Source-Changes-HG archive
[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index][Old Index]
[src/OPENSSH]: src/crypto/external/bsd/openssh/dist Import OpenSSH 8.9.
details: https://anonhg.NetBSD.org/src/rev/9532ca75ef8e
branches: OPENSSH
changeset: 362012:9532ca75ef8e
user: christos <christos%NetBSD.org@localhost>
date: Wed Feb 23 19:04:25 2022 +0000
description:
Import OpenSSH 8.9.
Future deprecation notice
=========================
A near-future release of OpenSSH will switch scp(1) from using the
legacy scp/rcp protocol to using SFTP by default.
Legacy scp/rcp performs wildcard expansion of remote filenames (e.g.
"scp host:* .") through the remote shell. This has the side effect of
requiring double quoting of shell meta-characters in file names
included on scp(1) command-lines, otherwise they could be interpreted
as shell commands on the remote side.
This creates one area of potential incompatibility: scp(1) when using
the SFTP protocol no longer requires this finicky and brittle quoting,
and attempts to use it may cause transfers to fail. We consider the
removal of the need for double-quoting shell characters in file names
to be a benefit and do not intend to introduce bug-compatibility for
legacy scp/rcp in scp(1) when using the SFTP protocol.
Another area of potential incompatibility relates to the use of remote
paths relative to other user's home directories, for example -
"scp host:~user/file /tmp". The SFTP protocol has no native way to
expand a ~user path. However, sftp-server(8) in OpenSSH 8.7 and later
support a protocol extension "expand-path%openssh.com@localhost" to support
this.
Security Near Miss
==================
* sshd(8): fix an integer overflow in the user authentication path
that, in conjunction with other logic errors, could have yielded
unauthenticated access under difficult to exploit conditions.
This situation is not exploitable because of independent checks in
the privilege separation monitor. Privilege separation has been
enabled by default in since openssh-3.2.2 (released in 2002) and
has been mandatory since openssh-7.5 (released in 2017). Moreover,
portable OpenSSH has used toolchain features available in most
modern compilers to abort on signed integer overflow since
openssh-6.5 (released in 2014).
Thanks to Malcolm Stagg for finding and reporting this bug.
Potentially-incompatible changes
================================
* sshd(8), portable OpenSSH only: this release removes in-built
support for MD5-hashed passwords. If you require these on your
system then we recommend linking against libxcrypt or similar.
* This release modifies the FIDO security key middleware interface
and increments SSH_SK_VERSION_MAJOR.
Changes since OpenSSH 8.8
=========================
This release includes a number of new features.
New features
------------
* ssh(1), sshd(8), ssh-add(1), ssh-agent(1): add a system for
restricting forwarding and use of keys added to ssh-agent(1)
A detailed description of the feature is available at
https://www.openssh.com/agent-restrict.html and the protocol
extensions are documented in the PROTOCOL and PROTOCOL.agent
files in the source release.
* ssh(1), sshd(8): add the sntrup761x25519-sha512%openssh.com@localhost hybrid
ECDH/x25519 + Streamlined NTRU Prime post-quantum KEX to the
default KEXAlgorithms list (after the ECDH methods but before the
prime-group DH ones). The next release of OpenSSH is likely to
make this key exchange the default method.
* ssh-keygen(1): when downloading resident keys from a FIDO token,
pass back the user ID that was used when the key was created and
append it to the filename the key is written to (if it is not the
default). Avoids keys being clobbered if the user created multiple
resident keys with the same application string but different user
IDs.
* ssh-keygen(1), ssh(1), ssh-agent(1): better handling for FIDO keys
on tokens that provide user verification (UV) on the device itself,
including biometric keys, avoiding unnecessary PIN prompts.
* ssh-keygen(1): add "ssh-keygen -Y match-principals" operation to
perform matching of principals names against an allowed signers
file. To be used towards a TOFU model for SSH signatures in git.
* ssh-add(1), ssh-agent(1): allow pin-required FIDO keys to be added
to ssh-agent(1). $SSH_ASKPASS will be used to request the PIN at
authentication time.
* ssh-keygen(1): allow selection of hash at sshsig signing time
(either sha512 (default) or sha256).
