summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2018-09-26upstream: remove big ugly TODO comment from start of file. Some ofdjm@openbsd.org
the mentioned tasks are obsolete and, of the remainder, most are already captured in PROTOCOL.mux where they better belong OpenBSD-Commit-ID: 16d9d76dee42a5bb651c9d6740f7f0ef68aeb407
2018-09-26upstream: Document mux proxy mode; added by Markus in openssh-7.4djm@openbsd.org
Also add a little bit of information about the overall packet format OpenBSD-Commit-ID: bdb6f6ea8580ef96792e270cae7857786ad84a95
2018-09-26upstream: s/process_mux_master/mux_master_process/ in mux masterdjm@openbsd.org
function names, Gives better symmetry with the existing mux_client_*() names and makes it more obvious when a message comes from the master vs client (they are interleved in ControlMaster=auto mode). no functional change beyond prefixing a could of log messages with __func__ where they were previously lacking. OpenBSD-Commit-ID: b01f7c3fdf92692e1713a822a89dc499333daf75
2018-09-22Remove unused variable in _ssh_compat_fflush.Darren Tucker
2018-09-22Import updated moduli.Darren Tucker
2018-09-21upstream: Allow ssh_config ForwardX11Timeout=0 to disable thedjm@openbsd.org
timeout and allow X11 connections in untrusted mode indefinitely. ok dtucker@ OpenBSD-Commit-ID: ea1ceed3f540b48e5803f933e59a03b20db10c69
2018-09-21upstream: when compiled with GSSAPI support, cache supported methoddjm@openbsd.org
OIDs by calling ssh_gssapi_prepare_supported_oids() regardless of whether GSSAPI authentication is enabled in the main config. This avoids sandbox violations for configurations that enable GSSAPI auth later, e.g. Match user djm GSSAPIAuthentication yes bz#2107; ok dtucker@ OpenBSD-Commit-ID: a5dd42d87c74e27cfb712b15b0f97ab20e0afd1d
2018-09-21upstream: In sshkey_in_file(), ignore keys that are considered fordjm@openbsd.org
being too short (i.e. SSH_ERR_KEY_LENGTH). These keys will not be considered to be "in the file". This allows key revocation lists to contain short keys without the entire revocation list being considered invalid. bz#2897; ok dtucker OpenBSD-Commit-ID: d9f3d857d07194a42ad7e62889a74dc3f9d9924b
2018-09-21upstream: Treat connections with ProxyJump specified the same as onesdjm@openbsd.org
with a ProxyCommand set with regards to hostname canonicalisation (i.e. don't try to canonicalise the hostname unless CanonicalizeHostname is set to 'always'). Patch from Sven Wegener via bz#2896 OpenBSD-Commit-ID: 527ff501cf98bf65fb4b29ed0cb847dda10f4d37
2018-09-21upstream: actually make CASignatureAlgorithms available as a configdjm@openbsd.org
option OpenBSD-Commit-ID: 93fa7ff58314ed7b1ab7744090a6a91232e6ae52
2018-09-21upstream: Import updated moduli.dtucker@openbsd.org
OpenBSD-Commit-ID: 04431e8e7872f49a2129bf080a6b73c19d576d40
2018-09-21upstream: reorder CASignatureAlgorithms, and add them to thejmc@openbsd.org
various -o lists; ok djm OpenBSD-Commit-ID: ecb88baecc3c54988b4d1654446ea033da359288
2018-09-20upstream: fix "ssh -Q sig" to show correct signature algorithm listdjm@openbsd.org
(it was erroneously showing certificate algorithms); prompted by markus@ OpenBSD-Commit-ID: 1cdee002f2f0c21456979deeb887fc889afb154d
2018-09-20upstream: add CASignatureAlgorithms option for the client, allowingdjm@openbsd.org
it to specify which signature algorithms may be used by CAs when signing certificates. Useful if you want to ban RSA/SHA1; ok markus@ OpenBSD-Commit-ID: 9159e5e9f67504829bf53ff222057307a6e3230f
2018-09-20upstream: Add sshd_config CASignatureAlgorithms option to allowdjm@openbsd.org
