summaryrefslogtreecommitdiff
path: root/ChangeLog
diff options
context:
space:
mode:
Diffstat (limited to 'ChangeLog')
-rw-r--r--ChangeLog4957
1 files changed, 1961 insertions, 2996 deletions
diff --git a/ChangeLog b/ChangeLog
index c9b5018bd..f2b96c37b 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,13 +1,1969 @@
120060211 120070306
2 - (dtucker) [README] Bump release notes URL. 2 - (djm) OpenBSD CVS Sync
3 - (djm) Release 4.3p2 3 - jmc@cvs.openbsd.org 2007/03/01 16:19:33
4 [sshd_config.5]
5 sort the `match' keywords;
6 - djm@cvs.openbsd.org 2007/03/06 10:13:14
7 [version.h]
8 openssh-4.6; "please" deraadt@
9 - (djm) [contrib/caldera/openssh.spec contrib/redhat/openssh.spec]
10 [contrib/suse/openssh.spec] crank spec files for release
11 - (djm) [README] correct link to release notes
12 - (djm) Release 4.6p1
13
1420070304
15 - (djm) [configure.ac] add a --without-openssl-header-check option to
16 configure, as some platforms (OS X) ship OpenSSL headers whose version
17 does not match that of the shipping library. ok dtucker@
18 - (dtucker) [openbsd-compat/openssl-compat.h] Bug #1291: Work around a
19 bug in OpenSSL 0.9.8e that prevents aes256-ctr, aes192-ctr and arcfour256
20 ciphers from working correctly (disconnects with "Bad packet length"
21 errors) as found by Ben Harris. ok djm@
22
2320070303
24 - (dtucker) [regress/agent-ptrace.sh] Make ttrace gdb error a little more
25 general to cover newer gdb versions on HP-UX.
26
2720070302
28 - (dtucker) [configure.ac] For Cygwin, read files in textmode (which allows
29 CRLF as well as LF lineendings) and write in binary mode. Patch from
30 vinschen at redhat.com.
31 - (dtucker) [INSTALL] Update to autoconf-2.61.
32
3320070301
34 - (dtucker) OpenBSD CVS Sync
35 - dtucker@cvs.openbsd.org 2007/03/01 10:28:02
36 [auth2.c sshd_config.5 servconf.c]
37 Remove ChallengeResponseAuthentication support inside a Match
38 block as its interaction with KbdInteractive makes it difficult to
39 support. Also, relocate the CR/kbdint option special-case code into
40 servconf. "please commit" djm@, ok markus@ for the relocation.
41 - (tim) [buildpkg.sh.in openssh.xml.in] Clean up Solaris 10 smf(5) bits.
42 "Looks sane" dtucker@
43
4420070228
45 - (dtucker) OpenBSD CVS Sync
46 - dtucker@cvs.openbsd.org 2007/02/28 00:55:30
47 [ssh-agent.c]
48 Remove expired keys periodically so they don't remain in memory when
49 the agent is entirely idle, as noted by David R. Piegdon. This is the
50 simple fix, a more efficient one will be done later. With markus,
51 deraadt, with & ok djm.
52
5320070225
54 - (dtucker) OpenBSD CVS Sync
55 - djm@cvs.openbsd.org 2007/02/20 10:25:14
56 [clientloop.c]
57 set maximum packet and window sizes the same for multiplexed clients
58 as normal connections; ok markus@
59 - dtucker@cvs.openbsd.org 2007/02/21 11:00:05
60 [sshd.c]
61 Clear alarm() before restarting sshd on SIGHUP. Without this, if there's
62 a SIGALRM pending (for SSH1 key regeneration) when sshd is SIGHUP'ed, the
63 newly exec'ed sshd will get the SIGALRM and not have a handler for it,
64 and the default action will terminate the listening sshd. Analysis and
65 patch from andrew at gaul.org.
66 - dtucker@cvs.openbsd.org 2007/02/22 12:58:40
67 [servconf.c]
68 Check activep so Match and GatewayPorts work together; ok markus@
69 - ray@cvs.openbsd.org 2007/02/24 03:30:11
70 [moduli.c]
71 - strlen returns size_t, not int.
72 - Pass full buffer size to fgets.
73 OK djm@, millert@, and moritz@.
74
7520070219
76 - (dtucker) OpenBSD CVS Sync
77 - jmc@cvs.openbsd.org 2007/01/10 13:23:22
78 [ssh_config.5]
79 do not use a list for SYNOPSIS;
80 this is actually part of a larger report sent by eric s. raymond
81 and forwarded by brad, but i only read half of it. spotted by brad.
82 - jmc@cvs.openbsd.org 2007/01/12 20:20:41
83 [ssh-keygen.1 ssh-keygen.c]
84 more secsh -> rfc 4716 updates;
85 spotted by wiz@netbsd
86 ok markus
87 - dtucker@cvs.openbsd.org 2007/01/17 23:22:52
88 [readconf.c]
89 Honour activep for times (eg ServerAliveInterval) while parsing
90 ssh_config and ~/.ssh/config so they work properly with Host directives.
91 From mario.lorenz@wincor-nixdorf.com via bz #1275. ok markus@
92 - stevesk@cvs.openbsd.org 2007/01/21 01:41:54
93 [auth-skey.c kex.c ssh-keygen.c session.c clientloop.c]
94 spaces
95 - stevesk@cvs.openbsd.org 2007/01/21 01:45:35
96 [readconf.c]
97 spaces
98 - djm@cvs.openbsd.org 2007/01/22 11:32:50
99 [sftp-client.c]
100 return error from do_upload() when a write fails. fixes bz#1252: zero
101 exit status from sftp when uploading to a full device. report from
102 jirkat AT atlas.cz; ok dtucker@
103 - djm@cvs.openbsd.org 2007/01/22 13:06:21
104 [scp.c]
105 fix detection of whether we should show progress meter or not: scp
106 tested isatty(stderr) but wrote the progress meter to stdout. This patch
107 makes it test stdout. bz#1265 reported by junkmail AT bitsculpture.com;
108 of dtucker@
109 - stevesk@cvs.openbsd.org 2007/02/14 14:32:00
110 [bufbn.c]
111 typos in comments; ok jmc@
112 - dtucker@cvs.openbsd.org 2007/02/19 10:45:58
113 [monitor_wrap.c servconf.c servconf.h monitor.c sshd_config.5]
114 Teach Match how handle config directives that are used before
115 authentication. This allows configurations such as permitting password
116 authentication from the local net only while requiring pubkey from
117 offsite. ok djm@, man page bits ok jmc@
118 - (dtucker) [contrib/findssl.sh] Add "which" as a shell function since some
119 platforms don't have it. Patch from dleonard at vintela.com.
120 - (dtucker) [openbsd-compat/getrrsetbyname.c] Don't attempt to calloc
121 an array for signatures when there are none since "calloc(0, n) returns
122 NULL on some platforms (eg Tru64), which is explicitly permitted by
123 POSIX. Diagnosis and patch by svallet genoscope.cns.fr.
124
12520070128
126 - (djm) [channels.c serverloop.c] Fix so-called "hang on exit" (bz #52)
127 when closing a tty session when a background process still holds tty
128 fds open. Great detective work and patch by Marc Aurele La France,
129 slightly tweaked by me; ok dtucker@
130
13120070123
132 - (dtucker) [openbsd-compat/bsd-snprintf.c] Static declarations for public
133 library interfaces aren't very helpful. Fix up the DOPR_OUTCH macro
134 so it works properly and modify its callers so that they don't pre or
135 post decrement arguments that are conditionally evaluated. While there,
136 put SNPRINTF_CONST back as it prevents build failures in some
137 configurations. ok djm@ (for most of it)
138
13920070122
140 - (djm) [ssh-rand-helper.8] manpage nits;
141 from dleonard AT vintela.com (bz#1529)
142
14320070117
144 - (dtucker) [packet.c] Re-remove in_systm.h since it's already in includes.h
145 and multiple including it causes problems on old IRIXes. (It snuck back
146 in during a sync.) Found (again) by Georg Schwarz.
147
14820070114
149 - (dtucker) [ssh-keygen.c] av -> argv to match earlier sync.
150 - (djm) [openbsd-compat/bsd-snprintf.c] Fix integer overflow in return
151 value of snprintf replacement, similar to bugs in various libc
152 implementations. This overflow is not exploitable in OpenSSH.
153 While I'm fiddling with it, make it a fair bit faster by inlining the
154 append-char routine; ok dtucker@
155
15620070105
157 - (djm) OpenBSD CVS Sync
158 - deraadt@cvs.openbsd.org 2006/11/14 19:41:04
159 [ssh-keygen.c]
160 use argc and argv not some made up short form
161 - ray@cvs.openbsd.org 2006/11/23 01:35:11
162 [misc.c sftp.c]
163 Don't access buf[strlen(buf) - 1] for zero-length strings.
164 ``ok by me'' djm@.
165 - markus@cvs.openbsd.org 2006/12/11 21:25:46
166 [ssh-keygen.1 ssh.1]
167 add rfc 4716 (public key format); ok jmc
168 - djm@cvs.openbsd.org 2006/12/12 03:58:42
169 [channels.c compat.c compat.h]
170 bz #1019: some ssh.com versions apparently can't cope with the
171 remote port forwarding bind_address being a hostname, so send
172 them an address for cases where they are not explicitly
173 specified (wildcard or localhost bind). reported by daveroth AT
174 acm.org; ok dtucker@ deraadt@
175 - dtucker@cvs.openbsd.org 2006/12/13 08:34:39
176 [servconf.c]
177 Make PermitOpen work with multiple values like the man pages says.
178 bz #1267 with details from peter at dmtz.com, with & ok djm@
179 - dtucker@cvs.openbsd.org 2006/12/14 10:01:14
180 [servconf.c]
181 Make "PermitOpen all" first-match within a block to match the way other
182 options work. ok markus@ djm@
183 - jmc@cvs.openbsd.org 2007/01/02 09:57:25
184 [sshd_config.5]
185 do not use lists for SYNOPSIS;
186 from eric s. raymond via brad
187 - stevesk@cvs.openbsd.org 2007/01/03 00:53:38
188 [ssh-keygen.c]
189 remove small dead code; arnaud.lacombe.1@ulaval.ca via Coverity scan
190 - stevesk@cvs.openbsd.org 2007/01/03 03:01:40
191 [auth2-chall.c channels.c dns.c sftp.c ssh-keygen.c ssh.c]
192 spaces
193 - stevesk@cvs.openbsd.org 2007/01/03 04:09:15
194 [sftp.c]
195 ARGSUSED for lint
196 - stevesk@cvs.openbsd.org 2007/01/03 07:22:36
197 [sftp-server.c]
198 spaces
199
20020061205
201 - (djm) [auth.c] Fix NULL pointer dereference in fakepw(). Crash would
202 occur if the server did not have the privsep user and an invalid user
203 tried to login and both privsep and krb5 auth are disabled; ok dtucker@
204 - (djm) [bsd-asprintf.c] Better test for bad vsnprintf lengths; ok dtucker@
205
20620061108
207 - (dtucker) OpenBSD CVS Sync
208 - markus@cvs.openbsd.org 2006/11/07 13:02:07
209 [dh.c]
210 BN_hex2bn returns int; from dtucker@
211
21220061107
213 - (dtucker) [sshd.c] Use privsep_pw if we have it, but only require it
214 if we absolutely need it. Pointed out by Corinna, ok djm@
215 - (dtucker) OpenBSD CVS Sync
216 - markus@cvs.openbsd.org 2006/11/06 21:25:28
217 [auth-rsa.c kexgexc.c kexdhs.c key.c ssh-dss.c sshd.c kexgexs.c
218 ssh-keygen.c bufbn.c moduli.c scard.c kexdhc.c sshconnect1.c dh.c rsa.c]
219 add missing checks for openssl return codes; with & ok djm@
220 - markus@cvs.openbsd.org 2006/11/07 10:31:31
221 [monitor.c version.h]
222 correctly check for bad signatures in the monitor, otherwise the monitor
223 and the unpriv process can get out of sync. with dtucker@, ok djm@,
224 dtucker@
225 - (dtucker) [README contrib/{caldera,redhat,contrib}/openssh.spec] Bump
226 versions.
227 - (dtucker) Release 4.5p1.
228
22920061105
230 - (djm) OpenBSD CVS Sync
231 - otto@cvs.openbsd.org 2006/10/28 18:08:10
232 [ssh.1]
233 correct/expand example of usage of -w; ok jmc@ stevesk@
234 - markus@cvs.openbsd.org 2006/10/31 16:33:12
235 [kexdhc.c kexdhs.c kexgexc.c kexgexs.c]
236 check DH_compute_key() for -1 even if it should not happen because of
237 earlier calls to dh_pub_is_valid(); report krahmer at suse.de; ok djm
238
23920061101
240 - (dtucker) [openbsd-compat/port-solaris.c] Bug #1255: Make only hwerr
241 events fatal in Solaris process contract support and tell it to signal
242 only processes in the same process group when something happens.
243 Based on information from andrew.benham at thus.net and similar to
244 a patch from Chad Mynhier. ok djm@
245
24620061027
247- (djm) [auth.c] gc some dead code
248
24920061023
250 - (djm) OpenBSD CVS Sync
251 - ray@cvs.openbsd.org 2006/09/30 17:48:22
252 [sftp.c]
253 Clear errno before calling the strtol functions.
254 From Paul Stoeber <x0001 at x dot de1 dot cc>.
255 OK deraadt@.
256 - djm@cvs.openbsd.org 2006/10/06 02:29:19
257 [ssh-agent.c ssh-keyscan.c ssh.c]
258 sys/resource.h needs sys/time.h; prompted by brad@
259 (NB. Id sync only for portable)
260 - djm@cvs.openbsd.org 2006/10/09 23:36:11
261 [session.c]
262 xmalloc -> xcalloc that was missed previously, from portable
263 (NB. Id sync only for portable, obviously)
264 - markus@cvs.openbsd.org 2006/10/10 10:12:45
265 [sshconnect.c]
266 sleep before retrying (not after) since sleep changes errno; fixes
267 pr 5250; rad@twig.com; ok dtucker djm
268 - markus@cvs.openbsd.org 2006/10/11 12:38:03
269 [clientloop.c serverloop.c]
270 exit instead of doing a blocking tcp send if we detect a client/server
271 timeout, since the tcp sendqueue might be already full (of alive
272 requests); ok dtucker, report mpf
273 - djm@cvs.openbsd.org 2006/10/22 02:25:50
274 [sftp-client.c]
275 cancel progress meter when upload write fails; ok deraadt@
276 - (tim) [Makefile.in scard/Makefile.in] Add datarootdir= lines to keep
277 autoconf 2.60 from complaining.
278
27920061018
280 - (dtucker) OpenBSD CVS Sync
281 - ray@cvs.openbsd.org 2006/09/25 04:55:38
282 [ssh-keyscan.1 ssh.1]
283 Change "a SSH" to "an SSH". Hurray, I'm not the only one who
284 pronounces "SSH" as "ess-ess-aich".
285 OK jmc@ and stevesk@.
286 - (dtucker) [sshd.c] Reshuffle storing of pw struct; prevents warnings
287 on older versions of OS X. ok djm@
288
28920061016
290 - (dtucker) [monitor_fdpass.c] Include sys/in.h, required for cmsg macros
291 on older (2.0) Linuxes. Based on patch from thmo-13 at gmx de.
292
29320061006
294 - (tim) [buildpkg.sh.in] Use uname -r instead of -v in OS_VER for Solaris.
295 Differentiate between OpenServer 5 and OpenServer 6
296 - (dtucker) [configure.ac] Set put -lselinux into $LIBS while testing for
297 SELinux functions so they're detected correctly. Patch from pebenito at
298 gentoo.org.
299 - (tim) [buildpkg.sh.in] Some systems have really limited nawk (OpenServer).
300 Allow setting alternate awk in openssh-config.local.
301
30220061003
303 - (tim) [configure.ac] Move CHECK_HEADERS test before platform specific
304 section so additional platform specific CHECK_HEADER tests will work
305 correctly. Fixes "<net/if_tap.h> on FreeBSD" problem report by des AT des.no
306 Feedback and "seems like a good idea" dtucker@
307
30820061001
309 - (dtucker) [audit-bsm.c] Include errno.h. Pointed out by des at des.no.
310
31120060929
312 - (dtucker) [configure.ac] Bug #1239: Fix configure test for OpenSSH engine
313 support. Patch from andrew.benham at thus net.
314
31520060928
316 - (dtucker) [entropy.c] Bug #1238: include signal.h to fix compilation error
317 on Solaris 8 w/out /dev/random or prngd. Patch from rl at
318 math.technion.ac.il.
319
32020060926
321 - (dtucker) [bufaux.h] nuke bufaux.h; it's already gone from OpenBSD and not
322 referenced any more. ok djm@
323 - (dtucker) [sftp-server.8] Resync; spotted by djm@
324 - (dtucker) Release 4.4p1.
325
32620060924
327 - (tim) [configure.ac] Remove CFLAGS hack for UnixWare 1.x/2.x (added
328 to rev 1.308) to work around broken gcc 2.x header file.
329
33020060923
331 - (dtucker) [configure.ac] Bug #1234: Put opensc libs into $LIBS rather than
332 $LDFLAGS. Patch from vapier at gentoo org.
333
33420060922
335 - (dtucker) [packet.c canohost.c] Include arpa/inet.h for htonl macros on
336 some platforms (eg HP-UX 11.00). From santhi.amirta at gmail com.
337
33820060921
339 - (dtucker) OpenBSD CVS Sync
340 - otto@cvs.openbsd.org 2006/09/19 05:52:23
341 [sftp.c]
342 Use S_IS* macros insted of masking with S_IF* flags. The latter may
343 have multiple bits set, which lead to surprising results. Spotted by
344 Paul Stoeber, more to come. ok millert@ pedro@ jaredy@ djm@
345 - markus@cvs.openbsd.org 2006/09/19 21:14:08
346 [packet.c]
347 client NULL deref on protocol error; Tavis Ormandy, Google Security Team
348 - (dtucker) [defines.h] Include unistd.h before defining getpgrp; fixes
349 build error on Ultrix. From Bernhard Simon.
350
35120060918
352 - (dtucker) [configure.ac] On AIX, check to see if the compiler will allow
353 macro redefinitions, and if not, remove "-qlanglvl=ansi" from the flags.
354 Allows build out of the box with older VAC and XLC compilers. Found by
355 David Bronder and Bernhard Simon.
356 - (dtucker) [openbsd-compat/port-aix.{c,h}] Reduce scope of includes.
357 Prevents macro redefinition warnings of "RDONLY".
358
35920060916
360 - OpenBSD CVS Sync
361 - djm@cvs.openbsd.org 2006/09/16 19:53:37
362 [deattack.c deattack.h packet.c]
363 limit maximum work performed by the CRC compensation attack detector,
364 problem reported by Tavis Ormandy, Google Security Team;
365 ok markus@ deraadt@
366 - (djm) Add openssh.xml to .cvsignore and sort it
367 - (dtucker) [auth-pam.c] Propogate TZ environment variable to PAM auth
368 process so that any logging it does is with the right timezone. From
369 Scott Strickler, ok djm@.
370 - (dtucker) [monitor.c] Correctly handle auditing of single commands when
371 using Protocol 1. From jhb at freebsd.
372 - (djm) [sshd.c] Fix warning/API abuse; ok dtucker@
373 - (dtucker) [INSTALL] Add info about audit support.
374
37520060912
376 - (djm) [Makefile.in buildpkg.sh.in configure.ac openssh.xml.in]
377 Support SMF in Solaris Packages if enabled by configure. Patch from
378 Chad Mynhier, tested by dtucker@
379
38020060911
381 - (dtucker) [cipher-aes.c] Include string.h for memcpy and friends. Noted
382 by Pekka Savola.
383
38420060910
385 - (dtucker) [contrib/aix/buildbff.sh] Ensure that perl is available.
386 - (dtucker) [configure.ac] Add -lcrypt to let DragonFly build OOTB.
387
38820060909
389 - (dtucker) [openbsd-compat/bsd-snprintf.c] Add stdarg.h.
390 - (dtucker) [contrib/aix/buildbff.sh] Always create privsep user.
391 - (dtucker) [buildpkg.sh.in] Always create privsep user. ok djm@
392
39320060908
394 - (dtucker) [auth-sia.c] Add includes required for build on Tru64. Patch
395 from Chris Adams.
396 - (dtucker) [configure.ac] The BSM header test needs time.h in some cases.
397
39820060907
399 - (djm) [sshd.c auth.c] Set up fakepw() with privsep uid/gid, so it can
400 be used to drop privilege to; fixes Solaris GSSAPI crash reported by
401 Magnus Abrante; suggestion and feedback dtucker@
402 NB. this change will require that the privilege separation user must
403 exist on all the time, not just when UsePrivilegeSeparation=yes
404 - (tim) [configure.ac] s/BROKEN_UPDWTMP/BROKEN_UPDWTMPX/ on SCO OSR6
405 - (dtucker) [loginrec.c] Wrap paths.h in HAVE_PATHS_H.
406 - (dtucker) [regress/cfgmatch.sh] stop_client is racy, so give us a better
407 chance of winning.
408
40920060905
410 - (dtucker) [configure.ac] s/AC_DEFINES/AC_DEFINE/ spotted by Roumen Petrov.
411 - (dtucker) [loginrec.c] Include paths.h for _PATH_BTMP.
412
41320060904
414 - (dtucker) [configure.ac] Define BROKEN_UPDWTMP on SCO OSR6 as the native
415 updwdtmp seems to generate invalid wtmp entries. From Roger Cornelius,
416 ok djm@
417
41820060903
419 - (dtucker) [configure.ac openbsd-compat/openbsd-compat.h] Check for
420 declaration of writev(2) and declare it ourselves if necessary. Makes
421 the atomiciov() calls build on really old systems. ok djm@
422
42320060902
424 - (dtucker) [openbsd-compat/port-irix.c] Add errno.h, found by Iain Morgan.
425 - (dtucker) [ssh-keyscan.c ssh-rand-helper.c ssh.c sshconnect.c
426 openbsd-compat/bindresvport.c openbsd-compat/getrrsetbyname.c
427 openbsd-compat/port-tun.c openbsd-compat/rresvport.c] Include <arpa/inet.h>
428 for hton* and ntoh* macros. Required on (at least) HP-UX since we define
429 _XOPEN_SOURCE_EXTENDED. Found by santhi.amirta at gmail com.
430
43120060901
432 - (djm) [audit-bsm.c audit.c auth-bsdauth.c auth-chall.c auth-pam.c]
433 [auth-rsa.c auth-shadow.c auth-sia.c auth1.c auth2-chall.c]
434 [auth2-gss.c auth2-kbdint.c auth2-none.c authfd.c authfile.c]
435 [cipher-3des1.c cipher-aes.c cipher-bf1.c cipher-ctr.c clientloop.c]
436 [dh.c dns.c entropy.c gss-serv-krb5.c gss-serv.c hostfile.c kex.c]
437 [kexdhc.c kexdhs.c kexgexc.c kexgexs.c key.c loginrec.c mac.c]
438 [md5crypt.c monitor.c monitor_wrap.c readconf.c rsa.c]
439 [scard-opensc.c scard.c session.c ssh-add.c ssh-agent.c ssh-dss.c]
440 [ssh-keygen.c ssh-keysign.c ssh-rsa.c ssh.c sshconnect.c]
441 [sshconnect1.c sshconnect2.c sshd.c]
442 [openbsd-compat/bsd-cray.c openbsd-compat/port-aix.c]
443 [openbsd-compat/port-linux.c openbsd-compat/port-solaris.c]
444 [openbsd-compat/port-uw.c]
445 Lots of headers for SCO OSR6, mainly adding stdarg.h for log.h;
446 compile problems reported by rac AT tenzing.org
447 - (djm) [includes.h monitor.c openbsd-compat/bindresvport.c]
448 [openbsd-compat/rresvport.c] Some more headers: netinet/in.h
449 sys/socket.h and unistd.h in various places
450 - (dtucker) [openbsd-compat/bsd-cygwin_util.c] Fix implict declaration
451 warnings for binary_open and binary_close. Patch from Corinna Vinschen.
452 - (dtucker) [configure.ac includes.h openbsd-compat/glob.{c,h}] Explicitly
453 test for GLOB_NOMATCH and use our glob functions if it's not found.
454 Stops sftp from segfaulting when attempting to get a nonexistent file on
455 Cygwin (previous versions of OpenSSH didn't use the native glob). Partly
456 from and tested by Corinna Vinschen.
457 - (dtucker) [README contrib/{caldera,redhat,suse}/openssh.spec] Crank
458 versions.
459
46020060831
461 - (djm) [CREDITS LICENCE Makefile.in auth.c configure.ac includes.h ]
462 [platform.c platform.h sshd.c openbsd-compat/Makefile.in]
463 [openbsd-compat/openbsd-compat.h openbsd-compat/port-solaris.c]
464 [openbsd-compat/port-solaris.h] Add support for Solaris process
465 contracts, enabled with --use-solaris-contracts. Patch from Chad
466 Mynhier, tweaked by dtucker@ and myself; ok dtucker@
467 - (dtucker) [contrib/cygwin/ssh-host-config] Add SeTcbPrivilege privilege
468 while setting up the ssh service account. Patch from Corinna Vinschen.
469
47020060830
471 - (djm) OpenBSD CVS Sync
472 - dtucker@cvs.openbsd.org 2006/08/21 08:14:01
473 [sshd_config.5]
474 Document HostbasedUsesNameFromPacketOnly. Corrections from jmc@,
475 ok jmc@ djm@
476 - dtucker@cvs.openbsd.org 2006/08/21 08:15:57
477 [sshd.8]
478 Add more detail about what permissions are and aren't accepted for
479 authorized_keys files. Corrections jmc@, ok djm@, "looks good" jmc@
480 - djm@cvs.openbsd.org 2006/08/29 10:40:19
481 [channels.c session.c]
482 normalise some inconsistent (but harmless) NULL pointer checks
483 spotted by the Stanford SATURN tool, via Isil Dillig;
484 ok markus@ deraadt@
485 - dtucker@cvs.openbsd.org 2006/08/29 12:02:30
486 [gss-genr.c]
487 Work around a problem in Heimdal that occurs when KRB5CCNAME file is
488 missing, by checking whether or not kerberos allocated us a context
489 before attempting to free it. Patch from Simon Wilkinson, tested by
490 biorn@, ok djm@
491 - dtucker@cvs.openbsd.org 2006/08/30 00:06:51
492 [sshconnect2.c]
493 Fix regression where SSH2 banner is printed at loglevels ERROR and FATAL
494 where previously it weren't. bz #1221, found by Dean Kopesky, ok djm@
495 - djm@cvs.openbsd.org 2006/08/30 00:14:37
496 [version.h]
497 crank to 4.4
498 - (djm) [openbsd-compat/xcrypt.c] needs unistd.h
499 - (dtucker) [auth.c openbsd-compat/port-aix.c] Bug #1207: always call
500 loginsuccess on AIX immediately after authentication to clear the failed
501 login count. Previously this would only happen when an interactive
502 session starts (ie when a pty is allocated) but this means that accounts
503 that have primarily non-interactive sessions (eg scp's) may gradually
504 accumulate enough failures to lock out an account. This change may have
505 a side effect of creating two audit records, one with a tty of "ssh"
506 corresponding to the authentication and one with the allocated pty per
507 interactive session.
508
50920060824
510 - (dtucker) [openbsd-compat/basename.c] Include errno.h.
511 - (dtucker) [openbsd-compat/bsd-misc.c] Add includes needed for select(2) on
512 older systems.
513 - (dtucker) [openbsd-compat/bsd-misc.c] Include <sys/select.h> for select(2)
514 on POSIX systems.
515 - (dtucker) [openbsd-compat/bsd-openpty.c] Include for ioctl(2).
516 - (dtucker) [openbsd-compat/rresvport.c] Include <stdlib.h> for malloc.
517 - (dtucker) [openbsd-compat/xmmap.c] Move #define HAVE_MMAP to prevent
518 unused variable warning when we have a broken or missing mmap(2).
519
52020060822
521 - (dtucker) [Makefile.in] Bug #1177: fix incorrect path for sshrc in
522 Makefile. Patch from santhi.amirta at gmail, ok djm.
523
52420060820
525 - (dtucker) [log.c] Move ifdef to prevent unused variable warning.
526 - (dtucker) [configure.ac] Save $LIBS during PAM library tests and restore
527 afterward. Removes the need to mangle $LIBS later to remove -lpam and -ldl.
528 - (dtucker) [configure.ac] Relocate --with-pam parts in preparation for
529 fixing bug #1181. No changes yet.
530 - (dtucker) [configure.ac] Bug #1181: Explicitly test to see if OpenSSL
531 (0.9.8a and presumably newer) requires -ldl to successfully link.
532 - (dtucker) [configure.ac] Remove errant "-".
533
53420060819
535 - (djm) OpenBSD CVS Sync
536 - djm@cvs.openbsd.org 2006/08/18 22:41:29
537 [gss-genr.c]
538 GSSAPI error code should be 0 and not -1; from simon@sxw.org.uk
539 - (dtucker) [openbsd-compat/regress/Makefile.in] Add $(EXEEXT) and add a
540 single rule for the test progs.
541
54220060818
543 - (dtucker) [configure.ac openbsd-compat/bsd-closefrom.c] Resync with
544 closefrom.c from sudo.
545 - (dtucker) [openbsd-compat/bsd-closefrom.c] Comment out rcsid.
546 - (dtucker) [openbsd-compat/regress/snprintftest.c] Newline on error.
547 - (dtucker) [openbsd-compat/regress/Makefile.in] Use implicit rules for the
548 test progs instead; they work better than what we have.
549 - (djm) OpenBSD CVS Sync
550 - stevesk@cvs.openbsd.org 2006/08/06 01:13:32
551 [compress.c monitor.c monitor_wrap.c]
552 "zlib.h" can be <zlib.h>; ok djm@ markus@
553 - miod@cvs.openbsd.org 2006/08/12 20:46:46
554 [monitor.c monitor_wrap.c]
555 Revert previous include file ordering change, for ssh to compile under
556 gcc2 (or until openssl include files are cleaned of parameter names
557 in function prototypes)
558 - dtucker@cvs.openbsd.org 2006/08/14 12:40:25
559 [servconf.c servconf.h sshd_config.5]
560 Add ability to match groups to Match keyword in sshd_config. Feedback
561 djm@, stevesk@, ok stevesk@.
562 - djm@cvs.openbsd.org 2006/08/16 11:47:15
563 [sshd.c]
564 factor inetd connection, TCP listen and main TCP accept loop out of
565 main() into separate functions to improve readability; ok markus@
566 - deraadt@cvs.openbsd.org 2006/08/18 09:13:26
567 [log.c log.h sshd.c]
568 make signal handler termination path shorter; risky code pointed out by
569 mark dowd; ok djm markus
570 - markus@cvs.openbsd.org 2006/08/18 09:15:20
571 [auth.h session.c sshd.c]
572 delay authentication related cleanups until we're authenticated and
573 all alarms have been cancelled; ok deraadt
574 - djm@cvs.openbsd.org 2006/08/18 10:27:16
575 [misc.h]
576 reorder so prototypes are sorted by the files they refer to; no
577 binary change
578 - djm@cvs.openbsd.org 2006/08/18 13:54:54
579 [gss-genr.c ssh-gss.h sshconnect2.c]
580 bz #1218 - disable SPNEGO as per RFC4462; diff from simon AT sxw.org.uk
581 ok markus@
582 - djm@cvs.openbsd.org 2006/08/18 14:40:34
583 [gss-genr.c ssh-gss.h]
584 constify host argument to match the rest of the GSSAPI functions and
585 unbreak compilation with -Werror
586 - (djm) Disable sigdie() for platforms that cannot safely syslog inside
587 a signal handler (basically all of them, excepting OpenBSD);
588 ok dtucker@
589
59020060817
591 - (dtucker) [openbsd-compat/fake-rfc2553.c openbsd-compat/setproctitle.c]
592 Include stdlib.h for malloc and friends.
593 - (dtucker) [configure.ac openbsd-compat/bsd-closefrom.c] Use F_CLOSEM fcntl
594 for closefrom() on AIX. Pointed out by William Ahern.
595 - (dtucker) [openbsd-compat/regress/{Makefile.in,closefromtest.c}] Regress
596 test for closefrom() in compat code.
597
59820060816
599 - (djm) [audit-bsm.c] Sprinkle in some headers
600
60120060815
602 - (dtucker) [LICENCE] Add Reyk to the list for the compat dir.
603
60420060806
605 - (djm) [openbsd-compat/bsd-getpeereid.c] Add some headers to quiet warnings
606 on Solaris 10
607
60820060806
609 - (dtucker) [defines.h] With the includes.h changes we no longer get the
610 name clash on "YES" so we can remove the workaround for it.
611 - (dtucker) [openbsd-compat/{bsd-asprintf.c,bsd-openpty.c,bsd-snprintf.c,
612 glob.c}] Include stdlib.h for malloc and friends in compat code.