* ssh(1), sshd(8): read network data directly to the packet input
buffer instead indirectly via a small stack buffer. Provides a
modest performance improvement.
* ssh(1), sshd(8): read data directly to the channel input buffer,
providing a similar modest performance improvement.
* ssh(1): extend the PubkeyAuthentication configuration directive to
accept yes|no|unbound|host-bound to allow control over one of the
protocol extensions used to implement agent-restricted keys.
Bugfixes
--------
* sshd(8): document that CASignatureAlgorithms, ExposeAuthInfo and
PubkeyAuthOptions can be used in a Match block. PR#277.
* sshd(8): fix possible string truncation when constructing paths to
.rhosts/.shosts files with very long user home directory names.
* ssh-keysign(1): unbreak for KEX algorithms that use SHA384/512
exchange hashes
* ssh(1): don't put the TTY into raw mode when SessionType=none,
avoids ^C being unable to kill such a session. bz3360
* scp(1): fix some corner-case bugs in SFTP-mode handling of
~-prefixed paths.
* ssh(1): unbreak hostbased auth using RSA keys. Allow ssh(1) to
select RSA keys when only RSA/SHA2 signature algorithms are
configured (this is the default case). Previously RSA keys were
not being considered in the default case.
* ssh-keysign(1): make ssh-keysign use the requested signature
algorithm and not the default for the key type. Part of unbreaking
hostbased auth for RSA/SHA2 keys.
* ssh(1): stricter UpdateHostkey signature verification logic on
the client- side. Require RSA/SHA2 signatures for RSA hostkeys
except when RSA/SHA1 was explicitly negotiated during initial
KEX; bz3375
* ssh(1), sshd(8): fix signature algorithm selection logic for
UpdateHostkeys on the server side. The previous code tried to
prefer RSA/SHA2 for hostkey proofs of RSA keys, but missed some
cases. This will use RSA/SHA2 signatures for RSA keys if the
client proposed these algorithms in initial KEX. bz3375
* All: convert all uses of select(2)/pselect(2) to poll(2)/ppoll(2).
This includes the mainloops in ssh(1), ssh-agent(1), ssh-agent(1)
and sftp-server(8), as well as the sshd(8) listen loop and all
other FD read/writability checks. On platforms with missing or
broken poll(2)/ppoll(2) syscalls a select(2)-based compat shim is
available.
* ssh-keygen(1): the "-Y find-principals" command was verifying key
validity when using ca certs but not with simple key lifetimes
within the allowed signers file.
* ssh-keygen(1): make sshsig verify-time argument parsing optional
* sshd(8): fix truncation in rhosts/shosts path construction.
* ssh(1), ssh-agent(1): avoid xmalloc(0) for PKCS#11 keyid for ECDSA
keys (we already did this for RSA keys). Avoids fatal errors for
PKCS#11 libraries that return empty keyid, e.g. Microchip ATECC608B
"cryptoauthlib"; bz#3364
* ssh(1), ssh-agent(1): improve the testing of credentials against
inserted FIDO: ask the token whether a particular key belongs to
it in cases where the token supports on-token user-verification
(e.g. biometrics) rather than just assuming that it will accept it.
Will reduce spurious "Confirm user presence" notifications for key
handles that relate to FIDO keys that are not currently inserted in at
least some cases. bz3366
* ssh(1), sshd(8): correct value for IPTOS_DSCP_LE. It needs to
allow for the preceding two ECN bits. bz#3373
* ssh-keygen(1): add missing -O option to usage() for the "-Y sign"
option.
* ssh-keygen(1): fix a NULL deref when using the find-principals
function, when matching an allowed_signers line that contains a
namespace restriction, but no restriction specified on the
command-line
* ssh-agent(1): fix memleak in process_extension(); oss-fuzz
issue #42719
* ssh(1): suppress "Connection to xxx closed" messages when LogLevel
is set to "error" or above. bz3378
* ssh(1), sshd(8): use correct zlib flags when inflate(3)-ing
compressed packet data. bz3372
* scp(1): when recursively transferring files in SFTP mode, create the
destination directory if it doesn't already exist to match scp(1) in
legacy RCP mode behaviour.
* scp(1): many improvements in error message consistency between scp(1)
in SFTP mode vs legacy RCP mode.
