Edit: /usr/share/doc/openssh/ChangeLog (331065B)
commit fd0fa130ecf06d7d092932adcd5d77f1549bfc8d
Author: Damien Miller
Date: Thu Apr 18 08:52:57 2019 +1000
makedepend
commit 5de397a876b587ba05a9169237deffdc71f273b0
Author: Damien Miller
Date: Fri Apr 5 11:29:51 2019 -0700
second thoughts: leave README in place
A number of contrib/* files refer to the existing README so let's leave
it in place for release and add the new markdown version in parallel.
I'll get rid of README after release.
commit 5d3127d9274519b25ed10e320f45045ba8d7f3be
Author: Damien Miller
Date: Fri Apr 5 11:29:31 2019 -0700
Revert "rewrite README"
This reverts commit 9444d82678cb7781820da4d1c23b3c2b9fb1e12f.
commit 9444d82678cb7781820da4d1c23b3c2b9fb1e12f
Author: Damien Miller
Date: Fri Apr 5 11:21:48 2019 -0700
rewrite README
Include basic build instructions and comments on commonly-used build-
time flags, links to the manual pages and other resources.
Now in Markdown format for better viewing on github, etc.
commit a924de0c4908902433813ba205bee1446bd1a157
Author: Damien Miller
Date: Fri Apr 5 03:41:52 2019 +1100
update versions
commit 312dcee739bca5d6878c536537b2a8a497314b75
Author: djm@openbsd.org
Date: Wed Apr 3 15:48:45 2019 +0000
upstream: openssh-8.0
OpenBSD-Commit-ID: 5aafdf218679dab982fea20771afd643be9a127b
commit 885bc114692046d55e2a170b932bdc0092fa3456
Author: Damien Miller
Date: Thu Apr 4 02:47:40 2019 +1100
session: Do not use removed API
from Jakub Jelen
commit 9d7b2882b0c9a5e9bf8312ce4075bf178e2b98be
Author: djm@openbsd.org
Date: Fri Mar 29 11:31:40 2019 +0000
upstream: when logging/fataling on error, include a bit more detail
than just the function name and the error message
OpenBSD-Commit-ID: dd72d7eba2215fcb89be516c378f633ea5bcca9f
commit 79a87d32783d6c9db40af8f35e091d9d30365ae7
Author: Darren Tucker
Date: Wed Apr 3 06:27:45 2019 +1100
Remove "struct ssh" from sys_auth_record_login.
It's not needed, and is not available from the call site in loginrec.c
Should only affect AIX, spotted by Kevin Brott.
commit 138c0d52cdc90f9895333b82fc57d81cce7a3d90
Author: Darren Tucker
Date: Tue Apr 2 18:21:35 2019 +1100
Adapt custom_failed_login to new prototype.
Spotted by Kevin Brott.
commit a0ca4009ab2f0b1007ec8ab6864dbf9b760a8ed5
Author: Darren Tucker
Date: Mon Apr 1 20:07:23 2019 +1100
Add includes.h for compat layer.
Should fix build on AIX 7.2.
commit 00991151786ce9b1d577bdad1f83a81d19c8236d
Author: Tim Rice
Date: Sun Mar 31 22:14:22 2019 -0700
Stop USL compilers for erroring with "integral constant expression expected"
commit 43f47ebbdd4037b569c23b8f4f7981f53b567f1d
Author: Tim Rice
Date: Sun Mar 31 19:22:19 2019 -0700
Only use O_NOFOLLOW in fchownat and fchmodat if defined
commit 342d6e51589b184c337cccfc4c788b60ff8b3765
Author: Jakub Jelen
Date: Fri Mar 29 12:29:41 2019 +0100
Adjust softhsm2 path on Fedora Linux for regress
The SoftHSM lives in Fedora in /usr/lib64/pkcs11/libsofthsm2.so
commit f5abb05f8c7358dacdcb866fe2813f6d8efd5830
Author: Darren Tucker
Date: Thu Mar 28 09:26:14 2019 +1100
Only use O_NOFOLLOW in utimensat if defined.
Fixes build on systems that don't have it (Solaris <=9) Found by
Tom G. Christensen.
commit 786cd4c1837fdc3fe7b4befe54a3f37db7df8715
Author: Corinna Vinschen
Date: Wed Mar 27 18:18:21 2019 +0100
drop old Cygwin considerations
- Cygwin supports non-DOS characters in filenames
- Cygwin does not support Windows XP anymore
Signed-off-by: Corinna Vinschen
commit 21da87f439b48a85b951ef1518fe85ac0273e719
Author: djm@openbsd.org
Date: Wed Mar 27 09:29:14 2019 +0000
upstream: fix interaction between ClientAliveInterval and RekeyLimit
that could cause connection to close incorrectly; Report and patch from Jakub
Jelen in bz#2757; ok dtucker@ markus@
OpenBSD-Commit-ID: 17229a8a65bd8e6c2080318ec2b7a61e1aede3fb
commit 4f0019a9afdb4a94d83b75e82dbbbe0cbe826c56
Author: djm@openbsd.org
Date: Mon Mar 25 22:34:52 2019 +0000
upstream: Fix authentication failures when "AuthenticationMethods
any" in a Match block overrides a more restrictive global default.
Spotted by jmc@, ok markus@
OpenBSD-Commit-ID: a90a4fe2ab81d0eeeb8fdfc21af81f7eabda6666
commit d6e5def308610f194c0ec3ef97a34a3e9630e190
Author: djm@openbsd.org
Date: Mon Mar 25 22:33:44 2019 +0000
upstream: whitespace
OpenBSD-Commit-ID: 106e853ae8a477e8385bc53824d3884a8159db07
commit 26e0cef07b04479537c971dec898741df1290fe5
Author: dtucker@openbsd.org
Date: Mon Mar 25 16:19:44 2019 +0000
upstream: Expand comment to document rationale for default key
sizes. "seems worthwhile" deraadt.
OpenBSD-Commit-ID: 72e5c0983d7da1fb72f191870f36cb58263a2456
commit f47269ea67eb4ff87454bf0d2a03e55532786482
Author: dtucker@openbsd.org
Date: Mon Mar 25 15:49:00 2019 +0000
upstream: Increase the default RSA key size to 3072 bits. Based on
the estimates from NIST Special Publication 800-57, 3k bits provides security
equivalent to 128 bits which is the smallest symmetric cipher we enable by
default. ok markus@ deraadt@
OpenBSD-Commit-ID: 461dd32ebe808f88f4fc3ec74749b0e6bef2276b
commit 62949c5b37af28d8490d94866e314a76be683a5e
Author: jmc@openbsd.org
Date: Fri Mar 22 20:58:34 2019 +0000
upstream: full stop in the wrong place;
OpenBSD-Commit-ID: 478a0567c83553a2aebf95d0f1bd67ac1b1253e4
commit 1b1332b5bb975d759a50b37f0e8bc8cfb07a0bb0
Author: jmc@openbsd.org
Date: Sat Mar 16 19:14:21 2019 +0000
upstream: benno helped me clean up the tcp forwarding section;
OpenBSD-Commit-ID: d4bec27edefde636fb632b7f0b7c656b9c7b7f08
commit 2aee9a49f668092ac5c9d34e904ef7a9722e541d
Author: markus@openbsd.org
Date: Fri Mar 8 17:24:43 2019 +0000
upstream: fix use-after-free in ssh-pkcs11; found by hshoexer w/AFL
OpenBSD-Commit-ID: febce81cca72b71f70513fbee4ff52ca050f675c
commit 9edbd7821e6837e98e7e95546cede804dac96754
Author: Darren Tucker
Date: Thu Mar 14 10:17:28 2019 +1100
Fix build when configured --without-openssl.
ok djm@
commit 825ab32f0d04a791e9d19d743c61ff8ed9b4d8e5
Author: Darren Tucker
Date: Thu Mar 14 08:51:17 2019 +1100
On Cygwin run sshd as SYSTEM where possible.
Seteuid now creates user token using S4U. We don't create a token
from scratch anymore, so we don't need the "Create a process token"
privilege. The service can run under SYSTEM again...
...unless Cygwin is running on Windows Vista or Windows 7 in the
WOW64 32 bit emulation layer. It turns out that WOW64 on these systems
didn't implement MsV1_0 S4U Logon so we still need the fallback
to NtCreateToken for these systems.
Signed-off-by: Corinna Vinschen
commit a212107bfdf4d3e870ab7a443e4d906e5b9578c3
Author: Darren Tucker
Date: Wed Mar 13 10:49:16 2019 +1100
Replace alloca with xcalloc.
The latter checks for memory exhaustion and integer overflow and may be
at a less predictable place. Sanity check by vinschen at redhat.com, ok
djm@
commit daa7505aadca68ba1a2c70cbdfce423208eb91ee
Author: Darren Tucker
Date: Tue Mar 12 09:19:19 2019 +1100
Use Cygwin-specific matching only for users+groups.
Patch from vinschen at redhat.com, updated a little by me.
commit fd10cf027b56f9aaa80c9e3844626a05066589a4
Author: dtucker@openbsd.org
Date: Wed Mar 6 22:14:23 2019 +0000
upstream: Move checks for lists of users or groups into their own
function. This is a no-op on OpenBSD but will make things easier in
-portable, eg on systems where these checks should be case-insensitive. ok
djm@
OpenBSD-Commit-ID: 8bc9c8d98670e23f8eaaaefe29c1f98e7ba0487e
commit ab5fee8eb6a011002fd9e32b1597f02aa8804a25
Author: dtucker@openbsd.org
Date: Wed Mar 6 21:06:59 2019 +0000
upstream: Reset last-seen time when sending a keepalive. Prevents
sending two keepalives successively and prematurely terminating connection
when ClientAliveCount=1. While there, collapse two similar tests into one.
ok markus@
OpenBSD-Commit-ID: 043670d201dfe222537a2a4bed16ce1087de5ddd
commit c13b74530f9f1d9df7aeae012004b31b2de4438e
Author: naddy@openbsd.org
Date: Tue Mar 5 16:17:12 2019 +0000
upstream: PKCS#11 support is no longer limited to RSA; ok benno@
kn@
OpenBSD-Commit-ID: 1a9bec64d530aed5f434a960e7515a3e80cbc826
commit e9552d6043db7cd170ac6ba1b4d2c7a5eb2c3201
Author: djm@openbsd.org
Date: Fri Mar 1 03:29:32 2019 +0000
upstream: in ssh_set_newkeys(), mention the direction that we're
keying in debug messages. Previously it would be difficult to tell which
direction it was talking about
OpenBSD-Commit-ID: c2b71bfcceb2a7389b9d0b497fb2122a406a522d
commit 76a24b3fa193a9ca3e47a8779d497cb06500798b
Author: djm@openbsd.org
Date: Fri Mar 1 02:32:39 2019 +0000
upstream: Fix two race conditions in sshd relating to SIGHUP:
1. Recently-forked child processes will briefly remain listening to
listen_socks. If the main server sshd process completes its restart
via execv() before these sockets are closed by the child processes
then it can fail to listen at the desired addresses/ports and/or
fail to restart.
2. When a SIGHUP is received, there may be forked child processes that
are awaiting their reexecution state. If the main server sshd
process restarts before passing this state, these child processes
will yield errors and use a fallback path of reading the current
sshd_config from the filesystem rather than use the one that sshd
was started with.
