blob: 1664c4fd0eb85b1247908fd96b10b4e10f4c5411 [file] [log] [blame]
Damien Miller9f67a212006-03-15 11:05:35 +1100120060315
2 - (djm) OpenBSD CVS Sync:
3 - msf@cvs.openbsd.org 2006/02/06 15:54:07
4 [ssh.1]
5 - typo fix
6 ok jmc@
Damien Millere93eaaa2006-03-15 11:05:59 +11007 - jmc@cvs.openbsd.org 2006/02/06 21:44:47
8 [ssh.1]
9 make this a little less ambiguous...
Damien Miller015cd792006-03-15 11:08:02 +110010 - stevesk@cvs.openbsd.org 2006/02/07 01:08:04
11 [auth-rhosts.c includes.h]
12 move #include <netgroup.h> out of includes.h; ok markus@
Damien Miller2eb63402006-03-15 11:09:42 +110013 - stevesk@cvs.openbsd.org 2006/02/07 01:18:09
14 [includes.h ssh-agent.c ssh-keyscan.c sshconnect2.c]
15 move #include <sys/queue.h> out of includes.h; ok markus@
Damien Miller99bd21e2006-03-15 11:11:28 +110016 - stevesk@cvs.openbsd.org 2006/02/07 01:42:00
17 [channels.c clientloop.c clientloop.h includes.h packet.h]
18 [serverloop.c sshpty.c sshpty.h sshtty.c ttymodes.c]
19 move #include <termios.h> out of includes.h; ok markus@
Damien Miller972c84b2006-03-15 11:11:56 +110020 - stevesk@cvs.openbsd.org 2006/02/07 01:52:50
21 [sshtty.c]
22 "log.h" not needed
Damien Miller5d771052006-03-15 11:12:13 +110023 - stevesk@cvs.openbsd.org 2006/02/07 03:47:05
24 [hostfile.c]
25 "packet.h" not needed
Damien Millerde6dd0a2006-03-15 11:12:38 +110026 - stevesk@cvs.openbsd.org 2006/02/07 03:59:20
27 [deattack.c]
28 duplicate #include
Damien Miller03e20032006-03-15 11:16:59 +110029 - stevesk@cvs.openbsd.org 2006/02/08 12:15:27
30 [auth.c clientloop.c includes.h misc.c monitor.c readpass.c]
31 [session.c sftp.c ssh-agent.c ssh-keysign.c ssh.c sshconnect.c]
32 [sshd.c sshpty.c]
33 move #include <paths.h> out of includes.h; ok markus@
Damien Miller3a4051e2006-03-15 11:19:42 +110034 - stevesk@cvs.openbsd.org 2006/02/08 12:32:49
35 [includes.h misc.c]
36 move #include <netinet/tcp.h> out of includes.h; ok markus@
Damien Miller0b70b542006-03-15 11:20:03 +110037 - stevesk@cvs.openbsd.org 2006/02/08 13:15:44
38 [gss-serv.c monitor.c]
39 small KNF
Damien Miller52ab0842006-03-15 11:20:46 +110040 - stevesk@cvs.openbsd.org 2006/02/08 14:16:59
41 [sshconnect.c]
42 <openssl/bn.h> not needed
Damien Millercd4223c2006-03-15 11:22:47 +110043 - stevesk@cvs.openbsd.org 2006/02/08 14:31:30
44 [includes.h ssh-agent.c ssh-keyscan.c ssh.c]
45 move #include <sys/resource.h> out of includes.h; ok markus@
Damien Miller68f8e992006-03-15 11:24:12 +110046 - stevesk@cvs.openbsd.org 2006/02/08 14:38:18
47 [includes.h packet.c]
48 move #include <netinet/in_systm.h> and <netinet/ip.h> out of
49 includes.h; ok markus@
Damien Miller88f254b2006-03-15 11:25:13 +110050 - stevesk@cvs.openbsd.org 2006/02/08 23:51:24
51 [includes.h scp.c sftp-glob.c sftp-server.c]
52 move #include <dirent.h> out of includes.h; ok markus@
Damien Miller1d905402006-03-15 11:26:55 +110053 - stevesk@cvs.openbsd.org 2006/02/09 00:32:07
54 [includes.h]
55 #include <sys/endian.h> not needed; ok djm@
56 NB. ID Sync only - we still need this (but it may move later)
Damien Millerc47d7e92006-03-15 11:27:20 +110057 - jmc@cvs.openbsd.org 2006/02/09 10:10:47
58 [sshd.8]
59 - move some text into a CAVEATS section
60 - merge the COMMAND EXECUTION... section into AUTHENTICATION
Damien Miller17e91c02006-03-15 11:28:34 +110061 - stevesk@cvs.openbsd.org 2006/02/10 00:27:13
62 [channels.c clientloop.c includes.h misc.c progressmeter.c sftp.c]
63 [ssh.c sshd.c sshpty.c]
64 move #include <sys/ioctl.h> out of includes.h; ok markus@
Damien Miller9cf6d072006-03-15 11:29:24 +110065 - stevesk@cvs.openbsd.org 2006/02/10 01:44:27
66 [includes.h monitor.c readpass.c scp.c serverloop.c session.c]
67 [sftp.c sshconnect.c sshconnect2.c sshd.c]
68 move #include <sys/wait.h> out of includes.h; ok markus@
Damien Miller3fd019e2006-03-15 11:29:51 +110069 - otto@cvs.openbsd.org 2006/02/11 19:31:18
70 [atomicio.c]
71 type correctness; from Ray Lai in PR 5011; ok millert@
Damien Miller3ec54c72006-03-15 11:30:13 +110072 - djm@cvs.openbsd.org 2006/02/12 06:45:34
73 [ssh.c ssh_config.5]
74 add a %l expansion code to the ControlPath, which is filled in with the
75 local hostname at runtime. Requested by henning@ to avoid some problems
76 with /home on NFS; ok dtucker@
Damien Millerb59d4fe2006-03-15 11:30:38 +110077 - djm@cvs.openbsd.org 2006/02/12 10:44:18
78 [readconf.c]
79 raise error when the user specifies a RekeyLimit that is smaller than 16
80 (the smallest of our cipher's blocksize) or big enough to cause integer
81 wraparound; ok & feedback dtucker@
Damien Miller20c2ec42006-03-15 11:31:01 +110082 - jmc@cvs.openbsd.org 2006/02/12 10:49:44
83 [ssh_config.5]
84 slight rewording; ok djm
Damien Millerdcfea272006-03-15 11:31:22 +110085 - jmc@cvs.openbsd.org 2006/02/12 10:52:41
86 [sshd.8]
87 rework the description of authorized_keys a little;
Damien Miller31bdc522006-03-15 11:31:44 +110088 - jmc@cvs.openbsd.org 2006/02/12 17:57:19
89 [sshd.8]
90 sort the list of options permissable w/ authorized_keys;
91 ok djm dtucker
Damien Miller7d2ef022006-03-15 11:32:06 +110092 - jmc@cvs.openbsd.org 2006/02/13 10:16:39
93 [sshd.8]
94 no need to subsection the authorized_keys examples - instead, convert
95 this to look like an actual file. also use proto 2 keys, and use IETF
96 example addresses;
Damien Miller9a7f2012006-03-15 11:32:42 +110097 - jmc@cvs.openbsd.org 2006/02/13 10:21:25
98 [sshd.8]
99 small tweaks for the ssh_known_hosts section;
Damien Millercc00f5e2006-03-15 11:33:00 +1100100 - jmc@cvs.openbsd.org 2006/02/13 11:02:26
101 [sshd.8]
102 turn this into an example ssh_known_hosts file; ok djm
Damien Millerc8f61cf2006-03-15 11:33:25 +1100103 - jmc@cvs.openbsd.org 2006/02/13 11:08:43
104 [sshd.8]
105 - avoid nasty line split
106 - `*' does not need to be escaped
Damien Millerd8702e82006-03-15 11:33:56 +1100107 - jmc@cvs.openbsd.org 2006/02/13 11:27:25
108 [sshd.8]
109 sort FILES and use a -compact list;
Damien Miller0c8d8f62006-03-15 11:34:25 +1100110 - david@cvs.openbsd.org 2006/02/15 05:08:24
111 [sftp-client.c]
112 typo in comment; ok djm@
Damien Miller39a93a32006-03-15 11:34:45 +1100113 - jmc@cvs.openbsd.org 2006/02/15 16:53:20
114 [ssh.1]
115 remove the IETF draft references and replace them with some updated RFCs;
Damien Millerbc1936a2006-03-15 11:35:05 +1100116 - jmc@cvs.openbsd.org 2006/02/15 16:55:33
117 [sshd.8]
118 remove ietf draft references; RFC list now maintained in ssh.1;
Damien Milleradc35b92006-03-15 11:35:27 +1100119 - jmc@cvs.openbsd.org 2006/02/16 09:05:34
120 [sshd.8]
121 sync some of the FILES entries w/ ssh.1;
Damien Millerfd725cf2006-03-15 11:35:54 +1100122 - jmc@cvs.openbsd.org 2006/02/19 19:52:10
123 [sshd.8]
124 move the sshrc stuff out of FILES, and into its own section:
125 FILES is not a good place to document how stuff works;
Damien Miller445121f2006-03-15 11:36:18 +1100126 - jmc@cvs.openbsd.org 2006/02/19 20:02:17
127 [sshd.8]
128 sync the (s)hosts.equiv FILES entries w/ those from ssh.1;
Damien Milleredd03752006-03-15 11:36:45 +1100129 - jmc@cvs.openbsd.org 2006/02/19 20:05:00
130 [sshd.8]
131 grammar;
Damien Miller5c853b52006-03-15 11:37:02 +1100132 - jmc@cvs.openbsd.org 2006/02/19 20:12:25
133 [ssh_config.5]
134 add some vertical space;
Damien Miller574c41f2006-03-15 11:40:10 +1100135 - stevesk@cvs.openbsd.org 2006/02/20 16:36:15
136 [authfd.c channels.c includes.h session.c ssh-agent.c ssh.c]
137 move #include <sys/un.h> out of includes.h; ok djm@
Damien Millerf17883e2006-03-15 11:45:54 +1100138 - stevesk@cvs.openbsd.org 2006/02/20 17:02:44
139 [clientloop.c includes.h monitor.c progressmeter.c scp.c]
140 [serverloop.c session.c sftp.c ssh-agent.c ssh.c sshd.c]
141 move #include <signal.h> out of includes.h; ok markus@
Damien Miller6ff3cad2006-03-15 11:52:09 +1100142 - stevesk@cvs.openbsd.org 2006/02/20 17:19:54
143 [auth-rhosts.c auth-rsa.c auth.c auth2-none.c auth2-pubkey.c]
144 [authfile.c clientloop.c includes.h readconf.c scp.c session.c]
145 [sftp-client.c sftp-common.c sftp-common.h sftp-glob.c]
146 [sftp-server.c sftp.c ssh-add.c ssh-keygen.c ssh.c sshconnect.c]
147 [sshconnect2.c sshd.c sshpty.c]
148 move #include <sys/stat.h> out of includes.h; ok markus@
Damien Millerc7b06362006-03-15 11:53:45 +1100149 - stevesk@cvs.openbsd.org 2006/02/22 00:04:45
150 [canohost.c clientloop.c includes.h match.c readconf.c scp.c ssh.c]
151 [sshconnect.c]
152 move #include <ctype.h> out of includes.h; ok djm@
Damien Miller6def5512006-03-15 11:54:05 +1100153 - jmc@cvs.openbsd.org 2006/02/24 10:25:14
154 [ssh_config.5]
155 add section on patterns;
156 from dtucker + myself
Damien Miller0c2079d2006-03-15 11:54:21 +1100157 - jmc@cvs.openbsd.org 2006/02/24 10:33:54
158 [sshd_config.5]
159 signpost to PATTERNS;
Damien Millerf54a4b92006-03-15 11:54:36 +1100160 - jmc@cvs.openbsd.org 2006/02/24 10:37:07
161 [ssh_config.5]
162 tidy up the refs to PATTERNS;
Damien Millerc7d5b5e2006-03-15 11:55:08 +1100163 - jmc@cvs.openbsd.org 2006/02/24 10:39:52
164 [sshd.8]
165 signpost to PATTERNS section;
Damien Miller1faa7132006-03-15 11:55:31 +1100166 - jmc@cvs.openbsd.org 2006/02/24 20:22:16
167 [ssh-keysign.8 ssh_config.5 sshd_config.5]
168 some consistency fixes;
Damien Miller208f1ed2006-03-15 11:56:03 +1100169 - jmc@cvs.openbsd.org 2006/02/24 20:31:31
170 [ssh.1 ssh_config.5 sshd.8 sshd_config.5]
171 more consistency fixes;
Damien Miller45ee2b92006-03-15 11:56:18 +1100172 - jmc@cvs.openbsd.org 2006/02/24 23:20:07
173 [ssh_config.5]
174 some grammar/wording fixes;
Damien Miller5b0d63f2006-03-15 11:56:56 +1100175 - jmc@cvs.openbsd.org 2006/02/24 23:43:57
176 [sshd_config.5]
177 some grammar/wording fixes;
Damien Millerf4f22b52006-03-15 11:57:25 +1100178 - jmc@cvs.openbsd.org 2006/02/24 23:51:17
179 [sshd_config.5]
180 oops - bits i missed;
Damien Miller9cfbaec2006-03-15 11:57:55 +1100181 - jmc@cvs.openbsd.org 2006/02/25 12:26:17
182 [ssh_config.5]
183 document the possible values for KbdInteractiveDevices;
Damien Millerd450f492006-03-15 11:58:25 +1100184 help/ok dtucker
Damien Millerac73e512006-03-15 11:58:49 +1100185 - jmc@cvs.openbsd.org 2006/02/25 12:28:34
186 [sshd_config.5]
187 document the order in which allow/deny directives are processed;
188 help/ok dtucker
Damien Millerb5282c22006-03-15 11:59:08 +1100189 - jmc@cvs.openbsd.org 2006/02/26 17:17:18
190 [ssh_config.5]
191 move PATTERNS to the end of the main body; requested by dtucker
Damien Millere3beba22006-03-15 11:59:25 +1100192 - jmc@cvs.openbsd.org 2006/02/26 18:01:13
193 [sshd_config.5]
194 subsection is pointless here;
Damien Miller4aea9742006-03-15 11:59:39 +1100195 - jmc@cvs.openbsd.org 2006/02/26 18:03:10
196 [ssh_config.5]
197 comma;
Damien Miller1cf76d92006-03-15 12:01:14 +1100198 - djm@cvs.openbsd.org 2006/02/28 01:10:21
199 [session.c]
200 fix logout recording when privilege separation is disabled, analysis and
201 patch from vinschen at redhat.com; tested by dtucker@ ok deraadt@
202 NB. ID sync only - patch already in portable
Damien Millerec04f362006-03-15 12:01:34 +1100203 - djm@cvs.openbsd.org 2006/03/04 04:12:58
204 [serverloop.c]
205 move a debug() outside of a signal handler; ok markus@ a little while back
Damien Miller2ecb6bd2006-03-15 12:03:53 +1100206 - djm@cvs.openbsd.org 2006/03/12 04:23:07
207 [ssh.c]
208 knf nit
Damien Millerb24c2f82006-03-15 12:04:36 +1100209 - djm@cvs.openbsd.org 2006/03/13 08:16:00
210 [sshd.c]
211 don't log that we are listening on a socket before the listen() call
212 actually succeeds, bz #1162 reported by Senthil Kumar; ok dtucker@
Damien Miller314dd4b2006-03-15 12:05:22 +1100213 - dtucker@cvs.openbsd.org 2006/03/13 08:33:00
214 [packet.c]
215 Set TCP_NODELAY for all connections not just "interactive" ones. Fixes
216 poor performance and protocol stalls under some network conditions (mindrot
217 bugs #556 and #981). Patch originally from markus@, ok djm@
Damien Miller8056a9d2006-03-15 12:05:40 +1100218 - dtucker@cvs.openbsd.org 2006/03/13 08:43:16
219 [ssh-keygen.c]
220 Make ssh-keygen handle CR and CRLF line termination when converting IETF
221 format keys, in adition to vanilla LF. mindrot #1157, tested by Chris
222 Pepper, ok djm@
Damien Miller306d1182006-03-15 12:05:59 +1100223 - dtucker@cvs.openbsd.org 2006/03/13 10:14:29
224 [misc.c ssh_config.5 sshd_config.5]
225 Allow config directives to contain whitespace by surrounding them by double
226 quotes. mindrot #482, man page help from jmc@, ok djm@
Damien Miller8275fad2006-03-15 12:06:23 +1100227 - dtucker@cvs.openbsd.org 2006/03/13 10:26:52
228 [authfile.c authfile.h ssh-add.c]
229 Make ssh-add check file permissions before attempting to load private
230 key files multiple times; it will fail anyway and this prevents confusing
231 multiple prompts and warnings. mindrot #1138, ok djm@
Damien Millerde85a282006-03-15 12:06:41 +1100232 - djm@cvs.openbsd.org 2006/03/14 00:15:39
233 [canohost.c]
234 log the originating address and not just the name when a reverse
235 mapping check fails, requested by linux AT linuon.com
Damien Millercc3e8ba2006-03-15 12:06:55 +1100236 - markus@cvs.openbsd.org 2006/03/14 16:32:48
237 [ssh_config.5 sshd_config.5]
238 *AliveCountMax applies to protcol v2 only; ok dtucker, djm
Damien Millera63128d2006-03-15 12:08:28 +1100239 - djm@cvs.openbsd.org 2006/03/07 09:07:40
240 [kex.c kex.h monitor.c myproposal.h ssh-keyscan.c sshconnect2.c sshd.c]
241 Implement the diffie-hellman-group-exchange-sha256 key exchange method
242 using the SHA256 code in libc (and wrapper to make it into an OpenSSL
243 EVP), interop tested against CVS PuTTY
244 NB. no portability bits committed yet
Damien Milleraf87af12006-03-15 13:02:28 +1100245 - (djm) [configure.ac defines.h kex.c md-sha256.c]
246 [openbsd-compat/sha2.h openbsd-compat/openbsd-compat.h]
247 [openbsd-compat/sha2.c] First stab at portability glue for SHA256
248 KEX support, should work with libc SHA256 support or OpenSSL
249 EVP_sha256 if present
Damien Millerdcf4ca12006-03-15 13:07:48 +1100250 - (djm) [includes.h] Restore accidentally dropped netinet/in.h
Damien Miller9f67a212006-03-15 11:05:35 +1100251
Darren Tuckerd1450db2006-03-13 19:06:51 +110025220060313
253 - (dtucker) [configure.ac] Bug #1171: Don't use printf("%lld", longlong)
254 since not all platforms support it. Instead, use internal equivalent while
255 computing LLONG_MIN and LLONG_MAX. Remove special case for alpha-dec-osf*
256 as it's no longer required. Tested by Bernhard Simon, ok djm@
257
Darren Tucker18614c22006-03-04 08:50:31 +110025820060304
259 - (dtucker) [contrib/cygwin/ssh-host-config] Require use of lastlog as a
260 file rather than directory, required as Cygwin will be importing lastlog(1).
261 Also tightens up permissions on the file. Patch from vinschen@redhat.com.
Darren Tucker890909e2006-03-04 08:59:39 +1100262 - (dtucker) [gss-serv-krb5.c] Bug #1166: Correct #ifdefs for gssapi_krb5.h
263 includes. Patch from gentoo.riverrat at gmail.com.
Darren Tucker18614c22006-03-04 08:50:31 +1100264
Darren Tucker54b75fe2006-02-26 12:31:48 +110026520060226
266 - (dtucker) [configure.ac] Bug #1156: QNX apparently needs SSHD_ACQUIRES_CTTY
267 patch from kraai at ftbfs.org.
268
26920060223
Darren Tuckera4904f72006-02-23 21:35:30 +1100270 - (dtucker) [sshd_config sshd_config.5] Update UsePAM to reflect current
271 reality. Pointed out by tryponraj at gmail.com.
272
Darren Tucker54b75fe2006-02-26 12:31:48 +110027320060222
Darren Tucker94413cf2006-02-22 22:24:47 +1100274 - (dtucker) [openbsd-compat/openssl-compat.{c,h}] Minor tidy up: only
275 compile in compat code if required.
276
Darren Tucker3322e0d2006-02-22 00:00:27 +110027720060221
278 - (dtucker) [openbsd-compat/openssl-compat.h] Prevent warning about
279 redefinition of SSLeay_add_all_algorithms.
280
Darren Tuckerfabdb6c2006-02-20 20:17:35 +110028120060220
282 - (dtucker) [INSTALL configure.ac openbsd-compat/openssl-compat.{c,h}]
283 Add optional enabling of OpenSSL's (hardware) Engine support, via
284 configure --with-ssl-engine. Based in part on a diff by michal at
285 logix.cz.
286
Darren Tucker4881c372006-02-19 22:50:20 +110028720060219
288 - (dtucker) [Makefile.in configure.ac, added openbsd-compat/regress/]
289 Add first attempt at regress tests for compat library. ok djm@
290
Tim Ricebf209f52006-02-13 12:46:44 -080029120060214
292 - (tim) [buildpkg.sh.in] Make the names consistent.
293 s/pkg_post_make_install_fixes.sh/pkg-post-make-install-fixes.sh/ OK dtucker@
294
Darren Tucker84af6152006-02-12 11:59:08 +110029520060212
296 - (dtucker) [openbsd-compat/bsd-cygwin_util.c] Make loop counter unsigned
297 to silence compiler warning, from vinschen at redhat.com.
Tim Rice2f993462006-02-11 18:37:48 -0800298 - (tim) [configure.ac] Bug #1149. Disable /etc/default/login check for QNX.
Darren Tucker61633502006-02-12 16:48:56 +1100299 - (dtucker) [README version.h contrib/caldera/openssh.spec
300 contrib/redhat/openssh.spec contrib/suse/openssh.spec] Bump version
301 strings to match 4.3p2 release.
Darren Tucker84af6152006-02-12 11:59:08 +1100302
Tim Rice83d2f5f2006-02-07 15:17:44 -080030320060208
304 - (tim) [session.c] Logout records were not updated on systems with
305 post auth privsep disabled due to bug 1086 changes. Analysis and patch
306 by vinschen at redhat.com. OK tim@, dtucker@.
Darren Tucker988b3fd2006-02-08 22:11:27 +1100307 - (dtucker) [configure.ac] Typo in Ultrix and NewsOS sections (NEED_SETPRGP
Darren Tuckerf35014a2006-03-04 09:00:19 +1100308 -> NEED_SETPGRP), reported by Bernhard Simon. ok tim@
Tim Rice83d2f5f2006-02-07 15:17:44 -0800309
Tim Riceac9b0602006-02-05 11:27:10 -080031020060206
311 - (tim) [configure.ac] Remove unnecessary tests for net/if.h and
312 netinet/in_systm.h. OK dtucker@.
313
Tim Rice0daad782006-02-04 17:33:55 -080031420060205
315 - (tim) [configure.ac] Add AC_REVISION. Add sys/time.h to lastlog.h test
316 for Solaris. OK dtucker@.
Tim Rice70335a62006-02-04 17:42:58 -0800317 - (tim) [configure.ac] Bug #1149. Changes in QNX section only. Patch by
318 kraai at ftbfs.org.
Tim Rice0daad782006-02-04 17:33:55 -0800319
Tim Ricefd80ddc2006-02-02 19:11:56 -080032020060203
321 - (tim) [configure.ac] test for egrep (AC_PROG_EGREP) before first
322 AC_CHECK_HEADERS test. Without it, if AC_CHECK_HEADERS is first run
323 by a platform specific check, builtin standard includes tests will be
324 skipped on the other platforms.
325 Analysis and suggestion by vinschen at redhat.com, patch by dtucker@.
326 OK tim@, djm@.
327
Darren Tuckercc7c2122006-02-02 18:44:19 +110032820060202
329 - (dtucker) [configure.ac] Bug #1148: Fix "crippled AES" test so that it
330 works with picky compilers. Patch from alex.kiernan at thus.net.
331
Damien Millere682cb02006-02-01 11:21:01 +110033220060201
333 - (djm) [regress/test-exec.sh] Try 'logname' as well as 'whoami' to
334 determine the user's login name - needed for regress tests on Solaris
335 10 and OpenSolaris
Damien Miller8bbdf902006-02-01 22:05:25 +1100336 - (djm) OpenBSD CVS Sync
337 - jmc@cvs.openbsd.org 2006/02/01 09:06:50
338 [sshd.8]
339 - merge sections on protocols 1 and 2 into a single section
340 - remove configuration file section
341 ok markus
Damien Miller2ac05772006-02-01 22:05:42 +1100342 - jmc@cvs.openbsd.org 2006/02/01 09:11:41
343 [sshd.8]
344 small tweak;
Damien Miller0d689562006-02-01 22:10:47 +1100345 - (djm) [contrib/caldera/openssh.spec contrib/redhat/openssh.spec]
346 [contrib/suse/openssh.spec] Update versions ahead of release
Damien Millerc79824b2006-02-01 22:27:31 +1100347 - markus@cvs.openbsd.org 2006/02/01 11:27:22
348 [version.h]
349 openssh 4.3
Damien Millerbfd52192006-02-01 22:32:17 +1100350 - (djm) Release OpenSSH 4.3p1
Damien Millere682cb02006-02-01 11:21:01 +1100351
Damien Millerddfddf12006-01-31 21:39:03 +110035220060131
353 - (djm) OpenBSD CVS Sync
354 - jmc@cvs.openbsd.org 2006/01/20 11:21:45
355 [ssh_config.5]
356 - word change, agreed w/ markus
357 - consistency fixes
Damien Miller99cc4a82006-01-31 21:45:53 +1100358 - jmc@cvs.openbsd.org 2006/01/25 09:04:34
359 [sshd.8]
360 move the options description up the page, and a few additional tweaks
361 whilst in here;
362 ok markus
Damien Miller7602cba2006-01-31 21:46:20 +1100363 - jmc@cvs.openbsd.org 2006/01/25 09:07:22
364 [sshd.8]
365 move subsections to full sections;
Damien Millerbbc59092006-01-31 21:46:51 +1100366 - jmc@cvs.openbsd.org 2006/01/26 08:47:56
367 [ssh.1]
368 add a section on verifying host keys in dns;
369 written with a lot of help from jakob;
370 feedback dtucker/markus;
371 ok markus
Damien Millere204f6a2006-01-31 21:47:15 +1100372 - reyk@cvs.openbsd.org 2006/01/30 12:22:22
373 [channels.c]
374 mark channel as write failed or dead instead of read failed on error
375 of the channel output filter.
376 ok markus@
Damien Millerb5dd55c2006-01-31 21:47:58 +1100377 - jmc@cvs.openbsd.org 2006/01/30 13:37:49
378 [ssh.1]
379 remove an incorrect sentence;
380 reported by roumen petrov;
381 ok djm markus
Damien Miller3eec6b72006-01-31 21:49:27 +1100382 - djm@cvs.openbsd.org 2006/01/31 10:19:02
383 [misc.c misc.h scp.c sftp.c]
384 fix local arbitrary command execution vulnerability on local/local and
385 remote/remote copies (CVE-2006-0225, bz #1094), patch by
386 t8m AT centrum.cz, polished by dtucker@ and myself; ok markus@
Damien Miller923f1ce2006-01-31 22:11:37 +1100387 - djm@cvs.openbsd.org 2006/01/31 10:35:43
388 [scp.c]
389 "scp a b c" shouldn't clobber "c" when it is not a directory, report and
390 fix from biorn@; ok markus@
Damien Millerc34940c2006-01-31 21:57:27 +1100391 - (djm) Sync regress tests to OpenBSD:
392 - dtucker@cvs.openbsd.org 2005/03/10 10:20:39
393 [regress/forwarding.sh]
394 Regress test for ClearAllForwardings (bz #994); ok markus@
Damien Miller76be6b82006-01-31 21:59:01 +1100395 - dtucker@cvs.openbsd.org 2005/04/25 09:54:09
396 [regress/multiplex.sh]
397 Don't call cleanup in multiplex as test-exec will cleanup anyway
398 found by tim@, ok djm@
399 NB. ID sync only, we already had this
400 - djm@cvs.openbsd.org 2005/05/20 23:14:15
401 [regress/test-exec.sh]
402 force addressfamily=inet for tests, unbreaking dynamic-forward regress for
403 recently committed nc SOCKS5 changes
Damien Millerec7b2f12006-01-31 21:59:35 +1100404 - djm@cvs.openbsd.org 2005/05/24 04:10:54
Damien Miller10c5fa72006-01-31 22:01:42 +1100405 [regress/try-ciphers.sh]
Damien Millerec7b2f12006-01-31 21:59:35 +1100406 oops, new arcfour modes here too
Damien Miller10c5fa72006-01-31 22:01:42 +1100407 - markus@cvs.openbsd.org 2005/06/30 11:02:37
408 [regress/scp.sh]
409 allow SUDO=sudo; from Alexander Bluhm
Damien Miller27a0dfa2006-01-31 22:02:16 +1100410 - grunk@cvs.openbsd.org 2005/11/14 21:25:56
411 [regress/agent-getpeereid.sh]
412 all other scripts in this dir use $SUDO, not 'sudo', so pull this even
413 ok markus@
Damien Miller15a815b2006-01-31 22:03:11 +1100414 - dtucker@cvs.openbsd.org 2005/12/14 04:36:39
415 [regress/scp-ssh-wrapper.sh]
416 Fix assumption about how many args scp will pass; ok djm@
417 NB. ID sync only, we already had this
Damien Miller0b996462006-01-31 22:05:23 +1100418 - djm@cvs.openbsd.org 2006/01/27 06:49:21
419 [scp.sh]
420 regress test for local to local scp copies; ok dtucker@
Damien Miller7410ad72006-01-31 22:06:14 +1100421 - djm@cvs.openbsd.org 2006/01/31 10:23:23
422 [scp.sh]
423 regression test for CVE-2006-0225 written by dtucker@
Damien Miller50c6eed2006-01-31 22:06:41 +1100424 - djm@cvs.openbsd.org 2006/01/31 10:36:33
425 [scp.sh]
426 regress test for "scp a b c" where "c" is not a directory
Damien Millerddfddf12006-01-31 21:39:03 +1100427
Darren Tuckerfbea7642006-01-30 00:22:39 +110042820060129
429 - (dtucker) [configure.ac opensshd.init.in] Bug #1144: Use /bin/sh for the
430 opensshd.init script interpretter if /sbin/sh does not exist. ok tim@
431
Darren Tucker94299ec2006-01-20 11:30:14 +110043220060120
433 - (dtucker) OpenBSD CVS Sync
434 - jmc@cvs.openbsd.org 2006/01/15 17:37:05
435 [ssh.1]
436 correction from deraadt
Darren Tucker248dd132006-01-20 11:30:58 +1100437 - jmc@cvs.openbsd.org 2006/01/18 10:53:29
438 [ssh.1]
439 add a section on ssh-based vpn, based on reyk's README.tun;
Darren Tucker62388b22006-01-20 11:31:47 +1100440 - dtucker@cvs.openbsd.org 2006/01/20 00:14:55
441 [scp.1 ssh.1 ssh_config.5 sftp.1]
442 Document RekeyLimit. Based on patch from jan.iven at cern.ch from mindrot
443 #1056 with feedback from jmc, djm and markus; ok jmc@ djm@
Darren Tucker94299ec2006-01-20 11:30:14 +1100444
Damien Millere87eb4c2006-01-14 10:08:36 +110044520060114
446 - (djm) OpenBSD CVS Sync
447 - jmc@cvs.openbsd.org 2006/01/06 13:27:32
448 [ssh.1]
449 weed out some duplicate info in the known_hosts FILES entries;
450 ok djm
Damien Miller7e76e1f2006-01-14 10:08:57 +1100451 - jmc@cvs.openbsd.org 2006/01/06 13:29:10
452 [ssh.1]
453 final round of whacking FILES for duplicate info, and some consistency
454 fixes;
455 ok djm
Damien Millerf3177182006-01-14 10:09:13 +1100456 - jmc@cvs.openbsd.org 2006/01/12 14:44:12
457 [ssh.1]
458 split sections on tcp and x11 forwarding into two sections.
459 add an example in the tcp section, based on sth i wrote for ssh faq;
460 help + ok: djm markus dtucker
Damien Miller8bfaf932006-01-14 10:09:30 +1100461 - jmc@cvs.openbsd.org 2006/01/12 18:48:48
462 [ssh.1]
463 refer to `TCP' rather than `TCP/IP' in the context of connection
464 forwarding;
465 ok markus
Damien Miller7c24b812006-01-14 10:09:56 +1100466 - jmc@cvs.openbsd.org 2006/01/12 22:20:00
467 [sshd.8]
468 refer to TCP forwarding, rather than TCP/IP forwarding;
Damien Millere9d001e2006-01-14 10:10:17 +1100469 - jmc@cvs.openbsd.org 2006/01/12 22:26:02
470 [ssh_config.5]
471 refer to TCP forwarding, rather than TCP/IP forwarding;
Damien Miller4a8dc9e2006-01-14 10:10:31 +1100472 - jmc@cvs.openbsd.org 2006/01/12 22:34:12
473 [ssh.1]
474 back out a sentence - AUTHENTICATION already documents this;
Damien Millere87eb4c2006-01-14 10:08:36 +1100475
Darren Tuckere78c6ce2006-01-10 00:02:44 +110047620060109
477 - (dtucker) [contrib/cygwin/ssh-host-config] Make sshd service depend on
478 tcpip service so it's always started after IP is up. Patch from
479 vinschen at redhat.com.
480
Damien Miller7655f5c2006-01-06 14:48:18 +110048120060106
482 - (djm) OpenBSD CVS Sync
483 - jmc@cvs.openbsd.org 2006/01/03 16:31:10
484 [ssh.1]
485 move FILES to a -compact list, and make each files an item in that list.
486 this avoids nastly line wrap when we have long pathnames, and treats
487 each file as a separate item;
488 remove the .Pa too, since it is useless.
Damien Miller6aa22902006-01-06 14:48:34 +1100489 - jmc@cvs.openbsd.org 2006/01/03 16:35:30
490 [ssh.1]
491 use a larger width for the ENVIRONMENT list;
Damien Millerfb8ea742006-01-06 14:48:52 +1100492 - jmc@cvs.openbsd.org 2006/01/03 16:52:36
493 [ssh.1]
494 put FILES in some sort of order: sort by pathname
Damien Miller4c102ee2006-01-06 14:49:17 +1100495 - jmc@cvs.openbsd.org 2006/01/03 16:55:18
496 [ssh.1]
497 tweak the description of ~/.ssh/environment
Damien Miller1bcdb502006-01-06 14:49:38 +1100498 - jmc@cvs.openbsd.org 2006/01/04 18:42:46
499 [ssh.1]
500 chop out some duplication in the .{r,s}hosts/{h,sh}osts.equiv FILES
501 entries;
502 ok markus
Damien Millera246d3b2006-01-06 14:49:54 +1100503 - jmc@cvs.openbsd.org 2006/01/04 18:45:01
504 [ssh.1]
505 remove .Xr's to rsh(1) and telnet(1): they are hardly needed;
Damien Miller128a0f12006-01-06 14:50:11 +1100506 - jmc@cvs.openbsd.org 2006/01/04 19:40:24
507 [ssh.1]
508 +.Xr ssh-keyscan 1 ,
Damien Millerc27f83a2006-01-06 14:50:26 +1100509 - jmc@cvs.openbsd.org 2006/01/04 19:50:09
510 [ssh.1]
511 -.Xr gzip 1 ,
Damien Miller72c5b7d2006-01-06 14:50:44 +1100512 - djm@cvs.openbsd.org 2006/01/05 23:43:53
513 [misc.c]
514 check that stdio file descriptors are actually closed before clobbering
515 them in sanitise_stdfd(). problems occurred when a lower numbered fd was
516 closed, but higher ones weren't. spotted by, and patch tested by
517 Frédéric Olivié
Damien Miller7655f5c2006-01-06 14:48:18 +1100518
Damien Millerb7977702006-01-03 18:47:31 +110051920060103
Damien Millera9694372006-01-04 07:27:50 +1100520 - (djm) [channels.c] clean up harmless merge error, from reyk@
521
52220060103
Damien Millerb7977702006-01-03 18:47:31 +1100523 - (djm) OpenBSD CVS Sync
524 - jmc@cvs.openbsd.org 2006/01/02 17:09:49
525 [ssh_config.5 sshd_config.5]
526 some corrections from michael knudsen;
527
Damien Miller90cd1c52006-01-02 20:23:18 +110052820060102
529 - (djm) [README.tun] Add README.tun, missed during sync of tun(4) support
Damien Miller48c94ab2006-01-02 23:38:00 +1100530 - (djm) OpenBSD CVS Sync
531 - jmc@cvs.openbsd.org 2005/12/31 10:46:17
532 [ssh.1]
533 merge the "LOGIN SESSION AND REMOTE EXECUTION" and "SERVER
534 AUTHENTICATION" sections into "AUTHENTICATION";
535 some rewording done to make the text read better, plus some
536 improvements from djm;
537 ok djm
Damien Miller14af93e2006-01-02 23:38:21 +1100538 - jmc@cvs.openbsd.org 2005/12/31 13:44:04
539 [ssh.1]
540 clean up ENVIRONMENT a little;
Damien Miller1164c292006-01-02 23:38:37 +1100541 - jmc@cvs.openbsd.org 2005/12/31 13:45:19
542 [ssh.1]
543 .Nm does not require an argument;
Damien Miller3beb8522006-01-02 23:40:10 +1100544 - stevesk@cvs.openbsd.org 2006/01/01 08:59:27
545 [includes.h misc.c]
546 move <net/if.h>; ok djm@
Damien Millera210d522006-01-02 23:40:30 +1100547 - stevesk@cvs.openbsd.org 2006/01/01 10:08:48
548 [misc.c]
549 no trailing "\n" for debug()
Damien Miller54446182006-01-02 23:40:50 +1100550 - djm@cvs.openbsd.org 2006/01/02 01:20:31
551 [sftp-client.c sftp-common.h sftp-server.c]
552 use a common max. packet length, no binary change
Damien Millera1d9a182006-01-02 23:41:21 +1100553 - reyk@cvs.openbsd.org 2006/01/02 07:53:44
554 [misc.c]
555 clarify tun(4) opening - set the mode and bring the interface up. also
556 (re)sets the tun(4) layer 2 LINK0 flag for existing tunnel interfaces.
557 suggested and ok by djm@
Damien Millera07a5912006-01-02 23:41:37 +1100558 - jmc@cvs.openbsd.org 2006/01/02 12:31:06
559 [ssh.1]
560 start to cut some duplicate info from FILES;
561 help/ok djm
Damien Miller90cd1c52006-01-02 20:23:18 +1100562
Damien Miller2dcddbf2006-01-01 19:47:05 +110056320060101
564 - (djm) [Makefile.in configure.ac includes.h misc.c]
565 [openbsd-compat/port-tun.c openbsd-compat/port-tun.h] Add support
566 for tunnel forwarding for FreeBSD and NetBSD. NetBSD's support is
567 limited to IPv4 tunnels only, and most versions don't support the
568 tap(4) device at all.
Damien Millerbd4e4102006-01-01 21:03:30 +1100569 - (djm) [configure.ac] Fix linux/if_tun.h test
Damien Miller5df52e82006-01-01 21:15:50 +1100570 - (djm) [openbsd-compat/port-tun.c] Linux needs linux/if.h too
Damien Miller2dcddbf2006-01-01 19:47:05 +1100571
Tim Rice8db70e22005-12-28 14:28:08 -080057220051229
Damien Miller5eb137c2005-12-31 16:19:53 +1100573 - (djm) OpenBSD CVS Sync
574 - stevesk@cvs.openbsd.org 2005/12/28 22:46:06
575 [canohost.c channels.c clientloop.c]
576 use 'break-in' for consistency; ok deraadt@ ok and input jmc@
Damien Miller077b2382005-12-31 16:22:32 +1100577 - reyk@cvs.openbsd.org 2005/12/30 15:56:37
578 [channels.c channels.h clientloop.c]
579 add channel output filter interface.
