]> andersk Git - openssh.git/blame - ChangeLog
- djm@cvs.openbsd.org 2007/10/24 03:44:02
[openssh.git] / ChangeLog
CommitLineData
73209290 120071026
2 - (djm) OpenBSD CVS Sync
3 - stevesk@cvs.openbsd.org 2007/09/11 23:49:09
4 [sshpty.c]
5 remove #if defined block not needed; ok markus@ dtucker@
6 (NB. RCD ID sync only for portable)
530c2ec0 7 - djm@cvs.openbsd.org 2007/09/21 03:05:23
8 [ssh_config.5]
9 document KbdInteractiveAuthentication in ssh_config.5;
10 patch from dkg AT fifthhorseman.net
a3d3770c 11 - djm@cvs.openbsd.org 2007/09/21 08:15:29
12 [auth-bsdauth.c auth-passwd.c auth.c auth.h auth1.c auth2-chall.c]
13 [monitor.c monitor_wrap.c]
14 unifdef -DBSD_AUTH
15 unifdef -USKEY
16 These options have been in use for some years;
17 ok markus@ "no objection" millert@
18 (NB. RCD ID sync only for portable)
18660b86 19 - canacar@cvs.openbsd.org 2007/09/25 23:48:57
20 [ssh-agent.c]
21 When adding a key that already exists, update the properties
22 (time, confirm, comment) instead of discarding them. ok djm@ markus@
5e4fce9c 23 - ray@cvs.openbsd.org 2007/09/27 00:15:57
24 [dh.c]
25 Don't return -1 on error in dh_pub_is_valid(), since it evaluates
26 to true.
27 Also fix a typo.
28 Initial diff from Matthew Dempsky, input from djm.
29 OK djm, markus.
e05f182e 30 - dtucker@cvs.openbsd.org 2007/09/29 00:25:51
31 [auth2.c]
32 Remove unused prototype. ok djm@
3e2d9453 33 - chl@cvs.openbsd.org 2007/10/02 17:49:58
34 [ssh-keygen.c]
35 handles zero-sized strings that fgets can return
c5b78b8e 36 properly removes trailing newline
37 removes an unused variable
38 correctly counts line number
39 "looks ok" ray@ markus@
c462cd6f 40 - markus@cvs.openbsd.org 2007/10/22 19:10:24
41 [readconf.c]
42 make sure that both the local and remote port are correct when
43 parsing -L; Jan Pechanec (bz #1378)
a733c71c 44 - djm@cvs.openbsd.org 2007/10/24 03:30:02
45 [sftp.c]
46 rework argument splitting and parsing to cope correctly with common
47 shell escapes and make handling of escaped characters consistent
48 with sh(1) and between sftp commands (especially between ones that
49 glob their arguments and ones that don't).
50 parse command flags using getopt(3) rather than hand-rolled parsers.
51 ok dtucker@
99b49072 52 - djm@cvs.openbsd.org 2007/10/24 03:44:02
53 [scp.c]
54 factor out network read/write into an atomicio()-like function, and
55 use it to handle short reads, apply bandwidth limits and update
56 counters. make network IO non-blocking, so a small trickle of
57 reads/writes has a chance of updating the progress meter; bz #799
58 ok dtucker@
49e0d774 59 - djm@cvs.openbsd.org 2006/08/29 09:44:00
60 [regress/sftp-cmds.sh]
61 clean up our mess
04ebbaad 62 - markus@cvs.openbsd.org 2006/11/06 09:27:43
63 [regress/cfgmatch.sh]
64 fix quoting for non-(c)sh login shells.
1c158420 65 - dtucker@cvs.openbsd.org 2006/12/13 08:36:36
66 [regress/cfgmatch.sh]
67 Additional test for multiple PermitOpen entries. ok djm@
ac01e61a 68 - pvalchev@cvs.openbsd.org 2007/06/07 19:41:46
69 [regress/cipher-speed.sh regress/try-ciphers.sh]
70 test umac-64@openssh.com
71 ok djm@
ba59fd15 72 - djm@cvs.openbsd.org 2007/10/24 03:32:35
73 [regress/sftp-cmds.sh regress/sftp-glob.sh regress/test-exec.sh]
74 comprehensive tests for sftp escaping its interaction with globbing;
75 ok dtucker@
2432048a 76 - djm@cvs.openbsd.org 2007/10/26 05:30:01
77 [regress/sftp-glob.sh regress/test-exec.sh]
78 remove "echo -E" crap that I added in last commit and use printf(1) for
79 cases where we strictly require echo not to reprocess escape characters.
a556beb5 80 - (djm) [regress/sftp-cmds.sh]
81 Use more restrictive glob to pick up test files from /bin - some platforms
82 ship broken symlinks there which could spoil the test.
530c2ec0 83
8aa5db7d 8420070927
85 - (dtucker) [configure.ac atomicio.c] Fall back to including <sys/poll.h> if
86 we don't have <poll.h> (eq QNX). From bacon at cs nyu edu.
86996ebe 87 - (dtucker) [configure.ac defines.h] Shadow expiry does not work on QNX6
88 so disable it for that platform. From bacon at cs nyu edu.
8aa5db7d 89
9e994eff 9020070921
91 - (djm) [atomicio.c] Fix spin avoidance for platforms that define
92 EWOULDBLOCK; patch from ben AT psc.edu
93
590c0dda 9420070917
95 - (djm) OpenBSD CVS Sync
96 - djm@cvs.openbsd.org 2007/08/23 02:49:43
97 [auth-passwd.c auth.c session.c]
98 unifdef HAVE_LOGIN_CAP; ok deraadt@ millert@
99 NB. RCS ID sync only for portable
466143fd 100 - djm@cvs.openbsd.org 2007/08/23 02:55:51
101 [auth-passwd.c auth.c session.c]
102 missed include bits from last commit
103 NB. RCS ID sync only for portable
2aa63b7b 104 - djm@cvs.openbsd.org 2007/08/23 03:06:10
105 [auth.h]
106 login_cap.h doesn't belong here
107 NB. RCS ID sync only for portable
ba8cfba6 108 - djm@cvs.openbsd.org 2007/08/23 03:22:16
109 [auth2-none.c sshd_config sshd_config.5]
110 Support "Banner=none" to disable displaying of the pre-login banner;
111 ok dtucker@ deraadt@
3af8ef1e 112 - djm@cvs.openbsd.org 2007/08/23 03:23:26
113 [sshconnect.c]
114 Execute ProxyCommands with $SHELL rather than /bin/sh unconditionally
8de7aaab 115 - djm@cvs.openbsd.org 2007/09/04 03:21:03
116 [clientloop.c monitor.c monitor_fdpass.c monitor_fdpass.h]
117 [monitor_wrap.c ssh.c]
118 make file descriptor passing code return an error rather than call fatal()
119 when it encounters problems, and use this to make session multiplexing
120 masters survive slaves failing to pass all stdio FDs; ok markus@
71300a43 121 - djm@cvs.openbsd.org 2007/09/04 11:15:56
122 [ssh.c sshconnect.c sshconnect.h]
123 make ssh(1)'s ConnectTimeout option apply to both the TCP connection and
124 SSH banner exchange (previously it just covered the TCP connection).
125 This allows callers of ssh(1) to better detect and deal with stuck servers
126 that accept a TCP connection but don't progress the protocol, and also
127 makes ConnectTimeout useful for connections via a ProxyCommand;
128 feedback and "looks ok" markus@
269cfc8a 129 - sobrado@cvs.openbsd.org 2007/09/09 11:38:01
130 [ssh-add.c ssh-agent.1 ssh-agent.c ssh-keygen.c]
131 sort synopsis and options in ssh-agent(1); usage is lowercase
132 ok jmc@
39fa9566 133 - stevesk@cvs.openbsd.org 2007/09/11 04:36:29
134 [sshpty.c]
135 sort #include
136 NB. RCS ID sync only
b05117ac 137 - gilles@cvs.openbsd.org 2007/09/11 15:47:17
138 [session.c ssh-keygen.c sshlogin.c]
139 use strcspn to properly overwrite '\n' in fgets returned buffer
140 ok pyr@, ray@, millert@, moritz@, chl@
f119adf5 141 - stevesk@cvs.openbsd.org 2007/09/11 23:49:09
142 [sshpty.c]
143 remove #if defined block not needed; ok markus@ dtucker@
144 NB. RCS ID sync only
7cfacf5e 145 - stevesk@cvs.openbsd.org 2007/09/12 19:39:19
146 [umac.c]
147 use xmalloc() and xfree(); ok markus@ pvalchev@
f8f7ecf5 148 - djm@cvs.openbsd.org 2007/09/13 04:39:04
149 [sftp-server.c]
150 fix incorrect test when setting syslog facility; from Jan Pechanec
9e7f4c4f 151 - djm@cvs.openbsd.org 2007/09/16 00:55:52
152 [sftp-client.c]
153 use off_t instead of u_int64_t for file offsets, matching what the
154 progressmeter code expects; bz #842
7bf7b86c 155 - (tim) [defines.h] Fix regression in long password support on OpenServer 6.
156 Problem report and additional testing rac AT tenzing.org.
590c0dda 157
e5fe7821 15820070914
159 - (dtucker) [openbsd-compat/bsd-asprintf.c] Plug mem leak in error path.
160 Patch from Jan.Pechanec at sun com.
161
822e80ce 16220070910
163 - (dtucker) [openbsd-compat/regress/closefromtest.c] Bug #1358: Always
164 return 0 on successful test. From David.Leonard at quest com.
d837615a 165 - (tim) [configure.ac] Autoconf didn't define HAVE_LIBIAF because we
166 did a AC_CHECK_FUNCS within the AC_CHECK_LIB test.
822e80ce 167
145707ab 16820070817
169 - (dtucker) [sshd.8] Many Linux variants use a single "!" to denote locked
170 accounts and that's what the code looks for, so make man page and code
171 agree. Pointed out by Roumen Petrov.
85eed7c2 172 - (dtucker) [INSTALL] Group the parts describing random options and PAM
173 implementations together which is hopefully more coherent.
3d1d89ea 174 - (dtucker) [INSTALL] the pid file is sshd.pid not ssh.pid.
49f63a45 175 - (dtucker) [INSTALL] Give PAM its own heading.
3c4db087 176 - (dtucker) [INSTALL] Link to tcpwrappers.
145707ab 177
8d5728b7 17820070816
179 - (dtucker) [session.c] Call PAM cleanup functions for unauthenticated
180 connections too. Based on a patch from Sandro Wefel, with & ok djm@
181
ed64eeca 18220070815
183 - (dtucker) OpenBSD CVS Sync
184 - markus@cvs.openbsd.org 2007/08/15 08:14:46
185 [clientloop.c]
186 do NOT fall back to the trused x11 cookie if generation of an untrusted
9c36d7f7 187 cookie fails; from Jan Pechanec, via security-alert at sun.com;
188 ok dtucker
3f921d0e 189 - markus@cvs.openbsd.org 2007/08/15 08:16:49
190 [version.h]
191 openssh 4.7
1ce8114b 192 - stevesk@cvs.openbsd.org 2007/08/15 12:13:41
193 [ssh_config.5]
194 tun device forwarding now honours ExitOnForwardFailure; ok markus@
06d20497 195 - (dtucker) [openbsd-compat/bsd-cray.c] Remove debug from signal handler.
196 ok djm@
4671cc21 197 - (dtucker) [README contrib/caldera/openssh.spec contrib/redhat/openssh.spec
198 contrib/suse/openssh.spec] Crank version.
ed64eeca 199
265edd5e 20020070813
201 - (dtucker) [session.c] Bug #1339: ensure that pam_setcred() is always
202 called with PAM_ESTABLISH_CRED at least once, which resolves a problem
203 with pam_dhkeys. Patch from David Leonard, ok djm@
204
6b3e6430 20520070810
206 - (dtucker) [auth-pam.c] Use sigdie here too. ok djm@
575ee4c4 207 - (dtucker) [configure.ac] Bug #1343: Set DISABLE_FD_PASSING for QNX6. From
208 Matt Kraai, ok djm@
6b3e6430 209
86c718e3 21020070809
211 - (dtucker) [openbsd-compat/port-aix.c] Comment typo.
549d7c4d 212 - (dtucker) [README.platform] Document the interaction between PermitRootLogin
213 and the AIX native login restrictions.
929a784c 214 - (dtucker) [defines.h] Remove _PATH_{CSHELL,SHELLS} which aren't
215 used anywhere and are a potential source of warnings.
86c718e3 216
1b73b60e 21720070808
218 - (djm) OpenBSD CVS Sync
219 - ray@cvs.openbsd.org 2007/07/12 05:48:05
220 [key.c]
221 Delint: remove some unreachable statements, from Bret Lambert.
222 OK markus@ and dtucker@.
d0ac0d65 223 - sobrado@cvs.openbsd.org 2007/08/06 19:16:06
224 [scp.1 scp.c]
225 the ellipsis is not an optional argument; while here, sync the usage
226 and synopsis of commands
227 lots of good ideas by jmc@
228 ok jmc@
79303c5a 229 - djm@cvs.openbsd.org 2007/08/07 07:32:53
230 [clientloop.c clientloop.h ssh.c]
231 bz#1232: ensure that any specified LocalCommand is executed after the
232 tunnel device is opened. Also, make failures to open a tunnel device
233 fatal when ExitOnForwardFailure is active.
234 Reported by h.goebel AT goebel-consult.de; ok dtucker markus reyk deraadt
1b73b60e 235
af12bf9c 23620070724
237 - (tim) [openssh.xml.in] make FMRI match what package scripts use.
87f560bb 238 - (tim) [openbsd-compat/regress/closefromtest.c] Bug 1345: fix open() call.
25c1216a 239 Report/patch by David.Leonard AT quest.com (and Bernhard Simon)
5498741c 240 - (tim) [buildpkg.sh.in openssh.xml.in] Allow more flexibility where smf(5)
a817bc2b 241 - (tim) [buildpkg.sh.in] s|$FAKE_ROOT/${sysconfdir}|$FAKE_ROOT${sysconfdir}|
af12bf9c 242
665ca996 24320070628
244 - (djm) bz#1325: Fix SELinux in permissive mode where it would
245 incorrectly fatal() on errors. patch from cjwatson AT debian.org;
246 ok dtucker
247
91044296 24820070625
249 - (dtucker) OpenBSD CVS Sync
250 - djm@cvs.openbsd.org 2007/06/13 00:21:27
251 [scp.c]
252 don't ftruncate() non-regular files; bz#1236 reported by wood AT
253 xmission.com; ok dtucker@
2c505585 254 - djm@cvs.openbsd.org 2007/06/14 21:43:25
255 [ssh.c]
256 handle EINTR when waiting for mux exit status properly
50455824 257 - djm@cvs.openbsd.org 2007/06/14 22:48:05
258 [ssh.c]
259 when waiting for the multiplex exit status, read until the master end
260 writes an entire int of data *and* closes the client_fd; fixes mux
261 regression spotted by dtucker, ok dtucker@
5a5e8b42 262 - djm@cvs.openbsd.org 2007/06/19 02:04:43
263 [atomicio.c]
264 if the fd passed to atomicio/atomiciov() is non blocking, then poll() to
265 avoid a spin if it is not yet ready for reading/writing; ok dtucker@
d9245683 266 - dtucker@cvs.openbsd.org 2007/06/25 08:20:03
267 [channels.c]
268 Correct test for window updates every three packets; prevents sending
269 window updates for every single packet. ok markus@
12ae19b0 270 - dtucker@cvs.openbsd.org 2007/06/25 12:02:27
271 [atomicio.c]
272 Include <poll.h> like the man page says rather than <sys/poll.h>. ok djm@
15aaadea 273 - (dtucker) [atomicio.c] Test for EWOULDBLOCK in atomiciov to match
274 atomicio.
6d39a5c4 275 - (dtucker) [atomicio.c configure.ac openbsd-compat/Makefile.in
276 openbsd-compat/bsd-poll.{c,h} openbsd-compat/openbsd-compat.h]
277 Add an implementation of poll() built on top of select(2). Code from
278 OpenNTPD with changes suggested by djm. ok djm@
91044296 279
cc43e894 28020070614
281 - (dtucker) [cipher-ctr.c umac.c openbsd-compat/openssl-compat.h] Move the
282 USE_BUILTIN_RIJNDAEL compat goop to openssl-compat.h so it can be
283 shared with umac.c. Allows building with OpenSSL 0.9.5 again including
284 umac support. With tim@ djm@, ok djm.
bff0be25 285 - (dtucker) [openbsd-compat/openssl-compat.h] Merge USE_BUILTIN_RIJNDAEL
286 sections. Fixes builds with early OpenSSL 0.9.6 versions.
9c9c3030 287 - (dtucker) [openbsd-compat/openssl-compat.h] Remove redundant definition
288 of USE_BUILTIN_RIJNDAEL since the <0.9.6 test is covered by the
289 subsequent <0.9.7 test.
cc43e894 290
e110afc3 29120070612
292 - (dtucker) OpenBSD CVS Sync
293 - markus@cvs.openbsd.org 2007/06/11 09:14:00
294 [channels.h]
295 increase default channel windows; ok djm
8f41056c 296 - djm@cvs.openbsd.org 2007/06/12 07:41:00
297 [ssh-add.1]
298 better document ssh-add's -d option (delete identies from agent), bz#1224
299 new text based on some provided by andrewmc-debian AT celt.dias.ie;
300 ok dtucker@
73d4e9cc 301 - djm@cvs.openbsd.org 2007/06/12 08:20:00
302 [ssh-gss.h gss-serv.c gss-genr.c]
303 relocate server-only GSSAPI code from libssh to server; bz #1225
304 patch from simon AT sxw.org.uk; ok markus@ dtucker@
4634ee16 305 - djm@cvs.openbsd.org 2007/06/12 08:24:20
306 [scp.c]
307 make scp try to skip FIFOs rather than blocking when nothing is listening.
308 depends on the platform supporting sane O_NONBLOCK semantics for open
309 on FIFOs (apparently POSIX does not mandate this), which OpenBSD does.
310 bz #856; report by cjwatson AT debian.org; ok markus@
5805c516 311 - djm@cvs.openbsd.org 2007/06/12 11:11:08
312 [ssh.c]
313 fix slave exit value when a control master goes away without passing the
314 full exit status by ensuring that the slave reads a full int. bz#1261
315 reported by frekko AT gmail.com; ok markus@ dtucker@
b2f4d5cc 316 - djm@cvs.openbsd.org 2007/06/12 11:15:17
317 [ssh.c ssh.1]
318 Add "-K" flag for ssh to set GSSAPIAuthentication=yes and
319 GSSAPIDelegateCredentials=yes. This is symmetric with -k (disable GSSAPI)
320 and is useful for hosts with /home on Kerberised NFS; bz #1312
321 patch from Markus.Kuhn AT cl.cam.ac.uk; ok dtucker@ markus@
6b34f31f 322 - djm@cvs.openbsd.org 2007/06/12 11:45:27
323 [ssh.c]
324 improved exit message from multiplex slave sessions; bz #1262
325 reported by alexandre.nunes AT gmail.com; ok dtucker@
dc1c8785 326 - dtucker@cvs.openbsd.org 2007/06/12 11:56:15
327 [gss-genr.c]
328 Pass GSS OID to gss_display_status to provide better information in
329 error messages. Patch from Simon Wilkinson via bz 1220. ok djm@
c159f720 330 - jmc@cvs.openbsd.org 2007/06/12 13:41:03
331 [ssh-add.1]
332 identies -> identities;
3c6a67c2 333 - jmc@cvs.openbsd.org 2007/06/12 13:43:55
334 [ssh.1]
335 add -K to SYNOPSIS;
5be98986 336 - dtucker@cvs.openbsd.org 2007/06/12 13:54:28
337 [scp.c]
338 Encode filename with strnvis if the name contains a newline (which can't
339 be represented in the scp protocol), from bz #891. ok markus@
e110afc3 340
bd6a1355 34120070611
342 - (djm) Bugzilla #1306: silence spurious error messages from hang-on-exit
343 fix; tested by dtucker@ and jochen.kirn AT gmail.com
f444d0f8 344 - pvalchev@cvs.openbsd.org 2007/06/07 19:37:34
345 [kex.h mac.c mac.h monitor_wrap.c myproposal.h packet.c ssh.1]
346 [ssh_config.5 sshd.8 sshd_config.5]
347 Add a new MAC algorithm for data integrity, UMAC-64 (not default yet,
348 must specify umac-64@openssh.com). Provides about 20% end-to-end speedup
349 compared to hmac-md5. Represents a different approach to message
350 authentication to that of HMAC that may be beneficial if HMAC based on
351 one of its underlying hash algorithms is found to be vulnerable to a
352 new attack. http://www.ietf.org/rfc/rfc4418.txt
353 in conjunction with and OK djm@
c22b0835 354 - pvalchev@cvs.openbsd.org 2007/06/08 04:40:40
355 [ssh_config]
356 Add a "MACs" line after "Ciphers" with the default MAC algorithms,
357 to ease people who want to tweak both (eg. for performance reasons).
358 ok deraadt@ djm@ dtucker@
bbc77085 359 - jmc@cvs.openbsd.org 2007/06/08 07:43:46
360 [ssh_config.5]
361 put the MAC list into a display, like we do for ciphers,
362 since groff has trouble handling wide lines;
33d2ae0f 363 - jmc@cvs.openbsd.org 2007/06/08 07:48:09
364 [sshd_config.5]
365 oops, here too: put the MAC list into a display, like we do for
366 ciphers, since groff has trouble with wide lines;
68a73f53 367 - markus@cvs.openbsd.org 2007/06/11 08:04:44
368 [channels.c]
369 send 'window adjust' messages every tree packets and do not wait
370 until 50% of the window is consumed. ok djm dtucker
1aac2117 371 - (djm) [configure.ac umac.c] If platform doesn't provide swap32(3), then
372 fallback to provided bit-swizzing functions
aee0a82f 373 - (dtucker) [openbsd-compat/bsd-misc.c] According to the spec the "remainder"
374 argument to nanosleep may be NULL. Currently this never happens in OpenSSH,
375 but check anyway in case this changes or the code gets used elsewhere.
e9b2809d 376 - (dtucker) [includes.h] Bug #1243: HAVE_PATHS -> HAVE_PATHS_H. Should
377 prevent warnings about redefinitions of various things in paths.h.
378 Spotted by cartmanltd at hotmail.com.
c22b0835 379
c33de4d8 38020070605
381 - (dtucker) OpenBSD CVS Sync
382 - djm@cvs.openbsd.org 2007/05/22 10:18:52
383 [sshd.c]
384 zap double include; from p_nowaczyk AT o2.pl
385 (not required in -portable, Id sync only)
68525040 386 - djm@cvs.openbsd.org 2007/05/30 05:58:13
387 [kex.c]
388 tidy: KNF, ARGSUSED and u_int
e473dcd1 389 - jmc@cvs.openbsd.org 2007/05/31 19:20:16
390 [scp.1 ssh_config.5 sftp-server.8 ssh-agent.1 sshd_config.5 sftp.1
391 ssh-keygen.1 ssh-keyscan.1 ssh-add.1 sshd.8 ssh.1 ssh-keysign.8]
392 convert to new .Dd format;
393 (We will need to teach mdoc2man.awk to understand this too.)
d156cd22 394 - djm@cvs.openbsd.org 2007/05/31 23:34:29
395 [packet.c]
396 gc unreachable code; spotted by Tavis Ormandy
996279fc 397 - djm@cvs.openbsd.org 2007/06/02 09:04:58
398 [bufbn.c]
399 memory leak on error path; from arnaud.lacombe.1 AT ulaval.ca
a3de8da1 400 - djm@cvs.openbsd.org 2007/06/05 06:52:37
401 [kex.c monitor_wrap.c packet.c mac.h kex.h mac.c]
402 Preserve MAC ctx between packets, saving 2xhash calls per-packet.
403 Yields around a 12-16% end-to-end speedup for arcfour256/hmac-md5
404 patch from markus@ tested dtucker@ and myself, ok markus@ and me (I'm
405 committing at his request)
f43b2695 406 - (dtucker) [mdoc2man.awk] Teach it to deal with $Mdocdate tags that
407 OpenBSD's cvs now adds.
8c5a3b27 408 - (dtucker) [mdoc2man.awk] Remove trailing "$" from Mdocdate regex so
409 mindrot's cvs doesn't expand it on us.
757841b2 410 - (dtucker) [mdoc2man.awk] Add support for %R references, used for RFCs.
c33de4d8 411
2e5c9c30 41220070520
413 - (dtucker) OpenBSD CVS Sync
414 - stevesk@cvs.openbsd.org 2007/04/14 22:01:58
415 [auth2.c]
416 remove unused macro; from Dmitry V. Levin <ldv@altlinux.org>
23983bf9 417 - stevesk@cvs.openbsd.org 2007/04/18 01:12:43
418 [sftp-server.c]
419 cast "%llu" format spec to (unsigned long long); do not assume a
420 u_int64_t arg is the same as 'unsigned long long'.
421 from Dmitry V. Levin <ldv@altlinux.org>
422 ok markus@ 'Yes, that looks correct' millert@
51b787f2 423 - dtucker@cvs.openbsd.org 2007/04/23 10:15:39
424 [servconf.c]
425 Remove debug() left over from development. ok deraadt@
7ce05acc 426 - djm@cvs.openbsd.org 2007/05/17 07:50:31
427 [log.c]
428 save and restore errno when logging; ok deraadt@
72dea2d9 429 - djm@cvs.openbsd.org 2007/05/17 07:55:29
430 [sftp-server.c]
431 bz#1286 stop reading and processing commands when input or output buffer
432 is nearly full, otherwise sftp-server would happily try to grow the
433 input/output buffers past the maximum supported by the buffer API and
434 promptly fatal()
435 based on patch from Thue Janus Kristensen; feedback & ok dtucker@
7fd1deb2 436 - djm@cvs.openbsd.org 2007/05/17 20:48:13
437 [sshconnect2.c]
438 fall back to gethostname() when the outgoing connection is not
439 on a socket, such as is the case when ProxyCommand is used.
