
[xmalloc.h cipher.c sftp-glob.c ssh-keyscan.c ssh.c sftp-common.c
ssh-ecdsa.c auth2-chall.c compat.c readconf.c kexgexs.c monitor.c
gss-genr.c cipher-3des1.c kex.c monitor_wrap.c ssh-pkcs11-client.c
auth-options.c rsa.c auth2-pubkey.c sftp.c hostfile.c auth2.c
servconf.c auth.c authfile.c xmalloc.c uuencode.c sftp-client.c
auth2-gss.c sftp-server.c bufaux.c mac.c session.c jpake.c kexgexc.c
sshconnect.c auth-chall.c auth2-passwd.c sshconnect1.c buffer.c
kexecdhs.c kexdhs.c ssh-rsa.c auth1.c ssh-pkcs11.c auth2-kbdint.c
kexdhc.c sshd.c umac.c ssh-dss.c auth2-jpake.c bufbn.c clientloop.c
monitor_mm.c scp.c roaming_client.c serverloop.c key.c auth-rsa.c
ssh-pkcs11-helper.c ssh-keysign.c ssh-keygen.c match.c channels.c
sshconnect2.c addrmatch.c mux.c canohost.c kexecdhc.c schnorr.c
ssh-add.c misc.c auth2-hostbased.c ssh-agent.c bufec.c groupaccess.c
dns.c packet.c readpass.c authfd.c moduli.c]
bye, bye xfree(); ok markus@
- djm@cvs.openbsd.org 2013/05/19 02:38:28
[auth2-pubkey.c]
fix failure to recognise cert-authority keys if a key of a different type
appeared in authorized_keys before it; ok markus@
- djm@cvs.openbsd.org 2013/05/19 02:42:42
[auth.h auth.c key.c monitor.c auth-rsa.c auth2.c auth1.c key.h]
Standardise logging of supplemental information during userauth. Keys
and ruser is now logged in the auth success/failure message alongside
the local username, remote host/port and protocol in use. Certificates
contents and CA are logged too.
Pushing all logging onto a single line simplifies log analysis as it is
no longer necessary to relate information scattered across multiple log
entries. "I like it" markus@
- dtucker@cvs.openbsd.org 2013/05/31 12:28:10
[ssh-agent.c]
Use time_t where appropriate. ok djm
- dtucker@cvs.openbsd.org 2013/06/01 13:15:52
[ssh-agent.c clientloop.c misc.h packet.c progressmeter.c misc.c
channels.c sandbox-systrace.c]
Use clock_gettime(CLOCK_MONOTONIC ...) for ssh timers so that things like
keepalives and rekeying will work properly over clock steps. Suggested by
markus@, "looks good" djm@.
- dtucker@cvs.openbsd.org 2013/06/01 20:59:25
[scp.c sftp-client.c]
Replace S_IWRITE, which isn't standardized, with S_IWUSR, which is. Patch
from Nathan Osman via bz#2085. ok deraadt.
- dtucker@cvs.openbsd.org 2013/06/01 22:34:50
[sftp-client.c]
Update progressmeter when data is acked, not when it's sent. bz#2108, from
Debian via Colin Watson, ok djm@
- (dtucker) [M auth-chall.c auth-krb5.c auth-pam.c cipher-aes.c cipher-ctr.c
groupaccess.c loginrec.c monitor.c monitor_wrap.c session.c sshd.c
sshlogin.c uidswap.c openbsd-compat/bsd-cygwin_util.c
openbsd-compat/getrrsetbyname-ldns.c openbsd-compat/port-aix.c
openbsd-compat/port-linux.c] Replace portable-specific instances of xfree
with the equivalent calls to free.
- (dtucker) [configure.ac misc.c] Look for clock_gettime in librt and fall
back to time(NULL) if we can't find it anywhere.
- (dtucker) [sandbox-seccomp-filter.c] Allow clock_gettimeofday.
20130529
- (dtucker) [configure.ac openbsd-compat/bsd-misc.h] bz#2087: Add a null
implementation of endgrent for platforms that don't have it (eg Android).
Loosely based on a patch from Nathan Osman, ok djm
20130517
- (dtucker) OpenBSD CVS Sync
- djm@cvs.openbsd.org 2013/03/07 00:20:34
[regress/proxy-connect.sh]
repeat test with a style appended to the username
- dtucker@cvs.openbsd.org 2013/03/23 11:09:43
[regress/test-exec.sh]
Only regenerate host keys if they don't exist or if ssh-keygen has changed
since they were. Reduces test runtime by 5-30% depending on machine
speed.
- dtucker@cvs.openbsd.org 2013/04/06 06:00:22
[regress/rekey.sh regress/test-exec.sh regress/integrity.sh
regress/multiplex.sh Makefile regress/cfgmatch.sh]
Split the regress log into 3 parts: the debug output from ssh, the debug
log from sshd and the output from the client command (ssh, scp or sftp).
Somewhat functional now, will become more useful when ssh/sshd -E is added.