* sshd(8): fix potential race in SIGTERM handling PR#289
* ssh(1), ssh(8): since DSA keys are deprecated, move them to the
end of the default list of public keys so that they will be tried
last. PR#295
* ssh-keygen(1): allow 'ssh-keygen -Y find-principals' to match
wildcard principals in allowed_signers files
Portability
-----------
* ssh(1), sshd(8): don't trust closefrom(2) on Linux. glibc's
implementation does not work in a chroot when the kernel does not
have close_range(2). It tries to read from /proc/self/fd and when
that fails dies with an assertion of sorts. Instead, call
close_range(2) directly from our compat code and fall back if
that fails. bz#3349,
* OS X poll(2) is broken; use compat replacement. For character-
special devices like /dev/null, Darwin's poll(2) returns POLLNVAL
when polled with POLLIN. Apparently this is Apple bug 3710161 -
not public but a websearch will find other OSS projects
rediscovering it periodically since it was first identified in
2005.
* Correct handling of exceptfds/POLLPRI in our select(2)-based
poll(2)/ppoll(2) compat implementation.
* Cygwin: correct checking of mbstowcs() return value.
* Add a basic SECURITY.md that refers people to the openssh.com
website.
* Enable additional compiler warnings and toolchain hardening flags,
including -Wbitwise-instead-of-logical, -Wmisleading-indentation,
-fzero-call-used-regs and -ftrivial-auto-var-init.
* HP/UX. Use compat getline(3) on HP-UX 10.x, where the libc version
is not reliable.
diffstat:
crypto/external/bsd/openssh/dist/PROTOCOL | 69 +-
crypto/external/bsd/openssh/dist/PROTOCOL.agent | 85 +-
crypto/external/bsd/openssh/dist/PROTOCOL.mux | 6 +-
crypto/external/bsd/openssh/dist/addr.c | 30 +-
crypto/external/bsd/openssh/dist/auth-options.c | 4 +-
crypto/external/bsd/openssh/dist/auth-rhosts.c | 38 +-
crypto/external/bsd/openssh/dist/auth.c | 16 +-
crypto/external/bsd/openssh/dist/auth.h | 5 +-
crypto/external/bsd/openssh/dist/auth2-gss.c | 5 +-
crypto/external/bsd/openssh/dist/auth2-hostbased.c | 11 +-
crypto/external/bsd/openssh/dist/auth2-kbdint.c | 5 +-
crypto/external/bsd/openssh/dist/auth2-none.c | 5 +-
crypto/external/bsd/openssh/dist/auth2-passwd.c | 5 +-
crypto/external/bsd/openssh/dist/auth2-pubkey.c | 49 +-
crypto/external/bsd/openssh/dist/auth2.c | 70 +-
crypto/external/bsd/openssh/dist/authfd.c | 116 ++-
crypto/external/bsd/openssh/dist/authfd.h | 35 +-
crypto/external/bsd/openssh/dist/authfile.c | 4 +-
crypto/external/bsd/openssh/dist/channels.c | 557 ++++++++---
crypto/external/bsd/openssh/dist/channels.h | 31 +-
crypto/external/bsd/openssh/dist/clientloop.c | 235 ++--
crypto/external/bsd/openssh/dist/dns.c | 4 +-
crypto/external/bsd/openssh/dist/hostfile.c | 22 +-
crypto/external/bsd/openssh/dist/kex.c | 48 +-
crypto/external/bsd/openssh/dist/kex.h | 13 +-
crypto/external/bsd/openssh/dist/kexgen.c | 35 +-
crypto/external/bsd/openssh/dist/kexgexc.c | 24 +-
crypto/external/bsd/openssh/dist/kexgexs.c | 14 +-
crypto/external/bsd/openssh/dist/kexsntrup761x25519.c | 4 +-
crypto/external/bsd/openssh/dist/misc.c | 90 +-
crypto/external/bsd/openssh/dist/misc.h | 4 +-
crypto/external/bsd/openssh/dist/moduli-gen/moduli.2048 | 140 +-
crypto/external/bsd/openssh/dist/moduli-gen/moduli.3072 | 153 +--
