summaryrefslogtreecommitdiffstats
AgeCommit message (Collapse)Author
2022-12-17Remove compat from the default tests.V_9_1Darren Tucker
The Makefile changes to get the compat tests to work went in after the V_9_1 branch, so don't test those on this branch.
2022-12-16Fix compat regress to work with non-GNU make.Darren Tucker
2022-12-16Only run opensslver tests if built with OpenSSL.Darren Tucker
2022-12-16Backport test workflow config changes.Darren Tucker
The self-hosted runner setup has been changed recently and the configs in the V_9_1 branch no longer work with the current runners. Backport the changes from master so that the tests on this branch work again.
2022-12-16Use -fzero-call-used-regs=used on clang 15.Darren Tucker
clang 15 seems to have a problem with -fzero-call-used-reg=all which causes spurious "incorrect signature" failures with ED25519. On those versions, use -fzero-call-used-regs=used instead. (We may add exceptions later if specific versions prove to be OK). Also move the GCC version check to match. Initial investigation by Daniel Pouzzner (douzzer at mega nu), workaround suggested by Bill Wendling (morbo at google com). bz#3475, ok djm@
2022-11-08Don't run compat-tests on V_9_1 branch.Darren Tucker
The requisite fixes did not go into the main branch until after V_9_1 was branched.
2022-11-08Add CIFuzz to V_9_1 branch.Darren Tucker
2022-11-08Resync CI configs to HEAD.Darren Tucker
There have been a number of fixes on the main branch, apply to V_9_1 branch.
2022-11-07Use "prohibit-password" in -portable comments.Darren Tucker
"without-password" is the deprecated alias for "prohibit-password", so we should reference the latter. From emaste at freebsd.org.
2022-11-07Fix tracing disable on FreeBSD.Darren Tucker
Some versions of FreeBSD do not support using id 0 to refer to the current pid for procctl, so pass getpid() explicitly. From emaste at freebsd.org.
2022-11-03Include time.h when defining timegm.Darren Tucker
Fixes build on some platforms eg recent AIX.
2022-11-02Always use compat getentropy.Darren Tucker
Have it call native getentropy and fall back as required. Should fix issues of platforms where libc has getentropy but it is not implemented in the kernel. Based on github PR#354 from simsergey.
2022-10-31OpenSSL dev branch is 302 not 320.Darren Tucker
While there, also accept 301 which it what it was previously.
2022-10-18OpenSSL dev branch now identifies as 3.2.0.Darren Tucker
2022-10-14Fix snprintf configure test for clang 15Harmen Stoppels
Clang 15 -Wimplicit-int defaults to an error in C99 mode and above. A handful of tests have "main(..." and not "int main(..." which caused the tests to produce incorrect results.
2022-10-04Test commits to all branches of portable.Darren Tucker
Only test OpenBSD upstream on commits to master since that's what it tracks.
2022-10-04update .dependV_9_1_P1Damien Miller
2022-10-04update release notes URLDamien Miller
2022-10-04crank versions in RPM spec filesDamien Miller
2022-09-27upstream: openssh-9.1djm@openbsd.org
OpenBSD-Commit-ID: 5a467b2ee81da01a86adf1ad93b62b1728494e56
2022-09-27upstream: Fix typo. From AlexanderStohr via github PR#343.dtucker@openbsd.org
OpenBSD-Commit-ID: a134c9b4039e48803fc6a87f955b0f4a03181497
2022-09-27upstream: add RequiredRSASize to the list of keywords accepted bydjm@openbsd.org
-o; spotted by jmc@ OpenBSD-Commit-ID: fe871408cf6f9d3699afeda876f8adbac86a035e
2022-09-19no need for glob.h hereDamien Miller
it also causes portability problems
2022-09-19avoid Wuninitialized false positive in gcc-12ishDamien Miller
2022-09-19upstream: use users-groups-by-id@openssh.com sftp-server extensiondjm@openbsd.org
