Some notable changes, from upstream's release notes: - sshd(8): Remove support for obsolete "host/port" syntax. - ssh(1): When prompting whether to record a new host key, accept the key fingerprint as a synonym for "yes". - ssh-keygen(1): when acting as a CA and signing certificates with an RSA key, default to using the rsa-sha2-512 signature algorithm. - ssh(1), sshd(8), ssh-keygen(1): this release removes the "ssh-rsa" (RSA/SHA1) algorithm from those accepted for certificate signatures. - ssh-sk-helper(8): this is a new binary. It is used by the FIDO/U2F support to provide address-space isolation for token middleware libraries (including the internal one). - ssh(1): this release enables UpdateHostkeys by default subject to some conservative preconditions. - scp(1): this release changes the behaviour of remote to remote copies (e.g. "scp host-a:/path host-b:") to transfer through the local host by default. - scp(1): experimental support for transfers using the SFTP protocol as a replacement for the venerable SCP/RCP protocol that it has traditionally used. Additional integration work is needed to support FIDO/U2F in the base system. Deprecation Notice ------------------ OpenSSH will disable the ssh-rsa signature scheme by default in the next release. Reviewed by: imp MFC after: 1 month Relnotes: Yes Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D29985
13704 lines
441 KiB
Plaintext
13704 lines
441 KiB
Plaintext
commit e1a596186c81e65a34ce13076449712d3bf97eb4
|
||
Author: Damien Miller <djm@mindrot.org>
|
||
Date: Fri Aug 20 14:03:49 2021 +1000
|
||
|
||
depend
|
||
|
||
commit 5450606c8f7f7a0d70211cea78bc2dab74ab35d1
|
||
Author: Damien Miller <djm@mindrot.org>
|
||
Date: Fri Aug 20 13:59:43 2021 +1000
|
||
|
||
update version numbers
|
||
|
||
commit feee2384ab8d694c770b7750cfa76a512bdf8246
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Fri Aug 20 03:22:55 2021 +0000
|
||
|
||
upstream: openssh-8.7
|
||
|
||
OpenBSD-Commit-ID: 8769dff0fd76ae3193d77bf83b439adee0f300cd
|
||
|
||
commit 9a2ed62173cc551b2b5f479460bb015b19499de8
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Fri Aug 20 10:48:13 2021 +1000
|
||
|
||
Also check pid in pselect_notify_setup.
|
||
|
||
Spotted by djm@.
|
||
|
||
commit deaadcb93ca15d4f38aa38fb340156077792ce87
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Fri Aug 20 08:39:33 2021 +1000
|
||
|
||
Prefix pselect functions to clarify debug messages
|
||
|
||
commit 10e45654cff221ca60fd35ee069df67208fcf415
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Fri Aug 20 08:30:42 2021 +1000
|
||
|
||
Fix race in pselect replacement code.
|
||
|
||
On the second and subsequent calls to pselect the notify_pipe was not
|
||
added to the select readset, opening up a race that om G. Christensen
|
||
discovered on multiprocessor Solaris <=9 systems.
|
||
|
||
Also reinitialize notify_pipe if the pid changes. This will prevent a
|
||
parent and child from using the same FD, although this is not an issue
|
||
in the current structure it might be in future.
|
||
|
||
commit 464ba22f1e38d25402e5ec79a9b8d34a32df5a3f
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Wed Aug 18 12:51:30 2021 +1000
|
||
|
||
Check compiler for c99 declarations after code.
|
||
|
||
The sntrup761 reference code contains c99-style declarations after code
|
||
so don't try to build that if the compiler doesn't support it.
|
||
|
||
commit 7d878679a4b155a359d32104ff473f789501748d
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Tue Aug 17 15:12:04 2021 +1000
|
||
|
||
Remove trailing backslash on regress-unit-binaries
|
||
|
||
commit b71b2508f17c68c5d9dbbe537686d81cedb9a781
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Tue Aug 17 07:59:27 2021 +1000
|
||
|
||
Put stdint.h inside HAVE_STDINT_H.
|
||
|
||
From Tom G. Christensen.
|
||
|
||
commit 6a24567a29bd7b4ab64e1afad859ea845cbc6b8c
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Mon Aug 16 14:13:02 2021 +1000
|
||
|
||
Improve github test driver script.
|
||
|
||
- use a trap to always output any failed regress logs (since the script
|
||
sets -e, the existing log output is never invoked).
|
||
- pass LTESTS and SKIP_LTESTS when re-running with sshd options (eg.
|
||
UsePAM).
|
||
|
||
commit b467cf13705f59ed348b620722ac098fe31879b7
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Mon Aug 16 11:32:23 2021 +1000
|
||
|
||
Remove deprecated ubuntu-16.04 test targets.
|
||
|
||
Github has deprecated ubuntu-16.04 and it will be removed on 20
|
||
September.
|
||
|
||
commit 20e6eefcdf78394f05e453d456c1212ffaa6b6a4
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Sun Aug 15 23:25:26 2021 +1000
|
||
|
||
Skip agent ptrace test on hurd.
|
||
|
||
commit 7c9115bbbf958fbf85259a061c1122e2d046aabf
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Sun Aug 15 19:37:22 2021 +1000
|
||
|
||
Add hurd test target.
|
||
|
||
commit 7909a566f6c6a78fcd30708dc49f4e4f9bb80ce3
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Sun Aug 15 12:45:10 2021 +1000
|
||
|
||
Skip scp3 tests on all dfly58 and 60 configs.
|
||
|
||
commit e65198e52cb03534e8c846d1bca74c310b1526de
|
||
Author: Tim Rice <tim@multitalents.net>
|
||
Date: Sat Aug 14 13:08:07 2021 -0700
|
||
|
||
openbsd-compat/openbsd-compat.h: put bsd-signal.h before bsd-misc.h
|
||
to get sigset_t from signal.h needed for the pselect replacement.
|
||
|
||
commit e50635640f79920d9375e0155cb3f4adb870eee5
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Fri Aug 13 13:21:00 2021 +1000
|
||
|
||
Test OpenSSH from OpenBSD head on 6.8 and 6.9.
|
||
|
||
commit e0ba38861c490c680117b7fe0a1d61a181cd00e7
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Fri Aug 13 13:00:14 2021 +1000
|
||
|
||
Skip scp3 test on dragonfly 58 and 60.
|
||
|
||
The tests hang, so skip until we figure them out.
|
||
|
||
commit dcce2a2bcf007bf817a2fb0dce3db83fa9201e92
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Thu Aug 12 23:59:25 2021 +0000
|
||
|
||
upstream: mention that CASignatureAlgorithms accepts +/- similarly to
|
||
|
||
the other algorithm list directives; ok jmc bz#3335
|
||
|
||
OpenBSD-Commit-ID: 0d46b53995817052c78e2dce9dbd133963b073d9
|
||
|
||
commit 090a82486e5d7a8f7f16613d67e66a673a40367f
|
||
Author: schwarze@openbsd.org <schwarze@openbsd.org>
|
||
Date: Thu Aug 12 09:59:00 2021 +0000
|
||
|
||
upstream: In the editline(3) branch of the sftp(1) event loop,
|
||
|
||
handle SIGINT rather than ignoring it, such that the user can use Ctrl-C to
|
||
discard the currently edited command line and get a fresh prompt, just like
|
||
in ftp(1), bc(1), and in shells.
|
||
|
||
It is critical to not use ssl_signal() for this particular case
|
||
because that function unconditionally sets SA_RESTART, but here we
|
||
need the signal to interrupt the read(2) in the el_gets(3) event loop.
|
||
|
||
OK dtucker@ deraadt@
|
||
|
||
OpenBSD-Commit-ID: 8025115a773f52e9bb562eaab37ea2e021cc7299
|
||
|
||
commit e1371e4f58404d6411d9f95eb774b444cea06a26
|
||
Author: naddy@openbsd.org <naddy@openbsd.org>
|
||
Date: Wed Aug 11 14:07:54 2021 +0000
|
||
|
||
upstream: scp: tweak man page and error message for -3 by default
|
||
|
||
Now that the -3 option is enabled by default, flip the documentation
|
||
and error message logic from "requires -3" to "blocked by -R".
|
||
|
||
ok djm@
|
||
|
||
OpenBSD-Commit-ID: a872592118444fb3acda5267b2a8c3d4c4252020
|
||
|
||
commit 49f46f6d77328a3d10a758522b670a3e8c2235e7
|
||
Author: naddy@openbsd.org <naddy@openbsd.org>
|
||
Date: Wed Aug 11 14:05:19 2021 +0000
|
||
|
||
upstream: scp: do not spawn ssh with two -s flags for
|
||
|
||
remote-to-remote copies
|
||
|
||
Do not add another "-s" to the argument vector every time an SFTP
|
||
connection is initiated. Instead, introduce a subsystem flag to
|
||
do_cmd() and add "-s" when the flag is set.
|
||
|
||
ok djm@
|
||
|
||
OpenBSD-Commit-ID: 25df69759f323661d31b2e1e790faa22e27966c1
|
||
|
||
commit 2a2cd00783e1da45ee730b7f453408af1358ef5b
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Wed Aug 11 08:55:04 2021 +0000
|
||
|
||
upstream: test -Oprint-pubkey
|
||
|
||
OpenBSD-Regress-ID: 3d51afb6d1f287975fb6fddd7a2c00a3bc5094e0
|
||
|
||
commit b9f4635ea5bc33ed5ebbacf332d79bae463b0f54
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Wed Aug 11 08:54:17 2021 +0000
|
||
|
||
upstream: when verifying sshsig signatures, support an option
|
||
|
||
(-Oprint-pubkey) to dump the full public key to stdout; based on patch from
|
||
Fabian Stelzer; ok markus@
|
||
|
||
OpenBSD-Commit-ID: 0598000e5b9adfb45d42afa76ff80daaa12fc3e2
|
||
|
||
commit 750c1a45ba4e8ad63793d49418a0780e77947b9b
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Wed Aug 11 05:21:32 2021 +0000
|
||
|
||
upstream: oops, missed one more %p
|
||
|
||
OpenBSD-Commit-ID: e7e62818d1564cc5cd9086eaf7a51cbd1a9701eb
|
||
|
||
commit b5aa27b69ab2e1c13ac2b5ad3f8f7d389bad7489
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Wed Aug 11 05:20:17 2021 +0000
|
||
|
||
upstream: remove a bunch of %p in format strings; leftovers of
|
||
|
||
debuggings past. prompted by Michael Forney, ok dtucker@
|
||
|
||
OpenBSD-Commit-ID: 4853a0d6c9cecaba9ecfcc19066e52d3a8dcb2ac
|
||
|
||
commit 419aa01123db5ff5dbc68b2376ef23b222862338
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Wed Aug 11 09:21:09 2021 +1000
|
||
|
||
Add includes.h to compat tests.
|
||
|
||
On platforms where closefrom returns void (eg glibc>=2.34) the prototype
|
||
for closefrom in its compat tests would cause compile errors. Remove
|
||
this and have the tests pull in the compat headers in the same way as
|
||
the main code. bz#3336.
|
||
|
||
commit 931f592f26239154eea3eb35a086585897b1a185
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Tue Aug 10 03:35:45 2021 +0000
|
||
|
||
upstream: adapt to scp -M flag change; make scp3.sh test SFTP mode too
|
||
|
||
OpenBSD-Regress-ID: 43fea26704a0f0b962b53c1fabcb68179638f9c0
|
||
|
||
commit 391ca67fb978252c48d20c910553f803f988bd37
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Tue Aug 10 03:33:34 2021 +0000
|
||
|
||
upstream: Prepare for a future where scp(1) uses the SFTP protocol by
|
||
|
||
default. Replace recently added -M option to select the protocol with -O
|
||
(olde) and -s (SFTP) flags, and label the -s flag with a clear warning that
|
||
it will be removed in the near future (so no, don't use it in scripts!).
|
||
|
||
prompted by/feedback from deraadt@
|
||
|
||
OpenBSD-Commit-ID: 92ad72cc6f0023c9be9e316d8b30eb6d8d749cfc
|
||
|
||
commit bfdd4b722f124a4fa9173d20dd64dd0fc69856be
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Mon Aug 9 23:56:36 2021 +0000
|
||
|
||
upstream: make scp -3 the default for remote-to-remote copies. It
|
||
|
||
provides a much better and more intuitive user experience and doesn't require
|
||
exposing credentials to the source host.
|
||
|
||
thanks naddy@ for catching the missing argument in usage()
|
||
|
||
"Yes please!" - markus@
|
||
"makes a lot of sense" - deraadt@
|
||
"the right thing to do" - dtucker@
|
||
|
||
OpenBSD-Commit-ID: d0d2af5f0965c5192ba5b2fa461c9f9b130e5dd9
|
||
|
||
commit 2f7a3b51cef689ad9e93d0c6c17db5a194eb5555
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Mon Aug 9 23:49:31 2021 +0000
|
||
|
||
upstream: make scp in SFTP mode try to use relative paths as much
|
||
|
||
as possible. Previosuly, it would try to make relative and ~/-rooted paths
|
||
absolute before requesting transfers.
|
||
|
||
prompted by and much discussion deraadt@
|
||
ok markus@
|
||
|
||
OpenBSD-Commit-ID: 46639d382ea99546a4914b545fa7b00fa1be5566
|
||
|
||
commit 2ab864010e0a93c5dd95116fb5ceaf430e2fc23c
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Mon Aug 9 23:47:44 2021 +0000
|
||
|
||
upstream: SFTP protocol extension to allow the server to expand
|
||
|
||
~-prefixed paths, in particular ~user ones. Allows scp in sftp mode to accept
|
||
these paths, like scp in rcp mode does.
|
||
|
||
prompted by and much discussion deraadt@
|
||
ok markus@
|
||
|
||
OpenBSD-Commit-ID: 7d794def9e4de348e1e777f6030fc9bafdfff392
|
||
|
||
commit 41b019ac067f1d1f7d99914d0ffee4d2a547c3d8
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Mon Aug 9 23:44:32 2021 +0000
|
||
|
||
upstream: when scp is in SFTP mode, try to deal better with ~
|
||
|
||
prefixed paths. ~user paths aren't supported, but ~/ paths will be accepted
|
||
and prefixed with the SFTP server starting directory (more to come)
|
||
|
||
prompted by and discussed with deraadt@
|
||
ok markus@
|
||
|
||
OpenBSD-Commit-ID: 263a071f14555c045fd03132a8fb6cbd983df00d
|
||
|
||
commit b4b3f3da6cdceb3fd168b5fab69d11fba73bd0ae
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Mon Aug 9 07:21:01 2021 +0000
|
||
|
||
upstream: on fatal errors, make scp wait for ssh connection before
|
||
|
||
exiting avoids LogLevel=verbose (or greater) messages from ssh appearing
|
||
after scp has returned exited and control has returned to the shell; ok
|
||
markus@
|
||
|
||
(this was originally committed as r1.223 along with unrelated stuff that
|
||
I rolled back in r1.224)
|
||
|
||
OpenBSD-Commit-ID: 1261fd667ad918484889ed3d7aec074f3956a74b
|
||
|
||
commit 2ae7771749e0b4cecb107f9d4860bec16c3f4245
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Mon Aug 9 07:19:12 2021 +0000
|
||
|
||
upstream: rever r1.223 - I accidentally committed unrelated changes
|
||
|
||
OpenBSD-Commit-ID: fb73f3865b2647a27dd94db73d6589506a9625f9
|
||
|
||
commit 986abe94d481a1e82a01747360bd767b96b41eda
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Mon Aug 9 07:16:09 2021 +0000
|
||
|
||
upstream: show only the final path component in the progress meter;
|
||
|
||
more useful with long paths (that may truncate) and better matches
|
||
traditional scp behaviour; spotted by naddy@ ok deraadt@
|
||
|
||
OpenBSD-Commit-ID: 26b544d0074f03ebb8a3ebce42317d8d7ee291a3
|
||
|
||
commit 2b67932bb3176dee4fd447af4368789e04a82b93
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Mon Aug 9 07:13:54 2021 +0000
|
||
|
||
upstream: on fatal errors, make scp wait for ssh connection before
|
||
|
||
exiting avoids LogLevel=verbose (or greater) messages from ssh appearing
|
||
after scp has returned exited and control has returned to the shell; ok
|
||
markus@
|
||
|
||
OpenBSD-Commit-ID: ef9dab5ef5ae54a6a4c3b15d380568e94263456c
|
||
|
||
commit 724eb900ace30661d45db2ba01d0f924d95ecccb
|
||
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
||
Date: Sun Aug 8 08:49:09 2021 +0000
|
||
|
||
upstream: xstrdup environment variable used by ForwardAgent. bz#3328
|
||
|
||
from goetze at dovetail.com, ok djm@ deraadt@
|
||
|
||
OpenBSD-Commit-ID: 760320dac1c3b26904284ba417a7d63fccc5e742
|
||
|
||
commit 86b4cb3a884846b358305aad17a6ef53045fa41f
|
||
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
||
Date: Sun Aug 8 08:27:28 2021 +0000
|
||
|
||
upstream: Although it's POSIX, not all shells used in Portable support
|
||
|
||
the implicit 'in "$@"' after 'for i'.
|
||
|
||
OpenBSD-Regress-ID: 3c9aec6bca4868f85d2742b6ba5223fce110bdbc
|
||
|
||
commit f2ccf6c9f395923695f22345e626dfd691227aaf
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Sun Aug 8 17:39:56 2021 +1000
|
||
|
||
Move portable specific settings down.
|
||
|
||
This brings the top hunk of the file back in sync with OpenBSD
|
||
so patches to the CVS Id should apply instead of always being
|
||
rejected.
|
||
|
||
commit 71b0eb997e220b0fc9331635af409ad84979f2af
|
||
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
||
Date: Sun Aug 8 07:27:52 2021 +0000
|
||
|
||
upstream: Move setting of USER further down the startup In portable
|
||
|
||
we have to change this and having it in the same hunk as the CVS Id string
|
||
means applying changes fails every. single. time.
|
||
|
||
OpenBSD-Regress-ID: 87cd603eb6db58c9b430bf90adacb7f90864429b
|
||
|
||
commit f0aca2706c710a0da1a4be705f825a807cd15400
|
||
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
||
Date: Sun Aug 8 06:38:33 2021 +0000
|
||
|
||
upstream: Drop -q in ssh-log-wrapper.sh to preserve logs.
|
||
|
||
scp and sftp like to add -q to the command line passed to ssh which
|
||
overrides the LogLevel we set in the config files and suppresses output
|
||
to the debug logs so drop any "-q" from the invoked ssh. In the one
|
||
case where we actually want to use -q in the banner test, call the ssh
|
||
binary directly bypassing the logging wrapper.
|
||
|
||
OpenBSD-Regress-ID: e2c97d3c964bda33a751374c56f65cdb29755b75
|
||
|
||
commit cf27810a649c5cfae60f8ce66eeb25caa53b13bc
|
||
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
||
Date: Sat Aug 7 01:57:08 2021 +0000
|
||
|
||
upstream: Fix prototype mismatch for do_cmd. ok djm@
|
||
|
||
OpenBSD-Commit-ID: 1c1598bb5237a7ae0be99152f185e0071163714d
|
||
|
||
commit 85de69f64665245786e28c81ab01fe18b0e2a149
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Sat Aug 7 01:55:01 2021 +0000
|
||
|
||
upstream: sftp-client.c needs poll.h
|
||
|
||
remove unused variable
|
||
|
||
OpenBSD-Commit-ID: 233ac6c012cd23af62f237167a661db391055a16
|
||
|
||
commit 397c4d72e50023af5fe3aee5cc2ad407a6eb1073
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Sat Aug 7 11:30:57 2021 +1000
|
||
|
||
Include poll.h and friends for struct pollfd.
|
||
|
||
commit a9e2c533195f28627f205682482d9da384c4c52e
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Sat Aug 7 00:14:17 2021 +0000
|
||
|
||
upstream: do_upload() used a near-identical structure for
|
||
|
||
tracking expected status replies from the server to what do_download() was
|
||
using.
|
||
|
||
Refactor it to use the same structure and factor out some common
|
||
code into helper functions.
|
||
|
||
OpenBSD-Commit-ID: 0c167df8ab6df4a5292c32421922b0cf379e9054
|
||
|
||
commit 7b1cbcb7599d9f6a3bbad79d412604aa1203b5ee
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Sat Aug 7 00:12:09 2021 +0000
|
||
|
||
upstream: make scp(1) in SFTP mode follow symlinks like
|
||
|
||
traditional scp(1) ok markus@
|
||
|
||
OpenBSD-Commit-ID: 97255e55be37e8e26605e4ba1e69f9781765d231
|
||
|
||
commit 133b44e500422df68c9c25c3b6de35c0263132f1
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Sat Aug 7 00:10:49 2021 +0000
|
||
|
||
upstream: fix incorrect directory permissions on scp -3
|
||
|
||
transfers; ok markus@
|
||
|
||
OpenBSD-Commit-ID: 64b2abaa5635a2be65ee2e77688ad9bcebf576c2
|
||
|
||
commit 98b59244ca10e62ff67a420856770cb700164f59
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Sat Aug 7 00:09:57 2021 +0000
|
||
|
||
upstream: a bit more debugging of file attributes being
|
||
|
||
sent/received over the wire
|
||
|
||
OpenBSD-Commit-ID: f68c4e207b08ef95200a8b2de499d422808e089b
|
||
|
||
commit c677e65365d6f460c084e41e0c4807bb8a9cf601
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Sat Aug 7 00:08:52 2021 +0000
|
||
|
||
upstream: make scp(1) in SFTP mode output better match original
|
||
|
||
scp(1) by suppressing "Retrieving [path]" lines that were emitted to support
|
||
the interactive sftp(1) client. ok markus@
|
||
|
||
OpenBSD-Commit-ID: 06be293df5f156a18f366079be2f33fa68001acc
|
||
|
||
commit 48cd39b7a4e5e7c25101c6d1179f98fe544835cd
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Sat Aug 7 00:07:18 2021 +0000
|
||
|
||
upstream: factor out a structure duplicated between downloading
|
||
|
||
and crossloading; ok markus@
|
||
|
||
OpenBSD-Commit-ID: 96eede24d520569232086a129febe342e4765d39
|
||
|
||
commit 318c06bb04ee21a0cfa6b6022a201eacaa53f388
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Sat Aug 7 00:06:30 2021 +0000
|
||
|
||
upstream: use sftp_client crossloading to implement scp -3
|
||
|
||
feedback/ok markus@
|
||
|
||
OpenBSD-Commit-ID: 7db4c0086cfc12afc9cfb71d4c2fd3c7e9416ee9
|
||
|
||
commit de7115b373ba0be3861c65de9b606a3e0e9d29a3
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Sat Aug 7 00:02:41 2021 +0000
|
||
|
||
upstream: support for "cross"-loading files/directories, i.e.
|
||
|
||
downloading from one SFTP server while simultaneously uploading to another.
|
||
|
||
feedback & ok markus@
|
||
|
||
OpenBSD-Commit-ID: 3982878e29d8df0fa4ddc502f5ff6126ac714235
|
||
|
||
commit a50bd0367ff2063bbc70a387740a2aa6914de094
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Sat Aug 7 00:01:29 2021 +0000
|
||
|
||
upstream: factor our SSH2_FXP_OPEN calls into their own function;
|
||
|
||
"looks fine" markus@
|
||
|
||
OpenBSD-Commit-ID: d3dea2153f08855c6d9dacc01973248944adeffb
|
||
|
||
commit e3c0ba05873cf3d3f7d19d595667a251026b2d84
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Sat Aug 7 00:00:33 2021 +0000
|
||
|
||
upstream: prepare for scp -3 implemented via sftp
|
||
|
||
OpenBSD-Commit-ID: 194aac0dd87cb175334b71c2a30623a5ad55bb44
|
||
|
||
commit 395d8fbdb094497211e1461cf0e2f80af5617e0a
|
||
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
||
Date: Fri Aug 6 09:00:18 2021 +0000
|
||
|
||
upstream: Make diff invocation more portable.
|
||
|
||
POSIX does not require diff to have -N, so compare in both directions
|
||
with just -r, which should catch missing files in either directory.
|
||
|
||
OpenBSD-Regress-ID: 0e2ec8594556a6f369ed5a0a90c6806419b845f7
|
||
|
||
commit d247a73ce27b460138599648d9c637c6f2b77605
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Wed Aug 4 21:28:00 2021 +0000
|
||
|
||
upstream: regression test for scp -3
|
||
|
||
OpenBSD-Regress-ID: b44375d125c827754a1f722ec6b6b75b634de05d
|
||
|
||
commit 35c8e41a6f6d8ad76f8d1cd81ac2ea23d0d993b2
|
||
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
||
Date: Fri Aug 6 05:04:42 2021 +0000
|
||
|
||
upstream: Document "ProxyJump none". bz#3334.
|
||
|
||
OpenBSD-Commit-ID: f78cc6f55731f2cd35c3a41d5352ac1ee419eba7
|
||
|
||
commit 911ec6411821bda535d09778df7503b92f0eafab
|
||
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
||
Date: Wed Aug 4 01:34:55 2021 +0000
|
||
|
||
upstream: Allow for different (but POSIX compliant) behaviour of
|
||
|
||
basename(3) and prevent a use-after-free in that case in the new sftp-compat
|
||
code.
|
||
|
||
POSIX allows basename(3) to either return a pointer to static storage
|
||
or modify the passed string and return a pointer to that. OpenBSD does
|
||
the former and works as is, but on other platforms "filename" points
|
||
into "tmp" which was just freed. This makes the freeing of tmp
|
||
consistent with the other variable in the loop.
|
||
|
||
Pinpointed by the -portable Valgrind regress test. ok djm@ deraadt@
|
||
|
||
OpenBSD-Commit-ID: 750f3c19bd4440e4210e30dd5d7367386e833374
|
||
|
||
commit 6df1fecb5d3e51f3a8027a74885c3a44f6cbfcbd
|
||
Author: Damien Miller <djm@mindrot.org>
|
||
Date: Wed Aug 4 11:05:11 2021 +1000
|
||
|
||
use openbsd-compat glob.h is required
|
||
|
||
commit 9ebd1828881dfc9014a344587934a5ce7db6fa1b
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Tue Aug 3 21:03:23 2021 +1000
|
||
|
||
Missing space between macro arg and punctuation.
|
||
|
||
From jmc@
|
||
|
||
commit 0fd3f62eddc7cf54dcc9053be6f58998f3eb926a
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Tue Aug 3 21:02:33 2021 +1000
|
||
|
||
Avoid lines >80 chars. From jmc@
|
||
|
||
commit af5d8094d8b755e1daaf2e20ff1dc252800b4c9b
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Tue Aug 3 01:05:24 2021 +0000
|
||
|
||
upstream: regression tests for scp SFTP protocol support; mostly by
|
||
|
||
Jakub Jelen in GHPR#194 ok markus
|
||
|
||
OpenBSD-Regress-ID: 36f1458525bcb111741ec8547eaf58b13cddc715
|
||
|
||
commit e4673b7f67ae7740131a4ecea29a846593049a91
|
||
Author: anton@openbsd.org <anton@openbsd.org>
|
||
Date: Thu Jul 29 15:34:09 2021 +0000
|
||
|
||
upstream: Treat doas with arguments as a valid SUDO variable.
|
||
|
||
Allows one to specify SUDO="doas -n" which I do while running make regress.
|
||
|
||
ok dtucker@
|
||
|
||
OpenBSD-Regress-ID: 4fe5814b5010dbf0885500d703bea06048d11005
|
||
|
||
commit 197e29f1cca190d767c4b2b63a662f9a9e5da0b3
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Mon Aug 2 23:38:27 2021 +0000
|
||
|
||
upstream: support for using the SFTP protocol for file transfers in
|
||
|
||
scp, via a new "-M sftp" option. Marked as experimental for now.
|
||
|
||
Some corner-cases exist, in particular there is no attempt to
|
||
provide bug-compatibility with scp's weird "double shell" quoting
|
||
rules.
|
||
|
||
Mostly by Jakub Jelen in GHPR#194 with some tweaks by me. ok markus@
|
||
Thanks jmc@ for improving the scp.1 bits.
|
||
|
||
OpenBSD-Commit-ID: 6ce4c9157ff17b650ace571c9f7793d92874051c
|
||
|
||
commit dd533c7ab79d61a7796b77b64bd81b098e0d7f9f
|
||
Author: jmc@openbsd.org <jmc@openbsd.org>
|
||
Date: Fri Jul 30 14:28:13 2021 +0000
|
||
|
||
upstream: fix a formatting error and add some Xr; from debian at
|
||
|
||
helgefjell de
|
||
|
||
removed references to rlogin etc. as no longer relevant;
|
||
suggested by djm
|
||
|
||
ok djm dtucker
|
||
|
||
OpenBSD-Commit-ID: 3c431c303068d3aec5bb18573a0bd5e0cd77c5ae
|
||
|
||
commit c7cd347a8823819411222c1e10a0d26747d0fd5c
|
||
Author: jmc@openbsd.org <jmc@openbsd.org>
|
||
Date: Fri Jul 30 14:25:01 2021 +0000
|
||
|
||
upstream: fix a formatting error and mark up known_hosts
|
||
|
||
consistently; issues reported by debian at helgefjell de
|
||
|
||
ok djm dtucker
|
||
|
||
OpenBSD-Commit-ID: a1fd8d21dc77f507685443832df0c9700481b0ce
|
||
|
||
commit 4455aec2e4fc90f64ae4fc47e78ebc9c18721738
|
||
Author: jmc@openbsd.org <jmc@openbsd.org>
|
||
Date: Wed Jul 28 05:57:42 2021 +0000
|
||
|
||
upstream: no need to talk about version 2 with the -Q option, so
|
||
|
||
rewrite the text to read better;
|
||
|
||
issue reported by debian at helgefjell de
|
||
ok djm dtucker
|
||
|
||
OpenBSD-Commit-ID: 59fe2e8219c37906740ad062e0fdaea487dbe9cf
|
||
|
||
commit bec429338e9b30d2c7668060e82608286a8a4777
|
||
Author: jmc@openbsd.org <jmc@openbsd.org>
|
||
Date: Tue Jul 27 14:28:46 2021 +0000
|
||
|
||
upstream: word fix; reported by debian at helgefjell de
|
||
|
||
OpenBSD-Commit-ID: 0c6fd22142422a25343c5bd1a618f31618f41ece
|
||
|
||
commit efad4deb5a1f1cf79ebefd63c6625059060bfbe1
|
||
Author: jmc@openbsd.org <jmc@openbsd.org>
|
||
Date: Tue Jul 27 14:14:25 2021 +0000
|
||
|
||
upstream: standardise the grammar in the options list; issue
|
||
|
||
reported by debian at helgefjell de
|
||
|
||
ok dtucker djm
|
||
|
||
OpenBSD-Commit-ID: 7ac15575045d82f4b205a42cc7d5207fe4c3f8e6
|
||
|
||
commit 1e11fb24066f3fc259ee30db3dbb2a3127e05956
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Mon Aug 2 18:56:29 2021 +1000
|
||
|
||
Check for RLIMIT_NOFILE before trying to use it.
|
||
|
||
commit 0f494236b49fb48c1ef33669f14822ca4f3ce2f4
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Tue Jul 27 17:45:34 2021 +1000
|
||
|
||
lastenv is only used in setenv.
|
||
|
||
Prevents an unused variable warning on platforms that have setenv but
|
||
not unsetenv.
|
||
|
||
commit a1f78e08bdb3eaa88603ba3c6e01de7c8671e28a
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Mon Jul 26 12:45:30 2021 +1000
|
||
|
||
Move SUDO to "make test" command line.
|
||
|
||
Environment variables don't get passed by vmrun, so move to command
|
||
line.
|
||
|
||
commit 02e624273b9c78a49a01239159b8c09b8409b1a0
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Sun Jul 25 23:26:36 2021 +1000
|
||
|
||
Set SUDO for tests and cleanup.
|
||
|
||
commit 460ae5d93051bab70239ad823dd784822d58baad
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Sun Jul 25 22:37:55 2021 +1000
|
||
|
||
Pass OPENSSL=no to make tests too.
|
||
|
||
commit b398f499c68d74ebe3298b73757cf3f36e14e0cb
|
||
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
||
Date: Sun Jul 25 12:27:37 2021 +0000
|
||
|
||
upstream: Skip unit and makefile-based key conversion tests when
|
||
|
||
we're building with OPENSSL=no.
|
||
|
||
OpenBSD-Regress-ID: 20455ed9a977c93f846059d1fcb48e29e2c8d732
|
||
|
||
commit 727ce36c8c5941bde99216d27109405907caae4f
|
||
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
||
Date: Sun Jul 25 12:13:03 2021 +0000
|
||
|
||
upstream: Replace OPENSSL as the variable that points to the
|
||
|
||
openssl binary with OPENSSL_BIN. This will allow us to use the OPENSSL
|
||
variable from mk.conf or the make(1) command line indicating if we're
|
||
building with our without OpenSSL, and ultimately get the regress tests
|
||
working in the OPENSSL=no configuration.
|
||
|
||
OpenBSD-Regress-ID: 2d788fade3264d7803e5b54cae8875963f688c4e
|
||
|
||
commit 55e17101a9075f6a63af724261c5744809dcb95c
|
||
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
||
Date: Sat Jul 24 02:57:28 2021 +0000
|
||
|
||
upstream: Skip RFC4716 format import and export tests when built
|
||
|
||
without OpenSSL.
|
||
|
||
OpenBSD-Regress-ID: d2c2d5d38c1acc2b88cc99cfe00a2eb8bb39dfa4
|
||
|
||
commit f5ccb5895d39cd627ad9e7b2c671d2587616100d
|
||
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
||
Date: Sat Jul 24 02:51:14 2021 +0000
|
||
|
||
upstream: Don't omit ssh-keygen -y from usage when built without
|
||
|
||
OpenSSL. It is actually available, albeit only for ed25519 keys.
|
||
|
||
OpenBSD-Commit-ID: 7a254c33d0e6a55c30c6b016a8d298d3cb7a7674
|
||
|
||
commit 819d57ac23469f1f03baa8feb38ddefbada90fdc
|
||
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
||
Date: Sat Jul 24 02:08:13 2021 +0000
|
||
|
||
upstream: Exclude key conversion options from usage when built
|
||
|
||
without OpenSSL since those are not available, similar to what we currently
|
||
do with the moduli screening options. We can also use this to skip the
|
||
conversion regression tests in this case.
|
||
|
||
OpenBSD-Commit-ID: 3c82caa398cf99cd4518c23bba5a2fc66b16bafe
|
||
|
||
commit b6673b1d2ee90b4690ee84f634efe40225423c38
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Sat Jul 24 13:02:51 2021 +1000
|
||
|
||
Test OpenBSD upstream with and without OpenSSL.
|
||
|
||
commit 9d38074b5453c1abbdf888e80828c278d3b886ac
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Sat Jul 24 01:54:23 2021 +0000
|
||
|
||
upstream: test for first-match-wins in authorized_keys environment=
|
||
|
||
options
|
||
|
||
OpenBSD-Regress-ID: 1517c90276fe84b5dc5821c59f88877fcc34c0e8
|
||
|
||
commit 2b76f1dd19787e784711ea297ad8fc938b4484fd
|
||
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
||
Date: Fri Jul 23 05:53:02 2021 +0000
|
||
|
||
upstream: Simplify keygen-convert by using $SSH_KEYTYPES directly.
|
||
|
||
OpenBSD-Regress-ID: cdbe408ec3671ea9ee9b55651ee551370d2a4108
|
||
|
||
commit 7d64a9fb587ba9592f027f7a2264226c713d6579
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Sat Jul 24 01:55:19 2021 +0000
|
||
|
||
upstream: don't leak environment= variable when it is not the first
|
||
|
||
match
|
||
|
||
OpenBSD-Commit-ID: 7fbdc3dfe0032deaf003fd937eeb4d434ee4efe0
|
||
|
||
commit db2130e2340bf923e41c791aa9cd27b9e926042c
|
||
Author: jmc@openbsd.org <jmc@openbsd.org>
|
||
Date: Fri Jul 23 06:01:17 2021 +0000
|
||
|
||
upstream: punctuation;
|
||
|
||
OpenBSD-Commit-ID: 64be152e378c45975073ab1c07e0db7eddd15806
|
||
|
||
commit 03190d10980c6fc9124e988cb2df13101f266507
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Fri Jul 23 05:56:47 2021 +0000
|
||
|
||
upstream: mention in comment that read_passphrase(..., RP_ALLOW_STDIN)
|
||
|
||
will try to use askpass first. bz3314
|
||
|
||
convert a couple of debug() -> debug_f() while here
|
||
|
||
OpenBSD-Commit-ID: c7e812aebc28fcc5db06d4710e0f73613dee545c
|
||
|
||
commit 1653ece6832b2b304d46866b262d5f69880a9ec7
|
||
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
||
Date: Fri Jul 23 05:07:16 2021 +0000
|
||
|
||
upstream: Test conversion of ed25519 and ecdsa keys too.
|
||
|
||
OpenBSD-Regress-ID: 3676d2d00e58e0d6d37f2878f108cc2b83bbe4bb
|
||
|
||
commit 8b7af02dcf9d2b738787efd27da7ffda9859bed2
|
||
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
||
Date: Fri Jul 23 04:56:21 2021 +0000
|
||
|
||
upstream: Add test for exporting pubkey from a passphrase-protected
|
||
|
||
private key.
|
||
|
||
OpenBSD-Regress-ID: da99d93e7b235fbd5b5aaa01efc411225e6ba8ac
|
||
|
||
commit 441095d4a3e5048fe3c87a6c5db5bc3383d767fb
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Fri Jul 23 03:54:55 2021 +0000
|
||
|
||
upstream: regression test for time-limited signature keys
|
||
|
||
OpenBSD-Regress-ID: 2a6f3bd900dbee0a3c96f1ff23e032c93ab392bc
|
||
|
||
commit 9e1882ef6489a7dd16b6d7794af96629cae61a53
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Fri Jul 23 05:24:02 2021 +0000
|
||
|
||
upstream: note successful authentication method in final "Authenticated
|
||
|
||
to ..." message and partial auth success messages (all at LogLevel=verbose)
|
||
ok dtucker@
|
||
|
||
OpenBSD-Commit-ID: 06834b89ceb89f8f16c5321d368a66c08f441984
|
||
|
||
commit a917e973a1b90b40ff1e950df083364b48fc6c78
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Fri Jul 23 04:04:52 2021 +0000
|
||
|
||
upstream: Add a ForkAfterAuthentication ssh_config(5) counterpart
|
||
|
||
to the ssh(1) -f flag. Last part of GHPR231 from Volker Diels-Grabsch. ok
|
||
dtucker
|
||
|
||
OpenBSD-Commit-ID: b18aeda12efdebe2093d55263c90fe4ea0bce0d3
|
||
|
||
commit e0c5088f1c96a145eb6ea1dee438010da78f9ef5
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Fri Jul 23 04:00:59 2021 +0000
|
||
|
||
upstream: Add a StdinNull directive to ssh_config(5) that allows
|
||
|
||
the config file to do the same thing as -n does on the ssh(1) commandline.
|
||
Patch from Volker Diels-Grabsch via GHPR231; ok dtucker
|
||
|
||
OpenBSD-Commit-ID: 66ddf3f15c76796d4dcd22ff464aed1edd62468e
|
||
|
||
commit e3957e21ffdc119d6d04c0b1686f8e2fe052f5ea
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Fri Jul 23 03:57:20 2021 +0000
|
||
|
||
upstream: make authorized_keys environment="..." directives
|
||
|
||
first-match-wins and more strictly limit their maximum number; prompted by
|
||
OOM reported by OSS-fuzz (35470).
|
||
|
||
feedback and ok dtucker@
|
||
|
||
OpenBSD-Commit-ID: 01f63fc10dcd995e7aed9c378ad879161af83121
|
||
|
||
commit d0bb1ce731762c55acb95817df4d5fab526c7ecd
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Fri Jul 23 03:37:52 2021 +0000
|
||
|
||
upstream: Let allowed signers files used by ssh-keygen(1)
|
||
|
||
signatures support key lifetimes, and allow the verification mode to specify
|
||
a signature time to check at. This is intended for use by git to support
|
||
signing objects using ssh keys. ok dtucker@
|
||
|
||
OpenBSD-Commit-ID: 3e2c67b7dcd94f0610194d1e8e4907829a40cf31
|
||
|
||
commit 44142068dc7ef783d135e91ff954e754d2ed432e
|
||
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
||
Date: Mon Jul 19 08:48:33 2021 +0000
|
||
|
||
upstream: Use SUDO when setting up hostkey.
|
||
|
||
OpenBSD-Regress-ID: 990cf4481cab8dad62e90818a9b4b36c533851a7
|
||
|
||
commit 6b67f3f1d1d187597e54a139cc7785c0acebd9a2
|
||
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
||
Date: Mon Jul 19 05:08:54 2021 +0000
|
||
|
||
upstream: Increase time margin for rekey tests. Should help
|
||
|
||
reliability on very heavily loaded hosts.
|
||
|
||
OpenBSD-Regress-ID: 4c28a0fce3ea89ebde441d7091464176e9730533
|
||
|
||
commit 7953e1bfce9e76bec41c1331a29bc6cff9d416b8
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Mon Jul 19 13:47:51 2021 +1000
|
||
|
||
Add sshfp-connect.sh file missed in previous.
|
||
|
||
commit b75a80fa8369864916d4c93a50576155cad4df03
|
||
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
||
Date: Mon Jul 19 03:13:28 2021 +0000
|
||
|
||
upstream: Ensure that all returned SSHFP records for the specified host
|
||
|
||
name and hostkey type match instead of only one. While there, simplify the
|
||
code somewhat and add some debugging. Based on discussion in bz#3322, ok
|
||
djm@.
|
||
|
||
OpenBSD-Commit-ID: 0a6a0a476eb7f9dfe8fe2c05a1a395e3e9b22ee4
|
||
|
||
commit 1cc1fd095393663cd72ddac927d82c6384c622ba
|
||
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
||
Date: Mon Jul 19 02:21:50 2021 +0000
|
||
|
||
upstream: Id sync only, -portable already has this.
|
||
|
||
Put dh_set_moduli_file call inside ifdef WITH_OPENSSL. Fixes
|
||
build with OPENSSL=no.
|
||
|
||
OpenBSD-Commit-ID: af54abbebfb12bcde6219a44d544e18204defb15
|
||
|
||
commit 33abbe2f4153f5ca5c874582f6a7cc91ae167485
|
||
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
||
Date: Mon Jul 19 02:46:34 2021 +0000
|
||
|
||
upstream: Add test for host key verification via SSHFP records. This
|
||
|
||
requires some external setup to operate so is disabled by default (see
|
||
comments in sshfp-connect.sh).
|
||
|
||
OpenBSD-Regress-ID: c52c461bd1df3a803d17498917d156ef64512fd9
|
||
|
||
commit f0cd000d8e3afeb0416dce1c711c3d7c28d89bdd
|
||
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
||
Date: Mon Jul 19 02:29:28 2021 +0000
|
||
|
||
upstream: Add ed25519 key and test SSHFP export of it. Only test
|
||
|
||
RSA SSHFP export if we have RSA functionality compiled in.
|
||
|
||
OpenBSD-Regress-ID: b4ff5181b8c9a5862e7f0ecdd96108622333a9af
|
||
|
||
commit 0075511e27e5394faa28edca02bfbf13b9a6693e
|
||
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
||
Date: Mon Jul 19 00:16:26 2021 +0000
|
||
|
||
upstream: Group keygen tests together.
|
||
|
||
OpenBSD-Regress-ID: 07e2d25c527bb44f03b7c329d893a1f2d6c5c40c
|
||
|
||
commit 034828820c7e62652e7c48f9ee6b67fb7ba6fa26
|
||
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
||
Date: Sun Jul 18 23:10:10 2021 +0000
|
||
|
||
upstream: Add test for ssh-keygen printing of SSHFP records.
|
||
|
||
OpenBSD-Regress-ID: fde9566b56eeb980e149bbe157a884838507c46b
|
||
|
||
commit 52c3b6985ef1d5dadb4c4fe212f8b3a78ca96812
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Sat Jul 17 00:38:11 2021 +0000
|
||
|
||
upstream: wrap some long lines
|
||
|
||
OpenBSD-Commit-ID: 4f5186b1466656762dae37d3e569438d900c350d
|
||
|
||
commit 43ec991a782791d0b3f42898cd789f99a07bfaa4
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Sat Jul 17 00:36:53 2021 +0000
|
||
|
||
upstream: fix sftp on ControlPersist connections, broken by recent
|
||
|
||
SessionType change; spotted by sthen@
|
||
|
||
OpenBSD-Commit-ID: 4c5ddc5698790ae6ff50d2a4f8f832f0eeeaa234
|
||
|
||
commit 073f45c236550f158c9a94003e4611c07dea5279
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Fri Jul 16 09:00:23 2021 +0000
|
||
|
||
upstream: Explicitly check for and start time-based rekeying in the
|
||
|
||
client and server mainloops.
|
||
|
||
Previously the rekey timeout could expire but rekeying would not start
|
||
until a packet was sent or received. This could cause us to spin in
|
||
select() on the rekey timeout if the connection was quiet.
|
||
|
||
ok markus@
|
||
|
||
OpenBSD-Commit-ID: 4356cf50d7900f3df0a8f2117d9e07c91b9ff987
|
||
|
||
commit ef7c4e52d5d840607f9ca3a302a4cbb81053eccf
|
||
Author: jmc@openbsd.org <jmc@openbsd.org>
|
||
Date: Wed Jul 14 06:46:38 2021 +0000
|
||
|
||
upstream: reorder SessionType; ok djm
|
||
|
||
OpenBSD-Commit-ID: c7dd0b39e942b1caf4976a0b1cf0fed33d05418c
|
||
|
||
commit 8aa2f9aeb56506dca996d68ab90ab9c0bebd7ec3
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Wed Jul 14 11:26:50 2021 +1000
|
||
|
||
Make whitespace consistent.
|
||
|
||
commit 4f4297ee9b8a39f4dfd243a74c5f51f9e7a05723
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Wed Jul 14 11:26:12 2021 +1000
|
||
|
||
Add ARM64 Linux self-hosted runner.
|
||
|
||
commit eda8909d1b0a85b9c3804a04d03ec6738fd9dc7f
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Tue Jul 13 23:48:36 2021 +0000
|
||
|
||
upstream: add a SessionType directive to ssh_config, allowing the
|
||
|
||
configuration file to offer equivalent control to the -N (no session) and -s
|
||
(subsystem) command-line flags.
|
||
|
||
Part of GHPR#231 by Volker Diels-Grabsch with some minor tweaks;
|
||
feedback and ok dtucker@
|
||
|
||
OpenBSD-Commit-ID: 726ee931dd4c5cc7f1d7a187b26f41257f9a2d12
|
||
|
||
commit 7ae69f2628e338ba6e0eae7ee8a63bcf8fea7538
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Mon Jul 12 02:12:22 2021 +0000
|
||
|
||
upstream: fix some broken tests; clean up output
|
||
|
||
OpenBSD-Regress-ID: 1d5038edb511dc4ce1622344c1e724626a253566
|
||
|
||
commit f5fc6a4c3404bbf65c21ca6361853b33d78aa87e
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Mon Jul 12 18:00:05 2021 +1000
|
||
|
||
Add configure-time detection for SSH_TIME_T_MAX.
|
||
|
||
Should fix printing cert times exceeding INT_MAX (bz#3329) on platforms
|
||
were time_t is a long long. The limit used is for the signed type, so if
|
||
some system has a 32bit unsigned time_t then the lower limit will still
|
||
be imposed and we would need to add some way to detect this. Anyone using
|
||
an unsigned 64bit can let us know when it starts being a problem.
|
||
|
||
commit fd2d06ae4442820429d634c0a8bae11c8e40c174
|
||
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
||
Date: Mon Jul 12 06:22:57 2021 +0000
|
||
|
||
upstream: Make limit for time_t test unconditional in the
|
||
|
||
format_absolute_time fix for bz#3329 that allows printing of timestamps past
|
||
INT_MAX. This was incorrectly included with the previous commit. Based on
|
||
discussion with djm@.
|
||
|
||
OpenBSD-Commit-ID: 835936f6837c86504b07cabb596b613600cf0f6e
|
||
|
||
commit 6c29b387cd64a57b0ec8ae7d2c8d02789d88fcc3
|
||
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
||
Date: Mon Jul 12 06:08:57 2021 +0000
|
||
|
||
upstream: Use existing format_absolute_time() function when
|
||
|
||
printing cert validity instead of doing it inline. Part of bz#3329.
|
||
|
||
OpenBSD-Commit-ID: a13d4e3c4f59644c23745eb02a09b2a4e717c00c
|
||
|
||
commit 99981d5f8bfa383791afea03f6bce8454e96e323
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Fri Jul 9 09:55:56 2021 +0000
|
||
|
||
upstream: silence redundant error message; reported by Fabian Stelzer
|
||
|
||
OpenBSD-Commit-ID: 9349a703016579a60557dafd03af2fe1d44e6aa2
|
||
|
||
commit e86097813419b49d5bff5c4b51d1c3a5d4d2d804
|
||
Author: John Ericson <John.Ericson@Obsidian.Systems>
|
||
Date: Sat Dec 26 11:40:49 2020 -0500
|
||
|
||
Re-indent krb5 section after pkg-config addition.
|
||
|
||
commit 32dd2daa56c294e40ff7efea482c9eac536d8cbb
|
||
Author: John Ericson <John.Ericson@Obsidian.Systems>
|
||
Date: Sat Dec 26 11:40:49 2020 -0500
|
||
|
||
Support finding Kerberos via pkg-config
|
||
|
||
This makes cross compilation easier.
|
||
|
||
commit def7a72234d7e4f684d72d33a0f7229f9eee0aa4
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Fri Jul 9 14:34:06 2021 +1000
|
||
|
||
Update comments about EGD to include prngd.
|
||
|
||
commit b5d23150b4e3368f4983fd169d432c07afeee45a
|
||
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
||
Date: Mon Jul 5 01:21:07 2021 +0000
|
||
|
||
upstream: Fix a couple of whitespace things. Portable already has
|
||
|
||
these so this removes two diffs between the two.
|
||
|
||
OpenBSD-Commit-ID: 769f017ebafd8e741e337b3e9e89eb5ac73c9c56
|
||
|
||
commit 8f57be9f279b8e905f9883066aa633c7e67b31cf
|
||
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
||
Date: Mon Jul 5 01:16:46 2021 +0000
|
||
|
||
upstream: Order includes as per style(9). Portable already has
|
||
|
||
these so this removes a handful of diffs between the two.
|
||
|
||
OpenBSD-Commit-ID: 8bd7452d809b199c19bfc49511a798f414eb4a77
|
||
|
||
commit b75624f8733b3ed9e240f86cac5d4a39dae11848
|
||
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
||
Date: Mon Jul 5 00:50:25 2021 +0000
|
||
|
||
upstream: Remove comment referencing now-removed
|
||
|
||
RhostsRSAAuthentication. ok djm@
|
||
|
||
OpenBSD-Commit-ID: 3d864bfbd99a1d4429a58e301688f3be464827a9
|
||
|
||
commit b67eb12f013c5441bb4f0893a97533582ad4eb13
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Mon Jul 5 00:25:42 2021 +0000
|
||
|
||
upstream: allow spaces to appear in usernames for local to remote,
|
||
|
||
and scp -3 remote to remote copies. with & ok dtucker bz#1164
|
||
|
||
OpenBSD-Commit-ID: e9b550f3a85ffbb079b6720833da31317901d6dd
|
||
|
||
commit 8c4ef0943e574f614fc7c6c7e427fd81ee64ab87
|
||
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
||
Date: Fri Jul 2 07:20:44 2021 +0000
|
||
|
||
upstream: Remove obsolete comments about SSHv1 auth methods. ok
|
||
|
||
djm@
|
||
|
||
OpenBSD-Commit-ID: 6060f70966f362d8eb4bec3da2f6c4712fbfb98f
|
||
|
||
commit 88908c9b61bcb99f16e8d398fc41e2b3b4be2003
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Sat Jul 3 23:00:19 2021 +1000
|
||
|
||
Remove reference to ChallengeResponse.
|
||
|
||
challenge_response_authentication was removed from the struct, keeping
|
||
kbd_interactive_authentication.
|
||
|
||
commit 321874416d610ad2158ce6112f094a4862c2e37f
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Sat Jul 3 20:38:09 2021 +1000
|
||
|
||
Move signal.h up include order to match upstream.
|
||
|
||
commit 4fa83e2d0e32c2dd758653e0359984bbf1334f32
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Sat Jul 3 20:36:06 2021 +1000
|
||
|
||
Remove old OpenBSD version marker.
|
||
|
||
Looks like an accidental leftover from a sync.
|
||
|
||
commit 9d5e31f55d5f3899b72645bac41a932d298ad73b
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Sat Jul 3 20:34:19 2021 +1000
|
||
|
||
Remove duplicate error on error path.
|
||
|
||
There's an extra error() call on the listen error path, it looks like
|
||
its removal was missed during an upstream sync.
|
||
|
||
commit 888c459925c7478ce22ff206c9ac1fb812a40caf
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Sat Jul 3 20:32:46 2021 +1000
|
||
|
||
Remove some whitespace not in upstream.
|
||
|
||
Reduces diff vs OpenBSD by a small amount.
|
||
|
||
commit 4d2d4d47a18d93f3e0a91a241a6fdb545bbf7dc2
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Sat Jul 3 19:27:43 2021 +1000
|
||
|
||
Replace remaining references to ChallengeResponse.
|
||
|
||
Portable had a few additional references to ChallengeResponse related to
|
||
UsePAM, replaces these with equivalent keyboard-interactive ones.
|
||
|
||
commit 53237ac789183946dac6dcb8838bc3b6b9b43be1
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Sat Jul 3 19:23:28 2021 +1000
|
||
|
||
Sync remaining ChallengeResponse removal.
|
||
|
||
These were omitted from commit 88868fd131.
|
||
|
||
commit 2c9e4b319f7e98744b188b0f58859d431def343b
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Sat Jul 3 19:17:31 2021 +1000
|
||
|
||
Disable rocky84 to figure out why agent test fails
|
||
|
||
commit bfe19197a92b7916f64a121fbd3c179abf15e218
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Fri Jul 2 15:43:28 2021 +1000
|
||
|
||
Remove now-unused SSHv1 enums.
|
||
|
||
sRhostsRSAAuthentication and sRSAAuthentication are protocol 1 options
|
||
and are no longer used.
|
||
|
||
commit c73b02d92d72458a5312bd098f32ce88868fd131
|
||
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
||
Date: Fri Jul 2 05:11:20 2021 +0000
|
||
|
||
upstream: Remove references to ChallengeResponseAuthentication in
|
||
|
||
favour of KbdInteractiveAuthentication. The former is what was in SSHv1, the
|
||
latter is what is in SSHv2 (RFC4256) and they were treated as somewhat but
|
||
not entirely equivalent. We retain the old name as deprecated alias so
|
||
config files continue to work and a reference in the man page for people
|
||
looking for it.
|
||
|
||
Prompted by bz#3303 which pointed out the discrepancy between the two
|
||
when used with Match. Man page help & ok jmc@, with & ok djm@
|
||
|
||
OpenBSD-Commit-ID: 2c1bff8e5c9852cfcdab1f3ea94dfef5a22f3b7e
|
||
|
||
commit f841fc9c8c7568a3b5d84a4cc0cefacb7dbc16b9
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Fri Jul 2 15:20:32 2021 +1000
|
||
|
||
Fix ifdefs around get_random_bytes_prngd.
|
||
|
||
get_random_bytes_prngd() is used if either of PRNGD_PORT or PRNGD_SOCKET
|
||
are defined, so adjust ifdef accordingly.
|
||
|
||
commit 0767627cf66574484b9c0834500b42ea04fe528a
|
||
Author: Damien Miller <djm@mindrot.org>
|
||
Date: Fri Jul 2 14:30:23 2021 +1000
|
||
|
||
wrap get_random_bytes_prngd() in ifdef
|
||
|
||
avoid unused static function warning
|
||
|
||
commit f93fdc4de158386efe1116bd44c5b3f4a7a82c25
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Mon Jun 28 13:06:37 2021 +1000
|
||
|
||
Add rocky84 test target.
|
||
|
||
commit d443006c0ddfa7f6a5bd9c0ae92036f3d5f2fa3b
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Fri Jun 25 06:30:22 2021 +0000
|
||
|
||
upstream: fix decoding of X.509 subject name; from Leif Thuresson
|
||
|
||
via bz3327 ok markus@
|
||
|
||
OpenBSD-Commit-ID: 0ea2e28f39750dd388b7e317bc43dd997a217ae8
|
||
|
||
commit 2a5704ec142202d387fda2d6872fd4715ab81347
|
||
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
||
Date: Fri Jun 25 06:20:39 2021 +0000
|
||
|
||
upstream: Use better language to refer to the user. From l1ving
|
||
|
||
via github PR#250, ok jmc@
|
||
|
||
OpenBSD-Commit-ID: 07ca3526626996613e128aeddf7748c93c4d6bbf
|
||
|
||
commit 4bdf7a04797a0ea1c431a9d54588417c29177d19
|
||
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
||
Date: Fri Jun 25 03:38:17 2021 +0000
|
||
|
||
upstream: Replace SIGCHLD/notify_pipe kludge with pselect.
|
||
|
||
Previously sshd's SIGCHLD handler would wake up select() by writing a
|
||
byte to notify_pipe. We can remove this by blocking SIGCHLD, checking
|
||
for child terminations then passing the original signal mask through
|
||
to pselect. This ensures that the pselect will immediately wake up if
|
||
a child terminates between wait()ing on them and the pselect.
|
||
|
||
In -portable, for platforms that do not have pselect the kludge is still
|
||
there but is hidden behind a pselect interface.
|
||
|
||
Based on other changes for bz#2158, ok djm@
|
||
|
||
OpenBSD-Commit-ID: 202c85de0b3bdf1744fe53529a05404c5480d813
|
||
|
||
commit c9f7bba2e6f70b7ac1f5ea190d890cb5162ce127
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Fri Jun 25 15:08:18 2021 +1000
|
||
|
||
Move closefrom() to before first malloc.
|
||
|
||
When built against tcmalloc, tcmalloc allocates a descriptor for its
|
||
internal use, so calling closefrom() afterward causes the descriptor
|
||
number to be reused resulting in a corrupted connection. Moving the
|
||
closefrom a little earlier should resolve this. From kircherlike at
|
||
outlook.com via bz#3321, ok djm@
|
||
|
||
commit 7ebfe4e439853b88997c9cfc2ff703408a1cca92
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Fri Jun 18 20:41:45 2021 +1000
|
||
|
||
Put second -lssh in link line for sftp-server.
|
||
|
||
When building --without-openssl the recent port-prngd.c change adds
|
||
a dependency on atomicio, but since nothing else in sftp-server uses
|
||
it, the linker may not find it. Add a second -lssh similar to other
|
||
binaries.
|
||
|
||
commit e409d7966785cfd9f5970e66a820685c42169717
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Fri Jun 18 18:34:08 2021 +1000
|
||
|
||
Try EGD/PRNGD if random device fails.
|
||
|
||
When built --without-openssl, try EGD/PRGGD (if configured) as a last
|
||
resort before failing.
|
||
|
||
commit e43a898043faa3a965dbaa1193cc60e0b479033d
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Fri Jun 18 18:32:51 2021 +1000
|
||
|
||
Split EGD/PRNGD interface into its own file.
|
||
|
||
This will allow us to use it when building --without-openssl.
|
||
|
||
commit acb2887a769a1b1912cfd7067f3ce04fad240260
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Thu Jun 17 21:03:19 2021 +1000
|
||
|
||
Handle GIDs > 2^31 in getgrouplist.
|
||
|
||
When compiled in 32bit mode, the getgrouplist implementation may fail
|
||
for GIDs greater than LONG_MAX. Analysis and change from ralf.winkel
|
||
at tui.com.
|
||
|
||
commit 31fac20c941126281b527605b73bff30a8f02edd
|
||
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
||
Date: Thu Jun 10 09:46:28 2021 +0000
|
||
|
||
upstream: Use $SUDO when reading sshd's pidfile here too.
|
||
|
||
OpenBSD-Regress-ID: 6bfb0d455d493f24839034a629c5306f84dbd409
|
||
|
||
commit a3a58acffc8cc527f8fc6729486d34e4c3d27643
|
||
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
||
Date: Thu Jun 10 09:43:51 2021 +0000
|
||
|
||
upstream: Use $SUDO when reading sshd's pidfile in case it was
|
||
|
||
created with a very restrictive umask. This resyncs with -portable.
|
||
|
||
OpenBSD-Regress-ID: 07fd2af06df759d4f64b82c59094accca1076a5d
|
||
|
||
commit 249ad4ae51cd3bc235e75a4846eccdf8b1416611
|
||
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
||
Date: Thu Jun 10 09:37:59 2021 +0000
|
||
|
||
upstream: Set umask when creating hostkeys to prevent excessive
|
||
|
||
permissions warning.
|
||
|
||
OpenBSD-Regress-ID: 382841db0ee28dfef7f7bffbd511803e1b8ab0ef
|
||
|
||
commit 9d0892153c005cc65897e9372b01fa66fcbe2842
|
||
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
||
Date: Thu Jun 10 03:45:31 2021 +0000
|
||
|
||
upstream: Add regress test for SIGHUP restart
|
||
|
||
while handling active and unauthenticated clients. Should catch anything
|
||
similar to the pselect bug just fixed in sshd.c.
|
||
|
||
OpenBSD-Regress-ID: 3b3c19b5e75e43af1ebcb9586875b3ae3a4cac73
|
||
|
||
commit 73f6f191f44440ca3049b9d3c8e5401d10b55097
|
||
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
||
Date: Thu Jun 10 03:14:14 2021 +0000
|
||
|
||
upstream: Continue accept loop when pselect
|
||
|
||
returns -1, eg if it was interrupted by a signal. This should prevent
|
||
the hang discovered by sthen@ wherein sshd receives a SIGHUP while it has
|
||
an unauthenticated child and goes on to a blocking read on a notify_pipe.
|
||
feedback deraadt@, ok djm@
|
||
|
||
OpenBSD-Commit-ID: 0243c1c5544fca0974dae92cd4079543a3fceaa0
|
||
|
||
commit c785c0ae134a8e8b5c82b2193f64c632a98159e4
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Tue Jun 8 22:30:27 2021 +0000
|
||
|
||
upstream: test that UserKnownHostsFile correctly accepts multiple
|
||
|
||
arguments; would have caught readconf.c r1.356 regression
|
||
|
||
OpenBSD-Regress-ID: 71ca54e66c2a0211b04999263e56390b1f323a6a
|
||
|
||
commit 1a6f6b08e62c78906a3032e8d9a83e721c84574e
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Tue Jun 8 22:06:12 2021 +0000
|
||
|
||
upstream: fix regression in r1.356: for ssh_config options that
|
||
|
||
accepted multiple string arguments, ssh was only recording the first.
|
||
Reported by Lucas via bugs@
|
||
|
||
OpenBSD-Commit-ID: 7cbf182f7449bf1cb7c5b4452667dc2b41170d6d
|
||
|
||
commit 78e30af3e2b2dd540a341cc827c6b98dd8b0a6de
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Tue Jun 8 07:40:12 2021 +0000
|
||
|
||
upstream: test argv_split() optional termination on comments
|
||
|
||
OpenBSD-Regress-ID: 9fd1c4a27a409897437c010cfd79c54b639a059c
|
||
|
||
commit a023138957ea2becf1c7f93fcc42b0aaac6f2b03
|
||
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
||
Date: Tue Jun 8 07:05:27 2021 +0000
|
||
|
||
upstream: Add testcases from bz#3319 for IPQoS and TunnelDevice
|
||
|
||
being overridden on the command line.
|
||
|
||
OpenBSD-Regress-ID: 801674d5d2d02abd58274a78cab2711f11de14a8
|
||
|
||
commit 660cea10b2cdc11f13ba99c89b1bbb368a4d9ff2
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Tue Jun 8 06:52:43 2021 +0000
|
||
|
||
upstream: sprinkle some "# comment" at end of configuration lines
|
||
|
||
to test comment handling
|
||
|
||
OpenBSD-Regress-ID: cb82fbf40bda5c257a9f742c63b1798e5a8fdda7
|
||
|
||
commit acc9c32dcb6def6c7d3688bceb4c0e59bd26b411
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Tue Jun 8 06:51:47 2021 +0000
|
||
|
||
upstream: more descriptive failure message
|
||
|
||
OpenBSD-Regress-ID: 5300f6faf1d9e99c0cd10827b51756c5510e3509
|
||
|
||
commit ce04dd4eae23d1c9cf7c424a702f48ee78573bc1
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Mon Jun 7 01:16:34 2021 +0000
|
||
|
||
upstream: test AuthenticationMethods inside a Match block as well
|
||
|
||
as in the main config section
|
||
|
||
OpenBSD-Regress-ID: ebe0a686621b7cb8bb003ac520975279c28747f7
|
||
|
||
commit 9018bd821fca17e26e92f7a7e51d9b24cd62f2db
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Mon Jun 7 00:00:50 2021 +0000
|
||
|
||
upstream: prepare for stricter sshd_config parsing that will refuse
|
||
|
||
a config that has {Allow,Deny}{Users,Groups} on a line with no subsequent
|
||
arguments. Such lines are permitted but are nonsensical noops ATM
|
||
|
||
OpenBSD-Regress-ID: ef65463fcbc0bd044e27f3fe400ea56eb4b8f650
|
||
|
||
commit a10f929d1ce80640129fc5b6bc1acd9bf689169e
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Tue Jun 8 07:09:42 2021 +0000
|
||
|
||
upstream: switch sshd_config parsing to argv_split()
|
||
|
||
similar to the previous commit, this switches sshd_config parsing to
|
||
the newer tokeniser. Config parsing will be a little stricter wrt
|
||
quote correctness and directives appearing without arguments.
|
||
|
||
feedback and ok markus@
|
||
|
||
tested in snaps for the last five or so days - thanks Theo and those who
|
||
caught bugs
|
||
|
||
OpenBSD-Commit-ID: 9c4305631d20c2d194661504ce11e1f68b20d93e
|
||
|
||
commit ea9e45c89a4822d74a9d97fef8480707d584da4d
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Tue Jun 8 07:07:15 2021 +0000
|
||
|
||
upstream: Switch ssh_config parsing to use argv_split()
|
||
|
||
This fixes a couple of problems with the previous tokeniser,
|
||
strdelim()
|
||
|
||
1. strdelim() is permissive wrt accepting '=' characters. This is
|
||
intended to allow it to tokenise "Option=value" but because it
|
||
cannot keep state, it will incorrectly split "Opt=val=val2".
|
||
2. strdelim() has rudimentry handling of quoted strings, but it
|
||
is incomplete and inconsistent. E.g. it doesn't handle escaped
|
||
quotes inside a quoted string.
|
||
3. It has no support for stopping on a (unquoted) comment. Because
|
||
of this readconf.c r1.343 added chopping of lines at '#', but
|
||
this caused a regression because these characters may legitimately
|
||
appear inside quoted strings.
|
||
|
||
The new tokeniser is stricter is a number of cases, including #1 above
|
||
but previously it was also possible for some directives to appear
|
||
without arguments. AFAIK these were nonsensical in all cases, and the
|
||
new tokeniser refuses to accept them.
|
||
|
||
The new code handles quotes much better, permitting quoted space as
|
||
well as escaped closing quotes. Finally, comment handling should be
|
||
fixed - the tokeniser will terminate only on unquoted # characters.
|
||
|
||
feedback & ok markus@
|
||
|
||
tested in snaps for the last five or so days - thanks Theo and those who
|
||
caught bugs
|
||
|
||
OpenBSD-Commit-ID: dc72fd12af9d5398f4d9e159d671f9269c5b14d5
|
||
|
||
commit d786424986c04d1d375f231fda177c8408e05c3e
|
||
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
||
Date: Tue Jun 8 07:02:46 2021 +0000
|
||
|
||
upstream: Check if IPQoS or TunnelDevice are already set before
|
||
|
||
overriding. Prevents values in config files from overriding values supplied
|
||
on the command line. bz#3319, ok markus.
|
||
|
||
OpenBSD-Commit-ID: f3b08b898c324debb9195e6865d8999406938f74
|
||
|
||
commit aae4b4d3585b9f944d7dbd3c9e5ba0006c55e457
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Tue Jun 8 06:54:40 2021 +0000
|
||
|
||
upstream: Allow argv_split() to optionally terminate tokenisation
|
||
|
||
when it encounters an unquoted comment.
|
||
|
||
Add some additional utility function for working with argument
|
||
vectors, since we'll be switching to using them to parse
|
||
ssh/sshd_config shortly.
|
||
|
||
ok markus@ as part of a larger diff; tested in snaps
|
||
|
||
OpenBSD-Commit-ID: fd9c108cef2f713f24e3bc5848861d221bb3a1ac
|
||
|
||
commit da9f9acaac5bab95dca642b48e0c8182b246ab69
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Mon Jun 7 19:19:23 2021 +1000
|
||
|
||
Save logs on failure for upstream test
|
||
|
||
commit 76883c60161e5f3808787085a27a8c37f8cc4e08
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Mon Jun 7 14:36:32 2021 +1000
|
||
|
||
Add obsdsnap-i386 upstream test target.
|
||
|
||
commit d45b9c63f947ec5ec314696e70281f6afddc0ac3
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Mon Jun 7 03:38:38 2021 +0000
|
||
|
||
upstream: fix debug message when finding a private key to match a
|
||
|
||
certificate being attempted for user authentication. Previously it would
|
||
print the certificate's path, whereas it was supposed to be showing the
|
||
private key's path. Patch from Alex Sherwin via GHPR247
|
||
|
||
OpenBSD-Commit-ID: d5af3be66d0f22c371dc1fe6195e774a18b2327b
|
||
|
||
commit 530739d42f6102668aecd699be0ce59815c1eceb
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Sun Jun 6 11:34:16 2021 +0000
|
||
|
||
upstream: Match host certificates against host public keys, not private
|
||
|
||
keys. Allows use of certificates with private keys held in a ssh-agent.
|
||
Reported by Miles Zhou in bz3524; ok dtucker@
|
||
|
||
OpenBSD-Commit-ID: 25f5bf70003126d19162862d9eb380bf34bac22a
|
||
|
||
commit 4265215d7300901fd7097061c7517688ade82f8e
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Sun Jun 6 03:40:39 2021 +0000
|
||
|
||
upstream: Client-side workaround for a bug in OpenSSH 7.4: this release
|
||
|
||
allows RSA/SHA2 signatures for public key authentication but fails to
|
||
advertise this correctly via SSH2_MSG_EXT_INFO. This causes clients of these
|
||
server to incorrectly match PubkeyAcceptedAlgorithms and potentially refuse
|
||
to offer valid keys.
|
||
|
||
Reported by and based on patch from Gordon Messmer via bz3213, thanks
|
||
also for additional analysis by Jakub Jelen. ok dtucker
|
||
|
||
OpenBSD-Commit-ID: d6d0b7351d5d44c45f3daaa26efac65847a564f7
|
||
|
||
commit bda270d7fb8522d43c21a79a4b02a052d7c64de8
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Sun Jun 6 03:17:02 2021 +0000
|
||
|
||
upstream: degrade gracefully if a sftp-server offers the
|
||
|
||
limits@openssh.com extension but fails when the client tries to invoke it.
|
||
Reported by Hector Martin via bz3318
|
||
|
||
OpenBSD-Commit-ID: bd9d1839c41811616ede4da467e25746fcd9b967
|
||
|
||
commit d345d5811afdc2d6923019b653cdd93c4cc95f76
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Sun Jun 6 03:15:39 2021 +0000
|
||
|
||
upstream: the limits@openssh.com extension was incorrectly marked
|
||
|
||
as an operation that writes to the filesystem, which made it unavailable in
|
||
sftp-server read-only mode. Spotted by Hector Martin via bz3318
|
||
|
||
OpenBSD-Commit-ID: f054465230787e37516c4b57098fc7975e00f067
|
||
|
||
commit 2b71010d9b43d7b8c9ec1bf010beb00d98fa765a
|
||
Author: naddy@openbsd.org <naddy@openbsd.org>
|
||
Date: Sat Jun 5 13:47:00 2021 +0000
|
||
|
||
upstream: PROTOCOL.certkeys: update reference from IETF draft to
|
||
|
||
RFC
|
||
|
||
Also fix some typos.
|
||
ok djm@
|
||
|
||
OpenBSD-Commit-ID: 5e855b6c5a22b5b13f8ffa3897a868e40d349b44
|
||
|
||
commit aa99b2d9a3e45b943196914e8d8bf086646fdb54
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Fri Jun 4 23:41:29 2021 +1000
|
||
|
||
Clear notify_pipe from readset if present.
|
||
|
||
Prevents leaking an implementation detail to the caller.
|
||
|
||
commit 6de8dadf6b4d0627d35bca0667ca44b1d61c2c6b
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Fri Jun 4 23:24:25 2021 +1000
|
||
|
||
space->tabs.
