120060201 2 - (djm) [regress/test-exec.sh] Try 'logname' as well as 'whoami' to 3 determine the user's login name - needed for regress tests on Solaris 4 10 and OpenSolaris 5 - (djm) OpenBSD CVS Sync 6 - jmc@cvs.openbsd.org 2006/02/01 09:06:50 7 [sshd.8] 8 - merge sections on protocols 1 and 2 into a single section 9 - remove configuration file section 10 ok markus 11 - jmc@cvs.openbsd.org 2006/02/01 09:11:41 12 [sshd.8] 13 small tweak; 14 - (djm) [contrib/caldera/openssh.spec contrib/redhat/openssh.spec] 15 [contrib/suse/openssh.spec] Update versions ahead of release 16 - markus@cvs.openbsd.org 2006/02/01 11:27:22 17 [version.h] 18 openssh 4.3 19 - (djm) Release OpenSSH 4.3p1 20 2120060131 22 - (djm) OpenBSD CVS Sync 23 - jmc@cvs.openbsd.org 2006/01/20 11:21:45 24 [ssh_config.5] 25 - word change, agreed w/ markus 26 - consistency fixes 27 - jmc@cvs.openbsd.org 2006/01/25 09:04:34 28 [sshd.8] 29 move the options description up the page, and a few additional tweaks 30 whilst in here; 31 ok markus 32 - jmc@cvs.openbsd.org 2006/01/25 09:07:22 33 [sshd.8] 34 move subsections to full sections; 35 - jmc@cvs.openbsd.org 2006/01/26 08:47:56 36 [ssh.1] 37 add a section on verifying host keys in dns; 38 written with a lot of help from jakob; 39 feedback dtucker/markus; 40 ok markus 41 - reyk@cvs.openbsd.org 2006/01/30 12:22:22 42 [channels.c] 43 mark channel as write failed or dead instead of read failed on error 44 of the channel output filter. 45 ok markus@ 46 - jmc@cvs.openbsd.org 2006/01/30 13:37:49 47 [ssh.1] 48 remove an incorrect sentence; 49 reported by roumen petrov; 50 ok djm markus 51 - djm@cvs.openbsd.org 2006/01/31 10:19:02 52 [misc.c misc.h scp.c sftp.c] 53 fix local arbitrary command execution vulnerability on local/local and 54 remote/remote copies (CVE-2006-0225, bz #1094), patch by 55 t8m AT centrum.cz, polished by dtucker@ and myself; ok markus@ 56 - djm@cvs.openbsd.org 2006/01/31 10:35:43 57 [scp.c] 58 "scp a b c" shouldn't clobber "c" when it is not a directory, report and 59 fix from biorn@; ok markus@ 60 - (djm) Sync regress tests to OpenBSD: 61 - dtucker@cvs.openbsd.org 2005/03/10 10:20:39 62 [regress/forwarding.sh] 63 Regress test for ClearAllForwardings (bz #994); ok markus@ 64 - dtucker@cvs.openbsd.org 2005/04/25 09:54:09 65 [regress/multiplex.sh] 66 Don't call cleanup in multiplex as test-exec will cleanup anyway 67 found by tim@, ok djm@ 68 NB. ID sync only, we already had this 69 - djm@cvs.openbsd.org 2005/05/20 23:14:15 70 [regress/test-exec.sh] 71 force addressfamily=inet for tests, unbreaking dynamic-forward regress for 72 recently committed nc SOCKS5 changes 73 - djm@cvs.openbsd.org 2005/05/24 04:10:54 74 [regress/try-ciphers.sh] 75 oops, new arcfour modes here too 76 - markus@cvs.openbsd.org 2005/06/30 11:02:37 77 [regress/scp.sh] 78 allow SUDO=sudo; from Alexander Bluhm 79 - grunk@cvs.openbsd.org 2005/11/14 21:25:56 80 [regress/agent-getpeereid.sh] 81 all other scripts in this dir use $SUDO, not 'sudo', so pull this even 82 ok markus@ 83 - dtucker@cvs.openbsd.org 2005/12/14 04:36:39 84 [regress/scp-ssh-wrapper.sh] 85 Fix assumption about how many args scp will pass; ok djm@ 86 NB. ID sync only, we already had this 87 - djm@cvs.openbsd.org 2006/01/27 06:49:21 88 [scp.sh] 89 regress test for local to local scp copies; ok dtucker@ 90 - djm@cvs.openbsd.org 2006/01/31 10:23:23 91 [scp.sh] 92 regression test for CVE-2006-0225 written by dtucker@ 93 - djm@cvs.openbsd.org 2006/01/31 10:36:33 94 [scp.sh] 95 regress test for "scp a b c" where "c" is not a directory 96 9720060129 98 - (dtucker) [configure.ac opensshd.init.in] Bug #1144: Use /bin/sh for the 99 opensshd.init script interpretter if /sbin/sh does not exist. ok tim@ 100 10120060120 102 - (dtucker) OpenBSD CVS Sync 103 - jmc@cvs.openbsd.org 2006/01/15 17:37:05 104 [ssh.1] 105 correction from deraadt 106 - jmc@cvs.openbsd.org 2006/01/18 10:53:29 107 [ssh.1] 108 add a section on ssh-based vpn, based on reyk's README.tun; 109 - dtucker@cvs.openbsd.org 2006/01/20 00:14:55 110 [scp.1 ssh.1 ssh_config.5 sftp.1] 111 Document RekeyLimit. Based on patch from jan.iven at cern.ch from mindrot 112 #1056 with feedback from jmc, djm and markus; ok jmc@ djm@ 113 11420060114 115 - (djm) OpenBSD CVS Sync 116 - jmc@cvs.openbsd.org 2006/01/06 13:27:32 117 [ssh.1] 118 weed out some duplicate info in the known_hosts FILES entries; 119 ok djm 120 - jmc@cvs.openbsd.org 2006/01/06 13:29:10 121 [ssh.1] 122 final round of whacking FILES for duplicate info, and some consistency 123 fixes; 124 ok djm 125 - jmc@cvs.openbsd.org 2006/01/12 14:44:12 126 [ssh.1] 127 split sections on tcp and x11 forwarding into two sections. 128 add an example in the tcp section, based on sth i wrote for ssh faq; 129 help + ok: djm markus dtucker 130 - jmc@cvs.openbsd.org 2006/01/12 18:48:48 131 [ssh.1] 132 refer to `TCP' rather than `TCP/IP' in the context of connection 133 forwarding; 134 ok markus 135 - jmc@cvs.openbsd.org 2006/01/12 22:20:00 136 [sshd.8] 137 refer to TCP forwarding, rather than TCP/IP forwarding; 138 - jmc@cvs.openbsd.org 2006/01/12 22:26:02 139 [ssh_config.5] 140 refer to TCP forwarding, rather than TCP/IP forwarding; 141 - jmc@cvs.openbsd.org 2006/01/12 22:34:12 142 [ssh.1] 143 back out a sentence - AUTHENTICATION already documents this; 144 14520060109 146 - (dtucker) [contrib/cygwin/ssh-host-config] Make sshd service depend on 147 tcpip service so it's always started after IP is up. Patch from 148 vinschen at redhat.com. 149 15020060106 151 - (djm) OpenBSD CVS Sync 152 - jmc@cvs.openbsd.org 2006/01/03 16:31:10 153 [ssh.1] 154 move FILES to a -compact list, and make each files an item in that list. 155 this avoids nastly line wrap when we have long pathnames, and treats 156 each file as a separate item; 157 remove the .Pa too, since it is useless. 158 - jmc@cvs.openbsd.org 2006/01/03 16:35:30 159 [ssh.1] 160 use a larger width for the ENVIRONMENT list; 161 - jmc@cvs.openbsd.org 2006/01/03 16:52:36 162 [ssh.1] 163 put FILES in some sort of order: sort by pathname 164 - jmc@cvs.openbsd.org 2006/01/03 16:55:18 165 [ssh.1] 166 tweak the description of ~/.ssh/environment 167 - jmc@cvs.openbsd.org 2006/01/04 18:42:46 168 [ssh.1] 169 chop out some duplication in the .{r,s}hosts/{h,sh}osts.equiv FILES 170 entries; 171 ok markus 172 - jmc@cvs.openbsd.org 2006/01/04 18:45:01 173 [ssh.1] 174 remove .Xr's to rsh(1) and telnet(1): they are hardly needed; 175 - jmc@cvs.openbsd.org 2006/01/04 19:40:24 176 [ssh.1] 177 +.Xr ssh-keyscan 1 , 178 - jmc@cvs.openbsd.org 2006/01/04 19:50:09 179 [ssh.1] 180 -.Xr gzip 1 , 181 - djm@cvs.openbsd.org 2006/01/05 23:43:53 182 [misc.c] 183 check that stdio file descriptors are actually closed before clobbering 184 them in sanitise_stdfd(). problems occurred when a lower numbered fd was 185 closed, but higher ones weren't. spotted by, and patch tested by 186 Fr�d�ric Olivi� 187 18820060103 189 - (djm) [channels.c] clean up harmless merge error, from reyk@ 190 19120060103 192 - (djm) OpenBSD CVS Sync 193 - jmc@cvs.openbsd.org 2006/01/02 17:09:49 194 [ssh_config.5 sshd_config.5] 195 some corrections from michael knudsen; 196 19720060102 198 - (djm) [README.tun] Add README.tun, missed during sync of tun(4) support 199 - (djm) OpenBSD CVS Sync 200 - jmc@cvs.openbsd.org 2005/12/31 10:46:17 201 [ssh.1] 202 merge the "LOGIN SESSION AND REMOTE EXECUTION" and "SERVER 203 AUTHENTICATION" sections into "AUTHENTICATION"; 204 some rewording done to make the text read better, plus some 205 improvements from djm; 206 ok djm 207 - jmc@cvs.openbsd.org 2005/12/31 13:44:04 208 [ssh.1] 209 clean up ENVIRONMENT a little; 210 - jmc@cvs.openbsd.org 2005/12/31 13:45:19 211 [ssh.1] 212 .Nm does not require an argument; 213 - stevesk@cvs.openbsd.org 2006/01/01 08:59:27 214 [includes.h misc.c] 215 move <net/if.h>; ok djm@ 216 - stevesk@cvs.openbsd.org 2006/01/01 10:08:48 217 [misc.c] 218 no trailing "\n" for debug() 219 - djm@cvs.openbsd.org 2006/01/02 01:20:31 220 [sftp-client.c sftp-common.h sftp-server.c] 221 use a common max. packet length, no binary change 222 - reyk@cvs.openbsd.org 2006/01/02 07:53:44 223 [misc.c] 224 clarify tun(4) opening - set the mode and bring the interface up. also 225 (re)sets the tun(4) layer 2 LINK0 flag for existing tunnel interfaces. 226 suggested and ok by djm@ 227 - jmc@cvs.openbsd.org 2006/01/02 12:31:06 228 [ssh.1] 229 start to cut some duplicate info from FILES; 230 help/ok djm 231 23220060101 233 - (djm) [Makefile.in configure.ac includes.h misc.c] 234 [openbsd-compat/port-tun.c openbsd-compat/port-tun.h] Add support 235 for tunnel forwarding for FreeBSD and NetBSD. NetBSD's support is 236 limited to IPv4 tunnels only, and most versions don't support the 237 tap(4) device at all. 238 - (djm) [configure.ac] Fix linux/if_tun.h test 239 - (djm) [openbsd-compat/port-tun.c] Linux needs linux/if.h too 240 24120051229 242 - (djm) OpenBSD CVS Sync 243 - stevesk@cvs.openbsd.org 2005/12/28 22:46:06 244 [canohost.c channels.c clientloop.c] 245 use 'break-in' for consistency; ok deraadt@ ok and input jmc@ 246 - reyk@cvs.openbsd.org 2005/12/30 15:56:37 247 [channels.c channels.h clientloop.c] 248 add channel output filter interface. 249 ok djm@, suggested by markus@ 250 - jmc@cvs.openbsd.org 2005/12/30 16:59:00 251 [sftp.1] 252 do not suggest that interactive authentication will work 253 with the -b flag; 254 based on a diff from john l. scarfone; 255 ok djm 256 - stevesk@cvs.openbsd.org 2005/12/31 01:38:45 257 [ssh.1] 258 document -MM; ok djm@ 259 - (djm) [openbsd-compat/port-tun.c openbsd-compat/port-tun.h configure.ac] 260 [serverloop.c ssh.c openbsd-compat/Makefile.in] 261 [openbsd-compat/openbsd-compat.h] Implement tun(4) forwarding 262 compatability support for Linux, diff from reyk@ 263 - (djm) [configure.ac] Disable Linux tun(4) compat code if linux/tun.h does 264 not exist 265 - (djm) [configure.ac] oops, make that linux/if_tun.h 266 26720051229 268 - (tim) [buildpkg.sh.in] grep for $SSHDUID instead of $SSHDGID on /etc/passwd 269 27020051224 271 - (djm) OpenBSD CVS Sync 272 - jmc@cvs.openbsd.org 2005/12/20 21:59:43 273 [ssh.1] 274 merge the sections on protocols 1 and 2 into one section on 275 authentication; 276 feedback djm dtucker 277 ok deraadt markus dtucker 278 - jmc@cvs.openbsd.org 2005/12/20 22:02:50 279 [ssh.1] 280 .Ss -> .Sh: subsections have not made this page more readable 281 - jmc@cvs.openbsd.org 2005/12/20 22:09:41 282 [ssh.1] 283 move info on ssh return values and config files up into the main 284 description; 285 - jmc@cvs.openbsd.org 2005/12/21 11:48:16 286 [ssh.1] 287 -L and -R descriptions are now above, not below, ~C description; 288 - jmc@cvs.openbsd.org 2005/12/21 11:57:25 289 [ssh.1] 290 options now described `above', rather than `later'; 291 - jmc@cvs.openbsd.org 2005/12/21 12:53:31 292 [ssh.1] 293 -Y does X11 forwarding too; 294 ok markus 295 - stevesk@cvs.openbsd.org 2005/12/21 22:44:26 296 [sshd.8] 297 clarify precedence of -p, Port, ListenAddress; ok and help jmc@ 298 - jmc@cvs.openbsd.org 2005/12/22 10:31:40 299 [ssh_config.5] 300 put the description of "UsePrivilegedPort" in the correct place; 301 - jmc@cvs.openbsd.org 2005/12/22 11:23:42 302 [ssh.1] 303 expand the description of -w somewhat; 304 help/ok reyk 305 - jmc@cvs.openbsd.org 2005/12/23 14:55:53 306 [ssh.1] 307 - sync the description of -e w/ synopsis 308 - simplify the description of -I 309 - note that -I is only available if support compiled in, and that it 310 isn't by default 311 feedback/ok djm@ 312 - jmc@cvs.openbsd.org 2005/12/23 23:46:23 313 [ssh.1] 314 less mark up for -c; 315 - djm@cvs.openbsd.org 2005/12/24 02:27:41 316 [session.c sshd.c] 317 eliminate some code duplicated in privsep and non-privsep paths, and 318 explicitly clear SIGALRM handler; "groovy" deraadt@ 319 32020051220 321 - (dtucker) OpenBSD CVS Sync 322 - reyk@cvs.openbsd.org 2005/12/13 15:03:02 323 [serverloop.c] 324 if forced_tun_device is not set, it is -1 and not SSH_TUNID_ANY 325 - jmc@cvs.openbsd.org 2005/12/16 18:07:08 326 [ssh.1] 327 move the option descriptions up the page: start of a restructure; 328 ok markus deraadt 329 - jmc@cvs.openbsd.org 2005/12/16 18:08:53 330 [ssh.1] 331 simplify a sentence; 332 - jmc@cvs.openbsd.org 2005/12/16 18:12:22 333 [ssh.1] 334 make the description of -c a little nicer; 335 - jmc@cvs.openbsd.org 2005/12/16 18:14:40 336 [ssh.1] 337 signpost the protocol sections; 338 - stevesk@cvs.openbsd.org 2005/12/17 21:13:05 339 [ssh_config.5 session.c] 340 spelling: fowarding, fowarded 341 - stevesk@cvs.openbsd.org 2005/12/17 21:36:42 342 [ssh_config.5] 343 spelling: intented -> intended 344 - dtucker@cvs.openbsd.org 2005/12/20 04:41:07 345 [ssh.c] 346 exit(255) on error to match description in ssh(1); bz #1137; ok deraadt@ 347 34820051219 349 - (dtucker) [cipher-aes.c cipher-ctr.c cipher.c configure.ac 350 openbsd-compat/openssl-compat.h] Check for and work around broken AES 351 ciphers >128bit on (some) Solaris 10 systems. ok djm@ 352 35320051217 354 - (dtucker) [defines.h] HP-UX system headers define "YES" and "NO" which 355 scp.c also uses, so undef them here. 356 - (dtucker) [configure.ac openbsd-compat/bsd-snprintf.c] Bug #1133: Our 357 snprintf replacement can have a conflicting declaration in HP-UX's system 358 headers (const vs. no const) so we now check for and work around it. Patch 359 from the dynamic duo of David Leonard and Ted Percival. 360 36120051214 362 - (dtucker) OpenBSD CVS Sync (regress/) 363 - dtucker@cvs.openbsd.org 2005/12/30 04:36:39 364 [regress/scp-ssh-wrapper.sh] 365 Fix assumption about how many args scp will pass; ok djm@ 366 36720051213 368 - (djm) OpenBSD CVS Sync 369 - jmc@cvs.openbsd.org 2005/11/30 11:18:27 370 [ssh.1] 371 timezone -> time zone 372 - jmc@cvs.openbsd.org 2005/11/30 11:45:20 373 [ssh.1] 374 avoid ambiguities in describing TZ; 375 ok djm@ 376 - reyk@cvs.openbsd.org 2005/12/06 22:38:28 377 [auth-options.c auth-options.h channels.c channels.h clientloop.c] 378 [misc.c misc.h readconf.c readconf.h scp.c servconf.c servconf.h] 379 [serverloop.c sftp.c ssh.1 ssh.c ssh_config ssh_config.5 sshconnect.c] 380 [sshconnect.h sshd.8 sshd_config sshd_config.5] 381 Add support for tun(4) forwarding over OpenSSH, based on an idea and 382 initial channel code bits by markus@. This is a simple and easy way to 383 use OpenSSH for ad hoc virtual private network connections, e.g. 384 administrative tunnels or secure wireless access. It's based on a new 385 ssh channel and works similar to the existing TCP forwarding support, 386 except that it depends on the tun(4) network interface on both ends of 387 the connection for layer 2 or layer 3 tunneling. This diff also adds 388 support for LocalCommand in the ssh(1) client. 389 ok djm@, markus@, jmc@ (manpages), tested and discussed with others 390 - djm@cvs.openbsd.org 2005/12/07 03:52:22 391 [clientloop.c] 392 reyk forgot to compile with -Werror (missing header) 393 - jmc@cvs.openbsd.org 2005/12/07 10:52:13 394 [ssh.1] 395 - avoid line split in SYNOPSIS 396 - add args to -w 397 - kill trailing whitespace 398 - jmc@cvs.openbsd.org 2005/12/08 14:59:44 399 [ssh.1 ssh_config.5] 400 make `!command' a little clearer; 401 ok reyk 402 - jmc@cvs.openbsd.org 2005/12/08 15:06:29 403 [ssh_config.5] 404 keep options in order; 405 - reyk@cvs.openbsd.org 2005/12/08 18:34:11 406 [auth-options.c includes.h misc.c misc.h readconf.c servconf.c] 407 [serverloop.c ssh.c ssh_config.5 sshd_config.5 configure.ac] 408 two changes to the new ssh tunnel support. this breaks compatibility 409 with the initial commit but is required for a portable approach. 410 - make the tunnel id u_int and platform friendly, use predefined types. 411 - support configuration of layer 2 (ethernet) or layer 3 412 (point-to-point, default) modes. configuration is done using the 413 Tunnel (yes|point-to-point|ethernet|no) option is ssh_config(5) and 414 restricted by the PermitTunnel (yes|point-to-point|ethernet|no) option 415 in sshd_config(5). 416 ok djm@, man page bits by jmc@ 417 - jmc@cvs.openbsd.org 2005/12/08 21:37:50 418 [ssh_config.5] 419 new sentence, new line; 420 - markus@cvs.openbsd.org 2005/12/12 13:46:18 421 [channels.c channels.h session.c] 422 make sure protocol messages for internal channels are ignored. 423 allow adjust messages for non-open channels; with and ok djm@ 424 - (djm) [misc.c] Disable tunnel code for non-OpenBSD (for now), enable 425 again by providing a sys_tun_open() function for your platform and 426 setting the CUSTOM_SYS_TUN_OPEN define. More work is required to match 427 OpenBSD's tunnel protocol, which prepends the address family to the 428 packet 429 43020051201 431 - (djm) [envpass.sh] Remove regress script that was accidentally committed 432 in top level directory and not noticed for over a year :) 433 43420051129 435 - (tim) [ssh-keygen.c] Move DSA length test after setting default when 436 bits == 0. 437 - (dtucker) OpenBSD CVS Sync 438 - dtucker@cvs.openbsd.org 2005/11/29 02:04:55 439 [ssh-keygen.c] 440 Populate default key sizes before checking them; from & ok tim@ 441 - (tim) [configure.ac sshd.8] Enable locked account check (a "*LK*" string) 442 for UnixWare. 443 44420051128 445 - (dtucker) [regress/yes-head.sh] Work around breakage caused by some 446 versions of GNU head. Based on patch from zappaman at buraphalinux.org 447 - (dtucker) [includes.h] Bug #1122: __USE_GNU is a glibc internal macro, use 448 _GNU_SOURCE instead. Patch from t8m at centrum.cz. 449 - (dtucker) OpenBSD CVS Sync 450 - dtucker@cvs.openbsd.org 2005/11/28 05:16:53 451 [ssh-keygen.1 ssh-keygen.c] 452 Enforce DSA key length of exactly 1024 bits to comply with FIPS-186-2, 453 increase minumum RSA key size to 768 bits and update man page to reflect 454 these. Patch originally bz#1119 (senthilkumar_sen at hotpop.com), 455 ok djm@, grudging ok deraadt@. 456 - dtucker@cvs.openbsd.org 2005/11/28 06:02:56 457 [ssh-agent.1] 458 Update agent socket path templates to reflect reality, correct xref for 459 time formats. bz#1121, patch from openssh at roumenpetrov.info, ok djm@ 460 46120051126 462 - (dtucker) [configure.ac] Bug #1126: AIX 5.2 and 5.3 (and presumably newer, 463 when they're available) need the real UID set otherwise pam_chauthtok will 464 set ADMCHG after changing the password, forcing the user to change it 465 again immediately. 466 46720051125 468 - (dtucker) [configure.ac] Apply tim's fix for older systems where the 469 resolver state in resolv.h is "state" not "__res_state". With slight 470 modification by me to also work on old AIXes. ok djm@ 471 - (dtucker) [progressmeter.c scp.c sftp-server.c] Use correct casts for 472 snprintf formats, fixes warnings on some 64 bit platforms. Patch from 473 shaw at vranix.com, ok djm@ 474 47520051124 476 - (djm) [configure.ac openbsd-compat/Makefile.in openbsd-compat/bsd-asprintf.c 477 openbsd-compat/bsd-snprintf.c openbsd-compat/openbsd-compat.h] Add an 478 asprintf() implementation, after syncing our {v,}snprintf() implementation 479 with some extra fixes from Samba's version. With help and debugging from 480 dtucker and tim; ok dtucker@ 481 - (dtucker) [configure.ac] Fix typos in comments and AC_SEARCH_LIB argument 482 order in Reliant Unix block. Patch from johane at lysator.liu.se. 483 - (dtucker) [regress/test-exec.sh] Use 1024 bit keys since we generate so 484 many and use them only once. Speeds up testing on older/slower hardware. 485 48620051122 487 - (dtucker) OpenBSD CVS Sync 488 - deraadt@cvs.openbsd.org 2005/11/12 18:37:59 489 [ssh-add.c] 490 space 491 - deraadt@cvs.openbsd.org 2005/11/12 18:38:15 492 [scp.c] 493 avoid close(-1), as in rcp; ok cloder 494 - millert@cvs.openbsd.org 2005/11/15 11:59:54 495 [includes.h] 496 Include sys/queue.h explicitly instead of assuming some other header 497 will pull it in. At the moment it gets pulled in by sys/select.h 498 (which ssh has no business including) via event.h. OK markus@ 499 (ID sync only in -portable) 500 - dtucker@cvs.openbsd.org 2005/11/21 09:42:10 501 [auth-krb5.c] 502 Perform Kerberos calls even for invalid users to prevent leaking 503 information about account validity. bz #975, patch originally from 504 Senthil Kumar, sanity checked by Simon Wilkinson, tested by djm@, biorn@, 505 ok markus@ 506 - dtucker@cvs.openbsd.org 2005/11/22 03:36:03 507 [hostfile.c] 508 Correct format/arguments to debug call; spotted by shaw at vranix.com 509 ok djm@ 510 - (dtucker) [loginrec.c] Add casts to prevent compiler warnings, patch 511 from shaw at vranix.com. 512 51320051120 514 - (dtucker) [openbsd-compat/openssl-compat.h] Add comment explaining what 515 is going on. 516 51720051112 518 - (dtucker) [openbsd-compat/getrrsetbyname.c] Restore Portable-specific 519 ifdef lost during sync. Spotted by tim@. 520 - (dtucker) [openbsd-compat/{realpath.c,stroll.c,rresvport.c}] $OpenBSD tag. 521 - (dtucker) [configure.ac] Use "$AWK" instead of "awk" in gcc version test. 522 - (dtucker) [configure.ac] Remove duplicate utimes() check. ok djm@ 523 - (dtucker) [regress/reconfigure.sh] Fix potential race in the reconfigure 524 test: if sshd takes too long to reconfigure the subsequent connection will 525 fail. Zap pidfile before HUPing sshd which will rewrite it when it's ready. 526 52720051110 528 - (dtucker) [openbsd-compat/setenv.c] Merge changes for __findenv from 529 OpenBSD getenv.c revs 1.4 - 1.8 (ANSIfication of arguments, removal of 530 "register"). 