crypto/external/bsd/openssh/dist/moduli-gen/moduli.4096 | 144 +-
crypto/external/bsd/openssh/dist/moduli-gen/moduli.6144 | 121 +-
crypto/external/bsd/openssh/dist/moduli-gen/moduli.7680 | 155 +-
crypto/external/bsd/openssh/dist/moduli-gen/moduli.8192 | 116 +-
crypto/external/bsd/openssh/dist/monitor.c | 31 +-
crypto/external/bsd/openssh/dist/mux.c | 4 +-
crypto/external/bsd/openssh/dist/myproposal.h | 3 +-
crypto/external/bsd/openssh/dist/nchan.c | 10 +-
crypto/external/bsd/openssh/dist/packet.c | 105 +-
crypto/external/bsd/openssh/dist/packet.h | 3 +-
crypto/external/bsd/openssh/dist/readconf.c | 27 +-
crypto/external/bsd/openssh/dist/readconf.h | 7 +-
crypto/external/bsd/openssh/dist/rijndael.h | 5 +-
crypto/external/bsd/openssh/dist/scp.1 | 4 +-
crypto/external/bsd/openssh/dist/scp.c | 83 +-
crypto/external/bsd/openssh/dist/servconf.c | 21 +-
crypto/external/bsd/openssh/dist/serverloop.c | 154 +-
crypto/external/bsd/openssh/dist/session.c | 4 +-
crypto/external/bsd/openssh/dist/sftp-client.c | 200 ++-
crypto/external/bsd/openssh/dist/sftp-client.h | 4 +-
crypto/external/bsd/openssh/dist/sftp-server.c | 83 +-
crypto/external/bsd/openssh/dist/sk-api.h | 7 +-
crypto/external/bsd/openssh/dist/sk-usbhid.c | 186 ++-
crypto/external/bsd/openssh/dist/ssh-add.1 | 88 +-
crypto/external/bsd/openssh/dist/ssh-add.c | 217 ++++-
crypto/external/bsd/openssh/dist/ssh-agent.c | 716 +++++++++++++++-
crypto/external/bsd/openssh/dist/ssh-keygen.1 | 37 +-
crypto/external/bsd/openssh/dist/ssh-keygen.c | 246 +++-
crypto/external/bsd/openssh/dist/ssh-keyscan.c | 68 +-
crypto/external/bsd/openssh/dist/ssh-keysign.c | 43 +-
crypto/external/bsd/openssh/dist/ssh-pkcs11-helper.c | 4 +-
crypto/external/bsd/openssh/dist/ssh-pkcs11.c | 9 +-
crypto/external/bsd/openssh/dist/ssh-sk-client.c | 98 +-
crypto/external/bsd/openssh/dist/ssh-sk-helper.c | 33 +-
crypto/external/bsd/openssh/dist/ssh-sk.c | 93 +-
crypto/external/bsd/openssh/dist/ssh-sk.h | 14 +-
crypto/external/bsd/openssh/dist/ssh.1 | 10 +-
crypto/external/bsd/openssh/dist/ssh.c | 20 +-
crypto/external/bsd/openssh/dist/ssh_config.5 | 20 +-
crypto/external/bsd/openssh/dist/sshbuf-misc.c | 39 +-
crypto/external/bsd/openssh/dist/sshbuf.h | 8 +-
crypto/external/bsd/openssh/dist/sshconnect.c | 4 +-
crypto/external/bsd/openssh/dist/sshconnect2.c | 79 +-
crypto/external/bsd/openssh/dist/sshd.c | 66 +-
crypto/external/bsd/openssh/dist/sshd_config.5 | 17 +-
crypto/external/bsd/openssh/dist/sshkey.c | 25 +-
crypto/external/bsd/openssh/dist/sshkey.h | 6 +-
crypto/external/bsd/openssh/dist/sshsig.c | 284 +++--
crypto/external/bsd/openssh/dist/sshsig.h | 6 +-
crypto/external/bsd/openssh/dist/umac.c | 4 +-
crypto/external/bsd/openssh/dist/umac.h | 4 +-
crypto/external/bsd/openssh/dist/version.h | 4 +-
85 files changed, 3877 insertions(+), 1794 deletions(-)
diffs (truncated from 10684 to 300 lines):
diff -r 3bd05cff7def -r 9532ca75ef8e crypto/external/bsd/openssh/dist/PROTOCOL
--- a/crypto/external/bsd/openssh/dist/PROTOCOL Mon Sep 27 17:00:57 2021 +0000
+++ b/crypto/external/bsd/openssh/dist/PROTOCOL Wed Feb 23 19:04:25 2022 +0000
@@ -342,9 +342,41 @@
extension signal "INFO%openssh.com@localhost" that allows sending SIGINFO on
BSD-derived systems.
