blob: 16b5693d4aa0377971be01223e0f6dc81962e8df [file] [log] [blame]
Tim Rice2bde3ee2010-03-11 22:18:13 -0800120100312
2 - (tim) [openssh/Makefile.in] Now that scard is gone, no need to
3 make $(datadir)
4
Tim Ricefa233ba2010-03-10 16:12:02 -0800520100311
6 - (tim) [contrib/suse/openssh.spec] crank version number here too.
7 report by imorgan AT nas.nasa.gov
8
Darren Tuckerc9fe39b2010-03-09 20:42:30 +1100920100309
10 - (dtucker) [configure.ac] Use a proper AC_CHECK_DECL for BROKEN_GETADDRINFO
11 so setting it in CFLAGS correctly skips IPv6 tests.
12
1320100308
Damien Millerb3bc3312010-03-08 09:03:33 +110014 - (djm) OpenBSD CVS Sync
Damien Miller3e1ee492010-03-08 09:24:11 +110015 - djm@cvs.openbsd.org 2010/03/07 22:16:01
16 [ssh-keygen.c]
17 make internal strptime string match strftime format;
18 suggested by vinschen AT redhat.com and markus@
Damien Miller081c9762010-03-08 11:30:00 +110019 - djm@cvs.openbsd.org 2010/03/08 00:28:55
20 [ssh-keygen.1]
21 document permit-agent-forwarding certificate constraint; patch from
22 stevesk@
Damien Millerb3bc3312010-03-08 09:03:33 +110023 - djm@cvs.openbsd.org 2010/03/07 22:01:32
24 [version.h]
25 openssh-5.4
Damien Miller6bf31782010-03-08 09:41:02 +110026 - (djm) [README contrib/caldera/openssh.spec contrib/redhat/openssh.spec]
27 crank version numbers
Damien Miller95867872010-03-08 09:50:17 +110028 - (djm) Release OpenSSH-5.4p1
Damien Millerb3bc3312010-03-08 09:03:33 +110029
3020100307
Darren Tuckerb3d20a32010-03-07 11:56:59 +110031 - (dtucker) [auth.c] Bug #1710: call setauthdb on AIX before getpwuid so that
32 it gets the passwd struct from the LAM that knows about the user which is
33 not necessarily the default. Patch from Alexandre Letourneau.
Darren Tuckerc738e6c2010-03-07 13:21:12 +110034 - (dtucker) [session.c] Bug #1567: move setpcred call to before chroot and
35 do not set real uid, since that's needed for the chroot, and will be set
36 by permanently_set_uid.
Darren Tuckerac0c4c92010-03-07 13:32:16 +110037 - (dtucker) [session.c] Also initialize creds to NULL for handing to
38 setpcred.
Darren Tuckercd70e1b2010-03-07 23:05:17 +110039 - (dtucker) OpenBSD CVS Sync
40 - dtucker@cvs.openbsd.org 2010/03/07 11:57:13
41 [auth-rhosts.c monitor.c monitor_wrap.c session.c auth-options.c sshd.c]
42 Hold authentication debug messages until after successful authentication.
43 Fixes an info leak of environment variables specified in authorized_keys,
44 reported by Jacob Appelbaum. ok djm@
Darren Tuckerb3d20a32010-03-07 11:56:59 +110045
Damien Miller72b33822010-03-05 07:39:01 +11004620100305
47 - OpenBSD CVS Sync
48 - jmc@cvs.openbsd.org 2010/03/04 12:51:25
49 [ssh.1 sshd_config.5]
50 tweak previous;
Damien Millerf2b70ca2010-03-05 07:39:35 +110051 - djm@cvs.openbsd.org 2010/03/04 20:35:08
52 [ssh-keygen.1 ssh-keygen.c]
53 Add a -L flag to print the contents of a certificate; ok markus@
Damien Miller8f6c3372010-03-05 10:41:26 +110054 - jmc@cvs.openbsd.org 2010/03/04 22:52:40
55 [ssh-keygen.1]
56 fix Bk/Ek;
Damien Millerc6db99e2010-03-05 10:41:45 +110057 - djm@cvs.openbsd.org 2010/03/04 23:17:25
58 [sshd_config.5]
59 missing word; spotted by jmc@
Damien Millera7dab8b2010-03-05 10:42:05 +110060 - djm@cvs.openbsd.org 2010/03/04 23:19:29
61 [ssh.1 sshd.8]
62 move section on CA and revoked keys from ssh.1 to sshd.8's known hosts
63 format section and rework it a bit; requested by jmc@
Damien Miller689b8722010-03-05 10:42:24 +110064 - djm@cvs.openbsd.org 2010/03/04 23:27:25
65 [auth-options.c ssh-keygen.c]
66 "force-command" is not spelled "forced-command"; spotted by
67 imorgan AT nas.nasa.gov
Damien Millerb068d0a2010-03-05 14:03:03 +110068 - djm@cvs.openbsd.org 2010/03/05 02:58:11
69 [auth.c]
70 make the warning for a revoked key louder and more noticable
Damien Miller98339052010-03-05 21:30:35 +110071 - jmc@cvs.openbsd.org 2010/03/05 06:50:35
72 [ssh.1 sshd.8]
73 tweak previous;
Damien Miller922b5412010-03-05 21:30:54 +110074 - jmc@cvs.openbsd.org 2010/03/05 08:31:20
75 [ssh.1]
76 document certificate authentication; help/ok djm
Damien Miller5059d8d2010-03-05 21:31:11 +110077 - djm@cvs.openbsd.org 2010/03/05 10:28:21
78 [ssh-add.1 ssh.1 ssh_config.5]
79 mention loading of certificate files from [private]-cert.pub when
80 they are present; feedback and ok jmc@
Tim Rice179eee02010-03-04 12:48:05 -080081 - (tim) [ssh-pkcs11.c] Fix "non-constant initializer" errors in older
82 compilers. OK djm@
Damien Miller48b60212010-03-05 11:40:19 +110083 - (djm) [ssh-rand-helper.c] declare optind, avoiding compilation failure
84 on some platforms
Damien Miller9527f222010-03-05 15:04:35 +110085 - (djm) [configure.ac] set -fno-strict-aliasing for gcc4; ok dtucker@
Damien Miller72b33822010-03-05 07:39:01 +110086
Damien Miller910f2092010-03-04 14:17:22 +11008720100304
88 - (djm) [ssh-keygen.c] Use correct local variable, instead of
89 maybe-undefined global "optarg"
Damien Miller661ffc12010-03-04 21:09:24 +110090 - (djm) [contrib/redhat/openssh.spec] Replace obsolete BuildPreReq
91 on XFree86-devel with neutral /usr/include/X11/Xlib.h;
92 imorgan AT nas.nasa.gov in bz#1731
Damien Millerd45f3b62010-03-04 21:09:46 +110093 - (djm) [.cvsignore] Ignore ssh-pkcs11-helper
Damien Millere1abf4d2010-03-04 21:41:29 +110094 - (djm) [regress/Makefile] Cleanup sshd_proxy_orig
Damien Miller41396572010-03-04 21:51:11 +110095 - OpenBSD CVS Sync
96 - djm@cvs.openbsd.org 2010/03/03 01:44:36
97 [auth-options.c key.c]
98 reject strings with embedded ASCII nul chars in certificate key IDs,
99 principal names and constraints
Damien Millercd38c9c2010-03-04 21:51:37 +1100100 - djm@cvs.openbsd.org 2010/03/03 22:49:50
101 [sshd.8]
102 the authorized_keys option for CA keys is "cert-authority", not
103 "from=cert-authority". spotted by imorgan AT nas.nasa.gov
Damien Millerfe588e32010-03-04 21:52:00 +1100104 - djm@cvs.openbsd.org 2010/03/03 22:50:40
105 [PROTOCOL.certkeys]
106 s/similar same/similar/; from imorgan AT nas.nasa.gov
Damien Miller2befbad2010-03-04 21:52:18 +1100107 - djm@cvs.openbsd.org 2010/03/04 01:44:57
108 [key.c]
109 use buffer_get_string_ptr_ret() where we are checking the return
110 value explicitly instead of the fatal()-causing buffer_get_string_ptr()
Damien Miller1aed65e2010-03-04 21:53:35 +1100111 - djm@cvs.openbsd.org 2010/03/04 10:36:03
112 [auth-rh-rsa.c auth-rsa.c auth.c auth.h auth2-hostbased.c auth2-pubkey.c]
113 [authfile.c authfile.h hostfile.c hostfile.h servconf.c servconf.h]
114 [ssh-keygen.c ssh.1 sshconnect.c sshd_config.5]
115 Add a TrustedUserCAKeys option to sshd_config to specify CA keys that
116 are trusted to authenticate users (in addition than doing it per-user
117 in authorized_keys).
118
119 Add a RevokedKeys option to sshd_config and a @revoked marker to
120 known_hosts to allow keys to me revoked and banned for user or host
121 authentication.
122
123 feedback and ok markus@
Damien Miller017d1e72010-03-04 21:57:21 +1100124 - djm@cvs.openbsd.org 2010/03/03 00:47:23
125 [regress/cert-hostkey.sh regress/cert-userkey.sh]
126 add an extra test to ensure that authentication with the wrong
127 certificate fails as it should (and it does)
Damien Miller700dcfa2010-03-04 21:58:01 +1100128 - djm@cvs.openbsd.org 2010/03/04 10:38:23
129 [regress/cert-hostkey.sh regress/cert-userkey.sh]
130 additional regression tests for revoked keys and TrustedUserCAKeys
Damien Miller910f2092010-03-04 14:17:22 +1100131
Damien Miller25b97dd2010-03-03 10:24:00 +110013220100303
133 - (djm) [PROTOCOL.certkeys] Add RCS Ident
Damien Miller15f5b562010-03-03 10:25:21 +1100134 - OpenBSD CVS Sync
135 - jmc@cvs.openbsd.org 2010/02/26 22:09:28
136 [ssh-keygen.1 ssh.1 sshd.8]
137 tweak previous;
Damien Miller0bd41862010-03-03 10:25:41 +1100138 - otto@cvs.openbsd.org 2010/03/01 11:07:06
139 [ssh-add.c]
140 zap what seems to be a left-over debug message; ok markus@
Damien Millerfb84e592010-03-03 10:26:04 +1100141 - djm@cvs.openbsd.org 2010/03/02 23:20:57
142 [ssh-keygen.c]
143 POSIX strptime is stricter than OpenBSD's so do a little dance to
144 appease it.
Damien Miller386dbc02010-03-03 13:22:41 +1100145 - (djm) [regress/cert-userkey.sh] s/echo -n/echon/ here too
Damien Miller25b97dd2010-03-03 10:24:00 +1100146
Tim Ricec5b0cb32010-03-01 15:57:42 -080014720100302
148 - (tim) [config.guess config.sub] Bug 1722: Update to latest versions from
149 http://git.savannah.gnu.org/gitweb/ (2009-12-30 and 2010-01-22
150 respectively).
151
Darren Tuckerc614c782010-03-01 12:49:05 +110015220100301
153 - (dtucker) [regress/{cert-hostkey,cfgmatch,cipher-speed}.sh} Replace
154 "echo -n" with "echon" for portability.
Darren Tucker9af0cb92010-03-01 15:52:49 +1100155 - (dtucker) [openbsd-compat/port-linux.c] Make failure to write to the OOM
156 adjust log at verbose only, since according to cjwatson in bug #1470
157 some virtualization platforms don't allow writes.
Darren Tuckerc614c782010-03-01 12:49:05 +1100158
Damien Milleracc9b292010-03-01 04:36:54 +110015920100228
160 - (djm) [auth.c] On Cygwin, refuse usernames that have differences in
161 case from that matched in the system password database. On this
162 platform, passwords are stored case-insensitively, but sshd requires
163 exact case matching for Match blocks in sshd_config(5). Based on
164 a patch from vinschen AT redhat.com.
Tim Ricebff24b82010-02-28 14:51:56 -0800165 - (tim) [ssh-pkcs11-helper.c] Move declarations before calling functions
166 to make older compilers (gcc 2.95) happy.
Damien Milleracc9b292010-03-01 04:36:54 +1100167
Damien Miller09a24db2010-02-28 03:28:05 +110016820100227
Damien Millerd05951f2010-02-28 03:29:33 +1100169 - (djm) [ssh-pkcs11-helper.c ] Ensure RNG is initialised and seeded
170 - (djm) [openbsd-compat/bsd-cygwin_util.c] Reduce the set of environment
171 variables copied into sshd child processes. From vinschen AT redhat.com
Damien Miller09a24db2010-02-28 03:28:05 +1100172
Damien Miller0a80ca12010-02-27 07:55:05 +110017320100226
174 - OpenBSD CVS Sync
175 - djm@cvs.openbsd.org 2010/02/26 20:29:54
176 [PROTOCOL PROTOCOL.agent PROTOCOL.certkeys addrmatch.c auth-options.c]
177 [auth-options.h auth.h auth2-pubkey.c authfd.c dns.c dns.h hostfile.c]
178 [hostfile.h kex.h kexdhs.c kexgexs.c key.c key.h match.h monitor.c]
179 [myproposal.h servconf.c servconf.h ssh-add.c ssh-agent.c ssh-dss.c]
180 [ssh-keygen.1 ssh-keygen.c ssh-rsa.c ssh.1 ssh.c ssh2.h sshconnect.c]
181 [sshconnect2.c sshd.8 sshd.c sshd_config.5]
182 Add support for certificate key types for users and hosts.
183
184 OpenSSH certificate key types are not X.509 certificates, but a much
185 simpler format that encodes a public key, identity information and
186 some validity constraints and signs it with a CA key. CA keys are
187 regular SSH keys. This certificate style avoids the attack surface
188 of X.509 certificates and is very easy to deploy.
189
190 Certified host keys allow automatic acceptance of new host keys
191 when a CA certificate is marked as trusted in ~/.ssh/known_hosts.
192 see VERIFYING HOST KEYS in ssh(1) for details.
193
194 Certified user keys allow authentication of users when the signing
195 CA key is marked as trusted in authorized_keys. See "AUTHORIZED_KEYS
196 FILE FORMAT" in sshd(8) for details.
197
198 Certificates are minted using ssh-keygen(1), documentation is in
199 the "CERTIFICATES" section of that manpage.
200
201 Documentation on the format of certificates is in the file
202 PROTOCOL.certkeys
203
204 feedback and ok markus@
Damien Miller58ac6de2010-02-27 07:57:12 +1100205 - djm@cvs.openbsd.org 2010/02/26 20:33:21
206 [Makefile regress/cert-hostkey.sh regress/cert-userkey.sh]
207 regression tests for certified keys
Damien Miller0a80ca12010-02-27 07:55:05 +1100208
Damien Miller05abd2c2010-02-24 17:16:08 +110020920100224
210 - (djm) [pkcs11.h ssh-pkcs11-client.c ssh-pkcs11-helper.c ssh-pkcs11.c]
211 [ssh-pkcs11.h] Add $OpenBSD$ RCS idents so we can sync portable
Damien Millera80f1402010-02-24 17:17:58 +1100212 - (djm) OpenBSD CVS Sync
213 - djm@cvs.openbsd.org 2010/02/11 20:37:47
214 [pathnames.h]
215 correct comment
Damien Millerb6bd3c22010-02-24 17:24:56 +1100216 - dtucker@cvs.openbsd.org 2009/11/09 04:20:04
217 [regress/Makefile]
218 add regression test for ssh-keygen pubkey conversions
Damien Miller0dff9c72010-02-24 17:25:58 +1100219 - dtucker@cvs.openbsd.org 2010/01/11 02:53:44
220 [regress/forwarding.sh]
221 regress test for stdio forwarding
Damien Millerbb4ae552010-02-24 17:26:38 +1100222 - djm@cvs.openbsd.org 2010/02/09 04:57:36
223 [regress/addrmatch.sh]
224 clean up droppings
Damien Miller8f9492c2010-02-24 17:28:45 +1100225 - djm@cvs.openbsd.org 2010/02/09 06:29:02
226 [regress/Makefile]
227 turn on all the malloc(3) checking options when running regression
228 tests. this has caught a few bugs for me in the past; ok dtucker@
Damien Millerc1739212010-02-24 17:29:34 +1100229 - djm@cvs.openbsd.org 2010/02/24 06:21:56
230 [regress/test-exec.sh]
231 wait for sshd to fully stop in cleanup() function; avoids races in tests
232 that do multiple start_sshd/cleanup cycles; "I hate pidfiles" deraadt@
Damien Millercfa42d22010-02-24 17:31:20 +1100233 - markus@cvs.openbsd.org 2010/02/08 10:52:47
234 [regress/agent-pkcs11.sh]
235 test for PKCS#11 support (currently disabled)
Damien Miller43001b32010-02-24 18:18:51 +1100236 - (djm) [Makefile.in ssh-pkcs11-helper.8] Add manpage for PKCS#11 helper
Damien Millerd27d85d2010-02-24 18:21:45 +1100237 - (djm) [contrib/caldera/openssh.spec contrib/redhat/openssh.spec]
238 [contrib/suse/openssh.spec] Add PKCS#11 helper binary and manpage
Damien Miller05abd2c2010-02-24 17:16:08 +1100239
Damien Miller17751bc2010-02-12 07:35:08 +110024020100212
241 - (djm) OpenBSD CVS Sync
242 - djm@cvs.openbsd.org 2010/02/02 22:49:34
243 [bufaux.c]
244 make buffer_get_string_ret() really non-fatal in all cases (it was
245 using buffer_get_int(), which could fatal() on buffer empty);
246 ok markus dtucker
Damien Miller7ea845e2010-02-12 09:21:02 +1100247 - markus@cvs.openbsd.org 2010/02/08 10:50:20
248 [pathnames.h readconf.c readconf.h scp.1 sftp.1 ssh-add.1 ssh-add.c]
249 [ssh-agent.c ssh-keygen.1 ssh-keygen.c ssh.1 ssh.c ssh_config.5]
250 replace our obsolete smartcard code with PKCS#11.
251 ftp://ftp.rsasecurity.com/pub/pkcs/pkcs-11/v2-20/pkcs-11v2-20.pdf
252 ssh(1) and ssh-keygen(1) use dlopen(3) directly to talk to a PKCS#11
253 provider (shared library) while ssh-agent(1) delegates PKCS#11 to
254 a forked a ssh-pkcs11-helper process.
255 PKCS#11 is currently a compile time option.
256 feedback and ok djm@; inspired by patches from Alon Bar-Lev
Damien Miller048dc932010-02-12 09:22:04 +1100257 - jmc@cvs.openbsd.org 2010/02/08 22:03:05
258 [ssh-add.1 ssh-keygen.1 ssh.1 ssh.c]
259 tweak previous; ok markus
Damien Millera183c6e2010-02-12 09:22:31 +1100260 - djm@cvs.openbsd.org 2010/02/09 00:50:36
261 [ssh-agent.c]
262 fallout from PKCS#11: unbreak -D
Damien Miller86cbb442010-02-12 09:22:57 +1100263 - djm@cvs.openbsd.org 2010/02/09 00:50:59
264 [ssh-keygen.c]
265 fix -Wall
Damien Miller89221062010-02-12 09:23:40 +1100266 - djm@cvs.openbsd.org 2010/02/09 03:56:28
267 [buffer.c buffer.h]
268 constify the arguments to buffer_len, buffer_ptr and buffer_dump
Damien Miller47cf16b2010-02-12 09:25:29 +1100269 - djm@cvs.openbsd.org 2010/02/09 06:18:46
270 [auth.c]
271 unbreak ChrootDirectory+internal-sftp by skipping check for executable
272 shell when chrooting; reported by danh AT wzrd.com; ok dtucker@
Damien Millera7618442010-02-12 09:26:02 +1100273 - markus@cvs.openbsd.org 2010/02/10 23:20:38
274 [ssh-add.1 ssh-keygen.1 ssh.1 ssh_config.5]
275 pkcs#11 is no longer optional; improve wording; ok jmc@
Damien Millerd400da52010-02-12 09:26:23 +1100276 - jmc@cvs.openbsd.org 2010/02/11 13:23:29
277 [ssh.1]
278 libarary -> library;
Damien Millerd8f60022010-02-12 09:34:22 +1100279 - (djm) [INSTALL Makefile.in README.smartcard configure.ac scard-opensc.c]
280 [scard.c scard.h pkcs11.h scard/Makefile.in scard/Ssh.bin.uu scard/Ssh.java]
281 Remove obsolete smartcard support
Damien Miller8ad0fbd2010-02-12 09:49:06 +1100282 - (djm) [ssh-pkcs11-client.c ssh-pkcs11-helper.c ssh-pkcs11.c]
283 Make it compile on OSX
Damien Millerdfa41562010-02-12 10:06:28 +1100284 - (djm) [ssh-pkcs11-client.c ssh-pkcs11-helper.c ssh-pkcs11.c]
285 Use ssh_get_progname to fill __progname
Damien Millerb3c9f782010-02-12 10:11:34 +1100286 - (djm) [configure.ac] Enable PKCS#11 support only when we find a working
287 dlopen()
Damien Miller17751bc2010-02-12 07:35:08 +1100288
Damien Miller1d2bfc42010-02-10 10:19:29 +110028920100210
290 - (djm) add -lselinux to LIBS before calling AC_CHECK_FUNCS for
291 getseuserbyname; patch from calebcase AT gmail.com via
292 cjwatson AT debian.org
293
Damien Miller74d98252010-02-02 17:01:46 +110029420100202
295 - (djm) OpenBSD CVS Sync
296 - djm@cvs.openbsd.org 2010/01/30 21:08:33
297 [sshd.8]
298 debug output goes to stderr, not "the system log"; ok markus dtucker
Damien Millerd6369432010-02-02 17:02:07 +1100299 - djm@cvs.openbsd.org 2010/01/30 21:12:08
300 [channels.c]
301 fake local addr:port when stdio fowarding as some servers (Tectia at
302 least) validate that they are well-formed;
303 reported by imorgan AT nas.nasa.gov
304 ok dtucker
Damien Miller74d98252010-02-02 17:01:46 +1100305
Damien Miller36f57eb2010-01-30 17:28:34 +110030620100130
307 - (djm) OpenBSD CVS Sync
308 - djm@cvs.openbsd.org 2010/01/28 00:21:18
309 [clientloop.c]
310 downgrade an error() to a debug() - this particular case can be hit in
311 normal operation for certain sequences of mux slave vs session closure
312 and is harmless
Damien Miller133d9d32010-01-30 17:30:04 +1100313 - djm@cvs.openbsd.org 2010/01/29 00:20:41
314 [sshd.c]
315 set FD_CLOEXEC on sock_in/sock_out; bz#1706 from jchadima AT redhat.com
316 ok dtucker@
Damien Miller0dac03f2010-01-30 17:36:33 +1100317 - djm@cvs.openbsd.org 2010/01/29 20:16:17
318 [mux.c]
319 kill correct channel (was killing already-dead mux channel, not
320 its session channel)
Damien Millerc3ca35f2010-01-30 17:42:01 +1100321 - djm@cvs.openbsd.org 2010/01/30 02:54:53
322 [mux.c]
323 don't mark channel as read failed if it is already closing; suppresses
324 harmless error messages when connecting to SSH.COM Tectia server
325 report by imorgan AT nas.nasa.gov
Damien Miller36f57eb2010-01-30 17:28:34 +1100326
Darren Tucker19d32cb2010-01-29 10:54:11 +110032720100129
328 - (dtucker) [openbsd-compat/openssl-compat.c] Bug #1707: Call OPENSSL_config()
329 after registering the hardware engines, which causes the openssl.cnf file to
330 be processed. See OpenSSL's man page for OPENSSL_config(3) for details.
