+20060818
+ - (dtucker) [configure.ac openbsd-compat/bsd-closefrom.c] Resync with
+ closefrom.c from sudo.
+ - (dtucker) [openbsd-compat/bsd-closefrom.c] Comment out rcsid.
+ - (dtucker) [openbsd-compat/regress/snprintftest.c] Newline on error.
+ - (dtucker) [openbsd-compat/regress/Makefile.in] Use implicit rules for the
+ test progs instead; they work better than what we have.
+ - (djm) OpenBSD CVS Sync
+ - stevesk@cvs.openbsd.org 2006/08/06 01:13:32
+ [compress.c monitor.c monitor_wrap.c]
+ "zlib.h" can be <zlib.h>; ok djm@ markus@
+
+20060817
+ - (dtucker) [openbsd-compat/fake-rfc2553.c openbsd-compat/setproctitle.c]
+ Include stdlib.h for malloc and friends.
+ - (dtucker) [configure.ac openbsd-compat/bsd-closefrom.c] Use F_CLOSEM fcntl
+ for closefrom() on AIX. Pointed out by William Ahern.
+ - (dtucker) [openbsd-compat/regress/{Makefile.in,closefromtest.c}] Regress
+ test for closefrom() in compat code.
+
+20060816
+ - (djm) [audit-bsm.c] Sprinkle in some headers
+
+20060815
+ - (dtucker) [LICENCE] Add Reyk to the list for the compat dir.
+
+20060806
+ - (djm) [openbsd-compat/bsd-getpeereid.c] Add some headers to quiet warnings
+ on Solaris 10
+
+20060806
+ - (dtucker) [defines.h] With the includes.h changes we no longer get the
+ name clash on "YES" so we can remove the workaround for it.
+ - (dtucker) [openbsd-compat/{bsd-asprintf.c,bsd-openpty.c,bsd-snprintf.c,
+ glob.c}] Include stdlib.h for malloc and friends in compat code.
+
+20060805
+ - (djm) OpenBSD CVS Sync
+ - stevesk@cvs.openbsd.org 2006/07/24 13:58:22
+ [sshconnect.c]
+ disable tunnel forwarding when no strict host key checking
+ and key changed; ok djm@ markus@ dtucker@
+ - stevesk@cvs.openbsd.org 2006/07/25 02:01:34
+ [scard.c]
+ need #include <string.h>
+ - stevesk@cvs.openbsd.org 2006/07/25 02:59:21
+ [channels.c clientloop.c packet.c scp.c serverloop.c sftp-client.c]
+ [sftp-server.c ssh-agent.c ssh-keyscan.c sshconnect.c sshd.c]
+ move #include <sys/time.h> out of includes.h
+ - stevesk@cvs.openbsd.org 2006/07/26 02:35:17
+ [atomicio.c auth.c dh.c authfile.c buffer.c clientloop.c kex.c]
+ [groupaccess.c gss-genr.c kexgexs.c misc.c monitor.c monitor_mm.c]
+ [packet.c scp.c serverloop.c session.c sftp-client.c sftp-common.c]
+ [sftp-server.c sftp.c ssh-add.c ssh-agent.c ssh-keygen.c sshlogin.c]
+ [uidswap.c xmalloc.c]
+ move #include <sys/param.h> out of includes.h
+ - stevesk@cvs.openbsd.org 2006/07/26 13:57:17
+ [authfd.c authfile.c dh.c canohost.c channels.c clientloop.c compat.c]
+ [hostfile.c kex.c log.c misc.c moduli.c monitor.c packet.c readpass.c]
+ [scp.c servconf.c session.c sftp-server.c sftp.c ssh-add.c ssh-agent.c]
+ [ssh-keygen.c ssh-keyscan.c ssh-keysign.c ssh.c sshconnect.c]
+ [sshconnect1.c sshd.c xmalloc.c]
+ move #include <stdlib.h> out of includes.h
+ - jmc@cvs.openbsd.org 2006/07/27 08:00:50
+ [ssh_config.5]
+ avoid confusing wording in HashKnownHosts:
+ originally spotted by alan amesbury;
+ ok deraadt
+ - jmc@cvs.openbsd.org 2006/07/27 08:00:50
+ [ssh_config.5]
+ avoid confusing wording in HashKnownHosts:
+ originally spotted by alan amesbury;
+ ok deraadt
+ - dtucker@cvs.openbsd.org 2006/08/01 11:34:36
+ [sshconnect.c]
+ Allow fallback to known_hosts entries without port qualifiers for
+ non-standard ports too, so that all existing known_hosts entries will be
+ recognised. Requested by, feedback and ok markus@
+ - stevesk@cvs.openbsd.org 2006/08/01 23:22:48
+ [auth-passwd.c auth-rhosts.c auth-rsa.c auth.c auth.h auth1.c]
+ [auth2-chall.c auth2-pubkey.c authfile.c buffer.c canohost.c]
+ [channels.c clientloop.c dh.c dns.c dns.h hostfile.c kex.c kexdhc.c]
+ [kexgexc.c kexgexs.c key.c key.h log.c misc.c misc.h moduli.c]
+ [monitor_wrap.c packet.c progressmeter.c readconf.c readpass.c scp.c]
+ [servconf.c session.c sftp-client.c sftp-common.c sftp-server.c sftp.c]
+ [ssh-add.c ssh-agent.c ssh-keygen.c ssh-keyscan.c ssh.c sshconnect.c]
+ [sshconnect1.c sshconnect2.c sshd.c sshlogin.c sshtty.c uuencode.c]
+ [uuencode.h xmalloc.c]
+ move #include <stdio.h> out of includes.h
+ - stevesk@cvs.openbsd.org 2006/08/01 23:36:12
+ [authfile.c channels.c progressmeter.c scard.c servconf.c ssh.c]
+ clean extra spaces
+ - deraadt@cvs.openbsd.org 2006/08/03 03:34:42
+ [OVERVIEW atomicio.c atomicio.h auth-bsdauth.c auth-chall.c auth-krb5.c]
