diff options
-rw-r--r-- | PROTOCOL | 6 | ||||
-rw-r--r-- | channels.h | 6 | ||||
-rw-r--r-- | compat.c | 18 | ||||
-rw-r--r-- | kex.c | 6 | ||||
-rw-r--r-- | match.c | 12 | ||||
-rw-r--r-- | match.h | 6 | ||||
-rw-r--r-- | monitor.c | 4 | ||||
-rw-r--r-- | mux.c | 14 | ||||
-rw-r--r-- | packet.c | 4 | ||||
-rw-r--r-- | readconf.c | 12 | ||||
-rw-r--r-- | servconf.c | 22 | ||||
-rw-r--r-- | servconf.h | 8 | ||||
-rw-r--r-- | session.c | 20 | ||||
-rw-r--r-- | ssh-agent.c | 8 | ||||
-rw-r--r-- | ssh.c | 12 |
15 files changed, 79 insertions, 79 deletions
@@ -140,7 +140,7 @@ window space and may be sent even if no window space is available. | |||
140 | NB. due to certain broken SSH implementations aborting upon receipt | 140 | NB. due to certain broken SSH implementations aborting upon receipt |
141 | of this message (in contravention of RFC4254 section 5.4), this | 141 | of this message (in contravention of RFC4254 section 5.4), this |
142 | message is only sent to OpenSSH peers (identified by banner). | 142 | message is only sent to OpenSSH peers (identified by banner). |
143 | Other SSH implementations may be whitelisted to receive this message | 143 | Other SSH implementations may be listed to receive this message |
144 | upon request. | 144 | upon request. |
145 | 145 | ||
146 | 2.2. connection: disallow additional sessions extension | 146 | 2.2. connection: disallow additional sessions extension |
@@ -169,7 +169,7 @@ Note that this is not a general defence against compromised clients | |||
169 | NB. due to certain broken SSH implementations aborting upon receipt | 169 | NB. due to certain broken SSH implementations aborting upon receipt |
170 | of this message, the no-more-sessions request is only sent to OpenSSH | 170 | of this message, the no-more-sessions request is only sent to OpenSSH |
171 | servers (identified by banner). Other SSH implementations may be | 171 | servers (identified by banner). Other SSH implementations may be |
172 | whitelisted to receive this message upon request. | 172 | listed to receive this message upon request. |
173 | 173 | ||
174 | 2.3. connection: Tunnel forward extension "tun@openssh.com" | 174 | 2.3. connection: Tunnel forward extension "tun@openssh.com" |
175 | 175 | ||
@@ -496,4 +496,4 @@ OpenSSH's connection multiplexing uses messages as described in | |||
496 | PROTOCOL.mux over a Unix domain socket for communications between a | 496 | PROTOCOL.mux over a Unix domain socket for communications between a |
497 | master instance and later clients. | 497 | master instance and later clients. |
498 | 498 | ||
499 | $OpenBSD: PROTOCOL,v 1.37 2020/02/21 00:04:43 dtucker Exp $ | 499 | $OpenBSD: PROTOCOL,v 1.38 2020/07/05 23:59:45 djm Exp $ |
diff --git a/channels.h b/channels.h index c8ae0d904..ee818880e 100644 --- a/channels.h +++ b/channels.h | |||
@@ -1,4 +1,4 @@ | |||
1 | /* $OpenBSD: channels.h,v 1.133 2020/01/25 22:49:38 djm Exp $ */ | 1 | /* $OpenBSD: channels.h,v 1.134 2020/07/05 23:59:45 djm Exp $ */ |
2 | 2 | ||
3 | /* | 3 | /* |
4 | * Author: Tatu Ylonen <ylo@cs.hut.fi> | 4 | * Author: Tatu Ylonen <ylo@cs.hut.fi> |
@@ -52,11 +52,11 @@ | |||
52 | #define SSH_CHANNEL_DYNAMIC 13 | 52 | #define SSH_CHANNEL_DYNAMIC 13 |
53 | #define SSH_CHANNEL_ZOMBIE 14 /* Almost dead. */ | 53 | #define SSH_CHANNEL_ZOMBIE 14 /* Almost dead. */ |
54 | #define SSH_CHANNEL_MUX_LISTENER 15 /* Listener for mux conn. */ | 54 | #define SSH_CHANNEL_MUX_LISTENER 15 /* Listener for mux conn. */ |
55 | #define SSH_CHANNEL_MUX_CLIENT 16 /* Conn. to mux slave */ | 55 | #define SSH_CHANNEL_MUX_CLIENT 16 /* Conn. to mux client */ |
56 | #define SSH_CHANNEL_ABANDONED 17 /* Abandoned session, eg mux */ | 56 | #define SSH_CHANNEL_ABANDONED 17 /* Abandoned session, eg mux */ |
57 | #define SSH_CHANNEL_UNIX_LISTENER 18 /* Listening on a domain socket. */ | 57 | #define SSH_CHANNEL_UNIX_LISTENER 18 /* Listening on a domain socket. */ |
58 | #define SSH_CHANNEL_RUNIX_LISTENER 19 /* Listening to a R-style domain socket. */ | 58 | #define SSH_CHANNEL_RUNIX_LISTENER 19 /* Listening to a R-style domain socket. */ |
59 | #define SSH_CHANNEL_MUX_PROXY 20 /* proxy channel for mux-slave */ | 59 | #define SSH_CHANNEL_MUX_PROXY 20 /* proxy channel for mux-client */ |
60 | #define SSH_CHANNEL_RDYNAMIC_OPEN 21 /* reverse SOCKS, parsing request */ | 60 | #define SSH_CHANNEL_RDYNAMIC_OPEN 21 /* reverse SOCKS, parsing request */ |
61 | #define SSH_CHANNEL_RDYNAMIC_FINISH 22 /* reverse SOCKS, finishing connect */ | 61 | #define SSH_CHANNEL_RDYNAMIC_FINISH 22 /* reverse SOCKS, finishing connect */ |
62 | #define SSH_CHANNEL_MAX_TYPE 23 | 62 | #define SSH_CHANNEL_MAX_TYPE 23 |
@@ -1,4 +1,4 @@ | |||