440 Gives hostbased auth an opportunity to work; bz#616, report
441 and feedback stuart AT kaloram.com; ok markus@
21cd42db 442 - djm@cvs.openbsd.org 2007/05/17 20:52:13
443 [monitor.c]
444 pass received SIGINT from monitor to postauth child so it can clean
445 up properly. bz#1196, patch from senthilkumar_sen AT hotpop.com;
446 ok markus@
b2349766 447 - jolan@cvs.openbsd.org 2007/05/17 23:53:41
448 [sshconnect2.c]
449 djm owes me a vb and a tism cd for breaking ssh compilation
fd8f181b 450 - (dtucker) [auth-pam.c] malloc+memset -> calloc. Patch from
451 ldv at altlinux.org.
e2dedae7 452 - (dtucker) [auth-pam.c] Return empty string if fgets fails in
453 sshpam_tty_conv. Patch from ldv at altlinux.org.
2e5c9c30 454
40701614 45520070509
456 - (tim) [configure.ac] Bug #1287: Add missing test for ucred.h.
457
65737b47 45820070429
459 - (dtucker) [openbsd-compat/bsd-misc.c] Include unistd.h and sys/types.h
460 for select(2) prototype.
e5b792cd 461 - (dtucker) [auth-shadow.c loginrec.c] Include time.h for time(2) prototype.
560acf80 462 - (dtucker) [configure.ac openbsd-compat/getrrsetbyname.c] Bug #1299: Use the
463 platform's _res if it has one. Should fix problem of DNSSEC record lookups
464 on NetBSD as reported by Curt Sampson.
81fa3f37 465 - (dtucker) [openbsd-compat/xmmap.c] Include stdlib.h for mkstemp prototype.
0bf6279d 466 - (dtucker) [configure.ac defines.h] Have configure check for MAXSYMLINKS
467 so we don't get redefinition warnings.
0b9fdeb8 468 - (dtucker) [openbsd-compat/xmmap.c] Include stdlib.h for mkstemp prototype.
469 - (dtucker) [configure.ac defines.h] Prevent warnings about __attribute__
470 __nonnull__ for versions of GCC that don't support it.
b41ece30 471 - (dtucker) [configure.ac defines.h] Have configure check for offsetof
472 to prevent redefinition warnings.
0b9fdeb8 473
6b44d402 47420070406
475 - (dtucker) [INSTALL] Update the systems that have PAM as standard. Link
476 to OpenPAM too.
e5d352eb 477 - (dtucker) [INSTALL] prngd lives at sourceforge these days.
6b44d402 478
a03acb8f 47920070326
480 - (tim) [auth.c configure.ac defines.h session.c openbsd-compat/port-uw.c
481 openbsd-compat/port-uw.h openbsd-compat/xcrypt.c] Rework libiaf test/defines
482 to account for IRIX having libiaf but not set_id(). Patch with & ok dtucker@
483
e54defb4 48420070325
485 - (dtucker) [Makefile.in configure.ac] Replace single-purpose LIBSELINUX,
486 LIBWRAP and LIBPAM variables in Makefile with the general-purpose
487 SSHDLIBS. "I like" djm@
488
136d42b7 48920070321
490 - (dtucker) OpenBSD CVS Sync
491 - dtucker@cvs.openbsd.org 2007/03/09 05:20:06
492 [servconf.c sshd.c]
493 Move C/R -> kbdint special case to after the defaults have been
494 loaded, which makes ChallengeResponse default to yes again. This
495 was broken by the Match changes and not fixed properly subsequently.
496 Found by okan at demirmen.com, ok djm@ "please do it" deraadt@
e93309c3 497 - djm@cvs.openbsd.org 2007/03/19 01:01:29
498 [sshd_config]
499 Disable the legacy SSH protocol 1 for new installations via
500 a configuration override. In the future, we will change the
501 server's default itself so users who need the legacy protocol
502 will need to turn it on explicitly
7f38e62e 503 - dtucker@cvs.openbsd.org 2007/03/19 12:16:42
504 [ssh-agent.c]
505 Remove the signal handler that checks if the agent's parent process
506 has gone away, instead check when the select loop returns. Record when
507 the next key will expire when scanning for expired keys. Set the select
508 timeout to whichever of these two things happens next. With djm@, with &
509 ok deraadt@ markus@
f48fbab3 510 - tedu@cvs.openbsd.org 2007/03/20 03:56:12
511 [readconf.c clientloop.c]
512 remove some bogus *p tests from charles longeau
513 ok deraadt millert
82029813 514 - jmc@cvs.openbsd.org 2007/03/20 15:57:15
515 [sshd.8]
516 - let synopsis and description agree for -f
517 - sort FILES
518 - +.Xr ssh-keyscan 1 ,
519 from Igor Sobrado
1961d660 520 - (dtucker) [configure.ac openbsd-compat/bsd-getpeereid.c] Bug #1287: Use
521 getpeerucred to implement getpeereid (currently only Solaris 10 and up).
522 Patch by Jan.Pechanec at Sun.
aee1c971 523 - (dtucker) [regress/agent-getpeereid.sh] Do peereid test if we have
524 HAVE_GETPEERUCRED too. Also from Jan Pechanec.
136d42b7 525
fce809d2 52620070313
527 - (dtucker) [entropy.c scard-opensc.c ssh-rand-helper.c] Bug #1294: include
528 string.h to prevent warnings, from vapier at gentoo.org.
5425009d 529 - (dtucker) [LICENCE] Add Daniel Walsh as a copyright holder for the
530 selinux bits in -portable.
ab26a796 531 - (dtucker) [cipher-3des1.c cipher-bf1.c] The OpenSSL 0.9.8e problem in
532 bug #1291 also affects Protocol 1 3des. While at it, use compat-openssl.h
533 in cipher-bf1.c. Patch from Juan Gallego.
76ef2ed2 534 - (dtucker) [README.platform] Info about blibpath on AIX.
fce809d2 535
a863b75f 53620070306
537 - (djm) OpenBSD CVS Sync
538 - jmc@cvs.openbsd.org 2007/03/01 16:19:33
539 [sshd_config.5]
540 sort the `match' keywords;
95d6e8af 541 - djm@cvs.openbsd.org 2007/03/06 10:13:14
542 [version.h]
543 openssh-4.6; "please" deraadt@
0a052bfe 544 - (djm) [contrib/caldera/openssh.spec contrib/redhat/openssh.spec]
545 [contrib/suse/openssh.spec] crank spec files for release
9b86b75a 546 - (djm) [README] correct link to release notes
68ff14ce 547 - (djm) Release 4.6p1
a863b75f 548
1d42bcce 54920070304
550 - (djm) [configure.ac] add a --without-openssl-header-check option to
551 configure, as some platforms (OS X) ship OpenSSL headers whose version
552 does not match that of the shipping library. ok dtucker@
190d9b26 553 - (dtucker) [openbsd-compat/openssl-compat.h] Bug #1291: Work around a
554 bug in OpenSSL 0.9.8e that prevents aes256-ctr, aes192-ctr and arcfour256
555 ciphers from working correctly (disconnects with "Bad packet length"
556 errors) as found by Ben Harris. ok djm@
1d42bcce 557
f0bbbd78 55820070303
559 - (dtucker) [regress/agent-ptrace.sh] Make ttrace gdb error a little more
560 general to cover newer gdb versions on HP-UX.
561
04765d02 56220070302
563 - (dtucker) [configure.ac] For Cygwin, read files in textmode (which allows
564 CRLF as well as LF lineendings) and write in binary mode. Patch from
565 vinschen at redhat.com.
2769e5d0 566 - (dtucker) [INSTALL] Update to autoconf-2.61.
04765d02 567
121c4a34 56820070301
569 - (dtucker) OpenBSD CVS Sync
570 - dtucker@cvs.openbsd.org 2007/03/01 10:28:02
571 [auth2.c sshd_config.5 servconf.c]
572 Remove ChallengeResponseAuthentication support inside a Match
573 block as its interaction with KbdInteractive makes it difficult to
574 support. Also, relocate the CR/kbdint option special-case code into
575 servconf. "please commit" djm@, ok markus@ for the relocation.
840bd607 576 - (tim) [buildpkg.sh.in openssh.xml.in] Clean up Solaris 10 smf(5) bits.
577 "Looks sane" dtucker@
121c4a34 578
f10f9102 57920070228
580 - (dtucker) OpenBSD CVS Sync
581 - dtucker@cvs.openbsd.org 2007/02/28 00:55:30
582 [ssh-agent.c]
583 Remove expired keys periodically so they don't remain in memory when
584 the agent is entirely idle, as noted by David R. Piegdon. This is the
585 simple fix, a more efficient one will be done later. With markus,
586 deraadt, with & ok djm.
587
88ea6a3c 58820070225
589 - (dtucker) OpenBSD CVS Sync
590 - djm@cvs.openbsd.org 2007/02/20 10:25:14
591 [clientloop.c]
592 set maximum packet and window sizes the same for multiplexed clients
593 as normal connections; ok markus@
1e823acf 594 - dtucker@cvs.openbsd.org 2007/02/21 11:00:05
595 [sshd.c]
596 Clear alarm() before restarting sshd on SIGHUP. Without this, if there's
597 a SIGALRM pending (for SSH1 key regeneration) when sshd is SIGHUP'ed, the
598 newly exec'ed sshd will get the SIGALRM and not have a handler for it,
599 and the default action will terminate the listening sshd. Analysis and
600 patch from andrew at gaul.org.
f3e3d6ce 601 - dtucker@cvs.openbsd.org 2007/02/22 12:58:40
602 [servconf.c]
603 Check activep so Match and GatewayPorts work together; ok markus@
8c1cb72e 604 - ray@cvs.openbsd.org 2007/02/24 03:30:11
605 [moduli.c]
606 - strlen returns size_t, not int.
607 - Pass full buffer size to fgets.
608 OK djm@, millert@, and moritz@.
88ea6a3c 609
5792fbb7 61020070219
611 - (dtucker) OpenBSD CVS Sync
612 - jmc@cvs.openbsd.org 2007/01/10 13:23:22
613 [ssh_config.5]
614 do not use a list for SYNOPSIS;
615 this is actually part of a larger report sent by eric s. raymond
616 and forwarded by brad, but i only read half of it. spotted by brad.
e91a8c3f 617 - jmc@cvs.openbsd.org 2007/01/12 20:20:41
618 [ssh-keygen.1 ssh-keygen.c]
619 more secsh -> rfc 4716 updates;
620 spotted by wiz@netbsd
621 ok markus
70b5e752 622 - dtucker@cvs.openbsd.org 2007/01/17 23:22:52
623 [readconf.c]
624 Honour activep for times (eg ServerAliveInterval) while parsing
625 ssh_config and ~/.ssh/config so they work properly with Host directives.
626 From mario.lorenz@wincor-nixdorf.com via bz #1275. ok markus@
627 - stevesk@cvs.openbsd.org 2007/01/21 01:41:54
628 [auth-skey.c kex.c ssh-keygen.c session.c clientloop.c]
629 spaces
0cf6a024 630 - stevesk@cvs.openbsd.org 2007/01/21 01:45:35
631 [readconf.c]
632 spaces
e4d5ca17 633 - djm@cvs.openbsd.org 2007/01/22 11:32:50
634 [sftp-client.c]
635 return error from do_upload() when a write fails. fixes bz#1252: zero
636 exit status from sftp when uploading to a full device. report from
637 jirkat AT atlas.cz; ok dtucker@
7df0afaf 638 - djm@cvs.openbsd.org 2007/01/22 13:06:21
639 [scp.c]
640 fix detection of whether we should show progress meter or not: scp
641 tested isatty(stderr) but wrote the progress meter to stdout. This patch
642 makes it test stdout. bz#1265 reported by junkmail AT bitsculpture.com;
643 of dtucker@
1b313731 644 - stevesk@cvs.openbsd.org 2007/02/14 14:32:00
645 [bufbn.c]
646 typos in comments; ok jmc@
03bcbf84 647 - dtucker@cvs.openbsd.org 2007/02/19 10:45:58
648 [monitor_wrap.c servconf.c servconf.h monitor.c sshd_config.5]
649 Teach Match how handle config directives that are used before
650 authentication. This allows configurations such as permitting password
651 authentication from the local net only while requiring pubkey from
652 offsite. ok djm@, man page bits ok jmc@
99d804ce 653 - (dtucker) [contrib/findssl.sh] Add "which" as a shell function since some
654 platforms don't have it. Patch from dleonard at vintela.com.
56a6f96f 655 - (dtucker) [openbsd-compat/getrrsetbyname.c] Don't attempt to calloc
656 an array for signatures when there are none since "calloc(0, n) returns
657 NULL on some platforms (eg Tru64), which is explicitly permitted by
658 POSIX. Diagnosis and patch by svallet genoscope.cns.fr.
5792fbb7 659
34640ce6 66020070128
661 - (djm) [channels.c serverloop.c] Fix so-called "hang on exit" (bz #52)
662 when closing a tty session when a background process still holds tty
663 fds open. Great detective work and patch by Marc Aurele La France,
664 slightly tweaked by me; ok dtucker@
665
4b478cc5 66620070123
667 - (dtucker) [openbsd-compat/bsd-snprintf.c] Static declarations for public
668 library interfaces aren't very helpful. Fix up the DOPR_OUTCH macro
669 so it works properly and modify its callers so that they don't pre or
670 post decrement arguments that are conditionally evaluated. While there,
671 put SNPRINTF_CONST back as it prevents build failures in some
672 configurations. ok djm@ (for most of it)
673
ed9b5e5f 67420070122
675 - (djm) [ssh-rand-helper.8] manpage nits;
676 from dleonard AT vintela.com (bz#1529)
677
25bd7a2a 67820070117
679 - (dtucker) [packet.c] Re-remove in_systm.h since it's already in includes.h
680 and multiple including it causes problems on old IRIXes. (It snuck back
681 in during a sync.) Found (again) by Georg Schwarz.
682
b05ff3f5 68320070114
7ac507d4 684 - (dtucker) [ssh-keygen.c] av -> argv to match earlier sync.
0d00c5cb 685 - (djm) [openbsd-compat/bsd-snprintf.c] Fix integer overflow in return
686 value of snprintf replacement, similar to bugs in various libc
687 implementations. This overflow is not exploitable in OpenSSH.
688 While I'm fiddling with it, make it a fair bit faster by inlining the
689 append-char routine; ok dtucker@
b05ff3f5 690
4b4810d4 69120070105
692 - (djm) OpenBSD CVS Sync
693 - deraadt@cvs.openbsd.org 2006/11/14 19:41:04
694 [ssh-keygen.c]
695 use argc and argv not some made up short form
ce4cf693 696 - ray@cvs.openbsd.org 2006/11/23 01:35:11
697 [misc.c sftp.c]
698 Don't access buf[strlen(buf) - 1] for zero-length strings.
699 ``ok by me'' djm@.
4e3c0053 700 - markus@cvs.openbsd.org 2006/12/11 21:25:46
701 [ssh-keygen.1 ssh.1]
702 add rfc 4716 (public key format); ok jmc
04efe9b0 703 - djm@cvs.openbsd.org 2006/12/12 03:58:42
704 [channels.c compat.c compat.h]
705 bz #1019: some ssh.com versions apparently can't cope with the
706 remote port forwarding bind_address being a hostname, so send
707 them an address for cases where they are not explicitly
708 specified (wildcard or localhost bind). reported by daveroth AT
709 acm.org; ok dtucker@ deraadt@
75b6d52c 710 - dtucker@cvs.openbsd.org 2006/12/13 08:34:39
711 [servconf.c]
712 Make PermitOpen work with multiple values like the man pages says.
713 bz #1267 with details from peter at dmtz.com, with & ok djm@
38757197 714 - dtucker@cvs.openbsd.org 2006/12/14 10:01:14
715 [servconf.c]
716 Make "PermitOpen all" first-match within a block to match the way other
717 options work. ok markus@ djm@
5d9a4204 718 - jmc@cvs.openbsd.org 2007/01/02 09:57:25
719 [sshd_config.5]
720 do not use lists for SYNOPSIS;
721 from eric s. raymond via brad
cbaa43c0 722 - stevesk@cvs.openbsd.org 2007/01/03 00:53:38
723 [ssh-keygen.c]
724 remove small dead code; arnaud.lacombe.1@ulaval.ca via Coverity scan
4f6e2ba9 725 - stevesk@cvs.openbsd.org 2007/01/03 03:01:40
726 [auth2-chall.c channels.c dns.c sftp.c ssh-keygen.c ssh.c]
727 spaces
c9625a42 728 - stevesk@cvs.openbsd.org 2007/01/03 04:09:15
729 [sftp.c]
730 ARGSUSED for lint
9a24ac07 731 - stevesk@cvs.openbsd.org 2007/01/03 07:22:36
732 [sftp-server.c]
733 spaces
4b4810d4 734
2b563deb 73520061205
736 - (djm) [auth.c] Fix NULL pointer dereference in fakepw(). Crash would
737 occur if the server did not have the privsep user and an invalid user
738 tried to login and both privsep and krb5 auth are disabled; ok dtucker@
096393b8 739 - (djm) [bsd-asprintf.c] Better test for bad vsnprintf lengths; ok dtucker@
2b563deb 740
d4d9db8d 74120061108
742 - (dtucker) OpenBSD CVS Sync
743 - markus@cvs.openbsd.org 2006/11/07 13:02:07
744 [dh.c]
745 BN_hex2bn returns int; from dtucker@
746
4d02b823 74720061107
748 - (dtucker) [sshd.c] Use privsep_pw if we have it, but only require it
749 if we absolutely need it. Pointed out by Corinna, ok djm@
e516451d 750 - (dtucker) OpenBSD CVS Sync
751 - markus@cvs.openbsd.org 2006/11/06 21:25:28
752 [auth-rsa.c kexgexc.c kexdhs.c key.c ssh-dss.c sshd.c kexgexs.c
753 ssh-keygen.c bufbn.c moduli.c scard.c kexdhc.c sshconnect1.c dh.c rsa.c]
754 add missing checks for openssl return codes; with & ok djm@
89916e8c 755 - markus@cvs.openbsd.org 2006/11/07 10:31:31
756 [monitor.c version.h]
757 correctly check for bad signatures in the monitor, otherwise the monitor
758 and the unpriv process can get out of sync. with dtucker@, ok djm@,
759 dtucker@
5b296f76 760 - (dtucker) [README contrib/{caldera,redhat,contrib}/openssh.spec] Bump
761 versions.
4354f73b 762 - (dtucker) Release 4.5p1.
4d02b823 763
b8e51e81 76420061105
765 - (djm) OpenBSD CVS Sync
766 - otto@cvs.openbsd.org 2006/10/28 18:08:10
767 [ssh.1]
768 correct/expand example of usage of -w; ok jmc@ stevesk@
8e8b473c 769 - markus@cvs.openbsd.org 2006/10/31 16:33:12
770 [kexdhc.c kexdhs.c kexgexc.c kexgexs.c]
771 check DH_compute_key() for -1 even if it should not happen because of
772 earlier calls to dh_pub_is_valid(); report krahmer at suse.de; ok djm
b8e51e81 773
8852e1d4 77420061101
775 - (dtucker) [openbsd-compat/port-solaris.c] Bug #1255: Make only hwerr
776 events fatal in Solaris process contract support and tell it to signal
777 only processes in the same process group when something happens.
778 Based on information from andrew.benham at thus.net and similar to
779 a patch from Chad Mynhier. ok djm@
780
1acc8e56 78120061027
782- (djm) [auth.c] gc some dead code
783
b3c338b7 78420061023
785 - (djm) OpenBSD CVS Sync
786 - ray@cvs.openbsd.org 2006/09/30 17:48:22
787 [sftp.c]
788 Clear errno before calling the strtol functions.
789 From Paul Stoeber <x0001 at x dot de1 dot cc>.
790 OK deraadt@.
fceb95fa 791 - djm@cvs.openbsd.org 2006/10/06 02:29:19
792 [ssh-agent.c ssh-keyscan.c ssh.c]
793 sys/resource.h needs sys/time.h; prompted by brad@
794 (NB. Id sync only for portable)
db6fcd65 795 - djm@cvs.openbsd.org 2006/10/09 23:36:11
796 [session.c]
797 xmalloc -> xcalloc that was missed previously, from portable
798 (NB. Id sync only for portable, obviously)
77903f77 799 - markus@cvs.openbsd.org 2006/10/10 10:12:45
800 [sshconnect.c]
801 sleep before retrying (not after) since sleep changes errno; fixes
802 pr 5250; rad@twig.com; ok dtucker djm
bd3b2cb2 803 - markus@cvs.openbsd.org 2006/10/11 12:38:03
804 [clientloop.c serverloop.c]
805 exit instead of doing a blocking tcp send if we detect a client/server
806 timeout, since the tcp sendqueue might be already full (of alive
807 requests); ok dtucker, report mpf
cdfbded8 808 - djm@cvs.openbsd.org 2006/10/22 02:25:50
809 [sftp-client.c]
810 cancel progress meter when upload write fails; ok deraadt@
0f74133a 811 - (tim) [Makefile.in scard/Makefile.in] Add datarootdir= lines to keep
812 autoconf 2.60 from complaining.
b3c338b7 813
525251b0 81420061018
815 - (dtucker) OpenBSD CVS Sync
816 - ray@cvs.openbsd.org 2006/09/25 04:55:38
817 [ssh-keyscan.1 ssh.1]
818 Change "a SSH" to "an SSH". Hurray, I'm not the only one who
819 pronounces "SSH" as "ess-ess-aich".
820 OK jmc@ and stevesk@.
d1f7ec98 821 - (dtucker) [sshd.c] Reshuffle storing of pw struct; prevents warnings
822 on older versions of OS X. ok djm@
525251b0 823
8153fef1 82420061016
825 - (dtucker) [monitor_fdpass.c] Include sys/in.h, required for cmsg macros
826 on older (2.0) Linuxes. Based on patch from thmo-13 at gmx de.
827
1f231631 82820061006
829 - (tim) [buildpkg.sh.in] Use uname -r instead of -v in OS_VER for Solaris.
830 Differentiate between OpenServer 5 and OpenServer 6
5ba277eb 831 - (dtucker) [configure.ac] Set put -lselinux into $LIBS while testing for
832 SELinux functions so they're detected correctly. Patch from pebenito at
833 gentoo.org.
b18359f6 834 - (tim) [buildpkg.sh.in] Some systems have really limited nawk (OpenServer).
835 Allow setting alternate awk in openssh-config.local.
1f231631 836
aa56f760 83720061003
838 - (tim) [configure.ac] Move CHECK_HEADERS test before platform specific
839 section so additional platform specific CHECK_HEADER tests will work
840 correctly. Fixes "<net/if_tap.h> on FreeBSD" problem report by des AT des.no
841 Feedback and "seems like a good idea" dtucker@
842
00dea73e 84320061001
844 - (dtucker) [audit-bsm.c] Include errno.h. Pointed out by des at des.no.
845
24b2647b 84620060929
847 - (dtucker) [configure.ac] Bug #1239: Fix configure test for OpenSSH engine
848 support. Patch from andrew.benham at thus net.
849
243a64f1 85020060928
851 - (dtucker) [entropy.c] Bug #1238: include signal.h to fix compilation error
852 on Solaris 8 w/out /dev/random or prngd. Patch from rl at
853 math.technion.ac.il.
854
f0a2e834 85520060926
856 - (dtucker) [bufaux.h] nuke bufaux.h; it's already gone from OpenBSD and not
857 referenced any more. ok djm@
5ed1a353 858 - (dtucker) [sftp-server.8] Resync; spotted by djm@
0eb97cdf 859 - (dtucker) Release 4.4p1.
f0a2e834 860
d6336595 86120060924
862 - (tim) [configure.ac] Remove CFLAGS hack for UnixWare 1.x/2.x (added
863 to rev 1.308) to work around broken gcc 2.x header file.
864
530456f4 86520060923
866 - (dtucker) [configure.ac] Bug #1234: Put opensc libs into $LIBS rather than
867 $LDFLAGS. Patch from vapier at gentoo org.
868
c5bca5d4 86920060922
870 - (dtucker) [packet.c canohost.c] Include arpa/inet.h for htonl macros on
871 some platforms (eg HP-UX 11.00). From santhi.amirta at gmail com.
872
d3fc2aa3 87320060921
874 - (dtucker) OpenBSD CVS Sync
875 - otto@cvs.openbsd.org 2006/09/19 05:52:23
876 [sftp.c]
877 Use S_IS* macros insted of masking with S_IF* flags. The latter may
878 have multiple bits set, which lead to surprising results. Spotted by
879 Paul Stoeber, more to come. ok millert@ pedro@ jaredy@ djm@
a29c9898 880 - markus@cvs.openbsd.org 2006/09/19 21:14:08
881 [packet.c]
882 client NULL deref on protocol error; Tavis Ormandy, Google Security Team
ffbfca72 883 - (dtucker) [defines.h] Include unistd.h before defining getpgrp; fixes
884 build error on Ultrix. From Bernhard Simon.
d3fc2aa3 885
25a2779b 88620060918
887 - (dtucker) [configure.ac] On AIX, check to see if the compiler will allow
888 macro redefinitions, and if not, remove "-qlanglvl=ansi" from the flags.
889 Allows build out of the box with older VAC and XLC compilers. Found by
890 David Bronder and Bernhard Simon.
d9ed544b 891 - (dtucker) [openbsd-compat/port-aix.{c,h}] Reduce scope of includes.
