dtucker [Wed, 3 May 2006 09:01:09 +0000 (09:01 +0000)]
- (dtucker) [packet.c] Remove in_systm.h since it's also in includes.h
and double including it on IRIX 5.3 causes problems. From Georg Schwarz,
"no objections" tim@
- dtucker@cvs.openbsd.org 2006/04/18 10:44:28
[bufaux.c bufbn.c Makefile.in]
Move Buffer bignum functions into their own file, bufbn.c. This means
that sftp and sftp-server (which use the Buffer functions in bufaux.c
but not the bignum ones) no longer need to be linked with libcrypto.
ok markus@
- djm@cvs.openbsd.org 2006/04/22 04:06:51
[uidswap.c]
use setres[ug]id() to permanently revoke privileges; ok deraadt@
(ID Sync only - portable already uses setres[ug]id() whenever possible)
- djm@cvs.openbsd.org 2006/04/20 21:53:44
[includes.h session.c sftp.c]
Switch from using pipes to socketpairs for communication between
sftp/scp and ssh, and between sshd and its subprocesses. This saves
a file descriptor per session and apparently makes userland ppp over
ssh work; ok markus@ deraadt@ (ID Sync only - portable makes this
decision on a per-platform basis)
- djm@cvs.openbsd.org 2006/04/20 09:27:09
[auth.h clientloop.c dispatch.c dispatch.h kex.h]
replace the last non-sig_atomic_t flag used in a signal handler with a
sig_atomic_t, unfortunately with some knock-on effects in other (non-
signal) contexts in which it is used; ok markus@
- dtucker@cvs.openbsd.org 2006/04/18 10:44:28
[bufaux.c bufbn.c]
Move Buffer bignum functions into their own file, bufbn.c. This means
that sftp and sftp-server (which use the Buffer functions in bufaux.c
but not the bignum ones) no longer need to be linked with libcrypto.
ok markus@
- djm@cvs.openbsd.org 2006/04/16 07:59:00
[atomicio.c]
reorder sanity test so that it cannot dereference past the end of the
iov array; well spotted canacar@!
- djm@cvs.openbsd.org 2006/04/16 00:54:10
[sftp-client.c]
avoid making a tiny 4-byte write to send the packet length of sftp
commands, which would result in a separate tiny packet on the wire by
using atomiciov(writev, ...) to write the length and the command in one
pass; ok deraadt@
- djm@cvs.openbsd.org 2006/04/16 00:52:55
[atomicio.c atomicio.h]
introduce atomiciov() function that wraps readv/writev to retry
interrupted transfers like atomicio() does for read/write;
feedback deraadt@ dtucker@ stevesk@ ok deraadt@
- djm@cvs.openbsd.org 2006/04/16 00:48:52
[buffer.c buffer.h channels.c]
Fix condition where we could exit with a fatal error when an input
buffer became too large and the remote end had advertised a big window.
The problem was a mismatch in the backoff math between the channels code
and the buffer code, so make a buffer_check_alloc() function that the
channels code can use to propsectivly check whether an incremental
allocation will succeed. bz #1131, debugged with the assistance of
cove AT wildpackets.com; ok dtucker@ deraadt@
- djm@cvs.openbsd.org 2006/04/03 07:10:38
[gss-genr.c]
GSSAPI buffers shouldn't be nul-terminated, spotted in bugzilla #1066
by dleonard AT vintela.com. use xasprintf() to simplify code while in
there; "looks right" deraadt@
- (djm) [Makefile.in configure.ac session.c sshpty.c]
[contrib/redhat/sshd.init openbsd-compat/Makefile.in]
[openbsd-compat/openbsd-compat.h openbsd-compat/port-linux.c]
[openbsd-compat/port-linux.h] Add support for SELinux, setting
the execution and TTY contexts. based on patch from Daniel Walsh,
bz #880; ok dtucker@
djm [Fri, 31 Mar 2006 12:13:21 +0000 (12:13 +0000)]
- djm@cvs.openbsd.org 2006/03/30 10:41:25
[ssh.c ssh_config.5]
add percent escape chars to the IdentityFile option, bz #1159 based
on a patch by imaging AT math.ualberta.ca; feedback and ok dtucker@
djm [Fri, 31 Mar 2006 12:13:02 +0000 (12:13 +0000)]
- djm@cvs.openbsd.org 2006/03/30 09:58:16
[authfd.c bufaux.c deattack.c gss-serv.c mac.c misc.c misc.h]
[monitor_wrap.c msg.c packet.c sftp-client.c sftp-server.c ssh-agent.c]
replace {GET,PUT}_XXBIT macros with functionally similar functions,
silencing a heap of lint warnings. also allows them to use
__bounded__ checking which can't be applied to macros; requested
by and feedback from deraadt@
djm [Sun, 26 Mar 2006 03:11:39 +0000 (03:11 +0000)]
- djm@cvs.openbsd.org 2006/03/22 21:27:15
[deattack.c deattack.h packet.c]
remove IV support from the CRC attack detector, OpenSSH has never used
it - it only applied to IDEA-CFB, which we don't support.