|
||
|
||
commit c8677065070ee34c05c7582a9c2f58d8642e552d
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Fri Jun 4 18:39:48 2021 +1000
|
||
|
||
Add pselect implementation for platforms without.
|
||
|
||
This is basically the existing notify_pipe kludge from serverloop.c
|
||
moved behind a pselect interface. It works by installing a signal
|
||
handler that writes to a pipe that the select is watching, then calls
|
||
the original handler.
|
||
|
||
The select call in serverloop will become pselect soon, at which point the
|
||
kludge will be removed from thereand will only exist in the compat layer.
|
||
Original code by markus, help from djm.
|
||
|
||
commit 7cd7f302d3a072748299f362f9e241d81fcecd26
|
||
Author: Vincent Brillault <vincent.brillault@cern.ch>
|
||
Date: Sun May 24 09:15:06 2020 +0200
|
||
|
||
auth_log: dont log partial successes as failures
|
||
|
||
By design, 'partial' logins are successful logins, so initially with
|
||
authenticated set to 1, for which another authentication is required. As
|
||
a result, authenticated is always reset to 0 when partial is set to 1.
|
||
However, even if authenticated is 0, those are not failed login
|
||
attempts, similarly to attempts with authctxt->postponed set to 1.
|
||
|
||
commit e7606919180661edc7f698e6a1b4ef2cfb363ebf
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Fri Jun 4 06:19:07 2021 +0000
|
||
|
||
upstream: The RB_GENERATE_STATIC(3) macro expands to a series of
|
||
|
||
function definitions and not a statement, so there should be no semicolon
|
||
following them. Patch from Michael Forney
|
||
|
||
OpenBSD-Commit-ID: c975dd180580f0bdc0a4d5b7d41ab1f5e9b7bedd
|
||
|
||
commit c298c4da574ab92df2f051561aeb3e106b0ec954
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Fri Jun 4 05:59:18 2021 +0000
|
||
|
||
upstream: rework authorized_keys example section, removing irrelevant
|
||
|
||
stuff, de-wrapping the example lines and better aligning the examples with
|
||
common usage and FAQs; ok jmc
|
||
|
||
OpenBSD-Commit-ID: d59f1c9281f828148e2a2e49eb9629266803b75c
|
||
|
||
commit d9cb35bbec5f623589d7c58fc094817b33030f35
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Fri Jun 4 05:10:03 2021 +0000
|
||
|
||
upstream: adjust SetEnv description to clarify $TERM handling
|
||
|
||
OpenBSD-Commit-ID: 8b8cc0124856bc1094949d55615e5c44390bcb22
|
||
|
||
commit 771f57a8626709f2ad207058efd68fbf30d31553
|
||
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
||
Date: Fri Jun 4 05:09:08 2021 +0000
|
||
|
||
upstream: Switch the listening select loop from select() to
|
||
|
||
pselect() and mask signals while checking signal flags, umasking for pselect
|
||
and restoring afterwards. Also restore signals before sighup_restart so they
|
||
don't remain blocked after restart.
|
||
|
||
This prevents a race where a SIGTERM or SIGHUP can arrive between
|
||
checking the flag and calling select (eg if sshd is processing a
|
||
new connection) resulting in sshd not shutting down until the next
|
||
time it receives a new connection. bz#2158, with & ok djm@
|
||
|
||
OpenBSD-Commit-ID: bf85bf880fd78e00d7478657644fcda97b9a936f
|
||
|
||
commit f64f8c00d158acc1359b8a096835849b23aa2e86
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Fri Jun 4 05:02:40 2021 +0000
|
||
|
||
upstream: allow ssh_config SetEnv to override $TERM, which is otherwise
|
||
|
||
handled specially by the protocol. Useful in ~/.ssh/config to set TERM to
|
||
something generic (e.g. "xterm" instead of "xterm-256color") for destinations
|
||
that lack terminfo entries. feedback and ok dtucker@
|
||
|
||
OpenBSD-Commit-ID: 38b1ef4d5bc159c7d9d589d05e3017433e2d5758
|
||
|
||
commit 60107677dc0ce1e93c61f23c433ad54687fcd9f5
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Fri Jun 4 04:02:21 2021 +0000
|
||
|
||
upstream: correct extension name "no-presence-required" =>
|
||
|
||
"no-touch-required"
|
||
|
||
document "verify-required" option
|
||
|
||
OpenBSD-Commit-ID: 1879ff4062cf61d79b515e433aff0bf49a6c55c5
|
||
|
||
commit ecc186e46e3e30f27539b4311366dfda502f0a08
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Wed Jun 2 13:54:11 2021 +1000
|
||
|
||
Retire fbsd7 test target.
|
||
|
||
It's the slowest of the selfhosted targets (since it's 32bit but has
|
||
most of the crypto algos). We still have coverage for 32bit i386.
|
||
|
||
commit 5de0867b822ec48b5eec9abde0f5f95d1d646546
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Wed Jun 2 11:21:40 2021 +1000
|
||
|
||
Check for $OPENSSL in md5 fallback too.
|
||
|
||
commit 1db69d1b6542f8419c04cee7fd523a4a11004be2
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Wed Jun 2 11:17:54 2021 +1000
|
||
|
||
Add dfly60 target.
|
||
|
||
commit a3f2dd955f1c19cad387a139f0e719af346ca6ef
|
||
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
||
Date: Wed Jun 2 00:17:45 2021 +0000
|
||
|
||
upstream: Merge back shell portability changes
|
||
|
||
bringing it back in sync with -portable.
|
||
|
||
OpenBSD-Regress-ID: c07905ba931e66ad7d849b87b7d19648007175d1
|
||
|
||
commit 9d482295c9f073e84d75af46b720a1c0f7ec2867
|
||
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
||
Date: Tue Jun 1 23:56:20 2021 +0000
|
||
|
||
upstream: Use a default value for $OPENSSL,
|
||
|
||
allowing it to be overridden. Do the same in the PuTTY tests since it's
|
||
needed there and not exported by test-exec.sh.
|
||
|
||
OpenBSD-Regress-ID: c49dcd6aa7602a8606b7afa192196ca1fa65de16
|
||
|
||
commit 07660b3c99f8ea74ddf4a440e55c16c9f7fb3dd1
|
||
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
||
Date: Mon May 24 10:25:18 2021 +0000
|
||
|
||
upstream: Find openssl binary via environment variable. This
|
||
|
||
allows overriding if necessary (eg in -portable where we're testing against a
|
||
specific version of OpenSSL).
|
||
|
||
OpenBSD-Regress-ID: 491f39cae9e762c71aa4bf045803d077139815c5
|
||
|
||
commit 1a4d1da9188d7c88f646b61f0d6a3b34f47c5439
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Fri May 21 04:03:47 2021 +0000
|
||
|
||
upstream: fix memleak in test
|
||
|
||
OpenBSD-Regress-ID: 5e529d0982aa04666604936df43242e97a7a6f81
|
||
|
||
commit 60455a5d98065a73ec9a1f303345856bbd49aecc
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Fri May 21 03:59:01 2021 +0000
|
||
|
||
upstream: also check contents of remaining string
|
||
|
||
OpenBSD-Regress-ID: d526fa07253f4eebbc7d6205a0ab3d491ec71a28
|
||
|
||
commit 39f6cd207851d7b67ca46903bfce4a9f615b5b1c
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Fri May 21 03:48:07 2021 +0000
|
||
|
||
upstream: unit test for misc.c:strdelim() that mostly servces to
|
||
|
||
highlight its inconsistencies
|
||
|
||
OpenBSD-Regress-ID: 8d2bf970fcc01ccc6e36a5065f89b9c7fa934195
|
||
|
||
commit 7a3a1dd2c7d4461962acbcc0ebee9445ba892be0
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Thu May 27 21:23:15 2021 +1000
|
||
|
||
Put minix3 config in the host-specific block.
|
||
|
||
commit 59a194825f12fff8a7f75d91bf751ea17645711b
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Mon May 31 06:48:42 2021 +0000
|
||
|
||
upstream: Hash challenge supplied by client during FIDO key enrollment
|
||
|
||
prior to passing it to libfido2, which does expect a hash.
|
||
|
||
There is no effect for users who are simply generating FIDO keys using
|
||
ssh-keygen - by default we generate a random 256 bit challenge, but
|
||
people building attestation workflows around our tools should now have
|
||
a more consistent experience (esp. fewer failures when they fail to
|
||
guess the magic 32-byte challenge length requirement).
|
||
|
||
ok markus@
|
||
|
||
OpenBSD-Commit-ID: b8d5363a6a7ca3b23dc28f3ca69470472959f2b5
|
||
|
||
commit eb68e669bc8ab968d4cca5bf1357baca7136a826
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Thu May 27 21:14:15 2021 +1000
|
||
|
||
Include login_cap.h for login_getpwclass override.
|
||
|
||
On minix3, login_getpwclass is __RENAME'ed to __login_getpwclass50 so
|
||
without this the include overriding login_getpwclass causes a compile
|
||
error.
|
||
|
||
commit 2063af71422501b65c7a92a5e14c0e6a3799ed89
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Thu May 27 21:13:38 2021 +1000
|
||
|
||
Add minix3 test target.
|
||
|
||
commit 2e1efcfd9f94352ca5f4b6958af8a454f8cf48cd
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Wed May 26 01:47:24 2021 +0000
|
||
|
||
upstream: fix SEGV in UpdateHostkeys debug() message, triggered
|
||
|
||
when the update removed more host keys than remain present. Fix tested by
|
||
reporter James Cook, via bugs@
|
||
|
||
OpenBSD-Commit-ID: 44f641f6ee02bb957f0c1d150495b60cf7b869d3
|
||
|
||
commit 9acd76e6e4d2b519773e7119c33cf77f09534909
|
||
Author: naddy@openbsd.org <naddy@openbsd.org>
|
||
Date: Sun May 23 18:22:57 2021 +0000
|
||
|
||
upstream: ssh: The client configuration keyword is
|
||
|
||
"hostbasedacceptedalgorithms"
|
||
|
||
This fixes a mistake that slipped in when "HostbasedKeyTypes" was
|
||
renamed to "HostbasedAcceptedAlgorithms".
|
||
|
||
Bug report by zack@philomathiclife.com
|
||
|
||
OpenBSD-Commit-ID: d745a7e8e50b2589fc56877f322ea204bc784f38
|
||
|
||
commit 078a0e60c92700da4c536c93c007257828ccd05b
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Tue May 25 11:40:47 2021 +1000
|
||
|
||
Rename README.md to ci-status.md.
|
||
|
||
The original intent was to provide a status page for the CIs configured
|
||
in that directory, but it had the side effect of replacing the top-level
|
||
README.md.
|
||
|
||
commit 7be4ac813662f68e89f23c50de058a49aa32f7e4
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Wed May 19 01:24:05 2021 +0000
|
||
|
||
upstream: restore blocking status on stdio fds before close
|
||
|
||
ssh(1) needs to set file descriptors to non-blocking mode to operate
|
||
but it was not restoring the original state on exit. This could cause
|
||
problems with fds shared with other programs via the shell, e.g.
|
||
|
||
> $ cat > test.sh << _EOF
|
||
> #!/bin/sh
|
||
> {
|
||
> ssh -Fnone -oLogLevel=verbose ::1 hostname
|
||
> cat /usr/share/dict/words
|
||
> } | sleep 10
|
||
> _EOF
|
||
> $ ./test.sh
|
||
> Authenticated to ::1 ([::1]:22).
|
||
> Transferred: sent 2352, received 2928 bytes, in 0.1 seconds
|
||
> Bytes per second: sent 44338.9, received 55197.4
|
||
> cat: stdout: Resource temporarily unavailable
|
||
|
||
This restores the blocking status for fds 0,1,2 (stdio) before ssh(1)
|
||
abandons/closes them.
|
||
|
||
This was reported as bz3280 and GHPR246; ok dtucker@
|
||
|
||
OpenBSD-Commit-ID: 8cc67346f05aa85a598bddf2383fcfcc3aae61ce
|
||
|
||
commit c4902e1a653c67fea850ec99c7537f358904c0af
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Mon May 17 11:43:16 2021 +0000
|
||
|
||
upstream: fix breakage of -W forwaring introduced in 1.554; reported by
|
||
|
||
naddy@ and sthen@, ok sthen@
|
||
|
||
OpenBSD-Commit-ID: f72558e643a26dc4150cff6e5097b5502f6c85fd
|
||
|
||
commit afea01381ad1fcea1543b133040f75f7542257e6
|
||
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
||
Date: Mon May 17 07:22:45 2021 +0000
|
||
|
||
upstream: Regenerate moduli.
|
||
|
||
OpenBSD-Commit-ID: 83c93a2a07c584c347ac6114d6329b18ce515557
|
||
|
||
commit be2866d6207b090615ff083c9ef212b603816a56
|
||
Author: Damien Miller <djm@mindrot.org>
|
||
Date: Mon May 17 09:40:23 2021 +1000
|
||
|
||
Handle Android libc returning NULL pw->pw_passwd
|
||
|
||
Reported by Luke Dashjr
|
||
|
||
commit 5953c143008259d87342fb5155bd0b8835ba88e5
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Fri May 14 05:20:32 2021 +0000
|
||
|
||
upstream: fix previous: test saved no_shell_flag, not the one that just
|
||
|
||
got clobbered
|
||
|
||
OpenBSD-Commit-ID: b8deace085d9d941b2d02f810243b9c302e5355d
|
||
|
||
commit 1e9fa55f4dc4b334651d569d3448aaa3841f736f
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Fri May 14 03:09:48 2021 +0000
|
||
|
||
upstream: Fix ssh started with ControlPersist incorrectly executing a
|
||
|
||
shell when the -N (no shell) option was specified. bz3290 reported by Richard
|
||
Schwab; patch from markus@ ok me
|
||
|
||
OpenBSD-Commit-ID: ea1ea4af16a95687302f7690bdbe36a6aabf87e1
|
||
|
||
commit d1320c492f655d8f5baef8c93899d79dded217a5
|
||
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
||
Date: Wed May 12 11:34:30 2021 +0000
|
||
|
||
upstream: Clarify language about moduli. While both ends of the
|
||
|
||
connection do need to use the same parameters (ie groups), the DH-GEX
|
||
protocol takes care of that and both ends do not need the same contents in
|
||
the moduli file, which is what the previous text suggested. ok djm@ jmc@
|
||
|
||
OpenBSD-Commit-ID: f0c18cc8e79c2fbf537a432a9070ed94e96a622a
|
||
|
||
commit d3cc4d650ce3e59f3e370b101778b0e8f1c02c4d
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Fri May 7 04:11:51 2021 +0000
|
||
|
||
upstream: include pid in LogVerbose spam
|
||
|
||
OpenBSD-Commit-ID: aacb86f96ee90c7cb84ec27452374285f89a7f00
|
||
|
||
commit e3c032333be5fdbbaf2751f6f478e044922b4ec4
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Fri May 7 03:09:38 2021 +0000
|
||
|
||
upstream: don't sigdie() in signal handler in privsep child process;
|
||
|
||
this can end up causing sandbox violations per bz3286; ok dtucker@
|
||
|
||
OpenBSD-Commit-ID: a7f40b2141dca4287920da68ede812bff7ccfdda
|
||
|
||
commit a4039724a3f2abac810735fc95cf9114a3856049
|
||
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
||
Date: Fri May 7 09:23:40 2021 +0000
|
||
|
||
upstream: Increase ConnectionAttempts from 4 to 10 as the tests
|
||
|
||
occasionally time out on heavily loaded hosts.
|
||
|
||
OpenBSD-Regress-ID: 29a8cdef354fc9da471a301f7f65184770434f3a
|
||
|
||
commit c0d7e36e979fa3cdb60f5dcb6ac9ad3fd018543b
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Fri May 7 02:26:55 2021 +0000
|
||
|
||
upstream: dump out a usable private key string too; inspired by Tyson
|
||
|
||
Whitehead
|
||
|
||
OpenBSD-Regress-ID: 65572d5333801cb2f650ebc778cbdc955e372058
|
||
|
||
commit 24fee8973abdf1c521cd2c0047d89e86d9c3fc38
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Fri May 7 02:29:40 2021 +0000
|
||
|
||
upstream: correct mistake in spec - the private key blobs are encoded
|
||
|
||
verbatim and not as strings (i.e. no 4-byte length header)
|
||
|
||
OpenBSD-Commit-ID: 3606b5d443d72118c5b76c4af6dd87a5d5a4f837
|
||
|
||
commit f43859159cc62396ad5d080f0b1f2635a67dac02
|
||
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
||
Date: Tue May 4 22:53:52 2021 +0000
|
||
|
||
upstream: Don't pass NULL as a string in debugging as it does not work
|
||
|
||
on some platforms in -portable. ok djm@
|
||
|
||
OpenBSD-Commit-ID: 937c892c99aa3c9c272a8ed78fa7c2aba3a44fc9
|
||
|
||
commit ac31aa3c6341905935e75f0539cf4a61bbe99779
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Mon May 3 00:16:45 2021 +0000
|
||
|
||
upstream: more debugging for UpdateHostKeys signature failures
|
||
|
||
OpenBSD-Commit-ID: 1ee95f03875e1725df15d5e4bea3e73493d57d36
|
||
|
||
commit 8e32e97e788e0676ce83018a742203614df6a2b3
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Sat May 1 20:07:47 2021 +1000
|
||
|
||
Add obsd69 test target.
|
||
|
||
commit f06893063597c5bb9d9e93f851c4070e77d2fba9
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Fri Apr 30 04:29:53 2021 +0000
|
||
|
||
upstream: a little debugging in the main mux process for status
|
||
|
||
confirmation failures in multiplexed sessions
|
||
|
||
OpenBSD-Commit-ID: 6e27b87c95176107597035424e1439c3232bcb49
|
||
|
||
commit e65cf00da6bc31e5f54603b7feb7252dc018c033
|
||
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
||
Date: Fri Apr 30 04:02:52 2021 +0000
|
||
|
||
upstream: Remove now-unused skey function prototypes leftover from
|
||
|
||
skey removal.
|
||
|
||
OpenBSD-Commit-ID: 2fc36d519fd37c6f10ce74854c628561555a94c3
|
||
|
||
commit ae5f9b0d5c8126214244ee6b35aae29c21028133
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Thu Apr 29 13:01:50 2021 +1000
|
||
|
||
Wrap sntrup761x25519 inside ifdef.
|
||
|
||
From balu.gajjala at gmail.com via bz#3306.
|
||
|
||
commit 70a8dc138a6480f85065cdb239915ad4b7f928cf
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Wed Apr 28 14:44:07 2021 +1000
|
||
|
||
Add status badges for Actions-based tests.
|
||
|
||
commit 40b59024cc3365815381474cdf4fe423102e391b
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Wed Apr 28 12:22:11 2021 +1000
|
||
|
||
Add obsdsnap (OpenBSD snapshot) test target.
|
||
|
||
commit e627067ec8ef9ae8e7a638f4dbac91d52dee3e6d
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Wed Apr 28 11:35:28 2021 +1000
|
||
|
||
Add test building upstream OpenBSD source.
|
||
|
||
commit 1b8108ebd12fc4ed0fb39ef94c5ba122558ac373
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Tue Apr 27 14:22:20 2021 +1000
|
||
|
||
Test against OpenSSL 1.1.0h instead of 1.1.0g.
|
||
|
||
1.1.0g requires a perl glob module that's not installed by default.
|
||
|
||
commit 9bc20efd39ce8525be33df3ee009f5a4564224f1
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Tue Apr 27 12:37:59 2021 +1000
|
||
|
||
Use the default VM type for libcrypto ver tests.
|
||
|
||
commit 9f79e80dc40965c2e73164531250b83b176c1eea
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Tue Apr 27 12:24:10 2021 +1000
|
||
|
||
Always build OpenSSL shared.
|
||
|
||
This is the default for current versions but we need it to test against
|
||
earlier versions.
|
||
|
||
commit b3cc9fbdff2782eca79e33e02ac22450dc63bce9
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Tue Apr 27 09:18:02 2021 +1000
|
||
|
||
Fix custom OpenSSL tests.
|
||
|
||
Check out specified OpenSSL version. Install custom libcrypto where
|
||
configure expects to find it. Remove unneeded OpenSSL config time
|
||
options. Older OpenSSL versions were not make -j safe so remove it.
|
||
|
||
commit 77532609874a99a19e3e2eb2d1b7fa93aef963bb
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Mon Apr 26 17:18:25 2021 +1000
|
||
|
||
Export CC and CFLAGS for c89 test.
|
||
|
||
commit 33f62dfbe865f4de77980ab88774bf1eb5e4e040
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Mon Apr 26 17:13:44 2021 +1000
|
||
|
||
Add c89 here too.
|
||
|
||
commit da9d59f526fce58e11cba49cd8eb011dc0bf5677
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Mon Apr 26 15:34:23 2021 +1000
|
||
|
||
Add test against OpenSSL w/out ECC.
|
||
|
||
commit 29e194a752359ebf85bf7fce100f23a0477fc4de
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Mon Apr 26 14:49:59 2021 +1000
|
||
|
||
Ensure we can still build with C89.
|
||
|
||
commit a38016d369d21df5d35f761f2b67e175e132ba22
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Mon Apr 26 14:29:03 2021 +1000
|
||
|
||
Interop test agains PuTTY.
|
||
|
||
commit 095b0307a77be8803768857cc6c0963fa52ed85b
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Mon Apr 26 14:02:03 2021 +1000
|
||
|
||
Support testing against arbitary libcrytpo vers.
|
||
|
||
Add tests against various LibreSSL and OpenSSL versions.
|
||
|
||
commit b16082aa110fa7128ece2a9037ff420c4a285317
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Mon Apr 26 13:35:44 2021 +1000
|
||
|
||
Add fbsd10 test target.
|
||
|
||
commit 2c805f16b24ea37cc051c6018fcb05defab6e57a
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Sun Apr 25 14:15:02 2021 +1000
|
||
|
||
Disable compiler hardening on nbsd4.
|
||
|
||
The system compiler supports -fstack-protector-all, but using it will
|
||
result in an internal compiler error on some files.
|
||
|
||
commit 6a5d39305649da5dff1934ee54292ee0cebd579d
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Sun Apr 25 13:01:34 2021 +1000
|
||
|
||
Add nbsd3, nbsd4 and nbsd9 test targets.
|
||
|
||
commit d1aed05bd2e4ae70f359a394dc60a2d96b88f78c
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Sat Apr 24 22:03:46 2021 +1000
|
||
|
||
Comment out nbsd2 test target for now.
|
||
|
||
commit a6b4ec94e5bd5a8a18cd2c9942d829d2e5698837
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Sat Apr 24 17:52:24 2021 +1000
|
||
|
||
Add OPENBSD ORIGINAL marker.
|
||
|
||
commit 3737c9f66ee590255546c4b637b6d2be669a11eb
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Fri Apr 23 19:49:46 2021 +1000
|
||
|
||
Replace "==" (a bashism) with "=".
|
||
|
||
commit a116b6f5be17a1dd345b7d54bf8aa3779a28a0df
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Fri Apr 23 16:34:48 2021 +1000
|
||
|
||
Add nbsd2 test target.
|
||
|
||
commit 196bf2a9bb771f45d9b0429cee7d325962233c44
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Fri Apr 23 14:54:10 2021 +1000
|
||
|
||
Add obsd68 test target.
|
||
|
||
commit e3ba6574ed69e8b7af725cf5e8a9edaac04ff077
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Fri Apr 23 14:53:32 2021 +1000
|
||
|
||
Remove dependency on bash.
|
||
|
||
commit db1f9ab8feb838aee9f5b99c6fd3f211355dfdcf
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Fri Apr 23 14:41:13 2021 +1000
|
||
|
||
Add obsd67 test target.
|
||
|
||
commit c039a6bf79192fe1daa9ddcc7c87dd98e258ae7c
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Fri Apr 23 11:08:23 2021 +1000
|
||
|
||
Re-add macos-11.0 test target.
|
||
|
||
commit a6db3a47b56adb76870d59225ffb90a65bc4daf2
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Fri Apr 23 10:28:28 2021 +1000
|
||
|
||
Add openindiana test target.
|
||
|
||
commit 3fe7e73b025c07eda46d78049f1da8ed7dfc0c69
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Fri Apr 23 10:26:35 2021 +1000
|
||
|
||
Test krb5 on Solaris 11 too.
|
||
|
||
commit f57fbfe5eb02df1a91f1a237c4d27165afd87c13
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Thu Apr 22 22:27:26 2021 +1000
|
||
|
||
Don't always set SUDO.
|
||
|
||
Rely on sourcing configs to set as appropriate.
|
||
|
||
commit e428f29402fb6ac140b52f8f12e06ece7bb104a0
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Thu Apr 22 22:26:08 2021 +1000
|
||
|
||
Remove now-unused 2nd arg to configs.
|
||
|
||
commit cb4ff640d79b3c736879582139778f016bbb2cd7
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Wed Apr 21 01:08:04 2021 +1000
|
||
|
||
Add win10 test target.
|
||
|
||
commit 4457837238072836b2fa3107d603aac809624983
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Tue Apr 20 23:31:29 2021 +1000
|
||
|
||
Add nbsd8 test target.
|
||
|
||
commit bd4fba22e14da2fa196009010aabec5a8ba9dd42
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Sat Apr 17 09:55:47 2021 +1000
|
||
|
||
Add obsd51 target.
|
||
|
||
commit 9403d0e805c77a5741ea8c3281bbe92558c2f125
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Fri Apr 16 18:14:25 2021 +1000
|
||
|
||
Add fbsd13 target.
|
||
|
||
commit e86968280e358e62649d268d41f698d64d0dc9fa
|
||
Author: Damien Miller <djm@mindrot.org>
|
||
Date: Fri Apr 16 13:55:25 2021 +1000
|
||
|
||
depend
|
||
|
||
commit 2fb25ca11e8b281363a2a2a4dec4c497a1475d9a
|
||
Author: Damien Miller <djm@mindrot.org>
|
||
Date: Fri Apr 16 13:53:02 2021 +1000
|
||
|
||
crank version in README and RPM spec files
|
||
|
||
commit b2b60ebab0cb77b5bc02d364d72e13db882f33ae
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Fri Apr 16 03:42:00 2021 +0000
|
||
|
||
upstream: openssh-8.6
|
||
|
||
OpenBSD-Commit-ID: b5f3e133c846127ec114812248bc17eff07c3e19
|
||
|
||
commit faf2b86a46c9281d237bcdec18c99e94a4eb820a
|
||
Author: markus@openbsd.org <markus@openbsd.org>
|
||
Date: Thu Apr 15 16:24:31 2021 +0000
|
||
|
||
upstream: do not pass file/func to monitor; noted by Ilja van Sprundel;
|
||
|
||
ok djm@
|
||
|
||
OpenBSD-Commit-ID: 85ae5c063845c410283cbdce685515dcd19479fa
|
||
|
||
commit 2dc328023f60212cd29504fc05d849133ae47355
|
||
Author: Damien Miller <djm@mindrot.org>
|
||
Date: Wed Apr 14 11:42:55 2021 +1000
|
||
|
||
sshd don't exit on transient read errors
|
||
|
||
openssh-8.5 introduced a regression that would cause sshd to exit
|
||
because of transient read errors on the network socket (e.g. EINTR,
|
||
EAGAIN). Reported by balu.gajjala AT gmail.com via bz3297
|
||
|
||
commit d5d6b7d76d171a2e6861609dcd92e714ee62ad88
|
||
Author: Damien Miller <djm@mindrot.org>
|
||
Date: Sat Apr 10 18:45:00 2021 +1000
|
||
|
||
perform report_failed_grab() inline
|
||
|
||
commit ea996ce2d023aa3c6d31125e2c3ebda1cb42db8c
|
||
Author: Damien Miller <djm@mindrot.org>
|
||
Date: Sat Apr 10 18:22:57 2021 +1000
|
||
|
||
dedicated gnome-ssk-askpass3 source
|
||
|
||
Compatibility with Wayland requires that we use the gdk_seat_grab()
|
||
API for grabbing mouse/keyboard, however these API don't exist in
|
||
Gtk+2.
|
||
|
||
This branches gnome-ssk-askpass2.c => gnome-ssk-askpass3.c and
|
||
makes the changes to use the gdk_seat_grab() instead of grabbing
|
||
mouse/focus separately via GDK.
|
||
|
||
In the future, we can also use the branched file to avoid some
|
||
API that has been soft-deprecated in GTK+3, e.g. gtk_widget_modify_fg
|
||
|
||
commit bfa5405da05d906ffd58216eb77c4375b62d64c2
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Thu Apr 8 15:18:15 2021 +1000
|
||
|
||
Ensure valgrind-out exists.
|
||
|
||
Normally the regress tests would create it, but running the unit tests
|
||
on their own would fail because the directory did not exist.
|
||
|
||
commit 1f189181f3ea09a9b08aa866f78843fec800874f
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Thu Apr 8 15:17:19 2021 +1000
|
||
|
||
Pass OBJ to unit test make invocation.
|
||
|
||
At least the Valgrind unit tests uses $OBJ.
|
||
|
||
commit f42b550c281d28bd19e9dd6ce65069164f3482b0
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Thu Apr 8 14:20:12 2021 +1000
|
||
|
||
Add pattern for valgrind-unit.
|
||
|
||
commit 19e534462710e98737478fd9c44768b50c27c4c6
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Thu Apr 8 13:31:08 2021 +1000
|
||
|
||
Run unit tests under valgrind.
|
||
|
||
Run a separate build for the unit tests under Valgrind. They take long
|
||
enough that running in parallel with the other Valgrind tests helps.
|
||
|
||
commit 80032102d05e866dc2a48a5caf760cf42c2e090e
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Thu Apr 8 13:25:57 2021 +1000
|
||
|
||
ifdef out MIN and MAX.
|
||
|
||
In -portable, defines.h ensures that these are defined, so redefining
|
||
potentially causes a warning. We don't just delete it to make any
|
||
future code syncs a little but easier. bz#3293.
|
||
|
||
commit d1bd184046bc310c405f45da3614a1dc5b3e521a
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Wed Apr 7 10:23:51 2021 +1000
|
||
|
||
Remove only use of warn().
|
||
|
||
The warn() function is only used in one place in portable and does not
|
||
exist upstream. Upgrade the only instance it's used to fail()
|
||
(the privsep/sandbox+proxyconnect, from back when that was new) and
|
||
remove the now-unused function.
|
||
|
||
commit fea8f4b1aa85026ad5aee5ad8e1599a8d5141fe0
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Wed Apr 7 10:18:32 2021 +1000
|
||
|
||
Move make_tmpdir() into portable-specific area.
|
||
|
||
Reduces diff vs OpenBSD and makes it more likely diffs will apply
|
||
cleanly.
|
||
|
||
commit 13e5fa2acffd26e754c6ee1d070d0afd035d4cb7
|
||
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
||
Date: Tue Apr 6 23:57:56 2021 +0000
|
||
|
||
upstream: Add TEST_SSH_ELAPSED_TIMES environment variable to print the
|
||
|
||
elapsed time in seconds of each test. This depends on "date +%s" which is
|
||
not specified by POSIX but is commonly implemented.
|
||
|
||
OpenBSD-Regress-ID: ec3c8c19ff49b2192116a0a646ee7c9b944e8a9c
|
||
|
||
commit ef4f46ab4387bb863b471bad124d46e8d911a79a
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Wed Apr 7 09:59:15 2021 +1000
|
||
|
||
Move the TEST_SSH_PORT section down a bit.
|
||
|
||
This groups the portable-specific changes together and makes it a
|
||
little more likely that patches will apply cleanly.
|
||
|
||
commit 3674e33fa70dfa1fe69b345bf576113af7b7be11
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Wed Apr 7 10:05:10 2021 +1000
|
||
|
||
Further split Valgrind tests.
|
||
|
||
Even split in two, the Valgrind tests take by far the longest to run,
|
||
so split them four ways to further increase parallelism.
|
||
|
||
commit 961af266b861e30fce1e26170ee0dbb5bf591f29
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Tue Apr 6 23:24:30 2021 +0000
|
||
|
||
upstream: include "ssherr.h" not <ssherr.h>; from Balu Gajjala via
|
||
|
||
bz#3292
|
||
|
||
OpenBSD-Commit-ID: e9535cd9966eb2e69e73d1ede1f44905c30310bd
|
||
|
||
commit e7d0a285dbdd65d8df16123ad90f15e91862f959
|
||
Author: Damien Miller <djm@mindrot.org>
|
||
Date: Wed Apr 7 08:50:38 2021 +1000
|
||
|
||
wrap struct rlimit in HAVE_GETRLIMIT too
|
||
|
||
commit f283a6c2e0a9bd9369e18462acd00be56fbe5b0d
|
||
Author: Damien Miller <djm@mindrot.org>
|
||
Date: Wed Apr 7 08:20:35 2021 +1000
|
||
|
||
wrap getrlimit call in HAVE_GETRLIMIT; bz3291
|
||
|
||
commit 679bdc4a5c9244f427a7aee9c14b0a0ed086da1f
|
||
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
||
Date: Tue Apr 6 09:07:33 2021 +0000
|
||
|
||
upstream: Don't check return value of unsetenv(). It's part of the
|
||
|
||
environment setup and not part of the actual test, and some platforms
|
||
-portable runs on declare it as returning void, which prevents the test from
|
||
compiling.
|
||
|
||
OpenBSD-Regress-ID: 24f08543ee3cdebc404f2951f3e388cc82b844a1
|
||
|
||
commit 320af2f3de6333aa123f1b088eca146a245e968a
|
||
Author: jmc@openbsd.org <jmc@openbsd.org>
|
||
Date: Sun Apr 4 11:36:56 2021 +0000
|
||
|
||
upstream: remove stray inserts; from matthias schmidt
|
||
|
||
OpenBSD-Commit-ID: 2c36ebdc54e14bbf1daad70c6a05479a073d5c63
|
||
|
||
commit 801f710953b24dd2f21939171c622eac77c7484d
|
||
Author: jmc@openbsd.org <jmc@openbsd.org>
|
||
Date: Sun Apr 4 06:11:24 2021 +0000
|
||
|
||
upstream: missing comma; from kawashima james
|
||
|
||
OpenBSD-Commit-ID: 31cec6bf26c6db4ffefc8a070715ebef274e68ea
|
||
|
||
commit b3ca08cb174266884d44ec710a84cd64c12414ea
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Mon Apr 5 23:46:42 2021 +1000
|
||
|
||
Install libcbor with libfido2.
|
||
|
||
commit f3ca8af87a4c32ada660da12ae95cf03d190c083
|
||
Author: Damien Miller <djm@mindrot.org>
|
||
Date: Sat Apr 3 18:21:08 2021 +1100
|
||
|
||
enable authopt and misc unit tests
|
||
|
||
Neither were wired into the build, both required some build
|
||
adaptations for -portable
|
||
|
||
commit dc1b45841fb97e3d7f655ddbcfef3839735cae5f
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Sat Apr 3 06:58:30 2021 +0000
|
||
|
||
upstream: typos in comments; GHPR#180 from Vill
|
||
|
||
=?UTF-8?q?e=20Skytt=C3=A4?=
|
||
MIME-Version: 1.0
|
||
Content-Type: text/plain; charset=UTF-8
|
||
Content-Transfer-Encoding: 8bit
|
||
|
||
OpenBSD-Commit-ID: 93c732381ae0e2b680c79e67c40c1814b7ceed2c
|
||
|
||
commit 53ea05e09b04fd7b6dea66b42b34d65fe61b9636
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Sat Apr 3 06:55:52 2021 +0000
|
||
|
||
upstream: sync CASignatureAlgorithms lists with reality. GHPR#174 from
|
||
|
||
Matt Hazinski
|
||
|
||
OpenBSD-Commit-ID: f05e4ca54d7e67b90fe58fe1bdb1d2a37e0e2696
|
||
|
||
commit 57ed647ee07bb883a2f2264231bcd1df6a5b9392
|
||
Author: Damien Miller <djm@mindrot.org>
|
||
Date: Sat Apr 3 17:47:37 2021 +1100
|
||
|
||
polish whitespace for portable files
|
||
|
||
commit 31d8d231eb9377df474746a822d380c5d68d7ad6
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Sat Apr 3 06:18:40 2021 +0000
|
||
|
||
upstream: highly polished whitespace, mostly fixing spaces-for-tab
|
||
|
||
and bad indentation on continuation lines. Prompted by GHPR#185
|
||
|
||
OpenBSD-Commit-ID: e5c81f0cbdcc6144df1ce468ec1bac366d8ad6e9
|
||
|
||
commit 34afde5c73b5570d6f8cce9b49993b23b77bfb86
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Sat Apr 3 05:54:14 2021 +0000
|
||
|
||
upstream: whitespace (tab after space)
|
||
|
||
OpenBSD-Commit-ID: 0e2b3f7674e985d3f7c27ff5028e690ba1c2efd4
|
||
|
||
commit 7cd262c1c5a08cc7f4f30e3cab108ef089d0a57b
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Sat Apr 3 16:59:10 2021 +1100
|
||
|
||
Save config.h and config.log on failure too.
|
||
|
||
commit 460aee9298f365357e9fd26851c22e0dca51fd6a
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Sat Apr 3 05:46:41 2021 +0000
|
||
|
||
upstream: fix incorrect plural; from Ville Skyt
|
||
|
||
=?UTF-8?q?t=C3=A4=20via=20GHPR#181?=
|
||
MIME-Version: 1.0
|
||
Content-Type: text/plain; charset=UTF-8
|
||
Content-Transfer-Encoding: 8bit
|
||
|
||
OpenBSD-Commit-ID: 92f31754c6296d8f403d7c293e09dc27292d22c9
|
||
|
||
commit 082804c14e548cada75c81003a3c68ee098138ee
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Sat Apr 3 05:40:39 2021 +0000
|
||
|
||
upstream: ensure that pkcs11_del_provider() is called before exit -
|
||
|
||
some PKCS#11 providers get upset if C_Initialize is not matched with
|
||
C_Finalize.
|
||
|
||
From Adithya Baglody via GHPR#234; ok markus
|
||
|
||
OpenBSD-Commit-ID: f8e770e03b416ee9a58f9762e162add900f832b6
|
||
|
||
commit 464ebc82aa926dd132ec75a0b064574ef375675e
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Sat Apr 3 05:28:43 2021 +0000
|
||
|
||
upstream: unused variable
|
||
|
||
OpenBSD-Commit-ID: 85f6a394c8e0f60d15ecddda75176f112007b205
|
||
|
||
commit dc3c0be8208c488e64a8bcb7d9efad98514e0ffb
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Sat Apr 3 05:21:46 2021 +0000
|
||
|
||
upstream: Fix two problems in string->argv conversion: 1) multiple
|
||
|
||
backslashes were not being dequoted correctly and 2) quoted space in the
|
||
middle of a string was being incorrectly split.
|
||
MIME-Version: 1.0
|
||
Content-Type: text/plain; charset=UTF-8
|
||
Content-Transfer-Encoding: 8bit
|
||
|
||
A unit test for these cases has already been committed
|
||
|
||
prompted by and based on GHPR#223 by Eero Häkkinen; ok markus@
|
||
|
||
OpenBSD-Commit-ID: d7ef27abb4eeeaf6e167e9312e4abe9e89faf1e4
|
||
|
||
commit f75bcbba58a08c670727ece5e3f8812125969799
|
||
Author: Damien Miller <djm@mindrot.org>
|
||
Date: Sat Apr 3 16:22:48 2021 +1100
|
||
|
||
missing bits from 259d648e
|
||
|
||
commit 4cbc4a722873d9b68cb5496304dc050d7168df78
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Wed Mar 31 21:59:26 2021 +0000
|
||
|
||
upstream: cannot effectively test posix-rename extension after
|
||
|
||
changes in feature advertisment.
|
||
|
||
OpenBSD-Regress-ID: 5e390bf88d379162aaa81b60ed86b34cb0c54d29
|
||
|
||
commit 259d648e63e82ade4fe2c2c73c8b67fe57d9d049
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Fri Mar 19 04:23:50 2021 +0000
|
||
|
||
upstream: add a test for misc.c:argv_split(), currently fails
|
||
|
||
OpenBSD-Regress-ID: ad6b96d6ebeb9643b698b3575bdd6f78bb144200
|
||
|
||
commit 473ddfc2d6b602cb2d1d897e0e5c204de145cd9a
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Fri Mar 19 03:25:01 2021 +0000
|
||
|
||
upstream: split
|
||
|
||
OpenBSD-Regress-ID: f6c03c0e4c58b3b9e04b161757b8c10dc8378c34
|
||
|
||
commit 1339800fef8d0dfbfeabff71b34670105bcfddd2
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Wed Mar 31 22:16:34 2021 +0000
|
||
|
||
upstream: Use new limits@openssh.com protocol extension to let the
|
||
|
||
client select good limits based on what the server supports. Split the
|
||
download and upload buffer sizes to allow them to be chosen independently.
|
||
|
||
In practice (and assuming upgraded sftp/sftp-server at each end), this
|
||
increases the download buffer 32->64KiB and the upload buffer
|
||
32->255KiB.
|
||
|
||
Patches from Mike Frysinger; ok dtucker@
|
||
|
||
OpenBSD-Commit-ID: ebd61c80d85b951b794164acc4b2f2fd8e88606c
|
||
|
||
commit 6653c61202d104e59c8e741329fcc567f7bc36b8
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Wed Mar 31 21:58:07 2021 +0000
|
||
|
||
upstream: do not advertise protocol extensions that have been
|
||
|
||
disallowed by the command-line options (e.g. -p/-P/-R); ok dtucker@
|
||
|
||
OpenBSD-Commit-ID: 3a8a76b3f5131741aca4b41bfab8d101c9926205
|
||
|
||
commit 71241fc05db4bbb11bb29340b44b92e2575373d8
|
||
Author: Damien Miller <djm@mindrot.org>
|
||
Date: Mon Mar 29 15:14:25 2021 +1100
|
||
|
||
gnome-ssh-askpass3 is a valid target here
|
||
|
||
commit 8a9520836e71830f4fccca066dba73fea3d16bda
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Fri Mar 19 02:22:34 2021 +0000
|
||
|
||
upstream: return non-zero exit status when killed by signal; bz#3281 ok
|
||
|
||
dtucker@
|
||
|
||
OpenBSD-Commit-ID: 117b31cf3c807993077b596bd730c24da9e9b816
|
||
|
||
commit 1269b8a686bf1254b03cd38af78167a04aa6ec88
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Fri Mar 19 02:18:28 2021 +0000
|
||
|
||
upstream: increase maximum SSH2_FXP_READ to match the maximum
|
||
|
||
packet size. Also handle zero-length reads that are borderline nonsensical
|
||
but not explicitly banned by the spec. Based on patch from Mike Frysinger,
|
||
feedback deraadt@ ok dtucker@
|
||
|
||
OpenBSD-Commit-ID: 4e67d60d81bde7b84a742b4ee5a34001bdf80d9c
|
||
|
||
commit 860b67604416640e8db14f365adc3f840aebcb1f
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Tue Mar 16 06:15:43 2021 +0000
|
||
|
||
upstream: don't let logging clobber errno before use
|
||
|
||
OpenBSD-Commit-ID: ce6cca370005c270c277c51c111bb6911e1680ec
|
||
|
||
commit 5ca8a9216559349c56e09039c4335636fd85c241
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Sat Mar 13 14:40:43 2021 +1100
|
||
|
||
Only call dh_set_moduli_file if using OpenSSL.
|
||
|
||
Fixes link failure when configuring --without-openssl since dh.c is not
|
||
linked in.
|
||
|
||
commit 867a7dcf003c51d5a83f83565771a35f0d9530ac
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Sat Mar 13 13:52:53 2021 +1100
|
||
|
||
Don't install moduli during tests.
|
||
|
||
Now that we have TEST_SSH_MODULI_FILE pointing to the moduli in the
|
||
soure directory we don't need to install the file to prevent warnings
|
||
about it being missing.
|
||
|
||
commit 0c054538fccf92b4a028008321d3711107bee6d5
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Sat Mar 13 13:51:26 2021 +1100
|
||
|
||
Point TEST_SSH_MODULI_FILE at our own moduli.
|
||
|
||
This will allow the test to run without requiring a moduli file
|
||
installed at the configured default path.
|
||
|
||
commit 4d48219c72ab0c71238806f057f0e9630b7dd25c
|
||
Author: jsg@openbsd.org <jsg@openbsd.org>
|
||
Date: Fri Mar 12 05:18:01 2021 +0000
|
||
|
||
upstream: spelling
|
||
|
||
OpenBSD-Commit-ID: 478bc3db04f62f1048ed6e1765400f3ab325e60f
|
||
|
||
commit 88057eb6df912abf2678ea5c846d9d9cbc92752c
|
||
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
||
Date: Fri Mar 12 04:08:19 2021 +0000
|
||
|
||
upstream: Add ModuliFile keyword to sshd_config to specify the
|
||
|
||
location of the "moduli" file containing the groups for DH-GEX. This will
|
||
allow us to run tests against arbitrary moduli files without having to
|
||
install them. ok djm@
|
||
|
||
OpenBSD-Commit-ID: 8df99d60b14ecaaa28f3469d01fc7f56bff49f66
|
||
|
||
commit f07519a2af96109325b5a48b1af18b57601074ca
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Fri Mar 12 03:43:40 2021 +0000
|
||
|
||
upstream: pwcopy() struct passwd that we're going to reuse across a
|
||
|
||
bunch of library calls; bz3273 ok dtucker@
|
||
|
||
OpenBSD-Commit-ID: b6eafa977b2e44607b1b121f5de855107809b762
|
||
|
||
commit 69d6d4b0c8a88d3d1288415605f36e2df61a2f12
|
||
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
||
Date: Wed Mar 10 06:32:27 2021 +0000
|
||
|
||
upstream: Import regenerated moduli file.
|
||
|
||
OpenBSD-Commit-ID: 7ac6c252d2a5be8fbad4c66d9d35db507c9dac5b
|
||
|
||
commit e5895e8ecfac65086ea6b34d0d168409a66a15e1
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Wed Mar 10 04:58:45 2021 +0000
|
||
|
||
upstream: no need to reset buffer after send_msg() as that is done
|
||
|
||
for us; patch from Mike Frysinger
|
||
|
||
OpenBSD-Commit-ID: 565516495ff8362a38231e0f1a087b8ae66da59c
|
||
|
||
commit 721948e67488767df0fa0db71ff2578ee2bb9210
|
||
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
||
Date: Sat Mar 13 01:52:16 2021 +0000
|
||
|
||
upstream: Add TEST_SSH_MODULI_FILE variable to allow overriding of the
|
||
|
||
moduli file used during the test run.
|
||
|
||
OpenBSD-Regress-ID: be10f785263120edb64fc87db0e0d6570a10220a
|
||
|
||
commit 82fef71e20ffef425b932bec26f5bc46aa1ed41c
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Fri Mar 12 15:58:57 2021 +1100
|
||
|
||
Allow (but return EACCES) fstatat64 in sandbox.
|
||
|
||
This is apparently used in some configurations of OpenSSL when glibc
|
||
has getrandom(). bz#3276, patch from Kris Karas, ok djm@
|
||
|
||
commit 1cd67ee15ce3d192ab51be22bc4872a6a7a4b6d9
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Fri Mar 12 13:16:10 2021 +1100
|
||
|
||
Move generic includes outside of ifdef.
|
||
|
||
This ensures that the macros in log.h are defined in the case where
|
||
either of --with-solaris-projects or --with-solaris-privs are used
|
||
without --with-solaris-contracts. bz#3278.
|
||
|
||
commit 2421a567a8862fe5102a4e7d60003ebffd1313dd
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Wed Mar 10 17:41:21 2021 +1100
|
||
|
||
Import regenerated moduli file.
|
||
|
||
commit e99080c05d9d48dbbdb022538533d53ae1bd567d
|
||
Author: millert@openbsd.org <millert@openbsd.org>
|
||
Date: Sat Mar 6 20:36:31 2021 +0000
|
||
|
||
upstream: Fix PRINT macro, the suffix param to sshlog() was missing.
|
||
|
||
Also remove redundant __func__ prefix from PRINT calls as the macro already
|
||
adds __FILE__, __func__ and __LINE__. From Christos Zoulas. OK dtucker@
|
||
|
||
OpenBSD-Commit-ID: 01fdfa9c5541151b5461d9d7d6ca186a3413d949
|
||
|
||
commit 160db17fc678ceb5e3fd4a7e006cc73866f484aa
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Wed Mar 3 22:41:49 2021 +0000
|
||
|
||
upstream: don't sshbuf_get_u32() into an enum; reported by goetze
|
||
|
||
AT dovetail.com via bz3269
|
||
|
||
OpenBSD-Commit-ID: 99a30a8f1df9bd72be54e21eee5c56a0f050921a
|
||
|
||
commit cffd033817a5aa388764b6661855dcdaabab0588
|
||
Author: sthen@openbsd.org <sthen@openbsd.org>
|
||
Date: Wed Mar 3 21:40:16 2021 +0000
|
||
|
||
upstream: typo in other_hostkeys_message() display output, ok djm
|
||
|
||
OpenBSD-Commit-ID: 276f58afc97b6f5826e0be58380b737603dbf5f5
|
||
|
||
commit 7fe141b96b13bd7dc67ca985e14d55b9bd8a03fd
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Wed Mar 3 08:42:52 2021 +0000
|
||
|
||
upstream: needs FILE*; from Mike Frysinger
|
||
|
||
OpenBSD-Commit-ID: dddb3aa9cb5792eeeaa37a1af67b5a3f25ded41d
|
||
|
||
commit d2afd717e62d76bb41ab5f3ab4ce6f885c8edc98
|
||
Author: Damien Miller <djm@mindrot.org>
|
||
Date: Tue Mar 2 21:31:47 2021 +1100
|
||
|
||
update depend
|
||
|
||
commit f0c4eddf7cf224ebcac1f07ac8afdb30c6e9fe0a
|
||
Author: Damien Miller <djm@mindrot.org>
|
||
Date: Tue Mar 2 21:30:14 2021 +1100
|
||
|
||
update relnotes URL
|
||
|
||
commit 67a8bb7fe62a381634db4c261720092e7d514a3d
|
||
Author: Damien Miller <djm@mindrot.org>
|
||
Date: Tue Mar 2 21:29:54 2021 +1100
|
||
|
||
update RPM spec version numbers
|
||
|
||
commit 0a4b23b11b9a4e6eec332dd5c6ab2ac6f62aa164
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Tue Mar 2 01:48:18 2021 +0000
|
||
|
||
upstream: openssh-8.5
|
||
|
||
OpenBSD-Commit-ID: 185e85d60fe042b8f8fa1ef29d4ef637bdf397d6
|
||
|
||
commit de3866383b6720ad4cad83be76fe4c8aa111a249
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Mon Mar 1 21:13:24 2021 +1100
|
||
|
||
Only upload config logs if configure fails.
|
||
|
||
commit 85ff2a564ce838f8690050081176c1de1fb33116
|
||
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
||
Date: Sun Feb 28 22:56:30 2021 +0000
|
||
|
||
upstream: Add %k to list of keywords. From
|
||
|
||
=?UTF-8?q?=20Eero=20H=C3=A4kkinenvia=20bz#3267?=
|
||
MIME-Version: 1.0
|
||
Content-Type: text/plain; charset=UTF-8
|
||
Content-Transfer-Encoding: 8bit
|
||
|
||
OpenBSD-Commit-ID: 9c87f39a048cee2a7d1c8bab951b2f716256865e
|
||
|
||
commit e774bac35933e71f924f4301786e7fb5bbe1422f
|
||
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
||
Date: Sun Feb 28 01:50:47 2021 +0000
|
||
|
||
upstream: Do not try to reset signal handler for signal 0 in
|
||
|
||
subprocess. Prevents spurious debug message. ok djm@
|
||
|
||
OpenBSD-Commit-ID: 7f9785e292dcf304457566ad4637effd27ad1d46
|
||
|
||
commit 351c5dbbd74ce300c4f058112f9731c867c6e225
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Sat Feb 27 23:42:37 2021 +0000
|
||
|
||
upstream: fix alphabetic ordering of options; spotted by Iain Morgan
|
||
|
||
OpenBSD-Commit-ID: f955fec617d74af0feb5b275831a9fee813d7ad5
|
||
|
||
commit 0d1c9dbe578597f8d45d3ac7690df10d32d743e5
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Sat Feb 27 12:25:25 2021 +1100
|
||
|
||
zlib is now optional.
|
||
|
||
commit b7c6ee7b437d9adfd19ef49d6c0f19f13f26f9b3
|
||
Author: Jeffrey H. Johnson <61629094+johnsonjh@users.noreply.github.com>
|
||
Date: Sat Feb 27 01:04:58 2021 +0000
|
||
|
||
Fix punctuatio and typo in README.md.
|
||
|
||
Some very minor fixes, missing 's' and punctuation.
|
||
|
||
commit 6248b86074804983e8f7a2058856a516dbfe2924
|
||
Author: Damien Miller <djm@mindrot.org>
|
||
Date: Fri Feb 26 16:45:50 2021 +1100
|
||
|
||
Revert "ssh: optional bind interface if bind address specified."
|
||
|
||
This reverts commit 5a878a71a3528c2626aa1d331934fd964782d41c.
|
||
|
||
Apologies - I accidentally pushed this.
|
||
|
||
commit 493339a940b13be6071629c3c2dd5a3b6fc17023
|
||
Author: Damien Miller <djm@mindrot.org>
|
||
Date: Fri Feb 26 15:45:38 2021 +1100
|
||
|
||
detech BSD libc hash functions in libbsd / libmd
|
||
|
||
Some Linux distributions are shipping the BSD-style hashing functions
|
||
(e.g. SHA256Update) in libbsd and/or libmd. Detect this situation to
|
||
avoid header/replacement clashes later. ok dtucker@
|
||
|
||
commit 5a878a71a3528c2626aa1d331934fd964782d41c
|
||
Author: Dmitrii Turlupov <dturlupov@factor-ts.ru>
|
||
Date: Thu Feb 4 16:27:31 2021 +0300
|
||
|
||
ssh: optional bind interface if bind address specified.
|
||
|
||
Allows the -b and -B options to be used together.
|
||
For example, when the interface is in the VRF.
|
||
|
||
commit 1fe4d70df94d3bcc2b35fd57cad6b5fc4b2d7b16
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Fri Feb 26 04:18:42 2021 +0000
|
||
|
||
upstream: remove this KEX fuzzer; it's awkward to use and doesn't play
|
||
|
||
nice with popular fuzzing drivers like libfuzzer. AFAIK nobody has used it
|
||
but me.
|
||
|
||
OpenBSD-Regress-ID: cad919522b3ce90c147c95abaf81b0492ac296c9
|
||
|
||
commit 24a3a67bd7421740d08803b84bd784e764107928
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Fri Feb 26 11:49:19 2021 +1100
|
||
|
||
Remove macos-11.00 PAM test target too.
|
||
|
||
These are failing apparently due to some kind of infrastructure problem,
|
||
making it look like every commit is busted.
|
||
|
||
commit 473201783f732ca8b0ec528b56aa55fa0d8cf717
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Fri Feb 26 00:16:58 2021 +0000
|
||
|
||
upstream: a bit more debugging behind #ifdef DEBUG_SK
|
||
|
||
OpenBSD-Commit-ID: d9fbce14945721061cb322f0084c2165d33d1993
|
||
|
||
commit fd9fa76a344118fe1ef10b9a6c9e85d39599e9a8
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Fri Feb 26 01:15:10 2021 +1100
|
||
|
||
Remove macos-11.0 from the test target list.
|
||
|
||
It has been consistently failing for the past few days with a github
|
||
actions internal error.
|
||
|
||
commit 476ac8e9d33dbf96ef97aab812b8d7089d0cdc24
|
||
Author: Philip Hands <phil@hands.com>
|
||
Date: Wed Feb 24 23:43:16 2021 +0100
|
||
|
||
tidy the $INSTALLKEY_SH code layout a little
|
||
|
||
SSH-Copy-ID-Upstream: 78178aa5017222773e4c23d9001391eeaeca8983
|
||
|
||
commit 983e05ef3b81329d76d6a802b39ad0d1f637c06c
|
||
Author: Jakub Jelen <jjelen@redhat.com>
|
||
Date: Tue Sep 29 10:02:45 2020 +0000
|
||
|
||
if unable to add a missing newline, fail
|
||
|
||
SSH-Copy-ID-Upstream: 76b25e18f55499ea9edb4c4d6dc4a80bebc36d95
|
||
|
||
commit 3594b3b015f6014591da88ba71bf6ff010be7411
|
||
Author: Philip Hands <phil@hands.com>
|
||
Date: Tue Oct 13 14:12:58 2020 +0200
|
||
|
||
use $AUTH_KEY_DIR, now that we have it
|
||
|
||
since that was a change made since jjelen's commit was written
|
||
|
||
also, quote the variables
|
||
|
||
SSH-Copy-ID-Upstream: 588cd8e5cbf95f3443d92b9ab27c5d73ceaf6616
|
||
|
||
commit 333e25f7bc43cee6e36f766e39dad6f9918b318c
|
||
Author: Jakub Jelen <jjelen@redhat.com>
|
||
Date: Tue Sep 29 10:00:01 2020 +0000
|
||
|
||
restorecon the correct directory
|
||
|
||
if using different path for authorized_keys file
|
||
|
||
SSH-Copy-ID-Upstream: 791a3df47b48412c726bff6f7b1d190721e65d51
|
||
|
||
commit 9beeab8a37a49a9e3ffb1972fff6621ee5bd7a71
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Thu Feb 25 03:27:34 2021 +0000
|
||
|
||
upstream: s/PubkeyAcceptedKeyTypes/PubkeyAcceptedAlgorithms/
|
||
|
||
OpenBSD-Regress-ID: 3dbc005fa29f69dc23d97e433b6dffed6fe7cb69
|
||
|
||
commit 2dd9870c16ddbd83740adeead5030d6840288c8f
|
||
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
||
Date: Wed Feb 24 23:12:35 2021 +0000
|
||
|
||
upstream: Rename pubkeyacceptedkeytypes to pubkeyacceptedalgorithms in
|
||
|
||
test to match change to config-dump output.
|
||
|
||
OpenBSD-Regress-ID: 74c9a4ad50306be873d032819d5e55c24eb74d5d
|
||
|
||
commit b9225c3a1c3f5827e31d5d64a71b8e0504a25619
|
||
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
||
Date: Wed Feb 24 01:18:08 2021 +0000
|
||
|
||
upstream: Put obsolete aliases for hostbasedalgorithms and
|
||
|
||
pubkeyacceptedalgorithms after their current names so that the config-dump
|
||
mode finds and uses the current names. Spotted by Phil Pennock.
|
||
|
||
OpenBSD-Commit-ID: 5dd10e93cccfaff3aaaa09060c917adff04a9b15
|
||
|
||
commit 8b8b60542d6652b2c91e0ef9e9cc81bcb65e6b42
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Tue Feb 23 21:55:08 2021 +0000
|
||
|
||
upstream: lots more s/key types/signature algorithms/ mostly in
|
||
|
||
HostbasedAcceptedAlgorithms and HostKeyAlgorithms; prompted by Jakub Jelen
|
||
|
||
OpenBSD-Commit-ID: 3f719de4385b1a89e4323b2549c66aae050129cb
|
||
|
||
commit 0aeb508aaabc4818970c90831e3d21843c3c6d09
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Tue Feb 23 21:50:18 2021 +0000
|
||
|
||
upstream: Correct reference to signature algorithms as keys; from
|
||
|
||
Jakub Jelen
|
||
|
||
OpenBSD-Commit-ID: 36f7ecee86fc811aa0f8e21e7a872eee044b4be5
|
||
|
||
commit f186a020f2ba5f9c462a23293750e29ba0a746b1
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Tue Feb 23 16:05:22 2021 +1100
|
||
|
||
Add a couple more test VMs.
|
||
|
||
commit ffcdd3d90e74176b3bb22937ad1f65a6c1cd3f9d
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Mon Feb 22 08:09:27 2021 +1100
|
||
|
||
Valgrind test: split and move up list.
|
||
|
||
Since the valgrind test takes so long it approaches the limit allowed by
|
||
github, move it to the head of the list so it's the first one started and
|
||
split the longest tests out into a second instance that runs concurrently
|
||
with the first.
|
||
|
||
commit c3b1636770785cc2830dedd0f22ef7d3d3491d6d
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Tue Feb 23 00:05:31 2021 +0000
|
||
|
||
upstream: warn when the user specifies a ForwardAgent path that does
|
||
|
||
not exist and exit if ExitOnForwardFailure is set; bz3264
|
||
|
||
OpenBSD-Commit-ID: 72f7875865e723e464c71bf8692e83110699bf26
|
||
|
||
commit 5fcb0514949d61aadaf4a89cf16eb78fb47491ec
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Sat Feb 20 13:34:02 2021 +1100
|
||
|
||
Disable rlimit sandbox, doesn't work with valgrind
|
||
|
||
Only run regress tests, runing unit tests as well makes it run longer
|
||
than allowed y github.
|
||
|
||
commit bb0b9bf45396c19486080d3eb0a159f94de7e6ba
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Sat Feb 20 13:06:25 2021 +1100
|
||
|
||
Upload valgrind logs on failure.
|
||
|
||
commit ebb3b75e974cb241c6b9b9f5881b09c7bd32b651
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Fri Feb 19 22:18:50 2021 +1100
|
||
|
||
Rename "vm" to "os" in selfhosted to match c-cpp.
|
||
|
||
Should make it easier to share code or maybe merge at some point.
|
||
|
||
commit 76c0be0fe0465cb2b975dbd409f8d38b55e55bcb
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Fri Feb 19 22:15:22 2021 +1100
|
||
|
||
Upload regress failure logs in c-cpp too.
|
||
|
||
commit 8751b6c3136f5225c40f41bbf29aa29e15795f6e
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Fri Feb 19 22:13:36 2021 +1100
|
||
|
||
Comment out Solaris 64bit PAM build...
|
||
|
||
until I can figure out why it's failing.
|
||
|
||
commit e9f6d563c06886b277c6b9abafa99fa80726dc48
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Fri Feb 19 10:20:17 2021 +1100
|
||
|
||
Actually run Valgrind tests.
|
||
|
||
commit 41d232e226624f1a81c17091c36b44c9010aae62
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Fri Feb 19 10:16:56 2021 +1100
|
||
|
||
Add test against Valgrind.
|
||
|
||
commit e6528d91f12fba05f0ea64224091c9d0f38bdf1d
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Thu Feb 18 16:30:01 2021 +1100
|
||
|
||
Add fbsd12 test target.
|
||
|
||
commit 6506cb2798d98ff03a7cc06567c392a81f540680
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Thu Feb 18 15:21:13 2021 +1100
|
||
|
||
Remove unused arg.
|
||
|
||
commit 93c31a623973b0fad508214593aab6ca94b11dcb
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Thu Feb 18 14:54:07 2021 +1100
|
||
|
||
Add DEBUG_SK to kitchensink builds.
|
||
|
||
commit 65085740d3574eeb3289d592f042df62c2689bb0
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Thu Feb 18 14:53:14 2021 +1100
|
||
|
||
Add bbone test target (arm32).
|
||
|
||
commit 63238f5aed66148b8d6ca7bd5fb347d624200155
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Thu Feb 18 02:49:35 2021 +0000
|
||
|
||
upstream: Fix the hostkeys rotation extension documentation
|
||
|
||
The documentation was lacking the needed want-reply field in the initial
|
||
global request.
|
||
|
||
https://github.com/openssh/openssh-portable/pull/218 by dbussink
|
||
|
||
OpenBSD-Commit-ID: 051824fd78edf6d647a0b9ac011bf88e28775054
|
||
|
||
commit 34c5ef6e2d06d9f0e20cb04a9aebf67a6f96609a
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Thu Feb 18 02:15:07 2021 +0000
|
||
|
||
upstream: make names in function prototypes match those in
|
||
|
||
definition from https://github.com/openssh/openssh-portable/pull/225 by
|
||
ZenithalHourlyRate
|
||
|
||
OpenBSD-Commit-ID: 7c736307bf3f2c7cb24d6f82f244eee959485acd
|
||
|
||
commit 88e3d4de31ab4f14cac658e9e0c512043b15b146
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Thu Feb 18 02:13:58 2021 +0000
|
||
|
||
upstream: unbreak SK_DEBUG builds
|
||
|
||
from https://github.com/openssh/openssh-portable/pull/225 by
|
||
ZenithalHourlyRate
|
||
|
||
OpenBSD-Commit-ID: 28d7259ce1b04d025411464decfa2f1a097b43eb
|
||
|
||
commit 788cbc5b74a53956ba9fff11e1ca506271a3597f
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Thu Feb 18 00:30:17 2021 +0000
|
||
|
||
upstream: sftp-server: implement limits@openssh.com extension
|
||
|
||
This is a simple extension that allows the server to clearly
|
||
communicate transfer limits it is imposing so the client doesn't
|
||
have to guess, or force the user to manually tune. This is
|
||
particularly useful when an attempt to use too large of a value
|
||
causes the server to abort the connection.
|
||
|
||
Patch from Mike Frysinger; ok dtucker@
|
||
|
||
OpenBSD-Commit-ID: f96293221e5aa24102d9bf30e4f4ef04d5f4fb51
|
||
|
||
commit 324449a68d510720d0e4dfcc8e9e5a702fe6a48f
|
||
Author: Damien Miller <djm@mindrot.org>
|
||
Date: Thu Feb 18 12:06:25 2021 +1100
|
||
|
||
support OpenSSL 3.x cipher IV API change
|
||
|
||
OpenSSL renamed the "get current CIPHER_CTX" IV operation in 3.x.
|
||
This uses the new name if available.
|
||
|
||
https://github.com/openssl/openssl/issues/13411
|
||
|
||
bz#3238 ok dtucker@
|
||
|
||
commit 845fe9811c047063d935eca89188ed55c993626b
|
||
Author: Damien Miller <djm@mindrot.org>
|
||
Date: Thu Feb 18 11:25:38 2021 +1100
|
||
|
||
prefer login_getpwclass() to login_getclass()
|
||
|
||
FreeBSD has login_getpwclass() that does some special magic for
|
||
UID=0. Prefer this to login_getclass() as its easier to emulate
|
||
the former with the latter.
|
||
|
||
Based on FreeBSD PR 37416 via Ed Maste; ok dtucker@
|
||
|
||
commit d0763c8d566119cce84d9806e419badf20444b02
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Thu Feb 18 10:45:27 2021 +1100
|
||
|
||
Fixing quoting for installing moduli on target guest.
|
||
|
||
commit b3afc243bc820f323a09e3218e9ec8a30a3c1933
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Thu Feb 18 10:27:16 2021 +1100
|
||
|
||
Install moduli on target not host.
|
||
|
||
commit f060c2bc85d59d111fa18a12eb3872ee4b9f7e97
|
||
Author: Damien Miller <djm@mindrot.org>
|
||
Date: Thu Feb 18 10:33:58 2021 +1100
|
||
|
||
don't free string returned by login_getcapstr(3)
|
||
|
||
OpenBSD and NetBSD require the caller to free strings returned
|
||
bu the login_* functions, but FreeBSD requires that callers don't.
|
||
|
||
Fortunately in this case, we can harmlessly leak as the process is
|
||
about to exec the shell/command.
|
||
|
||
From https://reviews.freebsd.org/D28617 via Ed Maste; ok dtucker@
|
||
|
||
commit bc9b0c25703215501da28aa7a6539f96c0fa656f
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Thu Feb 18 10:10:00 2021 +1100
|
||
|
||
Skip unit tests on sol11 to speed things up.
|
||
|
||
commit 161873035c12cc22211fc73d07170ade47746bc5
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Thu Feb 18 10:09:27 2021 +1100
|
||
|
||
Remove SKIP_UNIT as it needs to be a make arg.
|
||
|
||
commit 1c293868e4b4e8e74e3ea15b8dff90f6b089967a
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Thu Feb 18 10:05:03 2021 +1100
|
||
|
||
Always intall moduli.
|
||
|
||
Allows us to run tests without falling back to a fixed modulus. Ensure that
|
||
the directory exists.
|
||
|
||
commit 5c8f41ad100601ec2fdcbccdfe92890c31f81bbe
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Thu Feb 18 09:59:09 2021 +1100
|
||
|
||
Quote SSHD_CONFOPTS in case it contains spaces.
|
||
|
||
commit 4653116c1f5384ea7006e6396d9b53c33d218975
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Thu Feb 18 09:51:18 2021 +1100
|
||
|
||
Fix labels on targets (dots vs underscores).
|
||
|
||
commit 4512047f57ca3c6e8cd68f0cc69be59e98b25287
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Wed Feb 17 21:47:48 2021 +1100
|
||
|
||
More compact representation of config matrix.
|
||
|
||
commit 0406cd09f05c2e419b113dd4c0eac8bc34ec915b
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Wed Feb 17 21:19:18 2021 +1100
|
||
|
||
Skip unit tests on hosted VMs to speed things up.
|
||
|
||
commit 4582612e6147d766c336198c498740242fb8f1ec
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Wed Feb 17 20:21:29 2021 +1100
|
||
|
||
Merge macos and ubuntu tests.
|
||
|
||
commit 09f4b84654b71099559492e9aed5e1a38bf24815
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Wed Feb 17 18:41:30 2021 +1100
|
||
|
||
Convert most github hosted tests to new config structure.
|
||
|
||
commit 65380ff7e054be1454e5ab4fd7bb9c66f8fcbaa9
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Wed Feb 17 18:27:36 2021 +1100
|
||
|
||
Only run selfhosted tests from selfhosted repo.
|
||
|
||
commit f031366535650b88248ed7dbf23033afdf466240
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Fri Jan 15 14:11:43 2021 +1100
|
||
|
||
Add self-hosted runners for VMs of other platforms.
|
||
|
||
Github only hosts a limited number of platforms, and the runner code
|
||
is only supported on slightly wider range of platforms. To increase
|
||
our test coverage beyond that, we run the runner natively on a VM host,
|
||
where it runs a jobs that boot VMs of other platforms, waits for them
|
||
to come up then runs the build and test by ssh'ing into the guest.
|
||
This means that the minimum dependencies for the guests are quite low
|
||
(basically just sshd, a compiler and make).
|
||
|
||
The interface to the VM host is fairly simple (basically 3 scripts:
|
||
vmstartup, vmrun and vmshutdown), but those are specific to the VM host
|
||
so are not in the public repo. We also mount the working directory on the
|
||
host via sshfs, so things like artifact upload by the runner also work.
|
||
|
||
As part of this we are moving the per-test-target configs into a single
|
||
place (.github/configs) where there will be referenced by a single short
|
||
"config" key. I plan to make the github-hosted runners use this too.
|
||
|
||
The self-hosted runners are run off a private repo on github since that
|
||
prevents third parties from accessing them[0], and since runner quota is
|
||
limited on private repos, we avoid running the tests we run on the public
|
||
repo.
|
||
|
||
[0] https://docs.github.com/en/actions/hosting-your-own-runners/about-self-hosted-runners#self-hosted-runner-security-with-public-repositories
|
||
|
||
commit 64bbd7444d658ef7ee14a7ea5ccc7f5810279ee7
|
||
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
||
Date: Wed Feb 17 03:59:00 2021 +0000
|
||
|
||
upstream: Make sure puttygen is new enough to successfully run the
|
||
|
||
PuTTY interop tests, otherwise skip them.
|
||
|
||
OpenBSD-Regress-ID: 34565bb50b8aec58331ed02a5e9e0a9a929bef51
|
||
|
||
commit da0a9afcc446a30ca49dd216612c41ac3cb1f2d4
|
||
Author: markus@openbsd.org <markus@openbsd.org>
|
||
Date: Mon Feb 15 20:43:15 2021 +0000
|
||
|
||
upstream: ssh: add PermitRemoteOpen for remote dynamic forwarding
|
||
|
||
with SOCKS ok djm@, dtucker@
|
||
|
||
OpenBSD-Commit-ID: 64fe7b6360acc4ea56aa61b66498b5ecc0a96a7c
|
||
|
||
commit b696858a7f9db72a83d02cb6edaca4b30a91b386
|
||
Author: markus@openbsd.org <markus@openbsd.org>
|
||
Date: Mon Feb 15 20:36:35 2021 +0000
|
||
|
||
upstream: factor out opt_array_append; ok djm@
|
||
|
||
OpenBSD-Commit-ID: 571bc5dd35f99c5cf9de6aaeac428b168218e74a
|
||
|
||
commit ad74fc127cc45567e170e8c6dfa2cfd9767324ec
|
||
Author: dlg@openbsd.org <dlg@openbsd.org>
|
||
Date: Mon Feb 15 11:09:22 2021 +0000
|
||
|
||
upstream: ProxyJump takes "none" to disable processing like
|
||
|
||
ProxyCommand does
|
||
|
||
ok djm@ jmc@
|
||
|
||
OpenBSD-Commit-ID: 941a2399da2193356bdc30b879d6e1692f18b6d3
|
||
|
||
commit 16eacdb016ccf38dd9959c78edd3a6282513aa53
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Fri Feb 12 03:49:09 2021 +0000
|
||
|
||
upstream: sftp: add missing lsetstat@openssh.com documentation
|
||
|
||
patch from Mike Frysinger
|
||
|
||
OpenBSD-Commit-ID: 9c114db88d505864075bfe7888b7c8745549715b
|
||
|
||
commit e04fd6dde16de1cdc5a4d9946397ff60d96568db
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Fri Feb 12 03:14:18 2021 +0000
|
||
|
||
upstream: factor SSH_AGENT_CONSTRAIN_EXTENSION parsing into its own
|
||
|
||
function and remove an unused variable; ok dtucker@
|
||
|
||
OpenBSD-Commit-ID: e1a938657fbf7ef0ba5e73b30365734a0cc96559
|
||
|
||
commit 1bb130ed34721d46452529d094d9bbf045607d79
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Thu Feb 11 10:18:05 2021 +1100
|
||
|
||
Add __NR_futex_time64 to seccomp sandbox.
