Commit Graph

6351 Commits

Author SHA1 Message Date
Damien Miller
fd53abd00b - dtucker@cvs.openbsd.org 2011/05/06 01:03:35
[sshd_config]
     clarify language about overriding defaults.  bz#1892, from Petr Cerny
2011-05-15 08:36:02 +10:00
Damien Miller
60432d8cf2 - djm@cvs.openbsd.org 2011/05/05 05:12:08
[mux.c]
     gracefully fall back when ControlPath is too large for a
     sockaddr_un. ok markus@ as part of a larger diff
2011-05-15 08:34:46 +10:00
Darren Tucker
d6548fe4cf - (dtucker) [openbsd-compat/openssl-compat.{c,h}] Bug #1882: fix
--with-ssl-engine which was broken with the change from deprecated
   SSLeay_add_all_algorithms().  ok djm
2011-05-10 11:13:36 +10:00
Darren Tucker
343f75fa19 - (dtucker) [openbsd-compat/regress/closefromtest.c] Bug #1875: add prototype
for closefrom() in test code.  Report from Dan Wallis via Gentoo.
2011-05-06 10:43:50 +10:00
Tim Rice
9abb697d4f - (tim) [defines.h] Deal with platforms that do not have S_IFSOCK ok djm@ 2011-05-04 23:06:59 -07:00
Tim Rice
19d8181b86 - (tim) [configure.ac] Add AC_LANG_SOURCE to OPENSSH_CHECK_CFLAG_COMPILE
so autoreconf 2.68 is happy.
2011-05-04 21:44:25 -07:00
Damien Miller
2ce12ef1ac - djm@cvs.openbsd.org 2011/05/04 21:15:29
[authfile.c authfile.h ssh-add.c]
     allow "ssh-add - < key"; feedback and ok markus@
2011-05-05 14:17:18 +10:00
Damien Miller
8cb1cda1e3 - djm@cvs.openbsd.org 2011/04/18 00:46:05
[ssh-keygen.c]
     certificate options are supposed to be packed in lexical order of
     option name (though we don't actually enforce this at present).
     Move one up that was out of sequence
2011-05-05 14:16:56 +10:00
Damien Miller
6c3eec7ab2 - djm@cvs.openbsd.org 2011/04/17 22:42:42
[PROTOCOL.mux clientloop.c clientloop.h mux.c ssh.1 ssh.c]
     allow graceful shutdown of multiplexing: request that a mux server
     removes its listener socket and refuse future multiplexing requests;
     ok markus@
2011-05-05 14:16:22 +10:00
Damien Miller
ad21032e65 - djm@cvs.openbsd.org 2011/04/13 04:09:37
[ssh-keygen.1]
     mention valid -b sizes for ECDSA keys; bz#1862
2011-05-05 14:15:54 +10:00
Damien Miller
085c90fa20 - djm@cvs.openbsd.org 2011/04/13 04:02:48
[ssh-keygen.1]
     improve wording; bz#1861
2011-05-05 14:15:33 +10:00
Damien Miller
26b57ce6c2 - djm@cvs.openbsd.org 2011/04/12 05:32:49
[sshd.c]
     exit with 0 status on SIGTERM; bz#1879
2011-05-05 14:15:09 +10:00
Damien Miller
884b63a061 - djm@cvs.openbsd.org 2011/04/12 04:23:50
[ssh-keygen.c]
     fix -Wshadow
2011-05-05 14:14:52 +10:00
Damien Miller
9147586599 - stevesk@cvs.openbsd.org 2011/03/29 18:54:17
[misc.c misc.h servconf.c]
     print ipqos friendly string for sshd -T; ok markus
     # sshd -Tf sshd_config|grep ipqos
     ipqos lowdelay throughput
2011-05-05 14:14:34 +10:00
Damien Miller
044f4a6cc3 - stevesk@cvs.openbsd.org 2011/03/24 22:14:54
[ssh-keygen.c]
     use strcasecmp() for "clear" cert permission option also; ok djm
2011-05-05 14:14:08 +10:00
Damien Miller
3ca1eb373f - jmc@cvs.openbsd.org 2011/03/24 15:29:30
[ssh-keygen.1]
     zap trailing whitespace;
2011-05-05 14:13:50 +10:00
Damien Miller
111431963e - stevesk@cvs.openbsd.org 2011/03/23 16:50:04
[ssh-keygen.c]
     remove -d, documentation removed >10 years ago; ok markus
2011-05-05 14:13:25 +10:00
Damien Miller
4a4d161545 - stevesk@cvs.openbsd.org 2011/03/23 16:24:56
[ssh-keygen.1]
     -q not used in /etc/rc now so remove statement.
