summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* - djm@cvs.openbsd.org 2014/01/26 10:49:17Damien Miller2014-02-283-2/+7
| | | | | | | [scp-ssh-wrapper.sh scp.sh] make sure $SCP is tested on the remote end rather than whichever one happens to be in $PATH; from portable (Id sync only)
* - djm@cvs.openbsd.org 2014/01/26 10:22:10Damien Miller2014-02-282-1/+6
| | | | | | | [regress/cert-hostkey.sh] automatically generate revoked keys from listed keys rather than manually specifying each type; from portable (Id sync only)
* - dtucker@cvs.openbsd.org 2014/01/25 04:35:32Damien Miller2014-02-283-2/+60
| | | | | [regress/Makefile regress/dhgex.sh] Add a test for DH GEX sizes
* - dtucker@cvs.openbsd.org 2014/01/20 00:00:30Damien Miller2014-02-282-3/+5
| | | | | [sftp-chroot.sh] append to rather than truncating the log file
* - dtucker@cvs.openbsd.org 2014/01/19 23:43:02Damien Miller2014-02-282-2/+8
| | | | | | [regress/sftp-chroot.sh] Don't use -q on sftp as it suppresses logging, instead redirect the output to the regress logfile.
* - (djm) [README contrib/caldera/openssh.spec contrib/redhat/openssh.spec]Damien Miller2014-02-285-6/+8
| | | | [contrib/suse/openssh.spec] Crank version numbers
* - djm@cvs.openbsd.org 2014/02/27 22:57:40Damien Miller2014-02-282-2/+5
| | | | | [version.h] openssh-6.6
* - djm@cvs.openbsd.org 2014/02/27 22:47:07Damien Miller2014-02-282-2/+10
| | | | | | [sshd_config.5] bz#2184 clarify behaviour of a keyword that appears in multiple matching Match blocks; ok dtucker@
* - djm@cvs.openbsd.org 2014/02/27 08:25:09Damien Miller2014-02-282-2/+5
| | | | | [bufbn.c] off by one in range check
* - djm@cvs.openbsd.org 2014/02/27 00:41:49Damien Miller2014-02-282-1/+13
| | | | | | [bufbn.c] fix unsigned overflow that could lead to reading a short ssh protocol 1 bignum value; found by Ben Hawkes; ok deraadt@
* - markus@cvs.openbsd.org 2014/02/26 21:53:37Damien Miller2014-02-272-1/+6
| | | | | [sshd.c] ssh_gssapi_prepare_supported_oids needs GSSAPI
* - djm@cvs.openbsd.org 2014/02/26 20:29:29Damien Miller2014-02-272-1/+8
| | | | | | [channels.c] don't assume that the socks4 username is \0 terminated; spotted by Ben Hawkes; ok markus@
* - djm@cvs.openbsd.org 2014/02/26 20:28:44Damien Miller2014-02-275-10/+35
| | | | | | | [auth2-gss.c gss-serv.c ssh-gss.h sshd.c] bz#2107 - cache OIDs of supported GSSAPI mechanisms before privsep sandboxing, as running this code in the sandbox can cause violations; ok markus@
* - djm@cvs.openbsd.org 2014/02/26 20:18:37Damien Miller2014-02-272-6/+31
| | | | | | [ssh.c] bz#2205: avoid early hostname lookups unless canonicalisation is enabled; ok dtucker@ markus@
* - djm@cvs.openbsd.org 2014/02/23 20:11:36Damien Miller2014-02-245-62/+145
| | | | | | | | | | | | | | | | | | [readconf.c readconf.h ssh.c ssh_config.5] reparse ssh_config and ~/.ssh/config if hostname canonicalisation changes the hostname. This allows users to write configurations that always refer to canonical hostnames, e.g. CanonicalizeHostname yes CanonicalDomains int.example.org example.org CanonicalizeFallbackLocal no Host *.int.example.org Compression off Host *.example.org User djm ok markus@
* - djm@cvs.openbsd.org 2014/02/23 20:03:42Damien Miller2014-02-242-1/+11
| | | | | | [ssh-ed25519.c] check for unsigned overflow; not reachable in OpenSSH but others might copy our code...