892 Prevents macro redefinition warnings of "RDONLY".
25a2779b 893
f0d0e025 89420060916
895 - OpenBSD CVS Sync
896 - djm@cvs.openbsd.org 2006/09/16 19:53:37
897 [deattack.c deattack.h packet.c]
898 limit maximum work performed by the CRC compensation attack detector,
899 problem reported by Tavis Ormandy, Google Security Team;
900 ok markus@ deraadt@
95954124 901 - (djm) Add openssh.xml to .cvsignore and sort it
3fd7b98a 902 - (dtucker) [auth-pam.c] Propogate TZ environment variable to PAM auth
903 process so that any logging it does is with the right timezone. From
904 Scott Strickler, ok djm@.
bb09a477 905 - (dtucker) [monitor.c] Correctly handle auditing of single commands when
906 using Protocol 1. From jhb at freebsd.
cd3e77c4 907 - (djm) [sshd.c] Fix warning/API abuse; ok dtucker@
8e700494 908 - (dtucker) [INSTALL] Add info about audit support.
f0d0e025 909
29eadd7c 91020060912
911 - (djm) [Makefile.in buildpkg.sh.in configure.ac openssh.xml.in]
912 Support SMF in Solaris Packages if enabled by configure. Patch from
913 Chad Mynhier, tested by dtucker@
914
7238aaad 91520060911
916 - (dtucker) [cipher-aes.c] Include string.h for memcpy and friends. Noted
917 by Pekka Savola.
918
d23046e2 91920060910
920 - (dtucker) [contrib/aix/buildbff.sh] Ensure that perl is available.
36f36ba3 921 - (dtucker) [configure.ac] Add -lcrypt to let DragonFly build OOTB.
d23046e2 922
fa6edaf0 92320060909
924 - (dtucker) [openbsd-compat/bsd-snprintf.c] Add stdarg.h.
d2f401fe 925 - (dtucker) [contrib/aix/buildbff.sh] Always create privsep user.
16082eaa 926 - (dtucker) [buildpkg.sh.in] Always create privsep user. ok djm@
fa6edaf0 927
368a00c2 92820060908
929 - (dtucker) [auth-sia.c] Add includes required for build on Tru64. Patch
930 from Chris Adams.
a01f637d 931 - (dtucker) [configure.ac] The BSM header test needs time.h in some cases.
368a00c2 932
a078cbee 93320060907
934 - (djm) [sshd.c auth.c] Set up fakepw() with privsep uid/gid, so it can
935 be used to drop privilege to; fixes Solaris GSSAPI crash reported by
936 Magnus Abrante; suggestion and feedback dtucker@
937 NB. this change will require that the privilege separation user must
938 exist on all the time, not just when UsePrivilegeSeparation=yes
5cc6ddad 939 - (tim) [configure.ac] s/BROKEN_UPDWTMP/BROKEN_UPDWTMPX/ on SCO OSR6
4130b6f1 940 - (dtucker) [loginrec.c] Wrap paths.h in HAVE_PATHS_H.
15367d95 941 - (dtucker) [regress/cfgmatch.sh] stop_client is racy, so give us a better
942 chance of winning.
a078cbee 943
9286ecf2 94420060905
945 - (dtucker) [configure.ac] s/AC_DEFINES/AC_DEFINE/ spotted by Roumen Petrov.
e0f3adac 946 - (dtucker) [loginrec.c] Include paths.h for _PATH_BTMP.
9286ecf2 947
62143a41 94820060904
949 - (dtucker) [configure.ac] Define BROKEN_UPDWTMP on SCO OSR6 as the native
950 updwdtmp seems to generate invalid wtmp entries. From Roger Cornelius,
951 ok djm@
952
752994dd 95320060903
954 - (dtucker) [configure.ac openbsd-compat/openbsd-compat.h] Check for
955 declaration of writev(2) and declare it ourselves if necessary. Makes
956 the atomiciov() calls build on really old systems. ok djm@
957
b823d0b9 95820060902
959 - (dtucker) [openbsd-compat/port-irix.c] Add errno.h, found by Iain Morgan.
5e837c7b 960 - (dtucker) [ssh-keyscan.c ssh-rand-helper.c ssh.c sshconnect.c
961 openbsd-compat/bindresvport.c openbsd-compat/getrrsetbyname.c
962 openbsd-compat/port-tun.c openbsd-compat/rresvport.c] Include <arpa/inet.h>
963 for hton* and ntoh* macros. Required on (at least) HP-UX since we define
964 _XOPEN_SOURCE_EXTENDED. Found by santhi.amirta at gmail com.
b823d0b9 965
24436b92 96620060901
967 - (djm) [audit-bsm.c audit.c auth-bsdauth.c auth-chall.c auth-pam.c]
968 [auth-rsa.c auth-shadow.c auth-sia.c auth1.c auth2-chall.c]
969 [auth2-gss.c auth2-kbdint.c auth2-none.c authfd.c authfile.c]
970 [cipher-3des1.c cipher-aes.c cipher-bf1.c cipher-ctr.c clientloop.c]
971 [dh.c dns.c entropy.c gss-serv-krb5.c gss-serv.c hostfile.c kex.c]
972 [kexdhc.c kexdhs.c kexgexc.c kexgexs.c key.c loginrec.c mac.c]
973 [md5crypt.c monitor.c monitor_wrap.c readconf.c rsa.c]
974 [scard-opensc.c scard.c session.c ssh-add.c ssh-agent.c ssh-dss.c]
975 [ssh-keygen.c ssh-keysign.c ssh-rsa.c ssh.c sshconnect.c]
aa751414 976 [sshconnect1.c sshconnect2.c sshd.c]
24436b92 977 [openbsd-compat/bsd-cray.c openbsd-compat/port-aix.c]
978 [openbsd-compat/port-linux.c openbsd-compat/port-solaris.c]
979 [openbsd-compat/port-uw.c]
980 Lots of headers for SCO OSR6, mainly adding stdarg.h for log.h;
981 compile problems reported by rac AT tenzing.org
aa751414 982 - (djm) [includes.h monitor.c openbsd-compat/bindresvport.c]
983 [openbsd-compat/rresvport.c] Some more headers: netinet/in.h
984 sys/socket.h and unistd.h in various places
dd41ba6f 985 - (dtucker) [openbsd-compat/bsd-cygwin_util.c] Fix implict declaration
986 warnings for binary_open and binary_close. Patch from Corinna Vinschen.
78888bab 987 - (dtucker) [configure.ac includes.h openbsd-compat/glob.{c,h}] Explicitly
988 test for GLOB_NOMATCH and use our glob functions if it's not found.
989 Stops sftp from segfaulting when attempting to get a nonexistent file on
990 Cygwin (previous versions of OpenSSH didn't use the native glob). Partly
991 from and tested by Corinna Vinschen.
cdc9d1fc 992 - (dtucker) [README contrib/{caldera,redhat,suse}/openssh.spec] Crank
993 versions.
24436b92 994
5b84789f 99520060831
996 - (djm) [CREDITS LICENCE Makefile.in auth.c configure.ac includes.h ]
997 [platform.c platform.h sshd.c openbsd-compat/Makefile.in]
998 [openbsd-compat/openbsd-compat.h openbsd-compat/port-solaris.c]
999 [openbsd-compat/port-solaris.h] Add support for Solaris process
1000 contracts, enabled with --use-solaris-contracts. Patch from Chad
1001 Mynhier, tweaked by dtucker@ and myself; ok dtucker@
77f7d474 1002 - (dtucker) [contrib/cygwin/ssh-host-config] Add SeTcbPrivilege privilege
1003 while setting up the ssh service account. Patch from Corinna Vinschen.
5b84789f 1004
e9f2e744 100520060830
1006 - (djm) OpenBSD CVS Sync
1007 - dtucker@cvs.openbsd.org 2006/08/21 08:14:01
1008 [sshd_config.5]
1009 Document HostbasedUsesNameFromPacketOnly. Corrections from jmc@,
1010 ok jmc@ djm@
5f047fbc 1011 - dtucker@cvs.openbsd.org 2006/08/21 08:15:57
1012 [sshd.8]
1013 Add more detail about what permissions are and aren't accepted for
1014 authorized_keys files. Corrections jmc@, ok djm@, "looks good" jmc@
0875ae22 1015 - djm@cvs.openbsd.org 2006/08/29 10:40:19
1016 [channels.c session.c]
1017 normalise some inconsistent (but harmless) NULL pointer checks
1018 spotted by the Stanford SATURN tool, via Isil Dillig;
1019 ok markus@ deraadt@
b4f8e1cb 1020 - dtucker@cvs.openbsd.org 2006/08/29 12:02:30
1021 [gss-genr.c]
1022 Work around a problem in Heimdal that occurs when KRB5CCNAME file is
1023 missing, by checking whether or not kerberos allocated us a context
1024 before attempting to free it. Patch from Simon Wilkinson, tested by
1025 biorn@, ok djm@
3223b72f 1026 - dtucker@cvs.openbsd.org 2006/08/30 00:06:51
1027 [sshconnect2.c]
1028 Fix regression where SSH2 banner is printed at loglevels ERROR and FATAL
1029 where previously it weren't. bz #1221, found by Dean Kopesky, ok djm@
76970201 1030 - djm@cvs.openbsd.org 2006/08/30 00:14:37
1031 [version.h]
1032 crank to 4.4
9d68c41d 1033 - (djm) [openbsd-compat/xcrypt.c] needs unistd.h
6545dd0b 1034 - (dtucker) [auth.c openbsd-compat/port-aix.c] Bug #1207: always call
1035 loginsuccess on AIX immediately after authentication to clear the failed
1036 login count. Previously this would only happen when an interactive
1037 session starts (ie when a pty is allocated) but this means that accounts
1038 that have primarily non-interactive sessions (eg scp's) may gradually
1039 accumulate enough failures to lock out an account. This change may have
1040 a side effect of creating two audit records, one with a tty of "ssh"
1041 corresponding to the authentication and one with the allocated pty per
1042 interactive session.
e9f2e744 1043
48a7de26 104420060824
1045 - (dtucker) [openbsd-compat/basename.c] Include errno.h.
8151aaa5 1046 - (dtucker) [openbsd-compat/bsd-misc.c] Add includes needed for select(2) on
1047 older systems.
ab26f490 1048 - (dtucker) [openbsd-compat/bsd-misc.c] Include <sys/select.h> for select(2)
1049 on POSIX systems.
6beea87c 1050 - (dtucker) [openbsd-compat/bsd-openpty.c] Include for ioctl(2).
e429fba8 1051 - (dtucker) [openbsd-compat/rresvport.c] Include <stdlib.h> for malloc.
f07855f7 1052 - (dtucker) [openbsd-compat/xmmap.c] Move #define HAVE_MMAP to prevent
1053 unused variable warning when we have a broken or missing mmap(2).
48a7de26 1054
c1a1c295 105520060822
1056 - (dtucker) [Makefile.in] Bug #1177: fix incorrect path for sshrc in
1057 Makefile. Patch from santhi.amirta at gmail, ok djm.
1058
9895d518 105920060820
1060 - (dtucker) [log.c] Move ifdef to prevent unused variable warning.
08fb8ce9 1061 - (dtucker) [configure.ac] Save $LIBS during PAM library tests and restore
1062 afterward. Removes the need to mangle $LIBS later to remove -lpam and -ldl.
a086f73b 1063 - (dtucker) [configure.ac] Relocate --with-pam parts in preparation for
1064 fixing bug #1181. No changes yet.
282d6408 1065 - (dtucker) [configure.ac] Bug #1181: Explicitly test to see if OpenSSL
1066 (0.9.8a and presumably newer) requires -ldl to successfully link.
08164407 1067 - (dtucker) [configure.ac] Remove errant "-".
9895d518 1068
94d458e8 106920060819
1070 - (djm) OpenBSD CVS Sync
1071 - djm@cvs.openbsd.org 2006/08/18 22:41:29
1072 [gss-genr.c]
1073 GSSAPI error code should be 0 and not -1; from simon@sxw.org.uk
ea83a498 1074 - (dtucker) [openbsd-compat/regress/Makefile.in] Add $(EXEEXT) and add a
1075 single rule for the test progs.
94d458e8 1076
795e7517 107720060818
1078 - (dtucker) [configure.ac openbsd-compat/bsd-closefrom.c] Resync with
1079 closefrom.c from sudo.
5a1d6300 1080 - (dtucker) [openbsd-compat/bsd-closefrom.c] Comment out rcsid.
fed313fd 1081 - (dtucker) [openbsd-compat/regress/snprintftest.c] Newline on error.
d5498c58 1082 - (dtucker) [openbsd-compat/regress/Makefile.in] Use implicit rules for the
1083 test progs instead; they work better than what we have.
78372b6e 1084 - (djm) OpenBSD CVS Sync
1085 - stevesk@cvs.openbsd.org 2006/08/06 01:13:32
1086 [compress.c monitor.c monitor_wrap.c]
1087 "zlib.h" can be <zlib.h>; ok djm@ markus@
ba52fb56 1088 - miod@cvs.openbsd.org 2006/08/12 20:46:46
1089 [monitor.c monitor_wrap.c]
1090 Revert previous include file ordering change, for ssh to compile under
1091 gcc2 (or until openssl include files are cleaned of parameter names
1092 in function prototypes)
fa47fe3c 1093 - dtucker@cvs.openbsd.org 2006/08/14 12:40:25
1094 [servconf.c servconf.h sshd_config.5]
1095 Add ability to match groups to Match keyword in sshd_config. Feedback
1096 djm@, stevesk@, ok stevesk@.
e07335e2 1097 - djm@cvs.openbsd.org 2006/08/16 11:47:15
1098 [sshd.c]
1099 factor inetd connection, TCP listen and main TCP accept loop out of
1100 main() into separate functions to improve readability; ok markus@
28463427 1101 - deraadt@cvs.openbsd.org 2006/08/18 09:13:26
1102 [log.c log.h sshd.c]
1103 make signal handler termination path shorter; risky code pointed out by
1104 mark dowd; ok djm markus
184cb418 1105 - markus@cvs.openbsd.org 2006/08/18 09:15:20
1106 [auth.h session.c sshd.c]
1107 delay authentication related cleanups until we're authenticated and
1108 all alarms have been cancelled; ok deraadt
b2af4ca8 1109 - djm@cvs.openbsd.org 2006/08/18 10:27:16
1110 [misc.h]
1111 reorder so prototypes are sorted by the files they refer to; no
1112 binary change
592de384 1113 - djm@cvs.openbsd.org 2006/08/18 13:54:54
1114 [gss-genr.c ssh-gss.h sshconnect2.c]
1115 bz #1218 - disable SPNEGO as per RFC4462; diff from simon AT sxw.org.uk
1116 ok markus@
abb47f1e 1117 - djm@cvs.openbsd.org 2006/08/18 14:40:34
1118 [gss-genr.c ssh-gss.h]
1119 constify host argument to match the rest of the GSSAPI functions and
1120 unbreak compilation with -Werror
c79c4814 1121 - (djm) Disable sigdie() for platforms that cannot safely syslog inside
1122 a signal handler (basically all of them, excepting OpenBSD);
1123 ok dtucker@
795e7517 1124
f8688ddd 112520060817
1126 - (dtucker) [openbsd-compat/fake-rfc2553.c openbsd-compat/setproctitle.c]
1127 Include stdlib.h for malloc and friends.
53c337ed 1128 - (dtucker) [configure.ac openbsd-compat/bsd-closefrom.c] Use F_CLOSEM fcntl
1129 for closefrom() on AIX. Pointed out by William Ahern.
98cc66aa 1130 - (dtucker) [openbsd-compat/regress/{Makefile.in,closefromtest.c}] Regress
1131 test for closefrom() in compat code.
f8688ddd 1132
5388904a 113320060816
1134 - (djm) [audit-bsm.c] Sprinkle in some headers
1135
4a86d8eb 113620060815
1137 - (dtucker) [LICENCE] Add Reyk to the list for the compat dir.
1138
3a5b6088 113920060806
1140 - (djm) [openbsd-compat/bsd-getpeereid.c] Add some headers to quiet warnings
1141 on Solaris 10
1142
114320060806
149abacb 1144 - (dtucker) [defines.h] With the includes.h changes we no longer get the
1145 name clash on "YES" so we can remove the workaround for it.
442a6515 1146 - (dtucker) [openbsd-compat/{bsd-asprintf.c,bsd-openpty.c,bsd-snprintf.c,
1147 glob.c}] Include stdlib.h for malloc and friends in compat code.
149abacb 1148
fee76795 114920060805
1150 - (djm) OpenBSD CVS Sync
1151 - stevesk@cvs.openbsd.org 2006/07/24 13:58:22
1152 [sshconnect.c]
1153 disable tunnel forwarding when no strict host key checking
1154 and key changed; ok djm@ markus@ dtucker@
912da635 1155 - stevesk@cvs.openbsd.org 2006/07/25 02:01:34
1156 [scard.c]
1157 need #include <string.h>
e264ac72 1158 - stevesk@cvs.openbsd.org 2006/07/25 02:59:21
1159 [channels.c clientloop.c packet.c scp.c serverloop.c sftp-client.c]
1160 [sftp-server.c ssh-agent.c ssh-keyscan.c sshconnect.c sshd.c]
1161 move #include <sys/time.h> out of includes.h
536c14e8 1162 - stevesk@cvs.openbsd.org 2006/07/26 02:35:17
1163 [atomicio.c auth.c dh.c authfile.c buffer.c clientloop.c kex.c]
1164 [groupaccess.c gss-genr.c kexgexs.c misc.c monitor.c monitor_mm.c]
1165 [packet.c scp.c serverloop.c session.c sftp-client.c sftp-common.c]
1166 [sftp-server.c sftp.c ssh-add.c ssh-agent.c ssh-keygen.c sshlogin.c]
1167 [uidswap.c xmalloc.c]
1168 move #include <sys/param.h> out of includes.h
ffa517a8 1169 - stevesk@cvs.openbsd.org 2006/07/26 13:57:17
1170 [authfd.c authfile.c dh.c canohost.c channels.c clientloop.c compat.c]
1171 [hostfile.c kex.c log.c misc.c moduli.c monitor.c packet.c readpass.c]
1172 [scp.c servconf.c session.c sftp-server.c sftp.c ssh-add.c ssh-agent.c]
1173 [ssh-keygen.c ssh-keyscan.c ssh-keysign.c ssh.c sshconnect.c]
1174 [sshconnect1.c sshd.c xmalloc.c]
1175 move #include <stdlib.h> out of includes.h
f0817fbb 1176 - jmc@cvs.openbsd.org 2006/07/27 08:00:50
1177 [ssh_config.5]
1178 avoid confusing wording in HashKnownHosts:
1179 originally spotted by alan amesbury;
1180 ok deraadt
38b37661 1181 - jmc@cvs.openbsd.org 2006/07/27 08:00:50
1182 [ssh_config.5]
1183 avoid confusing wording in HashKnownHosts:
1184 originally spotted by alan amesbury;
1185 ok deraadt
331c3884 1186 - dtucker@cvs.openbsd.org 2006/08/01 11:34:36
1187 [sshconnect.c]
1188 Allow fallback to known_hosts entries without port qualifiers for
1189 non-standard ports too, so that all existing known_hosts entries will be
1190 recognised. Requested by, feedback and ok markus@
cf851879 1191 - stevesk@cvs.openbsd.org 2006/08/01 23:22:48
1192 [auth-passwd.c auth-rhosts.c auth-rsa.c auth.c auth.h auth1.c]
1193 [auth2-chall.c auth2-pubkey.c authfile.c buffer.c canohost.c]
1194 [channels.c clientloop.c dh.c dns.c dns.h hostfile.c kex.c kexdhc.c]
1195 [kexgexc.c kexgexs.c key.c key.h log.c misc.c misc.h moduli.c]
1196 [monitor_wrap.c packet.c progressmeter.c readconf.c readpass.c scp.c]
1197 [servconf.c session.c sftp-client.c sftp-common.c sftp-server.c sftp.c]
1198 [ssh-add.c ssh-agent.c ssh-keygen.c ssh-keyscan.c ssh.c sshconnect.c]
1199 [sshconnect1.c sshconnect2.c sshd.c sshlogin.c sshtty.c uuencode.c]
1200 [uuencode.h xmalloc.c]
1201 move #include <stdio.h> out of includes.h
d4f40d92 1202 - stevesk@cvs.openbsd.org 2006/08/01 23:36:12
1203 [authfile.c channels.c progressmeter.c scard.c servconf.c ssh.c]
1204 clean extra spaces
31652869 1205 - deraadt@cvs.openbsd.org 2006/08/03 03:34:42
1206 [OVERVIEW atomicio.c atomicio.h auth-bsdauth.c auth-chall.c auth-krb5.c]
1207 [auth-options.c auth-options.h auth-passwd.c auth-rh-rsa.c auth-rhosts.c]
1208 [auth-rsa.c auth-skey.c auth.c auth.h auth1.c auth2-chall.c auth2-gss.c]
1209 [auth2-hostbased.c auth2-kbdint.c auth2-none.c auth2-passwd.c ]
1210 [auth2-pubkey.c auth2.c authfd.c authfd.h authfile.c bufaux.c bufbn.c]
1211 [buffer.c buffer.h canohost.c channels.c channels.h cipher-3des1.c]
1212 [cipher-bf1.c cipher-ctr.c cipher.c cleanup.c clientloop.c compat.c]
1213 [compress.c deattack.c dh.c dispatch.c dns.c dns.h fatal.c groupaccess.c]
1214 [groupaccess.h gss-genr.c gss-serv-krb5.c gss-serv.c hostfile.c kex.c]
1215 [kex.h kexdh.c kexdhc.c kexdhs.c kexgex.c kexgexc.c kexgexs.c key.c]
1216 [key.h log.c log.h mac.c match.c md-sha256.c misc.c misc.h moduli.c]
1217 [monitor.c monitor_fdpass.c monitor_mm.c monitor_mm.h monitor_wrap.c]
1218 [monitor_wrap.h msg.c nchan.c packet.c progressmeter.c readconf.c]
1219 [readconf.h readpass.c rsa.c scard.c scard.h scp.c servconf.c servconf.h]
1220 [serverloop.c session.c session.h sftp-client.c sftp-common.c]
1221 [sftp-common.h sftp-glob.c sftp-server.c sftp.c ssh-add.c ssh-agent.c]
1222 [ssh-dss.c ssh-gss.h ssh-keygen.c ssh-keyscan.c ssh-keysign.c ssh-rsa.c]
1223 [ssh.c ssh.h sshconnect.c sshconnect.h sshconnect1.c sshconnect2.c]
1224 [sshd.c sshlogin.c sshlogin.h sshpty.c sshpty.h sshtty.c ttymodes.c]
1225 [uidswap.c uidswap.h uuencode.c uuencode.h xmalloc.c xmalloc.h]
1226 [loginrec.c loginrec.h openbsd-compat/port-aix.c openbsd-compat/port-tun.h]
1227 almost entirely get rid of the culture of ".h files that include .h files"
1228 ok djm, sort of ok stevesk
1229 makes the pain stop in one easy step
1230 NB. portable commit contains everything *except* removing includes.h, as
1231 that will take a fair bit more work as we move headers that are required
1232 for portability workarounds to defines.h. (also, this step wasn't "easy")
c56969f9 1233 - stevesk@cvs.openbsd.org 2006/08/04 20:46:05
1234 [monitor.c session.c ssh-agent.c]
1235 spaces
8bdc7aa0 1236 - (djm) [auth-pam.c defines.h] Move PAM related bits to auth-pam.c
693a35d3 1237 - (djm) [auth-pam.c auth.c bufaux.h entropy.c openbsd-compat/port-tun.c]
1238 remove last traces of bufaux.h - it was merged into buffer.h in the big
1239 includes.h commit
8ad2db2a 1240 - (djm) [auth.c loginrec.c] Missing netinet/in.h for loginrec
8d3106fd 1241 - (djm) [openbsd-compat/regress/snprintftest.c]
1242 [openbsd-compat/regress/strduptest.c] Add missing includes so they pass
1243 compilation with "-Wall -Werror"
00a017bd 1244 - (djm) [auth-pam.c auth-shadow.c auth2-none.c cleanup.c sshd.c]
1245 [openbsd-compat/port-tun.c openbsd-compat/port-tun.h] Sprinkle more
1246 includes for Linux in
ccc09f5c 1247 - (dtucker) [cleanup.c] Need defines.h for __dead.
9ae6b834 1248 - (dtucker) [auth2-gss.c] We still need the #ifdef GSSAPI in -portable.
f2265d5d 1249 - (dtucker) [openbsd-compat/{bsd-arc4random.c,port-tun.c,xmmap.c}] Lots of
1250 #include stdarg.h, needed for log.h.
5be9f803 1251 - (dtucker) [entropy.c] Needs unistd.h too.
35d1c2de 1252 - (dtucker) [ssh-rand-helper.c] Needs stdarg.h for log.h.
76e03684 1253 - (dtucker) [openbsd-compat/getrrsetbyname.c] Nees stdlib.h for malloc.
5946a69f 1254 - (dtucker) [openbsd-compat/strtonum.c] Include stdlib.h for strtoll,
1255 otherwise it is implicitly declared as returning an int.
428f6258 1256 - (dtucker) OpenBSD CVS Sync
1257 - dtucker@cvs.openbsd.org 2006/08/05 07:52:52
1258 [auth2-none.c sshd.c monitor_wrap.c]
1259 Add headers required to build with KERBEROS5=no. ok djm@
453cb7e7 1260 - dtucker@cvs.openbsd.org 2006/08/05 08:00:33
1261 [auth-skey.c]
1262 Add headers required to build with -DSKEY. ok djm@
cecc422f 1263 - dtucker@cvs.openbsd.org 2006/08/05 08:28:24
1264 [monitor_wrap.c auth-skey.c auth2-chall.c]
1265 Zap unused variables in -DSKEY code. ok djm@
0e13ec0f 1266 - dtucker@cvs.openbsd.org 2006/08/05 08:34:04
1267 [packet.c]
1268 Typo in comment
97ea266c 1269 - (dtucker) [openbsd-compat/bsd-cygwin_util.c] Add headers required to compile
1270 on Cygwin.
e3220bb2 1271 - (dtucker) [openbsd-compat/fake-rfc2553.c] Add headers needed for inet_ntoa.
f3296bc4 1272 - (dtucker) [auth-skey.c] monitor_wrap.h needs ssh-gss.h.
0e23dc86 1273 - (dtucker) [audit.c audit.h] Repair headers.
