| Commit message (Collapse) | Author | Age | Files | Lines | |
|---|---|---|---|---|---|
| * | Add a ssh_config HostbasedKeyType option to control which |   djm | 2015-01-30 | 7 | -120/+245 |
| | | | | | | | | | | host public key types are tried during hostbased authentication. This may be used to prevent too many keys being sent to the server, and blowing past its MaxAuthTries limit. bz#2211 based on patch by Iain Morgan; ok markus@ | ||||
| * | set a timeout to prevent hangs when talking to busted servers; | djm | 2015-01-30 | 1 | -1/+2 |
| | | | | | ok markus@ | ||||
| * | avoid more fatal/exit in the packet.c paths that ssh-keyscan | djm | 2015-01-30 | 9 | -114/+204 |
| | | | | | uses; feedback and "looks good" markus@ | ||||
| * | permit KRLs that revoke certificates by serial number or key ID | djm | 2015-01-30 | 3 | -51/+86 |
| | | | | | without scoping to a particular CA; ok markus@ | ||||
| * | missing parentheses after if in do_convert_from() broke | djm | 2015-01-30 | 1 | -3/+3 |
| | | | | | | private key conversion from other formats some time in 2010; bz#2345 reported by jjelen AT redhat.com | ||||
| * | fix ssh protocol 1, spotted by miod@ | djm | 2015-01-30 | 1 | -9/+20 |
| | | |||||
| * | update to new API (key_fingerprint => sshkey_fingerprint) | djm | 2015-01-28 | 12 | -68/+81 |
| | | | | | | check sshkey_fingerprint return values; ok markus | ||||
| * | avoid fatal() calls in packet code | djm | 2015-01-28 | 1 | -3/+15 |
| | | | | | | makes ssh-keyscan more reliable against server failures ok dtucker@ markus@ | ||||
| * | avoid fatal() calls in packet code | djm | 2015-01-28 | 7 | -29/+54 |
| | | | | | | makes ssh-keyscan more reliable against server failures ok dtucker@ markus@ | ||||
| * | remove obsolete comment | djm | 2015-01-28 | 1 | -2/+1 |
| | | |||||
| * | Since r1.2 removed the use of PRI* macros, inttypes.h is no longer |   okan | 2015-01-27 | 2 | -4/+2 |
| | | | | | | | required. ok djm@ | ||||
| * | sort previous; |   jmc | 2015-01-26 | 1 | -2/+2 |
| | | |||||
| * | properly restore umask | djm | 2015-01-26 | 1 | -2/+4 |
| | | |||||
| * | correct description of UpdateHostKeys in ssh_config.5 and | djm | 2015-01-26 | 4 | -10/+13 |
| | | | | | | add it to -o lists for ssh, scp and sftp; pointed out by jmc@ | ||||
| * | correctly match ECDSA subtype (== curve) for offered/recevied | djm | 2015-01-26 | 14 | -42/+68 |
| | | | | | | | | | host keys. Fixes connection-killing host key mismatches when a server offers multiple ECDSA keys with different curve type (an extremely unlikely configuration). ok markus, "looks mechanical" deraadt@ | ||||
| * | Host key rotation support. | djm | 2015-01-26 | 9 | -28/+401 |
| | | | | | | | | | | | | | | Add a hostkeys@openssh.com protocol extension (global request) for a server to inform a client of all its available host key after authentication has completed. The client may record the keys in known_hosts, allowing it to upgrade to better host key algorithms and a server to gracefully rotate its keys. The client side of this is controlled by a UpdateHostkeys config option (default on). ok markus@ | ||||
| * | small refactor and add some convenience functions; | djm | 2015-01-26 | 3 | -50/+86 |
| | | | | | ok markus | ||||
| * | heirarchy -> hierarchy; | jmc | 2015-01-22 | 1 | -2/+2 |
| | | |||||
| * | Provide a warning about chroot misuses (which sadly, seem to have become |   deraadt | 2015-01-22 | 1 | -4/+13 |
| | | | | | | | quite popular because shiny). sshd cannot detect/manage/do anything about these cases, best we can do is warn in the right spot in the man page. ok markus | ||||
| * | Reduce use of <sys/param.h> and transition to <limits.h> throughout. | deraadt | 2015-01-20 | 31 | -81/+82 |
| | | | | | ok djm markus | ||||
| * | kex_setup errors are fatal() |   markus | 2015-01-20 | 2 | -4/+8 |
| | | |||||
| * | make this compile with KERBEROS5 enabled | djm | 2015-01-20 | 1 | -8/+12 |
| | | |||||
| * | fix hostkeys in agent; ok markus@ | djm | 2015-01-20 | 4 | -20/+16 |
| | | |||||
| * | switch ssh-keyscan from setjmp to multiple ssh transport layer instances | markus | 2015-01-19 | 1 | -68/+81 |
| | | | | | ok djm@ | ||||
