#
1.17 |
|
03-Apr-2021 |
djm |
highly polished whitespace, mostly fixing spaces-for-tab and bad indentation on continuation lines. Prompted by GHPR#185
|
#
1.16 |
|
09-Jan-2021 |
dtucker |
Move address handling functions out into their own file in order to reuse them for per-source maxstartups limiting. Supplement with some additional functions from djm's flowtools that we'll also need. ok djm@ (as part of a larger diff).
|
#
1.15 |
|
18-Oct-2020 |
djm |
use the new variant log macros instead of prepending __func__ and appending ssh_err(r) manually; ok markus@
|
Revision tags: OPENBSD_6_4_BASE OPENBSD_6_5_BASE OPENBSD_6_6_BASE OPENBSD_6_7_BASE OPENBSD_6_8_BASE
|
#
1.14 |
|
31-Jul-2018 |
djm |
fix some memory leaks spotted by Coverity via Jakub Jelen in bz#2366 feedback and ok dtucker@
|
Revision tags: OPENBSD_6_1_BASE OPENBSD_6_2_BASE OPENBSD_6_3_BASE
|
#
1.13 |
|
21-Sep-2016 |
djm |
Revert two recent changes to negated address matching. The new behaviour offers unintuitive surprises. We'll find a better way to deal with single negated matches.
match.c 1.31: > fix matching for pattern lists that contain a single negated match, > e.g. "Host !example" > > report and patch from Robin Becker. bz#1918 ok dtucker@
addrmatch.c 1.11: > fix negated address matching where the address list consists of a > single negated match, e.g. "Match addr !192.20.0.1" > > Report and patch from Jakub Jelen. bz#2397 ok dtucker@
|
#
1.12 |
|
23-Aug-2016 |
djm |
downgrade an error() to a debug2() to match similar cases in addr_match_list()
|
#
1.11 |
|
23-Aug-2016 |
djm |
fix negated address matching where the address list consists of a single negated match, e.g. "Match addr !192.20.0.1"
Report and patch from Jakub Jelen. bz#2397 ok dtucker@
|
Revision tags: OPENBSD_5_8_BASE OPENBSD_5_9_BASE OPENBSD_6_0_BASE
|
#
1.10 |
|
08-Jul-2015 |
markus |
xmalloc.h is unused
|
Revision tags: OPENBSD_5_5_BASE OPENBSD_5_6_BASE OPENBSD_5_7_BASE
|
#
1.9 |
|
19-Jan-2014 |
dtucker |
Cast the sizeof to socklen_t so it'll work even if the supplied len is negative. Suggested by and ok djm, ok deraadt.
|
#
1.8 |
|
19-Jan-2014 |
dtucker |
Cast socklen_t when comparing to size_t and use socklen_t to iterate over the ip options, both to prevent signed/unsigned comparison warnings. Patch from vinschen at redhat via portable openssh, begrudging ok deraadt.
|
Revision tags: OPENBSD_5_4_BASE
|
#
1.7 |
|
17-May-2013 |
djm |
bye, bye xfree(); ok markus@
|
Revision tags: OPENBSD_5_2_BASE OPENBSD_5_3_BASE
|
#
1.6 |
|
21-Jun-2012 |
dtucker |
fix strlcpy truncation check. from carsten at debian org, ok markus
|
Revision tags: OPENBSD_4_7_BASE OPENBSD_4_8_BASE OPENBSD_4_9_BASE OPENBSD_5_0_BASE OPENBSD_5_1_BASE
|
#
1.5 |
|
26-Feb-2010 |
djm |
Add support for certificate key types for users and hosts.
OpenSSH certificate key types are not X.509 certificates, but a much simpler format that encodes a public key, identity information and some validity constraints and signs it with a CA key. CA keys are regular SSH keys. This certificate style avoids the attack surface of X.509 certificates and is very easy to deploy.
Certified host keys allow automatic acceptance of new host keys when a CA certificate is marked as trusted in ~/.ssh/known_hosts. see VERIFYING HOST KEYS in ssh(1) for details.
