Your IP : 216.73.216.48
commit 5c35450a0c901d9375fb23343a8dc82397da5f75
Author: Damien Miller <djm@mindrot.org>
Date: Thu Mar 10 05:04:48 2016 +1100
update versions for release
commit 9d47b8d3f50c3a6282896df8274147e3b9a38c56
Author: Damien Miller <djm@mindrot.org>
Date: Thu Mar 10 05:03:39 2016 +1100
sanitise characters destined for xauth(1)
reported by github.com/tintinweb
commit 72b061d4ba0f909501c595d709ea76e06b01e5c9
Author: Darren Tucker <dtucker@zip.com.au>
Date: Fri Feb 26 14:40:04 2016 +1100
Add a note about using xlc on AIX.
commit fd4e4f2416baa2e6565ea49d52aade296bad3e28
Author: Darren Tucker <dtucker@zip.com.au>
Date: Wed Feb 24 10:44:25 2016 +1100
Skip PrintLastLog in config dump mode.
When DISABLE_LASTLOG is set, do not try to include PrintLastLog in the
config dump since it'll be reported as UNKNOWN.
commit 99135c764fa250801da5ec3b8d06cbd0111caae8
Author: Damien Miller <djm@mindrot.org>
Date: Tue Feb 23 20:17:23 2016 +1100
update spec/README versions ahead of release
commit b86a334aaaa4d1e643eb1fd71f718573d6d948b5
Author: Damien Miller <djm@mindrot.org>
Date: Tue Feb 23 20:16:53 2016 +1100
put back portable patchlevel to p1
commit 555dd35ff176847e3c6bd068ba2e8db4022eb24f
Author: djm@openbsd.org <djm@openbsd.org>
Date: Tue Feb 23 09:14:34 2016 +0000
upstream commit
openssh-7.2
Upstream-ID: 9db776b26014147fc907ece8460ef2bcb0f11e78
commit 1acc058d0a7913838c830ed998a1a1fb5b7864bf
Author: Damien Miller <djm@mindrot.org>
Date: Tue Feb 23 16:12:13 2016 +1100
Disable tests where fs perms are incorrect
Some tests have strict requirements on the filesystem permissions
for certain files and directories. This adds a regress/check-perm
tool that copies the relevant logic from sshd to exactly test
the paths in question. This lets us skip tests when the local
filesystem doesn't conform to our expectations rather than
continuing and failing the test run.
ok dtucker@
commit 39f303b1f36d934d8410b05625f25c7bcb75db4d
Author: Damien Miller <djm@mindrot.org>
Date: Tue Feb 23 12:56:59 2016 +1100
fix sandbox on OSX Lion
sshd was failing with:
ssh_sandbox_child: sandbox_init: dlopen(/usr/lib/libsandbox.1.dylib, 261):cw
image not found [preauth]
caused by chroot before sandboxing. Avoid by explicitly linking libsandbox
to sshd. Spotted by Darren.
commit 0d1451a32c7436e6d3d482351e776bc5e7824ce4
Author: djm@openbsd.org <djm@openbsd.org>
Date: Tue Feb 23 01:34:14 2016 +0000
upstream commit
fix spurious error message when incorrect passphrase
entered for keys; reported by espie@ ok deraadt@
Upstream-ID: 58b2e46e63ed6912ed1ee780bd3bd8560f9a5899
commit 09d87d79741beb85768b5e788d7dfdf4bc3543dc
Author: sobrado@openbsd.org <sobrado@openbsd.org>
Date: Sat Feb 20 23:06:23 2016 +0000
upstream commit
set ssh(1) protocol version to 2 only.
ok djm@
Upstream-ID: e168daf9d27d7e392e3c9923826bd8e87b2b3a10
commit 9262e07826ba5eebf8423f7ac9e47ec488c47869
Author: sobrado@openbsd.org <sobrado@openbsd.org>
Date: Sat Feb 20 23:02:39 2016 +0000
upstream commit
add missing ~/.ssh/id_ecdsa and ~/.ssh/id_ed25519 to
IdentityFile.
ok djm@
Upstream-ID: 6ce99466312e4ae7708017c3665e3edb976f70cf
commit c12f0fdce8f985fca8d71829fd64c5b89dc777f5
Author: sobrado@openbsd.org <sobrado@openbsd.org>
Date: Sat Feb 20 23:01:46 2016 +0000
upstream commit
AddressFamily defaults to any.
ok djm@
Upstream-ID: 0d94aa06a4b889bf57a7f631c45ba36d24c13e0c
commit 907091acb188b1057d50c2158f74c3ecf1c2302b
Author: Darren Tucker <dtucker@zip.com.au>
Date: Fri Feb 19 09:05:39 2016 +1100
Make Solaris privs code build on older systems.
