summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2014-01-10 - djm@cvs.openbsd.org 2014/01/09 23:26:48Damien Miller
[sshconnect.c sshd.c] ban clients/servers that suffer from SSH_BUG_DERIVEKEY, they are ancient, deranged and might make some attacks on KEX easier; ok markus@
2014-01-10 - djm@cvs.openbsd.org 2014/01/09 23:20:00Damien Miller
[digest.c digest.h hostfile.c kex.c kex.h kexc25519.c kexc25519c.c] [kexc25519s.c kexdh.c kexecdh.c kexecdhc.c kexecdhs.c kexgex.c kexgexc.c] [kexgexs.c key.c key.h roaming_client.c roaming_common.c schnorr.c] [schnorr.h ssh-dss.c ssh-ecdsa.c ssh-rsa.c sshconnect2.c] Introduce digest API and use it to perform all hashing operations rather than calling OpenSSL EVP_Digest* directly. Will make it easier to build a reduced-feature OpenSSH without OpenSSL in future; feedback, ok markus@
2014-01-10 - guenther@cvs.openbsd.org 2014/01/09 03:26:00Damien Miller
[sftp-common.c] When formating the time for "ls -l"-style output, show dates in the future with the year, and rearrange a comparison to avoid a potentional signed arithmetic overflow that would give the wrong result. ok djm@
2014-01-10 - tedu@cvs.openbsd.org 2014/01/04 17:50:55Damien Miller
[mac.c monitor_mm.c monitor_mm.h xmalloc.c] use standard types and formats for size_t like variables. ok dtucker
2014-01-08 - (djm) [regress/.cvsignore] Ignore regress test droppings; ok dtucker@Damien Miller
2013-12-31 - djm@cvs.openbsd.org 2013/12/30 23:52:28Damien Miller
[auth2-hostbased.c auth2-pubkey.c compat.c compat.h ssh-rsa.c] [sshconnect.c sshconnect2.c sshd.c] refuse RSA keys from old proprietary clients/servers that use the obsolete RSA+MD5 signature scheme. it will still be possible to connect with these clients/servers but only DSA keys will be accepted, and we'll deprecate them entirely in a future release. ok markus@
2013-12-29 - (djm) [regress/Makefile] Add some generated files for cleaningDamien Miller
2013-12-29 - djm@cvs.openbsd.org 2013/12/29 05:57:02Damien Miller
[sshconnect.c] when showing other hostkeys, don't forget Ed25519 keys
2013-12-29 - djm@cvs.openbsd.org 2013/12/29 05:42:16Damien Miller
[ssh.c] don't forget to load Ed25519 certs too
2013-12-29 - djm@cvs.openbsd.org 2013/12/29 04:35:50Damien Miller
[authfile.c] don't refuse to load Ed25519 certificates
2013-12-29 - djm@cvs.openbsd.org 2013/12/29 04:29:25Damien Miller
[authfd.c] allow deletion of ed25519 keys from the agent
2013-12-29 - djm@cvs.openbsd.org 2013/12/29 04:20:04Damien Miller
[key.c] to make sure we don't omit any key types as valid CA keys again, factor the valid key type check into a key_type_is_valid_ca() function
2013-12-29 - djm@cvs.openbsd.org 2013/12/29 02:49:52Damien Miller
[key.c] correct comment for key_drop_cert()
2013-12-29 - djm@cvs.openbsd.org 2013/12/29 02:37:04Damien Miller
[key.c] correct comment for key_to_certified()
2013-12-29 - djm@cvs.openbsd.org 2013/12/29 02:28:10Damien Miller
[key.c] allow ed25519 keys to appear as certificate authorities
2013-12-29 - djm@cvs.openbsd.org 2013/12/27 22:37:18Damien Miller
[ssh-rsa.c] correct comment
2013-12-29 - djm@cvs.openbsd.org 2013/12/27 22:30:17Damien Miller
