Commit Graph

6327 Commits

Author SHA1 Message Date
Damien Miller
a10abe9e4b s/recommended/required in warning:
"It is recommended that your private key files are NOT accessible by others."

since there is no way to skip this check; bz#1878
2011-04-12 15:39:35 +10:00
Damien Miller
db59a3fb22 (whitespace change to test sync to hg) 2011-03-28 15:07:06 +11:00
Darren Tucker
e541aaaf0f - (dtucker) [contrib/cygwin/ssh-host-config] From Corinna: revamp of the
Cygwin-specific service installer script ssh-host-config.  The actual
   functionality is the same, the revisited version is just more
   exact when it comes to check for problems which disallow to run
   certain aspects of the script.  So, part of this script and the also
   rearranged service helper script library "csih" is to check if all
   the tools required to run the script are available on the system.
   The new script also is more thorough to inform the user why the
   script failed.  Patch from vinschen at redhat com.
2011-02-21 21:41:29 +11:00
Damien Miller
0588beba39 - djm@cvs.openbsd.org 2011/02/16 00:31:14
[ssh-keysign.c]
     make hostbased auth with ECDSA keys work correctly. Based on patch
     by harvey.eneman AT oracle.com in bz#1858; ok markus@ (pre-lock)
2011-02-18 09:18:45 +11:00
Darren Tucker
ea676a6422 - (dtucker) [contrib/cygwin/ssh-{host,user}-config] Add ECDSA key
generation and simplify.  Patch from Corinna Vinschen.
2011-02-06 13:31:23 +11:00
Darren Tucker
3b9617ecbd - (dtucker) [openbsd-compat/port-linux.c] Bug #1851: fix syntax error in
selinux code.  Patch from Leonardo Chiquitto.
2011-02-06 13:24:35 +11:00
Damien Miller
0d30b092ce - (djm) [README contrib/caldera/openssh.spec contrib/redhat/openssh.spec]
[contrib/suse/openssh.spec] update versions in docs and spec files.
 - Release OpenSSH 5.8p1
2011-02-04 12:43:36 +11:00
Damien Miller
a69812707d - djm@cvs.openbsd.org 2011/02/04 00:44:43
[version.h]
     openssh-5.8
2011-02-04 11:47:20 +11:00
Damien Miller
0a5f0129a3 - djm@cvs.openbsd.org 2011/02/04 00:44:21
[key.c]
     fix uninitialised nonce variable; reported by Mateusz Kocielski
2011-02-04 11:47:01 +11:00
Damien Miller
b407dd8d05 - djm@cvs.openbsd.org 2011/01/31 21:42:15
[PROTOCOL.mux]
     cut'n'pasto; from bert.wesarg AT googlemail.com
2011-02-04 11:46:39 +11:00
Damien Miller
d4a5504cb1 - (djm) [openbsd-compat/port-linux.c] Check whether SELinux is enabled
before attempting setfscreatecon(). Check whether matchpathcon()
   succeeded before using its result. Patch from cjwatson AT debian.org;
   bz#1851
2011-01-28 10:30:18 +11:00
Tim Rice
648f876566 20110127
- (tim) [configure.ac] Consistent M4 quoting throughout, updated obsolete
   AC_TRY_COMPILE with AC_COMPILE_IFELSE, updated obsolete AC_TRY_LINK with
   AC_LINK_IFELSE, updated obsolete AC_TRY_RUN with AC_RUN_IFELSE, misc white
   space changes for consistency/readability. Makes autoconf 2.68 happy.
   "Nice work" djm
2011-01-26 12:38:57 -08:00
Tim Rice
d069c48207 20110127
- (tim) [config.guess config.sub] Sync with upstream.
2011-01-26 12:32:12 -08:00
Damien Miller
71adf127e8 - (djm) [configure.ac Makefile.in ssh.c openbsd-compat/port-linux.c
openbsd-compat/port-linux.h] Move SELinux-specific code from ssh.c to
   port-linux.c to avoid compilation errors. Add -lselinux to ssh when
   building with SELinux support to avoid linking failure; report from
   amk AT spamfence.net; ok dtucker
2011-01-25 12:16:15 +11:00
Damien Miller
6f8f04b860 - (djm) Release 5.7p1 2011-01-22 20:25:11 +11:00
Damien Miller
4a5eb41cee trim entries older than 5.5p1 2011-01-22 20:24:34 +11:00
Damien Miller
966accc533 - (djm) [README contrib/caldera/openssh.spec contrib/redhat/openssh.spec]
[contrib/suse/openssh.spec] update versions in docs and spec files.
