summaryrefslogtreecommitdiff
path: root/usr.bin
AgeCommit message (Collapse)Author
2019-12-30SK API and sk-helper error/PIN passingDamien Miller
Allow passing a PIN via the SK API (API major crank) and let the ssh-sk-helper API follow. Also enhance the ssh-sk-helper API to support passing back an error code instead of a complete reply. Will be used to signal "wrong PIN", etc. feedback and ok markus@
2019-12-30implement loading resident keys in ssh-addDamien Miller
"ssh-add -O" will load resident keys from a FIDO2 token and add them to a ssh-agent. feedback and ok markus@
2019-12-30implement loading of resident keys in ssh-sk-helperDamien Miller
feedback and ok markus@
2019-12-30resident keys support in SK APIDamien Miller
Adds a sk_load_resident_keys() function to the security key API that accepts a security key provider and a PIN and returns a list of keys. Implement support for this in the usbhid middleware. feedback and ok markus@
2019-12-30Factor out parsing of struct sk_enroll_responseDamien Miller
We'll reuse this for extracting resident keys from a device. feedback and ok markus@
2019-12-30basic support for generating FIDO2 resident keysDamien Miller
"ssh-keygen -t ecdsa-sk|ed25519-sk -x resident" will generate a device-resident key. feedback and ok markus@
2019-12-30remove single-letter flags for moduli optionsDamien Miller
Move all moduli generation options to live under the -O flag. Frees up seven single-letter flags. NB. this change break existing ssh-keygen commandline syntax for moduli- related operations. Very few people use these fortunately. feedback and ok markus@
2019-12-30prepare for use of ssh-keygen -O flag beyond certsDamien Miller
Move list of available certificate options in ssh-keygen.1 to the CERTIFICATES section. Collect options specified by -O but delay parsing/validation of certificate options until we're sure that we're acting as a CA. ok markus@
2019-12-27Support regex search in copy mode, from Anindya Mukherjee in GitHubNicholas Marriott
issue 2038.
2019-12-27sort -Y internally in the options list, as is already done in synopsis;Jason McIntyre
2019-12-27in the options list, sort -Y and -y;Jason McIntyre
2019-12-26Do not fail an assertion when a high level macro occurs in the bodyIngo Schwarze
of a conditional inside a .ce request block. Instead, abort the .ce block just like when there is no conditional in between. Bug found by espie@ working on the textproc/fstrcmp port.
2019-12-26Pass correct value into iterator callback for time formats.Nicholas Marriott
2019-12-26Add a number of new formats to inspect what sessions and clients aNicholas Marriott
window is present or active in. From Tyler Culp in GitHub issue 2034.
2019-12-25exit_type is already set up with exactly the information we need,Marc Espie
so get rid of cluttered duplicate logic okay kn@
2019-12-24Remove non-sensical line. The node certainly hasn't been rebuilt yet,Marc Espie
and the first thing job_attach_node does is... set the field to BUILDING. probably remnants of code prior to refactoring okay captain_obvious
2019-12-24Fix name of option, GitHub issue 2030.Nicholas Marriott
2019-12-22- give a specific value to OP_ERROR that doesn't occur in natureMarc Espie
- define OP_ZERO as zero, to make some function calls obvious - split ParseDoOp into two functions: ParseDoOp that only deals with : :: ! and ParseDoSpecial that only deals with special nodes. This simplifies both functions accordingly - always initialize special_op okay millert@
2019-12-22we also have "VAR_*" constants in parsevar with totally different meanings.Marc Espie
Rename to avoid ambiguity - VAR_IS_SHELL (in var.c): the SHELL variable, which has specific POSIX semantics - VAR_SHELL (in parsevar.c): assign the result of running the command to the variable. no actual code change
2019-12-22have parseb64file be non-destructive, so we can write theMarc Espie
comment in zsig without needing an extra copy okay tedu@
2019-12-21a few depend:-related thingies that were still in.Marc Espie
okay millert@, tb@
2019-12-21Replace the term "security key" with "(FIDO) authenticator".Christian Weisgerber
The polysemous use of "key" was too confusing. Input from markus@. ok jmc@
2019-12-21Restore source-file -q behaviour, broken in r1.42; OK nicm@Tim van der Molen
2019-12-21yet another mostly cosmetic diffMarc Espie
- rename context into localvars, which is more meaningful and less generic - instantiate the random rumbling at the start of gnode.h with actual variable names - explain and group gnode.h variables better - make some comments terser/more meaningful okay millert@