[ssh-dss.c ssh-ecdsa.c ssh-rsa.c] make the original RSA and DSA signing/verification code look more like the ECDSA/Ed25519 ones: use key_type_plain() when checking the key type rather than tediously listing all variants, use __func__ for debug/ error messages
2013-12-29 - tedu@cvs.openbsd.org 2013/12/21 07:10:47Damien Miller
[ssh-keygen.1] small typo
2013-12-29 - djm@cvs.openbsd.org 2013/12/19 22:57:13Damien Miller
[poly1305.c poly1305.h] use full name for author, with his permission
2013-12-29 - djm@cvs.openbsd.org 2013/12/19 01:19:41Damien Miller
[ssh-agent.c] bz#2186: don't crash (NULL deref) when deleting PKCS#11 keys from an agent that has a mix of normal and PKCS#11 keys; fix from jay AT slushpupie.com; ok dtucker
2013-12-29 - djm@cvs.openbsd.org 2013/12/19 01:04:36Damien Miller
[channels.c] bz#2147: fix multiple remote forwardings with dynamically assigned listen ports. In the s->c message to open the channel we were sending zero (the magic number to request a dynamic port) instead of the actual listen port. The client therefore had no way of discriminating between them. Diagnosis and fix by ronf AT timeheart.net
2013-12-29 - djm@cvs.openbsd.org 2013/12/19 00:27:57Damien Miller
[auth-options.c] simplify freeing of source-address certificate restriction
2013-12-29 - dtucker@cvs.openbsd.org 2013/12/19 00:19:12Damien Miller
[serverloop.c] Cast client_alive_interval to u_int64_t before assinging to max_time_milliseconds to avoid potential integer overflow in the timeout. bz#2170, patch from Loganaden Velvindron, ok djm@
2013-12-29 - djm@cvs.openbsd.org 2013/12/19 00:10:30Damien Miller
[ssh-add.c] skip requesting smartcard PIN when removing keys from agent; bz#2187 patch from jay AT slushpupie.com; ok dtucker
2013-12-29 - (djm) [loginrec.c] Check for username truncation when looking up lastlogDamien Miller
entries
2013-12-2120131221Darren Tucker
- (dtucker) [regress/keytype.sh] Actually test ecdsa key types.
2013-12-19 - (dtucker) [auth-pam.c] bz#2163: check return value from pam_get_item().Darren Tucker
Patch from Loganaden Velvindron.
2013-12-19 - (dtucker) [configure.ac] bz#2178: Don't try to use BSM on Solaris versionsDarren Tucker
greater than 11 either rather than just 11. Patch from Tomas Kuthan.
2013-12-18 - markus@cvs.openbsd.org 2013/12/17 10:36:38Damien Miller
[crypto_api.h] I've assempled the header file by cut&pasting from generated headers and the source files.
2013-12-18 - djm@cvs.openbsd.org 2013/12/15 21:42:35Damien Miller
[cipher-chachapoly.c] add some comments and constify a constant
2013-12-18 - pascal@cvs.openbsd.org 2013/12/15 18:17:26Damien Miller
[ssh-add.c] Make ssh-add also add .ssh/id_ed25519; fixes lie in manual page. ok markus@
2013-12-18 - markus@cvs.openbsd.org 2013/12/09 11:08:17Damien Miller
[crypto_api.h] remove unused defines
2013-12-18 - markus@cvs.openbsd.org 2013/12/09 11:03:45Damien Miller
[blocks.c ed25519.c fe25519.c fe25519.h ge25519.c ge25519.h] [ge25519_base.data hash.c sc25519.c sc25519.h verify.c] Add Authors for the public domain ed25519/nacl code. see also http://nacl.cr.yp.to/features.html All of the NaCl software is in the public domain. and http://ed25519.cr.yp.to/software.html The Ed25519 software is in the public domain.
