summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2009-01-21 - (djm) [uidswap.c] bz#1412: Support >16 supplemental groups in OS X.Damien Miller
Patch based on one from vgiffin AT apple.com; ok dtucker@
2009-01-07 - (tim) [configure.ac] Move check_for_libcrypt_later=1 in *-*-sysv5*) section.Tim Rice
OpenServer 6 doesn't need libcrypt.
2009-01-07 - (tim) [configure.ac defines.h openbsd-compat/port-uw.cTim Rice
openbsd-compat/xcrypt.c] Add SECUREWARE support to OpenServer 6 SVR5 ABI. OK djm@ dtucker@
2008-12-09 - djm@cvs.openbsd.org 2008/12/09 03:02:37Damien Miller
[sftp.1 sftp.c] correct sftp(1) and corresponding usage syntax; bz#1518 patch from imorgan AT nas.nasa.gov; ok deraadt@ improved diff jmc@
2008-12-09 - djm@cvs.openbsd.org 2008/12/09 02:58:16Damien Miller
[readconf.c] don't leave junk (free'd) pointers around in Forward *fwd argument on failure; avoids double-free in ~C -L handler when given an invalid forwarding specification; bz#1539 report from adejong AT debian.org via Colin Watson; ok markus@ dtucker@
2008-12-09 - djm@cvs.openbsd.org 2008/12/09 02:39:59Damien Miller
[sftp.c] Deal correctly with failures in remote stat() operation in sftp, correcting fail-on-error behaviour in batchmode. bz#1541 report and fix from anedvedicky AT gmail.com; ok markus@
2008-12-09 - djm@cvs.openbsd.org 2008/12/09 02:38:18Damien Miller
[clientloop.c] The ~C escape handler does not work correctly for multiplexed sessions - it opens a commandline on the master session, instead of on the slave that requested it. Disable it on slave sessions until such time as it is fixed; bz#1543 report from Adrian Bridgett via Colin Watson ok markus@
2008-12-08 - markus@cvs.openbsd.org 2008/12/02 19:09:38Damien Miller
[channels.c] s/remote_id/id/ to be more consistent with other code; ok djm@
2008-12-08 - markus@cvs.openbsd.org 2008/12/02 19:08:59Damien Miller
[serverloop.c] backout 1.149, since it's not necessary and openssh clients send broken CHANNEL_FAILURE/SUCCESS messages since about 2004; ok djm@
2008-12-08 - markus@cvs.openbsd.org 2008/12/02 19:01:07Damien Miller
[clientloop.c] we have to use the recipient's channel number (RFC 4254) for SSH2_MSG_CHANNEL_SUCCESS/SSH2_MSG_CHANNEL_FAILURE messages, otherwise we trigger 'Non-public channel' error messages on sshd systems with clientkeepalive enabled; noticed by sturm; ok djm;
2008-12-08 - (djm) [configure.ac] bz#1538: better test for ProPolice/SSP: actuallyDamien Miller
use some stack in main(). Report and suggested fix from vapier AT gentoo.org
2008-12-01 - dtucker@cvs.openbsd.org 2008/11/30 11:59:26Darren Tucker
[monitor_fdpass.c] Retry sendmsg/recvmsg on EAGAIN and EINTR; ok djm@
2008-12-01 - markus@cvs.openbsd.org 2008/11/21 15:47:38Darren Tucker
[packet.c] packet_disconnect() on padding error, too. should reduce the success probability for the CPNI-957037 Plaintext Recovery Attack to 2^-18 ok djm@
2008-12-01 - (dtucker) [contrib/cygwin/{Makefile,ssh-host-config}] Add new doc filesDarren Tucker
and tweak the is-sshd-running check in ssh-host-config. Patch from vinschen at redhat com.
2008-11-23cmsg thing was originally spotted by desDarren Tucker
2008-11-23 - (dtucker) [monitor_fdpass.c] Reduce diff vs OpenBSD by moving someDarren Tucker
declarations, removing an unnecessary union member and adding whitespace. ok djm some time ago.
