]> andersk Git - openssh.git/blame - ChangeLog
andersk / openssh.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
- (djm) [configure.ac] --with-selinux too
[openssh.git] / ChangeLog
CommitLineData
0b639bf6 120080327
2 - (dtucker) Cache selinux status earlier so we know if it's enabled after a
3 chroot. Allows ChrootDirectory to work with selinux support compiled in
4 but not enabled. Using it with selinux enabled will require some selinux
5 support inside the chroot. "looks sane" djm@
96110356 6 - (djm) Fix RCS ident in sftp-server-main.c
cea5c2ba 7 - (djm) OpenBSD CVS sync:
8 - jmc@cvs.openbsd.org 2008/02/11 07:58:28
9 [ssh.1 sshd.8 sshd_config.5]
10 bump Mdocdate for pages committed in "febuary", necessary because
11 of a typo in rcs.c;
d1978bb4 12 - deraadt@cvs.openbsd.org 2008/03/13 01:49:53
13 [monitor_fdpass.c]
14 Correct CMSG_SPACE and CMSG_LEN usage everywhere in the tree. Due to
15 an extensive discussion with otto, kettenis, millert, and hshoexer
93cdda57 16 - deraadt@cvs.openbsd.org 2008/03/15 16:19:02
17 [monitor_fdpass.c]
18 Repair the simple cases for msg_controllen where it should just be
19 CMSG_SIZE(sizeof(int)), not sizeof(buffer) which may be larger because
20 of alignment; ok kettenis hshoexer
530f04a8 21 - djm@cvs.openbsd.org 2008/03/23 12:54:01
22 [sftp-client.c]
23 prefer POSIX-style file renaming over filexfer rename behaviour if the
24 server supports the posix-rename@openssh.com extension.
25 Note that the old (filexfer) behaviour would refuse to clobber an
26 existing file. Users who depended on this should adjust their sftp(1)
27 usage.
28 ok deraadt@ markus@
cab36661 29 - deraadt@cvs.openbsd.org 2008/03/24 16:11:07
30 [monitor_fdpass.c]
31 msg_controllen has to be CMSG_SPACE so that the kernel can account for
32 each cmsg_len (ie. msg_controllen = sum of CMSG_ALIGN(cmsg_len). This
33 works now that kernel fd passing has been fixed to accept a bit of
34 sloppiness because of this ABI repair.
35 lots of discussion with kettenis
6e2a8e29 36 - djm@cvs.openbsd.org 2008/03/25 11:58:02
37 [session.c sshd_config.5]
38 ignore ~/.ssh/rc if a sshd_config ForceCommand is specified;
39 from dtucker@ ok deraadt@ djm@
0adb9449 40 - djm@cvs.openbsd.org 2008/03/25 23:01:41
41 [session.c]
42 last patch had backwards test; spotted by termim AT gmail.com
8c03e768 43 - djm@cvs.openbsd.org 2008/03/26 21:28:14
44 [auth-options.c auth-options.h session.c sshd.8]
45 add no-user-rc authorized_keys option to disable execution of ~/.ssh/rc
3b6ed4a3 46 - djm@cvs.openbsd.org 2008/03/27 00:16:49
47 [version.h]
48 openssh-4.9
f47fb977 49 - djm@cvs.openbsd.org 2008/03/24 21:46:54
50 [regress/sftp-badcmds.sh]
51 disable no-replace rename test now that we prefer a POSIX rename; spotted
52 by dkrause@
a0969097 53 - (djm) [configure.ac] fix alignment of --without-stackprotect description
bb23b54f 54 - (djm) [configure.ac] --with-selinux too
0b639bf6 55
3e782ad1 5620080315
57 - (djm) [regress/test-exec.sh] Quote putty-related variables in case they are
58 empty; report and patch from Peter Stuge
59 - (djm) [regress/test-exec.sh] Silence noise from detection of putty
60 commands; report from Peter Stuge
fab9144d 61 - (djm) [session.c] Relocate incorrectly-placed closefrom() that was causing
62 crashes when used with ChrootDirectory
3e782ad1 63
caba7de7 6420080314
65 - (tim) [regress/sftp-cmds.sh] s/cd/lcd/ in lls test. Reported by
66 vinschen at redhat.com. Add () to put echo commands in subshell for lls test
67 I mistakenly left out of last commit.
9e8c6eb3 68 - (tim) [regress/localcommand.sh] Shell portability fix. Reported by imorgan at
69 nas.nasa.gov
caba7de7 70
49f32817 7120080313
72 - (djm) [Makefile.in regress/Makefile] Fix interop-tests target (note to
73 self: make changes to Makefile.in next time, not the generated Makefile).
32f129d1 74 - (djm) [Makefile.in regress/test-exec.sh] Find installed plink(1) and
75 puttygen(1) by $PATH
af8388bc 76 - (tim) [scp.c] Use poll.h if available, fall back to sys/poll.h if not. Patch
77 by vinschen at redhat.com.
575a5ece 78 - (tim) [regress/sftp-cmds.sh regress/ssh2putty.sh] Shell portability fixes
7e384d2c 79 from vinschen at redhat.com and imorgan at nas.nasa.gov
49f32817 80
8120080312
7fc75605 82 - (djm) OpenBSD CVS Sync
83 - dtucker@cvs.openbsd.org 2007/10/29 06:57:13
84 [regress/Makefile regress/localcommand.sh]
85 Add simple regress test for LocalCommand; ok djm@
a7c7196f 86 - jmc@cvs.openbsd.org 2007/11/25 15:35:09
87 [regress/agent-getpeereid.sh regress/agent.sh]
88 more existant -> existent, from Martynas Venckus;
89 pfctl changes: ok henning
90 ssh changes: ok deraadt
5e441c3c 91 - djm@cvs.openbsd.org 2007/12/12 05:04:03
92 [regress/sftp-cmds.sh]
93 unbreak lls command and add a regress test that would have caught the
94 breakage; spotted by mouring@
95 NB. sftp code change already committed.
f3dad773 96 - djm@cvs.openbsd.org 2007/12/21 04:13:53
97 [regress/Makefile regress/test-exec.sh regress/putty-ciphers.sh]
98 [regress/putty-kex.sh regress/putty-transfer.sh regress/ssh2putty.sh]
99 basic (crypto, kex and transfer) interop regression tests against putty
100 To run these, install putty and run "make interop-tests" from the build
101 directory - the tests aren't run by default yet.
7fc75605 102
ce433d53 10320080311
83fa7e8d 104 - (dtucker) [auth-pam.c monitor.c session.c sshd.c] Bug #926: Move
105 pam_open_session and pam_close_session into the privsep monitor, which
106 will ensure that pam_session_close is called as root. Patch from Tomas
107 Mraz.
108
caa21240 10920080309
110 - (dtucker) [configure.ac] It turns out gcc's -fstack-protector-all doesn't
111 always work for all platforms and versions, so test what we can and
112 add a configure flag to turn it of if needed. ok djm@
b2c70125 113 - (dtucker) [openbsd-compat/port-aix.{c,h}] Remove AIX specific initgroups
114 implementation. It's not needed to fix bug #1081 and breaks the build
115 on some AIX configurations.
3828f887 116 - (dtucker) [openbsd-compat/regress/strtonumtest.c] Bug #1347: Use platform's
117 equivalent of LLONG_MAX for the compat regression tests, which makes them
118 run on AIX and HP-UX. Patch from David Leonard.
23c5c479 119 - (dtucker) [configure.ac] Run stack-protector tests with -Werror to catch
120 platforms where gcc understands the option but it's not supported (and
121 thus generates a warning).
caa21240 122
c9e2b157 12320080307
124 - (djm) OpenBSD CVS Sync
125 - jmc@cvs.openbsd.org 2008/02/11 07:58:28
126 [ssh.1 sshd.8 sshd_config.5]
127 bump Mdocdate for pages committed in "febuary", necessary because
128 of a typo in rcs.c;
3dfce5de 129 - djm@cvs.openbsd.org 2008/02/13 22:38:17
130 [servconf.h session.c sshd.c]
131 rekey arc4random and OpenSSL RNG in postauth child
132 closefrom fds > 2 before shell/command execution
133 ok markus@
2600996b 134 - mbalmer@cvs.openbsd.org 2008/02/14 13:10:31
135 [sshd.c]
136 When started in configuration test mode (-t) do not check that sshd is
137 being started with an absolute path.
138 ok djm
e2875d9a 139 - markus@cvs.openbsd.org 2008/02/20 15:25:26
140 [session.c]
141 correct boolean encoding for coredump; der Mouse via dugsong
1d395ba0 142 - djm@cvs.openbsd.org 2008/02/22 05:58:56
143 [session.c]
144 closefrom() call was too early, delay it until just before we execute
145 the user's rc files (if any).
ac47b626 146 - dtucker@cvs.openbsd.org 2008/02/22 20:44:02
147 [clientloop.c packet.c packet.h serverloop.c]
148 Allow all SSH2 packet types, including UNIMPLEMENTED to reset the
149 keepalive timer (bz #1307). ok markus@
9fcc4e18 150 - djm@cvs.openbsd.org 2008/02/27 20:21:15
151 [sftp-server.c]
152 add an extension method "posix-rename@openssh.com" to perform POSIX atomic
153 rename() operations. based on patch from miklos AT szeredi.hu in bz#1400;
154 ok dtucker@ markus@
0c9a63f1 155 - deraadt@cvs.openbsd.org 2008/03/02 18:19:35
156 [monitor_fdpass.c]
157 use a union to ensure alignment of the cmsg (pay attention: various other
158 parts of the tree need this treatment too); ok djm
3673ea60 159 - deraadt@cvs.openbsd.org 2008/03/04 21:15:42
160 [version.h]
161 crank version; from djm
9fd799a4 162 - (tim) [regress/sftp-glob.sh] Shell portability fix.
c9e2b157 163
fbfeb0de 16420080302
165 - (dtucker) [configure.ac] FreeBSD's glob() doesn't behave the way we expect
166 either, so use our own.
167
6ce84f4f 16820080229
169 - (dtucker) [openbsd-compat/bsd-poll.c] We don't check for select(2) in
170 configure (and there's not much point, as openssh won't work without it)
171 so HAVE_SELECT is not defined and the poll(2) compat code doesn't get
172 built in. Remove HAVE_SELECT so we can build on platforms without poll.
55b82b39 173 - (dtucker) [scp.c] Include sys/poll.h inside HAVE_SYS_POLL_H.
29317db4 174 - (djm) [contrib/gnome-ssh-askpass2.h] Keep askpass windown on top. From
175 Debian patch via bernd AT openbsd.org
6ce84f4f 176
ebddd492 17720080228
178 - (dtucker) [configure.ac] Add -fstack-protector to LDFLAGS too, fixes
179 linking problems on AIX with gcc 4.1.x.
f5f25d17 180 - (dtucker) [includes.h ssh-add.c ssh-agent.c ssh-keygen.c ssh.c sshd.c
181 openbsd-compat/openssl-compat.{c,h}] Bug #1437 Move the OpenSSL compat
182 header to after OpenSSL headers, since some versions of OpenSSL have
183 SSLeay_add_all_algorithms as a macro already.
6e013118 184 - (dtucker) [key.c defines.h openbsd-compat/openssl-compat.h] Move old OpenSSL
185 compat glue into openssl-compat.h.
533a78f0 186 - (dtucker) [configure.ac openbsd-compat/port-aix.{c,h}] Bug #1081: Implement
187 getgrouplist via getgrset on AIX, rather than iterating over getgrent.
188 This allows, eg, Match and AllowGroups directives to work with NIS and
189 LDAP groups.
5c7fd4ce 190 - (dtucker) [sshd.c] Bug #1042: make log messages for tcpwrappers use the
191 same SyslogFacility as the rest of sshd. Patch from William Knox,
192 ok djm@.
ebddd492 193
2db5d1e9 19420080225
195 - (dtucker) [openbsd-compat/fake-rfc2553.h] rename ssh_gai_strerror hack
196 since it now conflicts with the helper function in misc.c. From
197 vinschen AT redhat.com.
a74e9b64 198 - (dtucker) [configure.ac audit-bsm.c] Bug #1420: Add a local implementation
199 of aug_get_machine for systems that don't have their own (eg OS X, FreeBSD).
200 Help and testing from csjp at FreeBSD org, vgiffin at apple com. ok djm@
3e35bb36 201 - (dtucker) [includes.h openbsd-compat/openssl-compat.c] Bug #1437: reshuffle
202 headers so ./configure --with-ssl-engine actually works. Patch from
203 Ian Lister.
2db5d1e9 204
880a060b 20520080224
206 - (tim) [contrib/cygwin/ssh-host-config]
207 Grammar changes on SYSCONFDIR LOCALSTATEDIR messages.
208 Check more thoroughly that it's possible to create the /var/empty directory.
209 Patch by vinschen AT redhat.com
210
737cce6f 21120080210
212 - OpenBSD CVS Sync
213 - chl@cvs.openbsd.org 2008/01/11 07:22:28
214 [sftp-client.c sftp-client.h]
215 disable unused functions
216 initially from tobias@, but disabled them by placing them in
217 "#ifdef notyet" which was asked by djm@
218 ok djm@ tobias@
05841f5b 219 - djm@cvs.openbsd.org 2008/01/19 19:13:28
220 [ssh.1]
221 satisfy the pedants: -q does not suppress all diagnostic messages (e.g.
222 some commandline parsing warnings go unconditionally to stdout).
4d6760a7 223 - djm@cvs.openbsd.org 2008/01/19 20:48:53
224 [clientloop.c]
225 fd leak on session multiplexing error path. Report and patch from
226 gregory_shively AT fanniemae.com
7cd4e5bc 227 - djm@cvs.openbsd.org 2008/01/19 20:51:26
228 [ssh.c]
229 ignore SIGPIPE in multiplex client mode - we can receive this if the
230 server runs out of fds on us midway. Report and patch from
231 gregory_shively AT fanniemae.com
1c861236 232 - djm@cvs.openbsd.org 2008/01/19 22:04:57
233 [sftp-client.c]
234 fix remote handle leak in do_download() local file open error path;
235 report and fix from sworley AT chkno.net
ccc6beea 236 - djm@cvs.openbsd.org 2008/01/19 22:22:58
237 [ssh-keygen.c]
238 when hashing individual hosts (ssh-keygen -Hf hostname), make sure we
239 hash just the specified hostname and not the entire hostspec from the
240 keyfile. It may be of the form "hostname,ipaddr", which would lead to
241 a hash that never matches. report and fix from jp AT devnull.cz
f8f89bae 242 - djm@cvs.openbsd.org 2008/01/19 22:37:19
243 [ssh-keygen.c]
244 unbreak line numbering (broken in revision 1.164), fix error message
bc4cc956 245 - djm@cvs.openbsd.org 2008/01/19 23:02:40
246 [channels.c]
247 When we added support for specified bind addresses for port forwards, we
248 added a quirk SSH_OLD_FORWARD_ADDR. There is a bug in our handling of
249 this for -L port forwards that causes the client to listen on both v4
250 and v6 addresses when connected to a server with this quirk, despite
251 having set 0.0.0.0 as a bind_address.
252 report and patch from Jan.Pechanec AT Sun.COM; ok dtucker@
fe771396 253 - djm@cvs.openbsd.org 2008/01/19 23:09:49
254 [readconf.c readconf.h sshconnect2.c]
255 promote rekeylimit to a int64 so it can hold the maximum useful limit
256 of 2^32; report and patch from Jan.Pechanec AT Sun.COM, ok dtucker@
70755b3b 257 - djm@cvs.openbsd.org 2008/01/20 00:38:30
258 [sftp.c]
259 When uploading, correctly handle the case of an unquoted filename with
260 glob metacharacters that match a file exactly but not as a glob, e.g. a
261 file called "[abcd]". report and test cases from duncan2nd AT gmx.de
b4bbe43c 262 - djm@cvs.openbsd.org 2008/01/21 17:24:30
263 [sftp-server.c]
264 Remove the fixed 100 handle limit in sftp-server and allocate as many
265 as we have available file descriptors. Patch from miklos AT szeredi.hu;
266 ok dtucker@ markus@
514a858e 267 - djm@cvs.openbsd.org 2008/01/21 19:20:17
268 [sftp-client.c]
269 when a remote write error occurs during an upload, ensure that ACKs for
270 all issued requests are properly drained. patch from t8m AT centrum.cz
aacfb17b 271 - dtucker@cvs.openbsd.org 2008/01/23 01:56:54
272 [clientloop.c packet.c serverloop.c]
273 Revert the change for bz #1307 as it causes connection aborts if an IGNORE
274 packet arrives while we're waiting in packet_read_expect (and possibly
275 elsewhere).
51402e76 276 - jmc@cvs.openbsd.org 2008/01/31 20:06:50
277 [scp.1]
278 explain how to handle local file names containing colons;
279 requested by Tamas TEVESZ
280 ok dtucker
c33ba17e 281 - markus@cvs.openbsd.org 2008/02/04 21:53:00
282 [session.c sftp-server.c sftp.h]
283 link sftp-server into sshd; feedback and ok djm@
7c36e880 284 - mcbride@cvs.openbsd.org 2008/02/09 12:15:43
285 [ssh.1 sshd.8]
286 Document the correct permissions for the ~/.ssh/ directory.
287 ok jmc
2bd88d9f 288 - djm@cvs.openbsd.org 2008/02/10 09:55:37
289 [sshd_config.5]
290 mantion that "internal-sftp" is useful with ForceCommand too
c5bf32e6 291 - djm@cvs.openbsd.org 2008/02/10 10:54:29
292 [servconf.c session.c]
293 delay ~ expansion for ChrootDirectory so it expands to the logged-in user's
294 home, rather than the user who starts sshd (probably root)
737cce6f 295
efcc134b 29620080119
297 - (djm) Silence noice from expr in ssh-copy-id; patch from
298 mikel AT mikelward.com
8eff0d0a 299 - (djm) Only listen for IPv6 connections on AF_INET6 sockets; patch from
300 tsr2600 AT gmail.com
efcc134b 301
bd326285 30220080102
303 - (dtucker) [configure.ac] Fix message for -fstack-protector-all test.
304
2a72bc03 30520080101
306 - (dtucker) OpenBSD CVS Sync
307 - dtucker@cvs.openbsd.org 2007/12/31 10:41:31
308 [readconf.c servconf.c]
309 Prevent strict-aliasing warnings on newer gcc versions. bz #1355, patch
310 from Dmitry V. Levin, ok djm@
59d68bae 311 - dtucker@cvs.openbsd.org 2007/12/31 15:27:04
312 [sshd.c]
313 When in inetd mode, have sshd generate a Protocol 1 ephemeral server
314 key only for connections where the client chooses Protocol 1 as opposed
315 to when it's enabled in the server's config. Speeds up Protocol 2
316 connections to inetd-mode servers that also allow Protocol 1. bz #440,
317 based on a patch from bruno at wolff.to, ok markus@
e5088d08 318 - dtucker@cvs.openbsd.org 2008/01/01 08:47:04
319 [misc.c]
320 spaces -> tabs from my previous commit
321 - dtucker@cvs.openbsd.org 2008/01/01 09:06:39
322 [scp.c]
323 If scp -p encounters a pre-epoch timestamp, use the epoch which is
324 as close as we can get given that it's used unsigned. Add a little
325 debugging while there. bz #828, ok djm@
2ef741a3 326 - dtucker@cvs.openbsd.org 2008/01/01 09:27:33
327 [sshd_config.5 servconf.c]
328 Allow PermitRootLogin in a Match block. Allows for, eg, permitting root
329 only from the local network. ok markus@, man page bit ok jmc@
c9babd71 330 - dtucker@cvs.openbsd.org 2008/01/01 08:51:20
331 [moduli]
332 Updated moduli file; ok djm@
2a72bc03 333
a8ad3b9d 33420071231
335 - (dtucker) [configure.ac openbsd-compat/glob.{c,h}] Bug #1407: force use of
336 builtin glob implementation on Mac OS X. Based on a patch from
337 vgiffin at apple.
338
65172fff 33920071229
340 - (dtucker) OpenBSD CVS Sync
341 - djm@cvs.openbsd.org 2007/12/12 05:04:03
342 [sftp.c]
343 unbreak lls command and add a regress test that would have caught the
344 breakage; spotted by mouring@
bb4626fe 345 - dtucker@cvs.openbsd.org 2007/12/27 14:22:08
346 [servconf.c canohost.c misc.c channels.c sshconnect.c misc.h ssh-keyscan.c
347 sshd.c]
348 Add a small helper function to consistently handle the EAI_SYSTEM error
349 code of getaddrinfo. Prompted by vgiffin at apple com via bz #1417.
350 ok markus@ stevesk@
271db2da 351 - dtucker@cvs.openbsd.org 2007/12/28 15:32:24
352 [clientloop.c serverloop.c packet.c]
353 Make SSH2_MSG_UNIMPLEMENTED and SSH2_MSG_IGNORE messages reset the
354 ServerAlive and ClientAlive timers. Prevents dropping a connection
355 when these are enabled but the peer does not support our keepalives.
356 bz #1307, ok djm@.
016f1482 357 - dtucker@cvs.openbsd.org 2007/12/28 22:34:47
358 [clientloop.c]
359 Use the correct packet maximum sizes for remote port and agent forwarding.
360 Prevents the server from killing the connection if too much data is queued
361 and an excessively large packet gets sent. bz #1360, ok djm@.
65172fff 362
eb5a7224 36320071202
364 - (dtucker) [configure.ac] Enable -fstack-protector-all on systems where
365 gcc supports it. ok djm@
4b565fda 366 - (dtucker) [scp.c] Update $OpenBSD tag missing from rev 1.175 and remove
367 leftover debug code.
ecb431c1 368 - (dtucker) OpenBSD CVS Sync
369 - dtucker@cvs.openbsd.org 2007/10/29 00:52:45
370 [auth2-gss.c]
371 Allow build without -DGSSAPI; ok deraadt@
372 (Id sync only, Portable already has the ifdefs)
d0420e01 373 - dtucker@cvs.openbsd.org 2007/10/29 01:55:04
374 [ssh.c]
375 Plug tiny mem leaks in ControlPath and ProxyCommand option processing;
376 ok djm@
dc0cae51 377 - dtucker@cvs.openbsd.org 2007/10/29 04:08:08
378 [monitor_wrap.c monitor.c]
379 Send config block back to slave for invalid users too so options
380 set by a Match block (eg Banner) behave the same for non-existent
381 users. Found by and ok djm@
d349e4bd 382 - dtucker@cvs.openbsd.org 2007/10/29 06:51:59
383 [ssh_config.5]
384 ProxyCommand and LocalCommand use the user's shell, not /bin/sh; ok djm@
c80e7e5d 385 - dtucker@cvs.openbsd.org 2007/10/29 06:54:50
386 [ssh.c]
387 Make LocalCommand work for Protocol 1 too; ok djm@
eb86ca9d 388 - jmc@cvs.openbsd.org 2007/10/29 07:48:19
389 [ssh_config.5]
390 clean up after previous macro removal;
16912319 391 - djm@cvs.openbsd.org 2007/11/03 00:36:14
392 [clientloop.c]
393 fix memory leak in process_cmdline(), patch from Jan.Pechanec AT Sun.COM;
394 ok dtucker@
a7082e17 395 - deraadt@cvs.openbsd.org 2007/11/03 01:24:06
396 [ssh.c]
397 bz #1377: getpwuid results were being clobbered by another getpw* call
398 inside tilde_expand_filename(); save the data we need carefully
399 ok djm
42f4b33f 400 - dtucker@cvs.openbsd.org 2007/11/03 02:00:32
401 [ssh.c]
402 Use xstrdup/xfree when saving pwname and pwdir; ok deraadt@
f622d144 403 - deraadt@cvs.openbsd.org 2007/11/03 02:03:49
404 [ssh.c]
405 avoid errno trashing in signal handler; ok dtucker
eb5a7224 406
d884586a 40720071030
408 - (djm) OpenBSD CVS Sync
409 - djm@cvs.openbsd.org 2007/10/29 23:49:41
410 [openbsd-compat/sys-tree.h]
411 remove extra backslash at the end of RB_PROTOTYPE, report from
412 Jan.Pechanec AT Sun.COM; ok deraadt@
413
73209290 41420071026
415 - (djm) OpenBSD CVS Sync
416 - stevesk@cvs.openbsd.org 2007/09/11 23:49:09
417 [sshpty.c]
418 remove #if defined block not needed; ok markus@ dtucker@
419 (NB. RCD ID sync only for portable)
530c2ec0 420 - djm@cvs.openbsd.org 2007/09/21 03:05:23
421 [ssh_config.5]
422 document KbdInteractiveAuthentication in ssh_config.5;
423 patch from dkg AT fifthhorseman.net
a3d3770c 424 - djm@cvs.openbsd.org 2007/09/21 08:15:29
425 [auth-bsdauth.c auth-passwd.c auth.c auth.h auth1.c auth2-chall.c]
426 [monitor.c monitor_wrap.c]
427 unifdef -DBSD_AUTH
428 unifdef -USKEY
429 These options have been in use for some years;
430 ok markus@ "no objection" millert@
431 (NB. RCD ID sync only for portable)
18660b86 432 - canacar@cvs.openbsd.org 2007/09/25 23:48:57
433 [ssh-agent.c]
434 When adding a key that already exists, update the properties
435 (time, confirm, comment) instead of discarding them. ok djm@ markus@
5e4fce9c 436 - ray@cvs.openbsd.org 2007/09/27 00:15:57
437 [dh.c]
438 Don't return -1 on error in dh_pub_is_valid(), since it evaluates
439 to true.
440 Also fix a typo.
441 Initial diff from Matthew Dempsky, input from djm.
442 OK djm, markus.
e05f182e 443 - dtucker@cvs.openbsd.org 2007/09/29 00:25:51
444 [auth2.c]
445 Remove unused prototype. ok djm@
3e2d9453 446 - chl@cvs.openbsd.org 2007/10/02 17:49:58
447 [ssh-keygen.c]
448 handles zero-sized strings that fgets can return
c5b78b8e 449 properly removes trailing newline
450 removes an unused variable
451 correctly counts line number
452 "looks ok" ray@ markus@
c462cd6f 453 - markus@cvs.openbsd.org 2007/10/22 19:10:24
454 [readconf.c]
455 make sure that both the local and remote port are correct when
456 parsing -L; Jan Pechanec (bz #1378)
a733c71c 457 - djm@cvs.openbsd.org 2007/10/24 03:30:02
458 [sftp.c]
459 rework argument splitting and parsing to cope correctly with common
460 shell escapes and make handling of escaped characters consistent
461 with sh(1) and between sftp commands (especially between ones that
462 glob their arguments and ones that don't).
463 parse command flags using getopt(3) rather than hand-rolled parsers.
464 ok dtucker@
99b49072 465 - djm@cvs.openbsd.org 2007/10/24 03:44:02
466 [scp.c]
467 factor out network read/write into an atomicio()-like function, and
468 use it to handle short reads, apply bandwidth limits and update
469 counters. make network IO non-blocking, so a small trickle of
470 reads/writes has a chance of updating the progress meter; bz #799
471 ok dtucker@
49e0d774 472 - djm@cvs.openbsd.org 2006/08/29 09:44:00
473 [regress/sftp-cmds.sh]
474 clean up our mess
04ebbaad 475 - markus@cvs.openbsd.org 2006/11/06 09:27:43
476 [regress/cfgmatch.sh]
477 fix quoting for non-(c)sh login shells.
1c158420 478 - dtucker@cvs.openbsd.org 2006/12/13 08:36:36
479 [regress/cfgmatch.sh]
480 Additional test for multiple PermitOpen entries. ok djm@
ac01e61a 481 - pvalchev@cvs.openbsd.org 2007/06/07 19:41:46
482 [regress/cipher-speed.sh regress/try-ciphers.sh]
483 test umac-64@openssh.com
484 ok djm@
ba59fd15 485 - djm@cvs.openbsd.org 2007/10/24 03:32:35
486 [regress/sftp-cmds.sh regress/sftp-glob.sh regress/test-exec.sh]
487 comprehensive tests for sftp escaping its interaction with globbing;
488 ok dtucker@
2432048a 489 - djm@cvs.openbsd.org 2007/10/26 05:30:01
490 [regress/sftp-glob.sh regress/test-exec.sh]
491 remove "echo -E" crap that I added in last commit and use printf(1) for
492 cases where we strictly require echo not to reprocess escape characters.
9e8278d2 493 - deraadt@cvs.openbsd.org 2005/11/28 17:50:12
494 [openbsd-compat/glob.c]
495 unused arg in internal static API
0af8cee7 496 - jakob@cvs.openbsd.org 2007/10/11 18:36:41
d6f5019c 497 [openbsd-compat/getrrsetbyname.c openbsd-compat/getrrsetbyname.h]
0af8cee7 498 use RRSIG instead of SIG for DNSSEC. ok djm@
a9733dc0 499 - otto@cvs.openbsd.org 2006/10/21 09:55:03
500 [openbsd-compat/base64.c]
501 remove calls to abort(3) that can't happen anyway; from
502 <bret dot lambert at gmail.com>; ok millert@ deraadt@
49f7b80f 503 - frantzen@cvs.openbsd.org 2004/04/24 18:11:46
504 [openbsd-compat/sys-tree.h]
4987209d 505 sync to Niels Provos' version. avoid unused variable warning in
506 RB_NEXT()
49f7b80f 507 - tdeval@cvs.openbsd.org 2004/11/24 18:10:42
508 [openbsd-compat/sys-tree.h]
509 typo
e271997a 510 - grange@cvs.openbsd.org 2004/05/04 16:59:32
511 [openbsd-compat/sys-queue.h]
512 Remove useless ``elm'' argument from the SIMPLEQ_REMOVE_HEAD macro.
513 This matches our SLIST behaviour and NetBSD's SIMPLEQ as well.
514 ok millert krw deraadt
d0f02ff0 515 - deraadt@cvs.openbsd.org 2005/02/25 13:29:30
516 [openbsd-compat/sys-queue.h]
517 minor white spacing
2d67e48d 518 - otto@cvs.openbsd.org 2005/10/17 20:19:42
519 [openbsd-compat/sys-queue.h]
520 Performing certain operations on queue.h data structurs produced
521 funny results. An example is calling LIST_REMOVE on the same
522 element twice. This will not fail, but result in a data structure
523 referencing who knows what. Prevent these accidents by NULLing some
524 fields on remove and replace. This way, either a panic or segfault
525 will be produced on the faulty operation.