|
||
|
||
This is apparently needed for (some) 32 bit platforms with glibc 2.33.
|
||
Patch from nix at esperi.org.uk and jjelen at redhat.com via bz#3260.
|
||
|
||
commit f88a7a431212a16e572ecabd559e632f369c363e
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Sat Feb 6 09:37:01 2021 +1100
|
||
|
||
Add a hostname function for systems that don't have it.
|
||
|
||
Some systems don't have a hostname command (it's not required by POSIX).
|
||
The do have uname -n (which is), but as found by tim@ some others (eg
|
||
UnixWare) do not report the FQDN from uname -n.
|
||
|
||
commit 5e385a71ef2317856f37c91a98658eb12eb5a89c
|
||
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
||
Date: Fri Feb 5 22:03:40 2021 +0000
|
||
|
||
upstream: Roll back the hostname->uname change in rev 1.10. It turns
|
||
|
||
out uname -n doesn't do what we need for some platforms in portable, so we'll
|
||
fix the original problem (that some other platforms don't have hostname at
|
||
all) by providing wrapper function to implement it.
|
||
|
||
OpenBSD-Regress-ID: 827a707d6201d5a8e196a8c28aec1d2c76c52341
|
||
|
||
commit b446c214279de50ed8388e54897eb1be5281c894
|
||
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
||
Date: Fri Feb 5 06:01:58 2021 +0000
|
||
|
||
upstream: hostname is not specified by POSIX but uname -n is, so use
|
||
|
||
the latter for portability. Patch from Geert Hendrickx via github PR#208.
|
||
|
||
OpenBSD-Regress-ID: d6a79c7c4d141a0d05ade4a042eb57dddbce89f3
|
||
|
||
commit 1cb6ce98d658e5fbdae025a3bd65793980e3b5d9
|
||
Author: David Carlier <devnexen@gmail.com>
|
||
Date: Sat Nov 21 12:22:23 2020 +0000
|
||
|
||
Using explicit_memset for the explicit_bzero compatibility layer.
|
||
|
||
Favoriting the native implementation in this case.
|
||
|
||
commit 2e0beff67def2120f4b051b1016d7fbf84823e78
|
||
Author: Luca Weiss <luca@z3ntu.xyz>
|
||
Date: Sun Nov 8 14:19:23 2020 +0100
|
||
|
||
Deny (non-fatal) statx in preauth privsep child.
|
||
|
||
commit a35d3e911e193a652bd09eed40907e3e165b0a7b
|
||
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
||
Date: Fri Feb 5 02:20:23 2021 +0000
|
||
|
||
upstream: Remove debug message from sigchld handler. While this
|
||
|
||
works on OpenBSD it can cause problems on other platforms. From kircherlike
|
||
at outlook.com via bz#3259, ok djm@
|
||
|
||
OpenBSD-Commit-ID: 3e241d7ac1ee77e3de3651780b5dc47b283a7668
|
||
|
||
commit 69338ab46afe9e3dfb7762ad65351d854077c998
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Tue Feb 2 22:36:59 2021 +0000
|
||
|
||
upstream: whitespace
|
||
|
||
OpenBSD-Commit-ID: 544bb092e03fcbecb420196cd0f70af13ea868ad
|
||
|
||
commit f71219a01d8f71c4b3ed7e456337a84ddba1653e
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Tue Feb 2 22:36:46 2021 +0000
|
||
|
||
upstream: fix memleaks in private key deserialisation; enforce more
|
||
|
||
consistency between redundant fields in private key certificate and private
|
||
key body; ok markus@
|
||
|
||
OpenBSD-Commit-ID: dec344e414d47f0a7adc13aecf3760fe58101240
|
||
|
||
commit 3287790e78bf5b53c4a3cafb67bb5aa03e3910f0
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Tue Feb 2 22:35:14 2021 +0000
|
||
|
||
upstream: memleak on error path; ok markus@
|
||
|
||
OpenBSD-Commit-ID: 2091a36d6ca3980c81891a6c4bdc544e63cb13a8
|
||
|
||
commit 3dd0c64e08f1bba21d71996d635c7256c8c139d1
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Sun Jan 31 22:55:29 2021 +0000
|
||
|
||
upstream: more strictly enforce KEX state-machine by banning packet
|
||
|
||
types once they are received. Fixes memleak caused by duplicate
|
||
SSH2_MSG_KEX_DH_GEX_REQUEST (spotted by portable OpenSSH kex_fuzz via
|
||
oss-fuzz #30078).
|
||
|
||
ok markus@
|
||
|
||
OpenBSD-Commit-ID: 87331c715c095b587d5c88724694cdeb701c9def
|
||
|
||
commit 7a92a324a2e351fabd0ba8ef9b434d3b12d54ee3
|
||
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
||
Date: Sun Jan 31 10:50:10 2021 +0000
|
||
|
||
upstream: Set linesize returned by getline to zero when freeing and
|
||
|
||
NULLing the returned string. OpenBSD's getline handles this just fine, but
|
||
some implementations used by -portable do not. ok djm@
|
||
|
||
OpenBSD-Commit-ID: 4d7bd5169d3397654247db9655cc69a9908d165c
|
||
|
||
commit a5dfc5bae8c16e2a7caf564758d812c7672480b5
|
||
Author: Damien Miller <djm@mindrot.org>
|
||
Date: Sat Jan 30 16:32:29 2021 +1100
|
||
|
||
allow a fuzz case to contain more than one request
|
||
|
||
loop until input buffer empty, no message consumed or 256 messages
|
||
processed
|
||
|
||
commit 0ef24ad60204022f7e33b6e9d171172c50514132
|
||
Author: Damien Miller <djm@mindrot.org>
|
||
Date: Sat Jan 30 16:28:23 2021 +1100
|
||
|
||
expect fuzz cases to have length prefix
|
||
|
||
might make life a little easier for the fuzzer, e.g. it can now
|
||
produce valid (multi-request) messages by smashing two cases together.
|
||
|
||
commit de613f2713d2dfcd3b03c00e5558a40997f52712
|
||
Author: Damien Miller <djm@mindrot.org>
|
||
Date: Sat Jan 30 12:03:30 2021 +1100
|
||
|
||
ssh-agent fuzzer
|
||
|
||
commit 7e96c877bcb2fb645355a687b8cb7347987c1c58
|
||
Author: Damien Miller <djm@mindrot.org>
|
||
Date: Sat Jan 30 12:02:46 2021 +1100
|
||
|
||
move keys out of kex_fuzz.cc into separate header
|
||
|
||
add certificates and missing key types
|
||
|
||
commit 76f46d75664fdaa1112739ca523ff85ee4eb52b4
|
||
Author: Damien Miller <djm@mindrot.org>
|
||
Date: Sat Jan 30 12:02:10 2021 +1100
|
||
|
||
some fixed test data (mostly keys) for fuzzing
|
||
|
||
commit 7c2e3d6de1f2edb0c8b4725b4c2b56360e032b19
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Sat Jan 30 00:56:38 2021 +0000
|
||
|
||
upstream: add a SK_DUMMY_INTEGRATE define that allows the dummy
|
||
|
||
security key middleware to be directly linked; useful for writing fuzzers,
|
||
etc.
|
||
|
||
OpenBSD-Regress-ID: 0ebd00159b58ebd85e61d8270fc02f1e45df1544
|
||
|
||
commit 1a4b92758690faa12f49079dd3b72567f909466d
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Fri Jan 29 06:29:46 2021 +0000
|
||
|
||
upstream: fix the values of enum sock_type
|
||
|
||
OpenBSD-Commit-ID: 18d048f4dbfbb159ff500cfc2700b8fb1407facd
|
||
|
||
commit 8afaa7d7918419d3da6c0477b83db2159879cb33
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Fri Jan 29 06:28:10 2021 +0000
|
||
|
||
upstream: give typedef'd struct a struct name; makes the fuzzer I'm
|
||
|
||
writing a bit easier
|
||
|
||
OpenBSD-Commit-ID: 1052ab521505a4d8384d67acb3974ef81b8896cb
|
||
|
||
commit 1e660115f0c7c4a750cd31e468ff889f33dd8088
|
||
Author: Damien Miller <djm@mindrot.org>
|
||
Date: Fri Jan 29 11:09:14 2021 +1100
|
||
|
||
fuzz diffie-hellman-group-exchange-sha1 kex too
|
||
|
||
commit be5f0048ea2aaeddd27be7dcca23aaad345fa16c
|
||
Author: Damien Miller <djm@mindrot.org>
|
||
Date: Fri Jan 29 11:03:35 2021 +1100
|
||
|
||
support for running kex fuzzer with null cipher
|
||
|
||
commit 3d59e88c0e42182c3749b446ccd9027933c84be4
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Thu Jan 28 20:55:16 2021 +1100
|
||
|
||
make with -j2 to use available CPUs.
|
||
|
||
commit 66dd9ddb5d2ea8c407908c8e8468c9d6e71db05b
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Thu Jan 28 14:31:01 2021 +1100
|
||
|
||
Add test against openssl head and libressl head.
|
||
|
||
commit 237dbb34e24b6b7ea888d54bda4d17da0a0fd0fa
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Thu Jan 28 14:30:50 2021 +1100
|
||
|
||
Remove whitespace.
|
||
|
||
commit d983e1732b8135d7ee8d92290d6dce35f736ab88
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Wed Jan 27 23:49:46 2021 +0000
|
||
|
||
upstream: fix leak: was double allocating kex->session_id buffer
|
||
|
||
OpenBSD-Commit-ID: 3765f4cc3ae1df874dba9102a3588ba7b48b8183
|
||
|
||
commit 1134a48cdcef8e7363b9f6c73ebdd24405066738
|
||
Author: Damien Miller <djm@mindrot.org>
|
||
Date: Thu Jan 28 08:57:31 2021 +1100
|
||
|
||
correct kex name in disabled code
|
||
|
||
commit 67f47f1965abafc1830a287761125c2f4790857e
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Wed Jan 27 10:15:08 2021 +0000
|
||
|
||
upstream: this needs kex.h now
|
||
|
||
OpenBSD-Commit-ID: c5a42166c5aa002197217421a971e48be7cb5d41
|
||
|
||
commit 39be3dc209f28f9c1ebfeba42adde8963b01e1cd
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Wed Jan 27 10:05:28 2021 +0000
|
||
|
||
upstream: make ssh->kex->session_id a sshbuf instead of u_char*/size_t
|
||
|
||
and use that instead of global variables containing copies of it. feedback/ok
|
||
markus@
|
||
|
||
OpenBSD-Commit-ID: a4b1b1ca4afd2e37cb9f64f737b30a6a7f96af68
|
||
|
||
commit 4ca6a1fac328477c642329676d6469dba59019a3
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Wed Jan 27 09:26:53 2021 +0000
|
||
|
||
upstream: remove global variable used to stash compat flags and use the
|
||
|
||
purpose-built ssh->compat variable instead; feedback/ok markus@
|
||
|
||
OpenBSD-Commit-ID: 7c4f200e112dae6bcf99f5bae1a5629288378a06
|
||
|
||
commit bba229b6f3328171f5e3ae85de443002523c0452
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Wed Jan 27 12:34:07 2021 +1100
|
||
|
||
Install moduli file before tests.
|
||
|
||
Reduces warnings during test runs.
|
||
|
||
commit 1b83185593a90a73860a503d753a95ca6d726c00
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Wed Jan 27 11:58:26 2021 +1100
|
||
|
||
Run one test with -Werror to catch warnings.
|
||
|
||
commit d1532d90074b212054d5fd965f833231b09982f5
|
||
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
||
Date: Wed Jan 27 00:37:26 2021 +0000
|
||
|
||
upstream: Logical not bitwise or. ok djm@
|
||
|
||
OpenBSD-Commit-ID: d4dc855cf04951b93c45caa383e1ac9af0a3b0e5
|
||
|
||
commit 507b448a2465a53ab03a88acbc71cc51b48ca6ac
|
||
Author: naddy@openbsd.org <naddy@openbsd.org>
|
||
Date: Tue Jan 26 15:40:17 2021 +0000
|
||
|
||
upstream: move HostbasedAcceptedAlgorithms to the right place in
|
||
|
||
alphabetical order
|
||
|
||
OpenBSD-Commit-ID: d766820d33dd874d944c14b0638239adb522c7ec
|
||
|
||
commit e26c980778b228bdd42b8353cc70101cf49b731b
|
||
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
||
Date: Tue Jan 26 11:25:01 2021 +0000
|
||
|
||
upstream: Remove unused variables leftover from refactoring. ok
|
||
|
||
djm@
|
||
|
||
OpenBSD-Commit-ID: 8b3ad58bff828fcf874e54b2fc27a4cf1d9505e8
|
||
|
||
commit e9f78d6b06fc323bba1890b2dc3b8423138fb35c
|
||
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
||
Date: Tue Jan 26 05:32:21 2021 +0000
|
||
|
||
upstream: Rename HostbasedKeyTypes (ssh) and
|
||
|
||
HostbasedAcceptedKeyTypes (sshd) to HostbasedAcceptedAlgorithms, which more
|
||
accurately reflects its effect. This matches a previous change to
|
||
PubkeyAcceptedAlgorithms. The previous names are retained as aliases. ok
|
||
djm@
|
||
|
||
OpenBSD-Commit-ID: 49451c382adc6e69d3fa0e0663eeef2daa4b199e
|
||
|
||
commit 48d0d7a4dd31154c4208ec39029d60646192f978
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Tue Jan 26 14:48:07 2021 +1100
|
||
|
||
Disable sntrup761 if compiler doesn't support VLAs.
|
||
|
||
The sntrup761 code sourced from supercop uses variable length
|
||
arrays. Although widely supported, they are not part of the ANSI
|
||
C89 spec so if the compiler does not support VLAs, disable the
|
||
sntrup761x25519-sha512@openssh.com KEX method by replacing the kex
|
||
functions with no-op ones similar to what we do in kexecdh.c.
|
||
|
||
This should allow OpenSSH to build with a plain C89 compiler again.
|
||
Spotted by tim@, ok djm@.
|
||
|
||
commit 37c70ea8d4f3664a88141bcdf0bf7a16bd5fd1ac
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Tue Jan 26 00:54:49 2021 +0000
|
||
|
||
upstream: refactor key constraint parsing in ssh-agent
|
||
|
||
Key constraints parsing code previously existed in both the "add regular
|
||
key" and "add smartcard key" path. This unifies them but also introduces
|
||
more consistency checking: duplicated constraints and constraints that
|
||
are nonsensical for a particular situation (e.g. FIDO provider for a
|
||
smartcard key) are now banned.
|
||
|
||
ok markus@
|
||
|
||
OpenBSD-Commit-ID: 511cb1b1c021ee1d51a4c2d649b937445de7983c
|
||
|
||
commit e0e8bee8024fa9e31974244d14f03d799e5c0775
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Tue Jan 26 00:53:31 2021 +0000
|
||
|
||
upstream: more ssh-agent refactoring
|
||
|
||
Allow confirm_key() to accept an additional reason suffix
|
||
|
||
Factor publickey userauth parsing out into its own function and allow
|
||
it to optionally return things it parsed out of the message to its
|
||
caller.
|
||
|
||
feedback/ok markus@
|
||
|
||
OpenBSD-Commit-ID: 29006515617d1aa2d8b85cd2bf667e849146477e
|
||
|
||
commit dfe18a295542c169ffde8533b3d7fe42088e2de7
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Tue Jan 26 00:51:30 2021 +0000
|
||
|
||
upstream: make struct hostkeys public; I have no idea why I made it
|
||
|
||
opaque originally.
|
||
|
||
ok markus@
|
||
|
||
OpenBSD-Commit-ID: e50780b34d4bbe628d69b2405b024dd749d982f3
|
||
|
||
commit 3b44f2513cae89c920e8fe927b9bc910a1c8c65a
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Tue Jan 26 00:49:30 2021 +0000
|
||
|
||
upstream: move check_host_cert() from sshconnect,c to sshkey.c and
|
||
|
||
refactor it to make it more generally usable and testable.
|
||
|
||
ok markus@
|
||
|
||
OpenBSD-Commit-ID: 536f489f5ff38808c1fa711ba58d4579b636f9e4
|
||
|
||
commit 1fe16fd61bb53944ec510882acc0491abd66ff76
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Tue Jan 26 00:47:47 2021 +0000
|
||
|
||
upstream: use recallocarray to allocate the agent sockets table;
|
||
|
||
also clear socket entries that are being marked as unused.
|
||
|
||
spinkle in some debug2() spam to make it easier to watch an agent
|
||
do its thing.
|
||
|
||
ok markus
|
||
|
||
OpenBSD-Commit-ID: 74582c8e82e96afea46f6c7b6813a429cbc75922
|
||
|
||
commit cb7b22ea20a01332c81c0ddcb3555ad50de9cce2
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Tue Jan 26 00:46:17 2021 +0000
|
||
|
||
upstream: factor out common code in the agent client
|
||
|
||
Add a ssh_request_reply_decode() function that sends a message to
|
||
the agent, reads and parses a success/failure reply.
|
||
Use it for all requests that only expect success/failure
|
||
|
||
ok markus@
|
||
|
||
OpenBSD-Commit-ID: e0c1f4d5e6cfa525d62581e2b8de93be0cb85adb
|
||
|
||
commit d1e578afe7cd48140ad6e92a453f9b035363fd7f
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Mon Jan 25 06:00:17 2021 +0000
|
||
|
||
upstream: make ssh hostbased authentication send the signature
|
||
|
||
algorithm in its SSH2_MSG_USERAUTH_REQUEST packets instead of the key type.
|
||
This make HostbasedAcceptedAlgorithms do what it is supposed to - filter on
|
||
signature algorithm and not key type.
|
||
|
||
spotted with dtucker@ ok markus@
|
||
|
||
OpenBSD-Commit-ID: 25bffe19f0326972f5728170f7da81d5f45c78c6
|
||
|
||
commit 95eca1e195a3b41baa1a725c2c5af8a09d885e4b
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Sat Jan 23 18:26:05 2021 +1100
|
||
|
||
ifdef new instance of sin6_scope_id
|
||
|
||
Put inside HAVE_STRUCT_SOCKADDR_IN6_SIN6_SCOPE_ID similar to
|
||
existing instance. Should fix error on UnixWare 7.
|
||
|
||
commit 6ffdcdda128045226dda7fbb3956407978028a1e
|
||
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
||
Date: Mon Jan 18 11:43:34 2021 +0000
|
||
|
||
upstream: Fix long->int for convtime tests here too. Spotted by
|
||
|
||
tobhe@.
|
||
|
||
OpenBSD-Regress-ID: a87094f5863312d00938afba771d25f788c849d0
|
||
|
||
commit b55b7565f15327d82ad7acbddafa90b658c5f0af
|
||
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
||
Date: Fri Jan 22 02:46:40 2021 +0000
|
||
|
||
upstream: PubkeyAcceptedKeyTypes->PubkeyAcceptedAlgorithms
|
||
|
||
here too.
|
||
|
||
OpenBSD-Commit-ID: 3b64a640f8ce8c21d9314da9df7ce2420eefde3a
|
||
|
||
commit ee9c0da8035b3168e8e57c1dedc2d1b0daf00eec
|
||
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
||
Date: Fri Jan 22 02:44:58 2021 +0000
|
||
|
||
upstream: Rename PubkeyAcceptedKeyTypes keyword to
|
||
|
||
PubkeyAcceptedAlgorithms. While the two were originally equivalent, this
|
||
actually specifies the signature algorithms that are accepted. Some key
|
||
types (eg RSA) can be used by multiple algorithms (eg ssh-rsa, rsa-sha2-512)
|
||
so the old name is becoming increasingly misleading. The old name is
|
||
retained as an alias. Prompted by bz#3253, help & ok djm@, man page help jmc@
|
||
|
||
OpenBSD-Commit-ID: 0346b2f73f54c43d4e001089759d149bfe402ca5
|
||
|
||
commit a8e798feabe36d02de292bcfd274712cae1d8d17
|
||
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
||
Date: Fri Jan 15 02:58:11 2021 +0000
|
||
|
||
upstream: Change types in convtime() unit test to int to match change
|
||
|
||
its new type. Add tests for boundary conditions and fix convtime to work up
|
||
to INT_MAX. ok djm@
|
||
|
||
OpenBSD-Regress-ID: ba2b81e9a3257fff204b020affe85b604a44f97e
|
||
|
||
commit 9bde1a420626da5007bf7ab499fa2159b9eddf72
|
||
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
||
Date: Fri Jan 15 04:31:25 2021 +0000
|
||
|
||
upstream: Make output buffer larger to prevent potential truncation
|
||
|
||
warnings from compilers not smart enough to know the strftime calls won't
|
||
ever fully fill "to" and "from". ok djm@
|
||
|
||
OpenBSD-Commit-ID: 83733f1b01b82da88b9dd1769475952aff10bdd7
|
||
|
||
commit 02da325f10b214219eae2bb1bc2d3bf0c2f13f9f
|
||
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
||
Date: Fri Jan 15 02:58:11 2021 +0000
|
||
|
||
upstream: Change types in convtime() unit test to int to match
|
||
|
||
change its new type. Add tests for boundary conditions and fix convtime to
|
||
work up to INT_MAX. ok djm@
|
||
|
||
OpenBSD-Commit-ID: 01dc0475f1484ac2f47facdfcf9221f9472145de
|
||
|
||
commit 5339ab369c225b40bc64d5ec3374f5c91b3ad609
|
||
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
||
Date: Fri Jan 15 02:32:41 2021 +0000
|
||
|
||
upstream: In waitfd(), when poll returns early we are subtracting
|
||
|
||
the elapsed time from the timeout each loop, so we only want to measure the
|
||
elapsed time the poll() in that loop, not since the start of the function.
|
||
Spotted by chris.xj.zhu at gmail.com, ok djm@
|
||
|
||
OpenBSD-Commit-ID: 199df060978ee9aa89b8041a3dfaf1bf7ae8dd7a
|
||
|
||
commit a164862dfa863b54b7897f66e1dd75437f086c11
|
||
Author: rob@openbsd.org <rob@openbsd.org>
|
||
Date: Thu Jan 14 19:45:06 2021 +0000
|
||
|
||
upstream: Minor grammatical correction.
|
||
|
||
OK jmc@
|
||
|
||
OpenBSD-Commit-ID: de0fad0581e212b2750751e479b79c18ff8cac02
|
||
|
||
commit 8635e7df7e3a3fbb4a4f6cd5a7202883b2506087
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Wed Jan 13 18:00:57 2021 +1100
|
||
|
||
Merge Mac OS X targets into a single config.
|
||
|
||
commit ac112ade990585c511048ed4edaf2d9fc92b61f0
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Tue Jan 12 19:22:47 2021 +1100
|
||
|
||
Add Mac OS X test targets.
|
||
|
||
commit 1050109b4b2884bf50fd1b3aa084c7fd0a42ae90
|
||
Author: anatasluo <luolongjuna@gmail.com>
|
||
Date: Mon Jan 11 13:51:39 2021 +0000
|
||
|
||
Remove duplicated declaration in fatal.c .
|
||
|
||
commit 7d0f8a3369579dfe398536eb4e3da7bc15da9599
|
||
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
||
Date: Mon Jan 11 04:48:22 2021 +0000
|
||
|
||
upstream: Correct spelling of persourcenetblocksize in config-dump
|
||
|
||
mode.
|
||
|
||
OpenBSD-Commit-ID: ecdc49e2b6bde6b6b0e52163d621831f6ac7b13d
|
||
|
||
commit ba328bd7a6774f30daaf90b83f1933cc4afc866c
|
||
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
||
Date: Sat Jan 9 12:31:46 2021 +0000
|
||
|
||
upstream: Adjust kexfuzz to addr.c/addrmatch.c split.
|
||
|
||
OpenBSD-Regress-ID: 1d8d23bb548078020be2fb52c4c643efb190f0eb
|
||
|
||
commit b08ef25552443e94c0857d5e3806dd019ccc55d7
|
||
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
||
Date: Sat Jan 9 12:24:30 2021 +0000
|
||
|
||
upstream: Update unittests for addr.c/addrmatch.c split.
|
||
|
||
OpenBSD-Regress-ID: de2b415fb7af084a91c6ef147a90482d8f771eef
|
||
|
||
commit 6d30673fedec2d251f4962c526fd0451f70c4d97
|
||
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
||
Date: Mon Jan 11 02:12:57 2021 +0000
|
||
|
||
upstream: Change convtime() from returning long to returning int.
|
||
|
||
On platforms where sizeof(int) != sizeof(long), convtime could accept values
|
||
>MAX_INT which subsequently truncate when stored in an int during config
|
||
parsing. bz#3250, ok djm@
|
||
|
||
OpenBSD-Commit-ID: 8fc932683d6b4660d52f50911d62bd6639c5db31
|
||
|
||
commit 7a57adb8b07b2ad0aead4b2e09ee18edc04d0481
|
||
Author: jmc@openbsd.org <jmc@openbsd.org>
|
||
Date: Sat Jan 9 12:51:12 2021 +0000
|
||
|
||
upstream: add a comma to previous;
|
||
|
||
OpenBSD-Commit-ID: 9139433701c0aa86a0d3a6c7afe10d1c9c2e0869
|
||
|
||
commit 3a923129534b007c2e24176a8655dec74eca9c46
|
||
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
||
Date: Sat Jan 9 12:10:02 2021 +0000
|
||
|
||
upstream: Add PerSourceMaxStartups and PerSourceNetBlockSize
|
||
|
||
options which provide more fine grained MaxStartups limits. Man page help
|
||
jmc@, feedback & ok djm@
|
||
|
||
OpenBSD-Commit-ID: e2f68664e3d02c0895b35aa751c48a2af622047b
|
||
|
||
commit d9a2bc71693ea27461a78110005d5a2d8b0c6a50
|
||
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
||
Date: Sat Jan 9 11:58:50 2021 +0000
|
||
|
||
upstream: Move address handling functions out into their own file
|
||
|
||
in order to reuse them for per-source maxstartups limiting. Supplement with
|
||
some additional functions from djm's flowtools that we'll also need. ok djm@
|
||
(as part of a larger diff).
|
||
|
||
OpenBSD-Commit-ID: e3e7d9ccc6c9b82e25cfef0ec83598e8e2327cbf
|
||
|
||
commit b744914fcb76d70761f1b667de95841b3fc80a56
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Sat Jan 9 00:36:05 2021 +1100
|
||
|
||
Add test against Graphene hardened malloc.
|
||
|
||
commit 6cb52d5bf771f6769b630fce35a8e9b8e433044f
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Fri Jan 8 04:49:13 2021 +0000
|
||
|
||
upstream: make CheckHostIP default to 'no'. It doesn't provide any
|
||
|
||
perceptible value and makes it much harder for hosts to change host keys,
|
||
particularly ones that use IP-based load-balancing.
|
||
|
||
ok dtucker@
|
||
|
||
OpenBSD-Commit-ID: 0db98413e82074f78c7d46784b1286d08aee78f0
|
||
|
||
commit 309b642e1442961b5e57701f095bcd4acd2bfb5f
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Fri Jan 8 15:50:41 2021 +1100
|
||
|
||
Run tests with sudo for better coverage.
|
||
|
||
commit c336644351fa3c715a08b7a292e309e72792e71e
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Fri Jan 8 14:26:32 2021 +1100
|
||
|
||
Add Ubuntu 16.04 and 20.04 test targets.
|
||
|
||
commit 4c7af01f9dcc1606dec033e7665a042cb0d8ec52
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Fri Jan 8 02:57:24 2021 +0000
|
||
|
||
upstream: If a signature operation on a FIDO key fails with a
|
||
|
||
"incorrect PIN" reason and no PIN was initially requested from the user, then
|
||
request a PIN and retry the operation.
|
||
|
||
This smoothes over a few corner cases including FIDO devices that
|
||
require PINs for all hosted credentials, biometric FIDO devices that
|
||
fall back to requiring PIN when reading the biometric failed, devices
|
||
that don't implement reading credProtect status for downloaded keys
|
||
and probably a few more cases that I haven't though of yet.
|
||
|
||
ok dtucker@
|
||
|
||
OpenBSD-Commit-ID: 176db8518933d6a5bbf81a2e3cf62447158dc878
|
||
|
||
commit 64ddd0fe68c4a7acf99b78624f8af45e919cd317
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Fri Jan 8 02:44:14 2021 +0000
|
||
|
||
upstream: don't try to use timespeccmp(3) directly as a qsort(3)
|
||
|
||
comparison function - it returns 0/1 and not the -1/0/1 that qsort expectes.
|
||
|
||
fixes sftp "ls -ltr" under some circumstances.
|
||
|
||
Based on patch by Masahiro Matsuya via bz3248.
|
||
|
||
OpenBSD-Commit-ID: 65b5e9f18bb0d10573868c3516de6e5170adb163
|
||
|
||
commit 599df78f3008cf78af21f8977be3e1dd085f8e2e
|
||
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
||
Date: Fri Jan 8 02:33:13 2021 +0000
|
||
|
||
upstream: Update the sntrup761 creation script and generated code:
|
||
|
||
- remove unneeded header files and typedefs and rely on crypto_api.h - add
|
||
defines to map types used to the crypto_api ones instead of typedefs. This
|
||
prevents typedef name collisions in -portable. - remove CRYPTO_NAMESPACE
|
||
entirely instead of making it a no-op - delete unused functions and make the
|
||
remaining ones that aren't exported static.
|
||
|
||
ok djm@
|
||
|
||
OpenBSD-Commit-ID: 7b9d0cf3acd5a3c1091da8afe00c904d38cf5783
|
||
|
||
commit 16448ff529affda7e2a15ee7c3200793abde0759
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Fri Jan 8 02:19:24 2021 +0000
|
||
|
||
upstream: mention that DisableForwarding is valid in a sshd_config
|
||
|
||
Match block reported by Fredrik Eriksson in bz3239
|
||
|
||
OpenBSD-Commit-ID: 3a71c3d84b597f5e43e4b40d5232797daf0993f6
|
||
|
||
commit 91bac5e95b1b0debf9b2b4f05c20dcfa96b368b9
|
||
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
||
Date: Mon Jan 4 21:58:58 2021 +0000
|
||
|
||
upstream: estructure sntrup761.sh to process all files in a single
|
||
|
||
list, which will make it easier to reorder. Re-inline int32_MINMAX. ok
|
||
tobhe@
|
||
|
||
OpenBSD-Commit-ID: d145c6c19b08bb93c9e14bfaa7af589d90f144c0
|
||
|
||
commit 4d96a3ebab2224f17e639a15078e03be1ad3736d
|
||
Author: tobhe@openbsd.org <tobhe@openbsd.org>
|
||
Date: Sun Jan 3 18:05:21 2021 +0000
|
||
|
||
upstream: Prevent redefinition of `crypto_int32' error with gcc3.
|
||
|
||
Fixes compilation on luna88k.
|
||
|
||
Feedback millert@
|
||
Found by and ok aoyama@
|
||
|
||
OpenBSD-Commit-ID: f305ddfe575a26cc53431af3fde3f4aeebed9ba6
|
||
|
||
commit a23954eeb930ccc8a66a2710153730769dba31b6
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Fri Jan 1 22:00:49 2021 +1100
|
||
|
||
Undef int32 after sort routines.
|
||
|
||
This prevents typedef'ing crypto_int32 twice, in sntrup761.c and
|
||
crypto_api.h, which some compilers (at least some GCCs) don't accept.
|
||
|
||
commit 148b8a661c3f93e4b6d049ee902de3d521261fbc
|
||
Author: Damien Miller <djm@mindrot.org>
|
||
Date: Thu Dec 31 12:47:22 2020 +1100
|
||
|
||
fix: missing pieces of previous commit
|
||
|
||
commit 3d999be7b987c848feda718cfcfcdc005ddf670d
|
||
Author: tobhe@openbsd.org <tobhe@openbsd.org>
|
||
Date: Wed Dec 30 14:13:28 2020 +0000
|
||
|
||
upstream: Use int64_t for intermediate values in int32_MINMAX to
|
||
|
||
prevent signed 32-bit integer overflow.
|
||
|
||
Found by and ok djm@
|
||
ok markus@
|
||
|
||
OpenBSD-Commit-ID: 4f0704768e34cf45fdd792bac4011c6971881bb3
|
||
|
||
commit 5c1953bf98732da5a76c706714ac066dbfa015ac
|
||
Author: Damien Miller <djm@mindrot.org>
|
||
Date: Tue Dec 29 12:40:54 2020 +1100
|
||
|
||
adapt KEX fuzzer to PQ kex change
|
||
|
||
commit 659864fe81dbc57eeed3769c462679d83e026640
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Tue Dec 29 01:02:15 2020 +0000
|
||
|
||
upstream: Adapt to replacement of
|
||
|
||
sntrup4591761x25519-sha512@tinyssh.org with
|
||
sntrup761x25519-sha512@openssh.com.
|
||
|
||
Also test sntrup761x25519-sha512@openssh.com in unittests/kex
|
||
|
||
OpenBSD-Regress-ID: cfa3506b2b077a9cac1877fb521efd2641b6030c
|
||
|
||
commit 2c71cec020219d69df84055c59eba5799a1233ec
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Tue Dec 29 00:59:15 2020 +0000
|
||
|
||
upstream: Update/replace the experimental post-quantim hybrid key
|
||
|
||
exchange method based on Streamlined NTRU Prime (coupled with X25519).
|
||
|
||
The previous sntrup4591761x25519-sha512@tinyssh.org method is
|
||
replaced with sntrup761x25519-sha512@openssh.com. Per the authors,
|
||
sntrup4591761 was replaced almost two years ago by sntrup761.
|
||
|
||
The sntrup761 implementaion, like sntrup4591761 before it, is public
|
||
domain code extracted from the SUPERCOP cryptography benchmark
|
||
suite (https://bench.cr.yp.to/supercop.html).
|
||
|
||
Thanks for Daniel J Bernstein for guidance on algorithm selection.
|
||
Patch from Tobias Heider; feedback & ok markus@ and myself
|
||
|
||
(note this both the updated method and the one that it replaced are
|
||
disabled by default)
|
||
|
||
OpenBSD-Commit-ID: 2bf582b772d81ee24e911bb6f4b2aecfd39338ae
|
||
|
||
commit 09d070ccc3574ae0d7947d212ed53c7268ef7e1f
|
||
Author: jmc@openbsd.org <jmc@openbsd.org>
|
||
Date: Tue Dec 22 07:40:26 2020 +0000
|
||
|
||
upstream: tweak the description of KnownHostsCommand in ssh_conf.5,
|
||
|
||
and add entries for it to the -O list in scp.1 and sftp.1;
|
||
|
||
ok djm
|
||
|
||
OpenBSD-Commit-ID: aba31ebea03f38f8d218857f7ce16a500c3e4aff
|
||
|
||
commit 931c93389a80e32272712459b1102d303844453d
|
||
Author: Damien Miller <djm@mindrot.org>
|
||
Date: Tue Dec 22 19:43:55 2020 +1100
|
||
|
||
whitespace at EOL
|
||
|
||
commit 397b1c4d393f97427283a4717e9015a2bd31b8a5
|
||
Author: Damien Miller <djm@mindrot.org>
|
||
Date: Tue Dec 22 19:42:37 2020 +1100
|
||
|
||
whitespace at EOL
|
||
|
||
commit 33fa3ac547e5349ca34681cce6727b2f933dff0a
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Tue Dec 22 19:21:26 2020 +1100
|
||
|
||
Improve AIX text.
|
||
|
||
commit 0f2e21c9dca89598b694932b5b05848380a23ec0
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Tue Dec 22 18:56:54 2020 +1100
|
||
|
||
Include stdio.h for FILE in misc.h.
|
||
|
||
Fixes build on at least OpenBSD.
|
||
|
||
commit 3e9811e57b57ee66b0f70d99d7258da3153b0e8a
|
||
Author: Damien Miller <djm@mindrot.org>
|
||
Date: Tue Dec 22 18:31:50 2020 +1100
|
||
|
||
ensure $LOGNAME is set in tests
|
||
|
||
commit 3eb647cbb34d87a063aa7714256c6e56103fffda
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Tue Dec 22 06:47:24 2020 +0000
|
||
|
||
upstream: more detail for failing tests
|
||
|
||
OpenBSD-Regress-ID: c68c0e5a521cad7e7f68e54c54ebf86d6c10ee1d
|
||
|
||
commit 2873f19570d4d8758be24dbf78332be9a779009b
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Tue Dec 22 06:03:36 2020 +0000
|
||
|
||
upstream: regress test for KnownHostsCommand
|
||
|
||
OpenBSD-Regress-ID: ffc77464320b6dabdcfa0a72e0df02659233a38a
|
||
|
||
commit 0121aa87bab9ad2365de2d07f2832b56d5ff9871
|
||
Author: tb@openbsd.org <tb@openbsd.org>
|
||
Date: Tue Dec 22 03:05:31 2020 +0000
|
||
|
||
upstream: Remove lines accidentally left behind in the ProxyJump
|
||
|
||
parsing fix r1.345.
|
||
|
||
ok djm
|
||
|
||
OpenBSD-Commit-ID: fe767c108c8117bea33767b080ff62eef2c55f5c
|
||
|
||
commit da4bf0db942b5f0278f33238b86235e5813d7a5a
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Tue Dec 22 00:15:22 2020 +0000
|
||
|
||
upstream: add a ssh_config KnownHostsCommand that allows the client
|
||
|
||
to obtain known_hosts data from a command in addition to the usual files.
|
||
|
||
The command accepts bunch of %-expansions, including details of the
|
||
connection and the offered server host key. Note that the command may
|
||
be invoked up to three times per connection (see the manpage for
|
||
details).
|
||
|
||
ok markus@
|
||
|
||
OpenBSD-Commit-ID: 2433cff4fb323918ae968da6ff38feb99b4d33d0
|
||
|
||
commit a34e14a5a0071de2036826a00197ce38c8b4ba8b
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Tue Dec 22 00:12:22 2020 +0000
|
||
|
||
upstream: move subprocess() from auth.c to misc.c
|
||
|
||
make privilege dropping optional but allow it via callbacks (to avoid
|
||
need to link uidswap.c everywhere)
|
||
|
||
add some other flags (keep environment, disable strict path safety check)
|
||
that make this more useful for client-side use.
|
||
|
||
feedback & ok markus@
|
||
|
||
OpenBSD-Commit-ID: a80ea9fdcc156f1a18e9c166122c759fae1637bf
|
||
|
||
commit 649205fe388b56acb3481a1b2461f6b5b7c6efa6
|
||
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
||
Date: Mon Dec 21 22:48:41 2020 +0000
|
||
|
||
upstream: Remove explicit rijndael-cbc@lysator.liu.se test since the
|
||
|
||
cipher was removed.
|
||
|
||
OpenBSD-Regress-ID: aa93cddb4ecd9bc21446a79008a1a53050e64f17
|
||
|
||
commit 03e93c753d7c223063ad8acaf9a30aa511e5f931
|
||
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
||
Date: Mon Dec 21 11:09:32 2020 +0000
|
||
|
||
upstream: Remove the pre-standardization cipher
|
||
|
||
rijndael-cbc@lysator.liu.se. It is an alias for aes256-cbc which was
|
||
standardized in RFC4253 (2006), has been deprecated and disabled by default
|
||
since OpenSSH 7.2 (2016) and was only briefly documented in ssh.1 in 2001.
|
||
|
||
This will reduce the amount of work the cipher/kex regression tests need
|
||
to do by a little bit. ok markus@ djm@
|
||
|
||
OpenBSD-Commit-ID: fb460acc18290a998fd70910b19c29b4e4f199ad
|
||
|
||
commit a11ca015879eab941add8c6bdaaec7d41107c6f5
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Mon Dec 21 09:19:53 2020 +0000
|
||
|
||
upstream: properly fix ProxyJump parsing; Thanks to tb@ for
|
||
|
||
pointing out my error (parse_ssh_uri() can return -1/0/1, that I missed).
|
||
Reported by Raf Czlonka via bugs@
|
||
|
||
ok tb@
|
||
|
||
OpenBSD-Commit-ID: a2991a3794bcaf1ca2b025212cce11cdb5f6b7d6
|
||
|
||
commit d97fb879724f1670bf55d9adfea7278a93c33ae2
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Mon Dec 21 01:31:06 2020 +0000
|
||
|
||
upstream: adapt to API change in hostkeys_foreach()/load_hostkeys()
|
||
|
||
OpenBSD-Regress-ID: dcb468514f32da49a446372453497dc6eeafdbf3
|
||
|
||
commit bf7eb3c266b7fd4ddda108fcf72b860af2af6406
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Fri Oct 16 14:02:24 2020 +0000
|
||
|
||
upstream: few more things needs match.c and addrmatch.c now that
|
||
|
||
log.c calls match_pattern_list()
|
||
|
||
OpenBSD-Regress-ID: f7c95c76b150d0aeb00a67858b9579b7d1b2db74
|
||
|
||
commit 2c64f24e27a5e72a7f59e515fc4f4985355237ae
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Mon Dec 21 14:02:56 2020 +1100
|
||
|
||
Pull in missing rev 1.2.
|
||
|
||
commit 0f504f592d15d8047e466eb7453067a6880992a8
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Sun Dec 20 23:40:19 2020 +0000
|
||
|
||
upstream: plumb ssh_conn_info through to sshconnect.c; feedback/ok
|
||
|
||
markus@
|
||
|
||
OpenBSD-Commit-ID: e8d14a09cda3f1dc55df08f8a4889beff74e68b0
|
||
|
||
commit 729b05f59ded35483acef90a6f88aa03eae33b29
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Sun Dec 20 23:38:00 2020 +0000
|
||
|
||
upstream: allow UserKnownHostsFile=none; feedback and ok markus@
|
||
|
||
OpenBSD-Commit-ID: c46d515eac94a35a1d50d5fd71c4b1ca53334b48
|
||
|
||
commit b4c7cd1185c5dc0593d47eafcc1a34fda569dd1d
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Sun Dec 20 23:36:51 2020 +0000
|
||
|
||
upstream: load_hostkeys()/hostkeys_foreach() variants for FILE*
|
||
|
||
Add load_hostkeys_file() and hostkeys_foreach_file() that accept a
|
||
FILE* argument instead of opening the file directly.
|
||
|
||
Original load_hostkeys() and hostkeys_foreach() are implemented using
|
||
these new interfaces.
|
||
|
||
Add a u_int note field to the hostkey_entry and hostkey_foreach_line
|
||
structs that is passed directly from the load_hostkeys() and
|
||
hostkeys_foreach() call. This is a lightweight way to annotate results
|
||
between different invocations of load_hostkeys().
|
||
|
||
ok markus@
|
||
|
||
OpenBSD-Commit-ID: 6ff6db13ec9ee4edfa658b2c38baad0f505d8c20
|
||
|
||
commit 06fbb386bed666581095cb9cbc7a900e02bfe1b7
|
||
Author: tobhe@openbsd.org <tobhe@openbsd.org>
|
||
Date: Sat Dec 19 22:09:21 2020 +0000
|
||
|
||
upstream: Print client kem key with correct length.
|
||
|
||
ok markus@
|
||
|
||
OpenBSD-Commit-ID: 91689e14a4fc6c270e265a32d1c8faba63a45755
|
||
|
||
commit 0ebead6593e2441e4af2735bbe2cd097607cd0d3
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Thu Dec 17 23:28:50 2020 +0000
|
||
|
||
upstream: fix possible error("%s", NULL) on error paths
|
||
|
||
OpenBSD-Commit-ID: 0b3833c2cb985453ecca1d76803ebb8f3b736a11
|
||
|
||
commit d060bc7f6e6244f001e658208f53e3e2ecbbd382
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Thu Dec 17 23:26:11 2020 +0000
|
||
|
||
upstream: refactor client percent_expand() argument passing;
|
||
|
||
consolidate the common arguments into a single struct and pass that around
|
||
instead of using a bunch of globals. ok markus@
|
||
|
||
OpenBSD-Commit-ID: 035e6d7ca9145ad504f6af5a021943f1958cd19b
|
||
|
||
commit 43026da035cd266db37df1f723d5575056150744
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Thu Dec 17 23:10:27 2020 +0000
|
||
|
||
upstream: prepare readconf.c for fuzzing; remove fatal calls and
|
||
|
||
fix some (one-off) memory leaks; ok markus@
|
||
|
||
OpenBSD-Commit-ID: 91c6aec57b0e7aae9190de188e9fe8933aad5ec5
|
||
|
||
commit bef92346c4a808f33216e54d6f4948f9df2ad7c1
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Mon Dec 14 03:13:12 2020 +0000
|
||
|
||
upstream: use _PATH_SSH_USER_DIR instead of hardcoded .ssh in path
|
||
|
||
OpenBSD-Commit-ID: 5c1048468813107baa872f5ee33ba51623630e01
|
||
|
||
commit a5ab499bd2644b4026596fc2cb24a744fa310666
|
||
Author: Damien Miller <djm@mindrot.org>
|
||
Date: Fri Dec 4 14:01:27 2020 +1100
|
||
|
||
basic KEX fuzzer; adapted from Markus' unittest
|
||
|
||
commit 021ff33e383c77b11badd60cec5b141a3e3fa532
|
||
Author: Damien Miller <djm@mindrot.org>
|
||
Date: Fri Dec 4 13:57:43 2020 +1100
|
||
|
||
use options that work with recent clang
|
||
|
||
commit e4d1a0b40add800b6e9352b40c2223e44acc3a45
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Fri Dec 4 02:41:10 2020 +0000
|
||
|
||
upstream: shuffle a few utility functions into sftp-client.c; from
|
||
|
||
Jakub Jelen
|
||
|
||
OpenBSD-Commit-ID: fdeb1aae1f6149b193f12cd2af158f948c514a2a
|
||
|
||
commit ace12dc64f8e3a2496ca48d36b53cb3c0a090755
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Fri Dec 4 02:29:56 2020 +0000
|
||
|
||
upstream: make ssh_free(NULL) a no-op
|
||
|
||
OpenBSD-Commit-ID: 42cb285d94789cefe6608db89c63040ab0a80fa0
|
||
|
||
commit 3b98b6e27f8a122dbfda9966b1afeb3e371cce91
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Fri Dec 4 02:29:25 2020 +0000
|
||
|
||
upstream: memleak of DH public bignum; found with libfuzzer
|
||
|
||
OpenBSD-Commit-ID: 0e913b542c3764b100b1571fdb0d0e5cc086fe97
|
||
|
||
commit 553b90feedd7da5b90901d73005f86705456d686
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Fri Dec 4 02:27:57 2020 +0000
|
||
|
||
upstream: fix minor memleak of kex->hostkey_alg on rekex
|
||
|
||
OpenBSD-Commit-ID: 2c3969c74966d4ccdfeff5e5f0df0791919aef50
|
||
|
||
commit ac0364b85e66eb53da2f9618f699ba6bd195ceea
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Fri Dec 4 02:27:08 2020 +0000
|
||
|
||
upstream: typos: s/hex/kex/ in error messages
|
||
|
||
OpenBSD-Commit-ID: 43a026c9571dd779ec148de1829cf5a6b6651905
|
||
|
||
commit ee22db7c5885a1d90219202c0695bc621aa0409b
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Fri Dec 4 02:25:13 2020 +0000
|
||
|
||
upstream: make program name be const
|
||
|
||
OpenBSD-Commit-ID: ece25680ec637fdf20502721ccb0276691df5384
|
||
|
||
commit 2bcbf679de838bb77a8bd7fa18e100df471a679c
|
||
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
||
Date: Mon Nov 30 05:36:39 2020 +0000
|
||
|
||
upstream: Ignore comments at the end of config lines in ssh_config,
|
||
|
||
similar to what we already do for sshd_config. bz#2320, with & ok djm@
|
||
|
||
OpenBSD-Commit-ID: bdbf9fc5bc72b1a14266f5f61723ed57307a6db4
|
||
|
||
commit b755264e7d3cdf1de34e18df1af4efaa76a3c015
|
||
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
||
Date: Sat Nov 28 12:52:32 2020 +0000
|
||
|
||
upstream: Include cipher.h for declaration of cipher_by_name.
|
||
|
||
OpenBSD-Commit-ID: ddfebbca03ca0e14e00bbad9d35f94b99655d032
|
||
|
||
commit 022def7bd16c3426a95e25f57cb259d54468341c
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Sat Nov 28 03:27:59 2020 +0000
|
||
|
||
upstream: check result of strchr() against NULL rather than
|
||
|
||
searched-for characters; from zhongjubin@huawei.com
|
||
|
||
OpenBSD-Commit-ID: e6f57de1d4a4d25f8db2d44e8d58d847e247a4fe
|
||
|
||
commit 57bf03f0217554afb8980f6697a7a0b88658d0a9
|
||
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
||
Date: Fri Nov 27 10:12:30 2020 +0000
|
||
|
||
upstream: Document ssh-keygen -Z, sanity check its argument earlier and
|
||
|
||
provide a better error message if it's not correct. Prompted by bz#2879, ok
|
||
djm@ jmc@
|
||
|
||
OpenBSD-Commit-ID: 484178a173e92230fb1803fb4f206d61f7b58005
|
||
|
||
commit 33313ebc1c7135085676db62189e3520341d6b73
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Fri Nov 27 00:49:58 2020 +0000
|
||
|
||
upstream: Set the specified TOS/DSCP for interactive use prior to
|
||
|
||
TCP connect. The connection phase of the SSH session is time-sensitive (due
|
||
to server side login grace periods) and is frequently interactive (e.g.
|
||
entering passwords). The ultimate interactive/bulk TOS/DSCP will be set after
|
||
authentication completes.
|
||
|
||
ok dtucker@
|
||
|
||
OpenBSD-Commit-ID: f31ab10d9233363a6d2c9996007083ba43a093f1
|
||
|
||
commit b2bcec13f17ce9174238a704e91d52203e916432
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Fri Nov 27 00:37:10 2020 +0000
|
||
|
||
upstream: clean up passing of struct passwd from monitor to preauth
|
||
|
||
privsep process. No longer copy entire struct w/ pointer addresses, but pass
|
||
remaining scalar fields explicitly,
|
||
|
||
Prompted by Yuichiro NAITO, feedback Thorsten Glaser; ok dtucker@
|
||
|
||
OpenBSD-Commit-ID: 9925df75a56732c43f3663e70dd15ff413ab3e53
|
||
|
||
commit 19af04e2231155d513e24fdc81fbec2217ae36a6
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Sun Nov 22 22:38:26 2020 +0000
|
||
|
||
upstream: when loading PKCS#11 keys, include the key fingerprints
|
||
|
||
and provider/slot information in debug output.
|
||
|
||
OpenBSD-Commit-ID: 969a089575d0166a9a364a9901bb6a8d9b8a1431
|
||
|
||
commit 9b9465ea856e15b9e9890b4ecb4110d7106e7766
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Sun Nov 22 22:37:11 2020 +0000
|
||
|
||
upstream: when mentioning that the host key has changed, don't
|
||
|
||
report the type because it is ambiguous as to whether it referred to the
|
||
known or new host key. bz3216; ok dtucker@
|
||
|
||
OpenBSD-Commit-ID: 2d5ce4a83dbcf44e340a572e361decad8aab7bad
|
||
|
||
commit 637017a7dd3281d3f2df804993cc27c30dbfda47
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Wed Nov 25 17:38:46 2020 +1100
|
||
|
||
Use "=" not "==" in string test.
|
||
|
||
POSIX says "=" is string comparison and some shells (eg HP-UX) will
|
||
complain about "==".
|
||
|
||
commit 9880f3480f9768897f3b8e714d5317fb993bc5b3
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Fri Nov 20 17:16:51 2020 +1100
|
||
|
||
Restore correct flags during localtime_r check.
|
||
|
||
We were restoring the wrong thing CPPFLAGS (we used CFLAGS) for any
|
||
platform that doesn't have localtime_r.
|
||
|
||
commit 41935882f4e82de60dbd6e033eabe79e1b963518
|
||
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
||
Date: Fri Nov 20 03:16:56 2020 +0000
|
||
|
||
upstream: When doing an sftp recursive upload or download of a
|
||
|
||
read-only directory, ensure that the directory is created with write and
|
||
execute permissions in the interim so that we can actually complete the
|
||
transfer, then set the directory permission as the final step. (The execute
|
||
bit is only likely to be an issue with a non-POSIX server). bz#3222, ok djm@
|
||
|
||
OpenBSD-Commit-ID: a82606212f2796e31f0e1af94a63355a7ad5d903
|
||
|
||
commit 0f90440ca70abab947acbd77795e9f130967956c
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Fri Nov 20 13:37:54 2020 +1100
|
||
|
||
Add new pselect6_time64 syscall on ARM.
|
||
|
||
This is apparently needed on armhfp/armv7hl. bz#3232, patch from
|
||
jjelen at redhat.com.
|
||
|
||
commit 3a7c46c72b6a1f643b1fc3589cd20d8320c3d9e1
|
||
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
||
Date: Fri Nov 20 02:14:16 2020 +0000
|
||
|
||
upstream: Explicitly initialize all members of the
|
||
|
||
find_by_key_ctx struct. Initializing a single member should be enough
|
||
(the spec says the remainder should be initialized as per the static
|
||
rules) but some GCCs warn on this which prevents us testing with -Werror
|
||
on those. ok deraadt@ djm@
|
||
|
||
OpenBSD-Commit-ID: 687126e60a27d30f02614760ef3c3ae4e8d6af28
|
||
|
||
commit 076cb616b87d1ea1d292973fcd0ba38c08ea6832
|
||
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
||
Date: Thu Nov 19 23:05:05 2020 +0000
|
||
|
||
upstream: draft-ietf-secsh-architecture is now RFC4251.
|
||
|
||
OpenBSD-Commit-ID: cb0bb58c2711fb5ed519507659be1dcf179ed403
|
||
|
||
commit 85cceda21f1471548e04111aefe2c4943131c1c8
|
||
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
||
Date: Tue Nov 17 11:23:58 2020 +0000
|
||
|
||
upstream: Specify that the KDF function is bcrypt. Based on github
|
||
|
||
PR#214 from rafork, ok markus@, mdoc correction jmc@
|
||
|
||
OpenBSD-Commit-ID: d8f2853e7edbcd483f31b50da77ab80ffa18b4ef
|
||
|
||
commit 5b9720f9adbd70ba5a994f407fe07a7d016d8d65
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Sun Nov 15 22:34:58 2020 +0000
|
||
|
||
upstream: revert r1.341; it breaks ProxyJump; reported by sthen@
|
||
|
||
OpenBSD-Commit-ID: 6ac2f945b26cb86d936eed338f77861d6da8356a
|
||
|
||
commit 04088725ec9c44880c01799b588cd4ba47b3e8bc
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Fri Nov 13 07:30:44 2020 +0000
|
||
|
||
upstream: scrub keyboard-interactive authentication prompts coming
|
||
|
||
from the server through asmprintf() prior to display; suggested by and ok
|
||
dtucker@
|
||
|
||
OpenBSD-Commit-ID: 31fe93367645c37fbfe4691596bf6cf1e3972a58
|
||
|
||
commit 5442b491d0ee4bb82f6341ad0ee620ef3947f8c5
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Fri Nov 13 04:53:12 2020 +0000
|
||
|
||
upstream: prefix keyboard interactive prompts with (user@host) to
|
||
|
||
make it easier to determine which connection they are associated with in
|
||
cases like scp -3, ProxyJump, etc. bz#3224 ok dtucker
|
||
|
||
OpenBSD-Commit-ID: 67e6189b04b46c867662f8a6759cf3ecb5f59170
|
||
|
||
commit 2992e4e7014ac1047062acfdbbf6feb156fef616
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Fri Nov 13 17:56:11 2020 +1100
|
||
|
||
Remove use of TIME_WITH_SYS_TIME.
|
||
|
||
It was only set by the recently removed AC_HEADER_TIME macro, replace
|
||
with simple inclusions of both sys/time.h and time.h. Should prevent
|
||
mis-detection of struct timespec.
|
||
|
||
commit e3f27006f15abacb7e89fda3f5e9a0bd420b7e38
|
||
Author: Damien Miller <djm@mindrot.org>
|
||
Date: Fri Nov 13 14:20:43 2020 +1100
|
||
|
||
Revert "detect Linux/X32 systems"
|
||
|
||
This reverts commit 5b56bd0affea7b02b540bdbc4d1d271b0e4fc885.
|
||
|
||
The approach used was incorrect; discussion in bz#3085
|
||
|
||
commit e51dc7fab61df36e43f3bc64b673f88d388cab91
|
||
Author: Damien Miller <djm@mindrot.org>
|
||
Date: Fri Nov 13 13:22:15 2020 +1100
|
||
|
||
SELinux has deprecated security_context_t
|
||
|
||
(it was only ever a char* anyway)
|
||
|
||
commit b79add37d118276d67f3899987b9f0629c9449c3
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Fri Nov 13 13:43:30 2020 +1100
|
||
|
||
Remove obsolete AC_HEADER_TIME macro.
|
||
|
||
AC_HEADER_TIME is marked as obsolete in autoconf-2.70 and as far as I
|
||
can tell everything we have that might be old enough to need it doesn't.
|
||
|
||
commit d5d05cdb3d4efd4a618aa52caab5bec73097c163
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Thu Nov 12 22:56:00 2020 +0000
|
||
|
||
upstream: when prompting the user to accept a new hostkey, display
|
||
|
||
any other host names/addresses already associated with the key. E.g.
|
||
|
||
> The authenticity of host 'test (10.0.0.1)' can't be established.
|
||
> ECDSA key fingerprint is SHA256:milU4MODXm8iJQI18wlsbPG7Yup+34fuNNmV08qDnax.
|
||
> This host key is known by the following other names/addresses:
|
||
> ~/.ssh/known_hosts:1: host.example.org,10.0.0.1
|
||
> ~/.ssh/known_hosts:2: [hashed name]
|
||
> ~/.ssh/known_hosts:3: [hashed name]
|
||
> ~/.ssh/known_hosts:4: host
|
||
> ~/.ssh/known_hosts:5: [host]:2222
|
||
> Are you sure you want to continue connecting (yes/no/[fingerprint])?
|
||
|
||
feedback and ok markus@
|
||
|
||
OpenBSD-Commit-ID: f6f58a77b49f1368b5883b3a1f776447cfcc7ef4
|
||
|
||
commit 819b44e8b9af6ce18d3ec7505b9f461bf7991a1f
|
||
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
||
Date: Thu Nov 12 22:38:57 2020 +0000
|
||
|
||
upstream: Prevent integer overflow when ridiculously large
|
||
|
||
ConnectTimeout is specified, capping the effective value (for most platforms)
|
||
at 24 days. bz#3229, ok djm@
|
||
|
||
OpenBSD-Commit-ID: 62d4c4b7b87d111045f8e9f28b5b532d17ac5bc0
|
||
|
||
commit add926dd1bbe3c4db06e27cab8ab0f9a3d00a0c2
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Wed Nov 11 05:22:32 2020 +0000
|
||
|
||
upstream: fix logic error that broke URI parsing in ProxyJump
|
||
|
||
directives; ok dtucker@
|
||
|
||
OpenBSD-Commit-ID: 96d48839b1704882a0e9a77898f5e14b2d222705
|
||
|
||
commit 4340dd43928dfe746cb7e75fe920b63c0d909a9a
|
||
Author: claudio@openbsd.org <claudio@openbsd.org>
|
||
Date: Tue Nov 10 07:46:20 2020 +0000
|
||
|
||
upstream: Free the previously allocated msg buffer after writing it
|
||
|
||
out. OK djm@
|
||
|
||
OpenBSD-Commit-ID: 18c055870fc75e4cb9f926c86c7543e2e21d7fa4
|
||
|
||
commit fcf429a4c69d30d8725612a55b37181594da8ddf
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Wed Nov 11 12:30:46 2020 +1100
|
||
|
||
Prevent excessively long username going to PAM.
|
||
|
||
This is a mitigation for a buffer overflow in Solaris' PAM username
|
||
handling (CVE-2020-14871), and is only enabled for Sun-derived PAM
|
||
implementations. This is not a problem in sshd itself, it only
|
||
prevents sshd from being used as a vector to attack Solaris' PAM.
|
||
It does not prevent the bug in PAM from being exploited via some other
|
||
PAM application.
|
||
|
||
Based on github PR#212 from Mike Scott but implemented slightly
|
||
differently. ok tim@ djm@
|
||
|
||
commit 10dce8ff68ef615362cfcab0c0cc33ce524e7682
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Sun Nov 8 23:19:03 2020 +0000
|
||
|
||
upstream: unbreak; missing NULL check
|
||
|
||
OpenBSD-Commit-ID: 6613dfab488123f454d348ef496824476b8c11c0
|
||
|
||
commit d5a0cd4fc430c8eda213a4010a612d4778867cd9
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Sun Nov 8 22:37:24 2020 +0000
|
||
|
||
upstream: when requesting a security key touch on stderr, inform the
|
||
|
||
user once the touch has been recorded; requested by claudio@ ok markus@
|
||
|
||
OpenBSD-Commit-ID: 3b76ee444490e546b9ea7f879e4092ee0d256233
|
||
|
||
commit 292bcb2479deb27204e3ff796539c003975a5f7a
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Mon Nov 9 00:33:35 2020 +1100
|
||
|
||
Remove preprocessor directive from log macro calls.
|
||
|
||
Preprocessor directives inside macro calls, such as the new log macros,
|
||
are undefined behaviour and do not work with, eg old GCCs. Put the
|
||
entire log call inside the ifdef for OPENSSL_HAS_NISTP521.
|
||
|
||
commit 71693251b7cbb7dd89aaac18815147124732d0d3
|
||
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
||
Date: Sun Nov 8 12:10:20 2020 +0000
|
||
|
||
upstream: Add a comment documenting the source of the moduli group
|
||
|
||
sizes.
|
||
|
||
OpenBSD-Commit-ID: aec0725ce607630caaa62682624c6763b350391c
|
||
|
||
commit 4d94b031ff88b015f0db57e140f481bff7ae1a91
|
||
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
||
Date: Sun Nov 8 11:46:12 2020 +0000
|
||
|
||
upstream: Replace WITH_OPENSSL ifdefs in log calls with a macro.
|
||
|
||
The log calls are themselves now macros, and preprocessor directives inside
|
||
macro arguments are undefined behaviour which some compilers (eg old GCCs)
|
||
choke on. It also makes the code tidier. ok deraadt@
|
||
|
||
OpenBSD-Commit-ID: cc12a9029833d222043aecd252d654965c351a69
|
||
|
||
commit 6d2564b94e51184eb0b73b97d13a36ad50b4f810
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Fri Nov 6 17:11:16 2020 +1100
|
||
|
||
Fix function body for variadic macro test.
|
||
|
||
AC_LANG_PROGRAM puts its second argument inside main() so we don't need
|
||
to do it ourselves.
|
||
|
||
commit 586f9bd2f5980e12f8cf0d3c2a761fa63175da52
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Fri Nov 6 16:53:24 2020 +1100
|
||
|
||
Remove AC_PROC_CC_C99 obsoleted in autoconf 2.70.
|
||
|
||
Since we only use it to make sure we can handle variadic macros,
|
||
explicitly check only for that. with & ok djm@
|
||
|
||
commit a019e353df04de1b2ca78d91b39c393256044ad7
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Fri Nov 6 13:56:41 2020 +1100
|
||
|
||
Replace AC_TRY_COMPILE obsoleted in autoconf 2.70.
|
||
|
||
Replace with the equivalent AC_COMPILE_IFELSE.
|
||
|
||
commit 771b7795c0ef6a2fb43b4c6c66b615c2085cb9cd
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Fri Nov 6 13:55:33 2020 +1100
|
||
|
||
Move AC_PROG_CC_C99 to immediately afer AC_PROG_CC.
|
||
|
||
This puts the related C version selection output in the same place.
|
||
|
||
commit e5591161f21ab493c6284a85ac3c0710ad94998f
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Fri Nov 6 13:54:17 2020 +1100
|
||
|
||
AC_CHECK_HEADER() is obsoleted in autoconf 2.70.
|
||
|
||
Replace with the non-obsoleted AC_CHECK_HEADERS().
|
||
|
||
commit 05bcd0cadf160fd4826a2284afa7cba6ec432633
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Tue Nov 3 22:53:12 2020 +0000
|
||
|
||
upstream: fold consecutive '*' wildcards to mitigate combinatorial
|
||
|
||
explosion of recursive searches; ok dtucker
|
||
|
||
OpenBSD-Commit-ID: d18bcb39c40fb8a1ab61153db987e7d11dd3792b
|
||
|
||
commit 7d680448db5858dc76307663f78d0b8d3c2b4a3d
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Fri Oct 30 01:50:07 2020 +0000
|
||
|
||
upstream: print reason in fatal error message when
|
||
|
||
kex_assemble_namelist() fails
|
||
|
||
OpenBSD-Commit-ID: a9975ee8db6c98d6f32233d88051b2077ca63dab
|
||
|
||
commit 95d1109fec7e89ad21f2a97e92bde1305d32a353
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Thu Oct 29 03:13:06 2020 +0000
|
||
|
||
upstream: fix sshd_config SetEnv directive inside Match blocks; part of
|
||
|
||
github PR#201 from github user manuelm
|
||
|
||
OpenBSD-Commit-ID: 9772e3748abff3ad65ae8fc43d026ed569b1d2bc
|
||
|
||
commit b12b835dc022ba161afe68348e05a83dfbcb1515
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Thu Oct 29 03:01:18 2020 +0000
|
||
|
||
upstream: fix type of nid in type_bits_valid(); github PR#202 from
|
||
|
||
github user thingsconnected
|
||
|
||
OpenBSD-Commit-ID: 769d2b040dec7ab32d323daf54b854dd5dcb5485
|
||
|
||
commit 1a14c13147618144d1798c36a588397ba9008fcc
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Thu Oct 29 02:52:43 2020 +0000
|
||
|
||
upstream: whitespace; no code change
|
||
|
||
OpenBSD-Commit-ID: efefc1c47e880887bdee8cd2127ca93177eaad79
|
||
|
||
commit 815209abfdd2991fb92ad7d2e33374916cdcbcf4
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Thu Oct 29 02:47:23 2020 +0000
|
||
|
||
upstream: UpdateHostkeys: fixed/better detection of host keys that
|
||
|
||
exist under other names and addresses; spotted by and debugged with lots of
|
||
help from jca@
|
||
|
||
OpenBSD-Commit-ID: 5113d7f550bbd48243db1705afbf16b63792d4b7
|
||
|
||
commit a575cf44e59a65506c67bddb62a712208a7a279c
|
||
Author: Duncan Eastoe <duncan.eastoe@att.com>
|
||
Date: Wed Oct 21 10:11:10 2020 +0100
|
||
|
||
session.c: use "denylist" terminology
|
||
|
||
Follow upstream (6d755706a0059eb9e2d63517f288b75cbc3b4701) language
|
||
improvements in this portable-specific code.
|
||
|
||
commit 33267feaffd5d98aa56d2f0b3a99ec352effe938
|
||
Author: Damien Miller <djm@mindrot.org>
|
||
Date: Tue Oct 27 16:46:31 2020 +1100
|
||
|
||
Remove checks for strict POSIX mkdtemp()
|
||
|
||
We needed a mkdtemp() that accepted template paths that did not
|
||
end in XXXXXX a long time ago for KRB4, but that code is long
|
||
deprecated. We no longer need to replace mkdtemp() for strictly
|
||
following POSIX. ok dtucker@
|
||
|
||
commit 492d70e18bad5a8c97d05f5eddac817171e88d2c
|
||
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
||
Date: Mon Oct 26 00:39:04 2020 +0000
|
||
|
||
upstream: Minor man page fixes (capitalization, commas) identified by
|
||
|
||
the manpage-l10n project via bz#3223. feedback deraadt@, ok jmc@
|
||
|
||
OpenBSD-Commit-ID: ab83af0daf18369244a72daaec6c4a58a9eb7e2c
|
||
|
||
commit eab2888cfc6cc4e2ef24bd017da9835a0f365f3f
|
||
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
||
Date: Mon Oct 19 22:49:23 2020 +0000
|
||
|
||
upstream: Adapt XMSS to new logging infrastructure. With markus@, ok
|
||
|
||
djm@.
|
||
|
||
OpenBSD-Commit-ID: 9c35ec3aa0f710e4e3325187ceff4fa3791686de
|
||
|
||
commit f7bd11e4941620991f3e727cd0131b01f0311a58
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Mon Oct 19 08:07:08 2020 +0000
|
||
|
||
upstream: fix SEGV on fatal() errors spotted by dtucker@
|
||
|
||
OpenBSD-Commit-ID: 75f155a1ac61e364ed00dc379e2c42df81067ce2
|
||
|
||
commit 7715a3b171049afa1feffb1d5a1245dfac36ce99
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Mon Oct 19 10:54:41 2020 +1100
|
||
|
||
Use fatal_fr not fatal_r when passing r.
|
||
|
||
Caught by the PAM -Werror tinderbox build.
|
||
|
||
commit 816036f142ecd284c12bb3685ae316a68d2ef190
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Sun Oct 18 11:32:01 2020 +0000
|
||
|
||
upstream: use the new variant log macros instead of prepending
|
||
|
||
__func__ and appending ssh_err(r) manually; ok markus@
|
||
|
||
OpenBSD-Commit-ID: 1f14b80bcfa85414b2a1a6ff714fb5362687ace8
|
||
|
||
commit 9e2c4f64224f68fb84c49b5182e449f94b0dc985
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Sun Oct 18 11:21:59 2020 +0000
|
||
|
||
upstream: variants of the log methods that append a ssherr.h string
|
||
|
||
from a supplied error code; ok markus@
|
||
|
||
OpenBSD-Commit-ID: aed98c4435d48d036ae6740300f6a8357b7cc0bf
|
||
|
||
commit 28cb0a4b03940d1ee576eb767a81a4113bdc917e
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Sun Oct 18 11:14:27 2020 +0000
|
||
|
||
upstream: remove a level of macro indirection; ok markus@
|
||
|
||
OpenBSD-Commit-ID: 0c529d06e902c5d1a6b231e1bec6157f76dc67c9
|
||
|
||
commit 9cac1db52e6c4961c447910fe02cd68a3b2f9460
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Sun Oct 18 11:13:45 2020 +0000
|
||
|
||
upstream: add some variant log.h calls that prepend the calling
|
||
|
||
function name; ok markus@
|
||
|
||
OpenBSD-Commit-ID: 4be1b2e2455b271ddb7457bc195c5367644f4e48
|
||
|
||
commit d55dfed34ef6ef1f028d552a90d5f3dba8dd6f7b
|
||
Author: Damien Miller <djm@mindrot.org>
|
||
Date: Sat Oct 17 22:55:24 2020 +1100
|
||
|
||
missing header
|
||
|
||
commit 999d7cb79a3a73d92a6dfbf174c33da0d984c7a2
|
||
Author: Damien Miller <djm@mindrot.org>
|
||
Date: Sat Oct 17 22:47:52 2020 +1100
|
||
|
||
sync regress/misc/sk-dummy/fatal.c
|
||
|
||
commit 3554b4afa38b3483a3302f1be18eaa6f843bb260
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Sat Oct 17 01:28:20 2020 +0000
|
||
|
||
upstream: make the log functions that exit (sshlogdie(),
|
||
|
||
sshfatal(), etc) have identical signatures. Makes things a bit more
|
||
consistent...
|
||
|
||
OpenBSD-Commit-ID: bd0ae124733389d7c0042e135c71ee9091362eb9
|
||
|
||
commit 616029a85ad7529b24bb8c4631d9607c0d6e7afe
|
||
Author: jmc@openbsd.org <jmc@openbsd.org>
|
||
Date: Fri Oct 16 14:34:33 2020 +0000
|
||
|
||
upstream: add space between macro arg and punctuation;
|
||
|
||
OpenBSD-Commit-ID: bb81e2ed5a77832fe62ab30a915ae67cda57633e
|
||
|
||
commit f812a36cee5727147bc897d34ab9af068dd4561e
|
||
Author: Damien Miller <djm@mindrot.org>
|
||
Date: Sat Oct 17 12:03:34 2020 +1100
|
||
|
||
check for and require a C99 capable compiler
|
||
|
||
recent logging changes use __VA_ARGS__.