To fix both of these cases, we reuse the startup_pipes that are shared
between the main server sshd and forked children. Previously this was
used solely to implement tracking of pre-auth child processes for
MaxStartups, but this extends the messaging over these pipes to include
a child->parent message that the parent process is safe to restart. This
message is sent from the child after it has completed its preliminaries:
closing listen_socks and receiving its reexec state.
bz#2953, reported by Michal Koutný; ok markus@ dtucker@
OpenBSD-Commit-ID: 7df09eacfa3ce13e9a7b1e9f17276ecc924d65ab
commit de817e9dfab99473017d28cdf69e60397d00ea21
Author: djm@openbsd.org
Date: Fri Mar 1 02:16:47 2019 +0000
upstream: mention PKCS11Provide=none, reword a little and remove
mention of RSA keys only (since we support ECDSA now and might support others
in the future). Inspired by Jakub Jelen via bz#2974
OpenBSD-Commit-ID: a92e3686561bf624ccc64ab320c96c9e9a263aa5
commit 95a8058c1a90a27acbb91392ba206854abc85226
Author: djm@openbsd.org
Date: Fri Mar 1 02:08:50 2019 +0000
upstream: let PKCS11Provider=none do what users expect
print PKCS11Provider instead of obsolete SmartcardDevice in config dump.
bz#2974 ok dtucker@
OpenBSD-Commit-ID: c303d6f0230a33aa2dd92dc9b68843d56a64f846
commit 8e7bac35aa576d2fd7560836da83733e864ce649
Author: markus@openbsd.org
Date: Wed Feb 27 19:37:01 2019 +0000
upstream: dup stdout/in for proxycommand=-, otherwise stdout might
be redirected to /dev/null; ok djm@
OpenBSD-Commit-ID: 97dfce4c47ed4055042de8ebde85b7d88793e595
commit 9b61130fbd95d196bce81ebeca94a4cb7c0d5ba0
Author: djm@openbsd.org
Date: Sat Feb 23 08:20:43 2019 +0000
upstream: openssh-7.9 accidentally reused the server's algorithm lists
in the client for KEX, ciphers and MACs. The ciphers and MACs were identical
between the client and server, but the error accidentially disabled the
diffie-hellman-group-exchange-sha1 KEX method.
This fixes the client code to use the correct method list, but
because nobody complained, it also disables the
diffie-hellman-group-exchange-sha1 KEX method.
Reported by nuxi AT vault24.org via bz#2697; ok dtucker
OpenBSD-Commit-ID: e30c33a23c10fd536fefa120e86af1842e33fd57
commit 37638c752041d591371900df820f070037878a2d
Author: Corinna Vinschen
Date: Wed Feb 20 13:41:25 2019 +0100
Cygwin: implement case-insensitive Unicode user and group name matching
The previous revert enabled case-insensitive user names again. This
patch implements the case-insensitive user and group name matching.
To allow Unicode chars, implement the matcher using wchar_t chars in
Cygwin-specific code. Keep the generic code changes as small as possible.
Cygwin: implement case-insensitive Unicode user and group name matching
Signed-off-by: Corinna Vinschen
commit bed1d43698807a07bb4ddb93a46b0bd84b9970b3
Author: Darren Tucker
Date: Fri Feb 22 15:21:21 2019 +1100
Revert unintended parts of previous commit.
commit f02afa350afac1b2f2d1413259a27a4ba1e2ca24
Author: Corinna Vinschen
Date: Wed Feb 20 13:41:24 2019 +0100
Revert "[auth.c] On Cygwin, refuse usernames that have differences in case"
This reverts commit acc9b29486dfd649dfda474e5c1a03b317449f1c.
Signed-off-by: Corinna Vinschen
commit 4c55b674835478eb80a1a7aeae588aa654e2a433
Author: Corinna Vinschen
Date: Sat Feb 16 14:13:43 2019 +0100
Add tags to .gitignore
Signed-off-by: Corinna Vinschen
commit 625b62634c33eaef4b80d07529954fe5c6435fe5
Author: djm@openbsd.org
Date: Fri Feb 22 03:37:11 2019 +0000
upstream: perform removal of agent-forwarding directory in forward
setup error path with user's privileged. This is a no-op as this code always
runs with user privilege now that we no longer support running sshd with
privilege separation disabled, but as long as the privsep skeleton is there
we should follow the rules.
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
bz#2969 with patch from Erik Sjölund
OpenBSD-Commit-ID: 2b708401a5a8d6133c865d7698d9852210dca846
commit d9ecfaba0b2f1887d20e4368230632e709ca83be
Author: jmc@openbsd.org
Date: Mon Feb 18 07:02:34 2019 +0000
upstream: sync the description of ~/.ssh/config with djm's updated
description in ssh.1; issue pointed out by andreas kahari
ok dtucker djm
OpenBSD-Commit-ID: 1b01ef0ae2c6328165150badae317ec92e52b01c
commit 38e83e4f219c752ebb1560633b73f06f0392018b
Author: djm@openbsd.org
Date: Tue Feb 12 23:53:10 2019 +0000
upstream: fix regression in r1.302 reported by naddy@ - only the first
public key from the agent was being attempted for use.
OpenBSD-Commit-ID: 07116aea521a04888718b2157f1ca723b2f46c8d
commit 5c68ea8da790d711e6dd5f4c30d089c54032c59a
Author: djm@openbsd.org
Date: Mon Feb 11 09:44:42 2019 +0000
upstream: cleanup GSSAPI authentication context after completion of the
authmethod. Move function-static GSSAPI state to the client Authctxt
structure. Make static a bunch of functions that aren't used outside this
file.
Based on patch from Markus Schmidt ; ok markus@
OpenBSD-Commit-ID: 497fb792c0ddb4f1ba631b6eed526861f115dbe5
commit a8c807f1956f81a92a758d3d0237d0ff06d0be5d
Author: benno@openbsd.org
Date: Sun Feb 10 16:35:41 2019 +0000
upstream: ssh-keygen -D pkcs11.so needs to initialize pkcs11
interactive, so it can ask for the smartcards PIN. ok markus@
OpenBSD-Commit-ID: 1be7ccf88f1876e0fc4d7c9b3f96019ac5655bab
commit 3d896c157c722bc47adca51a58dca859225b5874
Author: djm@openbsd.org
Date: Sun Feb 10 11:15:52 2019 +0000
upstream: when checking that filenames sent by the server side
match what the client requested, be prepared to handle shell-style brace
alternations, e.g. "{foo,bar}".
"looks good to me" millert@ + in snaps for the last week courtesy
deraadt@
OpenBSD-Commit-ID: 3b1ce7639b0b25b2248e3a30f561a548f6815f3e
commit 318e4f8548a4f5c0c913f61e27d4fc21ffb1eaae
Author: djm@openbsd.org
Date: Sun Feb 10 11:10:57 2019 +0000
upstream: syslog when connection is dropped for attempting to run a
command when ForceCommand=internal-sftp is in effect; bz2960; ok dtucker@
OpenBSD-Commit-ID: 8c87fa66d7fc6c0fffa3a3c28e8ab5e8dde234b8
commit 2ff2e19653b8c0798b8b8eff209651bdb1be2761
Author: Damien Miller
Date: Fri Feb 8 14:53:35 2019 +1100
don't set $MAIL if UsePam=yes
PAM typically specifies the user environment if it's enabled, so don't
second guess. bz#2937; ok dtucker@
commit 03e92dd27d491fe6d1a54e7b2f44ef1b0a916e52
Author: Damien Miller
Date: Fri Feb 8 14:50:36 2019 +1100
use same close logic for stderr as stdout
Avoids sending SIGPIPE to child processes after their parent exits
if they attempt to write to stderr.
Analysis and patch from JD Paul; patch reworked by Jakub Jelen and
myself. bz#2071; ok dtucker@
commit 8c53d409baeeaf652c0c125a9b164edc9dbeb6de
Author: dtucker@openbsd.org
Date: Tue Feb 5 11:35:56 2019 +0000
upstream: Adapt code in the non-USE_PIPES codepath to the new packet
API. This code is not normally reachable since USE_PIPES is always defined.
bz#2961, patch from adrian.fita at gmail com.
OpenBSD-Commit-ID: 8d8428d678d1d5eb4bb21921df34e8173e6d238a
commit 7a7fdca78de4b4774950be056099e579ef595414
Author: djm@openbsd.org
Date: Mon Feb 4 23:37:54 2019 +0000
upstream: fix NULL-deref crash in PKCS#11 code when attempting
login to a token requiring a PIN; reported by benno@ fix mostly by markus@
OpenBSD-Commit-ID: 438d0b114b1b4ba25a9869733db1921209aa9a31
commit cac302a4b42a988e54d32eb254b29b79b648dbf5
Author: dtucker@openbsd.org
Date: Mon Feb 4 02:39:42 2019 +0000
upstream: Remove obsolete "Protocol" from commented out examples. Patch
from samy.mahmoudi at gmail com.
OpenBSD-Commit-ID: 16aede33dae299725a03abdac5dcb4d73f5d0cbf
commit 483b3b638500fd498b4b529356e5a0e18cf76891
Author: dtucker@openbsd.org
Date: Fri Feb 1 03:52:23 2019 +0000
upstream: Save connection timeout and restore for 2nd and
subsequent attempts, preventing them from having no timeout. bz#2918, ok
djm@
OpenBSD-Commit-ID: 4977f1d0521d9b6bba0c9a20d3d226cefac48292
commit 5f004620fdc1b2108139300ee12f4014530fb559
Author: markus@openbsd.org
Date: Wed Jan 30 19:51:15 2019 +0000
upstream: Add authors for public domain sntrup4591761 code;
confirmed by Daniel J. Bernstein
OpenBSD-Commit-ID: b4621f22b8b8ef13e063c852af5e54dbbfa413c1
commit 2c21b75a7be6ebdcbceaebb43157c48dbb36f3d8
Author: jmc@openbsd.org
Date: Sun Jan 27 07:14:11 2019 +0000
upstream: add -T to usage();
OpenBSD-Commit-ID: a7ae14d9436c64e1bd05022329187ea3a0ce1899
commit 19a0f0529d3df04118da829528cac7ceff380b24
Author: dtucker@openbsd.org
Date: Mon Jan 28 03:50:39 2019 +0000
upstream: The test sshd_config in in $OBJ.
OpenBSD-Regress-ID: 1e5d908a286d8e7de3a15a0020c8857f3a7c9172
commit 8fe25440206319d15b52d12b948a5dfdec14dca3
Author: dtucker@openbsd.org
Date: Mon Jan 28 03:28:10 2019 +0000
upstream: Remove leftover debugging.
OpenBSD-Regress-ID: 3d86c3d4867e46b35af3fd2ac8c96df0ffdcfeb9
commit e30d32364d12c351eec9e14be6c61116f9d6cc90
Author: dtucker@openbsd.org
Date: Mon Jan 28 00:12:36 2019 +0000
upstream: Enable ssh-dss for the agent test. Disable it for the
certificate test.
OpenBSD-Regress-ID: 388c1e03e1def539d350f139b37d69f12334668d
commit ffdde469ed56249f5dc8af98da468dde35531398
Author: dtucker@openbsd.org
Date: Mon Jan 28 00:08:26 2019 +0000
upstream: Count the number of key types instead of assuming there
are only two.