- dtucker@cvs.openbsd.org 2013/04/07 02:16:03
[regress/Makefile regress/rekey.sh regress/integrity.sh
regress/sshd-log-wrapper.sh regress/forwarding.sh regress/test-exec.sh]
use -E option for ssh and sshd to write debuging logs to ssh{,d}.log and
save the output from any failing tests. If a test fails the debug output
from ssh and sshd for the failing tests (and only the failing tests) should
be available in failed-ssh{,d}.log.
- djm@cvs.openbsd.org 2013/04/18 02:46:12
[regress/Makefile regress/sftp-chroot.sh]
test sshd ChrootDirectory+internal-sftp; feedback & ok dtucker@
- dtucker@cvs.openbsd.org 2013/04/22 07:23:08
[regress/multiplex.sh]
Write mux master logs to regress.log instead of ssh.log to keep separate
- djm@cvs.openbsd.org 2013/05/10 03:46:14
[regress/modpipe.c]
sync some portability changes from portable OpenSSH (id sync only)
- dtucker@cvs.openbsd.org 2013/05/16 02:10:35
[regress/rekey.sh]
Add test for time-based rekeying
- dtucker@cvs.openbsd.org 2013/05/16 03:33:30
[regress/rekey.sh]
test rekeying when there's no data being transferred
- dtucker@cvs.openbsd.org 2013/05/16 04:26:10
[regress/rekey.sh]
add server-side rekey test
- dtucker@cvs.openbsd.org 2013/05/16 05:48:31
[regress/rekey.sh]
add tests for RekeyLimit parsing
- dtucker@cvs.openbsd.org 2013/05/17 00:37:40
[regress/agent.sh regress/keytype.sh regress/cfgmatch.sh
regress/forcecommand.sh regress/proto-version.sh regress/test-exec.sh
regress/cipher-speed.sh regress/cert-hostkey.sh regress/cert-userkey.sh
regress/ssh-com.sh]
replace 'echo -n' with 'printf' since it's more portable
also remove "echon" hack.
- dtucker@cvs.openbsd.org 2013/05/17 01:16:09
[regress/agent-timeout.sh]
Pull back some portability changes from -portable:
- TIMEOUT is a read-only variable in some shells
- not all greps have -q so redirect to /dev/null instead.
(ID sync only)
- dtucker@cvs.openbsd.org 2013/05/17 01:32:11
[regress/integrity.sh]
don't print output from ssh before getting it (it's available in ssh.log)
- dtucker@cvs.openbsd.org 2013/05/17 04:29:14
[regress/sftp.sh regress/putty-ciphers.sh regress/cipher-speed.sh
regress/test-exec.sh regress/sftp-batch.sh regress/dynamic-forward.sh
regress/putty-transfer.sh regress/conch-ciphers.sh regress/sftp-cmds.sh
regress/scp.sh regress/ssh-com-sftp.sh regress/rekey.sh
regress/putty-kex.sh regress/stderr-data.sh regress/stderr-after-eof.sh
regress/sftp-badcmds.sh regress/reexec.sh regress/ssh-com-client.sh
regress/sftp-chroot.sh regress/forwarding.sh regress/transfer.sh
regress/multiplex.sh]
Move the setting of DATA and COPY into test-exec.sh
- dtucker@cvs.openbsd.org 2013/05/17 10:16:26
[regress/try-ciphers.sh]
use expr for math to keep diffs vs portable down
(id sync only)
- dtucker@cvs.openbsd.org 2013/05/17 10:23:52
[regress/login-timeout.sh regress/reexec.sh regress/test-exec.sh]
Use SUDO when cat'ing pid files and running the sshd log wrapper so that
it works with a restrictive umask and the pid files are not world readable.
Changes from -portable. (id sync only)
- dtucker@cvs.openbsd.org 2013/05/17 10:24:48
[regress/localcommand.sh]
use backticks for portability. (id sync only)
- dtucker@cvs.openbsd.org 2013/05/17 10:26:26
[regress/sftp-badcmds.sh]
remove unused BATCH variable. (id sync only)
- dtucker@cvs.openbsd.org 2013/05/17 10:28:11
[regress/sftp.sh]
only compare copied data if sftp succeeds. from portable (id sync only)
- dtucker@cvs.openbsd.org 2013/05/17 10:30:07
[regress/test-exec.sh]
wait a bit longer for startup and use case for absolute path.
from portable (id sync only)
- dtucker@cvs.openbsd.org 2013/05/17 10:33:09
[regress/agent-getpeereid.sh]
don't redirect stdout from sudo. from portable (id sync only)
- dtucker@cvs.openbsd.org 2013/05/17 10:34:30
[regress/portnum.sh]
use a more portable negated if structure. from portable (id sync only)
- dtucker@cvs.openbsd.org 2013/05/17 10:35:43
[regress/scp.sh]
use a file extention that's not special on some platforms. from portable
(id sync only)
- (dtucker) [regress/bsd.regress.mk] Remove unused file. We've never used it
in portable and it's long gone in openbsd.
