gbucchino/openssh-portable
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
096faecdea1e39ecace0b20f4e208bd7ec33f6d2
openssh-portable/ChangeLog
T
Darren Tucker 096faecdea - (dtucker) [configure.ac includes.h openbsd-compat/glob.{c,h}] Explicitly 
test for GLOB_NOMATCH and use our glob functions if it's not found.
   Stops sftp from segfaulting when attempting to get a nonexistent file on
   Cygwin (previous versions of OpenSSH didn't use the native glob). Partly
   from and tested by Corinna Vinschen.
2006-09-01 20:29:10 +10:00

5379 lines
233 KiB
Plaintext
Raw Blame History

20060901
- (djm) [audit-bsm.c audit.c auth-bsdauth.c auth-chall.c auth-pam.c]
[auth-rsa.c auth-shadow.c auth-sia.c auth1.c auth2-chall.c]
[auth2-gss.c auth2-kbdint.c auth2-none.c authfd.c authfile.c]
[cipher-3des1.c cipher-aes.c cipher-bf1.c cipher-ctr.c clientloop.c]
[dh.c dns.c entropy.c gss-serv-krb5.c gss-serv.c hostfile.c kex.c]
[kexdhc.c kexdhs.c kexgexc.c kexgexs.c key.c loginrec.c mac.c]
[md5crypt.c monitor.c monitor_wrap.c readconf.c rsa.c]
[scard-opensc.c scard.c session.c ssh-add.c ssh-agent.c ssh-dss.c]
[ssh-keygen.c ssh-keysign.c ssh-rsa.c ssh.c sshconnect.c]
[sshconnect1.c sshconnect2.c sshd.c]
[openbsd-compat/bsd-cray.c openbsd-compat/port-aix.c]
[openbsd-compat/port-linux.c openbsd-compat/port-solaris.c]
[openbsd-compat/port-uw.c]
Lots of headers for SCO OSR6, mainly adding stdarg.h for log.h;
compile problems reported by rac AT tenzing.org
- (djm) [includes.h monitor.c openbsd-compat/bindresvport.c]
[openbsd-compat/rresvport.c] Some more headers: netinet/in.h
sys/socket.h and unistd.h in various places
- (dtucker) [openbsd-compat/bsd-cygwin_util.c] Fix implict declaration
warnings for binary_open and binary_close. Patch from Corinna Vinschen.
- (dtucker) [configure.ac includes.h openbsd-compat/glob.{c,h}] Explicitly
test for GLOB_NOMATCH and use our glob functions if it's not found.
Stops sftp from segfaulting when attempting to get a nonexistent file on
Cygwin (previous versions of OpenSSH didn't use the native glob). Partly
from and tested by Corinna Vinschen.
20060831
- (djm) [CREDITS LICENCE Makefile.in auth.c configure.ac includes.h ]
[platform.c platform.h sshd.c openbsd-compat/Makefile.in]
[openbsd-compat/openbsd-compat.h openbsd-compat/port-solaris.c]
[openbsd-compat/port-solaris.h] Add support for Solaris process
contracts, enabled with --use-solaris-contracts. Patch from Chad
Mynhier, tweaked by dtucker@ and myself; ok dtucker@
- (dtucker) [contrib/cygwin/ssh-host-config] Add SeTcbPrivilege privilege
while setting up the ssh service account. Patch from Corinna Vinschen.
20060830
- (djm) OpenBSD CVS Sync
- [email protected] 2006/08/21 08:14:01
[sshd_config.5]
Document HostbasedUsesNameFromPacketOnly. Corrections from jmc@,
ok jmc@ djm@
- [email protected] 2006/08/21 08:15:57
[sshd.8]
Add more detail about what permissions are and aren't accepted for
authorized_keys files. Corrections jmc@, ok djm@, "looks good" jmc@
- [email protected] 2006/08/29 10:40:19
[channels.c session.c]
normalise some inconsistent (but harmless) NULL pointer checks
spotted by the Stanford SATURN tool, via Isil Dillig;
ok markus@ deraadt@
- [email protected] 2006/08/29 12:02:30
[gss-genr.c]
Work around a problem in Heimdal that occurs when KRB5CCNAME file is
missing, by checking whether or not kerberos allocated us a context
before attempting to free it. Patch from Simon Wilkinson, tested by
biorn@, ok djm@
- [email protected] 2006/08/30 00:06:51
[sshconnect2.c]
Fix regression where SSH2 banner is printed at loglevels ERROR and FATAL
where previously it weren't. bz #1221, found by Dean Kopesky, ok djm@
- [email protected] 2006/08/30 00:14:37
[version.h]
crank to 4.4
- (djm) [openbsd-compat/xcrypt.c] needs unistd.h
- (dtucker) [auth.c openbsd-compat/port-aix.c] Bug #1207: always call
loginsuccess on AIX immediately after authentication to clear the failed
login count. Previously this would only happen when an interactive
session starts (ie when a pty is allocated) but this means that accounts
that have primarily non-interactive sessions (eg scp's) may gradually
accumulate enough failures to lock out an account. This change may have
a side effect of creating two audit records, one with a tty of "ssh"
corresponding to the authentication and one with the allocated pty per
interactive session.
20060824
- (dtucker) [openbsd-compat/basename.c] Include errno.h.
- (dtucker) [openbsd-compat/bsd-misc.c] Add includes needed for select(2) on
older systems.
- (dtucker) [openbsd-compat/bsd-misc.c] Include <sys/select.h> for select(2)
on POSIX systems.
- (dtucker) [openbsd-compat/bsd-openpty.c] Include for ioctl(2).
- (dtucker) [openbsd-compat/rresvport.c] Include <stdlib.h> for malloc.
- (dtucker) [openbsd-compat/xmmap.c] Move #define HAVE_MMAP to prevent
unused variable warning when we have a broken or missing mmap(2).
20060822
- (dtucker) [Makefile.in] Bug #1177: fix incorrect path for sshrc in
Makefile. Patch from santhi.amirta at gmail, ok djm.
20060820
- (dtucker) [log.c] Move ifdef to prevent unused variable warning.
- (dtucker) [configure.ac] Save $LIBS during PAM library tests and restore
afterward. Removes the need to mangle $LIBS later to remove -lpam and -ldl.
- (dtucker) [configure.ac] Relocate --with-pam parts in preparation for
fixing bug #1181. No changes yet.
- (dtucker) [configure.ac] Bug #1181: Explicitly test to see if OpenSSL
(0.9.8a and presumably newer) requires -ldl to successfully link.
- (dtucker) [configure.ac] Remove errant "-".
20060819
- (djm) OpenBSD CVS Sync
- [email protected] 2006/08/18 22:41:29
[gss-genr.c]
GSSAPI error code should be 0 and not -1; from [email protected]
- (dtucker) [openbsd-compat/regress/Makefile.in] Add $(EXEEXT) and add a
single rule for the test progs.
20060818
- (dtucker) [configure.ac openbsd-compat/bsd-closefrom.c] Resync with
closefrom.c from sudo.
- (dtucker) [openbsd-compat/bsd-closefrom.c] Comment out rcsid.
- (dtucker) [openbsd-compat/regress/snprintftest.c] Newline on error.
- (dtucker) [openbsd-compat/regress/Makefile.in] Use implicit rules for the
test progs instead; they work better than what we have.
- (djm) OpenBSD CVS Sync
- [email protected] 2006/08/06 01:13:32
[compress.c monitor.c monitor_wrap.c]
"zlib.h" can be <zlib.h>; ok djm@ markus@
- [email protected] 2006/08/12 20:46:46
[monitor.c monitor_wrap.c]
Revert previous include file ordering change, for ssh to compile under
gcc2 (or until openssl include files are cleaned of parameter names
in function prototypes)
- [email protected] 2006/08/14 12:40:25
[servconf.c servconf.h sshd_config.5]
Add ability to match groups to Match keyword in sshd_config. Feedback
djm@, stevesk@, ok stevesk@.
- [email protected] 2006/08/16 11:47:15
[sshd.c]
factor inetd connection, TCP listen and main TCP accept loop out of
main() into separate functions to improve readability; ok markus@
- [email protected] 2006/08/18 09:13:26
[log.c log.h sshd.c]
make signal handler termination path shorter; risky code pointed out by
mark dowd; ok djm markus
- [email protected] 2006/08/18 09:15:20
[auth.h session.c sshd.c]
delay authentication related cleanups until we're authenticated and
all alarms have been cancelled; ok deraadt
- [email protected] 2006/08/18 10:27:16
[misc.h]
reorder so prototypes are sorted by the files they refer to; no
binary change
- [email protected] 2006/08/18 13:54:54
[gss-genr.c ssh-gss.h sshconnect2.c]
bz #1218 - disable SPNEGO as per RFC4462; diff from simon AT sxw.org.uk
ok markus@
- [email protected] 2006/08/18 14:40:34
[gss-genr.c ssh-gss.h]
constify host argument to match the rest of the GSSAPI functions and
unbreak compilation with -Werror
- (djm) Disable sigdie() for platforms that cannot safely syslog inside
a signal handler (basically all of them, excepting OpenBSD);
ok dtucker@
20060817
- (dtucker) [openbsd-compat/fake-rfc2553.c openbsd-compat/setproctitle.c]
Include stdlib.h for malloc and friends.
- (dtucker) [configure.ac openbsd-compat/bsd-closefrom.c] Use F_CLOSEM fcntl
for closefrom() on AIX. Pointed out by William Ahern.
- (dtucker) [openbsd-compat/regress/{Makefile.in,closefromtest.c}] Regress
test for closefrom() in compat code.
20060816
- (djm) [audit-bsm.c] Sprinkle in some headers
20060815
- (dtucker) [LICENCE] Add Reyk to the list for the compat dir.
20060806
- (djm) [openbsd-compat/bsd-getpeereid.c] Add some headers to quiet warnings
on Solaris 10
20060806
- (dtucker) [defines.h] With the includes.h changes we no longer get the
name clash on "YES" so we can remove the workaround for it.
- (dtucker) [openbsd-compat/{bsd-asprintf.c,bsd-openpty.c,bsd-snprintf.c,
glob.c}] Include stdlib.h for malloc and friends in compat code.
20060805
- (djm) OpenBSD CVS Sync
- [email protected] 2006/07/24 13:58:22
[sshconnect.c]
disable tunnel forwarding when no strict host key checking
and key changed; ok djm@ markus@ dtucker@
- [email protected] 2006/07/25 02:01:34
[scard.c]
need #include <string.h>
- [email protected] 2006/07/25 02:59:21
[channels.c clientloop.c packet.c scp.c serverloop.c sftp-client.c]
[sftp-server.c ssh-agent.c ssh-keyscan.c sshconnect.c sshd.c]
move #include <sys/time.h> out of includes.h
- [email protected] 2006/07/26 02:35:17
[atomicio.c auth.c dh.c authfile.c buffer.c clientloop.c kex.c]
[groupaccess.c gss-genr.c kexgexs.c misc.c monitor.c monitor_mm.c]
[packet.c scp.c serverloop.c session.c sftp-client.c sftp-common.c]
[sftp-server.c sftp.c ssh-add.c ssh-agent.c ssh-keygen.c sshlogin.c]
[uidswap.c xmalloc.c]
move #include <sys/param.h> out of includes.h
- [email protected] 2006/07/26 13:57:17
[authfd.c authfile.c dh.c canohost.c channels.c clientloop.c compat.c]
[hostfile.c kex.c log.c misc.c moduli.c monitor.c packet.c readpass.c]
[scp.c servconf.c session.c sftp-server.c sftp.c ssh-add.c ssh-agent.c]
[ssh-keygen.c ssh-keyscan.c ssh-keysign.c ssh.c sshconnect.c]
[sshconnect1.c sshd.c xmalloc.c]
move #include <stdlib.h> out of includes.h
- [email protected] 2006/07/27 08:00:50
[ssh_config.5]
avoid confusing wording in HashKnownHosts:
originally spotted by alan amesbury;
ok deraadt
- [email protected] 2006/07/27 08:00:50
[ssh_config.5]
avoid confusing wording in HashKnownHosts:
originally spotted by alan amesbury;
ok deraadt
- [email protected] 2006/08/01 11:34:36
[sshconnect.c]
Allow fallback to known_hosts entries without port qualifiers for
non-standard ports too, so that all existing known_hosts entries will be
recognised. Requested by, feedback and ok markus@
- [email protected] 2006/08/01 23:22:48
[auth-passwd.c auth-rhosts.c auth-rsa.c auth.c auth.h auth1.c]
[auth2-chall.c auth2-pubkey.c authfile.c buffer.c canohost.c]
[channels.c clientloop.c dh.c dns.c dns.h hostfile.c kex.c kexdhc.c]
[kexgexc.c kexgexs.c key.c key.h log.c misc.c misc.h moduli.c]
[monitor_wrap.c packet.c progressmeter.c readconf.c readpass.c scp.c]
[servconf.c session.c sftp-client.c sftp-common.c sftp-server.c sftp.c]
[ssh-add.c ssh-agent.c ssh-keygen.c ssh-keyscan.c ssh.c sshconnect.c]
[sshconnect1.c sshconnect2.c sshd.c sshlogin.c sshtty.c uuencode.c]
[uuencode.h xmalloc.c]
move #include <stdio.h> out of includes.h
- [email protected] 2006/08/01 23:36:12
[authfile.c channels.c progressmeter.c scard.c servconf.c ssh.c]
clean extra spaces
- [email protected] 2006/08/03 03:34:42
[OVERVIEW atomicio.c atomicio.h auth-bsdauth.c auth-chall.c auth-krb5.c]
[auth-options.c auth-options.h auth-passwd.c auth-rh-rsa.c auth-rhosts.c]
[auth-rsa.c auth-skey.c auth.c auth.h auth1.c auth2-chall.c auth2-gss.c]
[auth2-hostbased.c auth2-kbdint.c auth2-none.c auth2-passwd.c ]
[auth2-pubkey.c auth2.c authfd.c authfd.h authfile.c bufaux.c bufbn.c]
[buffer.c buffer.h canohost.c channels.c channels.h cipher-3des1.c]
[cipher-bf1.c cipher-ctr.c cipher.c cleanup.c clientloop.c compat.c]
[compress.c deattack.c dh.c dispatch.c dns.c dns.h fatal.c groupaccess.c]
[groupaccess.h gss-genr.c gss-serv-krb5.c gss-serv.c hostfile.c kex.c]
[kex.h kexdh.c kexdhc.c kexdhs.c kexgex.c kexgexc.c kexgexs.c key.c]
[key.h log.c log.h mac.c match.c md-sha256.c misc.c misc.h moduli.c]
[monitor.c monitor_fdpass.c monitor_mm.c monitor_mm.h monitor_wrap.c]
[monitor_wrap.h msg.c nchan.c packet.c progressmeter.c readconf.c]
[readconf.h readpass.c rsa.c scard.c scard.h scp.c servconf.c servconf.h]
[serverloop.c session.c session.h sftp-client.c sftp-common.c]
[sftp-common.h sftp-glob.c sftp-server.c sftp.c ssh-add.c ssh-agent.c]
[ssh-dss.c ssh-gss.h ssh-keygen.c ssh-keyscan.c ssh-keysign.c ssh-rsa.c]
[ssh.c ssh.h sshconnect.c sshconnect.h sshconnect1.c sshconnect2.c]
[sshd.c sshlogin.c sshlogin.h sshpty.c sshpty.h sshtty.c ttymodes.c]
[uidswap.c uidswap.h uuencode.c uuencode.h xmalloc.c xmalloc.h]
[loginrec.c loginrec.h openbsd-compat/port-aix.c openbsd-compat/port-tun.h]
almost entirely get rid of the culture of ".h files that include .h files"
ok djm, sort of ok stevesk
makes the pain stop in one easy step
NB. portable commit contains everything *except* removing includes.h, as
that will take a fair bit more work as we move headers that are required
for portability workarounds to defines.h. (also, this step wasn't "easy")
- [email protected] 2006/08/04 20:46:05
[monitor.c session.c ssh-agent.c]
spaces
- (djm) [auth-pam.c defines.h] Move PAM related bits to auth-pam.c
- (djm) [auth-pam.c auth.c bufaux.h entropy.c openbsd-compat/port-tun.c]
remove last traces of bufaux.h - it was merged into buffer.h in the big
includes.h commit
- (djm) [auth.c loginrec.c] Missing netinet/in.h for loginrec
- (djm) [openbsd-compat/regress/snprintftest.c]
[openbsd-compat/regress/strduptest.c] Add missing includes so they pass
compilation with "-Wall -Werror"
- (djm) [auth-pam.c auth-shadow.c auth2-none.c cleanup.c sshd.c]
[openbsd-compat/port-tun.c openbsd-compat/port-tun.h] Sprinkle more
includes for Linux in
- (dtucker) [cleanup.c] Need defines.h for __dead.
- (dtucker) [auth2-gss.c] We still need the #ifdef GSSAPI in -portable.
- (dtucker) [openbsd-compat/{bsd-arc4random.c,port-tun.c,xmmap.c}] Lots of
#include stdarg.h, needed for log.h.
- (dtucker) [entropy.c] Needs unistd.h too.
- (dtucker) [ssh-rand-helper.c] Needs stdarg.h for log.h.
- (dtucker) [openbsd-compat/getrrsetbyname.c] Nees stdlib.h for malloc.
- (dtucker) [openbsd-compat/strtonum.c] Include stdlib.h for strtoll,
otherwise it is implicitly declared as returning an int.
- (dtucker) OpenBSD CVS Sync
- [email protected] 2006/08/05 07:52:52
[auth2-none.c sshd.c monitor_wrap.c]
Add headers required to build with KERBEROS5=no. ok djm@
- [email protected] 2006/08/05 08:00:33
[auth-skey.c]
Add headers required to build with -DSKEY. ok djm@
- [email protected] 2006/08/05 08:28:24
[monitor_wrap.c auth-skey.c auth2-chall.c]
Zap unused variables in -DSKEY code. ok djm@
- [email protected] 2006/08/05 08:34:04
[packet.c]
Typo in comment
- (dtucker) [openbsd-compat/bsd-cygwin_util.c] Add headers required to compile
on Cygwin.
- (dtucker) [openbsd-compat/fake-rfc2553.c] Add headers needed for inet_ntoa.
- (dtucker) [auth-skey.c] monitor_wrap.h needs ssh-gss.h.
- (dtucker) [audit.c audit.h] Repair headers.
- (dtucker) [audit-bsm.c] Add additional headers now required.
20060804
- (dtucker) [configure.ac] The "crippled AES" test does not work on recent
versions of Solaris, so use AC_LINK_IFELSE to actually link the test program
rather than just compiling it. Spotted by dlg@.
20060802
- (dtucker) [openbsd-compat/daemon.c] Add unistd.h for fork() prototype.
20060725
- (dtucker) [openbsd-compat/xmmap.c] Need fcntl.h for O_RDRW.
20060724
- (djm) OpenBSD CVS Sync
- [email protected] 2006/07/12 13:39:55
[sshd_config.5]
- new sentence, new line
- s/The the/The/
- kill a bad comma
- [email protected] 2006/07/12 22:28:52
[auth-options.c canohost.c channels.c includes.h readconf.c]
[servconf.c ssh-keyscan.c ssh.c sshconnect.c sshd.c]
move #include <netdb.h> out of includes.h; ok djm@
- [email protected] 2006/07/12 22:42:32
[includes.h ssh.c ssh-rand-helper.c]
move #include <stddef.h> out of includes.h
- [email protected] 2006/07/14 01:15:28
[monitor_wrap.h]
don't need incompletely-typed 'struct passwd' now with
#include <pwd.h>; ok markus@
- [email protected] 2006/07/17 01:31:10
[authfd.c authfile.c channels.c cleanup.c clientloop.c groupaccess.c]
[includes.h log.c misc.c msg.c packet.c progressmeter.c readconf.c]
[readpass.c scp.c servconf.c sftp-client.c sftp-server.c sftp.c]
[ssh-add.c ssh-agent.c ssh-keygen.c ssh-keyscan.c ssh-keysign.c ssh.c]
[sshconnect.c sshlogin.c sshpty.c uidswap.c]
move #include <unistd.h> out of includes.h
- [email protected] 2006/07/17 12:02:24
[auth-options.c]
Use '\0' rather than 0 to terminates strings; ok djm@
- [email protected] 2006/07/17 12:06:00
[channels.c channels.h servconf.c sshd_config.5]
Add PermitOpen directive to sshd_config which is equivalent to the
"permitopen" key option. Allows server admin to allow TCP port
forwarding only two specific host/port pairs. Useful when combined
with Match.
If permitopen is used in both sshd_config and a key option, both
must allow a given connection before it will be permitted.
Note that users can still use external forwarders such as netcat,
so to be those must be controlled too for the limits to be effective.
Feedback & ok djm@, man page corrections & ok jmc@.
- [email protected] 2006/07/18 07:50:40
[sshd_config.5]
tweak; ok dtucker
- [email protected] 2006/07/18 07:56:28
[scp.1]
replace DIAGNOSTICS with .Ex;
- [email protected] 2006/07/18 08:03:09
[ssh-agent.1 sshd_config.5]
mark up angle brackets;
- [email protected] 2006/07/18 08:22:23
[sshd_config.5]
Clarify description of Match, with minor correction from jmc@
- [email protected] 2006/07/18 22:27:55
[dh.c]
remove unneeded includes; ok djm@
- [email protected] 2006/07/19 08:56:41
[servconf.c sshd_config.5]
Add support for X11Forwaring, X11DisplayOffset and X11UseLocalhost to
Match. ok djm@
- [email protected] 2006/07/19 13:07:10
[servconf.c servconf.h session.c sshd.8 sshd_config sshd_config.5]
Add ForceCommand keyword to sshd_config, equivalent to the "command="
key option, man page entry and example in sshd_config.
Feedback & ok djm@, man page corrections & ok jmc@
- [email protected] 2006/07/20 15:26:15
[auth1.c serverloop.c session.c sshconnect2.c]
missed some needed #include <unistd.h> when KERBEROS5=no; issue from
[email protected]
- [email protected] 2006/07/21 12:43:36
[channels.c channels.h servconf.c servconf.h sshd_config.5]
Make PermitOpen take a list of permitted ports and act more like most
other keywords (ie the first match is the effective setting). This
also makes it easier to override a previously set PermitOpen. ok djm@
- [email protected] 2006/07/21 21:13:30
[channels.c]
more ARGSUSED (lint) for dispatch table-driven functions; ok djm@
- [email protected] 2006/07/21 21:26:55
[progressmeter.c]
ARGSUSED for signal handler
- [email protected] 2006/07/22 19:08:54
[includes.h moduli.c progressmeter.c scp.c sftp-common.c]
[sftp-server.c ssh-agent.c sshlogin.c]
move #include <time.h> out of includes.h
- [email protected] 2006/07/22 20:48:23
[atomicio.c auth-options.c auth-passwd.c auth-rhosts.c auth-rsa.c]
[auth.c auth1.c auth2-chall.c auth2-hostbased.c auth2-passwd.c auth2.c]
[authfd.c authfile.c bufaux.c bufbn.c buffer.c canohost.c channels.c]
[cipher-3des1.c cipher-bf1.c cipher-ctr.c cipher.c clientloop.c]
[compat.c deattack.c dh.c dns.c gss-genr.c gss-serv.c hostfile.c]
[includes.h kex.c kexdhc.c kexdhs.c kexgexc.c kexgexs.c key.c log.c]
[mac.c match.c md-sha256.c misc.c moduli.c monitor.c monitor_fdpass.c]
[monitor_mm.c monitor_wrap.c msg.c nchan.c packet.c rsa.c]
[progressmeter.c readconf.c readpass.c scp.c servconf.c serverloop.c]
[session.c sftp-client.c sftp-common.c sftp-glob.c sftp-server.c sftp.c]
[ssh-add.c ssh-agent.c ssh-dss.c ssh-keygen.c ssh-keyscan.c]
[ssh-keysign.c ssh-rsa.c ssh.c sshconnect.c sshconnect1.c sshconnect2.c]
[sshd.c sshlogin.c sshpty.c ttymodes.c uidswap.c xmalloc.c]
move #include <string.h> out of includes.h
- [email protected] 2006/07/23 01:11:05
[auth.h dispatch.c kex.h sftp-client.c]
#include <signal.h> for sig_atomic_t; need this prior to <sys/param.h>
move
- (djm) [acss.c auth-krb5.c auth-options.c auth-pam.c auth-shadow.c]
[canohost.c channels.c cipher-acss.c defines.h dns.c gss-genr.c]
[gss-serv-krb5.c gss-serv.c log.h loginrec.c logintest.c readconf.c]
[servconf.c ssh-keygen.c ssh-keyscan.c ssh-keysign.c ssh-rand-helper.c]
[ssh.c sshconnect.c sshd.c openbsd-compat/bindresvport.c]
[openbsd-compat/bsd-arc4random.c openbsd-compat/bsd-misc.c]
[openbsd-compat/getrrsetbyname.c openbsd-compat/glob.c]
[openbsd-compat/mktemp.c openbsd-compat/port-linux.c]
[openbsd-compat/port-tun.c openbsd-compat/readpassphrase.c]
[openbsd-compat/setproctitle.c openbsd-compat/xmmap.c]
make the portable tree compile again - sprinkle unistd.h and string.h
back in. Don't redefine __unused, as it turned out to be used in
headers on Linux, and replace its use in auth-pam.c with ARGSUSED
- (djm) [openbsd-compat/glob.c]
Move get_arg_max() into the ifdef HAVE_GLOB block so that it compiles
on OpenBSD (or other platforms with a decent glob implementation) with
-Werror
- (djm) [uuencode.c]
Add resolv.h, is it contains the prototypes for __b64_ntop/__b64_pton on
some platforms
- (djm) [session.c]
fix compile error with -Werror -Wall: 'path' is only used in
do_setup_env() if HAVE_LOGIN_CAP is not defined
- (djm) [openbsd-compat/basename.c openbsd-compat/bsd-closefrom.c]
[openbsd-compat/bsd-cray.c openbsd-compat/bsd-openpty.c]
[openbsd-compat/bsd-snprintf.c openbsd-compat/fake-rfc2553.c]
[openbsd-compat/port-aix.c openbsd-compat/port-irix.c]
[openbsd-compat/rresvport.c]
These look to need string.h and/or unistd.h (based on a grep for function
names)
- (djm) [Makefile.in]
Remove generated openbsd-compat/regress/Makefile in distclean target
- (djm) [regress/Makefile regress/agent-getpeereid.sh regress/cfgmatch.sh]
[regress/cipher-speed.sh regress/forcecommand.sh regress/forwarding.sh]
Sync regress tests to -current; include dtucker@'s new cfgmatch and
forcecommand tests. Add cipher-speed.sh test (not linked in yet)
- (dtucker) [cleanup.c] Since config.h defines _LARGE_FILES on AIX, including
system headers before defines.h will cause conflicting definitions.
- (dtucker) [regress/forcecommand.sh] Portablize.
20060713
- (dtucker) [auth-krb5.c auth-pam.c] Still more errno.h
20060712
- (dtucker) [configure.ac defines.h] Only define SHUT_RD (and friends) and
O_NONBLOCK if they're really needed. Fixes build errors on HP-UX, old
Linuxes and probably more.
- (dtucker) [configure.ac] OpenBSD needs <sys/types.h> before <sys/socket.h>
for SHUT_RD.
- (dtucker) [openbsd-compat/port-tun.c] OpenBSD needs <netinet/in.h> before
<netinet/ip.h>.
- (dtucker) OpenBSD CVS Sync
- [email protected] 2006/07/10 16:01:57
[sftp-glob.c sftp-common.h sftp.c]
buffer.h only needed in sftp-common.h and remove some unneeded
user includes; ok djm@
- [email protected] 2006/07/10 16:04:21
[sshd.8]
s/and and/and/
- [email protected] 2006/07/10 16:37:36
[readpass.c log.h scp.c fatal.c xmalloc.c includes.h ssh-keyscan.c misc.c
auth.c packet.c log.c]
move #include <stdarg.h> out of includes.h; ok markus@
- [email protected] 2006/07/11 10:12:07
[ssh.c]
Only copy the part of environment variable that we actually use. Prevents
ssh bailing when SendEnv is used and an environment variable with a really
long value exists. ok djm@
- [email protected] 2006/07/11 18:50:48
[clientloop.c ssh.1 ssh.c channels.c ssh_config.5 readconf.h session.c
channels.h readconf.c]
add ExitOnForwardFailure: terminate the connection if ssh(1)
cannot set up all requested dynamic, local, and remote port
forwardings. ok djm, dtucker, stevesk, jmc
- [email protected] 2006/07/11 20:07:25
[scp.c auth.c monitor.c serverloop.c sftp-server.c sshpty.c readpass.c
sshd.c monitor_wrap.c monitor_fdpass.c ssh-agent.c ttymodes.c atomicio.c
includes.h session.c sshlogin.c monitor_mm.c packet.c sshconnect2.c
sftp-client.c nchan.c clientloop.c sftp.c misc.c canohost.c channels.c
ssh-keygen.c progressmeter.c uidswap.c msg.c readconf.c sshconnect.c]
move #include <errno.h> out of includes.h; ok markus@
- [email protected] 2006/07/11 20:16:43
[ssh.c]
cast asterisk field precision argument to int to remove warning;
ok markus@
- [email protected] 2006/07/11 20:27:56
[authfile.c ssh.c]
need <errno.h> here also (it's also included in <openssl/err.h>)
- [email protected] 2006/07/12 11:34:58
[sshd.c servconf.h servconf.c sshd_config.5 auth.c]
Add support for conditional directives to sshd_config via a "Match"
keyword, which works similarly to the "Host" directive in ssh_config.
Lines after a Match line override the default set in the main section
if the condition on the Match line is true, eg
AllowTcpForwarding yes
Match User anoncvs
AllowTcpForwarding no
will allow port forwarding by all users except "anoncvs".
Currently only a very small subset of directives are supported.
ok djm@
- (dtucker) [loginrec.c openbsd-compat/xmmap.c openbsd-compat/bindresvport.c
openbsd-compat/glob.c openbsd-compat/mktemp.c openbsd-compat/port-tun.c
openbsd-compat/readpassphrase.c openbsd-compat/strtonum.c] Include <errno.h>.
- (dtucker) [openbsd-compat/setproctitle.c] Include stdarg.h.
- (dtucker) [ssh-keyscan.c ssh-rand-helper.c] More errno.h here too.
- (dtucker) [openbsd-compat/openbsd-compat.h] v*printf needs stdarg.h.
- (dtucker) [openbsd-compat/bsd-asprintf.c openbsd-compat/port-aix.c
openbsd-compat/rresvport.c] More errno.h.
20060711
- (dtucker) [configure.ac ssh-keygen.c openbsd-compat/bsd-openpty.c
openbsd-compat/daemon.c] Add includes needed by open(2). Conditionally
include paths.h. Fixes build error on Solaris.
- (dtucker) [entropy.c] More fcntl.h, this time on AIX (and probably
others).
20060710
- (dtucker) [INSTALL] New autoconf version: 2.60.