580 ok djm@, suggested by markus@
Damien Miller134eb812005-12-31 16:22:55 +1100581 - jmc@cvs.openbsd.org 2005/12/30 16:59:00
582 [sftp.1]
583 do not suggest that interactive authentication will work
584 with the -b flag;
585 based on a diff from john l. scarfone;
586 ok djm
Damien Miller88b25522005-12-31 16:23:15 +1100587 - stevesk@cvs.openbsd.org 2005/12/31 01:38:45
588 [ssh.1]
589 document -MM; ok djm@
Damien Miller598bbc22005-12-31 16:33:36 +1100590 - (djm) [openbsd-compat/port-tun.c openbsd-compat/port-tun.h configure.ac]
591 [serverloop.c ssh.c openbsd-compat/Makefile.in]
592 [openbsd-compat/openbsd-compat.h] Implement tun(4) forwarding
593 compatability support for Linux, diff from reyk@
Damien Miller89e03ba2005-12-31 16:42:03 +1100594 - (djm) [configure.ac] Disable Linux tun(4) compat code if linux/tun.h does
595 not exist
Damien Millerc4bcc912005-12-31 17:05:58 +1100596 - (djm) [configure.ac] oops, make that linux/if_tun.h
Damien Miller5eb137c2005-12-31 16:19:53 +1100597
59820051229
Tim Rice8db70e22005-12-28 14:28:08 -0800599 - (tim) [buildpkg.sh.in] grep for $SSHDUID instead of $SSHDGID on /etc/passwd
600
Damien Millerc93a8132005-12-24 14:52:13 +110060120051224
602 - (djm) OpenBSD CVS Sync
603 - jmc@cvs.openbsd.org 2005/12/20 21:59:43
604 [ssh.1]
605 merge the sections on protocols 1 and 2 into one section on
606 authentication;
607 feedback djm dtucker
608 ok deraadt markus dtucker
Damien Miller52d20612005-12-24 14:52:36 +1100609 - jmc@cvs.openbsd.org 2005/12/20 22:02:50
610 [ssh.1]
611 .Ss -> .Sh: subsections have not made this page more readable
Damien Millere9b333a2005-12-24 14:53:04 +1100612 - jmc@cvs.openbsd.org 2005/12/20 22:09:41
613 [ssh.1]
614 move info on ssh return values and config files up into the main
615 description;
Damien Miller329cb012005-12-24 14:53:23 +1100616 - jmc@cvs.openbsd.org 2005/12/21 11:48:16
617 [ssh.1]
618 -L and -R descriptions are now above, not below, ~C description;
Damien Miller9a765b22005-12-24 14:53:44 +1100619 - jmc@cvs.openbsd.org 2005/12/21 11:57:25
620 [ssh.1]
621 options now described `above', rather than `later';
Damien Miller1530f242005-12-24 14:54:03 +1100622 - jmc@cvs.openbsd.org 2005/12/21 12:53:31
623 [ssh.1]
624 -Y does X11 forwarding too;
625 ok markus
Damien Millerd7f308f2005-12-24 14:55:16 +1100626 - stevesk@cvs.openbsd.org 2005/12/21 22:44:26
627 [sshd.8]
628 clarify precedence of -p, Port, ListenAddress; ok and help jmc@
Damien Millere8cd7412005-12-24 14:55:47 +1100629 - jmc@cvs.openbsd.org 2005/12/22 10:31:40
630 [ssh_config.5]
631 put the description of "UsePrivilegedPort" in the correct place;
Damien Millercf1e3422005-12-24 14:56:04 +1100632 - jmc@cvs.openbsd.org 2005/12/22 11:23:42
633 [ssh.1]
634 expand the description of -w somewhat;
635 help/ok reyk
Damien Miller2142ba02005-12-24 14:56:29 +1100636 - jmc@cvs.openbsd.org 2005/12/23 14:55:53
637 [ssh.1]
638 - sync the description of -e w/ synopsis
639 - simplify the description of -I
640 - note that -I is only available if support compiled in, and that it
641 isn't by default
642 feedback/ok djm@
Damien Miller35978212005-12-24 14:56:47 +1100643 - jmc@cvs.openbsd.org 2005/12/23 23:46:23
644 [ssh.1]
645 less mark up for -c;
Damien Miller7bff1a92005-12-24 14:59:12 +1100646 - djm@cvs.openbsd.org 2005/12/24 02:27:41
647 [session.c sshd.c]
648 eliminate some code duplicated in privsep and non-privsep paths, and
649 explicitly clear SIGALRM handler; "groovy" deraadt@
Damien Millerc93a8132005-12-24 14:52:13 +1100650
Darren Tucker0d0e8f02005-12-20 16:08:42 +110065120051220
652 - (dtucker) OpenBSD CVS Sync
653 - reyk@cvs.openbsd.org 2005/12/13 15:03:02
654 [serverloop.c]
655 if forced_tun_device is not set, it is -1 and not SSH_TUNID_ANY
Darren Tuckerd3877b92005-12-20 16:09:36 +1100656 - jmc@cvs.openbsd.org 2005/12/16 18:07:08
657 [ssh.1]
658 move the option descriptions up the page: start of a restructure;
659 ok markus deraadt
Darren Tuckerb18c8672005-12-20 16:10:09 +1100660 - jmc@cvs.openbsd.org 2005/12/16 18:08:53
661 [ssh.1]
662 simplify a sentence;
Darren Tucker56529242005-12-20 16:12:24 +1100663 - jmc@cvs.openbsd.org 2005/12/16 18:12:22
664 [ssh.1]
665 make the description of -c a little nicer;
Darren Tucker5434cfe2005-12-20 16:11:35 +1100666 - jmc@cvs.openbsd.org 2005/12/16 18:14:40
667 [ssh.1]
668 signpost the protocol sections;
Darren Tucker63551872005-12-20 16:14:15 +1100669 - stevesk@cvs.openbsd.org 2005/12/17 21:13:05
670 [ssh_config.5 session.c]
671 spelling: fowarding, fowarded
Darren Tucker7eba8202005-12-20 16:15:14 +1100672 - stevesk@cvs.openbsd.org 2005/12/17 21:36:42
673 [ssh_config.5]
674 spelling: intented -> intended
Darren Tuckere9a9b712005-12-20 16:15:51 +1100675 - dtucker@cvs.openbsd.org 2005/12/20 04:41:07
676 [ssh.c]
677 exit(255) on error to match description in ssh(1); bz #1137; ok deraadt@
Darren Tucker0d0e8f02005-12-20 16:08:42 +1100678
Darren Tucker129d0bb2005-12-19 17:40:40 +110067920051219
680 - (dtucker) [cipher-aes.c cipher-ctr.c cipher.c configure.ac
681 openbsd-compat/openssl-compat.h] Check for and work around broken AES
682 ciphers >128bit on (some) Solaris 10 systems. ok djm@
683
Darren Tucker98cfc4c2005-12-17 22:04:08 +110068420051217
685 - (dtucker) [defines.h] HP-UX system headers define "YES" and "NO" which
686 scp.c also uses, so undef them here.
Darren Tuckerd40c66c2005-12-17 22:32:03 +1100687 - (dtucker) [configure.ac openbsd-compat/bsd-snprintf.c] Bug #1133: Our
688 snprintf replacement can have a conflicting declaration in HP-UX's system
689 headers (const vs. no const) so we now check for and work around it. Patch
690 from the dynamic duo of David Leonard and Ted Percival.
Darren Tucker98cfc4c2005-12-17 22:04:08 +1100691
Darren Tucker31543582005-12-14 15:39:20 +110069220051214
693 - (dtucker) OpenBSD CVS Sync (regress/)
694 - dtucker@cvs.openbsd.org 2005/12/30 04:36:39
695 [regress/scp-ssh-wrapper.sh]
696 Fix assumption about how many args scp will pass; ok djm@
697
Damien Millerc94ebbc2005-12-13 19:25:21 +110069820051213
699 - (djm) OpenBSD CVS Sync
700 - jmc@cvs.openbsd.org 2005/11/30 11:18:27
701 [ssh.1]
702 timezone -> time zone
Damien Miller6dbdb6a2005-12-13 19:25:43 +1100703 - jmc@cvs.openbsd.org 2005/11/30 11:45:20
704 [ssh.1]
705 avoid ambiguities in describing TZ;
706 ok djm@
Damien Millerd27b9472005-12-13 19:29:02 +1100707 - reyk@cvs.openbsd.org 2005/12/06 22:38:28
708 [auth-options.c auth-options.h channels.c channels.h clientloop.c]
709 [misc.c misc.h readconf.c readconf.h scp.c servconf.c servconf.h]
710 [serverloop.c sftp.c ssh.1 ssh.c ssh_config ssh_config.5 sshconnect.c]
711 [sshconnect.h sshd.8 sshd_config sshd_config.5]
712 Add support for tun(4) forwarding over OpenSSH, based on an idea and
713 initial channel code bits by markus@. This is a simple and easy way to
714 use OpenSSH for ad hoc virtual private network connections, e.g.
715 administrative tunnels or secure wireless access. It's based on a new
716 ssh channel and works similar to the existing TCP forwarding support,
717 except that it depends on the tun(4) network interface on both ends of
718 the connection for layer 2 or layer 3 tunneling. This diff also adds
719 support for LocalCommand in the ssh(1) client.
Damien Millerd27b9472005-12-13 19:29:02 +1100720 ok djm@, markus@, jmc@ (manpages), tested and discussed with others
Damien Milleraeb31d62005-12-13 19:29:36 +1100721 - djm@cvs.openbsd.org 2005/12/07 03:52:22
722 [clientloop.c]
723 reyk forgot to compile with -Werror (missing header)
Damien Millerf0c8c152005-12-13 19:29:58 +1100724 - jmc@cvs.openbsd.org 2005/12/07 10:52:13
725 [ssh.1]
726 - avoid line split in SYNOPSIS
727 - add args to -w
728 - kill trailing whitespace
Damien Miller4b2319f2005-12-13 19:30:27 +1100729 - jmc@cvs.openbsd.org 2005/12/08 14:59:44
730 [ssh.1 ssh_config.5]
731 make `!command' a little clearer;
732 ok reyk
Damien Miller957d4e42005-12-13 19:30:45 +1100733 - jmc@cvs.openbsd.org 2005/12/08 15:06:29
734 [ssh_config.5]
735 keep options in order;
Damien Miller7b58e802005-12-13 19:33:19 +1100736 - reyk@cvs.openbsd.org 2005/12/08 18:34:11
737 [auth-options.c includes.h misc.c misc.h readconf.c servconf.c]
738 [serverloop.c ssh.c ssh_config.5 sshd_config.5 configure.ac]
739 two changes to the new ssh tunnel support. this breaks compatibility
740 with the initial commit but is required for a portable approach.
741 - make the tunnel id u_int and platform friendly, use predefined types.
742 - support configuration of layer 2 (ethernet) or layer 3
743 (point-to-point, default) modes. configuration is done using the
744 Tunnel (yes|point-to-point|ethernet|no) option is ssh_config(5) and
745 restricted by the PermitTunnel (yes|point-to-point|ethernet|no) option
746 in sshd_config(5).
747 ok djm@, man page bits by jmc@
Damien Miller7746c392005-12-13 19:33:37 +1100748 - jmc@cvs.openbsd.org 2005/12/08 21:37:50
749 [ssh_config.5]
750 new sentence, new line;
Damien Millerd47c62a2005-12-13 19:33:57 +1100751 - markus@cvs.openbsd.org 2005/12/12 13:46:18
752 [channels.c channels.h session.c]
753 make sure protocol messages for internal channels are ignored.
754 allow adjust messages for non-open channels; with and ok djm@
Damien Miller62a31c92005-12-13 20:44:13 +1100755 - (djm) [misc.c] Disable tunnel code for non-OpenBSD (for now), enable
756 again by providing a sys_tun_open() function for your platform and
757 setting the CUSTOM_SYS_TUN_OPEN define. More work is required to match
758 OpenBSD's tunnel protocol, which prepends the address family to the
759 packet
Damien Millerc94ebbc2005-12-13 19:25:21 +1100760
Damien Miller7677be52005-12-01 12:51:59 +110076120051201
762 - (djm) [envpass.sh] Remove regress script that was accidentally committed
763 in top level directory and not noticed for over a year :)
764
Tim Rice660c3402005-11-28 17:45:32 -080076520051129
766 - (tim) [ssh-keygen.c] Move DSA length test after setting default when
767 bits == 0.
Darren Tucker3af2ac52005-11-29 13:10:24 +1100768 - (dtucker) OpenBSD CVS Sync
769 - dtucker@cvs.openbsd.org 2005/11/29 02:04:55
770 [ssh-keygen.c]
771 Populate default key sizes before checking them; from & ok tim@
Tim Rice46259d82005-11-28 18:40:34 -0800772 - (tim) [configure.ac sshd.8] Enable locked account check (a "*LK*" string)
773 for UnixWare.
Tim Rice660c3402005-11-28 17:45:32 -0800774
Darren Tuckerb1a87772005-11-28 16:41:03 +110077520051128
776 - (dtucker) [regress/yes-head.sh] Work around breakage caused by some
777 versions of GNU head. Based on patch from zappaman at buraphalinux.org
Darren Tuckerac0c8a52005-11-28 22:28:59 +1100778 - (dtucker) [includes.h] Bug #1122: __USE_GNU is a glibc internal macro, use
779 _GNU_SOURCE instead. Patch from t8m at centrum.cz.
Darren Tucker9f647332005-11-28 16:41:46 +1100780 - (dtucker) OpenBSD CVS Sync
781 - dtucker@cvs.openbsd.org 2005/11/28 05:16:53
782 [ssh-keygen.1 ssh-keygen.c]
783 Enforce DSA key length of exactly 1024 bits to comply with FIPS-186-2,
784 increase minumum RSA key size to 768 bits and update man page to reflect
785 these. Patch originally bz#1119 (senthilkumar_sen at hotpop.com),
786 ok djm@, grudging ok deraadt@.
Darren Tucker3a4634f2005-11-28 17:05:40 +1100787 - dtucker@cvs.openbsd.org 2005/11/28 06:02:56
788 [ssh-agent.1]
789 Update agent socket path templates to reflect reality, correct xref for
790 time formats. bz#1121, patch from openssh at roumenpetrov.info, ok djm@
Darren Tuckerb1a87772005-11-28 16:41:03 +1100791
Darren Tucker91d25a02005-11-26 22:24:09 +110079220051126
793 - (dtucker) [configure.ac] Bug #1126: AIX 5.2 and 5.3 (and presumably newer,
794 when they're available) need the real UID set otherwise pam_chauthtok will
795 set ADMCHG after changing the password, forcing the user to change it
796 again immediately.
797
Darren Tucker58e298d2005-11-25 13:14:58 +110079820051125
799 - (dtucker) [configure.ac] Apply tim's fix for older systems where the
800 resolver state in resolv.h is "state" not "__res_state". With slight
801 modification by me to also work on old AIXes. ok djm@
Darren Tuckere0be3042005-11-25 14:44:55 +1100802 - (dtucker) [progressmeter.c scp.c sftp-server.c] Use correct casts for
803 snprintf formats, fixes warnings on some 64 bit platforms. Patch from
804 shaw at vranix.com, ok djm@
Darren Tucker58e298d2005-11-25 13:14:58 +1100805
80620051124
Damien Miller57f39152005-11-24 19:58:19 +1100807 - (djm) [configure.ac openbsd-compat/Makefile.in openbsd-compat/bsd-asprintf.c
808 openbsd-compat/bsd-snprintf.c openbsd-compat/openbsd-compat.h] Add an
809 asprintf() implementation, after syncing our {v,}snprintf() implementation
810 with some extra fixes from Samba's version. With help and debugging from
811 dtucker and tim; ok dtucker@
Darren Tucker79d09fa2005-11-24 22:34:54 +1100812 - (dtucker) [configure.ac] Fix typos in comments and AC_SEARCH_LIB argument
813 order in Reliant Unix block. Patch from johane at lysator.liu.se.
Darren Tuckerfaec5ca2005-11-24 23:18:54 +1100814 - (dtucker) [regress/test-exec.sh] Use 1024 bit keys since we generate so
815 many and use them only once. Speeds up testing on older/slower hardware.
Damien Miller57f39152005-11-24 19:58:19 +1100816
81720051122
Darren Tuckerb736d8d2005-11-22 19:37:08 +1100818 - (dtucker) OpenBSD CVS Sync
819 - deraadt@cvs.openbsd.org 2005/11/12 18:37:59
820 [ssh-add.c]
821 space
Darren Tucker33f86bc2005-11-22 19:38:06 +1100822 - deraadt@cvs.openbsd.org 2005/11/12 18:38:15
823 [scp.c]
824 avoid close(-1), as in rcp; ok cloder
Darren Tuckere8400da2005-11-22 19:41:33 +1100825 - millert@cvs.openbsd.org 2005/11/15 11:59:54
826 [includes.h]
827 Include sys/queue.h explicitly instead of assuming some other header
828 will pull it in. At the moment it gets pulled in by sys/select.h
829 (which ssh has no business including) via event.h. OK markus@
830 (ID sync only in -portable)
Darren Tuckerf4732f62005-11-22 19:42:42 +1100831 - dtucker@cvs.openbsd.org 2005/11/21 09:42:10
832 [auth-krb5.c]
833 Perform Kerberos calls even for invalid users to prevent leaking
834 information about account validity. bz #975, patch originally from
835 Senthil Kumar, sanity checked by Simon Wilkinson, tested by djm@, biorn@,
836 ok markus@
Darren Tucker593bae72005-11-22 19:43:26 +1100837 - dtucker@cvs.openbsd.org 2005/11/22 03:36:03
838 [hostfile.c]
839 Correct format/arguments to debug call; spotted by shaw at vranix.com
840 ok djm@
Darren Tuckerefc17472005-11-22 19:55:13 +1100841 - (dtucker) [loginrec.c] Add casts to prevent compiler warnings, patch
842 from shaw at vranix.com.
Darren Tuckerb736d8d2005-11-22 19:37:08 +1100843
Darren Tucker41236362005-11-20 14:09:59 +110084420051120
845 - (dtucker) [openbsd-compat/openssl-compat.h] Add comment explaining what
846 is going on.
847
Darren Tucker16fd99c2005-11-12 14:06:29 +110084820051112
849 - (dtucker) [openbsd-compat/getrrsetbyname.c] Restore Portable-specific
850 ifdef lost during sync. Spotted by tim@.
Darren Tucker5a0bdf72005-11-12 14:28:05 +1100851 - (dtucker) [openbsd-compat/{realpath.c,stroll.c,rresvport.c}] $OpenBSD tag.
Darren Tucker3f9545e2005-11-12 15:20:52 +1100852 - (dtucker) [configure.ac] Use "$AWK" instead of "awk" in gcc version test.
Darren Tucker5bfe1682005-11-12 18:42:36 +1100853 - (dtucker) [configure.ac] Remove duplicate utimes() check. ok djm@
Darren Tuckercb6ecde2005-11-12 21:30:07 +1100854 - (dtucker) [regress/reconfigure.sh] Fix potential race in the reconfigure
855 test: if sshd takes too long to reconfigure the subsequent connection will
856 fail. Zap pidfile before HUPing sshd which will rewrite it when it's ready.
Darren Tucker16fd99c2005-11-12 14:06:29 +1100857
Darren Tuckerb8c89d12005-11-10 10:10:10 +110085820051110
Darren Tucker063ba742005-11-10 10:38:45 +1100859 - (dtucker) [openbsd-compat/setenv.c] Merge changes for __findenv from
Darren Tuckerb8c89d12005-11-10 10:10:10 +1100860 OpenBSD getenv.c revs 1.4 - 1.8 (ANSIfication of arguments, removal of
861 "register").
Darren Tucker063ba742005-11-10 10:38:45 +1100862 - (dtucker) [openbsd-compat/setenv.c] Make __findenv static, remove
Darren Tucker32b53102005-11-10 10:13:06 +1100863 unnecessary prototype.
Darren Tucker063ba742005-11-10 10:38:45 +1100864 - (dtucker) [openbsd-compat/setenv.c] Sync changes from OpenBSD setenv.c
865 revs 1.7 - 1.9.
Darren Tucker618db972005-11-10 14:43:11 +1100866 - (dtucker) [auth-krb5.c] Fix -Wsign-compare warning in non-Heimdal path.
867 Patch from djm@.
Darren Tuckerb0288092005-11-10 14:46:48 +1100868 - (dtucker) [configure.ac] Disable pointer-sign warnings on gcc 4.0+
869 since they're not useful right now. Patch from djm@.
Darren Tuckere5a2b522005-11-10 15:56:44 +1100870 - (dtucker) [openbsd-compat/getgrouplist.c] Sync OpenBSD revs 1.10 - 1.2 (ANSI
871 prototypes, removal of "register").
Darren Tucker80c0d7e2005-11-10 16:05:37 +1100872 - (dtucker) [openbsd-compat/strlcat.c] Sync OpenBSD revs 1.11 - 1.12 (removal
873 of "register").
Darren Tucker7f24a0e2005-11-10 16:18:56 +1100874 - (dtucker) [openbsd-compat/{LOTS}] Move the "OPENBSD ORIGINAL" markers to
875 after the copyright notices. Having them at the top next to the CVSIDs
876 guarantees a conflict for each and every sync.
Darren Tucker52245662005-11-10 16:26:17 +1100877 - (dtucker) [openbsd-compat/strlcpy.c] Update from OpenBSD 1.8 -> 1.10.
Darren Tucker925d1de2005-11-10 16:31:55 +1100878 - (dtucker) [openbsd-compat/sigact.h] Add "OPENBSD ORIGINAL" marker.
Darren Tucker09471d82005-11-10 16:38:54 +1100879 - (dtucker) [openbsd-compat/strmode.c] Update from OpenBSD 1.5 -> 1.7.
880 Removal of rcsid, "whiteout" inode type.
Darren Tuckerad1dada2005-11-10 16:42:51 +1100881 - (dtucker) [openbsd-compat/basename.c] Update from OpenBSD 1.11 -> 1.14.
882 Removal of rcsid, will no longer strlcpy parts of the string.
Darren Tuckerf976e6f2005-11-10 16:46:26 +1100883 - (dtucker) [openbsd-compat/strtoll.c] Update from OpenBSD 1.4 -> 1.5.
Darren Tuckerf5ebfe92005-11-10 16:48:10 +1100884 - (dtucker) [openbsd-compat/strtoul.c] Update from OpenBSD 1.5 -> 1.7.
Darren Tuckerdbb631c2005-11-10 16:56:28 +1100885 - (dtucker) [openbsd-compat/readpassphrase.c] Update from OpenBSD 1.16 -> 1.18.
Darren Tuckerd76b4c72005-11-10 16:58:47 +1100886 - (dtucker) [openbsd-compat/readpassphrase.h] Update from OpenBSD 1.3 -> 1.5.
Darren Tucker6524d4f2005-11-10 17:02:21 +1100887 - (dtucker) [openbsd-compat/glob.c] Update from OpenBSD 1.22 -> 1.25.
Darren Tucker50a221b2005-11-10 17:03:22 +1100888 - (dtucker) [openbsd-compat/glob.h] Update from OpenBSD 1.8 -> 1.9.
Darren Tucker31ba53e2005-11-10 17:11:29 +1100889 - (dtucker) [openbsd-compat/getcwd.c] Update from OpenBSD 1.9 -> 1.14.
Darren Tucker0a149d12005-11-10 17:15:06 +1100890 - (dtucker) [openbsd-compat/getcwd.c] Replace lstat with fstat to match up
891 with OpenBSD code since we don't support platforms without fstat any more.
Darren Tuckerc7e05d62005-11-10 17:21:21 +1100892 - (dtucker) [openbsd-compat/inet_aton.c] Update from OpenBSD 1.7 -> 1.9.
Darren Tucker28640392005-11-10 17:25:26 +1100893 - (dtucker) [openbsd-compat/inet_ntoa.c] Update from OpenBSD 1.4 -> 1.6.
894 - (dtucker) [openbsd-compat/inet_ntop.c] Update from OpenBSD 1.5 -> 1.7.
Darren Tuckerb10b4972005-11-10 17:27:25 +1100895 - (dtucker) [openbsd-compat/daemon.c] Update from OpenBSD 1.5 -> 1.6.
Darren Tucker4e8c2492005-11-10 17:28:35 +1100896 - (dtucker) [openbsd-compat/strsep.c] Update from OpenBSD 1.5 -> 1.6.
Darren Tucker8f0d8f82005-11-10 17:33:00 +1100897 - (dtucker) [openbsd-compat/daemon.c] Update from OpenBSD 1.10 -> 1.13.
Darren Tuckerffcd0ec2005-11-10 17:37:02 +1100898 - (dtucker) [openbsd-compat/mktemp.c] Update from OpenBSD 1.17 -> 1.19.
Darren Tucker91b34dc2005-11-10 17:42:40 +1100899 - (dtucker) [openbsd-compat/rresvport.c] Update from OpenBSD 1.6 -> 1.8.
Darren Tucker6f15c072005-11-10 17:52:08 +1100900 - (dtucker) [openbsd-compat/bindresvport.c] Add "OPENBSD ORIGINAL" marker.
Darren Tuckerfe80d7a2005-11-10 17:54:46 +1100901 - (dtucker) [openbsd-compat/bindresvport.c] Update from OpenBSD 1.16 -> 1.17.
Darren Tucker30d69742005-11-10 19:29:12 +1100902 - (dtucker) [openbsd-compat/sigact.c] Update from OpenBSD 1.3 -> 1.4.
903 Id and copyright sync only, there were no substantial changes we need.
Darren Tuckerce1cb1f2005-11-10 19:31:08 +1100904 - (dtucker) [openbsd-compat/bsd-closefrom.c openbsd-compat/base64.c]
Darren Tucker58120342005-11-10 19:31:37 +1100905 -Wsign-compare fixes from djm.
Darren Tucker9d30d132005-11-10 19:43:48 +1100906 - (dtucker) [openbsd-compat/sigact.h] Update from OpenBSD 1.2 -> 1.3.
907 Id and copyright sync only, there were no substantial changes we need.
Darren Tuckerf0324352005-11-10 21:30:36 +1100908 - (dtucker) [configure.ac] Try to get the gcc version number in a way that
909 doesn't change between versions, and use a safer default.
Darren Tuckerb8c89d12005-11-10 10:10:10 +1100910
Damien Miller3f54a9f2005-11-05 14:52:18 +110091120051105
912 - (djm) OpenBSD CVS Sync
913 - markus@cvs.openbsd.org 2005/10/07 11:13:57
914 [ssh-keygen.c]
915 change DSA default back to 1024, as it's defined for 1024 bits only
916 and this causes interop problems with other clients. moreover,
917 in order to improve the security of DSA you need to change more
918 components of DSA key generation (e.g. the internal SHA1 hash);
919 ok deraadt
Damien Miller39eda6e2005-11-05 14:52:50 +1100920 - djm@cvs.openbsd.org 2005/10/10 10:23:08
921 [channels.c channels.h clientloop.c serverloop.c session.c]
922 fix regression I introduced in 4.2: X11 forwardings initiated after
923 a session has exited (e.g. "(sleep 5; xterm) &") would not start.
924 bz #1086 reported by t8m AT centrum.cz; ok markus@ dtucker@
Damien Miller5e7fd072005-11-05 14:53:39 +1100925 - djm@cvs.openbsd.org 2005/10/11 23:37:37
926 [channels.c]
927 bz #1076 set SO_REUSEADDR on X11 forwarding listner sockets, preventing
928 bind() failure when a previous connection's listeners are in TIME_WAIT,
929 reported by plattner AT inf.ethz.ch; ok dtucker@
Damien Miller5434eb22005-11-05 15:03:24 +1100930 - stevesk@cvs.openbsd.org 2005/10/13 14:03:01
931 [auth2-gss.c gss-genr.c gss-serv.c]
932 remove unneeded #includes; ok markus@
Damien Miller9fac2632005-11-05 15:03:48 +1100933 - stevesk@cvs.openbsd.org 2005/10/13 14:20:37
934 [gss-serv.c]
935 spelling in comments
Damien Miller5f916c82005-11-05 15:05:28 +1100936 - stevesk@cvs.openbsd.org 2005/10/13 19:08:08
937 [gss-serv-krb5.c gss-serv.c]
938 unused declarations; ok deraadt@
939 (id sync only for gss-serv-krb5.c)
Damien Miller20afc242005-11-05 15:06:38 +1100940 - stevesk@cvs.openbsd.org 2005/10/13 19:13:41
941 [dns.c]
942 unneeded #include, unused declaration, little knf; ok deraadt@
Damien Miller6fd6def2005-11-05 15:07:05 +1100943 - stevesk@cvs.openbsd.org 2005/10/13 22:24:31
944 [auth2-gss.c gss-genr.c gss-serv.c monitor.c]
945 KNF; ok djm@
Damien Miller15d72a02005-11-05 15:07:33 +1100946 - stevesk@cvs.openbsd.org 2005/10/14 02:17:59
947 [ssh-keygen.c ssh.c sshconnect2.c]
948 no trailing "\n" for log functions; ok djm@
Damien Miller0a0176e2005-11-05 15:07:59 +1100949 - stevesk@cvs.openbsd.org 2005/10/14 02:29:37
950 [channels.c clientloop.c]
951 free()->xfree(); ok djm@
Damien Millerc1af1d52005-11-05 15:08:57 +1100952 - stevesk@cvs.openbsd.org 2005/10/15 15:28:12
953 [sshconnect.c]
954 make external definition static; ok deraadt@
Damien Miller7e8795d2005-11-05 15:10:42 +1100955 - stevesk@cvs.openbsd.org 2005/10/17 13:45:05
956 [dns.c]
957 fix memory leaks from 2 sources:
958 1) key_fingerprint_raw()
959 2) malloc in dns_read_rdata()
960 ok jakob@
961 - stevesk@cvs.openbsd.org 2005/10/17 14:01:28
962 [dns.c]
963 remove #ifdef LWRES; ok jakob@
Damien Miller319550a2005-11-05 15:11:15 +1100964 - stevesk@cvs.openbsd.org 2005/10/17 14:13:35
965 [dns.c dns.h]
966 more cleanups; ok jakob@
Damien Millerb3bfbb72005-11-05 15:11:48 +1100967 - djm@cvs.openbsd.org 2005/10/30 01:23:19
968 [ssh_config.5]
969 mention control socket fallback behaviour, reported by
970 tryponraj AT gmail.com
Damien Miller4bbacb72005-11-05 15:12:28 +1100971 - djm@cvs.openbsd.org 2005/10/30 04:01:03
972 [ssh-keyscan.c]
973 make ssh-keygen discard junk from server before SSH- ident, spotted by
974 dave AT cirt.net; ok dtucker@
Damien Milleraa3bb102005-11-05 15:12:59 +1100975 - djm@cvs.openbsd.org 2005/10/30 04:03:24
976 [ssh.c]
977 fix misleading debug message; ok dtucker@
Damien Miller4d3fd542005-11-05 15:13:24 +1100978 - dtucker@cvs.openbsd.org 2005/10/30 08:29:29
979 [canohost.c sshd.c]
980 Check for connections with IP options earlier and drop silently. ok djm@
Damien Miller713de762005-11-05 15:13:49 +1100981 - jmc@cvs.openbsd.org 2005/10/30 08:43:47
982 [ssh_config.5]
983 remove trailing whitespace;
Damien Miller788f2122005-11-05 15:14:59 +1100984 - djm@cvs.openbsd.org 2005/10/30 08:52:18
985 [clientloop.c packet.c serverloop.c session.c ssh-agent.c ssh-keygen.c]
986 [ssh.c sshconnect.c sshconnect1.c sshd.c]
987 no need to escape single quotes in comments, no binary change
Damien Miller653b93b2005-11-05 15:15:23 +1100988 - dtucker@cvs.openbsd.org 2005/10/31 06:15:04
989 [sftp.c]
990 Fix sorting with "ls -1" command. From Robert Tsai, "looks right" deraadt@
Damien Millerf14be5c2005-11-05 15:15:49 +1100991 - djm@cvs.openbsd.org 2005/10/31 11:12:49
992 [ssh-keygen.1 ssh-keygen.c]
993 generate a protocol 2 RSA key by default
Damien Millerc7e2d3f2005-11-05 15:16:12 +1100994 - djm@cvs.openbsd.org 2005/10/31 11:48:29
995 [serverloop.c]
996 make sure we clean up wtmp, etc. file when we receive a SIGTERM,
997 SIGINT or SIGQUIT when running without privilege separation (the
998 normal privsep case is already OK). Patch mainly by dtucker@ and
999 senthilkumar_sen AT hotpop.com; ok dtucker@
Damien Miller83d0d392005-11-05 15:16:27 +11001000 - jmc@cvs.openbsd.org 2005/10/31 19:55:25
1001 [ssh-keygen.1]
1002 grammar;
Damien Miller24ecf612005-11-05 15:16:52 +11001003 - dtucker@cvs.openbsd.org 2005/11/03 13:38:29
1004 [canohost.c]
1005 Cache reverse lookups with and without DNS separately; ok markus@
Damien Miller19bb3a52005-11-05 15:19:35 +11001006 - djm@cvs.openbsd.org 2005/11/04 05:15:59
1007 [kex.c kex.h kexdh.c kexdhc.c kexdhs.c kexgex.c kexgexc.c kexgexs.c]
1008 remove hardcoded hash lengths in key exchange code, allowing
1009 implementation of KEX methods with different hashes (e.g. SHA-256);
1010 ok markus@ dtucker@ stevesk@
Damien Miller5fd8b022005-11-05 16:04:36 +11001011 - djm@cvs.openbsd.org 2005/11/05 05:01:15
1012 [bufaux.c]
1013 Fix leaks in error paths, bz #1109 and #1110 reported by kremenek AT
1014 cs.stanford.edu; ok dtucker@
Darren Tucker3a38c5a2005-11-05 16:28:35 +11001015 - (dtucker) [README.platform] Add PAM section.
Damien Miller9b59ada2005-11-05 16:56:52 +11001016 - (djm) [openbsd-compat/getrrsetbyname.c] Sync to latest OpenBSD version,
1017 resolving memory leak bz#1111 reported by kremenek AT cs.stanford.edu;
1018 ok dtucker@
Damien Miller3f54a9f2005-11-05 14:52:18 +11001019
Darren Tuckerd32e2932005-11-02 09:07:31 +1100102020051102
1021 - (dtucker) [openbsd-compat/bsd-misc.c] Bug #1108: fix broken strdup().
1022 Reported by olavi at ipunplugged.com and antoine.brodin at laposte.net
1023 via FreeBSD.
1024
Damien Miller88edf622005-10-30 11:55:45 +1100102520051030
1026 - (djm) [contrib/suse/openssh.spec contrib/suse/rc.
1027 sshd contrib/suse/sysconfig.ssh] Bug #1106: Updated SuSE spec and init
1028 files from imorgan AT nas.nasa.gov
Darren Tucker42308a42005-10-30 15:31:55 +11001029 - (dtucker) [session.c] Bug #1045do not check /etc/nologin when PAM is
1030 enabled, instead allow PAM to handle it. Note that on platforms using PAM,
1031 the pam_nologin module should be added to sshd's session stack in order to
1032 maintain exising behaviour. Based on patch and discussion from t8m at
1033 centrum.cz, ok djm@
Damien Miller88edf622005-10-30 11:55:45 +11001034
Darren Tucker537f1ed2005-10-25 18:38:33 +1000103520051025
1036 - (dtucker) [configure.ac] Relocate LLONG_MAX calculation to after the
1037 sizeof(long long) checks, to make fixing bug #1104 easier (no changes
1038 yet).
Darren Tuckere7374552005-10-25 18:52:31 +10001039 - (dtucker) [configure.ac] Bug #1104: Tru64's printf family doesn't
1040 understand "%lld", even though the compiler has "long long", so handle
1041 it as a special case. Patch tested by mcaskill.scott at epa.gov.
Darren Tuckera841dce2005-10-25 18:55:00 +10001042 - (dtucker) [contrib/cygwin/ssh-user-config] Remove duplicate yes/no
1043 prompt. Patch from vinschen at redhat.com.
Darren Tucker537f1ed2005-10-25 18:38:33 +10001044
Darren Tucker314d89e2005-10-17 23:29:23 +1000104520051017
1046 - (dtucker) [configure.ac] Bug #1097: Fix configure for cross-compiling.
1047 /etc/default/login report and testing from aabaker at iee.org, corrections
1048 from tim@.
1049
Darren Tucker9ac1a652005-10-09 11:40:03 +1000105020051009
1051 - (dtucker) [configure.ac defines.h openbsd-compat/vis.{c,h}] Sync current
1052 versions from OpenBSD. ok djm@
1053
Darren Tucker1e6616b2005-10-08 12:07:01 +1000105420051008
1055 - (dtucker) [configure.ac] Bug #1098: define $MAIL for HP-UX; report from
1056 brian.smith at agilent com.
Damien Millere04ec6f2005-10-08 16:21:19 +10001057 - (djm) [configure.ac] missing 'test' call for -with-Werror test
Darren Tucker1e6616b2005-10-08 12:07:01 +10001058
Darren Tuckerb18f1512005-10-05 23:02:16 +1000105920051005
1060 - (dtucker) [configure.ac sshd.8] Enable locked account check (a prepended
1061 "*LOCKED*" string) for FreeBSD. Patch jeremie at le-hen.org and
1062 senthilkumar_sen at hotpop.com.
1063
Darren Tuckerd3d0fa12005-10-03 18:03:05 +1000106420051003
1065 - (dtucker) OpenBSD CVS Sync
1066 - markus@cvs.openbsd.org 2005/09/07 08:53:53
1067 [channels.c]
1068 enforce chanid != NULL; ok djm
Darren Tuckerd89dbf22005-10-03 18:05:26 +10001069 - markus@cvs.openbsd.org 2005/09/09 19:18:05
1070 [clientloop.c]
1071 typo; from mark at mcs.vuw.ac.nz, bug #1082
Darren Tuckerce321d82005-10-03 18:11:24 +10001072 - djm@cvs.openbsd.org 2005/09/13 23:40:07
1073 [sshd.c ssh.c misc.h sftp.c ssh-keygen.c ssh-keysign.c sftp-server.c
1074 scp.c misc.c ssh-keyscan.c ssh-add.c ssh-agent.c]
1075 ensure that stdio fds are attached; ok deraadt@
Darren Tuckerc8d64212005-10-03 18:13:42 +10001076 - djm@cvs.openbsd.org 2005/09/19 11:37:34
1077 [ssh_config.5 ssh.1]
1078 mention ability to specify bind_address for DynamicForward and -D options;
1079 bz#1077 spotted by Haruyama Seigo
Darren Tuckera2cdbda2005-10-03 18:16:02 +10001080 - djm@cvs.openbsd.org 2005/09/19 11:47:09
1081 [sshd.c]
1082 stop connection abort on rekey with delayed compression enabled when
1083 post-auth privsep is disabled (e.g. when root is logged in); ok dtucker@
Darren Tucker8813bbb2005-10-03 18:17:02 +10001084 - djm@cvs.openbsd.org 2005/09/19 11:48:10
1085 [gss-serv.c]
1086 typo
Darren Tucker05d4dfe2005-10-03 18:17:38 +10001087 - jmc@cvs.openbsd.org 2005/09/19 15:38:27
1088 [ssh.1]
1089 some more .Bk/.Ek to avoid ugly line split;
Darren Tucker895d6982005-10-03 18:18:05 +10001090 - jmc@cvs.openbsd.org 2005/09/19 15:42:44
1091 [ssh.c]
1092 update -D usage here too;
Darren Tucker1e4308e2005-10-03 18:18:40 +10001093 - djm@cvs.openbsd.org 2005/09/19 23:31:31
1094 [ssh.1]
1095 spelling nit from stevesk@
Darren Tuckere2dd2d52005-10-03 18:19:06 +10001096 - djm@cvs.openbsd.org 2005/09/21 23:36:54
1097 [sshd_config.5]
1098 aquire -> acquire, from stevesk@
Darren Tucker45b01422005-10-03 18:20:00 +10001099 - djm@cvs.openbsd.org 2005/09/21 23:37:11
1100 [sshd.c]
1101 change label at markus@'s request
Darren Tucker28e8e592005-10-03 18:20:28 +10001102 - jaredy@cvs.openbsd.org 2005/09/30 20:34:26
1103 [ssh-keyscan.1]
1104 deploy .An -nosplit; ok jmc
Darren Tuckerb0b12292005-10-03 18:23:44 +10001105 - dtucker@cvs.openbsd.org 2005/10/03 07:44:42
1106 [canohost.c]
1107 Relocate check_ip_options call to prevent logging of garbage for
1108 connections with IP options set. bz#1092 from David Leonard,
1109 "looks good" deraadt@
Darren Tucker1f85dc72005-10-03 20:14:18 +10001110 - (dtucker) [regress/README.regress] Bug #989: Document limitation that scp
1111 is required in the system path for the multiplex test to work.