- (dtucker) [regress/integrity.sh]. Force fixed Diffie-Hellman key exchange
methods. When the openssl version doesn't support ECDH then next one on
the list is DH group exchange, but that causes a bit more traffic which can
mean that the tests flip bits in the initial exchange rather than the MACed
traffic and we get different errors to what the tests look for.
- (dtucker) [openbsd-compat/getopt.h] Remove unneeded bits.
- (dtucker) [regress/cfgmatch.sh] Resync config file setup with openbsd.
- (dtucker) [regress/agent-getpeereid.sh] Resync spaces with openbsd.
- (dtucker) [regress/integrity.sh regress/krl.sh regress/test-exec.sh]
Move the jot helper function to portable-specific part of test-exec.sh.
- (dtucker) [regress/test-exec.sh] Move the portable-specific functions
together and add a couple of missing lines from openbsd.
- (dtucker) [regress/stderr-after-eof.sh regress/test-exec.sh] Move the md5
helper function to the portable part of test-exec.sh.
- (dtucker) [regress/runtests.sh] Remove obsolete test driver script.
- (dtucker) [regress/cfgmatch.sh] Remove unneeded sleep renderd obsolete by
rev 1.6 which calls wait.
20130516
- (djm) [contrib/ssh-copy-id] Fix bug that could cause "rm *" to be
executed if mktemp failed; bz#2105 ok dtucker@
- (dtucker) OpenBSD CVS Sync
- tedu@cvs.openbsd.org 2013/04/23 17:49:45
[misc.c]
use xasprintf instead of a series of strlcats and strdup. ok djm
- tedu@cvs.openbsd.org 2013/04/24 16:01:46
[misc.c]
remove extra parens noticed by nicm
- dtucker@cvs.openbsd.org 2013/05/06 07:35:12
[sftp-server.8]
Reference the version of the sftp draft we actually implement. ok djm@
- djm@cvs.openbsd.org 2013/05/10 03:40:07
[sshconnect2.c]
fix bzero(ptr_to_struct, sizeof(ptr_to_struct)); bz#2100 from
Colin Watson
- djm@cvs.openbsd.org 2013/05/10 04:08:01
[key.c]
memleak in cert_free(), wasn't actually freeing the struct;
bz#2096 from shm AT digitalsun.pl
- dtucker@cvs.openbsd.org 2013/05/10 10:13:50
[ssh-pkcs11-helper.c]
remove unused extern optarg. ok markus@
- dtucker@cvs.openbsd.org 2013/05/16 02:00:34
[ssh_config sshconnect2.c packet.c readconf.h readconf.c clientloop.c
ssh_config.5 packet.h]
Add an optional second argument to RekeyLimit in the client to allow
rekeying based on elapsed time in addition to amount of traffic.
with djm@ jmc@, ok djm
- dtucker@cvs.openbsd.org 2013/05/16 04:09:14
[sshd_config.5 servconf.c servconf.h packet.c serverloop.c monitor.c sshd_config
sshd.c] Add RekeyLimit to sshd with the same syntax as the client allowing
rekeying based on traffic volume or time. ok djm@, help & ok jmc@ for the man
page.
- djm@cvs.openbsd.org 2013/05/16 04:27:50
[ssh_config.5 readconf.h readconf.c]
add the ability to ignore specific unrecognised ssh_config options;
bz#866; ok markus@
- jmc@cvs.openbsd.org 2013/05/16 06:28:45
[ssh_config.5]
put IgnoreUnknown in the right place;
- jmc@cvs.openbsd.org 2013/05/16 06:30:06
[sshd_config.5]
oops! avoid Xr to self;
- dtucker@cvs.openbsd.org 2013/05/16 09:08:41
[log.c scp.c sshd.c serverloop.c schnorr.c sftp.c]
Fix some "unused result" warnings found via clang and -portable.
ok markus@
- dtucker@cvs.openbsd.org 2013/05/16 09:12:31
[readconf.c servconf.c]
switch RekeyLimit traffic volume parsing to scan_scaled. ok djm@
- dtucker@cvs.openbsd.org 2013/05/16 10:43:34
[servconf.c readconf.c]
remove now-unused variables
- dtucker@cvs.openbsd.org 2013/05/16 10:44:06
[servconf.c]
remove another now-unused variable
- (dtucker) [configure.ac readconf.c servconf.c
openbsd-compat/openbsd-compat.h] Add compat bits for scan_scaled.
20130510
- (dtucker) [configure.ac] Enable -Wsizeof-pointer-memaccess if the compiler
supports it. Mentioned by Colin Watson in bz#2100, ok djm.
- (dtucker) [openbsd-compat/getopt.c] Factor out portibility changes to
getopt.c. Preprocessed source is identical other than line numbers.
- (dtucker) [openbsd-compat/getopt_long.c] Import from OpenBSD. No
portability changes yet.
