]> andersk Git - openssh.git/blame - ChangeLog
andersk / openssh.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
- (djm) Fix RCS ident in sftp-server-main.c
[openssh.git] / ChangeLog
CommitLineData
0b639bf6 120080327
2 - (dtucker) Cache selinux status earlier so we know if it's enabled after a
3 chroot. Allows ChrootDirectory to work with selinux support compiled in
4 but not enabled. Using it with selinux enabled will require some selinux
5 support inside the chroot. "looks sane" djm@
96110356 6 - (djm) Fix RCS ident in sftp-server-main.c
0b639bf6 7
3e782ad1 820080315
9 - (djm) [regress/test-exec.sh] Quote putty-related variables in case they are
10 empty; report and patch from Peter Stuge
11 - (djm) [regress/test-exec.sh] Silence noise from detection of putty
12 commands; report from Peter Stuge
fab9144d 13 - (djm) [session.c] Relocate incorrectly-placed closefrom() that was causing
14 crashes when used with ChrootDirectory
3e782ad1 15
caba7de7 1620080314
17 - (tim) [regress/sftp-cmds.sh] s/cd/lcd/ in lls test. Reported by
18 vinschen at redhat.com. Add () to put echo commands in subshell for lls test
19 I mistakenly left out of last commit.
9e8c6eb3 20 - (tim) [regress/localcommand.sh] Shell portability fix. Reported by imorgan at
21 nas.nasa.gov
caba7de7 22
49f32817 2320080313
24 - (djm) [Makefile.in regress/Makefile] Fix interop-tests target (note to
25 self: make changes to Makefile.in next time, not the generated Makefile).
32f129d1 26 - (djm) [Makefile.in regress/test-exec.sh] Find installed plink(1) and
27 puttygen(1) by $PATH
af8388bc 28 - (tim) [scp.c] Use poll.h if available, fall back to sys/poll.h if not. Patch
29 by vinschen at redhat.com.
575a5ece 30 - (tim) [regress/sftp-cmds.sh regress/ssh2putty.sh] Shell portability fixes
7e384d2c 31 from vinschen at redhat.com and imorgan at nas.nasa.gov
49f32817 32
3320080312
7fc75605 34 - (djm) OpenBSD CVS Sync
35 - dtucker@cvs.openbsd.org 2007/10/29 06:57:13
36 [regress/Makefile regress/localcommand.sh]
37 Add simple regress test for LocalCommand; ok djm@
a7c7196f 38 - jmc@cvs.openbsd.org 2007/11/25 15:35:09
39 [regress/agent-getpeereid.sh regress/agent.sh]
40 more existant -> existent, from Martynas Venckus;
41 pfctl changes: ok henning
42 ssh changes: ok deraadt
5e441c3c 43 - djm@cvs.openbsd.org 2007/12/12 05:04:03
44 [regress/sftp-cmds.sh]
45 unbreak lls command and add a regress test that would have caught the
46 breakage; spotted by mouring@
47 NB. sftp code change already committed.
f3dad773 48 - djm@cvs.openbsd.org 2007/12/21 04:13:53
49 [regress/Makefile regress/test-exec.sh regress/putty-ciphers.sh]
50 [regress/putty-kex.sh regress/putty-transfer.sh regress/ssh2putty.sh]
51 basic (crypto, kex and transfer) interop regression tests against putty
52 To run these, install putty and run "make interop-tests" from the build
53 directory - the tests aren't run by default yet.
7fc75605 54
ce433d53 5520080311
83fa7e8d 56 - (dtucker) [auth-pam.c monitor.c session.c sshd.c] Bug #926: Move
57 pam_open_session and pam_close_session into the privsep monitor, which
58 will ensure that pam_session_close is called as root. Patch from Tomas
59 Mraz.
60
caa21240 6120080309
62 - (dtucker) [configure.ac] It turns out gcc's -fstack-protector-all doesn't
63 always work for all platforms and versions, so test what we can and
64 add a configure flag to turn it of if needed. ok djm@
b2c70125 65 - (dtucker) [openbsd-compat/port-aix.{c,h}] Remove AIX specific initgroups
66 implementation. It's not needed to fix bug #1081 and breaks the build
67 on some AIX configurations.
3828f887 68 - (dtucker) [openbsd-compat/regress/strtonumtest.c] Bug #1347: Use platform's
69 equivalent of LLONG_MAX for the compat regression tests, which makes them
70 run on AIX and HP-UX. Patch from David Leonard.
23c5c479 71 - (dtucker) [configure.ac] Run stack-protector tests with -Werror to catch
72 platforms where gcc understands the option but it's not supported (and
73 thus generates a warning).
caa21240 74
c9e2b157 7520080307
76 - (djm) OpenBSD CVS Sync
77 - jmc@cvs.openbsd.org 2008/02/11 07:58:28
78 [ssh.1 sshd.8 sshd_config.5]
79 bump Mdocdate for pages committed in "febuary", necessary because
80 of a typo in rcs.c;
3dfce5de 81 - djm@cvs.openbsd.org 2008/02/13 22:38:17
82 [servconf.h session.c sshd.c]
83 rekey arc4random and OpenSSL RNG in postauth child
84 closefrom fds > 2 before shell/command execution
85 ok markus@
2600996b 86 - mbalmer@cvs.openbsd.org 2008/02/14 13:10:31
87 [sshd.c]
88 When started in configuration test mode (-t) do not check that sshd is
89 being started with an absolute path.
90 ok djm
e2875d9a 91 - markus@cvs.openbsd.org 2008/02/20 15:25:26
92 [session.c]
93 correct boolean encoding for coredump; der Mouse via dugsong
1d395ba0 94 - djm@cvs.openbsd.org 2008/02/22 05:58:56
95 [session.c]
96 closefrom() call was too early, delay it until just before we execute
97 the user's rc files (if any).
ac47b626 98 - dtucker@cvs.openbsd.org 2008/02/22 20:44:02
99 [clientloop.c packet.c packet.h serverloop.c]
100 Allow all SSH2 packet types, including UNIMPLEMENTED to reset the
101 keepalive timer (bz #1307). ok markus@
9fcc4e18 102 - djm@cvs.openbsd.org 2008/02/27 20:21:15
103 [sftp-server.c]
104 add an extension method "posix-rename@openssh.com" to perform POSIX atomic
105 rename() operations. based on patch from miklos AT szeredi.hu in bz#1400;
106 ok dtucker@ markus@
0c9a63f1 107 - deraadt@cvs.openbsd.org 2008/03/02 18:19:35
108 [monitor_fdpass.c]
109 use a union to ensure alignment of the cmsg (pay attention: various other
110 parts of the tree need this treatment too); ok djm
3673ea60 111 - deraadt@cvs.openbsd.org 2008/03/04 21:15:42
112 [version.h]
113 crank version; from djm
9fd799a4 114 - (tim) [regress/sftp-glob.sh] Shell portability fix.
c9e2b157 115
fbfeb0de 11620080302
117 - (dtucker) [configure.ac] FreeBSD's glob() doesn't behave the way we expect
118 either, so use our own.
119
6ce84f4f 12020080229
121 - (dtucker) [openbsd-compat/bsd-poll.c] We don't check for select(2) in
122 configure (and there's not much point, as openssh won't work without it)
123 so HAVE_SELECT is not defined and the poll(2) compat code doesn't get
124 built in. Remove HAVE_SELECT so we can build on platforms without poll.
55b82b39 125 - (dtucker) [scp.c] Include sys/poll.h inside HAVE_SYS_POLL_H.
29317db4 126 - (djm) [contrib/gnome-ssh-askpass2.h] Keep askpass windown on top. From
127 Debian patch via bernd AT openbsd.org
6ce84f4f 128
ebddd492 12920080228
130 - (dtucker) [configure.ac] Add -fstack-protector to LDFLAGS too, fixes
131 linking problems on AIX with gcc 4.1.x.
f5f25d17 132 - (dtucker) [includes.h ssh-add.c ssh-agent.c ssh-keygen.c ssh.c sshd.c
133 openbsd-compat/openssl-compat.{c,h}] Bug #1437 Move the OpenSSL compat
134 header to after OpenSSL headers, since some versions of OpenSSL have
135 SSLeay_add_all_algorithms as a macro already.
6e013118 136 - (dtucker) [key.c defines.h openbsd-compat/openssl-compat.h] Move old OpenSSL
137 compat glue into openssl-compat.h.
533a78f0 138 - (dtucker) [configure.ac openbsd-compat/port-aix.{c,h}] Bug #1081: Implement
139 getgrouplist via getgrset on AIX, rather than iterating over getgrent.
140 This allows, eg, Match and AllowGroups directives to work with NIS and
141 LDAP groups.
5c7fd4ce 142 - (dtucker) [sshd.c] Bug #1042: make log messages for tcpwrappers use the
143 same SyslogFacility as the rest of sshd. Patch from William Knox,
144 ok djm@.
ebddd492 145
2db5d1e9 14620080225
147 - (dtucker) [openbsd-compat/fake-rfc2553.h] rename ssh_gai_strerror hack
148 since it now conflicts with the helper function in misc.c. From
149 vinschen AT redhat.com.
a74e9b64 150 - (dtucker) [configure.ac audit-bsm.c] Bug #1420: Add a local implementation
151 of aug_get_machine for systems that don't have their own (eg OS X, FreeBSD).
152 Help and testing from csjp at FreeBSD org, vgiffin at apple com. ok djm@
3e35bb36 153 - (dtucker) [includes.h openbsd-compat/openssl-compat.c] Bug #1437: reshuffle
154 headers so ./configure --with-ssl-engine actually works. Patch from
155 Ian Lister.
2db5d1e9 156
880a060b 15720080224
158 - (tim) [contrib/cygwin/ssh-host-config]
159 Grammar changes on SYSCONFDIR LOCALSTATEDIR messages.
160 Check more thoroughly that it's possible to create the /var/empty directory.
161 Patch by vinschen AT redhat.com
162
737cce6f 16320080210
164 - OpenBSD CVS Sync
165 - chl@cvs.openbsd.org 2008/01/11 07:22:28
166 [sftp-client.c sftp-client.h]
167 disable unused functions
168 initially from tobias@, but disabled them by placing them in
169 "#ifdef notyet" which was asked by djm@
170 ok djm@ tobias@
05841f5b 171 - djm@cvs.openbsd.org 2008/01/19 19:13:28
172 [ssh.1]
173 satisfy the pedants: -q does not suppress all diagnostic messages (e.g.
174 some commandline parsing warnings go unconditionally to stdout).
4d6760a7 175 - djm@cvs.openbsd.org 2008/01/19 20:48:53
176 [clientloop.c]
177 fd leak on session multiplexing error path. Report and patch from
178 gregory_shively AT fanniemae.com
7cd4e5bc 179 - djm@cvs.openbsd.org 2008/01/19 20:51:26
180 [ssh.c]
181 ignore SIGPIPE in multiplex client mode - we can receive this if the
182 server runs out of fds on us midway. Report and patch from
183 gregory_shively AT fanniemae.com
1c861236 184 - djm@cvs.openbsd.org 2008/01/19 22:04:57
185 [sftp-client.c]
186 fix remote handle leak in do_download() local file open error path;
187 report and fix from sworley AT chkno.net
ccc6beea 188 - djm@cvs.openbsd.org 2008/01/19 22:22:58
189 [ssh-keygen.c]
190 when hashing individual hosts (ssh-keygen -Hf hostname), make sure we
191 hash just the specified hostname and not the entire hostspec from the
192 keyfile. It may be of the form "hostname,ipaddr", which would lead to
193 a hash that never matches. report and fix from jp AT devnull.cz
f8f89bae 194 - djm@cvs.openbsd.org 2008/01/19 22:37:19
195 [ssh-keygen.c]
196 unbreak line numbering (broken in revision 1.164), fix error message
bc4cc956 197 - djm@cvs.openbsd.org 2008/01/19 23:02:40
198 [channels.c]
199 When we added support for specified bind addresses for port forwards, we
200 added a quirk SSH_OLD_FORWARD_ADDR. There is a bug in our handling of
201 this for -L port forwards that causes the client to listen on both v4
202 and v6 addresses when connected to a server with this quirk, despite
203 having set 0.0.0.0 as a bind_address.
204 report and patch from Jan.Pechanec AT Sun.COM; ok dtucker@
fe771396 205 - djm@cvs.openbsd.org 2008/01/19 23:09:49
206 [readconf.c readconf.h sshconnect2.c]
207 promote rekeylimit to a int64 so it can hold the maximum useful limit
208 of 2^32; report and patch from Jan.Pechanec AT Sun.COM, ok dtucker@
70755b3b 209 - djm@cvs.openbsd.org 2008/01/20 00:38:30
210 [sftp.c]
211 When uploading, correctly handle the case of an unquoted filename with
212 glob metacharacters that match a file exactly but not as a glob, e.g. a
213 file called "[abcd]". report and test cases from duncan2nd AT gmx.de
b4bbe43c 214 - djm@cvs.openbsd.org 2008/01/21 17:24:30
215 [sftp-server.c]
216 Remove the fixed 100 handle limit in sftp-server and allocate as many
217 as we have available file descriptors. Patch from miklos AT szeredi.hu;
218 ok dtucker@ markus@
514a858e 219 - djm@cvs.openbsd.org 2008/01/21 19:20:17
220 [sftp-client.c]
221 when a remote write error occurs during an upload, ensure that ACKs for
222 all issued requests are properly drained. patch from t8m AT centrum.cz
aacfb17b 223 - dtucker@cvs.openbsd.org 2008/01/23 01:56:54
224 [clientloop.c packet.c serverloop.c]
225 Revert the change for bz #1307 as it causes connection aborts if an IGNORE
226 packet arrives while we're waiting in packet_read_expect (and possibly
227 elsewhere).
51402e76 228 - jmc@cvs.openbsd.org 2008/01/31 20:06:50
229 [scp.1]
230 explain how to handle local file names containing colons;
231 requested by Tamas TEVESZ
232 ok dtucker
c33ba17e 233 - markus@cvs.openbsd.org 2008/02/04 21:53:00
234 [session.c sftp-server.c sftp.h]
235 link sftp-server into sshd; feedback and ok djm@
7c36e880 236 - mcbride@cvs.openbsd.org 2008/02/09 12:15:43
237 [ssh.1 sshd.8]
238 Document the correct permissions for the ~/.ssh/ directory.
239 ok jmc
2bd88d9f 240 - djm@cvs.openbsd.org 2008/02/10 09:55:37
241 [sshd_config.5]
242 mantion that "internal-sftp" is useful with ForceCommand too
c5bf32e6 243 - djm@cvs.openbsd.org 2008/02/10 10:54:29
244 [servconf.c session.c]
245 delay ~ expansion for ChrootDirectory so it expands to the logged-in user's
246 home, rather than the user who starts sshd (probably root)
737cce6f 247
efcc134b 24820080119
249 - (djm) Silence noice from expr in ssh-copy-id; patch from
250 mikel AT mikelward.com
8eff0d0a 251 - (djm) Only listen for IPv6 connections on AF_INET6 sockets; patch from
252 tsr2600 AT gmail.com
efcc134b 253
bd326285 25420080102
255 - (dtucker) [configure.ac] Fix message for -fstack-protector-all test.
256
2a72bc03 25720080101
258 - (dtucker) OpenBSD CVS Sync
259 - dtucker@cvs.openbsd.org 2007/12/31 10:41:31
260 [readconf.c servconf.c]
261 Prevent strict-aliasing warnings on newer gcc versions. bz #1355, patch
262 from Dmitry V. Levin, ok djm@
59d68bae 263 - dtucker@cvs.openbsd.org 2007/12/31 15:27:04
264 [sshd.c]
265 When in inetd mode, have sshd generate a Protocol 1 ephemeral server
266 key only for connections where the client chooses Protocol 1 as opposed
267 to when it's enabled in the server's config. Speeds up Protocol 2
268 connections to inetd-mode servers that also allow Protocol 1. bz #440,
269 based on a patch from bruno at wolff.to, ok markus@
e5088d08 270 - dtucker@cvs.openbsd.org 2008/01/01 08:47:04
271 [misc.c]
272 spaces -> tabs from my previous commit
273 - dtucker@cvs.openbsd.org 2008/01/01 09:06:39
274 [scp.c]
275 If scp -p encounters a pre-epoch timestamp, use the epoch which is
276 as close as we can get given that it's used unsigned. Add a little
277 debugging while there. bz #828, ok djm@
2ef741a3 278 - dtucker@cvs.openbsd.org 2008/01/01 09:27:33
279 [sshd_config.5 servconf.c]
280 Allow PermitRootLogin in a Match block. Allows for, eg, permitting root
281 only from the local network. ok markus@, man page bit ok jmc@
c9babd71 282 - dtucker@cvs.openbsd.org 2008/01/01 08:51:20
283 [moduli]
284 Updated moduli file; ok djm@
2a72bc03 285
a8ad3b9d 28620071231
287 - (dtucker) [configure.ac openbsd-compat/glob.{c,h}] Bug #1407: force use of
288 builtin glob implementation on Mac OS X. Based on a patch from
289 vgiffin at apple.
290
65172fff 29120071229
292 - (dtucker) OpenBSD CVS Sync
293 - djm@cvs.openbsd.org 2007/12/12 05:04:03
294 [sftp.c]
295 unbreak lls command and add a regress test that would have caught the
296 breakage; spotted by mouring@
bb4626fe 297 - dtucker@cvs.openbsd.org 2007/12/27 14:22:08
298 [servconf.c canohost.c misc.c channels.c sshconnect.c misc.h ssh-keyscan.c
299 sshd.c]
300 Add a small helper function to consistently handle the EAI_SYSTEM error
301 code of getaddrinfo. Prompted by vgiffin at apple com via bz #1417.
302 ok markus@ stevesk@
271db2da 303 - dtucker@cvs.openbsd.org 2007/12/28 15:32:24
304 [clientloop.c serverloop.c packet.c]
305 Make SSH2_MSG_UNIMPLEMENTED and SSH2_MSG_IGNORE messages reset the
306 ServerAlive and ClientAlive timers. Prevents dropping a connection
307 when these are enabled but the peer does not support our keepalives.
308 bz #1307, ok djm@.
016f1482 309 - dtucker@cvs.openbsd.org 2007/12/28 22:34:47
310 [clientloop.c]
311 Use the correct packet maximum sizes for remote port and agent forwarding.
312 Prevents the server from killing the connection if too much data is queued
313 and an excessively large packet gets sent. bz #1360, ok djm@.
65172fff 314
eb5a7224 31520071202
316 - (dtucker) [configure.ac] Enable -fstack-protector-all on systems where
317 gcc supports it. ok djm@
4b565fda 318 - (dtucker) [scp.c] Update $OpenBSD tag missing from rev 1.175 and remove
319 leftover debug code.
ecb431c1 320 - (dtucker) OpenBSD CVS Sync
321 - dtucker@cvs.openbsd.org 2007/10/29 00:52:45
322 [auth2-gss.c]
323 Allow build without -DGSSAPI; ok deraadt@
324 (Id sync only, Portable already has the ifdefs)
d0420e01 325 - dtucker@cvs.openbsd.org 2007/10/29 01:55:04
326 [ssh.c]
327 Plug tiny mem leaks in ControlPath and ProxyCommand option processing;
328 ok djm@
dc0cae51 329 - dtucker@cvs.openbsd.org 2007/10/29 04:08:08
330 [monitor_wrap.c monitor.c]
331 Send config block back to slave for invalid users too so options
332 set by a Match block (eg Banner) behave the same for non-existent
333 users. Found by and ok djm@
d349e4bd 334 - dtucker@cvs.openbsd.org 2007/10/29 06:51:59
335 [ssh_config.5]
336 ProxyCommand and LocalCommand use the user's shell, not /bin/sh; ok djm@
c80e7e5d 337 - dtucker@cvs.openbsd.org 2007/10/29 06:54:50
338 [ssh.c]
339 Make LocalCommand work for Protocol 1 too; ok djm@
eb86ca9d 340 - jmc@cvs.openbsd.org 2007/10/29 07:48:19
341 [ssh_config.5]
342 clean up after previous macro removal;
16912319 343 - djm@cvs.openbsd.org 2007/11/03 00:36:14
344 [clientloop.c]
345 fix memory leak in process_cmdline(), patch from Jan.Pechanec AT Sun.COM;
346 ok dtucker@
a7082e17 347 - deraadt@cvs.openbsd.org 2007/11/03 01:24:06
348 [ssh.c]
349 bz #1377: getpwuid results were being clobbered by another getpw* call
350 inside tilde_expand_filename(); save the data we need carefully
351 ok djm
42f4b33f 352 - dtucker@cvs.openbsd.org 2007/11/03 02:00:32
353 [ssh.c]
354 Use xstrdup/xfree when saving pwname and pwdir; ok deraadt@
f622d144 355 - deraadt@cvs.openbsd.org 2007/11/03 02:03:49
356 [ssh.c]
357 avoid errno trashing in signal handler; ok dtucker
eb5a7224 358
d884586a 35920071030
360 - (djm) OpenBSD CVS Sync
361 - djm@cvs.openbsd.org 2007/10/29 23:49:41
362 [openbsd-compat/sys-tree.h]
363 remove extra backslash at the end of RB_PROTOTYPE, report from
364 Jan.Pechanec AT Sun.COM; ok deraadt@
365
73209290 36620071026
367 - (djm) OpenBSD CVS Sync
368 - stevesk@cvs.openbsd.org 2007/09/11 23:49:09
369 [sshpty.c]
370 remove #if defined block not needed; ok markus@ dtucker@
371 (NB. RCD ID sync only for portable)
530c2ec0 372 - djm@cvs.openbsd.org 2007/09/21 03:05:23
373 [ssh_config.5]
374 document KbdInteractiveAuthentication in ssh_config.5;
375 patch from dkg AT fifthhorseman.net
a3d3770c 376 - djm@cvs.openbsd.org 2007/09/21 08:15:29
377 [auth-bsdauth.c auth-passwd.c auth.c auth.h auth1.c auth2-chall.c]
378 [monitor.c monitor_wrap.c]
379 unifdef -DBSD_AUTH
380 unifdef -USKEY
381 These options have been in use for some years;
382 ok markus@ "no objection" millert@
383 (NB. RCD ID sync only for portable)
18660b86 384 - canacar@cvs.openbsd.org 2007/09/25 23:48:57
385 [ssh-agent.c]
386 When adding a key that already exists, update the properties
387 (time, confirm, comment) instead of discarding them. ok djm@ markus@
5e4fce9c 388 - ray@cvs.openbsd.org 2007/09/27 00:15:57
389 [dh.c]
390 Don't return -1 on error in dh_pub_is_valid(), since it evaluates
391 to true.
392 Also fix a typo.
393 Initial diff from Matthew Dempsky, input from djm.
394 OK djm, markus.
e05f182e 395 - dtucker@cvs.openbsd.org 2007/09/29 00:25:51
396 [auth2.c]
397 Remove unused prototype. ok djm@
3e2d9453 398 - chl@cvs.openbsd.org 2007/10/02 17:49:58
399 [ssh-keygen.c]
400 handles zero-sized strings that fgets can return
c5b78b8e 401 properly removes trailing newline
402 removes an unused variable
403 correctly counts line number
404 "looks ok" ray@ markus@
c462cd6f 405 - markus@cvs.openbsd.org 2007/10/22 19:10:24
406 [readconf.c]
407 make sure that both the local and remote port are correct when
408 parsing -L; Jan Pechanec (bz #1378)
a733c71c 409 - djm@cvs.openbsd.org 2007/10/24 03:30:02
410 [sftp.c]
411 rework argument splitting and parsing to cope correctly with common
412 shell escapes and make handling of escaped characters consistent
413 with sh(1) and between sftp commands (especially between ones that
414 glob their arguments and ones that don't).
415 parse command flags using getopt(3) rather than hand-rolled parsers.
416 ok dtucker@
99b49072 417 - djm@cvs.openbsd.org 2007/10/24 03:44:02
418 [scp.c]
419 factor out network read/write into an atomicio()-like function, and
420 use it to handle short reads, apply bandwidth limits and update
421 counters. make network IO non-blocking, so a small trickle of
422 reads/writes has a chance of updating the progress meter; bz #799
423 ok dtucker@
49e0d774 424 - djm@cvs.openbsd.org 2006/08/29 09:44:00
425 [regress/sftp-cmds.sh]
426 clean up our mess
04ebbaad 427 - markus@cvs.openbsd.org 2006/11/06 09:27:43
428 [regress/cfgmatch.sh]
429 fix quoting for non-(c)sh login shells.
1c158420 430 - dtucker@cvs.openbsd.org 2006/12/13 08:36:36
431 [regress/cfgmatch.sh]
432 Additional test for multiple PermitOpen entries. ok djm@
ac01e61a 433 - pvalchev@cvs.openbsd.org 2007/06/07 19:41:46
434 [regress/cipher-speed.sh regress/try-ciphers.sh]
435 test umac-64@openssh.com
436 ok djm@
ba59fd15 437 - djm@cvs.openbsd.org 2007/10/24 03:32:35
438 [regress/sftp-cmds.sh regress/sftp-glob.sh regress/test-exec.sh]
439 comprehensive tests for sftp escaping its interaction with globbing;
440 ok dtucker@
2432048a 441 - djm@cvs.openbsd.org 2007/10/26 05:30:01
442 [regress/sftp-glob.sh regress/test-exec.sh]
443 remove "echo -E" crap that I added in last commit and use printf(1) for
444 cases where we strictly require echo not to reprocess escape characters.
9e8278d2 445 - deraadt@cvs.openbsd.org 2005/11/28 17:50:12
446 [openbsd-compat/glob.c]
447 unused arg in internal static API
0af8cee7 448 - jakob@cvs.openbsd.org 2007/10/11 18:36:41
d6f5019c 449 [openbsd-compat/getrrsetbyname.c openbsd-compat/getrrsetbyname.h]
0af8cee7 450 use RRSIG instead of SIG for DNSSEC. ok djm@
a9733dc0 451 - otto@cvs.openbsd.org 2006/10/21 09:55:03
452 [openbsd-compat/base64.c]
453 remove calls to abort(3) that can't happen anyway; from
454 <bret dot lambert at gmail.com>; ok millert@ deraadt@
49f7b80f 455 - frantzen@cvs.openbsd.org 2004/04/24 18:11:46
456 [openbsd-compat/sys-tree.h]
4987209d 457 sync to Niels Provos' version. avoid unused variable warning in
458 RB_NEXT()
49f7b80f 459 - tdeval@cvs.openbsd.org 2004/11/24 18:10:42
460 [openbsd-compat/sys-tree.h]
461 typo
e271997a 462 - grange@cvs.openbsd.org 2004/05/04 16:59:32
463 [openbsd-compat/sys-queue.h]
464 Remove useless ``elm'' argument from the SIMPLEQ_REMOVE_HEAD macro.
465 This matches our SLIST behaviour and NetBSD's SIMPLEQ as well.
466 ok millert krw deraadt
d0f02ff0 467 - deraadt@cvs.openbsd.org 2005/02/25 13:29:30
468 [openbsd-compat/sys-queue.h]
469 minor white spacing
2d67e48d 470 - otto@cvs.openbsd.org 2005/10/17 20:19:42
471 [openbsd-compat/sys-queue.h]
472 Performing certain operations on queue.h data structurs produced
473 funny results. An example is calling LIST_REMOVE on the same
474 element twice. This will not fail, but result in a data structure
475 referencing who knows what. Prevent these accidents by NULLing some
476 fields on remove and replace. This way, either a panic or segfault
477 will be produced on the faulty operation.
95760c2a 478 - otto@cvs.openbsd.org 2005/10/24 20:25:14
479 [openbsd-compat/sys-queue.h]
480 Partly backout. NOLIST, used in LISTs is probably interfering.
481 requested by deraadt@
5fda41d4 482 - otto@cvs.openbsd.org 2005/10/25 06:37:47
483 [openbsd-compat/sys-queue.h]
484 Some uvm problem is being exposed with the more strict macros.
485 Revert until we've found out what's causing the panics.
c7215802 486 - otto@cvs.openbsd.org 2005/11/25 08:06:25
487 [openbsd-compat/sys-queue.h]
488 Introduce debugging aid for queue macros. Disabled by default; but
489 developers are encouraged to run with this enabled.
490 ok krw@ fgsch@ deraadt@
9a35f8ed 491 - otto@cvs.openbsd.org 2007/04/30 18:42:34
492 [openbsd-compat/sys-queue.h]
493 Enable QUEUE_MACRO_DEBUG on DIAGNOSTIC kernels.
494 Input and okays from krw@, millert@, otto@, deraadt@, miod@.
5f762762 495 - millert@cvs.openbsd.org 2004/10/07 16:56:11
496 GLOB_NOESCAPE is POSIX so move it out of the #ifndef _POSIX_SOURCE
497 block.
498 (NB. mostly an RCS ID sync, as portable strips out the conditionals)
a556beb5 499 - (djm) [regress/sftp-cmds.sh]
500 Use more restrictive glob to pick up test files from /bin - some platforms
501 ship broken symlinks there which could spoil the test.
