blob: 712a9caf5f4be6501c217224befb901958a6f885 [file] [log] [blame]
Darren Tuckerb7b17be2010-01-08 16:49:52 +1100120091208
2 - (dtucker) OpenBSD CVS Sync
3 - andreas@cvs.openbsd.org 2009/10/24 11:11:58
4 [roaming.h]
5 Declarations needed for upcoming changes.
6 ok markus@
Darren Tucker36331b52010-01-08 16:50:41 +11007 - andreas@cvs.openbsd.org 2009/10/24 11:13:54
8 [sshconnect2.c kex.h kex.c]
9 Let the client detect if the server supports roaming by looking
10 for the resume@appgate.com kex algorithm.
11 ok markus@
Darren Tuckere32cf432010-01-08 16:51:40 +110012 - andreas@cvs.openbsd.org 2009/10/24 11:15:29
13 [clientloop.c]
14 client_loop() must detect if the session has been suspended and resumed,
15 and take appropriate action in that case.
16 From Martin Forssen, maf at appgate dot com
Darren Tuckerf9e6eb82010-01-08 16:52:32 +110017 - andreas@cvs.openbsd.org 2009/10/24 11:19:17
18 [ssh2.h]
19 Define the KEX messages used when resuming a suspended connection.
Darren Tuckere32cf432010-01-08 16:51:40 +110020 ok markus@
Darren Tuckere7301182010-01-08 16:53:31 +110021 - andreas@cvs.openbsd.org 2009/10/24 11:22:37
22 [roaming_common.c]
23 Do the actual suspend/resume in the client. This won't be useful until
24 the server side supports roaming.
25 Most code from Martin Forssen, maf at appgate dot com. Some changes by
26 me and markus@
27 ok markus@
Darren Tuckerf1de4e52010-01-08 16:54:59 +110028 - andreas@cvs.openbsd.org 2009/10/24 11:23:42
29 [ssh.c]
30 Request roaming to be enabled if UseRoaming is true and the server
31 supports it.
32 ok markus@
Darren Tucker34e314d2010-01-08 17:03:46 +110033 - reyk@cvs.openbsd.org 2009/10/28 16:38:18
34 [ssh_config.5 sshd.c misc.h ssh-keyscan.1 readconf.h sshconnect.c
35 channels.c channels.h servconf.h servconf.c ssh.1 ssh-keyscan.c scp.1
36 sftp.1 sshd_config.5 readconf.c ssh.c misc.c]
37 Allow to set the rdomain in ssh/sftp/scp/sshd and ssh-keyscan.
38 ok markus@
Darren Tuckercc117f02010-01-08 17:05:26 +110039 - jmc@cvs.openbsd.org 2009/10/28 21:45:08
40 [sshd_config.5 sftp.1]
41 tweak previous;
Darren Tucker78be8c52010-01-08 17:05:59 +110042 - djm@cvs.openbsd.org 2009/11/10 02:56:22
43 [ssh_config.5]
44 explain the constraints on LocalCommand some more so people don't
45 try to abuse it.
Darren Tuckerb7b17be2010-01-08 16:49:52 +110046
Tim Rice880ab0d2009-12-26 15:40:47 -08004720091226
48 - (tim) [contrib/cygwin/Makefile] Install ssh-copy-id and ssh-copy-id.1
49 Gzip all man pages. Patch from Corinna Vinschen.
50
Darren Tucker1bf35032009-12-21 10:49:21 +11005120091221
52 - (dtucker) [auth-krb5.c platform.{c,h} openbsd-compat/port-aix.{c,h}]
53 Bug #1583: Use system's kerberos principal name on AIX if it's available.
54 Based on a patch from and tested by Miguel Sanders
55
Darren Tuckerc8802aa2009-12-08 13:39:48 +11005620091208
57 - (dtucker) Bug #1470: Disable OOM-killing of the listening sshd on Linux,
58 based on a patch from Vaclav Ovsik and Colin Watson. ok djm.
59
Darren Tucker15333112009-12-07 11:15:43 +11006020091207
61 - (dtucker) Bug #1160: use pkg-config for opensc config if it's available.
62 Tested by Martin Paljak.
Darren Tuckerd35e0ef2009-12-07 11:32:36 +110063 - (dtucker) Bug #1677: add conditionals around the source for ssh-askpass.
Darren Tucker15333112009-12-07 11:15:43 +110064
Tim Rice53e99742009-11-20 19:32:15 -08006520091121
66 - (tim) [opensshd.init.in] If PidFile is set in sshd_config, use it.
67 Bug 1628. OK dtucker@
68
Damien Miller409661f2009-11-20 15:16:35 +11006920091120
70 - (djm) [ssh-rand-helper.c] Print error and usage() when passed command-
71 line arguments as none are supported. Exit when passed unrecognised
72 commandline flags. bz#1568 from gson AT araneus.fi
73
7420091118
Damien Miller04ee0f82009-11-18 17:48:30 +110075 - (djm) [channels.c misc.c misc.h sshd.c] add missing setsockopt() to
76 set IPV6_V6ONLY for local forwarding with GatwayPorts=yes. Unify
77 setting IPV6_V6ONLY behind a new function misc.c:sock_set_v6only()
Damien Miller2191e042009-11-18 17:51:59 +110078 bz#1648, report and fix from jan.kratochvil AT redhat.com
79 - (djm) [contrib/gnome-ssh-askpass2.c] Make askpass dialog desktop-modal.
80 bz#1645, patch from jchadima AT redhat.com
Damien Miller04ee0f82009-11-18 17:48:30 +110081
8220091107
Darren Tuckerdf6578b2009-11-07 16:03:14 +110083 - (dtucker) [authfile.c] Fall back to 3DES for the encryption of private
84 keys when built with OpenSSL versions that don't do AES.
85
Darren Tuckere89ed1c2009-11-05 20:43:16 +11008620091105
87 - (dtucker) [authfile.c] Add OpenSSL compat header so this still builds with
88 older versions of OpenSSL.
89
Darren Tucker1b118882009-10-24 11:40:32 +11009020091024
91 - (dtucker) OpenBSD CVS Sync
92 - djm@cvs.openbsd.org 2009/10/11 23:03:15
93 [hostfile.c]
94 mention the host name that we are looking for in check_host_in_hostfile()
Darren Tucker49b7e232009-10-24 11:41:05 +110095 - sobrado@cvs.openbsd.org 2009/10/17 12:10:39
96 [sftp-server.c]
97 sort flags.
Darren Tuckerae69e1d2009-10-24 11:41:34 +110098 - sobrado@cvs.openbsd.org 2009/10/22 12:35:53
99 [ssh.1 ssh-agent.1 ssh-add.1]
100 use the UNIX-related macros (.At and .Ux) where appropriate.
101 ok jmc@
Darren Tucker98c9aec2009-10-24 11:42:44 +1100102 - sobrado@cvs.openbsd.org 2009/10/22 15:02:12
103 [ssh-agent.1 ssh-add.1 ssh.1]
104 write UNIX-domain in a more consistent way; while here, replace a
105 few remaining ".Tn UNIX" macros with ".Ux" ones.
106 pointed out by ratchov@, thanks!
107 ok jmc@
Darren Tuckerdfb9b712009-10-24 11:46:43 +1100108 - djm@cvs.openbsd.org 2009/10/22 22:26:13
109 [authfile.c]
110 switch from 3DES to AES-128 for encryption of passphrase-protected
111 SSH protocol 2 private keys; ok several
Darren Tucker2f29a8c2009-10-24 11:47:58 +1100112 - djm@cvs.openbsd.org 2009/10/23 01:57:11
113 [sshconnect2.c]
114 disallow a hostile server from checking jpake auth by sending an
115 out-of-sequence success message. (doesn't affect code enabled by default)
Darren Tucker199ee6f2009-10-24 11:50:17 +1100116 - dtucker@cvs.openbsd.org 2009/10/24 00:48:34
117 [ssh-keygen.1]
118 ssh-keygen now uses AES-128 for private keys
Darren Tucker6ac91a72009-10-24 11:52:42 +1100119 - (dtucker) [mdoc2man.awk] Teach it to understand the .Ux macro.
Darren Tucker4d6656b2009-10-24 15:04:12 +1100120 - (dtucker) [session.c openbsd-compat/port-linux.{c,h}] Bug #1637: if selinux
121 is enabled set the security context to "sftpd_t" before running the
122 internal sftp server Based on a patch from jchadima at redhat.
Darren Tucker1b118882009-10-24 11:40:32 +1100123
Darren Tuckerc182d992009-10-11 21:50:20 +110012420091011
125 - (dtucker) [configure.ac sftp-client.c] Remove the gyrations required for
126 dirent d_type and DTTOIF as we've switched OpenBSD to the more portable
127 lstat.
Darren Tuckerbad50762009-10-11 21:51:08 +1100128 - (dtucker) OpenBSD CVS Sync
129 - markus@cvs.openbsd.org 2009/10/08 14:03:41
130 [sshd_config readconf.c ssh_config.5 servconf.c sshd_config.5]
131 disable protocol 1 by default (after a transition period of about 10 years)
132 ok deraadt
Darren Tucker7a4a7652009-10-11 21:51:40 +1100133 - jmc@cvs.openbsd.org 2009/10/08 20:42:12
134 [sshd_config.5 ssh_config.5 sshd.8 ssh.1]
135 some tweaks now that protocol 1 is not offered by default; ok markus
Darren Tucker438b4732009-10-11 21:52:10 +1100136 - dtucker@cvs.openbsd.org 2009/10/11 10:41:26
137 [sftp-client.c]
138 d_type isn't portable so use lstat to get dirent modes. Suggested by and
139 "looks sane" deraadt@
Darren Tuckere23a79c2009-10-12 09:37:22 +1100140 - markus@cvs.openbsd.org 2009/10/08 18:04:27
141 [regress/test-exec.sh]
142 re-enable protocol v1 for the tests.
Darren Tuckerc182d992009-10-11 21:50:20 +1100143
Darren Tucker46bbbe32009-10-07 08:21:48 +110014420091007
145 - (dtucker) OpenBSD CVS Sync
146 - djm@cvs.openbsd.org 2009/08/12 00:13:00
147 [sftp.c sftp.1]
148 support most of scp(1)'s commandline arguments in sftp(1), as a first
149 step towards making sftp(1) a drop-in replacement for scp(1).
150 One conflicting option (-P) has not been changed, pending further
151 discussion.
152 Patch from carlosvsilvapt@gmail.com as part of his work in the
153 Google Summer of Code
Darren Tuckeradba1ba2009-10-07 08:22:20 +1100154 - jmc@cvs.openbsd.org 2009/08/12 06:31:42
155 [sftp.1]
156 sort options;
Darren Tucker282b4022009-10-07 08:23:06 +1100157 - djm@cvs.openbsd.org 2009/08/13 01:11:19
158 [sftp.1 sftp.c]
159 Swizzle options: "-P sftp_server_path" moves to "-D sftp_server_path",
160 add "-P port" to match scp(1). Fortunately, the -P option is only really
161 used by our regression scripts.
162 part of larger patch from carlosvsilvapt@gmail.com for his Google Summer
163 of Code work; ok deraadt markus
Darren Tuckerc07138e2009-10-07 08:23:44 +1100164 - jmc@cvs.openbsd.org 2009/08/13 13:39:54
165 [sftp.1 sftp.c]
166 sync synopsis and usage();
Darren Tuckerc22f0902009-10-07 08:24:19 +1100167 - djm@cvs.openbsd.org 2009/08/14 18:17:49
168 [sftp-client.c]
169 make the "get_handle: ..." error messages vaguely useful by allowing
170 callers to specify their own error message strings.
Darren Tuckere54a0362009-10-07 08:35:32 +1100171 - fgsch@cvs.openbsd.org 2009/08/15 18:56:34
172 [auth.h]
173 remove unused define. markus@ ok.
174 (Id sync only, Portable still uses this.)
Darren Tucker1477ea12009-10-07 08:36:05 +1100175 - dtucker@cvs.openbsd.org 2009/08/16 23:29:26
176 [sshd_config.5]
177 Add PubkeyAuthentication to the list allowed in a Match block (bz #1577)
Darren Tucker1b0dd172009-10-07 08:37:48 +1100178 - djm@cvs.openbsd.org 2009/08/18 18:36:21
179 [sftp-client.h sftp.1 sftp-client.c sftp.c]
180 recursive transfer support for get/put and on the commandline
181 work mostly by carlosvsilvapt@gmail.com for the Google Summer of Code
182 with some tweaks by me; "go for it" deraadt@
Darren Tucker05016b22009-10-07 08:38:23 +1100183 - djm@cvs.openbsd.org 2009/08/18 21:15:59
184 [sftp.1]
185 fix "get" command usage, spotted by jmc@
Darren Tuckerb3b40a82009-10-07 08:39:09 +1100186 - jmc@cvs.openbsd.org 2009/08/19 04:56:03
187 [sftp.1]
188 ether -> either;
Darren Tucker8ec4fd82009-10-07 08:39:57 +1100189 - dtucker@cvs.openbsd.org 2009/08/20 23:54:28
190 [mux.c]
191 subsystem_flag is defined in ssh.c so it's extern; ok djm
Darren Tucker7dc48502009-10-07 08:44:42 +1100192 - djm@cvs.openbsd.org 2009/08/27 17:28:52
193 [sftp-server.c]
194 allow setting an explicit umask on the commandline to override whatever
195 default the user has. bz#1229; ok dtucker@ deraadt@ markus@
Darren Tucker9bcd25b2009-10-07 08:45:48 +1100196 - djm@cvs.openbsd.org 2009/08/27 17:33:49
197 [ssh-keygen.c]
198 force use of correct hash function for random-art signature display
199 as it was inheriting the wrong one when bubblebabble signatures were
200 activated; bz#1611 report and patch from fwojcik+openssh AT besh.com;
201 ok markus@
Darren Tucker6b286a42009-10-07 08:46:21 +1100202 - djm@cvs.openbsd.org 2009/08/27 17:43:00
203 [sftp-server.8]
204 allow setting an explicit umask on the commandline to override whatever
205 default the user has. bz#1229; ok dtucker@ deraadt@ markus@
Darren Tucker893d7352009-10-07 08:47:02 +1100206 - djm@cvs.openbsd.org 2009/08/27 17:44:52
207 [authfd.c ssh-add.c authfd.h]
208 Do not fall back to adding keys without contraints (ssh-add -c / -t ...)
209 when the agent refuses the constrained add request. This was a useful
210 migration measure back in 2002 when constraints were new, but just
211 adds risk now.
212 bz #1612, report and patch from dkg AT fifthhorseman.net; ok markus@
Darren Tucker30359e12009-10-07 08:47:24 +1100213 - djm@cvs.openbsd.org 2009/08/31 20:56:02
214 [sftp-server.c]
215 check correct variable for error message, spotted by martynas@
Darren Tucker7bee06a2009-10-07 08:47:47 +1100216 - djm@cvs.openbsd.org 2009/08/31 21:01:29
217 [sftp-server.8]
218 document -e and -h; prodded by jmc@
Darren Tucker72473c62009-10-07 09:01:03 +1100219 - djm@cvs.openbsd.org 2009/09/01 14:43:17
220 [ssh-agent.c]
221 fix a race condition in ssh-agent that could result in a wedged or
222 spinning agent: don't read off the end of the allocated fd_sets, and
223 don't issue blocking read/write on agent sockets - just fall back to
224 select() on retriable read/write errors. bz#1633 reported and tested
225 by "noodle10000 AT googlemail.com"; ok dtucker@ markus@
Darren Tucker759cb2a2009-10-07 09:01:50 +1100226 - grunk@cvs.openbsd.org 2009/10/01 11:37:33
227 [dh.c]
228 fix a cast
229 ok djm@ markus@
Darren Tucker695ed392009-10-07 09:02:18 +1100230 - djm@cvs.openbsd.org 2009/10/06 04:46:40
231 [session.c]
232 bz#1596: fflush(NULL) before exec() to ensure that everying (motd
233 in particular) has made it out before the streams go away.
Darren Tucker7023d162009-10-07 10:30:06 +1100234 - djm@cvs.openbsd.org 2008/12/07 22:17:48
235 [regress/addrmatch.sh]
236 match string "passwordauthentication" only at start of line, not anywhere
237 in sshd -T output
Darren Tucker79885532009-10-07 10:30:57 +1100238 - dtucker@cvs.openbsd.org 2009/05/05 07:51:36
239 [regress/multiplex.sh]
240 Always specify ssh_config for multiplex tests: prevents breakage caused
241 by options in ~/.ssh/config. From Dan Peterson.
Darren Tucker287b9322009-10-07 10:31:56 +1100242 - djm@cvs.openbsd.org 2009/08/13 00:57:17
243 [regress/Makefile]
244 regression test for port number parsing. written as part of the a2port
245 change that went into 5.2 but I forgot to commit it at the time...