531 - (dtucker) [openbsd-compat/setenv.c] Make __findenv static, remove 532 unnecessary prototype. 533 - (dtucker) [openbsd-compat/setenv.c] Sync changes from OpenBSD setenv.c 534 revs 1.7 - 1.9. 535 - (dtucker) [auth-krb5.c] Fix -Wsign-compare warning in non-Heimdal path. 536 Patch from djm@. 537 - (dtucker) [configure.ac] Disable pointer-sign warnings on gcc 4.0+ 538 since they're not useful right now. Patch from djm@. 539 - (dtucker) [openbsd-compat/getgrouplist.c] Sync OpenBSD revs 1.10 - 1.2 (ANSI 540 prototypes, removal of "register"). 541 - (dtucker) [openbsd-compat/strlcat.c] Sync OpenBSD revs 1.11 - 1.12 (removal 542 of "register"). 543 - (dtucker) [openbsd-compat/{LOTS}] Move the "OPENBSD ORIGINAL" markers to 544 after the copyright notices. Having them at the top next to the CVSIDs 545 guarantees a conflict for each and every sync. 546 - (dtucker) [openbsd-compat/strlcpy.c] Update from OpenBSD 1.8 -> 1.10. 547 - (dtucker) [openbsd-compat/sigact.h] Add "OPENBSD ORIGINAL" marker. 548 - (dtucker) [openbsd-compat/strmode.c] Update from OpenBSD 1.5 -> 1.7. 549 Removal of rcsid, "whiteout" inode type. 550 - (dtucker) [openbsd-compat/basename.c] Update from OpenBSD 1.11 -> 1.14. 551 Removal of rcsid, will no longer strlcpy parts of the string. 552 - (dtucker) [openbsd-compat/strtoll.c] Update from OpenBSD 1.4 -> 1.5. 553 - (dtucker) [openbsd-compat/strtoul.c] Update from OpenBSD 1.5 -> 1.7. 554 - (dtucker) [openbsd-compat/readpassphrase.c] Update from OpenBSD 1.16 -> 1.18. 555 - (dtucker) [openbsd-compat/readpassphrase.h] Update from OpenBSD 1.3 -> 1.5. 556 - (dtucker) [openbsd-compat/glob.c] Update from OpenBSD 1.22 -> 1.25. 557 - (dtucker) [openbsd-compat/glob.h] Update from OpenBSD 1.8 -> 1.9. 558 - (dtucker) [openbsd-compat/getcwd.c] Update from OpenBSD 1.9 -> 1.14. 559 - (dtucker) [openbsd-compat/getcwd.c] Replace lstat with fstat to match up 560 with OpenBSD code since we don't support platforms without fstat any more. 561 - (dtucker) [openbsd-compat/inet_aton.c] Update from OpenBSD 1.7 -> 1.9. 562 - (dtucker) [openbsd-compat/inet_ntoa.c] Update from OpenBSD 1.4 -> 1.6. 563 - (dtucker) [openbsd-compat/inet_ntop.c] Update from OpenBSD 1.5 -> 1.7. 564 - (dtucker) [openbsd-compat/daemon.c] Update from OpenBSD 1.5 -> 1.6. 565 - (dtucker) [openbsd-compat/strsep.c] Update from OpenBSD 1.5 -> 1.6. 566 - (dtucker) [openbsd-compat/daemon.c] Update from OpenBSD 1.10 -> 1.13. 567 - (dtucker) [openbsd-compat/mktemp.c] Update from OpenBSD 1.17 -> 1.19. 568 - (dtucker) [openbsd-compat/rresvport.c] Update from OpenBSD 1.6 -> 1.8. 569 - (dtucker) [openbsd-compat/bindresvport.c] Add "OPENBSD ORIGINAL" marker. 570 - (dtucker) [openbsd-compat/bindresvport.c] Update from OpenBSD 1.16 -> 1.17. 571 - (dtucker) [openbsd-compat/sigact.c] Update from OpenBSD 1.3 -> 1.4. 572 Id and copyright sync only, there were no substantial changes we need. 573 - (dtucker) [openbsd-compat/bsd-closefrom.c openbsd-compat/base64.c] 574 -Wsign-compare fixes from djm. 575 - (dtucker) [openbsd-compat/sigact.h] Update from OpenBSD 1.2 -> 1.3. 576 Id and copyright sync only, there were no substantial changes we need. 577 - (dtucker) [configure.ac] Try to get the gcc version number in a way that 578 doesn't change between versions, and use a safer default. 579 58020051105 581 - (djm) OpenBSD CVS Sync 582 - markus@cvs.openbsd.org 2005/10/07 11:13:57 583 [ssh-keygen.c] 584 change DSA default back to 1024, as it's defined for 1024 bits only 585 and this causes interop problems with other clients. moreover, 586 in order to improve the security of DSA you need to change more 587 components of DSA key generation (e.g. the internal SHA1 hash); 588 ok deraadt 589 - djm@cvs.openbsd.org 2005/10/10 10:23:08 590 [channels.c channels.h clientloop.c serverloop.c session.c] 591 fix regression I introduced in 4.2: X11 forwardings initiated after 592 a session has exited (e.g. "(sleep 5; xterm) &") would not start. 593 bz #1086 reported by t8m AT centrum.cz; ok markus@ dtucker@ 594 - djm@cvs.openbsd.org 2005/10/11 23:37:37 595 [channels.c] 596 bz #1076 set SO_REUSEADDR on X11 forwarding listner sockets, preventing 597 bind() failure when a previous connection's listeners are in TIME_WAIT, 598 reported by plattner AT inf.ethz.ch; ok dtucker@ 599 - stevesk@cvs.openbsd.org 2005/10/13 14:03:01 600 [auth2-gss.c gss-genr.c gss-serv.c] 601 remove unneeded #includes; ok markus@ 602 - stevesk@cvs.openbsd.org 2005/10/13 14:20:37 603 [gss-serv.c] 604 spelling in comments 605 - stevesk@cvs.openbsd.org 2005/10/13 19:08:08 606 [gss-serv-krb5.c gss-serv.c] 607 unused declarations; ok deraadt@ 608 (id sync only for gss-serv-krb5.c) 609 - stevesk@cvs.openbsd.org 2005/10/13 19:13:41 610 [dns.c] 611 unneeded #include, unused declaration, little knf; ok deraadt@ 612 - stevesk@cvs.openbsd.org 2005/10/13 22:24:31 613 [auth2-gss.c gss-genr.c gss-serv.c monitor.c] 614 KNF; ok djm@ 615 - stevesk@cvs.openbsd.org 2005/10/14 02:17:59 616 [ssh-keygen.c ssh.c sshconnect2.c] 617 no trailing "\n" for log functions; ok djm@ 618 - stevesk@cvs.openbsd.org 2005/10/14 02:29:37 619 [channels.c clientloop.c] 620 free()->xfree(); ok djm@ 621 - stevesk@cvs.openbsd.org 2005/10/15 15:28:12 622 [sshconnect.c] 623 make external definition static; ok deraadt@ 624 - stevesk@cvs.openbsd.org 2005/10/17 13:45:05 625 [dns.c] 626 fix memory leaks from 2 sources: 627 1) key_fingerprint_raw() 628 2) malloc in dns_read_rdata() 629 ok jakob@ 630 - stevesk@cvs.openbsd.org 2005/10/17 14:01:28 631 [dns.c] 632 remove #ifdef LWRES; ok jakob@ 633 - stevesk@cvs.openbsd.org 2005/10/17 14:13:35 634 [dns.c dns.h] 635 more cleanups; ok jakob@ 636 - djm@cvs.openbsd.org 2005/10/30 01:23:19 637 [ssh_config.5] 638 mention control socket fallback behaviour, reported by 639 tryponraj AT gmail.com 640 - djm@cvs.openbsd.org 2005/10/30 04:01:03 641 [ssh-keyscan.c] 642 make ssh-keygen discard junk from server before SSH- ident, spotted by 643 dave AT cirt.net; ok dtucker@ 644 - djm@cvs.openbsd.org 2005/10/30 04:03:24 645 [ssh.c] 646 fix misleading debug message; ok dtucker@ 647 - dtucker@cvs.openbsd.org 2005/10/30 08:29:29 648 [canohost.c sshd.c] 649 Check for connections with IP options earlier and drop silently. ok djm@ 650 - jmc@cvs.openbsd.org 2005/10/30 08:43:47 651 [ssh_config.5] 652 remove trailing whitespace; 653 - djm@cvs.openbsd.org 2005/10/30 08:52:18 654 [clientloop.c packet.c serverloop.c session.c ssh-agent.c ssh-keygen.c] 655 [ssh.c sshconnect.c sshconnect1.c sshd.c] 656 no need to escape single quotes in comments, no binary change 657 - dtucker@cvs.openbsd.org 2005/10/31 06:15:04 658 [sftp.c] 659 Fix sorting with "ls -1" command. From Robert Tsai, "looks right" deraadt@ 660 - djm@cvs.openbsd.org 2005/10/31 11:12:49 661 [ssh-keygen.1 ssh-keygen.c] 662 generate a protocol 2 RSA key by default 663 - djm@cvs.openbsd.org 2005/10/31 11:48:29 664 [serverloop.c] 665 make sure we clean up wtmp, etc. file when we receive a SIGTERM, 666 SIGINT or SIGQUIT when running without privilege separation (the 667 normal privsep case is already OK). Patch mainly by dtucker@ and 668 senthilkumar_sen AT hotpop.com; ok dtucker@ 669 - jmc@cvs.openbsd.org 2005/10/31 19:55:25 670 [ssh-keygen.1] 671 grammar; 672 - dtucker@cvs.openbsd.org 2005/11/03 13:38:29 673 [canohost.c] 674 Cache reverse lookups with and without DNS separately; ok markus@ 675 - djm@cvs.openbsd.org 2005/11/04 05:15:59 676 [kex.c kex.h kexdh.c kexdhc.c kexdhs.c kexgex.c kexgexc.c kexgexs.c] 677 remove hardcoded hash lengths in key exchange code, allowing 678 implementation of KEX methods with different hashes (e.g. SHA-256); 679 ok markus@ dtucker@ stevesk@ 680 - djm@cvs.openbsd.org 2005/11/05 05:01:15 681 [bufaux.c] 682 Fix leaks in error paths, bz #1109 and #1110 reported by kremenek AT 683 cs.stanford.edu; ok dtucker@ 684 - (dtucker) [README.platform] Add PAM section. 685 - (djm) [openbsd-compat/getrrsetbyname.c] Sync to latest OpenBSD version, 686 resolving memory leak bz#1111 reported by kremenek AT cs.stanford.edu; 687 ok dtucker@ 688 68920051102 690 - (dtucker) [openbsd-compat/bsd-misc.c] Bug #1108: fix broken strdup(). 691 Reported by olavi at ipunplugged.com and antoine.brodin at laposte.net 692 via FreeBSD. 693 69420051030 695 - (djm) [contrib/suse/openssh.spec contrib/suse/rc. 696 sshd contrib/suse/sysconfig.ssh] Bug #1106: Updated SuSE spec and init 697 files from imorgan AT nas.nasa.gov 698 - (dtucker) [session.c] Bug #1045do not check /etc/nologin when PAM is 699 enabled, instead allow PAM to handle it. Note that on platforms using PAM, 700 the pam_nologin module should be added to sshd's session stack in order to 701 maintain exising behaviour. Based on patch and discussion from t8m at 702 centrum.cz, ok djm@ 703 70420051025 705 - (dtucker) [configure.ac] Relocate LLONG_MAX calculation to after the 706 sizeof(long long) checks, to make fixing bug #1104 easier (no changes 707 yet). 708 - (dtucker) [configure.ac] Bug #1104: Tru64's printf family doesn't 709 understand "%lld", even though the compiler has "long long", so handle 710 it as a special case. Patch tested by mcaskill.scott at epa.gov. 711 - (dtucker) [contrib/cygwin/ssh-user-config] Remove duplicate yes/no 712 prompt. Patch from vinschen at redhat.com. 713 71420051017 715 - (dtucker) [configure.ac] Bug #1097: Fix configure for cross-compiling. 716 /etc/default/login report and testing from aabaker at iee.org, corrections 717 from tim@. 718 71920051009 720 - (dtucker) [configure.ac defines.h openbsd-compat/vis.{c,h}] Sync current 721 versions from OpenBSD. ok djm@ 722 72320051008 724 - (dtucker) [configure.ac] Bug #1098: define $MAIL for HP-UX; report from 725 brian.smith at agilent com. 726 - (djm) [configure.ac] missing 'test' call for -with-Werror test 727 72820051005 729 - (dtucker) [configure.ac sshd.8] Enable locked account check (a prepended 730 "*LOCKED*" string) for FreeBSD. Patch jeremie at le-hen.org and 731 senthilkumar_sen at hotpop.com. 732 73320051003 734 - (dtucker) OpenBSD CVS Sync 735 - markus@cvs.openbsd.org 2005/09/07 08:53:53 736 [channels.c] 737 enforce chanid != NULL; ok djm 738 - markus@cvs.openbsd.org 2005/09/09 19:18:05 739 [clientloop.c] 740 typo; from mark at mcs.vuw.ac.nz, bug #1082 741 - djm@cvs.openbsd.org 2005/09/13 23:40:07 742 [sshd.c ssh.c misc.h sftp.c ssh-keygen.c ssh-keysign.c sftp-server.c 743 scp.c misc.c ssh-keyscan.c ssh-add.c ssh-agent.c] 744 ensure that stdio fds are attached; ok deraadt@ 745 - djm@cvs.openbsd.org 2005/09/19 11:37:34 746 [ssh_config.5 ssh.1] 747 mention ability to specify bind_address for DynamicForward and -D options; 748 bz#1077 spotted by Haruyama Seigo 749 - djm@cvs.openbsd.org 2005/09/19 11:47:09 750 [sshd.c] 751 stop connection abort on rekey with delayed compression enabled when 752 post-auth privsep is disabled (e.g. when root is logged in); ok dtucker@ 753 - djm@cvs.openbsd.org 2005/09/19 11:48:10 754 [gss-serv.c] 755 typo 756 - jmc@cvs.openbsd.org 2005/09/19 15:38:27 757 [ssh.1] 758 some more .Bk/.Ek to avoid ugly line split; 759 - jmc@cvs.openbsd.org 2005/09/19 15:42:44 760 [ssh.c] 761 update -D usage here too; 762 - djm@cvs.openbsd.org 2005/09/19 23:31:31 763 [ssh.1] 764 spelling nit from stevesk@ 765 - djm@cvs.openbsd.org 2005/09/21 23:36:54 766 [sshd_config.5] 767 aquire -> acquire, from stevesk@ 768 - djm@cvs.openbsd.org 2005/09/21 23:37:11 769 [sshd.c] 770 change label at markus@'s request 771 - jaredy@cvs.openbsd.org 2005/09/30 20:34:26 772 [ssh-keyscan.1] 773 deploy .An -nosplit; ok jmc 774 - dtucker@cvs.openbsd.org 2005/10/03 07:44:42 775 [canohost.c] 776 Relocate check_ip_options call to prevent logging of garbage for 777 connections with IP options set. bz#1092 from David Leonard, 778 "looks good" deraadt@ 779 - (dtucker) [regress/README.regress] Bug #989: Document limitation that scp 780 is required in the system path for the multiplex test to work. 781 78220050930 783 - (dtucker) [openbsd-compat/openbsd-compat.h] Bug #1096: Add prototype 784 for strtoll. Patch from o.flebbe at science-computing.de. 785 - (dtucker) [monitor.c] Bug #1087: Send loginmsg to preauth privsep 786 child during PAM account check without clearing it. This restores the 787 post-login warnings such as LDAP password expiry. Patch from Tomas Mraz 788 with help from several others. 789 79020050929 791 - (dtucker) [monitor_wrap.c] Remove duplicate definition of loginmsg 792 introduced during sync. 793 79420050928 795 - (dtucker) [entropy.c] Use u_char for receiving RNG seed for consistency. 796 - (dtucker) [auth-pam.c] Bug #1028: send final non-query messages from 797 PAM via keyboard-interactive. Patch tested by the folks at Vintela. 798 79920050927 800 - (dtucker) [entropy.c] Remove unnecessary tests for getuid and geteuid 801 calls, since they can't possibly fail. ok djm@ 802 - (dtucker) [entropy.c entropy.h sshd.c] Pass RNG seed to the reexec'ed 803 process when sshd relies on ssh-random-helper. Should result in faster 804 logins on systems without a real random device or prngd. ok djm@ 805 80620050924 807 - (dtucker) [auth2.c] Move start_pam() calls out of if-else block to remove 808 duplicate call. ok djm@ 809 81020050922 811 - (dtucker) [configure.ac] Use -R linker flag for libedit too; patch from 812 skeleten at shillest.net. 813 - (dtucker) [configure.ac] Fix help for --with-opensc; patch from skeleten at 814 shillest.net. 815 81620050919 817 - (tim) [aclocal.m4 configure.ac] Delete acconfig.h and add templates to 818 AC_DEFINE and AC_DEFINE_UNQUOTED to quiet autoconf 2.59 warning messages. 819 ok dtucker@ 820 82120050912 822 - (tim) [configure.ac] Bug 1078. Fix --without-kerberos5. Reported by 823 Mike Frysinger. 824 82520050908 826 - (tim) [defines.h openbsd-compat/port-uw.c] Add long password support to 827 OpenServer 6 and add osr5bigcrypt support so when someone migrates 828 passwords between UnixWare and OpenServer they will still work. OK dtucker@ 829 83020050901 831 - (djm) Update RPM spec file versions 832 83320050831 834 - (djm) OpenBSD CVS Sync 835 - djm@cvs.openbsd.org 2005/08/30 22:08:05 836 [gss-serv.c sshconnect2.c] 837 destroy credentials if krb5_kuserok() call fails. Stops credentials being 838 delegated to users who are not authorised for GSSAPIAuthentication when 839 GSSAPIDeletegateCredentials=yes and another authentication mechanism 840 succeeds; bz#1073 reported by paul.moore AT centrify.com, fix by 841 simon AT sxw.org.uk, tested todd@ biorn@ jakob@; ok deraadt@ 842 - markus@cvs.openbsd.org 2005/08/31 09:28:42 843 [version.h] 844 4.2 845 - (dtucker) [README] Update release note URL to 4.2 846 - (tim) [configure.ac auth.c defines.h session.c openbsd-compat/port-uw.c 847 openbsd-compat/port-uw.h openbsd-compat/xcrypt.c] libiaf cleanup. Disable 848 libiaf bits for OpenServer6. Free memory allocated by ia_get_logpwd(). 849 Feedback and OK dtucker@ 850 85120050830 852 - (tim) [configure.ac] Back out last change. It needs to be done differently. 853 85420050829 855 - (tim) [configure.ac] ia_openinfo() seems broken on OSR6. Limit UW long 856 password support to 7.x for now. 857 85820050826 859 - (tim) [CREDITS LICENCE auth.c configure.ac defines.h includes.h session.c 860 openbsd-compat/Makefile.in openbsd-compat/openbsd-compat.h 861 openbsd-compat/xcrypt.c] New files [openssh/openbsd-compat/port-uw.c 862 openssh/openbsd-compat/port-uw.h] Support long passwords (> 8-char) 863 on UnixWare 7 from Dhiraj Gulati and Ahsan Rashid. Cleanup and testing 864 by tim@. Feedback and OK dtucker@ 865 86620050823 867 - (dtucker) [regress/test-exec.sh] Do not prepend an extra "/" to a fully- 868 qualified sshd pathname since some systems (eg Cygwin) may consider "/foo" 869 and "//foo" to be different. Spotted by vinschen at redhat.com. 870 - (tim) [configure.ac] Not all gcc's support -Wsign-compare. Enhancements 871 and OK dtucker@ 872 - (tim) [defines.h] PATH_MAX bits for OpenServer OK dtucker@ 873 87420050821 875 - (dtucker) [configure.ac defines.h includes.h sftp.c] Add support for 876 LynxOS, patch from Olli Savia (ops at iki.fi). ok djm@ 877 87820050816 879 - (djm) [ttymodes.c] bugzilla #1025: Fix encoding of _POSIX_VDISABLE, 880 from Jacob Nevins; ok dtucker@ 881 88220050815 883 - (tim) [sftp.c] wrap el_end() in #ifdef USE_LIBEDIT 884 - (tim) [configure.ac] corrections to libedit tests. Report and patches 885 by skeleten AT shillest.net 886 88720050812 888 - (djm) OpenBSD CVS Sync 889 - markus@cvs.openbsd.org 2005/07/28 17:36:22 890 [packet.c] 891 missing packet_init_compression(); from solar 892 - djm@cvs.openbsd.org 2005/07/30 01:26:16 893 [ssh.c] 894 fix -D listen_host initialisation, so it picks up gateway_ports setting 895 correctly 896 - djm@cvs.openbsd.org 2005/07/30 02:03:47 897 [readconf.c] 898 listen_hosts initialisation here too; spotted greg AT y2005.nest.cx 899 - dtucker@cvs.openbsd.org 2005/08/06 10:03:12 900 [servconf.c] 901 Unbreak sshd ListenAddress for bare IPv6 addresses. 902 Report from Janusz Mucka; ok djm@ 903 - jaredy@cvs.openbsd.org 2005/08/08 13:22:48 904 [sftp.c] 905 sftp prompt enhancements: 906 - in non-interactive mode, do not print an empty prompt at the end 907 before finishing 908 - print newline after EOF in editline mode 909 - call el_end() in editline mode 910 ok dtucker djm 911 91220050810 913 - (dtucker) [configure.ac] Test libedit library and headers for compatibility. 914 Report from skeleten AT shillest.net, ok djm@ 915 - (dtucker) [LICENCE configure.ac defines.h openbsd-compat/realpath.c] 916 Sync current (thread-safe) version of realpath.c from OpenBSD (which is 917 in turn based on FreeBSD's). ok djm@ 918 91920050809 920 - (tim) [configure.ac] Allow --with-audit=no. OK dtucker@ 921 Report by skeleten AT shillest.net 922 92320050803 924 - (dtucker) [openbsd-compat/fake-rfc2553.h] Check for EAI_* defines 925 individually and use a value less likely to collide with real values from 926 netdb.h. Fixes compile warnings on FreeBSD 5.3. ok djm@ 927 - (dtucker) [openbsd-compat/fake-rfc2553.h] MAX_INT -> INT_MAX since the 928 latter is specified in the standard. 929 93020050802 931 - (dtucker) OpenBSD CVS Sync 932 - dtucker@cvs.openbsd.org 2005/07/27 10:39:03 933 [scp.c hostfile.c sftp-client.c] 934 Silence bogus -Wuninitialized warnings; ok djm@ 935 - (dtucker) [configure.ac] Enable -Wuninitialized by default when compiling 936 with gcc. ok djm@ 937 - (dtucker) [configure.ac] Add a --with-Werror option to configure for 938 adding -Werror to CFLAGS when all of the configure tests are done. ok djm@ 939 94020050726 941 - (dtucker) [configure.ac] Update zlib warning message too, pointed out by 942 tim@. 943 - (djm) OpenBSD CVS Sync 944 - otto@cvs.openbsd.org 2005/07/19 15:32:26 945 [auth-passwd.c] 946 auth_usercheck(3) can return NULL, so check for that. Report from 947 mpech@. ok markus@ 948 - markus@cvs.openbsd.org 2005/07/25 11:59:40 949 [kex.c kex.h myproposal.h packet.c packet.h servconf.c session.c] 950 [sshconnect2.c sshd.c sshd_config sshd_config.5] 951 add a new compression method that delays compression until the user 952 has been authenticated successfully and set compression to 'delayed' 953 for sshd. 954 this breaks older openssh clients (< 3.5) if they insist on 955 compression, so you have to re-enable compression in sshd_config. 956 ok djm@ 957 95820050725 959 - (dtucker) [configure.ac] Update zlib version check for CAN-2005-2096. 960 96120050717 962- OpenBSD CVS Sync 963 - djm@cvs.openbsd.org 2005/07/16 01:35:24 964 [auth1.c channels.c cipher.c clientloop.c kex.c session.c ssh.c] 965 [sshconnect.c] 966 spacing 967 - (djm) [acss.c auth-pam.c auth-shadow.c auth-skey.c auth1.c canohost.c] 968 [cipher-acss.c loginrec.c ssh-rand-helper.c sshd.c] Fix whitespace at EOL 969 in portable too ("perl -p -i -e 's/\s+$/\n/' *.[ch]") 970 - (djm) [auth-pam.c sftp.c] spaces vs. tabs at start of line 971 - djm@cvs.openbsd.org 2005/07/17 06:49:04 972 [channels.c channels.h session.c session.h] 973 Fix a number of X11 forwarding channel leaks: 974 1. Refuse multiple X11 forwarding requests on the same session 975 2. Clean up all listeners after a single_connection X11 forward, not just 976 the one that made the single connection 977 3. Destroy X11 listeners when the session owning them goes away 978 testing and ok dtucker@ 979 - djm@cvs.openbsd.org 2005/07/17 07:17:55 980 [auth-rh-rsa.c auth-rhosts.c auth2-chall.c auth2-gss.c channels.c] 981 [cipher-ctr.c gss-genr.c gss-serv.c kex.c moduli.c readconf.c] 982 [serverloop.c session.c sftp-client.c sftp.c ssh-add.c ssh-keygen.c] 983 [sshconnect.c sshconnect2.c] 984 knf says that a 2nd level indent is four (not three or five) spaces 985 -(djm) [audit.c auth1.c auth2.c entropy.c loginrec.c serverloop.c] 986 [ssh-rand-helper.c] fix portable 2nd level indents at 4 spaces too 987 - (djm) [monitor.c monitor_wrap.c] -Wsign-compare for PAM monitor calls 988 98920050716 990 - (dtucker) [auth-pam.c] Ensure that only one side of the authentication 991 socketpair stays open on in both the monitor and PAM process. Patch from 992 Joerg Sonnenberger. 