882d4fb0 502 - (djm) [openbsd-compat/bindresvport.c]
503 Sync RCS ID after irrelevant (for portable OpenSSH) header shuffling
530c2ec0 504
8aa5db7d 50520070927
506 - (dtucker) [configure.ac atomicio.c] Fall back to including <sys/poll.h> if
507 we don't have <poll.h> (eq QNX). From bacon at cs nyu edu.
86996ebe 508 - (dtucker) [configure.ac defines.h] Shadow expiry does not work on QNX6
509 so disable it for that platform. From bacon at cs nyu edu.
8aa5db7d 510
9e994eff 51120070921
512 - (djm) [atomicio.c] Fix spin avoidance for platforms that define
513 EWOULDBLOCK; patch from ben AT psc.edu
514
590c0dda 51520070917
516 - (djm) OpenBSD CVS Sync
517 - djm@cvs.openbsd.org 2007/08/23 02:49:43
518 [auth-passwd.c auth.c session.c]
519 unifdef HAVE_LOGIN_CAP; ok deraadt@ millert@
520 NB. RCS ID sync only for portable
466143fd 521 - djm@cvs.openbsd.org 2007/08/23 02:55:51
522 [auth-passwd.c auth.c session.c]
523 missed include bits from last commit
524 NB. RCS ID sync only for portable
2aa63b7b 525 - djm@cvs.openbsd.org 2007/08/23 03:06:10
526 [auth.h]
527 login_cap.h doesn't belong here
528 NB. RCS ID sync only for portable
ba8cfba6 529 - djm@cvs.openbsd.org 2007/08/23 03:22:16
530 [auth2-none.c sshd_config sshd_config.5]
531 Support "Banner=none" to disable displaying of the pre-login banner;
532 ok dtucker@ deraadt@
3af8ef1e 533 - djm@cvs.openbsd.org 2007/08/23 03:23:26
534 [sshconnect.c]
535 Execute ProxyCommands with $SHELL rather than /bin/sh unconditionally
8de7aaab 536 - djm@cvs.openbsd.org 2007/09/04 03:21:03
537 [clientloop.c monitor.c monitor_fdpass.c monitor_fdpass.h]
538 [monitor_wrap.c ssh.c]
539 make file descriptor passing code return an error rather than call fatal()
540 when it encounters problems, and use this to make session multiplexing
541 masters survive slaves failing to pass all stdio FDs; ok markus@
71300a43 542 - djm@cvs.openbsd.org 2007/09/04 11:15:56
543 [ssh.c sshconnect.c sshconnect.h]
544 make ssh(1)'s ConnectTimeout option apply to both the TCP connection and
545 SSH banner exchange (previously it just covered the TCP connection).
546 This allows callers of ssh(1) to better detect and deal with stuck servers
547 that accept a TCP connection but don't progress the protocol, and also
548 makes ConnectTimeout useful for connections via a ProxyCommand;
549 feedback and "looks ok" markus@
269cfc8a 550 - sobrado@cvs.openbsd.org 2007/09/09 11:38:01
551 [ssh-add.c ssh-agent.1 ssh-agent.c ssh-keygen.c]
552 sort synopsis and options in ssh-agent(1); usage is lowercase
553 ok jmc@
39fa9566 554 - stevesk@cvs.openbsd.org 2007/09/11 04:36:29
555 [sshpty.c]
556 sort #include
557 NB. RCS ID sync only
b05117ac 558 - gilles@cvs.openbsd.org 2007/09/11 15:47:17
559 [session.c ssh-keygen.c sshlogin.c]
560 use strcspn to properly overwrite '\n' in fgets returned buffer
561 ok pyr@, ray@, millert@, moritz@, chl@
f119adf5 562 - stevesk@cvs.openbsd.org 2007/09/11 23:49:09
563 [sshpty.c]
564 remove #if defined block not needed; ok markus@ dtucker@
565 NB. RCS ID sync only
7cfacf5e 566 - stevesk@cvs.openbsd.org 2007/09/12 19:39:19
567 [umac.c]
568 use xmalloc() and xfree(); ok markus@ pvalchev@
f8f7ecf5 569 - djm@cvs.openbsd.org 2007/09/13 04:39:04
570 [sftp-server.c]
571 fix incorrect test when setting syslog facility; from Jan Pechanec
9e7f4c4f 572 - djm@cvs.openbsd.org 2007/09/16 00:55:52
573 [sftp-client.c]
574 use off_t instead of u_int64_t for file offsets, matching what the
575 progressmeter code expects; bz #842
7bf7b86c 576 - (tim) [defines.h] Fix regression in long password support on OpenServer 6.
577 Problem report and additional testing rac AT tenzing.org.
590c0dda 578
e5fe7821 57920070914
580 - (dtucker) [openbsd-compat/bsd-asprintf.c] Plug mem leak in error path.
581 Patch from Jan.Pechanec at sun com.
582
822e80ce 58320070910
584 - (dtucker) [openbsd-compat/regress/closefromtest.c] Bug #1358: Always
585 return 0 on successful test. From David.Leonard at quest com.
d837615a 586 - (tim) [configure.ac] Autoconf didn't define HAVE_LIBIAF because we
587 did a AC_CHECK_FUNCS within the AC_CHECK_LIB test.
822e80ce 588
145707ab 58920070817
590 - (dtucker) [sshd.8] Many Linux variants use a single "!" to denote locked
591 accounts and that's what the code looks for, so make man page and code
592 agree. Pointed out by Roumen Petrov.
85eed7c2 593 - (dtucker) [INSTALL] Group the parts describing random options and PAM
594 implementations together which is hopefully more coherent.
3d1d89ea 595 - (dtucker) [INSTALL] the pid file is sshd.pid not ssh.pid.
49f63a45 596 - (dtucker) [INSTALL] Give PAM its own heading.
3c4db087 597 - (dtucker) [INSTALL] Link to tcpwrappers.
145707ab 598
8d5728b7 59920070816
600 - (dtucker) [session.c] Call PAM cleanup functions for unauthenticated
601 connections too. Based on a patch from Sandro Wefel, with & ok djm@
602
ed64eeca 60320070815
604 - (dtucker) OpenBSD CVS Sync
605 - markus@cvs.openbsd.org 2007/08/15 08:14:46
606 [clientloop.c]
607 do NOT fall back to the trused x11 cookie if generation of an untrusted
9c36d7f7 608 cookie fails; from Jan Pechanec, via security-alert at sun.com;
609 ok dtucker
3f921d0e 610 - markus@cvs.openbsd.org 2007/08/15 08:16:49
611 [version.h]
612 openssh 4.7
1ce8114b 613 - stevesk@cvs.openbsd.org 2007/08/15 12:13:41
614 [ssh_config.5]
615 tun device forwarding now honours ExitOnForwardFailure; ok markus@
06d20497 616 - (dtucker) [openbsd-compat/bsd-cray.c] Remove debug from signal handler.
617 ok djm@
4671cc21 618 - (dtucker) [README contrib/caldera/openssh.spec contrib/redhat/openssh.spec
619 contrib/suse/openssh.spec] Crank version.
ed64eeca 620
265edd5e 62120070813
622 - (dtucker) [session.c] Bug #1339: ensure that pam_setcred() is always
623 called with PAM_ESTABLISH_CRED at least once, which resolves a problem
624 with pam_dhkeys. Patch from David Leonard, ok djm@
625
6b3e6430 62620070810
627 - (dtucker) [auth-pam.c] Use sigdie here too. ok djm@
575ee4c4 628 - (dtucker) [configure.ac] Bug #1343: Set DISABLE_FD_PASSING for QNX6. From
629 Matt Kraai, ok djm@
6b3e6430 630
86c718e3 63120070809
632 - (dtucker) [openbsd-compat/port-aix.c] Comment typo.
549d7c4d 633 - (dtucker) [README.platform] Document the interaction between PermitRootLogin
634 and the AIX native login restrictions.
929a784c 635 - (dtucker) [defines.h] Remove _PATH_{CSHELL,SHELLS} which aren't
636 used anywhere and are a potential source of warnings.
86c718e3 637
1b73b60e 63820070808
639 - (djm) OpenBSD CVS Sync
640 - ray@cvs.openbsd.org 2007/07/12 05:48:05
641 [key.c]
642 Delint: remove some unreachable statements, from Bret Lambert.
643 OK markus@ and dtucker@.
d0ac0d65 644 - sobrado@cvs.openbsd.org 2007/08/06 19:16:06
645 [scp.1 scp.c]
646 the ellipsis is not an optional argument; while here, sync the usage
647 and synopsis of commands
648 lots of good ideas by jmc@
649 ok jmc@
79303c5a 650 - djm@cvs.openbsd.org 2007/08/07 07:32:53
651 [clientloop.c clientloop.h ssh.c]
652 bz#1232: ensure that any specified LocalCommand is executed after the
653 tunnel device is opened. Also, make failures to open a tunnel device
654 fatal when ExitOnForwardFailure is active.
655 Reported by h.goebel AT goebel-consult.de; ok dtucker markus reyk deraadt
1b73b60e 656
af12bf9c 65720070724
658 - (tim) [openssh.xml.in] make FMRI match what package scripts use.
87f560bb 659 - (tim) [openbsd-compat/regress/closefromtest.c] Bug 1345: fix open() call.
25c1216a 660 Report/patch by David.Leonard AT quest.com (and Bernhard Simon)
5498741c 661 - (tim) [buildpkg.sh.in openssh.xml.in] Allow more flexibility where smf(5)
a817bc2b 662 - (tim) [buildpkg.sh.in] s|$FAKE_ROOT/${sysconfdir}|$FAKE_ROOT${sysconfdir}|
af12bf9c 663
665ca996 66420070628
665 - (djm) bz#1325: Fix SELinux in permissive mode where it would
666 incorrectly fatal() on errors. patch from cjwatson AT debian.org;
667 ok dtucker
668
91044296 66920070625
670 - (dtucker) OpenBSD CVS Sync
671 - djm@cvs.openbsd.org 2007/06/13 00:21:27
672 [scp.c]
673 don't ftruncate() non-regular files; bz#1236 reported by wood AT
674 xmission.com; ok dtucker@
2c505585 675 - djm@cvs.openbsd.org 2007/06/14 21:43:25
676 [ssh.c]
677 handle EINTR when waiting for mux exit status properly
50455824 678 - djm@cvs.openbsd.org 2007/06/14 22:48:05
679 [ssh.c]
680 when waiting for the multiplex exit status, read until the master end
681 writes an entire int of data *and* closes the client_fd; fixes mux
682 regression spotted by dtucker, ok dtucker@
5a5e8b42 683 - djm@cvs.openbsd.org 2007/06/19 02:04:43
684 [atomicio.c]
685 if the fd passed to atomicio/atomiciov() is non blocking, then poll() to
686 avoid a spin if it is not yet ready for reading/writing; ok dtucker@
d9245683 687 - dtucker@cvs.openbsd.org 2007/06/25 08:20:03
688 [channels.c]
689 Correct test for window updates every three packets; prevents sending
690 window updates for every single packet. ok markus@
12ae19b0 691 - dtucker@cvs.openbsd.org 2007/06/25 12:02:27
692 [atomicio.c]
693 Include <poll.h> like the man page says rather than <sys/poll.h>. ok djm@
15aaadea 694 - (dtucker) [atomicio.c] Test for EWOULDBLOCK in atomiciov to match
695 atomicio.
6d39a5c4 696 - (dtucker) [atomicio.c configure.ac openbsd-compat/Makefile.in
697 openbsd-compat/bsd-poll.{c,h} openbsd-compat/openbsd-compat.h]
698 Add an implementation of poll() built on top of select(2). Code from
699 OpenNTPD with changes suggested by djm. ok djm@
91044296 700
cc43e894 70120070614
702 - (dtucker) [cipher-ctr.c umac.c openbsd-compat/openssl-compat.h] Move the
703 USE_BUILTIN_RIJNDAEL compat goop to openssl-compat.h so it can be
704 shared with umac.c. Allows building with OpenSSL 0.9.5 again including
705 umac support. With tim@ djm@, ok djm.
bff0be25 706 - (dtucker) [openbsd-compat/openssl-compat.h] Merge USE_BUILTIN_RIJNDAEL
707 sections. Fixes builds with early OpenSSL 0.9.6 versions.
9c9c3030 708 - (dtucker) [openbsd-compat/openssl-compat.h] Remove redundant definition
709 of USE_BUILTIN_RIJNDAEL since the <0.9.6 test is covered by the
710 subsequent <0.9.7 test.
cc43e894 711
e110afc3 71220070612
713 - (dtucker) OpenBSD CVS Sync
714 - markus@cvs.openbsd.org 2007/06/11 09:14:00
715 [channels.h]
716 increase default channel windows; ok djm
8f41056c 717 - djm@cvs.openbsd.org 2007/06/12 07:41:00
718 [ssh-add.1]
719 better document ssh-add's -d option (delete identies from agent), bz#1224
720 new text based on some provided by andrewmc-debian AT celt.dias.ie;
721 ok dtucker@
73d4e9cc 722 - djm@cvs.openbsd.org 2007/06/12 08:20:00
723 [ssh-gss.h gss-serv.c gss-genr.c]
724 relocate server-only GSSAPI code from libssh to server; bz #1225
725 patch from simon AT sxw.org.uk; ok markus@ dtucker@
4634ee16 726 - djm@cvs.openbsd.org 2007/06/12 08:24:20
727 [scp.c]
728 make scp try to skip FIFOs rather than blocking when nothing is listening.
729 depends on the platform supporting sane O_NONBLOCK semantics for open
730 on FIFOs (apparently POSIX does not mandate this), which OpenBSD does.
731 bz #856; report by cjwatson AT debian.org; ok markus@
5805c516 732 - djm@cvs.openbsd.org 2007/06/12 11:11:08
733 [ssh.c]
734 fix slave exit value when a control master goes away without passing the
735 full exit status by ensuring that the slave reads a full int. bz#1261
736 reported by frekko AT gmail.com; ok markus@ dtucker@
b2f4d5cc 737 - djm@cvs.openbsd.org 2007/06/12 11:15:17
738 [ssh.c ssh.1]
739 Add "-K" flag for ssh to set GSSAPIAuthentication=yes and
740 GSSAPIDelegateCredentials=yes. This is symmetric with -k (disable GSSAPI)
741 and is useful for hosts with /home on Kerberised NFS; bz #1312
742 patch from Markus.Kuhn AT cl.cam.ac.uk; ok dtucker@ markus@
6b34f31f 743 - djm@cvs.openbsd.org 2007/06/12 11:45:27
744 [ssh.c]
745 improved exit message from multiplex slave sessions; bz #1262
746 reported by alexandre.nunes AT gmail.com; ok dtucker@
dc1c8785 747 - dtucker@cvs.openbsd.org 2007/06/12 11:56:15
748 [gss-genr.c]
749 Pass GSS OID to gss_display_status to provide better information in
750 error messages. Patch from Simon Wilkinson via bz 1220. ok djm@
c159f720 751 - jmc@cvs.openbsd.org 2007/06/12 13:41:03
752 [ssh-add.1]
753 identies -> identities;
3c6a67c2 754 - jmc@cvs.openbsd.org 2007/06/12 13:43:55
755 [ssh.1]
756 add -K to SYNOPSIS;
5be98986 757 - dtucker@cvs.openbsd.org 2007/06/12 13:54:28
758 [scp.c]
759 Encode filename with strnvis if the name contains a newline (which can't
760 be represented in the scp protocol), from bz #891. ok markus@
e110afc3 761
bd6a1355 76220070611
763 - (djm) Bugzilla #1306: silence spurious error messages from hang-on-exit
764 fix; tested by dtucker@ and jochen.kirn AT gmail.com
f444d0f8 765 - pvalchev@cvs.openbsd.org 2007/06/07 19:37:34
766 [kex.h mac.c mac.h monitor_wrap.c myproposal.h packet.c ssh.1]
767 [ssh_config.5 sshd.8 sshd_config.5]
768 Add a new MAC algorithm for data integrity, UMAC-64 (not default yet,
769 must specify umac-64@openssh.com). Provides about 20% end-to-end speedup
770 compared to hmac-md5. Represents a different approach to message
771 authentication to that of HMAC that may be beneficial if HMAC based on
772 one of its underlying hash algorithms is found to be vulnerable to a
773 new attack. http://www.ietf.org/rfc/rfc4418.txt
774 in conjunction with and OK djm@
c22b0835 775 - pvalchev@cvs.openbsd.org 2007/06/08 04:40:40
776 [ssh_config]
777 Add a "MACs" line after "Ciphers" with the default MAC algorithms,
778 to ease people who want to tweak both (eg. for performance reasons).
779 ok deraadt@ djm@ dtucker@
bbc77085 780 - jmc@cvs.openbsd.org 2007/06/08 07:43:46
781 [ssh_config.5]
782 put the MAC list into a display, like we do for ciphers,
783 since groff has trouble handling wide lines;
33d2ae0f 784 - jmc@cvs.openbsd.org 2007/06/08 07:48:09
785 [sshd_config.5]
786 oops, here too: put the MAC list into a display, like we do for
787 ciphers, since groff has trouble with wide lines;
68a73f53 788 - markus@cvs.openbsd.org 2007/06/11 08:04:44
789 [channels.c]
790 send 'window adjust' messages every tree packets and do not wait
791 until 50% of the window is consumed. ok djm dtucker
1aac2117 792 - (djm) [configure.ac umac.c] If platform doesn't provide swap32(3), then
793 fallback to provided bit-swizzing functions
aee0a82f 794 - (dtucker) [openbsd-compat/bsd-misc.c] According to the spec the "remainder"
795 argument to nanosleep may be NULL. Currently this never happens in OpenSSH,
796 but check anyway in case this changes or the code gets used elsewhere.
e9b2809d 797 - (dtucker) [includes.h] Bug #1243: HAVE_PATHS -> HAVE_PATHS_H. Should
798 prevent warnings about redefinitions of various things in paths.h.
799 Spotted by cartmanltd at hotmail.com.
c22b0835 800
c33de4d8 80120070605
802 - (dtucker) OpenBSD CVS Sync
803 - djm@cvs.openbsd.org 2007/05/22 10:18:52
804 [sshd.c]
805 zap double include; from p_nowaczyk AT o2.pl
806 (not required in -portable, Id sync only)
68525040 807 - djm@cvs.openbsd.org 2007/05/30 05:58:13
808 [kex.c]
809 tidy: KNF, ARGSUSED and u_int
e473dcd1 810 - jmc@cvs.openbsd.org 2007/05/31 19:20:16
811 [scp.1 ssh_config.5 sftp-server.8 ssh-agent.1 sshd_config.5 sftp.1
812 ssh-keygen.1 ssh-keyscan.1 ssh-add.1 sshd.8 ssh.1 ssh-keysign.8]
813 convert to new .Dd format;
814 (We will need to teach mdoc2man.awk to understand this too.)
d156cd22 815 - djm@cvs.openbsd.org 2007/05/31 23:34:29
816 [packet.c]
817 gc unreachable code; spotted by Tavis Ormandy
996279fc 818 - djm@cvs.openbsd.org 2007/06/02 09:04:58
819 [bufbn.c]
820 memory leak on error path; from arnaud.lacombe.1 AT ulaval.ca
a3de8da1 821 - djm@cvs.openbsd.org 2007/06/05 06:52:37
822 [kex.c monitor_wrap.c packet.c mac.h kex.h mac.c]
823 Preserve MAC ctx between packets, saving 2xhash calls per-packet.
824 Yields around a 12-16% end-to-end speedup for arcfour256/hmac-md5
825 patch from markus@ tested dtucker@ and myself, ok markus@ and me (I'm
826 committing at his request)
f43b2695 827 - (dtucker) [mdoc2man.awk] Teach it to deal with $Mdocdate tags that
828 OpenBSD's cvs now adds.
8c5a3b27 829 - (dtucker) [mdoc2man.awk] Remove trailing "$" from Mdocdate regex so
830 mindrot's cvs doesn't expand it on us.
757841b2 831 - (dtucker) [mdoc2man.awk] Add support for %R references, used for RFCs.
c33de4d8 832
2e5c9c30 83320070520
834 - (dtucker) OpenBSD CVS Sync
835 - stevesk@cvs.openbsd.org 2007/04/14 22:01:58
836 [auth2.c]
837 remove unused macro; from Dmitry V. Levin <ldv@altlinux.org>
23983bf9 838 - stevesk@cvs.openbsd.org 2007/04/18 01:12:43
839 [sftp-server.c]
840 cast "%llu" format spec to (unsigned long long); do not assume a
841 u_int64_t arg is the same as 'unsigned long long'.
842 from Dmitry V. Levin <ldv@altlinux.org>
843 ok markus@ 'Yes, that looks correct' millert@
51b787f2 844 - dtucker@cvs.openbsd.org 2007/04/23 10:15:39
845 [servconf.c]
846 Remove debug() left over from development. ok deraadt@
7ce05acc 847 - djm@cvs.openbsd.org 2007/05/17 07:50:31
848 [log.c]
849 save and restore errno when logging; ok deraadt@
72dea2d9 850 - djm@cvs.openbsd.org 2007/05/17 07:55:29
851 [sftp-server.c]
852 bz#1286 stop reading and processing commands when input or output buffer
853 is nearly full, otherwise sftp-server would happily try to grow the
854 input/output buffers past the maximum supported by the buffer API and
855 promptly fatal()
856 based on patch from Thue Janus Kristensen; feedback & ok dtucker@
7fd1deb2 857 - djm@cvs.openbsd.org 2007/05/17 20:48:13
858 [sshconnect2.c]
859 fall back to gethostname() when the outgoing connection is not
860 on a socket, such as is the case when ProxyCommand is used.
861 Gives hostbased auth an opportunity to work; bz#616, report
862 and feedback stuart AT kaloram.com; ok markus@
21cd42db 863 - djm@cvs.openbsd.org 2007/05/17 20:52:13
864 [monitor.c]
865 pass received SIGINT from monitor to postauth child so it can clean
866 up properly. bz#1196, patch from senthilkumar_sen AT hotpop.com;
867 ok markus@
b2349766 868 - jolan@cvs.openbsd.org 2007/05/17 23:53:41
869 [sshconnect2.c]
870 djm owes me a vb and a tism cd for breaking ssh compilation
fd8f181b 871 - (dtucker) [auth-pam.c] malloc+memset -> calloc. Patch from
872 ldv at altlinux.org.
e2dedae7 873 - (dtucker) [auth-pam.c] Return empty string if fgets fails in
874 sshpam_tty_conv. Patch from ldv at altlinux.org.
2e5c9c30 875
40701614 87620070509
877 - (tim) [configure.ac] Bug #1287: Add missing test for ucred.h.
878
65737b47 87920070429
880 - (dtucker) [openbsd-compat/bsd-misc.c] Include unistd.h and sys/types.h
881 for select(2) prototype.
e5b792cd 882 - (dtucker) [auth-shadow.c loginrec.c] Include time.h for time(2) prototype.
560acf80 883 - (dtucker) [configure.ac openbsd-compat/getrrsetbyname.c] Bug #1299: Use the
884 platform's _res if it has one. Should fix problem of DNSSEC record lookups
885 on NetBSD as reported by Curt Sampson.
81fa3f37 886 - (dtucker) [openbsd-compat/xmmap.c] Include stdlib.h for mkstemp prototype.
0bf6279d 887 - (dtucker) [configure.ac defines.h] Have configure check for MAXSYMLINKS
888 so we don't get redefinition warnings.
0b9fdeb8 889 - (dtucker) [openbsd-compat/xmmap.c] Include stdlib.h for mkstemp prototype.
890 - (dtucker) [configure.ac defines.h] Prevent warnings about __attribute__
891 __nonnull__ for versions of GCC that don't support it.
b41ece30 892 - (dtucker) [configure.ac defines.h] Have configure check for offsetof
893 to prevent redefinition warnings.
0b9fdeb8 894
6b44d402 89520070406
896 - (dtucker) [INSTALL] Update the systems that have PAM as standard. Link
897 to OpenPAM too.
e5d352eb 898 - (dtucker) [INSTALL] prngd lives at sourceforge these days.
6b44d402 899
a03acb8f 90020070326
901 - (tim) [auth.c configure.ac defines.h session.c openbsd-compat/port-uw.c
902 openbsd-compat/port-uw.h openbsd-compat/xcrypt.c] Rework libiaf test/defines
903 to account for IRIX having libiaf but not set_id(). Patch with & ok dtucker@
904
e54defb4 90520070325
906 - (dtucker) [Makefile.in configure.ac] Replace single-purpose LIBSELINUX,
907 LIBWRAP and LIBPAM variables in Makefile with the general-purpose
908 SSHDLIBS. "I like" djm@
909
136d42b7 91020070321
911 - (dtucker) OpenBSD CVS Sync
912 - dtucker@cvs.openbsd.org 2007/03/09 05:20:06
913 [servconf.c sshd.c]
914 Move C/R -> kbdint special case to after the defaults have been
915 loaded, which makes ChallengeResponse default to yes again. This
916 was broken by the Match changes and not fixed properly subsequently.
917 Found by okan at demirmen.com, ok djm@ "please do it" deraadt@
e93309c3 918 - djm@cvs.openbsd.org 2007/03/19 01:01:29
919 [sshd_config]
920 Disable the legacy SSH protocol 1 for new installations via
921 a configuration override. In the future, we will change the
922 server's default itself so users who need the legacy protocol
923 will need to turn it on explicitly
7f38e62e 924 - dtucker@cvs.openbsd.org 2007/03/19 12:16:42
925 [ssh-agent.c]
926 Remove the signal handler that checks if the agent's parent process
927 has gone away, instead check when the select loop returns. Record when
928 the next key will expire when scanning for expired keys. Set the select
929 timeout to whichever of these two things happens next. With djm@, with &
930 ok deraadt@ markus@
f48fbab3 931 - tedu@cvs.openbsd.org 2007/03/20 03:56:12
932 [readconf.c clientloop.c]
933 remove some bogus *p tests from charles longeau
934 ok deraadt millert
82029813 935 - jmc@cvs.openbsd.org 2007/03/20 15:57:15
936 [sshd.8]
937 - let synopsis and description agree for -f
938 - sort FILES
939 - +.Xr ssh-keyscan 1 ,
940 from Igor Sobrado
1961d660 941 - (dtucker) [configure.ac openbsd-compat/bsd-getpeereid.c] Bug #1287: Use
942 getpeerucred to implement getpeereid (currently only Solaris 10 and up).
943 Patch by Jan.Pechanec at Sun.
aee1c971 944 - (dtucker) [regress/agent-getpeereid.sh] Do peereid test if we have
945 HAVE_GETPEERUCRED too. Also from Jan Pechanec.
136d42b7 946
fce809d2 94720070313
948 - (dtucker) [entropy.c scard-opensc.c ssh-rand-helper.c] Bug #1294: include
949 string.h to prevent warnings, from vapier at gentoo.org.
5425009d 950 - (dtucker) [LICENCE] Add Daniel Walsh as a copyright holder for the
951 selinux bits in -portable.
ab26a796 952 - (dtucker) [cipher-3des1.c cipher-bf1.c] The OpenSSL 0.9.8e problem in
953 bug #1291 also affects Protocol 1 3des. While at it, use compat-openssl.h
954 in cipher-bf1.c. Patch from Juan Gallego.
76ef2ed2 955 - (dtucker) [README.platform] Info about blibpath on AIX.
fce809d2 956
a863b75f 95720070306
958 - (djm) OpenBSD CVS Sync
959 - jmc@cvs.openbsd.org 2007/03/01 16:19:33
960 [sshd_config.5]
961 sort the `match' keywords;
95d6e8af 962 - djm@cvs.openbsd.org 2007/03/06 10:13:14
963 [version.h]
964 openssh-4.6; "please" deraadt@
0a052bfe 965 - (djm) [contrib/caldera/openssh.spec contrib/redhat/openssh.spec]
966 [contrib/suse/openssh.spec] crank spec files for release
9b86b75a 967 - (djm) [README] correct link to release notes
68ff14ce 968 - (djm) Release 4.6p1
a863b75f 969
1d42bcce 97020070304
971 - (djm) [configure.ac] add a --without-openssl-header-check option to
972 configure, as some platforms (OS X) ship OpenSSL headers whose version
973 does not match that of the shipping library. ok dtucker@
190d9b26 974 - (dtucker) [openbsd-compat/openssl-compat.h] Bug #1291: Work around a
975 bug in OpenSSL 0.9.8e that prevents aes256-ctr, aes192-ctr and arcfour256
976 ciphers from working correctly (disconnects with "Bad packet length"
977 errors) as found by Ben Harris. ok djm@
1d42bcce 978
f0bbbd78 97920070303
980 - (dtucker) [regress/agent-ptrace.sh] Make ttrace gdb error a little more
981 general to cover newer gdb versions on HP-UX.
982
04765d02 98320070302
984 - (dtucker) [configure.ac] For Cygwin, read files in textmode (which allows
985 CRLF as well as LF lineendings) and write in binary mode. Patch from
986 vinschen at redhat.com.
2769e5d0 987 - (dtucker) [INSTALL] Update to autoconf-2.61.
