summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2020-02-07upstream: When using HostkeyAlgorithms to merely append or removedjm@openbsd.org
algorithms from the default set (i.e. HostkeyAlgorithms=+/-...), retain the default behaviour of preferring those algorithms that have existing keys in known_hosts; ok markus OpenBSD-Commit-ID: 040e7fcc38ea00146b5d224ce31ce7a1795ee6ed
2020-02-07upstream: expand HostkeyAlgorithms prior to config dump, matchingdjm@openbsd.org
other algorithm lists; ok markus@ OpenBSD-Commit-ID: a66f0fca8cc5ce30405a2867bc115fff600671d0
2020-02-07upstream: Add Include to the list of permitted keywords after anaddy@openbsd.org
Match keyword. ok markus@ OpenBSD-Commit-ID: 342e940538b13dd41e0fa167dc9ab192b9f6e2eb
2020-02-07upstream: Replace "security key" with "authenticator" in programnaddy@openbsd.org
messages. This replaces "security key" in error/usage/verbose messages and distinguishes between "authenticator" and "authenticator-hosted key". ok djm@ OpenBSD-Commit-ID: 7c63800e9c340c59440a054cde9790a78f18592e
2020-02-06Don't look for UINT32_MAX in inttypes.hDarren Tucker
... unless we are actually going to use it. Fixes build on HP-UX without the potential impact to other platforms of a header change shortly before release.
2020-02-06dependDamien Miller
2020-02-06Fix sha2 MAKE_CLONE no-op definitionMichael Forney
The point of the dummy declaration is so that MAKE_CLONE(...) can have a trailing semicolon without introducing an empty declaration. So, the macro replacement text should *not* have a trailing semicolon, just like DEF_WEAK.
2020-02-04upstream: require FIDO application strings to start with "ssh:"; okdjm@openbsd.org
markus@ OpenBSD-Commit-ID: 94e9c1c066d42b76f035a3d58250a32b14000afb
2020-02-04upstream: revert enabling UpdateHostKeys by default - there are stilldjm@openbsd.org
corner cases we need to address; ok markus OpenBSD-Commit-ID: ff7ad941bfdc49fb1d8baa95fd0717a61adcad57
2020-02-04upstream: use better markup for challenge and write-attestation, andjmc@openbsd.org
rejig the challenge text a little; ok djm OpenBSD-Commit-ID: 9f351e6da9edfdc907d5c3fdaf2e9ff3ab0a7a6f
2020-02-03mention libfido2 in dependencies sectionDamien Miller
2020-02-03add clock_gettime64(2) to sandbox allowed syscallsDamien Miller
bz3093
2020-02-02upstream: Output (none) in debug in the case in the CheckHostIP=no casedtucker@openbsd.org
as suggested by markus@ OpenBSD-Commit-ID: 4ab9117ee5261cbbd1868717fcc3142eea6385cf
2020-02-02upstream: Prevent possible null pointer deref of ip_str in debug.dtucker@openbsd.org
OpenBSD-Commit-ID: 37b252e2e6f690efed6682437ef75734dbc8addf
2020-02-02upstream: shuffle the challenge keyword to keep the -O list sorted;jmc@openbsd.org
OpenBSD-Commit-ID: 08efad608b790949a9a048d65578fae9ed5845fe
2020-02-02upstream: tweak previous;jmc@openbsd.org
OpenBSD-Commit-ID: 0c42851cdc88583402b4ab2b110a6348563626d3
2020-02-01Use sys-queue.h from compat library.Darren Tucker
Fixes build on platforms that don't have sys/queue.h (eg MUSL).
2020-02-01upstream: regress test for sshd_config Include directive; from Jakubdjm@openbsd.org
Jelen OpenBSD-Regress-ID: 0d9224de3297c7a5f51ba68d6e3725a2a9345fa4
2020-02-01upstream: whitespacedjm@openbsd.org
OpenBSD-Commit-ID: 564cf7a5407ecf5da2d94ec15474e07427986772
2020-02-01upstream: force early logging to stderr if debug_flag (-d) is set;djm@openbsd.org
avoids missing messages from re-exec config passing OpenBSD-Commit-ID: 02484b8241c1f49010e7a543a7098e6910a8c9ff
2020-02-01upstream: mistake in previous: filling the incorrect bufferdjm@openbsd.org
OpenBSD-Commit-ID: 862ee84bd4b97b529f64aec5d800c3dcde952e3a
2020-02-01upstream: Add a sshd_config "Include" directive to allow inclusiondjm@openbsd.org
of files. This has sensible semantics wrt Match blocks and accepts glob(3) patterns to specify the included files. Based on patch by Jakub Jelen in bz2468; feedback and ok markus@ OpenBSD-Commit-ID: 36ed0e845b872e33f03355b936a4fff02d5794ff
2020-02-01upstream: spelling fix;jmc@openbsd.org
OpenBSD-Commit-ID: 3c079523c4b161725a4b15dd06348186da912402
2020-01-31upstream: document changed default for UpdateHostKeysdjm@openbsd.org
OpenBSD-Commit-ID: 25c390b21d142f78ac0106241d13441c4265fd2c
2020-01-31upstream: enable UpdateKnownHosts=yes if the configurationdjm@openbsd.org
specifies only the default known_hosts files, otherwise select UpdateKnownHosts=ask; ok markus@ OpenBSD-Commit-ID: ab401a5ec4a33d2e1a9449eae6202e4b6d427df7
2020-01-30Look in inttypes.h for UINT32_MAX.Darren Tucker
Should prevent warnings on at least some AIX versions.