95760c2a 526 - otto@cvs.openbsd.org 2005/10/24 20:25:14
527 [openbsd-compat/sys-queue.h]
528 Partly backout. NOLIST, used in LISTs is probably interfering.
529 requested by deraadt@
5fda41d4 530 - otto@cvs.openbsd.org 2005/10/25 06:37:47
531 [openbsd-compat/sys-queue.h]
532 Some uvm problem is being exposed with the more strict macros.
533 Revert until we've found out what's causing the panics.
c7215802 534 - otto@cvs.openbsd.org 2005/11/25 08:06:25
535 [openbsd-compat/sys-queue.h]
536 Introduce debugging aid for queue macros. Disabled by default; but
537 developers are encouraged to run with this enabled.
538 ok krw@ fgsch@ deraadt@
9a35f8ed 539 - otto@cvs.openbsd.org 2007/04/30 18:42:34
540 [openbsd-compat/sys-queue.h]
541 Enable QUEUE_MACRO_DEBUG on DIAGNOSTIC kernels.
542 Input and okays from krw@, millert@, otto@, deraadt@, miod@.
5f762762 543 - millert@cvs.openbsd.org 2004/10/07 16:56:11
544 GLOB_NOESCAPE is POSIX so move it out of the #ifndef _POSIX_SOURCE
545 block.
546 (NB. mostly an RCS ID sync, as portable strips out the conditionals)
a556beb5 547 - (djm) [regress/sftp-cmds.sh]
548 Use more restrictive glob to pick up test files from /bin - some platforms
549 ship broken symlinks there which could spoil the test.
882d4fb0 550 - (djm) [openbsd-compat/bindresvport.c]
551 Sync RCS ID after irrelevant (for portable OpenSSH) header shuffling
530c2ec0 552
8aa5db7d 55320070927
554 - (dtucker) [configure.ac atomicio.c] Fall back to including <sys/poll.h> if
555 we don't have <poll.h> (eq QNX). From bacon at cs nyu edu.
86996ebe 556 - (dtucker) [configure.ac defines.h] Shadow expiry does not work on QNX6
557 so disable it for that platform. From bacon at cs nyu edu.
8aa5db7d 558
9e994eff 55920070921
560 - (djm) [atomicio.c] Fix spin avoidance for platforms that define
561 EWOULDBLOCK; patch from ben AT psc.edu
562
590c0dda 56320070917
564 - (djm) OpenBSD CVS Sync
565 - djm@cvs.openbsd.org 2007/08/23 02:49:43
566 [auth-passwd.c auth.c session.c]
567 unifdef HAVE_LOGIN_CAP; ok deraadt@ millert@
568 NB. RCS ID sync only for portable
466143fd 569 - djm@cvs.openbsd.org 2007/08/23 02:55:51
570 [auth-passwd.c auth.c session.c]
571 missed include bits from last commit
572 NB. RCS ID sync only for portable
2aa63b7b 573 - djm@cvs.openbsd.org 2007/08/23 03:06:10
574 [auth.h]
575 login_cap.h doesn't belong here
576 NB. RCS ID sync only for portable
ba8cfba6 577 - djm@cvs.openbsd.org 2007/08/23 03:22:16
578 [auth2-none.c sshd_config sshd_config.5]
579 Support "Banner=none" to disable displaying of the pre-login banner;
580 ok dtucker@ deraadt@
3af8ef1e 581 - djm@cvs.openbsd.org 2007/08/23 03:23:26
582 [sshconnect.c]
583 Execute ProxyCommands with $SHELL rather than /bin/sh unconditionally
8de7aaab 584 - djm@cvs.openbsd.org 2007/09/04 03:21:03
585 [clientloop.c monitor.c monitor_fdpass.c monitor_fdpass.h]
586 [monitor_wrap.c ssh.c]
587 make file descriptor passing code return an error rather than call fatal()
588 when it encounters problems, and use this to make session multiplexing
589 masters survive slaves failing to pass all stdio FDs; ok markus@
71300a43 590 - djm@cvs.openbsd.org 2007/09/04 11:15:56
591 [ssh.c sshconnect.c sshconnect.h]
592 make ssh(1)'s ConnectTimeout option apply to both the TCP connection and
593 SSH banner exchange (previously it just covered the TCP connection).
594 This allows callers of ssh(1) to better detect and deal with stuck servers
595 that accept a TCP connection but don't progress the protocol, and also
596 makes ConnectTimeout useful for connections via a ProxyCommand;
597 feedback and "looks ok" markus@
269cfc8a 598 - sobrado@cvs.openbsd.org 2007/09/09 11:38:01
599 [ssh-add.c ssh-agent.1 ssh-agent.c ssh-keygen.c]
600 sort synopsis and options in ssh-agent(1); usage is lowercase
601 ok jmc@
39fa9566 602 - stevesk@cvs.openbsd.org 2007/09/11 04:36:29
603 [sshpty.c]
604 sort #include
605 NB. RCS ID sync only
b05117ac 606 - gilles@cvs.openbsd.org 2007/09/11 15:47:17
607 [session.c ssh-keygen.c sshlogin.c]
608 use strcspn to properly overwrite '\n' in fgets returned buffer
609 ok pyr@, ray@, millert@, moritz@, chl@
f119adf5 610 - stevesk@cvs.openbsd.org 2007/09/11 23:49:09
611 [sshpty.c]
612 remove #if defined block not needed; ok markus@ dtucker@
613 NB. RCS ID sync only
7cfacf5e 614 - stevesk@cvs.openbsd.org 2007/09/12 19:39:19
615 [umac.c]
616 use xmalloc() and xfree(); ok markus@ pvalchev@
f8f7ecf5 617 - djm@cvs.openbsd.org 2007/09/13 04:39:04
618 [sftp-server.c]
619 fix incorrect test when setting syslog facility; from Jan Pechanec
9e7f4c4f 620 - djm@cvs.openbsd.org 2007/09/16 00:55:52
621 [sftp-client.c]
622 use off_t instead of u_int64_t for file offsets, matching what the
623 progressmeter code expects; bz #842
7bf7b86c 624 - (tim) [defines.h] Fix regression in long password support on OpenServer 6.
625 Problem report and additional testing rac AT tenzing.org.
590c0dda 626
e5fe7821 62720070914
628 - (dtucker) [openbsd-compat/bsd-asprintf.c] Plug mem leak in error path.
629 Patch from Jan.Pechanec at sun com.
630
822e80ce 63120070910
632 - (dtucker) [openbsd-compat/regress/closefromtest.c] Bug #1358: Always
633 return 0 on successful test. From David.Leonard at quest com.
d837615a 634 - (tim) [configure.ac] Autoconf didn't define HAVE_LIBIAF because we
635 did a AC_CHECK_FUNCS within the AC_CHECK_LIB test.
822e80ce 636
145707ab 63720070817
638 - (dtucker) [sshd.8] Many Linux variants use a single "!" to denote locked
639 accounts and that's what the code looks for, so make man page and code
640 agree. Pointed out by Roumen Petrov.
85eed7c2 641 - (dtucker) [INSTALL] Group the parts describing random options and PAM
642 implementations together which is hopefully more coherent.
3d1d89ea 643 - (dtucker) [INSTALL] the pid file is sshd.pid not ssh.pid.
49f63a45 644 - (dtucker) [INSTALL] Give PAM its own heading.
3c4db087 645 - (dtucker) [INSTALL] Link to tcpwrappers.
145707ab 646
8d5728b7 64720070816
648 - (dtucker) [session.c] Call PAM cleanup functions for unauthenticated
649 connections too. Based on a patch from Sandro Wefel, with & ok djm@
650
ed64eeca 65120070815
652 - (dtucker) OpenBSD CVS Sync
653 - markus@cvs.openbsd.org 2007/08/15 08:14:46
654 [clientloop.c]
655 do NOT fall back to the trused x11 cookie if generation of an untrusted
9c36d7f7 656 cookie fails; from Jan Pechanec, via security-alert at sun.com;
657 ok dtucker
3f921d0e 658 - markus@cvs.openbsd.org 2007/08/15 08:16:49
659 [version.h]
660 openssh 4.7
1ce8114b 661 - stevesk@cvs.openbsd.org 2007/08/15 12:13:41
662 [ssh_config.5]
663 tun device forwarding now honours ExitOnForwardFailure; ok markus@
06d20497 664 - (dtucker) [openbsd-compat/bsd-cray.c] Remove debug from signal handler.
665 ok djm@
4671cc21 666 - (dtucker) [README contrib/caldera/openssh.spec contrib/redhat/openssh.spec
667 contrib/suse/openssh.spec] Crank version.
ed64eeca 668
265edd5e 66920070813
670 - (dtucker) [session.c] Bug #1339: ensure that pam_setcred() is always
671 called with PAM_ESTABLISH_CRED at least once, which resolves a problem
672 with pam_dhkeys. Patch from David Leonard, ok djm@
673
6b3e6430 67420070810
675 - (dtucker) [auth-pam.c] Use sigdie here too. ok djm@
575ee4c4 676 - (dtucker) [configure.ac] Bug #1343: Set DISABLE_FD_PASSING for QNX6. From
677 Matt Kraai, ok djm@
6b3e6430 678
86c718e3 67920070809
680 - (dtucker) [openbsd-compat/port-aix.c] Comment typo.
549d7c4d 681 - (dtucker) [README.platform] Document the interaction between PermitRootLogin
682 and the AIX native login restrictions.
929a784c 683 - (dtucker) [defines.h] Remove _PATH_{CSHELL,SHELLS} which aren't
684 used anywhere and are a potential source of warnings.
86c718e3 685
1b73b60e 68620070808
687 - (djm) OpenBSD CVS Sync
688 - ray@cvs.openbsd.org 2007/07/12 05:48:05
689 [key.c]
690 Delint: remove some unreachable statements, from Bret Lambert.
691 OK markus@ and dtucker@.
d0ac0d65 692 - sobrado@cvs.openbsd.org 2007/08/06 19:16:06
693 [scp.1 scp.c]
694 the ellipsis is not an optional argument; while here, sync the usage
695 and synopsis of commands
696 lots of good ideas by jmc@
697 ok jmc@
79303c5a 698 - djm@cvs.openbsd.org 2007/08/07 07:32:53
699 [clientloop.c clientloop.h ssh.c]
700 bz#1232: ensure that any specified LocalCommand is executed after the
701 tunnel device is opened. Also, make failures to open a tunnel device
702 fatal when ExitOnForwardFailure is active.
703 Reported by h.goebel AT goebel-consult.de; ok dtucker markus reyk deraadt
1b73b60e 704
af12bf9c 70520070724
706 - (tim) [openssh.xml.in] make FMRI match what package scripts use.
87f560bb 707 - (tim) [openbsd-compat/regress/closefromtest.c] Bug 1345: fix open() call.
25c1216a 708 Report/patch by David.Leonard AT quest.com (and Bernhard Simon)
5498741c 709 - (tim) [buildpkg.sh.in openssh.xml.in] Allow more flexibility where smf(5)
a817bc2b 710 - (tim) [buildpkg.sh.in] s|$FAKE_ROOT/${sysconfdir}|$FAKE_ROOT${sysconfdir}|
af12bf9c 711
665ca996 71220070628
713 - (djm) bz#1325: Fix SELinux in permissive mode where it would
714 incorrectly fatal() on errors. patch from cjwatson AT debian.org;
715 ok dtucker
716
91044296 71720070625
718 - (dtucker) OpenBSD CVS Sync
719 - djm@cvs.openbsd.org 2007/06/13 00:21:27
720 [scp.c]
721 don't ftruncate() non-regular files; bz#1236 reported by wood AT
722 xmission.com; ok dtucker@
2c505585 723 - djm@cvs.openbsd.org 2007/06/14 21:43:25
724 [ssh.c]
725 handle EINTR when waiting for mux exit status properly
50455824 726 - djm@cvs.openbsd.org 2007/06/14 22:48:05
727 [ssh.c]
728 when waiting for the multiplex exit status, read until the master end
729 writes an entire int of data *and* closes the client_fd; fixes mux
730 regression spotted by dtucker, ok dtucker@
5a5e8b42 731 - djm@cvs.openbsd.org 2007/06/19 02:04:43
732 [atomicio.c]
733 if the fd passed to atomicio/atomiciov() is non blocking, then poll() to
734 avoid a spin if it is not yet ready for reading/writing; ok dtucker@
d9245683 735 - dtucker@cvs.openbsd.org 2007/06/25 08:20:03
736 [channels.c]
737 Correct test for window updates every three packets; prevents sending
738 window updates for every single packet. ok markus@
12ae19b0 739 - dtucker@cvs.openbsd.org 2007/06/25 12:02:27
740 [atomicio.c]
741 Include <poll.h> like the man page says rather than <sys/poll.h>. ok djm@
15aaadea 742 - (dtucker) [atomicio.c] Test for EWOULDBLOCK in atomiciov to match
743 atomicio.
6d39a5c4 744 - (dtucker) [atomicio.c configure.ac openbsd-compat/Makefile.in
745 openbsd-compat/bsd-poll.{c,h} openbsd-compat/openbsd-compat.h]
746 Add an implementation of poll() built on top of select(2). Code from
747 OpenNTPD with changes suggested by djm. ok djm@
91044296 748
cc43e894 74920070614
750 - (dtucker) [cipher-ctr.c umac.c openbsd-compat/openssl-compat.h] Move the
751 USE_BUILTIN_RIJNDAEL compat goop to openssl-compat.h so it can be
752 shared with umac.c. Allows building with OpenSSL 0.9.5 again including
753 umac support. With tim@ djm@, ok djm.
bff0be25 754 - (dtucker) [openbsd-compat/openssl-compat.h] Merge USE_BUILTIN_RIJNDAEL
755 sections. Fixes builds with early OpenSSL 0.9.6 versions.
9c9c3030 756 - (dtucker) [openbsd-compat/openssl-compat.h] Remove redundant definition
757 of USE_BUILTIN_RIJNDAEL since the <0.9.6 test is covered by the
758 subsequent <0.9.7 test.
cc43e894 759
e110afc3 76020070612
761 - (dtucker) OpenBSD CVS Sync
762 - markus@cvs.openbsd.org 2007/06/11 09:14:00
763 [channels.h]
764 increase default channel windows; ok djm
8f41056c 765 - djm@cvs.openbsd.org 2007/06/12 07:41:00
766 [ssh-add.1]
767 better document ssh-add's -d option (delete identies from agent), bz#1224
768 new text based on some provided by andrewmc-debian AT celt.dias.ie;
769 ok dtucker@
73d4e9cc 770 - djm@cvs.openbsd.org 2007/06/12 08:20:00
771 [ssh-gss.h gss-serv.c gss-genr.c]
772 relocate server-only GSSAPI code from libssh to server; bz #1225
773 patch from simon AT sxw.org.uk; ok markus@ dtucker@
4634ee16 774 - djm@cvs.openbsd.org 2007/06/12 08:24:20
775 [scp.c]
776 make scp try to skip FIFOs rather than blocking when nothing is listening.
777 depends on the platform supporting sane O_NONBLOCK semantics for open
778 on FIFOs (apparently POSIX does not mandate this), which OpenBSD does.
779 bz #856; report by cjwatson AT debian.org; ok markus@
5805c516 780 - djm@cvs.openbsd.org 2007/06/12 11:11:08
781 [ssh.c]
782 fix slave exit value when a control master goes away without passing the
783 full exit status by ensuring that the slave reads a full int. bz#1261
784 reported by frekko AT gmail.com; ok markus@ dtucker@
b2f4d5cc 785 - djm@cvs.openbsd.org 2007/06/12 11:15:17
786 [ssh.c ssh.1]
787 Add "-K" flag for ssh to set GSSAPIAuthentication=yes and
788 GSSAPIDelegateCredentials=yes. This is symmetric with -k (disable GSSAPI)
789 and is useful for hosts with /home on Kerberised NFS; bz #1312
790 patch from Markus.Kuhn AT cl.cam.ac.uk; ok dtucker@ markus@
6b34f31f 791 - djm@cvs.openbsd.org 2007/06/12 11:45:27
792 [ssh.c]
793 improved exit message from multiplex slave sessions; bz #1262
794 reported by alexandre.nunes AT gmail.com; ok dtucker@
dc1c8785 795 - dtucker@cvs.openbsd.org 2007/06/12 11:56:15
796 [gss-genr.c]
797 Pass GSS OID to gss_display_status to provide better information in
798 error messages. Patch from Simon Wilkinson via bz 1220. ok djm@
c159f720 799 - jmc@cvs.openbsd.org 2007/06/12 13:41:03
800 [ssh-add.1]
801 identies -> identities;
3c6a67c2 802 - jmc@cvs.openbsd.org 2007/06/12 13:43:55
803 [ssh.1]
804 add -K to SYNOPSIS;
5be98986 805 - dtucker@cvs.openbsd.org 2007/06/12 13:54:28
806 [scp.c]
807 Encode filename with strnvis if the name contains a newline (which can't
808 be represented in the scp protocol), from bz #891. ok markus@
e110afc3 809
bd6a1355 81020070611
811 - (djm) Bugzilla #1306: silence spurious error messages from hang-on-exit
812 fix; tested by dtucker@ and jochen.kirn AT gmail.com
f444d0f8 813 - pvalchev@cvs.openbsd.org 2007/06/07 19:37:34
814 [kex.h mac.c mac.h monitor_wrap.c myproposal.h packet.c ssh.1]
815 [ssh_config.5 sshd.8 sshd_config.5]
816 Add a new MAC algorithm for data integrity, UMAC-64 (not default yet,
817 must specify umac-64@openssh.com). Provides about 20% end-to-end speedup
818 compared to hmac-md5. Represents a different approach to message
819 authentication to that of HMAC that may be beneficial if HMAC based on
820 one of its underlying hash algorithms is found to be vulnerable to a
821 new attack. http://www.ietf.org/rfc/rfc4418.txt
822 in conjunction with and OK djm@
c22b0835 823 - pvalchev@cvs.openbsd.org 2007/06/08 04:40:40
824 [ssh_config]
825 Add a "MACs" line after "Ciphers" with the default MAC algorithms,
826 to ease people who want to tweak both (eg. for performance reasons).
827 ok deraadt@ djm@ dtucker@
bbc77085 828 - jmc@cvs.openbsd.org 2007/06/08 07:43:46
829 [ssh_config.5]
830 put the MAC list into a display, like we do for ciphers,
831 since groff has trouble handling wide lines;
33d2ae0f 832 - jmc@cvs.openbsd.org 2007/06/08 07:48:09
833 [sshd_config.5]
834 oops, here too: put the MAC list into a display, like we do for
835 ciphers, since groff has trouble with wide lines;
68a73f53 836 - markus@cvs.openbsd.org 2007/06/11 08:04:44
837 [channels.c]
838 send 'window adjust' messages every tree packets and do not wait
839 until 50% of the window is consumed. ok djm dtucker
1aac2117 840 - (djm) [configure.ac umac.c] If platform doesn't provide swap32(3), then
841 fallback to provided bit-swizzing functions
aee0a82f 842 - (dtucker) [openbsd-compat/bsd-misc.c] According to the spec the "remainder"
843 argument to nanosleep may be NULL. Currently this never happens in OpenSSH,
844 but check anyway in case this changes or the code gets used elsewhere.
e9b2809d 845 - (dtucker) [includes.h] Bug #1243: HAVE_PATHS -> HAVE_PATHS_H. Should
846 prevent warnings about redefinitions of various things in paths.h.
847 Spotted by cartmanltd at hotmail.com.
c22b0835 848
c33de4d8 84920070605
850 - (dtucker) OpenBSD CVS Sync
851 - djm@cvs.openbsd.org 2007/05/22 10:18:52
852 [sshd.c]
853 zap double include; from p_nowaczyk AT o2.pl
854 (not required in -portable, Id sync only)
68525040 855 - djm@cvs.openbsd.org 2007/05/30 05:58:13
856 [kex.c]
857 tidy: KNF, ARGSUSED and u_int
e473dcd1 858 - jmc@cvs.openbsd.org 2007/05/31 19:20:16
859 [scp.1 ssh_config.5 sftp-server.8 ssh-agent.1 sshd_config.5 sftp.1
860 ssh-keygen.1 ssh-keyscan.1 ssh-add.1 sshd.8 ssh.1 ssh-keysign.8]
861 convert to new .Dd format;
862 (We will need to teach mdoc2man.awk to understand this too.)
d156cd22 863 - djm@cvs.openbsd.org 2007/05/31 23:34:29
864 [packet.c]
865 gc unreachable code; spotted by Tavis Ormandy
996279fc 866 - djm@cvs.openbsd.org 2007/06/02 09:04:58
867 [bufbn.c]
868 memory leak on error path; from arnaud.lacombe.1 AT ulaval.ca
a3de8da1 869 - djm@cvs.openbsd.org 2007/06/05 06:52:37
870 [kex.c monitor_wrap.c packet.c mac.h kex.h mac.c]
871 Preserve MAC ctx between packets, saving 2xhash calls per-packet.
872 Yields around a 12-16% end-to-end speedup for arcfour256/hmac-md5
873 patch from markus@ tested dtucker@ and myself, ok markus@ and me (I'm
874 committing at his request)
f43b2695 875 - (dtucker) [mdoc2man.awk] Teach it to deal with $Mdocdate tags that
876 OpenBSD's cvs now adds.
8c5a3b27 877 - (dtucker) [mdoc2man.awk] Remove trailing "$" from Mdocdate regex so
878 mindrot's cvs doesn't expand it on us.
757841b2 879 - (dtucker) [mdoc2man.awk] Add support for %R references, used for RFCs.
c33de4d8 880
2e5c9c30 88120070520
882 - (dtucker) OpenBSD CVS Sync
883 - stevesk@cvs.openbsd.org 2007/04/14 22:01:58
884 [auth2.c]
885 remove unused macro; from Dmitry V. Levin <ldv@altlinux.org>
23983bf9 886 - stevesk@cvs.openbsd.org 2007/04/18 01:12:43
887 [sftp-server.c]
888 cast "%llu" format spec to (unsigned long long); do not assume a
889 u_int64_t arg is the same as 'unsigned long long'.
890 from Dmitry V. Levin <ldv@altlinux.org>
891 ok markus@ 'Yes, that looks correct' millert@
51b787f2 892 - dtucker@cvs.openbsd.org 2007/04/23 10:15:39
893 [servconf.c]
894 Remove debug() left over from development. ok deraadt@
7ce05acc 895 - djm@cvs.openbsd.org 2007/05/17 07:50:31
896 [log.c]
897 save and restore errno when logging; ok deraadt@
72dea2d9 898 - djm@cvs.openbsd.org 2007/05/17 07:55:29
899 [sftp-server.c]
900 bz#1286 stop reading and processing commands when input or output buffer
901 is nearly full, otherwise sftp-server would happily try to grow the
902 input/output buffers past the maximum supported by the buffer API and
903 promptly fatal()
904 based on patch from Thue Janus Kristensen; feedback & ok dtucker@
7fd1deb2 905 - djm@cvs.openbsd.org 2007/05/17 20:48:13
906 [sshconnect2.c]
907 fall back to gethostname() when the outgoing connection is not
908 on a socket, such as is the case when ProxyCommand is used.
909 Gives hostbased auth an opportunity to work; bz#616, report
910 and feedback stuart AT kaloram.com; ok markus@
21cd42db 911 - djm@cvs.openbsd.org 2007/05/17 20:52:13
912 [monitor.c]
913 pass received SIGINT from monitor to postauth child so it can clean
914 up properly. bz#1196, patch from senthilkumar_sen AT hotpop.com;
915 ok markus@
b2349766 916 - jolan@cvs.openbsd.org 2007/05/17 23:53:41
917 [sshconnect2.c]
918 djm owes me a vb and a tism cd for breaking ssh compilation
fd8f181b 919 - (dtucker) [auth-pam.c] malloc+memset -> calloc. Patch from
920 ldv at altlinux.org.
e2dedae7 921 - (dtucker) [auth-pam.c] Return empty string if fgets fails in
922 sshpam_tty_conv. Patch from ldv at altlinux.org.
2e5c9c30 923
40701614 92420070509
925 - (tim) [configure.ac] Bug #1287: Add missing test for ucred.h.
926
65737b47 92720070429
928 - (dtucker) [openbsd-compat/bsd-misc.c] Include unistd.h and sys/types.h
929 for select(2) prototype.
e5b792cd 930 - (dtucker) [auth-shadow.c loginrec.c] Include time.h for time(2) prototype.
560acf80 931 - (dtucker) [configure.ac openbsd-compat/getrrsetbyname.c] Bug #1299: Use the
932 platform's _res if it has one. Should fix problem of DNSSEC record lookups
933 on NetBSD as reported by Curt Sampson.
81fa3f37 934 - (dtucker) [openbsd-compat/xmmap.c] Include stdlib.h for mkstemp prototype.
0bf6279d 935 - (dtucker) [configure.ac defines.h] Have configure check for MAXSYMLINKS
936 so we don't get redefinition warnings.
0b9fdeb8 937 - (dtucker) [openbsd-compat/xmmap.c] Include stdlib.h for mkstemp prototype.
938 - (dtucker) [configure.ac defines.h] Prevent warnings about __attribute__
939 __nonnull__ for versions of GCC that don't support it.
b41ece30 940 - (dtucker) [configure.ac defines.h] Have configure check for offsetof
941 to prevent redefinition warnings.
0b9fdeb8 942
6b44d402 94320070406
944 - (dtucker) [INSTALL] Update the systems that have PAM as standard. Link
945 to OpenPAM too.
e5d352eb 946 - (dtucker) [INSTALL] prngd lives at sourceforge these days.
6b44d402 947
a03acb8f 94820070326
949 - (tim) [auth.c configure.ac defines.h session.c openbsd-compat/port-uw.c
950 openbsd-compat/port-uw.h openbsd-compat/xcrypt.c] Rework libiaf test/defines
951 to account for IRIX having libiaf but not set_id(). Patch with & ok dtucker@
952
e54defb4 95320070325
954 - (dtucker) [Makefile.in configure.ac] Replace single-purpose LIBSELINUX,
955 LIBWRAP and LIBPAM variables in Makefile with the general-purpose
956 SSHDLIBS. "I like" djm@
957
136d42b7 95820070321
959 - (dtucker) OpenBSD CVS Sync
960 - dtucker@cvs.openbsd.org 2007/03/09 05:20:06
961 [servconf.c sshd.c]
962 Move C/R -> kbdint special case to after the defaults have been
963 loaded, which makes ChallengeResponse default to yes again. This
964 was broken by the Match changes and not fixed properly subsequently.
965 Found by okan at demirmen.com, ok djm@ "please do it" deraadt@
e93309c3 966 - djm@cvs.openbsd.org 2007/03/19 01:01:29
967 [sshd_config]
968 Disable the legacy SSH protocol 1 for new installations via
969 a configuration override. In the future, we will change the
970 server's default itself so users who need the legacy protocol
971 will need to turn it on explicitly
7f38e62e 972 - dtucker@cvs.openbsd.org 2007/03/19 12:16:42
973 [ssh-agent.c]
974 Remove the signal handler that checks if the agent's parent process
975 has gone away, instead check when the select loop returns. Record when
976 the next key will expire when scanning for expired keys. Set the select
977 timeout to whichever of these two things happens next. With djm@, with &
978 ok deraadt@ markus@
f48fbab3 979 - tedu@cvs.openbsd.org 2007/03/20 03:56:12
980 [readconf.c clientloop.c]
981 remove some bogus *p tests from charles longeau
982 ok deraadt millert
82029813 983 - jmc@cvs.openbsd.org 2007/03/20 15:57:15
984 [sshd.8]
985 - let synopsis and description agree for -f
986 - sort FILES
987 - +.Xr ssh-keyscan 1 ,
988 from Igor Sobrado
1961d660 989 - (dtucker) [configure.ac openbsd-compat/bsd-getpeereid.c] Bug #1287: Use
990 getpeerucred to implement getpeereid (currently only Solaris 10 and up).
991 Patch by Jan.Pechanec at Sun.
aee1c971 992 - (dtucker) [regress/agent-getpeereid.sh] Do peereid test if we have
993 HAVE_GETPEERUCRED too. Also from Jan Pechanec.
136d42b7 994
fce809d2 99520070313
996 - (dtucker) [entropy.c scard-opensc.c ssh-rand-helper.c] Bug #1294: include
997 string.h to prevent warnings, from vapier at gentoo.org.
5425009d 998 - (dtucker) [LICENCE] Add Daniel Walsh as a copyright holder for the
999 selinux bits in -portable.
ab26a796 1000 - (dtucker) [cipher-3des1.c cipher-bf1.c] The OpenSSL 0.9.8e problem in
1001 bug #1291 also affects Protocol 1 3des. While at it, use compat-openssl.h
1002 in cipher-bf1.c. Patch from Juan Gallego.