Certified user keys allow authentication of users when the signing CA key is marked as trusted in authorized_keys. See "AUTHORIZED_KEYS FILE FORMAT" in sshd(8) for details.
Certificates are minted using ssh-keygen(1), documentation is in the "CERTIFICATES" section of that manpage.
Documentation on the format of certificates is in the file PROTOCOL.certkeys
feedback and ok markus@
|
Revision tags: OPENBSD_4_5_BASE OPENBSD_4_6_BASE
|
#
1.4 |
|
10-Dec-2008 |
stevesk |
o cannot be NULL here but use xfree() to be consistent; ok djm@
|
Revision tags: OPENBSD_4_4_BASE
|
#
1.3 |
|
10-Jun-2008 |
djm |
support CIDR address matching in .ssh/authorized_keys from="..." stanzas
ok and extensive testing dtucker@
|
#
1.2 |
|
10-Jun-2008 |
djm |
fix fatal() when performing address matching and connection is not on socket; spotted by & ok dtucker@
|
#
1.1 |
|
10-Jun-2008 |
djm |
support CIDR address matching in sshd_config "Match address" blocks, with full support for negation and fall-back to classic wildcard matching. For example:
Match address 192.0.2.0/24,3ffe:ffff::/32,!10.* PasswordAuthentication yes
addrmatch.c code mostly lifted from flowd's addr.c
feedback and ok dtucker@
|
#
1.16 |
|
09-Jan-2021 |
dtucker |
Move address handling functions out into their own file in order to reuse them for per-source maxstartups limiting. Supplement with some additional functions from djm's flowtools that we'll also need. ok djm@ (as part of a larger diff).
|
#
1.15 |
|
18-Oct-2020 |
djm |
use the new variant log macros instead of prepending __func__ and appending ssh_err(r) manually; ok markus@
|
Revision tags: OPENBSD_6_4_BASE OPENBSD_6_5_BASE OPENBSD_6_6_BASE OPENBSD_6_7_BASE OPENBSD_6_8_BASE
|
#
1.14 |
|
31-Jul-2018 |
djm |
fix some memory leaks spotted by Coverity via Jakub Jelen in bz#2366 feedback and ok dtucker@
|
Revision tags: OPENBSD_6_1_BASE OPENBSD_6_2_BASE OPENBSD_6_3_BASE
|
#
1.13 |
|
21-Sep-2016 |
djm |
Revert two recent changes to negated address matching. The new behaviour offers unintuitive surprises. We'll find a better way to deal with single negated matches.
match.c 1.31: > fix matching for pattern lists that contain a single negated match, > e.g. "Host !example" > > report and patch from Robin Becker. bz#1918 ok dtucker@
addrmatch.c 1.11: > fix negated address matching where the address list consists of a > single negated match, e.g. "Match addr !192.20.0.1" > > Report and patch from Jakub Jelen. bz#2397 ok dtucker@
|
#
1.12 |
|
23-Aug-2016 |
djm |
downgrade an error() to a debug2() to match similar cases in addr_match_list()
|
#
1.11 |
|
23-Aug-2016 |
djm |
fix negated address matching where the address list consists of a single negated match, e.g. "Match addr !192.20.0.1"
Report and patch from Jakub Jelen. bz#2397 ok dtucker@
|
Revision tags: OPENBSD_5_8_BASE OPENBSD_5_9_BASE OPENBSD_6_0_BASE
|
#
1.10 |
|
08-Jul-2015 |
markus |
xmalloc.h is unused
|
Revision tags: OPENBSD_5_5_BASE OPENBSD_5_6_BASE OPENBSD_5_7_BASE
|
#
1.9 |
|
19-Jan-2014 |
dtucker |
Cast the sizeof to socklen_t so it'll work even if the supplied len is negative. Suggested by and ok djm, ok deraadt.
|
#
1.8 |
|
19-Jan-2014 |
dtucker |
Cast socklen_t when comparing to size_t and use socklen_t to iterate over the ip options, both to prevent signed/unsigned comparison warnings. Patch from vinschen at redhat via portable openssh, begrudging ok deraadt.
|
Revision tags: OPENBSD_5_4_BASE
|
#
1.7 |
|
17-May-2013 |
djm |
bye, bye xfree(); ok markus@
|
Revision tags: OPENBSD_5_2_BASE OPENBSD_5_3_BASE
|
#
1.6 |
|
21-Jun-2012 |
dtucker |
fix strlcpy truncation check. from carsten at debian org, ok markus
|
Revision tags: OPENBSD_4_7_BASE OPENBSD_4_8_BASE OPENBSD_4_9_BASE OPENBSD_5_0_BASE OPENBSD_5_1_BASE
|
#
1.5 |
|
26-Feb-2010 |
djm |
Add support for certificate key types for users and hosts.
