summaryrefslogtreecommitdiff
path: root/usr.bin/ssh/ssh.c
AgeCommit message (Collapse)Author
2020-07-17Add a '%k' TOKEN that expands to the effective HostKey of theDarren Tucker
destination. This allows, eg, keeping host keys in individual files using "UserKnownHostsFile ~/.ssh/known_hosts.d/%k". bz#1654, ok djm@, jmc@ (man page bits)
2020-07-17Add %-TOKEN, environment variable and tilde expansion to UserKnownHostsFile,Darren Tucker
allowing the file to be automagically split up in the configuration (eg bz#1654). ok djm@, man page parts jmc@
2020-07-05some language improvements; ok markusDamien Miller
2020-06-26Defer creation of ~/.ssh by ssh(1) until we attempt to write to it so weDarren Tucker
don't leave an empty .ssh directory when it's not needed. Use the same function to replace the code in ssh-keygen that does the same thing. bz#3156, ok djm@
2020-06-05Correct historical comment: provos@ modified OpenSSH to work with SSLeayDarren Tucker
(very quickly replaced by OpenSSL) not SSL in general. ok deraadt, historical context markus@
2020-05-29Allow some keywords to expand shell-style ${ENV} environmentDarren Tucker
variables on the client side. The supported keywords are CertificateFile, ControlPath, IdentityAgent and IdentityFile, plus LocalForward and RemoteForward when used for Unix domain socket paths. This would for example allow forwarding of Unix domain socket paths that change at runtime. bz#3140, ok djm@
2020-04-10Add TOKEN percent expansion to LocalFoward and RemoteForward when usedDarren Tucker
for Unix domain socket forwarding. Factor out the code for the config keywords that use the most common subset of TOKENS into its own function. bz#3014, ok jmc@ (man page bits) djm@
2020-04-03r1.522 deleted one too many lines; repairDamien Miller
2020-04-03fix debug statementDamien Miller
2020-04-03the tunnel-forwarding vs ExitOnForwardFailure fix that I committedDamien Miller
earlier had an off-by-one. Fix this and add some debugging that would have made it apparent sooner.
2020-04-03make failures when establishing "Tunnel" forwarding terminate theDamien Miller
connection when ExitOnForwardFailure is enabled; bz3116; ok dtucker
2020-04-03Make with config keywords support which percent_expansions more consistent.Darren Tucker
- %C is moved into its own function and added to Match Exec. - move the common (global) options into a macro. This is ugly but it's the least-ugly way I could come up with. - move IdentityAgent and ForwardAgent percent expansion to before the config dump to make it regression-testable. - document all of the above ok jmc@ for man page bits, "makes things less terrible" djm@ for the rest.
2020-03-06initialize cname in case ai_canonname is NULL or too long; ok djmMarkus Friedl
2020-02-18Detect and prevent simple configuration loops when using ProxyJump.Darren Tucker
bz#3057, ok djm@
2020-02-07Add ssh -Q key-sig for all key and signature types. Teach ssh -Q to acceptDarren Tucker
ssh_config(5) and sshd_config(5) algorithm keywords as an alias for the corresponding query. Man page help jmc@, ok djm@.
2020-02-06Replace "security key" with "authenticator" in program messages.Christian Weisgerber
This replaces "security key" in error/usage/verbose messages and distinguishes between "authenticator" and "authenticator-hosted key". ok djm@
2020-01-28disable UpdateHostKeys=ask when in quiet mode;Damien Miller
"work for me" matthieu@
2020-01-27disable UpdateHostKeys=ask if command is specified; ok djm@ sthen@Markus Friedl
2020-01-25allow UpdateKnownHosts=yes to function when multiple known_hosts filesDamien Miller
are in use. When updating host keys, ssh will now search subsequent known_hosts files, but will add new/changed host keys to the first specified file only. bz#2738 ok markus@
2020-01-25expose PKCS#11 key labels/X.509 subjects as commentsDamien Miller
Extract the key label or X.509 subject string when PKCS#11 keys are retrieved from the token and plumb this through to places where it may be used as a comment. based on https://github.com/openssh/openssh-portable/pull/138 by Danielle Church feedback and ok markus@
2020-01-23Make zlib optional. This adds a "ZLIB" build time option that allowsDarren Tucker
building without zlib compression and associated options. With feedback from markus@, ok djm@
2020-01-23Replace all calls to signal(2) with a wrapper around sigaction(2).Darren Tucker
This wrapper blocks all other signals during the handler preventing races between handlers, and sets SA_RESTART which should reduce the potential for short read/write operations.