76ef2ed2 1003 - (dtucker) [README.platform] Info about blibpath on AIX.
fce809d2 1004
a863b75f 100520070306
1006 - (djm) OpenBSD CVS Sync
1007 - jmc@cvs.openbsd.org 2007/03/01 16:19:33
1008 [sshd_config.5]
1009 sort the `match' keywords;
95d6e8af 1010 - djm@cvs.openbsd.org 2007/03/06 10:13:14
1011 [version.h]
1012 openssh-4.6; "please" deraadt@
0a052bfe 1013 - (djm) [contrib/caldera/openssh.spec contrib/redhat/openssh.spec]
1014 [contrib/suse/openssh.spec] crank spec files for release
9b86b75a 1015 - (djm) [README] correct link to release notes
68ff14ce 1016 - (djm) Release 4.6p1
a863b75f 1017
1d42bcce 101820070304
1019 - (djm) [configure.ac] add a --without-openssl-header-check option to
1020 configure, as some platforms (OS X) ship OpenSSL headers whose version
1021 does not match that of the shipping library. ok dtucker@
190d9b26 1022 - (dtucker) [openbsd-compat/openssl-compat.h] Bug #1291: Work around a
1023 bug in OpenSSL 0.9.8e that prevents aes256-ctr, aes192-ctr and arcfour256
1024 ciphers from working correctly (disconnects with "Bad packet length"
1025 errors) as found by Ben Harris. ok djm@
1d42bcce 1026
f0bbbd78 102720070303
1028 - (dtucker) [regress/agent-ptrace.sh] Make ttrace gdb error a little more
1029 general to cover newer gdb versions on HP-UX.
1030
04765d02 103120070302
1032 - (dtucker) [configure.ac] For Cygwin, read files in textmode (which allows
1033 CRLF as well as LF lineendings) and write in binary mode. Patch from
1034 vinschen at redhat.com.
2769e5d0 1035 - (dtucker) [INSTALL] Update to autoconf-2.61.
04765d02 1036
121c4a34 103720070301
1038 - (dtucker) OpenBSD CVS Sync
1039 - dtucker@cvs.openbsd.org 2007/03/01 10:28:02
1040 [auth2.c sshd_config.5 servconf.c]
1041 Remove ChallengeResponseAuthentication support inside a Match
1042 block as its interaction with KbdInteractive makes it difficult to
1043 support. Also, relocate the CR/kbdint option special-case code into
1044 servconf. "please commit" djm@, ok markus@ for the relocation.
840bd607 1045 - (tim) [buildpkg.sh.in openssh.xml.in] Clean up Solaris 10 smf(5) bits.
1046 "Looks sane" dtucker@
121c4a34 1047
f10f9102 104820070228
1049 - (dtucker) OpenBSD CVS Sync
1050 - dtucker@cvs.openbsd.org 2007/02/28 00:55:30
1051 [ssh-agent.c]
1052 Remove expired keys periodically so they don't remain in memory when
1053 the agent is entirely idle, as noted by David R. Piegdon. This is the
1054 simple fix, a more efficient one will be done later. With markus,
1055 deraadt, with & ok djm.
1056
88ea6a3c 105720070225
1058 - (dtucker) OpenBSD CVS Sync
1059 - djm@cvs.openbsd.org 2007/02/20 10:25:14
1060 [clientloop.c]
1061 set maximum packet and window sizes the same for multiplexed clients
1062 as normal connections; ok markus@
1e823acf 1063 - dtucker@cvs.openbsd.org 2007/02/21 11:00:05
1064 [sshd.c]
1065 Clear alarm() before restarting sshd on SIGHUP. Without this, if there's
1066 a SIGALRM pending (for SSH1 key regeneration) when sshd is SIGHUP'ed, the
1067 newly exec'ed sshd will get the SIGALRM and not have a handler for it,
1068 and the default action will terminate the listening sshd. Analysis and
1069 patch from andrew at gaul.org.
f3e3d6ce 1070 - dtucker@cvs.openbsd.org 2007/02/22 12:58:40
1071 [servconf.c]
1072 Check activep so Match and GatewayPorts work together; ok markus@
8c1cb72e 1073 - ray@cvs.openbsd.org 2007/02/24 03:30:11
1074 [moduli.c]
1075 - strlen returns size_t, not int.
1076 - Pass full buffer size to fgets.
1077 OK djm@, millert@, and moritz@.
88ea6a3c 1078
5792fbb7 107920070219
1080 - (dtucker) OpenBSD CVS Sync
1081 - jmc@cvs.openbsd.org 2007/01/10 13:23:22
1082 [ssh_config.5]
1083 do not use a list for SYNOPSIS;
1084 this is actually part of a larger report sent by eric s. raymond
1085 and forwarded by brad, but i only read half of it. spotted by brad.
e91a8c3f 1086 - jmc@cvs.openbsd.org 2007/01/12 20:20:41
1087 [ssh-keygen.1 ssh-keygen.c]
1088 more secsh -> rfc 4716 updates;
1089 spotted by wiz@netbsd
1090 ok markus
70b5e752 1091 - dtucker@cvs.openbsd.org 2007/01/17 23:22:52
1092 [readconf.c]
1093 Honour activep for times (eg ServerAliveInterval) while parsing
1094 ssh_config and ~/.ssh/config so they work properly with Host directives.
1095 From mario.lorenz@wincor-nixdorf.com via bz #1275. ok markus@
1096 - stevesk@cvs.openbsd.org 2007/01/21 01:41:54
1097 [auth-skey.c kex.c ssh-keygen.c session.c clientloop.c]
1098 spaces
0cf6a024 1099 - stevesk@cvs.openbsd.org 2007/01/21 01:45:35
1100 [readconf.c]
1101 spaces
e4d5ca17 1102 - djm@cvs.openbsd.org 2007/01/22 11:32:50
1103 [sftp-client.c]
1104 return error from do_upload() when a write fails. fixes bz#1252: zero
1105 exit status from sftp when uploading to a full device. report from
1106 jirkat AT atlas.cz; ok dtucker@
7df0afaf 1107 - djm@cvs.openbsd.org 2007/01/22 13:06:21
1108 [scp.c]
1109 fix detection of whether we should show progress meter or not: scp
1110 tested isatty(stderr) but wrote the progress meter to stdout. This patch
1111 makes it test stdout. bz#1265 reported by junkmail AT bitsculpture.com;
1112 of dtucker@
1b313731 1113 - stevesk@cvs.openbsd.org 2007/02/14 14:32:00
1114 [bufbn.c]
1115 typos in comments; ok jmc@
03bcbf84 1116 - dtucker@cvs.openbsd.org 2007/02/19 10:45:58
1117 [monitor_wrap.c servconf.c servconf.h monitor.c sshd_config.5]
1118 Teach Match how handle config directives that are used before
1119 authentication. This allows configurations such as permitting password
1120 authentication from the local net only while requiring pubkey from
1121 offsite. ok djm@, man page bits ok jmc@
99d804ce 1122 - (dtucker) [contrib/findssl.sh] Add "which" as a shell function since some
1123 platforms don't have it. Patch from dleonard at vintela.com.
56a6f96f 1124 - (dtucker) [openbsd-compat/getrrsetbyname.c] Don't attempt to calloc
1125 an array for signatures when there are none since "calloc(0, n) returns
1126 NULL on some platforms (eg Tru64), which is explicitly permitted by
1127 POSIX. Diagnosis and patch by svallet genoscope.cns.fr.
5792fbb7 1128
34640ce6 112920070128
1130 - (djm) [channels.c serverloop.c] Fix so-called "hang on exit" (bz #52)
1131 when closing a tty session when a background process still holds tty
1132 fds open. Great detective work and patch by Marc Aurele La France,
1133 slightly tweaked by me; ok dtucker@
1134
4b478cc5 113520070123
1136 - (dtucker) [openbsd-compat/bsd-snprintf.c] Static declarations for public
1137 library interfaces aren't very helpful. Fix up the DOPR_OUTCH macro
1138 so it works properly and modify its callers so that they don't pre or
1139 post decrement arguments that are conditionally evaluated. While there,
1140 put SNPRINTF_CONST back as it prevents build failures in some
1141 configurations. ok djm@ (for most of it)
1142
ed9b5e5f 114320070122
1144 - (djm) [ssh-rand-helper.8] manpage nits;
1145 from dleonard AT vintela.com (bz#1529)
1146
25bd7a2a 114720070117
1148 - (dtucker) [packet.c] Re-remove in_systm.h since it's already in includes.h
1149 and multiple including it causes problems on old IRIXes. (It snuck back
1150 in during a sync.) Found (again) by Georg Schwarz.
1151
b05ff3f5 115220070114
7ac507d4 1153 - (dtucker) [ssh-keygen.c] av -> argv to match earlier sync.
0d00c5cb 1154 - (djm) [openbsd-compat/bsd-snprintf.c] Fix integer overflow in return
1155 value of snprintf replacement, similar to bugs in various libc
1156 implementations. This overflow is not exploitable in OpenSSH.
1157 While I'm fiddling with it, make it a fair bit faster by inlining the
1158 append-char routine; ok dtucker@
b05ff3f5 1159
4b4810d4 116020070105
1161 - (djm) OpenBSD CVS Sync
1162 - deraadt@cvs.openbsd.org 2006/11/14 19:41:04
1163 [ssh-keygen.c]
1164 use argc and argv not some made up short form
ce4cf693 1165 - ray@cvs.openbsd.org 2006/11/23 01:35:11
1166 [misc.c sftp.c]
1167 Don't access buf[strlen(buf) - 1] for zero-length strings.
1168 ``ok by me'' djm@.
4e3c0053 1169 - markus@cvs.openbsd.org 2006/12/11 21:25:46
1170 [ssh-keygen.1 ssh.1]
1171 add rfc 4716 (public key format); ok jmc
04efe9b0 1172 - djm@cvs.openbsd.org 2006/12/12 03:58:42
1173 [channels.c compat.c compat.h]
1174 bz #1019: some ssh.com versions apparently can't cope with the
1175 remote port forwarding bind_address being a hostname, so send
1176 them an address for cases where they are not explicitly
1177 specified (wildcard or localhost bind). reported by daveroth AT
1178 acm.org; ok dtucker@ deraadt@
75b6d52c 1179 - dtucker@cvs.openbsd.org 2006/12/13 08:34:39
1180 [servconf.c]
1181 Make PermitOpen work with multiple values like the man pages says.
1182 bz #1267 with details from peter at dmtz.com, with & ok djm@
38757197 1183 - dtucker@cvs.openbsd.org 2006/12/14 10:01:14
1184 [servconf.c]
1185 Make "PermitOpen all" first-match within a block to match the way other
1186 options work. ok markus@ djm@
5d9a4204 1187 - jmc@cvs.openbsd.org 2007/01/02 09:57:25
1188 [sshd_config.5]
1189 do not use lists for SYNOPSIS;
1190 from eric s. raymond via brad
cbaa43c0 1191 - stevesk@cvs.openbsd.org 2007/01/03 00:53:38
1192 [ssh-keygen.c]
1193 remove small dead code; arnaud.lacombe.1@ulaval.ca via Coverity scan
4f6e2ba9 1194 - stevesk@cvs.openbsd.org 2007/01/03 03:01:40
1195 [auth2-chall.c channels.c dns.c sftp.c ssh-keygen.c ssh.c]
1196 spaces
c9625a42 1197 - stevesk@cvs.openbsd.org 2007/01/03 04:09:15
1198 [sftp.c]
1199 ARGSUSED for lint
9a24ac07 1200 - stevesk@cvs.openbsd.org 2007/01/03 07:22:36
1201 [sftp-server.c]
1202 spaces
4b4810d4 1203
2b563deb 120420061205
1205 - (djm) [auth.c] Fix NULL pointer dereference in fakepw(). Crash would
1206 occur if the server did not have the privsep user and an invalid user
1207 tried to login and both privsep and krb5 auth are disabled; ok dtucker@
096393b8 1208 - (djm) [bsd-asprintf.c] Better test for bad vsnprintf lengths; ok dtucker@
2b563deb 1209
d4d9db8d 121020061108
1211 - (dtucker) OpenBSD CVS Sync
1212 - markus@cvs.openbsd.org 2006/11/07 13:02:07
1213 [dh.c]
1214 BN_hex2bn returns int; from dtucker@
1215
4d02b823 121620061107
1217 - (dtucker) [sshd.c] Use privsep_pw if we have it, but only require it
1218 if we absolutely need it. Pointed out by Corinna, ok djm@
e516451d 1219 - (dtucker) OpenBSD CVS Sync
1220 - markus@cvs.openbsd.org 2006/11/06 21:25:28
1221 [auth-rsa.c kexgexc.c kexdhs.c key.c ssh-dss.c sshd.c kexgexs.c
1222 ssh-keygen.c bufbn.c moduli.c scard.c kexdhc.c sshconnect1.c dh.c rsa.c]
1223 add missing checks for openssl return codes; with & ok djm@
89916e8c 1224 - markus@cvs.openbsd.org 2006/11/07 10:31:31
1225 [monitor.c version.h]
1226 correctly check for bad signatures in the monitor, otherwise the monitor
1227 and the unpriv process can get out of sync. with dtucker@, ok djm@,
1228 dtucker@
5b296f76 1229 - (dtucker) [README contrib/{caldera,redhat,contrib}/openssh.spec] Bump
1230 versions.
4354f73b 1231 - (dtucker) Release 4.5p1.
4d02b823 1232
b8e51e81 123320061105
1234 - (djm) OpenBSD CVS Sync
1235 - otto@cvs.openbsd.org 2006/10/28 18:08:10
1236 [ssh.1]
1237 correct/expand example of usage of -w; ok jmc@ stevesk@
8e8b473c 1238 - markus@cvs.openbsd.org 2006/10/31 16:33:12
1239 [kexdhc.c kexdhs.c kexgexc.c kexgexs.c]
1240 check DH_compute_key() for -1 even if it should not happen because of
1241 earlier calls to dh_pub_is_valid(); report krahmer at suse.de; ok djm
b8e51e81 1242
8852e1d4 124320061101
1244 - (dtucker) [openbsd-compat/port-solaris.c] Bug #1255: Make only hwerr
1245 events fatal in Solaris process contract support and tell it to signal
1246 only processes in the same process group when something happens.
1247 Based on information from andrew.benham at thus.net and similar to
1248 a patch from Chad Mynhier. ok djm@
1249
1acc8e56 125020061027
1251- (djm) [auth.c] gc some dead code
1252
b3c338b7 125320061023
1254 - (djm) OpenBSD CVS Sync
1255 - ray@cvs.openbsd.org 2006/09/30 17:48:22
1256 [sftp.c]
1257 Clear errno before calling the strtol functions.
1258 From Paul Stoeber <x0001 at x dot de1 dot cc>.
1259 OK deraadt@.
fceb95fa 1260 - djm@cvs.openbsd.org 2006/10/06 02:29:19
1261 [ssh-agent.c ssh-keyscan.c ssh.c]
1262 sys/resource.h needs sys/time.h; prompted by brad@
1263 (NB. Id sync only for portable)
db6fcd65 1264 - djm@cvs.openbsd.org 2006/10/09 23:36:11
1265 [session.c]
1266 xmalloc -> xcalloc that was missed previously, from portable
1267 (NB. Id sync only for portable, obviously)
77903f77 1268 - markus@cvs.openbsd.org 2006/10/10 10:12:45
1269 [sshconnect.c]
1270 sleep before retrying (not after) since sleep changes errno; fixes
1271 pr 5250; rad@twig.com; ok dtucker djm
bd3b2cb2 1272 - markus@cvs.openbsd.org 2006/10/11 12:38:03
1273 [clientloop.c serverloop.c]
1274 exit instead of doing a blocking tcp send if we detect a client/server
1275 timeout, since the tcp sendqueue might be already full (of alive
1276 requests); ok dtucker, report mpf
cdfbded8 1277 - djm@cvs.openbsd.org 2006/10/22 02:25:50
1278 [sftp-client.c]
1279 cancel progress meter when upload write fails; ok deraadt@
0f74133a 1280 - (tim) [Makefile.in scard/Makefile.in] Add datarootdir= lines to keep
1281 autoconf 2.60 from complaining.
b3c338b7 1282
525251b0 128320061018
1284 - (dtucker) OpenBSD CVS Sync
1285 - ray@cvs.openbsd.org 2006/09/25 04:55:38
1286 [ssh-keyscan.1 ssh.1]
1287 Change "a SSH" to "an SSH". Hurray, I'm not the only one who
1288 pronounces "SSH" as "ess-ess-aich".
1289 OK jmc@ and stevesk@.
d1f7ec98 1290 - (dtucker) [sshd.c] Reshuffle storing of pw struct; prevents warnings
1291 on older versions of OS X. ok djm@
525251b0 1292
8153fef1 129320061016
1294 - (dtucker) [monitor_fdpass.c] Include sys/in.h, required for cmsg macros
1295 on older (2.0) Linuxes. Based on patch from thmo-13 at gmx de.
1296
1f231631 129720061006
1298 - (tim) [buildpkg.sh.in] Use uname -r instead of -v in OS_VER for Solaris.
1299 Differentiate between OpenServer 5 and OpenServer 6
5ba277eb 1300 - (dtucker) [configure.ac] Set put -lselinux into $LIBS while testing for
1301 SELinux functions so they're detected correctly. Patch from pebenito at
1302 gentoo.org.
b18359f6 1303 - (tim) [buildpkg.sh.in] Some systems have really limited nawk (OpenServer).
1304 Allow setting alternate awk in openssh-config.local.
1f231631 1305
aa56f760 130620061003
1307 - (tim) [configure.ac] Move CHECK_HEADERS test before platform specific
1308 section so additional platform specific CHECK_HEADER tests will work
1309 correctly. Fixes "<net/if_tap.h> on FreeBSD" problem report by des AT des.no
1310 Feedback and "seems like a good idea" dtucker@
1311
00dea73e 131220061001
1313 - (dtucker) [audit-bsm.c] Include errno.h. Pointed out by des at des.no.
1314
24b2647b 131520060929
1316 - (dtucker) [configure.ac] Bug #1239: Fix configure test for OpenSSH engine
1317 support. Patch from andrew.benham at thus net.
1318
243a64f1 131920060928
1320 - (dtucker) [entropy.c] Bug #1238: include signal.h to fix compilation error
1321 on Solaris 8 w/out /dev/random or prngd. Patch from rl at
1322 math.technion.ac.il.
1323
f0a2e834 132420060926
1325 - (dtucker) [bufaux.h] nuke bufaux.h; it's already gone from OpenBSD and not
1326 referenced any more. ok djm@
5ed1a353 1327 - (dtucker) [sftp-server.8] Resync; spotted by djm@
0eb97cdf 1328 - (dtucker) Release 4.4p1.
f0a2e834 1329
d6336595 133020060924
1331 - (tim) [configure.ac] Remove CFLAGS hack for UnixWare 1.x/2.x (added
1332 to rev 1.308) to work around broken gcc 2.x header file.
1333
530456f4 133420060923
1335 - (dtucker) [configure.ac] Bug #1234: Put opensc libs into $LIBS rather than
1336 $LDFLAGS. Patch from vapier at gentoo org.
1337
c5bca5d4 133820060922
1339 - (dtucker) [packet.c canohost.c] Include arpa/inet.h for htonl macros on
1340 some platforms (eg HP-UX 11.00). From santhi.amirta at gmail com.
1341
d3fc2aa3 134220060921
1343 - (dtucker) OpenBSD CVS Sync
1344 - otto@cvs.openbsd.org 2006/09/19 05:52:23
1345 [sftp.c]
1346 Use S_IS* macros insted of masking with S_IF* flags. The latter may
1347 have multiple bits set, which lead to surprising results. Spotted by
1348 Paul Stoeber, more to come. ok millert@ pedro@ jaredy@ djm@
a29c9898 1349 - markus@cvs.openbsd.org 2006/09/19 21:14:08
1350 [packet.c]
1351 client NULL deref on protocol error; Tavis Ormandy, Google Security Team
ffbfca72 1352 - (dtucker) [defines.h] Include unistd.h before defining getpgrp; fixes
1353 build error on Ultrix. From Bernhard Simon.
d3fc2aa3 1354
25a2779b 135520060918
1356 - (dtucker) [configure.ac] On AIX, check to see if the compiler will allow
1357 macro redefinitions, and if not, remove "-qlanglvl=ansi" from the flags.
1358 Allows build out of the box with older VAC and XLC compilers. Found by
1359 David Bronder and Bernhard Simon.
d9ed544b 1360 - (dtucker) [openbsd-compat/port-aix.{c,h}] Reduce scope of includes.
1361 Prevents macro redefinition warnings of "RDONLY".
25a2779b 1362
f0d0e025 136320060916
1364 - OpenBSD CVS Sync
1365 - djm@cvs.openbsd.org 2006/09/16 19:53:37
1366 [deattack.c deattack.h packet.c]
1367 limit maximum work performed by the CRC compensation attack detector,
1368 problem reported by Tavis Ormandy, Google Security Team;
1369 ok markus@ deraadt@
95954124 1370 - (djm) Add openssh.xml to .cvsignore and sort it
3fd7b98a 1371 - (dtucker) [auth-pam.c] Propogate TZ environment variable to PAM auth
1372 process so that any logging it does is with the right timezone. From
1373 Scott Strickler, ok djm@.
bb09a477 1374 - (dtucker) [monitor.c] Correctly handle auditing of single commands when
1375 using Protocol 1. From jhb at freebsd.
cd3e77c4 1376 - (djm) [sshd.c] Fix warning/API abuse; ok dtucker@
8e700494 1377 - (dtucker) [INSTALL] Add info about audit support.
f0d0e025 1378
29eadd7c 137920060912
1380 - (djm) [Makefile.in buildpkg.sh.in configure.ac openssh.xml.in]
1381 Support SMF in Solaris Packages if enabled by configure. Patch from
1382 Chad Mynhier, tested by dtucker@
1383
7238aaad 138420060911
1385 - (dtucker) [cipher-aes.c] Include string.h for memcpy and friends. Noted
1386 by Pekka Savola.
1387
d23046e2 138820060910
1389 - (dtucker) [contrib/aix/buildbff.sh] Ensure that perl is available.
36f36ba3 1390 - (dtucker) [configure.ac] Add -lcrypt to let DragonFly build OOTB.
d23046e2 1391
fa6edaf0 139220060909
1393 - (dtucker) [openbsd-compat/bsd-snprintf.c] Add stdarg.h.
d2f401fe 1394 - (dtucker) [contrib/aix/buildbff.sh] Always create privsep user.
16082eaa 1395 - (dtucker) [buildpkg.sh.in] Always create privsep user. ok djm@
fa6edaf0 1396
368a00c2 139720060908
1398 - (dtucker) [auth-sia.c] Add includes required for build on Tru64. Patch
1399 from Chris Adams.
a01f637d 1400 - (dtucker) [configure.ac] The BSM header test needs time.h in some cases.
368a00c2 1401
a078cbee 140220060907
1403 - (djm) [sshd.c auth.c] Set up fakepw() with privsep uid/gid, so it can
1404 be used to drop privilege to; fixes Solaris GSSAPI crash reported by
1405 Magnus Abrante; suggestion and feedback dtucker@
1406 NB. this change will require that the privilege separation user must
1407 exist on all the time, not just when UsePrivilegeSeparation=yes
5cc6ddad 1408 - (tim) [configure.ac] s/BROKEN_UPDWTMP/BROKEN_UPDWTMPX/ on SCO OSR6
4130b6f1 1409 - (dtucker) [loginrec.c] Wrap paths.h in HAVE_PATHS_H.
15367d95 1410 - (dtucker) [regress/cfgmatch.sh] stop_client is racy, so give us a better
1411 chance of winning.
a078cbee 1412
9286ecf2 141320060905
1414 - (dtucker) [configure.ac] s/AC_DEFINES/AC_DEFINE/ spotted by Roumen Petrov.
e0f3adac 1415 - (dtucker) [loginrec.c] Include paths.h for _PATH_BTMP.
9286ecf2 1416
62143a41 141720060904
1418 - (dtucker) [configure.ac] Define BROKEN_UPDWTMP on SCO OSR6 as the native
1419 updwdtmp seems to generate invalid wtmp entries. From Roger Cornelius,
1420 ok djm@
1421
752994dd 142220060903
1423 - (dtucker) [configure.ac openbsd-compat/openbsd-compat.h] Check for
1424 declaration of writev(2) and declare it ourselves if necessary. Makes
1425 the atomiciov() calls build on really old systems. ok djm@
1426
b823d0b9 142720060902
1428 - (dtucker) [openbsd-compat/port-irix.c] Add errno.h, found by Iain Morgan.
5e837c7b 1429 - (dtucker) [ssh-keyscan.c ssh-rand-helper.c ssh.c sshconnect.c
1430 openbsd-compat/bindresvport.c openbsd-compat/getrrsetbyname.c
1431 openbsd-compat/port-tun.c openbsd-compat/rresvport.c] Include <arpa/inet.h>
1432 for hton* and ntoh* macros. Required on (at least) HP-UX since we define
1433 _XOPEN_SOURCE_EXTENDED. Found by santhi.amirta at gmail com.
b823d0b9 1434
24436b92 143520060901
1436 - (djm) [audit-bsm.c audit.c auth-bsdauth.c auth-chall.c auth-pam.c]
1437 [auth-rsa.c auth-shadow.c auth-sia.c auth1.c auth2-chall.c]
1438 [auth2-gss.c auth2-kbdint.c auth2-none.c authfd.c authfile.c]
1439 [cipher-3des1.c cipher-aes.c cipher-bf1.c cipher-ctr.c clientloop.c]
1440 [dh.c dns.c entropy.c gss-serv-krb5.c gss-serv.c hostfile.c kex.c]
1441 [kexdhc.c kexdhs.c kexgexc.c kexgexs.c key.c loginrec.c mac.c]
1442 [md5crypt.c monitor.c monitor_wrap.c readconf.c rsa.c]
1443 [scard-opensc.c scard.c session.c ssh-add.c ssh-agent.c ssh-dss.c]
1444 [ssh-keygen.c ssh-keysign.c ssh-rsa.c ssh.c sshconnect.c]
aa751414 1445 [sshconnect1.c sshconnect2.c sshd.c]
24436b92 1446 [openbsd-compat/bsd-cray.c openbsd-compat/port-aix.c]
1447 [openbsd-compat/port-linux.c openbsd-compat/port-solaris.c]
1448 [openbsd-compat/port-uw.c]
1449 Lots of headers for SCO OSR6, mainly adding stdarg.h for log.h;
1450 compile problems reported by rac AT tenzing.org
aa751414 1451 - (djm) [includes.h monitor.c openbsd-compat/bindresvport.c]
1452 [openbsd-compat/rresvport.c] Some more headers: netinet/in.h
1453 sys/socket.h and unistd.h in various places
dd41ba6f 1454 - (dtucker) [openbsd-compat/bsd-cygwin_util.c] Fix implict declaration
1455 warnings for binary_open and binary_close. Patch from Corinna Vinschen.
78888bab 1456 - (dtucker) [configure.ac includes.h openbsd-compat/glob.{c,h}] Explicitly
1457 test for GLOB_NOMATCH and use our glob functions if it's not found.
1458 Stops sftp from segfaulting when attempting to get a nonexistent file on
1459 Cygwin (previous versions of OpenSSH didn't use the native glob). Partly
1460 from and tested by Corinna Vinschen.
cdc9d1fc 1461 - (dtucker) [README contrib/{caldera,redhat,suse}/openssh.spec] Crank
1462 versions.
24436b92 1463
5b84789f 146420060831
1465 - (djm) [CREDITS LICENCE Makefile.in auth.c configure.ac includes.h ]
1466 [platform.c platform.h sshd.c openbsd-compat/Makefile.in]
1467 [openbsd-compat/openbsd-compat.h openbsd-compat/port-solaris.c]
1468 [openbsd-compat/port-solaris.h] Add support for Solaris process
1469 contracts, enabled with --use-solaris-contracts. Patch from Chad
1470 Mynhier, tweaked by dtucker@ and myself; ok dtucker@
77f7d474 1471 - (dtucker) [contrib/cygwin/ssh-host-config] Add SeTcbPrivilege privilege
1472 while setting up the ssh service account. Patch from Corinna Vinschen.
