| Age | Commit message (Collapse) | Author |
|---|
|
refactor ssh_dispatch_run_fatal() to use sshpkt_fatal()
to better report error conditions. Teach sshpkt_fatal() about ECONNRESET.
Improves error messages on TCP connection resets. bz#2257
ok dtucker@
|
|
a couple of parse targets were missing activep checks,
causing them to be misapplied in match context; bz#2272 diagnosis and
original patch from Sami Hartikainen ok dtucker@
|
|
make handling of AuthorizedPrincipalsFile=none more
consistent with other =none options; bz#2288 from Jakub Jelen; ok dtucker@
|
|
remove failed remote forwards established by muliplexing
from the list of active forwards; bz#2363, patch mostly by Yoann Ricordel; ok
dtucker@
|
|
reduce stderr spam when using ssh -S /path/mux -O forward
-R 0:... ok dtucker@
|
|
prevent authorized_keys options picked up on public key
tests without a corresponding private key authentication being applied to
other authentication methods. Reported by halex@, ok markus@
|
|
Don't make parsing of authorized_keys' environment=
option conditional on PermitUserEnv - always parse it, but only use the
result if the option is enabled. This prevents the syntax of authorized_keys
changing depending on which sshd_config options were enabled.
bz#2329; based on patch from coladict AT gmail.com, ok dtucker@
|
|
Remove pattern length argument from match_pattern_list(), we
only ever use it for strlen(pattern).
Prompted by hanno AT hboeck.de pointing an out-of-bound read
error caused by an incorrect pattern length found using AFL
and his own tools.
ok markus@
|
|
Add a simple regression test for sshd's configuration
parser. Right now, all it does is run the output of sshd -T back through
itself and ensure the output is valid and invariant.
|
|
use correct key for nested certificate test
|
|
mention that the user's shell from /etc/passwd is used
for commands too; bz#1459 ok dtucker@
|
|
whitespace
Upstream-Regress-ID: 6b708a3e709d5b7fd37890f874bafdff1f597519
|
|
whitespace at EOL
Upstream-Regress-ID: 9c48911643d5b05173b36a012041bed4080b8554
|
|
moar whitespace at eol
Upstream-ID: 64eaf872a3ba52ed41e494287e80d40aaba4b515
|
|
whitespace at EOL
Upstream-ID: 57bcf67d666c6fc1ad798aee448fdc3f70f7ec2c
|
|
whitespace at EOL
|
|
Use diff w/out -u for better portability
|
|
Use xcalloc for permitted_adm_opens instead of xmalloc to
ensure it's zeroed. Fixes post-auth crash with permitopen=none. bz#2355, ok
djm@
|
|
don't choke on new-format private keys encrypted with an
AEAD cipher; bz#2366, patch from Ron Frederick; ok markus@
|
|
Clarify pseudo-terminal request behaviour and use
"pseudo-terminal" consistently. bz#1716, ok jmc@ "I like it" deraadt@.
|
|
Blacklist DH-GEX for specific PuTTY versions known to
send non-RFC4419 DH-GEX messages rather than all versions of PuTTY.
According to Simon Tatham, 0.65 and newer versions will send RFC4419 DH-GEX
messages. ok djm@
|
|
WinSCP doesn't implement RFC4419 DH-GEX so flag it so we
don't offer that KEX method. ok markus@
|
|
use the sizeof the struct not the sizeof a pointer to the
struct in ssh_digest_start()
This file is only used if ssh is built with OPENSSL=no
ok markus@
|
|
This might help with the reported problem cross compiling for Android
("error: expected identifier or '(' before numeric constant") but
shouldn't hurt in any case.
|
|
|
|
Allow ListenAddress, Port and AddressFamily in any
order. bz#68, ok djm@, jmc@ (for the man page bit).
|
|
enviroment -> environment: apologies to darren for not
spotting that first time round...
|
|
Fix typo in previous
|
|
Document that the TERM environment variable is not
subject to SendEnv and AcceptEnv. bz#2386, based loosely on a patch from
jjelen at redhat, help and ok jmc@
|
|
Make sshd default to PermitRootLogin=no; ok deraadt@
rpe@
|
|
fix compilation with OPENSSL=no; ok dtucker@
|
|
Include stdio.h for FILE (used in sshkey.h) so it
compiles with OPENSSL=no.
|
|
allow "sshd -f none" to skip reading the config file,
much like "ssh -F none" does. ok dtucker
|
|
combine -Dd onto one line and update usage();
|
|
add ssh-agent -D to leave ssh-agent in foreground
without enabling debug mode; bz#2381 ok dtucker@
|
|
2*len -> use xreallocarray() ok djm
|
|
rename xrealloc() to xreallocarray() since it follows
that form. ok djm
|
|
Two small fixes for sshd -T: ListenAddress'es are added
to a list head so reverse the order when printing them to ensure the
behaviour remains the same, and print StreamLocalBindMask as octal with
leading zero. ok deraadt@
|
|
Check for and reject missing arguments for
VersionAddendum and ForceCommand. bz#2281, patch from plautrba at redhat com,
ok djm@
|
|
unknown certificate extensions are non-fatal, so don't
fatal when they are encountered; bz#2387 reported by Bob Van Zant; ok
dtucker@
|
|
Add back a backslash removed in rev 1.42 so
KEX_SERVER_ENCRYPT will include aes again.
ok deraadt@
|
|
s/recommended/required/ that private keys be og-r this
wording change was made a while ago but got accidentally reverted
|
|
don't try to cleanup NULL KEX proposals in
kex_prop_free(); found by Jukka Taimisto and Markus Hietava
|
|
use error/logit/fatal instead of fprintf(stderr, ...)
and exit(0), fix a few errors that were being printed to stdout instead of
stderr and a few non-errors that were going to stderr instead of stdout
bz#2325; ok dtucker
|
|
debug log missing DISPLAY environment when X11
forwarding requested; bz#1682 ok dtucker@
|
|
don't call record_login() in monitor when UseLogin is
enabled; bz#278 reported by drk AT sgi.com; ok dtucker
|
|
Add some missing options to sshd -T and fix the output
of VersionAddendum HostCertificate. bz#2346, patch from jjelen at redhat
com, ok djm.
|
|
Document "none" for PidFile XAuthLocation
TrustedUserCAKeys and RevokedKeys. bz#2382, feedback from jmc@, ok djm@
|
|
Plug leak of address passed to logging. bz#2373, patch
from jjelen at redhat, ok markus@
|
|
Output remote username in debug output since with Host
and Match it's not always obvious what it will be. bz#2368, ok djm@
|