04765d02 988
121c4a34 98920070301
990 - (dtucker) OpenBSD CVS Sync
991 - dtucker@cvs.openbsd.org 2007/03/01 10:28:02
992 [auth2.c sshd_config.5 servconf.c]
993 Remove ChallengeResponseAuthentication support inside a Match
994 block as its interaction with KbdInteractive makes it difficult to
995 support. Also, relocate the CR/kbdint option special-case code into
996 servconf. "please commit" djm@, ok markus@ for the relocation.
840bd607 997 - (tim) [buildpkg.sh.in openssh.xml.in] Clean up Solaris 10 smf(5) bits.
998 "Looks sane" dtucker@
121c4a34 999
f10f9102 100020070228
1001 - (dtucker) OpenBSD CVS Sync
1002 - dtucker@cvs.openbsd.org 2007/02/28 00:55:30
1003 [ssh-agent.c]
1004 Remove expired keys periodically so they don't remain in memory when
1005 the agent is entirely idle, as noted by David R. Piegdon. This is the
1006 simple fix, a more efficient one will be done later. With markus,
1007 deraadt, with & ok djm.
1008
88ea6a3c 100920070225
1010 - (dtucker) OpenBSD CVS Sync
1011 - djm@cvs.openbsd.org 2007/02/20 10:25:14
1012 [clientloop.c]
1013 set maximum packet and window sizes the same for multiplexed clients
1014 as normal connections; ok markus@
1e823acf 1015 - dtucker@cvs.openbsd.org 2007/02/21 11:00:05
1016 [sshd.c]
1017 Clear alarm() before restarting sshd on SIGHUP. Without this, if there's
1018 a SIGALRM pending (for SSH1 key regeneration) when sshd is SIGHUP'ed, the
1019 newly exec'ed sshd will get the SIGALRM and not have a handler for it,
1020 and the default action will terminate the listening sshd. Analysis and
1021 patch from andrew at gaul.org.
f3e3d6ce 1022 - dtucker@cvs.openbsd.org 2007/02/22 12:58:40
1023 [servconf.c]
1024 Check activep so Match and GatewayPorts work together; ok markus@
8c1cb72e 1025 - ray@cvs.openbsd.org 2007/02/24 03:30:11
1026 [moduli.c]
1027 - strlen returns size_t, not int.
1028 - Pass full buffer size to fgets.
1029 OK djm@, millert@, and moritz@.
88ea6a3c 1030
5792fbb7 103120070219
1032 - (dtucker) OpenBSD CVS Sync
1033 - jmc@cvs.openbsd.org 2007/01/10 13:23:22
1034 [ssh_config.5]
1035 do not use a list for SYNOPSIS;
1036 this is actually part of a larger report sent by eric s. raymond
1037 and forwarded by brad, but i only read half of it. spotted by brad.
e91a8c3f 1038 - jmc@cvs.openbsd.org 2007/01/12 20:20:41
1039 [ssh-keygen.1 ssh-keygen.c]
1040 more secsh -> rfc 4716 updates;
1041 spotted by wiz@netbsd
1042 ok markus
70b5e752 1043 - dtucker@cvs.openbsd.org 2007/01/17 23:22:52
1044 [readconf.c]
1045 Honour activep for times (eg ServerAliveInterval) while parsing
1046 ssh_config and ~/.ssh/config so they work properly with Host directives.
1047 From mario.lorenz@wincor-nixdorf.com via bz #1275. ok markus@
1048 - stevesk@cvs.openbsd.org 2007/01/21 01:41:54
1049 [auth-skey.c kex.c ssh-keygen.c session.c clientloop.c]
1050 spaces
0cf6a024 1051 - stevesk@cvs.openbsd.org 2007/01/21 01:45:35
1052 [readconf.c]
1053 spaces
e4d5ca17 1054 - djm@cvs.openbsd.org 2007/01/22 11:32:50
1055 [sftp-client.c]
1056 return error from do_upload() when a write fails. fixes bz#1252: zero
1057 exit status from sftp when uploading to a full device. report from
1058 jirkat AT atlas.cz; ok dtucker@
7df0afaf 1059 - djm@cvs.openbsd.org 2007/01/22 13:06:21
1060 [scp.c]
1061 fix detection of whether we should show progress meter or not: scp
1062 tested isatty(stderr) but wrote the progress meter to stdout. This patch
1063 makes it test stdout. bz#1265 reported by junkmail AT bitsculpture.com;
1064 of dtucker@
1b313731 1065 - stevesk@cvs.openbsd.org 2007/02/14 14:32:00
1066 [bufbn.c]
1067 typos in comments; ok jmc@
03bcbf84 1068 - dtucker@cvs.openbsd.org 2007/02/19 10:45:58
1069 [monitor_wrap.c servconf.c servconf.h monitor.c sshd_config.5]
1070 Teach Match how handle config directives that are used before
1071 authentication. This allows configurations such as permitting password
1072 authentication from the local net only while requiring pubkey from
1073 offsite. ok djm@, man page bits ok jmc@
99d804ce 1074 - (dtucker) [contrib/findssl.sh] Add "which" as a shell function since some
1075 platforms don't have it. Patch from dleonard at vintela.com.
56a6f96f 1076 - (dtucker) [openbsd-compat/getrrsetbyname.c] Don't attempt to calloc
1077 an array for signatures when there are none since "calloc(0, n) returns
1078 NULL on some platforms (eg Tru64), which is explicitly permitted by
1079 POSIX. Diagnosis and patch by svallet genoscope.cns.fr.
5792fbb7 1080
34640ce6 108120070128
1082 - (djm) [channels.c serverloop.c] Fix so-called "hang on exit" (bz #52)
1083 when closing a tty session when a background process still holds tty
1084 fds open. Great detective work and patch by Marc Aurele La France,
1085 slightly tweaked by me; ok dtucker@
1086
4b478cc5 108720070123
1088 - (dtucker) [openbsd-compat/bsd-snprintf.c] Static declarations for public
1089 library interfaces aren't very helpful. Fix up the DOPR_OUTCH macro
1090 so it works properly and modify its callers so that they don't pre or
1091 post decrement arguments that are conditionally evaluated. While there,
1092 put SNPRINTF_CONST back as it prevents build failures in some
1093 configurations. ok djm@ (for most of it)
1094
ed9b5e5f 109520070122
1096 - (djm) [ssh-rand-helper.8] manpage nits;
1097 from dleonard AT vintela.com (bz#1529)
1098
25bd7a2a 109920070117
1100 - (dtucker) [packet.c] Re-remove in_systm.h since it's already in includes.h
1101 and multiple including it causes problems on old IRIXes. (It snuck back
1102 in during a sync.) Found (again) by Georg Schwarz.
1103
b05ff3f5 110420070114
7ac507d4 1105 - (dtucker) [ssh-keygen.c] av -> argv to match earlier sync.
0d00c5cb 1106 - (djm) [openbsd-compat/bsd-snprintf.c] Fix integer overflow in return
1107 value of snprintf replacement, similar to bugs in various libc
1108 implementations. This overflow is not exploitable in OpenSSH.
1109 While I'm fiddling with it, make it a fair bit faster by inlining the
1110 append-char routine; ok dtucker@
b05ff3f5 1111
4b4810d4 111220070105
1113 - (djm) OpenBSD CVS Sync
1114 - deraadt@cvs.openbsd.org 2006/11/14 19:41:04
1115 [ssh-keygen.c]
1116 use argc and argv not some made up short form
ce4cf693 1117 - ray@cvs.openbsd.org 2006/11/23 01:35:11
1118 [misc.c sftp.c]
1119 Don't access buf[strlen(buf) - 1] for zero-length strings.
1120 ``ok by me'' djm@.
4e3c0053 1121 - markus@cvs.openbsd.org 2006/12/11 21:25:46
1122 [ssh-keygen.1 ssh.1]
1123 add rfc 4716 (public key format); ok jmc
04efe9b0 1124 - djm@cvs.openbsd.org 2006/12/12 03:58:42
1125 [channels.c compat.c compat.h]
1126 bz #1019: some ssh.com versions apparently can't cope with the
1127 remote port forwarding bind_address being a hostname, so send
1128 them an address for cases where they are not explicitly
1129 specified (wildcard or localhost bind). reported by daveroth AT
1130 acm.org; ok dtucker@ deraadt@
75b6d52c 1131 - dtucker@cvs.openbsd.org 2006/12/13 08:34:39
1132 [servconf.c]
1133 Make PermitOpen work with multiple values like the man pages says.
1134 bz #1267 with details from peter at dmtz.com, with & ok djm@
38757197 1135 - dtucker@cvs.openbsd.org 2006/12/14 10:01:14
1136 [servconf.c]
1137 Make "PermitOpen all" first-match within a block to match the way other
1138 options work. ok markus@ djm@
5d9a4204 1139 - jmc@cvs.openbsd.org 2007/01/02 09:57:25
1140 [sshd_config.5]
1141 do not use lists for SYNOPSIS;
1142 from eric s. raymond via brad
cbaa43c0 1143 - stevesk@cvs.openbsd.org 2007/01/03 00:53:38
1144 [ssh-keygen.c]
1145 remove small dead code; arnaud.lacombe.1@ulaval.ca via Coverity scan
4f6e2ba9 1146 - stevesk@cvs.openbsd.org 2007/01/03 03:01:40
1147 [auth2-chall.c channels.c dns.c sftp.c ssh-keygen.c ssh.c]
1148 spaces
c9625a42 1149 - stevesk@cvs.openbsd.org 2007/01/03 04:09:15
1150 [sftp.c]
1151 ARGSUSED for lint
9a24ac07 1152 - stevesk@cvs.openbsd.org 2007/01/03 07:22:36
1153 [sftp-server.c]
1154 spaces
4b4810d4 1155
2b563deb 115620061205
1157 - (djm) [auth.c] Fix NULL pointer dereference in fakepw(). Crash would
1158 occur if the server did not have the privsep user and an invalid user
1159 tried to login and both privsep and krb5 auth are disabled; ok dtucker@
096393b8 1160 - (djm) [bsd-asprintf.c] Better test for bad vsnprintf lengths; ok dtucker@
2b563deb 1161
d4d9db8d 116220061108
1163 - (dtucker) OpenBSD CVS Sync
1164 - markus@cvs.openbsd.org 2006/11/07 13:02:07
1165 [dh.c]
1166 BN_hex2bn returns int; from dtucker@
1167
4d02b823 116820061107
1169 - (dtucker) [sshd.c] Use privsep_pw if we have it, but only require it
1170 if we absolutely need it. Pointed out by Corinna, ok djm@
e516451d 1171 - (dtucker) OpenBSD CVS Sync
1172 - markus@cvs.openbsd.org 2006/11/06 21:25:28
1173 [auth-rsa.c kexgexc.c kexdhs.c key.c ssh-dss.c sshd.c kexgexs.c
1174 ssh-keygen.c bufbn.c moduli.c scard.c kexdhc.c sshconnect1.c dh.c rsa.c]
1175 add missing checks for openssl return codes; with & ok djm@
89916e8c 1176 - markus@cvs.openbsd.org 2006/11/07 10:31:31
1177 [monitor.c version.h]
1178 correctly check for bad signatures in the monitor, otherwise the monitor
1179 and the unpriv process can get out of sync. with dtucker@, ok djm@,
1180 dtucker@
5b296f76 1181 - (dtucker) [README contrib/{caldera,redhat,contrib}/openssh.spec] Bump
1182 versions.
4354f73b 1183 - (dtucker) Release 4.5p1.
4d02b823 1184
b8e51e81 118520061105
1186 - (djm) OpenBSD CVS Sync
1187 - otto@cvs.openbsd.org 2006/10/28 18:08:10
1188 [ssh.1]
1189 correct/expand example of usage of -w; ok jmc@ stevesk@
8e8b473c 1190 - markus@cvs.openbsd.org 2006/10/31 16:33:12
1191 [kexdhc.c kexdhs.c kexgexc.c kexgexs.c]
1192 check DH_compute_key() for -1 even if it should not happen because of
1193 earlier calls to dh_pub_is_valid(); report krahmer at suse.de; ok djm
b8e51e81 1194
8852e1d4 119520061101
1196 - (dtucker) [openbsd-compat/port-solaris.c] Bug #1255: Make only hwerr
1197 events fatal in Solaris process contract support and tell it to signal
1198 only processes in the same process group when something happens.
1199 Based on information from andrew.benham at thus.net and similar to
1200 a patch from Chad Mynhier. ok djm@
1201
1acc8e56 120220061027
1203- (djm) [auth.c] gc some dead code
1204
b3c338b7 120520061023
1206 - (djm) OpenBSD CVS Sync
1207 - ray@cvs.openbsd.org 2006/09/30 17:48:22
1208 [sftp.c]
1209 Clear errno before calling the strtol functions.
1210 From Paul Stoeber <x0001 at x dot de1 dot cc>.
1211 OK deraadt@.
fceb95fa 1212 - djm@cvs.openbsd.org 2006/10/06 02:29:19
1213 [ssh-agent.c ssh-keyscan.c ssh.c]
1214 sys/resource.h needs sys/time.h; prompted by brad@
1215 (NB. Id sync only for portable)
db6fcd65 1216 - djm@cvs.openbsd.org 2006/10/09 23:36:11
1217 [session.c]
1218 xmalloc -> xcalloc that was missed previously, from portable
1219 (NB. Id sync only for portable, obviously)
77903f77 1220 - markus@cvs.openbsd.org 2006/10/10 10:12:45
1221 [sshconnect.c]
1222 sleep before retrying (not after) since sleep changes errno; fixes
1223 pr 5250; rad@twig.com; ok dtucker djm
bd3b2cb2 1224 - markus@cvs.openbsd.org 2006/10/11 12:38:03
1225 [clientloop.c serverloop.c]
1226 exit instead of doing a blocking tcp send if we detect a client/server
1227 timeout, since the tcp sendqueue might be already full (of alive
1228 requests); ok dtucker, report mpf
cdfbded8 1229 - djm@cvs.openbsd.org 2006/10/22 02:25:50
1230 [sftp-client.c]
1231 cancel progress meter when upload write fails; ok deraadt@
0f74133a 1232 - (tim) [Makefile.in scard/Makefile.in] Add datarootdir= lines to keep
1233 autoconf 2.60 from complaining.
b3c338b7 1234
525251b0 123520061018
1236 - (dtucker) OpenBSD CVS Sync
1237 - ray@cvs.openbsd.org 2006/09/25 04:55:38
1238 [ssh-keyscan.1 ssh.1]
1239 Change "a SSH" to "an SSH". Hurray, I'm not the only one who
1240 pronounces "SSH" as "ess-ess-aich".
1241 OK jmc@ and stevesk@.
d1f7ec98 1242 - (dtucker) [sshd.c] Reshuffle storing of pw struct; prevents warnings
1243 on older versions of OS X. ok djm@
525251b0 1244
8153fef1 124520061016
1246 - (dtucker) [monitor_fdpass.c] Include sys/in.h, required for cmsg macros
1247 on older (2.0) Linuxes. Based on patch from thmo-13 at gmx de.
1248
1f231631 124920061006
1250 - (tim) [buildpkg.sh.in] Use uname -r instead of -v in OS_VER for Solaris.
1251 Differentiate between OpenServer 5 and OpenServer 6
5ba277eb 1252 - (dtucker) [configure.ac] Set put -lselinux into $LIBS while testing for
1253 SELinux functions so they're detected correctly. Patch from pebenito at
1254 gentoo.org.
b18359f6 1255 - (tim) [buildpkg.sh.in] Some systems have really limited nawk (OpenServer).
1256 Allow setting alternate awk in openssh-config.local.
1f231631 1257
aa56f760 125820061003
1259 - (tim) [configure.ac] Move CHECK_HEADERS test before platform specific
1260 section so additional platform specific CHECK_HEADER tests will work
1261 correctly. Fixes "<net/if_tap.h> on FreeBSD" problem report by des AT des.no
1262 Feedback and "seems like a good idea" dtucker@
1263
00dea73e 126420061001
1265 - (dtucker) [audit-bsm.c] Include errno.h. Pointed out by des at des.no.
1266
24b2647b 126720060929
1268 - (dtucker) [configure.ac] Bug #1239: Fix configure test for OpenSSH engine
1269 support. Patch from andrew.benham at thus net.
1270
243a64f1 127120060928
1272 - (dtucker) [entropy.c] Bug #1238: include signal.h to fix compilation error
1273 on Solaris 8 w/out /dev/random or prngd. Patch from rl at
1274 math.technion.ac.il.
1275
f0a2e834 127620060926
1277 - (dtucker) [bufaux.h] nuke bufaux.h; it's already gone from OpenBSD and not
1278 referenced any more. ok djm@
5ed1a353 1279 - (dtucker) [sftp-server.8] Resync; spotted by djm@
0eb97cdf 1280 - (dtucker) Release 4.4p1.
f0a2e834 1281
d6336595 128220060924
1283 - (tim) [configure.ac] Remove CFLAGS hack for UnixWare 1.x/2.x (added
1284 to rev 1.308) to work around broken gcc 2.x header file.
1285
530456f4 128620060923
1287 - (dtucker) [configure.ac] Bug #1234: Put opensc libs into $LIBS rather than
1288 $LDFLAGS. Patch from vapier at gentoo org.
1289
c5bca5d4 129020060922
1291 - (dtucker) [packet.c canohost.c] Include arpa/inet.h for htonl macros on
1292 some platforms (eg HP-UX 11.00). From santhi.amirta at gmail com.
1293
d3fc2aa3 129420060921
1295 - (dtucker) OpenBSD CVS Sync
1296 - otto@cvs.openbsd.org 2006/09/19 05:52:23
1297 [sftp.c]
1298 Use S_IS* macros insted of masking with S_IF* flags. The latter may
1299 have multiple bits set, which lead to surprising results. Spotted by
1300 Paul Stoeber, more to come. ok millert@ pedro@ jaredy@ djm@
a29c9898 1301 - markus@cvs.openbsd.org 2006/09/19 21:14:08
1302 [packet.c]
1303 client NULL deref on protocol error; Tavis Ormandy, Google Security Team
ffbfca72 1304 - (dtucker) [defines.h] Include unistd.h before defining getpgrp; fixes
1305 build error on Ultrix. From Bernhard Simon.
d3fc2aa3 1306
25a2779b 130720060918
1308 - (dtucker) [configure.ac] On AIX, check to see if the compiler will allow
1309 macro redefinitions, and if not, remove "-qlanglvl=ansi" from the flags.
1310 Allows build out of the box with older VAC and XLC compilers. Found by
1311 David Bronder and Bernhard Simon.
d9ed544b 1312 - (dtucker) [openbsd-compat/port-aix.{c,h}] Reduce scope of includes.
1313 Prevents macro redefinition warnings of "RDONLY".
25a2779b 1314
f0d0e025 131520060916
1316 - OpenBSD CVS Sync
1317 - djm@cvs.openbsd.org 2006/09/16 19:53:37
1318 [deattack.c deattack.h packet.c]
1319 limit maximum work performed by the CRC compensation attack detector,
1320 problem reported by Tavis Ormandy, Google Security Team;
1321 ok markus@ deraadt@
95954124 1322 - (djm) Add openssh.xml to .cvsignore and sort it
3fd7b98a 1323 - (dtucker) [auth-pam.c] Propogate TZ environment variable to PAM auth
1324 process so that any logging it does is with the right timezone. From
1325 Scott Strickler, ok djm@.
bb09a477 1326 - (dtucker) [monitor.c] Correctly handle auditing of single commands when
1327 using Protocol 1. From jhb at freebsd.
cd3e77c4 1328 - (djm) [sshd.c] Fix warning/API abuse; ok dtucker@
8e700494 1329 - (dtucker) [INSTALL] Add info about audit support.
f0d0e025 1330
29eadd7c 133120060912
1332 - (djm) [Makefile.in buildpkg.sh.in configure.ac openssh.xml.in]
1333 Support SMF in Solaris Packages if enabled by configure. Patch from
1334 Chad Mynhier, tested by dtucker@
1335
7238aaad 133620060911
1337 - (dtucker) [cipher-aes.c] Include string.h for memcpy and friends. Noted
1338 by Pekka Savola.
1339
d23046e2 134020060910
1341 - (dtucker) [contrib/aix/buildbff.sh] Ensure that perl is available.
36f36ba3 1342 - (dtucker) [configure.ac] Add -lcrypt to let DragonFly build OOTB.
d23046e2 1343
fa6edaf0 134420060909
1345 - (dtucker) [openbsd-compat/bsd-snprintf.c] Add stdarg.h.
d2f401fe 1346 - (dtucker) [contrib/aix/buildbff.sh] Always create privsep user.
16082eaa 1347 - (dtucker) [buildpkg.sh.in] Always create privsep user. ok djm@
fa6edaf0 1348
368a00c2 134920060908
1350 - (dtucker) [auth-sia.c] Add includes required for build on Tru64. Patch
1351 from Chris Adams.
a01f637d 1352 - (dtucker) [configure.ac] The BSM header test needs time.h in some cases.
368a00c2 1353
a078cbee 135420060907
1355 - (djm) [sshd.c auth.c] Set up fakepw() with privsep uid/gid, so it can
1356 be used to drop privilege to; fixes Solaris GSSAPI crash reported by
1357 Magnus Abrante; suggestion and feedback dtucker@
1358 NB. this change will require that the privilege separation user must
1359 exist on all the time, not just when UsePrivilegeSeparation=yes
5cc6ddad 1360 - (tim) [configure.ac] s/BROKEN_UPDWTMP/BROKEN_UPDWTMPX/ on SCO OSR6
4130b6f1 1361 - (dtucker) [loginrec.c] Wrap paths.h in HAVE_PATHS_H.
15367d95 1362 - (dtucker) [regress/cfgmatch.sh] stop_client is racy, so give us a better
1363 chance of winning.
a078cbee 1364
9286ecf2 136520060905
1366 - (dtucker) [configure.ac] s/AC_DEFINES/AC_DEFINE/ spotted by Roumen Petrov.
e0f3adac 1367 - (dtucker) [loginrec.c] Include paths.h for _PATH_BTMP.
9286ecf2 1368
62143a41 136920060904
1370 - (dtucker) [configure.ac] Define BROKEN_UPDWTMP on SCO OSR6 as the native
1371 updwdtmp seems to generate invalid wtmp entries. From Roger Cornelius,
1372 ok djm@
1373
752994dd 137420060903
1375 - (dtucker) [configure.ac openbsd-compat/openbsd-compat.h] Check for
1376 declaration of writev(2) and declare it ourselves if necessary. Makes
1377 the atomiciov() calls build on really old systems. ok djm@
1378
b823d0b9 137920060902
1380 - (dtucker) [openbsd-compat/port-irix.c] Add errno.h, found by Iain Morgan.
5e837c7b 1381 - (dtucker) [ssh-keyscan.c ssh-rand-helper.c ssh.c sshconnect.c
1382 openbsd-compat/bindresvport.c openbsd-compat/getrrsetbyname.c
1383 openbsd-compat/port-tun.c openbsd-compat/rresvport.c] Include <arpa/inet.h>
1384 for hton* and ntoh* macros. Required on (at least) HP-UX since we define
1385 _XOPEN_SOURCE_EXTENDED. Found by santhi.amirta at gmail com.
b823d0b9 1386
24436b92 138720060901
1388 - (djm) [audit-bsm.c audit.c auth-bsdauth.c auth-chall.c auth-pam.c]
1389 [auth-rsa.c auth-shadow.c auth-sia.c auth1.c auth2-chall.c]
1390 [auth2-gss.c auth2-kbdint.c auth2-none.c authfd.c authfile.c]
1391 [cipher-3des1.c cipher-aes.c cipher-bf1.c cipher-ctr.c clientloop.c]
1392 [dh.c dns.c entropy.c gss-serv-krb5.c gss-serv.c hostfile.c kex.c]
1393 [kexdhc.c kexdhs.c kexgexc.c kexgexs.c key.c loginrec.c mac.c]
1394 [md5crypt.c monitor.c monitor_wrap.c readconf.c rsa.c]
1395 [scard-opensc.c scard.c session.c ssh-add.c ssh-agent.c ssh-dss.c]
1396 [ssh-keygen.c ssh-keysign.c ssh-rsa.c ssh.c sshconnect.c]
aa751414 1397 [sshconnect1.c sshconnect2.c sshd.c]
24436b92 1398 [openbsd-compat/bsd-cray.c openbsd-compat/port-aix.c]
1399 [openbsd-compat/port-linux.c openbsd-compat/port-solaris.c]
1400 [openbsd-compat/port-uw.c]
1401 Lots of headers for SCO OSR6, mainly adding stdarg.h for log.h;
1402 compile problems reported by rac AT tenzing.org
aa751414 1403 - (djm) [includes.h monitor.c openbsd-compat/bindresvport.c]
1404 [openbsd-compat/rresvport.c] Some more headers: netinet/in.h
1405 sys/socket.h and unistd.h in various places
dd41ba6f 1406 - (dtucker) [openbsd-compat/bsd-cygwin_util.c] Fix implict declaration
1407 warnings for binary_open and binary_close. Patch from Corinna Vinschen.
78888bab 1408 - (dtucker) [configure.ac includes.h openbsd-compat/glob.{c,h}] Explicitly
1409 test for GLOB_NOMATCH and use our glob functions if it's not found.
1410 Stops sftp from segfaulting when attempting to get a nonexistent file on
1411 Cygwin (previous versions of OpenSSH didn't use the native glob). Partly
1412 from and tested by Corinna Vinschen.
cdc9d1fc 1413 - (dtucker) [README contrib/{caldera,redhat,suse}/openssh.spec] Crank
1414 versions.
24436b92 1415
5b84789f 141620060831
1417 - (djm) [CREDITS LICENCE Makefile.in auth.c configure.ac includes.h ]
1418 [platform.c platform.h sshd.c openbsd-compat/Makefile.in]
1419 [openbsd-compat/openbsd-compat.h openbsd-compat/port-solaris.c]
1420 [openbsd-compat/port-solaris.h] Add support for Solaris process
1421 contracts, enabled with --use-solaris-contracts. Patch from Chad
1422 Mynhier, tweaked by dtucker@ and myself; ok dtucker@
77f7d474 1423 - (dtucker) [contrib/cygwin/ssh-host-config] Add SeTcbPrivilege privilege
1424 while setting up the ssh service account. Patch from Corinna Vinschen.
5b84789f 1425
e9f2e744 142620060830
1427 - (djm) OpenBSD CVS Sync
1428 - dtucker@cvs.openbsd.org 2006/08/21 08:14:01
1429 [sshd_config.5]
1430 Document HostbasedUsesNameFromPacketOnly. Corrections from jmc@,
1431 ok jmc@ djm@
5f047fbc 1432 - dtucker@cvs.openbsd.org 2006/08/21 08:15:57
1433 [sshd.8]
1434 Add more detail about what permissions are and aren't accepted for
1435 authorized_keys files. Corrections jmc@, ok djm@, "looks good" jmc@
0875ae22 1436 - djm@cvs.openbsd.org 2006/08/29 10:40:19
1437 [channels.c session.c]
1438 normalise some inconsistent (but harmless) NULL pointer checks
1439 spotted by the Stanford SATURN tool, via Isil Dillig;
1440 ok markus@ deraadt@
b4f8e1cb 1441 - dtucker@cvs.openbsd.org 2006/08/29 12:02:30
1442 [gss-genr.c]
1443 Work around a problem in Heimdal that occurs when KRB5CCNAME file is
1444 missing, by checking whether or not kerberos allocated us a context
1445 before attempting to free it. Patch from Simon Wilkinson, tested by
1446 biorn@, ok djm@
3223b72f 1447 - dtucker@cvs.openbsd.org 2006/08/30 00:06:51
1448 [sshconnect2.c]
1449 Fix regression where SSH2 banner is printed at loglevels ERROR and FATAL
1450 where previously it weren't. bz #1221, found by Dean Kopesky, ok djm@
76970201 1451 - djm@cvs.openbsd.org 2006/08/30 00:14:37
1452 [version.h]
1453 crank to 4.4
9d68c41d 1454 - (djm) [openbsd-compat/xcrypt.c] needs unistd.h
6545dd0b 1455 - (dtucker) [auth.c openbsd-compat/port-aix.c] Bug #1207: always call
1456 loginsuccess on AIX immediately after authentication to clear the failed
1457 login count. Previously this would only happen when an interactive
1458 session starts (ie when a pty is allocated) but this means that accounts
1459 that have primarily non-interactive sessions (eg scp's) may gradually
1460 accumulate enough failures to lock out an account. This change may have
1461 a side effect of creating two audit records, one with a tty of "ssh"
1462 corresponding to the authentication and one with the allocated pty per
1463 interactive session.
e9f2e744 1464
48a7de26 146520060824
1466 - (dtucker) [openbsd-compat/basename.c] Include errno.h.
8151aaa5 1467 - (dtucker) [openbsd-compat/bsd-misc.c] Add includes needed for select(2) on
1468 older systems.
ab26f490 1469 - (dtucker) [openbsd-compat/bsd-misc.c] Include <sys/select.h> for select(2)
1470 on POSIX systems.
6beea87c 1471 - (dtucker) [openbsd-compat/bsd-openpty.c] Include for ioctl(2).
e429fba8 1472 - (dtucker) [openbsd-compat/rresvport.c] Include <stdlib.h> for malloc.
f07855f7 1473 - (dtucker) [openbsd-compat/xmmap.c] Move #define HAVE_MMAP to prevent
1474 unused variable warning when we have a broken or missing mmap(2).