Darren Tuckered6b0c52009-10-07 10:43:57 +1100246 - djm@cvs.openbsd.org 2009/08/13 01:11:55
Darren Tuckerb707a242009-10-07 10:54:31 +1100247 [regress/sftp-batch.sh regress/sftp-badcmds.sh regress/sftp.sh
248 regress/sftp-cmds.sh regres/sftp-glob.sh]
Darren Tuckered6b0c52009-10-07 10:43:57 +1100249 date: 2009/08/13 01:11:19; author: djm; state: Exp; lines: +10 -7
250 Swizzle options: "-P sftp_server_path" moves to "-D sftp_server_path",
251 add "-P port" to match scp(1). Fortunately, the -P option is only really
252 used by our regression scripts.
253 part of larger patch from carlosvsilvapt@gmail.com for his Google Summer
254 of Code work; ok deraadt markus
Darren Tuckerc8638952009-10-07 10:46:29 +1100255 - djm@cvs.openbsd.org 2009/08/20 18:43:07
Darren Tuckerb707a242009-10-07 10:54:31 +1100256 [regress/ssh-com-sftp.sh]
Darren Tuckerc8638952009-10-07 10:46:29 +1100257 fix one sftp -D ... => sftp -P ... conversion that I missed; from Carlos
258 Silva for Google Summer of Code
Darren Tuckerb707a242009-10-07 10:54:31 +1100259 - dtucker@cvs.openbsd.org 2009/10/06 23:51:49
260 [regress/ssh2putty.sh]
261 Add OpenBSD tag to make syncs easier
Darren Tuckera25ab012009-10-07 11:00:58 +1100262 - (dtucker) [regress/portnum.sh] Import new test.
Darren Tucker538738d2009-10-07 18:56:10 +1100263 - (dtucker) [configure.ac sftp-client.c] DTOTIF is in fs/ffs/dir.h on at
Darren Tucker4adeac72009-10-07 15:49:48 +1100264 least dragonflybsd.
Darren Tucker538738d2009-10-07 18:56:10 +1100265 - (dtucker) d_type is not mandated by POSIX, so add fallback code using
266 stat(), needed on at least cygwin.
Darren Tucker46bbbe32009-10-07 08:21:48 +1100267
Damien Miller350666d2009-10-02 11:50:55 +100026820091002
269 - (djm) [Makefile.in] Mention readconf.o in ssh-keysign's make deps.
270 spotted by des AT des.no
271
Damien Millerea437422009-10-02 11:49:03 +100027220090926
273 - (djm) [contrib/caldera/openssh.spec contrib/redhat/openssh.spec]
274 [contrib/suse/openssh.spec] Update for release
275 - (djm) [README] update relnotes URL
276 - (djm) [packet.c] Restore EWOULDBLOCK handling that got lost somewhere
277 - (djm) Release 5.3p1
278
Darren Tuckere02b49a2009-09-11 14:56:08 +100027920090911
280 - (dtucker) [configure.ac] Change the -lresolv check so it works on Mac OS X
281 10.6 (which doesn't have BIND8_COMPAT and thus uses res_9_query). Patch
282 from jbasney at ncsa uiuc edu.
283
Damien Millere5d5a172009-09-09 11:07:28 +100028420090908
285 - (djm) [serverloop.c] Fix test for server-assigned remote forwarding port
286 (-R 0:...); bz#1578, spotted and fix by gavin AT emf.net; ok dtucker@
287
Darren Tuckerdad48e72009-09-01 18:26:00 +100028820090901
289 - (dtucker) [configure.ac] Bug #1639: use AC_PATH_PROG to search the path for
290 krb5-config if it's not in the location specified by --with-kerberos5.
291 Patch from jchadima at redhat.
292
Darren Tucker427adf12009-08-29 09:14:48 +100029320090829
294 - (dtucker) [README.platform] Add text about development packages, based on
295 text from Chris Pepper in bug #1631.
296
Darren Tucker28b973e2009-08-28 10:16:44 +100029720090828
298 - dtucker [auth-sia.c] Roll back the change for bug #1241 as it apparently
299 causes problems in some Tru64 configurations.
Damien Miller8aac9932009-08-28 10:40:30 +1000300 - (djm) [sshd_config.5] downgrade mention of login.conf to be an example
301 and mention PAM as another provider for ChallengeResponseAuthentication;
302 bz#1408; ok dtucker@
Damien Miller0e265512009-08-28 10:43:13 +1000303 - (djm) [sftp-server.c] bz#1535: accept ENOSYS as a fallback error when
304 attempting atomic rename(); ok dtucker@
Damien Miller7d4a2682009-08-28 10:47:38 +1000305 - (djm) [Makefile.in] bz#1505: Solaris make(1) doesn't accept make variables
306 in argv, so pass them in the environment; ok dtucker@
Darren Tucker3980b632009-08-28 11:02:37 +1000307 - (dtucker) [channels.c configure.ac] Bug #1528: skip the tcgetattr call on
308 the pty master on Solaris, since it never succeeds and can hang if large
309 amounts of data is sent to the slave (eg a copy-paste). Based on a patch
310 originally from Doke Scott, ok djm@
Darren Tucker86e30a02009-08-28 11:21:06 +1000311 - (dtucker) [clientloop.c configure.ac defines.h] Make the client's IO buffer
312 size a compile-time option and set it to 64k on Cygwin, since Corinna
313 reports that it makes a significant difference to performance. ok djm@
Darren Tuckerac9f1b92009-08-28 15:01:20 +1000314 - (dtucker) [configure.ac] Fix the syntax of the Solaris tcgetattr entry.
Darren Tucker28b973e2009-08-28 10:16:44 +1000315
Darren Tucker2a5588d2009-08-20 16:16:01 +100031620090820
317 - (dtucker) [includes.h] Bug #1634: do not include system glob.h if we're not
318 using it since the type conflicts can cause problems on FreeBSD. Patch
319 from Jonathan Chen.
Darren Tucker82edf232009-08-20 16:20:50 +1000320 - (dtucker) [session.c openbsd-compat/port-aix.h] Bugs #1249 and #1567: move
321 the setpcred call on AIX to immediately before the permanently_set_uid().
322 Ensures that we still have privileges when we call chroot and
323 pam_open_sesson. Based on a patch from David Leonard.
Darren Tucker2a5588d2009-08-20 16:16:01 +1000324
Darren Tucker83d8f282009-08-17 09:35:22 +100032520090817
326 - (dtucker) [configure.ac] Check for headers before libraries for openssl an
327 zlib, which should make the errors slightly more meaningful on platforms
328 where there's separate "-devel" packages for those.
Darren Tuckerb5d5ee12009-08-17 09:40:00 +1000329 - (dtucker) [sshlogin.c openbsd-compat/port-aix.{c,h}] Bug #1595: make
330 PrintLastLog work on AIX. Based in part on a patch from Miguel Sanders.
Darren Tucker83d8f282009-08-17 09:35:22 +1000331
Tim Ricecaeb1642009-07-29 07:21:13 -070033220090729
333 - (tim) [contrib/cygwin/ssh-user-config] Change script to call correct error
334 function. Patch from Corinna Vinschen.
335
Darren Tucker440089a2009-07-13 11:38:23 +100033620090713
337 - (dtucker) [openbsd-compat/getrrsetbyname.c] Reduce answer buffer size so it
338 fits into 16 bits to work around a bug in glibc's resolver where it masks
339 off the buffer size at 16 bits. Patch from Hauke Lampe, ok djm jakob.
340
Darren Tuckerc4b22ca2009-07-12 21:56:29 +100034120090712
342 - (dtucker) [configure.ac] Include sys/param.h for the sys/mount.h test,
343 prevents configure complaining on older BSDs.
Darren Tucker8fdcba52009-07-12 21:58:42 +1000344 - (dtucker [contrib/cygwin/ssh-{host,user}-config] Add license text. Patch
345 from Corinna Vinschen.
Darren Tucker622d5c52009-07-12 22:07:21 +1000346 - (dtucker) [auth-pam.c] Bug #1534: move the deletion of PAM credentials on
Darren Tucker916fdda2009-07-12 22:12:28 +1000347 logout to after the session close. Patch from Anicka Bernathova,
348 originally from Andreas Schwab via Novelll ok djm.
Darren Tuckerc4b22ca2009-07-12 21:56:29 +1000349
Darren Tucker4d4fdc02009-07-07 21:19:11 +100035020090707
351 - (dtucker) [contrib/cygwin/ssh-host-config] better support for automated
352 scripts and fix usage of eval. Patch from Corinna Vinschen.
353
35420090705
Darren Tuckere841eb02009-07-06 07:11:13 +1000355 - (dtucker) OpenBSD CVS Sync
356 - andreas@cvs.openbsd.org 2009/06/27 09:29:06
357 [packet.h packet.c]
358 packet_bacup_state() and packet_restore_state() will be used to
359 temporarily save the current state ren resuming a suspended connection.
360 ok markus@
Darren Tucker466df212009-07-06 07:11:52 +1000361 - andreas@cvs.openbsd.org 2009/06/27 09:32:43
362 [roaming_common.c roaming.h]
363 It may be necessary to retransmit some data when resuming, so add it
364 to a buffer when roaming is enabled.
365 Most of this code was written by Martin Forssen, maf at appgate dot com.
366 ok markus@
Darren Tucker71e4d542009-07-06 07:12:27 +1000367 - andreas@cvs.openbsd.org 2009/06/27 09:35:06
368 [readconf.h readconf.c]
369 Add client option UseRoaming. It doesn't do anything yet but will
370 control whether the client tries to use roaming if enabled on the
371 server. From Martin Forssen.
372 ok markus@
Darren Tuckercd6b1a22009-07-06 07:13:04 +1000373 - markus@cvs.openbsd.org 2009/06/30 14:54:40
374 [version.h]
375 crank version; ok deraadt
Darren Tucker199b1342009-07-06 07:16:56 +1000376 - dtucker@cvs.openbsd.org 2009/07/02 02:11:47
377 [ssh.c]
378 allow for long home dir paths (bz #1615). ok deraadt
379 (based in part on a patch from jchadima at redhat)
Darren Tuckerde0c0252009-07-06 07:17:35 +1000380 - stevesk@cvs.openbsd.org 2009/07/05 19:28:33
381 [clientloop.c]
382 only send SSH2_MSG_DISCONNECT if we're in compat20; from dtucker@
383 ok deraadt@ markus@
Darren Tuckere841eb02009-07-06 07:11:13 +1000384
Darren Tucker821d3db2009-06-22 16:11:06 +100038520090622
386 - (dtucker) OpenBSD CVS Sync
387 - dtucker@cvs.openbsd.org 2009/06/22 05:39:28
388 [monitor_wrap.c monitor_mm.c ssh-keygen.c auth2.c gss-genr.c sftp-client.c]
389 alphabetize includes; reduces diff vs portable and style(9).
390 ok stevesk djm
391 (Id sync only; these were already in order in -portable)
392
Darren Tucker72efd742009-06-21 17:48:00 +100039320090621
394 - (dtucker) OpenBSD CVS Sync
395 - markus@cvs.openbsd.org 2009/03/17 21:37:00
396 [ssh.c]
397 pass correct argv[0] to openlog(); ok djm@
Darren Tucker3a6a51f2009-06-21 17:48:52 +1000398 - jmc@cvs.openbsd.org 2009/03/19 15:15:09
399 [ssh.1]
400 for "Ciphers", just point the reader to the keyword in ssh_config(5), just
401 as we do for "MACs": this stops us getting out of sync when the lists
402 change;
403 fixes documentation/6102, submitted by Peter J. Philipp
404 alternative fix proposed by djm
405 ok markus
Darren Tuckera0964502009-06-21 17:49:36 +1000406 - tobias@cvs.openbsd.org 2009/03/23 08:31:19
407 [ssh-agent.c]
408 Fixed a possible out-of-bounds memory access if the environment variable
409 SHELL is shorter than 3 characters.
410 with input by and ok dtucker
Darren Tucker90133232009-06-21 17:50:15 +1000411 - tobias@cvs.openbsd.org 2009/03/23 19:38:04
412 [ssh-agent.c]
413 My previous commit didn't fix the problem at all, so stick at my first
414 version of the fix presented to dtucker.
415 Issue notified by Matthias Barkhoff (matthias dot barkhoff at gmx dot de).
416 ok dtucker
Darren Tucker5837b512009-06-21 17:52:27 +1000417 - sobrado@cvs.openbsd.org 2009/03/26 08:38:39
418 [sftp-server.8 sshd.8 ssh-agent.1]
419 fix a few typographical errors found by spell(1).
420 ok dtucker@, jmc@
Darren Tuckeraf501cf2009-06-21 17:53:04 +1000421 - stevesk@cvs.openbsd.org 2009/04/13 19:07:44
422 [sshd_config.5]
423 fix possessive; ok djm@
Darren Tuckerb62f1a82009-06-21 17:53:48 +1000424 - stevesk@cvs.openbsd.org 2009/04/14 16:33:42
425 [sftp-server.c]
426 remove unused option character from getopt() optstring; ok markus@
Darren Tucker3b59dfa2009-06-21 17:54:47 +1000427 - jj@cvs.openbsd.org 2009/04/14 21:10:54
428 [servconf.c]
429 Fixed a few the-the misspellings in comments. Skipped a bunch in
430 binutils,gcc and so on. ok jmc@
Darren Tuckerac46a912009-06-21 17:55:23 +1000431 - stevesk@cvs.openbsd.org 2009/04/17 19:23:06
432 [session.c]
433 use INTERNAL_SFTP_NAME for setproctitle() of in-process sftp-server;
434 ok djm@ markus@
Darren Tucker00fcd712009-06-21 17:56:00 +1000435 - stevesk@cvs.openbsd.org 2009/04/17 19:40:17
436 [sshd_config.5]
437 clarify that even internal-sftp needs /dev/log for logging to work; ok
438 markus@
Darren Tuckerf92077f2009-06-21 17:56:25 +1000439 - jmc@cvs.openbsd.org 2009/04/18 18:39:10
440 [sshd_config.5]
441 tweak previous; ok stevesk
Darren Tucker51dbe502009-06-21 17:56:51 +1000442 - stevesk@cvs.openbsd.org 2009/04/21 15:13:17
443 [sshd_config.5]
444 clarify we cd to user's home after chroot; ok markus@ on
445 earlier version; tweaks and ok jmc@
Darren Tuckerf7288d72009-06-21 18:12:20 +1000446 - andreas@cvs.openbsd.org 2009/05/25 06:48:01
447 [channels.c packet.c clientloop.c packet.h serverloop.c monitor_wrap.c
448 monitor.c]
449 Put the globals in packet.c into a struct and don't access it directly
450 from other files. No functional changes.
451 ok markus@ djm@
452 - andreas@cvs.openbsd.org 2009/05/27 06:31:25
453 [canohost.h canohost.c]
454 Add clear_cached_addr(), needed for upcoming changes allowing the peer
455 address to change.
456 ok markus@
Darren Tucker39c76322009-06-21 18:13:57 +1000457 - andreas@cvs.openbsd.org 2009/05/27 06:33:39
458 [clientloop.c]
459 Send SSH2_MSG_DISCONNECT when the client disconnects. From a larger
460 change from Martin Forssen, maf at appgate dot com.
461 ok markus@
Darren Tucker12b4a652009-06-21 18:14:48 +1000462 - andreas@cvs.openbsd.org 2009/05/27 06:34:36
463 [kex.c kex.h]
464 Move the KEX_COOKIE_LEN define to kex.h
465 ok markus@
Darren Tucker5b48cdd2009-06-21 18:15:25 +1000466 - andreas@cvs.openbsd.org 2009/05/27 06:36:07
467 [packet.h packet.c]
468 Add packet_put_int64() and packet_get_int64(), part of a larger change
469 from Martin Forssen.
Darren Tucker761c3892009-06-21 18:16:26 +1000470 ok markus@
471 - andreas@cvs.openbsd.org 2009/05/27 06:38:16
472 [sshconnect.h sshconnect.c]
473 Un-static ssh_exchange_identification(), part of a larger change from
474 Martin Forssen and needed for upcoming changes.
475 ok markus@
Darren Tucker1cc55d72009-06-21 18:17:19 +1000476 - andreas@cvs.openbsd.org 2009/05/28 16:50:16
477 [sshd.c packet.c serverloop.c monitor_wrap.c clientloop.c sshconnect.c
Darren Tuckerc5564e12009-06-21 18:53:53 +1000478 monitor.c Added roaming.h roaming_common.c roaming_dummy.c]
Darren Tucker1cc55d72009-06-21 18:17:19 +1000479 Keep track of number of bytes read and written. Needed for upcoming
480 changes. Most code from Martin Forssen, maf at appgate dot com.
