Commit Graph

470 Commits

Author SHA1 Message Date
Steven Hartland
4b0b2f2d1b Change comment about HPNDisabled to match the style of other options to
avoid confusion.

Sponsored by:	Multiplay
2014-05-20 10:28:19 +00:00
Dag-Erling Smørgrav
30a0343983 Apply upstream patch for EC calculation bug and bump version addendum. 2014-04-20 11:34:33 +00:00
Dag-Erling Smørgrav
b8f726b41c Restore the pX part to the version number printed in debugging mode. 2014-04-09 20:42:00 +00:00
Dag-Erling Smørgrav
b83788ff87 Upgrade to OpenSSH 6.6p1. 2014-03-25 11:05:34 +00:00
Dag-Erling Smørgrav
cf783db152 Add a pre-merge script which reverts mechanical changes such as added
$FreeBSD$ tags and man page dates.

Add a post-merge script which reapplies these changes.

Run both scripts to normalize the existing code base.  As a result, many
files which should have had $FreeBSD$ tags but didn't now have them.

Partly rewrite the upgrade instructions and remove the now outdated
list of tricks.
2014-03-24 19:15:13 +00:00
Robert Watson
b881b8be1d Update most userspace consumers of capability.h to use capsicum.h instead.
auditdistd is not updated as I will make the change upstream and then do a
vendor import sometime in the next week or two.

MFC after:	3 weeks
2014-03-16 11:04:44 +00:00
Pawel Jakub Dawidek
d62289d013 Fix installations that use kernels without CAPABILITIES support.
Approved by:	des
2014-02-04 21:48:09 +00:00
Dag-Erling Smørgrav
2b1970f362 Turn sandboxing on by default. 2014-02-01 00:07:16 +00:00
Dag-Erling Smørgrav
f7167e0ea0 Upgrade to OpenSSH 6.5p1. 2014-01-31 13:12:02 +00:00
Xin LI
0a37d4a300 MFV r257952:
Upgrade to OpenSSH 6.4p1.

Bump VersionAddendum.

Approved by:	des
2013-11-11 09:19:58 +00:00
Dag-Erling Smørgrav
0085282b6a Unbreak the WITHOUT_KERBEROS build and try to reduce the odds of a
repeat performance by introducing a script that runs configure with and
without Kerberos, diffs the result and generates krb5_config.h, which
contains the preprocessor macros that need to be defined in the Kerberos
case and undefined otherwise.

Approved by:	re (marius)
2013-09-23 20:35:54 +00:00
Dag-Erling Smørgrav
ce3adf4362 Pull in all the OpenSSH bits that we'd previously left out because we
didn't use them.  This will make future merges from the vendor tree much
easier.

Approved by:	re (gjb)
2013-09-21 22:24:10 +00:00
Dag-Erling Smørgrav
e4a9863fb7 Upgrade to 6.3p1.
Approved by:	re (gjb)
2013-09-21 21:36:09 +00:00
Dag-Erling Smørgrav
83c6a5242c Change the default value of VerifyHostKeyDNS to "yes" if compiled with
LDNS.  With that setting, OpenSSH will silently accept host keys that
match verified SSHFP records.  If an SSHFP record exists but could not
be verified, OpenSSH will print a message and prompt the user as usual.

Approved by:	re (blanket)
2013-09-10 22:30:22 +00:00
Dag-Erling Smørgrav
58d839214e These three files appeared in 6.0p1, which was imported into the vendor
branch but never merged to head.  They were inadvertantly left out when
6.1p1 was merged to head.  It didn't make any difference at the time,
because they were unused, but one of them is required for DNS-based host
key verification.