+ [auth-options.c auth-options.h auth-passwd.c auth-rh-rsa.c auth-rhosts.c]
+ [auth-rsa.c auth-skey.c auth.c auth.h auth1.c auth2-chall.c auth2-gss.c]
+ [auth2-hostbased.c auth2-kbdint.c auth2-none.c auth2-passwd.c ]
+ [auth2-pubkey.c auth2.c authfd.c authfd.h authfile.c bufaux.c bufbn.c]
+ [buffer.c buffer.h canohost.c channels.c channels.h cipher-3des1.c]
+ [cipher-bf1.c cipher-ctr.c cipher.c cleanup.c clientloop.c compat.c]
+ [compress.c deattack.c dh.c dispatch.c dns.c dns.h fatal.c groupaccess.c]
+ [groupaccess.h gss-genr.c gss-serv-krb5.c gss-serv.c hostfile.c kex.c]
+ [kex.h kexdh.c kexdhc.c kexdhs.c kexgex.c kexgexc.c kexgexs.c key.c]
+ [key.h log.c log.h mac.c match.c md-sha256.c misc.c misc.h moduli.c]
+ [monitor.c monitor_fdpass.c monitor_mm.c monitor_mm.h monitor_wrap.c]
+ [monitor_wrap.h msg.c nchan.c packet.c progressmeter.c readconf.c]
+ [readconf.h readpass.c rsa.c scard.c scard.h scp.c servconf.c servconf.h]
+ [serverloop.c session.c session.h sftp-client.c sftp-common.c]
+ [sftp-common.h sftp-glob.c sftp-server.c sftp.c ssh-add.c ssh-agent.c]
+ [ssh-dss.c ssh-gss.h ssh-keygen.c ssh-keyscan.c ssh-keysign.c ssh-rsa.c]
+ [ssh.c ssh.h sshconnect.c sshconnect.h sshconnect1.c sshconnect2.c]
+ [sshd.c sshlogin.c sshlogin.h sshpty.c sshpty.h sshtty.c ttymodes.c]
+ [uidswap.c uidswap.h uuencode.c uuencode.h xmalloc.c xmalloc.h]
+ [loginrec.c loginrec.h openbsd-compat/port-aix.c openbsd-compat/port-tun.h]
+ almost entirely get rid of the culture of ".h files that include .h files"
+ ok djm, sort of ok stevesk
+ makes the pain stop in one easy step
+ NB. portable commit contains everything *except* removing includes.h, as
+ that will take a fair bit more work as we move headers that are required
+ for portability workarounds to defines.h. (also, this step wasn't "easy")
+ - stevesk@cvs.openbsd.org 2006/08/04 20:46:05
+ [monitor.c session.c ssh-agent.c]
+ spaces
+ - (djm) [auth-pam.c defines.h] Move PAM related bits to auth-pam.c
+ - (djm) [auth-pam.c auth.c bufaux.h entropy.c openbsd-compat/port-tun.c]
+ remove last traces of bufaux.h - it was merged into buffer.h in the big
+ includes.h commit
+ - (djm) [auth.c loginrec.c] Missing netinet/in.h for loginrec
+ - (djm) [openbsd-compat/regress/snprintftest.c]
+ [openbsd-compat/regress/strduptest.c] Add missing includes so they pass
+ compilation with "-Wall -Werror"
+ - (djm) [auth-pam.c auth-shadow.c auth2-none.c cleanup.c sshd.c]
+ [openbsd-compat/port-tun.c openbsd-compat/port-tun.h] Sprinkle more
+ includes for Linux in
+ - (dtucker) [cleanup.c] Need defines.h for __dead.
+ - (dtucker) [auth2-gss.c] We still need the #ifdef GSSAPI in -portable.
+ - (dtucker) [openbsd-compat/{bsd-arc4random.c,port-tun.c,xmmap.c}] Lots of
+ #include stdarg.h, needed for log.h.
+ - (dtucker) [entropy.c] Needs unistd.h too.
+ - (dtucker) [ssh-rand-helper.c] Needs stdarg.h for log.h.
+ - (dtucker) [openbsd-compat/getrrsetbyname.c] Nees stdlib.h for malloc.
+ - (dtucker) [openbsd-compat/strtonum.c] Include stdlib.h for strtoll,
+ otherwise it is implicitly declared as returning an int.
+ - (dtucker) OpenBSD CVS Sync
+ - dtucker@cvs.openbsd.org 2006/08/05 07:52:52
+ [auth2-none.c sshd.c monitor_wrap.c]
+ Add headers required to build with KERBEROS5=no. ok djm@
+ - dtucker@cvs.openbsd.org 2006/08/05 08:00:33
+ [auth-skey.c]
+ Add headers required to build with -DSKEY. ok djm@
+ - dtucker@cvs.openbsd.org 2006/08/05 08:28:24
+ [monitor_wrap.c auth-skey.c auth2-chall.c]
+ Zap unused variables in -DSKEY code. ok djm@
+ - dtucker@cvs.openbsd.org 2006/08/05 08:34:04
+ [packet.c]
+ Typo in comment
+ - (dtucker) [openbsd-compat/bsd-cygwin_util.c] Add headers required to compile
+ on Cygwin.
+ - (dtucker) [openbsd-compat/fake-rfc2553.c] Add headers needed for inet_ntoa.
+ - (dtucker) [auth-skey.c] monitor_wrap.h needs ssh-gss.h.
+ - (dtucker) [audit.c audit.h] Repair headers.
+ - (dtucker) [audit-bsm.c] Add additional headers now required.
+
+20060804
+ - (dtucker) [configure.ac] The "crippled AES" test does not work on recent
+ versions of Solaris, so use AC_LINK_IFELSE to actually link the test program
+ rather than just compiling it. Spotted by dlg@.
+
+20060802
+ - (dtucker) [openbsd-compat/daemon.c] Add unistd.h for fork() prototype.
+
+20060725
+ - (dtucker) [openbsd-compat/xmmap.c] Need fcntl.h for O_RDRW.