481 ok markus@
Darren Tuckerc5564e12009-06-21 18:53:53 +1000482 Also, applied appropriate changes to Makefile.in
Darren Tuckerb422afa2009-06-21 18:58:46 +1000483 - andreas@cvs.openbsd.org 2009/06/12 20:43:22
484 [monitor.c packet.c]
485 Fix warnings found by chl@ and djm@ and change roaming_atomicio's
486 return type to match atomicio's
487 Diff from djm@, ok markus@
Darren Tucker7b935c72009-06-21 18:59:36 +1000488 - andreas@cvs.openbsd.org 2009/06/12 20:58:32
489 [packet.c]
490 Move some more statics into session_state
491 ok markus@ djm@
Darren Tucker6ae35ac2009-06-21 19:00:20 +1000492 - dtucker@cvs.openbsd.org 2009/06/21 07:37:15
493 [kexdhs.c kexgexs.c]
494 abort if key_sign fails, preventing possible null deref. Based on report
495 from Paolo Ganci, ok markus@ djm@
Darren Tuckere6b590e2009-06-21 19:08:48 +1000496 - dtucker@cvs.openbsd.org 2009/06/21 09:04:03
497 [roaming.h roaming_common.c roaming_dummy.c]
498 Add tags for the benefit of the sync scripts
499 Also: pull in the changes for 1.1->1.2 missed in the previous sync.
Darren Tucker43e7a352009-06-21 19:50:08 +1000500 - (dtucker) [auth2-jpake.c auth2.c canohost.h session.c] Whitespace and
501 header-order changes to reduce diff vs OpenBSD.
Darren Tucker64cee362009-06-21 20:26:17 +1000502 - (dtucker) [servconf.c sshd.c] More whitespace sync.
Darren Tucker828c96d2009-06-21 22:22:08 +1000503 - (dtucker) [roaming_common.c roaming_dummy.c] Wrap #include <inttypes.h> in
504 ifdef.
Darren Tucker72efd742009-06-21 17:48:00 +1000505
Darren Tucker32780622009-06-16 16:11:02 +100050620090616
507 - (dtucker) [configure.ac defines.h] Bug #1607: handle the case where fsid_t
508 is a struct with a __val member. Fixes build on, eg, Redhat 6.2.
509
Darren Tuckera422d972009-05-04 12:52:47 +100051020090504
511 - (dtucker) [sshlogin.c] Move the NO_SSH_LASTLOG #ifndef line to include
512 variable declarations. Should prevent unused warnings anywhere it's set
513 (only Crays as far as I can tell) and be a no-op everywhere else.
514
Tim Ricea74000e2009-03-18 11:25:02 -070051520090318
516 - (tim) [configure.ac] Remove setting IP_TOS_IS_BROKEN for Cygwin. The problem
517 that setsockopt(IP_TOS) doesn't work on Cygwin has been fixed since 2005.
518 Based on patch from vinschen at redhat com.
519
Darren Tucker9d86e5d2009-03-08 11:40:27 +110052020090308
521 - (dtucker) [auth-passwd.c auth1.c auth2-kbdint.c auth2-none.c auth2-passwd.c
522 auth2-pubkey.c session.c openbsd-compat/bsd-cygwin_util.{c,h}
523 openbsd-compat/daemon.c] Remove support for Windows 95/98/ME and very old
524 version of Cygwin. Patch from vinschen at redhat com.
525
Darren Tucker558d6ca2009-03-07 10:22:10 +110052620090307
527 - (dtucker) [contrib/aix/buildbff.sh] Only try to rename ssh_prng_cmds if it
528 exists (it's not created if OpenSSL's PRNG is self-seeded, eg if the OS
529 has a /dev/random).
Darren Tucker8aae6ff2009-03-07 12:01:47 +1100530 - (dtucker) [schnorr.c openbsd-compat/openssl-compat.{c,h}] Add
531 EVP_DigestUpdate to the OLD_EVP compatibility functions and tell schnorr.c
532 to use them. Allows building with older OpenSSL versions.
Darren Tuckerccfee052009-03-07 12:32:22 +1100533 - (dtucker) [configure.ac defines.h] Check for in_port_t and typedef if needed.
Darren Tucker30ed6682009-03-07 18:06:22 +1100534 - (dtucker) [configure.ac] Missing comma in type list.
Darren Tucker3e7e15f2009-03-07 22:22:35 +1100535 - (dtucker) [configure.ac openbsd-compat/openssl-compat.{c,h}]
536 EVP_DigestUpdate does not exactly match the other OLD_EVP functions (eg
537 in openssl 0.9.6) so add an explicit test for it.
Darren Tucker558d6ca2009-03-07 10:22:10 +1100538
Damien Millercee85232009-03-06 00:58:22 +110053920090306
540 - (djm) OpenBSD CVS Sync
541 - djm@cvs.openbsd.org 2009/03/05 07:18:19
542 [auth2-jpake.c jpake.c jpake.h monitor_wrap.c monitor_wrap.h schnorr.c]
543 [sshconnect2.c]
544 refactor the (disabled) Schnorr proof code to make it a little more
545 generally useful
Damien Miller447e3872009-03-06 00:58:39 +1100546 - djm@cvs.openbsd.org 2009/03/05 11:30:50
547 [uuencode.c]
548 document what these functions do so I don't ever have to recuse into
549 b64_pton/ntop to remember their return values
Damien Millercee85232009-03-06 00:58:22 +1100550
Damien Miller19913842009-02-23 10:53:58 +110055120090223
552 - (djm) OpenBSD CVS Sync
553 - djm@cvs.openbsd.org 2009/02/22 23:50:57
554 [ssh_config.5 sshd_config.5]
555 don't advertise experimental options
Damien Miller0296ae82009-02-23 11:00:24 +1100556 - djm@cvs.openbsd.org 2009/02/22 23:59:25
557 [sshd_config.5]
558 missing period
Damien Miller582ca6b2009-02-23 11:09:25 +1100559 - djm@cvs.openbsd.org 2009/02/23 00:06:15
560 [version.h]
561 openssh-5.2
Damien Miller5d0d5302009-02-23 11:11:57 +1100562 - (djm) [README] update for 5.2
Damien Millerfaec50b2009-02-23 11:12:29 +1100563 - (djm) Release openssh-5.2p1
Damien Miller19913842009-02-23 10:53:58 +1100564
Damien Miller9eab9562009-02-22 08:47:02 +110056520090222
566 - (djm) OpenBSD CVS Sync
567 - tobias@cvs.openbsd.org 2009/02/21 19:32:04
568 [misc.c sftp-server-main.c ssh-keygen.c]
569 Added missing newlines in error messages.
570 ok dtucker
571
Damien Millere8001d42009-02-21 12:45:02 +110057220090221
573 - (djm) OpenBSD CVS Sync
574 - djm@cvs.openbsd.org 2009/02/17 01:28:32
575 [ssh_config]
576 sync with revised default ciphers; pointed out by dkrause@
Damien Miller25918382009-02-21 12:45:18 +1100577 - djm@cvs.openbsd.org 2009/02/18 04:31:21
578 [schnorr.c]
579 signature should hash over the entire group, not just the generator
580 (this is still disabled code)
Damien Miller7691e5f2009-02-21 18:03:04 +1100581 - (djm) [contrib/caldera/openssh.spec contrib/redhat/openssh.spec]
582 [contrib/suse/openssh.spec] Prepare for 5.2p1
Damien Millere8001d42009-02-21 12:45:02 +1100583
Damien Miller3f94aaf2009-02-16 15:21:39 +110058420090216
585 - (djm) [regress/conch-ciphers.sh regress/putty-ciphers.sh]
586 [regress/putty-kex.sh regress/putty-transfer.sh] Downgrade disabled
587 interop tests from FATAL error to a warning. Allows some interop
588 tests to proceed if others are missing necessary prerequisites.
Damien Miller90551722009-02-16 15:37:03 +1100589 - (djm) [configure.ac] support GNU/kFreeBSD and GNU/kOpensolaris
590 systems; patch from Aurelien Jarno via rmh AT aybabtu.com
Damien Miller3f94aaf2009-02-16 15:21:39 +1100591
Damien Millerfdd66fc2009-02-14 16:26:19 +110059220090214
593 - (djm) OpenBSD CVS Sync
594 - dtucker@cvs.openbsd.org 2009/02/02 11:15:14
595 [sftp.c]
596 Initialize a few variables to prevent spurious "may be used
597 uninitialized" warnings from newer gcc's. ok djm@
Damien Miller4bf648f2009-02-14 16:28:21 +1100598 - djm@cvs.openbsd.org 2009/02/12 03:00:56
599 [canohost.c canohost.h channels.c channels.h clientloop.c readconf.c]
600 [readconf.h serverloop.c ssh.c]
601 support remote port forwarding with a zero listen port (-R0:...) to
602 dyamically allocate a listen port at runtime (this is actually
603 specified in rfc4254); bz#1003 ok markus@
Damien Miller330d5852009-02-14 16:33:09 +1100604 - djm@cvs.openbsd.org 2009/02/12 03:16:01
605 [serverloop.c]
606 tighten check for -R0:... forwarding: only allow dynamic allocation
607 if want_reply is set in the packet
Damien Miller923e8bb2009-02-14 16:33:31 +1100608 - djm@cvs.openbsd.org 2009/02/12 03:26:22
609 [monitor.c]
610 some paranoia: check that the serialised key is really KEY_RSA before
611 diddling its internals
Damien Millere2f4cc52009-02-14 16:33:49 +1100612 - djm@cvs.openbsd.org 2009/02/12 03:42:09
613 [ssh.1]
614 document -R0:... usage
Damien Miller65fa4ca2009-02-14 16:34:05 +1100615 - djm@cvs.openbsd.org 2009/02/12 03:44:25
616 [ssh.1]
617 consistency: Dq => Ql
Damien Miller85c6d8a2009-02-14 16:34:21 +1100618 - djm@cvs.openbsd.org 2009/02/12 03:46:17
619 [ssh_config.5]
620 document RemoteForward usage with 0 listen port
Damien Millere379e102009-02-14 16:34:39 +1100621 - jmc@cvs.openbsd.org 2009/02/12 07:34:20
622 [ssh_config.5]
623 kill trailing whitespace;
Damien Miller61433be2009-02-14 16:35:01 +1100624 - markus@cvs.openbsd.org 2009/02/13 11:50:21
625 [packet.c]
626 check for enc !=NULL in packet_start_discard
Damien Miller6385e752009-02-14 18:00:52 +1100627 - djm@cvs.openbsd.org 2009/02/14 06:35:49
628 [PROTOCOL]
629 mention that eow and no-more-sessions extensions are sent only to
630 OpenSSH peers
Damien Millerfdd66fc2009-02-14 16:26:19 +1100631
63220090212
Damien Miller2de76242009-02-12 12:19:20 +1100633 - (djm) [sshpty.c] bz#1419: OSX uses cloning ptys that automagically
634 set ownership and modes, so avoid explicitly setting them
Damien Miller20e231f2009-02-12 13:12:21 +1100635 - (djm) [configure.ac loginrec.c] bz#1421: fix lastlog support for OSX.
636 OSX provides a getlastlogxbyname function that automates the reading of
637 a lastlog file. Also, the pututxline function will update lastlog so
638 there is no need for loginrec.c to do it explicitly. Collapse some
639 overly verbose code while I'm in there.
Damien Miller2de76242009-02-12 12:19:20 +1100640
Darren Tucker642ebe52009-02-01 22:19:54 +110064120090201
642 - (dtucker) [defines.h sshconnect.c] INET6_ADDRSTRLEN is now needed in
643 channels.c too, so move the definition for non-IP6 platforms to defines.h
644 where it can be shared.
645
Tim Rice6a325342009-01-29 12:30:01 -080064620090129
647 - (tim) [contrib/cygwin/ssh-host-config] Patch from Corinna Vinschen.
648 If the CYGWIN environment variable is empty, the installer script
649 should not install the service with an empty CYGWIN variable, but
650 rather without setting CYGWNI entirely.
Tim Rice0d8f2f32009-01-29 12:40:30 -0800651 - (tim) [contrib/cygwin/ssh-host-config] Whitespace cleanup. No code changes.
Tim Rice6a325342009-01-29 12:30:01 -0800652
Tim Riceca3692d2009-01-28 12:50:04 -080065320090128
654 - (tim) [contrib/cygwin/ssh-host-config] Patch from Corinna Vinschen.
655 Changes to work on Cygwin 1.5.x as well as on the new Cygwin 1.7.x.
656 The information given for the setting of the CYGWIN environment variable
657 is wrong for both releases so I just removed it, together with the
658 unnecessary (Cygwin 1.5.x) or wrong (Cygwin 1.7.x) default setting.
659
Damien Millerb53d8a12009-01-28 16:13:04 +110066020081228
661 - (djm) OpenBSD CVS Sync
662 - stevesk@cvs.openbsd.org 2008/12/09 03:20:42
663 [channels.c servconf.c]
664 channel_print_adm_permitted_opens() should deal with all the printing
665 for that config option. suggested by markus@; ok markus@ djm@
666 dtucker@
Damien Millerc30def92009-01-28 16:13:39 +1100667 - djm@cvs.openbsd.org 2008/12/09 04:32:22
668 [auth2-chall.c]
669 replace by-hand string building with xasprinf(); ok deraadt@
Damien Miller62fd18a2009-01-28 16:14:09 +1100670 - sobrado@cvs.openbsd.org 2008/12/09 15:35:00
671 [sftp.1 sftp.c]
672 update for the synopses displayed by the 'help' command, there are a
673 few missing flags; add 'bye' to the output of 'help'; sorting and spacing.
674 jmc@ suggested replacing .Oo/.Oc with a single .Op macro.
675 ok jmc@
Damien Millerb3f2c9f2009-01-28 16:15:30 +1100676 - stevesk@cvs.openbsd.org 2008/12/09 22:37:33
677 [clientloop.c]
678 fix typo in error message
Damien Miller7375fe22009-01-28 16:16:00 +1100679 - stevesk@cvs.openbsd.org 2008/12/10 03:55:20
680 [addrmatch.c]
681 o cannot be NULL here but use xfree() to be consistent; ok djm@
Damien Millerb2c17d42009-01-28 16:18:03 +1100682 - stevesk@cvs.openbsd.org 2008/12/29 01:12:36
683 [ssh-keyscan.1]
684 fix example, default key type is rsa for 3+ years; from
685 frederic.perrin@resel.fr
Damien Millera70ac762009-01-28 16:19:52 +1100686 - stevesk@cvs.openbsd.org 2008/12/29 02:23:26
687 [pathnames.h]
688 no need to escape single quotes in comments
Damien Miller17819012009-01-28 16:20:17 +1100689 - okan@cvs.openbsd.org 2008/12/30 00:46:56
690 [sshd_config.5]
691 add AllowAgentForwarding to available Match keywords list
692 ok djm
Damien Miller7a606212009-01-28 16:22:34 +1100693 - djm@cvs.openbsd.org 2009/01/01 21:14:35
694 [channels.c]
695 call channel destroy callbacks on receipt of open failure messages.
696 fixes client hangs when connecting to a server that has MaxSessions=0
697 set spotted by imorgan AT nas.nasa.gov; ok markus@
Damien Millerccf7e222009-01-28 16:23:06 +1100698 - djm@cvs.openbsd.org 2009/01/01 21:17:36
699 [kexgexs.c]
700 fix hash calculation for KEXGEX: hash over the original client-supplied
701 values and not the sanity checked versions that we acutally use;
702 bz#1540 reported by john.smith AT arrows.demon.co.uk
703 ok markus@
Damien Miller1781f532009-01-28 16:24:41 +1100704 - djm@cvs.openbsd.org 2009/01/14 01:38:06
705 [channels.c]
706 support SOCKS4A protocol, from dwmw2 AT infradead.org via bz#1482;
707 "looks ok" markus@
Damien Miller5bc6aae2009-01-28 16:27:31 +1100708 - stevesk@cvs.openbsd.org 2009/01/15 17:38:43
709 [readconf.c]
710 1) use obsolete instead of alias for consistency
711 2) oUserKnownHostsFile not obsolete but oGlobalKnownHostsFile2 is
712 so move the comment.
713 3) reorder so like options are together
714 ok djm@
Damien Millera1c1b6c2009-01-28 16:29:49 +1100715 - djm@cvs.openbsd.org 2009/01/22 09:46:01
716 [channels.c channels.h session.c]
717 make Channel->path an allocated string, saving a few bytes here and
718 there and fixing bz#1380 in the process; ok markus@
Damien Miller9576ac42009-01-28 16:30:33 +1100719 - djm@cvs.openbsd.org 2009/01/22 09:49:57
720 [channels.c]
721 oops! I committed the wrong version of the Channel->path diff,
722 it was missing some tweaks suggested by stevesk@
Damien Miller3dc71ad2009-01-28 16:31:22 +1100723 - djm@cvs.openbsd.org 2009/01/22 10:02:34
724 [clientloop.c misc.c readconf.c readconf.h servconf.c servconf.h]
725 [serverloop.c ssh-keyscan.c ssh.c sshd.c]
726 make a2port() return -1 when it encounters an invalid port number
727 rather than 0, which it will now treat as valid (needed for future work)
728 adjust current consumers of a2port() to check its return value is <= 0,
729 which in turn required some things to be converted from u_short => int
730 make use of int vs. u_short consistent in some other places too
731 feedback & ok markus@
Damien Millere37dde02009-01-28 16:33:01 +1100732 - djm@cvs.openbsd.org 2009/01/22 10:09:16
733 [auth-options.c]
734 another chunk of a2port() diff that got away. wtfdjm??
