summaryrefslogtreecommitdiffstats
AgeCommit message (Collapse)Author
2023-01-06upstream: Save debug logs from ssh for debugging purposes.dtucker@openbsd.org
OpenBSD-Regress-ID: 109e40b06de1c006a3b8e0d8745b790b2c5870a0
2023-01-06upstream: regression test for ChannelTimeoutdjm@openbsd.org
OpenBSD-Regress-ID: 280bfbefcfa415428ad744e43f69a8dede8ad685
2023-01-06upstream: fix typo in verbose loggingdjm@openbsd.org
OpenBSD-Regress-ID: 0497cdb66e003b2f50ed77291a9104fba2e017e9
2023-01-06upstream: unit tests for misc.c:ptimeout_* APIdjm@openbsd.org
OpenBSD-Regress-ID: 01f8fb12d08e5aaadd4bd4e71f456b6588be9a94
2023-01-06upstream: Copy bytes from the_banana[] rather than banana()tb@openbsd.org
Fixes test failure due to segfault seen on arm64 with xonly snap. ok djm OpenBSD-Regress-ID: 86e2aa4bbd1dff1bc4ebb2969c0d6474485be046
2023-01-06unbreak scp on NetBSD 4.xDamien Miller
e555d5cad5 effectively increased the default copy buffer size for SFTP transfers. This caused NetBSD 4.x to hang during the "copy local file to remote file in place" scp.sh regression test. This puts back the original 32KB copy buffer size until we can properly figure out why. lots of debugging assistance from dtucker@
2023-01-06upstream: Implement channel inactivity timeoutsdjm@openbsd.org
This adds a sshd_config ChannelTimeouts directive that allows channels that have not seen traffic in a configurable interval to be automatically closed. Different timeouts may be applied to session, X11, agent and TCP forwarding channels. Note: this only affects channels over an opened SSH connection and not the connection itself. Most clients close the connection when their channels go away, with a notable exception being ssh(1) in multiplexing mode. ok markus dtucker OpenBSD-Commit-ID: ae8bba3ed9d9f95ff2e2dc8dcadfa36b48e6c0b8
2023-01-06upstream: Add channel_set_xtype()djm@openbsd.org
This sets an "extended" channel type after channel creation (e.g. "session:subsystem:sftp") that will be used for setting channel inactivity timeouts. ok markus dtucker OpenBSD-Commit-ID: 42564aa92345045b4a74300528f960416a15d4ca
2023-01-06upstream: tweak channel ctype namesdjm@openbsd.org
These are now used by sshd_config:ChannelTimeouts to specify timeouts by channel type, so force them all to use a similar format without whitespace. ok dtucker markus OpenBSD-Commit-ID: 66834765bb4ae14f96d2bb981ac98a7dae361b65
2023-01-06upstream: Add channel_force_close()djm@openbsd.org
This will forcibly close an open channel by simulating read/write errors, draining the IO buffers and calling the detach function. Previously the detach function was only ever called during channel garbage collection, but there was no way to signal the user of a channel (e.g. session.c) that its channel was being closed deliberately (vs. by the usual state-machine logic). So this adds an extra "force" argument to the channel cleanup callback to indicate this condition. ok markus dtucker OpenBSD-Commit-ID: 23052707a42bdc62fda2508636e624afd466324b
2023-01-06upstream: replace manual poll/ppoll timeout math with ptimeout APIdjm@openbsd.org
feedback markus / ok markus dtucker OpenBSD-Commit-ID: c5ec4f2d52684cdb788cd9cbc1bcf89464014be2
2023-01-06upstream: add ptimeout API for keeping track of poll/ppolldjm@openbsd.org
timeouts; ok dtucker markus OpenBSD-Commit-ID: 3335268ca135b3ec15a947547d7cfbb8ff929ead
2023-01-06upstream: suppress "Connection closed" message when in quiet modedjm@openbsd.org
OpenBSD-Commit-ID: 8a3ab7176764da55f60bfacfeae9b82d84e3908f
2023-01-03upstream: regression test for PermitRemoteOpendjm@openbsd.org
OpenBSD-Regress-ID: 8271aafbf5c21950cd5bf966f08e585cebfe630c
2023-01-03upstream: fix bug in PermitRemoteOpen which caused it to ignore itsdjm@openbsd.org
