ChangeLog revision 181110
120061107 2 - (dtucker) [sshd.c] Use privsep_pw if we have it, but only require it 3 if we absolutely need it. Pointed out by Corinna, ok djm@ 4 - (dtucker) OpenBSD CVS Sync 5 - markus@cvs.openbsd.org 2006/11/06 21:25:28 6 [auth-rsa.c kexgexc.c kexdhs.c key.c ssh-dss.c sshd.c kexgexs.c 7 ssh-keygen.c bufbn.c moduli.c scard.c kexdhc.c sshconnect1.c dh.c rsa.c] 8 add missing checks for openssl return codes; with & ok djm@ 9 - markus@cvs.openbsd.org 2006/11/07 10:31:31 10 [monitor.c version.h] 11 correctly check for bad signatures in the monitor, otherwise the monitor 12 and the unpriv process can get out of sync. with dtucker@, ok djm@, 13 dtucker@ 14 - (dtucker) [README contrib/{caldera,redhat,contrib}/openssh.spec] Bump 15 versions. 16 - (dtucker) [dh.c] Type fix for BN_hex2bn; ok markus@ 17 - (dtucker) Release 4.5p1. 18 1920061105 20 - (djm) OpenBSD CVS Sync 21 - otto@cvs.openbsd.org 2006/10/28 18:08:10 22 [ssh.1] 23 correct/expand example of usage of -w; ok jmc@ stevesk@ 24 - markus@cvs.openbsd.org 2006/10/31 16:33:12 25 [kexdhc.c kexdhs.c kexgexc.c kexgexs.c] 26 check DH_compute_key() for -1 even if it should not happen because of 27 earlier calls to dh_pub_is_valid(); report krahmer at suse.de; ok djm 28 2920061101 30 - (dtucker) [openbsd-compat/port-solaris.c] Bug #1255: Make only hwerr 31 events fatal in Solaris process contract support and tell it to signal 32 only processes in the same process group when something happens. 33 Based on information from andrew.benham at thus.net and similar to 34 a patch from Chad Mynhier. ok djm@ 35 3620061027 37- (djm) [auth.c] gc some dead code 38 3920061023 40 - (djm) OpenBSD CVS Sync 41 - ray@cvs.openbsd.org 2006/09/30 17:48:22 42 [sftp.c] 43 Clear errno before calling the strtol functions. 44 From Paul Stoeber <x0001 at x dot de1 dot cc>. 45 OK deraadt@. 46 - djm@cvs.openbsd.org 2006/10/06 02:29:19 47 [ssh-agent.c ssh-keyscan.c ssh.c] 48 sys/resource.h needs sys/time.h; prompted by brad@ 49 (NB. Id sync only for portable) 50 - djm@cvs.openbsd.org 2006/10/09 23:36:11 51 [session.c] 52 xmalloc -> xcalloc that was missed previously, from portable 53 (NB. Id sync only for portable, obviously) 54 - markus@cvs.openbsd.org 2006/10/10 10:12:45 55 [sshconnect.c] 56 sleep before retrying (not after) since sleep changes errno; fixes 57 pr 5250; rad@twig.com; ok dtucker djm 58 - markus@cvs.openbsd.org 2006/10/11 12:38:03 59 [clientloop.c serverloop.c] 60 exit instead of doing a blocking tcp send if we detect a client/server 61 timeout, since the tcp sendqueue might be already full (of alive 62 requests); ok dtucker, report mpf 63 - djm@cvs.openbsd.org 2006/10/22 02:25:50 64 [sftp-client.c] 65 cancel progress meter when upload write fails; ok deraadt@ 66 - (tim) [Makefile.in scard/Makefile.in] Add datarootdir= lines to keep 67 autoconf 2.60 from complaining. 68 6920061018 70 - (dtucker) OpenBSD CVS Sync 71 - ray@cvs.openbsd.org 2006/09/25 04:55:38 72 [ssh-keyscan.1 ssh.1] 73 Change "a SSH" to "an SSH". Hurray, I'm not the only one who 74 pronounces "SSH" as "ess-ess-aich". 75 OK jmc@ and stevesk@. 76 - (dtucker) [sshd.c] Reshuffle storing of pw struct; prevents warnings 77 on older versions of OS X. ok djm@ 78 7920061016 80 - (dtucker) [monitor_fdpass.c] Include sys/in.h, required for cmsg macros 81 on older (2.0) Linuxes. Based on patch from thmo-13 at gmx de. 82 8320061006 84 - (tim) [buildpkg.sh.in] Use uname -r instead of -v in OS_VER for Solaris. 85 Differentiate between OpenServer 5 and OpenServer 6 86 - (dtucker) [configure.ac] Set put -lselinux into $LIBS while testing for 87 SELinux functions so they're detected correctly. Patch from pebenito at 88 gentoo.org. 89 - (tim) [buildpkg.sh.in] Some systems have really limited nawk (OpenServer). 90 Allow setting alternate awk in openssh-config.local. 91 9220061003 93 - (tim) [configure.ac] Move CHECK_HEADERS test before platform specific 94 section so additional platform specific CHECK_HEADER tests will work 95 correctly. Fixes "<net/if_tap.h> on FreeBSD" problem report by des AT des.no 96 Feedback and "seems like a good idea" dtucker@ 97 9820061001 99 - (dtucker) [audit-bsm.c] Include errno.h. Pointed out by des at des.no. 100 10120060929 102 - (dtucker) [configure.ac] Bug #1239: Fix configure test for OpenSSH engine 103 support. Patch from andrew.benham at thus net. 104 10520060928 106 - (dtucker) [entropy.c] Bug #1238: include signal.h to fix compilation error 107 on Solaris 8 w/out /dev/random or prngd. Patch from rl at 108 math.technion.ac.il. 109 11020060926 111 - (dtucker) [bufaux.h] nuke bufaux.h; it's already gone from OpenBSD and not 112 referenced any more. ok djm@ 113 - (dtucker) [sftp-server.8] Resync; spotted by djm@ 114 - (dtucker) Release 4.4p1. 115 11620060924 117 - (tim) [configure.ac] Remove CFLAGS hack for UnixWare 1.x/2.x (added 118 to rev 1.308) to work around broken gcc 2.x header file. 119 12020060923 121 - (dtucker) [configure.ac] Bug #1234: Put opensc libs into $LIBS rather than 122 $LDFLAGS. Patch from vapier at gentoo org. 123 12420060922 125 - (dtucker) [packet.c canohost.c] Include arpa/inet.h for htonl macros on 126 some platforms (eg HP-UX 11.00). From santhi.amirta at gmail com. 127 12820060921 129 - (dtucker) OpenBSD CVS Sync 130 - otto@cvs.openbsd.org 2006/09/19 05:52:23 131 [sftp.c] 132 Use S_IS* macros insted of masking with S_IF* flags. The latter may 133 have multiple bits set, which lead to surprising results. Spotted by 134 Paul Stoeber, more to come. ok millert@ pedro@ jaredy@ djm@ 135 - markus@cvs.openbsd.org 2006/09/19 21:14:08 136 [packet.c] 137 client NULL deref on protocol error; Tavis Ormandy, Google Security Team 138 - (dtucker) [defines.h] Include unistd.h before defining getpgrp; fixes 139 build error on Ultrix. From Bernhard Simon. 140 14120060918 142 - (dtucker) [configure.ac] On AIX, check to see if the compiler will allow 143 macro redefinitions, and if not, remove "-qlanglvl=ansi" from the flags. 144 Allows build out of the box with older VAC and XLC compilers. Found by 145 David Bronder and Bernhard Simon. 146 - (dtucker) [openbsd-compat/port-aix.{c,h}] Reduce scope of includes. 147 Prevents macro redefinition warnings of "RDONLY". 148 14920060916 150 - OpenBSD CVS Sync 151 - djm@cvs.openbsd.org 2006/09/16 19:53:37 152 [deattack.c deattack.h packet.c] 153 limit maximum work performed by the CRC compensation attack detector, 154 problem reported by Tavis Ormandy, Google Security Team; 155 ok markus@ deraadt@ 156 - (djm) Add openssh.xml to .cvsignore and sort it 157 - (dtucker) [auth-pam.c] Propogate TZ environment variable to PAM auth 158 process so that any logging it does is with the right timezone. From 159 Scott Strickler, ok djm@. 160 - (dtucker) [monitor.c] Correctly handle auditing of single commands when 161 using Protocol 1. From jhb at freebsd. 162 - (djm) [sshd.c] Fix warning/API abuse; ok dtucker@ 163 - (dtucker) [INSTALL] Add info about audit support. 164 16520060912 166 - (djm) [Makefile.in buildpkg.sh.in configure.ac openssh.xml.in] 167 Support SMF in Solaris Packages if enabled by configure. Patch from 168 Chad Mynhier, tested by dtucker@ 169 17020060911 171 - (dtucker) [cipher-aes.c] Include string.h for memcpy and friends. Noted 172 by Pekka Savola. 173 17420060910 175 - (dtucker) [contrib/aix/buildbff.sh] Ensure that perl is available. 176 - (dtucker) [configure.ac] Add -lcrypt to let DragonFly build OOTB. 177 17820060909 179 - (dtucker) [openbsd-compat/bsd-snprintf.c] Add stdarg.h. 180 - (dtucker) [contrib/aix/buildbff.sh] Always create privsep user. 181 - (dtucker) [buildpkg.sh.in] Always create privsep user. ok djm@ 182 18320060908 184 - (dtucker) [auth-sia.c] Add includes required for build on Tru64. Patch 185 from Chris Adams. 186 - (dtucker) [configure.ac] The BSM header test needs time.h in some cases. 187 18820060907 189 - (djm) [sshd.c auth.c] Set up fakepw() with privsep uid/gid, so it can 190 be used to drop privilege to; fixes Solaris GSSAPI crash reported by 191 Magnus Abrante; suggestion and feedback dtucker@ 192 NB. this change will require that the privilege separation user must 193 exist on all the time, not just when UsePrivilegeSeparation=yes 194 - (tim) [configure.ac] s/BROKEN_UPDWTMP/BROKEN_UPDWTMPX/ on SCO OSR6 195 - (dtucker) [loginrec.c] Wrap paths.h in HAVE_PATHS_H. 196 - (dtucker) [regress/cfgmatch.sh] stop_client is racy, so give us a better 197 chance of winning. 198 19920060905 200 - (dtucker) [configure.ac] s/AC_DEFINES/AC_DEFINE/ spotted by Roumen Petrov. 201 - (dtucker) [loginrec.c] Include paths.h for _PATH_BTMP. 202 20320060904 204 - (dtucker) [configure.ac] Define BROKEN_UPDWTMP on SCO OSR6 as the native 205 updwdtmp seems to generate invalid wtmp entries. From Roger Cornelius, 206 ok djm@ 207 20820060903 209 - (dtucker) [configure.ac openbsd-compat/openbsd-compat.h] Check for 210 declaration of writev(2) and declare it ourselves if necessary. Makes 211 the atomiciov() calls build on really old systems. ok djm@ 212 21320060902 214 - (dtucker) [openbsd-compat/port-irix.c] Add errno.h, found by Iain Morgan. 215 - (dtucker) [ssh-keyscan.c ssh-rand-helper.c ssh.c sshconnect.c 216 openbsd-compat/bindresvport.c openbsd-compat/getrrsetbyname.c 217 openbsd-compat/port-tun.c openbsd-compat/rresvport.c] Include <arpa/inet.h> 218 for hton* and ntoh* macros. Required on (at least) HP-UX since we define 219 _XOPEN_SOURCE_EXTENDED. Found by santhi.amirta at gmail com. 220 22120060901 222 - (djm) [audit-bsm.c audit.c auth-bsdauth.c auth-chall.c auth-pam.c] 223 [auth-rsa.c auth-shadow.c auth-sia.c auth1.c auth2-chall.c] 224 [auth2-gss.c auth2-kbdint.c auth2-none.c authfd.c authfile.c] 225 [cipher-3des1.c cipher-aes.c cipher-bf1.c cipher-ctr.c clientloop.c] 226 [dh.c dns.c entropy.c gss-serv-krb5.c gss-serv.c hostfile.c kex.c] 227 [kexdhc.c kexdhs.c kexgexc.c kexgexs.c key.c loginrec.c mac.c] 228 [md5crypt.c monitor.c monitor_wrap.c readconf.c rsa.c] 229 [scard-opensc.c scard.c session.c ssh-add.c ssh-agent.c ssh-dss.c] 230 [ssh-keygen.c ssh-keysign.c ssh-rsa.c ssh.c sshconnect.c] 231 [sshconnect1.c sshconnect2.c sshd.c] 232 [openbsd-compat/bsd-cray.c openbsd-compat/port-aix.c] 233 [openbsd-compat/port-linux.c openbsd-compat/port-solaris.c] 234 [openbsd-compat/port-uw.c] 235 Lots of headers for SCO OSR6, mainly adding stdarg.h for log.h; 236 compile problems reported by rac AT tenzing.org 237 - (djm) [includes.h monitor.c openbsd-compat/bindresvport.c] 238 [openbsd-compat/rresvport.c] Some more headers: netinet/in.h 239 sys/socket.h and unistd.h in various places 240 - (dtucker) [openbsd-compat/bsd-cygwin_util.c] Fix implict declaration 241 warnings for binary_open and binary_close. Patch from Corinna Vinschen. 242 - (dtucker) [configure.ac includes.h openbsd-compat/glob.{c,h}] Explicitly 243 test for GLOB_NOMATCH and use our glob functions if it's not found. 244 Stops sftp from segfaulting when attempting to get a nonexistent file on 245 Cygwin (previous versions of OpenSSH didn't use the native glob). Partly 246 from and tested by Corinna Vinschen. 247 - (dtucker) [README contrib/{caldera,redhat,suse}/openssh.spec] Crank 248 versions. 249 25020060831 251 - (djm) [CREDITS LICENCE Makefile.in auth.c configure.ac includes.h ] 252 [platform.c platform.h sshd.c openbsd-compat/Makefile.in] 253 [openbsd-compat/openbsd-compat.h openbsd-compat/port-solaris.c] 254 [openbsd-compat/port-solaris.h] Add support for Solaris process 255 contracts, enabled with --use-solaris-contracts. Patch from Chad 256 Mynhier, tweaked by dtucker@ and myself; ok dtucker@ 257 - (dtucker) [contrib/cygwin/ssh-host-config] Add SeTcbPrivilege privilege 258 while setting up the ssh service account. Patch from Corinna Vinschen. 259 26020060830 261 - (djm) OpenBSD CVS Sync 262 - dtucker@cvs.openbsd.org 2006/08/21 08:14:01 263 [sshd_config.5] 264 Document HostbasedUsesNameFromPacketOnly. Corrections from jmc@, 265 ok jmc@ djm@ 266 - dtucker@cvs.openbsd.org 2006/08/21 08:15:57 267 [sshd.8] 268 Add more detail about what permissions are and aren't accepted for 269 authorized_keys files. Corrections jmc@, ok djm@, "looks good" jmc@ 270 - djm@cvs.openbsd.org 2006/08/29 10:40:19 271 [channels.c session.c] 272 normalise some inconsistent (but harmless) NULL pointer checks 273 spotted by the Stanford SATURN tool, via Isil Dillig; 274 ok markus@ deraadt@ 275 - dtucker@cvs.openbsd.org 2006/08/29 12:02:30 276 [gss-genr.c] 277 Work around a problem in Heimdal that occurs when KRB5CCNAME file is 278 missing, by checking whether or not kerberos allocated us a context 279 before attempting to free it. Patch from Simon Wilkinson, tested by 280 biorn@, ok djm@ 281 - dtucker@cvs.openbsd.org 2006/08/30 00:06:51 282 [sshconnect2.c] 283 Fix regression where SSH2 banner is printed at loglevels ERROR and FATAL 284 where previously it weren't. bz #1221, found by Dean Kopesky, ok djm@ 285 - djm@cvs.openbsd.org 2006/08/30 00:14:37 286 [version.h] 287 crank to 4.4 288 - (djm) [openbsd-compat/xcrypt.c] needs unistd.h 289 - (dtucker) [auth.c openbsd-compat/port-aix.c] Bug #1207: always call 290 loginsuccess on AIX immediately after authentication to clear the failed 291 login count. Previously this would only happen when an interactive 292 session starts (ie when a pty is allocated) but this means that accounts 293 that have primarily non-interactive sessions (eg scp's) may gradually 294 accumulate enough failures to lock out an account. This change may have 295 a side effect of creating two audit records, one with a tty of "ssh" 296 corresponding to the authentication and one with the allocated pty per 297 interactive session. 298 29920060824 300 - (dtucker) [openbsd-compat/basename.c] Include errno.h. 301 - (dtucker) [openbsd-compat/bsd-misc.c] Add includes needed for select(2) on 302 older systems. 303 - (dtucker) [openbsd-compat/bsd-misc.c] Include <sys/select.h> for select(2) 304 on POSIX systems. 305 - (dtucker) [openbsd-compat/bsd-openpty.c] Include for ioctl(2). 306 - (dtucker) [openbsd-compat/rresvport.c] Include <stdlib.h> for malloc. 307 - (dtucker) [openbsd-compat/xmmap.c] Move #define HAVE_MMAP to prevent 308 unused variable warning when we have a broken or missing mmap(2). 309 31020060822 311 - (dtucker) [Makefile.in] Bug #1177: fix incorrect path for sshrc in 312 Makefile. Patch from santhi.amirta at gmail, ok djm. 313 31420060820 315 - (dtucker) [log.c] Move ifdef to prevent unused variable warning. 316 - (dtucker) [configure.ac] Save $LIBS during PAM library tests and restore 317 afterward. Removes the need to mangle $LIBS later to remove -lpam and -ldl. 318 - (dtucker) [configure.ac] Relocate --with-pam parts in preparation for 319 fixing bug #1181. No changes yet. 320 - (dtucker) [configure.ac] Bug #1181: Explicitly test to see if OpenSSL 321 (0.9.8a and presumably newer) requires -ldl to successfully link. 322 - (dtucker) [configure.ac] Remove errant "-". 