Damien Miller67081b52009-01-28 16:33:31 +1100735 - djm@cvs.openbsd.org 2009/01/23 07:58:11
736 [myproposal.h]
737 prefer CTR modes and revised arcfour (i.e w/ discard) modes to CBC
738 modes; ok markus@
Damien Miller9aa72ba2009-01-28 16:34:00 +1100739 - naddy@cvs.openbsd.org 2009/01/24 17:10:22
740 [ssh_config.5 sshd_config.5]
741 sync list of preferred ciphers; ok djm@
Damien Miller13ae44c2009-01-28 16:38:41 +1100742 - markus@cvs.openbsd.org 2009/01/26 09:58:15
743 [cipher.c cipher.h packet.c]
744 Work around the CPNI-957037 Plaintext Recovery Attack by always
745 reading 256K of data on packet size or HMAC errors (in CBC mode only).
746 Help, feedback and ok djm@
747 Feedback from Martin Albrecht and Paterson Kenny
Damien Millerb53d8a12009-01-28 16:13:04 +1100748
Tim Rice351529c2009-01-07 10:04:12 -080074920090107
Damien Miller1598d6b2009-01-21 16:04:24 +1100750 - (djm) [uidswap.c] bz#1412: Support >16 supplemental groups in OS X.
751 Patch based on one from vgiffin AT apple.com; ok dtucker@
Damien Miller819dbb62009-01-21 16:46:26 +1100752 - (djm) [channels.c] bz#1419: support "on demand" X11 forwarding via
753 launchd on OS X; patch from vgiffin AT apple.com, slightly tweaked;
754 ok dtucker@
Damien Miller02666772009-01-21 20:29:20 +1100755 - (djm) [contrib/ssh-copy-id.1 contrib/ssh-copy-id] bz#1492: Make
756 ssh-copy-id copy id_rsa.pub by default (instead of the legacy "identity"
757 key). Patch from cjwatson AT debian.org
Damien Miller1598d6b2009-01-21 16:04:24 +1100758
75920090107
Tim Rice351529c2009-01-07 10:04:12 -0800760 - (tim) [configure.ac defines.h openbsd-compat/port-uw.c
761 openbsd-compat/xcrypt.c] Add SECUREWARE support to OpenServer 6 SVR5 ABI.
762 OK djm@ dtucker@
Tim Rice26767912009-01-07 20:50:08 -0800763 - (tim) [configure.ac] Move check_for_libcrypt_later=1 in *-*-sysv5*) section.
764 OpenServer 6 doesn't need libcrypt.
Tim Rice351529c2009-01-07 10:04:12 -0800765
Damien Miller586b0052008-12-09 14:11:32 +110076620081209
767 - (djm) OpenBSD CVS Sync
768 - djm@cvs.openbsd.org 2008/12/09 02:38:18
769 [clientloop.c]
770 The ~C escape handler does not work correctly for multiplexed sessions -
771 it opens a commandline on the master session, instead of on the slave
772 that requested it. Disable it on slave sessions until such time as it
773 is fixed; bz#1543 report from Adrian Bridgett via Colin Watson
774 ok markus@
Damien Miller1be2cc42008-12-09 14:11:49 +1100775 - djm@cvs.openbsd.org 2008/12/09 02:39:59
776 [sftp.c]
777 Deal correctly with failures in remote stat() operation in sftp,
778 correcting fail-on-error behaviour in batchmode. bz#1541 report and
779 fix from anedvedicky AT gmail.com; ok markus@
Damien Miller0d772d92008-12-09 14:12:05 +1100780 - djm@cvs.openbsd.org 2008/12/09 02:58:16
781 [readconf.c]
782 don't leave junk (free'd) pointers around in Forward *fwd argument on
783 failure; avoids double-free in ~C -L handler when given an invalid
784 forwarding specification; bz#1539 report from adejong AT debian.org
785 via Colin Watson; ok markus@ dtucker@
Damien Miller7ebfad72008-12-09 14:12:33 +1100786 - djm@cvs.openbsd.org 2008/12/09 03:02:37
787 [sftp.1 sftp.c]
788 correct sftp(1) and corresponding usage syntax;
789 bz#1518 patch from imorgan AT nas.nasa.gov; ok deraadt@ improved diff jmc@
Damien Miller586b0052008-12-09 14:11:32 +1100790
Damien Miller7df2e402008-12-08 09:35:36 +110079120081208
792 - (djm) [configure.ac] bz#1538: better test for ProPolice/SSP: actually
793 use some stack in main().
794 Report and suggested fix from vapier AT gentoo.org
Damien Miller8533c782008-12-08 09:54:40 +1100795 - (djm) OpenBSD CVS Sync
796 - markus@cvs.openbsd.org 2008/12/02 19:01:07
797 [clientloop.c]
798 we have to use the recipient's channel number (RFC 4254) for
799 SSH2_MSG_CHANNEL_SUCCESS/SSH2_MSG_CHANNEL_FAILURE messages,
800 otherwise we trigger 'Non-public channel' error messages on sshd
801 systems with clientkeepalive enabled; noticed by sturm; ok djm;
Damien Miller5a33ec62008-12-08 09:55:02 +1100802 - markus@cvs.openbsd.org 2008/12/02 19:08:59
803 [serverloop.c]
804 backout 1.149, since it's not necessary and openssh clients send
805 broken CHANNEL_FAILURE/SUCCESS messages since about 2004; ok djm@
Damien Miller16a73072008-12-08 09:55:25 +1100806 - markus@cvs.openbsd.org 2008/12/02 19:09:38
807 [channels.c]
808 s/remote_id/id/ to be more consistent with other code; ok djm@
Damien Miller7df2e402008-12-08 09:35:36 +1100809
Darren Tucker83795d62008-12-01 21:34:28 +110081020081201
811 - (dtucker) [contrib/cygwin/{Makefile,ssh-host-config}] Add new doc files
812 and tweak the is-sshd-running check in ssh-host-config. Patch from
813 vinschen at redhat com.
Darren Tucker99d11a32008-12-01 21:40:48 +1100814 - (dtucker) OpenBSD CVS Sync
815 - markus@cvs.openbsd.org 2008/11/21 15:47:38
816 [packet.c]
817 packet_disconnect() on padding error, too. should reduce the success
818 probability for the CPNI-957037 Plaintext Recovery Attack to 2^-18
819 ok djm@
Darren Tucker23645642008-12-01 21:42:13 +1100820 - dtucker@cvs.openbsd.org 2008/11/30 11:59:26
821 [monitor_fdpass.c]
822 Retry sendmsg/recvmsg on EAGAIN and EINTR; ok djm@
Darren Tucker83795d62008-12-01 21:34:28 +1100823
Darren Tucker69087ea2008-11-23 14:03:19 +110082420081123
825 - (dtucker) [monitor_fdpass.c] Reduce diff vs OpenBSD by moving some
826 declarations, removing an unnecessary union member and adding whitespace.
Darren Tuckerd3782b42008-11-23 19:05:53 +1100827 cmsgbuf.tmp thing spotted by des at des no, ok djm some time ago.
Darren Tucker69087ea2008-11-23 14:03:19 +1100828
Tim Rice0f4d2c02008-11-18 21:26:41 -080082920081118
830 - (tim) [addrmatch.c configure.ac] Some platforms do not have sin6_scope_id
831 member of sockaddr_in6. Also reported in Bug 1491 by David Leonard. OK and
832 feedback by djm@
833
Darren Tuckerff4350e2008-11-11 16:31:05 +110083420081111
835 - (dtucker) OpenBSD CVS Sync
836 - jmc@cvs.openbsd.org 2008/11/05 11:22:54
837 [servconf.c]
838 passord -> password;
839 fixes user/5975 from Rene Maroufi
Darren Tuckere15fb092008-11-11 16:31:43 +1100840 - stevesk@cvs.openbsd.org 2008/11/07 00:42:12
841 [ssh-keygen.c]
842 spelling/typo in comment
Darren Tuckerb57fab62008-11-11 16:32:25 +1100843 - stevesk@cvs.openbsd.org 2008/11/07 18:50:18
844 [nchan.c]
845 add space to some log/debug messages for readability; ok djm@ markus@
Darren Tuckerc6d744e2008-11-11 16:33:03 +1100846 - dtucker@cvs.openbsd.org 2008/11/07 23:34:48
847 [auth2-jpake.c]
848 Move JPAKE define to make life easier for portable. ok djm@
Darren Tucker63917bd2008-11-11 16:33:48 +1100849 - tobias@cvs.openbsd.org 2008/11/09 12:34:47
850 [session.c ssh.1]
851 typo fixed (overriden -> overridden)
852 ok espie, jmc
Darren Tucker49c31c42008-11-11 16:39:44 +1100853 - stevesk@cvs.openbsd.org 2008/11/11 02:58:09
854 [servconf.c]
855 USE_AFS not referenced so remove #ifdef. fixes sshd -T not printing
856 kerberosgetafstoken. ok dtucker@
857 (Id sync only, we still want the ifdef in portable)
Darren Tucker22662e82008-11-11 16:40:22 +1100858 - stevesk@cvs.openbsd.org 2008/11/11 03:55:11
859 [channels.c]
860 for sshd -T print 'permitopen any' vs. 'permitopen' for case of no
861 permitopen's; ok and input dtucker@
Darren Tucker4a6f62d2008-11-11 16:55:25 +1100862 - djm@cvs.openbsd.org 2008/11/10 02:06:35
863 [regress/putty-ciphers.sh]
864 PuTTY supports AES CTR modes, so interop test against them too
Darren Tuckerff4350e2008-11-11 16:31:05 +1100865
Damien Miller7fc5c0f2008-11-05 16:12:11 +110086620081105
867 - OpenBSD CVS Sync
868 - djm@cvs.openbsd.org 2008/11/03 08:59:41
869 [servconf.c]
870 include MaxSessions in sshd -T output; patch from imorgan AT nas.nasa.gov
Damien Miller6f66d342008-11-05 16:12:54 +1100871 - djm@cvs.openbsd.org 2008/11/04 07:58:09
872 [auth.c]
873 need unistd.h for close() prototype
874 (ID sync only)
Damien Miller01ed2272008-11-05 16:20:46 +1100875 - djm@cvs.openbsd.org 2008/11/04 08:22:13
876 [auth.h auth2.c monitor.c monitor.h monitor_wrap.c monitor_wrap.h]
877 [readconf.c readconf.h servconf.c servconf.h ssh2.h ssh_config.5]
878 [sshconnect2.c sshd_config.5 jpake.c jpake.h schnorr.c auth2-jpake.c]
879 [Makefile.in]
880 Add support for an experimental zero-knowledge password authentication
881 method using the J-PAKE protocol described in F. Hao, P. Ryan,
882 "Password Authenticated Key Exchange by Juggling", 16th Workshop on
883 Security Protocols, Cambridge, April 2008.
884
885 This method allows password-based authentication without exposing
886 the password to the server. Instead, the client and server exchange
887 cryptographic proofs to demonstrate of knowledge of the password while
888 revealing nothing useful to an attacker or compromised endpoint.
889
890 This is experimental, work-in-progress code and is presently
891 compiled-time disabled (turn on -DJPAKE in Makefile.inc).
892
893 "just commit it. It isn't too intrusive." deraadt@
Damien Miller1a0442f2008-11-05 16:30:06 +1100894 - stevesk@cvs.openbsd.org 2008/11/04 19:18:00
895 [readconf.c]
896 because parse_forward() is now used to parse all forward types (DLR),
897 and it malloc's space for host variables, we don't need to malloc
898 here. fixes small memory leaks.
899
900 previously dynamic forwards were not parsed in parse_forward() and
901 space was not malloc'd in that case.
902
903 ok djm@
Damien Miller0164cb82008-11-05 16:30:31 +1100904 - stevesk@cvs.openbsd.org 2008/11/05 03:23:09
905 [clientloop.c ssh.1]
906 add dynamic forward escape command line; ok djm@
Damien Miller7fc5c0f2008-11-05 16:12:11 +1100907
Damien Miller9f6fb562008-11-03 19:15:44 +110090820081103
909 - OpenBSD CVS Sync
910 - sthen@cvs.openbsd.org 2008/07/24 23:55:30
911 [ssh-keygen.1]
912 Add "ssh-keygen -F -l" to synopsis (displays fingerprint from
913 known_hosts). ok djm@
914 - grunk@cvs.openbsd.org 2008/07/25 06:56:35
915 [ssh_config]
916 Add VisualHostKey to example file, ok djm@
Damien Millerc6aadd92008-11-03 19:16:20 +1100917 - grunk@cvs.openbsd.org 2008/07/25 07:05:16
918 [key.c]
919 In random art visualization, make sure to use the end marker only at the
920 end. Initial diff by Dirk Loss, tweaks and ok djm@
Damien Millerc674d582008-11-03 19:16:57 +1100921 - markus@cvs.openbsd.org 2008/07/31 14:48:28
922 [sshconnect2.c]
923 don't allocate space for empty banners; report t8m at centrum.cz;
924 ok deraadt
Damien Millerfa51b162008-11-03 19:17:33 +1100925 - krw@cvs.openbsd.org 2008/08/02 04:29:51
926 [ssh_config.5]
927 whitepsace -> whitespace. From Matthew Clarke via bugs@.
Damien Millerad793d52008-11-03 19:17:57 +1100928 - djm@cvs.openbsd.org 2008/08/21 04:09:57
929 [session.c]
930 allow ForceCommand internal-sftp with arguments. based on patch from
931 michael.barabanov AT gmail.com; ok markus@
Damien Miller15bce6b2008-11-03 19:19:12 +1100932 - djm@cvs.openbsd.org 2008/09/06 12:24:13
933 [kex.c]
934 OpenSSL 0.9.8h supplies a real EVP_sha256 so we do not need our
935 replacement anymore
936 (ID sync only for portable - we still need this)
Damien Miller456e6f02008-11-03 19:20:10 +1100937 - markus@cvs.openbsd.org 2008/09/11 14:22:37
938 [compat.c compat.h nchan.c ssh.c]
939 only send eow and no-more-sessions requests to openssh 5 and newer;
940 fixes interop problems with broken ssh v2 implementations; ok djm@
Damien Millerd58f5602008-11-03 19:20:49 +1100941 - millert@cvs.openbsd.org 2008/10/02 14:39:35
942 [session.c]
943 Convert an unchecked strdup to xstrdup. OK deraadt@
Damien Miller49b78d42008-11-03 19:21:21 +1100944 - jmc@cvs.openbsd.org 2008/10/03 13:08:12
945 [sshd.8]
946 do not give an example of how to chmod files: we can presume the user
947 knows that. removes an ambiguity in the permission of authorized_keys;
948 ok deraadt
Damien Millerc4d1b362008-11-03 19:22:09 +1100949 - deraadt@cvs.openbsd.org 2008/10/03 23:56:28
950 [sshconnect2.c]
951 Repair strnvis() buffersize of 4*n+1, with termination gauranteed by the
952 function.
953 spotted by des@freebsd, who commited an incorrect fix to the freebsd tree
954 and (as is fairly typical) did not report the problem to us. But this fix
955 is correct.
956 ok djm
Damien Millere272a5b2008-11-03 19:22:37 +1100957 - djm@cvs.openbsd.org 2008/10/08 23:34:03
958 [ssh.1 ssh.c]
959 Add -y option to force logging via syslog rather than stderr.
960 Useful for daemonised ssh connection (ssh -f). Patch originally from
961 and ok'd by markus@
Damien Miller51bde602008-11-03 19:23:10 +1100962 - djm@cvs.openbsd.org 2008/10/09 03:50:54
963 [servconf.c sshd_config.5]
964 support setting PermitEmptyPasswords in a Match block
965 requested in PR3891; ok dtucker@
Damien Millerc13c3ee2008-11-03 19:23:28 +1100966 - jmc@cvs.openbsd.org 2008/10/09 06:54:22
967 [ssh.c]
968 add -y to usage();
Damien Millerb4acb472008-11-03 19:23:45 +1100969 - stevesk@cvs.openbsd.org 2008/10/10 04:55:16
970 [scp.c]
971 spelling in comment; ok djm@
Damien Miller2f54ada2008-11-03 19:24:16 +1100972 - stevesk@cvs.openbsd.org 2008/10/10 05:00:12
973 [key.c]
974 typo in error message; ok djm@
Damien Millerece92c82008-11-03 19:25:03 +1100975 - stevesk@cvs.openbsd.org 2008/10/10 16:43:27
976 [ssh_config.5]
977 use 'Privileged ports can be forwarded only when logging in as root on
978 the remote machine.' for RemoteForward just like ssh.1 -R.