+
+20060724
+ - (djm) OpenBSD CVS Sync
+ - jmc@cvs.openbsd.org 2006/07/12 13:39:55
+ [sshd_config.5]
+ - new sentence, new line
+ - s/The the/The/
+ - kill a bad comma
+ - stevesk@cvs.openbsd.org 2006/07/12 22:28:52
+ [auth-options.c canohost.c channels.c includes.h readconf.c]
+ [servconf.c ssh-keyscan.c ssh.c sshconnect.c sshd.c]
+ move #include <netdb.h> out of includes.h; ok djm@
+ - stevesk@cvs.openbsd.org 2006/07/12 22:42:32
+ [includes.h ssh.c ssh-rand-helper.c]
+ move #include <stddef.h> out of includes.h
+ - stevesk@cvs.openbsd.org 2006/07/14 01:15:28
+ [monitor_wrap.h]
+ don't need incompletely-typed 'struct passwd' now with
+ #include <pwd.h>; ok markus@
+ - stevesk@cvs.openbsd.org 2006/07/17 01:31:10
+ [authfd.c authfile.c channels.c cleanup.c clientloop.c groupaccess.c]
+ [includes.h log.c misc.c msg.c packet.c progressmeter.c readconf.c]
+ [readpass.c scp.c servconf.c sftp-client.c sftp-server.c sftp.c]
+ [ssh-add.c ssh-agent.c ssh-keygen.c ssh-keyscan.c ssh-keysign.c ssh.c]
+ [sshconnect.c sshlogin.c sshpty.c uidswap.c]
+ move #include <unistd.h> out of includes.h
+ - dtucker@cvs.openbsd.org 2006/07/17 12:02:24
+ [auth-options.c]
+ Use '\0' rather than 0 to terminates strings; ok djm@
+ - dtucker@cvs.openbsd.org 2006/07/17 12:06:00
+ [channels.c channels.h servconf.c sshd_config.5]
+ Add PermitOpen directive to sshd_config which is equivalent to the
+ "permitopen" key option. Allows server admin to allow TCP port
+ forwarding only two specific host/port pairs. Useful when combined
+ with Match.
+ If permitopen is used in both sshd_config and a key option, both
+ must allow a given connection before it will be permitted.
+ Note that users can still use external forwarders such as netcat,
+ so to be those must be controlled too for the limits to be effective.
+ Feedback & ok djm@, man page corrections & ok jmc@.
+ - jmc@cvs.openbsd.org 2006/07/18 07:50:40
+ [sshd_config.5]
+ tweak; ok dtucker
+ - jmc@cvs.openbsd.org 2006/07/18 07:56:28
+ [scp.1]
+ replace DIAGNOSTICS with .Ex;
+ - jmc@cvs.openbsd.org 2006/07/18 08:03:09
+ [ssh-agent.1 sshd_config.5]
+ mark up angle brackets;
+ - dtucker@cvs.openbsd.org 2006/07/18 08:22:23
+ [sshd_config.5]
+ Clarify description of Match, with minor correction from jmc@
+ - stevesk@cvs.openbsd.org 2006/07/18 22:27:55
+ [dh.c]
+ remove unneeded includes; ok djm@
+ - dtucker@cvs.openbsd.org 2006/07/19 08:56:41
+ [servconf.c sshd_config.5]
+ Add support for X11Forwaring, X11DisplayOffset and X11UseLocalhost to
+ Match. ok djm@
+ - dtucker@cvs.openbsd.org 2006/07/19 13:07:10
+ [servconf.c servconf.h session.c sshd.8 sshd_config sshd_config.5]
+ Add ForceCommand keyword to sshd_config, equivalent to the "command="
+ key option, man page entry and example in sshd_config.
+ Feedback & ok djm@, man page corrections & ok jmc@
+ - stevesk@cvs.openbsd.org 2006/07/20 15:26:15
+ [auth1.c serverloop.c session.c sshconnect2.c]
+ missed some needed #include <unistd.h> when KERBEROS5=no; issue from
+ massimo@cedoc.mo.it
+ - dtucker@cvs.openbsd.org 2006/07/21 12:43:36
+ [channels.c channels.h servconf.c servconf.h sshd_config.5]
+ Make PermitOpen take a list of permitted ports and act more like most
+ other keywords (ie the first match is the effective setting). This
+ also makes it easier to override a previously set PermitOpen. ok djm@
+ - stevesk@cvs.openbsd.org 2006/07/21 21:13:30
+ [channels.c]
+ more ARGSUSED (lint) for dispatch table-driven functions; ok djm@
+ - stevesk@cvs.openbsd.org 2006/07/21 21:26:55
+ [progressmeter.c]
+ ARGSUSED for signal handler
+ - stevesk@cvs.openbsd.org 2006/07/22 19:08:54
+ [includes.h moduli.c progressmeter.c scp.c sftp-common.c]
+ [sftp-server.c ssh-agent.c sshlogin.c]
+ move #include <time.h> out of includes.h
+ - stevesk@cvs.openbsd.org 2006/07/22 20:48:23
+ [atomicio.c auth-options.c auth-passwd.c auth-rhosts.c auth-rsa.c]
+ [auth.c auth1.c auth2-chall.c auth2-hostbased.c auth2-passwd.c auth2.c]
+ [authfd.c authfile.c bufaux.c bufbn.c buffer.c canohost.c channels.c]
+ [cipher-3des1.c cipher-bf1.c cipher-ctr.c cipher.c clientloop.c]
+ [compat.c deattack.c dh.c dns.c gss-genr.c gss-serv.c hostfile.c]
+ [includes.h kex.c kexdhc.c kexdhs.c kexgexc.c kexgexs.c key.c log.c]
+ [mac.c match.c md-sha256.c misc.c moduli.c monitor.c monitor_fdpass.c]
+ [monitor_mm.c monitor_wrap.c msg.c nchan.c packet.c rsa.c]
+ [progressmeter.c readconf.c readpass.c scp.c servconf.c serverloop.c]
+ [session.c sftp-client.c sftp-common.c sftp-glob.c sftp-server.c sftp.c]
+ [ssh-add.c ssh-agent.c ssh-dss.c ssh-keygen.c ssh-keyscan.c]
+ [ssh-keysign.c ssh-rsa.c ssh.c sshconnect.c sshconnect1.c sshconnect2.c]
+ [sshd.c sshlogin.c sshpty.c ttymodes.c uidswap.c xmalloc.c]
+ move #include <string.h> out of includes.h
+ - stevesk@cvs.openbsd.org 2006/07/23 01:11:05