5b84789f 1473
e9f2e744 147420060830
1475 - (djm) OpenBSD CVS Sync
1476 - dtucker@cvs.openbsd.org 2006/08/21 08:14:01
1477 [sshd_config.5]
1478 Document HostbasedUsesNameFromPacketOnly. Corrections from jmc@,
1479 ok jmc@ djm@
5f047fbc 1480 - dtucker@cvs.openbsd.org 2006/08/21 08:15:57
1481 [sshd.8]
1482 Add more detail about what permissions are and aren't accepted for
1483 authorized_keys files. Corrections jmc@, ok djm@, "looks good" jmc@
0875ae22 1484 - djm@cvs.openbsd.org 2006/08/29 10:40:19
1485 [channels.c session.c]
1486 normalise some inconsistent (but harmless) NULL pointer checks
1487 spotted by the Stanford SATURN tool, via Isil Dillig;
1488 ok markus@ deraadt@
b4f8e1cb 1489 - dtucker@cvs.openbsd.org 2006/08/29 12:02:30
1490 [gss-genr.c]
1491 Work around a problem in Heimdal that occurs when KRB5CCNAME file is
1492 missing, by checking whether or not kerberos allocated us a context
1493 before attempting to free it. Patch from Simon Wilkinson, tested by
1494 biorn@, ok djm@
3223b72f 1495 - dtucker@cvs.openbsd.org 2006/08/30 00:06:51
1496 [sshconnect2.c]
1497 Fix regression where SSH2 banner is printed at loglevels ERROR and FATAL
1498 where previously it weren't. bz #1221, found by Dean Kopesky, ok djm@
76970201 1499 - djm@cvs.openbsd.org 2006/08/30 00:14:37
1500 [version.h]
1501 crank to 4.4
9d68c41d 1502 - (djm) [openbsd-compat/xcrypt.c] needs unistd.h
6545dd0b 1503 - (dtucker) [auth.c openbsd-compat/port-aix.c] Bug #1207: always call
1504 loginsuccess on AIX immediately after authentication to clear the failed
1505 login count. Previously this would only happen when an interactive
1506 session starts (ie when a pty is allocated) but this means that accounts
1507 that have primarily non-interactive sessions (eg scp's) may gradually
1508 accumulate enough failures to lock out an account. This change may have
1509 a side effect of creating two audit records, one with a tty of "ssh"
1510 corresponding to the authentication and one with the allocated pty per
1511 interactive session.
e9f2e744 1512
48a7de26 151320060824
1514 - (dtucker) [openbsd-compat/basename.c] Include errno.h.
8151aaa5 1515 - (dtucker) [openbsd-compat/bsd-misc.c] Add includes needed for select(2) on
1516 older systems.
ab26f490 1517 - (dtucker) [openbsd-compat/bsd-misc.c] Include <sys/select.h> for select(2)
1518 on POSIX systems.
6beea87c 1519 - (dtucker) [openbsd-compat/bsd-openpty.c] Include for ioctl(2).
e429fba8 1520 - (dtucker) [openbsd-compat/rresvport.c] Include <stdlib.h> for malloc.
f07855f7 1521 - (dtucker) [openbsd-compat/xmmap.c] Move #define HAVE_MMAP to prevent
1522 unused variable warning when we have a broken or missing mmap(2).
48a7de26 1523
c1a1c295 152420060822
1525 - (dtucker) [Makefile.in] Bug #1177: fix incorrect path for sshrc in
1526 Makefile. Patch from santhi.amirta at gmail, ok djm.
1527
9895d518 152820060820
1529 - (dtucker) [log.c] Move ifdef to prevent unused variable warning.
08fb8ce9 1530 - (dtucker) [configure.ac] Save $LIBS during PAM library tests and restore
1531 afterward. Removes the need to mangle $LIBS later to remove -lpam and -ldl.
a086f73b 1532 - (dtucker) [configure.ac] Relocate --with-pam parts in preparation for
1533 fixing bug #1181. No changes yet.
282d6408 1534 - (dtucker) [configure.ac] Bug #1181: Explicitly test to see if OpenSSL
1535 (0.9.8a and presumably newer) requires -ldl to successfully link.
08164407 1536 - (dtucker) [configure.ac] Remove errant "-".
9895d518 1537
94d458e8 153820060819
1539 - (djm) OpenBSD CVS Sync
1540 - djm@cvs.openbsd.org 2006/08/18 22:41:29
1541 [gss-genr.c]
1542 GSSAPI error code should be 0 and not -1; from simon@sxw.org.uk
ea83a498 1543 - (dtucker) [openbsd-compat/regress/Makefile.in] Add $(EXEEXT) and add a
1544 single rule for the test progs.
94d458e8 1545
795e7517 154620060818
1547 - (dtucker) [configure.ac openbsd-compat/bsd-closefrom.c] Resync with
1548 closefrom.c from sudo.
5a1d6300 1549 - (dtucker) [openbsd-compat/bsd-closefrom.c] Comment out rcsid.
fed313fd 1550 - (dtucker) [openbsd-compat/regress/snprintftest.c] Newline on error.
d5498c58 1551 - (dtucker) [openbsd-compat/regress/Makefile.in] Use implicit rules for the
1552 test progs instead; they work better than what we have.
78372b6e 1553 - (djm) OpenBSD CVS Sync
1554 - stevesk@cvs.openbsd.org 2006/08/06 01:13:32
1555 [compress.c monitor.c monitor_wrap.c]
1556 "zlib.h" can be <zlib.h>; ok djm@ markus@
ba52fb56 1557 - miod@cvs.openbsd.org 2006/08/12 20:46:46
1558 [monitor.c monitor_wrap.c]
1559 Revert previous include file ordering change, for ssh to compile under
1560 gcc2 (or until openssl include files are cleaned of parameter names
1561 in function prototypes)
fa47fe3c 1562 - dtucker@cvs.openbsd.org 2006/08/14 12:40:25
1563 [servconf.c servconf.h sshd_config.5]
1564 Add ability to match groups to Match keyword in sshd_config. Feedback
1565 djm@, stevesk@, ok stevesk@.
e07335e2 1566 - djm@cvs.openbsd.org 2006/08/16 11:47:15
1567 [sshd.c]
1568 factor inetd connection, TCP listen and main TCP accept loop out of
1569 main() into separate functions to improve readability; ok markus@
28463427 1570 - deraadt@cvs.openbsd.org 2006/08/18 09:13:26
1571 [log.c log.h sshd.c]
1572 make signal handler termination path shorter; risky code pointed out by
1573 mark dowd; ok djm markus
184cb418 1574 - markus@cvs.openbsd.org 2006/08/18 09:15:20
1575 [auth.h session.c sshd.c]
1576 delay authentication related cleanups until we're authenticated and
1577 all alarms have been cancelled; ok deraadt
b2af4ca8 1578 - djm@cvs.openbsd.org 2006/08/18 10:27:16
1579 [misc.h]
1580 reorder so prototypes are sorted by the files they refer to; no
1581 binary change
592de384 1582 - djm@cvs.openbsd.org 2006/08/18 13:54:54
1583 [gss-genr.c ssh-gss.h sshconnect2.c]
1584 bz #1218 - disable SPNEGO as per RFC4462; diff from simon AT sxw.org.uk
1585 ok markus@
abb47f1e 1586 - djm@cvs.openbsd.org 2006/08/18 14:40:34
1587 [gss-genr.c ssh-gss.h]
1588 constify host argument to match the rest of the GSSAPI functions and
1589 unbreak compilation with -Werror
c79c4814 1590 - (djm) Disable sigdie() for platforms that cannot safely syslog inside
1591 a signal handler (basically all of them, excepting OpenBSD);
1592 ok dtucker@
795e7517 1593
f8688ddd 159420060817
1595 - (dtucker) [openbsd-compat/fake-rfc2553.c openbsd-compat/setproctitle.c]
1596 Include stdlib.h for malloc and friends.
53c337ed 1597 - (dtucker) [configure.ac openbsd-compat/bsd-closefrom.c] Use F_CLOSEM fcntl
1598 for closefrom() on AIX. Pointed out by William Ahern.
98cc66aa 1599 - (dtucker) [openbsd-compat/regress/{Makefile.in,closefromtest.c}] Regress
1600 test for closefrom() in compat code.
f8688ddd 1601
5388904a 160220060816
1603 - (djm) [audit-bsm.c] Sprinkle in some headers
1604
4a86d8eb 160520060815
1606 - (dtucker) [LICENCE] Add Reyk to the list for the compat dir.
1607
3a5b6088 160820060806
1609 - (djm) [openbsd-compat/bsd-getpeereid.c] Add some headers to quiet warnings
1610 on Solaris 10
1611
161220060806
149abacb 1613 - (dtucker) [defines.h] With the includes.h changes we no longer get the
1614 name clash on "YES" so we can remove the workaround for it.
442a6515 1615 - (dtucker) [openbsd-compat/{bsd-asprintf.c,bsd-openpty.c,bsd-snprintf.c,
1616 glob.c}] Include stdlib.h for malloc and friends in compat code.
149abacb 1617
fee76795 161820060805
1619 - (djm) OpenBSD CVS Sync
1620 - stevesk@cvs.openbsd.org 2006/07/24 13:58:22
1621 [sshconnect.c]
1622 disable tunnel forwarding when no strict host key checking
1623 and key changed; ok djm@ markus@ dtucker@
912da635 1624 - stevesk@cvs.openbsd.org 2006/07/25 02:01:34
1625 [scard.c]
1626 need #include <string.h>
e264ac72 1627 - stevesk@cvs.openbsd.org 2006/07/25 02:59:21
1628 [channels.c clientloop.c packet.c scp.c serverloop.c sftp-client.c]
1629 [sftp-server.c ssh-agent.c ssh-keyscan.c sshconnect.c sshd.c]
1630 move #include <sys/time.h> out of includes.h
536c14e8 1631 - stevesk@cvs.openbsd.org 2006/07/26 02:35:17
1632 [atomicio.c auth.c dh.c authfile.c buffer.c clientloop.c kex.c]
1633 [groupaccess.c gss-genr.c kexgexs.c misc.c monitor.c monitor_mm.c]
1634 [packet.c scp.c serverloop.c session.c sftp-client.c sftp-common.c]
1635 [sftp-server.c sftp.c ssh-add.c ssh-agent.c ssh-keygen.c sshlogin.c]
1636 [uidswap.c xmalloc.c]
1637 move #include <sys/param.h> out of includes.h
ffa517a8 1638 - stevesk@cvs.openbsd.org 2006/07/26 13:57:17
1639 [authfd.c authfile.c dh.c canohost.c channels.c clientloop.c compat.c]
1640 [hostfile.c kex.c log.c misc.c moduli.c monitor.c packet.c readpass.c]
1641 [scp.c servconf.c session.c sftp-server.c sftp.c ssh-add.c ssh-agent.c]
1642 [ssh-keygen.c ssh-keyscan.c ssh-keysign.c ssh.c sshconnect.c]
1643 [sshconnect1.c sshd.c xmalloc.c]
1644 move #include <stdlib.h> out of includes.h
f0817fbb 1645 - jmc@cvs.openbsd.org 2006/07/27 08:00:50
1646 [ssh_config.5]
1647 avoid confusing wording in HashKnownHosts:
1648 originally spotted by alan amesbury;
1649 ok deraadt
38b37661 1650 - jmc@cvs.openbsd.org 2006/07/27 08:00:50
1651 [ssh_config.5]
1652 avoid confusing wording in HashKnownHosts:
1653 originally spotted by alan amesbury;
1654 ok deraadt
331c3884 1655 - dtucker@cvs.openbsd.org 2006/08/01 11:34:36
1656 [sshconnect.c]
1657 Allow fallback to known_hosts entries without port qualifiers for
1658 non-standard ports too, so that all existing known_hosts entries will be
1659 recognised. Requested by, feedback and ok markus@
cf851879 1660 - stevesk@cvs.openbsd.org 2006/08/01 23:22:48
1661 [auth-passwd.c auth-rhosts.c auth-rsa.c auth.c auth.h auth1.c]
1662 [auth2-chall.c auth2-pubkey.c authfile.c buffer.c canohost.c]
1663 [channels.c clientloop.c dh.c dns.c dns.h hostfile.c kex.c kexdhc.c]
1664 [kexgexc.c kexgexs.c key.c key.h log.c misc.c misc.h moduli.c]
1665 [monitor_wrap.c packet.c progressmeter.c readconf.c readpass.c scp.c]
1666 [servconf.c session.c sftp-client.c sftp-common.c sftp-server.c sftp.c]
1667 [ssh-add.c ssh-agent.c ssh-keygen.c ssh-keyscan.c ssh.c sshconnect.c]
1668 [sshconnect1.c sshconnect2.c sshd.c sshlogin.c sshtty.c uuencode.c]
1669 [uuencode.h xmalloc.c]
1670 move #include <stdio.h> out of includes.h
d4f40d92 1671 - stevesk@cvs.openbsd.org 2006/08/01 23:36:12
1672 [authfile.c channels.c progressmeter.c scard.c servconf.c ssh.c]
1673 clean extra spaces
31652869 1674 - deraadt@cvs.openbsd.org 2006/08/03 03:34:42
1675 [OVERVIEW atomicio.c atomicio.h auth-bsdauth.c auth-chall.c auth-krb5.c]
1676 [auth-options.c auth-options.h auth-passwd.c auth-rh-rsa.c auth-rhosts.c]
1677 [auth-rsa.c auth-skey.c auth.c auth.h auth1.c auth2-chall.c auth2-gss.c]
1678 [auth2-hostbased.c auth2-kbdint.c auth2-none.c auth2-passwd.c ]
1679 [auth2-pubkey.c auth2.c authfd.c authfd.h authfile.c bufaux.c bufbn.c]
1680 [buffer.c buffer.h canohost.c channels.c channels.h cipher-3des1.c]
1681 [cipher-bf1.c cipher-ctr.c cipher.c cleanup.c clientloop.c compat.c]
1682 [compress.c deattack.c dh.c dispatch.c dns.c dns.h fatal.c groupaccess.c]
1683 [groupaccess.h gss-genr.c gss-serv-krb5.c gss-serv.c hostfile.c kex.c]
1684 [kex.h kexdh.c kexdhc.c kexdhs.c kexgex.c kexgexc.c kexgexs.c key.c]
1685 [key.h log.c log.h mac.c match.c md-sha256.c misc.c misc.h moduli.c]
1686 [monitor.c monitor_fdpass.c monitor_mm.c monitor_mm.h monitor_wrap.c]
1687 [monitor_wrap.h msg.c nchan.c packet.c progressmeter.c readconf.c]
1688 [readconf.h readpass.c rsa.c scard.c scard.h scp.c servconf.c servconf.h]
1689 [serverloop.c session.c session.h sftp-client.c sftp-common.c]
1690 [sftp-common.h sftp-glob.c sftp-server.c sftp.c ssh-add.c ssh-agent.c]
1691 [ssh-dss.c ssh-gss.h ssh-keygen.c ssh-keyscan.c ssh-keysign.c ssh-rsa.c]
1692 [ssh.c ssh.h sshconnect.c sshconnect.h sshconnect1.c sshconnect2.c]
1693 [sshd.c sshlogin.c sshlogin.h sshpty.c sshpty.h sshtty.c ttymodes.c]
1694 [uidswap.c uidswap.h uuencode.c uuencode.h xmalloc.c xmalloc.h]
1695 [loginrec.c loginrec.h openbsd-compat/port-aix.c openbsd-compat/port-tun.h]
1696 almost entirely get rid of the culture of ".h files that include .h files"
1697 ok djm, sort of ok stevesk
1698 makes the pain stop in one easy step
1699 NB. portable commit contains everything *except* removing includes.h, as
1700 that will take a fair bit more work as we move headers that are required
1701 for portability workarounds to defines.h. (also, this step wasn't "easy")
c56969f9 1702 - stevesk@cvs.openbsd.org 2006/08/04 20:46:05
1703 [monitor.c session.c ssh-agent.c]
1704 spaces
8bdc7aa0 1705 - (djm) [auth-pam.c defines.h] Move PAM related bits to auth-pam.c
693a35d3 1706 - (djm) [auth-pam.c auth.c bufaux.h entropy.c openbsd-compat/port-tun.c]
1707 remove last traces of bufaux.h - it was merged into buffer.h in the big
1708 includes.h commit
8ad2db2a 1709 - (djm) [auth.c loginrec.c] Missing netinet/in.h for loginrec
8d3106fd 1710 - (djm) [openbsd-compat/regress/snprintftest.c]
1711 [openbsd-compat/regress/strduptest.c] Add missing includes so they pass
1712 compilation with "-Wall -Werror"
00a017bd 1713 - (djm) [auth-pam.c auth-shadow.c auth2-none.c cleanup.c sshd.c]
1714 [openbsd-compat/port-tun.c openbsd-compat/port-tun.h] Sprinkle more
1715 includes for Linux in
ccc09f5c 1716 - (dtucker) [cleanup.c] Need defines.h for __dead.
9ae6b834 1717 - (dtucker) [auth2-gss.c] We still need the #ifdef GSSAPI in -portable.
f2265d5d 1718 - (dtucker) [openbsd-compat/{bsd-arc4random.c,port-tun.c,xmmap.c}] Lots of
1719 #include stdarg.h, needed for log.h.
5be9f803 1720 - (dtucker) [entropy.c] Needs unistd.h too.
35d1c2de 1721 - (dtucker) [ssh-rand-helper.c] Needs stdarg.h for log.h.
76e03684 1722 - (dtucker) [openbsd-compat/getrrsetbyname.c] Nees stdlib.h for malloc.
5946a69f 1723 - (dtucker) [openbsd-compat/strtonum.c] Include stdlib.h for strtoll,
1724 otherwise it is implicitly declared as returning an int.
428f6258 1725 - (dtucker) OpenBSD CVS Sync
1726 - dtucker@cvs.openbsd.org 2006/08/05 07:52:52
1727 [auth2-none.c sshd.c monitor_wrap.c]
1728 Add headers required to build with KERBEROS5=no. ok djm@
453cb7e7 1729 - dtucker@cvs.openbsd.org 2006/08/05 08:00:33
1730 [auth-skey.c]
1731 Add headers required to build with -DSKEY. ok djm@
cecc422f 1732 - dtucker@cvs.openbsd.org 2006/08/05 08:28:24
1733 [monitor_wrap.c auth-skey.c auth2-chall.c]
1734 Zap unused variables in -DSKEY code. ok djm@
0e13ec0f 1735 - dtucker@cvs.openbsd.org 2006/08/05 08:34:04
1736 [packet.c]
1737 Typo in comment
97ea266c 1738 - (dtucker) [openbsd-compat/bsd-cygwin_util.c] Add headers required to compile
1739 on Cygwin.
e3220bb2 1740 - (dtucker) [openbsd-compat/fake-rfc2553.c] Add headers needed for inet_ntoa.
f3296bc4 1741 - (dtucker) [auth-skey.c] monitor_wrap.h needs ssh-gss.h.
0e23dc86 1742 - (dtucker) [audit.c audit.h] Repair headers.
6f54ce27 1743 - (dtucker) [audit-bsm.c] Add additional headers now required.
fee76795 1744
3e05aa50 174520060804
1746 - (dtucker) [configure.ac] The "crippled AES" test does not work on recent
1747 versions of Solaris, so use AC_LINK_IFELSE to actually link the test program
1748 rather than just compiling it. Spotted by dlg@.
1749
53d4ae20 175020060802
1751 - (dtucker) [openbsd-compat/daemon.c] Add unistd.h for fork() prototype.
1752
be350da6 175320060725
1754 - (dtucker) [openbsd-compat/xmmap.c] Need fcntl.h for O_RDRW.
1755
14e980ef 175620060724
1757 - (djm) OpenBSD CVS Sync
1758 - jmc@cvs.openbsd.org 2006/07/12 13:39:55
1759 [sshd_config.5]
1760 - new sentence, new line
1761 - s/The the/The/
1762 - kill a bad comma
c8dfff33 1763 - stevesk@cvs.openbsd.org 2006/07/12 22:28:52
742bee8c 1764 [auth-options.c canohost.c channels.c includes.h readconf.c]
1765 [servconf.c ssh-keyscan.c ssh.c sshconnect.c sshd.c]
c8dfff33 1766 move #include <netdb.h> out of includes.h; ok djm@
bcaab305 1767 - stevesk@cvs.openbsd.org 2006/07/12 22:42:32
1768 [includes.h ssh.c ssh-rand-helper.c]
1769 move #include <stddef.h> out of includes.h
d2a69816 1770 - stevesk@cvs.openbsd.org 2006/07/14 01:15:28
1771 [monitor_wrap.h]
1772 don't need incompletely-typed 'struct passwd' now with
1773 #include <pwd.h>; ok markus@
5188ba17 1774 - stevesk@cvs.openbsd.org 2006/07/17 01:31:10
1775 [authfd.c authfile.c channels.c cleanup.c clientloop.c groupaccess.c]
1776 [includes.h log.c misc.c msg.c packet.c progressmeter.c readconf.c]
1777 [readpass.c scp.c servconf.c sftp-client.c sftp-server.c sftp.c]
1778 [ssh-add.c ssh-agent.c ssh-keygen.c ssh-keyscan.c ssh-keysign.c ssh.c]
1779 [sshconnect.c sshlogin.c sshpty.c uidswap.c]
1780 move #include <unistd.h> out of includes.h
774de098 1781 - dtucker@cvs.openbsd.org 2006/07/17 12:02:24
1782 [auth-options.c]
1783 Use '\0' rather than 0 to terminates strings; ok djm@
2fefbadf 1784 - dtucker@cvs.openbsd.org 2006/07/17 12:06:00
1785 [channels.c channels.h servconf.c sshd_config.5]
1786 Add PermitOpen directive to sshd_config which is equivalent to the
1787 "permitopen" key option. Allows server admin to allow TCP port
1788 forwarding only two specific host/port pairs. Useful when combined
1789 with Match.
1790 If permitopen is used in both sshd_config and a key option, both
1791 must allow a given connection before it will be permitted.
1792 Note that users can still use external forwarders such as netcat,
1793 so to be those must be controlled too for the limits to be effective.
1794 Feedback & ok djm@, man page corrections & ok jmc@.
f22506ff 1795 - jmc@cvs.openbsd.org 2006/07/18 07:50:40
1796 [sshd_config.5]
1797 tweak; ok dtucker
578d2b99 1798 - jmc@cvs.openbsd.org 2006/07/18 07:56:28
1799 [scp.1]
1800 replace DIAGNOSTICS with .Ex;
874d319b 1801 - jmc@cvs.openbsd.org 2006/07/18 08:03:09
1802 [ssh-agent.1 sshd_config.5]
1803 mark up angle brackets;
4895f836 1804 - dtucker@cvs.openbsd.org 2006/07/18 08:22:23
1805 [sshd_config.5]
1806 Clarify description of Match, with minor correction from jmc@
62e12ffe 1807 - stevesk@cvs.openbsd.org 2006/07/18 22:27:55
1808 [dh.c]
1809 remove unneeded includes; ok djm@
691712e0 1810 - dtucker@cvs.openbsd.org 2006/07/19 08:56:41
1811 [servconf.c sshd_config.5]
1812 Add support for X11Forwaring, X11DisplayOffset and X11UseLocalhost to
1813 Match. ok djm@
e7259e8d 1814 - dtucker@cvs.openbsd.org 2006/07/19 13:07:10
1815 [servconf.c servconf.h session.c sshd.8 sshd_config sshd_config.5]
1816 Add ForceCommand keyword to sshd_config, equivalent to the "command="
1817 key option, man page entry and example in sshd_config.
1818 Feedback & ok djm@, man page corrections & ok jmc@
67514848 1819 - stevesk@cvs.openbsd.org 2006/07/20 15:26:15
1820 [auth1.c serverloop.c session.c sshconnect2.c]
1821 missed some needed #include <unistd.h> when KERBEROS5=no; issue from
1822 massimo@cedoc.mo.it
ea46e550 1823 - dtucker@cvs.openbsd.org 2006/07/21 12:43:36
1824 [channels.c channels.h servconf.c servconf.h sshd_config.5]
1825 Make PermitOpen take a list of permitted ports and act more like most
1826 other keywords (ie the first match is the effective setting). This
1827 also makes it easier to override a previously set PermitOpen. ok djm@
ebb90778 1828 - stevesk@cvs.openbsd.org 2006/07/21 21:13:30
1829 [channels.c]
1830 more ARGSUSED (lint) for dispatch table-driven functions; ok djm@
c88c3fb9 1831 - stevesk@cvs.openbsd.org 2006/07/21 21:26:55
1832 [progressmeter.c]
1833 ARGSUSED for signal handler
b0f6943a 1834 - stevesk@cvs.openbsd.org 2006/07/22 19:08:54
1835 [includes.h moduli.c progressmeter.c scp.c sftp-common.c]
1836 [sftp-server.c ssh-agent.c sshlogin.c]
1837 move #include <time.h> out of includes.h
00146caa 1838 - stevesk@cvs.openbsd.org 2006/07/22 20:48:23
1839 [atomicio.c auth-options.c auth-passwd.c auth-rhosts.c auth-rsa.c]
1840 [auth.c auth1.c auth2-chall.c auth2-hostbased.c auth2-passwd.c auth2.c]
1841 [authfd.c authfile.c bufaux.c bufbn.c buffer.c canohost.c channels.c]
1842 [cipher-3des1.c cipher-bf1.c cipher-ctr.c cipher.c clientloop.c]
1843 [compat.c deattack.c dh.c dns.c gss-genr.c gss-serv.c hostfile.c]
1844 [includes.h kex.c kexdhc.c kexdhs.c kexgexc.c kexgexs.c key.c log.c]
1845 [mac.c match.c md-sha256.c misc.c moduli.c monitor.c monitor_fdpass.c]
1846 [monitor_mm.c monitor_wrap.c msg.c nchan.c packet.c rsa.c]
1847 [progressmeter.c readconf.c readpass.c scp.c servconf.c serverloop.c]
1848 [session.c sftp-client.c sftp-common.c sftp-glob.c sftp-server.c sftp.c]
1849 [ssh-add.c ssh-agent.c ssh-dss.c ssh-keygen.c ssh-keyscan.c]
1850 [ssh-keysign.c ssh-rsa.c ssh.c sshconnect.c sshconnect1.c sshconnect2.c]
1851 [sshd.c sshlogin.c sshpty.c ttymodes.c uidswap.c xmalloc.c]
1852 move #include <string.h> out of includes.h
519fc2b7 1853 - stevesk@cvs.openbsd.org 2006/07/23 01:11:05
1854 [auth.h dispatch.c kex.h sftp-client.c]
1855 #include <signal.h> for sig_atomic_t; need this prior to <sys/param.h>
1856 move
28cb0a43 1857 - (djm) [acss.c auth-krb5.c auth-options.c auth-pam.c auth-shadow.c]
1858 [canohost.c channels.c cipher-acss.c defines.h dns.c gss-genr.c]
1859 [gss-serv-krb5.c gss-serv.c log.h loginrec.c logintest.c readconf.c]
1860 [servconf.c ssh-keygen.c ssh-keyscan.c ssh-keysign.c ssh-rand-helper.c]
1861 [ssh.c sshconnect.c sshd.c openbsd-compat/bindresvport.c]
1862 [openbsd-compat/bsd-arc4random.c openbsd-compat/bsd-misc.c]
1863 [openbsd-compat/getrrsetbyname.c openbsd-compat/glob.c]
1864 [openbsd-compat/mktemp.c openbsd-compat/port-linux.c]
1865 [openbsd-compat/port-tun.c openbsd-compat/readpassphrase.c]
1866 [openbsd-compat/setproctitle.c openbsd-compat/xmmap.c]
1867 make the portable tree compile again - sprinkle unistd.h and string.h
1868 back in. Don't redefine __unused, as it turned out to be used in
1869 headers on Linux, and replace its use in auth-pam.c with ARGSUSED
ba1e6121 1870 - (djm) [openbsd-compat/glob.c]
1871 Move get_arg_max() into the ifdef HAVE_GLOB block so that it compiles
1872 on OpenBSD (or other platforms with a decent glob implementation) with
1873 -Werror
25523747 1874 - (djm) [uuencode.c]
1875 Add resolv.h, is it contains the prototypes for __b64_ntop/__b64_pton on
1876 some platforms
9b09381d 1877 - (djm) [session.c]
1878 fix compile error with -Werror -Wall: 'path' is only used in
1879 do_setup_env() if HAVE_LOGIN_CAP is not defined
e204f3ee 1880 - (djm) [openbsd-compat/basename.c openbsd-compat/bsd-closefrom.c]
1881 [openbsd-compat/bsd-cray.c openbsd-compat/bsd-openpty.c]
1882 [openbsd-compat/bsd-snprintf.c openbsd-compat/fake-rfc2553.c]
1883 [openbsd-compat/port-aix.c openbsd-compat/port-irix.c]
1884 [openbsd-compat/rresvport.c]
1885 These look to need string.h and/or unistd.h (based on a grep for function
1886 names)
f40c8634 1887 - (djm) [Makefile.in]
1888 Remove generated openbsd-compat/regress/Makefile in distclean target
e7c5b206 1889 - (djm) [regress/Makefile regress/agent-getpeereid.sh regress/cfgmatch.sh]
1890 [regress/cipher-speed.sh regress/forcecommand.sh regress/forwarding.sh]
1891 Sync regress tests to -current; include dtucker@'s new cfgmatch and
1892 forcecommand tests. Add cipher-speed.sh test (not linked in yet)
30872a12 1893 - (dtucker) [cleanup.c] Since config.h defines _LARGE_FILES on AIX, including
1894 system headers before defines.h will cause conflicting definitions.
b64d983b 1895 - (dtucker) [regress/forcecommand.sh] Portablize.
e204f3ee 1896
4352744e 189720060713
1898 - (dtucker) [auth-krb5.c auth-pam.c] Still more errno.h
1899
956d6743 190020060712
294d3ca5 1901 - (dtucker) [configure.ac defines.h] Only define SHUT_RD (and friends) and
1902 O_NONBLOCK if they're really needed. Fixes build errors on HP-UX, old
1903 Linuxes and probably more.
71f4c727 1904 - (dtucker) [configure.ac] OpenBSD needs <sys/types.h> before <sys/socket.h>
1905 for SHUT_RD.
f9d5c000 1906 - (dtucker) [openbsd-compat/port-tun.c] OpenBSD needs <netinet/in.h> before
1907 <netinet/ip.h>.
a773acf7 1908 - (dtucker) OpenBSD CVS Sync
1909 - stevesk@cvs.openbsd.org 2006/07/10 16:01:57
1910 [sftp-glob.c sftp-common.h sftp.c]
1911 buffer.h only needed in sftp-common.h and remove some unneeded
1912 user includes; ok djm@
a0bca6ed 1913 - jmc@cvs.openbsd.org 2006/07/10 16:04:21
1914 [sshd.8]
1915 s/and and/and/
4c72fcfd 1916 - stevesk@cvs.openbsd.org 2006/07/10 16:37:36
1917 [readpass.c log.h scp.c fatal.c xmalloc.c includes.h ssh-keyscan.c misc.c
1918 auth.c packet.c log.c]
1919 move #include <stdarg.h> out of includes.h; ok markus@
0ad62016 1920 - dtucker@cvs.openbsd.org 2006/07/11 10:12:07
1921 [ssh.c]
1922 Only copy the part of environment variable that we actually use. Prevents
1923 ssh bailing when SendEnv is used and an environment variable with a really
1924 long value exists. ok djm@
42ea6f5e 1925 - markus@cvs.openbsd.org 2006/07/11 18:50:48
1926 [clientloop.c ssh.1 ssh.c channels.c ssh_config.5 readconf.h session.c
1927 channels.h readconf.c]
1928 add ExitOnForwardFailure: terminate the connection if ssh(1)
1929 cannot set up all requested dynamic, local, and remote port
1930 forwardings. ok djm, dtucker, stevesk, jmc
028094f4 1931 - stevesk@cvs.openbsd.org 2006/07/11 20:07:25
1932 [scp.c auth.c monitor.c serverloop.c sftp-server.c sshpty.c readpass.c
1933 sshd.c monitor_wrap.c monitor_fdpass.c ssh-agent.c ttymodes.c atomicio.c
1934 includes.h session.c sshlogin.c monitor_mm.c packet.c sshconnect2.c
1935 sftp-client.c nchan.c clientloop.c sftp.c misc.c canohost.c channels.c
1936 ssh-keygen.c progressmeter.c uidswap.c msg.c readconf.c sshconnect.c]
1937 move #include <errno.h> out of includes.h; ok markus@
00c8971b 1938 - stevesk@cvs.openbsd.org 2006/07/11 20:16:43
1939 [ssh.c]
1940 cast asterisk field precision argument to int to remove warning;
1941 ok markus@
dd984467 1942 - stevesk@cvs.openbsd.org 2006/07/11 20:27:56
1943 [authfile.c ssh.c]
1944 need <errno.h> here also (it's also included in <openssl/err.h>)
d231781a 1945 - dtucker@cvs.openbsd.org 2006/07/12 11:34:58
1946 [sshd.c servconf.h servconf.c sshd_config.5 auth.c]
1947 Add support for conditional directives to sshd_config via a "Match"
1948 keyword, which works similarly to the "Host" directive in ssh_config.