979 ok djm@ jmc@
980 - stevesk@cvs.openbsd.org 2008/10/14 18:11:33
981 [sshconnect.c]
982 use #define ROQUIET here; no binary change. ok dtucker@
Damien Millera414cd32008-11-03 19:25:21 +1100983 - stevesk@cvs.openbsd.org 2008/10/17 18:36:24
984 [ssh_config.5]
985 correct and clarify VisualHostKey; ok jmc@
Damien Millere7261c72008-11-03 19:25:40 +1100986 - stevesk@cvs.openbsd.org 2008/10/30 19:31:16
987 [clientloop.c sshd.c]
988 don't need to #include "monitor_fdpass.h"
Damien Miller2b20a922008-11-03 19:26:00 +1100989 - stevesk@cvs.openbsd.org 2008/10/31 15:05:34
990 [dispatch.c]
991 remove unused #define DISPATCH_MIN; ok markus@
Damien Millerf7475d72008-11-03 19:26:18 +1100992 - djm@cvs.openbsd.org 2008/11/01 04:50:08
993 [sshconnect2.c]
994 sprinkle ARGSUSED on dispatch handlers
995 nuke stale unusued prototype
Damien Millera0094332008-11-03 19:26:35 +1100996 - stevesk@cvs.openbsd.org 2008/11/01 06:43:33
997 [channels.c]
998 fix some typos in log messages; ok djm@
Damien Millerc1719f72008-11-03 19:27:07 +1100999 - sobrado@cvs.openbsd.org 2008/11/01 11:14:36
1000 [ssh-keyscan.1 ssh-keyscan.c]
1001 the ellipsis is not an optional argument; while here, improve spacing.
Damien Millera699d952008-11-03 19:27:34 +11001002 - stevesk@cvs.openbsd.org 2008/11/01 17:40:33
1003 [clientloop.c readconf.c readconf.h ssh.c]
1004 merge dynamic forward parsing into parse_forward();
1005 'i think this is OK' djm@
Damien Miller660d7da2008-11-03 19:27:52 +11001006 - stevesk@cvs.openbsd.org 2008/11/02 00:16:16
1007 [ttymodes.c]
1008 protocol 2 tty modes support is now 7.5 years old so remove these
1009 debug3()s; ok deraadt@
Damien Millera279d252008-11-03 19:28:07 +11001010 - stevesk@cvs.openbsd.org 2008/11/03 01:07:02
1011 [readconf.c]
1012 remove valueless comment
Damien Millerf4b39532008-11-03 19:28:21 +11001013 - stevesk@cvs.openbsd.org 2008/11/03 02:44:41
1014 [readconf.c]
1015 fix comment
Damien Miller85dec732008-11-03 20:16:01 +11001016 - (djm) [contrib/caldera/ssh-host-keygen contrib/suse/rc.sshd]
1017 Make example scripts generate keys with default sizes rather than fixed,
1018 non-default 1024 bits; patch from imorgan AT nas.nasa.gov
Damien Miller250071f2008-11-03 20:18:12 +11001019 - (djm) [contrib/sshd.pam.generic contrib/caldera/sshd.pam]
1020 [contrib/redhat/sshd.pam] Move pam_nologin to account group from
1021 incorrect auth group in example files;
1022 patch from imorgan AT nas.nasa.gov
Damien Miller9f6fb562008-11-03 19:15:44 +11001023
Darren Tuckerc570ff72008-09-06 18:20:57 +1000102420080906
1025 - (dtucker) [config.guess config.sub] Update to latest versions from
1026 http://git.savannah.gnu.org/gitweb/ (2008-04-14 and 2008-06-16
1027 respectively).
1028
Darren Tucker661f63b2008-08-30 07:32:37 +1000102920080830
1030 - (dtucker) [openbsd-compat/bsd-poll.c] correctly check for number of FDs
1031 larger than FD_SETSIZE (OpenSSH only ever uses poll with one fd). Patch
1032 from Nicholas Marriott.
1033
Damien Milleraa5f4332008-07-21 18:20:39 +1000103420080721
1035 - (djm) OpenBSD CVS Sync
Damien Miller6ef430d2008-07-23 17:40:04 +10001036 - djm@cvs.openbsd.org 2008/07/23 07:36:55
1037 [servconf.c]
1038 do not try to print options that have been compile-time disabled
1039 in config test mode (sshd -T); report from nix-corp AT esperi.org.uk
1040 ok dtucker@
Damien Miller212f0b02008-07-23 17:42:29 +10001041 - (djm) [servconf.c] Print UsePAM option in config test mode (when it
1042 has been compiled in); report from nix-corp AT esperi.org.uk
1043 ok dtucker@
Damien Miller6ef430d2008-07-23 17:40:04 +10001044
104520080721
1046 - (djm) OpenBSD CVS Sync
Damien Milleraa5f4332008-07-21 18:20:39 +10001047 - jmc@cvs.openbsd.org 2008/07/18 22:51:01
1048 [sftp-server.8]
1049 no need for .Pp before or after .Sh;
Damien Milleraaae43e2008-07-21 18:21:05 +10001050 - djm@cvs.openbsd.org 2008/07/21 08:19:07
1051 [version.h]
1052 openssh-5.1
Damien Miller1f8909c2008-07-21 18:21:52 +10001053 - (djm) [README contrib/caldera/openssh.spec contrib/redhat/openssh.spec]
1054 [contrib/suse/openssh.spec] Update version number in README and RPM specs
Damien Miller8f42e9b2008-07-21 18:22:25 +10001055 - (djm) Release OpenSSH-5.1
Damien Milleraa5f4332008-07-21 18:20:39 +10001056
Damien Miller7ba0ca72008-07-17 18:57:06 +1000105720080717
1058 - (djm) OpenBSD CVS Sync
1059 - djm@cvs.openbsd.org 2008/07/17 08:48:00
1060 [sshconnect2.c]
1061 strnvis preauth banner; pointed out by mpf@ ok markus@
Damien Millera1d03a52008-07-17 18:57:19 +10001062 - djm@cvs.openbsd.org 2008/07/17 08:51:07
1063 [auth2-hostbased.c]
1064 strip trailing '.' from hostname when HostbasedUsesNameFromPacketOnly=yes
1065 report and patch from res AT qoxp.net (bz#1200); ok markus@
Darren Tucker9a3f2b42008-07-17 19:03:49 +10001066 - (dtucker) [openbsd-compat/bsd-cygwin_util.c] Remove long-unneeded compat
1067 code, replace with equivalent cygwin library call. Patch from vinschen
Damien Miller2e28d862008-07-17 19:15:43 +10001068 at redhat.com, ok djm@.
1069 - (djm) [sshconnect2.c] vis.h isn't available everywhere
Damien Miller7ba0ca72008-07-17 18:57:06 +10001070
Damien Miller94717b02008-07-16 21:17:23 +1000107120080716
1072 - OpenBSD CVS Sync
1073 - djm@cvs.openbsd.org 2008/07/15 02:23:14
1074 [sftp.1]
1075 number of pipelined requests is now 64;
1076 prodded by Iain.Morgan AT nasa.gov
Damien Millerb9d3bee2008-07-16 22:40:52 +10001077 - djm@cvs.openbsd.org 2008/07/16 11:51:14
1078 [clientloop.c]
1079 rename variable first_gc -> last_gc (since it is actually the last
1080 in the list).
Damien Miller6ef17492008-07-16 22:42:06 +10001081 - djm@cvs.openbsd.org 2008/07/16 11:52:19
1082 [channels.c]
1083 this loop index should be automatic, not static
Damien Miller94717b02008-07-16 21:17:23 +10001084
Damien Miller81dec052008-07-14 11:28:29 +1000108520080714
1086 - (djm) OpenBSD CVS Sync
1087 - sthen@cvs.openbsd.org 2008/07/13 21:22:52
1088 [ssh-keygen.c]
1089 Change "ssh-keygen -F [host] -l" to not display random art unless
1090 -v is also specified, making it consistent with the manual and other
1091 uses of -l.
1092 ok grunk@
Damien Miller163886f2008-07-14 11:28:58 +10001093 - djm@cvs.openbsd.org 2008/07/13 22:13:07
1094 [channels.c]
1095 use struct sockaddr_storage instead of struct sockaddr for accept(2)
1096 address argument. from visibilis AT yahoo.com in bz#1485; ok markus@
Damien Miller7f980d12008-07-14 11:29:24 +10001097 - djm@cvs.openbsd.org 2008/07/13 22:16:03
1098 [sftp.c]
1099 increase number of piplelined requests so they properly fill the
1100 (recently increased) channel window. prompted by rapier AT psc.edu;
1101 ok markus@
Damien Miller276571c2008-07-14 12:09:57 +10001102 - djm@cvs.openbsd.org 2008/07/14 01:55:56
1103 [sftp-server.8]
1104 mention requirement for /dev/log inside chroot when using sftp-server
1105 with ChrootDirectory
Damien Millerce02e5e2008-07-14 12:02:24 +10001106 - (djm) [openbsd-compat/bindresvport.c] Rename variables s/sin/in/ to
1107 avoid clash with sin(3) function; reported by
1108 cristian.ionescu-idbohrn AT axis.com
Damien Miller639ce592008-07-14 12:03:27 +10001109 - (djm) [openbsd-compat/rresvport.c] Add unistd.h for missing close()
1110 prototype; reported by cristian.ionescu-idbohrn AT axis.com
Damien Miller36d70562008-07-14 12:04:43 +10001111 - (djm) [umac.c] Rename variable s/buffer_ptr/bufp/ to avoid clash;
1112 reported by cristian.ionescu-idbohrn AT axis.com
Damien Miller1fc231c2008-07-14 12:12:52 +10001113 - (djm) [contrib/cygwin/Makefile contrib/cygwin/ssh-host-config]
1114 [contrib/cygwin/ssh-user-config contrib/cygwin/sshd-inetd]
1115 Revamped and simplified Cygwin ssh-host-config script that uses
1116 unified csih configuration tool. Requires recent Cygwin.
1117 Patch from vinschen AT redhat.com
Damien Miller81dec052008-07-14 11:28:29 +10001118
Damien Miller2bcb8662008-07-12 17:12:29 +1000111920080712
1120 - (djm) OpenBSD CVS Sync
1121 - djm@cvs.openbsd.org 2008/07/12 04:52:50
1122 [channels.c]
1123 unbreak; move clearing of cctx struct to before first use
1124 reported by dkrause@
Damien Millera034baf2008-07-12 17:12:49 +10001125 - djm@cvs.openbsd.org 2008/07/12 05:33:41
1126 [scp.1]
1127 better description for -i flag:
1128 s/RSA authentication/public key authentication/
Damien Millerc4657ef2008-07-14 21:37:36 +10001129 - (djm) [openbsd-compat/fake-rfc2553.c openbsd-compat/fake-rfc2553.h]
1130 return EAI_FAMILY when trying to lookup unsupported address family;
1131 from vinschen AT redhat.com
Damien Miller2bcb8662008-07-12 17:12:29 +10001132
Damien Miller2f7faf12008-07-11 17:34:35 +1000113320080711
1134 - (djm) OpenBSD CVS Sync
1135 - stevesk@cvs.openbsd.org 2008/07/07 00:31:41
1136 [ttymodes.c]
1137 we don't need arg after the debug3() was removed. from lint.
1138 ok djm@
Damien Miller87dd5f22008-07-11 17:35:09 +10001139 - stevesk@cvs.openbsd.org 2008/07/07 23:32:51
1140 [key.c]
1141 /*NOTREACHED*/ for lint warning:
1142 warning: function key_equal falls off bottom without returning value
1143 ok djm@
Damien Millerdda5fff2008-07-11 17:35:37 +10001144 - markus@cvs.openbsd.org 2008/07/10 18:05:58
1145 [channels.c]
1146 missing bzero; from mickey; ok djm@
Damien Millerb61f3fc2008-07-11 17:36:48 +10001147 - markus@cvs.openbsd.org 2008/07/10 18:08:11
1148 [clientloop.c monitor.c monitor_wrap.c packet.c packet.h sshd.c]
1149 sync v1 and v2 traffic accounting; add it to sshd, too;
1150 ok djm@, dtucker@
Damien Miller2f7faf12008-07-11 17:34:35 +10001151
Damien Millerd9648ee2008-07-09 00:21:12 +1000115220080709
1153 - (djm) [Makefile.in] Print "all tests passed" when all regress tests pass
Damien Miller773a7b92008-07-09 20:54:05 +10001154 - (djm) [auth1.c] Fix format string vulnerability in protocol 1 PAM
1155 account check failure path. The vulnerable format buffer is supplied
1156 from PAM and should not contain attacker-supplied data.
Damien Miller7acf5502008-07-09 20:54:37 +10001157 - (djm) [auth.c] Missing unistd.h for close()
Damien Miller73193b32008-07-09 21:07:19 +10001158 - (djm) [configure.ac] Add -Wformat-security to CFLAGS for gcc 3.x and 4.x
Damien Millerd9648ee2008-07-09 00:21:12 +10001159
Damien Miller22989f12008-07-05 08:59:43 +1000116020080705
1161 - (djm) [auth.c] Fixed test for locked account on HP/UX with shadowed
1162 passwords disabled. bz#1083 report & patch from senthilkumar_sen AT
1163 hotpop.com, w/ dtucker@
Damien Miller20d16942008-07-05 09:36:58 +10001164 - (djm) [atomicio.c configure.ac] Disable poll() fallback in atomiciov for
1165 Tru64. readv doesn't seem to be a comparable object there.
1166 bz#1386, patch from dtucker@ ok me
Damien Miller42743cb2008-07-05 09:50:23 +10001167 - (djm) [Makefile.in] Pass though pass to conch for interop tests
Damien Millerff2e4922008-07-05 09:52:03 +10001168 - (djm) [configure.ac] unbreak: remove extra closing brace
Damien Millerd874fa52008-07-05 09:40:56 +10001169 - (djm) OpenBSD CVS Sync
1170 - djm@cvs.openbsd.org 2008/07/04 23:08:25
1171 [packet.c]
1172 handle EINTR in packet_write_poll()l ok dtucker@
Damien Miller0b4d48b2008-07-05 09:44:53 +10001173 - djm@cvs.openbsd.org 2008/07/04 23:30:16
1174 [auth1.c auth2.c]
1175 Make protocol 1 MaxAuthTries logic match protocol 2's.
1176 Do not treat the first protocol 2 authentication attempt as
1177 a failure IFF it is for method "none".
1178 Makes MaxAuthTries' user-visible behaviour identical for
1179 protocol 1 vs 2.