+ [auth.h dispatch.c kex.h sftp-client.c]
+ #include <signal.h> for sig_atomic_t; need this prior to <sys/param.h>
+ move
+ - (djm) [acss.c auth-krb5.c auth-options.c auth-pam.c auth-shadow.c]
+ [canohost.c channels.c cipher-acss.c defines.h dns.c gss-genr.c]
+ [gss-serv-krb5.c gss-serv.c log.h loginrec.c logintest.c readconf.c]
+ [servconf.c ssh-keygen.c ssh-keyscan.c ssh-keysign.c ssh-rand-helper.c]
+ [ssh.c sshconnect.c sshd.c openbsd-compat/bindresvport.c]
+ [openbsd-compat/bsd-arc4random.c openbsd-compat/bsd-misc.c]
+ [openbsd-compat/getrrsetbyname.c openbsd-compat/glob.c]
+ [openbsd-compat/mktemp.c openbsd-compat/port-linux.c]
+ [openbsd-compat/port-tun.c openbsd-compat/readpassphrase.c]
+ [openbsd-compat/setproctitle.c openbsd-compat/xmmap.c]
+ make the portable tree compile again - sprinkle unistd.h and string.h
+ back in. Don't redefine __unused, as it turned out to be used in
+ headers on Linux, and replace its use in auth-pam.c with ARGSUSED
+ - (djm) [openbsd-compat/glob.c]
+ Move get_arg_max() into the ifdef HAVE_GLOB block so that it compiles
+ on OpenBSD (or other platforms with a decent glob implementation) with
+ -Werror
+ - (djm) [uuencode.c]
+ Add resolv.h, is it contains the prototypes for __b64_ntop/__b64_pton on
+ some platforms
+ - (djm) [session.c]
+ fix compile error with -Werror -Wall: 'path' is only used in
+ do_setup_env() if HAVE_LOGIN_CAP is not defined
+ - (djm) [openbsd-compat/basename.c openbsd-compat/bsd-closefrom.c]
+ [openbsd-compat/bsd-cray.c openbsd-compat/bsd-openpty.c]
+ [openbsd-compat/bsd-snprintf.c openbsd-compat/fake-rfc2553.c]
+ [openbsd-compat/port-aix.c openbsd-compat/port-irix.c]
+ [openbsd-compat/rresvport.c]
+ These look to need string.h and/or unistd.h (based on a grep for function
+ names)
+ - (djm) [Makefile.in]
+ Remove generated openbsd-compat/regress/Makefile in distclean target
+ - (djm) [regress/Makefile regress/agent-getpeereid.sh regress/cfgmatch.sh]
+ [regress/cipher-speed.sh regress/forcecommand.sh regress/forwarding.sh]
+ Sync regress tests to -current; include dtucker@'s new cfgmatch and
+ forcecommand tests. Add cipher-speed.sh test (not linked in yet)
+ - (dtucker) [cleanup.c] Since config.h defines _LARGE_FILES on AIX, including
+ system headers before defines.h will cause conflicting definitions.
+ - (dtucker) [regress/forcecommand.sh] Portablize.
+
+20060713
+ - (dtucker) [auth-krb5.c auth-pam.c] Still more errno.h
+
+20060712
+ - (dtucker) [configure.ac defines.h] Only define SHUT_RD (and friends) and
+ O_NONBLOCK if they're really needed. Fixes build errors on HP-UX, old
+ Linuxes and probably more.
+ - (dtucker) [configure.ac] OpenBSD needs <sys/types.h> before <sys/socket.h>
+ for SHUT_RD.
+ - (dtucker) [openbsd-compat/port-tun.c] OpenBSD needs <netinet/in.h> before
+ <netinet/ip.h>.
+ - (dtucker) OpenBSD CVS Sync
+ - stevesk@cvs.openbsd.org 2006/07/10 16:01:57
+ [sftp-glob.c sftp-common.h sftp.c]
+ buffer.h only needed in sftp-common.h and remove some unneeded
+ user includes; ok djm@
+ - jmc@cvs.openbsd.org 2006/07/10 16:04:21
+ [sshd.8]
+ s/and and/and/
+ - stevesk@cvs.openbsd.org 2006/07/10 16:37:36
+ [readpass.c log.h scp.c fatal.c xmalloc.c includes.h ssh-keyscan.c misc.c
+ auth.c packet.c log.c]
+ move #include <stdarg.h> out of includes.h; ok markus@
+ - dtucker@cvs.openbsd.org 2006/07/11 10:12:07
+ [ssh.c]
+ Only copy the part of environment variable that we actually use. Prevents
+ ssh bailing when SendEnv is used and an environment variable with a really
+ long value exists. ok djm@
+ - markus@cvs.openbsd.org 2006/07/11 18:50:48
+ [clientloop.c ssh.1 ssh.c channels.c ssh_config.5 readconf.h session.c
+ channels.h readconf.c]
+ add ExitOnForwardFailure: terminate the connection if ssh(1)
+ cannot set up all requested dynamic, local, and remote port
+ forwardings. ok djm, dtucker, stevesk, jmc
+ - stevesk@cvs.openbsd.org 2006/07/11 20:07:25
+ [scp.c auth.c monitor.c serverloop.c sftp-server.c sshpty.c readpass.c
+ sshd.c monitor_wrap.c monitor_fdpass.c ssh-agent.c ttymodes.c atomicio.c
+ includes.h session.c sshlogin.c monitor_mm.c packet.c sshconnect2.c
+ sftp-client.c nchan.c clientloop.c sftp.c misc.c canohost.c channels.c
+ ssh-keygen.c progressmeter.c uidswap.c msg.c readconf.c sshconnect.c]
+ move #include <errno.h> out of includes.h; ok markus@
+ - stevesk@cvs.openbsd.org 2006/07/11 20:16:43
+ [ssh.c]
+ cast asterisk field precision argument to int to remove warning;
+ ok markus@
+ - stevesk@cvs.openbsd.org 2006/07/11 20:27:56
+ [authfile.c ssh.c]
+ need <errno.h> here also (it's also included in <openssl/err.h>)
+ - dtucker@cvs.openbsd.org 2006/07/12 11:34:58
+ [sshd.c servconf.h servconf.c sshd_config.5 auth.c]
+ Add support for conditional directives to sshd_config via a "Match"
+ keyword, which works similarly to the "Host" directive in ssh_config.