- OpenBSD CVS Sync
- [email protected] 2006/06/14 10:50:42
[sshconnect.c]
limit the number of pre-banner characters we will accept; ok markus@
- [email protected] 2006/06/26 10:36:15
[clientloop.c]
mention optional bind_address in runtime port forwarding setup
command-line help. patch from santhi.amirta AT gmail.com
- [email protected] 2006/07/02 17:12:58
[ssh.1 ssh.c ssh_config.5 sshd_config.5]
more details and clarity for tun(4) device forwarding; ok and help
jmc@
- [email protected] 2006/07/02 18:36:47
[gss-serv-krb5.c gss-serv.c]
no "servconf.h" needed here
(gss-serv-krb5.c change not applied, portable needs the server options)
- [email protected] 2006/07/02 22:45:59
[groupaccess.c groupaccess.h includes.h session.c sftp-common.c sshpty.c]
move #include <grp.h> out of includes.h
(portable needed uidswap.c too)
- [email protected] 2006/07/02 23:01:55
[clientloop.c ssh.1]
use -KR[bind_address:]port here; ok djm@
- [email protected] 2006/07/03 08:54:20
[includes.h ssh.c sshconnect.c sshd.c]
move #include "version.h" out of includes.h; ok markus@
- [email protected] 2006/07/03 17:59:32
[channels.c includes.h]
move #include <arpa/inet.h> out of includes.h; old ok djm@
(portable needed session.c too)
- [email protected] 2006/07/05 02:42:09
[canohost.c hostfile.c includes.h misc.c packet.c readconf.c]
[serverloop.c sshconnect.c uuencode.c]
move #include <netinet/in.h> out of includes.h; ok deraadt@
(also ssh-rand-helper.c logintest.c loginrec.c)
- [email protected] 2006/07/06 10:47:05
[servconf.c servconf.h session.c sshd_config.5]
support arguments to Subsystem commands; ok markus@
- [email protected] 2006/07/06 10:47:57
[sftp-server.8 sftp-server.c]
add commandline options to enable logging of transactions; ok markus@
- [email protected] 2006/07/06 16:03:53
[auth-options.c auth-options.h auth-passwd.c auth-rh-rsa.c]
[auth-rhosts.c auth-rsa.c auth.c auth.h auth2-hostbased.c]
[auth2-pubkey.c auth2.c includes.h misc.c misc.h monitor.c]
[monitor_wrap.c monitor_wrap.h scp.c serverloop.c session.c]
[session.h sftp-common.c ssh-add.c ssh-keygen.c ssh-keysign.c]
[ssh.c sshconnect.c sshconnect.h sshd.c sshpty.c sshpty.h uidswap.c]
[uidswap.h]
move #include <pwd.h> out of includes.h; ok markus@
- [email protected] 2006/07/06 16:22:39
[ssh-keygen.c]
move #include "dns.h" up
- [email protected] 2006/07/06 17:36:37
[monitor_wrap.h]
typo in comment
- [email protected] 2006/07/08 21:47:12
[authfd.c canohost.c clientloop.c dns.c dns.h includes.h]
[monitor_fdpass.c nchan.c packet.c servconf.c sftp.c ssh-agent.c]
[ssh-keyscan.c ssh.c sshconnect.h sshd.c sshlogin.h]
move #include <sys/socket.h> out of includes.h
- [email protected] 2006/07/08 21:48:53
[monitor.c session.c]
missed these from last commit:
move #include <sys/socket.h> out of includes.h
- [email protected] 2006/07/08 23:30:06
[log.c]
move user includes after /usr/include files
- [email protected] 2006/07/09 15:15:11
[auth2-none.c authfd.c authfile.c includes.h misc.c monitor.c]
[readpass.c scp.c serverloop.c sftp-client.c sftp-server.c]
[ssh-add.c ssh-agent.c ssh-keygen.c ssh-keysign.c ssh.c sshd.c]
[sshlogin.c sshpty.c]
move #include <fcntl.h> out of includes.h
- [email protected] 2006/07/09 15:27:59
[ssh-add.c]
use O_RDONLY vs. 0 in open(); no binary change
- [email protected] 2006/07/10 11:24:54
[sftp-server.c]
remove optind - it isn't used here
- [email protected] 2006/07/10 11:25:53
[sftp-server.c]
don't log variables that aren't yet set
- (djm) [loginrec.c ssh-rand-helper.c sshd.c openbsd-compat/glob.c]
[openbsd-compat/mktemp.c openbsd-compat/openbsd-compat.h]
[openbsd-compat/port-tun.c openbsd-compat/readpassphrase.c]
[openbsd-compat/xcrypt.c] Fix includes.h fallout, mainly fcntl.h
- OpenBSD CVS Sync
- [email protected] 2006/07/10 12:03:20
[scp.c]
duplicate argv at the start of main() because it gets modified later;
pointed out by deraadt@ ok markus@
- [email protected] 2006/07/10 12:08:08
[channels.c]
fix misparsing of SOCKS 5 packets that could result in a crash;
reported by mk@ ok markus@
- [email protected] 2006/07/10 12:46:51
[misc.c misc.h sshd.8 sshconnect.c]
Add port identifier to known_hosts for non-default ports, based originally
on a patch from Devin Nate in bz#910.
For any connection using the default port or using a HostKeyAlias the
format is unchanged, otherwise the host name or address is enclosed
within square brackets in the same format as sshd's ListenAddress.
Tested by many, ok markus@.
- (dtucker) [openbsd-compat/openbsd-compat.h] Need to include <sys/socket.h>
for struct sockaddr on platforms that use the fake-rfc stuff.
20060706
- (dtucker) [configure.ac] Try AIX blibpath test in different order when
compiling with gcc. gcc 4.1.x will accept (but ignore) -b flags so
configure would not select the correct libpath linker flags.
- (dtucker) [INSTALL] A bit more info on autoconf.
20060705
- (dtucker) [ssh-rand-helper.c] Don't exit if mkdir fails because the
target already exists.
20060630
- (dtucker) [openbsd-compat/openbsd-compat.h] SNPRINTF_CONST for snprintf
declaration too. Patch from russ at sludge.net.
- (dtucker) [openbsd-compat/getrrsetbyname.c] Undef _res before defining it,
prevents warnings on platforms where _res is in the system headers.
- (dtucker) [INSTALL] Bug #1202: Note when autoconf is required and which
version.
20060627
- (dtucker) [configure.ac] Bug #1203: Add missing '[', which causes problems
with autoconf 2.60. Patch from vapier at gentoo.org.
20060625
- (dtucker) [channels.c serverloop.c] Apply the bug #1102 workaround to ptys
only, otherwise sshd can hang exiting non-interactive sessions.
20060624
- (dtucker) [configure.ac] Bug #1193: Define PASSWD_NEEDS_USERNAME on Solaris.
Works around limitation in Solaris' passwd program for changing passwords
where the username is longer than 8 characters. ok djm@
- (dtucker) [serverloop.c] Get ifdef/ifndef the right way around for the bug
#1102 workaround.
20060623
- (dtucker) [README.platform configure.ac openbsd-compat/port-tun.c] Add
tunnel support for Mac OS X/Darwin via a third-party tun driver. Patch
from reyk@, tested by anil@
- (dtucker) [channels.c configure.ac serverloop.c] Bug #1102: Around AIX
4.3.3 ML3 or so, the AIX pty layer starting passing zero-length writes
on the pty slave as zero-length reads on the pty master, which sshd
interprets as the descriptor closing. Since most things don't do zero
length writes this rarely matters, but occasionally it happens, and when
it does the SSH pty session appears to hang, so we add a special case for
this condition. ok djm@
20060613
- (djm) [getput.h] This file has been replaced by functions in misc.c
- OpenBSD CVS Sync
- [email protected] 2006/05/08 10:49:48
[sshconnect2.c]
uint32_t -> u_int32_t (which we use everywhere else)
(Id sync only - portable already had this)
- [email protected] 2006/05/16 09:00:00
[clientloop.c]
missing free; from Kylene Hall
- [email protected] 2006/05/17 12:43:34
[scp.c sftp.c ssh-agent.c ssh-keygen.c sshconnect.c]
fix leak; coverity via Kylene Jo Hall
- [email protected] 2006/05/18 21:27:25
[kexdhc.c kexgexc.c]
paramter -> parameter
- [email protected] 2006/05/29 12:54:08
[ssh_config.5]
Add gssapi-with-mic to PreferredAuthentications default list; ok jmc
- [email protected] 2006/05/29 12:56:33
[ssh_config]
Add GSSAPIAuthentication and GSSAPIDelegateCredentials to examples in
sample ssh_config. ok markus@
- [email protected] 2006/05/29 16:10:03
[ssh_config.5]
oops - previous was too long; split the list of auths up
- [email protected] 2006/05/30 11:46:38
[ssh-add.c]
Sync usage() with man page and reality.
ok deraadt dtucker
- [email protected] 2006/05/29 16:13:23
[ssh.1]
add GSSAPI to the list of authentication methods supported;
- [email protected] 2006/05/30 11:46:38
[ssh-add.c]
Sync usage() with man page and reality.
ok deraadt dtucker
- [email protected] 2006/06/01 09:21:48
[sshd.c]
call get_remote_ipaddr() early; fixes logging after client disconnects;
report mpf@; ok dtucker@
- [email protected] 2006/06/06 10:20:20
[readpass.c sshconnect.c sshconnect.h sshconnect2.c uidswap.c]
replace remaining setuid() calls with permanently_set_uid() and
check seteuid() return values; report Marcus Meissner; ok dtucker djm
- [email protected] 2006/06/08 14:45:49
[readpass.c sshconnect.c sshconnect2.c uidswap.c uidswap.h]
do not set the gid, noted by solar; ok djm
- [email protected] 2006/06/13 01:18:36
[ssh-agent.c]
always use a format string, even when printing a constant
- [email protected] 2006/06/13 02:17:07
[ssh-agent.c]
revert; i am on drugs. spotted by alexander AT beard.se
20060521
- (dtucker) [auth.c monitor.c] Now that we don't log from both the monitor
and slave, we can remove the special-case handling in the audit hook in
auth_log.
20060517
- (dtucker) [ssh-rand-helper.c] Check return code of mkdir and fix file
pointer leak. From kjhall at us.ibm.com, found by coverity.
20060515
- (dtucker) [openbsd-compat/getrrsetbyname.c] Use _compat_res instead of
_res, prevents problems on some platforms that have _res as a global but
don't have getrrsetbyname(), eg IRIX 5.3. Found and tested by
georg.schwarz at freenet.de, ok djm@.
- (dtucker) [defines.h] Find a value for IOV_MAX or use a conservative
default. Patch originally from tim@, ok djm
- (dtucker) [auth-pam.c] Bug #1188: pass result of do_pam_account back and
do not allow kbdint again after the PAM account check fails. ok djm@
20060506
- (dtucker) OpenBSD CVS Sync
- [email protected] 2006/04/25 08:02:27
[authfile.c authfile.h sshconnect2.c ssh.c sshconnect1.c]
Prevent ssh from trying to open private keys with bad permissions more than
once or prompting for their passphrases (which it subsequently ignores
anyway), similar to a previous change in ssh-add. bz #1186, ok djm@
- [email protected] 2006/05/04 14:55:23
[dh.c]
tighter DH exponent checks here too; feedback and ok markus@
- [email protected] 2006/04/01 05:37:46
[OVERVIEW]
$OpenBSD$ in here too
- [email protected] 2006/05/06 08:35:40
[auth-krb5.c]
Add $OpenBSD$ in comment here too
20060504
- (dtucker) [auth-pam.c groupaccess.c monitor.c monitor_wrap.c scard-opensc.c
session.c ssh-rand-helper.c sshd.c openbsd-compat/bsd-cygwin_util.c
openbsd-compat/setproctitle.c] Convert malloc(foo*bar) -> calloc(foo,bar)
in Portable-only code; since calloc zeros, remove now-redundant memsets.
Also add a couple of sanity checks. With & ok djm@
20060503
- (dtucker) [packet.c] Remove in_systm.h since it's also in includes.h
and double including it on IRIX 5.3 causes problems. From Georg Schwarz,
"no objections" tim@
20060423
- (djm) OpenBSD CVS Sync
- [email protected] 2006/04/01 05:42:20
[scp.c]
minimal lint cleanup (unused crud, and some size_t); ok djm
- [email protected] 2006/04/01 05:50:29
[scp.c]
xasprintification; ok deraadt@
- [email protected] 2006/04/01 05:51:34
[atomicio.c]
ANSIfy; requested deraadt@
- [email protected] 2006/04/02 08:34:52
[ssh-keysign.c]
sessionid can be 32 bytes now too when sha256 kex is used; ok djm@
- [email protected] 2006/04/03 07:10:38
[gss-genr.c]
GSSAPI buffers shouldn't be nul-terminated, spotted in bugzilla #1066
by dleonard AT vintela.com. use xasprintf() to simplify code while in
there; "looks right" deraadt@
- [email protected] 2006/04/16 00:48:52
[buffer.c buffer.h channels.c]
Fix condition where we could exit with a fatal error when an input
buffer became too large and the remote end had advertised a big window.
The problem was a mismatch in the backoff math between the channels code
and the buffer code, so make a buffer_check_alloc() function that the
channels code can use to propsectivly check whether an incremental
allocation will succeed. bz #1131, debugged with the assistance of
cove AT wildpackets.com; ok dtucker@ deraadt@
- [email protected] 2006/04/16 00:52:55
[atomicio.c atomicio.h]
introduce atomiciov() function that wraps readv/writev to retry
interrupted transfers like atomicio() does for read/write;
feedback deraadt@ dtucker@ stevesk@ ok deraadt@
- [email protected] 2006/04/16 00:54:10
[sftp-client.c]
avoid making a tiny 4-byte write to send the packet length of sftp
commands, which would result in a separate tiny packet on the wire by
using atomiciov(writev, ...) to write the length and the command in one
pass; ok deraadt@
- [email protected] 2006/04/16 07:59:00
[atomicio.c]
reorder sanity test so that it cannot dereference past the end of the
iov array; well spotted canacar@!
- [email protected] 2006/04/18 10:44:28
[bufaux.c bufbn.c Makefile.in]
Move Buffer bignum functions into their own file, bufbn.c. This means
that sftp and sftp-server (which use the Buffer functions in bufaux.c
but not the bignum ones) no longer need to be linked with libcrypto.
ok markus@
- [email protected] 2006/04/20 09:27:09
[auth.h clientloop.c dispatch.c dispatch.h kex.h]
replace the last non-sig_atomic_t flag used in a signal handler with a
sig_atomic_t, unfortunately with some knock-on effects in other (non-
signal) contexts in which it is used; ok markus@
- [email protected] 2006/04/20 09:47:59
[sshconnect.c]
simplify; ok djm@
- [email protected] 2006/04/20 21:53:44
[includes.h session.c sftp.c]
Switch from using pipes to socketpairs for communication between
sftp/scp and ssh, and between sshd and its subprocesses. This saves
a file descriptor per session and apparently makes userland ppp over
ssh work; ok markus@ deraadt@ (ID Sync only - portable makes this
decision on a per-platform basis)
- [email protected] 2006/04/22 04:06:51
[uidswap.c]
use setres[ug]id() to permanently revoke privileges; ok deraadt@
(ID Sync only - portable already uses setres[ug]id() whenever possible)
- [email protected] 2006/04/22 18:29:33
[crc32.c]
remove extra spaces
- (djm) [auth.h dispatch.h kex.h] sprinkle in signal.h to get
sig_atomic_t
20060421
- (djm) [Makefile.in configure.ac session.c sshpty.c]
[contrib/redhat/sshd.init openbsd-compat/Makefile.in]
[openbsd-compat/openbsd-compat.h openbsd-compat/port-linux.c]
[openbsd-compat/port-linux.h] Add support for SELinux, setting
the execution and TTY contexts. based on patch from Daniel Walsh,
bz #880; ok dtucker@
20060418
- (djm) [canohost.c] Reorder IP options check so that it isn't broken
by mapped addresses; bz #1179 reported by markw wtech-llc.com;
ok dtucker@
20060331
- OpenBSD CVS Sync
- [email protected] 2006/03/27 01:21:18
[xmalloc.c]
we can do the size & nmemb check before the integer overflow check;
evol
- [email protected] 2006/03/27 13:03:54
[dh.c]
use strtonum() instead of atoi(), limit dhg size to 64k; ok djm
- [email protected] 2006/03/27 23:15:46
[sftp.c]
always use a format string for addargs; spotted by mouring@
- [email protected] 2006/03/28 00:12:31
[README.tun ssh.c]
spacing
- [email protected] 2006/03/28 01:52:28
[channels.c]
do not accept unreasonable X ports numbers; ok djm
- [email protected] 2006/03/28 01:53:43
[ssh-agent.c]
use strtonum() to parse the pid from the file, and range check it
better; ok djm
- [email protected] 2006/03/30 09:41:25
[channels.c]
ARGSUSED for dispatch table-driven functions
- [email protected] 2006/03/30 09:58:16
[authfd.c bufaux.c deattack.c gss-serv.c mac.c misc.c misc.h]
[monitor_wrap.c msg.c packet.c sftp-client.c sftp-server.c ssh-agent.c]
replace {GET,PUT}_XXBIT macros with functionally similar functions,
silencing a heap of lint warnings. also allows them to use
__bounded__ checking which can't be applied to macros; requested
by and feedback from deraadt@
- [email protected] 2006/03/30 10:41:25
[ssh.c ssh_config.5]
add percent escape chars to the IdentityFile option, bz #1159 based
on a patch by imaging AT math.ualberta.ca; feedback and ok dtucker@
- [email protected] 2006/03/30 11:05:17
[ssh-keygen.c]
Correctly handle truncated files while converting keys; ok djm@
- [email protected] 2006/03/30 11:40:21
[auth.c monitor.c]
Prevent duplicate log messages when privsep=yes; ok djm@
- [email protected] 2006/03/31 09:09:30
[ssh_config.5]
kill trailing whitespace;
- [email protected] 2006/03/31 09:13:56
[ssh_config.5]
remote user escape is %r not %h; spotted by jmc@
20060326
- OpenBSD CVS Sync
- [email protected] 2006/03/15 08:46:44
[ssh-keygen.c]
if no key file are given when printing the DNS host record, use the
host key file(s) as default. ok djm@
- [email protected] 2006/03/16 10:31:45
[scp.c]
Try to display errormessage even if remout == -1
ok djm@, markus@
- [email protected] 2006/03/17 22:31:50
[authfd.c]
another unreachable found by lint
- [email protected] 2006/03/17 22:31:11
[authfd.c]
unreachanble statement, found by lint
- [email protected] 2006/03/19 02:22:32
[serverloop.c]
memory leaks detected by Coverity via elad AT netbsd.org;
ok deraadt@ dtucker@
- [email protected] 2006/03/19 02:22:56
[sftp.c]
more memory leaks detected by Coverity via elad AT netbsd.org;
deraadt@ ok
- [email protected] 2006/03/19 02:23:26
[hostfile.c]
FILE* leak detected by Coverity via elad AT netbsd.org;
ok deraadt@
- [email protected] 2006/03/19 02:24:05
[dh.c readconf.c servconf.c]
potential NULL pointer dereferences detected by Coverity
via elad AT netbsd.org; ok deraadt@
- [email protected] 2006/03/19 07:41:30
[sshconnect2.c]
memory leaks detected by Coverity via elad AT netbsd.org;
deraadt@ ok
- [email protected] 2006/03/19 11:51:52
[servconf.c]
Correct strdelim null test; ok djm@
- [email protected] 2006/03/19 18:52:11
[auth1.c authfd.c channels.c]
spacing
- [email protected] 2006/03/19 18:53:12
[kex.c kex.h monitor.c myproposal.h session.c]
spacing
- [email protected] 2006/03/19 18:56:41
[clientloop.c progressmeter.c serverloop.c sshd.c]
ARGSUSED for signal handlers
- [email protected] 2006/03/19 18:59:49
[ssh-keyscan.c]
please lint
- [email protected] 2006/03/19 18:59:30
[ssh.c]
spacing
- [email protected] 2006/03/19 18:59:09
[authfile.c]
whoever thought that break after return was a good idea needs to
get their head examimed
- [email protected] 2006/03/20 04:09:44
[monitor.c]
memory leaks detected by Coverity via elad AT netbsd.org;
deraadt@ ok
that should be all of them now
- [email protected] 2006/03/20 11:38:46
[key.c]
(really) last of the Coverity diffs: avoid possible NULL deref in
key_free. via elad AT netbsd.org; markus@ ok
- [email protected] 2006/03/20 17:10:19
[auth.c key.c misc.c packet.c ssh-add.c]
in a switch (), break after return or goto is stupid
- [email protected] 2006/03/20 17:13:16
[key.c]
djm did a typo
- [email protected] 2006/03/20 17:17:23
[ssh-rsa.c]
in a switch (), break after return or goto is stupid
- [email protected] 2006/03/20 18:14:02
[channels.c clientloop.c monitor_wrap.c monitor_wrap.h serverloop.c]
[ssh.c sshpty.c sshpty.h]
sprinkle u_int throughout pty subsystem, ok markus
- [email protected] 2006/03/20 18:17:20
[auth1.c auth2.c sshd.c]
sprinkle some ARGSUSED for table driven functions (which sometimes
must ignore their args)
- [email protected] 2006/03/20 18:26:55
[channels.c monitor.c session.c session.h ssh-agent.c ssh-keygen.c]
[ssh-rsa.c ssh.c sshlogin.c]
annoying spacing fixes getting in the way of real diffs
- [email protected] 2006/03/20 18:27:50
[monitor.c]
spacing
- [email protected] 2006/03/20 18:35:12
[channels.c]
x11_fake_data is only ever used as u_char *
- [email protected] 2006/03/20 18:41:43
[dns.c]
cast xstrdup to propert u_char *
- [email protected] 2006/03/20 18:42:27
[canohost.c match.c ssh.c sshconnect.c]
be strict with tolower() casting
- [email protected] 2006/03/20 18:48:34
[channels.c fatal.c kex.c packet.c serverloop.c]
spacing
- [email protected] 2006/03/20 21:11:53
[ttymodes.c]
spacing
- [email protected] 2006/03/25 00:05:41
[auth-bsdauth.c auth-skey.c auth.c auth2-chall.c channels.c]
[clientloop.c deattack.c gss-genr.c kex.c key.c misc.c moduli.c]
[monitor.c monitor_wrap.c packet.c scard.c sftp-server.c ssh-agent.c]
[ssh-keyscan.c ssh.c sshconnect.c sshconnect2.c sshd.c uuencode.c]
[xmalloc.c xmalloc.h]
introduce xcalloc() and xasprintf() failure-checked allocations
functions and use them throughout openssh
xcalloc is particularly important because malloc(nmemb * size) is a
dangerous idiom (subject to integer overflow) and it is time for it
to die
feedback and ok deraadt@
- [email protected] 2006/03/25 01:13:23
[buffer.c channels.c deattack.c misc.c scp.c session.c sftp-client.c]
[sftp-server.c ssh-agent.c ssh-rsa.c xmalloc.c xmalloc.h auth-pam.c]
[uidswap.c]
change OpenSSH's xrealloc() function from being xrealloc(p, new_size)
to xrealloc(p, new_nmemb, new_itemsize).
realloc is particularly prone to integer overflows because it is
almost always allocating "n * size" bytes, so this is a far safer
API; ok deraadt@
- [email protected] 2006/03/25 01:30:23
[sftp.c]
"abormally" is a perfectly cromulent word, but "abnormally" is better
- [email protected] 2006/03/25 13:17:03
[atomicio.c auth-bsdauth.c auth-chall.c auth-options.c auth-passwd.c]
[auth-rh-rsa.c auth-rhosts.c auth-rsa.c auth-skey.c auth.c auth1.c]
[auth2-chall.c auth2-hostbased.c auth2-kbdint.c auth2-none.c]
[auth2-passwd.c auth2-pubkey.c auth2.c authfd.c authfile.c bufaux.c]
[buffer.c canohost.c channels.c cipher-3des1.c cipher-bf1.c]
[cipher-ctr.c cipher.c cleanup.c clientloop.c compat.c compress.c]
[deattack.c dh.c dispatch.c fatal.c groupaccess.c hostfile.c kex.c]
[kexdh.c kexdhc.c kexdhs.c kexgex.c kexgexc.c kexgexs.c key.c log.c]
[mac.c match.c md-sha256.c misc.c monitor.c monitor_fdpass.c]
[monitor_mm.c monitor_wrap.c msg.c nchan.c packet.c progressmeter.c]
[readconf.c readpass.c rsa.c scard.c scp.c servconf.c serverloop.c]
[session.c sftp-client.c sftp-common.c sftp-glob.c sftp-server.c]
[sftp.c ssh-add.c ssh-agent.c ssh-dss.c ssh-keygen.c ssh-keyscan.c]
[ssh-keysign.c ssh-rsa.c ssh.c sshconnect.c sshconnect1.c]
[sshconnect2.c sshd.c sshlogin.c sshpty.c sshtty.c ttymodes.c]
[uidswap.c uuencode.c xmalloc.c]
Put $OpenBSD$ tags back (as comments) to replace the RCSID()s that
Theo nuked - our scripts to sync -portable need them in the files
- [email protected] 2006/03/25 18:29:35
[auth-rsa.c authfd.c packet.c]
needed casts (always will be needed)
- [email protected] 2006/03/25 18:30:55
[clientloop.c serverloop.c]
spacing
- [email protected] 2006/03/25 18:36:15
[sshlogin.c sshlogin.h]
nicer size_t and time_t types
- [email protected] 2006/03/25 18:40:14
[ssh-keygen.c]
cast strtonum() result to right type
- [email protected] 2006/03/25 18:41:45
[ssh-agent.c]
mark two more signal handlers ARGSUSED
- [email protected] 2006/03/25 18:43:30
[channels.c]
use strtonum() instead of atoi() [limit X screens to 400, sorry]
- [email protected] 2006/03/25 18:56:55
[bufaux.c channels.c packet.c]
remove (char *) casts to a function that accepts void * for the arg
- [email protected] 2006/03/25 18:58:10
[channels.c]
delete cast not required
- [email protected] 2006/03/25 22:22:43
[atomicio.h auth-options.h auth.h auth2-gss.c authfd.h authfile.h]
[bufaux.h buffer.h canohost.h channels.h cipher.h clientloop.h]
[compat.h compress.h crc32.c crc32.h deattack.h dh.h dispatch.h]
[dns.c dns.h getput.h groupaccess.h gss-genr.c gss-serv-krb5.c]
[gss-serv.c hostfile.h includes.h kex.h key.h log.h mac.h match.h]
[misc.h monitor.h monitor_fdpass.h monitor_mm.h monitor_wrap.h msg.h]
[myproposal.h packet.h pathnames.h progressmeter.h readconf.h rsa.h]
[scard.h servconf.h serverloop.h session.h sftp-common.h sftp.h]
[ssh-gss.h ssh.h ssh1.h ssh2.h sshconnect.h sshlogin.h sshpty.h]
[ttymodes.h uidswap.h uuencode.h xmalloc.h]
standardise spacing in $OpenBSD$ tags; requested by deraadt@
- [email protected] 2006/03/26 01:31:48
[uuencode.c]
typo
20060325
- OpenBSD CVS Sync
- [email protected] 2006/03/16 04:24:42
[ssh.1]
Add RFC4419 (Diffie-Hellman group exchange KEX) to the list of SSH RFCs
that OpenSSH supports
- [email protected] 2006/03/19 18:51:18
[atomicio.c auth-bsdauth.c auth-chall.c auth-krb5.c auth-options.c]
[auth-pam.c auth-passwd.c auth-rh-rsa.c auth-rhosts.c auth-rsa.c]
[auth-shadow.c auth-skey.c auth.c auth1.c auth2-chall.c]
[auth2-hostbased.c auth2-kbdint.c auth2-none.c auth2-passwd.c]
[auth2-pubkey.c auth2.c authfd.c authfile.c bufaux.c buffer.c]
[canohost.c channels.c cipher-3des1.c cipher-acss.c cipher-aes.c]
[cipher-bf1.c cipher-ctr.c cipher.c cleanup.c clientloop.c compat.c]
[compress.c deattack.c dh.c dispatch.c dns.c entropy.c fatal.c]
[groupaccess.c hostfile.c includes.h kex.c kexdh.c kexdhc.c]
[kexdhs.c kexgex.c kexgexc.c kexgexs.c key.c log.c loginrec.c]
[loginrec.h logintest.c mac.c match.c md-sha256.c md5crypt.c misc.c]
[monitor.c monitor_fdpass.c monitor_mm.c monitor_wrap.c msg.c]
[nchan.c packet.c progressmeter.c readconf.c readpass.c rsa.c]
[scard.c scp.c servconf.c serverloop.c session.c sftp-client.c]
[sftp-common.c sftp-glob.c sftp-server.c sftp.c ssh-add.c]
[ssh-agent.c ssh-dss.c ssh-keygen.c ssh-keyscan.c ssh-keysign.c]
[ssh-rand-helper.c ssh-rsa.c ssh.c sshconnect.c sshconnect1.c]
[sshconnect2.c sshd.c sshlogin.c sshpty.c sshtty.c ttymodes.c]
[uidswap.c uuencode.c xmalloc.c openbsd-compat/bsd-arc4random.c]
[openbsd-compat/bsd-closefrom.c openbsd-compat/bsd-cygwin_util.c]
[openbsd-compat/bsd-getpeereid.c openbsd-compat/bsd-misc.c]
[openbsd-compat/bsd-nextstep.c openbsd-compat/bsd-snprintf.c]
[openbsd-compat/bsd-waitpid.c openbsd-compat/fake-rfc2553.c]
RCSID() can die
- [email protected] 2006/03/19 18:53:12
[kex.h myproposal.h]
spacing
- [email protected] 2006/03/20 04:07:22
[auth2-gss.c]
GSSAPI related leaks detected by Coverity via elad AT netbsd.org;
reviewed by simon AT sxw.org.uk; deraadt@ ok
- [email protected] 2006/03/20 04:07:49
[gss-genr.c]
more GSSAPI related leaks detected by Coverity via elad AT netbsd.org;
reviewed by simon AT sxw.org.uk; deraadt@ ok
- [email protected] 2006/03/20 04:08:18
[gss-serv.c]
last lot of GSSAPI related leaks detected by Coverity via
elad AT netbsd.org; reviewed by simon AT sxw.org.uk; deraadt@ ok
- [email protected] 2006/03/20 18:14:02
[monitor_wrap.h sshpty.h]
sprinkle u_int throughout pty subsystem, ok markus
- [email protected] 2006/03/20 18:26:55
[session.h]
annoying spacing fixes getting in the way of real diffs
- [email protected] 2006/03/20 18:41:43
[dns.c]
cast xstrdup to propert u_char *
- [email protected] 2006/03/22 21:16:24
[ssh.1]
simplify SSHFP example; ok jmc@
- [email protected] 2006/03/22 21:27:15
[deattack.c deattack.h]
remove IV support from the CRC attack detector, OpenSSH has never used
it - it only applied to IDEA-CFB, which we don't support.
prompted by NetBSD Coverity report via elad AT netbsd.org;
feedback markus@ "nuke it" deraadt@
20060318
- (djm) [auth-pam.c] Fix memleak in error path, from Coverity via
elad AT NetBSD.org
- (dtucker) [openbsd-compat/bsd-snprintf.c] Bug #1173: make fmtint() take
a LLONG rather than a long. Fixes scp'ing of large files on platforms
with missing/broken snprintfs. Patch from e.borovac at bom.gov.au.
20060316
- (dtucker) [entropy.c] Add headers for WIFEXITED and friends.
- (dtucker) [configure.ac md-sha256.c] NetBSD has sha2.h in
/usr/include/crypto. Hint from djm@.
- (tim) [kex.c myproposal.h md-sha256.c openbsd-compat/sha2.c,h]
Disable sha256 when openssl < 0.9.7. Patch from djm@.
- (djm) [kex.c] Slightly more clean deactivation of dhgex-sha256 on old
OpenSSL; ok tim
20060315
- (djm) OpenBSD CVS Sync:
- [email protected] 2006/02/06 15:54:07
[ssh.1]
- typo fix
ok jmc@
- [email protected] 2006/02/06 21:44:47
[ssh.1]
make this a little less ambiguous...