|
||
|
||
commit f9ea6515202b59a1e2d5b885cafc1b12eff33016
|
||
Author: Damien Miller <djm@mindrot.org>
|
||
Date: Sat Oct 17 11:51:20 2020 +1100
|
||
|
||
logging is now macros, remove function pointers
|
||
|
||
commit 0f938f998626e8359324f803157cd7c9f8f403e2
|
||
Author: Damien Miller <djm@mindrot.org>
|
||
Date: Sat Oct 17 11:42:26 2020 +1100
|
||
|
||
adapt sk-dummy's fatal implementation to changes
|
||
|
||
commit afbd9ec9e2dbad04834ce7ce53e58740434f32a5
|
||
Author: Damien Miller <djm@mindrot.org>
|
||
Date: Sat Oct 17 11:33:13 2020 +1100
|
||
|
||
fix netcat build problem
|
||
|
||
commit 793b583d097381730adaf6f68bed3c343139a013
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Fri Oct 16 13:26:13 2020 +0000
|
||
|
||
upstream: LogVerbose keyword for ssh and sshd
|
||
|
||
Allows forcing maximum debug logging by file/function/line pattern-
|
||
lists.
|
||
|
||
ok markus@
|
||
|
||
OpenBSD-Commit-ID: c294c25732d1b4fe7e345cb3e044df00531a6356
|
||
|
||
commit 752250caabda3dd24635503c4cd689b32a650794
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Fri Oct 16 13:24:45 2020 +0000
|
||
|
||
upstream: revised log infrastructure for OpenSSH
|
||
|
||
log functions receive function, filename and line number of caller.
|
||
We can use this to selectively enable logging via pattern-lists.
|
||
|
||
ok markus@
|
||
|
||
OpenBSD-Commit-ID: 51a472610cbe37834ce6ce4a3f0e0b1ccc95a349
|
||
|
||
commit acadbb3402b70f72f14d9a6930ad41be97c2f9dc
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Fri Oct 16 02:37:12 2020 +0000
|
||
|
||
upstream: use do_log2 instead of function pointers to different log
|
||
|
||
functions
|
||
|
||
OpenBSD-Commit-ID: 88077b826d348c58352a6b394755520f4e484480
|
||
|
||
commit 95b0bcfd1531d59e056ae8af27bb741391f26ab0
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Wed Oct 14 00:55:17 2020 +0000
|
||
|
||
upstream: make UpdateHostkeys still more conservative: refuse to
|
||
|
||
proceed if one of the keys offered by the server is already in known_hosts
|
||
under another name. This avoid collisions between address entries for
|
||
different host aliases when CheckHostIP=yes
|
||
|
||
Also, do not attempt to fix known_hosts with incomplete host/ip matches
|
||
when there are no new or deprecated hostkeys.
|
||
|
||
OpenBSD-Commit-ID: 95c19842f7c41f9bd9c92aa6441a278c0fd0c4a3
|
||
|
||
commit a336ce8c2c55547cc00e0070a18c55f30bb53fb6
|
||
Author: kn@openbsd.org <kn@openbsd.org>
|
||
Date: Mon Oct 12 08:36:36 2020 +0000
|
||
|
||
upstream: Zap unused family parameter from ssh_connect_direct()
|
||
|
||
sshconnect.c r1.241 from 2013 made it unused; found while reading code.
|
||
|
||
OK djm
|
||
|
||
OpenBSD-Commit-ID: 219ba6d7f9925d0b7992918612680399d86712b5
|
||
|
||
commit e545d94b713effab8e6c7dfabbfb76c1d84d7498
|
||
Author: Philip Hands <phil@hands.com>
|
||
Date: Sun Oct 4 00:15:46 2020 +0200
|
||
|
||
shift contents of long $() into filter_ids()
|
||
|
||
This was prompted by the fact that posh does not deal with $()
|
||
that contains comments where the comment includes an odd number
|
||
of single-quotes. It seems to get befuddled into trying to find
|
||
the matching quote.
|
||
Regardless, making a function for filtering the unneeded ids
|
||
seems much neater than avoiding apostrophes,
|
||
so that's what I've done.
|
||
|
||
SSH-Copy-ID-Upstream: 3dab3366a584427045c8a690a93282f02c09cf24
|
||
|
||
commit fd360174596047b52aa1cddda74d85012a03ca4b
|
||
Author: Philip Hands <phil@hands.com>
|
||
Date: Sat Oct 3 23:15:16 2020 +0200
|
||
|
||
combine if/elif to avoid duplication of the action
|
||
|
||
SSH-Copy-ID-Upstream: 42aeb1cc53d3f7f6e78edc210fb121fda0834914
|
||
|
||
commit f7c3a39b016dd77709ecbf18da8282f967b86cd7
|
||
Author: Philip Hands <phil@hands.com>
|
||
Date: Sat Oct 3 21:45:16 2020 +0200
|
||
|
||
shellcheck tidyage
|
||
|
||
SSH-Copy-ID-Upstream: 5b08f840e78ac544288b3983010a1b0585e966fd
|
||
|
||
commit 108676c3f26be6c873db0dd8754063699908727b
|
||
Author: Philip Hands <phil@hands.com>
|
||
Date: Sat Oct 3 21:10:03 2020 +0200
|
||
|
||
tidy up test of $SCRATCH_DIR creation
|
||
|
||
SSH-Copy-ID-Upstream: 2d8b22d96c105d87743ffe8874887b06f8989b93
|
||
|
||
commit a9c9e91a82bc1a2cf801b4e3ef27a941dbd27717
|
||
Author: Philip Hands <phil@hands.com>
|
||
Date: Wed Sep 16 16:13:30 2020 +0200
|
||
|
||
add -s flag: to install keys via SFTP
|
||
|
||
This is prompted by:
|
||
|
||
https://bugzilla.mindrot.org/show_bug.cgi?id=3201
|
||
|
||
Thanks go to Matthias Blümel for the idea, and the helpful patch, from
|
||
which this patch grew.
|
||
|
||
SSH-Copy-ID-Upstream: f7c76dc64427cd20287a6868f672423b62057614
|
||
|
||
commit f92424970c02b78852ff149378c7f2616ada4ccf
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Sun Oct 11 22:14:38 2020 +0000
|
||
|
||
upstream: UpdateHostkeys: check for keys under other names
|
||
|
||
Stop UpdateHostkeys from automatically removing deprecated keys from
|
||
known_hosts files if the same keys exist under a different name or
|
||
address to the host that is being connected to.
|
||
|
||
This avoids UpdateHostkeys from making known_hosts inconsistent in
|
||
some cases. For example, multiple host aliases sharing address-based
|
||
known_hosts on different lines, or hosts that resolves to multiple
|
||
addresses.
|
||
|
||
ok markus@
|
||
|
||
OpenBSD-Commit-ID: 6444a705ba504c3c8ccddccd8d1b94aa33bd11c1
|
||
|
||
commit d98f14b5328922ae3085e07007d820c4f655b57a
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Sun Oct 11 22:13:37 2020 +0000
|
||
|
||
upstream: UpdateHostkeys: better CheckHostIP handling
|
||
|
||
When preparing to update the known_hosts file, fully check both
|
||
entries for both the host and the address (if CheckHostIP enabled)
|
||
and ensure that, at the end of the operation, entries for both are
|
||
recorded.
|
||
|
||
Make sure this works with HashKnownHosts too, which requires maintaining
|
||
a list of entry-types seen across the whole file for each key.
|
||
|
||
ok markus@
|
||
|
||
OpenBSD-Commit-ID: 374dc263103f6b343d9671f87dbf81ffd0d6abdd
|
||
|
||
commit af5941ae9b013aac12585e84c4cf494f3728982f
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Sun Oct 11 22:12:44 2020 +0000
|
||
|
||
upstream: UpdateHostkeys: better detect manual host entries
|
||
|
||
Disable UpdateHostkeys if the known_hosts line has more than two
|
||
entries in the pattern-list. ssh(1) only writes "host" or "host,ip"
|
||
lines so anything else was added by a different tool or by a human.
|
||
|
||
ok markus@
|
||
|
||
OpenBSD-Commit-ID: e434828191fb5f3877d4887c218682825aa59820
|
||
|
||
commit 6247812c76f70b2245f3c23f5074665b3d436cae
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Thu Oct 8 01:15:16 2020 +0000
|
||
|
||
upstream: don't misdetect comma-separated hostkey names as wildcards;
|
||
|
||
spotted by naddy@
|
||
|
||
OpenBSD-Commit-ID: 4b874edfec7fc324a21b130bdb42f912177739ce
|
||
|
||
commit 67146c7d022a170be3cdad2f5f40259a663fb266
|
||
Author: wangxp006 <wangxiaopeng7@huawei.com>
|
||
Date: Thu Oct 8 17:49:59 2020 +0800
|
||
|
||
fix TEST_MALLOC_OPTIONS var
|
||
|
||
commit 3205eaa3f8883a34fa4559ddef6c90d1067c5cce
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Thu Oct 8 00:31:05 2020 +0000
|
||
|
||
upstream: clarify conditions for UpdateHostkeys
|
||
|
||
OpenBSD-Commit-ID: 9cba714cf6aeed769f998ccbe8c483077a618e27
|
||
|
||
commit e8dfca9bfeff05de87160407fb3e6a5717fa3dcb
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Wed Oct 7 06:38:16 2020 +0000
|
||
|
||
upstream: remove GlobalKnownHostsFile for this test after
|
||
|
||
UpdateHostkeys change
|
||
|
||
OpenBSD-Regress-ID: a940ad79d59343319613ba8fc46b6ef24aa3f8e1
|
||
|
||
commit 4aa2717d7517cff4bc423a6cfba3a2defb055aea
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Wed Oct 7 02:26:28 2020 +0000
|
||
|
||
upstream: Disable UpdateHostkeys when hostkey checking fails
|
||
|
||
If host key checking fails (i.e. a wrong host key is recorded for the
|
||
server) and the user elects to continue (via StrictHostKeyChecking=no),
|
||
then disable UpdateHostkeys for the session.
|
||
|
||
reminded by Mark D. Baushke; ok markus@
|
||
|
||
OpenBSD-Commit-ID: 98b524f121f4252309dd21becd8c4cacb0c6042a
|
||
|
||
commit 04c06d04475f1f673e9d9743710d194453fe3888
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Wed Oct 7 02:25:43 2020 +0000
|
||
|
||
upstream: Fix UpdateHostkeys/HashKnownHosts/CheckHostIP bug
|
||
|
||
When all of UpdateHostkeys, HashKnownHosts and ChechHostIP
|
||
were enabled and new host keys were learned, known_hosts IP
|
||
entries were not being recorded for new host keys.
|
||
|
||
reported by matthieu@ ok markus@
|
||
|
||
OpenBSD-Commit-ID: a654a8290bd1c930aac509e8158cf85e42e49cb7
|
||
|
||
commit b70e33711291f3081702133175a41cccafc0212a
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Wed Oct 7 02:24:51 2020 +0000
|
||
|
||
upstream: don't UpdateHostkeys when the hostkey is verified by the
|
||
|
||
GlobalKnownHostsFile file, support only UserKnownHostsFile matches
|
||
|
||
suggested by Mark D. Baushke; feedback and ok markus@
|
||
|
||
OpenBSD-Commit-ID: eabb771a6add676c398d38a143a1aff5f04abbb9
|
||
|
||
commit aa623142e426ca1ab9db77b06dcc9b1b70bd102b
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Wed Oct 7 02:22:23 2020 +0000
|
||
|
||
upstream: revert kex->flags cert hostkey downgrade back to a plain
|
||
|
||
key (commitid VtF8vozGOF8DMKVg). We now do this a simpler way that needs less
|
||
plumbing.
|
||
|
||
ok markus@
|
||
|
||
OpenBSD-Commit-ID: fb92d25b216bff8c136da818ac2221efaadf18ed
|
||
|
||
commit f4f14e023cafee1cd9ebe4bb0db4029e6e1fafac
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Wed Oct 7 02:20:35 2020 +0000
|
||
|
||
upstream: simply disable UpdateHostkeys when a certificate
|
||
|
||
successfully authenticated the host; simpler than the complicated plumbing
|
||
via kex->flags we have now.
|
||
|
||
ok markus@
|
||
|
||
OpenBSD-Commit-ID: 80e39644eed75717d563a7f177e8117a0e14f42c
|
||
|
||
commit e79957e877db42c4c68fabcf6ecff2268e53acb5
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Wed Oct 7 02:18:45 2020 +0000
|
||
|
||
upstream: disable UpdateHostkeys by default if VerifyHostKeyDNS is
|
||
|
||
enabled; suggested by Mark D. Baushke
|
||
|
||
OpenBSD-Commit-ID: 85a1b88592c81bc85df7ee7787dbbe721a0542bf
|
||
|
||
commit 3d4c2016bae1a6f14b48c1150a4c79ca4c9968bd
|
||
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
||
Date: Tue Oct 6 07:12:04 2020 +0000
|
||
|
||
upstream: Agent protocol draft is now at rev 4. ok djm@
|
||
|
||
OpenBSD-Commit-ID: 8c01ea3aae48aab45e01b7421b0fca2dad5e7837
|
||
|
||
commit af889a40ffc113af9105c03d7b32131eb4372d50
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Sun Oct 4 09:45:01 2020 +0000
|
||
|
||
upstream: when ordering host key algorithms in the client, consider
|
||
|
||
the ECDSA key subtype; ok markus@
|
||
|
||
OpenBSD-Commit-ID: 3097686f853c61ff61772ea35f8b699931392ece
|
||
|
||
commit 2d39fc9f7e039351daa3d6aead1538ac29258add
|
||
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
||
Date: Sun Oct 4 03:04:02 2020 +0000
|
||
|
||
upstream: Allow full range of UIDs and GIDs for sftp chown and
|
||
|
||
chgrp on 32bit platforms instead of being limited by LONG_MAX. bz#3206,
|
||
found by booking00 at sina.cn, ok markus@
|
||
|
||
OpenBSD-Commit-ID: 373b7bbf1f15ae482d39567ce30d18b51c9229b5
|
||
|
||
commit 396d32f3a1a16e54df2a76b2a9b237868580dcbe
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Sat Oct 3 09:22:26 2020 +0000
|
||
|
||
upstream: There are lots of place where we want to redirect stdin,
|
||
|
||
stdout and/or stderr to /dev/null. Factor all these out to a single
|
||
stdfd_devnull() function that allows selection of which of these to redirect.
|
||
ok markus@
|
||
|
||
OpenBSD-Commit-ID: 3033ba5a4c47cacfd5def020d42cabc52fad3099
|
||
|
||
commit 1286981d08b8429a64613215ce8bff3f6b32488a
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Sat Oct 3 08:30:47 2020 +0000
|
||
|
||
upstream: enable UpdateHostkeys by default when the configuration
|
||
|
||
has not overridden UserKnownHostsFile; ok markus@ "The timing is perfect"
|
||
deraadt@
|
||
|
||
OpenBSD-Commit-ID: 62df71c9c5242da5763cb473c2a2deefbd0cef60
|
||
|
||
commit 332f21537293d66508f7342dc643bc7fe45f0f69
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Sat Oct 3 08:12:59 2020 +0000
|
||
|
||
upstream: disable UpdateHostkeys when a wildcard hostname pattern
|
||
|
||
is encountered or when a certificate host key is in use. feedback/ok markus@
|
||
|
||
OpenBSD-Commit-ID: b6e5575af7e6732322be82ec299e09051a5413bd
|
||
|
||
commit 13cee44ef907824083d89cb9395adbbd552e46c1
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Sat Oct 3 08:11:28 2020 +0000
|
||
|
||
upstream: record when the host key checking code downgrades a
|
||
|
||
certificate host key to a plain key. This occurs when the user connects to a
|
||
host with a certificate host key but no corresponding CA key configured in
|
||
known_hosts; feedback and ok markus@
|
||
|
||
OpenBSD-Commit-ID: 2ada81853ff9ee7824c62f440bcf4ad62030c901
|
||
|
||
commit 12ae8f95e2e0c273e9e7ef930b01a028ef796a3f
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Sat Oct 3 04:15:06 2020 +0000
|
||
|
||
upstream: prefer ed25519 signature algorithm variants to ECDSA; ok
|
||
|
||
markus@
|
||
|
||
OpenBSD-Commit-ID: 82187926fca96d35a5b5afbc091afa84e0966e5b
|
||
|
||
commit e5ed753add7aa8eed6b167e44db6240a76404db2
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Sat Oct 3 03:40:38 2020 +0000
|
||
|
||
upstream: want time.h here too
|
||
|
||
OpenBSD-Commit-ID: fafee8f1108c64ad8b282f9a1ed5ea830d8c58a7
|
||
|
||
commit 66bd9fdf8b7762eb6a85cabbb1ae4ed955679f60
|
||
Author: deraadt@openbsd.org <deraadt@openbsd.org>
|
||
Date: Sat Oct 3 02:18:33 2020 +0000
|
||
|
||
upstream: split introductory paragraph, and insert ominous words about
|
||
|
||
the glob issue, which cannot be fully fixed and really requires completely
|
||
replacing scp with a completely different subsystem. team effort to find the
|
||
right words..
|
||
|
||
OpenBSD-Commit-ID: 58e1f72d292687f63eb357183036ee242513691c
|
||
|
||
commit 86cc8ce002ea10e88a4c5d622a8fdfab8a7d261f
|
||
Author: Damien Miller <djm@mindrot.org>
|
||
Date: Sat Oct 3 13:38:55 2020 +1000
|
||
|
||
use relative rather than system include here
|
||
|
||
commit 922cfac5ed5ead9f796f7d39f012dd653dc5c173
|
||
Author: Damien Miller <djm@mindrot.org>
|
||
Date: Sat Oct 3 13:38:41 2020 +1000
|
||
|
||
add some openbsd-compat licenses we missed
|
||
|
||
commit ce941c75ea9cd6c358508a5b206809846c8d9240
|
||
Author: Philip Hands <phil@hands.com>
|
||
Date: Sat Oct 3 00:20:07 2020 +0200
|
||
|
||
un-nest $() to make ksh cheerful
|
||
|
||
commit 18ea5f4b88e303677d2003b95e5cb864b439e442
|
||
Author: Philip Hands <phil@hands.com>
|
||
Date: Fri Oct 2 21:30:10 2020 +0200
|
||
|
||
ksh doesn't grok 'local'
|
||
|
||
and AFAICT it's not actually doing anything useful in the code, so let's
|
||
see how things go without it.
|
||
|
||
commit d9e727dcc04a52caaac87543ea1d230e9e6b5604
|
||
Author: Oleg <Fallmay@users.noreply.github.com>
|
||
Date: Thu Oct 1 12:09:08 2020 +0300
|
||
|
||
Fix `EOF: command not found` error in ssh-copy-id
|
||
|
||
commit a1a856d50c89be3206f320baa4bfb32fff4e826f
|
||
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
||
Date: Wed Sep 30 09:11:39 2020 +0000
|
||
|
||
upstream: Regen moduli.
|
||
|
||
OpenBSD-Commit-ID: 04967f8c43e9854ac34b917bcd6f5ac96c53a693
|
||
|
||
commit fa1fe3ead7069d90d3c67d62137ad66acfcc9f48
|
||
Author: HARUYAMA Seigo <haruyama@unixuser.org>
|
||
Date: Sun Sep 27 20:06:20 2020 +0900
|
||
|
||
Restore first section title of INSTALL
|
||
|
||
commit 279261e1ea8150c7c64ab5fe7cb4a4ea17acbb29
|
||
Author: Damien Miller <djm@mindrot.org>
|
||
Date: Sun Sep 27 17:25:01 2020 +1000
|
||
|
||
update version numbers
|
||
|
||
commit 58ca6ab6ff035ed12b5078e3e9c7199fe72c8587
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Sun Sep 27 07:22:05 2020 +0000
|
||
|
||
upstream: openssh 8.4
|
||
|
||
OpenBSD-Commit-ID: a29e5b372d2c00e297da8a35a3b87c9beb3b4a58
|
||
|
||
commit 9bb8a303ce05ff13fb421de991b495930be103c3
|
||
Author: Damien Miller <djm@mindrot.org>
|
||
Date: Tue Sep 22 10:07:43 2020 +1000
|
||
|
||
sync with upstream ssh-copy-id rev f0da1a1b7
|
||
|
||
commit 0a4a5571ada76b1b012bec9cf6ad1203fc19ec8d
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Mon Sep 21 07:29:09 2020 +0000
|
||
|
||
upstream: close stdin when forking after authentication too; ok markus
|
||
|
||
OpenBSD-Commit-ID: 43db17e4abc3e6b4a7b033aa8cdab326a7cb6c24
|
||
|
||
commit d14fe25e6c3b89f8af17e2894046164ac3b45688
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Sun Sep 20 23:31:46 2020 +0000
|
||
|
||
upstream: close stdout/stderr after "ssh -f ..." forking
|
||
|
||
bz#3137, ok markus
|
||
|
||
OpenBSD-Commit-ID: e2d83cc4dea1665651a7aa924ad1ed6bcaaab3e2
|
||
|
||
commit 53a33a0d745179c02108589e1722457ca8ae4372
|
||
Author: Damien Miller <djm@mindrot.org>
|
||
Date: Sun Sep 20 15:57:09 2020 +1000
|
||
|
||
.depend
|
||
|
||
commit 107eb3eeafcd390e1fa7cc7672a05e994d14013e
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Sun Sep 20 05:47:25 2020 +0000
|
||
|
||
upstream: cap channel input buffer size at 16MB; avoids high memory use
|
||
|
||
when peer advertises a large window but is slow to consume the data we send
|
||
(e.g. because of a slow network)
|
||
|
||
reported by Pierre-Yves David
|
||
|
||
fix with & ok markus@
|
||
|
||
OpenBSD-Commit-ID: 1452771f5e5e768876d3bfe2544e3866d6ade216
|
||
|
||
commit acfe2ac5fe033e227ad3a56624fbbe4af8b5da04
|
||
Author: Damien Miller <djm@mindrot.org>
|
||
Date: Fri Sep 18 22:02:53 2020 +1000
|
||
|
||
libfido2 1.5.0 is recommended
|
||
|
||
commit 52a03e9fca2d74eef953ddd4709250f365ca3975
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Fri Sep 18 08:16:38 2020 +0000
|
||
|
||
upstream: handle multiple messages in a single read()
|
||
|
||
PR#183 by Dennis Kaarsemaker; feedback and ok markus@
|
||
|
||
OpenBSD-Commit-ID: 8570bb4d02d00cf70b98590716ea6a7d1cce68d1
|
||
|
||
commit dc098405b2939146e17567a25b08fc6122893cdf
|
||
Author: pedro martelletto <pedro@ambientworks.net>
|
||
Date: Fri Sep 18 08:57:29 2020 +0200
|
||
|
||
configure.ac: add missing includes
|
||
|
||
when testing, make sure to include the relevant header files that
|
||
declare the types of the functions used by the test:
|
||
|
||
- stdio.h for printf();
|
||
- stdlib.h for exit();
|
||
- string.h for strcmp();
|
||
- unistd.h for unlink(), _exit(), fork(), getppid(), sleep().
|
||
|
||
commit b3855ff053f5078ec3d3c653cdaedefaa5fc362d
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Fri Sep 18 05:23:03 2020 +0000
|
||
|
||
upstream: tweak the client hostkey preference ordering algorithm to
|
||
|
||
prefer the default ordering if the user has a key that matches the
|
||
best-preference default algorithm.
|
||
|
||
feedback and ok markus@
|
||
|
||
OpenBSD-Commit-ID: a92dd7d7520ddd95c0a16786a7519e6d0167d35f
|
||
|
||
commit f93b187ab900c7d12875952cc63350fe4de8a0a8
|
||
Author: Damien Miller <djm@mindrot.org>
|
||
Date: Fri Sep 18 14:55:48 2020 +1000
|
||
|
||
control over the colours in gnome-ssh-askpass[23]
|
||
|
||
Optionally set the textarea colours via $GNOME_SSH_ASKPASS_FG_COLOR and
|
||
$GNOME_SSH_ASKPASS_BG_COLOR. These accept the usual three or six digit
|
||
hex colours.
|
||
|
||
commit 9d3d36bdb10b66abd1af42e8655502487b6ba1fa
|
||
Author: Damien Miller <djm@mindrot.org>
|
||
Date: Fri Sep 18 14:50:38 2020 +1000
|
||
|
||
focus improvement for gnome-ssh-askpass[23]
|
||
|
||
When serving a SSH_ASKPASS_PROMPT=none information dialog, ensure
|
||
then <enter> doesn't immediately close the dialog. Instead, require an
|
||
explicit <tab> to reach the close button, or <esc>.
|
||
|
||
commit d6f507f37e6c75a899db0ef8224e72797c5563b6
|
||
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
||
Date: Wed Sep 16 03:07:31 2020 +0000
|
||
|
||
upstream: Remove unused buf, last user was removed when switching
|
||
|
||
to the sshbuf API. Patch from Sebastian Andrzej Siewior.
|
||
|
||
OpenBSD-Commit-ID: 250fa17f0cec01039cc4abd95917d9746e24c889
|
||
|
||
commit c3c786c3a0973331ee0922b2c51832a3b8d7f20f
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Wed Sep 9 21:57:27 2020 +0000
|
||
|
||
upstream: For the hostkey confirmation message:
|
||
|
||
> Are you sure you want to continue connecting (yes/no/[fingerprint])?
|
||
|
||
compare the fingerprint case sensitively; spotted Patrik Lundin
|
||
ok dtucker
|
||
|
||
OpenBSD-Commit-ID: 73097afee1b3a5929324e345ba4a4a42347409f2
|
||
|
||
commit f2950baf0bafe6aa20dfe2e8d1ca4b23528df617
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Fri Sep 11 14:45:23 2020 +1000
|
||
|
||
New config-build-time dependency on automake.
|
||
|
||
commit 600c1c27abd496372bd0cf83d21a1c119dfdf9a5
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Sun Sep 6 21:56:36 2020 +1000
|
||
|
||
Add aclocal.m4 and config.h.in~ to .gitignore.
|
||
|
||
aclocal.m4 is now generated by autoreconf.
|
||
|
||
commit 4bf7e1d00b1dcd3a6b3239f77465c019e61c6715
|
||
Author: Sebastian Andrzej Siewior <sebastian@breakpoint.cc>
|
||
Date: Sat Sep 5 17:50:03 2020 +0200
|
||
|
||
Quote the definition of OSSH_CHECK_HEADER_FOR_FIELD
|
||
|
||
autoreconf complains about underquoted definition of
|
||
OSSH_CHECK_HEADER_FOR_FIELD after aclocal.m4 has been and now is beeing
|
||
recreated.
|
||
|
||
Quote OSSH_CHECK_HEADER_FOR_FIELD as suggested.
|
||
|
||
Signed-off-by: Sebastian Andrzej Siewior <sebastian@breakpoint.cc>
|
||
|
||
commit a2f3ae386b5f7938ed3c565ad71f30c4f7f010f1
|
||
Author: Sebastian Andrzej Siewior <sebastian@breakpoint.cc>
|
||
Date: Sat Sep 5 17:50:02 2020 +0200
|
||
|
||
Move the local m4 macros
|
||
|
||
The `aclocal' step is skipped during `autoreconf' because aclocal.m4 is
|
||
present.
|
||
Move the current aclocal.m4 which contains local macros into the m4/
|
||
folder. With this change the aclocal.m4 will be re-created during
|
||
changes to the m4/ macro.
|
||
This is needed so the `aclocal' can fetch m4 macros from the system if
|
||
they are references in the configure script. This is a prerequisite to
|
||
use PKG_CHECK_MODULES.
|
||
|
||
Signed-off-by: Sebastian Andrzej Siewior <sebastian@breakpoint.cc>
|
||
|
||
commit 8372bff3a895b84fd78a81dc39da10928b662f5a
|
||
Author: Sebastian Andrzej Siewior <sebastian@breakpoint.cc>
|
||
Date: Sat Sep 5 17:50:01 2020 +0200
|
||
|
||
Remove HAVE_MMAP and BROKEN_MMAP
|
||
|
||
BROKEN_MMAP is no longer defined since commit
|
||
1cfd5c06efb12 ("Remove portability support for mmap")
|
||
|
||
this commit also removed other HAVE_MMAP user. I didn't find anything
|
||
that defines HAVE_MMAP. The check does not trigger because compression
|
||
on server side is by default COMP_DELAYED (2) so it never triggers.
|
||
|
||
Remove remaining HAVE_MMAP and BROKEN_MMAP bits.
|
||
|
||
Signed-off-by: Sebastian Andrzej Siewior <sebastian@breakpoint.cc>
|
||
|
||
commit bbf20ac8065905f9cb9aeb8f1df57fcab52ee2fb
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Wed Sep 9 03:10:21 2020 +0000
|
||
|
||
upstream: adapt to SSH_SK_VERSION_MAJOR crank
|
||
|
||
OpenBSD-Regress-ID: 0f3e76bdc8f9dbd9d22707c7bdd86051d5112ab8
|
||
|
||
commit 9afe2a150893b20bdf9eab764978d817b9a7b783
|
||
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
||
Date: Fri Aug 28 03:17:13 2020 +0000
|
||
|
||
upstream: Ensure that address/mask mismatches are flagged at
|
||
|
||
config-check time. ok djm@
|
||
|
||
OpenBSD-Regress-ID: 8f5f4c2c0bf00e6ceae7a1755a444666de0ea5c2
|
||
|
||
commit c76773524179cb654ff838dd43ba1ddb155bafaa
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Wed Sep 9 03:08:01 2020 +0000
|
||
|
||
upstream: when writing an attestation blob for a FIDO key, record all
|
||
|
||
the data needed to verify the attestation. Previously we were missing the
|
||
"authenticator data" that is included in the signature.
|
||
|
||
spotted by Ian Haken
|
||
feedback Pedro Martelletto and Ian Haken; ok markus@
|
||
|
||
OpenBSD-Commit-ID: 8439896e63792b2db99c6065dd9a45eabbdb7e0a
|
||
|
||
commit c1c44eeecddf093a7983bd91e70b446de789b363
|
||
Author: pedro martelletto <pedro@ambientworks.net>
|
||
Date: Tue Sep 1 17:01:55 2020 +0200
|
||
|
||
configure.ac: fix libfido2 back-compat
|
||
|
||
- HAVE_FIDO_CRED_PROD -> HAVE_FIDO_CRED_PROT;
|
||
- check for fido_dev_get_touch_begin(), so that
|
||
HAVE_FIDO_DEV_GET_TOUCH_BEGIN gets defined.
|
||
|
||
commit 785f0f315bf7ac5909e988bb1ac3e019fb5e1594
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Mon Aug 31 04:33:17 2020 +0000
|
||
|
||
upstream: refuse to add verify-required (PINful) FIDO keys to
|
||
|
||
ssh-agent until the agent supports them properly
|
||
|
||
OpenBSD-Commit-ID: 125bd55a8df32c87c3ec33c6ebe437673a3d037e
|
||
|
||
commit 39e88aeff9c7cb6862b37ad1a87a03ebbb38c233
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Mon Aug 31 00:17:41 2020 +0000
|
||
|
||
upstream: Add RCS IDs to the few files that are missing them; from
|
||
|
||
Pedro Martelletto
|
||
|
||
OpenBSD-Commit-ID: 39aa37a43d0c75ec87f1659f573d3b5867e4a3b3
|
||
|
||
commit 72730249b38a676da94a1366b54a6e96e6928bcb
|
||
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
||
Date: Fri Aug 28 03:15:52 2020 +0000
|
||
|
||
upstream: Check that the addresses supplied to Match Address and
|
||
|
||
Match LocalAddress are valid when parsing in config-test mode. This will
|
||
catch address/mask mismatches before they cause problems at runtime. Found by
|
||
Daniel Stocker, ok djm@
|
||
|
||
OpenBSD-Commit-ID: 2d0b10c69fad5d8fda4c703e7c6804935289378b
|
||
|
||
commit 2a3a9822311a565a9df48ed3b6a3c972f462bd7d
|
||
Author: jmc@openbsd.org <jmc@openbsd.org>
|
||
Date: Thu Aug 27 12:34:00 2020 +0000
|
||
|
||
upstream: sentence fix; from pedro martelletto
|
||
|
||
OpenBSD-Commit-ID: f95b84a1e94e9913173229f3787448eea2f8a575
|
||
|
||
commit ce178be0d954b210c958bc2b9e998cd6a7aa73a9
|
||
Author: Damien Miller <djm@mindrot.org>
|
||
Date: Thu Aug 27 20:01:52 2020 +1000
|
||
|
||
tweak back-compat for older libfido2
|
||
|
||
commit d6f45cdde031acdf434bbb27235a1055621915f4
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Thu Aug 27 09:46:04 2020 +0000
|
||
|
||
upstream: debug()-print a little info about FIDO-specific key
|
||
|
||
fields via "ssh-keygen -vyf /path/key"
|
||
|
||
OpenBSD-Commit-ID: cf315c4fe77db43947d111b00155165cb6b577cf
|
||
|
||
commit b969072cc3d62d05cb41bc6d6f3c22c764ed932f
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Thu Aug 27 09:43:28 2020 +0000
|
||
|
||
upstream: skip a bit more FIDO token selection logic when only a
|
||
|
||
single token is attached.
|
||
|
||
with Pedro Martelletto
|
||
|
||
OpenBSD-Commit-ID: e4a324bd9814227ec1faa8cb619580e661cca9ac
|
||
|
||
commit 744df42a129d7d7db26947b7561be32edac89f88
|
||
Author: jmc@openbsd.org <jmc@openbsd.org>
|
||
Date: Thu Aug 27 06:15:22 2020 +0000
|
||
|
||
upstream: tweak previous;
|
||
|
||
OpenBSD-Commit-ID: 92714b6531e244e4da401b2defaa376374e24be7
|
||
|
||
commit e32479645ce649b444ba5c6e7151304306a09654
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Thu Aug 27 03:55:22 2020 +0000
|
||
|
||
upstream: adapt to API changes
|
||
|
||
OpenBSD-Regress-ID: 5f147990cb67094fe554333782ab268a572bb2dd
|
||
|
||
commit bbcc858ded3fbc46abfa7760e40389e3ca93884c
|
||
Author: Damien Miller <djm@mindrot.org>
|
||
Date: Thu Aug 27 12:37:12 2020 +1000
|
||
|
||
degrade semi-gracefully when libfido2 is too old
|
||
|
||
commit 9cbbdc12cb6a2ab1e9ffe9974cca91d213c185c2
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Thu Aug 27 01:15:36 2020 +0000
|
||
|
||
upstream: dummy firmware needs to match API version numner crank (for
|
||
|
||
verify-required resident keys) even though it doesn't implement this feature
|
||
|
||
OpenBSD-Regress-ID: 86579ea2891e18e822e204413d011b2ae0e59657
|
||
|
||
commit c1e76c64956b424ba260fd4eec9970e5b5859039
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Thu Aug 27 02:11:09 2020 +0000
|
||
|
||
upstream: remove unreachable code I forgot to delete in r1.334
|
||
|
||
OpenBSD-Commit-ID: 9ed6078251a0959ee8deda443b9ae42484fd8b18
|
||
|
||
commit 0caff05350bd5fc635674c9e051a0322faba5ae3
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Thu Aug 27 01:08:45 2020 +0000
|
||
|
||
upstream: Request PIN ahead of time for certain FIDO actions
|
||
|
||
When we know that a particular action will require a PIN, such as
|
||
downloading resident keys or generating a verify-required key, request
|
||
the PIN before attempting it.
|
||
|
||
joint work with Pedro Martelletto; ok markus@
|
||
|
||
OpenBSD-Commit-ID: 863182d38ef075bad1f7d20ca485752a05edb727
|
||
|
||
commit b649b3daa6d4b8ebe1bd6de69b3db5d2c03c9af0
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Thu Aug 27 01:08:19 2020 +0000
|
||
|
||
upstream: preserve verify-required for resident FIDO keys
|
||
|
||
When downloading a resident, verify-required key from a FIDO token,
|
||
preserve the verify-required in the private key that is written to
|
||
disk. Previously we weren't doing that because of lack of support
|
||
in the middleware API.
|
||
|
||
from Pedro Martelletto; ok markus@ and myself
|
||
|
||
OpenBSD-Commit-ID: 201c46ccdd227cddba3d64e1bdbd082afa956517
|
||
|
||
commit 642e06d0df983fa2af85126cf4b23440bb2985bf
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Thu Aug 27 01:07:51 2020 +0000
|
||
|
||
upstream: major rework of FIDO token selection logic
|
||
|
||
When PINs are in use and multiple FIDO tokens are attached to a host, we
|
||
cannot just blast requests at all attached tokens with the PIN specified
|
||
as this will cause the per-token PIN failure counter to increment. If
|
||
this retry counter hits the token's limit (usually 3 attempts), then the
|
||
token will lock itself and render all (web and SSH) of its keys invalid.
|
||
We don't want this.
|
||
|
||
So this reworks the key selection logic for the specific case of
|
||
multiple keys being attached. When multiple keys are attached and the
|
||
operation requires a PIN, then the user must touch the key that they
|
||
wish to use first in order to identify it.
|
||
|
||
This may require multiple touches, but only if there are multiple keys
|
||
attached AND (usually) the operation requires a PIN. The usual case of a
|
||
single key attached should be unaffected.
|
||
|
||
Work by Pedro Martelletto; ok myself and markus@
|
||
|
||
OpenBSD-Commit-ID: 637d3049ced61b7a9ee796914bbc4843d999a864
|
||
|
||
commit 801c9f095e6d8b7b91aefd98f5001c652ea13488
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Thu Aug 27 01:07:09 2020 +0000
|
||
|
||
upstream: support for requiring user verified FIDO keys in sshd
|
||
|
||
This adds a "verify-required" authorized_keys flag and a corresponding
|
||
sshd_config option that tells sshd to require that FIDO keys verify the
|
||
user identity before completing the signing/authentication attempt.
|
||
Whether or not user verification was performed is already baked into the
|
||
signature made on the FIDO token, so this is just plumbing that flag
|
||
through and adding ways to require it.
|
||
|
||
feedback and ok markus@
|
||
|
||
OpenBSD-Commit-ID: 3a2313aae153e043d57763d766bb6d55c4e276e6
|
||
|
||
commit 9b8ad93824c682ce841f53f3b5762cef4e7cc4dc
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Thu Aug 27 01:06:18 2020 +0000
|
||
|
||
upstream: support for user-verified FIDO keys
|
||
|
||
FIDO2 supports a notion of "user verification" where the user is
|
||
required to demonstrate their identity to the token before particular
|
||
operations (e.g. signing). Typically this is done by authenticating
|
||
themselves using a PIN that has been set on the token.
|
||
|
||
This adds support for generating and using user verified keys where
|
||
the verification happens via PIN (other options might be added in the
|
||
future, but none are in common use now). Practically, this adds
|
||
another key generation option "verify-required" that yields a key that
|
||
requires a PIN before each authentication.
|
||
|
||
feedback markus@ and Pedro Martelletto; ok markus@
|
||
|
||
OpenBSD-Commit-ID: 57fd461e4366f87c47502c5614ec08573e6d6a15
|
||
|
||
commit 1196d7f49d4fbc90f37e550de3056561613b0960
|
||
Author: cheloha@openbsd.org <cheloha@openbsd.org>
|
||
Date: Wed Aug 12 01:23:45 2020 +0000
|
||
|
||
upstream: ssh-keyscan(1): simplify conloop() with timercmp(3),
|
||
|
||
timersub(3); ok djm@
|
||
|
||
OpenBSD-Commit-ID: a102acb544f840d33ad73d40088adab4a687fa27
|
||
|
||
commit d0a195c89e26766d3eb8f3e4e2a00ebc98b57795
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Tue Aug 11 09:49:57 2020 +0000
|
||
|
||
upstream: let ssh_config(5)'s AddKeysToAgent keyword accept a time
|
||
|
||
limit for keys in addition to its current flag options. Time-limited keys
|
||
will automatically be removed from ssh-agent after their expiry time has
|
||
passed; ok markus@
|
||
|
||
OpenBSD-Commit-ID: 792e71cacbbc25faab5424cf80bee4a006119f94
|
||
|
||
commit e9c2002891a7b8e66f4140557a982978f372e5a3
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Tue Aug 11 09:45:54 2020 +0000
|
||
|
||
upstream: let the "Confirm user presence for key ..." ssh-askpass
|
||
|
||
notification respect $SSH_ASKPASS_REQUIRE; ok markus@
|
||
|
||
OpenBSD-Commit-ID: 7c1a616b348779bda3b9ad46bf592741f8e206c1
|
||
|
||
commit eaf8672b1b52db2815a229745f4e4b08681bed6d
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Fri Aug 21 00:04:13 2020 +1000
|
||
|
||
Remove check for 'ent' command.
|
||
|
||
It was added in 8d1fd57a9 for measuring entropy of ssh_prng_cmds which
|
||
has long since been removed and there are no other references to it.
|
||
|
||
commit 05c215de8d224e094a872d97d45f37f60c06206b
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Mon Aug 17 21:34:32 2020 +1000
|
||
|
||
Wrap stdint.h include in ifdef HAVE_STDINT_H.
|
||
|
||
commit eaf2765efe8bc74feba85c34295d067637fc6635
|
||
Author: Damien Miller <djm@mindrot.org>
|
||
Date: Mon Aug 10 13:24:09 2020 +1000
|
||
|
||
sync memmem.c with OpenBSD
|
||
|
||
commit ed6bef77f5bb5b8f9ca2914478949e29f2f0a780
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Fri Aug 7 17:12:16 2020 +1000
|
||
|
||
Always send any PAM account messages.
|
||
|
||
If the PAM account stack reaturns any messages, send them to the user
|
||
not just if the check succeeds. bz#2049, ok djm@
|
||
|
||
commit a09e98dcae1e26f026029b7142b0e0d10130056f
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Fri Aug 7 15:37:37 2020 +1000
|
||
|
||
Output test debug logs on failure.
|
||
|
||
commit eb122b1eebe58b29a83a507ee814cbcf8aeded1b
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Fri Aug 7 15:11:42 2020 +1000
|
||
|
||
Add ability to specify exact test target.
|
||
|
||
commit c2ec7a07f8caabb4d8e00c66e7cd46bf2cd1e922
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Fri Aug 7 14:21:15 2020 +1000
|
||
|
||
Document --without-openssl and --without-zlib.
|
||
|
||
commit 651bb3a31949bbdc3a78b2ede95a77bce0c72984
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Fri Aug 7 14:15:11 2020 +1000
|
||
|
||
Add without-openssl without-zlib test target.
|
||
|
||
commit 9499f2bb01dc1032ae155999b2d7764b9491341f
|
||
Author: Stefan Schindler <dns2utf8@estada.ch>
|
||
Date: Wed Aug 5 19:00:52 2020 +0200
|
||
|
||
Add CI with prepare script
|
||
|
||
* Only use heimdal kerberos implementation
|
||
* Fetch yubico/libfido2 (see: https://github.com/Yubico/libfido2)
|
||
* Add one target for
|
||
* all features
|
||
* each feature alone
|
||
* no features
|
||
|
||
commit ea1f649046546a860f68b97ddc3015b7e44346ca
|
||
Author: Damien Miller <djm@mindrot.org>
|
||
Date: Wed Aug 5 08:58:57 2020 +1000
|
||
|
||
support NetBSD's utmpx.ut_ss address field
|
||
|
||
bz#960, ok dtucker
|
||
|
||
commit 32c63e75a70a0ed9d6887a55fcb0e4531a6ad617
|
||
Author: Damien Miller <djm@mindrot.org>
|
||
Date: Tue Aug 4 14:59:21 2020 +1000
|
||
|
||
wrap a declaration in the same ifdefs as its use
|
||
|
||
avoids warnings on NetBSD
|
||
|
||
commit c9e3be9f4b41fda32a2a0138d54c7a6b563bc94d
|
||
Author: Damien Miller <djm@mindrot.org>
|
||
Date: Tue Aug 4 14:58:46 2020 +1000
|
||
|
||
undef TAILQ_CONCAT and friends
|
||
|
||
Needed for NetBSD. etc that supply these macros
|
||
|
||
commit 2d8a3b7e8b0408dfeb933ac5cfd3a58f5bac49af
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Mon Aug 3 02:53:51 2020 +0000
|
||
|
||
upstream: ensure that certificate extensions are lexically sorted.
|
||
|
||
Previously if the user specified a custom extension then the everything would
|
||
be in order except the custom ones. bz3198 ok dtucker markus
|
||
|
||
OpenBSD-Commit-ID: d97deb90587b06cb227c66ffebb2d9667bf886f0
|
||
|
||
commit a8732d74cb8e72f0c6366015687f1e649f60be87
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Mon Aug 3 02:43:41 2020 +0000
|
||
|
||
upstream: allow -A to explicitly enable agent forwarding in scp and
|
||
|
||
sftp. The default remains to not forward an agent, even when ssh_config
|
||
enables it. ok jmc dtucker markus
|
||
|
||
OpenBSD-Commit-ID: 36cc526aa3b0f94e4704b8d7b969dd63e8576822
|
||
|
||
commit ab9105470a83ed5d8197959a1b1f367399958ba1
|
||
Author: deraadt@openbsd.org <deraadt@openbsd.org>
|
||
Date: Mon Aug 3 02:42:49 2020 +0000
|
||
|
||
upstream: clang -Wimplicit-fallthrough does not recognise /*
|
||
|
||
FALLTHROUGH */ comments, which is the style we currently use, and gives too
|
||
many boring warnings. ok djm
|
||
|
||
OpenBSD-Commit-ID: 07b5031e9f49f2b69ac5e85b8da4fc9e393992a0
|
||
|
||
commit ced327b9fb78c94d143879ef4b2a02cbc5d38690
|
||
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
||
Date: Fri Jul 31 04:19:37 2020 +0000
|
||
|
||
upstream: Also compare username when checking for JumpHost loops.
|
||
|
||
bz#3057, ok djm@
|
||
|
||
OpenBSD-Commit-ID: 9bbc1d138adb34c54f3c03a15a91f75dbf418782
|
||
|
||
commit ae7527010c44b3376b85d036a498f136597b2099
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Fri Jul 31 15:19:04 2020 +1000
|
||
|
||
Remove AC_REVISION.
|
||
|
||
It hasn't been useful since we switched to git in 2014. ok djm@
|
||
|
||
commit 89fc3f414be0ce4e8008332a9739a7d721269e50
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Tue Jul 28 19:40:30 2020 +1000
|
||
|
||
Use argv in OSSH_CHECK_CFLAG_COMPILE test.
|
||
|
||
configure.ac is not detecting -Wextra in compilers that implement the
|
||
option. The problem is that -Wextra implies -Wunused-parameter, and the
|
||
C excerpt used by aclocal.m4 does not use argv. Patch from pedro at
|
||
ambientworks.net, ok djm@
|
||
|
||
commit 62c81ef531b0cc7ff655455dd34f5f0c94f48e82
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Mon Jul 20 22:12:07 2020 +1000
|
||
|
||
Skip ECDSA-SK webauthn test when built w/out ECC
|
||
|
||
commit 3ec9a6d7317236a9994887d8bd5d246af403a00d
|
||
Author: Damien Miller <djm@mindrot.org>
|
||
Date: Mon Jul 20 13:09:25 2020 +1000
|
||
|
||
Add ssh-sk-helper and manpage to RPM spec file
|
||
|
||
Based on patch from Fabio Pedretti
|
||
|
||
commit a2855c048b3f4b17d8787bd3f24232ec0cd79abe
|
||
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
||
Date: Fri Jul 17 07:09:24 2020 +0000
|
||
|
||
upstream: Add %k to the TOKENs for Match Exec for consistency with
|
||
|
||
the other keywords that recently got %k.
|
||
|
||
OpenBSD-Commit-ID: 1857d1c40f270cbc254fca91e66110641dddcfdb
|
||
|
||
commit 69860769fa9f4529d8612ec055ae11912f7344cf
|
||
Author: jmc@openbsd.org <jmc@openbsd.org>
|
||
Date: Fri Jul 17 05:59:05 2020 +0000
|
||
|
||
upstream: fix macro slip in previous;
|
||
|
||
OpenBSD-Commit-ID: 624e47ab209450ad9ad5c69f54fa69244de5ed9a
|
||
|
||
commit 40649bd0822883b684183854b16d0b8461d5697b
|
||
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
||
Date: Fri Jul 17 07:10:24 2020 +0000
|
||
|
||
upstream: Add test for '%k' (HostKeyAlias) TOKEN.
|
||
|
||
OpenBSD-Regress-ID: 8ed1ba1a811790031aad3fcea860a34ad7910456
|
||
|
||
commit 6736fe680704a3518cb4f3f8f6723b00433bd3dd
|
||
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
||
Date: Fri Jul 17 03:26:58 2020 +0000
|
||
|
||
upstream: Add tests for expansions on UserKnownHostsFile.
|
||
|
||
OpenBSD-Regress-ID: bccf8060306c841bbcceb1392644f906a4d6ca51
|
||
|
||
commit 287dc6396e0f9cb2393f901816dbd7f2a7dfbb5f
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Fri Jul 17 03:51:32 2020 +0000
|
||
|
||
upstream: log error message for process_write() write failures
|
||
|
||
OpenBSD-Commit-ID: f733d7b3b05e3c68967dc18dfe39b9e8fad29851
|
||
|
||
commit 8df5774a42d2eaffe057bd7f293fc6a4b1aa411c
|
||
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
||
Date: Fri Jul 17 03:43:42 2020 +0000
|
||
|
||
upstream: Add a '%k' TOKEN that expands to the effective HostKey of
|
||
|
||
the destination. This allows, eg, keeping host keys in individual files
|
||
using "UserKnownHostsFile ~/.ssh/known_hosts.d/%k". bz#1654, ok djm@, jmc@
|
||
(man page bits)
|
||
|
||
OpenBSD-Commit-ID: 7084d723c9cc987a5c47194219efd099af5beadc
|
||
|
||
commit c4f239944a4351810fd317edf408bdcd5c0102d9
|
||
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
||
Date: Fri Jul 17 03:23:10 2020 +0000
|
||
|
||
upstream: Add %-TOKEN, environment variable and tilde expansion to
|
||
|
||
UserKnownHostsFile, allowing the file to be automagically split up in the
|
||
configuration (eg bz#1654). ok djm@, man page parts jmc@
|
||
|
||
OpenBSD-Commit-ID: 7e1b406caf147638bb51558836a72d6cc0bd1b18
|
||
|
||
commit dbaaa01daedb423c38124a72c471982fb08a16fb
|
||
Author: solene@openbsd.org <solene@openbsd.org>
|
||
Date: Wed Jul 15 07:50:46 2020 +0000
|
||
|
||
upstream: - Add [-a rounds] in ssh-keygen man page and usage() -
|
||
|
||
Reorder parameters list in the first usage() case - Sentence rewording
|
||
|
||
ok dtucker@
|
||
jmc@ noticed usage() missed -a flag too
|
||
|
||
OpenBSD-Commit-ID: f06b9afe91cc96f260b929a56e9930caecbde246
|
||
|
||
commit 69924a92c3af7b99a7541aa544a2334ec0fb092c
|
||
Author: jmc@openbsd.org <jmc@openbsd.org>
|
||
Date: Wed Jul 15 05:40:05 2020 +0000
|
||
|
||
upstream: start sentence with capital letter;
|
||
|
||
OpenBSD-Commit-ID: ab06581d51b2b4cc1b4aab781f7f3cfa56cad973
|
||
|
||
commit 5b56bd0affea7b02b540bdbc4d1d271b0e4fc885
|
||
Author: Damien Miller <djm@mindrot.org>
|
||
Date: Fri Jul 17 13:15:50 2020 +1000
|
||
|
||
detect Linux/X32 systems
|
||
|
||
This is a frankenstein monster of AMD64 instructions/calling conventions
|
||
but with a 4GB address space. Allegedly deprecated but people still run
|
||
into it causing weird sandbox failures, e.g. bz#3085
|
||
|
||
commit 9c9ddc1391d6af8d09580a2424ab467d0a5df3c7
|
||
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
||
Date: Wed Jul 15 06:43:16 2020 +0000
|
||
|
||
upstream: Fix previous by calling the correct function.
|
||
|
||
OpenBSD-Regress-ID: 821cdd1dff9c502cceff4518b6afcb81767cad5a
|
||
|
||
commit f1a4798941b4372bfe5e46f1c0f8672fe692d9e4
|
||
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
||
Date: Wed Jul 15 05:36:50 2020 +0000
|
||
|
||
upstream: Update test to match recent change in match.c
|
||
|
||
OpenBSD-Regress-ID: 965bda1f95f09a765050707340c73ad755f41167
|
||
|
||
commit d7e71be4fd57b7c7e620d733cdf2333b27bfa924
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Wed Jul 15 15:30:43 2020 +1000
|
||
|
||
Adjust portable code to match changes in 939d787d,
|
||
|
||
commit fec89f32a84fd0aa1afc81deec80a460cbaf451a
|
||
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
||
Date: Wed Jul 15 04:27:34 2020 +0000
|
||
|
||
upstream: Add default for number of rounds (-a). ok djm@
|
||
|
||
OpenBSD-Commit-ID: cb7e9aa04ace01a98e63e4bd77f34a42ab169b15
|
||
|
||
commit aaa8b609a7b332be836cd9a3b782422254972777
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Tue Jul 14 23:57:01 2020 +0000
|
||
|
||
upstream: allow some additional control over the use of ssh-askpass
|
||
|
||
via $SSH_ASKPASS_REQUIRE, including force-enable/disable. bz#69 ok markus@
|
||
|
||
OpenBSD-Commit-ID: 3a1e6cbbf6241ddc4405c4246caa2c249f149eb2
|
||
|
||
commit 6368022cd4dd508671c4999a59ec5826df098530
|
||
Author: deraadt@openbsd.org <deraadt@openbsd.org>
|
||
Date: Tue Jul 7 02:47:21 2020 +0000
|
||
|
||
upstream: correct recently broken comments
|
||
|
||
OpenBSD-Commit-ID: 964d9a88f7de1d0eedd3f8070b43fb6e426351f1
|
||
|
||
commit 6d755706a0059eb9e2d63517f288b75cbc3b4701
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Sun Jul 5 23:59:45 2020 +0000
|
||
|
||
upstream: some language improvements; ok markus
|
||
|
||
OpenBSD-Commit-ID: 939d787d571b4d5da50b3b721fd0b2ac236acaa8
|
||
|
||
commit b0c1e8384d5e136ebdf895d1434aea7dd8661a1c
|
||
Author: markus@openbsd.org <markus@openbsd.org>
|
||
Date: Fri Jul 3 10:12:26 2020 +0000
|
||
|
||
upstream: update setproctitle after re-exec; ok djm
|
||
|
||
OpenBSD-Commit-ID: bc92d122f9184ec2a9471ade754b80edd034ce8b
|
||
|
||
commit cd119a5ec2bf0ed5df4daff3bd14f8f7566dafd3
|
||
Author: markus@openbsd.org <markus@openbsd.org>
|
||
Date: Fri Jul 3 10:11:33 2020 +0000
|
||
|
||
upstream: keep ignoring HUP after fork+exec; ok djm
|
||
|
||
OpenBSD-Commit-ID: 7679985a84ee5ceb09839905bb6f3ddd568749a2
|
||
|
||
commit 8af4a743693ccbea3e15fc9e93edbeb610fa94f4
|
||
Author: markus@openbsd.org <markus@openbsd.org>
|
||
Date: Fri Jul 3 10:10:17 2020 +0000
|
||
|
||
upstream: don't exit the listener on send_rexec_state errors; ok
|
||
|
||
djm
|
||
|
||
OpenBSD-Commit-ID: 57cbd757d130d3f45b7d41310b3a15eeec137d5c
|
||
|
||
commit 03da4c2b70468f04ed1c08518ea0a70e67232739
|
||
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
||
Date: Wed Jul 15 04:55:47 2020 +0000
|
||
|
||
upstream: Use $OBJ to find key files. Fixes test when run on an obj
|
||
|
||
directory (on OpenBSD) or out of tree (in Portable).
|
||
|
||
OpenBSD-Regress-ID: 938fa8ac86adaa527d64a305bd2135cfbb1c0a17
|
||
|
||
commit 73f20f195ad18f1cf633eb7d8be95dc1b6111eea
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Sat Jul 4 23:11:23 2020 +1000
|
||
|
||
Wrap stdint.h in ifdef HAVE_STDINT_H.
|
||
|
||
commit aa6fa4bf3023fa0e5761cd8f4b2cd015d2de74dd
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Fri Jul 3 07:25:18 2020 +0000
|
||
|
||
upstream: put back the mux_ctx memleak fix, but only for channels of
|
||
|
||
type SSH_CHANNEL_MUX_LISTENER; Specifically SSH_CHANNEL_MUX_PROXY channels
|
||
should not have this structure freed.
|
||
|
||
OpenBSD-Commit-ID: f3b213ae60405f77439e2b06262f054760c9d325
|
||
|
||
commit d8195914eb43b20b13381f4e5a74f9f8a14f0ded
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Fri Jul 3 07:17:35 2020 +0000
|
||
|
||
upstream: revert r1.399 - the lifetime of c->mux_ctx is more complex;
|
||
|
||
simply freeing it here causes other problems
|
||
|
||
OpenBSD-Commit-ID: c6fee8ca94e2485faa783839541962be2834c5ed
|
||
|
||
commit 20b5fab9f773b3d3c7f06cb15b8f69a2c081ee80
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Fri Jul 3 07:02:37 2020 +0000
|
||
|
||
upstream: avoid tilde_expand_filename() in expanding ~/.ssh/rc - if
|
||
|
||
sshd is in chroot mode, the likely absence of a password database will cause
|
||
tilde_expand_filename() to fatal; ok dtucker@
|
||
|
||
OpenBSD-Commit-ID: e20aee6159e8b79190d18dba1513fc1b7c8b7ee1
|
||
|
||
commit c8935081db35d73ee6355999142fa0776a2af912
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Fri Jul 3 06:46:41 2020 +0000
|
||
|
||
upstream: when redirecting sshd's log output to a file, undo this
|
||
|
||
redirection after the session child process is forked(); ok dtucker@
|
||
|
||
OpenBSD-Commit-ID: 6df86dd653c91f5bc8ac1916e7680d9d24690865
|
||
|
||
commit 183c4aaef944af3a1a909ffa01058c65bac55748
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Fri Jul 3 06:29:57 2020 +0000
|
||
|
||
upstream: start ClientAliveInterval bookkeeping before first pass
|
||
|
||
through select() loop; fixed theoretical case where busy sshd may ignore
|
||
timeouts from client; inspired by and ok dtucker
|
||
|
||
OpenBSD-Commit-ID: 96bfc4b1f86c7da313882a84755b2b47eb31957f
|
||
|
||
commit 6fcfd303d67f16695198cf23d109a988e40eefb6
|
||
Author: Damien Miller <djm@mindrot.org>
|
||
Date: Fri Jul 3 15:28:27 2020 +1000
|
||
|
||
add check for fido_cred_set_prot() to configure
|
||
|
||
commit f11b23346309e4d5138e733a49321aedd6eeaa2f
|
||
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
||
Date: Fri Jul 3 05:09:06 2020 +0000
|
||
|
||
upstream: Only reset the serveralive check when we receive traffic from
|
||
|
||
the server and ignore traffic from a port forwarding client, preventing a
|
||
client from keeping a connection alive when it should be terminated. Based
|
||
on a patch from jxraynor at gmail.com via openssh-unix-dev and bz#2265, ok
|
||
djm@
|
||
|
||
OpenBSD-Commit-ID: a941a575a5cbc244c0ef5d7abd0422bbf02c2dcd
|
||
|
||
commit adfdbf1211914b631c038f0867a447db7b519937
|
||
Author: Damien Miller <djm@mindrot.org>
|
||
Date: Fri Jul 3 15:15:15 2020 +1000
|
||
|
||
sync sys-queue.h with OpenBSD upstream
|
||
|
||
needed for TAILQ_CONCAT
|
||
|
||
commit 1b90ddde49e2ff377204082b6eb130a096411dc1
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Fri Jul 3 05:08:41 2020 +0000
|
||
|
||
upstream: fix memory leak of mux_ctx; patch from Sergiy Lozovsky
|
||
|
||
via bz3189 ok dtucker
|
||
|
||
OpenBSD-Commit-ID: db249bd4526fd42d0f4f43f72f7b8b7705253bde
|
||
|
||
commit 55ef3e9cbd5b336bd0f89205716924886fcf86de
|
||
Author: markus@openbsd.org <markus@openbsd.org>
|
||
Date: Wed Jul 1 16:28:31 2020 +0000
|
||
|
||
upstream: free kex in ssh_packet_close; ok djm semarie
|
||
|
||
OpenBSD-Commit-ID: dbc181e90d3d32fd97b10d75e68e374270e070a2
|
||
|
||
commit e1c401109b61f7dbc199b5099933d579e7fc5dc9
|
||
Author: bket@openbsd.org <bket@openbsd.org>
|
||
Date: Sat Jun 27 13:39:09 2020 +0000
|
||
|
||
upstream: Replace TAILQ concatenation loops with TAILQ_CONCAT
|
||
|
||
OK djm@
|
||
|
||
OpenBSD-Commit-ID: 454b40e09a117ddb833794358970a65b14c431ef
|
||
|
||
commit 14beca57ac92d62830c42444c26ba861812dc837
|
||
Author: semarie@openbsd.org <semarie@openbsd.org>
|
||
Date: Fri Jun 26 11:26:01 2020 +0000
|
||
|
||
upstream: backout 1.293 fix kex mem-leak in ssh_packet_close at markus
|
||
|
||
request
|
||
|
||
the change introduced a NULL deref in sshpkt_vfatal() (uses of ssh->kex after
|
||
calling ssh_packet_clear_keys())
|
||
|
||
OpenBSD-Commit-ID: 9c9a6721411461b0b1c28dc00930d7251a798484
|
||
|
||
commit 598c3a5e3885080ced0d7c40fde00f1d5cdbb32b
|
||
Author: Damien Miller <djm@mindrot.org>
|
||
Date: Fri Jun 26 16:07:12 2020 +1000
|
||
|
||
document a PAM spec problem in a frustrated comment
|
||
|
||
commit 976c4f86286d52a0cb2aadf4a095d379c0da752e
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Fri Jun 26 05:42:16 2020 +0000
|
||
|
||
upstream: avoid spurious error message when ssh-keygen creates files
|
||
|
||
outside ~/.ssh; with dtucker@
|
||
|
||
OpenBSD-Commit-ID: ac0c662d44607e00ec78c266ee60752beb1c7e08
|
||
|
||
commit 32b2502a9dfdfded1ccdc1fd6dc2b3fe41bfc205
|
||
Author: Damien Miller <djm@mindrot.org>
|
||
Date: Fri Jun 26 15:30:06 2020 +1000
|
||
|
||
missing ifdef SELINUX; spotted by dtucker
|
||
|
||
commit e073106f370cdd2679e41f6f55a37b491f0e82fe
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Fri Jun 26 05:12:21 2020 +0000
|
||
|
||
upstream: regress test for ssh-add -d; ok dtucker@
|
||
|
||
OpenBSD-Regress-ID: 3a2e044be616afc7dd4f56c100179e83b33d8abf
|
||
|
||
commit c809daaa1bad6b1c305b0e0b5440360f32546c84
|
||
Author: markus@openbsd.org <markus@openbsd.org>
|
||
Date: Wed Jun 24 15:16:23 2020 +0000
|
||
|
||
upstream: add test for mux w/-Oproxy; ok djm
|
||
|
||
OpenBSD-Regress-ID: 764d5c696e2a259f1316a056e225e50023abb027
|
||
|
||
commit 3d06ff4bbd3dca8054c238d2a94c0da563ef7eee
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Fri Jun 26 05:16:38 2020 +0000
|
||
|
||
upstream: handle EINTR in waitfd() and timeout_connect() helpers;
|
||
|
||
bz#3071; ok dtucker@
|
||
|
||
OpenBSD-Commit-ID: 08fa87be50070bd8b754d9b1ebb1138d7bc9d8ee
|
||
|
||
commit fe2ec0b9c19adeab0cd9f04b8152dc17f31c31e5
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Fri Jun 26 05:04:07 2020 +0000
|
||
|
||
upstream: allow "ssh-add -d -" to read keys to be deleted from
|
||
|
||
stdin bz#3180; ok dtucker@
|
||
|
||
OpenBSD-Commit-ID: 15c7f10289511eb19fce7905c9cae8954e3857ff
|
||
|
||
commit a3e0c376ffc11862fa3568b28188bd12965973e1
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Fri Jun 26 05:03:36 2020 +0000
|
||
|
||
upstream: constify a few things; ok dtucker (as part of another
|
||
|
||
diff)
|
||
|
||
OpenBSD-Commit-ID: 7c17fc987085994d752304bd20b1ae267a9bcdf6
|
||
|
||
commit 74344c3ca42c3f53b00b025daf09ae7f6aa38076
|
||
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
||
Date: Fri Jun 26 05:02:03 2020 +0000
|
||
|
||
upstream: Defer creation of ~/.ssh by ssh(1) until we attempt to
|
||
|
||
write to it so we don't leave an empty .ssh directory when it's not needed.
|
||
Use the same function to replace the code in ssh-keygen that does the same
|
||
thing. bz#3156, ok djm@
|
||
|
||
OpenBSD-Commit-ID: 59c073b569be1a60f4de36f491a4339bc4ae870f
|
||
|
||
commit c9e24daac6324fcbdba171392c325bf9ccc3c768
|
||
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
||
Date: Fri Jun 26 04:45:11 2020 +0000
|
||
|
||
upstream: Expand path to ~/.ssh/rc rather than relying on it
|
||
|
||
being relative to the current directory, so that it'll still be found if the
|
||
shell startup changes its directory. Since the path is potentially longer,
|
||
make the cmd buffer that uses it dynamically sized. bz#3185, with & ok djm@
|
||
|
||
OpenBSD-Commit-ID: 36e33ff01497af3dc8226d0c4c1526fc3a1e46bf
|
||
|
||
commit 07f5f369a25e228a7357ef6c57205f191f073d99
|
||
Author: markus@openbsd.org <markus@openbsd.org>
|
||
Date: Wed Jun 24 15:12:09 2020 +0000
|
||
|
||
upstream: fix kex mem-leak in ssh_packet_close; ok djm
|
||
|
||
OpenBSD-Commit-ID: e2e9533f393620383afd0b68ef435de8d5e8abe4
|
||
|
||
commit e35995088cd6691a712bfd586bae8084a3a922ba
|
||
Author: markus@openbsd.org <markus@openbsd.org>
|
||
Date: Wed Jun 24 15:10:38 2020 +0000
|
||
|
||
upstream: fix ssh -O proxy w/mux which got broken by no longer
|
||
|
||
making ssh->kex optional in packet.c revision 1.278 ok djm@
|
||
|
||
OpenBSD-Commit-ID: 2b65df04a064c2c6277359921d2320c90ab7d917
|
||
|
||
commit 250246fef22b87a54a63211c60a2def9be431fbd
|
||
Author: markus@openbsd.org <markus@openbsd.org>
|
||
Date: Wed Jun 24 15:09:53 2020 +0000
|
||
|
||
upstream: support loading big sshd_config files w/o realloc; ok
|
||
|
||
djm
|
||
|
||
OpenBSD-Commit-ID: ba9238e810074ac907f0cf8cee1737ac04983171
|
||
|
||
commit 89b54900ac61986760452f132bbe3fb7249cfdac
|
||
Author: markus@openbsd.org <markus@openbsd.org>
|
||
Date: Wed Jun 24 15:08:53 2020 +0000
|
||
|
||
upstream: allow sshd_config longer than 256k; ok djm
|
||
|
||
OpenBSD-Commit-ID: 83f40dd5457a64c1d3928eb4364461b22766beb3
|
||
|
||
commit e3fa6249e6d9ceb57c14b04dd4c0cfab12fa7cd5
|
||
Author: markus@openbsd.org <markus@openbsd.org>
|
||
Date: Wed Jun 24 15:07:33 2020 +0000
|
||
|
||
upstream: only call sshkey_xmss_init() once for KEY_XMSS_CERT; ok
|
||
|
||
djm
|
||
|
||
OpenBSD-Commit-ID: d0002ffb7f20f538b014d1d0735facd5a81ff096
|
||
|
||
commit 37f2da069c0619f2947fb92785051d82882876d7
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Mon Jun 22 23:44:27 2020 +0000
|
||
|
||
upstream: some clarifying comments
|
||
|
||
OpenBSD-Commit-ID: 5268479000fd97bfa30ab819f3517139daa054a2
|
||
|
||
commit b659319a5bc9e8adf3c4facc51f37b670d2a7426
|
||
Author: jmc@openbsd.org <jmc@openbsd.org>
|
||
Date: Mon Jun 22 06:37:38 2020 +0000
|
||
|
||
upstream: updated argument name for -P in first synopsis was
|
||
|
||
missed in previous;
|
||
|
||
OpenBSD-Commit-ID: 8d84dc3050469884ea91e29ee06a371713f2d0b7
|
||
|
||
commit 02a9222cbce7131d639984c2f6c71d1551fc3333
|
||
Author: jmc@openbsd.org <jmc@openbsd.org>
|
||
Date: Mon Jun 22 06:36:40 2020 +0000
|
||
|
||
upstream: supply word missing in previous;
|
||
|
||
OpenBSD-Commit-ID: 16a38b049f216108f66c8b699aa046063381bd23
|
||
|
||
commit 5098b3b6230852a80ac6cef5d53a785c789a5a56
|
||
Author: Damien Miller <djm@mindrot.org>
|
||
Date: Mon Jun 22 16:54:02 2020 +1000
|
||
|
||
missing files for webauthn/sshsig unit test
|
||
|
||
commit 354535ff79380237924ac8fdc98f8cdf83e67da6
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Mon Jun 22 06:00:06 2020 +0000
|
||
|
||
upstream: add support for verification of webauthn sshsig signature,
|
||
|
||
and example HTML/JS to generate webauthn signatures in SSH formats (also used
|
||
to generate the testdata/* for the test).
|
||
|
||
OpenBSD-Regress-ID: dc575be5bb1796fdf4b8aaee0ef52a6671a0f6fb
|
||
|
||
commit bb52e70fa5330070ec9a23069c311d9e277bbd6f
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Mon Jun 22 05:58:35 2020 +0000
|
||
|
||
upstream: Add support for FIDO webauthn (verification only).
|
||
|
||
webauthn is a standard for using FIDO keys in web browsers. webauthn
|
||
signatures are a slightly different format to plain FIDO signatures - this
|
||
support allows verification of these. Feedback and ok markus@
|
||
|
||
OpenBSD-Commit-ID: ab7e3a9fb5782d99d574f408614d833379e564ad
|
||
|
||
commit 64bc121097f377142f1387ffb2df7592c49935af
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Mon Jun 22 05:56:23 2020 +0000
|
||
|
||
upstream: refactor ECDSA-SK verification a little ahead of adding
|
||
|
||
support for FIDO webauthn signature verification support; ok markus@
|
||
|
||
OpenBSD-Commit-ID: c9f478fd8e0c1bd17e511ce8694f010d8e32043e
|
||
|
||
commit 12848191f8fe725af4485d3600e0842d92f8637f
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Mon Jun 22 05:54:10 2020 +0000
|
||
|
||
upstream: support for RFC4648 base64url encoding; ok markus
|
||
|
||
OpenBSD-Commit-ID: 0ef22c55e772dda05c112c88412c0797fec66eb4
|
||
|
||
commit 473b4af43db12127137c7fc1a10928313f5a16d2
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Mon Jun 22 05:53:26 2020 +0000
|
||
|
||
upstream: better terminology for permissions; feedback & ok markus@
|
||
|
||
OpenBSD-Commit-ID: ff2a71803b5ea57b83cc3fa9b3be42b70e462fb9
|
||
|
||
commit fc270baf264248c3ee3050b13a6c8c0919e6559f
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Mon Jun 22 05:52:05 2020 +0000
|
||
|
||
upstream: better terminology for permissions; feedback & ok markus@
|
||
|
||
OpenBSD-Commit-ID: ffb220b435610741dcb4de0e7fc68cbbdc876d2c
|
||
|
||
commit 00531bb42f1af17ddabea59c3d9c4b0629000d27
|
||
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
||
Date: Fri Jun 19 07:21:42 2020 +0000
|
||
|
||
upstream: Correct synopsis and usage for the options accepted when
|
||
|
||
passing a command to ssh-agent. ok jmc@
|
||
|
||
OpenBSD-Commit-ID: b36f0679cb0cac0e33b361051b3406ade82ea846
|
||
|
||
commit b4556c8ad7177e379f0b60305a0cd70f12180e7c
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Fri Jun 19 19:22:00 2020 +1000
|
||
|
||
Add OPENBSD ORIGINAL marker to bcrypt_pbkdf.
|
||
|
||
commit 1babb8bb14c423011ca34c2f563bb1c51c8fbf1d
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Fri Jun 19 19:10:47 2020 +1000
|
||
|
||
Extra brackets around sizeof() in bcrypt.
|
||
|
||
Prevents following warning from clang 10:
|
||
bcrypt_pbkdf.c:94:40: error: expression does not compute the number of
|
||
elements in this array; element type is ´uint32_tÂ[...]