48a7de26 1475
c1a1c295 147620060822
1477 - (dtucker) [Makefile.in] Bug #1177: fix incorrect path for sshrc in
1478 Makefile. Patch from santhi.amirta at gmail, ok djm.
1479
9895d518 148020060820
1481 - (dtucker) [log.c] Move ifdef to prevent unused variable warning.
08fb8ce9 1482 - (dtucker) [configure.ac] Save $LIBS during PAM library tests and restore
1483 afterward. Removes the need to mangle $LIBS later to remove -lpam and -ldl.
a086f73b 1484 - (dtucker) [configure.ac] Relocate --with-pam parts in preparation for
1485 fixing bug #1181. No changes yet.
282d6408 1486 - (dtucker) [configure.ac] Bug #1181: Explicitly test to see if OpenSSL
1487 (0.9.8a and presumably newer) requires -ldl to successfully link.
08164407 1488 - (dtucker) [configure.ac] Remove errant "-".
9895d518 1489
94d458e8 149020060819
1491 - (djm) OpenBSD CVS Sync
1492 - djm@cvs.openbsd.org 2006/08/18 22:41:29
1493 [gss-genr.c]
1494 GSSAPI error code should be 0 and not -1; from simon@sxw.org.uk
ea83a498 1495 - (dtucker) [openbsd-compat/regress/Makefile.in] Add $(EXEEXT) and add a
1496 single rule for the test progs.
94d458e8 1497
795e7517 149820060818
1499 - (dtucker) [configure.ac openbsd-compat/bsd-closefrom.c] Resync with
1500 closefrom.c from sudo.
5a1d6300 1501 - (dtucker) [openbsd-compat/bsd-closefrom.c] Comment out rcsid.
fed313fd 1502 - (dtucker) [openbsd-compat/regress/snprintftest.c] Newline on error.
d5498c58 1503 - (dtucker) [openbsd-compat/regress/Makefile.in] Use implicit rules for the
1504 test progs instead; they work better than what we have.
78372b6e 1505 - (djm) OpenBSD CVS Sync
1506 - stevesk@cvs.openbsd.org 2006/08/06 01:13:32
1507 [compress.c monitor.c monitor_wrap.c]
1508 "zlib.h" can be <zlib.h>; ok djm@ markus@
ba52fb56 1509 - miod@cvs.openbsd.org 2006/08/12 20:46:46
1510 [monitor.c monitor_wrap.c]
1511 Revert previous include file ordering change, for ssh to compile under
1512 gcc2 (or until openssl include files are cleaned of parameter names
1513 in function prototypes)
fa47fe3c 1514 - dtucker@cvs.openbsd.org 2006/08/14 12:40:25
1515 [servconf.c servconf.h sshd_config.5]
1516 Add ability to match groups to Match keyword in sshd_config. Feedback
1517 djm@, stevesk@, ok stevesk@.
e07335e2 1518 - djm@cvs.openbsd.org 2006/08/16 11:47:15
1519 [sshd.c]
1520 factor inetd connection, TCP listen and main TCP accept loop out of
1521 main() into separate functions to improve readability; ok markus@
28463427 1522 - deraadt@cvs.openbsd.org 2006/08/18 09:13:26
1523 [log.c log.h sshd.c]
1524 make signal handler termination path shorter; risky code pointed out by
1525 mark dowd; ok djm markus
184cb418 1526 - markus@cvs.openbsd.org 2006/08/18 09:15:20
1527 [auth.h session.c sshd.c]
1528 delay authentication related cleanups until we're authenticated and
1529 all alarms have been cancelled; ok deraadt
b2af4ca8 1530 - djm@cvs.openbsd.org 2006/08/18 10:27:16
1531 [misc.h]
1532 reorder so prototypes are sorted by the files they refer to; no
1533 binary change
592de384 1534 - djm@cvs.openbsd.org 2006/08/18 13:54:54
1535 [gss-genr.c ssh-gss.h sshconnect2.c]
1536 bz #1218 - disable SPNEGO as per RFC4462; diff from simon AT sxw.org.uk
1537 ok markus@
abb47f1e 1538 - djm@cvs.openbsd.org 2006/08/18 14:40:34
1539 [gss-genr.c ssh-gss.h]
1540 constify host argument to match the rest of the GSSAPI functions and
1541 unbreak compilation with -Werror
c79c4814 1542 - (djm) Disable sigdie() for platforms that cannot safely syslog inside
1543 a signal handler (basically all of them, excepting OpenBSD);
1544 ok dtucker@
795e7517 1545
f8688ddd 154620060817
1547 - (dtucker) [openbsd-compat/fake-rfc2553.c openbsd-compat/setproctitle.c]
1548 Include stdlib.h for malloc and friends.
53c337ed 1549 - (dtucker) [configure.ac openbsd-compat/bsd-closefrom.c] Use F_CLOSEM fcntl
1550 for closefrom() on AIX. Pointed out by William Ahern.
98cc66aa 1551 - (dtucker) [openbsd-compat/regress/{Makefile.in,closefromtest.c}] Regress
1552 test for closefrom() in compat code.
f8688ddd 1553
5388904a 155420060816
1555 - (djm) [audit-bsm.c] Sprinkle in some headers
1556
4a86d8eb 155720060815
1558 - (dtucker) [LICENCE] Add Reyk to the list for the compat dir.
1559
3a5b6088 156020060806
1561 - (djm) [openbsd-compat/bsd-getpeereid.c] Add some headers to quiet warnings
1562 on Solaris 10
1563
156420060806
149abacb 1565 - (dtucker) [defines.h] With the includes.h changes we no longer get the
1566 name clash on "YES" so we can remove the workaround for it.
442a6515 1567 - (dtucker) [openbsd-compat/{bsd-asprintf.c,bsd-openpty.c,bsd-snprintf.c,
1568 glob.c}] Include stdlib.h for malloc and friends in compat code.
149abacb 1569
fee76795 157020060805
1571 - (djm) OpenBSD CVS Sync
1572 - stevesk@cvs.openbsd.org 2006/07/24 13:58:22
1573 [sshconnect.c]
1574 disable tunnel forwarding when no strict host key checking
1575 and key changed; ok djm@ markus@ dtucker@
912da635 1576 - stevesk@cvs.openbsd.org 2006/07/25 02:01:34
1577 [scard.c]
1578 need #include <string.h>
e264ac72 1579 - stevesk@cvs.openbsd.org 2006/07/25 02:59:21
1580 [channels.c clientloop.c packet.c scp.c serverloop.c sftp-client.c]
1581 [sftp-server.c ssh-agent.c ssh-keyscan.c sshconnect.c sshd.c]
1582 move #include <sys/time.h> out of includes.h
536c14e8 1583 - stevesk@cvs.openbsd.org 2006/07/26 02:35:17
1584 [atomicio.c auth.c dh.c authfile.c buffer.c clientloop.c kex.c]
1585 [groupaccess.c gss-genr.c kexgexs.c misc.c monitor.c monitor_mm.c]
1586 [packet.c scp.c serverloop.c session.c sftp-client.c sftp-common.c]
1587 [sftp-server.c sftp.c ssh-add.c ssh-agent.c ssh-keygen.c sshlogin.c]
1588 [uidswap.c xmalloc.c]
1589 move #include <sys/param.h> out of includes.h
ffa517a8 1590 - stevesk@cvs.openbsd.org 2006/07/26 13:57:17
1591 [authfd.c authfile.c dh.c canohost.c channels.c clientloop.c compat.c]
1592 [hostfile.c kex.c log.c misc.c moduli.c monitor.c packet.c readpass.c]
1593 [scp.c servconf.c session.c sftp-server.c sftp.c ssh-add.c ssh-agent.c]
1594 [ssh-keygen.c ssh-keyscan.c ssh-keysign.c ssh.c sshconnect.c]
1595 [sshconnect1.c sshd.c xmalloc.c]
1596 move #include <stdlib.h> out of includes.h
f0817fbb 1597 - jmc@cvs.openbsd.org 2006/07/27 08:00:50
1598 [ssh_config.5]
1599 avoid confusing wording in HashKnownHosts:
1600 originally spotted by alan amesbury;
1601 ok deraadt
38b37661 1602 - jmc@cvs.openbsd.org 2006/07/27 08:00:50
1603 [ssh_config.5]
1604 avoid confusing wording in HashKnownHosts:
1605 originally spotted by alan amesbury;
1606 ok deraadt
331c3884 1607 - dtucker@cvs.openbsd.org 2006/08/01 11:34:36
1608 [sshconnect.c]
1609 Allow fallback to known_hosts entries without port qualifiers for
1610 non-standard ports too, so that all existing known_hosts entries will be
1611 recognised. Requested by, feedback and ok markus@
cf851879 1612 - stevesk@cvs.openbsd.org 2006/08/01 23:22:48
1613 [auth-passwd.c auth-rhosts.c auth-rsa.c auth.c auth.h auth1.c]
1614 [auth2-chall.c auth2-pubkey.c authfile.c buffer.c canohost.c]
1615 [channels.c clientloop.c dh.c dns.c dns.h hostfile.c kex.c kexdhc.c]
1616 [kexgexc.c kexgexs.c key.c key.h log.c misc.c misc.h moduli.c]
1617 [monitor_wrap.c packet.c progressmeter.c readconf.c readpass.c scp.c]
1618 [servconf.c session.c sftp-client.c sftp-common.c sftp-server.c sftp.c]
1619 [ssh-add.c ssh-agent.c ssh-keygen.c ssh-keyscan.c ssh.c sshconnect.c]
1620 [sshconnect1.c sshconnect2.c sshd.c sshlogin.c sshtty.c uuencode.c]
1621 [uuencode.h xmalloc.c]
1622 move #include <stdio.h> out of includes.h
d4f40d92 1623 - stevesk@cvs.openbsd.org 2006/08/01 23:36:12
1624 [authfile.c channels.c progressmeter.c scard.c servconf.c ssh.c]
1625 clean extra spaces
31652869 1626 - deraadt@cvs.openbsd.org 2006/08/03 03:34:42
1627 [OVERVIEW atomicio.c atomicio.h auth-bsdauth.c auth-chall.c auth-krb5.c]
1628 [auth-options.c auth-options.h auth-passwd.c auth-rh-rsa.c auth-rhosts.c]
1629 [auth-rsa.c auth-skey.c auth.c auth.h auth1.c auth2-chall.c auth2-gss.c]
1630 [auth2-hostbased.c auth2-kbdint.c auth2-none.c auth2-passwd.c ]
1631 [auth2-pubkey.c auth2.c authfd.c authfd.h authfile.c bufaux.c bufbn.c]
1632 [buffer.c buffer.h canohost.c channels.c channels.h cipher-3des1.c]
1633 [cipher-bf1.c cipher-ctr.c cipher.c cleanup.c clientloop.c compat.c]
1634 [compress.c deattack.c dh.c dispatch.c dns.c dns.h fatal.c groupaccess.c]
1635 [groupaccess.h gss-genr.c gss-serv-krb5.c gss-serv.c hostfile.c kex.c]
1636 [kex.h kexdh.c kexdhc.c kexdhs.c kexgex.c kexgexc.c kexgexs.c key.c]
1637 [key.h log.c log.h mac.c match.c md-sha256.c misc.c misc.h moduli.c]
1638 [monitor.c monitor_fdpass.c monitor_mm.c monitor_mm.h monitor_wrap.c]
1639 [monitor_wrap.h msg.c nchan.c packet.c progressmeter.c readconf.c]
1640 [readconf.h readpass.c rsa.c scard.c scard.h scp.c servconf.c servconf.h]
1641 [serverloop.c session.c session.h sftp-client.c sftp-common.c]
1642 [sftp-common.h sftp-glob.c sftp-server.c sftp.c ssh-add.c ssh-agent.c]
1643 [ssh-dss.c ssh-gss.h ssh-keygen.c ssh-keyscan.c ssh-keysign.c ssh-rsa.c]
1644 [ssh.c ssh.h sshconnect.c sshconnect.h sshconnect1.c sshconnect2.c]
1645 [sshd.c sshlogin.c sshlogin.h sshpty.c sshpty.h sshtty.c ttymodes.c]
1646 [uidswap.c uidswap.h uuencode.c uuencode.h xmalloc.c xmalloc.h]
1647 [loginrec.c loginrec.h openbsd-compat/port-aix.c openbsd-compat/port-tun.h]
1648 almost entirely get rid of the culture of ".h files that include .h files"
1649 ok djm, sort of ok stevesk
1650 makes the pain stop in one easy step
1651 NB. portable commit contains everything *except* removing includes.h, as
1652 that will take a fair bit more work as we move headers that are required
1653 for portability workarounds to defines.h. (also, this step wasn't "easy")
c56969f9 1654 - stevesk@cvs.openbsd.org 2006/08/04 20:46:05
1655 [monitor.c session.c ssh-agent.c]
1656 spaces
8bdc7aa0 1657 - (djm) [auth-pam.c defines.h] Move PAM related bits to auth-pam.c
693a35d3 1658 - (djm) [auth-pam.c auth.c bufaux.h entropy.c openbsd-compat/port-tun.c]
1659 remove last traces of bufaux.h - it was merged into buffer.h in the big
1660 includes.h commit
8ad2db2a 1661 - (djm) [auth.c loginrec.c] Missing netinet/in.h for loginrec
8d3106fd 1662 - (djm) [openbsd-compat/regress/snprintftest.c]
1663 [openbsd-compat/regress/strduptest.c] Add missing includes so they pass
1664 compilation with "-Wall -Werror"
00a017bd 1665 - (djm) [auth-pam.c auth-shadow.c auth2-none.c cleanup.c sshd.c]
1666 [openbsd-compat/port-tun.c openbsd-compat/port-tun.h] Sprinkle more
1667 includes for Linux in
ccc09f5c 1668 - (dtucker) [cleanup.c] Need defines.h for __dead.
9ae6b834 1669 - (dtucker) [auth2-gss.c] We still need the #ifdef GSSAPI in -portable.
f2265d5d 1670 - (dtucker) [openbsd-compat/{bsd-arc4random.c,port-tun.c,xmmap.c}] Lots of
1671 #include stdarg.h, needed for log.h.
5be9f803 1672 - (dtucker) [entropy.c] Needs unistd.h too.
35d1c2de 1673 - (dtucker) [ssh-rand-helper.c] Needs stdarg.h for log.h.
76e03684 1674 - (dtucker) [openbsd-compat/getrrsetbyname.c] Nees stdlib.h for malloc.
5946a69f 1675 - (dtucker) [openbsd-compat/strtonum.c] Include stdlib.h for strtoll,
1676 otherwise it is implicitly declared as returning an int.
428f6258 1677 - (dtucker) OpenBSD CVS Sync
1678 - dtucker@cvs.openbsd.org 2006/08/05 07:52:52
1679 [auth2-none.c sshd.c monitor_wrap.c]
1680 Add headers required to build with KERBEROS5=no. ok djm@
453cb7e7 1681 - dtucker@cvs.openbsd.org 2006/08/05 08:00:33
1682 [auth-skey.c]
1683 Add headers required to build with -DSKEY. ok djm@
cecc422f 1684 - dtucker@cvs.openbsd.org 2006/08/05 08:28:24
1685 [monitor_wrap.c auth-skey.c auth2-chall.c]
1686 Zap unused variables in -DSKEY code. ok djm@
0e13ec0f 1687 - dtucker@cvs.openbsd.org 2006/08/05 08:34:04
1688 [packet.c]
1689 Typo in comment
97ea266c 1690 - (dtucker) [openbsd-compat/bsd-cygwin_util.c] Add headers required to compile
1691 on Cygwin.
e3220bb2 1692 - (dtucker) [openbsd-compat/fake-rfc2553.c] Add headers needed for inet_ntoa.
f3296bc4 1693 - (dtucker) [auth-skey.c] monitor_wrap.h needs ssh-gss.h.
0e23dc86 1694 - (dtucker) [audit.c audit.h] Repair headers.
6f54ce27 1695 - (dtucker) [audit-bsm.c] Add additional headers now required.
fee76795 1696
3e05aa50 169720060804
1698 - (dtucker) [configure.ac] The "crippled AES" test does not work on recent
1699 versions of Solaris, so use AC_LINK_IFELSE to actually link the test program
1700 rather than just compiling it. Spotted by dlg@.
1701
53d4ae20 170220060802
1703 - (dtucker) [openbsd-compat/daemon.c] Add unistd.h for fork() prototype.
1704
be350da6 170520060725
1706 - (dtucker) [openbsd-compat/xmmap.c] Need fcntl.h for O_RDRW.
1707
14e980ef 170820060724
1709 - (djm) OpenBSD CVS Sync
1710 - jmc@cvs.openbsd.org 2006/07/12 13:39:55
1711 [sshd_config.5]
1712 - new sentence, new line
1713 - s/The the/The/
1714 - kill a bad comma
c8dfff33 1715 - stevesk@cvs.openbsd.org 2006/07/12 22:28:52
742bee8c 1716 [auth-options.c canohost.c channels.c includes.h readconf.c]
1717 [servconf.c ssh-keyscan.c ssh.c sshconnect.c sshd.c]
c8dfff33 1718 move #include <netdb.h> out of includes.h; ok djm@
bcaab305 1719 - stevesk@cvs.openbsd.org 2006/07/12 22:42:32
1720 [includes.h ssh.c ssh-rand-helper.c]
1721 move #include <stddef.h> out of includes.h
d2a69816 1722 - stevesk@cvs.openbsd.org 2006/07/14 01:15:28
1723 [monitor_wrap.h]
1724 don't need incompletely-typed 'struct passwd' now with
1725 #include <pwd.h>; ok markus@
5188ba17 1726 - stevesk@cvs.openbsd.org 2006/07/17 01:31:10
1727 [authfd.c authfile.c channels.c cleanup.c clientloop.c groupaccess.c]
1728 [includes.h log.c misc.c msg.c packet.c progressmeter.c readconf.c]
1729 [readpass.c scp.c servconf.c sftp-client.c sftp-server.c sftp.c]
1730 [ssh-add.c ssh-agent.c ssh-keygen.c ssh-keyscan.c ssh-keysign.c ssh.c]
1731 [sshconnect.c sshlogin.c sshpty.c uidswap.c]
1732 move #include <unistd.h> out of includes.h
774de098 1733 - dtucker@cvs.openbsd.org 2006/07/17 12:02:24
1734 [auth-options.c]
1735 Use '\0' rather than 0 to terminates strings; ok djm@
2fefbadf 1736 - dtucker@cvs.openbsd.org 2006/07/17 12:06:00
1737 [channels.c channels.h servconf.c sshd_config.5]
1738 Add PermitOpen directive to sshd_config which is equivalent to the
1739 "permitopen" key option. Allows server admin to allow TCP port
1740 forwarding only two specific host/port pairs. Useful when combined
1741 with Match.
1742 If permitopen is used in both sshd_config and a key option, both
1743 must allow a given connection before it will be permitted.
1744 Note that users can still use external forwarders such as netcat,
1745 so to be those must be controlled too for the limits to be effective.
1746 Feedback & ok djm@, man page corrections & ok jmc@.
f22506ff 1747 - jmc@cvs.openbsd.org 2006/07/18 07:50:40
1748 [sshd_config.5]
1749 tweak; ok dtucker
578d2b99 1750 - jmc@cvs.openbsd.org 2006/07/18 07:56:28
1751 [scp.1]
1752 replace DIAGNOSTICS with .Ex;
874d319b 1753 - jmc@cvs.openbsd.org 2006/07/18 08:03:09
1754 [ssh-agent.1 sshd_config.5]
1755 mark up angle brackets;
4895f836 1756 - dtucker@cvs.openbsd.org 2006/07/18 08:22:23
1757 [sshd_config.5]
1758 Clarify description of Match, with minor correction from jmc@
62e12ffe 1759 - stevesk@cvs.openbsd.org 2006/07/18 22:27:55
1760 [dh.c]
1761 remove unneeded includes; ok djm@
691712e0 1762 - dtucker@cvs.openbsd.org 2006/07/19 08:56:41
1763 [servconf.c sshd_config.5]
1764 Add support for X11Forwaring, X11DisplayOffset and X11UseLocalhost to
1765 Match. ok djm@
e7259e8d 1766 - dtucker@cvs.openbsd.org 2006/07/19 13:07:10
1767 [servconf.c servconf.h session.c sshd.8 sshd_config sshd_config.5]
1768 Add ForceCommand keyword to sshd_config, equivalent to the "command="
1769 key option, man page entry and example in sshd_config.
1770 Feedback & ok djm@, man page corrections & ok jmc@
67514848 1771 - stevesk@cvs.openbsd.org 2006/07/20 15:26:15
1772 [auth1.c serverloop.c session.c sshconnect2.c]
1773 missed some needed #include <unistd.h> when KERBEROS5=no; issue from
1774 massimo@cedoc.mo.it
ea46e550 1775 - dtucker@cvs.openbsd.org 2006/07/21 12:43:36
1776 [channels.c channels.h servconf.c servconf.h sshd_config.5]
1777 Make PermitOpen take a list of permitted ports and act more like most
1778 other keywords (ie the first match is the effective setting). This
1779 also makes it easier to override a previously set PermitOpen. ok djm@
ebb90778 1780 - stevesk@cvs.openbsd.org 2006/07/21 21:13:30
1781 [channels.c]
1782 more ARGSUSED (lint) for dispatch table-driven functions; ok djm@
c88c3fb9 1783 - stevesk@cvs.openbsd.org 2006/07/21 21:26:55
1784 [progressmeter.c]
1785 ARGSUSED for signal handler
b0f6943a 1786 - stevesk@cvs.openbsd.org 2006/07/22 19:08:54
1787 [includes.h moduli.c progressmeter.c scp.c sftp-common.c]
1788 [sftp-server.c ssh-agent.c sshlogin.c]
1789 move #include <time.h> out of includes.h
00146caa 1790 - stevesk@cvs.openbsd.org 2006/07/22 20:48:23
1791 [atomicio.c auth-options.c auth-passwd.c auth-rhosts.c auth-rsa.c]
1792 [auth.c auth1.c auth2-chall.c auth2-hostbased.c auth2-passwd.c auth2.c]
1793 [authfd.c authfile.c bufaux.c bufbn.c buffer.c canohost.c channels.c]
1794 [cipher-3des1.c cipher-bf1.c cipher-ctr.c cipher.c clientloop.c]
1795 [compat.c deattack.c dh.c dns.c gss-genr.c gss-serv.c hostfile.c]
1796 [includes.h kex.c kexdhc.c kexdhs.c kexgexc.c kexgexs.c key.c log.c]
1797 [mac.c match.c md-sha256.c misc.c moduli.c monitor.c monitor_fdpass.c]
1798 [monitor_mm.c monitor_wrap.c msg.c nchan.c packet.c rsa.c]
1799 [progressmeter.c readconf.c readpass.c scp.c servconf.c serverloop.c]
1800 [session.c sftp-client.c sftp-common.c sftp-glob.c sftp-server.c sftp.c]
1801 [ssh-add.c ssh-agent.c ssh-dss.c ssh-keygen.c ssh-keyscan.c]
1802 [ssh-keysign.c ssh-rsa.c ssh.c sshconnect.c sshconnect1.c sshconnect2.c]
1803 [sshd.c sshlogin.c sshpty.c ttymodes.c uidswap.c xmalloc.c]
1804 move #include <string.h> out of includes.h
519fc2b7 1805 - stevesk@cvs.openbsd.org 2006/07/23 01:11:05
1806 [auth.h dispatch.c kex.h sftp-client.c]
1807 #include <signal.h> for sig_atomic_t; need this prior to <sys/param.h>
1808 move
28cb0a43 1809 - (djm) [acss.c auth-krb5.c auth-options.c auth-pam.c auth-shadow.c]
1810 [canohost.c channels.c cipher-acss.c defines.h dns.c gss-genr.c]
1811 [gss-serv-krb5.c gss-serv.c log.h loginrec.c logintest.c readconf.c]
1812 [servconf.c ssh-keygen.c ssh-keyscan.c ssh-keysign.c ssh-rand-helper.c]
1813 [ssh.c sshconnect.c sshd.c openbsd-compat/bindresvport.c]
1814 [openbsd-compat/bsd-arc4random.c openbsd-compat/bsd-misc.c]
1815 [openbsd-compat/getrrsetbyname.c openbsd-compat/glob.c]
1816 [openbsd-compat/mktemp.c openbsd-compat/port-linux.c]
1817 [openbsd-compat/port-tun.c openbsd-compat/readpassphrase.c]
1818 [openbsd-compat/setproctitle.c openbsd-compat/xmmap.c]
1819 make the portable tree compile again - sprinkle unistd.h and string.h
1820 back in. Don't redefine __unused, as it turned out to be used in
1821 headers on Linux, and replace its use in auth-pam.c with ARGSUSED
ba1e6121 1822 - (djm) [openbsd-compat/glob.c]
1823 Move get_arg_max() into the ifdef HAVE_GLOB block so that it compiles
1824 on OpenBSD (or other platforms with a decent glob implementation) with
1825 -Werror
25523747 1826 - (djm) [uuencode.c]
1827 Add resolv.h, is it contains the prototypes for __b64_ntop/__b64_pton on
1828 some platforms
9b09381d 1829 - (djm) [session.c]
1830 fix compile error with -Werror -Wall: 'path' is only used in
1831 do_setup_env() if HAVE_LOGIN_CAP is not defined
e204f3ee 1832 - (djm) [openbsd-compat/basename.c openbsd-compat/bsd-closefrom.c]
1833 [openbsd-compat/bsd-cray.c openbsd-compat/bsd-openpty.c]
1834 [openbsd-compat/bsd-snprintf.c openbsd-compat/fake-rfc2553.c]
1835 [openbsd-compat/port-aix.c openbsd-compat/port-irix.c]
1836 [openbsd-compat/rresvport.c]
1837 These look to need string.h and/or unistd.h (based on a grep for function
1838 names)
f40c8634 1839 - (djm) [Makefile.in]
1840 Remove generated openbsd-compat/regress/Makefile in distclean target
e7c5b206 1841 - (djm) [regress/Makefile regress/agent-getpeereid.sh regress/cfgmatch.sh]
1842 [regress/cipher-speed.sh regress/forcecommand.sh regress/forwarding.sh]
1843 Sync regress tests to -current; include dtucker@'s new cfgmatch and
1844 forcecommand tests. Add cipher-speed.sh test (not linked in yet)
30872a12 1845 - (dtucker) [cleanup.c] Since config.h defines _LARGE_FILES on AIX, including
1846 system headers before defines.h will cause conflicting definitions.
b64d983b 1847 - (dtucker) [regress/forcecommand.sh] Portablize.
e204f3ee 1848
4352744e 184920060713
1850 - (dtucker) [auth-krb5.c auth-pam.c] Still more errno.h
1851
956d6743 185220060712
294d3ca5 1853 - (dtucker) [configure.ac defines.h] Only define SHUT_RD (and friends) and
1854 O_NONBLOCK if they're really needed. Fixes build errors on HP-UX, old
1855 Linuxes and probably more.
71f4c727 1856 - (dtucker) [configure.ac] OpenBSD needs <sys/types.h> before <sys/socket.h>
1857 for SHUT_RD.
f9d5c000 1858 - (dtucker) [openbsd-compat/port-tun.c] OpenBSD needs <netinet/in.h> before
1859 <netinet/ip.h>.
a773acf7 1860 - (dtucker) OpenBSD CVS Sync
1861 - stevesk@cvs.openbsd.org 2006/07/10 16:01:57
1862 [sftp-glob.c sftp-common.h sftp.c]
1863 buffer.h only needed in sftp-common.h and remove some unneeded
1864 user includes; ok djm@
a0bca6ed 1865 - jmc@cvs.openbsd.org 2006/07/10 16:04:21
1866 [sshd.8]
1867 s/and and/and/
4c72fcfd 1868 - stevesk@cvs.openbsd.org 2006/07/10 16:37:36
1869 [readpass.c log.h scp.c fatal.c xmalloc.c includes.h ssh-keyscan.c misc.c
1870 auth.c packet.c log.c]
1871 move #include <stdarg.h> out of includes.h; ok markus@
0ad62016 1872 - dtucker@cvs.openbsd.org 2006/07/11 10:12:07
1873 [ssh.c]
1874 Only copy the part of environment variable that we actually use. Prevents
1875 ssh bailing when SendEnv is used and an environment variable with a really
1876 long value exists. ok djm@
42ea6f5e 1877 - markus@cvs.openbsd.org 2006/07/11 18:50:48
1878 [clientloop.c ssh.1 ssh.c channels.c ssh_config.5 readconf.h session.c
1879 channels.h readconf.c]
1880 add ExitOnForwardFailure: terminate the connection if ssh(1)
1881 cannot set up all requested dynamic, local, and remote port
1882 forwardings. ok djm, dtucker, stevesk, jmc
028094f4 1883 - stevesk@cvs.openbsd.org 2006/07/11 20:07:25
1884 [scp.c auth.c monitor.c serverloop.c sftp-server.c sshpty.c readpass.c
1885 sshd.c monitor_wrap.c monitor_fdpass.c ssh-agent.c ttymodes.c atomicio.c
1886 includes.h session.c sshlogin.c monitor_mm.c packet.c sshconnect2.c
1887 sftp-client.c nchan.c clientloop.c sftp.c misc.c canohost.c channels.c
1888 ssh-keygen.c progressmeter.c uidswap.c msg.c readconf.c sshconnect.c]
1889 move #include <errno.h> out of includes.h; ok markus@
00c8971b 1890 - stevesk@cvs.openbsd.org 2006/07/11 20:16:43
1891 [ssh.c]
1892 cast asterisk field precision argument to int to remove warning;
1893 ok markus@
dd984467 1894 - stevesk@cvs.openbsd.org 2006/07/11 20:27:56
1895 [authfile.c ssh.c]
1896 need <errno.h> here also (it's also included in <openssl/err.h>)
d231781a 1897 - dtucker@cvs.openbsd.org 2006/07/12 11:34:58
1898 [sshd.c servconf.h servconf.c sshd_config.5 auth.c]
1899 Add support for conditional directives to sshd_config via a "Match"
1900 keyword, which works similarly to the "Host" directive in ssh_config.