OpenSSH certificate key types are not X.509 certificates, but a much simpler format that encodes a public key, identity information and some validity constraints and signs it with a CA key. CA keys are regular SSH keys. This certificate style avoids the attack surface of X.509 certificates and is very easy to deploy.
Certified host keys allow automatic acceptance of new host keys when a CA certificate is marked as trusted in ~/.ssh/known_hosts. see VERIFYING HOST KEYS in ssh(1) for details.
Certified user keys allow authentication of users when the signing CA key is marked as trusted in authorized_keys. See "AUTHORIZED_KEYS FILE FORMAT" in sshd(8) for details.
Certificates are minted using ssh-keygen(1), documentation is in the "CERTIFICATES" section of that manpage.
Documentation on the format of certificates is in the file PROTOCOL.certkeys
feedback and ok markus@
|
Revision tags: OPENBSD_4_5_BASE OPENBSD_4_6_BASE
|
#
1.4 |
|
10-Dec-2008 |
stevesk |
o cannot be NULL here but use xfree() to be consistent; ok djm@
|
Revision tags: OPENBSD_4_4_BASE
|
#
1.3 |
|
10-Jun-2008 |
djm |
support CIDR address matching in .ssh/authorized_keys from="..." stanzas
ok and extensive testing dtucker@
|
#
1.2 |
|
10-Jun-2008 |
djm |
fix fatal() when performing address matching and connection is not on socket; spotted by & ok dtucker@
|
#
1.1 |
|
10-Jun-2008 |
djm |
support CIDR address matching in sshd_config "Match address" blocks, with full support for negation and fall-back to classic wildcard matching. For example:
Match address 192.0.2.0/24,3ffe:ffff::/32,!10.* PasswordAuthentication yes
addrmatch.c code mostly lifted from flowd's addr.c
feedback and ok dtucker@
|
#
1.15 |
|
18-Oct-2020 |
djm |
use the new variant log macros instead of prepending __func__ and appending ssh_err(r) manually; ok markus@
|
Revision tags: OPENBSD_6_4_BASE OPENBSD_6_5_BASE OPENBSD_6_6_BASE OPENBSD_6_7_BASE OPENBSD_6_8_BASE
|
#
1.14 |
|
31-Jul-2018 |
djm |
fix some memory leaks spotted by Coverity via Jakub Jelen in bz#2366 feedback and ok dtucker@
|
Revision tags: OPENBSD_6_1_BASE OPENBSD_6_2_BASE OPENBSD_6_3_BASE
|
#
1.13 |
|
21-Sep-2016 |
djm |
Revert two recent changes to negated address matching. The new behaviour offers unintuitive surprises. We'll find a better way to deal with single negated matches.
match.c 1.31: > fix matching for pattern lists that contain a single negated match, > e.g. "Host !example" > > report and patch from Robin Becker. bz#1918 ok dtucker@
addrmatch.c 1.11: > fix negated address matching where the address list consists of a > single negated match, e.g. "Match addr !192.20.0.1" > > Report and patch from Jakub Jelen. bz#2397 ok dtucker@
|
#
1.12 |
|
23-Aug-2016 |
djm |
downgrade an error() to a debug2() to match similar cases in addr_match_list()
|
#
1.11 |
|
23-Aug-2016 |
djm |
fix negated address matching where the address list consists of a single negated match, e.g. "Match addr !192.20.0.1"
Report and patch from Jakub Jelen. bz#2397 ok dtucker@
|
Revision tags: OPENBSD_5_8_BASE OPENBSD_5_9_BASE OPENBSD_6_0_BASE
|
#
1.10 |
|
08-Jul-2015 |
markus |
xmalloc.h is unused
|
Revision tags: OPENBSD_5_5_BASE OPENBSD_5_6_BASE OPENBSD_5_7_BASE
|
#
1.9 |
|
19-Jan-2014 |
dtucker |
Cast the sizeof to socklen_t so it'll work even if the supplied len is negative. Suggested by and ok djm, ok deraadt.
