summaryrefslogtreecommitdiff
path: root/ChangeLog
AgeCommit message (Collapse)Author
2010-06-26 - djm@cvs.openbsd.org 2010/06/23 02:59:02Damien Miller
[ssh-keygen.c] fix printing of extensions in v01 certificates that I broke in r1.190
2010-06-26 - djm@cvs.openbsd.org 2010/06/22 04:59:12Damien Miller
[session.c] include the user name on "subsystem request for ..." log messages; bz#1571; ok dtucker@
2010-06-26 - djm@cvs.openbsd.org 2010/06/22 04:54:30Damien Miller
[ssh-keyscan.c] replace verbose and overflow-prone Linebuf code with read_keyfile_line() based on patch from joachim AT joachimschipper.nl; bz#1565; ok dtucker@
2010-06-26 - djm@cvs.openbsd.org 2010/06/22 04:49:47Damien Miller
[auth.c] queue auth debug messages for bad ownership or permissions on the user's keyfiles. These messages will be sent after the user has successfully authenticated (where our client will display them with LogLevel=debug).
2010-06-26 - djm@cvs.openbsd.org 2010/06/22 04:32:06Damien Miller
[ssh-keygen.c] standardise error messages when attempting to open private key files to include "progname: filename: error reason" bz#1783; ok dtucker@
2010-06-26 - djm@cvs.openbsd.org 2010/06/22 04:22:59Damien Miller
[servconf.c sshd_config.5] expose some more sshd_config options inside Match blocks: AuthorizedKeysFile AuthorizedPrincipalsFile HostbasedUsesNameFromPacketOnly PermitTunnel bz#1764; feedback from imorgan AT nas.nasa.gov; ok dtucker@
2010-06-26 - djm@cvs.openbsd.org 2010/06/18 04:43:08Damien Miller
[sftp-client.c] fix memory leak in do_realpath() error path; bz#1771, patch from anicka AT suse.cz
2010-06-26 - djm@cvs.openbsd.org 2010/06/18 03:16:03Damien Miller
[session.c] Missing check for chroot_director == "none" (we already checked against NULL); bz#1564 from Jan.Pechanec AT Sun.COM
2010-06-26 - djm@cvs.openbsd.org 2010/06/18 00:58:39Damien Miller
[sftp.c] unbreak ls in working directories that contains globbing characters in their pathnames. bz#1655 reported by vgiffin AT apple.com
2010-06-26 - djm@cvs.openbsd.org 2010/06/17 07:07:30Damien Miller
[mux.c] Correct sizing of object to be allocated by calloc(), replacing sizeof(state) with sizeof(*state). This worked by accident since the struct contained a single int at present, but could have broken in the future. patch from hyc AT symas.com
2010-06-26 - markus@cvs.openbsd.org 2010/06/08 21:32:19Damien Miller
[ssh-pkcs11.c] check length of value returned C_GetAttributValue for != 0 from mdrtbugzilla@codefive.co.uk; bugzilla #1773; ok dtucker@
2010-06-26 - OpenBSD CVS SyncDamien Miller
- djm@cvs.openbsd.org 2010/05/21 05:00:36 [misc.c] colon() returns char*, so s/return (0)/return NULL/
2010-06-22 - (djm) [loginrec.c] crank LINFO_NAMESIZE (username length) to 512Damien Miller
bz#1579; ok dtucker
2010-06-18 - (djm) [contrib/ssh-copy-id] Update key file explicitly under ~Damien Miller
rather than assuming that $CWD == $HOME. bz#1500, patch from timothy AT gelter.com
2010-06-17 - (tim) [contrib/cygwin/README] Remove a reference to the obsoleteTim Rice
minires-devel package, and to add the reference to the libedit-devel package since CYgwin now provides libedit. Patch from Corinna Vinschen.
