+20080612
+ - (dtucker) OpenBSD CVS Sync
+ - jmc@cvs.openbsd.org 2008/06/11 07:30:37
+ [sshd.8]
+ kill trailing whitespace;
+ - grunk@cvs.openbsd.org 2008/06/11 21:01:35
+ [ssh_config.5 key.h readconf.c readconf.h ssh-keygen.1 ssh-keygen.c key.c
+ sshconnect.c]
+ Introduce SSH Fingerprint ASCII Visualization, a technique inspired by the
+ graphical hash visualization schemes known as "random art", and by
+ Dan Kaminsky's musings on the subject during a BlackOp talk at the
+ 23C3 in Berlin.
+ Scientific publication (original paper):
+ "Hash Visualization: a New Technique to improve Real-World Security",
+ Perrig A. and Song D., 1999, International Workshop on Cryptographic
+ Techniques and E-Commerce (CrypTEC '99)
+ http://sparrow.ece.cmu.edu/~adrian/projects/validation/validation.pdf
+ The algorithm used here is a worm crawling over a discrete plane,
+ leaving a trace (augmenting the field) everywhere it goes.
+ Movement is taken from dgst_raw 2bit-wise. Bumping into walls
+ makes the respective movement vector be ignored for this turn,
+ thus switching to the other color of the chessboard.
+ Graphs are not unambiguous for now, because circles in graphs can be
+ walked in either direction.
+ discussions with several people,
+ help, corrections and ok markus@ djm@
+ - grunk@cvs.openbsd.org 2008/06/11 21:38:25
+ [ssh-keygen.c]
+ ssh-keygen -lv -f /etc/ssh/ssh_host_rsa_key.pub
+ would not display you the random art as intended, spotted by canacar@
+ - grunk@cvs.openbsd.org 2008/06/11 22:20:46
+ [ssh-keygen.c ssh-keygen.1]
+ ssh-keygen would write fingerprints to STDOUT, and random art to STDERR,
+ that is not how it was envisioned.
+ Also correct manpage saying that -v is needed along with -l for it to work.
+ spotted by naddy@
+ - otto@cvs.openbsd.org 2008/06/11 23:02:22
+ [key.c]
+ simpler way of computing the augmentations; ok grunk@
+ - grunk@cvs.openbsd.org 2008/06/11 23:03:56
+ [ssh_config.5]
+ CheckHostIP set to ``fingerprint'' will display both hex and random art
+ spotted by naddy@
+
+20080611
+ - (djm) [channels.c configure.ac]
+ Do not set SO_REUSEADDR on wildcard X11 listeners (X11UseLocalhost=no)
+ bz#1464; ok dtucker
+
+20080610
+ - (dtucker) OpenBSD CVS Sync
+ - djm@cvs.openbsd.org 2008/06/10 03:57:27
+ [servconf.c match.h sshd_config.5]
+ support CIDR address matching in sshd_config "Match address" blocks, with
+ full support for negation and fall-back to classic wildcard matching.
+ For example:
+ Match address 192.0.2.0/24,3ffe:ffff::/32,!10.*
+ PasswordAuthentication yes
+ addrmatch.c code mostly lifted from flowd's addr.c
+ feedback and ok dtucker@
+ - djm@cvs.openbsd.org 2008/06/10 04:17:46
+ [sshd_config.5]
+ better reference for pattern-list
+ - dtucker@cvs.openbsd.org 2008/06/10 04:50:25
+ [sshd.c channels.h channels.c log.c servconf.c log.h servconf.h sshd.8]
+ Add extended test mode (-T) and connection parameters for test mode (-C).
+ -T causes sshd to write its effective configuration to stdout and exit.
