CVS log for src/usr.bin/ssh/authfd.h

Up to [OpenBSD] / src / usr.bin / ssh

Request diff between arbitrary revisions

Keyword substitution: kv
Default branch: MAIN

Do not fall back to adding keys without contraints (ssh-add -c / -t ...)
when the agent refuses the constrained add request. This was a useful
migration measure back in 2002 when constraints were new, but just
adds risk now.

bz #1612, report and patch from dkg AT fifthhorseman.net; ok markus@

upgrade to OpenSSH 4.4

upgrade to OpenSSH 4.4

almost entirely get rid of the culture of ".h files that include .h files"
ok djm, sort of ok stevesk
makes the pain stop in one easy step

standardise spacing in $OpenBSD$ tags; requested by deraadt@

upgrade to OpenSSH 3.8upgrade to OpenSSH 3.8upgrade to OpenSSH 3.8

upgrade to OpenSSH 3.8

unexpand and delete whitespace at EOL; ok markus@

upgrade to OpenSSH 3.7

upgrade to OpenSSH 3.7

make agent constraints (lifetime, confirm) work with smartcard keys; ok markus@

Merge OpenSSH 3.6.1

Update to OpenSSH 3.6

ssh-add -c, prompt user for confirmation (using ssh-askpass) when
private agent key is used; with djm@; test by dugsong@, djm@; ok deraadt@

Update to OpenSSH 3.5

Update to OpenSSH 3.5

don't connect to agent to test for presence if we've previously
connected; ok markus@

Pull in OpenSSH-3.4

Update OpenSSH to version 3.3 (with local changes, configuration files still
living in /etc and privsep user being nobody).

KNF done automatically while reading....

remove the CONSTRAIN_IDENTITY messages and introduce a new
ADD_ID message with contraints instead. contraints can be
only added together with the private key.

fix stupid typo

break agent key lifetime protocol and allow other contraints for key usage.

ssh-add -t life,  Set lifetime (in seconds) when adding identities; ok provos@

ssh-add -x for lock and -X for unlocking the agent.
todo: encrypt private keys with locked...

Upgrade to OpenSSH 3.2.3.

Except for improbable compilation error fixes, this should be the last
commit made to the 2.9-STABLE branche. Have fun upgrading.

Update OpenSSH to version 3.2.2.

Add PIN-protection for secret key.

Merge OpenSSH 3.1, keeping /etc as configuration files directory.
(i.e. OpenSSH 3.1 + openbsd29_3.1.patch)

Merge OpenSSH 3.1.

Update to OpenSSH-3.1 on 3.0-stable branch

$OpenBSD$ and RCSID() cleanup: don't use RCSID() in .h files; add
missing RCSID() to .c files and remove dup /*$OpenBSD$*/ from .c
files.  ok markus@

signed vs. unsigned: make size arguments u_int, ok stevesk@

Pull in OpenSSH-2.9.9

Pull in OpenSSH 2.9.9 to the 2.8 branch.

extended failure messages from galb@vandyke.com

use strings instead of ints for smartcard reader ids

remove comments from .h, since they are cut&paste from the .c files
and out of sync

prototype pedant.  not very creative...
- () -> (void)
- no variable names

initial support for smartcards in the agent

Pull in OpenSSH-2.9 to 2.8 branch.

Pull in OpenSSH-2.5.2 for 2.8 branch.

Pull in OpenSSH-2.5.2 for 2.7 branch.

OpenSSH-2.5.1 for 2.7 patch branch

Pull in OpenSSH-2.5.1

Pull in OpenSSH 2.5.0

fix prototypes; from  stevesk@pobox.com

replace 'unsigned bla' with 'u_bla' everywhere. also, replace 'char unsigned'
with u_char.

add support for RSA to SSH2.  please test.

there are now 3 types of keys: RSA1 is used by ssh-1 only,
RSA and DSA are used by SSH2.

you can use 'ssh-keygen -t rsa -f ssh2_rsa_file' to generate RSA
keys for SSH2 and use the RSA keys for hostkeys or for user keys.

SSH2 RSA or DSA keys are added to .ssh/authorised_keys2 as before.

IdentityFile2, HostDsaKey and DSAAuthentication are obsolete.
you can use multiple IdentityFile and HostKey for all types of keys.

the option DSAAuthentication is replaced by PubkeyAuthetication.

openssh-2.3.0 (again) for 2.7 branch

interop with ssh-agent2, from <res@shore.net>

bug compat for old ssh.com software

cleanup copyright notices on all files.  I have attempted to be accurate with
the details.  everything is now under Tatu's licence (which I copied from his
readme), and/or the core-sdi bsd-ish thing for deattack, or various openbsd
developers under a 2-term bsd licence.  We're not changing any rules, just
being accurate.

Pull in the rest of openssh-2.2.0 to 2.7 branch (luvin' cvs...)

add SSH2/DSA support to the agent and some other DSA related cleanups.
(note that we cannot talk to ssh.com's ssh2 agents)

make ssh-add accept dsa keys (the agent does not)

OpenBSD tag

whitespace cleanup

KNF, final part 3

much more KNF

the keysize of rsa-parameter 'n' is passed implizit,
a few more checks and warnings about 'pretended' keysizes.

fix old connect() race security-bug for ssh-agent and agent-forwarding
by removing the connect() junk, with the following restrictions:
1) change the version to "OpenSSH-1.1":
   agent-forwarding will work only between OpenSSH-1.1 client and
   OpenSSH-1.1 server
2) renamed the environment variable of OpenSSH-1.1 to
   "SSH_AUTH_SOCKET", since useing OpenSSH-1.0 ssh-add against the new
   ssh-agent does not work

convert all uses of gmp to SSL bignum
convert all used of rsa to SSL rsa functions
remove all use of randomstate to OpenBSD arc4random() and arc4_stir()
all this done at a long long night in Canada.

i bet a lot of people didn't know what ssh 1.2.16 had a nice license.
well, except for the patent issues.  someone in sweden (forget their
name at the moment) cleaned out most of the patented code, and now
this code removes rsa code.  when this is done, it will link against
libssl, but the work isn't completely done yet.  then we need to bring
this up to modern days, featurewise.