|
#
1.8 |
|
19-Jan-2014 |
dtucker |
Cast socklen_t when comparing to size_t and use socklen_t to iterate over the ip options, both to prevent signed/unsigned comparison warnings. Patch from vinschen at redhat via portable openssh, begrudging ok deraadt.
|
Revision tags: OPENBSD_5_4_BASE
|
#
1.7 |
|
17-May-2013 |
djm |
bye, bye xfree(); ok markus@
|
Revision tags: OPENBSD_5_2_BASE OPENBSD_5_3_BASE
|
#
1.6 |
|
21-Jun-2012 |
dtucker |
fix strlcpy truncation check. from carsten at debian org, ok markus
|
Revision tags: OPENBSD_4_7_BASE OPENBSD_4_8_BASE OPENBSD_4_9_BASE OPENBSD_5_0_BASE OPENBSD_5_1_BASE
|
#
1.5 |
|
26-Feb-2010 |
djm |
Add support for certificate key types for users and hosts.
OpenSSH certificate key types are not X.509 certificates, but a much simpler format that encodes a public key, identity information and some validity constraints and signs it with a CA key. CA keys are regular SSH keys. This certificate style avoids the attack surface of X.509 certificates and is very easy to deploy.
Certified host keys allow automatic acceptance of new host keys when a CA certificate is marked as trusted in ~/.ssh/known_hosts. see VERIFYING HOST KEYS in ssh(1) for details.
Certified user keys allow authentication of users when the signing CA key is marked as trusted in authorized_keys. See "AUTHORIZED_KEYS FILE FORMAT" in sshd(8) for details.
Certificates are minted using ssh-keygen(1), documentation is in the "CERTIFICATES" section of that manpage.
Documentation on the format of certificates is in the file PROTOCOL.certkeys
feedback and ok markus@
|
Revision tags: OPENBSD_4_5_BASE OPENBSD_4_6_BASE
|
#
1.4 |
|
10-Dec-2008 |
stevesk |
o cannot be NULL here but use xfree() to be consistent; ok djm@
|
Revision tags: OPENBSD_4_4_BASE
|
#
1.3 |
|
10-Jun-2008 |
djm |
support CIDR address matching in .ssh/authorized_keys from="..." stanzas
ok and extensive testing dtucker@
|
#
1.2 |
|
10-Jun-2008 |
djm |
fix fatal() when performing address matching and connection is not on socket; spotted by & ok dtucker@
|
#
1.1 |
|
10-Jun-2008 |
djm |
support CIDR address matching in sshd_config "Match address" blocks, with full support for negation and fall-back to classic wildcard matching. For example:
Match address 192.0.2.0/24,3ffe:ffff::/32,!10.* PasswordAuthentication yes
addrmatch.c code mostly lifted from flowd's addr.c
feedback and ok dtucker@
|
#
1.14 |
|
31-Jul-2018 |
djm |
fix some memory leaks spotted by Coverity via Jakub Jelen in bz#2366 feedback and ok dtucker@
|
Revision tags: OPENBSD_6_1_BASE OPENBSD_6_2_BASE OPENBSD_6_3_BASE
|
#
1.13 |
|
21-Sep-2016 |
djm |
Revert two recent changes to negated address matching. The new behaviour offers unintuitive surprises. We'll find a better way to deal with single negated matches.