- (dtucker) [openbsd-compat/Makefile.in openbsd-compat/getopt.c
openbsd-compat/getopt_long.c regress/modpipe.c] Remove getopt.c, add
portability code to getopt_long.c and switch over Makefile and the ugly
hack in modpipe.c. Fixes bz#1448.
- (dtucker) [openbsd-compat/getopt.h openbsd-compat/getopt_long.c
openbsd-compat/openbsd-compat.h] pull in getopt.h from openbsd and plumb
in to use it when we're using our own getopt.
- (dtucker) [kex.c] Only include sha256 and ECC key exchange methods when the
underlying libraries support them.
- (dtucker) [configure.ac] Add -Werror to the -Qunused-arguments test so
we don't get a warning on compilers that *don't* support it. Add
-Wno-unknown-warning-option. Move both to the start of the list for
maximum noise suppression. Tested with gcc 4.6.3, gcc 2.95.4 and clang 2.9.
20130423
- (djm) [auth.c configure.ac misc.c monitor.c monitor_wrap.c] Support
platforms, such as Android, that lack struct passwd.pw_gecos. Report
and initial patch from Nathan Osman bz#2086; feedback tim@ ok dtucker@
- (djm) OpenBSD CVS Sync
- markus@cvs.openbsd.org 2013/03/05 20:16:09
[sshconnect2.c]
reset pubkey order on partial success; ok djm@
- djm@cvs.openbsd.org 2013/03/06 23:35:23
[session.c]
fatal() when ChrootDirectory specified by running without root privileges;
ok markus@
- djm@cvs.openbsd.org 2013/03/06 23:36:53
[readconf.c]
g/c unused variable (-Wunused)
- djm@cvs.openbsd.org 2013/03/07 00:19:59
[auth2-pubkey.c monitor.c]
reconstruct the original username that was sent by the client, which may
have included a style (e.g. "root:skey") when checking public key
signatures. Fixes public key and hostbased auth when the client specified
a style; ok markus@
- markus@cvs.openbsd.org 2013/03/07 19:27:25
[auth.h auth2-chall.c auth2.c monitor.c sshd_config.5]
add submethod support to AuthenticationMethods; ok and freedback djm@
- djm@cvs.openbsd.org 2013/03/08 06:32:58
[ssh.c]
allow "ssh -f none ..." ok markus@
- djm@cvs.openbsd.org 2013/04/05 00:14:00
[auth2-gss.c krl.c sshconnect2.c]
hush some {unused, printf type} warnings
- djm@cvs.openbsd.org 2013/04/05 00:31:49
[pathnames.h]
use the existing _PATH_SSH_USER_RC define to construct the other
pathnames; bz#2077, ok dtucker@ (no binary change)
- djm@cvs.openbsd.org 2013/04/05 00:58:51
[mux.c]
cleanup mux-created channels that are in SSH_CHANNEL_OPENING state too
(in addition to ones already in OPEN); bz#2079, ok dtucker@
- markus@cvs.openbsd.org 2013/04/06 16:07:00
[channels.c sshd.c]
handle ECONNABORTED for accept(); ok deraadt some time ago...
- dtucker@cvs.openbsd.org 2013/04/07 02:10:33
[log.c log.h ssh.1 ssh.c sshd.8 sshd.c]
Add -E option to ssh and sshd to append debugging logs to a specified file
instead of stderr or syslog. ok markus@, man page help jmc@
- dtucker@cvs.openbsd.org 2013/04/07 09:40:27
[sshd.8]
clarify -e text. suggested by & ok jmc@
- djm@cvs.openbsd.org 2013/04/11 02:27:50
[packet.c]
quiet disconnect notifications on the server from error() back to logit()
if it is a normal client closure; bz#2057 ok+feedback dtucker@
- dtucker@cvs.openbsd.org 2013/04/17 09:04:09
[session.c]
revert rev 1.262; it fails because uid is already set here. ok djm@
- djm@cvs.openbsd.org 2013/04/18 02:16:07
[sftp.c]
make "sftp -q" do what it says on the sticker: hush everything but errors;
ok dtucker@
- djm@cvs.openbsd.org 2013/04/19 01:00:10
[sshd_config.5]
document the requirment that the AuthorizedKeysCommand be owned by root;
ok dtucker@ markus@
- djm@cvs.openbsd.org 2013/04/19 01:01:00
[ssh-keygen.c]
fix some memory leaks; bz#2088 ok dtucker@
- djm@cvs.openbsd.org 2013/04/19 01:03:01
[session.c]
reintroduce 1.262 without the connection-killing bug:
fatal() when ChrootDirectory specified by running without root privileges;
ok markus@
- djm@cvs.openbsd.org 2013/04/19 01:06:50
[authfile.c cipher.c cipher.h kex.c kex.h kexecdh.c kexecdhc.c kexecdhs.c]
[key.c key.h mac.c mac.h packet.c ssh.1 ssh.c]
add the ability to query supported ciphers, MACs, key type and KEX
algorithms to ssh. Includes some refactoring of KEX and key type handling
to be table-driven; ok markus@
- djm@cvs.openbsd.org 2013/04/19 11:10:18
[ssh.c]
add -Q to usage; reminded by jmc@
- djm@cvs.openbsd.org 2013/04/19 12:07:08
[kex.c]
remove duplicated list entry pointed out by naddy@
- dtucker@cvs.openbsd.org 2013/04/22 01:17:18
[mux.c]
typo in debug output: evitval->exitval
20130418
- (djm) [config.guess config.sub] Update to last versions before they switch
to GPL3. ok dtucker@
- (dtucker) [configure.ac] Use -Qunused-arguments to suppress warnings from
unused argument warnings (in particular, -fno-builtin-memset) from clang.