Darren Tuckerd3d0fa12005-10-03 18:03:05 +10001112
Darren Tucker6e422112005-09-30 09:55:49 +1000111320050930
1114 - (dtucker) [openbsd-compat/openbsd-compat.h] Bug #1096: Add prototype
1115 for strtoll. Patch from o.flebbe at science-computing.de.
Darren Tuckerd4f04ae2005-09-30 10:23:21 +10001116 - (dtucker) [monitor.c] Bug #1087: Send loginmsg to preauth privsep
1117 child during PAM account check without clearing it. This restores the
1118 post-login warnings such as LDAP password expiry. Patch from Tomas Mraz
1119 with help from several others.
Darren Tucker6e422112005-09-30 09:55:49 +10001120
Darren Tucker372c8fb2005-09-29 22:01:10 +1000112120050929
1122 - (dtucker) [monitor_wrap.c] Remove duplicate definition of loginmsg
1123 introduced during sync.
1124
Darren Tucker46e7ba52005-09-28 08:26:30 +1000112520050928
1126 - (dtucker) [entropy.c] Use u_char for receiving RNG seed for consistency.
Darren Tucker7b1e6952005-09-28 22:33:27 +10001127 - (dtucker) [auth-pam.c] Bug #1028: send final non-query messages from
1128 PAM via keyboard-interactive. Patch tested by the folks at Vintela.
Darren Tucker46e7ba52005-09-28 08:26:30 +10001129
Darren Tuckerf1377bd2005-09-27 19:50:25 +1000113020050927
1131 - (dtucker) [entropy.c] Remove unnecessary tests for getuid and geteuid
1132 calls, since they can't possibly fail. ok djm@
Darren Tuckerc6f82192005-09-27 22:46:32 +10001133 - (dtucker) [entropy.c entropy.h sshd.c] Pass RNG seed to the reexec'ed
1134 process when sshd relies on ssh-random-helper. Should result in faster
1135 logins on systems without a real random device or prngd. ok djm@
Darren Tuckerf1377bd2005-09-27 19:50:25 +10001136
Darren Tuckerd3eff2b2005-09-24 12:43:51 +1000113720050924
1138 - (dtucker) [auth2.c] Move start_pam() calls out of if-else block to remove
1139 duplicate call. ok djm@
1140
Darren Tuckerc373a562005-09-22 20:15:08 +1000114120050922
1142 - (dtucker) [configure.ac] Use -R linker flag for libedit too; patch from
1143 skeleten at shillest.net.
Darren Tucker82171c62005-09-22 20:19:54 +10001144 - (dtucker) [configure.ac] Fix help for --with-opensc; patch from skeleten at
1145 shillest.net.
Darren Tuckerc373a562005-09-22 20:15:08 +10001146
Tim Rice7df8d392005-09-19 09:33:39 -0700114720050919
1148 - (tim) [aclocal.m4 configure.ac] Delete acconfig.h and add templates to
1149 AC_DEFINE and AC_DEFINE_UNQUOTED to quiet autoconf 2.59 warning messages.
Tim Rice542f62b2005-09-19 09:36:55 -07001150 ok dtucker@
Tim Rice7df8d392005-09-19 09:33:39 -07001151
Tim Ricefd9e9e32005-09-12 17:36:10 -0700115220050912
1153 - (tim) [configure.ac] Bug 1078. Fix --without-kerberos5. Reported by
1154 Mike Frysinger.
1155
Tim Rice64ead482005-09-08 21:56:33 -0700115620050908
1157 - (tim) [defines.h openbsd-compat/port-uw.c] Add long password support to
1158 OpenServer 6 and add osr5bigcrypt support so when someone migrates
1159 passwords between UnixWare and OpenServer they will still work. OK dtucker@
1160
Damien Millerc8ab8ce2005-09-01 19:10:48 +1000116120050901
1162 - (djm) Update RPM spec file versions
1163
Tim Rice66fd2172005-08-31 09:59:49 -0700116420050831
Damien Millerda9984f2005-08-31 19:46:26 +10001165 - (djm) OpenBSD CVS Sync
1166 - djm@cvs.openbsd.org 2005/08/30 22:08:05
1167 [gss-serv.c sshconnect2.c]
1168 destroy credentials if krb5_kuserok() call fails. Stops credentials being
1169 delegated to users who are not authorised for GSSAPIAuthentication when
1170 GSSAPIDeletegateCredentials=yes and another authentication mechanism
1171 succeeds; bz#1073 reported by paul.moore AT centrify.com, fix by
1172 simon AT sxw.org.uk, tested todd@ biorn@ jakob@; ok deraadt@
Damien Millerae379592005-08-31 19:47:07 +10001173 - markus@cvs.openbsd.org 2005/08/31 09:28:42
1174 [version.h]
1175 4.2
Darren Tuckerd0a47cd2005-09-01 00:05:56 +10001176 - (dtucker) [README] Update release note URL to 4.2
Tim Rice66fd2172005-08-31 09:59:49 -07001177 - (tim) [configure.ac auth.c defines.h session.c openbsd-compat/port-uw.c
1178 openbsd-compat/port-uw.h openbsd-compat/xcrypt.c] libiaf cleanup. Disable
1179 libiaf bits for OpenServer6. Free memory allocated by ia_get_logpwd().
1180 Feedback and OK dtucker@
Damien Millerda9984f2005-08-31 19:46:26 +10001181
118220050830
Tim Riceeb456542005-08-30 07:12:02 -07001183 - (tim) [configure.ac] Back out last change. It needs to be done differently.
1184
Tim Rice20168652005-08-29 17:17:37 -0700118520050829
1186 - (tim) [configure.ac] ia_openinfo() seems broken on OSR6. Limit UW long
1187 password support to 7.x for now.
1188
Tim Rice2291c002005-08-26 13:15:19 -0700118920050826
1190 - (tim) [CREDITS LICENCE auth.c configure.ac defines.h includes.h session.c
1191 openbsd-compat/Makefile.in openbsd-compat/openbsd-compat.h
1192 openbsd-compat/xcrypt.c] New files [openssh/openbsd-compat/port-uw.c
1193 openssh/openbsd-compat/port-uw.h] Support long passwords (> 8-char)
1194 on UnixWare 7 from Dhiraj Gulati and Ahsan Rashid. Cleanup and testing
1195 by tim@. Feedback and OK dtucker@
1196
Darren Tucker114572f2005-08-23 23:32:05 +1000119720050823
1198 - (dtucker) [regress/test-exec.sh] Do not prepend an extra "/" to a fully-
1199 qualified sshd pathname since some systems (eg Cygwin) may consider "/foo"
1200 and "//foo" to be different. Spotted by vinschen at redhat.com.
Tim Rice8cc2ad62005-08-23 17:18:21 -07001201 - (tim) [configure.ac] Not all gcc's support -Wsign-compare. Enhancements
1202 and OK dtucker@
1203 - (tim) [defines.h] PATH_MAX bits for OpenServer OK dtucker@
Darren Tucker114572f2005-08-23 23:32:05 +10001204
Darren Tucker93e7e8f2005-08-23 08:06:55 +1000120520050821
1206 - (dtucker) [configure.ac defines.h includes.h sftp.c] Add support for
1207 LynxOS, patch from Olli Savia (ops at iki.fi). ok djm@
1208
Damien Miller1d109762005-08-16 21:32:09 +1000120920050816
Damien Millerca9ce952005-08-31 19:42:20 +10001210 - (djm) [ttymodes.c] bugzilla #1025: Fix encoding of _POSIX_VDISABLE,
Damien Miller1d109762005-08-16 21:32:09 +10001211 from Jacob Nevins; ok dtucker@
1212
Tim Rice027e8b12005-08-15 14:52:50 -0700121320050815
Tim Ricec1819c82005-08-15 17:48:40 -07001214 - (tim) [sftp.c] wrap el_end() in #ifdef USE_LIBEDIT
1215 - (tim) [configure.ac] corrections to libedit tests. Report and patches
1216 by skeleten AT shillest.net
Tim Rice027e8b12005-08-15 14:52:50 -07001217
Damien Millerb5c01252005-08-12 22:10:28 +1000121820050812
1219 - (djm) OpenBSD CVS Sync
1220 - markus@cvs.openbsd.org 2005/07/28 17:36:22
1221 [packet.c]
1222 missing packet_init_compression(); from solar
Damien Millerbe1045d2005-08-12 22:10:56 +10001223 - djm@cvs.openbsd.org 2005/07/30 01:26:16
1224 [ssh.c]
1225 fix -D listen_host initialisation, so it picks up gateway_ports setting
1226 correctly
Damien Miller43f6db62005-08-12 22:11:18 +10001227 - djm@cvs.openbsd.org 2005/07/30 02:03:47
1228 [readconf.c]
1229 listen_hosts initialisation here too; spotted greg AT y2005.nest.cx
Damien Miller203c7052005-08-12 22:11:37 +10001230 - dtucker@cvs.openbsd.org 2005/08/06 10:03:12
1231 [servconf.c]
1232 Unbreak sshd ListenAddress for bare IPv6 addresses.
Damien Miller8e489482005-08-12 22:11:58 +10001233 Report from Janusz Mucka; ok djm@
Damien Miller0e2c1022005-08-12 22:16:22 +10001234 - jaredy@cvs.openbsd.org 2005/08/08 13:22:48
1235 [sftp.c]
1236 sftp prompt enhancements:
1237 - in non-interactive mode, do not print an empty prompt at the end
1238 before finishing
1239 - print newline after EOF in editline mode
1240 - call el_end() in editline mode
1241 ok dtucker djm
Damien Millerb5c01252005-08-12 22:10:28 +10001242
Darren Tuckerc7572b22005-08-10 20:34:15 +1000124320050810
1244 - (dtucker) [configure.ac] Test libedit library and headers for compatibility.
1245 Report from skeleten AT shillest.net, ok djm@
Darren Tucker73f671a2005-08-10 21:52:36 +10001246 - (dtucker) [LICENCE configure.ac defines.h openbsd-compat/realpath.c]
1247 Sync current (thread-safe) version of realpath.c from OpenBSD (which is
1248 in turn based on FreeBSD's). ok djm@
Darren Tuckerc7572b22005-08-10 20:34:15 +10001249
Tim Rice8bc6b902005-08-09 10:09:53 -0700125020050809
1251 - (tim) [configure.ac] Allow --with-audit=no. OK dtucker@
1252 Report by skeleten AT shillest.net
1253
Darren Tucker212cfc42005-08-03 10:57:15 +1000125420050803
1255 - (dtucker) [openbsd-compat/fake-rfc2553.h] Check for EAI_* defines
1256 individually and use a value less likely to collide with real values from
1257 netdb.h. Fixes compile warnings on FreeBSD 5.3. ok djm@
Darren Tucker98256972005-08-03 15:36:21 +10001258 - (dtucker) [openbsd-compat/fake-rfc2553.h] MAX_INT -> INT_MAX since the
1259 latter is specified in the standard.
Darren Tucker212cfc42005-08-03 10:57:15 +10001260
Darren Tucker40858532005-08-02 17:07:07 +1000126120050802
1262 - (dtucker) OpenBSD CVS Sync
1263 - dtucker@cvs.openbsd.org 2005/07/27 10:39:03
1264 [scp.c hostfile.c sftp-client.c]
1265 Silence bogus -Wuninitialized warnings; ok djm@
Darren Tuckerdd352b62005-08-02 17:21:29 +10001266 - (dtucker) [configure.ac] Enable -Wuninitialized by default when compiling
1267 with gcc. ok djm@
Darren Tucker7da23cb2005-08-03 00:20:15 +10001268 - (dtucker) [configure.ac] Add a --with-Werror option to configure for
1269 adding -Werror to CFLAGS when all of the configure tests are done. ok djm@
Darren Tucker40858532005-08-02 17:07:07 +10001270
Darren Tuckerac1910f2005-07-26 12:00:42 +1000127120050726
1272 - (dtucker) [configure.ac] Update zlib warning message too, pointed out by
1273 tim@.
Damien Miller47655ee2005-07-26 21:54:11 +10001274 - (djm) OpenBSD CVS Sync
1275 - otto@cvs.openbsd.org 2005/07/19 15:32:26
1276 [auth-passwd.c]
1277 auth_usercheck(3) can return NULL, so check for that. Report from
1278 mpech@. ok markus@
Damien Miller9786e6e2005-07-26 21:54:56 +10001279 - markus@cvs.openbsd.org 2005/07/25 11:59:40
1280 [kex.c kex.h myproposal.h packet.c packet.h servconf.c session.c]
1281 [sshconnect2.c sshd.c sshd_config sshd_config.5]
1282 add a new compression method that delays compression until the user
1283 has been authenticated successfully and set compression to 'delayed'
1284 for sshd.
1285 this breaks older openssh clients (< 3.5) if they insist on
1286 compression, so you have to re-enable compression in sshd_config.
1287 ok djm@
Darren Tuckerac1910f2005-07-26 12:00:42 +10001288
Darren Tucker41097ed2005-07-25 15:24:21 +1000128920050725
1290 - (dtucker) [configure.ac] Update zlib version check for CAN-2005-2096.
1291
Damien Miller46d38de2005-07-17 17:02:09 +1000129220050717
1293- OpenBSD CVS Sync
1294 - djm@cvs.openbsd.org 2005/07/16 01:35:24
1295 [auth1.c channels.c cipher.c clientloop.c kex.c session.c ssh.c]
1296 [sshconnect.c]
1297 spacing
Damien Miller94cf4c82005-07-17 17:04:47 +10001298 - (djm) [acss.c auth-pam.c auth-shadow.c auth-skey.c auth1.c canohost.c]
1299 [cipher-acss.c loginrec.c ssh-rand-helper.c sshd.c] Fix whitespace at EOL
1300 in portable too ("perl -p -i -e 's/\s+$/\n/' *.[ch]")
Damien Miller37294fb2005-07-17 17:18:49 +10001301 - (djm) [auth-pam.c sftp.c] spaces vs. tabs at start of line
Damien Miller2b9b0452005-07-17 17:19:24 +10001302 - djm@cvs.openbsd.org 2005/07/17 06:49:04
1303 [channels.c channels.h session.c session.h]
1304 Fix a number of X11 forwarding channel leaks:
1305 1. Refuse multiple X11 forwarding requests on the same session
1306 2. Clean up all listeners after a single_connection X11 forward, not just
1307 the one that made the single connection
1308 3. Destroy X11 listeners when the session owning them goes away
1309 testing and ok dtucker@
Damien Miller0dc1bef2005-07-17 17:22:45 +10001310 - djm@cvs.openbsd.org 2005/07/17 07:17:55
1311 [auth-rh-rsa.c auth-rhosts.c auth2-chall.c auth2-gss.c channels.c]
1312 [cipher-ctr.c gss-genr.c gss-serv.c kex.c moduli.c readconf.c]
1313 [serverloop.c session.c sftp-client.c sftp.c ssh-add.c ssh-keygen.c]
1314 [sshconnect.c sshconnect2.c]
1315 knf says that a 2nd level indent is four (not three or five) spaces
Damien Millerb6f72f52005-07-17 17:26:43 +10001316 -(djm) [audit.c auth1.c auth2.c entropy.c loginrec.c serverloop.c]
1317 [ssh-rand-helper.c] fix portable 2nd level indents at 4 spaces too
Damien Miller04b65332005-07-17 17:53:31 +10001318 - (djm) [monitor.c monitor_wrap.c] -Wsign-compare for PAM monitor calls
1319
Darren Tucker4f1adad2005-07-16 11:33:06 +1000132020050716
1321 - (dtucker) [auth-pam.c] Ensure that only one side of the authentication
1322 socketpair stays open on in both the monitor and PAM process. Patch from
1323 Joerg Sonnenberger.
1324
Darren Tuckera5cf8552005-07-14 17:04:18 +1000132520050714
1326 - (dtucker) OpenBSD CVS Sync
1327 - dtucker@cvs.openbsd.org 2005/07/06 09:33:05
1328 [ssh.1]
1329 clarify meaning of ssh -b ; with & ok jmc@
Darren Tuckerbee73d52005-07-14 17:05:02 +10001330 - dtucker@cvs.openbsd.org 2005/07/08 09:26:18
1331 [misc.c]
1332 Make comment match code; ok djm@
Darren Tuckerce377c32005-07-14 17:05:51 +10001333 - markus@cvs.openbsd.org 2005/07/08 09:41:33
1334 [channels.h]
1335 race when efd gets closed while there is still buffered data:
1336 change CHANNEL_EFD_OUTPUT_ACTIVE()
1337 1) c->efd must always be valid AND
1338 2a) no EOF has been seen OR
1339 2b) there is buffered data
1340 report, initial fix and testing Chuck Cranor
Darren Tucker89f4d472005-07-14 17:06:21 +10001341 - dtucker@cvs.openbsd.org 2005/07/08 10:20:41
1342 [ssh_config.5]
1343 change BindAddress to match recent ssh -b change; prompted by markus@
Darren Tucker6c71d202005-07-14 17:06:50 +10001344 - jmc@cvs.openbsd.org 2005/07/08 12:53:10
1345 [ssh_config.5]
1346 new sentence, new line;
Darren Tucker8e2eb302005-07-14 17:07:21 +10001347 - dtucker@cvs.openbsd.org 2005/07/14 04:00:43
1348 [misc.h]
1349 use __sentinel__ attribute; ok deraadt@ djm@ markus@
Darren Tucker4a422572005-07-14 17:22:11 +10001350 - (dtucker) [configure.ac defines.h] Define __sentinel__ to nothing if the
1351 compiler doesn't understand it to prevent warnings. If any mainstream
1352 compiler versions acquire it we can test for those versions. Based on
1353 discussion with djm@.
Darren Tuckera5cf8552005-07-14 17:04:18 +10001354
Darren Tuckera916d142005-07-07 11:50:20 +1000135520050707
Darren Tuckera83f2612005-07-07 20:09:35 +10001356 - dtucker [auth-krb5.c auth.h gss-serv-krb5.c] Move KRB5CCNAME generation for
1357 the MIT Kerberos code path into a common function and expand mkstemp
1358 template to be consistent with the rest of OpenSSH. From sxw at
1359 inf.ed.ac.uk, ok djm@
1360 - (dtucker) [auth-krb5.c] There's no guarantee that snprintf will set errno
1361 in the case where the buffer is insufficient, so always return ENOMEM.
1362 Also pointed out by sxw at inf.ed.ac.uk.
Darren Tucker893c6022005-07-07 20:33:36 +10001363 - (dtucker) [acconfig.h auth-krb5.c configure.ac gss-serv-krb5.c] Remove
1364 calls to krb5_init_ets, which has not been required since krb-1.1.x and
1365 most Kerberos versions no longer export in their public API. From sxw
1366 at inf.ed.ac.uk, ok djm@
Darren Tuckera916d142005-07-07 11:50:20 +10001367
Damien Millera7270302005-07-06 09:36:05 +1000136820050706
1369 - (djm) OpenBSD CVS Sync
1370 - markus@cvs.openbsd.org 2005/07/01 13:19:47
1371 [channels.c]
1372 don't free() if getaddrinfo() fails; report mpech@
Damien Miller13390022005-07-06 09:44:19 +10001373 - djm@cvs.openbsd.org 2005/07/04 00:58:43
1374 [channels.c clientloop.c clientloop.h misc.c misc.h ssh.c ssh_config.5]
1375 implement support for X11 and agent forwarding over multiplex slave
1376 connections. Because of protocol limitations, the slave connections inherit
1377 the master's DISPLAY and SSH_AUTH_SOCK rather than distinctly forwarding
1378 their own.
1379 ok dtucker@ "put it in" deraadt@
Damien Millerfd94fba2005-07-06 09:44:59 +10001380 - jmc@cvs.openbsd.org 2005/07/04 11:29:51
1381 [ssh_config.5]
1382 fix Xr and a little grammar;
Damien Millerf92c0792005-07-06 09:45:26 +10001383 - markus@cvs.openbsd.org 2005/07/04 14:04:11
1384 [channels.c]
1385 don't forget to set x11_saved_display
Damien Millera7270302005-07-06 09:36:05 +10001386
Damien Miller9651fe62005-06-26 08:55:25 +1000138720050626
1388 - (djm) OpenBSD CVS Sync
1389 - djm@cvs.openbsd.org 2005/06/17 22:53:47
1390 [ssh.c sshconnect.c]
1391 Fix ControlPath's %p expanding to "0" for a default port,
1392 spotted dwmw2 AT infradead.org; ok markus@
Damien Miller8f74c8f2005-06-26 08:56:03 +10001393 - djm@cvs.openbsd.org 2005/06/18 04:30:36
1394 [ssh.c ssh_config.5]
1395 allow ControlPath=none, patch from dwmw2 AT infradead.org; ok dtucker@
Damien Miller7c71cc72005-06-26 08:56:31 +10001396 - djm@cvs.openbsd.org 2005/06/25 22:47:49
1397 [ssh.c]
Damien Millerdba63542005-06-26 08:56:48 +10001398 do the default port filling code a few lines earlier, so it really
1399 does fix %p
Damien Miller9651fe62005-06-26 08:55:25 +10001400
Damien Miller6abf57c2005-06-19 07:31:37 +1000140120050618
1402 - (djm) OpenBSD CVS Sync
1403 - djm@cvs.openbsd.org 2005/05/20 12:57:01;
1404 [auth1.c] split protocol 1 auth methods into separate functions, makes
1405 authloop much more readable; fixes and ok markus@ (portable ok &
1406 polish dtucker@)
Damien Miller06221f12005-06-19 07:36:10 +10001407 - djm@cvs.openbsd.org 2005/06/17 02:44:33
1408 [auth1.c] make this -Wsign-compare clean; ok avsm@ markus@
Damien Miller52c8afe2005-06-19 10:19:43 +10001409 - (djm) [loginrec.c ssh-rand-helper.c] Fix -Wsign-compare for portable,
1410 tested and fixes tim@
Damien Miller6abf57c2005-06-19 07:31:37 +10001411
Damien Miller17e7ed02005-06-17 12:54:33 +1000141220050617
1413 - (djm) OpenBSD CVS Sync
1414 - djm@cvs.openbsd.org 2005/06/16 03:38:36
1415 [channels.c channels.h clientloop.c clientloop.h ssh.c]
1416 move x11_get_proto from ssh.c to clientloop.c, to make muliplexed xfwd
1417 easier later; ok deraadt@
Damien Miller677257f2005-06-17 12:55:03 +10001418 - markus@cvs.openbsd.org 2005/06/16 08:00:00
1419 [canohost.c channels.c sshd.c]
1420 don't exit if getpeername fails for forwarded ports; bugzilla #1054;
1421 ok djm
Damien Millereccb9de2005-06-17 12:59:34 +10001422 - djm@cvs.openbsd.org 2005/06/17 02:44:33
1423 [auth-rsa.c auth.c auth1.c auth2-chall.c auth2-gss.c authfd.c authfile.c]
1424 [bufaux.c canohost.c channels.c cipher.c clientloop.c dns.c gss-serv.c]
1425 [kex.c kex.h key.c mac.c match.c misc.c packet.c packet.h scp.c]
1426 [servconf.c session.c session.h sftp-client.c sftp-server.c sftp.c]
1427 [ssh-keyscan.c ssh-rsa.c sshconnect.c sshconnect1.c sshconnect2.c sshd.c]
1428 make this -Wsign-compare clean; ok avsm@ markus@
1429 NB. auth1.c changes not committed yet (conflicts with uncommitted sync)
1430 NB2. more work may be needed to make portable Wsign-compare clean
Darren Tuckerf0bd3522005-06-17 21:15:20 +10001431 - (dtucker) [cipher.c openbsd-compat/openbsd-compat.h
1432 openbsd-compat/openssl-compat.c] only include openssl compat stuff where
1433 it's needed as it can cause conflicts elsewhere (eg xcrypt.c). Found by
1434 and ok tim@
Damien Miller17e7ed02005-06-17 12:54:33 +10001435
Damien Miller05656962005-06-16 13:18:04 +1000143620050616
1437 - (djm) OpenBSD CVS Sync
1438 - jaredy@cvs.openbsd.org 2005/06/07 13:25:23
1439 [progressmeter.c]
1440 catch SIGWINCH and resize progress meter accordingly; ok markus dtucker
Damien Miller6476cad2005-06-16 13:18:34 +10001441 - djm@cvs.openbsd.org 2005/06/06 11:20:36
1442 [auth.c auth.h misc.c misc.h ssh.c ssh_config.5 sshconnect.c]
1443 introduce a generic %foo expansion function. replace existing % expansion
1444 and add expansion to ControlPath; ok markus@
Damien Millerac7ef6a2005-06-16 13:19:06 +10001445 - djm@cvs.openbsd.org 2005/06/08 03:50:00
1446 [ssh-keygen.1 ssh-keygen.c sshd.8]
1447 increase default rsa/dsa key length from 1024 to 2048 bits;
1448 ok markus@ deraadt@
Damien Millerd14b1e72005-06-16 13:19:41 +10001449 - djm@cvs.openbsd.org 2005/06/08 11:25:09
1450 [clientloop.c readconf.c readconf.h ssh.c ssh_config.5]
1451 add ControlMaster=auto/autoask options to support opportunistic
1452 multiplexing; tested avsm@ and jakob@, ok markus@
Damien Miller46f55d32005-06-16 13:21:17 +10001453 - dtucker@cvs.openbsd.org 2005/06/09 13:43:49
1454 [cipher.c]
1455 Correctly initialize end of array sentinel; ok djm@
1456 (Id sync only, change already in portable)
Damien Miller05656962005-06-16 13:18:04 +10001457
Darren Tuckera55ec772005-06-09 21:45:10 +1000145820050609
1459 - (dtucker) [cipher.c openbsd-compat/Makefile.in
Darren Tucker488d6022005-06-09 23:40:39 +10001460 openbsd-compat/openbsd-compat.h openbsd-compat/openssl-compat.{c,h}]
Darren Tuckera55ec772005-06-09 21:45:10 +10001461 Move compatibility code for supporting older OpenSSL versions to the
1462 compat layer. Suggested by and "no objection" djm@
1463
Darren Tucker431f0222005-06-07 17:53:40 +1000146420050607
1465 - (dtucker) [configure.ac] Continue the hunt for LLONG_MIN and LLONG_MAX:
1466 in today's episode we attempt to coax it from limits.h where it may be
1467 hiding, failing that we take the DIY approach. Tested by tim@
1468
Darren Tucker67b37032005-06-03 17:58:31 +1000146920050603
1470 - (dtucker) [configure.ac] Only try gcc -std=gnu99 if LLONG_MAX isn't
1471 defined, and check that it helps before keeping it in CFLAGS. Some old
1472 gcc's don't set an error code when encountering an unknown value in -std.
1473 Found and tested by tim@.
Darren Tucker6a45f3d2005-06-03 19:33:10 +10001474 - (dtucker) [configure.ac] Point configure's reporting address at the
1475 openssh-unix-dev list. ok tim@ djm@
Darren Tucker67b37032005-06-03 17:58:31 +10001476
Tim Ricefcc7ff12005-06-02 20:28:29 -0700147720050602
1478 - (tim) [configure.ac] Some platforms need sys/types.h for arpa/nameser.h.
1479 Take AC_CHECK_HEADERS test out of ultrix section. It caused other platforms
1480 to skip builtin standard includes tests. (first AC_CHECK_HEADERS test
1481 must be run on all platforms) Add missing ;; to case statement. OK dtucker@
1482
Darren Tuckerd886e1c2005-06-01 18:57:45 +1000148320050601
1484 - (dtucker) [configure.ac] Look for _getshort and _getlong in
1485 arpa/nameser.h.
Darren Tucker81eb5d52005-06-01 21:39:33 +10001486 - (dtucker) [configure.ac openbsd-compat/Makefile.in openbsd-compat/strtoll.c]
1487 Add strtoll to the compat library, from OpenBSD.
Darren Tuckerfc4f2dd2005-06-01 23:01:12 +10001488 - (dtucker) OpenBSD CVS Sync
1489 - avsm@cvs.openbsd.org 2005/05/26 02:08:05
1490 [scp.c]
1491 If copying multiple files to a target file (which normally fails, as it
1492 must be a target directory), kill the spawned ssh child before exiting.
1493 This stops it trying to authenticate and spewing lots of output.
1494 deraadt@ ok
Darren Tucker2db8ae62005-06-01 23:02:25 +10001495 - dtucker@cvs.openbsd.org 2005/05/26 09:08:12
1496 [ssh-keygen.c]
1497 uint32_t -> u_int32_t for consistency; ok djm@
Darren Tucker0814d312005-06-01 23:08:51 +10001498 - djm@cvs.openbsd.org 2005/05/27 08:30:37
1499 [ssh.c]
1500 fix -O for cases where no ControlPath has been specified or socket at
1501 ControlPath is not contactable; spotted by and ok avsm@
Tim Rice5f707582005-06-01 19:57:45 -07001502 - (tim) [config.guess config.sub] Update to '2005-05-27' version.
Tim Rice4dbacff2005-06-01 20:09:28 -07001503 - (tim) [configure.ac] set TEST_SHELL for OpenServer 6
Darren Tuckerd886e1c2005-06-01 18:57:45 +10001504
Darren Tucker11fb0f22005-05-31 16:51:07 +1000150520050531
1506 - (dtucker) [contrib/aix/pam.conf] Correct comments. From davidl at
1507 vintela.com.
Darren Tuckerf5615962005-05-31 16:59:16 +10001508 - (dtucker) [mdoc2man.awk] Teach it to understand .Ox.
Darren Tucker11fb0f22005-05-31 16:51:07 +10001509
151020050530
1511 - (dtucker) [README] Link to new release notes. Beter late than never...
1512
Darren Tucker782727a2005-05-29 10:28:48 +1000151320050529
1514 - (dtucker) [openbsd-compat/port-aix.c] Bug #1046: AIX 5.3 expects the
1515 argument to passwdexpired to be initialized to NULL. Suggested by tim@
1516 While at it, initialize the other arguments to auth functions in case they
1517 ever acquire this behaviour.
Darren Tucker6b2fe312005-05-29 10:32:47 +10001518 - (dtucker) [openbsd-compat/port-aix.c] Whitespace cleanups while there.
Darren Tuckerf9fea652005-05-29 10:54:27 +10001519 - (dtucker) [openbsd-compat/port-aix.c] Minor correction to debug message,
1520 spotted by tim@.
Darren Tucker782727a2005-05-29 10:28:48 +10001521
Darren Tucker0c9653f2005-05-28 15:58:14 +1000152220050528
1523 - (dtucker) [configure.ac] For AC_CHECK_HEADERS() and AC_CHECK_FUNCS() have
1524 one entry per line to make it easier to merge changes. ok djm@
Darren Tucker390b6d52005-05-28 16:54:36 +10001525 - (dtucker) [configure.ac] strsep() may be defined in string.h, so check
1526 for its presence and include it in the strsep check.
Darren Tucker7d2171b2005-05-28 16:57:00 +10001527 - (dtucker) [configure.ac] getpgrp may be defined in unistd.h, so check for
1528 its presence before doing AC_FUNC_GETPGRP.
Darren Tuckerfd333282005-05-28 18:31:42 +10001529 - (dtucker) [configure.ac] Merge HP-UX blocks into a common block with minor
1530 version-specific variations as required.
Darren Tucker5d72a402005-05-28 20:28:39 +10001531 - (dtucker) [openbsd-compat/port-aix.h] Use the HAVE_DECL_* definitions as
1532 per the autoconf man page. Configure should always define them but it
1533 doesn't hurt to check.
Darren Tucker0c9653f2005-05-28 15:58:14 +10001534
Damien Miller287b4592005-05-27 19:36:56 +1000153520050527
1536 - (djm) [defines.h] Use our realpath if we have to define PATH_MAX, spotted by
1537 David Leach; ok dtucker@
Darren Tucker2be1cbb2005-05-27 21:13:40 +10001538 - (dtucker) [acconfig.h configure.ac defines.h includes.h sshpty.c
1539 openbsd-compat/bsd-misc.c] Add support for Ultrix. No, that's not a typo.
1540 Required changes from Bernhard Simon, integrated by me. ok djm@
Damien Miller287b4592005-05-27 19:36:56 +10001541
Damien Miller2c04deb2005-05-26 11:35:37 +1000154220050525
1543 - (djm) [mpaux.c mpaux.h Makefile.in] Remove old mpaux.[ch] code, it has not
1544 been used for a while
Damien Miller9278ffa2005-05-26 11:59:06 +10001545 - (djm) OpenBSD CVS Sync
1546 - otto@cvs.openbsd.org 2005/04/05 13:45:31
1547 [ssh-keygen.c]
Damien Miller4f1d6b22005-05-26 11:59:32 +10001548 - djm@cvs.openbsd.org 2005/04/06 09:43:59
1549 [sshd.c]
1550 avoid harmless logspam by not performing setsockopt() on non-socket;
1551 ok markus@
Damien Miller1b0de9a2005-05-26 12:01:22 +10001552 - dtucker@cvs.openbsd.org 2005/04/06 12:26:06
1553 [ssh.c]
1554 Fix debug call for port forwards; patch from pete at seebeyond.com,
1555 ok djm@ (ID sync only - change already in portable)
Damien Miller5fd38c02005-05-26 12:02:14 +10001556 - djm@cvs.openbsd.org 2005/04/09 04:32:54
1557 [misc.c misc.h tildexpand.c Makefile.in]
1558 replace tilde_expand_filename with a simpler implementation, ahead of
1559 more whacking; ok deraadt@
Damien Miller3dc967e2005-05-26 12:03:15 +10001560 - jmc@cvs.openbsd.org 2005/04/14 12:30:30
1561 [ssh.1]
1562 arg to -b is an address, not if_name;
1563 ok markus@
Damien Millera31c9292005-05-26 12:03:31 +10001564 - jakob@cvs.openbsd.org 2005/04/20 10:05:45
1565 [dns.c]
1566 do not try to look up SSHFP for numerical hostname. ok djm@
Damien Miller167ea5d2005-05-26 12:04:02 +10001567 - djm@cvs.openbsd.org 2005/04/21 06:17:50
1568 [ssh-add.1 ssh-agent.1 ssh-keygen.1 ssh.1 ssh_config.5 sshd.8]
1569 [sshd_config.5] OpenSSH doesn't ever look at the $HOME environment
1570 variable, so don't say that we do (bz #623); ok deraadt@
Damien Millerddee5752005-05-26 12:05:05 +10001571 - djm@cvs.openbsd.org 2005/04/21 11:47:19
1572 [ssh.c]
1573 don't allocate a pty when -n flag (/dev/null stdin) is set, patch from
1574 ignasi.roca AT fujitsu-siemens.com (bz #829); ok dtucker@
Damien Millerddeb7522005-05-26 12:05:28 +10001575 - dtucker@cvs.openbsd.org 2005/04/23 23:43:47
1576 [readpass.c]
1577 Add debug message if read_passphrase can't open /dev/tty; bz #471;
1578 ok djm@
Damien Millerac7a0052005-05-26 12:05:49 +10001579 - jmc@cvs.openbsd.org 2005/04/26 12:59:02
1580 [sftp-client.h]
1581 spelling correction in comment from wiz@netbsd;
Damien Millerdadfd4d2005-05-26 12:07:13 +10001582 - jakob@cvs.openbsd.org 2005/04/26 13:08:37
1583 [ssh.c ssh_config.5]
1584 fallback gracefully if client cannot connect to ControlPath. ok djm@
Damien Miller41bfc292005-05-26 12:07:32 +10001585 - moritz@cvs.openbsd.org 2005/04/28 10:17:56
1586 [progressmeter.c ssh-keyscan.c]
1587 add snprintf checks. ok djm@ markus@
Damien Millerd2ebd452005-05-26 12:07:47 +10001588 - markus@cvs.openbsd.org 2005/05/02 21:13:22
1589 [readpass.c]
1590 missing {}
Damien Miller924c25a2005-05-26 12:09:32 +10001591 - djm@cvs.openbsd.org 2005/05/10 10:28:11
1592 [ssh.c]
1593 print nice error message for EADDRINUSE as well (ID sync only)
Damien Miller538c9b72005-05-26 12:11:28 +10001594 - djm@cvs.openbsd.org 2005/05/10 10:30:43
1595 [ssh.c]
1596 report real errors on fallback from ControlMaster=no to normal connect
Damien Miller17b23d82005-05-26 12:11:56 +10001597 - markus@cvs.openbsd.org 2005/05/16 15:30:51
1598 [readconf.c servconf.c]
1599 check return value from strdelim() for NULL (AddressFamily); mpech
Damien Miller1594ad52005-05-26 12:12:19 +10001600 - djm@cvs.openbsd.org 2005/05/19 02:39:55
1601 [sshd_config.5]
1602 sort config options, from grunk AT pestilenz.org; ok jmc@
Damien Miller06b75ad2005-05-26 12:12:37 +10001603 - djm@cvs.openbsd.org 2005/05/19 02:40:52
1604 [sshd_config]
1605 whitespace nit, from grunk AT pestilenz.org
Damien Miller459735a2005-05-26 12:13:42 +10001606 - djm@cvs.openbsd.org 2005/05/19 02:42:26
1607 [includes.h]
1608 fix cast, from grunk AT pestilenz.org
Damien Millerebcfedc2005-05-26 12:13:56 +10001609 - djm@cvs.openbsd.org 2005/05/20 10:50:55
1610 [ssh_config.5]
1611 give a ProxyCommand example using nc(1), with and ok jmc@
Damien Millerdfec2942005-05-26 12:14:32 +10001612 - jmc@cvs.openbsd.org 2005/05/20 11:23:32
1613 [ssh_config.5]
1614 oops - article and spacing;
Damien Millerb089fb52005-05-26 12:16:18 +10001615 - avsm@cvs.openbsd.org 2005/05/23 22:44:01
1616 [moduli.c ssh-keygen.c]
1617 - removes signed/unsigned comparisons in moduli generation
1618 - use strtonum instead of atoi where its easier
1619 - check some strlcpy overflow and fatal instead of truncate
Damien Miller3710f272005-05-26 12:19:17 +10001620 - djm@cvs.openbsd.org 2005/05/23 23:32:46
1621 [cipher.c myproposal.h ssh.1 ssh_config.5 sshd_config.5]
1622 add support for draft-harris-ssh-arcfour-fixes-02 improved arcfour modes;
1623 ok markus@
Damien Miller02e754f2005-05-26 12:19:39 +10001624 - avsm@cvs.openbsd.org 2005/05/24 02:05:09
1625 [ssh-keygen.c]
1626 some style nits from dmiller@, and use a fatal() instead of a printf()/exit
Damien Millerb253cc42005-05-26 12:23:44 +10001627 - avsm@cvs.openbsd.org 2005/05/24 17:32:44
1628 [atomicio.c atomicio.h authfd.c monitor_wrap.c msg.c scp.c sftp-client.c]
1629 [ssh-keyscan.c sshconnect.c]
1630 Switch atomicio to use a simpler interface; it now returns a size_t
1631 (containing number of bytes read/written), and indicates error by
1632 returning 0. EOF is signalled by errno==EPIPE.