993 99420050714 995 - (dtucker) OpenBSD CVS Sync 996 - dtucker@cvs.openbsd.org 2005/07/06 09:33:05 997 [ssh.1] 998 clarify meaning of ssh -b ; with & ok jmc@ 999 - dtucker@cvs.openbsd.org 2005/07/08 09:26:18 1000 [misc.c] 1001 Make comment match code; ok djm@ 1002 - markus@cvs.openbsd.org 2005/07/08 09:41:33 1003 [channels.h] 1004 race when efd gets closed while there is still buffered data: 1005 change CHANNEL_EFD_OUTPUT_ACTIVE() 1006 1) c->efd must always be valid AND 1007 2a) no EOF has been seen OR 1008 2b) there is buffered data 1009 report, initial fix and testing Chuck Cranor 1010 - dtucker@cvs.openbsd.org 2005/07/08 10:20:41 1011 [ssh_config.5] 1012 change BindAddress to match recent ssh -b change; prompted by markus@ 1013 - jmc@cvs.openbsd.org 2005/07/08 12:53:10 1014 [ssh_config.5] 1015 new sentence, new line; 1016 - dtucker@cvs.openbsd.org 2005/07/14 04:00:43 1017 [misc.h] 1018 use __sentinel__ attribute; ok deraadt@ djm@ markus@ 1019 - (dtucker) [configure.ac defines.h] Define __sentinel__ to nothing if the 1020 compiler doesn't understand it to prevent warnings. If any mainstream 1021 compiler versions acquire it we can test for those versions. Based on 1022 discussion with djm@. 1023 102420050707 1025 - dtucker [auth-krb5.c auth.h gss-serv-krb5.c] Move KRB5CCNAME generation for 1026 the MIT Kerberos code path into a common function and expand mkstemp 1027 template to be consistent with the rest of OpenSSH. From sxw at 1028 inf.ed.ac.uk, ok djm@ 1029 - (dtucker) [auth-krb5.c] There's no guarantee that snprintf will set errno 1030 in the case where the buffer is insufficient, so always return ENOMEM. 1031 Also pointed out by sxw at inf.ed.ac.uk. 1032 - (dtucker) [acconfig.h auth-krb5.c configure.ac gss-serv-krb5.c] Remove 1033 calls to krb5_init_ets, which has not been required since krb-1.1.x and 1034 most Kerberos versions no longer export in their public API. From sxw 1035 at inf.ed.ac.uk, ok djm@ 1036 103720050706 1038 - (djm) OpenBSD CVS Sync 1039 - markus@cvs.openbsd.org 2005/07/01 13:19:47 1040 [channels.c] 1041 don't free() if getaddrinfo() fails; report mpech@ 1042 - djm@cvs.openbsd.org 2005/07/04 00:58:43 1043 [channels.c clientloop.c clientloop.h misc.c misc.h ssh.c ssh_config.5] 1044 implement support for X11 and agent forwarding over multiplex slave 1045 connections. Because of protocol limitations, the slave connections inherit 1046 the master's DISPLAY and SSH_AUTH_SOCK rather than distinctly forwarding 1047 their own. 1048 ok dtucker@ "put it in" deraadt@ 1049 - jmc@cvs.openbsd.org 2005/07/04 11:29:51 1050 [ssh_config.5] 1051 fix Xr and a little grammar; 1052 - markus@cvs.openbsd.org 2005/07/04 14:04:11 1053 [channels.c] 1054 don't forget to set x11_saved_display 1055 105620050626 1057 - (djm) OpenBSD CVS Sync 1058 - djm@cvs.openbsd.org 2005/06/17 22:53:47 1059 [ssh.c sshconnect.c] 1060 Fix ControlPath's %p expanding to "0" for a default port, 1061 spotted dwmw2 AT infradead.org; ok markus@ 1062 - djm@cvs.openbsd.org 2005/06/18 04:30:36 1063 [ssh.c ssh_config.5] 1064 allow ControlPath=none, patch from dwmw2 AT infradead.org; ok dtucker@ 1065 - djm@cvs.openbsd.org 2005/06/25 22:47:49 1066 [ssh.c] 1067 do the default port filling code a few lines earlier, so it really 1068 does fix %p 1069 107020050618 1071 - (djm) OpenBSD CVS Sync 1072 - djm@cvs.openbsd.org 2005/05/20 12:57:01; 1073 [auth1.c] split protocol 1 auth methods into separate functions, makes 1074 authloop much more readable; fixes and ok markus@ (portable ok & 1075 polish dtucker@) 1076 - djm@cvs.openbsd.org 2005/06/17 02:44:33 1077 [auth1.c] make this -Wsign-compare clean; ok avsm@ markus@ 1078 - (djm) [loginrec.c ssh-rand-helper.c] Fix -Wsign-compare for portable, 1079 tested and fixes tim@ 1080 108120050617 1082 - (djm) OpenBSD CVS Sync 1083 - djm@cvs.openbsd.org 2005/06/16 03:38:36 1084 [channels.c channels.h clientloop.c clientloop.h ssh.c] 1085 move x11_get_proto from ssh.c to clientloop.c, to make muliplexed xfwd 1086 easier later; ok deraadt@ 1087 - markus@cvs.openbsd.org 2005/06/16 08:00:00 1088 [canohost.c channels.c sshd.c] 1089 don't exit if getpeername fails for forwarded ports; bugzilla #1054; 1090 ok djm 1091 - djm@cvs.openbsd.org 2005/06/17 02:44:33 1092 [auth-rsa.c auth.c auth1.c auth2-chall.c auth2-gss.c authfd.c authfile.c] 1093 [bufaux.c canohost.c channels.c cipher.c clientloop.c dns.c gss-serv.c] 1094 [kex.c kex.h key.c mac.c match.c misc.c packet.c packet.h scp.c] 1095 [servconf.c session.c session.h sftp-client.c sftp-server.c sftp.c] 1096 [ssh-keyscan.c ssh-rsa.c sshconnect.c sshconnect1.c sshconnect2.c sshd.c] 1097 make this -Wsign-compare clean; ok avsm@ markus@ 1098 NB. auth1.c changes not committed yet (conflicts with uncommitted sync) 1099 NB2. more work may be needed to make portable Wsign-compare clean 1100 - (dtucker) [cipher.c openbsd-compat/openbsd-compat.h 1101 openbsd-compat/openssl-compat.c] only include openssl compat stuff where 1102 it's needed as it can cause conflicts elsewhere (eg xcrypt.c). Found by 1103 and ok tim@ 1104 110520050616 1106 - (djm) OpenBSD CVS Sync 1107 - jaredy@cvs.openbsd.org 2005/06/07 13:25:23 1108 [progressmeter.c] 1109 catch SIGWINCH and resize progress meter accordingly; ok markus dtucker 1110 - djm@cvs.openbsd.org 2005/06/06 11:20:36 1111 [auth.c auth.h misc.c misc.h ssh.c ssh_config.5 sshconnect.c] 1112 introduce a generic %foo expansion function. replace existing % expansion 1113 and add expansion to ControlPath; ok markus@ 1114 - djm@cvs.openbsd.org 2005/06/08 03:50:00 1115 [ssh-keygen.1 ssh-keygen.c sshd.8] 1116 increase default rsa/dsa key length from 1024 to 2048 bits; 1117 ok markus@ deraadt@ 1118 - djm@cvs.openbsd.org 2005/06/08 11:25:09 1119 [clientloop.c readconf.c readconf.h ssh.c ssh_config.5] 1120 add ControlMaster=auto/autoask options to support opportunistic 1121 multiplexing; tested avsm@ and jakob@, ok markus@ 1122 - dtucker@cvs.openbsd.org 2005/06/09 13:43:49 1123 [cipher.c] 1124 Correctly initialize end of array sentinel; ok djm@ 1125 (Id sync only, change already in portable) 1126 112720050609 1128 - (dtucker) [cipher.c openbsd-compat/Makefile.in 1129 openbsd-compat/openbsd-compat.h openbsd-compat/openssl-compat.{c,h}] 1130 Move compatibility code for supporting older OpenSSL versions to the 1131 compat layer. Suggested by and "no objection" djm@ 1132 113320050607 1134 - (dtucker) [configure.ac] Continue the hunt for LLONG_MIN and LLONG_MAX: 1135 in today's episode we attempt to coax it from limits.h where it may be 1136 hiding, failing that we take the DIY approach. Tested by tim@ 1137 113820050603 1139 - (dtucker) [configure.ac] Only try gcc -std=gnu99 if LLONG_MAX isn't 1140 defined, and check that it helps before keeping it in CFLAGS. Some old 1141 gcc's don't set an error code when encountering an unknown value in -std. 1142 Found and tested by tim@. 1143 - (dtucker) [configure.ac] Point configure's reporting address at the 1144 openssh-unix-dev list. ok tim@ djm@ 1145 114620050602 1147 - (tim) [configure.ac] Some platforms need sys/types.h for arpa/nameser.h. 1148 Take AC_CHECK_HEADERS test out of ultrix section. It caused other platforms 1149 to skip builtin standard includes tests. (first AC_CHECK_HEADERS test 1150 must be run on all platforms) Add missing ;; to case statement. OK dtucker@ 1151 115220050601 1153 - (dtucker) [configure.ac] Look for _getshort and _getlong in 1154 arpa/nameser.h. 1155 - (dtucker) [configure.ac openbsd-compat/Makefile.in openbsd-compat/strtoll.c] 1156 Add strtoll to the compat library, from OpenBSD. 1157 - (dtucker) OpenBSD CVS Sync 1158 - avsm@cvs.openbsd.org 2005/05/26 02:08:05 1159 [scp.c] 1160 If copying multiple files to a target file (which normally fails, as it 1161 must be a target directory), kill the spawned ssh child before exiting. 1162 This stops it trying to authenticate and spewing lots of output. 1163 deraadt@ ok 1164 - dtucker@cvs.openbsd.org 2005/05/26 09:08:12 1165 [ssh-keygen.c] 1166 uint32_t -> u_int32_t for consistency; ok djm@ 1167 - djm@cvs.openbsd.org 2005/05/27 08:30:37 1168 [ssh.c] 1169 fix -O for cases where no ControlPath has been specified or socket at 1170 ControlPath is not contactable; spotted by and ok avsm@ 1171 - (tim) [config.guess config.sub] Update to '2005-05-27' version. 1172 - (tim) [configure.ac] set TEST_SHELL for OpenServer 6 1173 117420050531 1175 - (dtucker) [contrib/aix/pam.conf] Correct comments. From davidl at 1176 vintela.com. 1177 - (dtucker) [mdoc2man.awk] Teach it to understand .Ox. 1178 117920050530 1180 - (dtucker) [README] Link to new release notes. Beter late than never... 1181 118220050529 1183 - (dtucker) [openbsd-compat/port-aix.c] Bug #1046: AIX 5.3 expects the 1184 argument to passwdexpired to be initialized to NULL. Suggested by tim@ 1185 While at it, initialize the other arguments to auth functions in case they 1186 ever acquire this behaviour. 1187 - (dtucker) [openbsd-compat/port-aix.c] Whitespace cleanups while there. 1188 - (dtucker) [openbsd-compat/port-aix.c] Minor correction to debug message, 1189 spotted by tim@. 1190 119120050528 1192 - (dtucker) [configure.ac] For AC_CHECK_HEADERS() and AC_CHECK_FUNCS() have 1193 one entry per line to make it easier to merge changes. ok djm@ 1194 - (dtucker) [configure.ac] strsep() may be defined in string.h, so check 1195 for its presence and include it in the strsep check. 1196 - (dtucker) [configure.ac] getpgrp may be defined in unistd.h, so check for 1197 its presence before doing AC_FUNC_GETPGRP. 1198 - (dtucker) [configure.ac] Merge HP-UX blocks into a common block with minor 1199 version-specific variations as required. 1200 - (dtucker) [openbsd-compat/port-aix.h] Use the HAVE_DECL_* definitions as 1201 per the autoconf man page. Configure should always define them but it 1202 doesn't hurt to check. 1203 120420050527 1205 - (djm) [defines.h] Use our realpath if we have to define PATH_MAX, spotted by 1206 David Leach; ok dtucker@ 1207 - (dtucker) [acconfig.h configure.ac defines.h includes.h sshpty.c 1208 openbsd-compat/bsd-misc.c] Add support for Ultrix. No, that's not a typo. 1209 Required changes from Bernhard Simon, integrated by me. ok djm@ 1210 121120050525 1212 - (djm) [mpaux.c mpaux.h Makefile.in] Remove old mpaux.[ch] code, it has not 1213 been used for a while 1214 - (djm) OpenBSD CVS Sync 1215 - otto@cvs.openbsd.org 2005/04/05 13:45:31 1216 [ssh-keygen.c] 1217 - djm@cvs.openbsd.org 2005/04/06 09:43:59 1218 [sshd.c] 1219 avoid harmless logspam by not performing setsockopt() on non-socket; 1220 ok markus@ 1221 - dtucker@cvs.openbsd.org 2005/04/06 12:26:06 1222 [ssh.c] 1223 Fix debug call for port forwards; patch from pete at seebeyond.com, 1224 ok djm@ (ID sync only - change already in portable) 1225 - djm@cvs.openbsd.org 2005/04/09 04:32:54 1226 [misc.c misc.h tildexpand.c Makefile.in] 1227 replace tilde_expand_filename with a simpler implementation, ahead of 1228 more whacking; ok deraadt@ 1229 - jmc@cvs.openbsd.org 2005/04/14 12:30:30 1230 [ssh.1] 1231 arg to -b is an address, not if_name; 1232 ok markus@ 1233 - jakob@cvs.openbsd.org 2005/04/20 10:05:45 1234 [dns.c] 1235 do not try to look up SSHFP for numerical hostname. ok djm@ 1236 - djm@cvs.openbsd.org 2005/04/21 06:17:50 1237 [ssh-add.1 ssh-agent.1 ssh-keygen.1 ssh.1 ssh_config.5 sshd.8] 1238 [sshd_config.5] OpenSSH doesn't ever look at the $HOME environment 1239 variable, so don't say that we do (bz #623); ok deraadt@ 1240 - djm@cvs.openbsd.org 2005/04/21 11:47:19 1241 [ssh.c] 1242 don't allocate a pty when -n flag (/dev/null stdin) is set, patch from 1243 ignasi.roca AT fujitsu-siemens.com (bz #829); ok dtucker@ 1244 - dtucker@cvs.openbsd.org 2005/04/23 23:43:47 1245 [readpass.c] 1246 Add debug message if read_passphrase can't open /dev/tty; bz #471; 1247 ok djm@ 1248 - jmc@cvs.openbsd.org 2005/04/26 12:59:02 1249 [sftp-client.h] 1250 spelling correction in comment from wiz@netbsd; 1251 - jakob@cvs.openbsd.org 2005/04/26 13:08:37 1252 [ssh.c ssh_config.5] 1253 fallback gracefully if client cannot connect to ControlPath. ok djm@ 1254 - moritz@cvs.openbsd.org 2005/04/28 10:17:56 1255 [progressmeter.c ssh-keyscan.c] 1256 add snprintf checks. ok djm@ markus@ 1257 - markus@cvs.openbsd.org 2005/05/02 21:13:22 1258 [readpass.c] 1259 missing {} 1260 - djm@cvs.openbsd.org 2005/05/10 10:28:11 1261 [ssh.c] 1262 print nice error message for EADDRINUSE as well (ID sync only) 1263 - djm@cvs.openbsd.org 2005/05/10 10:30:43 1264 [ssh.c] 1265 report real errors on fallback from ControlMaster=no to normal connect 1266 - markus@cvs.openbsd.org 2005/05/16 15:30:51 1267 [readconf.c servconf.c] 1268 check return value from strdelim() for NULL (AddressFamily); mpech 1269 - djm@cvs.openbsd.org 2005/05/19 02:39:55 1270 [sshd_config.5] 1271 sort config options, from grunk AT pestilenz.org; ok jmc@ 1272 - djm@cvs.openbsd.org 2005/05/19 02:40:52 1273 [sshd_config] 1274 whitespace nit, from grunk AT pestilenz.org 1275 - djm@cvs.openbsd.org 2005/05/19 02:42:26 1276 [includes.h] 1277 fix cast, from grunk AT pestilenz.org 1278 - djm@cvs.openbsd.org 2005/05/20 10:50:55 1279 [ssh_config.5] 1280 give a ProxyCommand example using nc(1), with and ok jmc@ 1281 - jmc@cvs.openbsd.org 2005/05/20 11:23:32 1282 [ssh_config.5] 1283 oops - article and spacing; 1284 - avsm@cvs.openbsd.org 2005/05/23 22:44:01 1285 [moduli.c ssh-keygen.c] 1286 - removes signed/unsigned comparisons in moduli generation 1287 - use strtonum instead of atoi where its easier 1288 - check some strlcpy overflow and fatal instead of truncate 1289 - djm@cvs.openbsd.org 2005/05/23 23:32:46 1290 [cipher.c myproposal.h ssh.1 ssh_config.5 sshd_config.5] 1291 add support for draft-harris-ssh-arcfour-fixes-02 improved arcfour modes; 1292 ok markus@ 1293 - avsm@cvs.openbsd.org 2005/05/24 02:05:09 1294 [ssh-keygen.c] 1295 some style nits from dmiller@, and use a fatal() instead of a printf()/exit 1296 - avsm@cvs.openbsd.org 2005/05/24 17:32:44 1297 [atomicio.c atomicio.h authfd.c monitor_wrap.c msg.c scp.c sftp-client.c] 1298 [ssh-keyscan.c sshconnect.c] 1299 Switch atomicio to use a simpler interface; it now returns a size_t 1300 (containing number of bytes read/written), and indicates error by 1301 returning 0. EOF is signalled by errno==EPIPE. 1302 Typical use now becomes: 1303 1304 if (atomicio(read, ..., len) != len) 1305 err(1,"read"); 1306 1307 ok deraadt@, cloder@, djm@ 1308 - (dtucker) [regress/reexec.sh] Add ${EXEEXT} so this test also works on 1309 Cygwin. 1310 - (dtucker) [auth-pam.c] Bug #1033: Fix warnings building with PAM on Linux: 1311 warning: dereferencing type-punned pointer will break strict-aliasing rules 1312 warning: passing arg 3 of `pam_get_item' from incompatible pointer type 1313 The type-punned pointer fix is based on a patch from SuSE's rpm. ok djm@ 1314 - (dtucker) [configure.ac openbsd-compat/getrrsetbyname.c] Bug #1033: Provide 1315 templates for _getshort and _getlong if missing to prevent compiler warnings 1316 on Linux. 1317 - (djm) [configure.ac openbsd-compat/Makefile.in] 1318 [openbsd-compat/openbsd-compat.h openbsd-compat/strtonum.c] 1319 Add strtonum(3) from OpenBSD libc, new code needs it. 1320 Unfortunately Linux forces us to do a bizarre dance with compiler 1321 options to get LLONG_MIN/MAX; Spotted by and ok dtucker@ 1322 132320050524 1324 - (djm) [contrib/caldera/openssh.spec contrib/redhat/openssh.spec] 1325 [contrib/suse/openssh.spec] Update spec file versions to 4.1p1 1326 - (dtucker) [auth-pam.c] Since people don't seem to be getting the message 1327 that USE_POSIX_THREADS is unsupported, not recommended and generally a bad 1328 idea, it is now known as UNSUPPORTED_POSIX_THREADS_HACK. Attempting to use 1329 USE_POSIX_THREADS will now generate an error so we don't silently change 1330 behaviour. ok djm@ 1331 - (dtucker) [openbsd-compat/bsd-cygwin_util.c] Ensure sufficient memory 1332 allocation when retrieving core Windows environment. Add CYGWIN variable 1333 to propagated variables. Patch from vinschen at redhat.com, ok djm@ 1334 - Release 4.1p1 1335 133620050524 1337 - (djm) [openbsd-compat/readpassphrase.c] bz #950: Retry tcsetattr to ensure 1338 terminal modes are reset correctly. Fix from peak AT argo.troja.mff.cuni.cz; 1339 "looks ok" dtucker@ 1340 134120050512 1342 - (tim) [buildpkg.sh.in] missing ${PKG_INSTALL_ROOT} in init script 1343 hard link section. Bug 1038. 1344 134520050509 1346 - (dtucker) [contrib/cygwin/ssh-host-config] Add a test and warning for a 1347 user-mode mounts in Cygwin installation. Patch from vinschen at redhat.com. 1348 134920050504 1350 - (djm) [ssh.c] some systems return EADDRINUSE on a bind to an already-used 1351 unix domain socket, so catch that too; from jakob@ ok dtucker@ 1352 135320050503 1354 - (dtucker) [canohost.c] normalise socket addresses returned by 1355 get_remote_hostname(). This means that IPv4 addresses in log messages 1356 on IPv6 enabled machines will no longer be prefixed by "::ffff:" and 1357 AllowUsers, DenyUsers, AllowGroups, DenyGroups will match IPv4-style 1358 addresses only for 4-in-6 mapped connections, regardless of whether 1359 or not the machine is IPv6 enabled. ok djm@ 1360 136120050425 1362 - (dtucker) [regress/multiplex.sh] Use "kill -0 $pid" to check for the 1363 existence of a process since it's more portable. Found by jbasney at 1364 ncsa.uiuc.edu; ok tim@ 1365 - (dtucker) [regress/multiplex.sh] Remove cleanup call since test-exec.sh 1366 will clean up anyway. From tim@ 1367 - (dtucker) [regress/multiplex.sh] Put control socket in /tmp so running 1368 "make tests" works even if you're building on a filesystem that doesn't 1369 support sockets. From deengert at anl.gov, ok djm@ 1370 137120050424 1372 - (dtucker) [INSTALL configure.ac] Make zlib version check test for 1.1.4 or 1373 1.2.1.2 or higher. With tim@, ok djm@ 1374 137520050423 1376 - (tim) [config.guess] Add support for OpenServer 6. 1377 137820050421 1379 - (dtucker) [session.c] Bug #1024: Don't check pam_session_is_open if 1380 UseLogin is set as PAM is not used to establish credentials in that 1381 case. Found by Michael Selvesteen, ok djm@ 1382 138320050419 1384 - (dtucker) [INSTALL] Reference README.privsep for the privilege separation 1385 requirements. Pointed out by Bengt Svensson. 1386 - (dtucker) [INSTALL] Put the s/key text and URL back together. 1387 - (dtucker) [INSTALL] Fix s/key text too. 1388 138920050411 1390 - (tim) [configure.ac] UnixWare needs PASSWD_NEEDS_USERNAME 1391 139220050405 1393 - (dtucker) [configure.ac] Define HAVE_SO_PEERCRED if we have it. ok djm@ 1394 - (dtucker) [auth-sia.c] Constify sys_auth_passwd, fixes build error on 1395 Tru64. Patch from cmadams at hiwaay.net. 1396 - (dtucker) [auth-passwd.c auth-sia.h] Remove duplicate definitions of 1397 sys_auth_passwd, pointed out by cmadams at hiwaay.net. 1398 139920050403 1400 - (djm) OpenBSD CVS Sync 1401 - deraadt@cvs.openbsd.org 2005/03/31 18:39:21 1402 [scp.c] 1403 copy argv[] element instead of smashing the one that ps will see; ok otto 1404 - djm@cvs.openbsd.org 2005/04/02 12:41:16 1405 [scp.c] 1406 since ssh has xstrdup, use it instead of strdup+test. unbreaks -Werror 1407 build 1408 - (dtucker) [monitor.c] Don't free buffers in audit functions, monitor_read 1409 will free as needed. ok tim@ djm@ 1410 141120050331 1412 - (dtucker) OpenBSD CVS Sync 1413 - jmc@cvs.openbsd.org 2005/03/16 11:10:38 1414 [ssh_config.5] 1415 get the syntax right for {Local,Remote}Forward; 1416 based on a diff from markus; 1417 problem report from ponraj; 1418 ok dtucker@ markus@ deraadt@ 1419 - markus@cvs.openbsd.org 2005/03/16 21:17:39 1420 [version.h] 1421 4.1 1422 - jmc@cvs.openbsd.org 2005/03/18 17:05:00 1423 [sshd_config.5] 1424 typo; 1425 - (dtucker) [auth.h sshd.c openbsd-compat/port-aix.c] Bug #1006: fix bug in 1426 handling of password expiry messages returned by AIX's authentication 1427 routines, originally reported by robvdwal at sara.nl. 1428 - (dtucker) [ssh.c] Prevent null pointer deref in port forwarding debug 1429 message on some platforms. Patch from pete at seebeyond.com via djm. 1430 - (dtucker) [monitor.c] Remaining part of fix for bug #1006. 1431 143220050329 1433 - (dtucker) [contrib/aix/buildbff.sh] Bug #1005: Look up only the user we're 1434 interested in which is much faster in large (eg LDAP or NIS) environments. 1435 Patch from dleonard at vintela.com. 1436 143720050321 1438 - (dtucker) [configure.ac] Prevent configure --with-zlib from adding -Iyes 1439 and -Lyes to CFLAGS and LIBS. Pointed out by peter at slagheap.net, 1440 with & ok tim@ 1441 - (dtucker) [configure.ac] Make configure error out if the user specifies 1442 --with-libedit but the required libs can't be found, rather than silently 1443 ignoring and continuing. ok tim@ 1444 - (dtucker) [configure.ac openbsd-compat/port-aix.h] Prevent redefinitions 1445 of setauthdb on AIX 5.3, reported by anders.liljegren at its.uu.se. 1446 144720050317 1448 - (tim) [configure.ac] Bug 998. Make path for --with-opensc optional. 1449 Make --without-opensc work. 1450 - (tim) [configure.ac] portability changes on test statements. Some shells 1451 have problems with -a operator. 1452 - (tim) [configure.ac] make some configure options a little more error proof. 1453 - (tim) [configure.ac] remove trailing white space. 