summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2019-09-05upstream: expose allowed_signers options parsing code in header fordjm@openbsd.org
fuzzing rename to make more consistent with philosophically-similar auth options parsing API. OpenBSD-Commit-ID: 0c67600ef04187f98e2912ca57b60c22a8025b7c
2019-09-05upstream: Call comma-separated lists as such to clarify semantics.naddy@openbsd.org
Options such as Ciphers take values that may be a list of ciphers; the complete list, not indiviual elements, may be prefixed with a dash or plus character to remove from or append to the default list, respectively. Users might read the current text as if each elment took an optional prefix, so tweak the wording from "values" to "list" to prevent such ambiguity for all options supporting these semantics. Fix instances missed in first commit. ok jmc@ kn@ OpenBSD-Commit-ID: 7112522430a54fb9f15a7a26d26190ed84d5e417
2019-09-05upstream: tweak previous;jmc@openbsd.org
OpenBSD-Commit-ID: 0abd728aef6b5b35f6db43176aa83b7e3bf3ce27
2019-09-05upstream: repair typo and editing mishapnaddy@openbsd.org
OpenBSD-Commit-ID: d125ab720ca71ccf9baf83e08ddc8c12a328597e
2019-09-05Fuzzer harness for sshsigDamien Miller
2019-09-03oops; missed including the actual fileDamien Miller
2019-09-03portability fixes for sshsigDamien Miller
2019-09-03upstream: regress test for sshsig; feedback and ok markus@djm@openbsd.org
OpenBSD-Regress-ID: 74c0974f2cdae8d9599b9d76a09680bae55d8a8b
2019-09-03upstream: only add plain keys to prevent any certs laying arounddjm@openbsd.org
from confusing the test. OpenBSD-Regress-ID: b8f1508f822bc560b98dea910e61ecd76f34100f
2019-09-03upstream: sshsig tweaks and improvements from and suggested bydjm@openbsd.org
Markus ok markus/me OpenBSD-Commit-ID: ea4f46ad5a16b27af96e08c4877423918c4253e9
2019-09-03upstream: sshsig: lightweight signature and verification abilitydjm@openbsd.org
for OpenSSH This adds a simple manual signature scheme to OpenSSH. Signatures can be made and verified using ssh-keygen -Y sign|verify Signatures embed the key used to make them. At verification time, this is matched via principal name against an authorized_keys-like list of allowed signers. Mostly by Sebastian Kinne w/ some tweaks by me ok markus@ OpenBSD-Commit-ID: 2ab568e7114c933346616392579d72be65a4b8fb
2019-09-03upstream: move authorized_keys option parsing helpsers to misc.cdjm@openbsd.org
and make them public; ok markus@ OpenBSD-Commit-ID: c18bcb2a687227b3478377c981c2d56af2638ea2
2019-09-03upstream: make get_sigtype public as sshkey_get_sigtype(); okdjm@openbsd.org
markus@ OpenBSD-Commit-ID: 01f8cdbec63350490d2249f41112c5780d1cfbb8
2019-09-03upstream: move advance_past_options to authfile.c and make itdjm@openbsd.org
public; ok markus@ OpenBSD-Commit-ID: edda2fbba2c5b1f48e60f857a2010479e80c5f3c
2019-09-03upstream: move skip_space() to misc.c and make it public; okdjm@openbsd.org
markus@ OpenBSD-Commit-ID: caa77e8a3b210948e29ad3e28c5db00852961eae
2019-09-03upstream: authfd: add function to check if key is in agentdjm@openbsd.org
This commit adds a helper function which allows the caller to check if a given public key is present in ssh-agent. work by Sebastian Kinne; ok markus@ OpenBSD-Commit-ID: d43c5826353e1fdc1af71eb42961b30782c7bd13