1 | /* $OpenBSD: compat.c,v 1.114 2020/06/01 07:11:38 dtucker Exp $ */ | 1 | /* $OpenBSD: compat.c,v 1.115 2020/07/05 23:59:45 djm Exp $ */ |
2 | /* | 2 | /* |
3 | * Copyright (c) 1999, 2000, 2001, 2002 Markus Friedl. All rights reserved. | 3 | * Copyright (c) 1999, 2000, 2001, 2002 Markus Friedl. All rights reserved. |
4 | * | 4 | * |
@@ -163,8 +163,8 @@ compat_cipher_proposal(char *cipher_prop) | |||
163 | if (!(datafellows & SSH_BUG_BIGENDIANAES)) | 163 | if (!(datafellows & SSH_BUG_BIGENDIANAES)) |
164 | return cipher_prop; | 164 | return cipher_prop; |
165 | debug2("%s: original cipher proposal: %s", __func__, cipher_prop); | 165 | debug2("%s: original cipher proposal: %s", __func__, cipher_prop); |
166 | if ((cipher_prop = match_filter_blacklist(cipher_prop, "aes*")) == NULL) | 166 | if ((cipher_prop = match_filter_denylist(cipher_prop, "aes*")) == NULL) |
167 | fatal("match_filter_blacklist failed"); | 167 | fatal("match_filter_denylist failed"); |
168 | debug2("%s: compat cipher proposal: %s", __func__, cipher_prop); | 168 | debug2("%s: compat cipher proposal: %s", __func__, cipher_prop); |
169 | if (*cipher_prop == '\0') | 169 | if (*cipher_prop == '\0') |
170 | fatal("No supported ciphers found"); | 170 | fatal("No supported ciphers found"); |
@@ -177,8 +177,8 @@ compat_pkalg_proposal(char *pkalg_prop) | |||
177 | if (!(datafellows & SSH_BUG_RSASIGMD5)) | 177 | if (!(datafellows & SSH_BUG_RSASIGMD5)) |
178 | return pkalg_prop; | 178 | return pkalg_prop; |
179 | debug2("%s: original public key proposal: %s", __func__, pkalg_prop); | 179 | debug2("%s: original public key proposal: %s", __func__, pkalg_prop); |
180 | if ((pkalg_prop = match_filter_blacklist(pkalg_prop, "ssh-rsa")) == NULL) | 180 | if ((pkalg_prop = match_filter_denylist(pkalg_prop, "ssh-rsa")) == NULL) |
181 | fatal("match_filter_blacklist failed"); | 181 | fatal("match_filter_denylist failed"); |
182 | debug2("%s: compat public key proposal: %s", __func__, pkalg_prop); | 182 | debug2("%s: compat public key proposal: %s", __func__, pkalg_prop); |
183 | if (*pkalg_prop == '\0') | 183 | if (*pkalg_prop == '\0') |
184 | fatal("No supported PK algorithms found"); | 184 | fatal("No supported PK algorithms found"); |
@@ -192,14 +192,14 @@ compat_kex_proposal(char *p) | |||
192 | return p; | 192 | return p; |
193 | debug2("%s: original KEX proposal: %s", __func__, p); | 193 | debug2("%s: original KEX proposal: %s", __func__, p); |
194 | if ((datafellows & SSH_BUG_CURVE25519PAD) != 0) | 194 | if ((datafellows & SSH_BUG_CURVE25519PAD) != 0) |
195 | if ((p = match_filter_blacklist(p, | 195 | if ((p = match_filter_denylist(p, |
196 | "curve25519-sha256@libssh.org")) == NULL) | 196 | "curve25519-sha256@libssh.org")) == NULL) |
197 | fatal("match_filter_blacklist failed"); | 197 | fatal("match_filter_denylist failed"); |
198 | if ((datafellows & SSH_OLD_DHGEX) != 0) { | 198 | if ((datafellows & SSH_OLD_DHGEX) != 0) { |
199 | if ((p = match_filter_blacklist(p, | 199 | if ((p = match_filter_denylist(p, |
200 | "diffie-hellman-group-exchange-sha256," | 200 | "diffie-hellman-group-exchange-sha256," |
201 | "diffie-hellman-group-exchange-sha1")) == NULL) | 201 | "diffie-hellman-group-exchange-sha1")) == NULL) |
202 | fatal("match_filter_blacklist failed"); | 202 | fatal("match_filter_denylist failed"); |
203 | } | 203 | } |
204 | debug2("%s: compat KEX proposal: %s", __func__, p); | 204 | debug2("%s: compat KEX proposal: %s", __func__, p); |
205 | if (*p == '\0') | 205 | if (*p == '\0') |
@@ -1,4 +1,4 @@ | |||
1 | /* $OpenBSD: kex.c,v 1.158 2020/03/13 04:01:56 djm Exp $ */ | 1 | /* $OpenBSD: kex.c,v 1.159 2020/07/05 23:59:45 djm Exp $ */ |
2 | /* | 2 | /* |
3 | * Copyright (c) 2000, 2001 Markus Friedl. All rights reserved. | 3 | * Copyright (c) 2000, 2001 Markus Friedl. All rights reserved. |
4 | * | 4 | * |
@@ -247,7 +247,7 @@ kex_assemble_names(char **listp, const char *def, const char *all) | |||
247 | list = tmp; | 247 | list = tmp; |
248 | } else if (*list == '-') { | 248 | } else if (*list == '-') { |
249 | /* Remove names from default list */ | 249 | /* Remove names from default list */ |
250 | if ((*listp = match_filter_blacklist(def, list + 1)) == NULL) { | 250 | if ((*listp = match_filter_denylist(def, list + 1)) == NULL) { |
251 | r = SSH_ERR_ALLOC_FAIL; | 251 | r = SSH_ERR_ALLOC_FAIL; |
252 | goto fail; | 252 | goto fail; |
253 | } | 253 | } |
@@ -284,7 +284,7 @@ kex_assemble_names(char **listp, const char *def, const char *all) | |||
284 | goto fail; | 284 | goto fail; |
285 | } | 285 | } |
286 | free(matching); | 286 | free(matching); |
287 | if ((matching = match_filter_whitelist(all, cp)) == NULL) { | 287 | if ((matching = match_filter_allowlist(all, cp)) == NULL) { |