613
61420060805
615 - (djm) OpenBSD CVS Sync
616 - stevesk@cvs.openbsd.org 2006/07/24 13:58:22
617 [sshconnect.c]
618 disable tunnel forwarding when no strict host key checking
619 and key changed; ok djm@ markus@ dtucker@
620 - stevesk@cvs.openbsd.org 2006/07/25 02:01:34
621 [scard.c]
622 need #include <string.h>
623 - stevesk@cvs.openbsd.org 2006/07/25 02:59:21
624 [channels.c clientloop.c packet.c scp.c serverloop.c sftp-client.c]
625 [sftp-server.c ssh-agent.c ssh-keyscan.c sshconnect.c sshd.c]
626 move #include <sys/time.h> out of includes.h
627 - stevesk@cvs.openbsd.org 2006/07/26 02:35:17
628 [atomicio.c auth.c dh.c authfile.c buffer.c clientloop.c kex.c]
629 [groupaccess.c gss-genr.c kexgexs.c misc.c monitor.c monitor_mm.c]
630 [packet.c scp.c serverloop.c session.c sftp-client.c sftp-common.c]
631 [sftp-server.c sftp.c ssh-add.c ssh-agent.c ssh-keygen.c sshlogin.c]
632 [uidswap.c xmalloc.c]
633 move #include <sys/param.h> out of includes.h
634 - stevesk@cvs.openbsd.org 2006/07/26 13:57:17
635 [authfd.c authfile.c dh.c canohost.c channels.c clientloop.c compat.c]
636 [hostfile.c kex.c log.c misc.c moduli.c monitor.c packet.c readpass.c]
637 [scp.c servconf.c session.c sftp-server.c sftp.c ssh-add.c ssh-agent.c]
638 [ssh-keygen.c ssh-keyscan.c ssh-keysign.c ssh.c sshconnect.c]
639 [sshconnect1.c sshd.c xmalloc.c]
640 move #include <stdlib.h> out of includes.h
641 - jmc@cvs.openbsd.org 2006/07/27 08:00:50
642 [ssh_config.5]
643 avoid confusing wording in HashKnownHosts:
644 originally spotted by alan amesbury;
645 ok deraadt
646 - jmc@cvs.openbsd.org 2006/07/27 08:00:50
647 [ssh_config.5]
648 avoid confusing wording in HashKnownHosts:
649 originally spotted by alan amesbury;
650 ok deraadt
651 - dtucker@cvs.openbsd.org 2006/08/01 11:34:36
652 [sshconnect.c]
653 Allow fallback to known_hosts entries without port qualifiers for
654 non-standard ports too, so that all existing known_hosts entries will be
655 recognised. Requested by, feedback and ok markus@
656 - stevesk@cvs.openbsd.org 2006/08/01 23:22:48
657 [auth-passwd.c auth-rhosts.c auth-rsa.c auth.c auth.h auth1.c]
658 [auth2-chall.c auth2-pubkey.c authfile.c buffer.c canohost.c]
659 [channels.c clientloop.c dh.c dns.c dns.h hostfile.c kex.c kexdhc.c]
660 [kexgexc.c kexgexs.c key.c key.h log.c misc.c misc.h moduli.c]
661 [monitor_wrap.c packet.c progressmeter.c readconf.c readpass.c scp.c]
662 [servconf.c session.c sftp-client.c sftp-common.c sftp-server.c sftp.c]
663 [ssh-add.c ssh-agent.c ssh-keygen.c ssh-keyscan.c ssh.c sshconnect.c]
664 [sshconnect1.c sshconnect2.c sshd.c sshlogin.c sshtty.c uuencode.c]
665 [uuencode.h xmalloc.c]
666 move #include <stdio.h> out of includes.h
667 - stevesk@cvs.openbsd.org 2006/08/01 23:36:12
668 [authfile.c channels.c progressmeter.c scard.c servconf.c ssh.c]
669 clean extra spaces
670 - deraadt@cvs.openbsd.org 2006/08/03 03:34:42
671 [OVERVIEW atomicio.c atomicio.h auth-bsdauth.c auth-chall.c auth-krb5.c]
672 [auth-options.c auth-options.h auth-passwd.c auth-rh-rsa.c auth-rhosts.c]
673 [auth-rsa.c auth-skey.c auth.c auth.h auth1.c auth2-chall.c auth2-gss.c]
674 [auth2-hostbased.c auth2-kbdint.c auth2-none.c auth2-passwd.c ]
675 [auth2-pubkey.c auth2.c authfd.c authfd.h authfile.c bufaux.c bufbn.c]
676 [buffer.c buffer.h canohost.c channels.c channels.h cipher-3des1.c]
677 [cipher-bf1.c cipher-ctr.c cipher.c cleanup.c clientloop.c compat.c]
678 [compress.c deattack.c dh.c dispatch.c dns.c dns.h fatal.c groupaccess.c]
679 [groupaccess.h gss-genr.c gss-serv-krb5.c gss-serv.c hostfile.c kex.c]
680 [kex.h kexdh.c kexdhc.c kexdhs.c kexgex.c kexgexc.c kexgexs.c key.c]
681 [key.h log.c log.h mac.c match.c md-sha256.c misc.c misc.h moduli.c]
682 [monitor.c monitor_fdpass.c monitor_mm.c monitor_mm.h monitor_wrap.c]
683 [monitor_wrap.h msg.c nchan.c packet.c progressmeter.c readconf.c]
684 [readconf.h readpass.c rsa.c scard.c scard.h scp.c servconf.c servconf.h]
685 [serverloop.c session.c session.h sftp-client.c sftp-common.c]
686 [sftp-common.h sftp-glob.c sftp-server.c sftp.c ssh-add.c ssh-agent.c]
687 [ssh-dss.c ssh-gss.h ssh-keygen.c ssh-keyscan.c ssh-keysign.c ssh-rsa.c]
688 [ssh.c ssh.h sshconnect.c sshconnect.h sshconnect1.c sshconnect2.c]
689 [sshd.c sshlogin.c sshlogin.h sshpty.c sshpty.h sshtty.c ttymodes.c]
690 [uidswap.c uidswap.h uuencode.c uuencode.h xmalloc.c xmalloc.h]
691 [loginrec.c loginrec.h openbsd-compat/port-aix.c openbsd-compat/port-tun.h]
692 almost entirely get rid of the culture of ".h files that include .h files"
693 ok djm, sort of ok stevesk
694 makes the pain stop in one easy step
695 NB. portable commit contains everything *except* removing includes.h, as
696 that will take a fair bit more work as we move headers that are required
697 for portability workarounds to defines.h. (also, this step wasn't "easy")
698 - stevesk@cvs.openbsd.org 2006/08/04 20:46:05
699 [monitor.c session.c ssh-agent.c]
700 spaces
701 - (djm) [auth-pam.c defines.h] Move PAM related bits to auth-pam.c
702 - (djm) [auth-pam.c auth.c bufaux.h entropy.c openbsd-compat/port-tun.c]
703 remove last traces of bufaux.h - it was merged into buffer.h in the big
704 includes.h commit
705 - (djm) [auth.c loginrec.c] Missing netinet/in.h for loginrec
706 - (djm) [openbsd-compat/regress/snprintftest.c]
707 [openbsd-compat/regress/strduptest.c] Add missing includes so they pass
708 compilation with "-Wall -Werror"
709 - (djm) [auth-pam.c auth-shadow.c auth2-none.c cleanup.c sshd.c]
710 [openbsd-compat/port-tun.c openbsd-compat/port-tun.h] Sprinkle more
711 includes for Linux in
712 - (dtucker) [cleanup.c] Need defines.h for __dead.
713 - (dtucker) [auth2-gss.c] We still need the #ifdef GSSAPI in -portable.
714 - (dtucker) [openbsd-compat/{bsd-arc4random.c,port-tun.c,xmmap.c}] Lots of
715 #include stdarg.h, needed for log.h.
716 - (dtucker) [entropy.c] Needs unistd.h too.
717 - (dtucker) [ssh-rand-helper.c] Needs stdarg.h for log.h.
718 - (dtucker) [openbsd-compat/getrrsetbyname.c] Nees stdlib.h for malloc.
719 - (dtucker) [openbsd-compat/strtonum.c] Include stdlib.h for strtoll,
720 otherwise it is implicitly declared as returning an int.
721 - (dtucker) OpenBSD CVS Sync
722 - dtucker@cvs.openbsd.org 2006/08/05 07:52:52
723 [auth2-none.c sshd.c monitor_wrap.c]
724 Add headers required to build with KERBEROS5=no. ok djm@
725 - dtucker@cvs.openbsd.org 2006/08/05 08:00:33
726 [auth-skey.c]
727 Add headers required to build with -DSKEY. ok djm@
728 - dtucker@cvs.openbsd.org 2006/08/05 08:28:24
729 [monitor_wrap.c auth-skey.c auth2-chall.c]
730 Zap unused variables in -DSKEY code. ok djm@
731 - dtucker@cvs.openbsd.org 2006/08/05 08:34:04
732 [packet.c]
733 Typo in comment
734 - (dtucker) [openbsd-compat/bsd-cygwin_util.c] Add headers required to compile
735 on Cygwin.
736 - (dtucker) [openbsd-compat/fake-rfc2553.c] Add headers needed for inet_ntoa.
737 - (dtucker) [auth-skey.c] monitor_wrap.h needs ssh-gss.h.
738 - (dtucker) [audit.c audit.h] Repair headers.
739 - (dtucker) [audit-bsm.c] Add additional headers now required.
740
74120060804
742 - (dtucker) [configure.ac] The "crippled AES" test does not work on recent
743 versions of Solaris, so use AC_LINK_IFELSE to actually link the test program
744 rather than just compiling it. Spotted by dlg@.
745
74620060802
747 - (dtucker) [openbsd-compat/daemon.c] Add unistd.h for fork() prototype.
748
74920060725
750 - (dtucker) [openbsd-compat/xmmap.c] Need fcntl.h for O_RDRW.
751
75220060724
753 - (djm) OpenBSD CVS Sync
754 - jmc@cvs.openbsd.org 2006/07/12 13:39:55
755 [sshd_config.5]
756 - new sentence, new line
757 - s/The the/The/
758 - kill a bad comma
759 - stevesk@cvs.openbsd.org 2006/07/12 22:28:52
760 [auth-options.c canohost.c channels.c includes.h readconf.c]
761 [servconf.c ssh-keyscan.c ssh.c sshconnect.c sshd.c]
762 move #include <netdb.h> out of includes.h; ok djm@
763 - stevesk@cvs.openbsd.org 2006/07/12 22:42:32
764 [includes.h ssh.c ssh-rand-helper.c]
765 move #include <stddef.h> out of includes.h
766 - stevesk@cvs.openbsd.org 2006/07/14 01:15:28
767 [monitor_wrap.h]
768 don't need incompletely-typed 'struct passwd' now with
769 #include <pwd.h>; ok markus@
770 - stevesk@cvs.openbsd.org 2006/07/17 01:31:10
771 [authfd.c authfile.c channels.c cleanup.c clientloop.c groupaccess.c]
772 [includes.h log.c misc.c msg.c packet.c progressmeter.c readconf.c]
773 [readpass.c scp.c servconf.c sftp-client.c sftp-server.c sftp.c]
774 [ssh-add.c ssh-agent.c ssh-keygen.c ssh-keyscan.c ssh-keysign.c ssh.c]
775 [sshconnect.c sshlogin.c sshpty.c uidswap.c]
776 move #include <unistd.h> out of includes.h
777 - dtucker@cvs.openbsd.org 2006/07/17 12:02:24
778 [auth-options.c]
779 Use '\0' rather than 0 to terminates strings; ok djm@
780 - dtucker@cvs.openbsd.org 2006/07/17 12:06:00
781 [channels.c channels.h servconf.c sshd_config.5]
782 Add PermitOpen directive to sshd_config which is equivalent to the
783 "permitopen" key option. Allows server admin to allow TCP port
784 forwarding only two specific host/port pairs. Useful when combined
785 with Match.
786 If permitopen is used in both sshd_config and a key option, both
787 must allow a given connection before it will be permitted.
788 Note that users can still use external forwarders such as netcat,
789 so to be those must be controlled too for the limits to be effective.
790 Feedback & ok djm@, man page corrections & ok jmc@.
791 - jmc@cvs.openbsd.org 2006/07/18 07:50:40
792 [sshd_config.5]
793 tweak; ok dtucker
794 - jmc@cvs.openbsd.org 2006/07/18 07:56:28
795 [scp.1]
796 replace DIAGNOSTICS with .Ex;
797 - jmc@cvs.openbsd.org 2006/07/18 08:03:09
798 [ssh-agent.1 sshd_config.5]
799 mark up angle brackets;
800 - dtucker@cvs.openbsd.org 2006/07/18 08:22:23
801 [sshd_config.5]
802 Clarify description of Match, with minor correction from jmc@
803 - stevesk@cvs.openbsd.org 2006/07/18 22:27:55
804 [dh.c]
805 remove unneeded includes; ok djm@
806 - dtucker@cvs.openbsd.org 2006/07/19 08:56:41
807 [servconf.c sshd_config.5]
808 Add support for X11Forwaring, X11DisplayOffset and X11UseLocalhost to
809 Match. ok djm@
810 - dtucker@cvs.openbsd.org 2006/07/19 13:07:10
811 [servconf.c servconf.h session.c sshd.8 sshd_config sshd_config.5]
812 Add ForceCommand keyword to sshd_config, equivalent to the "command="
813 key option, man page entry and example in sshd_config.
814 Feedback & ok djm@, man page corrections & ok jmc@
815 - stevesk@cvs.openbsd.org 2006/07/20 15:26:15
816 [auth1.c serverloop.c session.c sshconnect2.c]
817 missed some needed #include <unistd.h> when KERBEROS5=no; issue from
818 massimo@cedoc.mo.it
819 - dtucker@cvs.openbsd.org 2006/07/21 12:43:36
820 [channels.c channels.h servconf.c servconf.h sshd_config.5]
821 Make PermitOpen take a list of permitted ports and act more like most
822 other keywords (ie the first match is the effective setting). This
823 also makes it easier to override a previously set PermitOpen. ok djm@
824 - stevesk@cvs.openbsd.org 2006/07/21 21:13:30
825 [channels.c]
826 more ARGSUSED (lint) for dispatch table-driven functions; ok djm@
827 - stevesk@cvs.openbsd.org 2006/07/21 21:26:55
828 [progressmeter.c]
829 ARGSUSED for signal handler
830 - stevesk@cvs.openbsd.org 2006/07/22 19:08:54
831 [includes.h moduli.c progressmeter.c scp.c sftp-common.c]
832 [sftp-server.c ssh-agent.c sshlogin.c]
833 move #include <time.h> out of includes.h
834 - stevesk@cvs.openbsd.org 2006/07/22 20:48:23
835 [atomicio.c auth-options.c auth-passwd.c auth-rhosts.c auth-rsa.c]
836 [auth.c auth1.c auth2-chall.c auth2-hostbased.c auth2-passwd.c auth2.c]
837 [authfd.c authfile.c bufaux.c bufbn.c buffer.c canohost.c channels.c]
838 [cipher-3des1.c cipher-bf1.c cipher-ctr.c cipher.c clientloop.c]
839 [compat.c deattack.c dh.c dns.c gss-genr.c gss-serv.c hostfile.c]
840 [includes.h kex.c kexdhc.c kexdhs.c kexgexc.c kexgexs.c key.c log.c]
841 [mac.c match.c md-sha256.c misc.c moduli.c monitor.c monitor_fdpass.c]
842 [monitor_mm.c monitor_wrap.c msg.c nchan.c packet.c rsa.c]
843 [progressmeter.c readconf.c readpass.c scp.c servconf.c serverloop.c]
844 [session.c sftp-client.c sftp-common.c sftp-glob.c sftp-server.c sftp.c]
845 [ssh-add.c ssh-agent.c ssh-dss.c ssh-keygen.c ssh-keyscan.c]
846 [ssh-keysign.c ssh-rsa.c ssh.c sshconnect.c sshconnect1.c sshconnect2.c]
847 [sshd.c sshlogin.c sshpty.c ttymodes.c uidswap.c xmalloc.c]
848 move #include <string.h> out of includes.h
849 - stevesk@cvs.openbsd.org 2006/07/23 01:11:05
850 [auth.h dispatch.c kex.h sftp-client.c]
851 #include <signal.h> for sig_atomic_t; need this prior to <sys/param.h>
852 move
853 - (djm) [acss.c auth-krb5.c auth-options.c auth-pam.c auth-shadow.c]
854 [canohost.c channels.c cipher-acss.c defines.h dns.c gss-genr.c]
855 [gss-serv-krb5.c gss-serv.c log.h loginrec.c logintest.c readconf.c]
856 [servconf.c ssh-keygen.c ssh-keyscan.c ssh-keysign.c ssh-rand-helper.c]
857 [ssh.c sshconnect.c sshd.c openbsd-compat/bindresvport.c]
858 [openbsd-compat/bsd-arc4random.c openbsd-compat/bsd-misc.c]
859 [openbsd-compat/getrrsetbyname.c openbsd-compat/glob.c]
860 [openbsd-compat/mktemp.c openbsd-compat/port-linux.c]
861 [openbsd-compat/port-tun.c openbsd-compat/readpassphrase.c]
862 [openbsd-compat/setproctitle.c openbsd-compat/xmmap.c]
863 make the portable tree compile again - sprinkle unistd.h and string.h
864 back in. Don't redefine __unused, as it turned out to be used in
865 headers on Linux, and replace its use in auth-pam.c with ARGSUSED
866 - (djm) [openbsd-compat/glob.c]
867 Move get_arg_max() into the ifdef HAVE_GLOB block so that it compiles
868 on OpenBSD (or other platforms with a decent glob implementation) with
869 -Werror
870 - (djm) [uuencode.c]
871 Add resolv.h, is it contains the prototypes for __b64_ntop/__b64_pton on
872 some platforms
873 - (djm) [session.c]
874 fix compile error with -Werror -Wall: 'path' is only used in
875 do_setup_env() if HAVE_LOGIN_CAP is not defined
876 - (djm) [openbsd-compat/basename.c openbsd-compat/bsd-closefrom.c]
877 [openbsd-compat/bsd-cray.c openbsd-compat/bsd-openpty.c]
878 [openbsd-compat/bsd-snprintf.c openbsd-compat/fake-rfc2553.c]
879 [openbsd-compat/port-aix.c openbsd-compat/port-irix.c]
880 [openbsd-compat/rresvport.c]
881 These look to need string.h and/or unistd.h (based on a grep for function
882 names)
883 - (djm) [Makefile.in]
884 Remove generated openbsd-compat/regress/Makefile in distclean target
885 - (djm) [regress/Makefile regress/agent-getpeereid.sh regress/cfgmatch.sh]
886 [regress/cipher-speed.sh regress/forcecommand.sh regress/forwarding.sh]
887 Sync regress tests to -current; include dtucker@'s new cfgmatch and
888 forcecommand tests. Add cipher-speed.sh test (not linked in yet)
889 - (dtucker) [cleanup.c] Since config.h defines _LARGE_FILES on AIX, including
890 system headers before defines.h will cause conflicting definitions.
891 - (dtucker) [regress/forcecommand.sh] Portablize.
892
89320060713
894 - (dtucker) [auth-krb5.c auth-pam.c] Still more errno.h
895
89620060712
897 - (dtucker) [configure.ac defines.h] Only define SHUT_RD (and friends) and
898 O_NONBLOCK if they're really needed. Fixes build errors on HP-UX, old
899 Linuxes and probably more.
900 - (dtucker) [configure.ac] OpenBSD needs <sys/types.h> before <sys/socket.h>
901 for SHUT_RD.
902 - (dtucker) [openbsd-compat/port-tun.c] OpenBSD needs <netinet/in.h> before
903 <netinet/ip.h>.
904 - (dtucker) OpenBSD CVS Sync
905 - stevesk@cvs.openbsd.org 2006/07/10 16:01:57
906 [sftp-glob.c sftp-common.h sftp.c]
907 buffer.h only needed in sftp-common.h and remove some unneeded
908 user includes; ok djm@
909 - jmc@cvs.openbsd.org 2006/07/10 16:04:21
910 [sshd.8]
911 s/and and/and/
912 - stevesk@cvs.openbsd.org 2006/07/10 16:37:36
913 [readpass.c log.h scp.c fatal.c xmalloc.c includes.h ssh-keyscan.c misc.c
914 auth.c packet.c log.c]
915 move #include <stdarg.h> out of includes.h; ok markus@
916 - dtucker@cvs.openbsd.org 2006/07/11 10:12:07
917 [ssh.c]
918 Only copy the part of environment variable that we actually use. Prevents
919 ssh bailing when SendEnv is used and an environment variable with a really
920 long value exists. ok djm@
921 - markus@cvs.openbsd.org 2006/07/11 18:50:48
922 [clientloop.c ssh.1 ssh.c channels.c ssh_config.5 readconf.h session.c
923 channels.h readconf.c]
924 add ExitOnForwardFailure: terminate the connection if ssh(1)
925 cannot set up all requested dynamic, local, and remote port
926 forwardings. ok djm, dtucker, stevesk, jmc
927 - stevesk@cvs.openbsd.org 2006/07/11 20:07:25
928 [scp.c auth.c monitor.c serverloop.c sftp-server.c sshpty.c readpass.c
929 sshd.c monitor_wrap.c monitor_fdpass.c ssh-agent.c ttymodes.c atomicio.c
930 includes.h session.c sshlogin.c monitor_mm.c packet.c sshconnect2.c
931 sftp-client.c nchan.c clientloop.c sftp.c misc.c canohost.c channels.c
932 ssh-keygen.c progressmeter.c uidswap.c msg.c readconf.c sshconnect.c]
933 move #include <errno.h> out of includes.h; ok markus@
934 - stevesk@cvs.openbsd.org 2006/07/11 20:16:43
935 [ssh.c]
936 cast asterisk field precision argument to int to remove warning;
937 ok markus@
938 - stevesk@cvs.openbsd.org 2006/07/11 20:27:56
939 [authfile.c ssh.c]
940 need <errno.h> here also (it's also included in <openssl/err.h>)
941 - dtucker@cvs.openbsd.org 2006/07/12 11:34:58
942 [sshd.c servconf.h servconf.c sshd_config.5 auth.c]
943 Add support for conditional directives to sshd_config via a "Match"
944 keyword, which works similarly to the "Host" directive in ssh_config.
945 Lines after a Match line override the default set in the main section
946 if the condition on the Match line is true, eg
947 AllowTcpForwarding yes
948 Match User anoncvs
949 AllowTcpForwarding no
950 will allow port forwarding by all users except "anoncvs".
951 Currently only a very small subset of directives are supported.
952 ok djm@
953 - (dtucker) [loginrec.c openbsd-compat/xmmap.c openbsd-compat/bindresvport.c
954 openbsd-compat/glob.c openbsd-compat/mktemp.c openbsd-compat/port-tun.c
955 openbsd-compat/readpassphrase.c openbsd-compat/strtonum.c] Include <errno.h>.
956 - (dtucker) [openbsd-compat/setproctitle.c] Include stdarg.h.
957 - (dtucker) [ssh-keyscan.c ssh-rand-helper.c] More errno.h here too.
958 - (dtucker) [openbsd-compat/openbsd-compat.h] v*printf needs stdarg.h.
959 - (dtucker) [openbsd-compat/bsd-asprintf.c openbsd-compat/port-aix.c
960 openbsd-compat/rresvport.c] More errno.h.
961
96220060711
963 - (dtucker) [configure.ac ssh-keygen.c openbsd-compat/bsd-openpty.c
964 openbsd-compat/daemon.c] Add includes needed by open(2). Conditionally
965 include paths.h. Fixes build error on Solaris.
966 - (dtucker) [entropy.c] More fcntl.h, this time on AIX (and probably
967 others).
968
96920060710
970 - (dtucker) [INSTALL] New autoconf version: 2.60.
971 - OpenBSD CVS Sync
972 - djm@cvs.openbsd.org 2006/06/14 10:50:42
973 [sshconnect.c]
974 limit the number of pre-banner characters we will accept; ok markus@
975 - djm@cvs.openbsd.org 2006/06/26 10:36:15
976 [clientloop.c]
977 mention optional bind_address in runtime port forwarding setup
978 command-line help. patch from santhi.amirta AT gmail.com
979 - stevesk@cvs.openbsd.org 2006/07/02 17:12:58
980 [ssh.1 ssh.c ssh_config.5 sshd_config.5]
981 more details and clarity for tun(4) device forwarding; ok and help
982 jmc@
983 - stevesk@cvs.openbsd.org 2006/07/02 18:36:47
984 [gss-serv-krb5.c gss-serv.c]
985 no "servconf.h" needed here
986 (gss-serv-krb5.c change not applied, portable needs the server options)
987 - stevesk@cvs.openbsd.org 2006/07/02 22:45:59
988 [groupaccess.c groupaccess.h includes.h session.c sftp-common.c sshpty.c]
989 move #include <grp.h> out of includes.h
990 (portable needed uidswap.c too)
991 - stevesk@cvs.openbsd.org 2006/07/02 23:01:55
992 [clientloop.c ssh.1]
993 use -KR[bind_address:]port here; ok djm@
994 - stevesk@cvs.openbsd.org 2006/07/03 08:54:20
995 [includes.h ssh.c sshconnect.c sshd.c]
996 move #include "version.h" out of includes.h; ok markus@
997 - stevesk@cvs.openbsd.org 2006/07/03 17:59:32
998 [channels.c includes.h]
999 move #include <arpa/inet.h> out of includes.h; old ok djm@
1000 (portable needed session.c too)
1001 - stevesk@cvs.openbsd.org 2006/07/05 02:42:09
1002 [canohost.c hostfile.c includes.h misc.c packet.c readconf.c]
1003 [serverloop.c sshconnect.c uuencode.c]
1004 move #include <netinet/in.h> out of includes.h; ok deraadt@
1005 (also ssh-rand-helper.c logintest.c loginrec.c)
1006 - djm@cvs.openbsd.org 2006/07/06 10:47:05
1007 [servconf.c servconf.h session.c sshd_config.5]
1008 support arguments to Subsystem commands; ok markus@
1009 - djm@cvs.openbsd.org 2006/07/06 10:47:57
1010 [sftp-server.8 sftp-server.c]
1011 add commandline options to enable logging of transactions; ok markus@
1012 - stevesk@cvs.openbsd.org 2006/07/06 16:03:53
1013 [auth-options.c auth-options.h auth-passwd.c auth-rh-rsa.c]
1014 [auth-rhosts.c auth-rsa.c auth.c auth.h auth2-hostbased.c]
1015 [auth2-pubkey.c auth2.c includes.h misc.c misc.h monitor.c]
1016 [monitor_wrap.c monitor_wrap.h scp.c serverloop.c session.c]
1017 [session.h sftp-common.c ssh-add.c ssh-keygen.c ssh-keysign.c]
1018 [ssh.c sshconnect.c sshconnect.h sshd.c sshpty.c sshpty.h uidswap.c]
1019 [uidswap.h]
1020 move #include <pwd.h> out of includes.h; ok markus@
1021 - stevesk@cvs.openbsd.org 2006/07/06 16:22:39
1022 [ssh-keygen.c]
1023 move #include "dns.h" up
1024 - stevesk@cvs.openbsd.org 2006/07/06 17:36:37
1025 [monitor_wrap.h]
1026 typo in comment
1027 - stevesk@cvs.openbsd.org 2006/07/08 21:47:12
1028 [authfd.c canohost.c clientloop.c dns.c dns.h includes.h]
1029 [monitor_fdpass.c nchan.c packet.c servconf.c sftp.c ssh-agent.c]
1030 [ssh-keyscan.c ssh.c sshconnect.h sshd.c sshlogin.h]
1031 move #include <sys/socket.h> out of includes.h
1032 - stevesk@cvs.openbsd.org 2006/07/08 21:48:53
1033 [monitor.c session.c]
1034 missed these from last commit:
1035 move #include <sys/socket.h> out of includes.h
1036 - stevesk@cvs.openbsd.org 2006/07/08 23:30:06
1037 [log.c]
1038 move user includes after /usr/include files
1039 - stevesk@cvs.openbsd.org 2006/07/09 15:15:11
1040 [auth2-none.c authfd.c authfile.c includes.h misc.c monitor.c]
1041 [readpass.c scp.c serverloop.c sftp-client.c sftp-server.c]
1042 [ssh-add.c ssh-agent.c ssh-keygen.c ssh-keysign.c ssh.c sshd.c]
1043 [sshlogin.c sshpty.c]
1044 move #include <fcntl.h> out of includes.h
1045 - stevesk@cvs.openbsd.org 2006/07/09 15:27:59
1046 [ssh-add.c]
1047 use O_RDONLY vs. 0 in open(); no binary change
1048 - djm@cvs.openbsd.org 2006/07/10 11:24:54
1049 [sftp-server.c]
1050 remove optind - it isn't used here
1051 - djm@cvs.openbsd.org 2006/07/10 11:25:53
1052 [sftp-server.c]
1053 don't log variables that aren't yet set
1054 - (djm) [loginrec.c ssh-rand-helper.c sshd.c openbsd-compat/glob.c]
1055 [openbsd-compat/mktemp.c openbsd-compat/openbsd-compat.h]
1056 [openbsd-compat/port-tun.c openbsd-compat/readpassphrase.c]
1057 [openbsd-compat/xcrypt.c] Fix includes.h fallout, mainly fcntl.h
1058 - OpenBSD CVS Sync
1059 - djm@cvs.openbsd.org 2006/07/10 12:03:20
1060 [scp.c]
1061 duplicate argv at the start of main() because it gets modified later;
1062 pointed out by deraadt@ ok markus@
1063 - djm@cvs.openbsd.org 2006/07/10 12:08:08
1064 [channels.c]
1065 fix misparsing of SOCKS 5 packets that could result in a crash;
1066 reported by mk@ ok markus@
1067 - dtucker@cvs.openbsd.org 2006/07/10 12:46:51
1068 [misc.c misc.h sshd.8 sshconnect.c]
1069 Add port identifier to known_hosts for non-default ports, based originally
1070 on a patch from Devin Nate in bz#910.
1071 For any connection using the default port or using a HostKeyAlias the
1072 format is unchanged, otherwise the host name or address is enclosed
1073 within square brackets in the same format as sshd's ListenAddress.
1074 Tested by many, ok markus@.
1075 - (dtucker) [openbsd-compat/openbsd-compat.h] Need to include <sys/socket.h>
1076 for struct sockaddr on platforms that use the fake-rfc stuff.
1077
107820060706
1079 - (dtucker) [configure.ac] Try AIX blibpath test in different order when
1080 compiling with gcc. gcc 4.1.x will accept (but ignore) -b flags so
1081 configure would not select the correct libpath linker flags.
1082 - (dtucker) [INSTALL] A bit more info on autoconf.
1083
108420060705
1085 - (dtucker) [ssh-rand-helper.c] Don't exit if mkdir fails because the
1086 target already exists.
1087
108820060630
1089 - (dtucker) [openbsd-compat/openbsd-compat.h] SNPRINTF_CONST for snprintf
1090 declaration too. Patch from russ at sludge.net.
1091 - (dtucker) [openbsd-compat/getrrsetbyname.c] Undef _res before defining it,
1092 prevents warnings on platforms where _res is in the system headers.
1093 - (dtucker) [INSTALL] Bug #1202: Note when autoconf is required and which
1094 version.
1095
109620060627
1097 - (dtucker) [configure.ac] Bug #1203: Add missing '[', which causes problems
1098 with autoconf 2.60. Patch from vapier at gentoo.org.
1099
110020060625
1101 - (dtucker) [channels.c serverloop.c] Apply the bug #1102 workaround to ptys
1102 only, otherwise sshd can hang exiting non-interactive sessions.
1103
110420060624
1105 - (dtucker) [configure.ac] Bug #1193: Define PASSWD_NEEDS_USERNAME on Solaris.
1106 Works around limitation in Solaris' passwd program for changing passwords
1107 where the username is longer than 8 characters. ok djm@
1108 - (dtucker) [serverloop.c] Get ifdef/ifndef the right way around for the bug
1109 #1102 workaround.
1110
111120060623
1112 - (dtucker) [README.platform configure.ac openbsd-compat/port-tun.c] Add
1113 tunnel support for Mac OS X/Darwin via a third-party tun driver. Patch
1114 from reyk@, tested by anil@
1115 - (dtucker) [channels.c configure.ac serverloop.c] Bug #1102: Around AIX
1116 4.3.3 ML3 or so, the AIX pty layer starting passing zero-length writes
1117 on the pty slave as zero-length reads on the pty master, which sshd
1118 interprets as the descriptor closing. Since most things don't do zero
1119 length writes this rarely matters, but occasionally it happens, and when
1120 it does the SSH pty session appears to hang, so we add a special case for
1121 this condition. ok djm@
1122
112320060613
1124 - (djm) [getput.h] This file has been replaced by functions in misc.c
1125 - OpenBSD CVS Sync
1126 - djm@cvs.openbsd.org 2006/05/08 10:49:48
1127 [sshconnect2.c]
1128 uint32_t -> u_int32_t (which we use everywhere else)
1129 (Id sync only - portable already had this)
1130 - markus@cvs.openbsd.org 2006/05/16 09:00:00
1131 [clientloop.c]
1132 missing free; from Kylene Hall
1133 - markus@cvs.openbsd.org 2006/05/17 12:43:34
1134 [scp.c sftp.c ssh-agent.c ssh-keygen.c sshconnect.c]
1135 fix leak; coverity via Kylene Jo Hall
1136 - miod@cvs.openbsd.org 2006/05/18 21:27:25
1137 [kexdhc.c kexgexc.c]
1138 paramter -> parameter
1139 - dtucker@cvs.openbsd.org 2006/05/29 12:54:08
1140 [ssh_config.5]
1141 Add gssapi-with-mic to PreferredAuthentications default list; ok jmc
1142 - dtucker@cvs.openbsd.org 2006/05/29 12:56:33
1143 [ssh_config]
1144 Add GSSAPIAuthentication and GSSAPIDelegateCredentials to examples in
1145 sample ssh_config. ok markus@
1146 - jmc@cvs.openbsd.org 2006/05/29 16:10:03
1147 [ssh_config.5]
1148 oops - previous was too long; split the list of auths up
1149 - mk@cvs.openbsd.org 2006/05/30 11:46:38
1150 [ssh-add.c]
1151 Sync usage() with man page and reality.
1152 ok deraadt dtucker
1153 - jmc@cvs.openbsd.org 2006/05/29 16:13:23
1154 [ssh.1]
1155 add GSSAPI to the list of authentication methods supported;
1156 - mk@cvs.openbsd.org 2006/05/30 11:46:38
1157 [ssh-add.c]
1158 Sync usage() with man page and reality.
1159 ok deraadt dtucker
1160 - markus@cvs.openbsd.org 2006/06/01 09:21:48
1161 [sshd.c]
1162 call get_remote_ipaddr() early; fixes logging after client disconnects;
1163 report mpf@; ok dtucker@
1164 - markus@cvs.openbsd.org 2006/06/06 10:20:20
1165 [readpass.c sshconnect.c sshconnect.h sshconnect2.c uidswap.c]
1166 replace remaining setuid() calls with permanently_set_uid() and
1167 check seteuid() return values; report Marcus Meissner; ok dtucker djm
1168 - markus@cvs.openbsd.org 2006/06/08 14:45:49
1169 [readpass.c sshconnect.c sshconnect2.c uidswap.c uidswap.h]
1170 do not set the gid, noted by solar; ok djm
1171 - djm@cvs.openbsd.org 2006/06/13 01:18:36
1172 [ssh-agent.c]
1173 always use a format string, even when printing a constant
1174 - djm@cvs.openbsd.org 2006/06/13 02:17:07
1175 [ssh-agent.c]
1176 revert; i am on drugs. spotted by alexander AT beard.se
1177
117820060521
1179 - (dtucker) [auth.c monitor.c] Now that we don't log from both the monitor
1180 and slave, we can remove the special-case handling in the audit hook in
1181 auth_log.
1182
118320060517
1184 - (dtucker) [ssh-rand-helper.c] Check return code of mkdir and fix file
1185 pointer leak. From kjhall at us.ibm.com, found by coverity.
1186
118720060515
1188 - (dtucker) [openbsd-compat/getrrsetbyname.c] Use _compat_res instead of
1189 _res, prevents problems on some platforms that have _res as a global but
1190 don't have getrrsetbyname(), eg IRIX 5.3. Found and tested by
1191 georg.schwarz at freenet.de, ok djm@.
1192 - (dtucker) [defines.h] Find a value for IOV_MAX or use a conservative
1193 default. Patch originally from tim@, ok djm
1194 - (dtucker) [auth-pam.c] Bug #1188: pass result of do_pam_account back and
1195 do not allow kbdint again after the PAM account check fails. ok djm@
1196
119720060506
1198 - (dtucker) OpenBSD CVS Sync
1199 - dtucker@cvs.openbsd.org 2006/04/25 08:02:27
1200 [authfile.c authfile.h sshconnect2.c ssh.c sshconnect1.c]
1201 Prevent ssh from trying to open private keys with bad permissions more than
1202 once or prompting for their passphrases (which it subsequently ignores
1203 anyway), similar to a previous change in ssh-add. bz #1186, ok djm@
1204 - djm@cvs.openbsd.org 2006/05/04 14:55:23
1205 [dh.c]
1206 tighter DH exponent checks here too; feedback and ok markus@
1207 - djm@cvs.openbsd.org 2006/04/01 05:37:46
1208 [OVERVIEW]
1209 $OpenBSD$ in here too
1210 - dtucker@cvs.openbsd.org 2006/05/06 08:35:40
1211 [auth-krb5.c]
1212 Add $OpenBSD$ in comment here too
1213
121420060504
1215 - (dtucker) [auth-pam.c groupaccess.c monitor.c monitor_wrap.c scard-opensc.c
1216 session.c ssh-rand-helper.c sshd.c openbsd-compat/bsd-cygwin_util.c
1217 openbsd-compat/setproctitle.c] Convert malloc(foo*bar) -> calloc(foo,bar)
1218 in Portable-only code; since calloc zeros, remove now-redundant memsets.