331 Patch from Solomon Peachy, ok djm@.
332
Damien Miller45a81a02010-01-28 06:26:20 +110033320100128
334 - (djm) OpenBSD CVS Sync
335 - djm@cvs.openbsd.org 2010/01/26 02:15:20
336 [mux.c]
337 -Wuninitialized and remove a // comment; from portable
338 (Id sync only)
Damien Millera21cdfa2010-01-28 06:26:59 +1100339 - djm@cvs.openbsd.org 2010/01/27 13:26:17
340 [mux.c]
341 fix bug introduced in mux rewrite:
342
343 In a mux master, when a socket to a mux slave closes before its server
344 session (as may occur when the slave has been signalled), gracefully
345 close the server session rather than deleting its channel immediately.
346 A server may have more messages on that channel to send (e.g. an exit
347 message) that will fatal() the client if they are sent to a channel that
348 has been prematurely deleted.
349
350 spotted by imorgan AT nas.nasa.gov
Damien Millera1162982010-01-28 06:27:54 +1100351 - djm@cvs.openbsd.org 2010/01/27 19:21:39
352 [sftp.c]
353 add missing "p" flag to getopt optstring;
354 bz#1704 from imorgan AT nas.nasa.gov
Damien Miller45a81a02010-01-28 06:26:20 +1100355
Damien Miller2e68d792010-01-26 12:51:13 +110035620100126
357 - (djm) OpenBSD CVS Sync
358 - tedu@cvs.openbsd.org 2010/01/17 21:49:09
359 [ssh-agent.1]
360 Correct and clarify ssh-add's password asking behavior.
361 Improved text dtucker and ok jmc
Damien Millerf589fd12010-01-26 12:53:06 +1100362 - dtucker@cvs.openbsd.org 2010/01/18 01:50:27
363 [roaming_client.c]
364 s/long long unsigned/unsigned long long/, from tim via portable
365 (Id sync only, change already in portable)
Damien Millere1537f92010-01-26 13:26:22 +1100366 - djm@cvs.openbsd.org 2010/01/26 01:28:35
367 [channels.c channels.h clientloop.c clientloop.h mux.c nchan.c ssh.c]
368 rewrite ssh(1) multiplexing code to a more sensible protocol.
369
370 The new multiplexing code uses channels for the listener and
371 accepted control sockets to make the mux master non-blocking, so
372 no stalls when processing messages from a slave.
373
374 avoid use of fatal() in mux master protocol parsing so an errant slave
375 process cannot take down a running master.
376
377 implement requesting of port-forwards over multiplexed sessions. Any
378 port forwards requested by the slave are added to those the master has
379 established.
380
381 add support for stdio forwarding ("ssh -W host:port ...") in mux slaves.
382
383 document master/slave mux protocol so that other tools can use it to
384 control a running ssh(1). Note: there are no guarantees that this
385 protocol won't be incompatibly changed (though it is versioned).
386
387 feedback Salvador Fandino, dtucker@
388 channel changes ok markus@
Damien Miller2e68d792010-01-26 12:51:13 +1100389
Tim Rice6761c742010-01-22 10:25:15 -080039020100122
391 - (tim) [configure.ac] Due to constraints in Windows Sockets in terms of
392 socket inheritance, reduce the default SO_RCVBUF/SO_SNDBUF buffer size
393 in Cygwin to 65535. Patch from Corinna Vinschen.
394
Tim Rice7ab7b932010-01-17 12:48:22 -080039520100117
396 - (tim) [configure.ac] OpenServer 5 needs BROKEN_GETADDRINFO too.
Tim Rice7bb74712010-01-17 22:49:57 -0800397 - (tim) [configure.ac] On SVR5 systems, use the C99-conforming functions
398 snprintf() and vsnprintf() named _xsnprintf() and _xvsnprintf().
Tim Rice7ab7b932010-01-17 12:48:22 -0800399
Darren Tuckerca944852010-01-16 11:48:27 +110040020100116
401 - (dtucker) [openbsd-compat/pwcache.c] Pull in includes.h and thus defines.h
402 so we correctly detect whether or not we have a native user_from_uid.
Darren Tucker2563e3f2010-01-16 11:53:07 +1100403 - (dtucker) [openbsd-compat/openbsd-compat.h] Prototypes for user_from_uid
404 and group_from_gid.
Darren Tucker69371b52010-01-16 13:30:30 +1100405 - (dtucker) [openbsd-compat/openbsd-compat.h] Fix prototypes, spotted by
406 Tim.
Darren Tuckerdab129b2010-01-16 13:43:50 +1100407 - (dtucker) OpenBSD CVS Sync
408 - markus@cvs.openbsd.org 2010/01/15 09:24:23
409 [sftp-common.c]
410 unused
Darren Tucker612e4002010-01-16 13:53:52 +1100411 - (dtucker) [openbsd-compat/pwcache.c] Shrink ifdef area to prevent unused
412 variable warnings.
Darren Tucker4e218552010-01-16 23:58:37 +1100413 - (dtucker) [openbsd-compat/openbsd-compat.h] Typo.
Tim Rice999aaf42010-01-16 11:37:53 -0800414 - (tim) [regress/portnum.sh] Shell portability fix.
Tim Rice4a7db1c2010-01-16 12:23:25 -0800415 - (tim) [configure.ac] Define BROKEN_GETADDRINFO on SVR5 systems. The native
416 getaddrinfo() is too old and limited for addr_pton() in addrmatch.c.
Tim Rice33e48ac2010-01-17 07:12:40 -0800417 - (tim) [roaming_client.c] Use of <sys/queue.h> is not really portable so we
418 use "openbsd-compat/sys-queue.h". s/long long unsigned/unsigned long long/
419 to keep USL compilers happy.
Darren Tuckerca944852010-01-16 11:48:27 +1100420
Darren Tucker75fe6262010-01-15 11:42:51 +110042120100115
422 - (dtucker) OpenBSD CVS Sync
423 - jmc@cvs.openbsd.org 2010/01/13 12:48:34
424 [sftp.1 sftp.c]
425 sftp.1: put ls -h in the right place
426 sftp.c: as above, plus add -p to get/put, and shorten their arg names
427 to keep the help usage nicely aligned
428 ok djm
Darren Tucker94881d82010-01-15 11:44:46 +1100429 - djm@cvs.openbsd.org 2010/01/13 23:47:26
430 [auth.c]
431 when using ChrootDirectory, make sure we test for the existence of the
432 user's shell inside the chroot; bz #1679, patch from alex AT rtfs.hu;
433 ok dtucker
Darren Tuckera788de22010-01-15 11:45:33 +1100434 - dtucker@cvs.openbsd.org 2010/01/14 23:41:49
435 [sftp-common.c]
436 use user_from{uid,gid} to lookup up ids since it keeps a small cache.
437 ok djm
Darren Tuckerb8b17e92010-01-15 11:46:03 +1100438 - guenther@cvs.openbsd.org 2010/01/15 00:05:22
439 [sftp.c]
440 Reset SIGTERM to SIG_DFL before executing ssh, so that even if sftp
441 inherited SIGTERM as ignored it will still be able to kill the ssh it
442 starts.
443 ok dtucker@
Darren Tucker7fa3a852010-01-15 13:12:10 +1100444 - (dtucker) [openbsd-compat/pwcache.c] Pull in pwcache.c from OpenBSD (no
Darren Tucker9d1fd5b2010-01-15 12:14:45 +1100445 changes yet but there will be some to come).
Darren Tucker909a3902010-01-15 12:38:30 +1100446 - (dtucker) [configure.ac openbsd-compat/{Makefile.in,pwcache.c} Portability
447 for pwcache. Also, added caching of negative hits.
Darren Tucker75fe6262010-01-15 11:42:51 +1100448
Damien Miller6abc9f62010-01-14 12:44:16 +110044920100114
450 - (djm) [platform.h] Add missing prototype for
451 platform_krb5_get_principal_name
452
Darren Tuckera8f20cf2010-01-13 10:54:46 +110045320100113
454 - (dtucker) [monitor_fdpass.c] Wrap poll.h include in ifdefs.
Darren Tuckerab3c2ca2010-01-13 18:27:32 +1100455 - (dtucker) [openbsd-compat/readpassphrase.c] Resync against OpenBSD's r1.18:
456 missing restore of SIGTTOU and some whitespace.
Darren Tucker1035cb42010-01-13 18:32:59 +1100457 - (dtucker) [openbsd-compat/readpassphrase.c] Update to OpenBSD's r1.21.
Darren Tuckerd59487a2010-01-13 21:32:44 +1100458 - (dtucker) [openbsd-compat/readpassphrase.c] Update to OpenBSD's r1.22.
459 Fixes bz #1590, where sometimes you could not interrupt a connection while
460 ssh was prompting for a passphrase or password.
Darren Tuckere2b36742010-01-13 22:42:34 +1100461 - (dtucker) OpenBSD CVS Sync
462 - dtucker@cvs.openbsd.org 2010/01/13 00:19:04
463 [sshconnect.c auth.c]
464 Fix a couple of typos/mispellings in comments
Darren Tucker561724f2010-01-13 22:43:05 +1100465 - dtucker@cvs.openbsd.org 2010/01/13 01:10:56
466 [key.c]
467 Ignore and log any Protocol 1 keys where the claimed size is not equal to
468 the actual size. Noted by Derek Martin, ok djm@
Darren Tuckerdaaa4502010-01-13 22:43:33 +1100469 - dtucker@cvs.openbsd.org 2010/01/13 01:20:20
470 [canohost.c ssh-keysign.c sshconnect2.c]
471 Make HostBased authentication work with a ProxyCommand. bz #1569, patch
472 from imorgan at nas nasa gov, ok djm@
Darren Tucker2901e2d2010-01-13 22:44:06 +1100473 - djm@cvs.openbsd.org 2010/01/13 01:40:16
474 [sftp.c sftp-server.c sftp.1 sftp-common.c sftp-common.h]
475 support '-h' (human-readable units) for sftp's ls command, just like
476 ls(1); ok dtucker@
Darren Tucker88b6fb22010-01-13 22:44:29 +1100477 - djm@cvs.openbsd.org 2010/01/13 03:48:13
478 [servconf.c servconf.h sshd.c]
479 avoid run-time failures when specifying hostkeys via a relative
480 path by prepending the cwd in these cases; bz#1290; ok dtucker@
Darren Tucker9c3ba072010-01-13 22:45:03 +1100481 - djm@cvs.openbsd.org 2010/01/13 04:10:50
482 [sftp.c]
483 don't append a space after inserting a completion of a directory (i.e.
484 a path ending in '/') for a slightly better user experience; ok dtucker@
Darren Tucker096630d2010-01-13 23:00:38 +1100485 - (dtucker) [sftp-common.c] Wrap include of util.h in an ifdef.
Tim Riced4a7fcb2010-01-13 15:44:34 -0800486 - (tim) [defines.h] openbsd-compat/readpassphrase.c now needs _NSIG.
487 feedback and ok dtucker@
Darren Tuckera8f20cf2010-01-13 10:54:46 +1100488
Darren Tucker09aa4c02010-01-12 19:51:48 +110048920100112
Darren Tucker7ad8dd22010-01-12 19:40:27 +1100490 - (dtucker) OpenBSD CVS Sync
491 - dtucker@cvs.openbsd.org 2010/01/11 01:39:46
492 [ssh_config channels.c ssh.1 channels.h ssh.c]
493 Add a 'netcat mode' (ssh -W). This connects stdio on the client to a
494 single port forward on the server. This allows, for example, using ssh as
495 a ProxyCommand to route connections via intermediate servers.
496 bz #1618, man page help from jmc@, ok markus@
Darren Tuckerd4c86b12010-01-12 19:41:22 +1100497 - dtucker@cvs.openbsd.org 2010/01/11 04:46:45
498 [authfile.c sshconnect2.c]
499 Do not prompt for a passphrase if we fail to open a keyfile, and log the
500 reason the open failed to debug.
501 bz #1693, found by tj AT castaglia org, ok djm@
Darren Tuckerd04758d2010-01-12 19:41:57 +1100502 - djm@cvs.openbsd.org 2010/01/11 10:51:07
503 [ssh-keygen.c]
504 when converting keys, truncate key comments at 72 chars as per RFC4716;
505 bz#1630 reported by tj AT castaglia.org; ok markus@
Darren Tucker69c01b12010-01-12 19:42:29 +1100506 - dtucker@cvs.openbsd.org 2010/01/12 00:16:47
507 [authfile.c]
508 Fix bug introduced in r1.78 (incorrect brace location) that broke key auth.
509 Patch from joachim joachimschipper nl.
Darren Tuckere371a132010-01-12 19:43:12 +1100510 - djm@cvs.openbsd.org 2010/01/12 00:58:25
511 [monitor_fdpass.c]
512 avoid spinning when fd passing on nonblocking sockets by calling poll()
513 in the EINTR/EAGAIN path, much like we do in atomicio; ok dtucker@
Darren Tuckerc6cc90b2010-01-12 19:43:46 +1100514 - djm@cvs.openbsd.org 2010/01/12 00:59:29
515 [roaming_common.c]
516 delete with extreme prejudice a debug() that fired with every keypress;
517 ok dtucker deraadt
Darren Tucker1b0c2452010-01-12 19:45:26 +1100518 - dtucker@cvs.openbsd.org 2010/01/12 01:31:05
519 [session.c]
520 Do not allow logins if /etc/nologin exists but is not readable by the user
521 logging in. Noted by Jan.Pechanec at Sun, ok djm@ deraadt@
Darren Tuckerebc71d92010-01-12 19:45:59 +1100522 - djm@cvs.openbsd.org 2010/01/12 01:36:08
523 [buffer.h bufaux.c]
524 add a buffer_get_string_ptr_ret() that does the same as
525 buffer_get_string_ptr() but does not fatal() on error; ok dtucker@
Darren Tucker09aa4c02010-01-12 19:51:48 +1100526 - dtucker@cvs.openbsd.org 2010/01/12 08:33:17
527 [session.c]
528 Add explicit stat so we reliably detect nologin with bad perms.
529 ok djm markus
Darren Tucker7ad8dd22010-01-12 19:40:27 +1100530
53120100110
Darren Tucker8c65f642010-01-10 10:26:57 +1100532 - (dtucker) [configure.ac misc.c readconf.c servconf.c ssh-keyscan.c]
533 Remove hacks add for RoutingDomain in preparation for its removal.
Darren Tuckerd3300452010-01-10 19:26:43 +1100534 - (dtucker) OpenBSD CVS Sync
Darren Tucker7bd98e72010-01-10 10:31:12 +1100535 - dtucker@cvs.openbsd.org 2010/01/09 23:04:13
536 [channels.c ssh.1 servconf.c sshd_config.5 sshd.c channels.h servconf.h
537 ssh-keyscan.1 ssh-keyscan.c readconf.c sshconnect.c misc.c ssh.c
538 readconf.h scp.1 sftp.1 ssh_config.5 misc.h]
539 Remove RoutingDomain from ssh since it's now not needed. It can be
540 replaced with "route exec" or "nc -V" as a proxycommand. "route exec"
541 also ensures that trafic such as DNS lookups stays withing the specified
542 routingdomain. For example (from reyk):
543 # route -T 2 exec /usr/sbin/sshd
544 or inherited from the parent process
545 $ route -T 2 exec sh
546 $ ssh 10.1.2.3
547 ok deraadt@ markus@ stevesk@ reyk@
Darren Tuckerd3300452010-01-10 19:26:43 +1100548 - dtucker@cvs.openbsd.org 2010/01/10 03:51:17
549 [servconf.c]
550 Add ChrootDirectory to sshd.c test-mode output
Darren Tucker43551522010-01-10 19:27:17 +1100551 - dtucker@cvs.openbsd.org 2010/01/10 07:15:56
552 [auth.c]
553 Output a debug if we can't open an existing keyfile. bz#1694, ok djm@
Darren Tucker8c65f642010-01-10 10:26:57 +1100554
Darren Tucker7ad8dd22010-01-12 19:40:27 +110055520100109
Darren Tucker9eba40c2010-01-09 09:02:07 +1100556 - (dtucker) Wrap use of IPPROTO_IPV6 in an ifdef for platforms that don't
557 have it.
Darren Tucker709d0ce2010-01-09 09:25:54 +1100558 - (dtucker) [defines.h] define PRIu64 for platforms that don't have it.
Darren Tucker11b5c072010-01-09 16:40:48 +1100559 - (dtucker) [roaming_client.c] Wrap inttypes.h in an ifdef.
Darren Tucker0b8a2262010-01-09 18:18:04 +1100560 - (dtucker) [loginrec.c] Use the SUSv3 specified name for the user name
561 when using utmpx. Patch from Ed Schouten.
Darren Tuckerdb7bf822010-01-09 22:24:33 +1100562 - (dtucker) OpenBSD CVS Sync
563 - djm@cvs.openbsd.org 2010/01/09 00:20:26
564 [sftp-server.c sftp-server.8]
565 add a 'read-only' mode to sftp-server(8) that disables open in write mode
566 and all other fs-modifying protocol methods. bz#430 ok dtucker@
Darren Tuckera2e10482010-01-09 22:25:14 +1100567 - djm@cvs.openbsd.org 2010/01/09 00:57:10
568 [PROTOCOL]
569 tweak language
Darren Tucker838891f2010-01-09 22:25:46 +1100570 - jmc@cvs.openbsd.org 2010/01/09 03:36:00
571 [sftp-server.8]
572 bad place to forget a comma...
Darren Tucker37c1b3d2010-01-09 22:26:23 +1100573 - djm@cvs.openbsd.org 2010/01/09 05:04:24
574 [mux.c sshpty.h clientloop.c sshtty.c]
575 quell tc[gs]etattr warnings when forcing a tty (ssh -tt), since we
576 usually don't actually have a tty to read/set; bz#1686 ok dtucker@
Darren Tucker4b282512010-01-09 22:27:06 +1100577 - dtucker@cvs.openbsd.org 2010/01/09 05:17:00
578 [roaming_client.c]
579 Remove a PRIu64 format string that snuck in with roaming. ok djm@
Darren Tucker70cc0922010-01-09 22:28:03 +1100580 - dtucker@cvs.openbsd.org 2010/01/09 11:13:02
581 [sftp.c]
582 Prevent sftp from derefing a null pointer when given a "-" without a
583 command. Also, allow whitespace to follow a "-". bz#1691, path from
584 Colin Watson via Debian. ok djm@ deraadt@
Darren Tucker2c671bf2010-01-09 22:28:43 +1100585 - dtucker@cvs.openbsd.org 2010/01/09 11:17:56
586 [sshd.c]
587 Afer sshd receives a SIGHUP, ignore subsequent HUPs while sshd re-execs
588 itself. Prevents two HUPs in quick succession from resulting in sshd
589 dying. bz#1692, patch from Colin Watson via Ubuntu.
Darren Tucker269275c2010-01-09 22:33:37 +1100590 - (dtucker) [defines.h] Remove now-undeeded PRIu64 define.
Darren Tucker9eba40c2010-01-09 09:02:07 +1100591
Darren Tucker7ad8dd22010-01-12 19:40:27 +110059220100108
Darren Tuckerb7b17be2010-01-08 16:49:52 +1100593 - (dtucker) OpenBSD CVS Sync
594 - andreas@cvs.openbsd.org 2009/10/24 11:11:58
595 [roaming.h]
596 Declarations needed for upcoming changes.
597 ok markus@
Darren Tucker36331b52010-01-08 16:50:41 +1100598 - andreas@cvs.openbsd.org 2009/10/24 11:13:54
599 [sshconnect2.c kex.h kex.c]
600 Let the client detect if the server supports roaming by looking
601 for the resume@appgate.com kex algorithm.
602 ok markus@
Darren Tuckere32cf432010-01-08 16:51:40 +1100603 - andreas@cvs.openbsd.org 2009/10/24 11:15:29
604 [clientloop.c]
605 client_loop() must detect if the session has been suspended and resumed,
606 and take appropriate action in that case.
607 From Martin Forssen, maf at appgate dot com
Darren Tuckerf9e6eb82010-01-08 16:52:32 +1100608 - andreas@cvs.openbsd.org 2009/10/24 11:19:17
609 [ssh2.h]
610 Define the KEX messages used when resuming a suspended connection.
Darren Tuckere32cf432010-01-08 16:51:40 +1100611 ok markus@
Darren Tuckere7301182010-01-08 16:53:31 +1100612 - andreas@cvs.openbsd.org 2009/10/24 11:22:37
613 [roaming_common.c]
614 Do the actual suspend/resume in the client. This won't be useful until
615 the server side supports roaming.
616 Most code from Martin Forssen, maf at appgate dot com. Some changes by
617 me and markus@
618 ok markus@
Darren Tuckerf1de4e52010-01-08 16:54:59 +1100619 - andreas@cvs.openbsd.org 2009/10/24 11:23:42
620 [ssh.c]
621 Request roaming to be enabled if UseRoaming is true and the server
622 supports it.
623 ok markus@
Darren Tucker34e314d2010-01-08 17:03:46 +1100624 - reyk@cvs.openbsd.org 2009/10/28 16:38:18
625 [ssh_config.5 sshd.c misc.h ssh-keyscan.1 readconf.h sshconnect.c
626 channels.c channels.h servconf.h servconf.c ssh.1 ssh-keyscan.c scp.1
627 sftp.1 sshd_config.5 readconf.c ssh.c misc.c]
628 Allow to set the rdomain in ssh/sftp/scp/sshd and ssh-keyscan.
629 ok markus@
Darren Tuckercc117f02010-01-08 17:05:26 +1100630 - jmc@cvs.openbsd.org 2009/10/28 21:45:08
631 [sshd_config.5 sftp.1]
632 tweak previous;
Darren Tucker78be8c52010-01-08 17:05:59 +1100633 - djm@cvs.openbsd.org 2009/11/10 02:56:22
634 [ssh_config.5]
635 explain the constraints on LocalCommand some more so people don't
636 try to abuse it.
Darren Tuckerf788a912010-01-08 17:06:47 +1100637 - djm@cvs.openbsd.org 2009/11/10 02:58:56
638 [sshd_config.5]
639 clarify that StrictModes does not apply to ChrootDirectory. Permissions
640 and ownership are always checked when chrooting. bz#1532
Darren Tucker6e7fe1c2010-01-08 17:07:22 +1100641 - dtucker@cvs.openbsd.org 2009/11/10 04:30:45
642 [sshconnect2.c channels.c sshconnect.c]
643 Set close-on-exec on various descriptors so they don't get leaked to
644 child processes. bz #1643, patch from jchadima at redhat, ok deraadt.
Darren Tucker876045b2010-01-08 17:08:00 +1100645 - markus@cvs.openbsd.org 2009/11/11 21:37:03
646 [channels.c channels.h]
647 fix race condition in x11/agent channel allocation: don't read after
648 the end of the select read/write fdset and make sure a reused FD
649 is not touched before the pre-handlers are called.