1949 Lines after a Match line override the default set in the main section
1950 if the condition on the Match line is true, eg
1951 AllowTcpForwarding yes
1952 Match User anoncvs
1953 AllowTcpForwarding no
1954 will allow port forwarding by all users except "anoncvs".
1955 Currently only a very small subset of directives are supported.
1956 ok djm@
fec71b2f 1957 - (dtucker) [loginrec.c openbsd-compat/xmmap.c openbsd-compat/bindresvport.c
1958 openbsd-compat/glob.c openbsd-compat/mktemp.c openbsd-compat/port-tun.c
1959 openbsd-compat/readpassphrase.c openbsd-compat/strtonum.c] Include <errno.h>.
baede55a 1960 - (dtucker) [openbsd-compat/setproctitle.c] Include stdarg.h.
403a29ac 1961 - (dtucker) [ssh-keyscan.c ssh-rand-helper.c] More errno.h here too.
5f8747dc 1962 - (dtucker) [openbsd-compat/openbsd-compat.h] v*printf needs stdarg.h.
4f4b7d4d 1963 - (dtucker) [openbsd-compat/bsd-asprintf.c openbsd-compat/port-aix.c
1964 openbsd-compat/rresvport.c] More errno.h.
1965
37259a8e 196620060711
1967 - (dtucker) [configure.ac ssh-keygen.c openbsd-compat/bsd-openpty.c
1968 openbsd-compat/daemon.c] Add includes needed by open(2). Conditionally
1969 include paths.h. Fixes build error on Solaris.
2edd133e 1970 - (dtucker) [entropy.c] More fcntl.h, this time on AIX (and probably
1971 others).
37259a8e 1972
44064ac4 197320060710
1974 - (dtucker) [INSTALL] New autoconf version: 2.60.
e5c76324 1975 - OpenBSD CVS Sync
1976 - djm@cvs.openbsd.org 2006/06/14 10:50:42
1977 [sshconnect.c]
1978 limit the number of pre-banner characters we will accept; ok markus@
9f1090be 1979 - djm@cvs.openbsd.org 2006/06/26 10:36:15
1980 [clientloop.c]
1981 mention optional bind_address in runtime port forwarding setup
1982 command-line help. patch from santhi.amirta AT gmail.com
06fa4ac1 1983 - stevesk@cvs.openbsd.org 2006/07/02 17:12:58
1984 [ssh.1 ssh.c ssh_config.5 sshd_config.5]
1985 more details and clarity for tun(4) device forwarding; ok and help
1986 jmc@
6955279c 1987 - stevesk@cvs.openbsd.org 2006/07/02 18:36:47
1988 [gss-serv-krb5.c gss-serv.c]
1989 no "servconf.h" needed here
1990 (gss-serv-krb5.c change not applied, portable needs the server options)
16fbe330 1991 - stevesk@cvs.openbsd.org 2006/07/02 22:45:59
1992 [groupaccess.c groupaccess.h includes.h session.c sftp-common.c sshpty.c]
1993 move #include <grp.h> out of includes.h
1994 (portable needed uidswap.c too)
33f13fa5 1995 - stevesk@cvs.openbsd.org 2006/07/02 23:01:55
1996 [clientloop.c ssh.1]
1997 use -KR[bind_address:]port here; ok djm@
28015df4 1998 - stevesk@cvs.openbsd.org 2006/07/03 08:54:20
1999 [includes.h ssh.c sshconnect.c sshd.c]
2000 move #include "version.h" out of includes.h; ok markus@
319d6b41 2001 - stevesk@cvs.openbsd.org 2006/07/03 17:59:32
2002 [channels.c includes.h]
2003 move #include <arpa/inet.h> out of includes.h; old ok djm@
2004 (portable needed session.c too)
9794d008 2005 - stevesk@cvs.openbsd.org 2006/07/05 02:42:09
2006 [canohost.c hostfile.c includes.h misc.c packet.c readconf.c]
2007 [serverloop.c sshconnect.c uuencode.c]
2008 move #include <netinet/in.h> out of includes.h; ok deraadt@
2009 (also ssh-rand-helper.c logintest.c loginrec.c)
d66ce1a1 2010 - djm@cvs.openbsd.org 2006/07/06 10:47:05
2011 [servconf.c servconf.h session.c sshd_config.5]
2012 support arguments to Subsystem commands; ok markus@
a13880bb 2013 - djm@cvs.openbsd.org 2006/07/06 10:47:57
2014 [sftp-server.8 sftp-server.c]
2015 add commandline options to enable logging of transactions; ok markus@
b1842393 2016 - stevesk@cvs.openbsd.org 2006/07/06 16:03:53
2017 [auth-options.c auth-options.h auth-passwd.c auth-rh-rsa.c]
2018 [auth-rhosts.c auth-rsa.c auth.c auth.h auth2-hostbased.c]
2019 [auth2-pubkey.c auth2.c includes.h misc.c misc.h monitor.c]
2020 [monitor_wrap.c monitor_wrap.h scp.c serverloop.c session.c]
2021 [session.h sftp-common.c ssh-add.c ssh-keygen.c ssh-keysign.c]
2022 [ssh.c sshconnect.c sshconnect.h sshd.c sshpty.c sshpty.h uidswap.c]
2023 [uidswap.h]
2024 move #include <pwd.h> out of includes.h; ok markus@
0cbe25f0 2025 - stevesk@cvs.openbsd.org 2006/07/06 16:22:39
2026 [ssh-keygen.c]
2027 move #include "dns.h" up
76275092 2028 - stevesk@cvs.openbsd.org 2006/07/06 17:36:37
2029 [monitor_wrap.h]
2030 typo in comment
5b04a8bf 2031 - stevesk@cvs.openbsd.org 2006/07/08 21:47:12
2032 [authfd.c canohost.c clientloop.c dns.c dns.h includes.h]
2033 [monitor_fdpass.c nchan.c packet.c servconf.c sftp.c ssh-agent.c]
2034 [ssh-keyscan.c ssh.c sshconnect.h sshd.c sshlogin.h]
2035 move #include <sys/socket.h> out of includes.h
9305512d 2036 - stevesk@cvs.openbsd.org 2006/07/08 21:48:53
2037 [monitor.c session.c]
2038 missed these from last commit:
2039 move #include <sys/socket.h> out of includes.h
ca1df159 2040 - stevesk@cvs.openbsd.org 2006/07/08 23:30:06
2041 [log.c]
2042 move user includes after /usr/include files
d3221cca 2043 - stevesk@cvs.openbsd.org 2006/07/09 15:15:11
2044 [auth2-none.c authfd.c authfile.c includes.h misc.c monitor.c]
2045 [readpass.c scp.c serverloop.c sftp-client.c sftp-server.c]
2046 [ssh-add.c ssh-agent.c ssh-keygen.c ssh-keysign.c ssh.c sshd.c]
2047 [sshlogin.c sshpty.c]
2048 move #include <fcntl.h> out of includes.h
657939aa 2049 - stevesk@cvs.openbsd.org 2006/07/09 15:27:59
2050 [ssh-add.c]
2051 use O_RDONLY vs. 0 in open(); no binary change
43bc2dc9 2052 - djm@cvs.openbsd.org 2006/07/10 11:24:54
2053 [sftp-server.c]
2054 remove optind - it isn't used here
26ddd377 2055 - djm@cvs.openbsd.org 2006/07/10 11:25:53
2056 [sftp-server.c]
2057 don't log variables that aren't yet set
22bbb3e6 2058 - (djm) [loginrec.c ssh-rand-helper.c sshd.c openbsd-compat/glob.c]
2059 [openbsd-compat/mktemp.c openbsd-compat/openbsd-compat.h]
2060 [openbsd-compat/port-tun.c openbsd-compat/readpassphrase.c]
2061 [openbsd-compat/xcrypt.c] Fix includes.h fallout, mainly fcntl.h
1879b184 2062 - OpenBSD CVS Sync
2063 - djm@cvs.openbsd.org 2006/07/10 12:03:20
2064 [scp.c]
2065 duplicate argv at the start of main() because it gets modified later;
2066 pointed out by deraadt@ ok markus@
a217e418 2067 - djm@cvs.openbsd.org 2006/07/10 12:08:08
2068 [channels.c]
2069 fix misparsing of SOCKS 5 packets that could result in a crash;
2070 reported by mk@ ok markus@
d4530052 2071 - dtucker@cvs.openbsd.org 2006/07/10 12:46:51
2072 [misc.c misc.h sshd.8 sshconnect.c]
2073 Add port identifier to known_hosts for non-default ports, based originally
2074 on a patch from Devin Nate in bz#910.
2075 For any connection using the default port or using a HostKeyAlias the
2076 format is unchanged, otherwise the host name or address is enclosed
2077 within square brackets in the same format as sshd's ListenAddress.
2078 Tested by many, ok markus@.
9b6edf98 2079 - (dtucker) [openbsd-compat/openbsd-compat.h] Need to include <sys/socket.h>
2080 for struct sockaddr on platforms that use the fake-rfc stuff.
44064ac4 2081
e7479666 208220060706
2083 - (dtucker) [configure.ac] Try AIX blibpath test in different order when
2084 compiling with gcc. gcc 4.1.x will accept (but ignore) -b flags so
2085 configure would not select the correct libpath linker flags.
90f321a4 2086 - (dtucker) [INSTALL] A bit more info on autoconf.
e7479666 2087
e5c27607 208820060705
2089 - (dtucker) [ssh-rand-helper.c] Don't exit if mkdir fails because the
2090 target already exists.
2091
202c6095 209220060630
2093 - (dtucker) [openbsd-compat/openbsd-compat.h] SNPRINTF_CONST for snprintf
2094 declaration too. Patch from russ at sludge.net.
0bbb4f75 2095 - (dtucker) [openbsd-compat/getrrsetbyname.c] Undef _res before defining it,
2096 prevents warnings on platforms where _res is in the system headers.
10f1064f 2097 - (dtucker) [INSTALL] Bug #1202: Note when autoconf is required and which
2098 version.
202c6095 2099
ecd9ec09 210020060627
2101 - (dtucker) [configure.ac] Bug #1203: Add missing '[', which causes problems
2102 with autoconf 2.60. Patch from vapier at gentoo.org.
2103
9c04d67d 210420060625
2105 - (dtucker) [channels.c serverloop.c] Apply the bug #1102 workaround to ptys
2106 only, otherwise sshd can hang exiting non-interactive sessions.
2107
795aa5f5 210820060624
2109 - (dtucker) [configure.ac] Bug #1193: Define PASSWD_NEEDS_USERNAME on Solaris.
2110 Works around limitation in Solaris' passwd program for changing passwords
2111 where the username is longer than 8 characters. ok djm@
24a87055 2112 - (dtucker) [serverloop.c] Get ifdef/ifndef the right way around for the bug
2113 #1102 workaround.
795aa5f5 2114
e02505e2 211520060623
2116 - (dtucker) [README.platform configure.ac openbsd-compat/port-tun.c] Add
2117 tunnel support for Mac OS X/Darwin via a third-party tun driver. Patch
2118 from reyk@, tested by anil@
ea8c44d9 2119 - (dtucker) [channels.c configure.ac serverloop.c] Bug #1102: Around AIX
2120 4.3.3 ML3 or so, the AIX pty layer starting passing zero-length writes
2121 on the pty slave as zero-length reads on the pty master, which sshd
2122 interprets as the descriptor closing. Since most things don't do zero
2123 length writes this rarely matters, but occasionally it happens, and when
2124 it does the SSH pty session appears to hang, so we add a special case for
2125 this condition. ok djm@
e02505e2 2126
6cba36fd 212720060613
ae410a09 2128 - (djm) [getput.h] This file has been replaced by functions in misc.c
6cba36fd 2129 - OpenBSD CVS Sync
2130 - djm@cvs.openbsd.org 2006/05/08 10:49:48
2131 [sshconnect2.c]
2132 uint32_t -> u_int32_t (which we use everywhere else)
2133 (Id sync only - portable already had this)
3173dd0d 2134 - markus@cvs.openbsd.org 2006/05/16 09:00:00
2135 [clientloop.c]
2136 missing free; from Kylene Hall
2b8dc5e3 2137 - markus@cvs.openbsd.org 2006/05/17 12:43:34
2138 [scp.c sftp.c ssh-agent.c ssh-keygen.c sshconnect.c]
2139 fix leak; coverity via Kylene Jo Hall
18c60a0b 2140 - miod@cvs.openbsd.org 2006/05/18 21:27:25
2141 [kexdhc.c kexgexc.c]
2142 paramter -> parameter
07a80cea 2143 - dtucker@cvs.openbsd.org 2006/05/29 12:54:08
2144 [ssh_config.5]
2145 Add gssapi-with-mic to PreferredAuthentications default list; ok jmc
aa195106 2146 - dtucker@cvs.openbsd.org 2006/05/29 12:56:33
2147 [ssh_config]
f127d8a4 2148 Add GSSAPIAuthentication and GSSAPIDelegateCredentials to examples in
2149 sample ssh_config. ok markus@
2150 - jmc@cvs.openbsd.org 2006/05/29 16:10:03
2151 [ssh_config.5]
2152 oops - previous was too long; split the list of auths up
ed277f5e 2153 - mk@cvs.openbsd.org 2006/05/30 11:46:38
2154 [ssh-add.c]
2155 Sync usage() with man page and reality.
2156 ok deraadt dtucker
2157 - jmc@cvs.openbsd.org 2006/05/29 16:13:23
2158 [ssh.1]
2159 add GSSAPI to the list of authentication methods supported;
f9579ee9 2160 - mk@cvs.openbsd.org 2006/05/30 11:46:38
2161 [ssh-add.c]
2162 Sync usage() with man page and reality.
2163 ok deraadt dtucker
211f229e 2164 - markus@cvs.openbsd.org 2006/06/01 09:21:48
2165 [sshd.c]
2166 call get_remote_ipaddr() early; fixes logging after client disconnects;
2167 report mpf@; ok dtucker@
82aeee5d 2168 - markus@cvs.openbsd.org 2006/06/06 10:20:20
2169 [readpass.c sshconnect.c sshconnect.h sshconnect2.c uidswap.c]
2170 replace remaining setuid() calls with permanently_set_uid() and
2171 check seteuid() return values; report Marcus Meissner; ok dtucker djm
3c33c1b6 2172 - markus@cvs.openbsd.org 2006/06/08 14:45:49
2173 [readpass.c sshconnect.c sshconnect2.c uidswap.c uidswap.h]
2174 do not set the gid, noted by solar; ok djm
e1ff5445 2175 - djm@cvs.openbsd.org 2006/06/13 01:18:36
2176 [ssh-agent.c]
2177 always use a format string, even when printing a constant
2178 - djm@cvs.openbsd.org 2006/06/13 02:17:07
2179 [ssh-agent.c]
2180 revert; i am on drugs. spotted by alexander AT beard.se
6cba36fd 2181
2ae7f715 218220060521
2183 - (dtucker) [auth.c monitor.c] Now that we don't log from both the monitor
2184 and slave, we can remove the special-case handling in the audit hook in
2185 auth_log.
2186
218720060517
aee28e67 2188 - (dtucker) [ssh-rand-helper.c] Check return code of mkdir and fix file
2189 pointer leak. From kjhall at us.ibm.com, found by coverity.
2190
2ae7f715 219120060515
a048aeba 2192 - (dtucker) [openbsd-compat/getrrsetbyname.c] Use _compat_res instead of
2193 _res, prevents problems on some platforms that have _res as a global but
2194 don't have getrrsetbyname(), eg IRIX 5.3. Found and tested by
2195 georg.schwarz at freenet.de, ok djm@.
143a79db 2196 - (dtucker) [defines.h] Find a value for IOV_MAX or use a conservative
2197 default. Patch originally from tim@, ok djm
5aa56df0 2198 - (dtucker) [auth-pam.c] Bug #1188: pass result of do_pam_account back and
2199 do not allow kbdint again after the PAM account check fails. ok djm@
a048aeba 2200
2ae7f715 220120060506
689d3f77 2202 - (dtucker) OpenBSD CVS Sync
fc231518 2203 - dtucker@cvs.openbsd.org 2006/04/25 08:02:27
2204 [authfile.c authfile.h sshconnect2.c ssh.c sshconnect1.c]
2205 Prevent ssh from trying to open private keys with bad permissions more than
2206 once or prompting for their passphrases (which it subsequently ignores
2207 anyway), similar to a previous change in ssh-add. bz #1186, ok djm@
397d64d2 2208 - djm@cvs.openbsd.org 2006/05/04 14:55:23
2209 [dh.c]
2210 tighter DH exponent checks here too; feedback and ok markus@
a1361c4b 2211 - djm@cvs.openbsd.org 2006/04/01 05:37:46
2212 [OVERVIEW]
2213 $OpenBSD$ in here too
9188927d 2214 - dtucker@cvs.openbsd.org 2006/05/06 08:35:40
2215 [auth-krb5.c]
2216 Add $OpenBSD$ in comment here too
fc231518 2217
01d35895 221820060504
2219 - (dtucker) [auth-pam.c groupaccess.c monitor.c monitor_wrap.c scard-opensc.c
2220 session.c ssh-rand-helper.c sshd.c openbsd-compat/bsd-cygwin_util.c
2221 openbsd-compat/setproctitle.c] Convert malloc(foo*bar) -> calloc(foo,bar)
2222 in Portable-only code; since calloc zeros, remove now-redundant memsets.
2223 Also add a couple of sanity checks. With & ok djm@
2224
7ca4010c 222520060503
2226 - (dtucker) [packet.c] Remove in_systm.h since it's also in includes.h
2227 and double including it on IRIX 5.3 causes problems. From Georg Schwarz,
2228 "no objections" tim@
2229
ac93e676 223020060423
2231 - (djm) OpenBSD CVS Sync
2232 - deraadt@cvs.openbsd.org 2006/04/01 05:42:20
2233 [scp.c]
2234 minimal lint cleanup (unused crud, and some size_t); ok djm
c0a8e7bb 2235 - djm@cvs.openbsd.org 2006/04/01 05:50:29
2236 [scp.c]
2237 xasprintification; ok deraadt@
5fe9ca7d 2238 - djm@cvs.openbsd.org 2006/04/01 05:51:34
2239 [atomicio.c]
2240 ANSIfy; requested deraadt@
2241 - dtucker@cvs.openbsd.org 2006/04/02 08:34:52
2242 [ssh-keysign.c]
2243 sessionid can be 32 bytes now too when sha256 kex is used; ok djm@
9c3c8eb1 2244 - djm@cvs.openbsd.org 2006/04/03 07:10:38
2245 [gss-genr.c]
2246 GSSAPI buffers shouldn't be nul-terminated, spotted in bugzilla #1066
2247 by dleonard AT vintela.com. use xasprintf() to simplify code while in
2248 there; "looks right" deraadt@
69d9d413 2249 - djm@cvs.openbsd.org 2006/04/16 00:48:52
2250 [buffer.c buffer.h channels.c]
2251 Fix condition where we could exit with a fatal error when an input
2252 buffer became too large and the remote end had advertised a big window.
2253 The problem was a mismatch in the backoff math between the channels code
2254 and the buffer code, so make a buffer_check_alloc() function that the
2255 channels code can use to propsectivly check whether an incremental
2256 allocation will succeed. bz #1131, debugged with the assistance of
2257 cove AT wildpackets.com; ok dtucker@ deraadt@
68d86b37 2258 - djm@cvs.openbsd.org 2006/04/16 00:52:55
2259 [atomicio.c atomicio.h]
2260 introduce atomiciov() function that wraps readv/writev to retry
2261 interrupted transfers like atomicio() does for read/write;
2262 feedback deraadt@ dtucker@ stevesk@ ok deraadt@
2c4369de 2263 - djm@cvs.openbsd.org 2006/04/16 00:54:10
2264 [sftp-client.c]
2265 avoid making a tiny 4-byte write to send the packet length of sftp
2266 commands, which would result in a separate tiny packet on the wire by
2267 using atomiciov(writev, ...) to write the length and the command in one
2268 pass; ok deraadt@
7bccebd0 2269 - djm@cvs.openbsd.org 2006/04/16 07:59:00
2270 [atomicio.c]
2271 reorder sanity test so that it cannot dereference past the end of the
2272 iov array; well spotted canacar@!
b0a892b2 2273 - dtucker@cvs.openbsd.org 2006/04/18 10:44:28
71544c3d 2274 [bufaux.c bufbn.c Makefile.in]
b0a892b2 2275 Move Buffer bignum functions into their own file, bufbn.c. This means
2276 that sftp and sftp-server (which use the Buffer functions in bufaux.c
2277 but not the bignum ones) no longer need to be linked with libcrypto.
2278 ok markus@
50394f26 2279 - djm@cvs.openbsd.org 2006/04/20 09:27:09
2280 [auth.h clientloop.c dispatch.c dispatch.h kex.h]
2281 replace the last non-sig_atomic_t flag used in a signal handler with a
2282 sig_atomic_t, unfortunately with some knock-on effects in other (non-
2283 signal) contexts in which it is used; ok markus@
4439dde1 2284 - markus@cvs.openbsd.org 2006/04/20 09:47:59
2285 [sshconnect.c]
2286 simplify; ok djm@
6e97fe1d 2287 - djm@cvs.openbsd.org 2006/04/20 21:53:44
2288 [includes.h session.c sftp.c]
2289 Switch from using pipes to socketpairs for communication between
2290 sftp/scp and ssh, and between sshd and its subprocesses. This saves
2291 a file descriptor per session and apparently makes userland ppp over
2292 ssh work; ok markus@ deraadt@ (ID Sync only - portable makes this
2293 decision on a per-platform basis)
40402a68 2294 - djm@cvs.openbsd.org 2006/04/22 04:06:51
2295 [uidswap.c]
2296 use setres[ug]id() to permanently revoke privileges; ok deraadt@
2297 (ID Sync only - portable already uses setres[ug]id() whenever possible)
ae3afe05 2298 - stevesk@cvs.openbsd.org 2006/04/22 18:29:33
2299 [crc32.c]
2300 remove extra spaces
0ca1dcaf 2301 - (djm) [auth.h dispatch.h kex.h] sprinkle in signal.h to get
2302 sig_atomic_t
ac93e676 2303
ef4d1846 230420060421
2305 - (djm) [Makefile.in configure.ac session.c sshpty.c]
2306 [contrib/redhat/sshd.init openbsd-compat/Makefile.in]
2307 [openbsd-compat/openbsd-compat.h openbsd-compat/port-linux.c]
2308 [openbsd-compat/port-linux.h] Add support for SELinux, setting
2309 the execution and TTY contexts. based on patch from Daniel Walsh,
2310 bz #880; ok dtucker@
2311
88680c8b 231220060418
ef4d1846 2313 - (djm) [canohost.c] Reorder IP options check so that it isn't broken
2314 by mapped addresses; bz #1179 reported by markw wtech-llc.com;
88680c8b 2315 ok dtucker@
2316
6a0984b4 231720060331
2318 - OpenBSD CVS Sync
2319 - deraadt@cvs.openbsd.org 2006/03/27 01:21:18
2320 [xmalloc.c]
2321 we can do the size & nmemb check before the integer overflow check;
2322 evol
fd06fbe0 2323 - deraadt@cvs.openbsd.org 2006/03/27 13:03:54
2324 [dh.c]
2325 use strtonum() instead of atoi(), limit dhg size to 64k; ok djm
e56b07ea 2326 - djm@cvs.openbsd.org 2006/03/27 23:15:46
2327 [sftp.c]
2328 always use a format string for addargs; spotted by mouring@
19e79961 2329 - deraadt@cvs.openbsd.org 2006/03/28 00:12:31
2330 [README.tun ssh.c]
2331 spacing
4f16046f 2332 - deraadt@cvs.openbsd.org 2006/03/28 01:52:28
2333 [channels.c]
2334 do not accept unreasonable X ports numbers; ok djm
cfaa5405 2335 - deraadt@cvs.openbsd.org 2006/03/28 01:53:43
2336 [ssh-agent.c]
2337 use strtonum() to parse the pid from the file, and range check it
2338 better; ok djm
04aa9e67 2339 - djm@cvs.openbsd.org 2006/03/30 09:41:25
2340 [channels.c]
2341 ARGSUSED for dispatch table-driven functions
51e7a012 2342 - djm@cvs.openbsd.org 2006/03/30 09:58:16
2343 [authfd.c bufaux.c deattack.c gss-serv.c mac.c misc.c misc.h]
2344 [monitor_wrap.c msg.c packet.c sftp-client.c sftp-server.c ssh-agent.c]
2345 replace {GET,PUT}_XXBIT macros with functionally similar functions,
2346 silencing a heap of lint warnings. also allows them to use
2347 __bounded__ checking which can't be applied to macros; requested
2348 by and feedback from deraadt@
8cffe22a 2349 - djm@cvs.openbsd.org 2006/03/30 10:41:25
2350 [ssh.c ssh_config.5]
2351 add percent escape chars to the IdentityFile option, bz #1159 based
2352 on a patch by imaging AT math.ualberta.ca; feedback and ok dtucker@
2ccf5424 2353 - dtucker@cvs.openbsd.org 2006/03/30 11:05:17
2354 [ssh-keygen.c]
2355 Correctly handle truncated files while converting keys; ok djm@
c023a130 2356 - dtucker@cvs.openbsd.org 2006/03/30 11:40:21
2357 [auth.c monitor.c]
2358 Prevent duplicate log messages when privsep=yes; ok djm@
99d18e3e 2359 - jmc@cvs.openbsd.org 2006/03/31 09:09:30
2360 [ssh_config.5]
2361 kill trailing whitespace;
b4d7dedd 2362 - djm@cvs.openbsd.org 2006/03/31 09:13:56
2363 [ssh_config.5]
2364 remote user escape is %r not %h; spotted by jmc@
6a0984b4 2365
3eff92ec 236620060326
2367 - OpenBSD CVS Sync
2368 - jakob@cvs.openbsd.org 2006/03/15 08:46:44
2369 [ssh-keygen.c]
2370 if no key file are given when printing the DNS host record, use the
2371 host key file(s) as default. ok djm@
d6157b67 2372 - biorn@cvs.openbsd.org 2006/03/16 10:31:45
2373 [scp.c]
2374 Try to display errormessage even if remout == -1
2375 ok djm@, markus@
9dfca510 2376 - djm@cvs.openbsd.org 2006/03/17 22:31:50
2377 [authfd.c]
2378 another unreachable found by lint
60ffd527 2379 - djm@cvs.openbsd.org 2006/03/17 22:31:11
2380 [authfd.c]
2381 unreachanble statement, found by lint
4113a1d7 2382 - djm@cvs.openbsd.org 2006/03/19 02:22:32
2383 [serverloop.c]
2384 memory leaks detected by Coverity via elad AT netbsd.org;
2385 ok deraadt@ dtucker@
e6a3cfb5 2386 - djm@cvs.openbsd.org 2006/03/19 02:22:56
2387 [sftp.c]
2388 more memory leaks detected by Coverity via elad AT netbsd.org;
2389 deraadt@ ok
f8f9ef4d 2390 - djm@cvs.openbsd.org 2006/03/19 02:23:26
2391 [hostfile.c]
2392 FILE* leak detected by Coverity via elad AT netbsd.org;
2393 ok deraadt@
88299971 2394 - djm@cvs.openbsd.org 2006/03/19 02:24:05
2395 [dh.c readconf.c servconf.c]
2396 potential NULL pointer dereferences detected by Coverity
2397 via elad AT netbsd.org; ok deraadt@
18fc231c 2398 - djm@cvs.openbsd.org 2006/03/19 07:41:30
2399 [sshconnect2.c]
2400 memory leaks detected by Coverity via elad AT netbsd.org;
2401 deraadt@ ok
0f8cd5a6 2402 - dtucker@cvs.openbsd.org 2006/03/19 11:51:52
2403 [servconf.c]
2404 Correct strdelim null test; ok djm@
c8e9c167 2405 - deraadt@cvs.openbsd.org 2006/03/19 18:52:11
2406 [auth1.c authfd.c channels.c]
2407 spacing
b4bbf172 2408 - deraadt@cvs.openbsd.org 2006/03/19 18:53:12
2409 [kex.c kex.h monitor.c myproposal.h session.c]
2410 spacing
3efa8ea9 2411 - deraadt@cvs.openbsd.org 2006/03/19 18:56:41
2412 [clientloop.c progressmeter.c serverloop.c sshd.c]
2413 ARGSUSED for signal handlers
6e56dc92 2414 - deraadt@cvs.openbsd.org 2006/03/19 18:59:49
2415 [ssh-keyscan.c]
2416 please lint
7de98c39 2417 - deraadt@cvs.openbsd.org 2006/03/19 18:59:30
2418 [ssh.c]
2419 spacing
c84ac6a4 2420 - deraadt@cvs.openbsd.org 2006/03/19 18:59:09
2421 [authfile.c]
2422 whoever thought that break after return was a good idea needs to
2423 get their head examimed
98d40a74 2424 - djm@cvs.openbsd.org 2006/03/20 04:09:44
2425 [monitor.c]
2426 memory leaks detected by Coverity via elad AT netbsd.org;
2427 deraadt@ ok
2428 that should be all of them now
7016f7cf 2429 - djm@cvs.openbsd.org 2006/03/20 11:38:46
2430 [key.c]
2431 (really) last of the Coverity diffs: avoid possible NULL deref in
2432 key_free. via elad AT netbsd.org; markus@ ok
5ef36928 2433 - deraadt@cvs.openbsd.org 2006/03/20 17:10:19
2434 [auth.c key.c misc.c packet.c ssh-add.c]
2435 in a switch (), break after return or goto is stupid
353d48db 2436 - deraadt@cvs.openbsd.org 2006/03/20 17:13:16
2437 [key.c]
2438 djm did a typo
952fce1b 2439 - deraadt@cvs.openbsd.org 2006/03/20 17:17:23
2440 [ssh-rsa.c]
2441 in a switch (), break after return or goto is stupid
148de80c 2442 - deraadt@cvs.openbsd.org 2006/03/20 18:14:02
b3b6f53d 2443 [channels.c clientloop.c monitor_wrap.c monitor_wrap.h serverloop.c]
2444 [ssh.c sshpty.c sshpty.h]
148de80c 2445 sprinkle u_int throughout pty subsystem, ok markus
fe8c3af1 2446 - deraadt@cvs.openbsd.org 2006/03/20 18:17:20
2447 [auth1.c auth2.c sshd.c]
2448 sprinkle some ARGSUSED for table driven functions (which sometimes
2449 must ignore their args)
32596c7b 2450 - deraadt@cvs.openbsd.org 2006/03/20 18:26:55
2451 [channels.c monitor.c session.c session.h ssh-agent.c ssh-keygen.c]
2452 [ssh-rsa.c ssh.c sshlogin.c]
2453 annoying spacing fixes getting in the way of real diffs
b248a875 2454 - deraadt@cvs.openbsd.org 2006/03/20 18:27:50
2455 [monitor.c]
2456 spacing
338eb2ab 2457 - deraadt@cvs.openbsd.org 2006/03/20 18:35:12
2458 [channels.c]
2459 x11_fake_data is only ever used as u_char *
0bcc3e35 2460 - deraadt@cvs.openbsd.org 2006/03/20 18:41:43
2461 [dns.c]
2462 cast xstrdup to propert u_char *
9555d258 2463 - deraadt@cvs.openbsd.org 2006/03/20 18:42:27
2464 [canohost.c match.c ssh.c sshconnect.c]
2465 be strict with tolower() casting
a7137f6b 2466 - deraadt@cvs.openbsd.org 2006/03/20 18:48:34
2467 [channels.c fatal.c kex.c packet.c serverloop.c]
2468 spacing
1cec12db 2469 - deraadt@cvs.openbsd.org 2006/03/20 21:11:53
2470 [ttymodes.c]
2471 spacing
52e3daed 2472 - djm@cvs.openbsd.org 2006/03/25 00:05:41
2473 [auth-bsdauth.c auth-skey.c auth.c auth2-chall.c channels.c]
2474 [clientloop.c deattack.c gss-genr.c kex.c key.c misc.c moduli.c]
2475 [monitor.c monitor_wrap.c packet.c scard.c sftp-server.c ssh-agent.c]
2476 [ssh-keyscan.c ssh.c sshconnect.c sshconnect2.c sshd.c uuencode.c]
2477 [xmalloc.c xmalloc.h]
2478 introduce xcalloc() and xasprintf() failure-checked allocations
2479 functions and use them throughout openssh
2480
2481 xcalloc is particularly important because malloc(nmemb * size) is a
2482 dangerous idiom (subject to integer overflow) and it is time for it
2483 to die
2484
2485 feedback and ok deraadt@
c5d10563 2486 - djm@cvs.openbsd.org 2006/03/25 01:13:23
2487 [buffer.c channels.c deattack.c misc.c scp.c session.c sftp-client.c]
2488 [sftp-server.c ssh-agent.c ssh-rsa.c xmalloc.c xmalloc.h auth-pam.c]
2489 [uidswap.c]
2490 change OpenSSH's xrealloc() function from being xrealloc(p, new_size)
2491 to xrealloc(p, new_nmemb, new_itemsize).