1219 Also add a couple of sanity checks. With & ok djm@
1220
122120060503
1222 - (dtucker) [packet.c] Remove in_systm.h since it's also in includes.h
1223 and double including it on IRIX 5.3 causes problems. From Georg Schwarz,
1224 "no objections" tim@
1225
122620060423
1227 - (djm) OpenBSD CVS Sync
1228 - deraadt@cvs.openbsd.org 2006/04/01 05:42:20
1229 [scp.c]
1230 minimal lint cleanup (unused crud, and some size_t); ok djm
1231 - djm@cvs.openbsd.org 2006/04/01 05:50:29
1232 [scp.c]
1233 xasprintification; ok deraadt@
1234 - djm@cvs.openbsd.org 2006/04/01 05:51:34
1235 [atomicio.c]
1236 ANSIfy; requested deraadt@
1237 - dtucker@cvs.openbsd.org 2006/04/02 08:34:52
1238 [ssh-keysign.c]
1239 sessionid can be 32 bytes now too when sha256 kex is used; ok djm@
1240 - djm@cvs.openbsd.org 2006/04/03 07:10:38
1241 [gss-genr.c]
1242 GSSAPI buffers shouldn't be nul-terminated, spotted in bugzilla #1066
1243 by dleonard AT vintela.com. use xasprintf() to simplify code while in
1244 there; "looks right" deraadt@
1245 - djm@cvs.openbsd.org 2006/04/16 00:48:52
1246 [buffer.c buffer.h channels.c]
1247 Fix condition where we could exit with a fatal error when an input
1248 buffer became too large and the remote end had advertised a big window.
1249 The problem was a mismatch in the backoff math between the channels code
1250 and the buffer code, so make a buffer_check_alloc() function that the
1251 channels code can use to propsectivly check whether an incremental
1252 allocation will succeed. bz #1131, debugged with the assistance of
1253 cove AT wildpackets.com; ok dtucker@ deraadt@
1254 - djm@cvs.openbsd.org 2006/04/16 00:52:55
1255 [atomicio.c atomicio.h]
1256 introduce atomiciov() function that wraps readv/writev to retry
1257 interrupted transfers like atomicio() does for read/write;
1258 feedback deraadt@ dtucker@ stevesk@ ok deraadt@
1259 - djm@cvs.openbsd.org 2006/04/16 00:54:10
1260 [sftp-client.c]
1261 avoid making a tiny 4-byte write to send the packet length of sftp
1262 commands, which would result in a separate tiny packet on the wire by
1263 using atomiciov(writev, ...) to write the length and the command in one
1264 pass; ok deraadt@
1265 - djm@cvs.openbsd.org 2006/04/16 07:59:00
1266 [atomicio.c]
1267 reorder sanity test so that it cannot dereference past the end of the
1268 iov array; well spotted canacar@!
1269 - dtucker@cvs.openbsd.org 2006/04/18 10:44:28
1270 [bufaux.c bufbn.c Makefile.in]
1271 Move Buffer bignum functions into their own file, bufbn.c. This means
1272 that sftp and sftp-server (which use the Buffer functions in bufaux.c
1273 but not the bignum ones) no longer need to be linked with libcrypto.
1274 ok markus@
1275 - djm@cvs.openbsd.org 2006/04/20 09:27:09
1276 [auth.h clientloop.c dispatch.c dispatch.h kex.h]
1277 replace the last non-sig_atomic_t flag used in a signal handler with a
1278 sig_atomic_t, unfortunately with some knock-on effects in other (non-
1279 signal) contexts in which it is used; ok markus@
1280 - markus@cvs.openbsd.org 2006/04/20 09:47:59
1281 [sshconnect.c]
1282 simplify; ok djm@
1283 - djm@cvs.openbsd.org 2006/04/20 21:53:44
1284 [includes.h session.c sftp.c]
1285 Switch from using pipes to socketpairs for communication between
1286 sftp/scp and ssh, and between sshd and its subprocesses. This saves
1287 a file descriptor per session and apparently makes userland ppp over
1288 ssh work; ok markus@ deraadt@ (ID Sync only - portable makes this
1289 decision on a per-platform basis)
1290 - djm@cvs.openbsd.org 2006/04/22 04:06:51
1291 [uidswap.c]
1292 use setres[ug]id() to permanently revoke privileges; ok deraadt@
1293 (ID Sync only - portable already uses setres[ug]id() whenever possible)
1294 - stevesk@cvs.openbsd.org 2006/04/22 18:29:33
1295 [crc32.c]
1296 remove extra spaces
1297 - (djm) [auth.h dispatch.h kex.h] sprinkle in signal.h to get
1298 sig_atomic_t
1299
130020060421
1301 - (djm) [Makefile.in configure.ac session.c sshpty.c]
1302 [contrib/redhat/sshd.init openbsd-compat/Makefile.in]
1303 [openbsd-compat/openbsd-compat.h openbsd-compat/port-linux.c]
1304 [openbsd-compat/port-linux.h] Add support for SELinux, setting
1305 the execution and TTY contexts. based on patch from Daniel Walsh,
1306 bz #880; ok dtucker@
1307
130820060418
1309 - (djm) [canohost.c] Reorder IP options check so that it isn't broken
1310 by mapped addresses; bz #1179 reported by markw wtech-llc.com;
1311 ok dtucker@
1312
131320060331
1314 - OpenBSD CVS Sync
1315 - deraadt@cvs.openbsd.org 2006/03/27 01:21:18
1316 [xmalloc.c]
1317 we can do the size & nmemb check before the integer overflow check;
1318 evol
1319 - deraadt@cvs.openbsd.org 2006/03/27 13:03:54
1320 [dh.c]
1321 use strtonum() instead of atoi(), limit dhg size to 64k; ok djm
1322 - djm@cvs.openbsd.org 2006/03/27 23:15:46
1323 [sftp.c]
1324 always use a format string for addargs; spotted by mouring@
1325 - deraadt@cvs.openbsd.org 2006/03/28 00:12:31
1326 [README.tun ssh.c]
1327 spacing
1328 - deraadt@cvs.openbsd.org 2006/03/28 01:52:28
1329 [channels.c]
1330 do not accept unreasonable X ports numbers; ok djm
1331 - deraadt@cvs.openbsd.org 2006/03/28 01:53:43
1332 [ssh-agent.c]
1333 use strtonum() to parse the pid from the file, and range check it
1334 better; ok djm
1335 - djm@cvs.openbsd.org 2006/03/30 09:41:25
1336 [channels.c]
1337 ARGSUSED for dispatch table-driven functions
1338 - djm@cvs.openbsd.org 2006/03/30 09:58:16
1339 [authfd.c bufaux.c deattack.c gss-serv.c mac.c misc.c misc.h]
1340 [monitor_wrap.c msg.c packet.c sftp-client.c sftp-server.c ssh-agent.c]
1341 replace {GET,PUT}_XXBIT macros with functionally similar functions,
1342 silencing a heap of lint warnings. also allows them to use
1343 __bounded__ checking which can't be applied to macros; requested
1344 by and feedback from deraadt@
1345 - djm@cvs.openbsd.org 2006/03/30 10:41:25
1346 [ssh.c ssh_config.5]
1347 add percent escape chars to the IdentityFile option, bz #1159 based
1348 on a patch by imaging AT math.ualberta.ca; feedback and ok dtucker@
1349 - dtucker@cvs.openbsd.org 2006/03/30 11:05:17
1350 [ssh-keygen.c]
1351 Correctly handle truncated files while converting keys; ok djm@
1352 - dtucker@cvs.openbsd.org 2006/03/30 11:40:21
1353 [auth.c monitor.c]
1354 Prevent duplicate log messages when privsep=yes; ok djm@
1355 - jmc@cvs.openbsd.org 2006/03/31 09:09:30
1356 [ssh_config.5]
1357 kill trailing whitespace;
1358 - djm@cvs.openbsd.org 2006/03/31 09:13:56
1359 [ssh_config.5]
1360 remote user escape is %r not %h; spotted by jmc@
1361
136220060326
1363 - OpenBSD CVS Sync
1364 - jakob@cvs.openbsd.org 2006/03/15 08:46:44
1365 [ssh-keygen.c]
1366 if no key file are given when printing the DNS host record, use the
1367 host key file(s) as default. ok djm@
1368 - biorn@cvs.openbsd.org 2006/03/16 10:31:45
1369 [scp.c]
1370 Try to display errormessage even if remout == -1
1371 ok djm@, markus@
1372 - djm@cvs.openbsd.org 2006/03/17 22:31:50
1373 [authfd.c]
1374 another unreachable found by lint
1375 - djm@cvs.openbsd.org 2006/03/17 22:31:11
1376 [authfd.c]
1377 unreachanble statement, found by lint
1378 - djm@cvs.openbsd.org 2006/03/19 02:22:32
1379 [serverloop.c]
1380 memory leaks detected by Coverity via elad AT netbsd.org;
1381 ok deraadt@ dtucker@
1382 - djm@cvs.openbsd.org 2006/03/19 02:22:56
1383 [sftp.c]
1384 more memory leaks detected by Coverity via elad AT netbsd.org;
1385 deraadt@ ok
1386 - djm@cvs.openbsd.org 2006/03/19 02:23:26
1387 [hostfile.c]
1388 FILE* leak detected by Coverity via elad AT netbsd.org;
1389 ok deraadt@
1390 - djm@cvs.openbsd.org 2006/03/19 02:24:05
1391 [dh.c readconf.c servconf.c]
1392 potential NULL pointer dereferences detected by Coverity
1393 via elad AT netbsd.org; ok deraadt@
1394 - djm@cvs.openbsd.org 2006/03/19 07:41:30
1395 [sshconnect2.c]
1396 memory leaks detected by Coverity via elad AT netbsd.org;
1397 deraadt@ ok
1398 - dtucker@cvs.openbsd.org 2006/03/19 11:51:52
1399 [servconf.c]
1400 Correct strdelim null test; ok djm@
1401 - deraadt@cvs.openbsd.org 2006/03/19 18:52:11
1402 [auth1.c authfd.c channels.c]
1403 spacing
1404 - deraadt@cvs.openbsd.org 2006/03/19 18:53:12
1405 [kex.c kex.h monitor.c myproposal.h session.c]
1406 spacing
1407 - deraadt@cvs.openbsd.org 2006/03/19 18:56:41
1408 [clientloop.c progressmeter.c serverloop.c sshd.c]
1409 ARGSUSED for signal handlers
1410 - deraadt@cvs.openbsd.org 2006/03/19 18:59:49
1411 [ssh-keyscan.c]
1412 please lint
1413 - deraadt@cvs.openbsd.org 2006/03/19 18:59:30
1414 [ssh.c]
1415 spacing
1416 - deraadt@cvs.openbsd.org 2006/03/19 18:59:09
1417 [authfile.c]
1418 whoever thought that break after return was a good idea needs to
1419 get their head examimed
1420 - djm@cvs.openbsd.org 2006/03/20 04:09:44
1421 [monitor.c]
1422 memory leaks detected by Coverity via elad AT netbsd.org;
1423 deraadt@ ok
1424 that should be all of them now
1425 - djm@cvs.openbsd.org 2006/03/20 11:38:46
1426 [key.c]
1427 (really) last of the Coverity diffs: avoid possible NULL deref in
1428 key_free. via elad AT netbsd.org; markus@ ok
1429 - deraadt@cvs.openbsd.org 2006/03/20 17:10:19
1430 [auth.c key.c misc.c packet.c ssh-add.c]
1431 in a switch (), break after return or goto is stupid
1432 - deraadt@cvs.openbsd.org 2006/03/20 17:13:16
1433 [key.c]
1434 djm did a typo
1435 - deraadt@cvs.openbsd.org 2006/03/20 17:17:23
1436 [ssh-rsa.c]
1437 in a switch (), break after return or goto is stupid
1438 - deraadt@cvs.openbsd.org 2006/03/20 18:14:02
1439 [channels.c clientloop.c monitor_wrap.c monitor_wrap.h serverloop.c]
1440 [ssh.c sshpty.c sshpty.h]
1441 sprinkle u_int throughout pty subsystem, ok markus
1442 - deraadt@cvs.openbsd.org 2006/03/20 18:17:20
1443 [auth1.c auth2.c sshd.c]
1444 sprinkle some ARGSUSED for table driven functions (which sometimes
1445 must ignore their args)
1446 - deraadt@cvs.openbsd.org 2006/03/20 18:26:55
1447 [channels.c monitor.c session.c session.h ssh-agent.c ssh-keygen.c]
1448 [ssh-rsa.c ssh.c sshlogin.c]
1449 annoying spacing fixes getting in the way of real diffs
1450 - deraadt@cvs.openbsd.org 2006/03/20 18:27:50
1451 [monitor.c]
1452 spacing
1453 - deraadt@cvs.openbsd.org 2006/03/20 18:35:12
1454 [channels.c]
1455 x11_fake_data is only ever used as u_char *
1456 - deraadt@cvs.openbsd.org 2006/03/20 18:41:43
1457 [dns.c]
1458 cast xstrdup to propert u_char *
1459 - deraadt@cvs.openbsd.org 2006/03/20 18:42:27
1460 [canohost.c match.c ssh.c sshconnect.c]
1461 be strict with tolower() casting
1462 - deraadt@cvs.openbsd.org 2006/03/20 18:48:34
1463 [channels.c fatal.c kex.c packet.c serverloop.c]
1464 spacing
1465 - deraadt@cvs.openbsd.org 2006/03/20 21:11:53
1466 [ttymodes.c]
1467 spacing
1468 - djm@cvs.openbsd.org 2006/03/25 00:05:41
1469 [auth-bsdauth.c auth-skey.c auth.c auth2-chall.c channels.c]
1470 [clientloop.c deattack.c gss-genr.c kex.c key.c misc.c moduli.c]
1471 [monitor.c monitor_wrap.c packet.c scard.c sftp-server.c ssh-agent.c]
1472 [ssh-keyscan.c ssh.c sshconnect.c sshconnect2.c sshd.c uuencode.c]
1473 [xmalloc.c xmalloc.h]
1474 introduce xcalloc() and xasprintf() failure-checked allocations
1475 functions and use them throughout openssh
1476
1477 xcalloc is particularly important because malloc(nmemb * size) is a
1478 dangerous idiom (subject to integer overflow) and it is time for it
1479 to die
1480
1481 feedback and ok deraadt@
1482 - djm@cvs.openbsd.org 2006/03/25 01:13:23
1483 [buffer.c channels.c deattack.c misc.c scp.c session.c sftp-client.c]
1484 [sftp-server.c ssh-agent.c ssh-rsa.c xmalloc.c xmalloc.h auth-pam.c]
1485 [uidswap.c]
1486 change OpenSSH's xrealloc() function from being xrealloc(p, new_size)
1487 to xrealloc(p, new_nmemb, new_itemsize).
1488
1489 realloc is particularly prone to integer overflows because it is
1490 almost always allocating "n * size" bytes, so this is a far safer
1491 API; ok deraadt@
1492 - djm@cvs.openbsd.org 2006/03/25 01:30:23
1493 [sftp.c]
1494 "abormally" is a perfectly cromulent word, but "abnormally" is better
1495 - djm@cvs.openbsd.org 2006/03/25 13:17:03
1496 [atomicio.c auth-bsdauth.c auth-chall.c auth-options.c auth-passwd.c]
1497 [auth-rh-rsa.c auth-rhosts.c auth-rsa.c auth-skey.c auth.c auth1.c]
1498 [auth2-chall.c auth2-hostbased.c auth2-kbdint.c auth2-none.c]
1499 [auth2-passwd.c auth2-pubkey.c auth2.c authfd.c authfile.c bufaux.c]
1500 [buffer.c canohost.c channels.c cipher-3des1.c cipher-bf1.c]
1501 [cipher-ctr.c cipher.c cleanup.c clientloop.c compat.c compress.c]
1502 [deattack.c dh.c dispatch.c fatal.c groupaccess.c hostfile.c kex.c]
1503 [kexdh.c kexdhc.c kexdhs.c kexgex.c kexgexc.c kexgexs.c key.c log.c]
1504 [mac.c match.c md-sha256.c misc.c monitor.c monitor_fdpass.c]
1505 [monitor_mm.c monitor_wrap.c msg.c nchan.c packet.c progressmeter.c]
1506 [readconf.c readpass.c rsa.c scard.c scp.c servconf.c serverloop.c]
1507 [session.c sftp-client.c sftp-common.c sftp-glob.c sftp-server.c]
1508 [sftp.c ssh-add.c ssh-agent.c ssh-dss.c ssh-keygen.c ssh-keyscan.c]
1509 [ssh-keysign.c ssh-rsa.c ssh.c sshconnect.c sshconnect1.c]
1510 [sshconnect2.c sshd.c sshlogin.c sshpty.c sshtty.c ttymodes.c]
1511 [uidswap.c uuencode.c xmalloc.c]
1512 Put $OpenBSD$ tags back (as comments) to replace the RCSID()s that
1513 Theo nuked - our scripts to sync -portable need them in the files
1514 - deraadt@cvs.openbsd.org 2006/03/25 18:29:35
1515 [auth-rsa.c authfd.c packet.c]
1516 needed casts (always will be needed)
1517 - deraadt@cvs.openbsd.org 2006/03/25 18:30:55
1518 [clientloop.c serverloop.c]
1519 spacing
1520 - deraadt@cvs.openbsd.org 2006/03/25 18:36:15
1521 [sshlogin.c sshlogin.h]
1522 nicer size_t and time_t types
1523 - deraadt@cvs.openbsd.org 2006/03/25 18:40:14
1524 [ssh-keygen.c]
1525 cast strtonum() result to right type
1526 - deraadt@cvs.openbsd.org 2006/03/25 18:41:45
1527 [ssh-agent.c]
1528 mark two more signal handlers ARGSUSED
1529 - deraadt@cvs.openbsd.org 2006/03/25 18:43:30
1530 [channels.c]
1531 use strtonum() instead of atoi() [limit X screens to 400, sorry]
1532 - deraadt@cvs.openbsd.org 2006/03/25 18:56:55
1533 [bufaux.c channels.c packet.c]
1534 remove (char *) casts to a function that accepts void * for the arg
1535 - deraadt@cvs.openbsd.org 2006/03/25 18:58:10
1536 [channels.c]
1537 delete cast not required
1538 - djm@cvs.openbsd.org 2006/03/25 22:22:43
1539 [atomicio.h auth-options.h auth.h auth2-gss.c authfd.h authfile.h]
1540 [bufaux.h buffer.h canohost.h channels.h cipher.h clientloop.h]
1541 [compat.h compress.h crc32.c crc32.h deattack.h dh.h dispatch.h]
1542 [dns.c dns.h getput.h groupaccess.h gss-genr.c gss-serv-krb5.c]
1543 [gss-serv.c hostfile.h includes.h kex.h key.h log.h mac.h match.h]
1544 [misc.h monitor.h monitor_fdpass.h monitor_mm.h monitor_wrap.h msg.h]
1545 [myproposal.h packet.h pathnames.h progressmeter.h readconf.h rsa.h]
1546 [scard.h servconf.h serverloop.h session.h sftp-common.h sftp.h]
1547 [ssh-gss.h ssh.h ssh1.h ssh2.h sshconnect.h sshlogin.h sshpty.h]
1548 [ttymodes.h uidswap.h uuencode.h xmalloc.h]
1549 standardise spacing in $OpenBSD$ tags; requested by deraadt@
1550 - deraadt@cvs.openbsd.org 2006/03/26 01:31:48
1551 [uuencode.c]
1552 typo
1553
155420060325
1555 - OpenBSD CVS Sync
1556 - djm@cvs.openbsd.org 2006/03/16 04:24:42
1557 [ssh.1]
1558 Add RFC4419 (Diffie-Hellman group exchange KEX) to the list of SSH RFCs
1559 that OpenSSH supports
1560 - deraadt@cvs.openbsd.org 2006/03/19 18:51:18
1561 [atomicio.c auth-bsdauth.c auth-chall.c auth-krb5.c auth-options.c]
1562 [auth-pam.c auth-passwd.c auth-rh-rsa.c auth-rhosts.c auth-rsa.c]
1563 [auth-shadow.c auth-skey.c auth.c auth1.c auth2-chall.c]
1564 [auth2-hostbased.c auth2-kbdint.c auth2-none.c auth2-passwd.c]
1565 [auth2-pubkey.c auth2.c authfd.c authfile.c bufaux.c buffer.c]
1566 [canohost.c channels.c cipher-3des1.c cipher-acss.c cipher-aes.c]
1567 [cipher-bf1.c cipher-ctr.c cipher.c cleanup.c clientloop.c compat.c]
1568 [compress.c deattack.c dh.c dispatch.c dns.c entropy.c fatal.c]
1569 [groupaccess.c hostfile.c includes.h kex.c kexdh.c kexdhc.c]
1570 [kexdhs.c kexgex.c kexgexc.c kexgexs.c key.c log.c loginrec.c]
1571 [loginrec.h logintest.c mac.c match.c md-sha256.c md5crypt.c misc.c]
1572 [monitor.c monitor_fdpass.c monitor_mm.c monitor_wrap.c msg.c]
1573 [nchan.c packet.c progressmeter.c readconf.c readpass.c rsa.c]
1574 [scard.c scp.c servconf.c serverloop.c session.c sftp-client.c]
1575 [sftp-common.c sftp-glob.c sftp-server.c sftp.c ssh-add.c]
1576 [ssh-agent.c ssh-dss.c ssh-keygen.c ssh-keyscan.c ssh-keysign.c]
1577 [ssh-rand-helper.c ssh-rsa.c ssh.c sshconnect.c sshconnect1.c]
1578 [sshconnect2.c sshd.c sshlogin.c sshpty.c sshtty.c ttymodes.c]
1579 [uidswap.c uuencode.c xmalloc.c openbsd-compat/bsd-arc4random.c]
1580 [openbsd-compat/bsd-closefrom.c openbsd-compat/bsd-cygwin_util.c]
1581 [openbsd-compat/bsd-getpeereid.c openbsd-compat/bsd-misc.c]
1582 [openbsd-compat/bsd-nextstep.c openbsd-compat/bsd-snprintf.c]
1583 [openbsd-compat/bsd-waitpid.c openbsd-compat/fake-rfc2553.c]
1584 RCSID() can die
1585 - deraadt@cvs.openbsd.org 2006/03/19 18:53:12
1586 [kex.h myproposal.h]
1587 spacing
1588 - djm@cvs.openbsd.org 2006/03/20 04:07:22
1589 [auth2-gss.c]
1590 GSSAPI related leaks detected by Coverity via elad AT netbsd.org;
1591 reviewed by simon AT sxw.org.uk; deraadt@ ok
1592 - djm@cvs.openbsd.org 2006/03/20 04:07:49
1593 [gss-genr.c]
1594 more GSSAPI related leaks detected by Coverity via elad AT netbsd.org;
1595 reviewed by simon AT sxw.org.uk; deraadt@ ok
1596 - djm@cvs.openbsd.org 2006/03/20 04:08:18
1597 [gss-serv.c]
1598 last lot of GSSAPI related leaks detected by Coverity via
1599 elad AT netbsd.org; reviewed by simon AT sxw.org.uk; deraadt@ ok
1600 - deraadt@cvs.openbsd.org 2006/03/20 18:14:02
1601 [monitor_wrap.h sshpty.h]
1602 sprinkle u_int throughout pty subsystem, ok markus
1603 - deraadt@cvs.openbsd.org 2006/03/20 18:26:55
1604 [session.h]
1605 annoying spacing fixes getting in the way of real diffs
1606 - deraadt@cvs.openbsd.org 2006/03/20 18:41:43
1607 [dns.c]
1608 cast xstrdup to propert u_char *
1609 - jakob@cvs.openbsd.org 2006/03/22 21:16:24
1610 [ssh.1]
1611 simplify SSHFP example; ok jmc@
1612 - djm@cvs.openbsd.org 2006/03/22 21:27:15
1613 [deattack.c deattack.h]
1614 remove IV support from the CRC attack detector, OpenSSH has never used
1615 it - it only applied to IDEA-CFB, which we don't support.
1616 prompted by NetBSD Coverity report via elad AT netbsd.org;
1617 feedback markus@ "nuke it" deraadt@
1618
161920060318
1620 - (djm) [auth-pam.c] Fix memleak in error path, from Coverity via
1621 elad AT NetBSD.org
1622 - (dtucker) [openbsd-compat/bsd-snprintf.c] Bug #1173: make fmtint() take
1623 a LLONG rather than a long. Fixes scp'ing of large files on platforms
1624 with missing/broken snprintfs. Patch from e.borovac at bom.gov.au.
1625
162620060316
1627 - (dtucker) [entropy.c] Add headers for WIFEXITED and friends.
1628 - (dtucker) [configure.ac md-sha256.c] NetBSD has sha2.h in
1629 /usr/include/crypto. Hint from djm@.
1630 - (tim) [kex.c myproposal.h md-sha256.c openbsd-compat/sha2.c,h]
1631 Disable sha256 when openssl < 0.9.7. Patch from djm@.
1632 - (djm) [kex.c] Slightly more clean deactivation of dhgex-sha256 on old
1633 OpenSSL; ok tim
1634
163520060315
1636 - (djm) OpenBSD CVS Sync:
1637 - msf@cvs.openbsd.org 2006/02/06 15:54:07
1638 [ssh.1]
1639 - typo fix
1640 ok jmc@
1641 - jmc@cvs.openbsd.org 2006/02/06 21:44:47
1642 [ssh.1]
1643 make this a little less ambiguous...
1644 - stevesk@cvs.openbsd.org 2006/02/07 01:08:04
1645 [auth-rhosts.c includes.h]
1646 move #include <netgroup.h> out of includes.h; ok markus@
1647 - stevesk@cvs.openbsd.org 2006/02/07 01:18:09
1648 [includes.h ssh-agent.c ssh-keyscan.c sshconnect2.c]
1649 move #include <sys/queue.h> out of includes.h; ok markus@
1650 - stevesk@cvs.openbsd.org 2006/02/07 01:42:00
1651 [channels.c clientloop.c clientloop.h includes.h packet.h]
1652 [serverloop.c sshpty.c sshpty.h sshtty.c ttymodes.c]
1653 move #include <termios.h> out of includes.h; ok markus@
1654 - stevesk@cvs.openbsd.org 2006/02/07 01:52:50
1655 [sshtty.c]
1656 "log.h" not needed
1657 - stevesk@cvs.openbsd.org 2006/02/07 03:47:05
1658 [hostfile.c]
1659 "packet.h" not needed
1660 - stevesk@cvs.openbsd.org 2006/02/07 03:59:20
1661 [deattack.c]
1662 duplicate #include
1663 - stevesk@cvs.openbsd.org 2006/02/08 12:15:27
1664 [auth.c clientloop.c includes.h misc.c monitor.c readpass.c]
1665 [session.c sftp.c ssh-agent.c ssh-keysign.c ssh.c sshconnect.c]
1666 [sshd.c sshpty.c]
1667 move #include <paths.h> out of includes.h; ok markus@
1668 - stevesk@cvs.openbsd.org 2006/02/08 12:32:49
1669 [includes.h misc.c]
1670 move #include <netinet/tcp.h> out of includes.h; ok markus@
1671 - stevesk@cvs.openbsd.org 2006/02/08 13:15:44
1672 [gss-serv.c monitor.c]
1673 small KNF
1674 - stevesk@cvs.openbsd.org 2006/02/08 14:16:59
1675 [sshconnect.c]
1676 <openssl/bn.h> not needed
1677 - stevesk@cvs.openbsd.org 2006/02/08 14:31:30
1678 [includes.h ssh-agent.c ssh-keyscan.c ssh.c]
1679 move #include <sys/resource.h> out of includes.h; ok markus@
1680 - stevesk@cvs.openbsd.org 2006/02/08 14:38:18
1681 [includes.h packet.c]
1682 move #include <netinet/in_systm.h> and <netinet/ip.h> out of
1683 includes.h; ok markus@
1684 - stevesk@cvs.openbsd.org 2006/02/08 23:51:24
1685 [includes.h scp.c sftp-glob.c sftp-server.c]
1686 move #include <dirent.h> out of includes.h; ok markus@
1687 - stevesk@cvs.openbsd.org 2006/02/09 00:32:07
1688 [includes.h]
1689 #include <sys/endian.h> not needed; ok djm@
1690 NB. ID Sync only - we still need this (but it may move later)
1691 - jmc@cvs.openbsd.org 2006/02/09 10:10:47
1692 [sshd.8]
1693 - move some text into a CAVEATS section
1694 - merge the COMMAND EXECUTION... section into AUTHENTICATION
1695 - stevesk@cvs.openbsd.org 2006/02/10 00:27:13
1696 [channels.c clientloop.c includes.h misc.c progressmeter.c sftp.c]
1697 [ssh.c sshd.c sshpty.c]
1698 move #include <sys/ioctl.h> out of includes.h; ok markus@
1699 - stevesk@cvs.openbsd.org 2006/02/10 01:44:27
1700 [includes.h monitor.c readpass.c scp.c serverloop.c session.c]
1701 [sftp.c sshconnect.c sshconnect2.c sshd.c]
1702 move #include <sys/wait.h> out of includes.h; ok markus@
1703 - otto@cvs.openbsd.org 2006/02/11 19:31:18
1704 [atomicio.c]
1705 type correctness; from Ray Lai in PR 5011; ok millert@
1706 - djm@cvs.openbsd.org 2006/02/12 06:45:34
1707 [ssh.c ssh_config.5]
1708 add a %l expansion code to the ControlPath, which is filled in with the
1709 local hostname at runtime. Requested by henning@ to avoid some problems
1710 with /home on NFS; ok dtucker@
1711 - djm@cvs.openbsd.org 2006/02/12 10:44:18
1712 [readconf.c]
1713 raise error when the user specifies a RekeyLimit that is smaller than 16
1714 (the smallest of our cipher's blocksize) or big enough to cause integer
1715 wraparound; ok & feedback dtucker@
1716 - jmc@cvs.openbsd.org 2006/02/12 10:49:44
1717 [ssh_config.5]
1718 slight rewording; ok djm
1719 - jmc@cvs.openbsd.org 2006/02/12 10:52:41
1720 [sshd.8]
1721 rework the description of authorized_keys a little;
1722 - jmc@cvs.openbsd.org 2006/02/12 17:57:19
1723 [sshd.8]
1724 sort the list of options permissable w/ authorized_keys;
1725 ok djm dtucker
1726 - jmc@cvs.openbsd.org 2006/02/13 10:16:39
1727 [sshd.8]
1728 no need to subsection the authorized_keys examples - instead, convert
1729 this to look like an actual file. also use proto 2 keys, and use IETF
1730 example addresses;
1731 - jmc@cvs.openbsd.org 2006/02/13 10:21:25
1732 [sshd.8]
1733 small tweaks for the ssh_known_hosts section;
1734 - jmc@cvs.openbsd.org 2006/02/13 11:02:26
1735 [sshd.8]
1736 turn this into an example ssh_known_hosts file; ok djm
1737 - jmc@cvs.openbsd.org 2006/02/13 11:08:43
1738 [sshd.8]
1739 - avoid nasty line split
1740 - `*' does not need to be escaped
1741 - jmc@cvs.openbsd.org 2006/02/13 11:27:25
1742 [sshd.8]
1743 sort FILES and use a -compact list;
1744 - david@cvs.openbsd.org 2006/02/15 05:08:24
1745 [sftp-client.c]
1746 typo in comment; ok djm@
1747 - jmc@cvs.openbsd.org 2006/02/15 16:53:20
1748 [ssh.1]
1749 remove the IETF draft references and replace them with some updated RFCs;
1750 - jmc@cvs.openbsd.org 2006/02/15 16:55:33
1751 [sshd.8]
1752 remove ietf draft references; RFC list now maintained in ssh.1;
1753 - jmc@cvs.openbsd.org 2006/02/16 09:05:34
1754 [sshd.8]
1755 sync some of the FILES entries w/ ssh.1;
1756 - jmc@cvs.openbsd.org 2006/02/19 19:52:10
1757 [sshd.8]
1758 move the sshrc stuff out of FILES, and into its own section:
1759 FILES is not a good place to document how stuff works;
1760 - jmc@cvs.openbsd.org 2006/02/19 20:02:17
1761 [sshd.8]
1762 sync the (s)hosts.equiv FILES entries w/ those from ssh.1;
1763 - jmc@cvs.openbsd.org 2006/02/19 20:05:00
1764 [sshd.8]
1765 grammar;
1766 - jmc@cvs.openbsd.org 2006/02/19 20:12:25
1767 [ssh_config.5]
1768 add some vertical space;
1769 - stevesk@cvs.openbsd.org 2006/02/20 16:36:15
1770 [authfd.c channels.c includes.h session.c ssh-agent.c ssh.c]
1771 move #include <sys/un.h> out of includes.h; ok djm@
1772 - stevesk@cvs.openbsd.org 2006/02/20 17:02:44
1773 [clientloop.c includes.h monitor.c progressmeter.c scp.c]
1774 [serverloop.c session.c sftp.c ssh-agent.c ssh.c sshd.c]
1775 move #include <signal.h> out of includes.h; ok markus@
1776 - stevesk@cvs.openbsd.org 2006/02/20 17:19:54
1777 [auth-rhosts.c auth-rsa.c auth.c auth2-none.c auth2-pubkey.c]
1778 [authfile.c clientloop.c includes.h readconf.c scp.c session.c]
1779 [sftp-client.c sftp-common.c sftp-common.h sftp-glob.c]
1780 [sftp-server.c sftp.c ssh-add.c ssh-keygen.c ssh.c sshconnect.c]
1781 [sshconnect2.c sshd.c sshpty.c]
1782 move #include <sys/stat.h> out of includes.h; ok markus@
1783 - stevesk@cvs.openbsd.org 2006/02/22 00:04:45
1784 [canohost.c clientloop.c includes.h match.c readconf.c scp.c ssh.c]
1785 [sshconnect.c]
1786 move #include <ctype.h> out of includes.h; ok djm@
1787 - jmc@cvs.openbsd.org 2006/02/24 10:25:14
1788 [ssh_config.5]
1789 add section on patterns;
1790 from dtucker + myself
1791 - jmc@cvs.openbsd.org 2006/02/24 10:33:54
1792 [sshd_config.5]
1793 signpost to PATTERNS;
1794 - jmc@cvs.openbsd.org 2006/02/24 10:37:07
1795 [ssh_config.5]
1796 tidy up the refs to PATTERNS;
1797 - jmc@cvs.openbsd.org 2006/02/24 10:39:52
1798 [sshd.8]
1799 signpost to PATTERNS section;
1800 - jmc@cvs.openbsd.org 2006/02/24 20:22:16
1801 [ssh-keysign.8 ssh_config.5 sshd_config.5]
1802 some consistency fixes;
1803 - jmc@cvs.openbsd.org 2006/02/24 20:31:31
1804 [ssh.1 ssh_config.5 sshd.8 sshd_config.5]
1805 more consistency fixes;
1806 - jmc@cvs.openbsd.org 2006/02/24 23:20:07
1807 [ssh_config.5]
1808 some grammar/wording fixes;
1809 - jmc@cvs.openbsd.org 2006/02/24 23:43:57
1810 [sshd_config.5]
1811 some grammar/wording fixes;
1812 - jmc@cvs.openbsd.org 2006/02/24 23:51:17
1813 [sshd_config.5]
1814 oops - bits i missed;
1815 - jmc@cvs.openbsd.org 2006/02/25 12:26:17
1816 [ssh_config.5]
1817 document the possible values for KbdInteractiveDevices;
1818 help/ok dtucker
1819 - jmc@cvs.openbsd.org 2006/02/25 12:28:34
1820 [sshd_config.5]
1821 document the order in which allow/deny directives are processed;
1822 help/ok dtucker
1823 - jmc@cvs.openbsd.org 2006/02/26 17:17:18
1824 [ssh_config.5]
1825 move PATTERNS to the end of the main body; requested by dtucker
1826 - jmc@cvs.openbsd.org 2006/02/26 18:01:13
1827 [sshd_config.5]
1828 subsection is pointless here;
1829 - jmc@cvs.openbsd.org 2006/02/26 18:03:10
1830 [ssh_config.5]
1831 comma;
1832 - djm@cvs.openbsd.org 2006/02/28 01:10:21
1833 [session.c]
1834 fix logout recording when privilege separation is disabled, analysis and
1835 patch from vinschen at redhat.com; tested by dtucker@ ok deraadt@
1836 NB. ID sync only - patch already in portable
1837 - djm@cvs.openbsd.org 2006/03/04 04:12:58
1838 [serverloop.c]
1839 move a debug() outside of a signal handler; ok markus@ a little while back
1840 - djm@cvs.openbsd.org 2006/03/12 04:23:07
1841 [ssh.c]
1842 knf nit
1843 - djm@cvs.openbsd.org 2006/03/13 08:16:00
1844 [sshd.c]
1845 don't log that we are listening on a socket before the listen() call
1846 actually succeeds, bz #1162 reported by Senthil Kumar; ok dtucker@
1847 - dtucker@cvs.openbsd.org 2006/03/13 08:33:00
1848 [packet.c]
1849 Set TCP_NODELAY for all connections not just "interactive" ones. Fixes
1850 poor performance and protocol stalls under some network conditions (mindrot
1851 bugs #556 and #981). Patch originally from markus@, ok djm@
1852 - dtucker@cvs.openbsd.org 2006/03/13 08:43:16
1853 [ssh-keygen.c]
1854 Make ssh-keygen handle CR and CRLF line termination when converting IETF
1855 format keys, in adition to vanilla LF. mindrot #1157, tested by Chris
1856 Pepper, ok djm@
1857 - dtucker@cvs.openbsd.org 2006/03/13 10:14:29
1858 [misc.c ssh_config.5 sshd_config.5]
1859 Allow config directives to contain whitespace by surrounding them by double
1860 quotes. mindrot #482, man page help from jmc@, ok djm@
1861 - dtucker@cvs.openbsd.org 2006/03/13 10:26:52
1862 [authfile.c authfile.h ssh-add.c]
1863 Make ssh-add check file permissions before attempting to load private
1864 key files multiple times; it will fail anyway and this prevents confusing
1865 multiple prompts and warnings. mindrot #1138, ok djm@
1866 - djm@cvs.openbsd.org 2006/03/14 00:15:39
1867 [canohost.c]
1868 log the originating address and not just the name when a reverse
1869 mapping check fails, requested by linux AT linuon.com
1870 - markus@cvs.openbsd.org 2006/03/14 16:32:48
1871 [ssh_config.5 sshd_config.5]
1872 *AliveCountMax applies to protcol v2 only; ok dtucker, djm
1873 - djm@cvs.openbsd.org 2006/03/07 09:07:40
1874 [kex.c kex.h monitor.c myproposal.h ssh-keyscan.c sshconnect2.c sshd.c]
1875 Implement the diffie-hellman-group-exchange-sha256 key exchange method
1876 using the SHA256 code in libc (and wrapper to make it into an OpenSSL
1877 EVP), interop tested against CVS PuTTY
1878 NB. no portability bits committed yet
1879 - (djm) [configure.ac defines.h kex.c md-sha256.c]
1880 [openbsd-compat/sha2.h openbsd-compat/openbsd-compat.h]
1881 [openbsd-compat/sha2.c] First stab at portability glue for SHA256
1882 KEX support, should work with libc SHA256 support or OpenSSL
1883 EVP_sha256 if present
1884 - (djm) [includes.h] Restore accidentally dropped netinet/in.h
1885 - (djm) [Makefile.in openbsd-compat/Makefile.in] Add added files
1886 - (djm) [md-sha256.c configure.ac] md-sha256.c needs sha2.h if present
1887 - (djm) [regress/.cvsignore] Ignore Makefile here
1888 - (djm) [loginrec.c] Need stat.h
1889 - (djm) [openbsd-compat/sha2.h] Avoid include macro clash with
1890 system sha2.h
1891 - (djm) [ssh-rand-helper.c] Needs a bunch of headers
1892 - (djm) [ssh-agent.c] Restore dropped stat.h
1893 - (djm) [openbsd-compat/sha2.h openbsd-compat/sha2.c] Comment out
1894 SHA384, which we don't need and doesn't compile without tweaks
1895 - (djm) [auth-pam.c clientloop.c includes.h monitor.c session.c]
1896 [sftp-client.c ssh-keysign.c ssh.c sshconnect.c sshconnect2.c]
1897 [sshd.c openbsd-compat/bsd-misc.c openbsd-compat/bsd-openpty.c]
1898 [openbsd-compat/glob.c openbsd-compat/mktemp.c]
1899 [openbsd-compat/readpassphrase.c] Lots of include fixes for
1900 OpenSolaris
1901 - (tim) [includes.h] put sys/stat.h back in to quiet some "macro redefined:"
1902 - (tim) [openssh/sshpty.c openssh/openbsd-compat/port-tun.c] put in some
1903 includes removed from includes.h
1904 - (dtucker) [configure.ac] Fix glob test conversion to AC_TRY_COMPILE
1905 - (djm) [includes.h] Put back paths.h, it is needed in defines.h
1906 - (dtucker) [openbsd-compat/openbsd-compat.h] AIX (at least) needs
1907 sys/ioctl.h for struct winsize.
