Commit Graph

11959 Commits

Author SHA1 Message Date
Harmen Stoppels
5eb796a369
Fix snprintf configure test for clang 15
Clang 15 -Wimplicit-int defaults to an error in C99 mode and above.
A handful of tests have "main(..." and not "int main(..." which caused
the tests to produce incorrect results.
2022-10-14 07:37:16 +11:00
Damien Miller
c64b62338b
skip bsd-poll.h if poll.h found; ok dtucker 2022-10-10 12:32:43 +11:00
djm@openbsd.org
5ee2b8ccfc
upstream: honour user's umask if it is more restrictive then the ssh
default (022); based on patch from Alex Henrie, ok dtucker@ deraadt@

OpenBSD-Commit-ID: fe1b9e15fc9a4f49fc338e848ce14d8727abe82d
2022-10-07 09:45:02 +11:00
Darren Tucker
a75cffc270
Add LibreSSL 3.6.0 to test suite.
While there, bump OpenSSL to latest 1.1.1q release.
2022-10-07 03:54:56 +11:00
Darren Tucker
fcc0f0c0e9
Add 9.1 branch to CI status page. 2022-10-06 21:18:16 +11:00
Darren Tucker
ef211eee63
Test commits to all branches of portable.
Only test OpenBSD upstream on commits to master since that's what it
tracks.
2022-10-05 06:31:48 +11:00
Damien Miller
fe646de03c
whitespace at EOL 2022-10-05 03:47:26 +11:00
Damien Miller
a6e1852d10
mention libfido2 autodetection 2022-10-05 03:40:01 +11:00
Damien Miller
7360c2c206
remove mention of --with-security-key-builtin
it is enabled by default when libfido2 is installed
2022-10-05 03:37:36 +11:00
Damien Miller
0ffb46f2ee
update .depend 2022-10-04 01:51:42 +11:00
Damien Miller
657e676ff6
update release notes URL 2022-10-04 01:45:52 +11:00
Damien Miller
f059da2b29
crank versions in RPM spec files 2022-10-04 01:45:41 +11:00
djm@openbsd.org
b51f3f172d
upstream: openssh-9.1
OpenBSD-Commit-ID: 5a467b2ee81da01a86adf1ad93b62b1728494e56
2022-09-27 19:37:13 +10:00
dtucker@openbsd.org
4cf8d0c0f3
upstream: Fix typo. From AlexanderStohr via github PR#343.
OpenBSD-Commit-ID: a134c9b4039e48803fc6a87f955b0f4a03181497
2022-09-27 08:16:44 +10:00
djm@openbsd.org
8179fed326
upstream: add RequiredRSASize to the list of keywords accepted by
-o; spotted by jmc@

OpenBSD-Commit-ID: fe871408cf6f9d3699afeda876f8adbac86a035e
2022-09-27 08:16:44 +10:00
Damien Miller
5f954929e9
no need for glob.h here
it also causes portability problems
2022-09-19 20:59:34 +10:00
Damien Miller
03d94a4720
avoid Wuninitialized false positive in gcc-12ish 2022-09-19 20:59:04 +10:00
djm@openbsd.org
9d95252911
upstream: use users-groups-by-id@openssh.com sftp-server extension
(when available) to fill in user/group names for directory listings.
Implement a client-side cache of see uid/gid=>user/group names. ok markus@

OpenBSD-Commit-ID: f239aeeadfa925a37ceee36ee8b256b8ccf4466e
2022-09-19 20:51:14 +10:00
djm@openbsd.org
8ff680368b
upstream: sftp client library support for
users-groups-by-id@openssh.com; ok markus@

OpenBSD-Commit-ID: ddb2f33a2da6349a9a89a8b5bcb9ca7c999394de
2022-09-19 20:49:14 +10:00
djm@openbsd.org
488f6e1c58
upstream: extend sftp-common.c:extend ls_file() to support supplied
user/group names; ok markus@

OpenBSD-Commit-ID: c70c70498b1fdcf158531117e405b6245863bfb0
2022-09-19 20:49:13 +10:00
djm@openbsd.org
74b77f7497
upstream: sftp-server(8): add a "users-groups-by-id@openssh.com"
extension request that allows the client to obtain user/group names that
correspond to a set of uids/gids.

Will be used to make directory listings more useful and consistent
in sftp(1).

ok markus@

OpenBSD-Commit-ID: 7ebabde0bcb95ef949c4840fe89e697e30df47d3
2022-09-19 20:49:13 +10:00
djm@openbsd.org
231a346c0c
upstream: better debugging for connect_next()
OpenBSD-Commit-ID: d16a307a0711499c971807f324484ed3a6036640
2022-09-19 19:25:14 +10:00
djm@openbsd.org
1875042c52
upstream: Add RequiredRSASize for sshd(8); RSA keys that fall
beneath this limit will be ignored for user and host-based authentication.