323 32420060819 325 - (djm) OpenBSD CVS Sync 326 - djm@cvs.openbsd.org 2006/08/18 22:41:29 327 [gss-genr.c] 328 GSSAPI error code should be 0 and not -1; from simon@sxw.org.uk 329 - (dtucker) [openbsd-compat/regress/Makefile.in] Add $(EXEEXT) and add a 330 single rule for the test progs. 331 33220060818 333 - (dtucker) [configure.ac openbsd-compat/bsd-closefrom.c] Resync with 334 closefrom.c from sudo. 335 - (dtucker) [openbsd-compat/bsd-closefrom.c] Comment out rcsid. 336 - (dtucker) [openbsd-compat/regress/snprintftest.c] Newline on error. 337 - (dtucker) [openbsd-compat/regress/Makefile.in] Use implicit rules for the 338 test progs instead; they work better than what we have. 339 - (djm) OpenBSD CVS Sync 340 - stevesk@cvs.openbsd.org 2006/08/06 01:13:32 341 [compress.c monitor.c monitor_wrap.c] 342 "zlib.h" can be <zlib.h>; ok djm@ markus@ 343 - miod@cvs.openbsd.org 2006/08/12 20:46:46 344 [monitor.c monitor_wrap.c] 345 Revert previous include file ordering change, for ssh to compile under 346 gcc2 (or until openssl include files are cleaned of parameter names 347 in function prototypes) 348 - dtucker@cvs.openbsd.org 2006/08/14 12:40:25 349 [servconf.c servconf.h sshd_config.5] 350 Add ability to match groups to Match keyword in sshd_config. Feedback 351 djm@, stevesk@, ok stevesk@. 352 - djm@cvs.openbsd.org 2006/08/16 11:47:15 353 [sshd.c] 354 factor inetd connection, TCP listen and main TCP accept loop out of 355 main() into separate functions to improve readability; ok markus@ 356 - deraadt@cvs.openbsd.org 2006/08/18 09:13:26 357 [log.c log.h sshd.c] 358 make signal handler termination path shorter; risky code pointed out by 359 mark dowd; ok djm markus 360 - markus@cvs.openbsd.org 2006/08/18 09:15:20 361 [auth.h session.c sshd.c] 362 delay authentication related cleanups until we're authenticated and 363 all alarms have been cancelled; ok deraadt 364 - djm@cvs.openbsd.org 2006/08/18 10:27:16 365 [misc.h] 366 reorder so prototypes are sorted by the files they refer to; no 367 binary change 368 - djm@cvs.openbsd.org 2006/08/18 13:54:54 369 [gss-genr.c ssh-gss.h sshconnect2.c] 370 bz #1218 - disable SPNEGO as per RFC4462; diff from simon AT sxw.org.uk 371 ok markus@ 372 - djm@cvs.openbsd.org 2006/08/18 14:40:34 373 [gss-genr.c ssh-gss.h] 374 constify host argument to match the rest of the GSSAPI functions and 375 unbreak compilation with -Werror 376 - (djm) Disable sigdie() for platforms that cannot safely syslog inside 377 a signal handler (basically all of them, excepting OpenBSD); 378 ok dtucker@ 379 38020060817 381 - (dtucker) [openbsd-compat/fake-rfc2553.c openbsd-compat/setproctitle.c] 382 Include stdlib.h for malloc and friends. 383 - (dtucker) [configure.ac openbsd-compat/bsd-closefrom.c] Use F_CLOSEM fcntl 384 for closefrom() on AIX. Pointed out by William Ahern. 385 - (dtucker) [openbsd-compat/regress/{Makefile.in,closefromtest.c}] Regress 386 test for closefrom() in compat code. 387 38820060816 389 - (djm) [audit-bsm.c] Sprinkle in some headers 390 39120060815 392 - (dtucker) [LICENCE] Add Reyk to the list for the compat dir. 393 39420060806 395 - (djm) [openbsd-compat/bsd-getpeereid.c] Add some headers to quiet warnings 396 on Solaris 10 397 39820060806 399 - (dtucker) [defines.h] With the includes.h changes we no longer get the 400 name clash on "YES" so we can remove the workaround for it. 401 - (dtucker) [openbsd-compat/{bsd-asprintf.c,bsd-openpty.c,bsd-snprintf.c, 402 glob.c}] Include stdlib.h for malloc and friends in compat code. 403 40420060805 405 - (djm) OpenBSD CVS Sync 406 - stevesk@cvs.openbsd.org 2006/07/24 13:58:22 407 [sshconnect.c] 408 disable tunnel forwarding when no strict host key checking 409 and key changed; ok djm@ markus@ dtucker@ 410 - stevesk@cvs.openbsd.org 2006/07/25 02:01:34 411 [scard.c] 412 need #include <string.h> 413 - stevesk@cvs.openbsd.org 2006/07/25 02:59:21 414 [channels.c clientloop.c packet.c scp.c serverloop.c sftp-client.c] 415 [sftp-server.c ssh-agent.c ssh-keyscan.c sshconnect.c sshd.c] 416 move #include <sys/time.h> out of includes.h 417 - stevesk@cvs.openbsd.org 2006/07/26 02:35:17 418 [atomicio.c auth.c dh.c authfile.c buffer.c clientloop.c kex.c] 419 [groupaccess.c gss-genr.c kexgexs.c misc.c monitor.c monitor_mm.c] 420 [packet.c scp.c serverloop.c session.c sftp-client.c sftp-common.c] 421 [sftp-server.c sftp.c ssh-add.c ssh-agent.c ssh-keygen.c sshlogin.c] 422 [uidswap.c xmalloc.c] 423 move #include <sys/param.h> out of includes.h 424 - stevesk@cvs.openbsd.org 2006/07/26 13:57:17 425 [authfd.c authfile.c dh.c canohost.c channels.c clientloop.c compat.c] 426 [hostfile.c kex.c log.c misc.c moduli.c monitor.c packet.c readpass.c] 427 [scp.c servconf.c session.c sftp-server.c sftp.c ssh-add.c ssh-agent.c] 428 [ssh-keygen.c ssh-keyscan.c ssh-keysign.c ssh.c sshconnect.c] 429 [sshconnect1.c sshd.c xmalloc.c] 430 move #include <stdlib.h> out of includes.h 431 - jmc@cvs.openbsd.org 2006/07/27 08:00:50 432 [ssh_config.5] 433 avoid confusing wording in HashKnownHosts: 434 originally spotted by alan amesbury; 435 ok deraadt 436 - jmc@cvs.openbsd.org 2006/07/27 08:00:50 437 [ssh_config.5] 438 avoid confusing wording in HashKnownHosts: 439 originally spotted by alan amesbury; 440 ok deraadt 441 - dtucker@cvs.openbsd.org 2006/08/01 11:34:36 442 [sshconnect.c] 443 Allow fallback to known_hosts entries without port qualifiers for 444 non-standard ports too, so that all existing known_hosts entries will be 445 recognised. Requested by, feedback and ok markus@ 446 - stevesk@cvs.openbsd.org 2006/08/01 23:22:48 447 [auth-passwd.c auth-rhosts.c auth-rsa.c auth.c auth.h auth1.c] 448 [auth2-chall.c auth2-pubkey.c authfile.c buffer.c canohost.c] 449 [channels.c clientloop.c dh.c dns.c dns.h hostfile.c kex.c kexdhc.c] 450 [kexgexc.c kexgexs.c key.c key.h log.c misc.c misc.h moduli.c] 451 [monitor_wrap.c packet.c progressmeter.c readconf.c readpass.c scp.c] 452 [servconf.c session.c sftp-client.c sftp-common.c sftp-server.c sftp.c] 453 [ssh-add.c ssh-agent.c ssh-keygen.c ssh-keyscan.c ssh.c sshconnect.c] 454 [sshconnect1.c sshconnect2.c sshd.c sshlogin.c sshtty.c uuencode.c] 455 [uuencode.h xmalloc.c] 456 move #include <stdio.h> out of includes.h 457 - stevesk@cvs.openbsd.org 2006/08/01 23:36:12 458 [authfile.c channels.c progressmeter.c scard.c servconf.c ssh.c] 459 clean extra spaces 460 - deraadt@cvs.openbsd.org 2006/08/03 03:34:42 461 [OVERVIEW atomicio.c atomicio.h auth-bsdauth.c auth-chall.c auth-krb5.c] 462 [auth-options.c auth-options.h auth-passwd.c auth-rh-rsa.c auth-rhosts.c] 463 [auth-rsa.c auth-skey.c auth.c auth.h auth1.c auth2-chall.c auth2-gss.c] 464 [auth2-hostbased.c auth2-kbdint.c auth2-none.c auth2-passwd.c ] 465 [auth2-pubkey.c auth2.c authfd.c authfd.h authfile.c bufaux.c bufbn.c] 466 [buffer.c buffer.h canohost.c channels.c channels.h cipher-3des1.c] 467 [cipher-bf1.c cipher-ctr.c cipher.c cleanup.c clientloop.c compat.c] 468 [compress.c deattack.c dh.c dispatch.c dns.c dns.h fatal.c groupaccess.c] 469 [groupaccess.h gss-genr.c gss-serv-krb5.c gss-serv.c hostfile.c kex.c] 470 [kex.h kexdh.c kexdhc.c kexdhs.c kexgex.c kexgexc.c kexgexs.c key.c] 471 [key.h log.c log.h mac.c match.c md-sha256.c misc.c misc.h moduli.c] 472 [monitor.c monitor_fdpass.c monitor_mm.c monitor_mm.h monitor_wrap.c] 473 [monitor_wrap.h msg.c nchan.c packet.c progressmeter.c readconf.c] 474 [readconf.h readpass.c rsa.c scard.c scard.h scp.c servconf.c servconf.h] 475 [serverloop.c session.c session.h sftp-client.c sftp-common.c] 476 [sftp-common.h sftp-glob.c sftp-server.c sftp.c ssh-add.c ssh-agent.c] 477 [ssh-dss.c ssh-gss.h ssh-keygen.c ssh-keyscan.c ssh-keysign.c ssh-rsa.c] 478 [ssh.c ssh.h sshconnect.c sshconnect.h sshconnect1.c sshconnect2.c] 479 [sshd.c sshlogin.c sshlogin.h sshpty.c sshpty.h sshtty.c ttymodes.c] 480 [uidswap.c uidswap.h uuencode.c uuencode.h xmalloc.c xmalloc.h] 481 [loginrec.c loginrec.h openbsd-compat/port-aix.c openbsd-compat/port-tun.h] 482 almost entirely get rid of the culture of ".h files that include .h files" 483 ok djm, sort of ok stevesk 484 makes the pain stop in one easy step 485 NB. portable commit contains everything *except* removing includes.h, as 486 that will take a fair bit more work as we move headers that are required 487 for portability workarounds to defines.h. (also, this step wasn't "easy") 488 - stevesk@cvs.openbsd.org 2006/08/04 20:46:05 489 [monitor.c session.c ssh-agent.c] 490 spaces 491 - (djm) [auth-pam.c defines.h] Move PAM related bits to auth-pam.c 492 - (djm) [auth-pam.c auth.c bufaux.h entropy.c openbsd-compat/port-tun.c] 493 remove last traces of bufaux.h - it was merged into buffer.h in the big 494 includes.h commit 495 - (djm) [auth.c loginrec.c] Missing netinet/in.h for loginrec 496 - (djm) [openbsd-compat/regress/snprintftest.c] 497 [openbsd-compat/regress/strduptest.c] Add missing includes so they pass 498 compilation with "-Wall -Werror" 499 - (djm) [auth-pam.c auth-shadow.c auth2-none.c cleanup.c sshd.c] 500 [openbsd-compat/port-tun.c openbsd-compat/port-tun.h] Sprinkle more 501 includes for Linux in 502 - (dtucker) [cleanup.c] Need defines.h for __dead. 503 - (dtucker) [auth2-gss.c] We still need the #ifdef GSSAPI in -portable. 504 - (dtucker) [openbsd-compat/{bsd-arc4random.c,port-tun.c,xmmap.c}] Lots of 505 #include stdarg.h, needed for log.h. 506 - (dtucker) [entropy.c] Needs unistd.h too. 507 - (dtucker) [ssh-rand-helper.c] Needs stdarg.h for log.h. 508 - (dtucker) [openbsd-compat/getrrsetbyname.c] Nees stdlib.h for malloc. 509 - (dtucker) [openbsd-compat/strtonum.c] Include stdlib.h for strtoll, 510 otherwise it is implicitly declared as returning an int. 511 - (dtucker) OpenBSD CVS Sync 512 - dtucker@cvs.openbsd.org 2006/08/05 07:52:52 513 [auth2-none.c sshd.c monitor_wrap.c] 514 Add headers required to build with KERBEROS5=no. ok djm@ 515 - dtucker@cvs.openbsd.org 2006/08/05 08:00:33 516 [auth-skey.c] 517 Add headers required to build with -DSKEY. ok djm@ 518 - dtucker@cvs.openbsd.org 2006/08/05 08:28:24 519 [monitor_wrap.c auth-skey.c auth2-chall.c] 520 Zap unused variables in -DSKEY code. ok djm@ 521 - dtucker@cvs.openbsd.org 2006/08/05 08:34:04 522 [packet.c] 523 Typo in comment 524 - (dtucker) [openbsd-compat/bsd-cygwin_util.c] Add headers required to compile 525 on Cygwin. 526 - (dtucker) [openbsd-compat/fake-rfc2553.c] Add headers needed for inet_ntoa. 527 - (dtucker) [auth-skey.c] monitor_wrap.h needs ssh-gss.h. 528 - (dtucker) [audit.c audit.h] Repair headers. 529 - (dtucker) [audit-bsm.c] Add additional headers now required. 530 53120060804 532 - (dtucker) [configure.ac] The "crippled AES" test does not work on recent 533 versions of Solaris, so use AC_LINK_IFELSE to actually link the test program 534 rather than just compiling it. Spotted by dlg@. 535 53620060802 537 - (dtucker) [openbsd-compat/daemon.c] Add unistd.h for fork() prototype. 538 53920060725 540 - (dtucker) [openbsd-compat/xmmap.c] Need fcntl.h for O_RDRW. 541 54220060724 543 - (djm) OpenBSD CVS Sync 544 - jmc@cvs.openbsd.org 2006/07/12 13:39:55 545 [sshd_config.5] 546 - new sentence, new line 547 - s/The the/The/ 548 - kill a bad comma 549 - stevesk@cvs.openbsd.org 2006/07/12 22:28:52 550 [auth-options.c canohost.c channels.c includes.h readconf.c] 551 [servconf.c ssh-keyscan.c ssh.c sshconnect.c sshd.c] 552 move #include <netdb.h> out of includes.h; ok djm@ 553 - stevesk@cvs.openbsd.org 2006/07/12 22:42:32 554 [includes.h ssh.c ssh-rand-helper.c] 555 move #include <stddef.h> out of includes.h 556 - stevesk@cvs.openbsd.org 2006/07/14 01:15:28 557 [monitor_wrap.h] 558 don't need incompletely-typed 'struct passwd' now with 559 #include <pwd.h>; ok markus@ 560 - stevesk@cvs.openbsd.org 2006/07/17 01:31:10 561 [authfd.c authfile.c channels.c cleanup.c clientloop.c groupaccess.c] 562 [includes.h log.c misc.c msg.c packet.c progressmeter.c readconf.c] 563 [readpass.c scp.c servconf.c sftp-client.c sftp-server.c sftp.c] 564 [ssh-add.c ssh-agent.c ssh-keygen.c ssh-keyscan.c ssh-keysign.c ssh.c] 565 [sshconnect.c sshlogin.c sshpty.c uidswap.c] 566 move #include <unistd.h> out of includes.h 567 - dtucker@cvs.openbsd.org 2006/07/17 12:02:24 568 [auth-options.c] 569 Use '\0' rather than 0 to terminates strings; ok djm@ 570 - dtucker@cvs.openbsd.org 2006/07/17 12:06:00 571 [channels.c channels.h servconf.c sshd_config.5] 572 Add PermitOpen directive to sshd_config which is equivalent to the 573 "permitopen" key option. Allows server admin to allow TCP port 574 forwarding only two specific host/port pairs. Useful when combined 575 with Match. 576 If permitopen is used in both sshd_config and a key option, both 577 must allow a given connection before it will be permitted. 578 Note that users can still use external forwarders such as netcat, 579 so to be those must be controlled too for the limits to be effective. 580 Feedback & ok djm@, man page corrections & ok jmc@. 581 - jmc@cvs.openbsd.org 2006/07/18 07:50:40 582 [sshd_config.5] 583 tweak; ok dtucker 584 - jmc@cvs.openbsd.org 2006/07/18 07:56:28 585 [scp.1] 586 replace DIAGNOSTICS with .Ex; 587 - jmc@cvs.openbsd.org 2006/07/18 08:03:09 588 [ssh-agent.1 sshd_config.5] 589 mark up angle brackets; 590 - dtucker@cvs.openbsd.org 2006/07/18 08:22:23 591 [sshd_config.5] 592 Clarify description of Match, with minor correction from jmc@ 593 - stevesk@cvs.openbsd.org 2006/07/18 22:27:55 594 [dh.c] 595 remove unneeded includes; ok djm@ 596 - dtucker@cvs.openbsd.org 2006/07/19 08:56:41 597 [servconf.c sshd_config.5] 598 Add support for X11Forwaring, X11DisplayOffset and X11UseLocalhost to 599 Match. ok djm@ 600 - dtucker@cvs.openbsd.org 2006/07/19 13:07:10 601 [servconf.c servconf.h session.c sshd.8 sshd_config sshd_config.5] 602 Add ForceCommand keyword to sshd_config, equivalent to the "command=" 603 key option, man page entry and example in sshd_config. 