summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2019-09-03upstream: sshsig tweaks and improvements from and suggested bydjm@openbsd.org
Markus ok markus/me OpenBSD-Commit-ID: ea4f46ad5a16b27af96e08c4877423918c4253e9
2019-09-03upstream: sshsig: lightweight signature and verification abilitydjm@openbsd.org
for OpenSSH This adds a simple manual signature scheme to OpenSSH. Signatures can be made and verified using ssh-keygen -Y sign|verify Signatures embed the key used to make them. At verification time, this is matched via principal name against an authorized_keys-like list of allowed signers. Mostly by Sebastian Kinne w/ some tweaks by me ok markus@ OpenBSD-Commit-ID: 2ab568e7114c933346616392579d72be65a4b8fb
2019-09-03upstream: move authorized_keys option parsing helpsers to misc.cdjm@openbsd.org
and make them public; ok markus@ OpenBSD-Commit-ID: c18bcb2a687227b3478377c981c2d56af2638ea2
2019-09-03upstream: make get_sigtype public as sshkey_get_sigtype(); okdjm@openbsd.org
markus@ OpenBSD-Commit-ID: 01f8cdbec63350490d2249f41112c5780d1cfbb8
2019-09-03upstream: move advance_past_options to authfile.c and make itdjm@openbsd.org
public; ok markus@ OpenBSD-Commit-ID: edda2fbba2c5b1f48e60f857a2010479e80c5f3c
2019-09-03upstream: move skip_space() to misc.c and make it public; okdjm@openbsd.org
markus@ OpenBSD-Commit-ID: caa77e8a3b210948e29ad3e28c5db00852961eae
2019-09-03upstream: authfd: add function to check if key is in agentdjm@openbsd.org
This commit adds a helper function which allows the caller to check if a given public key is present in ssh-agent. work by Sebastian Kinne; ok markus@ OpenBSD-Commit-ID: d43c5826353e1fdc1af71eb42961b30782c7bd13
2019-09-03upstream: fix memleak in ssh_free_identitylist(); ok markus@djm@openbsd.org
OpenBSD-Commit-ID: aa51f77ae2c5330a1f61b2d22933f24a443f9abf
2019-09-03upstream: factor out confirm_overwrite(); ok markus@djm@openbsd.org
OpenBSD-Commit-ID: 304e95381b39c774c8fced7e5328b106a3ff0400
2019-09-03upstream: constify an argumentdjm@openbsd.org
OpenBSD-Commit-ID: 724bafc9f993746ad4303e95bede2c030de6233b
2019-09-02upstream: downgrade PKCS#11 "provider returned no slots" warningdjm@openbsd.org
from log level error to debug. This is common when attempting to enumerate keys on smartcard readers with no cards plugged in. bz#3058 ok dtucker@ OpenBSD-Commit-ID: bb8839ddeb77c271390488af1b771041d43e49c6
2019-09-02upstream: print comment when printing pubkey from privatedjm@openbsd.org
bz#3052; ok dtucker OpenBSD-Commit-ID: a91b2a8d5f1053d34d7fce44523c53fb534ba914
2019-09-02fixed test in OSX closefrom() replacementDamien Miller
from likan_999.student AT sina.com
2019-09-02retain Solaris PRIV_FILE_LINK_ANY in sftp-serverDamien Miller
Dropping this privilege removes the ability to create hard links to files owned by other users. This is required for the legacy sftp rename operation. bz#3036; approach ok Alex Wilson (the original author of the Solaris sandbox/pledge replacement code)
2019-08-30upstream: Use ed25519 for most hostkey rotation tests since it'sdtucker@openbsd.org
supported even when built without OpenSSL. Use RSA for the secondary type test if supported, otherwise skip it. Fixes this test for !OpenSSL builds. OpenBSD-Regress-ID: 101cb34a84fd974c623bdb2e496f25a6e91be109
2019-08-30upstream: Test did not compile due to missing symbols. Add sourcebluhm@openbsd.org