288 | r = SSH_ERR_ALLOC_FAIL; | 288 | r = SSH_ERR_ALLOC_FAIL; |
289 | goto fail; | 289 | goto fail; |
290 | } | 290 | } |
@@ -1,4 +1,4 @@ | |||
1 | /* $OpenBSD: match.c,v 1.41 2019/11/13 04:47:52 deraadt Exp $ */ | 1 | /* $OpenBSD: match.c,v 1.42 2020/07/05 23:59:45 djm Exp $ */ |
2 | /* | 2 | /* |
3 | * Author: Tatu Ylonen <ylo@cs.hut.fi> | 3 | * Author: Tatu Ylonen <ylo@cs.hut.fi> |
4 | * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland | 4 | * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland |
@@ -309,13 +309,13 @@ match_list(const char *client, const char *server, u_int *next) | |||
309 | 309 | ||
310 | /* | 310 | /* |
311 | * Filter proposal using pattern-list filter. | 311 | * Filter proposal using pattern-list filter. |
312 | * "blacklist" determines sense of filter: | 312 | * "denylist" determines sense of filter: |
313 | * non-zero indicates that items matching filter should be excluded. | 313 | * non-zero indicates that items matching filter should be excluded. |
314 | * zero indicates that only items matching filter should be included. | 314 | * zero indicates that only items matching filter should be included. |
315 | * returns NULL on allocation error, otherwise caller must free result. | 315 | * returns NULL on allocation error, otherwise caller must free result. |
316 | */ | 316 | */ |
317 | static char * | 317 | static char * |
318 | filter_list(const char *proposal, const char *filter, int blacklist) | 318 | filter_list(const char *proposal, const char *filter, int denylist) |
319 | { | 319 | { |
320 | size_t len = strlen(proposal) + 1; | 320 | size_t len = strlen(proposal) + 1; |
321 | char *fix_prop = malloc(len); | 321 | char *fix_prop = malloc(len); |
@@ -333,7 +333,7 @@ filter_list(const char *proposal, const char *filter, int blacklist) | |||
333 | *fix_prop = '\0'; | 333 | *fix_prop = '\0'; |
334 | while ((cp = strsep(&tmp, ",")) != NULL) { | 334 | while ((cp = strsep(&tmp, ",")) != NULL) { |
335 | r = match_pattern_list(cp, filter, 0); | 335 | r = match_pattern_list(cp, filter, 0); |
336 | if ((blacklist && r != 1) || (!blacklist && r == 1)) { | 336 | if ((denylist && r != 1) || (!denylist && r == 1)) { |
337 | if (*fix_prop != '\0') | 337 | if (*fix_prop != '\0') |
338 | strlcat(fix_prop, ",", len); | 338 | strlcat(fix_prop, ",", len); |
339 | strlcat(fix_prop, cp, len); | 339 | strlcat(fix_prop, cp, len); |
@@ -348,7 +348,7 @@ filter_list(const char *proposal, const char *filter, int blacklist) | |||
348 | * the 'filter' pattern list. Caller must free returned string. | 348 | * the 'filter' pattern list. Caller must free returned string. |
349 | */ | 349 | */ |
350 | char * | 350 | char * |
351 | match_filter_blacklist(const char *proposal, const char *filter) | 351 | match_filter_denylist(const char *proposal, const char *filter) |
352 | { | 352 | { |
353 | return filter_list(proposal, filter, 1); | 353 | return filter_list(proposal, filter, 1); |
354 | } | 354 | } |
@@ -358,7 +358,7 @@ match_filter_blacklist(const char *proposal, const char *filter) | |||
358 | * the 'filter' pattern list. Caller must free returned string. | 358 | * the 'filter' pattern list. Caller must free returned string. |
359 | */ | 359 | */ |
360 | char * | 360 | char * |
361 | match_filter_whitelist(const char *proposal, const char *filter) | 361 | match_filter_allowlist(const char *proposal, const char *filter) |
362 | { | 362 | { |
363 | return filter_list(proposal, filter, 0); | 363 | return filter_list(proposal, filter, 0); |
364 | } | 364 | } |
@@ -1,4 +1,4 @@ | |||
1 | /* $OpenBSD: match.h,v 1.19 2019/03/06 22:14:23 dtucker Exp $ */ | 1 | /* $OpenBSD: match.h,v 1.20 2020/07/05 23:59:45 djm Exp $ */ |
2 | 2 | ||
3 | /* | 3 | /* |
4 | * Author: Tatu Ylonen <ylo@cs.hut.fi> | 4 | * Author: Tatu Ylonen <ylo@cs.hut.fi> |
@@ -21,8 +21,8 @@ int match_hostname(const char *, const char *); | |||
21 | int match_host_and_ip(const char *, const char *, const char *); | 21 | int match_host_and_ip(const char *, const char *, const char *); |
22 | int match_user(const char *, const char *, const char *, const char *); | 22 | int match_user(const char *, const char *, const char *, const char *); |
23 | char *match_list(const char *, const char *, u_int *); | 23 | char *match_list(const char *, const char *, u_int *); |
24 | char *match_filter_blacklist(const char *, const char *); | 24 | char *match_filter_denylist(const char *, const char *); |
25 | char *match_filter_whitelist(const char *, const char *); | 25 | char *match_filter_allowlist(const char *, const char *); |
26 | 26 | ||
27 | /* addrmatch.c */ | 27 | /* addrmatch.c */ |
28 | int addr_match_list(const char *, const char *); | 28 | int addr_match_list(const char *, const char *); |