- [email protected] 2006/02/07 01:08:04
[auth-rhosts.c includes.h]
move #include <netgroup.h> out of includes.h; ok markus@
- [email protected] 2006/02/07 01:18:09
[includes.h ssh-agent.c ssh-keyscan.c sshconnect2.c]
move #include <sys/queue.h> out of includes.h; ok markus@
- [email protected] 2006/02/07 01:42:00
[channels.c clientloop.c clientloop.h includes.h packet.h]
[serverloop.c sshpty.c sshpty.h sshtty.c ttymodes.c]
move #include <termios.h> out of includes.h; ok markus@
- [email protected] 2006/02/07 01:52:50
[sshtty.c]
"log.h" not needed
- [email protected] 2006/02/07 03:47:05
[hostfile.c]
"packet.h" not needed
- [email protected] 2006/02/07 03:59:20
[deattack.c]
duplicate #include
- [email protected] 2006/02/08 12:15:27
[auth.c clientloop.c includes.h misc.c monitor.c readpass.c]
[session.c sftp.c ssh-agent.c ssh-keysign.c ssh.c sshconnect.c]
[sshd.c sshpty.c]
move #include <paths.h> out of includes.h; ok markus@
- [email protected] 2006/02/08 12:32:49
[includes.h misc.c]
move #include <netinet/tcp.h> out of includes.h; ok markus@
- [email protected] 2006/02/08 13:15:44
[gss-serv.c monitor.c]
small KNF
- [email protected] 2006/02/08 14:16:59
[sshconnect.c]
<openssl/bn.h> not needed
- [email protected] 2006/02/08 14:31:30
[includes.h ssh-agent.c ssh-keyscan.c ssh.c]
move #include <sys/resource.h> out of includes.h; ok markus@
- [email protected] 2006/02/08 14:38:18
[includes.h packet.c]
move #include <netinet/in_systm.h> and <netinet/ip.h> out of
includes.h; ok markus@
- [email protected] 2006/02/08 23:51:24
[includes.h scp.c sftp-glob.c sftp-server.c]
move #include <dirent.h> out of includes.h; ok markus@
- [email protected] 2006/02/09 00:32:07
[includes.h]
#include <sys/endian.h> not needed; ok djm@
NB. ID Sync only - we still need this (but it may move later)
- [email protected] 2006/02/09 10:10:47
[sshd.8]
- move some text into a CAVEATS section
- merge the COMMAND EXECUTION... section into AUTHENTICATION
- [email protected] 2006/02/10 00:27:13
[channels.c clientloop.c includes.h misc.c progressmeter.c sftp.c]
[ssh.c sshd.c sshpty.c]
move #include <sys/ioctl.h> out of includes.h; ok markus@
- [email protected] 2006/02/10 01:44:27
[includes.h monitor.c readpass.c scp.c serverloop.c session.c]
[sftp.c sshconnect.c sshconnect2.c sshd.c]
move #include <sys/wait.h> out of includes.h; ok markus@
- [email protected] 2006/02/11 19:31:18
[atomicio.c]
type correctness; from Ray Lai in PR 5011; ok millert@
- [email protected] 2006/02/12 06:45:34
[ssh.c ssh_config.5]
add a %l expansion code to the ControlPath, which is filled in with the
local hostname at runtime. Requested by henning@ to avoid some problems
with /home on NFS; ok dtucker@
- [email protected] 2006/02/12 10:44:18
[readconf.c]
raise error when the user specifies a RekeyLimit that is smaller than 16
(the smallest of our cipher's blocksize) or big enough to cause integer
wraparound; ok & feedback dtucker@
- [email protected] 2006/02/12 10:49:44
[ssh_config.5]
slight rewording; ok djm
- [email protected] 2006/02/12 10:52:41
[sshd.8]
rework the description of authorized_keys a little;
- [email protected] 2006/02/12 17:57:19
[sshd.8]
sort the list of options permissable w/ authorized_keys;
ok djm dtucker
- [email protected] 2006/02/13 10:16:39
[sshd.8]
no need to subsection the authorized_keys examples - instead, convert
this to look like an actual file. also use proto 2 keys, and use IETF
example addresses;
- [email protected] 2006/02/13 10:21:25
[sshd.8]
small tweaks for the ssh_known_hosts section;
- [email protected] 2006/02/13 11:02:26
[sshd.8]
turn this into an example ssh_known_hosts file; ok djm
- [email protected] 2006/02/13 11:08:43
[sshd.8]
- avoid nasty line split
- `*' does not need to be escaped
- [email protected] 2006/02/13 11:27:25
[sshd.8]
sort FILES and use a -compact list;
- [email protected] 2006/02/15 05:08:24
[sftp-client.c]
typo in comment; ok djm@
- [email protected] 2006/02/15 16:53:20
[ssh.1]
remove the IETF draft references and replace them with some updated RFCs;
- [email protected] 2006/02/15 16:55:33
[sshd.8]
remove ietf draft references; RFC list now maintained in ssh.1;
- [email protected] 2006/02/16 09:05:34
[sshd.8]
sync some of the FILES entries w/ ssh.1;
- [email protected] 2006/02/19 19:52:10
[sshd.8]
move the sshrc stuff out of FILES, and into its own section:
FILES is not a good place to document how stuff works;
- [email protected] 2006/02/19 20:02:17
[sshd.8]
sync the (s)hosts.equiv FILES entries w/ those from ssh.1;
- [email protected] 2006/02/19 20:05:00
[sshd.8]
grammar;
- [email protected] 2006/02/19 20:12:25
[ssh_config.5]
add some vertical space;
- [email protected] 2006/02/20 16:36:15
[authfd.c channels.c includes.h session.c ssh-agent.c ssh.c]
move #include <sys/un.h> out of includes.h; ok djm@
- [email protected] 2006/02/20 17:02:44
[clientloop.c includes.h monitor.c progressmeter.c scp.c]
[serverloop.c session.c sftp.c ssh-agent.c ssh.c sshd.c]
move #include <signal.h> out of includes.h; ok markus@
- [email protected] 2006/02/20 17:19:54
[auth-rhosts.c auth-rsa.c auth.c auth2-none.c auth2-pubkey.c]
[authfile.c clientloop.c includes.h readconf.c scp.c session.c]
[sftp-client.c sftp-common.c sftp-common.h sftp-glob.c]
[sftp-server.c sftp.c ssh-add.c ssh-keygen.c ssh.c sshconnect.c]
[sshconnect2.c sshd.c sshpty.c]
move #include <sys/stat.h> out of includes.h; ok markus@
- [email protected] 2006/02/22 00:04:45
[canohost.c clientloop.c includes.h match.c readconf.c scp.c ssh.c]
[sshconnect.c]
move #include <ctype.h> out of includes.h; ok djm@
- [email protected] 2006/02/24 10:25:14
[ssh_config.5]
add section on patterns;
from dtucker + myself
- [email protected] 2006/02/24 10:33:54
[sshd_config.5]
signpost to PATTERNS;
- [email protected] 2006/02/24 10:37:07
[ssh_config.5]
tidy up the refs to PATTERNS;
- [email protected] 2006/02/24 10:39:52
[sshd.8]
signpost to PATTERNS section;
- [email protected] 2006/02/24 20:22:16
[ssh-keysign.8 ssh_config.5 sshd_config.5]
some consistency fixes;
- [email protected] 2006/02/24 20:31:31
[ssh.1 ssh_config.5 sshd.8 sshd_config.5]
more consistency fixes;
- [email protected] 2006/02/24 23:20:07
[ssh_config.5]
some grammar/wording fixes;
- [email protected] 2006/02/24 23:43:57
[sshd_config.5]
some grammar/wording fixes;
- [email protected] 2006/02/24 23:51:17
[sshd_config.5]
oops - bits i missed;
- [email protected] 2006/02/25 12:26:17
[ssh_config.5]
document the possible values for KbdInteractiveDevices;
help/ok dtucker
- [email protected] 2006/02/25 12:28:34
[sshd_config.5]
document the order in which allow/deny directives are processed;
help/ok dtucker
- [email protected] 2006/02/26 17:17:18
[ssh_config.5]
move PATTERNS to the end of the main body; requested by dtucker
- [email protected] 2006/02/26 18:01:13
[sshd_config.5]
subsection is pointless here;
- [email protected] 2006/02/26 18:03:10
[ssh_config.5]
comma;
- [email protected] 2006/02/28 01:10:21
[session.c]
fix logout recording when privilege separation is disabled, analysis and
patch from vinschen at redhat.com; tested by dtucker@ ok deraadt@
NB. ID sync only - patch already in portable
- [email protected] 2006/03/04 04:12:58
[serverloop.c]
move a debug() outside of a signal handler; ok markus@ a little while back
- [email protected] 2006/03/12 04:23:07
[ssh.c]
knf nit
- [email protected] 2006/03/13 08:16:00
[sshd.c]
don't log that we are listening on a socket before the listen() call
actually succeeds, bz #1162 reported by Senthil Kumar; ok dtucker@
- [email protected] 2006/03/13 08:33:00
[packet.c]
Set TCP_NODELAY for all connections not just "interactive" ones. Fixes
poor performance and protocol stalls under some network conditions (mindrot
bugs #556 and #981). Patch originally from markus@, ok djm@
- [email protected] 2006/03/13 08:43:16
[ssh-keygen.c]
Make ssh-keygen handle CR and CRLF line termination when converting IETF
format keys, in adition to vanilla LF. mindrot #1157, tested by Chris
Pepper, ok djm@
- [email protected] 2006/03/13 10:14:29
[misc.c ssh_config.5 sshd_config.5]
Allow config directives to contain whitespace by surrounding them by double
quotes. mindrot #482, man page help from jmc@, ok djm@
- [email protected] 2006/03/13 10:26:52
[authfile.c authfile.h ssh-add.c]
Make ssh-add check file permissions before attempting to load private
key files multiple times; it will fail anyway and this prevents confusing
multiple prompts and warnings. mindrot #1138, ok djm@
- [email protected] 2006/03/14 00:15:39
[canohost.c]
log the originating address and not just the name when a reverse
mapping check fails, requested by linux AT linuon.com
- [email protected] 2006/03/14 16:32:48
[ssh_config.5 sshd_config.5]
*AliveCountMax applies to protcol v2 only; ok dtucker, djm
- [email protected] 2006/03/07 09:07:40
[kex.c kex.h monitor.c myproposal.h ssh-keyscan.c sshconnect2.c sshd.c]
Implement the diffie-hellman-group-exchange-sha256 key exchange method
using the SHA256 code in libc (and wrapper to make it into an OpenSSL
EVP), interop tested against CVS PuTTY
NB. no portability bits committed yet
- (djm) [configure.ac defines.h kex.c md-sha256.c]
[openbsd-compat/sha2.h openbsd-compat/openbsd-compat.h]
[openbsd-compat/sha2.c] First stab at portability glue for SHA256
KEX support, should work with libc SHA256 support or OpenSSL
EVP_sha256 if present
- (djm) [includes.h] Restore accidentally dropped netinet/in.h
- (djm) [Makefile.in openbsd-compat/Makefile.in] Add added files
- (djm) [md-sha256.c configure.ac] md-sha256.c needs sha2.h if present
- (djm) [regress/.cvsignore] Ignore Makefile here
- (djm) [loginrec.c] Need stat.h
- (djm) [openbsd-compat/sha2.h] Avoid include macro clash with
system sha2.h
- (djm) [ssh-rand-helper.c] Needs a bunch of headers
- (djm) [ssh-agent.c] Restore dropped stat.h
- (djm) [openbsd-compat/sha2.h openbsd-compat/sha2.c] Comment out
SHA384, which we don't need and doesn't compile without tweaks
- (djm) [auth-pam.c clientloop.c includes.h monitor.c session.c]
[sftp-client.c ssh-keysign.c ssh.c sshconnect.c sshconnect2.c]
[sshd.c openbsd-compat/bsd-misc.c openbsd-compat/bsd-openpty.c]
[openbsd-compat/glob.c openbsd-compat/mktemp.c]
[openbsd-compat/readpassphrase.c] Lots of include fixes for
OpenSolaris
- (tim) [includes.h] put sys/stat.h back in to quiet some "macro redefined:"
- (tim) [openssh/sshpty.c openssh/openbsd-compat/port-tun.c] put in some
includes removed from includes.h
- (dtucker) [configure.ac] Fix glob test conversion to AC_TRY_COMPILE
- (djm) [includes.h] Put back paths.h, it is needed in defines.h
- (dtucker) [openbsd-compat/openbsd-compat.h] AIX (at least) needs
sys/ioctl.h for struct winsize.
- (dtucker) [configure.ac] login_cap.h requires sys/types.h on NetBSD.
20060313
- (dtucker) [configure.ac] Bug #1171: Don't use printf("%lld", longlong)
since not all platforms support it. Instead, use internal equivalent while
computing LLONG_MIN and LLONG_MAX. Remove special case for alpha-dec-osf*
as it's no longer required. Tested by Bernhard Simon, ok djm@
20060304
- (dtucker) [contrib/cygwin/ssh-host-config] Require use of lastlog as a
file rather than directory, required as Cygwin will be importing lastlog(1).
Also tightens up permissions on the file. Patch from [email protected].
- (dtucker) [gss-serv-krb5.c] Bug #1166: Correct #ifdefs for gssapi_krb5.h
includes. Patch from gentoo.riverrat at gmail.com.
20060226
- (dtucker) [configure.ac] Bug #1156: QNX apparently needs SSHD_ACQUIRES_CTTY
patch from kraai at ftbfs.org.
20060223
- (dtucker) [sshd_config sshd_config.5] Update UsePAM to reflect current
reality. Pointed out by tryponraj at gmail.com.
20060222
- (dtucker) [openbsd-compat/openssl-compat.{c,h}] Minor tidy up: only
compile in compat code if required.
20060221
- (dtucker) [openbsd-compat/openssl-compat.h] Prevent warning about
redefinition of SSLeay_add_all_algorithms.
20060220
- (dtucker) [INSTALL configure.ac openbsd-compat/openssl-compat.{c,h}]
Add optional enabling of OpenSSL's (hardware) Engine support, via
configure --with-ssl-engine. Based in part on a diff by michal at
logix.cz.
20060219
- (dtucker) [Makefile.in configure.ac, added openbsd-compat/regress/]
Add first attempt at regress tests for compat library. ok djm@
20060214
- (tim) [buildpkg.sh.in] Make the names consistent.
s/pkg_post_make_install_fixes.sh/pkg-post-make-install-fixes.sh/ OK dtucker@
20060212
- (dtucker) [openbsd-compat/bsd-cygwin_util.c] Make loop counter unsigned
to silence compiler warning, from vinschen at redhat.com.
- (tim) [configure.ac] Bug #1149. Disable /etc/default/login check for QNX.
- (dtucker) [README version.h contrib/caldera/openssh.spec
contrib/redhat/openssh.spec contrib/suse/openssh.spec] Bump version
strings to match 4.3p2 release.
20060208
- (tim) [session.c] Logout records were not updated on systems with
post auth privsep disabled due to bug 1086 changes. Analysis and patch
by vinschen at redhat.com. OK tim@, dtucker@.
- (dtucker) [configure.ac] Typo in Ultrix and NewsOS sections (NEED_SETPRGP
-> NEED_SETPGRP), reported by Bernhard Simon. ok tim@
20060206
- (tim) [configure.ac] Remove unnecessary tests for net/if.h and
netinet/in_systm.h. OK dtucker@.
20060205
- (tim) [configure.ac] Add AC_REVISION. Add sys/time.h to lastlog.h test
for Solaris. OK dtucker@.
- (tim) [configure.ac] Bug #1149. Changes in QNX section only. Patch by
kraai at ftbfs.org.
20060203
- (tim) [configure.ac] test for egrep (AC_PROG_EGREP) before first
AC_CHECK_HEADERS test. Without it, if AC_CHECK_HEADERS is first run
by a platform specific check, builtin standard includes tests will be
skipped on the other platforms.
Analysis and suggestion by vinschen at redhat.com, patch by dtucker@.
OK tim@, djm@.
20060202
- (dtucker) [configure.ac] Bug #1148: Fix "crippled AES" test so that it
works with picky compilers. Patch from alex.kiernan at thus.net.
20060201
- (djm) [regress/test-exec.sh] Try 'logname' as well as 'whoami' to
determine the user's login name - needed for regress tests on Solaris
10 and OpenSolaris
- (djm) OpenBSD CVS Sync
- [email protected] 2006/02/01 09:06:50
[sshd.8]
- merge sections on protocols 1 and 2 into a single section
- remove configuration file section
ok markus
- [email protected] 2006/02/01 09:11:41
[sshd.8]
small tweak;
- (djm) [contrib/caldera/openssh.spec contrib/redhat/openssh.spec]
[contrib/suse/openssh.spec] Update versions ahead of release
- [email protected] 2006/02/01 11:27:22
[version.h]
openssh 4.3
- (djm) Release OpenSSH 4.3p1
20060131
- (djm) OpenBSD CVS Sync
- [email protected] 2006/01/20 11:21:45
[ssh_config.5]
- word change, agreed w/ markus
- consistency fixes
- [email protected] 2006/01/25 09:04:34
[sshd.8]
move the options description up the page, and a few additional tweaks
whilst in here;
ok markus
- [email protected] 2006/01/25 09:07:22
[sshd.8]
move subsections to full sections;
- [email protected] 2006/01/26 08:47:56
[ssh.1]
add a section on verifying host keys in dns;
written with a lot of help from jakob;
feedback dtucker/markus;
ok markus
- [email protected] 2006/01/30 12:22:22
[channels.c]
mark channel as write failed or dead instead of read failed on error
of the channel output filter.
ok markus@
- [email protected] 2006/01/30 13:37:49
[ssh.1]
remove an incorrect sentence;
reported by roumen petrov;
ok djm markus
- [email protected] 2006/01/31 10:19:02
[misc.c misc.h scp.c sftp.c]
fix local arbitrary command execution vulnerability on local/local and
remote/remote copies (CVE-2006-0225, bz #1094), patch by
t8m AT centrum.cz, polished by dtucker@ and myself; ok markus@
- [email protected] 2006/01/31 10:35:43
[scp.c]
"scp a b c" shouldn't clobber "c" when it is not a directory, report and
fix from biorn@; ok markus@
- (djm) Sync regress tests to OpenBSD:
- [email protected] 2005/03/10 10:20:39
[regress/forwarding.sh]
Regress test for ClearAllForwardings (bz #994); ok markus@
- [email protected] 2005/04/25 09:54:09
[regress/multiplex.sh]
Don't call cleanup in multiplex as test-exec will cleanup anyway
found by tim@, ok djm@
NB. ID sync only, we already had this
- [email protected] 2005/05/20 23:14:15
[regress/test-exec.sh]
force addressfamily=inet for tests, unbreaking dynamic-forward regress for
recently committed nc SOCKS5 changes
- [email protected] 2005/05/24 04:10:54
[regress/try-ciphers.sh]
oops, new arcfour modes here too
- [email protected] 2005/06/30 11:02:37
[regress/scp.sh]
allow SUDO=sudo; from Alexander Bluhm
- [email protected] 2005/11/14 21:25:56
[regress/agent-getpeereid.sh]
all other scripts in this dir use $SUDO, not 'sudo', so pull this even
ok markus@
- [email protected] 2005/12/14 04:36:39
[regress/scp-ssh-wrapper.sh]
Fix assumption about how many args scp will pass; ok djm@
NB. ID sync only, we already had this
- [email protected] 2006/01/27 06:49:21
[scp.sh]
regress test for local to local scp copies; ok dtucker@
- [email protected] 2006/01/31 10:23:23
[scp.sh]
regression test for CVE-2006-0225 written by dtucker@
- [email protected] 2006/01/31 10:36:33
[scp.sh]
regress test for "scp a b c" where "c" is not a directory
20060129
- (dtucker) [configure.ac opensshd.init.in] Bug #1144: Use /bin/sh for the
opensshd.init script interpretter if /sbin/sh does not exist. ok tim@
20060120
- (dtucker) OpenBSD CVS Sync
- [email protected] 2006/01/15 17:37:05
[ssh.1]
correction from deraadt
- [email protected] 2006/01/18 10:53:29
[ssh.1]
add a section on ssh-based vpn, based on reyk's README.tun;
- [email protected] 2006/01/20 00:14:55
[scp.1 ssh.1 ssh_config.5 sftp.1]
Document RekeyLimit. Based on patch from jan.iven at cern.ch from mindrot
#1056 with feedback from jmc, djm and markus; ok jmc@ djm@
20060114
- (djm) OpenBSD CVS Sync
- [email protected] 2006/01/06 13:27:32
[ssh.1]
weed out some duplicate info in the known_hosts FILES entries;
ok djm
- [email protected] 2006/01/06 13:29:10
[ssh.1]
final round of whacking FILES for duplicate info, and some consistency
fixes;
ok djm
- [email protected] 2006/01/12 14:44:12
[ssh.1]
split sections on tcp and x11 forwarding into two sections.
add an example in the tcp section, based on sth i wrote for ssh faq;
help + ok: djm markus dtucker
- [email protected] 2006/01/12 18:48:48
[ssh.1]
refer to `TCP' rather than `TCP/IP' in the context of connection
forwarding;
ok markus
- [email protected] 2006/01/12 22:20:00
[sshd.8]
refer to TCP forwarding, rather than TCP/IP forwarding;
- [email protected] 2006/01/12 22:26:02
[ssh_config.5]
refer to TCP forwarding, rather than TCP/IP forwarding;
- [email protected] 2006/01/12 22:34:12
[ssh.1]
back out a sentence - AUTHENTICATION already documents this;
20060109
- (dtucker) [contrib/cygwin/ssh-host-config] Make sshd service depend on
tcpip service so it's always started after IP is up. Patch from
vinschen at redhat.com.
20060106
- (djm) OpenBSD CVS Sync
- [email protected] 2006/01/03 16:31:10
[ssh.1]
move FILES to a -compact list, and make each files an item in that list.
this avoids nastly line wrap when we have long pathnames, and treats
each file as a separate item;
remove the .Pa too, since it is useless.
- [email protected] 2006/01/03 16:35:30
[ssh.1]
use a larger width for the ENVIRONMENT list;
- [email protected] 2006/01/03 16:52:36
[ssh.1]
put FILES in some sort of order: sort by pathname
- [email protected] 2006/01/03 16:55:18
[ssh.1]
tweak the description of ~/.ssh/environment
- [email protected] 2006/01/04 18:42:46
[ssh.1]
chop out some duplication in the .{r,s}hosts/{h,sh}osts.equiv FILES
entries;
ok markus
- [email protected] 2006/01/04 18:45:01
[ssh.1]
remove .Xr's to rsh(1) and telnet(1): they are hardly needed;
- [email protected] 2006/01/04 19:40:24
[ssh.1]
+.Xr ssh-keyscan 1 ,
- [email protected] 2006/01/04 19:50:09
[ssh.1]
-.Xr gzip 1 ,
- [email protected] 2006/01/05 23:43:53
[misc.c]
check that stdio file descriptors are actually closed before clobbering
them in sanitise_stdfd(). problems occurred when a lower numbered fd was
closed, but higher ones weren't. spotted by, and patch tested by
Fr�d�ric Olivi�
20060103
- (djm) [channels.c] clean up harmless merge error, from reyk@
20060103
- (djm) OpenBSD CVS Sync
- [email protected] 2006/01/02 17:09:49
[ssh_config.5 sshd_config.5]
some corrections from michael knudsen;
20060102
- (djm) [README.tun] Add README.tun, missed during sync of tun(4) support
- (djm) OpenBSD CVS Sync
- [email protected] 2005/12/31 10:46:17
[ssh.1]
merge the "LOGIN SESSION AND REMOTE EXECUTION" and "SERVER
AUTHENTICATION" sections into "AUTHENTICATION";
some rewording done to make the text read better, plus some
improvements from djm;
ok djm
- [email protected] 2005/12/31 13:44:04
[ssh.1]
clean up ENVIRONMENT a little;
- [email protected] 2005/12/31 13:45:19
[ssh.1]
.Nm does not require an argument;
- [email protected] 2006/01/01 08:59:27
[includes.h misc.c]
move <net/if.h>; ok djm@
- [email protected] 2006/01/01 10:08:48
[misc.c]
no trailing "\n" for debug()
- [email protected] 2006/01/02 01:20:31
[sftp-client.c sftp-common.h sftp-server.c]
use a common max. packet length, no binary change
- [email protected] 2006/01/02 07:53:44
[misc.c]
clarify tun(4) opening - set the mode and bring the interface up. also
(re)sets the tun(4) layer 2 LINK0 flag for existing tunnel interfaces.
suggested and ok by djm@
- [email protected] 2006/01/02 12:31:06
[ssh.1]
start to cut some duplicate info from FILES;
help/ok djm
20060101
- (djm) [Makefile.in configure.ac includes.h misc.c]
[openbsd-compat/port-tun.c openbsd-compat/port-tun.h] Add support
for tunnel forwarding for FreeBSD and NetBSD. NetBSD's support is
limited to IPv4 tunnels only, and most versions don't support the
tap(4) device at all.
- (djm) [configure.ac] Fix linux/if_tun.h test
- (djm) [openbsd-compat/port-tun.c] Linux needs linux/if.h too
20051229
- (djm) OpenBSD CVS Sync
- [email protected] 2005/12/28 22:46:06
[canohost.c channels.c clientloop.c]
use 'break-in' for consistency; ok deraadt@ ok and input jmc@
- [email protected] 2005/12/30 15:56:37
[channels.c channels.h clientloop.c]
add channel output filter interface.
ok djm@, suggested by markus@
- [email protected] 2005/12/30 16:59:00
[sftp.1]
do not suggest that interactive authentication will work
with the -b flag;
based on a diff from john l. scarfone;
ok djm
- [email protected] 2005/12/31 01:38:45
[ssh.1]
document -MM; ok djm@
- (djm) [openbsd-compat/port-tun.c openbsd-compat/port-tun.h configure.ac]
[serverloop.c ssh.c openbsd-compat/Makefile.in]
[openbsd-compat/openbsd-compat.h] Implement tun(4) forwarding
compatability support for Linux, diff from reyk@
- (djm) [configure.ac] Disable Linux tun(4) compat code if linux/tun.h does
not exist
- (djm) [configure.ac] oops, make that linux/if_tun.h
20051229
- (tim) [buildpkg.sh.in] grep for $SSHDUID instead of $SSHDGID on /etc/passwd
20051224
- (djm) OpenBSD CVS Sync
- [email protected] 2005/12/20 21:59:43
[ssh.1]
merge the sections on protocols 1 and 2 into one section on
authentication;
feedback djm dtucker
ok deraadt markus dtucker
- [email protected] 2005/12/20 22:02:50
[ssh.1]
.Ss -> .Sh: subsections have not made this page more readable
- [email protected] 2005/12/20 22:09:41
[ssh.1]
move info on ssh return values and config files up into the main
description;
- [email protected] 2005/12/21 11:48:16
[ssh.1]
-L and -R descriptions are now above, not below, ~C description;
- [email protected] 2005/12/21 11:57:25
[ssh.1]
options now described `above', rather than `later';
- [email protected] 2005/12/21 12:53:31
[ssh.1]
-Y does X11 forwarding too;
ok markus
- [email protected] 2005/12/21 22:44:26
[sshd.8]
clarify precedence of -p, Port, ListenAddress; ok and help jmc@
- [email protected] 2005/12/22 10:31:40
[ssh_config.5]
put the description of "UsePrivilegedPort" in the correct place;
- [email protected] 2005/12/22 11:23:42
[ssh.1]
expand the description of -w somewhat;
help/ok reyk
- [email protected] 2005/12/23 14:55:53
[ssh.1]
- sync the description of -e w/ synopsis
- simplify the description of -I
- note that -I is only available if support compiled in, and that it
isn't by default
feedback/ok djm@
- [email protected] 2005/12/23 23:46:23
[ssh.1]
less mark up for -c;
- [email protected] 2005/12/24 02:27:41
[session.c sshd.c]
eliminate some code duplicated in privsep and non-privsep paths, and
explicitly clear SIGALRM handler; "groovy" deraadt@
20051220
- (dtucker) OpenBSD CVS Sync
- [email protected] 2005/12/13 15:03:02
[serverloop.c]
if forced_tun_device is not set, it is -1 and not SSH_TUNID_ANY
- [email protected] 2005/12/16 18:07:08
[ssh.1]
move the option descriptions up the page: start of a restructure;
ok markus deraadt
- [email protected] 2005/12/16 18:08:53
[ssh.1]
simplify a sentence;
- [email protected] 2005/12/16 18:12:22
[ssh.1]
make the description of -c a little nicer;
- [email protected] 2005/12/16 18:14:40
[ssh.1]
signpost the protocol sections;
- [email protected] 2005/12/17 21:13:05
[ssh_config.5 session.c]
spelling: fowarding, fowarded
- [email protected] 2005/12/17 21:36:42
[ssh_config.5]
spelling: intented -> intended
- [email protected] 2005/12/20 04:41:07
[ssh.c]
exit(255) on error to match description in ssh(1); bz #1137; ok deraadt@
20051219
- (dtucker) [cipher-aes.c cipher-ctr.c cipher.c configure.ac
openbsd-compat/openssl-compat.h] Check for and work around broken AES
ciphers >128bit on (some) Solaris 10 systems. ok djm@
20051217
- (dtucker) [defines.h] HP-UX system headers define "YES" and "NO" which
scp.c also uses, so undef them here.
- (dtucker) [configure.ac openbsd-compat/bsd-snprintf.c] Bug #1133: Our
snprintf replacement can have a conflicting declaration in HP-UX's system
headers (const vs. no const) so we now check for and work around it. Patch
from the dynamic duo of David Leonard and Ted Percival.
20051214
- (dtucker) OpenBSD CVS Sync (regress/)
- [email protected] 2005/12/30 04:36:39
[regress/scp-ssh-wrapper.sh]
Fix assumption about how many args scp will pass; ok djm@
20051213
- (djm) OpenBSD CVS Sync
- [email protected] 2005/11/30 11:18:27
[ssh.1]
timezone -> time zone
- [email protected] 2005/11/30 11:45:20
[ssh.1]
avoid ambiguities in describing TZ;
ok djm@
- [email protected] 2005/12/06 22:38:28
[auth-options.c auth-options.h channels.c channels.h clientloop.c]
[misc.c misc.h readconf.c readconf.h scp.c servconf.c servconf.h]
[serverloop.c sftp.c ssh.1 ssh.c ssh_config ssh_config.5 sshconnect.c]
[sshconnect.h sshd.8 sshd_config sshd_config.5]
Add support for tun(4) forwarding over OpenSSH, based on an idea and
initial channel code bits by markus@. This is a simple and easy way to
use OpenSSH for ad hoc virtual private network connections, e.g.
administrative tunnels or secure wireless access. It's based on a new
ssh channel and works similar to the existing TCP forwarding support,
except that it depends on the tun(4) network interface on both ends of
the connection for layer 2 or layer 3 tunneling. This diff also adds
support for LocalCommand in the ssh(1) client.
ok djm@, markus@, jmc@ (manpages), tested and discussed with others
- [email protected] 2005/12/07 03:52:22
[clientloop.c]
reyk forgot to compile with -Werror (missing header)
- [email protected] 2005/12/07 10:52:13
[ssh.1]
- avoid line split in SYNOPSIS
- add args to -w
- kill trailing whitespace
- [email protected] 2005/12/08 14:59:44
[ssh.1 ssh_config.5]
make `!command' a little clearer;
ok reyk
- [email protected] 2005/12/08 15:06:29
[ssh_config.5]
keep options in order;
- [email protected] 2005/12/08 18:34:11
[auth-options.c includes.h misc.c misc.h readconf.c servconf.c]
[serverloop.c ssh.c ssh_config.5 sshd_config.5 configure.ac]
two changes to the new ssh tunnel support. this breaks compatibility
with the initial commit but is required for a portable approach.
- make the tunnel id u_int and platform friendly, use predefined types.