604 Feedback & ok djm@, man page corrections & ok jmc@ 605 - stevesk@cvs.openbsd.org 2006/07/20 15:26:15 606 [auth1.c serverloop.c session.c sshconnect2.c] 607 missed some needed #include <unistd.h> when KERBEROS5=no; issue from 608 massimo@cedoc.mo.it 609 - dtucker@cvs.openbsd.org 2006/07/21 12:43:36 610 [channels.c channels.h servconf.c servconf.h sshd_config.5] 611 Make PermitOpen take a list of permitted ports and act more like most 612 other keywords (ie the first match is the effective setting). This 613 also makes it easier to override a previously set PermitOpen. ok djm@ 614 - stevesk@cvs.openbsd.org 2006/07/21 21:13:30 615 [channels.c] 616 more ARGSUSED (lint) for dispatch table-driven functions; ok djm@ 617 - stevesk@cvs.openbsd.org 2006/07/21 21:26:55 618 [progressmeter.c] 619 ARGSUSED for signal handler 620 - stevesk@cvs.openbsd.org 2006/07/22 19:08:54 621 [includes.h moduli.c progressmeter.c scp.c sftp-common.c] 622 [sftp-server.c ssh-agent.c sshlogin.c] 623 move #include <time.h> out of includes.h 624 - stevesk@cvs.openbsd.org 2006/07/22 20:48:23 625 [atomicio.c auth-options.c auth-passwd.c auth-rhosts.c auth-rsa.c] 626 [auth.c auth1.c auth2-chall.c auth2-hostbased.c auth2-passwd.c auth2.c] 627 [authfd.c authfile.c bufaux.c bufbn.c buffer.c canohost.c channels.c] 628 [cipher-3des1.c cipher-bf1.c cipher-ctr.c cipher.c clientloop.c] 629 [compat.c deattack.c dh.c dns.c gss-genr.c gss-serv.c hostfile.c] 630 [includes.h kex.c kexdhc.c kexdhs.c kexgexc.c kexgexs.c key.c log.c] 631 [mac.c match.c md-sha256.c misc.c moduli.c monitor.c monitor_fdpass.c] 632 [monitor_mm.c monitor_wrap.c msg.c nchan.c packet.c rsa.c] 633 [progressmeter.c readconf.c readpass.c scp.c servconf.c serverloop.c] 634 [session.c sftp-client.c sftp-common.c sftp-glob.c sftp-server.c sftp.c] 635 [ssh-add.c ssh-agent.c ssh-dss.c ssh-keygen.c ssh-keyscan.c] 636 [ssh-keysign.c ssh-rsa.c ssh.c sshconnect.c sshconnect1.c sshconnect2.c] 637 [sshd.c sshlogin.c sshpty.c ttymodes.c uidswap.c xmalloc.c] 638 move #include <string.h> out of includes.h 639 - stevesk@cvs.openbsd.org 2006/07/23 01:11:05 640 [auth.h dispatch.c kex.h sftp-client.c] 641 #include <signal.h> for sig_atomic_t; need this prior to <sys/param.h> 642 move 643 - (djm) [acss.c auth-krb5.c auth-options.c auth-pam.c auth-shadow.c] 644 [canohost.c channels.c cipher-acss.c defines.h dns.c gss-genr.c] 645 [gss-serv-krb5.c gss-serv.c log.h loginrec.c logintest.c readconf.c] 646 [servconf.c ssh-keygen.c ssh-keyscan.c ssh-keysign.c ssh-rand-helper.c] 647 [ssh.c sshconnect.c sshd.c openbsd-compat/bindresvport.c] 648 [openbsd-compat/bsd-arc4random.c openbsd-compat/bsd-misc.c] 649 [openbsd-compat/getrrsetbyname.c openbsd-compat/glob.c] 650 [openbsd-compat/mktemp.c openbsd-compat/port-linux.c] 651 [openbsd-compat/port-tun.c openbsd-compat/readpassphrase.c] 652 [openbsd-compat/setproctitle.c openbsd-compat/xmmap.c] 653 make the portable tree compile again - sprinkle unistd.h and string.h 654 back in. Don't redefine __unused, as it turned out to be used in 655 headers on Linux, and replace its use in auth-pam.c with ARGSUSED 656 - (djm) [openbsd-compat/glob.c] 657 Move get_arg_max() into the ifdef HAVE_GLOB block so that it compiles 658 on OpenBSD (or other platforms with a decent glob implementation) with 659 -Werror 660 - (djm) [uuencode.c] 661 Add resolv.h, is it contains the prototypes for __b64_ntop/__b64_pton on 662 some platforms 663 - (djm) [session.c] 664 fix compile error with -Werror -Wall: 'path' is only used in 665 do_setup_env() if HAVE_LOGIN_CAP is not defined 666 - (djm) [openbsd-compat/basename.c openbsd-compat/bsd-closefrom.c] 667 [openbsd-compat/bsd-cray.c openbsd-compat/bsd-openpty.c] 668 [openbsd-compat/bsd-snprintf.c openbsd-compat/fake-rfc2553.c] 669 [openbsd-compat/port-aix.c openbsd-compat/port-irix.c] 670 [openbsd-compat/rresvport.c] 671 These look to need string.h and/or unistd.h (based on a grep for function 672 names) 673 - (djm) [Makefile.in] 674 Remove generated openbsd-compat/regress/Makefile in distclean target 675 - (djm) [regress/Makefile regress/agent-getpeereid.sh regress/cfgmatch.sh] 676 [regress/cipher-speed.sh regress/forcecommand.sh regress/forwarding.sh] 677 Sync regress tests to -current; include dtucker@'s new cfgmatch and 678 forcecommand tests. Add cipher-speed.sh test (not linked in yet) 679 - (dtucker) [cleanup.c] Since config.h defines _LARGE_FILES on AIX, including 680 system headers before defines.h will cause conflicting definitions. 681 - (dtucker) [regress/forcecommand.sh] Portablize. 682 68320060713 684 - (dtucker) [auth-krb5.c auth-pam.c] Still more errno.h 685 68620060712 687 - (dtucker) [configure.ac defines.h] Only define SHUT_RD (and friends) and 688 O_NONBLOCK if they're really needed. Fixes build errors on HP-UX, old 689 Linuxes and probably more. 690 - (dtucker) [configure.ac] OpenBSD needs <sys/types.h> before <sys/socket.h> 691 for SHUT_RD. 692 - (dtucker) [openbsd-compat/port-tun.c] OpenBSD needs <netinet/in.h> before 693 <netinet/ip.h>. 694 - (dtucker) OpenBSD CVS Sync 695 - stevesk@cvs.openbsd.org 2006/07/10 16:01:57 696 [sftp-glob.c sftp-common.h sftp.c] 697 buffer.h only needed in sftp-common.h and remove some unneeded 698 user includes; ok djm@ 699 - jmc@cvs.openbsd.org 2006/07/10 16:04:21 700 [sshd.8] 701 s/and and/and/ 702 - stevesk@cvs.openbsd.org 2006/07/10 16:37:36 703 [readpass.c log.h scp.c fatal.c xmalloc.c includes.h ssh-keyscan.c misc.c 704 auth.c packet.c log.c] 705 move #include <stdarg.h> out of includes.h; ok markus@ 706 - dtucker@cvs.openbsd.org 2006/07/11 10:12:07 707 [ssh.c] 708 Only copy the part of environment variable that we actually use. Prevents 709 ssh bailing when SendEnv is used and an environment variable with a really 710 long value exists. ok djm@ 711 - markus@cvs.openbsd.org 2006/07/11 18:50:48 712 [clientloop.c ssh.1 ssh.c channels.c ssh_config.5 readconf.h session.c 713 channels.h readconf.c] 714 add ExitOnForwardFailure: terminate the connection if ssh(1) 715 cannot set up all requested dynamic, local, and remote port 716 forwardings. ok djm, dtucker, stevesk, jmc 717 - stevesk@cvs.openbsd.org 2006/07/11 20:07:25 718 [scp.c auth.c monitor.c serverloop.c sftp-server.c sshpty.c readpass.c 719 sshd.c monitor_wrap.c monitor_fdpass.c ssh-agent.c ttymodes.c atomicio.c 720 includes.h session.c sshlogin.c monitor_mm.c packet.c sshconnect2.c 721 sftp-client.c nchan.c clientloop.c sftp.c misc.c canohost.c channels.c 722 ssh-keygen.c progressmeter.c uidswap.c msg.c readconf.c sshconnect.c] 723 move #include <errno.h> out of includes.h; ok markus@ 724 - stevesk@cvs.openbsd.org 2006/07/11 20:16:43 725 [ssh.c] 726 cast asterisk field precision argument to int to remove warning; 727 ok markus@ 728 - stevesk@cvs.openbsd.org 2006/07/11 20:27:56 729 [authfile.c ssh.c] 730 need <errno.h> here also (it's also included in <openssl/err.h>) 731 - dtucker@cvs.openbsd.org 2006/07/12 11:34:58 732 [sshd.c servconf.h servconf.c sshd_config.5 auth.c] 733 Add support for conditional directives to sshd_config via a "Match" 734 keyword, which works similarly to the "Host" directive in ssh_config. 735 Lines after a Match line override the default set in the main section 736 if the condition on the Match line is true, eg 737 AllowTcpForwarding yes 738 Match User anoncvs 739 AllowTcpForwarding no 740 will allow port forwarding by all users except "anoncvs". 741 Currently only a very small subset of directives are supported. 742 ok djm@ 743 - (dtucker) [loginrec.c openbsd-compat/xmmap.c openbsd-compat/bindresvport.c 744 openbsd-compat/glob.c openbsd-compat/mktemp.c openbsd-compat/port-tun.c 745 openbsd-compat/readpassphrase.c openbsd-compat/strtonum.c] Include <errno.h>. 746 - (dtucker) [openbsd-compat/setproctitle.c] Include stdarg.h. 747 - (dtucker) [ssh-keyscan.c ssh-rand-helper.c] More errno.h here too. 748 - (dtucker) [openbsd-compat/openbsd-compat.h] v*printf needs stdarg.h. 749 - (dtucker) [openbsd-compat/bsd-asprintf.c openbsd-compat/port-aix.c 750 openbsd-compat/rresvport.c] More errno.h. 751 75220060711 753 - (dtucker) [configure.ac ssh-keygen.c openbsd-compat/bsd-openpty.c 754 openbsd-compat/daemon.c] Add includes needed by open(2). Conditionally 755 include paths.h. Fixes build error on Solaris. 756 - (dtucker) [entropy.c] More fcntl.h, this time on AIX (and probably 757 others). 758 75920060710 760 - (dtucker) [INSTALL] New autoconf version: 2.60. 761 - OpenBSD CVS Sync 762 - djm@cvs.openbsd.org 2006/06/14 10:50:42 763 [sshconnect.c] 764 limit the number of pre-banner characters we will accept; ok markus@ 765 - djm@cvs.openbsd.org 2006/06/26 10:36:15 766 [clientloop.c] 767 mention optional bind_address in runtime port forwarding setup 768 command-line help. patch from santhi.amirta AT gmail.com 769 - stevesk@cvs.openbsd.org 2006/07/02 17:12:58 770 [ssh.1 ssh.c ssh_config.5 sshd_config.5] 771 more details and clarity for tun(4) device forwarding; ok and help 772 jmc@ 773 - stevesk@cvs.openbsd.org 2006/07/02 18:36:47 774 [gss-serv-krb5.c gss-serv.c] 775 no "servconf.h" needed here 776 (gss-serv-krb5.c change not applied, portable needs the server options) 777 - stevesk@cvs.openbsd.org 2006/07/02 22:45:59 778 [groupaccess.c groupaccess.h includes.h session.c sftp-common.c sshpty.c] 779 move #include <grp.h> out of includes.h 780 (portable needed uidswap.c too) 781 - stevesk@cvs.openbsd.org 2006/07/02 23:01:55 782 [clientloop.c ssh.1] 783 use -KR[bind_address:]port here; ok djm@ 784 - stevesk@cvs.openbsd.org 2006/07/03 08:54:20 785 [includes.h ssh.c sshconnect.c sshd.c] 786 move #include "version.h" out of includes.h; ok markus@ 787 - stevesk@cvs.openbsd.org 2006/07/03 17:59:32 788 [channels.c includes.h] 789 move #include <arpa/inet.h> out of includes.h; old ok djm@ 790 (portable needed session.c too) 791 - stevesk@cvs.openbsd.org 2006/07/05 02:42:09 792 [canohost.c hostfile.c includes.h misc.c packet.c readconf.c] 793 [serverloop.c sshconnect.c uuencode.c] 794 move #include <netinet/in.h> out of includes.h; ok deraadt@ 795 (also ssh-rand-helper.c logintest.c loginrec.c) 796 - djm@cvs.openbsd.org 2006/07/06 10:47:05 797 [servconf.c servconf.h session.c sshd_config.5] 798 support arguments to Subsystem commands; ok markus@ 799 - djm@cvs.openbsd.org 2006/07/06 10:47:57 800 [sftp-server.8 sftp-server.c] 801 add commandline options to enable logging of transactions; ok markus@ 802 - stevesk@cvs.openbsd.org 2006/07/06 16:03:53 803 [auth-options.c auth-options.h auth-passwd.c auth-rh-rsa.c] 804 [auth-rhosts.c auth-rsa.c auth.c auth.h auth2-hostbased.c] 805 [auth2-pubkey.c auth2.c includes.h misc.c misc.h monitor.c] 806 [monitor_wrap.c monitor_wrap.h scp.c serverloop.c session.c] 807 [session.h sftp-common.c ssh-add.c ssh-keygen.c ssh-keysign.c] 808 [ssh.c sshconnect.c sshconnect.h sshd.c sshpty.c sshpty.h uidswap.c] 809 [uidswap.h] 810 move #include <pwd.h> out of includes.h; ok markus@ 811 - stevesk@cvs.openbsd.org 2006/07/06 16:22:39 812 [ssh-keygen.c] 813 move #include "dns.h" up 814 - stevesk@cvs.openbsd.org 2006/07/06 17:36:37 815 [monitor_wrap.h] 816 typo in comment 817 - stevesk@cvs.openbsd.org 2006/07/08 21:47:12 818 [authfd.c canohost.c clientloop.c dns.c dns.h includes.h] 819 [monitor_fdpass.c nchan.c packet.c servconf.c sftp.c ssh-agent.c] 820 [ssh-keyscan.c ssh.c sshconnect.h sshd.c sshlogin.h] 821 move #include <sys/socket.h> out of includes.h 822 - stevesk@cvs.openbsd.org 2006/07/08 21:48:53 823 [monitor.c session.c] 824 missed these from last commit: 825 move #include <sys/socket.h> out of includes.h 826 - stevesk@cvs.openbsd.org 2006/07/08 23:30:06 827 [log.c] 828 move user includes after /usr/include files 829 - stevesk@cvs.openbsd.org 2006/07/09 15:15:11 830 [auth2-none.c authfd.c authfile.c includes.h misc.c monitor.c] 831 [readpass.c scp.c serverloop.c sftp-client.c sftp-server.c] 832 [ssh-add.c ssh-agent.c ssh-keygen.c ssh-keysign.c ssh.c sshd.c] 833 [sshlogin.c sshpty.c] 834 move #include <fcntl.h> out of includes.h 835 - stevesk@cvs.openbsd.org 2006/07/09 15:27:59 836 [ssh-add.c] 837 use O_RDONLY vs. 0 in open(); no binary change 838 - djm@cvs.openbsd.org 2006/07/10 11:24:54 839 [sftp-server.c] 840 remove optind - it isn't used here 841 - djm@cvs.openbsd.org 2006/07/10 11:25:53 842 [sftp-server.c] 843 don't log variables that aren't yet set 844 - (djm) [loginrec.c ssh-rand-helper.c sshd.c openbsd-compat/glob.c] 845 [openbsd-compat/mktemp.c openbsd-compat/openbsd-compat.h] 846 [openbsd-compat/port-tun.c openbsd-compat/readpassphrase.c] 847 [openbsd-compat/xcrypt.c] Fix includes.h fallout, mainly fcntl.h 848 - OpenBSD CVS Sync 849 - djm@cvs.openbsd.org 2006/07/10 12:03:20 850 [scp.c] 851 duplicate argv at the start of main() because it gets modified later; 852 pointed out by deraadt@ ok markus@ 853 - djm@cvs.openbsd.org 2006/07/10 12:08:08 854 [channels.c] 855 fix misparsing of SOCKS 5 packets that could result in a crash; 856 reported by mk@ ok markus@ 857 - dtucker@cvs.openbsd.org 2006/07/10 12:46:51 858 [misc.c misc.h sshd.8 sshconnect.c] 859 Add port identifier to known_hosts for non-default ports, based originally 860 on a patch from Devin Nate in bz#910. 861 For any connection using the default port or using a HostKeyAlias the 862 format is unchanged, otherwise the host name or address is enclosed 863 within square brackets in the same format as sshd's ListenAddress. 864 Tested by many, ok markus@. 865 - (dtucker) [openbsd-compat/openbsd-compat.h] Need to include <sys/socket.h> 866 for struct sockaddr on platforms that use the fake-rfc stuff. 867 86820060706 869 - (dtucker) [configure.ac] Try AIX blibpath test in different order when 870 compiling with gcc. gcc 4.1.x will accept (but ignore) -b flags so 871 configure would not select the correct libpath linker flags. 872 - (dtucker) [INSTALL] A bit more info on autoconf. 873 87420060705 875 - (dtucker) [ssh-rand-helper.c] Don't exit if mkdir fails because the 876 target already exists. 877 87820060630 879 - (dtucker) [openbsd-compat/openbsd-compat.h] SNPRINTF_CONST for snprintf 880 declaration too. Patch from russ at sludge.net. 881 - (dtucker) [openbsd-compat/getrrsetbyname.c] Undef _res before defining it, 882 prevents warnings on platforms where _res is in the system headers. 883 - (dtucker) [INSTALL] Bug #1202: Note when autoconf is required and which 884 version. 885 88620060627 887 - (dtucker) [configure.ac] Bug #1203: Add missing '[', which causes problems 888 with autoconf 2.60. Patch from vapier at gentoo.org. 889 89020060625 891 - (dtucker) [channels.c serverloop.c] Apply the bug #1102 workaround to ptys 892 only, otherwise sshd can hang exiting non-interactive sessions. 893 89420060624 895 - (dtucker) [configure.ac] Bug #1193: Define PASSWD_NEEDS_USERNAME on Solaris. 896 Works around limitation in Solaris' passwd program for changing passwords 897 where the username is longer than 8 characters. ok djm@ 898 - (dtucker) [serverloop.c] Get ifdef/ifndef the right way around for the bug 899 #1102 workaround. 900 90120060623 902 - (dtucker) [README.platform configure.ac openbsd-compat/port-tun.c] Add 903 tunnel support for Mac OS X/Darwin via a third-party tun driver. Patch 904 from reyk@, tested by anil@ 905 - (dtucker) [channels.c configure.ac serverloop.c] Bug #1102: Around AIX 906 4.3.3 ML3 or so, the AIX pty layer starting passing zero-length writes 907 on the pty slave as zero-length reads on the pty master, which sshd 908 interprets as the descriptor closing. Since most things don't do zero 909 length writes this rarely matters, but occasionally it happens, and when 910 it does the SSH pty session appears to hang, so we add a special case for 911 this condition. ok djm@ 912 91320060613 914 - (djm) [getput.h] This file has been replaced by functions in misc.c 915 - OpenBSD CVS Sync 916 - djm@cvs.openbsd.org 2006/05/08 10:49:48 917 [sshconnect2.c] 918 uint32_t -> u_int32_t (which we use everywhere else) 919 (Id sync only - portable already had this) 920 - markus@cvs.openbsd.org 2006/05/16 09:00:00 921 [clientloop.c] 922 missing free; from Kylene Hall 923 - markus@cvs.openbsd.org 2006/05/17 12:43:34 924 [scp.c sftp.c ssh-agent.c ssh-keygen.c sshconnect.c] 925 fix leak; coverity via Kylene Jo Hall 926 - miod@cvs.openbsd.org 2006/05/18 21:27:25 927 [kexdhc.c kexgexc.c] 928 paramter -> parameter 929 - dtucker@cvs.openbsd.org 2006/05/29 12:54:08 930 [ssh_config.5] 931 Add gssapi-with-mic to PreferredAuthentications default list; ok jmc 932 - dtucker@cvs.openbsd.org 2006/05/29 12:56:33 933 [ssh_config] 934 Add GSSAPIAuthentication and GSSAPIDelegateCredentials to examples in 935 sample ssh_config. ok markus@ 936 - jmc@cvs.openbsd.org 2006/05/29 16:10:03 937 [ssh_config.5] 938 oops - previous was too long; split the list of auths up 939 - mk@cvs.openbsd.org 2006/05/30 11:46:38 940 [ssh-add.c] 941 Sync usage() with man page and reality. 