summaryrefslogtreecommitdiffstats
path: root/.depend (follow)
Commit message (Collapse)AuthorAgeFilesLines
* dependDamien Miller2024-10-141-3/+3
|
* conditionally include mman.h in arc4random codeDamien Miller2024-09-181-2/+2
|
* upstream: Add experimental support for hybrid post-quantum key exchangedjm@openbsd.org2024-09-021-0/+1
| | | | | | | | | | | | | | | | | | ML-KEM768 with ECDH/X25519 from the Internet-draft: https://datatracker.ietf.org/doc/html/draft-kampanakis-curdle-ssh-pq-ke-03 This is based on previous patches from markus@ but adapted to use the final FIPS203 standard ML-KEM using a formally-verified implementation from libcrux. Note this key exchange method is still a draft and thus subject to change. It is therefore disabled by default; set MLKEM=yes to build it. We're making it available now to make it easy for other SSH implementations to test against it. ok markus@ deraadt@ OpenBSD-Commit-ID: 02a8730a570b63fa8acd9913ec66353735dea42c
* upstream: Add a facility to sshd(8) to penalise particulardjm@openbsd.org2024-06-061-3/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | problematic client behaviours, controlled by two new sshd_config(5) options: PerSourcePenalties and PerSourcePenaltyExemptList. When PerSourcePenalties are enabled, sshd(8) will monitor the exit status of its child pre-auth session processes. Through the exit status, it can observe situations where the session did not authenticate as expected. These conditions include when the client repeatedly attempted authentication unsucessfully (possibly indicating an attack against one or more accounts, e.g. password guessing), or when client behaviour caused sshd to crash (possibly indicating attempts to exploit sshd). When such a condition is observed, sshd will record a penalty of some duration (e.g. 30 seconds) against the client's address. If this time is above a minimum threshold specified by the PerSourcePenalties, then connections from the client address will be refused (along with any others in the same PerSourceNetBlockSize CIDR range). Repeated offenses by the same client address will accrue greater penalties, up to a configurable maximum. A PerSourcePenaltyExemptList option allows certain address ranges to be exempt from all penalties. We hope these options will make it significantly more difficult for attackers to find accounts with weak/guessable passwords or exploit bugs in sshd(8) itself. PerSourcePenalties is off by default, but we expect to enable it automatically in the near future. much feedback markus@ and others, ok markus@ OpenBSD-Commit-ID: 89ded70eccb2b4926ef0366a4d58a693de366cca
* dependDamien Miller2024-05-311-0/+1
|
* Makefile support for sshd-sessionDamien Miller2024-05-171-4/+8
|
* dependDamien Miller2024-04-301-2/+2
|
* dependDamien Miller2023-12-181-1/+2
|
* dependDamien Miller2023-08-101-19/+0
|
* dependDamien Miller2023-07-201-0/+19
|
* dependV_9_3_P1Damien Miller2023-03-151-26/+25
|
* upstream: update OpenSSH's Ed25519 code to the last version of SUPERCOPdjm@openbsd.org2023-01-161-6/+2
| | | | | | | | | | (20221122) and change the import approach to the same one we use for Streamlined NTRUPrime: use a shell script to extract the bits we need from SUPERCOP, make some minor adjustments and squish them all into a single file. ok tb@ tobhe@ OpenBSD-Commit-ID: 1bc0fd624cb6af440905b8ba74ac7c03311b8e3b
* update .dependV_9_1_P1Damien Miller2022-10-031-1/+3
|
* Remove workarounds for OpenSSL missing AES-CTR.Darren Tucker2022-07-251-1/+0
| | | | | | | We have some compatibility hacks that were added to support OpenSSL versions that do not support AES CTR mode. Since that time, however, the minimum OpenSSL version that we support has moved to 1.0.1 which *does* have CTR, so this is no longer needed. ok djm@
* dependDamien Miller2022-03-311-1/+1
|
* makedependV_8_9_P1Damien Miller2022-02-231-1/+1
|
* dependDamien Miller2022-01-251-1/+1
|
* dependDamien Miller2022-01-061-3/+3
|
* dependDamien Miller2021-11-291-49/+47
|
* update dependsDamien Miller2021-11-181-47/+49
|
* dependDamien Miller2021-10-281-1/+0
|