@@ -1,4 +1,4 @@ | |||
1 | /* $OpenBSD: monitor.c,v 1.210 2020/03/13 03:17:07 djm Exp $ */ | 1 | /* $OpenBSD: monitor.c,v 1.211 2020/07/05 23:59:45 djm Exp $ */ |
2 | /* | 2 | /* |
3 | * Copyright 2002 Niels Provos <provos@citi.umich.edu> | 3 | * Copyright 2002 Niels Provos <provos@citi.umich.edu> |
4 | * Copyright 2002 Markus Friedl <markus@openbsd.org> | 4 | * Copyright 2002 Markus Friedl <markus@openbsd.org> |
@@ -1568,7 +1568,7 @@ mm_answer_pty(struct ssh *ssh, int sock, struct sshbuf *m) | |||
1568 | if (fd0 != 0) | 1568 | if (fd0 != 0) |
1569 | error("%s: fd0 %d != 0", __func__, fd0); | 1569 | error("%s: fd0 %d != 0", __func__, fd0); |
1570 | 1570 | ||
1571 | /* slave is not needed */ | 1571 | /* only need pty master side */ |
1572 | close(s->ttyfd); | 1572 | close(s->ttyfd); |
1573 | s->ttyfd = s->ptyfd; | 1573 | s->ttyfd = s->ptyfd; |
1574 | /* no need to dup() because nobody closes ptyfd */ | 1574 | /* no need to dup() because nobody closes ptyfd */ |
@@ -1,4 +1,4 @@ | |||
1 | /* $OpenBSD: mux.c,v 1.82 2020/04/30 17:12:20 markus Exp $ */ | 1 | /* $OpenBSD: mux.c,v 1.83 2020/07/05 23:59:45 djm Exp $ */ |
2 | /* | 2 | /* |
3 | * Copyright (c) 2002-2008 Damien Miller <djm@openbsd.org> | 3 | * Copyright (c) 2002-2008 Damien Miller <djm@openbsd.org> |
4 | * | 4 | * |
@@ -187,7 +187,7 @@ static const struct { | |||
187 | { 0, NULL } | 187 | { 0, NULL } |
188 | }; | 188 | }; |
189 | 189 | ||
190 | /* Cleanup callback fired on closure of mux slave _session_ channel */ | 190 | /* Cleanup callback fired on closure of mux client _session_ channel */ |
191 | /* ARGSUSED */ | 191 | /* ARGSUSED */ |
192 | static void | 192 | static void |
193 | mux_master_session_cleanup_cb(struct ssh *ssh, int cid, void *unused) | 193 | mux_master_session_cleanup_cb(struct ssh *ssh, int cid, void *unused) |
@@ -209,7 +209,7 @@ mux_master_session_cleanup_cb(struct ssh *ssh, int cid, void *unused) | |||
209 | channel_cancel_cleanup(ssh, c->self); | 209 | channel_cancel_cleanup(ssh, c->self); |
210 | } | 210 | } |
211 | 211 | ||
212 | /* Cleanup callback fired on closure of mux slave _control_ channel */ | 212 | /* Cleanup callback fired on closure of mux client _control_ channel */ |
213 | /* ARGSUSED */ | 213 | /* ARGSUSED */ |
214 | static void | 214 | static void |
215 | mux_master_control_cleanup_cb(struct ssh *ssh, int cid, void *unused) | 215 | mux_master_control_cleanup_cb(struct ssh *ssh, int cid, void *unused) |
@@ -287,7 +287,7 @@ mux_master_process_hello(struct ssh *ssh, u_int rid, | |||
287 | "(expected %u)", __func__, ver, SSHMUX_VER); | 287 | "(expected %u)", __func__, ver, SSHMUX_VER); |
288 | return -1; | 288 | return -1; |
289 | } | 289 | } |
290 | debug2("%s: channel %d slave version %u", __func__, c->self, ver); | 290 | debug2("%s: channel %d client version %u", __func__, c->self, ver); |
291 | 291 | ||
292 | /* No extensions are presently defined */ | 292 | /* No extensions are presently defined */ |
293 | while (sshbuf_len(m) > 0) { | 293 | while (sshbuf_len(m) > 0) { |
@@ -401,7 +401,7 @@ mux_master_process_new_session(struct ssh *ssh, u_int rid, | |||
401 | /* Gather fds from client */ | 401 | /* Gather fds from client */ |
402 | for(i = 0; i < 3; i++) { | 402 | for(i = 0; i < 3; i++) { |
403 | if ((new_fd[i] = mm_receive_fd(c->sock)) == -1) { | 403 | if ((new_fd[i] = mm_receive_fd(c->sock)) == -1) { |
404 | error("%s: failed to receive fd %d from slave", | 404 | error("%s: failed to receive fd %d from client", |
405 | __func__, i); | 405 | __func__, i); |
406 | for (j = 0; j < i; j++) | 406 | for (j = 0; j < i; j++) |
407 | close(new_fd[j]); | 407 | close(new_fd[j]); |
@@ -994,7 +994,7 @@ mux_master_process_stdio_fwd(struct ssh *ssh, u_int rid, | |||
994 | /* Gather fds from client */ | 994 | /* Gather fds from client */ |
995 | for(i = 0; i < 2; i++) { | 995 | for(i = 0; i < 2; i++) { |
996 | if ((new_fd[i] = mm_receive_fd(c->sock)) == -1) { | 996 | if ((new_fd[i] = mm_receive_fd(c->sock)) == -1) { |
997 | error("%s: failed to receive fd %d from slave", | 997 | error("%s: failed to receive fd %d from client", |
998 | __func__, i); | 998 | __func__, i); |
999 | for (j = 0; j < i; j++) | 999 | for (j = 0; j < i; j++) |
1000 | close(new_fd[j]); | 1000 | close(new_fd[j]); |
@@ -1154,7 +1154,7 @@ mux_master_process_proxy(struct ssh *ssh, u_int rid, | |||
1154 | return 0; | 1154 | return 0; |
1155 | } | 1155 | } |
1156 | 1156 | ||
1157 | /* Channel callbacks fired on read/write from mux slave fd */ | 1157 | /* Channel callbacks fired on read/write from mux client fd */ |
1158 | static int | 1158 | static int |
1159 | mux_master_read_cb(struct ssh *ssh, Channel *c) | 1159 | mux_master_read_cb(struct ssh *ssh, Channel *c) |
