| Age | Commit message (Collapse) | Author |
|---|
|
[scp.1 ssh-add.1 ssh-keygen.1 ssh.1 ssh_config.5 sshd.8 sshd_config.5]
knock out some "-*- nroff -*-" lines;
|
|
[authfile.c key.c key.h ssh-keygen.c]
fix a possible NULL deref on loading a corrupt ECDH key
store ECDH group information in private keys files as "named groups"
rather than as a set of explicit group parameters (by setting
the OPENSSL_EC_NAMED_CURVE flag). This makes for shorter key files and
retrieves the group's OpenSSL NID that we need for various things.
|
|
[regress/Makefile regress/kextype.sh]
regress test for each of the key exchange algorithms that we support
|
|
native one.
|
|
1.12 to unbreak Solaris build.
ok djm@
|
|
have it.
|
|
which don't have ECC support in libcrypto.
|
|
which don't have ECC support in libcrypto.
|
|
[sftp.c]
escape '[' in filename tab-completion; fix a type while there.
ok djm@
|
|
|
|
[regress/cert-hostkey.sh regress/cert-userkey.sh]
tests for ECDSA certificates
|
|
- dtucker@cvs.openbsd.org 2010/10/12 02:22:24
[mux.c]
Typo in confirmation message. bz#1827, patch from imorgan at nas nasa gov
|
|
|
|
bz#1825, reported by foo AT mailinator.com
|
|
dr AT vasco.com
|
|
|
|
|
|
|
|
[sshconnect.c]
swapped args to kill(2)
|
|
[clientloop.c ssh.c sshconnect.c sshconnect.h]
kill proxy command on fatal() (we already kill it on clean exit);
ok markus@
|
|
[sftp.c sshconnect.c]
use default shell /bin/sh if $SHELL is ""; ok markus@
|
|
[cipher-3des1.c cipher-bf1.c cipher-ctr.c openbsd-compat/openssl-compat.h]
adapt to API changes in openssl-1.0.0a
NB. contains compat code to select correct API for older OpenSSL
|
|
[servconf.c]
prevent free() of string in .rodata when overriding AuthorizedKeys in
a Match block; patch from rein AT basefarm.no
|
|
[sftp.c]
when performing an "ls" in columnated (short) mode, only call
ioctl(TIOCGWINSZ) once to get the window width instead of per-
filename
|
|
[sftp.c configure.ac openbsd-compat/glob.c openbsd-compat/glob.h]
make use of new glob(3) GLOB_KEEPSTAT extension to save extra server
rountrips to fetch per-file stat(2) information.
NB. update openbsd-compat/ glob(3) implementation from OpenBSD libc to
match.
|
|
[misc.c misc.h configure.ac openbsd-compat/openbsd-compat.h]
[openbsd-compat/timingsafe_bcmp.c]
Add timingsafe_bcmp(3) to libc, mention that it's already in the
kernel in kern(9), and remove it from OpenSSH.
ok deraadt@, djm@
NB. re-added under openbsd-compat/ for portable OpenSSH
|
|
[scp.1 sftp.1]
add KexAlgorithms to the -o list;
|
|
[sftp.c]
add [-l limit] to usage();
|
|
[atomicio.c atomicio.h misc.c misc.h scp.c sftp-client.c]
[sftp-client.h sftp.1 sftp.c]
add an option per-read/write callback to atomicio
factor out bandwidth limiting code from scp(1) into a generic bandwidth
limiter that can be attached using the atomicio callback mechanism
add a bandwidth limit option to sftp(1) using the above
"very nice" markus@
|
|
[ssh.1 ssh_config.5]
ssh.1: add kexalgorithms to the -o list
ssh_config.5: format the kexalgorithms in a more consistent
(prettier!) way
ok djm
|
|
[kex.c kex.h kexecdh.c kexecdhc.c kexecdhs.c readconf.c readconf.h]
[servconf.c servconf.h ssh_config.5 sshconnect2.c sshd.c sshd_config.5]
add a KexAlgorithms knob to the client and server configuration to allow
selection of which key exchange methods are used by ssh(1) and sshd(8)
and their order of preference.
ok markus@
|
|
[mux.c]
"atomically" create the listening mux socket by binding it on a temorary
name and then linking it into position after listen() has succeeded.
this allows the mux clients to determine that the server socket is
either ready or stale without races. stale server sockets are now
automatically removed
ok deraadt
|
|
[jpake.c]
missing #include
|
|
[jpake.c schnorr.c]
check that received values are smaller than the group size in the
disabled and unfinished J-PAKE code.
avoids catastrophic security failure found by Sebastien Martini
|
|
[ssh.c]
install a SIGCHLD handler to reap expiried child process; ok markus@
|
|
[sftp.1]
more wacky macro fixing;
|
|
[ssh.1]
mention RFC 5656 for ECC stuff
|
|
[ssh-keygen.1]
* mention ECDSA in more places
* less repetition in FILES section
* SSHv1 keys are still encrypted with 3DES
help and ok jmc@
|
|
for missing headers and compiler warnings.
|
|
[kexecdhc.c kexecdhs.c key.c key.h myproposal.h packet.c readconf.c]
[ssh-agent.c ssh-ecdsa.c ssh-keygen.c ssh.c] Disable ECDH and ECDSA on
platforms that don't have the requisite OpenSSL support. ok dtucker@
|
|
[kex.c kex.h kexecdh.c key.c key.h monitor.c ssh-ecdsa.c]
ECDH/ECDSA compliance fix: these methods vary the hash function they use
(SHA256/384/512) depending on the length of the curve in use. The previous
code incorrectly used SHA256 in all cases.
This fix will cause authentication failure when using 384 or 521-bit curve
keys if one peer hasn't been upgraded and the other has. (256-bit curve
keys work ok). In particular you may need to specify HostkeyAlgorithms
when connecting to a server that has not been upgraded from an upgraded
client.
ok naddy@
|
|
[compress.c]
work around name-space collisions some buggy compilers (looking at you
gcc, at least in earlier versions, but this does not forgive your current
transgressions) seen between zlib and openssl
ok djm
|
|
[authfile.c]
typo
|
|
[sshd_config]
add ssh_host_ecdsa_key to /etc; from Mattieu Baptiste
<mattieu.b@gmail.com>
ok deraadt@
|
|
[ssh-add.1 ssh.1]
two more EXIT STATUS sections;
|
|
[scp.1]
add an EXIT STATUS section for /usr/bin;
|
|
[ssh-keygen.c]
Switch ECDSA default key size to 256 bits, which according to RFC5656
should still be better than our current RSA-2048 default.
ok djm@, markus@
|
|
[ssh.c]
unbreak ControlPersist=yes for ControlMaster=yes; ok djm@
|
|
[ssh-keygen.c]
permit -b 256, 384 or 521 as key size for ECDSA; ok djm@
|
|
[servconf.c]
pick up ECDSA host key by default; ok djm@
|
