summaryrefslogtreecommitdiffstats
path: root/usr.bin/ssh/readconf.c (follow)
Commit message (Collapse)AuthorAgeFilesLines
* highly polished whitespace, mostly fixing spaces-for-tab and baddjm2021-04-031-4/+4
| | | | indentation on continuation lines. Prompted by GHPR#185
* Put obsolete aliases for hostbasedalgorithms and pubkeyacceptedalgorithmsdtucker2021-02-241-3/+3
| | | | | after their current names so that the config-dump mode finds and uses the current names. Spotted by Phil Pennock.
* ssh: add PermitRemoteOpen for remote dynamic forwarding with SOCKSmarkus2021-02-151-3/+60
| | | | ok djm@, dtucker@
* Rename HostbasedKeyTypes (ssh) and HostbasedAcceptedKeyTypes (sshd) todtucker2021-01-261-9/+10
| | | | | | HostbasedAcceptedAlgorithms, which more accurately reflects its effect. This matches a previous change to PubkeyAcceptedAlgorithms. The previous names are retained as aliases. ok djm@
* Rename PubkeyAcceptedKeyTypes keyword to PubkeyAcceptedAlgorithms.dtucker2021-01-221-13/+14
| | | | | | | | While the two were originally equivalent, this actually specifies the signature algorithms that are accepted. Some key types (eg RSA) can be used by multiple algorithms (eg ssh-rsa, rsa-sha2-512) so the old name is becoming increasingly misleading. The old name is retained as an alias. Prompted by bz#3253, help & ok djm@, man page help jmc@
* make CheckHostIP default to 'no'. It doesn't provide any perceptibledjm2021-01-081-2/+2
| | | | | | | value and makes it much harder for hosts to change host keys, particularly ones that use IP-based load-balancing. ok dtucker@
* Remove lines accidentally left behind in the ProxyJump parsing fix r1.345.tb2020-12-221-4/+1
| | | | ok djm
* add a ssh_config KnownHostsCommand that allows the client to obtaindjm2020-12-221-2/+10
| | | | | | | | | | | known_hosts data from a command in addition to the usual files. The command accepts bunch of %-expansions, including details of the connection and the offered server host key. Note that the command may be invoked up to three times per connection (see the manpage for details). ok markus@
* properly fix ProxyJump parsing; Thanks to tb@ for pointing out my errordjm2020-12-211-4/+9
| | | | | | | (parse_ssh_uri() can return -1/0/1, that I missed). Reported by Raf Czlonka via bugs@ ok tb@
* prepare readconf.c for fuzzing; remove fatal calls and fix somedjm2020-12-171-155/+404
| | | | (one-off) memory leaks; ok markus@
* Ignore comments at the end of config lines in ssh_config, similar to whatdtucker2020-11-301-2/+9
| | | | we already do for sshd_config. bz#2320, with & ok djm@
* revert r1.341; it breaks ProxyJump; reported by sthen@djm2020-11-151-3/+3
|
* fix logic error that broke URI parsing in ProxyJump directives;djm2020-11-111-3/+3
| | | | ok dtucker@
* use the new variant log macros instead of prepending __func__ anddjm2020-10-181-12/+11
| | | | appending ssh_err(r) manually; ok markus@
* LogVerbose keyword for ssh and sshddjm2020-10-161-3/+20
| | | | | | | Allows forcing maximum debug logging by file/function/line pattern- lists. ok markus@
* disable UpdateHostkeys by default if VerifyHostKeyDNS is enabled;djm2020-10-071-3/+4
| | | | suggested by Mark D. Baushke
* There are lots of place where we want to redirect stdin, stdoutdjm2020-10-031-15/+4
| | | | | | and/or stderr to /dev/null. Factor all these out to a single stdfd_devnull() function that allows selection of which of these to redirect. ok markus@
* enable UpdateHostkeys by default when the configuration has notdjm2020-10-031-2/+8
| | | | | overridden UserKnownHostsFile; ok markus@ "The timing is perfect" deraadt@
* remove unreachable code I forgot to delete in r1.334djm2020-08-271-13/+1
|
* let ssh_config(5)'s AddKeysToAgent keyword accept a time limit fordjm2020-08-111-17/+68
| | | | | | keys in addition to its current flag options. Time-limited keys will automatically be removed from ssh-agent after their expiry time has passed; ok markus@
* Add %k to the TOKENs for Match Exec for consistency with the other keywordsdtucker2020-07-171-2/+5
| | | | that recently got %k.
* some language improvements; ok markusdjm2020-07-051-6/+6
|
* Allow some keywords to expand shell-style ${ENV} environmentdtucker2020-05-291-4/+16
| | | | | | | | variables on the client side. The supported keywords are CertificateFile, ControlPath, IdentityAgent and IdentityFile, plus LocalForward and RemoteForward when used for Unix domain socket paths. This would for example allow forwarding of Unix domain socket paths that change at runtime. bz#3140, ok djm@
* fix crash in recallocarray when deleting SendEnv variables;djm2020-05-271-2/+7
| | | | spotted by & ok sthen@
* Fix incorrect error message for "too many known hosts files." bz#3149, patchdtucker2020-04-241-2/+2
| | | | from jjelen at redhat.com.