650 with and ok djm@
Darren Tucker29440822010-01-08 17:08:35 +1100651 - djm@cvs.openbsd.org 2009/11/17 05:31:44
652 [clientloop.c]
653 fix incorrect exit status when multiplexing and channel ID 0 is recycled
654 bz#1570 reported by peter.oliver AT eon-is.co.uk; ok dtucker
Darren Tuckerd6b06a92010-01-08 17:09:11 +1100655 - djm@cvs.openbsd.org 2009/11/19 23:39:50
656 [session.c]
657 bz#1606: error when an attempt is made to connect to a server
658 with ForceCommand=internal-sftp with a shell session (i.e. not a
659 subsystem session). Avoids stuck client when attempting to ssh to such a
660 service. ok dtucker@
Darren Tuckerc3dc4042010-01-08 17:09:50 +1100661 - dtucker@cvs.openbsd.org 2009/11/20 00:15:41
662 [session.c]
663 Warn but do not fail if stat()ing the subsystem binary fails. This helps
664 with chrootdirectory+forcecommand=sftp-server and restricted shells.
665 bz #1599, ok djm.
Darren Tucker21063192010-01-08 17:10:36 +1100666 - djm@cvs.openbsd.org 2009/11/20 00:54:01
667 [sftp.c]
668 bz#1588 change "Connecting to host..." message to "Connected to host."
669 and delay it until after the sftp protocol connection has been established.
670 Avoids confusing sequence of messages when the underlying ssh connection
671 experiences problems. ok dtucker@
Darren Tuckerab791692010-01-08 18:48:02 +1100672 - dtucker@cvs.openbsd.org 2009/11/20 00:59:36
673 [sshconnect2.c]
674 Use the HostKeyAlias when prompting for passwords. bz#1039, ok djm@
Darren Tucker70d87692010-01-08 18:49:16 +1100675 - djm@cvs.openbsd.org 2009/11/20 03:24:07
676 [misc.c]
677 correct off-by-one in percent_expand(): we would fatal() when trying
678 to expand EXPAND_MAX_KEYS, allowing only EXPAND_MAX_KEYS-1 to actually
679 work. Note that nothing in OpenSSH actually uses close to this limit at
680 present. bz#1607 from Jan.Pechanec AT Sun.COM
Darren Tuckerc4dc4f52010-01-08 18:50:04 +1100681 - halex@cvs.openbsd.org 2009/11/22 13:18:00
682 [sftp.c]
683 make passing of zero-length arguments to ssh safe by
684 passing "-<switch>" "<value>" rather than "-<switch><value>"
685 ok dtucker@, guenther@, djm@
Darren Tucker5246df42010-01-08 18:50:46 +1100686 - dtucker@cvs.openbsd.org 2009/12/06 23:41:15
687 [sshconnect2.c]
688 zap unused variable and strlen; from Steve McClellan, ok djm
Darren Tucker75694db2010-01-08 18:51:14 +1100689 - djm@cvs.openbsd.org 2009/12/06 23:53:45
690 [roaming_common.c]
691 use socklen_t for getsockopt optlen parameter; reported by
692 Steve.McClellan AT radisys.com, ok dtucker@
Darren Tuckerb5082e92010-01-08 18:51:47 +1100693 - dtucker@cvs.openbsd.org 2009/12/06 23:53:54
694 [sftp.c]
695 fix potential divide-by-zero in sftp's "df" output when talking to a server
696 that reports zero files on the filesystem (Unix filesystems always have at
697 least the root inode). From Steve McClellan at radisys, ok djm@
Darren Tucker57e0d012010-01-08 18:52:27 +1100698 - markus@cvs.openbsd.org 2009/12/11 18:16:33
699 [key.c]
700 switch from 35 to the more common value of RSA_F4 == (2**16)+1 == 65537
701 for the RSA public exponent; discussed with provos; ok djm@
Darren Tuckerb8c884a2010-01-08 18:53:43 +1100702 - guenther@cvs.openbsd.org 2009/12/20 07:28:36
703 [ssh.c sftp.c scp.c]
704 When passing user-controlled options with arguments to other programs,
705 pass the option and option argument as separate argv entries and
706 not smashed into one (e.g., as -l foo and not -lfoo). Also, always
707 pass a "--" argument to stop option parsing, so that a positional
708 argument that starts with a '-' isn't treated as an option. This
709 fixes some error cases as well as the handling of hostnames and
710 filenames that start with a '-'.
711 Based on a diff by halex@
712 ok halex@ djm@ deraadt@
Darren Tuckerf2705c82010-01-08 18:54:17 +1100713 - djm@cvs.openbsd.org 2009/12/20 23:20:40
714 [PROTOCOL]
715 fix an incorrect magic number and typo in PROTOCOL; bz#1688
716 report and fix from ueno AT unixuser.org
Darren Tucker75456e82010-01-08 18:55:58 +1100717 - stevesk@cvs.openbsd.org 2009/12/25 19:40:21
718 [readconf.c servconf.c misc.h ssh-keyscan.c misc.c]
719 validate routing domain is in range 0-RT_TABLEID_MAX.
720 'Looks right' deraadt@
Darren Tucker535b5e12010-01-08 18:56:48 +1100721 - stevesk@cvs.openbsd.org 2009/12/29 16:38:41
722 [sshd_config.5 readconf.c ssh_config.5 scp.1 servconf.c sftp.1 ssh.1]
723 Rename RDomain config option to RoutingDomain to be more clear and
724 consistent with other options.
725 NOTE: if you currently use RDomain in the ssh client or server config,
726 or ssh/sshd -o, you must update to use RoutingDomain.
727 ok markus@ djm@
Darren Tucker98e5d9a2010-01-08 18:57:39 +1100728 - jmc@cvs.openbsd.org 2009/12/29 18:03:32
729 [sshd_config.5 ssh_config.5]
730 sort previous;
Darren Tucker0c348f52010-01-08 18:58:05 +1100731 - dtucker@cvs.openbsd.org 2010/01/04 01:45:30
732 [sshconnect2.c]
733 Don't escape backslashes in the SSH2 banner. bz#1533, patch from
734 Michal Gorny via Gentoo.
Darren Tucker909d8582010-01-08 19:02:40 +1100735 - djm@cvs.openbsd.org 2010/01/04 02:03:57
736 [sftp.c]
737 Implement tab-completion of commands, local and remote filenames for sftp.
738 Hacked on and off for some time by myself, mouring, Carlos Silva (via 2009
739 Google Summer of Code) and polished to a fine sheen by myself again.
740 It should deal more-or-less correctly with the ikky corner-cases presented
741 by quoted filenames, but the UI could still be slightly improved.
742 In particular, it is quite slow for remote completion on large directories.
743 bz#200; ok markus@
Darren Tuckeraaf51d22010-01-08 19:04:49 +1100744 - djm@cvs.openbsd.org 2010/01/04 02:25:15
745 [sftp-server.c]
746 bz#1566 don't unnecessarily dup() in and out fds for sftp-server;
747 ok markus@
Darren Tucker340d1682010-01-09 08:54:31 +1100748 - dtucker@cvs.openbsd.org 2010/01/08 21:50:49
749 [sftp.c]
750 Fix two warnings: possibly used unitialized and use a nul byte instead of
751 NULL pointer. ok djm@
Darren Tucker8cbd4032010-01-08 19:13:25 +1100752 - (dtucker) [Makefile.in added roaming_client.c roaming_serv.c] Import new
753 files for roaming and add to Makefile.
Darren Tuckerdce7a922010-01-08 19:27:57 +1100754 - (dtucker) [Makefile.in] .c files do not belong in the OBJ lines.
Darren Tuckere67f7db2010-01-08 19:50:02 +1100755 - (dtucker) [sftp.c] ifdef out the sftp completion bits for platforms that
756 don't have libedit.
Darren Tucker1f5e3dc2010-01-08 19:53:52 +1100757 - (dtucker) [configure.ac misc.c readconf.c servconf.c ssh-keyscan.c] Make
758 RoutingDomain an unsupported option on platforms that don't have it.
Darren Tucker843f0fa2010-01-08 19:56:33 +1100759 - (dtucker) [sftp.c] Expand ifdef for libedit to cover complete_is_remote
760 too.
Darren Tuckere83c3ea2010-01-08 20:03:56 +1100761 - (dtucker) [misc.c] Move the routingdomain ifdef to allow the socket to
762 be created.
Darren Tuckercb5a1b62010-01-08 20:09:01 +1100763 - (dtucker] [misc.c] Shrink the area covered by USE_ROUTINGDOMAIN more
764 to eliminate an unused variable warning.
Darren Tucker1a8f5352010-01-08 20:45:42 +1100765 - (dtucker) [roaming_serv.c] Include includes.h for u_intXX_t types.
Darren Tuckerb7b17be2010-01-08 16:49:52 +1100766
Tim Rice880ab0d2009-12-26 15:40:47 -080076720091226
768 - (tim) [contrib/cygwin/Makefile] Install ssh-copy-id and ssh-copy-id.1
769 Gzip all man pages. Patch from Corinna Vinschen.
770
Darren Tucker1bf35032009-12-21 10:49:21 +110077120091221
772 - (dtucker) [auth-krb5.c platform.{c,h} openbsd-compat/port-aix.{c,h}]
773 Bug #1583: Use system's kerberos principal name on AIX if it's available.
774 Based on a patch from and tested by Miguel Sanders
775
Darren Tuckerc8802aa2009-12-08 13:39:48 +110077620091208
777 - (dtucker) Bug #1470: Disable OOM-killing of the listening sshd on Linux,
778 based on a patch from Vaclav Ovsik and Colin Watson. ok djm.
779
Darren Tucker15333112009-12-07 11:15:43 +110078020091207
781 - (dtucker) Bug #1160: use pkg-config for opensc config if it's available.
782 Tested by Martin Paljak.
Darren Tuckerd35e0ef2009-12-07 11:32:36 +1100783 - (dtucker) Bug #1677: add conditionals around the source for ssh-askpass.
Darren Tucker15333112009-12-07 11:15:43 +1100784
Tim Rice53e99742009-11-20 19:32:15 -080078520091121
786 - (tim) [opensshd.init.in] If PidFile is set in sshd_config, use it.
787 Bug 1628. OK dtucker@
788
Damien Miller409661f2009-11-20 15:16:35 +110078920091120
790 - (djm) [ssh-rand-helper.c] Print error and usage() when passed command-
791 line arguments as none are supported. Exit when passed unrecognised
792 commandline flags. bz#1568 from gson AT araneus.fi
793
79420091118
Damien Miller04ee0f82009-11-18 17:48:30 +1100795 - (djm) [channels.c misc.c misc.h sshd.c] add missing setsockopt() to
796 set IPV6_V6ONLY for local forwarding with GatwayPorts=yes. Unify
797 setting IPV6_V6ONLY behind a new function misc.c:sock_set_v6only()
Damien Miller2191e042009-11-18 17:51:59 +1100798 bz#1648, report and fix from jan.kratochvil AT redhat.com
799 - (djm) [contrib/gnome-ssh-askpass2.c] Make askpass dialog desktop-modal.
800 bz#1645, patch from jchadima AT redhat.com
Damien Miller04ee0f82009-11-18 17:48:30 +1100801
80220091107
Darren Tuckerdf6578b2009-11-07 16:03:14 +1100803 - (dtucker) [authfile.c] Fall back to 3DES for the encryption of private
804 keys when built with OpenSSL versions that don't do AES.
805
Darren Tuckere89ed1c2009-11-05 20:43:16 +110080620091105
807 - (dtucker) [authfile.c] Add OpenSSL compat header so this still builds with
808 older versions of OpenSSL.
809
Darren Tucker1b118882009-10-24 11:40:32 +110081020091024
811 - (dtucker) OpenBSD CVS Sync
812 - djm@cvs.openbsd.org 2009/10/11 23:03:15
813 [hostfile.c]
814 mention the host name that we are looking for in check_host_in_hostfile()
Darren Tucker49b7e232009-10-24 11:41:05 +1100815 - sobrado@cvs.openbsd.org 2009/10/17 12:10:39
816 [sftp-server.c]
817 sort flags.
Darren Tuckerae69e1d2009-10-24 11:41:34 +1100818 - sobrado@cvs.openbsd.org 2009/10/22 12:35:53
819 [ssh.1 ssh-agent.1 ssh-add.1]
820 use the UNIX-related macros (.At and .Ux) where appropriate.
821 ok jmc@
Darren Tucker98c9aec2009-10-24 11:42:44 +1100822 - sobrado@cvs.openbsd.org 2009/10/22 15:02:12
823 [ssh-agent.1 ssh-add.1 ssh.1]
824 write UNIX-domain in a more consistent way; while here, replace a
825 few remaining ".Tn UNIX" macros with ".Ux" ones.
826 pointed out by ratchov@, thanks!
827 ok jmc@
Darren Tuckerdfb9b712009-10-24 11:46:43 +1100828 - djm@cvs.openbsd.org 2009/10/22 22:26:13
829 [authfile.c]
830 switch from 3DES to AES-128 for encryption of passphrase-protected
831 SSH protocol 2 private keys; ok several
Darren Tucker2f29a8c2009-10-24 11:47:58 +1100832 - djm@cvs.openbsd.org 2009/10/23 01:57:11
833 [sshconnect2.c]
834 disallow a hostile server from checking jpake auth by sending an
835 out-of-sequence success message. (doesn't affect code enabled by default)
Darren Tucker199ee6f2009-10-24 11:50:17 +1100836 - dtucker@cvs.openbsd.org 2009/10/24 00:48:34
837 [ssh-keygen.1]
838 ssh-keygen now uses AES-128 for private keys
Darren Tucker6ac91a72009-10-24 11:52:42 +1100839 - (dtucker) [mdoc2man.awk] Teach it to understand the .Ux macro.
Darren Tucker4d6656b2009-10-24 15:04:12 +1100840 - (dtucker) [session.c openbsd-compat/port-linux.{c,h}] Bug #1637: if selinux
841 is enabled set the security context to "sftpd_t" before running the
842 internal sftp server Based on a patch from jchadima at redhat.
Darren Tucker1b118882009-10-24 11:40:32 +1100843
Darren Tuckerc182d992009-10-11 21:50:20 +110084420091011
845 - (dtucker) [configure.ac sftp-client.c] Remove the gyrations required for
846 dirent d_type and DTTOIF as we've switched OpenBSD to the more portable
847 lstat.
Darren Tuckerbad50762009-10-11 21:51:08 +1100848 - (dtucker) OpenBSD CVS Sync
849 - markus@cvs.openbsd.org 2009/10/08 14:03:41
850 [sshd_config readconf.c ssh_config.5 servconf.c sshd_config.5]
851 disable protocol 1 by default (after a transition period of about 10 years)
852 ok deraadt
Darren Tucker7a4a7652009-10-11 21:51:40 +1100853 - jmc@cvs.openbsd.org 2009/10/08 20:42:12
854 [sshd_config.5 ssh_config.5 sshd.8 ssh.1]
855 some tweaks now that protocol 1 is not offered by default; ok markus
Darren Tucker438b4732009-10-11 21:52:10 +1100856 - dtucker@cvs.openbsd.org 2009/10/11 10:41:26
857 [sftp-client.c]
858 d_type isn't portable so use lstat to get dirent modes. Suggested by and
859 "looks sane" deraadt@
Darren Tuckere23a79c2009-10-12 09:37:22 +1100860 - markus@cvs.openbsd.org 2009/10/08 18:04:27
861 [regress/test-exec.sh]
862 re-enable protocol v1 for the tests.
Darren Tuckerc182d992009-10-11 21:50:20 +1100863
Darren Tucker46bbbe32009-10-07 08:21:48 +110086420091007
865 - (dtucker) OpenBSD CVS Sync
866 - djm@cvs.openbsd.org 2009/08/12 00:13:00
867 [sftp.c sftp.1]
868 support most of scp(1)'s commandline arguments in sftp(1), as a first
869 step towards making sftp(1) a drop-in replacement for scp(1).
870 One conflicting option (-P) has not been changed, pending further
871 discussion.
872 Patch from carlosvsilvapt@gmail.com as part of his work in the
873 Google Summer of Code
Darren Tuckeradba1ba2009-10-07 08:22:20 +1100874 - jmc@cvs.openbsd.org 2009/08/12 06:31:42
875 [sftp.1]
876 sort options;
Darren Tucker282b4022009-10-07 08:23:06 +1100877 - djm@cvs.openbsd.org 2009/08/13 01:11:19
878 [sftp.1 sftp.c]
879 Swizzle options: "-P sftp_server_path" moves to "-D sftp_server_path",
880 add "-P port" to match scp(1). Fortunately, the -P option is only really
881 used by our regression scripts.
882 part of larger patch from carlosvsilvapt@gmail.com for his Google Summer
883 of Code work; ok deraadt markus
Darren Tuckerc07138e2009-10-07 08:23:44 +1100884 - jmc@cvs.openbsd.org 2009/08/13 13:39:54
885 [sftp.1 sftp.c]
886 sync synopsis and usage();
Darren Tuckerc22f0902009-10-07 08:24:19 +1100887 - djm@cvs.openbsd.org 2009/08/14 18:17:49
888 [sftp-client.c]
889 make the "get_handle: ..." error messages vaguely useful by allowing
890 callers to specify their own error message strings.
Darren Tuckere54a0362009-10-07 08:35:32 +1100891 - fgsch@cvs.openbsd.org 2009/08/15 18:56:34
892 [auth.h]
893 remove unused define. markus@ ok.
894 (Id sync only, Portable still uses this.)
Darren Tucker1477ea12009-10-07 08:36:05 +1100895 - dtucker@cvs.openbsd.org 2009/08/16 23:29:26
896 [sshd_config.5]
897 Add PubkeyAuthentication to the list allowed in a Match block (bz #1577)
Darren Tucker1b0dd172009-10-07 08:37:48 +1100898 - djm@cvs.openbsd.org 2009/08/18 18:36:21
899 [sftp-client.h sftp.1 sftp-client.c sftp.c]
900 recursive transfer support for get/put and on the commandline
901 work mostly by carlosvsilvapt@gmail.com for the Google Summer of Code
902 with some tweaks by me; "go for it" deraadt@
Darren Tucker05016b22009-10-07 08:38:23 +1100903 - djm@cvs.openbsd.org 2009/08/18 21:15:59
904 [sftp.1]
905 fix "get" command usage, spotted by jmc@
Darren Tuckerb3b40a82009-10-07 08:39:09 +1100906 - jmc@cvs.openbsd.org 2009/08/19 04:56:03
907 [sftp.1]
908 ether -> either;
Darren Tucker8ec4fd82009-10-07 08:39:57 +1100909 - dtucker@cvs.openbsd.org 2009/08/20 23:54:28
910 [mux.c]
911 subsystem_flag is defined in ssh.c so it's extern; ok djm
Darren Tucker7dc48502009-10-07 08:44:42 +1100912 - djm@cvs.openbsd.org 2009/08/27 17:28:52
913 [sftp-server.c]
914 allow setting an explicit umask on the commandline to override whatever
915 default the user has. bz#1229; ok dtucker@ deraadt@ markus@
Darren Tucker9bcd25b2009-10-07 08:45:48 +1100916 - djm@cvs.openbsd.org 2009/08/27 17:33:49
917 [ssh-keygen.c]
918 force use of correct hash function for random-art signature display
919 as it was inheriting the wrong one when bubblebabble signatures were
920 activated; bz#1611 report and patch from fwojcik+openssh AT besh.com;
921 ok markus@
Darren Tucker6b286a42009-10-07 08:46:21 +1100922 - djm@cvs.openbsd.org 2009/08/27 17:43:00
923 [sftp-server.8]
924 allow setting an explicit umask on the commandline to override whatever
925 default the user has. bz#1229; ok dtucker@ deraadt@ markus@
Darren Tucker893d7352009-10-07 08:47:02 +1100926 - djm@cvs.openbsd.org 2009/08/27 17:44:52
927 [authfd.c ssh-add.c authfd.h]
928 Do not fall back to adding keys without contraints (ssh-add -c / -t ...)
929 when the agent refuses the constrained add request. This was a useful
930 migration measure back in 2002 when constraints were new, but just
931 adds risk now.
932 bz #1612, report and patch from dkg AT fifthhorseman.net; ok markus@
Darren Tucker30359e12009-10-07 08:47:24 +1100933 - djm@cvs.openbsd.org 2009/08/31 20:56:02
934 [sftp-server.c]
935 check correct variable for error message, spotted by martynas@
Darren Tucker7bee06a2009-10-07 08:47:47 +1100936 - djm@cvs.openbsd.org 2009/08/31 21:01:29
937 [sftp-server.8]
938 document -e and -h; prodded by jmc@
Darren Tucker72473c62009-10-07 09:01:03 +1100939 - djm@cvs.openbsd.org 2009/09/01 14:43:17
940 [ssh-agent.c]
941 fix a race condition in ssh-agent that could result in a wedged or
942 spinning agent: don't read off the end of the allocated fd_sets, and
943 don't issue blocking read/write on agent sockets - just fall back to
944 select() on retriable read/write errors. bz#1633 reported and tested
945 by "noodle10000 AT googlemail.com"; ok dtucker@ markus@
Darren Tucker759cb2a2009-10-07 09:01:50 +1100946 - grunk@cvs.openbsd.org 2009/10/01 11:37:33
947 [dh.c]
948 fix a cast
949 ok djm@ markus@
Darren Tucker695ed392009-10-07 09:02:18 +1100950 - djm@cvs.openbsd.org 2009/10/06 04:46:40
951 [session.c]
952 bz#1596: fflush(NULL) before exec() to ensure that everying (motd
953 in particular) has made it out before the streams go away.
Darren Tucker7023d162009-10-07 10:30:06 +1100954 - djm@cvs.openbsd.org 2008/12/07 22:17:48
955 [regress/addrmatch.sh]
956 match string "passwordauthentication" only at start of line, not anywhere
957 in sshd -T output
Darren Tucker79885532009-10-07 10:30:57 +1100958 - dtucker@cvs.openbsd.org 2009/05/05 07:51:36
959 [regress/multiplex.sh]
960 Always specify ssh_config for multiplex tests: prevents breakage caused
961 by options in ~/.ssh/config. From Dan Peterson.
Darren Tucker287b9322009-10-07 10:31:56 +1100962 - djm@cvs.openbsd.org 2009/08/13 00:57:17
963 [regress/Makefile]
964 regression test for port number parsing. written as part of the a2port
965 change that went into 5.2 but I forgot to commit it at the time...
Darren Tuckered6b0c52009-10-07 10:43:57 +1100966 - djm@cvs.openbsd.org 2009/08/13 01:11:55
Darren Tuckerb707a242009-10-07 10:54:31 +1100967 [regress/sftp-batch.sh regress/sftp-badcmds.sh regress/sftp.sh
968 regress/sftp-cmds.sh regres/sftp-glob.sh]
Darren Tuckered6b0c52009-10-07 10:43:57 +1100969 date: 2009/08/13 01:11:19; author: djm; state: Exp; lines: +10 -7
970 Swizzle options: "-P sftp_server_path" moves to "-D sftp_server_path",
971 add "-P port" to match scp(1). Fortunately, the -P option is only really
972 used by our regression scripts.
973 part of larger patch from carlosvsilvapt@gmail.com for his Google Summer
974 of Code work; ok deraadt markus
Darren Tuckerc8638952009-10-07 10:46:29 +1100975 - djm@cvs.openbsd.org 2009/08/20 18:43:07
Darren Tuckerb707a242009-10-07 10:54:31 +1100976 [regress/ssh-com-sftp.sh]
Darren Tuckerc8638952009-10-07 10:46:29 +1100977 fix one sftp -D ... => sftp -P ... conversion that I missed; from Carlos
978 Silva for Google Summer of Code
Darren Tuckerb707a242009-10-07 10:54:31 +1100979 - dtucker@cvs.openbsd.org 2009/10/06 23:51:49
980 [regress/ssh2putty.sh]
981 Add OpenBSD tag to make syncs easier
Darren Tuckera25ab012009-10-07 11:00:58 +1100982 - (dtucker) [regress/portnum.sh] Import new test.