match.c 1.31: > fix matching for pattern lists that contain a single negated match, > e.g. "Host !example" > > report and patch from Robin Becker. bz#1918 ok dtucker@
addrmatch.c 1.11: > fix negated address matching where the address list consists of a > single negated match, e.g. "Match addr !192.20.0.1" > > Report and patch from Jakub Jelen. bz#2397 ok dtucker@
|
#
1.12 |
|
23-Aug-2016 |
djm |
downgrade an error() to a debug2() to match similar cases in addr_match_list()
|
#
1.11 |
|
23-Aug-2016 |
djm |
fix negated address matching where the address list consists of a single negated match, e.g. "Match addr !192.20.0.1"
Report and patch from Jakub Jelen. bz#2397 ok dtucker@
|
Revision tags: OPENBSD_5_8_BASE OPENBSD_5_9_BASE OPENBSD_6_0_BASE
|
#
1.10 |
|
08-Jul-2015 |
markus |
xmalloc.h is unused
|
Revision tags: OPENBSD_5_5_BASE OPENBSD_5_6_BASE OPENBSD_5_7_BASE
|
#
1.9 |
|
19-Jan-2014 |
dtucker |
Cast the sizeof to socklen_t so it'll work even if the supplied len is negative. Suggested by and ok djm, ok deraadt.
|
#
1.8 |
|
19-Jan-2014 |
dtucker |
Cast socklen_t when comparing to size_t and use socklen_t to iterate over the ip options, both to prevent signed/unsigned comparison warnings. Patch from vinschen at redhat via portable openssh, begrudging ok deraadt.
|
Revision tags: OPENBSD_5_4_BASE
|
#
1.7 |
|
17-May-2013 |
djm |
bye, bye xfree(); ok markus@
|
Revision tags: OPENBSD_5_2_BASE OPENBSD_5_3_BASE
|
#
1.6 |
|
21-Jun-2012 |
dtucker |
fix strlcpy truncation check. from carsten at debian org, ok markus
|
Revision tags: OPENBSD_4_7_BASE OPENBSD_4_8_BASE OPENBSD_4_9_BASE OPENBSD_5_0_BASE OPENBSD_5_1_BASE
|
#
1.5 |
|
26-Feb-2010 |
djm |
Add support for certificate key types for users and hosts.
OpenSSH certificate key types are not X.509 certificates, but a much simpler format that encodes a public key, identity information and some validity constraints and signs it with a CA key. CA keys are regular SSH keys. This certificate style avoids the attack surface of X.509 certificates and is very easy to deploy.
Certified host keys allow automatic acceptance of new host keys when a CA certificate is marked as trusted in ~/.ssh/known_hosts. see VERIFYING HOST KEYS in ssh(1) for details.
Certified user keys allow authentication of users when the signing CA key is marked as trusted in authorized_keys. See "AUTHORIZED_KEYS FILE FORMAT" in sshd(8) for details.
Certificates are minted using ssh-keygen(1), documentation is in the "CERTIFICATES" section of that manpage.
Documentation on the format of certificates is in the file PROTOCOL.certkeys
feedback and ok markus@
|
Revision tags: OPENBSD_4_5_BASE OPENBSD_4_6_BASE
|
#
1.4 |
|
10-Dec-2008 |
stevesk |
o cannot be NULL here but use xfree() to be consistent; ok djm@
|
Revision tags: OPENBSD_4_4_BASE
|
#
1.3 |
|
10-Jun-2008 |
djm |
support CIDR address matching in .ssh/authorized_keys from="..." stanzas
ok and extensive testing dtucker@
|
#
1.2 |
|
10-Jun-2008 |
djm |
fix fatal() when performing address matching and connection is not on socket; spotted by & ok dtucker@
|
#
1.1 |
|
10-Jun-2008 |
djm |
support CIDR address matching in sshd_config "Match address" blocks, with full support for negation and fall-back to classic wildcard matching. For example:
Match address 192.0.2.0/24,3ffe:ffff::/32,!10.* PasswordAuthentication yes
addrmatch.c code mostly lifted from flowd's addr.c
feedback and ok dtucker@
|
Revision tags: OPENBSD_6_1_BASE OPENBSD_6_2_BASE
|
#
1.13 |
|
21-Sep-2016 |
djm |
Revert two recent changes to negated address matching. The new behaviour offers unintuitive surprises. We'll find a better way to deal with single negated matches.