prompted by NetBSD Coverity report via elad AT netbsd.org;
feedback markus@ "nuke it" deraadt@
djm [Sun, 26 Mar 2006 03:07:26 +0000 (03:07 +0000)]
- deraadt@cvs.openbsd.org 2006/03/20 18:26:55
[channels.c monitor.c session.c session.h ssh-agent.c ssh-keygen.c]
[ssh-rsa.c ssh.c sshlogin.c]
annoying spacing fixes getting in the way of real diffs
djm [Sun, 26 Mar 2006 03:05:20 +0000 (03:05 +0000)]
- deraadt@cvs.openbsd.org 2006/03/20 18:17:20
[auth1.c auth2.c sshd.c]
sprinkle some ARGSUSED for table driven functions (which sometimes
must ignore their args)
djm [Sun, 26 Mar 2006 03:02:16 +0000 (03:02 +0000)]
- djm@cvs.openbsd.org 2006/03/20 11:38:46
[key.c]
(really) last of the Coverity diffs: avoid possible NULL deref in
key_free. via elad AT netbsd.org; markus@ ok
djm [Sun, 26 Mar 2006 03:01:54 +0000 (03:01 +0000)]
- djm@cvs.openbsd.org 2006/03/20 04:09:44
[monitor.c]
memory leaks detected by Coverity via elad AT netbsd.org;
deraadt@ ok
that should be all of them now
djm [Sun, 26 Mar 2006 02:53:32 +0000 (02:53 +0000)]
- djm@cvs.openbsd.org 2006/03/19 02:24:05
[dh.c readconf.c servconf.c]
potential NULL pointer dereferences detected by Coverity
via elad AT netbsd.org; ok deraadt@
djm [Sun, 26 Mar 2006 02:48:01 +0000 (02:48 +0000)]
- OpenBSD CVS Sync
- jakob@cvs.openbsd.org 2006/03/15 08:46:44
[ssh-keygen.c]
if no key file are given when printing the DNS host record, use the
host key file(s) as default. ok djm@
djm [Sat, 25 Mar 2006 13:11:46 +0000 (13:11 +0000)]
[deattack.c deattack.h]
remove IV support from the CRC attack detector, OpenSSH has never used
it - it only applied to IDEA-CFB, which we don't support.
prompted by NetBSD Coverity report via elad AT netbsd.org;
feedback markus@ "nuke it" deraadt@
djm [Sat, 25 Mar 2006 13:05:44 +0000 (13:05 +0000)]
- djm@cvs.openbsd.org 2006/03/20 04:08:18
[gss-serv.c]
last lot of GSSAPI related leaks detected by Coverity via
elad AT netbsd.org; reviewed by simon AT sxw.org.uk; deraadt@ ok
djm [Sat, 25 Mar 2006 13:05:23 +0000 (13:05 +0000)]
- djm@cvs.openbsd.org 2006/03/20 04:07:49
[gss-genr.c]
more GSSAPI related leaks detected by Coverity via elad AT netbsd.org;
reviewed by simon AT sxw.org.uk; deraadt@ ok
djm [Sat, 25 Mar 2006 13:04:53 +0000 (13:04 +0000)]
- djm@cvs.openbsd.org 2006/03/20 04:07:22
[auth2-gss.c]
GSSAPI related leaks detected by Coverity via elad AT netbsd.org;
reviewed by simon AT sxw.org.uk; deraadt@ ok
dtucker [Sat, 18 Mar 2006 13:07:07 +0000 (13:07 +0000)]
- (dtucker) [openbsd-compat/bsd-snprintf.c] Bug #1173: make fmtint() take
a LLONG rather than a long. Fixes scp'ing of large files on platforms
with missing/broken snprintfs. Patch from e.borovac at bom.gov.au.