1633 Typical use now becomes:
1634
1635 if (atomicio(read, ..., len) != len)
1636 err(1,"read");
1637
1638 ok deraadt@, cloder@, djm@
Darren Tuckerd98dce62005-05-26 13:43:57 +10001639 - (dtucker) [regress/reexec.sh] Add ${EXEEXT} so this test also works on
1640 Cygwin.
Darren Tuckerf08bdb52005-05-26 19:59:48 +10001641 - (dtucker) [auth-pam.c] Bug #1033: Fix warnings building with PAM on Linux:
Darren Tucker84ce9b42005-05-26 20:12:15 +10001642 warning: dereferencing type-punned pointer will break strict-aliasing rules
1643 warning: passing arg 3 of `pam_get_item' from incompatible pointer type
1644 The type-punned pointer fix is based on a patch from SuSE's rpm. ok djm@
1645 - (dtucker) [configure.ac openbsd-compat/getrrsetbyname.c] Bug #1033: Provide
1646 templates for _getshort and _getlong if missing to prevent compiler warnings
1647 on Linux.
Damien Millerde3cb0a2005-05-26 20:48:25 +10001648 - (djm) [configure.ac openbsd-compat/Makefile.in]
1649 [openbsd-compat/openbsd-compat.h openbsd-compat/strtonum.c]
1650 Add strtonum(3) from OpenBSD libc, new code needs it.
1651 Unfortunately Linux forces us to do a bizarre dance with compiler
1652 options to get LLONG_MIN/MAX; Spotted by and ok dtucker@
Damien Miller2c04deb2005-05-26 11:35:37 +10001653
Damien Miller4d8f5602005-05-25 14:43:47 +1000165420050524
1655 - (djm) [contrib/caldera/openssh.spec contrib/redhat/openssh.spec]
1656 [contrib/suse/openssh.spec] Update spec file versions to 4.1p1
Darren Tucker328118a2005-05-25 16:18:09 +10001657 - (dtucker) [auth-pam.c] Since people don't seem to be getting the message
1658 that USE_POSIX_THREADS is unsupported, not recommended and generally a bad
1659 idea, it is now known as UNSUPPORTED_POSIX_THREADS_HACK. Attempting to use
1660 USE_POSIX_THREADS will now generate an error so we don't silently change
1661 behaviour. ok djm@
Darren Tuckerae8c91e2005-05-25 19:42:10 +10001662 - (dtucker) [openbsd-compat/bsd-cygwin_util.c] Ensure sufficient memory
1663 allocation when retrieving core Windows environment. Add CYGWIN variable
1664 to propagated variables. Patch from vinschen at redhat.com, ok djm@
Damien Miller6b6d5be2005-05-26 11:34:36 +10001665 - Release 4.1p1
Damien Miller4d8f5602005-05-25 14:43:47 +10001666
166720050524
Damien Millerdf548bc2005-05-24 15:54:27 +10001668 - (djm) [openbsd-compat/readpassphrase.c] bz #950: Retry tcsetattr to ensure
1669 terminal modes are reset correctly. Fix from peak AT argo.troja.mff.cuni.cz;
1670 "looks ok" dtucker@
1671
167220050512
Tim Riceb58bd032005-05-12 10:32:19 -07001673 - (tim) [buildpkg.sh.in] missing ${PKG_INSTALL_ROOT} in init script
1674 hard link section. Bug 1038.
1675
Darren Tuckerfa2211d2005-05-09 23:48:17 +1000167620050509
1677 - (dtucker) [contrib/cygwin/ssh-host-config] Add a test and warning for a
1678 user-mode mounts in Cygwin installation. Patch from vinschen at redhat.com.
1679
Damien Miller4f10e252005-05-04 15:33:09 +1000168020050504
1681 - (djm) [ssh.c] some systems return EADDRINUSE on a bind to an already-used
1682 unix domain socket, so catch that too; from jakob@ ok dtucker@
1683
Darren Tucker5b115d42005-05-03 19:05:32 +1000168420050503
1685 - (dtucker) [canohost.c] normalise socket addresses returned by
1686 get_remote_hostname(). This means that IPv4 addresses in log messages
1687 on IPv6 enabled machines will no longer be prefixed by "::ffff:" and
1688 AllowUsers, DenyUsers, AllowGroups, DenyGroups will match IPv4-style
1689 addresses only for 4-in-6 mapped connections, regardless of whether
1690 or not the machine is IPv6 enabled. ok djm@
1691
Darren Tuckerfaefd2e2005-04-25 14:48:22 +1000169220050425
1693 - (dtucker) [regress/multiplex.sh] Use "kill -0 $pid" to check for the
1694 existence of a process since it's more portable. Found by jbasney at
1695 ncsa.uiuc.edu; ok tim@
Darren Tuckerbf2b3982005-04-25 14:49:48 +10001696 - (dtucker) [regress/multiplex.sh] Remove cleanup call since test-exec.sh
1697 will clean up anyway. From tim@
Darren Tuckeraf342552005-04-25 17:01:26 +10001698 - (dtucker) [regress/multiplex.sh] Put control socket in /tmp so running
Darren Tucker149da852005-04-25 17:03:29 +10001699 "make tests" works even if you're building on a filesystem that doesn't
Darren Tuckeraf342552005-04-25 17:01:26 +10001700 support sockets. From deengert at anl.gov, ok djm@
Darren Tuckerfaefd2e2005-04-25 14:48:22 +10001701
Darren Tucker2f0b5c42005-04-24 17:52:22 +1000170220050424
1703 - (dtucker) [INSTALL configure.ac] Make zlib version check test for 1.1.4 or
1704 1.2.1.2 or higher. With tim@, ok djm@
1705
Tim Rice4149ebc2005-04-23 18:17:29 -0700170620050423
1707 - (tim) [config.guess] Add support for OpenServer 6.
1708
Darren Tucker48554152005-04-21 19:50:55 +1000170920050421
1710 - (dtucker) [session.c] Bug #1024: Don't check pam_session_is_open if
1711 UseLogin is set as PAM is not used to establish credentials in that
1712 case. Found by Michael Selvesteen, ok djm@
1713
Darren Tuckerd9c88132005-04-19 12:21:21 +1000171420050419
1715 - (dtucker) [INSTALL] Reference README.privsep for the privilege separation
1716 requirements. Pointed out by Bengt Svensson.
Darren Tuckerad1e5e22005-04-19 15:31:49 +10001717 - (dtucker) [INSTALL] Put the s/key text and URL back together.
Darren Tucker8d158c92005-04-19 15:40:51 +10001718 - (dtucker) [INSTALL] Fix s/key text too.
Darren Tuckerd9c88132005-04-19 12:21:21 +10001719
Tim Rice2f97b8b2005-04-11 19:00:18 -0700172020050411
1721 - (tim) [configure.ac] UnixWare needs PASSWD_NEEDS_USERNAME
1722
Darren Tucker9d2562c2005-04-05 19:22:45 +1000172320050405
1724 - (dtucker) [configure.ac] Define HAVE_SO_PEERCRED if we have it. ok djm@
Darren Tucker00cadb82005-04-05 20:58:37 +10001725 - (dtucker) [auth-sia.c] Constify sys_auth_passwd, fixes build error on
1726 Tru64. Patch from cmadams at hiwaay.net.
Darren Tucker0f5eeff2005-04-05 21:00:47 +10001727 - (dtucker) [auth-passwd.c auth-sia.h] Remove duplicate definitions of
1728 sys_auth_passwd, pointed out by cmadams at hiwaay.net.
Darren Tucker9d2562c2005-04-05 19:22:45 +10001729
Damien Miller3dae15c2005-04-03 10:16:11 +1000173020050403
1731 - (djm) OpenBSD CVS Sync
1732 - deraadt@cvs.openbsd.org 2005/03/31 18:39:21
1733 [scp.c]
1734 copy argv[] element instead of smashing the one that ps will see; ok otto
Damien Miller4942de52005-04-03 10:16:39 +10001735 - djm@cvs.openbsd.org 2005/04/02 12:41:16
1736 [scp.c]
1737 since ssh has xstrdup, use it instead of strdup+test. unbreaks -Werror
1738 build
Darren Tucker69152292005-04-03 12:44:23 +10001739 - (dtucker) [monitor.c] Don't free buffers in audit functions, monitor_read
1740 will free as needed. ok tim@ djm@
Damien Miller3dae15c2005-04-03 10:16:11 +10001741
Darren Tucker5ede2ad2005-03-31 21:31:10 +1000174220050331
1743 - (dtucker) OpenBSD CVS Sync
1744 - jmc@cvs.openbsd.org 2005/03/16 11:10:38
1745 [ssh_config.5]
1746 get the syntax right for {Local,Remote}Forward;
1747 based on a diff from markus;
1748 problem report from ponraj;
1749 ok dtucker@ markus@ deraadt@
Darren Tucker1f04ca22005-03-31 21:31:54 +10001750 - markus@cvs.openbsd.org 2005/03/16 21:17:39
1751 [version.h]
1752 4.1
Darren Tucker83d5a982005-03-31 21:33:50 +10001753 - jmc@cvs.openbsd.org 2005/03/18 17:05:00
1754 [sshd_config.5]
1755 typo;
Darren Tuckerf3bb4342005-03-31 21:39:25 +10001756 - (dtucker) [auth.h sshd.c openbsd-compat/port-aix.c] Bug #1006: fix bug in
1757 handling of password expiry messages returned by AIX's authentication
1758 routines, originally reported by robvdwal at sara.nl.
Darren Tucker73ba4372005-03-31 21:51:54 +10001759 - (dtucker) [ssh.c] Prevent null pointer deref in port forwarding debug
1760 message on some platforms. Patch from pete at seebeyond.com via djm.
Darren Tuckerde0de392005-03-31 23:52:04 +10001761 - (dtucker) [monitor.c] Remaining part of fix for bug #1006.
Darren Tucker5ede2ad2005-03-31 21:31:10 +10001762
Darren Tucker6e1defd2005-03-29 23:24:12 +1000176320050329
1764 - (dtucker) [contrib/aix/buildbff.sh] Bug #1005: Look up only the user we're
1765 interested in which is much faster in large (eg LDAP or NIS) environments.
1766 Patch from dleonard at vintela.com.
1767
Darren Tucker86a5f8d2005-03-21 09:55:17 +1100176820050321
1769 - (dtucker) [configure.ac] Prevent configure --with-zlib from adding -Iyes
1770 and -Lyes to CFLAGS and LIBS. Pointed out by peter at slagheap.net,
1771 with & ok tim@
Darren Tucker1df61452005-03-21 09:58:07 +11001772 - (dtucker) [configure.ac] Make configure error out if the user specifies
1773 --with-libedit but the required libs can't be found, rather than silently
1774 ignoring and continuing. ok tim@
Darren Tuckere66519d2005-03-21 22:46:34 +11001775 - (dtucker) [configure.ac openbsd-compat/port-aix.h] Prevent redefinitions
1776 of setauthdb on AIX 5.3, reported by anders.liljegren at its.uu.se.
Darren Tucker86a5f8d2005-03-21 09:55:17 +11001777
Tim Rice12ee8e22005-03-17 13:37:04 -0800177820050317
1779 - (tim) [configure.ac] Bug 998. Make path for --with-opensc optional.
1780 Make --without-opensc work.
Tim Rice8bb561b2005-03-17 16:23:19 -08001781 - (tim) [configure.ac] portability changes on test statements. Some shells
1782 have problems with -a operator.
Tim Rice35cc69d2005-03-17 16:44:25 -08001783 - (tim) [configure.ac] make some configure options a little more error proof.
Tim Riceeae17cc2005-03-17 16:52:20 -08001784 - (tim) [configure.ac] remove trailing white space.
Tim Rice12ee8e22005-03-17 13:37:04 -08001785
Darren Tucker1d55ca72005-03-14 22:58:40 +1100178620050314
1787 - (dtucker) OpenBSD CVS Sync
1788 - dtucker@cvs.openbsd.org 2005/03/10 10:15:02
1789 [readconf.c]
1790 Check listen addresses for null, prevents xfree from dying during
1791 ClearAllForwardings (bz #996). From Craig Leres, ok markus@
Darren Tucker47eede72005-03-14 23:08:12 +11001792 - deraadt@cvs.openbsd.org 2005/03/10 22:01:05
1793 [misc.c ssh-keygen.c servconf.c clientloop.c auth-options.c ssh-add.c
1794 monitor.c sftp-client.c bufaux.h hostfile.c ssh.c sshconnect.c channels.c
1795 readconf.c bufaux.c sftp.c]
1796 spacing
Darren Tucker90b9e022005-03-14 23:08:50 +11001797 - deraadt@cvs.openbsd.org 2005/03/10 22:40:38
1798 [auth-options.c]
1799 spacing
Darren Tucker9f438a92005-03-14 23:09:18 +11001800 - markus@cvs.openbsd.org 2005/03/11 14:59:06
1801 [ssh-keygen.c]
1802 typo, missing \n; mpech
Darren Tucker1adc2bd2005-03-14 23:14:20 +11001803 - jmc@cvs.openbsd.org 2005/03/12 11:55:03
1804 [ssh_config.5]
1805 escape `.' at eol to avoid double spacing issues;
Darren Tuckerda1adbc2005-03-14 23:15:58 +11001806 - dtucker@cvs.openbsd.org 2005/03/14 10:09:03
1807 [ssh-keygen.1]
1808 Correct description of -H (bz #997); ok markus@, punctuation jmc@
Darren Tuckera8f553d2005-03-14 23:17:27 +11001809 - dtucker@cvs.openbsd.org 2005/03/14 11:44:42
1810 [auth.c]
1811 Populate host for log message for logins denied by AllowUsers and
Darren Tuckerc53c3a42005-03-14 23:24:43 +11001812 DenyUsers (bz #999); ok markus@ (patch by tryponraj at gmail.com)
Darren Tucker11327cc2005-03-14 23:22:25 +11001813 - markus@cvs.openbsd.org 2005/03/14 11:46:56
1814 [buffer.c buffer.h channels.c]
1815 limit input buffer size for channels; bugzilla #896; with and ok dtucker@
Tim Ricec3939e22005-03-14 17:24:51 -08001816 - (tim) [contrib/caldera/openssh.spec] links in rc?.d were getting trashed
1817 with a rpm -F
Darren Tucker1d55ca72005-03-14 22:58:40 +11001818
Darren Tuckera21380b2005-03-13 21:20:18 +1100181920050313
1820 - (dtucker) [contrib/cygwin/ssh-host-config] Makes the query for the
1821 localized name of the local administrators group more reliable. From
1822 vinschen at redhat.com.
1823
Darren Tuckerf899e6a2005-03-14 23:02:46 +1100182420050312
1825 - (dtucker) [regress/test-exec.sh] DEBUG can cause problems where debug
1826 output ends up in the client's output, causing regress failures. Found
1827 by Corinna Vinschen.
1828
Darren Tucker50c7db92005-03-09 10:02:55 +1100182920050309
1830 - (dtucker) [regress/test-exec.sh] Set BIN_SH=xpg4 on OSF1/Digital Unix/Tru64
1831 so that regress tests behave. From Chris Adams.
Damien Millerb096ac42005-03-09 11:00:05 +11001832 - (djm) OpenBSD CVS Sync
1833 - jmc@cvs.openbsd.org 2005/03/07 23:41:54
1834 [ssh.1 ssh_config.5]
1835 more macro simplification;
Damien Milleraca86262005-03-09 11:00:42 +11001836 - djm@cvs.openbsd.org 2005/03/08 23:49:48
1837 [version.h]
1838 OpenSSH 4.0
Damien Miller6f632bf2005-03-09 11:02:41 +11001839 - (djm) [contrib/caldera/openssh.spec contrib/redhat/openssh.spec]
1840 [contrib/suse/openssh.spec] Update spec file versions
Darren Tucker835903d2005-03-09 20:12:47 +11001841 - (djm) [log.c] Fix dumb syntax error; ok dtucker@
Damien Milleraa1dba62005-03-09 11:03:08 +11001842 - (djm) Release OpenSSH 4.0p1
Darren Tucker50c7db92005-03-09 10:02:55 +11001843
Darren Tucker0d096692005-03-07 17:34:45 +1100184420050307
1845 - (dtucker) [configure.ac] Disable gettext search when configuring with
1846 BSM audit support for the time being. ok djm@
Darren Tucker1c56ef62005-03-07 17:36:18 +11001847 - (dtucker) OpenBSD CVS Sync (regress/)
1848 - fgsch@cvs.openbsd.org 2004/12/10 01:31:30
Darren Tucker68f72132005-03-07 18:25:53 +11001849 [Makefile sftp-glob.sh]
Darren Tucker1c56ef62005-03-07 17:36:18 +11001850 some globbing regress; prompted and ok djm@
Darren Tuckerb712fcc2005-03-07 18:27:28 +11001851 - david@cvs.openbsd.org 2005/01/14 04:21:18
1852 [Makefile test-exec.sh]
1853 pass the SUDO make variable to the individual sh tests; ok dtucker@ markus@
Darren Tuckera0f3ba72005-03-07 18:33:02 +11001854 - dtucker@cvs.openbsd.org 2005/02/27 11:33:30
1855 [multiplex.sh test-exec.sh sshd-log-wrapper.sh]
1856 Add optional capability to log output from regress commands; ok markus@
1857 Use with: make TEST_SSH_LOGFILE=/tmp/regress.log
Darren Tucker894823e2005-03-07 18:34:04 +11001858 - djm@cvs.openbsd.org 2005/02/27 23:13:36
1859 [login-timeout.sh]
1860 avoid nameservice lookups in regress test; ok dtucker@
Darren Tucker5d909f02005-03-07 18:35:34 +11001861 - djm@cvs.openbsd.org 2005/03/04 08:48:46
1862 [Makefile envpass.sh]
1863 regress test for SendEnv config parsing bug; ok dtucker@
Darren Tucker4b9ac332005-03-07 19:15:06 +11001864 - (dtucker) [regress/test-exec.sh] Put SUDO in the right place.
Tim Ricec390c8d2005-03-07 01:21:37 -08001865 - (tim) [configure.ac] SCO 3.2v4.2 no longer supported.
Darren Tucker0d096692005-03-07 17:34:45 +11001866
Darren Tucker3745e2b2005-03-06 22:31:35 +1100186720050306
1868 - (dtucker) [monitor.c] Bug #125 comment #47: fix errors returned by monitor
1869 when attempting to audit disconnect events. Reported by Phil Dibowitz.
Darren Tucker2b59a6d2005-03-06 22:38:51 +11001870 - (dtucker) [session.c sshd.c] Bug #125 comment #49: Send disconnect audit
1871 events earlier, prevents mm_request_send errors reported by Matt Goebel.
Darren Tucker3745e2b2005-03-06 22:31:35 +11001872
Damien Miller7ffa3672005-03-05 11:20:40 +1100187320050305
1874 - (djm) [contrib/cygwin/README] Improve Cygwin build documentation. Patch
1875 from vinschen at redhat.com
Damien Millerb022b232005-03-05 11:22:36 +11001876 - (djm) OpenBSD CVS Sync
1877 - jmc@cvs.openbsd.org 2005/03/02 11:45:01
1878 [ssh.1]
1879 missing word;
Damien Millerf8e7acc2005-03-05 11:22:50 +11001880 - djm@cvs.openbsd.org 2005/03/04 08:48:06
1881 [readconf.c]
1882 fix SendEnv config parsing bug found by Roumen Petrov; ok dtucker@
Damien Miller7ffa3672005-03-05 11:20:40 +11001883
Damien Miller36bf7dd2005-03-02 12:02:47 +1100188420050302
1885 - (djm) OpenBSD CVS sync:
1886 - jmc@cvs.openbsd.org 2005/03/01 14:47:58
1887 [ssh.1]
1888 remove some unneccesary macros;
1889 do not mark up punctuation;
Damien Millerf8c55462005-03-02 12:03:05 +11001890 - jmc@cvs.openbsd.org 2005/03/01 14:55:23
1891 [ssh_config.5]
1892 do not mark up punctuation;
1893 whitespace;
Damien Miller718fd4b2005-03-02 12:03:23 +11001894 - jmc@cvs.openbsd.org 2005/03/01 14:59:49
1895 [sshd.8]
1896 new sentence, new line;
1897 whitespace;
Damien Miller4c9c6fd2005-03-02 12:03:43 +11001898 - jmc@cvs.openbsd.org 2005/03/01 15:05:00
1899 [ssh-keygen.1]
1900 whitespace;
Damien Miller9a2fdbd2005-03-02 12:04:01 +11001901 - jmc@cvs.openbsd.org 2005/03/01 15:47:14
1902 [ssh-keyscan.1 ssh-keyscan.c]
1903 sort options and sync usage();
Damien Miller27e9c512005-03-02 12:04:16 +11001904 - jmc@cvs.openbsd.org 2005/03/01 17:19:35
1905 [scp.1 sftp.1]
1906 add HashKnownHosts to -o list;
1907 ok markus@
Damien Miller02faece2005-03-02 12:04:32 +11001908 - jmc@cvs.openbsd.org 2005/03/01 17:22:06
1909 [ssh.c]
1910 sync usage() w/ man SYNOPSIS;
1911 ok markus@
Damien Miller792c0172005-03-02 12:04:50 +11001912 - jmc@cvs.openbsd.org 2005/03/01 17:32:19
1913 [ssh-add.1]
1914 sort options;
Damien Miller265d3092005-03-02 12:05:06 +11001915 - jmc@cvs.openbsd.org 2005/03/01 18:15:56
1916 [ssh-keygen.1]
1917 sort options (no attempt made at synopsis clean up though);
1918 spelling (occurance -> occurrence);
1919 use prompt before examples;
1920 grammar;
Damien Miller1227d4c2005-03-02 12:06:51 +11001921 - djm@cvs.openbsd.org 2005/03/02 01:00:06
1922 [sshconnect.c]
1923 fix addition of new hashed hostnames when CheckHostIP=yes;
1924 found and ok dtucker@
Damien Miller89eac802005-03-02 12:33:04 +11001925 - djm@cvs.openbsd.org 2005/03/02 01:27:41
1926 [ssh-keygen.c]
1927 ignore hostnames with metachars when hashing; ok deraadt@
Damien Miller947219e2005-03-02 13:22:30 +11001928 - djm@cvs.openbsd.org 2005/03/02 02:21:07
1929 [ssh.1]
1930 bz#987: mention ForwardX11Trusted in ssh.1,
1931 reported by andrew.benham AT thus.net; ok deraadt@
Tim Ricef8f30162005-03-02 21:49:56 -08001932 - (tim) [regress/agent-ptrace.sh] add another possible gdb error.
Damien Miller36bf7dd2005-03-02 12:02:47 +11001933
Damien Miller3eb48b62005-03-01 21:15:46 +1100193420050301
1935 - (djm) OpenBSD CVS sync:
1936 - otto@cvs.openbsd.org 2005/02/16 09:56:44
1937 [ssh.c]
1938 Better diagnostic if an identity file is not accesible. ok markus@ djm@
Damien Miller9b8073e2005-03-01 21:16:18 +11001939 - djm@cvs.openbsd.org 2005/02/18 03:05:53
1940 [canohost.c]
1941 better error messages for getnameinfo failures; ok dtucker@
Damien Miller64e8d442005-03-01 21:16:47 +11001942 - djm@cvs.openbsd.org 2005/02/20 22:59:06
1943 [sftp.c]
1944 turn on ssh batch mode when in sftp batch mode, patch from
1945 jdmossh AT nand.net;
1946 ok markus@
Damien Miller70a908e2005-03-01 21:17:09 +11001947 - jmc@cvs.openbsd.org 2005/02/25 10:55:13
1948 [sshd.8]
1949 add /etc/motd and $HOME/.hushlogin to FILES;
1950 from michael knudsen;
Damien Miller1717fd42005-03-01 21:17:31 +11001951 - djm@cvs.openbsd.org 2005/02/28 00:54:10
1952 [ssh_config.5]
1953 bz#849: document timeout on untrusted x11 forwarding sessions. Reported by
1954 orion AT cora.nwra.com; ok markus@
Damien Millerf91ee4c2005-03-01 21:24:33 +11001955 - djm@cvs.openbsd.org 2005/03/01 10:09:52
1956 [auth-options.c channels.c channels.h clientloop.c compat.c compat.h]
1957 [misc.c misc.h readconf.c readconf.h servconf.c ssh.1 ssh.c ssh_config.5]
1958 [sshd_config.5]
1959 bz#413: allow optional specification of bind address for port forwardings.
1960 Patch originally by Dan Astorian, but worked on by several people
1961 Adds GatewayPorts=clientspecified option on server to allow remote
1962 forwards to bind to client-specified ports.
Damien Millere1776152005-03-01 21:47:37 +11001963 - djm@cvs.openbsd.org 2005/03/01 10:40:27
1964 [hostfile.c hostfile.h readconf.c readconf.h ssh.1 ssh_config.5]
1965 [sshconnect.c sshd.8]
1966 add support for hashing host names and addresses added to known_hosts
1967 files, to improve privacy of which hosts user have been visiting; ok
1968 markus@ deraadt@
Damien Millerdb7b8172005-03-01 21:48:03 +11001969 - djm@cvs.openbsd.org 2005/03/01 10:41:28
1970 [ssh-keyscan.1 ssh-keyscan.c]
1971 option to hash hostnames output by ssh-keyscan; ok markus@ deraadt@
Damien Miller4b42d7f2005-03-01 21:48:35 +11001972 - djm@cvs.openbsd.org 2005/03/01 10:42:49
1973 [ssh-keygen.1 ssh-keygen.c ssh_config.5]
1974 add tools for managing known_hosts files with hashed hostnames, including
1975 hashing existing files and deleting hosts by name; ok markus@ deraadt@
Damien Miller3eb48b62005-03-01 21:15:46 +11001976
Darren Tucker34233832005-02-26 10:04:28 +1100197720050226
1978 - (dtucker) [openbsd-compat/bsd-openpty.c openbsd-compat/inet_ntop.c]
1979 Remove two obsolete Cygwin #ifdefs. Patch from vinschen at redhat.com.
Darren Tucker38049032005-02-26 10:07:37 +11001980 - (dtucker) [acconfig.h configure.ac openbsd-compat/bsd-misc.{c,h}]
1981 Remove SETGROUPS_NOOP, was only used by Cygwin, which doesn't need it any
1982 more. Patch from vinschen at redhat.com.
Darren Tuckerdc8fc622005-02-26 10:12:38 +11001983 - (dtucker) [Makefile.in] Add a install-nosysconf target for installing the
1984 binaries without the config files. Primarily useful for packaging.
1985 Patch from phil at usc.edu. ok djm@
Darren Tucker34233832005-02-26 10:04:28 +11001986
198720050224
Damien Miller848b9932005-02-24 12:12:34 +11001988 - (djm) [configure.ac] in_addr_t test needs sys/types.h too
1989
199020050222
Darren Tucker2ea9b182005-02-22 17:57:13 +11001991 - (dtucker) [uidswap.c] Skip uid restore test on Cygwin. Patch from
1992 vinschen at redhat.com.
1993
Darren Tuckerd9f88912005-02-20 21:01:48 +1100199420050220
1995 - (dtucker) [LICENCE Makefile.in README.platform audit-bsm.c configure.ac
1996 defines.h] Bug #125: Add *EXPERIMENTAL* BSM audit support. Configure
1997 --with-audit=bsm to enable. Patch originally from Sun Microsystems,
1998 parts by John R. Jackson. ok djm@
Darren Tucker04cfbe02005-02-20 23:27:11 +11001999 - (dtucker) [configure.ac] Missing comma in AIX section, somehow causes
2000 unrelated platforms to be configured incorrectly.
Darren Tuckerd9f88912005-02-20 21:01:48 +11002001
Damien Millered462d92005-02-16 13:02:45 +1100200220050216
2003 - (djm) write seed to temporary file and atomically rename into place;
2004 ok dtucker@
Darren Tucker7b48d252005-02-16 13:20:07 +11002005 - (dtucker) [ssh-rand-helper.c] Provide seed_rng since it may be called
2006 via mkstemp in some configurations. ok djm@
Darren Tuckera91f5ee2005-02-16 14:20:06 +11002007 - (dtucker) [auth-shadow.c] Prevent compiler warnings if "DAY" is defined
2008 by the system headers.
Darren Tuckerca6e7a72005-02-16 16:19:17 +11002009 - (dtucker) [configure.ac] Bug #893: check for libresolv early on Reliant
2010 Unix; prevents problems relating to the location of -lresolv in the
2011 link order.
Darren Tuckerc97b01a2005-02-16 16:47:37 +11002012 - (dtucker) [session.c] Bug #918: store credentials from gssapi-with-mic
2013 authentication early enough to be available to PAM session modules when
2014 privsep=yes. Patch from deengert at anl.gov, ok'ed in principle by Sam
2015 Hartman and similar to Debian's ssh-krb5 package.
Darren Tucker3c774c52005-02-16 22:49:31 +11002016 - (dtucker) [configure.ac openbsd-compat/port-aix.{c,h}] Silence some more
2017 compiler warnings on AIX.
Damien Millered462d92005-02-16 13:02:45 +11002018
Darren Tuckerf04c3612005-02-15 21:26:32 +1100201920050215
2020 - (dtucker) [config.sh.in] Collect oslevel -r too.
Darren Tucker691d5232005-02-15 21:45:57 +11002021 - (dtucker) [README.platform auth.c configure.ac loginrec.c
2022 openbsd-compat/port-aix.c openbsd-compat/port-aix.h] Bug #835: enable IPv6
2023 on AIX where possible (see README.platform for details) and work around
2024 a misfeature of AIX's getnameinfo. ok djm@
Darren Tuckera39f83e2005-02-15 22:19:28 +11002025 - (dtucker) [loginrec.c] Add missing #include.
Darren Tuckerf04c3612005-02-15 21:26:32 +11002026
Darren Tucker1b6f2292005-02-11 16:11:49 +1100202720050211
2028 - (dtucker) [configure.ac] Tidy up configure --help output.
Darren Tucker15af68f2005-02-11 18:32:13 +11002029 - (dtucker) [openbsd-compat/fake-rfc2553.h] We now need EAI_SYSTEM too.
Darren Tucker1b6f2292005-02-11 16:11:49 +11002030
Darren Tucker2f9573d2005-02-10 22:28:54 +1100203120050210
2032 - (dtucker) [configure.ac] Bug #919: Provide visible feedback for the
2033 --disable-etc-default-login configure option.
2034
Darren Tucker3f166df2005-02-09 09:46:47 +1100203520050209
2036 - (dtucker) OpenBSD CVS Sync
2037 - dtucker@cvs.openbsd.org 2005/01/28 09:45:53
2038 [ssh_config]
2039 Make it clear that the example entries in ssh_config are only some of the
2040 commonly-used options and refer the user to ssh_config(5) for more
2041 details; ok djm@
Darren Tucker79a7acf2005-02-09 09:48:57 +11002042 - jmc@cvs.openbsd.org 2005/01/28 15:05:43
2043 [ssh_config.5]
2044 grammar;
Darren Tucker43d8e282005-02-09 09:51:08 +11002045 - jmc@cvs.openbsd.org 2005/01/28 18:14:09
2046 [ssh_config.5]
2047 wording;
2048 ok markus@
Darren Tucker5b530262005-02-09 09:52:17 +11002049 - dtucker@cvs.openbsd.org 2005/01/30 11:18:08
2050 [monitor.c]
2051 Make code match intent; ok djm@
Darren Tucker96d47102005-02-09 09:53:48 +11002052 - dtucker@cvs.openbsd.org 2005/02/08 22:24:57
2053 [sshd.c]
2054 Provide reason in error message if getnameinfo fails; ok markus@
Darren Tucker92170a82005-02-09 17:08:23 +11002055 - (dtucker) [auth-passwd.c openbsd-compat/port-aix.c] Don't call
2056 disable_forwarding() from compat library. Prevent linker errrors trying
2057 to resolve it for binaries other than sshd. ok djm@
Darren Tuckerc7e38d52005-02-09 22:12:30 +11002058 - (dtucker) [configure.ac] Bug #854: prepend pwd to relative --with-ssl-dir
2059 paths. ok djm@
Darren Tucker33370e02005-02-09 22:17:28 +11002060 - (dtucker) [configure.ac session.c] Some platforms (eg some SCO) require
2061 the username to be passed to the passwd command when changing expired
2062 passwords. ok djm@
Darren Tucker3f166df2005-02-09 09:46:47 +11002063
Darren Tuckerfeb6f7f2005-02-08 20:17:17 +1100206420050208
2065 - (dtucker) [regress/test-exec.sh] Bug #912: Set _POSIX2_VERSION for the
2066 regress tests so newer versions of GNU head(1) behave themselves. Patch
2067 by djm, so ok me.
Darren Tuckerb4d30122005-02-08 21:06:55 +11002068 - (dtucker) [openbsd-compat/port-aix.c] Silence compiler warnings.
Darren Tucker2e0cf0d2005-02-08 21:52:47 +11002069 - (dtucker) [audit.c audit.h auth.c auth1.c auth2.c loginrec.c monitor.c
2070 monitor_wrap.c monitor_wrap.h session.c sshd.c]: Prepend all of the audit
2071 defines and enums with SSH_ to prevent namespace collisions on some
2072 platforms (eg AIX).
Darren Tuckerfeb6f7f2005-02-08 20:17:17 +11002073
Darren Tucker598ba7b2005-02-04 15:05:08 +1100207420050204
2075 - (dtucker) [monitor.c] Permit INVALID_USER audit events from slave too.
Darren Tucker40d9a632005-02-04 15:19:44 +11002076 - (dtucker) [auth.c] Fix parens in audit log check.
Darren Tucker598ba7b2005-02-04 15:05:08 +11002077
Darren Tuckerad7646a2005-02-02 10:43:59 +1100207820050202
2079 - (dtucker) [configure.ac openbsd-compat/realpath.c] Sync up with realpath
2080 rev 1.11 from OpenBSD and make it use fchdir if available. ok djm@
Darren Tucker42d9dc72005-02-02 17:10:11 +11002081 - (dtucker) [auth.c loginrec.h openbsd-compat/{bsd-cray,port-aix}.{c,h}]
2082 Make record_failed_login() call provide hostname rather than having the
2083 implementations having to do lookups themselves. Only affects AIX and
2084 UNICOS (the latter only uses the "user" parameter anyway). ok djm@
Darren Tucker9dc6c7d2005-02-02 18:30:33 +11002085 - (dtucker) [session.c sshd.c] Bug #445: Propogate KRB5CCNAME if set to child
2086 the process. Since we also unset KRB5CCNAME at startup, if it's set after
2087 authentication it must have been set by the platform's native auth system.
2088 This was already done for AIX; this enables it for the general case.
Darren Tucker2fba9932005-02-02 23:30:24 +11002089 - (dtucker) [auth.c canohost.c canohost.h configure.ac defines.h loginrec.c]
2090 Bug #974: Teach sshd to write failed login records to btmp for failed auth
2091 attempts (currently only for password, kbdint and C/R, only on Linux and
2092 HP-UX), based on code from login.c from util-linux. With ashok_kovai at
2093 hotmail.com, ok djm@
Darren Tucker269a1ea2005-02-03 00:20:53 +11002094 - (dtucker) [Makefile.in auth.c auth.h auth1.c auth2.c loginrec.c monitor.c
2095 monitor.h monitor_wrap.c monitor_wrap.h session.c sshd.c] Bug #125:
2096 (first stage) Add audit instrumentation to sshd, currently disabled by
Darren Tucker6dce9912005-02-03 15:07:37 +11002097 default. with suggestions from and ok djm@
Darren Tuckerad7646a2005-02-02 10:43:59 +11002098
Darren Tucker9b5495d2005-02-01 17:35:09 +1100209920050201
2100 - (dtucker) [log.c] Bug #973: force log_init() to open syslog, since on some
2101 platforms syslog will revert to its default values. This may result in
2102 messages from external libraries (eg libwrap) being sent to a different
2103 facility.
Darren Tucker9dca0992005-02-01 19:16:45 +11002104 - (dtucker) [sshd_config.5] Bug #701: remove warning about
2105 keyboard-interactive since this is no longer the case.
Darren Tucker9b5495d2005-02-01 17:35:09 +11002106
Darren Tucker5c14c732005-01-24 21:55:49 +1100210720050124
2108 - (dtucker) OpenBSD CVS Sync
2109 - otto@cvs.openbsd.org 2005/01/21 08:32:02
2110 [auth-passwd.c sshd.c]
2111 Warn in advance for password and account expiry; initialize loginmsg
2112 buffer earlier and clear it after privsep fork. ok and help dtucker@
2113 markus@
Darren Tucker094cd0b2005-01-24 21:56:48 +11002114 - dtucker@cvs.openbsd.org 2005/01/22 08:17:59
2115 [auth.c]
2116 Log source of connections denied by AllowUsers, DenyUsers, AllowGroups and
2117 DenyGroups. bz #909, ok djm@
Darren Tucker660db782005-01-24 21:57:11 +11002118 - djm@cvs.openbsd.org 2005/01/23 10:18:12
2119 [cipher.c]
2120 config option "Ciphers" should be case-sensitive; ok dtucker@
Darren Tuckerba66df82005-01-24 21:57:40 +11002121 - dtucker@cvs.openbsd.org 2005/01/24 10:22:06
2122 [scp.c sftp.c]
2123 Have scp and sftp wait for the spawned ssh to exit before they exit
2124 themselves. This prevents ssh from being unable to restore terminal
2125 modes (not normally a problem on OpenBSD but common with -Portable
2126 on POSIX platforms). From peak at argo.troja.mff.cuni.cz (bz#950);
2127 ok djm@ markus@
Darren Tucker1b7223c2005-01-24 22:00:40 +11002128 - dtucker@cvs.openbsd.org 2005/01/24 10:29:06
2129 [moduli]
2130 Import new moduli; requested by deraadt@ a week ago
Darren Tucker218f1782005-01-24 22:50:47 +11002131 - dtucker@cvs.openbsd.org 2005/01/24 11:47:13
2132 [auth-passwd.c]
2133 #if -> #ifdef so builds without HAVE_LOGIN_CAP work too; ok djm@ otto@
Darren Tucker5c14c732005-01-24 21:55:49 +11002134
Darren Tucker172a5e82005-01-20 10:55:46 +1100213520050120
2136 - (dtucker) OpenBSD CVS Sync
2137 - markus@cvs.openbsd.org 2004/12/23 17:35:48
2138 [session.c]
2139 check for NULL; from mpech
Darren Tucker7cfeecf2005-01-20 10:56:31 +11002140 - markus@cvs.openbsd.org 2004/12/23 17:38:07
2141 [ssh-keygen.c]
2142 leak; from mpech
Darren Tucker0f383232005-01-20 10:57:56 +11002143 - djm@cvs.openbsd.org 2004/12/23 23:11:00
2144 [servconf.c servconf.h sshd.c sshd_config sshd_config.5]
2145 bz #898: support AddressFamily in sshd_config. from
2146 peak@argo.troja.mff.cuni.cz; ok deraadt@
Darren Tuckerb2161e32005-01-20 11:00:46 +11002147 - markus@cvs.openbsd.org 2005/01/05 08:51:32
2148 [sshconnect.c]
2149 remove dead code, log connect() failures with level error, ok djm@
Darren Tuckerb3509012005-01-20 11:01:46 +11002150 - jmc@cvs.openbsd.org 2005/01/08 00:41:19
2151 [sshd_config.5]
2152 `login'(n) -> `log in'(v);
Darren Tuckerf0e792e2005-01-20 11:02:26 +11002153 - dtucker@cvs.openbsd.org 2005/01/17 03:25:46
2154 [moduli.c]
2155 Correct spelling: SCHNOOR->SCHNORR; ok djm@
Darren Tuckerea7c8122005-01-20 11:03:08 +11002156 - dtucker@cvs.openbsd.org 2005/01/17 22:48:39
2157 [sshd.c]
2158 Make debugging output continue after reexec; ok djm@
Darren Tucker611649e2005-01-20 11:05:34 +11002159 - dtucker@cvs.openbsd.org 2005/01/19 13:11:47
2160 [auth-bsdauth.c auth2-chall.c]
2161 Have keyboard-interactive code call the drivers even for responses for
2162 invalid logins. This allows the drivers themselves to decide how to
2163 handle them and prevent leaking information where possible. Existing
2164 behaviour for bsdauth is maintained by checking authctxt->valid in the
2165 bsdauth driver. Note that any third-party kbdint drivers will now need
2166 to be able to handle responses for invalid logins. ok markus@
Darren Tuckerd2311862005-01-20 13:27:56 +11002167 - djm@cvs.openbsd.org 2004/12/22 02:13:19
2168 [cipher-ctr.c cipher.c]
2169 remove fallback AES support for old OpenSSL, as OpenBSD has had it for
2170 many years now; ok deraadt@
2171 (Id sync only: Portable will continue to support older OpenSSLs)
Darren Tucker36a3d602005-01-20 12:43:38 +11002172 - (dtucker) [auth-pam.c] Bug #971: Prevent leaking information about user
2173 existence via keyboard-interactive/pam, in conjunction with previous
2174 auth2-chall.c change; with Colin Watson and djm.