Not all systems with Solaris privs have priv_basicset so factor that
out and provide backward compatibility code. Similarly, not all have
PRIV_NET_ACCESS so wrap that in #ifdef. Based on code from
alex at cooperi.net and djm@ with help from carson at taltos.org and
wieland at purdue.edu.
commit 292a8dee14e5e67dcd1b49ba5c7b9023e8420d59
Author: djm@openbsd.org <djm@openbsd.org>
Date: Wed Feb 17 22:20:14 2016 +0000
upstream commit
rekey refactor broke SSH1; spotted by Tom G. Christensen
Upstream-ID: 43f0d57928cc077c949af0bfa71ef574dcb58243
commit 3a13cb543df9919aec2fc6b75f3dd3802facaeca
Author: djm@openbsd.org <djm@openbsd.org>
Date: Wed Feb 17 08:57:34 2016 +0000
upstream commit
rsa-sha2-512,rsa-sha2-256 cannot be selected explicitly
in *KeyTypes options yet. Remove them from the lists of algorithms for now.
committing on behalf of markus@ ok djm@
Upstream-ID: c6e8820eb8e610ac21551832c0c89684a9a51bb7
commit a685ae8d1c24fb7c712c55a4f3280ee76f5f1e4b
Author: jmc@openbsd.org <jmc@openbsd.org>
Date: Wed Feb 17 07:38:19 2016 +0000
upstream commit
since these pages now clearly tell folks to avoid v1,
normalise the docs from a v2 perspective (i.e. stop pointing out which bits
are v2 only);
ok/tweaks djm ok markus
Upstream-ID: eb474f8c36fb6a532dc05c282f7965e38dcfa129
commit c5c3f3279a0e4044b8de71b70d3570d692d0f29d
Author: djm@openbsd.org <djm@openbsd.org>
Date: Wed Feb 17 05:29:04 2016 +0000
upstream commit
make sandboxed privilege separation the default, not just
for new installs; "absolutely" deraadt@
Upstream-ID: 5221ef3b927d2df044e9aa3f5db74ae91743f69b
commit eb3f7337a651aa01d5dec019025e6cdc124ed081
Author: jmc@openbsd.org <jmc@openbsd.org>
Date: Tue Feb 16 07:47:54 2016 +0000
upstream commit
no need to state that protocol 2 is the default twice;
Upstream-ID: b1e4c36b0c2e12e338e5b66e2978f2ac953b95eb
commit e7901efa9b24e5b0c7e74f2c5520d47eead4d005
Author: djm@openbsd.org <djm@openbsd.org>
Date: Tue Feb 16 05:11:04 2016 +0000
upstream commit
Replace list of ciphers and MACs adjacent to -1/-2 flag
descriptions in ssh(1) with a strong recommendation not to use protocol 1.
Add a similar warning to the Protocol option descriptions in ssh_config(5)
and sshd_config(5);
prompted by and ok mmcc@
Upstream-ID: 961f99e5437d50e636feca023978950a232ead5e
commit 5a0fcb77287342e2fc2ba1cee79b6af108973dc2
Author: djm@openbsd.org <djm@openbsd.org>
Date: Tue Feb 16 03:37:48 2016 +0000
upstream commit
add a "Close session" log entry (at loglevel=verbose) to
correspond to the existing "Starting session" one. Also include the session
id number to make multiplexed sessions more apparent.
feedback and ok dtucker@
Upstream-ID: e72d2ac080e02774376325136e532cb24c2e617c
commit 624fd395b559820705171f460dd33d67743d13d6
Author: djm@openbsd.org <djm@openbsd.org>
Date: Wed Feb 17 02:24:17 2016 +0000
upstream commit
include bad $SSH_CONNECTION in failure output
Upstream-Regress-ID: b22d72edfde78c403aaec2b9c9753ef633cc0529
commit 60d860e54b4f199e5e89963b1c086981309753cb
Author: Darren Tucker <dtucker@zip.com.au>
Date: Wed Feb 17 13:37:09 2016 +1100
Rollback addition of va_start.
va_start was added in 0f754e29dd3760fc0b172c1220f18b753fb0957e, however
it has the wrong number of args and it's not usable in non-variadic
functions anyway so it breaks things (for example Solaris 2.6 as
reported by Tom G. Christensen).i ok djm@
commit 2fee909c3cee2472a98b26eb82696297b81e0d38
Author: Darren Tucker <dtucker@zip.com.au>
Date: Wed Feb 17 09:48:15 2016 +1100
Look for gethostbyname in libresolv and libnsl.
