summaryrefslogtreecommitdiffstats
path: root/usr.bin/ssh/readconf.c (follow)
Commit message (Collapse)AuthorAgeFilesLines
* Fix printing (ssh -G ...) of HostKeyAlgorithms=+...djm2015-08-211-2/+6
| | | | Reported by Bryan Drewery
* Allow ssh_config and sshd_config kex parameters options be prefixeddjm2015-07-301-12/+13
| | | | | | | by a '+' to indicate that the specified items be appended to the default rather than replacing it. approach suggested by dtucker@, feedback dlg@, ok markus@
* Turn off DSA by default; add HostKeyAlgorithms to the server andmarkus2015-07-101-17/+20
| | | | | PubkeyAcceptedKeyTypes to the client side, so it still can be tested or turned back on; feedback and ok djm@
* Fix \-escaping bug that caused forward path parsing to skip twodjm2015-06-261-2/+3
| | | | | | characters and skip past the end of the string. Based on patch by Salvador Fandino; ok dtucker@
* Reorder EscapeChar option parsing to avoid a single-byte out-djm2015-05-221-6/+6
| | | | of-bounds read. bz#2396 from Jaak Ristioja; ok dtucker@
* Remove pattern length argument from match_pattern_list(),djm2015-05-041-9/+7
| | | | | | | | | | we only ever use it for strlen(pattern). Prompted by hanno AT hboeck.de pointing an out-of-bound read error caused by an incorrect pattern length found using AFL and his own tools. ok markus@
* rename xrealloc() to xreallocarray() since it follows that form.deraadt2015-04-241-3/+3
| | | | ok djm
* fix uninitialised memory read when parsing a config file consistingdjm2015-03-301-2/+4
| | | | | of a single nul byte. Found by hanno AT hboeck.de using AFL; ok dtucker
* Revise hostkeys@openssh.com hostkey learning extension.djm2015-02-161-2/+4
| | | | | | | | | | The client will not ask the server to prove ownership of the private halves of any hitherto-unseen hostkeys it offers to the client. Allow UpdateHostKeys option to take an 'ask' argument to let the user manually review keys offered. ok markus@
* turn UpdateHostkeys off by default until I figure out mlarkin@'sdjm2015-02-021-2/+2
| | | | warning message; requested by deraadt@
* Add a ssh_config HostbasedKeyType option to control whichdjm2015-01-301-3/+22
| | | | | | | | | host public key types are tried during hostbased authentication. This may be used to prevent too many keys being sent to the server, and blowing past its MaxAuthTries limit. bz#2211 based on patch by Iain Morgan; ok markus@
* Host key rotation support.djm2015-01-261-2/+11
| | | | | | | | | | | | | Add a hostkeys@openssh.com protocol extension (global request) for a server to inform a client of all its available host key after authentication has completed. The client may record the keys in known_hosts, allowing it to upgrade to better host key algorithms and a server to gracefully rotate its keys. The client side of this is controlled by a UpdateHostkeys config option (default on). ok markus@
* Replace <sys/param.h> with <limits.h> and other less dirty headers wherederaadt2015-01-161-1/+2
| | | | | | | | | possible. Annotate <sys/param.h> lines with their current reasons. Switch to PATH_MAX, NGROUPS_MAX, HOST_NAME_MAX+1, LOGIN_NAME_MAX, etc. Change MIN() and MAX() to local definitions of MINIMUM() and MAXIMUM() where sensible to avoid pulling in the pollution. These are the files confirmed through binary verification. ok guenther, millert, doug (helped with the verification protocol)
* sync ssh-keysign, ssh-keygen and some dependencies to the newdjm2015-01-151-3/+2
| | | | buffer/key API; mostly mechanical, ok markus@
* add sshd_config HostbasedAcceptedKeyTypes and PubkeyAcceptedKeyTypesdjm2015-01-131-2/+2
| | | | | options to allow sshd to control what public key types will be accepted. Currently defaults to all. Feedback & ok markus@
* fix ssh_config FingerprintHash evaluation order; from Petr Lautrbachdjm2015-01-081-3/+4
|
* Add FingerprintHash option to control algorithm used for keydjm2014-12-211-1/+23
| | | | | | | fingerprints. Default changes from MD5 to SHA256 and format from hex to base64. Feedback and ok naddy@ markus@
* add RevokedHostKeys option for the clientdjm2014-12-041-2/+10
| | | | Allow textfile or KRL-based revocation of hostkeys.