6f54ce27 1274 - (dtucker) [audit-bsm.c] Add additional headers now required.
fee76795 1275
3e05aa50 127620060804
1277 - (dtucker) [configure.ac] The "crippled AES" test does not work on recent
1278 versions of Solaris, so use AC_LINK_IFELSE to actually link the test program
1279 rather than just compiling it. Spotted by dlg@.
1280
53d4ae20 128120060802
1282 - (dtucker) [openbsd-compat/daemon.c] Add unistd.h for fork() prototype.
1283
be350da6 128420060725
1285 - (dtucker) [openbsd-compat/xmmap.c] Need fcntl.h for O_RDRW.
1286
14e980ef 128720060724
1288 - (djm) OpenBSD CVS Sync
1289 - jmc@cvs.openbsd.org 2006/07/12 13:39:55
1290 [sshd_config.5]
1291 - new sentence, new line
1292 - s/The the/The/
1293 - kill a bad comma
c8dfff33 1294 - stevesk@cvs.openbsd.org 2006/07/12 22:28:52
742bee8c 1295 [auth-options.c canohost.c channels.c includes.h readconf.c]
1296 [servconf.c ssh-keyscan.c ssh.c sshconnect.c sshd.c]
c8dfff33 1297 move #include <netdb.h> out of includes.h; ok djm@
bcaab305 1298 - stevesk@cvs.openbsd.org 2006/07/12 22:42:32
1299 [includes.h ssh.c ssh-rand-helper.c]
1300 move #include <stddef.h> out of includes.h
d2a69816 1301 - stevesk@cvs.openbsd.org 2006/07/14 01:15:28
1302 [monitor_wrap.h]
1303 don't need incompletely-typed 'struct passwd' now with
1304 #include <pwd.h>; ok markus@
5188ba17 1305 - stevesk@cvs.openbsd.org 2006/07/17 01:31:10
1306 [authfd.c authfile.c channels.c cleanup.c clientloop.c groupaccess.c]
1307 [includes.h log.c misc.c msg.c packet.c progressmeter.c readconf.c]
1308 [readpass.c scp.c servconf.c sftp-client.c sftp-server.c sftp.c]
1309 [ssh-add.c ssh-agent.c ssh-keygen.c ssh-keyscan.c ssh-keysign.c ssh.c]
1310 [sshconnect.c sshlogin.c sshpty.c uidswap.c]
1311 move #include <unistd.h> out of includes.h
774de098 1312 - dtucker@cvs.openbsd.org 2006/07/17 12:02:24
1313 [auth-options.c]
1314 Use '\0' rather than 0 to terminates strings; ok djm@
2fefbadf 1315 - dtucker@cvs.openbsd.org 2006/07/17 12:06:00
1316 [channels.c channels.h servconf.c sshd_config.5]
1317 Add PermitOpen directive to sshd_config which is equivalent to the
1318 "permitopen" key option. Allows server admin to allow TCP port
1319 forwarding only two specific host/port pairs. Useful when combined
1320 with Match.
1321 If permitopen is used in both sshd_config and a key option, both
1322 must allow a given connection before it will be permitted.
1323 Note that users can still use external forwarders such as netcat,
1324 so to be those must be controlled too for the limits to be effective.
1325 Feedback & ok djm@, man page corrections & ok jmc@.
f22506ff 1326 - jmc@cvs.openbsd.org 2006/07/18 07:50:40
1327 [sshd_config.5]
1328 tweak; ok dtucker
578d2b99 1329 - jmc@cvs.openbsd.org 2006/07/18 07:56:28
1330 [scp.1]
1331 replace DIAGNOSTICS with .Ex;
874d319b 1332 - jmc@cvs.openbsd.org 2006/07/18 08:03:09
1333 [ssh-agent.1 sshd_config.5]
1334 mark up angle brackets;
4895f836 1335 - dtucker@cvs.openbsd.org 2006/07/18 08:22:23
1336 [sshd_config.5]
1337 Clarify description of Match, with minor correction from jmc@
62e12ffe 1338 - stevesk@cvs.openbsd.org 2006/07/18 22:27:55
1339 [dh.c]
1340 remove unneeded includes; ok djm@
691712e0 1341 - dtucker@cvs.openbsd.org 2006/07/19 08:56:41
1342 [servconf.c sshd_config.5]
1343 Add support for X11Forwaring, X11DisplayOffset and X11UseLocalhost to
1344 Match. ok djm@
e7259e8d 1345 - dtucker@cvs.openbsd.org 2006/07/19 13:07:10
1346 [servconf.c servconf.h session.c sshd.8 sshd_config sshd_config.5]
1347 Add ForceCommand keyword to sshd_config, equivalent to the "command="
1348 key option, man page entry and example in sshd_config.
1349 Feedback & ok djm@, man page corrections & ok jmc@
67514848 1350 - stevesk@cvs.openbsd.org 2006/07/20 15:26:15
1351 [auth1.c serverloop.c session.c sshconnect2.c]
1352 missed some needed #include <unistd.h> when KERBEROS5=no; issue from
1353 massimo@cedoc.mo.it
ea46e550 1354 - dtucker@cvs.openbsd.org 2006/07/21 12:43:36
1355 [channels.c channels.h servconf.c servconf.h sshd_config.5]
1356 Make PermitOpen take a list of permitted ports and act more like most
1357 other keywords (ie the first match is the effective setting). This
1358 also makes it easier to override a previously set PermitOpen. ok djm@
ebb90778 1359 - stevesk@cvs.openbsd.org 2006/07/21 21:13:30
1360 [channels.c]
1361 more ARGSUSED (lint) for dispatch table-driven functions; ok djm@
c88c3fb9 1362 - stevesk@cvs.openbsd.org 2006/07/21 21:26:55
1363 [progressmeter.c]
1364 ARGSUSED for signal handler
b0f6943a 1365 - stevesk@cvs.openbsd.org 2006/07/22 19:08:54
1366 [includes.h moduli.c progressmeter.c scp.c sftp-common.c]
1367 [sftp-server.c ssh-agent.c sshlogin.c]
1368 move #include <time.h> out of includes.h
00146caa 1369 - stevesk@cvs.openbsd.org 2006/07/22 20:48:23
1370 [atomicio.c auth-options.c auth-passwd.c auth-rhosts.c auth-rsa.c]
1371 [auth.c auth1.c auth2-chall.c auth2-hostbased.c auth2-passwd.c auth2.c]
1372 [authfd.c authfile.c bufaux.c bufbn.c buffer.c canohost.c channels.c]
1373 [cipher-3des1.c cipher-bf1.c cipher-ctr.c cipher.c clientloop.c]
1374 [compat.c deattack.c dh.c dns.c gss-genr.c gss-serv.c hostfile.c]
1375 [includes.h kex.c kexdhc.c kexdhs.c kexgexc.c kexgexs.c key.c log.c]
1376 [mac.c match.c md-sha256.c misc.c moduli.c monitor.c monitor_fdpass.c]
1377 [monitor_mm.c monitor_wrap.c msg.c nchan.c packet.c rsa.c]
1378 [progressmeter.c readconf.c readpass.c scp.c servconf.c serverloop.c]
1379 [session.c sftp-client.c sftp-common.c sftp-glob.c sftp-server.c sftp.c]
1380 [ssh-add.c ssh-agent.c ssh-dss.c ssh-keygen.c ssh-keyscan.c]
1381 [ssh-keysign.c ssh-rsa.c ssh.c sshconnect.c sshconnect1.c sshconnect2.c]
1382 [sshd.c sshlogin.c sshpty.c ttymodes.c uidswap.c xmalloc.c]
1383 move #include <string.h> out of includes.h
519fc2b7 1384 - stevesk@cvs.openbsd.org 2006/07/23 01:11:05
1385 [auth.h dispatch.c kex.h sftp-client.c]
1386 #include <signal.h> for sig_atomic_t; need this prior to <sys/param.h>
1387 move
28cb0a43 1388 - (djm) [acss.c auth-krb5.c auth-options.c auth-pam.c auth-shadow.c]
1389 [canohost.c channels.c cipher-acss.c defines.h dns.c gss-genr.c]
1390 [gss-serv-krb5.c gss-serv.c log.h loginrec.c logintest.c readconf.c]
1391 [servconf.c ssh-keygen.c ssh-keyscan.c ssh-keysign.c ssh-rand-helper.c]
1392 [ssh.c sshconnect.c sshd.c openbsd-compat/bindresvport.c]
1393 [openbsd-compat/bsd-arc4random.c openbsd-compat/bsd-misc.c]
1394 [openbsd-compat/getrrsetbyname.c openbsd-compat/glob.c]
1395 [openbsd-compat/mktemp.c openbsd-compat/port-linux.c]
1396 [openbsd-compat/port-tun.c openbsd-compat/readpassphrase.c]
1397 [openbsd-compat/setproctitle.c openbsd-compat/xmmap.c]
1398 make the portable tree compile again - sprinkle unistd.h and string.h
1399 back in. Don't redefine __unused, as it turned out to be used in
1400 headers on Linux, and replace its use in auth-pam.c with ARGSUSED
ba1e6121 1401 - (djm) [openbsd-compat/glob.c]
1402 Move get_arg_max() into the ifdef HAVE_GLOB block so that it compiles
1403 on OpenBSD (or other platforms with a decent glob implementation) with
1404 -Werror
25523747 1405 - (djm) [uuencode.c]
1406 Add resolv.h, is it contains the prototypes for __b64_ntop/__b64_pton on
1407 some platforms
9b09381d 1408 - (djm) [session.c]
1409 fix compile error with -Werror -Wall: 'path' is only used in
1410 do_setup_env() if HAVE_LOGIN_CAP is not defined
e204f3ee 1411 - (djm) [openbsd-compat/basename.c openbsd-compat/bsd-closefrom.c]
1412 [openbsd-compat/bsd-cray.c openbsd-compat/bsd-openpty.c]
1413 [openbsd-compat/bsd-snprintf.c openbsd-compat/fake-rfc2553.c]
1414 [openbsd-compat/port-aix.c openbsd-compat/port-irix.c]
1415 [openbsd-compat/rresvport.c]
1416 These look to need string.h and/or unistd.h (based on a grep for function
1417 names)
f40c8634 1418 - (djm) [Makefile.in]
1419 Remove generated openbsd-compat/regress/Makefile in distclean target
e7c5b206 1420 - (djm) [regress/Makefile regress/agent-getpeereid.sh regress/cfgmatch.sh]
1421 [regress/cipher-speed.sh regress/forcecommand.sh regress/forwarding.sh]
1422 Sync regress tests to -current; include dtucker@'s new cfgmatch and
1423 forcecommand tests. Add cipher-speed.sh test (not linked in yet)
30872a12 1424 - (dtucker) [cleanup.c] Since config.h defines _LARGE_FILES on AIX, including
1425 system headers before defines.h will cause conflicting definitions.
b64d983b 1426 - (dtucker) [regress/forcecommand.sh] Portablize.
e204f3ee 1427
4352744e 142820060713
1429 - (dtucker) [auth-krb5.c auth-pam.c] Still more errno.h
1430
956d6743 143120060712
294d3ca5 1432 - (dtucker) [configure.ac defines.h] Only define SHUT_RD (and friends) and
1433 O_NONBLOCK if they're really needed. Fixes build errors on HP-UX, old
1434 Linuxes and probably more.
71f4c727 1435 - (dtucker) [configure.ac] OpenBSD needs <sys/types.h> before <sys/socket.h>
1436 for SHUT_RD.
f9d5c000 1437 - (dtucker) [openbsd-compat/port-tun.c] OpenBSD needs <netinet/in.h> before
1438 <netinet/ip.h>.
a773acf7 1439 - (dtucker) OpenBSD CVS Sync
1440 - stevesk@cvs.openbsd.org 2006/07/10 16:01:57
1441 [sftp-glob.c sftp-common.h sftp.c]
1442 buffer.h only needed in sftp-common.h and remove some unneeded
1443 user includes; ok djm@
a0bca6ed 1444 - jmc@cvs.openbsd.org 2006/07/10 16:04:21
1445 [sshd.8]
1446 s/and and/and/
4c72fcfd 1447 - stevesk@cvs.openbsd.org 2006/07/10 16:37:36
1448 [readpass.c log.h scp.c fatal.c xmalloc.c includes.h ssh-keyscan.c misc.c
1449 auth.c packet.c log.c]
1450 move #include <stdarg.h> out of includes.h; ok markus@
0ad62016 1451 - dtucker@cvs.openbsd.org 2006/07/11 10:12:07
1452 [ssh.c]
1453 Only copy the part of environment variable that we actually use. Prevents
1454 ssh bailing when SendEnv is used and an environment variable with a really
1455 long value exists. ok djm@
42ea6f5e 1456 - markus@cvs.openbsd.org 2006/07/11 18:50:48
1457 [clientloop.c ssh.1 ssh.c channels.c ssh_config.5 readconf.h session.c
1458 channels.h readconf.c]
1459 add ExitOnForwardFailure: terminate the connection if ssh(1)
1460 cannot set up all requested dynamic, local, and remote port
1461 forwardings. ok djm, dtucker, stevesk, jmc
028094f4 1462 - stevesk@cvs.openbsd.org 2006/07/11 20:07:25
1463 [scp.c auth.c monitor.c serverloop.c sftp-server.c sshpty.c readpass.c
1464 sshd.c monitor_wrap.c monitor_fdpass.c ssh-agent.c ttymodes.c atomicio.c
1465 includes.h session.c sshlogin.c monitor_mm.c packet.c sshconnect2.c
1466 sftp-client.c nchan.c clientloop.c sftp.c misc.c canohost.c channels.c
1467 ssh-keygen.c progressmeter.c uidswap.c msg.c readconf.c sshconnect.c]
1468 move #include <errno.h> out of includes.h; ok markus@
00c8971b 1469 - stevesk@cvs.openbsd.org 2006/07/11 20:16:43
1470 [ssh.c]
1471 cast asterisk field precision argument to int to remove warning;
1472 ok markus@
dd984467 1473 - stevesk@cvs.openbsd.org 2006/07/11 20:27:56
1474 [authfile.c ssh.c]
1475 need <errno.h> here also (it's also included in <openssl/err.h>)
d231781a 1476 - dtucker@cvs.openbsd.org 2006/07/12 11:34:58
1477 [sshd.c servconf.h servconf.c sshd_config.5 auth.c]
1478 Add support for conditional directives to sshd_config via a "Match"
1479 keyword, which works similarly to the "Host" directive in ssh_config.
1480 Lines after a Match line override the default set in the main section
1481 if the condition on the Match line is true, eg
1482 AllowTcpForwarding yes
1483 Match User anoncvs
1484 AllowTcpForwarding no
1485 will allow port forwarding by all users except "anoncvs".
1486 Currently only a very small subset of directives are supported.
1487 ok djm@
fec71b2f 1488 - (dtucker) [loginrec.c openbsd-compat/xmmap.c openbsd-compat/bindresvport.c
1489 openbsd-compat/glob.c openbsd-compat/mktemp.c openbsd-compat/port-tun.c
1490 openbsd-compat/readpassphrase.c openbsd-compat/strtonum.c] Include <errno.h>.
baede55a 1491 - (dtucker) [openbsd-compat/setproctitle.c] Include stdarg.h.
403a29ac 1492 - (dtucker) [ssh-keyscan.c ssh-rand-helper.c] More errno.h here too.
5f8747dc 1493 - (dtucker) [openbsd-compat/openbsd-compat.h] v*printf needs stdarg.h.
4f4b7d4d 1494 - (dtucker) [openbsd-compat/bsd-asprintf.c openbsd-compat/port-aix.c
1495 openbsd-compat/rresvport.c] More errno.h.
1496
37259a8e 149720060711
1498 - (dtucker) [configure.ac ssh-keygen.c openbsd-compat/bsd-openpty.c
1499 openbsd-compat/daemon.c] Add includes needed by open(2). Conditionally
1500 include paths.h. Fixes build error on Solaris.
2edd133e 1501 - (dtucker) [entropy.c] More fcntl.h, this time on AIX (and probably
1502 others).
37259a8e 1503
44064ac4 150420060710
1505 - (dtucker) [INSTALL] New autoconf version: 2.60.
e5c76324 1506 - OpenBSD CVS Sync
1507 - djm@cvs.openbsd.org 2006/06/14 10:50:42
1508 [sshconnect.c]
1509 limit the number of pre-banner characters we will accept; ok markus@
9f1090be 1510 - djm@cvs.openbsd.org 2006/06/26 10:36:15
1511 [clientloop.c]
1512 mention optional bind_address in runtime port forwarding setup
1513 command-line help. patch from santhi.amirta AT gmail.com
06fa4ac1 1514 - stevesk@cvs.openbsd.org 2006/07/02 17:12:58
1515 [ssh.1 ssh.c ssh_config.5 sshd_config.5]
1516 more details and clarity for tun(4) device forwarding; ok and help
1517 jmc@
6955279c 1518 - stevesk@cvs.openbsd.org 2006/07/02 18:36:47
1519 [gss-serv-krb5.c gss-serv.c]
1520 no "servconf.h" needed here
1521 (gss-serv-krb5.c change not applied, portable needs the server options)
16fbe330 1522 - stevesk@cvs.openbsd.org 2006/07/02 22:45:59
1523 [groupaccess.c groupaccess.h includes.h session.c sftp-common.c sshpty.c]
1524 move #include <grp.h> out of includes.h
1525 (portable needed uidswap.c too)
33f13fa5 1526 - stevesk@cvs.openbsd.org 2006/07/02 23:01:55
1527 [clientloop.c ssh.1]
1528 use -KR[bind_address:]port here; ok djm@
28015df4 1529 - stevesk@cvs.openbsd.org 2006/07/03 08:54:20
1530 [includes.h ssh.c sshconnect.c sshd.c]
1531 move #include "version.h" out of includes.h; ok markus@
319d6b41 1532 - stevesk@cvs.openbsd.org 2006/07/03 17:59:32
1533 [channels.c includes.h]
1534 move #include <arpa/inet.h> out of includes.h; old ok djm@
1535 (portable needed session.c too)
9794d008 1536 - stevesk@cvs.openbsd.org 2006/07/05 02:42:09
1537 [canohost.c hostfile.c includes.h misc.c packet.c readconf.c]
1538 [serverloop.c sshconnect.c uuencode.c]
1539 move #include <netinet/in.h> out of includes.h; ok deraadt@
1540 (also ssh-rand-helper.c logintest.c loginrec.c)
d66ce1a1 1541 - djm@cvs.openbsd.org 2006/07/06 10:47:05
1542 [servconf.c servconf.h session.c sshd_config.5]
1543 support arguments to Subsystem commands; ok markus@
a13880bb 1544 - djm@cvs.openbsd.org 2006/07/06 10:47:57
1545 [sftp-server.8 sftp-server.c]
1546 add commandline options to enable logging of transactions; ok markus@
b1842393 1547 - stevesk@cvs.openbsd.org 2006/07/06 16:03:53
1548 [auth-options.c auth-options.h auth-passwd.c auth-rh-rsa.c]
1549 [auth-rhosts.c auth-rsa.c auth.c auth.h auth2-hostbased.c]
1550 [auth2-pubkey.c auth2.c includes.h misc.c misc.h monitor.c]
1551 [monitor_wrap.c monitor_wrap.h scp.c serverloop.c session.c]
1552 [session.h sftp-common.c ssh-add.c ssh-keygen.c ssh-keysign.c]
1553 [ssh.c sshconnect.c sshconnect.h sshd.c sshpty.c sshpty.h uidswap.c]
1554 [uidswap.h]
1555 move #include <pwd.h> out of includes.h; ok markus@
0cbe25f0 1556 - stevesk@cvs.openbsd.org 2006/07/06 16:22:39
1557 [ssh-keygen.c]
1558 move #include "dns.h" up
76275092 1559 - stevesk@cvs.openbsd.org 2006/07/06 17:36:37
1560 [monitor_wrap.h]
1561 typo in comment
5b04a8bf 1562 - stevesk@cvs.openbsd.org 2006/07/08 21:47:12
1563 [authfd.c canohost.c clientloop.c dns.c dns.h includes.h]
1564 [monitor_fdpass.c nchan.c packet.c servconf.c sftp.c ssh-agent.c]
1565 [ssh-keyscan.c ssh.c sshconnect.h sshd.c sshlogin.h]
1566 move #include <sys/socket.h> out of includes.h
9305512d 1567 - stevesk@cvs.openbsd.org 2006/07/08 21:48:53
1568 [monitor.c session.c]
1569 missed these from last commit:
1570 move #include <sys/socket.h> out of includes.h
ca1df159 1571 - stevesk@cvs.openbsd.org 2006/07/08 23:30:06
1572 [log.c]
1573 move user includes after /usr/include files
d3221cca 1574 - stevesk@cvs.openbsd.org 2006/07/09 15:15:11
1575 [auth2-none.c authfd.c authfile.c includes.h misc.c monitor.c]
1576 [readpass.c scp.c serverloop.c sftp-client.c sftp-server.c]
1577 [ssh-add.c ssh-agent.c ssh-keygen.c ssh-keysign.c ssh.c sshd.c]
1578 [sshlogin.c sshpty.c]
1579 move #include <fcntl.h> out of includes.h
657939aa 1580 - stevesk@cvs.openbsd.org 2006/07/09 15:27:59
1581 [ssh-add.c]
1582 use O_RDONLY vs. 0 in open(); no binary change
43bc2dc9 1583 - djm@cvs.openbsd.org 2006/07/10 11:24:54
1584 [sftp-server.c]
1585 remove optind - it isn't used here
26ddd377 1586 - djm@cvs.openbsd.org 2006/07/10 11:25:53
1587 [sftp-server.c]
1588 don't log variables that aren't yet set
22bbb3e6 1589 - (djm) [loginrec.c ssh-rand-helper.c sshd.c openbsd-compat/glob.c]
1590 [openbsd-compat/mktemp.c openbsd-compat/openbsd-compat.h]
1591 [openbsd-compat/port-tun.c openbsd-compat/readpassphrase.c]
1592 [openbsd-compat/xcrypt.c] Fix includes.h fallout, mainly fcntl.h
1879b184 1593 - OpenBSD CVS Sync
1594 - djm@cvs.openbsd.org 2006/07/10 12:03:20
1595 [scp.c]
1596 duplicate argv at the start of main() because it gets modified later;
1597 pointed out by deraadt@ ok markus@
a217e418 1598 - djm@cvs.openbsd.org 2006/07/10 12:08:08
1599 [channels.c]
1600 fix misparsing of SOCKS 5 packets that could result in a crash;
1601 reported by mk@ ok markus@
d4530052 1602 - dtucker@cvs.openbsd.org 2006/07/10 12:46:51
1603 [misc.c misc.h sshd.8 sshconnect.c]
1604 Add port identifier to known_hosts for non-default ports, based originally
1605 on a patch from Devin Nate in bz#910.
1606 For any connection using the default port or using a HostKeyAlias the
1607 format is unchanged, otherwise the host name or address is enclosed
1608 within square brackets in the same format as sshd's ListenAddress.
1609 Tested by many, ok markus@.
9b6edf98 1610 - (dtucker) [openbsd-compat/openbsd-compat.h] Need to include <sys/socket.h>
1611 for struct sockaddr on platforms that use the fake-rfc stuff.
44064ac4 1612
e7479666 161320060706
1614 - (dtucker) [configure.ac] Try AIX blibpath test in different order when
1615 compiling with gcc. gcc 4.1.x will accept (but ignore) -b flags so
1616 configure would not select the correct libpath linker flags.
90f321a4 1617 - (dtucker) [INSTALL] A bit more info on autoconf.
e7479666 1618
e5c27607 161920060705
1620 - (dtucker) [ssh-rand-helper.c] Don't exit if mkdir fails because the
1621 target already exists.
1622
202c6095 162320060630
1624 - (dtucker) [openbsd-compat/openbsd-compat.h] SNPRINTF_CONST for snprintf
1625 declaration too. Patch from russ at sludge.net.
0bbb4f75 1626 - (dtucker) [openbsd-compat/getrrsetbyname.c] Undef _res before defining it,
1627 prevents warnings on platforms where _res is in the system headers.
10f1064f 1628 - (dtucker) [INSTALL] Bug #1202: Note when autoconf is required and which
1629 version.
202c6095 1630
ecd9ec09 163120060627
1632 - (dtucker) [configure.ac] Bug #1203: Add missing '[', which causes problems
1633 with autoconf 2.60. Patch from vapier at gentoo.org.
1634
9c04d67d 163520060625
1636 - (dtucker) [channels.c serverloop.c] Apply the bug #1102 workaround to ptys
1637 only, otherwise sshd can hang exiting non-interactive sessions.
1638
795aa5f5 163920060624
1640 - (dtucker) [configure.ac] Bug #1193: Define PASSWD_NEEDS_USERNAME on Solaris.
1641 Works around limitation in Solaris' passwd program for changing passwords
1642 where the username is longer than 8 characters. ok djm@
24a87055 1643 - (dtucker) [serverloop.c] Get ifdef/ifndef the right way around for the bug
1644 #1102 workaround.