-3. SFTP protocol changes
+3. Authentication protocol changes
+
+3.1. Host-bound public key authentication
+
+This is trivial change to the traditional "publickey" authentication
+method. The authentication request is identical to the original method
+but for the name and one additional field:
+
+ byte SSH2_MSG_USERAUTH_REQUEST
+ string username
+ string "ssh-connection"
+ string "publickey-hostbound-v00%openssh.com@localhost"
+ bool has_signature
+ string pkalg
+ string public key
+ string server host key
-3.1. sftp: Reversal of arguments to SSH_FXP_SYMLINK
+Because the entire SSH2_MSG_USERAUTH_REQUEST message is included in
+the signed data, this ensures that a binding between the destination
+user, the server identity and the session identifier is visible to the
+signer. OpenSSH uses this binding via signed data to implement per-key
+restrictions in ssh-agent.
+
+A server may advertise this method using the SSH2_MSG_EXT_INFO
+mechanism (RFC8308), with the following message:
+
+ string "publickey-hostbound%openssh.com@localhost"
+ string "0" (version)
+
+Clients should prefer host-bound authentication when advertised by
+server.
+
+4. SFTP protocol changes
+
+4.1. sftp: Reversal of arguments to SSH_FXP_SYMLINK
When OpenSSH's sftp-server was implemented, the order of the arguments
to the SSH_FXP_SYMLINK method was inadvertently reversed. Unfortunately,
@@ -357,7 +389,7 @@
string targetpath
string linkpath
-3.2. sftp: Server extension announcement in SSH_FXP_VERSION
+4.2. sftp: Server extension announcement in SSH_FXP_VERSION
OpenSSH's sftp-server lists the extensions it supports using the
standard extension announcement mechanism in the SSH_FXP_VERSION server
@@ -378,7 +410,7 @@
extension with multiple versions (though this is unlikely). Clients MUST
check the version number before attempting to use the extension.
-3.3. sftp: Extension request "posix-rename%openssh.com@localhost"
+4.3. sftp: Extension request "posix-rename%openssh.com@localhost"
This operation provides a rename operation with POSIX semantics, which
are different to those provided by the standard SSH_FXP_RENAME in
@@ -395,7 +427,7 @@
This extension is advertised in the SSH_FXP_VERSION hello with version
"1".
-3.4. sftp: Extension requests "statvfs%openssh.com@localhost" and
+4.4. sftp: Extension requests "statvfs%openssh.com@localhost" and
"fstatvfs%openssh.com@localhost"
These requests correspond to the statvfs and fstatvfs POSIX system
@@ -436,7 +468,7 @@
Both the "statvfs%openssh.com@localhost" and "fstatvfs%openssh.com@localhost" extensions are
advertised in the SSH_FXP_VERSION hello with version "2".
-3.5. sftp: Extension request "hardlink%openssh.com@localhost"
+4.5. sftp: Extension request "hardlink%openssh.com@localhost"
This request is for creating a hard link to a regular file. This
request is implemented as a SSH_FXP_EXTENDED request with the
@@ -452,7 +484,7 @@
This extension is advertised in the SSH_FXP_VERSION hello with version
"1".
-3.6. sftp: Extension request "fsync%openssh.com@localhost"
+4.6. sftp: Extension request "fsync%openssh.com@localhost"
This request asks the server to call fsync(2) on an open file handle.
@@ -466,7 +498,7 @@
This extension is advertised in the SSH_FXP_VERSION hello with version
"1".
-3.7. sftp: Extension request "lsetstat%openssh.com@localhost"
+4.7. sftp: Extension request "lsetstat%openssh.com@localhost"
This request is like the "setstat" command, but sets file attributes on
symlinks. It is implemented as a SSH_FXP_EXTENDED request with the
@@ -482,7 +514,7 @@
This extension is advertised in the SSH_FXP_VERSION hello with version
"1".