Darren Tucker538738d2009-10-07 18:56:10 +1100983 - (dtucker) [configure.ac sftp-client.c] DTOTIF is in fs/ffs/dir.h on at
Darren Tucker4adeac72009-10-07 15:49:48 +1100984 least dragonflybsd.
Darren Tucker538738d2009-10-07 18:56:10 +1100985 - (dtucker) d_type is not mandated by POSIX, so add fallback code using
986 stat(), needed on at least cygwin.
Darren Tucker46bbbe32009-10-07 08:21:48 +1100987
Damien Miller350666d2009-10-02 11:50:55 +100098820091002
989 - (djm) [Makefile.in] Mention readconf.o in ssh-keysign's make deps.
990 spotted by des AT des.no
991
Damien Millerea437422009-10-02 11:49:03 +100099220090926
993 - (djm) [contrib/caldera/openssh.spec contrib/redhat/openssh.spec]
994 [contrib/suse/openssh.spec] Update for release
995 - (djm) [README] update relnotes URL
996 - (djm) [packet.c] Restore EWOULDBLOCK handling that got lost somewhere
997 - (djm) Release 5.3p1
998
Darren Tuckere02b49a2009-09-11 14:56:08 +100099920090911
1000 - (dtucker) [configure.ac] Change the -lresolv check so it works on Mac OS X
1001 10.6 (which doesn't have BIND8_COMPAT and thus uses res_9_query). Patch
1002 from jbasney at ncsa uiuc edu.
1003
Damien Millere5d5a172009-09-09 11:07:28 +1000100420090908
1005 - (djm) [serverloop.c] Fix test for server-assigned remote forwarding port
1006 (-R 0:...); bz#1578, spotted and fix by gavin AT emf.net; ok dtucker@
1007
Darren Tuckerdad48e72009-09-01 18:26:00 +1000100820090901
1009 - (dtucker) [configure.ac] Bug #1639: use AC_PATH_PROG to search the path for
1010 krb5-config if it's not in the location specified by --with-kerberos5.
1011 Patch from jchadima at redhat.
1012
Darren Tucker427adf12009-08-29 09:14:48 +1000101320090829
1014 - (dtucker) [README.platform] Add text about development packages, based on
1015 text from Chris Pepper in bug #1631.
1016
Darren Tucker28b973e2009-08-28 10:16:44 +1000101720090828
1018 - dtucker [auth-sia.c] Roll back the change for bug #1241 as it apparently
1019 causes problems in some Tru64 configurations.
Damien Miller8aac9932009-08-28 10:40:30 +10001020 - (djm) [sshd_config.5] downgrade mention of login.conf to be an example
1021 and mention PAM as another provider for ChallengeResponseAuthentication;
1022 bz#1408; ok dtucker@
Damien Miller0e265512009-08-28 10:43:13 +10001023 - (djm) [sftp-server.c] bz#1535: accept ENOSYS as a fallback error when
1024 attempting atomic rename(); ok dtucker@
Damien Miller7d4a2682009-08-28 10:47:38 +10001025 - (djm) [Makefile.in] bz#1505: Solaris make(1) doesn't accept make variables
1026 in argv, so pass them in the environment; ok dtucker@
Darren Tucker3980b632009-08-28 11:02:37 +10001027 - (dtucker) [channels.c configure.ac] Bug #1528: skip the tcgetattr call on
1028 the pty master on Solaris, since it never succeeds and can hang if large
1029 amounts of data is sent to the slave (eg a copy-paste). Based on a patch
1030 originally from Doke Scott, ok djm@
Darren Tucker86e30a02009-08-28 11:21:06 +10001031 - (dtucker) [clientloop.c configure.ac defines.h] Make the client's IO buffer
1032 size a compile-time option and set it to 64k on Cygwin, since Corinna
1033 reports that it makes a significant difference to performance. ok djm@
Darren Tuckerac9f1b92009-08-28 15:01:20 +10001034 - (dtucker) [configure.ac] Fix the syntax of the Solaris tcgetattr entry.
Darren Tucker28b973e2009-08-28 10:16:44 +10001035
Darren Tucker2a5588d2009-08-20 16:16:01 +1000103620090820
1037 - (dtucker) [includes.h] Bug #1634: do not include system glob.h if we're not
1038 using it since the type conflicts can cause problems on FreeBSD. Patch
1039 from Jonathan Chen.
Darren Tucker82edf232009-08-20 16:20:50 +10001040 - (dtucker) [session.c openbsd-compat/port-aix.h] Bugs #1249 and #1567: move
1041 the setpcred call on AIX to immediately before the permanently_set_uid().
1042 Ensures that we still have privileges when we call chroot and
1043 pam_open_sesson. Based on a patch from David Leonard.
Darren Tucker2a5588d2009-08-20 16:16:01 +10001044
Darren Tucker83d8f282009-08-17 09:35:22 +1000104520090817
1046 - (dtucker) [configure.ac] Check for headers before libraries for openssl an
1047 zlib, which should make the errors slightly more meaningful on platforms
1048 where there's separate "-devel" packages for those.
Darren Tuckerb5d5ee12009-08-17 09:40:00 +10001049 - (dtucker) [sshlogin.c openbsd-compat/port-aix.{c,h}] Bug #1595: make
1050 PrintLastLog work on AIX. Based in part on a patch from Miguel Sanders.
Darren Tucker83d8f282009-08-17 09:35:22 +10001051
Tim Ricecaeb1642009-07-29 07:21:13 -0700105220090729
1053 - (tim) [contrib/cygwin/ssh-user-config] Change script to call correct error
1054 function. Patch from Corinna Vinschen.
1055
Darren Tucker440089a2009-07-13 11:38:23 +1000105620090713
1057 - (dtucker) [openbsd-compat/getrrsetbyname.c] Reduce answer buffer size so it
1058 fits into 16 bits to work around a bug in glibc's resolver where it masks
1059 off the buffer size at 16 bits. Patch from Hauke Lampe, ok djm jakob.
1060
Darren Tuckerc4b22ca2009-07-12 21:56:29 +1000106120090712
1062 - (dtucker) [configure.ac] Include sys/param.h for the sys/mount.h test,
1063 prevents configure complaining on older BSDs.
Darren Tucker8fdcba52009-07-12 21:58:42 +10001064 - (dtucker [contrib/cygwin/ssh-{host,user}-config] Add license text. Patch
1065 from Corinna Vinschen.
Darren Tucker622d5c52009-07-12 22:07:21 +10001066 - (dtucker) [auth-pam.c] Bug #1534: move the deletion of PAM credentials on
Darren Tucker916fdda2009-07-12 22:12:28 +10001067 logout to after the session close. Patch from Anicka Bernathova,
1068 originally from Andreas Schwab via Novelll ok djm.
Darren Tuckerc4b22ca2009-07-12 21:56:29 +10001069
Darren Tucker4d4fdc02009-07-07 21:19:11 +1000107020090707
1071 - (dtucker) [contrib/cygwin/ssh-host-config] better support for automated
1072 scripts and fix usage of eval. Patch from Corinna Vinschen.
1073
107420090705
Darren Tuckere841eb02009-07-06 07:11:13 +10001075 - (dtucker) OpenBSD CVS Sync
1076 - andreas@cvs.openbsd.org 2009/06/27 09:29:06
1077 [packet.h packet.c]
1078 packet_bacup_state() and packet_restore_state() will be used to
1079 temporarily save the current state ren resuming a suspended connection.
1080 ok markus@
Darren Tucker466df212009-07-06 07:11:52 +10001081 - andreas@cvs.openbsd.org 2009/06/27 09:32:43
1082 [roaming_common.c roaming.h]
1083 It may be necessary to retransmit some data when resuming, so add it
1084 to a buffer when roaming is enabled.
1085 Most of this code was written by Martin Forssen, maf at appgate dot com.
1086 ok markus@
Darren Tucker71e4d542009-07-06 07:12:27 +10001087 - andreas@cvs.openbsd.org 2009/06/27 09:35:06
1088 [readconf.h readconf.c]
1089 Add client option UseRoaming. It doesn't do anything yet but will
1090 control whether the client tries to use roaming if enabled on the
1091 server. From Martin Forssen.
1092 ok markus@
Darren Tuckercd6b1a22009-07-06 07:13:04 +10001093 - markus@cvs.openbsd.org 2009/06/30 14:54:40
1094 [version.h]
1095 crank version; ok deraadt
Darren Tucker199b1342009-07-06 07:16:56 +10001096 - dtucker@cvs.openbsd.org 2009/07/02 02:11:47
1097 [ssh.c]
1098 allow for long home dir paths (bz #1615). ok deraadt
1099 (based in part on a patch from jchadima at redhat)
Darren Tuckerde0c0252009-07-06 07:17:35 +10001100 - stevesk@cvs.openbsd.org 2009/07/05 19:28:33
1101 [clientloop.c]
1102 only send SSH2_MSG_DISCONNECT if we're in compat20; from dtucker@
1103 ok deraadt@ markus@
Darren Tuckere841eb02009-07-06 07:11:13 +10001104
Darren Tucker821d3db2009-06-22 16:11:06 +1000110520090622
1106 - (dtucker) OpenBSD CVS Sync
1107 - dtucker@cvs.openbsd.org 2009/06/22 05:39:28
1108 [monitor_wrap.c monitor_mm.c ssh-keygen.c auth2.c gss-genr.c sftp-client.c]
1109 alphabetize includes; reduces diff vs portable and style(9).
1110 ok stevesk djm
1111 (Id sync only; these were already in order in -portable)
1112
Darren Tucker72efd742009-06-21 17:48:00 +1000111320090621
1114 - (dtucker) OpenBSD CVS Sync
1115 - markus@cvs.openbsd.org 2009/03/17 21:37:00
1116 [ssh.c]
1117 pass correct argv[0] to openlog(); ok djm@
Darren Tucker3a6a51f2009-06-21 17:48:52 +10001118 - jmc@cvs.openbsd.org 2009/03/19 15:15:09
1119 [ssh.1]
1120 for "Ciphers", just point the reader to the keyword in ssh_config(5), just
1121 as we do for "MACs": this stops us getting out of sync when the lists
1122 change;
1123 fixes documentation/6102, submitted by Peter J. Philipp
1124 alternative fix proposed by djm
1125 ok markus
Darren Tuckera0964502009-06-21 17:49:36 +10001126 - tobias@cvs.openbsd.org 2009/03/23 08:31:19
1127 [ssh-agent.c]
1128 Fixed a possible out-of-bounds memory access if the environment variable
1129 SHELL is shorter than 3 characters.
1130 with input by and ok dtucker
Darren Tucker90133232009-06-21 17:50:15 +10001131 - tobias@cvs.openbsd.org 2009/03/23 19:38:04
1132 [ssh-agent.c]
1133 My previous commit didn't fix the problem at all, so stick at my first
1134 version of the fix presented to dtucker.
1135 Issue notified by Matthias Barkhoff (matthias dot barkhoff at gmx dot de).
1136 ok dtucker
Darren Tucker5837b512009-06-21 17:52:27 +10001137 - sobrado@cvs.openbsd.org 2009/03/26 08:38:39
1138 [sftp-server.8 sshd.8 ssh-agent.1]
1139 fix a few typographical errors found by spell(1).
1140 ok dtucker@, jmc@
Darren Tuckeraf501cf2009-06-21 17:53:04 +10001141 - stevesk@cvs.openbsd.org 2009/04/13 19:07:44
1142 [sshd_config.5]
1143 fix possessive; ok djm@
Darren Tuckerb62f1a82009-06-21 17:53:48 +10001144 - stevesk@cvs.openbsd.org 2009/04/14 16:33:42
1145 [sftp-server.c]
1146 remove unused option character from getopt() optstring; ok markus@
Darren Tucker3b59dfa2009-06-21 17:54:47 +10001147 - jj@cvs.openbsd.org 2009/04/14 21:10:54
1148 [servconf.c]
1149 Fixed a few the-the misspellings in comments. Skipped a bunch in
1150 binutils,gcc and so on. ok jmc@
Darren Tuckerac46a912009-06-21 17:55:23 +10001151 - stevesk@cvs.openbsd.org 2009/04/17 19:23:06
1152 [session.c]
1153 use INTERNAL_SFTP_NAME for setproctitle() of in-process sftp-server;
1154 ok djm@ markus@
Darren Tucker00fcd712009-06-21 17:56:00 +10001155 - stevesk@cvs.openbsd.org 2009/04/17 19:40:17
1156 [sshd_config.5]
1157 clarify that even internal-sftp needs /dev/log for logging to work; ok
1158 markus@
Darren Tuckerf92077f2009-06-21 17:56:25 +10001159 - jmc@cvs.openbsd.org 2009/04/18 18:39:10
1160 [sshd_config.5]
1161 tweak previous; ok stevesk
Darren Tucker51dbe502009-06-21 17:56:51 +10001162 - stevesk@cvs.openbsd.org 2009/04/21 15:13:17
1163 [sshd_config.5]
1164 clarify we cd to user's home after chroot; ok markus@ on
1165 earlier version; tweaks and ok jmc@
Darren Tuckerf7288d72009-06-21 18:12:20 +10001166 - andreas@cvs.openbsd.org 2009/05/25 06:48:01
1167 [channels.c packet.c clientloop.c packet.h serverloop.c monitor_wrap.c
1168 monitor.c]
1169 Put the globals in packet.c into a struct and don't access it directly
1170 from other files. No functional changes.
1171 ok markus@ djm@
1172 - andreas@cvs.openbsd.org 2009/05/27 06:31:25
1173 [canohost.h canohost.c]
1174 Add clear_cached_addr(), needed for upcoming changes allowing the peer
1175 address to change.
1176 ok markus@
Darren Tucker39c76322009-06-21 18:13:57 +10001177 - andreas@cvs.openbsd.org 2009/05/27 06:33:39
1178 [clientloop.c]
1179 Send SSH2_MSG_DISCONNECT when the client disconnects. From a larger
1180 change from Martin Forssen, maf at appgate dot com.
1181 ok markus@
Darren Tucker12b4a652009-06-21 18:14:48 +10001182 - andreas@cvs.openbsd.org 2009/05/27 06:34:36
1183 [kex.c kex.h]
1184 Move the KEX_COOKIE_LEN define to kex.h
1185 ok markus@
Darren Tucker5b48cdd2009-06-21 18:15:25 +10001186 - andreas@cvs.openbsd.org 2009/05/27 06:36:07
1187 [packet.h packet.c]
1188 Add packet_put_int64() and packet_get_int64(), part of a larger change
1189 from Martin Forssen.
Darren Tucker761c3892009-06-21 18:16:26 +10001190 ok markus@
1191 - andreas@cvs.openbsd.org 2009/05/27 06:38:16
1192 [sshconnect.h sshconnect.c]
1193 Un-static ssh_exchange_identification(), part of a larger change from
1194 Martin Forssen and needed for upcoming changes.
1195 ok markus@
Darren Tucker1cc55d72009-06-21 18:17:19 +10001196 - andreas@cvs.openbsd.org 2009/05/28 16:50:16
1197 [sshd.c packet.c serverloop.c monitor_wrap.c clientloop.c sshconnect.c
Darren Tuckerc5564e12009-06-21 18:53:53 +10001198 monitor.c Added roaming.h roaming_common.c roaming_dummy.c]
Darren Tucker1cc55d72009-06-21 18:17:19 +10001199 Keep track of number of bytes read and written. Needed for upcoming
1200 changes. Most code from Martin Forssen, maf at appgate dot com.
1201 ok markus@
Darren Tuckerc5564e12009-06-21 18:53:53 +10001202 Also, applied appropriate changes to Makefile.in
Darren Tuckerb422afa2009-06-21 18:58:46 +10001203 - andreas@cvs.openbsd.org 2009/06/12 20:43:22
1204 [monitor.c packet.c]
1205 Fix warnings found by chl@ and djm@ and change roaming_atomicio's
1206 return type to match atomicio's
1207 Diff from djm@, ok markus@
Darren Tucker7b935c72009-06-21 18:59:36 +10001208 - andreas@cvs.openbsd.org 2009/06/12 20:58:32
1209 [packet.c]
1210 Move some more statics into session_state
1211 ok markus@ djm@
Darren Tucker6ae35ac2009-06-21 19:00:20 +10001212 - dtucker@cvs.openbsd.org 2009/06/21 07:37:15
1213 [kexdhs.c kexgexs.c]
1214 abort if key_sign fails, preventing possible null deref. Based on report
1215 from Paolo Ganci, ok markus@ djm@
Darren Tuckere6b590e2009-06-21 19:08:48 +10001216 - dtucker@cvs.openbsd.org 2009/06/21 09:04:03
1217 [roaming.h roaming_common.c roaming_dummy.c]
1218 Add tags for the benefit of the sync scripts
1219 Also: pull in the changes for 1.1->1.2 missed in the previous sync.
Darren Tucker43e7a352009-06-21 19:50:08 +10001220 - (dtucker) [auth2-jpake.c auth2.c canohost.h session.c] Whitespace and
1221 header-order changes to reduce diff vs OpenBSD.
Darren Tucker64cee362009-06-21 20:26:17 +10001222 - (dtucker) [servconf.c sshd.c] More whitespace sync.
Darren Tucker828c96d2009-06-21 22:22:08 +10001223 - (dtucker) [roaming_common.c roaming_dummy.c] Wrap #include <inttypes.h> in
1224 ifdef.
Darren Tucker72efd742009-06-21 17:48:00 +10001225
Darren Tucker32780622009-06-16 16:11:02 +1000122620090616
1227 - (dtucker) [configure.ac defines.h] Bug #1607: handle the case where fsid_t
1228 is a struct with a __val member. Fixes build on, eg, Redhat 6.2.
1229
Darren Tuckera422d972009-05-04 12:52:47 +1000123020090504
1231 - (dtucker) [sshlogin.c] Move the NO_SSH_LASTLOG #ifndef line to include
1232 variable declarations. Should prevent unused warnings anywhere it's set
1233 (only Crays as far as I can tell) and be a no-op everywhere else.
1234
Tim Ricea74000e2009-03-18 11:25:02 -0700123520090318
1236 - (tim) [configure.ac] Remove setting IP_TOS_IS_BROKEN for Cygwin. The problem
1237 that setsockopt(IP_TOS) doesn't work on Cygwin has been fixed since 2005.
1238 Based on patch from vinschen at redhat com.
1239
Darren Tucker9d86e5d2009-03-08 11:40:27 +1100124020090308
1241 - (dtucker) [auth-passwd.c auth1.c auth2-kbdint.c auth2-none.c auth2-passwd.c
1242 auth2-pubkey.c session.c openbsd-compat/bsd-cygwin_util.{c,h}
1243 openbsd-compat/daemon.c] Remove support for Windows 95/98/ME and very old
1244 version of Cygwin. Patch from vinschen at redhat com.
1245
Darren Tucker558d6ca2009-03-07 10:22:10 +1100124620090307
1247 - (dtucker) [contrib/aix/buildbff.sh] Only try to rename ssh_prng_cmds if it
1248 exists (it's not created if OpenSSL's PRNG is self-seeded, eg if the OS
1249 has a /dev/random).
Darren Tucker8aae6ff2009-03-07 12:01:47 +11001250 - (dtucker) [schnorr.c openbsd-compat/openssl-compat.{c,h}] Add
1251 EVP_DigestUpdate to the OLD_EVP compatibility functions and tell schnorr.c
1252 to use them. Allows building with older OpenSSL versions.
Darren Tuckerccfee052009-03-07 12:32:22 +11001253 - (dtucker) [configure.ac defines.h] Check for in_port_t and typedef if needed.
Darren Tucker30ed6682009-03-07 18:06:22 +11001254 - (dtucker) [configure.ac] Missing comma in type list.
Darren Tucker3e7e15f2009-03-07 22:22:35 +11001255 - (dtucker) [configure.ac openbsd-compat/openssl-compat.{c,h}]
1256 EVP_DigestUpdate does not exactly match the other OLD_EVP functions (eg
1257 in openssl 0.9.6) so add an explicit test for it.
Darren Tucker558d6ca2009-03-07 10:22:10 +11001258
Damien Millercee85232009-03-06 00:58:22 +1100125920090306
1260 - (djm) OpenBSD CVS Sync
1261 - djm@cvs.openbsd.org 2009/03/05 07:18:19
1262 [auth2-jpake.c jpake.c jpake.h monitor_wrap.c monitor_wrap.h schnorr.c]
1263 [sshconnect2.c]
1264 refactor the (disabled) Schnorr proof code to make it a little more
1265 generally useful
Damien Miller447e3872009-03-06 00:58:39 +11001266 - djm@cvs.openbsd.org 2009/03/05 11:30:50
1267 [uuencode.c]
1268 document what these functions do so I don't ever have to recuse into
1269 b64_pton/ntop to remember their return values
Damien Millercee85232009-03-06 00:58:22 +11001270
Damien Miller19913842009-02-23 10:53:58 +1100127120090223
1272 - (djm) OpenBSD CVS Sync
1273 - djm@cvs.openbsd.org 2009/02/22 23:50:57
1274 [ssh_config.5 sshd_config.5]
1275 don't advertise experimental options
Damien Miller0296ae82009-02-23 11:00:24 +11001276 - djm@cvs.openbsd.org 2009/02/22 23:59:25
1277 [sshd_config.5]
1278 missing period
Damien Miller582ca6b2009-02-23 11:09:25 +11001279 - djm@cvs.openbsd.org 2009/02/23 00:06:15
1280 [version.h]
1281 openssh-5.2
Damien Miller5d0d5302009-02-23 11:11:57 +11001282 - (djm) [README] update for 5.2
Damien Millerfaec50b2009-02-23 11:12:29 +11001283 - (djm) Release openssh-5.2p1
Damien Miller19913842009-02-23 10:53:58 +11001284
Damien Miller9eab9562009-02-22 08:47:02 +1100128520090222
1286 - (djm) OpenBSD CVS Sync
1287 - tobias@cvs.openbsd.org 2009/02/21 19:32:04
1288 [misc.c sftp-server-main.c ssh-keygen.c]
1289 Added missing newlines in error messages.
1290 ok dtucker
1291
Damien Millere8001d42009-02-21 12:45:02 +1100129220090221
1293 - (djm) OpenBSD CVS Sync
1294 - djm@cvs.openbsd.org 2009/02/17 01:28:32
1295 [ssh_config]
1296 sync with revised default ciphers; pointed out by dkrause@
Damien Miller25918382009-02-21 12:45:18 +11001297 - djm@cvs.openbsd.org 2009/02/18 04:31:21
1298 [schnorr.c]
1299 signature should hash over the entire group, not just the generator
1300 (this is still disabled code)
Damien Miller7691e5f2009-02-21 18:03:04 +11001301 - (djm) [contrib/caldera/openssh.spec contrib/redhat/openssh.spec]
1302 [contrib/suse/openssh.spec] Prepare for 5.2p1
Damien Millere8001d42009-02-21 12:45:02 +11001303
Damien Miller3f94aaf2009-02-16 15:21:39 +1100130420090216
1305 - (djm) [regress/conch-ciphers.sh regress/putty-ciphers.sh]
1306 [regress/putty-kex.sh regress/putty-transfer.sh] Downgrade disabled
1307 interop tests from FATAL error to a warning. Allows some interop
1308 tests to proceed if others are missing necessary prerequisites.