Approved by:	re (blanket)
2013-09-09 13:56:58 +00:00
Dag-Erling Smørgrav
fb0edcbb74 Apply upstream revision 1.151 (fix relative symlinks)
MFC after:	3 days
2013-08-13 09:06:18 +00:00
Dag-Erling Smørgrav
aa0dd44b14 r251088 reverted the default value for UsePrivilegeSeparation from
"sandbox" to "yes", but did not update the documentation to match.
2013-06-28 09:41:59 +00:00
Dag-Erling Smørgrav
c89ea4d72b Revert a local change that sets the default for UsePrivilegeSeparation to
"sandbox" instead of "yes".  In sandbox mode, the privsep child is unable
to load additional libraries and will therefore crash when trying to take
advantage of crypto offloading on CPUs that support it.
2013-05-29 00:19:58 +00:00
Dag-Erling Smørgrav
420bce642c Upgrade to OpenSSH 6.2p2. Mostly a no-op since I had already patched
the issues that affected us.
2013-05-17 09:12:33 +00:00
Bryan Drewery
f13e3f2087 The HPN patch added a new BUG bit for SSH_BUG_LARGEWINDOW
and the update to 6.1 added SSH_BUG_DYNAMIC_RPORT with the
same value.

Fix the HPN SSH_BUG_LARGEWINDOW bit so it is unique.

Approved by:	des
MFC after:	2 weeks
2013-05-13 11:32:20 +00:00
Dag-Erling Smørgrav
733706130a Merge updated "no such identity file" patch.
PR:		bin/178060
2013-04-24 12:36:37 +00:00
Dag-Erling Smørgrav
f29b8a64d0 Silence "received disconnect" in the common case. 2013-04-14 13:06:07 +00:00
Dag-Erling Smørgrav
fa67e83c67 Merge upstream patch to silence spurious "no such identity file" warnings. 2013-04-02 11:44:55 +00:00
Dag-Erling Smørgrav
5992891888 Silence printf format warnings. 2013-04-02 11:42:39 +00:00
Dag-Erling Smørgrav
ee8c73cd06 Silence warnings about redefined macros. 2013-04-01 13:48:30 +00:00
Dag-Erling Smørgrav
009fd5a774 Revert r247892 now that this has been fixed upstream. 2013-03-23 14:52:31 +00:00
Dag-Erling Smørgrav
6888a9be56 Upgrade to OpenSSH 6.2p1. The most important new features are support
for a key revocation list and more fine-grained authentication control.
2013-03-22 17:55:38 +00:00
Dag-Erling Smørgrav
c5c0dc9146 Keep the default AuthorizedKeysFile setting. Although authorized_keys2
has been deprecated for a while, some people still use it and were
unpleasantly surprised by this change.

I may revert this commit at a later date if I can come up with a way
to give users who still have authorized_keys2 files sufficient advance
warning.

MFC after:	ASAP
2013-03-18 10:50:50 +00:00
Dag-Erling Smørgrav
2ec88e9d1b Unlike OpenBSD's, our setusercontext() will intentionally ignore the user's
own umask setting (from ~/.login.conf) unless running with the user's UID.
Therefore, we need to call it again with LOGIN_SETUMASK after changing UID.

PR:		bin/176740
Submitted by:	John Marshall <john.marshall@riverwillow.com.au>
MFC after:	1 week
2013-03-13 09:41:55 +00:00
Dag-Erling Smørgrav
29911fcacc Partially revert r247892 and r247904 since our strnvis() does not
behave the way OpenSSH expects.
2013-03-07 14:38:43 +00:00
Dag-Erling Smørgrav
e9a6213037 Remove strnvis(), strvis(), strvisx(). 2013-03-06 23:22:40 +00:00
Dag-Erling Smørgrav
d9bb67e8ce Explicitly disable lastlog, utmp and wtmp. 2013-03-06 13:46:20 +00:00
Dag-Erling Smørgrav
462c32cb8d Upgrade OpenSSH to 6.1p1. 2012-09-03 16:51:41 +00:00
Xin LI
f2618bb4d1 MFV (r237567):
Fetch both ECDSA and RSA keys by default in ssh-keyscan(1).

Approved by:	des
Obtained from:	OpenSSH portable
MFC after:	1 week
2012-06-25 19:01:04 +00:00
Eygene Ryabinkin
8c0260d62b OpenSSH: allow VersionAddendum to be used again
Prior to this, setting VersionAddendum will be a no-op: one will
always have BASE_VERSION + " " + VERSION_HPN for VersionAddendum
set in the config and a bare BASE_VERSION + VERSION_HPN when there
is no VersionAddendum is set.