1901 Lines after a Match line override the default set in the main section
1902 if the condition on the Match line is true, eg
1903 AllowTcpForwarding yes
1904 Match User anoncvs
1905 AllowTcpForwarding no
1906 will allow port forwarding by all users except "anoncvs".
1907 Currently only a very small subset of directives are supported.
1908 ok djm@
fec71b2f 1909 - (dtucker) [loginrec.c openbsd-compat/xmmap.c openbsd-compat/bindresvport.c
1910 openbsd-compat/glob.c openbsd-compat/mktemp.c openbsd-compat/port-tun.c
1911 openbsd-compat/readpassphrase.c openbsd-compat/strtonum.c] Include <errno.h>.
baede55a 1912 - (dtucker) [openbsd-compat/setproctitle.c] Include stdarg.h.
403a29ac 1913 - (dtucker) [ssh-keyscan.c ssh-rand-helper.c] More errno.h here too.
5f8747dc 1914 - (dtucker) [openbsd-compat/openbsd-compat.h] v*printf needs stdarg.h.
4f4b7d4d 1915 - (dtucker) [openbsd-compat/bsd-asprintf.c openbsd-compat/port-aix.c
1916 openbsd-compat/rresvport.c] More errno.h.
1917
37259a8e 191820060711
1919 - (dtucker) [configure.ac ssh-keygen.c openbsd-compat/bsd-openpty.c
1920 openbsd-compat/daemon.c] Add includes needed by open(2). Conditionally
1921 include paths.h. Fixes build error on Solaris.
2edd133e 1922 - (dtucker) [entropy.c] More fcntl.h, this time on AIX (and probably
1923 others).
37259a8e 1924
44064ac4 192520060710
1926 - (dtucker) [INSTALL] New autoconf version: 2.60.
e5c76324 1927 - OpenBSD CVS Sync
1928 - djm@cvs.openbsd.org 2006/06/14 10:50:42
1929 [sshconnect.c]
1930 limit the number of pre-banner characters we will accept; ok markus@
9f1090be 1931 - djm@cvs.openbsd.org 2006/06/26 10:36:15
1932 [clientloop.c]
1933 mention optional bind_address in runtime port forwarding setup
1934 command-line help. patch from santhi.amirta AT gmail.com
06fa4ac1 1935 - stevesk@cvs.openbsd.org 2006/07/02 17:12:58
1936 [ssh.1 ssh.c ssh_config.5 sshd_config.5]
1937 more details and clarity for tun(4) device forwarding; ok and help
1938 jmc@
6955279c 1939 - stevesk@cvs.openbsd.org 2006/07/02 18:36:47
1940 [gss-serv-krb5.c gss-serv.c]
1941 no "servconf.h" needed here
1942 (gss-serv-krb5.c change not applied, portable needs the server options)
16fbe330 1943 - stevesk@cvs.openbsd.org 2006/07/02 22:45:59
1944 [groupaccess.c groupaccess.h includes.h session.c sftp-common.c sshpty.c]
1945 move #include <grp.h> out of includes.h
1946 (portable needed uidswap.c too)
33f13fa5 1947 - stevesk@cvs.openbsd.org 2006/07/02 23:01:55
1948 [clientloop.c ssh.1]
1949 use -KR[bind_address:]port here; ok djm@
28015df4 1950 - stevesk@cvs.openbsd.org 2006/07/03 08:54:20
1951 [includes.h ssh.c sshconnect.c sshd.c]
1952 move #include "version.h" out of includes.h; ok markus@
319d6b41 1953 - stevesk@cvs.openbsd.org 2006/07/03 17:59:32
1954 [channels.c includes.h]
1955 move #include <arpa/inet.h> out of includes.h; old ok djm@
1956 (portable needed session.c too)
9794d008 1957 - stevesk@cvs.openbsd.org 2006/07/05 02:42:09
1958 [canohost.c hostfile.c includes.h misc.c packet.c readconf.c]
1959 [serverloop.c sshconnect.c uuencode.c]
1960 move #include <netinet/in.h> out of includes.h; ok deraadt@
1961 (also ssh-rand-helper.c logintest.c loginrec.c)
d66ce1a1 1962 - djm@cvs.openbsd.org 2006/07/06 10:47:05
1963 [servconf.c servconf.h session.c sshd_config.5]
1964 support arguments to Subsystem commands; ok markus@
a13880bb 1965 - djm@cvs.openbsd.org 2006/07/06 10:47:57
1966 [sftp-server.8 sftp-server.c]
1967 add commandline options to enable logging of transactions; ok markus@
b1842393 1968 - stevesk@cvs.openbsd.org 2006/07/06 16:03:53
1969 [auth-options.c auth-options.h auth-passwd.c auth-rh-rsa.c]
1970 [auth-rhosts.c auth-rsa.c auth.c auth.h auth2-hostbased.c]
1971 [auth2-pubkey.c auth2.c includes.h misc.c misc.h monitor.c]
1972 [monitor_wrap.c monitor_wrap.h scp.c serverloop.c session.c]
1973 [session.h sftp-common.c ssh-add.c ssh-keygen.c ssh-keysign.c]
1974 [ssh.c sshconnect.c sshconnect.h sshd.c sshpty.c sshpty.h uidswap.c]
1975 [uidswap.h]
1976 move #include <pwd.h> out of includes.h; ok markus@
0cbe25f0 1977 - stevesk@cvs.openbsd.org 2006/07/06 16:22:39
1978 [ssh-keygen.c]
1979 move #include "dns.h" up
76275092 1980 - stevesk@cvs.openbsd.org 2006/07/06 17:36:37
1981 [monitor_wrap.h]
1982 typo in comment
5b04a8bf 1983 - stevesk@cvs.openbsd.org 2006/07/08 21:47:12
1984 [authfd.c canohost.c clientloop.c dns.c dns.h includes.h]
1985 [monitor_fdpass.c nchan.c packet.c servconf.c sftp.c ssh-agent.c]
1986 [ssh-keyscan.c ssh.c sshconnect.h sshd.c sshlogin.h]
1987 move #include <sys/socket.h> out of includes.h
9305512d 1988 - stevesk@cvs.openbsd.org 2006/07/08 21:48:53
1989 [monitor.c session.c]
1990 missed these from last commit:
1991 move #include <sys/socket.h> out of includes.h
ca1df159 1992 - stevesk@cvs.openbsd.org 2006/07/08 23:30:06
1993 [log.c]
1994 move user includes after /usr/include files
d3221cca 1995 - stevesk@cvs.openbsd.org 2006/07/09 15:15:11
1996 [auth2-none.c authfd.c authfile.c includes.h misc.c monitor.c]
1997 [readpass.c scp.c serverloop.c sftp-client.c sftp-server.c]
1998 [ssh-add.c ssh-agent.c ssh-keygen.c ssh-keysign.c ssh.c sshd.c]
1999 [sshlogin.c sshpty.c]
2000 move #include <fcntl.h> out of includes.h
657939aa 2001 - stevesk@cvs.openbsd.org 2006/07/09 15:27:59
2002 [ssh-add.c]
2003 use O_RDONLY vs. 0 in open(); no binary change
43bc2dc9 2004 - djm@cvs.openbsd.org 2006/07/10 11:24:54
2005 [sftp-server.c]
2006 remove optind - it isn't used here
26ddd377 2007 - djm@cvs.openbsd.org 2006/07/10 11:25:53
2008 [sftp-server.c]
2009 don't log variables that aren't yet set
22bbb3e6 2010 - (djm) [loginrec.c ssh-rand-helper.c sshd.c openbsd-compat/glob.c]
2011 [openbsd-compat/mktemp.c openbsd-compat/openbsd-compat.h]
2012 [openbsd-compat/port-tun.c openbsd-compat/readpassphrase.c]
2013 [openbsd-compat/xcrypt.c] Fix includes.h fallout, mainly fcntl.h
1879b184 2014 - OpenBSD CVS Sync
2015 - djm@cvs.openbsd.org 2006/07/10 12:03:20
2016 [scp.c]
2017 duplicate argv at the start of main() because it gets modified later;
2018 pointed out by deraadt@ ok markus@
a217e418 2019 - djm@cvs.openbsd.org 2006/07/10 12:08:08
2020 [channels.c]
2021 fix misparsing of SOCKS 5 packets that could result in a crash;
2022 reported by mk@ ok markus@
d4530052 2023 - dtucker@cvs.openbsd.org 2006/07/10 12:46:51
2024 [misc.c misc.h sshd.8 sshconnect.c]
2025 Add port identifier to known_hosts for non-default ports, based originally
2026 on a patch from Devin Nate in bz#910.
2027 For any connection using the default port or using a HostKeyAlias the
2028 format is unchanged, otherwise the host name or address is enclosed
2029 within square brackets in the same format as sshd's ListenAddress.
2030 Tested by many, ok markus@.
9b6edf98 2031 - (dtucker) [openbsd-compat/openbsd-compat.h] Need to include <sys/socket.h>
2032 for struct sockaddr on platforms that use the fake-rfc stuff.
44064ac4 2033
e7479666 203420060706
2035 - (dtucker) [configure.ac] Try AIX blibpath test in different order when
2036 compiling with gcc. gcc 4.1.x will accept (but ignore) -b flags so
2037 configure would not select the correct libpath linker flags.
90f321a4 2038 - (dtucker) [INSTALL] A bit more info on autoconf.
e7479666 2039
e5c27607 204020060705
2041 - (dtucker) [ssh-rand-helper.c] Don't exit if mkdir fails because the
2042 target already exists.
2043
202c6095 204420060630
2045 - (dtucker) [openbsd-compat/openbsd-compat.h] SNPRINTF_CONST for snprintf
2046 declaration too. Patch from russ at sludge.net.
0bbb4f75 2047 - (dtucker) [openbsd-compat/getrrsetbyname.c] Undef _res before defining it,
2048 prevents warnings on platforms where _res is in the system headers.
10f1064f 2049 - (dtucker) [INSTALL] Bug #1202: Note when autoconf is required and which
2050 version.
202c6095 2051
ecd9ec09 205220060627
2053 - (dtucker) [configure.ac] Bug #1203: Add missing '[', which causes problems
2054 with autoconf 2.60. Patch from vapier at gentoo.org.
2055
9c04d67d 205620060625
2057 - (dtucker) [channels.c serverloop.c] Apply the bug #1102 workaround to ptys
2058 only, otherwise sshd can hang exiting non-interactive sessions.
2059
795aa5f5 206020060624
2061 - (dtucker) [configure.ac] Bug #1193: Define PASSWD_NEEDS_USERNAME on Solaris.
2062 Works around limitation in Solaris' passwd program for changing passwords
2063 where the username is longer than 8 characters. ok djm@
24a87055 2064 - (dtucker) [serverloop.c] Get ifdef/ifndef the right way around for the bug
2065 #1102 workaround.
795aa5f5 2066
e02505e2 206720060623
2068 - (dtucker) [README.platform configure.ac openbsd-compat/port-tun.c] Add
2069 tunnel support for Mac OS X/Darwin via a third-party tun driver. Patch
2070 from reyk@, tested by anil@
ea8c44d9 2071 - (dtucker) [channels.c configure.ac serverloop.c] Bug #1102: Around AIX
2072 4.3.3 ML3 or so, the AIX pty layer starting passing zero-length writes
2073 on the pty slave as zero-length reads on the pty master, which sshd
2074 interprets as the descriptor closing. Since most things don't do zero
2075 length writes this rarely matters, but occasionally it happens, and when
2076 it does the SSH pty session appears to hang, so we add a special case for
2077 this condition. ok djm@
e02505e2 2078
6cba36fd 207920060613
ae410a09 2080 - (djm) [getput.h] This file has been replaced by functions in misc.c
6cba36fd 2081 - OpenBSD CVS Sync
2082 - djm@cvs.openbsd.org 2006/05/08 10:49:48
2083 [sshconnect2.c]
2084 uint32_t -> u_int32_t (which we use everywhere else)
2085 (Id sync only - portable already had this)
3173dd0d 2086 - markus@cvs.openbsd.org 2006/05/16 09:00:00
2087 [clientloop.c]
2088 missing free; from Kylene Hall
2b8dc5e3 2089 - markus@cvs.openbsd.org 2006/05/17 12:43:34
2090 [scp.c sftp.c ssh-agent.c ssh-keygen.c sshconnect.c]
2091 fix leak; coverity via Kylene Jo Hall
18c60a0b 2092 - miod@cvs.openbsd.org 2006/05/18 21:27:25
2093 [kexdhc.c kexgexc.c]
2094 paramter -> parameter
07a80cea 2095 - dtucker@cvs.openbsd.org 2006/05/29 12:54:08
2096 [ssh_config.5]
2097 Add gssapi-with-mic to PreferredAuthentications default list; ok jmc
aa195106 2098 - dtucker@cvs.openbsd.org 2006/05/29 12:56:33
2099 [ssh_config]
f127d8a4 2100 Add GSSAPIAuthentication and GSSAPIDelegateCredentials to examples in
2101 sample ssh_config. ok markus@
2102 - jmc@cvs.openbsd.org 2006/05/29 16:10:03
2103 [ssh_config.5]
2104 oops - previous was too long; split the list of auths up
ed277f5e 2105 - mk@cvs.openbsd.org 2006/05/30 11:46:38
2106 [ssh-add.c]
2107 Sync usage() with man page and reality.
2108 ok deraadt dtucker
2109 - jmc@cvs.openbsd.org 2006/05/29 16:13:23
2110 [ssh.1]
2111 add GSSAPI to the list of authentication methods supported;
f9579ee9 2112 - mk@cvs.openbsd.org 2006/05/30 11:46:38
2113 [ssh-add.c]
2114 Sync usage() with man page and reality.
2115 ok deraadt dtucker
211f229e 2116 - markus@cvs.openbsd.org 2006/06/01 09:21:48
2117 [sshd.c]
2118 call get_remote_ipaddr() early; fixes logging after client disconnects;
2119 report mpf@; ok dtucker@
82aeee5d 2120 - markus@cvs.openbsd.org 2006/06/06 10:20:20
2121 [readpass.c sshconnect.c sshconnect.h sshconnect2.c uidswap.c]
2122 replace remaining setuid() calls with permanently_set_uid() and
2123 check seteuid() return values; report Marcus Meissner; ok dtucker djm
3c33c1b6 2124 - markus@cvs.openbsd.org 2006/06/08 14:45:49
2125 [readpass.c sshconnect.c sshconnect2.c uidswap.c uidswap.h]
2126 do not set the gid, noted by solar; ok djm
e1ff5445 2127 - djm@cvs.openbsd.org 2006/06/13 01:18:36
2128 [ssh-agent.c]
2129 always use a format string, even when printing a constant
2130 - djm@cvs.openbsd.org 2006/06/13 02:17:07
2131 [ssh-agent.c]
2132 revert; i am on drugs. spotted by alexander AT beard.se
6cba36fd 2133
2ae7f715 213420060521
2135 - (dtucker) [auth.c monitor.c] Now that we don't log from both the monitor
2136 and slave, we can remove the special-case handling in the audit hook in
2137 auth_log.
2138
213920060517
aee28e67 2140 - (dtucker) [ssh-rand-helper.c] Check return code of mkdir and fix file
2141 pointer leak. From kjhall at us.ibm.com, found by coverity.
2142
2ae7f715 214320060515
a048aeba 2144 - (dtucker) [openbsd-compat/getrrsetbyname.c] Use _compat_res instead of
2145 _res, prevents problems on some platforms that have _res as a global but
2146 don't have getrrsetbyname(), eg IRIX 5.3. Found and tested by
2147 georg.schwarz at freenet.de, ok djm@.
143a79db 2148 - (dtucker) [defines.h] Find a value for IOV_MAX or use a conservative
2149 default. Patch originally from tim@, ok djm
5aa56df0 2150 - (dtucker) [auth-pam.c] Bug #1188: pass result of do_pam_account back and
2151 do not allow kbdint again after the PAM account check fails. ok djm@
a048aeba 2152
2ae7f715 215320060506
689d3f77 2154 - (dtucker) OpenBSD CVS Sync
fc231518 2155 - dtucker@cvs.openbsd.org 2006/04/25 08:02:27
2156 [authfile.c authfile.h sshconnect2.c ssh.c sshconnect1.c]
2157 Prevent ssh from trying to open private keys with bad permissions more than
2158 once or prompting for their passphrases (which it subsequently ignores
2159 anyway), similar to a previous change in ssh-add. bz #1186, ok djm@
397d64d2 2160 - djm@cvs.openbsd.org 2006/05/04 14:55:23
2161 [dh.c]
2162 tighter DH exponent checks here too; feedback and ok markus@
a1361c4b 2163 - djm@cvs.openbsd.org 2006/04/01 05:37:46
2164 [OVERVIEW]
2165 $OpenBSD$ in here too
9188927d 2166 - dtucker@cvs.openbsd.org 2006/05/06 08:35:40
2167 [auth-krb5.c]
2168 Add $OpenBSD$ in comment here too
fc231518 2169
01d35895 217020060504
2171 - (dtucker) [auth-pam.c groupaccess.c monitor.c monitor_wrap.c scard-opensc.c
2172 session.c ssh-rand-helper.c sshd.c openbsd-compat/bsd-cygwin_util.c
2173 openbsd-compat/setproctitle.c] Convert malloc(foo*bar) -> calloc(foo,bar)
2174 in Portable-only code; since calloc zeros, remove now-redundant memsets.
2175 Also add a couple of sanity checks. With & ok djm@
2176
7ca4010c 217720060503
2178 - (dtucker) [packet.c] Remove in_systm.h since it's also in includes.h
2179 and double including it on IRIX 5.3 causes problems. From Georg Schwarz,
2180 "no objections" tim@
2181
ac93e676 218220060423
2183 - (djm) OpenBSD CVS Sync
2184 - deraadt@cvs.openbsd.org 2006/04/01 05:42:20
2185 [scp.c]
2186 minimal lint cleanup (unused crud, and some size_t); ok djm
c0a8e7bb 2187 - djm@cvs.openbsd.org 2006/04/01 05:50:29
2188 [scp.c]
2189 xasprintification; ok deraadt@
5fe9ca7d 2190 - djm@cvs.openbsd.org 2006/04/01 05:51:34
2191 [atomicio.c]
2192 ANSIfy; requested deraadt@
2193 - dtucker@cvs.openbsd.org 2006/04/02 08:34:52
2194 [ssh-keysign.c]
2195 sessionid can be 32 bytes now too when sha256 kex is used; ok djm@
9c3c8eb1 2196 - djm@cvs.openbsd.org 2006/04/03 07:10:38
2197 [gss-genr.c]
2198 GSSAPI buffers shouldn't be nul-terminated, spotted in bugzilla #1066
2199 by dleonard AT vintela.com. use xasprintf() to simplify code while in
2200 there; "looks right" deraadt@
69d9d413 2201 - djm@cvs.openbsd.org 2006/04/16 00:48:52
2202 [buffer.c buffer.h channels.c]
2203 Fix condition where we could exit with a fatal error when an input
2204 buffer became too large and the remote end had advertised a big window.
2205 The problem was a mismatch in the backoff math between the channels code
2206 and the buffer code, so make a buffer_check_alloc() function that the
2207 channels code can use to propsectivly check whether an incremental
2208 allocation will succeed. bz #1131, debugged with the assistance of
2209 cove AT wildpackets.com; ok dtucker@ deraadt@
68d86b37 2210 - djm@cvs.openbsd.org 2006/04/16 00:52:55
2211 [atomicio.c atomicio.h]
2212 introduce atomiciov() function that wraps readv/writev to retry
2213 interrupted transfers like atomicio() does for read/write;
2214 feedback deraadt@ dtucker@ stevesk@ ok deraadt@
2c4369de 2215 - djm@cvs.openbsd.org 2006/04/16 00:54:10
2216 [sftp-client.c]
2217 avoid making a tiny 4-byte write to send the packet length of sftp
2218 commands, which would result in a separate tiny packet on the wire by
2219 using atomiciov(writev, ...) to write the length and the command in one
2220 pass; ok deraadt@
7bccebd0 2221 - djm@cvs.openbsd.org 2006/04/16 07:59:00
2222 [atomicio.c]
2223 reorder sanity test so that it cannot dereference past the end of the
2224 iov array; well spotted canacar@!
b0a892b2 2225 - dtucker@cvs.openbsd.org 2006/04/18 10:44:28
71544c3d 2226 [bufaux.c bufbn.c Makefile.in]
b0a892b2 2227 Move Buffer bignum functions into their own file, bufbn.c. This means
2228 that sftp and sftp-server (which use the Buffer functions in bufaux.c
2229 but not the bignum ones) no longer need to be linked with libcrypto.
2230 ok markus@
50394f26 2231 - djm@cvs.openbsd.org 2006/04/20 09:27:09
2232 [auth.h clientloop.c dispatch.c dispatch.h kex.h]
2233 replace the last non-sig_atomic_t flag used in a signal handler with a
2234 sig_atomic_t, unfortunately with some knock-on effects in other (non-
2235 signal) contexts in which it is used; ok markus@
4439dde1 2236 - markus@cvs.openbsd.org 2006/04/20 09:47:59
2237 [sshconnect.c]
2238 simplify; ok djm@
6e97fe1d 2239 - djm@cvs.openbsd.org 2006/04/20 21:53:44
2240 [includes.h session.c sftp.c]
2241 Switch from using pipes to socketpairs for communication between
2242 sftp/scp and ssh, and between sshd and its subprocesses. This saves
2243 a file descriptor per session and apparently makes userland ppp over
2244 ssh work; ok markus@ deraadt@ (ID Sync only - portable makes this
2245 decision on a per-platform basis)
40402a68 2246 - djm@cvs.openbsd.org 2006/04/22 04:06:51
2247 [uidswap.c]
2248 use setres[ug]id() to permanently revoke privileges; ok deraadt@
2249 (ID Sync only - portable already uses setres[ug]id() whenever possible)
ae3afe05 2250 - stevesk@cvs.openbsd.org 2006/04/22 18:29:33
2251 [crc32.c]
2252 remove extra spaces
0ca1dcaf 2253 - (djm) [auth.h dispatch.h kex.h] sprinkle in signal.h to get
2254 sig_atomic_t
ac93e676 2255
ef4d1846 225620060421
2257 - (djm) [Makefile.in configure.ac session.c sshpty.c]
2258 [contrib/redhat/sshd.init openbsd-compat/Makefile.in]
2259 [openbsd-compat/openbsd-compat.h openbsd-compat/port-linux.c]
2260 [openbsd-compat/port-linux.h] Add support for SELinux, setting
2261 the execution and TTY contexts. based on patch from Daniel Walsh,
2262 bz #880; ok dtucker@
2263
88680c8b 226420060418
ef4d1846 2265 - (djm) [canohost.c] Reorder IP options check so that it isn't broken
2266 by mapped addresses; bz #1179 reported by markw wtech-llc.com;
88680c8b 2267 ok dtucker@
2268
6a0984b4 226920060331
2270 - OpenBSD CVS Sync
2271 - deraadt@cvs.openbsd.org 2006/03/27 01:21:18
2272 [xmalloc.c]
2273 we can do the size & nmemb check before the integer overflow check;
2274 evol
fd06fbe0 2275 - deraadt@cvs.openbsd.org 2006/03/27 13:03:54
2276 [dh.c]
2277 use strtonum() instead of atoi(), limit dhg size to 64k; ok djm
e56b07ea 2278 - djm@cvs.openbsd.org 2006/03/27 23:15:46
2279 [sftp.c]
2280 always use a format string for addargs; spotted by mouring@
19e79961 2281 - deraadt@cvs.openbsd.org 2006/03/28 00:12:31
2282 [README.tun ssh.c]
2283 spacing
4f16046f 2284 - deraadt@cvs.openbsd.org 2006/03/28 01:52:28
2285 [channels.c]
2286 do not accept unreasonable X ports numbers; ok djm
cfaa5405 2287 - deraadt@cvs.openbsd.org 2006/03/28 01:53:43
2288 [ssh-agent.c]
2289 use strtonum() to parse the pid from the file, and range check it
2290 better; ok djm
04aa9e67 2291 - djm@cvs.openbsd.org 2006/03/30 09:41:25
2292 [channels.c]
2293 ARGSUSED for dispatch table-driven functions
51e7a012 2294 - djm@cvs.openbsd.org 2006/03/30 09:58:16
2295 [authfd.c bufaux.c deattack.c gss-serv.c mac.c misc.c misc.h]
2296 [monitor_wrap.c msg.c packet.c sftp-client.c sftp-server.c ssh-agent.c]
2297 replace {GET,PUT}_XXBIT macros with functionally similar functions,
2298 silencing a heap of lint warnings. also allows them to use
2299 __bounded__ checking which can't be applied to macros; requested
2300 by and feedback from deraadt@
8cffe22a 2301 - djm@cvs.openbsd.org 2006/03/30 10:41:25
2302 [ssh.c ssh_config.5]
2303 add percent escape chars to the IdentityFile option, bz #1159 based
2304 on a patch by imaging AT math.ualberta.ca; feedback and ok dtucker@
2ccf5424 2305 - dtucker@cvs.openbsd.org 2006/03/30 11:05:17
2306 [ssh-keygen.c]
2307 Correctly handle truncated files while converting keys; ok djm@
c023a130 2308 - dtucker@cvs.openbsd.org 2006/03/30 11:40:21
2309 [auth.c monitor.c]
2310 Prevent duplicate log messages when privsep=yes; ok djm@
99d18e3e 2311 - jmc@cvs.openbsd.org 2006/03/31 09:09:30
2312 [ssh_config.5]
2313 kill trailing whitespace;
b4d7dedd 2314 - djm@cvs.openbsd.org 2006/03/31 09:13:56
2315 [ssh_config.5]
2316 remote user escape is %r not %h; spotted by jmc@
6a0984b4 2317
3eff92ec 231820060326
2319 - OpenBSD CVS Sync
2320 - jakob@cvs.openbsd.org 2006/03/15 08:46:44
2321 [ssh-keygen.c]
2322 if no key file are given when printing the DNS host record, use the
2323 host key file(s) as default. ok djm@
d6157b67 2324 - biorn@cvs.openbsd.org 2006/03/16 10:31:45
2325 [scp.c]
2326 Try to display errormessage even if remout == -1
2327 ok djm@, markus@
9dfca510 2328 - djm@cvs.openbsd.org 2006/03/17 22:31:50
2329 [authfd.c]
2330 another unreachable found by lint
60ffd527 2331 - djm@cvs.openbsd.org 2006/03/17 22:31:11
2332 [authfd.c]
2333 unreachanble statement, found by lint
4113a1d7 2334 - djm@cvs.openbsd.org 2006/03/19 02:22:32
2335 [serverloop.c]
2336 memory leaks detected by Coverity via elad AT netbsd.org;
2337 ok deraadt@ dtucker@
e6a3cfb5 2338 - djm@cvs.openbsd.org 2006/03/19 02:22:56
2339 [sftp.c]
2340 more memory leaks detected by Coverity via elad AT netbsd.org;
2341 deraadt@ ok
f8f9ef4d 2342 - djm@cvs.openbsd.org 2006/03/19 02:23:26
2343 [hostfile.c]
2344 FILE* leak detected by Coverity via elad AT netbsd.org;
2345 ok deraadt@
88299971 2346 - djm@cvs.openbsd.org 2006/03/19 02:24:05
2347 [dh.c readconf.c servconf.c]
2348 potential NULL pointer dereferences detected by Coverity
2349 via elad AT netbsd.org; ok deraadt@
18fc231c 2350 - djm@cvs.openbsd.org 2006/03/19 07:41:30
2351 [sshconnect2.c]
2352 memory leaks detected by Coverity via elad AT netbsd.org;
2353 deraadt@ ok
0f8cd5a6 2354 - dtucker@cvs.openbsd.org 2006/03/19 11:51:52
2355 [servconf.c]
2356 Correct strdelim null test; ok djm@
c8e9c167 2357 - deraadt@cvs.openbsd.org 2006/03/19 18:52:11
2358 [auth1.c authfd.c channels.c]
2359 spacing
b4bbf172 2360 - deraadt@cvs.openbsd.org 2006/03/19 18:53:12
2361 [kex.c kex.h monitor.c myproposal.h session.c]
2362 spacing
3efa8ea9 2363 - deraadt@cvs.openbsd.org 2006/03/19 18:56:41
2364 [clientloop.c progressmeter.c serverloop.c sshd.c]
2365 ARGSUSED for signal handlers
6e56dc92 2366 - deraadt@cvs.openbsd.org 2006/03/19 18:59:49
2367 [ssh-keyscan.c]
2368 please lint
7de98c39 2369 - deraadt@cvs.openbsd.org 2006/03/19 18:59:30
2370 [ssh.c]
2371 spacing
c84ac6a4 2372 - deraadt@cvs.openbsd.org 2006/03/19 18:59:09
2373 [authfile.c]
2374 whoever thought that break after return was a good idea needs to
2375 get their head examimed
98d40a74 2376 - djm@cvs.openbsd.org 2006/03/20 04:09:44
2377 [monitor.c]
2378 memory leaks detected by Coverity via elad AT netbsd.org;
2379 deraadt@ ok
2380 that should be all of them now
7016f7cf 2381 - djm@cvs.openbsd.org 2006/03/20 11:38:46
2382 [key.c]
2383 (really) last of the Coverity diffs: avoid possible NULL deref in
2384 key_free. via elad AT netbsd.org; markus@ ok
5ef36928 2385 - deraadt@cvs.openbsd.org 2006/03/20 17:10:19
2386 [auth.c key.c misc.c packet.c ssh-add.c]
2387 in a switch (), break after return or goto is stupid
353d48db 2388 - deraadt@cvs.openbsd.org 2006/03/20 17:13:16
2389 [key.c]
2390 djm did a typo
952fce1b 2391 - deraadt@cvs.openbsd.org 2006/03/20 17:17:23
2392 [ssh-rsa.c]
2393 in a switch (), break after return or goto is stupid
148de80c 2394 - deraadt@cvs.openbsd.org 2006/03/20 18:14:02
b3b6f53d 2395 [channels.c clientloop.c monitor_wrap.c monitor_wrap.h serverloop.c]
2396 [ssh.c sshpty.c sshpty.h]
148de80c 2397 sprinkle u_int throughout pty subsystem, ok markus
fe8c3af1 2398 - deraadt@cvs.openbsd.org 2006/03/20 18:17:20
2399 [auth1.c auth2.c sshd.c]
2400 sprinkle some ARGSUSED for table driven functions (which sometimes
2401 must ignore their args)
32596c7b 2402 - deraadt@cvs.openbsd.org 2006/03/20 18:26:55
2403 [channels.c monitor.c session.c session.h ssh-agent.c ssh-keygen.c]
2404 [ssh-rsa.c ssh.c sshlogin.c]
2405 annoying spacing fixes getting in the way of real diffs
b248a875 2406 - deraadt@cvs.openbsd.org 2006/03/20 18:27:50
2407 [monitor.c]
2408 spacing
338eb2ab 2409 - deraadt@cvs.openbsd.org 2006/03/20 18:35:12
2410 [channels.c]
2411 x11_fake_data is only ever used as u_char *
0bcc3e35 2412 - deraadt@cvs.openbsd.org 2006/03/20 18:41:43
2413 [dns.c]
2414 cast xstrdup to propert u_char *
9555d258 2415 - deraadt@cvs.openbsd.org 2006/03/20 18:42:27
2416 [canohost.c match.c ssh.c sshconnect.c]
2417 be strict with tolower() casting
a7137f6b 2418 - deraadt@cvs.openbsd.org 2006/03/20 18:48:34
2419 [channels.c fatal.c kex.c packet.c serverloop.c]
2420 spacing
1cec12db 2421 - deraadt@cvs.openbsd.org 2006/03/20 21:11:53
2422 [ttymodes.c]
2423 spacing
52e3daed 2424 - djm@cvs.openbsd.org 2006/03/25 00:05:41
2425 [auth-bsdauth.c auth-skey.c auth.c auth2-chall.c channels.c]
2426 [clientloop.c deattack.c gss-genr.c kex.c key.c misc.c moduli.c]
2427 [monitor.c monitor_wrap.c packet.c scard.c sftp-server.c ssh-agent.c]
2428 [ssh-keyscan.c ssh.c sshconnect.c sshconnect2.c sshd.c uuencode.c]
2429 [xmalloc.c xmalloc.h]
2430 introduce xcalloc() and xasprintf() failure-checked allocations
2431 functions and use them throughout openssh
2432
2433 xcalloc is particularly important because malloc(nmemb * size) is a
2434 dangerous idiom (subject to integer overflow) and it is time for it
2435 to die
2436
2437 feedback and ok deraadt@
c5d10563 2438 - djm@cvs.openbsd.org 2006/03/25 01:13:23
2439 [buffer.c channels.c deattack.c misc.c scp.c session.c sftp-client.c]
2440 [sftp-server.c ssh-agent.c ssh-rsa.c xmalloc.c xmalloc.h auth-pam.c]
2441 [uidswap.c]
2442 change OpenSSH's xrealloc() function from being xrealloc(p, new_size)
2443 to xrealloc(p, new_nmemb, new_itemsize).
