djm [Wed, 31 Aug 2005 09:46:26 +0000 (09:46 +0000)]
- (djm) OpenBSD CVS Sync
- djm@cvs.openbsd.org 2005/08/30 22:08:05
[gss-serv.c sshconnect2.c]
destroy credentials if krb5_kuserok() call fails. Stops credentials being
delegated to users who are not authorised for GSSAPIAuthentication when
GSSAPIDeletegateCredentials=yes and another authentication mechanism
succeeds; bz#1073 reported by paul.moore AT centrify.com, fix by
simon AT sxw.org.uk, tested todd@ biorn@ jakob@; ok deraadt@
tim [Fri, 26 Aug 2005 20:15:19 +0000 (20:15 +0000)]
- (tim) [CREDITS LICENCE auth.c configure.ac defines.h includes.h session.c
openbsd-compat/Makefile.in openbsd-compat/openbsd-compat.h
openbsd-compat/xcrypt.c] New files [openssh/openbsd-compat/port-uw.c
openssh/openbsd-compat/port-uw.h] Support long passwords (> 8-char)
on UnixWare 7 from Dhiraj Gulati and Ahsan Rashid. Cleanup and testing
by tim@. Feedback and OK dtucker@
dtucker [Tue, 23 Aug 2005 13:32:05 +0000 (13:32 +0000)]
- (dtucker) [regress/test-exec.sh] Do not prepend an extra "/" to a fully-
qualified sshd pathname since some systems (eg Cygwin) may consider "/foo"
and "//foo" to be different. Spotted by vinschen at redhat.com.
djm [Fri, 12 Aug 2005 12:16:22 +0000 (12:16 +0000)]
- jaredy@cvs.openbsd.org 2005/08/08 13:22:48
[sftp.c]
sftp prompt enhancements:
- in non-interactive mode, do not print an empty prompt at the end
before finishing
- print newline after EOF in editline mode
- call el_end() in editline mode
ok dtucker djm
dtucker [Wed, 10 Aug 2005 11:52:36 +0000 (11:52 +0000)]
- (dtucker) [LICENCE configure.ac defines.h openbsd-compat/realpath.c]
Sync current (thread-safe) version of realpath.c from OpenBSD (which is
in turn based on FreeBSD's). ok djm@
dtucker [Wed, 3 Aug 2005 00:57:15 +0000 (00:57 +0000)]
- (dtucker) [openbsd-compat/fake-rfc2553.h] Check for EAI_* defines
individually and use a value less likely to collide with real values from
netdb.h. Fixes compile warnings on FreeBSD 5.3. ok djm@
- markus@cvs.openbsd.org 2005/07/25 11:59:40
[kex.c kex.h myproposal.h packet.c packet.h servconf.c session.c]
[sshconnect2.c sshd.c sshd_config sshd_config.5]
add a new compression method that delays compression until the user
has been authenticated successfully and set compression to 'delayed'
for sshd.
this breaks older openssh clients (< 3.5) if they insist on
compression, so you have to re-enable compression in sshd_config.
ok djm@
- (djm) OpenBSD CVS Sync
- otto@cvs.openbsd.org 2005/07/19 15:32:26
[auth-passwd.c]
auth_usercheck(3) can return NULL, so check for that. Report from
mpech@. ok markus@
- (djm) [auth-pam.c sftp.c] spaces vs. tabs at start of line
- djm@cvs.openbsd.org 2005/07/17 06:49:04
[channels.c channels.h session.c session.h]
Fix a number of X11 forwarding channel leaks:
1. Refuse multiple X11 forwarding requests on the same session
2. Clean up all listeners after a single_connection X11 forward, not just
the one that made the single connection
3. Destroy X11 listeners when the session owning them goes away
testing and ok dtucker@
- (dtucker) [auth-pam.c] Ensure that only one side of the authentication
socketpair stays open on in both the monitor and PAM process. Patch from
Joerg Sonnenberger.
- (dtucker) [configure.ac defines.h] Define __sentinel__ to nothing if the
compiler doesn't understand it to prevent warnings. If any mainstream
compiler versions acquire it we can test for those versions. Based on
discussion with djm@.
- markus@cvs.openbsd.org 2005/07/08 09:41:33
[channels.h]
race when efd gets closed while there is still buffered data:
change CHANNEL_EFD_OUTPUT_ACTIVE()
1) c->efd must always be valid AND
2a) no EOF has been seen OR
2b) there is buffered data
report, initial fix and testing Chuck Cranor
- (dtucker) [acconfig.h auth-krb5.c configure.ac gss-serv-krb5.c] Remove
calls to krb5_init_ets, which has not been required since krb-1.1.x and
most Kerberos versions no longer export in their public API. From sxw
at inf.ed.ac.uk, ok djm@
- (dtucker) [auth-krb5.c] There's no guarantee that snprintf will set errno
in the case where the buffer is insufficient, so always return ENOMEM.
Also pointed out by sxw at inf.ed.ac.uk.
