Damien Miller [Fri, 18 Jan 2013 00:44:04 +0000 (11:44 +1100)]
- djm@cvs.openbsd.org 2013/01/17 23:00:01
[auth.c key.c key.h ssh-keygen.1 ssh-keygen.c sshd_config.5]
[krl.c krl.h PROTOCOL.krl]
add support for Key Revocation Lists (KRLs). These are a compact way to
represent lists of revoked keys and certificates, taking as little as
a single bit of incremental cost to revoke a certificate by serial number.
KRLs are loaded via the existing RevokedKeys sshd_config option.
feedback and ok markus@
Damien Miller [Wed, 9 Jan 2013 05:12:19 +0000 (16:12 +1100)]
- markus@cvs.openbsd.org 2013/01/08 18:49:04
[PROTOCOL authfile.c cipher.c cipher.h kex.c kex.h monitor_wrap.c]
[myproposal.h packet.c ssh_config.5 sshd_config.5]
support AES-GCM as defined in RFC 5647 (but with simpler KEX handling)
ok and feedback djm@
Damien Miller [Wed, 9 Jan 2013 04:57:36 +0000 (15:57 +1100)]
- djm@cvs.openbsd.org 2013/01/03 12:54:49
[sftp-server.8 sftp-server.c]
allow specification of an alternate start directory for sftp-server(8)
"I like this" markus@
Damien Miller [Wed, 9 Jan 2013 04:56:45 +0000 (15:56 +1100)]
- djm@cvs.openbsd.org 2013/01/03 05:49:36
[servconf.h]
add a couple of ServerOptions members that should be copied to the privsep
child (for consistency, in this case they happen only to be accessed in
the monitor); ok dtucker@
Damien Miller [Wed, 9 Jan 2013 04:56:13 +0000 (15:56 +1100)]
- djm@cvs.openbsd.org 2013/01/02 00:33:49
[PROTOCOL.agent]
correct format description for SSH_AGENTC_ADD_RSA_ID_CONSTRAINED
bz#2051 from david AT lechnology.com
Damien Miller [Wed, 9 Jan 2013 04:55:50 +0000 (15:55 +1100)]
- djm@cvs.openbsd.org 2013/01/02 00:32:07
[clientloop.c mux.c]
channel_setup_local_fwd_listener() returns 0 on failure, not -ve
bz#2055 reported by mathieu.lacage AT gmail.com
Damien Miller [Wed, 12 Dec 2012 20:18:59 +0000 (07:18 +1100)]
- markus@cvs.openbsd.org 2012/12/12 16:45:52
[packet.c]
reset incoming_packet buffer for each new packet in EtM-case, too;
this happens if packets are parsed only parially (e.g. ignore
messages sent when su/sudo turn off echo); noted by sthen/millert
Damien Miller [Tue, 11 Dec 2012 23:46:31 +0000 (10:46 +1100)]
- markus@cvs.openbsd.org 2012/12/11 22:31:18
[PROTOCOL authfile.c cipher.c cipher.h kex.h mac.c myproposal.h]
[packet.c ssh_config.5 sshd_config.5]
add encrypt-then-mac (EtM) modes to openssh by defining new mac algorithms
that change the packet format and compute the MAC over the encrypted
message (including the packet size) instead of the plaintext data;
these EtM modes are considered more secure and used by default.
feedback and ok djm@
Damien Miller [Tue, 11 Dec 2012 23:44:38 +0000 (10:44 +1100)]
- markus@cvs.openbsd.org 2012/12/11 22:16:21
[monitor.c]
drain the log messages after receiving the keystate from the unpriv
child. otherwise it might block while sending. ok djm@
Darren Tucker [Fri, 7 Dec 2012 02:07:46 +0000 (13:07 +1100)]
- dtucker@cvs.openbsd.org 2012/12/07 01:51:35
[serverloop.c]
Cast signal to int for logging. A no-op on openbsd (they're always ints)
but will prevent warnings in portable. ok djm@
Darren Tucker [Fri, 7 Dec 2012 02:03:10 +0000 (13:03 +1100)]
- dtucker@cvs.openbsd.org 2012/12/06 06:06:54
[regress/keys-command.sh]
Fix some problems with the keys-command test:
- use string comparison rather than numeric comparison
- check for existing KEY_COMMAND file and don't clobber if it exists
- clean up KEY_COMMAND file if we do create it.
- check that KEY_COMMAND is executable (which it won't be if eg /var/run
is mounted noexec).
ok djm.