942 ok deraadt dtucker 943 - jmc@cvs.openbsd.org 2006/05/29 16:13:23 944 [ssh.1] 945 add GSSAPI to the list of authentication methods supported; 946 - mk@cvs.openbsd.org 2006/05/30 11:46:38 947 [ssh-add.c] 948 Sync usage() with man page and reality. 949 ok deraadt dtucker 950 - markus@cvs.openbsd.org 2006/06/01 09:21:48 951 [sshd.c] 952 call get_remote_ipaddr() early; fixes logging after client disconnects; 953 report mpf@; ok dtucker@ 954 - markus@cvs.openbsd.org 2006/06/06 10:20:20 955 [readpass.c sshconnect.c sshconnect.h sshconnect2.c uidswap.c] 956 replace remaining setuid() calls with permanently_set_uid() and 957 check seteuid() return values; report Marcus Meissner; ok dtucker djm 958 - markus@cvs.openbsd.org 2006/06/08 14:45:49 959 [readpass.c sshconnect.c sshconnect2.c uidswap.c uidswap.h] 960 do not set the gid, noted by solar; ok djm 961 - djm@cvs.openbsd.org 2006/06/13 01:18:36 962 [ssh-agent.c] 963 always use a format string, even when printing a constant 964 - djm@cvs.openbsd.org 2006/06/13 02:17:07 965 [ssh-agent.c] 966 revert; i am on drugs. spotted by alexander AT beard.se 967 96820060521 969 - (dtucker) [auth.c monitor.c] Now that we don't log from both the monitor 970 and slave, we can remove the special-case handling in the audit hook in 971 auth_log. 972 97320060517 974 - (dtucker) [ssh-rand-helper.c] Check return code of mkdir and fix file 975 pointer leak. From kjhall at us.ibm.com, found by coverity. 976 97720060515 978 - (dtucker) [openbsd-compat/getrrsetbyname.c] Use _compat_res instead of 979 _res, prevents problems on some platforms that have _res as a global but 980 don't have getrrsetbyname(), eg IRIX 5.3. Found and tested by 981 georg.schwarz at freenet.de, ok djm@. 982 - (dtucker) [defines.h] Find a value for IOV_MAX or use a conservative 983 default. Patch originally from tim@, ok djm 984 - (dtucker) [auth-pam.c] Bug #1188: pass result of do_pam_account back and 985 do not allow kbdint again after the PAM account check fails. ok djm@ 986 98720060506 988 - (dtucker) OpenBSD CVS Sync 989 - dtucker@cvs.openbsd.org 2006/04/25 08:02:27 990 [authfile.c authfile.h sshconnect2.c ssh.c sshconnect1.c] 991 Prevent ssh from trying to open private keys with bad permissions more than 992 once or prompting for their passphrases (which it subsequently ignores 993 anyway), similar to a previous change in ssh-add. bz #1186, ok djm@ 994 - djm@cvs.openbsd.org 2006/05/04 14:55:23 995 [dh.c] 996 tighter DH exponent checks here too; feedback and ok markus@ 997 - djm@cvs.openbsd.org 2006/04/01 05:37:46 998 [OVERVIEW] 999 $OpenBSD$ in here too 1000 - dtucker@cvs.openbsd.org 2006/05/06 08:35:40 1001 [auth-krb5.c] 1002 Add $OpenBSD$ in comment here too 1003 100420060504 1005 - (dtucker) [auth-pam.c groupaccess.c monitor.c monitor_wrap.c scard-opensc.c 1006 session.c ssh-rand-helper.c sshd.c openbsd-compat/bsd-cygwin_util.c 1007 openbsd-compat/setproctitle.c] Convert malloc(foo*bar) -> calloc(foo,bar) 1008 in Portable-only code; since calloc zeros, remove now-redundant memsets. 1009 Also add a couple of sanity checks. With & ok djm@ 1010 101120060503 1012 - (dtucker) [packet.c] Remove in_systm.h since it's also in includes.h 1013 and double including it on IRIX 5.3 causes problems. From Georg Schwarz, 1014 "no objections" tim@ 1015 101620060423 1017 - (djm) OpenBSD CVS Sync 1018 - deraadt@cvs.openbsd.org 2006/04/01 05:42:20 1019 [scp.c] 1020 minimal lint cleanup (unused crud, and some size_t); ok djm 1021 - djm@cvs.openbsd.org 2006/04/01 05:50:29 1022 [scp.c] 1023 xasprintification; ok deraadt@ 1024 - djm@cvs.openbsd.org 2006/04/01 05:51:34 1025 [atomicio.c] 1026 ANSIfy; requested deraadt@ 1027 - dtucker@cvs.openbsd.org 2006/04/02 08:34:52 1028 [ssh-keysign.c] 1029 sessionid can be 32 bytes now too when sha256 kex is used; ok djm@ 1030 - djm@cvs.openbsd.org 2006/04/03 07:10:38 1031 [gss-genr.c] 1032 GSSAPI buffers shouldn't be nul-terminated, spotted in bugzilla #1066 1033 by dleonard AT vintela.com. use xasprintf() to simplify code while in 1034 there; "looks right" deraadt@ 1035 - djm@cvs.openbsd.org 2006/04/16 00:48:52 1036 [buffer.c buffer.h channels.c] 1037 Fix condition where we could exit with a fatal error when an input 1038 buffer became too large and the remote end had advertised a big window. 1039 The problem was a mismatch in the backoff math between the channels code 1040 and the buffer code, so make a buffer_check_alloc() function that the 1041 channels code can use to propsectivly check whether an incremental 1042 allocation will succeed. bz #1131, debugged with the assistance of 1043 cove AT wildpackets.com; ok dtucker@ deraadt@ 1044 - djm@cvs.openbsd.org 2006/04/16 00:52:55 1045 [atomicio.c atomicio.h] 1046 introduce atomiciov() function that wraps readv/writev to retry 1047 interrupted transfers like atomicio() does for read/write; 1048 feedback deraadt@ dtucker@ stevesk@ ok deraadt@ 1049 - djm@cvs.openbsd.org 2006/04/16 00:54:10 1050 [sftp-client.c] 1051 avoid making a tiny 4-byte write to send the packet length of sftp 1052 commands, which would result in a separate tiny packet on the wire by 1053 using atomiciov(writev, ...) to write the length and the command in one 1054 pass; ok deraadt@ 1055 - djm@cvs.openbsd.org 2006/04/16 07:59:00 1056 [atomicio.c] 1057 reorder sanity test so that it cannot dereference past the end of the 1058 iov array; well spotted canacar@! 1059 - dtucker@cvs.openbsd.org 2006/04/18 10:44:28 1060 [bufaux.c bufbn.c Makefile.in] 1061 Move Buffer bignum functions into their own file, bufbn.c. This means 1062 that sftp and sftp-server (which use the Buffer functions in bufaux.c 1063 but not the bignum ones) no longer need to be linked with libcrypto. 1064 ok markus@ 1065 - djm@cvs.openbsd.org 2006/04/20 09:27:09 1066 [auth.h clientloop.c dispatch.c dispatch.h kex.h] 1067 replace the last non-sig_atomic_t flag used in a signal handler with a 1068 sig_atomic_t, unfortunately with some knock-on effects in other (non- 1069 signal) contexts in which it is used; ok markus@ 1070 - markus@cvs.openbsd.org 2006/04/20 09:47:59 1071 [sshconnect.c] 1072 simplify; ok djm@ 1073 - djm@cvs.openbsd.org 2006/04/20 21:53:44 1074 [includes.h session.c sftp.c] 1075 Switch from using pipes to socketpairs for communication between 1076 sftp/scp and ssh, and between sshd and its subprocesses. This saves 1077 a file descriptor per session and apparently makes userland ppp over 1078 ssh work; ok markus@ deraadt@ (ID Sync only - portable makes this 1079 decision on a per-platform basis) 1080 - djm@cvs.openbsd.org 2006/04/22 04:06:51 1081 [uidswap.c] 1082 use setres[ug]id() to permanently revoke privileges; ok deraadt@ 1083 (ID Sync only - portable already uses setres[ug]id() whenever possible) 1084 - stevesk@cvs.openbsd.org 2006/04/22 18:29:33 1085 [crc32.c] 1086 remove extra spaces 1087 - (djm) [auth.h dispatch.h kex.h] sprinkle in signal.h to get 1088 sig_atomic_t 1089 109020060421 1091 - (djm) [Makefile.in configure.ac session.c sshpty.c] 1092 [contrib/redhat/sshd.init openbsd-compat/Makefile.in] 1093 [openbsd-compat/openbsd-compat.h openbsd-compat/port-linux.c] 1094 [openbsd-compat/port-linux.h] Add support for SELinux, setting 1095 the execution and TTY contexts. based on patch from Daniel Walsh, 1096 bz #880; ok dtucker@ 1097 109820060418 1099 - (djm) [canohost.c] Reorder IP options check so that it isn't broken 1100 by mapped addresses; bz #1179 reported by markw wtech-llc.com; 1101 ok dtucker@ 1102 110320060331 1104 - OpenBSD CVS Sync 1105 - deraadt@cvs.openbsd.org 2006/03/27 01:21:18 1106 [xmalloc.c] 1107 we can do the size & nmemb check before the integer overflow check; 1108 evol 1109 - deraadt@cvs.openbsd.org 2006/03/27 13:03:54 1110 [dh.c] 1111 use strtonum() instead of atoi(), limit dhg size to 64k; ok djm 1112 - djm@cvs.openbsd.org 2006/03/27 23:15:46 1113 [sftp.c] 1114 always use a format string for addargs; spotted by mouring@ 1115 - deraadt@cvs.openbsd.org 2006/03/28 00:12:31 1116 [README.tun ssh.c] 1117 spacing 1118 - deraadt@cvs.openbsd.org 2006/03/28 01:52:28 1119 [channels.c] 1120 do not accept unreasonable X ports numbers; ok djm 1121 - deraadt@cvs.openbsd.org 2006/03/28 01:53:43 1122 [ssh-agent.c] 1123 use strtonum() to parse the pid from the file, and range check it 1124 better; ok djm 1125 - djm@cvs.openbsd.org 2006/03/30 09:41:25 1126 [channels.c] 1127 ARGSUSED for dispatch table-driven functions 1128 - djm@cvs.openbsd.org 2006/03/30 09:58:16 1129 [authfd.c bufaux.c deattack.c gss-serv.c mac.c misc.c misc.h] 1130 [monitor_wrap.c msg.c packet.c sftp-client.c sftp-server.c ssh-agent.c] 1131 replace {GET,PUT}_XXBIT macros with functionally similar functions, 1132 silencing a heap of lint warnings. also allows them to use 1133 __bounded__ checking which can't be applied to macros; requested 1134 by and feedback from deraadt@ 1135 - djm@cvs.openbsd.org 2006/03/30 10:41:25 1136 [ssh.c ssh_config.5] 1137 add percent escape chars to the IdentityFile option, bz #1159 based 1138 on a patch by imaging AT math.ualberta.ca; feedback and ok dtucker@ 1139 - dtucker@cvs.openbsd.org 2006/03/30 11:05:17 1140 [ssh-keygen.c] 1141 Correctly handle truncated files while converting keys; ok djm@ 1142 - dtucker@cvs.openbsd.org 2006/03/30 11:40:21 1143 [auth.c monitor.c] 1144 Prevent duplicate log messages when privsep=yes; ok djm@ 1145 - jmc@cvs.openbsd.org 2006/03/31 09:09:30 1146 [ssh_config.5] 1147 kill trailing whitespace; 1148 - djm@cvs.openbsd.org 2006/03/31 09:13:56 1149 [ssh_config.5] 1150 remote user escape is %r not %h; spotted by jmc@ 1151 115220060326 1153 - OpenBSD CVS Sync 1154 - jakob@cvs.openbsd.org 2006/03/15 08:46:44 1155 [ssh-keygen.c] 1156 if no key file are given when printing the DNS host record, use the 1157 host key file(s) as default. ok djm@ 1158 - biorn@cvs.openbsd.org 2006/03/16 10:31:45 1159 [scp.c] 1160 Try to display errormessage even if remout == -1 1161 ok djm@, markus@ 1162 - djm@cvs.openbsd.org 2006/03/17 22:31:50 1163 [authfd.c] 1164 another unreachable found by lint 1165 - djm@cvs.openbsd.org 2006/03/17 22:31:11 1166 [authfd.c] 1167 unreachanble statement, found by lint 1168 - djm@cvs.openbsd.org 2006/03/19 02:22:32 1169 [serverloop.c] 1170 memory leaks detected by Coverity via elad AT netbsd.org; 1171 ok deraadt@ dtucker@ 1172 - djm@cvs.openbsd.org 2006/03/19 02:22:56 1173 [sftp.c] 1174 more memory leaks detected by Coverity via elad AT netbsd.org; 1175 deraadt@ ok 1176 - djm@cvs.openbsd.org 2006/03/19 02:23:26 1177 [hostfile.c] 1178 FILE* leak detected by Coverity via elad AT netbsd.org; 1179 ok deraadt@ 1180 - djm@cvs.openbsd.org 2006/03/19 02:24:05 1181 [dh.c readconf.c servconf.c] 1182 potential NULL pointer dereferences detected by Coverity 1183 via elad AT netbsd.org; ok deraadt@ 1184 - djm@cvs.openbsd.org 2006/03/19 07:41:30 1185 [sshconnect2.c] 1186 memory leaks detected by Coverity via elad AT netbsd.org; 1187 deraadt@ ok 1188 - dtucker@cvs.openbsd.org 2006/03/19 11:51:52 1189 [servconf.c] 1190 Correct strdelim null test; ok djm@ 1191 - deraadt@cvs.openbsd.org 2006/03/19 18:52:11 1192 [auth1.c authfd.c channels.c] 1193 spacing 1194 - deraadt@cvs.openbsd.org 2006/03/19 18:53:12 1195 [kex.c kex.h monitor.c myproposal.h session.c] 1196 spacing 1197 - deraadt@cvs.openbsd.org 2006/03/19 18:56:41 1198 [clientloop.c progressmeter.c serverloop.c sshd.c] 1199 ARGSUSED for signal handlers 1200 - deraadt@cvs.openbsd.org 2006/03/19 18:59:49 1201 [ssh-keyscan.c] 1202 please lint 1203 - deraadt@cvs.openbsd.org 2006/03/19 18:59:30 1204 [ssh.c] 1205 spacing 1206 - deraadt@cvs.openbsd.org 2006/03/19 18:59:09 1207 [authfile.c] 1208 whoever thought that break after return was a good idea needs to 1209 get their head examimed 1210 - djm@cvs.openbsd.org 2006/03/20 04:09:44 1211 [monitor.c] 1212 memory leaks detected by Coverity via elad AT netbsd.org; 1213 deraadt@ ok 1214 that should be all of them now 1215 - djm@cvs.openbsd.org 2006/03/20 11:38:46 1216 [key.c] 1217 (really) last of the Coverity diffs: avoid possible NULL deref in 1218 key_free. via elad AT netbsd.org; markus@ ok 1219 - deraadt@cvs.openbsd.org 2006/03/20 17:10:19 1220 [auth.c key.c misc.c packet.c ssh-add.c] 1221 in a switch (), break after return or goto is stupid 1222 - deraadt@cvs.openbsd.org 2006/03/20 17:13:16 1223 [key.c] 1224 djm did a typo 1225 - deraadt@cvs.openbsd.org 2006/03/20 17:17:23 1226 [ssh-rsa.c] 1227 in a switch (), break after return or goto is stupid 1228 - deraadt@cvs.openbsd.org 2006/03/20 18:14:02 1229 [channels.c clientloop.c monitor_wrap.c monitor_wrap.h serverloop.c] 1230 [ssh.c sshpty.c sshpty.h] 1231 sprinkle u_int throughout pty subsystem, ok markus 1232 - deraadt@cvs.openbsd.org 2006/03/20 18:17:20 1233 [auth1.c auth2.c sshd.c] 1234 sprinkle some ARGSUSED for table driven functions (which sometimes 1235 must ignore their args) 1236 - deraadt@cvs.openbsd.org 2006/03/20 18:26:55 1237 [channels.c monitor.c session.c session.h ssh-agent.c ssh-keygen.c] 1238 [ssh-rsa.c ssh.c sshlogin.c] 1239 annoying spacing fixes getting in the way of real diffs 1240 - deraadt@cvs.openbsd.org 2006/03/20 18:27:50 1241 [monitor.c] 1242 spacing 1243 - deraadt@cvs.openbsd.org 2006/03/20 18:35:12 1244 [channels.c] 1245 x11_fake_data is only ever used as u_char * 1246 - deraadt@cvs.openbsd.org 2006/03/20 18:41:43 1247 [dns.c] 1248 cast xstrdup to propert u_char * 1249 - deraadt@cvs.openbsd.org 2006/03/20 18:42:27 1250 [canohost.c match.c ssh.c sshconnect.c] 1251 be strict with tolower() casting 1252 - deraadt@cvs.openbsd.org 2006/03/20 18:48:34 1253 [channels.c fatal.c kex.c packet.c serverloop.c] 1254 spacing 1255 - deraadt@cvs.openbsd.org 2006/03/20 21:11:53 1256 [ttymodes.c] 1257 spacing 1258 - djm@cvs.openbsd.org 2006/03/25 00:05:41 1259 [auth-bsdauth.c auth-skey.c auth.c auth2-chall.c channels.c] 1260 [clientloop.c deattack.c gss-genr.c kex.c key.c misc.c moduli.c] 1261 [monitor.c monitor_wrap.c packet.c scard.c sftp-server.c ssh-agent.c] 1262 [ssh-keyscan.c ssh.c sshconnect.c sshconnect2.c sshd.c uuencode.c] 1263 [xmalloc.c xmalloc.h] 1264 introduce xcalloc() and xasprintf() failure-checked allocations 1265 functions and use them throughout openssh 1266 1267 xcalloc is particularly important because malloc(nmemb * size) is a 1268 dangerous idiom (subject to integer overflow) and it is time for it 1269 to die 1270 1271 feedback and ok deraadt@ 1272 - djm@cvs.openbsd.org 2006/03/25 01:13:23 1273 [buffer.c channels.c deattack.c misc.c scp.c session.c sftp-client.c] 1274 [sftp-server.c ssh-agent.c ssh-rsa.c xmalloc.c xmalloc.h auth-pam.c] 1275 [uidswap.c] 1276 change OpenSSH's xrealloc() function from being xrealloc(p, new_size) 1277 to xrealloc(p, new_nmemb, new_itemsize). 