OpenBSD-Regress-ID: 0998702c41235782cf0beee396ec49b5056eaed9
commit 1d05b4adcba08ab068466e5c08dee2f5417ec53a
Author: Corinna Vinschen
Date: Sat Jan 26 23:42:40 2019 +0100
Cygwin: only tweak sshd_config file if it's new, drop creating sshd user
The sshd_config tweaks were executed even if the old file was
still in place. Fix that. Also disable sshd user creation.
It's not used on Cygwin.
commit 89843de0c4c733501f6b4f988098e6e06963df37
Author: Corinna Vinschen
Date: Sat Jan 26 23:03:12 2019 +0100
Cygwin: Change service name to cygsshd
Microsoft hijacked the sshd service name without asking.
commit 2a9b3a2ce411d16cda9c79ab713c55f65b0ec257
Author: dtucker@openbsd.org
Date: Sun Jan 27 06:30:53 2019 +0000
upstream: Generate all key supported key types and enable for keyscan
test.
OpenBSD-Regress-ID: 72f72ff49946c61bc949e1692dd9e3d71370891b
commit 391ffc4b9d31fa1f4ad566499fef9176ff8a07dc
Author: djm@openbsd.org
Date: Sat Jan 26 22:41:28 2019 +0000
upstream: check in scp client that filenames sent during
remote->local directory copies satisfy the wildcard specified by the user.
This checking provides some protection against a malicious server
sending unexpected filenames, but it comes at a risk of rejecting wanted
files due to differences between client and server wildcard expansion rules.
For this reason, this also adds a new -T flag to disable the check.
reported by Harry Sintonen
fix approach suggested by markus@;
has been in snaps for ~1wk courtesy deraadt@
OpenBSD-Commit-ID: 00f44b50d2be8e321973f3c6d014260f8f7a8eda
commit c2c18a39683db382a15b438632afab3f551d50ce
Author: djm@openbsd.org
Date: Sat Jan 26 22:35:01 2019 +0000
upstream: make ssh-keyscan return a non-zero exit status if it
finds no keys. bz#2903
OpenBSD-Commit-ID: 89f1081fb81d950ebb48e6e73d21807b2723d488
commit 05b9a466700b44d49492edc2aa415fc2e8913dfe
Author: dtucker@openbsd.org
Date: Thu Jan 24 17:00:29 2019 +0000
upstream: Accept the host key fingerprint as a synonym for "yes"
when accepting an unknown host key. This allows you to paste a fingerprint
obtained out of band into the yes/no prompt and have the client do the
comparison for you. ok markus@ djm@
OpenBSD-Commit-ID: 3c47d10b9f43d3d345e044fd9ec09709583a2767
commit bdc6c63c80b55bcbaa66b5fde31c1cb1d09a41eb
Author: dtucker@openbsd.org
Date: Thu Jan 24 16:52:17 2019 +0000
upstream: Have progressmeter force an update at the beginning and
end of each transfer. Fixes the problem recently introduces where very quick
transfers do not display the progressmeter at all. Spotted by naddy@
OpenBSD-Commit-ID: 68dc46c259e8fdd4f5db3ec2a130f8e4590a7a9a
commit 258e6ca003e47f944688ad8b8de087b58a7d966c
Author: dtucker@openbsd.org
Date: Thu Jan 24 02:42:23 2019 +0000
upstream: Check for both EAGAIN and EWOULDBLOCK. This is a no-op
in OpenBSD (they are the same value) but makes things easier in -portable
where they may be distinct values. "sigh ok" deraadt@
(ID sync only, portable already had this change).
OpenBSD-Commit-ID: 91f2bc7c0ecec905915ed59fa37feb9cc90e17d7
commit 281ce042579b834cdc1e74314f1fb2eeb75d2612
Author: dtucker@openbsd.org
Date: Thu Jan 24 02:34:52 2019 +0000
upstream: Always initialize 2nd arg to hpdelim2. It populates that
*ONLY IF* there's a delimiter. If there's not (the common case) it checked
uninitialized memory, which usually passed, but if not would cause spurious
failures when the uninitialized memory happens to contain "/". ok deraadt.
OpenBSD-Commit-ID: 4291611eaf2a53d4c92f4a57c7f267c9f944e0d3
commit d05ea255678d9402beda4416cd0360f3e5dfe938
Author: dtucker@openbsd.org
Date: Wed Jan 23 21:50:56 2019 +0000
upstream: Remove support for obsolete host/port syntax.
host/port was added in 2001 as an alternative to host:port syntax for
the benefit of IPv6 users. These days there are establised standards
for this like [::1]:22 and the slash syntax is easily mistaken for CIDR
notation, which OpenSSH now supports for some things. Remove the slash
notation from ListenAddress and PermitOpen. bz#2335, patch from jjelen
at redhat.com, ok markus@
OpenBSD-Commit-ID: fae5f4e23c51a368d6b2d98376069ac2b10ad4b7
commit 177d6c80c557a5e060cd343a0c116a2f1a7f43db
Author: dtucker@openbsd.org
Date: Wed Jan 23 20:48:52 2019 +0000
upstream: Remove duplicate word. bz#2958, patch from jjelen at
redhat.com
OpenBSD-Commit-ID: cca3965a8333f2b6aae48b79ec1d72f7a830dd2c
commit be3e6cba95dffe5fcf190c713525b48c837e7875
Author: dtucker@openbsd.org
Date: Wed Jan 23 09:49:00 2019 +0000
upstream: Remove 3 as a guess for possible generator during moduli
generation. It's not mentioned in RFC4419 and it's not possible for
Sophie-Germain primes greater than 5. bz#2330, from Christian Wittenhorst ,
ok djm@ tb@
OpenBSD-Commit-ID: 1467652e6802ad3333b0959282d8d49dfe22c8cd
commit 8976f1c4b2721c26e878151f52bdf346dfe2d54c
Author: dtucker@openbsd.org
Date: Wed Jan 23 08:01:46 2019 +0000
upstream: Sanitize scp filenames via snmprintf. To do this we move
the progressmeter formatting outside of signal handler context and have the
atomicio callback called for EINTR too. bz#2434 with contributions from djm
and jjelen at redhat.com, ok djm@
OpenBSD-Commit-ID: 1af61c1f70e4f3bd8ab140b9f1fa699481db57d8
commit 6249451f381755f792c6b9e2c2f80cdc699c14e2
Author: Darren Tucker
Date: Thu Jan 24 10:00:20 2019 +1100
For broken read/readv comparisons, poll(RW).
In the cases where we can't compare to read or readv function pointers
for some reason we currently ifdef out the poll() used to block while
waiting for reads or writes, falling back to busy waiting. This restores
the poll() in this case, but has it always check for read or write,
removing an inline ifdef in the process.
commit 5cb503dff4db251520e8bf7d23b9c97c06eee031
Author: Darren Tucker
Date: Thu Jan 24 09:55:16 2019 +1100
Include unistd.h for strmode().
commit f236ca2741f29b5c443c0b2db3aa9afb9ad9befe
Author: Darren Tucker
Date: Thu Jan 24 09:50:58 2019 +1100
Also undef SIMPLEQ_FOREACH_SAFE.
Prevents macro redefinition warning on at least NetBSD 6.1.
commit be063945e4e7d46b1734d973bf244c350fae172a
Author: djm@openbsd.org
Date: Wed Jan 23 04:51:02 2019 +0000
upstream: allow auto-incrementing certificate serial number for certs
signed in a single commandline.
OpenBSD-Commit-ID: 39881087641efb8cd83c7ec13b9c98280633f45b
commit 851f80328931975fe68f71af363c4537cb896da2
Author: djm@openbsd.org
Date: Wed Jan 23 04:16:22 2019 +0000
upstream: move a bunch of global flag variables to main(); make the
rest static
OpenBSD-Commit-ID: fa431d92584e81fe99f95882f4c56b43fe3242dc
commit 2265402dc7d701a9aca9f8a7b7b0fd45b65c479f
Author: Damien Miller
Date: Wed Jan 23 13:03:16 2019 +1100
depend
commit 2c223878e53cc46def760add459f5f7c4fb43e35
Author: djm@openbsd.org
Date: Wed Jan 23 02:01:10 2019 +0000
upstream: switch mainloop from select(2) to poll(2); ok deraadt@
OpenBSD-Commit-ID: 37645419a330037d297f6f0adc3b3663e7ae7b2e
commit bb956eaa94757ad058ff43631c3a7d6c94d38c2f
Author: djm@openbsd.org
Date: Wed Jan 23 00:30:41 2019 +0000
upstream: pass most arguments to the KEX hash functions as sshbuf
rather than pointer+length; ok markus@
OpenBSD-Commit-ID: ef0c89c52ccc89817a13a5205725148a28492bf7
commit d691588b8e29622c66abf8932362b522cf7f4051
Author: djm@openbsd.org
Date: Tue Jan 22 22:58:50 2019 +0000
upstream: backoff reading messages from active connections when the
input buffer is too full to read one, or if the output buffer is too full to
enqueue a response; feedback & ok dtucker@
OpenBSD-Commit-ID: df3c5b6d57c968975875de40d8955cbfed05a6c8
commit f99ef8de967949a1fc25a5c28263ea32736e5943
Author: djm@openbsd.org
Date: Tue Jan 22 20:48:01 2019 +0000
upstream: add -m to usage(); reminded by jmc@
OpenBSD-Commit-ID: bca476a5236e8f94210290b3e6a507af0434613e
commit 41923ce06ac149453debe472238e0cca7d5a2e5f
Author: djm@openbsd.org
Date: Tue Jan 22 12:03:58 2019 +0000
upstream: Correct some bugs in PKCS#11 token PIN handling at
initial login, the attempt at reading the PIN could be skipped in some cases
especially on devices with integrated PIN readers.
based on patch from Daniel Kucera in bz#2652; ok markus@
OpenBSD-Commit-ID: fad70a61c60610afe8bb0db538c90e343e75e58e
commit 2162171ad517501ba511fa9f8191945d01857bb4
Author: djm@openbsd.org
Date: Tue Jan 22 12:00:50 2019 +0000
upstream: Support keys that set the CKA_ALWAYS_AUTHENTICATE by
requring a fresh login after the C_SignInit operation.
based on patch from Jakub Jelen in bz#2638; ok markus
OpenBSD-Commit-ID: a76e66996ba7c0923b46b74d46d499b811786661
commit 7a2cb18a215b2cb335da3dc99489c52a91f4925b
Author: djm@openbsd.org
Date: Tue Jan 22 11:51:25 2019 +0000
upstream: Mention that configuration for the destination host is
not applied to any ProxyJump/-J hosts. This has confused a few people...
OpenBSD-Commit-ID: 03f4f641df6ca236c1bfc69836a256b873db868b
commit ecd2f33cb772db4fa76776543599f1c1ab6f9fa0
Author: djm@openbsd.org
Date: Tue Jan 22 11:40:42 2019 +0000
upstream: Include -m in the synopsis for a few more commands that
support it
Be more explicit in the description of -m about where it may be used
Prompted by Jakub Jelen in bz2904
OpenBSD-Commit-ID: 3b398ac5e05d8a6356710d0ff114536c9d71046c
commit ff5d2cf4ca373bb4002eef395ed2cbe2ff0826c1
Author: djm@openbsd.org
Date: Tue Jan 22 11:26:16 2019 +0000
upstream: print the full pubkey being attempted at loglevel >=
debug2; bz2939
OpenBSD-Commit-ID: ac0fe5ca1429ebf4d460bad602adc96de0d7e290
commit 180b520e2bab33b566b4b0cbac7d5f9940935011
Author: djm@openbsd.org
Date: Tue Jan 22 11:19:42 2019 +0000
upstream: clarify: ssh-keygen -e only writes public keys, never
private
OpenBSD-Commit-ID: 7de7ff6d274d82febf9feb641e2415ffd6a30bfb
commit c45616a199c322ca674315de88e788f1d2596e26
Author: djm@openbsd.org
Date: Tue Jan 22 11:00:15 2019 +0000
upstream: mention the new vs. old key formats in the introduction
and give some hints on how keys may be converted or written in the old
format.