2011-01-22 20:23:10 +11:00
Damien Miller
ad4b1adf95 - OpenBSD CVS Sync
- djm@cvs.openbsd.org 2011/01/22 09:18:53
     [version.h]
     crank to OpenSSH-5.7
2011-01-22 20:21:33 +11:00
Darren Tucker
79241377df - (dtucker) [configure.ac openbsd-compat/openssl-compat.{c,h}] Add
RSA_get_default_method() for the benefit of openssl versions that don't
   have it (at least openssl-engine-0.9.6b).  Found and tested by Kevin Brott,
   ok djm@.
2011-01-22 09:37:01 +11:00
Damien Miller
e323ebc250 - (djm) [configure.ac] Disable ECC on OpenSSL <0.9.8g. Releases prior to
0.9.8 lacked it, and 0.9.8a through 0.9.8d have proven buggy in pre-
   release testing (random crashes and failure to load ECC keys).
   ok dtucker@
2011-01-19 23:12:27 +11:00
Tim Rice
15e1b4dea7 - (tim) [contrib/caldera/openssh.spec] Use CFLAGS from Makefile instead
of RPM so build completes. Signatures were changed to .asc since 4.1p1.
2011-01-18 20:47:04 -08:00
Darren Tucker
ea52a82969 - (dtucker) [LICENCE Makefile.in audit-bsm.c audit-linux.c audit.c audit.h
configure.ac defines.h loginrec.c]  Bug #1402: add linux audit subsystem
   support, based on patches from Tomas Mraz and jchadima at redhat.
2011-01-17 21:15:27 +11:00
Darren Tucker
263d43d2a5 - (dtucker) [openbsd-compat/port-linux.c] Fix minor bug caught by -Werror on
the tinderbox.
2011-01-17 18:50:22 +11:00
Tim Rice
6dfcd34042 - (tim) [regress/agent-getpeereid.sh] shell portability fix. 2011-01-16 22:53:56 -08:00
Damien Miller
58497780ab - (djm) [configure.ac regress/agent-getpeereid.sh regress/multiplex.sh]
[regress/sftp-glob.sh regress/test-exec.sh] Rework how feature tests are
   disabled on platforms that do not support them; add a "config_defined()"
   shell function that greps for defines in config.h and use them to decide
   on feature tests.
   Convert a couple of existing grep's over config.h to use the new function
   Add a define "FILESYSTEM_NO_BACKSLASH" for filesystem that can't represent
   backslash characters in filenames, enable it for Cygwin and use it to turn
   of tests for quotes backslashes in sftp-glob.sh.
   based on discussion with vinschen AT redhat.com and dtucker@; ok dtucker@
2011-01-17 16:17:09 +11:00
Darren Tucker
0c93adc7c1 - (dtucker) [openbsd-compat/port-linux.c] Bug #1838: Add support for the new
Linux OOM-killer magic values that changed in 2.6.36 kernels, with fallback
   to the old values.  Feedback from vapier at gentoo org and djm, ok djm.
2011-01-17 11:55:59 +11:00
Damien Miller
1ccbfa88b1 - (djm) [regress/agent-getpeereid.sh] leave stdout attached when running
ssh-add to avoid $SUDO failures on Linux
2011-01-17 11:52:40 +11:00
Damien Miller
fd3669eb26 - (djm) [regress/agent-ptrace.sh] Fix false failure on OS X by adding
its unique snowflake of a gdb error to the ones we look for.
2011-01-17 11:20:18 +11:00
Damien Miller
369c0e8eef - (djm) [regress/Makefile] use $TEST_SSH_KEYGEN instead of the one in
$PATH, fix cleanup of droppings; reported by openssh AT
   roumenpetrov.info; ok dtucker@
2011-01-17 10:51:40 +11:00
Damien Miller
cfd6e4f57f - djm@cvs.openbsd.org 2011/01/16 12:05:59
[clientloop.c]
     a couple more tweaks to the post-close protocol 1 stderr/stdout flush:
     now that we use atomicio(), convert them from while loops to if statements
     add test and cast to compile cleanly with -Wsigned
2011-01-16 23:18:33 +11:00
Damien Miller
6fb6fd5662 - djm@cvs.openbsd.org 2011/01/16 11:50:36
[sshconnect.c]
     reset the SIGPIPE handler when forking to execute child processes;
     ok dtucker@
2011-01-16 23:17:45 +11:00
Damien Miller
4791f9dcec - djm@cvs.openbsd.org 2011/01/16 11:50:05
[clientloop.c]
     Use atomicio when flushing protocol 1 std{out,err} buffers at
     session close. This was a latent bug exposed by setting a SIGCHLD
     handler and spotted by kevin.brott AT gmail.com; ok dtucker@
2011-01-16 23:16:53 +11:00
Darren Tucker
50c61f88ab - (dtucker) [Makefile.in configure.ac regress/kextype.sh] Skip sha256-based
on configurations that don't have it.