control over which signature algorithms a CA may use when signing certificates. In particular, this allows a sshd to ban certificates signed with RSA/SHA1. ok markus@ OpenBSD-Commit-ID: b05c86ef8b52b913ed48d54a9b9c1a7714d96bac
2018-09-20upstream: Make "ssh-add -q" do what it says on the tin: silencedjm@openbsd.org
output from successful operations. Based on patch from Thijs van Dijk; ok dtucker@ deraadt@ OpenBSD-Commit-ID: c4f754ecc055c10af166116ce7515104aa8522e1
2018-09-20upstream: When choosing a prime from the moduli file, avoidmillert@openbsd.org
re-using the linenum variable for something that is not a line number to avoid the confusion that resulted in the bug in rev. 1.64. This also lets us pass the actual linenum to parse_prime() so the error messages include the correct line number. OK markus@ some time ago. OpenBSD-Commit-ID: 4d8e5d3e924d6e8eb70053e3defa23c151a00084
2018-09-15Fix openssl-1.1 fallout for --without-openssl.Darren Tucker
ok djm@
2018-09-15add futex(2) syscall to seccomp sandboxDamien Miller
Apparently needed for some glibc/openssl combinations. Patch from Arkadiusz Miśkiewicz
2018-09-15really add source for authopt_fuzz this timeDamien Miller
2018-09-15remove accidentally checked-in authopt_fuzz binaryDamien Miller
2018-09-14upstream: second try, deals properly with missing and private-onlydjm@openbsd.org
Use consistent format in debug log for keys readied, offered and received during public key authentication. This makes it a little easier to see what is going on, as each message now contains (where available) the key filename, its type and fingerprint, and whether the key is hosted in an agent or a token. OpenBSD-Commit-ID: f1c6a8e9cfc4e108c359db77f24f9a40e1e25ea7
2018-09-14fuzzer harness for authorized_keys option parsingDamien Miller
2018-09-14upstream: revert following; deals badly with agent keysdjm@openbsd.org
revision 1.285 date: 2018/09/14 04:17:12; author: djm; state: Exp; lines: +47 -26; commitid: lflGFcNb2X2HebaK; Use consistent format in debug log for keys readied, offered and received during public key authentication. This makes it a little easier to see what is going on, as each message now contains the key filename, its type and fingerprint, and whether the key is hosted in an agent or a token. OpenBSD-Commit-ID: e496bd004e452d4b051f33ed9ae6a54ab918f56d
2018-09-14upstream: garbage-collect moribund ssh_new_private() API.djm@openbsd.org
OpenBSD-Commit-ID: 7c05bf13b094093dfa01848a9306c82eb6e95f6c
2018-09-14upstream: Use consistent format in debug log for keys readied,djm@openbsd.org
offered and received during public key authentication. This makes it a little easier to see what is going on, as each message now contains the key filename, its type and fingerprint, and whether the key is hosted in an agent or a token. OpenBSD-Commit-ID: 2a01d59285a8a7e01185bb0a43316084b4f06a1f
2018-09-14upstream: Fix warnings caused by user_from_uid() and group_from_gid()millert@openbsd.org
now returning const char *. OpenBSD-Commit-ID: b5fe571ea77cfa7b9035062829ab05eb87d7cc6f
2018-09-14allow SIGUSR1 as synonym for SIGINFODamien Miller
Lets users on those unfortunate operating systems that lack SIGINFO still be able to obtain progress information from unit tests :)
2018-09-13add compat headerDamien Miller
2018-09-13upstream: missed a bit of openssl-1.0.x API in this unittestdjm@openbsd.org
OpenBSD-Regress-ID: a73a54d7f7381856a3f3a2d25947bee7a9a5dbc9
2018-09-13upstream: use only openssl-1.1.x API here toodjm@openbsd.org
OpenBSD-Regress-ID: ae877064597c349954b1b443769723563cecbc8f
2018-09-13adapt -portable to OpenSSL 1.1x APIDamien Miller
