| Commit message (Collapse) | Author | Age | Files | Lines | |
|---|---|---|---|---|---|
| * | fixed unlink([uninitialised memory]) reported by Mateusz Kocielski; |   djm | 2015-08-19 | 1 | -2/+3 |
| | | | | | ok markus@ | ||||
| * | refuse to generate or accept RSA keys smaller than 1024 bits; | djm | 2015-07-03 | 1 | -3/+3 |
| | | | | | feedback and ok dtucker@ | ||||
| * | delete support for legacy v00 certificates; "sure" markus@ dtucker@ | djm | 2015-07-03 | 1 | -50/+17 |
| | | |||||
| * | wrap all moduli-related code in #ifdef WITH_OPENSSL. | djm | 2015-05-28 | 1 | -39/+52 |
| | | | | | | based on patch from Reuben Hawkins; bz#2388 feedback and ok dtucker@ | ||||
| * | make ssh-keygen default to ed25519 keys when compiled without | djm | 2015-05-28 | 1 | -2/+8 |
| | | | | | OpenSSL; bz#2388, ok dtucker@ | ||||
| * | Support "ssh-keygen -lF hostname" to find search known_hosts and | djm | 2015-05-21 | 1 | -3/+17 |
| | | | | | | print key hashes. Already advertised by ssh-keygen(1), but not delivered by code; ok dtucker@ | ||||
| * | fix compilation with OPENSSL=no; ok dtucker@ | djm | 2015-04-27 | 1 | -2/+6 |
| | | |||||
| * | rename xrealloc() to xreallocarray() since it follows that form. |   deraadt | 2015-04-24 | 1 | -2/+2 |
| | | | | | ok djm | ||||
| * | use error/logit/fatal instead of fprintf(stderr, ...) and exit(0), | djm | 2015-04-17 | 1 | -153/+94 |
| | | | | | | | fix a few errors that were being printed to stdout instead of stderr and a few non-errors that were going to stderr instead of stdout bz#2325; ok dtucker | ||||
| * | Comments are only supported for RSA1 keys. If a user tried to add one and |   tobias | 2015-03-31 | 1 | -1/+2 |
| | | | | | | | | entered his passphrase, explicitly clear it before exit. This is done in all other error paths, too. ok djm | ||||
| * | for ssh-keygen -A, don't try (and fail) to generate | djm | 2015-03-23 | 1 | -1/+5 |
| | | | | | | | ssh v.1 keys when compiled without SSH1 support RSA/DSA/ECDSA keys when compiled without OpenSSL based on patch by Mike Frysinger; bz#2369 | ||||
| * | don't printf NULL key comments; reported by Tom Christensen | djm | 2015-02-26 | 1 | -2/+3 |
| | | |||||
| * | add -v (show ASCII art) to -l's synopsis; ok djm@ |   naddy | 2015-02-24 | 1 | -2/+2 |
| | | |||||
| * | further silence spurious error message even when -v is specified | djm | 2015-02-23 | 1 | -2/+2 |
| | | | | | (e.g. to get visual host keys); reported by naddy@ | ||||
| * | silence a spurious error message when listing fingerprints for | djm | 2015-02-23 | 1 | -2/+2 |
| | | | | | known_hosts; bz#2342 | ||||
| * | Refactor hostkeys_foreach() and dependent code | djm | 2015-02-16 | 1 | -32/+39 |
| | | | | | | | Deal with IP addresses (i.e. CheckHostIP) Don't clobber known_hosts when nothing changed ok markus@ as part of larger commit | ||||
| * | permit KRLs that revoke certificates by serial number or key ID | djm | 2015-01-30 | 1 | -11/+15 |
| | | | | | without scoping to a particular CA; ok markus@ | ||||
| * | missing parentheses after if in do_convert_from() broke | djm | 2015-01-30 | 1 | -3/+3 |
| | | | | | | private key conversion from other formats some time in 2010; bz#2345 reported by jjelen AT redhat.com | ||||
| * | update to new API (key_fingerprint => sshkey_fingerprint) | djm | 2015-01-28 | 1 | -4/+14 |
| | | | | | | check sshkey_fingerprint return values; ok markus | ||||
| * | djm, your /usr/include tree is old | deraadt | 2015-01-19 | 1 | -2/+2 |
| | | |||||
| * | some feedback from markus@: comment hostkeys_foreach() | djm | 2015-01-18 | 1 | -10/+11 |
| | | | | | context and avoid a member in it. | ||||
| * | make ssh-keygen use hostkeys_foreach(). Removes some | djm | 2015-01-18 | 1 | -205/+121 |
| | | | | | horrendous code; ok markus@ | ||||
| * | infer key length correctly when user specified a fully- | djm | 2015-01-18 | 1 | -7/+12 |
| | | | | | | qualified key name instead of using the -b bits option; ok markus@ | ||||
| * | regression: incorrect error message on otherwise-successful | djm | 2015-01-16 | 1 | -3/+3 |
| | | | | | ssh-keygen -A. Reported by Dmitry Orlov, via deraadt@ | ||||
| * | Replace <sys/param.h> with <limits.h> and other less dirty headers where | deraadt | 2015-01-16 | 1 | -6/+6 |
| | | | | | | | | | | possible. Annotate <sys/param.h> lines with their current reasons. Switch to PATH_MAX, NGROUPS_MAX, HOST_NAME_MAX+1, LOGIN_NAME_MAX, etc. Change MIN() and MAX() to local definitions of MINIMUM() and MAXIMUM() where sensible to avoid pulling in the pollution. These are the files confirmed through binary verification. ok guenther, millert, doug (helped with the verification protocol) | ||||
| * | sync ssh-keysign, ssh-keygen and some dependencies to the new | djm | 2015-01-15 | 1 | -353/+420 |
| | | | | | buffer/key API; mostly mechanical, ok markus@ | ||||