* dependV_8_7_P1Damien Miller2021-08-201-158/+158
|
* upstream: on fatal errors, make scp wait for ssh connection beforedjm@openbsd.org2021-08-101-49/+47
| | | | | | | | exiting avoids LogLevel=verbose (or greater) messages from ssh appearing after scp has returned exited and control has returned to the shell; ok markus@ OpenBSD-Commit-ID: ef9dab5ef5ae54a6a4c3b15d380568e94263456c
* use openbsd-compat glob.h is requiredDamien Miller2021-08-041-48/+50
|
* upstream: support for using the SFTP protocol for file transfers indjm@openbsd.org2021-08-031-1/+1
| | | | | | | | | | | | | scp, via a new "-M sftp" option. Marked as experimental for now. Some corner-cases exist, in particular there is no attempt to provide bug-compatibility with scp's weird "double shell" quoting rules. Mostly by Jakub Jelen in GHPR#194 with some tweaks by me. ok markus@ Thanks jmc@ for improving the scp.1 bits. OpenBSD-Commit-ID: 6ce4c9157ff17b650ace571c9f7793d92874051c
* dependV_8_6_P1Damien Miller2021-04-161-90/+90
|
* update dependV_8_5_P1Damien Miller2021-03-021-9/+11
|
* upstream: Update/replace the experimental post-quantim hybrid keydjm@openbsd.org2020-12-291-3/+4
| | | | | | | | | | | | | | | | | | | | exchange method based on Streamlined NTRU Prime (coupled with X25519). The previous sntrup4591761x25519-sha512@tinyssh.org method is replaced with sntrup761x25519-sha512@openssh.com. Per the authors, sntrup4591761 was replaced almost two years ago by sntrup761. The sntrup761 implementaion, like sntrup4591761 before it, is public domain code extracted from the SUPERCOP cryptography benchmark suite (https://bench.cr.yp.to/supercop.html). Thanks for Daniel J Bernstein for guidance on algorithm selection. Patch from Tobias Heider; feedback & ok markus@ and myself (note this both the updated method and the one that it replaced are disabled by default) OpenBSD-Commit-ID: 2bf582b772d81ee24e911bb6f4b2aecfd39338ae
* upstream: use the new variant log macros instead of prependingdjm@openbsd.org2020-10-181-96/+96
| | | | | | __func__ and appending ssh_err(r) manually; ok markus@ OpenBSD-Commit-ID: 1f14b80bcfa85414b2a1a6ff714fb5362687ace8
* .dependDamien Miller2020-09-201-2/+2
|
* dependDamien Miller2020-05-291-49/+46
|
* make dependDamien Miller2020-05-131-45/+48
|
* Update .depend.Darren Tucker2020-05-021-2/+4
|
* Update .depend.Darren Tucker2020-04-241-3/+4
|
* dependDamien Miller2020-02-061-5/+5
|
* dependDamien Miller2020-01-261-1/+2
|
* dependDamien Miller2020-01-211-44/+44
|
* Update depend to remove rmd160.h.Darren Tucker2020-01-141-176/+173
|
* Remove auth-skey.c.Darren Tucker2020-01-051-1/+0
| | | | S/Key support was removed in OpenSSH 7.8 but this file was missed.
* refresh dependDamien Miller2019-12-301-4/+4
|
* adapt Makefile to ssh-sk-client everywhereDamien Miller2019-12-131-1/+2
|
* Sort depends.Darren Tucker2019-12-111-5/+5
|
* Update depend to include sk files.Darren Tucker2019-12-111-3/+3
|
* upstream: directly support U2F/FIDO2 security keys in OpenSSH bydjm@openbsd.org2019-11-141-43/+45
| | | | | | | | linking against the (previously external) USB HID middleware. The dlopen() capability still exists for alternate middlewares, e.g. for Bluetooth, NFC and test/debugging. OpenBSD-Commit-ID: 14446cf170ac0351f0d4792ba0bca53024930069
* Rebuild .depend.Darren Tucker2019-11-021-171/+174
|
* dependDamien Miller2019-10-311-5/+8
|
* dependDamien Miller2019-10-091-1/+1
|
* upstream: fixes for !WITH_OPENSSL compilation; ok dtucker@djm@openbsd.org2019-09-061-40/+41
| | | | OpenBSD-Commit-ID: 7fd68eaa9e0f7482b5d4c7e8d740aed4770a839f
* Revert one dependency per line change.Darren Tucker2019-07-191-5888/+166
| | | | | | It turns out that having such a large number of lines in the .depend file will cause the memory usage of awk during AC_SUBST to blow up on at least NetBSD's awk, causing configure to fail.
* Force dependencies one per line.Darren Tucker2019-07-191-166/+5888
| | | | | Force makedepend to output one dependency per line, which will make reading diffs against it much easier. ok djm@
generated by cgit v1.2.3 (git 2.39.1) at 2024-11-29 17:40:52 +0100