1180 ok dtucker@
Damien Millerc9c96f22008-07-05 15:17:48 +10001181 - djm@cvs.openbsd.org 2008/07/05 05:16:01
1182 [PROTOCOL]
1183 grammar
Damien Miller22989f12008-07-05 08:59:43 +10001184
Darren Tucker7c99b1c2008-07-04 12:53:23 +1000118520080704
1186 - (dtucker) OpenBSD CVS Sync
1187 - djm@cvs.openbsd.org 2008/07/02 13:30:34
1188 [auth2.c]
1189 really really remove the freebie "none" auth try for protocol 2
Darren Tucker9a2a6092008-07-04 12:53:50 +10001190 - djm@cvs.openbsd.org 2008/07/02 13:47:39
1191 [ssh.1 ssh.c]
1192 When forking after authentication ("ssh -f") with ExitOnForwardFailure
1193 enabled, delay the fork until after replies for any -R forwards have
1194 been seen. Allows for robust detection of -R forward failure when
1195 using -f (similar to bz#92); ok dtucker@
Darren Tuckerf5cafb02008-07-04 12:54:25 +10001196 - otto@cvs.openbsd.org 2008/07/03 21:46:58
1197 [auth2-pubkey.c]
1198 avoid nasty double free; ok dtucker@ djm@
Darren Tuckerb03fd022008-07-04 13:51:12 +10001199 - djm@cvs.openbsd.org 2008/07/04 03:44:59
1200 [servconf.c groupaccess.h groupaccess.c]
1201 support negation of groups in "Match group" block (bz#1315); ok dtucker@
Darren Tucker2784f1f2008-07-04 13:51:45 +10001202 - dtucker@cvs.openbsd.org 2008/07/04 03:47:02
1203 [monitor.c]
1204 Make debug a little clearer. ok djm@
Darren Tucker8c7a14e2008-07-04 17:08:58 +10001205 - djm@cvs.openbsd.org 2008/06/30 08:07:34
1206 [regress/key-options.sh]
1207 shell portability: use "=" instead of "==" in test(1) expressions,
1208 double-quote string with backslash escaped /
Darren Tucker5d6d70a2008-07-04 17:10:30 +10001209 - djm@cvs.openbsd.org 2008/06/30 10:31:11
1210 [regress/{putty-transfer,putty-kex,putty-ciphers}.sh]
1211 remove "set -e" left over from debugging
Darren Tuckerb01bac12008-07-04 17:11:30 +10001212 - djm@cvs.openbsd.org 2008/06/30 10:43:03
1213 [regress/conch-ciphers.sh]
1214 explicitly disable conch options that could interfere with the test
Darren Tuckerf7fa7062008-07-04 14:10:19 +10001215 - (dtucker) [sftp-server.c] Bug #1447: fall back to racy rename if link
1216 returns EXDEV. Patch from Mike Garrison, ok djm@
Damien Millerd8968ad2008-07-04 23:10:49 +10001217 - (djm) [atomicio.c channels.c clientloop.c defines.h includes.h]
1218 [packet.c scp.c serverloop.c sftp-client.c ssh-agent.c ssh-keyscan.c]
1219 [sshd.c] Explicitly handle EWOULDBLOCK wherever we handle EAGAIN, on
1220 some platforms (HP nonstop) it is a distinct errno;
1221 bz#1467 reported by sconeu AT yahoo.com; ok dtucker@
1222
Darren Tucker00f00f02008-07-02 22:31:31 +1000122320080702
1224 - (dtucker) OpenBSD CVS Sync
1225 - djm@cvs.openbsd.org 2008/06/30 08:05:59
1226 [PROTOCOL.agent]
1227 typo: s/constraint_date/constraint_data/
Darren Tucker8810dd42008-07-02 22:32:14 +10001228 - djm@cvs.openbsd.org 2008/06/30 12:15:39
1229 [serverloop.c]
1230 only pass channel requests on session channels through to the session
1231 channel handler, avoiding spurious log messages; ok! markus@
Darren Tucker8748b962008-07-02 22:32:43 +10001232 - djm@cvs.openbsd.org 2008/06/30 12:16:02
1233 [nchan.c]
1234 only send eow@openssh.com notifications for session channels; ok! markus@
Darren Tucker1f781b12008-07-02 22:33:16 +10001235 - djm@cvs.openbsd.org 2008/06/30 12:18:34
1236 [PROTOCOL]
1237 clarify that eow@openssh.com is only sent on session channels
Darren Tucker068e01f2008-07-02 22:33:55 +10001238 - dtucker@cvs.openbsd.org 2008/07/01 07:20:52
1239 [sshconnect.c]
1240 Check ExitOnForwardFailure if forwardings are disabled due to a failed
1241 host key check. ok djm@
Darren Tuckerd7bdc0c2008-07-02 22:34:30 +10001242 - dtucker@cvs.openbsd.org 2008/07/01 07:24:22
1243 [sshconnect.c sshd.c]
1244 Send CR LF during protocol banner exchanges, but only for Protocol 2 only,
1245 in order to comply with RFC 4253. bz #1443, ok djm@
Darren Tuckerf2e21de2008-07-02 22:35:00 +10001246 - stevesk@cvs.openbsd.org 2008/07/01 23:12:47
1247 [PROTOCOL.agent]
1248 fix some typos; ok djm@
Darren Tucker7499b0c2008-07-02 22:35:43 +10001249 - djm@cvs.openbsd.org 2008/07/02 02:24:18
1250 [sshd_config sshd_config.5 sshd.8 servconf.c]
1251 increase default size of ssh protocol 1 ephemeral key from 768 to 1024
1252 bits; prodded by & ok dtucker@ ok deraadt@
Darren Tucker33c787f2008-07-02 22:37:30 +10001253 - dtucker@cvs.openbsd.org 2008/07/02 12:03:51
1254 [auth-rsa.c auth.c auth2-pubkey.c auth.h]
1255 Merge duplicate host key file checks, based in part on a patch from Rob
1256 Holland via bz #1348 . Also checks for non-regular files during protocol
1257 1 RSA auth. ok djm@
Darren Tucker4230a5d2008-07-02 22:56:09 +10001258 - djm@cvs.openbsd.org 2008/07/02 12:36:39
1259 [auth2-none.c auth2.c]
1260 Make protocol 2 MaxAuthTries behaviour a little more sensible:
1261 Check whether client has exceeded MaxAuthTries before running
1262 an authentication method and skip it if they have, previously it
1263 would always allow one try (for "none" auth).
1264 Preincrement failure count before post-auth test - previously this
1265 checked and postincremented, also to allow one "none" try.
1266 Together, these two changes always count the "none" auth method
1267 which could be skipped by a malicious client (e.g. an SSH worm)
1268 to get an extra attempt at a real auth method. They also make
1269 MaxAuthTries=0 a useful way to block users entirely (esp. in a
1270 sshd_config Match block).
1271 Also, move sending of any preauth banner from "none" auth method
1272 to the first call to input_userauth_request(), so worms that skip
1273 the "none" method get to see it too.
Darren Tucker00f00f02008-07-02 22:31:31 +10001274
Damien Miller2e80cf22008-06-30 08:06:25 +1000127520080630
1276 - (djm) OpenBSD CVS Sync
1277 - dtucker@cvs.openbsd.org 2008/06/10 23:13:43
1278 [regress/Makefile regress/key-options.sh]
1279 Add regress test for key options. ok djm@
Damien Millerd9bfce82008-06-30 08:06:51 +10001280 - dtucker@cvs.openbsd.org 2008/06/11 23:11:40
Damien Miller4268a132008-06-30 08:07:56 +10001281 [regress/Makefile]
Damien Millerd9bfce82008-06-30 08:06:51 +10001282 Don't run cipher-speed test by default; mistakenly enabled by me
Damien Miller4268a132008-06-30 08:07:56 +10001283 - djm@cvs.openbsd.org 2008/06/28 13:57:25
1284 [regress/Makefile regress/test-exec.sh regress/conch-ciphers.sh]
1285 very basic regress test against Twisted Conch in "make interop"
1286 target (conch is available in ports/devel/py-twisted/conch);
1287 ok markus@
Damien Millera766cea2008-06-30 08:12:37 +10001288 - (djm) [regress/Makefile] search for conch by path, like we do putty
Damien Miller2e80cf22008-06-30 08:06:25 +10001289
Damien Millerf184bcf2008-06-29 22:45:13 +1000129020080629
1291 - (djm) OpenBSD CVS Sync
1292 - martynas@cvs.openbsd.org 2008/06/21 07:46:46
1293 [sftp.c]
1294 use optopt to get invalid flag, instead of return value of getopt,
1295 which is always '?'; ok djm@
Damien Miller007132a2008-06-29 22:45:37 +10001296 - otto@cvs.openbsd.org 2008/06/25 11:13:43
1297 [key.c]
1298 add key length to visual fingerprint; zap magical constants;
1299 ok grunk@ djm@
Damien Miller9e720282008-06-29 22:46:35 +10001300 - djm@cvs.openbsd.org 2008/06/26 06:10:09
1301 [sftp-client.c sftp-server.c]
1302 allow the sftp chmod(2)-equivalent operation to set set[ug]id/sticky
1303 bits. Note that this only affects explicit setting of modes (e.g. via
1304 sftp(1)'s chmod command) and not file transfers. (bz#1310)
1305 ok deraadt@ at c2k8
Damien Miller2e9cf492008-06-29 22:47:04 +10001306 - djm@cvs.openbsd.org 2008/06/26 09:19:40
1307 [dh.c dh.h moduli.c]
1308 when loading moduli from /etc/moduli in sshd(8), check that they
1309 are of the expected "safe prime" structure and have had
1310 appropriate primality tests performed;
1311 feedback and ok dtucker@
Damien Miller10288242008-06-30 00:04:03 +10001312 - grunk@cvs.openbsd.org 2008/06/26 11:46:31
1313 [readconf.c readconf.h ssh.1 ssh_config.5 sshconnect.c]
1314 Move SSH Fingerprint Visualization away from sharing the config option
1315 CheckHostIP to an own config option named VisualHostKey.
1316 While there, fix the behaviour that ssh would draw a random art picture
1317 on every newly seen host even when the option was not enabled.
1318 prodded by deraadt@, discussions,
1319 help and ok markus@ djm@ dtucker@
Damien Miller86399202008-06-30 00:04:31 +10001320 - jmc@cvs.openbsd.org 2008/06/26 21:11:46
1321 [ssh.1]
1322 add VisualHostKey to the list of options listed in -o;
Damien Millerbd45afb2008-06-30 00:04:57 +10001323 - djm@cvs.openbsd.org 2008/06/28 07:25:07
1324 [PROTOCOL]
1325 spelling fixes
Damien Miller1cfadab2008-06-30 00:05:21 +10001326 - djm@cvs.openbsd.org 2008/06/28 13:58:23
1327 [ssh-agent.c]
1328 refuse to add a key that has unknown constraints specified;
1329 ok markus
Damien Miller471db5c2008-06-30 00:05:48 +10001330 - djm@cvs.openbsd.org 2008/06/28 14:05:15
1331 [ssh-agent.c]
1332 reset global compat flag after processing a protocol 2 signature
1333 request with the legacy DSA encoding flag set; ok markus
Damien Miller1e18beb2008-06-30 00:07:00 +10001334 - djm@cvs.openbsd.org 2008/06/28 14:08:30
1335 [PROTOCOL PROTOCOL.agent]
1336 document the protocol used by ssh-agent; "looks ok" markus@
Damien Millerf184bcf2008-06-29 22:45:13 +10001337
Damien Miller493f0322008-06-28 16:01:35 +1000133820080628
1339 - (djm) [RFC.nroff contrib/cygwin/Makefile contrib/suse/openssh.spec]
1340 RFC.nroff lacks a license, remove it (it is long gone in OpenBSD).
1341
Damien Miller60dcc622008-06-26 15:59:32 +1000134220080626
1343 - (djm) [Makefile.in moduli.5] Include moduli(5) manpage from OpenBSD.
1344 (bz#1372)
Damien Millerf299ff82008-06-26 16:01:56 +10001345 - (djm) [ contrib/caldera/openssh.spec contrib/redhat/openssh.spec]
1346 [contrib/suse/openssh.spec] Include moduli.5 in RPM spec files.
Damien Miller60dcc622008-06-26 15:59:32 +10001347
Darren Tuckered3cdc02008-06-16 23:29:18 +1000134820080616
1349 - (dtucker) OpenBSD CVS Sync
1350 - dtucker@cvs.openbsd.org 2008/06/16 13:22:53
1351 [session.c channels.c]
1352 Rename the isatty argument to is_tty so we don't shadow
1353 isatty(3). ok markus@
Darren Tucker1a48aec2008-06-16 23:35:56 +10001354 - (dtucker) [channels.c] isatty -> is_tty here too.
Darren Tuckered3cdc02008-06-16 23:29:18 +10001355
Darren Tucker330c93f2008-06-16 02:27:48 +1000135620080615
1357 - (dtucker) [configure.ac] Enable -fno-builtin-memset when using gcc.
Damien Miller2a628472008-06-16 07:50:24 +10001358 - OpenBSD CVS Sync
1359 - dtucker@cvs.openbsd.org 2008/06/14 15:49:48
1360 [sshd.c]
1361 wrap long line at 80 chars
Damien Miller6ca16c62008-06-16 07:50:58 +10001362 - dtucker@cvs.openbsd.org 2008/06/14 17:07:11
1363 [sshd.c]
1364 ensure default umask disallows at least group and world write; ok djm@
Damien Miller6051c942008-06-16 07:53:16 +10001365 - djm@cvs.openbsd.org 2008/06/14 18:33:43
1366 [session.c]
1367 suppress the warning message from chdir(homedir) failures
1368 when chrooted (bz#1461); ok dtucker
Damien Millerc7ce0da2008-06-16 07:55:06 +10001369 - dtucker@cvs.openbsd.org 2008/06/14 19:42:10
1370 [scp.1]
1371 Mention that scp follows symlinks during -r. bz #1466,
1372 from nectar at apple
Damien Millerc62a5af2008-06-16 07:55:46 +10001373 - dtucker@cvs.openbsd.org 2008/06/15 16:55:38
1374 [sshd_config.5]
1375 MaxSessions is allowed in a Match block too
Damien Miller307c1d12008-06-16 07:56:20 +10001376 - dtucker@cvs.openbsd.org 2008/06/15 16:58:40
1377 [servconf.c sshd_config.5]
1378 Allow MaxAuthTries within a Match block. ok djm@
Damien Millerd310d512008-06-16 07:59:23 +10001379 - djm@cvs.openbsd.org 2008/06/15 20:06:26
1380 [channels.c channels.h session.c]
1381 don't call isatty() on a pty master, instead pass a flag down to
1382 channel_set_fds() indicating that te fds refer to a tty. Fixes a
1383 hang on exit on Solaris (bz#1463) in portable but is actually
1384 a generic bug; ok dtucker deraadt markus
Darren Tucker330c93f2008-06-16 02:27:48 +10001385
Damien Miller8b7ab962008-06-15 10:55:34 +1000138620080614
1387 - (djm) [openbsd-compat/sigact.c] Avoid NULL derefs in ancient sigaction
1388 replacement code; patch from ighighi AT gmail.com in bz#1240;
1389 ok dtucker
1390
Darren Tucker99bb7612008-06-13 22:02:50 +1000139120080613
1392 - (dtucker) OpenBSD CVS Sync
1393 - deraadt@cvs.openbsd.org 2008/06/13 09:44:36
1394 [packet.c]
1395 compile on older gcc; no decl after code
Darren Tuckerf2c16d32008-06-14 08:59:49 +10001396 - dtucker@cvs.openbsd.org 2008/06/13 13:56:59
1397 [monitor.c]
1398 Clear key options in the monitor on failed authentication, prevents
1399 applying additional restrictions to non-pubkey authentications in
1400 the case where pubkey fails but another method subsequently succeeds.
1401 bz #1472, found by Colin Watson, ok markus@ djm@
Darren Tuckerd9526a52008-06-14 09:01:24 +10001402 - dtucker@cvs.openbsd.org 2008/06/13 14:18:51
1403 [auth2-pubkey.c auth-rhosts.c]
1404 Include unistd.h for close(), prevents warnings in -portable
Darren Tucker47e713b2008-06-14 09:01:54 +10001405 - dtucker@cvs.openbsd.org 2008/06/13 17:21:20
1406 [mux.c]
1407 Friendlier error messages for mux fallback. ok djm@
Darren Tucker03ccc9b2008-06-14 09:02:25 +10001408 - dtucker@cvs.openbsd.org 2008/06/13 18:55:22
1409 [scp.c]
1410 Prevent -Wsign-compare warnings on LP64 systems. bz #1192, ok deraadt@
Darren Tuckerf6bffb12008-06-14 09:04:26 +10001411 - grunk@cvs.openbsd.org 2008/06/13 20:13:26
1412 [ssh.1]
1413 Explain the use of SSH fpr visualization using random art, and cite the
1414 original scientific paper inspiring that technique.
1415 Much help with English and nroff by jmc@, thanks.
Darren Tucker30fd49e2008-06-14 09:14:46 +10001416 - (dtucker) [configure.ac] Bug #1276: avoid linking against libgssapi, which
1417 despite its name doesn't seem to implement all of GSSAPI. Patch from
1418 Jan Engelhardt, sanity checked by Simon Wilkinson.
Darren Tucker99bb7612008-06-13 22:02:50 +10001419
Darren Tucker11996732008-06-13 04:32:00 +1000142020080612
1421 - (dtucker) OpenBSD CVS Sync
1422 - jmc@cvs.openbsd.org 2008/06/11 07:30:37
1423 [sshd.8]
1424 kill trailing whitespace;
Darren Tucker9c16ac92008-06-13 04:40:35 +10001425 - grunk@cvs.openbsd.org 2008/06/11 21:01:35
1426 [ssh_config.5 key.h readconf.c readconf.h ssh-keygen.1 ssh-keygen.c key.c
1427 sshconnect.c]
1428 Introduce SSH Fingerprint ASCII Visualization, a technique inspired by the
1429 graphical hash visualization schemes known as "random art", and by
1430 Dan Kaminsky's musings on the subject during a BlackOp talk at the
1431 23C3 in Berlin.
1432 Scientific publication (original paper):
1433 "Hash Visualization: a New Technique to improve Real-World Security",
1434 Perrig A. and Song D., 1999, International Workshop on Cryptographic
1435 Techniques and E-Commerce (CrypTEC '99)
1436 http://sparrow.ece.cmu.edu/~adrian/projects/validation/validation.pdf
1437 The algorithm used here is a worm crawling over a discrete plane,
1438 leaving a trace (augmenting the field) everywhere it goes.
1439 Movement is taken from dgst_raw 2bit-wise. Bumping into walls
1440 makes the respective movement vector be ignored for this turn,
1441 thus switching to the other color of the chessboard.
1442 Graphs are not unambiguous for now, because circles in graphs can be
1443 walked in either direction.