2444
2445 realloc is particularly prone to integer overflows because it is
2446 almost always allocating "n * size" bytes, so this is a far safer
2447 API; ok deraadt@
522327f5 2448 - djm@cvs.openbsd.org 2006/03/25 01:30:23
2449 [sftp.c]
2450 "abormally" is a perfectly cromulent word, but "abnormally" is better
c1cb7bae 2451 - djm@cvs.openbsd.org 2006/03/25 13:17:03
6ba5f28f 2452 [atomicio.c auth-bsdauth.c auth-chall.c auth-options.c auth-passwd.c]
2453 [auth-rh-rsa.c auth-rhosts.c auth-rsa.c auth-skey.c auth.c auth1.c]
2454 [auth2-chall.c auth2-hostbased.c auth2-kbdint.c auth2-none.c]
2455 [auth2-passwd.c auth2-pubkey.c auth2.c authfd.c authfile.c bufaux.c]
2456 [buffer.c canohost.c channels.c cipher-3des1.c cipher-bf1.c]
2457 [cipher-ctr.c cipher.c cleanup.c clientloop.c compat.c compress.c]
2458 [deattack.c dh.c dispatch.c fatal.c groupaccess.c hostfile.c kex.c]
2459 [kexdh.c kexdhc.c kexdhs.c kexgex.c kexgexc.c kexgexs.c key.c log.c]
2460 [mac.c match.c md-sha256.c misc.c monitor.c monitor_fdpass.c]
2461 [monitor_mm.c monitor_wrap.c msg.c nchan.c packet.c progressmeter.c]
2462 [readconf.c readpass.c rsa.c scard.c scp.c servconf.c serverloop.c]
2463 [session.c sftp-client.c sftp-common.c sftp-glob.c sftp-server.c]
2464 [sftp.c ssh-add.c ssh-agent.c ssh-dss.c ssh-keygen.c ssh-keyscan.c]
2465 [ssh-keysign.c ssh-rsa.c ssh.c sshconnect.c sshconnect1.c]
2466 [sshconnect2.c sshd.c sshlogin.c sshpty.c sshtty.c ttymodes.c]
2467 [uidswap.c uuencode.c xmalloc.c]
c1cb7bae 2468 Put $OpenBSD$ tags back (as comments) to replace the RCSID()s that
2469 Theo nuked - our scripts to sync -portable need them in the files
febd6f21 2470 - deraadt@cvs.openbsd.org 2006/03/25 18:29:35
2471 [auth-rsa.c authfd.c packet.c]
2472 needed casts (always will be needed)
b476adfa 2473 - deraadt@cvs.openbsd.org 2006/03/25 18:30:55
2474 [clientloop.c serverloop.c]
2475 spacing
306f24ca 2476 - deraadt@cvs.openbsd.org 2006/03/25 18:36:15
2477 [sshlogin.c sshlogin.h]
2478 nicer size_t and time_t types
0fe9892f 2479 - deraadt@cvs.openbsd.org 2006/03/25 18:40:14
2480 [ssh-keygen.c]
2481 cast strtonum() result to right type
8d0b0353 2482 - deraadt@cvs.openbsd.org 2006/03/25 18:41:45
2483 [ssh-agent.c]
2484 mark two more signal handlers ARGSUSED
d6d4897e 2485 - deraadt@cvs.openbsd.org 2006/03/25 18:43:30
2486 [channels.c]
2487 use strtonum() instead of atoi() [limit X screens to 400, sorry]
15dd2c4f 2488 - deraadt@cvs.openbsd.org 2006/03/25 18:56:55
2489 [bufaux.c channels.c packet.c]
2490 remove (char *) casts to a function that accepts void * for the arg
5b5f6af7 2491 - deraadt@cvs.openbsd.org 2006/03/25 18:58:10
2492 [channels.c]
2493 delete cast not required
56f824f3 2494 - djm@cvs.openbsd.org 2006/03/25 22:22:43
2495 [atomicio.h auth-options.h auth.h auth2-gss.c authfd.h authfile.h]
2496 [bufaux.h buffer.h canohost.h channels.h cipher.h clientloop.h]
2497 [compat.h compress.h crc32.c crc32.h deattack.h dh.h dispatch.h]
2498 [dns.c dns.h getput.h groupaccess.h gss-genr.c gss-serv-krb5.c]
2499 [gss-serv.c hostfile.h includes.h kex.h key.h log.h mac.h match.h]
2500 [misc.h monitor.h monitor_fdpass.h monitor_mm.h monitor_wrap.h msg.h]
2501 [myproposal.h packet.h pathnames.h progressmeter.h readconf.h rsa.h]
2502 [scard.h servconf.h serverloop.h session.h sftp-common.h sftp.h]
2503 [ssh-gss.h ssh.h ssh1.h ssh2.h sshconnect.h sshlogin.h sshpty.h]
2504 [ttymodes.h uidswap.h uuencode.h xmalloc.h]
2505 standardise spacing in $OpenBSD$ tags; requested by deraadt@
9594740b 2506 - deraadt@cvs.openbsd.org 2006/03/26 01:31:48
2507 [uuencode.c]
2508 typo
3eff92ec 2509
df938409 251020060325
2511 - OpenBSD CVS Sync
2512 - djm@cvs.openbsd.org 2006/03/16 04:24:42
2513 [ssh.1]
2514 Add RFC4419 (Diffie-Hellman group exchange KEX) to the list of SSH RFCs
2515 that OpenSSH supports
a92a0909 2516 - deraadt@cvs.openbsd.org 2006/03/19 18:51:18
2517 [atomicio.c auth-bsdauth.c auth-chall.c auth-krb5.c auth-options.c]
2518 [auth-pam.c auth-passwd.c auth-rh-rsa.c auth-rhosts.c auth-rsa.c]
2519 [auth-shadow.c auth-skey.c auth.c auth1.c auth2-chall.c]
2520 [auth2-hostbased.c auth2-kbdint.c auth2-none.c auth2-passwd.c]
2521 [auth2-pubkey.c auth2.c authfd.c authfile.c bufaux.c buffer.c]
2522 [canohost.c channels.c cipher-3des1.c cipher-acss.c cipher-aes.c]
2523 [cipher-bf1.c cipher-ctr.c cipher.c cleanup.c clientloop.c compat.c]
2524 [compress.c deattack.c dh.c dispatch.c dns.c entropy.c fatal.c]
2525 [groupaccess.c hostfile.c includes.h kex.c kexdh.c kexdhc.c]
2526 [kexdhs.c kexgex.c kexgexc.c kexgexs.c key.c log.c loginrec.c]
2527 [loginrec.h logintest.c mac.c match.c md-sha256.c md5crypt.c misc.c]
2528 [monitor.c monitor_fdpass.c monitor_mm.c monitor_wrap.c msg.c]
2529 [nchan.c packet.c progressmeter.c readconf.c readpass.c rsa.c]
2530 [scard.c scp.c servconf.c serverloop.c session.c sftp-client.c]
2531 [sftp-common.c sftp-glob.c sftp-server.c sftp.c ssh-add.c]
2532 [ssh-agent.c ssh-dss.c ssh-keygen.c ssh-keyscan.c ssh-keysign.c]
2533 [ssh-rand-helper.c ssh-rsa.c ssh.c sshconnect.c sshconnect1.c]
2534 [sshconnect2.c sshd.c sshlogin.c sshpty.c sshtty.c ttymodes.c]
2535 [uidswap.c uuencode.c xmalloc.c openbsd-compat/bsd-arc4random.c]
2536 [openbsd-compat/bsd-closefrom.c openbsd-compat/bsd-cygwin_util.c]
2537 [openbsd-compat/bsd-getpeereid.c openbsd-compat/bsd-misc.c]
2538 [openbsd-compat/bsd-nextstep.c openbsd-compat/bsd-snprintf.c]
2539 [openbsd-compat/bsd-waitpid.c openbsd-compat/fake-rfc2553.c]
2540 RCSID() can die
0e03e3d0 2541 - deraadt@cvs.openbsd.org 2006/03/19 18:53:12
2542 [kex.h myproposal.h]
2543 spacing
0fa53840 2544 - djm@cvs.openbsd.org 2006/03/20 04:07:22
2545 [auth2-gss.c]
2546 GSSAPI related leaks detected by Coverity via elad AT netbsd.org;
2547 reviewed by simon AT sxw.org.uk; deraadt@ ok
0926fd19 2548 - djm@cvs.openbsd.org 2006/03/20 04:07:49
2549 [gss-genr.c]
2550 more GSSAPI related leaks detected by Coverity via elad AT netbsd.org;
2551 reviewed by simon AT sxw.org.uk; deraadt@ ok
7cd30d48 2552 - djm@cvs.openbsd.org 2006/03/20 04:08:18
2553 [gss-serv.c]
2554 last lot of GSSAPI related leaks detected by Coverity via
2555 elad AT netbsd.org; reviewed by simon AT sxw.org.uk; deraadt@ ok
97f67e9a 2556 - deraadt@cvs.openbsd.org 2006/03/20 18:14:02
2557 [monitor_wrap.h sshpty.h]
2558 sprinkle u_int throughout pty subsystem, ok markus
fd6eaa8c 2559 - deraadt@cvs.openbsd.org 2006/03/20 18:26:55
2560 [session.h]
2561 annoying spacing fixes getting in the way of real diffs
6cfe93ec 2562 - deraadt@cvs.openbsd.org 2006/03/20 18:41:43
2563 [dns.c]
2564 cast xstrdup to propert u_char *
f0eea41f 2565 - jakob@cvs.openbsd.org 2006/03/22 21:16:24
2566 [ssh.1]
2567 simplify SSHFP example; ok jmc@
69753336 2568 - djm@cvs.openbsd.org 2006/03/22 21:27:15
2569 [deattack.c deattack.h]
2570 remove IV support from the CRC attack detector, OpenSSH has never used
2571 it - it only applied to IDEA-CFB, which we don't support.
2572 prompted by NetBSD Coverity report via elad AT netbsd.org;
2573 feedback markus@ "nuke it" deraadt@
df938409 2574
08a3f952 257520060318
7f38714e 2576 - (djm) [auth-pam.c] Fix memleak in error path, from Coverity via
2577 elad AT NetBSD.org
2578 - (dtucker) [openbsd-compat/bsd-snprintf.c] Bug #1173: make fmtint() take
2579 a LLONG rather than a long. Fixes scp'ing of large files on platforms
2580 with missing/broken snprintfs. Patch from e.borovac at bom.gov.au.
08a3f952 2581
32b0131a 258220060316
2583 - (dtucker) [entropy.c] Add headers for WIFEXITED and friends.
2f360c89 2584 - (dtucker) [configure.ac md-sha256.c] NetBSD has sha2.h in
2585 /usr/include/crypto. Hint from djm@.
b1f0c612 2586 - (tim) [kex.c myproposal.h md-sha256.c openbsd-compat/sha2.c,h]
2587 Disable sha256 when openssl < 0.9.7. Patch from djm@.
30baf904 2588 - (djm) [kex.c] Slightly more clean deactivation of dhgex-sha256 on old
2589 OpenSSL; ok tim
32b0131a 2590
0ac58ab4 259120060315
2592 - (djm) OpenBSD CVS Sync:
2593 - msf@cvs.openbsd.org 2006/02/06 15:54:07
2594 [ssh.1]
2595 - typo fix
2596 ok jmc@
260c414c 2597 - jmc@cvs.openbsd.org 2006/02/06 21:44:47
2598 [ssh.1]
2599 make this a little less ambiguous...
c38f5d19 2600 - stevesk@cvs.openbsd.org 2006/02/07 01:08:04
2601 [auth-rhosts.c includes.h]
2602 move #include <netgroup.h> out of includes.h; ok markus@
c3ff311a 2603 - stevesk@cvs.openbsd.org 2006/02/07 01:18:09
2604 [includes.h ssh-agent.c ssh-keyscan.c sshconnect2.c]
2605 move #include <sys/queue.h> out of includes.h; ok markus@
1d3e026f 2606 - stevesk@cvs.openbsd.org 2006/02/07 01:42:00
2607 [channels.c clientloop.c clientloop.h includes.h packet.h]
2608 [serverloop.c sshpty.c sshpty.h sshtty.c ttymodes.c]
2609 move #include <termios.h> out of includes.h; ok markus@
99f28949 2610 - stevesk@cvs.openbsd.org 2006/02/07 01:52:50
2611 [sshtty.c]
2612 "log.h" not needed
cc63c340 2613 - stevesk@cvs.openbsd.org 2006/02/07 03:47:05
2614 [hostfile.c]
2615 "packet.h" not needed
db5a9db9 2616 - stevesk@cvs.openbsd.org 2006/02/07 03:59:20
2617 [deattack.c]
2618 duplicate #include
a75f5360 2619 - stevesk@cvs.openbsd.org 2006/02/08 12:15:27
2620 [auth.c clientloop.c includes.h misc.c monitor.c readpass.c]
2621 [session.c sftp.c ssh-agent.c ssh-keysign.c ssh.c sshconnect.c]
2622 [sshd.c sshpty.c]
2623 move #include <paths.h> out of includes.h; ok markus@
6425cf65 2624 - stevesk@cvs.openbsd.org 2006/02/08 12:32:49
2625 [includes.h misc.c]
2626 move #include <netinet/tcp.h> out of includes.h; ok markus@
1720c23b 2627 - stevesk@cvs.openbsd.org 2006/02/08 13:15:44
2628 [gss-serv.c monitor.c]
2629 small KNF
5b984d1d 2630 - stevesk@cvs.openbsd.org 2006/02/08 14:16:59
2631 [sshconnect.c]
2632 <openssl/bn.h> not needed
876faccd 2633 - stevesk@cvs.openbsd.org 2006/02/08 14:31:30
2634 [includes.h ssh-agent.c ssh-keyscan.c ssh.c]
2635 move #include <sys/resource.h> out of includes.h; ok markus@
a3dcf543 2636 - stevesk@cvs.openbsd.org 2006/02/08 14:38:18
2637 [includes.h packet.c]
2638 move #include <netinet/in_systm.h> and <netinet/ip.h> out of
2639 includes.h; ok markus@
68e39d38 2640 - stevesk@cvs.openbsd.org 2006/02/08 23:51:24
2641 [includes.h scp.c sftp-glob.c sftp-server.c]
2642 move #include <dirent.h> out of includes.h; ok markus@
bbb1501d 2643 - stevesk@cvs.openbsd.org 2006/02/09 00:32:07
2644 [includes.h]
2645 #include <sys/endian.h> not needed; ok djm@
2646 NB. ID Sync only - we still need this (but it may move later)
4eb67845 2647 - jmc@cvs.openbsd.org 2006/02/09 10:10:47
2648 [sshd.8]
2649 - move some text into a CAVEATS section
2650 - merge the COMMAND EXECUTION... section into AUTHENTICATION
bd7c69ea 2651 - stevesk@cvs.openbsd.org 2006/02/10 00:27:13
2652 [channels.c clientloop.c includes.h misc.c progressmeter.c sftp.c]
2653 [ssh.c sshd.c sshpty.c]
2654 move #include <sys/ioctl.h> out of includes.h; ok markus@
aa2eae64 2655 - stevesk@cvs.openbsd.org 2006/02/10 01:44:27
2656 [includes.h monitor.c readpass.c scp.c serverloop.c session.c\7f]
2657 [sftp.c sshconnect.c sshconnect2.c sshd.c]
2658 move #include <sys/wait.h> out of includes.h; ok markus@
cfb9181c 2659 - otto@cvs.openbsd.org 2006/02/11 19:31:18
2660 [atomicio.c]
2661 type correctness; from Ray Lai in PR 5011; ok millert@
f7b8224d 2662 - djm@cvs.openbsd.org 2006/02/12 06:45:34
2663 [ssh.c ssh_config.5]
2664 add a %l expansion code to the ControlPath, which is filled in with the
2665 local hostname at runtime. Requested by henning@ to avoid some problems
2666 with /home on NFS; ok dtucker@
129d5252 2667 - djm@cvs.openbsd.org 2006/02/12 10:44:18
2668 [readconf.c]
2669 raise error when the user specifies a RekeyLimit that is smaller than 16
2670 (the smallest of our cipher's blocksize) or big enough to cause integer
2671 wraparound; ok & feedback dtucker@
5e7007ea 2672 - jmc@cvs.openbsd.org 2006/02/12 10:49:44
2673 [ssh_config.5]
2674 slight rewording; ok djm
010c04e5 2675 - jmc@cvs.openbsd.org 2006/02/12 10:52:41
2676 [sshd.8]
2677 rework the description of authorized_keys a little;
9ed4bd80 2678 - jmc@cvs.openbsd.org 2006/02/12 17:57:19
2679 [sshd.8]
2680 sort the list of options permissable w/ authorized_keys;
2681 ok djm dtucker
1e0fcfc6 2682 - jmc@cvs.openbsd.org 2006/02/13 10:16:39
2683 [sshd.8]
2684 no need to subsection the authorized_keys examples - instead, convert
2685 this to look like an actual file. also use proto 2 keys, and use IETF
2686 example addresses;
2881e0e9 2687 - jmc@cvs.openbsd.org 2006/02/13 10:21:25
2688 [sshd.8]
2689 small tweaks for the ssh_known_hosts section;
9d4b0313 2690 - jmc@cvs.openbsd.org 2006/02/13 11:02:26
2691 [sshd.8]
2692 turn this into an example ssh_known_hosts file; ok djm
481e991f 2693 - jmc@cvs.openbsd.org 2006/02/13 11:08:43
2694 [sshd.8]
2695 - avoid nasty line split
2696 - `*' does not need to be escaped
10fa86ae 2697 - jmc@cvs.openbsd.org 2006/02/13 11:27:25
2698 [sshd.8]
2699 sort FILES and use a -compact list;
2db34ac9 2700 - david@cvs.openbsd.org 2006/02/15 05:08:24
2701 [sftp-client.c]
2702 typo in comment; ok djm@
0e505e42 2703 - jmc@cvs.openbsd.org 2006/02/15 16:53:20
2704 [ssh.1]
2705 remove the IETF draft references and replace them with some updated RFCs;
2866aceb 2706 - jmc@cvs.openbsd.org 2006/02/15 16:55:33
2707 [sshd.8]
2708 remove ietf draft references; RFC list now maintained in ssh.1;
00e7c607 2709 - jmc@cvs.openbsd.org 2006/02/16 09:05:34
2710 [sshd.8]
2711 sync some of the FILES entries w/ ssh.1;
f3d2d92e 2712 - jmc@cvs.openbsd.org 2006/02/19 19:52:10
2713 [sshd.8]
2714 move the sshrc stuff out of FILES, and into its own section:
2715 FILES is not a good place to document how stuff works;
e56bbe08 2716 - jmc@cvs.openbsd.org 2006/02/19 20:02:17
2717 [sshd.8]
2718 sync the (s)hosts.equiv FILES entries w/ those from ssh.1;
3783659a 2719 - jmc@cvs.openbsd.org 2006/02/19 20:05:00
2720 [sshd.8]
2721 grammar;
922f8f17 2722 - jmc@cvs.openbsd.org 2006/02/19 20:12:25
2723 [ssh_config.5]
2724 add some vertical space;
cebb4c24 2725 - stevesk@cvs.openbsd.org 2006/02/20 16:36:15
2726 [authfd.c channels.c includes.h session.c ssh-agent.c ssh.c]
2727 move #include <sys/un.h> out of includes.h; ok djm@
4095f623 2728 - stevesk@cvs.openbsd.org 2006/02/20 17:02:44
2729 [clientloop.c includes.h monitor.c progressmeter.c scp.c]
2730 [serverloop.c session.c sftp.c ssh-agent.c ssh.c sshd.c]
2731 move #include <signal.h> out of includes.h; ok markus@
ada68823 2732 - stevesk@cvs.openbsd.org 2006/02/20 17:19:54
2733 [auth-rhosts.c auth-rsa.c auth.c auth2-none.c auth2-pubkey.c]
2734 [authfile.c clientloop.c includes.h readconf.c scp.c session.c]
2735 [sftp-client.c sftp-common.c sftp-common.h sftp-glob.c]
2736 [sftp-server.c sftp.c ssh-add.c ssh-keygen.c ssh.c sshconnect.c]
2737 [sshconnect2.c sshd.c sshpty.c]
2738 move #include <sys/stat.h> out of includes.h; ok markus@
b6438382 2739 - stevesk@cvs.openbsd.org 2006/02/22 00:04:45
2740 [canohost.c clientloop.c includes.h match.c readconf.c scp.c ssh.c]
2741 [sshconnect.c]
2742 move #include <ctype.h> out of includes.h; ok djm@
95d46d8f 2743 - jmc@cvs.openbsd.org 2006/02/24 10:25:14
2744 [ssh_config.5]
2745 add section on patterns;
2746 from dtucker + myself
ac1ec4d8 2747 - jmc@cvs.openbsd.org 2006/02/24 10:33:54
2748 [sshd_config.5]
2749 signpost to PATTERNS;
436a5ff9 2750 - jmc@cvs.openbsd.org 2006/02/24 10:37:07
2751 [ssh_config.5]
2752 tidy up the refs to PATTERNS;
4cb23985 2753 - jmc@cvs.openbsd.org 2006/02/24 10:39:52
2754 [sshd.8]
2755 signpost to PATTERNS section;
340a4caf 2756 - jmc@cvs.openbsd.org 2006/02/24 20:22:16
2757 [ssh-keysign.8 ssh_config.5 sshd_config.5]
2758 some consistency fixes;
f09ffbdb 2759 - jmc@cvs.openbsd.org 2006/02/24 20:31:31
2760 [ssh.1 ssh_config.5 sshd.8 sshd_config.5]
2761 more consistency fixes;
c5786b30 2762 - jmc@cvs.openbsd.org 2006/02/24 23:20:07
2763 [ssh_config.5]
2764 some grammar/wording fixes;
b74c3b8c 2765 - jmc@cvs.openbsd.org 2006/02/24 23:43:57
2766 [sshd_config.5]
2767 some grammar/wording fixes;
32cfd177 2768 - jmc@cvs.openbsd.org 2006/02/24 23:51:17
2769 [sshd_config.5]
2770 oops - bits i missed;
2963b207 2771 - jmc@cvs.openbsd.org 2006/02/25 12:26:17
2772 [ssh_config.5]
2773 document the possible values for KbdInteractiveDevices;
84c1b530 2774 help/ok dtucker
2775 - jmc@cvs.openbsd.org 2006/02/25 12:28:34
2776 [sshd_config.5]
2777 document the order in which allow/deny directives are processed;
a269663f 2778 help/ok dtucker
de4f5093 2779 - jmc@cvs.openbsd.org 2006/02/26 17:17:18
2780 [ssh_config.5]
2781 move PATTERNS to the end of the main body; requested by dtucker
ef1c6497 2782 - jmc@cvs.openbsd.org 2006/02/26 18:01:13
2783 [sshd_config.5]
2784 subsection is pointless here;
c04ba6a6 2785 - jmc@cvs.openbsd.org 2006/02/26 18:03:10
2786 [ssh_config.5]
2787 comma;
8b6bf4d5 2788 - djm@cvs.openbsd.org 2006/02/28 01:10:21
2789 [session.c]
2790 fix logout recording when privilege separation is disabled, analysis and
2791 patch from vinschen at redhat.com; tested by dtucker@ ok deraadt@
2792 NB. ID sync only - patch already in portable
140000b4 2793 - djm@cvs.openbsd.org 2006/03/04 04:12:58
2794 [serverloop.c]
2795 move a debug() outside of a signal handler; ok markus@ a little while back
16a5525d 2796 - djm@cvs.openbsd.org 2006/03/12 04:23:07
2797 [ssh.c]
2798 knf nit
9f513268 2799 - djm@cvs.openbsd.org 2006/03/13 08:16:00
2800 [sshd.c]
2801 don't log that we are listening on a socket before the listen() call
2802 actually succeeds, bz #1162 reported by Senthil Kumar; ok dtucker@
71f0de56 2803 - dtucker@cvs.openbsd.org 2006/03/13 08:33:00
2804 [packet.c]
2805 Set TCP_NODELAY for all connections not just "interactive" ones. Fixes
2806 poor performance and protocol stalls under some network conditions (mindrot
2807 bugs #556 and #981). Patch originally from markus@, ok djm@
15b81af3 2808 - dtucker@cvs.openbsd.org 2006/03/13 08:43:16
2809 [ssh-keygen.c]
2810 Make ssh-keygen handle CR and CRLF line termination when converting IETF
2811 format keys, in adition to vanilla LF. mindrot #1157, tested by Chris
2812 Pepper, ok djm@
533b9133 2813 - dtucker@cvs.openbsd.org 2006/03/13 10:14:29
2814 [misc.c ssh_config.5 sshd_config.5]
2815 Allow config directives to contain whitespace by surrounding them by double
2816 quotes. mindrot #482, man page help from jmc@, ok djm@
45660a22 2817 - dtucker@cvs.openbsd.org 2006/03/13 10:26:52
2818 [authfile.c authfile.h ssh-add.c]
2819 Make ssh-add check file permissions before attempting to load private
2820 key files multiple times; it will fail anyway and this prevents confusing
2821 multiple prompts and warnings. mindrot #1138, ok djm@
22aa23f8 2822 - djm@cvs.openbsd.org 2006/03/14 00:15:39
2823 [canohost.c]
2824 log the originating address and not just the name when a reverse
2825 mapping check fails, requested by linux AT linuon.com
2d762582 2826 - markus@cvs.openbsd.org 2006/03/14 16:32:48
2827 [ssh_config.5 sshd_config.5]
2828 *AliveCountMax applies to protcol v2 only; ok dtucker, djm
2ff8003a 2829 - djm@cvs.openbsd.org 2006/03/07 09:07:40
2830 [kex.c kex.h monitor.c myproposal.h ssh-keyscan.c sshconnect2.c sshd.c]
2831 Implement the diffie-hellman-group-exchange-sha256 key exchange method
2832 using the SHA256 code in libc (and wrapper to make it into an OpenSSL
2833 EVP), interop tested against CVS PuTTY
2834 NB. no portability bits committed yet
13ff27b7 2835 - (djm) [configure.ac defines.h kex.c md-sha256.c]
2836 [openbsd-compat/sha2.h openbsd-compat/openbsd-compat.h]
2837 [openbsd-compat/sha2.c] First stab at portability glue for SHA256
2838 KEX support, should work with libc SHA256 support or OpenSSL
2839 EVP_sha256 if present
1a6e2ed1 2840 - (djm) [includes.h] Restore accidentally dropped netinet/in.h
d3c45531 2841 - (djm) [Makefile.in openbsd-compat/Makefile.in] Add added files
f73e2ad7 2842 - (djm) [md-sha256.c configure.ac] md-sha256.c needs sha2.h if present
53a9f480 2843 - (djm) [regress/.cvsignore] Ignore Makefile here
81e73e57 2844 - (djm) [loginrec.c] Need stat.h
6c3a432e 2845 - (djm) [openbsd-compat/sha2.h] Avoid include macro clash with
2846 system sha2.h
cb2c6179 2847 - (djm) [ssh-rand-helper.c] Needs a bunch of headers
3e598f1a 2848 - (djm) [ssh-agent.c] Restore dropped stat.h
3070c7e1 2849 - (djm) [openbsd-compat/sha2.h openbsd-compat/sha2.c] Comment out
2850 SHA384, which we don't need and doesn't compile without tweaks
b5b88c19 2851 - (djm) [auth-pam.c clientloop.c includes.h monitor.c session.c]
2852 [sftp-client.c ssh-keysign.c ssh.c sshconnect.c sshconnect2.c]
2853 [sshd.c openbsd-compat/bsd-misc.c openbsd-compat/bsd-openpty.c]
2854 [openbsd-compat/glob.c openbsd-compat/mktemp.c]
2855 [openbsd-compat/readpassphrase.c] Lots of include fixes for
2856 OpenSolaris
b481f63d 2857 - (tim) [includes.h] put sys/stat.h back in to quiet some "macro redefined:"
3e9b2b1b 2858 - (tim) [openssh/sshpty.c openssh/openbsd-compat/port-tun.c] put in some
2859 includes removed from includes.h
d90b9f9a 2860 - (dtucker) [configure.ac] Fix glob test conversion to AC_TRY_COMPILE
b02dadfc 2861 - (djm) [includes.h] Put back paths.h, it is needed in defines.h
d4bf5977 2862 - (dtucker) [openbsd-compat/openbsd-compat.h] AIX (at least) needs
2863 sys/ioctl.h for struct winsize.