+ -C causes any relevant Match rules to be applied before output. The
+ combination allows tesing of the parser and config files. ok deraadt djm
+ - jmc@cvs.openbsd.org 2008/06/10 07:12:00
+ [sshd_config.5]
+ tweak previous;
+ - jmc@cvs.openbsd.org 2008/06/10 08:17:40
+ [sshd.8 sshd.c]
+ - update usage()
+ - fix SYNOPSIS, and sort options
+ - some minor additional fixes
+ - dtucker@cvs.openbsd.org 2008/06/09 18:06:32
+ [regress/test-exec.sh]
+ Don't generate putty keys if we're not going to use them. ok djm
+ - dtucker@cvs.openbsd.org 2008/06/10 05:23:32
+ [regress/addrmatch.sh regress/Makefile]
+ Regress test for Match CIDR rules. ok djm@
+ - dtucker@cvs.openbsd.org 2008/06/10 15:21:41
+ [test-exec.sh]
+ Use a more portable construct for checking if we're running a putty test
+ - dtucker@cvs.openbsd.org 2008/06/10 15:28:49
+ [test-exec.sh]
+ Add quotes
+ - dtucker@cvs.openbsd.org 2008/06/10 18:21:24
+ [ssh_config.5]
+ clarify that Host patterns are space-separated. ok deraadt
+ - djm@cvs.openbsd.org 2008/06/10 22:15:23
+ [PROTOCOL ssh.c serverloop.c]
+ Add a no-more-sessions@openssh.com global request extension that the
+ client sends when it knows that it will never request another session
+ (i.e. when session multiplexing is disabled). This allows a server to
+ disallow further session requests and terminate the session.
+ Why would a non-multiplexing client ever issue additional session
+ requests? It could have been attacked with something like SSH'jack:
+ http://www.storm.net.nz/projects/7
+ feedback & ok markus
+ - djm@cvs.openbsd.org 2008/06/10 23:06:19
+ [auth-options.c match.c servconf.c addrmatch.c sshd.8]
+ support CIDR address matching in .ssh/authorized_keys from="..." stanzas
+ ok and extensive testing dtucker@
+ - dtucker@cvs.openbsd.org 2008/06/10 23:21:34
+ [bufaux.c]
+ Use '\0' for a nul byte rather than unadorned 0. ok djm@
+ - dtucker@cvs.openbsd.org 2008/06/10 23:13:43
+ [Makefile regress/key-options.sh]
+ Add regress test for key options. ok djm@
+ - (dtucker) [openbsd-compat/fake-rfc2553.h] Add sin6_scope_id to sockaddr_in6
+ since the new CIDR code in addmatch.c references it.
+ - (dtucker) [Makefile.in configure.ac regress/addrmatch.sh] Skip IPv6
+ specific tests on platforms that don't do IPv6.
+ - (dtucker) [Makefile.in] Define TEST_SSH_IPV6 in make's arguments as well
+ as environment.
+ - (dtucker) [Makefile.in] Move addrmatch.o to libssh.a where it's needed now.
+
+20080609
+ - (dtucker) OpenBSD CVS Sync
+ - dtucker@cvs.openbsd.org 2008/06/08 17:04:41
+ [sftp-server.c]
+ Add case for ENOSYS in errno_to_portable; ok deraadt
+ - dtucker@cvs.openbsd.org 2008/06/08 20:15:29
+ [sftp.c sftp-client.c sftp-client.h]
+ Have the sftp client store the statvfs replies in wire format,
+ which prevents problems when the server's native sizes exceed the
+ client's.
+ Also extends the sizes of the remaining 32bit wire format to 64bit,
+ they're specified as unsigned long in the standard.
+ - dtucker@cvs.openbsd.org 2008/06/09 13:02:39
+ [sftp-server.c]
+ Extend 32bit -> 64bit values for statvfs extension missed in previous
+ commit.
+ - dtucker@cvs.openbsd.org 2008/06/09 13:38:46
+ [PROTOCOL]
+ Use a $OpenBSD tag so our scripts will sync changes.
+
+20080608
+ - (dtucker) [configure.ac defines.h sftp-client.c sftp-server.c sftp.c
+ openbsd-compat/Makefile.in openbsd-compat/openbsd-compat.h
+ openbsd-compat/bsd-statvfs.{c,h}] Add a null implementation of statvfs and
+ fstatvfs and remove #defines around statvfs code. ok djm@
+ - (dtucker) [configure.ac defines.h sftp-client.c M sftp-server.c] Add a
+ macro to convert fsid to unsigned long for platforms where fsid is a
+ 2-member array.
+
+20080607
+ - (dtucker) [mux.c] Include paths.h inside ifdef HAVE_PATHS_H.
+ - (dtucker) [configure.ac defines.h sftp-client.c sftp-server.c sftp.c]
+ Do not enable statvfs extensions on platforms that do not have statvfs.
