continually at runtime based on what sessions/channels are open.
Previously, ssh(1) and sshd(8) would pick a QoS value when they
were started and use it for the whole connection. This could
produce suboptimal choices for the QoS value, e.g. for multiplexed
sessions that started interactive but picked up a sftp client,
or sessions that moved large amounts of data via port forwarding.
Now the QoS value will change to the non-interactive IPQoS whenever
a "non-interactive" channel is open; basically any channel that lacks
a tty other than agent forwarding.
This is important now that the default interactive IPQoS is EF
(Expedited Forwarding), as many networks are configured to allow
only relatively small amounts of traffic of this class and they will
aggressively deprioritise the entire connection if this is exceeded.
NB. because ssh(1) and sshd(8) now change IP_TOS/IPV6_TCLASS
continually via setsockopt(), this commit requires a recent pledge(2)
change that landed recently in the OpenBSD kernel. Please ensure
you have updated to a kernel from within the last two weeks before
updating OpenSSH.
with job@ deraadt@
OpenBSD-Commit-ID: 325fc41717eecdf5e4b534bfa8d66817425b840f
file doesn't work in this program as logging already goes via the parent
sshd-session process. ok dtucker@
OpenBSD-Commit-ID: 73325b9e69364117c18305f896c620a3abcf4f87
Allow getsockname(2), getpeername(2) and getsockopt(2).
Also allow setsockopt(2) but only IP_TOS and IPV6_TCLASS.
Note that systems that use the older socketcall(2) mux syscall will
not have IP_TOS and IPV6_TCLASS allowlisted. On these platforms,
these calls will be soft-blocked (i.e. will fail rather than
terminate the whole process with a sandbox violation).
Needed for upcoming IPQoS change; ok dtucker@
Previously we only allowed __NR_futex, but some 32-bit systems
apparently support __NR_futex_time64. We had support for this
in the sandbox, but because of a macro error only __NR_futex was
allowlisted.
ok dtucker@
which is only used in user-visible contexts. freebsd 288773 shows their
localtime_r() has failed at least once for unknown reason. discussed with djm
OpenBSD-Commit-ID: 68f4c92d46b2578d4594b0ed940958d597fd61ac
non-post quantum safe key agreement algorithm.
Controlled via a new WarnWeakCrypto ssh_config option, defaulting
to on. This option might grow additional weak crypto warnings in
the future.
More details at https://openssh.com/pq.html
mostly by deraadt@ feedback dtucker@ ok deraadt@
OpenBSD-Commit-ID: 974ff243a1eccceac6a1a9d8fab3bcc89d74a2a4
struct ssh or struct packet_state; one static int escaped this rule, so move
it to struct packet_state now.
ok millert tb
OpenBSD-Commit-ID: bd6737168bf61a836ffbdc99ee4803468db90a53
enough information to identify the certificate in addition to the reason why
it was being denied. Makes debugging certificate authz problems a bit easier.
ok dlg@
OpenBSD-Commit-ID: 4c4621b2e70412754b3fe7540af8f4bf02b722b1
non-interactive traffic
It seems the CS1 traffic class mark is considered ambiguous and therefore
somewhat unhelpful (see RFC 8622 for more considerations). But, the new
'LE' scavenger class (also proposed in RFC 8622) offers high probability
of excessive delays & high packet loss, which would be inappropriate
for use with, for example, X11 forwardings. In fact, it is not known to
SSH what's appropriate because SSH is not aware of the content of what
passing through session forwardings. Therefore, no marking is appropriate.
Non-interactive traffic simply is best effort.
OK djm@ deraadt@
OpenBSD-Commit-ID: db1da1a432ecd53fc28feb84287aedb6bec80b01
and I-Ds that are more complete and detailed than what we have in the
PROTOCOL.* files. Refer to these when possible instead of documenting them
here.
OpenBSD-Commit-ID: 4fa5b0fcf5d5f24093d33d9e82c7ca4850d50d70
keywords
Type of Service (ToS) was deprecated in the late nineties and replaced
with the Differentiated Services architecture. Diffserv has significant
advantages for operators because this mechanism offers more granularity.
OpenSSH switched its default IPQoS from ToS to DSCP values in 2018.
IPQoS configurations with 'lowdelay', 'reliability', or 'throughput' will be
ignored and instead the system default QoS settings apply. Additionally, a
debug message is logged about the deprecation with a suggestion to use DSCP.
with/OK deraadt@ sthen@ djm@
OpenBSD-Commit-ID: 40c8c0c5cb20151a348728703536af2ec1c754ba
Forwarding (EF)
Marking interactive session data with DSCP value EF (RFC3246, RFC3247)
helps inform the network on relative priority compared to other traffic.
This is especially useful for differentiated treatment over wireless media.
Following the reconciled IETF Diffserv to IEEE 802.11 mappings (RFC 8325),
traffic marked with DSCP value EF maps to User Priority 6 in QoS Control,
in turn mapping to the high priority WMM AC_VO access category.
OK djm@
OpenBSD-Commit-ID: aadda7b9da794d70d7c6b381a861a0610afce1b3
The PKCS#11 code in OpenSSH used the libcrypto public key method API
(e.g. the delightfully named RSA_meth_free()) to delegate signing
operations to external keys. This had one advantage - that it was
basically transparent to callers, but also had a big disadvantage -
that we'd manually have to track the method implementations, their
state and their relationships to the underlying PKCS#11 objects.
This rips this out and replaces it with explicit delegation to
PKCS#11 code for externally hosted keys via the ssh-pkcs11-helper
subprocess. This is very similar to how we handle FIDO keys in
OpenSSH (i.e. via ssh-sk-helper). All we need to track now is a
much simpler mapping of public key -> helper subprocess.
Kicking our libcrypto meth dependency also makes it much easier
to support Ed25519 keys in PKCS#11, which will happen in a subsequent
commit.
feedback / ok tb@
OpenBSD-Commit-ID: a5a1eaf57971cf15e0cdc5a513e313541c8a35f0
encountered while processing an active section in a configuration file,
terminates ssh(1) with an error message that contains the argument to the
option.
This may be useful for expressing reminders or warnings in config
files, for example:
Match host foo
RefuseConnection "foo is deprecated, use splork instead"
ok djg
OpenBSD-Commit-ID: 5b0072fcd08ad3932ab21e27bbaa66b008d44237
GTK 3 has been in maintenance mode for a while now, and it is on the road
to being abandoned. As a result, the dialogue looks out of place on modern
systems.
We could port it to GTK 4 but without the program being registered as an
application (i.e. having a .desktop file), GNOME Shell would ask for
permission to grab input every time.
Let’s instead use the GNOME Shell’s native prompt through the unstable
Gcr API.
Apparently getgrouplist() can fail on OSX for when passed a non-existent
group name. Other platforms seem to return a group list consisting of
the numeric gid passed to the function.
This makes ga_init() handle this failure case gracefully, where it will
return success but with an empty group list array.
bz3848; ok dtucker@
Damien Miller