- support configuration of layer 2 (ethernet) or layer 3
(point-to-point, default) modes. configuration is done using the
Tunnel (yes|point-to-point|ethernet|no) option is ssh_config(5) and
restricted by the PermitTunnel (yes|point-to-point|ethernet|no) option
in sshd_config(5).
ok djm@, man page bits by jmc@
- [email protected] 2005/12/08 21:37:50
[ssh_config.5]
new sentence, new line;
- [email protected] 2005/12/12 13:46:18
[channels.c channels.h session.c]
make sure protocol messages for internal channels are ignored.
allow adjust messages for non-open channels; with and ok djm@
- (djm) [misc.c] Disable tunnel code for non-OpenBSD (for now), enable
again by providing a sys_tun_open() function for your platform and
setting the CUSTOM_SYS_TUN_OPEN define. More work is required to match
OpenBSD's tunnel protocol, which prepends the address family to the
packet
20051201
- (djm) [envpass.sh] Remove regress script that was accidentally committed
in top level directory and not noticed for over a year :)
20051129
- (tim) [ssh-keygen.c] Move DSA length test after setting default when
bits == 0.
- (dtucker) OpenBSD CVS Sync
- [email protected] 2005/11/29 02:04:55
[ssh-keygen.c]
Populate default key sizes before checking them; from & ok tim@
- (tim) [configure.ac sshd.8] Enable locked account check (a "*LK*" string)
for UnixWare.
20051128
- (dtucker) [regress/yes-head.sh] Work around breakage caused by some
versions of GNU head. Based on patch from zappaman at buraphalinux.org
- (dtucker) [includes.h] Bug #1122: __USE_GNU is a glibc internal macro, use
_GNU_SOURCE instead. Patch from t8m at centrum.cz.
- (dtucker) OpenBSD CVS Sync
- [email protected] 2005/11/28 05:16:53
[ssh-keygen.1 ssh-keygen.c]
Enforce DSA key length of exactly 1024 bits to comply with FIPS-186-2,
increase minumum RSA key size to 768 bits and update man page to reflect
these. Patch originally bz#1119 (senthilkumar_sen at hotpop.com),
ok djm@, grudging ok deraadt@.
- [email protected] 2005/11/28 06:02:56
[ssh-agent.1]
Update agent socket path templates to reflect reality, correct xref for
time formats. bz#1121, patch from openssh at roumenpetrov.info, ok djm@
20051126
- (dtucker) [configure.ac] Bug #1126: AIX 5.2 and 5.3 (and presumably newer,
when they're available) need the real UID set otherwise pam_chauthtok will
set ADMCHG after changing the password, forcing the user to change it
again immediately.
20051125
- (dtucker) [configure.ac] Apply tim's fix for older systems where the
resolver state in resolv.h is "state" not "__res_state". With slight
modification by me to also work on old AIXes. ok djm@
- (dtucker) [progressmeter.c scp.c sftp-server.c] Use correct casts for
snprintf formats, fixes warnings on some 64 bit platforms. Patch from
shaw at vranix.com, ok djm@
20051124
- (djm) [configure.ac openbsd-compat/Makefile.in openbsd-compat/bsd-asprintf.c
openbsd-compat/bsd-snprintf.c openbsd-compat/openbsd-compat.h] Add an
asprintf() implementation, after syncing our {v,}snprintf() implementation
with some extra fixes from Samba's version. With help and debugging from
dtucker and tim; ok dtucker@
- (dtucker) [configure.ac] Fix typos in comments and AC_SEARCH_LIB argument
order in Reliant Unix block. Patch from johane at lysator.liu.se.
- (dtucker) [regress/test-exec.sh] Use 1024 bit keys since we generate so
many and use them only once. Speeds up testing on older/slower hardware.
20051122
- (dtucker) OpenBSD CVS Sync
- [email protected] 2005/11/12 18:37:59
[ssh-add.c]
space
- [email protected] 2005/11/12 18:38:15
[scp.c]
avoid close(-1), as in rcp; ok cloder
- [email protected] 2005/11/15 11:59:54
[includes.h]
Include sys/queue.h explicitly instead of assuming some other header
will pull it in. At the moment it gets pulled in by sys/select.h
(which ssh has no business including) via event.h. OK markus@
(ID sync only in -portable)
- [email protected] 2005/11/21 09:42:10
[auth-krb5.c]
Perform Kerberos calls even for invalid users to prevent leaking
information about account validity. bz #975, patch originally from
Senthil Kumar, sanity checked by Simon Wilkinson, tested by djm@, biorn@,
ok markus@
- [email protected] 2005/11/22 03:36:03
[hostfile.c]
Correct format/arguments to debug call; spotted by shaw at vranix.com
ok djm@
- (dtucker) [loginrec.c] Add casts to prevent compiler warnings, patch
from shaw at vranix.com.
20051120
- (dtucker) [openbsd-compat/openssl-compat.h] Add comment explaining what
is going on.
20051112
- (dtucker) [openbsd-compat/getrrsetbyname.c] Restore Portable-specific
ifdef lost during sync. Spotted by tim@.
- (dtucker) [openbsd-compat/{realpath.c,stroll.c,rresvport.c}] $OpenBSD tag.
- (dtucker) [configure.ac] Use "$AWK" instead of "awk" in gcc version test.
- (dtucker) [configure.ac] Remove duplicate utimes() check. ok djm@
- (dtucker) [regress/reconfigure.sh] Fix potential race in the reconfigure
test: if sshd takes too long to reconfigure the subsequent connection will
fail. Zap pidfile before HUPing sshd which will rewrite it when it's ready.
20051110
- (dtucker) [openbsd-compat/setenv.c] Merge changes for __findenv from
OpenBSD getenv.c revs 1.4 - 1.8 (ANSIfication of arguments, removal of
"register").
- (dtucker) [openbsd-compat/setenv.c] Make __findenv static, remove
unnecessary prototype.
- (dtucker) [openbsd-compat/setenv.c] Sync changes from OpenBSD setenv.c
revs 1.7 - 1.9.
- (dtucker) [auth-krb5.c] Fix -Wsign-compare warning in non-Heimdal path.
Patch from djm@.
- (dtucker) [configure.ac] Disable pointer-sign warnings on gcc 4.0+
since they're not useful right now. Patch from djm@.
- (dtucker) [openbsd-compat/getgrouplist.c] Sync OpenBSD revs 1.10 - 1.2 (ANSI
prototypes, removal of "register").
- (dtucker) [openbsd-compat/strlcat.c] Sync OpenBSD revs 1.11 - 1.12 (removal
of "register").
- (dtucker) [openbsd-compat/{LOTS}] Move the "OPENBSD ORIGINAL" markers to
after the copyright notices. Having them at the top next to the CVSIDs
guarantees a conflict for each and every sync.
- (dtucker) [openbsd-compat/strlcpy.c] Update from OpenBSD 1.8 -> 1.10.
- (dtucker) [openbsd-compat/sigact.h] Add "OPENBSD ORIGINAL" marker.
- (dtucker) [openbsd-compat/strmode.c] Update from OpenBSD 1.5 -> 1.7.
Removal of rcsid, "whiteout" inode type.
- (dtucker) [openbsd-compat/basename.c] Update from OpenBSD 1.11 -> 1.14.
Removal of rcsid, will no longer strlcpy parts of the string.
- (dtucker) [openbsd-compat/strtoll.c] Update from OpenBSD 1.4 -> 1.5.
- (dtucker) [openbsd-compat/strtoul.c] Update from OpenBSD 1.5 -> 1.7.
- (dtucker) [openbsd-compat/readpassphrase.c] Update from OpenBSD 1.16 -> 1.18.
- (dtucker) [openbsd-compat/readpassphrase.h] Update from OpenBSD 1.3 -> 1.5.
- (dtucker) [openbsd-compat/glob.c] Update from OpenBSD 1.22 -> 1.25.
- (dtucker) [openbsd-compat/glob.h] Update from OpenBSD 1.8 -> 1.9.
- (dtucker) [openbsd-compat/getcwd.c] Update from OpenBSD 1.9 -> 1.14.
- (dtucker) [openbsd-compat/getcwd.c] Replace lstat with fstat to match up
with OpenBSD code since we don't support platforms without fstat any more.
- (dtucker) [openbsd-compat/inet_aton.c] Update from OpenBSD 1.7 -> 1.9.
- (dtucker) [openbsd-compat/inet_ntoa.c] Update from OpenBSD 1.4 -> 1.6.
- (dtucker) [openbsd-compat/inet_ntop.c] Update from OpenBSD 1.5 -> 1.7.
- (dtucker) [openbsd-compat/daemon.c] Update from OpenBSD 1.5 -> 1.6.
- (dtucker) [openbsd-compat/strsep.c] Update from OpenBSD 1.5 -> 1.6.
- (dtucker) [openbsd-compat/daemon.c] Update from OpenBSD 1.10 -> 1.13.
- (dtucker) [openbsd-compat/mktemp.c] Update from OpenBSD 1.17 -> 1.19.
- (dtucker) [openbsd-compat/rresvport.c] Update from OpenBSD 1.6 -> 1.8.
- (dtucker) [openbsd-compat/bindresvport.c] Add "OPENBSD ORIGINAL" marker.
- (dtucker) [openbsd-compat/bindresvport.c] Update from OpenBSD 1.16 -> 1.17.
- (dtucker) [openbsd-compat/sigact.c] Update from OpenBSD 1.3 -> 1.4.
Id and copyright sync only, there were no substantial changes we need.
- (dtucker) [openbsd-compat/bsd-closefrom.c openbsd-compat/base64.c]
-Wsign-compare fixes from djm.
- (dtucker) [openbsd-compat/sigact.h] Update from OpenBSD 1.2 -> 1.3.
Id and copyright sync only, there were no substantial changes we need.
- (dtucker) [configure.ac] Try to get the gcc version number in a way that
doesn't change between versions, and use a safer default.
20051105
- (djm) OpenBSD CVS Sync
- [email protected] 2005/10/07 11:13:57
[ssh-keygen.c]
change DSA default back to 1024, as it's defined for 1024 bits only
and this causes interop problems with other clients. moreover,
in order to improve the security of DSA you need to change more
components of DSA key generation (e.g. the internal SHA1 hash);
ok deraadt
- [email protected] 2005/10/10 10:23:08
[channels.c channels.h clientloop.c serverloop.c session.c]
fix regression I introduced in 4.2: X11 forwardings initiated after
a session has exited (e.g. "(sleep 5; xterm) &") would not start.
bz #1086 reported by t8m AT centrum.cz; ok markus@ dtucker@
- [email protected] 2005/10/11 23:37:37
[channels.c]
bz #1076 set SO_REUSEADDR on X11 forwarding listner sockets, preventing
bind() failure when a previous connection's listeners are in TIME_WAIT,
reported by plattner AT inf.ethz.ch; ok dtucker@
- [email protected] 2005/10/13 14:03:01
[auth2-gss.c gss-genr.c gss-serv.c]
remove unneeded #includes; ok markus@
- [email protected] 2005/10/13 14:20:37
[gss-serv.c]
spelling in comments
- [email protected] 2005/10/13 19:08:08
[gss-serv-krb5.c gss-serv.c]
unused declarations; ok deraadt@
(id sync only for gss-serv-krb5.c)
- [email protected] 2005/10/13 19:13:41
[dns.c]
unneeded #include, unused declaration, little knf; ok deraadt@
- [email protected] 2005/10/13 22:24:31
[auth2-gss.c gss-genr.c gss-serv.c monitor.c]
KNF; ok djm@
- [email protected] 2005/10/14 02:17:59
[ssh-keygen.c ssh.c sshconnect2.c]
no trailing "\n" for log functions; ok djm@
- [email protected] 2005/10/14 02:29:37
[channels.c clientloop.c]
free()->xfree(); ok djm@
- [email protected] 2005/10/15 15:28:12
[sshconnect.c]
make external definition static; ok deraadt@
- [email protected] 2005/10/17 13:45:05
[dns.c]
fix memory leaks from 2 sources:
1) key_fingerprint_raw()
2) malloc in dns_read_rdata()
ok jakob@
- [email protected] 2005/10/17 14:01:28
[dns.c]
remove #ifdef LWRES; ok jakob@
- [email protected] 2005/10/17 14:13:35
[dns.c dns.h]
more cleanups; ok jakob@
- [email protected] 2005/10/30 01:23:19
[ssh_config.5]
mention control socket fallback behaviour, reported by
tryponraj AT gmail.com
- [email protected] 2005/10/30 04:01:03
[ssh-keyscan.c]
make ssh-keygen discard junk from server before SSH- ident, spotted by
dave AT cirt.net; ok dtucker@
- [email protected] 2005/10/30 04:03:24
[ssh.c]
fix misleading debug message; ok dtucker@
- [email protected] 2005/10/30 08:29:29
[canohost.c sshd.c]
Check for connections with IP options earlier and drop silently. ok djm@
- [email protected] 2005/10/30 08:43:47
[ssh_config.5]
remove trailing whitespace;
- [email protected] 2005/10/30 08:52:18
[clientloop.c packet.c serverloop.c session.c ssh-agent.c ssh-keygen.c]
[ssh.c sshconnect.c sshconnect1.c sshd.c]
no need to escape single quotes in comments, no binary change
- [email protected] 2005/10/31 06:15:04
[sftp.c]
Fix sorting with "ls -1" command. From Robert Tsai, "looks right" deraadt@
- [email protected] 2005/10/31 11:12:49
[ssh-keygen.1 ssh-keygen.c]
generate a protocol 2 RSA key by default
- [email protected] 2005/10/31 11:48:29
[serverloop.c]
make sure we clean up wtmp, etc. file when we receive a SIGTERM,
SIGINT or SIGQUIT when running without privilege separation (the
normal privsep case is already OK). Patch mainly by dtucker@ and
senthilkumar_sen AT hotpop.com; ok dtucker@
- [email protected] 2005/10/31 19:55:25
[ssh-keygen.1]
grammar;
- [email protected] 2005/11/03 13:38:29
[canohost.c]
Cache reverse lookups with and without DNS separately; ok markus@
- [email protected] 2005/11/04 05:15:59
[kex.c kex.h kexdh.c kexdhc.c kexdhs.c kexgex.c kexgexc.c kexgexs.c]
remove hardcoded hash lengths in key exchange code, allowing
implementation of KEX methods with different hashes (e.g. SHA-256);
ok markus@ dtucker@ stevesk@
- [email protected] 2005/11/05 05:01:15
[bufaux.c]
Fix leaks in error paths, bz #1109 and #1110 reported by kremenek AT
cs.stanford.edu; ok dtucker@
- (dtucker) [README.platform] Add PAM section.
- (djm) [openbsd-compat/getrrsetbyname.c] Sync to latest OpenBSD version,
resolving memory leak bz#1111 reported by kremenek AT cs.stanford.edu;
ok dtucker@
20051102
- (dtucker) [openbsd-compat/bsd-misc.c] Bug #1108: fix broken strdup().
Reported by olavi at ipunplugged.com and antoine.brodin at laposte.net
via FreeBSD.
20051030
- (djm) [contrib/suse/openssh.spec contrib/suse/rc.
sshd contrib/suse/sysconfig.ssh] Bug #1106: Updated SuSE spec and init
files from imorgan AT nas.nasa.gov
- (dtucker) [session.c] Bug #1045do not check /etc/nologin when PAM is
enabled, instead allow PAM to handle it. Note that on platforms using PAM,
the pam_nologin module should be added to sshd's session stack in order to
maintain exising behaviour. Based on patch and discussion from t8m at
centrum.cz, ok djm@
20051025
- (dtucker) [configure.ac] Relocate LLONG_MAX calculation to after the
sizeof(long long) checks, to make fixing bug #1104 easier (no changes
yet).
- (dtucker) [configure.ac] Bug #1104: Tru64's printf family doesn't
understand "%lld", even though the compiler has "long long", so handle
it as a special case. Patch tested by mcaskill.scott at epa.gov.
- (dtucker) [contrib/cygwin/ssh-user-config] Remove duplicate yes/no
prompt. Patch from vinschen at redhat.com.
20051017
- (dtucker) [configure.ac] Bug #1097: Fix configure for cross-compiling.
/etc/default/login report and testing from aabaker at iee.org, corrections
from tim@.
20051009
- (dtucker) [configure.ac defines.h openbsd-compat/vis.{c,h}] Sync current
versions from OpenBSD. ok djm@
20051008
- (dtucker) [configure.ac] Bug #1098: define $MAIL for HP-UX; report from
brian.smith at agilent com.
- (djm) [configure.ac] missing 'test' call for -with-Werror test
20051005
- (dtucker) [configure.ac sshd.8] Enable locked account check (a prepended
"*LOCKED*" string) for FreeBSD. Patch jeremie at le-hen.org and
senthilkumar_sen at hotpop.com.
20051003
- (dtucker) OpenBSD CVS Sync
- [email protected] 2005/09/07 08:53:53
[channels.c]
enforce chanid != NULL; ok djm
- [email protected] 2005/09/09 19:18:05
[clientloop.c]
typo; from mark at mcs.vuw.ac.nz, bug #1082
- [email protected] 2005/09/13 23:40:07
[sshd.c ssh.c misc.h sftp.c ssh-keygen.c ssh-keysign.c sftp-server.c
scp.c misc.c ssh-keyscan.c ssh-add.c ssh-agent.c]
ensure that stdio fds are attached; ok deraadt@
- [email protected] 2005/09/19 11:37:34
[ssh_config.5 ssh.1]
mention ability to specify bind_address for DynamicForward and -D options;
bz#1077 spotted by Haruyama Seigo
- [email protected] 2005/09/19 11:47:09
[sshd.c]
stop connection abort on rekey with delayed compression enabled when
post-auth privsep is disabled (e.g. when root is logged in); ok dtucker@
- [email protected] 2005/09/19 11:48:10
[gss-serv.c]
typo
- [email protected] 2005/09/19 15:38:27
[ssh.1]
some more .Bk/.Ek to avoid ugly line split;
- [email protected] 2005/09/19 15:42:44
[ssh.c]
update -D usage here too;
- [email protected] 2005/09/19 23:31:31
[ssh.1]
spelling nit from stevesk@
- [email protected] 2005/09/21 23:36:54
[sshd_config.5]
aquire -> acquire, from stevesk@
- [email protected] 2005/09/21 23:37:11
[sshd.c]
change label at markus@'s request
- [email protected] 2005/09/30 20:34:26
[ssh-keyscan.1]
deploy .An -nosplit; ok jmc
- [email protected] 2005/10/03 07:44:42
[canohost.c]
Relocate check_ip_options call to prevent logging of garbage for
connections with IP options set. bz#1092 from David Leonard,
"looks good" deraadt@
- (dtucker) [regress/README.regress] Bug #989: Document limitation that scp
is required in the system path for the multiplex test to work.
20050930
- (dtucker) [openbsd-compat/openbsd-compat.h] Bug #1096: Add prototype
for strtoll. Patch from o.flebbe at science-computing.de.
- (dtucker) [monitor.c] Bug #1087: Send loginmsg to preauth privsep
child during PAM account check without clearing it. This restores the
post-login warnings such as LDAP password expiry. Patch from Tomas Mraz
with help from several others.
20050929
- (dtucker) [monitor_wrap.c] Remove duplicate definition of loginmsg
introduced during sync.
20050928
- (dtucker) [entropy.c] Use u_char for receiving RNG seed for consistency.
- (dtucker) [auth-pam.c] Bug #1028: send final non-query messages from
PAM via keyboard-interactive. Patch tested by the folks at Vintela.
20050927
- (dtucker) [entropy.c] Remove unnecessary tests for getuid and geteuid
calls, since they can't possibly fail. ok djm@
- (dtucker) [entropy.c entropy.h sshd.c] Pass RNG seed to the reexec'ed
process when sshd relies on ssh-random-helper. Should result in faster
logins on systems without a real random device or prngd. ok djm@
20050924
- (dtucker) [auth2.c] Move start_pam() calls out of if-else block to remove
duplicate call. ok djm@
20050922
- (dtucker) [configure.ac] Use -R linker flag for libedit too; patch from
skeleten at shillest.net.
- (dtucker) [configure.ac] Fix help for --with-opensc; patch from skeleten at
shillest.net.
20050919
- (tim) [aclocal.m4 configure.ac] Delete acconfig.h and add templates to
AC_DEFINE and AC_DEFINE_UNQUOTED to quiet autoconf 2.59 warning messages.
ok dtucker@
20050912
- (tim) [configure.ac] Bug 1078. Fix --without-kerberos5. Reported by
Mike Frysinger.
20050908
- (tim) [defines.h openbsd-compat/port-uw.c] Add long password support to
OpenServer 6 and add osr5bigcrypt support so when someone migrates
passwords between UnixWare and OpenServer they will still work. OK dtucker@
20050901
- (djm) Update RPM spec file versions
20050831
- (djm) OpenBSD CVS Sync
- [email protected] 2005/08/30 22:08:05
[gss-serv.c sshconnect2.c]
destroy credentials if krb5_kuserok() call fails. Stops credentials being
delegated to users who are not authorised for GSSAPIAuthentication when
GSSAPIDeletegateCredentials=yes and another authentication mechanism
succeeds; bz#1073 reported by paul.moore AT centrify.com, fix by
simon AT sxw.org.uk, tested todd@ biorn@ jakob@; ok deraadt@
- [email protected] 2005/08/31 09:28:42
[version.h]
4.2
- (dtucker) [README] Update release note URL to 4.2
- (tim) [configure.ac auth.c defines.h session.c openbsd-compat/port-uw.c
openbsd-compat/port-uw.h openbsd-compat/xcrypt.c] libiaf cleanup. Disable
libiaf bits for OpenServer6. Free memory allocated by ia_get_logpwd().
Feedback and OK dtucker@
20050830
- (tim) [configure.ac] Back out last change. It needs to be done differently.
20050829
- (tim) [configure.ac] ia_openinfo() seems broken on OSR6. Limit UW long
password support to 7.x for now.
20050826
- (tim) [CREDITS LICENCE auth.c configure.ac defines.h includes.h session.c
openbsd-compat/Makefile.in openbsd-compat/openbsd-compat.h
openbsd-compat/xcrypt.c] New files [openssh/openbsd-compat/port-uw.c
openssh/openbsd-compat/port-uw.h] Support long passwords (> 8-char)
on UnixWare 7 from Dhiraj Gulati and Ahsan Rashid. Cleanup and testing
by tim@. Feedback and OK dtucker@
20050823
- (dtucker) [regress/test-exec.sh] Do not prepend an extra "/" to a fully-
qualified sshd pathname since some systems (eg Cygwin) may consider "/foo"
and "//foo" to be different. Spotted by vinschen at redhat.com.
- (tim) [configure.ac] Not all gcc's support -Wsign-compare. Enhancements
and OK dtucker@
- (tim) [defines.h] PATH_MAX bits for OpenServer OK dtucker@
20050821
- (dtucker) [configure.ac defines.h includes.h sftp.c] Add support for
LynxOS, patch from Olli Savia (ops at iki.fi). ok djm@
20050816
- (djm) [ttymodes.c] bugzilla #1025: Fix encoding of _POSIX_VDISABLE,
from Jacob Nevins; ok dtucker@
20050815
- (tim) [sftp.c] wrap el_end() in #ifdef USE_LIBEDIT
- (tim) [configure.ac] corrections to libedit tests. Report and patches
by skeleten AT shillest.net
20050812
- (djm) OpenBSD CVS Sync
- [email protected] 2005/07/28 17:36:22
[packet.c]
missing packet_init_compression(); from solar
- [email protected] 2005/07/30 01:26:16
[ssh.c]
fix -D listen_host initialisation, so it picks up gateway_ports setting
correctly
- [email protected] 2005/07/30 02:03:47
[readconf.c]
listen_hosts initialisation here too; spotted greg AT y2005.nest.cx
- [email protected] 2005/08/06 10:03:12
[servconf.c]
Unbreak sshd ListenAddress for bare IPv6 addresses.
Report from Janusz Mucka; ok djm@
- [email protected] 2005/08/08 13:22:48
[sftp.c]
sftp prompt enhancements:
- in non-interactive mode, do not print an empty prompt at the end
before finishing
- print newline after EOF in editline mode
- call el_end() in editline mode
ok dtucker djm
20050810
- (dtucker) [configure.ac] Test libedit library and headers for compatibility.
Report from skeleten AT shillest.net, ok djm@
- (dtucker) [LICENCE configure.ac defines.h openbsd-compat/realpath.c]
Sync current (thread-safe) version of realpath.c from OpenBSD (which is
in turn based on FreeBSD's). ok djm@
20050809
- (tim) [configure.ac] Allow --with-audit=no. OK dtucker@
Report by skeleten AT shillest.net
20050803
- (dtucker) [openbsd-compat/fake-rfc2553.h] Check for EAI_* defines
individually and use a value less likely to collide with real values from
netdb.h. Fixes compile warnings on FreeBSD 5.3. ok djm@
- (dtucker) [openbsd-compat/fake-rfc2553.h] MAX_INT -> INT_MAX since the
latter is specified in the standard.
20050802
- (dtucker) OpenBSD CVS Sync
- [email protected] 2005/07/27 10:39:03
[scp.c hostfile.c sftp-client.c]
Silence bogus -Wuninitialized warnings; ok djm@
- (dtucker) [configure.ac] Enable -Wuninitialized by default when compiling
with gcc. ok djm@
- (dtucker) [configure.ac] Add a --with-Werror option to configure for
adding -Werror to CFLAGS when all of the configure tests are done. ok djm@
20050726
- (dtucker) [configure.ac] Update zlib warning message too, pointed out by
tim@.
- (djm) OpenBSD CVS Sync
- [email protected] 2005/07/19 15:32:26
[auth-passwd.c]
auth_usercheck(3) can return NULL, so check for that. Report from
mpech@. ok markus@
- [email protected] 2005/07/25 11:59:40
[kex.c kex.h myproposal.h packet.c packet.h servconf.c session.c]
[sshconnect2.c sshd.c sshd_config sshd_config.5]
add a new compression method that delays compression until the user
has been authenticated successfully and set compression to 'delayed'
for sshd.
this breaks older openssh clients (< 3.5) if they insist on
compression, so you have to re-enable compression in sshd_config.
ok djm@
20050725
- (dtucker) [configure.ac] Update zlib version check for CAN-2005-2096.
20050717
- OpenBSD CVS Sync
- [email protected] 2005/07/16 01:35:24
[auth1.c channels.c cipher.c clientloop.c kex.c session.c ssh.c]
[sshconnect.c]
spacing
- (djm) [acss.c auth-pam.c auth-shadow.c auth-skey.c auth1.c canohost.c]
[cipher-acss.c loginrec.c ssh-rand-helper.c sshd.c] Fix whitespace at EOL
in portable too ("perl -p -i -e 's/\s+$/\n/' *.[ch]")
- (djm) [auth-pam.c sftp.c] spaces vs. tabs at start of line
- [email protected] 2005/07/17 06:49:04
[channels.c channels.h session.c session.h]
Fix a number of X11 forwarding channel leaks:
1. Refuse multiple X11 forwarding requests on the same session
2. Clean up all listeners after a single_connection X11 forward, not just
the one that made the single connection
3. Destroy X11 listeners when the session owning them goes away
testing and ok dtucker@
- [email protected] 2005/07/17 07:17:55
[auth-rh-rsa.c auth-rhosts.c auth2-chall.c auth2-gss.c channels.c]
[cipher-ctr.c gss-genr.c gss-serv.c kex.c moduli.c readconf.c]
[serverloop.c session.c sftp-client.c sftp.c ssh-add.c ssh-keygen.c]
[sshconnect.c sshconnect2.c]
knf says that a 2nd level indent is four (not three or five) spaces
-(djm) [audit.c auth1.c auth2.c entropy.c loginrec.c serverloop.c]
[ssh-rand-helper.c] fix portable 2nd level indents at 4 spaces too
- (djm) [monitor.c monitor_wrap.c] -Wsign-compare for PAM monitor calls
20050716
- (dtucker) [auth-pam.c] Ensure that only one side of the authentication
socketpair stays open on in both the monitor and PAM process. Patch from
Joerg Sonnenberger.
20050714
- (dtucker) OpenBSD CVS Sync
- [email protected] 2005/07/06 09:33:05
[ssh.1]
clarify meaning of ssh -b ; with & ok jmc@
- [email protected] 2005/07/08 09:26:18
[misc.c]
Make comment match code; ok djm@
- [email protected] 2005/07/08 09:41:33
[channels.h]
race when efd gets closed while there is still buffered data:
change CHANNEL_EFD_OUTPUT_ACTIVE()
1) c->efd must always be valid AND
2a) no EOF has been seen OR
2b) there is buffered data
report, initial fix and testing Chuck Cranor
- [email protected] 2005/07/08 10:20:41
[ssh_config.5]
change BindAddress to match recent ssh -b change; prompted by markus@
- [email protected] 2005/07/08 12:53:10
[ssh_config.5]
new sentence, new line;
- [email protected] 2005/07/14 04:00:43
[misc.h]
use __sentinel__ attribute; ok deraadt@ djm@ markus@
- (dtucker) [configure.ac defines.h] Define __sentinel__ to nothing if the
compiler doesn't understand it to prevent warnings. If any mainstream
compiler versions acquire it we can test for those versions. Based on
discussion with djm@.
20050707
- dtucker [auth-krb5.c auth.h gss-serv-krb5.c] Move KRB5CCNAME generation for
the MIT Kerberos code path into a common function and expand mkstemp
template to be consistent with the rest of OpenSSH. From sxw at
inf.ed.ac.uk, ok djm@
- (dtucker) [auth-krb5.c] There's no guarantee that snprintf will set errno
in the case where the buffer is insufficient, so always return ENOMEM.
Also pointed out by sxw at inf.ed.ac.uk.