* %C expansion just added to Match Exec should include remote user not localdtucker2020-04-031-2/+2
| | | | user.
* Make with config keywords support which percent_expansions more consistent.dtucker2020-04-031-1/+25
| | | | | | | | | | | - %C is moved into its own function and added to Match Exec. - move the common (global) options into a macro. This is ugly but it's the least-ugly way I could come up with. - move IdentityAgent and ForwardAgent percent expansion to before the config dump to make it regression-testable. - document all of the above ok jmc@ for man page bits, "makes things less terrible" djm@ for the rest.
* expand HostkeyAlgorithms prior to config dump, matching otherdjm2020-02-061-3/+15
| | | | algorithm lists; ok markus@
* revert enabling UpdateHostKeys by default - there are still corner casesdjm2020-02-031-14/+3
| | | | we need to address; ok markus
* enable UpdateKnownHosts=yes if the configuration specifies only thedjm2020-01-301-3/+14
| | | | | default known_hosts files, otherwise select UpdateKnownHosts=ask; ok markus@
* set UpdateKnownHosts=ask by default; bz#2894; ok markus@djm2020-01-251-2/+2
|
* Make zlib optional. This adds a "ZLIB" build time option that allowsdtucker2020-01-231-2/+10
| | | | | building without zlib compression and associated options. With feedback from markus@, ok djm@
* Replace all calls to signal(2) with a wrapper around sigaction(2).dtucker2020-01-231-2/+2
| | | | | | This wrapper blocks all other signals during the handler preventing races between handlers, and sets SA_RESTART which should reduce the potential for short read/write operations.
* Remove unsupported algorithms from list of defaults at run time anddtucker2020-01-231-19/+34
| | | | | | | | remove ifdef and distinct settings for OPENSSL=no case. This will make things much simpler for -portable where the exact set of algos depends on the configuration of both OpenSSH and the libcrypto it's linked against (if any). ok djm@
* Allow forwarding a different agent socket to the path specified bydjm2019-12-211-6/+37
| | | | | | | | $SSH_AUTH_SOCK, by extending the existing ForwardAgent option to accepting an explicit path or the name of an environment variable in addition to yes/no. Patch by Eric Chiang, manpage by me; ok markus@
* Move always unsupported keywords to be grouped with the other ones.dtucker2019-12-201-5/+5
| | | | | Move oSecurityProvider to match the order in the OpCodes enum. Patch from openbsd@academicsolutions.ch, ok djm@
* Remove obsolete opcodes from the configuation enum. Patch fromdtucker2019-12-201-6/+6
| | | | openbsd@academicsolutions.ch, ok djm@
* Remove now-obsolete config options from example in comment. Patch fromdtucker2019-12-201-3/+1
| | | | openbsd@academicsolutions.ch, ok djm@
* allow security keys to act as host keys as well as user keys.djm2019-12-151-2/+2
| | | | | | | | | Previously we didn't do this because we didn't want to expose the attack surface presented by USB and FIDO protocol handling, but now that this is insulated behind ssh-sk-helper there is less risk. ok markus@
* directly support U2F/FIDO2 security keys in OpenSSH by linkingdjm2019-11-141-2/+2
| | | | | | against the (previously external) USB HID middleware. The dlopen() capability still exists for alternate middlewares, e.g. for Bluetooth, NFC and test/debugging.
* remove size_t gl_pathc < 0 test, it is invalid. the return value fromderaadt2019-11-131-3/+3
| | | | | glob() is sufficient. discussed with djm
* stdarg.h required more broadly; ok djmderaadt2019-11-131-1/+2
|
* enable ed25519 support; ok djmmarkus2019-11-121-1/+3
|
* ssh client support for U2F/FIDO keysdjm2019-10-311-2/+15
|
* Allow prepending a list of algorithms to the default set by startingnaddy2019-09-061-5/+9
| | | | | | | | | the list with the '^' character, e.g. HostKeyAlgorithms ^ssh-ed25519 Ciphers ^aes128-gcm@openssh.com,aes256-gcm@openssh.com ok djm@ dtucker@
* produce a useful error message if the user's shell is set incorrectlydjm2019-08-091-1/+6
| | | | | during "match exec" processing. bz#2791 reported by Dario Bertini; ok dtucker
* When system calls indicate an error they return -1, not some arbitraryderaadt2019-06-281-2/+2
| | | | | | value < 0. errno is only updated in this case. Change all (most?) callers of syscalls to follow this better, and let's see if this strictness helps us in the future.
* Hostname->HostName cleanup; from lauri tirkkonenjmc2019-06-121-6/+6
| | | | ok dtucker
* Typo and spelling fixes in comments and error messages. Patch fromdtucker2019-06-071-2/+2
| | | | knweiss at gmail.com via -portable.
* let PKCS11Provider=none do what users expectdjm2019-03-011-2/+3
| | | | | | print PKCS11Provider instead of obsolete SmartcardDevice in config dump. bz#2974 ok dtucker@
Copyright © 1996 – 2023 Jason A. Donenfeld. All Rights Reverse Engineered.