summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2019-09-05upstream: if a PKCS#11 token returns no keys then try to login anddjm@openbsd.org
refetch them. Based on patch from Jakub Jelen; bz#2430 ok markus@ OpenBSD-Commit-ID: ab53bd6ddd54dd09e54a8bfbed1a984496f08b43
2019-09-05upstream: sprinkle in some explicit errors here, otherwise thedjm@openbsd.org
percolate all the way up to dispatch_run_fatal() and lose all meaninful context to help with bz#3063; ok dtucker@ OpenBSD-Commit-ID: 5b2da83bb1c4a3471444b7910b2120ae36438a0a
2019-09-05upstream: only send ext_info for KEX_INITIAL; bz#2929 ok dtuckerdjm@openbsd.org
OpenBSD-Commit-ID: 00f5c6062f6863769f5447c6346f78c05d2e4a63
2019-09-05upstream: macro fix; ok djmjmc@openbsd.org
OpenBSD-Commit-ID: e891dd6c7996114cb32f0924cb7898ab55efde6e
2019-09-05update fuzzing makefile to more recent clangDamien Miller
2019-09-05fuzzer for sshsig allowed_signers option parsingDamien Miller
2019-09-05upstream: memleak on error path; found by libfuzzerdjm@openbsd.org
OpenBSD-Commit-ID: 34d44cb0fb5bdb5fcbc6b02b804e71b20a7a5fc7
2019-09-05upstream: expose allowed_signers options parsing code in header fordjm@openbsd.org
fuzzing rename to make more consistent with philosophically-similar auth options parsing API. OpenBSD-Commit-ID: 0c67600ef04187f98e2912ca57b60c22a8025b7c
2019-09-05upstream: Call comma-separated lists as such to clarify semantics.naddy@openbsd.org
Options such as Ciphers take values that may be a list of ciphers; the complete list, not indiviual elements, may be prefixed with a dash or plus character to remove from or append to the default list, respectively. Users might read the current text as if each elment took an optional prefix, so tweak the wording from "values" to "list" to prevent such ambiguity for all options supporting these semantics. Fix instances missed in first commit. ok jmc@ kn@ OpenBSD-Commit-ID: 7112522430a54fb9f15a7a26d26190ed84d5e417
2019-09-05upstream: tweak previous;jmc@openbsd.org
OpenBSD-Commit-ID: 0abd728aef6b5b35f6db43176aa83b7e3bf3ce27
2019-09-05upstream: repair typo and editing mishapnaddy@openbsd.org
OpenBSD-Commit-ID: d125ab720ca71ccf9baf83e08ddc8c12a328597e
2019-09-05Fuzzer harness for sshsigDamien Miller
2019-09-03oops; missed including the actual fileDamien Miller
2019-09-03portability fixes for sshsigDamien Miller
2019-09-03upstream: regress test for sshsig; feedback and ok markus@djm@openbsd.org
OpenBSD-Regress-ID: 74c0974f2cdae8d9599b9d76a09680bae55d8a8b
2019-09-03upstream: only add plain keys to prevent any certs laying arounddjm@openbsd.org
from confusing the test. OpenBSD-Regress-ID: b8f1508f822bc560b98dea910e61ecd76f34100f
2019-09-03upstream: sshsig tweaks and improvements from and suggested bydjm@openbsd.org
Markus ok markus/me OpenBSD-Commit-ID: ea4f46ad5a16b27af96e08c4877423918c4253e9
2019-09-03upstream: sshsig: lightweight signature and verification abilitydjm@openbsd.org
for OpenSSH This adds a simple manual signature scheme to OpenSSH. Signatures can be made and verified using ssh-keygen -Y sign|verify Signatures embed the key used to make them. At verification time, this is matched via principal name against an authorized_keys-like list of allowed signers. Mostly by Sebastian Kinne w/ some tweaks by me ok markus@ OpenBSD-Commit-ID: 2ab568e7114c933346616392579d72be65a4b8fb
2019-09-03upstream: move authorized_keys option parsing helpsers to misc.cdjm@openbsd.org
and make them public; ok markus@ OpenBSD-Commit-ID: c18bcb2a687227b3478377c981c2d56af2638ea2
2019-09-03upstream: make get_sigtype public as sshkey_get_sigtype(); okdjm@openbsd.org
markus@ OpenBSD-Commit-ID: 01f8cdbec63350490d2249f41112c5780d1cfbb8
2019-09-03upstream: move advance_past_options to authfile.c and make itdjm@openbsd.org
public; ok markus@ OpenBSD-Commit-ID: edda2fbba2c5b1f48e60f857a2010479e80c5f3c
2019-09-03upstream: move skip_space() to misc.c and make it public; okdjm@openbsd.org
markus@ OpenBSD-Commit-ID: caa77e8a3b210948e29ad3e28c5db00852961eae
2019-09-03upstream: authfd: add function to check if key is in agentdjm@openbsd.org
This commit adds a helper function which allows the caller to check if a given public key is present in ssh-agent. work by Sebastian Kinne; ok markus@ OpenBSD-Commit-ID: d43c5826353e1fdc1af71eb42961b30782c7bd13
2019-09-03upstream: fix memleak in ssh_free_identitylist(); ok markus@djm@openbsd.org
OpenBSD-Commit-ID: aa51f77ae2c5330a1f61b2d22933f24a443f9abf
2019-09-03upstream: factor out confirm_overwrite(); ok markus@djm@openbsd.org
OpenBSD-Commit-ID: 304e95381b39c774c8fced7e5328b106a3ff0400
2019-09-03upstream: constify an argumentdjm@openbsd.org
OpenBSD-Commit-ID: 724bafc9f993746ad4303e95bede2c030de6233b