sshbuf-misc.c to regress as it was done in ssh make file. from Moritz Buhl OpenBSD-Regress-ID: 9e1c23476bb845f3cf3d15d9032da3ed0cb2fcf5
2019-08-30tweak warning flagsDamien Miller
Enable -Wextra if compiler supports it Set -Wno-error=format-truncation if available to prevent expected string truncations in openbsd-compat from breaking -Werror builds
2019-08-30proc_pidinfo()-based closefrom() for OS XDamien Miller
Refactor closefrom() to use a single brute-force close() loop fallback. Based on patch from likan_999.student@sina.com in bz#3049. ok dtucker@
2019-08-29upstream: Call comma-separated lists as such to clarify semanticskn@openbsd.org
Options such as Ciphers take values that may be a list of ciphers; the complete list, not indiviual elements, may be prefixed with a dash or plus character to remove from or append to the default list respectively. Users might read the current text as if each elment took an optional prefix, so tweak the wording from "values" to "list" to prevent such ambiguity for all options supporting this semantics (those that provide a list of available elements via "ssh -Q ..."). Input and OK jmc OpenBSD-Commit-ID: 4fdd175b0e5f5cb10ab3f26ccc38a93bb6515d57
2019-08-29upstream: include sshbuf-misc.c in SRCS_BASEdjm@openbsd.org
OpenBSD-Commit-ID: 99dd10e72c04e93849981d43d64c946619efa474
2019-08-24Fix pasto in fallback code.Darren Tucker
There is no parameter called "pathname", it should simply be "path". bz#3059, patch from samuel at cendio.se.
2019-08-23use SC_ALLOW_ARG_MASK to limit mmap protectionsDamien Miller
Restrict to PROT_(READ|WRITE|NONE), i.e. exclude PROT_EXEC
2019-08-23allow mprotect(2) with PROT_(READ|WRITE|NONE) onlyDamien Miller
Used by some hardened heap allocators. Requested by Yegor Timoshenko in https://github.com/openssh/openssh-portable/pull/142
2019-08-16upstream: switch percent_expand() to use sshbuf instead of a limiteddjm@openbsd.org
fixed buffer; ok markus@ OpenBSD-Commit-ID: 3f9ef20bca5ef5058b48c1cac67c53b9a1d15711
2019-08-09upstream: produce a useful error message if the user's shell is setdjm@openbsd.org
incorrectly during "match exec" processing. bz#2791 reported by Dario Bertini; ok dtucker OpenBSD-Commit-ID: cf9eddd6a6be726cb73bd9c3936f3888cd85c03d
2019-08-09upstream: Change description of TCPKeepAlive from "inactive" todtucker@openbsd.org
"unresponsive" to clarify what it checks for. Patch from jblaine at kickflop.net via github pr#129, ok djm@. OpenBSD-Commit-ID: 3682f8ec7227f5697945daa25d11ce2d933899e9
2019-08-08upstream: Allow the maximimum uint32 value for the argument passed todtucker@openbsd.org
-b which allows better error messages from later validation. bz#3050, ok djm@ OpenBSD-Commit-ID: 10adf6876b2401b3dc02da580ebf67af05861673
2019-08-08upstream: Many key types are supported now, so take care to checknaddy@openbsd.org
the size restrictions and apply the default size only to the matching key type. tweak and ok dtucker@ OpenBSD-Commit-ID: b825de92d79cc4cba19b298c61e99909488ff57e
2019-08-08upstream: Remove now-redundant perm_ok arg sincedtucker@openbsd.org
sshkey_load_private_type will now return SSH_ERR_KEY_BAD_PERMISSIONS in that case. Patch from jitendra.sharma at intel.com, ok djm@ OpenBSD-Commit-ID: 07916a17ed0a252591b71e7fb4be2599cb5b0c77
2019-08-05Fix mem leak in unit test.Darren Tucker
Patch from jitendra.sharma at intel.com.