Feedback deraadt@ ok markus@

OpenBSD-Commit-ID: 187931dfc19d51873df5930a04f2d972adf1f7f1
2022-09-17 20:39:02 +10:00
djm@openbsd.org
54b333d12e
upstream: add a RequiredRSASize for checking RSA key length in
ssh(1). User authentication keys that fall beneath this limit will be
ignored. If a host presents a host key beneath this limit then the connection
will be terminated (unfortunately there are no fallbacks in the protocol for
host authentication).

feedback deraadt, Dmitry Belyavskiy; ok markus@

OpenBSD-Commit-ID: 430e339b2a79fa9ecc63f2837b06fdd88a7da13a
2022-09-17 20:39:02 +10:00
djm@openbsd.org
07d8771bac
upstream: Add a sshkey_check_rsa_length() call for checking the
length of an RSA key; ok markus@

OpenBSD-Commit-ID: de77cd5b11594297eda82edc594b0d32b8535134
2022-09-17 20:38:40 +10:00
djm@openbsd.org
3991a0cf94
upstream: actually hook up restrict_websafe; the command-line flag
was never actually used. Spotted by Matthew Garrett

OpenBSD-Commit-ID: 0b363518ac4c2819dbaa3dfad4028633ab9cdff1
2022-09-17 20:37:20 +10:00
djm@openbsd.org
30b2a7e429
upstream: correct error value
OpenBSD-Commit-ID: 780efcbad76281f11f14b2a5ff04eb6db3dfdad4
2022-09-17 20:37:19 +10:00
djm@openbsd.org
ac1ec95459
upstream: sftp: Be a bit more clever about completions
There are commands (e.g. "get" or "put") that accept two
arguments, a local path and a remote path. However, the way
current completion is written doesn't take this distinction into
account and always completes remote or local paths.

By expanding CMD struct and "cmds" array this distinction can be
reflected and with small adjustment to completer code the correct
path can be completed.

By Michal Privoznik, ok dtucker@

OpenBSD-Commit-ID: 1396d921c4eb1befd531f5c4a8ab47e7a74b610b
2022-09-16 13:35:22 +10:00
djm@openbsd.org
590db83384
upstream: sftp: Don't attempt to complete arguments for
non-existent commands

If user entered a non-existent command (e.g. because they made a
typo) there is no point in trying to complete its arguments. Skip
calling complete_match() if that's the case.

From Michal Privoznik

OpenBSD-Commit-ID: cf39c811a68cde2aeb98fc85addea4000ef6b07a
2022-09-16 13:35:21 +10:00
djm@openbsd.org
ff9809fdfd
upstream: sk_enroll: never drop SSH_SK_USER_VERIFICATION_REQD flag
from response

Now that all FIDO signing calls attempt first without PIN and then
fall back to trying PIN only if that attempt fails, we can remove the
hack^wtrick that removed the UV flag from the keys returned during
enroll.

By Corinna Vinschen

OpenBSD-Commit-ID: 684517608c8491503bf80cd175425f0178d91d7f
2022-09-14 10:16:06 +10:00
djm@openbsd.org
940dc10729
upstream: a little extra debugging
OpenBSD-Commit-ID: edf1601c1d0905f6da4c713f4d9cecc7d1c0295a
2022-09-14 10:16:05 +10:00
djm@openbsd.org
4b5f91cb95
upstream: ssh-agent: attempt FIDO key signing without PIN and use
the error to determine whether a PIN is required and prompt only if
necessary. from Corinna Vinschen

OpenBSD-Commit-ID: dd6be6a0b7148608e834ee737c3479b3270b00dd
2022-09-14 10:16:05 +10:00
jmc@openbsd.org
113523bf0b
upstream: .Li -> .Vt where appropriate; from josiah frentsos,
tweaked by schwarze

ok schwarze

OpenBSD-Commit-ID: 565046e3ce68b46c2f440a93d67c2a92726de8ed
2022-09-14 10:16:04 +10:00
jsg@openbsd.org
86af013b56
upstream: fix repeated words ok miod@ jmc@
OpenBSD-Commit-ID: 6765daefe26a6b648cc15cadbbe337596af709b7
2022-09-14 10:16:04 +10:00
djm@openbsd.org
0ba39b93b3
upstream: notifier_complete(NULL, ...) is a noop, so no need to test
that ctx!=NULL; from Corinna Vinschen