2019-09-02upstream: downgrade PKCS#11 "provider returned no slots" warningdjm@openbsd.org
from log level error to debug. This is common when attempting to enumerate keys on smartcard readers with no cards plugged in. bz#3058 ok dtucker@ OpenBSD-Commit-ID: bb8839ddeb77c271390488af1b771041d43e49c6
2019-09-02upstream: print comment when printing pubkey from privatedjm@openbsd.org
bz#3052; ok dtucker OpenBSD-Commit-ID: a91b2a8d5f1053d34d7fce44523c53fb534ba914
2019-09-02fixed test in OSX closefrom() replacementDamien Miller
from likan_999.student AT sina.com
2019-09-02retain Solaris PRIV_FILE_LINK_ANY in sftp-serverDamien Miller
Dropping this privilege removes the ability to create hard links to files owned by other users. This is required for the legacy sftp rename operation. bz#3036; approach ok Alex Wilson (the original author of the Solaris sandbox/pledge replacement code)
2019-08-30upstream: Use ed25519 for most hostkey rotation tests since it'sdtucker@openbsd.org
supported even when built without OpenSSL. Use RSA for the secondary type test if supported, otherwise skip it. Fixes this test for !OpenSSL builds. OpenBSD-Regress-ID: 101cb34a84fd974c623bdb2e496f25a6e91be109
2019-08-30upstream: Test did not compile due to missing symbols. Add sourcebluhm@openbsd.org
sshbuf-misc.c to regress as it was done in ssh make file. from Moritz Buhl OpenBSD-Regress-ID: 9e1c23476bb845f3cf3d15d9032da3ed0cb2fcf5
2019-08-30tweak warning flagsDamien Miller
Enable -Wextra if compiler supports it Set -Wno-error=format-truncation if available to prevent expected string truncations in openbsd-compat from breaking -Werror builds
2019-08-30proc_pidinfo()-based closefrom() for OS XDamien Miller
Refactor closefrom() to use a single brute-force close() loop fallback. Based on patch from likan_999.student@sina.com in bz#3049. ok dtucker@
2019-08-29upstream: Call comma-separated lists as such to clarify semanticskn@openbsd.org
Options such as Ciphers take values that may be a list of ciphers; the complete list, not indiviual elements, may be prefixed with a dash or plus character to remove from or append to the default list respectively. Users might read the current text as if each elment took an optional prefix, so tweak the wording from "values" to "list" to prevent such ambiguity for all options supporting this semantics (those that provide a list of available elements via "ssh -Q ..."). Input and OK jmc OpenBSD-Commit-ID: 4fdd175b0e5f5cb10ab3f26ccc38a93bb6515d57
2019-08-29upstream: include sshbuf-misc.c in SRCS_BASEdjm@openbsd.org
OpenBSD-Commit-ID: 99dd10e72c04e93849981d43d64c946619efa474
2019-08-28runit: Correct typoDaniel Kahn Gillmor
The name of the file that we check when sshd is supposed to be down is correct in the script, but not in the comments :) Signed-off-by: Daniel Kahn Gillmor <dkg@fifthhorseman.net>
2019-08-28releasing package openssh version 1:8.0p1-6Colin Watson
2019-08-28Only run dh_runit on openssh-serverColin Watson
Closes: #935936
2019-08-27releasing package openssh version 1:8.0p1-5Colin Watson
2019-08-24Fix pasto in fallback code.Darren Tucker
There is no parameter called "pathname", it should simply be "path". bz#3059, patch from samuel at cendio.se.
2019-08-23use SC_ALLOW_ARG_MASK to limit mmap protectionsDamien Miller
Restrict to PROT_(READ|WRITE|NONE), i.e. exclude PROT_EXEC
2019-08-23allow mprotect(2) with PROT_(READ|WRITE|NONE) onlyDamien Miller
Used by some hardened heap allocators. Requested by Yegor Timoshenko in https://github.com/openssh/openssh-portable/pull/142
2019-08-16upstream: switch percent_expand() to use sshbuf instead of a limiteddjm@openbsd.org
fixed buffer; ok markus@ OpenBSD-Commit-ID: 3f9ef20bca5ef5058b48c1cac67c53b9a1d15711
2019-08-13Add a runscript for runitColin Watson
Changelog entry for Lorenzo Puliti's recently-merged commit. Closes: #933999
2019-08-13Consistent whitespaceColin Watson
2019-08-13Merge branch 'runit' into 'master'Colin Watson
Please add a runscript for runit See merge request ssh-team/openssh!7
2019-08-12Add a runscript for runitLorenzo Puliti
Add a 'run' and a 'finish' script for runit init system; rely on dh-runit for maintscript code.
2019-08-09upstream: produce a useful error message if the user's shell is setdjm@openbsd.org
incorrectly during "match exec" processing. bz#2791 reported by Dario Bertini; ok dtucker OpenBSD-Commit-ID: cf9eddd6a6be726cb73bd9c3936f3888cd85c03d
2019-08-09upstream: Change description of TCPKeepAlive from "inactive" todtucker@openbsd.org
"unresponsive" to clarify what it checks for. Patch from jblaine at kickflop.net via github pr#129, ok djm@. OpenBSD-Commit-ID: 3682f8ec7227f5697945daa25d11ce2d933899e9
generated by cgit v1.2.3 (git 2.39.1) at 2024-08-27 10:11:10 +0000