2019-08-02upstream: fix some memleaks in test_helper codedjm@openbsd.org
bz#3037 from Jitendra Sharma OpenBSD-Regress-ID: 71440fa9186f5842a65ce9a27159385c6cb6f751
2019-08-02upstream: typo; from Christian Hessedjm@openbsd.org
OpenBSD-Commit-ID: 82f6de7438ea7ee5a14f44fdf5058ed57688fdc3
2019-07-30upstream: let sshbuf_find/cmp take a void* for thedjm@openbsd.org
search/comparison argument, instead of a u_char*. Saves callers needing to cast. OpenBSD-Commit-ID: d63b69b7c5dd570963e682f758f5a47b825605ed
2019-07-30upstream: When using a combination of a Yubikey+GnuPG+remotemestre@openbsd.org
forwarding the gpg-agent (and options ControlMaster+RemoteForward in ssh_config(5)) then the codepath taken will call mux_client_request_session -> mm_send_fd -> sendmsg(2). Since sendmsg(2) is not allowed in that codepath then pledge(2) kills the process. The solution is to add "sendfd" to pledge(2), which is not too bad considering a little bit later we reduce pledge(2) to only "stdio proc tty" in that codepath. Problem reported and diff provided by Timothy Brown <tbrown at freeshell.org> OK deraadt@ OpenBSD-Commit-ID: 7ce38b6542bbec00e441595d0a178e970a9472ac
2019-07-30upstream: Fix typo in CASignatureAlgorithms wherein what should bedtucker@openbsd.org
a comma is a dot. Patch from hnj2 via github pr#141. OpenBSD-Commit-ID: 01f5a460438ff1af09aab483c0a70065309445f0
2019-07-29Report success of individual tests as well as all.Darren Tucker
This puts the "all tests passed" message back at the end where the test harnesses can find it.
2019-07-29convert to UTF-8; from Mike FrysingerDamien Miller
2019-07-26upstream: Restrict limit-keytype to types supported by build. Thisdtucker@openbsd.org
means we have to skip a couple tests when only one key type is supported. OpenBSD-Regress-ID: 22d05befb9c7ce21ce8dc22acf1ffe9e2ef2e95e
2019-07-25Remove override disabling DH-GEX.Darren Tucker
The DH-GEX override doesn't work when build without OpenSSL, and we'll prefer curve25519 these days, removing the need for it.
2019-07-25upstream: Only use supported key types during KRL test, preferringdtucker@openbsd.org
ed25519 since it's supported by both OpenSSL and non-OpenSSL builds. OpenBSD-Regress-ID: 9f2bb3eadd50fcc8245b1bd8fd6f0e53602f71aa
2019-07-25upstream: Switch keys-command test from rsa to ed25519 since it'sdtucker@openbsd.org
supported for both OpenSSL and non-OpenSSL builds. OpenBSD-Regress-ID: 174be4be876edd493e4a5c851e5bc579885e7a0a
2019-07-25upstream: Make certificate tests work with the supported keydtucker@openbsd.org
algorithms. Allows tests to pass when built without OpenSSL. OpenBSD-Regress-ID: 617169a6dd9d06db3697a449d9a26c284eca20fc
2019-07-24upstream: Construct list of key types to test based on the typesdtucker@openbsd.org
supported by the binaries. OpenBSD-Regress-ID: fcbd115efacec8ab0ecbdb3faef79ac696cb1d62
2019-07-24upstream: Only use DSA key type in tests if binaries support it.dtucker@openbsd.org
OpenBSD-Regress-ID: 770e31fe61dc33ed8eea9c04ce839b33ddb4dc96
2019-07-24Split test targets further.Darren Tucker
Splits test into file-tests, t-exec, unit and interop-tests and their respective dependencies. Should allow running any set individually without having to build the other dependencies that are not needed for that specific test.
2019-07-24Add lib dependencies for regress binary targets.Darren Tucker
2019-07-24Make "unit" a dependency of "test".Darren Tucker
2019-07-23upstream rev 1.28: fix comment typo.Darren Tucker
2019-07-23Split regress-binaries into two targets.Darren Tucker
Split the binaries for the unit tests out into a regress-unit-binaries target, and add a dependency on it for only the unit tests. This allows us to run the integration tests only ("make t-exec") without building the unit tests, which allows us to run a subset of the tests when building --without-openssl without trying (and failing) to build the unit tests. This means there are two targets for "unit" which I *think* is valid (it works in testing, and makedepend will generate Makefiles of this form)a but I could be wrong.
2019-07-23upstream: Skip DH group generation test if binaries don't supportdtucker@openbsd.org
DH-GEX. OpenBSD-Regress-ID: 7c918230d969ecf7656babd6191a74526bffbffd
generated by cgit v1.2.3 (git 2.39.1) at 2024-11-04 18:08:26 +0000