Should fix build problem on Solaris 2.6 reported by Tom G. Christensen.
commit 5ac712d81a84396aab441a272ec429af5b738302
Author: Damien Miller <djm@mindrot.org>
Date: Tue Feb 16 10:45:02 2016 +1100
make existing ssh_malloc_init only for __OpenBSD__
commit 24c9bded569d9f2449ded73f92fb6d12db7a9eec
Author: djm@openbsd.org <djm@openbsd.org>
Date: Mon Feb 15 23:32:37 2016 +0000
upstream commit
memleak of algorithm name in mm_answer_sign; reported by
Jakub Jelen
Upstream-ID: ccd742cd25952240ebd23d7d4d6b605862584d08
commit ffb1e7e896139a42ceb78676f637658f44612411
Author: dtucker@openbsd.org <dtucker@openbsd.org>
Date: Mon Feb 15 09:47:49 2016 +0000
upstream commit
Add a function to enable security-related malloc_options.
With and ok deraadt@, something similar has been in the snaps for a while.
Upstream-ID: 43a95523b832b7f3b943d2908662191110c380ed
commit ef39e8c0497ff0564990a4f9e8b7338b3ba3507c
Author: Damien Miller <djm@mindrot.org>
Date: Tue Feb 16 10:34:39 2016 +1100
sync ssh-copy-id with upstream 783ef08b0a75
commit d2d772f55b19bb0e8d03c2fe1b9bb176d9779efd
Author: djm@openbsd.org <djm@openbsd.org>
Date: Fri Feb 12 00:20:30 2016 +0000
upstream commit
avoid fatal() for PKCS11 tokens that present empty key IDs
bz#1773, ok markus@
Upstream-ID: 044a764fee526f2c4a9d530bd10695422d01fc54
commit e4c918a6c721410792b287c9fd21356a1bed5805
Author: djm@openbsd.org <djm@openbsd.org>
Date: Thu Feb 11 02:56:32 2016 +0000
upstream commit
sync crypto algorithm lists in ssh_config(5) and
sshd_config(5) with current reality. bz#2527
Upstream-ID: d7fd1b6c1ed848d866236bcb1d7049d2bb9b2ff6
commit e30cabfa4ab456a30b3224f7f545f1bdfc4a2517
Author: djm@openbsd.org <djm@openbsd.org>
Date: Thu Feb 11 02:21:34 2016 +0000
upstream commit
fix regression in openssh-6.8 sftp client: existing
destination directories would incorrectly terminate recursive uploads;
bz#2528
Upstream-ID: 3306be469f41f26758e3d447987ac6d662623e18
commit 714e367226ded4dc3897078be48b961637350b05
Author: djm@openbsd.org <djm@openbsd.org>
Date: Tue Feb 9 05:30:04 2016 +0000
upstream commit
turn off more old crypto in the client: hmac-md5, ripemd,
truncated HMACs, RC4, blowfish. ok markus@ dtucker@
Upstream-ID: 96aa11c2c082be45267a690c12f1d2aae6acd46e
commit 5a622844ff7f78dcb75e223399f9ef0977e8d0a3
Author: djm@openbsd.org <djm@openbsd.org>
Date: Mon Feb 8 23:40:12 2016 +0000
upstream commit
don't attempt to percent_expand() already-canonicalised
addresses, avoiding unnecessary failures when attempting to connect to scoped
IPv6 addresses (that naturally contain '%' characters)
Upstream-ID: f24569cffa1a7cbde5f08dc739a72f4d78aa5c6a
commit 19bcf2ea2d17413f2d9730dd2a19575ff86b9b6a
Author: djm@openbsd.org <djm@openbsd.org>
Date: Mon Feb 8 10:57:07 2016 +0000
upstream commit
refactor activation of rekeying
This makes automatic rekeying internal to the packet code (previously
the server and client loops needed to assist). In doing to it makes
application of rekey limits more accurate by accounting for packets
about to be sent as well as packets queued during rekeying events
themselves.