- [auth-krb5.c auth.h gss-serv-krb5.c] Move KRB5CCNAME generation for the MIT
Kerberos code path into a common function and expand mkstemp template to be
consistent with the rest of OpenSSH. From sxw at inf.ed.ac.uk, ok djm@
- djm@cvs.openbsd.org 2005/07/04 00:58:43
[channels.c clientloop.c clientloop.h misc.c misc.h ssh.c ssh_config.5]
implement support for X11 and agent forwarding over multiplex slave
connections. Because of protocol limitations, the slave connections inherit
the master's DISPLAY and SSH_AUTH_SOCK rather than distinctly forwarding
their own.
ok dtucker@ "put it in" deraadt@
djm [Sat, 18 Jun 2005 21:31:37 +0000 (21:31 +0000)]
- djm@cvs.openbsd.org 2005/05/20 12:57:01;
[auth1.c] split protocol 1 auth methods into separate functions, makes
authloop much more readable; fixes and ok markus@ (portable ok &
polish dtucker@)
dtucker [Fri, 17 Jun 2005 11:15:20 +0000 (11:15 +0000)]
- (dtucker) [cipher.c openbsd-compat/openbsd-compat.h
openbsd-compat/openssl-compat.c] only include openssl compat stuff where
it's needed as it can cause conflicts elsewhere (eg xcrypt.c). Found by
and ok tim@
----------------------------------------------------------------------
automatically CVS: CVS: Committing in . CVS: CVS: Modified Files:
----------------------------------------------------------------------
djm [Thu, 16 Jun 2005 03:21:17 +0000 (03:21 +0000)]
- dtucker@cvs.openbsd.org 2005/06/09 13:43:49
[cipher.c]
Correctly initialize end of array sentinel; ok djm@
(Id sync only, change already in portable)
djm [Thu, 16 Jun 2005 03:18:04 +0000 (03:18 +0000)]
- (djm) OpenBSD CVS Sync
- jaredy@cvs.openbsd.org 2005/06/07 13:25:23
[progressmeter.c]
catch SIGWINCH and resize progress meter accordingly; ok markus dtucker
dtucker [Thu, 9 Jun 2005 11:45:10 +0000 (11:45 +0000)]
- (dtucker) [cipher.c openbsd-compat/Makefile.in
openbsd-compat/openbsd-compat.{c,h} openbsd-compat/openssl-compat.h]
Move compatibility code for supporting older OpenSSL versions to the
compat layer. Suggested by and "no objection" djm@
dtucker [Tue, 7 Jun 2005 07:53:40 +0000 (07:53 +0000)]
- (dtucker) [configure.ac] Continue the hunt for LLONG_MIN and LLONG_MAX:
in today's episode we attempt to coax it from limits.h where it may be
hiding, failing that we take the DIY approach. Tested by tim@
dtucker [Fri, 3 Jun 2005 07:58:31 +0000 (07:58 +0000)]
- (dtucker) [configure.ac] Only try gcc -std=gnu99 if LLONG_MAX isn't
defined, and check that it helps before keeping it in CFLAGS. Some old
gcc's don't set an error code when encountering an unknown value in -std.
Found and tested by tim@.
tim [Fri, 3 Jun 2005 03:28:29 +0000 (03:28 +0000)]
- (tim) [configure.ac] Some platforms need sys/types.h for arpa/nameser.h.
Take AC_CHECK_HEADERS test out of ultrix section. It caused other platforms
to skip builtin standard includes tests. (first AC_CHECK_HEADERS test
must be run on all platforms) Add missing ;; to case statement. OK dtucker@
dtucker [Wed, 1 Jun 2005 13:08:51 +0000 (13:08 +0000)]
- djm@cvs.openbsd.org 2005/05/27 08:30:37
[ssh.c]
fix -O for cases where no ControlPath has been specified or socket at
ControlPath is not contactable; spotted by and ok avsm@
dtucker [Wed, 1 Jun 2005 13:01:12 +0000 (13:01 +0000)]
- avsm@cvs.openbsd.org 2005/05/26 02:08:05
[scp.c]
If copying multiple files to a target file (which normally fails, as it
must be a target directory), kill the spawned ssh child before exiting.
This stops it trying to authenticate and spewing lots of output.
deraadt@ ok
dtucker [Sun, 29 May 2005 00:28:48 +0000 (00:28 +0000)]
20050529
- (dtucker) [openbsd-compat/port-aix.c] Bug #1046: AIX 5.3 expects the
argument to passwdexpired to be initialized to NULL. Suggested by tim@
While at it, initialize the other arguments to auth functions in case they
ever acquire this behaviour.
dtucker [Sat, 28 May 2005 10:28:39 +0000 (10:28 +0000)]
- (dtucker) [openbsd-compat/port-aix.h] Use the HAVE_DECL_* definitions as
per the autoconf man page. Configure should always define them but it
doesn't hurt to check.
andersk / openssh.git / log