|
||
place parentheses around the ´sizeof(uint64_t)´ expression to
|
||
silence this warning
|
||
|
||
commit 9e065729592633290e5ddb6852792913b2286545
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Fri Jun 19 18:47:56 2020 +1000
|
||
|
||
Add includes.h to new test.
|
||
|
||
Fixes warnings eg "´bounded´ attribute directive ignor" from gcc.
|
||
|
||
commit e684b1ea365e070433f282a3c1dabc3e2311ce49
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Fri Jun 19 18:38:39 2020 +1000
|
||
|
||
Skip OpenSSL specific tests w/out OpenSSL.
|
||
|
||
Allows unit tests to pass when configure'ed --without-openssl.
|
||
|
||
commit 80610e97a76407ca982e62fd051c9be03622fe7b
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Fri Jun 19 17:15:27 2020 +1000
|
||
|
||
Hook sshsig tests up to Portable Makefiles.
|
||
|
||
commit 5dba1fcabacaab46693338ec829b42a1293d1f52
|
||
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
||
Date: Fri Jun 19 05:07:09 2020 +0000
|
||
|
||
upstream: Test that ssh-agent exits when running as as subprocess
|
||
|
||
of a specified command (ie "ssh-agent command"). Would have caught bz#3181.
|
||
|
||
OpenBSD-Regress-ID: 895b4765ba5153eefaea3160a7fe08ac0b6db8b3
|
||
|
||
commit 68e8294f6b04f9590ea227e63d3e129398a49e27
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Fri Jun 19 04:34:21 2020 +0000
|
||
|
||
upstream: run sshsig unit tests
|
||
|
||
OpenBSD-Regress-ID: 706ef17e2b545b64873626e0e35553da7c06052a
|
||
|
||
commit 5edfa1690e9a75048971fd8775f7c16d153779db
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Fri Jun 19 04:32:09 2020 +0000
|
||
|
||
upstream: basic unit test for sshsig.[ch], including FIDO keys
|
||
|
||
verification only so far
|
||
|
||
OpenBSD-Regress-ID: fb1f946c8fc59206bc6a6666e577b5d5d7e45896
|
||
|
||
commit e95c0a0e964827722d29b4bc00d5c0ff4afe0ed2
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Fri Jun 19 03:48:49 2020 +0000
|
||
|
||
upstream: basic unit test for FIDO kep parsing
|
||
|
||
OpenBSD-Regress-ID: 8089b88393dd916d7c95422b442a6fd4cfe00c82
|
||
|
||
commit 7775819c6de3e9547ac57b87c7dd2bfd28cefcc5
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Thu Jun 18 23:34:19 2020 +0000
|
||
|
||
upstream: check public host key matches private; ok markus@ (as
|
||
|
||
part of previous diff)
|
||
|
||
OpenBSD-Commit-ID: 65a4f66436028748b59fb88b264cb8c94ce2ba63
|
||
|
||
commit c514f3c0522855b4d548286eaa113e209051a6d2
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Thu Jun 18 23:33:38 2020 +0000
|
||
|
||
upstream: avoid spurious "Unable to load host key" message when
|
||
|
||
sshd can load a private key but no public counterpart; with & ok markus@
|
||
|
||
OpenBSD-Commit-ID: 0713cbdf9aa1ff8ac7b1f78b09ac911af510f81b
|
||
|
||
commit 7fafaeb5da365f4a408fec355dac04a774f27193
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Fri Jun 12 05:26:37 2020 +0000
|
||
|
||
upstream: correct RFC number; from HARUYAMA Seigo via GH PR191
|
||
|
||
OpenBSD-Commit-ID: 8d03b6c96ca98bfbc23d3754c3c33e1fe0852e10
|
||
|
||
commit 3a7f654d5bcb20df24a134b6581b0d235da4564a
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Fri Jun 5 06:18:07 2020 +0000
|
||
|
||
upstream: unbreak "sshd -ddd" - close of config passing fd happened too
|
||
|
||
early. ok markus@
|
||
|
||
OpenBSD-Commit-ID: 49346e945c6447aca3e904e65fc400128d2f8ed0
|
||
|
||
commit 3de02be39e5c0c2208d9682a3844991651620fcc
|
||
Author: Andreas Schwab <schwab@suse.de>
|
||
Date: Mon May 25 11:10:44 2020 +0200
|
||
|
||
Add support for AUDIT_ARCH_RISCV64
|
||
|
||
commit ea547eb0329c2f8da77a4ac05f6c330bd49bdaab
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Fri Jun 5 03:25:35 2020 +0000
|
||
|
||
upstream: make sshbuf_putb(b, NULL) a no-op
|
||
|
||
OpenBSD-Commit-ID: 976fdc99b500e347023d430df372f31c1dd128f7
|
||
|
||
commit 69796297c812640415c6cea074ea61afc899cbaa
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Fri Jun 5 03:24:36 2020 +0000
|
||
|
||
upstream: make sshbuf_dump() args const
|
||
|
||
OpenBSD-Commit-ID: b4a5accae750875d665b862504169769bcf663bd
|
||
|
||
commit 670428895739d1f79894bdb2457891c3afa60a59
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Fri Jun 5 03:24:16 2020 +0000
|
||
|
||
upstream: wrap long line
|
||
|
||
OpenBSD-Commit-ID: ed405a12bd27bdc9c52e169bc5ff3529b4ebbbb2
|
||
|
||
commit 2f648cf222882719040906722b3593b01df4ad1a
|
||
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
||
Date: Fri Jun 5 03:15:26 2020 +0000
|
||
|
||
upstream: Correct historical comment: provos@ modified OpenSSH to
|
||
|
||
work with SSLeay (very quickly replaced by OpenSSL) not SSL in general. ok
|
||
deraadt, historical context markus@
|
||
|
||
OpenBSD-Commit-ID: 7209e07a2984b50411ed8ca5a4932da5030d2b90
|
||
|
||
commit 56548e4efcc3e3e8093c2eba30c75b23e561b172
|
||
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
||
Date: Wed Jun 3 08:23:18 2020 +0000
|
||
|
||
upstream: Import regenerated moduli file.
|
||
|
||
OpenBSD-Commit-ID: 52ff0e3205036147b2499889353ac082e505ea54
|
||
|
||
commit 8da801f585dd9c534c0cbe487a3b1648036bf2fb
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Fri Jun 5 13:20:10 2020 +1000
|
||
|
||
Test fallthrough in OSSH_CHECK_CFLAG_COMPILE.
|
||
|
||
clang 10's -Wimplicit-fallthrough does not understand /* FALLTHROUGH */
|
||
comments and we don't use the __attribute__((fallthrough)) that it's
|
||
looking for. This has the effect of turning off -Wimplicit-fallthrough
|
||
where it does not currently help (particularly with -Werror). ok djm@
|
||
|
||
commit 049297de975b92adcc2db77e3fb7046c0e3c695d
|
||
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
||
Date: Wed Jun 3 08:23:18 2020 +0000
|
||
|
||
upstream: Import regenerated moduli file.
|
||
|
||
OpenBSD-Commit-ID: 52ff0e3205036147b2499889353ac082e505ea54
|
||
|
||
commit b458423a38a3140ac022ffcffcb332609faccfe3
|
||
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
||
Date: Mon Jun 1 07:11:38 2020 +0000
|
||
|
||
upstream: Remove now-unused proto_spec and associated definitions.
|
||
|
||
ok djm@
|
||
|
||
OpenBSD-Commit-ID: 2e2b18e3aa6ee22a7b69c39f2d3bd679ec35c362
|
||
|
||
commit 5ad3c3a33ef038b55a14ebd31faeeec46073db2c
|
||
Author: millert@openbsd.org <millert@openbsd.org>
|
||
Date: Fri May 29 21:22:02 2020 +0000
|
||
|
||
upstream: Fix error message on close(2) and add printf format
|
||
|
||
attributes. From Christos Zoulas, OK markus@
|
||
|
||
OpenBSD-Commit-ID: 41523c999a9e3561fcc7082fd38ea2e0629ee07e
|
||
|
||
commit 712ac1efb687a945a89db6aa3e998c1a17b38653
|
||
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
||
Date: Fri May 29 11:17:56 2020 +0000
|
||
|
||
upstream: Make dollar_expand variadic and pass a real va_list to
|
||
|
||
vdollar_percent_expand. Fixes build error on arm64 spotted by otto@.
|
||
|
||
OpenBSD-Commit-ID: 181910d7ae489f40ad609b4cf4a20f3d068a7279
|
||
|
||
commit 837ffa9699a9cba47ae7921d2876afaccc027133
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Fri May 29 20:39:00 2020 +1000
|
||
|
||
Omit ToS setting if we don't have IPV6_TCLASS too.
|
||
|
||
Fixes tests on old BSDs.
|
||
|
||
commit f85b118d2150847cc333895296bc230e367be6b5
|
||
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
||
Date: Fri May 29 09:02:44 2020 +0000
|
||
|
||
upstream: Pass a NULL instead of zeroed out va_list from
|
||
|
||
dollar_expand. The original intent was in case there's some platform where
|
||
va_list is not a pointer equivalent, but on i386 this chokes on the memset.
|
||
This unbreaks that build, but will require further consideration.
|
||
|
||
OpenBSD-Commit-ID: 7b90afcd8e1137a1d863204060052aef415baaf7
|
||
|
||
commit ec1d50b01c84ff667240ed525f669454c4ebc8e9
|
||
Author: jmc@openbsd.org <jmc@openbsd.org>
|
||
Date: Fri May 29 05:48:39 2020 +0000
|
||
|
||
upstream: remove a stray .El;
|
||
|
||
OpenBSD-Commit-ID: 58ddfe6f8a15fe10209db6664ecbe7896f1d167c
|
||
|
||
commit 058674a62ffe33f01d871d46e624bc2a2c22d91f
|
||
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
||
Date: Fri May 29 04:32:26 2020 +0000
|
||
|
||
upstream: Add regression and unit tests for ${ENV} style
|
||
|
||
environment variable expansion in various keywords (bz#3140). ok djm@
|
||
|
||
OpenBSD-Regress-ID: 4d9ceb95d89365b7b674bc26cf064c15a5bbb197
|
||
|
||
commit 0b15892fc47d6840eba1291a6be9be1a70bc8972
|
||
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
||
Date: Fri May 29 01:21:35 2020 +0000
|
||
|
||
upstream: Unit test for convtime. ok djm@
|
||
|
||
OpenBSD-Regress-ID: cec4239efa2fc4c7062064f07a847e1cbdbcd5dd
|
||
|
||
commit 188e332d1c8f9f24e5b6659e9680bf083f837df9
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Fri May 29 05:37:03 2020 +0000
|
||
|
||
upstream: mention that wildcards are processed in lexical order;
|
||
|
||
bz#3165
|
||
|
||
OpenBSD-Commit-ID: 8856f3d1612bd42e9ee606d89386cae456dd165c
|
||
|
||
commit 4a1b46e6d032608b7ec00ae51c4e25b82f460b05
|
||
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
||
Date: Fri May 29 04:25:40 2020 +0000
|
||
|
||
upstream: Allow some keywords to expand shell-style ${ENV}
|
||
|
||
environment variables on the client side. The supported keywords are
|
||
CertificateFile, ControlPath, IdentityAgent and IdentityFile, plus
|
||
LocalForward and RemoteForward when used for Unix domain socket paths. This
|
||
would for example allow forwarding of Unix domain socket paths that change at
|
||
runtime. bz#3140, ok djm@
|
||
|
||
OpenBSD-Commit-ID: a4a2e801fc2d4df2fe0e58f50d9c81b03822dffa
|
||
|
||
commit c9bab1d3a9e183cef3a3412f57880a0374cc8cb2
|
||
Author: Damien Miller <djm@mindrot.org>
|
||
Date: Fri May 29 14:49:16 2020 +1000
|
||
|
||
depend
|
||
|
||
commit 0b0d219313bf9239ca043f20b1a095db0245588f
|
||
Author: sobrado <sobrado@openbsd.org>
|
||
Date: Thu Sep 3 23:06:28 2015 +0000
|
||
|
||
partial sync of regress/netcat.c with upstream
|
||
|
||
synchronize synopsis and usage.
|
||
|
||
commit 0f04c8467f589f85a523e19fd684c4f6c4ed9482
|
||
Author: chl <chl@openbsd.org>
|
||
Date: Sun Jul 26 19:12:28 2015 +0000
|
||
|
||
partial sync of regress/netcat.c with upstream
|
||
|
||
remove unused variable
|
||
|
||
ok tedu@
|
||
|
||
commit d6a81050ace2630b06c3c6dd39bb4eef5d1043f8
|
||
Author: tobias <tobias@openbsd.org>
|
||
Date: Thu Mar 26 21:22:50 2015 +0000
|
||
|
||
partial sync of regress/netcat.c with upstream
|
||
|
||
The code in socks.c writes multiple times in a row to a socket. If the socket becomes invalid between these calls (e.g. connection closed), write will throw SIGPIPE. With this patch, SIGPIPE is ignored so we can handle write's -1 return value (errno will be EPIPE). Ultimately, it leads to program exit, too -- but with nicer error message. :)
|
||
|
||
with input by and ok djm
|
||
|
||
commit bf3893dddd35e16def04bf48ed2ee1ad695b8f82
|
||
Author: tobias <tobias@openbsd.org>
|
||
Date: Thu Mar 26 10:36:03 2015 +0000
|
||
|
||
partial sync of regress/netcat.c with upstream
|
||
|
||
Check for short writes in fdpass(). Clean up while at it.
|
||
|
||
ok djm
|
||
|
||
commit e18435fec124b4c08eb6bbbbee9693dc04f4befb
|
||
Author: jca <jca@openbsd.org>
|
||
Date: Sat Feb 14 22:40:22 2015 +0000
|
||
|
||
partial sync of regress/netcat.c with upstream
|
||
|
||
Support for nc -T on IPv6 addresses.
|
||
|
||
ok sthen@
|
||
|
||
commit 4c607244054a036ad3b2449a6cb4c15feb846a76
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Fri May 29 03:14:02 2020 +0000
|
||
|
||
upstream: fix compilation on !HAVE_DLOPEN platforms; stub function
|
||
|
||
was not updated to match API change. From Dale Rahn via beck@ ok markus@
|
||
|
||
OpenBSD-Commit-ID: 2b8d054afe34c9ac85e417dae702ef981917b836
|
||
|
||
commit 224418cf55611869a4ace1b8b07bba0dff77a9c3
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Fri May 29 03:11:54 2020 +0000
|
||
|
||
upstream: fix exit status for downloading of FIDO resident keys;
|
||
|
||
from Pedro Martelletto, ok markus@
|
||
|
||
OpenBSD-Commit-ID: 0da77dc24a1084798eedd83c39a002a9d231faef
|
||
|
||
commit 1001dd148ed7c57bccf56afb40cb77482ea343a6
|
||
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
||
Date: Fri May 29 01:20:46 2020 +0000
|
||
|
||
upstream: Fix multiplier in convtime when handling seconds after
|
||
|
||
other units. bz#3171, spotted by ronf at timeheart.net, ok djm@.
|
||
|
||
OpenBSD-Commit-ID: 95b7a848e1083974a65fbb6ccb381d438e1dd5be
|
||
|
||
commit 7af1e92cd289b7eaa9a683e9a6f2fddd98f37a01
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Wed May 27 22:37:53 2020 +0000
|
||
|
||
upstream: fix Include before Match in sshd_config; bz#3122 patch
|
||
|
||
from Jakub Jelen
|
||
|
||
OpenBSD-Commit-ID: 1b0aaf135fe6732b5d326946042665dd3beba5f4
|
||
|
||
commit 0a9a611619b0a1fecd0195ec86a9885f5d681c84
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Wed May 27 21:59:11 2020 +0000
|
||
|
||
upstream: Do not call process_queued_listen_addrs() for every
|
||
|
||
included file from sshd_config; patch from Jakub Jelen
|
||
|
||
OpenBSD-Commit-ID: 0ff603d6f06a7fab4881f12503b53024799d0a49
|
||
|
||
commit 16ea1fdbe736648f79a827219134331f8d9844fb
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Wed May 27 21:25:18 2020 +0000
|
||
|
||
upstream: fix crash in recallocarray when deleting SendEnv
|
||
|
||
variables; spotted by & ok sthen@
|
||
|
||
OpenBSD-Commit-ID: b881e8e849edeec5082b5c0a87d8d7cff091a8fd
|
||
|
||
commit 47adfdc07f4f8ea0064a1495500244de08d311ed
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Wed May 27 22:35:19 2020 +0000
|
||
|
||
upstream: two new tests for Include in sshd_config, checking whether
|
||
|
||
Port directives are processed correctly and handling of Include directives
|
||
that appear before Match. Both tests currently fail. bz#3122 and bz#3169 -
|
||
patch from Jakub Jelen
|
||
|
||
OpenBSD-Regress-ID: 8ad5a4a385a63f0a1c59c59c763ff029b45715df
|
||
|
||
commit 47faad8f794516c33864d866aa1b55d88416f94c
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Wed May 27 23:26:23 2020 +1000
|
||
|
||
Document that libfido2 >= 1.4.0 is needed.
|
||
|
||
commit 4be563994c0cbe9856e7dd3078909f41beae4a9c
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Tue May 26 01:59:46 2020 +0000
|
||
|
||
upstream: fix memleak of signature; from Pedro Martelletto
|
||
|
||
OpenBSD-Commit-ID: d0a6eb07e77c001427d738b220dd024ddc64b2bb
|
||
|
||
commit 0c111eb84efba7c2a38b2cc3278901a0123161b9
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Tue May 26 01:26:58 2020 +0000
|
||
|
||
upstream: Restrict ssh-agent from signing web challenges for FIDO
|
||
|
||
keys.
|
||
|
||
When signing messages in ssh-agent using a FIDO key that has an
|
||
application string that does not start with "ssh:", ensure that the
|
||
message being signed is one of the forms expected for the SSH protocol
|
||
(currently pubkey authentication and sshsig signatures).
|
||
|
||
This prevents ssh-agent forwarding on a host that has FIDO keys
|
||
attached granting the ability for the remote side to sign challenges
|
||
for web authentication using those keys too.
|
||
|
||
Note that the converse case of web browsers signing SSH challenges is
|
||
already precluded because no web RP can have the "ssh:" prefix in the
|
||
application string that we require.
|
||
|
||
ok markus@
|
||
|
||
OpenBSD-Commit-ID: 9ab6012574ed0352d2f097d307f4a988222d1b19
|
||
|
||
commit 9c5f64b6cb3a68b99915202d318b842c6c76cf14
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Tue May 26 01:09:05 2020 +0000
|
||
|
||
upstream: improve logging for MaxStartups connection throttling:
|
||
|
||
have sshd log when it starts and stops throttling and periodically while in
|
||
this state. bz#3055 ok markus@
|
||
|
||
OpenBSD-Commit-ID: 2e07a09a62ab45d790d3d2d714f8cc09a9ac7ab9
|
||
|
||
commit 756c6f66aee83a5862a6f936a316f761532f3320
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Tue May 26 01:06:52 2020 +0000
|
||
|
||
upstream: add fmt_timeframe() (from bgpd) to format a time
|
||
|
||
interval in a human- friendly format. Switch copyright for this file from BSD
|
||
to MIT to make it easier to add Henning's copyright for this function. ok
|
||
markus@
|
||
|
||
OpenBSD-Commit-ID: 414a831c662df7e68893e5233e86f2cac081ccf9
|
||
|
||
commit 2a63ce5cd6d0e782783bf721462239b03757dd49
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Mon May 18 04:29:35 2020 +0000
|
||
|
||
upstream: avoid possible NULL deref; from Pedro Martelletto
|
||
|
||
OpenBSD-Commit-ID: e6099c3fbb70aa67eb106e84d8b43f1fa919b721
|
||
|
||
commit 4b307faf2fb0e63e51a550b37652f7f972df9676
|
||
Author: markus@openbsd.org <markus@openbsd.org>
|
||
Date: Fri May 15 08:34:03 2020 +0000
|
||
|
||
upstream: sshd listener must not block if reexecd sshd exits
|
||
|
||
in write(2) on config_s[0] if the forked child exits early before finishing
|
||
recv_rexec_state (e.g. with fatal()) because config_s[1] stays open in the
|
||
parent. this prevents the parent from accepting new connections. ok djm,
|
||
deraadt
|
||
|
||
OpenBSD-Commit-ID: 92ccfeb939ccd55bda914dc3fe84582158c4a9ef
|
||
|
||
commit af8b16fb2cce880341c0ee570ceb0d84104bdcc0
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Fri May 15 03:57:33 2020 +0000
|
||
|
||
upstream: fix off-by-one error that caused sftp downloads to make
|
||
|
||
one more concurrent request that desired. This prevented using sftp(1) in
|
||
unpipelined request/response mode, which is useful when debugging. Patch from
|
||
Stephen Goetze in bz#3054
|
||
|
||
OpenBSD-Commit-ID: 41b394ebe57037dbc43bdd0eef21ff0511191f28
|
||
|
||
commit d7d753e2979f2d3c904b03a08d30856cd2a6e892
|
||
Author: deraadt@openbsd.org <deraadt@openbsd.org>
|
||
Date: Wed May 13 22:38:41 2020 +0000
|
||
|
||
upstream: we are still aiming for pre-C99 ...
|
||
|
||
OpenBSD-Commit-ID: a240fc9cbe60bc4e6c3d24d022eb4ab01fe1cb38
|
||
|
||
commit 2ad7b7e46408dbebf2a4efc4efd75a9544197d57
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Wed May 13 10:08:02 2020 +0000
|
||
|
||
upstream: Enable credProtect extension when generating a resident
|
||
|
||
key.
|
||
|
||
The FIDO 2.1 Client to Authenticator Protocol introduced a "credProtect"
|
||
feature to better protect resident keys. This option allows (amone other
|
||
possibilities) requiring a PIN prior to all operations that may retrieve
|
||
the key handle.
|
||
|
||
Patch by Pedro Martelletto; ok djm and markus
|
||
|
||
OpenBSD-Commit-ID: 013bc06a577dcaa66be3913b7f183eb8cad87e73
|
||
|
||
commit 1e70dc3285fc9b4f6454975acb81e8702c23dd89
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Wed May 13 09:57:17 2020 +0000
|
||
|
||
upstream: always call fido_init(); previous behaviour only called
|
||
|
||
fido_init() when SK_DEBUG was defined. Harmless with current libfido2, but
|
||
this isn't guaranteed in the future.
|
||
|
||
OpenBSD-Commit-ID: c7ea20ff2bcd98dd12015d748d3672d4f01f0864
|
||
|
||
commit f2d84f1b3fa68d77c99238d4c645d0266fae2a74
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Wed May 13 09:55:57 2020 +0000
|
||
|
||
upstream: preserve group/world read permission on known_hosts
|
||
|
||
file across runs of "ssh-keygen -Rf /path". The old behaviour was to remove
|
||
all rights for group/other. bz#3146 ok dtucker@
|
||
|
||
OpenBSD-Commit-ID: dc369d0e0b5dd826430c63fd5f4b269953448a8a
|
||
|
||
commit 05a651400da6fbe12296c34e3d3bcf09f034fbbf
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Wed May 13 09:52:41 2020 +0000
|
||
|
||
upstream: when ordering the hostkey algorithms to request from a
|
||
|
||
server, prefer certificate types if the known_hosts files contain a key
|
||
marked as a @cert-authority; bz#3157 ok markus@
|
||
|
||
OpenBSD-Commit-ID: 8f194573e5bb7c01b69bbfaabc68f27c9fa5e0db
|
||
|
||
commit 829451815ec207e14bd54ff5cf7e22046816f042
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Tue May 12 01:41:32 2020 +0000
|
||
|
||
upstream: fix non-ASCII quote that snuck in; spotted by Gabriel
|
||
|
||
Kihlman
|
||
|
||
OpenBSD-Commit-ID: 04bcde311de2325d9e45730c744c8de079b49800
|
||
|
||
commit 5a442cec92c0efd6fffb4af84bf99c70af248ef3
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Mon May 11 02:11:29 2020 +0000
|
||
|
||
upstream: clarify role of FIDO tokens in multi-factor
|
||
|
||
authentictation; mostly from Pedro Martelletto
|
||
|
||
OpenBSD-Commit-ID: fbe05685a1f99c74b1baca7130c5a03c2df7c0ac
|
||
|
||
commit ecb2c02d994b3e21994f31a70ff911667c262f1f
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Fri May 8 05:13:14 2020 +0000
|
||
|
||
upstream: fix compilation with DEBUG_KEXDH; bz#3160 ok dtucker@
|
||
|
||
OpenBSD-Commit-ID: 832e771948fb45f2270e8b8895aac36d176ba17a
|
||
|
||
commit 3ab6fccc3935e9b778ff52f9c8d40f215d58e01d
|
||
Author: Damien Miller <djm@mindrot.org>
|
||
Date: Thu May 14 12:22:09 2020 +1000
|
||
|
||
prefer ln to cp for temporary copy of sshd
|
||
|
||
I saw failures on the reexec fallback test on Darwin 19.4 where
|
||
fork()ed children of a process that had it's executable removed
|
||
would instantly fail. Using ln to preserve the inode avoids this.
|
||
|
||
commit f700d316c6b15a9cfbe87230d2dca81a5d916279
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Wed May 13 15:24:51 2020 +1000
|
||
|
||
Actually skip pty tests when needed.
|
||
|
||
commit 08ce6b2210f46f795e7db747809f8e587429dfd2
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Wed May 13 13:56:45 2020 +1000
|
||
|
||
Skip building sk-dummy library if no SK support.
|
||
|
||
commit 102d106bc2e50347d0e545fad6ff5ce408d67247
|
||
Author: Damien Miller <djm@mindrot.org>
|
||
Date: Wed May 13 12:08:34 2020 +1000
|
||
|
||
explicitly manage .depend and .depend.bak
|
||
|
||
Bring back removal of .depend to give the file a known state before
|
||
running makedepend, but manually move aside the current .depend file
|
||
and restore it as .depend.bak afterwards so the stale .depend check
|
||
works as expected.
|
||
|
||
commit 83a6dc6ba1e03b3fa39d12a8522b8b0e68dd6390
|
||
Author: Damien Miller <djm@mindrot.org>
|
||
Date: Wed May 13 12:03:42 2020 +1000
|
||
|
||
make depend
|
||
|
||
commit 7c0bbed967abed6301a63e0267cc64144357a99a
|
||
Author: Damien Miller <djm@mindrot.org>
|
||
Date: Wed May 13 12:01:10 2020 +1000
|
||
|
||
revert removal of .depend before makedepend
|
||
|
||
Commit 83657eac4 started removing .depend before running makedepend
|
||
to reset the contents of .depend to a known state. Unfortunately
|
||
this broke the depend-check step as now .depend.bak would only ever
|
||
be created as an empty file.
|
||
|
||
ok dtucker
|
||
|
||
commit 58ad004acdcabf3b9f40bc3aaa206b25d998db8c
|
||
Author: Damien Miller <djm@mindrot.org>
|
||
Date: Tue May 12 12:58:46 2020 +1000
|
||
|
||
prepare for 8.3 release
|
||
|
||
commit 4fa9e048c2af26beb7dc2ee9479ff3323e92a7b5
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Fri May 8 21:50:43 2020 +1000
|
||
|
||
Ensure SA_SIGNAL test only signals itself.
|
||
|
||
When the test's child signals its parent and it exits the result of
|
||
getppid changes. On Ubuntu 20.04 this results in the ppid being that
|
||
of the GDM session, causing it to exit. Analysis and testing from pedro
|
||
at ambientworks.net
|
||
|
||
commit dc2da29aae76e170d22f38bb36f1f5d1edd5ec2b
|
||
Author: Damien Miller <djm@mindrot.org>
|
||
Date: Fri May 8 13:31:53 2020 +1000
|
||
|
||
sync config.guess/config.sub with latest versions
|
||
|
||
ok dtucker@
|
||
|
||
commit a8265bd64c14881fc7f4fa592f46dfc66b911f17
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Wed May 6 20:58:01 2020 +0000
|
||
|
||
upstream: openssh-8.3; ok deraadt@
|
||
|
||
OpenBSD-Commit-ID: c8831ec88b9c750f5816aed9051031fb535d22c1
|
||
|
||
commit 955854cafca88e0cdcd3d09ca1ad4ada465364a1
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Wed May 6 20:57:38 2020 +0000
|
||
|
||
upstream: another case where a utimes() failure could make scp send
|
||
|
||
a desynchronising error; reminded by Aymeric Vincent ok deraadt markus
|
||
|
||
OpenBSD-Commit-ID: 2ea611d34d8ff6d703a7a8bf858aa5dbfbfa7381
|
||
|
||
commit 59d531553fd90196946743da391f3a27cf472f4e
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Thu May 7 15:34:12 2020 +1000
|
||
|
||
Check if -D_REENTRANT is needed for localtime_r.
|
||
|
||
On at least HP-UX 11.11, the localtime_r declararation is behind
|
||
ifdef _REENTRANT. Check for and add if needed.
|
||
|
||
commit c13403e55de8cdbb9da628ed95017b1d4c0f205f
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Tue May 5 11:32:43 2020 +1000
|
||
|
||
Skip security key tests if ENABLE_SK not set.
|
||
|
||
commit 4da393f87cd52d788c84112ee3f2191c9bcaaf30
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Fri May 1 04:03:14 2020 +0000
|
||
|
||
upstream: sure enough, some of the test data that we though were in
|
||
|
||
new format were actually in the old format; fix from Michael Forney
|
||
|
||
OpenBSD-Regress-ID: a41a5c43a61b0f0b1691994dbf16dfb88e8af933
|
||
|
||
commit 15bfafc1db4c8792265ada9623a96f387990f732
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Fri May 1 04:00:29 2020 +0000
|
||
|
||
upstream: make mktestdata.sh generate old/new format keys that we
|
||
|
||
expect. This script was written before OpenSSH switched to new-format private
|
||
keys by default and was never updated to the change (until now) From Michael
|
||
Forney
|
||
|
||
OpenBSD-Regress-ID: 38cf354715c96852e5b71c2393fb6e7ad28b7ca7
|
||
|
||
commit 7882d2eda6ad3eb82220a85294de545d20ef82db
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Fri May 1 03:58:02 2020 +0000
|
||
|
||
upstream: portability fix for sed that always emil a newline even
|
||
|
||
if the input does not contain one; from Michael Forney
|
||
|
||
OpenBSD-Regress-ID: 9190c3ddf0d2562ccc02c4a95fce0e392196bfc7
|
||
|
||
commit 8074f9499e454df0acdacea33598858a1453a357
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Fri May 1 03:36:25 2020 +0000
|
||
|
||
upstream: remove obsolete RSA1 test keys; spotted by Michael Forney
|
||
|
||
OpenBSD-Regress-ID: 6384ba889594e217d166908ed8253718ab0866da
|
||
|
||
commit c697e46c314aa94574af0d393d80f23e0ebc9748
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Sat May 2 18:34:47 2020 +1000
|
||
|
||
Update .depend.
|
||
|
||
commit 83657eac42941f270c4b02b2c46d9a21f616ef99
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Sat May 2 18:29:40 2020 +1000
|
||
|
||
Remove use of tail for 'make depend'.
|
||
|
||
Not every tail supports +N and we can do with out it so just remove it.
|
||
Prompted by mforney at mforney.org.
|
||
|
||
commit d25d630d24c5a1c64d4e646510e79dc22d6d7b88
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Sat May 2 07:19:43 2020 +0000
|
||
|
||
upstream: we have a sshkey_save_public() function to save public keys;
|
||
|
||
use it and save a bunch of redundant code.
|
||
|
||
Patch from loic AT venez.fr; ok markus@ djm@
|
||
|
||
OpenBSD-Commit-ID: f93e030a0ebcd0fd9054ab30db501ec63454ea5f
|
||
|
||
commit e9dc9863723e111ae05e353d69df857f0169544a
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Fri May 1 18:32:25 2020 +1000
|
||
|
||
Use LONG_LONG_MAX and friends if available.
|
||
|
||
If we don't have LLONG_{MIN,MAX} but do have LONG_LONG_{MIN,MAX}
|
||
then use those instead. We do calculate these values in configure,
|
||
but it turns out that at least one compiler (old HP ANSI C) can't
|
||
parse "-9223372036854775808LL" without mangling it. (It can parse
|
||
"-9223372036854775807LL" which is presumably why its limits.h defines
|
||
LONG_LONG_MIN as the latter minus 1.)
|
||
|
||
Fixes rekey test when compiled with the aforementioned compiler.
|
||
|
||
commit aad87b88fc2536b1ea023213729aaf4eaabe1894
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Fri May 1 06:31:42 2020 +0000
|
||
|
||
upstream: when receving a file in sink(), be careful to send at
|
||
|
||
most a single error response after the file has been opened. Otherwise the
|
||
source() and sink() can become desyncronised. Reported by Daniel Goujot,
|
||
Georges-Axel Jaloyan, Ryan Lahfa, and David Naccache.
|
||
|
||
ok deraadt@ markus@
|
||
|
||
OpenBSD-Commit-ID: 6c14d233c97349cb811a8f7921ded3ae7d9e0035
|
||
|
||
commit 31909696c4620c431dd55f6cd15db65c4e9b98da
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Fri May 1 06:28:52 2020 +0000
|
||
|
||
upstream: expose vasnmprintf(); ok (as part of other commit) markus
|
||
|
||
deraadt
|
||
|
||
OpenBSD-Commit-ID: 2e80cea441c599631a870fd40307d2ade5a7f9b5
|
||
|
||
commit 99ce9cefbe532ae979744c6d956b49f4b02aff82
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Fri May 1 04:23:11 2020 +0000
|
||
|
||
upstream: avoid NULL dereference when attempting to convert invalid
|
||
|
||
ssh.com private keys using "ssh-keygen -i"; spotted by Michael Forney
|
||
|
||
OpenBSD-Commit-ID: 2e56e6d26973967d11d13f56ea67145f435bf298
|
||
|
||
commit 6c6072ba8b079e6f5caa38b011a6f4570c14ed38
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Fri May 1 15:09:26 2020 +1000
|
||
|
||
See if SA_RESTART signals will interrupt select().
|
||
|
||
On some platforms (at least older HP-UXes such as 11.11, possibly others)
|
||
setting SA_RESTART on signal handers will cause it to not interrupt
|
||
select(), at least for calls that do not specify a timeout. Try to
|
||
detect this and if found, don't use SA_RESTART.
|
||
|
||
POSIX says "If SA_RESTART has been set for the interrupting signal, it
|
||
is implementation-dependent whether select() restarts or returns with
|
||
[EINTR]" so this behaviour is within spec.
|
||
|
||
commit 90a0b434ed41f9c505662dba8782591818599cb3
|
||
Author: Damien Miller <djm@mindrot.org>
|
||
Date: Fri May 1 13:55:03 2020 +1000
|
||
|
||
fix reversed test
|
||
|
||
commit c0dfd18dd1c2107c73d18f70cd164f7ebd434b08
|
||
Author: Damien Miller <djm@mindrot.org>
|
||
Date: Fri May 1 13:29:16 2020 +1000
|
||
|
||
wrap sha2.h inclusion in #ifdef HAVE_SHA2_H
|
||
|
||
commit a01817a9f63dbcbbc6293aacc4019993a4cdc7e3
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Tue Apr 28 04:59:29 2020 +0000
|
||
|
||
upstream: adapt dummy FIDO middleware to API change; ok markus@
|
||
|
||
OpenBSD-Regress-ID: 8bb84ee500c2eaa5616044314dd0247709a1790f
|
||
|
||
commit 261571ddf02ea38fdb5e4a97c69ee53f847ca5b7
|
||
Author: jmc@openbsd.org <jmc@openbsd.org>
|
||
Date: Thu Apr 30 18:28:37 2020 +0000
|
||
|
||
upstream: tweak previous; ok markus
|
||
|
||
OpenBSD-Commit-ID: 41895450ce2294ec44a5713134491cc31f0c09fd
|
||
|
||
commit 5de21c82e1d806d3e401b5338371e354b2e0a66f
|
||
Author: markus@openbsd.org <markus@openbsd.org>
|
||
Date: Thu Apr 30 17:12:20 2020 +0000
|
||
|
||
upstream: bring back debug() removed in rev 1.74; noted by pradeep
|
||
|
||
kumar
|
||
|
||
OpenBSD-Commit-ID: 8d134d22ab25979078a3b48d058557d49c402e65
|
||
|
||
commit ea14103ce9a5e13492e805f7e9277516ff5a4273
|
||
Author: markus@openbsd.org <markus@openbsd.org>
|
||
Date: Thu Apr 30 17:07:10 2020 +0000
|
||
|
||
upstream: run the 2nd ssh with BatchMode for scp -3
|
||
|
||
OpenBSD-Commit-ID: 77994fc8c7ca02d88e6d0d06d0f0fe842a935748
|
||
|
||
commit 59d2de956ed29aa5565ed5e5947a7abdb27ac013
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Tue Apr 28 04:02:29 2020 +0000
|
||
|
||
upstream: when signing a challenge using a FIDO toke, perform the
|
||
|
||
hashing in the middleware layer rather than in ssh code. This allows
|
||
middlewares that call APIs that perform the hashing implicitly (including
|
||
Microsoft's AFAIK). ok markus@
|
||
|
||
OpenBSD-Commit-ID: c9fc8630aba26c75d5016884932f08a5a237f37d
|
||
|
||
commit c9d10dbc0ccfb1c7568bbb784f7aeb7a0b5ded12
|
||
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
||
Date: Sun Apr 26 09:38:14 2020 +0000
|
||
|
||
upstream: Fix comment typo. Patch from mforney at mforney.org.
|
||
|
||
OpenBSD-Commit-ID: 3565f056003707a5e678e60e03f7a3efd0464a2b
|
||
|
||
commit 4d2c87b4d1bde019cdd0f00552fcf97dd8b39940
|
||
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
||
Date: Sat Apr 25 06:59:36 2020 +0000
|
||
|
||
upstream: We've standardized on memset over bzero, replace a couple
|
||
|
||
that had slipped in. ok deraadt markus djm.
|
||
|
||
OpenBSD-Commit-ID: f5be055554ee93e6cc66b0053b590bef3728dbd6
|
||
|
||
commit 7f23f42123d64272a7b00754afa6b0841d676691
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Fri May 1 12:21:58 2020 +1000
|
||
|
||
Include sys/byteorder.h for htons and friends.
|
||
|
||
These are usually in netinet/in.h but on HP-UX they are not defined if
|
||
_XOPEN_SOURCE_EXTENDED is set. Only needed for netcat in the regression
|
||
tests.
|
||
|
||
commit d27cba58c972d101a5de976777e518f34ac779cb
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Fri May 1 09:21:52 2020 +1000
|
||
|
||
Fix conditional for openssl-based chacha20.
|
||
|
||
Fixes warnings or link errors when building against older OpenSSLs.
|
||
ok djm
|
||
|
||
commit 20819b962dc1467cd6fad5486a7020c850efdbee
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Fri Apr 24 15:07:55 2020 +1000
|
||
|
||
Error out if given RDomain if unsupported.
|
||
|
||
If the config contained 'RDomain %D' on a platform that did not support
|
||
it, the error would not be detected until runtime resulting in a broken
|
||
sshd. Detect this earlier and error out if found. bz#3126, based on a
|
||
patch from jjelen at redhat.com, tweaks and ok djm@
|
||
|
||
commit 2c1690115a585c624eed2435075a93a463a894e2
|
||
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
||
Date: Fri Apr 24 03:33:21 2020 +0000
|
||
|
||
upstream: Fix incorrect error message for "too many known hosts files."
|
||
|
||
bz#3149, patch from jjelen at redhat.com.
|
||
|
||
OpenBSD-Commit-ID: e0fcb07ed5cf7fd54ce340471a747c24454235e5
|
||
|
||
commit 3beb7276e7a8aedd3d4a49f9c03b97f643448c92
|
||
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
||
Date: Fri Apr 24 02:19:40 2020 +0000
|
||
|
||
upstream: Remove leave_non_blocking() which is now dead code
|
||
|
||
because nothing sets in_non_blocking_mode any more. Patch from
|
||
michaael.meeks at collabora.com, ok djm@
|
||
|
||
OpenBSD-Commit-ID: c403cefe97a5a99eca816e19cc849cdf926bd09c
|
||
|
||
commit 8654e3561772f0656e7663a0bd6a1a8cb6d43300
|
||
Author: jmc@openbsd.org <jmc@openbsd.org>
|
||
Date: Thu Apr 23 21:28:09 2020 +0000
|
||
|
||
upstream: ce examples of "Ar arg Ar arg" with "Ar arg arg" and
|
||
|
||
stop the spread;
|
||
|
||
OpenBSD-Commit-ID: af0e952ea0f5e2019c2ce953ed1796eca47f0705
|
||
|
||
commit 67697e4a8246dd8423e44b8785f3ee31fee72d07
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Fri Apr 24 11:10:18 2020 +1000
|
||
|
||
Update .depend.
|
||
|
||
commit d6cc76176216fe3fac16cd20d148d75cb9c50876
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Wed Apr 22 14:07:00 2020 +1000
|
||
|
||
Mailing list is now closed to non-subscribers.
|
||
|
||
While there, add a reference to the bugzilla. ok djm@
|
||
|
||
commit cecde6a41689d0ae585ec903b190755613a6de79
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Wed Apr 22 12:09:40 2020 +1000
|
||
|
||
Put the values from env vars back.
|
||
|
||
This merges the values from the recently removed environment into make's
|
||
command line arguments since we actually need those.
|
||
|
||
commit 300c4322b92e98d3346efa0aec1c094c94d0f964
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Wed Apr 22 11:33:15 2020 +1000
|
||
|
||
Pass configure's egrep through to test-exec.sh.
|
||
|
||
Use it to create a wrapper function to call it from tests. Fixes the
|
||
keygen-comment test on platforms with impoverished default egrep (eg
|
||
Solaris).
|
||
|
||
commit c8d9796cfe046f00eb8b2096d2b7028d6a523a84
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Wed Apr 22 10:56:44 2020 +1000
|
||
|
||
Remove unneeded env vars from t-exec invocation.
|
||
|
||
commit 01d4cdcd4514e99a4b6eb9523cd832bbf008d1d7
|
||
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
||
Date: Tue Apr 21 23:14:58 2020 +0000
|
||
|
||
upstream: Backslash '$' at then end of string. Prevents warning on
|
||
|
||
some shells.
|
||
|
||
OpenBSD-Regress-ID: 5dc27ab624c09d34078fd326b10e38c1ce9c741f
|
||
|
||
commit 8854724ccefc1fa16f10b37eda2e759c98148caa
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Tue Apr 21 18:27:23 2020 +1000
|
||
|
||
Sync rev 1.49.
|
||
|
||
Prevent infinite for loop since i went from ssize_t to size_t. Patch from
|
||
eagleoflqj via OpenSSH github PR#178, ok djm@, feedback & ok millert@
|
||
|
||
commit d00d07b6744d3b4bb7aca46c734ecd670148da23
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Mon Apr 20 04:44:47 2020 +0000
|
||
|
||
upstream: regression test for printing of private key fingerprints and
|
||
|
||
key comments, mostly by loic AT venez.fr (slightly tweaked for portability)
|
||
ok dtucker@
|
||
|
||
OpenBSD-Regress-ID: 8dc6c4feaf4fe58b6d634cd89afac9a13fd19004
|
||
|
||
commit a98d5ba31e5e7e01317352f85fa63b846a960f8c
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Mon Apr 20 04:43:57 2020 +0000
|
||
|
||
upstream: fix a bug I introduced in r1.406: when printing private key
|
||
|
||
fingerprint of old-format key, key comments were not being displayed. Spotted
|
||
by loic AT venez.fr, ok dtucker
|
||
|
||
OpenBSD-Commit-ID: 2d98e4f9eb168eea733d17e141e1ead9fe26e533
|
||
|
||
commit 32f2d0aad42c15e19bd3b07496076ca891573a58
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Fri Apr 17 07:16:07 2020 +0000
|
||
|
||
upstream: repair private key fingerprint printing to also print
|
||
|
||
comment after regression caused by my recent pubkey loading refactor.
|
||
Reported by loic AT venez.fr, ok dtucker@
|
||
|
||
OpenBSD-Commit-ID: f8db49acbee6a6ccb2a4259135693b3cceedb89e
|
||
|
||
commit 094dd513f4b42e6a3cebefd18d1837eb709b4d99
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Fri Apr 17 07:15:11 2020 +0000
|
||
|
||
upstream: refactor out some duplicate private key loading code;
|
||
|
||
based on patch from loic AT venez.fr, ok dtucker@
|
||
|
||
OpenBSD-Commit-ID: 5eff2476b0d8d0614924c55e350fb7bb9c84f45e
|
||
|
||
commit 4e04f46f248f1708e39b900b76c9693c820eff68
|
||
Author: jmc@openbsd.org <jmc@openbsd.org>
|
||
Date: Fri Apr 17 06:12:41 2020 +0000
|
||
|
||
upstream: add space beteen macro arg and punctuation;
|
||
|
||
OpenBSD-Commit-ID: c93a6cbb4bf9468fc4c13e64bc1fd4efee201a44
|
||
|
||
commit 44ae009a0112081d0d541aeaa90088bedb6f21ce
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Fri Apr 17 04:27:03 2020 +0000
|
||
|
||
upstream: auth2-pubkey r1.89 changed the order of operations to
|
||
|
||
checking AuthorizedKeysFile first and falling back to AuthorizedKeysCommand
|
||
if no key was found in a file. Document this order here; bz3134
|
||
|
||
OpenBSD-Commit-ID: afce0872cbfcfc1d4910ad7722e50f792a1dce12
|
||
|
||
commit f96f17f920f38ceea6f3c5cb0b075c46b8929fdc
|
||
Author: Damien Miller <djm@mindrot.org>
|
||
Date: Fri Apr 17 14:07:15 2020 +1000
|
||
|
||
sys/sysctl.h is only used on OpenBSD
|
||
|
||
so change the preprocessor test used to include it to check
|
||
__OpenBSD__, matching the code that uses the symbols it declares.
|
||
|
||
commit 54688e937a69c7aebef8a3d50cbd4c6345bab2ca
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Fri Apr 17 03:38:47 2020 +0000
|
||
|
||
upstream: fix reversed test that caused IdentitiesOnly=yes to not
|
||
|
||
apply to keys loaded from a PKCS11Provider; bz3141, ok dtucker@
|
||
|
||
OpenBSD-Commit-ID: e3dd6424b94685671fe84c9b9dbe352fb659f677
|
||
|
||
commit 267cbc87b5b6e78973ac4d3c7a6f807ed226928c
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Fri Apr 17 03:34:42 2020 +0000
|
||
|
||
upstream: mention that /etc/hosts.equiv and /etc/shosts.equiv are
|
||
|
||
not considered for HostbasedAuthentication when the target user is root;
|
||
bz3148
|
||
|
||
OpenBSD-Commit-ID: fe4c1256929e53f23af17068fbef47852f4bd752
|
||
|
||
commit c90f72d29e84b4a2709078bf5546a72c29a65177
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Fri Apr 17 03:30:05 2020 +0000
|
||
|
||
upstream: make IgnoreRhosts a tri-state option: "yes" ignore
|
||
|
||
rhosts/shosts, "no" allow rhosts/shosts or (new) "shosts-only" to allow
|
||
.shosts files but not .rhosts. ok dtucker@
|
||
|
||
OpenBSD-Commit-ID: d08d6930ed06377a80cf53923c1955e9589342e9
|
||
|
||
commit 321c7147079270f3a154f91b59e66219aac3d514
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Fri Apr 17 03:23:13 2020 +0000
|
||
|
||
upstream: allow the IgnoreRhosts directive to appear anywhere in a
|
||
|
||
sshd_config, not just before any Match blocks; bz3148, ok dtucker@
|
||
|
||
OpenBSD-Commit-ID: e042467d703bce640b1f42c5d1a62bf3825736e8
|
||
|
||
commit ca5403b085a735055ec7b7cdcd5b91f2662df94c
|
||
Author: jmc@openbsd.org <jmc@openbsd.org>
|
||
Date: Sat Apr 11 20:20:09 2020 +0000
|
||
|
||
upstream: add space between macro arg and punctuation;
|
||
|
||
OpenBSD-Commit-ID: e579e4d95eef13059c30931ea1f09ed8296b819c
|
||
|
||
commit 8af0244d7b4a65eed2e62f9c89141c7c8e63f09d
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Wed Apr 15 10:58:02 2020 +1000
|
||
|
||
Add sys/syscall.h for syscall numbers.
|
||
|
||
In some architecture/libc configurations we need to explicitly include
|
||
sys/syscall.h for the syscall number (__NR_xxx) definitions. bz#3085,
|
||
patch from blowfist at xroutine.net.
|
||
|
||
commit 3779b50ee952078018a5d9e1df20977f4355df17
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Sat Apr 11 10:16:11 2020 +0000
|
||
|
||
upstream: Refactor private key parsing. Eliminates a fair bit of
|
||
|
||
duplicated code and fixes oss-fuzz#20074 (NULL deref) caused by a missing key
|
||
type check in the ECDSA_CERT parsing path.
|
||
|
||
feedback and ok markus@
|
||
|
||
OpenBSD-Commit-ID: 4711981d88afb7196d228f7baad9be1d3b20f9c9
|
||
|
||
commit b6a4013647db67ec622c144a9e05dd768f1966b3
|
||
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
||
Date: Fri Apr 10 00:54:03 2020 +0000
|
||
|
||
upstream: Add tests for TOKEN expansion of LocalForward and
|
||
|
||
RemoteForward.
|
||
|
||
OpenBSD-Regress-ID: 90fcbc60d510eb114a2b6eaf4a06ff87ecd80a89
|
||
|
||
commit abc3e0a5179c13c0469a1b11fe17d832abc39999
|
||
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
||
Date: Mon Apr 6 09:43:55 2020 +0000
|
||
|
||
upstream: Add utf8.c for asmprintf used by krl.c
|
||
|
||
OpenBSD-Regress-ID: 433708d11165afdb189fe635151d21659dd37a37
|
||
|
||
commit 990687a0336098566c3a854d23cce74a31ec6fe2
|
||
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
||
Date: Fri Apr 10 00:52:07 2020 +0000
|
||
|
||
upstream: Add TOKEN percent expansion to LocalFoward and RemoteForward
|
||
|
||
when used for Unix domain socket forwarding. Factor out the code for the
|
||
config keywords that use the most common subset of TOKENS into its own
|
||
function. bz#3014, ok jmc@ (man page bits) djm@
|
||
|
||
OpenBSD-Commit-ID: bffc9f7e7b5cf420309a057408bef55171fd0b97
|
||
|
||
commit 2b13d3934d5803703c04803ca3a93078ecb5b715
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Wed Apr 8 00:10:37 2020 +0000
|
||
|
||
upstream: let sshkey_try_load_public() load public keys from the
|
||
|
||
unencrypted envelope of private key files if not sidecar public key file is
|
||
present.
|
||
|
||
ok markus@
|
||
|
||
OpenBSD-Commit-ID: 252a0a580e10b9a6311632530d63b5ac76592040
|
||
|
||
commit d01f39304eaab0352793b490a25e1ab5f59a5366
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Wed Apr 8 00:09:24 2020 +0000
|
||
|
||
upstream: simplify sshkey_try_load_public()
|
||
|
||
ok markus@
|
||
|
||
OpenBSD-Commit-ID: 05a5d46562aafcd70736c792208b1856064f40ad
|
||
|
||
commit f290ab0833e44355fc006e4e67b92446c14673ef
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Wed Apr 8 00:08:46 2020 +0000
|
||
|
||
upstream: add sshkey_parse_pubkey_from_private_fileblob_type()
|
||
|
||
Extracts a public key from the unencrypted envelope of a new-style
|
||
OpenSSH private key.
|
||
|
||
ok markus@
|
||
|
||
OpenBSD-Commit-ID: 44d7ab446e5e8c686aee96d5897b26b3939939aa
|
||
|
||
commit 8d514eea4ae089626a55e11c7bc1745c8d9683e4
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Wed Apr 8 00:07:19 2020 +0000
|
||
|
||
upstream: simplify sshkey_parse_private_fileblob_type()
|
||
|
||
Try new format parser for all key types first, fall back to PEM
|
||
parser only for invalid format errors.
|
||
|
||
ok markus@
|
||
|
||
OpenBSD-Commit-ID: 0173bbb3a5cface77b0679d4dca0e15eb5600b77
|
||
|
||
commit 421169d0e758351b105eabfcebf42378ebf17217
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Wed Apr 8 00:05:59 2020 +0000
|
||
|
||
upstream: check private key type against requested key type in
|
||
|
||
new-style private decoding; ok markus@
|
||
|
||
OpenBSD-Commit-ID: 04d44b3a34ce12ce5187fb6f6e441a88c8c51662
|
||
|
||
commit 6aabfb6d22b36d07f584cba97f4cdc4363a829da
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Wed Apr 8 00:04:32 2020 +0000
|
||
|
||
upstream: check that pubkey in private key envelope matches actual
|
||
|
||
private key
|
||
|
||
(this public key is currently unusued)
|
||
|
||
ok markus@
|
||
|
||
OpenBSD-Commit-ID: 634a60b5e135d75f48249ccdf042f3555112049c
|
||
|
||
commit c0f5b2294796451001fd328c44f0d00f1114eddf
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Wed Apr 8 00:01:52 2020 +0000
|
||
|
||
upstream: refactor private key parsing a little
|
||
|
||
Split out the base64 decoding and private section decryption steps in
|
||
to separate functions. This will make the decryption step easier to fuzz
|
||
as well as making it easier to write a "load public key from new-format
|
||
private key" function.
|
||
|
||
ok markus@
|
||
|
||
OpenBSD-Commit-ID: 7de31d80fb9062aa01901ddf040c286b64ff904e
|
||
|
||
commit 8461a5b3db34ed0b5a4a18d82f64fd5ac8693ea8
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Mon Apr 6 20:54:34 2020 +1000
|
||
|
||
Include openssl-compat.h before checking ifdefs.
|
||
|
||
Fixes problem where unsuitable chacha20 code in libressl would be used
|
||
unintentionally.
|
||
|
||
commit 931c50c5883a9910ea1ae9a371e4e815ec56b035
|
||
Author: Damien Miller <djm@mindrot.org>
|
||
Date: Mon Apr 6 10:04:56 2020 +1000
|
||
|
||
fix inverted test for LibreSSL version
|
||
|
||
commit d1d5f728511e2338b7c994968d301d8723012264
|
||
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
||
Date: Sat Apr 4 23:04:41 2020 +0000
|
||
|
||
upstream: Indicate if we're using a cached key in trace output.
|
||
|
||
OpenBSD-Regress-ID: 409a7b0e59d1272890fda507651c0c3d2d3c0d89
|
||
|
||
commit a398251a4627367c78bc483c70c2ec973223f82c
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Sun Apr 5 08:43:57 2020 +1000
|
||
|
||
Use /usr/bin/xp4g/id if necessary.
|
||
|
||
Solaris' native "id" doesn't support the options we use but the one
|
||
in /usr/bin/xp4g does, so use that instead.
|
||
|
||
commit db0fdd48335b5b01114f78c1a73a195235910f81
|
||
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
||
Date: Sat Apr 4 22:14:26 2020 +0000
|
||
|
||
upstream: Some platforms don't have "hostname -s", so use cut to trim
|
||
|
||
short hostname instead.
|
||
|
||
OpenBSD-Regress-ID: ebcf36a6fdf287c9336b0d4f6fc9f793c05307a7
|
||
|
||
commit e7e59a9cc8eb7fd5944ded28f4d7e3ae0a5fdecd
|
||
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
||
Date: Fri Apr 3 07:53:10 2020 +0000
|
||
|
||
upstream: Compute hash locally and re-enable %C tests.
|
||
|
||
OpenBSD-Regress-ID: 94d1366e8105274858b88a1f9ad2e62801e49770
|
||
|
||
commit abe2b245b3ac6c4801e99bc0f13289cd28211e22
|
||
Author: Damien Miller <djm@mindrot.org>
|
||
Date: Fri Apr 3 17:25:46 2020 +1100
|
||
|
||
prefer libcrypto chacha20-poly1305 where possible
|
||
|
||
commit bc5c5d01ad668981f9e554e62195383bc12e8528
|
||
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
||
Date: Fri Apr 3 05:43:11 2020 +0000
|
||
|
||
upstream: Temporarily remove tests for '%C' since the hash contains the
|
||
|
||
local hostname and it doesn't work on any machine except mine... spotted by
|
||
djm@
|
||
|
||
OpenBSD-Regress-ID: 2d4c3585b9fcbbff14f4a5a5fde51dbd0d690401
|
||
|
||
commit 81624026989654955a657ebf2a1fe8b9994f3c87
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Fri Apr 3 06:07:57 2020 +0000
|
||
|
||
upstream: r1.522 deleted one too many lines; repair
|
||
|
||
OpenBSD-Commit-ID: 1af8851fd7a99e4a887b19aa8f4c41a6b3d25477
|
||
|
||
commit 668cb3585ce829bd6e34d4a962c489bda1d16370
|
||
Author: jmc@openbsd.org <jmc@openbsd.org>
|
||
Date: Fri Apr 3 05:53:52 2020 +0000
|
||
|
||
upstream: sort -N and add it to usage();
|
||
|
||
OpenBSD-Commit-ID: 5b00e8db37c2b0a54c7831fed9e5f4db53ada332
|
||
|
||
commit 338ccee1e7fefa47f3d128c2541e94c5270abe0c
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Fri Apr 3 05:48:57 2020 +0000
|
||
|
||
upstream: avoid another compiler warning spotted in -portable
|
||
|
||
OpenBSD-Commit-ID: 1d29c51ac844b287c4c8bcaf04c63c7d9ba3b8c7
|
||
|
||
commit 9f8a42340bd9af86a99cf554dc39ecdf89287544
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Fri Apr 3 04:07:48 2020 +0000
|
||
|
||
upstream: this needs utf8.c too
|
||
|
||
OpenBSD-Regress-ID: 445040036cec714d28069a20da25553a04a28451
|
||
|
||
commit 92115ea7c3a834374720c350841fc729e7d5c8b2
|
||
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
||
Date: Fri Apr 3 03:14:03 2020 +0000
|
||
|
||
upstream: Add percent_expand test for 'Match Exec'.
|
||
|
||
OpenBSD-Regress-ID: a41c14fd6a0b54d66aa1e9eebfb9ec962b41232f
|
||
|
||
commit de34a440276ae855c38deb20f926d46752c62c9d
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Fri Apr 3 04:43:24 2020 +0000
|
||
|
||
upstream: fix format string (use %llu for uint64, not %lld). spotted by
|
||
|
||
Darren and his tinderbox tests
|
||
|
||
OpenBSD-Commit-ID: 3b4587c3d9d46a7be9bdf028704201943fba96c2
|
||
|
||
commit 9cd40b829a5295cc81fbea8c7d632b2478db6274
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Fri Apr 3 04:34:15 2020 +0000
|
||
|
||
upstream: Add a flag to re-enable verbose output when in batch
|
||
|
||
mode; requested in bz3135; ok dtucker
|
||
|
||
OpenBSD-Commit-ID: 5ad2ed0e6440562ba9c84b666a5bbddc1afe2e2b
|
||
|
||
commit 6ce51a5da5d333a44e7c74c027f3571f70c39b24
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Fri Apr 3 04:32:21 2020 +0000
|
||
|
||
upstream: chacha20-poly1305 AEAD using libcrypto EVP_chacha20
|
||
|
||
Based on patch from Yuriy M. Kaminskiy. ok + lots of assistance along the
|
||
way at a2k20 tb@
|
||
|
||
OpenBSD-Commit-ID: 5e08754c13d31258bae6c5e318cc96219d6b10f0
|
||
|
||
commit eba523f0a130f1cce829e6aecdcefa841f526a1a
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Fri Apr 3 04:27:03 2020 +0000
|
||
|
||
upstream: make Chacha20-POLY1305 context struct opaque; ok tb@ as
|
||
|
||
part of a larger diff at a2k20
|
||
|
||
OpenBSD-Commit-ID: a4609b7263284f95c9417ef60ed7cdbb7bf52cfd
|
||
|
||
commit ebd29e90129cf18fedfcfe1de86e324228669295
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Fri Apr 3 04:06:26 2020 +0000
|
||
|
||
upstream: fix debug statement
|
||
|
||
OpenBSD-Commit-ID: 42c6edeeda5ce88b51a20d88c93be3729ce6b916
|
||
|
||
commit 7b4d8999f2e1a0cb7b065e3efa83e6edccfc7d82
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Fri Apr 3 04:03:51 2020 +0000
|
||
|
||
upstream: the tunnel-forwarding vs ExitOnForwardFailure fix that I
|
||
|
||
committed earlier had an off-by-one. Fix this and add some debugging that
|
||
would have made it apparent sooner.
|
||
|
||
OpenBSD-Commit-ID: 082f8f72b1423bd81bbdad750925b906e5ac6910
|
||
|
||
commit eece243666d44ceb710d004624c5c7bdc05454bc
|
||
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
||
Date: Fri Apr 3 03:12:11 2020 +0000
|
||
|
||
upstream: %C expansion just added to Match Exec should include
|
||
|
||
remote user not local user.
|
||
|
||
OpenBSD-Commit-ID: 80f1d976938f2a55ee350c11d8b796836c8397e2
|
||
|
||
commit d5318a784d016478fc8da90a38d9062c51c10432
|
||
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
||
Date: Fri Apr 3 02:33:31 2020 +0000
|
||
|
||
upstream: Add regression test for percent expansions where possible.
|
||
|
||
OpenBSD-Regress-ID: 7283be8b2733ac1cbefea3048a23d02594485288
|
||
|
||
commit 663e84bb53de2a60e56a44d538d25b8152b5c1cc
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Fri Apr 3 02:40:32 2020 +0000
|
||
|
||
upstream: make failures when establishing "Tunnel" forwarding terminate
|
||
|
||
the connection when ExitOnForwardFailure is enabled; bz3116; ok dtucker
|
||
|
||
OpenBSD-Commit-ID: ef4b4808de0a419c17579b1081da768625c1d735
|
||
|
||
commit ed833da176611a39d3376d62154eb88eb440d31c
|
||
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
||
Date: Fri Apr 3 02:27:12 2020 +0000
|
||
|
||
upstream: Make with config keywords support which
|
||
|
||
percent_expansions more consistent. - %C is moved into its own function and
|
||
added to Match Exec. - move the common (global) options into a macro. This
|
||
is ugly but it's the least-ugly way I could come up with. - move
|
||
IdentityAgent and ForwardAgent percent expansion to before the config dump
|
||
to make it regression-testable. - document all of the above
|
||
|
||
ok jmc@ for man page bits, "makes things less terrible" djm@ for the rest.
|
||
|
||
OpenBSD-Commit-ID: 4b65664bd6d8ae2a9afaf1a2438ddd1b614b1d75
|
||
|
||
commit 6ec7457171468da2bbd908b8cd63d298b0e049ea
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Fri Apr 3 02:26:56 2020 +0000
|
||
|
||
upstream: give ssh-keygen the ability to dump the contents of a
|
||
|
||
binary key revocation list: ssh-keygen -lQf /path bz#3132; ok dtucker
|
||
|
||
OpenBSD-Commit-ID: b76afc4e3b74ab735dbde4e5f0cfa1f02356033b
|
||
|
||
commit af628b8a6c3ef403644d83d205c80ff188c97f0c
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Fri Apr 3 02:25:21 2020 +0000
|
||
|
||
upstream: add allocating variant of the safe utf8 printer; ok
|
||
|
||
dtucker as part of a larger diff
|
||
|
||
OpenBSD-Commit-ID: 037e2965bd50eacc2ffb49889ecae41552744fa0
|
||
|
||
commit d8ac9af645f5519ac5211e9e1e4dc1ed00e9cced
|
||
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
||
Date: Mon Mar 16 02:17:02 2020 +0000
|
||
|
||
upstream: Cast lifetime to u_long for comparison to prevent unsigned
|
||
|
||
comparison warning on 32bit arches. Spotted by deraadt, ok djm.
|
||
|
||
OpenBSD-Commit-ID: 7a75b2540bff5ab4fa00b4d595db1df13bb0515a
|
||
|
||
commit 0eaca933ae08b0a515edfccd5cc4a6b667034813
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Sat Mar 14 20:58:46 2020 +1100
|
||
|
||
Include fido.h when checking for fido/credman.h.
|
||
|
||
It's required for fido_dev_t, otherwise configure fails with
|
||
when given --with-security-key-builtin.
|
||
|
||
commit c7c099060f82ffe6a36d8785ecf6052e12fd92f0
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Fri Mar 13 03:18:45 2020 +0000
|
||
|
||
upstream: some more speeling mistakes from
|
||
|
||
OpenBSD-Regress-ID: 02471c079805471c546b7a69d9ab1d34e9a57443
|
||
|
||
commit 1d89232a4aa97fe935cd60b8d24d75c2f70d56c5
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Fri Mar 13 04:16:27 2020 +0000
|
||
|
||
upstream: improve error messages for some common PKCS#11 C_Login
|
||
|
||
failure cases; based on patch from Jacob Hoffman-Andrews in bz3130; ok
|
||
dtucker
|
||
|
||
OpenBSD-Commit-ID: b8b849621b4a98e468942efd0a1c519c12ce089e
|
||
|
||
commit 5becbec023f2037394987f85ed7f74b9a28699e0
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Fri Mar 13 04:01:56 2020 +0000
|
||
|
||
upstream: use sshpkt_fatal() for kex_exchange_identification()
|
||
|
||
errors. This ensures that the logged errors are consistent with other
|
||
transport- layer errors and that the relevant IP addresses are logged. bz3129
|
||
ok dtucker@
|
||
|
||
OpenBSD-Commit-ID: 2c22891f0b9e1a6cd46771cedbb26ac96ec2e6ab
|
||
|
||
commit eef88418f9e5e51910af3c5b23b5606ebc17af55
|
||
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
||
Date: Fri Mar 13 03:24:49 2020 +0000
|
||
|
||
upstream: Don't clear alarm timers in listening sshd. Previously
|
||
|
||
these timers were used for regenerating the SSH1 ephemeral host keys but
|
||
those are now gone so there's no need to clear the timers either. ok
|
||
deraadt@
|
||
|
||
OpenBSD-Commit-ID: 280d2b885e4a1ce404632e8cc38fcb17be7dafc0
|
||
|
||
commit d081f017c20a3564255873ed99fd7d024cac540f
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Fri Mar 13 03:17:07 2020 +0000
|
||
|
||
upstream: spelling errors in comments; no code change from
|
||
|
||
OpenBSD-Commit-ID: 166ea64f6d84f7bac5636dbd38968592cb5eb924
|
||
|
||
commit c084a2d040f160bc2b83f13297e3e3ca3f5dbac6
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Fri Mar 13 03:12:17 2020 +0000
|
||
|
||
upstream: when downloading FIDO2 resident keys from a token, don't
|
||
|
||
prompt for a PIN until the token has told us that it needs one. Avoids
|
||
double-prompting on devices that implement on-device authentication (e.g. a
|
||
touchscreen PIN pad on the Trezor Model T). ok dtucker@
|
||
|
||
OpenBSD-Commit-ID: 38b78903dd4422d7d3204095a31692fb69130817
|
||
|
||
commit 955c4cf4c6a1417c28d4e1040702c4d9bf63645b
|
||
Author: Damien Miller <djm@mindrot.org>
|
||
Date: Fri Mar 13 14:30:16 2020 +1100
|
||
|
||
sync fnmatch.c with upstream to fix another typo
|
||
|
||
commit 397f217e8640e75bb719a8e87111b4bd848fb3df
|
||
Author: Damien Miller <djm@mindrot.org>
|
||
Date: Fri Mar 13 14:24:23 2020 +1100
|
||
|
||
another spelling error in comment
|
||
|
||
commit def31bc5427579ec3f7f2ce99f2da1338fdc0c9f
|
||
Author: Damien Miller <djm@mindrot.org>
|
||
Date: Fri Mar 13 14:23:07 2020 +1100
|
||
|
||
spelling mistakes
|
||
|
||
from https://fossies.org/linux/misc/openssh-8.2p1.tar.gz/codespell.html
|
||
|
||
commit 8bdc3bb7cf4c82c3344cfcb82495a43406e87e83
|
||
Author: markus@openbsd.org <markus@openbsd.org>
|
||
Date: Fri Mar 6 18:29:54 2020 +0000
|
||
|
||
upstream: fix relative includes in sshd_config; ok djm
|
||
|
||
OpenBSD-Commit-ID: fa29b0da3c93cbc3a1d4c6bcd58af43c00ffeb5b
|
||
|
||
commit e32ef97a56ae03febfe307688858badae3a70e5a
|
||
Author: markus@openbsd.org <markus@openbsd.org>
|
||
Date: Fri Mar 6 18:29:14 2020 +0000
|
||
|
||
upstream: fix use-after-free in do_download_sk; ok djm
|
||
|
||
OpenBSD-Commit-ID: 96b49623d297797d4fc069f1f09e13c8811f8863
|
||
|
||
commit 5732d58020309364bf31fa125354e399361006db
|
||
Author: markus@openbsd.org <markus@openbsd.org>
|
||
Date: Fri Mar 6 18:28:50 2020 +0000
|
||
|
||
upstream: do not leak oprincipals; ok djm
|
||
|
||
OpenBSD-Commit-ID: 4691d9387eab36f8fda48f5d8009756ed13a7c4c
|
||
|
||
commit 8fae395f34c2c52cdaf9919aa261d1848b4bb00b
|
||
Author: markus@openbsd.org <markus@openbsd.org>
|
||
Date: Fri Mar 6 18:28:27 2020 +0000
|
||
|
||
upstream: initialize seconds for debug message; ok djm
|
||
|
||
OpenBSD-Commit-ID: 293fbefe6d00b4812a180ba02e26170e4c855b81
|
||
|
||
commit 46e5c4c8ffcd1569bcd5d04803abaa2ecf3e4cff
|
||
Author: markus@openbsd.org <markus@openbsd.org>
|
||
Date: Fri Mar 6 18:27:50 2020 +0000
|
||
|
||
upstream: correct return code; ok djm
|
||
|
||
OpenBSD-Commit-ID: 319d09e3b7f4b2bc920c67244d9ff6426b744810
|
||
|
||
commit 31c39e7840893f1bfdcbe4f813b20d1d7e69ec3e
|
||
Author: markus@openbsd.org <markus@openbsd.org>
|
||
Date: Fri Mar 6 18:27:15 2020 +0000
|
||
|
||
upstream: principalsp is optional, pubkey required; ok djm
|
||
|
||
OpenBSD-Commit-ID: 2cc3ea5018c28ed97edaccd7f17d2cc796f01024
|
||
|
||
commit e26a31757c5df2f58687cb9a4853d1418f39728e
|
||
Author: markus@openbsd.org <markus@openbsd.org>
|
||
Date: Fri Mar 6 18:26:21 2020 +0000
|
||
|
||
upstream: remove unused variables in ssh-pkcs11-helper; ok djm
|
||
|
||
OpenBSD-Commit-ID: 13e572846d0d1b28f1251ddd2165e9cf18135ae1
|
||
|
||
commit 1b378c0d982d6ab522eda634b0e88cf1fca5e352
|
||
Author: markus@openbsd.org <markus@openbsd.org>
|
||
Date: Fri Mar 6 18:25:48 2020 +0000
|
||
|
||
upstream: return correct error in sshsk_ed25519_sig; ok djm
|
||
|
||
OpenBSD-Commit-ID: 52bf733df220303c260fee4f165ec64b4a977625
|
||
|
||
commit fbff605e637b068061ab6784ff03e3874890c092
|
||
Author: markus@openbsd.org <markus@openbsd.org>
|
||
Date: Fri Mar 6 18:25:12 2020 +0000
|
||
|
||
upstream: fix possible null-deref in check_key_not_revoked; ok
|
||
|
||
djm
|
||
|
||
OpenBSD-Commit-ID: 80855e9d7af42bb6fcc16c074ba69876bfe5e3bf
|
||
|
||
commit bc30b446841fc16e50ed6e75c56ccfbd37b9f281
|
||
Author: markus@openbsd.org <markus@openbsd.org>
|
||
Date: Fri Mar 6 18:24:39 2020 +0000
|
||
|
||
upstream: ssh_fetch_identitylist() returns the return value from
|
||
|
||
ssh_request_reply() so we should also check against != 0 ok djm
|
||
|
||
OpenBSD-Commit-ID: 28d0028769d03e665688c61bb5fd943e18614952
|
||
|
||
commit 7b4f70ddeb59f35283d77d8d9c834ca58f8cf436
|
||
Author: markus@openbsd.org <markus@openbsd.org>
|
||
Date: Fri Mar 6 18:23:17 2020 +0000
|
||
|
||
upstream: sshkey_cert_check_authority requires reason to be set;
|
||
|
||
ok djm
|
||
|
||
OpenBSD-Commit-ID: 6f7a6f19540ed5749763c2f9530c0897c94aa552
|
||
|
||
commit 05efe270df1e925db0af56a806d18b5063db4b6d
|
||
Author: markus@openbsd.org <markus@openbsd.org>
|
||
Date: Fri Mar 6 18:21:28 2020 +0000
|
||
|
||
upstream: passphrase depends on kdfname, not ciphername (possible
|
||
|
||
null-deref); ok djm
|
||
|
||
OpenBSD-Commit-ID: 0d39668edf5e790b5837df4926ee1141cec5471c
|
||
|
||
commit 1ddf5682f3992bdacd29164891abb71a19c2cf61
|
||
Author: markus@openbsd.org <markus@openbsd.org>
|
||
Date: Fri Mar 6 18:20:44 2020 +0000
|
||
|
||
upstream: consistently check packet_timeout_ms against 0; ok djm
|
||
|
||
OpenBSD-Commit-ID: e8fb8cb2c96c980f075069302534eaf830929928
|
||
|
||
commit 31f1ee54968ad84eb32375e4412e0318766b586b
|
||
Author: markus@openbsd.org <markus@openbsd.org>
|
||
Date: Fri Mar 6 18:20:02 2020 +0000
|
||
|
||
upstream: initialize cname in case ai_canonname is NULL or too
|
||
|
||
long; ok djm
|
||
|
||
OpenBSD-Commit-ID: c27984636fdb1035d1642283664193e91aab6e37
|
||
|
||
commit a6134b02b5264b2611c8beae98bb392329452bba
|
||
Author: markus@openbsd.org <markus@openbsd.org>
|
||
Date: Fri Mar 6 18:19:21 2020 +0000
|
||
|
||
upstream: fix uninitialized pointers for forward_cancel; ok djm
|
||
|
||
OpenBSD-Commit-ID: 612778e6d87ee865d0ba97d0a335f141cee1aa37
|
||
|
||
commit 16d4f9961c75680aab374dee762a5baa0ad507af
|
||
Author: markus@openbsd.org <markus@openbsd.org>
|
||
Date: Fri Mar 6 18:16:21 2020 +0000
|
||
|
||
upstream: exit on parse failures in input_service_request; ok djm
|
||
|
||
OpenBSD-Commit-ID: 6a7e1bfded26051d5aa893c030229b1ee6a0d5d2
|
||
|
||
commit 5f25afe5216ba7f8921e04f79aa4ca0624eca820
|
||
Author: markus@openbsd.org <markus@openbsd.org>
|
||
Date: Fri Mar 6 18:15:38 2020 +0000
|
||
|
||
upstream: fix null-deref on calloc failure; ok djm
|
||
|
||
OpenBSD-Commit-ID: a313519579b392076b7831ec022dfdefbec8724a
|
||
|
||
commit ff2acca039aef16a15fce409163df404858f7aa5
|
||
Author: markus@openbsd.org <markus@openbsd.org>
|
||
Date: Fri Mar 6 18:15:04 2020 +0000
|
||
|
||
upstream: exit if ssh_krl_revoke_key_sha256 fails; ok djm
|
||
|
||
OpenBSD-Commit-ID: 0864ad4fe8bf28ab21fd1df766e0365c11bbc0dc
|
||
|
||
commit 31c860a0212af2d5b6a129e3e8fcead51392ee1d
|
||
Author: markus@openbsd.org <markus@openbsd.org>
|
||
Date: Fri Mar 6 18:14:13 2020 +0000
|
||
|
||
upstream: pkcs11_register_provider: return < 0 on error; ok djm
|
||
|
||
OpenBSD-Commit-ID: cfc8321315b787e4d40da4bdb2cbabd4154b0d97
|
||
|
||
commit 15be29e1e3318737b0768ca37d5b4a3fbe868ef0
|
||
Author: markus@openbsd.org <markus@openbsd.org>
|
||
Date: Fri Mar 6 18:13:29 2020 +0000
|
||
|
||
upstream: sshsig: return correct error, fix null-deref; ok djm
|
||
|
||
OpenBSD-Commit-ID: 1d1af7cd538b8b23e621cf7ab84f11e7a923edcd
|
||
|
||
commit 6fb6f186cb62a6370fba476b6a03478a1e95c30d
|
||
Author: markus@openbsd.org <markus@openbsd.org>
|
||
Date: Fri Mar 6 18:12:55 2020 +0000
|
||
|
||
upstream: vasnmprintf allocates str and returns -1; ok djm
|
||
|
||
OpenBSD-Commit-ID: dae4c9e83d88471bf3b3f89e3da7a107b44df11c
|
||
|
||
commit 714e1cbca17daa13f4f98978cf9e0695d4b2e0a4
|
||
Author: markus@openbsd.org <markus@openbsd.org>
|
||
Date: Fri Mar 6 18:11:10 2020 +0000
|
||
|
||
upstream: sshpkt_fatal() does not return; ok djm
|
||
|
||
OpenBSD-Commit-ID: 7dfe847e28bd78208eb227b37f29f4a2a0929929
|
||
|
||
commit 9b47bd7b09d191991ad9e0506bb66b74bbc93d34
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Fri Feb 28 01:07:28 2020 +0000
|
||
|
||
upstream: no-touch-required certificate option should be an
|
||
|
||
extension, not a critical option.