Based on a patch from dtucker@ which was in turn based on a patch
Aleksander Adamowski in bz#2521; ok markus@
Upstream-ID: a441227fd64f9739850ca97b4cf794202860fcd8
commit 603ba41179e4b53951c7b90ee95b6ef3faa3f15d
Author: naddy@openbsd.org <naddy@openbsd.org>
Date: Fri Feb 5 13:28:19 2016 +0000
upstream commit
Only check errno if read() has returned an error. EOF is
not an error. This fixes a problem where the mux master would sporadically
fail to notice that the client had exited. ok mikeb@ djm@
Upstream-ID: 3c2dadc21fac6ef64665688aac8a75fffd57ae53
commit 56d7dac790693ce420d225119283bc355cff9185
Author: jsg@openbsd.org <jsg@openbsd.org>
Date: Fri Feb 5 04:31:21 2016 +0000
upstream commit
avoid an uninitialised value when NumberOfPasswordPrompts
is 0 ok markus@ djm@
Upstream-ID: 11b068d83c2865343aeb46acf1e9eec00f829b6b
commit deae7d52d59c5019c528f977360d87fdda15d20b
Author: djm@openbsd.org <djm@openbsd.org>
Date: Fri Feb 5 03:07:06 2016 +0000
upstream commit
mention internal DH-GEX fallback groups; bz#2302
Upstream-ID: e7b395fcca3122cd825515f45a2e41c9a157e09e
commit cac3b6665f884d46192c0dc98a64112e8b11a766
Author: djm@openbsd.org <djm@openbsd.org>
Date: Fri Feb 5 02:37:56 2016 +0000
upstream commit
better description for MaxSessions; bz#2531
Upstream-ID: e2c0d74ee185cd1a3e9d4ca1f1b939b745b354da
commit 5ef4b0fdcc7a239577a754829b50022b91ab4712
Author: Damien Miller <djm@mindrot.org>
Date: Wed Jan 27 17:45:56 2016 +1100
avoid FreeBSD RCS Id in comment
Change old $FreeBSD version string in comment so it doesn't
become an RCS ident downstream; requested by des AT des.no
commit 696d12683c90d20a0a9c5f4275fc916b7011fb04
Author: djm@openbsd.org <djm@openbsd.org>
Date: Thu Feb 4 23:43:48 2016 +0000
upstream commit
printf argument casts to avoid warnings on strict
compilers
Upstream-ID: 7b9f6712cef01865ad29070262d366cf13587c9c
commit 5658ef2501e785fbbdf5de2dc33b1ff7a4dca73a
Author: millert@openbsd.org <millert@openbsd.org>
Date: Mon Feb 1 21:18:17 2016 +0000
upstream commit
Avoid ugly "DISPLAY "(null)" invalid; disabling X11
forwarding" message when DISPLAY is not set. This could also result in a
crash on systems with a printf that doesn't handle NULL. OK djm@
Upstream-ID: 20ee0cfbda678a247264c20ed75362042b90b412
commit 537f88ec7bcf40bd444ac5584c707c5588c55c43
Author: dtucker@openbsd.org <dtucker@openbsd.org>
Date: Fri Jan 29 05:18:15 2016 +0000
upstream commit
Add regression test for RekeyLimit parsing of >32bit values
(4G and 8G).
Upstream-Regress-ID: 548390350c62747b6234f522a99c319eee401328
commit 4c6cb8330460f94e6c7ae28a364236d4188156a3
Author: dtucker@openbsd.org <dtucker@openbsd.org>
Date: Fri Jan 29 23:04:46 2016 +0000
upstream commit
Remove leftover roaming dead code. ok djm markus.
Upstream-ID: 13d1f9c8b65a5109756bcfd3b74df949d53615be
commit 28136471809806d6246ef41e4341467a39fe2f91
Author: djm@openbsd.org <djm@openbsd.org>
Date: Fri Jan 29 05:46:01 2016 +0000
upstream commit
include packet type of non-data packets in debug3 output;
ok markus dtucker
Upstream-ID: 034eaf639acc96459b9c5ce782db9fcd8bd02d41
commit 6fd6e28daccafaa35f02741036abe64534c361a1
Author: dtucker@openbsd.org <dtucker@openbsd.org>
Date: Fri Jan 29 03:31:03 2016 +0000
upstream commit
Revert "account for packets buffered but not yet
processed" change as it breaks for very small RekeyLimit values due to
continuous rekeying. ok djm@
Upstream-ID: 7e03f636cb45ab60db18850236ccf19079182a19
commit 921ff00b0ac429666fb361d2d6cb1c8fff0006cb
Author: dtucker@openbsd.org <dtucker@openbsd.org>
Date: Fri Jan 29 02:54:45 2016 +0000
upstream commit
Allow RekeyLimits in excess of 4G up to 2**63 bits
(limited by the return type of scan_scaled). Part of bz#2521, ok djm.