1160 | { | 1160 | { |
@@ -1,4 +1,4 @@ | |||
1 | /* $OpenBSD: packet.c,v 1.295 2020/07/01 16:28:31 markus Exp $ */ | 1 | /* $OpenBSD: packet.c,v 1.296 2020/07/05 23:59:45 djm Exp $ */ |
2 | /* | 2 | /* |
3 | * Author: Tatu Ylonen <ylo@cs.hut.fi> | 3 | * Author: Tatu Ylonen <ylo@cs.hut.fi> |
4 | * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland | 4 | * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland |
@@ -2450,7 +2450,7 @@ ssh_packet_set_state(struct ssh *ssh, struct sshbuf *m) | |||
2450 | (r = sshbuf_get_u64(m, &state->p_read.bytes)) != 0) | 2450 | (r = sshbuf_get_u64(m, &state->p_read.bytes)) != 0) |
2451 | return r; | 2451 | return r; |
2452 | /* | 2452 | /* |
2453 | * We set the time here so that in post-auth privsep slave we | 2453 | * We set the time here so that in post-auth privsep child we |
2454 | * count from the completion of the authentication. | 2454 | * count from the completion of the authentication. |
2455 | */ | 2455 | */ |
2456 | state->rekey_time = monotime(); | 2456 | state->rekey_time = monotime(); |
diff --git a/readconf.c b/readconf.c index c0595a52b..9e597748c 100644 --- a/readconf.c +++ b/readconf.c | |||
@@ -1,4 +1,4 @@ | |||
1 | /* $OpenBSD: readconf.c,v 1.331 2020/05/29 04:25:40 dtucker Exp $ */ | 1 | /* $OpenBSD: readconf.c,v 1.332 2020/07/05 23:59:45 djm Exp $ */ |
2 | /* | 2 | /* |
3 | * Author: Tatu Ylonen <ylo@cs.hut.fi> | 3 | * Author: Tatu Ylonen <ylo@cs.hut.fi> |
4 | * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland | 4 | * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland |
@@ -2221,11 +2221,11 @@ fill_default_options(Options * options) | |||
2221 | all_key = sshkey_alg_list(0, 0, 1, ','); | 2221 | all_key = sshkey_alg_list(0, 0, 1, ','); |
2222 | all_sig = sshkey_alg_list(0, 1, 1, ','); | 2222 | all_sig = sshkey_alg_list(0, 1, 1, ','); |
2223 | /* remove unsupported algos from default lists */ | 2223 | /* remove unsupported algos from default lists */ |
2224 | def_cipher = match_filter_whitelist(KEX_CLIENT_ENCRYPT, all_cipher); | 2224 | def_cipher = match_filter_allowlist(KEX_CLIENT_ENCRYPT, all_cipher); |
2225 | def_mac = match_filter_whitelist(KEX_CLIENT_MAC, all_mac); | 2225 | def_mac = match_filter_allowlist(KEX_CLIENT_MAC, all_mac); |
2226 | def_kex = match_filter_whitelist(KEX_CLIENT_KEX, all_kex); | 2226 | def_kex = match_filter_allowlist(KEX_CLIENT_KEX, all_kex); |
2227 | def_key = match_filter_whitelist(KEX_DEFAULT_PK_ALG, all_key); | 2227 | def_key = match_filter_allowlist(KEX_DEFAULT_PK_ALG, all_key); |
2228 | def_sig = match_filter_whitelist(SSH_ALLOWED_CA_SIGALGS, all_sig); | 2228 | def_sig = match_filter_allowlist(SSH_ALLOWED_CA_SIGALGS, all_sig); |
2229 | #define ASSEMBLE(what, defaults, all) \ | 2229 | #define ASSEMBLE(what, defaults, all) \ |
2230 | do { \ | 2230 | do { \ |
2231 | if ((r = kex_assemble_names(&options->what, \ | 2231 | if ((r = kex_assemble_names(&options->what, \ |
diff --git a/servconf.c b/servconf.c index 22cb9583f..67581ccf2 100644 --- a/servconf.c +++ b/servconf.c | |||
@@ -1,5 +1,5 @@ | |||
1 | 1 | ||
2 | /* $OpenBSD: servconf.c,v 1.366 2020/06/24 15:09:53 markus Exp $ */ | 2 | /* $OpenBSD: servconf.c,v 1.367 2020/07/05 23:59:45 djm Exp $ */ |
3 | /* | 3 | /* |
4 | * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland | 4 | * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland |
5 | * All rights reserved | 5 | * All rights reserved |
@@ -141,7 +141,7 @@ initialize_server_options(ServerOptions *options) | |||
141 | options->challenge_response_authentication = -1; | 141 | options->challenge_response_authentication = -1; |
142 | options->permit_empty_passwd = -1; | 142 | options->permit_empty_passwd = -1; |
143 | options->permit_user_env = -1; | 143 | options->permit_user_env = -1; |
144 | options->permit_user_env_whitelist = NULL; | 144 | options->permit_user_env_allowlist = NULL; |
145 | options->compression = -1; | 145 | options->compression = -1; |
146 | options->rekey_limit = -1; | 146 | options->rekey_limit = -1; |
147 | options->rekey_interval = -1; | 147 | options->rekey_interval = -1; |
@@ -213,11 +213,11 @@ assemble_algorithms(ServerOptions *o) | |||
213 | all_key = sshkey_alg_list(0, 0, 1, ','); | 213 | all_key = sshkey_alg_list(0, 0, 1, ','); |
214 | all_sig = sshkey_alg_list(0, 1, 1, ','); | 214 | all_sig = sshkey_alg_list(0, 1, 1, ','); |
215 | /* remove unsupported algos from default lists */ | 215 | /* remove unsupported algos from default lists */ |
216 | def_cipher = match_filter_whitelist(KEX_SERVER_ENCRYPT, all_cipher); | 216 | def_cipher = match_filter_allowlist(KEX_SERVER_ENCRYPT, all_cipher); |
