| Age | Commit message (Collapse) | Author |
|---|
|
[sshconnect2.c]
fix inverted test that caused PKCS#11 keys that were explicitly listed
not to be preferred. Reported by Dirk-Willem van Gulik
|
|
ECC variable too.
|
|
the proposal if the version of OpenSSL we're using doesn't support ECC.
|
|
regress/unittests/sshbuf/test_sshbuf_getput_fuzz.c] Only do NISTP256
curve tests if OpenSSL has them.
|
|
[openbsd-compat/bsd-cygwin_util.h] On Cygwin, determine privilege
separation user at runtime, since it may need to be a domain account.
Patch from Corinna Vinschen.
|
|
from Corinna Vinschen, fixing a number of bugs and preparing for
Cygwin 1.7.30.
|
|
|
|
|
|
when it is available. It takes into account time spent suspended,
thereby ensuring timeouts (e.g. for expiring agent keys) fire
correctly. bz#2228 reported by John Haxby
|
|
vhangup on Linux. It doens't work for non-root users, and for them
it just messes up the tty settings.
|
|
|
|
[regress/unittests/sshbuf/test_sshbuf.c
[regress/unittests/sshbuf/test_sshbuf_fixed.c]
[regress/unittests/sshbuf/test_sshbuf_fuzz.c]
[regress/unittests/sshbuf/test_sshbuf_getput_basic.c]
[regress/unittests/sshbuf/test_sshbuf_getput_crypto.c]
[regress/unittests/sshbuf/test_sshbuf_getput_fuzz.c]
[regress/unittests/sshbuf/test_sshbuf_misc.c]
[regress/unittests/sshbuf/tests.c]
[regress/unittests/test_helper/fuzz.c]
[regress/unittests/test_helper/test_helper.c]
Hook new unit tests into the build and "make tests"
|
|
[regress/unittests/Makefile.inc]
[regress/unittests/sshbuf/Makefile]
[regress/unittests/sshbuf/test_sshbuf.c]
[regress/unittests/sshbuf/test_sshbuf_fixed.c]
[regress/unittests/sshbuf/test_sshbuf_fuzz.c]
[regress/unittests/sshbuf/test_sshbuf_getput_basic.c]
[regress/unittests/sshbuf/test_sshbuf_getput_crypto.c]
[regress/unittests/sshbuf/test_sshbuf_getput_fuzz.c]
[regress/unittests/sshbuf/test_sshbuf_misc.c]
[regress/unittests/sshbuf/tests.c]
[regress/unittests/test_helper/Makefile]
[regress/unittests/test_helper/fuzz.c]
[regress/unittests/test_helper/test_helper.c]
[regress/unittests/test_helper/test_helper.h]
Import new unit tests from OpenBSD; not yet hooked up to build.
|
|
[connect-privsep.sh]
Remove the Z flag from the list of malloc options as it
was removed from malloc.c 10 days ago.
OK from miod@
|
|
[proxy-connect.sh]
Add tests for with and without compression, with and without privsep.
|
|
[dhgex.sh integrity.sh kextype.sh rekey.sh try-ciphers.sh]
repair regress tests broken by server-side default cipher/kex/mac changes
by ensuring that the option under test is included in the server's
algorithm list
|
|
[login-timeout.sh]
this test is a sorry mess of race conditions; add another sleep
to avoid a failure on slow machines (at least until I find a
better way)
|
|
[sshbuf-getput-crypto.c sshbuf.c] compilation and portability fixes
|
|
portability glue to support building without libcrypto
|
|
[sftp.c]
Zap extra whitespace.
OK from djm@ and dtucker@
|
|
[monitor.c packet.c packet.h]
unbreak compression, by re-init-ing the compression code in the
post-auth child. the new buffer code is more strict, and requires
buffer_init() while the old code was happy after a bzero();
originally from djm@
|
|
[chacha.h cipher-chachapoly.h digest.h hmac.h kex.h kexc25519.c]
[misc.h poly1305.h ssh-pkcs11.c defines.h]
revert __bounded change; it causes way more problems for portable than
it solves; pointed out by dtucker@
|
|
[mac.c myproposal.h umac.c]
UMAC can use our local fallback implementation of AES when OpenSSL isn't
available. Glue code straight from Ted Krovetz's original umac.c.
ok markus@
|
|
[bufaux.c bufbn.c bufec.c buffer.c buffer.h sshbuf-getput-basic.c]
[sshbuf-getput-crypto.c sshbuf-misc.c sshbuf.c sshbuf.h ssherr.c]
[ssherr.h]
New buffer API; the first installment of the conversion/replacement
of OpenSSH's internals to make them usable as a standalone library.