2492
2493 realloc is particularly prone to integer overflows because it is
2494 almost always allocating "n * size" bytes, so this is a far safer
2495 API; ok deraadt@
522327f5 2496 - djm@cvs.openbsd.org 2006/03/25 01:30:23
2497 [sftp.c]
2498 "abormally" is a perfectly cromulent word, but "abnormally" is better
c1cb7bae 2499 - djm@cvs.openbsd.org 2006/03/25 13:17:03
6ba5f28f 2500 [atomicio.c auth-bsdauth.c auth-chall.c auth-options.c auth-passwd.c]
2501 [auth-rh-rsa.c auth-rhosts.c auth-rsa.c auth-skey.c auth.c auth1.c]
2502 [auth2-chall.c auth2-hostbased.c auth2-kbdint.c auth2-none.c]
2503 [auth2-passwd.c auth2-pubkey.c auth2.c authfd.c authfile.c bufaux.c]
2504 [buffer.c canohost.c channels.c cipher-3des1.c cipher-bf1.c]
2505 [cipher-ctr.c cipher.c cleanup.c clientloop.c compat.c compress.c]
2506 [deattack.c dh.c dispatch.c fatal.c groupaccess.c hostfile.c kex.c]
2507 [kexdh.c kexdhc.c kexdhs.c kexgex.c kexgexc.c kexgexs.c key.c log.c]
2508 [mac.c match.c md-sha256.c misc.c monitor.c monitor_fdpass.c]
2509 [monitor_mm.c monitor_wrap.c msg.c nchan.c packet.c progressmeter.c]
2510 [readconf.c readpass.c rsa.c scard.c scp.c servconf.c serverloop.c]
2511 [session.c sftp-client.c sftp-common.c sftp-glob.c sftp-server.c]
2512 [sftp.c ssh-add.c ssh-agent.c ssh-dss.c ssh-keygen.c ssh-keyscan.c]
2513 [ssh-keysign.c ssh-rsa.c ssh.c sshconnect.c sshconnect1.c]
2514 [sshconnect2.c sshd.c sshlogin.c sshpty.c sshtty.c ttymodes.c]
2515 [uidswap.c uuencode.c xmalloc.c]
c1cb7bae 2516 Put $OpenBSD$ tags back (as comments) to replace the RCSID()s that
2517 Theo nuked - our scripts to sync -portable need them in the files
febd6f21 2518 - deraadt@cvs.openbsd.org 2006/03/25 18:29:35
2519 [auth-rsa.c authfd.c packet.c]
2520 needed casts (always will be needed)
b476adfa 2521 - deraadt@cvs.openbsd.org 2006/03/25 18:30:55
2522 [clientloop.c serverloop.c]
2523 spacing
306f24ca 2524 - deraadt@cvs.openbsd.org 2006/03/25 18:36:15
2525 [sshlogin.c sshlogin.h]
2526 nicer size_t and time_t types
0fe9892f 2527 - deraadt@cvs.openbsd.org 2006/03/25 18:40:14
2528 [ssh-keygen.c]
2529 cast strtonum() result to right type
8d0b0353 2530 - deraadt@cvs.openbsd.org 2006/03/25 18:41:45
2531 [ssh-agent.c]
2532 mark two more signal handlers ARGSUSED
d6d4897e 2533 - deraadt@cvs.openbsd.org 2006/03/25 18:43:30
2534 [channels.c]
2535 use strtonum() instead of atoi() [limit X screens to 400, sorry]
15dd2c4f 2536 - deraadt@cvs.openbsd.org 2006/03/25 18:56:55
2537 [bufaux.c channels.c packet.c]
2538 remove (char *) casts to a function that accepts void * for the arg
5b5f6af7 2539 - deraadt@cvs.openbsd.org 2006/03/25 18:58:10
2540 [channels.c]
2541 delete cast not required
56f824f3 2542 - djm@cvs.openbsd.org 2006/03/25 22:22:43
2543 [atomicio.h auth-options.h auth.h auth2-gss.c authfd.h authfile.h]
2544 [bufaux.h buffer.h canohost.h channels.h cipher.h clientloop.h]
2545 [compat.h compress.h crc32.c crc32.h deattack.h dh.h dispatch.h]
2546 [dns.c dns.h getput.h groupaccess.h gss-genr.c gss-serv-krb5.c]
2547 [gss-serv.c hostfile.h includes.h kex.h key.h log.h mac.h match.h]
2548 [misc.h monitor.h monitor_fdpass.h monitor_mm.h monitor_wrap.h msg.h]
2549 [myproposal.h packet.h pathnames.h progressmeter.h readconf.h rsa.h]
2550 [scard.h servconf.h serverloop.h session.h sftp-common.h sftp.h]
2551 [ssh-gss.h ssh.h ssh1.h ssh2.h sshconnect.h sshlogin.h sshpty.h]
2552 [ttymodes.h uidswap.h uuencode.h xmalloc.h]
2553 standardise spacing in $OpenBSD$ tags; requested by deraadt@
9594740b 2554 - deraadt@cvs.openbsd.org 2006/03/26 01:31:48
2555 [uuencode.c]
2556 typo
3eff92ec 2557
df938409 255820060325
2559 - OpenBSD CVS Sync
2560 - djm@cvs.openbsd.org 2006/03/16 04:24:42
2561 [ssh.1]
2562 Add RFC4419 (Diffie-Hellman group exchange KEX) to the list of SSH RFCs
2563 that OpenSSH supports
a92a0909 2564 - deraadt@cvs.openbsd.org 2006/03/19 18:51:18
2565 [atomicio.c auth-bsdauth.c auth-chall.c auth-krb5.c auth-options.c]
2566 [auth-pam.c auth-passwd.c auth-rh-rsa.c auth-rhosts.c auth-rsa.c]
2567 [auth-shadow.c auth-skey.c auth.c auth1.c auth2-chall.c]
2568 [auth2-hostbased.c auth2-kbdint.c auth2-none.c auth2-passwd.c]
2569 [auth2-pubkey.c auth2.c authfd.c authfile.c bufaux.c buffer.c]
2570 [canohost.c channels.c cipher-3des1.c cipher-acss.c cipher-aes.c]
2571 [cipher-bf1.c cipher-ctr.c cipher.c cleanup.c clientloop.c compat.c]
2572 [compress.c deattack.c dh.c dispatch.c dns.c entropy.c fatal.c]
2573 [groupaccess.c hostfile.c includes.h kex.c kexdh.c kexdhc.c]
2574 [kexdhs.c kexgex.c kexgexc.c kexgexs.c key.c log.c loginrec.c]
2575 [loginrec.h logintest.c mac.c match.c md-sha256.c md5crypt.c misc.c]
2576 [monitor.c monitor_fdpass.c monitor_mm.c monitor_wrap.c msg.c]
2577 [nchan.c packet.c progressmeter.c readconf.c readpass.c rsa.c]
2578 [scard.c scp.c servconf.c serverloop.c session.c sftp-client.c]
2579 [sftp-common.c sftp-glob.c sftp-server.c sftp.c ssh-add.c]
2580 [ssh-agent.c ssh-dss.c ssh-keygen.c ssh-keyscan.c ssh-keysign.c]
2581 [ssh-rand-helper.c ssh-rsa.c ssh.c sshconnect.c sshconnect1.c]
2582 [sshconnect2.c sshd.c sshlogin.c sshpty.c sshtty.c ttymodes.c]
2583 [uidswap.c uuencode.c xmalloc.c openbsd-compat/bsd-arc4random.c]
2584 [openbsd-compat/bsd-closefrom.c openbsd-compat/bsd-cygwin_util.c]
2585 [openbsd-compat/bsd-getpeereid.c openbsd-compat/bsd-misc.c]
2586 [openbsd-compat/bsd-nextstep.c openbsd-compat/bsd-snprintf.c]
2587 [openbsd-compat/bsd-waitpid.c openbsd-compat/fake-rfc2553.c]
2588 RCSID() can die
0e03e3d0 2589 - deraadt@cvs.openbsd.org 2006/03/19 18:53:12
2590 [kex.h myproposal.h]
2591 spacing
0fa53840 2592 - djm@cvs.openbsd.org 2006/03/20 04:07:22
2593 [auth2-gss.c]
2594 GSSAPI related leaks detected by Coverity via elad AT netbsd.org;
2595 reviewed by simon AT sxw.org.uk; deraadt@ ok
0926fd19 2596 - djm@cvs.openbsd.org 2006/03/20 04:07:49
2597 [gss-genr.c]
2598 more GSSAPI related leaks detected by Coverity via elad AT netbsd.org;
2599 reviewed by simon AT sxw.org.uk; deraadt@ ok
7cd30d48 2600 - djm@cvs.openbsd.org 2006/03/20 04:08:18
2601 [gss-serv.c]
2602 last lot of GSSAPI related leaks detected by Coverity via
2603 elad AT netbsd.org; reviewed by simon AT sxw.org.uk; deraadt@ ok
97f67e9a 2604 - deraadt@cvs.openbsd.org 2006/03/20 18:14:02
2605 [monitor_wrap.h sshpty.h]
2606 sprinkle u_int throughout pty subsystem, ok markus
fd6eaa8c 2607 - deraadt@cvs.openbsd.org 2006/03/20 18:26:55
2608 [session.h]
2609 annoying spacing fixes getting in the way of real diffs
6cfe93ec 2610 - deraadt@cvs.openbsd.org 2006/03/20 18:41:43
2611 [dns.c]
2612 cast xstrdup to propert u_char *
f0eea41f 2613 - jakob@cvs.openbsd.org 2006/03/22 21:16:24
2614 [ssh.1]
2615 simplify SSHFP example; ok jmc@
69753336 2616 - djm@cvs.openbsd.org 2006/03/22 21:27:15
2617 [deattack.c deattack.h]
2618 remove IV support from the CRC attack detector, OpenSSH has never used
2619 it - it only applied to IDEA-CFB, which we don't support.
2620 prompted by NetBSD Coverity report via elad AT netbsd.org;
2621 feedback markus@ "nuke it" deraadt@
df938409 2622
08a3f952 262320060318
7f38714e 2624 - (djm) [auth-pam.c] Fix memleak in error path, from Coverity via
2625 elad AT NetBSD.org
2626 - (dtucker) [openbsd-compat/bsd-snprintf.c] Bug #1173: make fmtint() take
2627 a LLONG rather than a long. Fixes scp'ing of large files on platforms
2628 with missing/broken snprintfs. Patch from e.borovac at bom.gov.au.
08a3f952 2629
32b0131a 263020060316
2631 - (dtucker) [entropy.c] Add headers for WIFEXITED and friends.
2f360c89 2632 - (dtucker) [configure.ac md-sha256.c] NetBSD has sha2.h in
2633 /usr/include/crypto. Hint from djm@.
b1f0c612 2634 - (tim) [kex.c myproposal.h md-sha256.c openbsd-compat/sha2.c,h]
2635 Disable sha256 when openssl < 0.9.7. Patch from djm@.
30baf904 2636 - (djm) [kex.c] Slightly more clean deactivation of dhgex-sha256 on old
2637 OpenSSL; ok tim
32b0131a 2638
0ac58ab4 263920060315
2640 - (djm) OpenBSD CVS Sync:
2641 - msf@cvs.openbsd.org 2006/02/06 15:54:07
2642 [ssh.1]
2643 - typo fix
2644 ok jmc@
260c414c 2645 - jmc@cvs.openbsd.org 2006/02/06 21:44:47
2646 [ssh.1]
2647 make this a little less ambiguous...
c38f5d19 2648 - stevesk@cvs.openbsd.org 2006/02/07 01:08:04
2649 [auth-rhosts.c includes.h]
2650 move #include <netgroup.h> out of includes.h; ok markus@
c3ff311a 2651 - stevesk@cvs.openbsd.org 2006/02/07 01:18:09
2652 [includes.h ssh-agent.c ssh-keyscan.c sshconnect2.c]
2653 move #include <sys/queue.h> out of includes.h; ok markus@
1d3e026f 2654 - stevesk@cvs.openbsd.org 2006/02/07 01:42:00
2655 [channels.c clientloop.c clientloop.h includes.h packet.h]
2656 [serverloop.c sshpty.c sshpty.h sshtty.c ttymodes.c]
2657 move #include <termios.h> out of includes.h; ok markus@
99f28949 2658 - stevesk@cvs.openbsd.org 2006/02/07 01:52:50
2659 [sshtty.c]
2660 "log.h" not needed
cc63c340 2661 - stevesk@cvs.openbsd.org 2006/02/07 03:47:05
2662 [hostfile.c]
2663 "packet.h" not needed
db5a9db9 2664 - stevesk@cvs.openbsd.org 2006/02/07 03:59:20
2665 [deattack.c]
2666 duplicate #include
a75f5360 2667 - stevesk@cvs.openbsd.org 2006/02/08 12:15:27
2668 [auth.c clientloop.c includes.h misc.c monitor.c readpass.c]
2669 [session.c sftp.c ssh-agent.c ssh-keysign.c ssh.c sshconnect.c]
2670 [sshd.c sshpty.c]
2671 move #include <paths.h> out of includes.h; ok markus@
6425cf65 2672 - stevesk@cvs.openbsd.org 2006/02/08 12:32:49
2673 [includes.h misc.c]
2674 move #include <netinet/tcp.h> out of includes.h; ok markus@
1720c23b 2675 - stevesk@cvs.openbsd.org 2006/02/08 13:15:44
2676 [gss-serv.c monitor.c]
2677 small KNF
5b984d1d 2678 - stevesk@cvs.openbsd.org 2006/02/08 14:16:59
2679 [sshconnect.c]
2680 <openssl/bn.h> not needed
876faccd 2681 - stevesk@cvs.openbsd.org 2006/02/08 14:31:30
2682 [includes.h ssh-agent.c ssh-keyscan.c ssh.c]
2683 move #include <sys/resource.h> out of includes.h; ok markus@
a3dcf543 2684 - stevesk@cvs.openbsd.org 2006/02/08 14:38:18
2685 [includes.h packet.c]
2686 move #include <netinet/in_systm.h> and <netinet/ip.h> out of
2687 includes.h; ok markus@
68e39d38 2688 - stevesk@cvs.openbsd.org 2006/02/08 23:51:24
2689 [includes.h scp.c sftp-glob.c sftp-server.c]
2690 move #include <dirent.h> out of includes.h; ok markus@
bbb1501d 2691 - stevesk@cvs.openbsd.org 2006/02/09 00:32:07
2692 [includes.h]
2693 #include <sys/endian.h> not needed; ok djm@
2694 NB. ID Sync only - we still need this (but it may move later)
4eb67845 2695 - jmc@cvs.openbsd.org 2006/02/09 10:10:47
2696 [sshd.8]
2697 - move some text into a CAVEATS section
2698 - merge the COMMAND EXECUTION... section into AUTHENTICATION
bd7c69ea 2699 - stevesk@cvs.openbsd.org 2006/02/10 00:27:13
2700 [channels.c clientloop.c includes.h misc.c progressmeter.c sftp.c]
2701 [ssh.c sshd.c sshpty.c]
2702 move #include <sys/ioctl.h> out of includes.h; ok markus@
aa2eae64 2703 - stevesk@cvs.openbsd.org 2006/02/10 01:44:27
2704 [includes.h monitor.c readpass.c scp.c serverloop.c session.c\7f]
2705 [sftp.c sshconnect.c sshconnect2.c sshd.c]
2706 move #include <sys/wait.h> out of includes.h; ok markus@
cfb9181c 2707 - otto@cvs.openbsd.org 2006/02/11 19:31:18
2708 [atomicio.c]
2709 type correctness; from Ray Lai in PR 5011; ok millert@
f7b8224d 2710 - djm@cvs.openbsd.org 2006/02/12 06:45:34
2711 [ssh.c ssh_config.5]
2712 add a %l expansion code to the ControlPath, which is filled in with the
2713 local hostname at runtime. Requested by henning@ to avoid some problems
2714 with /home on NFS; ok dtucker@
129d5252 2715 - djm@cvs.openbsd.org 2006/02/12 10:44:18
2716 [readconf.c]
2717 raise error when the user specifies a RekeyLimit that is smaller than 16
2718 (the smallest of our cipher's blocksize) or big enough to cause integer
2719 wraparound; ok & feedback dtucker@
5e7007ea 2720 - jmc@cvs.openbsd.org 2006/02/12 10:49:44
2721 [ssh_config.5]
2722 slight rewording; ok djm
010c04e5 2723 - jmc@cvs.openbsd.org 2006/02/12 10:52:41
2724 [sshd.8]
2725 rework the description of authorized_keys a little;
9ed4bd80 2726 - jmc@cvs.openbsd.org 2006/02/12 17:57:19
2727 [sshd.8]
2728 sort the list of options permissable w/ authorized_keys;
2729 ok djm dtucker
1e0fcfc6 2730 - jmc@cvs.openbsd.org 2006/02/13 10:16:39
2731 [sshd.8]
2732 no need to subsection the authorized_keys examples - instead, convert
2733 this to look like an actual file. also use proto 2 keys, and use IETF
2734 example addresses;
2881e0e9 2735 - jmc@cvs.openbsd.org 2006/02/13 10:21:25
2736 [sshd.8]
2737 small tweaks for the ssh_known_hosts section;
9d4b0313 2738 - jmc@cvs.openbsd.org 2006/02/13 11:02:26
2739 [sshd.8]
2740 turn this into an example ssh_known_hosts file; ok djm
481e991f 2741 - jmc@cvs.openbsd.org 2006/02/13 11:08:43
2742 [sshd.8]
2743 - avoid nasty line split
2744 - `*' does not need to be escaped
10fa86ae 2745 - jmc@cvs.openbsd.org 2006/02/13 11:27:25
2746 [sshd.8]
2747 sort FILES and use a -compact list;
2db34ac9 2748 - david@cvs.openbsd.org 2006/02/15 05:08:24
2749 [sftp-client.c]
2750 typo in comment; ok djm@
0e505e42 2751 - jmc@cvs.openbsd.org 2006/02/15 16:53:20
2752 [ssh.1]
2753 remove the IETF draft references and replace them with some updated RFCs;
2866aceb 2754 - jmc@cvs.openbsd.org 2006/02/15 16:55:33
2755 [sshd.8]
2756 remove ietf draft references; RFC list now maintained in ssh.1;
00e7c607 2757 - jmc@cvs.openbsd.org 2006/02/16 09:05:34
2758 [sshd.8]
2759 sync some of the FILES entries w/ ssh.1;
f3d2d92e 2760 - jmc@cvs.openbsd.org 2006/02/19 19:52:10
2761 [sshd.8]
2762 move the sshrc stuff out of FILES, and into its own section:
2763 FILES is not a good place to document how stuff works;
e56bbe08 2764 - jmc@cvs.openbsd.org 2006/02/19 20:02:17
2765 [sshd.8]
2766 sync the (s)hosts.equiv FILES entries w/ those from ssh.1;
3783659a 2767 - jmc@cvs.openbsd.org 2006/02/19 20:05:00
2768 [sshd.8]
2769 grammar;
922f8f17 2770 - jmc@cvs.openbsd.org 2006/02/19 20:12:25
2771 [ssh_config.5]
2772 add some vertical space;
cebb4c24 2773 - stevesk@cvs.openbsd.org 2006/02/20 16:36:15
2774 [authfd.c channels.c includes.h session.c ssh-agent.c ssh.c]
2775 move #include <sys/un.h> out of includes.h; ok djm@
4095f623 2776 - stevesk@cvs.openbsd.org 2006/02/20 17:02:44
2777 [clientloop.c includes.h monitor.c progressmeter.c scp.c]
2778 [serverloop.c session.c sftp.c ssh-agent.c ssh.c sshd.c]
2779 move #include <signal.h> out of includes.h; ok markus@
ada68823 2780 - stevesk@cvs.openbsd.org 2006/02/20 17:19:54
2781 [auth-rhosts.c auth-rsa.c auth.c auth2-none.c auth2-pubkey.c]
2782 [authfile.c clientloop.c includes.h readconf.c scp.c session.c]
2783 [sftp-client.c sftp-common.c sftp-common.h sftp-glob.c]
2784 [sftp-server.c sftp.c ssh-add.c ssh-keygen.c ssh.c sshconnect.c]
2785 [sshconnect2.c sshd.c sshpty.c]
2786 move #include <sys/stat.h> out of includes.h; ok markus@
b6438382 2787 - stevesk@cvs.openbsd.org 2006/02/22 00:04:45
2788 [canohost.c clientloop.c includes.h match.c readconf.c scp.c ssh.c]
2789 [sshconnect.c]
2790 move #include <ctype.h> out of includes.h; ok djm@
95d46d8f 2791 - jmc@cvs.openbsd.org 2006/02/24 10:25:14
2792 [ssh_config.5]
2793 add section on patterns;
2794 from dtucker + myself
ac1ec4d8 2795 - jmc@cvs.openbsd.org 2006/02/24 10:33:54
2796 [sshd_config.5]
2797 signpost to PATTERNS;
436a5ff9 2798 - jmc@cvs.openbsd.org 2006/02/24 10:37:07
2799 [ssh_config.5]
2800 tidy up the refs to PATTERNS;
4cb23985 2801 - jmc@cvs.openbsd.org 2006/02/24 10:39:52
2802 [sshd.8]
2803 signpost to PATTERNS section;
340a4caf 2804 - jmc@cvs.openbsd.org 2006/02/24 20:22:16
2805 [ssh-keysign.8 ssh_config.5 sshd_config.5]
2806 some consistency fixes;
f09ffbdb 2807 - jmc@cvs.openbsd.org 2006/02/24 20:31:31
2808 [ssh.1 ssh_config.5 sshd.8 sshd_config.5]
2809 more consistency fixes;
c5786b30 2810 - jmc@cvs.openbsd.org 2006/02/24 23:20:07
2811 [ssh_config.5]
2812 some grammar/wording fixes;
b74c3b8c 2813 - jmc@cvs.openbsd.org 2006/02/24 23:43:57
2814 [sshd_config.5]
2815 some grammar/wording fixes;
32cfd177 2816 - jmc@cvs.openbsd.org 2006/02/24 23:51:17
2817 [sshd_config.5]
2818 oops - bits i missed;
2963b207 2819 - jmc@cvs.openbsd.org 2006/02/25 12:26:17
2820 [ssh_config.5]
2821 document the possible values for KbdInteractiveDevices;
84c1b530 2822 help/ok dtucker
2823 - jmc@cvs.openbsd.org 2006/02/25 12:28:34
2824 [sshd_config.5]
2825 document the order in which allow/deny directives are processed;
a269663f 2826 help/ok dtucker
de4f5093 2827 - jmc@cvs.openbsd.org 2006/02/26 17:17:18
2828 [ssh_config.5]
2829 move PATTERNS to the end of the main body; requested by dtucker
ef1c6497 2830 - jmc@cvs.openbsd.org 2006/02/26 18:01:13
2831 [sshd_config.5]
2832 subsection is pointless here;
c04ba6a6 2833 - jmc@cvs.openbsd.org 2006/02/26 18:03:10
2834 [ssh_config.5]
2835 comma;
8b6bf4d5 2836 - djm@cvs.openbsd.org 2006/02/28 01:10:21
2837 [session.c]
2838 fix logout recording when privilege separation is disabled, analysis and
2839 patch from vinschen at redhat.com; tested by dtucker@ ok deraadt@
2840 NB. ID sync only - patch already in portable
140000b4 2841 - djm@cvs.openbsd.org 2006/03/04 04:12:58
2842 [serverloop.c]
2843 move a debug() outside of a signal handler; ok markus@ a little while back
16a5525d 2844 - djm@cvs.openbsd.org 2006/03/12 04:23:07
2845 [ssh.c]
2846 knf nit
9f513268 2847 - djm@cvs.openbsd.org 2006/03/13 08:16:00
2848 [sshd.c]
2849 don't log that we are listening on a socket before the listen() call
2850 actually succeeds, bz #1162 reported by Senthil Kumar; ok dtucker@
71f0de56 2851 - dtucker@cvs.openbsd.org 2006/03/13 08:33:00
2852 [packet.c]
2853 Set TCP_NODELAY for all connections not just "interactive" ones. Fixes
2854 poor performance and protocol stalls under some network conditions (mindrot
2855 bugs #556 and #981). Patch originally from markus@, ok djm@
15b81af3 2856 - dtucker@cvs.openbsd.org 2006/03/13 08:43:16
2857 [ssh-keygen.c]
2858 Make ssh-keygen handle CR and CRLF line termination when converting IETF
2859 format keys, in adition to vanilla LF. mindrot #1157, tested by Chris
2860 Pepper, ok djm@
533b9133 2861 - dtucker@cvs.openbsd.org 2006/03/13 10:14:29
2862 [misc.c ssh_config.5 sshd_config.5]
2863 Allow config directives to contain whitespace by surrounding them by double
2864 quotes. mindrot #482, man page help from jmc@, ok djm@
45660a22 2865 - dtucker@cvs.openbsd.org 2006/03/13 10:26:52
2866 [authfile.c authfile.h ssh-add.c]
2867 Make ssh-add check file permissions before attempting to load private
2868 key files multiple times; it will fail anyway and this prevents confusing
2869 multiple prompts and warnings. mindrot #1138, ok djm@
22aa23f8 2870 - djm@cvs.openbsd.org 2006/03/14 00:15:39
2871 [canohost.c]
2872 log the originating address and not just the name when a reverse
2873 mapping check fails, requested by linux AT linuon.com
2d762582 2874 - markus@cvs.openbsd.org 2006/03/14 16:32:48
2875 [ssh_config.5 sshd_config.5]
2876 *AliveCountMax applies to protcol v2 only; ok dtucker, djm
2ff8003a 2877 - djm@cvs.openbsd.org 2006/03/07 09:07:40
2878 [kex.c kex.h monitor.c myproposal.h ssh-keyscan.c sshconnect2.c sshd.c]
2879 Implement the diffie-hellman-group-exchange-sha256 key exchange method
2880 using the SHA256 code in libc (and wrapper to make it into an OpenSSL
2881 EVP), interop tested against CVS PuTTY
2882 NB. no portability bits committed yet
13ff27b7 2883 - (djm) [configure.ac defines.h kex.c md-sha256.c]
2884 [openbsd-compat/sha2.h openbsd-compat/openbsd-compat.h]
2885 [openbsd-compat/sha2.c] First stab at portability glue for SHA256
2886 KEX support, should work with libc SHA256 support or OpenSSL
2887 EVP_sha256 if present
1a6e2ed1 2888 - (djm) [includes.h] Restore accidentally dropped netinet/in.h
d3c45531 2889 - (djm) [Makefile.in openbsd-compat/Makefile.in] Add added files
f73e2ad7 2890 - (djm) [md-sha256.c configure.ac] md-sha256.c needs sha2.h if present
53a9f480 2891 - (djm) [regress/.cvsignore] Ignore Makefile here
81e73e57 2892 - (djm) [loginrec.c] Need stat.h
6c3a432e 2893 - (djm) [openbsd-compat/sha2.h] Avoid include macro clash with
2894 system sha2.h
cb2c6179 2895 - (djm) [ssh-rand-helper.c] Needs a bunch of headers
3e598f1a 2896 - (djm) [ssh-agent.c] Restore dropped stat.h
3070c7e1 2897 - (djm) [openbsd-compat/sha2.h openbsd-compat/sha2.c] Comment out
2898 SHA384, which we don't need and doesn't compile without tweaks
b5b88c19 2899 - (djm) [auth-pam.c clientloop.c includes.h monitor.c session.c]
2900 [sftp-client.c ssh-keysign.c ssh.c sshconnect.c sshconnect2.c]
2901 [sshd.c openbsd-compat/bsd-misc.c openbsd-compat/bsd-openpty.c]
2902 [openbsd-compat/glob.c openbsd-compat/mktemp.c]
2903 [openbsd-compat/readpassphrase.c] Lots of include fixes for
2904 OpenSolaris
b481f63d 2905 - (tim) [includes.h] put sys/stat.h back in to quiet some "macro redefined:"
3e9b2b1b 2906 - (tim) [openssh/sshpty.c openssh/openbsd-compat/port-tun.c] put in some
2907 includes removed from includes.h
d90b9f9a 2908 - (dtucker) [configure.ac] Fix glob test conversion to AC_TRY_COMPILE
b02dadfc 2909 - (djm) [includes.h] Put back paths.h, it is needed in defines.h
d4bf5977 2910 - (dtucker) [openbsd-compat/openbsd-compat.h] AIX (at least) needs
2911 sys/ioctl.h for struct winsize.