1278 1279 realloc is particularly prone to integer overflows because it is 1280 almost always allocating "n * size" bytes, so this is a far safer 1281 API; ok deraadt@ 1282 - djm@cvs.openbsd.org 2006/03/25 01:30:23 1283 [sftp.c] 1284 "abormally" is a perfectly cromulent word, but "abnormally" is better 1285 - djm@cvs.openbsd.org 2006/03/25 13:17:03 1286 [atomicio.c auth-bsdauth.c auth-chall.c auth-options.c auth-passwd.c] 1287 [auth-rh-rsa.c auth-rhosts.c auth-rsa.c auth-skey.c auth.c auth1.c] 1288 [auth2-chall.c auth2-hostbased.c auth2-kbdint.c auth2-none.c] 1289 [auth2-passwd.c auth2-pubkey.c auth2.c authfd.c authfile.c bufaux.c] 1290 [buffer.c canohost.c channels.c cipher-3des1.c cipher-bf1.c] 1291 [cipher-ctr.c cipher.c cleanup.c clientloop.c compat.c compress.c] 1292 [deattack.c dh.c dispatch.c fatal.c groupaccess.c hostfile.c kex.c] 1293 [kexdh.c kexdhc.c kexdhs.c kexgex.c kexgexc.c kexgexs.c key.c log.c] 1294 [mac.c match.c md-sha256.c misc.c monitor.c monitor_fdpass.c] 1295 [monitor_mm.c monitor_wrap.c msg.c nchan.c packet.c progressmeter.c] 1296 [readconf.c readpass.c rsa.c scard.c scp.c servconf.c serverloop.c] 1297 [session.c sftp-client.c sftp-common.c sftp-glob.c sftp-server.c] 1298 [sftp.c ssh-add.c ssh-agent.c ssh-dss.c ssh-keygen.c ssh-keyscan.c] 1299 [ssh-keysign.c ssh-rsa.c ssh.c sshconnect.c sshconnect1.c] 1300 [sshconnect2.c sshd.c sshlogin.c sshpty.c sshtty.c ttymodes.c] 1301 [uidswap.c uuencode.c xmalloc.c] 1302 Put $OpenBSD$ tags back (as comments) to replace the RCSID()s that 1303 Theo nuked - our scripts to sync -portable need them in the files 1304 - deraadt@cvs.openbsd.org 2006/03/25 18:29:35 1305 [auth-rsa.c authfd.c packet.c] 1306 needed casts (always will be needed) 1307 - deraadt@cvs.openbsd.org 2006/03/25 18:30:55 1308 [clientloop.c serverloop.c] 1309 spacing 1310 - deraadt@cvs.openbsd.org 2006/03/25 18:36:15 1311 [sshlogin.c sshlogin.h] 1312 nicer size_t and time_t types 1313 - deraadt@cvs.openbsd.org 2006/03/25 18:40:14 1314 [ssh-keygen.c] 1315 cast strtonum() result to right type 1316 - deraadt@cvs.openbsd.org 2006/03/25 18:41:45 1317 [ssh-agent.c] 1318 mark two more signal handlers ARGSUSED 1319 - deraadt@cvs.openbsd.org 2006/03/25 18:43:30 1320 [channels.c] 1321 use strtonum() instead of atoi() [limit X screens to 400, sorry] 1322 - deraadt@cvs.openbsd.org 2006/03/25 18:56:55 1323 [bufaux.c channels.c packet.c] 1324 remove (char *) casts to a function that accepts void * for the arg 1325 - deraadt@cvs.openbsd.org 2006/03/25 18:58:10 1326 [channels.c] 1327 delete cast not required 1328 - djm@cvs.openbsd.org 2006/03/25 22:22:43 1329 [atomicio.h auth-options.h auth.h auth2-gss.c authfd.h authfile.h] 1330 [bufaux.h buffer.h canohost.h channels.h cipher.h clientloop.h] 1331 [compat.h compress.h crc32.c crc32.h deattack.h dh.h dispatch.h] 1332 [dns.c dns.h getput.h groupaccess.h gss-genr.c gss-serv-krb5.c] 1333 [gss-serv.c hostfile.h includes.h kex.h key.h log.h mac.h match.h] 1334 [misc.h monitor.h monitor_fdpass.h monitor_mm.h monitor_wrap.h msg.h] 1335 [myproposal.h packet.h pathnames.h progressmeter.h readconf.h rsa.h] 1336 [scard.h servconf.h serverloop.h session.h sftp-common.h sftp.h] 1337 [ssh-gss.h ssh.h ssh1.h ssh2.h sshconnect.h sshlogin.h sshpty.h] 1338 [ttymodes.h uidswap.h uuencode.h xmalloc.h] 1339 standardise spacing in $OpenBSD$ tags; requested by deraadt@ 1340 - deraadt@cvs.openbsd.org 2006/03/26 01:31:48 1341 [uuencode.c] 1342 typo 1343 134420060325 1345 - OpenBSD CVS Sync 1346 - djm@cvs.openbsd.org 2006/03/16 04:24:42 1347 [ssh.1] 1348 Add RFC4419 (Diffie-Hellman group exchange KEX) to the list of SSH RFCs 1349 that OpenSSH supports 1350 - deraadt@cvs.openbsd.org 2006/03/19 18:51:18 1351 [atomicio.c auth-bsdauth.c auth-chall.c auth-krb5.c auth-options.c] 1352 [auth-pam.c auth-passwd.c auth-rh-rsa.c auth-rhosts.c auth-rsa.c] 1353 [auth-shadow.c auth-skey.c auth.c auth1.c auth2-chall.c] 1354 [auth2-hostbased.c auth2-kbdint.c auth2-none.c auth2-passwd.c] 1355 [auth2-pubkey.c auth2.c authfd.c authfile.c bufaux.c buffer.c] 1356 [canohost.c channels.c cipher-3des1.c cipher-acss.c cipher-aes.c] 1357 [cipher-bf1.c cipher-ctr.c cipher.c cleanup.c clientloop.c compat.c] 1358 [compress.c deattack.c dh.c dispatch.c dns.c entropy.c fatal.c] 1359 [groupaccess.c hostfile.c includes.h kex.c kexdh.c kexdhc.c] 1360 [kexdhs.c kexgex.c kexgexc.c kexgexs.c key.c log.c loginrec.c] 1361 [loginrec.h logintest.c mac.c match.c md-sha256.c md5crypt.c misc.c] 1362 [monitor.c monitor_fdpass.c monitor_mm.c monitor_wrap.c msg.c] 1363 [nchan.c packet.c progressmeter.c readconf.c readpass.c rsa.c] 1364 [scard.c scp.c servconf.c serverloop.c session.c sftp-client.c] 1365 [sftp-common.c sftp-glob.c sftp-server.c sftp.c ssh-add.c] 1366 [ssh-agent.c ssh-dss.c ssh-keygen.c ssh-keyscan.c ssh-keysign.c] 1367 [ssh-rand-helper.c ssh-rsa.c ssh.c sshconnect.c sshconnect1.c] 1368 [sshconnect2.c sshd.c sshlogin.c sshpty.c sshtty.c ttymodes.c] 1369 [uidswap.c uuencode.c xmalloc.c openbsd-compat/bsd-arc4random.c] 1370 [openbsd-compat/bsd-closefrom.c openbsd-compat/bsd-cygwin_util.c] 1371 [openbsd-compat/bsd-getpeereid.c openbsd-compat/bsd-misc.c] 1372 [openbsd-compat/bsd-nextstep.c openbsd-compat/bsd-snprintf.c] 1373 [openbsd-compat/bsd-waitpid.c openbsd-compat/fake-rfc2553.c] 1374 RCSID() can die 1375 - deraadt@cvs.openbsd.org 2006/03/19 18:53:12 1376 [kex.h myproposal.h] 1377 spacing 1378 - djm@cvs.openbsd.org 2006/03/20 04:07:22 1379 [auth2-gss.c] 1380 GSSAPI related leaks detected by Coverity via elad AT netbsd.org; 1381 reviewed by simon AT sxw.org.uk; deraadt@ ok 1382 - djm@cvs.openbsd.org 2006/03/20 04:07:49 1383 [gss-genr.c] 1384 more GSSAPI related leaks detected by Coverity via elad AT netbsd.org; 1385 reviewed by simon AT sxw.org.uk; deraadt@ ok 1386 - djm@cvs.openbsd.org 2006/03/20 04:08:18 1387 [gss-serv.c] 1388 last lot of GSSAPI related leaks detected by Coverity via 1389 elad AT netbsd.org; reviewed by simon AT sxw.org.uk; deraadt@ ok 1390 - deraadt@cvs.openbsd.org 2006/03/20 18:14:02 1391 [monitor_wrap.h sshpty.h] 1392 sprinkle u_int throughout pty subsystem, ok markus 1393 - deraadt@cvs.openbsd.org 2006/03/20 18:26:55 1394 [session.h] 1395 annoying spacing fixes getting in the way of real diffs 1396 - deraadt@cvs.openbsd.org 2006/03/20 18:41:43 1397 [dns.c] 1398 cast xstrdup to propert u_char * 1399 - jakob@cvs.openbsd.org 2006/03/22 21:16:24 1400 [ssh.1] 1401 simplify SSHFP example; ok jmc@ 1402 - djm@cvs.openbsd.org 2006/03/22 21:27:15 1403 [deattack.c deattack.h] 1404 remove IV support from the CRC attack detector, OpenSSH has never used 1405 it - it only applied to IDEA-CFB, which we don't support. 1406 prompted by NetBSD Coverity report via elad AT netbsd.org; 1407 feedback markus@ "nuke it" deraadt@ 1408 140920060318 1410 - (djm) [auth-pam.c] Fix memleak in error path, from Coverity via 1411 elad AT NetBSD.org 1412 - (dtucker) [openbsd-compat/bsd-snprintf.c] Bug #1173: make fmtint() take 1413 a LLONG rather than a long. Fixes scp'ing of large files on platforms 1414 with missing/broken snprintfs. Patch from e.borovac at bom.gov.au. 1415 141620060316 1417 - (dtucker) [entropy.c] Add headers for WIFEXITED and friends. 1418 - (dtucker) [configure.ac md-sha256.c] NetBSD has sha2.h in 1419 /usr/include/crypto. Hint from djm@. 1420 - (tim) [kex.c myproposal.h md-sha256.c openbsd-compat/sha2.c,h] 1421 Disable sha256 when openssl < 0.9.7. Patch from djm@. 1422 - (djm) [kex.c] Slightly more clean deactivation of dhgex-sha256 on old 1423 OpenSSL; ok tim 1424 142520060315 1426 - (djm) OpenBSD CVS Sync: 1427 - msf@cvs.openbsd.org 2006/02/06 15:54:07 1428 [ssh.1] 1429 - typo fix 1430 ok jmc@ 1431 - jmc@cvs.openbsd.org 2006/02/06 21:44:47 1432 [ssh.1] 1433 make this a little less ambiguous... 1434 - stevesk@cvs.openbsd.org 2006/02/07 01:08:04 1435 [auth-rhosts.c includes.h] 1436 move #include <netgroup.h> out of includes.h; ok markus@ 1437 - stevesk@cvs.openbsd.org 2006/02/07 01:18:09 1438 [includes.h ssh-agent.c ssh-keyscan.c sshconnect2.c] 1439 move #include <sys/queue.h> out of includes.h; ok markus@ 1440 - stevesk@cvs.openbsd.org 2006/02/07 01:42:00 1441 [channels.c clientloop.c clientloop.h includes.h packet.h] 1442 [serverloop.c sshpty.c sshpty.h sshtty.c ttymodes.c] 1443 move #include <termios.h> out of includes.h; ok markus@ 1444 - stevesk@cvs.openbsd.org 2006/02/07 01:52:50 1445 [sshtty.c] 1446 "log.h" not needed 1447 - stevesk@cvs.openbsd.org 2006/02/07 03:47:05 1448 [hostfile.c] 1449 "packet.h" not needed 1450 - stevesk@cvs.openbsd.org 2006/02/07 03:59:20 1451 [deattack.c] 1452 duplicate #include 1453 - stevesk@cvs.openbsd.org 2006/02/08 12:15:27 1454 [auth.c clientloop.c includes.h misc.c monitor.c readpass.c] 1455 [session.c sftp.c ssh-agent.c ssh-keysign.c ssh.c sshconnect.c] 1456 [sshd.c sshpty.c] 1457 move #include <paths.h> out of includes.h; ok markus@ 1458 - stevesk@cvs.openbsd.org 2006/02/08 12:32:49 1459 [includes.h misc.c] 1460 move #include <netinet/tcp.h> out of includes.h; ok markus@ 1461 - stevesk@cvs.openbsd.org 2006/02/08 13:15:44 1462 [gss-serv.c monitor.c] 1463 small KNF 1464 - stevesk@cvs.openbsd.org 2006/02/08 14:16:59 1465 [sshconnect.c] 1466 <openssl/bn.h> not needed 1467 - stevesk@cvs.openbsd.org 2006/02/08 14:31:30 1468 [includes.h ssh-agent.c ssh-keyscan.c ssh.c] 1469 move #include <sys/resource.h> out of includes.h; ok markus@ 1470 - stevesk@cvs.openbsd.org 2006/02/08 14:38:18 1471 [includes.h packet.c] 1472 move #include <netinet/in_systm.h> and <netinet/ip.h> out of 1473 includes.h; ok markus@ 1474 - stevesk@cvs.openbsd.org 2006/02/08 23:51:24 1475 [includes.h scp.c sftp-glob.c sftp-server.c] 1476 move #include <dirent.h> out of includes.h; ok markus@ 1477 - stevesk@cvs.openbsd.org 2006/02/09 00:32:07 1478 [includes.h] 1479 #include <sys/endian.h> not needed; ok djm@ 1480 NB. ID Sync only - we still need this (but it may move later) 1481 - jmc@cvs.openbsd.org 2006/02/09 10:10:47 1482 [sshd.8] 1483 - move some text into a CAVEATS section 1484 - merge the COMMAND EXECUTION... section into AUTHENTICATION 1485 - stevesk@cvs.openbsd.org 2006/02/10 00:27:13 1486 [channels.c clientloop.c includes.h misc.c progressmeter.c sftp.c] 1487 [ssh.c sshd.c sshpty.c] 1488 move #include <sys/ioctl.h> out of includes.h; ok markus@ 1489 - stevesk@cvs.openbsd.org 2006/02/10 01:44:27 1490 [includes.h monitor.c readpass.c scp.c serverloop.c session.c] 1491 [sftp.c sshconnect.c sshconnect2.c sshd.c] 1492 move #include <sys/wait.h> out of includes.h; ok markus@ 1493 - otto@cvs.openbsd.org 2006/02/11 19:31:18 1494 [atomicio.c] 1495 type correctness; from Ray Lai in PR 5011; ok millert@ 1496 - djm@cvs.openbsd.org 2006/02/12 06:45:34 1497 [ssh.c ssh_config.5] 1498 add a %l expansion code to the ControlPath, which is filled in with the 1499 local hostname at runtime. Requested by henning@ to avoid some problems 1500 with /home on NFS; ok dtucker@ 1501 - djm@cvs.openbsd.org 2006/02/12 10:44:18 1502 [readconf.c] 1503 raise error when the user specifies a RekeyLimit that is smaller than 16 1504 (the smallest of our cipher's blocksize) or big enough to cause integer 1505 wraparound; ok & feedback dtucker@ 1506 - jmc@cvs.openbsd.org 2006/02/12 10:49:44 1507 [ssh_config.5] 1508 slight rewording; ok djm 1509 - jmc@cvs.openbsd.org 2006/02/12 10:52:41 1510 [sshd.8] 1511 rework the description of authorized_keys a little; 1512 - jmc@cvs.openbsd.org 2006/02/12 17:57:19 1513 [sshd.8] 1514 sort the list of options permissable w/ authorized_keys; 1515 ok djm dtucker 1516 - jmc@cvs.openbsd.org 2006/02/13 10:16:39 1517 [sshd.8] 1518 no need to subsection the authorized_keys examples - instead, convert 1519 this to look like an actual file. also use proto 2 keys, and use IETF 1520 example addresses; 1521 - jmc@cvs.openbsd.org 2006/02/13 10:21:25 1522 [sshd.8] 1523 small tweaks for the ssh_known_hosts section; 1524 - jmc@cvs.openbsd.org 2006/02/13 11:02:26 1525 [sshd.8] 1526 turn this into an example ssh_known_hosts file; ok djm 1527 - jmc@cvs.openbsd.org 2006/02/13 11:08:43 1528 [sshd.8] 1529 - avoid nasty line split 1530 - `*' does not need to be escaped 1531 - jmc@cvs.openbsd.org 2006/02/13 11:27:25 1532 [sshd.8] 1533 sort FILES and use a -compact list; 1534 - david@cvs.openbsd.org 2006/02/15 05:08:24 1535 [sftp-client.c] 1536 typo in comment; ok djm@ 1537 - jmc@cvs.openbsd.org 2006/02/15 16:53:20 1538 [ssh.1] 1539 remove the IETF draft references and replace them with some updated RFCs; 1540 - jmc@cvs.openbsd.org 2006/02/15 16:55:33 1541 [sshd.8] 1542 remove ietf draft references; RFC list now maintained in ssh.1; 1543 - jmc@cvs.openbsd.org 2006/02/16 09:05:34 1544 [sshd.8] 1545 sync some of the FILES entries w/ ssh.1; 1546 - jmc@cvs.openbsd.org 2006/02/19 19:52:10 1547 [sshd.8] 1548 move the sshrc stuff out of FILES, and into its own section: 1549 FILES is not a good place to document how stuff works; 1550 - jmc@cvs.openbsd.org 2006/02/19 20:02:17 1551 [sshd.8] 1552 sync the (s)hosts.equiv FILES entries w/ those from ssh.1; 1553 - jmc@cvs.openbsd.org 2006/02/19 20:05:00 1554 [sshd.8] 1555 grammar; 1556 - jmc@cvs.openbsd.org 2006/02/19 20:12:25 1557 [ssh_config.5] 1558 add some vertical space; 1559 - stevesk@cvs.openbsd.org 2006/02/20 16:36:15 1560 [authfd.c channels.c includes.h session.c ssh-agent.c ssh.c] 1561 move #include <sys/un.h> out of includes.h; ok djm@ 1562 - stevesk@cvs.openbsd.org 2006/02/20 17:02:44 1563 [clientloop.c includes.h monitor.c progressmeter.c scp.c] 1564 [serverloop.c session.c sftp.c ssh-agent.c ssh.c sshd.c] 1565 move #include <signal.h> out of includes.h; ok markus@ 1566 - stevesk@cvs.openbsd.org 2006/02/20 17:19:54 1567 [auth-rhosts.c auth-rsa.c auth.c auth2-none.c auth2-pubkey.c] 1568 [authfile.c clientloop.c includes.h readconf.c scp.c session.c] 1569 [sftp-client.c sftp-common.c sftp-common.h sftp-glob.c] 1570 [sftp-server.c sftp.c ssh-add.c ssh-keygen.c ssh.c sshconnect.c] 1571 [sshconnect2.c sshd.c sshpty.c] 1572 move #include <sys/stat.h> out of includes.h; ok markus@ 1573 - stevesk@cvs.openbsd.org 2006/02/22 00:04:45 1574 [canohost.c clientloop.c includes.h match.c readconf.c scp.c ssh.c] 1575 [sshconnect.c] 1576 move #include <ctype.h> out of includes.h; ok djm@ 1577 - jmc@cvs.openbsd.org 2006/02/24 10:25:14 1578 [ssh_config.5] 1579 add section on patterns; 1580 from dtucker + myself 1581 - jmc@cvs.openbsd.org 2006/02/24 10:33:54 1582 [sshd_config.5] 1583 signpost to PATTERNS; 1584 - jmc@cvs.openbsd.org 2006/02/24 10:37:07 1585 [ssh_config.5] 1586 tidy up the refs to PATTERNS; 1587 - jmc@cvs.openbsd.org 2006/02/24 10:39:52 1588 [sshd.8] 1589 signpost to PATTERNS section; 1590 - jmc@cvs.openbsd.org 2006/02/24 20:22:16 1591 [ssh-keysign.8 ssh_config.5 sshd_config.5] 1592 some consistency fixes; 1593 - jmc@cvs.openbsd.org 2006/02/24 20:31:31 1594 [ssh.1 