Polyfill missing API with replacement functions extracted from LibreSSL
2018-09-13forgot to stage these test files in commit d70d061Damien Miller
2018-09-13upstream: hold our collective noses and use the openssl-1.1.x API indjm@openbsd.org
OpenSSH; feedback and ok tb@ jsing@ markus@ OpenBSD-Commit-ID: cacbcac87ce5da0d3ca7ef1b38a6f7fb349e4417
2018-09-12upstream: Include certs with multiple RSA signature variants indjm@openbsd.org
test data Ensure that cert->signature_key is populated correctly OpenBSD-Regress-ID: 56e68f70fe46cb3a193ca207385bdb301fd6603a
2018-09-12upstream: test revocation by explicit hash and by fingerprintdjm@openbsd.org
OpenBSD-Regress-ID: 079c18a9ab9663f4af419327c759fc1e2bc78fd8
2018-09-12upstream: s/sshkey_demote/sshkey_from_private/gdjm@openbsd.org
OpenBSD-Regress-ID: 782bde7407d94a87aa8d1db7c23750e09d4443c4
2018-09-12delete the correct thing; kexfuzz binaryDamien Miller
2018-09-12upstream: fix edit mistake; spotted by jmc@djm@openbsd.org
OpenBSD-Commit-ID: dd724e1c52c9d6084f4cd260ec7e1b2b138261c6
2018-09-12upstream: add SSH_ALLOWED_CA_SIGALGS - the default list ofdjm@openbsd.org
signature algorithms that are allowed for CA signatures. Notably excludes ssh-dsa. ok markus@ OpenBSD-Commit-ID: 1628e4181dc8ab71909378eafe5d06159a22deb4
2018-09-12upstream: add sshkey_check_cert_sigtype() that checks adjm@openbsd.org
cert->signature_type against a supplied whitelist; ok markus OpenBSD-Commit-ID: caadb8073292ed7a9535e5adc067d11d356d9302
2018-09-12upstream: add cert->signature_type field and keep it in sync withdjm@openbsd.org
certificate signature wrt loading and certification operations; ok markus@ OpenBSD-Commit-ID: e8b8b9f76b66707a0cd926109c4383db8f664df3
2018-09-12upstream: Add "ssh -Q sig" to allow listing supported signaturedjm@openbsd.org
algorithms ok markus@ OpenBSD-Commit-ID: 7a8c6eb6c249dc37823ba5081fce64876d10fe2b
2018-09-12upstream: allow key revocation by SHA256 hash and allow ssh-keygendjm@openbsd.org
to create KRLs using SHA256/base64 key fingerprints; ok markus@ OpenBSD-Commit-ID: a0590fd34e7f1141f2873ab3acc57442560e6a94
2018-09-12upstream: log certificate fingerprint in authenticationdjm@openbsd.org
success/failure message (previously we logged only key ID and CA key fingerprint). ok markus@ OpenBSD-Commit-ID: a8ef2d172b7f1ddbcce26d6434b2de6d94f6c05d
2018-09-09upstream: Add FALLTHROUGH comments where appropriate. Patch fromdtucker@openbsd.org
jjelen at redhat via bz#2687. OpenBSD-Commit-ID: c48eb457be697a19d6d2950c6d0879f3ccc851d3
2018-09-09upstream: ssh -MM requires confirmation for all operations thatdjm@openbsd.org
change the multiplexing state, not just new sessions. mention that confirmation is checked via ssh-askpass OpenBSD-Commit-ID: 0f1b45551ebb9cc5c9a4fe54ad3b23ce90f1f5c2
2018-09-09upstream: fix misplaced parenthesis inside if-clause. it's harmlessmestre@openbsd.org
and the only issue is showing an unknown error (since it's not defined) during fatal(), if it ever an error occurs inside that condition. OK deraadt@ markus@ djm@ OpenBSD-Commit-ID: acb0a8e6936bfbe590504752d01d1d251a7101d8
2018-09-09upstream: fix build with DEBUG_PK enabledmestre@openbsd.org
OK dtucker@ OpenBSD-Commit-ID: ec1568cf27726e9638a0415481c20c406e7b441c
2018-09-07Handle ngroups>_SC_NGROUPS_MAX.Darren Tucker
Based on github pull request #99 from Darren Maffat at Oracle: Solaris' getgrouplist considers _SC_NGROUPS_MAX more of a guideline and can return a larger number of groups. In this case, retry getgrouplist with a larger array and defer allocating groups_byname. ok djm@
generated by cgit v1.2.3 (git 2.39.1) at 2024-11-09 20:27:26 +0000