| Commit message (Collapse) | Author | Age | Files | Lines | |
|---|---|---|---|---|---|
| * | Remove crc32.{c,h} which were only used by the now-gone SSH1 protocol. |   dtucker | 2019-04-18 | 1 | -2/+1 |
| | | | | | Patch from yumkam at gmail.com, ok deraadt. | ||||
| * | merge kexkem[cs] into kexgen |   djm | 2019-01-21 | 1 | -6/+4 |
| | | | | | from markus@ ok djm@ | ||||
| * | use KEM API for vanilla ECDH | djm | 2019-01-21 | 1 | -3/+1 |
| | | | | | from markus@ ok djm@ | ||||
| * | use KEM API for vanilla DH KEX | djm | 2019-01-21 | 1 | -3/+1 |
| | | | | | from markus@ ok djm@ | ||||
| * | use KEM API for vanilla c25519 KEX | djm | 2019-01-21 | 1 | -3/+1 |
| | | |||||
| * | Add support for a PQC KEX/KEM: sntrup4591761x25519-sha512@tinyssh.org | djm | 2019-01-21 | 1 | -1/+6 |
| | | | | | | | | | | using the Streamlined NTRU Prime 4591^761 implementation from SUPERCOP coupled with X25519 as a stop-loss. Not enabled by default. introduce KEM API; a simplified framework for DH-ish KEX methods. from markus@ feedback & ok djm@ | ||||
| * | remove last traces of old packet API! | djm | 2019-01-19 | 1 | -2/+1 |
| | | | | | with & ok markus@ | ||||
| * | Remove support for running ssh(1) setuid and fatal if attempted. | dtucker | 2018-07-18 | 1 | -2/+1 |
| | | | | | | Do not link uidwap.c into ssh any more. Neuters UsePrivilegedPort, which will be marked as deprecated shortly. ok markus@ djm@ | ||||
| * | remove legacy buffer API emulation layer; ok djm@ |   markus | 2018-07-09 | 1 | -5/+1 |
| | | |||||
| * | Add experimental support for PQC XMSS keys (Extended Hash-Based Signatures) | markus | 2018-02-23 | 1 | -1/+13 |
| | | | | | | | | The code is not compiled in by default (see WITH_XMSS in Makefile.inc) Joint work with stefan-lukas_gazdag at genua.eu See https://tools.ietf.org/html/draft-irtf-cfrg-xmss-hash-based-signatures-12 ok djm@ | ||||
| * | group shared source files (e.g. SRCS_KEX) and allow compilation w/o OPENSSL | markus | 2018-01-08 | 1 | -1/+86 |
| | | | | | ok djm@ | ||||
| * | ssh/lib hasn't worked towards our code-sharing goals for a quit while, |   deraadt | 2017-12-10 | 1 | -11/+1 |
| | | | | | | | | | | perhaps it is too verbose? Change each */Makefile to specifying exactly what sources that program requires, compiling it seperate. Maybe we'll iterate by sorting those into seperatable chunks, splitting up files which contain common code + server/client specific code, or whatnot. But this isn't one step, or we'd have done it a long time ago.. ok dtucker markus djm | ||||
| * | rationalise the long list of manual CDIAGFLAGS that we add; most of | djm | 2017-06-02 | 1 | -17/+4 |
| | | | | | these were redundant to -Wall -Wextra | ||||
| * | undo some local debugging stuff that I committed by accident | djm | 2017-04-30 | 1 | -7/+15 |
| | | |||||
| * | remove SSH1 make flag and associated files | djm | 2017-04-30 | 1 | -8/+1 |
| | | | | | ok markus@ | ||||
| * | unifdef WITH_SSH1 | djm | 2017-04-30 | 1 | -15/+6 |
| | | | | | ok markus@ | ||||
| * | Change COMPILER_VERSION tests which limited additional warnings to gcc4 |   jsg | 2017-04-17 | 1 | -2/+2 |
| | | | | | | to instead skip them on gcc3 as clang can handle -Wpointer-sign and -Wold-style-definition. | ||||
| * | Compile-time disable SSH v.1 again | djm | 2015-07-01 | 1 | -2/+2 |
| | | |||||
| * | put back SSH1 for now - we want to make sure we don't regress | djm | 2015-05-29 | 1 | -2/+2 |
| | | | | | it for the 6.9 release; ok deraadt@ | ||||
| * | Compile-time disable SSH protocol 1. You can turn it back on using | djm | 2015-03-24 | 1 | -2/+2 |
| | | | | | the Makefile.inc knob if you need it to talk to ancient devices. | ||||
| * | add SSH1 Makefile knob to make it easier to build without SSH1 support; | djm | 2015-03-03 | 1 | -2/+11 |
| | | | | | ok markus@ | ||||
| * | make compiling against OpenSSL optional (make OPENSSL=no); | markus | 2014-04-29 | 1 | -1/+6 |
| | | | | | | reduces algorithms to curve25519, aes-ctr, chacha, ed25519; allows us to explore further options; with and ok djm | ||||
| * | ssh has a target painted on it's back, so use -fstack-protector-all | deraadt | 2014-03-31 | 1 | -1/+2 |
| | | | | | dtucker mentioned that -portable does this | ||||
| * | Absolutely do not override base system build features in this file!! | deraadt | 2014-02-28 | 1 | -2/+1 |
| | | | | | Discovered by miod. | ||||
| * | -Wold-style-declaration is not supported by gcc 3. |   miod | 2014-02-07 | 1 | -2/+5 |
| | | |||||
| * | remove experimental, never-enabled JPAKE code; ok markus@ | djm | 2014-01-29 | 1 | -7/+26 |
| | | |||||