3919d576 2864 - (dtucker) [configure.ac] login_cap.h requires sys/types.h on NetBSD.
0ac58ab4 2865
055252ed 286620060313
2867 - (dtucker) [configure.ac] Bug #1171: Don't use printf("%lld", longlong)
2868 since not all platforms support it. Instead, use internal equivalent while
2869 computing LLONG_MIN and LLONG_MAX. Remove special case for alpha-dec-osf*
2870 as it's no longer required. Tested by Bernhard Simon, ok djm@
2871
f9b93ff8 287220060304
2873 - (dtucker) [contrib/cygwin/ssh-host-config] Require use of lastlog as a
2874 file rather than directory, required as Cygwin will be importing lastlog(1).
2875 Also tightens up permissions on the file. Patch from vinschen@redhat.com.
a8d3dd47 2876 - (dtucker) [gss-serv-krb5.c] Bug #1166: Correct #ifdefs for gssapi_krb5.h
2877 includes. Patch from gentoo.riverrat at gmail.com.
f9b93ff8 2878
49c64dd6 287920060226
2880 - (dtucker) [configure.ac] Bug #1156: QNX apparently needs SSHD_ACQUIRES_CTTY
2881 patch from kraai at ftbfs.org.
2882
288320060223
05059810 2884 - (dtucker) [sshd_config sshd_config.5] Update UsePAM to reflect current
2885 reality. Pointed out by tryponraj at gmail.com.
2886
49c64dd6 288720060222
0244ad55 2888 - (dtucker) [openbsd-compat/openssl-compat.{c,h}] Minor tidy up: only
2889 compile in compat code if required.
2890
15101d77 289120060221
2892 - (dtucker) [openbsd-compat/openssl-compat.h] Prevent warning about
2893 redefinition of SSLeay_add_all_algorithms.
2894
c7ad0d99 289520060220
2896 - (dtucker) [INSTALL configure.ac openbsd-compat/openssl-compat.{c,h}]
2897 Add optional enabling of OpenSSL's (hardware) Engine support, via
2898 configure --with-ssl-engine. Based in part on a diff by michal at
2899 logix.cz.
2900
46096a5b 290120060219
2902 - (dtucker) [Makefile.in configure.ac, added openbsd-compat/regress/]
2903 Add first attempt at regress tests for compat library. ok djm@
2904
103ff395 290520060214
2906 - (tim) [buildpkg.sh.in] Make the names consistent.
2907 s/pkg_post_make_install_fixes.sh/pkg-post-make-install-fixes.sh/ OK dtucker@
2908
06a517d4 290920060212
2910 - (dtucker) [openbsd-compat/bsd-cygwin_util.c] Make loop counter unsigned
2911 to silence compiler warning, from vinschen at redhat.com.
0c7e8877 2912 - (tim) [configure.ac] Bug #1149. Disable /etc/default/login check for QNX.
9603096f 2913 - (dtucker) [README version.h contrib/caldera/openssh.spec
2914 contrib/redhat/openssh.spec contrib/suse/openssh.spec] Bump version
2915 strings to match 4.3p2 release.
06a517d4 2916
4c721c3d 291720060208
2918 - (tim) [session.c] Logout records were not updated on systems with
2919 post auth privsep disabled due to bug 1086 changes. Analysis and patch
2920 by vinschen at redhat.com. OK tim@, dtucker@.
4b2cf3f1 2921 - (dtucker) [configure.ac] Typo in Ultrix and NewsOS sections (NEED_SETPRGP
8753ef06 2922 -> NEED_SETPGRP), reported by Bernhard Simon. ok tim@
4c721c3d 2923
5679f14d 292420060206
2925 - (tim) [configure.ac] Remove unnecessary tests for net/if.h and
2926 netinet/in_systm.h. OK dtucker@.
2927
823221b2 292820060205
2929 - (tim) [configure.ac] Add AC_REVISION. Add sys/time.h to lastlog.h test
2930 for Solaris. OK dtucker@.
9c54c067 2931 - (tim) [configure.ac] Bug #1149. Changes in QNX section only. Patch by
2932 kraai at ftbfs.org.
823221b2 2933
c9ecc3c7 293420060203
2935 - (tim) [configure.ac] test for egrep (AC_PROG_EGREP) before first
2936 AC_CHECK_HEADERS test. Without it, if AC_CHECK_HEADERS is first run
2937 by a platform specific check, builtin standard includes tests will be
2938 skipped on the other platforms.
2939 Analysis and suggestion by vinschen at redhat.com, patch by dtucker@.
2940 OK tim@, djm@.
2941
300ea548 294220060202
2943 - (dtucker) [configure.ac] Bug #1148: Fix "crippled AES" test so that it
2944 works with picky compilers. Patch from alex.kiernan at thus.net.
2945
0ceedd4e 294620060201
2947 - (djm) [regress/test-exec.sh] Try 'logname' as well as 'whoami' to
2948 determine the user's login name - needed for regress tests on Solaris
2949 10 and OpenSolaris
f3906047 2950 - (djm) OpenBSD CVS Sync
2951 - jmc@cvs.openbsd.org 2006/02/01 09:06:50
2952 [sshd.8]
2953 - merge sections on protocols 1 and 2 into a single section
2954 - remove configuration file section
2955 ok markus
170c69ba 2956 - jmc@cvs.openbsd.org 2006/02/01 09:11:41
2957 [sshd.8]
2958 small tweak;
026be201 2959 - (djm) [contrib/caldera/openssh.spec contrib/redhat/openssh.spec]
2960 [contrib/suse/openssh.spec] Update versions ahead of release
ac07067e 2961 - markus@cvs.openbsd.org 2006/02/01 11:27:22
2962 [version.h]
2963 openssh 4.3
2ac31303 2964 - (djm) Release OpenSSH 4.3p1
0ceedd4e 2965
0ce89457 296620060131
2967 - (djm) OpenBSD CVS Sync
2968 - jmc@cvs.openbsd.org 2006/01/20 11:21:45
2969 [ssh_config.5]
2970 - word change, agreed w/ markus
2971 - consistency fixes
ec63d7ce 2972 - jmc@cvs.openbsd.org 2006/01/25 09:04:34
2973 [sshd.8]
2974 move the options description up the page, and a few additional tweaks
2975 whilst in here;
2976 ok markus
f464b2f1 2977 - jmc@cvs.openbsd.org 2006/01/25 09:07:22
2978 [sshd.8]
2979 move subsections to full sections;
b661b7fb 2980 - jmc@cvs.openbsd.org 2006/01/26 08:47:56
2981 [ssh.1]
2982 add a section on verifying host keys in dns;
2983 written with a lot of help from jakob;
2984 feedback dtucker/markus;
2985 ok markus
d7b37427 2986 - reyk@cvs.openbsd.org 2006/01/30 12:22:22
2987 [channels.c]
2988 mark channel as write failed or dead instead of read failed on error
2989 of the channel output filter.
2990 ok markus@
062d2977 2991 - jmc@cvs.openbsd.org 2006/01/30 13:37:49
2992 [ssh.1]
2993 remove an incorrect sentence;
2994 reported by roumen petrov;
2995 ok djm markus
4116f5c0 2996 - djm@cvs.openbsd.org 2006/01/31 10:19:02
2997 [misc.c misc.h scp.c sftp.c]
2998 fix local arbitrary command execution vulnerability on local/local and
2999 remote/remote copies (CVE-2006-0225, bz #1094), patch by
3000 t8m AT centrum.cz, polished by dtucker@ and myself; ok markus@
16e8ab10 3001 - djm@cvs.openbsd.org 2006/01/31 10:35:43
3002 [scp.c]
3003 "scp a b c" shouldn't clobber "c" when it is not a directory, report and
3004 fix from biorn@; ok markus@
b645ff66 3005 - (djm) Sync regress tests to OpenBSD:
3006 - dtucker@cvs.openbsd.org 2005/03/10 10:20:39
3007 [regress/forwarding.sh]
3008 Regress test for ClearAllForwardings (bz #994); ok markus@
9b347e5f 3009 - dtucker@cvs.openbsd.org 2005/04/25 09:54:09
3010 [regress/multiplex.sh]
3011 Don't call cleanup in multiplex as test-exec will cleanup anyway
3012 found by tim@, ok djm@
3013 NB. ID sync only, we already had this
3014 - djm@cvs.openbsd.org 2005/05/20 23:14:15
3015 [regress/test-exec.sh]
3016 force addressfamily=inet for tests, unbreaking dynamic-forward regress for
3017 recently committed nc SOCKS5 changes
9f22d634 3018 - djm@cvs.openbsd.org 2005/05/24 04:10:54
89deb4c2 3019 [regress/try-ciphers.sh]
9f22d634 3020 oops, new arcfour modes here too
89deb4c2 3021 - markus@cvs.openbsd.org 2005/06/30 11:02:37
3022 [regress/scp.sh]
3023 allow SUDO=sudo; from Alexander Bluhm
41f70006 3024 - grunk@cvs.openbsd.org 2005/11/14 21:25:56
3025 [regress/agent-getpeereid.sh]
3026 all other scripts in this dir use $SUDO, not 'sudo', so pull this even
3027 ok markus@
71133d5b 3028 - dtucker@cvs.openbsd.org 2005/12/14 04:36:39
3029 [regress/scp-ssh-wrapper.sh]
3030 Fix assumption about how many args scp will pass; ok djm@
3031 NB. ID sync only, we already had this
452613c1 3032 - djm@cvs.openbsd.org 2006/01/27 06:49:21
3033 [scp.sh]
3034 regress test for local to local scp copies; ok dtucker@
3ca1f5b0 3035 - djm@cvs.openbsd.org 2006/01/31 10:23:23
3036 [scp.sh]
3037 regression test for CVE-2006-0225 written by dtucker@
d5b44cf1 3038 - djm@cvs.openbsd.org 2006/01/31 10:36:33
3039 [scp.sh]
3040 regress test for "scp a b c" where "c" is not a directory
0ce89457 3041
eeb27c78 304220060129
3043 - (dtucker) [configure.ac opensshd.init.in] Bug #1144: Use /bin/sh for the
3044 opensshd.init script interpretter if /sbin/sh does not exist. ok tim@
3045
16ad260d 304620060120
3047 - (dtucker) OpenBSD CVS Sync
3048 - jmc@cvs.openbsd.org 2006/01/15 17:37:05
3049 [ssh.1]
3050 correction from deraadt
43a7d9e7 3051 - jmc@cvs.openbsd.org 2006/01/18 10:53:29
3052 [ssh.1]
3053 add a section on ssh-based vpn, based on reyk's README.tun;
db175906 3054 - dtucker@cvs.openbsd.org 2006/01/20 00:14:55
3055 [scp.1 ssh.1 ssh_config.5 sftp.1]
3056 Document RekeyLimit. Based on patch from jan.iven at cern.ch from mindrot
3057 #1056 with feedback from jmc, djm and markus; ok jmc@ djm@
16ad260d 3058
aaa18db9 305920060114
3060 - (djm) OpenBSD CVS Sync
3061 - jmc@cvs.openbsd.org 2006/01/06 13:27:32
3062 [ssh.1]
3063 weed out some duplicate info in the known_hosts FILES entries;
3064 ok djm
5d7b356f 3065 - jmc@cvs.openbsd.org 2006/01/06 13:29:10
3066 [ssh.1]
3067 final round of whacking FILES for duplicate info, and some consistency
3068 fixes;
3069 ok djm
dbb3bf96 3070 - jmc@cvs.openbsd.org 2006/01/12 14:44:12
3071 [ssh.1]
3072 split sections on tcp and x11 forwarding into two sections.
3073 add an example in the tcp section, based on sth i wrote for ssh faq;
3074 help + ok: djm markus dtucker
5d4e571c 3075 - jmc@cvs.openbsd.org 2006/01/12 18:48:48
3076 [ssh.1]
3077 refer to `TCP' rather than `TCP/IP' in the context of connection
3078 forwarding;
3079 ok markus
e5d4cfad 3080 - jmc@cvs.openbsd.org 2006/01/12 22:20:00
3081 [sshd.8]
3082 refer to TCP forwarding, rather than TCP/IP forwarding;
0b3950af 3083 - jmc@cvs.openbsd.org 2006/01/12 22:26:02
3084 [ssh_config.5]
3085 refer to TCP forwarding, rather than TCP/IP forwarding;
c2da64a1 3086 - jmc@cvs.openbsd.org 2006/01/12 22:34:12
3087 [ssh.1]
3088 back out a sentence - AUTHENTICATION already documents this;
aaa18db9 3089
794febd2 309020060109
3091 - (dtucker) [contrib/cygwin/ssh-host-config] Make sshd service depend on
3092 tcpip service so it's always started after IP is up. Patch from
3093 vinschen at redhat.com.
3094
0624a70b 309520060106
3096 - (djm) OpenBSD CVS Sync
3097 - jmc@cvs.openbsd.org 2006/01/03 16:31:10
3098 [ssh.1]
3099 move FILES to a -compact list, and make each files an item in that list.
3100 this avoids nastly line wrap when we have long pathnames, and treats
3101 each file as a separate item;
3102 remove the .Pa too, since it is useless.
0502727e 3103 - jmc@cvs.openbsd.org 2006/01/03 16:35:30
3104 [ssh.1]
3105 use a larger width for the ENVIRONMENT list;
f403d7b5 3106 - jmc@cvs.openbsd.org 2006/01/03 16:52:36
3107 [ssh.1]
3108 put FILES in some sort of order: sort by pathname
c0907b37 3109 - jmc@cvs.openbsd.org 2006/01/03 16:55:18
3110 [ssh.1]
3111 tweak the description of ~/.ssh/environment
f3119772 3112 - jmc@cvs.openbsd.org 2006/01/04 18:42:46
3113 [ssh.1]
3114 chop out some duplication in the .{r,s}hosts/{h,sh}osts.equiv FILES
3115 entries;
3116 ok markus
6c276bb9 3117 - jmc@cvs.openbsd.org 2006/01/04 18:45:01
3118 [ssh.1]
3119 remove .Xr's to rsh(1) and telnet(1): they are hardly needed;
926f6a7a 3120 - jmc@cvs.openbsd.org 2006/01/04 19:40:24
3121 [ssh.1]
3122 +.Xr ssh-keyscan 1 ,
ccce91ef 3123 - jmc@cvs.openbsd.org 2006/01/04 19:50:09
3124 [ssh.1]
3125 -.Xr gzip 1 ,
db382686 3126 - djm@cvs.openbsd.org 2006/01/05 23:43:53
3127 [misc.c]
3128 check that stdio file descriptors are actually closed before clobbering
3129 them in sanitise_stdfd(). problems occurred when a lower numbered fd was
3130 closed, but higher ones weren't. spotted by, and patch tested by
3131 Frédéric Olivié
0624a70b 3132
d3506f6d 313320060103
3134 - (djm) [channels.c] clean up harmless merge error, from reyk@
3135
79e46360 313620060103
3137 - (djm) OpenBSD CVS Sync
3138 - jmc@cvs.openbsd.org 2006/01/02 17:09:49
3139 [ssh_config.5 sshd_config.5]
3140 some corrections from michael knudsen;
3141
6f6cd507 314220060102
3143 - (djm) [README.tun] Add README.tun, missed during sync of tun(4) support
4b5e6c81 3144 - (djm) OpenBSD CVS Sync
3145 - jmc@cvs.openbsd.org 2005/12/31 10:46:17
3146 [ssh.1]
3147 merge the "LOGIN SESSION AND REMOTE EXECUTION" and "SERVER
3148 AUTHENTICATION" sections into "AUTHENTICATION";
3149 some rewording done to make the text read better, plus some
3150 improvements from djm;
3151 ok djm
b92605e1 3152 - jmc@cvs.openbsd.org 2005/12/31 13:44:04
3153 [ssh.1]
3154 clean up ENVIRONMENT a little;
20892533 3155 - jmc@cvs.openbsd.org 2005/12/31 13:45:19
3156 [ssh.1]
3157 .Nm does not require an argument;
1f1fbbd8 3158 - stevesk@cvs.openbsd.org 2006/01/01 08:59:27
3159 [includes.h misc.c]
3160 move <net/if.h>; ok djm@
81c042a3 3161 - stevesk@cvs.openbsd.org 2006/01/01 10:08:48
3162 [misc.c]
3163 no trailing "\n" for debug()
3eee3b86 3164 - djm@cvs.openbsd.org 2006/01/02 01:20:31
3165 [sftp-client.c sftp-common.h sftp-server.c]
3166 use a common max. packet length, no binary change
b1b65311 3167 - reyk@cvs.openbsd.org 2006/01/02 07:53:44
3168 [misc.c]
3169 clarify tun(4) opening - set the mode and bring the interface up. also
3170 (re)sets the tun(4) layer 2 LINK0 flag for existing tunnel interfaces.
3171 suggested and ok by djm@
d141c93d 3172 - jmc@cvs.openbsd.org 2006/01/02 12:31:06
3173 [ssh.1]
3174 start to cut some duplicate info from FILES;
3175 help/ok djm
6f6cd507 3176
0f6cb079 317720060101
3178 - (djm) [Makefile.in configure.ac includes.h misc.c]
3179 [openbsd-compat/port-tun.c openbsd-compat/port-tun.h] Add support
3180 for tunnel forwarding for FreeBSD and NetBSD. NetBSD's support is
3181 limited to IPv4 tunnels only, and most versions don't support the
3182 tap(4) device at all.
b5081213 3183 - (djm) [configure.ac] Fix linux/if_tun.h test
3aef38da 3184 - (djm) [openbsd-compat/port-tun.c] Linux needs linux/if.h too
0f6cb079 3185
1908529f 318620051229
3187 - (djm) OpenBSD CVS Sync
3188 - stevesk@cvs.openbsd.org 2005/12/28 22:46:06
3189 [canohost.c channels.c clientloop.c]
3190 use 'break-in' for consistency; ok deraadt@ ok and input jmc@
c1c6a032 3191 - reyk@cvs.openbsd.org 2005/12/30 15:56:37
3192 [channels.c channels.h clientloop.c]
3193 add channel output filter interface.
3194 ok djm@, suggested by markus@
3da242db 3195 - jmc@cvs.openbsd.org 2005/12/30 16:59:00
3196 [sftp.1]
3197 do not suggest that interactive authentication will work
3198 with the -b flag;
3199 based on a diff from john l. scarfone;
3200 ok djm
f470cf48 3201 - stevesk@cvs.openbsd.org 2005/12/31 01:38:45
3202 [ssh.1]
3203 document -MM; ok djm@
e914f53a 3204 - (djm) [openbsd-compat/port-tun.c openbsd-compat/port-tun.h configure.ac]
3205 [serverloop.c ssh.c openbsd-compat/Makefile.in]
3206 [openbsd-compat/openbsd-compat.h] Implement tun(4) forwarding
3207 compatability support for Linux, diff from reyk@
c40f09ca 3208 - (djm) [configure.ac] Disable Linux tun(4) compat code if linux/tun.h does
3209 not exist
d91775e1 3210 - (djm) [configure.ac] oops, make that linux/if_tun.h
1908529f 3211
b5c428f0 321220051229
3213 - (tim) [buildpkg.sh.in] grep for $SSHDUID instead of $SSHDGID on /etc/passwd
3214
6b0117fd 321520051224
3216 - (djm) OpenBSD CVS Sync
3217 - jmc@cvs.openbsd.org 2005/12/20 21:59:43
3218 [ssh.1]
3219 merge the sections on protocols 1 and 2 into one section on
3220 authentication;
3221 feedback djm dtucker
3222 ok deraadt markus dtucker
5c5546be 3223 - jmc@cvs.openbsd.org 2005/12/20 22:02:50
3224 [ssh.1]
3225 .Ss -> .Sh: subsections have not made this page more readable
e6c7c03e 3226 - jmc@cvs.openbsd.org 2005/12/20 22:09:41
3227 [ssh.1]
3228 move info on ssh return values and config files up into the main
3229 description;
e49f7abd 3230 - jmc@cvs.openbsd.org 2005/12/21 11:48:16
3231 [ssh.1]
3232 -L and -R descriptions are now above, not below, ~C description;
8770ef76 3233 - jmc@cvs.openbsd.org 2005/12/21 11:57:25
3234 [ssh.1]
3235 options now described `above', rather than `later';
6e1e9c73 3236 - jmc@cvs.openbsd.org 2005/12/21 12:53:31
3237 [ssh.1]
3238 -Y does X11 forwarding too;
3239 ok markus
6cd6c442 3240 - stevesk@cvs.openbsd.org 2005/12/21 22:44:26
3241 [sshd.8]
3242 clarify precedence of -p, Port, ListenAddress; ok and help jmc@
0c9851b1 3243 - jmc@cvs.openbsd.org 2005/12/22 10:31:40
3244 [ssh_config.5]
3245 put the description of "UsePrivilegedPort" in the correct place;
9bf41db3 3246 - jmc@cvs.openbsd.org 2005/12/22 11:23:42
3247 [ssh.1]
3248 expand the description of -w somewhat;
3249 help/ok reyk
86131206 3250 - jmc@cvs.openbsd.org 2005/12/23 14:55:53
3251 [ssh.1]
3252 - sync the description of -e w/ synopsis
3253 - simplify the description of -I
3254 - note that -I is only available if support compiled in, and that it
3255 isn't by default
3256 feedback/ok djm@
025fc42e 3257 - jmc@cvs.openbsd.org 2005/12/23 23:46:23
3258 [ssh.1]
3259 less mark up for -c;
678143bd 3260 - djm@cvs.openbsd.org 2005/12/24 02:27:41
3261 [session.c sshd.c]
3262 eliminate some code duplicated in privsep and non-privsep paths, and
3263 explicitly clear SIGALRM handler; "groovy" deraadt@
6b0117fd 3264
a2b1748a 326520051220
3266 - (dtucker) OpenBSD CVS Sync
3267 - reyk@cvs.openbsd.org 2005/12/13 15:03:02
3268 [serverloop.c]
3269 if forced_tun_device is not set, it is -1 and not SSH_TUNID_ANY
442c8b33 3270 - jmc@cvs.openbsd.org 2005/12/16 18:07:08
3271 [ssh.1]
3272 move the option descriptions up the page: start of a restructure;
3273 ok markus deraadt
e426efa9 3274 - jmc@cvs.openbsd.org 2005/12/16 18:08:53
3275 [ssh.1]
3276 simplify a sentence;
28ca205d 3277 - jmc@cvs.openbsd.org 2005/12/16 18:12:22
3278 [ssh.1]
3279 make the description of -c a little nicer;
a55c1733 3280 - jmc@cvs.openbsd.org 2005/12/16 18:14:40
3281 [ssh.1]
3282 signpost the protocol sections;
8918b906 3283 - stevesk@cvs.openbsd.org 2005/12/17 21:13:05
3284 [ssh_config.5 session.c]
3285 spelling: fowarding, fowarded
551ed07c 3286 - stevesk@cvs.openbsd.org 2005/12/17 21:36:42
3287 [ssh_config.5]
3288 spelling: intented -> intended
3aa43b24 3289 - dtucker@cvs.openbsd.org 2005/12/20 04:41:07
3290 [ssh.c]
3291 exit(255) on error to match description in ssh(1); bz #1137; ok deraadt@
a2b1748a 3292
e5146707 329320051219
3294 - (dtucker) [cipher-aes.c cipher-ctr.c cipher.c configure.ac
3295 openbsd-compat/openssl-compat.h] Check for and work around broken AES
3296 ciphers >128bit on (some) Solaris 10 systems. ok djm@
3297
2f89281c 329820051217
3299 - (dtucker) [defines.h] HP-UX system headers define "YES" and "NO" which
3300 scp.c also uses, so undef them here.
31b0732a 3301 - (dtucker) [configure.ac openbsd-compat/bsd-snprintf.c] Bug #1133: Our
3302 snprintf replacement can have a conflicting declaration in HP-UX's system
3303 headers (const vs. no const) so we now check for and work around it. Patch
3304 from the dynamic duo of David Leonard and Ted Percival.
2f89281c 3305
9fed02d8 330620051214
3307 - (dtucker) OpenBSD CVS Sync (regress/)
3308 - dtucker@cvs.openbsd.org 2005/12/30 04:36:39
3309 [regress/scp-ssh-wrapper.sh]
3310 Fix assumption about how many args scp will pass; ok djm@
3311
d7cf99ff 331220051213
3313 - (djm) OpenBSD CVS Sync
3314 - jmc@cvs.openbsd.org 2005/11/30 11:18:27
3315 [ssh.1]
3316 timezone -> time zone
04ac3e62 3317 - jmc@cvs.openbsd.org 2005/11/30 11:45:20
3318 [ssh.1]
3319 avoid ambiguities in describing TZ;
3320 ok djm@
d20f3c9e 3321 - reyk@cvs.openbsd.org 2005/12/06 22:38:28
3322 [auth-options.c auth-options.h channels.c channels.h clientloop.c]
3323 [misc.c misc.h readconf.c readconf.h scp.c servconf.c servconf.h]
3324 [serverloop.c sftp.c ssh.1 ssh.c ssh_config ssh_config.5 sshconnect.c]
3325 [sshconnect.h sshd.8 sshd_config sshd_config.5]
3326 Add support for tun(4) forwarding over OpenSSH, based on an idea and
3327 initial channel code bits by markus@. This is a simple and easy way to
3328 use OpenSSH for ad hoc virtual private network connections, e.g.