first argument unless it was one of the special keywords "any" or "none". Reported by Georges Chaudy in bz3515; ok dtucker@ OpenBSD-Commit-ID: c5678a39f1ff79993d5ae3cfac5746a4ae148ea5
2023-01-03upstream: spelling fixes; from paul tagliamonte amendments to hisjmc@openbsd.org
diff are noted on tech OpenBSD-Commit-ID: d776dd03d0b882ca9c83b84f6b384f6f9bd7de4a
2023-01-03upstream: Mention that scp uses the SFTP protocol and removedjm@openbsd.org
reference to legacy flag. Spotted by, feedback and ok jmc@ OpenBSD-Commit-ID: 9dfe04966f52e941966b46c7a2972147f95281b3
2023-01-03upstream: Clear signal mask early in main(); sshd may have beendjm@openbsd.org
started with one or more signals masked (sigprocmask(2) is not cleared on fork/exec) and this could interfere with various things, e.g. the login grace timer. Execution environments that fail to clear the signal mask before running sshd are clearly broken, but apparently they do exist. Reported by Sreedhar Balasubramanian; ok dtucker@ OpenBSD-Commit-ID: 77078c0b1c53c780269fc0c416f121d05e3010ae
2023-01-03upstream: add -X to usage();jmc@openbsd.org
OpenBSD-Commit-ID: 1bdc3df7de11d766587b0428318336dbffe4a9d0
2023-01-03upstream: add a -X option to both scp(1) and sftp(1) to allowdjm@openbsd.org
control over some SFTP protocol knobs: the copy buffer length and the number of inflight requests, both of which are used during upload/download. Previously these could be controlled in sftp(1) using the -b/-R options. This makes them available in both SFTP protocol clients using the same option character sequence. ok dtucker@ OpenBSD-Commit-ID: 27502bffc589776f5da1f31df8cb51abe9a15f1c
2023-01-03upstream: The idiomatic way of coping with signed char vs unsignedderaadt@openbsd.org
char (which did not come from stdio read functions) in the presence of ctype macros, is to always cast to (unsigned char). casting to (int) for a "macro" which is documented to take int, is weird. And sadly wrong, because of the sing extension risk.. same diff from florian OpenBSD-Commit-ID: 65b9a49a68e22ff3a0ebd593f363e9f22dd73fea
2022-12-19Simply handling of SSH_CONNECTION PAM env var.Darren Tucker
Prompted by bz#3508: there's no need to cache the value of sshpam_conninfo so remove the global. While there, add check of return value from pam_putenv. ok djm@
2022-12-19Add tests for LibreSSL 3.7.0 and OpenSSL 1.1.1s.Darren Tucker
2022-12-18Use sudo when resetting perms on directories.Darren Tucker
2022-12-18Set group perms on regress dir.Darren Tucker
This ensures that the tests don't fail due to StrictMode checks.
2022-12-18Fetch regress logs from obj dir.Darren Tucker
2022-12-13obsdsnap test VMs runs-on libvirt too.Darren Tucker
2022-12-13Run upstream obsdsnap tests on ephemeral runners.Darren Tucker
2022-12-13Move obsdsnap test VMs to ephemeral runners.Darren Tucker
2022-12-09use calloc for allocating arc4random structsDamien Miller
ok dtucker
2022-12-09upstream: Warn if no host keys for hostbased auth can be loaded.dtucker@openbsd.org
OpenBSD-Commit-ID: 2a0a13132000cf8d3593133c1b49768aa3c95977
2022-12-09upstream: Add server debugging for hostbased auth.dtucker@openbsd.org
auth_debug_add queues messages about the auth process which is sent to the client after successful authentication. This also sends those to the server debug log to aid in debugging. From bz#3507, ok djm@ OpenBSD-Commit-ID: 46ff67518cccf9caf47e06393e2a121ee5aa258a
2022-12-09upstream: remove '?' from getopt(3) loopscheloha@openbsd.org
userspace: remove vestigial '?' cases from top-level getopt(3) loops getopt(3) returns '?' when it encounters a flag not present in the in the optstring or if a flag is missing its option argument. We can handle this case with the "default" failure case with no loss of legibility. Hence, remove all the redundant "case '?':" lines. Prompted by dlg@. With help from dlg@ and millert@. Link: https://marc.info/?l=openbsd-tech&m=167011979726449&w=2 ok naddy@ millert@ dlg@ OpenBSD-Commit-ID: b2f89346538ce4f5b33ab8011a23e0626a67e66e
