13852 Commits

This Branch

This Branch

All Branches

Author	SHA1	Message	Date
gbucchino	41d3f2785d	Add rsa_keys	2026-08-14 12:51:02 +01:00
gbucchino	3511a5a607	Update Makefile	2026-08-14 11:49:01 +01:00
gbucchino	a291b0e892	Add kem	2026-08-14 11:39:27 +01:00
gbucchino	e5024c7dc8	upd	2026-08-14 11:35:37 +01:00
gbucchino	aab0a5254a	add kem	2026-08-14 11:29:23 +01:00
Darren Tucker	528055671c	Update NetBSD vmaction pin to pick up 11.0 release.	2026-08-13 15:19:13 +10:00
Darren Tucker	54233bc157	Update x11-ssh-askpass upstream location. ... The original upstream location of x11-ssh-askpass is gone. Replace with its archive.org page for now, similar to what Debian uses.	2026-08-12 19:58:33 +10:00
Darren Tucker	effb576ba4	Add NetBSD 11.0 test targets.	2026-08-12 19:56:37 +10:00
Darren Tucker	0f69d9c717	Add 10.5 branch to test status display.	2026-08-12 19:56:06 +10:00
Damien Miller	9f279dd513	whitespace at eol	2026-08-12 09:29:31 +10:00
Damien Miller	77337b8a6d	depend	2026-08-11 12:21:59 +10:00
Damien Miller	772a5b728e	update version	2026-08-11 12:21:12 +10:00
[email protected]	bd714faddd	upstream: add regress test for servers that hang durig banner write; ... from Thomas Yiu OpenBSD-Regress-ID: 86a25553c75bddc6fc239dc272aca97c61047d22	2026-08-11 09:30:12 +10:00
[email protected]	7e5b75aace	upstream: openssh-10.5 ... OpenBSD-Commit-ID: 047bc46c0a58babdf702e01b8ffc7728d404cb9c	2026-08-11 09:30:02 +10:00
[email protected]	d535299b89	upstream: remove ml-dsa/x25519 from the default algorithm list for ... release (it will be back soon) OpenBSD-Commit-ID: 2466825e05a2cae6b0cb5fa34f39792a0b5a46d3	2026-08-11 09:29:56 +10:00
[email protected]	407a2b79d4	upstream: make reading server banner non-blocking; prevents one ... stuck server from blocking a many-host keyscan; from Thomas Yiu ok dtucker@ markus@ OpenBSD-Commit-ID: 4970af00975119ebf9c1e0e132e3317b72ac0c2e	2026-08-11 09:29:56 +10:00
Darren Tucker	64ede7991d	Use clang-20 when building hardenedmalloc for tests. ... Some versions of clang-19 report: error: invalid feature combination: +avx10.1-256; will be promoted to avx10.1-512 [-Werror,-Winvalid-feature-combination]	2026-08-08 21:23:22 +10:00
[email protected]	05ec77c14b	upstream: remove mlkem768brainpoolp256r1-sha256; requested by ... markus OpenBSD-Commit-ID: 0fcb5943abe5476e42983dcfc4c400e39e5db6a7	2026-08-08 17:35:08 +10:00
[email protected]	08d9155d6e	upstream: move comment to a better place; suggested by markus@ ... OpenBSD-Commit-ID: 451ba42a5dc88723a0b8837d4583957f18edbf40	2026-08-08 17:34:53 +10:00
[email protected]	72ed5241a8	upstream: add some options to allow setting or clearing the ... touch-required and verify-required flags on FIDO private keys when resetting the passphrase. feedback/ok tb@ OpenBSD-Commit-ID: 8895e62eae5778711fe7dd6c09f8679acb2e6674	2026-08-07 15:50:21 +10:00
[email protected]	6a57081dc3	upstream: Allow [email protected] requests when the agent is ... locked, otherwise forwarding sessions established with an agent was locked will be treated as local, rather than remote. Reported by sn0x-sharma OpenBSD-Commit-ID: 524f210c6f2b3a06e0a2f6d0af5188a9a75fa2c7	2026-08-07 15:25:03 +10:00
[email protected]	9910d5ef53	upstream: avoid potential realloc use-after-free in the client if a ... remote forwarding is added via the local session multiplexing socket while a remote forwarding open request is pending with the server. Report and fix from Brian Mingus of Cognatory OpenBSD-Commit-ID: c7888d566576386d0e96859f9ec7310a1e2d3609	2026-08-07 15:25:03 +10:00
