summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2014-01-20 - (tim) [platform.c session.c] Fix bug affecting SVR5 platforms introducedTim Rice
with sftp chroot support. Move set_id call after chroot.
2014-01-21 - (dtucker) [aclocal.m4] Differentiate between compile-time and link-timeDarren Tucker
tests in the configure output. ok djm.
2014-01-21 - (dtucker) [configure.ac] Make PIE a configure-time option which defaultsDarren Tucker
to on platforms where it's known to be reliably detected and off elsewhere. Works around platforms such as FreeBSD 9.1 where it does not interop with -ftrapv (it seems to work but fails when trying to link ssh). ok djm@
2014-01-20 - (djm) [regress/cert-hostkey.sh] Fix regress failure on platforms thatDamien Miller
skip one or more key types (e.g. RHEL/CentOS 6.5); ok dtucker@
2014-01-20- (dtucker) [gss-serv-krb5.c] Fall back to krb5_cc_gen_new if the KerberosDarren Tucker
implementation does not have krb5_cc_new_unique, similar to what we do in auth-krb5.c.
2014-01-20 - djm@cvs.openbsd.org 2014/01/20 00:08:48Damien Miller
[digest.c] memleak; found by Loganaden Velvindron @ AfriNIC; ok markus@
2014-01-19 - dtucker@cvs.openbsd.org 2014/01/19 11:21:51Darren Tucker
[addrmatch.c] Cast the sizeof to socklen_t so it'll work even if the supplied len is negative. Suggested by and ok djm, ok deraadt.
2014-01-19 - djm@cvs.openbsd.org 2014/01/19 04:48:08Darren Tucker
[ssh_config.5] fix inverted meaning of 'no' and 'yes' for CanonicalizeFallbackLocal
2014-01-19 - dtucker@cvs.openbsd.org 2014/01/19 04:17:29Darren Tucker
[canohost.c addrmatch.c] Cast socklen_t when comparing to size_t and use socklen_t to iterate over the ip options, both to prevent signed/unsigned comparison warnings. Patch from vinschen at redhat via portable openssh, begrudging ok deraadt.
2014-01-19 - dtucker@cvs.openbsd.org 2014/01/18 09:36:26Darren Tucker
[session.c] explicitly define USE_PIPES to 1 to prevent redefinition warnings in portable on platforms that use pipes for everything. From redhat @ redhat.
2014-01-19 - dtucker@cvs.openbsd.org 2014/01/17 06:23:24Darren Tucker
[sftp-server.c] fix log message statvfs. ok djm
2014-01-18 - (dtucker) [sandbox-capsicum.c] Correct some error messages and make theDarren Tucker
return value check for cap_enter() consistent with the other uses in FreeBSD. From by Loganaden Velvindron @ AfriNIC via bz#2140.
2014-01-18 - (dtucker) [configure.ac] On Cygwin the getopt variables (like optargs,Darren Tucker
optind) are defined in getopt.h already. Unfortunately they are defined as "declspec(dllimport)" for historical reasons, because the GNU linker didn't allow auto-import on PE/COFF targets way back when. The problem is the dllexport attributes collide with the definitions in the various source files in OpenSSH, which obviousy define the variables without declspec(dllimport). The least intrusive way to get rid of these warnings is to disable warnings for GCC compiler attributes when building on Cygwin. Patch from vinschen at redhat.com.
2014-01-18 - (dtucker) [openbsd-compat/bsd-cygwin_util.h] Add missing functionDarren Tucker
declarations that stopped being included when we stopped including <windows.h> from openbsd-compat/bsd-cygwin_util.h. Patch from vinschen at redhat.com.
2014-01-18 - (dtucker) [uidswap.c] Prevent unused variable warnings on Cygwin. PatchDarren Tucker
from vinschen at redhat.com
2014-01-18 - (dtucker) [defines.h] Move our definitions of uintXX_t types down to afterDarren Tucker
they're defined if we have to define them ourselves. Fixes builds on old AIX.
2014-01-18 - (dtucker) [readconf.c] Wrap paths.h inside an ifdef. Allows building onDarren Tucker
Solaris.
2014-01-17 - (dtucker) [configure.ac] Have --without-toolchain-hardening not turn offDarren Tucker
stack-protector since that has a separate flag that's been around a while.
2014-01-17 - (dtucker) [configure.ac] Also look in inttypes.h for uintXX_t types.Darren Tucker
2014-01-17 - (dtucker) [openbsd-compat/bsd-statvfs.h] Only start including headers if weDarren Tucker
need them to cut down on the name collisions.
2014-01-17 - (dtucker) [configure.ac openbsd-compat/bsd-statvfs.cDarren Tucker
openbsd-compat/bsd-statvfs.h] Implement enough of statvfs on top of statfs to be useful (and for the regression tests to pass) on platforms that have statfs and fstatfs. ok djm@
2014-01-17 - (dtucker) Fix typo in #ifndef.Darren Tucker
2014-01-17 - (dtucker) [configure.ac digest.c openbsd-compat/openssl-compat.cDarren Tucker
openbsd-compat/openssl-compat.h] Add compatibility layer for older openssl versions. ok djm@
2014-01-17 - (djm) [Makefile.in configure.ac sandbox-capsicum.c sandbox-darwin.c]Damien Miller
[sandbox-null.c sandbox-rlimit.c sandbox-seccomp-filter.c] [sandbox-systrace.c ssh-sandbox.h sshd.c] Support preauth sandboxing using the Capsicum API introduced in FreeBSD 10. Patch by Dag-Erling Smorgrav, updated by Loganaden Velvindron @ AfriNIC; ok dtucker@
2014-01-17 - dtucker@cvs.openbsd.org 2014/01/17 05:26:41Darren Tucker
[digest.c] remove unused includes. ok djm@
2014-01-17 - djm@cvs.openbsd.org 2014/01/17 00:21:06Darren Tucker
[sftp-client.c] signed/unsigned comparison warning fix; from portable (Id sync only)
2014-01-17 - (dtucker) [configure.ac] Split AC_CHECK_FUNCS for OpenSSL functions intoDarren Tucker
separate lines and alphabetize for easier diffing of changes.