2011-01-16 18:28:09 +11:00
Darren Tucker
08f83883f5 not February yet... 2011-01-16 18:24:04 +11:00
Tim Rice
c5c346b101 - (tim) [regress/cert-hostkey.sh] Add missing TEST_SSH_ECC guard around some
ecdsa bits.
2011-01-13 22:36:14 -08:00
Tim Rice
02d99da976 - (tim) [regress/cert-hostkey.sh] Typo. Missing $ on variable name. 2011-01-13 22:20:27 -08:00
Damien Miller
e9b40487fa - (djm) [Makefile.in] Use shell test to disable ecdsa key generating in
host-key-force target rather than a substitution that is replaced with a
   comment so that the Makefile.in is still a syntactically valid Makefile
   (useful to run the distprep target)
2011-01-14 14:47:37 +11:00
Damien Miller
42747df8b7 - djm@cvs.openbsd.org 2011/01/13 21:55:25
[PROTOCOL.mux]
     correct protocol names and add a couple of missing protocol number
     defines; patch from bert.wesarg AT googlemail.com
2011-01-14 12:01:50 +11:00
Damien Miller
445c9a507d - djm@cvs.openbsd.org 2011/01/13 21:54:53
[mux.c]
     correct error messages; patch from bert.wesarg AT googlemail.com
2011-01-14 12:01:29 +11:00
Damien Miller
5278806e39 - (djm) [regress/kextype.sh] Testing diffie-hellman-group-exchange-sha256
should not depend on ECC support
2011-01-13 22:05:14 +11:00
Damien Miller
9b16086e74 - (djm) [myproposal.h] Fix reversed OPENSSL_VERSION_NUMBER test and bad
#define that was causing diffie-hellman-group-exchange-sha256 to be
   incorrectly disabled
2011-01-13 22:00:20 +11:00
Damien Miller
cbaf8e6ec1 - (djm) [regress/Makefile] add a few more generated files to the clean
target
2011-01-13 21:08:27 +11:00
Damien Miller
ff22df538e - (djm) [entropy.c] cast OPENSSL_VERSION_NUMBER to u_long to avoid
gcc warning on platforms where it defaults to int
2011-01-13 21:05:27 +11:00
Tim Rice
9b87a5ce3c - (tim) [Makefile.in configure.ac opensshd.init.in] Add support for generating
ecdsa keys. ok djm.
2011-01-12 22:35:43 -08:00
Tim Rice
cce927c25f - (tim) [Makefile.in] test the ECC bits if we have the capability. ok djm 2011-01-12 19:06:31 -08:00
Damien Miller
1708cb7d0d - (djm) [misc.c] include time.h for nanosleep() prototype 2011-01-13 12:21:34 +11:00
Damien Miller
134d02a494 - (djm) [configure.ac] Fix broken test for gcc >= 4.4 with per-compiler
flag tests that don't depend on gcc version at all; suggested by and
   ok dtucker@
2011-01-12 16:00:37 +11:00
Damien Miller
945aa0c744 - (djm) [configure.ac] Turn on -Wno-unused-result for gcc >= 4.4 to avoid
silly warnings on write() calls we don't care succeed or not.
2011-01-12 13:34:02 +11:00
Damien Miller
4927aaf446 - djm@cvs.openbsd.org 2011/01/12 01:53:14
avoid some integer overflows mostly with GLOB_APPEND and GLOB_DOOFFS
     and sanity check arguments (these will be unnecessary when we switch
     struct glob members from being type into to size_t in the future);
     "looks ok" tedu@ feedback guenther@
2011-01-12 13:32:03 +11:00
Damien Miller
b66e917831 - nicm@cvs.openbsd.org 2010/10/08 21:48:42
[openbsd-compat/glob.c]
     Extend GLOB_LIMIT to cover readdir and stat and bump the malloc limit
     from ARG_MAX to 64K.
     Fixes glob-using programs (notably ftp) able to be triggered to hit
     resource limits.
     Idea from a similar NetBSD change, original problem reported by jasper@.
     ok millert tedu jasper
2011-01-12 13:30:18 +11:00