ssh_config.5 sshd.8 sshd_config.5] 1595 more consistency fixes; 1596 - jmc@cvs.openbsd.org 2006/02/24 23:20:07 1597 [ssh_config.5] 1598 some grammar/wording fixes; 1599 - jmc@cvs.openbsd.org 2006/02/24 23:43:57 1600 [sshd_config.5] 1601 some grammar/wording fixes; 1602 - jmc@cvs.openbsd.org 2006/02/24 23:51:17 1603 [sshd_config.5] 1604 oops - bits i missed; 1605 - jmc@cvs.openbsd.org 2006/02/25 12:26:17 1606 [ssh_config.5] 1607 document the possible values for KbdInteractiveDevices; 1608 help/ok dtucker 1609 - jmc@cvs.openbsd.org 2006/02/25 12:28:34 1610 [sshd_config.5] 1611 document the order in which allow/deny directives are processed; 1612 help/ok dtucker 1613 - jmc@cvs.openbsd.org 2006/02/26 17:17:18 1614 [ssh_config.5] 1615 move PATTERNS to the end of the main body; requested by dtucker 1616 - jmc@cvs.openbsd.org 2006/02/26 18:01:13 1617 [sshd_config.5] 1618 subsection is pointless here; 1619 - jmc@cvs.openbsd.org 2006/02/26 18:03:10 1620 [ssh_config.5] 1621 comma; 1622 - djm@cvs.openbsd.org 2006/02/28 01:10:21 1623 [session.c] 1624 fix logout recording when privilege separation is disabled, analysis and 1625 patch from vinschen at redhat.com; tested by dtucker@ ok deraadt@ 1626 NB. ID sync only - patch already in portable 1627 - djm@cvs.openbsd.org 2006/03/04 04:12:58 1628 [serverloop.c] 1629 move a debug() outside of a signal handler; ok markus@ a little while back 1630 - djm@cvs.openbsd.org 2006/03/12 04:23:07 1631 [ssh.c] 1632 knf nit 1633 - djm@cvs.openbsd.org 2006/03/13 08:16:00 1634 [sshd.c] 1635 don't log that we are listening on a socket before the listen() call 1636 actually succeeds, bz #1162 reported by Senthil Kumar; ok dtucker@ 1637 - dtucker@cvs.openbsd.org 2006/03/13 08:33:00 1638 [packet.c] 1639 Set TCP_NODELAY for all connections not just "interactive" ones. Fixes 1640 poor performance and protocol stalls under some network conditions (mindrot 1641 bugs #556 and #981). Patch originally from markus@, ok djm@ 1642 - dtucker@cvs.openbsd.org 2006/03/13 08:43:16 1643 [ssh-keygen.c] 1644 Make ssh-keygen handle CR and CRLF line termination when converting IETF 1645 format keys, in adition to vanilla LF. mindrot #1157, tested by Chris 1646 Pepper, ok djm@ 1647 - dtucker@cvs.openbsd.org 2006/03/13 10:14:29 1648 [misc.c ssh_config.5 sshd_config.5] 1649 Allow config directives to contain whitespace by surrounding them by double 1650 quotes. mindrot #482, man page help from jmc@, ok djm@ 1651 - dtucker@cvs.openbsd.org 2006/03/13 10:26:52 1652 [authfile.c authfile.h ssh-add.c] 1653 Make ssh-add check file permissions before attempting to load private 1654 key files multiple times; it will fail anyway and this prevents confusing 1655 multiple prompts and warnings. mindrot #1138, ok djm@ 1656 - djm@cvs.openbsd.org 2006/03/14 00:15:39 1657 [canohost.c] 1658 log the originating address and not just the name when a reverse 1659 mapping check fails, requested by linux AT linuon.com 1660 - markus@cvs.openbsd.org 2006/03/14 16:32:48 1661 [ssh_config.5 sshd_config.5] 1662 *AliveCountMax applies to protcol v2 only; ok dtucker, djm 1663 - djm@cvs.openbsd.org 2006/03/07 09:07:40 1664 [kex.c kex.h monitor.c myproposal.h ssh-keyscan.c sshconnect2.c sshd.c] 1665 Implement the diffie-hellman-group-exchange-sha256 key exchange method 1666 using the SHA256 code in libc (and wrapper to make it into an OpenSSL 1667 EVP), interop tested against CVS PuTTY 1668 NB. no portability bits committed yet 1669 - (djm) [configure.ac defines.h kex.c md-sha256.c] 1670 [openbsd-compat/sha2.h openbsd-compat/openbsd-compat.h] 1671 [openbsd-compat/sha2.c] First stab at portability glue for SHA256 1672 KEX support, should work with libc SHA256 support or OpenSSL 1673 EVP_sha256 if present 1674 - (djm) [includes.h] Restore accidentally dropped netinet/in.h 1675 - (djm) [Makefile.in openbsd-compat/Makefile.in] Add added files 1676 - (djm) [md-sha256.c configure.ac] md-sha256.c needs sha2.h if present 1677 - (djm) [regress/.cvsignore] Ignore Makefile here 1678 - (djm) [loginrec.c] Need stat.h 1679 - (djm) [openbsd-compat/sha2.h] Avoid include macro clash with 1680 system sha2.h 1681 - (djm) [ssh-rand-helper.c] Needs a bunch of headers 1682 - (djm) [ssh-agent.c] Restore dropped stat.h 1683 - (djm) [openbsd-compat/sha2.h openbsd-compat/sha2.c] Comment out 1684 SHA384, which we don't need and doesn't compile without tweaks 1685 - (djm) [auth-pam.c clientloop.c includes.h monitor.c session.c] 1686 [sftp-client.c ssh-keysign.c ssh.c sshconnect.c sshconnect2.c] 1687 [sshd.c openbsd-compat/bsd-misc.c openbsd-compat/bsd-openpty.c] 1688 [openbsd-compat/glob.c openbsd-compat/mktemp.c] 1689 [openbsd-compat/readpassphrase.c] Lots of include fixes for 1690 OpenSolaris 1691 - (tim) [includes.h] put sys/stat.h back in to quiet some "macro redefined:" 1692 - (tim) [openssh/sshpty.c openssh/openbsd-compat/port-tun.c] put in some 1693 includes removed from includes.h 1694 - (dtucker) [configure.ac] Fix glob test conversion to AC_TRY_COMPILE 1695 - (djm) [includes.h] Put back paths.h, it is needed in defines.h 1696 - (dtucker) [openbsd-compat/openbsd-compat.h] AIX (at least) needs 1697 sys/ioctl.h for struct winsize. 1698 - (dtucker) [configure.ac] login_cap.h requires sys/types.h on NetBSD. 1699 170020060313 1701 - (dtucker) [configure.ac] Bug #1171: Don't use printf("%lld", longlong) 1702 since not all platforms support it. Instead, use internal equivalent while 1703 computing LLONG_MIN and LLONG_MAX. Remove special case for alpha-dec-osf* 1704 as it's no longer required. Tested by Bernhard Simon, ok djm@ 1705 170620060304 1707 - (dtucker) [contrib/cygwin/ssh-host-config] Require use of lastlog as a 1708 file rather than directory, required as Cygwin will be importing lastlog(1). 1709 Also tightens up permissions on the file. Patch from vinschen@redhat.com. 1710 - (dtucker) [gss-serv-krb5.c] Bug #1166: Correct #ifdefs for gssapi_krb5.h 1711 includes. Patch from gentoo.riverrat at gmail.com. 1712 171320060226 1714 - (dtucker) [configure.ac] Bug #1156: QNX apparently needs SSHD_ACQUIRES_CTTY 1715 patch from kraai at ftbfs.org. 1716 171720060223 1718 - (dtucker) [sshd_config sshd_config.5] Update UsePAM to reflect current 1719 reality. Pointed out by tryponraj at gmail.com. 1720 172120060222 1722 - (dtucker) [openbsd-compat/openssl-compat.{c,h}] Minor tidy up: only 1723 compile in compat code if required. 1724 172520060221 1726 - (dtucker) [openbsd-compat/openssl-compat.h] Prevent warning about 1727 redefinition of SSLeay_add_all_algorithms. 1728 172920060220 1730 - (dtucker) [INSTALL configure.ac openbsd-compat/openssl-compat.{c,h}] 1731 Add optional enabling of OpenSSL's (hardware) Engine support, via 1732 configure --with-ssl-engine. Based in part on a diff by michal at 1733 logix.cz. 1734 173520060219 1736 - (dtucker) [Makefile.in configure.ac, added openbsd-compat/regress/] 1737 Add first attempt at regress tests for compat library. ok djm@ 1738 173920060214 1740 - (tim) [buildpkg.sh.in] Make the names consistent. 1741 s/pkg_post_make_install_fixes.sh/pkg-post-make-install-fixes.sh/ OK dtucker@ 1742 174320060212 1744 - (dtucker) [openbsd-compat/bsd-cygwin_util.c] Make loop counter unsigned 1745 to silence compiler warning, from vinschen at redhat.com. 1746 - (tim) [configure.ac] Bug #1149. Disable /etc/default/login check for QNX. 1747 - (dtucker) [README version.h contrib/caldera/openssh.spec 1748 contrib/redhat/openssh.spec contrib/suse/openssh.spec] Bump version 1749 strings to match 4.3p2 release. 1750 175120060208 1752 - (tim) [session.c] Logout records were not updated on systems with 1753 post auth privsep disabled due to bug 1086 changes. Analysis and patch 1754 by vinschen at redhat.com. OK tim@, dtucker@. 1755 - (dtucker) [configure.ac] Typo in Ultrix and NewsOS sections (NEED_SETPRGP 1756 -> NEED_SETPGRP), reported by Bernhard Simon. ok tim@ 1757 175820060206 1759 - (tim) [configure.ac] Remove unnecessary tests for net/if.h and 1760 netinet/in_systm.h. OK dtucker@. 1761 176220060205 1763 - (tim) [configure.ac] Add AC_REVISION. Add sys/time.h to lastlog.h test 1764 for Solaris. OK dtucker@. 1765 - (tim) [configure.ac] Bug #1149. Changes in QNX section only. Patch by 1766 kraai at ftbfs.org. 1767 176820060203 1769 - (tim) [configure.ac] test for egrep (AC_PROG_EGREP) before first 1770 AC_CHECK_HEADERS test. Without it, if AC_CHECK_HEADERS is first run 1771 by a platform specific check, builtin standard includes tests will be 1772 skipped on the other platforms. 1773 Analysis and suggestion by vinschen at redhat.com, patch by dtucker@. 1774 OK tim@, djm@. 1775 177620060202 1777 - (dtucker) [configure.ac] Bug #1148: Fix "crippled AES" test so that it 1778 works with picky compilers. Patch from alex.kiernan at thus.net. 1779 178020060201 1781 - (djm) [regress/test-exec.sh] Try 'logname' as well as 'whoami' to 1782 determine the user's login name - needed for regress tests on Solaris 1783 10 and OpenSolaris 1784 - (djm) OpenBSD CVS Sync 1785 - jmc@cvs.openbsd.org 2006/02/01 09:06:50 1786 [sshd.8] 1787 - merge sections on protocols 1 and 2 into a single section 1788 - remove configuration file section 1789 ok markus 1790 - jmc@cvs.openbsd.org 2006/02/01 09:11:41 1791 [sshd.8] 1792 small tweak; 1793 - (djm) [contrib/caldera/openssh.spec contrib/redhat/openssh.spec] 1794 [contrib/suse/openssh.spec] Update versions ahead of release 1795 - markus@cvs.openbsd.org 2006/02/01 11:27:22 1796 [version.h] 1797 openssh 4.3 1798 - (djm) Release OpenSSH 4.3p1 1799 180020060131 1801 - (djm) OpenBSD CVS Sync 1802 - jmc@cvs.openbsd.org 2006/01/20 11:21:45 1803 [ssh_config.5] 1804 - word change, agreed w/ markus 1805 - consistency fixes 1806 - jmc@cvs.openbsd.org 2006/01/25 09:04:34 1807 [sshd.8] 1808 move the options description up the page, and a few additional tweaks 1809 whilst in here; 1810 ok markus 1811 - jmc@cvs.openbsd.org 2006/01/25 09:07:22 1812 [sshd.8] 1813 move subsections to full sections; 1814 - jmc@cvs.openbsd.org 2006/01/26 08:47:56 1815 [ssh.1] 1816 add a section on verifying host keys in dns; 1817 written with a lot of help from jakob; 1818 feedback dtucker/markus; 1819 ok markus 1820 - reyk@cvs.openbsd.org 2006/01/30 12:22:22 1821 [channels.c] 1822 mark channel as write failed or dead instead of read failed on error 1823 of the channel output filter. 1824 ok markus@ 1825 - jmc@cvs.openbsd.org 2006/01/30 13:37:49 1826 [ssh.1] 1827 remove an incorrect sentence; 1828 reported by roumen petrov; 1829 ok djm markus 1830 - djm@cvs.openbsd.org 2006/01/31 10:19:02 1831 [misc.c misc.h scp.c sftp.c] 1832 fix local arbitrary command execution vulnerability on local/local and 1833 remote/remote copies (CVE-2006-0225, bz #1094), patch by 1834 t8m AT centrum.cz, polished by dtucker@ and myself; ok markus@ 1835 - djm@cvs.openbsd.org 2006/01/31 10:35:43 1836 [scp.c] 1837 "scp a b c" shouldn't clobber "c" when it is not a directory, report and 1838 fix from biorn@; ok markus@ 1839 - (djm) Sync regress tests to OpenBSD: 1840 - dtucker@cvs.openbsd.org 2005/03/10 10:20:39 1841 [regress/forwarding.sh] 1842 Regress test for ClearAllForwardings (bz #994); ok markus@ 1843 - dtucker@cvs.openbsd.org 2005/04/25 09:54:09 1844 [regress/multiplex.sh] 1845 Don't call cleanup in multiplex as test-exec will cleanup anyway 1846 found by tim@, ok djm@ 1847 NB. ID sync only, we already had this 1848 - djm@cvs.openbsd.org 2005/05/20 23:14:15 1849 [regress/test-exec.sh] 1850 force addressfamily=inet for tests, unbreaking dynamic-forward regress for 1851 recently committed nc SOCKS5 changes 1852 - djm@cvs.openbsd.org 2005/05/24 04:10:54 1853 [regress/try-ciphers.sh] 1854 oops, new arcfour modes here too 1855 - markus@cvs.openbsd.org 2005/06/30 11:02:37 1856 [regress/scp.sh] 1857 allow SUDO=sudo; from Alexander Bluhm 1858 - grunk@cvs.openbsd.org 2005/11/14 21:25:56 1859 [regress/agent-getpeereid.sh] 1860 all other scripts in this dir use $SUDO, not 'sudo', so pull this even 1861 ok markus@ 1862 - dtucker@cvs.openbsd.org 2005/12/14 04:36:39 1863 [regress/scp-ssh-wrapper.sh] 1864 Fix assumption about how many args scp will pass; ok djm@ 1865 NB. ID sync only, we already had this 1866 - djm@cvs.openbsd.org 2006/01/27 06:49:21 1867 [scp.sh] 1868 regress test for local to local scp copies; ok dtucker@ 1869 - djm@cvs.openbsd.org 2006/01/31 10:23:23 1870 [scp.sh] 1871 regression test for CVE-2006-0225 written by dtucker@ 1872 - djm@cvs.openbsd.org 2006/01/31 10:36:33 1873 [scp.sh] 1874 regress test for "scp a b c" where "c" is not a directory 1875 187620060129 1877 - (dtucker) [configure.ac opensshd.init.in] Bug #1144: Use /bin/sh for the 1878 opensshd.init script interpretter if /sbin/sh does not exist. ok tim@ 1879 188020060120 1881 - (dtucker) OpenBSD CVS Sync 1882 - jmc@cvs.openbsd.org 2006/01/15 17:37:05 1883 [ssh.1] 1884 correction from deraadt 1885 - jmc@cvs.openbsd.org 2006/01/18 10:53:29 1886 [ssh.1] 1887 add a section on ssh-based vpn, based on reyk's README.tun; 1888 - dtucker@cvs.openbsd.org 2006/01/20 00:14:55 1889 [scp.1 ssh.1 ssh_config.5 sftp.1] 1890 Document RekeyLimit. Based on patch from jan.iven at cern.ch from mindrot 1891 #1056 with feedback from jmc, djm and markus; ok jmc@ djm@ 1892 189320060114 1894 - (djm) OpenBSD CVS Sync 1895 - jmc@cvs.openbsd.org 2006/01/06 13:27:32 1896 [ssh.1] 1897 weed out some duplicate info in the known_hosts FILES entries; 1898 ok djm 1899 - jmc@cvs.openbsd.org 2006/01/06 13:29:10 1900 [ssh.1] 1901 final round of whacking FILES for duplicate info, and some consistency 1902 fixes; 1903 ok djm 1904 - jmc@cvs.openbsd.org 2006/01/12 14:44:12 1905 [ssh.1] 1906 split sections on tcp and x11 forwarding into two sections. 1907 add an example in the tcp section, based on sth i wrote for ssh faq; 1908 help + ok: djm markus dtucker 1909 - jmc@cvs.openbsd.org 2006/01/12 18:48:48 1910 [ssh.1] 1911 refer to `TCP' rather than `TCP/IP' in the context of connection 1912 forwarding; 1913 ok markus 1914 - jmc@cvs.openbsd.org 2006/01/12 22:20:00 1915 [sshd.8] 1916 refer to TCP forwarding, rather than TCP/IP forwarding; 1917 - jmc@cvs.openbsd.org 2006/01/12 22:26:02 1918 [ssh_config.5] 1919 refer to TCP forwarding, rather than TCP/IP forwarding; 1920 - jmc@cvs.openbsd.org 2006/01/12 22:34:12 1921 [ssh.1] 1922 back out a sentence - AUTHENTICATION already documents this; 1923 192420060109 1925 - (dtucker) [contrib/cygwin/ssh-host-config] Make sshd service depend on 1926 tcpip service so it's always started after IP is up. Patch from 1927 vinschen at redhat.com. 1928 192920060106 1930 - (djm) OpenBSD CVS Sync 1931 - jmc@cvs.openbsd.org 2006/01/03 16:31:10 1932 [ssh.1] 1933 move FILES to a -compact list, and make each files an item in that list. 1934 this avoids nastly line wrap when we have long pathnames, and treats 1935 each file as a separate item; 1936 remove the .Pa too, since it is useless. 