+20080119
+ - (djm) Silence noice from expr in ssh-copy-id; patch from
+ mikel AT mikelward.com
+
+20080102
+ - (dtucker) [configure.ac] Fix message for -fstack-protector-all test.
+
+20080101
+ - (dtucker) OpenBSD CVS Sync
+ - dtucker@cvs.openbsd.org 2007/12/31 10:41:31
+ [readconf.c servconf.c]
+ Prevent strict-aliasing warnings on newer gcc versions. bz #1355, patch
+ from Dmitry V. Levin, ok djm@
+ - dtucker@cvs.openbsd.org 2007/12/31 15:27:04
+ [sshd.c]
+ When in inetd mode, have sshd generate a Protocol 1 ephemeral server
+ key only for connections where the client chooses Protocol 1 as opposed
+ to when it's enabled in the server's config. Speeds up Protocol 2
+ connections to inetd-mode servers that also allow Protocol 1. bz #440,
+ based on a patch from bruno at wolff.to, ok markus@
+ - dtucker@cvs.openbsd.org 2008/01/01 08:47:04
+ [misc.c]
+ spaces -> tabs from my previous commit
+ - dtucker@cvs.openbsd.org 2008/01/01 09:06:39
+ [scp.c]
+ If scp -p encounters a pre-epoch timestamp, use the epoch which is
+ as close as we can get given that it's used unsigned. Add a little
+ debugging while there. bz #828, ok djm@
+ - dtucker@cvs.openbsd.org 2008/01/01 09:27:33
+ [sshd_config.5 servconf.c]
+ Allow PermitRootLogin in a Match block. Allows for, eg, permitting root
+ only from the local network. ok markus@, man page bit ok jmc@
+ - dtucker@cvs.openbsd.org 2008/01/01 08:51:20
+ [moduli]
+ Updated moduli file; ok djm@
+
+20071231
+ - (dtucker) [configure.ac openbsd-compat/glob.{c,h}] Bug #1407: force use of
+ builtin glob implementation on Mac OS X. Based on a patch from
+ vgiffin at apple.
+
+20071229
+ - (dtucker) OpenBSD CVS Sync
+ - djm@cvs.openbsd.org 2007/12/12 05:04:03
+ [sftp.c]
+ unbreak lls command and add a regress test that would have caught the
+ breakage; spotted by mouring@
+ - dtucker@cvs.openbsd.org 2007/12/27 14:22:08
+ [servconf.c canohost.c misc.c channels.c sshconnect.c misc.h ssh-keyscan.c
+ sshd.c]
+ Add a small helper function to consistently handle the EAI_SYSTEM error
+ code of getaddrinfo. Prompted by vgiffin at apple com via bz #1417.
+ ok markus@ stevesk@
+ - dtucker@cvs.openbsd.org 2007/12/28 15:32:24
+ [clientloop.c serverloop.c packet.c]
+ Make SSH2_MSG_UNIMPLEMENTED and SSH2_MSG_IGNORE messages reset the
+ ServerAlive and ClientAlive timers. Prevents dropping a connection
+ when these are enabled but the peer does not support our keepalives.
+ bz #1307, ok djm@.
+ - dtucker@cvs.openbsd.org 2007/12/28 22:34:47
+ [clientloop.c]
+ Use the correct packet maximum sizes for remote port and agent forwarding.
+ Prevents the server from killing the connection if too much data is queued
+ and an excessively large packet gets sent. bz #1360, ok djm@.
+
+20071202
+ - (dtucker) [configure.ac] Enable -fstack-protector-all on systems where
+ gcc supports it. ok djm@
+ - (dtucker) [scp.c] Update $OpenBSD tag missing from rev 1.175 and remove
+ leftover debug code.