* - djm@cvs.openbsd.org 2014/02/22 01:32:19Damien Miller2014-02-242-13/+25
| | | | | | [readconf.c] when processing Match blocks, skip 'exec' clauses if previous predicates failed to match; ok markus@
* - djm@cvs.openbsd.org 2014/02/15 23:05:36Damien Miller2014-02-242-2/+6
| | | | | | [channels.c] avoid spurious "getsockname failed: Bad file descriptor" errors in ssh -W; bz#2200, debian#738692 via Colin Watson; ok dtucker@
* - djm@cvs.openbsd.org 2014/02/07 06:55:54Damien Miller2014-02-243-9/+13
| | | | | | [cipher.c mac.c] remove some logging that makes ssh debugging output very verbose; ok markus
* 20140221Tim Rice2014-02-212-3/+6
| | | | - (tim) [configure.ac] Fix cut-and-paste error. Patch from Bryan Drewery.
* - (dtucker) [configure.ac openbsd-compat/openssl-compat.{c,h}] Add compatDarren Tucker2014-02-134-4/+21
| | | | code for older OpenSSL versions that don't have EVP_MD_CTX_copy_ex.
* - djm@cvs.openbsd.org 2014/02/06 22:21:01Damien Miller2014-02-062-15/+23
| | | | | | | [sshconnect.c] in ssh_create_socket(), only do the getaddrinfo for BindAddress when BindAddress is actually specified. Fixes regression in 6.5 for UsePrivilegedPort=yes; patch from Corinna Vinschen
* - naddy@cvs.openbsd.org 2014/02/05 20:13:25Damien Miller2014-02-063-5/+12
| | | | | | [ssh-keygen.1 ssh-keygen.c] tweak synopsis: calling ssh-keygen without any arguments is fine; ok jmc@ while here, fix ordering in usage(); requested by jmc@
* - (djm) [sandbox-seccomp-filter.c] Not all Linux architectures defineDamien Miller2014-02-062-0/+4
| | | | __NR_shutdown; some go via the socketcall(2) multiplexer.
* - (dtucker) [openbsd-compat/bsd-poll.c] Don't bother checking for non-NULLDarren Tucker2014-02-062-7/+8
| | | | before freeing since free(NULL) is a no-op. ok djm.
* - (djm) [sandbox-capsicum.c] Don't fatal if Capsicum is offered byDamien Miller2014-02-052-2/+9
| | | | | headers/libc but not supported by the kernel. Patch from Loganaden Velvindron @ AfriNIC
* - (djm) [regress/setuid-allowed.c] Missing string.h for strerror()Damien Miller2014-02-042-0/+2
|
* - (djm) [openbsd-compat/Makefile.in] Add missing explicit_bzero.oDamien Miller2014-02-042-2/+3
|
* - djm@cvs.openbsd.org 2014/02/04 00:24:29Damien Miller2014-02-041-0/+5
| | | | | | | [ssh.c] delay lowercasing of hostname until right before hostname canonicalisation to unbreak case-sensitive matching of ssh_config; reported by Ike Devolder; ok markus@
* - djm@cvs.openbsd.org 2014/02/04 00:24:29Damien Miller2014-02-041-2/+2
| | | | | | | [ssh.c] delay lowercasing of hostname until right before hostname canonicalisation to unbreak case-sensitive matching of ssh_config; reported by Ike Devolder; ok markus@
* - djm@cvs.openbsd.org 2014/02/02 03:44:31Damien Miller2014-02-043-5/+8
| | | | | [digest-libc.c digest-openssl.c] convert memset of potentially-private data to explicit_bzero()
* - djm@cvs.openbsd.org 2014/02/03 23:28:00Damien Miller2014-02-042-4/+5
| | | | | | [ssh-ecdsa.c] fix memory leak; ECDSA_SIG_new() allocates 'r' and 's' for us, unlike DSA_SIG_new. Reported by Batz Spear; ok markus@
* - djm@cvs.openbsd.org 2014/02/02 03:44:32Damien Miller2014-02-0437-154/+168
| | | | | | | | | | | [auth1.c auth2-chall.c auth2-passwd.c authfile.c bufaux.c bufbn.c] [buffer.c cipher-3des1.c cipher.c clientloop.c gss-serv.c kex.c] [kexdhc.c kexdhs.c kexecdhc.c kexgexc.c kexecdhs.c kexgexs.c key.c] [monitor.c monitor_wrap.c packet.c readpass.c rsa.c serverloop.c] [ssh-add.c ssh-agent.c ssh-dss.c ssh-ecdsa.c ssh-ed25519.c] [ssh-keygen.c ssh-rsa.c sshconnect.c sshconnect1.c sshconnect2.c] [sshd.c] convert memset of potentially-private data to explicit_bzero()