OpenBSD-Commit-ID: ade2f2e9cc519d01a586800c25621d910bce384a
2022-09-09 13:38:14 +10:00
Sam James
be19763532
openbsd-compat/bsd-asprintf: add <stdio.h> include for vsnprintf
Fixes the following build failure with Clang 15 on musl:
```
bsd-asprintf.c:51:8: error: call to undeclared library function 'vsnprintf' with type 'int (char *, unsigned long, const char *, struct __va_list_tag *)'; ISO C99 and laterclang -O2 -pipe -fdiagnostics-color=always -frecord-gcc-switches -pipe -Wunknown-warning-option -Qunused-arguments -Wall -Wpointer-arith -Wuninitialized -Wsign-compare -Wformat-security -Wsizeof-pointer-memaccess -Wno-pointer-sign -Wno-unused-result -Wmisleading-indentation -Wbitwise-instead-of-logical -fno-strict-aliasing -mretpoline  -ftrapv -fzero-call-used-regs=all -fno-builtin-memset -fstack-protector-strong -fPIE   -I. -I.  -D_XOPEN_SOURCE=600 -D_BSD_SOURCE -D_DEFAULT_SOURCE -DSSHDIR=\"/etc/ssh\" -D_PATH_SSH_PROGRAM=\"/usr/bin/ssh\" -D_PATH_SSH_ASKPASS_DEFAULT=\"/usr/lib/misc/ssh-askpass\" -D_PATH_SFTP_SERVER=\"/usr/lib/misc/sftp-server\" -D_PATH_SSH_KEY_SIGN=\"/usr/lib/misc/ssh-keysign\" -D_PATH_SSH_PKCS11_HELPER=\"/usr/lib/misc/ssh-pkcs11-helper\" -D_PATH_SSH_SK_HELPER=\"/usr/lib/misc/ssh-sk-helper\" -D_PATH_SSH_PIDDIR=\"/run\" -D_PATH_PRIVSEP_CHROOT_DIR=\"/var/empty\" -DHAVE_CONFIG_H -c cipher-aes.c -o cipher-aes.o
 do not support
      implicit function declarations [-Wimplicit-function-declaration]
        ret = vsnprintf(string, INIT_SZ, fmt, ap2);
              ^
bsd-asprintf.c:51:8: note: include the header <stdio.h> or explicitly provide a declaration for 'vsnprintf'
1 error generated.
```
2022-09-08 12:04:00 +10:00
Darren Tucker
6cb6f660bb
Remove DEF_WEAK, it's already in defines.h. 2022-09-02 16:43:27 +10:00
Darren Tucker
ce39e7d8b7
Resync arc4random with OpenBSD.
This brings us up to current, including djm's random-reseeding change,
as prompted by logan at cyberstorm.mu in bz#3467.  It brings the
platform-specific hooks from LibreSSL Portable, simplified to match our
use case.  ok djm@.
2022-09-02 14:30:38 +10:00
Darren Tucker
beaddde26f
Move OPENBSD ORIGINAL marker.
Putting this after the copyright statement (which doesn't change)
instead of before the version identifier (which does) prevents merge
conflicts when resyncing changes.
2022-09-02 14:30:38 +10:00
Darren Tucker
c83e467ead
Remove arc4random_uniform from arc4random.c
This was previously moved into its own file (matching OpenBSD) which
prematurely committed in commit 73541f2.
2022-09-02 14:30:38 +10:00
djm@openbsd.org
5f45c2395c
upstream: sk-usbhid: fix key_lookup() on tokens with built-in UV
explicitly test whether the token performs built-in UV (e.g. biometric
tokens) and enable UV in that case. From Pedro Martelletto via GHPR#388

OpenBSD-Commit-ID: 007eb7e387d27cf3029ab06b88224e03eca62ccd
2022-09-02 14:21:06 +10:00
Darren Tucker
03277a4aa4
Move sftp from valgrind-2 to 3 to rebalance. 2022-08-31 20:26:30 +10:00
djm@openbsd.org
fcf5365da6
upstream: whitespace
OpenBSD-Commit-ID: c2bcbf93610d3d62ed206cdf9bf9ff98c6aaf232
2022-08-31 12:57:42 +10:00
Damien Miller
e60136a3d7
additional keys 2022-08-29 13:27:45 +10:00
Damien Miller
2b02dcb505
cross-sign allowed_signers with PGP key
Provides continuity of trust from legacy PGP release key to
the SSHSIG signing keys that we will use henceforth for git
signing.
2022-08-29 13:23:43 +10:00
Darren Tucker
51b345f177
Add libcrypt-devel to cygwin-release deps.
Based on feedback from vinschen at redhat.com.
2022-08-27 21:49:27 +10:00
Darren Tucker
9f81736cf1
Add Windows 2022 test targets. 2022-08-27 09:37:40 +10:00
Darren Tucker
85e1a69243
Add cygwin-release test target.
This also moves the cygwin package install from the workflow file to
setup_ci.sh so that we can install different sets of Cygwin packages
for different test configs.
2022-08-26 19:22:25 +10:00
djm@openbsd.org
92382dbe8b
upstream: whitespace
OpenBSD-Commit-ID: a5d015efbfd228dc598ffdef612d2da3a579e5d8
2022-08-26 18:17:57 +10:00
djm@openbsd.org
70a5de0a50
upstream: whitespace
OpenBSD-Commit-ID: d297e4387935d4aef091c5e9432578c2e513f538
2022-08-26 18:14:02 +10:00