+ - (dtucker) OpenBSD CVS Sync
+ - dtucker@cvs.openbsd.org 2007/10/29 00:52:45
+ [auth2-gss.c]
+ Allow build without -DGSSAPI; ok deraadt@
+ (Id sync only, Portable already has the ifdefs)
+ - dtucker@cvs.openbsd.org 2007/10/29 01:55:04
+ [ssh.c]
+ Plug tiny mem leaks in ControlPath and ProxyCommand option processing;
+ ok djm@
+ - dtucker@cvs.openbsd.org 2007/10/29 04:08:08
+ [monitor_wrap.c monitor.c]
+ Send config block back to slave for invalid users too so options
+ set by a Match block (eg Banner) behave the same for non-existent
+ users. Found by and ok djm@
+ - dtucker@cvs.openbsd.org 2007/10/29 06:51:59
+ [ssh_config.5]
+ ProxyCommand and LocalCommand use the user's shell, not /bin/sh; ok djm@
+ - dtucker@cvs.openbsd.org 2007/10/29 06:54:50
+ [ssh.c]
+ Make LocalCommand work for Protocol 1 too; ok djm@
+ - jmc@cvs.openbsd.org 2007/10/29 07:48:19
+ [ssh_config.5]
+ clean up after previous macro removal;
+ - djm@cvs.openbsd.org 2007/11/03 00:36:14
+ [clientloop.c]
+ fix memory leak in process_cmdline(), patch from Jan.Pechanec AT Sun.COM;
+ ok dtucker@
+ - deraadt@cvs.openbsd.org 2007/11/03 01:24:06
+ [ssh.c]
+ bz #1377: getpwuid results were being clobbered by another getpw* call
+ inside tilde_expand_filename(); save the data we need carefully
+ ok djm
+ - dtucker@cvs.openbsd.org 2007/11/03 02:00:32
+ [ssh.c]
+ Use xstrdup/xfree when saving pwname and pwdir; ok deraadt@
+ - deraadt@cvs.openbsd.org 2007/11/03 02:03:49
+ [ssh.c]
+ avoid errno trashing in signal handler; ok dtucker
+
+20071030
+ - (djm) OpenBSD CVS Sync
+ - djm@cvs.openbsd.org 2007/10/29 23:49:41
+ [openbsd-compat/sys-tree.h]
+ remove extra backslash at the end of RB_PROTOTYPE, report from
+ Jan.Pechanec AT Sun.COM; ok deraadt@
+
+20071026
+ - (djm) OpenBSD CVS Sync
+ - stevesk@cvs.openbsd.org 2007/09/11 23:49:09
+ [sshpty.c]
+ remove #if defined block not needed; ok markus@ dtucker@
+ (NB. RCD ID sync only for portable)
+ - djm@cvs.openbsd.org 2007/09/21 03:05:23
+ [ssh_config.5]
+ document KbdInteractiveAuthentication in ssh_config.5;
+ patch from dkg AT fifthhorseman.net
+ - djm@cvs.openbsd.org 2007/09/21 08:15:29
+ [auth-bsdauth.c auth-passwd.c auth.c auth.h auth1.c auth2-chall.c]
+ [monitor.c monitor_wrap.c]
+ unifdef -DBSD_AUTH
+ unifdef -USKEY
+ These options have been in use for some years;
+ ok markus@ "no objection" millert@
+ (NB. RCD ID sync only for portable)
+ - canacar@cvs.openbsd.org 2007/09/25 23:48:57
+ [ssh-agent.c]
+ When adding a key that already exists, update the properties
+ (time, confirm, comment) instead of discarding them. ok djm@ markus@
+ - ray@cvs.openbsd.org 2007/09/27 00:15:57
+ [dh.c]
+ Don't return -1 on error in dh_pub_is_valid(), since it evaluates
+ to true.
+ Also fix a typo.
+ Initial diff from Matthew Dempsky, input from djm.
+ OK djm, markus.
+ - dtucker@cvs.openbsd.org 2007/09/29 00:25:51
+ [auth2.c]
+ Remove unused prototype. ok djm@
+ - chl@cvs.openbsd.org 2007/10/02 17:49:58
+ [ssh-keygen.c]
+ handles zero-sized strings that fgets can return
+ properly removes trailing newline
+ removes an unused variable
+ correctly counts line number
+ "looks ok" ray@ markus@
+ - markus@cvs.openbsd.org 2007/10/22 19:10:24
+ [readconf.c]
+ make sure that both the local and remote port are correct when
+ parsing -L; Jan Pechanec (bz #1378)
+ - djm@cvs.openbsd.org 2007/10/24 03:30:02
+ [sftp.c]
+ rework argument splitting and parsing to cope correctly with common
+ shell escapes and make handling of escaped characters consistent
+ with sh(1) and between sftp commands (especially between ones that
+ glob their arguments and ones that don't).
+ parse command flags using getopt(3) rather than hand-rolled parsers.
+ ok dtucker@
+ - djm@cvs.openbsd.org 2007/10/24 03:44:02
+ [scp.c]
+ factor out network read/write into an atomicio()-like function, and
+ use it to handle short reads, apply bandwidth limits and update
+ counters. make network IO non-blocking, so a small trickle of
+ reads/writes has a chance of updating the progress meter; bz #799
+ ok dtucker@
+ - djm@cvs.openbsd.org 2006/08/29 09:44:00
+ [regress/sftp-cmds.sh]
+ clean up our mess
+ - markus@cvs.openbsd.org 2006/11/06 09:27:43
+ [regress/cfgmatch.sh]
+ fix quoting for non-(c)sh login shells.