1444 discussions with several people,
1445 help, corrections and ok markus@ djm@
Darren Tuckera376a322008-06-13 04:42:14 +10001446 - grunk@cvs.openbsd.org 2008/06/11 21:38:25
1447 [ssh-keygen.c]
1448 ssh-keygen -lv -f /etc/ssh/ssh_host_rsa_key.pub
1449 would not display you the random art as intended, spotted by canacar@
Darren Tucker35c45532008-06-13 04:43:15 +10001450 - grunk@cvs.openbsd.org 2008/06/11 22:20:46
1451 [ssh-keygen.c ssh-keygen.1]
1452 ssh-keygen would write fingerprints to STDOUT, and random art to STDERR,
1453 that is not how it was envisioned.
1454 Also correct manpage saying that -v is needed along with -l for it to work.
1455 spotted by naddy@
Darren Tucker014d76f2008-06-13 04:43:51 +10001456 - otto@cvs.openbsd.org 2008/06/11 23:02:22
1457 [key.c]
1458 simpler way of computing the augmentations; ok grunk@
Darren Tuckerdcc1ab52008-06-13 04:44:25 +10001459 - grunk@cvs.openbsd.org 2008/06/11 23:03:56
1460 [ssh_config.5]
1461 CheckHostIP set to ``fingerprint'' will display both hex and random art
1462 spotted by naddy@
Darren Tuckerd32b28a2008-06-13 04:45:50 +10001463 - grunk@cvs.openbsd.org 2008/06/11 23:51:57
1464 [key.c]
1465 #define statements that are not atoms need braces around them, else they
1466 will cause trouble in some cases.
1467 Also do a computation of -1 once, and not in a loop several times.
1468 spotted by otto@
Darren Tucker78913e02008-06-13 04:47:34 +10001469 - dtucker@cvs.openbsd.org 2008/06/12 00:03:49
1470 [dns.c canohost.c sshconnect.c]
1471 Do not pass "0" strings as ports to getaddrinfo because the lookups
1472 can slow things down and we never use the service info anyway. bz
1473 #859, patch from YOSHIFUJI Hideaki and John Devitofranceschi. ok
1474 deraadt@ djm@
1475 djm belives that the reason for the "0" strings is to ensure that
1476 it's not possible to call getaddrinfo with both host and port being
1477 NULL. In the case of canohost.c host is a local array. In the
1478 case of sshconnect.c, it's checked for null immediately before use.
1479 In dns.c it ultimately comes from ssh.c:main() and is guaranteed to
1480 be non-null but it's not obvious, so I added a warning message in
1481 case it is ever passed a null.
1482 - grunk@cvs.openbsd.org 2008/06/12 00:13:55
1483 [sshconnect.c]
1484 Make ssh print the random art also when ssh'ing to a host using IP only.
1485 spotted by naddy@, ok and help djm@ dtucker@
Darren Tucker267e28b2008-06-13 04:48:11 +10001486 - otto@cvs.openbsd.org 2008/06/12 00:13:13
1487 [key.c]
1488 use an odd number of rows and columns and a separate start marker, looks
1489 better; ok grunk@
Darren Tucker2fb66ca2008-06-13 04:49:33 +10001490 - djm@cvs.openbsd.org 2008/06/12 03:40:52
1491 [clientloop.h mux.c channels.c clientloop.c channels.h]
1492 Enable ~ escapes for multiplex slave sessions; give each channel
1493 its own escape state and hook the escape filters up to muxed
1494 channels. bz #1331
1495 Mux slaves do not currently support the ~^Z and ~& escapes.
1496 NB. this change cranks the mux protocol version, so a new ssh
1497 mux client will not be able to connect to a running old ssh
1498 mux master.
1499 ok dtucker@
Darren Tucker9f407c42008-06-13 04:50:27 +10001500 - djm@cvs.openbsd.org 2008/06/12 04:06:00
1501 [clientloop.h ssh.c clientloop.c]
1502 maintain an ordered queue of outstanding global requests that we
1503 expect replies to, similar to the per-channel confirmation queue.
1504 Use this queue to verify success or failure for remote forward
1505 establishment in a race free way.
1506 ok dtucker@
Darren Tucker4d5cd332008-06-13 04:51:14 +10001507 - djm@cvs.openbsd.org 2008/06/12 04:17:47
1508 [clientloop.c]
1509 thall shalt not code past the eightieth column
Darren Tuckerd6173c02008-06-13 04:52:53 +10001510 - djm@cvs.openbsd.org 2008/06/12 04:24:06
1511 [ssh.c]
1512 thal shalt not code past the eightieth column
Darren Tuckere5d98292008-06-13 04:53:27 +10001513 - djm@cvs.openbsd.org 2008/06/12 05:15:41
1514 [PROTOCOL]
1515 document tun@openssh.com forwarding method
Darren Tuckerba69c7a2008-06-13 04:54:05 +10001516 - djm@cvs.openbsd.org 2008/06/12 05:32:30
1517 [mux.c]
1518 some more TODO for me
Darren Tucker4b3b9772008-06-13 04:55:10 +10001519 - grunk@cvs.openbsd.org 2008/06/12 05:42:46
1520 [key.c]
1521 supply the key type (rsa1, rsa, dsa) as a caption in the frame of the
1522 random art. while there, stress the fact that the field base should at
1523 least be 8 characters for the pictures to make sense.
1524 comment and ok djm@
1525 - grunk@cvs.openbsd.org 2008/06/12 06:32:59
1526 [key.c]
1527 We already mark the start of the worm, now also mark the end of the worm
1528 in our random art drawings.
1529 ok djm@
Darren Tucker84c56f52008-06-13 04:55:46 +10001530 - djm@cvs.openbsd.org 2008/06/12 15:19:17
1531 [clientloop.h channels.h clientloop.c channels.c mux.c]
1532 The multiplexing escape char handler commit last night introduced a
1533 small memory leak per session; plug it.
Darren Tuckerf6b01b72008-06-13 04:56:37 +10001534 - dtucker@cvs.openbsd.org 2008/06/12 16:35:31
1535 [ssh_config.5 ssh.c]
1536 keyword expansion for localcommand. ok djm@
Darren Tuckerf09e8252008-06-13 05:18:03 +10001537 - jmc@cvs.openbsd.org 2008/06/12 19:10:09
1538 [ssh_config.5 ssh-keygen.1]
1539 tweak the ascii art text; ok grunk
Darren Tucker3fc464e2008-06-13 06:42:45 +10001540 - dtucker@cvs.openbsd.org 2008/06/12 20:38:28
1541 [sshd.c sshconnect.c packet.h misc.c misc.h packet.c]
1542 Make keepalive timeouts apply while waiting for a packet, particularly
1543 during key renegotiation (bz #1363). With djm and Matt Day, ok djm@
Darren Tuckera64ab332008-06-13 07:01:29 +10001544 - djm@cvs.openbsd.org 2008/06/12 20:47:04
1545 [sftp-client.c]
1546 print extension revisions for extensions that we understand
Darren Tuckerbabc1d52008-06-13 08:56:01 +10001547 - djm@cvs.openbsd.org 2008/06/12 21:06:25
1548 [clientloop.c]
1549 I was coalescing expected global request confirmation replies at
1550 the wrong end of the queue - fix; prompted by markus@
Darren Tuckerb68fb4a2008-06-13 08:57:27 +10001551 - grunk@cvs.openbsd.org 2008/06/12 21:14:46
1552 [ssh-keygen.c]
1553 make ssh-keygen -lf show the key type just as ssh-add -l would do it
1554 ok djm@ markus@
Darren Tucker0f0ef0a2008-06-13 08:58:05 +10001555 - grunk@cvs.openbsd.org 2008/06/12 22:03:36
1556 [key.c]
1557 add my copyright, ok djm@
Darren Tuckerff4454d2008-06-13 10:21:51 +10001558 - ian@cvs.openbsd.org 2008/06/12 23:24:58
1559 [sshconnect.c]
1560 tweak wording in message, ok deraadt@ jmc@
Darren Tuckerf8b7eb72008-06-13 10:22:54 +10001561 - dtucker@cvs.openbsd.org 2008/06/13 00:12:02
1562 [sftp.h log.h]
1563 replace __dead with __attribute__((noreturn)), makes things
1564 a little easier to port. Also, add it to sigdie(). ok djm@
Darren Tuckerca19bfe2008-06-13 10:24:03 +10001565 - djm@cvs.openbsd.org 2008/06/13 00:16:49
1566 [mux.c]
1567 fall back to creating a new TCP connection on most multiplexing errors
1568 (socket connect fail, invalid version, refused permittion, corrupted
1569 messages, etc.); bz #1329 ok dtucker@
Darren Tucker1adfd362008-06-13 10:58:10 +10001570 - dtucker@cvs.openbsd.org 2008/06/13 00:47:53
1571 [mux.c]
1572 upcast size_t to u_long to match format arg; ok djm@
Darren Tuckerc7e030f2008-06-13 10:58:50 +10001573 - dtucker@cvs.openbsd.org 2008/06/13 00:51:47
1574 [mac.c]
1575 upcast another size_t to u_long to match format
Darren Tucker7517b5b2008-06-13 14:48:59 +10001576 - dtucker@cvs.openbsd.org 2008/06/13 01:38:23
1577 [misc.c]
1578 upcast uid to long with matching %ld, prevents warnings in portable
Darren Tucker06db5842008-06-13 14:51:28 +10001579 - djm@cvs.openbsd.org 2008/06/13 04:40:22
1580 [auth2-pubkey.c auth-rhosts.c]
1581 refuse to read ~/.shosts or ~/.ssh/authorized_keys that are not
1582 regular files; report from Solar Designer via Colin Watson in bz#1471
1583 ok dtucker@ deraadt
Darren Tucker1cf65ae2008-06-13 05:09:18 +10001584 - (dtucker) [clientloop.c serverloop.c] channel_register_filter now
1585 takes 2 more args. with djm@
Darren Tucker61b06952008-06-13 10:28:57 +10001586 - (dtucker) [defines.h] Bug #1112: __dead is, well dead. Based on a patch
1587 from Todd Vierling.
Darren Tucker2c1eb822008-06-13 11:13:13 +10001588 - (dtucker) [auth-sia.c] Bug #1241: support password expiry on Tru64 SIA
1589 systems. Patch from R. Scott Bailey.
Darren Tucker2c91b282008-06-13 12:40:55 +10001590 - (dtucker) [umac.c] STORE_UINT32_REVERSED and endian_convert are never used
1591 on big endian machines, so ifdef them for little-endian only to prevent
1592 unused function warnings on big-endians.
Darren Tuckerf387e592008-06-13 15:03:14 +10001593 - (dtucker) [openbsd-compat/setenv.c] Make offsets size_t to prevent
1594 compiler warnings on some platforms. Based on a discussion with otto@
Darren Tucker11996732008-06-13 04:32:00 +10001595
Damien Miller4401e452008-06-12 06:05:12 +1000159620080611
1597 - (djm) [channels.c configure.ac]
1598 Do not set SO_REUSEADDR on wildcard X11 listeners (X11UseLocalhost=no)
1599 bz#1464; ok dtucker
1600
Darren Tucker7a3935d2008-06-10 22:59:10 +1000160120080610
1602 - (dtucker) OpenBSD CVS Sync
1603 - djm@cvs.openbsd.org 2008/06/10 03:57:27
1604 [servconf.c match.h sshd_config.5]
1605 support CIDR address matching in sshd_config "Match address" blocks, with
1606 full support for negation and fall-back to classic wildcard matching.
1607 For example:
1608 Match address 192.0.2.0/24,3ffe:ffff::/32,!10.*
1609 PasswordAuthentication yes
1610 addrmatch.c code mostly lifted from flowd's addr.c
1611 feedback and ok dtucker@
Darren Tuckerb06cc4a2008-06-10 22:59:53 +10001612 - djm@cvs.openbsd.org 2008/06/10 04:17:46
1613 [sshd_config.5]
1614 better reference for pattern-list
Darren Tuckere7140f22008-06-10 23:01:51 +10001615 - dtucker@cvs.openbsd.org 2008/06/10 04:50:25
1616 [sshd.c channels.h channels.c log.c servconf.c log.h servconf.h sshd.8]
1617 Add extended test mode (-T) and connection parameters for test mode (-C).
1618 -T causes sshd to write its effective configuration to stdout and exit.
1619 -C causes any relevant Match rules to be applied before output. The
1620 combination allows tesing of the parser and config files. ok deraadt djm
Darren Tucker6a2a4002008-06-10 23:03:04 +10001621 - jmc@cvs.openbsd.org 2008/06/10 07:12:00
1622 [sshd_config.5]
1623 tweak previous;
Darren Tuckere7f3f752008-06-10 23:06:01 +10001624 - jmc@cvs.openbsd.org 2008/06/10 08:17:40
1625 [sshd.8 sshd.c]
1626 - update usage()
1627 - fix SYNOPSIS, and sort options
1628 - some minor additional fixes
Darren Tuckerd788b7c2008-06-10 23:15:54 +10001629 - dtucker@cvs.openbsd.org 2008/06/09 18:06:32
1630 [regress/test-exec.sh]
1631 Don't generate putty keys if we're not going to use them. ok djm
Darren Tucker10f92422008-06-10 23:16:46 +10001632 - dtucker@cvs.openbsd.org 2008/06/10 05:23:32
1633 [regress/addrmatch.sh regress/Makefile]
1634 Regress test for Match CIDR rules. ok djm@
Darren Tucker5f346642008-06-11 01:38:52 +10001635 - dtucker@cvs.openbsd.org 2008/06/10 15:21:41
1636 [test-exec.sh]
1637 Use a more portable construct for checking if we're running a putty test
Darren Tuckerd8bafea2008-06-11 01:39:38 +10001638 - dtucker@cvs.openbsd.org 2008/06/10 15:28:49
1639 [test-exec.sh]
1640 Add quotes
Darren Tuckerc9807e82008-06-11 09:33:01 +10001641 - dtucker@cvs.openbsd.org 2008/06/10 18:21:24
1642 [ssh_config.5]
1643 clarify that Host patterns are space-separated. ok deraadt
Darren Tucker8901fa92008-06-11 09:34:01 +10001644 - djm@cvs.openbsd.org 2008/06/10 22:15:23
1645 [PROTOCOL ssh.c serverloop.c]
1646 Add a no-more-sessions@openssh.com global request extension that the
1647 client sends when it knows that it will never request another session
1648 (i.e. when session multiplexing is disabled). This allows a server to
1649 disallow further session requests and terminate the session.
1650 Why would a non-multiplexing client ever issue additional session
1651 requests? It could have been attacked with something like SSH'jack:
1652 http://www.storm.net.nz/projects/7
1653 feedback & ok markus
Darren Tucker896ad5a2008-06-11 09:34:46 +10001654 - djm@cvs.openbsd.org 2008/06/10 23:06:19
1655 [auth-options.c match.c servconf.c addrmatch.c sshd.8]
1656 support CIDR address matching in .ssh/authorized_keys from="..." stanzas
1657 ok and extensive testing dtucker@
Darren Tucker2a8b1382008-06-11 09:35:37 +10001658 - dtucker@cvs.openbsd.org 2008/06/10 23:21:34
1659 [bufaux.c]
1660 Use '\0' for a nul byte rather than unadorned 0. ok djm@
Darren Tuckere045e0c2008-06-11 09:38:12 +10001661 - dtucker@cvs.openbsd.org 2008/06/10 23:13:43
1662 [Makefile regress/key-options.sh]
1663 Add regress test for key options. ok djm@
Darren Tucker5d376902008-06-11 04:15:05 +10001664 - (dtucker) [openbsd-compat/fake-rfc2553.h] Add sin6_scope_id to sockaddr_in6
1665 since the new CIDR code in addmatch.c references it.
1666 - (dtucker) [Makefile.in configure.ac regress/addrmatch.sh] Skip IPv6
1667 specific tests on platforms that don't do IPv6.
Darren Tucker34f49c62008-06-11 05:15:51 +10001668 - (dtucker) [Makefile.in] Define TEST_SSH_IPV6 in make's arguments as well
1669 as environment.
Darren Tuckerb8e05002008-06-11 09:47:59 +10001670 - (dtucker) [Makefile.in] Move addrmatch.o to libssh.a where it's needed now.
Darren Tucker7a3935d2008-06-10 22:59:10 +10001671
Darren Tucker422c34c2008-06-09 22:48:31 +1000167220080609
1673 - (dtucker) OpenBSD CVS Sync
1674 - dtucker@cvs.openbsd.org 2008/06/08 17:04:41
1675 [sftp-server.c]
1676 Add case for ENOSYS in errno_to_portable; ok deraadt
Darren Tucker7b598892008-06-09 22:49:36 +10001677 - dtucker@cvs.openbsd.org 2008/06/08 20:15:29
1678 [sftp.c sftp-client.c sftp-client.h]
1679 Have the sftp client store the statvfs replies in wire format,
1680 which prevents problems when the server's native sizes exceed the
1681 client's.