OpenBSD-Commit-ID: 9c90a9f92eddc249e07fad1204d0e15c8aa13823
commit fd8eb1383a34c986a00ef13d745ae9bd3ea21760
Author: jmc@openbsd.org
Date: Tue Jan 22 06:58:31 2019 +0000
upstream: tweak previous;
OpenBSD-Commit-ID: d2a80e389da8e7ed71978643d8cbaa8605b597a8
commit 68e924d5473c00057f8532af57741d258c478223
Author: tb@openbsd.org
Date: Mon Jan 21 23:55:12 2019 +0000
upstream: Forgot to add -J to the synopsis.
OpenBSD-Commit-ID: 26d95e409a0b72526526fc56ca1caca5cc3d3c5e
commit 622dedf1a884f2927a9121e672bd9955e12ba108
Author: tb@openbsd.org
Date: Mon Jan 21 22:50:42 2019 +0000
upstream: Add a -J option as a shortcut for -o Proxyjump= to scp(1)
and sftp(1) to match ssh(1)'s interface.
ok djm
OpenBSD-Commit-ID: a75bc2d5f329caa7229a7e9fe346c4f41c2663fc
commit c882d74652800150d538e22c80dd2bd3cdd5fae2
Author: Darren Tucker
Date: Tue Jan 22 20:38:40 2019 +1100
Allow building against OpenSSL dev (3.x) version.
commit d5520393572eb24aa0e001a1c61f49b104396e45
Author: Damien Miller
Date: Tue Jan 22 10:50:40 2019 +1100
typo
commit 2de9cec54230998ab10161576f77860a2559ccb7
Author: Damien Miller
Date: Tue Jan 22 10:49:52 2019 +1100
add missing header
commit 533cfb01e49a2a30354e191669dc3159e03e99a7
Author: djm@openbsd.org
Date: Mon Jan 21 22:18:24 2019 +0000
upstream: switch sntrup implementation source from supercop to
libpqcrypto; the latter is almost identical but doesn't rely on signed
underflow to implement an optimised integer sort; from markus@
OpenBSD-Commit-ID: cd09bbf0e0fcef1bedca69fdf7990dc360567cf8
commit d50ab3cd6fb859888a26b4d4e333239b4f6bf573
Author: Damien Miller
Date: Tue Jan 22 00:02:23 2019 +1100
new files need includes.h
commit c7670b091a7174760d619ef6738b4f26b2093301
Author: djm@openbsd.org
Date: Mon Jan 21 12:53:35 2019 +0000
upstream: add "-v" flags to ssh-add and ssh-pkcs11-helper to turn up
debug verbosity.
Make ssh-agent turn on ssh-pkcs11-helper's verbosity when it is run
in debug mode ("ssh-agent -d"), so we get to see errors from the
PKCS#11 code.
ok markus@
OpenBSD-Commit-ID: 0a798643c6a92a508df6bd121253ba1c8bee659d
commit 49d8c8e214d39acf752903566b105d06c565442a
Author: djm@openbsd.org
Date: Mon Jan 21 12:50:12 2019 +0000
upstream: adapt to changes in KEX APIs and file removals
OpenBSD-Regress-ID: 54d6857e7c58999c7a6d40942ab0fed3529f43ca
commit 35ecc53a83f8e8baab2e37549addfd05c73c30f1
Author: djm@openbsd.org
Date: Mon Jan 21 12:35:20 2019 +0000
upstream: adapt to changes in KEX API and file removals
OpenBSD-Regress-ID: 92cad022d3b0d11e08f3e0055d6a14b8f994c0d7
commit 7d69aae64c35868cc4f644583ab973113a79480e
Author: djm@openbsd.org
Date: Mon Jan 21 12:29:35 2019 +0000
upstream: adapt to bignum1 API removal and bignum2 API change
OpenBSD-Regress-ID: cea6ff270f3d560de86b355a87a2c95b55a5ca63
commit beab553f0a9578ef9bffe28b2c779725e77b39ec
Author: djm@openbsd.org
Date: Mon Jan 21 09:13:41 2019 +0000
upstream: remove hack to use non-system libcrypto
OpenBSD-Regress-ID: ce72487327eee4dfae1ab0212a1f33871fe0809f
commit 4dc06bd57996f1a46b4c3bababe0d09bc89098f7
Author: Damien Miller
Date: Mon Jan 21 23:14:04 2019 +1100
depend
commit 70edd73edc4df54e5eee50cd27c25427b34612f8
Author: djm@openbsd.org
Date: Mon Jan 21 12:08:13 2019 +0000
upstream: fix reversed arguments to kex_load_hostkey(); manifested as
errors in cert-hostkey.sh regress failures.
OpenBSD-Commit-ID: 12dab63850b844f84d5a67e86d9e21a42fba93ba
commit f1185abbf0c9108e639297addc77f8757ee00eb3
Author: djm@openbsd.org
Date: Mon Jan 21 11:22:00 2019 +0000
upstream: forgot to cvs add this file in previous series of commits;
grrr
OpenBSD-Commit-ID: bcff316c3e7da8fd15333e05d244442c3aaa66b0
commit 7bef390b625bdc080f0fd4499ef03cef60fca4fa
Author: djm@openbsd.org
Date: Mon Jan 21 10:44:21 2019 +0000
upstream: nothing shall escape this purge
OpenBSD-Commit-ID: 4795b0ff142b45448f7e15f3c2f77a947191b217
commit aaca72d6f1279b842066e07bff797019efeb2c23
Author: djm@openbsd.org
Date: Mon Jan 21 10:40:11 2019 +0000
upstream: rename kex->kem_client_pub -> kex->client_pub now that
KEM has been renamed to kexgen
from markus@ ok djm@
OpenBSD-Commit-ID: fac6da5dc63530ad0da537db022a9a4cfbe8bed8
commit 70867e1ca2eb08bbd494fe9c568df4fd3b35b867
Author: djm@openbsd.org
Date: Mon Jan 21 10:38:54 2019 +0000
upstream: merge kexkem[cs] into kexgen
from markus@ ok djm@
OpenBSD-Commit-ID: 87d886b7f1812ff9355fda1435f6ea9b71a0ac89
commit 71e67fff946396caa110a7964da23480757258ff
Author: djm@openbsd.org
Date: Mon Jan 21 10:35:09 2019 +0000
upstream: pass values used in KEX hash computation as sshbuf
rather than pointer+len
suggested by me; implemented by markus@ ok me
OpenBSD-Commit-ID: 994f33c464f4a9e0f1d21909fa3e379f5a0910f0
commit 4b83e2a2cc0c12e671a77eaba1c1245894f4e884
Author: djm@openbsd.org
Date: Mon Jan 21 10:33:49 2019 +0000
upstream: remove kex_derive_keys_bn wrapper; no unused since the
DH-like KEX methods have moved to KEM
from markus@ ok djm@
OpenBSD-Commit-ID: bde9809103832f349545e4f5bb733d316db9a060
commit 92dda34e373832f34a1944e5d9ebbebb184dedc1
Author: djm@openbsd.org
Date: Mon Jan 21 10:29:56 2019 +0000
upstream: use KEM API for vanilla ECDH
from markus@ ok djm@
OpenBSD-Commit-ID: 6fbff96339a929835536b5730585d1d6057a352c
commit b72357217cbe510a3ae155307a7be6b9181f1d1b
Author: Damien Miller
Date: Mon Jan 21 23:11:21 2019 +1100
fixup missing ssherr.h
commit 9c9c97e14fe190931f341876ad98213e1e1dc19f
Author: djm@openbsd.org
Date: Mon Jan 21 10:28:01 2019 +0000
upstream: use KEM API for vanilla DH KEX
from markus@ ok djm@
OpenBSD-Commit-ID: af56466426b08a8be275412ae2743319e3d277c9
commit 2f6a9ddbbf6ca8623c53c323ff17fb6d68d66970
Author: djm@openbsd.org
Date: Mon Jan 21 10:24:09 2019 +0000
upstream: use KEM API for vanilla c25519 KEX
OpenBSD-Commit-ID: 38d937b85ff770886379dd66a8f32ab0c1c35c1f
commit dfd591618cdf2c96727ac0eb65f89cf54af0d97e
Author: djm@openbsd.org
Date: Mon Jan 21 10:20:12 2019 +0000
upstream: Add support for a PQC KEX/KEM:
sntrup4591761x25519-sha512@tinyssh.org using the Streamlined NTRU Prime
4591^761 implementation from SUPERCOP coupled with X25519 as a stop-loss. Not
enabled by default.
introduce KEM API; a simplified framework for DH-ish KEX methods.
from markus@ feedback & ok djm@
OpenBSD-Commit-ID: d687f76cffd3561dd73eb302d17a1c3bf321d1a7
commit b1b2ff4ed559051d1035419f8f236275fa66d5d6
Author: djm@openbsd.org
Date: Mon Jan 21 10:07:22 2019 +0000
upstream: factor out kex_verify_hostkey() - again, duplicated
almost exactly across client and server for several KEX methods.
from markus@ ok djm@
OpenBSD-Commit-ID: 4e4a16d949dadde002a0aacf6d280a684e20829c
commit bb39bafb6dc520cc097780f4611a52da7f19c3e2
Author: djm@openbsd.org
Date: Mon Jan 21 10:05:09 2019 +0000
upstream: factor out kex_load_hostkey() - this is duplicated in
both the client and server implementations for most KEX methods.
from markus@ ok djm@
OpenBSD-Commit-ID: 8232fa7c21fbfbcaf838313b0c166dc6c8762f3c
commit dec5e9d33891e3bc3f1395d7db0e56fdc7f86dfc
Author: djm@openbsd.org
Date: Mon Jan 21 10:03:37 2019 +0000
upstream: factor out kex_dh_compute_key() - it's shared between
plain DH KEX and DH GEX in both the client and server implementations
from markus@ ok djm@
OpenBSD-Commit-ID: 12186e18791fffcd4642c82e7e0cfdd7ea37e2ec
commit e93bd98eab79b9a78f64ee8dd4dffc4d3979c7ae
Author: djm@openbsd.org
Date: Mon Jan 21 10:00:23 2019 +0000
upstream: factor out DH keygen; it's identical between the client
and the server
from markus@ ok djm@
OpenBSD-Commit-ID: 2be57f6a0d44f1ab2c8de2b1b5d6f530c387fae9
commit 5ae3f6d314465026d028af82609c1d49ad197655
Author: djm@openbsd.org
Date: Mon Jan 21 09:55:52 2019 +0000
upstream: save the derived session id in kex_derive_keys() rather
than making each kex method implementation do it.