+ - (dtucker) OpenBSD CVS Sync
+ - djm@cvs.openbsd.org 2008/05/19 06:14:02
+ [packet.c] unbreak protocol keepalive timeouts bz#1465; ok dtucker@
+ - djm@cvs.openbsd.org 2008/05/19 15:45:07
+ [sshtty.c ttymodes.c sshpty.h]
+ Fix sending tty modes when stdin is not a tty (bz#1199). Previously
+ we would send the modes corresponding to a zeroed struct termios,
+ whereas we should have been sending an empty list of modes.
+ Based on patch from daniel.ritz AT alcatel.ch; ok dtucker@ markus@
+ - djm@cvs.openbsd.org 2008/05/19 15:46:31
+ [ssh-keygen.c]
+ support -l (print fingerprint) in combination with -F (find host) to
+ search for a host in ~/.ssh/known_hosts and display its fingerprint;
+ ok markus@
+ - djm@cvs.openbsd.org 2008/05/19 20:53:52
+ [clientloop.c]
+ unbreak tree by committing this bit that I missed from:
+ Fix sending tty modes when stdin is not a tty (bz#1199). Previously
+ we would send the modes corresponding to a zeroed struct termios,
+ whereas we should have been sending an empty list of modes.
+ Based on patch from daniel.ritz AT alcatel.ch; ok dtucker@ markus@
+
+20080604
+ - (djm) [openbsd-compat/bsd-arc4random.c] Fix math bug that caused bias
+ in arc4random_uniform with upper_bound in (2^30,2*31). Note that
+ OpenSSH did not make requests with upper bounds in this range.
+
+20080519
+ - (djm) [configure.ac mux.c sftp.c openbsd-compat/Makefile.in]
+ [openbsd-compat/fmt_scaled.c openbsd-compat/openbsd-compat.h]
+ Fix compilation on Linux, including pulling in fmt_scaled(3)
+ implementation from OpenBSD's libutil.
+
20080518
- (djm) OpenBSD CVS Sync
- djm@cvs.openbsd.org 2008/04/04 05:14:38
making the function names more consistent - making ssh.c and
clientloop.c a fair bit more readable.
ok markus@
+ - djm@cvs.openbsd.org 2008/05/09 14:26:08
+ [ssh.c]
+ dingo stole my diff hunk
+ - markus@cvs.openbsd.org 2008/05/09 16:16:06
+ [session.c]
+ re-add the USE_PIPES code and enable it.
+ without pipes shutdown-read from the sshd does not trigger
+ a SIGPIPE when the forked program does a write.
+ ok djm@
+ (Id sync only, USE_PIPES never left portable OpenSSH)
+ - markus@cvs.openbsd.org 2008/05/09 16:17:51
+ [channels.c]
+ error-fd race: don't enable the error fd in the select bitmask
+ for channels with both in- and output closed, since the channel
+ will go away before we call select();
+ report, lots of debugging help and ok djm@
+ - markus@cvs.openbsd.org 2008/05/09 16:21:13
+ [channels.h clientloop.c nchan.c serverloop.c]
+ unbreak
+ ssh -2 localhost od /bin/ls | true
+ ignoring SIGPIPE by adding a new channel message (EOW) that signals
+ the peer that we're not interested in any data it might send.
+ fixes bz #85; discussion, debugging and ok djm@
+ - pvalchev@cvs.openbsd.org 2008/05/12 20:52:20
+ [umac.c]
+ Ensure nh_result lies on a 64-bit boundary (fixes warnings observed
+ on Itanium on Linux); from Dale Talcott (bug #1462); ok djm@
+ - djm@cvs.openbsd.org 2008/05/15 23:52:24
+ [nchan2.ms]
+ document eow message in ssh protocol 2 channel state machine;
+ feedback and ok markus@
+ - djm@cvs.openbsd.org 2008/05/18 21:29:05
+ [sftp-server.c]
+ comment extension announcement
+ - djm@cvs.openbsd.org 2008/05/16 08:30:42
+ [PROTOCOL]
+ document our protocol extensions and deviations; ok markus@
+ - djm@cvs.openbsd.org 2008/05/17 01:31:56
+ [PROTOCOL]
+ grammar and correctness fixes from stevesk@
20080403
- (djm) [openbsd-compat/bsd-poll.c] Include stdlib.h to avoid compile-
andersk / openssh.git / blobdiff