+ Lines after a Match line override the default set in the main section
+ if the condition on the Match line is true, eg
+ AllowTcpForwarding yes
+ Match User anoncvs
+ AllowTcpForwarding no
+ will allow port forwarding by all users except "anoncvs".
+ Currently only a very small subset of directives are supported.
+ ok djm@
+ - (dtucker) [loginrec.c openbsd-compat/xmmap.c openbsd-compat/bindresvport.c
+ openbsd-compat/glob.c openbsd-compat/mktemp.c openbsd-compat/port-tun.c
+ openbsd-compat/readpassphrase.c openbsd-compat/strtonum.c] Include <errno.h>.
+ - (dtucker) [openbsd-compat/setproctitle.c] Include stdarg.h.
+ - (dtucker) [ssh-keyscan.c ssh-rand-helper.c] More errno.h here too.
+ - (dtucker) [openbsd-compat/openbsd-compat.h] v*printf needs stdarg.h.
+ - (dtucker) [openbsd-compat/bsd-asprintf.c openbsd-compat/port-aix.c
+ openbsd-compat/rresvport.c] More errno.h.
+
+20060711
+ - (dtucker) [configure.ac ssh-keygen.c openbsd-compat/bsd-openpty.c
+ openbsd-compat/daemon.c] Add includes needed by open(2). Conditionally
+ include paths.h. Fixes build error on Solaris.
+ - (dtucker) [entropy.c] More fcntl.h, this time on AIX (and probably
+ others).
+
+20060710
+ - (dtucker) [INSTALL] New autoconf version: 2.60.
+ - OpenBSD CVS Sync
+ - djm@cvs.openbsd.org 2006/06/14 10:50:42
+ [sshconnect.c]
+ limit the number of pre-banner characters we will accept; ok markus@
+ - djm@cvs.openbsd.org 2006/06/26 10:36:15
+ [clientloop.c]
+ mention optional bind_address in runtime port forwarding setup
+ command-line help. patch from santhi.amirta AT gmail.com
+ - stevesk@cvs.openbsd.org 2006/07/02 17:12:58
+ [ssh.1 ssh.c ssh_config.5 sshd_config.5]
+ more details and clarity for tun(4) device forwarding; ok and help
+ jmc@
+ - stevesk@cvs.openbsd.org 2006/07/02 18:36:47
+ [gss-serv-krb5.c gss-serv.c]
+ no "servconf.h" needed here
+ (gss-serv-krb5.c change not applied, portable needs the server options)
+ - stevesk@cvs.openbsd.org 2006/07/02 22:45:59
+ [groupaccess.c groupaccess.h includes.h session.c sftp-common.c sshpty.c]
+ move #include <grp.h> out of includes.h
+ (portable needed uidswap.c too)
+ - stevesk@cvs.openbsd.org 2006/07/02 23:01:55
+ [clientloop.c ssh.1]
+ use -KR[bind_address:]port here; ok djm@
+ - stevesk@cvs.openbsd.org 2006/07/03 08:54:20
+ [includes.h ssh.c sshconnect.c sshd.c]
+ move #include "version.h" out of includes.h; ok markus@
+ - stevesk@cvs.openbsd.org 2006/07/03 17:59:32
+ [channels.c includes.h]
+ move #include <arpa/inet.h> out of includes.h; old ok djm@
+ (portable needed session.c too)
+ - stevesk@cvs.openbsd.org 2006/07/05 02:42:09
+ [canohost.c hostfile.c includes.h misc.c packet.c readconf.c]
+ [serverloop.c sshconnect.c uuencode.c]
+ move #include <netinet/in.h> out of includes.h; ok deraadt@
+ (also ssh-rand-helper.c logintest.c loginrec.c)
+ - djm@cvs.openbsd.org 2006/07/06 10:47:05
+ [servconf.c servconf.h session.c sshd_config.5]
+ support arguments to Subsystem commands; ok markus@
+ - djm@cvs.openbsd.org 2006/07/06 10:47:57
+ [sftp-server.8 sftp-server.c]
+ add commandline options to enable logging of transactions; ok markus@
+ - stevesk@cvs.openbsd.org 2006/07/06 16:03:53
+ [auth-options.c auth-options.h auth-passwd.c auth-rh-rsa.c]
+ [auth-rhosts.c auth-rsa.c auth.c auth.h auth2-hostbased.c]
+ [auth2-pubkey.c auth2.c includes.h misc.c misc.h monitor.c]
+ [monitor_wrap.c monitor_wrap.h scp.c serverloop.c session.c]
+ [session.h sftp-common.c ssh-add.c ssh-keygen.c ssh-keysign.c]
+ [ssh.c sshconnect.c sshconnect.h sshd.c sshpty.c sshpty.h uidswap.c]
+ [uidswap.h]
+ move #include <pwd.h> out of includes.h; ok markus@
+ - stevesk@cvs.openbsd.org 2006/07/06 16:22:39
+ [ssh-keygen.c]
+ move #include "dns.h" up
+ - stevesk@cvs.openbsd.org 2006/07/06 17:36:37
+ [monitor_wrap.h]
+ typo in comment
+ - stevesk@cvs.openbsd.org 2006/07/08 21:47:12
+ [authfd.c canohost.c clientloop.c dns.c dns.h includes.h]
+ [monitor_fdpass.c nchan.c packet.c servconf.c sftp.c ssh-agent.c]
+ [ssh-keyscan.c ssh.c sshconnect.h sshd.c sshlogin.h]
+ move #include <sys/socket.h> out of includes.h
+ - stevesk@cvs.openbsd.org 2006/07/08 21:48:53
+ [monitor.c session.c]
+ missed these from last commit:
+ move #include <sys/socket.h> out of includes.h
+ - stevesk@cvs.openbsd.org 2006/07/08 23:30:06
+ [log.c]
+ move user includes after /usr/include files
+ - stevesk@cvs.openbsd.org 2006/07/09 15:15:11
+ [auth2-none.c authfd.c authfile.c includes.h misc.c monitor.c]
+ [readpass.c scp.c serverloop.c sftp-client.c sftp-server.c]
+ [ssh-add.c ssh-agent.c ssh-keygen.c ssh-keysign.c ssh.c sshd.c]
+ [sshlogin.c sshpty.c]
+ move #include <fcntl.h> out of includes.h