Damien Miller90551722009-02-16 15:37:03 +11001309 - (djm) [configure.ac] support GNU/kFreeBSD and GNU/kOpensolaris
1310 systems; patch from Aurelien Jarno via rmh AT aybabtu.com
Damien Miller3f94aaf2009-02-16 15:21:39 +11001311
Damien Millerfdd66fc2009-02-14 16:26:19 +1100131220090214
1313 - (djm) OpenBSD CVS Sync
1314 - dtucker@cvs.openbsd.org 2009/02/02 11:15:14
1315 [sftp.c]
1316 Initialize a few variables to prevent spurious "may be used
1317 uninitialized" warnings from newer gcc's. ok djm@
Damien Miller4bf648f2009-02-14 16:28:21 +11001318 - djm@cvs.openbsd.org 2009/02/12 03:00:56
1319 [canohost.c canohost.h channels.c channels.h clientloop.c readconf.c]
1320 [readconf.h serverloop.c ssh.c]
1321 support remote port forwarding with a zero listen port (-R0:...) to
1322 dyamically allocate a listen port at runtime (this is actually
1323 specified in rfc4254); bz#1003 ok markus@
Damien Miller330d5852009-02-14 16:33:09 +11001324 - djm@cvs.openbsd.org 2009/02/12 03:16:01
1325 [serverloop.c]
1326 tighten check for -R0:... forwarding: only allow dynamic allocation
1327 if want_reply is set in the packet
Damien Miller923e8bb2009-02-14 16:33:31 +11001328 - djm@cvs.openbsd.org 2009/02/12 03:26:22
1329 [monitor.c]
1330 some paranoia: check that the serialised key is really KEY_RSA before
1331 diddling its internals
Damien Millere2f4cc52009-02-14 16:33:49 +11001332 - djm@cvs.openbsd.org 2009/02/12 03:42:09
1333 [ssh.1]
1334 document -R0:... usage
Damien Miller65fa4ca2009-02-14 16:34:05 +11001335 - djm@cvs.openbsd.org 2009/02/12 03:44:25
1336 [ssh.1]
1337 consistency: Dq => Ql
Damien Miller85c6d8a2009-02-14 16:34:21 +11001338 - djm@cvs.openbsd.org 2009/02/12 03:46:17
1339 [ssh_config.5]
1340 document RemoteForward usage with 0 listen port
Damien Millere379e102009-02-14 16:34:39 +11001341 - jmc@cvs.openbsd.org 2009/02/12 07:34:20
1342 [ssh_config.5]
1343 kill trailing whitespace;
Damien Miller61433be2009-02-14 16:35:01 +11001344 - markus@cvs.openbsd.org 2009/02/13 11:50:21
1345 [packet.c]
1346 check for enc !=NULL in packet_start_discard
Damien Miller6385e752009-02-14 18:00:52 +11001347 - djm@cvs.openbsd.org 2009/02/14 06:35:49
1348 [PROTOCOL]
1349 mention that eow and no-more-sessions extensions are sent only to
1350 OpenSSH peers
Damien Millerfdd66fc2009-02-14 16:26:19 +11001351
135220090212
Damien Miller2de76242009-02-12 12:19:20 +11001353 - (djm) [sshpty.c] bz#1419: OSX uses cloning ptys that automagically
1354 set ownership and modes, so avoid explicitly setting them
Damien Miller20e231f2009-02-12 13:12:21 +11001355 - (djm) [configure.ac loginrec.c] bz#1421: fix lastlog support for OSX.
1356 OSX provides a getlastlogxbyname function that automates the reading of
1357 a lastlog file. Also, the pututxline function will update lastlog so
1358 there is no need for loginrec.c to do it explicitly. Collapse some
1359 overly verbose code while I'm in there.
Damien Miller2de76242009-02-12 12:19:20 +11001360
Darren Tucker642ebe52009-02-01 22:19:54 +1100136120090201
1362 - (dtucker) [defines.h sshconnect.c] INET6_ADDRSTRLEN is now needed in
1363 channels.c too, so move the definition for non-IP6 platforms to defines.h
1364 where it can be shared.
1365
Tim Rice6a325342009-01-29 12:30:01 -0800136620090129
1367 - (tim) [contrib/cygwin/ssh-host-config] Patch from Corinna Vinschen.
1368 If the CYGWIN environment variable is empty, the installer script
1369 should not install the service with an empty CYGWIN variable, but
1370 rather without setting CYGWNI entirely.
Tim Rice0d8f2f32009-01-29 12:40:30 -08001371 - (tim) [contrib/cygwin/ssh-host-config] Whitespace cleanup. No code changes.
Tim Rice6a325342009-01-29 12:30:01 -08001372
Tim Riceca3692d2009-01-28 12:50:04 -0800137320090128
1374 - (tim) [contrib/cygwin/ssh-host-config] Patch from Corinna Vinschen.
1375 Changes to work on Cygwin 1.5.x as well as on the new Cygwin 1.7.x.
1376 The information given for the setting of the CYGWIN environment variable
1377 is wrong for both releases so I just removed it, together with the
1378 unnecessary (Cygwin 1.5.x) or wrong (Cygwin 1.7.x) default setting.
1379
Damien Millerb53d8a12009-01-28 16:13:04 +1100138020081228
1381 - (djm) OpenBSD CVS Sync
1382 - stevesk@cvs.openbsd.org 2008/12/09 03:20:42
1383 [channels.c servconf.c]
1384 channel_print_adm_permitted_opens() should deal with all the printing
1385 for that config option. suggested by markus@; ok markus@ djm@
1386 dtucker@
Damien Millerc30def92009-01-28 16:13:39 +11001387 - djm@cvs.openbsd.org 2008/12/09 04:32:22
1388 [auth2-chall.c]
1389 replace by-hand string building with xasprinf(); ok deraadt@
Damien Miller62fd18a2009-01-28 16:14:09 +11001390 - sobrado@cvs.openbsd.org 2008/12/09 15:35:00
1391 [sftp.1 sftp.c]
1392 update for the synopses displayed by the 'help' command, there are a
1393 few missing flags; add 'bye' to the output of 'help'; sorting and spacing.
1394 jmc@ suggested replacing .Oo/.Oc with a single .Op macro.
1395 ok jmc@
Damien Millerb3f2c9f2009-01-28 16:15:30 +11001396 - stevesk@cvs.openbsd.org 2008/12/09 22:37:33
1397 [clientloop.c]
1398 fix typo in error message
Damien Miller7375fe22009-01-28 16:16:00 +11001399 - stevesk@cvs.openbsd.org 2008/12/10 03:55:20
1400 [addrmatch.c]
1401 o cannot be NULL here but use xfree() to be consistent; ok djm@
Damien Millerb2c17d42009-01-28 16:18:03 +11001402 - stevesk@cvs.openbsd.org 2008/12/29 01:12:36
1403 [ssh-keyscan.1]
1404 fix example, default key type is rsa for 3+ years; from
1405 frederic.perrin@resel.fr
Damien Millera70ac762009-01-28 16:19:52 +11001406 - stevesk@cvs.openbsd.org 2008/12/29 02:23:26
1407 [pathnames.h]
1408 no need to escape single quotes in comments
Damien Miller17819012009-01-28 16:20:17 +11001409 - okan@cvs.openbsd.org 2008/12/30 00:46:56
1410 [sshd_config.5]
1411 add AllowAgentForwarding to available Match keywords list
1412 ok djm
Damien Miller7a606212009-01-28 16:22:34 +11001413 - djm@cvs.openbsd.org 2009/01/01 21:14:35
1414 [channels.c]
1415 call channel destroy callbacks on receipt of open failure messages.
1416 fixes client hangs when connecting to a server that has MaxSessions=0
1417 set spotted by imorgan AT nas.nasa.gov; ok markus@
Damien Millerccf7e222009-01-28 16:23:06 +11001418 - djm@cvs.openbsd.org 2009/01/01 21:17:36
1419 [kexgexs.c]
1420 fix hash calculation for KEXGEX: hash over the original client-supplied
1421 values and not the sanity checked versions that we acutally use;
1422 bz#1540 reported by john.smith AT arrows.demon.co.uk
1423 ok markus@
Damien Miller1781f532009-01-28 16:24:41 +11001424 - djm@cvs.openbsd.org 2009/01/14 01:38:06
1425 [channels.c]
1426 support SOCKS4A protocol, from dwmw2 AT infradead.org via bz#1482;
1427 "looks ok" markus@
Damien Miller5bc6aae2009-01-28 16:27:31 +11001428 - stevesk@cvs.openbsd.org 2009/01/15 17:38:43
1429 [readconf.c]
1430 1) use obsolete instead of alias for consistency
1431 2) oUserKnownHostsFile not obsolete but oGlobalKnownHostsFile2 is
1432 so move the comment.
1433 3) reorder so like options are together
1434 ok djm@
Damien Millera1c1b6c2009-01-28 16:29:49 +11001435 - djm@cvs.openbsd.org 2009/01/22 09:46:01
1436 [channels.c channels.h session.c]
1437 make Channel->path an allocated string, saving a few bytes here and
1438 there and fixing bz#1380 in the process; ok markus@
Damien Miller9576ac42009-01-28 16:30:33 +11001439 - djm@cvs.openbsd.org 2009/01/22 09:49:57
1440 [channels.c]
1441 oops! I committed the wrong version of the Channel->path diff,
1442 it was missing some tweaks suggested by stevesk@
Damien Miller3dc71ad2009-01-28 16:31:22 +11001443 - djm@cvs.openbsd.org 2009/01/22 10:02:34
1444 [clientloop.c misc.c readconf.c readconf.h servconf.c servconf.h]
1445 [serverloop.c ssh-keyscan.c ssh.c sshd.c]
1446 make a2port() return -1 when it encounters an invalid port number
1447 rather than 0, which it will now treat as valid (needed for future work)
1448 adjust current consumers of a2port() to check its return value is <= 0,
1449 which in turn required some things to be converted from u_short => int
1450 make use of int vs. u_short consistent in some other places too
1451 feedback & ok markus@
Damien Millere37dde02009-01-28 16:33:01 +11001452 - djm@cvs.openbsd.org 2009/01/22 10:09:16
1453 [auth-options.c]
1454 another chunk of a2port() diff that got away. wtfdjm??
Damien Miller67081b52009-01-28 16:33:31 +11001455 - djm@cvs.openbsd.org 2009/01/23 07:58:11
1456 [myproposal.h]
1457 prefer CTR modes and revised arcfour (i.e w/ discard) modes to CBC
1458 modes; ok markus@
Damien Miller9aa72ba2009-01-28 16:34:00 +11001459 - naddy@cvs.openbsd.org 2009/01/24 17:10:22
1460 [ssh_config.5 sshd_config.5]
1461 sync list of preferred ciphers; ok djm@
Damien Miller13ae44c2009-01-28 16:38:41 +11001462 - markus@cvs.openbsd.org 2009/01/26 09:58:15
1463 [cipher.c cipher.h packet.c]
1464 Work around the CPNI-957037 Plaintext Recovery Attack by always
1465 reading 256K of data on packet size or HMAC errors (in CBC mode only).
1466 Help, feedback and ok djm@
1467 Feedback from Martin Albrecht and Paterson Kenny
Damien Millerb53d8a12009-01-28 16:13:04 +11001468
Tim Rice351529c2009-01-07 10:04:12 -0800146920090107
Damien Miller1598d6b2009-01-21 16:04:24 +11001470 - (djm) [uidswap.c] bz#1412: Support >16 supplemental groups in OS X.
1471 Patch based on one from vgiffin AT apple.com; ok dtucker@
Damien Miller819dbb62009-01-21 16:46:26 +11001472 - (djm) [channels.c] bz#1419: support "on demand" X11 forwarding via
1473 launchd on OS X; patch from vgiffin AT apple.com, slightly tweaked;
1474 ok dtucker@
Damien Miller02666772009-01-21 20:29:20 +11001475 - (djm) [contrib/ssh-copy-id.1 contrib/ssh-copy-id] bz#1492: Make
1476 ssh-copy-id copy id_rsa.pub by default (instead of the legacy "identity"
1477 key). Patch from cjwatson AT debian.org
Damien Miller1598d6b2009-01-21 16:04:24 +11001478
147920090107
Tim Rice351529c2009-01-07 10:04:12 -08001480 - (tim) [configure.ac defines.h openbsd-compat/port-uw.c
1481 openbsd-compat/xcrypt.c] Add SECUREWARE support to OpenServer 6 SVR5 ABI.
1482 OK djm@ dtucker@
Tim Rice26767912009-01-07 20:50:08 -08001483 - (tim) [configure.ac] Move check_for_libcrypt_later=1 in *-*-sysv5*) section.
1484 OpenServer 6 doesn't need libcrypt.
Tim Rice351529c2009-01-07 10:04:12 -08001485
Damien Miller586b0052008-12-09 14:11:32 +1100148620081209
1487 - (djm) OpenBSD CVS Sync
1488 - djm@cvs.openbsd.org 2008/12/09 02:38:18
1489 [clientloop.c]
1490 The ~C escape handler does not work correctly for multiplexed sessions -
1491 it opens a commandline on the master session, instead of on the slave
1492 that requested it. Disable it on slave sessions until such time as it
1493 is fixed; bz#1543 report from Adrian Bridgett via Colin Watson
1494 ok markus@
Damien Miller1be2cc42008-12-09 14:11:49 +11001495 - djm@cvs.openbsd.org 2008/12/09 02:39:59
1496 [sftp.c]
1497 Deal correctly with failures in remote stat() operation in sftp,
1498 correcting fail-on-error behaviour in batchmode. bz#1541 report and
1499 fix from anedvedicky AT gmail.com; ok markus@
Damien Miller0d772d92008-12-09 14:12:05 +11001500 - djm@cvs.openbsd.org 2008/12/09 02:58:16
1501 [readconf.c]
1502 don't leave junk (free'd) pointers around in Forward *fwd argument on
1503 failure; avoids double-free in ~C -L handler when given an invalid
1504 forwarding specification; bz#1539 report from adejong AT debian.org
1505 via Colin Watson; ok markus@ dtucker@
Damien Miller7ebfad72008-12-09 14:12:33 +11001506 - djm@cvs.openbsd.org 2008/12/09 03:02:37
1507 [sftp.1 sftp.c]
1508 correct sftp(1) and corresponding usage syntax;
1509 bz#1518 patch from imorgan AT nas.nasa.gov; ok deraadt@ improved diff jmc@
Damien Miller586b0052008-12-09 14:11:32 +11001510
Damien Miller7df2e402008-12-08 09:35:36 +1100151120081208
1512 - (djm) [configure.ac] bz#1538: better test for ProPolice/SSP: actually
1513 use some stack in main().
1514 Report and suggested fix from vapier AT gentoo.org
Damien Miller8533c782008-12-08 09:54:40 +11001515 - (djm) OpenBSD CVS Sync
1516 - markus@cvs.openbsd.org 2008/12/02 19:01:07
1517 [clientloop.c]
1518 we have to use the recipient's channel number (RFC 4254) for
1519 SSH2_MSG_CHANNEL_SUCCESS/SSH2_MSG_CHANNEL_FAILURE messages,
1520 otherwise we trigger 'Non-public channel' error messages on sshd
1521 systems with clientkeepalive enabled; noticed by sturm; ok djm;
Damien Miller5a33ec62008-12-08 09:55:02 +11001522 - markus@cvs.openbsd.org 2008/12/02 19:08:59
1523 [serverloop.c]
1524 backout 1.149, since it's not necessary and openssh clients send
1525 broken CHANNEL_FAILURE/SUCCESS messages since about 2004; ok djm@
Damien Miller16a73072008-12-08 09:55:25 +11001526 - markus@cvs.openbsd.org 2008/12/02 19:09:38
1527 [channels.c]
1528 s/remote_id/id/ to be more consistent with other code; ok djm@
Damien Miller7df2e402008-12-08 09:35:36 +11001529
Darren Tucker83795d62008-12-01 21:34:28 +1100153020081201
1531 - (dtucker) [contrib/cygwin/{Makefile,ssh-host-config}] Add new doc files
1532 and tweak the is-sshd-running check in ssh-host-config. Patch from
1533 vinschen at redhat com.
Darren Tucker99d11a32008-12-01 21:40:48 +11001534 - (dtucker) OpenBSD CVS Sync
1535 - markus@cvs.openbsd.org 2008/11/21 15:47:38
1536 [packet.c]
1537 packet_disconnect() on padding error, too. should reduce the success
1538 probability for the CPNI-957037 Plaintext Recovery Attack to 2^-18
1539 ok djm@
Darren Tucker23645642008-12-01 21:42:13 +11001540 - dtucker@cvs.openbsd.org 2008/11/30 11:59:26
1541 [monitor_fdpass.c]
1542 Retry sendmsg/recvmsg on EAGAIN and EINTR; ok djm@
Darren Tucker83795d62008-12-01 21:34:28 +11001543
Darren Tucker69087ea2008-11-23 14:03:19 +1100154420081123
1545 - (dtucker) [monitor_fdpass.c] Reduce diff vs OpenBSD by moving some
1546 declarations, removing an unnecessary union member and adding whitespace.
Darren Tuckerd3782b42008-11-23 19:05:53 +11001547 cmsgbuf.tmp thing spotted by des at des no, ok djm some time ago.
Darren Tucker69087ea2008-11-23 14:03:19 +11001548
Tim Rice0f4d2c02008-11-18 21:26:41 -0800154920081118
1550 - (tim) [addrmatch.c configure.ac] Some platforms do not have sin6_scope_id
1551 member of sockaddr_in6. Also reported in Bug 1491 by David Leonard. OK and
1552 feedback by djm@
1553
Darren Tuckerff4350e2008-11-11 16:31:05 +1100155420081111
1555 - (dtucker) OpenBSD CVS Sync
1556 - jmc@cvs.openbsd.org 2008/11/05 11:22:54
1557 [servconf.c]
1558 passord -> password;
1559 fixes user/5975 from Rene Maroufi
Darren Tuckere15fb092008-11-11 16:31:43 +11001560 - stevesk@cvs.openbsd.org 2008/11/07 00:42:12
1561 [ssh-keygen.c]
1562 spelling/typo in comment
Darren Tuckerb57fab62008-11-11 16:32:25 +11001563 - stevesk@cvs.openbsd.org 2008/11/07 18:50:18
1564 [nchan.c]
1565 add space to some log/debug messages for readability; ok djm@ markus@
Darren Tuckerc6d744e2008-11-11 16:33:03 +11001566 - dtucker@cvs.openbsd.org 2008/11/07 23:34:48
1567 [auth2-jpake.c]
1568 Move JPAKE define to make life easier for portable. ok djm@
Darren Tucker63917bd2008-11-11 16:33:48 +11001569 - tobias@cvs.openbsd.org 2008/11/09 12:34:47
1570 [session.c ssh.1]
1571 typo fixed (overriden -> overridden)
1572 ok espie, jmc
Darren Tucker49c31c42008-11-11 16:39:44 +11001573 - stevesk@cvs.openbsd.org 2008/11/11 02:58:09
1574 [servconf.c]
1575 USE_AFS not referenced so remove #ifdef. fixes sshd -T not printing
1576 kerberosgetafstoken. ok dtucker@
1577 (Id sync only, we still want the ifdef in portable)
Darren Tucker22662e82008-11-11 16:40:22 +11001578 - stevesk@cvs.openbsd.org 2008/11/11 03:55:11
1579 [channels.c]
1580 for sshd -T print 'permitopen any' vs. 'permitopen' for case of no
1581 permitopen's; ok and input dtucker@
Darren Tucker4a6f62d2008-11-11 16:55:25 +11001582 - djm@cvs.openbsd.org 2008/11/10 02:06:35
1583 [regress/putty-ciphers.sh]
1584 PuTTY supports AES CTR modes, so interop test against them too
Darren Tuckerff4350e2008-11-11 16:31:05 +11001585
Damien Miller7fc5c0f2008-11-05 16:12:11 +1100158620081105
1587 - OpenBSD CVS Sync
1588 - djm@cvs.openbsd.org 2008/11/03 08:59:41
1589 [servconf.c]
1590 include MaxSessions in sshd -T output; patch from imorgan AT nas.nasa.gov
Damien Miller6f66d342008-11-05 16:12:54 +11001591 - djm@cvs.openbsd.org 2008/11/04 07:58:09
1592 [auth.c]
1593 need unistd.h for close() prototype
1594 (ID sync only)
Damien Miller01ed2272008-11-05 16:20:46 +11001595 - djm@cvs.openbsd.org 2008/11/04 08:22:13
1596 [auth.h auth2.c monitor.c monitor.h monitor_wrap.c monitor_wrap.h]
1597 [readconf.c readconf.h servconf.c servconf.h ssh2.h ssh_config.5]
1598 [sshconnect2.c sshd_config.5 jpake.c jpake.h schnorr.c auth2-jpake.c]
1599 [Makefile.in]
1600 Add support for an experimental zero-knowledge password authentication
1601 method using the J-PAKE protocol described in F. Hao, P. Ryan,
1602 "Password Authenticated Key Exchange by Juggling", 16th Workshop on
1603 Security Protocols, Cambridge, April 2008.
1604
1605 This method allows password-based authentication without exposing
1606 the password to the server. Instead, the client and server exchange
1607 cryptographic proofs to demonstrate of knowledge of the password while
1608 revealing nothing useful to an attacker or compromised endpoint.
1609
1610 This is experimental, work-in-progress code and is presently
1611 compiled-time disabled (turn on -DJPAKE in Makefile.inc).
1612
1613 "just commit it. It isn't too intrusive." deraadt@
Damien Miller1a0442f2008-11-05 16:30:06 +11001614 - stevesk@cvs.openbsd.org 2008/11/04 19:18:00
1615 [readconf.c]
1616 because parse_forward() is now used to parse all forward types (DLR),
1617 and it malloc's space for host variables, we don't need to malloc
1618 here. fixes small memory leaks.
1619
1620 previously dynamic forwards were not parsed in parse_forward() and
1621 space was not malloc'd in that case.
1622
1623 ok djm@
Damien Miller0164cb82008-11-05 16:30:31 +11001624 - stevesk@cvs.openbsd.org 2008/11/05 03:23:09
1625 [clientloop.c ssh.1]
1626 add dynamic forward escape command line; ok djm@
Damien Miller7fc5c0f2008-11-05 16:12:11 +11001627
Damien Miller9f6fb562008-11-03 19:15:44 +1100162820081103
1629 - OpenBSD CVS Sync
1630 - sthen@cvs.openbsd.org 2008/07/24 23:55:30
1631 [ssh-keygen.1]
1632 Add "ssh-keygen -F -l" to synopsis (displays fingerprint from
1633 known_hosts). ok djm@
1634 - grunk@cvs.openbsd.org 2008/07/25 06:56:35
1635 [ssh_config]
1636 Add VisualHostKey to example file, ok djm@
Damien Millerc6aadd92008-11-03 19:16:20 +11001637 - grunk@cvs.openbsd.org 2008/07/25 07:05:16
1638 [key.c]
1639 In random art visualization, make sure to use the end marker only at the
1640 end. Initial diff by Dirk Loss, tweaks and ok djm@
Damien Millerc674d582008-11-03 19:16:57 +11001641 - markus@cvs.openbsd.org 2008/07/31 14:48:28
1642 [sshconnect2.c]
1643 don't allocate space for empty banners; report t8m at centrum.cz;
1644 ok deraadt
Damien Millerfa51b162008-11-03 19:17:33 +11001645 - krw@cvs.openbsd.org 2008/08/02 04:29:51
1646 [ssh_config.5]
1647 whitepsace -> whitespace. From Matthew Clarke via bugs@.