20130404
- (dtucker) OpenBSD CVS Sync
- dtucker@cvs.openbsd.org 2013/02/17 23:16:57
[readconf.c ssh.c readconf.h sshconnect2.c]
Keep track of which IndentityFile options were manually supplied and which
were default options, and don't warn if the latter are missing.
ok markus@
- dtucker@cvs.openbsd.org 2013/02/19 02:12:47
[krl.c]
Remove bogus include. ok djm
- dtucker@cvs.openbsd.org 2013/02/22 04:45:09
[ssh.c readconf.c readconf.h]
Don't complain if IdentityFiles specified in system-wide configs are
missing. ok djm, deraadt.
- markus@cvs.openbsd.org 2013/02/22 19:13:56
[sshconnect.c]
support ProxyCommand=- (stdin/out already point to the proxy); ok djm@
- djm@cvs.openbsd.org 2013/02/22 22:09:01
[ssh.c]
Allow IdenityFile=none; ok markus deraadt (and dtucker for an earlier
version)
20130401
- (dtucker) [openbsd-compat/bsd-cygwin_util.{c,h}] Don't include windows.h
to avoid conflicting definitions of __int64, adding the required bits.
Patch from Corinna Vinschen.
20120323
- (tim) [Makefile.in] remove some duplication introduced in 20130220 commit.
20120322
- (djm) [contrib/ssh-copy-id contrib/ssh-copy-id.1] Updated to Phil
Hands' greatly revised version.
- (djm) Release 6.2p1
- (dtucker) [configure.ac] Add stdlib.h to zlib check for exit() prototype.
- (dtucker) [includes.h] Check if _GNU_SOURCE is already defined before
defining it again. Prevents warnings if someone, eg, sets it in CFLAGS.
20120318
- (djm) [configure.ac log.c scp.c sshconnect2.c openbsd-compat/vis.c]
[openbsd-compat/vis.h] FreeBSD's strnvis isn't compatible with OpenBSD's
so mark it as broken. Patch from des AT des.no
20120317
- (tim) [configure.ac] OpenServer 5 wants lastlog even though it has none
of the bits the configure test looks for.
20120316
- (djm) [configure.ac] Disable utmp, wtmp and/or lastlog if the platform
is unable to successfully compile them. Based on patch from des AT
des.no
- (djm) [configure.ac openbsd-compat/bsd-misc.c openbsd-compat/bsd-misc.h]
Add a usleep replacement for platforms that lack it; ok dtucker
- (djm) [session.c] FreeBSD needs setusercontext(..., LOGIN_SETUMASK) to
occur after UID switch; patch from John Marshall via des AT des.no;
ok dtucker@
20120312
- (dtucker) [regress/Makefile regress/cipher-speed.sh regress/test-exec.sh]
Improve portability of cipher-speed test, based mostly on a patch from
Iain Morgan.
- (dtucker) [auth.c configure.ac platform.c platform.h] Accept uid 2 ("bin")
in addition to root as an owner of system directories on AIX and HP-UX.
ok djm@
20130307
- (dtucker) [INSTALL] Bump documented autoconf version to what we're
currently using.
- (dtucker) [defines.h] Remove SIZEOF_CHAR bits since the test for it
was removed in configure.ac rev 1.481 as it was redundant.
- (tim) [Makefile.in] Add another missing $(EXEEXT) I should have seen 3 days
ago.
- (djm) [configure.ac] Add a timeout to the select/rlimit test to give it a
chance to complete on broken systems; ok dtucker@
20130306
- (dtucker) [regress/forward-control.sh] Wait longer for the forwarding
connection to start so that the test works on slower machines.
- (dtucker) [configure.ac] test that we can set number of file descriptors
to zero with setrlimit before enabling the rlimit sandbox. This affects
(at least) HPUX 11.11.
20130305
- (djm) [regress/modpipe.c] Compilation fix for AIX and parsing fix for
HP/UX. Spotted by Kevin Brott
- (dtucker) [configure.ac] use "=" for shell test and not "==". Spotted by
Amit Kulkarni and Kevin Brott.
- (dtucker) [Makefile.in] Remove trailing "\" on PATHS, which caused obscure
build breakage on (at least) HP-UX 11.11. Found by Amit Kulkarni and Kevin
Brott.