1454 145520050314 1456 - (dtucker) OpenBSD CVS Sync 1457 - dtucker@cvs.openbsd.org 2005/03/10 10:15:02 1458 [readconf.c] 1459 Check listen addresses for null, prevents xfree from dying during 1460 ClearAllForwardings (bz #996). From Craig Leres, ok markus@ 1461 - deraadt@cvs.openbsd.org 2005/03/10 22:01:05 1462 [misc.c ssh-keygen.c servconf.c clientloop.c auth-options.c ssh-add.c 1463 monitor.c sftp-client.c bufaux.h hostfile.c ssh.c sshconnect.c channels.c 1464 readconf.c bufaux.c sftp.c] 1465 spacing 1466 - deraadt@cvs.openbsd.org 2005/03/10 22:40:38 1467 [auth-options.c] 1468 spacing 1469 - markus@cvs.openbsd.org 2005/03/11 14:59:06 1470 [ssh-keygen.c] 1471 typo, missing \n; mpech 1472 - jmc@cvs.openbsd.org 2005/03/12 11:55:03 1473 [ssh_config.5] 1474 escape `.' at eol to avoid double spacing issues; 1475 - dtucker@cvs.openbsd.org 2005/03/14 10:09:03 1476 [ssh-keygen.1] 1477 Correct description of -H (bz #997); ok markus@, punctuation jmc@ 1478 - dtucker@cvs.openbsd.org 2005/03/14 11:44:42 1479 [auth.c] 1480 Populate host for log message for logins denied by AllowUsers and 1481 DenyUsers (bz #999); ok markus@ (patch by tryponraj at gmail.com) 1482 - markus@cvs.openbsd.org 2005/03/14 11:46:56 1483 [buffer.c buffer.h channels.c] 1484 limit input buffer size for channels; bugzilla #896; with and ok dtucker@ 1485 - (tim) [contrib/caldera/openssh.spec] links in rc?.d were getting trashed 1486 with a rpm -F 1487 148820050313 1489 - (dtucker) [contrib/cygwin/ssh-host-config] Makes the query for the 1490 localized name of the local administrators group more reliable. From 1491 vinschen at redhat.com. 1492 149320050312 1494 - (dtucker) [regress/test-exec.sh] DEBUG can cause problems where debug 1495 output ends up in the client's output, causing regress failures. Found 1496 by Corinna Vinschen. 1497 149820050309 1499 - (dtucker) [regress/test-exec.sh] Set BIN_SH=xpg4 on OSF1/Digital Unix/Tru64 1500 so that regress tests behave. From Chris Adams. 1501 - (djm) OpenBSD CVS Sync 1502 - jmc@cvs.openbsd.org 2005/03/07 23:41:54 1503 [ssh.1 ssh_config.5] 1504 more macro simplification; 1505 - djm@cvs.openbsd.org 2005/03/08 23:49:48 1506 [version.h] 1507 OpenSSH 4.0 1508 - (djm) [contrib/caldera/openssh.spec contrib/redhat/openssh.spec] 1509 [contrib/suse/openssh.spec] Update spec file versions 1510 - (djm) [log.c] Fix dumb syntax error; ok dtucker@ 1511 - (djm) Release OpenSSH 4.0p1 1512 151320050307 1514 - (dtucker) [configure.ac] Disable gettext search when configuring with 1515 BSM audit support for the time being. ok djm@ 1516 - (dtucker) OpenBSD CVS Sync (regress/) 1517 - fgsch@cvs.openbsd.org 2004/12/10 01:31:30 1518 [Makefile sftp-glob.sh] 1519 some globbing regress; prompted and ok djm@ 1520 - david@cvs.openbsd.org 2005/01/14 04:21:18 1521 [Makefile test-exec.sh] 1522 pass the SUDO make variable to the individual sh tests; ok dtucker@ markus@ 1523 - dtucker@cvs.openbsd.org 2005/02/27 11:33:30 1524 [multiplex.sh test-exec.sh sshd-log-wrapper.sh] 1525 Add optional capability to log output from regress commands; ok markus@ 1526 Use with: make TEST_SSH_LOGFILE=/tmp/regress.log 1527 - djm@cvs.openbsd.org 2005/02/27 23:13:36 1528 [login-timeout.sh] 1529 avoid nameservice lookups in regress test; ok dtucker@ 1530 - djm@cvs.openbsd.org 2005/03/04 08:48:46 1531 [Makefile envpass.sh] 1532 regress test for SendEnv config parsing bug; ok dtucker@ 1533 - (dtucker) [regress/test-exec.sh] Put SUDO in the right place. 1534 - (tim) [configure.ac] SCO 3.2v4.2 no longer supported. 1535 153620050306 1537 - (dtucker) [monitor.c] Bug #125 comment #47: fix errors returned by monitor 1538 when attempting to audit disconnect events. Reported by Phil Dibowitz. 1539 - (dtucker) [session.c sshd.c] Bug #125 comment #49: Send disconnect audit 1540 events earlier, prevents mm_request_send errors reported by Matt Goebel. 1541 154220050305 1543 - (djm) [contrib/cygwin/README] Improve Cygwin build documentation. Patch 1544 from vinschen at redhat.com 1545 - (djm) OpenBSD CVS Sync 1546 - jmc@cvs.openbsd.org 2005/03/02 11:45:01 1547 [ssh.1] 1548 missing word; 1549 - djm@cvs.openbsd.org 2005/03/04 08:48:06 1550 [readconf.c] 1551 fix SendEnv config parsing bug found by Roumen Petrov; ok dtucker@ 1552 155320050302 1554 - (djm) OpenBSD CVS sync: 1555 - jmc@cvs.openbsd.org 2005/03/01 14:47:58 1556 [ssh.1] 1557 remove some unneccesary macros; 1558 do not mark up punctuation; 1559 - jmc@cvs.openbsd.org 2005/03/01 14:55:23 1560 [ssh_config.5] 1561 do not mark up punctuation; 1562 whitespace; 1563 - jmc@cvs.openbsd.org 2005/03/01 14:59:49 1564 [sshd.8] 1565 new sentence, new line; 1566 whitespace; 1567 - jmc@cvs.openbsd.org 2005/03/01 15:05:00 1568 [ssh-keygen.1] 1569 whitespace; 1570 - jmc@cvs.openbsd.org 2005/03/01 15:47:14 1571 [ssh-keyscan.1 ssh-keyscan.c] 1572 sort options and sync usage(); 1573 - jmc@cvs.openbsd.org 2005/03/01 17:19:35 1574 [scp.1 sftp.1] 1575 add HashKnownHosts to -o list; 1576 ok markus@ 1577 - jmc@cvs.openbsd.org 2005/03/01 17:22:06 1578 [ssh.c] 1579 sync usage() w/ man SYNOPSIS; 1580 ok markus@ 1581 - jmc@cvs.openbsd.org 2005/03/01 17:32:19 1582 [ssh-add.1] 1583 sort options; 1584 - jmc@cvs.openbsd.org 2005/03/01 18:15:56 1585 [ssh-keygen.1] 1586 sort options (no attempt made at synopsis clean up though); 1587 spelling (occurance -> occurrence); 1588 use prompt before examples; 1589 grammar; 1590 - djm@cvs.openbsd.org 2005/03/02 01:00:06 1591 [sshconnect.c] 1592 fix addition of new hashed hostnames when CheckHostIP=yes; 1593 found and ok dtucker@ 1594 - djm@cvs.openbsd.org 2005/03/02 01:27:41 1595 [ssh-keygen.c] 1596 ignore hostnames with metachars when hashing; ok deraadt@ 1597 - djm@cvs.openbsd.org 2005/03/02 02:21:07 1598 [ssh.1] 1599 bz#987: mention ForwardX11Trusted in ssh.1, 1600 reported by andrew.benham AT thus.net; ok deraadt@ 1601 - (tim) [regress/agent-ptrace.sh] add another possible gdb error. 1602 160320050301 1604 - (djm) OpenBSD CVS sync: 1605 - otto@cvs.openbsd.org 2005/02/16 09:56:44 1606 [ssh.c] 1607 Better diagnostic if an identity file is not accesible. ok markus@ djm@ 1608 - djm@cvs.openbsd.org 2005/02/18 03:05:53 1609 [canohost.c] 1610 better error messages for getnameinfo failures; ok dtucker@ 1611 - djm@cvs.openbsd.org 2005/02/20 22:59:06 1612 [sftp.c] 1613 turn on ssh batch mode when in sftp batch mode, patch from 1614 jdmossh AT nand.net; 1615 ok markus@ 1616 - jmc@cvs.openbsd.org 2005/02/25 10:55:13 1617 [sshd.8] 1618 add /etc/motd and $HOME/.hushlogin to FILES; 1619 from michael knudsen; 1620 - djm@cvs.openbsd.org 2005/02/28 00:54:10 1621 [ssh_config.5] 1622 bz#849: document timeout on untrusted x11 forwarding sessions. Reported by 1623 orion AT cora.nwra.com; ok markus@ 1624 - djm@cvs.openbsd.org 2005/03/01 10:09:52 1625 [auth-options.c channels.c channels.h clientloop.c compat.c compat.h] 1626 [misc.c misc.h readconf.c readconf.h servconf.c ssh.1 ssh.c ssh_config.5] 1627 [sshd_config.5] 1628 bz#413: allow optional specification of bind address for port forwardings. 1629 Patch originally by Dan Astorian, but worked on by several people 1630 Adds GatewayPorts=clientspecified option on server to allow remote 1631 forwards to bind to client-specified ports. 1632 - djm@cvs.openbsd.org 2005/03/01 10:40:27 1633 [hostfile.c hostfile.h readconf.c readconf.h ssh.1 ssh_config.5] 1634 [sshconnect.c sshd.8] 1635 add support for hashing host names and addresses added to known_hosts 1636 files, to improve privacy of which hosts user have been visiting; ok 1637 markus@ deraadt@ 1638 - djm@cvs.openbsd.org 2005/03/01 10:41:28 1639 [ssh-keyscan.1 ssh-keyscan.c] 1640 option to hash hostnames output by ssh-keyscan; ok markus@ deraadt@ 1641 - djm@cvs.openbsd.org 2005/03/01 10:42:49 1642 [ssh-keygen.1 ssh-keygen.c ssh_config.5] 1643 add tools for managing known_hosts files with hashed hostnames, including 1644 hashing existing files and deleting hosts by name; ok markus@ deraadt@ 1645 164620050226 1647 - (dtucker) [openbsd-compat/bsd-openpty.c openbsd-compat/inet_ntop.c] 1648 Remove two obsolete Cygwin #ifdefs. Patch from vinschen at redhat.com. 1649 - (dtucker) [acconfig.h configure.ac openbsd-compat/bsd-misc.{c,h}] 1650 Remove SETGROUPS_NOOP, was only used by Cygwin, which doesn't need it any 1651 more. Patch from vinschen at redhat.com. 1652 - (dtucker) [Makefile.in] Add a install-nosysconf target for installing the 1653 binaries without the config files. Primarily useful for packaging. 1654 Patch from phil at usc.edu. ok djm@ 1655 165620050224 1657 - (djm) [configure.ac] in_addr_t test needs sys/types.h too 1658 165920050222 1660 - (dtucker) [uidswap.c] Skip uid restore test on Cygwin. Patch from 1661 vinschen at redhat.com. 1662 166320050220 1664 - (dtucker) [LICENCE Makefile.in README.platform audit-bsm.c configure.ac 1665 defines.h] Bug #125: Add *EXPERIMENTAL* BSM audit support. Configure 1666 --with-audit=bsm to enable. Patch originally from Sun Microsystems, 1667 parts by John R. Jackson. ok djm@ 1668 - (dtucker) [configure.ac] Missing comma in AIX section, somehow causes 1669 unrelated platforms to be configured incorrectly. 1670 167120050216 1672 - (djm) write seed to temporary file and atomically rename into place; 1673 ok dtucker@ 1674 - (dtucker) [ssh-rand-helper.c] Provide seed_rng since it may be called 1675 via mkstemp in some configurations. ok djm@ 1676 - (dtucker) [auth-shadow.c] Prevent compiler warnings if "DAY" is defined 1677 by the system headers. 1678 - (dtucker) [configure.ac] Bug #893: check for libresolv early on Reliant 1679 Unix; prevents problems relating to the location of -lresolv in the 1680 link order. 1681 - (dtucker) [session.c] Bug #918: store credentials from gssapi-with-mic 1682 authentication early enough to be available to PAM session modules when 1683 privsep=yes. Patch from deengert at anl.gov, ok'ed in principle by Sam 1684 Hartman and similar to Debian's ssh-krb5 package. 1685 - (dtucker) [configure.ac openbsd-compat/port-aix.{c,h}] Silence some more 1686 compiler warnings on AIX. 1687 168820050215 1689 - (dtucker) [config.sh.in] Collect oslevel -r too. 1690 - (dtucker) [README.platform auth.c configure.ac loginrec.c 1691 openbsd-compat/port-aix.c openbsd-compat/port-aix.h] Bug #835: enable IPv6 1692 on AIX where possible (see README.platform for details) and work around 1693 a misfeature of AIX's getnameinfo. ok djm@ 1694 - (dtucker) [loginrec.c] Add missing #include. 1695 169620050211 1697 - (dtucker) [configure.ac] Tidy up configure --help output. 1698 - (dtucker) [openbsd-compat/fake-rfc2553.h] We now need EAI_SYSTEM too. 1699 170020050210 1701 - (dtucker) [configure.ac] Bug #919: Provide visible feedback for the 1702 --disable-etc-default-login configure option. 1703 170420050209 1705 - (dtucker) OpenBSD CVS Sync 1706 - dtucker@cvs.openbsd.org 2005/01/28 09:45:53 1707 [ssh_config] 1708 Make it clear that the example entries in ssh_config are only some of the 1709 commonly-used options and refer the user to ssh_config(5) for more 1710 details; ok djm@ 1711 - jmc@cvs.openbsd.org 2005/01/28 15:05:43 1712 [ssh_config.5] 1713 grammar; 1714 - jmc@cvs.openbsd.org 2005/01/28 18:14:09 1715 [ssh_config.5] 1716 wording; 1717 ok markus@ 1718 - dtucker@cvs.openbsd.org 2005/01/30 11:18:08 1719 [monitor.c] 1720 Make code match intent; ok djm@ 1721 - dtucker@cvs.openbsd.org 2005/02/08 22:24:57 1722 [sshd.c] 1723 Provide reason in error message if getnameinfo fails; ok markus@ 1724 - (dtucker) [auth-passwd.c openbsd-compat/port-aix.c] Don't call 1725 disable_forwarding() from compat library. Prevent linker errrors trying 1726 to resolve it for binaries other than sshd. ok djm@ 1727 - (dtucker) [configure.ac] Bug #854: prepend pwd to relative --with-ssl-dir 1728 paths. ok djm@ 1729 - (dtucker) [configure.ac session.c] Some platforms (eg some SCO) require 1730 the username to be passed to the passwd command when changing expired 1731 passwords. ok djm@ 1732 173320050208 1734 - (dtucker) [regress/test-exec.sh] Bug #912: Set _POSIX2_VERSION for the 1735 regress tests so newer versions of GNU head(1) behave themselves. Patch 1736 by djm, so ok me. 1737 - (dtucker) [openbsd-compat/port-aix.c] Silence compiler warnings. 1738 - (dtucker) [audit.c audit.h auth.c auth1.c auth2.c loginrec.c monitor.c 1739 monitor_wrap.c monitor_wrap.h session.c sshd.c]: Prepend all of the audit 1740 defines and enums with SSH_ to prevent namespace collisions on some 1741 platforms (eg AIX). 1742 174320050204 1744 - (dtucker) [monitor.c] Permit INVALID_USER audit events from slave too. 1745 - (dtucker) [auth.c] Fix parens in audit log check. 1746 174720050202 1748 - (dtucker) [configure.ac openbsd-compat/realpath.c] Sync up with realpath 1749 rev 1.11 from OpenBSD and make it use fchdir if available. ok djm@ 1750 - (dtucker) [auth.c loginrec.h openbsd-compat/{bsd-cray,port-aix}.{c,h}] 1751 Make record_failed_login() call provide hostname rather than having the 1752 implementations having to do lookups themselves. Only affects AIX and 1753 UNICOS (the latter only uses the "user" parameter anyway). ok djm@ 1754 - (dtucker) [session.c sshd.c] Bug #445: Propogate KRB5CCNAME if set to child 1755 the process. Since we also unset KRB5CCNAME at startup, if it's set after 1756 authentication it must have been set by the platform's native auth system. 1757 This was already done for AIX; this enables it for the general case. 1758 - (dtucker) [auth.c canohost.c canohost.h configure.ac defines.h loginrec.c] 1759 Bug #974: Teach sshd to write failed login records to btmp for failed auth 1760 attempts (currently only for password, kbdint and C/R, only on Linux and 1761 HP-UX), based on code from login.c from util-linux. With ashok_kovai at 1762 hotmail.com, ok djm@ 1763 - (dtucker) [Makefile.in auth.c auth.h auth1.c auth2.c loginrec.c monitor.c 1764 monitor.h monitor_wrap.c monitor_wrap.h session.c sshd.c] Bug #125: 1765 (first stage) Add audit instrumentation to sshd, currently disabled by 1766 default. with suggestions from and ok djm@ 1767 176820050201 1769 - (dtucker) [log.c] Bug #973: force log_init() to open syslog, since on some 1770 platforms syslog will revert to its default values. This may result in 1771 messages from external libraries (eg libwrap) being sent to a different 1772 facility. 1773 - (dtucker) [sshd_config.5] Bug #701: remove warning about 1774 keyboard-interactive since this is no longer the case. 1775 177620050124 1777 - (dtucker) OpenBSD CVS Sync 1778 - otto@cvs.openbsd.org 2005/01/21 08:32:02 1779 [auth-passwd.c sshd.c] 1780 Warn in advance for password and account expiry; initialize loginmsg 1781 buffer earlier and clear it after privsep fork. ok and help dtucker@ 1782 markus@ 1783 - dtucker@cvs.openbsd.org 2005/01/22 08:17:59 1784 [auth.c] 1785 Log source of connections denied by AllowUsers, DenyUsers, AllowGroups and 1786 DenyGroups. bz #909, ok djm@ 1787 - djm@cvs.openbsd.org 2005/01/23 10:18:12 1788 [cipher.c] 1789 config option "Ciphers" should be case-sensitive; ok dtucker@ 1790 - dtucker@cvs.openbsd.org 2005/01/24 10:22:06 1791 [scp.c sftp.c] 1792 Have scp and sftp wait for the spawned ssh to exit before they exit 1793 themselves. This prevents ssh from being unable to restore terminal 1794 modes (not normally a problem on OpenBSD but common with -Portable 1795 on POSIX platforms). From peak at argo.troja.mff.cuni.cz (bz#950); 1796 ok djm@ markus@ 1797 - dtucker@cvs.openbsd.org 2005/01/24 10:29:06 1798 [moduli] 1799 Import new moduli; requested by deraadt@ a week ago 1800 - dtucker@cvs.openbsd.org 2005/01/24 11:47:13 1801 [auth-passwd.c] 1802 #if -> #ifdef so builds without HAVE_LOGIN_CAP work too; ok djm@ otto@ 1803 180420050120 1805 - (dtucker) OpenBSD CVS Sync 1806 - markus@cvs.openbsd.org 2004/12/23 17:35:48 1807 [session.c] 1808 check for NULL; from mpech 1809 - markus@cvs.openbsd.org 2004/12/23 17:38:07 1810 [ssh-keygen.c] 1811 leak; from mpech 1812 - djm@cvs.openbsd.org 2004/12/23 23:11:00 1813 [servconf.c servconf.h sshd.c sshd_config sshd_config.5] 1814 bz #898: support AddressFamily in sshd_config. from 1815 peak@argo.troja.mff.cuni.cz; ok deraadt@ 1816 - markus@cvs.openbsd.org 2005/01/05 08:51:32 1817 [sshconnect.c] 1818 remove dead code, log connect() failures with level error, ok djm@ 1819 - jmc@cvs.openbsd.org 2005/01/08 00:41:19 1820 [sshd_config.5] 1821 `login'(n) -> `log in'(v); 1822 - dtucker@cvs.openbsd.org 2005/01/17 03:25:46 1823 [moduli.c] 1824 Correct spelling: SCHNOOR->SCHNORR; ok djm@ 1825 - dtucker@cvs.openbsd.org 2005/01/17 22:48:39 1826 [sshd.c] 1827 Make debugging output continue after reexec; ok djm@ 1828 - dtucker@cvs.openbsd.org 2005/01/19 13:11:47 1829 [auth-bsdauth.c auth2-chall.c] 1830 Have keyboard-interactive code call the drivers even for responses for 1831 invalid logins. This allows the drivers themselves to decide how to 1832 handle them and prevent leaking information where possible. Existing 1833 behaviour for bsdauth is maintained by checking authctxt->valid in the 1834 bsdauth driver. Note that any third-party kbdint drivers will now need 1835 to be able to handle responses for invalid logins. ok markus@ 1836 - djm@cvs.openbsd.org 2004/12/22 02:13:19 1837 [cipher-ctr.c cipher.c] 1838 remove fallback AES support for old OpenSSL, as OpenBSD has had it for 1839 many years now; ok deraadt@ 1840 (Id sync only: Portable will continue to support older OpenSSLs) 1841 - (dtucker) [auth-pam.c] Bug #971: Prevent leaking information about user 1842 existence via keyboard-interactive/pam, in conjunction with previous 1843 auth2-chall.c change; with Colin Watson and djm. 1844 - (dtucker) [loginrec.h] Bug #952: Increase size of username field to 128 1845 bytes to prevent errors from login_init_entry() when the username is 1846 exactly 64 bytes(!) long. From brhamon at cisco.com, ok djm@ 1847 - (dtucker) [auth-chall.c auth.h auth2-chall.c] Bug #936: Remove pam from 1848 the list of available kbdint devices if UsePAM=no. ok djm@ 1849 185020050118 1851 - (dtucker) [INSTALL Makefile.in configure.ac survey.sh.in] Implement 1852 "make survey" and "make send-survey". This will provide data on the 1853 configure parameters, platform and platform features to the development 1854 team, which will allow (among other things) better targetting of testing. 1855 It's entirely voluntary and is off be default. ok djm@ 1856 - (dtucker) [survey.sh.in] Remove any blank lines from the output of 1857 ccver-v and ccver-V. 1858 185920041220 1860 - (dtucker) [ssh-rand-helper.c] Fall back to command-based seeding if reading 1861 from prngd is enabled at compile time but fails at run time, eg because 1862 prngd is not running. Note that if you have prngd running when OpenSSH is 1863 built, OpenSSL will consider itself internally seeded and rand-helper won't 1864 be built at all unless explicitly enabled via --with-rand-helper. ok djm@ 1865 - (dtucker) [regress/rekey.sh] Touch datafile before filling with dd, since 1866 on some wacky platforms (eg old AIXes), dd will refuse to create an output 1867 file if it doesn't exist. 1868 186920041213 1870 - (dtucker) [contrib/findssh.sh] Clean up on interrupt; from 1871 amarendra.godbole at ge com. 1872 187320041211 1874 - (dtucker) OpenBSD CVS Sync 1875 - markus@cvs.openbsd.org 2004/12/06 16:00:43 1876 [bufaux.c] 1877 use 0x00 not \0 since buf[] is a bignum 1878 - fgsch@cvs.openbsd.org 2004/12/10 03:10:42 1879 [sftp.c] 1880 - fix globbed ls for paths the same lenght as the globbed path when 1881 we have a unique matching. 1882 - fix globbed ls in case of a directory when we have a unique matching. 1883 - as a side effect, if the path does not exist error (used to silently 1884 ignore). 1885 - don't do extra do_lstat() if we only have one matching file. 1886 djm@ ok 1887 - dtucker@cvs.openbsd.org 2004/12/11 01:48:56 1888 [auth-rsa.c auth2-pubkey.c authfile.c misc.c misc.h] 1889 Fix debug call in error path of authorized_keys processing and fix related 1890 warnings; ok djm@ 1891 189220041208 1893 - (tim) [configure.ac] Comment some non obvious platforms in the 1894 target-specific case statement. Suggested and OK by dtucker@ 1895 189620041207 1897 - (dtucker) [regress/scp.sh] Use portable-friendly $DIFFOPTs in new test. 1898 189920041206 1900 - (dtucker) [TODO WARNING.RNG] Update to reflect current reality. ok djm@ 1901 - (dtucker) OpenBSD CVS Sync 1902 - markus@cvs.openbsd.org 2004/11/25 22:22:14 1903 [sftp-client.c sftp.c] 1904 leak; from mpech 1905 - jmc@cvs.openbsd.org 2004/11/29 00:05:17 1906 [sftp.1] 1907 missing full stop; 1908 - djm@cvs.openbsd.org 2004/11/29 07:41:24 1909 [sftp-client.h sftp.c] 1910 Some small fixes from moritz@jodeit.org. ok deraadt@ 1911 - jaredy@cvs.openbsd.org 2004/12/05 23:55:07 1912 [sftp.1] 1913 - explain that patterns can be used as arguments in get/put/ls/etc 1914 commands (prodded by Michael Knudsen) 1915 - describe ls flags as a list 1916 - other minor improvements 1917 ok jmc, djm 1918 - dtucker@cvs.openbsd.org 2004/12/06 11:41:03 1919 [auth-rsa.c auth2-pubkey.c authfile.c misc.c misc.h ssh.h sshd.8] 1920 Discard over-length authorized_keys entries rather than complaining when 1921 they don't decode. bz #884, with & ok djm@ 1922 - (dtucker) OpenBSD CVS Sync (regress/) 1923 - djm@cvs.openbsd.org 2004/06/26 06:16:07 1924 [reexec.sh] 1925 don't change the name of the copied sshd for the reexec fallback test, 1926 makes life simpler for portable 1927 - dtucker@cvs.openbsd.org 2004/07/08 12:59:35 1928 [scp.sh] 1929 Regress test for bz #863 (scp double-error), requires $SUDO. ok markus@ 1930 - david@cvs.openbsd.org 2004/07/09 19:45:43 1931 [Makefile] 1932 add a missing CLEANFILES used in the re-exec test 1933 - djm@cvs.openbsd.org 2004/10/08 02:01:50 1934 [reexec.sh] 1935 shrink and tidy; ok dtucker@ 1936 - djm@cvs.openbsd.org 2004/10/29 23:59:22 1937 [Makefile added brokenkeys.sh] 1938 regression test for handling of corrupt keys in authorized_keys file 1939 - djm@cvs.openbsd.org 2004/11/07 00:32:41 1940 [multiplex.sh] 1941 regression tests for new multiplex commands 1942 - dtucker@cvs.openbsd.org 2004/11/25 09:39:27 1943 [test-exec.sh] 1944 Remove obsolete RhostsAuthentication from test config; ok markus@ 1945 - dtucker@cvs.openbsd.org 2004/12/06 10:49:56 1946 [test-exec.sh] 1947 Check if TEST_SSH_SSHD is a full path to sshd before searching; ok markus@ 1948 194920041203 1950 - (dtucker) OpenBSD CVS Sync 1951 - jmc@cvs.openbsd.org 2004/11/07 17:42:36 1952 [ssh.1] 1953 options sort, and whitespace; 1954 - jmc@cvs.openbsd.org 2004/11/07 17:57:30 1955 [ssh.c] 1956 usage(): 1957 - add -O 1958 - sync -S w/ manpage 1959 - remove -h 1960 - (dtucker) [auth1.c auth2.c] If the user successfully authenticates but is 1961 subsequently denied by the PAM auth stack, send the PAM message to the 1962 user via packet_disconnect (Protocol 1) or userauth_banner (Protocol 2). 