dtucker [Mon, 19 Dec 2005 06:40:40 +0000 (06:40 +0000)]
- (dtucker) [cipher-aes.c cipher-ctr.c cipher.c configure.ac
openbsd-compat/openssl-compat.h] Check for and work around broken AES
ciphers >128bit on (some) Solaris 10 systems. ok djm@
dtucker [Sat, 17 Dec 2005 11:32:03 +0000 (11:32 +0000)]
- (dtucker) [configure.ac openbsd-compat/bsd-snprintf.c] Bug #1133: Our
snprintf replacement can have a conflicting declaration in HP-UX's system
headers (const vs. no const) so we now check for and work around it. Patch
from the dynamic duo of David Leonard and Ted Percival.
djm [Tue, 13 Dec 2005 09:44:13 +0000 (09:44 +0000)]
- (djm) [misc.c] Disable tunnel code for non-OpenBSD (for now), enable
again by providing a sys_tun_open() function for your platform and
setting the CUSTOM_SYS_TUN_OPEN define. More work is required to match
OpenBSD's tunnel protocol, which prepends the address family to the
packet
djm [Tue, 13 Dec 2005 08:33:57 +0000 (08:33 +0000)]
- markus@cvs.openbsd.org 2005/12/12 13:46:18
[channels.c channels.h session.c]
make sure protocol messages for internal channels are ignored.
allow adjust messages for non-open channels; with and ok djm@
djm [Tue, 13 Dec 2005 08:33:19 +0000 (08:33 +0000)]
- reyk@cvs.openbsd.org 2005/12/08 18:34:11
[auth-options.c includes.h misc.c misc.h readconf.c servconf.c]
[serverloop.c ssh.c ssh_config.5 sshd_config.5 configure.ac]
two changes to the new ssh tunnel support. this breaks compatibility
with the initial commit but is required for a portable approach.
- make the tunnel id u_int and platform friendly, use predefined types.
- support configuration of layer 2 (ethernet) or layer 3
(point-to-point, default) modes. configuration is done using the
Tunnel (yes|point-to-point|ethernet|no) option is ssh_config(5) and
restricted by the PermitTunnel (yes|point-to-point|ethernet|no) option
in sshd_config(5).
ok djm@, man page bits by jmc@
djm [Tue, 13 Dec 2005 08:29:02 +0000 (08:29 +0000)]
- reyk@cvs.openbsd.org 2005/12/06 22:38:28
[auth-options.c auth-options.h channels.c channels.h clientloop.c]
[misc.c misc.h readconf.c readconf.h scp.c servconf.c servconf.h]
[serverloop.c sftp.c ssh.1 ssh.c ssh_config ssh_config.5 sshconnect.c]
[sshconnect.h sshd.8 sshd_config sshd_config.5]
Add support for tun(4) forwarding over OpenSSH, based on an idea and
initial channel code bits by markus@. This is a simple and easy way to
use OpenSSH for ad hoc virtual private network connections, e.g.
administrative tunnels or secure wireless access. It's based on a new
ssh channel and works similar to the existing TCP forwarding support,
except that it depends on the tun(4) network interface on both ends of
the connection for layer 2 or layer 3 tunneling. This diff also adds
support for LocalCommand in the ssh(1) client.
ok djm@, markus@, jmc@ (manpages), tested and discussed with others
dtucker [Mon, 28 Nov 2005 06:05:40 +0000 (06:05 +0000)]
- dtucker@cvs.openbsd.org 2005/11/28 06:02:56
[ssh-agent.1]
Update agent socket path templates to reflect reality, correct xref for
time formats. bz#1121, patch from openssh at roumenpetrov.info, ok djm@
dtucker [Mon, 28 Nov 2005 05:41:46 +0000 (05:41 +0000)]
[ssh-keygen.1 ssh-keygen.c]
Enforce DSA key length of exactly 1024 bits to comply with FIPS-186-2,
increase minumum RSA key size to 768 bits and update man page to reflect
these. Patch originally bz#1119 (senthilkumar_sen at hotpop.com),
ok djm@, grudging ok deraadt@.
dtucker [Sat, 26 Nov 2005 11:24:09 +0000 (11:24 +0000)]
- (dtucker) [configure.ac] Bug #1126: AIX 5.2 and 5.3 (and presumably newer,
when they're available) need the real UID set otherwise pam_chauthtok will
set ADMCHG after changing the password, forcing the user to change it
again immediately.