2011-05-05 14:06:39 +10:00
Damien Miller
58f1bafb3d - stevesk@cvs.openbsd.org 2011/03/23 15:16:22
[ssh-keygen.1 ssh-keygen.c]
     Add -A option.  For each of the key types (rsa1, rsa, dsa and ecdsa)
     for which host keys do not exist, generate the host keys with the
     default key file path, an empty passphrase, default bits for the key
     type, and default comment.  This will be used by /etc/rc to generate
     new host keys.  Idea from deraadt.
     ok deraadt
2011-05-05 14:06:15 +10:00
Damien Miller
c5219e701e - okan@cvs.openbsd.org 2011/03/15 10:36:02
[ssh-keyscan.c]
     use timerclear macro
     ok djm@
2011-05-05 14:05:12 +10:00
Damien Miller
b2da7d185e - djm@cvs.openbsd.org 2011/03/10 11:34:25
[auth.h]
     allow GSSAPI authentication to detect when a server-side failure causes
     authentication failure and don't count such failures against MaxAuthTries;
     bz#1244 from simon AT sxw.org.uk; ok markus@ before lock
2011-05-05 14:04:50 +10:00
Damien Miller
3fcdfd55a3 - OpenBSD CVS Sync
- djm@cvs.openbsd.org 2011/03/10 02:52:57
     [auth2-gss.c auth2.c]
     allow GSSAPI authentication to detect when a server-side failure causes
     authentication failure and don't count such failures against MaxAuthTries;
     bz#1244 from simon AT sxw.org.uk; ok markus@ before lock
2011-05-05 14:04:11 +10:00
Damien Miller
f22019bdbf - (djm) [Makefile.in WARNING.RNG aclocal.m4 buildpkg.sh.in configure.ac]
[entropy.c ssh-add.c ssh-agent.c ssh-keygen.c ssh-keyscan.c]
   [ssh-keysign.c ssh-pkcs11-helper.c ssh-rand-helper.8 ssh-rand-helper.c]
   [ssh.c ssh_prng_cmds.in sshd.c contrib/aix/buildbff.sh]
   [regress/README.regress] Remove ssh-rand-helper and all its
   tentacles. PRNGd seeding has been rolled into entropy.c directly.
   Thanks to tim@ for testing on affected platforms.
2011-05-05 13:48:37 +10:00
Damien Miller
68790fedef - (djm) [defines.h] Move up include of netinet/ip.h for IPTOS
definitions.
2011-05-05 11:19:13 +10:00
Damien Miller
a10abe9e4b s/recommended/required in warning:
"It is recommended that your private key files are NOT accessible by others."

since there is no way to skip this check; bz#1878
2011-04-12 15:39:35 +10:00
Damien Miller
db59a3fb22 (whitespace change to test sync to hg) 2011-03-28 15:07:06 +11:00
Darren Tucker
e541aaaf0f - (dtucker) [contrib/cygwin/ssh-host-config] From Corinna: revamp of the
Cygwin-specific service installer script ssh-host-config.  The actual
   functionality is the same, the revisited version is just more
   exact when it comes to check for problems which disallow to run
   certain aspects of the script.  So, part of this script and the also
   rearranged service helper script library "csih" is to check if all
   the tools required to run the script are available on the system.
   The new script also is more thorough to inform the user why the
   script failed.  Patch from vinschen at redhat com.
2011-02-21 21:41:29 +11:00
Damien Miller
0588beba39 - djm@cvs.openbsd.org 2011/02/16 00:31:14
[ssh-keysign.c]
     make hostbased auth with ECDSA keys work correctly. Based on patch
     by harvey.eneman AT oracle.com in bz#1858; ok markus@ (pre-lock)
2011-02-18 09:18:45 +11:00
Darren Tucker
ea676a6422 - (dtucker) [contrib/cygwin/ssh-{host,user}-config] Add ECDSA key
generation and simplify.  Patch from Corinna Vinschen.
2011-02-06 13:31:23 +11:00
Darren Tucker
3b9617ecbd - (dtucker) [openbsd-compat/port-linux.c] Bug #1851: fix syntax error in
selinux code.  Patch from Leonardo Chiquitto.
2011-02-06 13:24:35 +11:00
Damien Miller
0d30b092ce - (djm) [README contrib/caldera/openssh.spec contrib/redhat/openssh.spec]
[contrib/suse/openssh.spec] update versions in docs and spec files.