1963 ok djm@ 1964 196520041107 1966 - (dtucker) OpenBSD CVS Sync 1967 - djm@cvs.openbsd.org 2004/11/05 12:19:56 1968 [sftp.c] 1969 command editing and history support via libedit; ok markus@ 1970 thanks to hshoexer@ and many testers on tech@ too 1971 - djm@cvs.openbsd.org 2004/11/07 00:01:46 1972 [clientloop.c clientloop.h ssh.1 ssh.c] 1973 add basic control of a running multiplex master connection; including the 1974 ability to check its status and request it to exit; ok markus@ 1975 - (dtucker) [INSTALL Makefile.in configure.ac] Add --with-libedit configure 1976 option and supporting makefile bits and documentation. 1977 197820041105 1979 - (dtucker) OpenBSD CVS Sync 1980 - markus@cvs.openbsd.org 2004/08/30 09:18:08 1981 [LICENCE] 1982 s/keygen/keyscan/ 1983 - jmc@cvs.openbsd.org 2004/08/30 21:22:49 1984 [ssh-add.1 ssh.1] 1985 .Xsession -> .xsession; 1986 originally from a pr from f at obiit dot org, but missed by myself; 1987 ok markus@ matthieu@ 1988 - djm@cvs.openbsd.org 2004/09/07 23:41:30 1989 [clientloop.c ssh.c] 1990 cleanup multiplex control socket on SIGHUP too, spotted by sturm@ 1991 ok markus@ deraadt@ 1992 - deraadt@cvs.openbsd.org 2004/09/15 00:46:01 1993 [ssh.c] 1994 /* fallthrough */ is something a programmer understands. But 1995 /* FALLTHROUGH */ is also understood by lint, so that is better. 1996 - jaredy@cvs.openbsd.org 2004/09/15 03:25:41 1997 [sshd_config.5] 1998 mention PrintLastLog only prints last login time for interactive 1999 sessions, like PrintMotd mentions. 2000 From Michael Knudsen, with wording changed slightly to match the 2001 PrintMotd description. 2002 ok djm 2003 - mickey@cvs.openbsd.org 2004/09/15 18:42:27 2004 [sshd.c] 2005 use less doubles in daemons; markus@ ok 2006 - deraadt@cvs.openbsd.org 2004/09/15 18:46:04 2007 [scp.c] 2008 scratch that do { } while (0) wrapper in this case 2009 - djm@cvs.openbsd.org 2004/09/23 13:00:04 2010 [ssh.c] 2011 correctly honour -n in multiplex client mode; spotted by sturm@ ok markus@ 2012 - djm@cvs.openbsd.org 2004/09/25 03:45:14 2013 [sshd.c] 2014 these printf args are no longer double; ok deraadt@ markus@ 2015 - djm@cvs.openbsd.org 2004/10/07 10:10:24 2016 [scp.1 sftp.1 ssh.1 ssh_config.5] 2017 document KbdInteractiveDevices; ok markus@ 2018 - djm@cvs.openbsd.org 2004/10/07 10:12:36 2019 [ssh-agent.c] 2020 don't unlink agent socket when bind() fails, spotted by rich AT 2021 rich-paul.net, ok markus@ 2022 - markus@cvs.openbsd.org 2004/10/20 11:48:53 2023 [packet.c ssh1.h] 2024 disconnect for invalid (out of range) message types. 2025 - djm@cvs.openbsd.org 2004/10/29 21:47:15 2026 [channels.c channels.h clientloop.c] 2027 fix some window size change bugs for multiplexed connections: windows sizes 2028 were not being updated if they had changed after ~^Z suspends and SIGWINCH 2029 was not being processed unless the first connection had requested a tty; 2030 ok markus 2031 - djm@cvs.openbsd.org 2004/10/29 22:53:56 2032 [clientloop.c misc.h readpass.c ssh-agent.c] 2033 factor out common permission-asking code to separate function; ok markus@ 2034 - djm@cvs.openbsd.org 2004/10/29 23:56:17 2035 [bufaux.c bufaux.h buffer.c buffer.h] 2036 introduce a new buffer API that returns an error rather than fatal()ing 2037 when presented with bad data; ok markus@ 2038 - djm@cvs.openbsd.org 2004/10/29 23:57:05 2039 [key.c] 2040 use new buffer API to avoid fatal errors on corrupt keys in authorized_keys 2041 files; ok markus@ 2042 204320041102 2044 - (dtucker) [configure.ac includes.h] Bug #947: Fix compile error on HP-UX 2045 10.x by testing for conflicts in shadow.h and undef'ing _INCLUDE__STDC__ 2046 only if a conflict is detected. 2047 204820041019 2049 - (dtucker) [uidswap.c] Don't test dropping of gids for the root user or 2050 on Cygwin. Cygwin parts from vinschen at redhat com; ok djm@ 2051 205220041016 2053 - (djm) [auth-pam.c] snprintf->strl*, fix server message length calculations; 2054 ok dtucker@ 2055 205620041006 2057 - (dtucker) [README.privsep] Bug #939: update info about HP-UX Trusted Mode 2058 and other PAM platforms. 2059 - (dtucker) [monitor_mm.c openbsd-compat/xmmap.c] Bug #940: cast constants 2060 to void * to appease picky compilers (eg Tru64's "cc -std1"). 2061 206220040930 2063 - (dtucker) [configure.ac] Set AC_PACKAGE_NAME. ok djm@ 2064 206520040923 2066 - (dtucker) [openbsd-compat/bsd-snprintf.c] Previous change was off by one, 2067 which could have caused the justification to be wrong. ok djm@ 2068 206920040921 2070 - (dtucker) [openbsd-compat/bsd-snprintf.c] Check for max length too. 2071 ok djm@ 2072 - (dtucker) [contrib/cygwin/ssh-host-config] Update to match current Cygwin 2073 install process. Patch from vinschen at redhat.com. 2074 207520040912 2076 - (djm) [loginrec.c] Start KNF and tidy up of this long-neglected file. 2077 No change in resultant binary 2078 - (djm) [loginrec.c] __func__ifiy 2079 - (djm) [loginrec.c] xmalloc 2080 - (djm) [ssh.c sshd.c version.h] Don't divulge portable version in protocol 2081 banner. Suggested by deraadt@, ok mouring@, dtucker@ 2082 - (dtucker) [configure.ac] Fix incorrect quoting and tests for cross-compile. 2083 Partly by & ok djm@. 2084 208520040911 2086 - (djm) [ssh-agent.c] unifdef some cygwin code; ok dtucker@ 2087 - (dtucker) [auth-pam.c auth-pam.h session.c] Bug #890: Send output from 2088 failing PAM session modules to user then exit, similar to the way 2089 /etc/nologin is handled. ok djm@ 2090 - (dtucker) [auth-pam.c] Relocate sshpam_store_conv(), no code change. 2091 - (djm) [auth2-kbdint.c auth2-none.c auth2-passwd.c auth2-pubkey.c] 2092 Make cygwin code more consistent with that which surrounds it 2093 - (dtucker) [auth-pam.c auth.h auth2-none.c auth2.c monitor.c monitor_wrap.c] 2094 Bug #892: Send messages from failing PAM account modules to the client via 2095 SSH2_MSG_USERAUTH_BANNER messages. Note that this will not happen with 2096 SSH2 kbdint authentication, which need to be dealt with separately. ok djm@ 2097 - (dtucker) [session.c] Bug #927: make .hushlogin silent again. ok djm@ 2098 - (dtucker) [configure.ac] Bug #321: Add cross-compile support to configure. 2099 Parts by chua at ayrnetworks.com, astrand at lysator.liu.se and me. ok djm@ 2100 - (dtucker) [auth-krb5.c] Bug #922: Pass KRB5CCNAME to PAM. From deengert 2101 at anl.gov, ok djm@ 2102 210320040830 2104 - (dtucker) [session.c openbsd-compat/bsd-cygwin_util.{c,h}] Bug #915: only 2105 copy required environment variables on Cygwin. Patch from vinschen at 2106 redhat.com, ok djm@ 2107 - (dtucker) [regress/Makefile] Clean scp-ssh-wrapper.scp too. Patch from 2108 vinschen at redhat.com. 2109 - (dtucker) [Makefile.in contrib/ssh-copy-id] Bug #894: Improve portability 2110 of shell constructs. Patch from cjwatson at debian.org. 2111 211220040829 2113 - (dtucker) [openbsd-compat/getrrsetbyname.c] Prevent getrrsetbyname from 2114 failing with NOMEMORY if no sigs are returned and malloc(0) returns NULL. 2115 From Martin.Kraemer at Fujitsu-Siemens.com; ok djm@ 2116 - (dtucker) OpenBSD CVS Sync 2117 - djm@cvs.openbsd.org 2004/08/23 11:48:09 2118 [authfile.c] 2119 fix error path, spotted by Martin.Kraemer AT Fujitsu-Siemens.com; ok markus 2120 - djm@cvs.openbsd.org 2004/08/23 11:48:47 2121 [channels.c] 2122 typo, spotted by Martin.Kraemer AT Fujitsu-Siemens.com; ok markus 2123 - dtucker@cvs.openbsd.org 2004/08/23 14:26:38 2124 [ssh-keysign.c ssh.c] 2125 Use permanently_set_uid() in ssh and ssh-keysign for consistency, matches 2126 change in Portable; ok markus@ (CVS ID sync only) 2127 - dtucker@cvs.openbsd.org 2004/08/23 14:29:23 2128 [ssh-keysign.c] 2129 Remove duplicate getuid(), suggested by & ok markus@ 2130 - markus@cvs.openbsd.org 2004/08/26 16:00:55 2131 [ssh.1 sshd.8] 2132 get rid of references to rhosts authentication; with jmc@ 2133 - djm@cvs.openbsd.org 2004/08/28 01:01:48 2134 [sshd.c] 2135 don't erroneously close stdin for !reexec case, from Dave Johnson; 2136 ok markus@ 2137 - (dtucker) [configure.ac] Include sys/stream.h in sys/ptms.h header check, 2138 fixes configure warning on Solaris reported by wknox at mitre.org. 2139 - (dtucker) [regress/multiplex.sh] Skip test on platforms that do not 2140 support FD passing since multiplex requires it. Noted by tim@ 2141 - (dtucker) [regress/dynamic-forward.sh] Allow time for connections to be torn 2142 down, needed on some platforms, should be harmless on others. Patch from 2143 jason at devrandom.org. 2144 - (dtucker) [regress/scp.sh] Make this work on Cygwin too, which doesn't like 2145 files ending in .exe that aren't binaries; patch from vinschen at redhat.com. 2146 - (dtucker) [Makefile.in] Get regress/Makefile symlink right for out-of-tree 2147 builds too, from vinschen at redhat.com. 2148 - (dtucker) [regress/agent-ptrace.sh] Skip ptrace test on OSF1/DUnix/Tru64 2149 too; patch from cmadams at hiwaay.net. 2150 - (dtucker) [configure.ac] Replace non-portable echo \n with extra echo. 2151 - (dtucker) [openbsd-compat/port-aix.c] Bug #712: Explicitly check for 2152 accounts with authentication configs that sshd can't support (ie 2153 SYSTEM=NONE and AUTH1=something). 2154 215520040828 2156 - (dtucker) [openbsd-compat/mktemp.c] Remove superfluous Cygwin #ifdef; from 2157 vinschen at redhat.com. 2158 215920040823 2160 - (djm) [ssh-rand-helper.c] Typo. Found by 2161 Martin.Kraemer AT Fujitsu-Siemens.com 2162 - (djm) [loginrec.c] Typo and bad args in error messages; Spotted by 2163 Martin.Kraemer AT Fujitsu-Siemens.com 2164 216520040817 2166 - (dtucker) [regress/README.regress] Note compatibility issues with GNU head. 2167 - (djm) OpenBSD CVS Sync 2168 - markus@cvs.openbsd.org 2004/08/16 08:17:01 2169 [version.h] 2170 3.9 2171 - (djm) Crank RPM spec version numbers 2172 - (djm) Release 3.9p1 2173 217420040816 2175 - (dtucker) [acconfig.h auth-pam.c configure.ac] Set real uid to non-root 2176 to convince Solaris PAM to honour password complexity rules. ok djm@ 2177 217820040815 2179 - (dtucker) [Makefile.in ssh-keysign.c ssh.c] Use permanently_set_uid() since 2180 it does the right thing on all platforms. ok djm@ 2181 - (djm) [acconfig.h configure.ac openbsd-compat/Makefile.in 2182 openbsd-compat/bsd-closefrom.c openbsd-compat/bsd-misc.c 2183 openbsd-compat/bsd-misc.h openbsd-compat/openbsd-compat.h] Use smarter 2184 closefrom() replacement from sudo; ok dtucker@ 2185 - (djm) [loginrec.c] Check that seek succeeded here too; ok dtucker 2186 - (dtucker) [Makefile.in] Fix typo. 2187 218820040814 2189 - (dtucker) [auth-krb5.c gss-serv-krb5.c openbsd-compat/xmmap.c] 2190 Explicitly set umask for mkstemp; ok djm@ 2191 - (dtucker) [includes.h] Undef _INCLUDE__STDC__ on HP-UX, otherwise 2192 prot.h and shadow.h provide conflicting declarations of getspnam. ok djm@ 2193 - (dtucker) [loginrec.c openbsd-compat/port-aix.c openbsd-compat/port-aix.h] 2194 Plug AIX login recording into login_write so logins will be recorded for 2195 all auth types. 2196 219720040813 2198 - (dtucker) [openbsd-compat/bsd-misc.c] Typo in #ifdef; from vinschen at 2199 redhat.com 2200- (dtucker) OpenBSD CVS Sync 2201 - avsm@cvs.openbsd.org 2004/08/11 21:43:05 2202 [channels.c channels.h clientloop.c misc.c misc.h serverloop.c ssh-agent.c] 2203 some signed/unsigned int comparison cleanups; markus@ ok 2204 - avsm@cvs.openbsd.org 2004/08/11 21:44:32 2205 [authfd.c scp.c ssh-keyscan.c] 2206 use atomicio instead of homegrown equivalents or read/write. 2207 markus@ ok 2208 - djm@cvs.openbsd.org 2004/08/12 09:18:24 2209 [sshlogin.c] 2210 typo in error message, spotted by moritz AT jodeit.org (Id sync only) 2211 - jakob@cvs.openbsd.org 2004/08/12 21:41:13 2212 [ssh-keygen.1 ssh.1] 2213 improve SSHFP documentation; ok deraadt@ 2214 - jmc@cvs.openbsd.org 2004/08/13 00:01:43 2215 [ssh-keygen.1] 2216 kill whitespace at eol; 2217 - djm@cvs.openbsd.org 2004/08/13 02:51:48 2218 [monitor_fdpass.c] 2219 extra check for no message case; ok markus, deraadt, hshoexer, henning 2220 - dtucker@cvs.openbsd.org 2004/08/13 11:09:24 2221 [servconf.c] 2222 Fix line numbers off-by-one in error messages, from tortay at cc.in2p3.fr 2223 ok markus@, djm@ 2224 222520040812 2226 - (dtucker) [sshd.c] Remove duplicate variable imported during sync. 2227 - (dtucker) OpenBSD CVS Sync 2228 - markus@cvs.openbsd.org 2004/07/28 08:56:22 2229 [sshd.c] 2230 call setsid() _before_ re-exec 2231 - markus@cvs.openbsd.org 2004/07/28 09:40:29 2232 [auth.c auth1.c auth2.c cipher.c cipher.h key.c session.c ssh.c 2233 sshconnect1.c] 2234 more s/illegal/invalid/ 2235 - djm@cvs.openbsd.org 2004/08/04 10:37:52 2236 [dh.c] 2237 return group14 when no primes found - fixes hang on empty /etc/moduli; 2238 ok markus@ 2239 - dtucker@cvs.openbsd.org 2004/08/11 11:09:54 2240 [servconf.c] 2241 Fix minor leak; "looks right" deraadt@ 2242 - dtucker@cvs.openbsd.org 2004/08/11 11:50:09 2243 [sshd.c] 2244 Don't try to close startup_pipe if it's not open; ok djm@ 2245 - djm@cvs.openbsd.org 2004/08/11 11:59:22 2246 [sshlogin.c] 2247 check that lseek went were we told it to; ok markus@ 2248 (Id sync only, but similar changes are needed in loginrec.c) 2249 - djm@cvs.openbsd.org 2004/08/11 12:01:16 2250 [sshlogin.c] 2251 make store_lastlog_message() static to appease -Wall; ok markus 2252 - (dtucker) [sshd.c] Clear loginmsg in postauth monitor, prevents doubling 2253 messages generated before the postauth privsep split. 2254 225520040720 2256 - (djm) OpenBSD CVS Sync 2257 - markus@cvs.openbsd.org 2004/07/21 08:56:12 2258 [auth.c] 2259 s/Illegal user/Invalid user/; many requests; ok djm, millert, niklas, 2260 miod, ... 2261 - djm@cvs.openbsd.org 2004/07/21 10:33:31 2262 [auth1.c auth2.c] 2263 bz#899: Don't display invalid usernames in setproctitle 2264 from peak AT argo.troja.mff.cuni.cz; ok markus@ 2265 - djm@cvs.openbsd.org 2004/07/21 10:36:23 2266 [gss-serv-krb5.c] 2267 fix function declaration 2268 - djm@cvs.openbsd.org 2004/07/21 11:51:29 2269 [canohost.c] 2270 bz#902: cache remote port so we don't fatal() in auth_log when remote 2271 connection goes away quickly. from peak AT argo.troja.mff.cuni.cz; 2272 ok markus@ 2273 - (djm) [auth-pam.c] Portable parts of bz#899: Don't display invalid 2274 usernames in setproctitle from peak AT argo.troja.mff.cuni.cz; 2275 227620040720 2277 - (djm) [log.c] bz #111: Escape more control characters when sending data 2278 to syslog; from peak AT argo.troja.mff.cuni.cz 2279 - (djm) [contrib/redhat/sshd.pam] bz #903: Remove redundant entries; from 2280 peak AT argo.troja.mff.cuni.cz 2281 - (djm) [regress/README.regress] Remove caveat regarding TCP wrappers, now 2282 that sshd is fixed to behave better; suggested by tim 2283 228420040719 2285 - (djm) [openbsd-compat/bsd-arc4random.c] Discard early keystream, like OpenBSD 2286 ok dtucker@ 2287 - (djm) [auth-pam.c] Avoid use of xstrdup and friends in conversation function, 2288 instead return PAM_CONV_ERR, avoiding another path to fatal(); ok dtucker@ 2289 - (tim) [configure.ac] updwtmpx() on OpenServer seems to add duplicate entry. 2290 Report by rac AT tenzing.org 2291 229220040717 2293 - (dtucker) [logintest.c scp.c sftp-server.c sftp.c ssh-add.c ssh-agent.c 2294 ssh-keygen.c ssh-keyscan.c ssh-keysign.c ssh-rand-helper.c ssh.c sshd.c 2295 openbsd-compat/bsd-misc.c] Move "char *__progname" to bsd-misc.c. Reduces 2296 diff vs OpenBSD; ok mouring@, tested by tim@ too. 2297 - (dtucker) OpenBSD CVS Sync 2298 - deraadt@cvs.openbsd.org 2004/07/11 17:48:47 2299 [channels.c cipher.c clientloop.c clientloop.h compat.h moduli.c 2300 readconf.c nchan.c pathnames.h progressmeter.c readconf.h servconf.c 2301 session.c sftp-client.c sftp.c ssh-agent.1 ssh-keygen.c ssh.c ssh1.h 2302 sshd.c ttymodes.h] 2303 spaces 2304 - brad@cvs.openbsd.org 2004/07/12 23:34:25 2305 [ssh-keyscan.1] 2306 Fix incorrect macro, .I -> .Em 2307 From: Eric S. Raymond <esr at thyrsus dot com> 2308 ok jmc@ 2309 - dtucker@cvs.openbsd.org 2004/07/17 05:31:41 2310 [monitor.c monitor_wrap.c session.c session.h sshd.c sshlogin.c] 2311 Move "Last logged in at.." message generation to the monitor, right 2312 before recording the new login. Fixes missing lastlog message when 2313 /var/log/lastlog is not world-readable and incorrect datestamp when 2314 multiple sessions are used (bz #463); much assistance & ok markus@ 2315 231620040711 2317 - (dtucker) [auth-pam.c] Check for zero from waitpid() too, which allows 2318 the monitor to properly clean up the PAM thread (Debian bug #252676). 2319 232020040709 2321 - (tim) [contrib/cygwin/README] add minires-devel requirement. Patch from 2322 vinschen AT redhat.com 2323 232420040708 2325 - (dtucker) OpenBSD CVS Sync 2326 - dtucker@cvs.openbsd.org 2004/07/03 05:11:33 2327 [sshlogin.c] (RCSID sync only, the corresponding code is not in Portable) 2328 Use '\0' not 0 for string; ok djm@, deraadt@ 2329 - dtucker@cvs.openbsd.org 2004/07/03 11:02:25 2330 [monitor_wrap.c] 2331 Put s/key functions inside #ifdef SKEY same as monitor.c, 2332 from des@freebsd via bz #330, ok markus@ 2333 - dtucker@cvs.openbsd.org 2004/07/08 12:47:21 2334 [scp.c] 2335 Prevent scp from skipping the file following a double-error. 2336 bz #863, ok markus@ 2337 233820040702 2339 - (dtucker) [mdoc2man.awk] Teach it to ignore .Bk -words, reported by 2340 strube at physik3.gwdg.de a long time ago. 2341 234220040701 2343 - (dtucker) [session.c] Call display_loginmsg again after do_pam_session. 2344 Ensures messages from PAM modules are displayed when privsep=no. 2345 - (dtucker) [auth-pam.c] Bug #705: Make arguments match PAM specs, fixes 2346 warnings on compliant platforms. From paul.a.bolton at bt.com. ok djm@ 2347 - (dtucker) [auth-pam.c] Bug #559 (last piece): Pass DISALLOW_NULL_AUTHTOK 2348 to pam_authenticate for challenge-response auth too. Originally from 2349 fcusack at fcusack.com, ok djm@ 2350 - (tim) [buildpkg.sh.in] Add $REV to bump the package revision within 2351 the same version. Handle the case where someone uses --with-privsep-user= 2352 and the user name does not match the group name. ok dtucker@ 2353 235420040630 2355 - (dtucker) [auth-pam.c] Check for buggy PAM modules that return a NULL 2356 appdata_ptr to the conversation function. ok djm@ 2357 - (djm) OpenBSD CVS Sync 2358 - jmc@cvs.openbsd.org 2004/06/26 09:03:21 2359 [ssh.1] 2360 - remove double word 2361 - rearrange .Bk to keep SYNOPSIS nice 2362 - -M before -m in options description 2363 - jmc@cvs.openbsd.org 2004/06/26 09:11:14 2364 [ssh_config.5] 2365 punctuation and grammar fixes. also, keep the options in order. 2366 - jmc@cvs.openbsd.org 2004/06/26 09:14:40 2367 [sshd_config.5] 2368 new sentence, new line; 2369 - avsm@cvs.openbsd.org 2004/06/26 20:07:16 2370 [sshd.c] 2371 initialise some fd variables to -1, djm@ ok 2372 - djm@cvs.openbsd.org 2004/06/30 08:36:59 2373 [session.c] 2374 unbreak TTY break, diagnosed by darren AT dazwin.com; ok markus@ 2375 237620040627 2377 - (tim) update README files. 2378 - (dtucker) [mdoc2man.awk] Bug #883: correctly recognise .Pa and .Ev macros. 2379 - (dtucker) [regress/README.regress] Document new variables. 2380 - (dtucker) [acconfig.h configure.ac sftp-server.c] Bug #823: add sftp 2381 rename handling for Linux which returns EPERM for link() on (at least some) 2382 filesystems that do not support hard links. sftp-server will fall back to 2383 stat+rename() in such cases. 2384 - (dtucker) [openbsd-compat/port-aix.c] Missing __func__. 