Upstream-ID: 13bea82be566b9704821b1ea05bf7804335c7979
commit c0060a65296f01d4634f274eee184c0e93ba0f23
Author: dtucker@openbsd.org <dtucker@openbsd.org>
Date: Fri Jan 29 02:42:46 2016 +0000
upstream commit
Account for packets buffered but not yet processed when
computing whether or not it is time to perform rekeying. bz#2521, based
loosely on a patch from olo at fb.com, ok djm@
Upstream-ID: 67e268b547f990ed220f3cb70a5624d9bda12b8c
commit 44cf930e670488c85c9efeb373fa5f4b455692ac
Author: djm@openbsd.org <djm@openbsd.org>
Date: Wed Jan 27 06:44:58 2016 +0000
upstream commit
change old $FreeBSD version string in comment so it doesn't
become an RCS ident downstream; requested by des AT des.no
Upstream-ID: 8ca558c01f184e596b45e4fc8885534b2c864722
commit ebacd377769ac07d1bf3c75169644336056b7060
Author: djm@openbsd.org <djm@openbsd.org>
Date: Wed Jan 27 00:53:12 2016 +0000
upstream commit
make the debug messages a bit more useful here
Upstream-ID: 478ccd4e897e0af8486b294aa63aa3f90ab78d64
commit 458abc2934e82034c5c281336d8dc0f910aecad3
Author: jsg@openbsd.org <jsg@openbsd.org>
Date: Sat Jan 23 05:31:35 2016 +0000
upstream commit
Zero a stack buffer with explicit_bzero() instead of
memset() when returning from client_loop() for consistency with
buffer_free()/sshbuf_free().
ok dtucker@ deraadt@ djm@
Upstream-ID: bc9975b2095339811c3b954694d7d15ea5c58f66
commit 65a3c0dacbc7dbb75ddb6a70ebe22d8de084d0b0
Author: dtucker@openbsd.org <dtucker@openbsd.org>
Date: Wed Jan 20 09:22:39 2016 +0000
upstream commit
Include sys/time.h for gettimeofday. From sortie at
maxsi.org.
Upstream-ID: 6ed0c33b836d9de0a664cd091e86523ecaa2fb3b
commit fc77ccdc2ce6d5d06628b8da5048a6a5f6ffca5a
Author: markus@openbsd.org <markus@openbsd.org>
Date: Thu Jan 14 22:56:56 2016 +0000
upstream commit
fd leaks; report Qualys Security Advisory team; ok
deraadt@
Upstream-ID: 4ec0f12b9d8fa202293c9effa115464185aa071d
commit a306863831c57ec5fad918687cc5d289ee8e2635
Author: markus@openbsd.org <markus@openbsd.org>
Date: Thu Jan 14 16:17:39 2016 +0000
upstream commit
remove roaming support; ok djm@
Upstream-ID: 2cab8f4b197bc95776fb1c8dc2859dad0c64dc56
commit 6ef49e83e30688504552ac10875feabd5521565f
Author: deraadt@openbsd.org <deraadt@openbsd.org>
Date: Thu Jan 14 14:34:34 2016 +0000
upstream commit
Disable experimental client-side roaming support. Server
side was disabled/gutted for years already, but this aspect was surprisingly
forgotten. Thanks for report from Qualys
Upstream-ID: 2328004b58f431a554d4c1bf67f5407eae3389df
commit 8d7b523b96d3be180572d9d338cedaafc0570f60
Author: Damien Miller <djm@mindrot.org>
Date: Thu Jan 14 11:08:19 2016 +1100
bump version numbers
commit 8c3d512a1fac8b9c83b4d0c9c3f2376290bd84ca
Author: Damien Miller <djm@mindrot.org>
Date: Thu Jan 14 11:04:04 2016 +1100
openssh-7.1p2
commit e6c85f8889c5c9eb04796fdb76d2807636b9eef5
Author: Damien Miller <djm@mindrot.org>
Date: Fri Jan 15 01:30:36 2016 +1100
forcibly disable roaming support in the client
commit ed4ce82dbfa8a3a3c8ea6fa0db113c71e234416c
Author: djm@openbsd.org <djm@openbsd.org>
Date: Wed Jan 13 23:04:47 2016 +0000
upstream commit
eliminate fallback from untrusted X11 forwarding to trusted
forwarding when the X server disables the SECURITY extension; Reported by
Thomas Hoger; ok deraadt@
Upstream-ID: f76195bd2064615a63ef9674a0e4096b0713f938
commit 9a728cc918fad67c8a9a71201088b1e150340ba4
Author: djm@openbsd.org <djm@openbsd.org>
Date: Tue Jan 12 23:42:54 2016 +0000
upstream commit
use explicit_bzero() more liberally in the buffer code; ok
deraadt
Upstream-ID: 0ece37069fd66bc6e4f55eb1321f93df372b65bf
commit 4626cbaf78767fc8e9c86dd04785386c59ae0839
Author: Damien Miller <djm@mindrot.org>
Date: Fri Jan 8 14:24:56 2016 +1100
Support Illumos/Solaris fine-grained privileges
Includes a pre-auth privsep sandbox and several pledge()
emulations. bz#2511, patch by Alex Wilson.