| * | Remove -Wbounded: it is now the compiler default. |   martynas | 2014-01-18 | 1 | -2/+1 |
| | | |||||
| * | new private key format, bcrypt as KDF by default; details in PROTOCOL.key; | markus | 2013-12-06 | 1 | -1/+3 |
| | | | | | feedback and lots help from djm; ok djm@ | ||||
| * | turn off -g too | djm | 2010-10-01 | 1 | -2/+2 |
| | | |||||
| * | oops, didn't mean to turn -Werror on for everyone. | djm | 2010-10-01 | 1 | -2/+2 |
| | | |||||
| * | adapt to API changes in openssl-1.0.0a | djm | 2010-10-01 | 1 | -4/+4 |
| | | |||||
| * | unbreak build for NOPIC systems; noticed, help and ok deraadt@ | markus | 2010-02-20 | 1 | -1/+5 |
| | | |||||
| * | enable PKCS#11 code; ok djm | markus | 2010-02-09 | 1 | -2/+2 |
| | | |||||
| * | replace our obsolete smartcard code with PKCS#11. | markus | 2010-02-08 | 1 | -3/+2 |
| | | | | | | | | | | ftp://ftp.rsasecurity.com/pub/pkcs/pkcs-11/v2-20/pkcs-11v2-20.pdf ssh(1) and ssh-keygen(1) use dlopen(3) directly to talk to a PKCS#11 provider (shared library) while ssh-agent(1) delegates PKCS#11 to a forked a ssh-pkcs11-helper process. PKCS#11 is currently a compile time option. feedback and ok djm@; inspired by patches from Alon Bar-Lev | ||||
| * | Add support for an experimental zero-knowledge password authentication | djm | 2008-11-04 | 1 | -1/+3 |
| | | | | | | | | | | | | | | | | | method using the J-PAKE protocol described in F. Hao, P. Ryan, "Password Authenticated Key Exchange by Juggling", 16th Workshop on Security Protocols, Cambridge, April 2008. This method allows password-based authentication without exposing the password to the server. Instead, the client and server exchange cryptographic proofs to demonstrate of knowledge of the password while revealing nothing useful to an attacker or compromised endpoint. This is experimental, work-in-progress code and is presently compiled-time disabled (turn on -DJPAKE in Makefile.inc). "just commit it. It isn't too intrusive." deraadt@ | ||||
| * | revert accidental commit (nearly 2 months ago!) that | djm | 2008-06-28 | 1 | -3/+3 |
| | | | | | unconditionally enabled -Werror and -g | ||||
| * | Make the maximum number of sessions run-time controllable via | djm | 2008-05-08 | 1 | -3/+3 |
| | | | | | | | | | | | | | | | | | | a sshd_config MaxSessions knob. This is useful for disabling login/shell/subsystem access while leaving port-forwarding working (MaxSessions 0), disabling connection multiplexing (MaxSessions 1) or simply increasing the number of allows multiplexed sessions. Because some bozos are sure to configure MaxSessions in excess of the number of available file descriptors in sshd (which, at peak, might be as many as 9*MaxSessions), audit sshd to ensure that it doesn't leak fds on error paths, and make it fail gracefully on out-of-fd conditions - sending channel errors instead of than exiting with fatal(). bz#1090; MaxSessions config bits and manpage from junyer AT gmail.com ok markus@ | ||||
| * | turn on -Wstrict-prototypes -Wsign-compare -Wshadow now that we are clean | djm | 2005-06-17 | 1 | -4/+4 |
| | | |||||
| * | comment out -Wshadow for now, gcc2 sucks. noticed by markus |   avsm | 2004-06-21 | 1 | -2/+2 |
| | | |||||
| * | make ssh -Wshadow clean, no functional changes | avsm | 2004-06-21 | 1 | -1/+2 |
| | | | | | markus@ ok | ||||
| * | include SSHFP lookup code (not enabled by default). ok markus@ |   jakob | 2003-10-14 | 1 | -3/+1 |
| | | |||||
| * | replace fatal_cleanup() and linked list of fatal callbacks with static | markus | 2003-09-23 | 1 | -2/+2 |
| | | | | | | | cleanup_exit() function. re-refine cleanup_exit() where appropriate, allocate sshd's authctxt eary to allow simpler cleanup in sshd. tested by many, ok deraadt@ | ||||
| * | more buffer allocation fixes; from Solar Designer; CAN-2003-0682; ok millert@ | markus | 2003-09-18 | 1 | -1/+3 |
| | | |||||
| * | add experimental support for verifying hos keys using DNS as described | jakob | 2003-05-14 | 1 | -1/+3 |
| | | | | | | in draft-ietf-secsh-dns-xx.txt. more information in README.dns. ok markus@ and henning@ | ||||
| * | undo | markus | 2002-03-06 | 1 | -2/+2 |
| | | |||||
| * | compat.c | markus | 2002-03-06 | 1 | -2/+2 |
| | | |||||
| * | undo (disable debug again) | markus | 2001-10-30 | 1 | -2/+2 |
| | | |||||
| * | ssh.1 | markus | 2001-10-30 | 1 | -2/+2 |
| | | |||||
| * | typo, add -Wunused | markus | 2001-07-29 | 1 | -2/+3 |
| | | |||||
| * | CDIAGFLAGS. Okay markus@ |   espie | 2001-07-26 | 1 | -7/+7 |
| | | |||||
 |
index : wireguard-openbsd | |
| WireGuard implementation for the OpenBSD kernel | Matt Dunwoodie |
| summaryrefslogtreecommitdiffstats |