2385 238620040626 2387 - (djm) OpenBSD CVS Sync 2388 - djm@cvs.openbsd.org 2004/06/25 18:43:36 2389 [sshd.c] 2390 fix broken fd handling in the re-exec fallback path, particularly when 2391 /dev/crypto is in use; ok deraadt@ markus@ 2392 - djm@cvs.openbsd.org 2004/06/25 23:21:38 2393 [sftp.c] 2394 bz #875: fix bad escape char error message; reported by f_mohr AT yahoo.de 2395 239620040625 2397 - (dtucker) OpenBSD CVS Sync 2398 - djm@cvs.openbsd.org 2004/06/24 19:30:54 2399 [servconf.c servconf.h sshd.c] 2400 re-exec sshd on accept(); initial work, final debugging and ok markus@ 2401 - djm@cvs.openbsd.org 2004/06/25 01:16:09 2402 [sshd.c] 2403 only perform tcp wrappers checks when the incoming connection is on a 2404 socket. silences useless warnings from regress tests that use 2405 proxycommand="sshd -i". prompted by david@ ok markus@ 2406 - djm@cvs.openbsd.org 2004/06/24 19:32:00 2407 [regress/Makefile regress/test-exec.sh, added regress/reexec.sh] 2408 regress test for re-exec corner cases 2409 - djm@cvs.openbsd.org 2004/06/25 01:25:12 2410 [regress/test-exec.sh] 2411 clean reexec-specific junk out of text-exec.sh and simplify; idea markus@ 2412 - dtucker@cvs.openbsd.org 2004/06/25 05:38:48 2413 [sftp-server.c] 2414 Fall back to stat+rename if filesystem doesn't doesn't support hard 2415 links. bz#823, ok djm@ 2416 - (dtucker) [configure.ac openbsd-compat/misc.c [openbsd-compat/misc.h] 2417 Add closefrom() for platforms that don't have it. 2418 - (dtucker) [sshd.c] add line missing from reexec sync. 2419 242020040623 2421 - (dtucker) [auth1.c] Ensure do_pam_account is called for Protocol 1 2422 connections with empty passwords. Patch from davidwu at nbttech.com, 2423 ok djm@ 2424 - (dtucker) OpenBSD CVS Sync 2425 - dtucker@cvs.openbsd.org 2004/06/22 22:42:02 2426 [regress/envpass.sh] 2427 Add quoting for test -z; ok markus@ 2428 - dtucker@cvs.openbsd.org 2004/06/22 22:45:52 2429 [regress/test-exec.sh] 2430 Add TEST_SSH_SSHD_CONFOPTS and TEST_SSH_SSH_CONFOPTS to allow adding 2431 arbitary options to sshd_config and ssh_config during tests. ok markus@ 2432 - dtucker@cvs.openbsd.org 2004/06/22 22:55:56 2433 [regress/dynamic-forward.sh regress/test-exec.sh] 2434 Allow setting of port for regress from TEST_SSH_PORT variable; ok markus@ 2435 - mouring@cvs.openbsd.org 2004/06/23 00:39:38 2436 [rijndael.c] 2437 -Wshadow fix up s/encrypt/do_encrypt/. OK djm@, markus@ 2438 - dtucker@cvs.openbsd.org 2004/06/23 14:31:01 2439 [ssh.c] 2440 Fix counting in master/slave when passing environment variables; ok djm@ 2441 - (dtucker) [cipher.c] encrypt->do_encrypt inside SSH_OLD_EVP to match 2442 -Wshadow change. 2443 - (bal) [Makefile.in] Remove opensshd.init on 'make distclean' 2444 - (dtucker) [auth.c openbsd-compat/port-aix.c openbsd-compat/port-aix.h] 2445 Move loginrestrictions test to port-aix.c, replace with a generic hook. 2446 - (tim) [regress/try-ciphers.sh] "if ! some_command" is not portable. 2447 - (bal) [contrib/README] Removed "mdoc2man.pl" reference and added 2448 reference to "findssl.sh" 2449 245020040622 2451 - (dtucker) OpenBSD CVS Sync 2452 - djm@cvs.openbsd.org 2004/06/20 17:36:59 2453 [ssh.c] 2454 filter passed env vars at slave in connection sharing case; ok markus@ 2455 - djm@cvs.openbsd.org 2004/06/20 18:53:39 2456 [sftp.c] 2457 make "ls -l" listings print user/group names, add "ls -n" to show uid/gid 2458 (like /bin/ls); idea & ok markus@ 2459 - djm@cvs.openbsd.org 2004/06/20 19:28:12 2460 [sftp.1] 2461 mention new -n flag 2462 - avsm@cvs.openbsd.org 2004/06/21 17:36:31 2463 [auth-rsa.c auth2-gss.c auth2-pubkey.c authfile.c canohost.c channels.c 2464 cipher.c dns.c kex.c monitor.c monitor_fdpass.c monitor_wrap.c 2465 monitor_wrap.h nchan.c packet.c progressmeter.c scp.c sftp-server.c sftp.c 2466 ssh-gss.h ssh-keygen.c ssh.c sshconnect.c sshconnect1.c sshlogin.c 2467 sshpty.c] 2468 make ssh -Wshadow clean, no functional changes 2469 markus@ ok 2470 - djm@cvs.openbsd.org 2004/06/21 17:53:03 2471 [session.c] 2472 fix fd leak for multiple subsystem connections; with markus@ 2473 - djm@cvs.openbsd.org 2004/06/21 22:02:58 2474 [log.h] 2475 mark fatal and cleanup exit as __dead; ok markus@ 2476 - djm@cvs.openbsd.org 2004/06/21 22:04:50 2477 [sftp.c] 2478 introduce sorting for ls, same options as /bin/ls; ok markus@ 2479 - djm@cvs.openbsd.org 2004/06/21 22:30:45 2480 [sftp.c] 2481 prefix ls option flags with LS_ 2482 - djm@cvs.openbsd.org 2004/06/21 22:41:31 2483 [sftp.1] 2484 document sort options 2485 - djm@cvs.openbsd.org 2004/06/22 01:16:39 2486 [sftp.c] 2487 don't show .files by default in ls, add -a option to turn them back on; 2488 ok markus 2489 - markus@cvs.openbsd.org 2004/06/22 03:12:13 2490 [regress/envpass.sh regress/multiplex.sh] 2491 more portable env passing tests 2492 - dtucker@cvs.openbsd.org 2004/06/22 05:05:45 2493 [monitor.c monitor_wrap.c] 2494 Change login->username, will prevent -Wshadow errors in Portable; 2495 ok markus@ 2496 - (dtucker) [monitor.c] Fix Portable-specific -Wshadow warnings on "socket". 2497 - (dtucker) [defines.h] Define __dead if not already defined. 2498 - (bal) [auth-passwd.c auth1.c] Clean up unused variables. 2499 250020040620 2501 - (tim) [configure.ac Makefile.in] Only change TEST_SHELL on broken platforms. 2502 250320040619 2504 - (dtucker) [auth-pam.c] Don't use PAM namespace for 2505 pam_password_change_required either. 2506 - (tim) [configure.ac buildpkg.sh.in contrib/solaris/README] move opensshd 2507 init script to top level directory. Add opensshd.init.in. 2508 Remove contrib/solaris/buildpkg.sh, contrib/solaris/opensshd.in 2509 251020040618 2511 - (djm) OpenBSD CVS Sync 2512 - djm@cvs.openbsd.org 2004/06/17 14:52:48 2513 [clientloop.c clientloop.h ssh.c] 2514 support environment passing over shared connections; ok markus@ 2515 - djm@cvs.openbsd.org 2004/06/17 15:10:14 2516 [clientloop.c misc.h readconf.c readpass.c ssh.c ssh_config.5] 2517 Add option for confirmation (ControlMaster=ask) via ssh-askpass before 2518 opening shared connections; ok markus@ 2519 - djm@cvs.openbsd.org 2004/06/17 14:53:27 2520 [regress/multiplex.sh] 2521 shared connection env passing regress test 2522 - (dtucker) [regress/README.regress] Add detail on how to run a single 2523 test from the top-level Makefile. 2524 - (dtucker) OpenBSD CVS Sync 2525 - djm@cvs.openbsd.org 2004/06/17 23:56:57 2526 [ssh.1 ssh.c] 2527 sync usage() and SYNPOSIS with connection sharing changes 2528 - dtucker@cvs.openbsd.org 2004/06/18 06:13:25 2529 [sftp.c] 2530 Use execvp instead of execv so sftp -S ssh works. "makes sense" markus@ 2531 - dtucker@cvs.openbsd.org 2004/06/18 06:15:51 2532 [multiplex.sh] 2533 Use -S for scp/sftp to force the use of the ssh being tested. 2534 ok djm@,markus@ 2535 - (djm) OpenBSD CVS Sync 2536 - djm@cvs.openbsd.org 2004/06/18 10:40:19 2537 [ssh.c] 2538 delay signal handler setup until we have finished talking to the master. 2539 allow interrupting of setup (e.g. if master is stuck); ok markus@ 2540 - markus@cvs.openbsd.org 2004/06/18 10:55:43 2541 [ssh.1 ssh.c] 2542 trim synopsis for -S, allow -S and -oControlMaster, -MM means 'ask'; 2543 ok djm 2544 - djm@cvs.openbsd.org 2004/06/18 11:11:54 2545 [channels.c clientloop.c] 2546 Don't explode in clientloop when we receive a bogus channel id, but 2547 also don't generate them to begin with; ok markus@ 2548 254920040617 2550 - (dtucker) [regress/scp.sh] diff -N is not portable (but needed for some 2551 platforms), so test if diff understands it. Pointed out by tim@, ok djm@ 2552 - (dtucker) OpenBSD CVS Sync regress/ 2553 - dtucker@cvs.openbsd.org 2004/06/17 05:51:59 2554 [regress/multiplex.sh] 2555 Remove datafile between and after tests, kill sshd rather than wait; 2556 ok djm@ 2557 - dtucker@cvs.openbsd.org 2004/06/17 06:00:05 2558 [regress/multiplex.sh] 2559 Use DATA and COPY for test data rather than hard-coded paths; ok djm@ 2560 - dtucker@cvs.openbsd.org 2004/06/17 06:19:06 2561 [regress/multiplex.sh] 2562 Add small description of failing test to failure message; ok djm@ 2563 - (dtucker) [regress/multiplex.sh] add EXEEXT for those platforms that need 2564 it. 2565 - (dtucker) [regress/multiplex.sh] Increase sleep time to 120 sec (60 is not 2566 enough for slow systems, especially if they don't have a kernel RNG). 2567 256820040616 2569 - (dtucker) [openbsd-compat/port-aix.c] Expand whitespace -> tabs. No 2570 code changes. 2571 - (dtucker) OpenBSD CVS Sync regress/ 2572 - djm@cvs.openbsd.org 2004/04/27 09:47:30 2573 [regress/Makefile regress/test-exec.sh, added regress/envpass.sh] 2574 regress test for environment passing, SendEnv & AcceptEnv options; 2575 ok markus@ 2576 - dtucker@cvs.openbsd.org 2004/06/13 13:51:02 2577 [regress/Makefile regress/test-exec.sh, added regress/scp-ssh-wrapper.sh 2578 regress/scp.sh] 2579 Add scp regression test; with & ok markus@ 2580 - djm@cvs.openbsd.org 2004/06/13 15:04:08 2581 [regress/Makefile regress/test-exec.sh, added regress/envpass.sh] 2582 regress test for client multiplexing; ok markus@ 2583 - djm@cvs.openbsd.org 2004/06/13 15:16:54 2584 [regress/test-exec.sh] 2585 remove duplicate setting of $SCP; spotted by markus@ 2586 - dtucker@cvs.openbsd.org 2004/06/16 13:15:09 2587 [regress/scp.sh] 2588 Make scp -r tests use diff -rN not cmp (which won't do dirs. ok markus@ 2589 - dtucker@cvs.openbsd.org 2004/06/16 13:16:40 2590 [regress/multiplex.sh] 2591 Silence multiplex sftp and scp tests. ok markus@ 2592 - (dtucker) [regress/test-exec.sh] 2593 Move Portable-only StrictModes to top of list to make syncs easier. 2594 - (dtucker) [regress/README.regress] 2595 Add $TEST_SHELL to readme. 2596 259720040615 2598 - (djm) OpenBSD CVS Sync 2599 - djm@cvs.openbsd.org 2004/05/26 08:59:57 2600 [sftp.c] 2601 exit -> _exit in forked child on error; from andrushock AT korovino.net 2602 - markus@cvs.openbsd.org 2004/05/26 23:02:39 2603 [channels.c] 2604 missing freeaddrinfo; Andrey Matveev 2605 - dtucker@cvs.openbsd.org 2004/05/27 00:50:13 2606 [readconf.c] 2607 Kill dead code after fatal(); ok djm@ 2608 - dtucker@cvs.openbsd.org 2004/06/01 14:20:45 2609 [auth2-chall.c] 2610 Remove redundant #include; ok markus@ 2611 - pedro@cvs.openbsd.org 2004/06/03 12:22:20 2612 [sftp-client.c sftp.c] 2613 initialize pointers, ok markus@ 2614 - djm@cvs.openbsd.org 2004/06/13 12:53:24 2615 [dh.c dh.h kex.c kex.h kexdhc.c kexdhs.c monitor.c myproposal.h] 2616 [ssh-keyscan.c sshconnect2.c sshd.c] 2617 implement diffie-hellman-group14-sha1 kex method (trivial extension to 2618 existing diffie-hellman-group1-sha1); ok markus@ 2619 - dtucker@cvs.openbsd.org 2004/06/13 14:01:42 2620 [ssh.1 ssh_config.5 sshd_config.5] 2621 List supported ciphers in man pages, tidy up ssh -c; 2622 "looks fine" jmc@, ok markus@ 2623 - djm@cvs.openbsd.org 2004/06/13 15:03:02 2624 [channels.c channels.h clientloop.c clientloop.h includes.h readconf.c] 2625 [readconf.h scp.1 sftp.1 ssh.1 ssh.c ssh_config.5] 2626 implement session multiplexing in the client (the server has supported 2627 this since 2.0); ok markus@ 2628 - djm@cvs.openbsd.org 2004/06/14 01:44:39 2629 [channels.c clientloop.c misc.c misc.h packet.c ssh-agent.c ssh-keyscan.c] 2630 [sshd.c] 2631 set_nonblock() instead of fnctl(...,O_NONBLOCK); "looks sane" deraadt@ 2632 - djm@cvs.openbsd.org 2004/06/15 05:45:04 2633 [clientloop.c] 2634 missed one unset_nonblock; spotted by Tim Rice 2635 - (djm) Fix Makefile.in for connection sharing changes 2636 - (djm) [ssh.c] Use separate var for address length 2637 263820040603 2639 - (dtucker) [auth-pam.c] Don't use pam_* namespace for sshd's PAM functions. 2640 ok djm@ 2641 264220040601 2643 - (djm) [auth-pam.c] Add copyright for local changes 2644 264520040530 2646 - (dtucker) [auth-pam.c auth-pam.h auth-passwd.c] Bug #874: Re-add PAM 2647 support for PasswordAuthentication=yes. ok djm@ 2648 - (dtucker) [auth-pam.c] Use an invalid password for root if 2649 PermitRootLogin != yes or the login is invalid, to prevent leaking 2650 information. Based on Openwall's owl-always-auth patch. ok djm@ 2651 - (tim) [configure.ac Makefile.in] Add support for "make package" ok djm@ 2652 - (tim) [buildpkg.sh.in] New file. A more flexible version of 2653 contrib/solaris/buildpkg.sh used for "make package". 2654 - (tim) [buildpkg.sh.in] Last minute fix didn't make it in the .in file. 2655 265620040527 2657 - (dtucker) [contrib/caldera/openssh.spec contrib/redhat/openssh.spec 2658 contrib/README CREDITS INSTALL] Bug #873: Correct URLs for x11-ssh-askpass 2659 and Jim Knoble's email address , from Jim himself. 2660 266120040524 2662 - (dtucker) OpenBSD CVS Sync 2663 - djm@cvs.openbsd.org 2004/05/19 12:17:33 2664 [sftp-client.c sftp.c] 2665 gracefully abort transfers on receipt of SIGINT, also ignore SIGINT while 2666 waiting for a command; ok markus@ 2667 - dtucker@cvs.openbsd.org 2004/05/20 10:58:05 2668 [clientloop.c] 2669 Trivial type fix 0 -> '\0'; ok markus@ 2670 - markus@cvs.openbsd.org 2004/05/21 08:43:03 2671 [kex.h moduli.c tildexpand.c] 2672 add prototypes for -Wall; ok djm 2673 - djm@cvs.openbsd.org 2004/05/21 11:33:11 2674 [channels.c channels.h clientloop.c serverloop.c ssh.1] 2675 bz #756: add support for the cancel-tcpip-forward request for the server 2676 and the client (through the ~C commandline). reported by z3p AT 2677 twistedmatrix.com; ok markus@ 2678 - djm@cvs.openbsd.org 2004/05/22 06:32:12 2679 [clientloop.c ssh.1] 2680 use '-h' for help in ~C commandline instead of '-?'; inspired by jmc@ 2681 - jmc@cvs.openbsd.org 2004/05/22 16:01:05 2682 [ssh.1] 2683 kill whitespace at eol; 2684 - dtucker@cvs.openbsd.org 2004/05/23 23:59:53 2685 [auth.c auth.h auth1.c auth2.c servconf.c servconf.h sshd_config 2686 sshd_config.5] 2687 Add MaxAuthTries sshd config option; ok markus@ 2688 - (dtucker) [auth-pam.c] Bug #839: Ensure that pam authentication "thread" 2689 is terminated if the privsep slave exits during keyboard-interactive 2690 authentication. ok djm@ 2691 - (dtucker) [sshd.c] Fix typo in comment. 2692 269320040523 2694 - (djm) [sshd_config] Explain consequences of UsePAM=yes a little better in 2695 sshd_config; ok dtucker@ 2696 - (djm) [configure.ac] Warn if the system has no known way of figuring out 2697 which user is on the other end of a Unix domain socket; ok dtucker@ 2698 - (bal) [openbsd-compat/sys-queue.h] Reintroduce machinary to handle 2699 old/broken/incomplete <sys/queue.h>. 2700 270120040513 2702 - (dtucker) [configure.ac] Bug #867: Additional tests for res_query in 2703 libresolv, fixes problems detecting it on some platforms 2704 (eg Linux/x86-64). From Kurt Roeckx via Debian, ok mouring@ 2705 - (dtucker) OpenBSD CVS Sync 2706 - jmc@cvs.openbsd.org 2004/05/04 18:36:07 2707 [scp.1] 2708 SendEnv here too; 2709 - jmc@cvs.openbsd.org 2004/05/06 11:24:23 2710 [ssh_config.5] 2711 typo from John Cosimano (PR 3770); 2712 - deraadt@cvs.openbsd.org 2004/05/08 00:01:37 2713 [auth.c clientloop.c misc.h servconf.c ssh.c sshpty.h sshtty.c 2714 tildexpand.c], removed: sshtty.h tildexpand.h 2715 make two tiny header files go away; djm ok 2716 - djm@cvs.openbsd.org 2004/05/08 00:21:31 2717 [clientloop.c misc.h readpass.c scard.c ssh-add.c ssh-agent.c ssh-keygen.c 2718 sshconnect.c sshconnect1.c sshconnect2.c] removed: readpass.h 2719 kill a tiny header; ok deraadt@ 2720 - djm@cvs.openbsd.org 2004/05/09 00:06:47 2721 [moduli.c ssh-keygen.c] removed: moduli.h 2722 zap another tiny header; ok deraadt@ 2723 - djm@cvs.openbsd.org 2004/05/09 01:19:28 2724 [OVERVIEW auth-rsa.c auth1.c kex.c monitor.c session.c sshconnect1.c 2725 sshd.c] removed: mpaux.c mpaux.h 2726 kill some more tiny files; ok deraadt@ 2727 - djm@cvs.openbsd.org 2004/05/09 01:26:48 2728 [kex.c] 2729 don't overwrite what we are trying to compute 2730 - deraadt@cvs.openbsd.org 2004/05/11 19:01:43 2731 [auth.c auth2-none.c authfile.c channels.c monitor.c monitor_mm.c 2732 packet.c packet.h progressmeter.c session.c openbsd-compat/xmmap.c] 2733 improve some code lint did not like; djm millert ok 2734 - dtucker@cvs.openbsd.org 2004/05/13 02:47:50 2735 [ssh-agent.1] 2736 Add examples to ssh-agent.1, bz#481 from Ralf Hauser; ok deraadt@ 2737 - (dtucker) [sshd.8] Bug #843: Add warning about PasswordAuthentication to 2738 UsePAM section. Parts from djm@ and jmc@. 2739 - (dtucker) [auth-pam.c scard-opensc.c] Tinderbox says auth-pam.c uses 2740 readpass.h, grep says scard-opensc.c does too. Replace with misc.h. 2741 - (dtucker) [openbsd-compat/getrrsetbyname.c] Check that HAVE_DECL_H_ERROR 2742 is defined before using. 2743 - (dtucker) [openbsd-compat/getrrsetbyname.c] Fix typo too: HAVE_DECL_H_ERROR 2744 -> HAVE_DECL_H_ERRNO. 2745 274620040502 2747 - (dtucker) OpenBSD CVS Sync 2748 - djm@cvs.openbsd.org 2004/04/22 11:56:57 2749 [moduli.c] 2750 Bugzilla #850: Sophie Germain is the correct name of the French 2751 mathematician, "Sophie Germaine" isn't; from Luc.Maisonobe@c-s.fr 2752 - djm@cvs.openbsd.org 2004/04/27 09:46:37 2753 [readconf.c readconf.h servconf.c servconf.h session.c session.h ssh.c 2754 ssh_config.5 sshd_config.5] 2755 bz #815: implement ability to pass specified environment variables from 2756 the client to the server; ok markus@ 2757 - djm@cvs.openbsd.org 2004/04/28 05:17:10 2758 [ssh_config.5 sshd_config.5] 2759 manpage fixes in envpass stuff from Brian Poole (raj AT cerias.purdue.edu) 2760 - jmc@cvs.openbsd.org 2004/04/28 07:02:56 2761 [sshd_config.5] 2762 remove unnecessary .Pp; 2763 - jmc@cvs.openbsd.org 2004/04/28 07:13:42 2764 [sftp.1 ssh.1] 2765 add SendEnv to -o list; 2766 - dtucker@cvs.openbsd.org 2004/05/02 11:54:31 2767 [sshd.8] 2768 Man page grammar fix (bz #858), from damerell at chiark.greenend.org.uk 2769 via Debian; ok djm@ 2770 - dtucker@cvs.openbsd.org 2004/05/02 11:57:52 2771 [ssh.1] 2772 ConnectionTimeout -> ConnectTimeout, from m.a.ellis at ncl.ac.uk via 2773 Debian. ok djm@ 2774 - dtucker@cvs.openbsd.org 2004/05/02 23:02:17 2775 [sftp.1] 2776 ConnectionTimeout -> ConnectTimeout here too, pointed out by jmc@ 2777 - dtucker@cvs.openbsd.org 2004/05/02 23:17:51 2778 [scp.1] 2779 ConnectionTimeout -> ConnectTimeout for scp.1 too. 2780 278120040423 2782 - (dtucker) [configure.ac openbsd-compat/getrrsetbyname.c] Declare h_errno 2783 as extern int if not already declared. Fixes compile errors on old SCO 2784 platforms. ok tim@ 2785 - (dtucker) [README.platform] List prereqs for building on Cygwin. 2786 278720040421 2788 - (djm) Update config.guess and config.sub to autoconf-2.59 versions; ok tim@ 2789 279020040420 2791 - (djm) OpenBSD CVS Sync 2792 - henning@cvs.openbsd.org 2004/04/08 16:08:21 2793 [sshconnect2.c] 2794 swap the last two parameters to TAILQ_FOREACH_REVERSE. matches what 2795 FreeBSD and NetBSD do. 2796 ok millert@ mcbride@ markus@ ho@, checked to not affect ports by naddy@ 2797 - djm@cvs.openbsd.org 2004/04/18 23:10:26 2798 [readconf.c readconf.h ssh-keysign.c ssh.c] 2799 perform strict ownership and modes checks for ~/.ssh/config files, 2800 as these can be used to execute arbitrary programs; ok markus@ 2801 NB. ssh will now exit when it detects a config with poor permissions 2802 - djm@cvs.openbsd.org 2004/04/19 13:02:40 2803 [ssh.1 ssh_config.5] 2804 document strict permission checks on ~/.ssh/config; prompted by, 2805 with & ok jmc@ 2806 - jmc@cvs.openbsd.org 2004/04/19 16:12:14 2807 [ssh_config.5] 2808 kill whitespace at eol; 2809 - djm@cvs.openbsd.org 2004/04/19 21:51:49 2810 [ssh.c] 2811 fix idiot typo that i introduced in my last commit; 2812 spotted by cschneid AT cschneid.com 2813 - (djm) [openbsd-compat/sys-queue.h] Sync with OpenBSD, needed for 2814 above change 2815 - (djm) [configure.ac] Check whether libroken is required when building 2816 with Heimdal 2817 281820040419 2819 - (dtucker) OpenBSD CVS Sync 2820 - dtucker@cvs.openbsd.org 2004/02/29 22:04:45 2821 [regress/login-timeout.sh] 2822 Use sudo when restarting daemon during test. ok markus@ 2823 - dtucker@cvs.openbsd.org 2004/03/08 10:17:12 2824 [regress/login-timeout.sh] 2825 Missing OBJ, from tim@. ok markus@ (Already fixed, ID sync only) 2826 - djm@cvs.openbsd.org 2004/03/30 12:41:56 2827 [sftp-client.c] 2828 sync comment with reality 2829 - djm@cvs.openbsd.org 2004/03/31 21:58:47 2830 [canohost.c] 2831 don't skip ip options check when UseDNS=no; ok markus@ (ID sync only) 2832 - markus@cvs.openbsd.org 2004/04/01 12:19:57 2833 [scp.c] 2834 limit trust between local and remote rcp/scp process, 2835 noticed by lcamtuf; ok deraadt@, djm@ 2836 283720040418 2838 - (dtucker) [auth-pam.c] Log username and source host for failed PAM 2839 authentication attempts. With & ok djm@ 2840 - (djm) [openbsd-compat/bsd-cygwin_util.c] Recent versions of Cygwin allow 2841 change of user context without a password, so relax auth method 2842 restrictions; from vinschen AT redhat.com; ok dtucker@ 2843 284420040416 2845 - (dtucker) [regress/sftp-cmds.sh] Skip quoting test on Cygwin, since 2846 FAT/NTFS does not permit quotes in filenames. From vinschen at redhat.com 2847 - (djm) [auth-krb5.c auth.h session.c] Explicitly refer to Kerberos ccache 2848 file using FILE: method, fixes problems on Mac OSX. 2849 Patch from simon@sxw.org.uk; ok dtucker@ 2850 - (tim) [configure.ac] Set SETEUID_BREAKS_SETUID, BROKEN_SETREUID and 2851 BROKEN_SETREGID for SCO OpenServer 3 2852 285320040412 2854 - (dtucker) [sshd_config.5] Add PermitRootLogin without-password warning 2855 from bug #701 (text from jfh at cise.ufl.edu). 2856 - (dtucker) [acconfig.h configure.ac defines.h] Bug #673: check for 4-arg 2857 skeychallenge(), eg on NetBSD. ok mouring@ 2858 - (dtucker) [auth-skey.c defines.h monitor.c] Make skeychallenge explicitly 2859 4-arg, with compatibility for 3-arg versions. From djm@, ok me. 2860 - (djm) [configure.ac] Fix detection of libwrap on OpenBSD; ok dtucker@ 2861 286220040408 2863 - (dtucker) [loginrec.c] Use UT_LINESIZE if available, prevents truncating 2864 pty name on Linux 2.6.x systems. Patch from jpe at eisenmenger.org. 2865 - (bal) [monitor.c monitor_wrap.c] Second try. Put the zlib.h headers 2866 back and #undef TARGET_OS_MAC instead. (Bug report pending with Apple) 2867 - (dtucker) [defines.h loginrec.c] Define UT_LINESIZE if not defined and 2868 simplify loginrec.c. ok tim@ 2869 - (bal) [monitor.c monitor_wrap.c] Ok.. Last time. Promise. Tim suggested 2870 limiting scope and dtucker@ agreed. 