upstream: remove a stray .El;

OpenBSD-Commit-ID: 58ddfe6f8a15fe10209db6664ecbe7896f1d167c

upstream: Add regression and unit tests for ${ENV} style

environment variable expansion in various keywords (bz#3140). ok djm@

OpenBSD-Regress-ID: 4d9ceb95d89365b7b674bc26cf064c15a

upstream: Add regression and unit tests for ${ENV} style

environment variable expansion in various keywords (bz#3140). ok djm@

OpenBSD-Regress-ID: 4d9ceb95d89365b7b674bc26cf064c15a5bbb197

show more ...

upstream: Unit test for convtime. ok djm@

OpenBSD-Regress-ID: cec4239efa2fc4c7062064f07a847e1cbdbcd5dd

upstream: mention that wildcards are processed in lexical order;

bz#3165

OpenBSD-Commit-ID: 8856f3d1612bd42e9ee606d89386cae456dd165c

upstream: Allow some keywords to expand shell-style ${ENV}

environment variables on the client side. The supported keywords are
CertificateFile, ControlPath, IdentityAgent and IdentityF

upstream: Allow some keywords to expand shell-style ${ENV}

environment variables on the client side. The supported keywords are
CertificateFile, ControlPath, IdentityAgent and IdentityFile, plus
LocalForward and RemoteForward when used for Unix domain socket paths. This
would for example allow forwarding of Unix domain socket paths that change at
runtime. bz#3140, ok djm@

OpenBSD-Commit-ID: a4a2e801fc2d4df2fe0e58f50d9c81b03822dffa

show more ...

depend

partial sync of regress/netcat.c with upstream

synchronize synopsis and usage.

partial sync of regress/netcat.c with upstream

remove unused variable

ok tedu@

partial sync of regress/netcat.c with upstream

The code in socks.c writes multiple times in a row to a socket. If the socket becomes invalid between these calls (e.g. connection closed), wri

partial sync of regress/netcat.c with upstream

The code in socks.c writes multiple times in a row to a socket. If the socket becomes invalid between these calls (e.g. connection closed), write will throw SIGPIPE. With this patch, SIGPIPE is ignored so we can handle write's -1 return value (errno will be EPIPE). Ultimately, it leads to program exit, too -- but with nicer error message. :)

with input by and ok djm

show more ...

partial sync of regress/netcat.c with upstream

Check for short writes in fdpass(). Clean up while at it.

ok djm

partial sync of regress/netcat.c with upstream

Support for nc -T on IPv6 addresses.

ok sthen@

upstream: fix compilation on !HAVE_DLOPEN platforms; stub function

was not updated to match API change. From Dale Rahn via beck@ ok markus@

OpenBSD-Commit-ID: 2b8d054afe34c9ac85e417

upstream: fix compilation on !HAVE_DLOPEN platforms; stub function

was not updated to match API change. From Dale Rahn via beck@ ok markus@

OpenBSD-Commit-ID: 2b8d054afe34c9ac85e417dae702ef981917b836

show more ...

upstream: fix exit status for downloading of FIDO resident keys;

from Pedro Martelletto, ok markus@

OpenBSD-Commit-ID: 0da77dc24a1084798eedd83c39a002a9d231faef

upstream: Fix multiplier in convtime when handling seconds after

other units. bz#3171, spotted by ronf at timeheart.net, ok djm@.

OpenBSD-Commit-ID: 95b7a848e1083974a65fbb6ccb381d43

upstream: Fix multiplier in convtime when handling seconds after

other units. bz#3171, spotted by ronf at timeheart.net, ok djm@.

OpenBSD-Commit-ID: 95b7a848e1083974a65fbb6ccb381d438e1dd5be

show more ...

upstream: fix Include before Match in sshd_config; bz#3122 patch

from Jakub Jelen

OpenBSD-Commit-ID: 1b0aaf135fe6732b5d326946042665dd3beba5f4

upstream: Do not call process_queued_listen_addrs() for every

included file from sshd_config; patch from Jakub Jelen

OpenBSD-Commit-ID: 0ff603d6f06a7fab4881f12503b53024799d0a49

upstream: fix crash in recallocarray when deleting SendEnv

variables; spotted by & ok sthen@

OpenBSD-Commit-ID: b881e8e849edeec5082b5c0a87d8d7cff091a8fd

upstream: two new tests for Include in sshd_config, checking whether

Port directives are processed correctly and handling of Include directives
that appear before Match. Both tests curre

upstream: two new tests for Include in sshd_config, checking whether

Port directives are processed correctly and handling of Include directives
that appear before Match. Both tests currently fail. bz#3122 and bz#3169 -
patch from Jakub Jelen

OpenBSD-Regress-ID: 8ad5a4a385a63f0a1c59c59c763ff029b45715df

show more ...

Document that libfido2 >= 1.4.0 is needed.

upstream: fix memleak of signature; from Pedro Martelletto

OpenBSD-Commit-ID: d0a6eb07e77c001427d738b220dd024ddc64b2bb

upstream: Restrict ssh-agent from signing web challenges for FIDO

keys.

When signing messages in ssh-agent using a FIDO key that has an
application string that does not start wi

upstream: Restrict ssh-agent from signing web challenges for FIDO

keys.

When signing messages in ssh-agent using a FIDO key that has an
application string that does not start with "ssh:", ensure that the
message being signed is one of the forms expected for the SSH protocol
(currently pubkey authentication and sshsig signatures).

This prevents ssh-agent forwarding on a host that has FIDO keys
attached granting the ability for the remote side to sign challenges
for web authentication using those keys too.

Note that the converse case of web browsers signing SSH challenges is
already precluded because no web RP can have the "ssh:" prefix in the
application string that we require.

ok markus@

OpenBSD-Commit-ID: 9ab6012574ed0352d2f097d307f4a988222d1b19

show more ...

upstream: improve logging for MaxStartups connection throttling:

have sshd log when it starts and stops throttling and periodically while in
this state. bz#3055 ok markus@

OpenB

upstream: improve logging for MaxStartups connection throttling:

have sshd log when it starts and stops throttling and periodically while in
this state. bz#3055 ok markus@

OpenBSD-Commit-ID: 2e07a09a62ab45d790d3d2d714f8cc09a9ac7ab9

show more ...

upstream: add fmt_timeframe() (from bgpd) to format a time

interval in a human- friendly format. Switch copyright for this file from BSD
to MIT to make it easier to add Henning's copyrig

upstream: add fmt_timeframe() (from bgpd) to format a time

interval in a human- friendly format. Switch copyright for this file from BSD
to MIT to make it easier to add Henning's copyright for this function. ok
markus@

OpenBSD-Commit-ID: 414a831c662df7e68893e5233e86f2cac081ccf9

show more ...

upstream: avoid possible NULL deref; from Pedro Martelletto

OpenBSD-Commit-ID: e6099c3fbb70aa67eb106e84d8b43f1fa919b721

upstream: sshd listener must not block if reexecd sshd exits

in write(2) on config_s[0] if the forked child exits early before finishing
recv_rexec_state (e.g. with fatal()) because conf

upstream: sshd listener must not block if reexecd sshd exits

in write(2) on config_s[0] if the forked child exits early before finishing
recv_rexec_state (e.g. with fatal()) because config_s[1] stays open in the
parent. this prevents the parent from accepting new connections. ok djm,
deraadt

OpenBSD-Commit-ID: 92ccfeb939ccd55bda914dc3fe84582158c4a9ef

show more ...