summaryrefslogtreecommitdiff
path: root/usr.bin/ssh/readconf.c
AgeCommit message (Collapse)Author
2014-04-23don't record duplicate IdentityFilesDamien Miller
2014-02-23reparse ssh_config and ~/.ssh/config if hostname canonicalisation changesDamien Miller
the hostname. This allows users to write configurations that always refer to canonical hostnames, e.g. CanonicalizeHostname yes CanonicalDomains int.example.org example.org CanonicalizeFallbackLocal no Host *.int.example.org Compression off Host *.example.org User djm ok markus@
2014-02-22when processing Match blocks, skip 'exec' clauses if previous predicatesDamien Miller
failed to match; ok markus@
2014-01-29remove experimental, never-enabled JPAKE code; ok markus@Damien Miller
2013-12-06support ed25519 keys (hostkeys and user identities) using the public domainMarkus Friedl
ed25519 reference code from SUPERCOP, see http://ed25519.cr.yp.to/software.html feedback, help & ok djm@
2013-11-20unsigned casts for ctype macros where neccessaryTheo de Raadt
ok guenther millert markus
2013-10-24Disallow empty Match statements and add "Match all" which matches everything.Darren Tucker
ok djm, man page help jmc@
2013-10-23commentDamien Miller
2013-10-23Hostname may have %h sequences that should be expanded prior to MatchDamien Miller
evaluation; spotted by Iain Morgan
2013-10-20rename "command" subclause of the recently-added "Match" keyword toDamien Miller
"exec"; it's shorter, clearer in intent and we might want to add the ability to match against the command being executed at the remote end in the future.
2013-10-16s/canonicalise/canonicalize/ for consistency with existing spelling,Damien Miller
e.g. authorized_keys; pointed out by naddy@
2013-10-16Implement client-side hostname canonicalisation to allow an explicitDamien Miller
search path of domain suffixes to use to convert unqualified host names to fully-qualified ones for host key matching. This is particularly useful for host certificates, which would otherwise need to list unqualified names alongside fully-qualified ones (and this causes a number of problems). "looks fine" markus@
2013-10-14refactor client config code a little:Damien Miller
add multistate option partsing to readconf.c, similar to servconf.c's existing code. move checking of options that accept "none" as an argument to readconf.c add a lowercase() function and use it instead of explicit tolower() in loops part of a larger diff that was ok markus@
2013-10-14add a "Match" keyword to ssh_config that allows matching on hostname,Damien Miller
user and result of arbitrary commands. "nice work" markus@
2013-08-20Add a ssh_config ProxyUseFDPass option that supports the use ofDamien Miller
ProxyCommands that establish a connection and then pass a connected file descriptor back to ssh(1). This allows the ProxyCommand to exit rather than have to shuffle data back and forth and enables ssh to use getpeername, etc. to obtain address information just like it does with regular directly-connected sockets. ok markus@
2013-06-10revert 1.203 while we investigate crashes reported by okan@Darren Tucker
2013-06-05plug another memleak. bz#1967, from Zhenbo Xu, detected by Melton, ok djmDarren Tucker
2013-05-17bye, bye xfree(); ok markus@Damien Miller
2013-05-16remove now-unused variablesDarren Tucker
2013-05-16switch RekeyLimit traffic volume parsing to scan_scaled. ok djm@Darren Tucker
2013-05-16add the ability to ignore specific unrecognised ssh_config options;Damien Miller
bz#866; ok markus@
2013-05-16Add an optional second argument to RekeyLimit in the client to allowDarren Tucker
rekeying based on elapsed time in addition to amount of traffic. with djm@ jmc@, ok djm
2013-03-06g/c unused variable (-Wunused)Damien Miller
2013-02-22Don't complain if IdentityFiles specified in system-wide configs are missing.Darren Tucker
ok djm, deraadt.
2013-02-17Keep track of which IndentityFile options were manually supplied and whichDarren Tucker
were default options, and don't warn if the latter are missing. ok markus@
2011-09-23unbreak remote portforwarding with dynamic allocated listen ports:Markus Friedl
1) send the actual listen port in the open message (instead of 0). this allows multiple forwardings with a dynamic listen port 2) update the matching permit-open entry, so we can identify where to connect to report: den at skbkontur.ru and P. Szczygielski feedback and ok djm@
2011-05-24Remove undocumented legacy options UserKnownHostsFile2 andDamien Miller
GlobalKnownHostsFile2 by making UserKnownHostsFile/GlobalKnownHostsFile accept multiple paths per line and making their defaults include known_hosts2; ok markus
2011-05-06Add a RequestTTY ssh_config option to allow configuration-basedDamien Miller
control over tty allocation (like -t/-T); ok markus@
2011-05-06support negated Host matching, e.g.Damien Miller
Host *.example.org !c.example.org User mekmitasdigoat Will match "a.example.org", "b.example.org", but not "c.example.org" ok markus@
2010-11-13allow ssh and sshd to set arbitrary TOS/DSCP/QoS values instead ofDamien Miller
hardcoding lowdelay/throughput. bz#1733 patch from philipp AT redfish-solutions.com; ok markus@ deraadt@
2010-09-22add a KexAlgorithms knob to the client and server configuration to allowDamien Miller
selection of which key exchange methods are used by ssh(1) and sshd(8) and their order of preference. ok markus@
2010-08-31Implement Elliptic Curve Cryptography modes for key exchange (ECDH) andDamien Miller