- (tim) [Makefile.in] Add missing $(EXEEXT). Found by Roumen Petrov.
20130227
- (djm) [README contrib/caldera/openssh.spec contrib/redhat/openssh.spec]
[contrib/suse/openssh.spec] Crank version numbers
- (tim) [regress/forward-control.sh] use sh in case login shell is csh.
- (tim) [regress/integrity.sh] shell portability fix.
- (tim) [regress/integrity.sh] keep old solaris awk from hanging.
- (tim) [regress/krl.sh] keep old solaris awk from hanging.
20130226
- OpenBSD CVS Sync
- djm@cvs.openbsd.org 2013/02/20 08:27:50
[integrity.sh]
Add an option to modpipe that warns if the modification offset it not
reached in it's stream and turn it on for t-integrity. This should catch
cases where the session is not fuzzed for being too short (cf. my last
"oops" commit)
- (djm) [regress/integrity.sh] Run sshd via $SUDO; fixes tinderbox breakage
for UsePAM=yes configuration
20130225
- (dtucker) [configure.ac ssh-gss.h] bz#2073: additional #includes needed
to use Solaris native GSS libs. Patch from Pierre Ossman.
20130223
- (djm) [configure.ac includes.h loginrec.c mux.c sftp.c] Prefer
bsd/libutil.h to libutil.h to avoid deprecation warnings on Ubuntu.
ok tim
20130222
- (dtucker) [Makefile.in configure.ac] bz#2072: don't link krb5 libs to
ssh(1) since they're not needed. Patch from Pierre Ossman, ok djm.
- (dtucker) [configure.ac] bz#2073: look for Solaris' differently-named
libgss too. Patch from Pierre Ossman, ok djm.
- (djm) [configure.ac sandbox-seccomp-filter.c] Support for Linux
seccomp-bpf sandbox on ARM. Patch from shawnlandden AT gmail.com;
ok dtucker
20130221
- (tim) [regress/forward-control.sh] shell portability fix.
20130220
- (tim) [regress/cipher-speed.sh regress/try-ciphers.sh] shell portability fix.
- (tim) [krl.c Makefile.in regress/Makefile regress/modpipe.c] remove unneeded
err.h include from krl.c. Additional portability fixes for modpipe. OK djm
- OpenBSD CVS Sync
- djm@cvs.openbsd.org 2013/02/20 08:27:50
[regress/integrity.sh regress/modpipe.c]
Add an option to modpipe that warns if the modification offset it not
reached in it's stream and turn it on for t-integrity. This should catch
cases where the session is not fuzzed for being too short (cf. my last
"oops" commit)
- djm@cvs.openbsd.org 2013/02/20 08:29:27
[regress/modpipe.c]
s/Id/OpenBSD/ in RCS tag
20130219
- OpenBSD CVS Sync
- djm@cvs.openbsd.org 2013/02/18 22:26:47
[integrity.sh]
crank the offset yet again; it was still fuzzing KEX one of Darren's
portable test hosts at 2800
- djm@cvs.openbsd.org 2013/02/19 02:14:09
[integrity.sh]
oops, forgot to increase the output of the ssh command to ensure that
we actually reach $offset
- (djm) [regress/integrity.sh] Skip SHA2-based MACs on configurations that
lack support for SHA2.
- (djm) [regress/modpipe.c] Add local err, and errx functions for platforms
that do not have them.
20130217
- OpenBSD CVS Sync
- djm@cvs.openbsd.org 2013/02/17 23:16:55
[integrity.sh]
make the ssh command generates some output to ensure that there are at
least offset+tries bytes in the stream.
20130216
- OpenBSD CVS Sync
- djm@cvs.openbsd.org 2013/02/16 06:08:45
[integrity.sh]
make sure the fuzz offset is actually past the end of KEX for all KEX
types. diffie-hellman-group-exchange-sha256 requires an offset around
2700. Noticed via test failures in portable OpenSSH on platforms that
lack ECC and this the more byte-frugal ECDH KEX algorithms.
20130215
- (djm) [contrib/suse/rc.sshd] Use SSHD_BIN consistently; bz#2056 from
Iain Morgan
- (dtucker) [configure.ac openbsd-compat/bsd-misc.c openbsd-compat/bsd-misc.h]
Use getpgrp() if we don't have getpgid() (old BSDs, maybe others).
- (dtucker) [configure.ac openbsd-compat/Makefile.in openbsd-compat/strtoull.c
openbsd-compat/openbsd-compat.h] Add strtoull to compat library for
platforms that don't have it.
- (dtucker) [openbsd-compat/openbsd-compat.h] Add prototype for strtoul,
group strto* function prototypes together.
- (dtucker) [openbsd-compat/bsd-misc.c] Handle the case where setpgrp() takes
an argument. Pointed out by djm.