3329 administrative tunnels or secure wireless access. It's based on a new
3330 ssh channel and works similar to the existing TCP forwarding support,
3331 except that it depends on the tun(4) network interface on both ends of
3332 the connection for layer 2 or layer 3 tunneling. This diff also adds
3333 support for LocalCommand in the ssh(1) client.
d20f3c9e 3334 ok djm@, markus@, jmc@ (manpages), tested and discussed with others
ceec33f3 3335 - djm@cvs.openbsd.org 2005/12/07 03:52:22
3336 [clientloop.c]
3337 reyk forgot to compile with -Werror (missing header)
985bb789 3338 - jmc@cvs.openbsd.org 2005/12/07 10:52:13
3339 [ssh.1]
3340 - avoid line split in SYNOPSIS
3341 - add args to -w
3342 - kill trailing whitespace
64925c6d 3343 - jmc@cvs.openbsd.org 2005/12/08 14:59:44
3344 [ssh.1 ssh_config.5]
3345 make `!command' a little clearer;
3346 ok reyk
030723f9 3347 - jmc@cvs.openbsd.org 2005/12/08 15:06:29
3348 [ssh_config.5]
3349 keep options in order;
a4f24bf8 3350 - reyk@cvs.openbsd.org 2005/12/08 18:34:11
3351 [auth-options.c includes.h misc.c misc.h readconf.c servconf.c]
3352 [serverloop.c ssh.c ssh_config.5 sshd_config.5 configure.ac]
3353 two changes to the new ssh tunnel support. this breaks compatibility
3354 with the initial commit but is required for a portable approach.
3355 - make the tunnel id u_int and platform friendly, use predefined types.
3356 - support configuration of layer 2 (ethernet) or layer 3
3357 (point-to-point, default) modes. configuration is done using the
3358 Tunnel (yes|point-to-point|ethernet|no) option is ssh_config(5) and
3359 restricted by the PermitTunnel (yes|point-to-point|ethernet|no) option
3360 in sshd_config(5).
3361 ok djm@, man page bits by jmc@
a274ba38 3362 - jmc@cvs.openbsd.org 2005/12/08 21:37:50
3363 [ssh_config.5]
3364 new sentence, new line;
b872f7f0 3365 - markus@cvs.openbsd.org 2005/12/12 13:46:18
3366 [channels.c channels.h session.c]
3367 make sure protocol messages for internal channels are ignored.
3368 allow adjust messages for non-open channels; with and ok djm@
6306853a 3369 - (djm) [misc.c] Disable tunnel code for non-OpenBSD (for now), enable
3370 again by providing a sys_tun_open() function for your platform and
3371 setting the CUSTOM_SYS_TUN_OPEN define. More work is required to match
3372 OpenBSD's tunnel protocol, which prepends the address family to the
3373 packet
d7cf99ff 3374
fbc06315 337520051201
3376 - (djm) [envpass.sh] Remove regress script that was accidentally committed
3377 in top level directory and not noticed for over a year :)
3378
6e94bd72 337920051129
3380 - (tim) [ssh-keygen.c] Move DSA length test after setting default when
3381 bits == 0.
60dc0294 3382 - (dtucker) OpenBSD CVS Sync
3383 - dtucker@cvs.openbsd.org 2005/11/29 02:04:55
3384 [ssh-keygen.c]
3385 Populate default key sizes before checking them; from & ok tim@
e45da4d6 3386 - (tim) [configure.ac sshd.8] Enable locked account check (a "*LK*" string)
3387 for UnixWare.
6e94bd72 3388
b7bb251f 338920051128
3390 - (dtucker) [regress/yes-head.sh] Work around breakage caused by some
3391 versions of GNU head. Based on patch from zappaman at buraphalinux.org
8b396721 3392 - (dtucker) [includes.h] Bug #1122: __USE_GNU is a glibc internal macro, use
3393 _GNU_SOURCE instead. Patch from t8m at centrum.cz.
c6d7b211 3394 - (dtucker) OpenBSD CVS Sync
3395 - dtucker@cvs.openbsd.org 2005/11/28 05:16:53
3396 [ssh-keygen.1 ssh-keygen.c]
3397 Enforce DSA key length of exactly 1024 bits to comply with FIPS-186-2,
3398 increase minumum RSA key size to 768 bits and update man page to reflect
3399 these. Patch originally bz#1119 (senthilkumar_sen at hotpop.com),
3400 ok djm@, grudging ok deraadt@.
98e93fbc 3401 - dtucker@cvs.openbsd.org 2005/11/28 06:02:56
3402 [ssh-agent.1]
3403 Update agent socket path templates to reflect reality, correct xref for
3404 time formats. bz#1121, patch from openssh at roumenpetrov.info, ok djm@
b7bb251f 3405
961c2997 340620051126
3407 - (dtucker) [configure.ac] Bug #1126: AIX 5.2 and 5.3 (and presumably newer,
3408 when they're available) need the real UID set otherwise pam_chauthtok will
3409 set ADMCHG after changing the password, forcing the user to change it
3410 again immediately.
3411
ccc45ee0 341220051125
3413 - (dtucker) [configure.ac] Apply tim's fix for older systems where the
3414 resolver state in resolv.h is "state" not "__res_state". With slight
3415 modification by me to also work on old AIXes. ok djm@
419094c6 3416 - (dtucker) [progressmeter.c scp.c sftp-server.c] Use correct casts for
3417 snprintf formats, fixes warnings on some 64 bit platforms. Patch from
3418 shaw at vranix.com, ok djm@
ccc45ee0 3419
342020051124
9a406e1e 3421 - (djm) [configure.ac openbsd-compat/Makefile.in openbsd-compat/bsd-asprintf.c
3422 openbsd-compat/bsd-snprintf.c openbsd-compat/openbsd-compat.h] Add an
3423 asprintf() implementation, after syncing our {v,}snprintf() implementation
3424 with some extra fixes from Samba's version. With help and debugging from
3425 dtucker and tim; ok dtucker@
d08db6d1 3426 - (dtucker) [configure.ac] Fix typos in comments and AC_SEARCH_LIB argument
3427 order in Reliant Unix block. Patch from johane at lysator.liu.se.
d77c7dff 3428 - (dtucker) [regress/test-exec.sh] Use 1024 bit keys since we generate so
3429 many and use them only once. Speeds up testing on older/slower hardware.
9a406e1e 3430
932ab351 343120051122
3432 - (dtucker) OpenBSD CVS Sync
3433 - deraadt@cvs.openbsd.org 2005/11/12 18:37:59
3434 [ssh-add.c]
3435 space
29accf74 3436 - deraadt@cvs.openbsd.org 2005/11/12 18:38:15
3437 [scp.c]
3438 avoid close(-1), as in rcp; ok cloder
a001f9d7 3439 - millert@cvs.openbsd.org 2005/11/15 11:59:54
3440 [includes.h]
3441 Include sys/queue.h explicitly instead of assuming some other header
3442 will pull it in. At the moment it gets pulled in by sys/select.h
3443 (which ssh has no business including) via event.h. OK markus@
3444 (ID sync only in -portable)
426cef74 3445 - dtucker@cvs.openbsd.org 2005/11/21 09:42:10
3446 [auth-krb5.c]
3447 Perform Kerberos calls even for invalid users to prevent leaking
3448 information about account validity. bz #975, patch originally from
3449 Senthil Kumar, sanity checked by Simon Wilkinson, tested by djm@, biorn@,
3450 ok markus@
18f8ef7a 3451 - dtucker@cvs.openbsd.org 2005/11/22 03:36:03
3452 [hostfile.c]
3453 Correct format/arguments to debug call; spotted by shaw at vranix.com
3454 ok djm@
dfde7f6e 3455 - (dtucker) [loginrec.c] Add casts to prevent compiler warnings, patch
3456 from shaw at vranix.com.
932ab351 3457
60e10887 345820051120
3459 - (dtucker) [openbsd-compat/openssl-compat.h] Add comment explaining what
3460 is going on.
3461
4162eae5 346220051112
3463 - (dtucker) [openbsd-compat/getrrsetbyname.c] Restore Portable-specific
3464 ifdef lost during sync. Spotted by tim@.
f97dc218 3465 - (dtucker) [openbsd-compat/{realpath.c,stroll.c,rresvport.c}] $OpenBSD tag.
eeee8237 3466 - (dtucker) [configure.ac] Use "$AWK" instead of "awk" in gcc version test.
23361281 3467 - (dtucker) [configure.ac] Remove duplicate utimes() check. ok djm@
29aaf112 3468 - (dtucker) [regress/reconfigure.sh] Fix potential race in the reconfigure
3469 test: if sshd takes too long to reconfigure the subsequent connection will
3470 fail. Zap pidfile before HUPing sshd which will rewrite it when it's ready.
4162eae5 3471
e1658b5c 347220051110
b69585d9 3473 - (dtucker) [openbsd-compat/setenv.c] Merge changes for __findenv from
e1658b5c 3474 OpenBSD getenv.c revs 1.4 - 1.8 (ANSIfication of arguments, removal of
3475 "register").
b69585d9 3476 - (dtucker) [openbsd-compat/setenv.c] Make __findenv static, remove
7b2dcf21 3477 unnecessary prototype.
b69585d9 3478 - (dtucker) [openbsd-compat/setenv.c] Sync changes from OpenBSD setenv.c
3479 revs 1.7 - 1.9.
c080bed1 3480 - (dtucker) [auth-krb5.c] Fix -Wsign-compare warning in non-Heimdal path.
3481 Patch from djm@.
dbf07ba2 3482 - (dtucker) [configure.ac] Disable pointer-sign warnings on gcc 4.0+
3483 since they're not useful right now. Patch from djm@.
242652fe 3484 - (dtucker) [openbsd-compat/getgrouplist.c] Sync OpenBSD revs 1.10 - 1.2 (ANSI
3485 prototypes, removal of "register").
432e59f9 3486 - (dtucker) [openbsd-compat/strlcat.c] Sync OpenBSD revs 1.11 - 1.12 (removal
3487 of "register").
f6d4fb87 3488 - (dtucker) [openbsd-compat/{LOTS}] Move the "OPENBSD ORIGINAL" markers to
3489 after the copyright notices. Having them at the top next to the CVSIDs
3490 guarantees a conflict for each and every sync.
e4f65477 3491 - (dtucker) [openbsd-compat/strlcpy.c] Update from OpenBSD 1.8 -> 1.10.
bfd4a832 3492 - (dtucker) [openbsd-compat/sigact.h] Add "OPENBSD ORIGINAL" marker.
bc16ca63 3493 - (dtucker) [openbsd-compat/strmode.c] Update from OpenBSD 1.5 -> 1.7.
3494 Removal of rcsid, "whiteout" inode type.
7dfb4a82 3495 - (dtucker) [openbsd-compat/basename.c] Update from OpenBSD 1.11 -> 1.14.
3496 Removal of rcsid, will no longer strlcpy parts of the string.
d8922805 3497 - (dtucker) [openbsd-compat/strtoll.c] Update from OpenBSD 1.4 -> 1.5.
4ff445f1 3498 - (dtucker) [openbsd-compat/strtoul.c] Update from OpenBSD 1.5 -> 1.7.
e1829842 3499 - (dtucker) [openbsd-compat/readpassphrase.c] Update from OpenBSD 1.16 -> 1.18.
625552b8 3500 - (dtucker) [openbsd-compat/readpassphrase.h] Update from OpenBSD 1.3 -> 1.5.
a65ea33b 3501 - (dtucker) [openbsd-compat/glob.c] Update from OpenBSD 1.22 -> 1.25.
b84a707a 3502 - (dtucker) [openbsd-compat/glob.h] Update from OpenBSD 1.8 -> 1.9.
281bbb02 3503 - (dtucker) [openbsd-compat/getcwd.c] Update from OpenBSD 1.9 -> 1.14.
16d51c41 3504 - (dtucker) [openbsd-compat/getcwd.c] Replace lstat with fstat to match up
3505 with OpenBSD code since we don't support platforms without fstat any more.
b53df919 3506 - (dtucker) [openbsd-compat/inet_aton.c] Update from OpenBSD 1.7 -> 1.9.
68b36828 3507 - (dtucker) [openbsd-compat/inet_ntoa.c] Update from OpenBSD 1.4 -> 1.6.
3508 - (dtucker) [openbsd-compat/inet_ntop.c] Update from OpenBSD 1.5 -> 1.7.
fc1c42f3 3509 - (dtucker) [openbsd-compat/daemon.c] Update from OpenBSD 1.5 -> 1.6.
0695e921 3510 - (dtucker) [openbsd-compat/strsep.c] Update from OpenBSD 1.5 -> 1.6.
3c8f7a26 3511 - (dtucker) [openbsd-compat/daemon.c] Update from OpenBSD 1.10 -> 1.13.
5bf337a5 3512 - (dtucker) [openbsd-compat/mktemp.c] Update from OpenBSD 1.17 -> 1.19.
8c603515 3513 - (dtucker) [openbsd-compat/rresvport.c] Update from OpenBSD 1.6 -> 1.8.
c9d7b187 3514 - (dtucker) [openbsd-compat/bindresvport.c] Add "OPENBSD ORIGINAL" marker.
295034ce 3515 - (dtucker) [openbsd-compat/bindresvport.c] Update from OpenBSD 1.16 -> 1.17.
3e6325a6 3516 - (dtucker) [openbsd-compat/sigact.c] Update from OpenBSD 1.3 -> 1.4.
3517 Id and copyright sync only, there were no substantial changes we need.
8d767ef2 3518 - (dtucker) [openbsd-compat/bsd-closefrom.c openbsd-compat/base64.c]
6bd2d8e5 3519 -Wsign-compare fixes from djm.
e1b4416e 3520 - (dtucker) [openbsd-compat/sigact.h] Update from OpenBSD 1.2 -> 1.3.
3521 Id and copyright sync only, there were no substantial changes we need.
cd595991 3522 - (dtucker) [configure.ac] Try to get the gcc version number in a way that
3523 doesn't change between versions, and use a safer default.
e1658b5c 3524
255d3e00 352520051105
3526 - (djm) OpenBSD CVS Sync
3527 - markus@cvs.openbsd.org 2005/10/07 11:13:57
3528 [ssh-keygen.c]
3529 change DSA default back to 1024, as it's defined for 1024 bits only
3530 and this causes interop problems with other clients. moreover,
3531 in order to improve the security of DSA you need to change more
3532 components of DSA key generation (e.g. the internal SHA1 hash);
3533 ok deraadt
8cd0437d 3534 - djm@cvs.openbsd.org 2005/10/10 10:23:08
3535 [channels.c channels.h clientloop.c serverloop.c session.c]
3536 fix regression I introduced in 4.2: X11 forwardings initiated after
3537 a session has exited (e.g. "(sleep 5; xterm) &") would not start.
3538 bz #1086 reported by t8m AT centrum.cz; ok markus@ dtucker@
442aee3a 3539 - djm@cvs.openbsd.org 2005/10/11 23:37:37
3540 [channels.c]
3541 bz #1076 set SO_REUSEADDR on X11 forwarding listner sockets, preventing
3542 bind() failure when a previous connection's listeners are in TIME_WAIT,
3543 reported by plattner AT inf.ethz.ch; ok dtucker@
b96eade6 3544 - stevesk@cvs.openbsd.org 2005/10/13 14:03:01
3545 [auth2-gss.c gss-genr.c gss-serv.c]
3546 remove unneeded #includes; ok markus@
6e902aec 3547 - stevesk@cvs.openbsd.org 2005/10/13 14:20:37
3548 [gss-serv.c]
3549 spelling in comments
6472fefc 3550 - stevesk@cvs.openbsd.org 2005/10/13 19:08:08
3551 [gss-serv-krb5.c gss-serv.c]
3552 unused declarations; ok deraadt@
3553 (id sync only for gss-serv-krb5.c)
adf8c40b 3554 - stevesk@cvs.openbsd.org 2005/10/13 19:13:41
3555 [dns.c]
3556 unneeded #include, unused declaration, little knf; ok deraadt@
8442cc66 3557 - stevesk@cvs.openbsd.org 2005/10/13 22:24:31
3558 [auth2-gss.c gss-genr.c gss-serv.c monitor.c]
3559 KNF; ok djm@
17318dd6 3560 - stevesk@cvs.openbsd.org 2005/10/14 02:17:59
3561 [ssh-keygen.c ssh.c sshconnect2.c]
3562 no trailing "\n" for log functions; ok djm@
8c4bd764 3563 - stevesk@cvs.openbsd.org 2005/10/14 02:29:37
3564 [channels.c clientloop.c]
3565 free()->xfree(); ok djm@
ed82a2a9 3566 - stevesk@cvs.openbsd.org 2005/10/15 15:28:12
3567 [sshconnect.c]
3568 make external definition static; ok deraadt@
7238b6e4 3569 - stevesk@cvs.openbsd.org 2005/10/17 13:45:05
3570 [dns.c]
3571 fix memory leaks from 2 sources:
3572 1) key_fingerprint_raw()
3573 2) malloc in dns_read_rdata()
3574 ok jakob@
3575 - stevesk@cvs.openbsd.org 2005/10/17 14:01:28
3576 [dns.c]
3577 remove #ifdef LWRES; ok jakob@
8374cf6f 3578 - stevesk@cvs.openbsd.org 2005/10/17 14:13:35
3579 [dns.c dns.h]
3580 more cleanups; ok jakob@
6b0b0d65 3581 - djm@cvs.openbsd.org 2005/10/30 01:23:19
3582 [ssh_config.5]
3583 mention control socket fallback behaviour, reported by
3584 tryponraj AT gmail.com
2995db03 3585 - djm@cvs.openbsd.org 2005/10/30 04:01:03
3586 [ssh-keyscan.c]
3587 make ssh-keygen discard junk from server before SSH- ident, spotted by
3588 dave AT cirt.net; ok dtucker@
aa9bc1de 3589 - djm@cvs.openbsd.org 2005/10/30 04:03:24
3590 [ssh.c]
3591 fix misleading debug message; ok dtucker@
3a85986d 3592 - dtucker@cvs.openbsd.org 2005/10/30 08:29:29
3593 [canohost.c sshd.c]
3594 Check for connections with IP options earlier and drop silently. ok djm@
db98627d 3595 - jmc@cvs.openbsd.org 2005/10/30 08:43:47
3596 [ssh_config.5]
3597 remove trailing whitespace;
7b9b0103 3598 - djm@cvs.openbsd.org 2005/10/30 08:52:18
3599 [clientloop.c packet.c serverloop.c session.c ssh-agent.c ssh-keygen.c]
3600 [ssh.c sshconnect.c sshconnect1.c sshd.c]
3601 no need to escape single quotes in comments, no binary change
bdd3b323 3602 - dtucker@cvs.openbsd.org 2005/10/31 06:15:04
3603 [sftp.c]
3604 Fix sorting with "ls -1" command. From Robert Tsai, "looks right" deraadt@
882c9d5a 3605 - djm@cvs.openbsd.org 2005/10/31 11:12:49
3606 [ssh-keygen.1 ssh-keygen.c]
3607 generate a protocol 2 RSA key by default
6af12d46 3608 - djm@cvs.openbsd.org 2005/10/31 11:48:29
3609 [serverloop.c]
3610 make sure we clean up wtmp, etc. file when we receive a SIGTERM,
3611 SIGINT or SIGQUIT when running without privilege separation (the
3612 normal privsep case is already OK). Patch mainly by dtucker@ and
3613 senthilkumar_sen AT hotpop.com; ok dtucker@
3543c5e1 3614 - jmc@cvs.openbsd.org 2005/10/31 19:55:25
3615 [ssh-keygen.1]
3616 grammar;
0bbbf2a4 3617 - dtucker@cvs.openbsd.org 2005/11/03 13:38:29
3618 [canohost.c]
3619 Cache reverse lookups with and without DNS separately; ok markus@
47e5dc72 3620 - djm@cvs.openbsd.org 2005/11/04 05:15:59
3621 [kex.c kex.h kexdh.c kexdhc.c kexdhs.c kexgex.c kexgexc.c kexgexs.c]
3622 remove hardcoded hash lengths in key exchange code, allowing
3623 implementation of KEX methods with different hashes (e.g. SHA-256);
3624 ok markus@ dtucker@ stevesk@
27e3ef36 3625 - djm@cvs.openbsd.org 2005/11/05 05:01:15
3626 [bufaux.c]
3627 Fix leaks in error paths, bz #1109 and #1110 reported by kremenek AT
3628 cs.stanford.edu; ok dtucker@
e557f3b5 3629 - (dtucker) [README.platform] Add PAM section.
ebb049f1 3630 - (djm) [openbsd-compat/getrrsetbyname.c] Sync to latest OpenBSD version,
3631 resolving memory leak bz#1111 reported by kremenek AT cs.stanford.edu;
3632 ok dtucker@
255d3e00 3633
bd2a0801 363420051102
3635 - (dtucker) [openbsd-compat/bsd-misc.c] Bug #1108: fix broken strdup().
3636 Reported by olavi at ipunplugged.com and antoine.brodin at laposte.net
3637 via FreeBSD.
3638
5097eaa9 363920051030
3640 - (djm) [contrib/suse/openssh.spec contrib/suse/rc.
3641 sshd contrib/suse/sysconfig.ssh] Bug #1106: Updated SuSE spec and init
3642 files from imorgan AT nas.nasa.gov
0a61a240 3643 - (dtucker) [session.c] Bug #1045do not check /etc/nologin when PAM is
3644 enabled, instead allow PAM to handle it. Note that on platforms using PAM,
3645 the pam_nologin module should be added to sshd's session stack in order to
3646 maintain exising behaviour. Based on patch and discussion from t8m at
3647 centrum.cz, ok djm@
5097eaa9 3648
90f15776 364920051025
3650 - (dtucker) [configure.ac] Relocate LLONG_MAX calculation to after the
3651 sizeof(long long) checks, to make fixing bug #1104 easier (no changes
3652 yet).
d75dfaa6 3653 - (dtucker) [configure.ac] Bug #1104: Tru64's printf family doesn't
3654 understand "%lld", even though the compiler has "long long", so handle
3655 it as a special case. Patch tested by mcaskill.scott at epa.gov.
b8bc9d84 3656 - (dtucker) [contrib/cygwin/ssh-user-config] Remove duplicate yes/no
3657 prompt. Patch from vinschen at redhat.com.
90f15776 3658
b0e7249f 365920051017
3660 - (dtucker) [configure.ac] Bug #1097: Fix configure for cross-compiling.
3661 /etc/default/login report and testing from aabaker at iee.org, corrections
3662 from tim@.
3663
8034a348 366420051009
3665 - (dtucker) [configure.ac defines.h openbsd-compat/vis.{c,h}] Sync current
3666 versions from OpenBSD. ok djm@
3667
83f987c3 366820051008
3669 - (dtucker) [configure.ac] Bug #1098: define $MAIL for HP-UX; report from
3670 brian.smith at agilent com.
1012885d 3671 - (djm) [configure.ac] missing 'test' call for -with-Werror test
83f987c3 3672
278f9900 367320051005
3674 - (dtucker) [configure.ac sshd.8] Enable locked account check (a prepended
3675 "*LOCKED*" string) for FreeBSD. Patch jeremie at le-hen.org and
3676 senthilkumar_sen at hotpop.com.
3677
59e5aff5 367820051003
3679 - (dtucker) OpenBSD CVS Sync
3680 - markus@cvs.openbsd.org 2005/09/07 08:53:53
3681 [channels.c]
3682 enforce chanid != NULL; ok djm
b5443199 3683 - markus@cvs.openbsd.org 2005/09/09 19:18:05
3684 [clientloop.c]
3685 typo; from mark at mcs.vuw.ac.nz, bug #1082
fd6168c1 3686 - djm@cvs.openbsd.org 2005/09/13 23:40:07
3687 [sshd.c ssh.c misc.h sftp.c ssh-keygen.c ssh-keysign.c sftp-server.c
3688 scp.c misc.c ssh-keyscan.c ssh-add.c ssh-agent.c]
3689 ensure that stdio fds are attached; ok deraadt@
5ddc5eb4 3690 - djm@cvs.openbsd.org 2005/09/19 11:37:34
3691 [ssh_config.5 ssh.1]
3692 mention ability to specify bind_address for DynamicForward and -D options;
3693 bz#1077 spotted by Haruyama Seigo
d77dd4d7 3694 - djm@cvs.openbsd.org 2005/09/19 11:47:09
3695 [sshd.c]
3696 stop connection abort on rekey with delayed compression enabled when
3697 post-auth privsep is disabled (e.g. when root is logged in); ok dtucker@
67003554 3698 - djm@cvs.openbsd.org 2005/09/19 11:48:10
3699 [gss-serv.c]
3700 typo
37c406a8 3701 - jmc@cvs.openbsd.org 2005/09/19 15:38:27
3702 [ssh.1]
3703 some more .Bk/.Ek to avoid ugly line split;
80e29ee6 3704 - jmc@cvs.openbsd.org 2005/09/19 15:42:44
3705 [ssh.c]
3706 update -D usage here too;
2915e42b 3707 - djm@cvs.openbsd.org 2005/09/19 23:31:31
3708 [ssh.1]
3709 spelling nit from stevesk@
0d3d1077 3710 - djm@cvs.openbsd.org 2005/09/21 23:36:54
3711 [sshd_config.5]
3712 aquire -> acquire, from stevesk@
ae25711b 3713 - djm@cvs.openbsd.org 2005/09/21 23:37:11
3714 [sshd.c]
3715 change label at markus@'s request
8f921a4a 3716 - jaredy@cvs.openbsd.org 2005/09/30 20:34:26
3717 [ssh-keyscan.1]
3718 deploy .An -nosplit; ok jmc
d2130e1f 3719 - dtucker@cvs.openbsd.org 2005/10/03 07:44:42
3720 [canohost.c]
3721 Relocate check_ip_options call to prevent logging of garbage for
3722 connections with IP options set. bz#1092 from David Leonard,
3723 "looks good" deraadt@
1172d361 3724 - (dtucker) [regress/README.regress] Bug #989: Document limitation that scp
3725 is required in the system path for the multiplex test to work.
59e5aff5 3726
bfd17430 372720050930
3728 - (dtucker) [openbsd-compat/openbsd-compat.h] Bug #1096: Add prototype
3729 for strtoll. Patch from o.flebbe at science-computing.de.
cfb60d3a 3730 - (dtucker) [monitor.c] Bug #1087: Send loginmsg to preauth privsep
3731 child during PAM account check without clearing it. This restores the
3732 post-login warnings such as LDAP password expiry. Patch from Tomas Mraz
3733 with help from several others.
bfd17430 3734
140da888 373520050929
3736 - (dtucker) [monitor_wrap.c] Remove duplicate definition of loginmsg
3737 introduced during sync.
3738
4ebacf50 373920050928
3740 - (dtucker) [entropy.c] Use u_char for receiving RNG seed for consistency.
cafa6a80 3741 - (dtucker) [auth-pam.c] Bug #1028: send final non-query messages from
3742 PAM via keyboard-interactive. Patch tested by the folks at Vintela.
4ebacf50 3743
759ab0d9 374420050927
3745 - (dtucker) [entropy.c] Remove unnecessary tests for getuid and geteuid
3746 calls, since they can't possibly fail. ok djm@
72f02ae7 3747 - (dtucker) [entropy.c entropy.h sshd.c] Pass RNG seed to the reexec'ed
3748 process when sshd relies on ssh-random-helper. Should result in faster
3749 logins on systems without a real random device or prngd. ok djm@
759ab0d9 3750
b6c37221 375120050924
3752 - (dtucker) [auth2.c] Move start_pam() calls out of if-else block to remove
3753 duplicate call. ok djm@
3754
bb116c8e 375520050922
3756 - (dtucker) [configure.ac] Use -R linker flag for libedit too; patch from
3757 skeleten at shillest.net.
e47fb473 3758 - (dtucker) [configure.ac] Fix help for --with-opensc; patch from skeleten at
3759 shillest.net.
bb116c8e 3760
3466e002 376120050919
3762 - (tim) [aclocal.m4 configure.ac] Delete acconfig.h and add templates to
3763 AC_DEFINE and AC_DEFINE_UNQUOTED to quiet autoconf 2.59 warning messages.
f666dcfa 3764 ok dtucker@
3466e002 3765
f5555364 376620050912
3767 - (tim) [configure.ac] Bug 1078. Fix --without-kerberos5. Reported by
3768 Mike Frysinger.
3769
d2a3abef 377020050908
3771 - (tim) [defines.h openbsd-compat/port-uw.c] Add long password support to
3772 OpenServer 6 and add osr5bigcrypt support so when someone migrates
3773 passwords between UnixWare and OpenServer they will still work. OK dtucker@
3774
0b202697 3775$Id$
git-cvsimport mirror of OpenSSH
This page took 1.246711 seconds and 5 git commands to generate.