2020-01-05fix CanonicalizeHostname, broken by rev 1.507Bob Beck
Issue noticed and reported by Pierre-Olivier Martel <pom@apple.com> ok dtucker@ markus@ djm@
2019-12-21Allow forwarding a different agent socket to the path specified byDamien Miller
$SSH_AUTH_SOCK, by extending the existing ForwardAgent option to accepting an explicit path or the name of an environment variable in addition to yes/no. Patch by Eric Chiang, manpage by me; ok markus@
2019-11-18additional missing stdarg.h includes when built without WITH_OPENSSL; ok djm@Christian Weisgerber
2019-10-31ssh client support for U2F/FIDO keysDamien Miller
2019-09-13allow %n to be expanded in ProxyCommand stringsDamien Miller
From Zachary Harmany via github.com/openssh/openssh-portable/pull/118 ok dtucker@
2019-09-06Allow prepending a list of algorithms to the default set by startingChristian Weisgerber
the list with the '^' character, e.g. HostKeyAlgorithms ^ssh-ed25519 Ciphers ^aes128-gcm@openssh.com,aes256-gcm@openssh.com ok djm@ dtucker@
2019-06-28When system calls indicate an error they return -1, not some arbitraryTheo de Raadt
value < 0. errno is only updated in this case. Change all (most?) callers of syscalls to follow this better, and let's see if this strictness helps us in the future.
2019-06-14slightly more instructive error message when the user specifies multipleDamien Miller
-J options on the commandline. bz3015 ok dtucker@
2019-06-12Hostname->HostName cleanup; from lauri tirkkonenJason McIntyre
ok dtucker
2019-06-06Replace calls to ssh_malloc_init() by a static init of malloc_options.Otto Moerbeek
Prepares for changes in the way malloc is initialized. ok guenther@ dtucker@
2019-04-23Use the LogLevel typdef instead of int where appropriate. Patch fromDarren Tucker
Markus Schmidt via openssh-unix-dev, ok markus@
2019-01-19remove last references to active_stateDamien Miller
with & ok markus@
2019-01-19convert ssh.c to new packet APIDamien Miller
with & ok markus@
2019-01-19begin landing remaining refactoring of packet parsing API, startedDamien Miller
almost exactly six years ago. This change stops including the old packet_* API by default and makes each file that requires the old API include it explicitly. We will commit file-by-file refactoring to remove the old API in consistent steps. with & ok markus@
2018-12-27move client/server SSH-* banners to buffers under ssh->kex and factorDamien Miller
out the banner exchange. This eliminates some common code from the client and server. Also be more strict about handling \r characters - these should only be accepted immediately before \n (pointed out by Jann Horn). Inspired by a patch from Markus Schmidt. (lots of) feedback and ok markus@
2018-11-23add a ssh_config "Match final" predicateDamien Miller
Matches in same pass as "Match canonical" but doesn't require hostname canonicalisation be enabled. bz#2906 ok markus
2018-10-23refer to OpenSSL not SSLeay;Damien Miller
we're old, but we don't have to act it
2018-10-03Allow ssh_config IdentityAgent directive to accept environment variableDamien Miller
names as well as explicit paths. ok dtucker@
2018-09-21Treat connections with ProxyJump specified the same as ones with aDamien Miller
ProxyCommand set with regards to hostname canonicalisation (i.e. don't try to canonicalise the hostname unless CanonicalizeHostname is set to 'always'). Patch from Sven Wegener via bz#2896
2018-09-20fix "ssh -Q sig" to show correct signature algorithm list (it wasDamien Miller
erroneously showing certificate algorithms); prompted by markus@
2018-09-12Add "ssh -Q sig" to allow listing supported signature algorithmsDamien Miller
ok markus@
2018-07-27Now that ssh can't be setuid, remove the original_real_uid andDarren Tucker
original_effective_uid globals and replace with calls to plain getuid(). ok djm@
2018-07-25Use the caller provided (copied) pwent struct in load_public_identity_filesBob Beck
instead of calling getpwuid() again and discarding the argument. This prevents a client crash where tilde_expand_filename calls getpwuid() again before the pwent pointer is used. Issue noticed and reported by Pierre-Olivier Martel <pom@apple.com> ok djm@ deraadt@
2018-07-19Deprecate UsePrivilegedPort now that support for running ssh(1)Darren Tucker
setuid has been removed, remove supporting code and clean up references to it in the man pages We have not shipped ssh(1) the setuid bit since 2002. If ayone really needs to make connections from a low port number this can be implemented via a small setuid ProxyCommand. ok markus@ jmc@ djm@
2018-07-18Remove support for running ssh(1) setuid and fatal if attempted.Darren Tucker
Do not link uidwap.c into ssh any more. Neuters UsePrivilegedPort, which will be marked as deprecated shortly. ok markus@ djm@
2018-07-16Slot 0 in the hostbased key array was previously RSA1, but that isDarren Tucker
now gone and the slot is unused so remove it. Remove two now-unused macros, and add an array bounds check to the two remaining ones (array is statically sized, so mostly a safety check on future changes). ok markus@
2018-07-16Remove support for loading HostBasedAuthentication keys directly inDarren Tucker
ssh(1) and always use ssh-keysign. This removes one of the few remaining reasons why ssh(1) might be setuid. ok markus@
2018-07-16keep options.identity_file_userprovided array in sync when we loadDamien Miller
keys, fixing some spurious error messages; ok markus
generated by cgit v1.2.3 (git 2.25.1) at 2025-01-30 04:16:04 +0000