2019-09-03upstream: fix memleak in ssh_free_identitylist(); ok markus@djm@openbsd.org
OpenBSD-Commit-ID: aa51f77ae2c5330a1f61b2d22933f24a443f9abf
2019-09-03upstream: factor out confirm_overwrite(); ok markus@djm@openbsd.org
OpenBSD-Commit-ID: 304e95381b39c774c8fced7e5328b106a3ff0400
2019-09-03upstream: constify an argumentdjm@openbsd.org
OpenBSD-Commit-ID: 724bafc9f993746ad4303e95bede2c030de6233b
2019-09-02upstream: downgrade PKCS#11 "provider returned no slots" warningdjm@openbsd.org
from log level error to debug. This is common when attempting to enumerate keys on smartcard readers with no cards plugged in. bz#3058 ok dtucker@ OpenBSD-Commit-ID: bb8839ddeb77c271390488af1b771041d43e49c6
2019-09-02upstream: print comment when printing pubkey from privatedjm@openbsd.org
bz#3052; ok dtucker OpenBSD-Commit-ID: a91b2a8d5f1053d34d7fce44523c53fb534ba914
2019-09-02fixed test in OSX closefrom() replacementDamien Miller
from likan_999.student AT sina.com
2019-09-02retain Solaris PRIV_FILE_LINK_ANY in sftp-serverDamien Miller
Dropping this privilege removes the ability to create hard links to files owned by other users. This is required for the legacy sftp rename operation. bz#3036; approach ok Alex Wilson (the original author of the Solaris sandbox/pledge replacement code)
2019-08-30upstream: Use ed25519 for most hostkey rotation tests since it'sdtucker@openbsd.org
supported even when built without OpenSSL. Use RSA for the secondary type test if supported, otherwise skip it. Fixes this test for !OpenSSL builds. OpenBSD-Regress-ID: 101cb34a84fd974c623bdb2e496f25a6e91be109
2019-08-30upstream: Test did not compile due to missing symbols. Add sourcebluhm@openbsd.org
sshbuf-misc.c to regress as it was done in ssh make file. from Moritz Buhl OpenBSD-Regress-ID: 9e1c23476bb845f3cf3d15d9032da3ed0cb2fcf5
2019-08-30tweak warning flagsDamien Miller
Enable -Wextra if compiler supports it Set -Wno-error=format-truncation if available to prevent expected string truncations in openbsd-compat from breaking -Werror builds
2019-08-30proc_pidinfo()-based closefrom() for OS XDamien Miller
Refactor closefrom() to use a single brute-force close() loop fallback. Based on patch from likan_999.student@sina.com in bz#3049. ok dtucker@
2019-08-29upstream: Call comma-separated lists as such to clarify semanticskn@openbsd.org
Options such as Ciphers take values that may be a list of ciphers; the complete list, not indiviual elements, may be prefixed with a dash or plus character to remove from or append to the default list respectively. Users might read the current text as if each elment took an optional prefix, so tweak the wording from "values" to "list" to prevent such ambiguity for all options supporting this semantics (those that provide a list of available elements via "ssh -Q ..."). Input and OK jmc OpenBSD-Commit-ID: 4fdd175b0e5f5cb10ab3f26ccc38a93bb6515d57
2019-08-29upstream: include sshbuf-misc.c in SRCS_BASEdjm@openbsd.org
OpenBSD-Commit-ID: 99dd10e72c04e93849981d43d64c946619efa474
2019-08-24Fix pasto in fallback code.Darren Tucker
There is no parameter called "pathname", it should simply be "path". bz#3059, patch from samuel at cendio.se.