|
||
|
||
OpenBSD-Commit-ID: 626b22c5feb7be8a645e4b9a9bef89893b88600d
|
||
|
||
commit dd992520bed35387fc010239abe1bdc0c2665e38
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Fri Feb 28 01:06:05 2020 +0000
|
||
|
||
upstream: better error message when trying to use a FIDO key
|
||
|
||
function and SecurityKeyProvider is empty
|
||
|
||
OpenBSD-Commit-ID: e56602c2ee8c82f835d30e4dc8ee2e4a7896be24
|
||
|
||
commit b81e66dbe0345aef4717911abcb4f589fff33a0a
|
||
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
||
Date: Thu Feb 27 02:32:37 2020 +0000
|
||
|
||
upstream: Drop leading space from line count that was confusing
|
||
|
||
ssh-keygen's screen mode.
|
||
|
||
OpenBSD-Commit-ID: 3bcae7a754db3fc5ad3cab63dd46774edb35b8ae
|
||
|
||
commit d5ba1c03278eb079438bb038266d80d7477d49cb
|
||
Author: jsg@openbsd.org <jsg@openbsd.org>
|
||
Date: Wed Feb 26 13:40:09 2020 +0000
|
||
|
||
upstream: change explicit_bzero();free() to freezero()
|
||
|
||
While freezero() returns early if the pointer is NULL the tests for
|
||
NULL in callers are left to avoid warnings about passing an
|
||
uninitialised size argument across a function boundry.
|
||
|
||
ok deraadt@ djm@
|
||
|
||
OpenBSD-Commit-ID: 2660fa334fcc7cd05ec74dd99cb036f9ade6384a
|
||
|
||
commit 9e3220b585c5be19a7431ea4ff8884c137b3a81c
|
||
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
||
Date: Wed Feb 26 11:46:51 2020 +0000
|
||
|
||
upstream: Have sftp reject "-1" in the same way as ssh(1) and
|
||
|
||
scp(1) do instead of accepting and silently ignoring it since protocol 1
|
||
support has been removed. Spotted by shivakumar2696 at gmail.com, ok
|
||
deraadt@
|
||
|
||
OpenBSD-Commit-ID: b79f95559a1c993214f4ec9ae3c34caa87e9d5de
|
||
|
||
commit ade8e67bb0f07b12e5e47e7baeafbdc898de639f
|
||
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
||
Date: Wed Feb 26 01:31:47 2020 +0000
|
||
|
||
upstream: Remove obsolete XXX comment. ok deraadt@
|
||
|
||
OpenBSD-Commit-ID: bc462cc843947feea26a2e21c750b3a7469ff01b
|
||
|
||
commit 7eb903f51eba051d7f65790bab92a28970ac1ccc
|
||
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
||
Date: Mon Feb 24 04:27:58 2020 +0000
|
||
|
||
upstream: Fix typo. Patch from itoama at live.jp via github PR#173.
|
||
|
||
OpenBSD-Commit-ID: 5cdaafab38bbdea0d07e24777d00bfe6f972568a
|
||
|
||
commit b2491c289dd1b557a18a2aca04eeff5c157fc5ef
|
||
Author: Nico Kadel-Garcia <nkadel@gmail.com>
|
||
Date: Sat Oct 12 17:51:01 2019 -0400
|
||
|
||
Switch %define to %global for redhat/openssh.spec
|
||
|
||
commit b18dcf6cca7c7aba1cc22e668e04492090ef0255
|
||
Author: mkontani <itoama@live.jp>
|
||
Date: Fri Feb 21 00:54:49 2020 +0900
|
||
|
||
fix some typos and sentence
|
||
|
||
commit 0001576a096f788d40c2c0a39121cff51bf961ad
|
||
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
||
Date: Fri Feb 21 00:04:43 2020 +0000
|
||
|
||
upstream: Fix some typos and an incorrect word in docs. Patch from
|
||
|
||
itoama at live.jp via github PR#172.
|
||
|
||
OpenBSD-Commit-ID: 166ee8f93a7201fef431b9001725ab8b269d5874
|
||
|
||
commit 99ff8fefe4b2763a53778d06b5f74443c8701615
|
||
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
||
Date: Thu Feb 20 05:58:08 2020 +0000
|
||
|
||
upstream: Update moduli generation script to new ssh-keygen
|
||
|
||
generation and screening command line flags.
|
||
|
||
OpenBSD-Commit-ID: 5010ff08f7ad92082e87dde098b20f5c24921a8f
|
||
|
||
commit 700d16f5e534d6de5a3b7105a74a7a6f4487b681
|
||
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
||
Date: Thu Feb 20 05:41:51 2020 +0000
|
||
|
||
upstream: Import regenerated moduli.
|
||
|
||
OpenBSD-Commit-ID: 7b7b619c1452a459310b0cf4391c5757c6bdbc0f
|
||
|
||
commit 4753b74ba0f09e4aacdaab5e184cd540352004d5
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Thu Feb 20 16:42:50 2020 +1100
|
||
|
||
Import regenerated moduli.
|
||
|
||
commit 11d427162778c18fa42917893a75d178679a2389
|
||
Author: HARUYAMA Seigo <haruyama@unixuser.org>
|
||
Date: Fri Feb 14 16:14:23 2020 +0900
|
||
|
||
Fix typos in INSTALL: s/avilable/available/ s/suppports/supports/
|
||
|
||
commit 264a966216137c9f4f8220fd9142242d784ba059
|
||
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
||
Date: Tue Feb 18 08:58:33 2020 +0000
|
||
|
||
upstream: Ensure that the key lifetime provided fits within the
|
||
|
||
values allowed by the wire format (u32). Prevents integer wraparound of the
|
||
timeout values. bz#3119, ok markus@ djm@
|
||
|
||
OpenBSD-Commit-ID: 8afe6038b5cdfcf63360788f012a7ad81acc46a2
|
||
|
||
commit de1f3564cd85915b3002859873a37cb8d31ac9ce
|
||
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
||
Date: Tue Feb 18 08:49:49 2020 +0000
|
||
|
||
upstream: Detect and prevent simple configuration loops when using
|
||
|
||
ProxyJump. bz#3057, ok djm@
|
||
|
||
OpenBSD-Commit-ID: 077d21c564c886c98309d871ed6f8ef267b9f037
|
||
|
||
commit 30144865bfa06b12239cfabc37c45e5ddc369d97
|
||
Author: naddy@openbsd.org <naddy@openbsd.org>
|
||
Date: Sun Feb 16 21:15:43 2020 +0000
|
||
|
||
upstream: document -F none; with jmc@
|
||
|
||
OpenBSD-Commit-ID: 0eb93b75473d2267aae9200e02588e57778c84f2
|
||
|
||
commit 011052de73f3dbc53f50927ccf677266a9ade4f6
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Mon Feb 17 22:55:51 2020 +1100
|
||
|
||
Remove unused variable warning.
|
||
|
||
commit 31c9348c5e4e94e9913ec64b3ca6e15f68ba19e5
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Mon Feb 17 22:53:24 2020 +1100
|
||
|
||
Constify aix_krb5_get_principal_name.
|
||
|
||
Prevents warning about discarding type qualifiers on AIX.
|
||
|
||
commit 290c994336a2cfe03c5496bebb6580863f94b232
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Mon Feb 17 22:51:36 2020 +1100
|
||
|
||
Check if TILDE is already defined and undef.
|
||
|
||
Prevents redefinition warning on AIX.
|
||
|
||
commit 41a2e64ae480eda73ee0e809bbe743d203890938
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Mon Feb 17 22:51:00 2020 +1100
|
||
|
||
Prevent unused variable warning.
|
||
|
||
commit d4860ec4efd25ba194337082736797fce0bda016
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Mon Feb 17 22:48:50 2020 +1100
|
||
|
||
Check if getpeereid is actually declared.
|
||
|
||
Check in sys/socket.h (AIX) and unistd.h (FreeBSD, DragonFLy and OS X).
|
||
Prevents undeclared function warning on at least some versions of AIX.
|
||
|
||
commit 8aa3455b16fddea4c0144a7c4a1edb10ec67dcc8
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Fri Feb 14 00:39:20 2020 +0000
|
||
|
||
upstream: openssh-8.2
|
||
|
||
OpenBSD-Commit-ID: 0a1340ff65fad0d84b997ac58dd1b393dec7c19b
|
||
|
||
commit 72f0ce33f0d5a37f31bad5800d1eb2fbdb732de6
|
||
Author: Damien Miller <djm@mindrot.org>
|
||
Date: Wed Feb 12 09:28:35 2020 +1100
|
||
|
||
crank version numbers
|
||
|
||
commit b763ed05bd1f1f15ae1727c86a4498546bc36ca8
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Tue Feb 11 12:51:24 2020 +1100
|
||
|
||
Minor documentation update:
|
||
|
||
- remove duplication of dependency information (it's all in INSTALL).
|
||
- SSHFP is now an RFC.
|
||
|
||
commit 14ccfdb7248e33b1dc8bbac1425ace4598e094cb
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Sun Feb 9 11:23:35 2020 +1100
|
||
|
||
Check if UINT32_MAX is defined before redefining.
|
||
|
||
commit be075110c735a451fd9d79a864e01e2e0d9f19d2
|
||
Author: Damien Miller <djm@mindrot.org>
|
||
Date: Fri Feb 7 15:07:27 2020 +1100
|
||
|
||
typo; reported by Phil Pennock
|
||
|
||
commit 963d71851e727ffdd2a97fe0898fad61d4a70ba1
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Fri Feb 7 03:57:31 2020 +0000
|
||
|
||
upstream: sync the description of the $SSH_SK_PROVIDER environment
|
||
|
||
variable with that of the SecurityKeyProvider ssh/sshd_config(5) directive,
|
||
as the latter was more descriptive.
|
||
|
||
OpenBSD-Commit-ID: 0488f09530524a7e53afca6b6e1780598022552f
|
||
|
||
commit d4d9e1d40514e2746f9e05335d646512ea1020c6
|
||
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
||
Date: Fri Feb 7 03:54:44 2020 +0000
|
||
|
||
upstream: Add ssh -Q key-sig for all key and signature types.
|
||
|
||
Teach ssh -Q to accept ssh_config(5) and sshd_config(5) algorithm keywords as
|
||
an alias for the corresponding query. Man page help jmc@, ok djm@.
|
||
|
||
OpenBSD-Commit-ID: 1e110aee3db2fc4bc5bee2d893b7128fd622e0f8
|
||
|
||
commit fd68dc27864b099b552a6d9d507ca4b83afd6a76
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Fri Feb 7 03:27:54 2020 +0000
|
||
|
||
upstream: fix two PIN entry bugs on FIDO keygen: 1) it would allow more
|
||
|
||
than the intended number of prompts (3) and 2) it would SEGV too many
|
||
incorrect PINs were entered; based on patch by Gabriel Kihlman
|
||
|
||
OpenBSD-Commit-ID: 9c0011f28ba8bd8adf2014424b64960333da1718
|
||
|
||
commit 96bd895a0a0b3a36f81c14db8c91513578fc5563
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Thu Feb 6 22:48:23 2020 +0000
|
||
|
||
upstream: When using HostkeyAlgorithms to merely append or remove
|
||
|
||
algorithms from the default set (i.e. HostkeyAlgorithms=+/-...), retain the
|
||
default behaviour of preferring those algorithms that have existing keys in
|
||
known_hosts; ok markus
|
||
|
||
OpenBSD-Commit-ID: 040e7fcc38ea00146b5d224ce31ce7a1795ee6ed
|
||
|
||
commit c7288486731734a864b58d024b1395029b55bbc5
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Thu Feb 6 22:46:31 2020 +0000
|
||
|
||
upstream: expand HostkeyAlgorithms prior to config dump, matching
|
||
|
||
other algorithm lists; ok markus@
|
||
|
||
OpenBSD-Commit-ID: a66f0fca8cc5ce30405a2867bc115fff600671d0
|
||
|
||
commit a6ac5d36efc072b15690c65039754f8e44247bdf
|
||
Author: naddy@openbsd.org <naddy@openbsd.org>
|
||
Date: Thu Feb 6 22:34:58 2020 +0000
|
||
|
||
upstream: Add Include to the list of permitted keywords after a
|
||
|
||
Match keyword. ok markus@
|
||
|
||
OpenBSD-Commit-ID: 342e940538b13dd41e0fa167dc9ab192b9f6e2eb
|
||
|
||
commit a47f6a6c0e06628eed0c2a08dc31a8923bcc37ba
|
||
Author: naddy@openbsd.org <naddy@openbsd.org>
|
||
Date: Thu Feb 6 22:30:54 2020 +0000
|
||
|
||
upstream: Replace "security key" with "authenticator" in program
|
||
|
||
messages.
|
||
|
||
This replaces "security key" in error/usage/verbose messages and
|
||
distinguishes between "authenticator" and "authenticator-hosted key".
|
||
|
||
ok djm@
|
||
|
||
OpenBSD-Commit-ID: 7c63800e9c340c59440a054cde9790a78f18592e
|
||
|
||
commit 849a9b87144f8a5b1771de6c85e44bfeb86be9a9
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Thu Feb 6 11:28:14 2020 +1100
|
||
|
||
Don't look for UINT32_MAX in inttypes.h
|
||
|
||
... unless we are actually going to use it. Fixes build on HP-UX
|
||
without the potential impact to other platforms of a header change
|
||
shortly before release.
|
||
|
||
commit a2437f8ed0c3be54ddd21630a93c68ebd168286f
|
||
Author: Damien Miller <djm@mindrot.org>
|
||
Date: Thu Feb 6 12:02:22 2020 +1100
|
||
|
||
depend
|
||
|
||
commit 9716e8c4956acdd7b223d1642bfa376e07e7503d
|
||
Author: Michael Forney <mforney@mforney.org>
|
||
Date: Wed Nov 27 19:17:26 2019 -0800
|
||
|
||
Fix sha2 MAKE_CLONE no-op definition
|
||
|
||
The point of the dummy declaration is so that MAKE_CLONE(...) can have
|
||
a trailing semicolon without introducing an empty declaration. So,
|
||
the macro replacement text should *not* have a trailing semicolon,
|
||
just like DEF_WEAK.
|
||
|
||
commit d596b1d30dc158915a3979fa409d21ff2465b6ee
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Tue Feb 4 09:58:04 2020 +0000
|
||
|
||
upstream: require FIDO application strings to start with "ssh:"; ok
|
||
|
||
markus@
|
||
|
||
OpenBSD-Commit-ID: 94e9c1c066d42b76f035a3d58250a32b14000afb
|
||
|
||
commit 501f3582438cb2cb1cb92be0f17be490ae96fb23
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Mon Feb 3 23:47:57 2020 +0000
|
||
|
||
upstream: revert enabling UpdateHostKeys by default - there are still
|
||
|
||
corner cases we need to address; ok markus
|
||
|
||
OpenBSD-Commit-ID: ff7ad941bfdc49fb1d8baa95fd0717a61adcad57
|
||
|
||
commit 072f3b832d2a4db8d9880effcb6c4d0dad676504
|
||
Author: jmc@openbsd.org <jmc@openbsd.org>
|
||
Date: Mon Feb 3 08:15:37 2020 +0000
|
||
|
||
upstream: use better markup for challenge and write-attestation, and
|
||
|
||
rejig the challenge text a little;
|
||
|
||
ok djm
|
||
|
||
OpenBSD-Commit-ID: 9f351e6da9edfdc907d5c3fdaf2e9ff3ab0a7a6f
|
||
|
||
commit 262eb05a22cb1fabc3bc1746c220566490b80229
|
||
Author: Damien Miller <djm@mindrot.org>
|
||
Date: Mon Feb 3 21:22:15 2020 +1100
|
||
|
||
mention libfido2 in dependencies section
|
||
|
||
commit ccd3b247d59d3bde16c3bef0ea888213fbd6da86
|
||
Author: Damien Miller <djm@mindrot.org>
|
||
Date: Mon Feb 3 19:40:12 2020 +1100
|
||
|
||
add clock_gettime64(2) to sandbox allowed syscalls
|
||
|
||
bz3093
|
||
|
||
commit adffbe1c645ad2887ba0b6d24c194aa7a40c5735
|
||
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
||
Date: Sun Feb 2 09:45:34 2020 +0000
|
||
|
||
upstream: Output (none) in debug in the case in the CheckHostIP=no case
|
||
|
||
as suggested by markus@
|
||
|
||
OpenBSD-Commit-ID: 4ab9117ee5261cbbd1868717fcc3142eea6385cf
|
||
|
||
commit 58c819096a2167983e55ae686486ce317b69b2d1
|
||
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
||
Date: Sun Feb 2 09:22:22 2020 +0000
|
||
|
||
upstream: Prevent possible null pointer deref of ip_str in debug.
|
||
|
||
OpenBSD-Commit-ID: 37b252e2e6f690efed6682437ef75734dbc8addf
|
||
|
||
commit 0facae7bc8d3f8f9d02d0f6bed3d163ff7f39806
|
||
Author: jmc@openbsd.org <jmc@openbsd.org>
|
||
Date: Sun Feb 2 07:36:50 2020 +0000
|
||
|
||
upstream: shuffle the challenge keyword to keep the -O list sorted;
|
||
|
||
OpenBSD-Commit-ID: 08efad608b790949a9a048d65578fae9ed5845fe
|
||
|
||
commit 6fb3dd0ccda1c26b06223b87bcd1cab9ec8ec3cc
|
||
Author: jmc@openbsd.org <jmc@openbsd.org>
|
||
Date: Sat Feb 1 06:53:12 2020 +0000
|
||
|
||
upstream: tweak previous;
|
||
|
||
OpenBSD-Commit-ID: 0c42851cdc88583402b4ab2b110a6348563626d3
|
||
|
||
commit 92725d4d3fde675acc0ca040b48f3d0c7be73b7f
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Sat Feb 1 17:25:09 2020 +1100
|
||
|
||
Use sys-queue.h from compat library.
|
||
|
||
Fixes build on platforms that don't have sys/queue.h (eg MUSL).
|
||
|
||
commit 677d0ece67634262b3b96c3cd6410b19f3a603b7
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Fri Jan 31 23:25:08 2020 +0000
|
||
|
||
upstream: regress test for sshd_config Include directive; from Jakub
|
||
|
||
Jelen
|
||
|
||
OpenBSD-Regress-ID: 0d9224de3297c7a5f51ba68d6e3725a2a9345fa4
|
||
|
||
commit d4f4cdd681ab6408a98419f398b75a55497ed324
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Fri Jan 31 23:13:04 2020 +0000
|
||
|
||
upstream: whitespace
|
||
|
||
OpenBSD-Commit-ID: 564cf7a5407ecf5da2d94ec15474e07427986772
|
||
|
||
commit 245399dfb3ecebc6abfc2ef4ee2e650fa9f6942b
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Fri Jan 31 23:11:25 2020 +0000
|
||
|
||
upstream: force early logging to stderr if debug_flag (-d) is set;
|
||
|
||
avoids missing messages from re-exec config passing
|
||
|
||
OpenBSD-Commit-ID: 02484b8241c1f49010e7a543a7098e6910a8c9ff
|
||
|
||
commit 7365f28a66d1c443723fbe6f4a2612ea6002901e
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Fri Jan 31 23:08:08 2020 +0000
|
||
|
||
upstream: mistake in previous: filling the incorrect buffer
|
||
|
||
OpenBSD-Commit-ID: 862ee84bd4b97b529f64aec5d800c3dcde952e3a
|
||
|
||
commit c2bd7f74b0e0f3a3ee9d19ac549e6ba89013abaf
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Fri Jan 31 22:42:45 2020 +0000
|
||
|
||
upstream: Add a sshd_config "Include" directive to allow inclusion
|
||
|
||
of files. This has sensible semantics wrt Match blocks and accepts glob(3)
|
||
patterns to specify the included files. Based on patch by Jakub Jelen in
|
||
bz2468; feedback and ok markus@
|
||
|
||
OpenBSD-Commit-ID: 36ed0e845b872e33f03355b936a4fff02d5794ff
|
||
|
||
commit ba261a1dd33266168ead4f8f40446dcece4d1600
|
||
Author: jmc@openbsd.org <jmc@openbsd.org>
|
||
Date: Fri Jan 31 22:25:59 2020 +0000
|
||
|
||
upstream: spelling fix;
|
||
|
||
OpenBSD-Commit-ID: 3c079523c4b161725a4b15dd06348186da912402
|
||
|
||
commit 771891a044f763be0711493eca14b6b0082e030f
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Thu Jan 30 22:25:34 2020 +0000
|
||
|
||
upstream: document changed default for UpdateHostKeys
|
||
|
||
OpenBSD-Commit-ID: 25c390b21d142f78ac0106241d13441c4265fd2c
|
||
|
||
commit d53a518536c552672c00e8892e2aea28f664148c
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Thu Jan 30 22:19:32 2020 +0000
|
||
|
||
upstream: enable UpdateKnownHosts=yes if the configuration
|
||
|
||
specifies only the default known_hosts files, otherwise select
|
||
UpdateKnownHosts=ask; ok markus@
|
||
|
||
OpenBSD-Commit-ID: ab401a5ec4a33d2e1a9449eae6202e4b6d427df7
|
||
|
||
commit bb63ff844e818d188da4fed3c016e0a4eecbbf25
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Thu Jan 30 18:54:42 2020 +1100
|
||
|
||
Look in inttypes.h for UINT32_MAX.
|
||
|
||
Should prevent warnings on at least some AIX versions.
|
||
|
||
commit afeb6a960da23f0a5cbc4b80cca107c7504e932a
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Thu Jan 30 07:21:38 2020 +0000
|
||
|
||
upstream: use sshpkt_fatal() instead of plain fatal() for
|
||
|
||
ssh_packet_write_poll() failures here too as the former yields better error
|
||
messages; ok dtucker@
|
||
|
||
OpenBSD-Commit-ID: 1f7a6ca95bc2b716c2e948fc1370753be772d8e3
|
||
|
||
commit 65d6fd0a8a6f31c3ddf0c1192429a176575cf701
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Thu Jan 30 07:20:57 2020 +0000
|
||
|
||
upstream: check the return value of ssh_packet_write_poll() and
|
||
|
||
call sshpkt_fatal() if it fails; avoid potential busy-loop under some
|
||
circumstances. Based on patch by Mike Frysinger; ok dtucker@
|
||
|
||
OpenBSD-Commit-ID: c79fe5cf4f0cd8074cb6db257c1394d5139408ec
|
||
|
||
commit dce74eab0c0f9010dc84c62500a17771d0131ff3
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Thu Jan 30 07:20:05 2020 +0000
|
||
|
||
upstream: have sshpkt_fatal() save/restore errno before we
|
||
|
||
potentially call strerror() (via ssh_err()); ok dtucker
|
||
|
||
OpenBSD-Commit-ID: 5590df31d21405498c848245b85c24acb84ad787
|
||
|
||
commit 14ef4efe2bf4180e085ea6738fdbebc199458b0c
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Wed Jan 29 08:17:49 2020 +0000
|
||
|
||
upstream: markus suggests a simplification to previous
|
||
|
||
OpenBSD-Commit-ID: 10bbfb6607ebbb9a018dcd163f0964941adf58de
|
||
|
||
commit 101ebc3a8cfa78d2e615afffbef9861bbbabf1ff
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Wed Jan 29 07:51:30 2020 +0000
|
||
|
||
upstream: give more context to UpdateHostKeys messages, mentioning
|
||
|
||
that the changes are validated by the existing trusted host key. Prompted by
|
||
espie@ feedback and ok markus@
|
||
|
||
OpenBSD-Commit-ID: b3d95f4a45f2692f4143b9e77bb241184dbb8dc5
|
||
|
||
commit 24c0f752adf9021277a7b0a84931bb5fe48ea379
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Tue Jan 28 08:01:34 2020 +0000
|
||
|
||
upstream: changes to support FIDO attestation
|
||
|
||
Allow writing to disk the attestation certificate that is generated by
|
||
the FIDO token at key enrollment time. These certificates may be used
|
||
by an out-of-band workflow to prove that a particular key is held in
|
||
trustworthy hardware.
|
||
|
||
Allow passing in a challenge that will be sent to the card during
|
||
key enrollment. These are needed to build an attestation workflow
|
||
that resists replay attacks.
|
||
|
||
ok markus@
|
||
|
||
OpenBSD-Commit-ID: 457dc3c3d689ba39eed328f0817ed9b91a5f78f6
|
||
|
||
commit 156bef36f93a48212383235bb8e3d71eaf2b2777
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Tue Jan 28 07:24:15 2020 +0000
|
||
|
||
upstream: disable UpdateHostKeys=ask when in quiet mode; "work for
|
||
|
||
me" matthieu@
|
||
|
||
OpenBSD-Commit-ID: 60d7b5eb91accf935ed9852650a826d86db2ddc7
|
||
|
||
commit ec8a759b4045e54d6b38e690ffee4cbffc53c7b7
|
||
Author: Damien Miller <djm@mindrot.org>
|
||
Date: Tue Jan 28 12:57:25 2020 +1100
|
||
|
||
compat for missing IPTOS_DSCP_LE in system headers
|
||
|
||
commit 4594c7627680c4f41c2ad5fe412e55b7cc79b10c
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Tue Jan 28 01:49:36 2020 +0000
|
||
|
||
upstream: make IPTOS_DSCP_LE available via IPQoS directive; bz2986,
|
||
|
||
based on patch by veegish AT cyberstorm.mu
|
||
|
||
OpenBSD-Commit-ID: 9902bf4fbb4ea51de2193ac2b1d965bc5d99c425
|
||
|
||
commit da22216b5db3613325aa7b639f40dc017e4c6f69
|
||
Author: markus@openbsd.org <markus@openbsd.org>
|
||
Date: Mon Jan 27 20:51:32 2020 +0000
|
||
|
||
upstream: disable UpdateHostKeys=ask if command is specified; ok
|
||
|
||
djm@ sthen@
|
||
|
||
OpenBSD-Commit-ID: e5bcc45eadb78896637d4143d289f1e42c2ef5d7
|
||
|
||
commit 1e1db0544fdd788e2e3fc21d972a7ccb7de6b4ae
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Sun Jan 26 00:09:50 2020 +0000
|
||
|
||
upstream: unbreak unittests for recent API / source file changes
|
||
|
||
OpenBSD-Regress-ID: 075a899a01bbf7781d38bf0b33d8366faaf6d3c0
|
||
|
||
commit 0d1144769151edf65f74aee9a4c8545c37861695
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Sun Jan 26 15:09:15 2020 +1100
|
||
|
||
Move definition of UINT32_MAX.
|
||
|
||
This allows us to always define it if needed not just if we also
|
||
define the type ourself.
|
||
|
||
commit f73ab8a811bc874c2fb403012aa8e4bfdcaf5ec7
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Sun Jan 26 00:09:50 2020 +0000
|
||
|
||
upstream: unbreak unittests for recent API / source file changes
|
||
|
||
OpenBSD-Regress-ID: 075a899a01bbf7781d38bf0b33d8366faaf6d3c0
|
||
|
||
commit 0373f9eba2b63455dceedbd3ac3d5dca306789ff
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Sun Jan 26 14:09:17 2020 +1100
|
||
|
||
Include signal.h to prevent redefintion of _NSIG.
|
||
|
||
commit 638a45b5c1e20a8539100ca44166caad8abf26f8
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Sun Jan 26 13:40:51 2020 +1100
|
||
|
||
Wrap stdint.h in tests inside HAVE_STDINT_H.
|
||
|
||
commit 74dfc2c859c906eaab1f88a27fd883115ffb928f
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Sun Jan 26 00:14:45 2020 +0000
|
||
|
||
upstream: for UpdateHostKeys, don't report errors for unsupported
|
||
|
||
key types - just ignore them. spotted by and ok dtucker@
|
||
|
||
OpenBSD-Commit-ID: 91769e443f6197c983932fc8ae9d39948727d473
|
||
|
||
commit b59618246c332e251160be0f1e0e88a7d4e2b0ae
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Sun Jan 26 00:13:20 2020 +0000
|
||
|
||
upstream: downgrade error() for missing subsequent known_hosts
|
||
|
||
files to debug() as it was intended to be; spotted by dtucker@
|
||
|
||
OpenBSD-Commit-ID: 18cfea382cb52f2da761be524e309cc3d5354ef9
|
||
|
||
commit 469df611f778eec5950d556aabfe1d4efc227915
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Sat Jan 25 23:33:27 2020 +0000
|
||
|
||
upstream: clarify that BatchMode applies to all interactive prompts
|
||
|
||
(e.g. host key confirmation) and not just password prompts.
|
||
|
||
OpenBSD-Commit-ID: 97b001883d89d3fb1620d2e6b747c14a26aa9818
|
||
|
||
commit de40876c4a5d7c519d3d7253557572fdfc13db76
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Sat Jan 25 23:28:06 2020 +0000
|
||
|
||
upstream: tidy headers; some junk snuck into sshbuf-misc.c and
|
||
|
||
sshbuf-io.c doesn't need SSHBUF_INTERNAL set
|
||
|
||
OpenBSD-Commit-ID: 27a724d2e0b2619c1a1490f44093bbd73580d9e6
|
||
|
||
commit 6a107606355fa9547884cad6740e6144a7a7955b
|
||
Author: Damien Miller <djm@mindrot.org>
|
||
Date: Sun Jan 26 10:28:21 2020 +1100
|
||
|
||
depend
|
||
|
||
commit 59d01f1d720ebede4da42882f592d1093dac7adc
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Sat Jan 25 23:13:09 2020 +0000
|
||
|
||
upstream: improve the error message for u2f enrollment errors by
|
||
|
||
making ssh-keygen be solely responsible for printing the error message and
|
||
convertint some more common error responses from the middleware to a useful
|
||
ssherr.h status code. more detail remains visible via -v of course.
|
||
|
||
also remove indepedent copy of sk-api.h declarations in sk-usbhid.c
|
||
and just include it.
|
||
|
||
feedback & ok markus@
|
||
|
||
OpenBSD-Commit-ID: a4a8ffa870d9a3e0cfd76544bcdeef5c9fb1f1bb
|
||
|
||
commit 99aa8035554ddb976348d2a9253ab3653019728d
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Sat Jan 25 23:02:13 2020 +0000
|
||
|
||
upstream: factor out reading/writing sshbufs to dedicated
|
||
|
||
functions; feedback and ok markus@
|
||
|
||
OpenBSD-Commit-ID: dc09e5f1950b7acc91b8fdf8015347782d2ecd3d
|
||
|
||
commit 065064fcf455778b0918f783033b374d4ba37a92
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Sat Jan 25 22:49:38 2020 +0000
|
||
|
||
upstream: add a comment describing the ranges of channel IDs that
|
||
|
||
we use; requested by markus@
|
||
|
||
OpenBSD-Commit-ID: 83a1f09810ffa3a96a55fbe32675b34ba739e56b
|
||
|
||
commit 69334996ae203c51c70bf01d414c918a44618f8e
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Sat Jan 25 22:41:01 2020 +0000
|
||
|
||
upstream: make sshd_config:ClientAliveCountMax=0 disable the
|
||
|
||
connection killing behaviour, rather than killing the connection after
|
||
sending the first liveness test probe (regardless of whether the client was
|
||
responsive) bz2627; ok markus
|
||
|
||
OpenBSD-Commit-ID: 5af79c35f4c9fa280643b6852f524bfcd9bccdaf
|
||
|
||
commit bf986a9e2792555e0879a3145fa18d2b49436c74
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Sat Jan 25 22:36:22 2020 +0000
|
||
|
||
upstream: clarify order of AllowUsers/DenyUsers vs
|
||
|
||
AllowGroups/DenyGroups; bz1690, ok markus@
|
||
|
||
OpenBSD-Commit-ID: 5637584ec30db9cf64822460f41b3e42c8f9facd
|
||
|
||
commit 022ce92fa0daa9d78830baeb2bd2dc3f83c724ba
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Sat Jan 25 07:17:18 2020 +0000
|
||
|
||
upstream: when AddKeysToAgent=yes is set and the key contains no
|
||
|
||
comment, add the key to the agent with the key's path as the comment. bz2564
|
||
|
||
OpenBSD-Commit-ID: 8dd8ca9340d7017631a27f4ed5358a4cfddec16f
|
||
|
||
commit 0b813436bbf6546638b10c1fa71f54691bcf5e63
|
||
Author: tedu@openbsd.org <tedu@openbsd.org>
|
||
Date: Sat Jan 25 07:09:14 2020 +0000
|
||
|
||
upstream: group14-sha1 is no longer a default algorithm
|
||
|
||
OpenBSD-Commit-ID: a96f04d5e9c2ff760c6799579dc44f69b4ff431d
|
||
|
||
commit 3432b6e05d5c583c91c566c5708fed487cec79ac
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Sat Jan 25 07:02:51 2020 +0000
|
||
|
||
upstream: reword HashKnownHosts description a little more; some
|
||
|
||
people found the wording confusing (bz#2560)
|
||
|
||
OpenBSD-Commit-ID: ac30896598694f07d498828690aecd424c496988
|
||
|
||
commit f80d7d6aa98d6eddc5df02412efee6db75673d4c
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Sat Jan 25 07:01:00 2020 +0000
|
||
|
||
upstream: weaken the language for what HashKnownHosts provides with
|
||
|
||
regards to known_hosts name privacy, it's not practical for this option to
|
||
offer any guarantee that hostnames cannot be recovered from a disclosed
|
||
known_hosts file (e.g. by brute force).
|
||
|
||
OpenBSD-Commit-ID: 13f1e3285f8acf7244e9770074296bcf446c6972
|
||
|
||
commit 846446bf3e7421e6671a4afd074bdf15eecd7832
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Sat Jan 25 06:40:20 2020 +0000
|
||
|
||
upstream: the GatewayPorts vs -R listen address selection logic is
|
||
|
||
still confusing people, so add another comment explaining the special
|
||
handling of "localhost"; bz#3258
|
||
|
||
OpenBSD-Commit-ID: e6bf0f0fbf1c7092bf0dbd9c6eab105970b5b53a
|
||
|
||
commit 734f2f83f5ff86f2967a99d67be9ce22dd0394dd
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Sat Jan 25 06:03:10 2020 +0000
|
||
|
||
upstream: mention that permitopen=/PermitOpen do no name to address
|
||
|
||
translation; prompted by bz3099
|
||
|
||
OpenBSD-Commit-ID: 0dda8e54d566b29855e76bebf9cfecce573f5c23
|
||
|
||
commit e1e97cae19ff07b7a7f7e82556bc048c3c54af63
|
||
Author: Damien Miller <djm@mindrot.org>
|
||
Date: Sat Jan 25 16:30:22 2020 +1100
|
||
|
||
include tunnel device path in error message
|
||
|
||
commit 0ecd20bc9f0b9c7c697c9eb014613516c8f65834
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Sat Jan 25 04:48:26 2020 +0000
|
||
|
||
upstream: unrevert this:
|
||
|
||
> revision 1.217
|
||
> date: 2019/11/27 03:34:04; author: dtucker; state: Exp; lines: +5 -7; commitid: wkiMn49XJyjzoJIs;
|
||
> Make channel_id u_int32_t and remove unnecessary check and cast that were
|
||
> left over from the type conversion. Noted by t-hashida@amiya.co.jp in
|
||
> bz#3098, ok markus@ djm@
|
||
|
||
Darren was right the first time; ok dtucker@ "agreed" markus@
|
||
|
||
OpenBSD-Commit-ID: 641dd1b99a6bbd85b7160da462ae1be83432c7c8
|
||
|
||
commit a0c81d2402eedc514b9c9f25ef9604eb0576b86a
|
||
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
||
Date: Sat Jan 25 02:57:53 2020 +0000
|
||
|
||
upstream: Move setting $NC into test-exec since it's now used by
|
||
|
||
multiple tests, and in -portable we use our own local copy to avoid
|
||
portability problems.
|
||
|
||
OpenBSD-Regress-ID: ceb78445fcaac317bec2fc51b3f0d9589048c114
|
||
|
||
commit e16dfa94f86358033531c4a97dcb51508ef84d49
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Sat Jan 25 13:05:42 2020 +1100
|
||
|
||
Put EC key export inside OPENSSL_HAS_ECC.
|
||
|
||
Fixes link error when building against an OpenSSL that does not have
|
||
ECC.
|
||
|
||
commit 94a2e5951b374e1a89761ceaff72e66eb1946807
|
||
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
||
Date: Sat Jan 25 00:27:56 2020 +0000
|
||
|
||
upstream: Wait a bit longer for the multiplex master to become ready
|
||
|
||
since on very slow hosts the current delay is not sufficient and the test
|
||
will fail.
|
||
|
||
OpenBSD-Regress-ID: 6d90c7475d67ac3a95610b64af700629ece51a48
|
||
|
||
commit b2df804f571d77b07059f087b90955ffbc2f67d4
|
||
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
||
Date: Fri Jan 24 10:08:17 2020 +0000
|
||
|
||
upstream: Add a connection test for proxycommand. This would have
|
||
|
||
caught the problem caused by ssh.c rev 1.507 wherein Host and Hostname were
|
||
swapped. Prompted by beck@
|
||
|
||
OpenBSD-Regress-ID: d218500ae6aca4c479c27318fb5b09ebc00f7aae
|
||
|
||
commit c6f06fd38a257b9fcc7d6760f8fb6d505dccb628
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Sat Jan 25 00:22:31 2020 +0000
|
||
|
||
upstream: set UpdateKnownHosts=ask by default; bz#2894; ok
|
||
|
||
markus@
|
||
|
||
OpenBSD-Commit-ID: f09cb3177f3a14c96428e14f347e976a8a531fee
|
||
|
||
commit 7955633a554397bc24913cec9fd7285002935f7e
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Sat Jan 25 00:21:08 2020 +0000
|
||
|
||
upstream: allow UpdateKnownHosts=yes to function when multiple
|
||
|
||
known_hosts files are in use. When updating host keys, ssh will now search
|
||
subsequent known_hosts files, but will add new/changed host keys to the first
|
||
specified file only. bz#2738
|
||
|
||
ok markus@
|
||
|
||
OpenBSD-Commit-ID: 6ded6d878a03e57d5aa20bab9c31f92e929dbc6c
|
||
|
||
commit e5a278a62ab49dffe96929fa8d8506c6928dba90
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Sat Jan 25 00:06:48 2020 +0000
|
||
|
||
upstream: process security key provider via realpath() in agent,
|
||
|
||
avoids malicious client from being able to cause agent to load arbitrary
|
||
libraries into ssh-sk-helper.
|
||
|
||
reported by puck AT puckipedia.com; ok markus
|
||
|
||
OpenBSD-Commit-ID: 1086643df1b7eee4870825c687cf0c26a6145d1c
|
||
|
||
commit 89a8d4525e8edd9958ed3df60cf683551142eae0
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Sat Jan 25 00:03:36 2020 +0000
|
||
|
||
upstream: expose PKCS#11 key labels/X.509 subjects as comments
|
||
|
||
Extract the key label or X.509 subject string when PKCS#11 keys
|
||
are retrieved from the token and plumb this through to places where
|
||
it may be used as a comment.
|
||
|
||
based on https://github.com/openssh/openssh-portable/pull/138
|
||
by Danielle Church
|
||
|
||
feedback and ok markus@
|
||
|
||
OpenBSD-Commit-ID: cae1fda10d9e10971dea29520916e27cfec7ca35
|
||
|
||
commit a8c05c640873621681ab64d2e47a314592d5efa2
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Fri Jan 24 23:56:01 2020 +0000
|
||
|
||
upstream: tweak proctitle to include sshd arguments, as these are
|
||
|
||
frequently used to distinguish between multiple independent instances of the
|
||
server. New proctitle looks like this:
|
||
|
||
$ pgrep -lf sshd
|
||
12844 sshd: /usr/sbin/sshd -f /etc/ssh/sshd_config [listener] 0 of 10-100 startups
|
||
|
||
requested by sthen@ and aja@; ok aja@
|
||
|
||
OpenBSD-Commit-ID: cf235a561c655a3524a82003cf7244ecb48ccc1e
|
||
|
||
commit 8075fccbd4f70a4371acabcfb47562471ff0de6f
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Fri Jan 24 23:54:40 2020 +0000
|
||
|
||
upstream: add xextendf() to extend a string with a format
|
||
|
||
(reallocating as necessary). ok aja@ as part of a larger diff
|
||
|
||
OpenBSD-Commit-ID: 30796b50d330b3e0e201747fe40cdf9aa70a77f9
|
||
|
||
commit d15c8adf2c6f1a6b4845131074383eb9c3d05c3d
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Fri Jan 24 05:33:01 2020 +0000
|
||
|
||
upstream: minor tweaks to ssh-keygen -Y find-principals:
|
||
|
||
emit matched principals one per line to stdout rather than as comma-
|
||
separated and with a free-text preamble (easy confusion opportunity)
|
||
|
||
emit "not found" error to stderr
|
||
|
||
fix up argument testing for -Y operations and improve error message for
|
||
unsupported operations
|
||
|
||
OpenBSD-Commit-ID: 3d9c9a671ab07fc04a48f543edfa85eae77da69c
|
||
|
||
commit c3368a5d5ec368ef6bdf9971d6330ca0e3bdca06
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Fri Jan 24 00:28:57 2020 +0000
|
||
|
||
upstream: remove ssh-rsa (SHA1) from the list of allowed CA
|
||
|
||
signature algorithms ok markus
|
||
|
||
OpenBSD-Commit-ID: da3481fca8c81e6951f319a86b7be67502237f57
|
||
|
||
commit 4a41d245d6b13bd3882c8dc058dbd2e2b39a9f67
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Fri Jan 24 00:27:04 2020 +0000
|
||
|
||
upstream: when signing a certificate with an RSA key, default to
|
||
|
||
a safe signature algorithm (rsa-sha-512) if not is explicitly specified by
|
||
the user; ok markus@
|
||
|
||
OpenBSD-Commit-ID: e05f638f0be6c0266e1d3d799716b461011e83a9
|
||
|
||
commit 8dfb6a202c96cdf037c8ce05e53e32e0e0b7b454
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Fri Jan 24 00:00:31 2020 +0000
|
||
|
||
upstream: allow PEM export of DSA and ECDSA keys; bz3091, patch
|
||
|
||
from Jakub Jelen ok markus@
|
||
|
||
OpenBSD-Commit-ID: a58edec8b9f07acab4b962a71a5125830d321b51
|
||
|
||
commit 72a8bea2d748c8bd7f076a8b39a52082c79ae95f
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Thu Jan 23 23:31:52 2020 +0000
|
||
|
||
upstream: ssh-keygen -Y find-principals fixes based on feedback
|
||
|
||
from Markus:
|
||
|
||
use "principals" instead of principal, as allowed_signers lines may list
|
||
multiple.
|
||
|
||
When the signing key is a certificate, emit only principals that match
|
||
the certificate principal list.
|
||
|
||
NB. the command -Y name changes: "find-principal" => "find-principals"
|
||
|
||
ok markus@
|
||
|
||
OpenBSD-Commit-ID: ab575946ff9a55624cd4e811bfd338bf3b1d0faf
|
||
|
||
commit 0585b5697201f5d8b32e6f1b0fee7e188268d30d
|
||
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
||
Date: Fri Jan 24 01:29:23 2020 +0000
|
||
|
||
upstream: Do not warn about permissions on symlinks.
|
||
|
||
OpenBSD-Regress-ID: 339d4cbae224bd8743ffad9c3afb0cf3cb66c357
|
||
|
||
commit 415192348a5737a960f6d1b292a17b64d55b542c
|
||
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
||
Date: Thu Jan 23 11:19:12 2020 +0000
|
||
|
||
upstream: Handle zlib compression being disabled now that it's
|
||
|
||
optional.
|
||
|
||
OpenBSD-Regress-ID: 0af4fbc5168e62f89d0350de524bff1cb00e707a
|
||
|
||
commit fbce7c1a898ae75286349822950682cf46346121
|
||
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
||
Date: Thu Jan 23 10:53:04 2020 +0000
|
||
|
||
upstream: Fix typo in comment.
|
||
|
||
OpenBSD-Commit-ID: d1d7a6553208bf439378fd1cf686a828aceb353a
|
||
|
||
commit ba247af8e9e302910e22881ef9d307a8afeef036
|
||
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
||
Date: Thu Jan 23 10:19:59 2020 +0000
|
||
|
||
upstream: When checking for unsafe directories, ignore non-directories
|
||
|
||
(ie symlinks, where permissions are not relevant).
|
||
|
||
OpenBSD-Regress-ID: fb6cfc8b022becb62b2dcb99ed3f072b3326e501
|
||
|
||
commit 74deb7029be4c00810443114aac9308875a81dae
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Thu Jan 23 22:17:24 2020 +1100
|
||
|
||
zlib is now optional.
|
||
|
||
commit 633a2af47ee90291aaf93969aeee1e5046074c7c
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Thu Jan 23 22:16:51 2020 +1100
|
||
|
||
Plumb WITH_ZLIB into configure.
|
||
|
||
This allows zlib support to be disabled by ./configure --without-zlib.
|
||
|
||
commit 7f8e66fea8c4e2a910df9067cb7638999b7764d5
|
||
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
||
Date: Thu Jan 23 10:24:29 2020 +0000
|
||
|
||
upstream: Make zlib optional. This adds a "ZLIB" build time option
|
||
|
||
that allows building without zlib compression and associated options. With
|
||
feedback from markus@, ok djm@
|
||
|
||
OpenBSD-Commit-ID: 44c6e1133a90fd15a3aa865bdedc53bab28b7910
|
||
|
||
commit 69ac4e33023b379e9a8e9b4b6aeeffa6d1fcf6fa
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Thu Jan 23 07:54:04 2020 +0000
|
||
|
||
upstream: remove trailing period characters from pub/priv key
|
||
|
||
pathnames - they make them needlessly more difficult to cut and paste without
|
||
error; ok markus@ & dtucker@
|
||
|
||
OpenBSD-Commit-ID: abdcfd1a5723fcac0711feee7665edc66ae2335a
|
||
|
||
commit 945bf52c3c815d95b1e842ebf6c910c3524bd5bb
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Thu Jan 23 21:06:45 2020 +1100
|
||
|
||
Fix a couple of mysig_t leftovers.
|
||
|
||
commit 84226b447d45fe4542613de68c2ca59a890d7c01
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Thu Jan 23 18:55:24 2020 +1100
|
||
|
||
Remove mysignal wrapper.
|
||
|
||
We switched the main code to use sigaction(), so the wrapper is no
|
||
longer used.
|
||
|
||
commit 5533c2fb7ef21172fa3708d66b03faa2c6b3d93f
|
||
Author: jmc@openbsd.org <jmc@openbsd.org>
|
||
Date: Thu Jan 23 07:16:38 2020 +0000
|
||
|
||
upstream: new sentence, new line;
|
||
|
||
OpenBSD-Commit-ID: b6c3f2f36ec77e99198619b38a9f146655281925
|
||
|
||
commit 3bf2a6ac791d64046a537335a0f1d5e43579c5ad
|
||
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
||
Date: Thu Jan 23 07:10:22 2020 +0000
|
||
|
||
upstream: Replace all calls to signal(2) with a wrapper around
|
||
|
||
sigaction(2). This wrapper blocks all other signals during the handler
|
||
preventing races between handlers, and sets SA_RESTART which should reduce
|
||
the potential for short read/write operations.
|
||
|
||
OpenBSD-Commit-ID: 5e047663fd77a40d7b07bdabe68529df51fd2519
|
||
|
||
commit e027c044c796f3a01081a91bee55741204283f28
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Thu Jan 23 04:54:34 2020 +0000
|
||
|
||
upstream: missing header change from previous; spotted by dtucker@
|
||
|
||
OpenBSD-Commit-ID: 321ce74c0a5bbd0f02fa3f20cb5cf2a952c6b96f
|
||
|
||
commit 7e1323102b1b04eef391b01e180710a2d408a7ab
|
||
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
||
Date: Thu Jan 23 03:42:41 2020 +0000
|
||
|
||
upstream: Check for and warn about StrictModes permission problems. ok tb@
|
||
|
||
OpenBSD-Regress-ID: 4841704ccdee50ee7efc6035bc686695c6ac2991
|
||
|
||
commit 84de1c27f845d15c859db44e7070a46f45504b66
|
||
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
||
Date: Thu Jan 23 03:35:07 2020 +0000
|
||
|
||
upstream: Also test PuTTY chacha20.
|
||
|
||
OpenBSD-Regress-ID: 7af6a0e8763b05f1f8eee6bca5f31fcb16151040
|
||
|
||
commit c7ed15a39695ecd5f1f21842d8d9cd22246d4ee2
|
||
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
||
Date: Thu Jan 23 03:24:38 2020 +0000
|
||
|
||
upstream: Also test PuTTY ecdh kex methods.
|
||
|
||
OpenBSD-Regress-ID: ec4017dce612131842398a03e93007a869c2c133
|
||
|
||
commit c4b3a128954ee1b7fbcbda167baf8aca1a3d1c84
|
||
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
||
Date: Thu Jan 23 02:46:49 2020 +0000
|
||
|
||
upstream: Remove unsupported algorithms from list of defaults at run
|
||
|
||
time and remove ifdef and distinct settings for OPENSSL=no case.
|
||
|
||
This will make things much simpler for -portable where the exact set
|
||
of algos depends on the configuration of both OpenSSH and the libcrypto
|
||
it's linked against (if any). ok djm@
|
||
|
||
OpenBSD-Commit-ID: e0116d0183dcafc7a9c40ba5fe9127805c5dfdd2
|
||
|
||
commit 56cffcc09f8a2e661d2ba02e61364ae6f998b2b1
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Thu Jan 23 02:43:48 2020 +0000
|
||
|
||
upstream: add a new signature operations "find-principal" to look
|
||
|
||
up the principal associated with a signature from an allowed-signers file.
|
||
Work by Sebastian Kinne; ok dtucker@
|
||
|
||
OpenBSD-Commit-ID: 6f782cc7e18e38fcfafa62af53246a1dcfe74e5d
|
||
|
||
commit 65cf8730de6876a56595eef296e07a86c52534a6
|
||
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
||
Date: Wed Jan 22 07:38:30 2020 +0000
|
||
|
||
upstream: Ignore whitespace when checking explict fingerprint.
|
||
|
||
When confirming a host key using the fingerprint itself, ignore leading and
|
||
trailing whitespace. ok deraadt@ djm@
|
||
|
||
OpenBSD-Commit-ID: cafd7f803bbdcd40c3a8f8f1a77747e6b6d8c011
|
||
|
||
commit 8d3af6ebdf524b34087a0a3ae415b5141ba10572
|
||
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
||
Date: Wed Jan 22 07:31:27 2020 +0000
|
||
|
||
upstream: Increase keyscan timeout from default. On slow hosts 3
|
||
|
||
concurrent keyscans can hit the default 5 second timeout, so increase to 15
|
||
seconds.
|
||
|
||
OpenBSD-Regress-ID: 16383dec166af369b7fb9948572856f5d544c93f
|
||
|
||
commit 6c30c9adbeeed09a8a9e7a69974cfa1f1ddd1e9e
|
||
Author: tedu@openbsd.org <tedu@openbsd.org>
|
||
Date: Wed Jan 22 04:58:23 2020 +0000
|
||
|
||
upstream: remove diffie-hellman-group14-sha1 from default kex to
|
||
|
||
see what happens. general mostly ok
|
||
|
||
OpenBSD-Commit-ID: 216b7b8462d2ef5f4531f26cb2cb839b2153dad9
|
||
|
||
commit 4a32c0ca44a2dc2a358f69b5d43c08e528b44b39
|
||
Author: claudio@openbsd.org <claudio@openbsd.org>
|
||
Date: Wed Jan 22 04:51:51 2020 +0000
|
||
|
||
upstream: For ssh-keygen -lF only add a space after key fingerprint
|
||
|
||
when there is a comment. This makes copy-paste of fingerprints into ssh
|
||
easier. OK djm@
|
||
|
||
OpenBSD-Commit-ID: fa01d95624f65c1eb4dc7c575d20d77c78010dfd
|
||
|
||
commit 37d3b736506760e4ebc7fe56255f7b8ea823a00c
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Wed Jan 22 04:49:16 2020 +0000
|
||
|
||
upstream: some __func__ and strerror(errno) here; no functional
|
||
|
||
change
|
||
|
||
OpenBSD-Commit-ID: 6c3ddd5f848b99ea560b31d3fba99ceed66cef37
|
||
|
||
commit e2031b05c74c98b141179ceab13a323cf17d01e5
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Wed Jan 22 02:25:21 2020 +0000
|
||
|
||
upstream: factor out parsing of allowed-signers lines
|
||
|
||
OpenBSD-Commit-ID: 85ee6aeff608371826019ea85e55bfa87f79d06e
|
||
|
||
commit 47160e1de8c2f638f0ef41cef42c976417b61778
|
||
Author: Damien Miller <djm@mindrot.org>
|
||
Date: Wed Jan 22 10:30:13 2020 +1100
|
||
|
||
unbreak fuzzer support for recent ssh-sk.h changes
|
||
|
||
commit 70d38c3cfd4550e8ee66cc3bf1b91aa339c91df5
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Tue Jan 21 22:39:57 2020 +0000
|
||
|
||
upstream: expose the number of currently-authenticating connections
|
||
|
||
along with the MaxStartups limit in the proctitle; suggestion from Philipp
|
||
Marek, w/ feedback from Craig Miskell ok dtucker@
|
||
|
||
OpenBSD-Commit-ID: a4a6db2dc1641a5df8eddf7d6652176e359dffb3
|
||
|
||
commit a78c66d5d2144bd49779bc80a647346bd3d7233d
|
||
Author: naddy@openbsd.org <naddy@openbsd.org>
|
||
Date: Tue Jan 21 12:40:04 2020 +0000
|
||
|
||
upstream: document the default value of the ControlPersist option;
|
||
|
||
ok dtucker@ djm@
|
||
|
||
OpenBSD-Commit-ID: 0788e7f2b5a9d4e36d3d2ab378f73329320fef66
|
||
|
||
commit b46a6325849e40aa2e4b0d962a6f00f708f6576a
|
||
Author: Damien Miller <djm@mindrot.org>
|
||
Date: Wed Jan 22 09:28:32 2020 +1100
|
||
|
||
remove accidental change in f8c11461
|
||
|
||
commit 80d3bebcab96fe1d177e45906e10db16895da01d
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Tue Jan 21 11:06:09 2020 +0000
|
||
|
||
upstream: don't #ifdef out the KRL code when compiling without
|
||
|
||
libcrypto support; it works just fine and disabling it breaks a few tests. ok
|
||
dtucker@
|
||
|
||
OpenBSD-Commit-ID: 65f6272c4241eb4b04de78b012fe98b2b555ad44
|
||
|
||
commit f8c11461aa6db168fc5e7eeae448b4cbbf59642a
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Tue Jan 21 08:06:27 2020 +0000
|
||
|
||
upstream: pass SSH_SK_HELPER explicitly past $SUDO to avoid it getting
|
||
|
||
cleared; with dtucker@
|
||
|
||
OpenBSD-Regress-ID: 03178a0580324bf0dff28f7eac6c3edbc5407f8e
|
||
|
||
commit b5fcb0ac1cc0ef01aeec1c089146298654ab3ae0
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Tue Jan 21 07:07:31 2020 +0000
|
||
|
||
upstream: check access(ssh-sk-helper, X_OK) to provide friendly
|
||
|
||
error message for misconfigured helper paths
|
||
|
||
OpenBSD-Commit-ID: 061bcc262155d12e726305c91394ac0aaf1f8341
|
||
|
||
commit 56bced43c14dc6fa2bfa1816007e441644105609
|
||
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
||
Date: Tue Jan 21 06:09:56 2020 +0000
|
||
|
||
upstream: Document sntrup4591761x25519-sha512@tinyssh.org. Patch
|
||
|
||
from jtesta@positronsecurity.com via github PR#151.
|
||
|
||
OpenBSD-Commit-ID: f3d48168623045c258245c340a5a2af7dbb74edc
|
||
|
||
commit 4a05d789b86314fef7303824f69defbc6b96ed60
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Tue Jan 21 05:56:56 2020 +0000
|
||
|
||
upstream: fix ssh-keygen not displaying authenticator touch
|
||
|
||
prompt; reported by jmc@
|
||
|
||
OpenBSD-Commit-ID: 04d4f582fc194eb3897ebcbfe286c49958ba2859
|
||
|
||
commit 881aded0389d999375f926051491a944c6d8752b
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Tue Jan 21 05:56:27 2020 +0000
|
||
|
||
upstream: a little more verbosity in sign_and_send_pubkey() debug
|
||
|
||
messages
|
||
|
||
OpenBSD-Commit-ID: 6da47a0e6373f6683006f49bc2a516d197655508
|
||
|
||
commit b715fdc71bbd009d0caff691ab3fc04903c4aee8
|
||
Author: naddy@openbsd.org <naddy@openbsd.org>
|
||
Date: Sat Jan 18 21:16:43 2020 +0000
|
||
|
||
upstream: one more replacement "(security) key" -> "(FIDO)
|
||
|
||
authenticator"
|
||
|
||
OpenBSD-Commit-ID: 031bca03c1d1f878ab929facd561911f1bc68dfd
|
||
|
||
commit 84911da1beeb6ed258a43468efb316cd39fb6855
|
||
Author: naddy@openbsd.org <naddy@openbsd.org>
|
||
Date: Sat Jan 18 15:45:41 2020 +0000
|
||
|
||
upstream: undo merge error and replace the term "security key"
|
||
|
||
again
|
||
|
||
OpenBSD-Commit-ID: 341749062c089cc360a7877e9ee3a887aecde395
|
||
|
||
commit e8c06c4ee708720efec12cd1a6f78a3c6d76b7f0
|
||
Author: naddy@openbsd.org <naddy@openbsd.org>
|
||
Date: Fri Jan 17 20:13:47 2020 +0000
|
||
|
||
upstream: Document loading of resident keys from a FIDO
|
||
|
||
authenticator.
|
||
|
||
* Rename -O to -K to keep "-O option" available.
|
||
* Document -K.
|
||
* Trim usage() message down to synopsis, like all other commands.
|
||
|
||
ok markus@
|
||
|
||
OpenBSD-Commit-ID: 015c2c4b28f8e19107adc80351b44b23bca4c78a
|
||
|
||
commit 0d005d6372a067b59123dec8fc6dc905f2c09e1e
|
||
Author: naddy@openbsd.org <naddy@openbsd.org>
|
||
Date: Tue Jan 14 15:07:30 2020 +0000
|
||
|
||
upstream: sync ssh-keygen.1 and ssh-keygen's usage() with each
|
||
|
||
other and reality ok markus@
|
||
|
||
OpenBSD-Commit-ID: cdf64454f2c3604c25977c944e5b6262a3bcce92
|
||
|
||
commit b8a4ca2ebfddab862f7eb1ea2a07fb9f70330429
|
||
Author: naddy@openbsd.org <naddy@openbsd.org>
|
||
Date: Sat Jan 11 16:23:10 2020 +0000
|
||
|
||
upstream: revise the fix for reversed arguments on
|
||
|
||
expand_proxy_command()
|
||
|
||
Always put 'host' before 'host_arg' for consistency. ok markus@ djm@
|
||
|
||
OpenBSD-Commit-ID: 1ba5b25472779f1b1957295fcc6907bb961472a3
|
||
|
||
commit 57b181eaf2d34fd0a1b51ab30cb6983df784de5a
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Fri Jan 10 23:43:26 2020 +0000
|
||
|
||
upstream: pass the log-on-stderr flag and log level through to
|
||
|
||
ssh-sk-helper, making debugging a bit easier. ok markus@
|
||
|
||
OpenBSD-Commit-ID: 2e7aea6bf5770d3f38b7c7bba891069256c5a49a
|
||
|
||
commit a8bd5fdbdb7581afc7123a042a7cd6ca25357388
|
||
Author: Damien Miller <djm@mindrot.org>
|
||
Date: Tue Jan 21 12:32:16 2020 +1100
|
||
|
||
Wrap copy_environment_blacklist() in #ifdef
|
||
|
||
It's only needed for USE_PAM or HAVE_CYGWIN cases and will cause compiler
|
||
warnings otherwise.
|
||
|
||
commit 10ecc647fc1db8d2dde9f6b9b826b201dfc48b62
|
||
Author: Damien Miller <djm@mindrot.org>
|
||
Date: Tue Jan 21 12:20:05 2020 +1100
|
||
|
||
depend
|
||
|
||
commit b3f7009c9ffa5891283ed96e043001e09934a8d4
|
||
Author: Ruben Kerkhof <ruben@rubenkerkhof.com>
|
||
Date: Mon Jan 20 11:56:48 2020 +0100
|
||
|
||
Fix missing prototype warning for copy_environment
|
||
|
||
This function is only used in this file, and only on Cygwin, so make
|
||
it static and hide it behind HAVE_CYGWIN. Prevents missing prototype
|
||
warning.
|
||
|
||
commit 0c428c0e991e2c4fabc48cf5d9b8f84c9412e0c3
|
||
Author: Ruben Kerkhof <ruben@rubenkerkhof.com>
|
||
Date: Mon Jan 20 13:58:11 2020 +0100
|
||
|
||
configure.ac: fix ldns test
|
||
|
||
When running ./configure --with-ldns, if ldns-config cannot be found, we
|
||
add -Iyes/include to CPPFLAGS and -Lyes/lib to LDFLAGS. Fix that.
|
||
|
||
commit 6089abf715e2784751c9f62697e09bb103295b93
|
||
Author: Ruben Kerkhof <ruben@rubenkerkhof.com>
|
||
Date: Mon Jan 20 12:13:26 2020 +0100
|
||
|
||
Make sshpam_password_change_required static.
|
||
|
||
sshpam_password_change_required is only used in auth-pam.c, so make it
|
||
static to prevent a mising prototype warning.
|
||
|
||
commit 5a9b9c82851b7bc219dc3a65962a80803c76c102
|
||
Author: Ruben Kerkhof <ruben@rubenkerkhof.com>
|
||
Date: Mon Jan 20 12:24:51 2020 +0100
|
||
|
||
sandbox-darwin.c: fix missing prototypes.
|
||
|
||
Include the right header just like the other sandbox files.
|
||
Fixes missing prototype warnings for ssh_sandbox_* functions.
|
||
|
||
commit 335dc93526942a650f6c69666b3f6ca44d0a2910
|
||
Author: Ruben Kerkhof <ruben@rubenkerkhof.com>
|
||
Date: Mon Jan 20 11:09:27 2020 +0100
|
||
|
||
Fix a few warnings when on Mac OS X.
|
||
|
||
Include stdlib.h for calloc, malloc, free and setenv.
|
||
|
||
commit 0488dc2d3050ea1a99ef5cf44afc50ffbf3f1315
|
||
Author: Ruben Kerkhof <ruben@rubenkerkhof.com>
|
||
Date: Mon Jan 20 10:32:23 2020 +0100
|
||
|
||
Fix building without openssl.
|
||
|
||
This fixes the following when there are no openssl headers on the system:
|
||
ssh-ecdsa-sk.c:34:10: fatal error: 'openssl/bn.h' file not found
|
||
|
||
commit e6b7157b4ef29c83ec3a2d1d7c927e4b8898f9bb
|
||
Author: Ruben Kerkhof <ruben@rubenkerkhof.com>
|
||
Date: Wed Jan 15 16:08:55 2020 +0100
|
||
|
||
Add config.log to .gitignore
|
||
|
||
commit 515e10ddf9644010b88cfd7ecf601f4306d42232
|
||
Author: Ruben Kerkhof <ruben@rubenkerkhof.com>
|
||
Date: Wed Jan 15 16:16:31 2020 +0100
|
||
|
||
Fix typo in README.md, s/crytpo/crypto/
|
||
|
||
commit 1af3354aea3c4bfa5b5ecfb5d1ff3ad231c2073c
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Wed Jan 15 16:22:36 2020 +1100
|
||
|
||
Wrap stdint.h in ifdef HAVE_STDINT_H.
|
||
|
||
commit 429170f273ce1b0140f8111a45ba69390d98de3a
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Tue Jan 14 14:41:47 2020 +1100
|
||
|
||
Wrap stdint.h inside HAVE_STDINT_H.
|
||
|
||
commit a0989b60211b6f1c2313e1397c526d883a23a075
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Tue Jan 14 14:26:41 2020 +1100
|
||
|
||
Include compat header for definitions.
|
||
|
||
commit e0cedcad51fe02683943bf4f1ad2961aa3f35313
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Tue Jan 14 09:42:52 2020 +1100
|
||
|
||
Improve search for 'struct timespec'.
|
||
|
||
Make struct timespec test consistent with existing timeval test.
|
||
Include time.h for timespec in compat header where required.
|
||
|
||
commit acaf9e058594310001ce64468ed2923dc6323e81
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Tue Jan 14 12:43:03 2020 +1100
|
||
|
||
Update depend to remove rmd160.h.
|
||
|
||
commit 26b2675b0c3e3efea11a52609073aec01736ec84
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Tue Jan 14 07:24:46 2020 +1100
|
||
|
||
Remove configure test & compat code for ripemd160.
|
||
|
||
RIPEMD160 support was removed upstream in 2017, however we still had
|
||
a configure test and compat code for it, so clean those up now.
|
||
|
||
commit ed3ad71b17adcd1fb4431d145f53cee1c6a1135e
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Thu Jan 9 03:28:38 2020 +0000
|
||
|
||
upstream: fix reversed arguments on expand_proxy_command(); spotted
|
||
|
||
by anton@
|
||
|
||
OpenBSD-Commit-ID: db1c32478a01dfbc9c4db171de0f25907bea5775
|
||
|
||
commit cd53476383f0cf475f40ba8ac8deb6b76dd5ce4e
|
||
Author: jmc@openbsd.org <jmc@openbsd.org>
|
||
Date: Mon Jan 6 07:43:28 2020 +0000
|
||
|
||
upstream: put the fido options in a list, and tidy up the text a
|
||
|
||
little; ok djm
|
||
|
||
OpenBSD-Commit-ID: 491ce15ae52a88b7a6a2b3b6708a14b4aacdeebb
|
||
|
||
commit 30f704ebc0e9e32b3d12f5d9e8c1b705fdde2c89
|
||
Author: Jeremy Drake <github@jdrake.com>
|
||
Date: Fri Oct 11 18:31:05 2019 -0700
|
||
|
||
Deny (non-fatal) ipc in preauth privsep child.
|
||
|
||
As noted in openssh/openssh-portable#149, i386 does not have have
|
||
_NR_shmget etc. Instead, it has a single ipc syscall (see man 2 ipc,
|
||
https://linux.die.net/man/2/ipc). Add this syscall, if present, to the
|
||
list of syscalls that seccomp will deny non-fatally.
|
||
|
||
commit b110cefdfbf5a20f49b774a55062d6ded2fb6e22
|
||
Author: Khem Raj <raj.khem@gmail.com>
|
||
Date: Tue Jan 7 16:26:45 2020 -0800
|
||
|
||
seccomp: Allow clock_gettime64() in sandbox.
|
||
|
||
This helps sshd accept connections on mips platforms with
|
||
upcoming glibc ( 2.31 )
|
||
|
||
commit 3cc60c899a92a469e5118310ba6b74cb57215618
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Mon Jan 6 02:39:30 2020 +0000
|
||
|
||
upstream: missing else in check_enroll_options()
|
||
|
||
OpenBSD-Commit-ID: e058fb918fda56ddbbf0bee910101004cec421d4
|
||
|
||
commit ff5784e2698d6c41e9f39ce4df24968c1beeb2bb
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Mon Jan 6 02:24:28 2020 +0000
|
||
|
||
upstream: fix error message
|
||
|
||
OpenBSD-Commit-ID: 1eb52025658eb78ea6223181e552862198d3d505
|
||
|
||
commit dd2acc8b862c09751621995fba2d5fa6f4e24cc9
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Mon Jan 6 02:07:50 2020 +0000
|
||
|
||
upstream: adapt sk-dummy to SK API changes
|
||
|
||
also, make it pull prototypes directly from sk-api.c and #error
|
||
if the expected version changes. This will make any future regress
|
||
test breakage because of SK API changes much more apparent
|
||
|
||
OpenBSD-Regress-ID: 79b07055de4feb988e31da71a89051ad5969829d
|
||
|
||
commit c312ca077cd2a6c15545cd6b4d34ee2f69289174
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Mon Jan 6 02:00:46 2020 +0000
|
||
|
||
upstream: Extends the SK API to accept a set of key/value options
|
||
|
||
for all operations. These are intended to future-proof the API a little by
|
||
making it easier to specify additional fields for without having to change
|
||
the API version for each.
