summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2019-11-18upstream: tweak debug messagedjm@openbsd.org
OpenBSD-Commit-ID: 2bf336d3be0b7e3dd97920d7e7471146a281d2b9
2019-11-17upstream: a little debug() in the security key interfacedjm@openbsd.org
OpenBSD-Commit-ID: 4c70300609a5c8b19707207bb7ad4109e963b0e8
2019-11-17upstream: always use ssh-sk-helper, even for the internal USB HIDdjm@openbsd.org
support. This avoid the need for a wpath pledge in ssh-agent. reported by jmc@ OpenBSD-Commit-ID: 19f799c4d020b870741d221335dbfa5e76691c23
2019-11-17upstream: fix typos in sk_enrollmarkus@openbsd.org
OpenBSD-Commit-ID: faa9bf779e008b3e64e2eb1344d9b7d83b3c4487
2019-11-17upstream: double word;jmc@openbsd.org
OpenBSD-Commit-ID: 43d09bafa4ea9002078cb30ca9adc3dcc0b9c2b9
2019-11-17upstream: remove most uses of BN_CTXdjm@openbsd.org
We weren't following the rules re BN_CTX_start/BN_CTX_end and the places we were using it didn't benefit from its use anyway. ok dtucker@ OpenBSD-Commit-ID: ea9ba6c0d2e6f6adfe00b309a8f41842fe12fc7a
2019-11-15Add wrappers for other ultrix headers.Darren Tucker
Wrappers protect against multiple inclusions for headers that don't do it themselves.
2019-11-15Add SSIZE_MAX when we define ssize_t.Darren Tucker
2019-11-15Remove ultrix realpath hack.Darren Tucker
2019-11-15upstream: unshield security key privkey before attempting signaturedjm@openbsd.org
in agent. spotted by dtucker@ OpenBSD-Commit-ID: fb67d451665385b8a0a55371231c50aac67b91d2
2019-11-15upstream: rewrite c99-ismderaadt@openbsd.org
OpenBSD-Commit-ID: d0c70cca29cfa7e6d9f7ec1d6d5dabea112499b3
2019-11-15upstream: only clang understands those new -W optionsderaadt@openbsd.org
OpenBSD-Commit-ID: d9b910e412d139141b072a905e66714870c38ac0
2019-11-15configure flag to built-in security key supportDamien Miller
Require --with-security-key-builtin before enabling the built-in security key support (and consequent dependency on libfido2).
2019-11-15upstream commitDamien Miller
revision 1.48 date: 2019/02/04 16:45:40; author: millert; state: Exp; lines: +16 -17; commitid: cpNtVC7erojNyctw; Make gl_pathc, gl_matchc and gl_offs size_t in glob_t to match POSIX. This requires a libc major version bump. OK deraadt@
2019-11-15upstream commitDamien Miller
revision 1.47 date: 2017/05/08 14:53:27; author: millert; state: Exp; lines: +34 -21; commitid: sYfxfyUHAfarP8sE; Fix exponential CPU use with repeated '*' operators by changing '*' handling to be interative instead of recursive. Fix by Yves Orton, ported to OpenBSD glob.c by Ray Lai. OK tb@
2019-11-15upstream commitDamien Miller
revision 1.46 date: 2015/12/28 22:08:18; author: mmcc; state: Exp; lines: +5 -9; commitid: 0uXuF2O13NH9q2e1; Remove NULL-checks before free() and a few related dead assignments. ok and valuable input from millert@
2019-11-15upstream commitDamien Miller
revision 1.44 date: 2015/09/14 16:09:13; author: tedu; state: Exp; lines: +3 -5; commitid: iWfSX2BIn0sLw62l; remove null check before free. from Michael McConville ok semarie
2019-11-15upstream commitDamien Miller
revision 1.43 date: 2015/06/13 16:57:04; author: deraadt; state: Exp; lines: +4 -4; commitid: zOUKuqWBdOPOz1SZ; in glob() initialize the glob_t before the first failure check. from j@pureftpd.org ok millert stsp
2019-11-15upstream commitDamien Miller
revision 1.42 date: 2015/02/05 12:59:57; author: millert; state: Exp; lines: +2 -1; commitid: DTQbfd4poqBW8iSJ; Include stdint.h, not limits.h to get SIZE_MAX. OK guenther@
2019-11-15upstream commitDamien Miller
revision 1.41 date: 2014/10/08 05:35:27; author: deraadt; state: Exp; lines: +3 -3; commitid: JwTGarRLHQKDgPh2; obvious realloc -> reallocarray conversion
2019-11-15upstream: don't consult dlopen whitelist for internal security keydjm@openbsd.org
provider; spotted by dtucker@ OpenBSD-Commit-ID: bfe5fbd17e4ff95dd85b9212181652b54444192e
2019-11-15upstream commitDamien Miller
revision 1.40 date: 2013/09/30 12:02:34; author: millert; state: Exp; lines: +14 -15; Use PATH_MAX, NAME_MAX and LOGIN_NAME_MAX not MAXPATHNAMELEN, MAXNAMLEN or MAXLOGNAME where possible. OK deraadt@
2019-11-15upstream commitDamien Miller
revision 1.39 date: 2012/01/20 07:09:42; author: tedu; state: Exp; lines: +4 -4; the glob stat limit is way too low. bump to 2048. while here, failed stats should count against the limit too. ok deraadt sthen stsp
2019-11-15upstream: U2F tokens may return FIDO_ERR_USER_PRESENCE_REQUIRED whendjm@openbsd.org
probed to see if they own a key handle. Handle this case so the find_device() look can work for them. Reported by Michael Forney OpenBSD-Commit-ID: 2ccd5b30a6ddfe4dba228b7159bf168601bd9166
