Source-Changes-HG archive
[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index][Old Index]
[src/trunk]: src/crypto/external/bsd/openssh update to 6.1
details: https://anonhg.NetBSD.org/src/rev/6279964c5fc8
branches: trunk
changeset: 783266:6279964c5fc8
user: christos <christos%NetBSD.org@localhost>
date: Wed Dec 12 17:42:39 2012 +0000
description:
update to 6.1
This is primarily a bugfix release.
Features:
* sshd(8): This release turns on pre-auth sandboxing sshd by default for
new installs, by setting UsePrivilegeSeparation=sandbox in sshd_config.
* ssh-keygen(1): Add options to specify starting line number and number of
lines to process when screening moduli candidates, allowing processing
of different parts of a candidate moduli file in parallel
* sshd(8): The Match directive now supports matching on the local (listen)
address and port upon which the incoming connection was received via
LocalAddress and LocalPort clauses.
* sshd(8): Extend sshd_config Match directive to allow setting AcceptEnv
and {Allow,Deny}{Users,Groups}
* Add support for RFC6594 SSHFP DNS records for ECDSA key types. bz#1978
* ssh-keygen(1): Allow conversion of RSA1 keys to public PEM and PKCS8
* sshd(8): Allow the sshd_config PermitOpen directive to accept "none" as
an argument to refuse all port-forwarding requests.
* sshd(8): Support "none" as an argument for AuthorizedPrincipalsFile
* ssh-keyscan(1): Look for ECDSA keys by default. bz#1971
* sshd(8): Add "VersionAddendum" to sshd_config to allow server operators
to append some arbitrary text to the server SSH protocol banner.
Bugfixes:
* ssh(1)/sshd(8): Don't spin in accept() in situations of file
descriptor exhaustion. Instead back off for a while.
* ssh(1)/sshd(8): Remove hmac-sha2-256-96 and hmac-sha2-512-96 MACs as
they were removed from the specification. bz#2023,
* sshd(8): Handle long comments in config files better. bz#2025
* ssh(1): Delay setting tty_flag so RequestTTY options are correctly
picked up. bz#1995
* sshd(8): Fix handling of /etc/nologin incorrectly being applied to root
on platforms that use login_cap.
diffstat:
crypto/external/bsd/openssh/dist/PROTOCOL.certkeys | 17 +-
crypto/external/bsd/openssh/dist/PROTOCOL.mux | 13 +-
crypto/external/bsd/openssh/dist/addrmatch.c | 8 +-
crypto/external/bsd/openssh/dist/auth.c | 14 +-
crypto/external/bsd/openssh/dist/channels.c | 71 ++++-
crypto/external/bsd/openssh/dist/channels.h | 9 +-
crypto/external/bsd/openssh/dist/clientloop.c | 12 +-
crypto/external/bsd/openssh/dist/dns.c | 107 +++++--
crypto/external/bsd/openssh/dist/dns.h | 17 +-
crypto/external/bsd/openssh/dist/jpake.c | 8 +-
crypto/external/bsd/openssh/dist/key.c | 9 +-
crypto/external/bsd/openssh/dist/key.h | 7 +-
crypto/external/bsd/openssh/dist/mac.c | 8 +-
crypto/external/bsd/openssh/dist/moduli.c | 22 +-
crypto/external/bsd/openssh/dist/monitor.c | 9 +-
crypto/external/bsd/openssh/dist/mux.c | 18 +-
crypto/external/bsd/openssh/dist/myproposal.h | 6 +-
crypto/external/bsd/openssh/dist/servconf.c | 236 +++++++++++++++---
crypto/external/bsd/openssh/dist/servconf.h | 33 ++-
crypto/external/bsd/openssh/dist/serverloop.c | 18 +-
crypto/external/bsd/openssh/dist/session.c | 8 +-
crypto/external/bsd/openssh/dist/sftp-client.c | 9 +-
crypto/external/bsd/openssh/dist/sftp.c | 13 +-
crypto/external/bsd/openssh/dist/ssh-keygen.1 | 20 +-
crypto/external/bsd/openssh/dist/ssh-keygen.c | 38 ++-
crypto/external/bsd/openssh/dist/ssh-keyscan.1 | 13 +-
crypto/external/bsd/openssh/dist/ssh-keyscan.c | 8 +-
crypto/external/bsd/openssh/dist/ssh-pkcs11-helper.c | 10 +-
crypto/external/bsd/openssh/dist/ssh.1 | 18 +-
crypto/external/bsd/openssh/dist/ssh.c | 51 ++-
crypto/external/bsd/openssh/dist/ssh_config.5 | 13 +-
crypto/external/bsd/openssh/dist/sshconnect2.c | 8 +-
crypto/external/bsd/openssh/dist/sshd.8 | 12 +-
crypto/external/bsd/openssh/dist/sshd.c | 59 +--
crypto/external/bsd/openssh/dist/sshd_config | 9 +-
crypto/external/bsd/openssh/dist/sshd_config.5 | 30 +-
crypto/external/bsd/openssh/dist/version.h | 8 +-
crypto/external/bsd/openssh/lib/shlib_version | 4 +-
38 files changed, 653 insertions(+), 320 deletions(-)
diffs (truncated from 2515 to 300 lines):
diff -r 2c16e431d422 -r 6279964c5fc8 crypto/external/bsd/openssh/dist/PROTOCOL.certkeys
--- a/crypto/external/bsd/openssh/dist/PROTOCOL.certkeys Wed Dec 12 16:52:23 2012 +0000
+++ b/crypto/external/bsd/openssh/dist/PROTOCOL.certkeys Wed Dec 12 17:42:39 2012 +0000
@@ -162,6 +162,13 @@
are not critical, and an implementation that encounters one that it does
not recognise may safely ignore it.