host/user keys (ECDSA) as specified by RFC5656. ECDH and ECDSA offer better performance than plain DH and DSA at the same equivalent symmetric key length, as well as much shorter keys. Only the mandatory sections of RFC5656 are implemented, specifically the three REQUIRED curves nistp256, nistp384 and nistp521 and only ECDH and ECDSA. Point compression (optional in RFC5656 is NOT implemented). Certificate host and user keys using the new ECDSA key types are supported. Note that this code has not been tested for interoperability and may be subject to change. feedback and ok markus@
2010-07-19add a "ControlPersist" option that automatically starts a backgroundDamien Miller
ssh(1) multiplex master when connecting. This connection can stay alive indefinitely, or can be set to automatically close after a user-specified duration of inactivity. bz#1330 - patch by dwmw2 AT infradead.org, but further hacked on by wmertens AT cisco.com, apb AT cequrux.com, martin-mindrot-bugzilla AT earth.li and myself; "looks ok" markus@
2010-06-25Add X11ForwardTimeout option to specify timeout for untrusted X11Damien Miller
authentication cookies to avoid fallback in X11 code to fully-trusted implicit authentication using SO_PEERCRED described at: http://lists.x.org/archives/xorg-devel/2010-May/008636.html After the X11ForwardTimeout has expired the client will now refuse incoming X11 channel opens. based on patch from Tavis Ormandy; "nice" markus@
2010-06-25bz#1327: remove hardcoded limit of 100 permitopen clauses and portDamien Miller
forwards per direction; ok markus@ stevesk@
2010-05-16mux support for remote forwarding with dynamic port allocation,Markus Friedl
use with LPORT=`ssh -S muxsocket -R0:localhost:25 -O forward somehost` feedback and ok djm@
2010-02-08replace our obsolete smartcard code with PKCS#11.Markus Friedl
ftp://ftp.rsasecurity.com/pub/pkcs/pkcs-11/v2-20/pkcs-11v2-20.pdf ssh(1) and ssh-keygen(1) use dlopen(3) directly to talk to a PKCS#11 provider (shared library) while ssh-agent(1) delegates PKCS#11 to a forked a ssh-pkcs11-helper process. PKCS#11 is currently a compile time option. feedback and ok djm@; inspired by patches from Alon Bar-Lev
2010-01-09Remove RoutingDomain from ssh since it's now not needed. It can be replacedDarren Tucker
with "route exec" or "nc -V" as a proxycommand. "route exec" also ensures that trafic such as DNS lookups stays withing the specified routingdomain. For example (from reyk): # route -T 2 exec /usr/sbin/sshd or inherited from the parent process $ route -T 2 exec sh $ ssh 10.1.2.3 ok deraadt@ markus@ stevesk@ reyk@
2009-12-29Rename RDomain config option to RoutingDomain to be more clear andKevin Steves
consistent with other options. NOTE: if you currently use RDomain in the ssh client or server config, or ssh/sshd -o, you must update to use RoutingDomain. ok markus@ djm@
2009-12-25validate routing domain is in range 0-RT_TABLEID_MAX.Kevin Steves
'Looks right' deraadt@
2009-10-28Allow to set the rdomain in ssh/sftp/scp/sshd and ssh-keyscan.Reyk Floeter
ok markus@
2009-10-08disable protocol 1 by default (after a transition period of about 10 years)Markus Friedl
ok deraadt
2009-06-27Add client option UseRoaming. It doesn't do anything yet but willAndreas Gunnarsson
control whether the client tries to use roaming if enabled on the server. From Martin Forssen. ok markus@
2009-02-12support remote port forwarding with a zero listen port (-R0:...) toDamien Miller
dyamically allocate a listen port at runtime (this is actually specified in rfc4254); bz#1003 ok markus@
2009-01-22make a2port() return -1 when it encounters an invalid port numberDamien Miller
rather than 0, which it will now treat as valid (needed for future work) adjust current consumers of a2port() to check its return value is <= 0, which in turn required some things to be converted from u_short => int make use of int vs. u_short consistent in some other places too feedback & ok markus@
2009-01-151) use obsolete instead of alias for consistencyKevin Steves
2) oUserKnownHostsFile not obsolete but oGlobalKnownHostsFile2 is so move the comment. 3) reorder so like options are together ok djm@
2008-12-09don't leave junk (free'd) pointers around in Forward *fwd argument onDamien Miller
failure; avoids double-free in ~C -L handler when given an invalid forwarding specification; bz#1539 report from adejong AT debian.org via Colin Watson; ok markus@ dtucker@
2008-11-04because parse_forward() is now used to parse all forward types (DLR),Kevin Steves
and it malloc's space for host variables, we don't need to malloc here. fixes small memory leaks. previously dynamic forwards were not parsed in parse_forward() and space was not malloc'd in that case. ok djm@
2008-11-04Add support for an experimental zero-knowledge password authenticationDamien Miller
method using the J-PAKE protocol described in F. Hao, P. Ryan, "Password Authenticated Key Exchange by Juggling", 16th Workshop on Security Protocols, Cambridge, April 2008. This method allows password-based authentication without exposing the password to the server. Instead, the client and server exchange cryptographic proofs to demonstrate of knowledge of the password while revealing nothing useful to an attacker or compromised endpoint. This is experimental, work-in-progress code and is presently compiled-time disabled (turn on -DJPAKE in Makefile.inc). "just commit it. It isn't too intrusive." deraadt@
2008-11-03fix commentKevin Steves
generated by cgit v1.2.3 (git 2.25.1) at 2024-11-29 10:49:26 +0000