2871 287220040407 2873 - (dtucker) [session.c] Flush stdout after displaying loginmsg. From 2874 f_mohr at yahoo.de. 2875 - (bal) [acconfig.h auth-krb5.c configure.ac gss-serv-krb5.c] Check to see 2876 if Krb5 library exports krb5_init_etc() since some OSes (like MacOS/X) 2877 are starting to restrict it as internal since it is not needed by 2878 developers any more. (Patch based on Apple tree) 2879 - (bal) [monitor.c monitor_wrap.c] monitor_wrap.c] moved zlib.h higher since 2880 krb5 on MacOS/X conflicts. There may be a better solution, but this will 2881 work for now. 2882 288320040406 2884 - (dtucker) [acconfig.h configure.ac defines.h] Bug #820: don't use 2885 updwtmpx() on IRIX since it seems to clobber utmp. ok djm@ 2886 - (dtucker) [configure.ac] Bug #816, #748 (again): Attempt to detect 2887 broken getaddrinfo and friends on HP-UX. ok djm@ 2888 288920040330 2890 - (dtucker) [configure.ac] Bug #811: Use "!" for LOCKED_PASSWD_PREFIX on 2891 Linuxes, since that's what many use. ok djm@ 2892 - (dtucker) [auth-pam.c] rename the_authctxt to sshpam_authctxt in auth-pam.c 2893 to reduce potential confusion with the one in sshd.c. ok djm@ 2894 - (djm) Bug #825: Fix ip_options_check() for mapped IPv4/IPv6 connection; 2895 with & ok dtucker@ 2896 289720040327 2898 - (dtucker) [session.c] Bug #817: Clear loginmsg after fork to prevent 2899 duplicate login messages for mutli-session logins. ok djm@ 2900 290120040322 2902 - (djm) [sshd.c] Drop supplemental groups if started as root 2903 - (djm) OpenBSD CVS Sync 2904 - markus@cvs.openbsd.org 2004/03/09 22:11:05 2905 [ssh.c] 2906 increase x11 cookie lifetime to 20 minutes; ok djm 2907 - markus@cvs.openbsd.org 2004/03/10 09:45:06 2908 [ssh.c] 2909 trim usage to match ssh(1) and look more like unix. ok djm@ 2910 - markus@cvs.openbsd.org 2004/03/11 08:36:26 2911 [sshd.c] 2912 trim usage; ok deraadt 2913 - markus@cvs.openbsd.org 2004/03/11 10:21:17 2914 [ssh.c sshd.c] 2915 ssh, sshd: sync version output, ok djm 2916 - markus@cvs.openbsd.org 2004/03/20 10:40:59 2917 [version.h] 2918 3.8.1 2919 - (djm) Crank RPM spec versions 2920 292120040311 2922 - (djm) [configure.ac] Add standard license to configure.ac; ok ben, dtucker 2923 292420040310 2925 - (dtucker) [openbsd-compat/fake-rfc2553.h] Bug #812: #undef getaddrinfo 2926 before redefining it, silences warnings on Tru64. 2927 292820040308 2929 - (dtucker) [sshd.c] Back out rev 1.270 as it caused problems on some 2930 platforms (eg SCO, HP-UX) with logging in the wrong TZ. ok djm@ 2931 - (dtucker) [configure.ac sshd.c openbsd-compat/bsd-misc.h 2932 openbsd-compat/setenv.c] Unset KRB5CCNAME on AIX to prevent it from being 2933 inherited by the child. ok djm@ 2934 - (dtucker) [auth-pam.c auth-pam.h auth1.c auth2.c monitor.c monitor_wrap.c 2935 monitor_wrap.h] Bug #808: Ensure force_pwchange is correctly initialized 2936 even if keyboard-interactive is not used by the client. Prevents 2937 segfaults in some cases where the user's password is expired (note this 2938 is not considered a security exposure). ok djm@ 2939 - (djm) OpenBSD CVS Sync 2940 - markus@cvs.openbsd.org 2004/03/03 06:47:52 2941 [sshd.c] 2942 change proctiltle after accept(2); ok henning, deraadt, djm 2943 - djm@cvs.openbsd.org 2004/03/03 09:30:42 2944 [sftp-client.c] 2945 Don't print duplicate messages when progressmeter is off 2946 Spotted by job317 AT mailvault.com; ok markus@ 2947 - djm@cvs.openbsd.org 2004/03/03 09:31:20 2948 [sftp.c] 2949 Fix initialisation of progress meter; ok markus@ 2950 - markus@cvs.openbsd.org 2004/03/05 10:53:58 2951 [readconf.c readconf.h scp.1 sftp.1 ssh.1 ssh_config.5 sshconnect2.c] 2952 add IdentitiesOnly; ok djm@, pb@ 2953 - djm@cvs.openbsd.org 2004/03/08 09:38:05 2954 [ssh-keyscan.c] 2955 explicitly initialise remote_major and remote_minor. 2956 from cjwatson AT debian.org; ok markus@ 2957 - dtucker@cvs.openbsd.org 2004/03/08 10:18:57 2958 [sshd_config.5] 2959 Document KerberosGetAFSToken; ok markus@ 2960 - (tim) [regress/README.regress] Document ssh-rand-helper issue. ok bal 2961 296220040307 2963 - (tim) [regress/login-timeout.sh] fix building outside of source tree. 2964 296520040304 2966 - (dtucker) [auth-pam.c] Don't try to export PAM when compiled with 2967 -DUSE_POSIX_THREADS. From antoine.verheijen at ualbert ca. ok djm@ 2968 - (dtucker) [auth-pam.c] Reset signal status when starting pam auth thread, 2969 prevent hanging during PAM keyboard-interactive authentications. ok djm@ 2970 - (dtucker) [auth-passwd.c auth-sia.c auth-sia.h defines.h 2971 openbsd-compat/xcrypt.c] Bug #802: Fix build error on Tru64 when 2972 configured --with-osfsia. ok djm@ 2973 297420040303 2975 - (djm) [configure.ac ssh-agent.c] Use prctl to prevent ptrace on ssh-agent 2976 ok dtucker 2977 297820040229 2979 - (tim) [configure.ac] Put back bits mistakenly removed from Rev 1.188 2980 298120040229 2982 - (dtucker) OpenBSD CVS Sync 2983 - djm@cvs.openbsd.org 2004/02/25 00:22:45 2984 [sshd.c] 2985 typo in comment 2986 - dtucker@cvs.openbsd.org 2004/02/27 22:42:47 2987 [dh.c] 2988 Prevent sshd from sending DH groups with a primitive generator of zero or 2989 one, even if they are listed in /etc/moduli. ok markus@ 2990 - dtucker@cvs.openbsd.org 2004/02/27 22:44:56 2991 [dh.c] 2992 Make /etc/moduli line buffer big enough for 8kbit primes, in case anyone 2993 ever uses one. ok markus@ 2994 - dtucker@cvs.openbsd.org 2004/02/27 22:49:27 2995 [dh.c] 2996 Reset bit counter at the right time, fixes debug output in the case where 2997 the DH group is rejected. ok markus@ 2998 - dtucker@cvs.openbsd.org 2004/02/17 08:23:20 2999 [regress/Makefile regress/login-timeout.sh] 3000 Add regression test for LoginGraceTime; ok markus@ 3001 - markus@cvs.openbsd.org 2004/02/24 16:56:30 3002 [regress/test-exec.sh] 3003 allow arguments in ${TEST_SSH_XXX} 3004 - markus@cvs.openbsd.org 2004/02/24 17:06:52 3005 [regress/ssh-com-client.sh regress/ssh-com-keygen.sh 3006 regress/ssh-com-sftp.sh regress/ssh-com.sh] 3007 test against recent ssh.com releases 3008 - dtucker@cvs.openbsd.org 2004/02/28 12:16:57 3009 [regress/dynamic-forward.sh] 3010 Make dynamic-forward understand nc's new output. ok markus@ 3011 - dtucker@cvs.openbsd.org 2004/02/28 13:44:45 3012 [regress/try-ciphers.sh] 3013 Test acss too; ok markus@ 3014 - (dtucker) [regress/try-ciphers.sh] Skip acss if not compiled in (eg if we 3015 built with openssl < 0.9.7) 3016 301720040226 3018 - (bal) KNF our sshlogin.c even if the code looks nothing like upstream 3019 code due to diversity issues. 3020 302120040225 3022 - (djm) Trim ChangeLog 3023 - (djm) Don't specify path to PAM modules in Redhat sshd.pam; from Fedora 3024 302520040224 3026 - (dtucker) OpenBSD CVS Sync 3027 - markus@cvs.openbsd.org 2004/02/19 21:15:04 3028 [sftp-server.c] 3029 switch to new license.template 3030 - markus@cvs.openbsd.org 2004/02/23 12:02:33 3031 [sshd.c] 3032 backout revision 1.279; set listen socket to non-block; ok henning. 3033 - markus@cvs.openbsd.org 2004/02/23 15:12:46 3034 [bufaux.c] 3035 encode 0 correctly in buffer_put_bignum2; noted by Mikulas Patocka 3036 and drop support for negative BNs; ok otto@ 3037 - markus@cvs.openbsd.org 2004/02/23 15:16:46 3038 [version.h] 3039 enter 3.8 3040 - (dtucker) [configure.ac gss-serv-krb5.c ssh-gss.h] Define GSSAPI when found 3041 with krb5-config, hunt down gssapi.h and friends. Based partially on patch 3042 from deengert at anl.gov. ok djm@ 3043 - (djm) [groupaccess.c uidswap.c] Bug #787: Size group arrays at runtime 3044 using sysconf() if available Based on patches from 3045 holger AT van-lengerich.de and openssh_bugzilla AT hockin.org 3046 - (dtucker) [uidswap.c] Minor KNF. ok djm@ 3047 - (tim) [openbsd-compat/getrrsetbyname.c] Make gcc 2.7.2.3 happy. ok djm@ 3048 - (djm) Crank RPM spec versions 3049 - (dtucker) [README] Add pointer to release notes. ok djm@ 3050 - (dtucker) {README.platform] Add platform-specific notes. 3051 - (tim) [configure.ac] SCO3 needs -lcrypt_i for -lprot 3052 - (djm) Release 3.8p1 3053 305420040223 3055 - (dtucker) [session.c] Bug #789: Only make setcred call for !privsep in the 3056 non-interactive path. ok djm@ 3057 305820040222 3059 - (dtucker) [auth-shadow.c auth.c auth.h] Move shadow account expiry test 3060 to auth-shadow.c, no functional change. ok djm@ 3061 - (dtucker) [auth-shadow.c auth.h] Provide warnings of impending account or 3062 password expiry. ok djm@ 3063 - (dtucker) [auth-passwd.c] Only check password expiry once. Prevents 3064 multiple warnings if a wrong password is entered. 3065 - (dtucker) [configure.ac] Apply krb5-config --libs fix to non-gssapi path 3066 too. 3067 306820040220 3069 - (djm) [openbsd-compat/setproctitle.c] fix comments; from grange@ 3070 307120040218 3072 - (dtucker) [configure.ac] Handle case where krb5-config --libs returns a 3073 path with a "-" in it. From Sergio.Gelato at astro.su.se. 3074 - (djm) OpenBSD CVS Sync 3075 - djm@cvs.openbsd.org 2004/02/17 07:17:29 3076 [sftp-glob.c sftp.c] 3077 Remove useless headers; ok deraadt@ 3078 - djm@cvs.openbsd.org 2004/02/17 11:03:08 3079 [sftp.c] 3080 sftp.c and sftp-int.c, together at last; ok markus@ 3081 - jmc@cvs.openbsd.org 2004/02/17 19:35:21 3082 [sshd_config.5] 3083 remove cruft left over from RhostsAuthentication removal; 3084 ok markus@ 3085 - (djm) [log.c] Correct use of HAVE_OPENLOG_R 3086 - (djm) [log.c] Tighten openlog_r tests 3087 308820040217 3089 - (djm) Simplify the license on code I have written. No code changes. 3090 - (djm) OpenBSD CVS Sync 3091 - djm@cvs.openbsd.org 2004/02/17 05:39:51 3092 [sftp-client.c sftp-client.h sftp-glob.c sftp-glob.h sftp-int.c] 3093 [sftp-int.h sftp.c] 3094 switch to license.template for code written by me (belated, I know...) 3095 - (djm) Bug #698: Specify FILE: for KRB5CCNAME; patch from 3096 stadal@suse.cz and simon@sxw.org.uk 3097 - (dtucker) [auth-pam.c] Tidy up PAM debugging. ok djm@ 3098 - (dtucker) [auth-pam.c] Store output from pam_session and pam_setcred for 3099 display after login. Should fix problems like pam_motd not displaying 3100 anything, noticed by cjwatson at debian.org. ok djm@ 3101 310220040212 3103 - (tim) [Makefile.in regress/sftp-badcmds.sh regress/test-exec.sh] 3104 Portablity fixes. Data sftp transfers needs to be world readable. Some 3105 older shells hang on while loops when doing sh -n some_script. OK dtucker@ 3106 - (tim) [configure.ac] Make sure -lcrypto is before -lsocket for sco3. 3107 ok mouring@ 3108 310920040211 3110 - (dtucker) [auth-passwd.c auth-shadow.c] Only enable shadow expiry check 3111 if HAS_SHADOW_EXPIRY is set. 3112 - (tim) [configure.ac] Fix comment to match code changes in ver 1.117 3113 311420040210 3115 - (dtucker) [auth-passwd.c auth.h openbsd-compat/port-aix.c 3116 openbsd-compat/port-aix.h] Bug #14: Use do_pwchange to support AIX's 3117 native password expiry. 3118 - (dtucker) [LICENCE Makefile.in auth-passwd.c auth-shadow.c auth.c auth.h 3119 defines.h] Bug #14: Use do_pwchange to support password expiry and force 3120 change for platforms using /etc/shadow. ok djm@ 3121 - (dtucker) [openbsd-compat/fake-rfc2553.h] Bug #563: Prepend ssh_ to compat 3122 functions to avoid conflicts with Heimdal's libroken. ok djm@ 3123 - (dtucker) [auth-pam.c auth-pam.h session.c] Bug #14: Use do_pwchange to 3124 change expired PAM passwords for SSHv1 connections without privsep. 3125 pam_chauthtok is still used when privsep is disabled. ok djm@ 3126 - (dtucker) [openbsd-compat/port-aix.c openbsd-compat/port-aix.h] Move 3127 include from port-aix.h to port-aix.c and remove unnecessary function 3128 definition. Fixes build errors on AIX. 3129 - (dtucker) [configure.ac loginrec.c] Bug #464: Use updwtmpx on platforms 3130 that support it. from & ok mouring@ 3131 - (dtucker) [configure.ac] Bug #345: Do not disable utmp on HP-UX 10.x. 3132 ok djm@ 3133 313420040207 3135 - (dtucker) OpenBSD CVS Sync 3136 - dtucker@cvs.openbsd.org 2004/02/06 23:41:13 3137 [cipher-ctr.c] 3138 Use EVP_CIPHER_CTX_key_length for key length. ok markus@ 3139 (This will fix builds with OpenSSL 0.9.5) 3140 - (dtucker) [cipher.c] enable AES counter modes with OpenSSL 0.9.5. 3141 ok djm@, markus@ 3142 314320040206 3144 - (dtucker) [acss.c acss.h] Fix $Id tags. 3145 - (dtucker) [cipher-acss.c cipher.c] Enable acss only if building with 3146 OpenSSL >= 0.9.7. ok djm@ 3147 - (dtucker) [session.c] Bug #789: Do not call do_pam_setcred as a non-root 3148 user, since some modules might fail due to lack of privilege. ok djm@ 3149 - (dtucker) [configure.ac] Bug #748: Always define BROKEN_GETADDRINFO 3150 for HP-UX 11.11. If there are known-good configs where this is not 3151 required, please report them. ok djm@ 3152 - (dtucker) [sshd.c] Bug #757: Clear child's environment to prevent 3153 accidentally inheriting from root's environment. ok djm@ 3154 - (dtucker) [openbsd-compat/port-aix.c openbsd-compat/port-aix.h] Bug #796: 3155 Restore previous authdb setting after auth calls. Fixes problems with 3156 setpcred failing on accounts that use AFS or NIS password registries. 3157 - (dtucker) [configure.ac includes.h] Include <sys/stream.h> if present, 3158 required on Solaris 2.5.1 for queue_t, which is used by <sys/ptms.h>. 3159 - (dtucker) OpenBSD CVS Sync 3160 - markus@cvs.openbsd.org 2004/01/30 09:48:57 3161 [auth-passwd.c auth.h pathnames.h session.c] 3162 support for password change; ok dtucker@ 3163 (set password-dead=1w in login.conf to use this). 3164 In -Portable, this is currently only platforms using bsdauth. 3165 - dtucker@cvs.openbsd.org 2004/02/05 05:37:17 3166 [monitor.c sshd.c] 3167 Pass SIGALRM through to privsep child if LoginGraceTime expires. ok markus@ 3168 - markus@cvs.openbsd.org 2004/02/05 15:33:33 3169 [progressmeter.c] 3170 fix ETA for > 4GB; bugzilla #791; ok henning@ deraadt@ 3171 317220040129 3173 - (dtucker) OpenBSD CVS Sync regress/ 3174 - dtucker@cvs.openbsd.org 2003/10/11 11:49:49 3175 [Makefile banner.sh] 3176 Test missing banner file, suppression of banner with ssh -q, check return 3177 code from ssh. ok markus@ 3178 - jmc@cvs.openbsd.org 2003/11/07 10:16:44 3179 [ssh-com.sh] 3180 adress -> address, and a few more; all from Jonathon Gray; 3181 - djm@cvs.openbsd.org 2004/01/13 09:49:06 3182 [sftp-batch.sh] 3183 - (dtucker) [configure.ac] Add --without-zlib-version-check. Feedback from 3184 tim@, ok several 3185 - (dtucker) [configure.ac openbsd-compat/bsd-cray.c openbsd-compat/bsd-cray.h] 3186 Bug #775: Cray fixes from wendy at cray.com 3187 318820040128 3189 - (dtucker) [regress/README.regress] Add tcpwrappers issue, noted by tim@ 3190 - (dtucker) [moduli] Import new moduli file from OpenBSD. 3191 319220040127 3193 - (djm) OpenBSD CVS Sync 3194 - hshoexer@cvs.openbsd.org 2004/01/23 17:06:03 3195 [cipher.c] 3196 enable acss for ssh 3197 ok deraadt@ markus@ 3198 - mouring@cvs.openbsd.org 2004/01/23 17:57:48 3199 [sftp-int.c] 3200 Fix issue pointed out with ls not handling large directories 3201 with embeded paths correctly. OK damien@ 3202 - hshoexer@cvs.openbsd.org 2004/01/23 19:26:33 3203 [cipher.c] 3204 rename acss@opebsd.org to acss@openssh.org 3205 ok deraadt@ 3206 - djm@cvs.openbsd.org 2004/01/25 03:49:09 3207 [sshconnect.c] 3208 reset nonblocking flag after ConnectTimeout > 0 connect; (bugzilla #785) 3209 from jclonguet AT free.fr; ok millert@ 3210 - djm@cvs.openbsd.org 2004/01/27 10:08:10 3211 [sftp.c] 3212 reorder parsing so user:skey@host:file works (bugzilla #777) 3213 patch from admorten AT umich.edu; ok markus@ 3214 - (djm) [acss.c acss.h cipher-acss.c] Portable support for ACSS 3215 if libcrypto lacks it 3216 321720040126 3218 - (tim) Typo in regress/README.regress 3219 - (tim) [regress/test-exec.sh] RhostsAuthentication is deprecated. 3220 - (tim) [defines.h] Add defines for HFIXEDSZ and T_SIG 3221 - (tim) [configure.ac includes.h] add <sys/ptms.h> for grantpt() and friends. 3222 - (tim) [defines.h openbsd-compat/getrrsetbyname.h] Move defines for HFIXEDSZ 3223 and T_SIG to getrrsetbyname.h 3224 322520040124 3226 - (djm) Typo in openbsd-compat/bsd-openpty.c; from wendyp AT cray.com 3227 322820040123 3229 - (djm) Do pam_session processing for systems with HAVE_LOGIN_CAP; from 3230 ralf.hack AT pipex.net; ok dtucker@ 3231 - (djm) Bug #776: Update contrib/redhat/openssh.spec to dynamically detect 3232 Kerberos location (and thus work with Fedora Core 1); 3233 from jason AT devrandom.org 3234 - (dtucker) [configure.ac] Bug #788: Test for zlib.h presence and for 3235 zlib >= 1.1.4. Partly from jbasney at ncsa.uiuc.edu. ok djm@ 3236 - (dtucker) [contrib/cygwin/README] Document new ssh-host-config options. 3237 Patch from vinschen at redhat.com. 3238 - (dtucker) [acconfig.h configure.ac includes.h servconf.c session.c] 3239 Change AFS symbol to USE_AFS to prevent namespace collisions, do not 3240 include kafs.h unless necessary. From deengert at anl.gov. 3241 - (tim) [configure.ac] Remove hard coded -L/usr/local/lib and 3242 -I/usr/local/include. Users can do LDFLAGS="-L/usr/local/lib" \ 3243 CPPFLAGS="-I/usr/local/include" ./configure if needed. 3244 324520040122 3246 - (dtucker) [configure.ac] Use krb5-config where available for Kerberos/ 3247 GSSAPI detection, libs and includes. ok djm@ 3248 - (dtucker) [session.c] Enable AFS support in conjunction with KRB5 not 3249 just HEIMDAL. 3250 - (tim) [contrib/solaris/buildpkg.sh] Allow for the possibility of 3251 /usr/local being a symbolic link. Fixes problem reported by Henry Grebler. 3252 325320040121 3254 - (djm) OpenBSD CVS Sync 3255 - djm@cvs.openbsd.org 2004/01/13 09:25:05 3256 [sftp-int.c sftp.1 sftp.c] 3257 Tidy sftp batchmode handling, eliminate junk to stderr (bugzilla #754) and 3258 enable use of "-b -" to accept batchfile from stdin; ok markus@ 3259 - jmc@cvs.openbsd.org 2004/01/13 12:17:33 3260 [sftp.1] 3261 remove unnecessary Ic's; 3262 kill whitespace at EOL; 3263 ok djm@ 3264 - markus@cvs.openbsd.org 2004/01/13 19:23:15 3265 [compress.c session.c] 3266 -Wall; ok henning 3267 - markus@cvs.openbsd.org 2004/01/13 19:45:15 3268 [compress.c] 3269 cast for portability; millert@ 3270 - markus@cvs.openbsd.org 2004/01/19 09:24:21 3271 [channels.c] 3272 fake consumption for half closed channels since the peer is waiting for 3273 window adjust messages; bugzilla #790 Matthew Dillon; test + ok dtucker@ 3274 reproduce with sh -c 'ulimit -f 10; ssh host -n od /bsd | cat > foo' 3275 - markus@cvs.openbsd.org 2004/01/19 21:25:15 3276 [auth2-hostbased.c auth2-pubkey.c serverloop.c ssh-keysign.c sshconnect2.c] 3277 fix mem leaks; some fixes from Pete Flugstad; tested dtucker@ 3278 - djm@cvs.openbsd.org 2004/01/21 03:07:59 3279 [sftp.c] 3280 initialise infile in main, rather than statically - from portable 3281 - deraadt@cvs.openbsd.org 2004/01/11 21:55:06 3282 [sshpty.c] 3283 for pty opening, only use the openpty() path. the other stuff only needs 3284 to be in openssh-p; markus ok 3285 - (djm) [openbsd-compat/bsd-openpty.c] Rework old sshpty.c code into an 3286 openpty() replacement 3287 328820040114 3289 - (dtucker) [auth-pam.c] Have monitor die if PAM authentication thread exits 3290 unexpectedly. with & ok djm@ 3291 - (dtucker) [auth-pam.c] Reset signal handler in pthread_cancel too, add 3292 test for case where cleanup has already run. 3293 - (dtucker) [auth-pam.c] Add minor debugging. 3294 329520040113 3296 - (dtucker) [auth-pam.c] Relocate struct pam_ctxt and prototypes. No 3297 functional changes. 3298 329920040108 3300 - (dtucker) [auth-pam.c defines.h] Bug #783: move __unused to defines.h and 3301 only define if not already. From des at freebsd.org. 3302 - (dtucker) [configure.ac] Remove extra (typo) comma. 3303 330420040105 3305 - (dtucker) [contrib/ssh-copy-id] Bug #781: exit if ssh fails. Patch from 3306 cjwatson at debian.org. 3307 - (dtucker) [acconfig.h configure.ac includes.h servconf.c session.c] 3308 Only enable KerberosGetAFSToken if Heimdal's libkafs is found. with jakob@ 3309 331020040102 3311 - (djm) OSX/Darwin needs BIND_8_COMPAT to build getrrsetbyname. Report from 3312 jakob@ 3313 - (djm) Remove useless DNS support configure summary message. from jakob@ 3314 - (djm) OSX/Darwin put the PAM headers in a different place, detect this. 3315 Report from jakob@ 3316 331720031231 3318 - (dtucker) OpenBSD CVS Sync 3319 - djm@cvs.openbsd.org 2003/12/22 09:16:58 3320 [moduli.c ssh-keygen.1 ssh-keygen.c] 3321 tidy up moduli generation debugging, add -v (verbose/debug) option to 3322 ssh-keygen; ok markus@ 3323 - markus@cvs.openbsd.org 2003/12/22 20:29:55 3324 [cipher-3des1.c] 3325 EVP_CIPHER_CTX_cleanup() for the des contexts; pruiksma@freesurf.fr 3326 - jakob@cvs.openbsd.org 2003/12/23 16:12:10 3327 [servconf.c servconf.h session.c sshd_config] 3328 implement KerberosGetAFSToken server option. ok markus@, beck@ 3329 - millert@cvs.openbsd.org 2003/12/29 16:39:50 3330 [sshd_config] 3331 KeepAlive has been obsoleted, use TCPKeepAlive instead; markus@ OK 3332 - dtucker@cvs.openbsd.org 2003/12/31 00:24:50 3333 [auth2-passwd.c] 3334 Ignore password change request during password auth (which we currently 3335 don't support) and discard proposed new password. corrections/ok markus@ 3336 - (dtucker) [configure.ac] Only test setresuid and setresgid if they exist. 3337 333820031219 3339 - (dtucker) [defines.h] Bug #458: Define SIZE_T_MAX as UINT_MAX if we 3340 typedef size_t ourselves. 3341 334220031218 3343 - (dtucker) [configure.ac] Don't use setre[ug]id on DG-UX, from Tom Orban. 3344 - (dtucker) [auth-pam.c] Do PAM chauthtok during SSH2 keyboard-interactive 3345 authentication. Partially fixes bug #423. Feedback & ok djm@ 3346 334720031217 3348 - (djm) OpenBSD CVS Sync 3349 - markus@cvs.openbsd.org 2003/12/09 15:28:43 3350 [serverloop.c] 3351 make ClientKeepAlive work for ssh -N, too (no login shell requested). 