summaryrefslogtreecommitdiffstats
path: root/usr.bin/ssh/sshconnect.c (follow)
Commit message (Collapse)AuthorAgeFilesLines
...
* Move SSH Fingerprint Visualization away from sharing the config optiongrunk2008-06-261-11/+7
| | | | | | | | | CheckHostIP to an own config option named VisualHostKey. While there, fix the behaviour that ssh would draw a random art picture on every newly seen host even when the option was not enabled. prodded by deraadt@, discussions, help and ok markus@ djm@ dtucker@
* tweak wording in message, ok deraadt@ jmc@ian2008-06-121-2/+2
|
* Make keepalive timeouts apply while waiting for a packet, particularly duringdtucker2008-06-121-18/+5
| | | | key renegotiation (bz #1363). With djm and Matt Day, ok djm@
* Make ssh print the random art also when ssh'ing to a host using IP only.grunk2008-06-121-2/+10
| | | | spotted by naddy@, ok and help djm@ dtucker@
* Do not pass "0" strings as ports to getaddrinfo because the lookupsdtucker2008-06-121-2/+2
| | | | | | | | | | | | | | | can slow things down and we never use the service info anyway. bz #859, patch from YOSHIFUJI Hideaki and John Devitofranceschi. ok deraadt@ djm@ djm belives that the reason for the "0" strings is to ensure that it's not possible to call getaddrinfo with both host and port being NULL. In the case of canohost.c host is a local array. In the case of sshconnect.c, it's checked for null immediately before use. In dns.c it ultimately comes from ssh.c:main() and is guaranteed to be non-null but it's not obvious, so I added a warning message in case it is ever passed a null.
* Introduce SSH Fingerprint ASCII Visualization, a technique inspired by thegrunk2008-06-111-7/+19
| | | | | | | | | | | | | | | | | | | | | | | graphical hash visualization schemes known as "random art", and by Dan Kaminsky's musings on the subject during a BlackOp talk at the 23C3 in Berlin. Scientific publication (original paper): "Hash Visualization: a New Technique to improve Real-World Security", Perrig A. and Song D., 1999, International Workshop on Cryptographic Techniques and E-Commerce (CrypTEC '99) http://sparrow.ece.cmu.edu/~adrian/projects/validation/validation.pdf The algorithm used here is a worm crawling over a discrete plane, leaving a trace (augmenting the field) everywhere it goes. Movement is taken from dgst_raw 2bit-wise. Bumping into walls makes the respective movement vector be ignored for this turn, thus switching to the other color of the chessboard. Graphs are not unambiguous for now, because circles in graphs can be walked in either direction. discussions with several people, help, corrections and ok markus@ djm@
* Add a small helper function to consistently handle the EAI_SYSTEM errordtucker2007-12-271-4/+4
| | | | | code of getaddrinfo. Prompted by vgiffin at apple com via bz #1417. ok markus@ stevesk@
* make ssh(1)'s ConnectTimeout option apply to both the TCP connection anddjm2007-09-041-21/+84
| | | | | | | | SSH banner exchange (previously it just covered the TCP connection). This allows callers of ssh(1) to better detect and deal with stuck servers that accept a TCP connection but don't progress the protocol, and also makes ConnectTimeout useful for connections via a ProxyCommand; feedback and "looks ok" markus@
* Execute ProxyCommands with $SHELL rather than /bin/sh unconditionallydjm2007-08-231-3/+6
|
* sleep before retrying (not after) since sleep changes errno; fixesmarkus2006-10-101-6/+5
| | | | pr 5250; rad@twig.com; ok dtucker djm
* almost entirely get rid of the culture of ".h files that include .h files"deraadt2006-08-031-4/+3
| | | | | ok djm, sort of ok stevesk makes the pain stop in one easy step
* move #include <stdio.h> out of includes.hstevesk2006-08-011-1/+2
|
* Allow fallback to known_hosts entries without port qualifiers fordtucker2006-08-011-9/+25
| | | | | non-standard ports too, so that all existing known_hosts entries will be recognised. Requested by, feedback and ok markus@
* move #include <stdlib.h> out of includes.hstevesk2006-07-261-1/+2
|
* move #include <sys/time.h> out of includes.hstevesk2006-07-251-1/+2
|
* disable tunnel forwarding when no strict host key checkingstevesk2006-07-241-2/+7
| | | | and key changed; ok djm@ markus@ dtucker@
* move #include <string.h> out of includes.hstevesk2006-07-221-1/+2
|
* move #include <unistd.h> out of includes.hstevesk2006-07-171-1/+2
|
* move #include <netdb.h> out of includes.h; ok djm@stevesk2006-07-121-1/+2
|
* move #include <errno.h> out of includes.h; ok markus@stevesk2006-07-111-1/+2
|
* Add port identifier to known_hosts for non-default ports, based originallydtucker2006-07-101-10/+15
| | | | | | | | | | on a patch from Devin Nate in bz#910. For any connection using the default port or using a HostKeyAlias the format is unchanged, otherwise the host name or address is enclosed within square brackets in the same format as sshd's ListenAddress. Tested by many, ok markus@.