+ - stevesk@cvs.openbsd.org 2006/07/09 15:27:59
+ [ssh-add.c]
+ use O_RDONLY vs. 0 in open(); no binary change
+ - djm@cvs.openbsd.org 2006/07/10 11:24:54
+ [sftp-server.c]
+ remove optind - it isn't used here
+ - djm@cvs.openbsd.org 2006/07/10 11:25:53
+ [sftp-server.c]
+ don't log variables that aren't yet set
+ - (djm) [loginrec.c ssh-rand-helper.c sshd.c openbsd-compat/glob.c]
+ [openbsd-compat/mktemp.c openbsd-compat/openbsd-compat.h]
+ [openbsd-compat/port-tun.c openbsd-compat/readpassphrase.c]
+ [openbsd-compat/xcrypt.c] Fix includes.h fallout, mainly fcntl.h
+ - OpenBSD CVS Sync
+ - djm@cvs.openbsd.org 2006/07/10 12:03:20
+ [scp.c]
+ duplicate argv at the start of main() because it gets modified later;
+ pointed out by deraadt@ ok markus@
+ - djm@cvs.openbsd.org 2006/07/10 12:08:08
+ [channels.c]
+ fix misparsing of SOCKS 5 packets that could result in a crash;
+ reported by mk@ ok markus@
+ - dtucker@cvs.openbsd.org 2006/07/10 12:46:51
+ [misc.c misc.h sshd.8 sshconnect.c]
+ Add port identifier to known_hosts for non-default ports, based originally
+ on a patch from Devin Nate in bz#910.
+ For any connection using the default port or using a HostKeyAlias the
+ format is unchanged, otherwise the host name or address is enclosed
+ within square brackets in the same format as sshd's ListenAddress.
+ Tested by many, ok markus@.
+ - (dtucker) [openbsd-compat/openbsd-compat.h] Need to include <sys/socket.h>
+ for struct sockaddr on platforms that use the fake-rfc stuff.
+
+20060706
+ - (dtucker) [configure.ac] Try AIX blibpath test in different order when
+ compiling with gcc. gcc 4.1.x will accept (but ignore) -b flags so
+ configure would not select the correct libpath linker flags.
+ - (dtucker) [INSTALL] A bit more info on autoconf.
+
+20060705
+ - (dtucker) [ssh-rand-helper.c] Don't exit if mkdir fails because the
+ target already exists.
+
+20060630
+ - (dtucker) [openbsd-compat/openbsd-compat.h] SNPRINTF_CONST for snprintf
+ declaration too. Patch from russ at sludge.net.
+ - (dtucker) [openbsd-compat/getrrsetbyname.c] Undef _res before defining it,
+ prevents warnings on platforms where _res is in the system headers.
+ - (dtucker) [INSTALL] Bug #1202: Note when autoconf is required and which
+ version.
+
+20060627
+ - (dtucker) [configure.ac] Bug #1203: Add missing '[', which causes problems
+ with autoconf 2.60. Patch from vapier at gentoo.org.
+
+20060625
+ - (dtucker) [channels.c serverloop.c] Apply the bug #1102 workaround to ptys
+ only, otherwise sshd can hang exiting non-interactive sessions.
+
+20060624
+ - (dtucker) [configure.ac] Bug #1193: Define PASSWD_NEEDS_USERNAME on Solaris.
+ Works around limitation in Solaris' passwd program for changing passwords
+ where the username is longer than 8 characters. ok djm@
+ - (dtucker) [serverloop.c] Get ifdef/ifndef the right way around for the bug
+ #1102 workaround.
+
+20060623
+ - (dtucker) [README.platform configure.ac openbsd-compat/port-tun.c] Add
+ tunnel support for Mac OS X/Darwin via a third-party tun driver. Patch
+ from reyk@, tested by anil@
+ - (dtucker) [channels.c configure.ac serverloop.c] Bug #1102: Around AIX
+ 4.3.3 ML3 or so, the AIX pty layer starting passing zero-length writes
+ on the pty slave as zero-length reads on the pty master, which sshd
+ interprets as the descriptor closing. Since most things don't do zero
+ length writes this rarely matters, but occasionally it happens, and when
+ it does the SSH pty session appears to hang, so we add a special case for
+ this condition. ok djm@
+
+20060613
+ - (djm) [getput.h] This file has been replaced by functions in misc.c
+ - OpenBSD CVS Sync
+ - djm@cvs.openbsd.org 2006/05/08 10:49:48
+ [sshconnect2.c]
+ uint32_t -> u_int32_t (which we use everywhere else)
+ (Id sync only - portable already had this)
+ - markus@cvs.openbsd.org 2006/05/16 09:00:00
+ [clientloop.c]
+ missing free; from Kylene Hall
+ - markus@cvs.openbsd.org 2006/05/17 12:43:34
+ [scp.c sftp.c ssh-agent.c ssh-keygen.c sshconnect.c]
+ fix leak; coverity via Kylene Jo Hall
+ - miod@cvs.openbsd.org 2006/05/18 21:27:25
+ [kexdhc.c kexgexc.c]
+ paramter -> parameter
+ - dtucker@cvs.openbsd.org 2006/05/29 12:54:08
+ [ssh_config.5]
+ Add gssapi-with-mic to PreferredAuthentications default list; ok jmc
+ - dtucker@cvs.openbsd.org 2006/05/29 12:56:33
+ [ssh_config]
+ Add GSSAPIAuthentication and GSSAPIDelegateCredentials to examples in
+ sample ssh_config. ok markus@
+ - jmc@cvs.openbsd.org 2006/05/29 16:10:03
+ [ssh_config.5]
+ oops - previous was too long; split the list of auths up
+ - mk@cvs.openbsd.org 2006/05/30 11:46:38
+ [ssh-add.c]
+ Sync usage() with man page and reality.