|
||
|
||
At present, only two options are defined: one to explicitly specify
|
||
the device for an operation (rather than accepting the middleware's
|
||
autoselection) and another to specify the FIDO2 username that may
|
||
be used when generating a resident key. These new options may be
|
||
invoked at key generation time via ssh-keygen -O
|
||
|
||
This also implements a suggestion from Markus to avoid "int" in favour
|
||
of uint32_t for the algorithm argument in the API, to make implementation
|
||
of ssh-sk-client/helper a little easier.
|
||
|
||
feedback, fixes and ok markus@
|
||
|
||
OpenBSD-Commit-ID: 973ce11704609022ab36abbdeb6bc23c8001eabc
|
||
|
||
commit 2ab335712d084d9ccaf3f53afc3fa9535329da87
|
||
Author: beck@openbsd.org <beck@openbsd.org>
|
||
Date: Sun Jan 5 16:28:22 2020 +0000
|
||
|
||
upstream: fix CanonicalizeHostname, broken by rev 1.507
|
||
|
||
Issue noticed and reported by Pierre-Olivier Martel <pom@apple.com>
|
||
ok dtucker@ markus@ djm@
|
||
|
||
OpenBSD-Commit-ID: 749f3168ec520609c35b0c4e1984e5fa47f16094
|
||
|
||
commit 69e44ba701b90b0f530d64c3fe4363ea86e50cd3
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Mon Jan 6 09:02:53 2020 +1100
|
||
|
||
Fix typo: 'you' -> 'your'.
|
||
|
||
bz#3108 from jmckitrick@gmail.com.
|
||
|
||
commit 7652a57662969bd5c61448b3843ec6d407ad12be
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Mon Jan 6 08:56:46 2020 +1100
|
||
|
||
Remove auth-skey.c.
|
||
|
||
S/Key support was removed in OpenSSH 7.8 but this file was missed.
|
||
|
||
commit c593cc5e826c9f4ec506e22b629d37cabfaacff9
|
||
Author: jmc@openbsd.org <jmc@openbsd.org>
|
||
Date: Fri Jan 3 07:33:33 2020 +0000
|
||
|
||
upstream: the download resident keys option is -K (upper) not -k
|
||
|
||
(lower); ok djm
|
||
|
||
OpenBSD-Commit-ID: 71dc28a3e1fa7c553844abc508845bcf5766e091
|
||
|
||
commit ff31f15773ee173502eec4d7861ec56f26bba381
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Fri Jan 3 03:02:26 2020 +0000
|
||
|
||
upstream: what bozo decided to use 2020 as a future date in a regress
|
||
|
||
test?
|
||
|
||
OpenBSD-Regress-ID: 3b953df5a7e14081ff6cf495d4e8d40e153cbc3a
|
||
|
||
commit 680eb7749a39d0e4d046e66cac4e51e8e3640b75
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Fri Jan 3 02:46:19 2020 +0000
|
||
|
||
upstream: implement recent SK API change to support resident keys
|
||
|
||
and PIN prompting in the dummy middleware that we use for the tests. Should
|
||
fix breakage spotted by dtucker@
|
||
|
||
OpenBSD-Regress-ID: 379cf9eabfea57aaf7f3f59dafde59889566c484
|
||
|
||
commit 86834fe6b54ac57b8528c30cf0b27e5cac5b7af7
|
||
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
||
Date: Thu Jan 2 13:25:38 2020 +0000
|
||
|
||
upstream: Update keygen moduli screen test to match recent command
|
||
|
||
line option change to ssh-keygen(1).
|
||
|
||
OpenBSD-Regress-ID: 744a72755004377e9669b662c13c6aa9ead8a0c3
|
||
|
||
commit 9039971887cccd95b209c479296f772a3a93e8e7
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Thu Jan 2 22:40:09 2020 +0000
|
||
|
||
upstream: ability to download FIDO2 resident keys from a token via
|
||
|
||
"ssh-keygen -K". This will save public/private keys into the current
|
||
directory.
|
||
|
||
This is handy if you move a token between hosts.
|
||
|
||
feedback & ok markus@
|
||
|
||
OpenBSD-Commit-ID: d57c1f9802f7850f00a117a1d36682a6c6d10da6
|
||
|
||
commit 878ba4350d57e905d6bb1865d8ff31bdfe5deab4
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Thu Jan 2 22:38:33 2020 +0000
|
||
|
||
upstream: add sshkey_save_public(), to save a public key; ok
|
||
|
||
markus@
|
||
|
||
OpenBSD-Commit-ID: 5d6f96a966d10d7fa689ff9aa9e1d6767ad5a076
|
||
|
||
commit 3b1382ffd5e71eff78db8cef0f3cada22ff29409
|
||
Author: jmc@openbsd.org <jmc@openbsd.org>
|
||
Date: Mon Dec 30 16:10:00 2019 +0000
|
||
|
||
upstream: simplify the list for moduli options - no need for
|
||
|
||
-compact;
|
||
|
||
OpenBSD-Commit-ID: 6492c72280482c6d072be46236b365cb359fc280
|
||
|
||
commit 0248ec7c763dee9ff730a589e3d166eac5c74d7c
|
||
Author: Damien Miller <djm@mindrot.org>
|
||
Date: Thu Jan 2 13:41:31 2020 +1100
|
||
|
||
ssh-sk-null.cc needs extern "C" {}
|
||
|
||
commit 5ca4b414effe4b56f0cfe3058c92391aa8a43871
|
||
Author: Damien Miller <djm@mindrot.org>
|
||
Date: Thu Jan 2 10:56:29 2020 +1100
|
||
|
||
add dummy ssh-sk API for linking with fuzzers
|
||
|
||
commit c4b2664be7ba25e4c233315b25212dec29b727ab
|
||
Author: Damien Miller <djm@mindrot.org>
|
||
Date: Mon Dec 30 21:04:09 2019 +1100
|
||
|
||
refresh depend
|
||
|
||
commit 3093d12ff80927cf45da08d9f262a26680fb14ee
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Mon Dec 30 09:49:52 2019 +0000
|
||
|
||
upstream: Remove the -x option currently used for
|
||
|
||
FIDO/U2F-specific key flags. Instead these flags may be specified via -O.
|
||
|
||
ok markus@
|
||
|
||
OpenBSD-Commit-ID: f23ebde2a8a7e1bf860a51055a711cffb8c328c1
|
||
|
||
commit ef65e7dbaa8fac3245aa2bfc9f7e09be7cba0d9d
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Mon Dec 30 09:25:29 2019 +0000
|
||
|
||
upstream: document SK API changes in PROTOCOL.u2f
|
||
|
||
ok markus@
|
||
|
||
OpenBSD-Commit-ID: 52622363c103a3c4d3d546050480ffe978a32186
|
||
|
||
commit 43ce96427b76c4918e39af654e2fc9ee18d5d478
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Mon Dec 30 09:24:45 2019 +0000
|
||
|
||
upstream: translate and return error codes; retry on bad PIN
|
||
|
||
Define some well-known error codes in the SK API and pass
|
||
them back via ssh-sk-helper.
|
||
|
||
Use the new "wrong PIN" error code to retry PIN prompting during
|
||
ssh-keygen of resident keys.
|
||
|
||
feedback and ok markus@
|
||
|
||
OpenBSD-Commit-ID: 9663c6a2bb7a0bc8deaccc6c30d9a2983b481620
|
||
|
||
commit d433596736a2cd4818f538be11fc94783f5c5236
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Mon Dec 30 09:24:03 2019 +0000
|
||
|
||
upstream: improve some error messages; ok markus@
|
||
|
||
OpenBSD-Commit-ID: 4ccd8ddabb8df4f995107dd3b7ea58220e93cb81
|
||
|
||
commit c54cd1892c3e7f268b21e1f07ada9f0d9816ffc0
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Mon Dec 30 09:23:28 2019 +0000
|
||
|
||
upstream: SK API and sk-helper error/PIN passing
|
||
|
||
Allow passing a PIN via the SK API (API major crank) and let the
|
||
ssh-sk-helper API follow.
|
||
|
||
Also enhance the ssh-sk-helper API to support passing back an error
|
||
code instead of a complete reply. Will be used to signal "wrong PIN",
|
||
etc.
|
||
|
||
feedback and ok markus@
|
||
|
||
OpenBSD-Commit-ID: a1bd6b0a2421646919a0c139b8183ad76d28fb71
|
||
|
||
commit 79fe22d9bc2868c5118f032ec1200ac9c2e3aaef
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Mon Dec 30 09:22:49 2019 +0000
|
||
|
||
upstream: implement loading resident keys in ssh-add
|
||
|
||
"ssh-add -O" will load resident keys from a FIDO2 token and add them
|
||
to a ssh-agent.
|
||
|
||
feedback and ok markus@
|
||
|
||
OpenBSD-Commit-ID: 608104ae957a7d65cb84e0a3a26c8f60e0df3290
|
||
|
||
commit 27753a8e21887d47fe6b5c78a4aed0efe558a850
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Mon Dec 30 09:21:59 2019 +0000
|
||
|
||
upstream: implement loading of resident keys in ssh-sk-helper
|
||
|
||
feedback and ok markus@
|
||
|
||
OpenBSD-Commit-ID: b273c23769ea182c55c4a7b8f9cbd9181722011a
|
||
|
||
commit 14cea36df397677b8f8568204300ef654114fd76
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Mon Dec 30 09:21:16 2019 +0000
|
||
|
||
upstream: resident keys support in SK API
|
||
|
||
Adds a sk_load_resident_keys() function to the security key
|
||
API that accepts a security key provider and a PIN and returns
|
||
a list of keys.
|
||
|
||
Implement support for this in the usbhid middleware.
|
||
|
||
feedback and ok markus@
|
||
|
||
OpenBSD-Commit-ID: 67e984e4e87f4999ce447a6178c4249a9174eff0
|
||
|
||
commit 2fe05fcb4a2695f190b4fcf27770b655586ab349
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Mon Dec 30 09:20:36 2019 +0000
|
||
|
||
upstream: Factor out parsing of struct sk_enroll_response
|
||
|
||
We'll reuse this for extracting resident keys from a device.
|
||
|
||
feedback and ok markus@
|
||
|
||
OpenBSD-Commit-ID: 9bc1efd9c6897eac4df0983746cf6578c1542273
|
||
|
||
commit 4532bd01d57ee13c3ca881eceac1bf9da96a4d7e
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Mon Dec 30 09:19:52 2019 +0000
|
||
|
||
upstream: basic support for generating FIDO2 resident keys
|
||
|
||
"ssh-keygen -t ecdsa-sk|ed25519-sk -x resident" will generate a
|
||
device-resident key.
|
||
|
||
feedback and ok markus@
|
||
|
||
OpenBSD-Commit-ID: 8e1b3c56a4b11d85047bd6c6c705b7eef4d58431
|
||
|
||
commit 3e60d18fba1b502c21d64fc7e81d80bcd08a2092
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Mon Dec 30 03:30:09 2019 +0000
|
||
|
||
upstream: remove single-letter flags for moduli options
|
||
|
||
Move all moduli generation options to live under the -O flag.
|
||
|
||
Frees up seven single-letter flags.
|
||
|
||
NB. this change break existing ssh-keygen commandline syntax for moduli-
|
||
related operations. Very few people use these fortunately.
|
||
|
||
feedback and ok markus@
|
||
|
||
OpenBSD-Commit-ID: d498f3eaf28128484826a4fcb343612764927935
|
||
|
||
commit 1e645fe767f27725dc7fd7864526de34683f7daf
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Mon Dec 30 03:28:41 2019 +0000
|
||
|
||
upstream: prepare for use of ssh-keygen -O flag beyond certs
|
||
|
||
Move list of available certificate options in ssh-keygen.1 to the
|
||
CERTIFICATES section.
|
||
|
||
Collect options specified by -O but delay parsing/validation of
|
||
certificate options until we're sure that we're acting as a CA.
|
||
|
||
ok markus@
|
||
|
||
OpenBSD-Commit-ID: 33e6bcc29cfca43606f6fa09bd84b955ee3a4106
|
||
|
||
commit 20ccd854245c598e2b47cc9f8d4955d645195055
|
||
Author: jmc@openbsd.org <jmc@openbsd.org>
|
||
Date: Fri Dec 27 08:28:44 2019 +0000
|
||
|
||
upstream: sort -Y internally in the options list, as is already
|
||
|
||
done in synopsis;
|
||
|
||
OpenBSD-Commit-ID: 86d033c5764404057616690d7be992e445b42274
|
||
|
||
commit 5b6c954751dd3677466cda7adb92e4f05446c96c
|
||
Author: jmc@openbsd.org <jmc@openbsd.org>
|
||
Date: Fri Dec 27 08:25:07 2019 +0000
|
||
|
||
upstream: in the options list, sort -Y and -y;
|
||
|
||
OpenBSD-Commit-ID: 24c2e6a3aeab6e050a0271ffc73fdff91c10dcaa
|
||
|
||
commit 141df487ba699cfd1ec3dcd98186e7c956e99024
|
||
Author: naddy@openbsd.org <naddy@openbsd.org>
|
||
Date: Sat Dec 21 20:22:34 2019 +0000
|
||
|
||
upstream: Replace the term "security key" with "(FIDO)
|
||
|
||
authenticator".
|
||
|
||
The polysemous use of "key" was too confusing. Input from markus@.
|
||
ok jmc@
|
||
|
||
OpenBSD-Commit-ID: 12eea973a44c8232af89f86e4269d71ae900ca8f
|
||
|
||
commit fbd9729d4eadf2f7097b6017156387ac64302453
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Sat Dec 21 02:33:07 2019 +0000
|
||
|
||
upstream: unit tests for ForwardAgent=/path; from Eric Chiang
|
||
|
||
OpenBSD-Regress-ID: 24f693f78290b2c17725dab2c614dffe4a88c8da
|
||
|
||
commit e5b7cf8edca7e843adc125621e1dab14507f430a
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Mon Dec 16 02:39:05 2019 +0000
|
||
|
||
upstream: test security key host keys in addition to user keys
|
||
|
||
OpenBSD-Regress-ID: 9fb45326106669a27e4bf150575c321806e275b1
|
||
|
||
commit 40be78f503277bd91c958fa25ea9ef918a2ffd3d
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Sat Dec 21 02:19:13 2019 +0000
|
||
|
||
upstream: Allow forwarding a different agent socket to the path
|
||
|
||
specified by $SSH_AUTH_SOCK, by extending the existing ForwardAgent option to
|
||
accepting an explicit path or the name of an environment variable in addition
|
||
to yes/no.
|
||
|
||
Patch by Eric Chiang, manpage by me; ok markus@
|
||
|
||
OpenBSD-Commit-ID: 98f2ed80bf34ea54d8b2ddd19ac14ebbf40e9265
|
||
|
||
commit 416f15372bfb5be1709a0ad1d00ef5d8ebfb9e0e
|
||
Author: naddy@openbsd.org <naddy@openbsd.org>
|
||
Date: Fri Dec 20 20:28:55 2019 +0000
|
||
|
||
upstream: SSH U2F keys can now be used as host keys. Fix a garden
|
||
|
||
path sentence. ok markus@
|
||
|
||
OpenBSD-Commit-ID: 67d7971ca1a020acd6c151426c54bd29d784bd6b
|
||
|
||
commit 68010acbcfe36167b3eece3115f3a502535f80df
|
||
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
||
Date: Fri Dec 20 02:42:42 2019 +0000
|
||
|
||
upstream: Move always unsupported keywords to be grouped with the other
|
||
|
||
ones. Move oSecurityProvider to match the order in the OpCodes enum. Patch
|
||
from openbsd@academicsolutions.ch, ok djm@
|
||
|
||
OpenBSD-Commit-ID: 061e4505861ec1e02ba3a63e3d1b3be3cad458ec
|
||
|
||
commit 8784b02dc49e1c98df4e7aca466be2f652ed4ad1
|
||
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
||
Date: Fri Dec 20 02:29:21 2019 +0000
|
||
|
||
upstream: Remove obsolete opcodes from the configuation enum.
|
||
|
||
Patch from openbsd@academicsolutions.ch, ok djm@
|
||
|
||
OpenBSD-Commit-ID: 395c202228872ce8d9044cc08552ac969f51e01b
|
||
|
||
commit 345be6091bdc9be09c90a937d1320f97c01fab2a
|
||
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
||
Date: Fri Dec 20 02:11:38 2019 +0000
|
||
|
||
upstream: Remove now-obsolete config options from example in
|
||
|
||
comment. Patch from openbsd@academicsolutions.ch, ok djm@
|
||
|
||
OpenBSD-Commit-ID: 35862beb0927b1cb0af476ec23cc07f6e3006101
|
||
|
||
commit ae024b22c4fd68e7f39681d605585889f9511108
|
||
Author: naddy@openbsd.org <naddy@openbsd.org>
|
||
Date: Thu Dec 19 15:09:30 2019 +0000
|
||
|
||
upstream: Document that security key-hosted keys can act as host
|
||
|
||
keys.
|
||
|
||
Update the list of default host key algorithms in ssh_config.5 and
|
||
sshd_config.5. Copy the description of the SecurityKeyProvider
|
||
option to sshd_config.5.
|
||
|
||
ok jmc@
|
||
|
||
OpenBSD-Commit-ID: edadf3566ab5e94582df4377fee3b8b702c7eca0
|
||
|
||
commit bc2dc091e0ac4ff6245c43a61ebe12c7e9ea0b7f
|
||
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
||
Date: Thu Dec 19 03:50:01 2019 +0000
|
||
|
||
upstream: "Forward security" -> "Forward secrecy" since that's the
|
||
|
||
correct term. Add "MAC" since we use that acronym in other man pages. ok
|
||
naddy@
|
||
|
||
OpenBSD-Commit-ID: c35529e511788586725fb63bda3459e10738c5f5
|
||
|
||
commit e905f7260d72bc0e33ef5f10a0db737ff6e77ba7
|
||
Author: naddy@openbsd.org <naddy@openbsd.org>
|
||
Date: Tue Dec 17 16:21:07 2019 +0000
|
||
|
||
upstream: cut obsolete lists of crypto algorithms from outline of
|
||
|
||
how SSH works ok markus@ jmc@
|
||
|
||
OpenBSD-Commit-ID: 8e34973f232ab48c4d4f5d07df48d501708b9160
|
||
|
||
commit f65cf1163ff01531ae02f3f9210391d0d692f699
|
||
Author: tobhe@openbsd.org <tobhe@openbsd.org>
|
||
Date: Mon Dec 16 13:58:53 2019 +0000
|
||
|
||
upstream: strdup may return NULL if memory allocation fails. Use
|
||
|
||
the safer xstrdup which fatals on allocation failures.
|
||
|
||
ok markus@
|
||
|
||
OpenBSD-Commit-ID: 8b608d387120630753cbcb8110e0b019c0c9a0d0
|
||
|
||
commit 57634bfc5708477826c0be265ddc59b9d83e4886
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Mon Dec 16 03:16:58 2019 +0000
|
||
|
||
upstream: sort sk-* methods behind their plain key methods cousins
|
||
|
||
for now
|
||
|
||
OpenBSD-Commit-ID: c97e22c2b28c0d12ee389b8b4ef5f2ada7908828
|
||
|
||
commit b8df8fe920e697edcc69c520390b78c3b7ad9d84
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Tue Dec 17 19:46:15 2019 +1100
|
||
|
||
Mac OS X has PAM too.
|
||
|
||
commit bf8de8b8251af69b5ce96a8faa69145af156af4d
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Tue Dec 17 19:37:06 2019 +1100
|
||
|
||
Show portable tarball pattern in example.
|
||
|
||
commit a19ef613e98141cc37c8acdeebe285b9dbe2531e
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Tue Dec 17 19:35:59 2019 +1100
|
||
|
||
OpenSSL is now optional.
|
||
|
||
commit 1a7217ac063e48cf0082895aeee81ed2b8a57191
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Sun Dec 15 18:58:33 2019 +0000
|
||
|
||
upstream: adapt to ssh-sk-client change
|
||
|
||
OpenBSD-Regress-ID: 40481999a5928d635ab2e5b029e8239c112005ea
|
||
|
||
commit a7fc1df246e80bfdabd09b069b91c72f9c578ca8
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Wed Dec 11 18:47:14 2019 +0000
|
||
|
||
upstream: it's no longer possible to disable privilege separation
|
||
|
||
in sshd, so don't double the tests' work by trying both off/on
|
||
|
||
OpenBSD-Regress-ID: d366665466dbd09e9b707305da884be3e7619c68
|
||
|
||
commit 3145d38ea06820a66c0f5e068f49af14fd2b7ac1
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Sun Dec 15 20:59:23 2019 +0000
|
||
|
||
upstream: don't treat HostKeyAgent=none as a path either; avoids
|
||
|
||
spurious warnings from the cfgparse regress test
|
||
|
||
OpenBSD-Commit-ID: ba49ea7a5c92b8a16cb9c2e975dbb163853afc54
|
||
|
||
commit 747e25192f436e71dd39e15d65aa32bca967533a
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Sun Dec 15 20:57:15 2019 +0000
|
||
|
||
upstream: do not attempt to find an absolute path for sshd_config
|
||
|
||
SecurityKeyProvider=internal - unbreaks cfgparse regress test
|
||
|
||
OpenBSD-Commit-ID: d2ddcf525c0dc3c8339522360c10b3c70f1fd641
|
||
|
||
commit 9b6e30b96b094ad787511a5b989253e3b8fe1789
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Sun Dec 15 19:47:10 2019 +0000
|
||
|
||
upstream: allow ssh-keyscan to find security key hostkeys
|
||
|
||
OpenBSD-Commit-ID: 1fe822a7f714df19a7e7184e3a3bbfbf546811d3
|
||
|
||
commit 56584cce75f3d20aaa30befc7cbd331d922927f3
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Sun Dec 15 18:57:30 2019 +0000
|
||
|
||
upstream: allow security keys to act as host keys as well as user
|
||
|
||
keys.
|
||
|
||
Previously we didn't do this because we didn't want to expose
|
||
the attack surface presented by USB and FIDO protocol handling,
|
||
but now that this is insulated behind ssh-sk-helper there is
|
||
less risk.
|
||
|
||
ok markus@
|
||
|
||
OpenBSD-Commit-ID: 77b068dd133b8d87e0f010987bd5131e640ee64c
|
||
|
||
commit 5af6fd5461bb709304e6979c8b7856c7af921c9e
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Mon Dec 16 13:55:56 2019 +1100
|
||
|
||
Allow clock_nanosleep_time64 in seccomp sandbox.
|
||
|
||
Needed on Linux ARM. bz#3100, patch from jjelen@redhat.com.
|
||
|
||
commit fff8ff6dd580e1a72ba09a6775d185175cdc8d13
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Sun Dec 15 18:27:02 2019 +1100
|
||
|
||
Put SK ECDSA bits inside ifdef OPENSSL_HAS_ECC.
|
||
|
||
Fixes build when linking against OpenSSLs built with no-ec.
|
||
|
||
commit 9244990ecdcfa36bb9371058111685b05f201c1e
|
||
Author: Damien Miller <djm@mindrot.org>
|
||
Date: Sat Dec 14 09:21:46 2019 +1100
|
||
|
||
remove a bunch of ENABLE_SK #ifdefs
|
||
|
||
The ssh-sk-helper client API gives us a nice place to disable
|
||
security key support when it is wasn't enabled at compile time,
|
||
so we don't need to check everywere.
|
||
|
||
Also, verification of security key signatures can remain enabled
|
||
all the time - it has no additional dependencies. So sshd can
|
||
accept security key pubkeys in authorized_keys, etc regardless of
|
||
the host's support for dlopen, etc.
|
||
|
||
commit a33ab1688b5c460a7e2a301418241ce1b13b2638
|
||
Author: Damien Miller <djm@mindrot.org>
|
||
Date: Sat Dec 14 09:15:06 2019 +1100
|
||
|
||
ssh-sk-client.c needs includes.h
|
||
|
||
commit 633778d567ad50b63d2a3bca5e1b97d279d236d9
|
||
Author: Damien Miller <djm@mindrot.org>
|
||
Date: Sat Dec 14 08:40:33 2019 +1100
|
||
|
||
only link ssh-sk-helper against libfido2
|
||
|
||
commit 7b47b40b170db4d6f41da0479575f6d99dd7228a
|
||
Author: Damien Miller <djm@mindrot.org>
|
||
Date: Sat Dec 14 08:20:52 2019 +1100
|
||
|
||
adapt Makefile to ssh-sk-client everywhere
|
||
|
||
commit f45f3a8a12e2bee601046b916e6c5cd6eae08048
|
||
Author: Damien Miller <djm@mindrot.org>
|
||
Date: Sat Dec 14 07:53:11 2019 +1100
|
||
|
||
fixup
|
||
|
||
commit d21434766764d5babf99fc3937c19b625c0f6334
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Fri Dec 13 20:16:56 2019 +0000
|
||
|
||
upstream: actually commit the ssh-sk-helper client code; ok markus
|
||
|
||
OpenBSD-Commit-ID: fd2ea776a5bbbf4d452989d3c3054cf25a5e0589
|
||
|
||
commit 611073fb40ecaf4ac65094e403edea3a08deb700
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Fri Dec 13 19:11:14 2019 +0000
|
||
|
||
upstream: perform security key enrollment via ssh-sk-helper too.
|
||
|
||
This means that ssh-keygen no longer needs to link against ssh-sk-helper, and
|
||
only ssh-sk-helper needs libfido2 and /dev/uhid* access;
|
||
|
||
feedback & ok markus@
|
||
|
||
OpenBSD-Commit-ID: 9464233fab95708d2ff059f8bee29c0d1f270800
|
||
|
||
commit 612b1dd1ec91ffb1e01f58cca0c6eb1d47bf4423
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Fri Dec 13 19:09:37 2019 +0000
|
||
|
||
upstream: allow sshbuf_put_stringb(buf, NULL); ok markus@
|
||
|
||
OpenBSD-Commit-ID: 91482c1ada9adb283165d48dafbb88ae91c657bd
|
||
|
||
commit b52ec0ba3983859514aa7b57d6100fa9759fe696
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Fri Dec 13 19:09:10 2019 +0000
|
||
|
||
upstream: use ssh-sk-helper for all security key signing operations
|
||
|
||
This extracts and refactors the client interface for ssh-sk-helper
|
||
from ssh-agent and generalises it for use by the other programs.
|
||
This means that most OpenSSH tools no longer need to link against
|
||
libfido2 or directly interact with /dev/uhid*
|
||
|
||
requested by, feedback and ok markus@
|
||
|
||
OpenBSD-Commit-ID: 1abcd3aea9a7460eccfbf8ca154cdfa62f1dc93f
|
||
|
||
commit c33d46868c3d88e04a92610cdb429094aeeb5847
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Wed Dec 11 22:19:47 2019 +0000
|
||
|
||
upstream: add a note about the 'extensions' field in the signed
|
||
|
||
object
|
||
|
||
OpenBSD-Commit-ID: 67c01e0565b258e0818c1ccfe1f1aeaf9a0d4c7b
|
||
|
||
commit a62f4e1960691f3aeb1f972e009788b29e2ae464
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Tue Dec 10 23:37:31 2019 +0000
|
||
|
||
upstream: some more corrections for documentation problems spotted
|
||
|
||
by Ron Frederick
|
||
|
||
document certifiate private key format
|
||
correct flags type for sk-ssh-ed25519@openssh.com keys
|
||
|
||
OpenBSD-Commit-ID: fc4e9a1ed7f9f7f9dd83e2e2c59327912e933e74
|
||
|
||
commit 22d4beb79622fc82d7111ac941269861fc7aef8d
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Tue Dec 10 23:21:56 2019 +0000
|
||
|
||
upstream: loading security keys into ssh-agent used the extension
|
||
|
||
constraint "sk-provider@openssh.com", not "sk@openssh.com"; spotted by Ron
|
||
Frederick
|
||
|
||
OpenBSD-Commit-ID: dbfba09edbe023abadd5f59c1492df9073b0e51d
|
||
|
||
commit 75f7f22a43799f6d25dffd9d6683de1601da05a3
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Tue Dec 10 22:43:19 2019 +0000
|
||
|
||
upstream: add security key types to list of keys allowed to act as
|
||
|
||
CAs; spotted by Ron Frederick
|
||
|
||
OpenBSD-Commit-ID: 9bb0dfff927b4f7aa70679f983f84c69d45656c3
|
||
|
||
commit 516605f2d596884cedc2beed6b262716ec76f63d
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Tue Dec 10 22:37:20 2019 +0000
|
||
|
||
upstream: when acting as a CA and using a security key as the CA
|
||
|
||
key, remind the user to touch they key to authorise the signature.
|
||
|
||
OpenBSD-Commit-ID: fe58733edd367362f9766b526a8b56827cc439c1
|
||
|
||
commit c4036fe75ea5a4d03a2a40be1f3660dcbbfa01b2
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Tue Dec 10 22:36:08 2019 +0000
|
||
|
||
upstream: chop some unnecessary and confusing verbiage from the
|
||
|
||
security key protocol description; feedback from Ron Frederick
|
||
|
||
OpenBSD-Commit-ID: 048c9483027fbf9c995e5a51b3ac502989085a42
|
||
|
||
commit 59175a350fe1091af7528b2971e3273aa7ca7295
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Fri Dec 6 03:06:08 2019 +0000
|
||
|
||
upstream: fix setting of $SSH_ASKPASS_PROMPT - it shouldn't be set
|
||
|
||
when asking passphrases, only when confirming the use of a key (i.e. for
|
||
ssh-agent keys added with "ssh-add -c keyfile")
|
||
|
||
OpenBSD-Commit-ID: 6643c82960d9427d5972eb702c917b3b838ecf89
|
||
|
||
commit 36eaa356d391a23a2d4e3a8aaa0223abc70b9822
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Fri Dec 6 02:55:21 2019 +0000
|
||
|
||
upstream: bring the __func__
|
||
|
||
OpenBSD-Commit-ID: 71a3a45b0fe1b8f680ff95cf264aa81f7abbff67
|
||
|
||
commit 483cc723d1ff3b7fdafc6239348040a608ebc78d
|
||
Author: jmc@openbsd.org <jmc@openbsd.org>
|
||
Date: Sat Nov 30 07:07:59 2019 +0000
|
||
|
||
upstream: tweak the Nd lines for a bit of consistency; ok markus
|
||
|
||
OpenBSD-Commit-ID: 876651bdde06bc1e72dd4bd7ad599f42a6ce5a16
|
||
|
||
commit afffd310360b155df2133d1f5f1ab2f4e939b570
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Wed Dec 11 13:22:06 2019 +1100
|
||
|
||
Check if memmem is declared in system headers.
|
||
|
||
If the system (or one of the dependencies) implements memmem but does
|
||
not define the header, we would not declare it either resulting in
|
||
compiler warnings. Check for declaration explicitly. bz#3102.
|
||
|
||
commit ad8cd420797695f3b580aea1034b9de60bede9b9
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Wed Dec 11 13:12:01 2019 +1100
|
||
|
||
Sort depends.
|
||
|
||
commit 5e3abff39e01817f6866494416f2ada25c316018
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Wed Dec 11 13:09:34 2019 +1100
|
||
|
||
Sort .depend when rebuilding.
|
||
|
||
This makes diffs more stable between makedepend implementations.
|
||
|
||
commit 5df9d1f5c0943367d9b68435f4c82224ce11a73f
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Wed Dec 11 13:06:43 2019 +1100
|
||
|
||
Update depend to include sk files.
|
||
|
||
commit 9a967c5bbfca35835165f7d8a6165009f5b21872
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Mon Dec 9 20:25:26 2019 +1100
|
||
|
||
Describe how to build libcrypto as PIC.
|
||
|
||
While there, move the OpenSSL 1.1.0g caveat closer to the other version
|
||
information.
|
||
|
||
commit b66fa5da25c4b5b67cf9f0ce7af513f5a6a6a686
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Mon Dec 9 17:23:22 2019 +1100
|
||
|
||
Recommend running LibreSSL or OpenSSL self-tests.
|
||
|
||
commit fa7924008e838cded7e8a561356ffe5e06e0ed64
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Fri Dec 6 14:17:26 2019 +1100
|
||
|
||
Wrap ECC specific bits in ifdef.
|
||
|
||
Fixes tests when built against an OpenSSL configured with no-ec.
|
||
|
||
commit 2ff822eabd7d4461743f22d3b9ba35ab76069df5
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Fri Nov 29 20:21:36 2019 +1100
|
||
|
||
Wrap sha2.h include in ifdef.
|
||
|
||
Fixes build --without-openssl on at least Fedora.
|
||
|
||
commit 443848155ffcda65a6077aac118c861b503a093f
|
||
Author: Damien Miller <djm@mindrot.org>
|
||
Date: Fri Nov 29 15:10:21 2019 +1100
|
||
|
||
compile sk-dummy.so with no-PIE version of LDFLAGS
|
||
|
||
This lets it pick up the -L path to libcrypto for example.
|
||
|
||
commit 37f5b5346e4cc6a894245aa89d2930649bb7045b
|
||
Author: Damien Miller <djm@mindrot.org>
|
||
Date: Fri Nov 29 14:48:46 2019 +1100
|
||
|
||
includes.h for sk-dummy.c, dummy
|
||
|
||
commit b218055e59a7c1a1816f7a55ca18e3f3c05d63a4
|
||
Author: Damien Miller <djm@mindrot.org>
|
||
Date: Fri Nov 29 12:32:23 2019 +1100
|
||
|
||
(yet) another x-platform fix for sk-dummy.so
|
||
|
||
Check for -fPIC support from compiler
|
||
|
||
Compile libopenbsd-compat -fPIC
|
||
|
||
Don't mix -fPIE and -fPIC when compiling
|
||
|
||
commit 0dedb703adcd98d0dbc4479f5f312a2bd3df2850
|
||
Author: Damien Miller <djm@mindrot.org>
|
||
Date: Fri Nov 29 11:53:57 2019 +1100
|
||
|
||
needs includes.h for WITH_OPENSSL
|
||
|
||
commit ef3853bb94c2c72e7eda0de6cec0bcb1da62058f
|
||
Author: Damien Miller <djm@mindrot.org>
|
||
Date: Fri Nov 29 11:52:23 2019 +1100
|
||
|
||
another attempt at sk-dummy.so working x-platform
|
||
|
||
include a fatal() implementation to satisfy libopenbsd-compat
|
||
|
||
clean up .lo and .so files
|
||
|
||
.gitignore .lo and .so files
|
||
|
||
commit d46ac56f1cbd5a855a2d5e7309f90d383dcf6431
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Fri Nov 29 00:13:29 2019 +0000
|
||
|
||
upstream: lots of dependencies go away here with ed25519 no longer
|
||
|
||
needing the ssh_digest API.
|
||
|
||
OpenBSD-Regress-ID: 785847ec78cb580d141e29abce351a436d6b5d49
|
||
|
||
commit 7404b81f25a4a7847380c0f0cf7f1bea5f0a5cd3
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Fri Nov 29 00:11:21 2019 +0000
|
||
|
||
upstream: perform hashing directly in crypto_hash_sha512() using
|
||
|
||
libcrypto or libc SHA512 functions rather than calling ssh_digest_memory();
|
||
avoids many dependencies on ssh code that complicate standalone use of
|
||
ed25519, as we want to do in sk-dummy.so
|
||
|
||
OpenBSD-Commit-ID: 5a3c37593d3ba7add037b587cec44aaea088496d
|
||
|
||
commit d39a865b7af93a7a9b5a64cf7cf0ef4396c80ba3
|
||
Author: jmc@openbsd.org <jmc@openbsd.org>
|
||
Date: Thu Nov 28 12:24:31 2019 +0000
|
||
|
||
upstream: improve the text for -A a little; input from naddy and
|
||
|
||
djm
|
||
|
||
OpenBSD-Commit-ID: f9cdfb1d6dbb9887c4bf3bb25f9c7a94294c988d
|
||
|
||
commit 9a0e01bd0c61f553ead96b5af84abd73865847b8
|
||
Author: jmc@openbsd.org <jmc@openbsd.org>
|
||
Date: Thu Nov 28 12:23:25 2019 +0000
|
||
|
||
upstream: reshuffle the text to read better; input from naddy,
|
||
|
||
djmc, and dtucker
|
||
|
||
OpenBSD-Commit-ID: a0b2aca2b67614dda3d6618ea097bf0610c35013
|
||
|
||
commit 5ca52c0f2e5e7f7d01d8d557b994b5c2087bed00
|
||
Author: Damien Miller <djm@mindrot.org>
|
||
Date: Thu Nov 28 18:09:07 2019 +1100
|
||
|
||
$< doesn't work as` I thought; explicily list objs
|
||
|
||
commit 18e84bfdc5906a73405c3b42d7f840013bbffe34
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Thu Nov 28 05:20:54 2019 +0000
|
||
|
||
upstream: tweak wording
|
||
|
||
OpenBSD-Commit-ID: bd002ca1599b71331faca735ff5f6de29e32222e
|
||
|
||
commit 8ef5bf9d03aa0f047711cff47f5ffbe3b33ff8c9
|
||
Author: Damien Miller <djm@mindrot.org>
|
||
Date: Thu Nov 28 13:12:30 2019 +1100
|
||
|
||
missing .SUFFIXES line makes make sad
|
||
|
||
commit 323da82b8ea993b7f2c5793fd53b4f5ca105d19d
|
||
Author: Damien Miller <djm@mindrot.org>
|
||
Date: Thu Nov 28 09:53:42 2019 +1100
|
||
|
||
(hopefully) fix out of tree builds of sk-dummy.so
|
||
|
||
commit d8b2838c5d19bf409d44ede4d32df8ee47aeb4cd
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Wed Nov 27 22:32:11 2019 +0000
|
||
|
||
upstream: remove stray semicolon after closing brace of function;
|
||
|
||
from Michael Forney
|
||
|
||
OpenBSD-Commit-ID: fda95acb799bb160d15e205ee126117cf33da3a7
|
||
|
||
commit 6e1d1bbf5a3eca875005e0c87f341a0a03799809
|
||
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
||
Date: Wed Nov 27 05:38:43 2019 +0000
|
||
|
||
upstream: Revert previous commit. The channels code still uses int
|
||
|
||
in many places for channel ids so the INT_MAX check still makes sense.
|
||
|
||
OpenBSD-Commit-ID: 532e4b644791b826956c3c61d6ac6da39bac84bf
|
||
|
||
commit 48989244658b9748b6801034ff4ffbdfc6b1520f
|
||
Author: Damien Miller <djm@mindrot.org>
|
||
Date: Wed Nov 27 16:03:12 2019 +1100
|
||
|
||
wire sk-dummy.so into test suite
|
||
|
||
commit f79364bacaebde4f1c260318ab460fceacace02f
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Wed Nov 27 05:00:17 2019 +0000
|
||
|
||
upstream: use error()+_exit() instead of fatal() to avoid running
|
||
|
||
cleanup handlers in child process; spotted via weird regress failures in
|
||
portable
|
||
|
||
OpenBSD-Commit-ID: 6902a9bb3987c7d347774444f7979b8a9ba7f412
|
||
|
||
commit 70ec5e5e2681bcd409a9df94a2fec6f57a750945
|
||
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
||
Date: Wed Nov 27 03:34:04 2019 +0000
|
||
|
||
upstream: Make channel_id u_int32_t and remove unnecessary check
|
||
|
||
and cast that were left over from the type conversion. Noted by
|
||
t-hashida@amiya.co.jp in bz#3098, ok markus@ djm@
|
||
|
||
OpenBSD-Commit-ID: 3ad105b6a905284e780b1fd7ff118e1c346e90b5
|
||
|
||
commit ad44ca81bea83657d558aaef5a1d789a9032bac3
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Tue Nov 26 23:43:10 2019 +0000
|
||
|
||
upstream: test FIDO2/U2F key types; ok markus@
|
||
|
||
OpenBSD-Regress-ID: 367e06d5a260407619b4b113ea0bd7004a435474
|
||
|
||
commit c6efa8a91af1d4fdb43909a23a0a4ffa012155ad
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Tue Nov 26 23:41:23 2019 +0000
|
||
|
||
upstream: add dummy security key middleware based on work by
|
||
|
||
markus@
|
||
|
||
This will allow us to test U2F/FIDO2 support in OpenSSH without
|
||
requiring real hardware.
|
||
|
||
ok markus@
|
||
|
||
OpenBSD-Regress-ID: 88b309464b8850c320cf7513f26d97ee1fdf9aae
|
||
|
||
commit 8635afa1cdc21366d61730d943f3cf61861899c8
|
||
Author: jmc@openbsd.org <jmc@openbsd.org>
|
||
Date: Tue Nov 26 22:42:26 2019 +0000
|
||
|
||
upstream: tweak previous;
|
||
|
||
OpenBSD-Commit-ID: a4c097364c75da320f1b291568db830fb1ee4883
|
||
|
||
commit e0d38ae9bc8c0de421605b9021d8144e4d8ff22b
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Tue Nov 26 03:04:27 2019 +0000
|
||
|
||
upstream: more debugging; behind DEBUG_SK
|
||
|
||
OpenBSD-Commit-ID: a978896227118557505999ddefc1f4c839818b60
|
||
|
||
commit 9281d4311b8abc63b88259f354944c53f9b0b3c7
|
||
Author: Damien Miller <djm@mindrot.org>
|
||
Date: Mon Nov 25 21:47:49 2019 +1100
|
||
|
||
unbreak fuzzers for recent security key changes
|
||
|
||
commit c5f1cc993597fed0a9013743556b1567f476c677
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Mon Nov 25 10:32:35 2019 +0000
|
||
|
||
upstream: unbreak tests for recent security key changes
|
||
|
||
OpenBSD-Regress-ID: 2cdf2fcae9962ca4d711338f3ceec3c1391bdf95
|
||
|
||
commit 64988266820cc90a45a21672be9d762cbde8d34d
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Mon Nov 25 06:53:04 2019 +0000
|
||
|
||
upstream: unbreak after security key support landed
|
||
|
||
OpenBSD-Regress-ID: 3ab578b0dbeb2aa6d9969b54a9c1bad329c0dcba
|
||
|
||
commit e65e25c81e22ea622e89a142a303726a3882384f
|
||
Author: tb@openbsd.org <tb@openbsd.org>
|
||
Date: Thu Nov 21 05:18:47 2019 +0000
|
||
|
||
upstream: Remove workaround for broken 'openssl rsa -text' output
|
||
|
||
that was fixed in libcrypto/rsa/rsa_ameth.c r1.24.
|
||
|
||
ok dtucker inoguchi
|
||
|
||
OpenBSD-Regress-ID: c260edfac177daa8fcce90141587cf04a95c4f5f
|
||
|
||
commit 21377ec2a9378579ba4b44a681af7bbca77581f4
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Mon Nov 25 10:23:36 2019 +0000
|
||
|
||
upstream: redundant test
|
||
|
||
OpenBSD-Commit-ID: 38fa7806c528a590d91ae560e67bd8b246c2d7a3
|
||
|
||
commit 664deef95a2e770812533439b8bdd3f3c291ae59
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Mon Nov 25 00:57:51 2019 +0000
|
||
|
||
upstream: document the "no-touch-required" certificate extension;
|
||
|
||
ok markus, feedback deraadt
|
||
|
||
OpenBSD-Commit-ID: 47640122b13f825e9c404ea99803b2372246579d
|
||
|
||
commit 26cb128b31efdd5395153f4943f5be3eddc07033
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Mon Nov 25 00:57:27 2019 +0000
|
||
|
||
upstream: Print a key touch reminder when generating a security
|
||
|
||
key. Most keys require a touch to authorize the operation.
|
||
|
||
OpenBSD-Commit-ID: 7fe8b23edbf33e1bb81741b9f25e9a63be5f6b68
|
||
|
||
commit daeaf4136927c2a82af1399022103d67ff03f74a
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Mon Nov 25 00:55:58 2019 +0000
|
||
|
||
upstream: allow "ssh-keygen -x no-touch-required" when generating a
|
||
|
||
security key keypair to request one that does not require a touch for each
|
||
authentication attempt. The default remains to require touch.
|
||
|
||
feedback deraadt; ok markus@
|
||
|
||
OpenBSD-Commit-ID: 887e7084b2e89c0c62d1598ac378aad8e434bcbd
|
||
|
||
commit 2e71263b80fec7ad977e098004fef7d122169d40
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Mon Nov 25 00:54:23 2019 +0000
|
||
|
||
upstream: add a "no-touch-required" option for authorized_keys and
|
||
|
||
a similar extension for certificates. This option disables the default
|
||
requirement that security key signatures attest that the user touched their
|
||
key to authorize them.
|
||
|
||
feedback deraadt, ok markus
|
||
|
||
OpenBSD-Commit-ID: f1fb56151ba68d55d554d0f6d3d4dba0cf1a452e
|
||
|
||
commit 0fddf2967ac51d518e300408a0d7e6adf4cd2634
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Mon Nov 25 00:52:46 2019 +0000
|
||
|
||
upstream: Add a sshd_config PubkeyAuthOptions directive
|
||
|
||
This directive has a single valid option "no-touch-required" that
|
||
causes sshd to skip checking whether user presence was tested before
|
||
a security key signature was made (usually by the user touching the
|
||
key).
|
||
|
||
ok markus@
|
||
|
||
OpenBSD-Commit-ID: 46e434a49802d4ed82bc0aa38cb985c198c407de
|
||
|
||
commit b7e74ea072919b31391bc0f5ff653f80b9f5e84f
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Mon Nov 25 00:51:37 2019 +0000
|
||
|
||
upstream: Add new structure for signature options
|
||
|
||
This is populated during signature verification with additional fields
|
||
that are present in and covered by the signature. At the moment, it is
|
||
only used to record security key-specific options, especially the flags
|
||
field.
|
||
|
||
with and ok markus@
|
||
|
||
OpenBSD-Commit-ID: 338a1f0e04904008836130bedb9ece4faafd4e49
|
||
|
||
commit d2b0f88178ec9e3f11b606bf1004ac2fe541a2c3
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Mon Nov 25 00:38:17 2019 +0000
|
||
|
||
upstream: memleak in error path
|
||
|
||
OpenBSD-Commit-ID: 93488431bf02dde85a854429362695d2d43d9112
|
||
|
||
commit e2c0a21ade5e0bd7f0aab08d7eb9457f086681e9
|
||
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
||
Date: Fri Nov 22 06:50:30 2019 +0000
|
||
|
||
upstream: Wait for FD to be readable or writeable during a nonblocking
|
||
|
||
connect, not just readable. Prevents a timeout when the server doesn't
|
||
immediately send a banner (eg multiplexers like sslh) but is also slightly
|
||
quicker for other connections since, unlike ssh1, ssh2 doesn't specify
|
||
that the client should parse the server banner before sending its own.
|
||
Patch from mnissler@chromium.org, ok djm@
|
||
|
||
OpenBSD-Commit-ID: aba9cd8480d1d9dd31d0ca0422ea155c26c5df1d
|
||
|
||
commit 2f95d43dc222ce194622b706682e8de07c9cfb42
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Wed Nov 20 16:34:11 2019 +1100
|
||
|
||
Include openssl compat header.
|
||
|
||
Fixes warning for ECDSA_SIG_set0 on OpenSSL versions prior to 1.1.
|
||
|
||
commit a70d92f236576c032a45c39e68ca0d71e958d19d
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Tue Nov 19 22:23:19 2019 +0000
|
||
|
||
upstream: adjust on-wire signature encoding for ecdsa-sk keys to
|
||
|
||
better match ec25519-sk keys. Discussed with markus@ and Sebastian Kinne
|
||
|
||
NB. if you are depending on security keys (already?) then make sure you
|
||
update both your clients and servers.
|
||
|
||
OpenBSD-Commit-ID: 53d88d8211f0dd02a7954d3af72017b1a79c0679
|
||
|
||
commit 26369a5f7d9c4e4ef44a3e04910126e1bcea43d8
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Tue Nov 19 22:21:15 2019 +0000
|
||
|
||
upstream: a little more information from the monitor when signature
|
||
|
||
verification fails.
|
||
|
||
OpenBSD-Commit-ID: e6a30071e0518cac512f9e10be3dc3500e2003f3
|
||
|
||
commit 4402d6c9b5bf128dcfae2429f1d41cdaa8849b6b
|
||
Author: jmc@openbsd.org <jmc@openbsd.org>
|
||
Date: Tue Nov 19 16:02:32 2019 +0000
|
||
|
||
upstream: revert previous: naddy pointed out what's meant to
|
||
|
||
happen. rethink needed...
|
||
|
||
OpenBSD-Commit-ID: fb0fede8123ea7f725fd65e00d49241c40bd3421
|
||
|
||
commit 88056f881315233e990e4e04a815f8f96b4674e1
|
||
Author: jmc@openbsd.org <jmc@openbsd.org>
|
||
Date: Tue Nov 19 14:54:47 2019 +0000
|
||
|
||
upstream: -c and -s do not make sense with -k; reshuffle -k into
|
||
|
||
the main synopsis/usage; ok djm
|
||
|
||
OpenBSD-Commit-ID: f881ba253da015398ae8758d973e3390754869bc
|
||
|
||
commit 2cf262c21f35296c2ff718cfdb52e0473a1c3983
|
||
Author: naddy@openbsd.org <naddy@openbsd.org>
|
||
Date: Mon Nov 18 23:17:48 2019 +0000
|
||
|
||
upstream: document '$' environment variable expansion for
|
||
|
||
SecurityKeyProvider; ok djm@
|
||
|
||
OpenBSD-Commit-ID: 76db507ebd336a573e1cd4146cc40019332c5799
|
||
|
||
commit f0edda81c5ebccffcce52b182c3033531a1aab71
|
||
Author: naddy@openbsd.org <naddy@openbsd.org>
|
||
Date: Mon Nov 18 23:16:49 2019 +0000
|
||
|
||
upstream: more missing mentions of ed25519-sk; ok djm@
|
||
|
||
OpenBSD-Commit-ID: f242e53366f61697dffd53af881bc5daf78230ff
|
||
|
||
commit 189550f5bc85148e85f4caa1f6b2fc623149a4ee
|
||
Author: naddy@openbsd.org <naddy@openbsd.org>
|
||
Date: Mon Nov 18 16:10:05 2019 +0000
|
||
|
||
upstream: additional missing stdarg.h includes when built without
|
||
|
||
WITH_OPENSSL; ok djm@
|
||
|
||
OpenBSD-Commit-ID: 881f9a2c4e2239849cee8bbf4faec9bab128f55b
|
||
|
||
commit 723a5369864b338c48d22854bc2bb4ee5c083deb
|
||
Author: naddy@openbsd.org <naddy@openbsd.org>
|
||
Date: Mon Nov 18 16:08:57 2019 +0000
|
||
|
||
upstream: add the missing WITH_OPENSSL ifdefs after the ED25519-SK
|
||
|
||
addition; ok djm@
|
||
|
||
OpenBSD-Commit-ID: a9545e1c273e506cf70e328cbb9d0129b6d62474
|
||
|
||
commit 478f4f98e4e93ae4ed1a8911dec4e5b75ea10f30
|
||
Author: Damien Miller <djm@mindrot.org>
|
||
Date: Tue Nov 19 08:52:24 2019 +1100
|
||
|
||
remove all EC algs from proposals, no just sk ones
|
||
|
||
ok dtucker@
|
||
|
||
commit 6a7ef310da100f876a257b7367e3b0766dac3994
|
||
Author: Damien Miller <djm@mindrot.org>
|
||
Date: Mon Nov 18 22:22:04 2019 +1100
|
||
|
||
filter PUBKEY_DEFAULT_PK_ALG for ECC algorithms
|
||
|
||
Remove ECC algorithms from the PUBKEY_DEFAULT_PK_ALG list when
|
||
compiling without ECC support in libcrypto.
|
||
|
||
commit 64f56f1d1af3947a71a4c391f2c08747d19ee591
|
||
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
||
Date: Mon Nov 18 09:15:17 2019 +0000
|
||
|
||
upstream: LibreSSL change the format for openssl rsa -text output from
|
||
|
||
"publicExponent" to "Exponent" so accept either. with djm.
|
||
|
||
OpenBSD-Regress-ID: b7e6c4bf700029a31c98be14600d4472fe0467e6
|
||
|
||
commit 4bfc0503ad94a2a7190686a89649567c20b8534f
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Mon Nov 18 06:58:00 2019 +0000
|
||
|
||
upstream: fix a bug that prevented serialisation of ed25519-sk keys
|
||
|
||
OpenBSD-Commit-ID: 066682b79333159cac04fcbe03ebd9c8dcc152a9
|
||
|
||
commit d88205417084f523107fbe1bc92061635cd57fd2
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Mon Nov 18 06:39:36 2019 +0000
|
||
|
||
upstream: Fix incorrect error message when key certification fails
|
||
|
||
OpenBSD-Commit-ID: 7771bd77ee73f7116df37c734c41192943a73cee
|
||
|
||
commit 740c4bc9875cbb4b9fc03fd5eac19df080f20df5
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Mon Nov 18 06:39:02 2019 +0000
|
||
|
||
upstream: fix bug that prevented certification of ed25519-sk keys
|
||
|
||
OpenBSD-Commit-ID: 64c8cc6f5de2cdd0ee3a81c3a9dee8d862645996
|
||
|
||
commit 85409cbb505d8c463ab6e2284b4039764c7243de
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Mon Nov 18 06:24:17 2019 +0000
|
||
|
||
upstream: allow *-sk key types to be turned into certificates
|
||
|
||
OpenBSD-Commit-ID: cd365ee343934862286d0b011aa77fa739d2a945
|
||
|
||
commit e2e1283404e06a22ac6135d057199e70dcadb8dd
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Mon Nov 18 04:55:02 2019 +0000
|
||
|
||
upstream: mention ed25519-sk key/cert types here too; prompted by
|
||
|
||
jmc@
|
||
|
||
OpenBSD-Commit-ID: e281977e4a4f121f3470517cbd5e483eee37b818
|
||
|
||
commit 97dc5d1d82865a7d20f1eb193b5c62ce684024e5
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Mon Nov 18 04:50:45 2019 +0000
|
||
|
||
upstream: mention ed25519-sk in places where it is accepted;
|
||
|
||
prompted by jmc@
|
||
|
||
OpenBSD-Commit-ID: 076d386739ebe7336c2137e583bc7a5c9538a442
|
||
|
||
commit 130664344862a8c7afd3e24d8d36ce40af41a99f
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Mon Nov 18 04:34:47 2019 +0000
|
||
|
||
upstream: document ed25519-sk pubkey, private key and certificate
|
||
|
||
formats
|
||
|
||
OpenBSD-Commit-ID: 795a7c1c80315412e701bef90e31e376ea2f3c88
|
||
|
||
commit 71856e1142fc01628ce53098f8cfc74765464b35
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Mon Nov 18 04:29:50 2019 +0000
|
||
|
||
upstream: correct order or ecdsa-sk private key fields
|
||
|
||
OpenBSD-Commit-ID: 4d4a0c13226a79f0080ce6cbe74f73b03ed8092e
|
||
|
||
commit 93fa2a6649ae3e0626cbff25c985a4573d63e3f2
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Mon Nov 18 04:16:53 2019 +0000
|
||
|
||
upstream: correct description of fields in pub/private keys (was
|
||
|
||
missing curve name); spotted by Sebastian Kinne
|
||
|
||
OpenBSD-Commit-ID: 2a11340dc7ed16200342d384fb45ecd4fcce26e7
|
||
|
||
commit b497e920b409250309c4abe64229237b8f2730ba
|
||
Author: Damien Miller <djm@mindrot.org>
|
||
Date: Mon Nov 18 15:05:04 2019 +1100
|
||
|
||
Teach the GTK2/3 ssh-askpass the new prompt hints
|
||
|
||
ssh/ssh-agent now sets a hint environment variable $SSH_ASKPASS_PROMPT
|
||
when running the askpass program. This is intended to allow the
|
||
askpass to vary its UI across the three cases it supports: asking for
|
||
a passphrase, confirming the use of a key and (recently) reminding
|
||
a user to touch their security key.
|
||
|
||
This adapts the gnome-ssh-askpass[23] to use these hints. Specifically,
|
||
for SSH_ASKPASS_PROMPT=confirm it will skip the text input box and show
|
||
only "yes"/"no" buttons. For SSH_ASKPASS_PROMPT=none (used to remind
|
||
users to tap their security key), it shows only a "close" button.
|
||
|
||
Help wanted: adapt the other askpass programs in active use, including
|
||
x11-ssh-askpass, lxqt-openssh-askpass, etc.
|
||
|
||
commit 857f49e91eeae6feb781ef5f5e26c38ca3d953ec
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Mon Nov 18 14:15:26 2019 +1100
|
||
|
||
Move ifdef OPENSSL_HAS_ECC.
|
||
|
||
Found by -Wimplicit-fallthrough: one ECC case was not inside the ifdef.
|
||
ok djm@
|
||
|
||
commit 6cf1c40096a79e5eedcf897c7cdb46bb32d4a3ee
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Mon Nov 18 14:14:18 2019 +1100
|
||
|
||
Enable -Wimplicit-fallthrough if supported
|
||
|
||
Suggested by djm.
|
||
|
||
commit 103c51fd5f5ddc01cd6b5c1132e711765b921bf5
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Mon Nov 18 01:59:48 2019 +0000
|
||
|
||
upstream: missing break in getopt switch; spotted by Sebastian Kinne
|
||
|
||
OpenBSD-Commit-ID: f002dbf14dba5586e8407e90f0141148ade8e8fc
|
||
|
||
commit 9a1225e8ca2ce1fe809910874935302234399a6d
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Sat Nov 16 23:17:20 2019 +0000
|
||
|
||
upstream: tweak debug message
|
||
|
||
OpenBSD-Commit-ID: 2bf336d3be0b7e3dd97920d7e7471146a281d2b9
|
||
|
||
commit 4103a3ec7c68493dbc4f0994a229507e943a86d3
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Sat Nov 16 22:42:30 2019 +0000
|
||
|
||
upstream: a little debug() in the security key interface
|
||
|
||
OpenBSD-Commit-ID: 4c70300609a5c8b19707207bb7ad4109e963b0e8
|
||
|
||
commit 05daa211de926f66f50b7380d637f84dc6341574
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Sat Nov 16 22:36:48 2019 +0000
|
||
|
||
upstream: always use ssh-sk-helper, even for the internal USB HID
|
||
|
||
support. This avoid the need for a wpath pledge in ssh-agent.
|
||
|
||
reported by jmc@
|
||
|
||
OpenBSD-Commit-ID: 19f799c4d020b870741d221335dbfa5e76691c23
|
||
|
||
commit d431778a561d90131814f986b646299f9af33c8c
|
||
Author: markus@openbsd.org <markus@openbsd.org>
|
||
Date: Fri Nov 15 15:41:01 2019 +0000
|
||
|
||
upstream: fix typos in sk_enroll
|
||
|
||
OpenBSD-Commit-ID: faa9bf779e008b3e64e2eb1344d9b7d83b3c4487
|
||
|
||
commit af90aec0443ec51e6b2d804cb91771d3905f8a6f
|
||
Author: jmc@openbsd.org <jmc@openbsd.org>
|
||
Date: Fri Nov 15 11:16:28 2019 +0000
|
||
|
||
upstream: double word;
|
||
|
||
OpenBSD-Commit-ID: 43d09bafa4ea9002078cb30ca9adc3dcc0b9c2b9
|
||
|
||
commit fd1a96490cef7f945a1b3b5df4e90c8a1070f425
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Fri Nov 15 06:00:20 2019 +0000
|
||
|
||
upstream: remove most uses of BN_CTX
|
||
|
||
We weren't following the rules re BN_CTX_start/BN_CTX_end and the places
|
||
we were using it didn't benefit from its use anyway. ok dtucker@
|
||
|
||
OpenBSD-Commit-ID: ea9ba6c0d2e6f6adfe00b309a8f41842fe12fc7a
|
||
|
||
commit 39b87104cdd47baf79ef77dc81de62cea07d119f
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Fri Nov 15 18:56:54 2019 +1100
|
||
|
||
Add wrappers for other ultrix headers.
|
||
|
||
Wrappers protect against multiple inclusions for headers that don't do
|
||
it themselves.
|
||
|
||
commit 134a74f4e0cf750931f1125beb2a3f40c54c8809
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Fri Nov 15 18:55:13 2019 +1100
|
||
|
||
Add SSIZE_MAX when we define ssize_t.
|
||
|
||
commit 9c6d0a3a1ed77989d8c5436d8c3cc6c7045c0197
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Fri Nov 15 17:13:19 2019 +1100
|
||
|
||
Remove ultrix realpath hack.
|
||
|
||
commit c63fba5e3472307167850bbd84187186af7fa9f0
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Fri Nov 15 05:37:27 2019 +0000
|
||
|
||
upstream: unshield security key privkey before attempting signature
|
||
|
||
in agent. spotted by dtucker@
|
||
|
||
OpenBSD-Commit-ID: fb67d451665385b8a0a55371231c50aac67b91d2
|
||
|
||
commit d165bb5396e3f718480e6039ca2cf77f5a2c2885
|
||
Author: deraadt@openbsd.org <deraadt@openbsd.org>
|
||
Date: Fri Nov 15 05:26:56 2019 +0000
|
||
|
||
upstream: rewrite c99-ism
|
||
|
||
OpenBSD-Commit-ID: d0c70cca29cfa7e6d9f7ec1d6d5dabea112499b3
|
||
|
||
commit 03e06dd0e6e1c0a9f4b4b9de7def8a44dcbf93a7
|
||
Author: deraadt@openbsd.org <deraadt@openbsd.org>
|
||
Date: Fri Nov 15 05:25:52 2019 +0000
|
||
|
||
upstream: only clang understands those new -W options
|
||
|
||
OpenBSD-Commit-ID: d9b910e412d139141b072a905e66714870c38ac0
|
||
|
||
commit 5c0bc273cba53f822b7d777bbb6c35d160d3b505
|
||
Author: Damien Miller <djm@mindrot.org>
|
||
Date: Fri Nov 15 16:08:00 2019 +1100
|
||
|
||
configure flag to built-in security key support
|
||
|
||
Require --with-security-key-builtin before enabling the built-in
|
||
security key support (and consequent dependency on libfido2).
|
||
|
||
commit fbcb9a7fa55300b8bd4c18bee024c6104c5a25d7
|
||
Author: Damien Miller <djm@mindrot.org>
|
||
Date: Fri Nov 15 16:06:30 2019 +1100
|
||
|
||
upstream commit
|
||
|
||
revision 1.48
|
||
date: 2019/02/04 16:45:40; author: millert; state: Exp; lines: +16 -17; commitid: cpNtVC7erojNyctw;
|
||
Make gl_pathc, gl_matchc and gl_offs size_t in glob_t to match POSIX.
|
||
This requires a libc major version bump. OK deraadt@
|
||
|
||
commit 2cfb11abac85885de0cb888bbeb9a3e4303105ea
|
||
Author: Damien Miller <djm@mindrot.org>
|
||
Date: Fri Nov 15 16:05:07 2019 +1100
|
||
|
||
upstream commit
|
||
|
||
revision 1.47
|
||
date: 2017/05/08 14:53:27; author: millert; state: Exp; lines: +34 -21; commitid: sYfxfyUHAfarP8sE;
|
||
Fix exponential CPU use with repeated '*' operators by changing '*'
|
||
handling to be interative instead of recursive.
|
||
Fix by Yves Orton, ported to OpenBSD glob.c by Ray Lai. OK tb@
|
||
|
||
commit 228dd595c7882bb9b161dbb7d4dca15c8a5f03f5
|
||
Author: Damien Miller <djm@mindrot.org>
|
||
Date: Fri Nov 15 16:04:28 2019 +1100
|
||
|
||
upstream commit
|
||
|
||
revision 1.46
|
||
date: 2015/12/28 22:08:18; author: mmcc; state: Exp; lines: +5 -9; commitid: 0uXuF2O13NH9q2e1;
|
||
Remove NULL-checks before free() and a few related dead assignments.
|
||
|
||
ok and valuable input from millert@
|
||
|
||
commit a16f748690139b9f452485d97511ad5e578f59b2
|
||
Author: Damien Miller <djm@mindrot.org>
|
||
Date: Fri Nov 15 16:02:43 2019 +1100
|
||
|
||
upstream commit
|
||
|
||
revision 1.44
|
||
date: 2015/09/14 16:09:13; author: tedu; state: Exp; lines: +3 -5; commitid: iWfSX2BIn0sLw62l;
|
||
remove null check before free. from Michael McConville
|
||
ok semarie
|
||
|
||
commit fd37cdeafe25adfcdc752280f535d28de7997ff1
|
||
Author: Damien Miller <djm@mindrot.org>
|
||
Date: Fri Nov 15 16:02:27 2019 +1100
|
||
|
||
upstream commit
|
||
|
||
revision 1.43
|
||
date: 2015/06/13 16:57:04; author: deraadt; state: Exp; lines: +4 -4; commitid: zOUKuqWBdOPOz1SZ;
|
||
in glob() initialize the glob_t before the first failure check.
|
||
from j@pureftpd.org
|
||
ok millert stsp
|
||
|
||
commit fd62769c3882adea118dccaff80a06009874a2d1
|
||
Author: Damien Miller <djm@mindrot.org>
|
||
Date: Fri Nov 15 16:01:20 2019 +1100
|
||
|
||
upstream commit
|
||
|
||
revision 1.42
|
||
date: 2015/02/05 12:59:57; author: millert; state: Exp; lines: +2 -1; commitid: DTQbfd4poqBW8iSJ;
|
||
Include stdint.h, not limits.h to get SIZE_MAX. OK guenther@
|
||
|
||
commit 2b6cba7ee2b8b36f393be739c860a9d2e5d8eb48
|
||
Author: Damien Miller <djm@mindrot.org>
|
||
Date: Fri Nov 15 16:00:07 2019 +1100
|
||
|
||
upstream commit
|
||
|
||
revision 1.41
|
||
date: 2014/10/08 05:35:27; author: deraadt; state: Exp; lines: +3 -3; commitid: JwTGarRLHQKDgPh2;
|
||
obvious realloc -> reallocarray conversion
|
||
|
||
commit ab3600665387ae34785498558c4409e27f495b0b
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Fri Nov 15 04:12:32 2019 +0000
|
||
|
||
upstream: don't consult dlopen whitelist for internal security key
|
||
|
||
provider; spotted by dtucker@
|
||
|
||
OpenBSD-Commit-ID: bfe5fbd17e4ff95dd85b9212181652b54444192e
|
||
|
||
commit 19f8ec428db835f68c1cfd63587e9880ccd6486c
|
||
Author: Damien Miller <djm@mindrot.org>
|
||
Date: Fri Nov 15 15:08:28 2019 +1100
|
||
|
||
upstream commit
|
||
|
||
revision 1.40
|
||
date: 2013/09/30 12:02:34; author: millert; state: Exp; lines: +14 -15;
|
||
Use PATH_MAX, NAME_MAX and LOGIN_NAME_MAX not MAXPATHNAMELEN,
|
||
MAXNAMLEN or MAXLOGNAME where possible. OK deraadt@
|
||
|
||
commit bb7413db98e418d4af791244660abf6c829783f5
|
||
Author: Damien Miller <djm@mindrot.org>
|
||
Date: Fri Nov 15 15:07:30 2019 +1100
|
||
|
||
upstream commit
|
||
|
||
revision 1.39
|
||
date: 2012/01/20 07:09:42; author: tedu; state: Exp; lines: +4 -4;
|
||
the glob stat limit is way too low. bump to 2048.
|
||
while here, failed stats should count against the limit too.
|
||
ok deraadt sthen stsp
|
||
|
||
commit 01362cf7cb979525c014714e2bccf799a46e772e
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Fri Nov 15 03:41:57 2019 +0000
|
||
|
||
upstream: U2F tokens may return FIDO_ERR_USER_PRESENCE_REQUIRED when
|
||
|
||
probed to see if they own a key handle. Handle this case so the find_device()
|
||
look can work for them. Reported by Michael Forney
|
||
|
||
OpenBSD-Commit-ID: 2ccd5b30a6ddfe4dba228b7159bf168601bd9166
|
||
|
||
commit cf62307bc9758105913dcb91b418e4968ac2244d
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Fri Nov 15 14:01:00 2019 +1100
|
||
|
||
Add libfido2 to INSTALL.
|
||
|
||
commit 69fbda1894349d1f420c842dfcbcc883239d1aa7
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Fri Nov 15 13:42:15 2019 +1100
|
||
|
||
libcrypto is now optional.
|
||
|
||
commit 45ffa369886e37930776d7c15dd8b973242d6ecc
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Fri Nov 15 02:38:07 2019 +0000
|
||
|
||
upstream: show the "please touch your security key" notifier when
|
||
|
||
using the (default) build-in security key support.
|
||
|
||
OpenBSD-Commit-ID: 4707643aaa7124501d14e92d1364b20f312a6428
|
||
|
||
commit 49dc9fa928d77807c53bdc2898db7fb515fe5eb3
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Fri Nov 15 02:37:24 2019 +0000
|
||
|
||
upstream: close the "touch your security key" notifier on the error
|
||
|
||
path too
|
||
|
||
OpenBSD-Commit-ID: c7628bf80505c1aefbb1de7abc8bb5ee51826829
|
||
|
||
commit 22a82712e89bf17c27427aeba15795fb4011a0c2
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Fri Nov 15 02:20:06 2019 +0000
|
||
|
||
upstream: correct function name in debug message
|
||
|
||
OpenBSD-Commit-ID: 2482c99d2ce448f39282493050f8a01e3ffc39ab
|
||
|
||
commit 018e2902a65c22faded215a7c588492c948f108c
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Fri Nov 15 00:32:40 2019 +0000
|
||
|
||
upstream: follow existing askpass logic for security key notifier:
|
||
|
||
fall back to _PATH_SSH_ASKPASS_DEFAULT if no $SSH_ASKPASS environment
|
||
variable is set.
|
||
|
||
OpenBSD-Commit-ID: cda753726b13fb797bf7a9f7a0b3022d9ade4520
|
||
|
||
commit 575d0042a94997c1eeb86a6dcfb30b3c7bdbcba3
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Thu Nov 14 21:56:52 2019 +0000
|
||
|
||
upstream: remove debugging goop that snuck in to last commit
|
||
|
||
OpenBSD-Commit-ID: 8ea4455a2d9364a0a04f9e4a2cbfa4c9fcefe77e
|
||
|
||
commit 63a5b24f2dbdc9a4bf2182ac3db26731ddc617e8
|
||
Author: Damien Miller <djm@mindrot.org>
|
||
Date: Fri Nov 15 11:21:26 2019 +1100
|
||
|
||
don't fatal if libfido2 not found
|
||
|
||
spotted by dtucker@
|
||
|
||
commit 129952a81c00c332721b4ba3ede868c720ad7f4e
|
||
Author: Damien Miller <djm@mindrot.org>
|
||
Date: Fri Nov 15 11:17:12 2019 +1100
|
||
|
||
correct object dependency
|
||
|
||
commit 6bff9521ab9a9f7396d635755c342b72373bb4f9
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Thu Nov 14 21:27:29 2019 +0000
|
||
|
||
upstream: directly support U2F/FIDO2 security keys in OpenSSH by
|
||
|
||
linking against the (previously external) USB HID middleware. The dlopen()
|
||
capability still exists for alternate middlewares, e.g. for Bluetooth, NFC
|
||
and test/debugging.