(when available) to fill in user/group names for directory listings. Implement a client-side cache of see uid/gid=>user/group names. ok markus@ OpenBSD-Commit-ID: f239aeeadfa925a37ceee36ee8b256b8ccf4466e
2022-09-19upstream: sftp client library support fordjm@openbsd.org
users-groups-by-id@openssh.com; ok markus@ OpenBSD-Commit-ID: ddb2f33a2da6349a9a89a8b5bcb9ca7c999394de
2022-09-19upstream: extend sftp-common.c:extend ls_file() to support supplieddjm@openbsd.org
user/group names; ok markus@ OpenBSD-Commit-ID: c70c70498b1fdcf158531117e405b6245863bfb0
2022-09-19upstream: sftp-server(8): add a "users-groups-by-id@openssh.com"djm@openbsd.org
extension request that allows the client to obtain user/group names that correspond to a set of uids/gids. Will be used to make directory listings more useful and consistent in sftp(1). ok markus@ OpenBSD-Commit-ID: 7ebabde0bcb95ef949c4840fe89e697e30df47d3
2022-09-19upstream: better debugging for connect_next()djm@openbsd.org
OpenBSD-Commit-ID: d16a307a0711499c971807f324484ed3a6036640
2022-09-17upstream: Add RequiredRSASize for sshd(8); RSA keys that falldjm@openbsd.org
beneath this limit will be ignored for user and host-based authentication. Feedback deraadt@ ok markus@ OpenBSD-Commit-ID: 187931dfc19d51873df5930a04f2d972adf1f7f1
2022-09-17upstream: add a RequiredRSASize for checking RSA key length indjm@openbsd.org
ssh(1). User authentication keys that fall beneath this limit will be ignored. If a host presents a host key beneath this limit then the connection will be terminated (unfortunately there are no fallbacks in the protocol for host authentication). feedback deraadt, Dmitry Belyavskiy; ok markus@ OpenBSD-Commit-ID: 430e339b2a79fa9ecc63f2837b06fdd88a7da13a
2022-09-17upstream: Add a sshkey_check_rsa_length() call for checking thedjm@openbsd.org
length of an RSA key; ok markus@ OpenBSD-Commit-ID: de77cd5b11594297eda82edc594b0d32b8535134
2022-09-17upstream: actually hook up restrict_websafe; the command-line flagdjm@openbsd.org
was never actually used. Spotted by Matthew Garrett OpenBSD-Commit-ID: 0b363518ac4c2819dbaa3dfad4028633ab9cdff1
2022-09-17upstream: correct error valuedjm@openbsd.org
OpenBSD-Commit-ID: 780efcbad76281f11f14b2a5ff04eb6db3dfdad4
2022-09-16upstream: sftp: Be a bit more clever about completionsdjm@openbsd.org
There are commands (e.g. "get" or "put") that accept two arguments, a local path and a remote path. However, the way current completion is written doesn't take this distinction into account and always completes remote or local paths. By expanding CMD struct and "cmds" array this distinction can be reflected and with small adjustment to completer code the correct path can be completed. By Michal Privoznik, ok dtucker@ OpenBSD-Commit-ID: 1396d921c4eb1befd531f5c4a8ab47e7a74b610b
2022-09-16upstream: sftp: Don't attempt to complete arguments fordjm@openbsd.org
non-existent commands If user entered a non-existent command (e.g. because they made a typo) there is no point in trying to complete its arguments. Skip calling complete_match() if that's the case. From Michal Privoznik OpenBSD-Commit-ID: cf39c811a68cde2aeb98fc85addea4000ef6b07a
2022-09-14upstream: sk_enroll: never drop SSH_SK_USER_VERIFICATION_REQD flagdjm@openbsd.org
from response Now that all FIDO signing calls attempt first without PIN and then fall back to trying PIN only if that attempt fails, we can remove the hack^wtrick that removed the UV flag from the keys returned during enroll. By Corinna Vinschen OpenBSD-Commit-ID: 684517608c8491503bf80cd175425f0178d91d7f
2022-09-14upstream: a little extra debuggingdjm@openbsd.org