from markus@ ok djm@
OpenBSD-Commit-ID: d61ade9c8d1e13f665f8663c552abff8c8a30673
commit 7be8572b32a15d5c3dba897f252e2e04e991c307
Author: djm@openbsd.org
Date: Mon Jan 21 09:54:11 2019 +0000
upstream: Make sshpkt_get_bignum2() allocate the bignum it is
parsing rather than make the caller do it. Saves a lot of boilerplate code.
from markus@ ok djm@
OpenBSD-Commit-ID: 576bf784f9a240f5a1401f7005364e59aed3bce9
commit 803178bd5da7e72be94ba5b4c4c196d4b542da4d
Author: djm@openbsd.org
Date: Mon Jan 21 09:52:25 2019 +0000
upstream: remove obsolete (SSH v.1) sshbuf_get/put_bignum1
functions
from markus@ ok djm@
OpenBSD-Commit-ID: 0380b1b2d9de063de3c5a097481a622e6a04943e
commit f3ebaffd8714be31d4345f90af64992de4b3bba2
Author: djm@openbsd.org
Date: Mon Jan 21 09:49:37 2019 +0000
upstream: fix all-zero check in kexc25519_shared_key
from markus@ ok djm@
OpenBSD-Commit-ID: 60b1d364e0d9d34d1d1ef1620cb92e36cf06712d
commit 9d1a9771d0ad3a83af733bf3d2650b53f43c269f
Author: jmc@openbsd.org
Date: Mon Jan 21 07:09:10 2019 +0000
upstream: - -T was added to the first synopsis by mistake - since
"..." denotes optional, no need to surround it in []
ok djm
OpenBSD-Commit-ID: 918f6d8eed4e0d8d9ef5eadae1b8983d796f0e25
commit 2f0bad2bf85391dbb41315ab55032ec522660617
Author: Darren Tucker
Date: Mon Jan 21 21:28:27 2019 +1100
Make --with-rpath take a flag instead of yes/no.
Linkers need various flags for -rpath and similar, so make --with-rpath
take an optional flag argument which is passed to the linker. ok djm@
commit 23490a6c970ea1d03581a3b4208f2eb7a675f453
Author: Damien Miller
Date: Mon Jan 21 15:05:43 2019 +1100
fix previous test
commit b6dd3277f2c49f9584a2097bc792e8f480397e87
Author: Darren Tucker
Date: Mon Jan 21 13:50:17 2019 +1100
Wrap ECC static globals in EC_KEY_METHOD_NEW too.
commit b2eb9db35b7191613f2f4b934d57b25938bb34b3
Author: Damien Miller
Date: Mon Jan 21 12:53:40 2019 +1100
pass TEST_SSH_SSHPKCS11HELPER to regress tests
commit ba58a529f45b3dae2db68607d8c54ae96e90e705
Author: Damien Miller
Date: Mon Jan 21 12:31:29 2019 +1100
make agent-pkcs11 search harder for softhsm2.so
commit 662be40c62339ab645113c930ce689466f028938
Author: djm@openbsd.org
Date: Mon Jan 21 02:05:38 2019 +0000
upstream: always print the caller's error message in ossl_error(),
even when there are no libcrypto errors to report.
OpenBSD-Commit-ID: 09ebaa8f706e0eccedd209775baa1eee2ada806a
commit ce46c3a077dfb4c531ccffcfff03f37775725b75
Author: djm@openbsd.org
Date: Mon Jan 21 02:01:03 2019 +0000
upstream: get the ex_data (pkcs11_key object) back from the keys at
the index at which it was inserted, rather than assuming index 0
OpenBSD-Commit-ID: 1f3a6ce0346c8014e895e50423bef16401510aa8
commit 0a5f2ea35626022299ece3c8817a1abe8cf37b3e
Author: djm@openbsd.org
Date: Mon Jan 21 01:05:00 2019 +0000
upstream: GSSAPI code got missed when converting to new packet API
OpenBSD-Commit-ID: 37e4f06ab4a0f4214430ff462ba91acba28b7851
commit 2efcf812b4c1555ca3aff744820a3b3bccd68298
Author: Damien Miller
Date: Mon Jan 21 11:57:21 2019 +1100
Fix -Wunused when compiling PKCS#11 without ECDSA
commit 3c0c657ed7cd335fc05c0852d88232ca7e92a5d9
Author: djm@openbsd.org
Date: Sun Jan 20 23:26:44 2019 +0000
upstream: allow override of ssh-pkcs11-helper binary via
$TEST_SSH_SSHPKCS11HELPER from markus@
OpenBSD-Regress-ID: 7382a3d76746f5a792d106912a5819fd5e49e469
commit 760ae37b4505453c6fa4faf1aa39a8671ab053af
Author: djm@openbsd.org
Date: Sun Jan 20 23:25:25 2019 +0000
upstream: adapt agent-pkcs11.sh test to softhsm2 and add support
for ECDSA keys
work by markus@, ok djm@
OpenBSD-Regress-ID: 1ebc2be0e88eff1b6d8be2f9c00cdc60723509fe
commit b2ce8b31a1f974a13e6d12e0a0c132b50bc45115
Author: djm@openbsd.org
Date: Sun Jan 20 23:24:19 2019 +0000
upstream: add "extra:" target to run some extra tests that are not
enabled by default (currently includes agent-pkcs11.sh); from markus@
OpenBSD-Regress-ID: 9a969e1adcd117fea174d368dcb9c61eb50a2a3c
commit 632976418d60b7193597bbc6ac7ca33981a41aab
Author: djm@openbsd.org
Date: Mon Jan 21 00:47:34 2019 +0000
upstream: use ECDSA_SIG_set0() instead of poking signature values into
structure directly; the latter works on LibreSSL but not on OpenSSL. From
portable.
OpenBSD-Commit-ID: 5b22a1919d9cee907d3f8a029167f70a481891c6
commit 5de6ac2bad11175135d9b819b3546db0ca0b4878
Author: Damien Miller
Date: Mon Jan 21 11:44:19 2019 +1100
remove HAVE_DLOPEN that snuck in
portable doesn't use this
commit e2cb445d786f7572da2af93e3433308eaed1093a
Author: Damien Miller
Date: Mon Jan 21 11:32:28 2019 +1100
conditionalise ECDSA PKCS#11 support
Require EC_KEY_METHOD support in libcrypto, evidenced by presence
of EC_KEY_METHOD_new() function.
commit fcb1b0937182d0137a3c357c89735d0dc5869d54
Author: djm@openbsd.org
Date: Sun Jan 20 23:12:35 2019 +0000
upstream: we use singleton pkcs#11 RSA_METHOD and EC_KEY_METHOD
now, so there is no need to keep a copy of each in the pkcs11_key object.
work by markus@, ok djm@
OpenBSD-Commit-ID: 43b4856516e45c0595f17a8e95b2daee05f12faa
commit 6529409e85890cd6df7e5e81d04e393b1d2e4b0b
Author: djm@openbsd.org
Date: Sun Jan 20 23:11:11 2019 +0000
upstream: KNF previous; from markus@
OpenBSD-Commit-ID: 3dfe35e25b310c3968b1e4e53a0cb1d03bda5395
commit 58622a8c82f4e2aad630580543f51ba537c1f39e
Author: djm@openbsd.org
Date: Sun Jan 20 23:10:33 2019 +0000
upstream: use OpenSSL's RSA reference counting hooks to
implicitly clean up pkcs11_key objects when their owning RSA object's
reference count drops to zero. Simplifies the cleanup path and makes it more
like ECDSA's
work by markus@, ok djm@
OpenBSD-Commit-ID: 74b9c98f405cd78f7148e9e4a4982336cd3df25c
commit f118542fc82a3b3ab0360955b33bc5a271ea709f
Author: djm@openbsd.org
Date: Sun Jan 20 23:08:24 2019 +0000
upstream: make the PKCS#11 RSA code more like the new PKCS#11
ECDSA code: use a single custom RSA_METHOD instead of a method per key
suggested by me, but markus@ did all the work.
ok djm@
OpenBSD-Commit-ID: 8aafcebe923dc742fc5537a995cee549d07e4b2e
commit 445cfce49dfc904c6b8ab25afa2f43130296c1a5
Author: djm@openbsd.org
Date: Sun Jan 20 23:05:52 2019 +0000
upstream: fix leak of ECDSA pkcs11_key objects
work by markus, ok djm@
OpenBSD-Commit-ID: 9fc0c4f1d640aaa5f19b8d70f37ea19b8ad284a1
commit 8a2467583f0b5760787273796ec929190c3f16ee
Author: djm@openbsd.org
Date: Sun Jan 20 23:03:26 2019 +0000
upstream: use EVP_PKEY_get0_EC_KEY() instead of direct access of
EC_KEY internals as that won't work on OpenSSL
work by markus@, feedback and ok djm@
OpenBSD-Commit-ID: 4a99cdb89fbd6f5155ef8c521c99dc66e2612700
commit 24757c1ae309324e98d50e5935478655be04e549
Author: djm@openbsd.org
Date: Sun Jan 20 23:01:59 2019 +0000
upstream: cleanup PKCS#11 ECDSA pubkey loading: the returned
object should never have a DER header
work by markus; feedback and ok djm@
OpenBSD-Commit-ID: b617fa585eddbbf0b1245b58b7a3c4b8d613db17
commit 749aef30321595435ddacef2f31d7a8f2b289309
Author: djm@openbsd.org
Date: Sun Jan 20 23:00:12 2019 +0000
upstream: cleanup unnecessary code in ECDSA pkcs#11 signature
work by markus@, feedback and ok djm@
OpenBSD-Commit-ID: affa5ca7d58d59fbd16169f77771dcdbd2b0306d
commit 0c50992af49b562970dd0ba3f8f151f1119e260e
Author: djm@openbsd.org
Date: Sun Jan 20 22:57:45 2019 +0000
upstream: cleanup pkcs#11 client code: use sshkey_new in instead
of stack- allocating a sshkey
work by markus@, ok djm@
OpenBSD-Commit-ID: a048eb6ec8aa7fa97330af927022c0da77521f91
commit 854bd8674ee5074a239f7cadf757d55454802e41
Author: djm@openbsd.org
Date: Sun Jan 20 22:54:30 2019 +0000
upstream: allow override of the pkcs#11 helper binary via
$SSH_PKCS11_HELPER; needed for regress tests.
work by markus@, ok me
OpenBSD-Commit-ID: f78d8185500bd7c37aeaf7bd27336db62f0f7a83
commit 93f02107f44d63a016d8c23ebd2ca9205c495c48
Author: djm@openbsd.org
Date: Sun Jan 20 22:51:37 2019 +0000
upstream: add support for ECDSA keys in PKCS#11 tokens
Work by markus@ and Pedro Martelletto, feedback and ok me@
OpenBSD-Commit-ID: a37d651e221341376636056512bddfc16efb4424
commit aa22c20e0c36c2fc610cfcc793b0d14079c38814
Author: djm@openbsd.org
Date: Sun Jan 20 22:03:29 2019 +0000
upstream: add option to test whether keys in an agent are usable,
by performing a signature and a verification using each key "ssh-add -T
pubkey [...]"
work by markus@, ok djm@
OpenBSD-Commit-ID: 931b888a600b6a883f65375bd5f73a4776c6d19b
commit a36b0b14a12971086034d53c0c3dfbad07665abe
Author: tb@openbsd.org
Date: Sun Jan 20 02:01:59 2019 +0000
upstream: Fix BN_is_prime_* calls in SSH, the API returns -1 on
error.