ok dtucker@
commit 422d1b3ee977ff4c724b597fb2e437d38fc8de9d
Author: djm@openbsd.org <djm@openbsd.org>
Date: Thu Dec 31 00:33:52 2015 +0000
upstream commit
fix three bugs in KRL code related to (unused) signature
support: verification length was being incorrectly calculated, multiple
signatures were being incorrectly processed and a NULL dereference that
occurred when signatures were verified. Reported by Carl Jackson
Upstream-ID: e705e97ad3ccce84291eaa651708dd1b9692576b
commit 6074c84bf95d00f29cc7d5d3cd3798737851aa1a
Author: djm@openbsd.org <djm@openbsd.org>
Date: Wed Dec 30 23:46:14 2015 +0000
upstream commit
unused prototype
Upstream-ID: f3eef4389d53ed6c0d5c77dcdcca3060c745da97
commit 6213f0e180e54122bb1ba928e11c784e2b4e5380
Author: guenther@openbsd.org <guenther@openbsd.org>
Date: Sat Dec 26 20:51:35 2015 +0000
upstream commit
Use pread/pwrite instead separate lseek+read/write for
lastlog. Cast to off_t before multiplication to avoid truncation on ILP32
ok kettenis@ mmcc@
Upstream-ID: fc40092568cd195719ddf1a00aa0742340d616cf
commit d7d2bc95045a43dd56ea696cc1d030ac9d77e81f
Author: semarie@openbsd.org <semarie@openbsd.org>
Date: Sat Dec 26 07:46:03 2015 +0000
upstream commit
adjust pledge promises for ControlMaster: when using
"ask" or "autoask", the process will use ssh-askpass for asking confirmation.
problem found by halex@
ok halex@
Upstream-ID: 38a58b30ae3eef85051c74d3c247216ec0735f80
commit 271df8185d9689b3fb0523f58514481b858f6843
Author: djm@openbsd.org <djm@openbsd.org>
Date: Sun Dec 13 22:42:23 2015 +0000
upstream commit
unbreak connections with peers that set
first_kex_follows; fix from Matt Johnston va bz#2515
Upstream-ID: decc88ec4fc7515594fdb42b04aa03189a44184b
commit 43849a47c5f8687699eafbcb5604f6b9c395179f
Author: doug@openbsd.org <doug@openbsd.org>
Date: Fri Dec 11 17:41:37 2015 +0000
upstream commit
Add "id" to ssh-agent pledge for subprocess support.
Found the hard way by Jan Johansson when using ssh-agent with X. Also,
rearranged proc/exec and retval to match other pledge calls in the tree.
ok djm@
Upstream-ID: 914255f6850e5e7fa830a2de6c38605333b584db
commit 52d7078421844b2f88329f5be3de370b0a938636
Author: mmcc@openbsd.org <mmcc@openbsd.org>
Date: Fri Dec 11 04:21:11 2015 +0000
upstream commit
Remove NULL-checks before sshbuf_free().
ok djm@
Upstream-ID: 5ebed00ed5f9f03b119a345085e8774565466917
commit a4b9e0f4e4a6980a0eb8072f76ea611cab5b77e7
Author: djm@openbsd.org <djm@openbsd.org>
Date: Fri Dec 11 03:24:25 2015 +0000
upstream commit
include remote port number in a few more messages; makes
tying log messages together into a session a bit easier; bz#2503 ok dtucker@
Upstream-ID: 9300dc354015f7a7368d94a8ff4a4266a69d237e
commit 6091c362e89079397e68744ae30df121b0a72c07
Author: djm@openbsd.org <djm@openbsd.org>
Date: Fri Dec 11 03:20:09 2015 +0000
upstream commit
don't try to load SSHv1 private key when compiled without
SSHv1 support. From Iain Morgan bz#2505
Upstream-ID: 8b8e7b02a448cf5e5635979df2d83028f58868a7
commit cce6a36bb95e81fa8bfb46daf22eabcf13afc352
Author: djm@openbsd.org <djm@openbsd.org>
Date: Fri Dec 11 03:19:09 2015 +0000
upstream commit
use SSH_MAX_PUBKEY_BYTES consistently as buffer size when
reading key files. Increase it to match the size of the buffers already being
used.