Damien Millerad793d52008-11-03 19:17:57 +11001648 - djm@cvs.openbsd.org 2008/08/21 04:09:57
1649 [session.c]
1650 allow ForceCommand internal-sftp with arguments. based on patch from
1651 michael.barabanov AT gmail.com; ok markus@
Damien Miller15bce6b2008-11-03 19:19:12 +11001652 - djm@cvs.openbsd.org 2008/09/06 12:24:13
1653 [kex.c]
1654 OpenSSL 0.9.8h supplies a real EVP_sha256 so we do not need our
1655 replacement anymore
1656 (ID sync only for portable - we still need this)
Damien Miller456e6f02008-11-03 19:20:10 +11001657 - markus@cvs.openbsd.org 2008/09/11 14:22:37
1658 [compat.c compat.h nchan.c ssh.c]
1659 only send eow and no-more-sessions requests to openssh 5 and newer;
1660 fixes interop problems with broken ssh v2 implementations; ok djm@
Damien Millerd58f5602008-11-03 19:20:49 +11001661 - millert@cvs.openbsd.org 2008/10/02 14:39:35
1662 [session.c]
1663 Convert an unchecked strdup to xstrdup. OK deraadt@
Damien Miller49b78d42008-11-03 19:21:21 +11001664 - jmc@cvs.openbsd.org 2008/10/03 13:08:12
1665 [sshd.8]
1666 do not give an example of how to chmod files: we can presume the user
1667 knows that. removes an ambiguity in the permission of authorized_keys;
1668 ok deraadt
Damien Millerc4d1b362008-11-03 19:22:09 +11001669 - deraadt@cvs.openbsd.org 2008/10/03 23:56:28
1670 [sshconnect2.c]
1671 Repair strnvis() buffersize of 4*n+1, with termination gauranteed by the
1672 function.
1673 spotted by des@freebsd, who commited an incorrect fix to the freebsd tree
1674 and (as is fairly typical) did not report the problem to us. But this fix
1675 is correct.
1676 ok djm
Damien Millere272a5b2008-11-03 19:22:37 +11001677 - djm@cvs.openbsd.org 2008/10/08 23:34:03
1678 [ssh.1 ssh.c]
1679 Add -y option to force logging via syslog rather than stderr.
1680 Useful for daemonised ssh connection (ssh -f). Patch originally from
1681 and ok'd by markus@
Damien Miller51bde602008-11-03 19:23:10 +11001682 - djm@cvs.openbsd.org 2008/10/09 03:50:54
1683 [servconf.c sshd_config.5]
1684 support setting PermitEmptyPasswords in a Match block
1685 requested in PR3891; ok dtucker@
Damien Millerc13c3ee2008-11-03 19:23:28 +11001686 - jmc@cvs.openbsd.org 2008/10/09 06:54:22
1687 [ssh.c]
1688 add -y to usage();
Damien Millerb4acb472008-11-03 19:23:45 +11001689 - stevesk@cvs.openbsd.org 2008/10/10 04:55:16
1690 [scp.c]
1691 spelling in comment; ok djm@
Damien Miller2f54ada2008-11-03 19:24:16 +11001692 - stevesk@cvs.openbsd.org 2008/10/10 05:00:12
1693 [key.c]
1694 typo in error message; ok djm@
Damien Millerece92c82008-11-03 19:25:03 +11001695 - stevesk@cvs.openbsd.org 2008/10/10 16:43:27
1696 [ssh_config.5]
1697 use 'Privileged ports can be forwarded only when logging in as root on
1698 the remote machine.' for RemoteForward just like ssh.1 -R.
1699 ok djm@ jmc@
1700 - stevesk@cvs.openbsd.org 2008/10/14 18:11:33
1701 [sshconnect.c]
1702 use #define ROQUIET here; no binary change. ok dtucker@
Damien Millera414cd32008-11-03 19:25:21 +11001703 - stevesk@cvs.openbsd.org 2008/10/17 18:36:24
1704 [ssh_config.5]
1705 correct and clarify VisualHostKey; ok jmc@
Damien Millere7261c72008-11-03 19:25:40 +11001706 - stevesk@cvs.openbsd.org 2008/10/30 19:31:16
1707 [clientloop.c sshd.c]
1708 don't need to #include "monitor_fdpass.h"
Damien Miller2b20a922008-11-03 19:26:00 +11001709 - stevesk@cvs.openbsd.org 2008/10/31 15:05:34
1710 [dispatch.c]
1711 remove unused #define DISPATCH_MIN; ok markus@
Damien Millerf7475d72008-11-03 19:26:18 +11001712 - djm@cvs.openbsd.org 2008/11/01 04:50:08
1713 [sshconnect2.c]
1714 sprinkle ARGSUSED on dispatch handlers
1715 nuke stale unusued prototype
Damien Millera0094332008-11-03 19:26:35 +11001716 - stevesk@cvs.openbsd.org 2008/11/01 06:43:33
1717 [channels.c]
1718 fix some typos in log messages; ok djm@
Damien Millerc1719f72008-11-03 19:27:07 +11001719 - sobrado@cvs.openbsd.org 2008/11/01 11:14:36
1720 [ssh-keyscan.1 ssh-keyscan.c]
1721 the ellipsis is not an optional argument; while here, improve spacing.
Damien Millera699d952008-11-03 19:27:34 +11001722 - stevesk@cvs.openbsd.org 2008/11/01 17:40:33
1723 [clientloop.c readconf.c readconf.h ssh.c]
1724 merge dynamic forward parsing into parse_forward();
1725 'i think this is OK' djm@
Damien Miller660d7da2008-11-03 19:27:52 +11001726 - stevesk@cvs.openbsd.org 2008/11/02 00:16:16
1727 [ttymodes.c]
1728 protocol 2 tty modes support is now 7.5 years old so remove these
1729 debug3()s; ok deraadt@
Damien Millera279d252008-11-03 19:28:07 +11001730 - stevesk@cvs.openbsd.org 2008/11/03 01:07:02
1731 [readconf.c]
1732 remove valueless comment
Damien Millerf4b39532008-11-03 19:28:21 +11001733 - stevesk@cvs.openbsd.org 2008/11/03 02:44:41
1734 [readconf.c]
1735 fix comment
Damien Miller85dec732008-11-03 20:16:01 +11001736 - (djm) [contrib/caldera/ssh-host-keygen contrib/suse/rc.sshd]
1737 Make example scripts generate keys with default sizes rather than fixed,
1738 non-default 1024 bits; patch from imorgan AT nas.nasa.gov
Damien Miller250071f2008-11-03 20:18:12 +11001739 - (djm) [contrib/sshd.pam.generic contrib/caldera/sshd.pam]
1740 [contrib/redhat/sshd.pam] Move pam_nologin to account group from
1741 incorrect auth group in example files;
1742 patch from imorgan AT nas.nasa.gov
Damien Miller9f6fb562008-11-03 19:15:44 +11001743
Darren Tuckerc570ff72008-09-06 18:20:57 +1000174420080906
1745 - (dtucker) [config.guess config.sub] Update to latest versions from
1746 http://git.savannah.gnu.org/gitweb/ (2008-04-14 and 2008-06-16
1747 respectively).
1748
Darren Tucker661f63b2008-08-30 07:32:37 +1000174920080830
1750 - (dtucker) [openbsd-compat/bsd-poll.c] correctly check for number of FDs
1751 larger than FD_SETSIZE (OpenSSH only ever uses poll with one fd). Patch
1752 from Nicholas Marriott.
1753
Damien Milleraa5f4332008-07-21 18:20:39 +1000175420080721
1755 - (djm) OpenBSD CVS Sync
Damien Miller6ef430d2008-07-23 17:40:04 +10001756 - djm@cvs.openbsd.org 2008/07/23 07:36:55
1757 [servconf.c]
1758 do not try to print options that have been compile-time disabled
1759 in config test mode (sshd -T); report from nix-corp AT esperi.org.uk
1760 ok dtucker@
Damien Miller212f0b02008-07-23 17:42:29 +10001761 - (djm) [servconf.c] Print UsePAM option in config test mode (when it
1762 has been compiled in); report from nix-corp AT esperi.org.uk
1763 ok dtucker@
Damien Miller6ef430d2008-07-23 17:40:04 +10001764
176520080721
1766 - (djm) OpenBSD CVS Sync
Damien Milleraa5f4332008-07-21 18:20:39 +10001767 - jmc@cvs.openbsd.org 2008/07/18 22:51:01
1768 [sftp-server.8]
1769 no need for .Pp before or after .Sh;
Damien Milleraaae43e2008-07-21 18:21:05 +10001770 - djm@cvs.openbsd.org 2008/07/21 08:19:07
1771 [version.h]
1772 openssh-5.1
Damien Miller1f8909c2008-07-21 18:21:52 +10001773 - (djm) [README contrib/caldera/openssh.spec contrib/redhat/openssh.spec]
1774 [contrib/suse/openssh.spec] Update version number in README and RPM specs
Damien Miller8f42e9b2008-07-21 18:22:25 +10001775 - (djm) Release OpenSSH-5.1
Damien Milleraa5f4332008-07-21 18:20:39 +10001776
Damien Miller7ba0ca72008-07-17 18:57:06 +1000177720080717
1778 - (djm) OpenBSD CVS Sync
1779 - djm@cvs.openbsd.org 2008/07/17 08:48:00
1780 [sshconnect2.c]
1781 strnvis preauth banner; pointed out by mpf@ ok markus@
Damien Millera1d03a52008-07-17 18:57:19 +10001782 - djm@cvs.openbsd.org 2008/07/17 08:51:07
1783 [auth2-hostbased.c]
1784 strip trailing '.' from hostname when HostbasedUsesNameFromPacketOnly=yes
1785 report and patch from res AT qoxp.net (bz#1200); ok markus@
Darren Tucker9a3f2b42008-07-17 19:03:49 +10001786 - (dtucker) [openbsd-compat/bsd-cygwin_util.c] Remove long-unneeded compat
1787 code, replace with equivalent cygwin library call. Patch from vinschen
Damien Miller2e28d862008-07-17 19:15:43 +10001788 at redhat.com, ok djm@.
1789 - (djm) [sshconnect2.c] vis.h isn't available everywhere
Damien Miller7ba0ca72008-07-17 18:57:06 +10001790
Damien Miller94717b02008-07-16 21:17:23 +1000179120080716
1792 - OpenBSD CVS Sync
1793 - djm@cvs.openbsd.org 2008/07/15 02:23:14
1794 [sftp.1]
1795 number of pipelined requests is now 64;
1796 prodded by Iain.Morgan AT nasa.gov
Damien Millerb9d3bee2008-07-16 22:40:52 +10001797 - djm@cvs.openbsd.org 2008/07/16 11:51:14
1798 [clientloop.c]
1799 rename variable first_gc -> last_gc (since it is actually the last
1800 in the list).
Damien Miller6ef17492008-07-16 22:42:06 +10001801 - djm@cvs.openbsd.org 2008/07/16 11:52:19
1802 [channels.c]
1803 this loop index should be automatic, not static
Damien Miller94717b02008-07-16 21:17:23 +10001804
Damien Miller81dec052008-07-14 11:28:29 +1000180520080714
1806 - (djm) OpenBSD CVS Sync
1807 - sthen@cvs.openbsd.org 2008/07/13 21:22:52
1808 [ssh-keygen.c]
1809 Change "ssh-keygen -F [host] -l" to not display random art unless
1810 -v is also specified, making it consistent with the manual and other
1811 uses of -l.
1812 ok grunk@
Damien Miller163886f2008-07-14 11:28:58 +10001813 - djm@cvs.openbsd.org 2008/07/13 22:13:07
1814 [channels.c]
1815 use struct sockaddr_storage instead of struct sockaddr for accept(2)
1816 address argument. from visibilis AT yahoo.com in bz#1485; ok markus@
Damien Miller7f980d12008-07-14 11:29:24 +10001817 - djm@cvs.openbsd.org 2008/07/13 22:16:03
1818 [sftp.c]
1819 increase number of piplelined requests so they properly fill the
1820 (recently increased) channel window. prompted by rapier AT psc.edu;
1821 ok markus@
Damien Miller276571c2008-07-14 12:09:57 +10001822 - djm@cvs.openbsd.org 2008/07/14 01:55:56
1823 [sftp-server.8]
1824 mention requirement for /dev/log inside chroot when using sftp-server
1825 with ChrootDirectory
Damien Millerce02e5e2008-07-14 12:02:24 +10001826 - (djm) [openbsd-compat/bindresvport.c] Rename variables s/sin/in/ to
1827 avoid clash with sin(3) function; reported by
1828 cristian.ionescu-idbohrn AT axis.com
Damien Miller639ce592008-07-14 12:03:27 +10001829 - (djm) [openbsd-compat/rresvport.c] Add unistd.h for missing close()
1830 prototype; reported by cristian.ionescu-idbohrn AT axis.com
Damien Miller36d70562008-07-14 12:04:43 +10001831 - (djm) [umac.c] Rename variable s/buffer_ptr/bufp/ to avoid clash;
1832 reported by cristian.ionescu-idbohrn AT axis.com
Damien Miller1fc231c2008-07-14 12:12:52 +10001833 - (djm) [contrib/cygwin/Makefile contrib/cygwin/ssh-host-config]
1834 [contrib/cygwin/ssh-user-config contrib/cygwin/sshd-inetd]
1835 Revamped and simplified Cygwin ssh-host-config script that uses
1836 unified csih configuration tool. Requires recent Cygwin.
1837 Patch from vinschen AT redhat.com
Damien Miller81dec052008-07-14 11:28:29 +10001838
Damien Miller2bcb8662008-07-12 17:12:29 +1000183920080712
1840 - (djm) OpenBSD CVS Sync
1841 - djm@cvs.openbsd.org 2008/07/12 04:52:50
1842 [channels.c]
1843 unbreak; move clearing of cctx struct to before first use
1844 reported by dkrause@
Damien Millera034baf2008-07-12 17:12:49 +10001845 - djm@cvs.openbsd.org 2008/07/12 05:33:41
1846 [scp.1]
1847 better description for -i flag:
1848 s/RSA authentication/public key authentication/
Damien Millerc4657ef2008-07-14 21:37:36 +10001849 - (djm) [openbsd-compat/fake-rfc2553.c openbsd-compat/fake-rfc2553.h]
1850 return EAI_FAMILY when trying to lookup unsupported address family;
1851 from vinschen AT redhat.com
Damien Miller2bcb8662008-07-12 17:12:29 +10001852
Damien Miller2f7faf12008-07-11 17:34:35 +1000185320080711
1854 - (djm) OpenBSD CVS Sync
1855 - stevesk@cvs.openbsd.org 2008/07/07 00:31:41
1856 [ttymodes.c]
1857 we don't need arg after the debug3() was removed. from lint.
1858 ok djm@
Damien Miller87dd5f22008-07-11 17:35:09 +10001859 - stevesk@cvs.openbsd.org 2008/07/07 23:32:51
1860 [key.c]
1861 /*NOTREACHED*/ for lint warning:
1862 warning: function key_equal falls off bottom without returning value
1863 ok djm@
Damien Millerdda5fff2008-07-11 17:35:37 +10001864 - markus@cvs.openbsd.org 2008/07/10 18:05:58
1865 [channels.c]
1866 missing bzero; from mickey; ok djm@
Damien Millerb61f3fc2008-07-11 17:36:48 +10001867 - markus@cvs.openbsd.org 2008/07/10 18:08:11
1868 [clientloop.c monitor.c monitor_wrap.c packet.c packet.h sshd.c]
1869 sync v1 and v2 traffic accounting; add it to sshd, too;
1870 ok djm@, dtucker@
Damien Miller2f7faf12008-07-11 17:34:35 +10001871
Damien Millerd9648ee2008-07-09 00:21:12 +1000187220080709
1873 - (djm) [Makefile.in] Print "all tests passed" when all regress tests pass
Damien Miller773a7b92008-07-09 20:54:05 +10001874 - (djm) [auth1.c] Fix format string vulnerability in protocol 1 PAM
1875 account check failure path. The vulnerable format buffer is supplied
1876 from PAM and should not contain attacker-supplied data.
Damien Miller7acf5502008-07-09 20:54:37 +10001877 - (djm) [auth.c] Missing unistd.h for close()
Damien Miller73193b32008-07-09 21:07:19 +10001878 - (djm) [configure.ac] Add -Wformat-security to CFLAGS for gcc 3.x and 4.x
Damien Millerd9648ee2008-07-09 00:21:12 +10001879
Damien Miller22989f12008-07-05 08:59:43 +1000188020080705
1881 - (djm) [auth.c] Fixed test for locked account on HP/UX with shadowed
1882 passwords disabled. bz#1083 report & patch from senthilkumar_sen AT
1883 hotpop.com, w/ dtucker@
Damien Miller20d16942008-07-05 09:36:58 +10001884 - (djm) [atomicio.c configure.ac] Disable poll() fallback in atomiciov for
1885 Tru64. readv doesn't seem to be a comparable object there.
1886 bz#1386, patch from dtucker@ ok me
Damien Miller42743cb2008-07-05 09:50:23 +10001887 - (djm) [Makefile.in] Pass though pass to conch for interop tests
Damien Millerff2e4922008-07-05 09:52:03 +10001888 - (djm) [configure.ac] unbreak: remove extra closing brace
Damien Millerd874fa52008-07-05 09:40:56 +10001889 - (djm) OpenBSD CVS Sync
1890 - djm@cvs.openbsd.org 2008/07/04 23:08:25
1891 [packet.c]
1892 handle EINTR in packet_write_poll()l ok dtucker@
Damien Miller0b4d48b2008-07-05 09:44:53 +10001893 - djm@cvs.openbsd.org 2008/07/04 23:30:16
1894 [auth1.c auth2.c]
1895 Make protocol 1 MaxAuthTries logic match protocol 2's.
1896 Do not treat the first protocol 2 authentication attempt as
1897 a failure IFF it is for method "none".
1898 Makes MaxAuthTries' user-visible behaviour identical for
1899 protocol 1 vs 2.
1900 ok dtucker@
Damien Millerc9c96f22008-07-05 15:17:48 +10001901 - djm@cvs.openbsd.org 2008/07/05 05:16:01
1902 [PROTOCOL]
1903 grammar
Damien Miller22989f12008-07-05 08:59:43 +10001904
Darren Tucker7c99b1c2008-07-04 12:53:23 +1000190520080704
1906 - (dtucker) OpenBSD CVS Sync
1907 - djm@cvs.openbsd.org 2008/07/02 13:30:34
1908 [auth2.c]
1909 really really remove the freebie "none" auth try for protocol 2
Darren Tucker9a2a6092008-07-04 12:53:50 +10001910 - djm@cvs.openbsd.org 2008/07/02 13:47:39
1911 [ssh.1 ssh.c]
1912 When forking after authentication ("ssh -f") with ExitOnForwardFailure
1913 enabled, delay the fork until after replies for any -R forwards have
1914 been seen. Allows for robust detection of -R forward failure when
1915 using -f (similar to bz#92); ok dtucker@
Darren Tuckerf5cafb02008-07-04 12:54:25 +10001916 - otto@cvs.openbsd.org 2008/07/03 21:46:58
1917 [auth2-pubkey.c]
1918 avoid nasty double free; ok dtucker@ djm@
Darren Tuckerb03fd022008-07-04 13:51:12 +10001919 - djm@cvs.openbsd.org 2008/07/04 03:44:59
1920 [servconf.c groupaccess.h groupaccess.c]
1921 support negation of groups in "Match group" block (bz#1315); ok dtucker@
Darren Tucker2784f1f2008-07-04 13:51:45 +10001922 - dtucker@cvs.openbsd.org 2008/07/04 03:47:02
1923 [monitor.c]
1924 Make debug a little clearer. ok djm@
Darren Tucker8c7a14e2008-07-04 17:08:58 +10001925 - djm@cvs.openbsd.org 2008/06/30 08:07:34
1926 [regress/key-options.sh]
1927 shell portability: use "=" instead of "==" in test(1) expressions,
1928 double-quote string with backslash escaped /
Darren Tucker5d6d70a2008-07-04 17:10:30 +10001929 - djm@cvs.openbsd.org 2008/06/30 10:31:11
1930 [regress/{putty-transfer,putty-kex,putty-ciphers}.sh]
1931 remove "set -e" left over from debugging
Darren Tuckerb01bac12008-07-04 17:11:30 +10001932 - djm@cvs.openbsd.org 2008/06/30 10:43:03
1933 [regress/conch-ciphers.sh]
1934 explicitly disable conch options that could interfere with the test
Darren Tuckerf7fa7062008-07-04 14:10:19 +10001935 - (dtucker) [sftp-server.c] Bug #1447: fall back to racy rename if link
1936 returns EXDEV. Patch from Mike Garrison, ok djm@
Damien Millerd8968ad2008-07-04 23:10:49 +10001937 - (djm) [atomicio.c channels.c clientloop.c defines.h includes.h]
1938 [packet.c scp.c serverloop.c sftp-client.c ssh-agent.c ssh-keyscan.c]
1939 [sshd.c] Explicitly handle EWOULDBLOCK wherever we handle EAGAIN, on
1940 some platforms (HP nonstop) it is a distinct errno;
1941 bz#1467 reported by sconeu AT yahoo.com; ok dtucker@
1942
Darren Tucker00f00f02008-07-02 22:31:31 +1000194320080702
1944 - (dtucker) OpenBSD CVS Sync
1945 - djm@cvs.openbsd.org 2008/06/30 08:05:59
1946 [PROTOCOL.agent]
1947 typo: s/constraint_date/constraint_data/
Darren Tucker8810dd42008-07-02 22:32:14 +10001948 - djm@cvs.openbsd.org 2008/06/30 12:15:39
1949 [serverloop.c]
1950 only pass channel requests on session channels through to the session
1951 channel handler, avoiding spurious log messages; ok! markus@
Darren Tucker8748b962008-07-02 22:32:43 +10001952 - djm@cvs.openbsd.org 2008/06/30 12:16:02
1953 [nchan.c]
1954 only send eow@openssh.com notifications for session channels; ok! markus@
Darren Tucker1f781b12008-07-02 22:33:16 +10001955 - djm@cvs.openbsd.org 2008/06/30 12:18:34
1956 [PROTOCOL]
1957 clarify that eow@openssh.com is only sent on session channels
Darren Tucker068e01f2008-07-02 22:33:55 +10001958 - dtucker@cvs.openbsd.org 2008/07/01 07:20:52
1959 [sshconnect.c]
1960 Check ExitOnForwardFailure if forwardings are disabled due to a failed
1961 host key check. ok djm@
Darren Tuckerd7bdc0c2008-07-02 22:34:30 +10001962 - dtucker@cvs.openbsd.org 2008/07/01 07:24:22
1963 [sshconnect.c sshd.c]
1964 Send CR LF during protocol banner exchanges, but only for Protocol 2 only,
1965 in order to comply with RFC 4253. bz #1443, ok djm@
Darren Tuckerf2e21de2008-07-02 22:35:00 +10001966 - stevesk@cvs.openbsd.org 2008/07/01 23:12:47
1967 [PROTOCOL.agent]
1968 fix some typos; ok djm@
Darren Tucker7499b0c2008-07-02 22:35:43 +10001969 - djm@cvs.openbsd.org 2008/07/02 02:24:18
1970 [sshd_config sshd_config.5 sshd.8 servconf.c]
1971 increase default size of ssh protocol 1 ephemeral key from 768 to 1024
1972 bits; prodded by & ok dtucker@ ok deraadt@
Darren Tucker33c787f2008-07-02 22:37:30 +10001973 - dtucker@cvs.openbsd.org 2008/07/02 12:03:51
1974 [auth-rsa.c auth.c auth2-pubkey.c auth.h]
1975 Merge duplicate host key file checks, based in part on a patch from Rob
1976 Holland via bz #1348 . Also checks for non-regular files during protocol
1977 1 RSA auth. ok djm@
Darren Tucker4230a5d2008-07-02 22:56:09 +10001978 - djm@cvs.openbsd.org 2008/07/02 12:36:39
1979 [auth2-none.c auth2.c]
1980 Make protocol 2 MaxAuthTries behaviour a little more sensible:
1981 Check whether client has exceeded MaxAuthTries before running
1982 an authentication method and skip it if they have, previously it
1983 would always allow one try (for "none" auth).