2019-12-21those fields only hold true/false valueMarc Espie
make it obvious okay millert@
2019-12-21rename a few variable/functions to have better names.Marc Espie
adjust comments to be more meaningful reorder predecessors/successors fields in an order that makes more sense to me. okay millert@
2019-12-21rename built_status constants to be less quirkyMarc Espie
fold back BEINGMADE and BUILDING which mean the same thing GC CYCLE/ENDCYCLE okay millert@
2019-12-21tweak buffer handling a bit:Marc Espie
- make BufExpand a real function, zap BufOverflow - sprinkle assert that justify the arithmetic - use unsigned constants - fix a bug in the unlikely condition where Buf_printf would exactly match the buffer boundary and Buf_Retrieve would be called right after okay millert@
2019-12-21The man page actually didn't explain its main parameters!Marc Espie
fix glaring omission okay schwarze@, jmc@
2019-12-21Allow forwarding a different agent socket to the path specified byDamien Miller
$SSH_AUTH_SOCK, by extending the existing ForwardAgent option to accepting an explicit path or the name of an environment variable in addition to yes/no. Patch by Eric Chiang, manpage by me; ok markus@
2019-12-20SSH U2F keys can now be used as host keys. Fix a garden path sentence.Christian Weisgerber
ok markus@
2019-12-20Move always unsupported keywords to be grouped with the other ones.Darren Tucker
Move oSecurityProvider to match the order in the OpCodes enum. Patch from openbsd@academicsolutions.ch, ok djm@
2019-12-20Remove obsolete opcodes from the configuation enum. Patch fromDarren Tucker
openbsd@academicsolutions.ch, ok djm@
2019-12-20Remove now-obsolete config options from example in comment. Patch fromDarren Tucker
openbsd@academicsolutions.ch, ok djm@
2019-12-19Document that security key-hosted keys can act as host keys.Christian Weisgerber
Update the list of default host key algorithms in ssh_config.5 and sshd_config.5. Copy the description of the SecurityKeyProvider option to sshd_config.5. ok jmc@
2019-12-19When adding a list with multiple commands to the queue, the next item toNicholas Marriott
insert after needs to be the last one added, not the first. Reported by Jason Kim in GitHub issue 2023.
2019-12-19"Forward security" -> "Forward secrecy" since that's the correct term.Darren Tucker
Add "MAC" since we use that acronym in other man pages. ok naddy@
2019-12-19Prevent redirections to file: URLsJeremie Courreges-Anglas
Report and fix from Hiltjo Posthuma, input from and ok deraadt@
2019-12-18use "Currently" in the doc for "openssl enc" when talking about defaultStuart Henderson
md, to hint that it might not always be the case (e.g. if dealing with files from a different version of the tool). ok tb@
2019-12-18In January, the default digest used in the openssl enc command wasTheo Buehler
changed from md5 to sha256. Update manual to reflect that. From Fabio Scotoni ok jmc
2019-12-18Do not rely on errno after glob(3) fails.Nicholas Marriott
2019-12-17cut obsolete lists of crypto algorithms from outline of how SSH worksChristian Weisgerber
ok markus@ jmc@
2019-12-17Use the message that has already been built rather than the va_list.Nicholas Marriott
2019-12-16Delete tests for P_THREAD that predate the existence ofPhilip Guenther
KERN_PROC_SHOW_THREADS and have been rendered superfluous by it. Similarly, some P_SYSTEM tests can be deleted or pushed to the kernel by using KERN_PROC_ALL instead of KERN_PROC_KTHREAD. ok visa@ mpi@
2019-12-16If /dev/fd/X is a symlink and realpath() expands symlinks, /dev/fd/XNicholas Marriott
ends up pointing to the wrong place before it is passed to the client. The path is only used internally so there is no real need for realpath(), remove it and move the get_path function to file.c where all the callers are.
2019-12-16Need to include message size in the maximum buffer calculation.Nicholas Marriott
2019-12-16Instead of using large buffers in imsgs, add the data or path onto the end.Nicholas Marriott
2019-12-16strdup may return NULL if memory allocation fails. Use the safer xstrduptobhe
which fatals on allocation failures. ok markus@
2019-12-16sort sk-* methods behind their plain key methods cousins for nowDamien Miller
2019-12-15don't treat HostKeyAgent=none as a path either; avoids spuriousDamien Miller
warnings from the cfgparse regress test
generated by cgit v1.2.3 (git 2.25.1) at 2025-01-09 00:59:54 +0000