+Generally, critical options are used to control features that restrict
+access where extensions are used to enable features that grant access.
+This ensures that certificates containing unknown restrictions do not
+inadvertently grant access while allowing new protocol features to be
+enabled via extensions without breaking certificates' backwards
+compatibility.
+
The reserved field is currently unused and is ignored in this version of
the protocol.
@@ -189,7 +196,7 @@
string data
Options must be lexically ordered by "name" if they appear in the
-sequence.
+sequence. Each named option may only appear once in a certificate.
The name field identifies the option and the data field encodes
option-specific information (see below). All options are
@@ -220,7 +227,9 @@
The extensions section of the certificate specifies zero or more
non-critical certificate extensions. The encoding and ordering of
-extensions in this field is identical to that of the critical options.
+extensions in this field is identical to that of the critical options,
+as is the requirement that each name appear only once.
+
If an implementation does not recognise an extension, then it should
ignore it.
@@ -253,5 +262,5 @@
of this script will not be permitted if
this option is not present.
-$OpenBSD: PROTOCOL.certkeys,v 1.8 2010/08/31 11:54:45 djm Exp $
-$NetBSD: PROTOCOL.certkeys,v 1.2 2011/07/25 03:03:10 christos Exp $
+$OpenBSD: PROTOCOL.certkeys,v 1.9 2012/03/28 07:23:22 djm Exp $
+$NetBSD: PROTOCOL.certkeys,v 1.3 2012/12/12 17:42:39 christos Exp $
diff -r 2c16e431d422 -r 6279964c5fc8 crypto/external/bsd/openssh/dist/PROTOCOL.mux
--- a/crypto/external/bsd/openssh/dist/PROTOCOL.mux Wed Dec 12 16:52:23 2012 +0000
+++ b/crypto/external/bsd/openssh/dist/PROTOCOL.mux Wed Dec 12 17:42:39 2012 +0000
@@ -110,9 +110,9 @@
uint32 request id
uint32 forwarding type
string listen host
- string listen port
+ uint32 listen port
string connect host
- string connect port
+ uint32 connect port
forwarding type may be MUX_FWD_LOCAL, MUX_FWD_REMOTE, MUX_FWD_DYNAMIC.
@@ -135,9 +135,9 @@
uint32 request id
uint32 forwarding type
string listen host
- string listen port
+ uint32 listen port
string connect host
- string connect port
+ uint32 connect port
A server may reply with a MUX_S_OK, a MUX_S_PERMISSION_DENIED or a
MUX_S_FAILURE.