HPN patch requires both parties to have the "hpn" inside their
advertized versions, so we add VERSION_HPN to the VERSION_BASE
if HPN is enabled and omitting it if HPN is disabled.

VersionAddendum now uses the following logics:
 * unset (default value): append " " and VERSION_ADDENDUM;
 * VersionAddendum is set and isn't empty: append " "
   and VersionAddendum;
 * VersionAddendum is set and empty: don't append anything.

Approved by: des
Reviewed by: bz
MFC after: 3 days
2012-05-27 06:53:35 +00:00
Ed Schouten
35762f5913 Polish diff against upstream.
- Revert unneeded whitespace changes.
- Revert modifications to loginrec.c, as the upstream version already
  does the right thing.
- Fix indentation and whitespace of local changes.

Approved by:	des
MFC after:	1 month
2012-02-13 11:59:59 +00:00
Dag-Erling Smørgrav
fceeafce68 Add a -x option that causes ssh-agent(1) to exit when all clients have
disconnected.

MFC after:	1 week
2011-10-07 13:10:16 +00:00
Dag-Erling Smørgrav
e146993e33 Upgrade to OpenSSH 5.9p1.
MFC after:	3 months
2011-10-05 22:08:17 +00:00
Dag-Erling Smørgrav
c177b01465 Belatedly regenerate after application of the HPN patch. 2011-09-28 20:42:22 +00:00
Dag-Erling Smørgrav
45f3db2122 Remove the svn:keywords property and restore the historical $FreeBSD$ tag.
Approved by:	re (kib)
MFC after:	3 weeks
2011-09-16 11:14:10 +00:00
Brooks Davis
8eb43d357c Fix two more $FreeBSD$ keywords.
Reported by:	pluknet
Approved by:	re (implicit)
2011-08-03 20:21:52 +00:00
Brooks Davis
8998619212 Add support for dynamically adjusted buffers to allow the full use of
the bandwidth of long fat pipes (i.e. 100Mbps+ trans-oceanic or
trans-continental links).  Bandwidth-delay products up to 64MB are
supported.

Also add support (not compiled by default) for the None cypher.  The
None cypher can only be enabled on non-interactive sessions (those
without a pty where -T was not used) and must be enabled in both
the client and server configuration files and on the client command
line.  Additionally, the None cypher will only be activated after
authentication is complete.  To enable the None cypher you must add
-DNONE_CIPHER_ENABLED to CFLAGS via the make command line or in
/etc/make.conf.

This code is a style(9) compliant version of these features extracted
from the patches published at:

http://www.psc.edu/networking/projects/hpn-ssh/

Merging this patch has been a collaboration between me and Bjoern.

Reviewed by:	bz
Approved by:	re (kib), des (maintainer)
2011-08-03 19:14:22 +00:00
Dag-Erling Smørgrav
faa715d30c Merge two upstream patches from vendor branch. No functional changes. 2011-05-05 08:08:18 +00:00
Dag-Erling Smørgrav
4a421b6336 Upgrade to OpenSSH 5.8p2. 2011-05-04 07:34:44 +00:00
Dag-Erling Smørgrav
e2f6069c09 Upgrade to OpenSSH 5.6p1. 2010-11-11 11:46:19 +00:00
Dag-Erling Smørgrav
c4f213baab Forgot to svn rm this when I imported 5.4p1. 2010-11-10 08:21:25 +00:00
Ed Maste
905571c031 Remove copyright strings printed at login time via login(1) or sshd(8).
It is not clear to what this copyright should apply, and this is in line
with what other operating systems do.

For ssh specifically, printing of the copyright string is not in the
upstream version so this reduces our FreeBSD-local diffs.

Approved by:	core, des (ssh)
2010-09-28 20:57:14 +00:00
Dag-Erling Smørgrav
e252e85c1e More commas 2010-06-01 22:46:57 +00:00
Dag-Erling Smørgrav
afee23fec9 Missing commas 2010-06-01 15:11:29 +00:00
Colin Percival
e9b8779126 Fix .Dd line: FreeBSD's mdoc code doesn't understand OpenBSD's $Mdocdate$.
MFC after:	3 days
2010-05-28 01:06:40 +00:00