2020-01-30upstream: use sshpkt_fatal() instead of plain fatal() fordjm@openbsd.org
ssh_packet_write_poll() failures here too as the former yields better error messages; ok dtucker@ OpenBSD-Commit-ID: 1f7a6ca95bc2b716c2e948fc1370753be772d8e3
2020-01-30upstream: check the return value of ssh_packet_write_poll() anddjm@openbsd.org
call sshpkt_fatal() if it fails; avoid potential busy-loop under some circumstances. Based on patch by Mike Frysinger; ok dtucker@ OpenBSD-Commit-ID: c79fe5cf4f0cd8074cb6db257c1394d5139408ec
2020-01-30upstream: have sshpkt_fatal() save/restore errno before wedjm@openbsd.org
potentially call strerror() (via ssh_err()); ok dtucker OpenBSD-Commit-ID: 5590df31d21405498c848245b85c24acb84ad787
2020-01-30upstream: markus suggests a simplification to previousdjm@openbsd.org
OpenBSD-Commit-ID: 10bbfb6607ebbb9a018dcd163f0964941adf58de
2020-01-29upstream: give more context to UpdateHostKeys messages, mentioningdjm@openbsd.org
that the changes are validated by the existing trusted host key. Prompted by espie@ feedback and ok markus@ OpenBSD-Commit-ID: b3d95f4a45f2692f4143b9e77bb241184dbb8dc5
2020-01-29upstream: changes to support FIDO attestationdjm@openbsd.org
Allow writing to disk the attestation certificate that is generated by the FIDO token at key enrollment time. These certificates may be used by an out-of-band workflow to prove that a particular key is held in trustworthy hardware. Allow passing in a challenge that will be sent to the card during key enrollment. These are needed to build an attestation workflow that resists replay attacks. ok markus@ OpenBSD-Commit-ID: 457dc3c3d689ba39eed328f0817ed9b91a5f78f6
2020-01-29upstream: disable UpdateHostKeys=ask when in quiet mode; "work fordjm@openbsd.org
me" matthieu@ OpenBSD-Commit-ID: 60d7b5eb91accf935ed9852650a826d86db2ddc7
2020-01-28compat for missing IPTOS_DSCP_LE in system headersDamien Miller
2020-01-28upstream: make IPTOS_DSCP_LE available via IPQoS directive; bz2986,djm@openbsd.org
based on patch by veegish AT cyberstorm.mu OpenBSD-Commit-ID: 9902bf4fbb4ea51de2193ac2b1d965bc5d99c425
2020-01-28upstream: disable UpdateHostKeys=ask if command is specified; okmarkus@openbsd.org
djm@ sthen@ OpenBSD-Commit-ID: e5bcc45eadb78896637d4143d289f1e42c2ef5d7
2020-01-28upstream: unbreak unittests for recent API / source file changesdjm@openbsd.org
OpenBSD-Regress-ID: 075a899a01bbf7781d38bf0b33d8366faaf6d3c0
2020-01-26Move definition of UINT32_MAX.Darren Tucker
This allows us to always define it if needed not just if we also define the type ourself.
2020-01-26upstream: unbreak unittests for recent API / source file changesdjm@openbsd.org
OpenBSD-Regress-ID: 075a899a01bbf7781d38bf0b33d8366faaf6d3c0
2020-01-26Include signal.h to prevent redefintion of _NSIG.Darren Tucker
2020-01-26Wrap stdint.h in tests inside HAVE_STDINT_H.Darren Tucker
2020-01-26upstream: for UpdateHostKeys, don't report errors for unsupporteddjm@openbsd.org
key types - just ignore them. spotted by and ok dtucker@ OpenBSD-Commit-ID: 91769e443f6197c983932fc8ae9d39948727d473
2020-01-26upstream: downgrade error() for missing subsequent known_hostsdjm@openbsd.org
files to debug() as it was intended to be; spotted by dtucker@ OpenBSD-Commit-ID: 18cfea382cb52f2da761be524e309cc3d5354ef9
2020-01-26upstream: clarify that BatchMode applies to all interactive promptsdjm@openbsd.org
(e.g. host key confirmation) and not just password prompts. OpenBSD-Commit-ID: 97b001883d89d3fb1620d2e6b747c14a26aa9818
2020-01-26upstream: tidy headers; some junk snuck into sshbuf-misc.c anddjm@openbsd.org
sshbuf-io.c doesn't need SSHBUF_INTERNAL set OpenBSD-Commit-ID: 27a724d2e0b2619c1a1490f44093bbd73580d9e6
2020-01-26dependDamien Miller
2020-01-26upstream: improve the error message for u2f enrollment errors bydjm@openbsd.org
making ssh-keygen be solely responsible for printing the error message and convertint some more common error responses from the middleware to a useful ssherr.h status code. more detail remains visible via -v of course. also remove indepedent copy of sk-api.h declarations in sk-usbhid.c and just include it. feedback & ok markus@ OpenBSD-Commit-ID: a4a8ffa870d9a3e0cfd76544bcdeef5c9fb1f1bb
2020-01-26upstream: factor out reading/writing sshbufs to dedicateddjm@openbsd.org
functions; feedback and ok markus@ OpenBSD-Commit-ID: dc09e5f1950b7acc91b8fdf8015347782d2ecd3d
2020-01-26upstream: add a comment describing the ranges of channel IDs thatdjm@openbsd.org
we use; requested by markus@ OpenBSD-Commit-ID: 83a1f09810ffa3a96a55fbe32675b34ba739e56b
2020-01-26upstream: make sshd_config:ClientAliveCountMax=0 disable thedjm@openbsd.org
connection killing behaviour, rather than killing the connection after sending the first liveness test probe (regardless of whether the client was responsive) bz2627; ok markus OpenBSD-Commit-ID: 5af79c35f4c9fa280643b6852f524bfcd9bccdaf
generated by cgit v1.2.3 (git 2.39.1) at 2024-11-06 07:28:25 +0000