2010-05-21 - djm@cvs.openbsd.org 2010/05/20 23:46:02Damien Miller
[PROTOCOL.certkeys auth-options.c ssh-keygen.c] Move the permit-* options to the non-critical "extensions" field for v01 certificates. The logic is that if another implementation fails to implement them then the connection just loses features rather than fails outright. ok markus@
2010-05-21 - djm@cvs.openbsd.org 2010/05/20 11:25:26Damien Miller
[auth2-pubkey.c] fix logspam when key options (from="..." especially) deny non-matching keys; reported by henning@ also bz#1765; ok markus@ dtucker@
2010-05-21 - markus@cvs.openbsd.org 2010/05/16 12:55:51Damien Miller
[PROTOCOL.mux clientloop.h mux.c readconf.c readconf.h ssh.1 ssh.c] mux support for remote forwarding with dynamic port allocation, use with LPORT=`ssh -S muxsocket -R0:localhost:25 -O forward somehost` feedback and ok djm@
2010-05-21 - djm@cvs.openbsd.org 2010/05/14 23:29:23Damien Miller
[channels.c channels.h mux.c ssh.c] Pause the mux channel while waiting for reply from aynch callbacks. Prevents misordering of replies if new requests arrive while waiting. Extend channel open confirm callback to allow signalling failure conditions as well as success. Use this to 1) fix a memory leak, 2) start using the above pause mechanism and 3) delay sending a success/ failure message on mux slave session open until we receive a reply from the server. motivated by and with feedback from markus@
2010-05-21 - djm@cvs.openbsd.org 2010/05/14 00:47:22Damien Miller
[ssh-add.c] check that the certificate matches the corresponding private key before grafting it on
2010-05-21 - djm@cvs.openbsd.org 2010/05/11 02:58:04Damien Miller
[auth-rsa.c] don't accept certificates marked as "cert-authority" here; ok markus@
2010-05-21 - djm@cvs.openbsd.org 2010/05/07 11:31:26Damien Miller
[regress/Makefile regress/cert-userkey.sh] regress tests for AuthorizedPrincipalsFile and "principals=" key option. feedback and ok markus@
2010-05-12 - (djm) [openbsd-compat/openssl-compat.h] Fix build breakage on olderDamien Miller
libcrypto by defining OPENSSL_[DR]SA_MAX_MODULUS_BITS if they aren't already. ok dtucker@
2010-05-12 - (dtucker) [Makefile.in] Bug #1770: Link libopenbsd-compat twice to solveDarren Tucker
circular dependency problem on old or odd platforms. From Tom Lane, ok djm@.
2010-05-10 - jmc@cvs.openbsd.org 2010/05/07 12:49:17Damien Miller
[sshd_config.5] tweak previous;
2010-05-10 - djm@cvs.openbsd.org 2010/05/07 11:30:30Damien Miller
[auth-options.c auth-options.h auth.c auth.h auth2-pubkey.c] [key.c servconf.c servconf.h sshd.8 sshd_config.5] add some optional indirection to matching of principal names listed in certificates. Currently, a certificate must include the a user's name to be accepted for authentication. This change adds the ability to specify a list of certificate principal names that are acceptable. When authenticating using a CA trusted through ~/.ssh/authorized_keys, this adds a new principals="name1[,name2,...]" key option. For CAs listed through sshd_config's TrustedCAKeys option, a new config option "AuthorizedPrincipalsFile" specifies a per-user file containing the list of acceptable names. If either option is absent, the current behaviour of requiring the username to appear in principals continues to apply. These options are useful for role accounts, disjoint account namespaces and "user@realm"-style naming policies in certificates. feedback and ok markus@
2010-05-10 - dtucker@cvs.openbsd.org 2010/05/05 04:22:09Damien Miller
[sftp.c] restore mput and mget which got lost in the tab-completion changes. found by Kenneth Whitaker, ok djm@
2010-05-10 - djm@cvs.openbsd.org 2010/05/01 02:50:50Damien Miller
[PROTOCOL.certkeys] typo; jmeltzer@
2010-05-10 - djm@cvs.openbsd.org 2010/04/26 22:28:24Damien Miller
[sshconnect2.c] bz#1502: authctxt.success is declared as an int, but passed by reference to function that accepts sig_atomic_t*. Convert it to the latter; ok markus@ dtucker@
2010-05-10 - djm@cvs.openbsd.org 2010/04/23 22:48:31Damien Miller
[ssh-keygen.c] refuse to generate keys longer than OPENSSL_[RD]SA_MAX_MODULUS_BITS, since we would refuse to use them anyway. bz#1516; ok dtucker@
2010-05-10 - djm@cvs.openbsd.org 2010/04/23 22:42:05Damien Miller
[session.c] set stderr to /dev/null for subsystems rather than just closing it. avoids hangs if a subsystem or shell initialisation writes to stderr. bz#1750; ok markus@
2010-05-10 - djm@cvs.openbsd.org 2010/04/23 22:27:38Damien Miller
[mux.c] set "detach_close" flag when registering channel cleanup callbacks. This causes the channel to close normally when its fds close and hangs when terminating a mux slave using ~. bz#1758; ok markus@
2010-05-10 - OpenBSD CVS SyncDamien Miller
- djm@cvs.openbsd.org 2010/04/23 01:47:41 [ssh-keygen.c] bz#1740: display a more helpful error message when $HOME is inaccessible while trying to create .ssh directory. Based on patch from jchadima AT redhat.com; ok dtucker@
2010-04-23 - (dtucker) [configure.ac] Bug #1756: Check for the existence of a lib64 dirDarren Tucker
in the openssl install directory (some newer openssl versions do this on at least some amd64 platforms).