* move #include <pwd.h> out of includes.h; ok markus@stevesk2006-07-061-1/+2
|
* move #include <netinet/in.h> out of includes.h; ok deraadt@stevesk2006-07-051-1/+4
|
* move #include "version.h" out of includes.h; ok markus@stevesk2006-07-031-1/+2
|
* limit the number of pre-banner characters we will accept; ok markus@djm2006-06-141-3/+5
|
* do not set the gid, noted by solar; ok djmmarkus2006-06-081-2/+2
|
* replace remaining setuid() calls with permanently_set_uid() andmarkus2006-06-061-3/+2
| | | | check seteuid() return values; report Marcus Meissner; ok dtucker djm
* fix leak; coverity via Kylene Jo Hallmarkus2006-05-171-1/+2
|
* simplify; ok djm@markus2006-04-201-20/+9
|
* Put $OpenBSD$ tags back (as comments) to replace the RCSID()s thatdjm2006-03-251-0/+1
| | | | Theo nuked - our scripts to sync -portable need them in the files
* introduce xcalloc() and xasprintf() failure-checked allocations functionsdjm2006-03-251-12/+5
| | | | | | | | | | and use them throughout openssh xcalloc is particularly important because malloc(nmemb * size) is a dangerous idiom (subject to integer overflow) and it is time for it to die feedback and ok deraadt@
* be strict with tolower() castingderaadt2006-03-201-1/+1
|
* RCSID() can diederaadt2006-03-191-1/+0
|
* move #include <ctype.h> out of includes.h; ok djm@stevesk2006-02-221-1/+2
|
* move #include <sys/stat.h> out of includes.h; ok markus@stevesk2006-02-201-1/+2
|
* move #include <sys/wait.h> out of includes.h; ok markus@stevesk2006-02-101-1/+4
|
* <openssl/bn.h> not neededstevesk2006-02-081-3/+1
|
* move #include <paths.h> out of includes.h; ok markus@stevesk2006-02-081-1/+3
|
* Add support for tun(4) forwarding over OpenSSH, based on an idea andreyk2005-12-061-1/+37
| | | | | | | | | | | | initial channel code bits by markus@. This is a simple and easy way to use OpenSSH for ad hoc virtual private network connections, e.g. administrative tunnels or secure wireless access. It's based on a new ssh channel and works similar to the existing TCP forwarding support, except that it depends on the tun(4) network interface on both ends of the connection for layer 2 or layer 3 tunneling. This diff also adds support for LocalCommand in the ssh(1) client. ok djm@, markus@, jmc@ (manpages), tested and discussed with others
* no need to escape single quotes in comments, no binary changedjm2005-10-301-2/+2
|
* make external definition static; ok deraadt@stevesk2005-10-151-3/+2
|
* knf says that a 2nd level indent is four (not three or five) spacesdjm2005-07-171-4/+4
|
* spacingdjm2005-07-161-2/+2
|
* Fix ControlPath's %p expanding to "0" for a default port,djm2005-06-171-10/+1
| | | | spotted dwmw2 AT infradead.org; ok markus@
* make this -Wsign-compare clean; ok avsm@ markus@djm2005-06-171-2/+3
|
* introduce a generic %foo expansion function. replace existing % expansion anddjm2005-06-061-30/+11
| | | | add expansion to ControlPath; ok markus@
* Switch atomicio to use a simpler interface; it now returns a size_tavsm2005-05-241-6/+7
| | | | | | | | | | | (containing number of bytes read/written), and indicates error by returning 0. EOF is signalled by errno==EPIPE. Typical use now becomes: if (atomicio(read, ..., len) != len) err(1,"read"); ok deraadt@, cloder@, djm@
* spacingderaadt2005-03-101-3/+3
|
* fix addition of new hashed hostnames when CheckHostIP=yes;djm2005-03-021-10/+25
| | | | found and ok dtucker@
* add support for hashing host names and addresses added to known_hosts files,djm2005-03-011-3/+4
| | | | to improve privacy of which hosts user have been visiting; ok markus@ deraadt@
Copyright © 1996 – 2023 Jason A. Donenfeld. All Rights Reverse Engineered.