Damien Miller [Sun, 2 Dec 2012 23:08:25 +0000 (10:08 +1100)]
- dtucker@cvs.openbsd.org 2012/10/05 02:20:48
[regress/cipher-speed.sh regress/try-ciphers.sh]
Add umac-128@openssh.com to the list of MACs to be tested
Damien Miller [Sun, 2 Dec 2012 22:53:20 +0000 (09:53 +1100)]
- djm@cvs.openbsd.org 2012/12/02 20:34:10
[auth.c auth.h auth1.c auth2-chall.c auth2-gss.c auth2-jpake.c auth2.c]
[monitor.c monitor.h]
Fixes logging of partial authentication when privsep is enabled
Previously, we recorded "Failed xxx" since we reset authenticated before
calling auth_log() in auth2.c. This adds an explcit "Partial" state.
Add a "submethod" to auth_log() to report which submethod is used
for keyboard-interactive.
Fix multiple authentication when one of the methods is
keyboard-interactive.
Damien Miller [Sun, 2 Dec 2012 22:50:54 +0000 (09:50 +1100)]
- djm@cvs.openbsd.org 2012/12/02 20:46:11
[auth-options.c channels.c servconf.c servconf.h serverloop.c session.c]
[sshd_config.5]
make AllowTcpForwarding accept "local" and "remote" in addition to its
current "yes"/"no" to allow the server to specify whether just local or
remote TCP forwarding is enabled. ok markus@
Damien Miller [Sun, 2 Dec 2012 22:50:24 +0000 (09:50 +1100)]
- djm@cvs.openbsd.org 2012/12/02 20:42:15
[ssh-add.1 ssh-add.c]
make deleting explicit keys "ssh-add -d" symmetric with adding keys -
try to delete the corresponding certificate too and respect the -k option
to allow deleting of the key only; feedback and ok markus@
Damien Miller [Sun, 2 Dec 2012 22:49:52 +0000 (09:49 +1100)]
- djm@cvs.openbsd.org 2012/12/02 20:26:11
[ssh_config.5 sshconnect2.c]
Make IdentitiesOnly apply to keys obtained from a PKCS11Provider.
This allows control of which keys are offered from tokens using
IdentityFile. ok markus@
Damien Miller [Tue, 6 Nov 2012 21:36:00 +0000 (08:36 +1100)]
- jmc@cvs.openbsd.org 2012/09/26 17:34:38
[moduli.5]
last stage of rfc changes, using consistent Rs/Re blocks, and moving the
references into a STANDARDS section;
Darren Tucker [Mon, 5 Nov 2012 06:04:37 +0000 (17:04 +1100)]
- (dtucker) [uidswap.c openbsd-compat/Makefile.in
openbsd-compat/bsd-setres_id.c openbsd-compat/bsd-setres_id.h
openbsd-compat/openbsd-compat.h] Move the fallback code for setting uids
and gids from uidswap.c to the compat library, which allows it to work with
the new setresuid calls in auth2-pubkey. with tim@, ok djm@
Damien Miller [Sun, 4 Nov 2012 12:21:40 +0000 (23:21 +1100)]
- djm@cvs.openbsd.org 2012/11/04 11:09:15
[auth.h auth1.c auth2.c monitor.c servconf.c servconf.h sshd.c]
[sshd_config.5]
Support multiple required authentication via an AuthenticationMethods
option. This option lists one or more comma-separated lists of
authentication method names. Successful completion of all the methods in
any list is required for authentication to complete;
feedback and ok markus@
Damien Miller [Sun, 4 Nov 2012 11:23:14 +0000 (22:23 +1100)]
- djm@cvs.openbsd.org 2012/11/04 10:38:43
[auth2-pubkey.c sshd.c sshd_config.5]
Remove default of AuthorizedCommandUser. Administrators are now expected
to explicitly specify a user. feedback and ok markus@
Damien Miller [Tue, 30 Oct 2012 21:58:58 +0000 (08:58 +1100)]
- djm@cvs.openbsd.org 2012/10/30 21:29:55
[auth-rsa.c auth.c auth.h auth2-pubkey.c servconf.c servconf.h]
[sshd.c sshd_config sshd_config.5]
new sshd_config option AuthorizedKeysCommand to support fetching
authorized_keys from a command in addition to (or instead of) from
the filesystem. The command is run as the target server user unless
another specified via a new AuthorizedKeysCommandUser option.
patch originally by jchadima AT redhat.com, reworked by me; feedback
and ok markus@
Darren Tucker [Fri, 5 Oct 2012 02:04:10 +0000 (12:04 +1000)]
- dtucker@cvs.openbsd.org 2012/09/10 01:51:19
[regress/multiplex.sh]
use -Ocheck and waiting for completions by PID to make multiplexing test
less racy and (hopefully) more reliable on slow hardware.