1984 Preincrement failure count before post-auth test - previously this
1985 checked and postincremented, also to allow one "none" try.
1986 Together, these two changes always count the "none" auth method
1987 which could be skipped by a malicious client (e.g. an SSH worm)
1988 to get an extra attempt at a real auth method. They also make
1989 MaxAuthTries=0 a useful way to block users entirely (esp. in a
1990 sshd_config Match block).
1991 Also, move sending of any preauth banner from "none" auth method
1992 to the first call to input_userauth_request(), so worms that skip
1993 the "none" method get to see it too.
Darren Tucker00f00f02008-07-02 22:31:31 +10001994
Damien Miller2e80cf22008-06-30 08:06:25 +1000199520080630
1996 - (djm) OpenBSD CVS Sync
1997 - dtucker@cvs.openbsd.org 2008/06/10 23:13:43
1998 [regress/Makefile regress/key-options.sh]
1999 Add regress test for key options. ok djm@
Damien Millerd9bfce82008-06-30 08:06:51 +10002000 - dtucker@cvs.openbsd.org 2008/06/11 23:11:40
Damien Miller4268a132008-06-30 08:07:56 +10002001 [regress/Makefile]
Damien Millerd9bfce82008-06-30 08:06:51 +10002002 Don't run cipher-speed test by default; mistakenly enabled by me
Damien Miller4268a132008-06-30 08:07:56 +10002003 - djm@cvs.openbsd.org 2008/06/28 13:57:25
2004 [regress/Makefile regress/test-exec.sh regress/conch-ciphers.sh]
2005 very basic regress test against Twisted Conch in "make interop"
2006 target (conch is available in ports/devel/py-twisted/conch);
2007 ok markus@
Damien Millera766cea2008-06-30 08:12:37 +10002008 - (djm) [regress/Makefile] search for conch by path, like we do putty
Damien Miller2e80cf22008-06-30 08:06:25 +10002009
Damien Millerf184bcf2008-06-29 22:45:13 +1000201020080629
2011 - (djm) OpenBSD CVS Sync
2012 - martynas@cvs.openbsd.org 2008/06/21 07:46:46
2013 [sftp.c]
2014 use optopt to get invalid flag, instead of return value of getopt,
2015 which is always '?'; ok djm@
Damien Miller007132a2008-06-29 22:45:37 +10002016 - otto@cvs.openbsd.org 2008/06/25 11:13:43
2017 [key.c]
2018 add key length to visual fingerprint; zap magical constants;
2019 ok grunk@ djm@
Damien Miller9e720282008-06-29 22:46:35 +10002020 - djm@cvs.openbsd.org 2008/06/26 06:10:09
2021 [sftp-client.c sftp-server.c]
2022 allow the sftp chmod(2)-equivalent operation to set set[ug]id/sticky
2023 bits. Note that this only affects explicit setting of modes (e.g. via
2024 sftp(1)'s chmod command) and not file transfers. (bz#1310)
2025 ok deraadt@ at c2k8
Damien Miller2e9cf492008-06-29 22:47:04 +10002026 - djm@cvs.openbsd.org 2008/06/26 09:19:40
2027 [dh.c dh.h moduli.c]
2028 when loading moduli from /etc/moduli in sshd(8), check that they
2029 are of the expected "safe prime" structure and have had
2030 appropriate primality tests performed;
2031 feedback and ok dtucker@
Damien Miller10288242008-06-30 00:04:03 +10002032 - grunk@cvs.openbsd.org 2008/06/26 11:46:31
2033 [readconf.c readconf.h ssh.1 ssh_config.5 sshconnect.c]
2034 Move SSH Fingerprint Visualization away from sharing the config option
2035 CheckHostIP to an own config option named VisualHostKey.
2036 While there, fix the behaviour that ssh would draw a random art picture
2037 on every newly seen host even when the option was not enabled.
2038 prodded by deraadt@, discussions,
2039 help and ok markus@ djm@ dtucker@
Damien Miller86399202008-06-30 00:04:31 +10002040 - jmc@cvs.openbsd.org 2008/06/26 21:11:46
2041 [ssh.1]
2042 add VisualHostKey to the list of options listed in -o;
Damien Millerbd45afb2008-06-30 00:04:57 +10002043 - djm@cvs.openbsd.org 2008/06/28 07:25:07
2044 [PROTOCOL]
2045 spelling fixes
Damien Miller1cfadab2008-06-30 00:05:21 +10002046 - djm@cvs.openbsd.org 2008/06/28 13:58:23
2047 [ssh-agent.c]
2048 refuse to add a key that has unknown constraints specified;
2049 ok markus
Damien Miller471db5c2008-06-30 00:05:48 +10002050 - djm@cvs.openbsd.org 2008/06/28 14:05:15
2051 [ssh-agent.c]
2052 reset global compat flag after processing a protocol 2 signature
2053 request with the legacy DSA encoding flag set; ok markus
Damien Miller1e18beb2008-06-30 00:07:00 +10002054 - djm@cvs.openbsd.org 2008/06/28 14:08:30
2055 [PROTOCOL PROTOCOL.agent]
2056 document the protocol used by ssh-agent; "looks ok" markus@
Damien Millerf184bcf2008-06-29 22:45:13 +10002057
Damien Miller493f0322008-06-28 16:01:35 +1000205820080628
2059 - (djm) [RFC.nroff contrib/cygwin/Makefile contrib/suse/openssh.spec]
2060 RFC.nroff lacks a license, remove it (it is long gone in OpenBSD).
2061
Damien Miller60dcc622008-06-26 15:59:32 +1000206220080626
2063 - (djm) [Makefile.in moduli.5] Include moduli(5) manpage from OpenBSD.
2064 (bz#1372)
Damien Millerf299ff82008-06-26 16:01:56 +10002065 - (djm) [ contrib/caldera/openssh.spec contrib/redhat/openssh.spec]
2066 [contrib/suse/openssh.spec] Include moduli.5 in RPM spec files.
Damien Miller60dcc622008-06-26 15:59:32 +10002067
Darren Tuckered3cdc02008-06-16 23:29:18 +1000206820080616
2069 - (dtucker) OpenBSD CVS Sync
2070 - dtucker@cvs.openbsd.org 2008/06/16 13:22:53
2071 [session.c channels.c]
2072 Rename the isatty argument to is_tty so we don't shadow
2073 isatty(3). ok markus@
Darren Tucker1a48aec2008-06-16 23:35:56 +10002074 - (dtucker) [channels.c] isatty -> is_tty here too.
Darren Tuckered3cdc02008-06-16 23:29:18 +10002075
Darren Tucker330c93f2008-06-16 02:27:48 +1000207620080615
2077 - (dtucker) [configure.ac] Enable -fno-builtin-memset when using gcc.
Damien Miller2a628472008-06-16 07:50:24 +10002078 - OpenBSD CVS Sync
2079 - dtucker@cvs.openbsd.org 2008/06/14 15:49:48
2080 [sshd.c]
2081 wrap long line at 80 chars
Damien Miller6ca16c62008-06-16 07:50:58 +10002082 - dtucker@cvs.openbsd.org 2008/06/14 17:07:11
2083 [sshd.c]
2084 ensure default umask disallows at least group and world write; ok djm@
Damien Miller6051c942008-06-16 07:53:16 +10002085 - djm@cvs.openbsd.org 2008/06/14 18:33:43
2086 [session.c]
2087 suppress the warning message from chdir(homedir) failures
2088 when chrooted (bz#1461); ok dtucker
Damien Millerc7ce0da2008-06-16 07:55:06 +10002089 - dtucker@cvs.openbsd.org 2008/06/14 19:42:10
2090 [scp.1]
2091 Mention that scp follows symlinks during -r. bz #1466,
2092 from nectar at apple
Damien Millerc62a5af2008-06-16 07:55:46 +10002093 - dtucker@cvs.openbsd.org 2008/06/15 16:55:38
2094 [sshd_config.5]
2095 MaxSessions is allowed in a Match block too
Damien Miller307c1d12008-06-16 07:56:20 +10002096 - dtucker@cvs.openbsd.org 2008/06/15 16:58:40
2097 [servconf.c sshd_config.5]
2098 Allow MaxAuthTries within a Match block. ok djm@
Damien Millerd310d512008-06-16 07:59:23 +10002099 - djm@cvs.openbsd.org 2008/06/15 20:06:26
2100 [channels.c channels.h session.c]
2101 don't call isatty() on a pty master, instead pass a flag down to
2102 channel_set_fds() indicating that te fds refer to a tty. Fixes a
2103 hang on exit on Solaris (bz#1463) in portable but is actually
2104 a generic bug; ok dtucker deraadt markus
Darren Tucker330c93f2008-06-16 02:27:48 +10002105
Damien Miller8b7ab962008-06-15 10:55:34 +1000210620080614
2107 - (djm) [openbsd-compat/sigact.c] Avoid NULL derefs in ancient sigaction
2108 replacement code; patch from ighighi AT gmail.com in bz#1240;
2109 ok dtucker
2110
Darren Tucker99bb7612008-06-13 22:02:50 +1000211120080613
2112 - (dtucker) OpenBSD CVS Sync
2113 - deraadt@cvs.openbsd.org 2008/06/13 09:44:36
2114 [packet.c]
2115 compile on older gcc; no decl after code
Darren Tuckerf2c16d32008-06-14 08:59:49 +10002116 - dtucker@cvs.openbsd.org 2008/06/13 13:56:59
2117 [monitor.c]
2118 Clear key options in the monitor on failed authentication, prevents
2119 applying additional restrictions to non-pubkey authentications in
2120 the case where pubkey fails but another method subsequently succeeds.
2121 bz #1472, found by Colin Watson, ok markus@ djm@
Darren Tuckerd9526a52008-06-14 09:01:24 +10002122 - dtucker@cvs.openbsd.org 2008/06/13 14:18:51
2123 [auth2-pubkey.c auth-rhosts.c]
2124 Include unistd.h for close(), prevents warnings in -portable
Darren Tucker47e713b2008-06-14 09:01:54 +10002125 - dtucker@cvs.openbsd.org 2008/06/13 17:21:20
2126 [mux.c]
2127 Friendlier error messages for mux fallback. ok djm@
Darren Tucker03ccc9b2008-06-14 09:02:25 +10002128 - dtucker@cvs.openbsd.org 2008/06/13 18:55:22
2129 [scp.c]
2130 Prevent -Wsign-compare warnings on LP64 systems. bz #1192, ok deraadt@
Darren Tuckerf6bffb12008-06-14 09:04:26 +10002131 - grunk@cvs.openbsd.org 2008/06/13 20:13:26
2132 [ssh.1]
2133 Explain the use of SSH fpr visualization using random art, and cite the
2134 original scientific paper inspiring that technique.
2135 Much help with English and nroff by jmc@, thanks.
Darren Tucker30fd49e2008-06-14 09:14:46 +10002136 - (dtucker) [configure.ac] Bug #1276: avoid linking against libgssapi, which
2137 despite its name doesn't seem to implement all of GSSAPI. Patch from
2138 Jan Engelhardt, sanity checked by Simon Wilkinson.
Darren Tucker99bb7612008-06-13 22:02:50 +10002139
Darren Tucker11996732008-06-13 04:32:00 +1000214020080612
2141 - (dtucker) OpenBSD CVS Sync
2142 - jmc@cvs.openbsd.org 2008/06/11 07:30:37
2143 [sshd.8]
2144 kill trailing whitespace;
Darren Tucker9c16ac92008-06-13 04:40:35 +10002145 - grunk@cvs.openbsd.org 2008/06/11 21:01:35
2146 [ssh_config.5 key.h readconf.c readconf.h ssh-keygen.1 ssh-keygen.c key.c
2147 sshconnect.c]
2148 Introduce SSH Fingerprint ASCII Visualization, a technique inspired by the
2149 graphical hash visualization schemes known as "random art", and by
2150 Dan Kaminsky's musings on the subject during a BlackOp talk at the
2151 23C3 in Berlin.
2152 Scientific publication (original paper):
2153 "Hash Visualization: a New Technique to improve Real-World Security",
2154 Perrig A. and Song D., 1999, International Workshop on Cryptographic
2155 Techniques and E-Commerce (CrypTEC '99)
2156 http://sparrow.ece.cmu.edu/~adrian/projects/validation/validation.pdf
2157 The algorithm used here is a worm crawling over a discrete plane,
2158 leaving a trace (augmenting the field) everywhere it goes.
2159 Movement is taken from dgst_raw 2bit-wise. Bumping into walls
2160 makes the respective movement vector be ignored for this turn,
2161 thus switching to the other color of the chessboard.
2162 Graphs are not unambiguous for now, because circles in graphs can be
2163 walked in either direction.
2164 discussions with several people,
2165 help, corrections and ok markus@ djm@
Darren Tuckera376a322008-06-13 04:42:14 +10002166 - grunk@cvs.openbsd.org 2008/06/11 21:38:25
2167 [ssh-keygen.c]
2168 ssh-keygen -lv -f /etc/ssh/ssh_host_rsa_key.pub
2169 would not display you the random art as intended, spotted by canacar@
Darren Tucker35c45532008-06-13 04:43:15 +10002170 - grunk@cvs.openbsd.org 2008/06/11 22:20:46
2171 [ssh-keygen.c ssh-keygen.1]
2172 ssh-keygen would write fingerprints to STDOUT, and random art to STDERR,
2173 that is not how it was envisioned.
2174 Also correct manpage saying that -v is needed along with -l for it to work.
2175 spotted by naddy@
Darren Tucker014d76f2008-06-13 04:43:51 +10002176 - otto@cvs.openbsd.org 2008/06/11 23:02:22
2177 [key.c]
2178 simpler way of computing the augmentations; ok grunk@
Darren Tuckerdcc1ab52008-06-13 04:44:25 +10002179 - grunk@cvs.openbsd.org 2008/06/11 23:03:56
2180 [ssh_config.5]
2181 CheckHostIP set to ``fingerprint'' will display both hex and random art
2182 spotted by naddy@
Darren Tuckerd32b28a2008-06-13 04:45:50 +10002183 - grunk@cvs.openbsd.org 2008/06/11 23:51:57
2184 [key.c]
2185 #define statements that are not atoms need braces around them, else they
2186 will cause trouble in some cases.
2187 Also do a computation of -1 once, and not in a loop several times.
2188 spotted by otto@
Darren Tucker78913e02008-06-13 04:47:34 +10002189 - dtucker@cvs.openbsd.org 2008/06/12 00:03:49
2190 [dns.c canohost.c sshconnect.c]
2191 Do not pass "0" strings as ports to getaddrinfo because the lookups
2192 can slow things down and we never use the service info anyway. bz
2193 #859, patch from YOSHIFUJI Hideaki and John Devitofranceschi. ok
2194 deraadt@ djm@
2195 djm belives that the reason for the "0" strings is to ensure that
2196 it's not possible to call getaddrinfo with both host and port being
2197 NULL. In the case of canohost.c host is a local array. In the
2198 case of sshconnect.c, it's checked for null immediately before use.
2199 In dns.c it ultimately comes from ssh.c:main() and is guaranteed to
2200 be non-null but it's not obvious, so I added a warning message in
2201 case it is ever passed a null.
2202 - grunk@cvs.openbsd.org 2008/06/12 00:13:55
2203 [sshconnect.c]
2204 Make ssh print the random art also when ssh'ing to a host using IP only.
2205 spotted by naddy@, ok and help djm@ dtucker@
Darren Tucker267e28b2008-06-13 04:48:11 +10002206 - otto@cvs.openbsd.org 2008/06/12 00:13:13
2207 [key.c]
2208 use an odd number of rows and columns and a separate start marker, looks
2209 better; ok grunk@
Darren Tucker2fb66ca2008-06-13 04:49:33 +10002210 - djm@cvs.openbsd.org 2008/06/12 03:40:52
2211 [clientloop.h mux.c channels.c clientloop.c channels.h]
2212 Enable ~ escapes for multiplex slave sessions; give each channel
2213 its own escape state and hook the escape filters up to muxed
2214 channels. bz #1331
2215 Mux slaves do not currently support the ~^Z and ~& escapes.
2216 NB. this change cranks the mux protocol version, so a new ssh
2217 mux client will not be able to connect to a running old ssh
2218 mux master.
2219 ok dtucker@
Darren Tucker9f407c42008-06-13 04:50:27 +10002220 - djm@cvs.openbsd.org 2008/06/12 04:06:00
2221 [clientloop.h ssh.c clientloop.c]
2222 maintain an ordered queue of outstanding global requests that we
2223 expect replies to, similar to the per-channel confirmation queue.
2224 Use this queue to verify success or failure for remote forward
2225 establishment in a race free way.
2226 ok dtucker@
Darren Tucker4d5cd332008-06-13 04:51:14 +10002227 - djm@cvs.openbsd.org 2008/06/12 04:17:47
2228 [clientloop.c]
2229 thall shalt not code past the eightieth column
Darren Tuckerd6173c02008-06-13 04:52:53 +10002230 - djm@cvs.openbsd.org 2008/06/12 04:24:06
2231 [ssh.c]
2232 thal shalt not code past the eightieth column
Darren Tuckere5d98292008-06-13 04:53:27 +10002233 - djm@cvs.openbsd.org 2008/06/12 05:15:41
2234 [PROTOCOL]
2235 document tun@openssh.com forwarding method
Darren Tuckerba69c7a2008-06-13 04:54:05 +10002236 - djm@cvs.openbsd.org 2008/06/12 05:32:30
2237 [mux.c]
2238 some more TODO for me
Darren Tucker4b3b9772008-06-13 04:55:10 +10002239 - grunk@cvs.openbsd.org 2008/06/12 05:42:46
2240 [key.c]
2241 supply the key type (rsa1, rsa, dsa) as a caption in the frame of the
2242 random art. while there, stress the fact that the field base should at
2243 least be 8 characters for the pictures to make sense.
2244 comment and ok djm@
2245 - grunk@cvs.openbsd.org 2008/06/12 06:32:59
2246 [key.c]
2247 We already mark the start of the worm, now also mark the end of the worm
2248 in our random art drawings.
2249 ok djm@
Darren Tucker84c56f52008-06-13 04:55:46 +10002250 - djm@cvs.openbsd.org 2008/06/12 15:19:17
2251 [clientloop.h channels.h clientloop.c channels.c mux.c]
2252 The multiplexing escape char handler commit last night introduced a
2253 small memory leak per session; plug it.
Darren Tuckerf6b01b72008-06-13 04:56:37 +10002254 - dtucker@cvs.openbsd.org 2008/06/12 16:35:31
2255 [ssh_config.5 ssh.c]
2256 keyword expansion for localcommand. ok djm@
Darren Tuckerf09e8252008-06-13 05:18:03 +10002257 - jmc@cvs.openbsd.org 2008/06/12 19:10:09
2258 [ssh_config.5 ssh-keygen.1]
2259 tweak the ascii art text; ok grunk
Darren Tucker3fc464e2008-06-13 06:42:45 +10002260 - dtucker@cvs.openbsd.org 2008/06/12 20:38:28
2261 [sshd.c sshconnect.c packet.h misc.c misc.h packet.c]
2262 Make keepalive timeouts apply while waiting for a packet, particularly
2263 during key renegotiation (bz #1363). With djm and Matt Day, ok djm@
Darren Tuckera64ab332008-06-13 07:01:29 +10002264 - djm@cvs.openbsd.org 2008/06/12 20:47:04
2265 [sftp-client.c]
2266 print extension revisions for extensions that we understand
Darren Tuckerbabc1d52008-06-13 08:56:01 +10002267 - djm@cvs.openbsd.org 2008/06/12 21:06:25
2268 [clientloop.c]
2269 I was coalescing expected global request confirmation replies at
2270 the wrong end of the queue - fix; prompted by markus@
Darren Tuckerb68fb4a2008-06-13 08:57:27 +10002271 - grunk@cvs.openbsd.org 2008/06/12 21:14:46
2272 [ssh-keygen.c]
2273 make ssh-keygen -lf show the key type just as ssh-add -l would do it
2274 ok djm@ markus@
Darren Tucker0f0ef0a2008-06-13 08:58:05 +10002275 - grunk@cvs.openbsd.org 2008/06/12 22:03:36
2276 [key.c]
2277 add my copyright, ok djm@
Darren Tuckerff4454d2008-06-13 10:21:51 +10002278 - ian@cvs.openbsd.org 2008/06/12 23:24:58
2279 [sshconnect.c]
2280 tweak wording in message, ok deraadt@ jmc@
Darren Tuckerf8b7eb72008-06-13 10:22:54 +10002281 - dtucker@cvs.openbsd.org 2008/06/13 00:12:02
2282 [sftp.h log.h]
2283 replace __dead with __attribute__((noreturn)), makes things
2284 a little easier to port. Also, add it to sigdie(). ok djm@
Darren Tuckerca19bfe2008-06-13 10:24:03 +10002285 - djm@cvs.openbsd.org 2008/06/13 00:16:49
2286 [mux.c]
2287 fall back to creating a new TCP connection on most multiplexing errors
2288 (socket connect fail, invalid version, refused permittion, corrupted
2289 messages, etc.); bz #1329 ok dtucker@
Darren Tucker1adfd362008-06-13 10:58:10 +10002290 - dtucker@cvs.openbsd.org 2008/06/13 00:47:53
2291 [mux.c]
2292 upcast size_t to u_long to match format arg; ok djm@
Darren Tuckerc7e030f2008-06-13 10:58:50 +10002293 - dtucker@cvs.openbsd.org 2008/06/13 00:51:47
2294 [mac.c]
2295 upcast another size_t to u_long to match format
Darren Tucker7517b5b2008-06-13 14:48:59 +10002296 - dtucker@cvs.openbsd.org 2008/06/13 01:38:23
2297 [misc.c]
2298 upcast uid to long with matching %ld, prevents warnings in portable
Darren Tucker06db5842008-06-13 14:51:28 +10002299 - djm@cvs.openbsd.org 2008/06/13 04:40:22
2300 [auth2-pubkey.c auth-rhosts.c]
2301 refuse to read ~/.shosts or ~/.ssh/authorized_keys that are not
2302 regular files; report from Solar Designer via Colin Watson in bz#1471
2303 ok dtucker@ deraadt
Darren Tucker1cf65ae2008-06-13 05:09:18 +10002304 - (dtucker) [clientloop.c serverloop.c] channel_register_filter now
2305 takes 2 more args. with djm@
Darren Tucker61b06952008-06-13 10:28:57 +10002306 - (dtucker) [defines.h] Bug #1112: __dead is, well dead. Based on a patch
2307 from Todd Vierling.
Darren Tucker2c1eb822008-06-13 11:13:13 +10002308 - (dtucker) [auth-sia.c] Bug #1241: support password expiry on Tru64 SIA
2309 systems. Patch from R. Scott Bailey.