|
||
|
||
OpenBSD-Commit-ID: 14446cf170ac0351f0d4792ba0bca53024930069
|
||
|
||
commit 4f5e331cb8e11face3025aa6578662dde489c3ad
|
||
Author: markus@openbsd.org <markus@openbsd.org>
|
||
Date: Wed Nov 13 22:00:21 2019 +0000
|
||
|
||
upstream: in order to be able to figure out the number of
|
||
|
||
signatures left on a shielded key, we need to transfer the number of
|
||
signatures left from the private to the public key. ok djm@
|
||
|
||
OpenBSD-Commit-ID: 8a5d0d260aeace47d372695fdae383ce9b962574
|
||
|
||
commit dffd02e297e6c2a4e86775f293eb1b0ff01fb3df
|
||
Author: markus@openbsd.org <markus@openbsd.org>
|
||
Date: Wed Nov 13 20:25:45 2019 +0000
|
||
|
||
upstream: fix check for sig_s; noted by qsa at qualys.com
|
||
|
||
OpenBSD-Commit-ID: 34198084e4afb424a859f52c04bb2c9668a52867
|
||
|
||
commit fc173aeb1526d4268db89ec5dfebaf8750dd26cd
|
||
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
||
Date: Wed Nov 13 11:25:11 2019 +0000
|
||
|
||
upstream: When clients get denied by MaxStartups, send a
|
||
|
||
noification prior to the SSH2 protocol banner according to RFC4253 section
|
||
4.2. ok djm@ deraadt@ markus@
|
||
|
||
OpenBSD-Commit-ID: e5dabcb722d54dea18eafb336d50b733af4f9c63
|
||
|
||
commit bf219920b70cafbf29ebc9890ef67d0efa54e738
|
||
Author: markus@openbsd.org <markus@openbsd.org>
|
||
Date: Wed Nov 13 07:53:10 2019 +0000
|
||
|
||
upstream: fix shield/unshield for xmss keys: - in ssh-agent we need
|
||
|
||
to delay the call to shield until we have received key specific options. -
|
||
when serializing xmss keys for shield we need to deal with all optional
|
||
components (e.g. state might not be loaded). ok djm@
|
||
|
||
OpenBSD-Commit-ID: cc2db82524b209468eb176d6b4d6b9486422f41f
|
||
|
||
commit 40598b85d72a509566b7b2a6d57676c7231fed34
|
||
Author: deraadt@openbsd.org <deraadt@openbsd.org>
|
||
Date: Wed Nov 13 05:42:26 2019 +0000
|
||
|
||
upstream: remove size_t gl_pathc < 0 test, it is invalid. the
|
||
|
||
return value from glob() is sufficient. discussed with djm
|
||
|
||
OpenBSD-Commit-ID: c91203322db9caaf7efaf5ae90c794a91070be3c
|
||
|
||
commit 72687c8e7c38736e3e64e833ee7aa8f9cd9efed1
|
||
Author: deraadt@openbsd.org <deraadt@openbsd.org>
|
||
Date: Wed Nov 13 04:47:52 2019 +0000
|
||
|
||
upstream: stdarg.h required more broadly; ok djm
|
||
|
||
OpenBSD-Commit-ID: b5b15674cde1b54d6dbbae8faf30d47e6e5d6513
|
||
|
||
commit 1e0b248d47c96be944868a735553af8482300a07
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Thu Nov 14 16:08:17 2019 +1100
|
||
|
||
Put sshsk_sign call inside ifdef ENABLE_SK.
|
||
|
||
Fixes build against OpenSSL configured without ECC.
|
||
|
||
commit 546274a6f89489d2e6be8a8b62f2bb63c87a61fd
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Wed Nov 13 23:27:31 2019 +1100
|
||
|
||
Remove duplicate __NR_clock_nanosleep
|
||
|
||
commit b1c82f4b8adf3f42476d8a1f292df33fb7aa1a56
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Wed Nov 13 23:19:35 2019 +1100
|
||
|
||
seccomp: Allow clock_nanosleep() in sandbox.
|
||
|
||
seccomp: Allow clock_nanosleep() to make OpenSSH working with latest
|
||
glibc. Patch from Jakub Jelen <jjelen@redhat.com> via bz #3093.
|
||
|
||
commit 2b523d23804c13cb68db135b919fcf312c42b580
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Wed Nov 13 11:56:56 2019 +1100
|
||
|
||
Include stdarg.h for va_list in xmalloc.h.
|
||
|
||
commit 245dcbdca5374296bdb9c48be6e24bdf6b1c0af7
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Wed Nov 13 11:19:26 2019 +1100
|
||
|
||
Put headers inside ifdef _AIX.
|
||
|
||
Prevents compile errors due to missing definitions (eg va_list) on
|
||
non-AIX platforms.
|
||
|
||
commit a4cc579c6ad2b2e54bdd6cc0d5e12c2288113a56
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Wed Nov 13 10:41:41 2019 +1100
|
||
|
||
Fix comment in match_usergroup_pattern_list.
|
||
|
||
Spotted by balu.gajjala@gmail.com via bz#3092.
|
||
|
||
commit fccff339cab5aa66f2554e0188b83f980683490b
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Tue Nov 12 22:38:19 2019 +0000
|
||
|
||
upstream: allow an empty attestation certificate returned by a
|
||
|
||
security key enrollment - these are possible for tokens that only offer self-
|
||
attestation. This also needs support from the middleware.
|
||
|
||
ok markus@
|
||
|
||
OpenBSD-Commit-ID: 135eeeb937088ef6830a25ca0bbe678dfd2c57cc
|
||
|
||
commit e44bb61824e36d0d181a08489c16c378c486a974
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Tue Nov 12 22:36:44 2019 +0000
|
||
|
||
upstream: security keys typically need to be tapped/touched in
|
||
|
||
order to perform a signature operation. Notify the user when this is expected
|
||
via the TTY (if available) or $SSH_ASKPASS if we can.
|
||
|
||
ok markus@
|
||
|
||
OpenBSD-Commit-ID: 0ef90a99a85d4a2a07217a58efb4df8444818609
|
||
|
||
commit 4671211068441519011ac0e38c588317f4157ba1
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Tue Nov 12 22:35:02 2019 +0000
|
||
|
||
upstream: pass SSH_ASKPASS_PROMPT hint to y/n key confirm too
|
||
|
||
OpenBSD-Commit-ID: 08d46712e5e5f1bad0aea68e7717b7bec1ab8959
|
||
|
||
commit 5d1c1590d736694f41b03e686045f08fcae20d62
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Tue Nov 12 22:34:20 2019 +0000
|
||
|
||
upstream: dd API for performing one-shot notifications via tty or
|
||
|
||
SSH_ASKPASS
|
||
|
||
OpenBSD-Commit-ID: 9484aea33aff5b62ce3642bf259546c7639f23f3
|
||
|
||
commit 166927fd410823eec8a7b2472463db51e0e6fef5
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Tue Nov 12 22:32:48 2019 +0000
|
||
|
||
upstream: add xvasprintf()
|
||
|
||
OpenBSD-Commit-ID: e5e3671c05c121993b034db935bce1a7aa372247
|
||
|
||
commit 782093ec6cf64cc6c4078410093359869ea9329f
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Wed Nov 13 09:08:55 2019 +1100
|
||
|
||
Remove leftover if statement from sync.
|
||
|
||
commit b556cc3cbf0c43f073bb41bba4e92ca709a1ec13
|
||
Author: markus@openbsd.org <markus@openbsd.org>
|
||
Date: Tue Nov 12 19:34:40 2019 +0000
|
||
|
||
upstream: remove extra layer for ed25519 signature; ok djm@
|
||
|
||
OpenBSD-Commit-ID: 7672d9d0278b4bf656a12d3aab0c0bfe92a8ae47
|
||
|
||
commit 3fcf69ace19e75cf9dcd7206f396adfcb29611a8
|
||
Author: markus@openbsd.org <markus@openbsd.org>
|
||
Date: Tue Nov 12 19:34:00 2019 +0000
|
||
|
||
upstream: check sig_r and sig_s for ssh-sk keys; ok djm
|
||
|
||
OpenBSD-Commit-ID: 1a1e6a85b5f465d447a3800f739e35c5b74e0abc
|
||
|
||
commit 2c55744a56de0ffc81fe445a1e7fc5cd308712b3
|
||
Author: markus@openbsd.org <markus@openbsd.org>
|
||
Date: Tue Nov 12 19:33:08 2019 +0000
|
||
|
||
upstream: enable ed25519 support; ok djm
|
||
|
||
OpenBSD-Commit-ID: 1a399c5b3ef15bd8efb916110cf5a9e0b554ab7e
|
||
|
||
commit fd1a3b5e38721b1d69aae2d9de1a1d9155dfa5c7
|
||
Author: markus@openbsd.org <markus@openbsd.org>
|
||
Date: Tue Nov 12 19:32:30 2019 +0000
|
||
|
||
upstream: update sk-api to version 2 for ed25519 support; ok djm
|
||
|
||
OpenBSD-Commit-ID: 77aa4d5b6ab17987d8a600907b49573940a0044a
|
||
|
||
commit 7c32b51edbed5bd57870249c0a45dffd06be0002
|
||
Author: markus@openbsd.org <markus@openbsd.org>
|
||
Date: Tue Nov 12 19:31:45 2019 +0000
|
||
|
||
upstream: implement sshsk_ed25519_assemble(); ok djm
|
||
|
||
OpenBSD-Commit-ID: af9ec838b9bc643786310b5caefc4ca4754e68c6
|
||
|
||
commit fe05a36dc0ea884c8c2395d53d804fe4f4202b26
|
||
Author: markus@openbsd.org <markus@openbsd.org>
|
||
Date: Tue Nov 12 19:31:18 2019 +0000
|
||
|
||
upstream: implement sshsk_ed25519_inner_sig(); ok djm
|
||
|
||
OpenBSD-Commit-ID: f422d0052c6d948fe0e4b04bc961f37fdffa0910
|
||
|
||
commit e03a29e6554cd0c9cdbac0dae53dd79e6eb4ea47
|
||
Author: markus@openbsd.org <markus@openbsd.org>
|
||
Date: Tue Nov 12 19:30:50 2019 +0000
|
||
|
||
upstream: rename sshsk_ecdsa_sign() to sshsk_sign(); ok djm
|
||
|
||
OpenBSD-Commit-ID: 1524042e09d81e54c4470d7bfcc0194c5b46fe19
|
||
|
||
commit bc7b5d6187de625c086b5f639b25bbad17bbabfc
|
||
Author: markus@openbsd.org <markus@openbsd.org>
|
||
Date: Tue Nov 12 19:30:21 2019 +0000
|
||
|
||
upstream: factor out sshsk_ecdsa_inner_sig(); ok djm@
|
||
|
||
OpenBSD-Commit-ID: 07e41997b542f670a15d7e2807143fe01efef584
|
||
|
||
commit cef84a062db8cfeece26f067235dc440f6992c17
|
||
Author: markus@openbsd.org <markus@openbsd.org>
|
||
Date: Tue Nov 12 19:29:54 2019 +0000
|
||
|
||
upstream: factor out sshsk_ecdsa_assemble(); ok djm@
|
||
|
||
OpenBSD-Commit-ID: 2313761a3a84ccfe032874d638d3c363e0f14026
|
||
|
||
commit 7c096c456f33f3d2682736d4735cc10e790276e9
|
||
Author: markus@openbsd.org <markus@openbsd.org>
|
||
Date: Tue Nov 12 19:29:24 2019 +0000
|
||
|
||
upstream: implement ssh-ed25519-sk verification; ok djm@
|
||
|
||
OpenBSD-Commit-ID: 37906d93948a1e3d237c20e713d6ca8fbf7d13f6
|
||
|
||
commit ba5fb02bed1e556d0ce7b1740ae8a5f87b737491
|
||
Author: Damien Miller <djm@mindrot.org>
|
||
Date: Wed Nov 13 08:48:30 2019 +1100
|
||
|
||
ignore ssh-sk-helper
|
||
|
||
commit 78c96498947f711141f493a40d202c482cc59438
|
||
Author: deraadt@openbsd.org <deraadt@openbsd.org>
|
||
Date: Mon Nov 11 19:53:37 2019 +0000
|
||
|
||
upstream: skip demanding -fstack-protector-all on hppa. we never
|
||
|
||
wrote a stack protector for reverse-stack architectures, and i don't think
|
||
anyone else did either. a warning per compiled file is just annoying.
|
||
|
||
OpenBSD-Commit-ID: 14806a59353152f843eb349e618abbf6f4dd3ada
|
||
|
||
commit aa1c9e37789f999979fe59df74ce5c8424861ac8
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Fri Nov 8 03:54:02 2019 +0000
|
||
|
||
upstream: duplicate 'x' character in getopt(3) optstring
|
||
|
||
OpenBSD-Commit-ID: 64c81caa0cb5798de3621eca16b7dd22e5d0d8a7
|
||
|
||
commit aa4c640dc362816d63584a16e786d5e314e24390
|
||
Author: naddy@openbsd.org <naddy@openbsd.org>
|
||
Date: Thu Nov 7 08:38:38 2019 +0000
|
||
|
||
upstream: Fill in missing man page bits for U2F security key support:
|
||
|
||
Mention the new key types, the ~/.ssh/id_ecdsa_sk file, ssh's
|
||
SecurityKeyProvider keyword, the SSH_SK_PROVIDER environment variable,
|
||
and ssh-keygen's new -w and -x options.
|
||
|
||
Copy the ssh-sk-helper man page from ssh-pkcs11-helper with minimal
|
||
substitutions.
|
||
|
||
ok djm@
|
||
|
||
OpenBSD-Commit-ID: ef2e8f83d0c0ce11ad9b8c28945747e5ca337ac4
|
||
|
||
commit b236b27d6dada7f0542214003632b4e9b7aa1380
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Sun Nov 3 00:10:43 2019 +1100
|
||
|
||
Put sftp-realpath in libssh.a
|
||
|
||
and remove it from the specific binary targets.
|
||
|
||
commit 382c18c20cdcec45b5d21ff25b4a5e0df91a68c4
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Sun Nov 3 00:09:21 2019 +1100
|
||
|
||
statfs might be defined in sys/mount.h.
|
||
|
||
eg on old NetBSDs.
|
||
|
||
commit 03ffc0951c305c8e3b5fdc260d65312a57f8f7ea
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Sat Nov 2 23:25:01 2019 +1100
|
||
|
||
Put stdint.h inside ifdef HAVE_STDINT_H.
|
||
|
||
commit 19cb64c4b42d4312ce12091fd9436dbd6898998c
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Sat Nov 2 22:45:44 2019 +1100
|
||
|
||
Rebuild .depend.
|
||
|
||
commit 3611bfe89b92ada5914526d8ff0919aeb967cfa7
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Sat Nov 2 22:42:05 2019 +1100
|
||
|
||
Define __BSD_VISIBLE in fnmatch.h.
|
||
|
||
.. since we use symbols defined only when it is when using the compat
|
||
fnmatch.
|
||
|
||
commit f5cc5816aaddb8eca3cba193f53e99d6a0b37d05
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Sat Nov 2 16:39:38 2019 +1100
|
||
|
||
Only enable U2F if OpenSSL supports ECC.
|
||
|
||
This requires moving the U2F bits to below the OpenSSL parts so we have
|
||
the required information. ok djm@
|
||
|
||
commit ad38406fc95fa223b0ef2edf8ff50508f8ab1cb6
|
||
Author: naddy@openbsd.org <naddy@openbsd.org>
|
||
Date: Fri Nov 1 12:10:43 2019 +0000
|
||
|
||
upstream: fix miscellaneous text problems; ok djm@
|
||
|
||
OpenBSD-Commit-ID: 0cbf411a14d8fa0b269b69cbb1b4fc0ca699fe9f
|
||
|
||
commit 9cac151c2dc76b8e5b727b2fa216f572e372170f
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Fri Nov 1 18:26:07 2019 +1100
|
||
|
||
Add flags needed to build and work on Ultrix.
|
||
|
||
commit 0e3c5bc50907d2058407641b5a3581b7eda91b7e
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Fri Nov 1 18:24:29 2019 +1100
|
||
|
||
Hook up fnmatch for platforms that don't have it.
|
||
|
||
commit b56dbfd9d967e5b6ce7be9f81f206112e19e1030
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Fri Nov 1 18:17:42 2019 +1100
|
||
|
||
Add missing bracket in realpath macro.
|
||
|
||
commit 59ccb56f15e5e530e7c1b5a0b361749d8c6217d5
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Fri Nov 1 17:32:47 2019 +1100
|
||
|
||
Import fnmatch.c from OpenBSD.
|
||
|
||
commit 79d46de9fbea0f3c0e8ae7cf84effaba089071b0
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Fri Nov 1 15:22:32 2019 +1100
|
||
|
||
Use sftp_realpath if no native realpath.
|
||
|
||
commit bb4f003ed8c5f61ec74a66bcedc8ab19bf5b35c4
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Fri Nov 1 15:06:16 2019 +1100
|
||
|
||
Configure flags for haiku from haikuports.
|
||
|
||
Should build with the default flags with ./configure
|
||
|
||
commit 4332b4fe49360679647a8705bc08f4e81323f6b4
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Fri Nov 1 03:54:33 2019 +0000
|
||
|
||
upstream: fix a race condition in the SIGCHILD handler that could turn
|
||
|
||
in to a kill(-1); bz3084, reported by Gao Rui, ok dtucker@
|
||
|
||
OpenBSD-Commit-ID: ac2742e04a69d4c34223505b6a32f6d686e18896
|
||
|
||
commit 03f9205f0fb49ea2507eacc143737a8511ae5a4e
|
||
Author: Damien Miller <djm@mindrot.org>
|
||
Date: Fri Nov 1 14:49:25 2019 +1100
|
||
|
||
conditionalise SK sign/verify on ENABLE_SK
|
||
|
||
Spotted by Darren and his faux-Vax
|
||
|
||
commit 5eb7b9563ff818e17de24231bf2d347d9db302c5
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Fri Nov 1 14:41:07 2019 +1100
|
||
|
||
Add prototype for localtime_r if needed.
|
||
|
||
commit d500b59a825f6a58f2abf7b04eb1992d81e45d58
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Fri Nov 1 13:42:12 2019 +1100
|
||
|
||
Check if IP_TOS is defined before using.
|
||
|
||
commit 764d51e04460ec0da12e05e4777bc90c116accb9
|
||
Author: Damien Miller <djm@mindrot.org>
|
||
Date: Fri Nov 1 13:34:49 2019 +1100
|
||
|
||
autoconf pieces for U2F support
|
||
|
||
Mostly following existing logic for PKCS#11 - turning off support
|
||
when either libcrypto or dlopen(3) are unavailable.
|
||
|
||
commit 45f17a159acfc5a8e450bfbcc2cffe72950ed7a3
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Fri Nov 1 02:32:05 2019 +0000
|
||
|
||
upstream: remove duplicate PUBKEY_DEFAULT_PK_ALG on !WITH_OPENSSL path
|
||
|
||
OpenBSD-Commit-ID: 95a7cafad2a4665d57cabacc28031fabc0bea9fc
|
||
|
||
commit db8d13f7925da7337df87248995c533e111637ec
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Fri Nov 1 02:06:52 2019 +0000
|
||
|
||
upstream: more additional source files
|
||
|
||
OpenBSD-Regress-ID: 8eaa25fb901594aee23b76eda99dca5b8db94c6f
|
||
|
||
commit f89c5df65dd307739ff22319c2cf847d3b0c5ab4
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Fri Nov 1 02:04:25 2019 +0000
|
||
|
||
upstream: additional source files here too
|
||
|
||
OpenBSD-Regress-ID: 8809f8e1c8f7459e7096ab6b58d8e56cb2f483fd
|
||
|
||
commit 02275afa1ecbfbd39f27d34c97090e76bec232ec
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Fri Nov 1 02:03:27 2019 +0000
|
||
|
||
upstream: additional source files here too
|
||
|
||
OpenBSD-Regress-ID: 09297e484327f911fd353489518cceaa0c1b95ce
|
||
|
||
commit dfc8f01b9886c7999e6e20acf3f7492cb8c80796
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Fri Nov 1 01:57:59 2019 +0000
|
||
|
||
upstream: adapt to extra sshkey_sign() argument and additional
|
||
|
||
dependencies
|
||
|
||
OpenBSD-Regress-ID: 7a25604968486c4d6f81d06e8fbc7d17519de50e
|
||
|
||
commit afa59e26eeb44a93f36f043f60b936eaddae77c4
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Fri Nov 1 01:55:41 2019 +0000
|
||
|
||
upstream: skip security-key key types for tests until we have a
|
||
|
||
dummy U2F middleware to use.
|
||
|
||
OpenBSD-Regress-ID: 37200462b44334a4ad45e6a1f7ad1bd717521a95
|
||
|
||
commit de871e4daf346a712c78fa4ab8f18b231a47cb85
|
||
Author: jmc@openbsd.org <jmc@openbsd.org>
|
||
Date: Fri Nov 1 00:52:35 2019 +0000
|
||
|
||
upstream: sort;
|
||
|
||
OpenBSD-Commit-ID: 8264b0be01ec5a60602bd50fd49cc3c81162ea16
|
||
|
||
commit 2aae149a34b1b5dfbef423d3b7999a96818969bb
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Thu Oct 31 21:37:33 2019 +0000
|
||
|
||
upstream: undo debugging bits that shouldn't have been committed
|
||
|
||
OpenBSD-Commit-ID: 4bd5551b306df55379afe17d841207990eb773bf
|
||
|
||
commit 3420e0464bd0e8fedcfa5fd20ad37bdc740ad5b4
|
||
Author: Damien Miller <djm@mindrot.org>
|
||
Date: Fri Nov 1 09:24:58 2019 +1100
|
||
|
||
depend
|
||
|
||
commit b923a90abc7bccb11a513dc8b5c0f13a0ea9682c
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Thu Oct 31 21:28:27 2019 +0000
|
||
|
||
upstream: fix -Wshadow warning
|
||
|
||
OpenBSD-Commit-ID: 3441eb04f872a00c2483c11a5f1570dfe775103c
|
||
|
||
commit 9a14c64c38fc14d0029f1c7bc70cf62cc7f0fdf9
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Thu Oct 31 21:23:19 2019 +0000
|
||
|
||
upstream: Refactor signing - use sshkey_sign for everything,
|
||
|
||
including the new U2F signatures.
|
||
|
||
Don't use sshsk_ecdsa_sign() directly, instead make it reachable via
|
||
sshkey_sign() like all other signature operations. This means that
|
||
we need to add a provider argument to sshkey_sign(), so most of this
|
||
change is mechanically adding that.
|
||
|
||
Suggested by / ok markus@
|
||
|
||
OpenBSD-Commit-ID: d5193a03fcfa895085d91b2b83d984a9fde76c8c
|
||
|
||
commit 07da39f71d36fb547749a5b16aa8892e621a7e4a
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Thu Oct 31 21:22:01 2019 +0000
|
||
|
||
upstream: ssh-agent support for U2F/FIDO keys
|
||
|
||
feedback & ok markus@
|
||
|
||
OpenBSD-Commit-ID: bb544a44bc32e45d2ec8bf652db2046f38360acb
|
||
|
||
commit eebec620c9519c4839d781c4d5b6082152998f82
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Thu Oct 31 21:20:38 2019 +0000
|
||
|
||
upstream: ssh AddKeysToAgent support for U2F/FIDO keys
|
||
|
||
feedback & ok markus@
|
||
|
||
OpenBSD-Commit-ID: ac08e45c7f995fa71f8d661b3f582e38cc0a2f91
|
||
|
||
commit 486164d060314a7f8bca2a00f53be9e900c5e74d
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Thu Oct 31 21:19:56 2019 +0000
|
||
|
||
upstream: ssh-add support for U2F/FIDO keys
|
||
|
||
OpenBSD-Commit-ID: 7f88a5181c982687afedf3130c6ab2bba60f7644
|
||
|
||
commit b9dd14d3091e31fb836f69873d3aa622eb7b4a1c
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Thu Oct 31 21:19:14 2019 +0000
|
||
|
||
upstream: add new agent key constraint for U2F/FIDO provider
|
||
|
||
feedback & ok markus@
|
||
|
||
OpenBSD-Commit-ID: d880c380170704280b4003860a1744d286c7a172
|
||
|
||
commit 884416bdb10468f1252e4d7c13d51b43dccba7f6
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Thu Oct 31 21:18:28 2019 +0000
|
||
|
||
upstream: ssh client support for U2F/FIDO keys
|
||
|
||
OpenBSD-Commit-ID: eb2cfa6cf7419a1895e06e398ea6d41516c5b0bc
|
||
|
||
commit 01a0670f69c5b86e471e033b92145d6c7cc77c58
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Thu Oct 31 21:17:49 2019 +0000
|
||
|
||
upstream: Separate myproposal.h userauth pubkey types
|
||
|
||
U2F/FIDO keys are not supported for host authentication, so we need
|
||
a separate list for user keys.
|
||
|
||
feedback & ok markus@
|
||
|
||
OpenBSD-Commit-ID: 7fe2e6ab85f9f2338866e5af8ca2d312abbf0429
|
||
|
||
commit 23f38c2d8cda3fad24e214e1f0133c42435b54ee
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Thu Oct 31 21:17:09 2019 +0000
|
||
|
||
upstream: ssh-keygen support for generating U2F/FIDO keys
|
||
|
||
OpenBSD-Commit-ID: 6ce04f2b497ac9dd8c327f76f1e6c724fb1d1b37
|
||
|
||
commit ed3467c1e16b7396ff7fcf12d2769261512935ec
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Thu Oct 31 21:16:20 2019 +0000
|
||
|
||
upstream: U2F/FIDO middleware interface
|
||
|
||
Supports enrolling (generating) keys and signatures.
|
||
|
||
feedback & ok markus@
|
||
|
||
OpenBSD-Commit-ID: 73d1dd5939454f9c7bd840f48236cba41e8ad592
|
||
|
||
commit 02bb0768a937e50bbb236efc2bbdddb1991b1c85
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Thu Oct 31 21:15:14 2019 +0000
|
||
|
||
upstream: Initial infrastructure for U2F/FIDO support
|
||
|
||
Key library support: including allocation, marshalling public/private
|
||
keys and certificates, signature validation.
|
||
|
||
feedback & ok markus@
|
||
|
||
OpenBSD-Commit-ID: a17615ba15e0f7932ac4360cb18fc9a9544e68c7
|
||
|
||
commit 57ecc10628b04c384cbba2fbc87d38b74cd1199d
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Thu Oct 31 21:14:17 2019 +0000
|
||
|
||
upstream: Protocol documentation for U2F/FIDO keys in OpenSSH
|
||
|
||
OpenBSD-Commit-ID: 8f3247317c2909870593aeb306dff848bc427915
|
||
|
||
commit f4fdcd2b7a2bbf5d8770d44565173ca5158d4dcb
|
||
Author: Damien Miller <djm@mindrot.org>
|
||
Date: Fri Nov 1 08:36:16 2019 +1100
|
||
|
||
Missing unit test files
|
||
|
||
commit 1bcd1169c5221688418fa38606e9c69055b72451
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Tue Oct 29 19:45:03 2019 +1100
|
||
|
||
Add implementation of localtime_r.
|
||
|
||
commit 2046ed16c1202431b0307674c33a123a113e8297
|
||
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
||
Date: Tue Oct 29 07:47:27 2019 +0000
|
||
|
||
upstream: Signal handler cleanup: remove leftover support for
|
||
|
||
unreliable signals and now-unneeded save and restore of errno. ok deraadt@
|
||
markus@
|
||
|
||
OpenBSD-Commit-ID: 01dd8a1ebdd991c8629ba1f5237283341a93cd88
|
||
|
||
commit 70fc9a6ca4dd33cb2dd400a4dad5db9683a3d284
|
||
Author: jmc@openbsd.org <jmc@openbsd.org>
|
||
Date: Tue Oct 22 08:50:35 2019 +0000
|
||
|
||
upstream: fixes from lucas;
|
||
|
||
OpenBSD-Commit-ID: 4c4bfd2806c5bbc753788ffe19c5ee13aaf418b2
|
||
|
||
commit 702368aa4381c3b482368257ac574a87b5a80938
|
||
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
||
Date: Tue Oct 22 07:06:35 2019 +0000
|
||
|
||
upstream: Import regenerated moduli file.
|
||
|
||
OpenBSD-Commit-ID: 58ec755be4e51978ecfee73539090eb68652a987
|
||
|
||
commit 5fe81da22652f8caa63e9e3a1af519a85d36337e
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Mon Oct 28 21:19:47 2019 +1100
|
||
|
||
Fix ifdefs to not mask needed bits.
|
||
|
||
commit 7694e9d2fb5785bbdd0920dce7a160bd79feaf00
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Mon Oct 28 17:05:36 2019 +1100
|
||
|
||
Only use RLIMIT_NOFILE if it's defined.
|
||
|
||
commit d561b0b2fa2531b4cc3bc70a7d657c6485c9fd0b
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Mon Oct 28 16:09:04 2019 +1100
|
||
|
||
Make sure we have struct statfs before using.
|
||
|
||
commit 2912596aecfcf48e5115c7a906d1e664f7717a4b
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Mon Oct 28 16:06:59 2019 +1100
|
||
|
||
Define UINT32_MAX if needed.
|
||
|
||
commit 7169e31121e8c8cc729b55154deb722ae495b316
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Mon Oct 28 16:00:45 2019 +1100
|
||
|
||
Move utimensat definition into timespec section.
|
||
|
||
Since utimensat uses struct timespec, move it to the section where we
|
||
define struct timespec when needed.
|
||
|
||
commit 850ec1773d656cbff44d78a79e369dc262ce5853
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Mon Oct 28 15:57:22 2019 +1100
|
||
|
||
Wrap OpenSSL bits in WITH_OPENSSL.
|
||
|
||
commit 6fc7e1c6fec3ba589869ae98e968c0e5e2e4695b
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Mon Oct 28 15:53:25 2019 +1100
|
||
|
||
Wrap poll.h includes in HAVE_POLL_H.
|
||
|
||
commit 9239a18f96905cc1a353e861e33af093652f24e7
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Thu Oct 24 14:39:49 2019 +1100
|
||
|
||
Add a function call stackprotector tests.
|
||
|
||
Including a function call in the test programs for the gcc stack
|
||
protector flag tests exercises more of the compiler and makes it more
|
||
likely it'll detect problems.
|
||
|
||
commit b9705393be4612fd5e29d0cd8e7cf2b66ed19eb7
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Tue Oct 22 18:09:22 2019 +1100
|
||
|
||
Import regenerated moduli file.
|
||
|
||
commit 76ed2199491397e0f9902ade80d5271e4a9b2630
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Wed Oct 16 06:05:39 2019 +0000
|
||
|
||
upstream: potential NULL dereference for revoked hostkeys; reported
|
||
|
||
by krishnaiah bommu
|
||
|
||
OpenBSD-Commit-ID: 35ff685e7cc9dd2e3fe2e3dfcdcb9bc5c79f6506
|
||
|
||
commit 6500c3bc71bf4fe14972c1177e6b93f1164d07a4
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Wed Oct 16 06:03:30 2019 +0000
|
||
|
||
upstream: free buf before return; reported by krishnaiah bommu
|
||
|
||
OpenBSD-Commit-ID: 091bb23a6e913af5d4f72c50030b53ce1cef4de1
|
||
|
||
commit d7d116b6d9e6cb79cc235e9801caa683d3db3181
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Mon Oct 14 06:00:02 2019 +0000
|
||
|
||
upstream: memleak in error path; spotted by oss-fuzz, ok markus@
|
||
|
||
OpenBSD-Commit-ID: d6ed260cbbc297ab157ad63931802fb1ef7a4266
|
||
|
||
commit 9b9e3ca6945351eefb821ff783a4a8e6d9b98b9a
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Fri Oct 11 14:12:16 2019 +1100
|
||
|
||
Re-add SA_RESTART to mysignal.
|
||
|
||
This makes mysignal implement reliable BSD semantics according to
|
||
Stevens' APUE. This was first attempted in 2001 but was reverted
|
||
due to problems with HP-UX 10.20 and select() and possibly grantpt().
|
||
Modern systems should be fine with it, but if any current platforms have
|
||
a problem with it now we can disable it just for those. ok djm@
|
||
|
||
commit 0bd312a362168c1eae3cd6b3889395a78e6fd0f8
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Thu Oct 10 09:42:03 2019 +1100
|
||
|
||
Fix ifdef typo for declaration of memmem.
|
||
|
||
Fixes build on IRIX. bz#3081.
|
||
|
||
commit 01ce1cd402d5eecde2bba35b67e08f5b266b37fd
|
||
Author: Abhishek Arya <inferno@chromium.org>
|
||
Date: Tue Oct 8 20:19:18 2019 -0700
|
||
|
||
Update README.md
|
||
|
||
commit 1ba130ac8fb2884307f658126f04578f8aef409e
|
||
Author: Damien Miller <djm@mindrot.org>
|
||
Date: Wed Oct 9 13:49:35 2019 +1100
|
||
|
||
add a fuzzer for private key parsing
|
||
|
||
commit cdf1d0a9f5d18535e0a18ff34860e81a6d83aa5c
|
||
Author: Damien Miller <djm@mindrot.org>
|
||
Date: Wed Oct 9 11:31:03 2019 +1100
|
||
|
||
prepare for 8.1 release
|
||
|
||
commit 3b4e56d740b74324e2d7542957cad5a11518f455
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Wed Oct 9 00:04:57 2019 +0000
|
||
|
||
upstream: openssh-8.1
|
||
|
||
OpenBSD-Commit-ID: 3356bb34e2aa287f0e6d6773c9ae659dc680147d
|
||
|
||
commit 29e0ecd9b4eb3b9f305e2240351f0c59cad9ef81
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Wed Oct 9 00:04:42 2019 +0000
|
||
|
||
upstream: fix an unreachable integer overflow similar to the XMSS
|
||
|
||
case, and some other NULL dereferences found by fuzzing.
|
||
|
||
fix with and ok markus@
|
||
|
||
OpenBSD-Commit-ID: 0f81adbb95ef887ce586953e1cb225fa45c7a47b
|
||
|
||
commit a546b17bbaeb12beac4c9aeed56f74a42b18a93a
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Wed Oct 9 00:02:57 2019 +0000
|
||
|
||
upstream: fix integer overflow in XMSS private key parsing.
|
||
|
||
Reported by Adam Zabrocki via SecuriTeam's SSH program.
|
||
|
||
Note that this code is experimental and not compiled by default.
|
||
|
||
ok markus@
|
||
|
||
OpenBSD-Commit-ID: cd0361896d15e8a1bac495ac583ff065ffca2be1
|
||
|
||
commit c2cc25480ba36ab48c1a577bebb12493865aad87
|
||
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
||
Date: Tue Oct 8 22:40:39 2019 +0000
|
||
|
||
upstream: Correct type for end-of-list sentinel; fixes initializer
|
||
|
||
warnings on some platforms. ok deraadt.
|
||
|
||
OpenBSD-Commit-ID: a990dbc2dac25bdfa07e79321349c73fd991efa2
|
||
|
||
commit e827aedf8818e75c0016b47ed8fc231427457c43
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Mon Oct 7 23:10:38 2019 +0000
|
||
|
||
upstream: reversed test yielded incorrect debug message
|
||
|
||
OpenBSD-Commit-ID: 78bb512d04cfc238adb2c5b7504ac93eecf523b3
|
||
|
||
commit 8ca491d29fbe26e5909ce22b344c0a848dc28d55
|
||
Author: Damien Miller <djm@mindrot.org>
|
||
Date: Tue Oct 8 17:05:57 2019 +1100
|
||
|
||
depend
|
||
|
||
commit 86a0323374cbd404629e75bb320b3fa1c16aaa6b
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Wed Oct 9 09:36:06 2019 +1100
|
||
|
||
Make MAKE_CLONE no-op macro more correct.
|
||
|
||
Similar to the previous change to DEF_WEAK, some compilers don't like
|
||
the empty statement, so convert into a no-op function prototype.
|
||
|
||
commit cfc1897a2002ec6c4dc879b24e8b3153c87ea2cf
|
||
Author: Damien Miller <djm@mindrot.org>
|
||
Date: Wed Oct 9 09:06:35 2019 +1100
|
||
|
||
wrap stdint.h include in HAVE_STDINT_H
|
||
|
||
make the indenting a little more consistent too..
|
||
|
||
Fixes Solaris 2.6; reported by Tom G. Christensen
|
||
|
||
commit 13b3369830a43b89a503915216a23816d1b25744
|
||
Author: Damien Miller <djm@mindrot.org>
|
||
Date: Tue Oct 8 15:32:02 2019 +1100
|
||
|
||
avoid "return (value)" in void-declared function
|
||
|
||
spotted by Tim Rice; ok dtucker
|
||
|
||
commit 0c7f8d2326d812b371f7afd63aff846973ec80a4
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Tue Oct 8 14:44:50 2019 +1100
|
||
|
||
Make DEF_WEAK more likely to be correct.
|
||
|
||
Completely nop-ing out DEF_WEAK leaves an empty statemment which some
|
||
compilers don't like. Replace with a no-op function template. ok djm@
|
||
|
||
commit b1e79ea8fae9c252399677a28707661d85c7d00c
|
||
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
||
Date: Sun Oct 6 11:49:50 2019 +0000
|
||
|
||
upstream: Instead of running sed over the whole log to remove CRs,
|
||
|
||
remove them only where it's needed (and confuses test(1) on at least OS X in
|
||
portable).
|
||
|
||
OpenBSD-Regress-ID: a6ab9b4bd1d33770feaf01b2dfb96f9e4189d2d0
|
||
|
||
commit 8dc7d6b75a7f746fdd056acd41dffc0a13557a4c
|
||
Author: Eduardo Barretto <ebarretto@linux.vnet.ibm.com>
|
||
Date: Tue May 9 13:33:30 2017 -0300
|
||
|
||
Enable specific ioctl call for EP11 crypto card (s390)
|
||
|
||
The EP11 crypto card needs to make an ioctl call, which receives an
|
||
specific argument. This crypto card is for s390 only.
|
||
|
||
Signed-off-by: Eduardo Barretto <ebarretto@linux.vnet.ibm.com>
|
||
|
||
commit 07f2c7f34951c04d2cd796ac6c80e47c56c4969e
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Fri Oct 4 04:31:59 2019 +0000
|
||
|
||
upstream: fix memory leak in error path; bz#3074 patch from
|
||
|
||
krishnaiah.bommu@intel.com, ok dtucker
|
||
|
||
OpenBSD-Commit-ID: d031853f3ecf47b35a0669588f4d9d8e3b307b3c
|
||
|
||
commit b7fbc75e119170f4d15c94a7fda4a1050e0871d6
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Fri Oct 4 04:13:39 2019 +0000
|
||
|
||
upstream: space
|
||
|
||
OpenBSD-Commit-ID: 350648bcf00a2454e7ef998b7d88e42552b348ac
|
||
|
||
commit 643ab68c79ac1644f4a31e36928c2bfc8a51db3c
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Fri Oct 4 03:39:19 2019 +0000
|
||
|
||
upstream: more sshsig regress tests: check key revocation, the
|
||
|
||
check-novalidate signature test mode and signing keys in ssh-agent.
|
||
|
||
From Sebastian Kinne (slightly tweaked)
|
||
|
||
OpenBSD-Regress-ID: b39566f5cec70140674658cdcedf38752a52e2e2
|
||
|
||
commit 714031a10bbe378a395a93cf1040f4ee1451f45f
|
||
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
||
Date: Fri Oct 4 03:26:58 2019 +0000
|
||
|
||
upstream: Check for gmtime failure in moduli generation. Based on
|
||
|
||
patch from krishnaiah.bommu@intel.com, ok djm@
|
||
|
||
OpenBSD-Commit-ID: 4c6a4cde0022188ac83737de08da0e875704eeaa
|
||
|
||
commit 6918974405cc28ed977f802fd97a9c9a9b2e141b
|
||
Author: jmc@openbsd.org <jmc@openbsd.org>
|
||
Date: Thu Oct 3 17:07:50 2019 +0000
|
||
|
||
upstream: use a more common options order in SYNOPSIS and sync
|
||
|
||
usage(); while here, no need for Bk/Ek;
|
||
|
||
ok dtucker
|
||
|
||
OpenBSD-Commit-ID: 38715c3f10b166f599a2283eb7bc14860211bb90
|
||
|
||
commit feff96b7d4c0b99307f0459cbff128aede4a8984
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Wed Oct 2 09:50:50 2019 +0000
|
||
|
||
upstream: thinko in previous; spotted by Mantas
|
||
|
||
=?UTF-8?q?=20Mikul=C4=97nas?=
|
||
MIME-Version: 1.0
|
||
Content-Type: text/plain; charset=UTF-8
|
||
Content-Transfer-Encoding: 8bit
|
||
|
||
OpenBSD-Commit-ID: ffa3f5a45e09752fc47d9041e2203ee2ec15b24d
|
||
|
||
commit b5a89eec410967d6b712665f8cf0cb632928d74b
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Wed Oct 2 08:07:13 2019 +0000
|
||
|
||
upstream: make signature format match PROTOCO
|
||
|
||
=?UTF-8?q?=20as=20a=20string,=20not=20raw=20bytes.=20Spotted=20by=20Manta?=
|
||
=?UTF-8?q?s=20Mikul=C4=97nas?=
|
||
MIME-Version: 1.0
|
||
Content-Type: text/plain; charset=UTF-8
|
||
Content-Transfer-Encoding: 8bit
|
||
|
||
OpenBSD-Commit-ID: 80fcc6d52893f80c6de2bedd65353cebfebcfa8f
|
||
|
||
commit dc6f81ee94995deb11bbf7e19801022c5f6fd90a
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Wed Oct 2 08:05:50 2019 +0000
|
||
|
||
upstream: ban empty namespace strings for s
|
||
|
||
=?UTF-8?q?shsig;=20spotted=20by=20Mantas=20Mikul=C4=97nas?=
|
||
MIME-Version: 1.0
|
||
Content-Type: text/plain; charset=UTF-8
|
||
Content-Transfer-Encoding: 8bit
|
||
|
||
OpenBSD-Commit-ID: 7c5bcf40bed8f4e826230176f4aa353c52aeb698
|
||
|
||
commit fa5bd8107e0e2b3e1e184f55d0f9320c119f65f0
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Wed Oct 2 14:30:55 2019 +1000
|
||
|
||
Put ssherr.h back as it's actually needed.
|
||
|
||
commit 3ef92a657444f172b61f92d5da66d94fa8265602
|
||
Author: Lonnie Abelbeck <lonnie@abelbeck.com>
|
||
Date: Tue Oct 1 09:05:09 2019 -0500
|
||
|
||
Deny (non-fatal) shmget/shmat/shmdt in preauth privsep child.
|
||
|
||
New wait_random_seeded() function on OpenSSL 1.1.1d uses shmget, shmat, and shmdt
|
||
in the preauth codepath, deny (non-fatal) in seccomp_filter sandbox.
|
||
|
||
commit edd1d3a6261aecbf9a55944fd7be1db83571b46e
|
||
Author: Damien Miller <djm@mindrot.org>
|
||
Date: Wed Oct 2 10:54:28 2019 +1000
|
||
|
||
remove duplicate #includes
|
||
|
||
Prompted by Jakub Jelen
|
||
|
||
commit 13c508dfed9f25e6e54c984ad00a74ef08539e70
|
||
Author: Damien Miller <djm@mindrot.org>
|
||
Date: Wed Oct 2 10:51:15 2019 +1000
|
||
|
||
typo in comment
|
||
|
||
commit d0c3ac427f6c52b872d6617421421dd791664445
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Wed Oct 2 00:42:30 2019 +0000
|
||
|
||
upstream: remove some duplicate #includes
|
||
|
||
OpenBSD-Commit-ID: ed6827ab921eff8027669848ef4f70dc1da4098c
|
||
|
||
commit 084682786d9275552ee93857cb36e43c446ce92c
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Tue Oct 1 10:22:53 2019 +0000
|
||
|
||
upstream: revert unconditional forced login implemented in r1.41 of
|
||
|
||
ssh-pkcs11.c; r1.45 added a forced login as a fallback for cases where the
|
||
token returns no objects and this is less disruptive for users of tokens
|
||
directly in ssh (rather than via ssh-agent) and in ssh-keygen
|
||
|
||
bz3006, patch from Jakub Jelen; ok markus
|
||
|
||
OpenBSD-Commit-ID: 33d6df589b072094384631ff93b1030103b3d02e
|
||
|
||
commit 6c91d42cce3f055917dc3fd2c305dfc5b3b584b3
|
||
Author: jmc@openbsd.org <jmc@openbsd.org>
|
||
Date: Sun Sep 29 16:31:57 2019 +0000
|
||
|
||
upstream: group and sort single letter options; ok deraadt
|
||
|
||
OpenBSD-Commit-ID: e1480e760a2b582f79696cdcff70098e23fc603f
|
||
|
||
commit 3b44bf39ff4d7ef5d50861e2e9dda62d2926d2fe
|
||
Author: jmc@openbsd.org <jmc@openbsd.org>
|
||
Date: Fri Sep 27 20:03:24 2019 +0000
|
||
|
||
upstream: fix the DH-GEX text in -a; because this required a comma,
|
||
|
||
i added a comma to the first part, for balance...
|
||
|
||
OpenBSD-Commit-ID: 2c3464e9e82a41e8cdfe8f0a16d94266e43dbb58
|
||
|
||
commit 3e53ef28fab53094e3b19622ba0e9c3d5fe71273
|
||
Author: deraadt@openbsd.org <deraadt@openbsd.org>
|
||
Date: Tue Sep 24 12:50:46 2019 +0000
|
||
|
||
upstream: identity_file[] should be PATH_MAX, not the arbitrary
|
||
|
||
number 1024
|
||
|
||
OpenBSD-Commit-ID: e775f94ad47ce9ab37bd1410d7cf3b7ea98b11b7
|
||
|
||
commit 90d4b2541e8c907793233d9cbd4963f7624f4174
|
||
Author: jmc@openbsd.org <jmc@openbsd.org>
|
||
Date: Fri Sep 20 18:50:58 2019 +0000
|
||
|
||
upstream: new sentence, new line;
|
||
|
||
OpenBSD-Commit-ID: c35ca5ec07be460e95e7406af12eee04a77b6698
|
||
|
||
commit fbec7dba01b70b49ac47f56031310865dff86200
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Mon Sep 30 18:01:12 2019 +1000
|
||
|
||
Include stdio.h for snprintf.
|
||
|
||
Patch from vapier@gentoo.org.
|
||
|
||
commit 0a403bfde71c4b82147473298d3a60b4171468bd
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Mon Sep 30 14:11:42 2019 +1000
|
||
|
||
Add SKIP_LTESTS for skipping specific tests.
|
||
|
||
commit 4d59f7a5169c451ebf559aedec031ac9da2bf80c
|
||
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
||
Date: Fri Sep 27 05:25:12 2019 +0000
|
||
|
||
upstream: Test for empty result in expected bits. Remove CRs from log
|
||
|
||
as they confuse tools on some platforms. Re-enable the 3des-cbc test.
|
||
|
||
OpenBSD-Regress-ID: edf536d4f29fc1ba412889b37247a47f1b49d250
|
||
|
||
commit 7c817d129e2d48fc8a6f7965339313023ec45765
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Fri Sep 27 15:26:22 2019 +1000
|
||
|
||
Re-enable dhgex test.
|
||
|
||
Since we've added larger fallback groups to dh.c this test will pass
|
||
even if there is no moduli file installed on the system.
|
||
|
||
commit c1e0a32fa852de6d1c82ece4f76add0ab0ca0eae
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Tue Sep 24 21:17:20 2019 +1000
|
||
|
||
Add more ToS bits, currently only used by netcat.
|
||
|
||
commit 5a273a33ca1410351cb484af7db7c13e8b4e8e4e
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Thu Sep 19 15:41:23 2019 +1000
|
||
|
||
Privsep is now required.
|
||
|
||
commit 8aa2aa3cd4d27d14e74b247c773696349472ef20
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Mon Sep 16 03:23:02 2019 +0000
|
||
|
||
upstream: Allow testing signature syntax and validity without verifying
|
||
|
||
that a signature came from a trusted signer. To discourage accidental or
|
||
unintentional use, this is invoked by the deliberately ugly option name
|
||
"check-novalidate"
|
||
|
||
from Sebastian Kinne
|
||
|
||
OpenBSD-Commit-ID: cea42c36ab7d6b70890e2d8635c1b5b943adcc0b
|
||
|
||
commit 7047d5afe3103f0f07966c05b810682d92add359
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Fri Sep 13 04:52:34 2019 +0000
|
||
|
||
upstream: clarify that IdentitiesOnly also applies to the default
|
||
|
||
~/.ssh/id_* keys; bz#3062
|
||
|
||
OpenBSD-Commit-ID: 604be570e04646f0f4a17026f8b2aada6a585dfa
|
||
|
||
commit b36ee3fcb2f1601693b1b7fd60dd6bd96006ea75
|
||
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
||
Date: Fri Sep 13 04:36:43 2019 +0000
|
||
|
||
upstream: Plug mem leaks on error paths, based in part on github
|
||
|
||
pr#120 from David Carlier. ok djm@.
|
||
|
||
OpenBSD-Commit-ID: c57adeb1022a8148fc86e5a88837b3b156dbdb7e
|
||
|
||
commit 2aefdf1aef906cf7548a2e5927d35aacb55948d4
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Fri Sep 13 04:31:19 2019 +0000
|
||
|
||
upstream: whitespace
|
||
|
||
OpenBSD-Commit-ID: 57a71dd5f4cae8d61e0ac631a862589fb2bfd700
|
||
|
||
commit fbe24b142915331ceb2a3a76be3dc5b6d204fddf
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Fri Sep 13 04:27:35 2019 +0000
|
||
|
||
upstream: allow %n to be expanded in ProxyCommand strings
|
||
|
||
From Zachary Harmany via github.com/openssh/openssh-portable/pull/118
|
||
ok dtucker@
|
||
|
||
OpenBSD-Commit-ID: 7eebf1b7695f50c66d42053d352a4db9e8fb84b6
|
||
|
||
commit 2ce1d11600e13bee0667d6b717ffcc18a057b821
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Fri Sep 13 04:07:42 2019 +0000
|
||
|
||
upstream: clarify that ConnectTimeout applies both to the TCP
|
||
|
||
connection and to the protocol handshake/KEX. From Jean-Charles Longuet via
|
||
Github PR140
|
||
|
||
OpenBSD-Commit-ID: ce1766abc6da080f0d88c09c2c5585a32b2256bf
|
||
|
||
commit df780114278f406ef7cb2278802a2660092fff09
|
||
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
||
Date: Mon Sep 9 02:31:19 2019 +0000
|
||
|
||
upstream: Fix potential truncation warning. ok deraadt.
|
||
|
||
OpenBSD-Commit-ID: d87b7e3a94ec935e8194e7fce41815e22804c3ff
|
||
|
||
commit ec0e6243660bf2df30c620a6a0d83eded376c9c6
|
||
Author: Damien Miller <djm@mindrot.org>
|
||
Date: Fri Sep 13 13:14:39 2019 +1000
|
||
|
||
memleak of buffer in sshpam_query
|
||
|
||
coverity report via Ed Maste; ok dtucker@
|
||
|
||
commit c17e4638e5592688264fc0349f61bfc7b4425aa5
|
||
Author: Damien Miller <djm@mindrot.org>
|
||
Date: Fri Sep 13 13:12:42 2019 +1000
|
||
|
||
explicitly test set[ug]id() return values
|
||
|
||
Legacy !_POSIX_SAVED_IDS path only; coverity report via Ed Maste
|
||
ok dtucker@
|
||
|
||
commit 91a2135f32acdd6378476c5bae475a6e7811a6a2
|
||
Author: naddy@openbsd.org <naddy@openbsd.org>
|
||
Date: Fri Sep 6 14:45:34 2019 +0000
|
||
|
||
upstream: Allow prepending a list of algorithms to the default set
|
||
|
||
by starting the list with the '^' character, e.g.
|
||
|
||
HostKeyAlgorithms ^ssh-ed25519
|
||
Ciphers ^aes128-gcm@openssh.com,aes256-gcm@openssh.com
|
||
|
||
ok djm@ dtucker@
|
||
|
||
OpenBSD-Commit-ID: 1e1996fac0dc8a4b0d0ff58395135848287f6f97
|
||
|
||
commit c8bdd2db77ac2369d5cdee237656f266c8f41552
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Fri Sep 6 07:53:40 2019 +0000
|
||
|
||
upstream: key conversion should fail for !openssl builds, not fall
|
||
|
||
through to the key generation code
|
||
|
||
OpenBSD-Commit-ID: b957436adc43c4941e61d61958a193a708bc83c9
|
||
|
||
commit 823f6c37eb2d8191d45539f7b6fa877a4cb4ed3d
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Fri Sep 6 06:08:11 2019 +0000
|
||
|
||
upstream: typo in previous
|
||
|
||
OpenBSD-Commit-ID: 7c3b94110864771a6b80a0d8acaca34037c3c96e
|
||
|
||
commit 6a710d3e06fd375e2c2ae02546b9541c488a2cdb
|
||
Author: Damien Miller <djm@mindrot.org>
|
||
Date: Sun Sep 8 14:48:11 2019 +1000
|
||
|
||
needs time.h for --without-openssl
|
||
|
||
commit f61f29afda6c71eda26effa54d3c2e5306fd0833
|
||
Author: Damien Miller <djm@mindrot.org>
|
||
Date: Sat Sep 7 19:25:00 2019 +1000
|
||
|
||
make unittests pass for no-openssl case
|
||
|
||
commit 105e1c9218940eb53473f55a9177652d889ddbad
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Fri Sep 6 05:59:41 2019 +0000
|
||
|
||
upstream: avoid compiling certain files that deeply depend on
|
||
|
||
libcrypto when WITH_OPENSSL isn't set
|
||
|
||
OpenBSD-Commit-ID: 569f08445c27124ec7c7f6c0268d844ec56ac061
|
||
|
||
commit 670104b923dd97b1c06c0659aef7c3e52af571b2
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Fri Sep 6 05:23:55 2019 +0000
|
||
|
||
upstream: fixes for !WITH_OPENSSL compilation; ok dtucker@
|
||
|
||
OpenBSD-Commit-ID: 7fd68eaa9e0f7482b5d4c7e8d740aed4770a839f
|
||
|
||
commit be02d7cbde3d211ec2ed2320a1f7d86b2339d758
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Fri Sep 6 04:53:27 2019 +0000
|
||
|
||
upstream: lots of things were relying on libcrypto headers to
|
||
|
||
transitively include various system headers (mostly stdlib.h); include them
|
||
explicitly
|
||
|
||
OpenBSD-Commit-ID: 5b522f4f2d844f78bf1cc4f3f4cc392e177b2080
|
||
|
||
commit d05aaaaadcad592abfaa44540928e0c61ef72ebb
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Fri Sep 6 03:30:42 2019 +0000
|
||
|
||
upstream: remove leakmalloc reference; we used this early when
|
||
|
||
refactoring but not since
|
||
|
||
OpenBSD-Commit-ID: bb28ebda8f7c490b87b37954044a6cdd43a7eb2c
|
||
|
||
commit 1268f0bcd8fc844ac6c27167888443c8350005eb
|
||
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
||
Date: Fri Sep 6 04:24:06 2019 +0000
|
||
|
||
upstream: Check for RSA support before using it for the user key,
|
||
|
||
otherwise use ed25519 which is supported when built without OpenSSL.
|
||
|
||
OpenBSD-Regress-ID: 3d23ddfe83c5062f00ac845d463f19a2ec78c0f7
|
||
|
||
commit fd7a2dec652b9efc8e97f03f118f935dce732c60
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Fri Sep 6 14:07:10 2019 +1000
|
||
|
||
Provide explicit path to configure-check.
|
||
|
||
On some platforms (at least OpenBSD) make won't search VPATH for target
|
||
files, so building out-of-tree will fail at configure-check. Provide
|
||
explicit path. ok djm@
|
||
|
||
commit 00865c29690003b4523cc09a0e104724b9f911a4
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Fri Sep 6 01:58:50 2019 +0000
|
||
|
||
upstream: better error code for bad arguments; inspired by
|
||
|
||
OpenBSD-Commit-ID: dfc263b6041de7f0ed921a1de0b81ddebfab1e0a
|
||
|
||
commit afdf27f5aceb4973b9f5308f4310c6e3fd8db1fb
|
||
Author: Damien Miller <djm@mindrot.org>
|
||
Date: Thu Sep 5 21:38:40 2019 +1000
|
||
|
||
revert config.h/config.h.in freshness checks
|
||
|
||
turns out autoreconf and configure don't touch some files if their content
|
||
doesn't change, so the mtime can't be relied upon in a makefile rule
|
||
|
||
commit a97609e850c57bd2cc2fe7e175fc35cb865bc834
|
||
Author: Damien Miller <djm@mindrot.org>
|
||
Date: Thu Sep 5 20:54:39 2019 +1000
|
||
|
||
extend autoconf freshness test
|
||
|
||
make it cover config.h.in and config.h separately
|
||
|
||
commit 182297c10edb21c4856c6a38326fd04d81de41a5
|
||
Author: Damien Miller <djm@mindrot.org>
|
||
Date: Thu Sep 5 20:34:54 2019 +1000
|
||
|
||
check that configure/config.h is up to date
|
||
|
||
Ensure they are newer than the configure.ac / aclocal.m4 source
|
||
|
||
commit 7d6034bd020248e9fc0f8c39c71c858debd0d0c1
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Thu Sep 5 10:05:51 2019 +0000
|
||
|
||
upstream: if a PKCS#11 token returns no keys then try to login and
|
||
|
||
refetch them. Based on patch from Jakub Jelen; bz#2430 ok markus@
|
||
|
||
OpenBSD-Commit-ID: ab53bd6ddd54dd09e54a8bfbed1a984496f08b43
|
||
|
||
commit 76f09bd95917862101b740afb19f4db5ccc752bf
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Thu Sep 5 09:35:19 2019 +0000
|
||
|
||
upstream: sprinkle in some explicit errors here, otherwise the
|
||
|
||
percolate all the way up to dispatch_run_fatal() and lose all meaninful
|
||
context
|
||
|
||
to help with bz#3063; ok dtucker@
|
||
|
||
OpenBSD-Commit-ID: 5b2da83bb1c4a3471444b7910b2120ae36438a0a
|
||
|
||
commit 0ea332497b2b2fc3995f72f6bafe9d664c0195b3
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Thu Sep 5 09:25:13 2019 +0000
|
||
|
||
upstream: only send ext_info for KEX_INITIAL; bz#2929 ok dtucker
|
||
|
||
OpenBSD-Commit-ID: 00f5c6062f6863769f5447c6346f78c05d2e4a63
|
||
|
||
commit f23d91f9fa7f6f42e70404e000fac88aebfe3076
|
||
Author: jmc@openbsd.org <jmc@openbsd.org>
|
||
Date: Thu Sep 5 05:47:23 2019 +0000
|
||
|
||
upstream: macro fix; ok djm
|
||
|
||
OpenBSD-Commit-ID: e891dd6c7996114cb32f0924cb7898ab55efde6e
|
||
|
||
commit 8b57337c1c1506df2bb9f039d0628a6de618566b
|
||
Author: Damien Miller <djm@mindrot.org>
|
||
Date: Thu Sep 5 15:46:39 2019 +1000
|
||
|
||
update fuzzing makefile to more recent clang
|
||
|
||
commit ae631ad77daf8fd39723d15a687cd4b1482cbae8
|
||
Author: Damien Miller <djm@mindrot.org>
|
||
Date: Thu Sep 5 15:45:32 2019 +1000
|
||
|
||
fuzzer for sshsig allowed_signers option parsing
|
||
|
||
commit 69159afe24120c97e5ebaf81016c85968afb903e
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Thu Sep 5 05:42:59 2019 +0000
|
||
|
||
upstream: memleak on error path; found by libfuzzer
|
||
|
||
OpenBSD-Commit-ID: 34d44cb0fb5bdb5fcbc6b02b804e71b20a7a5fc7
|
||
|
||
commit bab6feb01f9924758ca7129dba708298a53dde5f
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Thu Sep 5 04:55:32 2019 +0000
|
||
|
||
upstream: expose allowed_signers options parsing code in header for
|
||
|
||
fuzzing
|
||
|
||
rename to make more consistent with philosophically-similar auth
|
||
options parsing API.
|
||
|
||
OpenBSD-Commit-ID: 0c67600ef04187f98e2912ca57b60c22a8025b7c
|
||
|
||
commit 4f9d75fbafde83d428e291516f8ce98e6b3a7c4b
|
||
Author: naddy@openbsd.org <naddy@openbsd.org>
|
||
Date: Wed Sep 4 20:31:15 2019 +0000
|
||
|
||
upstream: Call comma-separated lists as such to clarify semantics.
|
||
|
||
Options such as Ciphers take values that may be a list of ciphers; the
|
||
complete list, not indiviual elements, may be prefixed with a dash or plus
|
||
character to remove from or append to the default list, respectively.
|
||
|
||
Users might read the current text as if each elment took an optional prefix,
|
||
so tweak the wording from "values" to "list" to prevent such ambiguity for
|
||
all options supporting these semantics.
|
||
|
||
Fix instances missed in first commit. ok jmc@ kn@
|
||
|
||
OpenBSD-Commit-ID: 7112522430a54fb9f15a7a26d26190ed84d5e417
|
||
|
||
commit db1e6f60f03641b2d17e0ab062242609f4ed4598
|
||
Author: jmc@openbsd.org <jmc@openbsd.org>
|
||
Date: Wed Sep 4 05:56:54 2019 +0000
|
||
|
||
upstream: tweak previous;
|
||
|
||
OpenBSD-Commit-ID: 0abd728aef6b5b35f6db43176aa83b7e3bf3ce27
|
||
|
||
commit 0f44e5956c7c816f6600f2a47be4d7bb5a8d711d
|
||
Author: naddy@openbsd.org <naddy@openbsd.org>
|
||
Date: Tue Sep 3 20:51:49 2019 +0000
|
||
|
||
upstream: repair typo and editing mishap
|
||
|
||
OpenBSD-Commit-ID: d125ab720ca71ccf9baf83e08ddc8c12a328597e
|
||
|
||
commit f4846dfc6a79f84bbc6356ae3184f142bacedc24
|
||
Author: Damien Miller <djm@mindrot.org>
|
||
Date: Thu Sep 5 11:09:28 2019 +1000
|
||
|
||
Fuzzer harness for sshsig
|
||
|
||
commit b08a6bc1cc7750c6f8a425d1cdbd86552fffc637
|
||
Author: Damien Miller <djm@mindrot.org>
|
||
Date: Tue Sep 3 18:45:42 2019 +1000
|
||
|
||
oops; missed including the actual file
|
||
|
||
commit 1a72c0dd89f09754df443c9576dde624a17d7dd0
|
||
Author: Damien Miller <djm@mindrot.org>
|
||
Date: Tue Sep 3 18:44:10 2019 +1000
|
||
|
||
portability fixes for sshsig
|
||
|
||
commit 6d6427d01304d967e58544cf1c71d2b4394c0522
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Tue Sep 3 08:37:45 2019 +0000
|
||
|
||
upstream: regress test for sshsig; feedback and ok markus@
|
||
|
||
OpenBSD-Regress-ID: 74c0974f2cdae8d9599b9d76a09680bae55d8a8b
|
||
|
||
commit 59650f0eaf65115afe04c39abfb93a4fc994ec55
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Tue Sep 3 08:37:06 2019 +0000
|
||
|
||
upstream: only add plain keys to prevent any certs laying around
|
||
|
||
from confusing the test.
|
||
|
||
OpenBSD-Regress-ID: b8f1508f822bc560b98dea910e61ecd76f34100f
|
||
|
||
commit d637c4aee6f9b5280c13c020d7653444ac1fcaa5
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Tue Sep 3 08:35:27 2019 +0000
|
||
|
||
upstream: sshsig tweaks and improvements from and suggested by
|
||
|
||
Markus
|
||
|
||
ok markus/me
|
||
|
||
OpenBSD-Commit-ID: ea4f46ad5a16b27af96e08c4877423918c4253e9
|
||
|
||
commit 2a9c9f7272c1e8665155118fe6536bebdafb6166
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Tue Sep 3 08:34:19 2019 +0000
|
||
|
||
upstream: sshsig: lightweight signature and verification ability
|
||
|
||
for OpenSSH
|
||
|
||
This adds a simple manual signature scheme to OpenSSH.
|
||
Signatures can be made and verified using ssh-keygen -Y sign|verify
|
||
|
||
Signatures embed the key used to make them. At verification time, this
|
||
is matched via principal name against an authorized_keys-like list
|
||
of allowed signers.
|
||
|
||
Mostly by Sebastian Kinne w/ some tweaks by me
|
||
|
||
ok markus@
|
||
|
||
OpenBSD-Commit-ID: 2ab568e7114c933346616392579d72be65a4b8fb
|
||
|
||
commit 5485f8d50a5bc46aeed829075ebf5d9c617027ea
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Tue Sep 3 08:32:11 2019 +0000
|
||
|
||
upstream: move authorized_keys option parsing helpsers to misc.c
|
||
|
||
and make them public; ok markus@
|
||
|
||
OpenBSD-Commit-ID: c18bcb2a687227b3478377c981c2d56af2638ea2
|
||
|
||
commit f8df0413f0a057b6a3d3dd7bd8bc7c5d80911d3a
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Tue Sep 3 08:31:20 2019 +0000
|
||
|
||
upstream: make get_sigtype public as sshkey_get_sigtype(); ok
|
||
|
||
markus@
|
||
|
||
OpenBSD-Commit-ID: 01f8cdbec63350490d2249f41112c5780d1cfbb8
|
||
|
||
commit dd8002fbe63d903ffea5be7b7f5fc2714acab4a0
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Tue Sep 3 08:30:47 2019 +0000
|
||
|
||
upstream: move advance_past_options to authfile.c and make it
|
||
|
||
public; ok markus@
|
||
|
||
OpenBSD-Commit-ID: edda2fbba2c5b1f48e60f857a2010479e80c5f3c
|
||
|
||
commit c72d78ccbe642e08591a626e5de18381489716e0
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Tue Sep 3 08:29:58 2019 +0000
|
||
|
||
upstream: move skip_space() to misc.c and make it public; ok
|
||
|
||
markus@
|
||
|
||
OpenBSD-Commit-ID: caa77e8a3b210948e29ad3e28c5db00852961eae
|
||
|
||
commit 06af3583f46e2c327fdd44d8a95b8b4e8dfd8db5
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Tue Sep 3 08:29:15 2019 +0000
|
||
|
||
upstream: authfd: add function to check if key is in agent
|
||
|
||
This commit adds a helper function which allows the caller to
|
||
check if a given public key is present in ssh-agent.
|
||
|
||
work by Sebastian Kinne; ok markus@
|
||
|
||
OpenBSD-Commit-ID: d43c5826353e1fdc1af71eb42961b30782c7bd13
|
||
|
||
commit 2ab5a8464870cc4b29ddbe849bbbc255729437bf
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Tue Sep 3 08:28:30 2019 +0000
|
||
|
||
upstream: fix memleak in ssh_free_identitylist(); ok markus@
|
||
|
||
OpenBSD-Commit-ID: aa51f77ae2c5330a1f61b2d22933f24a443f9abf
|
||
|
||
commit 85443f165b4169b2a448b3e24bc1d4dc5b3156a4
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Tue Sep 3 08:27:52 2019 +0000
|
||
|
||
upstream: factor out confirm_overwrite(); ok markus@
|
||
|
||
OpenBSD-Commit-ID: 304e95381b39c774c8fced7e5328b106a3ff0400
|
||
|
||
commit 9a396e33685633581c67d5ad9664570ef95281f2
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Mon Sep 2 23:46:46 2019 +0000
|
||
|
||
upstream: constify an argument
|
||
|
||
OpenBSD-Commit-ID: 724bafc9f993746ad4303e95bede2c030de6233b
|
||
|
||
commit b52c0c2e64988277a35a955a474d944967059aeb
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Mon Sep 2 00:19:25 2019 +0000
|
||
|
||
upstream: downgrade PKCS#11 "provider returned no slots" warning
|
||
|
||
from log level error to debug. This is common when attempting to enumerate
|
||
keys on smartcard readers with no cards plugged in. bz#3058 ok dtucker@
|
||
|
||
OpenBSD-Commit-ID: bb8839ddeb77c271390488af1b771041d43e49c6
|
||
|
||
commit 0713322e18162463c5ab5ddfb9f935055ca775d8
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Sun Sep 1 23:47:32 2019 +0000
|
||
|
||
upstream: print comment when printing pubkey from private
|
||
|
||
bz#3052; ok dtucker
|
||
|
||
OpenBSD-Commit-ID: a91b2a8d5f1053d34d7fce44523c53fb534ba914
|
||
|
||
commit 368f1cc2fbd6ad10c66bc1b67c2c04aebf8a04a8
|
||
Author: Damien Miller <djm@mindrot.org>
|
||
Date: Mon Sep 2 10:28:42 2019 +1000
|
||
|
||
fixed test in OSX closefrom() replacement
|
||
|
||
from likan_999.student AT sina.com
|
||
|
||
commit 6b7c53498def19a14dd9587bf521ab6dbee8988f
|
||
Author: Damien Miller <djm@mindrot.org>
|
||
Date: Mon Sep 2 10:22:02 2019 +1000
|
||
|
||
retain Solaris PRIV_FILE_LINK_ANY in sftp-server
|
||
|
||
Dropping this privilege removes the ability to create hard links to
|
||
files owned by other users. This is required for the legacy sftp rename
|
||
operation.
|
||
|
||
bz#3036; approach ok Alex Wilson (the original author of the Solaris
|
||
sandbox/pledge replacement code)
|
||
|
||
commit e50f808712393e86d69e42e9847cdf8d473412d7
|
||
Author: dtucker@openbsd.org <dtucker@openbsd.org>
|
||
Date: Fri Aug 30 05:08:28 2019 +0000
|
||
|
||
upstream: Use ed25519 for most hostkey rotation tests since it's
|
||
|
||
supported even when built without OpenSSL. Use RSA for the secondary type
|
||
test if supported, otherwise skip it. Fixes this test for !OpenSSL builds.
|
||
|
||
OpenBSD-Regress-ID: 101cb34a84fd974c623bdb2e496f25a6e91be109
|
||
|
||
commit 5e4796c47dd8d6c38fb2ff0b3e817525fed6040d
|
||
Author: bluhm@openbsd.org <bluhm@openbsd.org>
|
||
Date: Thu Aug 22 21:47:27 2019 +0000
|
||
|
||
upstream: Test did not compile due to missing symbols. Add source
|
||
|
||
sshbuf-misc.c to regress as it was done in ssh make file. from Moritz Buhl
|
||
|
||
OpenBSD-Regress-ID: 9e1c23476bb845f3cf3d15d9032da3ed0cb2fcf5
|
||
|
||
commit e0e7e3d0e26f2c30697e6d0cfc293414908963c7
|
||
Author: Damien Miller <djm@mindrot.org>
|
||
Date: Fri Aug 30 14:26:19 2019 +1000
|
||
|
||
tweak warning flags
|
||
|
||
Enable -Wextra if compiler supports it
|
||
|
||
Set -Wno-error=format-truncation if available to prevent expected
|
||
string truncations in openbsd-compat from breaking -Werror builds
|
||
|
||
commit 28744182cf90e0073b76a9e98de58a47e688b2c4
|
||
Author: Damien Miller <djm@mindrot.org>
|
||
Date: Fri Aug 30 13:21:38 2019 +1000
|
||
|
||
proc_pidinfo()-based closefrom() for OS X
|
||
|
||
Refactor closefrom() to use a single brute-force close() loop fallback.
|
||
|
||
Based on patch from likan_999.student@sina.com in bz#3049. ok dtucker@
|
||
|
||
commit dc2ca588144f088a54febebfde3414568dc73d5f
|
||
Author: kn@openbsd.org <kn@openbsd.org>
|
||
Date: Fri Aug 16 11:16:32 2019 +0000
|
||
|
||
upstream: Call comma-separated lists as such to clarify semantics
|
||
|
||
Options such as Ciphers take values that may be a list of ciphers; the
|
||
complete list, not indiviual elements, may be prefixed with a dash or plus
|
||
character to remove from or append to the default list respectively.
|
||
|
||
Users might read the current text as if each elment took an optional prefix,
|
||
so tweak the wording from "values" to "list" to prevent such ambiguity for
|
||
all options supporting this semantics (those that provide a list of
|
||
available elements via "ssh -Q ...").
|
||
|
||
Input and OK jmc
|
||
|
||
OpenBSD-Commit-ID: 4fdd175b0e5f5cb10ab3f26ccc38a93bb6515d57
|
||
|
||
commit c4736f39e66729ce2bf5b06ee6b391e092b48f47
|
||
Author: djm@openbsd.org <djm@openbsd.org>
|
||
Date: Fri Aug 16 06:35:27 2019 +0000
|
||
|
||
upstream: include sshbuf-misc.c in SRCS_BASE
|
||
|
||
OpenBSD-Commit-ID: 99dd10e72c04e93849981d43d64c946619efa474
|
||
|
||
commit d0e51810f332fe44ebdba41113aacf319d35f5a5
|
||
Author: Darren Tucker <dtucker@dtucker.net>
|
||
Date: Sat Aug 24 15:12:11 2019 +1000
|
||
|
||
Fix pasto in fallback code.
|
||
|
||
There is no parameter called "pathname", it should simply be "path".
|
||
bz#3059, patch from samuel at cendio.se.
|
||
|
||
commit e83c989bfd9fc9838b7dfb711d1dc6da81814045
|
||
Author: Damien Miller <djm@mindrot.org>
|
||
Date: Fri Aug 23 10:19:30 2019 +1000
|
||
|
||
use SC_ALLOW_ARG_MASK to limit mmap protections
|
||
|
||
Restrict to PROT_(READ|WRITE|NONE), i.e. exclude PROT_EXEC
|
||
|
||
commit f6906f9bf12c968debec3671bbf19926ff8a235b
|
||
Author: Damien Miller <djm@mindrot.org>
|
||
Date: Fri Aug 23 10:08:48 2019 +1000
|
||
|
||
allow mprotect(2) with PROT_(READ|WRITE|NONE) only
|
||
|
||
Used by some hardened heap allocators. Requested by Yegor
|
||
Timoshenko in https://github.com/openssh/openssh-portable/pull/142
|