| * | Add FingerprintHash option to control algorithm used for key | djm | 2014-12-21 | 1 | -22/+36 |
| | | | | | | | | fingerprints. Default changes from MD5 to SHA256 and format from hex to base64. Feedback and ok naddy@ markus@ | ||||
| * | Free resources on error in mkstemp and fdopen |   doug | 2014-08-21 | 1 | -1/+3 |
| | | | | | ok djm@ | ||||
| * | When hashing or removing hosts using ssh-keygen, don't choke on | djm | 2014-07-03 | 1 | -26/+44 |
| | | | | | | @revoked markers and don't remove @cert-authority markers; bz#2241, reported by mlindgren AT runelind.net | ||||
| * | standardise on NI_MAXHOST for gethostname() string lengths; about | djm | 2014-07-03 | 1 | -2/+3 |
| | | | | | 1/2 the cases were using it already. Fixes bz#2239 en passant | ||||
| * | New key API: refactor key-related functions to be more library-like, | djm | 2014-06-24 | 1 | -9/+11 |
| | | | | | | | | | | existing API is offered as a set of wrappers. with and ok markus@ Thanks also to Ben Hawkes, David Tomaschik, Ivan Fratric, Matthew Dempsky and Ron Bowes for a detailed review a few months ago. | ||||
| * | make compiling against OpenSSL optional (make OPENSSL=no); |   markus | 2014-04-29 | 1 | -1/+15 |
| | | | | | | reduces algorithms to curve25519, aes-ctr, chacha, ed25519; allows us to explore further options; with and ok djm | ||||
| * | buffer_get_string_ptr's return should be const to remind | djm | 2014-04-28 | 1 | -6/+6 |
| | | | | | | callers that futzing with it will futz with the actual buffer contents | ||||
| * | Add support for SSHFP DNS records for ED25519 key types. |   logan | 2014-04-20 | 1 | -2/+3 |
| | | | | | OK from djm@ | ||||
| * | Improve usage() and documentation towards the standard form. In particular, | deraadt | 2014-03-15 | 1 | -49/+28 |
| | | | | | | | | this line saves a lot of man page reading time. usage: ssh-keygen [-q] [-b bits] [-t dsa | ecdsa | ed25519 | rsa | rsa1] [-N new_passphrase] [-C comment] [-f output_keyfile] ok schwarze jmc | ||||
| * | don't count on things that accept arguments by reference to clear | djm | 2014-03-12 | 1 | -2/+2 |
| | | | | | things for us on error; most things do, but it's unsafe form. | ||||
| * | tweak synopsis: calling ssh-keygen without any arguments is fine; ok jmc@ | naddy | 2014-02-05 | 1 | -2/+2 |
| | | | | | while here, fix ordering in usage(); requested by jmc@ | ||||
| * | convert memset of potentially-private data to explicit_bzero() | djm | 2014-02-02 | 1 | -17/+17 |
| | | |||||
| * | replace most bzero with explicit_bzero, except a few that cna be memset |   tedu | 2014-01-31 | 1 | -2/+2 |
| | | | | | ok djm dtucker | ||||
| * | support ed25519 keys (hostkeys and user identities) using the public domain | markus | 2013-12-06 | 1 | -3/+8 |
| | | | | | | ed25519 reference code from SUPERCOP, see http://ed25519.cr.yp.to/software.html feedback, help & ok djm@ | ||||
| * | new private key format, bcrypt as KDF by default; details in PROTOCOL.key; | markus | 2013-12-06 | 1 | -13/+38 |
| | | | | | feedback and lots help from djm; ok djm@ | ||||
| * | remove duplicated character ('g') in getopt() string; | djm | 2013-12-06 | 1 | -2/+3 |
| | | | | | | document the (few) remaining option characters so we don't have to rummage next time. | ||||
| * | Make code match documentation: relative-specified certificate expiry time | djm | 2013-10-23 | 1 | -2/+2 |
| | | | | | | should be relative to current time and not the validity start time. Reported by Petr Lautrbach; ok deraadt@ | ||||
| * | All the instances of arc4random_stir() are bogus, since arc4random() | deraadt | 2013-09-02 | 1 | -6/+1 |
| | | | | | | | does this itself, inside itself, and has for a very long time.. Actually, this was probably reducing the entropy available. ok djm | ||||
| * | improve batch processing a bit by making use of the quite flag a bit |   mikeb | 2013-08-28 | 1 | -10/+15 |
| | | | | | | | | more often and exit with a non zero code if asked to find a hostname in a known_hosts file and it wasn't there; originally from reyk@, ok djm | ||||
| * | another of the same typo | djm | 2013-08-13 | 1 | -2/+2 |
| | | |||||
| * | typo in error message; from Stephan Rickauer | djm | 2013-08-13 | 1 | -2/+2 |
| | | |||||
| * | More useful error message on missing current user in /etc/passwd | djm | 2013-07-20 | 1 | -2/+2 |
| | | |||||
| * | do_print_resource_record() can never be called with a NULL filename, so | djm | 2013-07-12 | 1 | -2/+2 |
| | | | | | | don't attempt (and bungle) asking for one if it has not been specified bz#2127 ok dtucker@ | ||||
| * | fix pointer-signedness warnings from clang/llvm-3.3; "seems nice" deraadt@ | djm | 2013-07-12 | 1 | -3/+4 |
| | | |||||
 |
index : wireguard-openbsd | |
| WireGuard implementation for the OpenBSD kernel | Matt Dunwoodie |
| summaryrefslogtreecommitdiffstats |