- (djm) OpenBSD CVS Sync
- djm@cvs.openbsd.org 2013/02/14 21:35:59
[auth2-pubkey.c]
Correct error message that had a typo and was logging the wrong thing;
patch from Petr Lautrbach
- dtucker@cvs.openbsd.org 2013/02/15 00:21:01
[sshconnect2.c]
Warn more loudly if an IdentityFile provided by the user cannot be read.
bz #1981, ok djm@
20130214
- (djm) [regress/krl.sh] Don't use ecdsa keys in environment that lack ECC.
- (djm) [regress/krl.sh] typo; found by Iain Morgan
- (djm) [regress/integrity.sh] Start fuzzing from offset 2500 (instead
of 2300) to avoid clobbering the end of (non-MAC'd) KEX. Verified by
Iain Morgan
20130212
- (djm) OpenBSD CVS Sync
- djm@cvs.openbsd.org 2013/01/24 21:45:37
[krl.c]
fix handling of (unused) KRL signatures; skip string in correct buffer
- djm@cvs.openbsd.org 2013/01/24 22:08:56
[krl.c]
skip serial lookup when cert's serial number is zero
- krw@cvs.openbsd.org 2013/01/25 05:00:27
[krl.c]
Revert last. Breaks due to likely typo. Let djm@ fix later.
ok djm@ via dlg@
- djm@cvs.openbsd.org 2013/01/25 10:22:19
[krl.c]
redo last commit without the vi-vomit that snuck in:
skip serial lookup when cert's serial number is zero
(now with 100% better comment)
- djm@cvs.openbsd.org 2013/01/26 06:11:05
[Makefile.in acss.c acss.h cipher-acss.c cipher.c]
[openbsd-compat/openssl-compat.h]
remove ACSS, now that it is gone from libcrypto too
- djm@cvs.openbsd.org 2013/01/27 10:06:12
[krl.c]
actually use the xrealloc() return value; spotted by xi.wang AT gmail.com
- dtucker@cvs.openbsd.org 2013/02/06 00:20:42
[servconf.c sshd_config sshd_config.5]
Change default of MaxStartups to 10:30:100 to start doing random early
drop at 10 connections up to 100 connections. This will make it harder
to DoS as CPUs have come a long way since the original value was set
back in 2000. Prompted by nion at debian org, ok markus@
- dtucker@cvs.openbsd.org 2013/02/06 00:22:21
[auth.c]
Fix comment, from jfree.e1 at gmail
- djm@cvs.openbsd.org 2013/02/08 00:41:12
[sftp.c]
fix NULL deref when built without libedit and control characters
entered as command; debugging and patch from Iain Morgan an
Loganaden Velvindron in bz#1956
- markus@cvs.openbsd.org 2013/02/10 21:19:34
[version.h]
openssh 6.2
- djm@cvs.openbsd.org 2013/02/10 23:32:10
[ssh-keygen.c]
append to moduli file when screening candidates rather than overwriting.
allows resumption of interrupted screen; patch from Christophe Garault
in bz#1957; ok dtucker@
- djm@cvs.openbsd.org 2013/02/10 23:35:24
[packet.c]
record "Received disconnect" messages at ERROR rather than INFO priority,
since they are abnormal and result in a non-zero ssh exit status; patch
from Iain Morgan in bz#2057; ok dtucker@
- dtucker@cvs.openbsd.org 2013/02/11 21:21:58
[sshd.c]
Add openssl version to debug output similar to the client. ok markus@
- djm@cvs.openbsd.org 2013/02/11 23:58:51
[regress/try-ciphers.sh]
remove acss here too
- (djm) [regress/try-ciphers.sh] clean up CVS merge botch
20130211
- (djm) [configure.ac openbsd-compat/openssl-compat.h] Repair build on old
libcrypto that lacks EVP_CIPHER_CTX_ctrl
20130208
- (djm) [contrib/redhat/sshd.init] treat RETVAL as an integer;
patch from Iain Morgan in bz#2059
- (dtucker) [configure.ac openbsd-compat/sys-tree.h] Test if compiler allows
__attribute__ on return values and work around if necessary. ok djm@
20130207
- (djm) [configure.ac] Don't probe seccomp capability of running kernel
at configure time; the seccomp sandbox will fall back to rlimit at
runtime anyway. Patch from plautrba AT redhat.com in bz#2011
20130120
- (djm) [cipher-aes.c cipher-ctr.c openbsd-compat/openssl-compat.h]
Move prototypes for replacement ciphers to openssl-compat.h; fix EVP
prototypes for openssl-1.0.0-fips.