Darren Tucker2c91b282008-06-13 12:40:55 +10002310 - (dtucker) [umac.c] STORE_UINT32_REVERSED and endian_convert are never used
2311 on big endian machines, so ifdef them for little-endian only to prevent
2312 unused function warnings on big-endians.
Darren Tuckerf387e592008-06-13 15:03:14 +10002313 - (dtucker) [openbsd-compat/setenv.c] Make offsets size_t to prevent
2314 compiler warnings on some platforms. Based on a discussion with otto@
Darren Tucker11996732008-06-13 04:32:00 +10002315
Damien Miller4401e452008-06-12 06:05:12 +1000231620080611
2317 - (djm) [channels.c configure.ac]
2318 Do not set SO_REUSEADDR on wildcard X11 listeners (X11UseLocalhost=no)
2319 bz#1464; ok dtucker
2320
Darren Tucker7a3935d2008-06-10 22:59:10 +1000232120080610
2322 - (dtucker) OpenBSD CVS Sync
2323 - djm@cvs.openbsd.org 2008/06/10 03:57:27
2324 [servconf.c match.h sshd_config.5]
2325 support CIDR address matching in sshd_config "Match address" blocks, with
2326 full support for negation and fall-back to classic wildcard matching.
2327 For example:
2328 Match address 192.0.2.0/24,3ffe:ffff::/32,!10.*
2329 PasswordAuthentication yes
2330 addrmatch.c code mostly lifted from flowd's addr.c
2331 feedback and ok dtucker@
Darren Tuckerb06cc4a2008-06-10 22:59:53 +10002332 - djm@cvs.openbsd.org 2008/06/10 04:17:46
2333 [sshd_config.5]
2334 better reference for pattern-list
Darren Tuckere7140f22008-06-10 23:01:51 +10002335 - dtucker@cvs.openbsd.org 2008/06/10 04:50:25
2336 [sshd.c channels.h channels.c log.c servconf.c log.h servconf.h sshd.8]
2337 Add extended test mode (-T) and connection parameters for test mode (-C).
2338 -T causes sshd to write its effective configuration to stdout and exit.
2339 -C causes any relevant Match rules to be applied before output. The
2340 combination allows tesing of the parser and config files. ok deraadt djm
Darren Tucker6a2a4002008-06-10 23:03:04 +10002341 - jmc@cvs.openbsd.org 2008/06/10 07:12:00
2342 [sshd_config.5]
2343 tweak previous;
Darren Tuckere7f3f752008-06-10 23:06:01 +10002344 - jmc@cvs.openbsd.org 2008/06/10 08:17:40
2345 [sshd.8 sshd.c]
2346 - update usage()
2347 - fix SYNOPSIS, and sort options
2348 - some minor additional fixes
Darren Tuckerd788b7c2008-06-10 23:15:54 +10002349 - dtucker@cvs.openbsd.org 2008/06/09 18:06:32
2350 [regress/test-exec.sh]
2351 Don't generate putty keys if we're not going to use them. ok djm
Darren Tucker10f92422008-06-10 23:16:46 +10002352 - dtucker@cvs.openbsd.org 2008/06/10 05:23:32
2353 [regress/addrmatch.sh regress/Makefile]
2354 Regress test for Match CIDR rules. ok djm@
Darren Tucker5f346642008-06-11 01:38:52 +10002355 - dtucker@cvs.openbsd.org 2008/06/10 15:21:41
2356 [test-exec.sh]
2357 Use a more portable construct for checking if we're running a putty test
Darren Tuckerd8bafea2008-06-11 01:39:38 +10002358 - dtucker@cvs.openbsd.org 2008/06/10 15:28:49
2359 [test-exec.sh]
2360 Add quotes
Darren Tuckerc9807e82008-06-11 09:33:01 +10002361 - dtucker@cvs.openbsd.org 2008/06/10 18:21:24
2362 [ssh_config.5]
2363 clarify that Host patterns are space-separated. ok deraadt
Darren Tucker8901fa92008-06-11 09:34:01 +10002364 - djm@cvs.openbsd.org 2008/06/10 22:15:23
2365 [PROTOCOL ssh.c serverloop.c]
2366 Add a no-more-sessions@openssh.com global request extension that the
2367 client sends when it knows that it will never request another session
2368 (i.e. when session multiplexing is disabled). This allows a server to
2369 disallow further session requests and terminate the session.
2370 Why would a non-multiplexing client ever issue additional session
2371 requests? It could have been attacked with something like SSH'jack:
2372 http://www.storm.net.nz/projects/7
2373 feedback & ok markus
Darren Tucker896ad5a2008-06-11 09:34:46 +10002374 - djm@cvs.openbsd.org 2008/06/10 23:06:19
2375 [auth-options.c match.c servconf.c addrmatch.c sshd.8]
2376 support CIDR address matching in .ssh/authorized_keys from="..." stanzas
2377 ok and extensive testing dtucker@
Darren Tucker2a8b1382008-06-11 09:35:37 +10002378 - dtucker@cvs.openbsd.org 2008/06/10 23:21:34
2379 [bufaux.c]
2380 Use '\0' for a nul byte rather than unadorned 0. ok djm@
Darren Tuckere045e0c2008-06-11 09:38:12 +10002381 - dtucker@cvs.openbsd.org 2008/06/10 23:13:43
2382 [Makefile regress/key-options.sh]
2383 Add regress test for key options. ok djm@
Darren Tucker5d376902008-06-11 04:15:05 +10002384 - (dtucker) [openbsd-compat/fake-rfc2553.h] Add sin6_scope_id to sockaddr_in6
2385 since the new CIDR code in addmatch.c references it.
2386 - (dtucker) [Makefile.in configure.ac regress/addrmatch.sh] Skip IPv6
2387 specific tests on platforms that don't do IPv6.
Darren Tucker34f49c62008-06-11 05:15:51 +10002388 - (dtucker) [Makefile.in] Define TEST_SSH_IPV6 in make's arguments as well
2389 as environment.
Darren Tuckerb8e05002008-06-11 09:47:59 +10002390 - (dtucker) [Makefile.in] Move addrmatch.o to libssh.a where it's needed now.
Darren Tucker7a3935d2008-06-10 22:59:10 +10002391
Darren Tucker422c34c2008-06-09 22:48:31 +1000239220080609
2393 - (dtucker) OpenBSD CVS Sync
2394 - dtucker@cvs.openbsd.org 2008/06/08 17:04:41
2395 [sftp-server.c]
2396 Add case for ENOSYS in errno_to_portable; ok deraadt
Darren Tucker7b598892008-06-09 22:49:36 +10002397 - dtucker@cvs.openbsd.org 2008/06/08 20:15:29
2398 [sftp.c sftp-client.c sftp-client.h]
2399 Have the sftp client store the statvfs replies in wire format,
2400 which prevents problems when the server's native sizes exceed the
2401 client's.
2402 Also extends the sizes of the remaining 32bit wire format to 64bit,
2403 they're specified as unsigned long in the standard.
Darren Tucker3463aca2008-06-09 23:06:55 +10002404 - dtucker@cvs.openbsd.org 2008/06/09 13:02:39
Darren Tucker588fe0e2008-06-09 23:52:22 +10002405 [sftp-server.c]
Darren Tucker3463aca2008-06-09 23:06:55 +10002406 Extend 32bit -> 64bit values for statvfs extension missed in previous
2407 commit.
Darren Tucker588fe0e2008-06-09 23:52:22 +10002408 - dtucker@cvs.openbsd.org 2008/06/09 13:38:46
2409 [PROTOCOL]
2410 Use a $OpenBSD tag so our scripts will sync changes.
Darren Tucker422c34c2008-06-09 22:48:31 +10002411
Darren Tucker598eaa62008-06-09 03:32:29 +1000241220080608
2413 - (dtucker) [configure.ac defines.h sftp-client.c sftp-server.c sftp.c
2414 openbsd-compat/Makefile.in openbsd-compat/openbsd-compat.h
2415 openbsd-compat/bsd-statvfs.{c,h}] Add a null implementation of statvfs and
2416 fstatvfs and remove #defines around statvfs code. ok djm@
Darren Tucker77001382008-06-09 06:17:53 +10002417 - (dtucker) [configure.ac defines.h sftp-client.c M sftp-server.c] Add a
2418 macro to convert fsid to unsigned long for platforms where fsid is a
2419 2-member array.
Darren Tucker598eaa62008-06-09 03:32:29 +10002420
Darren Tuckerce38d822008-06-07 06:25:15 +1000242120080607
2422 - (dtucker) [mux.c] Include paths.h inside ifdef HAVE_PATHS_H.
Darren Tucker5b2e2ba2008-06-08 09:25:28 +10002423 - (dtucker) [configure.ac defines.h sftp-client.c sftp-server.c sftp.c]
2424 Do not enable statvfs extensions on platforms that do not have statvfs.
Darren Tucker136e56f2008-06-08 12:49:30 +10002425 - (dtucker) OpenBSD CVS Sync
2426 - djm@cvs.openbsd.org 2008/05/19 06:14:02
2427 [packet.c] unbreak protocol keepalive timeouts bz#1465; ok dtucker@
Darren Tuckerdd392642008-06-08 12:53:20 +10002428 - djm@cvs.openbsd.org 2008/05/19 15:45:07
2429 [sshtty.c ttymodes.c sshpty.h]
2430 Fix sending tty modes when stdin is not a tty (bz#1199). Previously
2431 we would send the modes corresponding to a zeroed struct termios,
2432 whereas we should have been sending an empty list of modes.
2433 Based on patch from daniel.ritz AT alcatel.ch; ok dtucker@ markus@
Darren Tucker0f7e9102008-06-08 12:54:29 +10002434 - djm@cvs.openbsd.org 2008/05/19 15:46:31
2435 [ssh-keygen.c]
2436 support -l (print fingerprint) in combination with -F (find host) to
2437 search for a host in ~/.ssh/known_hosts and display its fingerprint;
2438 ok markus@
Darren Tuckerdf189fb2008-06-08 12:55:32 +10002439 - djm@cvs.openbsd.org 2008/05/19 20:53:52
2440 [clientloop.c]
2441 unbreak tree by committing this bit that I missed from:
2442 Fix sending tty modes when stdin is not a tty (bz#1199). Previously
2443 we would send the modes corresponding to a zeroed struct termios,
2444 whereas we should have been sending an empty list of modes.
2445 Based on patch from daniel.ritz AT alcatel.ch; ok dtucker@ markus@
Darren Tuckerce38d822008-06-07 06:25:15 +10002446
Damien Miller58ea61b2008-06-04 10:54:00 +1000244720080604
2448 - (djm) [openbsd-compat/bsd-arc4random.c] Fix math bug that caused bias
2449 in arc4random_uniform with upper_bound in (2^30,2*31). Note that
2450 OpenSSH did not make requests with upper bounds in this range.
2451
Damien Millera7058ec2008-05-20 08:57:06 +1000245220080519
2453 - (djm) [configure.ac mux.c sftp.c openbsd-compat/Makefile.in]
2454 [openbsd-compat/fmt_scaled.c openbsd-compat/openbsd-compat.h]
2455 Fix compilation on Linux, including pulling in fmt_scaled(3)
2456 implementation from OpenBSD's libutil.
2457
Damien Miller797e3d12008-05-19 14:27:42 +1000245820080518
2459 - (djm) OpenBSD CVS Sync
2460 - djm@cvs.openbsd.org 2008/04/04 05:14:38
2461 [sshd_config.5]
2462 ChrootDirectory is supported in Match blocks (in fact, it is most useful
2463 there). Spotted by Minstrel AT minstrel.org.uk
Damien Miller56f41dd2008-05-19 14:28:19 +10002464 - djm@cvs.openbsd.org 2008/04/04 06:44:26
2465 [sshd_config.5]
2466 oops, some unrelated stuff crept into that commit - backout.
2467 spotted by jmc@
Damien Miller25434de2008-05-19 14:29:08 +10002468 - djm@cvs.openbsd.org 2008/04/05 02:46:02
2469 [sshd_config.5]
2470 HostbasedAuthentication is supported under Match too
Damien Millera4be7c22008-05-19 14:47:37 +10002471 - (djm) [openbsd-compat/bsd-arc4random.c openbsd-compat/openbsd-compat.c]
2472 [configure.ac] Implement arc4random_buf(), import implementation of
2473 arc4random_uniform() from OpenBSD
Damien Millercaaed012008-05-19 15:26:54 +10002474 - (djm) [openbsd-compat/bsd-arc4random.c] Warning fixes
Damien Miller94178312008-05-19 15:28:35 +10002475 - (djm) [openbsd-compat/port-tun.c] needs sys/queue.h
Damien Miller354c48c2008-05-19 14:50:00 +10002476 - (djm) OpenBSD CVS Sync
2477 - djm@cvs.openbsd.org 2008/04/13 00:22:17
2478 [dh.c sshd.c]
2479 Use arc4random_buf() when requesting more than a single word of output
2480 Use arc4random_uniform() when the desired random number upper bound
2481 is not a power of two
2482 ok deraadt@ millert@
Damien Millerd671e5a2008-05-19 14:53:33 +10002483 - djm@cvs.openbsd.org 2008/04/18 12:32:11
2484 [sftp-client.c sftp-client.h sftp-server.c sftp.1 sftp.c sftp.h]
2485 introduce sftp extension methods statvfs@openssh.com and
2486 fstatvfs@openssh.com that implement statvfs(2)-like operations,
2487 based on a patch from miklos AT szeredi.hu (bz#1399)
2488 also add a "df" command to the sftp client that uses the
2489 statvfs@openssh.com to produce a df(1)-like display of filesystem
2490 space and inode utilisation
2491 ok markus@
Damien Miller64058cb2008-05-19 14:54:25 +10002492 - jmc@cvs.openbsd.org 2008/04/18 17:15:47
2493 [sftp.1]
2494 macro fixage;
Damien Millerff0dd882008-05-19 14:55:02 +10002495 - djm@cvs.openbsd.org 2008/04/18 22:01:33
2496 [session.c]
2497 remove unneccessary parentheses
Damien Miller0b4c1652008-05-19 14:55:29 +10002498 - otto@cvs.openbsd.org 2008/04/29 11:20:31
2499 [monitor_mm.h]
2500 garbage collect two unused fields in struct mm_master; ok markus@
Damien Millerbacb7fb2008-05-19 14:56:33 +10002501 - djm@cvs.openbsd.org 2008/04/30 10:14:03
2502 [ssh-keyscan.1 ssh-keyscan.c]
2503 default to rsa (protocol 2) keys, instead of rsa1 keys; spotted by
2504 larsnooden AT openoffice.org
Damien Miller4f755cd2008-05-19 14:57:41 +10002505 - pyr@cvs.openbsd.org 2008/05/07 05:49:37
2506 [servconf.c servconf.h session.c sshd_config.5]
2507 Enable the AllowAgentForwarding option in sshd_config (global and match
2508 context), to specify if agents should be permitted on the server.
2509 As the man page states:
2510 ``Note that disabling Agent forwarding does not improve security
2511 unless users are also denied shell access, as they can always install
2512 their own forwarders.''
2513 ok djm@, ok and a mild frown markus@
Damien Millerba3a6592008-05-19 14:58:22 +10002514 - pyr@cvs.openbsd.org 2008/05/07 06:43:35
2515 [sshd_config]
2516 push the sshd_config bits in, spotted by ajacoutot@
Damien Millere9890192008-05-19 14:59:02 +10002517 - jmc@cvs.openbsd.org 2008/05/07 08:00:14
2518 [sshd_config.5]
2519 sort;
Damien Millerdb255ca2008-05-19 14:59:37 +10002520 - markus@cvs.openbsd.org 2008/05/08 06:59:01
2521 [bufaux.c buffer.h channels.c packet.c packet.h]
2522 avoid extra malloc/copy/free when receiving data over the net;
2523 ~10% speedup for localhost-scp; ok djm@
Damien Millerb84886b2008-05-19 15:05:07 +10002524 - djm@cvs.openbsd.org 2008/05/08 12:02:23
2525 [auth-options.c auth1.c channels.c channels.h clientloop.c gss-serv.c]
2526 [monitor.c monitor_wrap.c nchan.c servconf.c serverloop.c session.c]
2527 [ssh.c sshd.c]
2528 Implement a channel success/failure status confirmation callback
2529 mechanism. Each channel maintains a queue of callbacks, which will
2530 be drained in order (RFC4253 guarantees confirm messages are not
2531 reordered within an channel).
2532 Also includes a abandonment callback to clean up if a channel is
2533 closed without sending confirmation messages. This probably
2534 shouldn't happen in compliant implementations, but it could be
2535 abused to leak memory.
2536 ok markus@ (as part of a larger diff)
Damien Miller7207f642008-05-19 15:34:50 +10002537 - djm@cvs.openbsd.org 2008/05/08 12:21:16
2538 [monitor.c monitor_wrap.c session.h servconf.c servconf.h session.c]
2539 [sshd_config sshd_config.5]
2540 Make the maximum number of sessions run-time controllable via
2541 a sshd_config MaxSessions knob. This is useful for disabling
2542 login/shell/subsystem access while leaving port-forwarding working
2543 (MaxSessions 0), disabling connection multiplexing (MaxSessions 1) or
2544 simply increasing the number of allows multiplexed sessions.
2545 Because some bozos are sure to configure MaxSessions in excess of the
2546 number of available file descriptors in sshd (which, at peak, might be
2547 as many as 9*MaxSessions), audit sshd to ensure that it doesn't leak fds
2548 on error paths, and make it fail gracefully on out-of-fd conditions -
2549 sending channel errors instead of than exiting with fatal().
2550 bz#1090; MaxSessions config bits and manpage from junyer AT gmail.com
2551 ok markus@
Damien Miller5771ed72008-05-19 15:35:33 +10002552 - djm@cvs.openbsd.org 2008/05/08 13:06:11
2553 [clientloop.c clientloop.h ssh.c]
2554 Use new channel status confirmation callback system to properly deal
2555 with "important" channel requests that fail, in particular command exec,
2556 shell and subsystem requests. Previously we would optimistically assume
2557 that the requests would always succeed, which could cause hangs if they
2558 did not (e.g. when the server runs out of fds) or were unimplemented by
2559 the server (bz #1384)
2560 Also, properly report failing multiplex channel requests via the mux
2561 client stderr (subject to LogLevel in the mux master) - better than
2562 silently failing.
2563 most bits ok markus@ (as part of a larger diff)
Damien Millerbd740252008-05-19 15:37:09 +10002564 - djm@cvs.openbsd.org 2008/05/09 04:55:56
2565 [channels.c channels.h clientloop.c serverloop.c]
2566 Try additional addresses when connecting to a port forward destination
2567 whose DNS name resolves to more than one address. The previous behaviour
2568 was to try the first address and give up.
2569 Reported by stig AT venaas.com in bz#343
2570 great feedback and ok markus@
Damien Millerb1cbfa22008-05-19 16:00:08 +10002571 - djm@cvs.openbsd.org 2008/05/09 14:18:44
2572 [clientloop.c clientloop.h ssh.c mux.c]
2573 tidy up session multiplexing code, moving it into its own file and
2574 making the function names more consistent - making ssh.c and
2575 clientloop.c a fair bit more readable.
2576 ok markus@
Damien Millerb3da5932008-05-19 16:02:37 +10002577 - djm@cvs.openbsd.org 2008/05/09 14:26:08
2578 [ssh.c]
2579 dingo stole my diff hunk
Damien Miller2ff1ca52008-05-19 16:04:56 +10002580 - markus@cvs.openbsd.org 2008/05/09 16:16:06
2581 [session.c]
2582 re-add the USE_PIPES code and enable it.
2583 without pipes shutdown-read from the sshd does not trigger
2584 a SIGPIPE when the forked program does a write.
2585 ok djm@
2586 (Id sync only, USE_PIPES never left portable OpenSSH)
Damien Millerd654dd22008-05-19 16:05:41 +10002587 - markus@cvs.openbsd.org 2008/05/09 16:17:51
2588 [channels.c]
2589 error-fd race: don't enable the error fd in the select bitmask
2590 for channels with both in- and output closed, since the channel
2591 will go away before we call select();
2592 report, lots of debugging help and ok djm@
Damien Millerbab9bd42008-05-19 16:06:47 +10002593 - markus@cvs.openbsd.org 2008/05/09 16:21:13
2594 [channels.h clientloop.c nchan.c serverloop.c]
2595 unbreak
2596 ssh -2 localhost od /bin/ls | true
2597 ignoring SIGPIPE by adding a new channel message (EOW) that signals
2598 the peer that we're not interested in any data it might send.
2599 fixes bz #85; discussion, debugging and ok djm@
Damien Miller0f30c872008-05-19 16:07:45 +10002600 - pvalchev@cvs.openbsd.org 2008/05/12 20:52:20
2601 [umac.c]
2602 Ensure nh_result lies on a 64-bit boundary (fixes warnings observed
2603 on Itanium on Linux); from Dale Talcott (bug #1462); ok djm@
Damien Miller5159bdd2008-05-19 16:08:20 +10002604 - djm@cvs.openbsd.org 2008/05/15 23:52:24
2605 [nchan2.ms]
2606 document eow message in ssh protocol 2 channel state machine;
2607 feedback and ok markus@
Damien Millera7e0d5a2008-05-19 16:08:41 +10002608 - djm@cvs.openbsd.org 2008/05/18 21:29:05
2609 [sftp-server.c]
2610 comment extension announcement
Damien Miller58a81142008-05-19 16:11:56 +10002611 - djm@cvs.openbsd.org 2008/05/16 08:30:42
2612 [PROTOCOL]
2613 document our protocol extensions and deviations; ok markus@
2614 - djm@cvs.openbsd.org 2008/05/17 01:31:56
2615 [PROTOCOL]
2616 grammar and correctness fixes from stevesk@
Damien Miller797e3d12008-05-19 14:27:42 +10002617
Damien Miller5f5cd742008-04-03 08:43:57 +1100261820080403
Damien Miller55754fb2008-04-04 16:16:35 +11002619 - (djm) [openbsd-compat/bsd-poll.c] Include stdlib.h to avoid compile-
2620 time warnings on LynxOS. Patch from ops AT iki.fi
Damien Millerc5750222008-05-16 10:01:54 +10002621 - (djm) Force string arguments to replacement setproctitle() though
2622 strnvis first. Ok dtucker@
Damien Miller55754fb2008-04-04 16:16:35 +11002623
262420080403
Damien Miller5f5cd742008-04-03 08:43:57 +11002625 - (djm) OpenBSD CVS sync:
2626 - markus@cvs.openbsd.org 2008/04/02 15:36:51
2627 [channels.c]
2628 avoid possible hijacking of x11-forwarded connections (back out 1.183)
2629 CVE-2008-1483; ok djm@
Damien Miller13ba9c22008-04-03 20:52:51 +11002630 - jmc@cvs.openbsd.org 2008/03/27 22:37:57
2631 [sshd.8]
2632 remove trailing whitespace;
Damien Millera68d31b2008-04-03 20:53:08 +11002633 - djm@cvs.openbsd.org 2008/04/03 09:50:14
2634 [version.h]
2635 openssh-5.0
Damien Miller5a4b6462008-04-03 20:55:44 +11002636 - (djm) [contrib/caldera/openssh.spec contrib/redhat/openssh.spec]
2637 [contrib/suse/openssh.spec] Crank version numbers in RPM spec files
Damien Millerffa83022008-04-03 20:56:38 +11002638 - (djm) [README] Update link to release notes
Damien Miller79a1bc92008-04-03 20:57:05 +11002639 - (djm) Release 5.0p1