- (dtucker) [acconfig.h auth-krb5.c configure.ac gss-serv-krb5.c] Remove
calls to krb5_init_ets, which has not been required since krb-1.1.x and
most Kerberos versions no longer export in their public API. From sxw
at inf.ed.ac.uk, ok djm@
20050706
- (djm) OpenBSD CVS Sync
- [email protected] 2005/07/01 13:19:47
[channels.c]
don't free() if getaddrinfo() fails; report mpech@
- [email protected] 2005/07/04 00:58:43
[channels.c clientloop.c clientloop.h misc.c misc.h ssh.c ssh_config.5]
implement support for X11 and agent forwarding over multiplex slave
connections. Because of protocol limitations, the slave connections inherit
the master's DISPLAY and SSH_AUTH_SOCK rather than distinctly forwarding
their own.
ok dtucker@ "put it in" deraadt@
- [email protected] 2005/07/04 11:29:51
[ssh_config.5]
fix Xr and a little grammar;
- [email protected] 2005/07/04 14:04:11
[channels.c]
don't forget to set x11_saved_display
20050626
- (djm) OpenBSD CVS Sync
- [email protected] 2005/06/17 22:53:47
[ssh.c sshconnect.c]
Fix ControlPath's %p expanding to "0" for a default port,
spotted dwmw2 AT infradead.org; ok markus@
- [email protected] 2005/06/18 04:30:36
[ssh.c ssh_config.5]
allow ControlPath=none, patch from dwmw2 AT infradead.org; ok dtucker@
- [email protected] 2005/06/25 22:47:49
[ssh.c]
do the default port filling code a few lines earlier, so it really
does fix %p
20050618
- (djm) OpenBSD CVS Sync
- [email protected] 2005/05/20 12:57:01;
[auth1.c] split protocol 1 auth methods into separate functions, makes
authloop much more readable; fixes and ok markus@ (portable ok &
polish dtucker@)
- [email protected] 2005/06/17 02:44:33
[auth1.c] make this -Wsign-compare clean; ok avsm@ markus@
- (djm) [loginrec.c ssh-rand-helper.c] Fix -Wsign-compare for portable,
tested and fixes tim@
20050617
- (djm) OpenBSD CVS Sync
- [email protected] 2005/06/16 03:38:36
[channels.c channels.h clientloop.c clientloop.h ssh.c]
move x11_get_proto from ssh.c to clientloop.c, to make muliplexed xfwd
easier later; ok deraadt@
- [email protected] 2005/06/16 08:00:00
[canohost.c channels.c sshd.c]
don't exit if getpeername fails for forwarded ports; bugzilla #1054;
ok djm
- [email protected] 2005/06/17 02:44:33
[auth-rsa.c auth.c auth1.c auth2-chall.c auth2-gss.c authfd.c authfile.c]
[bufaux.c canohost.c channels.c cipher.c clientloop.c dns.c gss-serv.c]
[kex.c kex.h key.c mac.c match.c misc.c packet.c packet.h scp.c]
[servconf.c session.c session.h sftp-client.c sftp-server.c sftp.c]
[ssh-keyscan.c ssh-rsa.c sshconnect.c sshconnect1.c sshconnect2.c sshd.c]
make this -Wsign-compare clean; ok avsm@ markus@
NB. auth1.c changes not committed yet (conflicts with uncommitted sync)
NB2. more work may be needed to make portable Wsign-compare clean
- (dtucker) [cipher.c openbsd-compat/openbsd-compat.h
openbsd-compat/openssl-compat.c] only include openssl compat stuff where
it's needed as it can cause conflicts elsewhere (eg xcrypt.c). Found by
and ok tim@
20050616
- (djm) OpenBSD CVS Sync
- [email protected] 2005/06/07 13:25:23
[progressmeter.c]
catch SIGWINCH and resize progress meter accordingly; ok markus dtucker
- [email protected] 2005/06/06 11:20:36
[auth.c auth.h misc.c misc.h ssh.c ssh_config.5 sshconnect.c]
introduce a generic %foo expansion function. replace existing % expansion
and add expansion to ControlPath; ok markus@
- [email protected] 2005/06/08 03:50:00
[ssh-keygen.1 ssh-keygen.c sshd.8]
increase default rsa/dsa key length from 1024 to 2048 bits;
ok markus@ deraadt@
- [email protected] 2005/06/08 11:25:09
[clientloop.c readconf.c readconf.h ssh.c ssh_config.5]
add ControlMaster=auto/autoask options to support opportunistic
multiplexing; tested avsm@ and jakob@, ok markus@
- [email protected] 2005/06/09 13:43:49
[cipher.c]
Correctly initialize end of array sentinel; ok djm@
(Id sync only, change already in portable)
20050609
- (dtucker) [cipher.c openbsd-compat/Makefile.in
openbsd-compat/openbsd-compat.h openbsd-compat/openssl-compat.{c,h}]
Move compatibility code for supporting older OpenSSL versions to the
compat layer. Suggested by and "no objection" djm@
20050607
- (dtucker) [configure.ac] Continue the hunt for LLONG_MIN and LLONG_MAX:
in today's episode we attempt to coax it from limits.h where it may be
hiding, failing that we take the DIY approach. Tested by tim@
20050603
- (dtucker) [configure.ac] Only try gcc -std=gnu99 if LLONG_MAX isn't
defined, and check that it helps before keeping it in CFLAGS. Some old
gcc's don't set an error code when encountering an unknown value in -std.
Found and tested by tim@.
- (dtucker) [configure.ac] Point configure's reporting address at the
openssh-unix-dev list. ok tim@ djm@
20050602
- (tim) [configure.ac] Some platforms need sys/types.h for arpa/nameser.h.
Take AC_CHECK_HEADERS test out of ultrix section. It caused other platforms
to skip builtin standard includes tests. (first AC_CHECK_HEADERS test
must be run on all platforms) Add missing ;; to case statement. OK dtucker@
20050601
- (dtucker) [configure.ac] Look for _getshort and _getlong in
arpa/nameser.h.
- (dtucker) [configure.ac openbsd-compat/Makefile.in openbsd-compat/strtoll.c]
Add strtoll to the compat library, from OpenBSD.
- (dtucker) OpenBSD CVS Sync
- [email protected] 2005/05/26 02:08:05
[scp.c]
If copying multiple files to a target file (which normally fails, as it
must be a target directory), kill the spawned ssh child before exiting.
This stops it trying to authenticate and spewing lots of output.
deraadt@ ok
- [email protected] 2005/05/26 09:08:12
[ssh-keygen.c]
uint32_t -> u_int32_t for consistency; ok djm@
- [email protected] 2005/05/27 08:30:37
[ssh.c]
fix -O for cases where no ControlPath has been specified or socket at
ControlPath is not contactable; spotted by and ok avsm@
- (tim) [config.guess config.sub] Update to '2005-05-27' version.
- (tim) [configure.ac] set TEST_SHELL for OpenServer 6
20050531
- (dtucker) [contrib/aix/pam.conf] Correct comments. From davidl at
vintela.com.
- (dtucker) [mdoc2man.awk] Teach it to understand .Ox.
20050530
- (dtucker) [README] Link to new release notes. Beter late than never...
20050529
- (dtucker) [openbsd-compat/port-aix.c] Bug #1046: AIX 5.3 expects the
argument to passwdexpired to be initialized to NULL. Suggested by tim@
While at it, initialize the other arguments to auth functions in case they
ever acquire this behaviour.
- (dtucker) [openbsd-compat/port-aix.c] Whitespace cleanups while there.
- (dtucker) [openbsd-compat/port-aix.c] Minor correction to debug message,
spotted by tim@.
20050528
- (dtucker) [configure.ac] For AC_CHECK_HEADERS() and AC_CHECK_FUNCS() have
one entry per line to make it easier to merge changes. ok djm@
- (dtucker) [configure.ac] strsep() may be defined in string.h, so check
for its presence and include it in the strsep check.
- (dtucker) [configure.ac] getpgrp may be defined in unistd.h, so check for
its presence before doing AC_FUNC_GETPGRP.
- (dtucker) [configure.ac] Merge HP-UX blocks into a common block with minor
version-specific variations as required.
- (dtucker) [openbsd-compat/port-aix.h] Use the HAVE_DECL_* definitions as
per the autoconf man page. Configure should always define them but it
doesn't hurt to check.
20050527
- (djm) [defines.h] Use our realpath if we have to define PATH_MAX, spotted by
David Leach; ok dtucker@
- (dtucker) [acconfig.h configure.ac defines.h includes.h sshpty.c
openbsd-compat/bsd-misc.c] Add support for Ultrix. No, that's not a typo.
Required changes from Bernhard Simon, integrated by me. ok djm@
20050525
- (djm) [mpaux.c mpaux.h Makefile.in] Remove old mpaux.[ch] code, it has not
been used for a while
- (djm) OpenBSD CVS Sync
- [email protected] 2005/04/05 13:45:31
[ssh-keygen.c]
- [email protected] 2005/04/06 09:43:59
[sshd.c]
avoid harmless logspam by not performing setsockopt() on non-socket;
ok markus@
- [email protected] 2005/04/06 12:26:06
[ssh.c]
Fix debug call for port forwards; patch from pete at seebeyond.com,
ok djm@ (ID sync only - change already in portable)
- [email protected] 2005/04/09 04:32:54
[misc.c misc.h tildexpand.c Makefile.in]
replace tilde_expand_filename with a simpler implementation, ahead of
more whacking; ok deraadt@
- [email protected] 2005/04/14 12:30:30
[ssh.1]
arg to -b is an address, not if_name;
ok markus@
- [email protected] 2005/04/20 10:05:45
[dns.c]
do not try to look up SSHFP for numerical hostname. ok djm@
- [email protected] 2005/04/21 06:17:50
[ssh-add.1 ssh-agent.1 ssh-keygen.1 ssh.1 ssh_config.5 sshd.8]
[sshd_config.5] OpenSSH doesn't ever look at the $HOME environment
variable, so don't say that we do (bz #623); ok deraadt@
- [email protected] 2005/04/21 11:47:19
[ssh.c]
don't allocate a pty when -n flag (/dev/null stdin) is set, patch from
ignasi.roca AT fujitsu-siemens.com (bz #829); ok dtucker@
- [email protected] 2005/04/23 23:43:47
[readpass.c]
Add debug message if read_passphrase can't open /dev/tty; bz #471;
ok djm@
- [email protected] 2005/04/26 12:59:02
[sftp-client.h]
spelling correction in comment from wiz@netbsd;
- [email protected] 2005/04/26 13:08:37
[ssh.c ssh_config.5]
fallback gracefully if client cannot connect to ControlPath. ok djm@
- [email protected] 2005/04/28 10:17:56
[progressmeter.c ssh-keyscan.c]
add snprintf checks. ok djm@ markus@
- [email protected] 2005/05/02 21:13:22
[readpass.c]
missing {}
- [email protected] 2005/05/10 10:28:11
[ssh.c]
print nice error message for EADDRINUSE as well (ID sync only)
- [email protected] 2005/05/10 10:30:43
[ssh.c]
report real errors on fallback from ControlMaster=no to normal connect
- [email protected] 2005/05/16 15:30:51
[readconf.c servconf.c]
check return value from strdelim() for NULL (AddressFamily); mpech
- [email protected] 2005/05/19 02:39:55
[sshd_config.5]
sort config options, from grunk AT pestilenz.org; ok jmc@
- [email protected] 2005/05/19 02:40:52
[sshd_config]
whitespace nit, from grunk AT pestilenz.org
- [email protected] 2005/05/19 02:42:26
[includes.h]
fix cast, from grunk AT pestilenz.org
- [email protected] 2005/05/20 10:50:55
[ssh_config.5]
give a ProxyCommand example using nc(1), with and ok jmc@
- [email protected] 2005/05/20 11:23:32
[ssh_config.5]
oops - article and spacing;
- [email protected] 2005/05/23 22:44:01
[moduli.c ssh-keygen.c]
- removes signed/unsigned comparisons in moduli generation
- use strtonum instead of atoi where its easier
- check some strlcpy overflow and fatal instead of truncate
- [email protected] 2005/05/23 23:32:46
[cipher.c myproposal.h ssh.1 ssh_config.5 sshd_config.5]
add support for draft-harris-ssh-arcfour-fixes-02 improved arcfour modes;
ok markus@
- [email protected] 2005/05/24 02:05:09
[ssh-keygen.c]
some style nits from dmiller@, and use a fatal() instead of a printf()/exit
- [email protected] 2005/05/24 17:32:44
[atomicio.c atomicio.h authfd.c monitor_wrap.c msg.c scp.c sftp-client.c]
[ssh-keyscan.c sshconnect.c]
Switch atomicio to use a simpler interface; it now returns a size_t
(containing number of bytes read/written), and indicates error by
returning 0. EOF is signalled by errno==EPIPE.
Typical use now becomes:
if (atomicio(read, ..., len) != len)
err(1,"read");
ok deraadt@, cloder@, djm@
- (dtucker) [regress/reexec.sh] Add ${EXEEXT} so this test also works on
Cygwin.
- (dtucker) [auth-pam.c] Bug #1033: Fix warnings building with PAM on Linux:
warning: dereferencing type-punned pointer will break strict-aliasing rules
warning: passing arg 3 of `pam_get_item' from incompatible pointer type
The type-punned pointer fix is based on a patch from SuSE's rpm. ok djm@
- (dtucker) [configure.ac openbsd-compat/getrrsetbyname.c] Bug #1033: Provide
templates for _getshort and _getlong if missing to prevent compiler warnings
on Linux.
- (djm) [configure.ac openbsd-compat/Makefile.in]
[openbsd-compat/openbsd-compat.h openbsd-compat/strtonum.c]
Add strtonum(3) from OpenBSD libc, new code needs it.
Unfortunately Linux forces us to do a bizarre dance with compiler
options to get LLONG_MIN/MAX; Spotted by and ok dtucker@
20050524
- (djm) [contrib/caldera/openssh.spec contrib/redhat/openssh.spec]
[contrib/suse/openssh.spec] Update spec file versions to 4.1p1
- (dtucker) [auth-pam.c] Since people don't seem to be getting the message
that USE_POSIX_THREADS is unsupported, not recommended and generally a bad
idea, it is now known as UNSUPPORTED_POSIX_THREADS_HACK. Attempting to use
USE_POSIX_THREADS will now generate an error so we don't silently change
behaviour. ok djm@
- (dtucker) [openbsd-compat/bsd-cygwin_util.c] Ensure sufficient memory
allocation when retrieving core Windows environment. Add CYGWIN variable
to propagated variables. Patch from vinschen at redhat.com, ok djm@
- Release 4.1p1
20050524
- (djm) [openbsd-compat/readpassphrase.c] bz #950: Retry tcsetattr to ensure
terminal modes are reset correctly. Fix from peak AT argo.troja.mff.cuni.cz;
"looks ok" dtucker@
20050512
- (tim) [buildpkg.sh.in] missing ${PKG_INSTALL_ROOT} in init script
hard link section. Bug 1038.
20050509
- (dtucker) [contrib/cygwin/ssh-host-config] Add a test and warning for a
user-mode mounts in Cygwin installation. Patch from vinschen at redhat.com.
20050504
- (djm) [ssh.c] some systems return EADDRINUSE on a bind to an already-used
unix domain socket, so catch that too; from jakob@ ok dtucker@
20050503
- (dtucker) [canohost.c] normalise socket addresses returned by
get_remote_hostname(). This means that IPv4 addresses in log messages
on IPv6 enabled machines will no longer be prefixed by "::ffff:" and
AllowUsers, DenyUsers, AllowGroups, DenyGroups will match IPv4-style
addresses only for 4-in-6 mapped connections, regardless of whether
or not the machine is IPv6 enabled. ok djm@
20050425
- (dtucker) [regress/multiplex.sh] Use "kill -0 $pid" to check for the
existence of a process since it's more portable. Found by jbasney at
ncsa.uiuc.edu; ok tim@
- (dtucker) [regress/multiplex.sh] Remove cleanup call since test-exec.sh
will clean up anyway. From tim@
- (dtucker) [regress/multiplex.sh] Put control socket in /tmp so running
"make tests" works even if you're building on a filesystem that doesn't
support sockets. From deengert at anl.gov, ok djm@
20050424
- (dtucker) [INSTALL configure.ac] Make zlib version check test for 1.1.4 or
1.2.1.2 or higher. With tim@, ok djm@
20050423
- (tim) [config.guess] Add support for OpenServer 6.
20050421
- (dtucker) [session.c] Bug #1024: Don't check pam_session_is_open if
UseLogin is set as PAM is not used to establish credentials in that
case. Found by Michael Selvesteen, ok djm@
20050419
- (dtucker) [INSTALL] Reference README.privsep for the privilege separation
requirements. Pointed out by Bengt Svensson.
- (dtucker) [INSTALL] Put the s/key text and URL back together.
- (dtucker) [INSTALL] Fix s/key text too.
20050411
- (tim) [configure.ac] UnixWare needs PASSWD_NEEDS_USERNAME
20050405
- (dtucker) [configure.ac] Define HAVE_SO_PEERCRED if we have it. ok djm@
- (dtucker) [auth-sia.c] Constify sys_auth_passwd, fixes build error on
Tru64. Patch from cmadams at hiwaay.net.
- (dtucker) [auth-passwd.c auth-sia.h] Remove duplicate definitions of
sys_auth_passwd, pointed out by cmadams at hiwaay.net.
20050403
- (djm) OpenBSD CVS Sync
- [email protected] 2005/03/31 18:39:21
[scp.c]
copy argv[] element instead of smashing the one that ps will see; ok otto
- [email protected] 2005/04/02 12:41:16
[scp.c]
since ssh has xstrdup, use it instead of strdup+test. unbreaks -Werror
build
- (dtucker) [monitor.c] Don't free buffers in audit functions, monitor_read
will free as needed. ok tim@ djm@
20050331
- (dtucker) OpenBSD CVS Sync
- [email protected] 2005/03/16 11:10:38
[ssh_config.5]
get the syntax right for {Local,Remote}Forward;
based on a diff from markus;
problem report from ponraj;
ok dtucker@ markus@ deraadt@
- [email protected] 2005/03/16 21:17:39
[version.h]
4.1
- [email protected] 2005/03/18 17:05:00
[sshd_config.5]
typo;
- (dtucker) [auth.h sshd.c openbsd-compat/port-aix.c] Bug #1006: fix bug in
handling of password expiry messages returned by AIX's authentication
routines, originally reported by robvdwal at sara.nl.
- (dtucker) [ssh.c] Prevent null pointer deref in port forwarding debug
message on some platforms. Patch from pete at seebeyond.com via djm.
- (dtucker) [monitor.c] Remaining part of fix for bug #1006.
20050329
- (dtucker) [contrib/aix/buildbff.sh] Bug #1005: Look up only the user we're
interested in which is much faster in large (eg LDAP or NIS) environments.
Patch from dleonard at vintela.com.
20050321
- (dtucker) [configure.ac] Prevent configure --with-zlib from adding -Iyes
and -Lyes to CFLAGS and LIBS. Pointed out by peter at slagheap.net,
with & ok tim@
- (dtucker) [configure.ac] Make configure error out if the user specifies
--with-libedit but the required libs can't be found, rather than silently
ignoring and continuing. ok tim@
- (dtucker) [configure.ac openbsd-compat/port-aix.h] Prevent redefinitions
of setauthdb on AIX 5.3, reported by anders.liljegren at its.uu.se.
20050317
- (tim) [configure.ac] Bug 998. Make path for --with-opensc optional.
Make --without-opensc work.
- (tim) [configure.ac] portability changes on test statements. Some shells
have problems with -a operator.
- (tim) [configure.ac] make some configure options a little more error proof.
- (tim) [configure.ac] remove trailing white space.
20050314
- (dtucker) OpenBSD CVS Sync
- [email protected] 2005/03/10 10:15:02
[readconf.c]
Check listen addresses for null, prevents xfree from dying during
ClearAllForwardings (bz #996). From Craig Leres, ok markus@
- [email protected] 2005/03/10 22:01:05
[misc.c ssh-keygen.c servconf.c clientloop.c auth-options.c ssh-add.c
monitor.c sftp-client.c bufaux.h hostfile.c ssh.c sshconnect.c channels.c
readconf.c bufaux.c sftp.c]
spacing
- [email protected] 2005/03/10 22:40:38
[auth-options.c]
spacing
- [email protected] 2005/03/11 14:59:06
[ssh-keygen.c]
typo, missing \n; mpech
- [email protected] 2005/03/12 11:55:03
[ssh_config.5]
escape `.' at eol to avoid double spacing issues;
- [email protected] 2005/03/14 10:09:03
[ssh-keygen.1]
Correct description of -H (bz #997); ok markus@, punctuation jmc@
- [email protected] 2005/03/14 11:44:42
[auth.c]
Populate host for log message for logins denied by AllowUsers and
DenyUsers (bz #999); ok markus@ (patch by tryponraj at gmail.com)
- [email protected] 2005/03/14 11:46:56
[buffer.c buffer.h channels.c]
limit input buffer size for channels; bugzilla #896; with and ok dtucker@
- (tim) [contrib/caldera/openssh.spec] links in rc?.d were getting trashed
with a rpm -F
20050313
- (dtucker) [contrib/cygwin/ssh-host-config] Makes the query for the
localized name of the local administrators group more reliable. From
vinschen at redhat.com.
20050312
- (dtucker) [regress/test-exec.sh] DEBUG can cause problems where debug
output ends up in the client's output, causing regress failures. Found
by Corinna Vinschen.
20050309
- (dtucker) [regress/test-exec.sh] Set BIN_SH=xpg4 on OSF1/Digital Unix/Tru64
so that regress tests behave. From Chris Adams.
- (djm) OpenBSD CVS Sync
- [email protected] 2005/03/07 23:41:54
[ssh.1 ssh_config.5]
more macro simplification;
- [email protected] 2005/03/08 23:49:48
[version.h]
OpenSSH 4.0
- (djm) [contrib/caldera/openssh.spec contrib/redhat/openssh.spec]
[contrib/suse/openssh.spec] Update spec file versions
- (djm) [log.c] Fix dumb syntax error; ok dtucker@
- (djm) Release OpenSSH 4.0p1
20050307
- (dtucker) [configure.ac] Disable gettext search when configuring with
BSM audit support for the time being. ok djm@
- (dtucker) OpenBSD CVS Sync (regress/)
- [email protected] 2004/12/10 01:31:30
[Makefile sftp-glob.sh]
some globbing regress; prompted and ok djm@
- [email protected] 2005/01/14 04:21:18
[Makefile test-exec.sh]
pass the SUDO make variable to the individual sh tests; ok dtucker@ markus@
- [email protected] 2005/02/27 11:33:30
[multiplex.sh test-exec.sh sshd-log-wrapper.sh]
Add optional capability to log output from regress commands; ok markus@
Use with: make TEST_SSH_LOGFILE=/tmp/regress.log
- [email protected] 2005/02/27 23:13:36
[login-timeout.sh]
avoid nameservice lookups in regress test; ok dtucker@
- [email protected] 2005/03/04 08:48:46
[Makefile envpass.sh]
regress test for SendEnv config parsing bug; ok dtucker@
- (dtucker) [regress/test-exec.sh] Put SUDO in the right place.
- (tim) [configure.ac] SCO 3.2v4.2 no longer supported.
20050306
- (dtucker) [monitor.c] Bug #125 comment #47: fix errors returned by monitor
when attempting to audit disconnect events. Reported by Phil Dibowitz.
- (dtucker) [session.c sshd.c] Bug #125 comment #49: Send disconnect audit
events earlier, prevents mm_request_send errors reported by Matt Goebel.
20050305
- (djm) [contrib/cygwin/README] Improve Cygwin build documentation. Patch
from vinschen at redhat.com
- (djm) OpenBSD CVS Sync
- [email protected] 2005/03/02 11:45:01
[ssh.1]
missing word;
- [email protected] 2005/03/04 08:48:06
[readconf.c]
fix SendEnv config parsing bug found by Roumen Petrov; ok dtucker@
20050302
- (djm) OpenBSD CVS sync:
- [email protected] 2005/03/01 14:47:58
[ssh.1]
remove some unneccesary macros;
do not mark up punctuation;
- [email protected] 2005/03/01 14:55:23
[ssh_config.5]
do not mark up punctuation;
whitespace;
- [email protected] 2005/03/01 14:59:49
[sshd.8]
new sentence, new line;
whitespace;
- [email protected] 2005/03/01 15:05:00
[ssh-keygen.1]
whitespace;
- [email protected] 2005/03/01 15:47:14
[ssh-keyscan.1 ssh-keyscan.c]
sort options and sync usage();
- [email protected] 2005/03/01 17:19:35
[scp.1 sftp.1]
add HashKnownHosts to -o list;
ok markus@
- [email protected] 2005/03/01 17:22:06
[ssh.c]
sync usage() w/ man SYNOPSIS;
ok markus@
- [email protected] 2005/03/01 17:32:19
[ssh-add.1]
sort options;
- [email protected] 2005/03/01 18:15:56
[ssh-keygen.1]
sort options (no attempt made at synopsis clean up though);
spelling (occurance -> occurrence);
use prompt before examples;
grammar;
- [email protected] 2005/03/02 01:00:06
[sshconnect.c]
fix addition of new hashed hostnames when CheckHostIP=yes;
found and ok dtucker@
- [email protected] 2005/03/02 01:27:41
[ssh-keygen.c]
ignore hostnames with metachars when hashing; ok deraadt@
- [email protected] 2005/03/02 02:21:07
[ssh.1]
bz#987: mention ForwardX11Trusted in ssh.1,
reported by andrew.benham AT thus.net; ok deraadt@
- (tim) [regress/agent-ptrace.sh] add another possible gdb error.
20050301
- (djm) OpenBSD CVS sync:
- [email protected] 2005/02/16 09:56:44
[ssh.c]
Better diagnostic if an identity file is not accesible. ok markus@ djm@
- [email protected] 2005/02/18 03:05:53
[canohost.c]
better error messages for getnameinfo failures; ok dtucker@
- [email protected] 2005/02/20 22:59:06
[sftp.c]
turn on ssh batch mode when in sftp batch mode, patch from
jdmossh AT nand.net;
ok markus@
- [email protected] 2005/02/25 10:55:13
[sshd.8]
add /etc/motd and $HOME/.hushlogin to FILES;
from michael knudsen;
- [email protected] 2005/02/28 00:54:10
[ssh_config.5]
bz#849: document timeout on untrusted x11 forwarding sessions. Reported by
orion AT cora.nwra.com; ok markus@
- [email protected] 2005/03/01 10:09:52
[auth-options.c channels.c channels.h clientloop.c compat.c compat.h]
[misc.c misc.h readconf.c readconf.h servconf.c ssh.1 ssh.c ssh_config.5]
[sshd_config.5]
bz#413: allow optional specification of bind address for port forwardings.
Patch originally by Dan Astorian, but worked on by several people
Adds GatewayPorts=clientspecified option on server to allow remote
forwards to bind to client-specified ports.
- [email protected] 2005/03/01 10:40:27
[hostfile.c hostfile.h readconf.c readconf.h ssh.1 ssh_config.5]
[sshconnect.c sshd.8]
add support for hashing host names and addresses added to known_hosts
files, to improve privacy of which hosts user have been visiting; ok
markus@ deraadt@
- [email protected] 2005/03/01 10:41:28
[ssh-keyscan.1 ssh-keyscan.c]
option to hash hostnames output by ssh-keyscan; ok markus@ deraadt@
- [email protected] 2005/03/01 10:42:49
[ssh-keygen.1 ssh-keygen.c ssh_config.5]
add tools for managing known_hosts files with hashed hostnames, including
hashing existing files and deleting hosts by name; ok markus@ deraadt@
20050226
- (dtucker) [openbsd-compat/bsd-openpty.c openbsd-compat/inet_ntop.c]
Remove two obsolete Cygwin #ifdefs. Patch from vinschen at redhat.com.
- (dtucker) [acconfig.h configure.ac openbsd-compat/bsd-misc.{c,h}]
Remove SETGROUPS_NOOP, was only used by Cygwin, which doesn't need it any
more. Patch from vinschen at redhat.com.
- (dtucker) [Makefile.in] Add a install-nosysconf target for installing the
binaries without the config files. Primarily useful for packaging.
Patch from phil at usc.edu. ok djm@
20050224
- (djm) [configure.ac] in_addr_t test needs sys/types.h too
20050222
- (dtucker) [uidswap.c] Skip uid restore test on Cygwin. Patch from
vinschen at redhat.com.
20050220
- (dtucker) [LICENCE Makefile.in README.platform audit-bsm.c configure.ac
defines.h] Bug #125: Add *EXPERIMENTAL* BSM audit support. Configure
--with-audit=bsm to enable. Patch originally from Sun Microsystems,
parts by John R. Jackson. ok djm@
- (dtucker) [configure.ac] Missing comma in AIX section, somehow causes
unrelated platforms to be configured incorrectly.
20050216
- (djm) write seed to temporary file and atomically rename into place;
ok dtucker@
- (dtucker) [ssh-rand-helper.c] Provide seed_rng since it may be called
via mkstemp in some configurations. ok djm@
- (dtucker) [auth-shadow.c] Prevent compiler warnings if "DAY" is defined
by the system headers.
- (dtucker) [configure.ac] Bug #893: check for libresolv early on Reliant
Unix; prevents problems relating to the location of -lresolv in the
link order.
- (dtucker) [session.c] Bug #918: store credentials from gssapi-with-mic
authentication early enough to be available to PAM session modules when
privsep=yes. Patch from deengert at anl.gov, ok'ed in principle by Sam
Hartman and similar to Debian's ssh-krb5 package.
- (dtucker) [configure.ac openbsd-compat/port-aix.{c,h}] Silence some more
compiler warnings on AIX.
20050215
- (dtucker) [config.sh.in] Collect oslevel -r too.
- (dtucker) [README.platform auth.c configure.ac loginrec.c
openbsd-compat/port-aix.c openbsd-compat/port-aix.h] Bug #835: enable IPv6
on AIX where possible (see README.platform for details) and work around
a misfeature of AIX's getnameinfo. ok djm@
- (dtucker) [loginrec.c] Add missing #include.
20050211
- (dtucker) [configure.ac] Tidy up configure --help output.
- (dtucker) [openbsd-compat/fake-rfc2553.h] We now need EAI_SYSTEM too.
20050210
- (dtucker) [configure.ac] Bug #919: Provide visible feedback for the
--disable-etc-default-login configure option.
20050209
- (dtucker) OpenBSD CVS Sync
- [email protected] 2005/01/28 09:45:53
[ssh_config]
Make it clear that the example entries in ssh_config are only some of the
commonly-used options and refer the user to ssh_config(5) for more
details; ok djm@
- [email protected] 2005/01/28 15:05:43
[ssh_config.5]
grammar;
- [email protected] 2005/01/28 18:14:09
[ssh_config.5]
wording;
ok markus@
- [email protected] 2005/01/30 11:18:08
[monitor.c]
Make code match intent; ok djm@
- [email protected] 2005/02/08 22:24:57
[sshd.c]
Provide reason in error message if getnameinfo fails; ok markus@
- (dtucker) [auth-passwd.c openbsd-compat/port-aix.c] Don't call
disable_forwarding() from compat library. Prevent linker errrors trying
to resolve it for binaries other than sshd. ok djm@
- (dtucker) [configure.ac] Bug #854: prepend pwd to relative --with-ssl-dir
paths. ok djm@
- (dtucker) [configure.ac session.c] Some platforms (eg some SCO) require
the username to be passed to the passwd command when changing expired
passwords. ok djm@
20050208
- (dtucker) [regress/test-exec.sh] Bug #912: Set _POSIX2_VERSION for the
regress tests so newer versions of GNU head(1) behave themselves. Patch
by djm, so ok me.
- (dtucker) [openbsd-compat/port-aix.c] Silence compiler warnings.
- (dtucker) [audit.c audit.h auth.c auth1.c auth2.c loginrec.c monitor.c
monitor_wrap.c monitor_wrap.h session.c sshd.c]: Prepend all of the audit
defines and enums with SSH_ to prevent namespace collisions on some
platforms (eg AIX).
20050204
- (dtucker) [monitor.c] Permit INVALID_USER audit events from slave too.
- (dtucker) [auth.c] Fix parens in audit log check.
20050202
- (dtucker) [configure.ac openbsd-compat/realpath.c] Sync up with realpath
rev 1.11 from OpenBSD and make it use fchdir if available. ok djm@
- (dtucker) [auth.c loginrec.h openbsd-compat/{bsd-cray,port-aix}.{c,h}]
Make record_failed_login() call provide hostname rather than having the
implementations having to do lookups themselves. Only affects AIX and
UNICOS (the latter only uses the "user" parameter anyway). ok djm@
- (dtucker) [session.c sshd.c] Bug #445: Propogate KRB5CCNAME if set to child
the process. Since we also unset KRB5CCNAME at startup, if it's set after
authentication it must have been set by the platform's native auth system.
This was already done for AIX; this enables it for the general case.
- (dtucker) [auth.c canohost.c canohost.h configure.ac defines.h loginrec.c]
Bug #974: Teach sshd to write failed login records to btmp for failed auth
attempts (currently only for password, kbdint and C/R, only on Linux and
HP-UX), based on code from login.c from util-linux. With ashok_kovai at
hotmail.com, ok djm@
- (dtucker) [Makefile.in auth.c auth.h auth1.c auth2.c loginrec.c monitor.c
monitor.h monitor_wrap.c monitor_wrap.h session.c sshd.c] Bug #125:
(first stage) Add audit instrumentation to sshd, currently disabled by
default. with suggestions from and ok djm@
20050201
- (dtucker) [log.c] Bug #973: force log_init() to open syslog, since on some
platforms syslog will revert to its default values. This may result in
messages from external libraries (eg libwrap) being sent to a different
facility.