dtucker [Fri, 25 Nov 2005 03:44:55 +0000 (03:44 +0000)]
- (dtucker) [progressmeter.c scp.c sftp-server.c] Use correct casts for
snprintf formats, fixes warnings on some 64 bit platforms. Patch from
shaw at vranix.com, ok djm@
dtucker [Fri, 25 Nov 2005 02:14:58 +0000 (02:14 +0000)]
- (dtucker) [configure.ac] Apply tim's fix for older systems where the
resolver state in resolv.h is "state" not "__res_state". With slight
modification by me to also work on old AIXes. ok djm@
djm [Thu, 24 Nov 2005 08:58:19 +0000 (08:58 +0000)]
- (djm) [configure.ac openbsd-compat/Makefile.in openbsd-compat/bsd-asprintf.c
openbsd-compat/bsd-snprintf.c openbsd-compat/openbsd-compat.h] Add an
asprintf() implementation, after syncing our {v,}snprintf() implementation
with some extra fixes from Samba's version. With help and debugging from
dtucker and tim; ok dtucker@
dtucker [Tue, 22 Nov 2005 08:42:42 +0000 (08:42 +0000)]
- dtucker@cvs.openbsd.org 2005/11/21 09:42:10
[auth-krb5.c]
Perform Kerberos calls even for invalid users to prevent leaking
information about account validity. bz #975, patch originally from
Senthil Kumar, sanity checked by Simon Wilkinson, tested by djm@, biorn@,
ok markus@
dtucker [Tue, 22 Nov 2005 08:41:33 +0000 (08:41 +0000)]
- millert@cvs.openbsd.org 2005/11/15 11:59:54
[includes.h]
Include sys/queue.h explicitly instead of assuming some other header
will pull it in. At the moment it gets pulled in by sys/select.h
(which ssh has no business including) via event.h. OK markus@
(ID sync only in -portable)
dtucker [Sat, 12 Nov 2005 10:30:07 +0000 (10:30 +0000)]
- (dtucker) [regress/reconfigure.sh] Fix potential race in the reconfigure
test: if sshd takes too long to reconfigure the subsequent connection will
fail. Zap pidfile before HUPing sshd which will rewrite it when it's ready.
dtucker [Thu, 10 Nov 2005 05:18:56 +0000 (05:18 +0000)]
- (dtucker) [openbsd-compat/{LOTS}] Move the "OPENBSD ORIGINAL" markers to
after the copyright notices. Having them at the top next to the CVSIDs
guarantees a conflict for each and every sync.
dtucker [Wed, 9 Nov 2005 23:10:10 +0000 (23:10 +0000)]
- (dtucker) [openbsd-compat/getenv.c] Merge changes for __findenv from
OpenBSD getenv.c revs 1.4 - 1.8 (ANSIfication of arguments, removal of
"register").
djm [Sat, 5 Nov 2005 05:56:52 +0000 (05:56 +0000)]
- (djm) [openbsd-compat/getrrsetbyname.c] Sync to latest OpenBSD version,
resolving memory leak bz#1111 reported by kremenek AT cs.stanford.edu;
ok dtucker@
djm [Sat, 5 Nov 2005 04:16:12 +0000 (04:16 +0000)]
- djm@cvs.openbsd.org 2005/10/31 11:48:29
[serverloop.c]
make sure we clean up wtmp, etc. file when we receive a SIGTERM,
SIGINT or SIGQUIT when running without privilege separation (the
normal privsep case is already OK). Patch mainly by dtucker@ and
senthilkumar_sen AT hotpop.com; ok dtucker@
djm [Sat, 5 Nov 2005 04:14:59 +0000 (04:14 +0000)]
- djm@cvs.openbsd.org 2005/10/30 08:52:18
[clientloop.c packet.c serverloop.c session.c ssh-agent.c ssh-keygen.c]
[ssh.c sshconnect.c sshconnect1.c sshd.c]
no need to escape single quotes in comments, no binary change
djm [Sat, 5 Nov 2005 04:12:28 +0000 (04:12 +0000)]
- djm@cvs.openbsd.org 2005/10/30 04:01:03
[ssh-keyscan.c]
make ssh-keygen discard junk from server before SSH- ident, spotted by
dave AT cirt.net; ok dtucker@