@@ -219,6 +219,5 @@
XXX server->client error/warning notifications
XXX send signals via mux
-$OpenBSD: PROTOCOL.mux,v 1.7 2011/05/08 12:52:01 djm Exp $
-$OpenBSD: PROTOCOL.mux,v 1.8 2011/09/09 00:44:07 djm Exp $
-$NetBSD: PROTOCOL.mux,v 1.4 2012/05/02 02:41:08 christos Exp $
+$OpenBSD: PROTOCOL.mux,v 1.9 2012/06/01 00:49:35 djm Exp $
+$NetBSD: PROTOCOL.mux,v 1.5 2012/12/12 17:42:39 christos Exp $
diff -r 2c16e431d422 -r 6279964c5fc8 crypto/external/bsd/openssh/dist/addrmatch.c
--- a/crypto/external/bsd/openssh/dist/addrmatch.c Wed Dec 12 16:52:23 2012 +0000
+++ b/crypto/external/bsd/openssh/dist/addrmatch.c Wed Dec 12 17:42:39 2012 +0000
@@ -1,5 +1,5 @@
-/* $NetBSD: addrmatch.c,v 1.4 2011/09/07 17:49:19 christos Exp $ */
-/* $OpenBSD: addrmatch.c,v 1.5 2010/02/26 20:29:54 djm Exp $ */
+/* $NetBSD: addrmatch.c,v 1.5 2012/12/12 17:42:39 christos Exp $ */
+/* $OpenBSD: addrmatch.c,v 1.6 2012/06/21 00:16:07 dtucker Exp $ */
/*
* Copyright (c) 2004-2008 Damien Miller <djm%mindrot.org@localhost>
@@ -18,7 +18,7 @@
*/
#include "includes.h"
-__RCSID("$NetBSD: addrmatch.c,v 1.4 2011/09/07 17:49:19 christos Exp $");
+__RCSID("$NetBSD: addrmatch.c,v 1.5 2012/12/12 17:42:39 christos Exp $");
#include <sys/types.h>
#include <sys/socket.h>
#include <netinet/in.h>
@@ -317,7 +317,7 @@
char addrbuf[64], *mp, *cp;
/* Don't modify argument */
- if (p == NULL || strlcpy(addrbuf, p, sizeof(addrbuf)) > sizeof(addrbuf))
+ if (p == NULL || strlcpy(addrbuf, p, sizeof(addrbuf)) >= sizeof(addrbuf))
return -1;
if ((mp = strchr(addrbuf, '/')) != NULL) {
diff -r 2c16e431d422 -r 6279964c5fc8 crypto/external/bsd/openssh/dist/auth.c
--- a/crypto/external/bsd/openssh/dist/auth.c Wed Dec 12 16:52:23 2012 +0000
+++ b/crypto/external/bsd/openssh/dist/auth.c Wed Dec 12 17:42:39 2012 +0000
@@ -1,5 +1,5 @@
-/* $NetBSD: auth.c,v 1.5 2011/09/07 17:49:19 christos Exp $ */
-/* $OpenBSD: auth.c,v 1.94 2011/05/23 03:33:38 djm Exp $ */
+/* $NetBSD: auth.c,v 1.6 2012/12/12 17:42:39 christos Exp $ */
+/* $OpenBSD: auth.c,v 1.96 2012/05/13 01:42:32 dtucker Exp $ */
/*
* Copyright (c) 2000 Markus Friedl. All rights reserved.
*
@@ -25,7 +25,7 @@
*/
#include "includes.h"
-__RCSID("$NetBSD: auth.c,v 1.5 2011/09/07 17:49:19 christos Exp $");
+__RCSID("$NetBSD: auth.c,v 1.6 2012/12/12 17:42:39 christos Exp $");
#include <sys/types.h>
#include <sys/stat.h>
#include <sys/param.h>
@@ -398,7 +398,8 @@
char *
authorized_principals_file(struct passwd *pw)
{
- if (options.authorized_principals_file == NULL)
+ if (options.authorized_principals_file == NULL ||
+ strcasecmp(options.authorized_principals_file, "none") == 0)
return NULL;
return expand_authorized_keys(options.authorized_principals_file, pw);
}
@@ -585,9 +586,10 @@
#endif
#endif
struct passwd *pw;
+ struct connection_info *ci = get_connection_info(1, options.use_dns);
- parse_server_match_config(&options, user,
- get_canonical_hostname(options.use_dns), get_remote_ipaddr());
+ ci->user = user;
+ parse_server_match_config(&options, ci);
pw = getpwnam(user);
if (pw == NULL) {
diff -r 2c16e431d422 -r 6279964c5fc8 crypto/external/bsd/openssh/dist/channels.c
--- a/crypto/external/bsd/openssh/dist/channels.c Wed Dec 12 16:52:23 2012 +0000
+++ b/crypto/external/bsd/openssh/dist/channels.c Wed Dec 12 17:42:39 2012 +0000
@@ -1,5 +1,5 @@
-/* $NetBSD: channels.c,v 1.8 2012/05/02 02:41:08 christos Exp $ */
-/* $OpenBSD: channels.c,v 1.315 2011/09/23 07:45:05 markus Exp $ */
+/* $NetBSD: channels.c,v 1.9 2012/12/12 17:42:39 christos Exp $ */