Darren Tucker33bc3342005-01-20 22:07:29 +11002175 - (dtucker) [loginrec.h] Bug #952: Increase size of username field to 128
2176 bytes to prevent errors from login_init_entry() when the username is
2177 exactly 64 bytes(!) long. From brhamon at cisco.com, ok djm@
Darren Tucker3c660802005-01-20 22:20:50 +11002178 - (dtucker) [auth-chall.c auth.h auth2-chall.c] Bug #936: Remove pam from
2179 the list of available kbdint devices if UsePAM=no. ok djm@
Darren Tucker172a5e82005-01-20 10:55:46 +11002180
218120050118
Darren Tucker72c025d2005-01-18 12:05:18 +11002182 - (dtucker) [INSTALL Makefile.in configure.ac survey.sh.in] Implement
2183 "make survey" and "make send-survey". This will provide data on the
2184 configure parameters, platform and platform features to the development
2185 team, which will allow (among other things) better targetting of testing.
2186 It's entirely voluntary and is off be default. ok djm@
Darren Tucker24c710e2005-01-18 12:45:42 +11002187 - (dtucker) [survey.sh.in] Remove any blank lines from the output of
2188 ccver-v and ccver-V.
Darren Tucker72c025d2005-01-18 12:05:18 +11002189
Darren Tucker8686ed72004-12-20 12:05:08 +1100219020041220
2191 - (dtucker) [ssh-rand-helper.c] Fall back to command-based seeding if reading
2192 from prngd is enabled at compile time but fails at run time, eg because
2193 prngd is not running. Note that if you have prngd running when OpenSSH is
2194 built, OpenSSL will consider itself internally seeded and rand-helper won't
2195 be built at all unless explicitly enabled via --with-rand-helper. ok djm@
Darren Tucker5caa78b2004-12-20 12:35:42 +11002196 - (dtucker) [regress/rekey.sh] Touch datafile before filling with dd, since
2197 on some wacky platforms (eg old AIXes), dd will refuse to create an output
2198 file if it doesn't exist.
Darren Tucker8686ed72004-12-20 12:05:08 +11002199
Darren Tucker442a3832004-12-13 18:08:32 +1100220020041213
2201 - (dtucker) [contrib/findssh.sh] Clean up on interrupt; from
2202 amarendra.godbole at ge com.
2203
Darren Tucker56c95982004-12-11 13:34:56 +1100220420041211
2205 - (dtucker) OpenBSD CVS Sync
2206 - markus@cvs.openbsd.org 2004/12/06 16:00:43
2207 [bufaux.c]
2208 use 0x00 not \0 since buf[] is a bignum
Darren Tucker596dcfa2004-12-11 13:37:22 +11002209 - fgsch@cvs.openbsd.org 2004/12/10 03:10:42
2210 [sftp.c]
2211 - fix globbed ls for paths the same lenght as the globbed path when
2212 we have a unique matching.
2213 - fix globbed ls in case of a directory when we have a unique matching.
2214 - as a side effect, if the path does not exist error (used to silently
2215 ignore).
2216 - don't do extra do_lstat() if we only have one matching file.
2217 djm@ ok
Darren Tuckerf0f90982004-12-11 13:39:50 +11002218 - dtucker@cvs.openbsd.org 2004/12/11 01:48:56
2219 [auth-rsa.c auth2-pubkey.c authfile.c misc.c misc.h]
2220 Fix debug call in error path of authorized_keys processing and fix related
2221 warnings; ok djm@
Darren Tucker56c95982004-12-11 13:34:56 +11002222
Tim Rice0f83d292004-12-08 18:29:58 -0800222320041208
2224 - (tim) [configure.ac] Comment some non obvious platforms in the
2225 target-specific case statement. Suggested and OK by dtucker@
2226
Darren Tucker641b34c2004-12-07 11:26:15 +1100222720041207
2228 - (dtucker) [regress/scp.sh] Use portable-friendly $DIFFOPTs in new test.
2229
Darren Tuckerba2abb32004-12-06 22:40:10 +1100223020041206
2231 - (dtucker) [TODO WARNING.RNG] Update to reflect current reality. ok djm@
Darren Tuckercd516ef2004-12-06 22:43:43 +11002232 - (dtucker) OpenBSD CVS Sync
2233 - markus@cvs.openbsd.org 2004/11/25 22:22:14
2234 [sftp-client.c sftp.c]
2235 leak; from mpech
Darren Tucker0133a722004-12-06 22:44:32 +11002236 - jmc@cvs.openbsd.org 2004/11/29 00:05:17
2237 [sftp.1]
2238 missing full stop;
Darren Tuckere2f189a2004-12-06 22:45:53 +11002239 - djm@cvs.openbsd.org 2004/11/29 07:41:24
2240 [sftp-client.h sftp.c]
2241 Some small fixes from moritz@jodeit.org. ok deraadt@
Darren Tucker16e254d2004-12-06 22:46:45 +11002242 - jaredy@cvs.openbsd.org 2004/12/05 23:55:07
2243 [sftp.1]
2244 - explain that patterns can be used as arguments in get/put/ls/etc
2245 commands (prodded by Michael Knudsen)
2246 - describe ls flags as a list
2247 - other minor improvements
2248 ok jmc, djm
Darren Tucker22cc7412004-12-06 22:47:41 +11002249 - dtucker@cvs.openbsd.org 2004/12/06 11:41:03
2250 [auth-rsa.c auth2-pubkey.c authfile.c misc.c misc.h ssh.h sshd.8]
2251 Discard over-length authorized_keys entries rather than complaining when
2252 they don't decode. bz #884, with & ok djm@
Darren Tuckera3729602004-12-06 23:00:27 +11002253 - (dtucker) OpenBSD CVS Sync (regress/)
2254 - djm@cvs.openbsd.org 2004/06/26 06:16:07
2255 [reexec.sh]
2256 don't change the name of the copied sshd for the reexec fallback test,
2257 makes life simpler for portable
Darren Tuckerccf07792004-12-06 23:03:27 +11002258 - dtucker@cvs.openbsd.org 2004/07/08 12:59:35
2259 [scp.sh]
2260 Regress test for bz #863 (scp double-error), requires $SUDO. ok markus@
Darren Tucker3206e572004-12-06 23:04:57 +11002261 - david@cvs.openbsd.org 2004/07/09 19:45:43
2262 [Makefile]
2263 add a missing CLEANFILES used in the re-exec test
Darren Tucker71b56432004-12-06 23:05:52 +11002264 - djm@cvs.openbsd.org 2004/10/08 02:01:50
2265 [reexec.sh]
2266 shrink and tidy; ok dtucker@
Darren Tucker124f58e2004-12-06 23:07:37 +11002267 - djm@cvs.openbsd.org 2004/10/29 23:59:22
2268 [Makefile added brokenkeys.sh]
2269 regression test for handling of corrupt keys in authorized_keys file
Darren Tucker79ec66e2004-12-06 23:12:15 +11002270 - djm@cvs.openbsd.org 2004/11/07 00:32:41
2271 [multiplex.sh]
2272 regression tests for new multiplex commands
Darren Tuckercc0603d2004-12-06 23:13:50 +11002273 - dtucker@cvs.openbsd.org 2004/11/25 09:39:27
2274 [test-exec.sh]
2275 Remove obsolete RhostsAuthentication from test config; ok markus@
Darren Tuckerd028fea2004-12-06 23:16:29 +11002276 - dtucker@cvs.openbsd.org 2004/12/06 10:49:56
2277 [test-exec.sh]
2278 Check if TEST_SSH_SSHD is a full path to sshd before searching; ok markus@
Darren Tuckerba2abb32004-12-06 22:40:10 +11002279
Darren Tuckere04644c2004-12-03 14:08:45 +1100228020041203
2281 - (dtucker) OpenBSD CVS Sync
2282 - jmc@cvs.openbsd.org 2004/11/07 17:42:36
2283 [ssh.1]
2284 options sort, and whitespace;
Darren Tucker9c6bf322004-12-03 14:10:19 +11002285 - jmc@cvs.openbsd.org 2004/11/07 17:57:30
2286 [ssh.c]
2287 usage():
2288 - add -O
2289 - sync -S w/ manpage
2290 - remove -h
Darren Tuckerc1386672004-12-03 14:33:47 +11002291 - (dtucker) [auth1.c auth2.c] If the user successfully authenticates but is
2292 subsequently denied by the PAM auth stack, send the PAM message to the
2293 user via packet_disconnect (Protocol 1) or userauth_banner (Protocol 2).
2294 ok djm@
Darren Tuckere04644c2004-12-03 14:08:45 +11002295
Darren Tucker2d963d82004-11-07 20:04:10 +1100229620041107
2297 - (dtucker) OpenBSD CVS Sync
2298 - djm@cvs.openbsd.org 2004/11/05 12:19:56
2299 [sftp.c]
2300 command editing and history support via libedit; ok markus@
2301 thanks to hshoexer@ and many testers on tech@ too
Darren Tucker7ebfc102004-11-07 20:06:19 +11002302 - djm@cvs.openbsd.org 2004/11/07 00:01:46
2303 [clientloop.c clientloop.h ssh.1 ssh.c]
2304 add basic control of a running multiplex master connection; including the
2305 ability to check its status and request it to exit; ok markus@
Darren Tucker16bcc1c2004-11-07 20:14:34 +11002306 - (dtucker) [INSTALL Makefile.in configure.ac] Add --with-libedit configure
2307 option and supporting makefile bits and documentation.
Darren Tucker2d963d82004-11-07 20:04:10 +11002308
Darren Tuckerc0161342004-11-05 20:00:03 +1100230920041105
2310 - (dtucker) OpenBSD CVS Sync
2311 - markus@cvs.openbsd.org 2004/08/30 09:18:08
2312 [LICENCE]
2313 s/keygen/keyscan/
Darren Tucker4e4fe002004-11-05 20:01:03 +11002314 - jmc@cvs.openbsd.org 2004/08/30 21:22:49
2315 [ssh-add.1 ssh.1]
2316 .Xsession -> .xsession;
2317 originally from a pr from f at obiit dot org, but missed by myself;
2318 ok markus@ matthieu@
Darren Tucker07336da2004-11-05 20:02:16 +11002319 - djm@cvs.openbsd.org 2004/09/07 23:41:30
2320 [clientloop.c ssh.c]
2321 cleanup multiplex control socket on SIGHUP too, spotted by sturm@
2322 ok markus@ deraadt@
Darren Tuckere9bf9842004-11-05 20:05:32 +11002323 - deraadt@cvs.openbsd.org 2004/09/15 00:46:01
2324 [ssh.c]
2325 /* fallthrough */ is something a programmer understands. But
2326 /* FALLTHROUGH */ is also understood by lint, so that is better.
Darren Tucker7cc5c232004-11-05 20:06:59 +11002327 - jaredy@cvs.openbsd.org 2004/09/15 03:25:41
2328 [sshd_config.5]
2329 mention PrintLastLog only prints last login time for interactive
2330 sessions, like PrintMotd mentions.
2331 From Michael Knudsen, with wording changed slightly to match the
2332 PrintMotd description.
2333 ok djm
Darren Tucker178fa662004-11-05 20:09:09 +11002334 - mickey@cvs.openbsd.org 2004/09/15 18:42:27
2335 [sshd.c]
2336 use less doubles in daemons; markus@ ok
Darren Tuckerf30e1ac2004-11-05 20:10:02 +11002337 - deraadt@cvs.openbsd.org 2004/09/15 18:46:04
2338 [scp.c]
2339 scratch that do { } while (0) wrapper in this case
Darren Tucker39207a42004-11-05 20:19:51 +11002340 - djm@cvs.openbsd.org 2004/09/23 13:00:04
2341 [ssh.c]
2342 correctly honour -n in multiplex client mode; spotted by sturm@ ok markus@
Darren Tucker3269b132004-11-05 20:20:59 +11002343 - djm@cvs.openbsd.org 2004/09/25 03:45:14
2344 [sshd.c]
2345 these printf args are no longer double; ok deraadt@ markus@
Darren Tucker636ca902004-11-05 20:22:00 +11002346 - djm@cvs.openbsd.org 2004/10/07 10:10:24
2347 [scp.1 sftp.1 ssh.1 ssh_config.5]
2348 document KbdInteractiveDevices; ok markus@
Darren Tucker1dee8682004-11-05 20:26:49 +11002349 - djm@cvs.openbsd.org 2004/10/07 10:12:36
2350 [ssh-agent.c]
2351 don't unlink agent socket when bind() fails, spotted by rich AT
2352 rich-paul.net, ok markus@
Darren Tuckerb2694f02004-11-05 20:27:54 +11002353 - markus@cvs.openbsd.org 2004/10/20 11:48:53
2354 [packet.c ssh1.h]
2355 disconnect for invalid (out of range) message types.
Darren Tucker5d78de62004-11-05 20:35:44 +11002356 - djm@cvs.openbsd.org 2004/10/29 21:47:15
2357 [channels.c channels.h clientloop.c]
2358 fix some window size change bugs for multiplexed connections: windows sizes
2359 were not being updated if they had changed after ~^Z suspends and SIGWINCH
2360 was not being processed unless the first connection had requested a tty;
2361 ok markus
Darren Tuckerce327b62004-11-05 20:38:03 +11002362 - djm@cvs.openbsd.org 2004/10/29 22:53:56
2363 [clientloop.c misc.h readpass.c ssh-agent.c]
2364 factor out common permission-asking code to separate function; ok markus@
Darren Tucker50dbe832004-11-05 20:41:24 +11002365 - djm@cvs.openbsd.org 2004/10/29 23:56:17
2366 [bufaux.c bufaux.h buffer.c buffer.h]
2367 introduce a new buffer API that returns an error rather than fatal()ing
2368 when presented with bad data; ok markus@
Darren Tucker08d04fa2004-11-05 20:42:28 +11002369 - djm@cvs.openbsd.org 2004/10/29 23:57:05
2370 [key.c]
2371 use new buffer API to avoid fatal errors on corrupt keys in authorized_keys
2372 files; ok markus@
Darren Tuckerc0161342004-11-05 20:00:03 +11002373
Darren Tuckera56f1912004-11-02 20:30:54 +1100237420041102
2375 - (dtucker) [configure.ac includes.h] Bug #947: Fix compile error on HP-UX
2376 10.x by testing for conflicts in shadow.h and undef'ing _INCLUDE__STDC__
2377 only if a conflict is detected.
2378
Darren Tucker35beadd2004-10-19 16:33:33 +1000237920041019
2380 - (dtucker) [uidswap.c] Don't test dropping of gids for the root user or
2381 on Cygwin. Cygwin parts from vinschen at redhat com; ok djm@
2382
Damien Millerdaffc6a2004-10-16 18:52:44 +1000238320041016
Damien Miller0e035d82004-10-16 18:53:28 +10002384 - (djm) [auth-pam.c] snprintf->strl*, fix server message length calculations;
2385 ok dtucker@
Damien Millerdaffc6a2004-10-16 18:52:44 +10002386
Darren Tuckerb7d55e32004-10-06 20:09:32 +1000238720041006
2388 - (dtucker) [README.privsep] Bug #939: update info about HP-UX Trusted Mode
2389 and other PAM platforms.
Darren Tuckerdbc22962004-10-06 23:15:44 +10002390 - (dtucker) [monitor_mm.c openbsd-compat/xmmap.c] Bug #940: cast constants
2391 to void * to appease picky compilers (eg Tru64's "cc -std1").
Darren Tuckerb7d55e32004-10-06 20:09:32 +10002392
Darren Tucker59f79c42004-09-30 21:17:08 +1000239320040930
2394 - (dtucker) [configure.ac] Set AC_PACKAGE_NAME. ok djm@
2395
Darren Tucker4127f552004-09-23 21:35:09 +1000239620040923
2397 - (dtucker) [openbsd-compat/bsd-snprintf.c] Previous change was off by one,
2398 which could have caused the justification to be wrong. ok djm@
2399
Darren Tucker50fbb452004-09-21 21:32:12 +1000240020040921
2401 - (dtucker) [openbsd-compat/bsd-snprintf.c] Check for max length too.
2402 ok djm@
Darren Tucker5d596132004-09-21 21:35:55 +10002403 - (dtucker) [contrib/cygwin/ssh-host-config] Update to match current Cygwin
2404 install process. Patch from vinschen at redhat.com.
Darren Tucker50fbb452004-09-21 21:32:12 +10002405
Damien Miller8899ed32004-09-12 15:18:55 +1000240620040912
2407 - (djm) [loginrec.c] Start KNF and tidy up of this long-neglected file.
2408 No change in resultant binary
Damien Miller6b0279c2004-09-12 15:25:17 +10002409 - (djm) [loginrec.c] __func__ifiy
Damien Millerb0aae332004-09-12 15:26:00 +10002410 - (djm) [loginrec.c] xmalloc
Damien Miller2aa6d3c2004-09-12 16:53:04 +10002411 - (djm) [ssh.c sshd.c version.h] Don't divulge portable version in protocol
2412 banner. Suggested by deraadt@, ok mouring@, dtucker@
Darren Tucker623d92f2004-09-12 22:36:15 +10002413 - (dtucker) [configure.ac] Fix incorrect quoting and tests for cross-compile.
2414 Partly by & ok djm@.
Damien Miller8899ed32004-09-12 15:18:55 +10002415
Damien Miller928a19a2004-09-11 15:18:05 +1000241620040911
2417 - (djm) [ssh-agent.c] unifdef some cygwin code; ok dtucker@
Darren Tucker69687f42004-09-11 22:17:26 +10002418 - (dtucker) [auth-pam.c auth-pam.h session.c] Bug #890: Send output from
2419 failing PAM session modules to user then exit, similar to the way
2420 /etc/nologin is handled. ok djm@
Darren Tucker0a7e3c62004-09-11 22:28:01 +10002421 - (dtucker) [auth-pam.c] Relocate sshpam_store_conv(), no code change.
Damien Miller47656792004-09-11 22:42:09 +10002422 - (djm) [auth2-kbdint.c auth2-none.c auth2-passwd.c auth2-pubkey.c]
2423 Make cygwin code more consistent with that which surrounds it
Darren Tucker77fc29e2004-09-11 23:07:03 +10002424 - (dtucker) [auth-pam.c auth.h auth2-none.c auth2.c monitor.c monitor_wrap.c]
2425 Bug #892: Send messages from failing PAM account modules to the client via
2426 SSH2_MSG_USERAUTH_BANNER messages. Note that this will not happen with
2427 SSH2 kbdint authentication, which need to be dealt with separately. ok djm@
Darren Tuckera2a3ed02004-09-11 23:09:53 +10002428 - (dtucker) [session.c] Bug #927: make .hushlogin silent again. ok djm@
Darren Tuckera0c2b392004-09-11 23:26:37 +10002429 - (dtucker) [configure.ac] Bug #321: Add cross-compile support to configure.
2430 Parts by chua at ayrnetworks.com, astrand at lysator.liu.se and me. ok djm@
Darren Tucker5614d8f2004-09-11 23:32:09 +10002431 - (dtucker) [auth-krb5.c] Bug #922: Pass KRB5CCNAME to PAM. From deengert
2432 at anl.gov, ok djm@
Damien Miller928a19a2004-09-11 15:18:05 +10002433
Darren Tucker14c372d2004-08-30 20:42:08 +1000243420040830
2435 - (dtucker) [session.c openbsd-compat/bsd-cygwin_util.{c,h}] Bug #915: only
2436 copy required environment variables on Cygwin. Patch from vinschen at
2437 redhat.com, ok djm@
Darren Tucker476b7ec2004-08-30 21:13:49 +10002438 - (dtucker) [regress/Makefile] Clean scp-ssh-wrapper.scp too. Patch from
2439 vinschen at redhat.com.
Darren Tucker25a12342004-08-30 21:33:02 +10002440 - (dtucker) [Makefile.in contrib/ssh-copy-id] Bug #894: Improve portability
2441 of shell constructs. Patch from cjwatson at debian.org.
Darren Tucker14c372d2004-08-30 20:42:08 +10002442
Darren Tuckerf00e51d2004-08-29 16:12:29 +1000244320040829
2444 - (dtucker) [openbsd-compat/getrrsetbyname.c] Prevent getrrsetbyname from
2445 failing with NOMEMORY if no sigs are returned and malloc(0) returns NULL.
2446 From Martin.Kraemer at Fujitsu-Siemens.com; ok djm@
Darren Tuckerf4b43712004-08-29 16:28:39 +10002447 - (dtucker) OpenBSD CVS Sync
2448 - djm@cvs.openbsd.org 2004/08/23 11:48:09
2449 [authfile.c]
2450 fix error path, spotted by Martin.Kraemer AT Fujitsu-Siemens.com; ok markus
Darren Tuckere6ed8392004-08-29 16:29:44 +10002451 - djm@cvs.openbsd.org 2004/08/23 11:48:47
2452 [channels.c]
2453 typo, spotted by Martin.Kraemer AT Fujitsu-Siemens.com; ok markus
Darren Tucker27a8f6b2004-08-29 16:31:28 +10002454 - dtucker@cvs.openbsd.org 2004/08/23 14:26:38
2455 [ssh-keysign.c ssh.c]
2456 Use permanently_set_uid() in ssh and ssh-keysign for consistency, matches
2457 change in Portable; ok markus@ (CVS ID sync only)
Darren Tucker34620d62004-08-29 16:32:59 +10002458 - dtucker@cvs.openbsd.org 2004/08/23 14:29:23
2459 [ssh-keysign.c]
2460 Remove duplicate getuid(), suggested by & ok markus@
Darren Tuckerdb693902004-08-29 16:37:24 +10002461 - markus@cvs.openbsd.org 2004/08/26 16:00:55
2462 [ssh.1 sshd.8]
2463 get rid of references to rhosts authentication; with jmc@
Darren Tucker0f56ed12004-08-29 16:38:41 +10002464 - djm@cvs.openbsd.org 2004/08/28 01:01:48
2465 [sshd.c]
2466 don't erroneously close stdin for !reexec case, from Dave Johnson;
2467 ok markus@
Darren Tucker48d99d32004-08-29 17:04:50 +10002468 - (dtucker) [configure.ac] Include sys/stream.h in sys/ptms.h header check,
2469 fixes configure warning on Solaris reported by wknox at mitre.org.
Darren Tucker2a81adc2004-08-29 17:09:34 +10002470 - (dtucker) [regress/multiplex.sh] Skip test on platforms that do not
2471 support FD passing since multiplex requires it. Noted by tim@
Darren Tucker07d30e42004-08-29 17:14:31 +10002472 - (dtucker) [regress/dynamic-forward.sh] Allow time for connections to be torn
2473 down, needed on some platforms, should be harmless on others. Patch from
2474 jason at devrandom.org.
Darren Tucker0521dcb2004-08-29 19:39:09 +10002475 - (dtucker) [regress/scp.sh] Make this work on Cygwin too, which doesn't like
2476 files ending in .exe that aren't binaries; patch from vinschen at redhat.com.
Darren Tucker2a502ff2004-08-29 19:52:32 +10002477 - (dtucker) [Makefile.in] Get regress/Makefile symlink right for out-of-tree
2478 builds too, from vinschen at redhat.com.
Darren Tuckerb17035f2004-08-29 20:33:07 +10002479 - (dtucker) [regress/agent-ptrace.sh] Skip ptrace test on OSF1/DUnix/Tru64
2480 too; patch from cmadams at hiwaay.net.
Darren Tuckercf59d312004-08-29 21:18:09 +10002481 - (dtucker) [configure.ac] Replace non-portable echo \n with extra echo.
Darren Tucker5a88d002004-08-29 21:43:33 +10002482 - (dtucker) [openbsd-compat/port-aix.c] Bug #712: Explicitly check for
2483 accounts with authentication configs that sshd can't support (ie
2484 SYSTEM=NONE and AUTH1=something).
Darren Tuckerf00e51d2004-08-29 16:12:29 +10002485
Darren Tuckerf0c2aea2004-08-28 15:46:57 +1000248620040828
Darren Tucker11bdc012004-08-28 16:17:35 +10002487 - (dtucker) [openbsd-compat/mktemp.c] Remove superfluous Cygwin #ifdef; from
2488 vinschen at redhat.com.
Darren Tuckerf0c2aea2004-08-28 15:46:57 +10002489
Damien Miller7daf0442004-08-23 21:52:08 +1000249020040823
2491 - (djm) [ssh-rand-helper.c] Typo. Found by
2492 Martin.Kraemer AT Fujitsu-Siemens.com
Damien Millerb0419f22004-08-23 21:53:28 +10002493 - (djm) [loginrec.c] Typo and bad args in error messages; Spotted by
2494 Martin.Kraemer AT Fujitsu-Siemens.com
Damien Miller7daf0442004-08-23 21:52:08 +10002495
Darren Tuckerbad5f2d2004-08-17 22:31:32 +1000249620040817
2497 - (dtucker) [regress/README.regress] Note compatibility issues with GNU head.
Damien Miller87c9cca2004-08-17 22:47:41 +10002498 - (djm) OpenBSD CVS Sync
2499 - markus@cvs.openbsd.org 2004/08/16 08:17:01
2500 [version.h]
2501 3.9
Damien Millerd5452852004-08-17 22:49:12 +10002502 - (djm) Crank RPM spec version numbers
Damien Millere17cc752004-08-17 22:50:40 +10002503 - (djm) Release 3.9p1
Darren Tuckerbad5f2d2004-08-17 22:31:32 +10002504
Darren Tucker21dd0892004-08-16 23:12:05 +1000250520040816
2506 - (dtucker) [acconfig.h auth-pam.c configure.ac] Set real uid to non-root
2507 to convince Solaris PAM to honour password complexity rules. ok djm@
2508
Darren Tucker25f60a72004-08-15 17:23:34 +1000250920040815
2510 - (dtucker) [Makefile.in ssh-keysign.c ssh.c] Use permanently_set_uid() since
2511 it does the right thing on all platforms. ok djm@
Damien Miller36f49652004-08-15 18:40:59 +10002512 - (djm) [acconfig.h configure.ac openbsd-compat/Makefile.in
2513 openbsd-compat/bsd-closefrom.c openbsd-compat/bsd-misc.c
2514 openbsd-compat/bsd-misc.h openbsd-compat/openbsd-compat.h] Use smarter
2515 closefrom() replacement from sudo; ok dtucker@
Damien Miller81409592004-08-15 19:12:52 +10002516 - (djm) [loginrec.c] Check that seek succeeded here too; ok dtucker
Darren Tucker0cbc3c62004-08-15 21:01:37 +10002517 - (dtucker) [Makefile.in] Fix typo.
Darren Tucker25f60a72004-08-15 17:23:34 +10002518
Darren Tucker06696932004-08-14 23:55:37 +1000251920040814
2520 - (dtucker) [auth-krb5.c gss-serv-krb5.c openbsd-compat/xmmap.c]
2521 Explicitly set umask for mkstemp; ok djm@
Darren Tucker3d50c9b2004-08-15 00:01:48 +10002522 - (dtucker) [includes.h] Undef _INCLUDE__STDC__ on HP-UX, otherwise
2523 prot.h and shadow.h provide conflicting declarations of getspnam. ok djm@
Darren Tucker397a2f22004-08-15 00:09:11 +10002524 - (dtucker) [loginrec.c openbsd-compat/port-aix.c openbsd-compat/port-aix.h]
2525 Plug AIX login recording into login_write so logins will be recorded for
2526 all auth types.
Darren Tucker06696932004-08-14 23:55:37 +10002527
Darren Tucker03669a32004-08-13 18:37:21 +1000252820040813
2529 - (dtucker) [openbsd-compat/bsd-misc.c] Typo in #ifdef; from vinschen at
2530 redhat.com
Darren Tuckerc7a6fc42004-08-13 21:18:00 +10002531- (dtucker) OpenBSD CVS Sync
2532 - avsm@cvs.openbsd.org 2004/08/11 21:43:05
2533 [channels.c channels.h clientloop.c misc.c misc.h serverloop.c ssh-agent.c]
2534 some signed/unsigned int comparison cleanups; markus@ ok
Darren Tuckerfe6649d2004-08-13 21:19:37 +10002535 - avsm@cvs.openbsd.org 2004/08/11 21:44:32
2536 [authfd.c scp.c ssh-keyscan.c]
2537 use atomicio instead of homegrown equivalents or read/write.
2538 markus@ ok
Darren Tuckerbcf27972004-08-13 21:21:47 +10002539 - djm@cvs.openbsd.org 2004/08/12 09:18:24
2540 [sshlogin.c]
2541 typo in error message, spotted by moritz AT jodeit.org (Id sync only)
Darren Tucker0b42e6d2004-08-13 21:22:40 +10002542 - jakob@cvs.openbsd.org 2004/08/12 21:41:13
2543 [ssh-keygen.1 ssh.1]
2544 improve SSHFP documentation; ok deraadt@
Darren Tucker6e370372004-08-13 21:23:25 +10002545 - jmc@cvs.openbsd.org 2004/08/13 00:01:43
2546 [ssh-keygen.1]
2547 kill whitespace at eol;
Darren Tucker1ef0bc02004-08-13 21:29:02 +10002548 - djm@cvs.openbsd.org 2004/08/13 02:51:48
2549 [monitor_fdpass.c]
2550 extra check for no message case; ok markus, deraadt, hshoexer, henning
Darren Tucker137e9c92004-08-13 21:30:24 +10002551 - dtucker@cvs.openbsd.org 2004/08/13 11:09:24
2552 [servconf.c]
2553 Fix line numbers off-by-one in error messages, from tortay at cc.in2p3.fr
2554 ok markus@, djm@
Darren Tucker03669a32004-08-13 18:37:21 +10002555
Darren Tucker8ae66a52004-08-12 22:16:55 +1000255620040812
2557 - (dtucker) [sshd.c] Remove duplicate variable imported during sync.
Darren Tucker6832b832004-08-12 22:36:51 +10002558 - (dtucker) OpenBSD CVS Sync
2559 - markus@cvs.openbsd.org 2004/07/28 08:56:22
2560 [sshd.c]
2561 call setsid() _before_ re-exec
Darren Tucker5cb30ad2004-08-12 22:40:24 +10002562 - markus@cvs.openbsd.org 2004/07/28 09:40:29
2563 [auth.c auth1.c auth2.c cipher.c cipher.h key.c session.c ssh.c
2564 sshconnect1.c]
2565 more s/illegal/invalid/
Darren Tucker9a2bd112004-08-12 22:40:59 +10002566 - djm@cvs.openbsd.org 2004/08/04 10:37:52
2567 [dh.c]
2568 return group14 when no primes found - fixes hang on empty /etc/moduli;
2569 ok markus@
Darren Tucker9fbac712004-08-12 22:41:44 +10002570 - dtucker@cvs.openbsd.org 2004/08/11 11:09:54
2571 [servconf.c]
2572 Fix minor leak; "looks right" deraadt@
Darren Tuckerd8835932004-08-12 22:42:29 +10002573 - dtucker@cvs.openbsd.org 2004/08/11 11:50:09
2574 [sshd.c]
2575 Don't try to close startup_pipe if it's not open; ok djm@
Darren Tucker9c5049a2004-08-12 22:49:00 +10002576 - djm@cvs.openbsd.org 2004/08/11 11:59:22
2577 [sshlogin.c]
2578 check that lseek went were we told it to; ok markus@
2579 (Id sync only, but similar changes are needed in loginrec.c)
Darren Tucker133b7572004-08-12 22:50:03 +10002580 - djm@cvs.openbsd.org 2004/08/11 12:01:16
2581 [sshlogin.c]
2582 make store_lastlog_message() static to appease -Wall; ok markus
Darren Tuckereb578622004-08-12 23:08:14 +10002583 - (dtucker) [sshd.c] Clear loginmsg in postauth monitor, prevents doubling
2584 messages generated before the postauth privsep split.
Darren Tucker8ae66a52004-08-12 22:16:55 +10002585
Damien Millerb5a21442004-07-21 20:44:05 +1000258620040720
Damien Millera22f2d72004-07-21 20:48:24 +10002587 - (djm) OpenBSD CVS Sync
2588 - markus@cvs.openbsd.org 2004/07/21 08:56:12
2589 [auth.c]
2590 s/Illegal user/Invalid user/; many requests; ok djm, millert, niklas,
2591 miod, ...
Damien Miller30d1f842004-07-21 20:48:53 +10002592 - djm@cvs.openbsd.org 2004/07/21 10:33:31
2593 [auth1.c auth2.c]
2594 bz#899: Don't display invalid usernames in setproctitle
Damien Miller10a445b2004-07-21 20:49:39 +10002595 from peak AT argo.troja.mff.cuni.cz; ok markus@
2596 - djm@cvs.openbsd.org 2004/07/21 10:36:23
2597 [gss-serv-krb5.c]
2598 fix function declaration
Damien Miller0670c732004-07-21 21:53:34 +10002599 - djm@cvs.openbsd.org 2004/07/21 11:51:29
2600 [canohost.c]
2601 bz#902: cache remote port so we don't fatal() in auth_log when remote
2602 connection goes away quickly. from peak AT argo.troja.mff.cuni.cz;
2603 ok markus@
Damien Miller2d2ed3d2004-07-21 20:54:47 +10002604 - (djm) [auth-pam.c] Portable parts of bz#899: Don't display invalid
2605 usernames in setproctitle from peak AT argo.troja.mff.cuni.cz;
Damien Millera22f2d72004-07-21 20:48:24 +10002606
260720040720
Damien Miller23a70272004-07-21 10:52:13 +10002608 - (djm) [log.c] bz #111: Escape more control characters when sending data
2609 to syslog; from peak AT argo.troja.mff.cuni.cz
Damien Miller8fe01052004-07-21 11:01:41 +10002610 - (djm) [contrib/redhat/sshd.pam] bz #903: Remove redundant entries; from
2611 peak AT argo.troja.mff.cuni.cz
Damien Millerb5a21442004-07-21 20:44:05 +10002612 - (djm) [regress/README.regress] Remove caveat regarding TCP wrappers, now
2613 that sshd is fixed to behave better; suggested by tim
Damien Miller23a70272004-07-21 10:52:13 +10002614
261520040719
Damien Miller65df1742004-07-19 09:30:38 +10002616 - (djm) [openbsd-compat/bsd-arc4random.c] Discard early keystream, like OpenBSD
2617 ok dtucker@
Damien Millera6fb77f2004-07-19 09:39:11 +10002618 - (djm) [auth-pam.c] Avoid use of xstrdup and friends in conversation function,
2619 instead return PAM_CONV_ERR, avoiding another path to fatal(); ok dtucker@
Tim Rice816bd0d2004-07-19 10:19:26 -07002620 - (tim) [configure.ac] updwtmpx() on OpenServer seems to add duplicate entry.
2621 Report by rac AT tenzing.org
Damien Miller65df1742004-07-19 09:30:38 +10002622
Darren Tuckerba6de952004-07-17 14:07:42 +1000262320040717
2624 - (dtucker) [logintest.c scp.c sftp-server.c sftp.c ssh-add.c ssh-agent.c
2625 ssh-keygen.c ssh-keyscan.c ssh-keysign.c ssh-rand-helper.c ssh.c sshd.c
2626 openbsd-compat/bsd-misc.c] Move "char *__progname" to bsd-misc.c. Reduces
2627 diff vs OpenBSD; ok mouring@, tested by tim@ too.
Darren Tuckerfc959702004-07-17 16:12:08 +10002628 - (dtucker) OpenBSD CVS Sync
2629 - deraadt@cvs.openbsd.org 2004/07/11 17:48:47
2630 [channels.c cipher.c clientloop.c clientloop.h compat.h moduli.c
2631 readconf.c nchan.c pathnames.h progressmeter.c readconf.h servconf.c
2632 session.c sftp-client.c sftp.c ssh-agent.1 ssh-keygen.c ssh.c ssh1.h
2633 sshd.c ttymodes.h]
2634 spaces
Darren Tucker3ca45082004-07-17 16:13:15 +10002635 - brad@cvs.openbsd.org 2004/07/12 23:34:25
2636 [ssh-keyscan.1]
2637 Fix incorrect macro, .I -> .Em
2638 From: Eric S. Raymond <esr at thyrsus dot com>
2639 ok jmc@
Darren Tucker09991742004-07-17 17:05:14 +10002640 - dtucker@cvs.openbsd.org 2004/07/17 05:31:41
2641 [monitor.c monitor_wrap.c session.c session.h sshd.c sshlogin.c]
2642 Move "Last logged in at.." message generation to the monitor, right
2643 before recording the new login. Fixes missing lastlog message when
2644 /var/log/lastlog is not world-readable and incorrect datestamp when
2645 multiple sessions are used (bz #463); much assistance & ok markus@
Darren Tuckerba6de952004-07-17 14:07:42 +10002646
Darren Tucker5d423f42004-07-11 16:54:08 +1000264720040711
2648 - (dtucker) [auth-pam.c] Check for zero from waitpid() too, which allows
2649 the monitor to properly clean up the PAM thread (Debian bug #252676).
2650
Tim Rice3b376f02004-07-09 10:45:26 -0700265120040709
2652 - (tim) [contrib/cygwin/README] add minires-devel requirement. Patch from
2653 vinschen AT redhat.com
2654
Darren Tuckercd99fa02004-07-08 23:08:26 +1000265520040708
2656 - (dtucker) OpenBSD CVS Sync
2657 - dtucker@cvs.openbsd.org 2004/07/03 05:11:33
2658 [sshlogin.c] (RCSID sync only, the corresponding code is not in Portable)
2659 Use '\0' not 0 for string; ok djm@, deraadt@
Darren Tucker042e2e82004-07-08 23:09:42 +10002660 - dtucker@cvs.openbsd.org 2004/07/03 11:02:25
2661 [monitor_wrap.c]
2662 Put s/key functions inside #ifdef SKEY same as monitor.c,
2663 from des@freebsd via bz #330, ok markus@
Darren Tuckere1f17052004-07-08 23:11:44 +10002664 - dtucker@cvs.openbsd.org 2004/07/08 12:47:21
2665 [scp.c]
2666 Prevent scp from skipping the file following a double-error.
2667 bz #863, ok markus@
Darren Tuckercd99fa02004-07-08 23:08:26 +10002668
Darren Tuckerd062da52004-07-02 18:43:09 +1000266920040702
2670 - (dtucker) [mdoc2man.awk] Teach it to ignore .Bk -words, reported by
2671 strube at physik3.gwdg.de a long time ago.