2010-04-18 - (dtucker) [contrib/aix/buildbff.sh] Fix creation of ssh_prng_cmds.defaultDarren Tucker
file.
2010-04-18 - OpenBSD CVS SyncDamien Miller
- djm@cvs.openbsd.org 2010/04/16 01:58:45 [regress/cert-hostkey.sh regress/cert-userkey.sh] regression tests for v01 certificate format includes interop tests for v00 certs
2010-04-18 - djm@cvs.openbsd.org 2010/04/16 21:14:27Damien Miller
[sshconnect.c] oops, %r => remote username, not %u
2010-04-18 - jmc@cvs.openbsd.org 2010/04/16 06:47:04Damien Miller
[ssh-keygen.1 ssh-keygen.c] tweak previous; ok djm
2010-04-18 - OpenBSD CVS SyncDamien Miller
- jmc@cvs.openbsd.org 2010/04/16 06:45:01 [ssh_config.5] tweak previous; ok djm
2010-04-16 - djm@cvs.openbsd.org 2010/04/16 01:47:26Damien Miller
[PROTOCOL.certkeys auth-options.c auth-options.h auth-rsa.c] [auth2-pubkey.c authfd.c key.c key.h myproposal.h ssh-add.c] [ssh-agent.c ssh-dss.c ssh-keygen.1 ssh-keygen.c ssh-rsa.c] [sshconnect.c sshconnect2.c sshd.c] revised certificate format ssh-{dss,rsa}-cert-v01@openssh.com with the following changes: move the nonce field to the beginning of the certificate where it can better protect against chosen-prefix attacks on the signature hash Rename "constraints" field to "critical options" Add a new non-critical "extensions" field Add a serial number The older format is still support for authentication and cert generation (use "ssh-keygen -t v00 -s ca_key ..." to generate a v00 certificate) ok markus@
2010-04-16 - markus@cvs.openbsd.org 2010/04/15 20:32:55Damien Miller
[ssh-pkcs11.c] retry lookup for private key if there's no matching key with CKA_SIGN attribute enabled; this fixes fixes MuscleCard support (bugzilla #1736) ok djm@
2010-04-16 - djm@cvs.openbsd.org 2010/04/14 22:27:42Damien Miller
[ssh_config.5 sshconnect.c] expand %r => remote username in ssh_config:ProxyCommand; ok deraadt markus
2010-04-16 - djm@cvs.openbsd.org 2010/04/10 05:48:16Damien Miller
[mux.c] fix NULL dereference; from matthew.haub AT alumni.adelaide.edu.au
2010-04-16 - djm@cvs.openbsd.org 2010/04/10 02:10:56Damien Miller
[sshconnect2.c] show the key type that we are offering in debug(), helps distinguish between certs and plain keys as the path to the private key is usually the same.
2010-04-16 - djm@cvs.openbsd.org 2010/04/10 02:08:44Damien Miller
[clientloop.c] bz#1698: kill channel when pty allocation requests fail. Fixed stuck client if the server refuses pty allocation. ok dtucker@ "think so" markus@
2010-04-16 - djm@cvs.openbsd.org 2010/04/10 00:04:30Damien Miller
[sshconnect.c] fix terminology: we didn't find a certificate in known_hosts, we found a CA key
2010-04-16 - djm@cvs.openbsd.org 2010/04/10 00:00:16Damien Miller
[ssh.c] bz#1746 - suppress spurious tty warning when using -O and stdin is not a tty; ok dtucker@ markus@
2010-04-16 - jmc@cvs.openbsd.org 2010/03/27 14:26:55Damien Miller
[ssh_config.5] tweak previous; ok dtucker
2010-04-16 - jmc@cvs.openbsd.org 2010/03/26 06:54:36Damien Miller
[ssh.1] tweak previous;
2010-04-16 - OpenBSD CVS SyncDamien Miller
- djm@cvs.openbsd.org 2010/03/26 03:13:17 [bufaux.c] allow buffer_get_int_ret/buffer_get_int64_ret to take a NULL pointer argument to allow skipping past values in a buffer