-3.8. sftp: Extension request "limits%openssh.com@localhost"
+4.8. sftp: Extension request "limits%openssh.com@localhost"
This request is used to determine various limits the server might impose.
Clients should not attempt to exceed these limits as the server might sever
@@ -525,7 +557,7 @@
This extension is advertised in the SSH_FXP_VERSION hello with version
"1".
-3.9. sftp: Extension request "expand-path%openssh.com@localhost"
+4.9. sftp: Extension request "expand-path%openssh.com@localhost"
This request supports canonicalisation of relative paths and
those that need tilde-expansion, i.e. "~", "~/..." and "~user/..."
@@ -544,9 +576,9 @@
This extension is advertised in the SSH_FXP_VERSION hello with version
"1".
-4. Miscellaneous changes
+5. Miscellaneous changes
-4.1 Public key format
+5.1 Public key format
OpenSSH public keys, as generated by ssh-keygen(1) and appearing in
authorized_keys files, are formatted as a single line of text consisting
@@ -557,22 +589,27 @@
and the "New public key formats" section of PROTOCOL.certkeys for the
OpenSSH certificate formats.
-4.2 Private key format
+5.2 Private key format
OpenSSH private keys, as generated by ssh-keygen(1) use the format
described in PROTOCOL.key by default. As a legacy option, PEM format
(RFC7468) private keys are also supported for RSA, DSA and ECDSA keys
and were the default format before OpenSSH 7.8.
-4.3 KRL format
+5.3 KRL format
OpenSSH supports a compact format for Key Revocation Lists (KRLs). This
format is described in the PROTOCOL.krl file.
-4.4 Connection multiplexing
+5.4 Connection multiplexing
OpenSSH's connection multiplexing uses messages as described in
PROTOCOL.mux over a Unix domain socket for communications between a
master instance and later clients.
-$OpenBSD: PROTOCOL,v 1.42 2021/08/09 23:47:44 djm Exp $
+5.5. Agent protocol extensions
+
+OpenSSH extends the usual agent protocol. These changes are documented
+in the PROTOCOL.agent file.
+
+$OpenBSD: PROTOCOL,v 1.43 2021/12/19 22:15:42 djm Exp $
diff -r 3bd05cff7def -r 9532ca75ef8e crypto/external/bsd/openssh/dist/PROTOCOL.agent
--- a/crypto/external/bsd/openssh/dist/PROTOCOL.agent Mon Sep 27 17:00:57 2021 +0000
+++ b/crypto/external/bsd/openssh/dist/PROTOCOL.agent Wed Feb 23 19:04:25 2022 +0000
@@ -1,5 +1,84 @@
-This file used to contain a description of the SSH agent protocol
-implemented by OpenSSH. It has since been superseded by
+The SSH agent protocol is described in
https://tools.ietf.org/html/draft-miller-ssh-agent-04
-$OpenBSD: PROTOCOL.agent,v 1.14 2020/10/06 07:12:04 dtucker Exp $
+This file document's OpenSSH's extensions to the agent protocol.
+
+1. session-bind%openssh.com@localhost extension
+
+This extension allows a ssh client to bind an agent connection to a
+particular SSH session identifier as derived from the initial key
+exchange (as per RFC4253 section 7.2) and the host key used for that
+exchange. This binding is verifiable at the agent by including the
+initial KEX signature made by the host key.
+
+The message format is:
+
+ byte SSH_AGENTC_EXTENSION (0x1b)
+ string session-bind%openssh.com@localhost
+ string hostkey
+ string session identifier
+ string signature
+ bool is_forwarding
+
+Where 'hostkey' is the encoded server host public key, 'session
+identifier' is the exchange hash derived from the initial key
+exchange, 'signature' is the server's signature of the session
+identifier using the private hostkey, as sent in the final
+SSH2_MSG_KEXDH_REPLY/SSH2_MSG_KEXECDH_REPLY message of the initial key
+exchange. 'is_forwarding' is a flag indicating whether this connection
+should be bound for user authentication or forwarding.
+
+When an agent received this message, it will verify the signature and
+check the consistency of its contents, including refusing to accept
+a duplicate session identifier, or any attempt to bind a connection
+previously bound for authentication. It will then then record the
+binding for the life of the connection for use later in testing per-key
+destination constraints.