2019-08-23use SC_ALLOW_ARG_MASK to limit mmap protectionsDamien Miller
Restrict to PROT_(READ|WRITE|NONE), i.e. exclude PROT_EXEC
2019-08-23allow mprotect(2) with PROT_(READ|WRITE|NONE) onlyDamien Miller
Used by some hardened heap allocators. Requested by Yegor Timoshenko in https://github.com/openssh/openssh-portable/pull/142
2019-08-16upstream: switch percent_expand() to use sshbuf instead of a limiteddjm@openbsd.org
fixed buffer; ok markus@ OpenBSD-Commit-ID: 3f9ef20bca5ef5058b48c1cac67c53b9a1d15711
2019-08-09upstream: produce a useful error message if the user's shell is setdjm@openbsd.org
incorrectly during "match exec" processing. bz#2791 reported by Dario Bertini; ok dtucker OpenBSD-Commit-ID: cf9eddd6a6be726cb73bd9c3936f3888cd85c03d
2019-08-09upstream: Change description of TCPKeepAlive from "inactive" todtucker@openbsd.org
"unresponsive" to clarify what it checks for. Patch from jblaine at kickflop.net via github pr#129, ok djm@. OpenBSD-Commit-ID: 3682f8ec7227f5697945daa25d11ce2d933899e9
2019-08-08upstream: Allow the maximimum uint32 value for the argument passed todtucker@openbsd.org
-b which allows better error messages from later validation. bz#3050, ok djm@ OpenBSD-Commit-ID: 10adf6876b2401b3dc02da580ebf67af05861673
2019-08-08upstream: Many key types are supported now, so take care to checknaddy@openbsd.org
the size restrictions and apply the default size only to the matching key type. tweak and ok dtucker@ OpenBSD-Commit-ID: b825de92d79cc4cba19b298c61e99909488ff57e
2019-08-08upstream: Remove now-redundant perm_ok arg sincedtucker@openbsd.org
sshkey_load_private_type will now return SSH_ERR_KEY_BAD_PERMISSIONS in that case. Patch from jitendra.sharma at intel.com, ok djm@ OpenBSD-Commit-ID: 07916a17ed0a252591b71e7fb4be2599cb5b0c77
2019-08-05Fix mem leak in unit test.Darren Tucker
Patch from jitendra.sharma at intel.com.
2019-08-02upstream: fix some memleaks in test_helper codedjm@openbsd.org
bz#3037 from Jitendra Sharma OpenBSD-Regress-ID: 71440fa9186f5842a65ce9a27159385c6cb6f751
2019-08-02upstream: typo; from Christian Hessedjm@openbsd.org
OpenBSD-Commit-ID: 82f6de7438ea7ee5a14f44fdf5058ed57688fdc3
2019-07-30upstream: let sshbuf_find/cmp take a void* for thedjm@openbsd.org
search/comparison argument, instead of a u_char*. Saves callers needing to cast. OpenBSD-Commit-ID: d63b69b7c5dd570963e682f758f5a47b825605ed
2019-07-30upstream: When using a combination of a Yubikey+GnuPG+remotemestre@openbsd.org
forwarding the gpg-agent (and options ControlMaster+RemoteForward in ssh_config(5)) then the codepath taken will call mux_client_request_session -> mm_send_fd -> sendmsg(2). Since sendmsg(2) is not allowed in that codepath then pledge(2) kills the process. The solution is to add "sendfd" to pledge(2), which is not too bad considering a little bit later we reduce pledge(2) to only "stdio proc tty" in that codepath. Problem reported and diff provided by Timothy Brown <tbrown at freeshell.org> OK deraadt@ OpenBSD-Commit-ID: 7ce38b6542bbec00e441595d0a178e970a9472ac
2019-07-30upstream: Fix typo in CASignatureAlgorithms wherein what should bedtucker@openbsd.org
a comma is a dot. Patch from hnj2 via github pr#141. OpenBSD-Commit-ID: 01f5a460438ff1af09aab483c0a70065309445f0
2019-07-29Report success of individual tests as well as all.Darren Tucker
This puts the "all tests passed" message back at the end where the test harnesses can find it.
2019-07-29convert to UTF-8; from Mike FrysingerDamien Miller
2019-07-26upstream: Restrict limit-keytype to types supported by build. Thisdtucker@openbsd.org
means we have to skip a couple tests when only one key type is supported. OpenBSD-Regress-ID: 22d05befb9c7ce21ce8dc22acf1ffe9e2ef2e95e
2019-07-25Remove override disabling DH-GEX.Darren Tucker
The DH-GEX override doesn't work when build without OpenSSL, and we'll prefer curve25519 these days, removing the need for it.
2019-07-25upstream: Only use supported key types during KRL test, preferringdtucker@openbsd.org
ed25519 since it's supported by both OpenSSL and non-OpenSSL builds. OpenBSD-Regress-ID: 9f2bb3eadd50fcc8245b1bd8fd6f0e53602f71aa
2019-07-25upstream: Switch keys-command test from rsa to ed25519 since it'sdtucker@openbsd.org
supported for both OpenSSL and non-OpenSSL builds. OpenBSD-Regress-ID: 174be4be876edd493e4a5c851e5bc579885e7a0a
generated by cgit v1.2.3 (git 2.39.1) at 2024-07-08 00:32:36 +0000