Upstream-ID: 1b60586b484b55a947d99a0b32bd25e0ced56fae
commit 89540b6de025b80404a0cb8418c06377f3f98848
Author: mmcc@openbsd.org <mmcc@openbsd.org>
Date: Fri Dec 11 02:31:47 2015 +0000
upstream commit
Remove NULL-checks before sshkey_free().
ok djm@
Upstream-ID: 3e35afe8a25e021216696b5d6cde7f5d2e5e3f52
commit 79394ed6d74572c2d2643d73937dad33727fc240
Author: dtucker@openbsd.org <dtucker@openbsd.org>
Date: Fri Dec 11 02:29:03 2015 +0000
upstream commit
fflush stdout so that output is seen even when running in
debug mode when output may otherwise not be flushed. Patch from dustin at
null-ptr.net.
Upstream-ID: b0c6b4cd2cdb01d7e9eefbffdc522e35b5bc4acc
commit ee607cccb6636eb543282ba90e0677b0604d8b7a
Author: Darren Tucker <dtucker@zip.com.au>
Date: Tue Dec 15 15:23:49 2015 +1100
Increase robustness of redhat/openssh.spec
- remove configure --with-rsh, because this option isn't supported anymore
- replace last occurrence of BuildPreReq by BuildRequires
- update grep statement to query the krb5 include directory
Patch from CarstenGrohmann via github, ok djm.
commit b5fa0cd73555b991a543145603658d7088ec6b60
Author: Darren Tucker <dtucker@zip.com.au>
Date: Tue Dec 15 15:10:32 2015 +1100
Allow --without-ssl-engine with --without-openssl
Patch from Mike Frysinger via github.
commit c1d7e546f6029024f3257cc25c92f2bddf163125
Author: Darren Tucker <dtucker@zip.com.au>
Date: Tue Dec 15 14:27:09 2015 +1100
Include openssl crypto.h for SSLeay.
Patch from doughdemon via github.
commit c6f5f01651526e88c00d988ce59d71f481ebac62
Author: Darren Tucker <dtucker@zip.com.au>
Date: Tue Dec 15 13:59:12 2015 +1100
Add sys/time.h for gettimeofday.
Should allow it it compile with MUSL libc. Based on patch from
doughdemon via github.
commit 39736be06c7498ef57d6970f2d85cf066ae57c82
Author: djm@openbsd.org <djm@openbsd.org>
Date: Fri Dec 11 02:20:28 2015 +0000
upstream commit
correct error messages; from Tomas Kuthan bz#2507
Upstream-ID: 7454a0affeab772398052954c79300aa82077093
commit 94141b7ade24afceeb6762a3f99e09e47a6c42b6
Author: mmcc@openbsd.org <mmcc@openbsd.org>
Date: Fri Dec 11 00:20:04 2015 +0000
upstream commit
Pass (char *)NULL rather than (char *)0 to execl and
execlp.
ok dtucker@
Upstream-ID: 56c955106cbddba86c3dd9bbf786ac0d1b361492
commit d59ce08811bf94111c2f442184cf7d1257ffae24
Author: mmcc@openbsd.org <mmcc@openbsd.org>
Date: Thu Dec 10 17:08:40 2015 +0000
upstream commit
Remove NULL-checks before free().
ok dtucker@
Upstream-ID: e3d3cb1ce900179906af36517b5eea0fb15e6ef8
commit 8e56dd46cb37879c73bce2d6032cf5e7f82d5a71
Author: mmcc@openbsd.org <mmcc@openbsd.org>
Date: Thu Dec 10 07:01:35 2015 +0000
upstream commit
Fix a couple "the the" typos. ok dtucker@
Upstream-ID: ec364c5af32031f013001fd28d1bd3dfacfe9a72
commit 6262a0522ddc2c0f2e9358dcb68d59b46e9c533e
Author: markus@openbsd.org <markus@openbsd.org>
Date: Mon Dec 7 20:04:09 2015 +0000
upstream commit
stricter encoding type checks for ssh-rsa; ok djm@
Upstream-ID: 8cca7c787599a5e8391e184d0b4f36fdc3665650
commit d86a3ba7af160c13496102aed861ae48a4297072
Author: Damien Miller <djm@mindrot.org>
Date: Wed Dec 9 09:18:45 2015 +1100
Don't set IPV6_V6ONLY on OpenBSD
It isn't necessary and runs afoul of pledge(2) restrictions.