+ - dtucker@cvs.openbsd.org 2006/12/13 08:36:36
+ [regress/cfgmatch.sh]
+ Additional test for multiple PermitOpen entries. ok djm@
+ - pvalchev@cvs.openbsd.org 2007/06/07 19:41:46
+ [regress/cipher-speed.sh regress/try-ciphers.sh]
+ test umac-64@openssh.com
+ ok djm@
+ - djm@cvs.openbsd.org 2007/10/24 03:32:35
+ [regress/sftp-cmds.sh regress/sftp-glob.sh regress/test-exec.sh]
+ comprehensive tests for sftp escaping its interaction with globbing;
+ ok dtucker@
+ - djm@cvs.openbsd.org 2007/10/26 05:30:01
+ [regress/sftp-glob.sh regress/test-exec.sh]
+ remove "echo -E" crap that I added in last commit and use printf(1) for
+ cases where we strictly require echo not to reprocess escape characters.
+ - deraadt@cvs.openbsd.org 2005/11/28 17:50:12
+ [openbsd-compat/glob.c]
+ unused arg in internal static API
+ - jakob@cvs.openbsd.org 2007/10/11 18:36:41
+ [openbsd-compat/getrrsetbyname.c openbsd-compat/getrrsetbyname.h]
+ use RRSIG instead of SIG for DNSSEC. ok djm@
+ - otto@cvs.openbsd.org 2006/10/21 09:55:03
+ [openbsd-compat/base64.c]
+ remove calls to abort(3) that can't happen anyway; from
+ <bret dot lambert at gmail.com>; ok millert@ deraadt@
+ - frantzen@cvs.openbsd.org 2004/04/24 18:11:46
+ [openbsd-compat/sys-tree.h]
+ sync to Niels Provos' version. avoid unused variable warning in
+ RB_NEXT()
+ - tdeval@cvs.openbsd.org 2004/11/24 18:10:42
+ [openbsd-compat/sys-tree.h]
+ typo
+ - grange@cvs.openbsd.org 2004/05/04 16:59:32
+ [openbsd-compat/sys-queue.h]
+ Remove useless ``elm'' argument from the SIMPLEQ_REMOVE_HEAD macro.
+ This matches our SLIST behaviour and NetBSD's SIMPLEQ as well.
+ ok millert krw deraadt
+ - deraadt@cvs.openbsd.org 2005/02/25 13:29:30
+ [openbsd-compat/sys-queue.h]
+ minor white spacing
+ - otto@cvs.openbsd.org 2005/10/17 20:19:42
+ [openbsd-compat/sys-queue.h]
+ Performing certain operations on queue.h data structurs produced
+ funny results. An example is calling LIST_REMOVE on the same
+ element twice. This will not fail, but result in a data structure
+ referencing who knows what. Prevent these accidents by NULLing some
+ fields on remove and replace. This way, either a panic or segfault
+ will be produced on the faulty operation.
+ - otto@cvs.openbsd.org 2005/10/24 20:25:14
+ [openbsd-compat/sys-queue.h]
+ Partly backout. NOLIST, used in LISTs is probably interfering.
+ requested by deraadt@
+ - otto@cvs.openbsd.org 2005/10/25 06:37:47
+ [openbsd-compat/sys-queue.h]
+ Some uvm problem is being exposed with the more strict macros.
+ Revert until we've found out what's causing the panics.
+ - otto@cvs.openbsd.org 2005/11/25 08:06:25
+ [openbsd-compat/sys-queue.h]
+ Introduce debugging aid for queue macros. Disabled by default; but
+ developers are encouraged to run with this enabled.
+ ok krw@ fgsch@ deraadt@
+ - otto@cvs.openbsd.org 2007/04/30 18:42:34
+ [openbsd-compat/sys-queue.h]
+ Enable QUEUE_MACRO_DEBUG on DIAGNOSTIC kernels.
+ Input and okays from krw@, millert@, otto@, deraadt@, miod@.
+ - millert@cvs.openbsd.org 2004/10/07 16:56:11
+ GLOB_NOESCAPE is POSIX so move it out of the #ifndef _POSIX_SOURCE
+ block.
+ (NB. mostly an RCS ID sync, as portable strips out the conditionals)
+ - (djm) [regress/sftp-cmds.sh]
+ Use more restrictive glob to pick up test files from /bin - some platforms
+ ship broken symlinks there which could spoil the test.
+ - (djm) [openbsd-compat/bindresvport.c]
+ Sync RCS ID after irrelevant (for portable OpenSSH) header shuffling
+
+20070927
+ - (dtucker) [configure.ac atomicio.c] Fall back to including <sys/poll.h> if
+ we don't have <poll.h> (eq QNX). From bacon at cs nyu edu.
+ - (dtucker) [configure.ac defines.h] Shadow expiry does not work on QNX6
+ so disable it for that platform. From bacon at cs nyu edu.