217 | def_mac = match_filter_whitelist(KEX_SERVER_MAC, all_mac); | 217 | def_mac = match_filter_allowlist(KEX_SERVER_MAC, all_mac); |
218 | def_kex = match_filter_whitelist(KEX_SERVER_KEX, all_kex); | 218 | def_kex = match_filter_allowlist(KEX_SERVER_KEX, all_kex); |
219 | def_key = match_filter_whitelist(KEX_DEFAULT_PK_ALG, all_key); | 219 | def_key = match_filter_allowlist(KEX_DEFAULT_PK_ALG, all_key); |
220 | def_sig = match_filter_whitelist(SSH_ALLOWED_CA_SIGALGS, all_sig); | 220 | def_sig = match_filter_allowlist(SSH_ALLOWED_CA_SIGALGS, all_sig); |
221 | #define ASSEMBLE(what, defaults, all) \ | 221 | #define ASSEMBLE(what, defaults, all) \ |
222 | do { \ | 222 | do { \ |
223 | if ((r = kex_assemble_names(&o->what, defaults, all)) != 0) \ | 223 | if ((r = kex_assemble_names(&o->what, defaults, all)) != 0) \ |
@@ -390,7 +390,7 @@ fill_default_server_options(ServerOptions *options) | |||
390 | options->permit_empty_passwd = 0; | 390 | options->permit_empty_passwd = 0; |
391 | if (options->permit_user_env == -1) { | 391 | if (options->permit_user_env == -1) { |
392 | options->permit_user_env = 0; | 392 | options->permit_user_env = 0; |
393 | options->permit_user_env_whitelist = NULL; | 393 | options->permit_user_env_allowlist = NULL; |
394 | } | 394 | } |
395 | if (options->compression == -1) | 395 | if (options->compression == -1) |
396 | #ifdef WITH_ZLIB | 396 | #ifdef WITH_ZLIB |
@@ -1630,7 +1630,7 @@ process_server_config_line_depth(ServerOptions *options, char *line, | |||
1630 | 1630 | ||
1631 | case sPermitUserEnvironment: | 1631 | case sPermitUserEnvironment: |
1632 | intptr = &options->permit_user_env; | 1632 | intptr = &options->permit_user_env; |
1633 | charptr = &options->permit_user_env_whitelist; | 1633 | charptr = &options->permit_user_env_allowlist; |
1634 | arg = strdelim(&cp); | 1634 | arg = strdelim(&cp); |
1635 | if (!arg || *arg == '\0') | 1635 | if (!arg || *arg == '\0') |
1636 | fatal("%s line %d: missing argument.", | 1636 | fatal("%s line %d: missing argument.", |
@@ -2925,11 +2925,11 @@ dump_config(ServerOptions *o) | |||
2925 | } | 2925 | } |
2926 | printf("\n"); | 2926 | printf("\n"); |
2927 | 2927 | ||
2928 | if (o->permit_user_env_whitelist == NULL) { | 2928 | if (o->permit_user_env_allowlist == NULL) { |
2929 | dump_cfg_fmtint(sPermitUserEnvironment, o->permit_user_env); | 2929 | dump_cfg_fmtint(sPermitUserEnvironment, o->permit_user_env); |
2930 | } else { | 2930 | } else { |
2931 | printf("permituserenvironment %s\n", | 2931 | printf("permituserenvironment %s\n", |
2932 | o->permit_user_env_whitelist); | 2932 | o->permit_user_env_allowlist); |
2933 | } | 2933 | } |
2934 | 2934 | ||
2935 | printf("pubkeyauthoptions"); | 2935 | printf("pubkeyauthoptions"); |
diff --git a/servconf.h b/servconf.h index a420f398d..8422f3f51 100644 --- a/servconf.h +++ b/servconf.h | |||
@@ -1,4 +1,4 @@ | |||
1 | /* $OpenBSD: servconf.h,v 1.144 2020/04/17 03:30:05 djm Exp $ */ | 1 | /* $OpenBSD: servconf.h,v 1.145 2020/07/05 23:59:45 djm Exp $ */ |
2 | 2 | ||
3 | /* | 3 | /* |
4 | * Author: Tatu Ylonen <ylo@cs.hut.fi> | 4 | * Author: Tatu Ylonen <ylo@cs.hut.fi> |
@@ -146,7 +146,7 @@ typedef struct { | |||
146 | int permit_empty_passwd; /* If false, do not permit empty | 146 | int permit_empty_passwd; /* If false, do not permit empty |
147 | * passwords. */ | 147 | * passwords. */ |
148 | int permit_user_env; /* If true, read ~/.ssh/environment */ | 148 | int permit_user_env; /* If true, read ~/.ssh/environment */ |
149 | char *permit_user_env_whitelist; /* pattern-list whitelist */ | 149 | char *permit_user_env_allowlist; /* pattern-list of allowed env names */ |
150 | int compression; /* If true, compression is allowed */ | 150 | int compression; /* If true, compression is allowed */ |
151 | int allow_tcp_forwarding; /* One of FORWARD_* */ | 151 | int allow_tcp_forwarding; /* One of FORWARD_* */ |
152 | int allow_streamlocal_forwarding; /* One of FORWARD_* */ | 152 | int allow_streamlocal_forwarding; /* One of FORWARD_* */ |
@@ -250,7 +250,7 @@ TAILQ_HEAD(include_list, include_item); | |||
250 | /* | 250 | /* |
251 | * These are string config options that must be copied between the | 251 | * These are string config options that must be copied between the |
252 | * Match sub-config and the main config, and must be sent from the | 252 | * Match sub-config and the main config, and must be sent from the |
253 | * privsep slave to the privsep master. We use a macro to ensure all | 253 | * privsep child to the privsep master. We use a macro to ensure all |
254 | * the options are copied and the copies are done in the correct order. | 254 | * the options are copied and the copies are done in the correct order. |
255 | * | 255 | * |