 - Release OpenSSH 5.8p1
2011-02-04 12:43:36 +11:00
Damien Miller
a69812707d - djm@cvs.openbsd.org 2011/02/04 00:44:43
[version.h]
     openssh-5.8
2011-02-04 11:47:20 +11:00
Damien Miller
0a5f0129a3 - djm@cvs.openbsd.org 2011/02/04 00:44:21
[key.c]
     fix uninitialised nonce variable; reported by Mateusz Kocielski
2011-02-04 11:47:01 +11:00
Damien Miller
b407dd8d05 - djm@cvs.openbsd.org 2011/01/31 21:42:15
[PROTOCOL.mux]
     cut'n'pasto; from bert.wesarg AT googlemail.com
2011-02-04 11:46:39 +11:00
Damien Miller
d4a5504cb1 - (djm) [openbsd-compat/port-linux.c] Check whether SELinux is enabled
before attempting setfscreatecon(). Check whether matchpathcon()
   succeeded before using its result. Patch from cjwatson AT debian.org;
   bz#1851
2011-01-28 10:30:18 +11:00
Tim Rice
648f876566 20110127
- (tim) [configure.ac] Consistent M4 quoting throughout, updated obsolete
   AC_TRY_COMPILE with AC_COMPILE_IFELSE, updated obsolete AC_TRY_LINK with
   AC_LINK_IFELSE, updated obsolete AC_TRY_RUN with AC_RUN_IFELSE, misc white
   space changes for consistency/readability. Makes autoconf 2.68 happy.
   "Nice work" djm
2011-01-26 12:38:57 -08:00
Tim Rice
d069c48207 20110127
- (tim) [config.guess config.sub] Sync with upstream.
2011-01-26 12:32:12 -08:00
Damien Miller
71adf127e8 - (djm) [configure.ac Makefile.in ssh.c openbsd-compat/port-linux.c
openbsd-compat/port-linux.h] Move SELinux-specific code from ssh.c to
   port-linux.c to avoid compilation errors. Add -lselinux to ssh when
   building with SELinux support to avoid linking failure; report from
   amk AT spamfence.net; ok dtucker
2011-01-25 12:16:15 +11:00
Damien Miller
6f8f04b860 - (djm) Release 5.7p1 2011-01-22 20:25:11 +11:00
Damien Miller
4a5eb41cee trim entries older than 5.5p1 2011-01-22 20:24:34 +11:00
Damien Miller
966accc533 - (djm) [README contrib/caldera/openssh.spec contrib/redhat/openssh.spec]
[contrib/suse/openssh.spec] update versions in docs and spec files.
2011-01-22 20:23:10 +11:00
Damien Miller
ad4b1adf95 - OpenBSD CVS Sync
- djm@cvs.openbsd.org 2011/01/22 09:18:53
     [version.h]
     crank to OpenSSH-5.7
2011-01-22 20:21:33 +11:00
Darren Tucker
79241377df - (dtucker) [configure.ac openbsd-compat/openssl-compat.{c,h}] Add
RSA_get_default_method() for the benefit of openssl versions that don't
   have it (at least openssl-engine-0.9.6b).  Found and tested by Kevin Brott,
   ok djm@.
2011-01-22 09:37:01 +11:00
Damien Miller
e323ebc250 - (djm) [configure.ac] Disable ECC on OpenSSL <0.9.8g. Releases prior to
0.9.8 lacked it, and 0.9.8a through 0.9.8d have proven buggy in pre-
   release testing (random crashes and failure to load ECC keys).
   ok dtucker@
2011-01-19 23:12:27 +11:00
Tim Rice
15e1b4dea7 - (tim) [contrib/caldera/openssh.spec] Use CFLAGS from Makefile instead
of RPM so build completes. Signatures were changed to .asc since 4.1p1.
2011-01-18 20:47:04 -08:00
Darren Tucker
ea52a82969 - (dtucker) [LICENCE Makefile.in audit-bsm.c audit-linux.c audit.c audit.h
configure.ac defines.h loginrec.c]  Bug #1402: add linux audit subsystem
   support, based on patches from Tomas Mraz and jchadima at redhat.
2011-01-17 21:15:27 +11:00
Darren Tucker
263d43d2a5 - (dtucker) [openbsd-compat/port-linux.c] Fix minor bug caught by -Werror on
the tinderbox.
2011-01-17 18:50:22 +11:00
Tim Rice
6dfcd34042 - (tim) [regress/agent-getpeereid.sh] shell portability fix. 2011-01-16 22:53:56 -08:00
Damien Miller
58497780ab - (djm) [configure.ac regress/agent-getpeereid.sh regress/multiplex.sh]
[regress/sftp-glob.sh regress/test-exec.sh] Rework how feature tests are
   disabled on platforms that do not support them; add a "config_defined()"
   shell function that greps for defines in config.h and use them to decide
   on feature tests.
   Convert a couple of existing grep's over config.h to use the new function
   Add a define "FILESYSTEM_NO_BACKSLASH" for filesystem that can't represent
   backslash characters in filenames, enable it for Cygwin and use it to turn
   of tests for quotes backslashes in sftp-glob.sh.
   based on discussion with vinschen AT redhat.com and dtucker@; ok dtucker@
2011-01-17 16:17:09 +11:00
Darren Tucker
0c93adc7c1 - (dtucker) [openbsd-compat/port-linux.c] Bug #1838: Add support for the new
Linux OOM-killer magic values that changed in 2.6.36 kernels, with fallback
   to the old values.  Feedback from vapier at gentoo org and djm, ok djm.
2011-01-17 11:55:59 +11:00