2008-11-18 - (tim) [addrmatch.c configure.ac] Some platforms do not have sin6_scope_idTim Rice
member of sockaddr_in6. Also reported in Bug 1491 by David Leonard. OK and feedback by djm@
2008-11-19test commitDamien Miller
2008-11-11 - djm@cvs.openbsd.org 2008/11/10 02:06:35Darren Tucker
[regress/putty-ciphers.sh] PuTTY supports AES CTR modes, so interop test against them too
2008-11-11 - stevesk@cvs.openbsd.org 2008/11/11 03:55:11Darren Tucker
[channels.c] for sshd -T print 'permitopen any' vs. 'permitopen' for case of no permitopen's; ok and input dtucker@
2008-11-11 - stevesk@cvs.openbsd.org 2008/11/11 02:58:09Darren Tucker
[servconf.c] USE_AFS not referenced so remove #ifdef. fixes sshd -T not printing kerberosgetafstoken. ok dtucker@ (Id sync only, we still want the ifdef in portable)
2008-11-11 - tobias@cvs.openbsd.org 2008/11/09 12:34:47Darren Tucker
[session.c ssh.1] typo fixed (overriden -> overridden) ok espie, jmc
2008-11-11 - dtucker@cvs.openbsd.org 2008/11/07 23:34:48Darren Tucker
[auth2-jpake.c] Move JPAKE define to make life easier for portable. ok djm@
2008-11-11 - stevesk@cvs.openbsd.org 2008/11/07 18:50:18Darren Tucker
[nchan.c] add space to some log/debug messages for readability; ok djm@ markus@
2008-11-11 - stevesk@cvs.openbsd.org 2008/11/07 00:42:12Darren Tucker
[ssh-keygen.c] spelling/typo in comment
2008-11-11 - (dtucker) OpenBSD CVS SyncDarren Tucker
- jmc@cvs.openbsd.org 2008/11/05 11:22:54 [servconf.c] passord -> password; fixes user/5975 from Rene Maroufi
2008-11-05 - stevesk@cvs.openbsd.org 2008/11/05 03:23:09Damien Miller
[clientloop.c ssh.1] add dynamic forward escape command line; ok djm@
2008-11-05 - stevesk@cvs.openbsd.org 2008/11/04 19:18:00Damien Miller
[readconf.c] because parse_forward() is now used to parse all forward types (DLR), and it malloc's space for host variables, we don't need to malloc here. fixes small memory leaks. previously dynamic forwards were not parsed in parse_forward() and space was not malloc'd in that case. ok djm@
2008-11-05 - djm@cvs.openbsd.org 2008/11/04 08:22:13Damien Miller
[auth.h auth2.c monitor.c monitor.h monitor_wrap.c monitor_wrap.h] [readconf.c readconf.h servconf.c servconf.h ssh2.h ssh_config.5] [sshconnect2.c sshd_config.5 jpake.c jpake.h schnorr.c auth2-jpake.c] [Makefile.in] Add support for an experimental zero-knowledge password authentication method using the J-PAKE protocol described in F. Hao, P. Ryan, "Password Authenticated Key Exchange by Juggling", 16th Workshop on Security Protocols, Cambridge, April 2008. This method allows password-based authentication without exposing the password to the server. Instead, the client and server exchange cryptographic proofs to demonstrate of knowledge of the password while revealing nothing useful to an attacker or compromised endpoint. This is experimental, work-in-progress code and is presently compiled-time disabled (turn on -DJPAKE in Makefile.inc). "just commit it. It isn't too intrusive." deraadt@
2008-11-05 - djm@cvs.openbsd.org 2008/11/04 07:58:09Damien Miller
[auth.c] need unistd.h for close() prototype (ID sync only)