1908 - (dtucker) [configure.ac] login_cap.h requires sys/types.h on NetBSD.
1909
191020060313
1911 - (dtucker) [configure.ac] Bug #1171: Don't use printf("%lld", longlong)
1912 since not all platforms support it. Instead, use internal equivalent while
1913 computing LLONG_MIN and LLONG_MAX. Remove special case for alpha-dec-osf*
1914 as it's no longer required. Tested by Bernhard Simon, ok djm@
1915
191620060304
1917 - (dtucker) [contrib/cygwin/ssh-host-config] Require use of lastlog as a
1918 file rather than directory, required as Cygwin will be importing lastlog(1).
1919 Also tightens up permissions on the file. Patch from vinschen@redhat.com.
1920 - (dtucker) [gss-serv-krb5.c] Bug #1166: Correct #ifdefs for gssapi_krb5.h
1921 includes. Patch from gentoo.riverrat at gmail.com.
1922
192320060226
1924 - (dtucker) [configure.ac] Bug #1156: QNX apparently needs SSHD_ACQUIRES_CTTY
1925 patch from kraai at ftbfs.org.
1926
192720060223
1928 - (dtucker) [sshd_config sshd_config.5] Update UsePAM to reflect current
1929 reality. Pointed out by tryponraj at gmail.com.
1930
193120060222
1932 - (dtucker) [openbsd-compat/openssl-compat.{c,h}] Minor tidy up: only
1933 compile in compat code if required.
1934
193520060221
1936 - (dtucker) [openbsd-compat/openssl-compat.h] Prevent warning about
1937 redefinition of SSLeay_add_all_algorithms.
1938
193920060220
1940 - (dtucker) [INSTALL configure.ac openbsd-compat/openssl-compat.{c,h}]
1941 Add optional enabling of OpenSSL's (hardware) Engine support, via
1942 configure --with-ssl-engine. Based in part on a diff by michal at
1943 logix.cz.
1944
194520060219
1946 - (dtucker) [Makefile.in configure.ac, added openbsd-compat/regress/]
1947 Add first attempt at regress tests for compat library. ok djm@
1948
194920060214
1950 - (tim) [buildpkg.sh.in] Make the names consistent.
1951 s/pkg_post_make_install_fixes.sh/pkg-post-make-install-fixes.sh/ OK dtucker@
1952
195320060212
1954 - (dtucker) [openbsd-compat/bsd-cygwin_util.c] Make loop counter unsigned
1955 to silence compiler warning, from vinschen at redhat.com.
1956 - (tim) [configure.ac] Bug #1149. Disable /etc/default/login check for QNX.
1957 - (dtucker) [README version.h contrib/caldera/openssh.spec
1958 contrib/redhat/openssh.spec contrib/suse/openssh.spec] Bump version
1959 strings to match 4.3p2 release.
4 1960
520060208 196120060208
6 - (tim) [session.c] Logout records were not updated on systems with 1962 - (tim) [session.c] Logout records were not updated on systems with
7 post auth privsep disabled due to bug 1086 changes. Analysis and patch 1963 post auth privsep disabled due to bug 1086 changes. Analysis and patch
8 by vinschen at redhat.com. OK tim@, dtucker@. 1964 by vinschen at redhat.com. OK tim@, dtucker@.
9 - (dtucker) [configure.ac] Typo in Ultrix and NewsOS sections (NEED_SETPRGP 1965 - (dtucker) [configure.ac] Typo in Ultrix and NewsOS sections (NEED_SETPRGP
10 -> NEED_SETPGRP), reported by Berhard Simon. ok tim@ 1966 -> NEED_SETPGRP), reported by Bernhard Simon. ok tim@
11 1967
1220060206 196820060206
13 - (tim) [configure.ac] Remove unnecessary tests for net/if.h and 1969 - (tim) [configure.ac] Remove unnecessary tests for net/if.h and
@@ -860,2995 +2816,4 @@
860 OpenServer 6 and add osr5bigcrypt support so when someone migrates 2816 OpenServer 6 and add osr5bigcrypt support so when someone migrates
861 passwords between UnixWare and OpenServer they will still work. OK dtucker@ 2817 passwords between UnixWare and OpenServer they will still work. OK dtucker@
862 2818
86320050901 2819$Id: ChangeLog,v 1.4635.2.1 2007/03/06 10:27:55 djm Exp $
864 - (djm) Update RPM spec file versions
865
86620050831
867 - (djm) OpenBSD CVS Sync
868 - djm@cvs.openbsd.org 2005/08/30 22:08:05
869 [gss-serv.c sshconnect2.c]
870 destroy credentials if krb5_kuserok() call fails. Stops credentials being
871 delegated to users who are not authorised for GSSAPIAuthentication when
872 GSSAPIDeletegateCredentials=yes and another authentication mechanism
873 succeeds; bz#1073 reported by paul.moore AT centrify.com, fix by
874 simon AT sxw.org.uk, tested todd@ biorn@ jakob@; ok deraadt@
875 - markus@cvs.openbsd.org 2005/08/31 09:28:42
876 [version.h]
877 4.2
878 - (dtucker) [README] Update release note URL to 4.2
879 - (tim) [configure.ac auth.c defines.h session.c openbsd-compat/port-uw.c
880 openbsd-compat/port-uw.h openbsd-compat/xcrypt.c] libiaf cleanup. Disable
881 libiaf bits for OpenServer6. Free memory allocated by ia_get_logpwd().
882 Feedback and OK dtucker@
883
88420050830
885 - (tim) [configure.ac] Back out last change. It needs to be done differently.
886
88720050829
888 - (tim) [configure.ac] ia_openinfo() seems broken on OSR6. Limit UW long
889 password support to 7.x for now.
890
89120050826
892 - (tim) [CREDITS LICENCE auth.c configure.ac defines.h includes.h session.c
893 openbsd-compat/Makefile.in openbsd-compat/openbsd-compat.h
894 openbsd-compat/xcrypt.c] New files [openssh/openbsd-compat/port-uw.c
895 openssh/openbsd-compat/port-uw.h] Support long passwords (> 8-char)
896 on UnixWare 7 from Dhiraj Gulati and Ahsan Rashid. Cleanup and testing
897 by tim@. Feedback and OK dtucker@
898
89920050823
900 - (dtucker) [regress/test-exec.sh] Do not prepend an extra "/" to a fully-
901 qualified sshd pathname since some systems (eg Cygwin) may consider "/foo"
902 and "//foo" to be different. Spotted by vinschen at redhat.com.
903 - (tim) [configure.ac] Not all gcc's support -Wsign-compare. Enhancements
904 and OK dtucker@
905 - (tim) [defines.h] PATH_MAX bits for OpenServer OK dtucker@
906
90720050821
908 - (dtucker) [configure.ac defines.h includes.h sftp.c] Add support for
909 LynxOS, patch from Olli Savia (ops at iki.fi). ok djm@
910
91120050816
912 - (djm) [ttymodes.c] bugzilla #1025: Fix encoding of _POSIX_VDISABLE,
913 from Jacob Nevins; ok dtucker@
914
91520050815
916 - (tim) [sftp.c] wrap el_end() in #ifdef USE_LIBEDIT
917 - (tim) [configure.ac] corrections to libedit tests. Report and patches
918 by skeleten AT shillest.net
919
92020050812
921 - (djm) OpenBSD CVS Sync
922 - markus@cvs.openbsd.org 2005/07/28 17:36:22
923 [packet.c]
924 missing packet_init_compression(); from solar
925 - djm@cvs.openbsd.org 2005/07/30 01:26:16
926 [ssh.c]
927 fix -D listen_host initialisation, so it picks up gateway_ports setting
928 correctly
929 - djm@cvs.openbsd.org 2005/07/30 02:03:47
930 [readconf.c]
931 listen_hosts initialisation here too; spotted greg AT y2005.nest.cx
932 - dtucker@cvs.openbsd.org 2005/08/06 10:03:12
933 [servconf.c]
934 Unbreak sshd ListenAddress for bare IPv6 addresses.
935 Report from Janusz Mucka; ok djm@
936 - jaredy@cvs.openbsd.org 2005/08/08 13:22:48
937 [sftp.c]
938 sftp prompt enhancements:
939 - in non-interactive mode, do not print an empty prompt at the end
940 before finishing
941 - print newline after EOF in editline mode
942 - call el_end() in editline mode
943 ok dtucker djm
944
94520050810
946 - (dtucker) [configure.ac] Test libedit library and headers for compatibility.
947 Report from skeleten AT shillest.net, ok djm@
948 - (dtucker) [LICENCE configure.ac defines.h openbsd-compat/realpath.c]
949 Sync current (thread-safe) version of realpath.c from OpenBSD (which is
950 in turn based on FreeBSD's). ok djm@
951
95220050809
953 - (tim) [configure.ac] Allow --with-audit=no. OK dtucker@
954 Report by skeleten AT shillest.net
955
95620050803
957 - (dtucker) [openbsd-compat/fake-rfc2553.h] Check for EAI_* defines
958 individually and use a value less likely to collide with real values from
959 netdb.h. Fixes compile warnings on FreeBSD 5.3. ok djm@
960 - (dtucker) [openbsd-compat/fake-rfc2553.h] MAX_INT -> INT_MAX since the
961 latter is specified in the standard.
962
96320050802
964 - (dtucker) OpenBSD CVS Sync
965 - dtucker@cvs.openbsd.org 2005/07/27 10:39:03
966 [scp.c hostfile.c sftp-client.c]
967 Silence bogus -Wuninitialized warnings; ok djm@
968 - (dtucker) [configure.ac] Enable -Wuninitialized by default when compiling
969 with gcc. ok djm@
970 - (dtucker) [configure.ac] Add a --with-Werror option to configure for
971 adding -Werror to CFLAGS when all of the configure tests are done. ok djm@
972
97320050726
974 - (dtucker) [configure.ac] Update zlib warning message too, pointed out by
975 tim@.
976 - (djm) OpenBSD CVS Sync
977 - otto@cvs.openbsd.org 2005/07/19 15:32:26
978 [auth-passwd.c]
979 auth_usercheck(3) can return NULL, so check for that. Report from
980 mpech@. ok markus@
981 - markus@cvs.openbsd.org 2005/07/25 11:59:40
982 [kex.c kex.h myproposal.h packet.c packet.h servconf.c session.c]
983 [sshconnect2.c sshd.c sshd_config sshd_config.5]
984 add a new compression method that delays compression until the user
985 has been authenticated successfully and set compression to 'delayed'
986 for sshd.
987 this breaks older openssh clients (< 3.5) if they insist on
988 compression, so you have to re-enable compression in sshd_config.
989 ok djm@
990
99120050725
992 - (dtucker) [configure.ac] Update zlib version check for CAN-2005-2096.
993
99420050717
995- OpenBSD CVS Sync
996 - djm@cvs.openbsd.org 2005/07/16 01:35:24
997 [auth1.c channels.c cipher.c clientloop.c kex.c session.c ssh.c]
998 [sshconnect.c]
999 spacing
1000 - (djm) [acss.c auth-pam.c auth-shadow.c auth-skey.c auth1.c canohost.c]
1001 [cipher-acss.c loginrec.c ssh-rand-helper.c sshd.c] Fix whitespace at EOL
1002 in portable too ("perl -p -i -e 's/\s+$/\n/' *.[ch]")
1003 - (djm) [auth-pam.c sftp.c] spaces vs. tabs at start of line
1004 - djm@cvs.openbsd.org 2005/07/17 06:49:04
1005 [channels.c channels.h session.c session.h]
1006 Fix a number of X11 forwarding channel leaks:
1007 1. Refuse multiple X11 forwarding requests on the same session
1008 2. Clean up all listeners after a single_connection X11 forward, not just
1009 the one that made the single connection
1010 3. Destroy X11 listeners when the session owning them goes away
1011 testing and ok dtucker@
1012 - djm@cvs.openbsd.org 2005/07/17 07:17:55
1013 [auth-rh-rsa.c auth-rhosts.c auth2-chall.c auth2-gss.c channels.c]
1014 [cipher-ctr.c gss-genr.c gss-serv.c kex.c moduli.c readconf.c]
1015 [serverloop.c session.c sftp-client.c sftp.c ssh-add.c ssh-keygen.c]
1016 [sshconnect.c sshconnect2.c]
1017 knf says that a 2nd level indent is four (not three or five) spaces
1018 -(djm) [audit.c auth1.c auth2.c entropy.c loginrec.c serverloop.c]
1019 [ssh-rand-helper.c] fix portable 2nd level indents at 4 spaces too
1020 - (djm) [monitor.c monitor_wrap.c] -Wsign-compare for PAM monitor calls
1021
102220050716
1023 - (dtucker) [auth-pam.c] Ensure that only one side of the authentication
1024 socketpair stays open on in both the monitor and PAM process. Patch from
1025 Joerg Sonnenberger.
1026
102720050714
1028 - (dtucker) OpenBSD CVS Sync
1029 - dtucker@cvs.openbsd.org 2005/07/06 09:33:05
1030 [ssh.1]
1031 clarify meaning of ssh -b ; with & ok jmc@
1032 - dtucker@cvs.openbsd.org 2005/07/08 09:26:18
1033 [misc.c]
1034 Make comment match code; ok djm@
1035 - markus@cvs.openbsd.org 2005/07/08 09:41:33
1036 [channels.h]
1037 race when efd gets closed while there is still buffered data:
1038 change CHANNEL_EFD_OUTPUT_ACTIVE()
1039 1) c->efd must always be valid AND
1040 2a) no EOF has been seen OR
1041 2b) there is buffered data
1042 report, initial fix and testing Chuck Cranor
1043 - dtucker@cvs.openbsd.org 2005/07/08 10:20:41
1044 [ssh_config.5]
1045 change BindAddress to match recent ssh -b change; prompted by markus@
1046 - jmc@cvs.openbsd.org 2005/07/08 12:53:10
1047 [ssh_config.5]
1048 new sentence, new line;
1049 - dtucker@cvs.openbsd.org 2005/07/14 04:00:43
1050 [misc.h]
1051 use __sentinel__ attribute; ok deraadt@ djm@ markus@
1052 - (dtucker) [configure.ac defines.h] Define __sentinel__ to nothing if the
1053 compiler doesn't understand it to prevent warnings. If any mainstream
1054 compiler versions acquire it we can test for those versions. Based on
1055 discussion with djm@.
1056
105720050707
1058 - dtucker [auth-krb5.c auth.h gss-serv-krb5.c] Move KRB5CCNAME generation for
1059 the MIT Kerberos code path into a common function and expand mkstemp
1060 template to be consistent with the rest of OpenSSH. From sxw at
1061 inf.ed.ac.uk, ok djm@
1062 - (dtucker) [auth-krb5.c] There's no guarantee that snprintf will set errno
1063 in the case where the buffer is insufficient, so always return ENOMEM.
1064 Also pointed out by sxw at inf.ed.ac.uk.
1065 - (dtucker) [acconfig.h auth-krb5.c configure.ac gss-serv-krb5.c] Remove
1066 calls to krb5_init_ets, which has not been required since krb-1.1.x and
1067 most Kerberos versions no longer export in their public API. From sxw
1068 at inf.ed.ac.uk, ok djm@
1069
107020050706
1071 - (djm) OpenBSD CVS Sync
1072 - markus@cvs.openbsd.org 2005/07/01 13:19:47
1073 [channels.c]
1074 don't free() if getaddrinfo() fails; report mpech@
1075 - djm@cvs.openbsd.org 2005/07/04 00:58:43
1076 [channels.c clientloop.c clientloop.h misc.c misc.h ssh.c ssh_config.5]
1077 implement support for X11 and agent forwarding over multiplex slave
1078 connections. Because of protocol limitations, the slave connections inherit
1079 the master's DISPLAY and SSH_AUTH_SOCK rather than distinctly forwarding
1080 their own.
1081 ok dtucker@ "put it in" deraadt@
1082 - jmc@cvs.openbsd.org 2005/07/04 11:29:51
1083 [ssh_config.5]
1084 fix Xr and a little grammar;
1085 - markus@cvs.openbsd.org 2005/07/04 14:04:11
1086 [channels.c]
1087 don't forget to set x11_saved_display
1088
108920050626
1090 - (djm) OpenBSD CVS Sync
1091 - djm@cvs.openbsd.org 2005/06/17 22:53:47
1092 [ssh.c sshconnect.c]
1093 Fix ControlPath's %p expanding to "0" for a default port,
1094 spotted dwmw2 AT infradead.org; ok markus@
1095 - djm@cvs.openbsd.org 2005/06/18 04:30:36
1096 [ssh.c ssh_config.5]
1097 allow ControlPath=none, patch from dwmw2 AT infradead.org; ok dtucker@
1098 - djm@cvs.openbsd.org 2005/06/25 22:47:49
1099 [ssh.c]
1100 do the default port filling code a few lines earlier, so it really
1101 does fix %p
1102
110320050618
1104 - (djm) OpenBSD CVS Sync
1105 - djm@cvs.openbsd.org 2005/05/20 12:57:01;
1106 [auth1.c] split protocol 1 auth methods into separate functions, makes
1107 authloop much more readable; fixes and ok markus@ (portable ok &
1108 polish dtucker@)
1109 - djm@cvs.openbsd.org 2005/06/17 02:44:33
1110 [auth1.c] make this -Wsign-compare clean; ok avsm@ markus@
1111 - (djm) [loginrec.c ssh-rand-helper.c] Fix -Wsign-compare for portable,
1112 tested and fixes tim@
1113
111420050617
1115 - (djm) OpenBSD CVS Sync
1116 - djm@cvs.openbsd.org 2005/06/16 03:38:36
1117 [channels.c channels.h clientloop.c clientloop.h ssh.c]
1118 move x11_get_proto from ssh.c to clientloop.c, to make muliplexed xfwd
1119 easier later; ok deraadt@
1120 - markus@cvs.openbsd.org 2005/06/16 08:00:00
1121 [canohost.c channels.c sshd.c]
1122 don't exit if getpeername fails for forwarded ports; bugzilla #1054;
1123 ok djm
1124 - djm@cvs.openbsd.org 2005/06/17 02:44:33
1125 [auth-rsa.c auth.c auth1.c auth2-chall.c auth2-gss.c authfd.c authfile.c]
1126 [bufaux.c canohost.c channels.c cipher.c clientloop.c dns.c gss-serv.c]
1127 [kex.c kex.h key.c mac.c match.c misc.c packet.c packet.h scp.c]
1128 [servconf.c session.c session.h sftp-client.c sftp-server.c sftp.c]
1129 [ssh-keyscan.c ssh-rsa.c sshconnect.c sshconnect1.c sshconnect2.c sshd.c]
1130 make this -Wsign-compare clean; ok avsm@ markus@
1131 NB. auth1.c changes not committed yet (conflicts with uncommitted sync)
1132 NB2. more work may be needed to make portable Wsign-compare clean
1133 - (dtucker) [cipher.c openbsd-compat/openbsd-compat.h
1134 openbsd-compat/openssl-compat.c] only include openssl compat stuff where
1135 it's needed as it can cause conflicts elsewhere (eg xcrypt.c). Found by
1136 and ok tim@
1137
113820050616
1139 - (djm) OpenBSD CVS Sync
1140 - jaredy@cvs.openbsd.org 2005/06/07 13:25:23
1141 [progressmeter.c]
1142 catch SIGWINCH and resize progress meter accordingly; ok markus dtucker
1143 - djm@cvs.openbsd.org 2005/06/06 11:20:36
1144 [auth.c auth.h misc.c misc.h ssh.c ssh_config.5 sshconnect.c]
1145 introduce a generic %foo expansion function. replace existing % expansion
1146 and add expansion to ControlPath; ok markus@
1147 - djm@cvs.openbsd.org 2005/06/08 03:50:00
1148 [ssh-keygen.1 ssh-keygen.c sshd.8]
1149 increase default rsa/dsa key length from 1024 to 2048 bits;
1150 ok markus@ deraadt@
1151 - djm@cvs.openbsd.org 2005/06/08 11:25:09
1152 [clientloop.c readconf.c readconf.h ssh.c ssh_config.5]
1153 add ControlMaster=auto/autoask options to support opportunistic
1154 multiplexing; tested avsm@ and jakob@, ok markus@
1155 - dtucker@cvs.openbsd.org 2005/06/09 13:43:49
1156 [cipher.c]
1157 Correctly initialize end of array sentinel; ok djm@
1158 (Id sync only, change already in portable)
1159
116020050609
1161 - (dtucker) [cipher.c openbsd-compat/Makefile.in
1162 openbsd-compat/openbsd-compat.h openbsd-compat/openssl-compat.{c,h}]
1163 Move compatibility code for supporting older OpenSSL versions to the
1164 compat layer. Suggested by and "no objection" djm@
1165
116620050607
1167 - (dtucker) [configure.ac] Continue the hunt for LLONG_MIN and LLONG_MAX:
1168 in today's episode we attempt to coax it from limits.h where it may be
1169 hiding, failing that we take the DIY approach. Tested by tim@
1170
117120050603
1172 - (dtucker) [configure.ac] Only try gcc -std=gnu99 if LLONG_MAX isn't
1173 defined, and check that it helps before keeping it in CFLAGS. Some old
1174 gcc's don't set an error code when encountering an unknown value in -std.
1175 Found and tested by tim@.
1176 - (dtucker) [configure.ac] Point configure's reporting address at the
1177 openssh-unix-dev list. ok tim@ djm@
1178
117920050602
1180 - (tim) [configure.ac] Some platforms need sys/types.h for arpa/nameser.h.
1181 Take AC_CHECK_HEADERS test out of ultrix section. It caused other platforms
1182 to skip builtin standard includes tests. (first AC_CHECK_HEADERS test
1183 must be run on all platforms) Add missing ;; to case statement. OK dtucker@
1184
118520050601
1186 - (dtucker) [configure.ac] Look for _getshort and _getlong in
1187 arpa/nameser.h.
1188 - (dtucker) [configure.ac openbsd-compat/Makefile.in openbsd-compat/strtoll.c]
1189 Add strtoll to the compat library, from OpenBSD.
1190 - (dtucker) OpenBSD CVS Sync
1191 - avsm@cvs.openbsd.org 2005/05/26 02:08:05
1192 [scp.c]
1193 If copying multiple files to a target file (which normally fails, as it
1194 must be a target directory), kill the spawned ssh child before exiting.
1195 This stops it trying to authenticate and spewing lots of output.
1196 deraadt@ ok
1197 - dtucker@cvs.openbsd.org 2005/05/26 09:08:12
1198 [ssh-keygen.c]
1199 uint32_t -> u_int32_t for consistency; ok djm@
1200 - djm@cvs.openbsd.org 2005/05/27 08:30:37
1201 [ssh.c]
1202 fix -O for cases where no ControlPath has been specified or socket at
1203 ControlPath is not contactable; spotted by and ok avsm@
1204 - (tim) [config.guess config.sub] Update to '2005-05-27' version.
1205 - (tim) [configure.ac] set TEST_SHELL for OpenServer 6
1206
120720050531
1208 - (dtucker) [contrib/aix/pam.conf] Correct comments. From davidl at
1209 vintela.com.
1210 - (dtucker) [mdoc2man.awk] Teach it to understand .Ox.
1211
121220050530
1213 - (dtucker) [README] Link to new release notes. Beter late than never...
1214
121520050529
1216 - (dtucker) [openbsd-compat/port-aix.c] Bug #1046: AIX 5.3 expects the
1217 argument to passwdexpired to be initialized to NULL. Suggested by tim@
1218 While at it, initialize the other arguments to auth functions in case they
1219 ever acquire this behaviour.
1220 - (dtucker) [openbsd-compat/port-aix.c] Whitespace cleanups while there.
1221 - (dtucker) [openbsd-compat/port-aix.c] Minor correction to debug message,
1222 spotted by tim@.
1223
122420050528
1225 - (dtucker) [configure.ac] For AC_CHECK_HEADERS() and AC_CHECK_FUNCS() have
1226 one entry per line to make it easier to merge changes. ok djm@
1227 - (dtucker) [configure.ac] strsep() may be defined in string.h, so check
1228 for its presence and include it in the strsep check.
1229 - (dtucker) [configure.ac] getpgrp may be defined in unistd.h, so check for
1230 its presence before doing AC_FUNC_GETPGRP.
1231 - (dtucker) [configure.ac] Merge HP-UX blocks into a common block with minor
1232 version-specific variations as required.
1233 - (dtucker) [openbsd-compat/port-aix.h] Use the HAVE_DECL_* definitions as
1234 per the autoconf man page. Configure should always define them but it
1235 doesn't hurt to check.
1236
123720050527
1238 - (djm) [defines.h] Use our realpath if we have to define PATH_MAX, spotted by
1239 David Leach; ok dtucker@
1240 - (dtucker) [acconfig.h configure.ac defines.h includes.h sshpty.c
1241 openbsd-compat/bsd-misc.c] Add support for Ultrix. No, that's not a typo.
1242 Required changes from Bernhard Simon, integrated by me. ok djm@
1243
124420050525
1245 - (djm) [mpaux.c mpaux.h Makefile.in] Remove old mpaux.[ch] code, it has not
1246 been used for a while
1247 - (djm) OpenBSD CVS Sync
1248 - otto@cvs.openbsd.org 2005/04/05 13:45:31
1249 [ssh-keygen.c]
1250 - djm@cvs.openbsd.org 2005/04/06 09:43:59
1251 [sshd.c]
1252 avoid harmless logspam by not performing setsockopt() on non-socket;
1253 ok markus@
1254 - dtucker@cvs.openbsd.org 2005/04/06 12:26:06
1255 [ssh.c]
1256 Fix debug call for port forwards; patch from pete at seebeyond.com,
1257 ok djm@ (ID sync only - change already in portable)
1258 - djm@cvs.openbsd.org 2005/04/09 04:32:54
1259 [misc.c misc.h tildexpand.c Makefile.in]
1260 replace tilde_expand_filename with a simpler implementation, ahead of
1261 more whacking; ok deraadt@
1262 - jmc@cvs.openbsd.org 2005/04/14 12:30:30
1263 [ssh.1]
1264 arg to -b is an address, not if_name;
1265 ok markus@
1266 - jakob@cvs.openbsd.org 2005/04/20 10:05:45
1267 [dns.c]
1268 do not try to look up SSHFP for numerical hostname. ok djm@
1269 - djm@cvs.openbsd.org 2005/04/21 06:17:50
1270 [ssh-add.1 ssh-agent.1 ssh-keygen.1 ssh.1 ssh_config.5 sshd.8]
1271 [sshd_config.5] OpenSSH doesn't ever look at the $HOME environment
1272 variable, so don't say that we do (bz #623); ok deraadt@
1273 - djm@cvs.openbsd.org 2005/04/21 11:47:19
1274 [ssh.c]
1275 don't allocate a pty when -n flag (/dev/null stdin) is set, patch from
1276 ignasi.roca AT fujitsu-siemens.com (bz #829); ok dtucker@
1277 - dtucker@cvs.openbsd.org 2005/04/23 23:43:47
1278 [readpass.c]
1279 Add debug message if read_passphrase can't open /dev/tty; bz #471;
1280 ok djm@
1281 - jmc@cvs.openbsd.org 2005/04/26 12:59:02
1282 [sftp-client.h]
1283 spelling correction in comment from wiz@netbsd;
1284 - jakob@cvs.openbsd.org 2005/04/26 13:08:37
1285 [ssh.c ssh_config.5]
1286 fallback gracefully if client cannot connect to ControlPath. ok djm@
1287 - moritz@cvs.openbsd.org 2005/04/28 10:17:56
1288 [progressmeter.c ssh-keyscan.c]
1289 add snprintf checks. ok djm@ markus@
1290 - markus@cvs.openbsd.org 2005/05/02 21:13:22
1291 [readpass.c]
1292 missing {}
1293 - djm@cvs.openbsd.org 2005/05/10 10:28:11
1294 [ssh.c]
1295 print nice error message for EADDRINUSE as well (ID sync only)
1296 - djm@cvs.openbsd.org 2005/05/10 10:30:43
1297 [ssh.c]
1298 report real errors on fallback from ControlMaster=no to normal connect
1299 - markus@cvs.openbsd.org 2005/05/16 15:30:51
1300 [readconf.c servconf.c]
1301 check return value from strdelim() for NULL (AddressFamily); mpech
1302 - djm@cvs.openbsd.org 2005/05/19 02:39:55
1303 [sshd_config.5]
1304 sort config options, from grunk AT pestilenz.org; ok jmc@
1305 - djm@cvs.openbsd.org 2005/05/19 02:40:52
1306 [sshd_config]
1307 whitespace nit, from grunk AT pestilenz.org
1308 - djm@cvs.openbsd.org 2005/05/19 02:42:26
1309 [includes.h]
1310 fix cast, from grunk AT pestilenz.org
1311 - djm@cvs.openbsd.org 2005/05/20 10:50:55
1312 [ssh_config.5]
1313 give a ProxyCommand example using nc(1), with and ok jmc@
1314 - jmc@cvs.openbsd.org 2005/05/20 11:23:32
1315 [ssh_config.5]
1316 oops - article and spacing;
1317 - avsm@cvs.openbsd.org 2005/05/23 22:44:01
1318 [moduli.c ssh-keygen.c]
1319 - removes signed/unsigned comparisons in moduli generation
1320 - use strtonum instead of atoi where its easier
1321 - check some strlcpy overflow and fatal instead of truncate
1322 - djm@cvs.openbsd.org 2005/05/23 23:32:46
1323 [cipher.c myproposal.h ssh.1 ssh_config.5 sshd_config.5]
1324 add support for draft-harris-ssh-arcfour-fixes-02 improved arcfour modes;
1325 ok markus@
1326 - avsm@cvs.openbsd.org 2005/05/24 02:05:09
1327 [ssh-keygen.c]
1328 some style nits from dmiller@, and use a fatal() instead of a printf()/exit
1329 - avsm@cvs.openbsd.org 2005/05/24 17:32:44
1330 [atomicio.c atomicio.h authfd.c monitor_wrap.c msg.c scp.c sftp-client.c]
1331 [ssh-keyscan.c sshconnect.c]
1332 Switch atomicio to use a simpler interface; it now returns a size_t
1333 (containing number of bytes read/written), and indicates error by
1334 returning 0. EOF is signalled by errno==EPIPE.