3919d576 2912 - (dtucker) [configure.ac] login_cap.h requires sys/types.h on NetBSD.
0ac58ab4 2913
055252ed 291420060313
2915 - (dtucker) [configure.ac] Bug #1171: Don't use printf("%lld", longlong)
2916 since not all platforms support it. Instead, use internal equivalent while
2917 computing LLONG_MIN and LLONG_MAX. Remove special case for alpha-dec-osf*
2918 as it's no longer required. Tested by Bernhard Simon, ok djm@
2919
f9b93ff8 292020060304
2921 - (dtucker) [contrib/cygwin/ssh-host-config] Require use of lastlog as a
2922 file rather than directory, required as Cygwin will be importing lastlog(1).
2923 Also tightens up permissions on the file. Patch from vinschen@redhat.com.
a8d3dd47 2924 - (dtucker) [gss-serv-krb5.c] Bug #1166: Correct #ifdefs for gssapi_krb5.h
2925 includes. Patch from gentoo.riverrat at gmail.com.
f9b93ff8 2926
49c64dd6 292720060226
2928 - (dtucker) [configure.ac] Bug #1156: QNX apparently needs SSHD_ACQUIRES_CTTY
2929 patch from kraai at ftbfs.org.
2930
293120060223
05059810 2932 - (dtucker) [sshd_config sshd_config.5] Update UsePAM to reflect current
2933 reality. Pointed out by tryponraj at gmail.com.
2934
49c64dd6 293520060222
0244ad55 2936 - (dtucker) [openbsd-compat/openssl-compat.{c,h}] Minor tidy up: only
2937 compile in compat code if required.
2938
15101d77 293920060221
2940 - (dtucker) [openbsd-compat/openssl-compat.h] Prevent warning about
2941 redefinition of SSLeay_add_all_algorithms.
2942
c7ad0d99 294320060220
2944 - (dtucker) [INSTALL configure.ac openbsd-compat/openssl-compat.{c,h}]
2945 Add optional enabling of OpenSSL's (hardware) Engine support, via
2946 configure --with-ssl-engine. Based in part on a diff by michal at
2947 logix.cz.
2948
46096a5b 294920060219
2950 - (dtucker) [Makefile.in configure.ac, added openbsd-compat/regress/]
2951 Add first attempt at regress tests for compat library. ok djm@
2952
103ff395 295320060214
2954 - (tim) [buildpkg.sh.in] Make the names consistent.
2955 s/pkg_post_make_install_fixes.sh/pkg-post-make-install-fixes.sh/ OK dtucker@
2956
06a517d4 295720060212
2958 - (dtucker) [openbsd-compat/bsd-cygwin_util.c] Make loop counter unsigned
2959 to silence compiler warning, from vinschen at redhat.com.
0c7e8877 2960 - (tim) [configure.ac] Bug #1149. Disable /etc/default/login check for QNX.
9603096f 2961 - (dtucker) [README version.h contrib/caldera/openssh.spec
2962 contrib/redhat/openssh.spec contrib/suse/openssh.spec] Bump version
2963 strings to match 4.3p2 release.
06a517d4 2964
4c721c3d 296520060208
2966 - (tim) [session.c] Logout records were not updated on systems with
2967 post auth privsep disabled due to bug 1086 changes. Analysis and patch
2968 by vinschen at redhat.com. OK tim@, dtucker@.
4b2cf3f1 2969 - (dtucker) [configure.ac] Typo in Ultrix and NewsOS sections (NEED_SETPRGP
8753ef06 2970 -> NEED_SETPGRP), reported by Bernhard Simon. ok tim@
4c721c3d 2971
5679f14d 297220060206
2973 - (tim) [configure.ac] Remove unnecessary tests for net/if.h and
2974 netinet/in_systm.h. OK dtucker@.
2975
823221b2 297620060205
2977 - (tim) [configure.ac] Add AC_REVISION. Add sys/time.h to lastlog.h test
2978 for Solaris. OK dtucker@.
9c54c067 2979 - (tim) [configure.ac] Bug #1149. Changes in QNX section only. Patch by
2980 kraai at ftbfs.org.
823221b2 2981
c9ecc3c7 298220060203
2983 - (tim) [configure.ac] test for egrep (AC_PROG_EGREP) before first
2984 AC_CHECK_HEADERS test. Without it, if AC_CHECK_HEADERS is first run
2985 by a platform specific check, builtin standard includes tests will be
2986 skipped on the other platforms.
2987 Analysis and suggestion by vinschen at redhat.com, patch by dtucker@.
2988 OK tim@, djm@.
2989
300ea548 299020060202
2991 - (dtucker) [configure.ac] Bug #1148: Fix "crippled AES" test so that it
2992 works with picky compilers. Patch from alex.kiernan at thus.net.
2993
0ceedd4e 299420060201
2995 - (djm) [regress/test-exec.sh] Try 'logname' as well as 'whoami' to
2996 determine the user's login name - needed for regress tests on Solaris
2997 10 and OpenSolaris
f3906047 2998 - (djm) OpenBSD CVS Sync
2999 - jmc@cvs.openbsd.org 2006/02/01 09:06:50
3000 [sshd.8]
3001 - merge sections on protocols 1 and 2 into a single section
3002 - remove configuration file section
3003 ok markus
170c69ba 3004 - jmc@cvs.openbsd.org 2006/02/01 09:11:41
3005 [sshd.8]
3006 small tweak;
026be201 3007 - (djm) [contrib/caldera/openssh.spec contrib/redhat/openssh.spec]
3008 [contrib/suse/openssh.spec] Update versions ahead of release
ac07067e 3009 - markus@cvs.openbsd.org 2006/02/01 11:27:22
3010 [version.h]
3011 openssh 4.3
2ac31303 3012 - (djm) Release OpenSSH 4.3p1
0ceedd4e 3013
0ce89457 301420060131
3015 - (djm) OpenBSD CVS Sync
3016 - jmc@cvs.openbsd.org 2006/01/20 11:21:45
3017 [ssh_config.5]
3018 - word change, agreed w/ markus
3019 - consistency fixes
ec63d7ce 3020 - jmc@cvs.openbsd.org 2006/01/25 09:04:34
3021 [sshd.8]
3022 move the options description up the page, and a few additional tweaks
3023 whilst in here;
3024 ok markus
f464b2f1 3025 - jmc@cvs.openbsd.org 2006/01/25 09:07:22
3026 [sshd.8]
3027 move subsections to full sections;
b661b7fb 3028 - jmc@cvs.openbsd.org 2006/01/26 08:47:56
3029 [ssh.1]
3030 add a section on verifying host keys in dns;
3031 written with a lot of help from jakob;
3032 feedback dtucker/markus;
3033 ok markus
d7b37427 3034 - reyk@cvs.openbsd.org 2006/01/30 12:22:22
3035 [channels.c]
3036 mark channel as write failed or dead instead of read failed on error
3037 of the channel output filter.
3038 ok markus@
062d2977 3039 - jmc@cvs.openbsd.org 2006/01/30 13:37:49
3040 [ssh.1]
3041 remove an incorrect sentence;
3042 reported by roumen petrov;
3043 ok djm markus
4116f5c0 3044 - djm@cvs.openbsd.org 2006/01/31 10:19:02
3045 [misc.c misc.h scp.c sftp.c]
3046 fix local arbitrary command execution vulnerability on local/local and
3047 remote/remote copies (CVE-2006-0225, bz #1094), patch by
3048 t8m AT centrum.cz, polished by dtucker@ and myself; ok markus@
16e8ab10 3049 - djm@cvs.openbsd.org 2006/01/31 10:35:43
3050 [scp.c]
3051 "scp a b c" shouldn't clobber "c" when it is not a directory, report and
3052 fix from biorn@; ok markus@
b645ff66 3053 - (djm) Sync regress tests to OpenBSD:
3054 - dtucker@cvs.openbsd.org 2005/03/10 10:20:39
3055 [regress/forwarding.sh]
3056 Regress test for ClearAllForwardings (bz #994); ok markus@
9b347e5f 3057 - dtucker@cvs.openbsd.org 2005/04/25 09:54:09
3058 [regress/multiplex.sh]
3059 Don't call cleanup in multiplex as test-exec will cleanup anyway
3060 found by tim@, ok djm@
3061 NB. ID sync only, we already had this
3062 - djm@cvs.openbsd.org 2005/05/20 23:14:15
3063 [regress/test-exec.sh]
3064 force addressfamily=inet for tests, unbreaking dynamic-forward regress for
3065 recently committed nc SOCKS5 changes
9f22d634 3066 - djm@cvs.openbsd.org 2005/05/24 04:10:54
89deb4c2 3067 [regress/try-ciphers.sh]
9f22d634 3068 oops, new arcfour modes here too
89deb4c2 3069 - markus@cvs.openbsd.org 2005/06/30 11:02:37
3070 [regress/scp.sh]
3071 allow SUDO=sudo; from Alexander Bluhm
41f70006 3072 - grunk@cvs.openbsd.org 2005/11/14 21:25:56
3073 [regress/agent-getpeereid.sh]
3074 all other scripts in this dir use $SUDO, not 'sudo', so pull this even
3075 ok markus@
71133d5b 3076 - dtucker@cvs.openbsd.org 2005/12/14 04:36:39
3077 [regress/scp-ssh-wrapper.sh]
3078 Fix assumption about how many args scp will pass; ok djm@
3079 NB. ID sync only, we already had this
452613c1 3080 - djm@cvs.openbsd.org 2006/01/27 06:49:21
3081 [scp.sh]
3082 regress test for local to local scp copies; ok dtucker@
3ca1f5b0 3083 - djm@cvs.openbsd.org 2006/01/31 10:23:23
3084 [scp.sh]
3085 regression test for CVE-2006-0225 written by dtucker@
d5b44cf1 3086 - djm@cvs.openbsd.org 2006/01/31 10:36:33
3087 [scp.sh]
3088 regress test for "scp a b c" where "c" is not a directory
0ce89457 3089
eeb27c78 309020060129
3091 - (dtucker) [configure.ac opensshd.init.in] Bug #1144: Use /bin/sh for the
3092 opensshd.init script interpretter if /sbin/sh does not exist. ok tim@
3093
16ad260d 309420060120
3095 - (dtucker) OpenBSD CVS Sync
3096 - jmc@cvs.openbsd.org 2006/01/15 17:37:05
3097 [ssh.1]
3098 correction from deraadt
43a7d9e7 3099 - jmc@cvs.openbsd.org 2006/01/18 10:53:29
3100 [ssh.1]
3101 add a section on ssh-based vpn, based on reyk's README.tun;
db175906 3102 - dtucker@cvs.openbsd.org 2006/01/20 00:14:55
3103 [scp.1 ssh.1 ssh_config.5 sftp.1]
3104 Document RekeyLimit. Based on patch from jan.iven at cern.ch from mindrot
3105 #1056 with feedback from jmc, djm and markus; ok jmc@ djm@
16ad260d 3106
aaa18db9 310720060114
3108 - (djm) OpenBSD CVS Sync
3109 - jmc@cvs.openbsd.org 2006/01/06 13:27:32
3110 [ssh.1]
3111 weed out some duplicate info in the known_hosts FILES entries;
3112 ok djm
5d7b356f 3113 - jmc@cvs.openbsd.org 2006/01/06 13:29:10
3114 [ssh.1]
3115 final round of whacking FILES for duplicate info, and some consistency
3116 fixes;
3117 ok djm
dbb3bf96 3118 - jmc@cvs.openbsd.org 2006/01/12 14:44:12
3119 [ssh.1]
3120 split sections on tcp and x11 forwarding into two sections.
3121 add an example in the tcp section, based on sth i wrote for ssh faq;
3122 help + ok: djm markus dtucker
5d4e571c 3123 - jmc@cvs.openbsd.org 2006/01/12 18:48:48
3124 [ssh.1]
3125 refer to `TCP' rather than `TCP/IP' in the context of connection
3126 forwarding;
3127 ok markus
e5d4cfad 3128 - jmc@cvs.openbsd.org 2006/01/12 22:20:00
3129 [sshd.8]
3130 refer to TCP forwarding, rather than TCP/IP forwarding;
0b3950af 3131 - jmc@cvs.openbsd.org 2006/01/12 22:26:02
3132 [ssh_config.5]
3133 refer to TCP forwarding, rather than TCP/IP forwarding;
c2da64a1 3134 - jmc@cvs.openbsd.org 2006/01/12 22:34:12
3135 [ssh.1]
3136 back out a sentence - AUTHENTICATION already documents this;
aaa18db9 3137
794febd2 313820060109
3139 - (dtucker) [contrib/cygwin/ssh-host-config] Make sshd service depend on
3140 tcpip service so it's always started after IP is up. Patch from
3141 vinschen at redhat.com.
3142
0624a70b 314320060106
3144 - (djm) OpenBSD CVS Sync
3145 - jmc@cvs.openbsd.org 2006/01/03 16:31:10
3146 [ssh.1]
3147 move FILES to a -compact list, and make each files an item in that list.
3148 this avoids nastly line wrap when we have long pathnames, and treats
3149 each file as a separate item;
3150 remove the .Pa too, since it is useless.
0502727e 3151 - jmc@cvs.openbsd.org 2006/01/03 16:35:30
3152 [ssh.1]
3153 use a larger width for the ENVIRONMENT list;
f403d7b5 3154 - jmc@cvs.openbsd.org 2006/01/03 16:52:36
3155 [ssh.1]
3156 put FILES in some sort of order: sort by pathname
c0907b37 3157 - jmc@cvs.openbsd.org 2006/01/03 16:55:18
3158 [ssh.1]
3159 tweak the description of ~/.ssh/environment
f3119772 3160 - jmc@cvs.openbsd.org 2006/01/04 18:42:46
3161 [ssh.1]
3162 chop out some duplication in the .{r,s}hosts/{h,sh}osts.equiv FILES
3163 entries;
3164 ok markus
6c276bb9 3165 - jmc@cvs.openbsd.org 2006/01/04 18:45:01
3166 [ssh.1]
3167 remove .Xr's to rsh(1) and telnet(1): they are hardly needed;
926f6a7a 3168 - jmc@cvs.openbsd.org 2006/01/04 19:40:24
3169 [ssh.1]
3170 +.Xr ssh-keyscan 1 ,
ccce91ef 3171 - jmc@cvs.openbsd.org 2006/01/04 19:50:09
3172 [ssh.1]
3173 -.Xr gzip 1 ,
db382686 3174 - djm@cvs.openbsd.org 2006/01/05 23:43:53
3175 [misc.c]
3176 check that stdio file descriptors are actually closed before clobbering
3177 them in sanitise_stdfd(). problems occurred when a lower numbered fd was
3178 closed, but higher ones weren't. spotted by, and patch tested by
3179 Frédéric Olivié
0624a70b 3180
d3506f6d 318120060103
3182 - (djm) [channels.c] clean up harmless merge error, from reyk@
3183
79e46360 318420060103
3185 - (djm) OpenBSD CVS Sync
3186 - jmc@cvs.openbsd.org 2006/01/02 17:09:49
3187 [ssh_config.5 sshd_config.5]
3188 some corrections from michael knudsen;
3189
6f6cd507 319020060102
3191 - (djm) [README.tun] Add README.tun, missed during sync of tun(4) support
4b5e6c81 3192 - (djm) OpenBSD CVS Sync
3193 - jmc@cvs.openbsd.org 2005/12/31 10:46:17
3194 [ssh.1]
3195 merge the "LOGIN SESSION AND REMOTE EXECUTION" and "SERVER
3196 AUTHENTICATION" sections into "AUTHENTICATION";
3197 some rewording done to make the text read better, plus some
3198 improvements from djm;
3199 ok djm
b92605e1 3200 - jmc@cvs.openbsd.org 2005/12/31 13:44:04
3201 [ssh.1]
3202 clean up ENVIRONMENT a little;
20892533 3203 - jmc@cvs.openbsd.org 2005/12/31 13:45:19
3204 [ssh.1]
3205 .Nm does not require an argument;
1f1fbbd8 3206 - stevesk@cvs.openbsd.org 2006/01/01 08:59:27
3207 [includes.h misc.c]
3208 move <net/if.h>; ok djm@
81c042a3 3209 - stevesk@cvs.openbsd.org 2006/01/01 10:08:48
3210 [misc.c]
3211 no trailing "\n" for debug()
3eee3b86 3212 - djm@cvs.openbsd.org 2006/01/02 01:20:31
3213 [sftp-client.c sftp-common.h sftp-server.c]
3214 use a common max. packet length, no binary change
b1b65311 3215 - reyk@cvs.openbsd.org 2006/01/02 07:53:44
3216 [misc.c]
3217 clarify tun(4) opening - set the mode and bring the interface up. also
3218 (re)sets the tun(4) layer 2 LINK0 flag for existing tunnel interfaces.
3219 suggested and ok by djm@
d141c93d 3220 - jmc@cvs.openbsd.org 2006/01/02 12:31:06
3221 [ssh.1]
3222 start to cut some duplicate info from FILES;
3223 help/ok djm
6f6cd507 3224
0f6cb079 322520060101
3226 - (djm) [Makefile.in configure.ac includes.h misc.c]
3227 [openbsd-compat/port-tun.c openbsd-compat/port-tun.h] Add support
3228 for tunnel forwarding for FreeBSD and NetBSD. NetBSD's support is
3229 limited to IPv4 tunnels only, and most versions don't support the
3230 tap(4) device at all.
b5081213 3231 - (djm) [configure.ac] Fix linux/if_tun.h test
3aef38da 3232 - (djm) [openbsd-compat/port-tun.c] Linux needs linux/if.h too
0f6cb079 3233
1908529f 323420051229
3235 - (djm) OpenBSD CVS Sync
3236 - stevesk@cvs.openbsd.org 2005/12/28 22:46:06
3237 [canohost.c channels.c clientloop.c]
3238 use 'break-in' for consistency; ok deraadt@ ok and input jmc@
c1c6a032 3239 - reyk@cvs.openbsd.org 2005/12/30 15:56:37
3240 [channels.c channels.h clientloop.c]
3241 add channel output filter interface.
3242 ok djm@, suggested by markus@
3da242db 3243 - jmc@cvs.openbsd.org 2005/12/30 16:59:00
3244 [sftp.1]
3245 do not suggest that interactive authentication will work
3246 with the -b flag;
3247 based on a diff from john l. scarfone;
3248 ok djm
f470cf48 3249 - stevesk@cvs.openbsd.org 2005/12/31 01:38:45
3250 [ssh.1]
3251 document -MM; ok djm@
e914f53a 3252 - (djm) [openbsd-compat/port-tun.c openbsd-compat/port-tun.h configure.ac]
3253 [serverloop.c ssh.c openbsd-compat/Makefile.in]
3254 [openbsd-compat/openbsd-compat.h] Implement tun(4) forwarding
3255 compatability support for Linux, diff from reyk@
c40f09ca 3256 - (djm) [configure.ac] Disable Linux tun(4) compat code if linux/tun.h does
3257 not exist
d91775e1 3258 - (djm) [configure.ac] oops, make that linux/if_tun.h
1908529f 3259
b5c428f0 326020051229
3261 - (tim) [buildpkg.sh.in] grep for $SSHDUID instead of $SSHDGID on /etc/passwd
3262
6b0117fd 326320051224
3264 - (djm) OpenBSD CVS Sync
3265 - jmc@cvs.openbsd.org 2005/12/20 21:59:43
3266 [ssh.1]
3267 merge the sections on protocols 1 and 2 into one section on
3268 authentication;
3269 feedback djm dtucker
3270 ok deraadt markus dtucker
5c5546be 3271 - jmc@cvs.openbsd.org 2005/12/20 22:02:50
3272 [ssh.1]
3273 .Ss -> .Sh: subsections have not made this page more readable
e6c7c03e 3274 - jmc@cvs.openbsd.org 2005/12/20 22:09:41
3275 [ssh.1]
3276 move info on ssh return values and config files up into the main
3277 description;
e49f7abd 3278 - jmc@cvs.openbsd.org 2005/12/21 11:48:16
3279 [ssh.1]
3280 -L and -R descriptions are now above, not below, ~C description;
8770ef76 3281 - jmc@cvs.openbsd.org 2005/12/21 11:57:25
3282 [ssh.1]
3283 options now described `above', rather than `later';
6e1e9c73 3284 - jmc@cvs.openbsd.org 2005/12/21 12:53:31
3285 [ssh.1]
3286 -Y does X11 forwarding too;
3287 ok markus
6cd6c442 3288 - stevesk@cvs.openbsd.org 2005/12/21 22:44:26
3289 [sshd.8]
3290 clarify precedence of -p, Port, ListenAddress; ok and help jmc@
0c9851b1 3291 - jmc@cvs.openbsd.org 2005/12/22 10:31:40
3292 [ssh_config.5]
3293 put the description of "UsePrivilegedPort" in the correct place;
9bf41db3 3294 - jmc@cvs.openbsd.org 2005/12/22 11:23:42
3295 [ssh.1]
3296 expand the description of -w somewhat;
3297 help/ok reyk
86131206 3298 - jmc@cvs.openbsd.org 2005/12/23 14:55:53
3299 [ssh.1]
3300 - sync the description of -e w/ synopsis
3301 - simplify the description of -I
3302 - note that -I is only available if support compiled in, and that it
3303 isn't by default
3304 feedback/ok djm@
025fc42e 3305 - jmc@cvs.openbsd.org 2005/12/23 23:46:23
3306 [ssh.1]
3307 less mark up for -c;
678143bd 3308 - djm@cvs.openbsd.org 2005/12/24 02:27:41
3309 [session.c sshd.c]
3310 eliminate some code duplicated in privsep and non-privsep paths, and
3311 explicitly clear SIGALRM handler; "groovy" deraadt@
6b0117fd 3312
a2b1748a 331320051220
3314 - (dtucker) OpenBSD CVS Sync
3315 - reyk@cvs.openbsd.org 2005/12/13 15:03:02
3316 [serverloop.c]
3317 if forced_tun_device is not set, it is -1 and not SSH_TUNID_ANY
442c8b33 3318 - jmc@cvs.openbsd.org 2005/12/16 18:07:08
3319 [ssh.1]
3320 move the option descriptions up the page: start of a restructure;
3321 ok markus deraadt
e426efa9 3322 - jmc@cvs.openbsd.org 2005/12/16 18:08:53
3323 [ssh.1]
3324 simplify a sentence;
28ca205d 3325 - jmc@cvs.openbsd.org 2005/12/16 18:12:22
3326 [ssh.1]
3327 make the description of -c a little nicer;
a55c1733 3328 - jmc@cvs.openbsd.org 2005/12/16 18:14:40
3329 [ssh.1]
3330 signpost the protocol sections;
8918b906 3331 - stevesk@cvs.openbsd.org 2005/12/17 21:13:05
3332 [ssh_config.5 session.c]
3333 spelling: fowarding, fowarded
551ed07c 3334 - stevesk@cvs.openbsd.org 2005/12/17 21:36:42
3335 [ssh_config.5]
3336 spelling: intented -> intended
3aa43b24 3337 - dtucker@cvs.openbsd.org 2005/12/20 04:41:07
3338 [ssh.c]
3339 exit(255) on error to match description in ssh(1); bz #1137; ok deraadt@
a2b1748a 3340
e5146707 334120051219
3342 - (dtucker) [cipher-aes.c cipher-ctr.c cipher.c configure.ac
3343 openbsd-compat/openssl-compat.h] Check for and work around broken AES
3344 ciphers >128bit on (some) Solaris 10 systems. ok djm@
3345
2f89281c 334620051217
3347 - (dtucker) [defines.h] HP-UX system headers define "YES" and "NO" which
3348 scp.c also uses, so undef them here.
31b0732a 3349 - (dtucker) [configure.ac openbsd-compat/bsd-snprintf.c] Bug #1133: Our
3350 snprintf replacement can have a conflicting declaration in HP-UX's system
3351 headers (const vs. no const) so we now check for and work around it. Patch
3352 from the dynamic duo of David Leonard and Ted Percival.