2019-11-15Add libfido2 to INSTALL.Darren Tucker
2019-11-15libcrypto is now optional.Darren Tucker
2019-11-15upstream: show the "please touch your security key" notifier whendjm@openbsd.org
using the (default) build-in security key support. OpenBSD-Commit-ID: 4707643aaa7124501d14e92d1364b20f312a6428
2019-11-15upstream: close the "touch your security key" notifier on the errordjm@openbsd.org
path too OpenBSD-Commit-ID: c7628bf80505c1aefbb1de7abc8bb5ee51826829
2019-11-15upstream: correct function name in debug messagedjm@openbsd.org
OpenBSD-Commit-ID: 2482c99d2ce448f39282493050f8a01e3ffc39ab
2019-11-15upstream: follow existing askpass logic for security key notifier:djm@openbsd.org
fall back to _PATH_SSH_ASKPASS_DEFAULT if no $SSH_ASKPASS environment variable is set. OpenBSD-Commit-ID: cda753726b13fb797bf7a9f7a0b3022d9ade4520
2019-11-15upstream: remove debugging goop that snuck in to last commitdjm@openbsd.org
OpenBSD-Commit-ID: 8ea4455a2d9364a0a04f9e4a2cbfa4c9fcefe77e
2019-11-15don't fatal if libfido2 not foundDamien Miller
spotted by dtucker@
2019-11-15correct object dependencyDamien Miller
2019-11-15upstream: directly support U2F/FIDO2 security keys in OpenSSH bydjm@openbsd.org
linking against the (previously external) USB HID middleware. The dlopen() capability still exists for alternate middlewares, e.g. for Bluetooth, NFC and test/debugging. OpenBSD-Commit-ID: 14446cf170ac0351f0d4792ba0bca53024930069
2019-11-15upstream: in order to be able to figure out the number ofmarkus@openbsd.org
signatures left on a shielded key, we need to transfer the number of signatures left from the private to the public key. ok djm@ OpenBSD-Commit-ID: 8a5d0d260aeace47d372695fdae383ce9b962574
2019-11-15upstream: fix check for sig_s; noted by qsa at qualys.commarkus@openbsd.org
OpenBSD-Commit-ID: 34198084e4afb424a859f52c04bb2c9668a52867
2019-11-15upstream: When clients get denied by MaxStartups, send adtucker@openbsd.org
noification prior to the SSH2 protocol banner according to RFC4253 section 4.2. ok djm@ deraadt@ markus@ OpenBSD-Commit-ID: e5dabcb722d54dea18eafb336d50b733af4f9c63
2019-11-15upstream: fix shield/unshield for xmss keys: - in ssh-agent we needmarkus@openbsd.org
to delay the call to shield until we have received key specific options. - when serializing xmss keys for shield we need to deal with all optional components (e.g. state might not be loaded). ok djm@ OpenBSD-Commit-ID: cc2db82524b209468eb176d6b4d6b9486422f41f
2019-11-15upstream: remove size_t gl_pathc < 0 test, it is invalid. thederaadt@openbsd.org
return value from glob() is sufficient. discussed with djm OpenBSD-Commit-ID: c91203322db9caaf7efaf5ae90c794a91070be3c
2019-11-15upstream: stdarg.h required more broadly; ok djmderaadt@openbsd.org
OpenBSD-Commit-ID: b5b15674cde1b54d6dbbae8faf30d47e6e5d6513
2019-11-14Put sshsk_sign call inside ifdef ENABLE_SK.Darren Tucker
Fixes build against OpenSSL configured without ECC.
2019-11-13Remove duplicate __NR_clock_nanosleepDarren Tucker
2019-11-13seccomp: Allow clock_nanosleep() in sandbox.Darren Tucker
seccomp: Allow clock_nanosleep() to make OpenSSH working with latest glibc. Patch from Jakub Jelen <jjelen@redhat.com> via bz #3093.
2019-11-13Include stdarg.h for va_list in xmalloc.h.Darren Tucker
2019-11-13Put headers inside ifdef _AIX.Darren Tucker
Prevents compile errors due to missing definitions (eg va_list) on non-AIX platforms.
2019-11-13Fix comment in match_usergroup_pattern_list.Darren Tucker
Spotted by balu.gajjala@gmail.com via bz#3092.
2019-11-13upstream: allow an empty attestation certificate returned by adjm@openbsd.org
security key enrollment - these are possible for tokens that only offer self- attestation. This also needs support from the middleware. ok markus@ OpenBSD-Commit-ID: 135eeeb937088ef6830a25ca0bbe678dfd2c57cc
2019-11-13upstream: security keys typically need to be tapped/touched indjm@openbsd.org
order to perform a signature operation. Notify the user when this is expected via the TTY (if available) or $SSH_ASKPASS if we can. ok markus@ OpenBSD-Commit-ID: 0ef90a99a85d4a2a07217a58efb4df8444818609
2019-11-13upstream: pass SSH_ASKPASS_PROMPT hint to y/n key confirm toodjm@openbsd.org
OpenBSD-Commit-ID: 08d46712e5e5f1bad0aea68e7717b7bec1ab8959
2019-11-13upstream: dd API for performing one-shot notifications via tty ordjm@openbsd.org
SSH_ASKPASS OpenBSD-Commit-ID: 9484aea33aff5b62ce3642bf259546c7639f23f3
generated by cgit v1.2.3 (git 2.39.1) at 2024-11-05 11:44:30 +0000