[email protected]	3883901483	upstream: fix up synopsis and tweak wording for -Z ... OpenBSD-Commit-ID: 7f0f8e7f610f6af6890cb10915bf316f23651505	2026-08-07 15:25:03 +10:00
[email protected]	e6ece1bc26	upstream: document existence of ... mlkem768{brainpoolp256r1,nistp256}-sha256 KEXes OpenBSD-Commit-ID: e9a9b01a19ed3ccdd82c7fc4c77395495b28faf9	2026-08-07 15:25:03 +10:00
Darren Tucker	4c414d99f3	Re-allow PAMServiceName inside a Match block. ... This is documented to be allowed, and was up until 10.4p1 when a transcription error in the config handling rework reverted it to global-only, ie not allowed inside Match. bz#3987.	2026-08-06 23:30:30 +10:00
Darren Tucker	5adaaa7781	Rerun VM tests on regress Makefile change too	2026-08-04 22:20:47 +10:00
Darren Tucker	b1000abf54	Run tests on regress Makefile changes too.	2026-08-04 14:23:59 +10:00
[email protected]	b8b12ca065	upstream: disable pubkey-priority test until I can fix it to not pick ... up the user's keys from ~/.ssh OpenBSD-Regress-ID: 5295a8cefe1d2def5c8b10f9d60d9bb7a350d316	2026-08-04 12:49:07 +10:00
[email protected]	d5dc50020f	upstream: Fix expected output for implicit ordering test. ok djm@ ... OpenBSD-Regress-ID: 3ba8907d381fb738578ba2090d4b2f22d35a555a	2026-08-04 09:49:11 +10:00
Darren Tucker	265336a702	Don't enable Brainpool on AWS-LC or BoringSSL. ... These fail at runtime, so disable until we figure out why.	2026-08-03 22:15:07 +10:00
Darren Tucker	b5ad8c3b1f	Correct filename in comment.	2026-08-03 22:06:26 +10:00
Darren Tucker	7d6170c00e	Fix OpenSSL ECC detection message.	2026-08-03 21:18:48 +10:00
Darren Tucker	e766b76b61	Make EC_KEY_METHOD_new optional again. ... The change making ECC required also incorrectly made EC_KEY_METHOD_new required, causing builds with BoringSSL to fail.	2026-08-03 18:19:58 +10:00
[email protected]	e47a744c8b	upstream: crank up MaxAuthTries to avoid failures here ... OpenBSD-Regress-ID: 052b0c4cc8bd6ea2679fbc9f96f4cb7f48c73035	2026-08-03 16:54:20 +10:00
[email protected]	129f5ac61f	upstream: regression test for pubkey ordering in the client; ok ... dtucker OpenBSD-Regress-ID: e55fa977be300307e6e03a001716b3dce8faa1a1	2026-08-03 16:54:19 +10:00
[email protected]	6fe6ab77da	upstream: Tweak ordering of certificates tried during pubkey ... authentication to prefer FIDO keys that do not require user presence (touch) first, followed by ones that do and with FIDO keys that require user verification via PIN or biometrics last. This effectively tries low-friction authenticators before higher friction authenticators. ok dtucker@ OpenBSD-Commit-ID: 067076c652dbb4f2aa89c6e82b19d8cbfec1d1be	2026-08-03 16:53:54 +10:00
[email protected]	29f1b46e0f	upstream: Add a "ssh -Z user@host" mode that dumps the pubkeys that ... will be tried for authentication in the order that they will be used. feedback tb@ ok dtucker@ OpenBSD-Commit-ID: 617a7f149d1410980eac551e4780280190a5f218	2026-08-03 16:53:54 +10:00
[email protected]	2aee73ed90	upstream: fix ML-KEM/ECDH interop problem (does not affect ... mlkem768x25519-sha256) from markus@ OpenBSD-Commit-ID: 9c72e9c0407906bb7d5fb16648b38282676391e9	2026-08-03 16:44:04 +10:00