3352 1) send a bogus channel request if we find a channel 3353 2) send a bogus global request if we don't have a channel 3354 ok + test beck@ 3355 - markus@cvs.openbsd.org 2003/12/09 17:29:04 3356 [sshd.c] 3357 fix -o and HUP; ok henning@ 3358 - markus@cvs.openbsd.org 2003/12/09 17:30:05 3359 [ssh.c] 3360 don't modify argv for ssh -o; similar to sshd.c 1.283 3361 - markus@cvs.openbsd.org 2003/12/09 21:53:37 3362 [readconf.c readconf.h scp.1 servconf.c servconf.h sftp.1 ssh.1] 3363 [ssh_config.5 sshconnect.c sshd.c sshd_config.5] 3364 rename keepalive to tcpkeepalive; the old name causes too much 3365 confusion; ok djm, dtucker; with help from jmc@ 3366 - dtucker@cvs.openbsd.org 2003/12/09 23:45:32 3367 [clientloop.c] 3368 Clear exit code when ssh -N is terminated with a SIGTERM. ok markus@ 3369 - markus@cvs.openbsd.org 2003/12/14 12:37:21 3370 [ssh_config.5] 3371 we don't support GSS KEX; from Simon Wilkinson 3372 - markus@cvs.openbsd.org 2003/12/16 15:49:51 3373 [clientloop.c clientloop.h readconf.c readconf.h scp.1 sftp.1 ssh.1] 3374 [ssh.c ssh_config.5] 3375 application layer keep alive (ServerAliveInterval ServerAliveCountMax) 3376 for ssh(1), similar to the sshd(8) option; ok beck@; with help from 3377 jmc and dtucker@ 3378 - markus@cvs.openbsd.org 2003/12/16 15:51:54 3379 [dh.c] 3380 use <= instead of < in dh_estimate; ok provos/hshoexer; 3381 do not return < DH_GRP_MIN 3382 - (dtucker) [acconfig.h configure.ac uidswap.c] Bug #645: Check for 3383 setres[ug]id() present but not implemented (eg some Linux/glibc 3384 combinations). 3385 - (bal) [openbsd-compat/bsd-misc.c] unset 'signal' defined if we are 3386 using a real 'signal()' (Noticed by a NeXT Compile) 3387 338820031209 3389 - (dtucker) OpenBSD CVS Sync 3390 - matthieu@cvs.openbsd.org 2003/11/25 23:10:08 3391 [ssh-add.1] 3392 ssh-add doesn't need to be a descendant of ssh-agent. Ok markus@, jmc@. 3393 - djm@cvs.openbsd.org 2003/11/26 21:44:29 3394 [cipher-aes.c] 3395 fix #ifdef before #define; ok markus@ 3396 (RCS ID sync only, Portable already had this) 3397 - markus@cvs.openbsd.org 2003/12/02 12:15:10 3398 [progressmeter.c] 3399 improvments from andreas@: 3400 * saner speed estimate for transfers that takes less than a second by 3401 rounding the time to 1 second. 3402 * when the transfer is finished calculate the actual total speed 3403 rather than the current speed which is given during the transfer 3404 - markus@cvs.openbsd.org 2003/12/02 17:01:15 3405 [channels.c session.c ssh-agent.c ssh.h sshd.c] 3406 use SSH_LISTEN_BACKLOG (=128) in listen(2). 3407 - djm@cvs.openbsd.org 2003/12/07 06:34:18 3408 [moduli.c] 3409 remove unused debugging #define templates 3410 - markus@cvs.openbsd.org 2003/12/08 11:00:47 3411 [kexgexc.c] 3412 print requested group size in debug; ok djm 3413 - dtucker@cvs.openbsd.org 2003/12/09 13:52:55 3414 [moduli.c] 3415 Prevent ssh-keygen -T from outputting moduli with a generator of 0, since 3416 they can't be used for Diffie-Hellman. Assistance and ok djm@ 3417 - (dtucker) [ssh-keyscan.c] Sync RCSIDs, missed in SSH_SSFDMAX change below. 3418 341920031208 3420 - (tim) [configure.ac] Bug 770. Fix --without-rpath. 3421 342220031123 3423 - (djm) [canohost.c] Move IPv4inV6 mapped address normalisation to its own 3424 function and call it unconditionally 3425 - (djm) OpenBSD CVS Sync 3426 - djm@cvs.openbsd.org 2003/11/23 23:17:34 3427 [ssh-keyscan.c] 3428 from portable - use sysconf to detect fd limit; ok markus@ 3429 (tidy diff by adding SSH_SSFDMAX macro to defines.h) 3430 - djm@cvs.openbsd.org 2003/11/23 23:18:45 3431 [ssh-keygen.c] 3432 consistency PATH_MAX -> MAXPATHLEN; ok markus@ 3433 (RCS ID sync only) 3434 - djm@cvs.openbsd.org 2003/11/23 23:21:21 3435 [scp.c] 3436 from portable: rename clashing variable limit-> limit_rate; ok markus@ 3437 (RCS ID sync only) 3438 - dtucker@cvs.openbsd.org 2003/11/24 00:16:35 3439 [ssh.1 ssh.c] 3440 Make ssh -k mean GSSAPIDelegateCredentials=no. Suggestion & ok markus@ 3441 - (djm) Annotate OpenBSD-derived files in openbsd-compat/ with original 3442 source file path (in OpenBSD tree). 3443 344420031122 3445 - (dtucker) [channels.c] Make AIX write limit code clearer. Suggested by djm@ 3446 - (dtucker) [auth-passwd.c openbsd-compat/port-aix.c openbsd-compat/port-aix.h] 3447 Move AIX specific password authentication code to port-aix.c, call 3448 authenticate() until reenter flag is clear. 3449 - (dtucker) [auth-sia.c configure.ac] Tru64 update from cmadams at hiwaay.net. 3450 Use permanently_set_uid for SIA, only define DISABLE_FD_PASSING when SIA 3451 is enabled, rely on SIA to check for locked accounts if enabled. ok djm@ 3452 - (djm) [scp.c] Rename limitbw -> limit_rate to match upstreamed patch 3453 - (djm) [sftp-int.c] Remove duplicated code from bogus sync 3454 - (djm) [packet.c] Shuffle #ifdef to reduce conditionally compiled code 3455 345620031121 3457 - (djm) OpenBSD CVS Sync 3458 - markus@cvs.openbsd.org 2003/11/20 11:39:28 3459 [progressmeter.c] 3460 fix rounding errors; from andreas@ 3461 - djm@cvs.openbsd.org 2003/11/21 11:57:03 3462 [everything] 3463 unexpand and delete whitespace at EOL; ok markus@ 3464 (done locally and RCS IDs synced) 3465 346620031118 3467 - (djm) Fix early exit for root auth success when UsePAM=yes and 3468 PermitRootLogin=no 3469 - (dtucker) [auth-pam.c] Convert chauthtok_conv into a generic tty_conv, 3470 and use it for do_pam_session. Fixes problems like pam_motd not 3471 displaying anything. ok djm@ 3472 - (dtucker) [auth-pam.c] Only use pam_putenv if our platform has it. ok djm@ 3473 - (djm) OpenBSD CVS Sync 3474 - dtucker@cvs.openbsd.org 2003/11/18 00:40:05 3475 [serverloop.c] 3476 Correct check for authctxt->valid. ok djm@ 3477 - djm@cvs.openbsd.org 2003/11/18 10:53:07 3478 [monitor.c] 3479 unbreak fake authloop for non-existent users (my screwup). Spotted and 3480 tested by dtucker@; ok markus@ 3481 348220031117 3483 - (djm) OpenBSD CVS Sync 3484 - djm@cvs.openbsd.org 2003/11/03 09:03:37 3485 [auth-chall.c] 3486 make this a little more idiot-proof; ok markus@ 3487 (includes portable-specific changes) 3488 - jakob@cvs.openbsd.org 2003/11/03 09:09:41 3489 [sshconnect.c] 3490 move changed key warning into warn_changed_key(). ok markus@ 3491 - jakob@cvs.openbsd.org 2003/11/03 09:37:32 3492 [sshconnect.c] 3493 do not free static type pointer in warn_changed_key() 3494 - djm@cvs.openbsd.org 2003/11/04 08:54:09 3495 [auth1.c auth2.c auth2-pubkey.c auth.h auth-krb5.c auth-passwd.c] 3496 [auth-rhosts.c auth-rh-rsa.c auth-rsa.c monitor.c serverloop.c] 3497 [session.c] 3498 standardise arguments to auth methods - they should all take authctxt. 3499 check authctxt->valid rather then pw != NULL; ok markus@ 3500 - jakob@cvs.openbsd.org 2003/11/08 16:02:40 3501 [auth1.c] 3502 remove unused variable (pw). ok djm@ 3503 (id sync only - still used in portable) 3504 - jmc@cvs.openbsd.org 2003/11/08 19:17:29 3505 [sftp-int.c] 3506 typos from Jonathon Gray; 3507 - jakob@cvs.openbsd.org 2003/11/10 16:23:41 3508 [bufaux.c bufaux.h cipher.c cipher.h hostfile.c hostfile.h key.c] 3509 [key.h sftp-common.c sftp-common.h sftp-server.c sshconnect.c sshd.c] 3510 [ssh-dss.c ssh-rsa.c uuencode.c uuencode.h] 3511 constify. ok markus@ & djm@ 3512 - dtucker@cvs.openbsd.org 2003/11/12 10:12:15 3513 [scp.c] 3514 When called with -q, pass -q to ssh; suppresses SSH2 banner. ok markus@ 3515 - jakob@cvs.openbsd.org 2003/11/12 16:39:58 3516 [dns.c dns.h readconf.c ssh_config.5 sshconnect.c] 3517 update SSHFP validation. ok markus@ 3518 - jmc@cvs.openbsd.org 2003/11/12 20:14:51 3519 [ssh_config.5] 3520 make verb agree with subject, and kill some whitespace; 3521 - markus@cvs.openbsd.org 2003/11/14 13:19:09 3522 [sshconnect2.c] 3523 cleanup and minor fixes for the client code; from Simon Wilkinson 3524 - djm@cvs.openbsd.org 2003/11/17 09:45:39 3525 [msg.c msg.h sshconnect2.c ssh-keysign.c] 3526 return error on msg send/receive failure (rather than fatal); ok markus@ 3527 - markus@cvs.openbsd.org 2003/11/17 11:06:07 3528 [auth2-gss.c gss-genr.c gss-serv.c monitor.c monitor.h monitor_wrap.c] 3529 [monitor_wrap.h sshconnect2.c ssh-gss.h] 3530 replace "gssapi" with "gssapi-with-mic"; from Simon Wilkinson; 3531 test + ok jakob. 3532 - (djm) Bug #632: Don't call pam_end indirectly from within kbd-int 3533 conversation function 3534 - (djm) Export environment variables from authentication subprocess to 3535 parent. Part of Bug #717 3536 353720031115 3538 - (dtucker) [regress/agent-ptrace.sh] Test for GDB output from Solaris and 3539 HP-UX, skip test on AIX. 3540 354120031113 3542 - (dtucker) [auth-pam.c] Append newlines to lines output by the 3543 pam_chauthtok_conv(). 3544 - (dtucker) [README ssh-host-config ssh-user-config Makefile] (All 3545 contrib/cygwin). Major update from vinschen at redhat.com. 3546 - Makefile provides a `cygwin-postinstall' target to run right after 3547 `make install'. 3548 - Better support for Windows 2003 Server. 3549 - Try to get permissions as correct as possible. 3550 - New command line options to allow full automated host configuration. 3551 - Create configs from skeletons in /etc/defaults/etc. 3552 - Use /bin/bash, allows reading user input with readline support. 3553 - Remove really old configs from /usr/local. 3554 - (dtucker) [auth-pam.c] Add newline to accumulated PAM_TEXT_INFO and 3555 PAM_ERROR_MSG messages. 3556 355720031106 3558 - (djm) Clarify UsePAM consequences a little more 3559 356020031103 3561 - (dtucker) [contrib/cygwin/ssh-host-config] Ensure entries in /etc/services 3562 are created correctly with CRLF line terminations. Patch from vinschen at 3563 redhat.com. 3564 - (dtucker) OpenBSD CVS Sync 3565 - markus@cvs.openbsd.org 2003/10/15 09:48:45 3566 [monitor_wrap.c] 3567 check pmonitor != NULL 3568 - markus@cvs.openbsd.org 2003/10/21 09:50:06 3569 [auth2-gss.c] 3570 make sure the doid is larger than 2 3571 - avsm@cvs.openbsd.org 2003/10/26 16:57:43 3572 [sshconnect2.c] 3573 rename 'supported' static var in userauth_gssapi() to 'gss_supported' 3574 to avoid shadowing the global version. markus@ ok 3575 - markus@cvs.openbsd.org 2003/10/28 09:08:06 3576 [misc.c] 3577 error->debug for getsockopt+TCP_NODELAY; several requests 3578 - markus@cvs.openbsd.org 2003/11/02 11:01:03 3579 [auth2-gss.c compat.c compat.h sshconnect2.c] 3580 remove support for SSH_BUG_GSSAPI_BER; simon@sxw.org.uk 3581 - (dtucker) [regress/agent-ptrace.sh] Use numeric uid and gid. 3582 358320031021 3584 - (dtucker) [INSTALL] Some system crypt() functions support MD5 passwords 3585 directly. Noted by Darren.Moffat at sun.com. 3586 - (dtucker) [regress/agent-ptrace.sh] Skip agent-test unless SUDO is set, 3587 make agent setgid during test. 3588 358920031017 3590 - (dtucker) [INSTALL] Note that --with-md5 is now required on platforms with 3591 MD5 passwords even if PAM support is enabled. From steev at detritus.net. 3592 359320031015 3594 - (dtucker) OpenBSD CVS Sync 3595 - jmc@cvs.openbsd.org 2003/10/08 08:27:36 3596 [scp.1 scp.c sftp-server.8 sftp.1 sftp.c ssh.1 sshd.8] 3597 scp and sftp: add options list and sort options. options list requested 3598 by deraadt@ 3599 sshd: use same format as ssh 3600 ssh: remove wrong option from list 3601 sftp-server: Subsystem is documented in ssh_config(5), not sshd(8) 3602 ok deraadt@ markus@ 3603 - markus@cvs.openbsd.org 2003/10/08 15:21:24 3604 [readconf.c ssh_config.5] 3605 default GSS API to no in client, too; ok jakob, deraadt@ 3606 - markus@cvs.openbsd.org 2003/10/11 08:24:08 3607 [readconf.c readconf.h ssh.1 ssh.c ssh_config.5] 3608 remote x11 clients are now untrusted by default, uses xauth(8) to generate 3609 untrusted cookies; ForwardX11Trusted=yes restores old behaviour. 3610 ok deraadt; feedback and ok djm/fries 3611 - markus@cvs.openbsd.org 2003/10/11 08:26:43 3612 [sshconnect2.c] 3613 search keys in reverse order; fixes #684 3614 - markus@cvs.openbsd.org 2003/10/11 11:36:23 3615 [monitor_wrap.c] 3616 return NULL for missing banner; ok djm@ 3617 - jmc@cvs.openbsd.org 2003/10/12 13:12:13 3618 [ssh_config.5] 3619 note that EnableSSHKeySign should be in the non-hostspecific section; 3620 remove unnecessary .Pp; 3621 ok markus@ 3622 - markus@cvs.openbsd.org 2003/10/13 08:22:25 3623 [scp.1 sftp.1] 3624 don't refer to options related to forwarding; ok jmc@ 3625 - jakob@cvs.openbsd.org 2003/10/14 19:42:10 3626 [dns.c dns.h readconf.c ssh-keygen.c sshconnect.c] 3627 include SSHFP lookup code (not enabled by default). ok markus@ 3628 - jakob@cvs.openbsd.org 2003/10/14 19:43:23 3629 [README.dns] 3630 update 3631 - markus@cvs.openbsd.org 2003/10/14 19:54:39 3632 [session.c ssh-agent.c] 3633 10X for mkdtemp; djm@ 3634 - (dtucker) [acconfig.h configure.ac dns.c openbsd-compat/getrrsetbyname.c 3635 openbsd-compat/getrrsetbyname.h] DNS fingerprint support is now always 3636 compiled in but disabled in config. 3637 - (dtucker) [auth.c] Check for disabled password expiry on HP-UX Trusted Mode. 3638 - (tim) [regress/banner.sh] portability fix. 3639 364020031009 3641 - (dtucker) [sshd_config.5] UsePAM defaults to "no". ok djm@ 3642 364320031008 3644 - (dtucker) OpenBSD CVS Sync 3645 - dtucker@cvs.openbsd.org 2003/10/07 01:47:27 3646 [sshconnect2.c] 3647 Don't use logit for banner, since it truncates to MSGBUFSIZ; bz #668 & 3648 #707. ok markus@ 3649 - djm@cvs.openbsd.org 2003/10/07 07:04:16 3650 [sftp-int.c] 3651 sftp quoting fix from admorten AT umich.edu; ok markus@ 3652 - deraadt@cvs.openbsd.org 2003/10/07 21:58:28 3653 [sshconnect2.c] 3654 set ptr to NULL after free 3655 - dtucker@cvs.openbsd.org 2003/10/07 01:52:13 3656 [regress/Makefile regress/banner.sh] 3657 Test SSH2 banner. ok markus@ 3658 - djm@cvs.openbsd.org 2003/10/07 07:04:52 3659 [regress/sftp-cmds.sh] 3660 more sftp quoting regress tests; ok markus 3661 366220031007 3663 - (djm) Delete autom4te.cache after autoreconf 3664 - (dtucker) [auth-pam.c auth-pam.h session.c] Make PAM use the new static 3665 cleanup functions. With & ok djm@ 3666 - (dtucker) [contrib/redhat/openssh.spec] Bug #714: Now that UsePAM is a 3667 run-time switch, always build --with-md5-passwords. 3668 - (dtucker) [configure.ac openbsd-compat/Makefile.in openbsd-compat/strtoul.c] 3669 Bug #670: add strtoul() to openbsd-compat for platforms lacking it. ok djm@ 3670 - (dtucker) [configure.ac] Bug #715: Set BROKEN_SETREUID and BROKEN_SETREGID 3671 on Reliant Unix. Patch from Robert.Dahlem at siemens.com. 3672 - (dtucker) [configure.ac] Bug #710: Check for dlsym() in libdl on 3673 Reliant Unix. Based on patch from Robert.Dahlem at siemens.com. 3674 367520031003 3676 - (dtucker) OpenBSD CVS Sync 3677 - markus@cvs.openbsd.org 2003/10/02 10:41:59 3678 [sshd.c] 3679 print openssl version, too, several requests; ok henning/djm. 3680 - markus@cvs.openbsd.org 2003/10/02 08:26:53 3681 [ssh-gss.h] 3682 missing $OpenBSD:; dtucker 3683 - (tim) [contrib/caldera/openssh.spec] Remove obsolete --with-ipv4-default 3684 option. 3685 368620031002 3687 - (dtucker) OpenBSD CVS Sync 3688 - markus@cvs.openbsd.org 2003/09/23 20:17:11 3689 [Makefile.in auth1.c auth2.c auth.c auth.h auth-krb5.c canohost.c 3690 cleanup.c clientloop.c fatal.c gss-serv.c log.c log.h monitor.c monitor.h 3691 monitor_wrap.c monitor_wrap.h packet.c serverloop.c session.c session.h 3692 ssh-agent.c sshd.c] 3693 replace fatal_cleanup() and linked list of fatal callbacks with static 3694 cleanup_exit() function. re-refine cleanup_exit() where appropriate, 3695 allocate sshd's authctxt eary to allow simpler cleanup in sshd. 3696 tested by many, ok deraadt@ 3697 - markus@cvs.openbsd.org 2003/09/23 20:18:52 3698 [progressmeter.c] 3699 don't print trailing \0; bug #709; Robert.Dahlem@siemens.com 3700 ok millert/deraadt@ 3701 - markus@cvs.openbsd.org 2003/09/23 20:41:11 3702 [channels.c channels.h clientloop.c] 3703 move client only agent code to clientloop.c 3704 - markus@cvs.openbsd.org 2003/09/26 08:19:29 3705 [sshd.c] 3706 no need to set the listen sockets to non-block; ok deraadt@ 3707 - jmc@cvs.openbsd.org 2003/09/29 11:40:51 3708 [ssh.1] 3709 - add list of options to -o and .Xr ssh_config(5) 3710 - some other cleanup 3711 requested by deraadt@; 3712 ok deraadt@ markus@ 3713 - markus@cvs.openbsd.org 2003/09/29 20:19:57 3714 [servconf.c sshd_config] 3715 GSSAPICleanupCreds -> GSSAPICleanupCredentials 3716 - (dtucker) [configure.ac] Don't set DISABLE_SHADOW when configuring 3717 --with-pam. ok djm@ 3718 - (dtucker) [ssh-gss.h] Prototype change missed in sync. 3719 - (dtucker) [session.c] Fix bus errors on some 64-bit Solaris configurations. 3720 Based on patches by Matthias Koeppe and Thomas Baden. ok djm@ 3721 372220030930 3723 - (bal) Fix issues in openbsd-compat/realpath.c 3724 372520030925 3726 - (dtucker) [configure.ac openbsd-compat/xcrypt.c] Bug #633: Remove 3727 DISABLE_SHADOW for HP-UX, use getspnam instead of getprpwnam. Patch from 3728 michael_steffens at hp.com, ok djm@ 3729 - (tim) [sshd_config] UsePAM defaults to no. 3730 373120030924 3732 - (djm) Update version.h and spec files for HEAD 3733 - (dtucker) [configure.ac] IRIX5 needs the same setre[ug]id defines as IRIX6. 3734 373520030923 3736 - (dtucker) [Makefile.in] Bug #644: Fix "make clean" for out-of-tree 3737 builds. Portability corrections from tim@. 3738 - (dtucker) [configure.ac] Bug #665: uid swapping issues on Mac OS X. 3739 Patch from max at quendi.de. 3740 - (dtucker) [configure.ac] Bug #657: uid swapping issues on BSDi. 3741 - (dtucker) [configure.ac] Bug #653: uid swapping issues on Tru64. 3742 - (dtucker) [configure.ac] Bug #693: uid swapping issues on NCR MP-RAS. 3743 Patch from david.haughton at ncr.com 3744 - (dtucker) [configure.ac] Bug #659: uid swapping issues on IRIX 6. 3745 Part of patch supplied by bugzilla-openssh at thewrittenword.com 3746 - (dtucker) [configure.ac openbsd-compat/fake-rfc2553.c 3747 openbsd-compat/fake-rfc2553.h] Bug #659: Test for and handle systems with 3748 where gai_strerror is defined as "const char *". Part of patch supplied 3749 by bugzilla-openssh at thewrittenword.com 3750 - (dtucker) [contrib/cygwin/README contrib/cygwin/ssh-host-config] Update 3751 ssh-host-config to match current defaults, bump README version. Patch from 3752 vinschen at redhat.com. 3753 - (dtucker) [uidswap.c] Don't test restoration of uid on Cygwin since the 3754 OS does not support permanently dropping privileges. Patch from 3755 vinschen at redhat.com. 3756 - (dtucker) [openbsd-compat/port-aix.c] Use correct include for xmalloc.h, 3757 add canohost.h to stop warning. Based on patch from openssh-unix-dev at 3758 thewrittenword.com 3759 - (dtucker) [INSTALL] Bug #686: Document requirement for zlib 1.1.4 or 3760 higher. 3761 - (tim) Fix typo. s/SETEIUD_BREAKS_SETUID/SETEUID_BREAKS_SETUID/ 3762 - (tim) [configure.ac] Bug 665: move 3 new AC_DEFINES outside of AC_TRY_RUN. 3763 Report by distler AT golem ph utexas edu. 3764 - (dtucker) [contrib/aix/pam.conf] Include example pam.conf for AIX from 3765 article by genty at austin.ibm.com, included with the author's permission. 3766 - (dtucker) OpenBSD CVS Sync 3767 - markus@cvs.openbsd.org 2003/09/18 07:52:54 3768 [sshconnect.c] 3769 missing {}; bug #656; jclonguet at free.fr 3770 - markus@cvs.openbsd.org 2003/09/18 07:54:48 3771 [buffer.c] 3772 protect against double free; #660; zardoz at users.sf.net 3773 - markus@cvs.openbsd.org 2003/09/18 07:56:05 3774 [authfile.c] 3775 missing buffer_free(&encrypted); #662; zardoz at users.sf.net 3776 - markus@cvs.openbsd.org 2003/09/18 08:49:45 3777 [deattack.c misc.c session.c ssh-agent.c] 3778 more buffer allocation fixes; from Solar Designer; CAN-2003-0682; 3779 ok millert@ 3780 - miod@cvs.openbsd.org 2003/09/18 13:02:21 3781 [authfd.c bufaux.c dh.c mac.c ssh-keygen.c] 3782 A few signedness fixes for harmless situations; markus@ ok 3783 - markus@cvs.openbsd.org 2003/09/19 09:02:02 3784 [packet.c] 3785 buffer_dump only if PACKET_DEBUG is defined; Jedi/Sector One; pr 3471 3786 - markus@cvs.openbsd.org 2003/09/19 09:03:00 3787 [buffer.c] 3788 sign fix in buffer_dump; Jedi/Sector One; pr 3473 3789 - markus@cvs.openbsd.org 2003/09/19 11:29:40 3790 [ssh-agent.c] 3791 provide a ssh-agent specific fatal() function; ok deraadt 3792 - markus@cvs.openbsd.org 2003/09/19 11:30:39 3793 [ssh-keyscan.c] 3794 avoid fatal_cleanup, just call exit(); ok deraadt 3795 - markus@cvs.openbsd.org 2003/09/19 11:31:33 3796 [channels.c] 3797 do not call channel_free_all on fatal; ok deraadt 3798 - markus@cvs.openbsd.org 2003/09/19 11:33:09 3799 [packet.c sshd.c] 3800 do not call packet_close on fatal; ok deraadt 3801 - markus@cvs.openbsd.org 2003/09/19 17:40:20 3802 [scp.c] 3803 error handling for remote-remote copy; #638; report Harald Koenig; 3804 ok millert, fgs, henning, deraadt 3805 - markus@cvs.openbsd.org 2003/09/19 17:43:35 3806 [clientloop.c sshtty.c sshtty.h] 3807 remove fatal callbacks from client code; ok deraadt 3808 - (bal) "extration" -> "extraction" in ssh-rand-helper.c; repoted by john 3809 on #unixhelp@efnet 3810 - (tim) [configure.ac] add --disable-etc-default-login option. ok djm 3811 - (djm) Sync with V_3_7 branch: 3812 - (djm) Fix SSH1 challenge kludge 3813 - (djm) Bug #671: Fix builds on OpenBSD 3814 - (djm) Bug #676: Fix PAM stack corruption 3815 - (djm) Fix bad free() in PAM code 3816 - (djm) Don't call pam_end before pam_init 3817 - (djm) Enable build with old OpenSSL again 3818 - (djm) Trim deprecated options from INSTALL. Mention UsePAM 3819 - (djm) Fix quote handling in sftp; Patch from admorten AT umich.edu 3820 3821$Id: ChangeLog,v 1.4117.2.1 2006/02/01 11:33:14 djm Exp $ 3822