2672
Darren Tucker0a44d1e2004-07-01 09:48:29 +1000267320040701
2674 - (dtucker) [session.c] Call display_loginmsg again after do_pam_session.
2675 Ensures messages from PAM modules are displayed when privsep=no.
Darren Tuckere2ba9c22004-07-01 12:38:14 +10002676 - (dtucker) [auth-pam.c] Bug #705: Make arguments match PAM specs, fixes
2677 warnings on compliant platforms. From paul.a.bolton at bt.com. ok djm@
Darren Tucker1f7e4082004-07-01 14:00:14 +10002678 - (dtucker) [auth-pam.c] Bug #559 (last piece): Pass DISALLOW_NULL_AUTHTOK
2679 to pam_authenticate for challenge-response auth too. Originally from
2680 fcusack at fcusack.com, ok djm@
Tim Ricea5757f02004-07-01 20:41:15 -07002681 - (tim) [buildpkg.sh.in] Add $REV to bump the package revision within
2682 the same version. Handle the case where someone uses --with-privsep-user=
2683 and the user name does not match the group name. ok dtucker@
Darren Tucker0a44d1e2004-07-01 09:48:29 +10002684
Darren Tucker59e06022004-06-30 20:34:31 +1000268520040630
2686 - (dtucker) [auth-pam.c] Check for buggy PAM modules that return a NULL
2687 appdata_ptr to the conversation function. ok djm@
Damien Miller5d1eceb2004-06-30 22:37:57 +10002688 - (djm) OpenBSD CVS Sync
2689 - jmc@cvs.openbsd.org 2004/06/26 09:03:21
2690 [ssh.1]
2691 - remove double word
2692 - rearrange .Bk to keep SYNOPSIS nice
2693 - -M before -m in options description
Damien Miller2234bac2004-06-30 22:38:52 +10002694 - jmc@cvs.openbsd.org 2004/06/26 09:11:14
2695 [ssh_config.5]
2696 punctuation and grammar fixes. also, keep the options in order.
Damien Miller26213e52004-06-30 22:39:34 +10002697 - jmc@cvs.openbsd.org 2004/06/26 09:14:40
2698 [sshd_config.5]
2699 new sentence, new line;
Damien Miller386c6a22004-06-30 22:40:20 +10002700 - avsm@cvs.openbsd.org 2004/06/26 20:07:16
2701 [sshd.c]
2702 initialise some fd variables to -1, djm@ ok
Damien Millera6b1d162004-06-30 22:41:07 +10002703 - djm@cvs.openbsd.org 2004/06/30 08:36:59
2704 [session.c]
2705 unbreak TTY break, diagnosed by darren AT dazwin.com; ok markus@
Darren Tucker59e06022004-06-30 20:34:31 +10002706
Tim Rice52879022004-06-27 20:50:35 -0700270720040627
2708 - (tim) update README files.
Darren Tucker58cef1f2004-06-28 15:45:08 +10002709 - (dtucker) [mdoc2man.awk] Bug #883: correctly recognise .Pa and .Ev macros.
Darren Tuckerf9eb2b02004-06-28 15:52:50 +10002710 - (dtucker) [regress/README.regress] Document new variables.
Darren Tuckere59b5082004-06-28 16:01:19 +10002711 - (dtucker) [acconfig.h configure.ac sftp-server.c] Bug #823: add sftp
2712 rename handling for Linux which returns EPERM for link() on (at least some)
2713 filesystems that do not support hard links. sftp-server will fall back to
2714 stat+rename() in such cases.
Darren Tucker5288cb22004-06-28 18:11:19 +10002715 - (dtucker) [openbsd-compat/port-aix.c] Missing __func__.
Tim Rice52879022004-06-27 20:50:35 -07002716
Damien Miller035a5b42004-06-26 08:16:31 +1000271720040626
2718 - (djm) OpenBSD CVS Sync
2719 - djm@cvs.openbsd.org 2004/06/25 18:43:36
2720 [sshd.c]
2721 fix broken fd handling in the re-exec fallback path, particularly when
2722 /dev/crypto is in use; ok deraadt@ markus@
Damien Miller96d6d7d2004-06-26 09:21:06 +10002723 - djm@cvs.openbsd.org 2004/06/25 23:21:38
2724 [sftp.c]
2725 bz #875: fix bad escape char error message; reported by f_mohr AT yahoo.de
Damien Miller035a5b42004-06-26 08:16:31 +10002726
Darren Tucker645ab752004-06-25 13:33:20 +1000272720040625
2728 - (dtucker) OpenBSD CVS Sync
2729 - djm@cvs.openbsd.org 2004/06/24 19:30:54
2730 [servconf.c servconf.h sshd.c]
2731 re-exec sshd on accept(); initial work, final debugging and ok markus@
Darren Tucker586b0b92004-06-25 13:34:31 +10002732 - djm@cvs.openbsd.org 2004/06/25 01:16:09
2733 [sshd.c]
2734 only perform tcp wrappers checks when the incoming connection is on a
2735 socket. silences useless warnings from regress tests that use
2736 proxycommand="sshd -i". prompted by david@ ok markus@
Darren Tucker977a9d22004-06-25 13:45:18 +10002737 - djm@cvs.openbsd.org 2004/06/24 19:32:00
2738 [regress/Makefile regress/test-exec.sh, added regress/reexec.sh]
2739 regress test for re-exec corner cases
Darren Tuckeref3b47a2004-06-25 13:46:08 +10002740 - djm@cvs.openbsd.org 2004/06/25 01:25:12
2741 [regress/test-exec.sh]
2742 clean reexec-specific junk out of text-exec.sh and simplify; idea markus@
Darren Tuckeraedc1d62004-06-25 17:06:02 +10002743 - dtucker@cvs.openbsd.org 2004/06/25 05:38:48
2744 [sftp-server.c]
2745 Fall back to stat+rename if filesystem doesn't doesn't support hard
2746 links. bz#823, ok djm@
Darren Tucker60bd4092004-06-25 14:03:34 +10002747 - (dtucker) [configure.ac openbsd-compat/misc.c [openbsd-compat/misc.h]
2748 Add closefrom() for platforms that don't have it.
Darren Tucker17c5d032004-06-25 14:22:23 +10002749 - (dtucker) [sshd.c] add line missing from reexec sync.
Darren Tucker645ab752004-06-25 13:33:20 +10002750
Darren Tuckera8c73d32004-06-23 09:17:54 +1000275120040623
2752 - (dtucker) [auth1.c] Ensure do_pam_account is called for Protocol 1
2753 connections with empty passwords. Patch from davidwu at nbttech.com,
2754 ok djm@
Darren Tucker6eabe642004-06-23 09:23:58 +10002755 - (dtucker) OpenBSD CVS Sync
2756 - dtucker@cvs.openbsd.org 2004/06/22 22:42:02
2757 [regress/envpass.sh]
2758 Add quoting for test -z; ok markus@
Darren Tucker6223eea2004-06-23 09:25:02 +10002759 - dtucker@cvs.openbsd.org 2004/06/22 22:45:52
2760 [regress/test-exec.sh]
2761 Add TEST_SSH_SSHD_CONFOPTS and TEST_SSH_SSH_CONFOPTS to allow adding
2762 arbitary options to sshd_config and ssh_config during tests. ok markus@
Darren Tucker3b9c0ad2004-06-23 09:28:20 +10002763 - dtucker@cvs.openbsd.org 2004/06/22 22:55:56
2764 [regress/dynamic-forward.sh regress/test-exec.sh]
2765 Allow setting of port for regress from TEST_SSH_PORT variable; ok markus@
Darren Tuckerede07fb2004-06-24 00:33:48 +10002766 - mouring@cvs.openbsd.org 2004/06/23 00:39:38
2767 [rijndael.c]
2768 -Wshadow fix up s/encrypt/do_encrypt/. OK djm@, markus@
Darren Tuckerb5bc1a62004-06-24 00:34:53 +10002769 - dtucker@cvs.openbsd.org 2004/06/23 14:31:01
2770 [ssh.c]
2771 Fix counting in master/slave when passing environment variables; ok djm@
Darren Tuckere5a604f2004-06-23 12:28:31 +10002772 - (dtucker) [cipher.c] encrypt->do_encrypt inside SSH_OLD_EVP to match
2773 -Wshadow change.
Ben Lindstromca372192004-06-23 04:04:45 +00002774 - (bal) [Makefile.in] Remove opensshd.init on 'make distclean'
Darren Tucker0a9d43d2004-06-23 13:45:24 +10002775 - (dtucker) [auth.c openbsd-compat/port-aix.c openbsd-compat/port-aix.h]
2776 Move loginrestrictions test to port-aix.c, replace with a generic hook.
Tim Riceaf4ab6c2004-06-22 20:53:02 -07002777 - (tim) [regress/try-ciphers.sh] "if ! some_command" is not portable.
Ben Lindstromca372192004-06-23 04:04:45 +00002778 - (bal) [contrib/README] Removed "mdoc2man.pl" reference and added
2779 reference to "findssl.sh"
Darren Tuckera8c73d32004-06-23 09:17:54 +10002780
Darren Tucker365433f2004-06-22 12:29:23 +1000278120040622
2782 - (dtucker) OpenBSD CVS Sync
2783 - djm@cvs.openbsd.org 2004/06/20 17:36:59
2784 [ssh.c]
2785 filter passed env vars at slave in connection sharing case; ok markus@
Darren Tuckerb215c5d2004-06-22 12:30:53 +10002786 - djm@cvs.openbsd.org 2004/06/20 18:53:39
2787 [sftp.c]
2788 make "ls -l" listings print user/group names, add "ls -n" to show uid/gid
2789 (like /bin/ls); idea & ok markus@
Darren Tuckerb357afc2004-06-22 12:31:23 +10002790 - djm@cvs.openbsd.org 2004/06/20 19:28:12
2791 [sftp.1]
2792 mention new -n flag
Darren Tucker3f9fdc72004-06-22 12:56:01 +10002793 - avsm@cvs.openbsd.org 2004/06/21 17:36:31
2794 [auth-rsa.c auth2-gss.c auth2-pubkey.c authfile.c canohost.c channels.c
2795 cipher.c dns.c kex.c monitor.c monitor_fdpass.c monitor_wrap.c
2796 monitor_wrap.h nchan.c packet.c progressmeter.c scp.c sftp-server.c sftp.c
2797 ssh-gss.h ssh-keygen.c ssh.c sshconnect.c sshconnect1.c sshlogin.c
2798 sshpty.c]
2799 make ssh -Wshadow clean, no functional changes
2800 markus@ ok
Darren Tucker723e9452004-06-22 12:57:08 +10002801 - djm@cvs.openbsd.org 2004/06/21 17:53:03
2802 [session.c]
2803 fix fd leak for multiple subsystem connections; with markus@
Darren Tuckerefa62f92004-06-22 12:57:44 +10002804 - djm@cvs.openbsd.org 2004/06/21 22:02:58
2805 [log.h]
2806 mark fatal and cleanup exit as __dead; ok markus@
Darren Tuckerb9123452004-06-22 13:06:45 +10002807 - djm@cvs.openbsd.org 2004/06/21 22:04:50
2808 [sftp.c]
2809 introduce sorting for ls, same options as /bin/ls; ok markus@
Darren Tuckera4e9ffa2004-06-22 13:07:58 +10002810 - djm@cvs.openbsd.org 2004/06/21 22:30:45
2811 [sftp.c]
2812 prefix ls option flags with LS_
Darren Tucker15ca6e82004-06-22 13:08:21 +10002813 - djm@cvs.openbsd.org 2004/06/21 22:41:31
2814 [sftp.1]
2815 document sort options
Darren Tucker9a526452004-06-22 13:09:55 +10002816 - djm@cvs.openbsd.org 2004/06/22 01:16:39
2817 [sftp.c]
2818 don't show .files by default in ls, add -a option to turn them back on;
2819 ok markus
Darren Tucker430c6a12004-06-22 13:38:56 +10002820 - markus@cvs.openbsd.org 2004/06/22 03:12:13
2821 [regress/envpass.sh regress/multiplex.sh]
2822 more portable env passing tests
Darren Tuckerb09b6772004-06-22 15:06:46 +10002823 - dtucker@cvs.openbsd.org 2004/06/22 05:05:45
2824 [monitor.c monitor_wrap.c]
2825 Change login->username, will prevent -Wshadow errors in Portable;
2826 ok markus@
Darren Tucker5e4e2722004-06-22 13:26:00 +10002827 - (dtucker) [monitor.c] Fix Portable-specific -Wshadow warnings on "socket".
Darren Tucker59bf4a92004-06-22 13:27:16 +10002828 - (dtucker) [defines.h] Define __dead if not already defined.
Ben Lindstromca372192004-06-23 04:04:45 +00002829 - (bal) [auth-passwd.c auth1.c] Clean up unused variables.
Darren Tucker365433f2004-06-22 12:29:23 +10002830
Tim Ricef7ba8f62004-06-20 10:37:32 -0700283120040620
2832 - (tim) [configure.ac Makefile.in] Only change TEST_SHELL on broken platforms.
2833
Darren Tucker17db1c42004-06-19 12:54:38 +1000283420040619
2835 - (dtucker) [auth-pam.c] Don't use PAM namespace for
2836 pam_password_change_required either.
Tim Rice5af9db92004-06-19 19:31:06 -07002837 - (tim) [configure.ac buildpkg.sh.in contrib/solaris/README] move opensshd
2838 init script to top level directory. Add opensshd.init.in.
2839 Remove contrib/solaris/buildpkg.sh, contrib/solaris/opensshd.in
Darren Tucker17db1c42004-06-19 12:54:38 +10002840
Damien Miller3756dce2004-06-18 01:17:29 +1000284120040618
2842 - (djm) OpenBSD CVS Sync
2843 - djm@cvs.openbsd.org 2004/06/17 14:52:48
2844 [clientloop.c clientloop.h ssh.c]
2845 support environment passing over shared connections; ok markus@
Damien Miller23f07702004-06-18 01:19:03 +10002846 - djm@cvs.openbsd.org 2004/06/17 15:10:14
2847 [clientloop.c misc.h readconf.c readpass.c ssh.c ssh_config.5]
2848 Add option for confirmation (ControlMaster=ask) via ssh-askpass before
2849 opening shared connections; ok markus@
Damien Millere826a8c2004-06-18 01:23:03 +10002850 - djm@cvs.openbsd.org 2004/06/17 14:53:27
2851 [regress/multiplex.sh]
2852 shared connection env passing regress test
Darren Tucker13fbe572004-06-18 14:14:43 +10002853 - (dtucker) [regress/README.regress] Add detail on how to run a single
2854 test from the top-level Makefile.
Darren Tuckerba5c5922004-06-18 16:22:39 +10002855 - (dtucker) OpenBSD CVS Sync
2856 - djm@cvs.openbsd.org 2004/06/17 23:56:57
2857 [ssh.1 ssh.c]
2858 sync usage() and SYNPOSIS with connection sharing changes
Darren Tuckerbd12f172004-06-18 16:23:43 +10002859 - dtucker@cvs.openbsd.org 2004/06/18 06:13:25
2860 [sftp.c]
2861 Use execvp instead of execv so sftp -S ssh works. "makes sense" markus@
Darren Tucker6288dc12004-06-18 16:25:35 +10002862 - dtucker@cvs.openbsd.org 2004/06/18 06:15:51
2863 [multiplex.sh]
2864 Use -S for scp/sftp to force the use of the ssh being tested.
2865 ok djm@,markus@
Damien Miller0809e232004-06-18 22:20:57 +10002866 - (djm) OpenBSD CVS Sync
2867 - djm@cvs.openbsd.org 2004/06/18 10:40:19
2868 [ssh.c]
2869 delay signal handler setup until we have finished talking to the master.
2870 allow interrupting of setup (e.g. if master is stuck); ok markus@
Damien Millerb8ea2482004-06-18 22:21:55 +10002871 - markus@cvs.openbsd.org 2004/06/18 10:55:43
2872 [ssh.1 ssh.c]
2873 trim synopsis for -S, allow -S and -oControlMaster, -MM means 'ask';
2874 ok djm
Damien Miller3bbd8782004-06-18 22:23:22 +10002875 - djm@cvs.openbsd.org 2004/06/18 11:11:54
2876 [channels.c clientloop.c]
2877 Don't explode in clientloop when we receive a bogus channel id, but
2878 also don't generate them to begin with; ok markus@
Damien Miller3756dce2004-06-18 01:17:29 +10002879
Darren Tucker8a2f1b32004-06-17 15:18:32 +1000288020040617
2881 - (dtucker) [regress/scp.sh] diff -N is not portable (but needed for some
2882 platforms), so test if diff understands it. Pointed out by tim@, ok djm@
Darren Tuckerddea13d2004-06-17 16:27:43 +10002883 - (dtucker) OpenBSD CVS Sync regress/
2884 - dtucker@cvs.openbsd.org 2004/06/17 05:51:59
2885 [regress/multiplex.sh]
2886 Remove datafile between and after tests, kill sshd rather than wait;
2887 ok djm@
Darren Tuckerffaa6a52004-06-17 16:32:45 +10002888 - dtucker@cvs.openbsd.org 2004/06/17 06:00:05
2889 [regress/multiplex.sh]
2890 Use DATA and COPY for test data rather than hard-coded paths; ok djm@
Darren Tucker3e86fc42004-06-17 16:34:02 +10002891 - dtucker@cvs.openbsd.org 2004/06/17 06:19:06
2892 [regress/multiplex.sh]
2893 Add small description of failing test to failure message; ok djm@
Darren Tucker10e7f192004-06-17 16:36:27 +10002894 - (dtucker) [regress/multiplex.sh] add EXEEXT for those platforms that need
2895 it.
Darren Tuckera9972e12004-06-17 17:01:21 +10002896 - (dtucker) [regress/multiplex.sh] Increase sleep time to 120 sec (60 is not
2897 enough for slow systems, especially if they don't have a kernel RNG).
Darren Tucker8a2f1b32004-06-17 15:18:32 +10002898
Darren Tuckera7ea5462004-06-16 12:01:15 +1000289920040616
2900 - (dtucker) [openbsd-compat/port-aix.c] Expand whitespace -> tabs. No
2901 code changes.
Darren Tucker4c37ef02004-06-16 20:08:56 +10002902 - (dtucker) OpenBSD CVS Sync regress/
2903 - djm@cvs.openbsd.org 2004/04/27 09:47:30
Darren Tucker9fe95da2004-06-16 20:33:55 +10002904 [regress/Makefile regress/test-exec.sh, added regress/envpass.sh]
Darren Tucker4c37ef02004-06-16 20:08:56 +10002905 regress test for environment passing, SendEnv & AcceptEnv options;
2906 ok markus@
Darren Tucker50433a92004-06-16 20:15:59 +10002907 - dtucker@cvs.openbsd.org 2004/06/13 13:51:02
Darren Tucker9fe95da2004-06-16 20:33:55 +10002908 [regress/Makefile regress/test-exec.sh, added regress/scp-ssh-wrapper.sh
2909 regress/scp.sh]
Darren Tucker50433a92004-06-16 20:15:59 +10002910 Add scp regression test; with & ok markus@
Darren Tuckere7d05832004-06-16 20:22:22 +10002911 - djm@cvs.openbsd.org 2004/06/13 15:04:08
Darren Tucker9fe95da2004-06-16 20:33:55 +10002912 [regress/Makefile regress/test-exec.sh, added regress/envpass.sh]
Darren Tuckere7d05832004-06-16 20:22:22 +10002913 regress test for client multiplexing; ok markus@
Darren Tuckera4039562004-06-16 20:31:18 +10002914 - djm@cvs.openbsd.org 2004/06/13 15:16:54
2915 [regress/test-exec.sh]
2916 remove duplicate setting of $SCP; spotted by markus@
Darren Tucker6f0e35b2004-06-16 23:22:37 +10002917 - dtucker@cvs.openbsd.org 2004/06/16 13:15:09
2918 [regress/scp.sh]
2919 Make scp -r tests use diff -rN not cmp (which won't do dirs. ok markus@
Darren Tucker5711dca2004-06-16 23:23:50 +10002920 - dtucker@cvs.openbsd.org 2004/06/16 13:16:40
Darren Tuckeraf161542004-06-16 23:24:19 +10002921 [regress/multiplex.sh]
Darren Tucker5711dca2004-06-16 23:23:50 +10002922 Silence multiplex sftp and scp tests. ok markus@
Darren Tucker7a06f622004-06-16 21:08:32 +10002923 - (dtucker) [regress/test-exec.sh]
2924 Move Portable-only StrictModes to top of list to make syncs easier.
2925 - (dtucker) [regress/README.regress]
2926 Add $TEST_SHELL to readme.
Darren Tuckera7ea5462004-06-16 12:01:15 +10002927
Damien Miller350327c2004-06-15 10:24:13 +1000292820040615
2929 - (djm) OpenBSD CVS Sync
2930 - djm@cvs.openbsd.org 2004/05/26 08:59:57
2931 [sftp.c]
2932 exit -> _exit in forked child on error; from andrushock AT korovino.net
Damien Miller3e4dffb2004-06-15 10:27:15 +10002933 - markus@cvs.openbsd.org 2004/05/26 23:02:39
2934 [channels.c]
2935 missing freeaddrinfo; Andrey Matveev
Damien Miller33793852004-06-15 10:27:55 +10002936 - dtucker@cvs.openbsd.org 2004/05/27 00:50:13
2937 [readconf.c]
2938 Kill dead code after fatal(); ok djm@
Damien Miller16ea6492004-06-15 10:28:24 +10002939 - dtucker@cvs.openbsd.org 2004/06/01 14:20:45
2940 [auth2-chall.c]
2941 Remove redundant #include; ok markus@
Damien Miller7cf17eb2004-06-15 10:28:56 +10002942 - pedro@cvs.openbsd.org 2004/06/03 12:22:20
2943 [sftp-client.c sftp.c]
2944 initialize pointers, ok markus@
Damien Millerf675fc42004-06-15 10:30:09 +10002945 - djm@cvs.openbsd.org 2004/06/13 12:53:24
2946 [dh.c dh.h kex.c kex.h kexdhc.c kexdhs.c monitor.c myproposal.h]
2947 [ssh-keyscan.c sshconnect2.c sshd.c]
2948 implement diffie-hellman-group14-sha1 kex method (trivial extension to
2949 existing diffie-hellman-group1-sha1); ok markus@
Damien Miller05202ff2004-06-15 10:30:39 +10002950 - dtucker@cvs.openbsd.org 2004/06/13 14:01:42
2951 [ssh.1 ssh_config.5 sshd_config.5]
2952 List supported ciphers in man pages, tidy up ssh -c;
2953 "looks fine" jmc@, ok markus@
Damien Miller0e220db2004-06-15 10:34:08 +10002954 - djm@cvs.openbsd.org 2004/06/13 15:03:02
2955 [channels.c channels.h clientloop.c clientloop.h includes.h readconf.c]
2956 [readconf.h scp.1 sftp.1 ssh.1 ssh.c ssh_config.5]
2957 implement session multiplexing in the client (the server has supported
2958 this since 2.0); ok markus@
Damien Miller232711f2004-06-15 10:35:30 +10002959 - djm@cvs.openbsd.org 2004/06/14 01:44:39
2960 [channels.c clientloop.c misc.c misc.h packet.c ssh-agent.c ssh-keyscan.c]
2961 [sshd.c]
Damien Miller03e66f62004-06-15 15:47:51 +10002962 set_nonblock() instead of fnctl(...,O_NONBLOCK); "looks sane" deraadt@
2963 - djm@cvs.openbsd.org 2004/06/15 05:45:04
2964 [clientloop.c]
2965 missed one unset_nonblock; spotted by Tim Rice
Damien Miller5e6f4db2004-06-15 10:44:40 +10002966 - (djm) Fix Makefile.in for connection sharing changes
Damien Miller07b6ff12004-06-15 11:14:45 +10002967 - (djm) [ssh.c] Use separate var for address length
Damien Miller350327c2004-06-15 10:24:13 +10002968
Darren Tucker94befab2004-06-03 14:53:12 +1000296920040603
2970 - (dtucker) [auth-pam.c] Don't use pam_* namespace for sshd's PAM functions.
2971 ok djm@
2972
Damien Miller26314f62004-06-01 11:28:20 +1000297320040601
2974 - (djm) [auth-pam.c] Add copyright for local changes
2975
Darren Tucker450a1582004-05-30 20:43:59 +1000297620040530
Darren Tuckere061b152004-05-30 22:04:56 +10002977 - (dtucker) [auth-pam.c auth-pam.h auth-passwd.c] Bug #874: Re-add PAM
Darren Tucker450a1582004-05-30 20:43:59 +10002978 support for PasswordAuthentication=yes. ok djm@
Darren Tuckere061b152004-05-30 22:04:56 +10002979 - (dtucker) [auth-pam.c] Use an invalid password for root if
2980 PermitRootLogin != yes or the login is invalid, to prevent leaking
2981 information. Based on Openwall's owl-always-auth patch. ok djm@
Tim Rice6f1f7582004-05-30 21:38:51 -07002982 - (tim) [configure.ac Makefile.in] Add support for "make package" ok djm@
2983 - (tim) [buildpkg.sh.in] New file. A more flexible version of
2984 contrib/solaris/buildpkg.sh used for "make package".
Tim Rice2d2b9f72004-05-30 21:48:40 -07002985 - (tim) [buildpkg.sh.in] Last minute fix didn't make it in the .in file.
Darren Tucker450a1582004-05-30 20:43:59 +10002986
Darren Tucker0ffe6382004-05-27 09:59:31 +1000298720040527
2988 - (dtucker) [contrib/caldera/openssh.spec contrib/redhat/openssh.spec
2989 contrib/README CREDITS INSTALL] Bug #873: Correct URLs for x11-ssh-askpass
2990 and Jim Knoble's email address , from Jim himself.
2991
Darren Tuckercdf547a2004-05-24 10:12:19 +1000299220040524
2993 - (dtucker) OpenBSD CVS Sync
2994 - djm@cvs.openbsd.org 2004/05/19 12:17:33
2995 [sftp-client.c sftp.c]
2996 gracefully abort transfers on receipt of SIGINT, also ignore SIGINT while
2997 waiting for a command; ok markus@
Darren Tuckere1675822004-05-24 10:13:07 +10002998 - dtucker@cvs.openbsd.org 2004/05/20 10:58:05
2999 [clientloop.c]
3000 Trivial type fix 0 -> '\0'; ok markus@
Darren Tuckere4ab1152004-05-24 10:14:24 +10003001 - markus@cvs.openbsd.org 2004/05/21 08:43:03
3002 [kex.h moduli.c tildexpand.c]
3003 add prototypes for -Wall; ok djm
Darren Tuckere7066df2004-05-24 10:18:05 +10003004 - djm@cvs.openbsd.org 2004/05/21 11:33:11
3005 [channels.c channels.h clientloop.c serverloop.c ssh.1]
Darren Tuckerb53355e2004-05-24 11:55:36 +10003006 bz #756: add support for the cancel-tcpip-forward request for the server
3007 and the client (through the ~C commandline). reported by z3p AT
3008 twistedmatrix.com; ok markus@
Darren Tucker1973c882004-05-24 10:34:36 +10003009 - djm@cvs.openbsd.org 2004/05/22 06:32:12
3010 [clientloop.c ssh.1]
3011 use '-h' for help in ~C commandline instead of '-?'; inspired by jmc@
Darren Tuckere534e122004-05-24 10:35:14 +10003012 - jmc@cvs.openbsd.org 2004/05/22 16:01:05
3013 [ssh.1]
3014 kill whitespace at eol;
Darren Tucker89413db2004-05-24 10:36:23 +10003015 - dtucker@cvs.openbsd.org 2004/05/23 23:59:53
Darren Tuckerb53355e2004-05-24 11:55:36 +10003016 [auth.c auth.h auth1.c auth2.c servconf.c servconf.h sshd_config
3017 sshd_config.5]
Darren Tucker89413db2004-05-24 10:36:23 +10003018 Add MaxAuthTries sshd config option; ok markus@
Darren Tuckerb53355e2004-05-24 11:55:36 +10003019 - (dtucker) [auth-pam.c] Bug #839: Ensure that pam authentication "thread"
3020 is terminated if the privsep slave exits during keyboard-interactive
3021 authentication. ok djm@
Darren Tucker12984962004-05-24 13:37:13 +10003022 - (dtucker) [sshd.c] Fix typo in comment.
Darren Tuckercdf547a2004-05-24 10:12:19 +10003023
Damien Miller701d0512004-05-23 11:47:58 +1000302420040523
Damien Millerb4097182004-05-23 14:09:40 +10003025 - (djm) [sshd_config] Explain consequences of UsePAM=yes a little better in
3026 sshd_config; ok dtucker@
3027 - (djm) [configure.ac] Warn if the system has no known way of figuring out
3028 which user is on the other end of a Unix domain socket; ok dtucker@
Ben Lindstromefec7c22004-05-23 06:22:27 +00003029 - (bal) [openbsd-compat/sys-queue.h] Reintroduce machinary to handle
3030 old/broken/incomplete <sys/queue.h>.
Damien Miller701d0512004-05-23 11:47:58 +10003031
Darren Tucker8e968a52004-05-13 11:56:16 +1000303220040513
3033 - (dtucker) [configure.ac] Bug #867: Additional tests for res_query in
3034 libresolv, fixes problems detecting it on some platforms
3035 (eg Linux/x86-64). From Kurt Roeckx via Debian, ok mouring@
Darren Tucker2e578f62004-05-13 13:03:04 +10003036 - (dtucker) OpenBSD CVS Sync
3037 - jmc@cvs.openbsd.org 2004/05/04 18:36:07
3038 [scp.1]
3039 SendEnv here too;
Darren Tuckerdcf6ec42004-05-13 13:03:56 +10003040 - jmc@cvs.openbsd.org 2004/05/06 11:24:23
3041 [ssh_config.5]
3042 typo from John Cosimano (PR 3770);
Darren Tucker06f2bd82004-05-13 16:06:46 +10003043 - deraadt@cvs.openbsd.org 2004/05/08 00:01:37
3044 [auth.c clientloop.c misc.h servconf.c ssh.c sshpty.h sshtty.c
3045 tildexpand.c], removed: sshtty.h tildexpand.h
3046 make two tiny header files go away; djm ok
Darren Tuckere608ca22004-05-13 16:15:47 +10003047 - djm@cvs.openbsd.org 2004/05/08 00:21:31
3048 [clientloop.c misc.h readpass.c scard.c ssh-add.c ssh-agent.c ssh-keygen.c
3049 sshconnect.c sshconnect1.c sshconnect2.c] removed: readpass.h
3050 kill a tiny header; ok deraadt@
Darren Tucker770fc012004-05-13 16:24:32 +10003051 - djm@cvs.openbsd.org 2004/05/09 00:06:47
3052 [moduli.c ssh-keygen.c] removed: moduli.h
3053 zap another tiny header; ok deraadt@
Darren Tuckere14e0052004-05-13 16:30:44 +10003054 - djm@cvs.openbsd.org 2004/05/09 01:19:28
3055 [OVERVIEW auth-rsa.c auth1.c kex.c monitor.c session.c sshconnect1.c
3056 sshd.c] removed: mpaux.c mpaux.h
3057 kill some more tiny files; ok deraadt@
Darren Tuckerb42714e2004-05-13 16:31:48 +10003058 - djm@cvs.openbsd.org 2004/05/09 01:26:48
3059 [kex.c]
3060 don't overwrite what we are trying to compute
Darren Tucker1f8311c2004-05-13 16:39:33 +10003061 - deraadt@cvs.openbsd.org 2004/05/11 19:01:43
3062 [auth.c auth2-none.c authfile.c channels.c monitor.c monitor_mm.c
3063 packet.c packet.h progressmeter.c session.c openbsd-compat/xmmap.c]
3064 improve some code lint did not like; djm millert ok
Darren Tuckera86b4532004-05-13 16:45:46 +10003065 - dtucker@cvs.openbsd.org 2004/05/13 02:47:50
3066 [ssh-agent.1]
3067 Add examples to ssh-agent.1, bz#481 from Ralf Hauser; ok deraadt@
Darren Tucker1dcff9a2004-05-13 16:51:40 +10003068 - (dtucker) [sshd.8] Bug #843: Add warning about PasswordAuthentication to
3069 UsePAM section. Parts from djm@ and jmc@.
Darren Tuckerb6db1722004-05-13 17:29:35 +10003070 - (dtucker) [auth-pam.c scard-opensc.c] Tinderbox says auth-pam.c uses
3071 readpass.h, grep says scard-opensc.c does too. Replace with misc.h.
Darren Tuckercc268552004-05-13 20:10:38 +10003072 - (dtucker) [openbsd-compat/getrrsetbyname.c] Check that HAVE_DECL_H_ERROR
3073 is defined before using.
Darren Tucker991d95f2004-05-13 20:24:10 +10003074 - (dtucker) [openbsd-compat/getrrsetbyname.c] Fix typo too: HAVE_DECL_H_ERROR
3075 -> HAVE_DECL_H_ERRNO.
Darren Tucker8e968a52004-05-13 11:56:16 +10003076
307720040502
Darren Tucker47abce42004-05-02 22:09:00 +10003078 - (dtucker) OpenBSD CVS Sync
3079 - djm@cvs.openbsd.org 2004/04/22 11:56:57
3080 [moduli.c]
3081 Bugzilla #850: Sophie Germain is the correct name of the French
3082 mathematician, "Sophie Germaine" isn't; from Luc.Maisonobe@c-s.fr
Darren Tucker46bc0752004-05-02 22:11:30 +10003083 - djm@cvs.openbsd.org 2004/04/27 09:46:37
3084 [readconf.c readconf.h servconf.c servconf.h session.c session.h ssh.c
3085 ssh_config.5 sshd_config.5]
3086 bz #815: implement ability to pass specified environment variables from
3087 the client to the server; ok markus@
Darren Tucker1e0c9bf2004-05-02 22:12:48 +10003088 - djm@cvs.openbsd.org 2004/04/28 05:17:10
3089 [ssh_config.5 sshd_config.5]
3090 manpage fixes in envpass stuff from Brian Poole (raj AT cerias.purdue.edu)
Darren Tuckerb2a601c2004-05-02 22:13:20 +10003091 - jmc@cvs.openbsd.org 2004/04/28 07:02:56
3092 [sshd_config.5]
3093 remove unnecessary .Pp;
Darren Tucker7a6c0662004-05-02 22:14:03 +10003094 - jmc@cvs.openbsd.org 2004/04/28 07:13:42
3095 [sftp.1 ssh.1]
3096 add SendEnv to -o list;
Darren Tucker097e1e92004-05-02 22:15:08 +10003097 - dtucker@cvs.openbsd.org 2004/05/02 11:54:31
3098 [sshd.8]
3099 Man page grammar fix (bz #858), from damerell at chiark.greenend.org.uk
3100 via Debian; ok djm@
Darren Tuckeredae0ec2004-05-02 22:15:52 +10003101 - dtucker@cvs.openbsd.org 2004/05/02 11:57:52
3102 [ssh.1]
3103 ConnectionTimeout -> ConnectTimeout, from m.a.ellis at ncl.ac.uk via
3104 Debian. ok djm@
Darren Tucker3d5cbb72004-05-03 09:13:15 +10003105 - dtucker@cvs.openbsd.org 2004/05/02 23:02:17
3106 [sftp.1]
3107 ConnectionTimeout -> ConnectTimeout here too, pointed out by jmc@
Darren Tuckerc0796d72004-05-03 09:19:03 +10003108 - dtucker@cvs.openbsd.org 2004/05/02 23:17:51
3109 [scp.1]
3110 ConnectionTimeout -> ConnectTimeout for scp.1 too.
Darren Tucker47abce42004-05-02 22:09:00 +10003111
Darren Tucker5bb14002004-04-23 18:53:10 +1000311220040423
3113 - (dtucker) [configure.ac openbsd-compat/getrrsetbyname.c] Declare h_errno
3114 as extern int if not already declared. Fixes compile errors on old SCO
3115 platforms. ok tim@
Darren Tucker7749c512004-04-23 18:57:13 +10003116 - (dtucker) [README.platform] List prereqs for building on Cygwin.
Darren Tucker5bb14002004-04-23 18:53:10 +10003117
Damien Miller752e4e62004-04-21 12:29:13 +1000311820040421
3119 - (djm) Update config.guess and config.sub to autoconf-2.59 versions; ok tim@
3120
Damien Miller0b51a522004-04-20 20:07:19 +1000312120040420
3122 - (djm) OpenBSD CVS Sync
3123 - henning@cvs.openbsd.org 2004/04/08 16:08:21
3124 [sshconnect2.c]
Damien Miller50bec892004-04-20 20:20:40 +10003125 swap the last two parameters to TAILQ_FOREACH_REVERSE. matches what
3126 FreeBSD and NetBSD do.
Damien Miller0b51a522004-04-20 20:07:19 +10003127 ok millert@ mcbride@ markus@ ho@, checked to not affect ports by naddy@
Damien Miller57a44762004-04-20 20:11:57 +10003128 - djm@cvs.openbsd.org 2004/04/18 23:10:26
3129 [readconf.c readconf.h ssh-keysign.c ssh.c]
3130 perform strict ownership and modes checks for ~/.ssh/config files,
3131 as these can be used to execute arbitrary programs; ok markus@
3132 NB. ssh will now exit when it detects a config with poor permissions
Damien Millerc970cb92004-04-20 20:12:53 +10003133 - djm@cvs.openbsd.org 2004/04/19 13:02:40
3134 [ssh.1 ssh_config.5]
3135 document strict permission checks on ~/.ssh/config; prompted by,
3136 with & ok jmc@
Damien Miller1a812582004-04-20 20:13:32 +10003137 - jmc@cvs.openbsd.org 2004/04/19 16:12:14
3138 [ssh_config.5]
3139 kill whitespace at eol;
Damien Miller914420f2004-04-20 20:14:07 +10003140 - djm@cvs.openbsd.org 2004/04/19 21:51:49
3141 [ssh.c]
3142 fix idiot typo that i introduced in my last commit;
3143 spotted by cschneid AT cschneid.com
Damien Miller50bec892004-04-20 20:20:40 +10003144 - (djm) [openbsd-compat/sys-queue.h] Sync with OpenBSD, needed for
3145 above change
Damien Miller5561e0b2004-04-20 20:28:55 +10003146 - (djm) [configure.ac] Check whether libroken is required when building
3147 with Heimdal
Damien Miller0b51a522004-04-20 20:07:19 +10003148
Darren Tucker9929d1f2004-04-19 22:01:37 +1000314920040419
3150 - (dtucker) OpenBSD CVS Sync
3151 - dtucker@cvs.openbsd.org 2004/02/29 22:04:45
3152 [regress/login-timeout.sh]
3153 Use sudo when restarting daemon during test. ok markus@
Darren Tucker0a74ae72004-04-19 22:04:21 +10003154 - dtucker@cvs.openbsd.org 2004/03/08 10:17:12
3155 [regress/login-timeout.sh]
3156 Missing OBJ, from tim@. ok markus@ (Already fixed, ID sync only)
Darren Tuckerdca6a4d2004-04-19 22:10:52 +10003157 - djm@cvs.openbsd.org 2004/03/30 12:41:56
3158 [sftp-client.c]
3159 sync comment with reality
Darren Tuckerd04121f2004-04-19 22:16:53 +10003160 - djm@cvs.openbsd.org 2004/03/31 21:58:47
3161 [canohost.c]
3162 don't skip ip options check when UseDNS=no; ok markus@ (ID sync only)
Darren Tuckerbddc2b02004-04-19 23:50:16 +10003163 - markus@cvs.openbsd.org 2004/04/01 12:19:57
3164 [scp.c]
3165 limit trust between local and remote rcp/scp process,
3166 noticed by lcamtuf; ok deraadt@, djm@
Darren Tucker9929d1f2004-04-19 22:01:37 +10003167
Darren Tucker2a9bf4b2004-04-18 11:00:26 +1000316820040418
3169 - (dtucker) [auth-pam.c] Log username and source host for failed PAM
3170 authentication attempts. With & ok djm@
Damien Miller2eb42362004-04-18 21:15:43 +10003171 - (djm) [openbsd-compat/bsd-cygwin_util.c] Recent versions of Cygwin allow
3172 change of user context without a password, so relax auth method
3173 restrictions; from vinschen AT redhat.com; ok dtucker@
Darren Tucker2a9bf4b2004-04-18 11:00:26 +10003174
Darren Tuckerc99a19b2004-04-16 17:58:28 +1000317520040416
3176 - (dtucker) [regress/sftp-cmds.sh] Skip quoting test on Cygwin, since
3177 FAT/NTFS does not permit quotes in filenames. From vinschen at redhat.com
Damien Miller9c870f92004-04-16 22:47:55 +10003178 - (djm) [auth-krb5.c auth.h session.c] Explicitly refer to Kerberos ccache
3179 file using FILE: method, fixes problems on Mac OSX.