+ ok deraadt dtucker
+ - jmc@cvs.openbsd.org 2006/05/29 16:13:23
+ [ssh.1]
+ add GSSAPI to the list of authentication methods supported;
+ - mk@cvs.openbsd.org 2006/05/30 11:46:38
+ [ssh-add.c]
+ Sync usage() with man page and reality.
+ ok deraadt dtucker
+ - markus@cvs.openbsd.org 2006/06/01 09:21:48
+ [sshd.c]
+ call get_remote_ipaddr() early; fixes logging after client disconnects;
+ report mpf@; ok dtucker@
+ - markus@cvs.openbsd.org 2006/06/06 10:20:20
+ [readpass.c sshconnect.c sshconnect.h sshconnect2.c uidswap.c]
+ replace remaining setuid() calls with permanently_set_uid() and
+ check seteuid() return values; report Marcus Meissner; ok dtucker djm
+ - markus@cvs.openbsd.org 2006/06/08 14:45:49
+ [readpass.c sshconnect.c sshconnect2.c uidswap.c uidswap.h]
+ do not set the gid, noted by solar; ok djm
+ - djm@cvs.openbsd.org 2006/06/13 01:18:36
+ [ssh-agent.c]
+ always use a format string, even when printing a constant
+ - djm@cvs.openbsd.org 2006/06/13 02:17:07
+ [ssh-agent.c]
+ revert; i am on drugs. spotted by alexander AT beard.se
+
+20060521
+ - (dtucker) [auth.c monitor.c] Now that we don't log from both the monitor
+ and slave, we can remove the special-case handling in the audit hook in
+ auth_log.
+
+20060517
+ - (dtucker) [ssh-rand-helper.c] Check return code of mkdir and fix file
+ pointer leak. From kjhall at us.ibm.com, found by coverity.
+
+20060515
+ - (dtucker) [openbsd-compat/getrrsetbyname.c] Use _compat_res instead of
+ _res, prevents problems on some platforms that have _res as a global but
+ don't have getrrsetbyname(), eg IRIX 5.3. Found and tested by
+ georg.schwarz at freenet.de, ok djm@.
+ - (dtucker) [defines.h] Find a value for IOV_MAX or use a conservative
+ default. Patch originally from tim@, ok djm
+ - (dtucker) [auth-pam.c] Bug #1188: pass result of do_pam_account back and
+ do not allow kbdint again after the PAM account check fails. ok djm@
+
+20060506
+ - (dtucker) OpenBSD CVS Sync
+ - dtucker@cvs.openbsd.org 2006/04/25 08:02:27
+ [authfile.c authfile.h sshconnect2.c ssh.c sshconnect1.c]
+ Prevent ssh from trying to open private keys with bad permissions more than
+ once or prompting for their passphrases (which it subsequently ignores
+ anyway), similar to a previous change in ssh-add. bz #1186, ok djm@
+ - djm@cvs.openbsd.org 2006/05/04 14:55:23
+ [dh.c]
+ tighter DH exponent checks here too; feedback and ok markus@
+ - djm@cvs.openbsd.org 2006/04/01 05:37:46
+ [OVERVIEW]
+ $OpenBSD$ in here too
+ - dtucker@cvs.openbsd.org 2006/05/06 08:35:40
+ [auth-krb5.c]
+ Add $OpenBSD$ in comment here too
+
+20060504
+ - (dtucker) [auth-pam.c groupaccess.c monitor.c monitor_wrap.c scard-opensc.c
+ session.c ssh-rand-helper.c sshd.c openbsd-compat/bsd-cygwin_util.c
+ openbsd-compat/setproctitle.c] Convert malloc(foo*bar) -> calloc(foo,bar)
+ in Portable-only code; since calloc zeros, remove now-redundant memsets.
+ Also add a couple of sanity checks. With & ok djm@
+
+20060503
+ - (dtucker) [packet.c] Remove in_systm.h since it's also in includes.h
+ and double including it on IRIX 5.3 causes problems. From Georg Schwarz,
+ "no objections" tim@
+
+20060423
+ - (djm) OpenBSD CVS Sync
+ - deraadt@cvs.openbsd.org 2006/04/01 05:42:20
+ [scp.c]
+ minimal lint cleanup (unused crud, and some size_t); ok djm
+ - djm@cvs.openbsd.org 2006/04/01 05:50:29
+ [scp.c]
+ xasprintification; ok deraadt@
+ - djm@cvs.openbsd.org 2006/04/01 05:51:34
+ [atomicio.c]
+ ANSIfy; requested deraadt@
+ - dtucker@cvs.openbsd.org 2006/04/02 08:34:52
+ [ssh-keysign.c]
+ sessionid can be 32 bytes now too when sha256 kex is used; ok djm@
+ - djm@cvs.openbsd.org 2006/04/03 07:10:38
+ [gss-genr.c]
+ GSSAPI buffers shouldn't be nul-terminated, spotted in bugzilla #1066
+ by dleonard AT vintela.com. use xasprintf() to simplify code while in
+ there; "looks right" deraadt@
+ - djm@cvs.openbsd.org 2006/04/16 00:48:52
+ [buffer.c buffer.h channels.c]
+ Fix condition where we could exit with a fatal error when an input
+ buffer became too large and the remote end had advertised a big window.