1335 Typical use now becomes:
1336
1337 if (atomicio(read, ..., len) != len)
1338 err(1,"read");
1339
1340 ok deraadt@, cloder@, djm@
1341 - (dtucker) [regress/reexec.sh] Add ${EXEEXT} so this test also works on
1342 Cygwin.
1343 - (dtucker) [auth-pam.c] Bug #1033: Fix warnings building with PAM on Linux:
1344 warning: dereferencing type-punned pointer will break strict-aliasing rules
1345 warning: passing arg 3 of `pam_get_item' from incompatible pointer type
1346 The type-punned pointer fix is based on a patch from SuSE's rpm. ok djm@
1347 - (dtucker) [configure.ac openbsd-compat/getrrsetbyname.c] Bug #1033: Provide
1348 templates for _getshort and _getlong if missing to prevent compiler warnings
1349 on Linux.
1350 - (djm) [configure.ac openbsd-compat/Makefile.in]
1351 [openbsd-compat/openbsd-compat.h openbsd-compat/strtonum.c]
1352 Add strtonum(3) from OpenBSD libc, new code needs it.
1353 Unfortunately Linux forces us to do a bizarre dance with compiler
1354 options to get LLONG_MIN/MAX; Spotted by and ok dtucker@
1355
135620050524
1357 - (djm) [contrib/caldera/openssh.spec contrib/redhat/openssh.spec]
1358 [contrib/suse/openssh.spec] Update spec file versions to 4.1p1
1359 - (dtucker) [auth-pam.c] Since people don't seem to be getting the message
1360 that USE_POSIX_THREADS is unsupported, not recommended and generally a bad
1361 idea, it is now known as UNSUPPORTED_POSIX_THREADS_HACK. Attempting to use
1362 USE_POSIX_THREADS will now generate an error so we don't silently change
1363 behaviour. ok djm@
1364 - (dtucker) [openbsd-compat/bsd-cygwin_util.c] Ensure sufficient memory
1365 allocation when retrieving core Windows environment. Add CYGWIN variable
1366 to propagated variables. Patch from vinschen at redhat.com, ok djm@
1367 - Release 4.1p1
1368
136920050524
1370 - (djm) [openbsd-compat/readpassphrase.c] bz #950: Retry tcsetattr to ensure
1371 terminal modes are reset correctly. Fix from peak AT argo.troja.mff.cuni.cz;
1372 "looks ok" dtucker@
1373
137420050512
1375 - (tim) [buildpkg.sh.in] missing ${PKG_INSTALL_ROOT} in init script
1376 hard link section. Bug 1038.
1377
137820050509
1379 - (dtucker) [contrib/cygwin/ssh-host-config] Add a test and warning for a
1380 user-mode mounts in Cygwin installation. Patch from vinschen at redhat.com.
1381
138220050504
1383 - (djm) [ssh.c] some systems return EADDRINUSE on a bind to an already-used
1384 unix domain socket, so catch that too; from jakob@ ok dtucker@
1385
138620050503
1387 - (dtucker) [canohost.c] normalise socket addresses returned by
1388 get_remote_hostname(). This means that IPv4 addresses in log messages
1389 on IPv6 enabled machines will no longer be prefixed by "::ffff:" and
1390 AllowUsers, DenyUsers, AllowGroups, DenyGroups will match IPv4-style
1391 addresses only for 4-in-6 mapped connections, regardless of whether
1392 or not the machine is IPv6 enabled. ok djm@
1393
139420050425
1395 - (dtucker) [regress/multiplex.sh] Use "kill -0 $pid" to check for the
1396 existence of a process since it's more portable. Found by jbasney at
1397 ncsa.uiuc.edu; ok tim@
1398 - (dtucker) [regress/multiplex.sh] Remove cleanup call since test-exec.sh
1399 will clean up anyway. From tim@
1400 - (dtucker) [regress/multiplex.sh] Put control socket in /tmp so running
1401 "make tests" works even if you're building on a filesystem that doesn't
1402 support sockets. From deengert at anl.gov, ok djm@
1403
140420050424
1405 - (dtucker) [INSTALL configure.ac] Make zlib version check test for 1.1.4 or
1406 1.2.1.2 or higher. With tim@, ok djm@
1407
140820050423
1409 - (tim) [config.guess] Add support for OpenServer 6.
1410
141120050421
1412 - (dtucker) [session.c] Bug #1024: Don't check pam_session_is_open if
1413 UseLogin is set as PAM is not used to establish credentials in that
1414 case. Found by Michael Selvesteen, ok djm@
1415
141620050419
1417 - (dtucker) [INSTALL] Reference README.privsep for the privilege separation
1418 requirements. Pointed out by Bengt Svensson.
1419 - (dtucker) [INSTALL] Put the s/key text and URL back together.
1420 - (dtucker) [INSTALL] Fix s/key text too.
1421
142220050411
1423 - (tim) [configure.ac] UnixWare needs PASSWD_NEEDS_USERNAME
1424
142520050405
1426 - (dtucker) [configure.ac] Define HAVE_SO_PEERCRED if we have it. ok djm@
1427 - (dtucker) [auth-sia.c] Constify sys_auth_passwd, fixes build error on
1428 Tru64. Patch from cmadams at hiwaay.net.
1429 - (dtucker) [auth-passwd.c auth-sia.h] Remove duplicate definitions of
1430 sys_auth_passwd, pointed out by cmadams at hiwaay.net.
1431
143220050403
1433 - (djm) OpenBSD CVS Sync
1434 - deraadt@cvs.openbsd.org 2005/03/31 18:39:21
1435 [scp.c]
1436 copy argv[] element instead of smashing the one that ps will see; ok otto
1437 - djm@cvs.openbsd.org 2005/04/02 12:41:16
1438 [scp.c]
1439 since ssh has xstrdup, use it instead of strdup+test. unbreaks -Werror
1440 build
1441 - (dtucker) [monitor.c] Don't free buffers in audit functions, monitor_read
1442 will free as needed. ok tim@ djm@
1443
144420050331
1445 - (dtucker) OpenBSD CVS Sync
1446 - jmc@cvs.openbsd.org 2005/03/16 11:10:38
1447 [ssh_config.5]
1448 get the syntax right for {Local,Remote}Forward;
1449 based on a diff from markus;
1450 problem report from ponraj;
1451 ok dtucker@ markus@ deraadt@
1452 - markus@cvs.openbsd.org 2005/03/16 21:17:39
1453 [version.h]
1454 4.1
1455 - jmc@cvs.openbsd.org 2005/03/18 17:05:00
1456 [sshd_config.5]
1457 typo;
1458 - (dtucker) [auth.h sshd.c openbsd-compat/port-aix.c] Bug #1006: fix bug in
1459 handling of password expiry messages returned by AIX's authentication
1460 routines, originally reported by robvdwal at sara.nl.
1461 - (dtucker) [ssh.c] Prevent null pointer deref in port forwarding debug
1462 message on some platforms. Patch from pete at seebeyond.com via djm.
1463 - (dtucker) [monitor.c] Remaining part of fix for bug #1006.
1464
146520050329
1466 - (dtucker) [contrib/aix/buildbff.sh] Bug #1005: Look up only the user we're
1467 interested in which is much faster in large (eg LDAP or NIS) environments.
1468 Patch from dleonard at vintela.com.
1469
147020050321
1471 - (dtucker) [configure.ac] Prevent configure --with-zlib from adding -Iyes
1472 and -Lyes to CFLAGS and LIBS. Pointed out by peter at slagheap.net,
1473 with & ok tim@
1474 - (dtucker) [configure.ac] Make configure error out if the user specifies
1475 --with-libedit but the required libs can't be found, rather than silently
1476 ignoring and continuing. ok tim@
1477 - (dtucker) [configure.ac openbsd-compat/port-aix.h] Prevent redefinitions
1478 of setauthdb on AIX 5.3, reported by anders.liljegren at its.uu.se.
1479
148020050317
1481 - (tim) [configure.ac] Bug 998. Make path for --with-opensc optional.
1482 Make --without-opensc work.
1483 - (tim) [configure.ac] portability changes on test statements. Some shells
1484 have problems with -a operator.
1485 - (tim) [configure.ac] make some configure options a little more error proof.
1486 - (tim) [configure.ac] remove trailing white space.
1487
148820050314
1489 - (dtucker) OpenBSD CVS Sync
1490 - dtucker@cvs.openbsd.org 2005/03/10 10:15:02
1491 [readconf.c]
1492 Check listen addresses for null, prevents xfree from dying during
1493 ClearAllForwardings (bz #996). From Craig Leres, ok markus@
1494 - deraadt@cvs.openbsd.org 2005/03/10 22:01:05
1495 [misc.c ssh-keygen.c servconf.c clientloop.c auth-options.c ssh-add.c
1496 monitor.c sftp-client.c bufaux.h hostfile.c ssh.c sshconnect.c channels.c
1497 readconf.c bufaux.c sftp.c]
1498 spacing
1499 - deraadt@cvs.openbsd.org 2005/03/10 22:40:38
1500 [auth-options.c]
1501 spacing
1502 - markus@cvs.openbsd.org 2005/03/11 14:59:06
1503 [ssh-keygen.c]
1504 typo, missing \n; mpech
1505 - jmc@cvs.openbsd.org 2005/03/12 11:55:03
1506 [ssh_config.5]
1507 escape `.' at eol to avoid double spacing issues;
1508 - dtucker@cvs.openbsd.org 2005/03/14 10:09:03
1509 [ssh-keygen.1]
1510 Correct description of -H (bz #997); ok markus@, punctuation jmc@
1511 - dtucker@cvs.openbsd.org 2005/03/14 11:44:42
1512 [auth.c]
1513 Populate host for log message for logins denied by AllowUsers and
1514 DenyUsers (bz #999); ok markus@ (patch by tryponraj at gmail.com)
1515 - markus@cvs.openbsd.org 2005/03/14 11:46:56
1516 [buffer.c buffer.h channels.c]
1517 limit input buffer size for channels; bugzilla #896; with and ok dtucker@
1518 - (tim) [contrib/caldera/openssh.spec] links in rc?.d were getting trashed
1519 with a rpm -F
1520
152120050313
1522 - (dtucker) [contrib/cygwin/ssh-host-config] Makes the query for the
1523 localized name of the local administrators group more reliable. From
1524 vinschen at redhat.com.
1525
152620050312
1527 - (dtucker) [regress/test-exec.sh] DEBUG can cause problems where debug
1528 output ends up in the client's output, causing regress failures. Found
1529 by Corinna Vinschen.
1530
153120050309
1532 - (dtucker) [regress/test-exec.sh] Set BIN_SH=xpg4 on OSF1/Digital Unix/Tru64
1533 so that regress tests behave. From Chris Adams.
1534 - (djm) OpenBSD CVS Sync
1535 - jmc@cvs.openbsd.org 2005/03/07 23:41:54
1536 [ssh.1 ssh_config.5]
1537 more macro simplification;
1538 - djm@cvs.openbsd.org 2005/03/08 23:49:48
1539 [version.h]
1540 OpenSSH 4.0
1541 - (djm) [contrib/caldera/openssh.spec contrib/redhat/openssh.spec]
1542 [contrib/suse/openssh.spec] Update spec file versions
1543 - (djm) [log.c] Fix dumb syntax error; ok dtucker@
1544 - (djm) Release OpenSSH 4.0p1
1545
154620050307
1547 - (dtucker) [configure.ac] Disable gettext search when configuring with
1548 BSM audit support for the time being. ok djm@
1549 - (dtucker) OpenBSD CVS Sync (regress/)
1550 - fgsch@cvs.openbsd.org 2004/12/10 01:31:30
1551 [Makefile sftp-glob.sh]
1552 some globbing regress; prompted and ok djm@
1553 - david@cvs.openbsd.org 2005/01/14 04:21:18
1554 [Makefile test-exec.sh]
1555 pass the SUDO make variable to the individual sh tests; ok dtucker@ markus@
1556 - dtucker@cvs.openbsd.org 2005/02/27 11:33:30
1557 [multiplex.sh test-exec.sh sshd-log-wrapper.sh]
1558 Add optional capability to log output from regress commands; ok markus@
1559 Use with: make TEST_SSH_LOGFILE=/tmp/regress.log
1560 - djm@cvs.openbsd.org 2005/02/27 23:13:36
1561 [login-timeout.sh]
1562 avoid nameservice lookups in regress test; ok dtucker@
1563 - djm@cvs.openbsd.org 2005/03/04 08:48:46
1564 [Makefile envpass.sh]
1565 regress test for SendEnv config parsing bug; ok dtucker@
1566 - (dtucker) [regress/test-exec.sh] Put SUDO in the right place.
1567 - (tim) [configure.ac] SCO 3.2v4.2 no longer supported.
1568
156920050306
1570 - (dtucker) [monitor.c] Bug #125 comment #47: fix errors returned by monitor
1571 when attempting to audit disconnect events. Reported by Phil Dibowitz.
1572 - (dtucker) [session.c sshd.c] Bug #125 comment #49: Send disconnect audit
1573 events earlier, prevents mm_request_send errors reported by Matt Goebel.
1574
157520050305
1576 - (djm) [contrib/cygwin/README] Improve Cygwin build documentation. Patch
1577 from vinschen at redhat.com
1578 - (djm) OpenBSD CVS Sync
1579 - jmc@cvs.openbsd.org 2005/03/02 11:45:01
1580 [ssh.1]
1581 missing word;
1582 - djm@cvs.openbsd.org 2005/03/04 08:48:06
1583 [readconf.c]
1584 fix SendEnv config parsing bug found by Roumen Petrov; ok dtucker@
1585
158620050302
1587 - (djm) OpenBSD CVS sync:
1588 - jmc@cvs.openbsd.org 2005/03/01 14:47:58
1589 [ssh.1]
1590 remove some unneccesary macros;
1591 do not mark up punctuation;
1592 - jmc@cvs.openbsd.org 2005/03/01 14:55:23
1593 [ssh_config.5]
1594 do not mark up punctuation;
1595 whitespace;
1596 - jmc@cvs.openbsd.org 2005/03/01 14:59:49
1597 [sshd.8]
1598 new sentence, new line;
1599 whitespace;
1600 - jmc@cvs.openbsd.org 2005/03/01 15:05:00
1601 [ssh-keygen.1]
1602 whitespace;
1603 - jmc@cvs.openbsd.org 2005/03/01 15:47:14
1604 [ssh-keyscan.1 ssh-keyscan.c]
1605 sort options and sync usage();
1606 - jmc@cvs.openbsd.org 2005/03/01 17:19:35
1607 [scp.1 sftp.1]
1608 add HashKnownHosts to -o list;
1609 ok markus@
1610 - jmc@cvs.openbsd.org 2005/03/01 17:22:06
1611 [ssh.c]
1612 sync usage() w/ man SYNOPSIS;
1613 ok markus@
1614 - jmc@cvs.openbsd.org 2005/03/01 17:32:19
1615 [ssh-add.1]
1616 sort options;
1617 - jmc@cvs.openbsd.org 2005/03/01 18:15:56
1618 [ssh-keygen.1]
1619 sort options (no attempt made at synopsis clean up though);
1620 spelling (occurance -> occurrence);
1621 use prompt before examples;
1622 grammar;
1623 - djm@cvs.openbsd.org 2005/03/02 01:00:06
1624 [sshconnect.c]
1625 fix addition of new hashed hostnames when CheckHostIP=yes;
1626 found and ok dtucker@
1627 - djm@cvs.openbsd.org 2005/03/02 01:27:41
1628 [ssh-keygen.c]
1629 ignore hostnames with metachars when hashing; ok deraadt@
1630 - djm@cvs.openbsd.org 2005/03/02 02:21:07
1631 [ssh.1]
1632 bz#987: mention ForwardX11Trusted in ssh.1,
1633 reported by andrew.benham AT thus.net; ok deraadt@
1634 - (tim) [regress/agent-ptrace.sh] add another possible gdb error.
1635
163620050301
1637 - (djm) OpenBSD CVS sync:
1638 - otto@cvs.openbsd.org 2005/02/16 09:56:44
1639 [ssh.c]
1640 Better diagnostic if an identity file is not accesible. ok markus@ djm@
1641 - djm@cvs.openbsd.org 2005/02/18 03:05:53
1642 [canohost.c]
1643 better error messages for getnameinfo failures; ok dtucker@
1644 - djm@cvs.openbsd.org 2005/02/20 22:59:06
1645 [sftp.c]
1646 turn on ssh batch mode when in sftp batch mode, patch from
1647 jdmossh AT nand.net;
1648 ok markus@
1649 - jmc@cvs.openbsd.org 2005/02/25 10:55:13
1650 [sshd.8]
1651 add /etc/motd and $HOME/.hushlogin to FILES;
1652 from michael knudsen;
1653 - djm@cvs.openbsd.org 2005/02/28 00:54:10
1654 [ssh_config.5]
1655 bz#849: document timeout on untrusted x11 forwarding sessions. Reported by
1656 orion AT cora.nwra.com; ok markus@
1657 - djm@cvs.openbsd.org 2005/03/01 10:09:52
1658 [auth-options.c channels.c channels.h clientloop.c compat.c compat.h]
1659 [misc.c misc.h readconf.c readconf.h servconf.c ssh.1 ssh.c ssh_config.5]
1660 [sshd_config.5]
1661 bz#413: allow optional specification of bind address for port forwardings.
1662 Patch originally by Dan Astorian, but worked on by several people
1663 Adds GatewayPorts=clientspecified option on server to allow remote
1664 forwards to bind to client-specified ports.
1665 - djm@cvs.openbsd.org 2005/03/01 10:40:27
1666 [hostfile.c hostfile.h readconf.c readconf.h ssh.1 ssh_config.5]
1667 [sshconnect.c sshd.8]
1668 add support for hashing host names and addresses added to known_hosts
1669 files, to improve privacy of which hosts user have been visiting; ok
1670 markus@ deraadt@
1671 - djm@cvs.openbsd.org 2005/03/01 10:41:28
1672 [ssh-keyscan.1 ssh-keyscan.c]
1673 option to hash hostnames output by ssh-keyscan; ok markus@ deraadt@
1674 - djm@cvs.openbsd.org 2005/03/01 10:42:49
1675 [ssh-keygen.1 ssh-keygen.c ssh_config.5]
1676 add tools for managing known_hosts files with hashed hostnames, including
1677 hashing existing files and deleting hosts by name; ok markus@ deraadt@
1678
167920050226
1680 - (dtucker) [openbsd-compat/bsd-openpty.c openbsd-compat/inet_ntop.c]
1681 Remove two obsolete Cygwin #ifdefs. Patch from vinschen at redhat.com.
1682 - (dtucker) [acconfig.h configure.ac openbsd-compat/bsd-misc.{c,h}]
1683 Remove SETGROUPS_NOOP, was only used by Cygwin, which doesn't need it any
1684 more. Patch from vinschen at redhat.com.
1685 - (dtucker) [Makefile.in] Add a install-nosysconf target for installing the
1686 binaries without the config files. Primarily useful for packaging.
1687 Patch from phil at usc.edu. ok djm@
1688
168920050224
1690 - (djm) [configure.ac] in_addr_t test needs sys/types.h too
1691
169220050222
1693 - (dtucker) [uidswap.c] Skip uid restore test on Cygwin. Patch from
1694 vinschen at redhat.com.
1695
169620050220
1697 - (dtucker) [LICENCE Makefile.in README.platform audit-bsm.c configure.ac
1698 defines.h] Bug #125: Add *EXPERIMENTAL* BSM audit support. Configure
1699 --with-audit=bsm to enable. Patch originally from Sun Microsystems,
1700 parts by John R. Jackson. ok djm@
1701 - (dtucker) [configure.ac] Missing comma in AIX section, somehow causes
1702 unrelated platforms to be configured incorrectly.
1703
170420050216
1705 - (djm) write seed to temporary file and atomically rename into place;
1706 ok dtucker@
1707 - (dtucker) [ssh-rand-helper.c] Provide seed_rng since it may be called
1708 via mkstemp in some configurations. ok djm@
1709 - (dtucker) [auth-shadow.c] Prevent compiler warnings if "DAY" is defined
1710 by the system headers.
1711 - (dtucker) [configure.ac] Bug #893: check for libresolv early on Reliant
1712 Unix; prevents problems relating to the location of -lresolv in the
1713 link order.
1714 - (dtucker) [session.c] Bug #918: store credentials from gssapi-with-mic
1715 authentication early enough to be available to PAM session modules when
1716 privsep=yes. Patch from deengert at anl.gov, ok'ed in principle by Sam
1717 Hartman and similar to Debian's ssh-krb5 package.
1718 - (dtucker) [configure.ac openbsd-compat/port-aix.{c,h}] Silence some more
1719 compiler warnings on AIX.
1720
172120050215
1722 - (dtucker) [config.sh.in] Collect oslevel -r too.
1723 - (dtucker) [README.platform auth.c configure.ac loginrec.c
1724 openbsd-compat/port-aix.c openbsd-compat/port-aix.h] Bug #835: enable IPv6
1725 on AIX where possible (see README.platform for details) and work around
1726 a misfeature of AIX's getnameinfo. ok djm@
1727 - (dtucker) [loginrec.c] Add missing #include.
1728
172920050211
1730 - (dtucker) [configure.ac] Tidy up configure --help output.
1731 - (dtucker) [openbsd-compat/fake-rfc2553.h] We now need EAI_SYSTEM too.
1732
173320050210
1734 - (dtucker) [configure.ac] Bug #919: Provide visible feedback for the
1735 --disable-etc-default-login configure option.
1736
173720050209
1738 - (dtucker) OpenBSD CVS Sync
1739 - dtucker@cvs.openbsd.org 2005/01/28 09:45:53
1740 [ssh_config]
1741 Make it clear that the example entries in ssh_config are only some of the
1742 commonly-used options and refer the user to ssh_config(5) for more
1743 details; ok djm@
1744 - jmc@cvs.openbsd.org 2005/01/28 15:05:43
1745 [ssh_config.5]
1746 grammar;
1747 - jmc@cvs.openbsd.org 2005/01/28 18:14:09
1748 [ssh_config.5]
1749 wording;
1750 ok markus@
1751 - dtucker@cvs.openbsd.org 2005/01/30 11:18:08
1752 [monitor.c]
1753 Make code match intent; ok djm@
1754 - dtucker@cvs.openbsd.org 2005/02/08 22:24:57
1755 [sshd.c]
1756 Provide reason in error message if getnameinfo fails; ok markus@
1757 - (dtucker) [auth-passwd.c openbsd-compat/port-aix.c] Don't call
1758 disable_forwarding() from compat library. Prevent linker errrors trying
1759 to resolve it for binaries other than sshd. ok djm@
1760 - (dtucker) [configure.ac] Bug #854: prepend pwd to relative --with-ssl-dir
1761 paths. ok djm@
1762 - (dtucker) [configure.ac session.c] Some platforms (eg some SCO) require
1763 the username to be passed to the passwd command when changing expired
1764 passwords. ok djm@
1765
176620050208
1767 - (dtucker) [regress/test-exec.sh] Bug #912: Set _POSIX2_VERSION for the
1768 regress tests so newer versions of GNU head(1) behave themselves. Patch
1769 by djm, so ok me.
1770 - (dtucker) [openbsd-compat/port-aix.c] Silence compiler warnings.
1771 - (dtucker) [audit.c audit.h auth.c auth1.c auth2.c loginrec.c monitor.c
1772 monitor_wrap.c monitor_wrap.h session.c sshd.c]: Prepend all of the audit
1773 defines and enums with SSH_ to prevent namespace collisions on some
1774 platforms (eg AIX).
1775
177620050204
1777 - (dtucker) [monitor.c] Permit INVALID_USER audit events from slave too.
1778 - (dtucker) [auth.c] Fix parens in audit log check.
1779
178020050202
1781 - (dtucker) [configure.ac openbsd-compat/realpath.c] Sync up with realpath
1782 rev 1.11 from OpenBSD and make it use fchdir if available. ok djm@
1783 - (dtucker) [auth.c loginrec.h openbsd-compat/{bsd-cray,port-aix}.{c,h}]
1784 Make record_failed_login() call provide hostname rather than having the
1785 implementations having to do lookups themselves. Only affects AIX and
1786 UNICOS (the latter only uses the "user" parameter anyway). ok djm@
1787 - (dtucker) [session.c sshd.c] Bug #445: Propogate KRB5CCNAME if set to child
1788 the process. Since we also unset KRB5CCNAME at startup, if it's set after
1789 authentication it must have been set by the platform's native auth system.
1790 This was already done for AIX; this enables it for the general case.
1791 - (dtucker) [auth.c canohost.c canohost.h configure.ac defines.h loginrec.c]
1792 Bug #974: Teach sshd to write failed login records to btmp for failed auth
1793 attempts (currently only for password, kbdint and C/R, only on Linux and
1794 HP-UX), based on code from login.c from util-linux. With ashok_kovai at
1795 hotmail.com, ok djm@
1796 - (dtucker) [Makefile.in auth.c auth.h auth1.c auth2.c loginrec.c monitor.c
1797 monitor.h monitor_wrap.c monitor_wrap.h session.c sshd.c] Bug #125:
1798 (first stage) Add audit instrumentation to sshd, currently disabled by
1799 default. with suggestions from and ok djm@
1800
180120050201
1802 - (dtucker) [log.c] Bug #973: force log_init() to open syslog, since on some
1803 platforms syslog will revert to its default values. This may result in
1804 messages from external libraries (eg libwrap) being sent to a different
1805 facility.
1806 - (dtucker) [sshd_config.5] Bug #701: remove warning about
1807 keyboard-interactive since this is no longer the case.
1808
180920050124
1810 - (dtucker) OpenBSD CVS Sync
1811 - otto@cvs.openbsd.org 2005/01/21 08:32:02
1812 [auth-passwd.c sshd.c]
1813 Warn in advance for password and account expiry; initialize loginmsg
1814 buffer earlier and clear it after privsep fork. ok and help dtucker@
1815 markus@
1816 - dtucker@cvs.openbsd.org 2005/01/22 08:17:59
1817 [auth.c]
1818 Log source of connections denied by AllowUsers, DenyUsers, AllowGroups and
1819 DenyGroups. bz #909, ok djm@
1820 - djm@cvs.openbsd.org 2005/01/23 10:18:12
1821 [cipher.c]
1822 config option "Ciphers" should be case-sensitive; ok dtucker@
1823 - dtucker@cvs.openbsd.org 2005/01/24 10:22:06
1824 [scp.c sftp.c]
1825 Have scp and sftp wait for the spawned ssh to exit before they exit
1826 themselves. This prevents ssh from being unable to restore terminal
1827 modes (not normally a problem on OpenBSD but common with -Portable
1828 on POSIX platforms). From peak at argo.troja.mff.cuni.cz (bz#950);
1829 ok djm@ markus@
1830 - dtucker@cvs.openbsd.org 2005/01/24 10:29:06
1831 [moduli]
1832 Import new moduli; requested by deraadt@ a week ago
1833 - dtucker@cvs.openbsd.org 2005/01/24 11:47:13
1834 [auth-passwd.c]
1835 #if -> #ifdef so builds without HAVE_LOGIN_CAP work too; ok djm@ otto@
1836
183720050120
1838 - (dtucker) OpenBSD CVS Sync
1839 - markus@cvs.openbsd.org 2004/12/23 17:35:48
1840 [session.c]
1841 check for NULL; from mpech
1842 - markus@cvs.openbsd.org 2004/12/23 17:38:07
1843 [ssh-keygen.c]
1844 leak; from mpech
1845 - djm@cvs.openbsd.org 2004/12/23 23:11:00
1846 [servconf.c servconf.h sshd.c sshd_config sshd_config.5]
1847 bz #898: support AddressFamily in sshd_config. from
1848 peak@argo.troja.mff.cuni.cz; ok deraadt@
1849 - markus@cvs.openbsd.org 2005/01/05 08:51:32
1850 [sshconnect.c]
1851 remove dead code, log connect() failures with level error, ok djm@
1852 - jmc@cvs.openbsd.org 2005/01/08 00:41:19
1853 [sshd_config.5]
1854 `login'(n) -> `log in'(v);
1855 - dtucker@cvs.openbsd.org 2005/01/17 03:25:46
1856 [moduli.c]
1857 Correct spelling: SCHNOOR->SCHNORR; ok djm@
1858 - dtucker@cvs.openbsd.org 2005/01/17 22:48:39
1859 [sshd.c]
1860 Make debugging output continue after reexec; ok djm@
1861 - dtucker@cvs.openbsd.org 2005/01/19 13:11:47
1862 [auth-bsdauth.c auth2-chall.c]
1863 Have keyboard-interactive code call the drivers even for responses for
1864 invalid logins. This allows the drivers themselves to decide how to
1865 handle them and prevent leaking information where possible. Existing
1866 behaviour for bsdauth is maintained by checking authctxt->valid in the
1867 bsdauth driver. Note that any third-party kbdint drivers will now need
1868 to be able to handle responses for invalid logins. ok markus@
1869 - djm@cvs.openbsd.org 2004/12/22 02:13:19
1870 [cipher-ctr.c cipher.c]
1871 remove fallback AES support for old OpenSSL, as OpenBSD has had it for
1872 many years now; ok deraadt@
1873 (Id sync only: Portable will continue to support older OpenSSLs)
1874 - (dtucker) [auth-pam.c] Bug #971: Prevent leaking information about user
1875 existence via keyboard-interactive/pam, in conjunction with previous
1876 auth2-chall.c change; with Colin Watson and djm.
1877 - (dtucker) [loginrec.h] Bug #952: Increase size of username field to 128
1878 bytes to prevent errors from login_init_entry() when the username is
1879 exactly 64 bytes(!) long. From brhamon at cisco.com, ok djm@
1880 - (dtucker) [auth-chall.c auth.h auth2-chall.c] Bug #936: Remove pam from
1881 the list of available kbdint devices if UsePAM=no. ok djm@
1882
188320050118
1884 - (dtucker) [INSTALL Makefile.in configure.ac survey.sh.in] Implement
1885 "make survey" and "make send-survey". This will provide data on the
1886 configure parameters, platform and platform features to the development
1887 team, which will allow (among other things) better targetting of testing.
1888 It's entirely voluntary and is off be default. ok djm@
1889 - (dtucker) [survey.sh.in] Remove any blank lines from the output of
1890 ccver-v and ccver-V.
1891
189220041220
1893 - (dtucker) [ssh-rand-helper.c] Fall back to command-based seeding if reading
1894 from prngd is enabled at compile time but fails at run time, eg because
1895 prngd is not running. Note that if you have prngd running when OpenSSH is
1896 built, OpenSSL will consider itself internally seeded and rand-helper won't
1897 be built at all unless explicitly enabled via --with-rand-helper. ok djm@
1898 - (dtucker) [regress/rekey.sh] Touch datafile before filling with dd, since
1899 on some wacky platforms (eg old AIXes), dd will refuse to create an output
1900 file if it doesn't exist.
1901
190220041213
1903 - (dtucker) [contrib/findssh.sh] Clean up on interrupt; from
1904 amarendra.godbole at ge com.
1905
190620041211
1907 - (dtucker) OpenBSD CVS Sync
1908 - markus@cvs.openbsd.org 2004/12/06 16:00:43
1909 [bufaux.c]
1910 use 0x00 not \0 since buf[] is a bignum
1911 - fgsch@cvs.openbsd.org 2004/12/10 03:10:42
1912 [sftp.c]
1913 - fix globbed ls for paths the same lenght as the globbed path when
1914 we have a unique matching.
1915 - fix globbed ls in case of a directory when we have a unique matching.
1916 - as a side effect, if the path does not exist error (used to silently
1917 ignore).
1918 - don't do extra do_lstat() if we only have one matching file.
1919 djm@ ok
1920 - dtucker@cvs.openbsd.org 2004/12/11 01:48:56
1921 [auth-rsa.c auth2-pubkey.c authfile.c misc.c misc.h]
1922 Fix debug call in error path of authorized_keys processing and fix related
1923 warnings; ok djm@
1924
192520041208
1926 - (tim) [configure.ac] Comment some non obvious platforms in the
1927 target-specific case statement. Suggested and OK by dtucker@
1928
192920041207
1930 - (dtucker) [regress/scp.sh] Use portable-friendly $DIFFOPTs in new test.
1931
193220041206
1933 - (dtucker) [TODO WARNING.RNG] Update to reflect current reality. ok djm@
1934 - (dtucker) OpenBSD CVS Sync
1935 - markus@cvs.openbsd.org 2004/11/25 22:22:14
1936 [sftp-client.c sftp.c]
1937 leak; from mpech
1938 - jmc@cvs.openbsd.org 2004/11/29 00:05:17
1939 [sftp.1]
1940 missing full stop;
1941 - djm@cvs.openbsd.org 2004/11/29 07:41:24
1942 [sftp-client.h sftp.c]
1943 Some small fixes from moritz@jodeit.org. ok deraadt@
1944 - jaredy@cvs.openbsd.org 2004/12/05 23:55:07
1945 [sftp.1]
1946 - explain that patterns can be used as arguments in get/put/ls/etc
1947 commands (prodded by Michael Knudsen)
1948 - describe ls flags as a list
1949 - other minor improvements
1950 ok jmc, djm
1951 - dtucker@cvs.openbsd.org 2004/12/06 11:41:03
1952 [auth-rsa.c auth2-pubkey.c authfile.c misc.c misc.h ssh.h sshd.8]
1953 Discard over-length authorized_keys entries rather than complaining when
1954 they don't decode. bz #884, with & ok djm@
1955 - (dtucker) OpenBSD CVS Sync (regress/)
1956 - djm@cvs.openbsd.org 2004/06/26 06:16:07
1957 [reexec.sh]
1958 don't change the name of the copied sshd for the reexec fallback test,
1959 makes life simpler for portable
1960 - dtucker@cvs.openbsd.org 2004/07/08 12:59:35
1961 [scp.sh]
1962 Regress test for bz #863 (scp double-error), requires $SUDO. ok markus@
1963 - david@cvs.openbsd.org 2004/07/09 19:45:43
1964 [Makefile]
1965 add a missing CLEANFILES used in the re-exec test
1966 - djm@cvs.openbsd.org 2004/10/08 02:01:50
1967 [reexec.sh]
1968 shrink and tidy; ok dtucker@
1969 - djm@cvs.openbsd.org 2004/10/29 23:59:22
1970 [Makefile added brokenkeys.sh]
1971 regression test for handling of corrupt keys in authorized_keys file
1972 - djm@cvs.openbsd.org 2004/11/07 00:32:41
1973 [multiplex.sh]
1974 regression tests for new multiplex commands
1975 - dtucker@cvs.openbsd.org 2004/11/25 09:39:27
1976 [test-exec.sh]
1977 Remove obsolete RhostsAuthentication from test config; ok markus@
1978 - dtucker@cvs.openbsd.org 2004/12/06 10:49:56
1979 [test-exec.sh]
1980 Check if TEST_SSH_SSHD is a full path to sshd before searching; ok markus@
1981
198220041203
1983 - (dtucker) OpenBSD CVS Sync
1984 - jmc@cvs.openbsd.org 2004/11/07 17:42:36
1985 [ssh.1]
1986 options sort, and whitespace;
1987 - jmc@cvs.openbsd.org 2004/11/07 17:57:30
1988 [ssh.c]
1989 usage():
1990 - add -O
1991 - sync -S w/ manpage
1992 - remove -h
1993 - (dtucker) [auth1.c auth2.c] If the user successfully authenticates but is
1994 subsequently denied by the PAM auth stack, send the PAM message to the
1995 user via packet_disconnect (Protocol 1) or userauth_banner (Protocol 2).