2014-01-17 - (dtucker) [defines.h] Add typedefs for uintXX_t types for platforms thatDarren Tucker
don't have them.
2014-01-17 - (dtucker) [openbsd-compat/bcrypt_pbkdf.c] Wrap stdlib.h include insideDarren Tucker
#ifdef HAVE_STDINT_H.
2014-01-17 - (dtucker) [blocks.c fe25519.c ge25519.c hash.c sc25519.c verify.c] IncludeDarren Tucker
includes.h to pull in all of the compatibility stuff.
2014-01-17 - (dtucker) [poly1305.c] Wrap stdlib.h include inside #ifdef HAVE_STDINT_H.Darren Tucker
2014-01-17 - (dtucker) [crypto_api.h] Wrap stdlib.h include inside #ifdef HAVE_STDINT_H.Darren Tucker
2014-01-17 - (dtucker) [loginrec.c] Cast to the types specfied in the formatDarren Tucker
specification to prevent warnings.
2014-01-17 - (djm) [sftp-client.c] signed/unsigned comparison fixDamien Miller
2014-01-17 - (dtucker) [aclocal.m4 configure.ac] Add some additional compiler/toolchainDarren Tucker
hardening flags including -fstack-protector-strong. These default to on if the toolchain supports them, but there is a configure-time knob (--without-hardening) to disable them if necessary. ok djm@
2014-01-16 - (djm) [README] update release notes URL.Damien Miller
2014-01-16 - (djm) [contrib/caldera/openssh.spec contrib/redhat/openssh.spec]Damien Miller
[contrib/suse/openssh.spec] Crank RPM spec version numbers.
2014-01-16 - djm@cvs.openbsd.org 2014/01/16 07:32:00Damien Miller
[version.h] openssh-6.5
2014-01-16 - djm@cvs.openbsd.org 2014/01/16 07:31:09Damien Miller
[sftp-client.c] needless and incorrect cast to size_t can break resumption of large download; patch from tobias@
2014-01-12 - djm@cvs.openbsd.org 2014/01/12 08:13:13Damien Miller
[bufaux.c buffer.h kex.c kex.h kexc25519.c kexc25519c.c kexc25519s.c] [kexdhc.c kexdhs.c kexecdhc.c kexecdhs.c kexgexc.c kexgexs.c] avoid use of OpenSSL BIGNUM type and functions for KEX with Curve25519 by adding a buffer_put_bignum2_from_string() that stores a string using the bignum encoding rules. Will make it easier to build a reduced-feature OpenSSH without OpenSSL in the future; ok markus@
2014-01-12 - djm@cvs.openbsd.org 2014/01/10 05:59:19Damien Miller
[sshd_config] the /etc/ssh/ssh_host_ed25519_key is loaded by default too
2014-01-10 - djm@cvs.openbsd.org 2014/01/09 23:26:48Damien Miller
[sshconnect.c sshd.c] ban clients/servers that suffer from SSH_BUG_DERIVEKEY, they are ancient, deranged and might make some attacks on KEX easier; ok markus@
2014-01-10 - djm@cvs.openbsd.org 2014/01/09 23:20:00Damien Miller
[digest.c digest.h hostfile.c kex.c kex.h kexc25519.c kexc25519c.c] [kexc25519s.c kexdh.c kexecdh.c kexecdhc.c kexecdhs.c kexgex.c kexgexc.c] [kexgexs.c key.c key.h roaming_client.c roaming_common.c schnorr.c] [schnorr.h ssh-dss.c ssh-ecdsa.c ssh-rsa.c sshconnect2.c] Introduce digest API and use it to perform all hashing operations rather than calling OpenSSL EVP_Digest* directly. Will make it easier to build a reduced-feature OpenSSH without OpenSSL in future; feedback, ok markus@
2014-01-10 - guenther@cvs.openbsd.org 2014/01/09 03:26:00Damien Miller
[sftp-common.c] When formating the time for "ls -l"-style output, show dates in the future with the year, and rearrange a comparison to avoid a potentional signed arithmetic overflow that would give the wrong result. ok djm@
2014-01-10 - tedu@cvs.openbsd.org 2014/01/04 17:50:55Damien Miller
[mac.c monitor_mm.c monitor_mm.h xmalloc.c] use standard types and formats for size_t like variables. ok dtucker
2014-01-08 - (djm) [regress/.cvsignore] Ignore regress test droppings; ok dtucker@Damien Miller
2013-12-31 - djm@cvs.openbsd.org 2013/12/30 23:52:28Damien Miller
[auth2-hostbased.c auth2-pubkey.c compat.c compat.h ssh-rsa.c] [sshconnect.c sshconnect2.c sshd.c] refuse RSA keys from old proprietary clients/servers that use the obsolete RSA+MD5 signature scheme. it will still be possible to connect with these clients/servers but only DSA keys will be accepted, and we'll deprecate them entirely in a future release. ok markus@
2013-12-29 - (djm) [regress/Makefile] Add some generated files for cleaningDamien Miller
2013-12-29 - djm@cvs.openbsd.org 2013/12/29 05:57:02Damien Miller
[sshconnect.c] when showing other hostkeys, don't forget Ed25519 keys
2013-12-29 - djm@cvs.openbsd.org 2013/12/29 05:42:16Damien Miller
[ssh.c] don't forget to load Ed25519 certs too