- (djm) OpenBSD CVS Sync
- jmc@cvs.openbsd.org 2013/01/18 07:57:47
[ssh-keygen.1]
tweak previous;
- jmc@cvs.openbsd.org 2013/01/18 07:59:46
[ssh-keygen.c]
-u before -V in usage();
- jmc@cvs.openbsd.org 2013/01/18 08:00:49
[sshd_config.5]
tweak previous;
- jmc@cvs.openbsd.org 2013/01/18 08:39:04
[ssh-keygen.1]
add -Q to the options list; ok djm
- jmc@cvs.openbsd.org 2013/01/18 21:48:43
[ssh-keygen.1]
command-line (adj.) -> command line (n.);
- jmc@cvs.openbsd.org 2013/01/19 07:13:25
[ssh-keygen.1]
fix some formatting; ok djm
- markus@cvs.openbsd.org 2013/01/19 12:34:55
[krl.c]
RB_INSERT does not remove existing elments; ok djm@
- (djm) [openbsd-compat/sys-tree.h] Sync with OpenBSD. krl.c needs newer
version.
- (djm) [regress/krl.sh] replacement for jot; most platforms lack it
20130118
- (djm) OpenBSD CVS Sync
- djm@cvs.openbsd.org 2013/01/17 23:00:01
[auth.c key.c key.h ssh-keygen.1 ssh-keygen.c sshd_config.5]
[krl.c krl.h PROTOCOL.krl]
add support for Key Revocation Lists (KRLs). These are a compact way to
represent lists of revoked keys and certificates, taking as little as
a single bit of incremental cost to revoke a certificate by serial number.
KRLs are loaded via the existing RevokedKeys sshd_config option.
feedback and ok markus@
- djm@cvs.openbsd.org 2013/01/18 00:45:29
[regress/Makefile regress/cert-userkey.sh regress/krl.sh]
Tests for Key Revocation Lists (KRLs)
- djm@cvs.openbsd.org 2013/01/18 03:00:32
[krl.c]
fix KRL generation bug for list sections
20130117
- (djm) [regress/cipher-speed.sh regress/integrity.sh regress/try-ciphers.sh]
check for GCM support before testing GCM ciphers.
20130112
- (djm) OpenBSD CVS Sync
- djm@cvs.openbsd.org 2013/01/12 11:22:04
[cipher.c]
improve error message for integrity failure in AES-GCM modes; ok markus@
- djm@cvs.openbsd.org 2013/01/12 11:23:53
[regress/cipher-speed.sh regress/integrity.sh regress/try-ciphers.sh]
test AES-GCM modes; feedback markus@
- (djm) [regress/integrity.sh] repair botched merge
20130109
- (djm) OpenBSD CVS Sync
- dtucker@cvs.openbsd.org 2012/12/14 05:26:43
[auth.c]
use correct string in error message; from rustybsd at gmx.fr
- djm@cvs.openbsd.org 2013/01/02 00:32:07
[clientloop.c mux.c]
channel_setup_local_fwd_listener() returns 0 on failure, not -ve
bz#2055 reported by mathieu.lacage AT gmail.com
- djm@cvs.openbsd.org 2013/01/02 00:33:49
[PROTOCOL.agent]
correct format description for SSH_AGENTC_ADD_RSA_ID_CONSTRAINED
bz#2051 from david AT lechnology.com
- djm@cvs.openbsd.org 2013/01/03 05:49:36
[servconf.h]
add a couple of ServerOptions members that should be copied to the privsep
child (for consistency, in this case they happen only to be accessed in
the monitor); ok dtucker@
- djm@cvs.openbsd.org 2013/01/03 12:49:01
[PROTOCOL]
fix description of MAC calculation for EtM modes; ok markus@
- djm@cvs.openbsd.org 2013/01/03 12:54:49
[sftp-server.8 sftp-server.c]
allow specification of an alternate start directory for sftp-server(8)
"I like this" markus@
- djm@cvs.openbsd.org 2013/01/03 23:22:58
[ssh-keygen.c]
allow fingerprinting of keys hosted in PKCS#11 tokens: ssh-keygen -lD ...
ok markus@
- jmc@cvs.openbsd.org 2013/01/04 19:26:38
[sftp-server.8 sftp-server.c]
sftp-server.8: add argument name to -d
sftp-server.c: add -d to usage()
ok djm
- markus@cvs.openbsd.org 2013/01/08 18:49:04
[PROTOCOL authfile.c cipher.c cipher.h kex.c kex.h monitor_wrap.c]
[myproposal.h packet.c ssh_config.5 sshd_config.5]
support AES-GCM as defined in RFC 5647 (but with simpler KEX handling)
ok and feedback djm@
- djm@cvs.openbsd.org 2013/01/09 05:40:17
[ssh-keygen.c]
correctly initialise fingerprint type for fingerprinting PKCS#11 keys
- (djm) [cipher.c configure.ac openbsd-compat/openssl-compat.h]
Fix merge botch, automatically detect AES-GCM in OpenSSL, move a little
cipher compat code to openssl-compat.h
20121217
- (dtucker) [Makefile.in] Add some scaffolding so that the new regress
tests will work with VPATH directories.
20121213
- (djm) OpenBSD CVS Sync
- markus@cvs.openbsd.org 2012/12/12 16:45:52
[packet.c]
reset incoming_packet buffer for each new packet in EtM-case, too;
this happens if packets are parsed only parially (e.g. ignore