1996 ok djm@
1997
199820041107
1999 - (dtucker) OpenBSD CVS Sync
2000 - djm@cvs.openbsd.org 2004/11/05 12:19:56
2001 [sftp.c]
2002 command editing and history support via libedit; ok markus@
2003 thanks to hshoexer@ and many testers on tech@ too
2004 - djm@cvs.openbsd.org 2004/11/07 00:01:46
2005 [clientloop.c clientloop.h ssh.1 ssh.c]
2006 add basic control of a running multiplex master connection; including the
2007 ability to check its status and request it to exit; ok markus@
2008 - (dtucker) [INSTALL Makefile.in configure.ac] Add --with-libedit configure
2009 option and supporting makefile bits and documentation.
2010
201120041105
2012 - (dtucker) OpenBSD CVS Sync
2013 - markus@cvs.openbsd.org 2004/08/30 09:18:08
2014 [LICENCE]
2015 s/keygen/keyscan/
2016 - jmc@cvs.openbsd.org 2004/08/30 21:22:49
2017 [ssh-add.1 ssh.1]
2018 .Xsession -> .xsession;
2019 originally from a pr from f at obiit dot org, but missed by myself;
2020 ok markus@ matthieu@
2021 - djm@cvs.openbsd.org 2004/09/07 23:41:30
2022 [clientloop.c ssh.c]
2023 cleanup multiplex control socket on SIGHUP too, spotted by sturm@
2024 ok markus@ deraadt@
2025 - deraadt@cvs.openbsd.org 2004/09/15 00:46:01
2026 [ssh.c]
2027 /* fallthrough */ is something a programmer understands. But
2028 /* FALLTHROUGH */ is also understood by lint, so that is better.
2029 - jaredy@cvs.openbsd.org 2004/09/15 03:25:41
2030 [sshd_config.5]
2031 mention PrintLastLog only prints last login time for interactive
2032 sessions, like PrintMotd mentions.
2033 From Michael Knudsen, with wording changed slightly to match the
2034 PrintMotd description.
2035 ok djm
2036 - mickey@cvs.openbsd.org 2004/09/15 18:42:27
2037 [sshd.c]
2038 use less doubles in daemons; markus@ ok
2039 - deraadt@cvs.openbsd.org 2004/09/15 18:46:04
2040 [scp.c]
2041 scratch that do { } while (0) wrapper in this case
2042 - djm@cvs.openbsd.org 2004/09/23 13:00:04
2043 [ssh.c]
2044 correctly honour -n in multiplex client mode; spotted by sturm@ ok markus@
2045 - djm@cvs.openbsd.org 2004/09/25 03:45:14
2046 [sshd.c]
2047 these printf args are no longer double; ok deraadt@ markus@
2048 - djm@cvs.openbsd.org 2004/10/07 10:10:24
2049 [scp.1 sftp.1 ssh.1 ssh_config.5]
2050 document KbdInteractiveDevices; ok markus@
2051 - djm@cvs.openbsd.org 2004/10/07 10:12:36
2052 [ssh-agent.c]
2053 don't unlink agent socket when bind() fails, spotted by rich AT
2054 rich-paul.net, ok markus@
2055 - markus@cvs.openbsd.org 2004/10/20 11:48:53
2056 [packet.c ssh1.h]
2057 disconnect for invalid (out of range) message types.
2058 - djm@cvs.openbsd.org 2004/10/29 21:47:15
2059 [channels.c channels.h clientloop.c]
2060 fix some window size change bugs for multiplexed connections: windows sizes
2061 were not being updated if they had changed after ~^Z suspends and SIGWINCH
2062 was not being processed unless the first connection had requested a tty;
2063 ok markus
2064 - djm@cvs.openbsd.org 2004/10/29 22:53:56
2065 [clientloop.c misc.h readpass.c ssh-agent.c]
2066 factor out common permission-asking code to separate function; ok markus@
2067 - djm@cvs.openbsd.org 2004/10/29 23:56:17
2068 [bufaux.c bufaux.h buffer.c buffer.h]
2069 introduce a new buffer API that returns an error rather than fatal()ing
2070 when presented with bad data; ok markus@
2071 - djm@cvs.openbsd.org 2004/10/29 23:57:05
2072 [key.c]
2073 use new buffer API to avoid fatal errors on corrupt keys in authorized_keys
2074 files; ok markus@
2075
207620041102
2077 - (dtucker) [configure.ac includes.h] Bug #947: Fix compile error on HP-UX
2078 10.x by testing for conflicts in shadow.h and undef'ing _INCLUDE__STDC__
2079 only if a conflict is detected.
2080
208120041019
2082 - (dtucker) [uidswap.c] Don't test dropping of gids for the root user or
2083 on Cygwin. Cygwin parts from vinschen at redhat com; ok djm@
2084
208520041016
2086 - (djm) [auth-pam.c] snprintf->strl*, fix server message length calculations;
2087 ok dtucker@
2088
208920041006
2090 - (dtucker) [README.privsep] Bug #939: update info about HP-UX Trusted Mode
2091 and other PAM platforms.
2092 - (dtucker) [monitor_mm.c openbsd-compat/xmmap.c] Bug #940: cast constants
2093 to void * to appease picky compilers (eg Tru64's "cc -std1").
2094
209520040930
2096 - (dtucker) [configure.ac] Set AC_PACKAGE_NAME. ok djm@
2097
209820040923
2099 - (dtucker) [openbsd-compat/bsd-snprintf.c] Previous change was off by one,
2100 which could have caused the justification to be wrong. ok djm@
2101
210220040921
2103 - (dtucker) [openbsd-compat/bsd-snprintf.c] Check for max length too.
2104 ok djm@
2105 - (dtucker) [contrib/cygwin/ssh-host-config] Update to match current Cygwin
2106 install process. Patch from vinschen at redhat.com.
2107
210820040912
2109 - (djm) [loginrec.c] Start KNF and tidy up of this long-neglected file.
2110 No change in resultant binary
2111 - (djm) [loginrec.c] __func__ifiy
2112 - (djm) [loginrec.c] xmalloc
2113 - (djm) [ssh.c sshd.c version.h] Don't divulge portable version in protocol
2114 banner. Suggested by deraadt@, ok mouring@, dtucker@
2115 - (dtucker) [configure.ac] Fix incorrect quoting and tests for cross-compile.
2116 Partly by & ok djm@.
2117
211820040911
2119 - (djm) [ssh-agent.c] unifdef some cygwin code; ok dtucker@
2120 - (dtucker) [auth-pam.c auth-pam.h session.c] Bug #890: Send output from
2121 failing PAM session modules to user then exit, similar to the way
2122 /etc/nologin is handled. ok djm@
2123 - (dtucker) [auth-pam.c] Relocate sshpam_store_conv(), no code change.
2124 - (djm) [auth2-kbdint.c auth2-none.c auth2-passwd.c auth2-pubkey.c]
2125 Make cygwin code more consistent with that which surrounds it
2126 - (dtucker) [auth-pam.c auth.h auth2-none.c auth2.c monitor.c monitor_wrap.c]
2127 Bug #892: Send messages from failing PAM account modules to the client via
2128 SSH2_MSG_USERAUTH_BANNER messages. Note that this will not happen with
2129 SSH2 kbdint authentication, which need to be dealt with separately. ok djm@
2130 - (dtucker) [session.c] Bug #927: make .hushlogin silent again. ok djm@
2131 - (dtucker) [configure.ac] Bug #321: Add cross-compile support to configure.
2132 Parts by chua at ayrnetworks.com, astrand at lysator.liu.se and me. ok djm@
2133 - (dtucker) [auth-krb5.c] Bug #922: Pass KRB5CCNAME to PAM. From deengert
2134 at anl.gov, ok djm@
2135
213620040830
2137 - (dtucker) [session.c openbsd-compat/bsd-cygwin_util.{c,h}] Bug #915: only
2138 copy required environment variables on Cygwin. Patch from vinschen at
2139 redhat.com, ok djm@
2140 - (dtucker) [regress/Makefile] Clean scp-ssh-wrapper.scp too. Patch from
2141 vinschen at redhat.com.
2142 - (dtucker) [Makefile.in contrib/ssh-copy-id] Bug #894: Improve portability
2143 of shell constructs. Patch from cjwatson at debian.org.
2144
214520040829
2146 - (dtucker) [openbsd-compat/getrrsetbyname.c] Prevent getrrsetbyname from
2147 failing with NOMEMORY if no sigs are returned and malloc(0) returns NULL.
2148 From Martin.Kraemer at Fujitsu-Siemens.com; ok djm@
2149 - (dtucker) OpenBSD CVS Sync
2150 - djm@cvs.openbsd.org 2004/08/23 11:48:09
2151 [authfile.c]
2152 fix error path, spotted by Martin.Kraemer AT Fujitsu-Siemens.com; ok markus
2153 - djm@cvs.openbsd.org 2004/08/23 11:48:47
2154 [channels.c]
2155 typo, spotted by Martin.Kraemer AT Fujitsu-Siemens.com; ok markus
2156 - dtucker@cvs.openbsd.org 2004/08/23 14:26:38
2157 [ssh-keysign.c ssh.c]
2158 Use permanently_set_uid() in ssh and ssh-keysign for consistency, matches
2159 change in Portable; ok markus@ (CVS ID sync only)
2160 - dtucker@cvs.openbsd.org 2004/08/23 14:29:23
2161 [ssh-keysign.c]
2162 Remove duplicate getuid(), suggested by & ok markus@
2163 - markus@cvs.openbsd.org 2004/08/26 16:00:55
2164 [ssh.1 sshd.8]
2165 get rid of references to rhosts authentication; with jmc@
2166 - djm@cvs.openbsd.org 2004/08/28 01:01:48
2167 [sshd.c]
2168 don't erroneously close stdin for !reexec case, from Dave Johnson;
2169 ok markus@
2170 - (dtucker) [configure.ac] Include sys/stream.h in sys/ptms.h header check,
2171 fixes configure warning on Solaris reported by wknox at mitre.org.
2172 - (dtucker) [regress/multiplex.sh] Skip test on platforms that do not
2173 support FD passing since multiplex requires it. Noted by tim@
2174 - (dtucker) [regress/dynamic-forward.sh] Allow time for connections to be torn
2175 down, needed on some platforms, should be harmless on others. Patch from
2176 jason at devrandom.org.
2177 - (dtucker) [regress/scp.sh] Make this work on Cygwin too, which doesn't like
2178 files ending in .exe that aren't binaries; patch from vinschen at redhat.com.
2179 - (dtucker) [Makefile.in] Get regress/Makefile symlink right for out-of-tree
2180 builds too, from vinschen at redhat.com.
2181 - (dtucker) [regress/agent-ptrace.sh] Skip ptrace test on OSF1/DUnix/Tru64
2182 too; patch from cmadams at hiwaay.net.
2183 - (dtucker) [configure.ac] Replace non-portable echo \n with extra echo.
2184 - (dtucker) [openbsd-compat/port-aix.c] Bug #712: Explicitly check for
2185 accounts with authentication configs that sshd can't support (ie
2186 SYSTEM=NONE and AUTH1=something).
2187
218820040828
2189 - (dtucker) [openbsd-compat/mktemp.c] Remove superfluous Cygwin #ifdef; from
2190 vinschen at redhat.com.
2191
219220040823
2193 - (djm) [ssh-rand-helper.c] Typo. Found by
2194 Martin.Kraemer AT Fujitsu-Siemens.com
2195 - (djm) [loginrec.c] Typo and bad args in error messages; Spotted by
2196 Martin.Kraemer AT Fujitsu-Siemens.com
2197
219820040817
2199 - (dtucker) [regress/README.regress] Note compatibility issues with GNU head.
2200 - (djm) OpenBSD CVS Sync
2201 - markus@cvs.openbsd.org 2004/08/16 08:17:01
2202 [version.h]
2203 3.9
2204 - (djm) Crank RPM spec version numbers
2205 - (djm) Release 3.9p1
2206
220720040816
2208 - (dtucker) [acconfig.h auth-pam.c configure.ac] Set real uid to non-root
2209 to convince Solaris PAM to honour password complexity rules. ok djm@
2210
221120040815
2212 - (dtucker) [Makefile.in ssh-keysign.c ssh.c] Use permanently_set_uid() since
2213 it does the right thing on all platforms. ok djm@
2214 - (djm) [acconfig.h configure.ac openbsd-compat/Makefile.in
2215 openbsd-compat/bsd-closefrom.c openbsd-compat/bsd-misc.c
2216 openbsd-compat/bsd-misc.h openbsd-compat/openbsd-compat.h] Use smarter
2217 closefrom() replacement from sudo; ok dtucker@
2218 - (djm) [loginrec.c] Check that seek succeeded here too; ok dtucker
2219 - (dtucker) [Makefile.in] Fix typo.
2220
222120040814
2222 - (dtucker) [auth-krb5.c gss-serv-krb5.c openbsd-compat/xmmap.c]
2223 Explicitly set umask for mkstemp; ok djm@
2224 - (dtucker) [includes.h] Undef _INCLUDE__STDC__ on HP-UX, otherwise
2225 prot.h and shadow.h provide conflicting declarations of getspnam. ok djm@
2226 - (dtucker) [loginrec.c openbsd-compat/port-aix.c openbsd-compat/port-aix.h]
2227 Plug AIX login recording into login_write so logins will be recorded for
2228 all auth types.
2229
223020040813
2231 - (dtucker) [openbsd-compat/bsd-misc.c] Typo in #ifdef; from vinschen at
2232 redhat.com
2233- (dtucker) OpenBSD CVS Sync
2234 - avsm@cvs.openbsd.org 2004/08/11 21:43:05
2235 [channels.c channels.h clientloop.c misc.c misc.h serverloop.c ssh-agent.c]
2236 some signed/unsigned int comparison cleanups; markus@ ok
2237 - avsm@cvs.openbsd.org 2004/08/11 21:44:32
2238 [authfd.c scp.c ssh-keyscan.c]
2239 use atomicio instead of homegrown equivalents or read/write.
2240 markus@ ok
2241 - djm@cvs.openbsd.org 2004/08/12 09:18:24
2242 [sshlogin.c]
2243 typo in error message, spotted by moritz AT jodeit.org (Id sync only)
2244 - jakob@cvs.openbsd.org 2004/08/12 21:41:13
2245 [ssh-keygen.1 ssh.1]
2246 improve SSHFP documentation; ok deraadt@
2247 - jmc@cvs.openbsd.org 2004/08/13 00:01:43
2248 [ssh-keygen.1]
2249 kill whitespace at eol;
2250 - djm@cvs.openbsd.org 2004/08/13 02:51:48
2251 [monitor_fdpass.c]
2252 extra check for no message case; ok markus, deraadt, hshoexer, henning
2253 - dtucker@cvs.openbsd.org 2004/08/13 11:09:24
2254 [servconf.c]
2255 Fix line numbers off-by-one in error messages, from tortay at cc.in2p3.fr
2256 ok markus@, djm@
2257
225820040812
2259 - (dtucker) [sshd.c] Remove duplicate variable imported during sync.
2260 - (dtucker) OpenBSD CVS Sync
2261 - markus@cvs.openbsd.org 2004/07/28 08:56:22
2262 [sshd.c]
2263 call setsid() _before_ re-exec
2264 - markus@cvs.openbsd.org 2004/07/28 09:40:29
2265 [auth.c auth1.c auth2.c cipher.c cipher.h key.c session.c ssh.c
2266 sshconnect1.c]
2267 more s/illegal/invalid/
2268 - djm@cvs.openbsd.org 2004/08/04 10:37:52
2269 [dh.c]
2270 return group14 when no primes found - fixes hang on empty /etc/moduli;
2271 ok markus@
2272 - dtucker@cvs.openbsd.org 2004/08/11 11:09:54
2273 [servconf.c]
2274 Fix minor leak; "looks right" deraadt@
2275 - dtucker@cvs.openbsd.org 2004/08/11 11:50:09
2276 [sshd.c]
2277 Don't try to close startup_pipe if it's not open; ok djm@
2278 - djm@cvs.openbsd.org 2004/08/11 11:59:22
2279 [sshlogin.c]
2280 check that lseek went were we told it to; ok markus@
2281 (Id sync only, but similar changes are needed in loginrec.c)
2282 - djm@cvs.openbsd.org 2004/08/11 12:01:16
2283 [sshlogin.c]
2284 make store_lastlog_message() static to appease -Wall; ok markus
2285 - (dtucker) [sshd.c] Clear loginmsg in postauth monitor, prevents doubling
2286 messages generated before the postauth privsep split.
2287
228820040720
2289 - (djm) OpenBSD CVS Sync
2290 - markus@cvs.openbsd.org 2004/07/21 08:56:12
2291 [auth.c]
2292 s/Illegal user/Invalid user/; many requests; ok djm, millert, niklas,
2293 miod, ...
2294 - djm@cvs.openbsd.org 2004/07/21 10:33:31
2295 [auth1.c auth2.c]
2296 bz#899: Don't display invalid usernames in setproctitle
2297 from peak AT argo.troja.mff.cuni.cz; ok markus@
2298 - djm@cvs.openbsd.org 2004/07/21 10:36:23
2299 [gss-serv-krb5.c]
2300 fix function declaration
2301 - djm@cvs.openbsd.org 2004/07/21 11:51:29
2302 [canohost.c]
2303 bz#902: cache remote port so we don't fatal() in auth_log when remote
2304 connection goes away quickly. from peak AT argo.troja.mff.cuni.cz;
2305 ok markus@
2306 - (djm) [auth-pam.c] Portable parts of bz#899: Don't display invalid
2307 usernames in setproctitle from peak AT argo.troja.mff.cuni.cz;
2308
230920040720
2310 - (djm) [log.c] bz #111: Escape more control characters when sending data
2311 to syslog; from peak AT argo.troja.mff.cuni.cz
2312 - (djm) [contrib/redhat/sshd.pam] bz #903: Remove redundant entries; from
2313 peak AT argo.troja.mff.cuni.cz
2314 - (djm) [regress/README.regress] Remove caveat regarding TCP wrappers, now
2315 that sshd is fixed to behave better; suggested by tim
2316
231720040719
2318 - (djm) [openbsd-compat/bsd-arc4random.c] Discard early keystream, like OpenBSD
2319 ok dtucker@
2320 - (djm) [auth-pam.c] Avoid use of xstrdup and friends in conversation function,
2321 instead return PAM_CONV_ERR, avoiding another path to fatal(); ok dtucker@
2322 - (tim) [configure.ac] updwtmpx() on OpenServer seems to add duplicate entry.
2323 Report by rac AT tenzing.org
2324
232520040717
2326 - (dtucker) [logintest.c scp.c sftp-server.c sftp.c ssh-add.c ssh-agent.c
2327 ssh-keygen.c ssh-keyscan.c ssh-keysign.c ssh-rand-helper.c ssh.c sshd.c
2328 openbsd-compat/bsd-misc.c] Move "char *__progname" to bsd-misc.c. Reduces
2329 diff vs OpenBSD; ok mouring@, tested by tim@ too.
2330 - (dtucker) OpenBSD CVS Sync
2331 - deraadt@cvs.openbsd.org 2004/07/11 17:48:47
2332 [channels.c cipher.c clientloop.c clientloop.h compat.h moduli.c
2333 readconf.c nchan.c pathnames.h progressmeter.c readconf.h servconf.c
2334 session.c sftp-client.c sftp.c ssh-agent.1 ssh-keygen.c ssh.c ssh1.h
2335 sshd.c ttymodes.h]
2336 spaces
2337 - brad@cvs.openbsd.org 2004/07/12 23:34:25
2338 [ssh-keyscan.1]
2339 Fix incorrect macro, .I -> .Em
2340 From: Eric S. Raymond <esr at thyrsus dot com>
2341 ok jmc@
2342 - dtucker@cvs.openbsd.org 2004/07/17 05:31:41
2343 [monitor.c monitor_wrap.c session.c session.h sshd.c sshlogin.c]
2344 Move "Last logged in at.." message generation to the monitor, right
2345 before recording the new login. Fixes missing lastlog message when
2346 /var/log/lastlog is not world-readable and incorrect datestamp when
2347 multiple sessions are used (bz #463); much assistance & ok markus@
2348
234920040711
2350 - (dtucker) [auth-pam.c] Check for zero from waitpid() too, which allows
2351 the monitor to properly clean up the PAM thread (Debian bug #252676).
2352
235320040709
2354 - (tim) [contrib/cygwin/README] add minires-devel requirement. Patch from
2355 vinschen AT redhat.com
2356
235720040708
2358 - (dtucker) OpenBSD CVS Sync
2359 - dtucker@cvs.openbsd.org 2004/07/03 05:11:33
2360 [sshlogin.c] (RCSID sync only, the corresponding code is not in Portable)
2361 Use '\0' not 0 for string; ok djm@, deraadt@
2362 - dtucker@cvs.openbsd.org 2004/07/03 11:02:25
2363 [monitor_wrap.c]
2364 Put s/key functions inside #ifdef SKEY same as monitor.c,
2365 from des@freebsd via bz #330, ok markus@
2366 - dtucker@cvs.openbsd.org 2004/07/08 12:47:21
2367 [scp.c]
2368 Prevent scp from skipping the file following a double-error.
2369 bz #863, ok markus@
2370
237120040702
2372 - (dtucker) [mdoc2man.awk] Teach it to ignore .Bk -words, reported by
2373 strube at physik3.gwdg.de a long time ago.
2374
237520040701
2376 - (dtucker) [session.c] Call display_loginmsg again after do_pam_session.
2377 Ensures messages from PAM modules are displayed when privsep=no.
2378 - (dtucker) [auth-pam.c] Bug #705: Make arguments match PAM specs, fixes
2379 warnings on compliant platforms. From paul.a.bolton at bt.com. ok djm@
2380 - (dtucker) [auth-pam.c] Bug #559 (last piece): Pass DISALLOW_NULL_AUTHTOK
2381 to pam_authenticate for challenge-response auth too. Originally from
2382 fcusack at fcusack.com, ok djm@
2383 - (tim) [buildpkg.sh.in] Add $REV to bump the package revision within
2384 the same version. Handle the case where someone uses --with-privsep-user=
2385 and the user name does not match the group name. ok dtucker@
2386
238720040630
2388 - (dtucker) [auth-pam.c] Check for buggy PAM modules that return a NULL
2389 appdata_ptr to the conversation function. ok djm@
2390 - (djm) OpenBSD CVS Sync
2391 - jmc@cvs.openbsd.org 2004/06/26 09:03:21
2392 [ssh.1]
2393 - remove double word
2394 - rearrange .Bk to keep SYNOPSIS nice
2395 - -M before -m in options description
2396 - jmc@cvs.openbsd.org 2004/06/26 09:11:14
2397 [ssh_config.5]
2398 punctuation and grammar fixes. also, keep the options in order.
2399 - jmc@cvs.openbsd.org 2004/06/26 09:14:40
2400 [sshd_config.5]
2401 new sentence, new line;
2402 - avsm@cvs.openbsd.org 2004/06/26 20:07:16
2403 [sshd.c]
2404 initialise some fd variables to -1, djm@ ok
2405 - djm@cvs.openbsd.org 2004/06/30 08:36:59
2406 [session.c]
2407 unbreak TTY break, diagnosed by darren AT dazwin.com; ok markus@
2408
240920040627
2410 - (tim) update README files.
2411 - (dtucker) [mdoc2man.awk] Bug #883: correctly recognise .Pa and .Ev macros.
2412 - (dtucker) [regress/README.regress] Document new variables.
2413 - (dtucker) [acconfig.h configure.ac sftp-server.c] Bug #823: add sftp
2414 rename handling for Linux which returns EPERM for link() on (at least some)
2415 filesystems that do not support hard links. sftp-server will fall back to
2416 stat+rename() in such cases.
2417 - (dtucker) [openbsd-compat/port-aix.c] Missing __func__.
2418
241920040626
2420 - (djm) OpenBSD CVS Sync
2421 - djm@cvs.openbsd.org 2004/06/25 18:43:36
2422 [sshd.c]
2423 fix broken fd handling in the re-exec fallback path, particularly when
2424 /dev/crypto is in use; ok deraadt@ markus@
2425 - djm@cvs.openbsd.org 2004/06/25 23:21:38
2426 [sftp.c]
2427 bz #875: fix bad escape char error message; reported by f_mohr AT yahoo.de
2428
242920040625
2430 - (dtucker) OpenBSD CVS Sync
2431 - djm@cvs.openbsd.org 2004/06/24 19:30:54
2432 [servconf.c servconf.h sshd.c]
2433 re-exec sshd on accept(); initial work, final debugging and ok markus@
2434 - djm@cvs.openbsd.org 2004/06/25 01:16:09
2435 [sshd.c]
2436 only perform tcp wrappers checks when the incoming connection is on a
2437 socket. silences useless warnings from regress tests that use
2438 proxycommand="sshd -i". prompted by david@ ok markus@
2439 - djm@cvs.openbsd.org 2004/06/24 19:32:00
2440 [regress/Makefile regress/test-exec.sh, added regress/reexec.sh]
2441 regress test for re-exec corner cases
2442 - djm@cvs.openbsd.org 2004/06/25 01:25:12
2443 [regress/test-exec.sh]
2444 clean reexec-specific junk out of text-exec.sh and simplify; idea markus@
2445 - dtucker@cvs.openbsd.org 2004/06/25 05:38:48
2446 [sftp-server.c]
2447 Fall back to stat+rename if filesystem doesn't doesn't support hard
2448 links. bz#823, ok djm@
2449 - (dtucker) [configure.ac openbsd-compat/misc.c [openbsd-compat/misc.h]
2450 Add closefrom() for platforms that don't have it.
2451 - (dtucker) [sshd.c] add line missing from reexec sync.
2452
245320040623
2454 - (dtucker) [auth1.c] Ensure do_pam_account is called for Protocol 1
2455 connections with empty passwords. Patch from davidwu at nbttech.com,
2456 ok djm@
2457 - (dtucker) OpenBSD CVS Sync
2458 - dtucker@cvs.openbsd.org 2004/06/22 22:42:02
2459 [regress/envpass.sh]
2460 Add quoting for test -z; ok markus@
2461 - dtucker@cvs.openbsd.org 2004/06/22 22:45:52
2462 [regress/test-exec.sh]
2463 Add TEST_SSH_SSHD_CONFOPTS and TEST_SSH_SSH_CONFOPTS to allow adding
2464 arbitary options to sshd_config and ssh_config during tests. ok markus@
2465 - dtucker@cvs.openbsd.org 2004/06/22 22:55:56
2466 [regress/dynamic-forward.sh regress/test-exec.sh]
2467 Allow setting of port for regress from TEST_SSH_PORT variable; ok markus@
2468 - mouring@cvs.openbsd.org 2004/06/23 00:39:38
2469 [rijndael.c]
2470 -Wshadow fix up s/encrypt/do_encrypt/. OK djm@, markus@
2471 - dtucker@cvs.openbsd.org 2004/06/23 14:31:01
2472 [ssh.c]
2473 Fix counting in master/slave when passing environment variables; ok djm@
2474 - (dtucker) [cipher.c] encrypt->do_encrypt inside SSH_OLD_EVP to match
2475 -Wshadow change.
2476 - (bal) [Makefile.in] Remove opensshd.init on 'make distclean'
2477 - (dtucker) [auth.c openbsd-compat/port-aix.c openbsd-compat/port-aix.h]
2478 Move loginrestrictions test to port-aix.c, replace with a generic hook.
2479 - (tim) [regress/try-ciphers.sh] "if ! some_command" is not portable.
2480 - (bal) [contrib/README] Removed "mdoc2man.pl" reference and added
2481 reference to "findssl.sh"
2482
248320040622
2484 - (dtucker) OpenBSD CVS Sync
2485 - djm@cvs.openbsd.org 2004/06/20 17:36:59
2486 [ssh.c]
2487 filter passed env vars at slave in connection sharing case; ok markus@
2488 - djm@cvs.openbsd.org 2004/06/20 18:53:39
2489 [sftp.c]
2490 make "ls -l" listings print user/group names, add "ls -n" to show uid/gid
2491 (like /bin/ls); idea & ok markus@
2492 - djm@cvs.openbsd.org 2004/06/20 19:28:12
2493 [sftp.1]
2494 mention new -n flag
2495 - avsm@cvs.openbsd.org 2004/06/21 17:36:31
2496 [auth-rsa.c auth2-gss.c auth2-pubkey.c authfile.c canohost.c channels.c
2497 cipher.c dns.c kex.c monitor.c monitor_fdpass.c monitor_wrap.c
2498 monitor_wrap.h nchan.c packet.c progressmeter.c scp.c sftp-server.c sftp.c
2499 ssh-gss.h ssh-keygen.c ssh.c sshconnect.c sshconnect1.c sshlogin.c
2500 sshpty.c]
2501 make ssh -Wshadow clean, no functional changes
2502 markus@ ok
2503 - djm@cvs.openbsd.org 2004/06/21 17:53:03
2504 [session.c]
2505 fix fd leak for multiple subsystem connections; with markus@
2506 - djm@cvs.openbsd.org 2004/06/21 22:02:58
2507 [log.h]
2508 mark fatal and cleanup exit as __dead; ok markus@
2509 - djm@cvs.openbsd.org 2004/06/21 22:04:50
2510 [sftp.c]
2511 introduce sorting for ls, same options as /bin/ls; ok markus@
2512 - djm@cvs.openbsd.org 2004/06/21 22:30:45
2513 [sftp.c]
2514 prefix ls option flags with LS_
2515 - djm@cvs.openbsd.org 2004/06/21 22:41:31
2516 [sftp.1]
2517 document sort options
2518 - djm@cvs.openbsd.org 2004/06/22 01:16:39
2519 [sftp.c]
2520 don't show .files by default in ls, add -a option to turn them back on;
2521 ok markus
2522 - markus@cvs.openbsd.org 2004/06/22 03:12:13
2523 [regress/envpass.sh regress/multiplex.sh]
2524 more portable env passing tests
2525 - dtucker@cvs.openbsd.org 2004/06/22 05:05:45
2526 [monitor.c monitor_wrap.c]
2527 Change login->username, will prevent -Wshadow errors in Portable;
2528 ok markus@
2529 - (dtucker) [monitor.c] Fix Portable-specific -Wshadow warnings on "socket".
2530 - (dtucker) [defines.h] Define __dead if not already defined.
2531 - (bal) [auth-passwd.c auth1.c] Clean up unused variables.
2532
253320040620
2534 - (tim) [configure.ac Makefile.in] Only change TEST_SHELL on broken platforms.
2535
253620040619
2537 - (dtucker) [auth-pam.c] Don't use PAM namespace for
2538 pam_password_change_required either.
2539 - (tim) [configure.ac buildpkg.sh.in contrib/solaris/README] move opensshd
2540 init script to top level directory. Add opensshd.init.in.
2541 Remove contrib/solaris/buildpkg.sh, contrib/solaris/opensshd.in
2542
254320040618
2544 - (djm) OpenBSD CVS Sync
2545 - djm@cvs.openbsd.org 2004/06/17 14:52:48
2546 [clientloop.c clientloop.h ssh.c]
2547 support environment passing over shared connections; ok markus@
2548 - djm@cvs.openbsd.org 2004/06/17 15:10:14
2549 [clientloop.c misc.h readconf.c readpass.c ssh.c ssh_config.5]
2550 Add option for confirmation (ControlMaster=ask) via ssh-askpass before
2551 opening shared connections; ok markus@
2552 - djm@cvs.openbsd.org 2004/06/17 14:53:27
2553 [regress/multiplex.sh]
2554 shared connection env passing regress test
2555 - (dtucker) [regress/README.regress] Add detail on how to run a single
2556 test from the top-level Makefile.
2557 - (dtucker) OpenBSD CVS Sync
2558 - djm@cvs.openbsd.org 2004/06/17 23:56:57
2559 [ssh.1 ssh.c]
2560 sync usage() and SYNPOSIS with connection sharing changes
2561 - dtucker@cvs.openbsd.org 2004/06/18 06:13:25
2562 [sftp.c]
2563 Use execvp instead of execv so sftp -S ssh works. "makes sense" markus@
2564 - dtucker@cvs.openbsd.org 2004/06/18 06:15:51
2565 [multiplex.sh]
2566 Use -S for scp/sftp to force the use of the ssh being tested.
2567 ok djm@,markus@
2568 - (djm) OpenBSD CVS Sync
2569 - djm@cvs.openbsd.org 2004/06/18 10:40:19
2570 [ssh.c]
2571 delay signal handler setup until we have finished talking to the master.
2572 allow interrupting of setup (e.g. if master is stuck); ok markus@
2573 - markus@cvs.openbsd.org 2004/06/18 10:55:43
2574 [ssh.1 ssh.c]
2575 trim synopsis for -S, allow -S and -oControlMaster, -MM means 'ask';
2576 ok djm
2577 - djm@cvs.openbsd.org 2004/06/18 11:11:54
2578 [channels.c clientloop.c]
2579 Don't explode in clientloop when we receive a bogus channel id, but
2580 also don't generate them to begin with; ok markus@
2581
258220040617
2583 - (dtucker) [regress/scp.sh] diff -N is not portable (but needed for some
2584 platforms), so test if diff understands it. Pointed out by tim@, ok djm@
2585 - (dtucker) OpenBSD CVS Sync regress/
2586 - dtucker@cvs.openbsd.org 2004/06/17 05:51:59
2587 [regress/multiplex.sh]
2588 Remove datafile between and after tests, kill sshd rather than wait;
2589 ok djm@
2590 - dtucker@cvs.openbsd.org 2004/06/17 06:00:05
2591 [regress/multiplex.sh]
2592 Use DATA and COPY for test data rather than hard-coded paths; ok djm@
2593 - dtucker@cvs.openbsd.org 2004/06/17 06:19:06
2594 [regress/multiplex.sh]
2595 Add small description of failing test to failure message; ok djm@
2596 - (dtucker) [regress/multiplex.sh] add EXEEXT for those platforms that need
2597 it.
2598 - (dtucker) [regress/multiplex.sh] Increase sleep time to 120 sec (60 is not
2599 enough for slow systems, especially if they don't have a kernel RNG).
2600
260120040616
2602 - (dtucker) [openbsd-compat/port-aix.c] Expand whitespace -> tabs. No
2603 code changes.