3180 Patch from simon@sxw.org.uk; ok dtucker@
Tim Ricefe6d5aa2004-04-16 20:03:07 -07003181 - (tim) [configure.ac] Set SETEUID_BREAKS_SETUID, BROKEN_SETREUID and
3182 BROKEN_SETREGID for SCO OpenServer 3
Darren Tuckerc99a19b2004-04-16 17:58:28 +10003183
Darren Tucker96cc26b2004-04-14 13:04:35 +1000318420040412
3185 - (dtucker) [sshd_config.5] Add PermitRootLogin without-password warning
3186 from bug #701 (text from jfh at cise.ufl.edu).
Darren Tucker3b908f62004-04-14 15:26:39 +10003187 - (dtucker) [acconfig.h configure.ac defines.h] Bug #673: check for 4-arg
3188 skeychallenge(), eg on NetBSD. ok mouring@
Darren Tucker06a8cfe2004-04-14 17:24:30 +10003189 - (dtucker) [auth-skey.c defines.h monitor.c] Make skeychallenge explicitly
3190 4-arg, with compatibility for 3-arg versions. From djm@, ok me.
Damien Miller0ac45002004-04-14 20:14:26 +10003191 - (djm) [configure.ac] Fix detection of libwrap on OpenBSD; ok dtucker@
Darren Tucker96cc26b2004-04-14 13:04:35 +10003192
Darren Tucker4d2f3612004-04-08 10:57:05 +1000319320040408
3194 - (dtucker) [loginrec.c] Use UT_LINESIZE if available, prevents truncating
3195 pty name on Linux 2.6.x systems. Patch from jpe at eisenmenger.org.
Ben Lindstrom1b9f2a62004-04-08 05:11:03 +00003196 - (bal) [monitor.c monitor_wrap.c] Second try. Put the zlib.h headers
3197 back and #undef TARGET_OS_MAC instead. (Bug report pending with Apple)
Darren Tucker11f18292004-04-08 16:16:06 +10003198 - (dtucker) [defines.h loginrec.c] Define UT_LINESIZE if not defined and
3199 simplify loginrec.c. ok tim@
Ben Lindstrom036768e2004-04-08 16:12:30 +00003200 - (bal) [monitor.c monitor_wrap.c] Ok.. Last time. Promise. Tim suggested
3201 limiting scope and dtucker@ agreed.
Darren Tucker4d2f3612004-04-08 10:57:05 +10003202
Darren Tuckerac7c9982004-04-07 08:04:09 +1000320320040407
3204 - (dtucker) [session.c] Flush stdout after displaying loginmsg. From
3205 f_mohr at yahoo.de.
Ben Lindstroma8104b52004-04-07 04:16:11 +00003206 - (bal) [acconfig.h auth-krb5.c configure.ac gss-serv-krb5.c] Check to see
3207 if Krb5 library exports krb5_init_etc() since some OSes (like MacOS/X)
3208 are starting to restrict it as internal since it is not needed by
3209 developers any more. (Patch based on Apple tree)
3210 - (bal) [monitor.c monitor_wrap.c] monitor_wrap.c] moved zlib.h higher since
3211 krb5 on MacOS/X conflicts. There may be a better solution, but this will
3212 work for now.
Darren Tuckerac7c9982004-04-07 08:04:09 +10003213
Darren Tucker8db9a0f2004-04-06 21:31:12 +1000321420040406
3215 - (dtucker) [acconfig.h configure.ac defines.h] Bug #820: don't use
3216 updwtmpx() on IRIX since it seems to clobber utmp. ok djm@
Darren Tucker4398cf52004-04-06 21:39:02 +10003217 - (dtucker) [configure.ac] Bug #816, #748 (again): Attempt to detect
3218 broken getaddrinfo and friends on HP-UX. ok djm@
Darren Tucker8db9a0f2004-04-06 21:31:12 +10003219
Darren Tucker809031f2004-03-30 14:03:45 +1000322020040330
3221 - (dtucker) [configure.ac] Bug #811: Use "!" for LOCKED_PASSWD_PREFIX on
3222 Linuxes, since that's what many use. ok djm@
Darren Tucker17addf02004-03-30 20:57:57 +10003223 - (dtucker) [auth-pam.c] rename the_authctxt to sshpam_authctxt in auth-pam.c
3224 to reduce potential confusion with the one in sshd.c. ok djm@
Damien Millerccea0202004-03-31 15:17:54 +10003225 - (djm) Bug #825: Fix ip_options_check() for mapped IPv4/IPv6 connection;
3226 with & ok dtucker@
Darren Tucker809031f2004-03-30 14:03:45 +10003227
Darren Tuckerb3850592004-03-27 16:44:21 +1100322820040327
3229 - (dtucker) [session.c] Bug #817: Clear loginmsg after fork to prevent
3230 duplicate login messages for mutli-session logins. ok djm@
3231
Damien Miller3df755e2004-03-22 09:34:26 +1100323220040322
Damien Millerbfba3542004-03-22 09:29:57 +11003233 - (djm) [sshd.c] Drop supplemental groups if started as root
Damien Miller3df755e2004-03-22 09:34:26 +11003234 - (djm) OpenBSD CVS Sync
3235 - markus@cvs.openbsd.org 2004/03/09 22:11:05
3236 [ssh.c]
3237 increase x11 cookie lifetime to 20 minutes; ok djm
Damien Miller50955102004-03-22 09:34:58 +11003238 - markus@cvs.openbsd.org 2004/03/10 09:45:06
3239 [ssh.c]
3240 trim usage to match ssh(1) and look more like unix. ok djm@
Damien Millerb4087862004-03-22 09:35:21 +11003241 - markus@cvs.openbsd.org 2004/03/11 08:36:26
3242 [sshd.c]
3243 trim usage; ok deraadt
Damien Miller0c889cd2004-03-22 09:36:00 +11003244 - markus@cvs.openbsd.org 2004/03/11 10:21:17
3245 [ssh.c sshd.c]
3246 ssh, sshd: sync version output, ok djm
Damien Milleraed7cee2004-03-22 09:39:09 +11003247 - markus@cvs.openbsd.org 2004/03/20 10:40:59
3248 [version.h]
3249 3.8.1
Damien Miller154e8b82004-03-22 09:40:01 +11003250 - (djm) Crank RPM spec versions
Damien Millerbfba3542004-03-22 09:29:57 +11003251
Damien Miller4fefe242004-03-11 14:20:10 +1100325220040311
3253 - (djm) [configure.ac] Add standard license to configure.ac; ok ben, dtucker
3254
Darren Tucker7c991ab2004-03-10 21:06:32 +1100325520040310
3256 - (dtucker) [openbsd-compat/fake-rfc2553.h] Bug #812: #undef getaddrinfo
3257 before redefining it, silences warnings on Tru64.
3258
Darren Tucker112aaac2004-03-08 22:13:12 +1100325920040308
3260 - (dtucker) [sshd.c] Back out rev 1.270 as it caused problems on some
Darren Tuckerdbf7a742004-03-08 23:04:06 +11003261 platforms (eg SCO, HP-UX) with logging in the wrong TZ. ok djm@
3262 - (dtucker) [configure.ac sshd.c openbsd-compat/bsd-misc.h
3263 openbsd-compat/setenv.c] Unset KRB5CCNAME on AIX to prevent it from being
3264 inherited by the child. ok djm@
3265 - (dtucker) [auth-pam.c auth-pam.h auth1.c auth2.c monitor.c monitor_wrap.c
3266 monitor_wrap.h] Bug #808: Ensure force_pwchange is correctly initialized
Damien Miller57aae982004-03-08 23:11:25 +11003267 even if keyboard-interactive is not used by the client. Prevents
3268 segfaults in some cases where the user's password is expired (note this
3269 is not considered a security exposure). ok djm@
3270 - (djm) OpenBSD CVS Sync
3271 - markus@cvs.openbsd.org 2004/03/03 06:47:52
3272 [sshd.c]
3273 change proctiltle after accept(2); ok henning, deraadt, djm
Damien Miller9ba30692004-03-08 23:12:02 +11003274 - djm@cvs.openbsd.org 2004/03/03 09:30:42
3275 [sftp-client.c]
3276 Don't print duplicate messages when progressmeter is off
3277 Spotted by job317 AT mailvault.com; ok markus@
Damien Millerc0f27d82004-03-08 23:12:19 +11003278 - djm@cvs.openbsd.org 2004/03/03 09:31:20
3279 [sftp.c]
3280 Fix initialisation of progress meter; ok markus@
Damien Millerbd394c32004-03-08 23:12:36 +11003281 - markus@cvs.openbsd.org 2004/03/05 10:53:58
3282 [readconf.c readconf.h scp.1 sftp.1 ssh.1 ssh_config.5 sshconnect2.c]
3283 add IdentitiesOnly; ok djm@, pb@
Damien Miller3b513012004-03-08 23:13:00 +11003284 - djm@cvs.openbsd.org 2004/03/08 09:38:05
3285 [ssh-keyscan.c]
3286 explicitly initialise remote_major and remote_minor.
3287 from cjwatson AT debian.org; ok markus@
Damien Miller8448e662004-03-08 23:13:15 +11003288 - dtucker@cvs.openbsd.org 2004/03/08 10:18:57
3289 [sshd_config.5]
3290 Document KerberosGetAFSToken; ok markus@
Tim Riceaa538322004-03-08 12:12:18 -08003291 - (tim) [regress/README.regress] Document ssh-rand-helper issue. ok bal
Darren Tucker112aaac2004-03-08 22:13:12 +11003292
Tim Ricef45eff22004-03-07 10:40:01 -0800329320040307
3294 - (tim) [regress/login-timeout.sh] fix building outside of source tree.
3295
Darren Tucker4b385d42004-03-04 19:54:10 +1100329620040304
3297 - (dtucker) [auth-pam.c] Don't try to export PAM when compiled with
3298 -DUSE_POSIX_THREADS. From antoine.verheijen at ualbert ca. ok djm@
Darren Tuckerb9b60212004-03-04 20:03:54 +11003299 - (dtucker) [auth-pam.c] Reset signal status when starting pam auth thread,
3300 prevent hanging during PAM keyboard-interactive authentications. ok djm@
Darren Tucker91bf45c2004-03-04 22:59:36 +11003301 - (dtucker) [auth-passwd.c auth-sia.c auth-sia.h defines.h
3302 openbsd-compat/xcrypt.c] Bug #802: Fix build error on Tru64 when
3303 configured --with-osfsia. ok djm@
Darren Tucker4b385d42004-03-04 19:54:10 +11003304
Darren Tucker6e26bf12004-03-04 19:47:29 +1100330520040303
Damien Miller6c4914a2004-03-03 11:08:59 +11003306 - (djm) [configure.ac ssh-agent.c] Use prctl to prevent ptrace on ssh-agent
3307 ok dtucker
3308
Darren Tuckerd5920482004-02-29 20:11:30 +1100330920040229
Tim Ricead4a1882004-02-29 15:53:37 -08003310 - (tim) [configure.ac] Put back bits mistakenly removed from Rev 1.188
3311
331220040229
Darren Tuckerd5920482004-02-29 20:11:30 +11003313 - (dtucker) OpenBSD CVS Sync
3314 - djm@cvs.openbsd.org 2004/02/25 00:22:45
3315 [sshd.c]
3316 typo in comment
Darren Tuckerfc113c92004-02-29 20:12:33 +11003317 - dtucker@cvs.openbsd.org 2004/02/27 22:42:47
3318 [dh.c]
3319 Prevent sshd from sending DH groups with a primitive generator of zero or
3320 one, even if they are listed in /etc/moduli. ok markus@
Darren Tuckerc56c7ef2004-02-29 20:13:34 +11003321 - dtucker@cvs.openbsd.org 2004/02/27 22:44:56
3322 [dh.c]
3323 Make /etc/moduli line buffer big enough for 8kbit primes, in case anyone
3324 ever uses one. ok markus@
Darren Tuckereffc84c2004-02-29 20:15:08 +11003325 - dtucker@cvs.openbsd.org 2004/02/27 22:49:27
3326 [dh.c]
3327 Reset bit counter at the right time, fixes debug output in the case where
3328 the DH group is rejected. ok markus@
Darren Tucker017fd612004-02-29 20:30:17 +11003329 - dtucker@cvs.openbsd.org 2004/02/17 08:23:20
3330 [regress/Makefile regress/login-timeout.sh]
3331 Add regression test for LoginGraceTime; ok markus@
Darren Tucker03c907a2004-02-29 20:31:08 +11003332 - markus@cvs.openbsd.org 2004/02/24 16:56:30
3333 [regress/test-exec.sh]
3334 allow arguments in ${TEST_SSH_XXX}
Darren Tucker437a5f02004-02-29 20:33:51 +11003335 - markus@cvs.openbsd.org 2004/02/24 17:06:52
3336 [regress/ssh-com-client.sh regress/ssh-com-keygen.sh
3337 regress/ssh-com-sftp.sh regress/ssh-com.sh]
3338 test against recent ssh.com releases
Darren Tucker68b184c2004-02-29 20:37:06 +11003339 - dtucker@cvs.openbsd.org 2004/02/28 12:16:57
3340 [regress/dynamic-forward.sh]
3341 Make dynamic-forward understand nc's new output. ok markus@
Darren Tucker9468ba32004-02-29 20:38:26 +11003342 - dtucker@cvs.openbsd.org 2004/02/28 13:44:45
3343 [regress/try-ciphers.sh]
3344 Test acss too; ok markus@
Darren Tuckerb099d852004-02-29 21:30:05 +11003345 - (dtucker) [regress/try-ciphers.sh] Skip acss if not compiled in (eg if we
3346 built with openssl < 0.9.7)
Darren Tuckerd5920482004-02-29 20:11:30 +11003347
Ben Lindstrom78ffe262004-02-27 03:01:19 +0000334820040226
3349 - (bal) KNF our sshlogin.c even if the code looks nothing like upstream
3350 code due to diversity issues.
3351
Damien Millerd8913952004-02-25 10:56:31 +1100335220040225
3353 - (djm) Trim ChangeLog
Damien Miller124055d2004-02-25 10:57:45 +11003354 - (djm) Don't specify path to PAM modules in Redhat sshd.pam; from Fedora
Damien Millerd8913952004-02-25 10:56:31 +11003355
Darren Tucker37bd3662004-02-24 09:19:15 +1100335620040224
3357 - (dtucker) OpenBSD CVS Sync
3358 - markus@cvs.openbsd.org 2004/02/19 21:15:04
3359 [sftp-server.c]
3360 switch to new license.template
Darren Tuckerefa37062004-02-24 09:20:29 +11003361 - markus@cvs.openbsd.org 2004/02/23 12:02:33
3362 [sshd.c]
3363 backout revision 1.279; set listen socket to non-block; ok henning.
Darren Tucker0acc92a2004-02-24 09:21:41 +11003364 - markus@cvs.openbsd.org 2004/02/23 15:12:46
3365 [bufaux.c]
3366 encode 0 correctly in buffer_put_bignum2; noted by Mikulas Patocka
3367 and drop support for negative BNs; ok otto@
Darren Tuckera6ea4202004-02-24 09:24:01 +11003368 - markus@cvs.openbsd.org 2004/02/23 15:16:46
3369 [version.h]
3370 enter 3.8
Darren Tucker0d27ed12004-02-24 10:37:33 +11003371 - (dtucker) [configure.ac gss-serv-krb5.c ssh-gss.h] Define GSSAPI when found
3372 with krb5-config, hunt down gssapi.h and friends. Based partially on patch
Darren Tucker8a4e4f82004-02-24 10:58:10 +11003373 from deengert at anl.gov. ok djm@
Damien Millera811d9a2004-02-24 13:05:11 +11003374 - (djm) [groupaccess.c uidswap.c] Bug #787: Size group arrays at runtime
3375 using sysconf() if available Based on patches from
3376 holger AT van-lengerich.de and openssh_bugzilla AT hockin.org
Darren Tucker2359aa92004-02-24 13:17:30 +11003377 - (dtucker) [uidswap.c] Minor KNF. ok djm@
Tim Rice18959002004-02-23 20:51:06 -08003378 - (tim) [openbsd-compat/getrrsetbyname.c] Make gcc 2.7.2.3 happy. ok djm@
Damien Miller9fc475f2004-02-24 16:00:02 +11003379 - (djm) Crank RPM spec versions
Darren Tucker5ce131f2004-02-24 16:13:24 +11003380 - (dtucker) [README] Add pointer to release notes. ok djm@
Darren Tucker149543e2004-02-24 16:14:41 +11003381 - (dtucker) {README.platform] Add platform-specific notes.
Tim Ricee8c898a2004-02-23 21:47:04 -08003382 - (tim) [configure.ac] SCO3 needs -lcrypt_i for -lprot
Damien Miller33424702004-02-24 17:13:28 +11003383 - (djm) Release 3.8p1
Darren Tucker37bd3662004-02-24 09:19:15 +11003384
Darren Tucker1825f262004-02-24 00:01:27 +1100338520040223
3386 - (dtucker) [session.c] Bug #789: Only make setcred call for !privsep in the
3387 non-interactive path. ok djm@
3388
Darren Tucker15ee7482004-02-22 09:43:15 +1100338920040222
3390 - (dtucker) [auth-shadow.c auth.c auth.h] Move shadow account expiry test
3391 to auth-shadow.c, no functional change. ok djm@
Darren Tuckere828d0c2004-02-22 11:55:07 +11003392 - (dtucker) [auth-shadow.c auth.h] Provide warnings of impending account or
3393 password expiry. ok djm@
3394 - (dtucker) [auth-passwd.c] Only check password expiry once. Prevents
3395 multiple warnings if a wrong password is entered.
3396 - (dtucker) [configure.ac] Apply krb5-config --libs fix to non-gssapi path
3397 too.
Darren Tucker15ee7482004-02-22 09:43:15 +11003398
Damien Miller2e45cb02004-02-20 20:37:44 +1100339920040220
3400 - (djm) [openbsd-compat/setproctitle.c] fix comments; from grange@
3401
Darren Tuckera22897d2004-02-18 11:21:12 +1100340220040218
3403 - (dtucker) [configure.ac] Handle case where krb5-config --libs returns a
3404 path with a "-" in it. From Sergio.Gelato at astro.su.se.
Damien Millerd7d46bb2004-02-18 14:11:13 +11003405 - (djm) OpenBSD CVS Sync
3406 - djm@cvs.openbsd.org 2004/02/17 07:17:29
3407 [sftp-glob.c sftp.c]
3408 Remove useless headers; ok deraadt@
Damien Miller20e1fab2004-02-18 14:30:55 +11003409 - djm@cvs.openbsd.org 2004/02/17 11:03:08
3410 [sftp.c]
3411 sftp.c and sftp-int.c, together at last; ok markus@
Damien Miller05a75b62004-02-18 14:31:23 +11003412 - jmc@cvs.openbsd.org 2004/02/17 19:35:21
3413 [sshd_config.5]
3414 remove cruft left over from RhostsAuthentication removal;
3415 ok markus@
Damien Miller82c78b32004-02-18 15:42:31 +11003416 - (djm) [log.c] Correct use of HAVE_OPENLOG_R
Damien Miller051b0ac2004-02-18 22:59:43 +11003417 - (djm) [log.c] Tighten openlog_r tests
Darren Tuckera22897d2004-02-18 11:21:12 +11003418
Damien Miller98225c22004-02-17 16:49:41 +1100341920040217
3420 - (djm) Simplify the license on code I have written. No code changes.
Damien Miller4e60ed72004-02-17 17:07:59 +11003421 - (djm) OpenBSD CVS Sync
3422 - djm@cvs.openbsd.org 2004/02/17 05:39:51
3423 [sftp-client.c sftp-client.h sftp-glob.c sftp-glob.h sftp-int.c]
3424 [sftp-int.h sftp.c]
3425 switch to license.template for code written by me (belated, I know...)
Damien Miller34255b92004-02-17 20:33:52 +11003426 - (djm) Bug #698: Specify FILE: for KRB5CCNAME; patch from
3427 stadal@suse.cz and simon@sxw.org.uk
Darren Tuckerba53b832004-02-17 20:46:59 +11003428 - (dtucker) [auth-pam.c] Tidy up PAM debugging. ok djm@
Darren Tucker5cf8ef72004-02-17 23:20:07 +11003429 - (dtucker) [auth-pam.c] Store output from pam_session and pam_setcred for
3430 display after login. Should fix problems like pam_motd not displaying
3431 anything, noticed by cjwatson at debian.org. ok djm@
Damien Miller98225c22004-02-17 16:49:41 +11003432
Tim Rice9ad7e0e2004-02-12 07:17:10 -0800343320040212
3434 - (tim) [Makefile.in regress/sftp-badcmds.sh regress/test-exec.sh]
3435 Portablity fixes. Data sftp transfers needs to be world readable. Some
3436 older shells hang on while loops when doing sh -n some_script. OK dtucker@
Tim Rice3d5352e2004-02-12 09:27:21 -08003437 - (tim) [configure.ac] Make sure -lcrypto is before -lsocket for sco3.
3438 ok mouring@
Tim Rice9ad7e0e2004-02-12 07:17:10 -08003439
Darren Tuckercee6d4c2004-02-11 18:48:52 +1100344020040211
3441 - (dtucker) [auth-passwd.c auth-shadow.c] Only enable shadow expiry check
3442 if HAS_SHADOW_EXPIRY is set.
Tim Rice43fa5572004-02-11 14:46:40 -08003443 - (tim) [configure.ac] Fix comment to match code changes in ver 1.117
Darren Tuckercee6d4c2004-02-11 18:48:52 +11003444
Darren Tuckere3dba822004-02-10 12:50:19 +1100344520040210
3446 - (dtucker) [auth-passwd.c auth.h openbsd-compat/port-aix.c
Darren Tucker9df3def2004-02-10 13:01:14 +11003447 openbsd-compat/port-aix.h] Bug #14: Use do_pwchange to support AIX's
3448 native password expiry.
3449 - (dtucker) [LICENCE Makefile.in auth-passwd.c auth-shadow.c auth.c auth.h
3450 defines.h] Bug #14: Use do_pwchange to support password expiry and force
3451 change for platforms using /etc/shadow. ok djm@
Darren Tuckerffae5322004-02-10 13:05:40 +11003452 - (dtucker) [openbsd-compat/fake-rfc2553.h] Bug #563: Prepend ssh_ to compat
3453 functions to avoid conflicts with Heimdal's libroken. ok djm@
Darren Tucker1921ed92004-02-10 13:23:28 +11003454 - (dtucker) [auth-pam.c auth-pam.h session.c] Bug #14: Use do_pwchange to
3455 change expired PAM passwords for SSHv1 connections without privsep.
3456 pam_chauthtok is still used when privsep is disabled. ok djm@
Darren Tuckercfea2062004-02-10 15:27:34 +11003457 - (dtucker) [openbsd-compat/port-aix.c openbsd-compat/port-aix.h] Move
3458 include from port-aix.h to port-aix.c and remove unnecessary function
3459 definition. Fixes build errors on AIX.
Darren Tuckerc28b88a2004-02-10 16:49:35 +11003460 - (dtucker) [configure.ac loginrec.c] Bug #464: Use updwtmpx on platforms
3461 that support it. from & ok mouring@
Darren Tucker13a707b2004-02-10 17:15:05 +11003462 - (dtucker) [configure.ac] Bug #345: Do not disable utmp on HP-UX 10.x.
Darren Tuckercee6d4c2004-02-11 18:48:52 +11003463 ok djm@
Darren Tuckere3dba822004-02-10 12:50:19 +11003464
Darren Tuckerfc57f712004-02-07 10:41:48 +1100346520040207
3466 - (dtucker) OpenBSD CVS Sync
3467 - dtucker@cvs.openbsd.org 2004/02/06 23:41:13
3468 [cipher-ctr.c]
3469 Use EVP_CIPHER_CTX_key_length for key length. ok markus@
3470 (This will fix builds with OpenSSL 0.9.5)
Darren Tucker693f8a82004-02-07 12:29:39 +11003471 - (dtucker) [cipher.c] enable AES counter modes with OpenSSL 0.9.5.
3472 ok djm@, markus@
Darren Tuckerfc57f712004-02-07 10:41:48 +11003473
Darren Tucker99762462004-02-06 15:22:43 +1100347420040206
3475 - (dtucker) [acss.c acss.h] Fix $Id tags.
Darren Tucker6977fe72004-02-06 15:26:10 +11003476 - (dtucker) [cipher-acss.c cipher.c] Enable acss only if building with
3477 OpenSSL >= 0.9.7. ok djm@
Darren Tuckeref3a4a22004-02-06 15:30:50 +11003478 - (dtucker) [session.c] Bug #789: Do not call do_pam_setcred as a non-root
3479 user, since some modules might fail due to lack of privilege. ok djm@
Darren Tuckerf58fb7e2004-02-06 15:59:06 +11003480 - (dtucker) [configure.ac] Bug #748: Always define BROKEN_GETADDRINFO
3481 for HP-UX 11.11. If there are known-good configs where this is not
3482 required, please report them. ok djm@
Darren Tuckerecc9d462004-02-06 16:04:08 +11003483 - (dtucker) [sshd.c] Bug #757: Clear child's environment to prevent
3484 accidentally inheriting from root's environment. ok djm@
Darren Tucker819d4522004-02-06 16:18:47 +11003485 - (dtucker) [openbsd-compat/port-aix.c openbsd-compat/port-aix.h] Bug #796:
3486 Restore previous authdb setting after auth calls. Fixes problems with
3487 setpcred failing on accounts that use AFS or NIS password registries.
Darren Tucker07459352004-02-06 21:29:41 +11003488 - (dtucker) [configure.ac includes.h] Include <sys/stream.h> if present,
3489 required on Solaris 2.5.1 for queue_t, which is used by <sys/ptms.h>.
Darren Tucker23bc8d02004-02-06 16:24:31 +11003490 - (dtucker) OpenBSD CVS Sync
3491 - markus@cvs.openbsd.org 2004/01/30 09:48:57
3492 [auth-passwd.c auth.h pathnames.h session.c]
3493 support for password change; ok dtucker@
3494 (set password-dead=1w in login.conf to use this).
3495 In -Portable, this is currently only platforms using bsdauth.
Darren Tuckera8be9e22004-02-06 16:40:27 +11003496 - dtucker@cvs.openbsd.org 2004/02/05 05:37:17
3497 [monitor.c sshd.c]
3498 Pass SIGALRM through to privsep child if LoginGraceTime expires. ok markus@
Darren Tucker7f73a492004-02-06 16:41:37 +11003499 - markus@cvs.openbsd.org 2004/02/05 15:33:33
3500 [progressmeter.c]
3501 fix ETA for > 4GB; bugzilla #791; ok henning@ deraadt@
Darren Tucker99762462004-02-06 15:22:43 +11003502
Darren Tucker22991ba2004-01-30 12:58:51 +1100350320040129
3504 - (dtucker) OpenBSD CVS Sync regress/
3505 - dtucker@cvs.openbsd.org 2003/10/11 11:49:49
3506 [Makefile banner.sh]
3507 Test missing banner file, suppression of banner with ssh -q, check return
3508 code from ssh. ok markus@
Darren Tucker633f3e02004-01-30 13:00:29 +11003509 - jmc@cvs.openbsd.org 2003/11/07 10:16:44
3510 [ssh-com.sh]
3511 adress -> address, and a few more; all from Jonathon Gray;
Darren Tucker46662bf2004-01-30 13:02:55 +11003512 - djm@cvs.openbsd.org 2004/01/13 09:49:06
3513 [sftp-batch.sh]
Darren Tuckerdcc736b2004-01-30 14:20:59 +11003514 - (dtucker) [configure.ac] Add --without-zlib-version-check. Feedback from
3515 tim@, ok several
Darren Tucker2df33432004-01-30 14:34:21 +11003516 - (dtucker) [configure.ac openbsd-compat/bsd-cray.c openbsd-compat/bsd-cray.h]
3517 Bug #775: Cray fixes from wendy at cray.com
Darren Tucker22991ba2004-01-30 12:58:51 +11003518
Darren Tucker4f9f6792004-01-28 12:26:14 +1100351920040128
3520 - (dtucker) [regress/README.regress] Add tcpwrappers issue, noted by tim@
Darren Tucker77970692004-01-28 15:44:04 +11003521 - (dtucker) [moduli] Import new moduli file from OpenBSD.
Darren Tucker4f9f6792004-01-28 12:26:14 +11003522
Damien Miller4f0fe682004-01-27 21:19:21 +1100352320040127
3524 - (djm) OpenBSD CVS Sync
3525 - hshoexer@cvs.openbsd.org 2004/01/23 17:06:03
3526 [cipher.c]
3527 enable acss for ssh
3528 ok deraadt@ markus@
Damien Millerb21be842004-01-27 21:20:11 +11003529 - mouring@cvs.openbsd.org 2004/01/23 17:57:48
3530 [sftp-int.c]
3531 Fix issue pointed out with ls not handling large directories
3532 with embeded paths correctly. OK damien@
Damien Millerb2d1c2b2004-01-27 21:20:59 +11003533 - hshoexer@cvs.openbsd.org 2004/01/23 19:26:33
3534 [cipher.c]
3535 rename acss@opebsd.org to acss@openssh.org
3536 ok deraadt@
Damien Millerf6723f02004-01-27 21:21:27 +11003537 - djm@cvs.openbsd.org 2004/01/25 03:49:09
3538 [sshconnect.c]
3539 reset nonblocking flag after ConnectTimeout > 0 connect; (bugzilla #785)
3540 from jclonguet AT free.fr; ok millert@
Damien Millerec692032004-01-27 21:22:00 +11003541 - djm@cvs.openbsd.org 2004/01/27 10:08:10
3542 [sftp.c]
3543 reorder parsing so user:skey@host:file works (bugzilla #777)
3544 patch from admorten AT umich.edu; ok markus@
Damien Miller4f0fe682004-01-27 21:19:21 +11003545 - (djm) [acss.c acss.h cipher-acss.c] Portable support for ACSS
3546 if libcrypto lacks it
3547
Tim Rice3084a612004-01-26 09:37:09 -0800354820040126
3549 - (tim) Typo in regress/README.regress
Tim Riceeafd8e92004-01-26 14:10:10 -08003550 - (tim) [regress/test-exec.sh] RhostsAuthentication is deprecated.
Tim Riceba1c2b82004-01-26 16:02:17 -08003551 - (tim) [defines.h] Add defines for HFIXEDSZ and T_SIG
Tim Rice2597bfd2004-01-26 19:03:39 -08003552 - (tim) [configure.ac includes.h] add <sys/ptms.h> for grantpt() and friends.
Tim Rice01326eb2004-01-26 21:40:35 -08003553 - (tim) [defines.h openbsd-compat/getrrsetbyname.h] Move defines for HFIXEDSZ
3554 and T_SIG to getrrsetbyname.h
Tim Rice3084a612004-01-26 09:37:09 -08003555
Damien Miller68144112004-01-24 13:50:39 +1100355620040124
3557 - (djm) Typo in openbsd-compat/bsd-openpty.c; from wendyp AT cray.com
3558
Damien Millerd3526362004-01-23 14:16:26 +1100355920040123
3560 - (djm) Do pam_session processing for systems with HAVE_LOGIN_CAP; from
3561 ralf.hack AT pipex.net; ok dtucker@
Damien Miller84938142004-01-23 16:30:03 +11003562 - (djm) Bug #776: Update contrib/redhat/openssh.spec to dynamically detect
3563 Kerberos location (and thus work with Fedora Core 1);
3564 from jason AT devrandom.org
Darren Tucker2dcd2392004-01-23 17:13:33 +11003565 - (dtucker) [configure.ac] Bug #788: Test for zlib.h presence and for
3566 zlib >= 1.1.4. Partly from jbasney at ncsa.uiuc.edu. ok djm@
Darren Tucker63699582004-01-23 21:35:44 +11003567 - (dtucker) [contrib/cygwin/README] Document new ssh-host-config options.
3568 Patch from vinschen at redhat.com.
Darren Tucker3c78c5e2004-01-23 22:03:10 +11003569 - (dtucker) [acconfig.h configure.ac includes.h servconf.c session.c]
3570 Change AFS symbol to USE_AFS to prevent namespace collisions, do not
3571 include kafs.h unless necessary. From deengert at anl.gov.
Tim Ricefcb62202004-01-23 18:35:16 -08003572 - (tim) [configure.ac] Remove hard coded -L/usr/local/lib and
3573 -I/usr/local/include. Users can do LDFLAGS="-L/usr/local/lib" \
3574 CPPFLAGS="-I/usr/local/include" ./configure if needed.
Damien Millerd3526362004-01-23 14:16:26 +11003575
Darren Tucker1d3ca582004-01-22 12:05:34 +1100357620040122
3577 - (dtucker) [configure.ac] Use krb5-config where available for Kerberos/
3578 GSSAPI detection, libs and includes. ok djm@
Darren Tucker7fe8b722004-01-22 12:48:26 +11003579 - (dtucker) [session.c] Enable AFS support in conjunction with KRB5 not
3580 just HEIMDAL.
Tim Ricec9001282004-01-22 16:10:03 -08003581 - (tim) [contrib/solaris/buildpkg.sh] Allow for the possibility of
3582 /usr/local being a symbolic link. Fixes problem reported by Henry Grebler.
Darren Tucker1d3ca582004-01-22 12:05:34 +11003583
Damien Miller44f75c12004-01-21 10:58:47 +1100358420040121
3585 - (djm) OpenBSD CVS Sync
3586 - djm@cvs.openbsd.org 2004/01/13 09:25:05
3587 [sftp-int.c sftp.1 sftp.c]
3588 Tidy sftp batchmode handling, eliminate junk to stderr (bugzilla #754) and
3589 enable use of "-b -" to accept batchfile from stdin; ok markus@
Damien Miller86a39682004-01-21 11:00:04 +11003590 - jmc@cvs.openbsd.org 2004/01/13 12:17:33
3591 [sftp.1]
3592 remove unnecessary Ic's;
3593 kill whitespace at EOL;
3594 ok djm@
Damien Miller8f341f82004-01-21 11:00:46 +11003595 - markus@cvs.openbsd.org 2004/01/13 19:23:15
3596 [compress.c session.c]
3597 -Wall; ok henning
Damien Millerf84fed62004-01-21 11:01:23 +11003598 - markus@cvs.openbsd.org 2004/01/13 19:45:15
3599 [compress.c]
3600 cast for portability; millert@
Damien Millera04ad492004-01-21 11:02:09 +11003601 - markus@cvs.openbsd.org 2004/01/19 09:24:21
3602 [channels.c]
3603 fake consumption for half closed channels since the peer is waiting for
3604 window adjust messages; bugzilla #790 Matthew Dillon; test + ok dtucker@
3605 reproduce with sh -c 'ulimit -f 10; ssh host -n od /bsd | cat > foo'
Damien Millerfb1310e2004-01-21 11:02:50 +11003606 - markus@cvs.openbsd.org 2004/01/19 21:25:15
3607 [auth2-hostbased.c auth2-pubkey.c serverloop.c ssh-keysign.c sshconnect2.c]
3608 fix mem leaks; some fixes from Pete Flugstad; tested dtucker@
Damien Millere4f5a822004-01-21 14:11:05 +11003609 - djm@cvs.openbsd.org 2004/01/21 03:07:59
3610 [sftp.c]
3611 initialise infile in main, rather than statically - from portable
Damien Millerf4da3bb2004-01-21 17:07:16 +11003612 - deraadt@cvs.openbsd.org 2004/01/11 21:55:06
3613 [sshpty.c]
3614 for pty opening, only use the openpty() path. the other stuff only needs
3615 to be in openssh-p; markus ok
3616 - (djm) [openbsd-compat/bsd-openpty.c] Rework old sshpty.c code into an
3617 openpty() replacement
Damien Miller44f75c12004-01-21 10:58:47 +11003618
Darren Tucker749bc952004-01-14 22:14:04 +1100361920040114
3620 - (dtucker) [auth-pam.c] Have monitor die if PAM authentication thread exits
3621 unexpectedly. with & ok djm@
Darren Tucker7ae09622004-01-14 23:07:56 +11003622 - (dtucker) [auth-pam.c] Reset signal handler in pthread_cancel too, add
3623 test for case where cleanup has already run.
Darren Tuckera8df9242004-01-15 00:15:07 +11003624 - (dtucker) [auth-pam.c] Add minor debugging.
Darren Tucker749bc952004-01-14 22:14:04 +11003625
Darren Tucker1b27c8f2004-01-13 22:35:58 +1100362620040113
3627 - (dtucker) [auth-pam.c] Relocate struct pam_ctxt and prototypes. No
3628 functional changes.
3629
Darren Tucker0234e862004-01-08 23:32:04 +1100363020040108
3631 - (dtucker) [auth-pam.c defines.h] Bug #783: move __unused to defines.h and
3632 only define if not already. From des at freebsd.org.
Darren Tuckerfd0894a2004-01-09 00:19:25 +11003633 - (dtucker) [configure.ac] Remove extra (typo) comma.
Darren Tucker0234e862004-01-08 23:32:04 +11003634
Darren Tuckere9183182004-01-05 08:16:34 +1100363520040105
3636 - (dtucker) [contrib/ssh-copy-id] Bug #781: exit if ssh fails. Patch from
3637 cjwatson at debian.org.
Darren Tucker409cb322004-01-05 22:36:51 +11003638 - (dtucker) [acconfig.h configure.ac includes.h servconf.c session.c]
3639 Only enable KerberosGetAFSToken if Heimdal's libkafs is found. with jakob@
Darren Tuckere9183182004-01-05 08:16:34 +11003640
Damien Miller7a2ea782004-01-02 17:52:10 +1100364120040102
3642 - (djm) OSX/Darwin needs BIND_8_COMPAT to build getrrsetbyname. Report from
3643 jakob@
Damien Millerc8ec1662004-01-02 17:53:04 +11003644 - (djm) Remove useless DNS support configure summary message. from jakob@
Damien Miller0f47c532004-01-02 18:01:30 +11003645 - (djm) OSX/Darwin put the PAM headers in a different place, detect this.