- (dtucker) [sshd_config.5] Bug #701: remove warning about
keyboard-interactive since this is no longer the case.
20050124
- (dtucker) OpenBSD CVS Sync
- [email protected] 2005/01/21 08:32:02
[auth-passwd.c sshd.c]
Warn in advance for password and account expiry; initialize loginmsg
buffer earlier and clear it after privsep fork. ok and help dtucker@
markus@
- [email protected] 2005/01/22 08:17:59
[auth.c]
Log source of connections denied by AllowUsers, DenyUsers, AllowGroups and
DenyGroups. bz #909, ok djm@
- [email protected] 2005/01/23 10:18:12
[cipher.c]
config option "Ciphers" should be case-sensitive; ok dtucker@
- [email protected] 2005/01/24 10:22:06
[scp.c sftp.c]
Have scp and sftp wait for the spawned ssh to exit before they exit
themselves. This prevents ssh from being unable to restore terminal
modes (not normally a problem on OpenBSD but common with -Portable
on POSIX platforms). From peak at argo.troja.mff.cuni.cz (bz#950);
ok djm@ markus@
- [email protected] 2005/01/24 10:29:06
[moduli]
Import new moduli; requested by deraadt@ a week ago
- [email protected] 2005/01/24 11:47:13
[auth-passwd.c]
#if -> #ifdef so builds without HAVE_LOGIN_CAP work too; ok djm@ otto@
20050120
- (dtucker) OpenBSD CVS Sync
- [email protected] 2004/12/23 17:35:48
[session.c]
check for NULL; from mpech
- [email protected] 2004/12/23 17:38:07
[ssh-keygen.c]
leak; from mpech
- [email protected] 2004/12/23 23:11:00
[servconf.c servconf.h sshd.c sshd_config sshd_config.5]
bz #898: support AddressFamily in sshd_config. from
[email protected]; ok deraadt@
- [email protected] 2005/01/05 08:51:32
[sshconnect.c]
remove dead code, log connect() failures with level error, ok djm@
- [email protected] 2005/01/08 00:41:19
[sshd_config.5]
`login'(n) -> `log in'(v);
- [email protected] 2005/01/17 03:25:46
[moduli.c]
Correct spelling: SCHNOOR->SCHNORR; ok djm@
- [email protected] 2005/01/17 22:48:39
[sshd.c]
Make debugging output continue after reexec; ok djm@
- [email protected] 2005/01/19 13:11:47
[auth-bsdauth.c auth2-chall.c]
Have keyboard-interactive code call the drivers even for responses for
invalid logins. This allows the drivers themselves to decide how to
handle them and prevent leaking information where possible. Existing
behaviour for bsdauth is maintained by checking authctxt->valid in the
bsdauth driver. Note that any third-party kbdint drivers will now need
to be able to handle responses for invalid logins. ok markus@
- [email protected] 2004/12/22 02:13:19
[cipher-ctr.c cipher.c]
remove fallback AES support for old OpenSSL, as OpenBSD has had it for
many years now; ok deraadt@
(Id sync only: Portable will continue to support older OpenSSLs)
- (dtucker) [auth-pam.c] Bug #971: Prevent leaking information about user
existence via keyboard-interactive/pam, in conjunction with previous
auth2-chall.c change; with Colin Watson and djm.
- (dtucker) [loginrec.h] Bug #952: Increase size of username field to 128
bytes to prevent errors from login_init_entry() when the username is
exactly 64 bytes(!) long. From brhamon at cisco.com, ok djm@
- (dtucker) [auth-chall.c auth.h auth2-chall.c] Bug #936: Remove pam from
the list of available kbdint devices if UsePAM=no. ok djm@
20050118
- (dtucker) [INSTALL Makefile.in configure.ac survey.sh.in] Implement
"make survey" and "make send-survey". This will provide data on the
configure parameters, platform and platform features to the development
team, which will allow (among other things) better targetting of testing.
It's entirely voluntary and is off be default. ok djm@
- (dtucker) [survey.sh.in] Remove any blank lines from the output of
ccver-v and ccver-V.
20041220
- (dtucker) [ssh-rand-helper.c] Fall back to command-based seeding if reading
from prngd is enabled at compile time but fails at run time, eg because
prngd is not running. Note that if you have prngd running when OpenSSH is
built, OpenSSL will consider itself internally seeded and rand-helper won't
be built at all unless explicitly enabled via --with-rand-helper. ok djm@
- (dtucker) [regress/rekey.sh] Touch datafile before filling with dd, since
on some wacky platforms (eg old AIXes), dd will refuse to create an output
file if it doesn't exist.
20041213
- (dtucker) [contrib/findssh.sh] Clean up on interrupt; from
amarendra.godbole at ge com.
20041211
- (dtucker) OpenBSD CVS Sync
- [email protected] 2004/12/06 16:00:43
[bufaux.c]
use 0x00 not \0 since buf[] is a bignum
- [email protected] 2004/12/10 03:10:42
[sftp.c]
- fix globbed ls for paths the same lenght as the globbed path when
we have a unique matching.
- fix globbed ls in case of a directory when we have a unique matching.
- as a side effect, if the path does not exist error (used to silently
ignore).
- don't do extra do_lstat() if we only have one matching file.
djm@ ok
- [email protected] 2004/12/11 01:48:56
[auth-rsa.c auth2-pubkey.c authfile.c misc.c misc.h]
Fix debug call in error path of authorized_keys processing and fix related
warnings; ok djm@
20041208
- (tim) [configure.ac] Comment some non obvious platforms in the
target-specific case statement. Suggested and OK by dtucker@
20041207
- (dtucker) [regress/scp.sh] Use portable-friendly $DIFFOPTs in new test.
20041206
- (dtucker) [TODO WARNING.RNG] Update to reflect current reality. ok djm@
- (dtucker) OpenBSD CVS Sync
- [email protected] 2004/11/25 22:22:14
[sftp-client.c sftp.c]
leak; from mpech
- [email protected] 2004/11/29 00:05:17
[sftp.1]
missing full stop;
- [email protected] 2004/11/29 07:41:24
[sftp-client.h sftp.c]
Some small fixes from [email protected]. ok deraadt@
- [email protected] 2004/12/05 23:55:07
[sftp.1]
- explain that patterns can be used as arguments in get/put/ls/etc
commands (prodded by Michael Knudsen)
- describe ls flags as a list
- other minor improvements
ok jmc, djm
- [email protected] 2004/12/06 11:41:03
[auth-rsa.c auth2-pubkey.c authfile.c misc.c misc.h ssh.h sshd.8]
Discard over-length authorized_keys entries rather than complaining when
they don't decode. bz #884, with & ok djm@
- (dtucker) OpenBSD CVS Sync (regress/)
- [email protected] 2004/06/26 06:16:07
[reexec.sh]
don't change the name of the copied sshd for the reexec fallback test,
makes life simpler for portable
- [email protected] 2004/07/08 12:59:35
[scp.sh]
Regress test for bz #863 (scp double-error), requires $SUDO. ok markus@
- [email protected] 2004/07/09 19:45:43
[Makefile]
add a missing CLEANFILES used in the re-exec test
- [email protected] 2004/10/08 02:01:50
[reexec.sh]
shrink and tidy; ok dtucker@
- [email protected] 2004/10/29 23:59:22
[Makefile added brokenkeys.sh]
regression test for handling of corrupt keys in authorized_keys file
- [email protected] 2004/11/07 00:32:41
[multiplex.sh]
regression tests for new multiplex commands
- [email protected] 2004/11/25 09:39:27
[test-exec.sh]
Remove obsolete RhostsAuthentication from test config; ok markus@
- [email protected] 2004/12/06 10:49:56
[test-exec.sh]
Check if TEST_SSH_SSHD is a full path to sshd before searching; ok markus@
20041203
- (dtucker) OpenBSD CVS Sync
- [email protected] 2004/11/07 17:42:36
[ssh.1]
options sort, and whitespace;
- [email protected] 2004/11/07 17:57:30
[ssh.c]
usage():
- add -O
- sync -S w/ manpage
- remove -h
- (dtucker) [auth1.c auth2.c] If the user successfully authenticates but is
subsequently denied by the PAM auth stack, send the PAM message to the
user via packet_disconnect (Protocol 1) or userauth_banner (Protocol 2).
ok djm@
20041107
- (dtucker) OpenBSD CVS Sync
- [email protected] 2004/11/05 12:19:56
[sftp.c]
command editing and history support via libedit; ok markus@
thanks to hshoexer@ and many testers on tech@ too
- [email protected] 2004/11/07 00:01:46
[clientloop.c clientloop.h ssh.1 ssh.c]
add basic control of a running multiplex master connection; including the
ability to check its status and request it to exit; ok markus@
- (dtucker) [INSTALL Makefile.in configure.ac] Add --with-libedit configure
option and supporting makefile bits and documentation.
20041105
- (dtucker) OpenBSD CVS Sync
- [email protected] 2004/08/30 09:18:08
[LICENCE]
s/keygen/keyscan/
- [email protected] 2004/08/30 21:22:49
[ssh-add.1 ssh.1]
.Xsession -> .xsession;
originally from a pr from f at obiit dot org, but missed by myself;
ok markus@ matthieu@
- [email protected] 2004/09/07 23:41:30
[clientloop.c ssh.c]
cleanup multiplex control socket on SIGHUP too, spotted by sturm@
ok markus@ deraadt@
- [email protected] 2004/09/15 00:46:01
[ssh.c]
/* fallthrough */ is something a programmer understands. But
/* FALLTHROUGH */ is also understood by lint, so that is better.
- [email protected] 2004/09/15 03:25:41
[sshd_config.5]
mention PrintLastLog only prints last login time for interactive
sessions, like PrintMotd mentions.
From Michael Knudsen, with wording changed slightly to match the
PrintMotd description.
ok djm
- [email protected] 2004/09/15 18:42:27
[sshd.c]
use less doubles in daemons; markus@ ok
- [email protected] 2004/09/15 18:46:04
[scp.c]
scratch that do { } while (0) wrapper in this case
- [email protected] 2004/09/23 13:00:04
[ssh.c]
correctly honour -n in multiplex client mode; spotted by sturm@ ok markus@
- [email protected] 2004/09/25 03:45:14
[sshd.c]
these printf args are no longer double; ok deraadt@ markus@
- [email protected] 2004/10/07 10:10:24
[scp.1 sftp.1 ssh.1 ssh_config.5]
document KbdInteractiveDevices; ok markus@
- [email protected] 2004/10/07 10:12:36
[ssh-agent.c]
don't unlink agent socket when bind() fails, spotted by rich AT
rich-paul.net, ok markus@
- [email protected] 2004/10/20 11:48:53
[packet.c ssh1.h]
disconnect for invalid (out of range) message types.
- [email protected] 2004/10/29 21:47:15
[channels.c channels.h clientloop.c]
fix some window size change bugs for multiplexed connections: windows sizes
were not being updated if they had changed after ~^Z suspends and SIGWINCH
was not being processed unless the first connection had requested a tty;
ok markus
- [email protected] 2004/10/29 22:53:56
[clientloop.c misc.h readpass.c ssh-agent.c]
factor out common permission-asking code to separate function; ok markus@
- [email protected] 2004/10/29 23:56:17
[bufaux.c bufaux.h buffer.c buffer.h]
introduce a new buffer API that returns an error rather than fatal()ing
when presented with bad data; ok markus@
- [email protected] 2004/10/29 23:57:05
[key.c]
use new buffer API to avoid fatal errors on corrupt keys in authorized_keys
files; ok markus@
20041102
- (dtucker) [configure.ac includes.h] Bug #947: Fix compile error on HP-UX
10.x by testing for conflicts in shadow.h and undef'ing _INCLUDE__STDC__
only if a conflict is detected.
20041019
- (dtucker) [uidswap.c] Don't test dropping of gids for the root user or
on Cygwin. Cygwin parts from vinschen at redhat com; ok djm@
20041016
- (djm) [auth-pam.c] snprintf->strl*, fix server message length calculations;
ok dtucker@
20041006
- (dtucker) [README.privsep] Bug #939: update info about HP-UX Trusted Mode
and other PAM platforms.
- (dtucker) [monitor_mm.c openbsd-compat/xmmap.c] Bug #940: cast constants
to void * to appease picky compilers (eg Tru64's "cc -std1").
20040930
- (dtucker) [configure.ac] Set AC_PACKAGE_NAME. ok djm@
20040923
- (dtucker) [openbsd-compat/bsd-snprintf.c] Previous change was off by one,
which could have caused the justification to be wrong. ok djm@
20040921
- (dtucker) [openbsd-compat/bsd-snprintf.c] Check for max length too.
ok djm@
- (dtucker) [contrib/cygwin/ssh-host-config] Update to match current Cygwin
install process. Patch from vinschen at redhat.com.
20040912
- (djm) [loginrec.c] Start KNF and tidy up of this long-neglected file.
No change in resultant binary
- (djm) [loginrec.c] __func__ifiy
- (djm) [loginrec.c] xmalloc
- (djm) [ssh.c sshd.c version.h] Don't divulge portable version in protocol
banner. Suggested by deraadt@, ok mouring@, dtucker@
- (dtucker) [configure.ac] Fix incorrect quoting and tests for cross-compile.
Partly by & ok djm@.
20040911
- (djm) [ssh-agent.c] unifdef some cygwin code; ok dtucker@
- (dtucker) [auth-pam.c auth-pam.h session.c] Bug #890: Send output from
failing PAM session modules to user then exit, similar to the way
/etc/nologin is handled. ok djm@
- (dtucker) [auth-pam.c] Relocate sshpam_store_conv(), no code change.
- (djm) [auth2-kbdint.c auth2-none.c auth2-passwd.c auth2-pubkey.c]
Make cygwin code more consistent with that which surrounds it
- (dtucker) [auth-pam.c auth.h auth2-none.c auth2.c monitor.c monitor_wrap.c]
Bug #892: Send messages from failing PAM account modules to the client via
SSH2_MSG_USERAUTH_BANNER messages. Note that this will not happen with
SSH2 kbdint authentication, which need to be dealt with separately. ok djm@
- (dtucker) [session.c] Bug #927: make .hushlogin silent again. ok djm@
- (dtucker) [configure.ac] Bug #321: Add cross-compile support to configure.
Parts by chua at ayrnetworks.com, astrand at lysator.liu.se and me. ok djm@
- (dtucker) [auth-krb5.c] Bug #922: Pass KRB5CCNAME to PAM. From deengert
at anl.gov, ok djm@
20040830
- (dtucker) [session.c openbsd-compat/bsd-cygwin_util.{c,h}] Bug #915: only
copy required environment variables on Cygwin. Patch from vinschen at
redhat.com, ok djm@
- (dtucker) [regress/Makefile] Clean scp-ssh-wrapper.scp too. Patch from
vinschen at redhat.com.
- (dtucker) [Makefile.in contrib/ssh-copy-id] Bug #894: Improve portability
of shell constructs. Patch from cjwatson at debian.org.
20040829
- (dtucker) [openbsd-compat/getrrsetbyname.c] Prevent getrrsetbyname from
failing with NOMEMORY if no sigs are returned and malloc(0) returns NULL.
From Martin.Kraemer at Fujitsu-Siemens.com; ok djm@
- (dtucker) OpenBSD CVS Sync
- [email protected] 2004/08/23 11:48:09
[authfile.c]
fix error path, spotted by Martin.Kraemer AT Fujitsu-Siemens.com; ok markus
- [email protected] 2004/08/23 11:48:47
[channels.c]
typo, spotted by Martin.Kraemer AT Fujitsu-Siemens.com; ok markus
- [email protected] 2004/08/23 14:26:38
[ssh-keysign.c ssh.c]
Use permanently_set_uid() in ssh and ssh-keysign for consistency, matches
change in Portable; ok markus@ (CVS ID sync only)
- [email protected] 2004/08/23 14:29:23
[ssh-keysign.c]
Remove duplicate getuid(), suggested by & ok markus@
- [email protected] 2004/08/26 16:00:55
[ssh.1 sshd.8]
get rid of references to rhosts authentication; with jmc@
- [email protected] 2004/08/28 01:01:48
[sshd.c]
don't erroneously close stdin for !reexec case, from Dave Johnson;
ok markus@
- (dtucker) [configure.ac] Include sys/stream.h in sys/ptms.h header check,
fixes configure warning on Solaris reported by wknox at mitre.org.
- (dtucker) [regress/multiplex.sh] Skip test on platforms that do not
support FD passing since multiplex requires it. Noted by tim@
- (dtucker) [regress/dynamic-forward.sh] Allow time for connections to be torn
down, needed on some platforms, should be harmless on others. Patch from
jason at devrandom.org.
- (dtucker) [regress/scp.sh] Make this work on Cygwin too, which doesn't like
files ending in .exe that aren't binaries; patch from vinschen at redhat.com.
- (dtucker) [Makefile.in] Get regress/Makefile symlink right for out-of-tree
builds too, from vinschen at redhat.com.
- (dtucker) [regress/agent-ptrace.sh] Skip ptrace test on OSF1/DUnix/Tru64
too; patch from cmadams at hiwaay.net.
- (dtucker) [configure.ac] Replace non-portable echo \n with extra echo.
- (dtucker) [openbsd-compat/port-aix.c] Bug #712: Explicitly check for
accounts with authentication configs that sshd can't support (ie
SYSTEM=NONE and AUTH1=something).
20040828
- (dtucker) [openbsd-compat/mktemp.c] Remove superfluous Cygwin #ifdef; from
vinschen at redhat.com.
20040823
- (djm) [ssh-rand-helper.c] Typo. Found by
Martin.Kraemer AT Fujitsu-Siemens.com
- (djm) [loginrec.c] Typo and bad args in error messages; Spotted by
Martin.Kraemer AT Fujitsu-Siemens.com
20040817
- (dtucker) [regress/README.regress] Note compatibility issues with GNU head.
- (djm) OpenBSD CVS Sync
- [email protected] 2004/08/16 08:17:01
[version.h]
3.9
- (djm) Crank RPM spec version numbers
- (djm) Release 3.9p1
20040816
- (dtucker) [acconfig.h auth-pam.c configure.ac] Set real uid to non-root
to convince Solaris PAM to honour password complexity rules. ok djm@
20040815
- (dtucker) [Makefile.in ssh-keysign.c ssh.c] Use permanently_set_uid() since
it does the right thing on all platforms. ok djm@
- (djm) [acconfig.h configure.ac openbsd-compat/Makefile.in
openbsd-compat/bsd-closefrom.c openbsd-compat/bsd-misc.c
openbsd-compat/bsd-misc.h openbsd-compat/openbsd-compat.h] Use smarter
closefrom() replacement from sudo; ok dtucker@
- (djm) [loginrec.c] Check that seek succeeded here too; ok dtucker
- (dtucker) [Makefile.in] Fix typo.
20040814
- (dtucker) [auth-krb5.c gss-serv-krb5.c openbsd-compat/xmmap.c]
Explicitly set umask for mkstemp; ok djm@
- (dtucker) [includes.h] Undef _INCLUDE__STDC__ on HP-UX, otherwise
prot.h and shadow.h provide conflicting declarations of getspnam. ok djm@
- (dtucker) [loginrec.c openbsd-compat/port-aix.c openbsd-compat/port-aix.h]
Plug AIX login recording into login_write so logins will be recorded for
all auth types.
20040813
- (dtucker) [openbsd-compat/bsd-misc.c] Typo in #ifdef; from vinschen at
redhat.com
- (dtucker) OpenBSD CVS Sync
- [email protected] 2004/08/11 21:43:05
[channels.c channels.h clientloop.c misc.c misc.h serverloop.c ssh-agent.c]
some signed/unsigned int comparison cleanups; markus@ ok
- [email protected] 2004/08/11 21:44:32
[authfd.c scp.c ssh-keyscan.c]
use atomicio instead of homegrown equivalents or read/write.
markus@ ok
- [email protected] 2004/08/12 09:18:24
[sshlogin.c]
typo in error message, spotted by moritz AT jodeit.org (Id sync only)
- [email protected] 2004/08/12 21:41:13
[ssh-keygen.1 ssh.1]
improve SSHFP documentation; ok deraadt@
- [email protected] 2004/08/13 00:01:43
[ssh-keygen.1]
kill whitespace at eol;
- [email protected] 2004/08/13 02:51:48
[monitor_fdpass.c]
extra check for no message case; ok markus, deraadt, hshoexer, henning
- [email protected] 2004/08/13 11:09:24
[servconf.c]
Fix line numbers off-by-one in error messages, from tortay at cc.in2p3.fr
ok markus@, djm@
20040812
- (dtucker) [sshd.c] Remove duplicate variable imported during sync.
- (dtucker) OpenBSD CVS Sync
- [email protected] 2004/07/28 08:56:22
[sshd.c]
call setsid() _before_ re-exec
- [email protected] 2004/07/28 09:40:29
[auth.c auth1.c auth2.c cipher.c cipher.h key.c session.c ssh.c
sshconnect1.c]
more s/illegal/invalid/
- [email protected] 2004/08/04 10:37:52
[dh.c]
return group14 when no primes found - fixes hang on empty /etc/moduli;
ok markus@
- [email protected] 2004/08/11 11:09:54
[servconf.c]
Fix minor leak; "looks right" deraadt@
- [email protected] 2004/08/11 11:50:09
[sshd.c]
Don't try to close startup_pipe if it's not open; ok djm@
- [email protected] 2004/08/11 11:59:22
[sshlogin.c]
check that lseek went were we told it to; ok markus@
(Id sync only, but similar changes are needed in loginrec.c)
- [email protected] 2004/08/11 12:01:16
[sshlogin.c]
make store_lastlog_message() static to appease -Wall; ok markus
- (dtucker) [sshd.c] Clear loginmsg in postauth monitor, prevents doubling
messages generated before the postauth privsep split.
20040720
- (djm) OpenBSD CVS Sync
- [email protected] 2004/07/21 08:56:12
[auth.c]
s/Illegal user/Invalid user/; many requests; ok djm, millert, niklas,
miod, ...
- [email protected] 2004/07/21 10:33:31
[auth1.c auth2.c]
bz#899: Don't display invalid usernames in setproctitle
from peak AT argo.troja.mff.cuni.cz; ok markus@
- [email protected] 2004/07/21 10:36:23
[gss-serv-krb5.c]
fix function declaration
- [email protected] 2004/07/21 11:51:29
[canohost.c]
bz#902: cache remote port so we don't fatal() in auth_log when remote
connection goes away quickly. from peak AT argo.troja.mff.cuni.cz;
ok markus@
- (djm) [auth-pam.c] Portable parts of bz#899: Don't display invalid
usernames in setproctitle from peak AT argo.troja.mff.cuni.cz;
20040720
- (djm) [log.c] bz #111: Escape more control characters when sending data
to syslog; from peak AT argo.troja.mff.cuni.cz
- (djm) [contrib/redhat/sshd.pam] bz #903: Remove redundant entries; from
peak AT argo.troja.mff.cuni.cz
- (djm) [regress/README.regress] Remove caveat regarding TCP wrappers, now
that sshd is fixed to behave better; suggested by tim
20040719
- (djm) [openbsd-compat/bsd-arc4random.c] Discard early keystream, like OpenBSD
ok dtucker@
- (djm) [auth-pam.c] Avoid use of xstrdup and friends in conversation function,
instead return PAM_CONV_ERR, avoiding another path to fatal(); ok dtucker@
- (tim) [configure.ac] updwtmpx() on OpenServer seems to add duplicate entry.
Report by rac AT tenzing.org
20040717
- (dtucker) [logintest.c scp.c sftp-server.c sftp.c ssh-add.c ssh-agent.c
ssh-keygen.c ssh-keyscan.c ssh-keysign.c ssh-rand-helper.c ssh.c sshd.c
openbsd-compat/bsd-misc.c] Move "char *__progname" to bsd-misc.c. Reduces
diff vs OpenBSD; ok mouring@, tested by tim@ too.
- (dtucker) OpenBSD CVS Sync
- [email protected] 2004/07/11 17:48:47
[channels.c cipher.c clientloop.c clientloop.h compat.h moduli.c
readconf.c nchan.c pathnames.h progressmeter.c readconf.h servconf.c
session.c sftp-client.c sftp.c ssh-agent.1 ssh-keygen.c ssh.c ssh1.h
sshd.c ttymodes.h]
spaces
- [email protected] 2004/07/12 23:34:25
[ssh-keyscan.1]
Fix incorrect macro, .I -> .Em
From: Eric S. Raymond <esr at thyrsus dot com>
ok jmc@
- [email protected] 2004/07/17 05:31:41
[monitor.c monitor_wrap.c session.c session.h sshd.c sshlogin.c]
Move "Last logged in at.." message generation to the monitor, right
before recording the new login. Fixes missing lastlog message when
/var/log/lastlog is not world-readable and incorrect datestamp when
multiple sessions are used (bz #463); much assistance & ok markus@
20040711
- (dtucker) [auth-pam.c] Check for zero from waitpid() too, which allows
the monitor to properly clean up the PAM thread (Debian bug #252676).
20040709
- (tim) [contrib/cygwin/README] add minires-devel requirement. Patch from
vinschen AT redhat.com
20040708
- (dtucker) OpenBSD CVS Sync
- [email protected] 2004/07/03 05:11:33
[sshlogin.c] (RCSID sync only, the corresponding code is not in Portable)
Use '\0' not 0 for string; ok djm@, deraadt@
- [email protected] 2004/07/03 11:02:25
[monitor_wrap.c]
Put s/key functions inside #ifdef SKEY same as monitor.c,
from des@freebsd via bz #330, ok markus@
- [email protected] 2004/07/08 12:47:21
[scp.c]
Prevent scp from skipping the file following a double-error.
bz #863, ok markus@
20040702
- (dtucker) [mdoc2man.awk] Teach it to ignore .Bk -words, reported by
strube at physik3.gwdg.de a long time ago.
20040701
- (dtucker) [session.c] Call display_loginmsg again after do_pam_session.
Ensures messages from PAM modules are displayed when privsep=no.
- (dtucker) [auth-pam.c] Bug #705: Make arguments match PAM specs, fixes
warnings on compliant platforms. From paul.a.bolton at bt.com. ok djm@
- (dtucker) [auth-pam.c] Bug #559 (last piece): Pass DISALLOW_NULL_AUTHTOK
to pam_authenticate for challenge-response auth too. Originally from
fcusack at fcusack.com, ok djm@
- (tim) [buildpkg.sh.in] Add $REV to bump the package revision within
the same version. Handle the case where someone uses --with-privsep-user=
and the user name does not match the group name. ok dtucker@
20040630
- (dtucker) [auth-pam.c] Check for buggy PAM modules that return a NULL
appdata_ptr to the conversation function. ok djm@
- (djm) OpenBSD CVS Sync
- [email protected] 2004/06/26 09:03:21
[ssh.1]
- remove double word
- rearrange .Bk to keep SYNOPSIS nice
- -M before -m in options description
- [email protected] 2004/06/26 09:11:14
[ssh_config.5]
punctuation and grammar fixes. also, keep the options in order.
- [email protected] 2004/06/26 09:14:40
[sshd_config.5]
new sentence, new line;
- [email protected] 2004/06/26 20:07:16
[sshd.c]
initialise some fd variables to -1, djm@ ok
- [email protected] 2004/06/30 08:36:59
[session.c]
unbreak TTY break, diagnosed by darren AT dazwin.com; ok markus@
20040627
- (tim) update README files.
- (dtucker) [mdoc2man.awk] Bug #883: correctly recognise .Pa and .Ev macros.
- (dtucker) [regress/README.regress] Document new variables.
- (dtucker) [acconfig.h configure.ac sftp-server.c] Bug #823: add sftp
rename handling for Linux which returns EPERM for link() on (at least some)
filesystems that do not support hard links. sftp-server will fall back to
stat+rename() in such cases.
- (dtucker) [openbsd-compat/port-aix.c] Missing __func__.
20040626
- (djm) OpenBSD CVS Sync
- [email protected] 2004/06/25 18:43:36
[sshd.c]
fix broken fd handling in the re-exec fallback path, particularly when
/dev/crypto is in use; ok deraadt@ markus@
- [email protected] 2004/06/25 23:21:38
[sftp.c]
bz #875: fix bad escape char error message; reported by f_mohr AT yahoo.de
20040625
- (dtucker) OpenBSD CVS Sync
- [email protected] 2004/06/24 19:30:54
[servconf.c servconf.h sshd.c]
re-exec sshd on accept(); initial work, final debugging and ok markus@
- [email protected] 2004/06/25 01:16:09
[sshd.c]
only perform tcp wrappers checks when the incoming connection is on a
socket. silences useless warnings from regress tests that use
proxycommand="sshd -i". prompted by david@ ok markus@
- [email protected] 2004/06/24 19:32:00
[regress/Makefile regress/test-exec.sh, added regress/reexec.sh]
regress test for re-exec corner cases
- [email protected] 2004/06/25 01:25:12
[regress/test-exec.sh]
clean reexec-specific junk out of text-exec.sh and simplify; idea markus@
- [email protected] 2004/06/25 05:38:48
[sftp-server.c]
Fall back to stat+rename if filesystem doesn't doesn't support hard
links. bz#823, ok djm@
- (dtucker) [configure.ac openbsd-compat/misc.c [openbsd-compat/misc.h]
Add closefrom() for platforms that don't have it.
- (dtucker) [sshd.c] add line missing from reexec sync.
20040623
- (dtucker) [auth1.c] Ensure do_pam_account is called for Protocol 1
connections with empty passwords. Patch from davidwu at nbttech.com,
ok djm@
- (dtucker) OpenBSD CVS Sync
- [email protected] 2004/06/22 22:42:02
[regress/envpass.sh]
Add quoting for test -z; ok markus@
- [email protected] 2004/06/22 22:45:52
[regress/test-exec.sh]
Add TEST_SSH_SSHD_CONFOPTS and TEST_SSH_SSH_CONFOPTS to allow adding
arbitary options to sshd_config and ssh_config during tests. ok markus@
- [email protected] 2004/06/22 22:55:56
[regress/dynamic-forward.sh regress/test-exec.sh]
Allow setting of port for regress from TEST_SSH_PORT variable; ok markus@
- [email protected] 2004/06/23 00:39:38
[rijndael.c]
-Wshadow fix up s/encrypt/do_encrypt/. OK djm@, markus@
- [email protected] 2004/06/23 14:31:01
[ssh.c]
Fix counting in master/slave when passing environment variables; ok djm@
- (dtucker) [cipher.c] encrypt->do_encrypt inside SSH_OLD_EVP to match
-Wshadow change.
- (bal) [Makefile.in] Remove opensshd.init on 'make distclean'
- (dtucker) [auth.c openbsd-compat/port-aix.c openbsd-compat/port-aix.h]
Move loginrestrictions test to port-aix.c, replace with a generic hook.
- (tim) [regress/try-ciphers.sh] "if ! some_command" is not portable.