| * | add experimental api for packet layer; ok djm@ | markus | 2015-01-19 | 6 | -11/+690 |
| | | |||||
| * | store compat flags in struct ssh; ok djm@ | markus | 2015-01-19 | 4 | -12/+15 |
| | | |||||
| * | adapt kex to sshbuf and struct ssh; ok djm@ | markus | 2015-01-19 | 24 | -1149/+1701 |
| | | |||||
| * | move dispatch to struct ssh; ok djm@ | markus | 2015-01-19 | 13 | -145/+253 |
| | | |||||
| * | update packet.c & isolate, introduce struct ssh | markus | 2015-01-19 | 28 | -1879/+2535 |
| | | | | | | | | | a) switch packet.c to buffer api and isolate per-connection info into struct ssh b) (de)serialization of the state is moved from monitor to packet.c c) the old packet.c API is implemented in opacket.[ch] d) compress.c/h is removed and integrated into packet.c with and ok djm@ | ||||
| * | fix format strings in (disabled) debugging | djm | 2015-01-19 | 1 | -4/+4 |
| | | |||||
| * | djm, your /usr/include tree is old | deraadt | 2015-01-19 | 1 | -2/+2 |
| | | |||||
| * | some feedback from markus@: comment hostkeys_foreach() | djm | 2015-01-18 | 1 | -10/+11 |
| | | | | | context and avoid a member in it. | ||||
| * | make ssh-keygen use hostkeys_foreach(). Removes some | djm | 2015-01-18 | 1 | -205/+121 |
| | | | | | horrendous code; ok markus@ | ||||
| * | convert load_hostkeys() (hostkey ordering and known_host | djm | 2015-01-18 | 1 | -89/+52 |
| | | | | | | matching) to use the new hostkey_foreach() iterator; ok markus | ||||
| * | introduce hostkeys_foreach() to allow iteration over a | djm | 2015-01-18 | 2 | -3/+187 |
| | | | | | | | | | known_hosts file or controlled subset thereof. This will allow us to pull out some ugly and duplicated code, and will be used to implement hostkey rotation later. feedback and ok markus | ||||
| * | string truncation due to sizeof(size) | deraadt | 2015-01-18 | 1 | -2/+2 |
| | | | | | ok djm markus | ||||
| * | avoid trailing ',' in host key algorithms | djm | 2015-01-18 | 1 | -2/+3 |
| | | |||||
| * | infer key length correctly when user specified a fully- | djm | 2015-01-18 | 1 | -7/+12 |
| | | | | | | qualified key name instead of using the -b bits option; ok markus@ | ||||
| * | fix hostkeys on ssh agent; found by unit test I'm about to commit | djm | 2015-01-17 | 1 | -3/+7 |
| | | |||||
| * | garbage collect empty .No macros mandoc warns about |   schwarze | 2015-01-16 | 1 | -4/+4 |
| | | |||||
| * | regression: incorrect error message on otherwise-successful | djm | 2015-01-16 | 1 | -3/+3 |
| | | | | | ssh-keygen -A. Reported by Dmitry Orlov, via deraadt@ | ||||
| * | when hostname canonicalisation is enabled, try to parse hostnames | djm | 2015-01-16 | 1 | -5/+72 |
| | | | | | | | as addresses before looking them up for canonicalisation. fixes bz#2074 and avoids needless DNS lookups in some cases; ok markus | ||||
| * | Replace <sys/param.h> with <limits.h> and other less dirty headers where | deraadt | 2015-01-16 | 13 | -36/+41 |
| | | | | | | | | | | possible. Annotate <sys/param.h> lines with their current reasons. Switch to PATH_MAX, NGROUPS_MAX, HOST_NAME_MAX+1, LOGIN_NAME_MAX, etc. Change MIN() and MAX() to local definitions of MINIMUM() and MAXIMUM() where sensible to avoid pulling in the pollution. These are the files confirmed through binary verification. ok guenther, millert, doug (helped with the verification protocol) | ||||
| * | remove xmalloc, switch to sshbuf | markus | 2015-01-15 | 1 | -5/+3 |
| | | |||||
| * | switch to sshbuf | markus | 2015-01-15 | 1 | -3/+3 |
| | | |||||
| * | handle UMAC128 initialization like UMAC; ok djm@ markus@ |   naddy | 2015-01-15 | 1 | -2/+3 |
| | | |||||
| * | fix regression reported by brad@ for passworded keys without | djm | 2015-01-15 | 1 | -3/+5 |
| | | | | | agent present | ||||
| * | sync ssh-keysign, ssh-keygen and some dependencies to the new | djm | 2015-01-15 | 13 | -495/+595 |
| | | | | | buffer/key API; mostly mechanical, ok markus@ | ||||
| * | remove commented-out test code now that it has moved to a | djm | 2015-01-15 | 1 | -175/+0 |
| | | | | | proper unit test | ||||
| * | whitespace | djm | 2015-01-14 | 1 | -2/+0 |
| | | |||||
 |
index : wireguard-openbsd | |
| WireGuard implementation for the OpenBSD kernel | Matt Dunwoodie |
| summaryrefslogtreecommitdiffstats |