CVS log for src/usr.bin/ssh/auth-options.c

Up to [OpenBSD] / src / usr.bin / ssh

Request diff between arbitrary revisions

Keyword substitution: kv
Default branch: MAIN

don't send the actual forced command in a debug message; ok markus deraadt

Add buffer_get_cstring() and related functions that verify that the
string extracted from the buffer contains no embedded \0 characters*
This prevents random (possibly malicious) crap from being appended to
strings where it would not be noticed if the string is used with
a string(3) function.

Use the new API in a few sensitive places.

* actually, we allow a single one at the end of the string for now because
we don't know how many deployed implementations get this wrong, but don't
count on this to remain indefinitely.

Move the permit-* options to the non-critical "extensions" field for v01
certificates. The logic is that if another implementation fails to
implement them then the connection just loses features rather than fails
outright.

ok markus@

add some optional indirection to matching of principal names listed
in certificates. Currently, a certificate must include the a user's name
to be accepted for authentication. This change adds the ability to
specify a list of certificate principal names that are acceptable.

When authenticating using a CA trusted through ~/.ssh/authorized_keys,
this adds a new principals="name1[,name2,...]" key option.

For CAs listed through sshd_config's TrustedCAKeys option, a new config
option "AuthorizedPrincipalsFile" specifies a per-user file containing
the list of acceptable names.

If either option is absent, the current behaviour of requiring the
username to appear in principals continues to apply.

These options are useful for role accounts, disjoint account namespaces
and "user@realm"-style naming policies in certificates.

feedback and ok markus@

revised certificate format ssh-{dss,rsa}-cert-v01@openssh.com with the
following changes:

move the nonce field to the beginning of the certificate where it can
better protect against chosen-prefix attacks on the signature hash

Rename "constraints" field to "critical options"

Add a new non-critical "extensions" field

Add a serial number

The older format is still support for authentication and cert generation
(use "ssh-keygen -t v00 -s ca_key ..." to generate a v00 certificate)

ok markus@

spelling in error message. ok djm kettenis

Hold authentication debug messages until after successful authentication.
Fixes an info leak of environment variables specified in authorized_keys,
reported by Jacob Appelbaum.  ok djm@

"force-command" is not spelled "forced-command"; spotted by
imorgan AT nas.nasa.gov

reject strings with embedded ASCII nul chars in certificate key IDs,
principal names and constraints

Add support for certificate key types for users and hosts.

OpenSSH certificate key types are not X.509 certificates, but a much
simpler format that encodes a public key, identity information and
some validity constraints and signs it with a CA key. CA keys are
regular SSH keys. This certificate style avoids the attack surface
of X.509 certificates and is very easy to deploy.

Certified host keys allow automatic acceptance of new host keys
when a CA certificate is marked as trusted in ~/.ssh/known_hosts.
see VERIFYING HOST KEYS in ssh(1) for details.

Certified user keys allow authentication of users when the signing
CA key is marked as trusted in authorized_keys. See "AUTHORIZED_KEYS
FILE FORMAT" in sshd(8) for details.

Certificates are minted using ssh-keygen(1), documentation is in
the "CERTIFICATES" section of that manpage.

Documentation on the format of certificates is in the file
PROTOCOL.certkeys

feedback and ok markus@

another chunk of a2port() diff that got away. wtfdjm??

support CIDR address matching in .ssh/authorized_keys from="..." stanzas

ok and extensive testing dtucker@

Implement a channel success/failure status confirmation callback
mechanism. Each channel maintains a queue of callbacks, which will
be drained in order (RFC4253 guarantees confirm messages are not
reordered within an channel).

Also includes a abandonment callback to clean up if a channel is
closed without sending confirmation messages. This probably
shouldn't happen in compliant implementations, but it could be
abused to leak memory.

ok markus@ (as part of a larger diff)

add no-user-rc authorized_keys option to disable execution of ~/.ssh/rc

upgrade to OpenSSH 4.4

upgrade to OpenSSH 4.4

almost entirely get rid of the culture of ".h files that include .h files"
ok djm, sort of ok stevesk
makes the pain stop in one easy step

move #include <string.h> out of includes.h

Use '\0' rather than 0 to terminates strings; ok djm@

move #include <netdb.h> out of includes.h; ok djm@

move #include <pwd.h> out of includes.h; ok markus@

Put $OpenBSD$ tags back (as comments) to replace the RCSID()s that
Theo nuked - our scripts to sync -portable need them in the files

RCSID() can die

upgrade to OpenSSH 4.3

upgrade to OpenSSH 4.3

two changes to the new ssh tunnel support. this breaks compatibility
with the initial commit but is required for a portable approach.
- make the tunnel id u_int and platform friendly, use predefined types.
- support configuration of layer 2 (ethernet) or layer 3
(point-to-point, default) modes. configuration is done using the
Tunnel (yes|point-to-point|ethernet|no) option is ssh_config(5) and
restricted by the PermitTunnel (yes|point-to-point|ethernet|no) option
in sshd_config(5).