commit da98c11d03d819a15429d8fff9688acd7505439f
Author: djm@openbsd.org <djm@openbsd.org>
Date: Mon Dec 7 02:20:46 2015 +0000
upstream commit
basic unit tests for rsa-sha2-* signature types
Upstream-Regress-ID: 7dc4b9db809d578ff104d591b4d86560c3598d3c
commit 3da893fdec9936dd2c23739cdb3c0c9d4c59fca0
Author: markus@openbsd.org <markus@openbsd.org>
Date: Sat Dec 5 20:53:21 2015 +0000
upstream commit
prefer rsa-sha2-512 over -256 for hostkeys, too; noticed
by naddy@
Upstream-ID: 685f55f7ec566a8caca587750672723a0faf3ffe
commit 8b56e59714d87181505e4678f0d6d39955caf10e
Author: tobias@openbsd.org <tobias@openbsd.org>
Date: Fri Dec 4 21:51:06 2015 +0000
upstream commit
Properly handle invalid %-format by calling fatal.
ok deraadt, djm
Upstream-ID: 5692bce7d9f6eaa9c488cb93d3b55e758bef1eac
commit 76c9fbbe35aabc1db977fb78e827644345e9442e
Author: markus@openbsd.org <markus@openbsd.org>
Date: Fri Dec 4 16:41:28 2015 +0000
upstream commit
implement SHA2-{256,512} for RSASSA-PKCS1-v1_5 signatures
(user and host auth) based on draft-rsa-dsa-sha2-256-03.txt and
draft-ssh-ext-info-04.txt; with & ok djm@
Upstream-ID: cf82ce532b2733e5c4b34bb7b7c94835632db309
commit 6064a8b8295cb5a17b5ebcfade53053377714f40
Author: djm@openbsd.org <djm@openbsd.org>
Date: Fri Dec 4 00:24:55 2015 +0000
upstream commit
clean up agent_fd handling; properly initialise it to -1
and make tests consistent
ok markus@
Upstream-ID: ac9554323d5065745caf17b5e37cb0f0d4825707
commit b91926a97620f3e51761c271ba57aa5db790f48d
Author: semarie@openbsd.org <semarie@openbsd.org>
Date: Thu Dec 3 17:00:18 2015 +0000
upstream commit
pledges ssh client: - mux client: which is used when
ControlMaster is in use. will end with "stdio proc tty" (proc is to
permit sending SIGWINCH to mux master on window resize)
- client loop: several levels of pledging depending of your used options
ok deraadt@
Upstream-ID: 21676155a700e51f2ce911e33538e92a2cd1d94b
commit bcce47466bbc974636f588b5e4a9a18ae386f64a
Author: doug@openbsd.org <doug@openbsd.org>
Date: Wed Dec 2 08:30:50 2015 +0000
upstream commit
Add "cpath" to the ssh-agent pledge so the cleanup
handler can unlink().
ok djm@
Upstream-ID: 9e632991d48241d56db645602d381253a3d8c29d
commit a90d001543f46716b6590c6dcc681d5f5322f8cf
Author: djm@openbsd.org <djm@openbsd.org>
Date: Wed Dec 2 08:00:58 2015 +0000
upstream commit
ssh-agent pledge needs proc for askpass; spotted by todd@
Upstream-ID: 349aa261b29cc0e7de47ef56167769c432630b2a
commit d952162b3c158a8f23220587bb6c8fcda75da551
Author: djm@openbsd.org <djm@openbsd.org>
Date: Tue Dec 1 23:29:24 2015 +0000
upstream commit
basic pledge() for ssh-agent, more refinement needed
Upstream-ID: 5b5b03c88162fce549e45e1b6dd833f20bbb5e13
commit f0191d7c8e76e30551084b79341886d9bb38e453
Author: Damien Miller <djm@mindrot.org>
Date: Mon Nov 30 10:53:25 2015 +1100
Revert "stub for pledge(2) for systems that lack it"
This reverts commit 14c887c8393adde2d9fd437d498be30f8c98535c.