Darren Tucker	ec04856328	Require NISTP521 in libcrypto. ... Previously we supported building without NISTP521 in libcrypto since some vendors shipped without it, but this now seems uncommon. This removes that support, requiring a fully functional libcrypto. This removes another set of diffs vs upstream and should reduce the maintenance burden. ok djm@	2026-08-01 12:29:37 +10:00
Darren Tucker	e416edf1b2	Remove support for libcrypto w/out ECC. ... Since 2010, we have supported building against an OpenSSL that did not have any ECC support, since at the time many systems still shipped with OpenSSL versions prior to ECC being added. We no longer support OpenSSL versions that old, and while it's possible to build a modern libcrypto without ECC, doing so seems very uncommon. Having OPENSSL_HAS_ECC sprinkled throughout the code increases the cost of syncing changes and is a maintenance burden, so this has now outlived its usefulness and is being removed. It is still possible to build --without-openssl on such systems if required. This includes a few whitespace and header order changes to bring Portable back into sync with OpenBSD in those places, and removes the corresponding test. ok djm@	2026-07-31 21:41:10 +10:00
Darren Tucker	15d1832b5e	Add includes.h for compat interfaces.	2026-07-30 22:15:46 +10:00
[email protected]	d8140f0706	upstream: Use ssh_mldsa44_ed25519_cleanup consistently to avoid ... calling freezero with the wrong size. With help from tb@ ok tb, dtucker@ OpenBSD-Commit-ID: 4de18532e448a62005e12c179786bec512b83fde	2026-07-30 18:02:30 +10:00
[email protected]	18f5f351ed	upstream: Fix $OpenBSD marker for easier syncing. ... OpenBSD-Commit-ID: 1f38203c268007964b0abdfa4e024d572c65a898	2026-07-30 18:02:29 +10:00
[email protected]	128a4a5bf9	upstream: ssh: update kex unit test ... OpenBSD-Regress-ID: db6f1a538803716ce225e2128046de0b6ab6d2aa	2026-07-30 17:41:27 +10:00
[email protected]	52794802d9	upstream: Make mlkem768ecdh build with OPENSSL=no. ok djm@ ... OpenBSD-Commit-ID: b23fc98b885d72b57d9a2b989f6c062751bff52b	2026-07-30 17:39:53 +10:00
[email protected]	4b5860ed27	upstream: pass back errors from ed25519 key generation, which ... theoretically can fail. From Dimitri John Ledkov via GHPR702. ok deraadt@ dtucker@ OpenBSD-Commit-ID: 1ecdd981c3f89393092949ff5e96662946fc5040	2026-07-30 13:49:44 +10:00
[email protected]	52154c2d23	upstream: Move check of public key type against allowed algorithms ... to before parsing of the key sent by the peer. This removes at least some key parsing and verification paths from the pre-auth attack surface. Suggested by Christopher Paul Rohlf of Anthropic, ok deraadt@ OpenBSD-Commit-ID: 4560b53b5cd2fe9b875436e48995a1829c2a9dea	2026-07-30 13:49:43 +10:00
[email protected]	05000bc5ea	upstream: Fix double frees (impossible to reach outside of a test ... harness), and also use freezero where possible from Christopher Paul Rohlf at Anthropic ok djm OpenBSD-Commit-ID: 50227bff4ffd4a93aad399f21fc20f1c3cbf2c69	2026-07-30 13:49:43 +10:00
[email protected]	ddbcd8ffda	upstream: ssh: implement mlkem768brainpoolp256r1-sha256; ok djm@ ... OpenBSD-Commit-ID: 99a304085f96d9a595b326c06694290c5612620c	2026-07-30 13:49:43 +10:00
[email protected]	786cb6a14c	upstream: ssh: implement mlkem768nistp256-sha256; ok djm@ ... OpenBSD-Commit-ID: f5daafce2fcb44684606197873dab4cd189524a9	2026-07-30 13:48:52 +10:00