summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2016-09-21upstream commitmarkus@openbsd.org
move inbound NEWKEYS handling to kex layer; otherwise early NEWKEYS causes NULL deref; found by Robert Swiecki/honggfuzz; fixed with & ok djm@ Upstream-ID: 9a68b882892e9f51dc7bfa9f5a423858af358b2f
2016-09-21upstream commitnatano@openbsd.org
Replace two more arc4random() loops with arc4random_buf(). tweaks and ok dtucker ok deraadt Upstream-ID: 738d3229130ccc7eac975c190276ca6fcf0208e4
2016-09-21upstream committedu@openbsd.org
replace two arc4random loops with arc4random_buf ok deraadt natano Upstream-ID: e18ede972d1737df54b49f011fa4f3917a403f48
2016-09-15upstream commitdjm@openbsd.org
take fingerprint of correct key for AuthorizedPrincipalsCommand Upstream-ID: 553581a549cd6a3e73ce9f57559a325cc2cb1f38
2016-09-14upstream commitdjm@openbsd.org
add %-escapes to AuthorizedPrincipalsCommand to match those supported for AuthorizedKeysCommand (key, key type, fingerprint, etc) and a few more to provide access to the certificate's CA key; 'looks ok' dtucker@ Upstream-ID: 6b00fd446dbebe67f4e4e146d2e492d650ae04eb
2016-09-14upstream commitdtucker@openbsd.org
Improve test coverage of ssh-keygen -T a bit. Upstream-Regress-ID: 8851668c721bcc2b400600cfc5a87644cc024e72
2016-09-14upstream commitdtucker@openbsd.org
Add testcase for ssh-keygen -j, -J and -K options for moduli screening. Does not currently test generation as that is extremely slow. Upstream-Regress-ID: 9de6ce801377ed3ce0a63a1413f1cd5fd3c2d062
2016-09-14upstream commitdjm@openbsd.org
add tests for addr_match_list() Upstream-Regress-ID: fae2d1fef84687ece584738a924c7bf969616c8e
2016-09-14upstream commitdjm@openbsd.org
handle certs in rsa_hash_alg_from_ident(), saving an unnecessary special case elsewhere. Upstream-ID: 901cb081c59d6d2698b57901c427f3f6dc7397d4
2016-09-13upstream commitdjm@openbsd.org
list all supported signature algorithms in the server-sig-algs Reported by mb AT smartftp.com in bz#2547 and (independantly) Ron Frederick; ok markus@ Upstream-ID: ddf702d721f54646b11ef2cee6d916666cb685cd
2016-09-12Remove no-op brackets to resync with upstream.Darren Tucker
2016-09-12Resync ssh-keygen -W error message with upstream.Darren Tucker
2016-09-12Move ssh-keygen -W handling code to match upstreamDarren Tucker
2016-09-12Move ssh-keygen -T handling code to match upstream.Darren Tucker
2016-09-12Move -M handling code to match upstream.Darren Tucker
2016-09-12upstream commitdtucker@openbsd.org
Spaces->tabs. Upstream-ID: f4829dfc3f36318273f6082b379ac562eead70b7
2016-09-12upstream commitdtucker@openbsd.org
Style whitespace fix. Also happens to remove a no-op diff with portable. Upstream-ID: 45d90f9a62ad56340913a433a9453eb30ceb8bf3
2016-09-12upstream commitderaadt@openbsd.org
Add MAXIMUM(), MINIMUM(), and ROUNDUP() to misc.h, then use those definitions rather than pulling <sys/param.h> and unknown namespace pollution. ok djm markus dtucker Upstream-ID: 712cafa816c9f012a61628b66b9fbd5687223fb8
2016-09-12upstream commitjmc@openbsd.org
sort; from matthew martin Upstream-ID: 73cec7f7ecc82d37a4adffad7745e4684de67ce7
2016-09-12upstream commitmarkus@openbsd.org
ssh_set_newkeys: print correct block counters on rekeying; ok djm@ Upstream-ID: 32bb7a9cb9919ff5bab28d50ecef3a2b2045dd1e
2016-09-12upstream commitmarkus@openbsd.org
update ext_info_c every time we receive a kexinit msg; fixes sending of ext_info if privsep is disabled; report Aris Adamantiadis & Mancha; ok djm@ Upstream-ID: 2ceaa1076e19dbd3542254b4fb8e42d608f28856
2016-09-12upstream commitdjm@openbsd.org
remove 3des-cbc from the client's default proposal; 64-bit block ciphers are not safe in 2016 and we don't want to wait until attacks like sweet32 are extended to SSH. As 3des-cbc was the only mandatory cipher in the SSH RFCs, this may cause problems connecting to older devices using the defaults, but it's highly likely that such devices already need explicit configuration for KEX and hostkeys anyway. ok deraadt, markus, dtucker Upstream-ID: a505dfe65c6733af0f751b64cbc4bb7e0761bc2f
2016-09-12upstream commitdjm@openbsd.org
enforce expected request flow for GSSAPI calls; thanks to Jakub Jelen for testing; ok markus@ Upstream-ID: d4bc0e70e1be403735d3d9d7e176309b1fd626b9
2016-09-12Restore ssh-keygen's -J and -j option handling.Darren Tucker
These were incorrectly removed in the 1d9a2e28 sync commit.