+
+2. restrict-destination-v00%openssh.com@localhost key constraint extension
+
+The key constraint extension supports destination- and forwarding path-
+restricted keys. It may be attached as a constraint when keys or
+smartcard keys are added to an agent.
+
+ byte SSH_AGENT_CONSTRAIN_EXTENSION (0xff)
+ string restrict-destination-v00%openssh.com@localhost
+ constraint[] constraints
+
+Where a constraint consists of:
+
+ string from_username (must be empty)
+ string from_hostname
+ keyspec[] from_hostkeys
+ string to_username
+ string to_hostname
+ keyspec[] to_hostkeys
+
+An a keyspec consists of:
+
+ string keyblob
+ bool is_ca
+
+When receiving this message, the agent will ensure that the
+'from_username' field is empty, and that 'to_hostname' and 'to_hostkeys'
+have been supplied (empty 'from_hostname' and 'from_hostkeys' are valid
+and signify the initial hop from the host running ssh-agent). The agent
+will then record the constraint against the key.
+
+Subsequent operations on this key including add/remove/request
+identities and, in particular, signature requests will check the key
+constraints against the session-bind%openssh.com@localhost bindings recorded for
+the agent connection over which they were received.
+
+3. SSH_AGENT_CONSTRAIN_MAXSIGN key constraint
+
+This key constraint allows communication to an agent of the maximum
+number of signatures that may be made with an XMSS key. The format of
+the constraint is:
+
+ byte SSH_AGENT_CONSTRAIN_MAXSIGN (0x03)
+ uint32 max_signatures
+
+This option is only valid for XMSS keys.
+
+$OpenBSD: PROTOCOL.agent,v 1.16 2022/01/01 01:55:30 jsg Exp $
diff -r 3bd05cff7def -r 9532ca75ef8e crypto/external/bsd/openssh/dist/PROTOCOL.mux
--- a/crypto/external/bsd/openssh/dist/PROTOCOL.mux Mon Sep 27 17:00:57 2021 +0000
+++ b/crypto/external/bsd/openssh/dist/PROTOCOL.mux Wed Feb 23 19:04:25 2022 +0000
@@ -15,7 +15,7 @@
field. This field is returned in replies as "client request id" to
facilitate matching of responses to requests.
-Many muliplexing (mux) client requests yield immediate responses from
+Many multiplexing (mux) client requests yield immediate responses from
the mux process; requesting a forwarding, performing an alive check or
requesting the master terminate itself fall in to this category.
@@ -216,7 +216,7 @@
9. Requesting proxy mode
-A client may request that the the control connection be placed in proxy
+A client may request that the control connection be placed in proxy
mode:
uint32 MUX_C_PROXY
@@ -295,4 +295,4 @@
XXX signals via mux request
XXX list active connections via mux
-$OpenBSD: PROTOCOL.mux,v 1.12 2020/03/13 03:17:07 djm Exp $
+$OpenBSD: PROTOCOL.mux,v 1.13 2022/01/01 01:55:30 jsg Exp $
diff -r 3bd05cff7def -r 9532ca75ef8e crypto/external/bsd/openssh/dist/addr.c
--- a/crypto/external/bsd/openssh/dist/addr.c Mon Sep 27 17:00:57 2021 +0000
+++ b/crypto/external/bsd/openssh/dist/addr.c Wed Feb 23 19:04:25 2022 +0000
@@ -1,4 +1,4 @@
-/* $OpenBSD: addr.c,v 1.1 2021/01/09 11:58:50 dtucker Exp $ */
+/* $OpenBSD: addr.c,v 1.4 2021/10/22 10:51:57 dtucker Exp $ */
/*
* Copyright (c) 2004-2008 Damien Miller <djm%mindrot.org@localhost>
@@ -240,7 +240,7 @@
if (a->v4.s_addr == b->v4.s_addr)
return 0;
return (ntohl(a->v4.s_addr) > ntohl(b->v4.s_addr) ? 1 : -1);
- case AF_INET6:;
+ case AF_INET6:
/*
* Do this a byte at a time to avoid the above issue and
* any endian problems
@@ -264,7 +264,7 @@
Home |
Main Index |
Thread Index |
Old Index