Darren Tucker [Fri, 5 Oct 2012 01:45:39 +0000 (11:45 +1000)]
- dtucker@cvs.openbsd.org 2012/09/10 00:49:21
[regress/multiplex.sh]
Log -O cmd output to the log file and make logging consistent with the
other tests. Test clean shutdown of an existing channel when testing
"stop".
Darren Tucker [Fri, 5 Oct 2012 01:02:39 +0000 (11:02 +1000)]
- markus@cvs.openbsd.org 2012/10/04 13:21:50
[myproposal.h ssh_config.5 umac.h sshd_config.5 ssh.1 sshd.8 mac.c]
add umac128 variant; ok djm@ at n2k12
(note: further Makefile work is required)
Darren Tucker [Fri, 5 Oct 2012 00:50:15 +0000 (10:50 +1000)]
- jmc@cvs.openbsd.org 2012/09/26 16:12:13
[ssh.1]
last stage of rfc changes, using consistent Rs/Re blocks, and moving the
references into a STANDARDS section;
Darren Tucker [Fri, 5 Oct 2012 00:46:16 +0000 (10:46 +1000)]
- dtucker@cvs.openbsd.org 2012/09/21 10:55:04
[sftp.c]
Fix handling of filenames containing escaped globbing characters and
escape "#" and "*". Patch from Jean-Marc Robert via tech@, ok djm.
Darren Tucker [Fri, 5 Oct 2012 00:45:01 +0000 (10:45 +1000)]
- dtucker@cvs.openbsd.org 2012/09/21 10:53:07
[sftp.c]
Fix improper handling of absolute paths when PWD is part of the completed
path. Patch from Jean-Marc Robert via tech@, ok djm.
Darren Tucker [Fri, 5 Oct 2012 00:43:58 +0000 (10:43 +1000)]
- dtucker@cvs.openbsd.org 2012/09/18 10:36:12
[sftp.c]
Add bounds check on sftp tab-completion. Part of a patch from from
Jean-Marc Robert via tech@, ok djm
Darren Tucker [Fri, 7 Sep 2012 06:38:53 +0000 (16:38 +1000)]
- dtucker@cvs.openbsd.org 2012/09/07 06:34:21
[clientloop.c]
when muxmaster is run with -N, make it shut down gracefully when a client
sends it "-O stop" rather than hanging around (bz#1985). ok djm@
Darren Tucker [Fri, 7 Sep 2012 01:20:20 +0000 (11:20 +1000)]
- dtucker@cvs.openbsd.org 2012/09/06 09:50:13
[clientloop.c]
Make the escape command help (~?) context sensitive so that only commands
that will work in the current session are shown. ok markus@
(note: previous commit with this description was a mistake on my part while
pulling changes from OpenBSD)
Darren Tucker [Thu, 6 Sep 2012 11:26:34 +0000 (21:26 +1000)]
- dtucker@cvs.openbsd.org 2012/09/06 09:50:13
[clientloop.c]
Make the escape command help (~?) context sensitive so that only commands
that will work in the current session are shown. ok markus@
Darren Tucker [Thu, 6 Sep 2012 11:25:37 +0000 (21:25 +1000)]
- dtucker@cvs.openbsd.org 2012/09/06 04:37:39
[clientloop.c log.c ssh.1 log.h]
Add ~v and ~V escape sequences to raise and lower the logging level
respectively. Man page help from jmc, ok deraadt jmc
Darren Tucker [Thu, 6 Sep 2012 11:21:56 +0000 (21:21 +1000)]
- djm@cvs.openbsd.org 2012/08/17 01:30:00
[compat.c sshconnect.c]
Send client banner immediately, rather than waiting for the server to
move first for SSH protocol 2 connections (the default). Patch based on
one in bz#1999 by tls AT panix.com, feedback dtucker@ ok markus@
Darren Tucker [Thu, 6 Sep 2012 11:19:51 +0000 (21:19 +1000)]
- djm@cvs.openbsd.org 2012/08/17 01:22:56
[kex.c]
add some comments about better handling first-KEX-follows notifications
from the server. Nothing uses these right now. No binary change
Darren Tucker [Thu, 6 Sep 2012 11:19:05 +0000 (21:19 +1000)]
- dtucker@cvs.openbsd.org 2012/08/17 00:45:45
[clientloop.c clientloop.h mux.c]
Force a clean shutdown of ControlMaster client sessions when the ~. escape
sequence is used. This means that ~. should now work in mux clients even
if the server is no longer responding. Found by tedu, ok djm.
Darren Tucker [Thu, 6 Sep 2012 11:18:11 +0000 (21:18 +1000)]
- jmc@cvs.openbsd.org 2012/08/15 18:25:50
[ssh-keygen.1]
a little more info on certificate validity;
requested by Ross L Richardson, and provided by djm
projects / thirdparty / openssh-portable.git / log