Found thanks to BoringSSL's commit 53409ee3d7595ed37da472bc73b010cd2c8a5ffd
by David Benjamin.
ok djm, dtucker
OpenBSD-Commit-ID: 1ee832be3c44b1337f76b8562ec6d203f3b072f8
commit ec4776bb01dd8d61fddc7d2a31ab10bf3d3d829a
Author: dtucker@openbsd.org
Date: Sun Jan 20 01:12:40 2019 +0000
upstream: DH-GEX min value is now specified in RFC8270. ok djm@
OpenBSD-Commit-ID: 1229d0feb1d0ecefe05bf67a17578b263e991acc
commit c90a7928c4191303e76a8c58b9008d464287ae1b
Author: Darren Tucker
Date: Mon Jan 21 09:22:36 2019 +1100
Check for cc before gcc.
If cc is something other than gcc and is the system compiler prefer using
that, unless otherwise told via $CC. ok djm@
commit 9b655dc9c9a353f0a527f0c6c43a5e35653c9503
Author: Damien Miller
Date: Sun Jan 20 14:55:27 2019 +1100
last bits of old packet API / active_state global
commit 3f0786bbe73609ac96e5a0d91425ee21129f8e04
Author: Damien Miller
Date: Sun Jan 20 10:22:18 2019 +1100
remove PAM dependencies on old packet API
Requires some caching of values, because the PAM code isn't
always called with packet context.
commit 08f66d9f17e12c1140d1f1cf5c4dce67e915d3cc
Author: Damien Miller
Date: Sun Jan 20 09:58:45 2019 +1100
remove vestiges of old packet API from loginrec.c
commit c327813ea1d740e3e367109c17873815aba1328e
Author: Damien Miller
Date: Sun Jan 20 09:45:38 2019 +1100
depend
commit 135e302cfdbe91817294317c337cc38c3ff01cba
Author: djm@openbsd.org
Date: Sat Jan 19 22:30:52 2019 +0000
upstream: fix error in refactor: use ssh_packet_disconnect() instead of
sshpkt_error(). The first one logs the error and exits (what we want) instead
of just logging and blundering on.
OpenBSD-Commit-ID: 39f51b43641dce9ce0f408ea6c0e6e077e2e91ae
commit 245c6a0b220b58686ee35bc5fc1c359e9be2faaa
Author: djm@openbsd.org
Date: Sat Jan 19 21:45:31 2019 +0000
upstream: remove last traces of old packet API!
with & ok markus@
OpenBSD-Commit-ID: 9bd10437026423eb8245636ad34797a20fbafd7d
commit 04c091fc199f17dacf8921df0a06634b454e2722
Author: djm@openbsd.org
Date: Sat Jan 19 21:43:56 2019 +0000
upstream: remove last references to active_state
with & ok markus@
OpenBSD-Commit-ID: 78619a50ea7e4ca2f3b54d4658b3227277490ba2
commit ec00f918b8ad90295044266c433340a8adc93452
Author: djm@openbsd.org
Date: Sat Jan 19 21:43:07 2019 +0000
upstream: convert monitor.c to new packet API
with & ok markus@
OpenBSD-Commit-ID: 61ecd154bd9804461a0cf5f495a29d919e0014d5
commit 6350e0316981489d4205952d6904d6fedba5bfe0
Author: djm@openbsd.org
Date: Sat Jan 19 21:42:30 2019 +0000
upstream: convert sshd.c to new packet API
with & ok markus@
OpenBSD-Commit-ID: ea569d3eaf9b5cf1bad52779fbfa5fa0b28af891
commit a5e2ad88acff2b7d131ee6d5dc5d339b0f8c6a6d
Author: djm@openbsd.org
Date: Sat Jan 19 21:41:53 2019 +0000
upstream: convert session.c to new packet API
with & ok markus@
OpenBSD-Commit-ID: fae817207e23099ddd248960c984f7b7f26ea68e
commit 3a00a921590d4c4b7e96df11bb10e6f9253ad45e
Author: djm@openbsd.org
Date: Sat Jan 19 21:41:18 2019 +0000
upstream: convert auth.c to new packet API
with & ok markus@
OpenBSD-Commit-ID: 7e10359f614ff522b52a3f05eec576257794e8e4
commit 7ec5cb4d15ed2f2c5c9f5d00e6b361d136fc1e2d
Author: djm@openbsd.org
Date: Sat Jan 19 21:40:48 2019 +0000
upstream: convert serverloop.c to new packet API
with & ok markus@
OpenBSD-Commit-ID: c92dd19b55457541478f95c0d6b318426d86d885
commit 64c9598ac05332d1327cbf55334dee4172d216c4
Author: djm@openbsd.org
Date: Sat Jan 19 21:40:21 2019 +0000
upstream: convert the remainder of sshconnect2.c to new packet
API
with & ok markus@
OpenBSD-Commit-ID: 0986d324f2ceb5e8a12ac21c1bb10b3b4b1e0f71
commit bc5e1169d101d16e3a5962a928db2bc49a8ef5a3
Author: djm@openbsd.org
Date: Sat Jan 19 21:39:12 2019 +0000
upstream: convert the remainder of clientloop.c to new packet API
with & ok markus@
OpenBSD-Commit-ID: ce2fbbacb86a290f31da1e7bf04cddf2bdae3d1e
commit 5ebce136a6105f084db8f0d7ee41981d42daec40
Author: Damien Miller
Date: Sun Jan 20 09:44:53 2019 +1100
upstream: convert auth2.c to new packet API
OpenBSD-Commit-ID: ed831bb95ad228c6791bc18b60ce7a2edef2c999
commit 172a592a53ebe8649c4ac0d7946e6c08eb151af6
Author: djm@openbsd.org
Date: Sat Jan 19 21:37:48 2019 +0000
upstream: convert servconf.c to new packet API
with & ok markus@
OpenBSD-Commit-ID: 126553aecca302c9e02fd77e333b9cb217e623b4
commit 8cc7a679d29cf6ecccfa08191e688c7f81ef95c2
Author: djm@openbsd.org
Date: Sat Jan 19 21:37:13 2019 +0000
upstream: convert channels.c to new packet API
with & ok markus@
OpenBSD-Commit-ID: 0b8279b56113cbd4011fc91315c0796b63dc862c
commit 06232038c794c7dfcb087be0ab0b3e65b09fd396
Author: djm@openbsd.org
Date: Sat Jan 19 21:36:38 2019 +0000
upstream: convert sshconnect.c to new packet API
with & ok markus@
OpenBSD-Commit-ID: 222337cf6c96c347f1022d976fac74b4257c061f
commit 25b2ed667216314471bb66752442c55b95792dc3
Author: djm@openbsd.org
Date: Sat Jan 19 21:36:06 2019 +0000
upstream: convert ssh.c to new packet API
with & ok markus@
OpenBSD-Commit-ID: eb146878b24e85c2a09ee171afa6797c166a2e21
commit e3128b38623eef2fa8d6e7ae934d3bd08c7e973e
Author: djm@openbsd.org
Date: Sat Jan 19 21:35:25 2019 +0000
upstream: convert mux.c to new packet API
with & ok markus@
OpenBSD-Commit-ID: 4e3893937bae66416e984b282d8f0f800aafd802
commit ed1df7226caf3a943a36d580d4d4e9275f8a61ee
Author: djm@openbsd.org
Date: Sat Jan 19 21:34:45 2019 +0000
upstream: convert sshconnect2.c to new packet API
with & ok markus@
OpenBSD-Commit-ID: 1cb869e0d6e03539f943235641ea070cae2ebc58
commit 23f22a4aaa923c61ec49a99ebaa383656e87fa40
Author: djm@openbsd.org
Date: Sat Jan 19 21:33:57 2019 +0000
upstream: convert clientloop.c to new packet API
with & ok markus@
OpenBSD-Commit-ID: 497b36500191f452a22abf283aa8d4a9abaee7fa
commit ad60b1179c9682ca5aef0b346f99ef68cbbbc4e5
Author: djm@openbsd.org
Date: Sat Jan 19 21:33:13 2019 +0000
upstream: allow sshpkt_fatal() to take a varargs format; we'll
use this to give packet-related fatal error messages more context (esp. the
remote endpoint) ok markus@
OpenBSD-Commit-ID: de57211f9543426b515a8a10a4f481666b2b2a50
commit 0fa174ebe129f3d0aeaf4e2d1dd8de745870d0ff
Author: djm@openbsd.org
Date: Sat Jan 19 21:31:32 2019 +0000
upstream: begin landing remaining refactoring of packet parsing
API, started almost exactly six years ago.
This change stops including the old packet_* API by default and makes
each file that requires the old API include it explicitly. We will
commit file-by-file refactoring to remove the old API in consistent
steps.
with & ok markus@
OpenBSD-Commit-ID: 93c98a6b38f6911fd1ae025a1ec57807fb4d4ef4
commit 4ae7f80dfd02f2bde912a67c9f338f61e90fa79f
Author: tb@openbsd.org
Date: Sat Jan 19 04:15:56 2019 +0000
upstream: Print an \r in front of the password prompt so parts of
a password that was entered too early are likely clobbered by the prompt.
Idea from doas.
from and ok djm
"i like it" deraadt
OpenBSD-Commit-ID: 5fb97c68df6d8b09ab37f77bca1d84d799c4084e
commit a6258e5dc314c7d504ac9f0fbc3be96475581dbe
Author: Darren Tucker
Date: Fri Jan 18 11:09:01 2019 +1100
Add minimal fchownat and fchmodat implementations.
Fixes builds on at least OS X Lion, NetBSD 6 and Solaris 10.
commit 091093d25802b87d3b2b09f2c88d9f33e1ae5562
Author: Darren Tucker
Date: Fri Jan 18 12:11:42 2019 +1300
Add a minimal implementation of utimensat().