2604 - (dtucker) OpenBSD CVS Sync regress/
2605 - djm@cvs.openbsd.org 2004/04/27 09:47:30
2606 [regress/Makefile regress/test-exec.sh, added regress/envpass.sh]
2607 regress test for environment passing, SendEnv & AcceptEnv options;
2608 ok markus@
2609 - dtucker@cvs.openbsd.org 2004/06/13 13:51:02
2610 [regress/Makefile regress/test-exec.sh, added regress/scp-ssh-wrapper.sh
2611 regress/scp.sh]
2612 Add scp regression test; with & ok markus@
2613 - djm@cvs.openbsd.org 2004/06/13 15:04:08
2614 [regress/Makefile regress/test-exec.sh, added regress/envpass.sh]
2615 regress test for client multiplexing; ok markus@
2616 - djm@cvs.openbsd.org 2004/06/13 15:16:54
2617 [regress/test-exec.sh]
2618 remove duplicate setting of $SCP; spotted by markus@
2619 - dtucker@cvs.openbsd.org 2004/06/16 13:15:09
2620 [regress/scp.sh]
2621 Make scp -r tests use diff -rN not cmp (which won't do dirs. ok markus@
2622 - dtucker@cvs.openbsd.org 2004/06/16 13:16:40
2623 [regress/multiplex.sh]
2624 Silence multiplex sftp and scp tests. ok markus@
2625 - (dtucker) [regress/test-exec.sh]
2626 Move Portable-only StrictModes to top of list to make syncs easier.
2627 - (dtucker) [regress/README.regress]
2628 Add $TEST_SHELL to readme.
2629
263020040615
2631 - (djm) OpenBSD CVS Sync
2632 - djm@cvs.openbsd.org 2004/05/26 08:59:57
2633 [sftp.c]
2634 exit -> _exit in forked child on error; from andrushock AT korovino.net
2635 - markus@cvs.openbsd.org 2004/05/26 23:02:39
2636 [channels.c]
2637 missing freeaddrinfo; Andrey Matveev
2638 - dtucker@cvs.openbsd.org 2004/05/27 00:50:13
2639 [readconf.c]
2640 Kill dead code after fatal(); ok djm@
2641 - dtucker@cvs.openbsd.org 2004/06/01 14:20:45
2642 [auth2-chall.c]
2643 Remove redundant #include; ok markus@
2644 - pedro@cvs.openbsd.org 2004/06/03 12:22:20
2645 [sftp-client.c sftp.c]
2646 initialize pointers, ok markus@
2647 - djm@cvs.openbsd.org 2004/06/13 12:53:24
2648 [dh.c dh.h kex.c kex.h kexdhc.c kexdhs.c monitor.c myproposal.h]
2649 [ssh-keyscan.c sshconnect2.c sshd.c]
2650 implement diffie-hellman-group14-sha1 kex method (trivial extension to
2651 existing diffie-hellman-group1-sha1); ok markus@
2652 - dtucker@cvs.openbsd.org 2004/06/13 14:01:42
2653 [ssh.1 ssh_config.5 sshd_config.5]
2654 List supported ciphers in man pages, tidy up ssh -c;
2655 "looks fine" jmc@, ok markus@
2656 - djm@cvs.openbsd.org 2004/06/13 15:03:02
2657 [channels.c channels.h clientloop.c clientloop.h includes.h readconf.c]
2658 [readconf.h scp.1 sftp.1 ssh.1 ssh.c ssh_config.5]
2659 implement session multiplexing in the client (the server has supported
2660 this since 2.0); ok markus@
2661 - djm@cvs.openbsd.org 2004/06/14 01:44:39
2662 [channels.c clientloop.c misc.c misc.h packet.c ssh-agent.c ssh-keyscan.c]
2663 [sshd.c]
2664 set_nonblock() instead of fnctl(...,O_NONBLOCK); "looks sane" deraadt@
2665 - djm@cvs.openbsd.org 2004/06/15 05:45:04
2666 [clientloop.c]
2667 missed one unset_nonblock; spotted by Tim Rice
2668 - (djm) Fix Makefile.in for connection sharing changes
2669 - (djm) [ssh.c] Use separate var for address length
2670
267120040603
2672 - (dtucker) [auth-pam.c] Don't use pam_* namespace for sshd's PAM functions.
2673 ok djm@
2674
267520040601
2676 - (djm) [auth-pam.c] Add copyright for local changes
2677
267820040530
2679 - (dtucker) [auth-pam.c auth-pam.h auth-passwd.c] Bug #874: Re-add PAM
2680 support for PasswordAuthentication=yes. ok djm@
2681 - (dtucker) [auth-pam.c] Use an invalid password for root if
2682 PermitRootLogin != yes or the login is invalid, to prevent leaking
2683 information. Based on Openwall's owl-always-auth patch. ok djm@
2684 - (tim) [configure.ac Makefile.in] Add support for "make package" ok djm@
2685 - (tim) [buildpkg.sh.in] New file. A more flexible version of
2686 contrib/solaris/buildpkg.sh used for "make package".
2687 - (tim) [buildpkg.sh.in] Last minute fix didn't make it in the .in file.
2688
268920040527
2690 - (dtucker) [contrib/caldera/openssh.spec contrib/redhat/openssh.spec
2691 contrib/README CREDITS INSTALL] Bug #873: Correct URLs for x11-ssh-askpass
2692 and Jim Knoble's email address , from Jim himself.
2693
269420040524
2695 - (dtucker) OpenBSD CVS Sync
2696 - djm@cvs.openbsd.org 2004/05/19 12:17:33
2697 [sftp-client.c sftp.c]
2698 gracefully abort transfers on receipt of SIGINT, also ignore SIGINT while
2699 waiting for a command; ok markus@
2700 - dtucker@cvs.openbsd.org 2004/05/20 10:58:05
2701 [clientloop.c]
2702 Trivial type fix 0 -> '\0'; ok markus@
2703 - markus@cvs.openbsd.org 2004/05/21 08:43:03
2704 [kex.h moduli.c tildexpand.c]
2705 add prototypes for -Wall; ok djm
2706 - djm@cvs.openbsd.org 2004/05/21 11:33:11
2707 [channels.c channels.h clientloop.c serverloop.c ssh.1]
2708 bz #756: add support for the cancel-tcpip-forward request for the server
2709 and the client (through the ~C commandline). reported by z3p AT
2710 twistedmatrix.com; ok markus@
2711 - djm@cvs.openbsd.org 2004/05/22 06:32:12
2712 [clientloop.c ssh.1]
2713 use '-h' for help in ~C commandline instead of '-?'; inspired by jmc@
2714 - jmc@cvs.openbsd.org 2004/05/22 16:01:05
2715 [ssh.1]
2716 kill whitespace at eol;
2717 - dtucker@cvs.openbsd.org 2004/05/23 23:59:53
2718 [auth.c auth.h auth1.c auth2.c servconf.c servconf.h sshd_config
2719 sshd_config.5]
2720 Add MaxAuthTries sshd config option; ok markus@
2721 - (dtucker) [auth-pam.c] Bug #839: Ensure that pam authentication "thread"
2722 is terminated if the privsep slave exits during keyboard-interactive
2723 authentication. ok djm@
2724 - (dtucker) [sshd.c] Fix typo in comment.
2725
272620040523
2727 - (djm) [sshd_config] Explain consequences of UsePAM=yes a little better in
2728 sshd_config; ok dtucker@
2729 - (djm) [configure.ac] Warn if the system has no known way of figuring out
2730 which user is on the other end of a Unix domain socket; ok dtucker@
2731 - (bal) [openbsd-compat/sys-queue.h] Reintroduce machinary to handle
2732 old/broken/incomplete <sys/queue.h>.
2733
273420040513
2735 - (dtucker) [configure.ac] Bug #867: Additional tests for res_query in
2736 libresolv, fixes problems detecting it on some platforms
2737 (eg Linux/x86-64). From Kurt Roeckx via Debian, ok mouring@
2738 - (dtucker) OpenBSD CVS Sync
2739 - jmc@cvs.openbsd.org 2004/05/04 18:36:07
2740 [scp.1]
2741 SendEnv here too;
2742 - jmc@cvs.openbsd.org 2004/05/06 11:24:23
2743 [ssh_config.5]
2744 typo from John Cosimano (PR 3770);
2745 - deraadt@cvs.openbsd.org 2004/05/08 00:01:37
2746 [auth.c clientloop.c misc.h servconf.c ssh.c sshpty.h sshtty.c
2747 tildexpand.c], removed: sshtty.h tildexpand.h
2748 make two tiny header files go away; djm ok
2749 - djm@cvs.openbsd.org 2004/05/08 00:21:31
2750 [clientloop.c misc.h readpass.c scard.c ssh-add.c ssh-agent.c ssh-keygen.c
2751 sshconnect.c sshconnect1.c sshconnect2.c] removed: readpass.h
2752 kill a tiny header; ok deraadt@
2753 - djm@cvs.openbsd.org 2004/05/09 00:06:47
2754 [moduli.c ssh-keygen.c] removed: moduli.h
2755 zap another tiny header; ok deraadt@
2756 - djm@cvs.openbsd.org 2004/05/09 01:19:28
2757 [OVERVIEW auth-rsa.c auth1.c kex.c monitor.c session.c sshconnect1.c
2758 sshd.c] removed: mpaux.c mpaux.h
2759 kill some more tiny files; ok deraadt@
2760 - djm@cvs.openbsd.org 2004/05/09 01:26:48
2761 [kex.c]
2762 don't overwrite what we are trying to compute
2763 - deraadt@cvs.openbsd.org 2004/05/11 19:01:43
2764 [auth.c auth2-none.c authfile.c channels.c monitor.c monitor_mm.c
2765 packet.c packet.h progressmeter.c session.c openbsd-compat/xmmap.c]
2766 improve some code lint did not like; djm millert ok
2767 - dtucker@cvs.openbsd.org 2004/05/13 02:47:50
2768 [ssh-agent.1]
2769 Add examples to ssh-agent.1, bz#481 from Ralf Hauser; ok deraadt@
2770 - (dtucker) [sshd.8] Bug #843: Add warning about PasswordAuthentication to
2771 UsePAM section. Parts from djm@ and jmc@.
2772 - (dtucker) [auth-pam.c scard-opensc.c] Tinderbox says auth-pam.c uses
2773 readpass.h, grep says scard-opensc.c does too. Replace with misc.h.
2774 - (dtucker) [openbsd-compat/getrrsetbyname.c] Check that HAVE_DECL_H_ERROR
2775 is defined before using.
2776 - (dtucker) [openbsd-compat/getrrsetbyname.c] Fix typo too: HAVE_DECL_H_ERROR
2777 -> HAVE_DECL_H_ERRNO.
2778
277920040502
2780 - (dtucker) OpenBSD CVS Sync
2781 - djm@cvs.openbsd.org 2004/04/22 11:56:57
2782 [moduli.c]
2783 Bugzilla #850: Sophie Germain is the correct name of the French
2784 mathematician, "Sophie Germaine" isn't; from Luc.Maisonobe@c-s.fr
2785 - djm@cvs.openbsd.org 2004/04/27 09:46:37
2786 [readconf.c readconf.h servconf.c servconf.h session.c session.h ssh.c
2787 ssh_config.5 sshd_config.5]
2788 bz #815: implement ability to pass specified environment variables from
2789 the client to the server; ok markus@
2790 - djm@cvs.openbsd.org 2004/04/28 05:17:10
2791 [ssh_config.5 sshd_config.5]
2792 manpage fixes in envpass stuff from Brian Poole (raj AT cerias.purdue.edu)
2793 - jmc@cvs.openbsd.org 2004/04/28 07:02:56
2794 [sshd_config.5]
2795 remove unnecessary .Pp;
2796 - jmc@cvs.openbsd.org 2004/04/28 07:13:42
2797 [sftp.1 ssh.1]
2798 add SendEnv to -o list;
2799 - dtucker@cvs.openbsd.org 2004/05/02 11:54:31
2800 [sshd.8]
2801 Man page grammar fix (bz #858), from damerell at chiark.greenend.org.uk
2802 via Debian; ok djm@
2803 - dtucker@cvs.openbsd.org 2004/05/02 11:57:52
2804 [ssh.1]
2805 ConnectionTimeout -> ConnectTimeout, from m.a.ellis at ncl.ac.uk via
2806 Debian. ok djm@
2807 - dtucker@cvs.openbsd.org 2004/05/02 23:02:17
2808 [sftp.1]
2809 ConnectionTimeout -> ConnectTimeout here too, pointed out by jmc@
2810 - dtucker@cvs.openbsd.org 2004/05/02 23:17:51
2811 [scp.1]
2812 ConnectionTimeout -> ConnectTimeout for scp.1 too.
2813
281420040423
2815 - (dtucker) [configure.ac openbsd-compat/getrrsetbyname.c] Declare h_errno
2816 as extern int if not already declared. Fixes compile errors on old SCO
2817 platforms. ok tim@
2818 - (dtucker) [README.platform] List prereqs for building on Cygwin.
2819
282020040421
2821 - (djm) Update config.guess and config.sub to autoconf-2.59 versions; ok tim@
2822
282320040420
2824 - (djm) OpenBSD CVS Sync
2825 - henning@cvs.openbsd.org 2004/04/08 16:08:21
2826 [sshconnect2.c]
2827 swap the last two parameters to TAILQ_FOREACH_REVERSE. matches what
2828 FreeBSD and NetBSD do.
2829 ok millert@ mcbride@ markus@ ho@, checked to not affect ports by naddy@
2830 - djm@cvs.openbsd.org 2004/04/18 23:10:26
2831 [readconf.c readconf.h ssh-keysign.c ssh.c]
2832 perform strict ownership and modes checks for ~/.ssh/config files,
2833 as these can be used to execute arbitrary programs; ok markus@
2834 NB. ssh will now exit when it detects a config with poor permissions
2835 - djm@cvs.openbsd.org 2004/04/19 13:02:40
2836 [ssh.1 ssh_config.5]
2837 document strict permission checks on ~/.ssh/config; prompted by,
2838 with & ok jmc@
2839 - jmc@cvs.openbsd.org 2004/04/19 16:12:14
2840 [ssh_config.5]
2841 kill whitespace at eol;
2842 - djm@cvs.openbsd.org 2004/04/19 21:51:49
2843 [ssh.c]
2844 fix idiot typo that i introduced in my last commit;
2845 spotted by cschneid AT cschneid.com
2846 - (djm) [openbsd-compat/sys-queue.h] Sync with OpenBSD, needed for
2847 above change
2848 - (djm) [configure.ac] Check whether libroken is required when building
2849 with Heimdal
2850
285120040419
2852 - (dtucker) OpenBSD CVS Sync
2853 - dtucker@cvs.openbsd.org 2004/02/29 22:04:45
2854 [regress/login-timeout.sh]
2855 Use sudo when restarting daemon during test. ok markus@
2856 - dtucker@cvs.openbsd.org 2004/03/08 10:17:12
2857 [regress/login-timeout.sh]
2858 Missing OBJ, from tim@. ok markus@ (Already fixed, ID sync only)
2859 - djm@cvs.openbsd.org 2004/03/30 12:41:56
2860 [sftp-client.c]
2861 sync comment with reality
2862 - djm@cvs.openbsd.org 2004/03/31 21:58:47
2863 [canohost.c]
2864 don't skip ip options check when UseDNS=no; ok markus@ (ID sync only)
2865 - markus@cvs.openbsd.org 2004/04/01 12:19:57
2866 [scp.c]
2867 limit trust between local and remote rcp/scp process,
2868 noticed by lcamtuf; ok deraadt@, djm@
2869
287020040418
2871 - (dtucker) [auth-pam.c] Log username and source host for failed PAM
2872 authentication attempts. With & ok djm@
2873 - (djm) [openbsd-compat/bsd-cygwin_util.c] Recent versions of Cygwin allow
2874 change of user context without a password, so relax auth method
2875 restrictions; from vinschen AT redhat.com; ok dtucker@
2876
287720040416
2878 - (dtucker) [regress/sftp-cmds.sh] Skip quoting test on Cygwin, since
2879 FAT/NTFS does not permit quotes in filenames. From vinschen at redhat.com
2880 - (djm) [auth-krb5.c auth.h session.c] Explicitly refer to Kerberos ccache
2881 file using FILE: method, fixes problems on Mac OSX.
2882 Patch from simon@sxw.org.uk; ok dtucker@
2883 - (tim) [configure.ac] Set SETEUID_BREAKS_SETUID, BROKEN_SETREUID and
2884 BROKEN_SETREGID for SCO OpenServer 3
2885
288620040412
2887 - (dtucker) [sshd_config.5] Add PermitRootLogin without-password warning
2888 from bug #701 (text from jfh at cise.ufl.edu).
2889 - (dtucker) [acconfig.h configure.ac defines.h] Bug #673: check for 4-arg
2890 skeychallenge(), eg on NetBSD. ok mouring@
2891 - (dtucker) [auth-skey.c defines.h monitor.c] Make skeychallenge explicitly
2892 4-arg, with compatibility for 3-arg versions. From djm@, ok me.
2893 - (djm) [configure.ac] Fix detection of libwrap on OpenBSD; ok dtucker@
2894
289520040408
2896 - (dtucker) [loginrec.c] Use UT_LINESIZE if available, prevents truncating
2897 pty name on Linux 2.6.x systems. Patch from jpe at eisenmenger.org.
2898 - (bal) [monitor.c monitor_wrap.c] Second try. Put the zlib.h headers
2899 back and #undef TARGET_OS_MAC instead. (Bug report pending with Apple)
2900 - (dtucker) [defines.h loginrec.c] Define UT_LINESIZE if not defined and
2901 simplify loginrec.c. ok tim@
2902 - (bal) [monitor.c monitor_wrap.c] Ok.. Last time. Promise. Tim suggested
2903 limiting scope and dtucker@ agreed.
2904
290520040407
2906 - (dtucker) [session.c] Flush stdout after displaying loginmsg. From
2907 f_mohr at yahoo.de.
2908 - (bal) [acconfig.h auth-krb5.c configure.ac gss-serv-krb5.c] Check to see
2909 if Krb5 library exports krb5_init_etc() since some OSes (like MacOS/X)
2910 are starting to restrict it as internal since it is not needed by
2911 developers any more. (Patch based on Apple tree)
2912 - (bal) [monitor.c monitor_wrap.c] monitor_wrap.c] moved zlib.h higher since
2913 krb5 on MacOS/X conflicts. There may be a better solution, but this will
2914 work for now.
2915
291620040406
2917 - (dtucker) [acconfig.h configure.ac defines.h] Bug #820: don't use
2918 updwtmpx() on IRIX since it seems to clobber utmp. ok djm@
2919 - (dtucker) [configure.ac] Bug #816, #748 (again): Attempt to detect
2920 broken getaddrinfo and friends on HP-UX. ok djm@
2921
292220040330
2923 - (dtucker) [configure.ac] Bug #811: Use "!" for LOCKED_PASSWD_PREFIX on
2924 Linuxes, since that's what many use. ok djm@
2925 - (dtucker) [auth-pam.c] rename the_authctxt to sshpam_authctxt in auth-pam.c
2926 to reduce potential confusion with the one in sshd.c. ok djm@
2927 - (djm) Bug #825: Fix ip_options_check() for mapped IPv4/IPv6 connection;
2928 with & ok dtucker@
2929
293020040327
2931 - (dtucker) [session.c] Bug #817: Clear loginmsg after fork to prevent
2932 duplicate login messages for mutli-session logins. ok djm@
2933
293420040322
2935 - (djm) [sshd.c] Drop supplemental groups if started as root
2936 - (djm) OpenBSD CVS Sync
2937 - markus@cvs.openbsd.org 2004/03/09 22:11:05
2938 [ssh.c]
2939 increase x11 cookie lifetime to 20 minutes; ok djm
2940 - markus@cvs.openbsd.org 2004/03/10 09:45:06
2941 [ssh.c]
2942 trim usage to match ssh(1) and look more like unix. ok djm@
2943 - markus@cvs.openbsd.org 2004/03/11 08:36:26
2944 [sshd.c]
2945 trim usage; ok deraadt
2946 - markus@cvs.openbsd.org 2004/03/11 10:21:17
2947 [ssh.c sshd.c]
2948 ssh, sshd: sync version output, ok djm
2949 - markus@cvs.openbsd.org 2004/03/20 10:40:59
2950 [version.h]
2951 3.8.1
2952 - (djm) Crank RPM spec versions
2953
295420040311
2955 - (djm) [configure.ac] Add standard license to configure.ac; ok ben, dtucker
2956
295720040310
2958 - (dtucker) [openbsd-compat/fake-rfc2553.h] Bug #812: #undef getaddrinfo
2959 before redefining it, silences warnings on Tru64.
2960
296120040308
2962 - (dtucker) [sshd.c] Back out rev 1.270 as it caused problems on some
2963 platforms (eg SCO, HP-UX) with logging in the wrong TZ. ok djm@
2964 - (dtucker) [configure.ac sshd.c openbsd-compat/bsd-misc.h
2965 openbsd-compat/setenv.c] Unset KRB5CCNAME on AIX to prevent it from being
2966 inherited by the child. ok djm@
2967 - (dtucker) [auth-pam.c auth-pam.h auth1.c auth2.c monitor.c monitor_wrap.c
2968 monitor_wrap.h] Bug #808: Ensure force_pwchange is correctly initialized
2969 even if keyboard-interactive is not used by the client. Prevents
2970 segfaults in some cases where the user's password is expired (note this
2971 is not considered a security exposure). ok djm@
2972 - (djm) OpenBSD CVS Sync
2973 - markus@cvs.openbsd.org 2004/03/03 06:47:52
2974 [sshd.c]
2975 change proctiltle after accept(2); ok henning, deraadt, djm
2976 - djm@cvs.openbsd.org 2004/03/03 09:30:42
2977 [sftp-client.c]
2978 Don't print duplicate messages when progressmeter is off
2979 Spotted by job317 AT mailvault.com; ok markus@
2980 - djm@cvs.openbsd.org 2004/03/03 09:31:20
2981 [sftp.c]
2982 Fix initialisation of progress meter; ok markus@
2983 - markus@cvs.openbsd.org 2004/03/05 10:53:58
2984 [readconf.c readconf.h scp.1 sftp.1 ssh.1 ssh_config.5 sshconnect2.c]
2985 add IdentitiesOnly; ok djm@, pb@
2986 - djm@cvs.openbsd.org 2004/03/08 09:38:05
2987 [ssh-keyscan.c]
2988 explicitly initialise remote_major and remote_minor.
2989 from cjwatson AT debian.org; ok markus@
2990 - dtucker@cvs.openbsd.org 2004/03/08 10:18:57
2991 [sshd_config.5]
2992 Document KerberosGetAFSToken; ok markus@
2993 - (tim) [regress/README.regress] Document ssh-rand-helper issue. ok bal
2994
299520040307
2996 - (tim) [regress/login-timeout.sh] fix building outside of source tree.
2997
299820040304
2999 - (dtucker) [auth-pam.c] Don't try to export PAM when compiled with
3000 -DUSE_POSIX_THREADS. From antoine.verheijen at ualbert ca. ok djm@
3001 - (dtucker) [auth-pam.c] Reset signal status when starting pam auth thread,
3002 prevent hanging during PAM keyboard-interactive authentications. ok djm@
3003 - (dtucker) [auth-passwd.c auth-sia.c auth-sia.h defines.h
3004 openbsd-compat/xcrypt.c] Bug #802: Fix build error on Tru64 when
3005 configured --with-osfsia. ok djm@
3006
300720040303
3008 - (djm) [configure.ac ssh-agent.c] Use prctl to prevent ptrace on ssh-agent
3009 ok dtucker
3010
301120040229
3012 - (tim) [configure.ac] Put back bits mistakenly removed from Rev 1.188
3013
301420040229
3015 - (dtucker) OpenBSD CVS Sync
3016 - djm@cvs.openbsd.org 2004/02/25 00:22:45
3017 [sshd.c]
3018 typo in comment
3019 - dtucker@cvs.openbsd.org 2004/02/27 22:42:47
3020 [dh.c]
3021 Prevent sshd from sending DH groups with a primitive generator of zero or
3022 one, even if they are listed in /etc/moduli. ok markus@
3023 - dtucker@cvs.openbsd.org 2004/02/27 22:44:56
3024 [dh.c]
3025 Make /etc/moduli line buffer big enough for 8kbit primes, in case anyone
3026 ever uses one. ok markus@
3027 - dtucker@cvs.openbsd.org 2004/02/27 22:49:27
3028 [dh.c]
3029 Reset bit counter at the right time, fixes debug output in the case where
3030 the DH group is rejected. ok markus@
3031 - dtucker@cvs.openbsd.org 2004/02/17 08:23:20
3032 [regress/Makefile regress/login-timeout.sh]
3033 Add regression test for LoginGraceTime; ok markus@
3034 - markus@cvs.openbsd.org 2004/02/24 16:56:30
3035 [regress/test-exec.sh]
3036 allow arguments in ${TEST_SSH_XXX}
3037 - markus@cvs.openbsd.org 2004/02/24 17:06:52
3038 [regress/ssh-com-client.sh regress/ssh-com-keygen.sh
3039 regress/ssh-com-sftp.sh regress/ssh-com.sh]
3040 test against recent ssh.com releases
3041 - dtucker@cvs.openbsd.org 2004/02/28 12:16:57
3042 [regress/dynamic-forward.sh]
3043 Make dynamic-forward understand nc's new output. ok markus@
3044 - dtucker@cvs.openbsd.org 2004/02/28 13:44:45
3045 [regress/try-ciphers.sh]
3046 Test acss too; ok markus@
3047 - (dtucker) [regress/try-ciphers.sh] Skip acss if not compiled in (eg if we
3048 built with openssl < 0.9.7)
3049
305020040226
3051 - (bal) KNF our sshlogin.c even if the code looks nothing like upstream
3052 code due to diversity issues.
3053
305420040225
3055 - (djm) Trim ChangeLog
3056 - (djm) Don't specify path to PAM modules in Redhat sshd.pam; from Fedora
3057
305820040224
3059 - (dtucker) OpenBSD CVS Sync
3060 - markus@cvs.openbsd.org 2004/02/19 21:15:04
3061 [sftp-server.c]
3062 switch to new license.template
3063 - markus@cvs.openbsd.org 2004/02/23 12:02:33
3064 [sshd.c]
3065 backout revision 1.279; set listen socket to non-block; ok henning.
3066 - markus@cvs.openbsd.org 2004/02/23 15:12:46
3067 [bufaux.c]
3068 encode 0 correctly in buffer_put_bignum2; noted by Mikulas Patocka
3069 and drop support for negative BNs; ok otto@
3070 - markus@cvs.openbsd.org 2004/02/23 15:16:46
3071 [version.h]
3072 enter 3.8
3073 - (dtucker) [configure.ac gss-serv-krb5.c ssh-gss.h] Define GSSAPI when found
3074 with krb5-config, hunt down gssapi.h and friends. Based partially on patch
3075 from deengert at anl.gov. ok djm@
3076 - (djm) [groupaccess.c uidswap.c] Bug #787: Size group arrays at runtime
3077 using sysconf() if available Based on patches from
3078 holger AT van-lengerich.de and openssh_bugzilla AT hockin.org
3079 - (dtucker) [uidswap.c] Minor KNF. ok djm@
3080 - (tim) [openbsd-compat/getrrsetbyname.c] Make gcc 2.7.2.3 happy. ok djm@
3081 - (djm) Crank RPM spec versions
3082 - (dtucker) [README] Add pointer to release notes. ok djm@
3083 - (dtucker) {README.platform] Add platform-specific notes.
3084 - (tim) [configure.ac] SCO3 needs -lcrypt_i for -lprot
3085 - (djm) Release 3.8p1
3086
308720040223
3088 - (dtucker) [session.c] Bug #789: Only make setcred call for !privsep in the
3089 non-interactive path. ok djm@
3090
309120040222
3092 - (dtucker) [auth-shadow.c auth.c auth.h] Move shadow account expiry test
3093 to auth-shadow.c, no functional change. ok djm@
3094 - (dtucker) [auth-shadow.c auth.h] Provide warnings of impending account or
3095 password expiry. ok djm@
3096 - (dtucker) [auth-passwd.c] Only check password expiry once. Prevents
3097 multiple warnings if a wrong password is entered.
3098 - (dtucker) [configure.ac] Apply krb5-config --libs fix to non-gssapi path
3099 too.
3100
310120040220
3102 - (djm) [openbsd-compat/setproctitle.c] fix comments; from grange@
3103
310420040218
3105 - (dtucker) [configure.ac] Handle case where krb5-config --libs returns a
3106 path with a "-" in it. From Sergio.Gelato at astro.su.se.
3107 - (djm) OpenBSD CVS Sync
3108 - djm@cvs.openbsd.org 2004/02/17 07:17:29
3109 [sftp-glob.c sftp.c]
3110 Remove useless headers; ok deraadt@
3111 - djm@cvs.openbsd.org 2004/02/17 11:03:08
3112 [sftp.c]
3113 sftp.c and sftp-int.c, together at last; ok markus@
3114 - jmc@cvs.openbsd.org 2004/02/17 19:35:21
3115 [sshd_config.5]
3116 remove cruft left over from RhostsAuthentication removal;
3117 ok markus@
3118 - (djm) [log.c] Correct use of HAVE_OPENLOG_R
3119 - (djm) [log.c] Tighten openlog_r tests
3120
312120040217
3122 - (djm) Simplify the license on code I have written. No code changes.
3123 - (djm) OpenBSD CVS Sync
3124 - djm@cvs.openbsd.org 2004/02/17 05:39:51
3125 [sftp-client.c sftp-client.h sftp-glob.c sftp-glob.h sftp-int.c]
3126 [sftp-int.h sftp.c]
3127 switch to license.template for code written by me (belated, I know...)
3128 - (djm) Bug #698: Specify FILE: for KRB5CCNAME; patch from
3129 stadal@suse.cz and simon@sxw.org.uk
3130 - (dtucker) [auth-pam.c] Tidy up PAM debugging. ok djm@
3131 - (dtucker) [auth-pam.c] Store output from pam_session and pam_setcred for
3132 display after login. Should fix problems like pam_motd not displaying
3133 anything, noticed by cjwatson at debian.org. ok djm@
3134
313520040212
3136 - (tim) [Makefile.in regress/sftp-badcmds.sh regress/test-exec.sh]
3137 Portablity fixes. Data sftp transfers needs to be world readable. Some
3138 older shells hang on while loops when doing sh -n some_script. OK dtucker@
3139 - (tim) [configure.ac] Make sure -lcrypto is before -lsocket for sco3.
3140 ok mouring@
3141
314220040211
3143 - (dtucker) [auth-passwd.c auth-shadow.c] Only enable shadow expiry check
3144 if HAS_SHADOW_EXPIRY is set.
3145 - (tim) [configure.ac] Fix comment to match code changes in ver 1.117
3146
314720040210
3148 - (dtucker) [auth-passwd.c auth.h openbsd-compat/port-aix.c
3149 openbsd-compat/port-aix.h] Bug #14: Use do_pwchange to support AIX's
3150 native password expiry.
3151 - (dtucker) [LICENCE Makefile.in auth-passwd.c auth-shadow.c auth.c auth.h
3152 defines.h] Bug #14: Use do_pwchange to support password expiry and force
3153 change for platforms using /etc/shadow. ok djm@
3154 - (dtucker) [openbsd-compat/fake-rfc2553.h] Bug #563: Prepend ssh_ to compat
3155 functions to avoid conflicts with Heimdal's libroken. ok djm@
3156 - (dtucker) [auth-pam.c auth-pam.h session.c] Bug #14: Use do_pwchange to
3157 change expired PAM passwords for SSHv1 connections without privsep.
3158 pam_chauthtok is still used when privsep is disabled. ok djm@
3159 - (dtucker) [openbsd-compat/port-aix.c openbsd-compat/port-aix.h] Move
3160 include from port-aix.h to port-aix.c and remove unnecessary function
3161 definition. Fixes build errors on AIX.
3162 - (dtucker) [configure.ac loginrec.c] Bug #464: Use updwtmpx on platforms
3163 that support it. from & ok mouring@
3164 - (dtucker) [configure.ac] Bug #345: Do not disable utmp on HP-UX 10.x.
3165 ok djm@
3166
316720040207
3168 - (dtucker) OpenBSD CVS Sync
3169 - dtucker@cvs.openbsd.org 2004/02/06 23:41:13
3170 [cipher-ctr.c]
3171 Use EVP_CIPHER_CTX_key_length for key length. ok markus@
3172 (This will fix builds with OpenSSL 0.9.5)
3173 - (dtucker) [cipher.c] enable AES counter modes with OpenSSL 0.9.5.
3174 ok djm@, markus@
3175
317620040206
3177 - (dtucker) [acss.c acss.h] Fix $Id tags.
3178 - (dtucker) [cipher-acss.c cipher.c] Enable acss only if building with
3179 OpenSSL >= 0.9.7. ok djm@
3180 - (dtucker) [session.c] Bug #789: Do not call do_pam_setcred as a non-root
3181 user, since some modules might fail due to lack of privilege. ok djm@
3182 - (dtucker) [configure.ac] Bug #748: Always define BROKEN_GETADDRINFO
3183 for HP-UX 11.11. If there are known-good configs where this is not
3184 required, please report them. ok djm@
3185 - (dtucker) [sshd.c] Bug #757: Clear child's environment to prevent
3186 accidentally inheriting from root's environment. ok djm@
3187 - (dtucker) [openbsd-compat/port-aix.c openbsd-compat/port-aix.h] Bug #796:
3188 Restore previous authdb setting after auth calls. Fixes problems with
3189 setpcred failing on accounts that use AFS or NIS password registries.
3190 - (dtucker) [configure.ac includes.h] Include <sys/stream.h> if present,
3191 required on Solaris 2.5.1 for queue_t, which is used by <sys/ptms.h>.
3192 - (dtucker) OpenBSD CVS Sync
3193 - markus@cvs.openbsd.org 2004/01/30 09:48:57
3194 [auth-passwd.c auth.h pathnames.h session.c]
3195 support for password change; ok dtucker@
3196 (set password-dead=1w in login.conf to use this).
3197 In -Portable, this is currently only platforms using bsdauth.
3198 - dtucker@cvs.openbsd.org 2004/02/05 05:37:17
3199 [monitor.c sshd.c]
3200 Pass SIGALRM through to privsep child if LoginGraceTime expires. ok markus@
3201 - markus@cvs.openbsd.org 2004/02/05 15:33:33
3202 [progressmeter.c]
3203 fix ETA for > 4GB; bugzilla #791; ok henning@ deraadt@
3204
320520040129
3206 - (dtucker) OpenBSD CVS Sync regress/
3207 - dtucker@cvs.openbsd.org 2003/10/11 11:49:49
3208 [Makefile banner.sh]
3209 Test missing banner file, suppression of banner with ssh -q, check return
3210 code from ssh. ok markus@
3211 - jmc@cvs.openbsd.org 2003/11/07 10:16:44
3212 [ssh-com.sh]
3213 adress -> address, and a few more; all from Jonathon Gray;
3214 - djm@cvs.openbsd.org 2004/01/13 09:49:06
3215 [sftp-batch.sh]
3216 - (dtucker) [configure.ac] Add --without-zlib-version-check. Feedback from
3217 tim@, ok several
3218 - (dtucker) [configure.ac openbsd-compat/bsd-cray.c openbsd-compat/bsd-cray.h]
3219 Bug #775: Cray fixes from wendy at cray.com
3220
322120040128
3222 - (dtucker) [regress/README.regress] Add tcpwrappers issue, noted by tim@
3223 - (dtucker) [moduli] Import new moduli file from OpenBSD.