2016-08-31tighten PAM monitor callsDamien Miller
only allow kbd-interactive ones when that authentication method is enabled. Prompted by Solar Designer
2016-08-31upstream commitdjm@openbsd.org
restrict monitor auth calls to be allowed only when their respective authentication methods are enabled in the configuration. prompted by Solar Designer; ok markus dtucker Upstream-ID: 6eb3f89332b3546d41d6dbf5a8e6ff920142b553
2016-08-29Tighten monitor state-machine flow for PAM callsDamien Miller
(attack surface reduction)
2016-08-29upstream commitdjm@openbsd.org
fix uninitialised optlen in getsockopt() call; harmless on Unix/BSD but potentially crashy on Cygwin. Reported by James Slepicka ok deraadt@ Upstream-ID: 1987ccee508ba5b18f016c85100d7ac3f70ff965
2016-08-29upstream commitguenther@openbsd.org
Pull in <sys/time.h> for struct timeval ok deraadt@ Upstream-ID: ae34525485a173bccd61ac8eefeb91c57e3b7df6
2016-08-29upstream commitguenther@openbsd.org
Pull in <stdlib.h> for NULL ok deraadt@ Upstream-ID: 7baa6a0f1e049bb3682522b4b95a26c866bfc043
2016-08-29upstream commitdjm@openbsd.org
add a sIgnore opcode that silently ignores options and use it to suppress noisy deprecation warnings for the Protocol directive. req henning, ok markus Upstream-ID: 9fe040aca3d6ff393f6f7e60045cdd821dc4cbe0
2016-08-29upstream commitdjm@openbsd.org
remove superfluous NOTREACHED comment Upstream-ID: a7485c1f1be618e8c9e38fd9be46c13b2d03b90c
2016-08-29upstream commitotto@openbsd.org
fix previous, a condition was modified incorrectly; ok markus@ deraadt@ Upstream-ID: c443e339768e7ed396dff3bb55f693e7d3641453
2016-08-29upstream commitdjm@openbsd.org
downgrade an error() to a debug2() to match similar cases in addr_match_list() Upstream-ID: 07c3d53e357214153d9d08f234411e0d1a3d6f5c
2016-08-23upstream commitdjm@openbsd.org
remove Protocol directive from client/server configs that causes spammy deprecation warnings hardcode SSH_PROTOCOLS=2, since that's all we support on the server now (the client still may support both, so it could get confused) Upstream-Regress-ID: c16662c631af51633f9fd06aca552a70535de181
2016-08-23hook match and utf8 unittests up to MakefileDamien Miller
2016-08-23upstream commitdjm@openbsd.org
add tests for matching functions Upstream-Regress-ID: 0869d4f5c5d627c583c6a929d69c17d5dd65882c
2016-08-23removing UseLogin bits from configure.acDamien Miller
2016-08-23upstream commitdjm@openbsd.org
fix negated address matching where the address list consists of a single negated match, e.g. "Match addr !192.20.0.1" Report and patch from Jakub Jelen. bz#2397 ok dtucker@ Upstream-ID: 01dcac3f3e6ca47518cf293e31c73597a4bb40d8
2016-08-23upstream commitdjm@openbsd.org
fix matching for pattern lists that contain a single negated match, e.g. "Host !example" report and patch from Robin Becker. bz#1918 ok dtucker@ Upstream-ID: 05a0cb323ea4bc20e98db099b42c067bfb9ea1ea
2016-08-23upstream commitdjm@openbsd.org
remove UseLogin option and support for having /bin/login manage login sessions; ok deraadt markus dtucker Upstream-ID: bea7213fbf158efab7e602d9d844fba4837d2712
2016-08-23upstream commitnaddy@openbsd.org
Catch up with the SSH1 code removal and delete all mention of protocol 1 particularities, key files and formats, command line options, and configuration keywords from the server documentation and examples. ok jmc@ Upstream-ID: 850328854675b4b6a0d4a90f0b4a9dd9ca4e905f
2016-08-23upstream commitnaddy@openbsd.org
Remove more SSH1 server code: * Drop sshd's -k option. * Retire configuration keywords that only apply to protocol 1, as well as the "protocol" keyword. * Remove some related vestiges of protocol 1 support. ok markus@ Upstream-ID: 9402f82886de917779db12f8ee3f03d4decc244d
2016-08-17Only check for prctl once.Darren Tucker
2016-08-17Fix typo.Darren Tucker
2016-08-17Correct LDFLAGS for clang example.Darren Tucker
--with-ldflags isn't used until after the -ftrapv test, so mention LDFLAGS instead for now.
2016-08-17Remove obsolete CVS $Id from source files.Darren Tucker
Since -portable switched to git the CVS $Id tags are no longer being updated and are becoming increasingly misleading. Remove them.
2016-08-17Remove now-obsolete CVS $Id tags from text files.Darren Tucker
Since -portable switched to git, the CVS $Id tags are no longer being updated and are becoming increasingly misleading. Remove them.
2016-08-17Add a section for compiler specifics.Darren Tucker
Add a section for compiler specifics and document the runtime requirements for clang's integer sanitization.
2016-08-17Test multiplying two long long ints.Darren Tucker
When using clang with -ftrapv or -sanitize=integer the tests would pass but linking would fail with "undefined reference to __mulodi4". Explicitly test for this before enabling -trapv.
generated by cgit v1.2.3 (git 2.39.1) at 2024-07-08 00:25:31 +0000