This includes a set of wrappers to make it compatible with the
existing buffer API so replacement can occur incrementally.
With and ok markus@
Thanks also to Ben Hawkes, David Tomaschik, Ivan Fratric, Matthew
Dempsky and Ron Bowes for a detailed review.
|
|
[sftp.c]
Don't attempt to append a nul quote char to the filename. Should prevent
fatal'ing with "el_insertstr failed" when there's a single quote char
somewhere in the string. bz#2238, ok markus@
|
|
[sftp.c]
Move nulling of variable next to where it's freed. ok markus@
|
|
[auth.c authfd.c authfile.c bufaux.c cipher.c cipher.h hostfile.c]
[kex.c key.c mac.c monitor.c monitor_wrap.c myproposal.h packet.c]
[roaming_client.c ssh-agent.c ssh-keygen.c ssh-keyscan.c ssh-keysign.c]
[ssh-pkcs11.h ssh.c sshconnect.c sshconnect2.c sshd.c]
make compiling against OpenSSL optional (make OPENSSL=no);
reduces algorithms to curve25519, aes-ctr, chacha, ed25519;
allows us to explore further options; with and ok djm
|
|
[clientloop.c serverloop.c]
bz#1818 - don't send channel success/failre replies on channels that
have sent a close already; analysis and patch from Simon Tatham;
ok markus@
|
|
[authfile.c bufaux.c buffer.h channels.c krl.c mux.c packet.c packet.h]
[ssh-keygen.c]
buffer_get_string_ptr's return should be const to remind
callers that futzing with it will futz with the actual buffer
contents
|
|
[readconf.c]
don't record duplicate IdentityFiles
|
|
[sftp.1]
zap eol whitespace;
|
|
[sftp.1]
Document sftp upload resume.
OK from djm@, with feedback from okan@.
|
|
[sftp.c]
Sort the sftp command list.
OK from djm@
|
|
[sftp-client.c sftp-client.h sftp.c]
Implement sftp upload resume support.
OK from djm@, with input from guenther@, mlarkin@ and
okan@
|
|
[dns.c dns.h ssh-keygen.c]
Add support for SSHFP DNS records for ED25519 key types.
OK from djm@
|
|
OpenBSD
|
|
have it. Only attempt to use __attribute__(__bounded__) for gcc.
|
|
[compat.c]
add a canonical 6.6 + curve25519 bignum fix fake version that I can
recommend people use ahead of the openssh-6.7 release
|
|
[misc.c misc.h umac.c]
use get/put_u32 to load values rather than *((UINT32 *)p) that breaks on
strict-alignment architectures; reported by and ok stsp@
|
|
[ssh.1]
delete .xr to hosts.equiv. there's still an unfortunate amount of
documentation referring to rhosts equivalency in here.
|
|
[sshd.8]
remove some really old rsh references
|
|
[ssh-keysign.c sshd.c]
Delete futile calls to RAND_seed. ok djm
NB. Id sync only. This only applies to OpenBSD's libcrypto slashathon
|
|
[compat.c]
missing wildcard; pointed out by naddy@
|
|
[compat.c compat.h sshconnect2.c sshd.c version.h]
OpenSSH 6.5 and 6.6 have a bug that causes ~0.2% of connections
using the curve25519-sha256@libssh.org KEX exchange method to fail
when connecting with something that implements the spec properly.
Disable this KEX method when speaking to one of the affected
versions.
reported by Aris Adamantiadis; ok markus@
|
|
[ssh-agent.1]
remove the identity files from this manpage - ssh-agent doesn't deal
with them at all and the same information is duplicated in ssh-add.1
(which does deal with them); prodded by deraadt@
|
|
[bufaux.c]
skip leading zero bytes in buffer_put_bignum2_from_string();
reported by jan AT mojzis.com; ok markus@
|
|
[sshd.c]
avoid crash at exit: check that pmonitor!=NULL before dereferencing;
bz#2225, patch from kavi AT juniper.net
|
|
[packet.c]
demote a debug3 to PACKET_DEBUG; ok markus@
|
|
[sshconnect.c]
When using VerifyHostKeyDNS with a DNSSEC resolver, down-convert any
certificate keys to plain keys and attempt SSHFP resolution.
Prevents a server from skipping SSHFP lookup and forcing a new-hostkey
dialog by offering only certificate keys.
Reported by mcv21 AT cam.ac.uk
|
|
[ssh-keysign.c]
include fingerprint of key not found
use arc4random_buf() instead of loop+arc4random()
|