2022-12-09upstream: Fix comment typo.dtucker@openbsd.org
OpenBSD-Regress-ID: 3b04faced6511bb5e74648c6a4ef4bf2c4decf03
2022-12-07Add SANDBOX_DEBUG to the kitchensink test build.Darren Tucker
2022-12-07disable SANDBOX_SECCOMP_FILTER_DEBUGDamien Miller
It was mistakenly enabled in 2580916e4872 Reported by Peter sec-openssh-com.22.fichtner AT 0sg.net
2022-12-06Update autotoolsRose
Regenerate config files using latest autotools
2022-12-06Fix typo in comment. Spotted by tim@Darren Tucker
2022-12-04upstream: Remove duplicate includes.dtucker@openbsd.org
Patch from AtariDreams via github PR#364. OpenBSD-Commit-ID: b9186638a05cb8b56ef7c0de521922b6723644ea
2022-12-04upstream: make struct sshbuf privatedjm@openbsd.org
and remove an unused field; ok dtucker OpenBSD-Commit-ID: c7a3d77c0b8c153d463398606a8d57569186a0c3
2022-12-02Restore ssh-agent permissions on exit.Darren Tucker
...enough that subsequent builds can overwrite ssh-agent if necessary.
2022-12-02upstream: Clean up ssh-add and ssh-agent logs.dtucker@openbsd.org
OpenBSD-Regress-ID: 9eda8e4c3714d7f943ab2e73ed58a233bd29cd2c
2022-12-02upstream: Log output of ssh-agent and ssh-adddtucker@openbsd.org
This should make debugging easier. OpenBSD-Regress-ID: 5974b02651f428d7e1079b41304c498ca7e306c8
2022-11-30upstream: Add void to client_repledge args to fix compiler warning. ok djm@dtucker@openbsd.org
OpenBSD-Commit-ID: 7e964a641ce4a0a0a11f047953b29929d7a4b866
2022-11-30upstream: tighten pledge(2) after session establishmentdjm@openbsd.org
feedback, ok & testing in snaps deraadt@ OpenBSD-Commit-ID: aecf4d49d28586dfbcc74328d9333398fef9eb58
2022-11-30upstream: New EnableEscapeCommandline ssh_config(5) optiondjm@openbsd.org
This option (default "no") controls whether the ~C escape is available. Turning it off by default means we will soon be able to use a stricter default pledge(2) in the client. feedback deraadt@ dtucker@; tested in snaps for a while OpenBSD-Commit-ID: 7e277595d60acb8263118dcb66554472257b387a
2022-11-30upstream: In channel_request_remote_forwarding the parameters formbuhl@openbsd.org
permission_set_add are leaked as they are also duplicated in the call. Found by CodeChecker. ok djm OpenBSD-Commit-ID: 4aef50fa9be7c0b138188814c8fe3dccc196f61e
2022-11-30Use -fzero-call-used-regs=used on clang 15.Darren Tucker
clang 15 seems to have a problem with -fzero-call-used-reg=all which causes spurious "incorrect signature" failures with ED25519. On those versions, use -fzero-call-used-regs=used instead. (We may add exceptions later if specific versions prove to be OK). Also move the GCC version check to match. Initial investigation by Daniel Pouzzner (douzzer at mega nu), workaround suggested by Bill Wendling (morbo at google com). bz#3475, ok djm@
2022-11-28Skip unit tests on slow riscv64 hardware.Darren Tucker
2022-11-28Rework how selfhosted tests interact with runners.Darren Tucker
Previously there was one runner per test target (mostly VMs). This had a few limitations: - multiple tests that ran on the same target (eg multiple build configs) were serialized on availability or that runner. - it needed manual balancing of VMs over host machines. To address this, make VMs that use ephemeral disks (ie most of them) all use a pool of runners with the "libvirt" label. This requires that we distinguish between "host" and "target" for those. Native runners and VMs with persistent disks (eg the constantly-updated snapshot ones) specify the same host and target. This should improve test throughput.
generated by cgit v1.2.3 (git 2.25.1) at 2024-05-30 03:27:22 +0000