2008-11-05 - OpenBSD CVS SyncDamien Miller
- djm@cvs.openbsd.org 2008/11/03 08:59:41 [servconf.c] include MaxSessions in sshd -T output; patch from imorgan AT nas.nasa.gov
2008-11-03 - (djm) [contrib/sshd.pam.generic contrib/caldera/sshd.pam]Damien Miller
[contrib/redhat/sshd.pam] Move pam_nologin to account group from incorrect auth group in example files; patch from imorgan AT nas.nasa.gov
2008-11-03 - (djm) [contrib/caldera/ssh-host-keygen contrib/suse/rc.sshd]Damien Miller
Make example scripts generate keys with default sizes rather than fixed, non-default 1024 bits; patch from imorgan AT nas.nasa.gov
2008-11-03 - stevesk@cvs.openbsd.org 2008/11/03 02:44:41Damien Miller
[readconf.c] fix comment
2008-11-03 - stevesk@cvs.openbsd.org 2008/11/03 01:07:02Damien Miller
[readconf.c] remove valueless comment
2008-11-03 - stevesk@cvs.openbsd.org 2008/11/02 00:16:16Damien Miller
[ttymodes.c] protocol 2 tty modes support is now 7.5 years old so remove these debug3()s; ok deraadt@
2008-11-03 - stevesk@cvs.openbsd.org 2008/11/01 17:40:33Damien Miller
[clientloop.c readconf.c readconf.h ssh.c] merge dynamic forward parsing into parse_forward(); 'i think this is OK' djm@
2008-11-03 - sobrado@cvs.openbsd.org 2008/11/01 11:14:36Damien Miller
[ssh-keyscan.1 ssh-keyscan.c] the ellipsis is not an optional argument; while here, improve spacing.
2008-11-03 - stevesk@cvs.openbsd.org 2008/11/01 06:43:33Damien Miller
[channels.c] fix some typos in log messages; ok djm@
2008-11-03 - djm@cvs.openbsd.org 2008/11/01 04:50:08Damien Miller
[sshconnect2.c] sprinkle ARGSUSED on dispatch handlers nuke stale unusued prototype
2008-11-03 - stevesk@cvs.openbsd.org 2008/10/31 15:05:34Damien Miller
[dispatch.c] remove unused #define DISPATCH_MIN; ok markus@
2008-11-03 - stevesk@cvs.openbsd.org 2008/10/30 19:31:16Damien Miller
[clientloop.c sshd.c] don't need to #include "monitor_fdpass.h"
2008-11-03 - stevesk@cvs.openbsd.org 2008/10/17 18:36:24Damien Miller
[ssh_config.5] correct and clarify VisualHostKey; ok jmc@
2008-11-03 - stevesk@cvs.openbsd.org 2008/10/14 18:11:33Damien Miller
[sshconnect.c] use #define ROQUIET here; no binary change. ok dtucker@
2008-11-03 - stevesk@cvs.openbsd.org 2008/10/10 16:43:27Damien Miller
[ssh_config.5] use 'Privileged ports can be forwarded only when logging in as root on the remote machine.' for RemoteForward just like ssh.1 -R. ok djm@ jmc@
2008-11-03 - stevesk@cvs.openbsd.org 2008/10/10 05:00:12Damien Miller
[key.c] typo in error message; ok djm@
2008-11-03 - stevesk@cvs.openbsd.org 2008/10/10 04:55:16Damien Miller
[scp.c] spelling in comment; ok djm@
2008-11-03 - jmc@cvs.openbsd.org 2008/10/09 06:54:22Damien Miller
[ssh.c] add -y to usage();
2008-11-03 - djm@cvs.openbsd.org 2008/10/09 03:50:54Damien Miller
[servconf.c sshd_config.5] support setting PermitEmptyPasswords in a Match block requested in PR3891; ok dtucker@
2008-11-03 - djm@cvs.openbsd.org 2008/10/08 23:34:03Damien Miller
[ssh.1 ssh.c] Add -y option to force logging via syslog rather than stderr. Useful for daemonised ssh connection (ssh -f). Patch originally from and ok'd by markus@