795aa5f5 1645
e02505e2 164620060623
1647 - (dtucker) [README.platform configure.ac openbsd-compat/port-tun.c] Add
1648 tunnel support for Mac OS X/Darwin via a third-party tun driver. Patch
1649 from reyk@, tested by anil@
ea8c44d9 1650 - (dtucker) [channels.c configure.ac serverloop.c] Bug #1102: Around AIX
1651 4.3.3 ML3 or so, the AIX pty layer starting passing zero-length writes
1652 on the pty slave as zero-length reads on the pty master, which sshd
1653 interprets as the descriptor closing. Since most things don't do zero
1654 length writes this rarely matters, but occasionally it happens, and when
1655 it does the SSH pty session appears to hang, so we add a special case for
1656 this condition. ok djm@
e02505e2 1657
6cba36fd 165820060613
ae410a09 1659 - (djm) [getput.h] This file has been replaced by functions in misc.c
6cba36fd 1660 - OpenBSD CVS Sync
1661 - djm@cvs.openbsd.org 2006/05/08 10:49:48
1662 [sshconnect2.c]
1663 uint32_t -> u_int32_t (which we use everywhere else)
1664 (Id sync only - portable already had this)
3173dd0d 1665 - markus@cvs.openbsd.org 2006/05/16 09:00:00
1666 [clientloop.c]
1667 missing free; from Kylene Hall
2b8dc5e3 1668 - markus@cvs.openbsd.org 2006/05/17 12:43:34
1669 [scp.c sftp.c ssh-agent.c ssh-keygen.c sshconnect.c]
1670 fix leak; coverity via Kylene Jo Hall
18c60a0b 1671 - miod@cvs.openbsd.org 2006/05/18 21:27:25
1672 [kexdhc.c kexgexc.c]
1673 paramter -> parameter
07a80cea 1674 - dtucker@cvs.openbsd.org 2006/05/29 12:54:08
1675 [ssh_config.5]
1676 Add gssapi-with-mic to PreferredAuthentications default list; ok jmc
aa195106 1677 - dtucker@cvs.openbsd.org 2006/05/29 12:56:33
1678 [ssh_config]
f127d8a4 1679 Add GSSAPIAuthentication and GSSAPIDelegateCredentials to examples in
1680 sample ssh_config. ok markus@
1681 - jmc@cvs.openbsd.org 2006/05/29 16:10:03
1682 [ssh_config.5]
1683 oops - previous was too long; split the list of auths up
ed277f5e 1684 - mk@cvs.openbsd.org 2006/05/30 11:46:38
1685 [ssh-add.c]
1686 Sync usage() with man page and reality.
1687 ok deraadt dtucker
1688 - jmc@cvs.openbsd.org 2006/05/29 16:13:23
1689 [ssh.1]
1690 add GSSAPI to the list of authentication methods supported;
f9579ee9 1691 - mk@cvs.openbsd.org 2006/05/30 11:46:38
1692 [ssh-add.c]
1693 Sync usage() with man page and reality.
1694 ok deraadt dtucker
211f229e 1695 - markus@cvs.openbsd.org 2006/06/01 09:21:48
1696 [sshd.c]
1697 call get_remote_ipaddr() early; fixes logging after client disconnects;
1698 report mpf@; ok dtucker@
82aeee5d 1699 - markus@cvs.openbsd.org 2006/06/06 10:20:20
1700 [readpass.c sshconnect.c sshconnect.h sshconnect2.c uidswap.c]
1701 replace remaining setuid() calls with permanently_set_uid() and
1702 check seteuid() return values; report Marcus Meissner; ok dtucker djm
3c33c1b6 1703 - markus@cvs.openbsd.org 2006/06/08 14:45:49
1704 [readpass.c sshconnect.c sshconnect2.c uidswap.c uidswap.h]
1705 do not set the gid, noted by solar; ok djm
e1ff5445 1706 - djm@cvs.openbsd.org 2006/06/13 01:18:36
1707 [ssh-agent.c]
1708 always use a format string, even when printing a constant
1709 - djm@cvs.openbsd.org 2006/06/13 02:17:07
1710 [ssh-agent.c]
1711 revert; i am on drugs. spotted by alexander AT beard.se
6cba36fd 1712
2ae7f715 171320060521
1714 - (dtucker) [auth.c monitor.c] Now that we don't log from both the monitor
1715 and slave, we can remove the special-case handling in the audit hook in
1716 auth_log.
1717
171820060517
aee28e67 1719 - (dtucker) [ssh-rand-helper.c] Check return code of mkdir and fix file
1720 pointer leak. From kjhall at us.ibm.com, found by coverity.
1721
2ae7f715 172220060515
a048aeba 1723 - (dtucker) [openbsd-compat/getrrsetbyname.c] Use _compat_res instead of
1724 _res, prevents problems on some platforms that have _res as a global but
1725 don't have getrrsetbyname(), eg IRIX 5.3. Found and tested by
1726 georg.schwarz at freenet.de, ok djm@.
143a79db 1727 - (dtucker) [defines.h] Find a value for IOV_MAX or use a conservative
1728 default. Patch originally from tim@, ok djm
5aa56df0 1729 - (dtucker) [auth-pam.c] Bug #1188: pass result of do_pam_account back and
1730 do not allow kbdint again after the PAM account check fails. ok djm@
a048aeba 1731
2ae7f715 173220060506
689d3f77 1733 - (dtucker) OpenBSD CVS Sync
fc231518 1734 - dtucker@cvs.openbsd.org 2006/04/25 08:02:27
1735 [authfile.c authfile.h sshconnect2.c ssh.c sshconnect1.c]
1736 Prevent ssh from trying to open private keys with bad permissions more than
1737 once or prompting for their passphrases (which it subsequently ignores
1738 anyway), similar to a previous change in ssh-add. bz #1186, ok djm@
397d64d2 1739 - djm@cvs.openbsd.org 2006/05/04 14:55:23
1740 [dh.c]
1741 tighter DH exponent checks here too; feedback and ok markus@
a1361c4b 1742 - djm@cvs.openbsd.org 2006/04/01 05:37:46
1743 [OVERVIEW]
1744 $OpenBSD$ in here too
9188927d 1745 - dtucker@cvs.openbsd.org 2006/05/06 08:35:40
1746 [auth-krb5.c]
1747 Add $OpenBSD$ in comment here too
fc231518 1748
01d35895 174920060504
1750 - (dtucker) [auth-pam.c groupaccess.c monitor.c monitor_wrap.c scard-opensc.c
1751 session.c ssh-rand-helper.c sshd.c openbsd-compat/bsd-cygwin_util.c
1752 openbsd-compat/setproctitle.c] Convert malloc(foo*bar) -> calloc(foo,bar)
1753 in Portable-only code; since calloc zeros, remove now-redundant memsets.
1754 Also add a couple of sanity checks. With & ok djm@
1755
7ca4010c 175620060503
1757 - (dtucker) [packet.c] Remove in_systm.h since it's also in includes.h
1758 and double including it on IRIX 5.3 causes problems. From Georg Schwarz,
1759 "no objections" tim@
1760
ac93e676 176120060423
1762 - (djm) OpenBSD CVS Sync
1763 - deraadt@cvs.openbsd.org 2006/04/01 05:42:20
1764 [scp.c]
1765 minimal lint cleanup (unused crud, and some size_t); ok djm
c0a8e7bb 1766 - djm@cvs.openbsd.org 2006/04/01 05:50:29
1767 [scp.c]
1768 xasprintification; ok deraadt@
5fe9ca7d 1769 - djm@cvs.openbsd.org 2006/04/01 05:51:34
1770 [atomicio.c]
1771 ANSIfy; requested deraadt@
1772 - dtucker@cvs.openbsd.org 2006/04/02 08:34:52
1773 [ssh-keysign.c]
1774 sessionid can be 32 bytes now too when sha256 kex is used; ok djm@
9c3c8eb1 1775 - djm@cvs.openbsd.org 2006/04/03 07:10:38
1776 [gss-genr.c]
1777 GSSAPI buffers shouldn't be nul-terminated, spotted in bugzilla #1066
1778 by dleonard AT vintela.com. use xasprintf() to simplify code while in
1779 there; "looks right" deraadt@
69d9d413 1780 - djm@cvs.openbsd.org 2006/04/16 00:48:52
1781 [buffer.c buffer.h channels.c]
1782 Fix condition where we could exit with a fatal error when an input
1783 buffer became too large and the remote end had advertised a big window.
1784 The problem was a mismatch in the backoff math between the channels code
1785 and the buffer code, so make a buffer_check_alloc() function that the
1786 channels code can use to propsectivly check whether an incremental
1787 allocation will succeed. bz #1131, debugged with the assistance of
1788 cove AT wildpackets.com; ok dtucker@ deraadt@
68d86b37 1789 - djm@cvs.openbsd.org 2006/04/16 00:52:55
1790 [atomicio.c atomicio.h]
1791 introduce atomiciov() function that wraps readv/writev to retry
1792 interrupted transfers like atomicio() does for read/write;
1793 feedback deraadt@ dtucker@ stevesk@ ok deraadt@
2c4369de 1794 - djm@cvs.openbsd.org 2006/04/16 00:54:10
1795 [sftp-client.c]
1796 avoid making a tiny 4-byte write to send the packet length of sftp
1797 commands, which would result in a separate tiny packet on the wire by
1798 using atomiciov(writev, ...) to write the length and the command in one
1799 pass; ok deraadt@
7bccebd0 1800 - djm@cvs.openbsd.org 2006/04/16 07:59:00
1801 [atomicio.c]
1802 reorder sanity test so that it cannot dereference past the end of the
1803 iov array; well spotted canacar@!
b0a892b2 1804 - dtucker@cvs.openbsd.org 2006/04/18 10:44:28
71544c3d 1805 [bufaux.c bufbn.c Makefile.in]
b0a892b2 1806 Move Buffer bignum functions into their own file, bufbn.c. This means
1807 that sftp and sftp-server (which use the Buffer functions in bufaux.c
1808 but not the bignum ones) no longer need to be linked with libcrypto.
1809 ok markus@
50394f26 1810 - djm@cvs.openbsd.org 2006/04/20 09:27:09
1811 [auth.h clientloop.c dispatch.c dispatch.h kex.h]
1812 replace the last non-sig_atomic_t flag used in a signal handler with a
1813 sig_atomic_t, unfortunately with some knock-on effects in other (non-
1814 signal) contexts in which it is used; ok markus@
4439dde1 1815 - markus@cvs.openbsd.org 2006/04/20 09:47:59
1816 [sshconnect.c]
1817 simplify; ok djm@
6e97fe1d 1818 - djm@cvs.openbsd.org 2006/04/20 21:53:44
1819 [includes.h session.c sftp.c]
1820 Switch from using pipes to socketpairs for communication between
1821 sftp/scp and ssh, and between sshd and its subprocesses. This saves
1822 a file descriptor per session and apparently makes userland ppp over
1823 ssh work; ok markus@ deraadt@ (ID Sync only - portable makes this
1824 decision on a per-platform basis)
40402a68 1825 - djm@cvs.openbsd.org 2006/04/22 04:06:51
1826 [uidswap.c]
1827 use setres[ug]id() to permanently revoke privileges; ok deraadt@
1828 (ID Sync only - portable already uses setres[ug]id() whenever possible)
ae3afe05 1829 - stevesk@cvs.openbsd.org 2006/04/22 18:29:33
1830 [crc32.c]
1831 remove extra spaces
0ca1dcaf 1832 - (djm) [auth.h dispatch.h kex.h] sprinkle in signal.h to get
1833 sig_atomic_t
ac93e676 1834
ef4d1846 183520060421
1836 - (djm) [Makefile.in configure.ac session.c sshpty.c]
1837 [contrib/redhat/sshd.init openbsd-compat/Makefile.in]
1838 [openbsd-compat/openbsd-compat.h openbsd-compat/port-linux.c]
1839 [openbsd-compat/port-linux.h] Add support for SELinux, setting
1840 the execution and TTY contexts. based on patch from Daniel Walsh,
1841 bz #880; ok dtucker@
1842
88680c8b 184320060418
ef4d1846 1844 - (djm) [canohost.c] Reorder IP options check so that it isn't broken
1845 by mapped addresses; bz #1179 reported by markw wtech-llc.com;
88680c8b 1846 ok dtucker@
1847
6a0984b4 184820060331
1849 - OpenBSD CVS Sync
1850 - deraadt@cvs.openbsd.org 2006/03/27 01:21:18
1851 [xmalloc.c]
1852 we can do the size & nmemb check before the integer overflow check;
1853 evol
fd06fbe0 1854 - deraadt@cvs.openbsd.org 2006/03/27 13:03:54
1855 [dh.c]
1856 use strtonum() instead of atoi(), limit dhg size to 64k; ok djm
e56b07ea 1857 - djm@cvs.openbsd.org 2006/03/27 23:15:46
1858 [sftp.c]
1859 always use a format string for addargs; spotted by mouring@
19e79961 1860 - deraadt@cvs.openbsd.org 2006/03/28 00:12:31
1861 [README.tun ssh.c]
1862 spacing
4f16046f 1863 - deraadt@cvs.openbsd.org 2006/03/28 01:52:28
1864 [channels.c]
1865 do not accept unreasonable X ports numbers; ok djm
cfaa5405 1866 - deraadt@cvs.openbsd.org 2006/03/28 01:53:43
1867 [ssh-agent.c]
1868 use strtonum() to parse the pid from the file, and range check it
1869 better; ok djm
04aa9e67 1870 - djm@cvs.openbsd.org 2006/03/30 09:41:25
1871 [channels.c]
1872 ARGSUSED for dispatch table-driven functions
51e7a012 1873 - djm@cvs.openbsd.org 2006/03/30 09:58:16
1874 [authfd.c bufaux.c deattack.c gss-serv.c mac.c misc.c misc.h]
1875 [monitor_wrap.c msg.c packet.c sftp-client.c sftp-server.c ssh-agent.c]
1876 replace {GET,PUT}_XXBIT macros with functionally similar functions,
1877 silencing a heap of lint warnings. also allows them to use
1878 __bounded__ checking which can't be applied to macros; requested
1879 by and feedback from deraadt@
8cffe22a 1880 - djm@cvs.openbsd.org 2006/03/30 10:41:25
1881 [ssh.c ssh_config.5]
1882 add percent escape chars to the IdentityFile option, bz #1159 based
1883 on a patch by imaging AT math.ualberta.ca; feedback and ok dtucker@
2ccf5424 1884 - dtucker@cvs.openbsd.org 2006/03/30 11:05:17
1885 [ssh-keygen.c]
1886 Correctly handle truncated files while converting keys; ok djm@
c023a130 1887 - dtucker@cvs.openbsd.org 2006/03/30 11:40:21
1888 [auth.c monitor.c]
1889 Prevent duplicate log messages when privsep=yes; ok djm@
99d18e3e 1890 - jmc@cvs.openbsd.org 2006/03/31 09:09:30
1891 [ssh_config.5]
1892 kill trailing whitespace;
b4d7dedd 1893 - djm@cvs.openbsd.org 2006/03/31 09:13:56
1894 [ssh_config.5]
1895 remote user escape is %r not %h; spotted by jmc@
6a0984b4 1896
3eff92ec 189720060326
1898 - OpenBSD CVS Sync
1899 - jakob@cvs.openbsd.org 2006/03/15 08:46:44
1900 [ssh-keygen.c]
1901 if no key file are given when printing the DNS host record, use the
1902 host key file(s) as default. ok djm@
d6157b67 1903 - biorn@cvs.openbsd.org 2006/03/16 10:31:45
1904 [scp.c]
1905 Try to display errormessage even if remout == -1
1906 ok djm@, markus@
9dfca510 1907 - djm@cvs.openbsd.org 2006/03/17 22:31:50
1908 [authfd.c]
1909 another unreachable found by lint
60ffd527 1910 - djm@cvs.openbsd.org 2006/03/17 22:31:11
1911 [authfd.c]
1912 unreachanble statement, found by lint
4113a1d7 1913 - djm@cvs.openbsd.org 2006/03/19 02:22:32
1914 [serverloop.c]
1915 memory leaks detected by Coverity via elad AT netbsd.org;
1916 ok deraadt@ dtucker@
e6a3cfb5 1917 - djm@cvs.openbsd.org 2006/03/19 02:22:56
1918 [sftp.c]
1919 more memory leaks detected by Coverity via elad AT netbsd.org;
1920 deraadt@ ok
f8f9ef4d 1921 - djm@cvs.openbsd.org 2006/03/19 02:23:26
1922 [hostfile.c]
1923 FILE* leak detected by Coverity via elad AT netbsd.org;
1924 ok deraadt@
88299971 1925 - djm@cvs.openbsd.org 2006/03/19 02:24:05
1926 [dh.c readconf.c servconf.c]
1927 potential NULL pointer dereferences detected by Coverity
1928 via elad AT netbsd.org; ok deraadt@
18fc231c 1929 - djm@cvs.openbsd.org 2006/03/19 07:41:30
1930 [sshconnect2.c]
1931 memory leaks detected by Coverity via elad AT netbsd.org;
1932 deraadt@ ok
0f8cd5a6 1933 - dtucker@cvs.openbsd.org 2006/03/19 11:51:52
1934 [servconf.c]
1935 Correct strdelim null test; ok djm@
c8e9c167 1936 - deraadt@cvs.openbsd.org 2006/03/19 18:52:11
1937 [auth1.c authfd.c channels.c]
1938 spacing
b4bbf172 1939 - deraadt@cvs.openbsd.org 2006/03/19 18:53:12
1940 [kex.c kex.h monitor.c myproposal.h session.c]
1941 spacing
3efa8ea9 1942 - deraadt@cvs.openbsd.org 2006/03/19 18:56:41
1943 [clientloop.c progressmeter.c serverloop.c sshd.c]
1944 ARGSUSED for signal handlers
6e56dc92 1945 - deraadt@cvs.openbsd.org 2006/03/19 18:59:49
1946 [ssh-keyscan.c]
1947 please lint
7de98c39 1948 - deraadt@cvs.openbsd.org 2006/03/19 18:59:30
1949 [ssh.c]
1950 spacing
c84ac6a4 1951 - deraadt@cvs.openbsd.org 2006/03/19 18:59:09
1952 [authfile.c]
1953 whoever thought that break after return was a good idea needs to
1954 get their head examimed
98d40a74 1955 - djm@cvs.openbsd.org 2006/03/20 04:09:44
1956 [monitor.c]
1957 memory leaks detected by Coverity via elad AT netbsd.org;
1958 deraadt@ ok
1959 that should be all of them now
7016f7cf 1960 - djm@cvs.openbsd.org 2006/03/20 11:38:46
1961 [key.c]
1962 (really) last of the Coverity diffs: avoid possible NULL deref in
1963 key_free. via elad AT netbsd.org; markus@ ok
5ef36928 1964 - deraadt@cvs.openbsd.org 2006/03/20 17:10:19
1965 [auth.c key.c misc.c packet.c ssh-add.c]
1966 in a switch (), break after return or goto is stupid
353d48db 1967 - deraadt@cvs.openbsd.org 2006/03/20 17:13:16
1968 [key.c]
1969 djm did a typo
952fce1b 1970 - deraadt@cvs.openbsd.org 2006/03/20 17:17:23
1971 [ssh-rsa.c]
1972 in a switch (), break after return or goto is stupid
148de80c 1973 - deraadt@cvs.openbsd.org 2006/03/20 18:14:02
b3b6f53d 1974 [channels.c clientloop.c monitor_wrap.c monitor_wrap.h serverloop.c]
1975 [ssh.c sshpty.c sshpty.h]
148de80c 1976 sprinkle u_int throughout pty subsystem, ok markus
fe8c3af1 1977 - deraadt@cvs.openbsd.org 2006/03/20 18:17:20
1978 [auth1.c auth2.c sshd.c]
1979 sprinkle some ARGSUSED for table driven functions (which sometimes
1980 must ignore their args)
32596c7b 1981 - deraadt@cvs.openbsd.org 2006/03/20 18:26:55
1982 [channels.c monitor.c session.c session.h ssh-agent.c ssh-keygen.c]
1983 [ssh-rsa.c ssh.c sshlogin.c]
1984 annoying spacing fixes getting in the way of real diffs
b248a875 1985 - deraadt@cvs.openbsd.org 2006/03/20 18:27:50
1986 [monitor.c]
1987 spacing
338eb2ab 1988 - deraadt@cvs.openbsd.org 2006/03/20 18:35:12
1989 [channels.c]
1990 x11_fake_data is only ever used as u_char *
0bcc3e35 1991 - deraadt@cvs.openbsd.org 2006/03/20 18:41:43
1992 [dns.c]
1993 cast xstrdup to propert u_char *
9555d258 1994 - deraadt@cvs.openbsd.org 2006/03/20 18:42:27
1995 [canohost.c match.c ssh.c sshconnect.c]
1996 be strict with tolower() casting
a7137f6b 1997 - deraadt@cvs.openbsd.org 2006/03/20 18:48:34
1998 [channels.c fatal.c kex.c packet.c serverloop.c]
1999 spacing
1cec12db 2000 - deraadt@cvs.openbsd.org 2006/03/20 21:11:53
2001 [ttymodes.c]
2002 spacing
52e3daed 2003 - djm@cvs.openbsd.org 2006/03/25 00:05:41
2004 [auth-bsdauth.c auth-skey.c auth.c auth2-chall.c channels.c]
2005 [clientloop.c deattack.c gss-genr.c kex.c key.c misc.c moduli.c]
2006 [monitor.c monitor_wrap.c packet.c scard.c sftp-server.c ssh-agent.c]
2007 [ssh-keyscan.c ssh.c sshconnect.c sshconnect2.c sshd.c uuencode.c]
2008 [xmalloc.c xmalloc.h]
2009 introduce xcalloc() and xasprintf() failure-checked allocations
2010 functions and use them throughout openssh
2011
2012 xcalloc is particularly important because malloc(nmemb * size) is a
2013 dangerous idiom (subject to integer overflow) and it is time for it
2014 to die
2015
2016 feedback and ok deraadt@
c5d10563 2017 - djm@cvs.openbsd.org 2006/03/25 01:13:23
2018 [buffer.c channels.c deattack.c misc.c scp.c session.c sftp-client.c]
2019 [sftp-server.c ssh-agent.c ssh-rsa.c xmalloc.c xmalloc.h auth-pam.c]
2020 [uidswap.c]
2021 change OpenSSH's xrealloc() function from being xrealloc(p, new_size)
2022 to xrealloc(p, new_nmemb, new_itemsize).
