summaryrefslogtreecommitdiff
path: root/usr.bin
AgeCommit message (Collapse)Author
2021-12-07better error message for FIDO keys when we can't match them to a tokenDamien Miller
2021-12-07Simple conversion to opaque EVP_CIPHER.Theo Buehler
2021-12-07switch from tradcpp(1) to cpp(1); ok jsg@Robert Nagy
2021-12-07Improve the COMMAND SECTION section in multiple respects regardingIngo Schwarze
correctness, clarity, readability, and markup conventions. Triggered by Richard Ulmer <... rulmer at mailbox dot org> wondering whether the list of actions is complete and pointing out that the "shell" action no longer exists (it was removed quite some time ago for security reasons). OK jmc@
2021-12-07Respond to OSC 4 query.Nicholas Marriott
2021-12-07Use four digits not two for RGB responses to match other terminals.Nicholas Marriott
2021-12-07sys/signal.h (or some master include) must happen before sys/proc.h, whichTheo de Raadt
is not standalone. This problem is being hidden by a sys/param.h which cannot be deleted yet.
2021-12-07Use PATH_MAX (the standard name) rather than MAXPATHLEN (from BSD sys/param.h)Theo de Raadt
2021-12-06Clean up a bunch of dead code in s_server.c and s_socket.cTheo Buehler
jsg's analysis tool flagged a potential double free in do_server(). While this looks like a false positive, we can clean this code up a little: the host name passed to the callbacks isn't used by either sv_body() and www_body(), so it can be made local to do_accept() (an extra variable would not even be needed). Simplify the callbacks' signatures accordingly. Remove some commented out linger code that would never be used again anyway. ok inoguchi jsg
2021-12-06Fix g/G keys to be in line with copy mode.Nicholas Marriott
2021-12-06Do not dereference NULL window when resizing client, GitHub issue 2982.Nicholas Marriott
2021-12-05sys/select.h is not needed, if howmany/NBBY are needed they will arriveTheo de Raadt
via netinet/in.h and sys/time.h, which I must say surprises me a bit
2021-12-05fix unintended sizeof pointer in debug pathJonathan Gray
ok markus@
2021-12-04RSA/SHA-1 is not used by default anymore on the serverChristian Weisgerber
2021-12-03Fixed-size NOFILE_MAX (from sys/param.h of course) array is crazy, soTheo de Raadt
rewrite to expand the array as needed. ok tb
2021-12-02hash full host:port when asked to hash output, fixes hashes for non-Damien Miller
default ports. bz3367 ok dtucker@
2021-12-02improve the testing of credentials against inserted FIDO keys a littleDamien Miller
more: ask the token whether a particular key belongs to it in cases where the token support on-token user- verification (e.g. biometrics) rather than just assuming that it will accept it. Will reduce spurious "Confirm user presence" notifications for key handles that relate to FIDO keys that are not currently inserted in at least some cases. Motivated by bz3366; by Pedro Martelletto
2021-12-02move check_sk_options() up so we can use it earlierDamien Miller
2021-12-02ssh-rsa is no longer in the default for PubkeyAcceptedAlgorithms.Darren Tucker
2021-12-02list uppercase options along with lower in SYNOPSIS/options list/usage;Jason McIntyre
suggested by/ok deraadt
2021-12-02don't put the tty into raw mode when SessionType=none, avoids ^c beingDamien Miller
unable to kill such a session. bz3360; ok dtucker@
2021-11-30Improved error handling in config parser.Tobias Stoeckmann
- Escaped newlines confused column counter - An unclosed quote could have been logged multiple times - Signed data types could overflow, which is undefined behavior ok tedu
2021-11-30Fix indentation of return in yy_try_NUL_trans().Todd C. Miller
M4_YY_NOOP_GUTS_VAR is a no-op in most cases but its indentation remains, leading to double indentation of the return statement. This fixes "misleading indentation" warnings from clang. OK tb@
2021-11-29Bump response timer to three seconds, GitHub issue 2984.Nicholas Marriott
2021-11-29Fix user option lookup ordering.Nicholas Marriott
2021-11-29local copy of roundup() means no more sys/param.hTheo de Raadt
2021-11-28Stop using MAXBSIZE to eliminate sys/param.h including (which injects aTheo de Raadt
ton of namespace intrusion). Create local sizes, and refactor some code along the way. ok millert
2021-11-28sshsig: return "key not found" when searching empty files rather thanDamien Miller
"internal error"
2021-11-28ssh-keygen -Y match-principals doesn't accept any -O optionsDamien Miller