1937 - jmc@cvs.openbsd.org 2006/01/03 16:35:30 1938 [ssh.1] 1939 use a larger width for the ENVIRONMENT list; 1940 - jmc@cvs.openbsd.org 2006/01/03 16:52:36 1941 [ssh.1] 1942 put FILES in some sort of order: sort by pathname 1943 - jmc@cvs.openbsd.org 2006/01/03 16:55:18 1944 [ssh.1] 1945 tweak the description of ~/.ssh/environment 1946 - jmc@cvs.openbsd.org 2006/01/04 18:42:46 1947 [ssh.1] 1948 chop out some duplication in the .{r,s}hosts/{h,sh}osts.equiv FILES 1949 entries; 1950 ok markus 1951 - jmc@cvs.openbsd.org 2006/01/04 18:45:01 1952 [ssh.1] 1953 remove .Xr's to rsh(1) and telnet(1): they are hardly needed; 1954 - jmc@cvs.openbsd.org 2006/01/04 19:40:24 1955 [ssh.1] 1956 +.Xr ssh-keyscan 1 , 1957 - jmc@cvs.openbsd.org 2006/01/04 19:50:09 1958 [ssh.1] 1959 -.Xr gzip 1 , 1960 - djm@cvs.openbsd.org 2006/01/05 23:43:53 1961 [misc.c] 1962 check that stdio file descriptors are actually closed before clobbering 1963 them in sanitise_stdfd(). problems occurred when a lower numbered fd was 1964 closed, but higher ones weren't. spotted by, and patch tested by 1965 Fr�d�ric Olivi� 1966 196720060103 1968 - (djm) [channels.c] clean up harmless merge error, from reyk@ 1969 197020060103 1971 - (djm) OpenBSD CVS Sync 1972 - jmc@cvs.openbsd.org 2006/01/02 17:09:49 1973 [ssh_config.5 sshd_config.5] 1974 some corrections from michael knudsen; 1975 197620060102 1977 - (djm) [README.tun] Add README.tun, missed during sync of tun(4) support 1978 - (djm) OpenBSD CVS Sync 1979 - jmc@cvs.openbsd.org 2005/12/31 10:46:17 1980 [ssh.1] 1981 merge the "LOGIN SESSION AND REMOTE EXECUTION" and "SERVER 1982 AUTHENTICATION" sections into "AUTHENTICATION"; 1983 some rewording done to make the text read better, plus some 1984 improvements from djm; 1985 ok djm 1986 - jmc@cvs.openbsd.org 2005/12/31 13:44:04 1987 [ssh.1] 1988 clean up ENVIRONMENT a little; 1989 - jmc@cvs.openbsd.org 2005/12/31 13:45:19 1990 [ssh.1] 1991 .Nm does not require an argument; 1992 - stevesk@cvs.openbsd.org 2006/01/01 08:59:27 1993 [includes.h misc.c] 1994 move <net/if.h>; ok djm@ 1995 - stevesk@cvs.openbsd.org 2006/01/01 10:08:48 1996 [misc.c] 1997 no trailing "\n" for debug() 1998 - djm@cvs.openbsd.org 2006/01/02 01:20:31 1999 [sftp-client.c sftp-common.h sftp-server.c] 2000 use a common max. packet length, no binary change 2001 - reyk@cvs.openbsd.org 2006/01/02 07:53:44 2002 [misc.c] 2003 clarify tun(4) opening - set the mode and bring the interface up. also 2004 (re)sets the tun(4) layer 2 LINK0 flag for existing tunnel interfaces. 2005 suggested and ok by djm@ 2006 - jmc@cvs.openbsd.org 2006/01/02 12:31:06 2007 [ssh.1] 2008 start to cut some duplicate info from FILES; 2009 help/ok djm 2010 201120060101 2012 - (djm) [Makefile.in configure.ac includes.h misc.c] 2013 [openbsd-compat/port-tun.c openbsd-compat/port-tun.h] Add support 2014 for tunnel forwarding for FreeBSD and NetBSD. NetBSD's support is 2015 limited to IPv4 tunnels only, and most versions don't support the 2016 tap(4) device at all. 2017 - (djm) [configure.ac] Fix linux/if_tun.h test 2018 - (djm) [openbsd-compat/port-tun.c] Linux needs linux/if.h too 2019 202020051229 2021 - (djm) OpenBSD CVS Sync 2022 - stevesk@cvs.openbsd.org 2005/12/28 22:46:06 2023 [canohost.c channels.c clientloop.c] 2024 use 'break-in' for consistency; ok deraadt@ ok and input jmc@ 2025 - reyk@cvs.openbsd.org 2005/12/30 15:56:37 2026 [channels.c channels.h clientloop.c] 2027 add channel output filter interface. 2028 ok djm@, suggested by markus@ 2029 - jmc@cvs.openbsd.org 2005/12/30 16:59:00 2030 [sftp.1] 2031 do not suggest that interactive authentication will work 2032 with the -b flag; 2033 based on a diff from john l. scarfone; 2034 ok djm 2035 - stevesk@cvs.openbsd.org 2005/12/31 01:38:45 2036 [ssh.1] 2037 document -MM; ok djm@ 2038 - (djm) [openbsd-compat/port-tun.c openbsd-compat/port-tun.h configure.ac] 2039 [serverloop.c ssh.c openbsd-compat/Makefile.in] 2040 [openbsd-compat/openbsd-compat.h] Implement tun(4) forwarding 2041 compatability support for Linux, diff from reyk@ 2042 - (djm) [configure.ac] Disable Linux tun(4) compat code if linux/tun.h does 2043 not exist 2044 - (djm) [configure.ac] oops, make that linux/if_tun.h 2045 204620051229 2047 - (tim) [buildpkg.sh.in] grep for $SSHDUID instead of $SSHDGID on /etc/passwd 2048 204920051224 2050 - (djm) OpenBSD CVS Sync 2051 - jmc@cvs.openbsd.org 2005/12/20 21:59:43 2052 [ssh.1] 2053 merge the sections on protocols 1 and 2 into one section on 2054 authentication; 2055 feedback djm dtucker 2056 ok deraadt markus dtucker 2057 - jmc@cvs.openbsd.org 2005/12/20 22:02:50 2058 [ssh.1] 2059 .Ss -> .Sh: subsections have not made this page more readable 2060 - jmc@cvs.openbsd.org 2005/12/20 22:09:41 2061 [ssh.1] 2062 move info on ssh return values and config files up into the main 2063 description; 2064 - jmc@cvs.openbsd.org 2005/12/21 11:48:16 2065 [ssh.1] 2066 -L and -R descriptions are now above, not below, ~C description; 2067 - jmc@cvs.openbsd.org 2005/12/21 11:57:25 2068 [ssh.1] 2069 options now described `above', rather than `later'; 2070 - jmc@cvs.openbsd.org 2005/12/21 12:53:31 2071 [ssh.1] 2072 -Y does X11 forwarding too; 2073 ok markus 2074 - stevesk@cvs.openbsd.org 2005/12/21 22:44:26 2075 [sshd.8] 2076 clarify precedence of -p, Port, ListenAddress; ok and help jmc@ 2077 - jmc@cvs.openbsd.org 2005/12/22 10:31:40 2078 [ssh_config.5] 2079 put the description of "UsePrivilegedPort" in the correct place; 2080 - jmc@cvs.openbsd.org 2005/12/22 11:23:42 2081 [ssh.1] 2082 expand the description of -w somewhat; 2083 help/ok reyk 2084 - jmc@cvs.openbsd.org 2005/12/23 14:55:53 2085 [ssh.1] 2086 - sync the description of -e w/ synopsis 2087 - simplify the description of -I 2088 - note that -I is only available if support compiled in, and that it 2089 isn't by default 2090 feedback/ok djm@ 2091 - jmc@cvs.openbsd.org 2005/12/23 23:46:23 2092 [ssh.1] 2093 less mark up for -c; 2094 - djm@cvs.openbsd.org 2005/12/24 02:27:41 2095 [session.c sshd.c] 2096 eliminate some code duplicated in privsep and non-privsep paths, and 2097 explicitly clear SIGALRM handler; "groovy" deraadt@ 2098 209920051220 2100 - (dtucker) OpenBSD CVS Sync 2101 - reyk@cvs.openbsd.org 2005/12/13 15:03:02 2102 [serverloop.c] 2103 if forced_tun_device is not set, it is -1 and not SSH_TUNID_ANY 2104 - jmc@cvs.openbsd.org 2005/12/16 18:07:08 2105 [ssh.1] 2106 move the option descriptions up the page: start of a restructure; 2107 ok markus deraadt 2108 - jmc@cvs.openbsd.org 2005/12/16 18:08:53 2109 [ssh.1] 2110 simplify a sentence; 2111 - jmc@cvs.openbsd.org 2005/12/16 18:12:22 2112 [ssh.1] 2113 make the description of -c a little nicer; 2114 - jmc@cvs.openbsd.org 2005/12/16 18:14:40 2115 [ssh.1] 2116 signpost the protocol sections; 2117 - stevesk@cvs.openbsd.org 2005/12/17 21:13:05 2118 [ssh_config.5 session.c] 2119 spelling: fowarding, fowarded 2120 - stevesk@cvs.openbsd.org 2005/12/17 21:36:42 2121 [ssh_config.5] 2122 spelling: intented -> intended 2123 - dtucker@cvs.openbsd.org 2005/12/20 04:41:07 2124 [ssh.c] 2125 exit(255) on error to match description in ssh(1); bz #1137; ok deraadt@ 2126 212720051219 2128 - (dtucker) [cipher-aes.c cipher-ctr.c cipher.c configure.ac 2129 openbsd-compat/openssl-compat.h] Check for and work around broken AES 2130 ciphers >128bit on (some) Solaris 10 systems. ok djm@ 2131 213220051217 2133 - (dtucker) [defines.h] HP-UX system headers define "YES" and "NO" which 2134 scp.c also uses, so undef them here. 2135 - (dtucker) [configure.ac openbsd-compat/bsd-snprintf.c] Bug #1133: Our 2136 snprintf replacement can have a conflicting declaration in HP-UX's system 2137 headers (const vs. no const) so we now check for and work around it. Patch 2138 from the dynamic duo of David Leonard and Ted Percival. 2139 214020051214 2141 - (dtucker) OpenBSD CVS Sync (regress/) 2142 - dtucker@cvs.openbsd.org 2005/12/30 04:36:39 2143 [regress/scp-ssh-wrapper.sh] 2144 Fix assumption about how many args scp will pass; ok djm@ 2145 214620051213 2147 - (djm) OpenBSD CVS Sync 2148 - jmc@cvs.openbsd.org 2005/11/30 11:18:27 2149 [ssh.1] 2150 timezone -> time zone 2151 - jmc@cvs.openbsd.org 2005/11/30 11:45:20 2152 [ssh.1] 2153 avoid ambiguities in describing TZ; 2154 ok djm@ 2155 - reyk@cvs.openbsd.org 2005/12/06 22:38:28 2156 [auth-options.c auth-options.h channels.c channels.h clientloop.c] 2157 [misc.c misc.h readconf.c readconf.h scp.c servconf.c servconf.h] 2158 [serverloop.c sftp.c ssh.1 ssh.c ssh_config ssh_config.5 sshconnect.c] 2159 [sshconnect.h sshd.8 sshd_config sshd_config.5] 2160 Add support for tun(4) forwarding over OpenSSH, based on an idea and 2161 initial channel code bits by markus@. This is a simple and easy way to 2162 use OpenSSH for ad hoc virtual private network connections, e.g. 2163 administrative tunnels or secure wireless access. It's based on a new 2164 ssh channel and works similar to the existing TCP forwarding support, 2165 except that it depends on the tun(4) network interface on both ends of 2166 the connection for layer 2 or layer 3 tunneling. This diff also adds 2167 support for LocalCommand in the ssh(1) client. 2168 ok djm@, markus@, jmc@ (manpages), tested and discussed with others 2169 - djm@cvs.openbsd.org 2005/12/07 03:52:22 2170 [clientloop.c] 2171 reyk forgot to compile with -Werror (missing header) 2172 - jmc@cvs.openbsd.org 2005/12/07 10:52:13 2173 [ssh.1] 2174 - avoid line split in SYNOPSIS 2175 - add args to -w 2176 - kill trailing whitespace 2177 - jmc@cvs.openbsd.org 2005/12/08 14:59:44 2178 [ssh.1 ssh_config.5] 2179 make `!command' a little clearer; 2180 ok reyk 2181 - jmc@cvs.openbsd.org 2005/12/08 15:06:29 2182 [ssh_config.5] 2183 keep options in order; 2184 - reyk@cvs.openbsd.org 2005/12/08 18:34:11 2185 [auth-options.c includes.h misc.c misc.h readconf.c servconf.c] 2186 [serverloop.c ssh.c ssh_config.5 sshd_config.5 configure.ac] 2187 two changes to the new ssh tunnel support. this breaks compatibility 2188 with the initial commit but is required for a portable approach. 2189 - make the tunnel id u_int and platform friendly, use predefined types. 2190 - support configuration of layer 2 (ethernet) or layer 3 2191 (point-to-point, default) modes. configuration is done using the 2192 Tunnel (yes|point-to-point|ethernet|no) option is ssh_config(5) and 2193 restricted by the PermitTunnel (yes|point-to-point|ethernet|no) option 2194 in sshd_config(5). 2195 ok djm@, man page bits by jmc@ 2196 - jmc@cvs.openbsd.org 2005/12/08 21:37:50 2197 [ssh_config.5] 2198 new sentence, new line; 2199 - markus@cvs.openbsd.org 2005/12/12 13:46:18 2200 [channels.c channels.h session.c] 2201 make sure protocol messages for internal channels are ignored. 2202 allow adjust messages for non-open channels; with and ok djm@ 2203 - (djm) [misc.c] Disable tunnel code for non-OpenBSD (for now), enable 2204 again by providing a sys_tun_open() function for your platform and 2205 setting the CUSTOM_SYS_TUN_OPEN define. More work is required to match 2206 OpenBSD's tunnel protocol, which prepends the address family to the 2207 packet 2208 220920051201 2210 - (djm) [envpass.sh] Remove regress script that was accidentally committed 2211 in top level directory and not noticed for over a year :) 2212 221320051129 2214 - (tim) [ssh-keygen.c] Move DSA length test after setting default when 2215 bits == 0. 2216 - (dtucker) OpenBSD CVS Sync 2217 - dtucker@cvs.openbsd.org 2005/11/29 02:04:55 2218 [ssh-keygen.c] 2219 Populate default key sizes before checking them; from & ok tim@ 2220 - (tim) [configure.ac sshd.8] Enable locked account check (a "*LK*" string) 2221 for UnixWare. 2222 222320051128 2224 - (dtucker) [regress/yes-head.sh] Work around breakage caused by some 2225 versions of GNU head. Based on patch from zappaman at buraphalinux.org 2226 - (dtucker) [includes.h] Bug #1122: __USE_GNU is a glibc internal macro, use 2227 _GNU_SOURCE instead. Patch from t8m at centrum.cz. 2228 - (dtucker) OpenBSD CVS Sync 2229 - dtucker@cvs.openbsd.org 2005/11/28 05:16:53 2230 [ssh-keygen.1 ssh-keygen.c] 2231 Enforce DSA key length of exactly 1024 bits to comply with FIPS-186-2, 2232 increase minumum RSA key size to 768 bits and update man page to reflect 2233 these. Patch originally bz#1119 (senthilkumar_sen at hotpop.com), 2234 ok djm@, grudging ok deraadt@. 2235 - dtucker@cvs.openbsd.org 2005/11/28 06:02:56 2236 [ssh-agent.1] 2237 Update agent socket path templates to reflect reality, correct xref for 2238 time formats. bz#1121, patch from openssh at roumenpetrov.info, ok djm@ 2239 224020051126 2241 - (dtucker) [configure.ac] Bug #1126: AIX 5.2 and 5.3 (and presumably newer, 2242 when they're available) need the real UID set otherwise pam_chauthtok will 2243 set ADMCHG after changing the password, forcing the user to change it 2244 again immediately. 2245 224620051125 2247 - (dtucker) [configure.ac] Apply tim's fix for older systems where the 2248 resolver state in resolv.h is "state" not "__res_state". With slight 2249 modification by me to also work on old AIXes. ok djm@ 2250 - (dtucker) [progressmeter.c scp.c sftp-server.c] Use correct casts for 2251 snprintf formats, fixes warnings on some 64 bit platforms. Patch from 2252 shaw at vranix.com, ok djm@ 2253 225420051124 2255 - (djm) [configure.ac openbsd-compat/Makefile.in openbsd-compat/bsd-asprintf.c 2256 openbsd-compat/bsd-snprintf.c openbsd-compat/openbsd-compat.h] Add an 2257 asprintf() implementation, after syncing our {v,}snprintf() implementation 2258 with some extra fixes from Samba's version. With help and debugging from 2259 dtucker and tim; ok dtucker@ 2260 - (dtucker) [configure.ac] Fix typos in comments and AC_SEARCH_LIB argument 2261 order in Reliant Unix block. Patch from johane at lysator.liu.se. 2262 - (dtucker) [regress/test-exec.sh] Use 1024 bit keys since we generate so 2263 many and use them only once. Speeds up testing on older/slower hardware. 2264 226520051122 2266 - (dtucker) OpenBSD CVS Sync 2267 - deraadt@cvs.openbsd.org 2005/11/12 18:37:59 2268 [ssh-add.c] 2269 space 2270 - deraadt@cvs.openbsd.org 2005/11/12 18:38:15 2271 [scp.c] 2272 avoid close(-1), as in rcp; ok cloder 2273 - millert@cvs.openbsd.org 2005/11/15 11:59:54 2274 [includes.h] 2275 Include sys/queue.h explicitly instead of assuming some other header 2276 will pull it in. At the moment it gets pulled in by sys/select.h 2277 (which ssh has no business including) via event.h. OK markus@ 2278 (ID sync only in -portable) 2279 - dtucker@cvs.openbsd.org 2005/11/21 09:42:10 2280 [auth-krb5.c] 2281 Perform Kerberos calls even for invalid users to prevent leaking 2282 information about account validity. bz #975, patch originally from 2283 Senthil Kumar, sanity checked by Simon Wilkinson, tested by djm@, biorn@, 2284 ok markus@ 2285 - dtucker@cvs.openbsd.org 2005/11/22 03:36:03 2286 [hostfile.c] 2287 Correct format/arguments to debug call; spotted by shaw at vranix.com 2288 ok djm@ 2289 - (dtucker) [loginrec.c] Add casts to prevent compiler warnings, patch 2290 from shaw at vranix.com. 2291 229220051120 2293 - (dtucker) [openbsd-compat/openssl-compat.h] Add comment explaining what 2294 is going on. 2295 229620051112 2297 - (dtucker) [openbsd-compat/getrrsetbyname.c] Restore Portable-specific 2298 ifdef lost during sync. Spotted by tim@. 