ok djm@, man page bits by jmc@

Add support for tun(4) forwarding over OpenSSH, based on an idea and
initial channel code bits by markus@. This is a simple and easy way to
use OpenSSH for ad hoc virtual private network connections, e.g.
administrative tunnels or secure wireless access. It's based on a new
ssh channel and works similar to the existing TCP forwarding support,
except that it depends on the tun(4) network interface on both ends of
the connection for layer 2 or layer 3 tunneling. This diff also adds
support for LocalCommand in the ssh(1) client.

ok djm@, markus@, jmc@ (manpages), tested and discussed with others

upgrade to OpenSSH 4.1

spacing

spacing

upgrade to OpenSSH 4.0

upgrade to OpenSSH 4.0

bz#413: allow optional specification of bind address for port forwardings.
Patch originally by Dan Astorian, but worked on by several people
Adds GatewayPorts=clientspecified option on server to allow remote forwards
to bind to client-specified ports.

ok markus@

upgrade to OpenSSH 3.8upgrade to OpenSSH 3.8upgrade to OpenSSH 3.8

upgrade to OpenSSH 3.7

upgrade to OpenSSH 3.7

deprecate VerifyReverseMapping since it's dangerous if combined
with IP based access control as noted by Mike Harding; replace with
a UseDNS option, UseDNS is on by default and includes the
VerifyReverseMapping check; with itojun@, provos@, jakob@ and deraadt@
ok deraadt@, djm@

rename log() into logit() to avoid name conflict.  markus ok, from netbsd

Update to OpenSSH 3.5

Update to OpenSSH 3.5

add PermitUserEnvironment (off by default!); from dot@dotat.at; ok provos, deraadt

unneeded includes

Pull in OpenSSH-3.4

Upgrade to OpenSSH 3.2.3.

Except for improbable compilation error fixes, this should be the last
commit made to the 2.9-STABLE branche. Have fun upgrading.

Update to OpenSSH-3.2.3

Update to OpenSSH-3.2.2

Update OpenSSH to version 3.2.2.

move the packet_send_debug handling from auth-options.c to auth.c; ok provos@

clean up prototypes

integrate privilege separated openssh; its turned off by default for now.
work done by me and markus@

Merge OpenSSH 3.1, keeping /etc as configuration files directory.
(i.e. OpenSSH 3.1 + openbsd29_3.1.patch)

Merge OpenSSH 3.1.

Update to OpenSSH-3.1 on 3.0-stable branch

s/ReverseMappingCheck/VerifyReverseMapping/ and avoid confusion; ok stevesk@

Pull in OpenSSH-2.9.9

Pull in OpenSSH 2.9.9 to the 2.8 branch.

validate ports for permitopen key file option. add host/port
alternative syntax for IPv6. ok markus@

move ip+hostname check to match.c

undo the .c file split, just merge the header and keep the cvs history

channel layer cleanup: merge header files and split .c files

Pull in OpenSSH-2.9 to 2.8 branch.

Pull in OpenSSH-2.5.2 for 2.8 branch.

Pull in OpenSSH-2.5.2 for 2.7 branch.

ignore permitopen="host:port" if AllowTcpForwarding==no

implement "permitopen" key option, restricts -L style forwarding to
to specified host:port pairs. based on work by harlan@genua.de

missing xfree, deny key on parse error; ok stevesk@

OpenSSH-2.5.1 for 2.7 patch branch

Pull in OpenSSH-2.5.1

Pull in OpenSSH 2.5.0

reset options if no option is given; from han.holl@prismant.nl

make ReverseMappingCheck optional in sshd_config; ok djm@,dugsong@

split ssh.h and try to cleanup the #include mess. remove unnecessary #includes.
rename util.[ch] -> misc.[ch]

pass the filename to auth_parse_options()

move ssh1 definitions to ssh1.h, pathnames to pathnames.h

fix comment

replace 'unsigned bla' with 'u_bla' everywhere. also, replace 'char unsigned'
with u_char.

case insensitive key options; from stevesk@sweden.hp.com

openssh-2.3.0 (again) for 2.7 branch

clear options on every call.

some more Copyright fixes

cleanup copyright notices on all files.  I have attempted to be accurate with
the details.  everything is now under Tatu's licence (which I copied from his
readme), and/or the core-sdi bsd-ish thing for deattack, or various openbsd
developers under a 2-term bsd licence.  We're not changing any rules, just
being accurate.

Pull in the rest of openssh-2.2.0 to 2.7 branch (luvin' cvs...)

OpenBSD tag

split auth-rsa option parsing into auth-options
add options support to authorized_keys2