+
+20070921
+ - (djm) [atomicio.c] Fix spin avoidance for platforms that define
+ EWOULDBLOCK; patch from ben AT psc.edu
+
+20070917
+ - (djm) OpenBSD CVS Sync
+ - djm@cvs.openbsd.org 2007/08/23 02:49:43
+ [auth-passwd.c auth.c session.c]
+ unifdef HAVE_LOGIN_CAP; ok deraadt@ millert@
+ NB. RCS ID sync only for portable
+ - djm@cvs.openbsd.org 2007/08/23 02:55:51
+ [auth-passwd.c auth.c session.c]
+ missed include bits from last commit
+ NB. RCS ID sync only for portable
+ - djm@cvs.openbsd.org 2007/08/23 03:06:10
+ [auth.h]
+ login_cap.h doesn't belong here
+ NB. RCS ID sync only for portable
+ - djm@cvs.openbsd.org 2007/08/23 03:22:16
+ [auth2-none.c sshd_config sshd_config.5]
+ Support "Banner=none" to disable displaying of the pre-login banner;
+ ok dtucker@ deraadt@
+ - djm@cvs.openbsd.org 2007/08/23 03:23:26
+ [sshconnect.c]
+ Execute ProxyCommands with $SHELL rather than /bin/sh unconditionally
+ - djm@cvs.openbsd.org 2007/09/04 03:21:03
+ [clientloop.c monitor.c monitor_fdpass.c monitor_fdpass.h]
+ [monitor_wrap.c ssh.c]
+ make file descriptor passing code return an error rather than call fatal()
+ when it encounters problems, and use this to make session multiplexing
+ masters survive slaves failing to pass all stdio FDs; ok markus@
+ - djm@cvs.openbsd.org 2007/09/04 11:15:56
+ [ssh.c sshconnect.c sshconnect.h]
+ make ssh(1)'s ConnectTimeout option apply to both the TCP connection and
+ SSH banner exchange (previously it just covered the TCP connection).
+ This allows callers of ssh(1) to better detect and deal with stuck servers
+ that accept a TCP connection but don't progress the protocol, and also
+ makes ConnectTimeout useful for connections via a ProxyCommand;
+ feedback and "looks ok" markus@
+ - sobrado@cvs.openbsd.org 2007/09/09 11:38:01
+ [ssh-add.c ssh-agent.1 ssh-agent.c ssh-keygen.c]
+ sort synopsis and options in ssh-agent(1); usage is lowercase
+ ok jmc@
+ - stevesk@cvs.openbsd.org 2007/09/11 04:36:29
+ [sshpty.c]
+ sort #include
+ NB. RCS ID sync only
+ - gilles@cvs.openbsd.org 2007/09/11 15:47:17
+ [session.c ssh-keygen.c sshlogin.c]
+ use strcspn to properly overwrite '\n' in fgets returned buffer
+ ok pyr@, ray@, millert@, moritz@, chl@
+ - stevesk@cvs.openbsd.org 2007/09/11 23:49:09
+ [sshpty.c]
+ remove #if defined block not needed; ok markus@ dtucker@
+ NB. RCS ID sync only
+ - stevesk@cvs.openbsd.org 2007/09/12 19:39:19
+ [umac.c]
+ use xmalloc() and xfree(); ok markus@ pvalchev@
+ - djm@cvs.openbsd.org 2007/09/13 04:39:04
+ [sftp-server.c]
+ fix incorrect test when setting syslog facility; from Jan Pechanec
+ - djm@cvs.openbsd.org 2007/09/16 00:55:52
+ [sftp-client.c]
+ use off_t instead of u_int64_t for file offsets, matching what the
+ progressmeter code expects; bz #842
+ - (tim) [defines.h] Fix regression in long password support on OpenServer 6.
+ Problem report and additional testing rac AT tenzing.org.
+
+20070914
+ - (dtucker) [openbsd-compat/bsd-asprintf.c] Plug mem leak in error path.
+ Patch from Jan.Pechanec at sun com.
+
+20070910
+ - (dtucker) [openbsd-compat/regress/closefromtest.c] Bug #1358: Always
+ return 0 on successful test. From David.Leonard at quest com.
+ - (tim) [configure.ac] Autoconf didn't define HAVE_LIBIAF because we
+ did a AC_CHECK_FUNCS within the AC_CHECK_LIB test.
+
20070817
- (dtucker) [sshd.8] Many Linux variants use a single "!" to denote locked
accounts and that's what the code looks for, so make man page and code
do NOT fall back to the trused x11 cookie if generation of an untrusted
cookie fails; from Jan Pechanec, via security-alert at sun.com;
ok dtucker
- Originally found and fixed by Jan Pechanec.
- markus@cvs.openbsd.org 2007/08/15 08:16:49
[version.h]
openssh 4.7
andersk / openssh.git / blobdiff