* Remove unnecessary include: netinet/in_systm.h is not needed by theselteo2014-10-241-2/+1
| | | | | | programs. ok deraadt@ millert@
* Tweak config reparsing with host canonicalisationdjm2014-10-081-68/+380
| | | | | | | | | | | | | | | | Make the second pass through the config files always run when hostname canonicalisation is enabled. Add a "Match canonical" criteria that allows ssh_config Match blocks to trigger only in the second config pass. Add a -G option to ssh that causes it to parse its configuration and dump the result to stdout, similar to "sshd -T" Allow ssh_config Port options set in the second config parse phase to be applied (they were being ignored). bz#2267 bz#2286; ok markus
* Add support for Unix domain socket forwarding. A remote TCP portmillert2014-07-151-38/+186
| | | | | | | | may be forwarded to a local Unix domain socket and vice versa or both ends may be a Unix domain socket. This is a reimplementation of the streamlocal patches by William Ahern from: http://www.25thandclement.com/~william/projects/streamlocal.html OK djm@ markus@
* don't record duplicate IdentityFilesdjm2014-04-231-1/+12
|
* reparse ssh_config and ~/.ssh/config if hostname canonicalisation changesdjm2014-02-231-3/+24
| | | | | | | | | | | | | | | | the hostname. This allows users to write configurations that always refer to canonical hostnames, e.g. CanonicalizeHostname yes CanonicalDomains int.example.org example.org CanonicalizeFallbackLocal no Host *.int.example.org Compression off Host *.example.org User djm ok markus@
* when processing Match blocks, skip 'exec' clauses if previous predicatesdjm2014-02-221-10/+21
| | | | failed to match; ok markus@
* remove experimental, never-enabled JPAKE code; ok markus@djm2014-01-291-15/+2
|
* support ed25519 keys (hostkeys and user identities) using the public domainmarkus2013-12-061-1/+3
| | | | | ed25519 reference code from SUPERCOP, see http://ed25519.cr.yp.to/software.html feedback, help & ok djm@
* unsigned casts for ctype macros where neccessaryderaadt2013-11-201-2/+2
| | | | ok guenther millert markus
* Disallow empty Match statements and add "Match all" which matches everything.dtucker2013-10-241-2/+20
| | | | ok djm, man page help jmc@
* commentdjm2013-10-231-1/+2
|
* Hostname may have %h sequences that should be expanded prior to Matchdjm2013-10-231-6/+14
| | | | evaluation; spotted by Iain Morgan
* rename "command" subclause of the recently-added "Match" keyword todjm2013-10-201-4/+4
| | | | | | "exec"; it's shorter, clearer in intent and we might want to add the ability to match against the command being executed at the remote end in the future.
* s/canonicalise/canonicalize/ for consistency with existing spelling,djm2013-10-161-25/+25
| | | | e.g. authorized_keys; pointed out by naddy@
* Implement client-side hostname canonicalisation to allow an explicitdjm2013-10-161-1/+112
| | | | | | | | | | search path of domain suffixes to use to convert unqualified host names to fully-qualified ones for host key matching. This is particularly useful for host certificates, which would otherwise need to list unqualified names alongside fully-qualified ones (and this causes a number of problems). "looks fine" markus@
* refactor client config code a little:djm2013-10-141-104/+95
| | | | | | | | | | | | add multistate option partsing to readconf.c, similar to servconf.c's existing code. move checking of options that accept "none" as an argument to readconf.c add a lowercase() function and use it instead of explicit tolower() in loops part of a larger diff that was ok markus@
* add a "Match" keyword to ssh_config that allows matching on hostname,djm2013-10-141-12/+215
| | | | user and result of arbitrary commands. "nice work" markus@
* Add a ssh_config ProxyUseFDPass option that supports the use ofdjm2013-08-201-2/+10
| | | | | | | | ProxyCommands that establish a connection and then pass a connected file descriptor back to ssh(1). This allows the ProxyCommand to exit rather than have to shuffle data back and forth and enables ssh to use getpeername, etc. to obtain address information just like it does with regular directly-connected sockets. ok markus@
* revert 1.203 while we investigate crashes reported by okan@dtucker2013-06-101-3/+1
|
* plug another memleak. bz#1967, from Zhenbo Xu, detected by Melton, ok djmdtucker2013-06-051-1/+3
|
* bye, bye xfree(); ok markus@djm2013-05-171-18/+12
|
* remove now-unused variablesdtucker2013-05-161-3/+3
|
* switch RekeyLimit traffic volume parsing to scan_scaled. ok djm@dtucker2013-05-161-28/+7
|
* add the ability to ignore specific unrecognised ssh_config options;djm2013-05-161-9/+26
| | | | bz#866; ok markus@
* Add an optional second argument to RekeyLimit in the client to allowdtucker2013-05-161-31/+49
| | | | | rekeying based on elapsed time in addition to amount of traffic. with djm@ jmc@, ok djm
* g/c unused variable (-Wunused)djm2013-03-061-3/+1
|
* Don't complain if IdentityFiles specified in system-wide configs are missing.dtucker2013-02-221-6/+7
| | | | ok djm, deraadt.
* Keep track of which IndentityFile options were manually supplied and whichdtucker2013-02-171-26/+30
| | | | were default options, and don't warn if the latter are missing. ok markus@
* unbreak remote portforwarding with dynamic allocated listen ports:markus2011-09-231-1/+2
| | | | | | | | | 1) send the actual listen port in the open message (instead of 0). this allows multiple forwardings with a dynamic listen port 2) update the matching permit-open entry, so we can identify where to connect to report: den at skbkontur.ru and P. Szczygielski feedback and ok djm@
* Remove undocumented legacy options UserKnownHostsFile2 anddjm2011-05-241-29/+40
| | | | | | GlobalKnownHostsFile2 by making UserKnownHostsFile/GlobalKnownHostsFile accept multiple paths per line and making their defaults include known_hosts2; ok markus
* Add a RequestTTY ssh_config option to allow configuration-baseddjm2011-05-061-2/+26
| | | | control over tty allocation (like -t/-T); ok markus@
* support negated Host matching, e.g.djm2011-05-061-5/+21
| | | | | | | | Host *.example.org !c.example.org User mekmitasdigoat Will match "a.example.org", "b.example.org", but not "c.example.org" ok markus@
Copyright © 1996 – 2023 Jason A. Donenfeld. All Rights Reverse Engineered.