- (bal) [contrib/README] Removed "mdoc2man.pl" reference and added
reference to "findssl.sh"
20040622
- (dtucker) OpenBSD CVS Sync
- [email protected] 2004/06/20 17:36:59
[ssh.c]
filter passed env vars at slave in connection sharing case; ok markus@
- [email protected] 2004/06/20 18:53:39
[sftp.c]
make "ls -l" listings print user/group names, add "ls -n" to show uid/gid
(like /bin/ls); idea & ok markus@
- [email protected] 2004/06/20 19:28:12
[sftp.1]
mention new -n flag
- [email protected] 2004/06/21 17:36:31
[auth-rsa.c auth2-gss.c auth2-pubkey.c authfile.c canohost.c channels.c
cipher.c dns.c kex.c monitor.c monitor_fdpass.c monitor_wrap.c
monitor_wrap.h nchan.c packet.c progressmeter.c scp.c sftp-server.c sftp.c
ssh-gss.h ssh-keygen.c ssh.c sshconnect.c sshconnect1.c sshlogin.c
sshpty.c]
make ssh -Wshadow clean, no functional changes
markus@ ok
- [email protected] 2004/06/21 17:53:03
[session.c]
fix fd leak for multiple subsystem connections; with markus@
- [email protected] 2004/06/21 22:02:58
[log.h]
mark fatal and cleanup exit as __dead; ok markus@
- [email protected] 2004/06/21 22:04:50
[sftp.c]
introduce sorting for ls, same options as /bin/ls; ok markus@
- [email protected] 2004/06/21 22:30:45
[sftp.c]
prefix ls option flags with LS_
- [email protected] 2004/06/21 22:41:31
[sftp.1]
document sort options
- [email protected] 2004/06/22 01:16:39
[sftp.c]
don't show .files by default in ls, add -a option to turn them back on;
ok markus
- [email protected] 2004/06/22 03:12:13
[regress/envpass.sh regress/multiplex.sh]
more portable env passing tests
- [email protected] 2004/06/22 05:05:45
[monitor.c monitor_wrap.c]
Change login->username, will prevent -Wshadow errors in Portable;
ok markus@
- (dtucker) [monitor.c] Fix Portable-specific -Wshadow warnings on "socket".
- (dtucker) [defines.h] Define __dead if not already defined.
- (bal) [auth-passwd.c auth1.c] Clean up unused variables.
20040620
- (tim) [configure.ac Makefile.in] Only change TEST_SHELL on broken platforms.
20040619
- (dtucker) [auth-pam.c] Don't use PAM namespace for
pam_password_change_required either.
- (tim) [configure.ac buildpkg.sh.in contrib/solaris/README] move opensshd
init script to top level directory. Add opensshd.init.in.
Remove contrib/solaris/buildpkg.sh, contrib/solaris/opensshd.in
20040618
- (djm) OpenBSD CVS Sync
- [email protected] 2004/06/17 14:52:48
[clientloop.c clientloop.h ssh.c]
support environment passing over shared connections; ok markus@
- [email protected] 2004/06/17 15:10:14
[clientloop.c misc.h readconf.c readpass.c ssh.c ssh_config.5]
Add option for confirmation (ControlMaster=ask) via ssh-askpass before
opening shared connections; ok markus@
- [email protected] 2004/06/17 14:53:27
[regress/multiplex.sh]
shared connection env passing regress test
- (dtucker) [regress/README.regress] Add detail on how to run a single
test from the top-level Makefile.
- (dtucker) OpenBSD CVS Sync
- [email protected] 2004/06/17 23:56:57
[ssh.1 ssh.c]
sync usage() and SYNPOSIS with connection sharing changes
- [email protected] 2004/06/18 06:13:25
[sftp.c]
Use execvp instead of execv so sftp -S ssh works. "makes sense" markus@
- [email protected] 2004/06/18 06:15:51
[multiplex.sh]
Use -S for scp/sftp to force the use of the ssh being tested.
ok djm@,markus@
- (djm) OpenBSD CVS Sync
- [email protected] 2004/06/18 10:40:19
[ssh.c]
delay signal handler setup until we have finished talking to the master.
allow interrupting of setup (e.g. if master is stuck); ok markus@
- [email protected] 2004/06/18 10:55:43
[ssh.1 ssh.c]
trim synopsis for -S, allow -S and -oControlMaster, -MM means 'ask';
ok djm
- [email protected] 2004/06/18 11:11:54
[channels.c clientloop.c]
Don't explode in clientloop when we receive a bogus channel id, but
also don't generate them to begin with; ok markus@
20040617
- (dtucker) [regress/scp.sh] diff -N is not portable (but needed for some
platforms), so test if diff understands it. Pointed out by tim@, ok djm@
- (dtucker) OpenBSD CVS Sync regress/
- [email protected] 2004/06/17 05:51:59
[regress/multiplex.sh]
Remove datafile between and after tests, kill sshd rather than wait;
ok djm@
- [email protected] 2004/06/17 06:00:05
[regress/multiplex.sh]
Use DATA and COPY for test data rather than hard-coded paths; ok djm@
- [email protected] 2004/06/17 06:19:06
[regress/multiplex.sh]
Add small description of failing test to failure message; ok djm@
- (dtucker) [regress/multiplex.sh] add EXEEXT for those platforms that need
it.
- (dtucker) [regress/multiplex.sh] Increase sleep time to 120 sec (60 is not
enough for slow systems, especially if they don't have a kernel RNG).
20040616
- (dtucker) [openbsd-compat/port-aix.c] Expand whitespace -> tabs. No
code changes.
- (dtucker) OpenBSD CVS Sync regress/
- [email protected] 2004/04/27 09:47:30
[regress/Makefile regress/test-exec.sh, added regress/envpass.sh]
regress test for environment passing, SendEnv & AcceptEnv options;
ok markus@
- [email protected] 2004/06/13 13:51:02
[regress/Makefile regress/test-exec.sh, added regress/scp-ssh-wrapper.sh
regress/scp.sh]
Add scp regression test; with & ok markus@
- [email protected] 2004/06/13 15:04:08
[regress/Makefile regress/test-exec.sh, added regress/envpass.sh]
regress test for client multiplexing; ok markus@
- [email protected] 2004/06/13 15:16:54
[regress/test-exec.sh]
remove duplicate setting of $SCP; spotted by markus@
- [email protected] 2004/06/16 13:15:09
[regress/scp.sh]
Make scp -r tests use diff -rN not cmp (which won't do dirs. ok markus@
- [email protected] 2004/06/16 13:16:40
[regress/multiplex.sh]
Silence multiplex sftp and scp tests. ok markus@
- (dtucker) [regress/test-exec.sh]
Move Portable-only StrictModes to top of list to make syncs easier.
- (dtucker) [regress/README.regress]
Add $TEST_SHELL to readme.
20040615
- (djm) OpenBSD CVS Sync
- [email protected] 2004/05/26 08:59:57
[sftp.c]
exit -> _exit in forked child on error; from andrushock AT korovino.net
- [email protected] 2004/05/26 23:02:39
[channels.c]
missing freeaddrinfo; Andrey Matveev
- [email protected] 2004/05/27 00:50:13
[readconf.c]
Kill dead code after fatal(); ok djm@
- [email protected] 2004/06/01 14:20:45
[auth2-chall.c]
Remove redundant #include; ok markus@
- [email protected] 2004/06/03 12:22:20
[sftp-client.c sftp.c]
initialize pointers, ok markus@
- [email protected] 2004/06/13 12:53:24
[dh.c dh.h kex.c kex.h kexdhc.c kexdhs.c monitor.c myproposal.h]
[ssh-keyscan.c sshconnect2.c sshd.c]
implement diffie-hellman-group14-sha1 kex method (trivial extension to
existing diffie-hellman-group1-sha1); ok markus@
- [email protected] 2004/06/13 14:01:42
[ssh.1 ssh_config.5 sshd_config.5]
List supported ciphers in man pages, tidy up ssh -c;
"looks fine" jmc@, ok markus@
- [email protected] 2004/06/13 15:03:02
[channels.c channels.h clientloop.c clientloop.h includes.h readconf.c]
[readconf.h scp.1 sftp.1 ssh.1 ssh.c ssh_config.5]
implement session multiplexing in the client (the server has supported
this since 2.0); ok markus@
- [email protected] 2004/06/14 01:44:39
[channels.c clientloop.c misc.c misc.h packet.c ssh-agent.c ssh-keyscan.c]
[sshd.c]
set_nonblock() instead of fnctl(...,O_NONBLOCK); "looks sane" deraadt@
- [email protected] 2004/06/15 05:45:04
[clientloop.c]
missed one unset_nonblock; spotted by Tim Rice
- (djm) Fix Makefile.in for connection sharing changes
- (djm) [ssh.c] Use separate var for address length
20040603
- (dtucker) [auth-pam.c] Don't use pam_* namespace for sshd's PAM functions.
ok djm@
20040601
- (djm) [auth-pam.c] Add copyright for local changes
20040530
- (dtucker) [auth-pam.c auth-pam.h auth-passwd.c] Bug #874: Re-add PAM
support for PasswordAuthentication=yes. ok djm@
- (dtucker) [auth-pam.c] Use an invalid password for root if
PermitRootLogin != yes or the login is invalid, to prevent leaking
information. Based on Openwall's owl-always-auth patch. ok djm@
- (tim) [configure.ac Makefile.in] Add support for "make package" ok djm@
- (tim) [buildpkg.sh.in] New file. A more flexible version of
contrib/solaris/buildpkg.sh used for "make package".
- (tim) [buildpkg.sh.in] Last minute fix didn't make it in the .in file.
20040527
- (dtucker) [contrib/caldera/openssh.spec contrib/redhat/openssh.spec
contrib/README CREDITS INSTALL] Bug #873: Correct URLs for x11-ssh-askpass
and Jim Knoble's email address , from Jim himself.
20040524
- (dtucker) OpenBSD CVS Sync
- [email protected] 2004/05/19 12:17:33
[sftp-client.c sftp.c]
gracefully abort transfers on receipt of SIGINT, also ignore SIGINT while
waiting for a command; ok markus@
- [email protected] 2004/05/20 10:58:05
[clientloop.c]
Trivial type fix 0 -> '\0'; ok markus@
- [email protected] 2004/05/21 08:43:03
[kex.h moduli.c tildexpand.c]
add prototypes for -Wall; ok djm
- [email protected] 2004/05/21 11:33:11
[channels.c channels.h clientloop.c serverloop.c ssh.1]
bz #756: add support for the cancel-tcpip-forward request for the server
and the client (through the ~C commandline). reported by z3p AT
twistedmatrix.com; ok markus@
- [email protected] 2004/05/22 06:32:12
[clientloop.c ssh.1]
use '-h' for help in ~C commandline instead of '-?'; inspired by jmc@
- [email protected] 2004/05/22 16:01:05
[ssh.1]
kill whitespace at eol;
- [email protected] 2004/05/23 23:59:53
[auth.c auth.h auth1.c auth2.c servconf.c servconf.h sshd_config
sshd_config.5]
Add MaxAuthTries sshd config option; ok markus@
- (dtucker) [auth-pam.c] Bug #839: Ensure that pam authentication "thread"
is terminated if the privsep slave exits during keyboard-interactive
authentication. ok djm@
- (dtucker) [sshd.c] Fix typo in comment.
20040523
- (djm) [sshd_config] Explain consequences of UsePAM=yes a little better in
sshd_config; ok dtucker@
- (djm) [configure.ac] Warn if the system has no known way of figuring out
which user is on the other end of a Unix domain socket; ok dtucker@
- (bal) [openbsd-compat/sys-queue.h] Reintroduce machinary to handle
old/broken/incomplete <sys/queue.h>.
20040513
- (dtucker) [configure.ac] Bug #867: Additional tests for res_query in
libresolv, fixes problems detecting it on some platforms
(eg Linux/x86-64). From Kurt Roeckx via Debian, ok mouring@
- (dtucker) OpenBSD CVS Sync
- [email protected] 2004/05/04 18:36:07
[scp.1]
SendEnv here too;
- [email protected] 2004/05/06 11:24:23
[ssh_config.5]
typo from John Cosimano (PR 3770);
- [email protected] 2004/05/08 00:01:37
[auth.c clientloop.c misc.h servconf.c ssh.c sshpty.h sshtty.c
tildexpand.c], removed: sshtty.h tildexpand.h
make two tiny header files go away; djm ok
- [email protected] 2004/05/08 00:21:31
[clientloop.c misc.h readpass.c scard.c ssh-add.c ssh-agent.c ssh-keygen.c
sshconnect.c sshconnect1.c sshconnect2.c] removed: readpass.h
kill a tiny header; ok deraadt@
- [email protected] 2004/05/09 00:06:47
[moduli.c ssh-keygen.c] removed: moduli.h
zap another tiny header; ok deraadt@
- [email protected] 2004/05/09 01:19:28
[OVERVIEW auth-rsa.c auth1.c kex.c monitor.c session.c sshconnect1.c
sshd.c] removed: mpaux.c mpaux.h
kill some more tiny files; ok deraadt@
- [email protected] 2004/05/09 01:26:48
[kex.c]
don't overwrite what we are trying to compute
- [email protected] 2004/05/11 19:01:43
[auth.c auth2-none.c authfile.c channels.c monitor.c monitor_mm.c
packet.c packet.h progressmeter.c session.c openbsd-compat/xmmap.c]
improve some code lint did not like; djm millert ok
- [email protected] 2004/05/13 02:47:50
[ssh-agent.1]
Add examples to ssh-agent.1, bz#481 from Ralf Hauser; ok deraadt@
- (dtucker) [sshd.8] Bug #843: Add warning about PasswordAuthentication to
UsePAM section. Parts from djm@ and jmc@.
- (dtucker) [auth-pam.c scard-opensc.c] Tinderbox says auth-pam.c uses
readpass.h, grep says scard-opensc.c does too. Replace with misc.h.
- (dtucker) [openbsd-compat/getrrsetbyname.c] Check that HAVE_DECL_H_ERROR
is defined before using.
- (dtucker) [openbsd-compat/getrrsetbyname.c] Fix typo too: HAVE_DECL_H_ERROR
-> HAVE_DECL_H_ERRNO.
20040502
- (dtucker) OpenBSD CVS Sync
- [email protected] 2004/04/22 11:56:57
[moduli.c]
Bugzilla #850: Sophie Germain is the correct name of the French
mathematician, "Sophie Germaine" isn't; from [email protected]
- [email protected] 2004/04/27 09:46:37
[readconf.c readconf.h servconf.c servconf.h session.c session.h ssh.c
ssh_config.5 sshd_config.5]
bz #815: implement ability to pass specified environment variables from
the client to the server; ok markus@
- [email protected] 2004/04/28 05:17:10
[ssh_config.5 sshd_config.5]
manpage fixes in envpass stuff from Brian Poole (raj AT cerias.purdue.edu)
- [email protected] 2004/04/28 07:02:56
[sshd_config.5]
remove unnecessary .Pp;
- [email protected] 2004/04/28 07:13:42
[sftp.1 ssh.1]
add SendEnv to -o list;
- [email protected] 2004/05/02 11:54:31
[sshd.8]
Man page grammar fix (bz #858), from damerell at chiark.greenend.org.uk
via Debian; ok djm@
- [email protected] 2004/05/02 11:57:52
[ssh.1]
ConnectionTimeout -> ConnectTimeout, from m.a.ellis at ncl.ac.uk via
Debian. ok djm@
- [email protected] 2004/05/02 23:02:17
[sftp.1]
ConnectionTimeout -> ConnectTimeout here too, pointed out by jmc@
- [email protected] 2004/05/02 23:17:51
[scp.1]
ConnectionTimeout -> ConnectTimeout for scp.1 too.
20040423
- (dtucker) [configure.ac openbsd-compat/getrrsetbyname.c] Declare h_errno
as extern int if not already declared. Fixes compile errors on old SCO
platforms. ok tim@
- (dtucker) [README.platform] List prereqs for building on Cygwin.
20040421
- (djm) Update config.guess and config.sub to autoconf-2.59 versions; ok tim@
20040420
- (djm) OpenBSD CVS Sync
- [email protected] 2004/04/08 16:08:21
[sshconnect2.c]
swap the last two parameters to TAILQ_FOREACH_REVERSE. matches what
FreeBSD and NetBSD do.
ok millert@ mcbride@ markus@ ho@, checked to not affect ports by naddy@
- [email protected] 2004/04/18 23:10:26
[readconf.c readconf.h ssh-keysign.c ssh.c]
perform strict ownership and modes checks for ~/.ssh/config files,
as these can be used to execute arbitrary programs; ok markus@
NB. ssh will now exit when it detects a config with poor permissions
- [email protected] 2004/04/19 13:02:40
[ssh.1 ssh_config.5]
document strict permission checks on ~/.ssh/config; prompted by,
with & ok jmc@
- [email protected] 2004/04/19 16:12:14
[ssh_config.5]
kill whitespace at eol;
- [email protected] 2004/04/19 21:51:49
[ssh.c]
fix idiot typo that i introduced in my last commit;
spotted by cschneid AT cschneid.com
- (djm) [openbsd-compat/sys-queue.h] Sync with OpenBSD, needed for
above change
- (djm) [configure.ac] Check whether libroken is required when building
with Heimdal
20040419
- (dtucker) OpenBSD CVS Sync
- [email protected] 2004/02/29 22:04:45
[regress/login-timeout.sh]
Use sudo when restarting daemon during test. ok markus@
- [email protected] 2004/03/08 10:17:12
[regress/login-timeout.sh]
Missing OBJ, from tim@. ok markus@ (Already fixed, ID sync only)
- [email protected] 2004/03/30 12:41:56
[sftp-client.c]
sync comment with reality
- [email protected] 2004/03/31 21:58:47
[canohost.c]
don't skip ip options check when UseDNS=no; ok markus@ (ID sync only)
- [email protected] 2004/04/01 12:19:57
[scp.c]
limit trust between local and remote rcp/scp process,
noticed by lcamtuf; ok deraadt@, djm@
20040418
- (dtucker) [auth-pam.c] Log username and source host for failed PAM
authentication attempts. With & ok djm@
- (djm) [openbsd-compat/bsd-cygwin_util.c] Recent versions of Cygwin allow
change of user context without a password, so relax auth method
restrictions; from vinschen AT redhat.com; ok dtucker@
20040416
- (dtucker) [regress/sftp-cmds.sh] Skip quoting test on Cygwin, since
FAT/NTFS does not permit quotes in filenames. From vinschen at redhat.com
- (djm) [auth-krb5.c auth.h session.c] Explicitly refer to Kerberos ccache
file using FILE: method, fixes problems on Mac OSX.
Patch from [email protected]; ok dtucker@
- (tim) [configure.ac] Set SETEUID_BREAKS_SETUID, BROKEN_SETREUID and
BROKEN_SETREGID for SCO OpenServer 3
20040412
- (dtucker) [sshd_config.5] Add PermitRootLogin without-password warning
from bug #701 (text from jfh at cise.ufl.edu).
- (dtucker) [acconfig.h configure.ac defines.h] Bug #673: check for 4-arg
skeychallenge(), eg on NetBSD. ok mouring@
- (dtucker) [auth-skey.c defines.h monitor.c] Make skeychallenge explicitly
4-arg, with compatibility for 3-arg versions. From djm@, ok me.
- (djm) [configure.ac] Fix detection of libwrap on OpenBSD; ok dtucker@
20040408
- (dtucker) [loginrec.c] Use UT_LINESIZE if available, prevents truncating
pty name on Linux 2.6.x systems. Patch from jpe at eisenmenger.org.
- (bal) [monitor.c monitor_wrap.c] Second try. Put the zlib.h headers
back and #undef TARGET_OS_MAC instead. (Bug report pending with Apple)
- (dtucker) [defines.h loginrec.c] Define UT_LINESIZE if not defined and
simplify loginrec.c. ok tim@
- (bal) [monitor.c monitor_wrap.c] Ok.. Last time. Promise. Tim suggested
limiting scope and dtucker@ agreed.
20040407
- (dtucker) [session.c] Flush stdout after displaying loginmsg. From
f_mohr at yahoo.de.
- (bal) [acconfig.h auth-krb5.c configure.ac gss-serv-krb5.c] Check to see
if Krb5 library exports krb5_init_etc() since some OSes (like MacOS/X)
are starting to restrict it as internal since it is not needed by
developers any more. (Patch based on Apple tree)
- (bal) [monitor.c monitor_wrap.c] monitor_wrap.c] moved zlib.h higher since
krb5 on MacOS/X conflicts. There may be a better solution, but this will
work for now.
20040406
- (dtucker) [acconfig.h configure.ac defines.h] Bug #820: don't use
updwtmpx() on IRIX since it seems to clobber utmp. ok djm@
- (dtucker) [configure.ac] Bug #816, #748 (again): Attempt to detect
broken getaddrinfo and friends on HP-UX. ok djm@
20040330
- (dtucker) [configure.ac] Bug #811: Use "!" for LOCKED_PASSWD_PREFIX on
Linuxes, since that's what many use. ok djm@
- (dtucker) [auth-pam.c] rename the_authctxt to sshpam_authctxt in auth-pam.c
to reduce potential confusion with the one in sshd.c. ok djm@
- (djm) Bug #825: Fix ip_options_check() for mapped IPv4/IPv6 connection;
with & ok dtucker@
20040327
- (dtucker) [session.c] Bug #817: Clear loginmsg after fork to prevent
duplicate login messages for mutli-session logins. ok djm@
20040322
- (djm) [sshd.c] Drop supplemental groups if started as root
- (djm) OpenBSD CVS Sync
- [email protected] 2004/03/09 22:11:05
[ssh.c]
increase x11 cookie lifetime to 20 minutes; ok djm
- [email protected] 2004/03/10 09:45:06
[ssh.c]
trim usage to match ssh(1) and look more like unix. ok djm@
- [email protected] 2004/03/11 08:36:26
[sshd.c]
trim usage; ok deraadt
- [email protected] 2004/03/11 10:21:17
[ssh.c sshd.c]
ssh, sshd: sync version output, ok djm
- [email protected] 2004/03/20 10:40:59
[version.h]
3.8.1
- (djm) Crank RPM spec versions
20040311
- (djm) [configure.ac] Add standard license to configure.ac; ok ben, dtucker
20040310
- (dtucker) [openbsd-compat/fake-rfc2553.h] Bug #812: #undef getaddrinfo
before redefining it, silences warnings on Tru64.
20040308
- (dtucker) [sshd.c] Back out rev 1.270 as it caused problems on some
platforms (eg SCO, HP-UX) with logging in the wrong TZ. ok djm@
- (dtucker) [configure.ac sshd.c openbsd-compat/bsd-misc.h
openbsd-compat/setenv.c] Unset KRB5CCNAME on AIX to prevent it from being
inherited by the child. ok djm@
- (dtucker) [auth-pam.c auth-pam.h auth1.c auth2.c monitor.c monitor_wrap.c
monitor_wrap.h] Bug #808: Ensure force_pwchange is correctly initialized
even if keyboard-interactive is not used by the client. Prevents
segfaults in some cases where the user's password is expired (note this
is not considered a security exposure). ok djm@
- (djm) OpenBSD CVS Sync
- [email protected] 2004/03/03 06:47:52
[sshd.c]
change proctiltle after accept(2); ok henning, deraadt, djm
- [email protected] 2004/03/03 09:30:42
[sftp-client.c]
Don't print duplicate messages when progressmeter is off
Spotted by job317 AT mailvault.com; ok markus@
- [email protected] 2004/03/03 09:31:20
[sftp.c]
Fix initialisation of progress meter; ok markus@
- [email protected] 2004/03/05 10:53:58
[readconf.c readconf.h scp.1 sftp.1 ssh.1 ssh_config.5 sshconnect2.c]
add IdentitiesOnly; ok djm@, pb@
- [email protected] 2004/03/08 09:38:05
[ssh-keyscan.c]
explicitly initialise remote_major and remote_minor.
from cjwatson AT debian.org; ok markus@
- [email protected] 2004/03/08 10:18:57
[sshd_config.5]
Document KerberosGetAFSToken; ok markus@
- (tim) [regress/README.regress] Document ssh-rand-helper issue. ok bal
20040307
- (tim) [regress/login-timeout.sh] fix building outside of source tree.
20040304
- (dtucker) [auth-pam.c] Don't try to export PAM when compiled with
-DUSE_POSIX_THREADS. From antoine.verheijen at ualbert ca. ok djm@
- (dtucker) [auth-pam.c] Reset signal status when starting pam auth thread,
prevent hanging during PAM keyboard-interactive authentications. ok djm@
- (dtucker) [auth-passwd.c auth-sia.c auth-sia.h defines.h
openbsd-compat/xcrypt.c] Bug #802: Fix build error on Tru64 when
configured --with-osfsia. ok djm@
20040303
- (djm) [configure.ac ssh-agent.c] Use prctl to prevent ptrace on ssh-agent
ok dtucker
20040229
- (tim) [configure.ac] Put back bits mistakenly removed from Rev 1.188
20040229
- (dtucker) OpenBSD CVS Sync
- [email protected] 2004/02/25 00:22:45
[sshd.c]
typo in comment
- [email protected] 2004/02/27 22:42:47
[dh.c]
Prevent sshd from sending DH groups with a primitive generator of zero or
one, even if they are listed in /etc/moduli. ok markus@
- [email protected] 2004/02/27 22:44:56
[dh.c]
Make /etc/moduli line buffer big enough for 8kbit primes, in case anyone
ever uses one. ok markus@
- [email protected] 2004/02/27 22:49:27
[dh.c]
Reset bit counter at the right time, fixes debug output in the case where
the DH group is rejected. ok markus@
- [email protected] 2004/02/17 08:23:20
[regress/Makefile regress/login-timeout.sh]
Add regression test for LoginGraceTime; ok markus@
- [email protected] 2004/02/24 16:56:30
[regress/test-exec.sh]
allow arguments in ${TEST_SSH_XXX}
- [email protected] 2004/02/24 17:06:52
[regress/ssh-com-client.sh regress/ssh-com-keygen.sh
regress/ssh-com-sftp.sh regress/ssh-com.sh]
test against recent ssh.com releases
- [email protected] 2004/02/28 12:16:57
[regress/dynamic-forward.sh]
Make dynamic-forward understand nc's new output. ok markus@
- [email protected] 2004/02/28 13:44:45
[regress/try-ciphers.sh]
Test acss too; ok markus@
- (dtucker) [regress/try-ciphers.sh] Skip acss if not compiled in (eg if we
built with openssl < 0.9.7)
20040226
- (bal) KNF our sshlogin.c even if the code looks nothing like upstream
code due to diversity issues.
20040225
- (djm) Trim ChangeLog
- (djm) Don't specify path to PAM modules in Redhat sshd.pam; from Fedora
20040224
- (dtucker) OpenBSD CVS Sync
- [email protected] 2004/02/19 21:15:04
[sftp-server.c]
switch to new license.template
- [email protected] 2004/02/23 12:02:33
[sshd.c]
backout revision 1.279; set listen socket to non-block; ok henning.
- [email protected] 2004/02/23 15:12:46
[bufaux.c]
encode 0 correctly in buffer_put_bignum2; noted by Mikulas Patocka
and drop support for negative BNs; ok otto@
- [email protected] 2004/02/23 15:16:46
[version.h]
enter 3.8
- (dtucker) [configure.ac gss-serv-krb5.c ssh-gss.h] Define GSSAPI when found
with krb5-config, hunt down gssapi.h and friends. Based partially on patch
from deengert at anl.gov. ok djm@
- (djm) [groupaccess.c uidswap.c] Bug #787: Size group arrays at runtime
using sysconf() if available Based on patches from
holger AT van-lengerich.de and openssh_bugzilla AT hockin.org
- (dtucker) [uidswap.c] Minor KNF. ok djm@
- (tim) [openbsd-compat/getrrsetbyname.c] Make gcc 2.7.2.3 happy. ok djm@
- (djm) Crank RPM spec versions
- (dtucker) [README] Add pointer to release notes. ok djm@
- (dtucker) {README.platform] Add platform-specific notes.
- (tim) [configure.ac] SCO3 needs -lcrypt_i for -lprot
- (djm) Release 3.8p1
20040223
- (dtucker) [session.c] Bug #789: Only make setcred call for !privsep in the
non-interactive path. ok djm@
20040222
- (dtucker) [auth-shadow.c auth.c auth.h] Move shadow account expiry test
to auth-shadow.c, no functional change. ok djm@
- (dtucker) [auth-shadow.c auth.h] Provide warnings of impending account or
password expiry. ok djm@
- (dtucker) [auth-passwd.c] Only check password expiry once. Prevents
multiple warnings if a wrong password is entered.
- (dtucker) [configure.ac] Apply krb5-config --libs fix to non-gssapi path
too.
20040220
- (djm) [openbsd-compat/setproctitle.c] fix comments; from grange@
20040218
- (dtucker) [configure.ac] Handle case where krb5-config --libs returns a
path with a "-" in it. From Sergio.Gelato at astro.su.se.
- (djm) OpenBSD CVS Sync
- [email protected] 2004/02/17 07:17:29
[sftp-glob.c sftp.c]
Remove useless headers; ok deraadt@
- [email protected] 2004/02/17 11:03:08
[sftp.c]
sftp.c and sftp-int.c, together at last; ok markus@
- [email protected] 2004/02/17 19:35:21
[sshd_config.5]
remove cruft left over from RhostsAuthentication removal;
ok markus@
- (djm) [log.c] Correct use of HAVE_OPENLOG_R
- (djm) [log.c] Tighten openlog_r tests
20040217
- (djm) Simplify the license on code I have written. No code changes.
- (djm) OpenBSD CVS Sync
- [email protected] 2004/02/17 05:39:51
[sftp-client.c sftp-client.h sftp-glob.c sftp-glob.h sftp-int.c]
[sftp-int.h sftp.c]
switch to license.template for code written by me (belated, I know...)
- (djm) Bug #698: Specify FILE: for KRB5CCNAME; patch from
[email protected] and [email protected]
- (dtucker) [auth-pam.c] Tidy up PAM debugging. ok djm@
- (dtucker) [auth-pam.c] Store output from pam_session and pam_setcred for
display after login. Should fix problems like pam_motd not displaying
anything, noticed by cjwatson at debian.org. ok djm@
20040212
- (tim) [Makefile.in regress/sftp-badcmds.sh regress/test-exec.sh]
Portablity fixes. Data sftp transfers needs to be world readable. Some
older shells hang on while loops when doing sh -n some_script. OK dtucker@
- (tim) [configure.ac] Make sure -lcrypto is before -lsocket for sco3.
ok mouring@
20040211
- (dtucker) [auth-passwd.c auth-shadow.c] Only enable shadow expiry check
if HAS_SHADOW_EXPIRY is set.
- (tim) [configure.ac] Fix comment to match code changes in ver 1.117
20040210
- (dtucker) [auth-passwd.c auth.h openbsd-compat/port-aix.c
openbsd-compat/port-aix.h] Bug #14: Use do_pwchange to support AIX's
native password expiry.
- (dtucker) [LICENCE Makefile.in auth-passwd.c auth-shadow.c auth.c auth.h
defines.h] Bug #14: Use do_pwchange to support password expiry and force
change for platforms using /etc/shadow. ok djm@
- (dtucker) [openbsd-compat/fake-rfc2553.h] Bug #563: Prepend ssh_ to compat
functions to avoid conflicts with Heimdal's libroken. ok djm@
- (dtucker) [auth-pam.c auth-pam.h session.c] Bug #14: Use do_pwchange to
change expired PAM passwords for SSHv1 connections without privsep.
pam_chauthtok is still used when privsep is disabled. ok djm@
- (dtucker) [openbsd-compat/port-aix.c openbsd-compat/port-aix.h] Move
include from port-aix.h to port-aix.c and remove unnecessary function
definition. Fixes build errors on AIX.
- (dtucker) [configure.ac loginrec.c] Bug #464: Use updwtmpx on platforms
that support it. from & ok mouring@
- (dtucker) [configure.ac] Bug #345: Do not disable utmp on HP-UX 10.x.
ok djm@
20040207
- (dtucker) OpenBSD CVS Sync
- [email protected] 2004/02/06 23:41:13
[cipher-ctr.c]
Use EVP_CIPHER_CTX_key_length for key length. ok markus@
(This will fix builds with OpenSSL 0.9.5)
- (dtucker) [cipher.c] enable AES counter modes with OpenSSL 0.9.5.
ok djm@, markus@
20040206
- (dtucker) [acss.c acss.h] Fix $Id tags.