2013-12-18 - dtucker@cvs.openbsd.org 2013/12/08 09:53:27Damien Miller
[sshd_config.5] Use a literal for the default value of KEXAlgorithms. ok deraadt jmc
2013-12-18 - naddy@cvs.openbsd.org 2013/12/07 11:58:46Damien Miller
[ssh-add.1 ssh-agent.1 ssh-keygen.1 ssh-keyscan.1 ssh-keysign.8 ssh.1] [ssh_config.5 sshd.8 sshd_config.5] add missing mentions of ed25519; ok djm@
2013-12-18 - djm@cvs.openbsd.org 2013/12/07 08:08:26Damien Miller
[ssh-keygen.1] document -a and -o wrt new key format
2013-12-08 - (djm) [Makefile.in regress/Makefile regress/agent-ptrace.sh]Damien Miller
[regress/setuid-allowed.c] Check that ssh-agent is not on a no-setuid filesystem before running agent-ptrace.sh; ok dtucker
2013-12-08 - (djm) [openbsd-compat/bsd-setres_id.c] Missing header; from CorinnaDamien Miller
Vinschen
2013-12-07 - (djm) [Makefile.in] PATHSUBS and keygen bits for Ed25519; fromDamien Miller
Loganaden Velvindron @ AfriNIC in bz#2179
2013-12-07 - (djm) [regress/cert-hostkey.sh] Fix merge botchDamien Miller
2013-12-07 - markus@cvs.openbsd.org 2013/12/06 13:52:46Damien Miller
[regress/Makefile regress/agent.sh regress/cert-hostkey.sh] [regress/cert-userkey.sh regress/keytype.sh] test ed25519 support; from djm@
2013-12-07 - (djm) [ed25519.c ssh-ed25519.c openbsd-compat/Makefile.in]Damien Miller
[openbsd-compat/bcrypt_pbkdf.c] Make ed25519/new key format compile on Linux
2013-12-07 - [configure.ac openbsd-compat/Makefile.in openbsd-compat/bcrypt_pbkdf.c]Damien Miller
[openbsd-compat/blf.h openbsd-compat/blowfish.c] [openbsd-compat/openbsd-compat.h] Start at supporting bcrypt_pbkdf in portable.
2013-12-07 - [authfile.c] Conditionalise inclusion of util.hDamien Miller
2013-12-07 - [Makefile.in] Add ed25519 sourcesDamien Miller
2013-12-07 - djm@cvs.openbsd.org 2013/12/07 00:19:15Damien Miller
[key.c] set k->cert = NULL after freeing it
2013-12-07 - [blocks.c ed25519.c fe25519.c fe25519.h ge25519.c ge25519.h]Damien Miller
[ge25519_base.data hash.c sc25519.c sc25519.h verify.c] Fix RCS idents
2013-12-07 - jmc@cvs.openbsd.org 2013/12/06 15:29:07Damien Miller
[sshd.8] missing comma;
2013-12-07 - markus@cvs.openbsd.org 2013/12/06 13:39:49Damien Miller
[authfd.c authfile.c key.c key.h myproposal.h pathnames.h readconf.c] [servconf.c ssh-agent.c ssh-keygen.c ssh-keyscan.1 ssh-keyscan.c] [ssh-keysign.c ssh.c ssh_config.5 sshd.8 sshd.c verify.c ssh-ed25519.c] [sc25519.h sc25519.c hash.c ge25519_base.data ge25519.h ge25519.c] [fe25519.h fe25519.c ed25519.c crypto_api.h blocks.c] support ed25519 keys (hostkeys and user identities) using the public domain ed25519 reference code from SUPERCOP, see http://ed25519.cr.yp.to/software.html feedback, help & ok djm@
2013-12-07 - markus@cvs.openbsd.org 2013/12/06 13:34:54Damien Miller
[authfile.c authfile.h cipher.c cipher.h key.c packet.c ssh-agent.c] [ssh-keygen.c PROTOCOL.key] new private key format, bcrypt as KDF by default; details in PROTOCOL.key; feedback and lots help from djm; ok djm@