3224
322520040127
3226 - (djm) OpenBSD CVS Sync
3227 - hshoexer@cvs.openbsd.org 2004/01/23 17:06:03
3228 [cipher.c]
3229 enable acss for ssh
3230 ok deraadt@ markus@
3231 - mouring@cvs.openbsd.org 2004/01/23 17:57:48
3232 [sftp-int.c]
3233 Fix issue pointed out with ls not handling large directories
3234 with embeded paths correctly. OK damien@
3235 - hshoexer@cvs.openbsd.org 2004/01/23 19:26:33
3236 [cipher.c]
3237 rename acss@opebsd.org to acss@openssh.org
3238 ok deraadt@
3239 - djm@cvs.openbsd.org 2004/01/25 03:49:09
3240 [sshconnect.c]
3241 reset nonblocking flag after ConnectTimeout > 0 connect; (bugzilla #785)
3242 from jclonguet AT free.fr; ok millert@
3243 - djm@cvs.openbsd.org 2004/01/27 10:08:10
3244 [sftp.c]
3245 reorder parsing so user:skey@host:file works (bugzilla #777)
3246 patch from admorten AT umich.edu; ok markus@
3247 - (djm) [acss.c acss.h cipher-acss.c] Portable support for ACSS
3248 if libcrypto lacks it
3249
325020040126
3251 - (tim) Typo in regress/README.regress
3252 - (tim) [regress/test-exec.sh] RhostsAuthentication is deprecated.
3253 - (tim) [defines.h] Add defines for HFIXEDSZ and T_SIG
3254 - (tim) [configure.ac includes.h] add <sys/ptms.h> for grantpt() and friends.
3255 - (tim) [defines.h openbsd-compat/getrrsetbyname.h] Move defines for HFIXEDSZ
3256 and T_SIG to getrrsetbyname.h
3257
325820040124
3259 - (djm) Typo in openbsd-compat/bsd-openpty.c; from wendyp AT cray.com
3260
326120040123
3262 - (djm) Do pam_session processing for systems with HAVE_LOGIN_CAP; from
3263 ralf.hack AT pipex.net; ok dtucker@
3264 - (djm) Bug #776: Update contrib/redhat/openssh.spec to dynamically detect
3265 Kerberos location (and thus work with Fedora Core 1);
3266 from jason AT devrandom.org
3267 - (dtucker) [configure.ac] Bug #788: Test for zlib.h presence and for
3268 zlib >= 1.1.4. Partly from jbasney at ncsa.uiuc.edu. ok djm@
3269 - (dtucker) [contrib/cygwin/README] Document new ssh-host-config options.
3270 Patch from vinschen at redhat.com.
3271 - (dtucker) [acconfig.h configure.ac includes.h servconf.c session.c]
3272 Change AFS symbol to USE_AFS to prevent namespace collisions, do not
3273 include kafs.h unless necessary. From deengert at anl.gov.
3274 - (tim) [configure.ac] Remove hard coded -L/usr/local/lib and
3275 -I/usr/local/include. Users can do LDFLAGS="-L/usr/local/lib" \
3276 CPPFLAGS="-I/usr/local/include" ./configure if needed.
3277
327820040122
3279 - (dtucker) [configure.ac] Use krb5-config where available for Kerberos/
3280 GSSAPI detection, libs and includes. ok djm@
3281 - (dtucker) [session.c] Enable AFS support in conjunction with KRB5 not
3282 just HEIMDAL.
3283 - (tim) [contrib/solaris/buildpkg.sh] Allow for the possibility of
3284 /usr/local being a symbolic link. Fixes problem reported by Henry Grebler.
3285
328620040121
3287 - (djm) OpenBSD CVS Sync
3288 - djm@cvs.openbsd.org 2004/01/13 09:25:05
3289 [sftp-int.c sftp.1 sftp.c]
3290 Tidy sftp batchmode handling, eliminate junk to stderr (bugzilla #754) and
3291 enable use of "-b -" to accept batchfile from stdin; ok markus@
3292 - jmc@cvs.openbsd.org 2004/01/13 12:17:33
3293 [sftp.1]
3294 remove unnecessary Ic's;
3295 kill whitespace at EOL;
3296 ok djm@
3297 - markus@cvs.openbsd.org 2004/01/13 19:23:15
3298 [compress.c session.c]
3299 -Wall; ok henning
3300 - markus@cvs.openbsd.org 2004/01/13 19:45:15
3301 [compress.c]
3302 cast for portability; millert@
3303 - markus@cvs.openbsd.org 2004/01/19 09:24:21
3304 [channels.c]
3305 fake consumption for half closed channels since the peer is waiting for
3306 window adjust messages; bugzilla #790 Matthew Dillon; test + ok dtucker@
3307 reproduce with sh -c 'ulimit -f 10; ssh host -n od /bsd | cat > foo'
3308 - markus@cvs.openbsd.org 2004/01/19 21:25:15
3309 [auth2-hostbased.c auth2-pubkey.c serverloop.c ssh-keysign.c sshconnect2.c]
3310 fix mem leaks; some fixes from Pete Flugstad; tested dtucker@
3311 - djm@cvs.openbsd.org 2004/01/21 03:07:59
3312 [sftp.c]
3313 initialise infile in main, rather than statically - from portable
3314 - deraadt@cvs.openbsd.org 2004/01/11 21:55:06
3315 [sshpty.c]
3316 for pty opening, only use the openpty() path. the other stuff only needs
3317 to be in openssh-p; markus ok
3318 - (djm) [openbsd-compat/bsd-openpty.c] Rework old sshpty.c code into an
3319 openpty() replacement
3320
332120040114
3322 - (dtucker) [auth-pam.c] Have monitor die if PAM authentication thread exits
3323 unexpectedly. with & ok djm@
3324 - (dtucker) [auth-pam.c] Reset signal handler in pthread_cancel too, add
3325 test for case where cleanup has already run.
3326 - (dtucker) [auth-pam.c] Add minor debugging.
3327
332820040113
3329 - (dtucker) [auth-pam.c] Relocate struct pam_ctxt and prototypes. No
3330 functional changes.
3331
333220040108
3333 - (dtucker) [auth-pam.c defines.h] Bug #783: move __unused to defines.h and
3334 only define if not already. From des at freebsd.org.
3335 - (dtucker) [configure.ac] Remove extra (typo) comma.
3336
333720040105
3338 - (dtucker) [contrib/ssh-copy-id] Bug #781: exit if ssh fails. Patch from
3339 cjwatson at debian.org.
3340 - (dtucker) [acconfig.h configure.ac includes.h servconf.c session.c]
3341 Only enable KerberosGetAFSToken if Heimdal's libkafs is found. with jakob@
3342
334320040102
3344 - (djm) OSX/Darwin needs BIND_8_COMPAT to build getrrsetbyname. Report from
3345 jakob@
3346 - (djm) Remove useless DNS support configure summary message. from jakob@
3347 - (djm) OSX/Darwin put the PAM headers in a different place, detect this.
3348 Report from jakob@
3349
335020031231
3351 - (dtucker) OpenBSD CVS Sync
3352 - djm@cvs.openbsd.org 2003/12/22 09:16:58
3353 [moduli.c ssh-keygen.1 ssh-keygen.c]
3354 tidy up moduli generation debugging, add -v (verbose/debug) option to
3355 ssh-keygen; ok markus@
3356 - markus@cvs.openbsd.org 2003/12/22 20:29:55
3357 [cipher-3des1.c]
3358 EVP_CIPHER_CTX_cleanup() for the des contexts; pruiksma@freesurf.fr
3359 - jakob@cvs.openbsd.org 2003/12/23 16:12:10
3360 [servconf.c servconf.h session.c sshd_config]
3361 implement KerberosGetAFSToken server option. ok markus@, beck@
3362 - millert@cvs.openbsd.org 2003/12/29 16:39:50
3363 [sshd_config]
3364 KeepAlive has been obsoleted, use TCPKeepAlive instead; markus@ OK
3365 - dtucker@cvs.openbsd.org 2003/12/31 00:24:50
3366 [auth2-passwd.c]
3367 Ignore password change request during password auth (which we currently
3368 don't support) and discard proposed new password. corrections/ok markus@
3369 - (dtucker) [configure.ac] Only test setresuid and setresgid if they exist.
3370
337120031219
3372 - (dtucker) [defines.h] Bug #458: Define SIZE_T_MAX as UINT_MAX if we
3373 typedef size_t ourselves.
3374
337520031218
3376 - (dtucker) [configure.ac] Don't use setre[ug]id on DG-UX, from Tom Orban.
3377 - (dtucker) [auth-pam.c] Do PAM chauthtok during SSH2 keyboard-interactive
3378 authentication. Partially fixes bug #423. Feedback & ok djm@
3379
338020031217
3381 - (djm) OpenBSD CVS Sync
3382 - markus@cvs.openbsd.org 2003/12/09 15:28:43
3383 [serverloop.c]
3384 make ClientKeepAlive work for ssh -N, too (no login shell requested).
3385 1) send a bogus channel request if we find a channel
3386 2) send a bogus global request if we don't have a channel
3387 ok + test beck@
3388 - markus@cvs.openbsd.org 2003/12/09 17:29:04
3389 [sshd.c]
3390 fix -o and HUP; ok henning@
3391 - markus@cvs.openbsd.org 2003/12/09 17:30:05
3392 [ssh.c]
3393 don't modify argv for ssh -o; similar to sshd.c 1.283
3394 - markus@cvs.openbsd.org 2003/12/09 21:53:37
3395 [readconf.c readconf.h scp.1 servconf.c servconf.h sftp.1 ssh.1]
3396 [ssh_config.5 sshconnect.c sshd.c sshd_config.5]
3397 rename keepalive to tcpkeepalive; the old name causes too much
3398 confusion; ok djm, dtucker; with help from jmc@
3399 - dtucker@cvs.openbsd.org 2003/12/09 23:45:32
3400 [clientloop.c]
3401 Clear exit code when ssh -N is terminated with a SIGTERM. ok markus@
3402 - markus@cvs.openbsd.org 2003/12/14 12:37:21
3403 [ssh_config.5]
3404 we don't support GSS KEX; from Simon Wilkinson
3405 - markus@cvs.openbsd.org 2003/12/16 15:49:51
3406 [clientloop.c clientloop.h readconf.c readconf.h scp.1 sftp.1 ssh.1]
3407 [ssh.c ssh_config.5]
3408 application layer keep alive (ServerAliveInterval ServerAliveCountMax)
3409 for ssh(1), similar to the sshd(8) option; ok beck@; with help from
3410 jmc and dtucker@
3411 - markus@cvs.openbsd.org 2003/12/16 15:51:54
3412 [dh.c]
3413 use <= instead of < in dh_estimate; ok provos/hshoexer;
3414 do not return < DH_GRP_MIN
3415 - (dtucker) [acconfig.h configure.ac uidswap.c] Bug #645: Check for
3416 setres[ug]id() present but not implemented (eg some Linux/glibc
3417 combinations).
3418 - (bal) [openbsd-compat/bsd-misc.c] unset 'signal' defined if we are
3419 using a real 'signal()' (Noticed by a NeXT Compile)
3420
342120031209
3422 - (dtucker) OpenBSD CVS Sync
3423 - matthieu@cvs.openbsd.org 2003/11/25 23:10:08
3424 [ssh-add.1]
3425 ssh-add doesn't need to be a descendant of ssh-agent. Ok markus@, jmc@.
3426 - djm@cvs.openbsd.org 2003/11/26 21:44:29
3427 [cipher-aes.c]
3428 fix #ifdef before #define; ok markus@
3429 (RCS ID sync only, Portable already had this)
3430 - markus@cvs.openbsd.org 2003/12/02 12:15:10
3431 [progressmeter.c]
3432 improvments from andreas@:
3433 * saner speed estimate for transfers that takes less than a second by
3434 rounding the time to 1 second.
3435 * when the transfer is finished calculate the actual total speed
3436 rather than the current speed which is given during the transfer
3437 - markus@cvs.openbsd.org 2003/12/02 17:01:15
3438 [channels.c session.c ssh-agent.c ssh.h sshd.c]
3439 use SSH_LISTEN_BACKLOG (=128) in listen(2).
3440 - djm@cvs.openbsd.org 2003/12/07 06:34:18
3441 [moduli.c]
3442 remove unused debugging #define templates
3443 - markus@cvs.openbsd.org 2003/12/08 11:00:47
3444 [kexgexc.c]
3445 print requested group size in debug; ok djm
3446 - dtucker@cvs.openbsd.org 2003/12/09 13:52:55
3447 [moduli.c]
3448 Prevent ssh-keygen -T from outputting moduli with a generator of 0, since
3449 they can't be used for Diffie-Hellman. Assistance and ok djm@
3450 - (dtucker) [ssh-keyscan.c] Sync RCSIDs, missed in SSH_SSFDMAX change below.
3451
345220031208
3453 - (tim) [configure.ac] Bug 770. Fix --without-rpath.
3454
345520031123
3456 - (djm) [canohost.c] Move IPv4inV6 mapped address normalisation to its own
3457 function and call it unconditionally
3458 - (djm) OpenBSD CVS Sync
3459 - djm@cvs.openbsd.org 2003/11/23 23:17:34
3460 [ssh-keyscan.c]
3461 from portable - use sysconf to detect fd limit; ok markus@
3462 (tidy diff by adding SSH_SSFDMAX macro to defines.h)
3463 - djm@cvs.openbsd.org 2003/11/23 23:18:45
3464 [ssh-keygen.c]
3465 consistency PATH_MAX -> MAXPATHLEN; ok markus@
3466 (RCS ID sync only)
3467 - djm@cvs.openbsd.org 2003/11/23 23:21:21
3468 [scp.c]
3469 from portable: rename clashing variable limit-> limit_rate; ok markus@
3470 (RCS ID sync only)
3471 - dtucker@cvs.openbsd.org 2003/11/24 00:16:35
3472 [ssh.1 ssh.c]
3473 Make ssh -k mean GSSAPIDelegateCredentials=no. Suggestion & ok markus@
3474 - (djm) Annotate OpenBSD-derived files in openbsd-compat/ with original
3475 source file path (in OpenBSD tree).
3476
347720031122
3478 - (dtucker) [channels.c] Make AIX write limit code clearer. Suggested by djm@
3479 - (dtucker) [auth-passwd.c openbsd-compat/port-aix.c openbsd-compat/port-aix.h]
3480 Move AIX specific password authentication code to port-aix.c, call
3481 authenticate() until reenter flag is clear.
3482 - (dtucker) [auth-sia.c configure.ac] Tru64 update from cmadams at hiwaay.net.
3483 Use permanently_set_uid for SIA, only define DISABLE_FD_PASSING when SIA
3484 is enabled, rely on SIA to check for locked accounts if enabled. ok djm@
3485 - (djm) [scp.c] Rename limitbw -> limit_rate to match upstreamed patch
3486 - (djm) [sftp-int.c] Remove duplicated code from bogus sync
3487 - (djm) [packet.c] Shuffle #ifdef to reduce conditionally compiled code
3488
348920031121
3490 - (djm) OpenBSD CVS Sync
3491 - markus@cvs.openbsd.org 2003/11/20 11:39:28
3492 [progressmeter.c]
3493 fix rounding errors; from andreas@
3494 - djm@cvs.openbsd.org 2003/11/21 11:57:03
3495 [everything]
3496 unexpand and delete whitespace at EOL; ok markus@
3497 (done locally and RCS IDs synced)
3498
349920031118
3500 - (djm) Fix early exit for root auth success when UsePAM=yes and
3501 PermitRootLogin=no
3502 - (dtucker) [auth-pam.c] Convert chauthtok_conv into a generic tty_conv,
3503 and use it for do_pam_session. Fixes problems like pam_motd not
3504 displaying anything. ok djm@
3505 - (dtucker) [auth-pam.c] Only use pam_putenv if our platform has it. ok djm@
3506 - (djm) OpenBSD CVS Sync
3507 - dtucker@cvs.openbsd.org 2003/11/18 00:40:05
3508 [serverloop.c]
3509 Correct check for authctxt->valid. ok djm@
3510 - djm@cvs.openbsd.org 2003/11/18 10:53:07
3511 [monitor.c]
3512 unbreak fake authloop for non-existent users (my screwup). Spotted and
3513 tested by dtucker@; ok markus@
3514
351520031117
3516 - (djm) OpenBSD CVS Sync
3517 - djm@cvs.openbsd.org 2003/11/03 09:03:37
3518 [auth-chall.c]
3519 make this a little more idiot-proof; ok markus@
3520 (includes portable-specific changes)
3521 - jakob@cvs.openbsd.org 2003/11/03 09:09:41
3522 [sshconnect.c]
3523 move changed key warning into warn_changed_key(). ok markus@
3524 - jakob@cvs.openbsd.org 2003/11/03 09:37:32
3525 [sshconnect.c]
3526 do not free static type pointer in warn_changed_key()
3527 - djm@cvs.openbsd.org 2003/11/04 08:54:09
3528 [auth1.c auth2.c auth2-pubkey.c auth.h auth-krb5.c auth-passwd.c]
3529 [auth-rhosts.c auth-rh-rsa.c auth-rsa.c monitor.c serverloop.c]
3530 [session.c]
3531 standardise arguments to auth methods - they should all take authctxt.
3532 check authctxt->valid rather then pw != NULL; ok markus@
3533 - jakob@cvs.openbsd.org 2003/11/08 16:02:40
3534 [auth1.c]
3535 remove unused variable (pw). ok djm@
3536 (id sync only - still used in portable)
3537 - jmc@cvs.openbsd.org 2003/11/08 19:17:29
3538 [sftp-int.c]
3539 typos from Jonathon Gray;
3540 - jakob@cvs.openbsd.org 2003/11/10 16:23:41
3541 [bufaux.c bufaux.h cipher.c cipher.h hostfile.c hostfile.h key.c]
3542 [key.h sftp-common.c sftp-common.h sftp-server.c sshconnect.c sshd.c]
3543 [ssh-dss.c ssh-rsa.c uuencode.c uuencode.h]
3544 constify. ok markus@ & djm@
3545 - dtucker@cvs.openbsd.org 2003/11/12 10:12:15
3546 [scp.c]
3547 When called with -q, pass -q to ssh; suppresses SSH2 banner. ok markus@
3548 - jakob@cvs.openbsd.org 2003/11/12 16:39:58
3549 [dns.c dns.h readconf.c ssh_config.5 sshconnect.c]
3550 update SSHFP validation. ok markus@
3551 - jmc@cvs.openbsd.org 2003/11/12 20:14:51
3552 [ssh_config.5]
3553 make verb agree with subject, and kill some whitespace;
3554 - markus@cvs.openbsd.org 2003/11/14 13:19:09
3555 [sshconnect2.c]
3556 cleanup and minor fixes for the client code; from Simon Wilkinson
3557 - djm@cvs.openbsd.org 2003/11/17 09:45:39
3558 [msg.c msg.h sshconnect2.c ssh-keysign.c]
3559 return error on msg send/receive failure (rather than fatal); ok markus@
3560 - markus@cvs.openbsd.org 2003/11/17 11:06:07
3561 [auth2-gss.c gss-genr.c gss-serv.c monitor.c monitor.h monitor_wrap.c]
3562 [monitor_wrap.h sshconnect2.c ssh-gss.h]
3563 replace "gssapi" with "gssapi-with-mic"; from Simon Wilkinson;
3564 test + ok jakob.
3565 - (djm) Bug #632: Don't call pam_end indirectly from within kbd-int
3566 conversation function
3567 - (djm) Export environment variables from authentication subprocess to
3568 parent. Part of Bug #717
3569
357020031115
3571 - (dtucker) [regress/agent-ptrace.sh] Test for GDB output from Solaris and
3572 HP-UX, skip test on AIX.
3573
357420031113
3575 - (dtucker) [auth-pam.c] Append newlines to lines output by the
3576 pam_chauthtok_conv().
3577 - (dtucker) [README ssh-host-config ssh-user-config Makefile] (All
3578 contrib/cygwin). Major update from vinschen at redhat.com.
3579 - Makefile provides a `cygwin-postinstall' target to run right after
3580 `make install'.
3581 - Better support for Windows 2003 Server.
3582 - Try to get permissions as correct as possible.
3583 - New command line options to allow full automated host configuration.
3584 - Create configs from skeletons in /etc/defaults/etc.
3585 - Use /bin/bash, allows reading user input with readline support.
3586 - Remove really old configs from /usr/local.
3587 - (dtucker) [auth-pam.c] Add newline to accumulated PAM_TEXT_INFO and
3588 PAM_ERROR_MSG messages.
3589
359020031106
3591 - (djm) Clarify UsePAM consequences a little more
3592
359320031103
3594 - (dtucker) [contrib/cygwin/ssh-host-config] Ensure entries in /etc/services
3595 are created correctly with CRLF line terminations. Patch from vinschen at
3596 redhat.com.
3597 - (dtucker) OpenBSD CVS Sync
3598 - markus@cvs.openbsd.org 2003/10/15 09:48:45
3599 [monitor_wrap.c]
3600 check pmonitor != NULL
3601 - markus@cvs.openbsd.org 2003/10/21 09:50:06
3602 [auth2-gss.c]
3603 make sure the doid is larger than 2
3604 - avsm@cvs.openbsd.org 2003/10/26 16:57:43
3605 [sshconnect2.c]
3606 rename 'supported' static var in userauth_gssapi() to 'gss_supported'
3607 to avoid shadowing the global version. markus@ ok
3608 - markus@cvs.openbsd.org 2003/10/28 09:08:06
3609 [misc.c]
3610 error->debug for getsockopt+TCP_NODELAY; several requests
3611 - markus@cvs.openbsd.org 2003/11/02 11:01:03
3612 [auth2-gss.c compat.c compat.h sshconnect2.c]
3613 remove support for SSH_BUG_GSSAPI_BER; simon@sxw.org.uk
3614 - (dtucker) [regress/agent-ptrace.sh] Use numeric uid and gid.
3615
361620031021
3617 - (dtucker) [INSTALL] Some system crypt() functions support MD5 passwords
3618 directly. Noted by Darren.Moffat at sun.com.
3619 - (dtucker) [regress/agent-ptrace.sh] Skip agent-test unless SUDO is set,
3620 make agent setgid during test.
3621
362220031017
3623 - (dtucker) [INSTALL] Note that --with-md5 is now required on platforms with
3624 MD5 passwords even if PAM support is enabled. From steev at detritus.net.
3625
362620031015
3627 - (dtucker) OpenBSD CVS Sync
3628 - jmc@cvs.openbsd.org 2003/10/08 08:27:36
3629 [scp.1 scp.c sftp-server.8 sftp.1 sftp.c ssh.1 sshd.8]
3630 scp and sftp: add options list and sort options. options list requested
3631 by deraadt@
3632 sshd: use same format as ssh
3633 ssh: remove wrong option from list
3634 sftp-server: Subsystem is documented in ssh_config(5), not sshd(8)
3635 ok deraadt@ markus@
3636 - markus@cvs.openbsd.org 2003/10/08 15:21:24
3637 [readconf.c ssh_config.5]
3638 default GSS API to no in client, too; ok jakob, deraadt@
3639 - markus@cvs.openbsd.org 2003/10/11 08:24:08
3640 [readconf.c readconf.h ssh.1 ssh.c ssh_config.5]
3641 remote x11 clients are now untrusted by default, uses xauth(8) to generate
3642 untrusted cookies; ForwardX11Trusted=yes restores old behaviour.
3643 ok deraadt; feedback and ok djm/fries
3644 - markus@cvs.openbsd.org 2003/10/11 08:26:43
3645 [sshconnect2.c]
3646 search keys in reverse order; fixes #684
3647 - markus@cvs.openbsd.org 2003/10/11 11:36:23
3648 [monitor_wrap.c]
3649 return NULL for missing banner; ok djm@
3650 - jmc@cvs.openbsd.org 2003/10/12 13:12:13
3651 [ssh_config.5]
3652 note that EnableSSHKeySign should be in the non-hostspecific section;
3653 remove unnecessary .Pp;
3654 ok markus@
3655 - markus@cvs.openbsd.org 2003/10/13 08:22:25
3656 [scp.1 sftp.1]
3657 don't refer to options related to forwarding; ok jmc@
3658 - jakob@cvs.openbsd.org 2003/10/14 19:42:10
3659 [dns.c dns.h readconf.c ssh-keygen.c sshconnect.c]
3660 include SSHFP lookup code (not enabled by default). ok markus@
3661 - jakob@cvs.openbsd.org 2003/10/14 19:43:23
3662 [README.dns]
3663 update
3664 - markus@cvs.openbsd.org 2003/10/14 19:54:39
3665 [session.c ssh-agent.c]
3666 10X for mkdtemp; djm@
3667 - (dtucker) [acconfig.h configure.ac dns.c openbsd-compat/getrrsetbyname.c
3668 openbsd-compat/getrrsetbyname.h] DNS fingerprint support is now always
3669 compiled in but disabled in config.
3670 - (dtucker) [auth.c] Check for disabled password expiry on HP-UX Trusted Mode.
3671 - (tim) [regress/banner.sh] portability fix.
3672
367320031009
3674 - (dtucker) [sshd_config.5] UsePAM defaults to "no". ok djm@
3675
367620031008
3677 - (dtucker) OpenBSD CVS Sync
3678 - dtucker@cvs.openbsd.org 2003/10/07 01:47:27
3679 [sshconnect2.c]
3680 Don't use logit for banner, since it truncates to MSGBUFSIZ; bz #668 &
3681 #707. ok markus@
3682 - djm@cvs.openbsd.org 2003/10/07 07:04:16
3683 [sftp-int.c]
3684 sftp quoting fix from admorten AT umich.edu; ok markus@
3685 - deraadt@cvs.openbsd.org 2003/10/07 21:58:28
3686 [sshconnect2.c]
3687 set ptr to NULL after free
3688 - dtucker@cvs.openbsd.org 2003/10/07 01:52:13
3689 [regress/Makefile regress/banner.sh]
3690 Test SSH2 banner. ok markus@
3691 - djm@cvs.openbsd.org 2003/10/07 07:04:52
3692 [regress/sftp-cmds.sh]
3693 more sftp quoting regress tests; ok markus
3694
369520031007
3696 - (djm) Delete autom4te.cache after autoreconf
3697 - (dtucker) [auth-pam.c auth-pam.h session.c] Make PAM use the new static
3698 cleanup functions. With & ok djm@
3699 - (dtucker) [contrib/redhat/openssh.spec] Bug #714: Now that UsePAM is a
3700 run-time switch, always build --with-md5-passwords.
3701 - (dtucker) [configure.ac openbsd-compat/Makefile.in openbsd-compat/strtoul.c]
3702 Bug #670: add strtoul() to openbsd-compat for platforms lacking it. ok djm@
3703 - (dtucker) [configure.ac] Bug #715: Set BROKEN_SETREUID and BROKEN_SETREGID
3704 on Reliant Unix. Patch from Robert.Dahlem at siemens.com.
3705 - (dtucker) [configure.ac] Bug #710: Check for dlsym() in libdl on
3706 Reliant Unix. Based on patch from Robert.Dahlem at siemens.com.
3707
370820031003
3709 - (dtucker) OpenBSD CVS Sync
3710 - markus@cvs.openbsd.org 2003/10/02 10:41:59
3711 [sshd.c]
3712 print openssl version, too, several requests; ok henning/djm.
3713 - markus@cvs.openbsd.org 2003/10/02 08:26:53
3714 [ssh-gss.h]
3715 missing $OpenBSD:; dtucker
3716 - (tim) [contrib/caldera/openssh.spec] Remove obsolete --with-ipv4-default
3717 option.
3718
371920031002
3720 - (dtucker) OpenBSD CVS Sync
3721 - markus@cvs.openbsd.org 2003/09/23 20:17:11
3722 [Makefile.in auth1.c auth2.c auth.c auth.h auth-krb5.c canohost.c
3723 cleanup.c clientloop.c fatal.c gss-serv.c log.c log.h monitor.c monitor.h
3724 monitor_wrap.c monitor_wrap.h packet.c serverloop.c session.c session.h
3725 ssh-agent.c sshd.c]
3726 replace fatal_cleanup() and linked list of fatal callbacks with static
3727 cleanup_exit() function. re-refine cleanup_exit() where appropriate,
3728 allocate sshd's authctxt eary to allow simpler cleanup in sshd.
3729 tested by many, ok deraadt@
3730 - markus@cvs.openbsd.org 2003/09/23 20:18:52
3731 [progressmeter.c]
3732 don't print trailing \0; bug #709; Robert.Dahlem@siemens.com
3733 ok millert/deraadt@
3734 - markus@cvs.openbsd.org 2003/09/23 20:41:11
3735 [channels.c channels.h clientloop.c]
3736 move client only agent code to clientloop.c
3737 - markus@cvs.openbsd.org 2003/09/26 08:19:29
3738 [sshd.c]
3739 no need to set the listen sockets to non-block; ok deraadt@
3740 - jmc@cvs.openbsd.org 2003/09/29 11:40:51
3741 [ssh.1]
3742 - add list of options to -o and .Xr ssh_config(5)
3743 - some other cleanup
3744 requested by deraadt@;
3745 ok deraadt@ markus@
3746 - markus@cvs.openbsd.org 2003/09/29 20:19:57
3747 [servconf.c sshd_config]
3748 GSSAPICleanupCreds -> GSSAPICleanupCredentials
3749 - (dtucker) [configure.ac] Don't set DISABLE_SHADOW when configuring
3750 --with-pam. ok djm@
3751 - (dtucker) [ssh-gss.h] Prototype change missed in sync.
3752 - (dtucker) [session.c] Fix bus errors on some 64-bit Solaris configurations.
3753 Based on patches by Matthias Koeppe and Thomas Baden. ok djm@
3754
375520030930
3756 - (bal) Fix issues in openbsd-compat/realpath.c
3757
375820030925
3759 - (dtucker) [configure.ac openbsd-compat/xcrypt.c] Bug #633: Remove
3760 DISABLE_SHADOW for HP-UX, use getspnam instead of getprpwnam. Patch from
3761 michael_steffens at hp.com, ok djm@
3762 - (tim) [sshd_config] UsePAM defaults to no.
3763
376420030924
3765 - (djm) Update version.h and spec files for HEAD
3766 - (dtucker) [configure.ac] IRIX5 needs the same setre[ug]id defines as IRIX6.
3767
376820030923
3769 - (dtucker) [Makefile.in] Bug #644: Fix "make clean" for out-of-tree
3770 builds. Portability corrections from tim@.
3771 - (dtucker) [configure.ac] Bug #665: uid swapping issues on Mac OS X.
3772 Patch from max at quendi.de.
3773 - (dtucker) [configure.ac] Bug #657: uid swapping issues on BSDi.
3774 - (dtucker) [configure.ac] Bug #653: uid swapping issues on Tru64.
3775 - (dtucker) [configure.ac] Bug #693: uid swapping issues on NCR MP-RAS.
3776 Patch from david.haughton at ncr.com
3777 - (dtucker) [configure.ac] Bug #659: uid swapping issues on IRIX 6.
3778 Part of patch supplied by bugzilla-openssh at thewrittenword.com
3779 - (dtucker) [configure.ac openbsd-compat/fake-rfc2553.c
3780 openbsd-compat/fake-rfc2553.h] Bug #659: Test for and handle systems with
3781 where gai_strerror is defined as "const char *". Part of patch supplied
3782 by bugzilla-openssh at thewrittenword.com
3783 - (dtucker) [contrib/cygwin/README contrib/cygwin/ssh-host-config] Update
3784 ssh-host-config to match current defaults, bump README version. Patch from
3785 vinschen at redhat.com.
3786 - (dtucker) [uidswap.c] Don't test restoration of uid on Cygwin since the
3787 OS does not support permanently dropping privileges. Patch from
3788 vinschen at redhat.com.
3789 - (dtucker) [openbsd-compat/port-aix.c] Use correct include for xmalloc.h,
3790 add canohost.h to stop warning. Based on patch from openssh-unix-dev at
3791 thewrittenword.com
3792 - (dtucker) [INSTALL] Bug #686: Document requirement for zlib 1.1.4 or
3793 higher.
3794 - (tim) Fix typo. s/SETEIUD_BREAKS_SETUID/SETEUID_BREAKS_SETUID/
3795 - (tim) [configure.ac] Bug 665: move 3 new AC_DEFINES outside of AC_TRY_RUN.
3796 Report by distler AT golem ph utexas edu.
3797 - (dtucker) [contrib/aix/pam.conf] Include example pam.conf for AIX from
3798 article by genty at austin.ibm.com, included with the author's permission.
3799 - (dtucker) OpenBSD CVS Sync
3800 - markus@cvs.openbsd.org 2003/09/18 07:52:54
3801 [sshconnect.c]
3802 missing {}; bug #656; jclonguet at free.fr
3803 - markus@cvs.openbsd.org 2003/09/18 07:54:48
3804 [buffer.c]
3805 protect against double free; #660; zardoz at users.sf.net
3806 - markus@cvs.openbsd.org 2003/09/18 07:56:05
3807 [authfile.c]
3808 missing buffer_free(&encrypted); #662; zardoz at users.sf.net
3809 - markus@cvs.openbsd.org 2003/09/18 08:49:45
3810 [deattack.c misc.c session.c ssh-agent.c]
3811 more buffer allocation fixes; from Solar Designer; CAN-2003-0682;
3812 ok millert@
3813 - miod@cvs.openbsd.org 2003/09/18 13:02:21
3814 [authfd.c bufaux.c dh.c mac.c ssh-keygen.c]
3815 A few signedness fixes for harmless situations; markus@ ok
3816 - markus@cvs.openbsd.org 2003/09/19 09:02:02
3817 [packet.c]
3818 buffer_dump only if PACKET_DEBUG is defined; Jedi/Sector One; pr 3471
3819 - markus@cvs.openbsd.org 2003/09/19 09:03:00
3820 [buffer.c]
3821 sign fix in buffer_dump; Jedi/Sector One; pr 3473
3822 - markus@cvs.openbsd.org 2003/09/19 11:29:40
3823 [ssh-agent.c]
3824 provide a ssh-agent specific fatal() function; ok deraadt
3825 - markus@cvs.openbsd.org 2003/09/19 11:30:39
3826 [ssh-keyscan.c]
3827 avoid fatal_cleanup, just call exit(); ok deraadt
3828 - markus@cvs.openbsd.org 2003/09/19 11:31:33
3829 [channels.c]
3830 do not call channel_free_all on fatal; ok deraadt
3831 - markus@cvs.openbsd.org 2003/09/19 11:33:09
3832 [packet.c sshd.c]
3833 do not call packet_close on fatal; ok deraadt
3834 - markus@cvs.openbsd.org 2003/09/19 17:40:20
3835 [scp.c]
3836 error handling for remote-remote copy; #638; report Harald Koenig;
3837 ok millert, fgs, henning, deraadt
3838 - markus@cvs.openbsd.org 2003/09/19 17:43:35
3839 [clientloop.c sshtty.c sshtty.h]
3840 remove fatal callbacks from client code; ok deraadt
3841 - (bal) "extration" -> "extraction" in ssh-rand-helper.c; repoted by john
3842 on #unixhelp@efnet
3843 - (tim) [configure.ac] add --disable-etc-default-login option. ok djm
3844 - (djm) Sync with V_3_7 branch:
3845 - (djm) Fix SSH1 challenge kludge
3846 - (djm) Bug #671: Fix builds on OpenBSD
3847 - (djm) Bug #676: Fix PAM stack corruption
3848 - (djm) Fix bad free() in PAM code
3849 - (djm) Don't call pam_end before pam_init
3850 - (djm) Enable build with old OpenSSL again
3851 - (djm) Trim deprecated options from INSTALL. Mention UsePAM
3852 - (djm) Fix quote handling in sftp; Patch from admorten AT umich.edu
3853
3854$Id: ChangeLog,v 1.4117.2.10 2006/02/11 00:00:44 djm Exp $
generated by cgit v1.2.3 (git 2.39.1) at 2024-07-18 07:41:41 +0000