256 | * NB. an option must appear in servconf.c:copy_set_server_options() or | 256 | * NB. an option must appear in servconf.c:copy_set_server_options() or |
@@ -269,7 +269,7 @@ TAILQ_HEAD(include_list, include_item); | |||
269 | M_CP_STROPT(pubkey_key_types); \ | 269 | M_CP_STROPT(pubkey_key_types); \ |
270 | M_CP_STROPT(ca_sign_algorithms); \ | 270 | M_CP_STROPT(ca_sign_algorithms); \ |
271 | M_CP_STROPT(routing_domain); \ | 271 | M_CP_STROPT(routing_domain); \ |
272 | M_CP_STROPT(permit_user_env_whitelist); \ | 272 | M_CP_STROPT(permit_user_env_allowlist); \ |
273 | M_CP_STRARRAYOPT(authorized_keys_files, num_authkeys_files); \ | 273 | M_CP_STRARRAYOPT(authorized_keys_files, num_authkeys_files); \ |
274 | M_CP_STRARRAYOPT(allow_users, num_allow_users); \ | 274 | M_CP_STRARRAYOPT(allow_users, num_allow_users); \ |
275 | M_CP_STRARRAYOPT(deny_users, num_deny_users); \ | 275 | M_CP_STRARRAYOPT(deny_users, num_deny_users); \ |
@@ -1,4 +1,4 @@ | |||
1 | /* $OpenBSD: session.c,v 1.322 2020/07/03 07:02:37 djm Exp $ */ | 1 | /* $OpenBSD: session.c,v 1.323 2020/07/05 23:59:45 djm Exp $ */ |
2 | /* | 2 | /* |
3 | * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland | 3 | * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland |
4 | * All rights reserved | 4 | * All rights reserved |
@@ -644,7 +644,7 @@ do_exec_pty(struct ssh *ssh, Session *s, const char *command) | |||
644 | 644 | ||
645 | s->pid = pid; | 645 | s->pid = pid; |
646 | 646 | ||
647 | /* Parent. Close the slave side of the pseudo tty. */ | 647 | /* Parent. Close the child side of the pseudo tty. */ |
648 | close(ttyfd); | 648 | close(ttyfd); |
649 | 649 | ||
650 | /* Enter interactive session. */ | 650 | /* Enter interactive session. */ |
@@ -843,12 +843,12 @@ check_quietlogin(Session *s, const char *command) | |||
843 | * into the environment. If the file does not exist, this does nothing. | 843 | * into the environment. If the file does not exist, this does nothing. |
844 | * Otherwise, it must consist of empty lines, comments (line starts with '#') | 844 | * Otherwise, it must consist of empty lines, comments (line starts with '#') |
845 | * and assignments of the form name=value. No other forms are allowed. | 845 | * and assignments of the form name=value. No other forms are allowed. |
846 | * If whitelist is not NULL, then it is interpreted as a pattern list and | 846 | * If allowlist is not NULL, then it is interpreted as a pattern list and |
847 | * only variable names that match it will be accepted. | 847 | * only variable names that match it will be accepted. |
848 | */ | 848 | */ |
849 | static void | 849 | static void |
850 | read_environment_file(char ***env, u_int *envsize, | 850 | read_environment_file(char ***env, u_int *envsize, |
851 | const char *filename, const char *whitelist) | 851 | const char *filename, const char *allowlist) |
852 | { | 852 | { |
853 | FILE *f; | 853 | FILE *f; |
854 | char *line = NULL, *cp, *value; | 854 | char *line = NULL, *cp, *value; |
@@ -881,8 +881,8 @@ read_environment_file(char ***env, u_int *envsize, | |||
881 | */ | 881 | */ |
882 | *value = '\0'; | 882 | *value = '\0'; |
883 | value++; | 883 | value++; |
884 | if (whitelist != NULL && | 884 | if (allowlist != NULL && |
885 | match_pattern_list(cp, whitelist, 0) != 1) | 885 | match_pattern_list(cp, allowlist, 0) != 1) |
886 | continue; | 886 | continue; |
887 | child_set_env(env, envsize, cp, value); | 887 | child_set_env(env, envsize, cp, value); |
888 | } | 888 | } |
@@ -1111,10 +1111,10 @@ do_setup_env(struct ssh *ssh, Session *s, const char *shell) | |||
1111 | cp = strchr(ocp, '='); | 1111 | cp = strchr(ocp, '='); |
1112 | if (*cp == '=') { | 1112 | if (*cp == '=') { |
1113 | *cp = '\0'; | 1113 | *cp = '\0'; |
1114 | /* Apply PermitUserEnvironment whitelist */ | 1114 | /* Apply PermitUserEnvironment allowlist */ |
1115 | if (options.permit_user_env_whitelist == NULL || | 1115 | if (options.permit_user_env_allowlist == NULL || |
1116 | match_pattern_list(ocp, | 1116 | match_pattern_list(ocp, |
1117 | options.permit_user_env_whitelist, 0) == 1) | 1117 | options.permit_user_env_allowlist, 0) == 1) |
1118 | child_set_env(&env, &envsize, | 1118 | child_set_env(&env, &envsize, |
1119 | ocp, cp + 1); | 1119 | ocp, cp + 1); |
1120 | } | 1120 | } |
@@ -1127,7 +1127,7 @@ do_setup_env(struct ssh *ssh, Session *s, const char *shell) | |||
1127 | snprintf(buf, sizeof buf, "%.200s/.ssh/environment", | 1127 | snprintf(buf, sizeof buf, "%.200s/.ssh/environment", |
1128 | pw->pw_dir); | 1128 | pw->pw_dir); |
1129 | read_environment_file(&env, &envsize, buf, | 1129 | read_environment_file(&env, &envsize, buf, |