+ The problem was a mismatch in the backoff math between the channels code
+ and the buffer code, so make a buffer_check_alloc() function that the
+ channels code can use to propsectivly check whether an incremental
+ allocation will succeed. bz #1131, debugged with the assistance of
+ cove AT wildpackets.com; ok dtucker@ deraadt@
+ - djm@cvs.openbsd.org 2006/04/16 00:52:55
+ [atomicio.c atomicio.h]
+ introduce atomiciov() function that wraps readv/writev to retry
+ interrupted transfers like atomicio() does for read/write;
+ feedback deraadt@ dtucker@ stevesk@ ok deraadt@
+ - djm@cvs.openbsd.org 2006/04/16 00:54:10
+ [sftp-client.c]
+ avoid making a tiny 4-byte write to send the packet length of sftp
+ commands, which would result in a separate tiny packet on the wire by
+ using atomiciov(writev, ...) to write the length and the command in one
+ pass; ok deraadt@
+ - djm@cvs.openbsd.org 2006/04/16 07:59:00
+ [atomicio.c]
+ reorder sanity test so that it cannot dereference past the end of the
+ iov array; well spotted canacar@!
+ - dtucker@cvs.openbsd.org 2006/04/18 10:44:28
+ [bufaux.c bufbn.c Makefile.in]
+ Move Buffer bignum functions into their own file, bufbn.c. This means
+ that sftp and sftp-server (which use the Buffer functions in bufaux.c
+ but not the bignum ones) no longer need to be linked with libcrypto.
+ ok markus@
+ - djm@cvs.openbsd.org 2006/04/20 09:27:09
+ [auth.h clientloop.c dispatch.c dispatch.h kex.h]
+ replace the last non-sig_atomic_t flag used in a signal handler with a
+ sig_atomic_t, unfortunately with some knock-on effects in other (non-
+ signal) contexts in which it is used; ok markus@
+ - markus@cvs.openbsd.org 2006/04/20 09:47:59
+ [sshconnect.c]
+ simplify; ok djm@
+ - djm@cvs.openbsd.org 2006/04/20 21:53:44
+ [includes.h session.c sftp.c]
+ Switch from using pipes to socketpairs for communication between
+ sftp/scp and ssh, and between sshd and its subprocesses. This saves
+ a file descriptor per session and apparently makes userland ppp over
+ ssh work; ok markus@ deraadt@ (ID Sync only - portable makes this
+ decision on a per-platform basis)
+ - djm@cvs.openbsd.org 2006/04/22 04:06:51
+ [uidswap.c]
+ use setres[ug]id() to permanently revoke privileges; ok deraadt@
+ (ID Sync only - portable already uses setres[ug]id() whenever possible)
+ - stevesk@cvs.openbsd.org 2006/04/22 18:29:33
+ [crc32.c]
+ remove extra spaces
+ - (djm) [auth.h dispatch.h kex.h] sprinkle in signal.h to get
+ sig_atomic_t
+
+20060421
+ - (djm) [Makefile.in configure.ac session.c sshpty.c]
+ [contrib/redhat/sshd.init openbsd-compat/Makefile.in]
+ [openbsd-compat/openbsd-compat.h openbsd-compat/port-linux.c]
+ [openbsd-compat/port-linux.h] Add support for SELinux, setting
+ the execution and TTY contexts. based on patch from Daniel Walsh,
+ bz #880; ok dtucker@
+
+20060418
+ - (djm) [canohost.c] Reorder IP options check so that it isn't broken
+ by mapped addresses; bz #1179 reported by markw wtech-llc.com;
+ ok dtucker@
+
20060331
- OpenBSD CVS Sync
- deraadt@cvs.openbsd.org 2006/03/27 01:21:18
[xmalloc.c]
we can do the size & nmemb check before the integer overflow check;
evol
+ - deraadt@cvs.openbsd.org 2006/03/27 13:03:54
+ [dh.c]
+ use strtonum() instead of atoi(), limit dhg size to 64k; ok djm
+ - djm@cvs.openbsd.org 2006/03/27 23:15:46
+ [sftp.c]
+ always use a format string for addargs; spotted by mouring@
+ - deraadt@cvs.openbsd.org 2006/03/28 00:12:31
+ [README.tun ssh.c]
+ spacing
+ - deraadt@cvs.openbsd.org 2006/03/28 01:52:28
+ [channels.c]
+ do not accept unreasonable X ports numbers; ok djm
+ - deraadt@cvs.openbsd.org 2006/03/28 01:53:43
+ [ssh-agent.c]
+ use strtonum() to parse the pid from the file, and range check it
+ better; ok djm
+ - djm@cvs.openbsd.org 2006/03/30 09:41:25
+ [channels.c]
+ ARGSUSED for dispatch table-driven functions
+ - djm@cvs.openbsd.org 2006/03/30 09:58:16
+ [authfd.c bufaux.c deattack.c gss-serv.c mac.c misc.c misc.h]
+ [monitor_wrap.c msg.c packet.c sftp-client.c sftp-server.c ssh-agent.c]
+ replace {GET,PUT}_XXBIT macros with functionally similar functions,
+ silencing a heap of lint warnings. also allows them to use
+ __bounded__ checking which can't be applied to macros; requested
+ by and feedback from deraadt@
+ - djm@cvs.openbsd.org 2006/03/30 10:41:25
+ [ssh.c ssh_config.5]
+ add percent escape chars to the IdentityFile option, bz #1159 based
+ on a patch by imaging AT math.ualberta.ca; feedback and ok dtucker@
+ - dtucker@cvs.openbsd.org 2006/03/30 11:05:17
+ [ssh-keygen.c]
+ Correctly handle truncated files while converting keys; ok djm@
+ - dtucker@cvs.openbsd.org 2006/03/30 11:40:21
+ [auth.c monitor.c]
+ Prevent duplicate log messages when privsep=yes; ok djm@
+ - jmc@cvs.openbsd.org 2006/03/31 09:09:30
+ [ssh_config.5]
+ kill trailing whitespace;
+ - djm@cvs.openbsd.org 2006/03/31 09:13:56
+ [ssh_config.5]
+ remote user escape is %r not %h; spotted by jmc@
20060326
- OpenBSD CVS Sync
andersk / openssh.git / blobdiff