2299 - (dtucker) [openbsd-compat/{realpath.c,stroll.c,rresvport.c}] $OpenBSD tag. 2300 - (dtucker) [configure.ac] Use "$AWK" instead of "awk" in gcc version test. 2301 - (dtucker) [configure.ac] Remove duplicate utimes() check. ok djm@ 2302 - (dtucker) [regress/reconfigure.sh] Fix potential race in the reconfigure 2303 test: if sshd takes too long to reconfigure the subsequent connection will 2304 fail. Zap pidfile before HUPing sshd which will rewrite it when it's ready. 2305 230620051110 2307 - (dtucker) [openbsd-compat/setenv.c] Merge changes for __findenv from 2308 OpenBSD getenv.c revs 1.4 - 1.8 (ANSIfication of arguments, removal of 2309 "register"). 2310 - (dtucker) [openbsd-compat/setenv.c] Make __findenv static, remove 2311 unnecessary prototype. 2312 - (dtucker) [openbsd-compat/setenv.c] Sync changes from OpenBSD setenv.c 2313 revs 1.7 - 1.9. 2314 - (dtucker) [auth-krb5.c] Fix -Wsign-compare warning in non-Heimdal path. 2315 Patch from djm@. 2316 - (dtucker) [configure.ac] Disable pointer-sign warnings on gcc 4.0+ 2317 since they're not useful right now. Patch from djm@. 2318 - (dtucker) [openbsd-compat/getgrouplist.c] Sync OpenBSD revs 1.10 - 1.2 (ANSI 2319 prototypes, removal of "register"). 2320 - (dtucker) [openbsd-compat/strlcat.c] Sync OpenBSD revs 1.11 - 1.12 (removal 2321 of "register"). 2322 - (dtucker) [openbsd-compat/{LOTS}] Move the "OPENBSD ORIGINAL" markers to 2323 after the copyright notices. Having them at the top next to the CVSIDs 2324 guarantees a conflict for each and every sync. 2325 - (dtucker) [openbsd-compat/strlcpy.c] Update from OpenBSD 1.8 -> 1.10. 2326 - (dtucker) [openbsd-compat/sigact.h] Add "OPENBSD ORIGINAL" marker. 2327 - (dtucker) [openbsd-compat/strmode.c] Update from OpenBSD 1.5 -> 1.7. 2328 Removal of rcsid, "whiteout" inode type. 2329 - (dtucker) [openbsd-compat/basename.c] Update from OpenBSD 1.11 -> 1.14. 2330 Removal of rcsid, will no longer strlcpy parts of the string. 2331 - (dtucker) [openbsd-compat/strtoll.c] Update from OpenBSD 1.4 -> 1.5. 2332 - (dtucker) [openbsd-compat/strtoul.c] Update from OpenBSD 1.5 -> 1.7. 2333 - (dtucker) [openbsd-compat/readpassphrase.c] Update from OpenBSD 1.16 -> 1.18. 2334 - (dtucker) [openbsd-compat/readpassphrase.h] Update from OpenBSD 1.3 -> 1.5. 2335 - (dtucker) [openbsd-compat/glob.c] Update from OpenBSD 1.22 -> 1.25. 2336 - (dtucker) [openbsd-compat/glob.h] Update from OpenBSD 1.8 -> 1.9. 2337 - (dtucker) [openbsd-compat/getcwd.c] Update from OpenBSD 1.9 -> 1.14. 2338 - (dtucker) [openbsd-compat/getcwd.c] Replace lstat with fstat to match up 2339 with OpenBSD code since we don't support platforms without fstat any more. 2340 - (dtucker) [openbsd-compat/inet_aton.c] Update from OpenBSD 1.7 -> 1.9. 2341 - (dtucker) [openbsd-compat/inet_ntoa.c] Update from OpenBSD 1.4 -> 1.6. 2342 - (dtucker) [openbsd-compat/inet_ntop.c] Update from OpenBSD 1.5 -> 1.7. 2343 - (dtucker) [openbsd-compat/daemon.c] Update from OpenBSD 1.5 -> 1.6. 2344 - (dtucker) [openbsd-compat/strsep.c] Update from OpenBSD 1.5 -> 1.6. 2345 - (dtucker) [openbsd-compat/daemon.c] Update from OpenBSD 1.10 -> 1.13. 2346 - (dtucker) [openbsd-compat/mktemp.c] Update from OpenBSD 1.17 -> 1.19. 2347 - (dtucker) [openbsd-compat/rresvport.c] Update from OpenBSD 1.6 -> 1.8. 2348 - (dtucker) [openbsd-compat/bindresvport.c] Add "OPENBSD ORIGINAL" marker. 2349 - (dtucker) [openbsd-compat/bindresvport.c] Update from OpenBSD 1.16 -> 1.17. 2350 - (dtucker) [openbsd-compat/sigact.c] Update from OpenBSD 1.3 -> 1.4. 2351 Id and copyright sync only, there were no substantial changes we need. 2352 - (dtucker) [openbsd-compat/bsd-closefrom.c openbsd-compat/base64.c] 2353 -Wsign-compare fixes from djm. 2354 - (dtucker) [openbsd-compat/sigact.h] Update from OpenBSD 1.2 -> 1.3. 2355 Id and copyright sync only, there were no substantial changes we need. 2356 - (dtucker) [configure.ac] Try to get the gcc version number in a way that 2357 doesn't change between versions, and use a safer default. 2358 235920051105 2360 - (djm) OpenBSD CVS Sync 2361 - markus@cvs.openbsd.org 2005/10/07 11:13:57 2362 [ssh-keygen.c] 2363 change DSA default back to 1024, as it's defined for 1024 bits only 2364 and this causes interop problems with other clients. moreover, 2365 in order to improve the security of DSA you need to change more 2366 components of DSA key generation (e.g. the internal SHA1 hash); 2367 ok deraadt 2368 - djm@cvs.openbsd.org 2005/10/10 10:23:08 2369 [channels.c channels.h clientloop.c serverloop.c session.c] 2370 fix regression I introduced in 4.2: X11 forwardings initiated after 2371 a session has exited (e.g. "(sleep 5; xterm) &") would not start. 2372 bz #1086 reported by t8m AT centrum.cz; ok markus@ dtucker@ 2373 - djm@cvs.openbsd.org 2005/10/11 23:37:37 2374 [channels.c] 2375 bz #1076 set SO_REUSEADDR on X11 forwarding listner sockets, preventing 2376 bind() failure when a previous connection's listeners are in TIME_WAIT, 2377 reported by plattner AT inf.ethz.ch; ok dtucker@ 2378 - stevesk@cvs.openbsd.org 2005/10/13 14:03:01 2379 [auth2-gss.c gss-genr.c gss-serv.c] 2380 remove unneeded #includes; ok markus@ 2381 - stevesk@cvs.openbsd.org 2005/10/13 14:20:37 2382 [gss-serv.c] 2383 spelling in comments 2384 - stevesk@cvs.openbsd.org 2005/10/13 19:08:08 2385 [gss-serv-krb5.c gss-serv.c] 2386 unused declarations; ok deraadt@ 2387 (id sync only for gss-serv-krb5.c) 2388 - stevesk@cvs.openbsd.org 2005/10/13 19:13:41 2389 [dns.c] 2390 unneeded #include, unused declaration, little knf; ok deraadt@ 2391 - stevesk@cvs.openbsd.org 2005/10/13 22:24:31 2392 [auth2-gss.c gss-genr.c gss-serv.c monitor.c] 2393 KNF; ok djm@ 2394 - stevesk@cvs.openbsd.org 2005/10/14 02:17:59 2395 [ssh-keygen.c ssh.c sshconnect2.c] 2396 no trailing "\n" for log functions; ok djm@ 2397 - stevesk@cvs.openbsd.org 2005/10/14 02:29:37 2398 [channels.c clientloop.c] 2399 free()->xfree(); ok djm@ 2400 - stevesk@cvs.openbsd.org 2005/10/15 15:28:12 2401 [sshconnect.c] 2402 make external definition static; ok deraadt@ 2403 - stevesk@cvs.openbsd.org 2005/10/17 13:45:05 2404 [dns.c] 2405 fix memory leaks from 2 sources: 2406 1) key_fingerprint_raw() 2407 2) malloc in dns_read_rdata() 2408 ok jakob@ 2409 - stevesk@cvs.openbsd.org 2005/10/17 14:01:28 2410 [dns.c] 2411 remove #ifdef LWRES; ok jakob@ 2412 - stevesk@cvs.openbsd.org 2005/10/17 14:13:35 2413 [dns.c dns.h] 2414 more cleanups; ok jakob@ 2415 - djm@cvs.openbsd.org 2005/10/30 01:23:19 2416 [ssh_config.5] 2417 mention control socket fallback behaviour, reported by 2418 tryponraj AT gmail.com 2419 - djm@cvs.openbsd.org 2005/10/30 04:01:03 2420 [ssh-keyscan.c] 2421 make ssh-keygen discard junk from server before SSH- ident, spotted by 2422 dave AT cirt.net; ok dtucker@ 2423 - djm@cvs.openbsd.org 2005/10/30 04:03:24 2424 [ssh.c] 2425 fix misleading debug message; ok dtucker@ 2426 - dtucker@cvs.openbsd.org 2005/10/30 08:29:29 2427 [canohost.c sshd.c] 2428 Check for connections with IP options earlier and drop silently. ok djm@ 2429 - jmc@cvs.openbsd.org 2005/10/30 08:43:47 2430 [ssh_config.5] 2431 remove trailing whitespace; 2432 - djm@cvs.openbsd.org 2005/10/30 08:52:18 2433 [clientloop.c packet.c serverloop.c session.c ssh-agent.c ssh-keygen.c] 2434 [ssh.c sshconnect.c sshconnect1.c sshd.c] 2435 no need to escape single quotes in comments, no binary change 2436 - dtucker@cvs.openbsd.org 2005/10/31 06:15:04 2437 [sftp.c] 2438 Fix sorting with "ls -1" command. From Robert Tsai, "looks right" deraadt@ 2439 - djm@cvs.openbsd.org 2005/10/31 11:12:49 2440 [ssh-keygen.1 ssh-keygen.c] 2441 generate a protocol 2 RSA key by default 2442 - djm@cvs.openbsd.org 2005/10/31 11:48:29 2443 [serverloop.c] 2444 make sure we clean up wtmp, etc. file when we receive a SIGTERM, 2445 SIGINT or SIGQUIT when running without privilege separation (the 2446 normal privsep case is already OK). Patch mainly by dtucker@ and 2447 senthilkumar_sen AT hotpop.com; ok dtucker@ 2448 - jmc@cvs.openbsd.org 2005/10/31 19:55:25 2449 [ssh-keygen.1] 2450 grammar; 2451 - dtucker@cvs.openbsd.org 2005/11/03 13:38:29 2452 [canohost.c] 2453 Cache reverse lookups with and without DNS separately; ok markus@ 2454 - djm@cvs.openbsd.org 2005/11/04 05:15:59 2455 [kex.c kex.h kexdh.c kexdhc.c kexdhs.c kexgex.c kexgexc.c kexgexs.c] 2456 remove hardcoded hash lengths in key exchange code, allowing 2457 implementation of KEX methods with different hashes (e.g. SHA-256); 2458 ok markus@ dtucker@ stevesk@ 2459 - djm@cvs.openbsd.org 2005/11/05 05:01:15 2460 [bufaux.c] 2461 Fix leaks in error paths, bz #1109 and #1110 reported by kremenek AT 2462 cs.stanford.edu; ok dtucker@ 2463 - (dtucker) [README.platform] Add PAM section. 2464 - (djm) [openbsd-compat/getrrsetbyname.c] Sync to latest OpenBSD version, 2465 resolving memory leak bz#1111 reported by kremenek AT cs.stanford.edu; 2466 ok dtucker@ 2467 246820051102 2469 - (dtucker) [openbsd-compat/bsd-misc.c] Bug #1108: fix broken strdup(). 2470 Reported by olavi at ipunplugged.com and antoine.brodin at laposte.net 2471 via FreeBSD. 2472 247320051030 2474 - (djm) [contrib/suse/openssh.spec contrib/suse/rc. 2475 sshd contrib/suse/sysconfig.ssh] Bug #1106: Updated SuSE spec and init 2476 files from imorgan AT nas.nasa.gov 2477 - (dtucker) [session.c] Bug #1045do not check /etc/nologin when PAM is 2478 enabled, instead allow PAM to handle it. Note that on platforms using PAM, 2479 the pam_nologin module should be added to sshd's session stack in order to 2480 maintain exising behaviour. Based on patch and discussion from t8m at 2481 centrum.cz, ok djm@ 2482 248320051025 2484 - (dtucker) [configure.ac] Relocate LLONG_MAX calculation to after the 2485 sizeof(long long) checks, to make fixing bug #1104 easier (no changes 2486 yet). 2487 - (dtucker) [configure.ac] Bug #1104: Tru64's printf family doesn't 2488 understand "%lld", even though the compiler has "long long", so handle 2489 it as a special case. Patch tested by mcaskill.scott at epa.gov. 2490 - (dtucker) [contrib/cygwin/ssh-user-config] Remove duplicate yes/no 2491 prompt. Patch from vinschen at redhat.com. 2492 249320051017 2494 - (dtucker) [configure.ac] Bug #1097: Fix configure for cross-compiling. 2495 /etc/default/login report and testing from aabaker at iee.org, corrections 2496 from tim@. 2497 249820051009 2499 - (dtucker) [configure.ac defines.h openbsd-compat/vis.{c,h}] Sync current 2500 versions from OpenBSD. ok djm@ 2501 250220051008 2503 - (dtucker) [configure.ac] Bug #1098: define $MAIL for HP-UX; report from 2504 brian.smith at agilent com. 2505 - (djm) [configure.ac] missing 'test' call for -with-Werror test 2506 250720051005 2508 - (dtucker) [configure.ac sshd.8] Enable locked account check (a prepended 2509 "*LOCKED*" string) for FreeBSD. Patch jeremie at le-hen.org and 2510 senthilkumar_sen at hotpop.com. 2511 251220051003 2513 - (dtucker) OpenBSD CVS Sync 2514 - markus@cvs.openbsd.org 2005/09/07 08:53:53 2515 [channels.c] 2516 enforce chanid != NULL; ok djm 2517 - markus@cvs.openbsd.org 2005/09/09 19:18:05 2518 [clientloop.c] 2519 typo; from mark at mcs.vuw.ac.nz, bug #1082 2520 - djm@cvs.openbsd.org 2005/09/13 23:40:07 2521 [sshd.c ssh.c misc.h sftp.c ssh-keygen.c ssh-keysign.c sftp-server.c 2522 scp.c misc.c ssh-keyscan.c ssh-add.c ssh-agent.c] 2523 ensure that stdio fds are attached; ok deraadt@ 2524 - djm@cvs.openbsd.org 2005/09/19 11:37:34 2525 [ssh_config.5 ssh.1] 2526 mention ability to specify bind_address for DynamicForward and -D options; 2527 bz#1077 spotted by Haruyama Seigo 2528 - djm@cvs.openbsd.org 2005/09/19 11:47:09 2529 [sshd.c] 2530 stop connection abort on rekey with delayed compression enabled when 2531 post-auth privsep is disabled (e.g. when root is logged in); ok dtucker@ 2532 - djm@cvs.openbsd.org 2005/09/19 11:48:10 2533 [gss-serv.c] 2534 typo 2535 - jmc@cvs.openbsd.org 2005/09/19 15:38:27 2536 [ssh.1] 2537 some more .Bk/.Ek to avoid ugly line split; 2538 - jmc@cvs.openbsd.org 2005/09/19 15:42:44 2539 [ssh.c] 2540 update -D usage here too; 2541 - djm@cvs.openbsd.org 2005/09/19 23:31:31 2542 [ssh.1] 2543 spelling nit from stevesk@ 2544 - djm@cvs.openbsd.org 2005/09/21 23:36:54 2545 [sshd_config.5] 2546 aquire -> acquire, from stevesk@ 2547 - djm@cvs.openbsd.org 2005/09/21 23:37:11 2548 [sshd.c] 2549 change label at markus@'s request 2550 - jaredy@cvs.openbsd.org 2005/09/30 20:34:26 2551 [ssh-keyscan.1] 2552 deploy .An -nosplit; ok jmc 2553 - dtucker@cvs.openbsd.org 2005/10/03 07:44:42 2554 [canohost.c] 2555 Relocate check_ip_options call to prevent logging of garbage for 2556 connections with IP options set. bz#1092 from David Leonard, 2557 "looks good" deraadt@ 2558 - (dtucker) [regress/README.regress] Bug #989: Document limitation that scp 2559 is required in the system path for the multiplex test to work. 2560 256120050930 2562 - (dtucker) [openbsd-compat/openbsd-compat.h] Bug #1096: Add prototype 2563 for strtoll. Patch from o.flebbe at science-computing.de. 2564 - (dtucker) [monitor.c] Bug #1087: Send loginmsg to preauth privsep 2565 child during PAM account check without clearing it. This restores the 2566 post-login warnings such as LDAP password expiry. Patch from Tomas Mraz 2567 with help from several others. 2568 256920050929 2570 - (dtucker) [monitor_wrap.c] Remove duplicate definition of loginmsg 2571 introduced during sync. 2572 257320050928 2574 - (dtucker) [entropy.c] Use u_char for receiving RNG seed for consistency. 2575 - (dtucker) [auth-pam.c] Bug #1028: send final non-query messages from 2576 PAM via keyboard-interactive. Patch tested by the folks at Vintela. 2577 257820050927 2579 - (dtucker) [entropy.c] Remove unnecessary tests for getuid and geteuid 2580 calls, since they can't possibly fail. ok djm@ 2581 - (dtucker) [entropy.c entropy.h sshd.c] Pass RNG seed to the reexec'ed 2582 process when sshd relies on ssh-random-helper. Should result in faster 2583 logins on systems without a real random device or prngd. ok djm@ 2584 258520050924 2586 - (dtucker) [auth2.c] Move start_pam() calls out of if-else block to remove 2587 duplicate call. ok djm@ 2588 258920050922 2590 - (dtucker) [configure.ac] Use -R linker flag for libedit too; patch from 2591 skeleten at shillest.net. 2592 - (dtucker) [configure.ac] Fix help for --with-opensc; patch from skeleten at 2593 shillest.net. 2594 259520050919 2596 - (tim) [aclocal.m4 configure.ac] Delete acconfig.h and add templates to 2597 AC_DEFINE and AC_DEFINE_UNQUOTED to quiet autoconf 2.59 warning messages. 2598 ok dtucker@ 2599 260020050912 2601 - (tim) [configure.ac] Bug 1078. Fix --without-kerberos5. Reported by 2602 Mike Frysinger. 2603 260420050908 2605 - (tim) [defines.h openbsd-compat/port-uw.c] Add long password support to 2606 OpenServer 6 and add osr5bigcrypt support so when someone migrates 2607 passwords between UnixWare and OpenServer they will still work. OK dtucker@ 2608 2609$Id: ChangeLog,v 1.4588.2.1 2006/11/07 13:02:59 dtucker Exp $ 2610