2023
2024 realloc is particularly prone to integer overflows because it is
2025 almost always allocating "n * size" bytes, so this is a far safer
2026 API; ok deraadt@
522327f5 2027 - djm@cvs.openbsd.org 2006/03/25 01:30:23
2028 [sftp.c]
2029 "abormally" is a perfectly cromulent word, but "abnormally" is better
c1cb7bae 2030 - djm@cvs.openbsd.org 2006/03/25 13:17:03
6ba5f28f 2031 [atomicio.c auth-bsdauth.c auth-chall.c auth-options.c auth-passwd.c]
2032 [auth-rh-rsa.c auth-rhosts.c auth-rsa.c auth-skey.c auth.c auth1.c]
2033 [auth2-chall.c auth2-hostbased.c auth2-kbdint.c auth2-none.c]
2034 [auth2-passwd.c auth2-pubkey.c auth2.c authfd.c authfile.c bufaux.c]
2035 [buffer.c canohost.c channels.c cipher-3des1.c cipher-bf1.c]
2036 [cipher-ctr.c cipher.c cleanup.c clientloop.c compat.c compress.c]
2037 [deattack.c dh.c dispatch.c fatal.c groupaccess.c hostfile.c kex.c]
2038 [kexdh.c kexdhc.c kexdhs.c kexgex.c kexgexc.c kexgexs.c key.c log.c]
2039 [mac.c match.c md-sha256.c misc.c monitor.c monitor_fdpass.c]
2040 [monitor_mm.c monitor_wrap.c msg.c nchan.c packet.c progressmeter.c]
2041 [readconf.c readpass.c rsa.c scard.c scp.c servconf.c serverloop.c]
2042 [session.c sftp-client.c sftp-common.c sftp-glob.c sftp-server.c]
2043 [sftp.c ssh-add.c ssh-agent.c ssh-dss.c ssh-keygen.c ssh-keyscan.c]
2044 [ssh-keysign.c ssh-rsa.c ssh.c sshconnect.c sshconnect1.c]
2045 [sshconnect2.c sshd.c sshlogin.c sshpty.c sshtty.c ttymodes.c]
2046 [uidswap.c uuencode.c xmalloc.c]
c1cb7bae 2047 Put $OpenBSD$ tags back (as comments) to replace the RCSID()s that
2048 Theo nuked - our scripts to sync -portable need them in the files
febd6f21 2049 - deraadt@cvs.openbsd.org 2006/03/25 18:29:35
2050 [auth-rsa.c authfd.c packet.c]
2051 needed casts (always will be needed)
b476adfa 2052 - deraadt@cvs.openbsd.org 2006/03/25 18:30:55
2053 [clientloop.c serverloop.c]
2054 spacing
306f24ca 2055 - deraadt@cvs.openbsd.org 2006/03/25 18:36:15
2056 [sshlogin.c sshlogin.h]
2057 nicer size_t and time_t types
0fe9892f 2058 - deraadt@cvs.openbsd.org 2006/03/25 18:40:14
2059 [ssh-keygen.c]
2060 cast strtonum() result to right type
8d0b0353 2061 - deraadt@cvs.openbsd.org 2006/03/25 18:41:45
2062 [ssh-agent.c]
2063 mark two more signal handlers ARGSUSED
d6d4897e 2064 - deraadt@cvs.openbsd.org 2006/03/25 18:43:30
2065 [channels.c]
2066 use strtonum() instead of atoi() [limit X screens to 400, sorry]
15dd2c4f 2067 - deraadt@cvs.openbsd.org 2006/03/25 18:56:55
2068 [bufaux.c channels.c packet.c]
2069 remove (char *) casts to a function that accepts void * for the arg
5b5f6af7 2070 - deraadt@cvs.openbsd.org 2006/03/25 18:58:10
2071 [channels.c]
2072 delete cast not required
56f824f3 2073 - djm@cvs.openbsd.org 2006/03/25 22:22:43
2074 [atomicio.h auth-options.h auth.h auth2-gss.c authfd.h authfile.h]
2075 [bufaux.h buffer.h canohost.h channels.h cipher.h clientloop.h]
2076 [compat.h compress.h crc32.c crc32.h deattack.h dh.h dispatch.h]
2077 [dns.c dns.h getput.h groupaccess.h gss-genr.c gss-serv-krb5.c]
2078 [gss-serv.c hostfile.h includes.h kex.h key.h log.h mac.h match.h]
2079 [misc.h monitor.h monitor_fdpass.h monitor_mm.h monitor_wrap.h msg.h]
2080 [myproposal.h packet.h pathnames.h progressmeter.h readconf.h rsa.h]
2081 [scard.h servconf.h serverloop.h session.h sftp-common.h sftp.h]
2082 [ssh-gss.h ssh.h ssh1.h ssh2.h sshconnect.h sshlogin.h sshpty.h]
2083 [ttymodes.h uidswap.h uuencode.h xmalloc.h]
2084 standardise spacing in $OpenBSD$ tags; requested by deraadt@
9594740b 2085 - deraadt@cvs.openbsd.org 2006/03/26 01:31:48
2086 [uuencode.c]
2087 typo
3eff92ec 2088
df938409 208920060325
2090 - OpenBSD CVS Sync
2091 - djm@cvs.openbsd.org 2006/03/16 04:24:42
2092 [ssh.1]
2093 Add RFC4419 (Diffie-Hellman group exchange KEX) to the list of SSH RFCs
2094 that OpenSSH supports
a92a0909 2095 - deraadt@cvs.openbsd.org 2006/03/19 18:51:18
2096 [atomicio.c auth-bsdauth.c auth-chall.c auth-krb5.c auth-options.c]
2097 [auth-pam.c auth-passwd.c auth-rh-rsa.c auth-rhosts.c auth-rsa.c]
2098 [auth-shadow.c auth-skey.c auth.c auth1.c auth2-chall.c]
2099 [auth2-hostbased.c auth2-kbdint.c auth2-none.c auth2-passwd.c]
2100 [auth2-pubkey.c auth2.c authfd.c authfile.c bufaux.c buffer.c]
2101 [canohost.c channels.c cipher-3des1.c cipher-acss.c cipher-aes.c]
2102 [cipher-bf1.c cipher-ctr.c cipher.c cleanup.c clientloop.c compat.c]
2103 [compress.c deattack.c dh.c dispatch.c dns.c entropy.c fatal.c]
2104 [groupaccess.c hostfile.c includes.h kex.c kexdh.c kexdhc.c]
2105 [kexdhs.c kexgex.c kexgexc.c kexgexs.c key.c log.c loginrec.c]
2106 [loginrec.h logintest.c mac.c match.c md-sha256.c md5crypt.c misc.c]
2107 [monitor.c monitor_fdpass.c monitor_mm.c monitor_wrap.c msg.c]
2108 [nchan.c packet.c progressmeter.c readconf.c readpass.c rsa.c]
2109 [scard.c scp.c servconf.c serverloop.c session.c sftp-client.c]
2110 [sftp-common.c sftp-glob.c sftp-server.c sftp.c ssh-add.c]
2111 [ssh-agent.c ssh-dss.c ssh-keygen.c ssh-keyscan.c ssh-keysign.c]
2112 [ssh-rand-helper.c ssh-rsa.c ssh.c sshconnect.c sshconnect1.c]
2113 [sshconnect2.c sshd.c sshlogin.c sshpty.c sshtty.c ttymodes.c]
2114 [uidswap.c uuencode.c xmalloc.c openbsd-compat/bsd-arc4random.c]
2115 [openbsd-compat/bsd-closefrom.c openbsd-compat/bsd-cygwin_util.c]
2116 [openbsd-compat/bsd-getpeereid.c openbsd-compat/bsd-misc.c]
2117 [openbsd-compat/bsd-nextstep.c openbsd-compat/bsd-snprintf.c]
2118 [openbsd-compat/bsd-waitpid.c openbsd-compat/fake-rfc2553.c]
2119 RCSID() can die
0e03e3d0 2120 - deraadt@cvs.openbsd.org 2006/03/19 18:53:12
2121 [kex.h myproposal.h]
2122 spacing
0fa53840 2123 - djm@cvs.openbsd.org 2006/03/20 04:07:22
2124 [auth2-gss.c]
2125 GSSAPI related leaks detected by Coverity via elad AT netbsd.org;
2126 reviewed by simon AT sxw.org.uk; deraadt@ ok
0926fd19 2127 - djm@cvs.openbsd.org 2006/03/20 04:07:49
2128 [gss-genr.c]
2129 more GSSAPI related leaks detected by Coverity via elad AT netbsd.org;
2130 reviewed by simon AT sxw.org.uk; deraadt@ ok
7cd30d48 2131 - djm@cvs.openbsd.org 2006/03/20 04:08:18
2132 [gss-serv.c]
2133 last lot of GSSAPI related leaks detected by Coverity via
2134 elad AT netbsd.org; reviewed by simon AT sxw.org.uk; deraadt@ ok
97f67e9a 2135 - deraadt@cvs.openbsd.org 2006/03/20 18:14:02
2136 [monitor_wrap.h sshpty.h]
2137 sprinkle u_int throughout pty subsystem, ok markus
fd6eaa8c 2138 - deraadt@cvs.openbsd.org 2006/03/20 18:26:55
2139 [session.h]
2140 annoying spacing fixes getting in the way of real diffs
6cfe93ec 2141 - deraadt@cvs.openbsd.org 2006/03/20 18:41:43
2142 [dns.c]
2143 cast xstrdup to propert u_char *
f0eea41f 2144 - jakob@cvs.openbsd.org 2006/03/22 21:16:24
2145 [ssh.1]
2146 simplify SSHFP example; ok jmc@
69753336 2147 - djm@cvs.openbsd.org 2006/03/22 21:27:15
2148 [deattack.c deattack.h]
2149 remove IV support from the CRC attack detector, OpenSSH has never used
2150 it - it only applied to IDEA-CFB, which we don't support.
2151 prompted by NetBSD Coverity report via elad AT netbsd.org;
2152 feedback markus@ "nuke it" deraadt@
df938409 2153
08a3f952 215420060318
7f38714e 2155 - (djm) [auth-pam.c] Fix memleak in error path, from Coverity via
2156 elad AT NetBSD.org
2157 - (dtucker) [openbsd-compat/bsd-snprintf.c] Bug #1173: make fmtint() take
2158 a LLONG rather than a long. Fixes scp'ing of large files on platforms
2159 with missing/broken snprintfs. Patch from e.borovac at bom.gov.au.
08a3f952 2160
32b0131a 216120060316
2162 - (dtucker) [entropy.c] Add headers for WIFEXITED and friends.
2f360c89 2163 - (dtucker) [configure.ac md-sha256.c] NetBSD has sha2.h in
2164 /usr/include/crypto. Hint from djm@.
b1f0c612 2165 - (tim) [kex.c myproposal.h md-sha256.c openbsd-compat/sha2.c,h]
2166 Disable sha256 when openssl < 0.9.7. Patch from djm@.
30baf904 2167 - (djm) [kex.c] Slightly more clean deactivation of dhgex-sha256 on old
2168 OpenSSL; ok tim
32b0131a 2169
0ac58ab4 217020060315
2171 - (djm) OpenBSD CVS Sync:
2172 - msf@cvs.openbsd.org 2006/02/06 15:54:07
2173 [ssh.1]
2174 - typo fix
2175 ok jmc@
260c414c 2176 - jmc@cvs.openbsd.org 2006/02/06 21:44:47
2177 [ssh.1]
2178 make this a little less ambiguous...
c38f5d19 2179 - stevesk@cvs.openbsd.org 2006/02/07 01:08:04
2180 [auth-rhosts.c includes.h]
2181 move #include <netgroup.h> out of includes.h; ok markus@
c3ff311a 2182 - stevesk@cvs.openbsd.org 2006/02/07 01:18:09
2183 [includes.h ssh-agent.c ssh-keyscan.c sshconnect2.c]
2184 move #include <sys/queue.h> out of includes.h; ok markus@
1d3e026f 2185 - stevesk@cvs.openbsd.org 2006/02/07 01:42:00
2186 [channels.c clientloop.c clientloop.h includes.h packet.h]
2187 [serverloop.c sshpty.c sshpty.h sshtty.c ttymodes.c]
2188 move #include <termios.h> out of includes.h; ok markus@
99f28949 2189 - stevesk@cvs.openbsd.org 2006/02/07 01:52:50
2190 [sshtty.c]
2191 "log.h" not needed
cc63c340 2192 - stevesk@cvs.openbsd.org 2006/02/07 03:47:05
2193 [hostfile.c]
2194 "packet.h" not needed
db5a9db9 2195 - stevesk@cvs.openbsd.org 2006/02/07 03:59:20
2196 [deattack.c]
2197 duplicate #include
a75f5360 2198 - stevesk@cvs.openbsd.org 2006/02/08 12:15:27
2199 [auth.c clientloop.c includes.h misc.c monitor.c readpass.c]
2200 [session.c sftp.c ssh-agent.c ssh-keysign.c ssh.c sshconnect.c]
2201 [sshd.c sshpty.c]
2202 move #include <paths.h> out of includes.h; ok markus@
6425cf65 2203 - stevesk@cvs.openbsd.org 2006/02/08 12:32:49
2204 [includes.h misc.c]
2205 move #include <netinet/tcp.h> out of includes.h; ok markus@
1720c23b 2206 - stevesk@cvs.openbsd.org 2006/02/08 13:15:44
2207 [gss-serv.c monitor.c]
2208 small KNF
5b984d1d 2209 - stevesk@cvs.openbsd.org 2006/02/08 14:16:59
2210 [sshconnect.c]
2211 <openssl/bn.h> not needed
876faccd 2212 - stevesk@cvs.openbsd.org 2006/02/08 14:31:30
2213 [includes.h ssh-agent.c ssh-keyscan.c ssh.c]
2214 move #include <sys/resource.h> out of includes.h; ok markus@
a3dcf543 2215 - stevesk@cvs.openbsd.org 2006/02/08 14:38:18
2216 [includes.h packet.c]
2217 move #include <netinet/in_systm.h> and <netinet/ip.h> out of
2218 includes.h; ok markus@
68e39d38 2219 - stevesk@cvs.openbsd.org 2006/02/08 23:51:24
2220 [includes.h scp.c sftp-glob.c sftp-server.c]
2221 move #include <dirent.h> out of includes.h; ok markus@
bbb1501d 2222 - stevesk@cvs.openbsd.org 2006/02/09 00:32:07
2223 [includes.h]
2224 #include <sys/endian.h> not needed; ok djm@
2225 NB. ID Sync only - we still need this (but it may move later)
4eb67845 2226 - jmc@cvs.openbsd.org 2006/02/09 10:10:47
2227 [sshd.8]
2228 - move some text into a CAVEATS section
2229 - merge the COMMAND EXECUTION... section into AUTHENTICATION
bd7c69ea 2230 - stevesk@cvs.openbsd.org 2006/02/10 00:27:13
2231 [channels.c clientloop.c includes.h misc.c progressmeter.c sftp.c]
2232 [ssh.c sshd.c sshpty.c]
2233 move #include <sys/ioctl.h> out of includes.h; ok markus@
aa2eae64 2234 - stevesk@cvs.openbsd.org 2006/02/10 01:44:27
2235 [includes.h monitor.c readpass.c scp.c serverloop.c session.c\7f]
2236 [sftp.c sshconnect.c sshconnect2.c sshd.c]
2237 move #include <sys/wait.h> out of includes.h; ok markus@
cfb9181c 2238 - otto@cvs.openbsd.org 2006/02/11 19:31:18
2239 [atomicio.c]
2240 type correctness; from Ray Lai in PR 5011; ok millert@
f7b8224d 2241 - djm@cvs.openbsd.org 2006/02/12 06:45:34
2242 [ssh.c ssh_config.5]
2243 add a %l expansion code to the ControlPath, which is filled in with the
2244 local hostname at runtime. Requested by henning@ to avoid some problems
2245 with /home on NFS; ok dtucker@
129d5252 2246 - djm@cvs.openbsd.org 2006/02/12 10:44:18
2247 [readconf.c]
2248 raise error when the user specifies a RekeyLimit that is smaller than 16
2249 (the smallest of our cipher's blocksize) or big enough to cause integer
2250 wraparound; ok & feedback dtucker@
5e7007ea 2251 - jmc@cvs.openbsd.org 2006/02/12 10:49:44
2252 [ssh_config.5]
2253 slight rewording; ok djm
010c04e5 2254 - jmc@cvs.openbsd.org 2006/02/12 10:52:41
2255 [sshd.8]
2256 rework the description of authorized_keys a little;
9ed4bd80 2257 - jmc@cvs.openbsd.org 2006/02/12 17:57:19
2258 [sshd.8]
2259 sort the list of options permissable w/ authorized_keys;
2260 ok djm dtucker
1e0fcfc6 2261 - jmc@cvs.openbsd.org 2006/02/13 10:16:39
2262 [sshd.8]
2263 no need to subsection the authorized_keys examples - instead, convert
2264 this to look like an actual file. also use proto 2 keys, and use IETF
2265 example addresses;
2881e0e9 2266 - jmc@cvs.openbsd.org 2006/02/13 10:21:25
2267 [sshd.8]
2268 small tweaks for the ssh_known_hosts section;
9d4b0313 2269 - jmc@cvs.openbsd.org 2006/02/13 11:02:26
2270 [sshd.8]
2271 turn this into an example ssh_known_hosts file; ok djm
481e991f 2272 - jmc@cvs.openbsd.org 2006/02/13 11:08:43
2273 [sshd.8]
2274 - avoid nasty line split
2275 - `*' does not need to be escaped
10fa86ae 2276 - jmc@cvs.openbsd.org 2006/02/13 11:27:25
2277 [sshd.8]
2278 sort FILES and use a -compact list;
2db34ac9 2279 - david@cvs.openbsd.org 2006/02/15 05:08:24
2280 [sftp-client.c]
2281 typo in comment; ok djm@
0e505e42 2282 - jmc@cvs.openbsd.org 2006/02/15 16:53:20
2283 [ssh.1]
2284 remove the IETF draft references and replace them with some updated RFCs;
2866aceb 2285 - jmc@cvs.openbsd.org 2006/02/15 16:55:33
2286 [sshd.8]
2287 remove ietf draft references; RFC list now maintained in ssh.1;
00e7c607 2288 - jmc@cvs.openbsd.org 2006/02/16 09:05:34
2289 [sshd.8]
2290 sync some of the FILES entries w/ ssh.1;
f3d2d92e 2291 - jmc@cvs.openbsd.org 2006/02/19 19:52:10
2292 [sshd.8]
2293 move the sshrc stuff out of FILES, and into its own section:
2294 FILES is not a good place to document how stuff works;
e56bbe08 2295 - jmc@cvs.openbsd.org 2006/02/19 20:02:17
2296 [sshd.8]
2297 sync the (s)hosts.equiv FILES entries w/ those from ssh.1;
3783659a 2298 - jmc@cvs.openbsd.org 2006/02/19 20:05:00
2299 [sshd.8]
2300 grammar;
922f8f17 2301 - jmc@cvs.openbsd.org 2006/02/19 20:12:25
2302 [ssh_config.5]
2303 add some vertical space;
cebb4c24 2304 - stevesk@cvs.openbsd.org 2006/02/20 16:36:15
2305 [authfd.c channels.c includes.h session.c ssh-agent.c ssh.c]
2306 move #include <sys/un.h> out of includes.h; ok djm@
4095f623 2307 - stevesk@cvs.openbsd.org 2006/02/20 17:02:44
2308 [clientloop.c includes.h monitor.c progressmeter.c scp.c]
2309 [serverloop.c session.c sftp.c ssh-agent.c ssh.c sshd.c]
2310 move #include <signal.h> out of includes.h; ok markus@
ada68823 2311 - stevesk@cvs.openbsd.org 2006/02/20 17:19:54
2312 [auth-rhosts.c auth-rsa.c auth.c auth2-none.c auth2-pubkey.c]
2313 [authfile.c clientloop.c includes.h readconf.c scp.c session.c]
2314 [sftp-client.c sftp-common.c sftp-common.h sftp-glob.c]
2315 [sftp-server.c sftp.c ssh-add.c ssh-keygen.c ssh.c sshconnect.c]
2316 [sshconnect2.c sshd.c sshpty.c]
2317 move #include <sys/stat.h> out of includes.h; ok markus@
b6438382 2318 - stevesk@cvs.openbsd.org 2006/02/22 00:04:45
2319 [canohost.c clientloop.c includes.h match.c readconf.c scp.c ssh.c]
2320 [sshconnect.c]
2321 move #include <ctype.h> out of includes.h; ok djm@
95d46d8f 2322 - jmc@cvs.openbsd.org 2006/02/24 10:25:14
2323 [ssh_config.5]
2324 add section on patterns;
2325 from dtucker + myself
ac1ec4d8 2326 - jmc@cvs.openbsd.org 2006/02/24 10:33:54
2327 [sshd_config.5]
2328 signpost to PATTERNS;
436a5ff9 2329 - jmc@cvs.openbsd.org 2006/02/24 10:37:07
2330 [ssh_config.5]
2331 tidy up the refs to PATTERNS;
4cb23985 2332 - jmc@cvs.openbsd.org 2006/02/24 10:39:52
2333 [sshd.8]
2334 signpost to PATTERNS section;
340a4caf 2335 - jmc@cvs.openbsd.org 2006/02/24 20:22:16
2336 [ssh-keysign.8 ssh_config.5 sshd_config.5]
2337 some consistency fixes;
f09ffbdb 2338 - jmc@cvs.openbsd.org 2006/02/24 20:31:31
2339 [ssh.1 ssh_config.5 sshd.8 sshd_config.5]
2340 more consistency fixes;
c5786b30 2341 - jmc@cvs.openbsd.org 2006/02/24 23:20:07
2342 [ssh_config.5]
2343 some grammar/wording fixes;
b74c3b8c 2344 - jmc@cvs.openbsd.org 2006/02/24 23:43:57
2345 [sshd_config.5]
2346 some grammar/wording fixes;
32cfd177 2347 - jmc@cvs.openbsd.org 2006/02/24 23:51:17
2348 [sshd_config.5]
2349 oops - bits i missed;
2963b207 2350 - jmc@cvs.openbsd.org 2006/02/25 12:26:17
2351 [ssh_config.5]
2352 document the possible values for KbdInteractiveDevices;
84c1b530 2353 help/ok dtucker
2354 - jmc@cvs.openbsd.org 2006/02/25 12:28:34
2355 [sshd_config.5]
2356 document the order in which allow/deny directives are processed;
a269663f 2357 help/ok dtucker
de4f5093 2358 - jmc@cvs.openbsd.org 2006/02/26 17:17:18
2359 [ssh_config.5]
2360 move PATTERNS to the end of the main body; requested by dtucker
ef1c6497 2361 - jmc@cvs.openbsd.org 2006/02/26 18:01:13
2362 [sshd_config.5]
2363 subsection is pointless here;
c04ba6a6 2364 - jmc@cvs.openbsd.org 2006/02/26 18:03:10
2365 [ssh_config.5]
2366 comma;
8b6bf4d5 2367 - djm@cvs.openbsd.org 2006/02/28 01:10:21
2368 [session.c]
2369 fix logout recording when privilege separation is disabled, analysis and
2370 patch from vinschen at redhat.com; tested by dtucker@ ok deraadt@
2371 NB. ID sync only - patch already in portable
140000b4 2372 - djm@cvs.openbsd.org 2006/03/04 04:12:58
2373 [serverloop.c]
2374 move a debug() outside of a signal handler; ok markus@ a little while back
16a5525d 2375 - djm@cvs.openbsd.org 2006/03/12 04:23:07
2376 [ssh.c]
2377 knf nit
9f513268 2378 - djm@cvs.openbsd.org 2006/03/13 08:16:00
2379 [sshd.c]
2380 don't log that we are listening on a socket before the listen() call
2381 actually succeeds, bz #1162 reported by Senthil Kumar; ok dtucker@
71f0de56 2382 - dtucker@cvs.openbsd.org 2006/03/13 08:33:00
2383 [packet.c]
2384 Set TCP_NODELAY for all connections not just "interactive" ones. Fixes
2385 poor performance and protocol stalls under some network conditions (mindrot
2386 bugs #556 and #981). Patch originally from markus@, ok djm@
15b81af3 2387 - dtucker@cvs.openbsd.org 2006/03/13 08:43:16
2388 [ssh-keygen.c]
2389 Make ssh-keygen handle CR and CRLF line termination when converting IETF
2390 format keys, in adition to vanilla LF. mindrot #1157, tested by Chris
2391 Pepper, ok djm@
533b9133 2392 - dtucker@cvs.openbsd.org 2006/03/13 10:14:29
2393 [misc.c ssh_config.5 sshd_config.5]
2394 Allow config directives to contain whitespace by surrounding them by double
2395 quotes. mindrot #482, man page help from jmc@, ok djm@
45660a22 2396 - dtucker@cvs.openbsd.org 2006/03/13 10:26:52
2397 [authfile.c authfile.h ssh-add.c]
2398 Make ssh-add check file permissions before attempting to load private
2399 key files multiple times; it will fail anyway and this prevents confusing
2400 multiple prompts and warnings. mindrot #1138, ok djm@
22aa23f8 2401 - djm@cvs.openbsd.org 2006/03/14 00:15:39
2402 [canohost.c]
2403 log the originating address and not just the name when a reverse
2404 mapping check fails, requested by linux AT linuon.com
2d762582 2405 - markus@cvs.openbsd.org 2006/03/14 16:32:48
2406 [ssh_config.5 sshd_config.5]
2407 *AliveCountMax applies to protcol v2 only; ok dtucker, djm
2ff8003a 2408 - djm@cvs.openbsd.org 2006/03/07 09:07:40
2409 [kex.c kex.h monitor.c myproposal.h ssh-keyscan.c sshconnect2.c sshd.c]
2410 Implement the diffie-hellman-group-exchange-sha256 key exchange method
2411 using the SHA256 code in libc (and wrapper to make it into an OpenSSL
2412 EVP), interop tested against CVS PuTTY
2413 NB. no portability bits committed yet
13ff27b7 2414 - (djm) [configure.ac defines.h kex.c md-sha256.c]
2415 [openbsd-compat/sha2.h openbsd-compat/openbsd-compat.h]
2416 [openbsd-compat/sha2.c] First stab at portability glue for SHA256
2417 KEX support, should work with libc SHA256 support or OpenSSL
2418 EVP_sha256 if present
1a6e2ed1 2419 - (djm) [includes.h] Restore accidentally dropped netinet/in.h
d3c45531 2420 - (djm) [Makefile.in openbsd-compat/Makefile.in] Add added files
f73e2ad7 2421 - (djm) [md-sha256.c configure.ac] md-sha256.c needs sha2.h if present
53a9f480 2422 - (djm) [regress/.cvsignore] Ignore Makefile here
81e73e57 2423 - (djm) [loginrec.c] Need stat.h
6c3a432e 2424 - (djm) [openbsd-compat/sha2.h] Avoid include macro clash with
2425 system sha2.h
cb2c6179 2426 - (djm) [ssh-rand-helper.c] Needs a bunch of headers
3e598f1a 2427 - (djm) [ssh-agent.c] Restore dropped stat.h
3070c7e1 2428 - (djm) [openbsd-compat/sha2.h openbsd-compat/sha2.c] Comment out
2429 SHA384, which we don't need and doesn't compile without tweaks
b5b88c19 2430 - (djm) [auth-pam.c clientloop.c includes.h monitor.c session.c]
2431 [sftp-client.c ssh-keysign.c ssh.c sshconnect.c sshconnect2.c]
2432 [sshd.c openbsd-compat/bsd-misc.c openbsd-compat/bsd-openpty.c]
2433 [openbsd-compat/glob.c openbsd-compat/mktemp.c]
2434 [openbsd-compat/readpassphrase.c] Lots of include fixes for
2435 OpenSolaris
b481f63d 2436 - (tim) [includes.h] put sys/stat.h back in to quiet some "macro redefined:"
3e9b2b1b 2437 - (tim) [openssh/sshpty.c openssh/openbsd-compat/port-tun.c] put in some
2438 includes removed from includes.h
d90b9f9a 2439 - (dtucker) [configure.ac] Fix glob test conversion to AC_TRY_COMPILE
b02dadfc 2440 - (djm) [includes.h] Put back paths.h, it is needed in defines.h
d4bf5977 2441 - (dtucker) [openbsd-compat/openbsd-compat.h] AIX (at least) needs
2442 sys/ioctl.h for struct winsize.
3919d576 2443 - (dtucker) [configure.ac] login_cap.h requires sys/types.h on NetBSD.
0ac58ab4 2444
055252ed 244520060313
2446 - (dtucker) [configure.ac] Bug #1171: Don't use printf("%lld", longlong)
2447 since not all platforms support it. Instead, use internal equivalent while
2448 computing LLONG_MIN and LLONG_MAX. Remove special case for alpha-dec-osf*
2449 as it's no longer required. Tested by Bernhard Simon, ok djm@
2450
f9b93ff8 245120060304
2452 - (dtucker) [contrib/cygwin/ssh-host-config] Require use of lastlog as a
2453 file rather than directory, required as Cygwin will be importing lastlog(1).
2454 Also tightens up permissions on the file. Patch from vinschen@redhat.com.
a8d3dd47 2455 - (dtucker) [gss-serv-krb5.c] Bug #1166: Correct #ifdefs for gssapi_krb5.h
2456 includes. Patch from gentoo.riverrat at gmail.com.
f9b93ff8 2457
49c64dd6 245820060226
2459 - (dtucker) [configure.ac] Bug #1156: QNX apparently needs SSHD_ACQUIRES_CTTY
2460 patch from kraai at ftbfs.org.
2461
246220060223
05059810 2463 - (dtucker) [sshd_config sshd_config.5] Update UsePAM to reflect current
2464 reality. Pointed out by tryponraj at gmail.com.
2465
49c64dd6 246620060222
0244ad55 2467 - (dtucker) [openbsd-compat/openssl-compat.{c,h}] Minor tidy up: only
2468 compile in compat code if required.
2469
15101d77 247020060221
2471 - (dtucker) [openbsd-compat/openssl-compat.h] Prevent warning about
2472 redefinition of SSLeay_add_all_algorithms.
2473
c7ad0d99 247420060220
2475 - (dtucker) [INSTALL configure.ac openbsd-compat/openssl-compat.{c,h}]
2476 Add optional enabling of OpenSSL's (hardware) Engine support, via
2477 configure --with-ssl-engine. Based in part on a diff by michal at
2478 logix.cz.