OpenBSD-Commit-ID: edf1601c1d0905f6da4c713f4d9cecc7d1c0295a
2022-09-14upstream: ssh-agent: attempt FIDO key signing without PIN and usedjm@openbsd.org
the error to determine whether a PIN is required and prompt only if necessary. from Corinna Vinschen OpenBSD-Commit-ID: dd6be6a0b7148608e834ee737c3479b3270b00dd
2022-09-14upstream: .Li -> .Vt where appropriate; from josiah frentsos,jmc@openbsd.org
tweaked by schwarze ok schwarze OpenBSD-Commit-ID: 565046e3ce68b46c2f440a93d67c2a92726de8ed
2022-09-14upstream: fix repeated words ok miod@ jmc@jsg@openbsd.org
OpenBSD-Commit-ID: 6765daefe26a6b648cc15cadbbe337596af709b7
2022-09-09upstream: notifier_complete(NULL, ...) is a noop, so no need to testdjm@openbsd.org
that ctx!=NULL; from Corinna Vinschen OpenBSD-Commit-ID: ade2f2e9cc519d01a586800c25621d910bce384a
2022-09-08openbsd-compat/bsd-asprintf: add <stdio.h> include for vsnprintfSam James
Fixes the following build failure with Clang 15 on musl: ``` bsd-asprintf.c:51:8: error: call to undeclared library function 'vsnprintf' with type 'int (char *, unsigned long, const char *, struct __va_list_tag *)'; ISO C99 and laterclang -O2 -pipe -fdiagnostics-color=always -frecord-gcc-switches -pipe -Wunknown-warning-option -Qunused-arguments -Wall -Wpointer-arith -Wuninitialized -Wsign-compare -Wformat-security -Wsizeof-pointer-memaccess -Wno-pointer-sign -Wno-unused-result -Wmisleading-indentation -Wbitwise-instead-of-logical -fno-strict-aliasing -mretpoline -ftrapv -fzero-call-used-regs=all -fno-builtin-memset -fstack-protector-strong -fPIE -I. -I. -D_XOPEN_SOURCE=600 -D_BSD_SOURCE -D_DEFAULT_SOURCE -DSSHDIR=\"/etc/ssh\" -D_PATH_SSH_PROGRAM=\"/usr/bin/ssh\" -D_PATH_SSH_ASKPASS_DEFAULT=\"/usr/lib/misc/ssh-askpass\" -D_PATH_SFTP_SERVER=\"/usr/lib/misc/sftp-server\" -D_PATH_SSH_KEY_SIGN=\"/usr/lib/misc/ssh-keysign\" -D_PATH_SSH_PKCS11_HELPER=\"/usr/lib/misc/ssh-pkcs11-helper\" -D_PATH_SSH_SK_HELPER=\"/usr/lib/misc/ssh-sk-helper\" -D_PATH_SSH_PIDDIR=\"/run\" -D_PATH_PRIVSEP_CHROOT_DIR=\"/var/empty\" -DHAVE_CONFIG_H -c cipher-aes.c -o cipher-aes.o do not support implicit function declarations [-Wimplicit-function-declaration] ret = vsnprintf(string, INIT_SZ, fmt, ap2); ^ bsd-asprintf.c:51:8: note: include the header <stdio.h> or explicitly provide a declaration for 'vsnprintf' 1 error generated. ```
2022-09-02Remove DEF_WEAK, it's already in defines.h.Darren Tucker
2022-09-02Resync arc4random with OpenBSD.Darren Tucker
This brings us up to current, including djm's random-reseeding change, as prompted by logan at cyberstorm.mu in bz#3467. It brings the platform-specific hooks from LibreSSL Portable, simplified to match our use case. ok djm@.
2022-09-02Move OPENBSD ORIGINAL marker.Darren Tucker
Putting this after the copyright statement (which doesn't change) instead of before the version identifier (which does) prevents merge conflicts when resyncing changes.
2022-09-02Remove arc4random_uniform from arc4random.cDarren Tucker
This was previously moved into its own file (matching OpenBSD) which prematurely committed in commit 73541f2.
2022-09-02upstream: sk-usbhid: fix key_lookup() on tokens with built-in UVdjm@openbsd.org
explicitly test whether the token performs built-in UV (e.g. biometric tokens) and enable UV in that case. From Pedro Martelletto via GHPR#388 OpenBSD-Commit-ID: 007eb7e387d27cf3029ab06b88224e03eca62ccd
2022-08-31Move sftp from valgrind-2 to 3 to rebalance.Darren Tucker
2022-08-31upstream: whitespacedjm@openbsd.org
OpenBSD-Commit-ID: c2bcbf93610d3d62ed206cdf9bf9ff98c6aaf232
generated by cgit v1.2.3 (git 2.25.1) at 2024-05-14 00:46:58 +0000