* - tedu@cvs.openbsd.org 2014/01/31 16:39:19Damien Miller2014-02-0425-65/+96
| | | | | | | | | | [auth2-chall.c authfd.c authfile.c bufaux.c bufec.c canohost.c] [channels.c cipher-chachapoly.c clientloop.c configure.ac hostfile.c] [kexc25519.c krl.c monitor.c sandbox-systrace.c session.c] [sftp-client.c ssh-keygen.c ssh.c sshconnect2.c sshd.c sshlogin.c] [openbsd-compat/explicit_bzero.c openbsd-compat/openbsd-compat.h] replace most bzero with explicit_bzero, except a few that cna be memset ok djm dtucker
* - djm@cvs.openbsd.org 2014/01/30 22:26:14Damien Miller2014-02-042-1/+6
| | | | | | | [sandbox-systrace.c] allow shutdown(2) syscall in sandbox - it may be called by packet_close() from portable (Id sync only; change is already in portable)
* - jmc@cvs.openbsd.org 2014/01/29 14:04:51Damien Miller2014-02-042-2/+19
| | | | | | | | [sshd_config.5] document kbdinteractiveauthentication; requested From: Ross L Richardson dtucker/markus helped explain its workings;
* - djm@cvs.openbsd.org 2014/01/29 06:18:35Damien Miller2014-02-0419-2633/+22
| | | | | | | [Makefile.in auth.h auth2-jpake.c auth2.c jpake.c jpake.h monitor.c] [monitor.h monitor_wrap.c monitor_wrap.h readconf.c readconf.h] [schnorr.c schnorr.h servconf.c servconf.h ssh2.h sshconnect2.c] remove experimental, never-enabled JPAKE code; ok markus@
* - djm@cvs.openbsd.org 2014/01/29 00:19:26Damien Miller2014-02-042-1/+7
| | | | | | | | [sshd.c] use kill(0, ...) instead of killpg(0, ...); on most operating systems they are equivalent, but SUSv2 describes the latter as having undefined behaviour; from portable; ok dtucker (Id sync only; change is already in portable)
* - jmc@cvs.openbsd.org 2014/01/28 14:13:39Damien Miller2014-02-042-14/+18
| | | | | | [ssh-keyscan.1] kill some bad Pa; From: Jan Stary
* ignore a few more regress droppingsDamien Miller2014-02-041-0/+2
|
* - markus@cvs.openbsd.org 2014/01/27 20:13:46Damien Miller2014-02-044-3/+244
| | | | | [digest.c digest-openssl.c digest-libc.c Makefile.in] rename digest.c to digest-openssl.c and add libc variant; ok djm@
* - markus@cvs.openbsd.org 2014/01/27 19:18:54Damien Miller2014-02-046-43/+58
| | | | | [auth-rsa.c cipher.c ssh-agent.c sshconnect1.c sshd.c] replace openssl MD5 with our ssh_digest_*; ok djm@
* - markus@cvs.openbsd.org 2014/01/27 18:58:14Damien Miller2014-02-049-71/+332
| | | | | | [Makefile.in digest.c digest.h hostfile.c kex.h mac.c hmac.c hmac.h] replace openssl HMAC with an implementation based on our ssh_digest_* ok and feedback djm@
* - (tim) [Makefile.in] build regress/setuid-allow.Tim Rice2014-01-312-2/+3
|
* - (dtucker) [readconf.c] Include <arpa/inet.h> for the hton macros. FixesDarren Tucker2014-01-312-0/+3
| | | | build with HP-UX's compiler. Patch from Kevin Brott.
* - (djm) [sandbox-seccomp-filter.c sandbox-systrace.c] Allow shutdown(2)Damien Miller2014-01-303-0/+6
| | | | syscall from sandboxes; it may be called by packet_close.
* - (djm) Release openssh-6.5p1V_6_5_P1Damien Miller2014-01-301-0/+1
|
* trim entries prior to openssh-6.0p1Damien Miller2014-01-301-2049/+0
|
* - (djm) [configure.ac atomicio.c] Kludge around NetBSD offeringDamien Miller2014-01-303-2/+12
| | | | | | different symbols for 'read' when various compiler flags are in use, causing atomicio.c comparisons against it to break and read/write operations to hang; ok dtucker
* - (djm) [configure.ac] Only check for width-specified integer typesDamien Miller2014-01-302-6/+17
| | | | | in headers that actually exist. patch from Tom G. Christensen; ok dtucker@
generated by cgit v1.2.3 (git 2.39.1) at 2024-12-03 13:46:29 +0100