Some systems (eg older OS X) do not have utimensat, so provide minimal
implementation in compat layer. Fixes build on at least El Capitan.
commit 609644027dde1f82213699cb6599e584c7efcb75
Author: djm@openbsd.org
Date: Tue Jan 1 22:20:16 2019 +0000
upstream: regress bits for banner processing refactor (this test was
depending on ssh returning a particular error message for banner parsing
failure)
reminded by bluhm@
OpenBSD-Regress-ID: f24fc303d40931157431df589b386abf5e1be575
commit f47d72ddad75b93d3cbc781718b0fa9046c03df8
Author: djm@openbsd.org
Date: Thu Jan 17 04:45:09 2019 +0000
upstream: tun_fwd_ifnames variable should b
=?UTF-8?q?e=20extern;=20from=20Hanno=20B=C3=B6ck?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
OpenBSD-Commit-ID: d53dede6e521161bf04d39d09947db6253a38271
commit 943d0965263cae1c080ce5a9d0b5aa341885e55d
Author: djm@openbsd.org
Date: Thu Jan 17 04:20:53 2019 +0000
upstream: include time.h for time(3)/nanosleep(2); from Ian
McKellar
OpenBSD-Commit-ID: 6412ccd06a88f65b207a1089345f51fa1244ea51
commit dbb4dec6d5d671b5e9d67ef02162a610ad052068
Author: djm@openbsd.org
Date: Thu Jan 17 01:50:24 2019 +0000
upstream: many of the global variables in this file can be made static;
patch from Markus Schmidt
OpenBSD-Commit-ID: f3db619f67beb53257b21bac0e92b4fb7d5d5737
commit 60d8c84e0887514c99c9ce071965fafaa1c3d34a
Author: djm@openbsd.org
Date: Wed Jan 16 23:23:45 2019 +0000
upstream: Add "-h" flag to sftp chown/chgrp/chmod commands to
request they do not follow symlinks. Requires recently-committed
lsetstat@openssh.com extension on the server side.
ok markus@ dtucker@
OpenBSD-Commit-ID: f93bb3f6f7eb2fb7ef1e59126e72714f1626d604
commit dbbc7e0eab7262f34b8e0cd6efecd1c77b905ed0
Author: djm@openbsd.org
Date: Wed Jan 16 23:22:10 2019 +0000
upstream: add support for a "lsetstat@openssh.com" extension. This
replicates the functionality of the existing SSH2_FXP_SETSTAT operation but
does not follow symlinks. Based on a patch from Bert Haverkamp in bz#2067 but
with more attribute modifications supported.
ok markus@ dtucker@
OpenBSD-Commit-ID: f7234f6e90db19655d55d936a115ee4ccb6aaf80
commit 4a526941d328fc3d97068c6a4cbd9b71b70fe5e1
Author: djm@openbsd.org
Date: Fri Jan 4 03:27:50 2019 +0000
upstream: eliminate function-static attempt counters for
passwd/kbdint authmethods by moving them to the client authctxt; Patch from
Markus Schmidt, ok markus@
OpenBSD-Commit-ID: 4df4404a5d5416eb056f68e0e2f4fa91ba3b3f7f
commit 8a8183474c41bd6cebaa917346b549af2239ba2f
Author: djm@openbsd.org
Date: Fri Jan 4 03:23:00 2019 +0000
upstream: fix memory leak of ciphercontext when rekeying; bz#2942
Patch from Markus Schmidt; ok markus@
OpenBSD-Commit-ID: 7877f1b82e249986f1ef98d0ae76ce987d332bdd
commit 5bed70afce0907b6217418d0655724c99b683d93
Author: djm@openbsd.org
Date: Tue Jan 1 23:10:53 2019 +0000
upstream: static on global vars, const on handler tables that contain
function pointers; from Mike Frysinger
OpenBSD-Commit-ID: 7ef2305e50d3caa6326286db43cf2cfaf03960e0
commit 007a88b48c97d092ed2f501bbdcb70d9925277be
Author: djm@openbsd.org
Date: Thu Dec 27 23:02:11 2018 +0000
upstream: Request RSA-SHA2 signatures for
rsa-sha2-{256|512}-cert-v01@openssh.com cert algorithms; ok markus@
OpenBSD-Commit-ID: afc6f7ca216ccd821656d1c911d2a3deed685033
commit eb347d086c35428c47fe52b34588cbbc9b49d9a6
Author: djm@openbsd.org
Date: Thu Dec 27 03:37:49 2018 +0000
upstream: ssh_packet_set_state() now frees ssh->kex implicitly, so
don't do explicit kex_free() beforehand
OpenBSD-Regress-ID: f2f73bad47f62a2040ccba0a72cadcb12eda49cf
commit bb542f0cf6f7511a22a08c492861e256a82376a9
Author: tedu@openbsd.org
Date: Sat Dec 15 00:50:21 2018 +0000
upstream: remove unused and problematic sudo clean. ok espie
OpenBSD-Regress-ID: ca90c20a15a85b661e13e98b80c10e65cd662f7b
commit 0a843d9a0e805f14653a555f5c7a8ba99d62c12d
Author: djm@openbsd.org
Date: Thu Dec 27 03:25:24 2018 +0000
upstream: move client/server SSH-* banners to buffers under
ssh->kex and factor out the banner exchange. This eliminates some common code
from the client and server.
Also be more strict about handling \r characters - these should only
be accepted immediately before \n (pointed out by Jann Horn).
Inspired by a patch from Markus Schmidt.
(lots of) feedback and ok markus@
OpenBSD-Commit-ID: 1cc7885487a6754f63641d7d3279b0941890275b
commit 434b587afe41c19391821e7392005068fda76248
Author: dtucker@openbsd.org
Date: Fri Dec 7 04:36:09 2018 +0000
upstream: Fix calculation of initial bandwidth limits. Account for
written bytes before the initial timer check so that the first buffer written
is accounted. Set the threshold after which the timer is checked such that
the limit starts being computed as soon as possible, ie after the second
buffer is written. This prevents an initial burst of traffic and provides a
more accurate bandwidth limit. bz#2927, ok djm.
OpenBSD-Commit-ID: ff3ef76e4e43040ec198c2718d5682c36b255cb6
commit a6a0788cbbe8dfce2819ee43b09c80725742e21c
Author: djm@openbsd.org
Date: Fri Dec 7 03:39:40 2018 +0000
upstream: only consider the ext-info-c extension during the initial
KEX. It shouldn't be sent in subsequent ones, but if it is present we should
ignore it.
This prevents sshd from sending a SSH_MSG_EXT_INFO for REKEX for buggy
these clients. Reported by Jakub Jelen via bz2929; ok dtucker@
OpenBSD-Commit-ID: 91564118547f7807030ec537480303e2371902f9
commit 63bba57a32c5bb6158d57cf4c47022daf89c14a0
Author: djm@openbsd.org
Date: Fri Dec 7 03:33:18 2018 +0000
upstream: fix option letter pasto in previous
OpenBSD-Commit-ID: e26c8bf2f2a808f3c47960e1e490d2990167ec39
commit 737e4edd82406595815efadc28ed5161b8b0c01a
Author: djm@openbsd.org
Date: Fri Dec 7 03:32:26 2018 +0000
upstream: mention that the ssh-keygen -F (find host in
authorized_keys) and -R (remove host from authorized_keys) options may accept
either a bare hostname or a [hostname]:port combo. bz#2935
OpenBSD-Commit-ID: 5535cf4ce78375968b0d2cd7aa316fa3eb176780
commit 8a22ffaa13391cfe5b40316d938fe0fb931e9296
Author: Damien Miller
Date: Fri Dec 7 15:41:16 2018 +1100
expose $SSH_CONNECTION in the PAM environment
This makes the connection 4-tuple available to PAM modules that
wish to use it in decision-making. bz#2741
commit a784fa8c7a7b084d63bae82ccfea902131bb45c5
Author: Kevin Adler
Date: Wed Dec 12 22:12:45 2018 -0600
Don't pass loginmsg by address now that it's an sshbuf*
In 120a1ec74, loginmsg was changed from the legacy Buffer type
to struct sshbuf*, but it missed changing calls to
sys_auth_allowed_user and sys_auth_record_login which passed
loginmsg by address. Now that it's a pointer, just pass it directly.
This only affects AIX, unless there are out of tree users.
commit 285310b897969a63ef224d39e7cc2b7316d86940
Author: djm@openbsd.org
Date: Fri Dec 7 02:31:20 2018 +0000
upstream: no need to allocate channels_pre/channels_post in
channel_init_channels() as we do it anyway in channel_handler_init() that we
call at the end of the function. Fix from Markus Schmidt via bz#2938
OpenBSD-Commit-ID: 74893638af49e3734f1e33a54af1b7ea533373ed
commit 87d6cf1cbc91df6815db8fe0acc7c910bc3d18e4
Author: djm@openbsd.org
Date: Fri Nov 30 02:24:52 2018 +0000
upstream: don't attempt to connect to empty SSH_AUTH_SOCK; bz#293
OpenBSD-Commit-ID: 0e8fc8f19f14b21adef7109e0faa583d87c0e929
commit 91b19198c3f604f5eef2c56dbe36f29478243141
Author: djm@openbsd.org
Date: Wed Nov 28 06:00:38 2018 +0000
upstream: don't truncate user or host name in "user@host's
OpenBSD-Commit-ID: e6ca01a8d58004b7f2cac0b1b7ce8f87e425e360
commit dd0cf6318d9b4b3533bda1e3bc021b2cd7246b7a
Author: jmc@openbsd.org
Date: Fri Nov 23 06:58:28 2018 +0000
upstream: tweak previous;
OpenBSD-Commit-ID: 08f096922eb00c98251501c193ff9e83fbb5de4f
commit 8a85f5458d1c802471ca899c97f89946f6666e61
Author: Darren Tucker
Date: Sun Nov 25 21:44:05 2018 +1100
Include stdio.h for FILE if needed.
commit 16fb23f25454991272bfe4598cc05d20fcd25116
Author: Darren Tucker
Date: Sun Nov 25 14:05:57 2018 +1100
Reverse order of OpenSSL init functions.
Try the new init function (OPENSSL_init_crypto) before falling back to
the old one (OpenSSL_add_all_algorithms).
commit 98f878d2272bf8dff21f2a0265d963c29e33fed2
Author: Darren Tucker
Date: Sun Nov 25 14:05:08 2018 +1100
Improve OpenSSL_add_all_algorithms check.
OpenSSL_add_all_algorithms() may be a macro so check for that too.
commit 9e34e0c59ab04514f9de9934a772283f7f372afe
Author: djm@openbsd.org
Date: Fri Nov 23 05:08:07 2018 +0000
upstream: add a ssh_config "Match final" predicate
Matches in same pass as "Match canonical" but doesn't require
hostname canonicalisation be enabled. bz#2906 ok markus
OpenBSD-Commit-ID: fba1dfe9f6e0cabcd0e2b3be13f7a434199beffa
commit 4da58d58736b065b1182b563d10ad6765d811c6d
Author: dtucker@openbsd.org
Date: Fri Nov 23 02:53:57 2018 +0000
upstream: Remove now-unneeded ifdef SIGINFO around handler since it is
now always used for SIGUSR1 even when SIGINFO is not defined. This will make
things simpler in -portable.
OpenBSD-Regress-ID: 4ff0265b335820b0646d37beb93f036ded0dc43f
commit c721d5877509875c8515df0215fa1dab862013bc
Author: Darren Tucker
Date: Fri Nov 23 14:11:20 2018 +1100
Move RANDOM_SEED_SIZE outside ifdef.
RANDOM_SEED_SIZE is used by both the OpenSSL and non-OpenSSL code
This fixes the build with configureed --without-openssl.
commit deb51552c3ce7ce72c8d0232e4f36f2e7c118c7d
Author: Darren Tucker
Date: Thu Nov 22 19:59:28 2018 +1100
Resync with OpenBSD by pulling in an ifdef SIGINFO.
commit 28c7b2cd050f4416bfcf3869a20e3ea138aa52fe
Author: Damien Miller
Date: Fri Nov 23 10:45:20 2018 +1100
fix configure test for OpenSSL version
square brackets in case statements may be eaten by autoconf.
Report and fix from Filipp Gunbin; tweaked by naddy@
commit 42c5ec4b97b6a1bae70f323952d0646af16ce710
Author: Damien Miller
Date: Fri Nov 23 10:40:06 2018 +1100
refactor libcrypto initialisation
Don't call OpenSSL_add_all_algorithms() unless OpenSSL actually
supports it.
Move all libcrypto initialisation to a single function, and call that
from seed_rng() that is called early in each tool's main().
Prompted by patch from Rosen Penev
commit 5b60b6c02009547a3e2a99d4886965de2a4719da
Author: dtucker@openbsd.org
Date: Thu Nov 22 08:59:11 2018 +0000
upstream: Output info on SIGUSR1 as well as
SIGINFO to resync with portable. (ID sync only).