2479
46096a5b 248020060219
2481 - (dtucker) [Makefile.in configure.ac, added openbsd-compat/regress/]
2482 Add first attempt at regress tests for compat library. ok djm@
2483
103ff395 248420060214
2485 - (tim) [buildpkg.sh.in] Make the names consistent.
2486 s/pkg_post_make_install_fixes.sh/pkg-post-make-install-fixes.sh/ OK dtucker@
2487
06a517d4 248820060212
2489 - (dtucker) [openbsd-compat/bsd-cygwin_util.c] Make loop counter unsigned
2490 to silence compiler warning, from vinschen at redhat.com.
0c7e8877 2491 - (tim) [configure.ac] Bug #1149. Disable /etc/default/login check for QNX.
9603096f 2492 - (dtucker) [README version.h contrib/caldera/openssh.spec
2493 contrib/redhat/openssh.spec contrib/suse/openssh.spec] Bump version
2494 strings to match 4.3p2 release.
06a517d4 2495
4c721c3d 249620060208
2497 - (tim) [session.c] Logout records were not updated on systems with
2498 post auth privsep disabled due to bug 1086 changes. Analysis and patch
2499 by vinschen at redhat.com. OK tim@, dtucker@.
4b2cf3f1 2500 - (dtucker) [configure.ac] Typo in Ultrix and NewsOS sections (NEED_SETPRGP
8753ef06 2501 -> NEED_SETPGRP), reported by Bernhard Simon. ok tim@
4c721c3d 2502
5679f14d 250320060206
2504 - (tim) [configure.ac] Remove unnecessary tests for net/if.h and
2505 netinet/in_systm.h. OK dtucker@.
2506
823221b2 250720060205
2508 - (tim) [configure.ac] Add AC_REVISION. Add sys/time.h to lastlog.h test
2509 for Solaris. OK dtucker@.
9c54c067 2510 - (tim) [configure.ac] Bug #1149. Changes in QNX section only. Patch by
2511 kraai at ftbfs.org.
823221b2 2512
c9ecc3c7 251320060203
2514 - (tim) [configure.ac] test for egrep (AC_PROG_EGREP) before first
2515 AC_CHECK_HEADERS test. Without it, if AC_CHECK_HEADERS is first run
2516 by a platform specific check, builtin standard includes tests will be
2517 skipped on the other platforms.
2518 Analysis and suggestion by vinschen at redhat.com, patch by dtucker@.
2519 OK tim@, djm@.
2520
300ea548 252120060202
2522 - (dtucker) [configure.ac] Bug #1148: Fix "crippled AES" test so that it
2523 works with picky compilers. Patch from alex.kiernan at thus.net.
2524
0ceedd4e 252520060201
2526 - (djm) [regress/test-exec.sh] Try 'logname' as well as 'whoami' to
2527 determine the user's login name - needed for regress tests on Solaris
2528 10 and OpenSolaris
f3906047 2529 - (djm) OpenBSD CVS Sync
2530 - jmc@cvs.openbsd.org 2006/02/01 09:06:50
2531 [sshd.8]
2532 - merge sections on protocols 1 and 2 into a single section
2533 - remove configuration file section
2534 ok markus
170c69ba 2535 - jmc@cvs.openbsd.org 2006/02/01 09:11:41
2536 [sshd.8]
2537 small tweak;
026be201 2538 - (djm) [contrib/caldera/openssh.spec contrib/redhat/openssh.spec]
2539 [contrib/suse/openssh.spec] Update versions ahead of release
ac07067e 2540 - markus@cvs.openbsd.org 2006/02/01 11:27:22
2541 [version.h]
2542 openssh 4.3
2ac31303 2543 - (djm) Release OpenSSH 4.3p1
0ceedd4e 2544
0ce89457 254520060131
2546 - (djm) OpenBSD CVS Sync
2547 - jmc@cvs.openbsd.org 2006/01/20 11:21:45
2548 [ssh_config.5]
2549 - word change, agreed w/ markus
2550 - consistency fixes
ec63d7ce 2551 - jmc@cvs.openbsd.org 2006/01/25 09:04:34
2552 [sshd.8]
2553 move the options description up the page, and a few additional tweaks
2554 whilst in here;
2555 ok markus
f464b2f1 2556 - jmc@cvs.openbsd.org 2006/01/25 09:07:22
2557 [sshd.8]
2558 move subsections to full sections;
b661b7fb 2559 - jmc@cvs.openbsd.org 2006/01/26 08:47:56
2560 [ssh.1]
2561 add a section on verifying host keys in dns;
2562 written with a lot of help from jakob;
2563 feedback dtucker/markus;
2564 ok markus
d7b37427 2565 - reyk@cvs.openbsd.org 2006/01/30 12:22:22
2566 [channels.c]
2567 mark channel as write failed or dead instead of read failed on error
2568 of the channel output filter.
2569 ok markus@
062d2977 2570 - jmc@cvs.openbsd.org 2006/01/30 13:37:49
2571 [ssh.1]
2572 remove an incorrect sentence;
2573 reported by roumen petrov;
2574 ok djm markus
4116f5c0 2575 - djm@cvs.openbsd.org 2006/01/31 10:19:02
2576 [misc.c misc.h scp.c sftp.c]
2577 fix local arbitrary command execution vulnerability on local/local and
2578 remote/remote copies (CVE-2006-0225, bz #1094), patch by
2579 t8m AT centrum.cz, polished by dtucker@ and myself; ok markus@
16e8ab10 2580 - djm@cvs.openbsd.org 2006/01/31 10:35:43
2581 [scp.c]
2582 "scp a b c" shouldn't clobber "c" when it is not a directory, report and
2583 fix from biorn@; ok markus@
b645ff66 2584 - (djm) Sync regress tests to OpenBSD:
2585 - dtucker@cvs.openbsd.org 2005/03/10 10:20:39
2586 [regress/forwarding.sh]
2587 Regress test for ClearAllForwardings (bz #994); ok markus@
9b347e5f 2588 - dtucker@cvs.openbsd.org 2005/04/25 09:54:09
2589 [regress/multiplex.sh]
2590 Don't call cleanup in multiplex as test-exec will cleanup anyway
2591 found by tim@, ok djm@
2592 NB. ID sync only, we already had this
2593 - djm@cvs.openbsd.org 2005/05/20 23:14:15
2594 [regress/test-exec.sh]
2595 force addressfamily=inet for tests, unbreaking dynamic-forward regress for
2596 recently committed nc SOCKS5 changes
9f22d634 2597 - djm@cvs.openbsd.org 2005/05/24 04:10:54
89deb4c2 2598 [regress/try-ciphers.sh]
9f22d634 2599 oops, new arcfour modes here too
89deb4c2 2600 - markus@cvs.openbsd.org 2005/06/30 11:02:37
2601 [regress/scp.sh]
2602 allow SUDO=sudo; from Alexander Bluhm
41f70006 2603 - grunk@cvs.openbsd.org 2005/11/14 21:25:56
2604 [regress/agent-getpeereid.sh]
2605 all other scripts in this dir use $SUDO, not 'sudo', so pull this even
2606 ok markus@
71133d5b 2607 - dtucker@cvs.openbsd.org 2005/12/14 04:36:39
2608 [regress/scp-ssh-wrapper.sh]
2609 Fix assumption about how many args scp will pass; ok djm@
2610 NB. ID sync only, we already had this
452613c1 2611 - djm@cvs.openbsd.org 2006/01/27 06:49:21
2612 [scp.sh]
2613 regress test for local to local scp copies; ok dtucker@
3ca1f5b0 2614 - djm@cvs.openbsd.org 2006/01/31 10:23:23
2615 [scp.sh]
2616 regression test for CVE-2006-0225 written by dtucker@
d5b44cf1 2617 - djm@cvs.openbsd.org 2006/01/31 10:36:33
2618 [scp.sh]
2619 regress test for "scp a b c" where "c" is not a directory
0ce89457 2620
eeb27c78 262120060129
2622 - (dtucker) [configure.ac opensshd.init.in] Bug #1144: Use /bin/sh for the
2623 opensshd.init script interpretter if /sbin/sh does not exist. ok tim@
2624
16ad260d 262520060120
2626 - (dtucker) OpenBSD CVS Sync
2627 - jmc@cvs.openbsd.org 2006/01/15 17:37:05
2628 [ssh.1]
2629 correction from deraadt
43a7d9e7 2630 - jmc@cvs.openbsd.org 2006/01/18 10:53:29
2631 [ssh.1]
2632 add a section on ssh-based vpn, based on reyk's README.tun;
db175906 2633 - dtucker@cvs.openbsd.org 2006/01/20 00:14:55
2634 [scp.1 ssh.1 ssh_config.5 sftp.1]
2635 Document RekeyLimit. Based on patch from jan.iven at cern.ch from mindrot
2636 #1056 with feedback from jmc, djm and markus; ok jmc@ djm@
16ad260d 2637
aaa18db9 263820060114
2639 - (djm) OpenBSD CVS Sync
2640 - jmc@cvs.openbsd.org 2006/01/06 13:27:32
2641 [ssh.1]
2642 weed out some duplicate info in the known_hosts FILES entries;
2643 ok djm
5d7b356f 2644 - jmc@cvs.openbsd.org 2006/01/06 13:29:10
2645 [ssh.1]
2646 final round of whacking FILES for duplicate info, and some consistency
2647 fixes;
2648 ok djm
dbb3bf96 2649 - jmc@cvs.openbsd.org 2006/01/12 14:44:12
2650 [ssh.1]
2651 split sections on tcp and x11 forwarding into two sections.
2652 add an example in the tcp section, based on sth i wrote for ssh faq;
2653 help + ok: djm markus dtucker
5d4e571c 2654 - jmc@cvs.openbsd.org 2006/01/12 18:48:48
2655 [ssh.1]
2656 refer to `TCP' rather than `TCP/IP' in the context of connection
2657 forwarding;
2658 ok markus
e5d4cfad 2659 - jmc@cvs.openbsd.org 2006/01/12 22:20:00
2660 [sshd.8]
2661 refer to TCP forwarding, rather than TCP/IP forwarding;
0b3950af 2662 - jmc@cvs.openbsd.org 2006/01/12 22:26:02
2663 [ssh_config.5]
2664 refer to TCP forwarding, rather than TCP/IP forwarding;
c2da64a1 2665 - jmc@cvs.openbsd.org 2006/01/12 22:34:12
2666 [ssh.1]
2667 back out a sentence - AUTHENTICATION already documents this;
aaa18db9 2668
794febd2 266920060109
2670 - (dtucker) [contrib/cygwin/ssh-host-config] Make sshd service depend on
2671 tcpip service so it's always started after IP is up. Patch from
2672 vinschen at redhat.com.
2673
0624a70b 267420060106
2675 - (djm) OpenBSD CVS Sync
2676 - jmc@cvs.openbsd.org 2006/01/03 16:31:10
2677 [ssh.1]
2678 move FILES to a -compact list, and make each files an item in that list.
2679 this avoids nastly line wrap when we have long pathnames, and treats
2680 each file as a separate item;
2681 remove the .Pa too, since it is useless.
0502727e 2682 - jmc@cvs.openbsd.org 2006/01/03 16:35:30
2683 [ssh.1]
2684 use a larger width for the ENVIRONMENT list;
f403d7b5 2685 - jmc@cvs.openbsd.org 2006/01/03 16:52:36
2686 [ssh.1]
2687 put FILES in some sort of order: sort by pathname
c0907b37 2688 - jmc@cvs.openbsd.org 2006/01/03 16:55:18
2689 [ssh.1]
2690 tweak the description of ~/.ssh/environment
f3119772 2691 - jmc@cvs.openbsd.org 2006/01/04 18:42:46
2692 [ssh.1]
2693 chop out some duplication in the .{r,s}hosts/{h,sh}osts.equiv FILES
2694 entries;
2695 ok markus
6c276bb9 2696 - jmc@cvs.openbsd.org 2006/01/04 18:45:01
2697 [ssh.1]
2698 remove .Xr's to rsh(1) and telnet(1): they are hardly needed;
926f6a7a 2699 - jmc@cvs.openbsd.org 2006/01/04 19:40:24
2700 [ssh.1]
2701 +.Xr ssh-keyscan 1 ,
ccce91ef 2702 - jmc@cvs.openbsd.org 2006/01/04 19:50:09
2703 [ssh.1]
2704 -.Xr gzip 1 ,
db382686 2705 - djm@cvs.openbsd.org 2006/01/05 23:43:53
2706 [misc.c]
2707 check that stdio file descriptors are actually closed before clobbering
2708 them in sanitise_stdfd(). problems occurred when a lower numbered fd was
2709 closed, but higher ones weren't. spotted by, and patch tested by
2710 Frédéric Olivié
0624a70b 2711
d3506f6d 271220060103
2713 - (djm) [channels.c] clean up harmless merge error, from reyk@
2714
79e46360 271520060103
2716 - (djm) OpenBSD CVS Sync
2717 - jmc@cvs.openbsd.org 2006/01/02 17:09:49
2718 [ssh_config.5 sshd_config.5]
2719 some corrections from michael knudsen;
2720
6f6cd507 272120060102
2722 - (djm) [README.tun] Add README.tun, missed during sync of tun(4) support
4b5e6c81 2723 - (djm) OpenBSD CVS Sync
2724 - jmc@cvs.openbsd.org 2005/12/31 10:46:17
2725 [ssh.1]
2726 merge the "LOGIN SESSION AND REMOTE EXECUTION" and "SERVER
2727 AUTHENTICATION" sections into "AUTHENTICATION";
2728 some rewording done to make the text read better, plus some
2729 improvements from djm;
2730 ok djm
b92605e1 2731 - jmc@cvs.openbsd.org 2005/12/31 13:44:04
2732 [ssh.1]
2733 clean up ENVIRONMENT a little;
20892533 2734 - jmc@cvs.openbsd.org 2005/12/31 13:45:19
2735 [ssh.1]
2736 .Nm does not require an argument;
1f1fbbd8 2737 - stevesk@cvs.openbsd.org 2006/01/01 08:59:27
2738 [includes.h misc.c]
2739 move <net/if.h>; ok djm@
81c042a3 2740 - stevesk@cvs.openbsd.org 2006/01/01 10:08:48
2741 [misc.c]
2742 no trailing "\n" for debug()
3eee3b86 2743 - djm@cvs.openbsd.org 2006/01/02 01:20:31
2744 [sftp-client.c sftp-common.h sftp-server.c]
2745 use a common max. packet length, no binary change
b1b65311 2746 - reyk@cvs.openbsd.org 2006/01/02 07:53:44
2747 [misc.c]
2748 clarify tun(4) opening - set the mode and bring the interface up. also
2749 (re)sets the tun(4) layer 2 LINK0 flag for existing tunnel interfaces.
2750 suggested and ok by djm@
d141c93d 2751 - jmc@cvs.openbsd.org 2006/01/02 12:31:06
2752 [ssh.1]
2753 start to cut some duplicate info from FILES;
2754 help/ok djm
6f6cd507 2755
0f6cb079 275620060101
2757 - (djm) [Makefile.in configure.ac includes.h misc.c]
2758 [openbsd-compat/port-tun.c openbsd-compat/port-tun.h] Add support
2759 for tunnel forwarding for FreeBSD and NetBSD. NetBSD's support is
2760 limited to IPv4 tunnels only, and most versions don't support the
2761 tap(4) device at all.
b5081213 2762 - (djm) [configure.ac] Fix linux/if_tun.h test
3aef38da 2763 - (djm) [openbsd-compat/port-tun.c] Linux needs linux/if.h too
0f6cb079 2764
1908529f 276520051229
2766 - (djm) OpenBSD CVS Sync
2767 - stevesk@cvs.openbsd.org 2005/12/28 22:46:06
2768 [canohost.c channels.c clientloop.c]
2769 use 'break-in' for consistency; ok deraadt@ ok and input jmc@
c1c6a032 2770 - reyk@cvs.openbsd.org 2005/12/30 15:56:37
2771 [channels.c channels.h clientloop.c]
2772 add channel output filter interface.
2773 ok djm@, suggested by markus@
3da242db 2774 - jmc@cvs.openbsd.org 2005/12/30 16:59:00
2775 [sftp.1]
2776 do not suggest that interactive authentication will work
2777 with the -b flag;
2778 based on a diff from john l. scarfone;
2779 ok djm
f470cf48 2780 - stevesk@cvs.openbsd.org 2005/12/31 01:38:45
2781 [ssh.1]
2782 document -MM; ok djm@
e914f53a 2783 - (djm) [openbsd-compat/port-tun.c openbsd-compat/port-tun.h configure.ac]
2784 [serverloop.c ssh.c openbsd-compat/Makefile.in]
2785 [openbsd-compat/openbsd-compat.h] Implement tun(4) forwarding
2786 compatability support for Linux, diff from reyk@
c40f09ca 2787 - (djm) [configure.ac] Disable Linux tun(4) compat code if linux/tun.h does
2788 not exist
d91775e1 2789 - (djm) [configure.ac] oops, make that linux/if_tun.h
1908529f 2790
b5c428f0 279120051229
2792 - (tim) [buildpkg.sh.in] grep for $SSHDUID instead of $SSHDGID on /etc/passwd
2793
6b0117fd 279420051224
2795 - (djm) OpenBSD CVS Sync
2796 - jmc@cvs.openbsd.org 2005/12/20 21:59:43
2797 [ssh.1]
2798 merge the sections on protocols 1 and 2 into one section on
2799 authentication;
2800 feedback djm dtucker
2801 ok deraadt markus dtucker
5c5546be 2802 - jmc@cvs.openbsd.org 2005/12/20 22:02:50
2803 [ssh.1]
2804 .Ss -> .Sh: subsections have not made this page more readable
e6c7c03e 2805 - jmc@cvs.openbsd.org 2005/12/20 22:09:41
2806 [ssh.1]
2807 move info on ssh return values and config files up into the main
2808 description;
e49f7abd 2809 - jmc@cvs.openbsd.org 2005/12/21 11:48:16
2810 [ssh.1]
2811 -L and -R descriptions are now above, not below, ~C description;
8770ef76 2812 - jmc@cvs.openbsd.org 2005/12/21 11:57:25
2813 [ssh.1]
2814 options now described `above', rather than `later';
6e1e9c73 2815 - jmc@cvs.openbsd.org 2005/12/21 12:53:31
2816 [ssh.1]
2817 -Y does X11 forwarding too;
2818 ok markus
6cd6c442 2819 - stevesk@cvs.openbsd.org 2005/12/21 22:44:26
2820 [sshd.8]
2821 clarify precedence of -p, Port, ListenAddress; ok and help jmc@
0c9851b1 2822 - jmc@cvs.openbsd.org 2005/12/22 10:31:40
2823 [ssh_config.5]
2824 put the description of "UsePrivilegedPort" in the correct place;
9bf41db3 2825 - jmc@cvs.openbsd.org 2005/12/22 11:23:42
2826 [ssh.1]
2827 expand the description of -w somewhat;
2828 help/ok reyk
86131206 2829 - jmc@cvs.openbsd.org 2005/12/23 14:55:53
2830 [ssh.1]
2831 - sync the description of -e w/ synopsis
2832 - simplify the description of -I
2833 - note that -I is only available if support compiled in, and that it
2834 isn't by default
2835 feedback/ok djm@
025fc42e 2836 - jmc@cvs.openbsd.org 2005/12/23 23:46:23
2837 [ssh.1]
2838 less mark up for -c;
678143bd 2839 - djm@cvs.openbsd.org 2005/12/24 02:27:41
2840 [session.c sshd.c]
2841 eliminate some code duplicated in privsep and non-privsep paths, and
2842 explicitly clear SIGALRM handler; "groovy" deraadt@
6b0117fd 2843
a2b1748a 284420051220
2845 - (dtucker) OpenBSD CVS Sync
2846 - reyk@cvs.openbsd.org 2005/12/13 15:03:02
2847 [serverloop.c]
2848 if forced_tun_device is not set, it is -1 and not SSH_TUNID_ANY
442c8b33 2849 - jmc@cvs.openbsd.org 2005/12/16 18:07:08
2850 [ssh.1]
2851 move the option descriptions up the page: start of a restructure;
2852 ok markus deraadt
e426efa9 2853 - jmc@cvs.openbsd.org 2005/12/16 18:08:53
2854 [ssh.1]
2855 simplify a sentence;
28ca205d 2856 - jmc@cvs.openbsd.org 2005/12/16 18:12:22
2857 [ssh.1]
2858 make the description of -c a little nicer;
a55c1733 2859 - jmc@cvs.openbsd.org 2005/12/16 18:14:40
2860 [ssh.1]
2861 signpost the protocol sections;
8918b906 2862 - stevesk@cvs.openbsd.org 2005/12/17 21:13:05
2863 [ssh_config.5 session.c]
2864 spelling: fowarding, fowarded
551ed07c 2865 - stevesk@cvs.openbsd.org 2005/12/17 21:36:42
2866 [ssh_config.5]
2867 spelling: intented -> intended
3aa43b24 2868 - dtucker@cvs.openbsd.org 2005/12/20 04:41:07
2869 [ssh.c]
2870 exit(255) on error to match description in ssh(1); bz #1137; ok deraadt@
a2b1748a 2871
e5146707 287220051219
2873 - (dtucker) [cipher-aes.c cipher-ctr.c cipher.c configure.ac
2874 openbsd-compat/openssl-compat.h] Check for and work around broken AES
2875 ciphers >128bit on (some) Solaris 10 systems. ok djm@
2876
2f89281c 287720051217
2878 - (dtucker) [defines.h] HP-UX system headers define "YES" and "NO" which
2879 scp.c also uses, so undef them here.
31b0732a 2880 - (dtucker) [configure.ac openbsd-compat/bsd-snprintf.c] Bug #1133: Our
2881 snprintf replacement can have a conflicting declaration in HP-UX's system
2882 headers (const vs. no const) so we now check for and work around it. Patch
2883 from the dynamic duo of David Leonard and Ted Percival.
2f89281c 2884
9fed02d8 288520051214
2886 - (dtucker) OpenBSD CVS Sync (regress/)
2887 - dtucker@cvs.openbsd.org 2005/12/30 04:36:39
2888 [regress/scp-ssh-wrapper.sh]
2889 Fix assumption about how many args scp will pass; ok djm@
2890
d7cf99ff 289120051213
2892 - (djm) OpenBSD CVS Sync
2893 - jmc@cvs.openbsd.org 2005/11/30 11:18:27
2894 [ssh.1]
2895 timezone -> time zone
04ac3e62 2896 - jmc@cvs.openbsd.org 2005/11/30 11:45:20
2897 [ssh.1]
2898 avoid ambiguities in describing TZ;
2899 ok djm@
d20f3c9e 2900 - reyk@cvs.openbsd.org 2005/12/06 22:38:28
2901 [auth-options.c auth-options.h channels.c channels.h clientloop.c]
2902 [misc.c misc.h readconf.c readconf.h scp.c servconf.c servconf.h]
2903 [serverloop.c sftp.c ssh.1 ssh.c ssh_config ssh_config.5 sshconnect.c]
2904 [sshconnect.h sshd.8 sshd_config sshd_config.5]
2905 Add support for tun(4) forwarding over OpenSSH, based on an idea and
2906 initial channel code bits by markus@. This is a simple and easy way to
2907 use OpenSSH for ad hoc virtual private network connections, e.g.
2908 administrative tunnels or secure wireless access. It's based on a new
2909 ssh channel and works similar to the existing TCP forwarding support,
2910 except that it depends on the tun(4) network interface on both ends of
2911 the connection for layer 2 or layer 3 tunneling. This diff also adds
2912 support for LocalCommand in the ssh(1) client.
d20f3c9e 2913 ok djm@, markus@, jmc@ (manpages), tested and discussed with others
ceec33f3 2914 - djm@cvs.openbsd.org 2005/12/07 03:52:22
2915 [clientloop.c]
2916 reyk forgot to compile with -Werror (missing header)
985bb789 2917 - jmc@cvs.openbsd.org 2005/12/07 10:52:13
2918 [ssh.1]
2919 - avoid line split in SYNOPSIS
2920 - add args to -w
2921 - kill trailing whitespace
64925c6d 2922 - jmc@cvs.openbsd.org 2005/12/08 14:59:44
2923 [ssh.1 ssh_config.5]
2924 make `!command' a little clearer;
2925 ok reyk
030723f9 2926 - jmc@cvs.openbsd.org 2005/12/08 15:06:29
2927 [ssh_config.5]
2928 keep options in order;
a4f24bf8 2929 - reyk@cvs.openbsd.org 2005/12/08 18:34:11
2930 [auth-options.c includes.h misc.c misc.h readconf.c servconf.c]
2931 [serverloop.c ssh.c ssh_config.5 sshd_config.5 configure.ac]
2932 two changes to the new ssh tunnel support. this breaks compatibility
2933 with the initial commit but is required for a portable approach.
2934 - make the tunnel id u_int and platform friendly, use predefined types.
2935 - support configuration of layer 2 (ethernet) or layer 3
2936 (point-to-point, default) modes. configuration is done using the
2937 Tunnel (yes|point-to-point|ethernet|no) option is ssh_config(5) and
2938 restricted by the PermitTunnel (yes|point-to-point|ethernet|no) option
2939 in sshd_config(5).
2940 ok djm@, man page bits by jmc@
a274ba38 2941 - jmc@cvs.openbsd.org 2005/12/08 21:37:50
2942 [ssh_config.5]
2943 new sentence, new line;
b872f7f0 2944 - markus@cvs.openbsd.org 2005/12/12 13:46:18
2945 [channels.c channels.h session.c]
2946 make sure protocol messages for internal channels are ignored.
2947 allow adjust messages for non-open channels; with and ok djm@
6306853a 2948 - (djm) [misc.c] Disable tunnel code for non-OpenBSD (for now), enable
2949 again by providing a sys_tun_open() function for your platform and
2950 setting the CUSTOM_SYS_TUN_OPEN define. More work is required to match
2951 OpenBSD's tunnel protocol, which prepends the address family to the
2952 packet
d7cf99ff 2953
fbc06315 295420051201
2955 - (djm) [envpass.sh] Remove regress script that was accidentally committed
2956 in top level directory and not noticed for over a year :)
2957
6e94bd72 295820051129
2959 - (tim) [ssh-keygen.c] Move DSA length test after setting default when
2960 bits == 0.