match.c 1.31: > fix matching for pattern lists that contain a single negated match, > e.g. "Host !example" > > report and patch from Robin Becker. bz#1918 ok dtucker@
addrmatch.c 1.11: > fix negated address matching where the address list consists of a > single negated match, e.g. "Match addr !192.20.0.1" > > Report and patch from Jakub Jelen. bz#2397 ok dtucker@
|
#
1.12 |
|
23-Aug-2016 |
djm |
downgrade an error() to a debug2() to match similar cases in addr_match_list()
|
#
1.11 |
|
23-Aug-2016 |
djm |
fix negated address matching where the address list consists of a single negated match, e.g. "Match addr !192.20.0.1"
Report and patch from Jakub Jelen. bz#2397 ok dtucker@
|
Revision tags: OPENBSD_5_8_BASE OPENBSD_5_9_BASE OPENBSD_6_0_BASE
|
#
1.10 |
|
08-Jul-2015 |
markus |
xmalloc.h is unused
|
Revision tags: OPENBSD_5_5_BASE OPENBSD_5_6_BASE OPENBSD_5_7_BASE
|
#
1.9 |
|
19-Jan-2014 |
dtucker |
Cast the sizeof to socklen_t so it'll work even if the supplied len is negative. Suggested by and ok djm, ok deraadt.
|
#
1.8 |
|
19-Jan-2014 |
dtucker |
Cast socklen_t when comparing to size_t and use socklen_t to iterate over the ip options, both to prevent signed/unsigned comparison warnings. Patch from vinschen at redhat via portable openssh, begrudging ok deraadt.
|
Revision tags: OPENBSD_5_4_BASE
|
#
1.7 |
|
17-May-2013 |
djm |
bye, bye xfree(); ok markus@
|
Revision tags: OPENBSD_5_2_BASE OPENBSD_5_3_BASE
|
#
1.6 |
|
21-Jun-2012 |
dtucker |
fix strlcpy truncation check. from carsten at debian org, ok markus
|
Revision tags: OPENBSD_4_7_BASE OPENBSD_4_8_BASE OPENBSD_4_9_BASE OPENBSD_5_0_BASE OPENBSD_5_1_BASE
|
#
1.5 |
|
26-Feb-2010 |
djm |
Add support for certificate key types for users and hosts.
OpenSSH certificate key types are not X.509 certificates, but a much simpler format that encodes a public key, identity information and some validity constraints and signs it with a CA key. CA keys are regular SSH keys. This certificate style avoids the attack surface of X.509 certificates and is very easy to deploy.
Certified host keys allow automatic acceptance of new host keys when a CA certificate is marked as trusted in ~/.ssh/known_hosts. see VERIFYING HOST KEYS in ssh(1) for details.
Certified user keys allow authentication of users when the signing CA key is marked as trusted in authorized_keys. See "AUTHORIZED_KEYS FILE FORMAT" in sshd(8) for details.
Certificates are minted using ssh-keygen(1), documentation is in the "CERTIFICATES" section of that manpage.
Documentation on the format of certificates is in the file PROTOCOL.certkeys
feedback and ok markus@
|
Revision tags: OPENBSD_4_5_BASE OPENBSD_4_6_BASE
|
#
1.4 |
|
10-Dec-2008 |
stevesk |
o cannot be NULL here but use xfree() to be consistent; ok djm@
|
Revision tags: OPENBSD_4_4_BASE
|
#
1.3 |
|
10-Jun-2008 |
djm |
support CIDR address matching in .ssh/authorized_keys from="..." stanzas
ok and extensive testing dtucker@
|
#
1.2 |
|
10-Jun-2008 |
djm |
fix fatal() when performing address matching and connection is not on socket; spotted by & ok dtucker@
|
#
1.1 |
|
10-Jun-2008 |
djm |
support CIDR address matching in sshd_config "Match address" blocks, with full support for negation and fall-back to classic wildcard matching. For example:
Match address 192.0.2.0/24,3ffe:ffff::/32,!10.* PasswordAuthentication yes
addrmatch.c code mostly lifted from flowd's addr.c
feedback and ok dtucker@
|