1682 Also extends the sizes of the remaining 32bit wire format to 64bit,
1683 they're specified as unsigned long in the standard.
Darren Tucker3463aca2008-06-09 23:06:55 +10001684 - dtucker@cvs.openbsd.org 2008/06/09 13:02:39
Darren Tucker588fe0e2008-06-09 23:52:22 +10001685 [sftp-server.c]
Darren Tucker3463aca2008-06-09 23:06:55 +10001686 Extend 32bit -> 64bit values for statvfs extension missed in previous
1687 commit.
Darren Tucker588fe0e2008-06-09 23:52:22 +10001688 - dtucker@cvs.openbsd.org 2008/06/09 13:38:46
1689 [PROTOCOL]
1690 Use a $OpenBSD tag so our scripts will sync changes.
Darren Tucker422c34c2008-06-09 22:48:31 +10001691
Darren Tucker598eaa62008-06-09 03:32:29 +1000169220080608
1693 - (dtucker) [configure.ac defines.h sftp-client.c sftp-server.c sftp.c
1694 openbsd-compat/Makefile.in openbsd-compat/openbsd-compat.h
1695 openbsd-compat/bsd-statvfs.{c,h}] Add a null implementation of statvfs and
1696 fstatvfs and remove #defines around statvfs code. ok djm@
Darren Tucker77001382008-06-09 06:17:53 +10001697 - (dtucker) [configure.ac defines.h sftp-client.c M sftp-server.c] Add a
1698 macro to convert fsid to unsigned long for platforms where fsid is a
1699 2-member array.
Darren Tucker598eaa62008-06-09 03:32:29 +10001700
Darren Tuckerce38d822008-06-07 06:25:15 +1000170120080607
1702 - (dtucker) [mux.c] Include paths.h inside ifdef HAVE_PATHS_H.
Darren Tucker5b2e2ba2008-06-08 09:25:28 +10001703 - (dtucker) [configure.ac defines.h sftp-client.c sftp-server.c sftp.c]
1704 Do not enable statvfs extensions on platforms that do not have statvfs.
Darren Tucker136e56f2008-06-08 12:49:30 +10001705 - (dtucker) OpenBSD CVS Sync
1706 - djm@cvs.openbsd.org 2008/05/19 06:14:02
1707 [packet.c] unbreak protocol keepalive timeouts bz#1465; ok dtucker@
Darren Tuckerdd392642008-06-08 12:53:20 +10001708 - djm@cvs.openbsd.org 2008/05/19 15:45:07
1709 [sshtty.c ttymodes.c sshpty.h]
1710 Fix sending tty modes when stdin is not a tty (bz#1199). Previously
1711 we would send the modes corresponding to a zeroed struct termios,
1712 whereas we should have been sending an empty list of modes.
1713 Based on patch from daniel.ritz AT alcatel.ch; ok dtucker@ markus@
Darren Tucker0f7e9102008-06-08 12:54:29 +10001714 - djm@cvs.openbsd.org 2008/05/19 15:46:31
1715 [ssh-keygen.c]
1716 support -l (print fingerprint) in combination with -F (find host) to
1717 search for a host in ~/.ssh/known_hosts and display its fingerprint;
1718 ok markus@
Darren Tuckerdf189fb2008-06-08 12:55:32 +10001719 - djm@cvs.openbsd.org 2008/05/19 20:53:52
1720 [clientloop.c]
1721 unbreak tree by committing this bit that I missed from:
1722 Fix sending tty modes when stdin is not a tty (bz#1199). Previously
1723 we would send the modes corresponding to a zeroed struct termios,
1724 whereas we should have been sending an empty list of modes.
1725 Based on patch from daniel.ritz AT alcatel.ch; ok dtucker@ markus@
Darren Tuckerce38d822008-06-07 06:25:15 +10001726
Damien Miller58ea61b2008-06-04 10:54:00 +1000172720080604
1728 - (djm) [openbsd-compat/bsd-arc4random.c] Fix math bug that caused bias
1729 in arc4random_uniform with upper_bound in (2^30,2*31). Note that
1730 OpenSSH did not make requests with upper bounds in this range.
1731
Damien Millera7058ec2008-05-20 08:57:06 +1000173220080519
1733 - (djm) [configure.ac mux.c sftp.c openbsd-compat/Makefile.in]
1734 [openbsd-compat/fmt_scaled.c openbsd-compat/openbsd-compat.h]
1735 Fix compilation on Linux, including pulling in fmt_scaled(3)
1736 implementation from OpenBSD's libutil.
1737
Damien Miller797e3d12008-05-19 14:27:42 +1000173820080518
1739 - (djm) OpenBSD CVS Sync
1740 - djm@cvs.openbsd.org 2008/04/04 05:14:38
1741 [sshd_config.5]
1742 ChrootDirectory is supported in Match blocks (in fact, it is most useful
1743 there). Spotted by Minstrel AT minstrel.org.uk
Damien Miller56f41dd2008-05-19 14:28:19 +10001744 - djm@cvs.openbsd.org 2008/04/04 06:44:26
1745 [sshd_config.5]
1746 oops, some unrelated stuff crept into that commit - backout.
1747 spotted by jmc@
Damien Miller25434de2008-05-19 14:29:08 +10001748 - djm@cvs.openbsd.org 2008/04/05 02:46:02
1749 [sshd_config.5]
1750 HostbasedAuthentication is supported under Match too
Damien Millera4be7c22008-05-19 14:47:37 +10001751 - (djm) [openbsd-compat/bsd-arc4random.c openbsd-compat/openbsd-compat.c]
1752 [configure.ac] Implement arc4random_buf(), import implementation of
1753 arc4random_uniform() from OpenBSD
Damien Millercaaed012008-05-19 15:26:54 +10001754 - (djm) [openbsd-compat/bsd-arc4random.c] Warning fixes
Damien Miller94178312008-05-19 15:28:35 +10001755 - (djm) [openbsd-compat/port-tun.c] needs sys/queue.h
Damien Miller354c48c2008-05-19 14:50:00 +10001756 - (djm) OpenBSD CVS Sync
1757 - djm@cvs.openbsd.org 2008/04/13 00:22:17
1758 [dh.c sshd.c]
1759 Use arc4random_buf() when requesting more than a single word of output
1760 Use arc4random_uniform() when the desired random number upper bound
1761 is not a power of two
1762 ok deraadt@ millert@
Damien Millerd671e5a2008-05-19 14:53:33 +10001763 - djm@cvs.openbsd.org 2008/04/18 12:32:11
1764 [sftp-client.c sftp-client.h sftp-server.c sftp.1 sftp.c sftp.h]
1765 introduce sftp extension methods statvfs@openssh.com and
1766 fstatvfs@openssh.com that implement statvfs(2)-like operations,
1767 based on a patch from miklos AT szeredi.hu (bz#1399)
1768 also add a "df" command to the sftp client that uses the
1769 statvfs@openssh.com to produce a df(1)-like display of filesystem
1770 space and inode utilisation
1771 ok markus@
Damien Miller64058cb2008-05-19 14:54:25 +10001772 - jmc@cvs.openbsd.org 2008/04/18 17:15:47
1773 [sftp.1]
1774 macro fixage;
Damien Millerff0dd882008-05-19 14:55:02 +10001775 - djm@cvs.openbsd.org 2008/04/18 22:01:33
1776 [session.c]
1777 remove unneccessary parentheses
Damien Miller0b4c1652008-05-19 14:55:29 +10001778 - otto@cvs.openbsd.org 2008/04/29 11:20:31
1779 [monitor_mm.h]
1780 garbage collect two unused fields in struct mm_master; ok markus@
Damien Millerbacb7fb2008-05-19 14:56:33 +10001781 - djm@cvs.openbsd.org 2008/04/30 10:14:03
1782 [ssh-keyscan.1 ssh-keyscan.c]
1783 default to rsa (protocol 2) keys, instead of rsa1 keys; spotted by
1784 larsnooden AT openoffice.org
Damien Miller4f755cd2008-05-19 14:57:41 +10001785 - pyr@cvs.openbsd.org 2008/05/07 05:49:37
1786 [servconf.c servconf.h session.c sshd_config.5]
1787 Enable the AllowAgentForwarding option in sshd_config (global and match
1788 context), to specify if agents should be permitted on the server.
1789 As the man page states:
1790 ``Note that disabling Agent forwarding does not improve security
1791 unless users are also denied shell access, as they can always install
1792 their own forwarders.''
1793 ok djm@, ok and a mild frown markus@
Damien Millerba3a6592008-05-19 14:58:22 +10001794 - pyr@cvs.openbsd.org 2008/05/07 06:43:35
1795 [sshd_config]
1796 push the sshd_config bits in, spotted by ajacoutot@
Damien Millere9890192008-05-19 14:59:02 +10001797 - jmc@cvs.openbsd.org 2008/05/07 08:00:14
1798 [sshd_config.5]
1799 sort;
Damien Millerdb255ca2008-05-19 14:59:37 +10001800 - markus@cvs.openbsd.org 2008/05/08 06:59:01
1801 [bufaux.c buffer.h channels.c packet.c packet.h]
1802 avoid extra malloc/copy/free when receiving data over the net;
1803 ~10% speedup for localhost-scp; ok djm@
Damien Millerb84886b2008-05-19 15:05:07 +10001804 - djm@cvs.openbsd.org 2008/05/08 12:02:23
1805 [auth-options.c auth1.c channels.c channels.h clientloop.c gss-serv.c]
1806 [monitor.c monitor_wrap.c nchan.c servconf.c serverloop.c session.c]
1807 [ssh.c sshd.c]
1808 Implement a channel success/failure status confirmation callback
1809 mechanism. Each channel maintains a queue of callbacks, which will
1810 be drained in order (RFC4253 guarantees confirm messages are not
1811 reordered within an channel).
1812 Also includes a abandonment callback to clean up if a channel is
1813 closed without sending confirmation messages. This probably
1814 shouldn't happen in compliant implementations, but it could be
1815 abused to leak memory.
1816 ok markus@ (as part of a larger diff)
Damien Miller7207f642008-05-19 15:34:50 +10001817 - djm@cvs.openbsd.org 2008/05/08 12:21:16
1818 [monitor.c monitor_wrap.c session.h servconf.c servconf.h session.c]
1819 [sshd_config sshd_config.5]
1820 Make the maximum number of sessions run-time controllable via
1821 a sshd_config MaxSessions knob. This is useful for disabling
1822 login/shell/subsystem access while leaving port-forwarding working
1823 (MaxSessions 0), disabling connection multiplexing (MaxSessions 1) or
1824 simply increasing the number of allows multiplexed sessions.
1825 Because some bozos are sure to configure MaxSessions in excess of the
1826 number of available file descriptors in sshd (which, at peak, might be
1827 as many as 9*MaxSessions), audit sshd to ensure that it doesn't leak fds
1828 on error paths, and make it fail gracefully on out-of-fd conditions -
1829 sending channel errors instead of than exiting with fatal().
1830 bz#1090; MaxSessions config bits and manpage from junyer AT gmail.com
1831 ok markus@
Damien Miller5771ed72008-05-19 15:35:33 +10001832 - djm@cvs.openbsd.org 2008/05/08 13:06:11
1833 [clientloop.c clientloop.h ssh.c]
1834 Use new channel status confirmation callback system to properly deal
1835 with "important" channel requests that fail, in particular command exec,
1836 shell and subsystem requests. Previously we would optimistically assume
1837 that the requests would always succeed, which could cause hangs if they
1838 did not (e.g. when the server runs out of fds) or were unimplemented by
1839 the server (bz #1384)
1840 Also, properly report failing multiplex channel requests via the mux
1841 client stderr (subject to LogLevel in the mux master) - better than
1842 silently failing.
1843 most bits ok markus@ (as part of a larger diff)
Damien Millerbd740252008-05-19 15:37:09 +10001844 - djm@cvs.openbsd.org 2008/05/09 04:55:56
1845 [channels.c channels.h clientloop.c serverloop.c]
1846 Try additional addresses when connecting to a port forward destination
1847 whose DNS name resolves to more than one address. The previous behaviour
1848 was to try the first address and give up.
1849 Reported by stig AT venaas.com in bz#343
1850 great feedback and ok markus@
Damien Millerb1cbfa22008-05-19 16:00:08 +10001851 - djm@cvs.openbsd.org 2008/05/09 14:18:44
1852 [clientloop.c clientloop.h ssh.c mux.c]
1853 tidy up session multiplexing code, moving it into its own file and
1854 making the function names more consistent - making ssh.c and
1855 clientloop.c a fair bit more readable.
1856 ok markus@
Damien Millerb3da5932008-05-19 16:02:37 +10001857 - djm@cvs.openbsd.org 2008/05/09 14:26:08
1858 [ssh.c]
1859 dingo stole my diff hunk
Damien Miller2ff1ca52008-05-19 16:04:56 +10001860 - markus@cvs.openbsd.org 2008/05/09 16:16:06
1861 [session.c]
1862 re-add the USE_PIPES code and enable it.
1863 without pipes shutdown-read from the sshd does not trigger
1864 a SIGPIPE when the forked program does a write.
1865 ok djm@
1866 (Id sync only, USE_PIPES never left portable OpenSSH)
Damien Millerd654dd22008-05-19 16:05:41 +10001867 - markus@cvs.openbsd.org 2008/05/09 16:17:51
1868 [channels.c]
1869 error-fd race: don't enable the error fd in the select bitmask
1870 for channels with both in- and output closed, since the channel
1871 will go away before we call select();
1872 report, lots of debugging help and ok djm@
Damien Millerbab9bd42008-05-19 16:06:47 +10001873 - markus@cvs.openbsd.org 2008/05/09 16:21:13
1874 [channels.h clientloop.c nchan.c serverloop.c]
1875 unbreak
1876 ssh -2 localhost od /bin/ls | true
1877 ignoring SIGPIPE by adding a new channel message (EOW) that signals
1878 the peer that we're not interested in any data it might send.
1879 fixes bz #85; discussion, debugging and ok djm@
Damien Miller0f30c872008-05-19 16:07:45 +10001880 - pvalchev@cvs.openbsd.org 2008/05/12 20:52:20
1881 [umac.c]
1882 Ensure nh_result lies on a 64-bit boundary (fixes warnings observed
1883 on Itanium on Linux); from Dale Talcott (bug #1462); ok djm@
Damien Miller5159bdd2008-05-19 16:08:20 +10001884 - djm@cvs.openbsd.org 2008/05/15 23:52:24
1885 [nchan2.ms]
1886 document eow message in ssh protocol 2 channel state machine;
1887 feedback and ok markus@
Damien Millera7e0d5a2008-05-19 16:08:41 +10001888 - djm@cvs.openbsd.org 2008/05/18 21:29:05
1889 [sftp-server.c]
1890 comment extension announcement
Damien Miller58a81142008-05-19 16:11:56 +10001891 - djm@cvs.openbsd.org 2008/05/16 08:30:42
1892 [PROTOCOL]
1893 document our protocol extensions and deviations; ok markus@
1894 - djm@cvs.openbsd.org 2008/05/17 01:31:56
1895 [PROTOCOL]
1896 grammar and correctness fixes from stevesk@
Damien Miller797e3d12008-05-19 14:27:42 +10001897
Damien Miller5f5cd742008-04-03 08:43:57 +1100189820080403
Damien Miller55754fb2008-04-04 16:16:35 +11001899 - (djm) [openbsd-compat/bsd-poll.c] Include stdlib.h to avoid compile-
1900 time warnings on LynxOS. Patch from ops AT iki.fi
Damien Millerc5750222008-05-16 10:01:54 +10001901 - (djm) Force string arguments to replacement setproctitle() though
1902 strnvis first. Ok dtucker@
Damien Miller55754fb2008-04-04 16:16:35 +11001903
190420080403
Damien Miller5f5cd742008-04-03 08:43:57 +11001905 - (djm) OpenBSD CVS sync:
1906 - markus@cvs.openbsd.org 2008/04/02 15:36:51
1907 [channels.c]
1908 avoid possible hijacking of x11-forwarded connections (back out 1.183)
1909 CVE-2008-1483; ok djm@
Damien Miller13ba9c22008-04-03 20:52:51 +11001910 - jmc@cvs.openbsd.org 2008/03/27 22:37:57
1911 [sshd.8]
1912 remove trailing whitespace;
Damien Millera68d31b2008-04-03 20:53:08 +11001913 - djm@cvs.openbsd.org 2008/04/03 09:50:14
1914 [version.h]
1915 openssh-5.0
Damien Miller5a4b6462008-04-03 20:55:44 +11001916 - (djm) [contrib/caldera/openssh.spec contrib/redhat/openssh.spec]
1917 [contrib/suse/openssh.spec] Crank version numbers in RPM spec files
Damien Millerffa83022008-04-03 20:56:38 +11001918 - (djm) [README] Update link to release notes
Damien Miller79a1bc92008-04-03 20:57:05 +11001919 - (djm) Release 5.0p1