60dc0294 2961 - (dtucker) OpenBSD CVS Sync
2962 - dtucker@cvs.openbsd.org 2005/11/29 02:04:55
2963 [ssh-keygen.c]
2964 Populate default key sizes before checking them; from & ok tim@
e45da4d6 2965 - (tim) [configure.ac sshd.8] Enable locked account check (a "*LK*" string)
2966 for UnixWare.
6e94bd72 2967
b7bb251f 296820051128
2969 - (dtucker) [regress/yes-head.sh] Work around breakage caused by some
2970 versions of GNU head. Based on patch from zappaman at buraphalinux.org
8b396721 2971 - (dtucker) [includes.h] Bug #1122: __USE_GNU is a glibc internal macro, use
2972 _GNU_SOURCE instead. Patch from t8m at centrum.cz.
c6d7b211 2973 - (dtucker) OpenBSD CVS Sync
2974 - dtucker@cvs.openbsd.org 2005/11/28 05:16:53
2975 [ssh-keygen.1 ssh-keygen.c]
2976 Enforce DSA key length of exactly 1024 bits to comply with FIPS-186-2,
2977 increase minumum RSA key size to 768 bits and update man page to reflect
2978 these. Patch originally bz#1119 (senthilkumar_sen at hotpop.com),
2979 ok djm@, grudging ok deraadt@.
98e93fbc 2980 - dtucker@cvs.openbsd.org 2005/11/28 06:02:56
2981 [ssh-agent.1]
2982 Update agent socket path templates to reflect reality, correct xref for
2983 time formats. bz#1121, patch from openssh at roumenpetrov.info, ok djm@
b7bb251f 2984
961c2997 298520051126
2986 - (dtucker) [configure.ac] Bug #1126: AIX 5.2 and 5.3 (and presumably newer,
2987 when they're available) need the real UID set otherwise pam_chauthtok will
2988 set ADMCHG after changing the password, forcing the user to change it
2989 again immediately.
2990
ccc45ee0 299120051125
2992 - (dtucker) [configure.ac] Apply tim's fix for older systems where the
2993 resolver state in resolv.h is "state" not "__res_state". With slight
2994 modification by me to also work on old AIXes. ok djm@
419094c6 2995 - (dtucker) [progressmeter.c scp.c sftp-server.c] Use correct casts for
2996 snprintf formats, fixes warnings on some 64 bit platforms. Patch from
2997 shaw at vranix.com, ok djm@
ccc45ee0 2998
299920051124
9a406e1e 3000 - (djm) [configure.ac openbsd-compat/Makefile.in openbsd-compat/bsd-asprintf.c
3001 openbsd-compat/bsd-snprintf.c openbsd-compat/openbsd-compat.h] Add an
3002 asprintf() implementation, after syncing our {v,}snprintf() implementation
3003 with some extra fixes from Samba's version. With help and debugging from
3004 dtucker and tim; ok dtucker@
d08db6d1 3005 - (dtucker) [configure.ac] Fix typos in comments and AC_SEARCH_LIB argument
3006 order in Reliant Unix block. Patch from johane at lysator.liu.se.
d77c7dff 3007 - (dtucker) [regress/test-exec.sh] Use 1024 bit keys since we generate so
3008 many and use them only once. Speeds up testing on older/slower hardware.
9a406e1e 3009
932ab351 301020051122
3011 - (dtucker) OpenBSD CVS Sync
3012 - deraadt@cvs.openbsd.org 2005/11/12 18:37:59
3013 [ssh-add.c]
3014 space
29accf74 3015 - deraadt@cvs.openbsd.org 2005/11/12 18:38:15
3016 [scp.c]
3017 avoid close(-1), as in rcp; ok cloder
a001f9d7 3018 - millert@cvs.openbsd.org 2005/11/15 11:59:54
3019 [includes.h]
3020 Include sys/queue.h explicitly instead of assuming some other header
3021 will pull it in. At the moment it gets pulled in by sys/select.h
3022 (which ssh has no business including) via event.h. OK markus@
3023 (ID sync only in -portable)
426cef74 3024 - dtucker@cvs.openbsd.org 2005/11/21 09:42:10
3025 [auth-krb5.c]
3026 Perform Kerberos calls even for invalid users to prevent leaking
3027 information about account validity. bz #975, patch originally from
3028 Senthil Kumar, sanity checked by Simon Wilkinson, tested by djm@, biorn@,
3029 ok markus@
18f8ef7a 3030 - dtucker@cvs.openbsd.org 2005/11/22 03:36:03
3031 [hostfile.c]
3032 Correct format/arguments to debug call; spotted by shaw at vranix.com
3033 ok djm@
dfde7f6e 3034 - (dtucker) [loginrec.c] Add casts to prevent compiler warnings, patch
3035 from shaw at vranix.com.
932ab351 3036
60e10887 303720051120
3038 - (dtucker) [openbsd-compat/openssl-compat.h] Add comment explaining what
3039 is going on.
3040
4162eae5 304120051112
3042 - (dtucker) [openbsd-compat/getrrsetbyname.c] Restore Portable-specific
3043 ifdef lost during sync. Spotted by tim@.
f97dc218 3044 - (dtucker) [openbsd-compat/{realpath.c,stroll.c,rresvport.c}] $OpenBSD tag.
eeee8237 3045 - (dtucker) [configure.ac] Use "$AWK" instead of "awk" in gcc version test.
23361281 3046 - (dtucker) [configure.ac] Remove duplicate utimes() check. ok djm@
29aaf112 3047 - (dtucker) [regress/reconfigure.sh] Fix potential race in the reconfigure
3048 test: if sshd takes too long to reconfigure the subsequent connection will
3049 fail. Zap pidfile before HUPing sshd which will rewrite it when it's ready.
4162eae5 3050
e1658b5c 305120051110
b69585d9 3052 - (dtucker) [openbsd-compat/setenv.c] Merge changes for __findenv from
e1658b5c 3053 OpenBSD getenv.c revs 1.4 - 1.8 (ANSIfication of arguments, removal of
3054 "register").
b69585d9 3055 - (dtucker) [openbsd-compat/setenv.c] Make __findenv static, remove
7b2dcf21 3056 unnecessary prototype.
b69585d9 3057 - (dtucker) [openbsd-compat/setenv.c] Sync changes from OpenBSD setenv.c
3058 revs 1.7 - 1.9.
c080bed1 3059 - (dtucker) [auth-krb5.c] Fix -Wsign-compare warning in non-Heimdal path.
3060 Patch from djm@.
dbf07ba2 3061 - (dtucker) [configure.ac] Disable pointer-sign warnings on gcc 4.0+
3062 since they're not useful right now. Patch from djm@.
242652fe 3063 - (dtucker) [openbsd-compat/getgrouplist.c] Sync OpenBSD revs 1.10 - 1.2 (ANSI
3064 prototypes, removal of "register").
432e59f9 3065 - (dtucker) [openbsd-compat/strlcat.c] Sync OpenBSD revs 1.11 - 1.12 (removal
3066 of "register").
f6d4fb87 3067 - (dtucker) [openbsd-compat/{LOTS}] Move the "OPENBSD ORIGINAL" markers to
3068 after the copyright notices. Having them at the top next to the CVSIDs
3069 guarantees a conflict for each and every sync.
e4f65477 3070 - (dtucker) [openbsd-compat/strlcpy.c] Update from OpenBSD 1.8 -> 1.10.
bfd4a832 3071 - (dtucker) [openbsd-compat/sigact.h] Add "OPENBSD ORIGINAL" marker.
bc16ca63 3072 - (dtucker) [openbsd-compat/strmode.c] Update from OpenBSD 1.5 -> 1.7.
3073 Removal of rcsid, "whiteout" inode type.
7dfb4a82 3074 - (dtucker) [openbsd-compat/basename.c] Update from OpenBSD 1.11 -> 1.14.
3075 Removal of rcsid, will no longer strlcpy parts of the string.
d8922805 3076 - (dtucker) [openbsd-compat/strtoll.c] Update from OpenBSD 1.4 -> 1.5.
4ff445f1 3077 - (dtucker) [openbsd-compat/strtoul.c] Update from OpenBSD 1.5 -> 1.7.
e1829842 3078 - (dtucker) [openbsd-compat/readpassphrase.c] Update from OpenBSD 1.16 -> 1.18.
625552b8 3079 - (dtucker) [openbsd-compat/readpassphrase.h] Update from OpenBSD 1.3 -> 1.5.
a65ea33b 3080 - (dtucker) [openbsd-compat/glob.c] Update from OpenBSD 1.22 -> 1.25.
b84a707a 3081 - (dtucker) [openbsd-compat/glob.h] Update from OpenBSD 1.8 -> 1.9.
281bbb02 3082 - (dtucker) [openbsd-compat/getcwd.c] Update from OpenBSD 1.9 -> 1.14.
16d51c41 3083 - (dtucker) [openbsd-compat/getcwd.c] Replace lstat with fstat to match up
3084 with OpenBSD code since we don't support platforms without fstat any more.
b53df919 3085 - (dtucker) [openbsd-compat/inet_aton.c] Update from OpenBSD 1.7 -> 1.9.
68b36828 3086 - (dtucker) [openbsd-compat/inet_ntoa.c] Update from OpenBSD 1.4 -> 1.6.
3087 - (dtucker) [openbsd-compat/inet_ntop.c] Update from OpenBSD 1.5 -> 1.7.
fc1c42f3 3088 - (dtucker) [openbsd-compat/daemon.c] Update from OpenBSD 1.5 -> 1.6.
0695e921 3089 - (dtucker) [openbsd-compat/strsep.c] Update from OpenBSD 1.5 -> 1.6.
3c8f7a26 3090 - (dtucker) [openbsd-compat/daemon.c] Update from OpenBSD 1.10 -> 1.13.
5bf337a5 3091 - (dtucker) [openbsd-compat/mktemp.c] Update from OpenBSD 1.17 -> 1.19.
8c603515 3092 - (dtucker) [openbsd-compat/rresvport.c] Update from OpenBSD 1.6 -> 1.8.
c9d7b187 3093 - (dtucker) [openbsd-compat/bindresvport.c] Add "OPENBSD ORIGINAL" marker.
295034ce 3094 - (dtucker) [openbsd-compat/bindresvport.c] Update from OpenBSD 1.16 -> 1.17.
3e6325a6 3095 - (dtucker) [openbsd-compat/sigact.c] Update from OpenBSD 1.3 -> 1.4.
3096 Id and copyright sync only, there were no substantial changes we need.
8d767ef2 3097 - (dtucker) [openbsd-compat/bsd-closefrom.c openbsd-compat/base64.c]
6bd2d8e5 3098 -Wsign-compare fixes from djm.
e1b4416e 3099 - (dtucker) [openbsd-compat/sigact.h] Update from OpenBSD 1.2 -> 1.3.
3100 Id and copyright sync only, there were no substantial changes we need.
cd595991 3101 - (dtucker) [configure.ac] Try to get the gcc version number in a way that
3102 doesn't change between versions, and use a safer default.
e1658b5c 3103
255d3e00 310420051105
3105 - (djm) OpenBSD CVS Sync
3106 - markus@cvs.openbsd.org 2005/10/07 11:13:57
3107 [ssh-keygen.c]
3108 change DSA default back to 1024, as it's defined for 1024 bits only
3109 and this causes interop problems with other clients. moreover,
3110 in order to improve the security of DSA you need to change more
3111 components of DSA key generation (e.g. the internal SHA1 hash);
3112 ok deraadt
8cd0437d 3113 - djm@cvs.openbsd.org 2005/10/10 10:23:08
3114 [channels.c channels.h clientloop.c serverloop.c session.c]
3115 fix regression I introduced in 4.2: X11 forwardings initiated after
3116 a session has exited (e.g. "(sleep 5; xterm) &") would not start.
3117 bz #1086 reported by t8m AT centrum.cz; ok markus@ dtucker@
442aee3a 3118 - djm@cvs.openbsd.org 2005/10/11 23:37:37
3119 [channels.c]
3120 bz #1076 set SO_REUSEADDR on X11 forwarding listner sockets, preventing
3121 bind() failure when a previous connection's listeners are in TIME_WAIT,
3122 reported by plattner AT inf.ethz.ch; ok dtucker@
b96eade6 3123 - stevesk@cvs.openbsd.org 2005/10/13 14:03:01
3124 [auth2-gss.c gss-genr.c gss-serv.c]
3125 remove unneeded #includes; ok markus@
6e902aec 3126 - stevesk@cvs.openbsd.org 2005/10/13 14:20:37
3127 [gss-serv.c]
3128 spelling in comments
6472fefc 3129 - stevesk@cvs.openbsd.org 2005/10/13 19:08:08
3130 [gss-serv-krb5.c gss-serv.c]
3131 unused declarations; ok deraadt@
3132 (id sync only for gss-serv-krb5.c)
adf8c40b 3133 - stevesk@cvs.openbsd.org 2005/10/13 19:13:41
3134 [dns.c]
3135 unneeded #include, unused declaration, little knf; ok deraadt@
8442cc66 3136 - stevesk@cvs.openbsd.org 2005/10/13 22:24:31
3137 [auth2-gss.c gss-genr.c gss-serv.c monitor.c]
3138 KNF; ok djm@
17318dd6 3139 - stevesk@cvs.openbsd.org 2005/10/14 02:17:59
3140 [ssh-keygen.c ssh.c sshconnect2.c]
3141 no trailing "\n" for log functions; ok djm@
8c4bd764 3142 - stevesk@cvs.openbsd.org 2005/10/14 02:29:37
3143 [channels.c clientloop.c]
3144 free()->xfree(); ok djm@
ed82a2a9 3145 - stevesk@cvs.openbsd.org 2005/10/15 15:28:12
3146 [sshconnect.c]
3147 make external definition static; ok deraadt@
7238b6e4 3148 - stevesk@cvs.openbsd.org 2005/10/17 13:45:05
3149 [dns.c]
3150 fix memory leaks from 2 sources:
3151 1) key_fingerprint_raw()
3152 2) malloc in dns_read_rdata()
3153 ok jakob@
3154 - stevesk@cvs.openbsd.org 2005/10/17 14:01:28
3155 [dns.c]
3156 remove #ifdef LWRES; ok jakob@
8374cf6f 3157 - stevesk@cvs.openbsd.org 2005/10/17 14:13:35
3158 [dns.c dns.h]
3159 more cleanups; ok jakob@
6b0b0d65 3160 - djm@cvs.openbsd.org 2005/10/30 01:23:19
3161 [ssh_config.5]
3162 mention control socket fallback behaviour, reported by
3163 tryponraj AT gmail.com
2995db03 3164 - djm@cvs.openbsd.org 2005/10/30 04:01:03
3165 [ssh-keyscan.c]
3166 make ssh-keygen discard junk from server before SSH- ident, spotted by
3167 dave AT cirt.net; ok dtucker@
aa9bc1de 3168 - djm@cvs.openbsd.org 2005/10/30 04:03:24
3169 [ssh.c]
3170 fix misleading debug message; ok dtucker@
3a85986d 3171 - dtucker@cvs.openbsd.org 2005/10/30 08:29:29
3172 [canohost.c sshd.c]
3173 Check for connections with IP options earlier and drop silently. ok djm@
db98627d 3174 - jmc@cvs.openbsd.org 2005/10/30 08:43:47
3175 [ssh_config.5]
3176 remove trailing whitespace;
7b9b0103 3177 - djm@cvs.openbsd.org 2005/10/30 08:52:18
3178 [clientloop.c packet.c serverloop.c session.c ssh-agent.c ssh-keygen.c]
3179 [ssh.c sshconnect.c sshconnect1.c sshd.c]
3180 no need to escape single quotes in comments, no binary change
bdd3b323 3181 - dtucker@cvs.openbsd.org 2005/10/31 06:15:04
3182 [sftp.c]
3183 Fix sorting with "ls -1" command. From Robert Tsai, "looks right" deraadt@
882c9d5a 3184 - djm@cvs.openbsd.org 2005/10/31 11:12:49
3185 [ssh-keygen.1 ssh-keygen.c]
3186 generate a protocol 2 RSA key by default
6af12d46 3187 - djm@cvs.openbsd.org 2005/10/31 11:48:29
3188 [serverloop.c]
3189 make sure we clean up wtmp, etc. file when we receive a SIGTERM,
3190 SIGINT or SIGQUIT when running without privilege separation (the
3191 normal privsep case is already OK). Patch mainly by dtucker@ and
3192 senthilkumar_sen AT hotpop.com; ok dtucker@
3543c5e1 3193 - jmc@cvs.openbsd.org 2005/10/31 19:55:25
3194 [ssh-keygen.1]
3195 grammar;
0bbbf2a4 3196 - dtucker@cvs.openbsd.org 2005/11/03 13:38:29
3197 [canohost.c]
3198 Cache reverse lookups with and without DNS separately; ok markus@
47e5dc72 3199 - djm@cvs.openbsd.org 2005/11/04 05:15:59
3200 [kex.c kex.h kexdh.c kexdhc.c kexdhs.c kexgex.c kexgexc.c kexgexs.c]
3201 remove hardcoded hash lengths in key exchange code, allowing
3202 implementation of KEX methods with different hashes (e.g. SHA-256);
3203 ok markus@ dtucker@ stevesk@
27e3ef36 3204 - djm@cvs.openbsd.org 2005/11/05 05:01:15
3205 [bufaux.c]
3206 Fix leaks in error paths, bz #1109 and #1110 reported by kremenek AT
3207 cs.stanford.edu; ok dtucker@
e557f3b5 3208 - (dtucker) [README.platform] Add PAM section.
ebb049f1 3209 - (djm) [openbsd-compat/getrrsetbyname.c] Sync to latest OpenBSD version,
3210 resolving memory leak bz#1111 reported by kremenek AT cs.stanford.edu;
3211 ok dtucker@
255d3e00 3212
bd2a0801 321320051102
3214 - (dtucker) [openbsd-compat/bsd-misc.c] Bug #1108: fix broken strdup().
3215 Reported by olavi at ipunplugged.com and antoine.brodin at laposte.net
3216 via FreeBSD.
3217
5097eaa9 321820051030
3219 - (djm) [contrib/suse/openssh.spec contrib/suse/rc.
3220 sshd contrib/suse/sysconfig.ssh] Bug #1106: Updated SuSE spec and init
3221 files from imorgan AT nas.nasa.gov
0a61a240 3222 - (dtucker) [session.c] Bug #1045do not check /etc/nologin when PAM is
3223 enabled, instead allow PAM to handle it. Note that on platforms using PAM,
3224 the pam_nologin module should be added to sshd's session stack in order to
3225 maintain exising behaviour. Based on patch and discussion from t8m at
3226 centrum.cz, ok djm@
5097eaa9 3227
90f15776 322820051025
3229 - (dtucker) [configure.ac] Relocate LLONG_MAX calculation to after the
3230 sizeof(long long) checks, to make fixing bug #1104 easier (no changes
3231 yet).
d75dfaa6 3232 - (dtucker) [configure.ac] Bug #1104: Tru64's printf family doesn't
3233 understand "%lld", even though the compiler has "long long", so handle
3234 it as a special case. Patch tested by mcaskill.scott at epa.gov.
b8bc9d84 3235 - (dtucker) [contrib/cygwin/ssh-user-config] Remove duplicate yes/no
3236 prompt. Patch from vinschen at redhat.com.
90f15776 3237
b0e7249f 323820051017
3239 - (dtucker) [configure.ac] Bug #1097: Fix configure for cross-compiling.
3240 /etc/default/login report and testing from aabaker at iee.org, corrections
3241 from tim@.
3242
8034a348 324320051009
3244 - (dtucker) [configure.ac defines.h openbsd-compat/vis.{c,h}] Sync current
3245 versions from OpenBSD. ok djm@
3246
83f987c3 324720051008
3248 - (dtucker) [configure.ac] Bug #1098: define $MAIL for HP-UX; report from
3249 brian.smith at agilent com.
1012885d 3250 - (djm) [configure.ac] missing 'test' call for -with-Werror test
83f987c3 3251
278f9900 325220051005
3253 - (dtucker) [configure.ac sshd.8] Enable locked account check (a prepended
3254 "*LOCKED*" string) for FreeBSD. Patch jeremie at le-hen.org and
3255 senthilkumar_sen at hotpop.com.
3256
59e5aff5 325720051003
3258 - (dtucker) OpenBSD CVS Sync
3259 - markus@cvs.openbsd.org 2005/09/07 08:53:53
3260 [channels.c]
3261 enforce chanid != NULL; ok djm
b5443199 3262 - markus@cvs.openbsd.org 2005/09/09 19:18:05
3263 [clientloop.c]
3264 typo; from mark at mcs.vuw.ac.nz, bug #1082
fd6168c1 3265 - djm@cvs.openbsd.org 2005/09/13 23:40:07
3266 [sshd.c ssh.c misc.h sftp.c ssh-keygen.c ssh-keysign.c sftp-server.c
3267 scp.c misc.c ssh-keyscan.c ssh-add.c ssh-agent.c]
3268 ensure that stdio fds are attached; ok deraadt@
5ddc5eb4 3269 - djm@cvs.openbsd.org 2005/09/19 11:37:34
3270 [ssh_config.5 ssh.1]
3271 mention ability to specify bind_address for DynamicForward and -D options;
3272 bz#1077 spotted by Haruyama Seigo
d77dd4d7 3273 - djm@cvs.openbsd.org 2005/09/19 11:47:09
3274 [sshd.c]
3275 stop connection abort on rekey with delayed compression enabled when
3276 post-auth privsep is disabled (e.g. when root is logged in); ok dtucker@
67003554 3277 - djm@cvs.openbsd.org 2005/09/19 11:48:10
3278 [gss-serv.c]
3279 typo
37c406a8 3280 - jmc@cvs.openbsd.org 2005/09/19 15:38:27
3281 [ssh.1]
3282 some more .Bk/.Ek to avoid ugly line split;
80e29ee6 3283 - jmc@cvs.openbsd.org 2005/09/19 15:42:44
3284 [ssh.c]
3285 update -D usage here too;
2915e42b 3286 - djm@cvs.openbsd.org 2005/09/19 23:31:31
3287 [ssh.1]
3288 spelling nit from stevesk@
0d3d1077 3289 - djm@cvs.openbsd.org 2005/09/21 23:36:54
3290 [sshd_config.5]
3291 aquire -> acquire, from stevesk@
ae25711b 3292 - djm@cvs.openbsd.org 2005/09/21 23:37:11
3293 [sshd.c]
3294 change label at markus@'s request
8f921a4a 3295 - jaredy@cvs.openbsd.org 2005/09/30 20:34:26
3296 [ssh-keyscan.1]
3297 deploy .An -nosplit; ok jmc
d2130e1f 3298 - dtucker@cvs.openbsd.org 2005/10/03 07:44:42
3299 [canohost.c]
3300 Relocate check_ip_options call to prevent logging of garbage for
3301 connections with IP options set. bz#1092 from David Leonard,
3302 "looks good" deraadt@
1172d361 3303 - (dtucker) [regress/README.regress] Bug #989: Document limitation that scp
3304 is required in the system path for the multiplex test to work.
59e5aff5 3305
bfd17430 330620050930
3307 - (dtucker) [openbsd-compat/openbsd-compat.h] Bug #1096: Add prototype
3308 for strtoll. Patch from o.flebbe at science-computing.de.
cfb60d3a 3309 - (dtucker) [monitor.c] Bug #1087: Send loginmsg to preauth privsep
3310 child during PAM account check without clearing it. This restores the
3311 post-login warnings such as LDAP password expiry. Patch from Tomas Mraz
3312 with help from several others.
bfd17430 3313
140da888 331420050929
3315 - (dtucker) [monitor_wrap.c] Remove duplicate definition of loginmsg
3316 introduced during sync.
3317
4ebacf50 331820050928
3319 - (dtucker) [entropy.c] Use u_char for receiving RNG seed for consistency.
cafa6a80 3320 - (dtucker) [auth-pam.c] Bug #1028: send final non-query messages from
3321 PAM via keyboard-interactive. Patch tested by the folks at Vintela.
4ebacf50 3322
759ab0d9 332320050927
3324 - (dtucker) [entropy.c] Remove unnecessary tests for getuid and geteuid
3325 calls, since they can't possibly fail. ok djm@
72f02ae7 3326 - (dtucker) [entropy.c entropy.h sshd.c] Pass RNG seed to the reexec'ed
3327 process when sshd relies on ssh-random-helper. Should result in faster
3328 logins on systems without a real random device or prngd. ok djm@
759ab0d9 3329
b6c37221 333020050924
3331 - (dtucker) [auth2.c] Move start_pam() calls out of if-else block to remove
3332 duplicate call. ok djm@
3333
bb116c8e 333420050922
3335 - (dtucker) [configure.ac] Use -R linker flag for libedit too; patch from
3336 skeleten at shillest.net.
e47fb473 3337 - (dtucker) [configure.ac] Fix help for --with-opensc; patch from skeleten at
3338 shillest.net.
bb116c8e 3339
3466e002 334020050919
3341 - (tim) [aclocal.m4 configure.ac] Delete acconfig.h and add templates to
3342 AC_DEFINE and AC_DEFINE_UNQUOTED to quiet autoconf 2.59 warning messages.
f666dcfa 3343 ok dtucker@
3466e002 3344
f5555364 334520050912
3346 - (tim) [configure.ac] Bug 1078. Fix --without-kerberos5. Reported by
3347 Mike Frysinger.
3348
d2a3abef 334920050908
3350 - (tim) [defines.h openbsd-compat/port-uw.c] Add long password support to
3351 OpenServer 6 and add osr5bigcrypt support so when someone migrates
3352 passwords between UnixWare and OpenServer they will still work. OK dtucker@
3353
0b202697 3354$Id$
This page took 1.179684 seconds and 5 git commands to generate.