1130 | options.permit_user_env_whitelist); | 1130 | options.permit_user_env_allowlist); |
1131 | } | 1131 | } |
1132 | 1132 | ||
1133 | #ifdef USE_PAM | 1133 | #ifdef USE_PAM |
diff --git a/ssh-agent.c b/ssh-agent.c index 06efe3c6f..5f7ac8b91 100644 --- a/ssh-agent.c +++ b/ssh-agent.c | |||
@@ -1,4 +1,4 @@ | |||
1 | /* $OpenBSD: ssh-agent.c,v 1.261 2020/06/22 06:37:38 jmc Exp $ */ | 1 | /* $OpenBSD: ssh-agent.c,v 1.262 2020/07/05 23:59:45 djm Exp $ */ |
2 | /* | 2 | /* |
3 | * Author: Tatu Ylonen <ylo@cs.hut.fi> | 3 | * Author: Tatu Ylonen <ylo@cs.hut.fi> |
4 | * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland | 4 | * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland |
@@ -93,8 +93,8 @@ | |||
93 | #include "ssh-pkcs11.h" | 93 | #include "ssh-pkcs11.h" |
94 | #include "sk-api.h" | 94 | #include "sk-api.h" |
95 | 95 | ||
96 | #ifndef DEFAULT_PROVIDER_WHITELIST | 96 | #ifndef DEFAULT_ALLOWED_PROVIDERS |
97 | # define DEFAULT_PROVIDER_WHITELIST "/usr/lib*/*,/usr/local/lib*/*" | 97 | # define DEFAULT_ALLOWED_PROVIDERS "/usr/lib*/*,/usr/local/lib*/*" |
98 | #endif | 98 | #endif |
99 | 99 | ||
100 | /* Maximum accepted message length */ | 100 | /* Maximum accepted message length */ |
@@ -1359,7 +1359,7 @@ main(int ac, char **av) | |||
1359 | usage(); | 1359 | usage(); |
1360 | 1360 | ||
1361 | if (allowed_providers == NULL) | 1361 | if (allowed_providers == NULL) |
1362 | allowed_providers = xstrdup(DEFAULT_PROVIDER_WHITELIST); | 1362 | allowed_providers = xstrdup(DEFAULT_ALLOWED_PROVIDERS); |
1363 | 1363 | ||
1364 | if (ac == 0 && !c_flag && !s_flag) { | 1364 | if (ac == 0 && !c_flag && !s_flag) { |
1365 | shell = getenv("SHELL"); | 1365 | shell = getenv("SHELL"); |
@@ -1,4 +1,4 @@ | |||
1 | /* $OpenBSD: ssh.c,v 1.530 2020/06/26 05:02:03 dtucker Exp $ */ | 1 | /* $OpenBSD: ssh.c,v 1.531 2020/07/05 23:59:45 djm Exp $ */ |
2 | /* | 2 | /* |
3 | * Author: Tatu Ylonen <ylo@cs.hut.fi> | 3 | * Author: Tatu Ylonen <ylo@cs.hut.fi> |
4 | * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland | 4 | * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland |
@@ -137,11 +137,11 @@ int stdin_null_flag = 0; | |||
137 | 137 | ||
138 | /* | 138 | /* |
139 | * Flag indicating that the current process should be backgrounded and | 139 | * Flag indicating that the current process should be backgrounded and |
140 | * a new slave launched in the foreground for ControlPersist. | 140 | * a new mux-client launched in the foreground for ControlPersist. |
141 | */ | 141 | */ |
142 | int need_controlpersist_detach = 0; | 142 | int need_controlpersist_detach = 0; |
143 | 143 | ||
144 | /* Copies of flags for ControlPersist foreground slave */ | 144 | /* Copies of flags for ControlPersist foreground mux-client */ |
145 | int ostdin_null_flag, ono_shell_flag, otty_flag, orequest_tty; | 145 | int ostdin_null_flag, ono_shell_flag, otty_flag, orequest_tty; |
146 | 146 | ||
147 | /* | 147 | /* |
@@ -1691,7 +1691,7 @@ control_persist_detach(void) | |||
1691 | /* Child: master process continues mainloop */ | 1691 | /* Child: master process continues mainloop */ |
1692 | break; | 1692 | break; |
1693 | default: | 1693 | default: |
1694 | /* Parent: set up mux slave to connect to backgrounded master */ | 1694 | /* Parent: set up mux client to connect to backgrounded master */ |
1695 | debug2("%s: background process is %ld", __func__, (long)pid); | 1695 | debug2("%s: background process is %ld", __func__, (long)pid); |
1696 | stdin_null_flag = ostdin_null_flag; | 1696 | stdin_null_flag = ostdin_null_flag; |
1697 | options.request_tty = orequest_tty; | 1697 | options.request_tty = orequest_tty; |
@@ -2070,9 +2070,9 @@ ssh_session2(struct ssh *ssh, struct passwd *pw) | |||
2070 | /* | 2070 | /* |
2071 | * If we are in control persist mode and have a working mux listen | 2071 | * If we are in control persist mode and have a working mux listen |
2072 | * socket, then prepare to background ourselves and have a foreground | 2072 | * socket, then prepare to background ourselves and have a foreground |
2073 | * client attach as a control slave. | 2073 | * client attach as a control client. |
2074 | * NB. we must save copies of the flags that we override for | 2074 | * NB. we must save copies of the flags that we override for |
2075 | * the backgrounding, since we defer attachment of the slave until | 2075 | * the backgrounding, since we defer attachment of the client until |
2076 | * after the connection is fully established (in particular, | 2076 | * after the connection is fully established (in particular, |
2077 | * async rfwd replies have been received for ExitOnForwardFailure). | 2077 | * async rfwd replies have been received for ExitOnForwardFailure). |
2078 | */ | 2078 | */ |