2f89281c 3353
9fed02d8 335420051214
3355 - (dtucker) OpenBSD CVS Sync (regress/)
3356 - dtucker@cvs.openbsd.org 2005/12/30 04:36:39
3357 [regress/scp-ssh-wrapper.sh]
3358 Fix assumption about how many args scp will pass; ok djm@
3359
d7cf99ff 336020051213
3361 - (djm) OpenBSD CVS Sync
3362 - jmc@cvs.openbsd.org 2005/11/30 11:18:27
3363 [ssh.1]
3364 timezone -> time zone
04ac3e62 3365 - jmc@cvs.openbsd.org 2005/11/30 11:45:20
3366 [ssh.1]
3367 avoid ambiguities in describing TZ;
3368 ok djm@
d20f3c9e 3369 - reyk@cvs.openbsd.org 2005/12/06 22:38:28
3370 [auth-options.c auth-options.h channels.c channels.h clientloop.c]
3371 [misc.c misc.h readconf.c readconf.h scp.c servconf.c servconf.h]
3372 [serverloop.c sftp.c ssh.1 ssh.c ssh_config ssh_config.5 sshconnect.c]
3373 [sshconnect.h sshd.8 sshd_config sshd_config.5]
3374 Add support for tun(4) forwarding over OpenSSH, based on an idea and
3375 initial channel code bits by markus@. This is a simple and easy way to
3376 use OpenSSH for ad hoc virtual private network connections, e.g.
3377 administrative tunnels or secure wireless access. It's based on a new
3378 ssh channel and works similar to the existing TCP forwarding support,
3379 except that it depends on the tun(4) network interface on both ends of
3380 the connection for layer 2 or layer 3 tunneling. This diff also adds
3381 support for LocalCommand in the ssh(1) client.
d20f3c9e 3382 ok djm@, markus@, jmc@ (manpages), tested and discussed with others
ceec33f3 3383 - djm@cvs.openbsd.org 2005/12/07 03:52:22
3384 [clientloop.c]
3385 reyk forgot to compile with -Werror (missing header)
985bb789 3386 - jmc@cvs.openbsd.org 2005/12/07 10:52:13
3387 [ssh.1]
3388 - avoid line split in SYNOPSIS
3389 - add args to -w
3390 - kill trailing whitespace
64925c6d 3391 - jmc@cvs.openbsd.org 2005/12/08 14:59:44
3392 [ssh.1 ssh_config.5]
3393 make `!command' a little clearer;
3394 ok reyk
030723f9 3395 - jmc@cvs.openbsd.org 2005/12/08 15:06:29
3396 [ssh_config.5]
3397 keep options in order;
a4f24bf8 3398 - reyk@cvs.openbsd.org 2005/12/08 18:34:11
3399 [auth-options.c includes.h misc.c misc.h readconf.c servconf.c]
3400 [serverloop.c ssh.c ssh_config.5 sshd_config.5 configure.ac]
3401 two changes to the new ssh tunnel support. this breaks compatibility
3402 with the initial commit but is required for a portable approach.
3403 - make the tunnel id u_int and platform friendly, use predefined types.
3404 - support configuration of layer 2 (ethernet) or layer 3
3405 (point-to-point, default) modes. configuration is done using the
3406 Tunnel (yes|point-to-point|ethernet|no) option is ssh_config(5) and
3407 restricted by the PermitTunnel (yes|point-to-point|ethernet|no) option
3408 in sshd_config(5).
3409 ok djm@, man page bits by jmc@
a274ba38 3410 - jmc@cvs.openbsd.org 2005/12/08 21:37:50
3411 [ssh_config.5]
3412 new sentence, new line;
b872f7f0 3413 - markus@cvs.openbsd.org 2005/12/12 13:46:18
3414 [channels.c channels.h session.c]
3415 make sure protocol messages for internal channels are ignored.
3416 allow adjust messages for non-open channels; with and ok djm@
6306853a 3417 - (djm) [misc.c] Disable tunnel code for non-OpenBSD (for now), enable
3418 again by providing a sys_tun_open() function for your platform and
3419 setting the CUSTOM_SYS_TUN_OPEN define. More work is required to match
3420 OpenBSD's tunnel protocol, which prepends the address family to the
3421 packet
d7cf99ff 3422
fbc06315 342320051201
3424 - (djm) [envpass.sh] Remove regress script that was accidentally committed
3425 in top level directory and not noticed for over a year :)
3426
6e94bd72 342720051129
3428 - (tim) [ssh-keygen.c] Move DSA length test after setting default when
3429 bits == 0.
60dc0294 3430 - (dtucker) OpenBSD CVS Sync
3431 - dtucker@cvs.openbsd.org 2005/11/29 02:04:55
3432 [ssh-keygen.c]
3433 Populate default key sizes before checking them; from & ok tim@
e45da4d6 3434 - (tim) [configure.ac sshd.8] Enable locked account check (a "*LK*" string)
3435 for UnixWare.
6e94bd72 3436
b7bb251f 343720051128
3438 - (dtucker) [regress/yes-head.sh] Work around breakage caused by some
3439 versions of GNU head. Based on patch from zappaman at buraphalinux.org
8b396721 3440 - (dtucker) [includes.h] Bug #1122: __USE_GNU is a glibc internal macro, use
3441 _GNU_SOURCE instead. Patch from t8m at centrum.cz.
c6d7b211 3442 - (dtucker) OpenBSD CVS Sync
3443 - dtucker@cvs.openbsd.org 2005/11/28 05:16:53
3444 [ssh-keygen.1 ssh-keygen.c]
3445 Enforce DSA key length of exactly 1024 bits to comply with FIPS-186-2,
3446 increase minumum RSA key size to 768 bits and update man page to reflect
3447 these. Patch originally bz#1119 (senthilkumar_sen at hotpop.com),
3448 ok djm@, grudging ok deraadt@.
98e93fbc 3449 - dtucker@cvs.openbsd.org 2005/11/28 06:02:56
3450 [ssh-agent.1]
3451 Update agent socket path templates to reflect reality, correct xref for
3452 time formats. bz#1121, patch from openssh at roumenpetrov.info, ok djm@
b7bb251f 3453
961c2997 345420051126
3455 - (dtucker) [configure.ac] Bug #1126: AIX 5.2 and 5.3 (and presumably newer,
3456 when they're available) need the real UID set otherwise pam_chauthtok will
3457 set ADMCHG after changing the password, forcing the user to change it
3458 again immediately.
3459
ccc45ee0 346020051125
3461 - (dtucker) [configure.ac] Apply tim's fix for older systems where the
3462 resolver state in resolv.h is "state" not "__res_state". With slight
3463 modification by me to also work on old AIXes. ok djm@
419094c6 3464 - (dtucker) [progressmeter.c scp.c sftp-server.c] Use correct casts for
3465 snprintf formats, fixes warnings on some 64 bit platforms. Patch from
3466 shaw at vranix.com, ok djm@
ccc45ee0 3467
346820051124
9a406e1e 3469 - (djm) [configure.ac openbsd-compat/Makefile.in openbsd-compat/bsd-asprintf.c
3470 openbsd-compat/bsd-snprintf.c openbsd-compat/openbsd-compat.h] Add an
3471 asprintf() implementation, after syncing our {v,}snprintf() implementation
3472 with some extra fixes from Samba's version. With help and debugging from
3473 dtucker and tim; ok dtucker@
d08db6d1 3474 - (dtucker) [configure.ac] Fix typos in comments and AC_SEARCH_LIB argument
3475 order in Reliant Unix block. Patch from johane at lysator.liu.se.
d77c7dff 3476 - (dtucker) [regress/test-exec.sh] Use 1024 bit keys since we generate so
3477 many and use them only once. Speeds up testing on older/slower hardware.
9a406e1e 3478
932ab351 347920051122
3480 - (dtucker) OpenBSD CVS Sync
3481 - deraadt@cvs.openbsd.org 2005/11/12 18:37:59
3482 [ssh-add.c]
3483 space
29accf74 3484 - deraadt@cvs.openbsd.org 2005/11/12 18:38:15
3485 [scp.c]
3486 avoid close(-1), as in rcp; ok cloder
a001f9d7 3487 - millert@cvs.openbsd.org 2005/11/15 11:59:54
3488 [includes.h]
3489 Include sys/queue.h explicitly instead of assuming some other header
3490 will pull it in. At the moment it gets pulled in by sys/select.h
3491 (which ssh has no business including) via event.h. OK markus@
3492 (ID sync only in -portable)
426cef74 3493 - dtucker@cvs.openbsd.org 2005/11/21 09:42:10
3494 [auth-krb5.c]
3495 Perform Kerberos calls even for invalid users to prevent leaking
3496 information about account validity. bz #975, patch originally from
3497 Senthil Kumar, sanity checked by Simon Wilkinson, tested by djm@, biorn@,
3498 ok markus@
18f8ef7a 3499 - dtucker@cvs.openbsd.org 2005/11/22 03:36:03
3500 [hostfile.c]
3501 Correct format/arguments to debug call; spotted by shaw at vranix.com
3502 ok djm@
dfde7f6e 3503 - (dtucker) [loginrec.c] Add casts to prevent compiler warnings, patch
3504 from shaw at vranix.com.
932ab351 3505
60e10887 350620051120
3507 - (dtucker) [openbsd-compat/openssl-compat.h] Add comment explaining what
3508 is going on.
3509
4162eae5 351020051112
3511 - (dtucker) [openbsd-compat/getrrsetbyname.c] Restore Portable-specific
3512 ifdef lost during sync. Spotted by tim@.
f97dc218 3513 - (dtucker) [openbsd-compat/{realpath.c,stroll.c,rresvport.c}] $OpenBSD tag.
eeee8237 3514 - (dtucker) [configure.ac] Use "$AWK" instead of "awk" in gcc version test.
23361281 3515 - (dtucker) [configure.ac] Remove duplicate utimes() check. ok djm@
29aaf112 3516 - (dtucker) [regress/reconfigure.sh] Fix potential race in the reconfigure
3517 test: if sshd takes too long to reconfigure the subsequent connection will
3518 fail. Zap pidfile before HUPing sshd which will rewrite it when it's ready.
4162eae5 3519
e1658b5c 352020051110
b69585d9 3521 - (dtucker) [openbsd-compat/setenv.c] Merge changes for __findenv from
e1658b5c 3522 OpenBSD getenv.c revs 1.4 - 1.8 (ANSIfication of arguments, removal of
3523 "register").
b69585d9 3524 - (dtucker) [openbsd-compat/setenv.c] Make __findenv static, remove
7b2dcf21 3525 unnecessary prototype.
b69585d9 3526 - (dtucker) [openbsd-compat/setenv.c] Sync changes from OpenBSD setenv.c
3527 revs 1.7 - 1.9.
c080bed1 3528 - (dtucker) [auth-krb5.c] Fix -Wsign-compare warning in non-Heimdal path.
3529 Patch from djm@.
dbf07ba2 3530 - (dtucker) [configure.ac] Disable pointer-sign warnings on gcc 4.0+
3531 since they're not useful right now. Patch from djm@.
242652fe 3532 - (dtucker) [openbsd-compat/getgrouplist.c] Sync OpenBSD revs 1.10 - 1.2 (ANSI
3533 prototypes, removal of "register").
432e59f9 3534 - (dtucker) [openbsd-compat/strlcat.c] Sync OpenBSD revs 1.11 - 1.12 (removal
3535 of "register").
f6d4fb87 3536 - (dtucker) [openbsd-compat/{LOTS}] Move the "OPENBSD ORIGINAL" markers to
3537 after the copyright notices. Having them at the top next to the CVSIDs
3538 guarantees a conflict for each and every sync.
e4f65477 3539 - (dtucker) [openbsd-compat/strlcpy.c] Update from OpenBSD 1.8 -> 1.10.
bfd4a832 3540 - (dtucker) [openbsd-compat/sigact.h] Add "OPENBSD ORIGINAL" marker.
bc16ca63 3541 - (dtucker) [openbsd-compat/strmode.c] Update from OpenBSD 1.5 -> 1.7.
3542 Removal of rcsid, "whiteout" inode type.
7dfb4a82 3543 - (dtucker) [openbsd-compat/basename.c] Update from OpenBSD 1.11 -> 1.14.
3544 Removal of rcsid, will no longer strlcpy parts of the string.
d8922805 3545 - (dtucker) [openbsd-compat/strtoll.c] Update from OpenBSD 1.4 -> 1.5.
4ff445f1 3546 - (dtucker) [openbsd-compat/strtoul.c] Update from OpenBSD 1.5 -> 1.7.
e1829842 3547 - (dtucker) [openbsd-compat/readpassphrase.c] Update from OpenBSD 1.16 -> 1.18.
625552b8 3548 - (dtucker) [openbsd-compat/readpassphrase.h] Update from OpenBSD 1.3 -> 1.5.
a65ea33b 3549 - (dtucker) [openbsd-compat/glob.c] Update from OpenBSD 1.22 -> 1.25.
b84a707a 3550 - (dtucker) [openbsd-compat/glob.h] Update from OpenBSD 1.8 -> 1.9.
281bbb02 3551 - (dtucker) [openbsd-compat/getcwd.c] Update from OpenBSD 1.9 -> 1.14.
16d51c41 3552 - (dtucker) [openbsd-compat/getcwd.c] Replace lstat with fstat to match up
3553 with OpenBSD code since we don't support platforms without fstat any more.
b53df919 3554 - (dtucker) [openbsd-compat/inet_aton.c] Update from OpenBSD 1.7 -> 1.9.
68b36828 3555 - (dtucker) [openbsd-compat/inet_ntoa.c] Update from OpenBSD 1.4 -> 1.6.
3556 - (dtucker) [openbsd-compat/inet_ntop.c] Update from OpenBSD 1.5 -> 1.7.
fc1c42f3 3557 - (dtucker) [openbsd-compat/daemon.c] Update from OpenBSD 1.5 -> 1.6.
0695e921 3558 - (dtucker) [openbsd-compat/strsep.c] Update from OpenBSD 1.5 -> 1.6.
3c8f7a26 3559 - (dtucker) [openbsd-compat/daemon.c] Update from OpenBSD 1.10 -> 1.13.
5bf337a5 3560 - (dtucker) [openbsd-compat/mktemp.c] Update from OpenBSD 1.17 -> 1.19.
8c603515 3561 - (dtucker) [openbsd-compat/rresvport.c] Update from OpenBSD 1.6 -> 1.8.
c9d7b187 3562 - (dtucker) [openbsd-compat/bindresvport.c] Add "OPENBSD ORIGINAL" marker.
295034ce 3563 - (dtucker) [openbsd-compat/bindresvport.c] Update from OpenBSD 1.16 -> 1.17.
3e6325a6 3564 - (dtucker) [openbsd-compat/sigact.c] Update from OpenBSD 1.3 -> 1.4.
3565 Id and copyright sync only, there were no substantial changes we need.
8d767ef2 3566 - (dtucker) [openbsd-compat/bsd-closefrom.c openbsd-compat/base64.c]
6bd2d8e5 3567 -Wsign-compare fixes from djm.
e1b4416e 3568 - (dtucker) [openbsd-compat/sigact.h] Update from OpenBSD 1.2 -> 1.3.
3569 Id and copyright sync only, there were no substantial changes we need.
cd595991 3570 - (dtucker) [configure.ac] Try to get the gcc version number in a way that
3571 doesn't change between versions, and use a safer default.
e1658b5c 3572
255d3e00 357320051105
3574 - (djm) OpenBSD CVS Sync
3575 - markus@cvs.openbsd.org 2005/10/07 11:13:57
3576 [ssh-keygen.c]
3577 change DSA default back to 1024, as it's defined for 1024 bits only
3578 and this causes interop problems with other clients. moreover,
3579 in order to improve the security of DSA you need to change more
3580 components of DSA key generation (e.g. the internal SHA1 hash);
3581 ok deraadt
8cd0437d 3582 - djm@cvs.openbsd.org 2005/10/10 10:23:08
3583 [channels.c channels.h clientloop.c serverloop.c session.c]
3584 fix regression I introduced in 4.2: X11 forwardings initiated after
3585 a session has exited (e.g. "(sleep 5; xterm) &") would not start.
3586 bz #1086 reported by t8m AT centrum.cz; ok markus@ dtucker@
442aee3a 3587 - djm@cvs.openbsd.org 2005/10/11 23:37:37
3588 [channels.c]
3589 bz #1076 set SO_REUSEADDR on X11 forwarding listner sockets, preventing
3590 bind() failure when a previous connection's listeners are in TIME_WAIT,
3591 reported by plattner AT inf.ethz.ch; ok dtucker@
b96eade6 3592 - stevesk@cvs.openbsd.org 2005/10/13 14:03:01
3593 [auth2-gss.c gss-genr.c gss-serv.c]
3594 remove unneeded #includes; ok markus@
6e902aec 3595 - stevesk@cvs.openbsd.org 2005/10/13 14:20:37
3596 [gss-serv.c]
3597 spelling in comments
6472fefc 3598 - stevesk@cvs.openbsd.org 2005/10/13 19:08:08
3599 [gss-serv-krb5.c gss-serv.c]
3600 unused declarations; ok deraadt@
3601 (id sync only for gss-serv-krb5.c)
adf8c40b 3602 - stevesk@cvs.openbsd.org 2005/10/13 19:13:41
3603 [dns.c]
3604 unneeded #include, unused declaration, little knf; ok deraadt@
8442cc66 3605 - stevesk@cvs.openbsd.org 2005/10/13 22:24:31
3606 [auth2-gss.c gss-genr.c gss-serv.c monitor.c]
3607 KNF; ok djm@
17318dd6 3608 - stevesk@cvs.openbsd.org 2005/10/14 02:17:59
3609 [ssh-keygen.c ssh.c sshconnect2.c]
3610 no trailing "\n" for log functions; ok djm@
8c4bd764 3611 - stevesk@cvs.openbsd.org 2005/10/14 02:29:37
3612 [channels.c clientloop.c]
3613 free()->xfree(); ok djm@
ed82a2a9 3614 - stevesk@cvs.openbsd.org 2005/10/15 15:28:12
3615 [sshconnect.c]
3616 make external definition static; ok deraadt@
7238b6e4 3617 - stevesk@cvs.openbsd.org 2005/10/17 13:45:05
3618 [dns.c]
3619 fix memory leaks from 2 sources:
3620 1) key_fingerprint_raw()
3621 2) malloc in dns_read_rdata()
3622 ok jakob@
3623 - stevesk@cvs.openbsd.org 2005/10/17 14:01:28
3624 [dns.c]
3625 remove #ifdef LWRES; ok jakob@
8374cf6f 3626 - stevesk@cvs.openbsd.org 2005/10/17 14:13:35
3627 [dns.c dns.h]
3628 more cleanups; ok jakob@
6b0b0d65 3629 - djm@cvs.openbsd.org 2005/10/30 01:23:19
3630 [ssh_config.5]
3631 mention control socket fallback behaviour, reported by
3632 tryponraj AT gmail.com
2995db03 3633 - djm@cvs.openbsd.org 2005/10/30 04:01:03
3634 [ssh-keyscan.c]
3635 make ssh-keygen discard junk from server before SSH- ident, spotted by
3636 dave AT cirt.net; ok dtucker@
aa9bc1de 3637 - djm@cvs.openbsd.org 2005/10/30 04:03:24
3638 [ssh.c]
3639 fix misleading debug message; ok dtucker@
3a85986d 3640 - dtucker@cvs.openbsd.org 2005/10/30 08:29:29
3641 [canohost.c sshd.c]
3642 Check for connections with IP options earlier and drop silently. ok djm@
db98627d 3643 - jmc@cvs.openbsd.org 2005/10/30 08:43:47
3644 [ssh_config.5]
3645 remove trailing whitespace;
7b9b0103 3646 - djm@cvs.openbsd.org 2005/10/30 08:52:18
3647 [clientloop.c packet.c serverloop.c session.c ssh-agent.c ssh-keygen.c]
3648 [ssh.c sshconnect.c sshconnect1.c sshd.c]
3649 no need to escape single quotes in comments, no binary change
bdd3b323 3650 - dtucker@cvs.openbsd.org 2005/10/31 06:15:04
3651 [sftp.c]
3652 Fix sorting with "ls -1" command. From Robert Tsai, "looks right" deraadt@
882c9d5a 3653 - djm@cvs.openbsd.org 2005/10/31 11:12:49
3654 [ssh-keygen.1 ssh-keygen.c]
3655 generate a protocol 2 RSA key by default
6af12d46 3656 - djm@cvs.openbsd.org 2005/10/31 11:48:29
3657 [serverloop.c]
3658 make sure we clean up wtmp, etc. file when we receive a SIGTERM,
3659 SIGINT or SIGQUIT when running without privilege separation (the
3660 normal privsep case is already OK). Patch mainly by dtucker@ and
3661 senthilkumar_sen AT hotpop.com; ok dtucker@
3543c5e1 3662 - jmc@cvs.openbsd.org 2005/10/31 19:55:25
3663 [ssh-keygen.1]
3664 grammar;
0bbbf2a4 3665 - dtucker@cvs.openbsd.org 2005/11/03 13:38:29
3666 [canohost.c]
3667 Cache reverse lookups with and without DNS separately; ok markus@
47e5dc72 3668 - djm@cvs.openbsd.org 2005/11/04 05:15:59
3669 [kex.c kex.h kexdh.c kexdhc.c kexdhs.c kexgex.c kexgexc.c kexgexs.c]
3670 remove hardcoded hash lengths in key exchange code, allowing
3671 implementation of KEX methods with different hashes (e.g. SHA-256);
3672 ok markus@ dtucker@ stevesk@
27e3ef36 3673 - djm@cvs.openbsd.org 2005/11/05 05:01:15
3674 [bufaux.c]
3675 Fix leaks in error paths, bz #1109 and #1110 reported by kremenek AT
3676 cs.stanford.edu; ok dtucker@
e557f3b5 3677 - (dtucker) [README.platform] Add PAM section.
ebb049f1 3678 - (djm) [openbsd-compat/getrrsetbyname.c] Sync to latest OpenBSD version,
3679 resolving memory leak bz#1111 reported by kremenek AT cs.stanford.edu;
3680 ok dtucker@
255d3e00 3681
bd2a0801 368220051102
3683 - (dtucker) [openbsd-compat/bsd-misc.c] Bug #1108: fix broken strdup().
3684 Reported by olavi at ipunplugged.com and antoine.brodin at laposte.net
3685 via FreeBSD.
3686
5097eaa9 368720051030
3688 - (djm) [contrib/suse/openssh.spec contrib/suse/rc.
3689 sshd contrib/suse/sysconfig.ssh] Bug #1106: Updated SuSE spec and init
3690 files from imorgan AT nas.nasa.gov
0a61a240 3691 - (dtucker) [session.c] Bug #1045do not check /etc/nologin when PAM is
3692 enabled, instead allow PAM to handle it. Note that on platforms using PAM,
3693 the pam_nologin module should be added to sshd's session stack in order to
3694 maintain exising behaviour. Based on patch and discussion from t8m at
3695 centrum.cz, ok djm@
5097eaa9 3696
90f15776 369720051025
3698 - (dtucker) [configure.ac] Relocate LLONG_MAX calculation to after the
3699 sizeof(long long) checks, to make fixing bug #1104 easier (no changes
3700 yet).
d75dfaa6 3701 - (dtucker) [configure.ac] Bug #1104: Tru64's printf family doesn't
3702 understand "%lld", even though the compiler has "long long", so handle
3703 it as a special case. Patch tested by mcaskill.scott at epa.gov.
b8bc9d84 3704 - (dtucker) [contrib/cygwin/ssh-user-config] Remove duplicate yes/no
3705 prompt. Patch from vinschen at redhat.com.
90f15776 3706
b0e7249f 370720051017
3708 - (dtucker) [configure.ac] Bug #1097: Fix configure for cross-compiling.
3709 /etc/default/login report and testing from aabaker at iee.org, corrections
3710 from tim@.
3711
8034a348 371220051009
3713 - (dtucker) [configure.ac defines.h openbsd-compat/vis.{c,h}] Sync current
3714 versions from OpenBSD. ok djm@
3715
83f987c3 371620051008
3717 - (dtucker) [configure.ac] Bug #1098: define $MAIL for HP-UX; report from
3718 brian.smith at agilent com.
1012885d 3719 - (djm) [configure.ac] missing 'test' call for -with-Werror test
83f987c3 3720
278f9900 372120051005
3722 - (dtucker) [configure.ac sshd.8] Enable locked account check (a prepended
3723 "*LOCKED*" string) for FreeBSD. Patch jeremie at le-hen.org and
3724 senthilkumar_sen at hotpop.com.
3725
59e5aff5 372620051003
3727 - (dtucker) OpenBSD CVS Sync
3728 - markus@cvs.openbsd.org 2005/09/07 08:53:53
3729 [channels.c]
3730 enforce chanid != NULL; ok djm
b5443199 3731 - markus@cvs.openbsd.org 2005/09/09 19:18:05
3732 [clientloop.c]
3733 typo; from mark at mcs.vuw.ac.nz, bug #1082
fd6168c1 3734 - djm@cvs.openbsd.org 2005/09/13 23:40:07
3735 [sshd.c ssh.c misc.h sftp.c ssh-keygen.c ssh-keysign.c sftp-server.c
3736 scp.c misc.c ssh-keyscan.c ssh-add.c ssh-agent.c]
3737 ensure that stdio fds are attached; ok deraadt@
5ddc5eb4 3738 - djm@cvs.openbsd.org 2005/09/19 11:37:34
3739 [ssh_config.5 ssh.1]
3740 mention ability to specify bind_address for DynamicForward and -D options;
3741 bz#1077 spotted by Haruyama Seigo
d77dd4d7 3742 - djm@cvs.openbsd.org 2005/09/19 11:47:09
3743 [sshd.c]
3744 stop connection abort on rekey with delayed compression enabled when
3745 post-auth privsep is disabled (e.g. when root is logged in); ok dtucker@
67003554 3746 - djm@cvs.openbsd.org 2005/09/19 11:48:10
3747 [gss-serv.c]
3748 typo
37c406a8 3749 - jmc@cvs.openbsd.org 2005/09/19 15:38:27
3750 [ssh.1]
3751 some more .Bk/.Ek to avoid ugly line split;
80e29ee6 3752 - jmc@cvs.openbsd.org 2005/09/19 15:42:44
3753 [ssh.c]
3754 update -D usage here too;
2915e42b 3755 - djm@cvs.openbsd.org 2005/09/19 23:31:31
3756 [ssh.1]
3757 spelling nit from stevesk@
0d3d1077 3758 - djm@cvs.openbsd.org 2005/09/21 23:36:54
3759 [sshd_config.5]
3760 aquire -> acquire, from stevesk@
ae25711b 3761 - djm@cvs.openbsd.org 2005/09/21 23:37:11
3762 [sshd.c]
3763 change label at markus@'s request
8f921a4a 3764 - jaredy@cvs.openbsd.org 2005/09/30 20:34:26
3765 [ssh-keyscan.1]
3766 deploy .An -nosplit; ok jmc
d2130e1f 3767 - dtucker@cvs.openbsd.org 2005/10/03 07:44:42
3768 [canohost.c]
3769 Relocate check_ip_options call to prevent logging of garbage for
3770 connections with IP options set. bz#1092 from David Leonard,
3771 "looks good" deraadt@
1172d361 3772 - (dtucker) [regress/README.regress] Bug #989: Document limitation that scp
3773 is required in the system path for the multiplex test to work.
59e5aff5 3774
bfd17430 377520050930
3776 - (dtucker) [openbsd-compat/openbsd-compat.h] Bug #1096: Add prototype
3777 for strtoll. Patch from o.flebbe at science-computing.de.
cfb60d3a 3778 - (dtucker) [monitor.c] Bug #1087: Send loginmsg to preauth privsep
3779 child during PAM account check without clearing it. This restores the
3780 post-login warnings such as LDAP password expiry. Patch from Tomas Mraz
3781 with help from several others.
bfd17430 3782
140da888 378320050929
3784 - (dtucker) [monitor_wrap.c] Remove duplicate definition of loginmsg
3785 introduced during sync.
3786
4ebacf50 378720050928
3788 - (dtucker) [entropy.c] Use u_char for receiving RNG seed for consistency.
cafa6a80 3789 - (dtucker) [auth-pam.c] Bug #1028: send final non-query messages from
3790 PAM via keyboard-interactive. Patch tested by the folks at Vintela.
4ebacf50 3791
759ab0d9 379220050927
3793 - (dtucker) [entropy.c] Remove unnecessary tests for getuid and geteuid
3794 calls, since they can't possibly fail. ok djm@
72f02ae7 3795 - (dtucker) [entropy.c entropy.h sshd.c] Pass RNG seed to the reexec'ed
3796 process when sshd relies on ssh-random-helper. Should result in faster
3797 logins on systems without a real random device or prngd. ok djm@
759ab0d9 3798
b6c37221 379920050924
3800 - (dtucker) [auth2.c] Move start_pam() calls out of if-else block to remove
3801 duplicate call. ok djm@
3802
bb116c8e 380320050922
3804 - (dtucker) [configure.ac] Use -R linker flag for libedit too; patch from
3805 skeleten at shillest.net.
e47fb473 3806 - (dtucker) [configure.ac] Fix help for --with-opensc; patch from skeleten at
3807 shillest.net.
bb116c8e 3808
3466e002 380920050919
3810 - (tim) [aclocal.m4 configure.ac] Delete acconfig.h and add templates to
3811 AC_DEFINE and AC_DEFINE_UNQUOTED to quiet autoconf 2.59 warning messages.
f666dcfa 3812 ok dtucker@
3466e002 3813
f5555364 381420050912
3815 - (tim) [configure.ac] Bug 1078. Fix --without-kerberos5. Reported by
3816 Mike Frysinger.
3817
d2a3abef 381820050908
3819 - (tim) [defines.h openbsd-compat/port-uw.c] Add long password support to
3820 OpenServer 6 and add osr5bigcrypt support so when someone migrates
3821 passwords between UnixWare and OpenServer they will still work. OK dtucker@
3822
0b202697 3823$Id$
git-cvsimport mirror of OpenSSH
This page took 1.178336 seconds and 5 git commands to generate.