at present, so don't say otherwise in SYNOPSIS; spotted jmc@
2021-11-28fix indenting in last commitDamien Miller
2021-11-28missing initialisation for oerrnoDamien Miller
2021-11-27Add ssh-keygen -Y match-principals operation to perform matching ofDamien Miller
principals names against an allowed signers file. Requested by and mostly written by Fabian Stelzer, towards a TOFU model for SSH signatures in git. Some tweaks by me. "doesn't bother me" deraadt@
2021-11-26openssl(1): drop support for netscape certificates and server gated keys.Theo Buehler
ok inoguchi jsing
2021-11-26followng -> followingJonathan Gray
2021-11-26definiton -> definitionJonathan Gray
2021-11-25debug("func: ...") -> debug_f("...")Damien Miller
2021-11-25We know how to print a size_t now. Drop a comment and a cast.Theo Buehler
ok bluhm inoguchi
2021-11-21Tweak for opaque EVP_MD: use EVP_MD_type(dgst) instead of dgst->type.Theo Buehler
2021-11-21Add the new `ipsec_exctdb' ipsec(4) counter to count and expose to theVitaliy Makkoveev
userland the TDBs which exceeded hard limit. Also the `ipsec_notdb' counter description in header doesn't math to netstat(1) description. We never count `ipsec_notdb' and the netstat(1) description looks more appropriate so it's used to avoid confusion with the new counter. ok bluhm@
2021-11-21tee(1): use idiomatic write loopScott Soule Cheloha
tee(1) handles partial writes correctly, but the more idiomatic write loop is shorter and easier to audit than this heterodox approach. ok millert@
2021-11-20Convert openssl(1) to using BN_GENCB on the heapTheo Buehler
This is three times the same thing while genrsa needs some extra steps to deal with opaque BIGNUMs. We can also garbage collect some Win 3.1 contortions and use the conversion routines directly instead of doing them manually. ok jsing
2021-11-20typo in commentTheo Buehler
2021-11-18less confusing debug message; bz#3365Damien Miller
2021-11-18avoid xmalloc(0) for PKCS#11 keyid for ECDSA keys (we already did thisDamien Miller
for RSA keys). Avoids fatal errors for PKCS#11 libraries that return empty keyid, e.g. Microchip ATECC608B "cryptoauthlib"; bz#3364
2021-11-18ssh-keygen -Y find-principals was verifying key validity when usingDamien Miller
ca certs but not with simple key lifetimes within the allowed signers file. Since it returns the first keys principal it finds this could result in a principal with an expired key even though a valid one is just below. patch from Fabian Stelzer; feedback/ok djm markus
2021-11-18check for POLLHUP wherever we check for POLLINDamien Miller
2021-11-18fd leak in sshd listen loop error path; from Gleb SmirnoffDamien Miller
2021-11-18check for POLLHUP as well as POLLIN in sshd listen loop;Damien Miller
ok deraadt millert
2021-11-18check for POLLHUP as well as POLLIN, handle transient IO errors as wellDamien Miller
as half-close on the output side; ok deraadt millert
2021-11-17uniq(1): ignore trailing newlines when comparing linesScott Soule Cheloha
POSIX.1-2008 tweaked the uniq definition in light of AGI 1003.1-2001 #133. uniq must now *ignore* the trailing newline when comparing lines from the input. In practice this means that if the last line in the input is missing a trailing newline it isn't necessarily different from the line preceding it. So, uniq(1) now stubs the trailing newline before doing any line comparisons. For sake of simplicity, this patch introduces a second change: if the last line in the input is missing a trailing newline and we choose to print the line, a newline is appended when we print it. Adopting the newline change aligns our implementation with with POSIX.1-2008 (which we already claim in the manpage). Adopting both changes aligns our behavior with that of FreeBSD and GNU uniq. For better or worse, OpenBSD's uniq no longer behaves like NetBSD's uniq in this corner case. References: POSIX.1-2001 uniq: https://pubs.opengroup.org/onlinepubs/009695399/utilities/uniq.html Austin Group Interpretation 1003.1-2001 #133: https://collaboration.opengroup.org/austin/interps/documents/14355/AI-133.txt POSIX.1-2008 uniq: https://pubs.opengroup.org/onlinepubs/9699919799/utilities/uniq.html -- Discussed with millert@. With input from schwarze@. Positive feedback from bcallah@. Thread: https://marc.info/?l=openbsd-tech&m=163581613829524&w=2 ok millert@
generated by cgit v1.2.3 (git 2.25.1) at 2024-12-12 10:08:30 +0000