+/* $OpenBSD: channels.c,v 1.318 2012/04/23 08:18:17 djm Exp $ */
/*
* Author: Tatu Ylonen <ylo%cs.hut.fi@localhost>
* Copyright (c) 1995 Tatu Ylonen <ylo%cs.hut.fi@localhost>, Espoo, Finland
@@ -41,7 +41,7 @@
*/
#include "includes.h"
-__RCSID("$NetBSD: channels.c,v 1.8 2012/05/02 02:41:08 christos Exp $");
+__RCSID("$NetBSD: channels.c,v 1.9 2012/12/12 17:42:39 christos Exp $");
#include <sys/param.h>
#include <sys/types.h>
#include <sys/ioctl.h>
@@ -315,6 +315,7 @@
c->istate = CHAN_INPUT_OPEN;
c->flags = 0;
channel_register_fds(c, rfd, wfd, efd, extusage, nonblock, 0);
+ c->notbefore = 0;
c->self = found;
c->type = type;
c->ctype = __UNCONST(ctype);
@@ -1370,6 +1371,8 @@
}
if (newsock < 0) {
error("accept: %.100s", strerror(errno));
+ if (errno == EMFILE || errno == ENFILE)
+ c->notbefore = time(NULL) + 1;
return;
}
set_nodelay(newsock);
@@ -1513,6 +1516,8 @@
newsock = accept(c->sock, (struct sockaddr *)&addr, &addrlen);
if (newsock < 0) {
error("accept: %.100s", strerror(errno));
+ if (errno == EMFILE || errno == ENFILE)
+ c->notbefore = time(NULL) + 1;
return;
}
set_nodelay(newsock);
@@ -1545,7 +1550,10 @@
addrlen = sizeof(addr);
newsock = accept(c->sock, (struct sockaddr *)&addr, &addrlen);
if (newsock < 0) {
- error("accept from auth socket: %.100s", strerror(errno));
+ error("accept from auth socket: %.100s",
+ strerror(errno));
+ if (errno == EMFILE || errno == ENFILE)
+ c->notbefore = time(NULL) + 1;
return;
}
nc = channel_new("accepted auth socket",
@@ -1938,6 +1946,8 @@
if ((newsock = accept(c->sock, (struct sockaddr*)&addr,
&addrlen)) == -1) {
error("%s accept: %s", __func__, strerror(errno));
+ if (errno == EMFILE || errno == ENFILE)
+ c->notbefore = time(NULL) + 1;
return;
}
@@ -2088,16 +2098,21 @@
}
static void
-channel_handler(chan_fn *ftab[], fd_set *readset, fd_set *writeset)
+channel_handler(chan_fn *ftab[], fd_set *readset, fd_set *writeset,
+ time_t *unpause_secs)
{
static int did_init = 0;
u_int i, oalloc;
Channel *c;
+ time_t now;
if (!did_init) {
channel_handler_init();
did_init = 1;
}
+ now = time(NULL);
+ if (unpause_secs != NULL)
+ *unpause_secs = 0;
for (i = 0, oalloc = channels_alloc; i < oalloc; i++) {
c = channels[i];
if (c == NULL)
@@ -2108,10 +2123,30 @@
else
continue;
}
- if (ftab[c->type] != NULL)
- (*ftab[c->type])(c, readset, writeset);
+ if (ftab[c->type] != NULL) {
+ /*
+ * Run handlers that are not paused.
+ */
+ if (c->notbefore <= now)
+ (*ftab[c->type])(c, readset, writeset);
+ else if (unpause_secs != NULL) {
+ /*
+ * Collect the time that the earliest
+ * channel comes off pause.
+ */
+ debug3("%s: chan %d: skip for %d more seconds",
+ __func__, c->self,
+ (int)(c->notbefore - now));
+ if (*unpause_secs == 0 ||
+ (c->notbefore - now) < *unpause_secs)
+ *unpause_secs = c->notbefore - now;
+ }
+ }
channel_garbage_collect(c);
}
+ if (unpause_secs != NULL && *unpause_secs != 0)
+ debug3("%s: first channel unpauses in %d seconds",
+ __func__, (int)*unpause_secs);
}
/*
@@ -2120,7 +2155,7 @@
*/
void
channel_prepare_select(fd_set **readsetp, fd_set **writesetp, int *maxfdp,
- u_int *nallocp, int rekeying)
+ u_int *nallocp, time_t *minwait_secs, int rekeying)
{
u_int n, sz, nfdset;
@@ -2143,7 +2178,8 @@
memset(*writesetp, 0, sz);
if (!rekeying)
- channel_handler(channel_pre, *readsetp, *writesetp);
+ channel_handler(channel_pre, *readsetp, *writesetp,
+ minwait_secs);
}
/*
@@ -2153,7 +2189,7 @@
void
channel_after_select(fd_set *readset, fd_set *writeset)
{
- channel_handler(channel_post, readset, writeset);
Home |
Main Index |
Thread Index |
Old Index