- (dtucker) [cipher-acss.c cipher.c] Enable acss only if building with
OpenSSL >= 0.9.7. ok djm@
- (dtucker) [session.c] Bug #789: Do not call do_pam_setcred as a non-root
user, since some modules might fail due to lack of privilege. ok djm@
- (dtucker) [configure.ac] Bug #748: Always define BROKEN_GETADDRINFO
for HP-UX 11.11. If there are known-good configs where this is not
required, please report them. ok djm@
- (dtucker) [sshd.c] Bug #757: Clear child's environment to prevent
accidentally inheriting from root's environment. ok djm@
- (dtucker) [openbsd-compat/port-aix.c openbsd-compat/port-aix.h] Bug #796:
Restore previous authdb setting after auth calls. Fixes problems with
setpcred failing on accounts that use AFS or NIS password registries.
- (dtucker) [configure.ac includes.h] Include <sys/stream.h> if present,
required on Solaris 2.5.1 for queue_t, which is used by <sys/ptms.h>.
- (dtucker) OpenBSD CVS Sync
- [email protected] 2004/01/30 09:48:57
[auth-passwd.c auth.h pathnames.h session.c]
support for password change; ok dtucker@
(set password-dead=1w in login.conf to use this).
In -Portable, this is currently only platforms using bsdauth.
- [email protected] 2004/02/05 05:37:17
[monitor.c sshd.c]
Pass SIGALRM through to privsep child if LoginGraceTime expires. ok markus@
- [email protected] 2004/02/05 15:33:33
[progressmeter.c]
fix ETA for > 4GB; bugzilla #791; ok henning@ deraadt@
20040129
- (dtucker) OpenBSD CVS Sync regress/
- [email protected] 2003/10/11 11:49:49
[Makefile banner.sh]
Test missing banner file, suppression of banner with ssh -q, check return
code from ssh. ok markus@
- [email protected] 2003/11/07 10:16:44
[ssh-com.sh]
adress -> address, and a few more; all from Jonathon Gray;
- [email protected] 2004/01/13 09:49:06
[sftp-batch.sh]
- (dtucker) [configure.ac] Add --without-zlib-version-check. Feedback from
tim@, ok several
- (dtucker) [configure.ac openbsd-compat/bsd-cray.c openbsd-compat/bsd-cray.h]
Bug #775: Cray fixes from wendy at cray.com
20040128
- (dtucker) [regress/README.regress] Add tcpwrappers issue, noted by tim@
- (dtucker) [moduli] Import new moduli file from OpenBSD.
20040127
- (djm) OpenBSD CVS Sync
- [email protected] 2004/01/23 17:06:03
[cipher.c]
enable acss for ssh
ok deraadt@ markus@
- [email protected] 2004/01/23 17:57:48
[sftp-int.c]
Fix issue pointed out with ls not handling large directories
with embeded paths correctly. OK damien@
- [email protected] 2004/01/23 19:26:33
[cipher.c]
rename [email protected] to [email protected]
ok deraadt@
- [email protected] 2004/01/25 03:49:09
[sshconnect.c]
reset nonblocking flag after ConnectTimeout > 0 connect; (bugzilla #785)
from jclonguet AT free.fr; ok millert@
- [email protected] 2004/01/27 10:08:10
[sftp.c]
reorder parsing so user:skey@host:file works (bugzilla #777)
patch from admorten AT umich.edu; ok markus@
- (djm) [acss.c acss.h cipher-acss.c] Portable support for ACSS
if libcrypto lacks it
20040126
- (tim) Typo in regress/README.regress
- (tim) [regress/test-exec.sh] RhostsAuthentication is deprecated.
- (tim) [defines.h] Add defines for HFIXEDSZ and T_SIG
- (tim) [configure.ac includes.h] add <sys/ptms.h> for grantpt() and friends.
- (tim) [defines.h openbsd-compat/getrrsetbyname.h] Move defines for HFIXEDSZ
and T_SIG to getrrsetbyname.h
20040124
- (djm) Typo in openbsd-compat/bsd-openpty.c; from wendyp AT cray.com
20040123
- (djm) Do pam_session processing for systems with HAVE_LOGIN_CAP; from
ralf.hack AT pipex.net; ok dtucker@
- (djm) Bug #776: Update contrib/redhat/openssh.spec to dynamically detect
Kerberos location (and thus work with Fedora Core 1);
from jason AT devrandom.org
- (dtucker) [configure.ac] Bug #788: Test for zlib.h presence and for
zlib >= 1.1.4. Partly from jbasney at ncsa.uiuc.edu. ok djm@
- (dtucker) [contrib/cygwin/README] Document new ssh-host-config options.
Patch from vinschen at redhat.com.
- (dtucker) [acconfig.h configure.ac includes.h servconf.c session.c]
Change AFS symbol to USE_AFS to prevent namespace collisions, do not
include kafs.h unless necessary. From deengert at anl.gov.
- (tim) [configure.ac] Remove hard coded -L/usr/local/lib and
-I/usr/local/include. Users can do LDFLAGS="-L/usr/local/lib" \
CPPFLAGS="-I/usr/local/include" ./configure if needed.
20040122
- (dtucker) [configure.ac] Use krb5-config where available for Kerberos/
GSSAPI detection, libs and includes. ok djm@
- (dtucker) [session.c] Enable AFS support in conjunction with KRB5 not
just HEIMDAL.
- (tim) [contrib/solaris/buildpkg.sh] Allow for the possibility of
/usr/local being a symbolic link. Fixes problem reported by Henry Grebler.
20040121
- (djm) OpenBSD CVS Sync
- [email protected] 2004/01/13 09:25:05
[sftp-int.c sftp.1 sftp.c]
Tidy sftp batchmode handling, eliminate junk to stderr (bugzilla #754) and
enable use of "-b -" to accept batchfile from stdin; ok markus@
- [email protected] 2004/01/13 12:17:33
[sftp.1]
remove unnecessary Ic's;
kill whitespace at EOL;
ok djm@
- [email protected] 2004/01/13 19:23:15
[compress.c session.c]
-Wall; ok henning
- [email protected] 2004/01/13 19:45:15
[compress.c]
cast for portability; millert@
- [email protected] 2004/01/19 09:24:21
[channels.c]
fake consumption for half closed channels since the peer is waiting for
window adjust messages; bugzilla #790 Matthew Dillon; test + ok dtucker@
reproduce with sh -c 'ulimit -f 10; ssh host -n od /bsd | cat > foo'
- [email protected] 2004/01/19 21:25:15
[auth2-hostbased.c auth2-pubkey.c serverloop.c ssh-keysign.c sshconnect2.c]
fix mem leaks; some fixes from Pete Flugstad; tested dtucker@
- [email protected] 2004/01/21 03:07:59
[sftp.c]
initialise infile in main, rather than statically - from portable
- [email protected] 2004/01/11 21:55:06
[sshpty.c]
for pty opening, only use the openpty() path. the other stuff only needs
to be in openssh-p; markus ok
- (djm) [openbsd-compat/bsd-openpty.c] Rework old sshpty.c code into an
openpty() replacement
20040114
- (dtucker) [auth-pam.c] Have monitor die if PAM authentication thread exits
unexpectedly. with & ok djm@
- (dtucker) [auth-pam.c] Reset signal handler in pthread_cancel too, add
test for case where cleanup has already run.
- (dtucker) [auth-pam.c] Add minor debugging.
20040113
- (dtucker) [auth-pam.c] Relocate struct pam_ctxt and prototypes. No
functional changes.
20040108
- (dtucker) [auth-pam.c defines.h] Bug #783: move __unused to defines.h and
only define if not already. From des at freebsd.org.
- (dtucker) [configure.ac] Remove extra (typo) comma.
20040105
- (dtucker) [contrib/ssh-copy-id] Bug #781: exit if ssh fails. Patch from
cjwatson at debian.org.
- (dtucker) [acconfig.h configure.ac includes.h servconf.c session.c]
Only enable KerberosGetAFSToken if Heimdal's libkafs is found. with jakob@
20040102
- (djm) OSX/Darwin needs BIND_8_COMPAT to build getrrsetbyname. Report from
jakob@
- (djm) Remove useless DNS support configure summary message. from jakob@
- (djm) OSX/Darwin put the PAM headers in a different place, detect this.
Report from jakob@
20031231
- (dtucker) OpenBSD CVS Sync
- [email protected] 2003/12/22 09:16:58
[moduli.c ssh-keygen.1 ssh-keygen.c]
tidy up moduli generation debugging, add -v (verbose/debug) option to
ssh-keygen; ok markus@
- [email protected] 2003/12/22 20:29:55
[cipher-3des1.c]
EVP_CIPHER_CTX_cleanup() for the des contexts; [email protected]
- [email protected] 2003/12/23 16:12:10
[servconf.c servconf.h session.c sshd_config]
implement KerberosGetAFSToken server option. ok markus@, beck@
- [email protected] 2003/12/29 16:39:50
[sshd_config]
KeepAlive has been obsoleted, use TCPKeepAlive instead; markus@ OK
- [email protected] 2003/12/31 00:24:50
[auth2-passwd.c]
Ignore password change request during password auth (which we currently
don't support) and discard proposed new password. corrections/ok markus@
- (dtucker) [configure.ac] Only test setresuid and setresgid if they exist.
20031219
- (dtucker) [defines.h] Bug #458: Define SIZE_T_MAX as UINT_MAX if we
typedef size_t ourselves.
20031218
- (dtucker) [configure.ac] Don't use setre[ug]id on DG-UX, from Tom Orban.
- (dtucker) [auth-pam.c] Do PAM chauthtok during SSH2 keyboard-interactive
authentication. Partially fixes bug #423. Feedback & ok djm@
20031217
- (djm) OpenBSD CVS Sync
- [email protected] 2003/12/09 15:28:43
[serverloop.c]
make ClientKeepAlive work for ssh -N, too (no login shell requested).
1) send a bogus channel request if we find a channel
2) send a bogus global request if we don't have a channel
ok + test beck@
- [email protected] 2003/12/09 17:29:04
[sshd.c]
fix -o and HUP; ok henning@
- [email protected] 2003/12/09 17:30:05
[ssh.c]
don't modify argv for ssh -o; similar to sshd.c 1.283
- [email protected] 2003/12/09 21:53:37
[readconf.c readconf.h scp.1 servconf.c servconf.h sftp.1 ssh.1]
[ssh_config.5 sshconnect.c sshd.c sshd_config.5]
rename keepalive to tcpkeepalive; the old name causes too much
confusion; ok djm, dtucker; with help from jmc@
- [email protected] 2003/12/09 23:45:32
[clientloop.c]
Clear exit code when ssh -N is terminated with a SIGTERM. ok markus@
- [email protected] 2003/12/14 12:37:21
[ssh_config.5]
we don't support GSS KEX; from Simon Wilkinson
- [email protected] 2003/12/16 15:49:51
[clientloop.c clientloop.h readconf.c readconf.h scp.1 sftp.1 ssh.1]
[ssh.c ssh_config.5]
application layer keep alive (ServerAliveInterval ServerAliveCountMax)
for ssh(1), similar to the sshd(8) option; ok beck@; with help from
jmc and dtucker@
- [email protected] 2003/12/16 15:51:54
[dh.c]
use <= instead of < in dh_estimate; ok provos/hshoexer;
do not return < DH_GRP_MIN
- (dtucker) [acconfig.h configure.ac uidswap.c] Bug #645: Check for
setres[ug]id() present but not implemented (eg some Linux/glibc
combinations).
- (bal) [openbsd-compat/bsd-misc.c] unset 'signal' defined if we are
using a real 'signal()' (Noticed by a NeXT Compile)
20031209
- (dtucker) OpenBSD CVS Sync
- [email protected] 2003/11/25 23:10:08
[ssh-add.1]
ssh-add doesn't need to be a descendant of ssh-agent. Ok markus@, jmc@.
- [email protected] 2003/11/26 21:44:29
[cipher-aes.c]
fix #ifdef before #define; ok markus@
(RCS ID sync only, Portable already had this)
- [email protected] 2003/12/02 12:15:10
[progressmeter.c]
improvments from andreas@:
* saner speed estimate for transfers that takes less than a second by
rounding the time to 1 second.
* when the transfer is finished calculate the actual total speed
rather than the current speed which is given during the transfer
- [email protected] 2003/12/02 17:01:15
[channels.c session.c ssh-agent.c ssh.h sshd.c]
use SSH_LISTEN_BACKLOG (=128) in listen(2).
- [email protected] 2003/12/07 06:34:18
[moduli.c]
remove unused debugging #define templates
- [email protected] 2003/12/08 11:00:47
[kexgexc.c]
print requested group size in debug; ok djm
- [email protected] 2003/12/09 13:52:55
[moduli.c]
Prevent ssh-keygen -T from outputting moduli with a generator of 0, since
they can't be used for Diffie-Hellman. Assistance and ok djm@
- (dtucker) [ssh-keyscan.c] Sync RCSIDs, missed in SSH_SSFDMAX change below.
20031208
- (tim) [configure.ac] Bug 770. Fix --without-rpath.
20031123
- (djm) [canohost.c] Move IPv4inV6 mapped address normalisation to its own
function and call it unconditionally
- (djm) OpenBSD CVS Sync
- [email protected] 2003/11/23 23:17:34
[ssh-keyscan.c]
from portable - use sysconf to detect fd limit; ok markus@
(tidy diff by adding SSH_SSFDMAX macro to defines.h)
- [email protected] 2003/11/23 23:18:45
[ssh-keygen.c]
consistency PATH_MAX -> MAXPATHLEN; ok markus@
(RCS ID sync only)
- [email protected] 2003/11/23 23:21:21
[scp.c]
from portable: rename clashing variable limit-> limit_rate; ok markus@
(RCS ID sync only)
- [email protected] 2003/11/24 00:16:35
[ssh.1 ssh.c]
Make ssh -k mean GSSAPIDelegateCredentials=no. Suggestion & ok markus@
- (djm) Annotate OpenBSD-derived files in openbsd-compat/ with original
source file path (in OpenBSD tree).
20031122
- (dtucker) [channels.c] Make AIX write limit code clearer. Suggested by djm@
- (dtucker) [auth-passwd.c openbsd-compat/port-aix.c openbsd-compat/port-aix.h]
Move AIX specific password authentication code to port-aix.c, call
authenticate() until reenter flag is clear.
- (dtucker) [auth-sia.c configure.ac] Tru64 update from cmadams at hiwaay.net.
Use permanently_set_uid for SIA, only define DISABLE_FD_PASSING when SIA
is enabled, rely on SIA to check for locked accounts if enabled. ok djm@
- (djm) [scp.c] Rename limitbw -> limit_rate to match upstreamed patch
- (djm) [sftp-int.c] Remove duplicated code from bogus sync
- (djm) [packet.c] Shuffle #ifdef to reduce conditionally compiled code
20031121
- (djm) OpenBSD CVS Sync
- [email protected] 2003/11/20 11:39:28
[progressmeter.c]
fix rounding errors; from andreas@
- [email protected] 2003/11/21 11:57:03
[everything]
unexpand and delete whitespace at EOL; ok markus@
(done locally and RCS IDs synced)
20031118
- (djm) Fix early exit for root auth success when UsePAM=yes and
PermitRootLogin=no
- (dtucker) [auth-pam.c] Convert chauthtok_conv into a generic tty_conv,
and use it for do_pam_session. Fixes problems like pam_motd not
displaying anything. ok djm@
- (dtucker) [auth-pam.c] Only use pam_putenv if our platform has it. ok djm@
- (djm) OpenBSD CVS Sync
- [email protected] 2003/11/18 00:40:05
[serverloop.c]
Correct check for authctxt->valid. ok djm@
- [email protected] 2003/11/18 10:53:07
[monitor.c]
unbreak fake authloop for non-existent users (my screwup). Spotted and
tested by dtucker@; ok markus@
20031117
- (djm) OpenBSD CVS Sync
- [email protected] 2003/11/03 09:03:37
[auth-chall.c]
make this a little more idiot-proof; ok markus@
(includes portable-specific changes)
- [email protected] 2003/11/03 09:09:41
[sshconnect.c]
move changed key warning into warn_changed_key(). ok markus@
- [email protected] 2003/11/03 09:37:32
[sshconnect.c]
do not free static type pointer in warn_changed_key()
- [email protected] 2003/11/04 08:54:09
[auth1.c auth2.c auth2-pubkey.c auth.h auth-krb5.c auth-passwd.c]
[auth-rhosts.c auth-rh-rsa.c auth-rsa.c monitor.c serverloop.c]
[session.c]
standardise arguments to auth methods - they should all take authctxt.
check authctxt->valid rather then pw != NULL; ok markus@
- [email protected] 2003/11/08 16:02:40
[auth1.c]
remove unused variable (pw). ok djm@
(id sync only - still used in portable)
- [email protected] 2003/11/08 19:17:29
[sftp-int.c]
typos from Jonathon Gray;
- [email protected] 2003/11/10 16:23:41
[bufaux.c bufaux.h cipher.c cipher.h hostfile.c hostfile.h key.c]
[key.h sftp-common.c sftp-common.h sftp-server.c sshconnect.c sshd.c]
[ssh-dss.c ssh-rsa.c uuencode.c uuencode.h]
constify. ok markus@ & djm@
- [email protected] 2003/11/12 10:12:15
[scp.c]
When called with -q, pass -q to ssh; suppresses SSH2 banner. ok markus@
- [email protected] 2003/11/12 16:39:58
[dns.c dns.h readconf.c ssh_config.5 sshconnect.c]
update SSHFP validation. ok markus@
- [email protected] 2003/11/12 20:14:51
[ssh_config.5]
make verb agree with subject, and kill some whitespace;
- [email protected] 2003/11/14 13:19:09
[sshconnect2.c]
cleanup and minor fixes for the client code; from Simon Wilkinson
- [email protected] 2003/11/17 09:45:39
[msg.c msg.h sshconnect2.c ssh-keysign.c]
return error on msg send/receive failure (rather than fatal); ok markus@
- [email protected] 2003/11/17 11:06:07
[auth2-gss.c gss-genr.c gss-serv.c monitor.c monitor.h monitor_wrap.c]
[monitor_wrap.h sshconnect2.c ssh-gss.h]
replace "gssapi" with "gssapi-with-mic"; from Simon Wilkinson;
test + ok jakob.
- (djm) Bug #632: Don't call pam_end indirectly from within kbd-int
conversation function
- (djm) Export environment variables from authentication subprocess to
parent. Part of Bug #717
20031115
- (dtucker) [regress/agent-ptrace.sh] Test for GDB output from Solaris and
HP-UX, skip test on AIX.
20031113
- (dtucker) [auth-pam.c] Append newlines to lines output by the
pam_chauthtok_conv().
- (dtucker) [README ssh-host-config ssh-user-config Makefile] (All
contrib/cygwin). Major update from vinschen at redhat.com.
- Makefile provides a `cygwin-postinstall' target to run right after
`make install'.
- Better support for Windows 2003 Server.
- Try to get permissions as correct as possible.
- New command line options to allow full automated host configuration.
- Create configs from skeletons in /etc/defaults/etc.
- Use /bin/bash, allows reading user input with readline support.
- Remove really old configs from /usr/local.
- (dtucker) [auth-pam.c] Add newline to accumulated PAM_TEXT_INFO and
PAM_ERROR_MSG messages.
20031106
- (djm) Clarify UsePAM consequences a little more
20031103
- (dtucker) [contrib/cygwin/ssh-host-config] Ensure entries in /etc/services
are created correctly with CRLF line terminations. Patch from vinschen at
redhat.com.
- (dtucker) OpenBSD CVS Sync
- [email protected] 2003/10/15 09:48:45
[monitor_wrap.c]
check pmonitor != NULL
- [email protected] 2003/10/21 09:50:06
[auth2-gss.c]
make sure the doid is larger than 2
- [email protected] 2003/10/26 16:57:43
[sshconnect2.c]
rename 'supported' static var in userauth_gssapi() to 'gss_supported'
to avoid shadowing the global version. markus@ ok
- [email protected] 2003/10/28 09:08:06
[misc.c]
error->debug for getsockopt+TCP_NODELAY; several requests
- [email protected] 2003/11/02 11:01:03
[auth2-gss.c compat.c compat.h sshconnect2.c]
remove support for SSH_BUG_GSSAPI_BER; [email protected]
- (dtucker) [regress/agent-ptrace.sh] Use numeric uid and gid.
20031021
- (dtucker) [INSTALL] Some system crypt() functions support MD5 passwords
directly. Noted by Darren.Moffat at sun.com.
- (dtucker) [regress/agent-ptrace.sh] Skip agent-test unless SUDO is set,
make agent setgid during test.
20031017
- (dtucker) [INSTALL] Note that --with-md5 is now required on platforms with
MD5 passwords even if PAM support is enabled. From steev at detritus.net.
20031015
- (dtucker) OpenBSD CVS Sync
- [email protected] 2003/10/08 08:27:36
[scp.1 scp.c sftp-server.8 sftp.1 sftp.c ssh.1 sshd.8]
scp and sftp: add options list and sort options. options list requested
by deraadt@
sshd: use same format as ssh
ssh: remove wrong option from list
sftp-server: Subsystem is documented in ssh_config(5), not sshd(8)
ok deraadt@ markus@
- [email protected] 2003/10/08 15:21:24
[readconf.c ssh_config.5]
default GSS API to no in client, too; ok jakob, deraadt@
- [email protected] 2003/10/11 08:24:08
[readconf.c readconf.h ssh.1 ssh.c ssh_config.5]
remote x11 clients are now untrusted by default, uses xauth(8) to generate
untrusted cookies; ForwardX11Trusted=yes restores old behaviour.
ok deraadt; feedback and ok djm/fries
- [email protected] 2003/10/11 08:26:43
[sshconnect2.c]
search keys in reverse order; fixes #684
- [email protected] 2003/10/11 11:36:23
[monitor_wrap.c]
return NULL for missing banner; ok djm@
- [email protected] 2003/10/12 13:12:13
[ssh_config.5]
note that EnableSSHKeySign should be in the non-hostspecific section;
remove unnecessary .Pp;
ok markus@
- [email protected] 2003/10/13 08:22:25
[scp.1 sftp.1]
don't refer to options related to forwarding; ok jmc@
- [email protected] 2003/10/14 19:42:10
[dns.c dns.h readconf.c ssh-keygen.c sshconnect.c]
include SSHFP lookup code (not enabled by default). ok markus@
- [email protected] 2003/10/14 19:43:23
[README.dns]
update
- [email protected] 2003/10/14 19:54:39
[session.c ssh-agent.c]
10X for mkdtemp; djm@
- (dtucker) [acconfig.h configure.ac dns.c openbsd-compat/getrrsetbyname.c
openbsd-compat/getrrsetbyname.h] DNS fingerprint support is now always
compiled in but disabled in config.
- (dtucker) [auth.c] Check for disabled password expiry on HP-UX Trusted Mode.
- (tim) [regress/banner.sh] portability fix.
20031009
- (dtucker) [sshd_config.5] UsePAM defaults to "no". ok djm@
20031008
- (dtucker) OpenBSD CVS Sync
- [email protected] 2003/10/07 01:47:27
[sshconnect2.c]
Don't use logit for banner, since it truncates to MSGBUFSIZ; bz #668 &
#707. ok markus@
- [email protected] 2003/10/07 07:04:16
[sftp-int.c]
sftp quoting fix from admorten AT umich.edu; ok markus@
- [email protected] 2003/10/07 21:58:28
[sshconnect2.c]
set ptr to NULL after free
- [email protected] 2003/10/07 01:52:13
[regress/Makefile regress/banner.sh]
Test SSH2 banner. ok markus@
- [email protected] 2003/10/07 07:04:52
[regress/sftp-cmds.sh]
more sftp quoting regress tests; ok markus
20031007
- (djm) Delete autom4te.cache after autoreconf
- (dtucker) [auth-pam.c auth-pam.h session.c] Make PAM use the new static
cleanup functions. With & ok djm@
- (dtucker) [contrib/redhat/openssh.spec] Bug #714: Now that UsePAM is a
run-time switch, always build --with-md5-passwords.
- (dtucker) [configure.ac openbsd-compat/Makefile.in openbsd-compat/strtoul.c]
Bug #670: add strtoul() to openbsd-compat for platforms lacking it. ok djm@
- (dtucker) [configure.ac] Bug #715: Set BROKEN_SETREUID and BROKEN_SETREGID
on Reliant Unix. Patch from Robert.Dahlem at siemens.com.
- (dtucker) [configure.ac] Bug #710: Check for dlsym() in libdl on
Reliant Unix. Based on patch from Robert.Dahlem at siemens.com.
20031003
- (dtucker) OpenBSD CVS Sync
- [email protected] 2003/10/02 10:41:59
[sshd.c]
print openssl version, too, several requests; ok henning/djm.
- [email protected] 2003/10/02 08:26:53
[ssh-gss.h]
missing $OpenBSD:; dtucker
- (tim) [contrib/caldera/openssh.spec] Remove obsolete --with-ipv4-default
option.
20031002
- (dtucker) OpenBSD CVS Sync
- [email protected] 2003/09/23 20:17:11
[Makefile.in auth1.c auth2.c auth.c auth.h auth-krb5.c canohost.c
cleanup.c clientloop.c fatal.c gss-serv.c log.c log.h monitor.c monitor.h
monitor_wrap.c monitor_wrap.h packet.c serverloop.c session.c session.h
ssh-agent.c sshd.c]
replace fatal_cleanup() and linked list of fatal callbacks with static
cleanup_exit() function. re-refine cleanup_exit() where appropriate,
allocate sshd's authctxt eary to allow simpler cleanup in sshd.
tested by many, ok deraadt@
- [email protected] 2003/09/23 20:18:52
[progressmeter.c]
don't print trailing \0; bug #709; [email protected]
ok millert/deraadt@
- [email protected] 2003/09/23 20:41:11
[channels.c channels.h clientloop.c]
move client only agent code to clientloop.c
- [email protected] 2003/09/26 08:19:29
[sshd.c]
no need to set the listen sockets to non-block; ok deraadt@
- [email protected] 2003/09/29 11:40:51
[ssh.1]
- add list of options to -o and .Xr ssh_config(5)
- some other cleanup
requested by deraadt@;
ok deraadt@ markus@
- [email protected] 2003/09/29 20:19:57
[servconf.c sshd_config]
GSSAPICleanupCreds -> GSSAPICleanupCredentials
- (dtucker) [configure.ac] Don't set DISABLE_SHADOW when configuring
--with-pam. ok djm@
- (dtucker) [ssh-gss.h] Prototype change missed in sync.
- (dtucker) [session.c] Fix bus errors on some 64-bit Solaris configurations.
Based on patches by Matthias Koeppe and Thomas Baden. ok djm@
20030930
- (bal) Fix issues in openbsd-compat/realpath.c
20030925
- (dtucker) [configure.ac openbsd-compat/xcrypt.c] Bug #633: Remove
DISABLE_SHADOW for HP-UX, use getspnam instead of getprpwnam. Patch from
michael_steffens at hp.com, ok djm@
- (tim) [sshd_config] UsePAM defaults to no.
20030924
- (djm) Update version.h and spec files for HEAD
- (dtucker) [configure.ac] IRIX5 needs the same setre[ug]id defines as IRIX6.
20030923
- (dtucker) [Makefile.in] Bug #644: Fix "make clean" for out-of-tree
builds. Portability corrections from tim@.
- (dtucker) [configure.ac] Bug #665: uid swapping issues on Mac OS X.
Patch from max at quendi.de.
- (dtucker) [configure.ac] Bug #657: uid swapping issues on BSDi.
- (dtucker) [configure.ac] Bug #653: uid swapping issues on Tru64.
- (dtucker) [configure.ac] Bug #693: uid swapping issues on NCR MP-RAS.
Patch from david.haughton at ncr.com
- (dtucker) [configure.ac] Bug #659: uid swapping issues on IRIX 6.
Part of patch supplied by bugzilla-openssh at thewrittenword.com
- (dtucker) [configure.ac openbsd-compat/fake-rfc2553.c
openbsd-compat/fake-rfc2553.h] Bug #659: Test for and handle systems with
where gai_strerror is defined as "const char *". Part of patch supplied
by bugzilla-openssh at thewrittenword.com
- (dtucker) [contrib/cygwin/README contrib/cygwin/ssh-host-config] Update
ssh-host-config to match current defaults, bump README version. Patch from
vinschen at redhat.com.
- (dtucker) [uidswap.c] Don't test restoration of uid on Cygwin since the
OS does not support permanently dropping privileges. Patch from
vinschen at redhat.com.
- (dtucker) [openbsd-compat/port-aix.c] Use correct include for xmalloc.h,
add canohost.h to stop warning. Based on patch from openssh-unix-dev at
thewrittenword.com
- (dtucker) [INSTALL] Bug #686: Document requirement for zlib 1.1.4 or
higher.
- (tim) Fix typo. s/SETEIUD_BREAKS_SETUID/SETEUID_BREAKS_SETUID/
- (tim) [configure.ac] Bug 665: move 3 new AC_DEFINES outside of AC_TRY_RUN.
Report by distler AT golem ph utexas edu.
- (dtucker) [contrib/aix/pam.conf] Include example pam.conf for AIX from
article by genty at austin.ibm.com, included with the author's permission.
- (dtucker) OpenBSD CVS Sync
- [email protected] 2003/09/18 07:52:54
[sshconnect.c]
missing {}; bug #656; jclonguet at free.fr
- [email protected] 2003/09/18 07:54:48
[buffer.c]
protect against double free; #660; zardoz at users.sf.net
- [email protected] 2003/09/18 07:56:05
[authfile.c]
missing buffer_free(&encrypted); #662; zardoz at users.sf.net
- [email protected] 2003/09/18 08:49:45
[deattack.c misc.c session.c ssh-agent.c]
more buffer allocation fixes; from Solar Designer; CAN-2003-0682;
ok millert@
- [email protected] 2003/09/18 13:02:21
[authfd.c bufaux.c dh.c mac.c ssh-keygen.c]
A few signedness fixes for harmless situations; markus@ ok
- [email protected] 2003/09/19 09:02:02
[packet.c]
buffer_dump only if PACKET_DEBUG is defined; Jedi/Sector One; pr 3471
- [email protected] 2003/09/19 09:03:00
[buffer.c]
sign fix in buffer_dump; Jedi/Sector One; pr 3473
- [email protected] 2003/09/19 11:29:40
[ssh-agent.c]
provide a ssh-agent specific fatal() function; ok deraadt
- [email protected] 2003/09/19 11:30:39
[ssh-keyscan.c]
avoid fatal_cleanup, just call exit(); ok deraadt
- [email protected] 2003/09/19 11:31:33
[channels.c]
do not call channel_free_all on fatal; ok deraadt
- [email protected] 2003/09/19 11:33:09
[packet.c sshd.c]
do not call packet_close on fatal; ok deraadt
- [email protected] 2003/09/19 17:40:20
[scp.c]
error handling for remote-remote copy; #638; report Harald Koenig;
ok millert, fgs, henning, deraadt
- [email protected] 2003/09/19 17:43:35
[clientloop.c sshtty.c sshtty.h]
remove fatal callbacks from client code; ok deraadt
- (bal) "extration" -> "extraction" in ssh-rand-helper.c; repoted by john
on #unixhelp@efnet
- (tim) [configure.ac] add --disable-etc-default-login option. ok djm
- (djm) Sync with V_3_7 branch:
- (djm) Fix SSH1 challenge kludge
- (djm) Bug #671: Fix builds on OpenBSD
- (djm) Bug #676: Fix PAM stack corruption
- (djm) Fix bad free() in PAM code
- (djm) Don't call pam_end before pam_init
- (djm) Enable build with old OpenSSL again
- (djm) Trim deprecated options from INSTALL. Mention UsePAM
- (djm) Fix quote handling in sftp; Patch from admorten AT umich.edu
$Id: ChangeLog,v 1.4524 2006/09/01 10:29:10 dtucker Exp $
Reference in New Issue View Git Blame Copy Permalink