OpenBSD-Regress-ID: 699d153e2de22dce51a1b270c40a98472d1a1b16
commit e4ae345dc75b34fd870c2e8690d831d2c1088eb7
Author: dtucker@openbsd.org
Date: Thu Nov 22 08:48:32 2018 +0000
upstream: Append pid to temp files in /var/run and set a cleanup
trap for them. This allows multiple instances of tests to run without
colliding.
OpenBSD-Regress-ID: 57add105ecdfc54752d8003acdd99eb68c3e0b4c
commit f72d0f52effca5aa20a193217346615ecd3eed53
Author: dtucker@openbsd.org
Date: Wed Oct 31 11:09:27 2018 +0000
upstream: UsePrivilegeSeparation no is deprecated
test "yes" and "sandbox".
OpenBSD-Regress-ID: 80e685ed8990766527dc629b1affc09a75bfe2da
commit 35d0e5fefc419bddcbe09d7fc163d8cd3417125b
Author: djm@openbsd.org
Date: Wed Oct 17 23:28:05 2018 +0000
upstream: add some knobs:
UNITTEST_FAST?= no # Skip slow tests (e.g. less intensive fuzzing).
UNITTEST_SLOW?= no # Include slower tests (e.g. more intensive fuzzing).
UNITTEST_VERBOSE?= no # Verbose test output (inc. per-test names).
useful if you want to run the tests as a smoke test to exercise the
functionality without waiting for all the fuzzers to run.
OpenBSD-Regress-ID: e04d82ebec86068198cd903acf1c67563c57315e
commit c1941293d9422a14dda372b4c21895e72aa7a063
Author: Darren Tucker
Date: Thu Nov 22 15:52:26 2018 +1100
Resync Makefile.inc with upstream.
It's unused in -portable, but having it out of sync makes other syncs
fail to apply.
commit 928f1231f65f88cd4c73e6e0edd63d2cf6295d77
Author: djm@openbsd.org
Date: Mon Nov 19 04:12:32 2018 +0000
upstream: silence (to log level debug2) failure messages when
loading the default hostkeys. Hostkeys explicitly specified in the
configuration or on the command-line are still reported as errors, and
failure to load at least one host key remains a fatal error.
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Based on patch from Dag-Erling Smørgrav via
https://github.com/openssh/openssh-portable/pull/103
ok markus@
OpenBSD-Commit-ID: ffc2e35a75d1008effaf05a5e27425041c27b684
commit 7fca94edbe8ca9f879da9fdd2afd959c4180f4c7
Author: dtucker@openbsd.org
Date: Sun Nov 18 22:43:29 2018 +0000
upstream: Fix inverted logic for redirecting ProxyCommand stderr to
/dev/null. Fixes mosh in proxycommand mode that was broken by the previous
ProxyCommand change that was reported by matthieu@. ok djm@ danj@
OpenBSD-Commit-ID: c6fc9641bc250221a0a81c6beb2e72d603f8add6
commit ccef7c4faf914993b53035cd2b25ce02ab039c9d
Author: djm@openbsd.org
Date: Fri Nov 16 06:17:38 2018 +0000
upstream: redirect stderr of ProxyCommands to /dev/null when ssh is
started with ControlPersist; based on patch from Steffen Prohaska
OpenBSD-Commit-ID: 1bcaa14a03ae80369d31021271ec75dce2597957
commit 15182fd96845a03216d7ac5a2cf31c4e77e406e3
Author: djm@openbsd.org
Date: Fri Nov 16 06:10:29 2018 +0000
upstream: make grandparent-parent-child sshbuf chains robust to
use-after-free faults if the ancestors are freed before the descendents.
Nothing in OpenSSH uses this deallocation pattern. Reported by Jann Horn
OpenBSD-Commit-ID: d93501d1d2734245aac802a252b9bb2eccdba0f2
commit 2a35862e664afde774d4a72497d394fe7306ccb5
Author: djm@openbsd.org
Date: Fri Nov 16 03:26:01 2018 +0000
upstream: use path_absolute() for pathname checks; from Manoj Ampalam
OpenBSD-Commit-ID: 482ce71a5ea5c5f3bc4d00fd719481a6a584d925
commit d0d1dfa55be1c5c0d77ab3096b198a64235f936d
Author: Darren Tucker
Date: Fri Nov 16 14:11:44 2018 +1100
Test for OPENSSL_init_crypto before using.
Check for the presence of OPENSSL_init_crypto and all the flags we want
before trying to use it (bz#2931).
commit 6010c0303a422a9c5fa8860c061bf7105eb7f8b2
Author: djm@openbsd.org
Date: Fri Nov 16 03:03:10 2018 +0000
upstream: disallow empty incoming filename or ones that refer to the
current directory; based on report/patch from Harry Sintonen
OpenBSD-Commit-ID: f27651b30eaee2df49540ab68d030865c04f6de9
commit aaed635e3a401cfcc4cc97f33788179c458901c3
Author: djm@openbsd.org
Date: Fri Nov 16 02:46:20 2018 +0000
upstream: fix bug in client that was keeping a redundant ssh-agent
socket around for the life of the connection; bz#2912; reported by Simon
Tatham; ok dtucker@
OpenBSD-Commit-ID: 4ded588301183d343dce3e8c5fc1398e35058478
commit e76135e3007f1564427b2956c628923d8dc2f75a
Author: djm@openbsd.org
Date: Fri Nov 16 02:43:56 2018 +0000
upstream: fix bug in HostbasedAcceptedKeyTypes and
PubkeyAcceptedKeyTypes options. If only RSA-SHA2 siganture types were
specified, then authentication would always fail for RSA keys as the monitor
checks only the base key (not the signature algorithm) type against
*AcceptedKeyTypes. bz#2746; reported by Jakub Jelen; ok dtucker
OpenBSD-Commit-ID: 117bc3dc54578dbdb515a1d3732988cb5b00461b
commit 5c1a63562cac0574c226224075b0829a50b48c9d
Author: djm@openbsd.org
Date: Fri Nov 16 02:30:20 2018 +0000
upstream: support a prefix of '@' to suppress echo of sftp batch
commands; bz#2926; ok dtucker@
OpenBSD-Commit-ID: 9d635636bc84aeae796467e059f7634de990a79d
commit 90ef45f7aac33eaf55ec344e101548a01e570f29
Author: schwarze@openbsd.org
Date: Tue Nov 13 07:22:45 2018 +0000
upstream: fix markup error (missing blank before delimiter); from
Mike Frysinger
OpenBSD-Commit-ID: 1bc5392f795ca86318d695e0947eaf71a5a4f6d9
commit 960e7c672dc106f3b759c081de3edb4d1138b36e
Author: djm@openbsd.org
Date: Fri Nov 9 02:57:58 2018 +0000
upstream: typo in error message; caught by Debian lintian, via
Colin Watson
OpenBSD-Commit-ID: bff614c7bd1f4ca491a84e9b5999f848d0d66758
commit 81f1620c836e6c79c0823ba44acca605226a80f1
Author: djm@openbsd.org
Date: Fri Nov 9 02:56:22 2018 +0000
upstream: correct local variable name; from yawang AT microsoft.com
OpenBSD-Commit-ID: a0c228390856a215bb66319c89cb3959d3af8c87
commit 1293740e800fa2e5ccd38842a2e4970c6f3b9831
Author: dtucker@openbsd.org
Date: Wed Oct 31 11:20:05 2018 +0000
upstream: Import new moduli.
OpenBSD-Commit-ID: c07772f58028fda683ee6abd41c73da3ff70d403
commit 46925ae28e53fc9add336a4fcdb7ed4b86c3591c
Author: djm@openbsd.org
Date: Fri Oct 26 01:23:03 2018 +0000
upstream: mention ssh-ed25519-cert-v01@openssh.com in list of cert
key type at start of doc
OpenBSD-Commit-ID: b46b0149256d67f05f2d5d01e160634ed1a67324
commit 8d8340e2c215155637fe19cb1a837f71b2d55f7b
Author: Darren Tucker
Date: Fri Nov 16 13:32:13 2018 +1100
Remove fallback check for /usr/local/ssl.
If configure could not find a working OpenSSL installation it would
fall back to checking in /usr/local/ssl. This made sense back when
systems did not ship with OpenSSL, but most do and OpenSSL 1.1 doesn't
use that as a default any more. The fallback behaviour also meant
that if you pointed --with-ssl-dir at a specific directory and it
didn't work, it would silently use either the system libs or the ones
in /usr/local/ssl. If you want to use /usr/local/ssl you'll need to
pass configure --with-ssl-dir=/usr/local/ssl. ok djm@
commit ce93472134fb22eff73edbcd173a21ae38889331
Author: Darren Tucker
Date: Fri Nov 16 12:44:01 2018 +1100
Fix check for OpenSSL 1.0.1 exactly.
Both INSTALL and configure.ac claim OpenSSL >= 1.0.1 is supported; fix
compile-time check for 1.0.1 to match.
commit f2970868f86161a22b2c377057fa3891863a692a
Author: Darren Tucker
Date: Sun Nov 11 15:58:20 2018 +1100
Improve warnings in cygwin service setup.
bz#2922, patch from vinschen at redhat.com.
commit bd2d54fc1eee84bf87158a1277a50e6c8a303339
Author: Darren Tucker
Date: Sun Nov 11 15:54:54 2018 +1100
Remove hardcoded service name in cygwin setup.
bz#2922, patch from Christian.Lupien at USherbrooke.ca, sanity check
by vinschen at redhat.com.
commit d0153c77bf7964e694f1d26c56c41a571b8e9466
Author: Dag-Erling Smørgrav
Date: Tue Oct 9 23:03:40 2018 +0200
AC_CHECK_SIZEOF() no longer needs a second argument.
commit 9b47b083ca9d866249ada9f02dbd57c87b13806e
Author: Manoj Ampalam
Date: Thu Nov 8 22:41:59 2018 -0800
Fix error message w/out nistp521.
Correct error message when OpenSSL doesn't support certain ECDSA key
lengths.
commit 624d19ac2d56fa86a22417c35536caceb3be346f
Author: Eneas U de Queiroz
Date: Tue Oct 9 16:17:42 2018 -0300
fix compilation with openssl built without ECC
ECDSA code in openssh-compat.h and libressl-api-compat.c needs to be
guarded by OPENSSL_HAS_ECC
Signed-off-by: Eneas U de Queiroz
commit 1801cd11d99d05a66ab5248c0555f55909a355ce
Author: Darren Tucker
Date: Thu Nov 8 15:03:11 2018 +1100
Simplify OpenSSL 1.1 function checks.
Replace AC_SEARCH_LIBS checks for OpenSSL 1.1 functions with a single
AC_CHECK_FUNCS. ok djm@
commit bc32f118d484e4d71d2a0828fd4eab7e4176c9af
Author: Darren Tucker
Date: Mon Nov 5 17:31:24 2018 +1100
Fix pasto for HAVE_EVP_CIPHER_CTX_SET_IV.
Prevents unnecessary redefinition. Patch from mforney at mforney.org.
commit 3719df60c66abc4b47200d41f571d67772f293ba
Author: Darren Tucker
Date: Wed Oct 31 22:21:03 2018 +1100
Import new moduli.
commit 595605d4abede475339d6a1f07a8cc674c11d1c3
Author: Darren Tucker