3646 Report from jakob@
Damien Miller7a2ea782004-01-02 17:52:10 +11003647
Darren Tucker06930c72003-12-31 11:34:51 +1100364820031231
3649 - (dtucker) OpenBSD CVS Sync
3650 - djm@cvs.openbsd.org 2003/12/22 09:16:58
3651 [moduli.c ssh-keygen.1 ssh-keygen.c]
3652 tidy up moduli generation debugging, add -v (verbose/debug) option to
3653 ssh-keygen; ok markus@
Darren Tuckera32e19c2003-12-31 11:36:00 +11003654 - markus@cvs.openbsd.org 2003/12/22 20:29:55
3655 [cipher-3des1.c]
3656 EVP_CIPHER_CTX_cleanup() for the des contexts; pruiksma@freesurf.fr
Darren Tucker22ef5082003-12-31 11:37:34 +11003657 - jakob@cvs.openbsd.org 2003/12/23 16:12:10
3658 [servconf.c servconf.h session.c sshd_config]
3659 implement KerberosGetAFSToken server option. ok markus@, beck@
Darren Tucker0b3b9752003-12-31 11:38:32 +11003660 - millert@cvs.openbsd.org 2003/12/29 16:39:50
3661 [sshd_config]
3662 KeepAlive has been obsoleted, use TCPKeepAlive instead; markus@ OK
Darren Tuckerea287062003-12-31 11:43:24 +11003663 - dtucker@cvs.openbsd.org 2003/12/31 00:24:50
3664 [auth2-passwd.c]
3665 Ignore password change request during password auth (which we currently
3666 don't support) and discard proposed new password. corrections/ok markus@
Darren Tucker2a6b0292003-12-31 14:59:17 +11003667 - (dtucker) [configure.ac] Only test setresuid and setresgid if they exist.
Darren Tucker06930c72003-12-31 11:34:51 +11003668
Darren Tucker3715be32003-12-19 10:58:43 +1100366920031219
3670 - (dtucker) [defines.h] Bug #458: Define SIZE_T_MAX as UINT_MAX if we
3671 typedef size_t ourselves.
3672
Darren Tucker454da0b2003-12-18 12:52:19 +1100367320031218
3674 - (dtucker) [configure.ac] Don't use setre[ug]id on DG-UX, from Tom Orban.
Darren Tucker07705c72003-12-18 15:34:31 +11003675 - (dtucker) [auth-pam.c] Do PAM chauthtok during SSH2 keyboard-interactive
3676 authentication. Partially fixes bug #423. Feedback & ok djm@
Darren Tucker454da0b2003-12-18 12:52:19 +11003677
Damien Millerb5820f42003-12-17 16:27:32 +1100367820031217
3679 - (djm) OpenBSD CVS Sync
3680 - markus@cvs.openbsd.org 2003/12/09 15:28:43
3681 [serverloop.c]
3682 make ClientKeepAlive work for ssh -N, too (no login shell requested).
3683 1) send a bogus channel request if we find a channel
3684 2) send a bogus global request if we don't have a channel
3685 ok + test beck@
Damien Millerb9997192003-12-17 16:29:22 +11003686 - markus@cvs.openbsd.org 2003/12/09 17:29:04
3687 [sshd.c]
3688 fix -o and HUP; ok henning@
Damien Miller9836cf82003-12-17 16:30:06 +11003689 - markus@cvs.openbsd.org 2003/12/09 17:30:05
3690 [ssh.c]
3691 don't modify argv for ssh -o; similar to sshd.c 1.283
Damien Miller12c150e2003-12-17 16:31:10 +11003692 - markus@cvs.openbsd.org 2003/12/09 21:53:37
3693 [readconf.c readconf.h scp.1 servconf.c servconf.h sftp.1 ssh.1]
3694 [ssh_config.5 sshconnect.c sshd.c sshd_config.5]
3695 rename keepalive to tcpkeepalive; the old name causes too much
3696 confusion; ok djm, dtucker; with help from jmc@
Damien Millerd6965512003-12-17 16:31:53 +11003697 - dtucker@cvs.openbsd.org 2003/12/09 23:45:32
3698 [clientloop.c]
3699 Clear exit code when ssh -N is terminated with a SIGTERM. ok markus@
Damien Millerbaafb982003-12-17 16:32:23 +11003700 - markus@cvs.openbsd.org 2003/12/14 12:37:21
3701 [ssh_config.5]
3702 we don't support GSS KEX; from Simon Wilkinson
Damien Miller509b0102003-12-17 16:33:10 +11003703 - markus@cvs.openbsd.org 2003/12/16 15:49:51
3704 [clientloop.c clientloop.h readconf.c readconf.h scp.1 sftp.1 ssh.1]
3705 [ssh.c ssh_config.5]
3706 application layer keep alive (ServerAliveInterval ServerAliveCountMax)
3707 for ssh(1), similar to the sshd(8) option; ok beck@; with help from
3708 jmc and dtucker@
Damien Miller8975ddf2003-12-17 16:33:53 +11003709 - markus@cvs.openbsd.org 2003/12/16 15:51:54
3710 [dh.c]
3711 use <= instead of < in dh_estimate; ok provos/hshoexer;
3712 do not return < DH_GRP_MIN
Darren Tuckere937be32003-12-17 18:53:26 +11003713 - (dtucker) [acconfig.h configure.ac uidswap.c] Bug #645: Check for
3714 setres[ug]id() present but not implemented (eg some Linux/glibc
3715 combinations).
Ben Lindstrom563eb992003-12-18 00:34:06 +00003716 - (bal) [openbsd-compat/bsd-misc.c] unset 'signal' defined if we are
3717 using a real 'signal()' (Noticed by a NeXT Compile)
Damien Millerb5820f42003-12-17 16:27:32 +11003718
Darren Tucker4c568432003-12-09 19:01:51 +1100371920031209
3720 - (dtucker) OpenBSD CVS Sync
3721 - matthieu@cvs.openbsd.org 2003/11/25 23:10:08
3722 [ssh-add.1]
3723 ssh-add doesn't need to be a descendant of ssh-agent. Ok markus@, jmc@.
Darren Tucker37afa9d2003-12-09 19:05:42 +11003724 - djm@cvs.openbsd.org 2003/11/26 21:44:29
3725 [cipher-aes.c]
3726 fix #ifdef before #define; ok markus@
3727 (RCS ID sync only, Portable already had this)
Darren Tucker1fb04252003-12-09 19:07:13 +11003728 - markus@cvs.openbsd.org 2003/12/02 12:15:10
3729 [progressmeter.c]
3730 improvments from andreas@:
3731 * saner speed estimate for transfers that takes less than a second by
3732 rounding the time to 1 second.
3733 * when the transfer is finished calculate the actual total speed
3734 rather than the current speed which is given during the transfer
Darren Tucker3175eb92003-12-09 19:15:11 +11003735 - markus@cvs.openbsd.org 2003/12/02 17:01:15
3736 [channels.c session.c ssh-agent.c ssh.h sshd.c]
3737 use SSH_LISTEN_BACKLOG (=128) in listen(2).
Darren Tucker1cbc4442003-12-09 19:19:38 +11003738 - djm@cvs.openbsd.org 2003/12/07 06:34:18
3739 [moduli.c]
3740 remove unused debugging #define templates
Darren Tucker564f19e2003-12-09 19:18:07 +11003741 - markus@cvs.openbsd.org 2003/12/08 11:00:47
3742 [kexgexc.c]
3743 print requested group size in debug; ok djm
Darren Tucker5cd9d442003-12-10 00:54:38 +11003744 - dtucker@cvs.openbsd.org 2003/12/09 13:52:55
3745 [moduli.c]
3746 Prevent ssh-keygen -T from outputting moduli with a generator of 0, since
3747 they can't be used for Diffie-Hellman. Assistance and ok djm@
Darren Tuckera6153142003-12-10 00:52:37 +11003748 - (dtucker) [ssh-keyscan.c] Sync RCSIDs, missed in SSH_SSFDMAX change below.
Darren Tucker4c568432003-12-09 19:01:51 +11003749
Tim Rice88368a32003-12-08 12:35:59 -0800375020031208
3751 - (tim) [configure.ac] Bug 770. Fix --without-rpath.
3752
Damien Miller927f5272003-11-24 12:57:25 +1100375320031123
3754 - (djm) [canohost.c] Move IPv4inV6 mapped address normalisation to its own
3755 function and call it unconditionally
Damien Millere00074a2003-11-24 13:07:45 +11003756 - (djm) OpenBSD CVS Sync
3757 - djm@cvs.openbsd.org 2003/11/23 23:17:34
3758 [ssh-keyscan.c]
3759 from portable - use sysconf to detect fd limit; ok markus@
3760 (tidy diff by adding SSH_SSFDMAX macro to defines.h)
Damien Millera4b33df2003-11-24 13:09:27 +11003761 - djm@cvs.openbsd.org 2003/11/23 23:18:45
3762 [ssh-keygen.c]
3763 consistency PATH_MAX -> MAXPATHLEN; ok markus@
3764 (RCS ID sync only)
3765 - djm@cvs.openbsd.org 2003/11/23 23:21:21
3766 [scp.c]
3767 from portable: rename clashing variable limit-> limit_rate; ok markus@
3768 (RCS ID sync only)
Damien Millere0113cc2003-11-24 13:10:09 +11003769 - dtucker@cvs.openbsd.org 2003/11/24 00:16:35
3770 [ssh.1 ssh.c]
3771 Make ssh -k mean GSSAPIDelegateCredentials=no. Suggestion & ok markus@
Damien Miller3db2e4d2003-11-24 13:33:34 +11003772 - (djm) Annotate OpenBSD-derived files in openbsd-compat/ with original
3773 source file path (in OpenBSD tree).
Damien Miller927f5272003-11-24 12:57:25 +11003774
Darren Tucker240fdfa2003-11-22 14:10:02 +1100377520031122
3776 - (dtucker) [channels.c] Make AIX write limit code clearer. Suggested by djm@
Darren Tuckerd7634162003-11-22 14:16:56 +11003777 - (dtucker) [auth-passwd.c openbsd-compat/port-aix.c openbsd-compat/port-aix.h]
3778 Move AIX specific password authentication code to port-aix.c, call
3779 authenticate() until reenter flag is clear.
Darren Tucker4e06a1d2003-11-22 14:25:15 +11003780 - (dtucker) [auth-sia.c configure.ac] Tru64 update from cmadams at hiwaay.net.
3781 Use permanently_set_uid for SIA, only define DISABLE_FD_PASSING when SIA
3782 is enabled, rely on SIA to check for locked accounts if enabled. ok djm@
Damien Miller4da295c2003-11-22 14:39:04 +11003783 - (djm) [scp.c] Rename limitbw -> limit_rate to match upstreamed patch
Damien Miller841b9f12003-11-22 14:48:49 +11003784 - (djm) [sftp-int.c] Remove duplicated code from bogus sync
Damien Miller5924ceb2003-11-22 15:02:42 +11003785 - (djm) [packet.c] Shuffle #ifdef to reduce conditionally compiled code
Darren Tucker240fdfa2003-11-22 14:10:02 +11003786
Damien Miller8c5e91c2003-11-21 23:09:10 +1100378720031121
3788 - (djm) OpenBSD CVS Sync
3789 - markus@cvs.openbsd.org 2003/11/20 11:39:28
3790 [progressmeter.c]
3791 fix rounding errors; from andreas@
Damien Millera8e06ce2003-11-21 23:48:55 +11003792 - djm@cvs.openbsd.org 2003/11/21 11:57:03
3793 [everything]
3794 unexpand and delete whitespace at EOL; ok markus@
3795 (done locally and RCS IDs synced)
Damien Miller8c5e91c2003-11-21 23:09:10 +11003796
Darren Tucker18df00c2003-11-18 12:42:07 +1100379720031118
Damien Miller6aef38f2003-11-18 10:45:20 +11003798 - (djm) Fix early exit for root auth success when UsePAM=yes and
3799 PermitRootLogin=no
Darren Tucker18df00c2003-11-18 12:42:07 +11003800 - (dtucker) [auth-pam.c] Convert chauthtok_conv into a generic tty_conv,
Damien Miller4bb1dd32003-11-18 22:01:25 +11003801 and use it for do_pam_session. Fixes problems like pam_motd not
3802 displaying anything. ok djm@
Darren Tucker8a1624c2003-11-18 12:45:35 +11003803 - (dtucker) [auth-pam.c] Only use pam_putenv if our platform has it. ok djm@
Damien Miller4bb1dd32003-11-18 22:01:25 +11003804 - (djm) OpenBSD CVS Sync
3805 - dtucker@cvs.openbsd.org 2003/11/18 00:40:05
3806 [serverloop.c]
3807 Correct check for authctxt->valid. ok djm@
Damien Millerf96d1832003-11-18 22:01:48 +11003808 - djm@cvs.openbsd.org 2003/11/18 10:53:07
3809 [monitor.c]
3810 unbreak fake authloop for non-existent users (my screwup). Spotted and
3811 tested by dtucker@; ok markus@
Damien Miller6aef38f2003-11-18 10:45:20 +11003812
381320031117
Damien Miller3e8f41e2003-11-17 21:09:50 +11003814 - (djm) OpenBSD CVS Sync
3815 - djm@cvs.openbsd.org 2003/11/03 09:03:37
3816 [auth-chall.c]
3817 make this a little more idiot-proof; ok markus@
3818 (includes portable-specific changes)
Damien Miller5a388972003-11-17 21:10:47 +11003819 - jakob@cvs.openbsd.org 2003/11/03 09:09:41
3820 [sshconnect.c]
3821 move changed key warning into warn_changed_key(). ok markus@
Damien Miller8f746ec2003-11-17 21:11:15 +11003822 - jakob@cvs.openbsd.org 2003/11/03 09:37:32
3823 [sshconnect.c]
3824 do not free static type pointer in warn_changed_key()
Damien Miller3e3b5142003-11-17 21:13:40 +11003825 - djm@cvs.openbsd.org 2003/11/04 08:54:09
3826 [auth1.c auth2.c auth2-pubkey.c auth.h auth-krb5.c auth-passwd.c]
3827 [auth-rhosts.c auth-rh-rsa.c auth-rsa.c monitor.c serverloop.c]
3828 [session.c]
3829 standardise arguments to auth methods - they should all take authctxt.
3830 check authctxt->valid rather then pw != NULL; ok markus@
Damien Millera9fcd3a2003-11-17 21:16:55 +11003831 - jakob@cvs.openbsd.org 2003/11/08 16:02:40
3832 [auth1.c]
3833 remove unused variable (pw). ok djm@
3834 (id sync only - still used in portable)
Damien Miller939cd382003-11-17 21:17:24 +11003835 - jmc@cvs.openbsd.org 2003/11/08 19:17:29
3836 [sftp-int.c]
3837 typos from Jonathon Gray;
Damien Millerf58b58c2003-11-17 21:18:23 +11003838 - jakob@cvs.openbsd.org 2003/11/10 16:23:41
3839 [bufaux.c bufaux.h cipher.c cipher.h hostfile.c hostfile.h key.c]
3840 [key.h sftp-common.c sftp-common.h sftp-server.c sshconnect.c sshd.c]
3841 [ssh-dss.c ssh-rsa.c uuencode.c uuencode.h]
3842 constify. ok markus@ & djm@
Damien Millerc1f27922003-11-17 21:19:05 +11003843 - dtucker@cvs.openbsd.org 2003/11/12 10:12:15
3844 [scp.c]
3845 When called with -q, pass -q to ssh; suppresses SSH2 banner. ok markus@
Damien Miller150b5572003-11-17 21:19:29 +11003846 - jakob@cvs.openbsd.org 2003/11/12 16:39:58
3847 [dns.c dns.h readconf.c ssh_config.5 sshconnect.c]
3848 update SSHFP validation. ok markus@
Damien Millerfe448472003-11-17 21:19:49 +11003849 - jmc@cvs.openbsd.org 2003/11/12 20:14:51
3850 [ssh_config.5]
3851 make verb agree with subject, and kill some whitespace;
Damien Miller91c6aa42003-11-17 21:20:18 +11003852 - markus@cvs.openbsd.org 2003/11/14 13:19:09
3853 [sshconnect2.c]
3854 cleanup and minor fixes for the client code; from Simon Wilkinson
Damien Miller51bf11f2003-11-17 21:20:47 +11003855 - djm@cvs.openbsd.org 2003/11/17 09:45:39
3856 [msg.c msg.h sshconnect2.c ssh-keysign.c]
3857 return error on msg send/receive failure (rather than fatal); ok markus@
Damien Miller0425d402003-11-17 22:18:21 +11003858 - markus@cvs.openbsd.org 2003/11/17 11:06:07
3859 [auth2-gss.c gss-genr.c gss-serv.c monitor.c monitor.h monitor_wrap.c]
3860 [monitor_wrap.h sshconnect2.c ssh-gss.h]
3861 replace "gssapi" with "gssapi-with-mic"; from Simon Wilkinson;
3862 test + ok jakob.
Damien Miller9bdba702003-11-17 21:27:55 +11003863 - (djm) Bug #632: Don't call pam_end indirectly from within kbd-int
3864 conversation function
Damien Millerc756e9b2003-11-17 21:41:42 +11003865 - (djm) Export environment variables from authentication subprocess to
3866 parent. Part of Bug #717
Damien Miller3e8f41e2003-11-17 21:09:50 +11003867
Darren Tucker203c40b2003-11-15 12:13:16 +1100386820031115
3869 - (dtucker) [regress/agent-ptrace.sh] Test for GDB output from Solaris and
3870 HP-UX, skip test on AIX.
3871
Darren Tucker0947ddf2003-11-13 11:21:31 +1100387220031113
3873 - (dtucker) [auth-pam.c] Append newlines to lines output by the
3874 pam_chauthtok_conv().
Darren Tucker798ca842003-11-13 11:28:49 +11003875 - (dtucker) [README ssh-host-config ssh-user-config Makefile] (All
3876 contrib/cygwin). Major update from vinschen at redhat.com.
3877 - Makefile provides a `cygwin-postinstall' target to run right after
3878 `make install'.
3879 - Better support for Windows 2003 Server.
3880 - Try to get permissions as correct as possible.
3881 - New command line options to allow full automated host configuration.
3882 - Create configs from skeletons in /etc/defaults/etc.
3883 - Use /bin/bash, allows reading user input with readline support.
3884 - Remove really old configs from /usr/local.
Darren Tuckerae52b7c2003-11-13 19:52:31 +11003885 - (dtucker) [auth-pam.c] Add newline to accumulated PAM_TEXT_INFO and
3886 PAM_ERROR_MSG messages.
Darren Tucker0947ddf2003-11-13 11:21:31 +11003887
Damien Miller418a3862003-11-06 20:27:51 +1100388820031106
3889 - (djm) Clarify UsePAM consequences a little more
3890
Darren Tucker7c582db2003-11-03 18:59:29 +1100389120031103
3892 - (dtucker) [contrib/cygwin/ssh-host-config] Ensure entries in /etc/services
3893 are created correctly with CRLF line terminations. Patch from vinschen at
3894 redhat.com.
Darren Tuckera47c9bc2003-11-03 20:03:25 +11003895 - (dtucker) OpenBSD CVS Sync
3896 - markus@cvs.openbsd.org 2003/10/15 09:48:45
3897 [monitor_wrap.c]
3898 check pmonitor != NULL
Darren Tucker8cc39782003-11-03 20:05:03 +11003899 - markus@cvs.openbsd.org 2003/10/21 09:50:06
3900 [auth2-gss.c]
3901 make sure the doid is larger than 2
Darren Tucker56afe142003-11-03 20:06:14 +11003902 - avsm@cvs.openbsd.org 2003/10/26 16:57:43
3903 [sshconnect2.c]
3904 rename 'supported' static var in userauth_gssapi() to 'gss_supported'
3905 to avoid shadowing the global version. markus@ ok
Darren Tucker6db8f932003-11-03 20:07:14 +11003906 - markus@cvs.openbsd.org 2003/10/28 09:08:06
3907 [misc.c]
3908 error->debug for getsockopt+TCP_NODELAY; several requests
Darren Tucker655a5e02003-11-03 20:09:03 +11003909 - markus@cvs.openbsd.org 2003/11/02 11:01:03
3910 [auth2-gss.c compat.c compat.h sshconnect2.c]
3911 remove support for SSH_BUG_GSSAPI_BER; simon@sxw.org.uk
Darren Tuckerbe8a7712003-11-03 22:52:52 +11003912 - (dtucker) [regress/agent-ptrace.sh] Use numeric uid and gid.
Darren Tucker7c582db2003-11-03 18:59:29 +11003913
Darren Tucker0d37b5c2003-10-21 12:41:14 +1000391420031021
3915 - (dtucker) [INSTALL] Some system crypt() functions support MD5 passwords
3916 directly. Noted by Darren.Moffat at sun.com.
Darren Tuckerea4c6702003-10-21 22:27:08 +10003917 - (dtucker) [regress/agent-ptrace.sh] Skip agent-test unless SUDO is set,
3918 make agent setgid during test.
Darren Tucker0d37b5c2003-10-21 12:41:14 +10003919
Darren Tucker9568ad92003-10-17 16:32:11 +1000392020031017
3921 - (dtucker) [INSTALL] Note that --with-md5 is now required on platforms with
3922 MD5 passwords even if PAM support is enabled. From steev at detritus.net.
3923
Darren Tucker1f203942003-10-15 15:50:42 +1000392420031015
3925 - (dtucker) OpenBSD CVS Sync
3926 - jmc@cvs.openbsd.org 2003/10/08 08:27:36
3927 [scp.1 scp.c sftp-server.8 sftp.1 sftp.c ssh.1 sshd.8]
3928 scp and sftp: add options list and sort options. options list requested
3929 by deraadt@
3930 sshd: use same format as ssh
3931 ssh: remove wrong option from list
3932 sftp-server: Subsystem is documented in ssh_config(5), not sshd(8)
3933 ok deraadt@ markus@
Darren Tuckera044f472003-10-15 15:52:03 +10003934 - markus@cvs.openbsd.org 2003/10/08 15:21:24
3935 [readconf.c ssh_config.5]
3936 default GSS API to no in client, too; ok jakob, deraadt@
Darren Tucker0a118da2003-10-15 15:54:32 +10003937 - markus@cvs.openbsd.org 2003/10/11 08:24:08
3938 [readconf.c readconf.h ssh.1 ssh.c ssh_config.5]
3939 remote x11 clients are now untrusted by default, uses xauth(8) to generate
3940 untrusted cookies; ForwardX11Trusted=yes restores old behaviour.
3941 ok deraadt; feedback and ok djm/fries
Darren Tuckerd05b6012003-10-15 15:55:59 +10003942 - markus@cvs.openbsd.org 2003/10/11 08:26:43
3943 [sshconnect2.c]
3944 search keys in reverse order; fixes #684
Darren Tucker7eb3de02003-10-15 15:56:58 +10003945 - markus@cvs.openbsd.org 2003/10/11 11:36:23
3946 [monitor_wrap.c]
3947 return NULL for missing banner; ok djm@
Darren Tuckerf132c672003-10-15 15:58:18 +10003948 - jmc@cvs.openbsd.org 2003/10/12 13:12:13
3949 [ssh_config.5]
3950 note that EnableSSHKeySign should be in the non-hostspecific section;
3951 remove unnecessary .Pp;
3952 ok markus@
Darren Tuckerb370ca92003-10-15 15:59:26 +10003953 - markus@cvs.openbsd.org 2003/10/13 08:22:25
3954 [scp.1 sftp.1]
3955 don't refer to options related to forwarding; ok jmc@
Darren Tuckerdda19d62003-10-15 16:00:47 +10003956 - jakob@cvs.openbsd.org 2003/10/14 19:42:10
3957 [dns.c dns.h readconf.c ssh-keygen.c sshconnect.c]
3958 include SSHFP lookup code (not enabled by default). ok markus@
Darren Tucker64b77bc2003-10-15 16:07:53 +10003959 - jakob@cvs.openbsd.org 2003/10/14 19:43:23
3960 [README.dns]
3961 update
Darren Tucker072a7b12003-10-15 16:10:25 +10003962 - markus@cvs.openbsd.org 2003/10/14 19:54:39
3963 [session.c ssh-agent.c]
3964 10X for mkdtemp; djm@
Darren Tucker5f88d342003-10-15 16:57:57 +10003965 - (dtucker) [acconfig.h configure.ac dns.c openbsd-compat/getrrsetbyname.c
3966 openbsd-compat/getrrsetbyname.h] DNS fingerprint support is now always
3967 compiled in but disabled in config.
Darren Tuckerc6020652003-10-15 17:48:20 +10003968 - (dtucker) [auth.c] Check for disabled password expiry on HP-UX Trusted Mode.
Tim Rice6b1f8a32003-10-15 09:22:39 -07003969 - (tim) [regress/banner.sh] portability fix.
Darren Tucker1f203942003-10-15 15:50:42 +10003970
Darren Tucker6c0c0702003-10-09 14:13:53 +1000397120031009
3972 - (dtucker) [sshd_config.5] UsePAM defaults to "no". ok djm@
3973
Darren Tucker046dff22003-10-08 17:32:02 +1000397420031008
3975 - (dtucker) OpenBSD CVS Sync
3976 - dtucker@cvs.openbsd.org 2003/10/07 01:47:27
3977 [sshconnect2.c]
Darren Tucker79644822003-10-08 17:37:58 +10003978 Don't use logit for banner, since it truncates to MSGBUFSIZ; bz #668 &
3979 #707. ok markus@
Darren Tucker64dbccc2003-10-08 17:34:38 +10003980 - djm@cvs.openbsd.org 2003/10/07 07:04:16
3981 [sftp-int.c]
3982 sftp quoting fix from admorten AT umich.edu; ok markus@
Darren Tucker79644822003-10-08 17:37:58 +10003983 - deraadt@cvs.openbsd.org 2003/10/07 21:58:28
3984 [sshconnect2.c]
3985 set ptr to NULL after free
Darren Tuckerdc001a52003-10-08 17:47:19 +10003986 - dtucker@cvs.openbsd.org 2003/10/07 01:52:13
3987 [regress/Makefile regress/banner.sh]
3988 Test SSH2 banner. ok markus@
Darren Tucker0240ff72003-10-08 17:52:10 +10003989 - djm@cvs.openbsd.org 2003/10/07 07:04:52
3990 [regress/sftp-cmds.sh]
3991 more sftp quoting regress tests; ok markus
Darren Tucker046dff22003-10-08 17:32:02 +10003992
Damien Miller6f1f6112003-10-07 10:18:22 +1000399320031007
3994 - (djm) Delete autom4te.cache after autoreconf
Darren Tucker8846a072003-10-07 11:30:15 +10003995 - (dtucker) [auth-pam.c auth-pam.h session.c] Make PAM use the new static
3996 cleanup functions. With & ok djm@
Darren Tuckerdfe6d912003-10-07 17:40:56 +10003997 - (dtucker) [contrib/redhat/openssh.spec] Bug #714: Now that UsePAM is a
3998 run-time switch, always build --with-md5-passwords.
Darren Tucker2e8c0cc2003-10-07 17:49:56 +10003999 - (dtucker) [configure.ac openbsd-compat/Makefile.in openbsd-compat/strtoul.c]
4000 Bug #670: add strtoul() to openbsd-compat for platforms lacking it. ok djm@
Darren Tucker3b2a06c2003-10-07 18:37:11 +10004001 - (dtucker) [configure.ac] Bug #715: Set BROKEN_SETREUID and BROKEN_SETREGID
4002 on Reliant Unix. Patch from Robert.Dahlem at siemens.com.
Darren Tucker89df7a32003-10-07 20:35:57 +10004003 - (dtucker) [configure.ac] Bug #710: Check for dlsym() in libdl on
4004 Reliant Unix. Based on patch from Robert.Dahlem at siemens.com.
Damien Miller6f1f6112003-10-07 10:18:22 +10004005
Darren Tucker4a250542003-10-03 17:57:24 +1000400620031003
Darren Tuckerf4bf5d02003-10-07 11:31:22 +10004007 - (dtucker) OpenBSD CVS Sync
Darren Tucker4a250542003-10-03 17:57:24 +10004008 - markus@cvs.openbsd.org 2003/10/02 10:41:59
4009 [sshd.c]
4010 print openssl version, too, several requests; ok henning/djm.
Darren Tuckere3ca82e2003-10-03 18:02:30 +10004011 - markus@cvs.openbsd.org 2003/10/02 08:26:53
4012 [ssh-gss.h]
4013 missing $OpenBSD:; dtucker
Tim Rice30aa44c2003-10-03 22:30:23 -07004014 - (tim) [contrib/caldera/openssh.spec] Remove obsolete --with-ipv4-default
4015 option.
Darren Tucker4a250542003-10-03 17:57:24 +10004016
Darren Tucker3e33cec2003-10-02 16:12:36 +1000401720031002
Darren Tuckerf4bf5d02003-10-07 11:31:22 +10004018 - (dtucker) OpenBSD CVS Sync
Darren Tucker3e33cec2003-10-02 16:12:36 +10004019 - markus@cvs.openbsd.org 2003/09/23 20:17:11
4020 [Makefile.in auth1.c auth2.c auth.c auth.h auth-krb5.c canohost.c
4021 cleanup.c clientloop.c fatal.c gss-serv.c log.c log.h monitor.c monitor.h
4022 monitor_wrap.c monitor_wrap.h packet.c serverloop.c session.c session.h
4023 ssh-agent.c sshd.c]
4024 replace fatal_cleanup() and linked list of fatal callbacks with static
4025 cleanup_exit() function. re-refine cleanup_exit() where appropriate,
4026 allocate sshd's authctxt eary to allow simpler cleanup in sshd.
4027 tested by many, ok deraadt@
Darren Tucker6cc310b2003-10-02 16:15:15 +10004028 - markus@cvs.openbsd.org 2003/09/23 20:18:52
4029 [progressmeter.c]
4030 don't print trailing \0; bug #709; Robert.Dahlem@siemens.com
4031 ok millert/deraadt@
Darren Tucker5dcdd212003-10-02 16:17:00 +10004032 - markus@cvs.openbsd.org 2003/09/23 20:41:11
4033 [channels.c channels.h clientloop.c]
4034 move client only agent code to clientloop.c
Darren Tucker8fca6b52003-10-02 16:18:22 +10004035 - markus@cvs.openbsd.org 2003/09/26 08:19:29
4036 [sshd.c]
4037 no need to set the listen sockets to non-block; ok deraadt@
Darren Tucker61776952003-10-02 16:19:47 +10004038 - jmc@cvs.openbsd.org 2003/09/29 11:40:51
4039 [ssh.1]
4040 - add list of options to -o and .Xr ssh_config(5)
4041 - some other cleanup
4042 requested by deraadt@;
4043 ok deraadt@ markus@
Darren Tuckera49d36e2003-10-02 16:20:54 +10004044 - markus@cvs.openbsd.org 2003/09/29 20:19:57
4045 [servconf.c sshd_config]
4046 GSSAPICleanupCreds -> GSSAPICleanupCredentials
Darren Tucker0ccb59b2003-10-02 16:26:34 +10004047 - (dtucker) [configure.ac] Don't set DISABLE_SHADOW when configuring
4048 --with-pam. ok djm@
Darren Tucker7596d682003-10-02 17:32:30 +10004049 - (dtucker) [ssh-gss.h] Prototype change missed in sync.
Darren Tuckerf391ba62003-10-02 20:07:09 +10004050 - (dtucker) [session.c] Fix bus errors on some 64-bit Solaris configurations.
4051 Based on patches by Matthias Koeppe and Thomas Baden. ok djm@
Darren Tucker3e33cec2003-10-02 16:12:36 +10004052
Ben Lindstromb210aa22003-09-30 23:49:06 +0000405320030930
4054 - (bal) Fix issues in openbsd-compat/realpath.c
4055
Darren Tuckerb88fcc72003-09-25 20:18:33 +1000405620030925
4057 - (dtucker) [configure.ac openbsd-compat/xcrypt.c] Bug #633: Remove
4058 DISABLE_SHADOW for HP-UX, use getspnam instead of getprpwnam. Patch from
4059 michael_steffens at hp.com, ok djm@
Tim Riced4d18152003-09-25 19:04:34 -07004060 - (tim) [sshd_config] UsePAM defaults to no.
Darren Tuckerb88fcc72003-09-25 20:18:33 +10004061
Damien Millerdbb10472003-09-24 08:30:18 +1000406220030924
4063 - (djm) Update version.h and spec files for HEAD
Darren Tuckerbeaf6792003-09-24 20:03:48 +10004064 - (dtucker) [configure.ac] IRIX5 needs the same setre[ug]id defines as IRIX6.
Damien Millerdbb10472003-09-24 08:30:18 +10004065
Darren Tucker782390e2003-09-22 10:58:55 +1000406620030923
Darren Tucker8a49dd12003-09-22 10:59:34 +10004067 - (dtucker) [Makefile.in] Bug #644: Fix "make clean" for out-of-tree
Darren Tucker782390e2003-09-22 10:58:55 +10004068 builds. Portability corrections from tim@.
Tim Rice480ef8d2003-09-21 21:38:11 -07004069 - (dtucker) [configure.ac] Bug #665: uid swapping issues on Mac OS X.
Darren Tucker20379a32003-09-22 11:07:40 +10004070 Patch from max at quendi.de.
Darren Tuckered92b212003-09-22 11:26:16 +10004071 - (dtucker) [configure.ac] Bug #657: uid swapping issues on BSDi.
4072 - (dtucker) [configure.ac] Bug #653: uid swapping issues on Tru64.
Darren Tucker00130112003-09-22 11:40:24 +10004073 - (dtucker) [configure.ac] Bug #693: uid swapping issues on NCR MP-RAS.
4074 Patch from david.haughton at ncr.com
Darren Tuckerbe79af12003-09-22 11:58:21 +10004075 - (dtucker) [configure.ac] Bug #659: uid swapping issues on IRIX 6.
4076 Part of patch supplied by bugzilla-openssh at thewrittenword.com
Darren Tuckerd5e082f2003-09-22 12:08:23 +10004077 - (dtucker) [configure.ac openbsd-compat/fake-rfc2553.c
4078 openbsd-compat/fake-rfc2553.h] Bug #659: Test for and handle systems with
4079 where gai_strerror is defined as "const char *". Part of patch supplied
4080 by bugzilla-openssh at thewrittenword.com
Darren Tucker8daf4b42003-09-22 12:32:00 +10004081 - (dtucker) [contrib/cygwin/README contrib/cygwin/ssh-host-config] Update
4082 ssh-host-config to match current defaults, bump README version. Patch from
4083 vinschen at redhat.com.
Darren Tuckerfbe3b362003-09-22 12:54:37 +10004084 - (dtucker) [uidswap.c] Don't test restoration of uid on Cygwin since the
4085 OS does not support permanently dropping privileges. Patch from
4086 vinschen at redhat.com.
Darren Tucker051c2702003-09-22 13:05:26 +10004087 - (dtucker) [openbsd-compat/port-aix.c] Use correct include for xmalloc.h,
4088 add canohost.h to stop warning. Based on patch from openssh-unix-dev at
4089 thewrittenword.com
Darren Tucker42d30822003-09-22 13:28:36 +10004090 - (dtucker) [INSTALL] Bug #686: Document requirement for zlib 1.1.4 or
4091 higher.
Tim Rice7a74c6b2003-09-21 21:00:59 -07004092 - (tim) Fix typo. s/SETEIUD_BREAKS_SETUID/SETEUID_BREAKS_SETUID/
Tim Rice480ef8d2003-09-21 21:38:11 -07004093 - (tim) [configure.ac] Bug 665: move 3 new AC_DEFINES outside of AC_TRY_RUN.
4094 Report by distler AT golem ph utexas edu.
Darren Tucker220bf132003-09-22 20:41:40 +10004095 - (dtucker) [contrib/aix/pam.conf] Include example pam.conf for AIX from
4096 article by genty at austin.ibm.com, included with the author's permission.
Darren Tuckerbd5361b2003-09-22 20:59:16 +10004097 - (dtucker) OpenBSD CVS Sync
4098 - markus@cvs.openbsd.org 2003/09/18 07:52:54
4099 [sshconnect.c]
4100 missing {}; bug #656; jclonguet at free.fr
Darren Tuckerd2730d32003-09-22 21:00:19 +10004101 - markus@cvs.openbsd.org 2003/09/18 07:54:48
4102 [buffer.c]
4103 protect against double free; #660; zardoz at users.sf.net
Darren Tuckerd1d41b32003-09-22 21:01:27 +10004104 - markus@cvs.openbsd.org 2003/09/18 07:56:05
4105 [authfile.c]
4106 missing buffer_free(&encrypted); #662; zardoz at users.sf.net
Darren Tuckerfb16b242003-09-22 21:04:23 +10004107 - markus@cvs.openbsd.org 2003/09/18 08:49:45
4108 [deattack.c misc.c session.c ssh-agent.c]
4109 more buffer allocation fixes; from Solar Designer; CAN-2003-0682;
4110 ok millert@
Darren Tuckerc0815c92003-09-22 21:05:50 +10004111 - miod@cvs.openbsd.org 2003/09/18 13:02:21
4112 [authfd.c bufaux.c dh.c mac.c ssh-keygen.c]
4113 A few signedness fixes for harmless situations; markus@ ok
Darren Tuckera8151da2003-09-22 21:06:46 +10004114 - markus@cvs.openbsd.org 2003/09/19 09:02:02
4115 [packet.c]
4116 buffer_dump only if PACKET_DEBUG is defined; Jedi/Sector One; pr 3471
Darren Tucker631a4a92003-09-22 21:08:21 +10004117 - markus@cvs.openbsd.org 2003/09/19 09:03:00
4118 [buffer.c]
4119 sign fix in buffer_dump; Jedi/Sector One; pr 3473
Darren Tucker6fa8abd2003-09-22 21:10:21 +10004120 - markus@cvs.openbsd.org 2003/09/19 11:29:40
4121 [ssh-agent.c]
4122 provide a ssh-agent specific fatal() function; ok deraadt
Darren Tucker3d326222003-09-22 21:11:20 +10004123 - markus@cvs.openbsd.org 2003/09/19 11:30:39
4124 [ssh-keyscan.c]
4125 avoid fatal_cleanup, just call exit(); ok deraadt
Darren Tucker3dbff2a2003-09-22 21:12:56 +10004126 - markus@cvs.openbsd.org 2003/09/19 11:31:33
4127 [channels.c]
4128 do not call channel_free_all on fatal; ok deraadt
Darren Tuckeraaa56cb2003-09-22 21:13:59 +10004129 - markus@cvs.openbsd.org 2003/09/19 11:33:09
4130 [packet.c sshd.c]
4131 do not call packet_close on fatal; ok deraadt
Darren Tucker8654d162003-09-22 21:14:55 +10004132 - markus@cvs.openbsd.org 2003/09/19 17:40:20
4133 [scp.c]
4134 error handling for remote-remote copy; #638; report Harald Koenig;
4135 ok millert, fgs, henning, deraadt
Darren Tucker9a2c4cd2003-09-22 21:16:05 +10004136 - markus@cvs.openbsd.org 2003/09/19 17:43:35
4137 [clientloop.c sshtty.c sshtty.h]
4138 remove fatal callbacks from client code; ok deraadt
Ben Lindstromda4d9cf2003-09-22 15:36:15 +00004139 - (bal) "extration" -> "extraction" in ssh-rand-helper.c; repoted by john
4140 on #unixhelp@efnet
Tim Rice7ff4e6d2003-09-22 19:50:14 -07004141 - (tim) [configure.ac] add --disable-etc-default-login option. ok djm
Damien Miller5c3a5582003-09-23 22:12:38 +10004142 - (djm) Sync with V_3_7 branch:
4143 - (djm) Fix SSH1 challenge kludge
4144 - (djm) Bug #671: Fix builds on OpenBSD
4145 - (djm) Bug #676: Fix PAM stack corruption
4146 - (djm) Fix bad free() in PAM code
4147 - (djm) Don't call pam_end before pam_init
4148 - (djm) Enable build with old OpenSSL again
4149 - (djm) Trim deprecated options from INSTALL. Mention UsePAM
4150 - (djm) Fix quote handling in sftp; Patch from admorten AT umich.edu
Darren Tucker782390e2003-09-22 10:58:55 +10004151
Damien Millerdcf4ca12006-03-15 13:07:48 +11004152$Id: ChangeLog,v 1.4209 2006/03/15 02:07:48 djm Exp $