upstream: remove this KEX fuzzer; it's awkward to use and doesn't play

nice with popular fuzzing drivers like libfuzzer. AFAIK nobody has used it
but me.

OpenBSD-Regress-ID: cad

upstream: remove this KEX fuzzer; it's awkward to use and doesn't play

nice with popular fuzzing drivers like libfuzzer. AFAIK nobody has used it
but me.

OpenBSD-Regress-ID: cad919522b3ce90c147c95abaf81b0492ac296c9

show more ...

upstream: Add PerSourceMaxStartups and PerSourceNetBlockSize

options which provide more fine grained MaxStartups limits. Man page help
jmc@, feedback & ok djm@

OpenBSD-Commit-I

upstream: Add PerSourceMaxStartups and PerSourceNetBlockSize

options which provide more fine grained MaxStartups limits. Man page help
jmc@, feedback & ok djm@

OpenBSD-Commit-ID: e2f68664e3d02c0895b35aa751c48a2af622047b

show more ...

upstream: Move address handling functions out into their own file

in order to reuse them for per-source maxstartups limiting. Supplement with
some additional functions from djm's flowto

upstream: Move address handling functions out into their own file

in order to reuse them for per-source maxstartups limiting. Supplement with
some additional functions from djm's flowtools that we'll also need. ok djm@
(as part of a larger diff).

OpenBSD-Commit-ID: e3e7d9ccc6c9b82e25cfef0ec83598e8e2327cbf

show more ...

upstream: Update/replace the experimental post-quantim hybrid key

exchange method based on Streamlined NTRU Prime (coupled with X25519).

The previous sntrup4591761x25519-sha512@tiny

upstream: Update/replace the experimental post-quantim hybrid key

exchange method based on Streamlined NTRU Prime (coupled with X25519).

The previous sntrup4591761x25519-sha512@tinyssh.org method is
replaced with sntrup761x25519-sha512@openssh.com. Per the authors,
sntrup4591761 was replaced almost two years ago by sntrup761.

The sntrup761 implementaion, like sntrup4591761 before it, is public
domain code extracted from the SUPERCOP cryptography benchmark
suite (https://bench.cr.yp.to/supercop.html).

Thanks for Daniel J Bernstein for guidance on algorithm selection.
Patch from Tobias Heider; feedback & ok markus@ and myself

(note this both the updated method and the one that it replaced are
disabled by default)

OpenBSD-Commit-ID: 2bf582b772d81ee24e911bb6f4b2aecfd39338ae

show more ...

Move the local m4 macros

The `aclocal' step is skipped during `autoreconf' because aclocal.m4 is
present.
Move the current aclocal.m4 which contains local macros into the m4/
fol

Move the local m4 macros

The `aclocal' step is skipped during `autoreconf' because aclocal.m4 is
present.
Move the current aclocal.m4 which contains local macros into the m4/
folder. With this change the aclocal.m4 will be re-created during
changes to the m4/ macro.
This is needed so the `aclocal' can fetch m4 macros from the system if
they are references in the configure script. This is a prerequisite to
use PKG_CHECK_MODULES.

Signed-off-by: Sebastian Andrzej Siewior <sebastian@breakpoint.cc>

show more ...

Remove check for 'ent' command.

It was added in 8d1fd57a9 for measuring entropy of ssh_prng_cmds which
has long since been removed and there are no other references to it.

upstream: avoid spurious error message when ssh-keygen creates files

outside ~/.ssh; with dtucker@

OpenBSD-Commit-ID: ac0c662d44607e00ec78c266ee60752beb1c7e08

Hook sshsig tests up to Portable Makefiles.

Skip building sk-dummy library if no SK support.

explicitly manage .depend and .depend.bak

Bring back removal of .depend to give the file a known state before
running makedepend, but manually move aside the current .depend file
and

explicitly manage .depend and .depend.bak

Bring back removal of .depend to give the file a known state before
running makedepend, but manually move aside the current .depend file
and restore it as .depend.bak afterwards so the stale .depend check
works as expected.

show more ...

revert removal of .depend before makedepend

Commit 83657eac4 started removing .depend before running makedepend
to reset the contents of .depend to a known state. Unfortunately
this

revert removal of .depend before makedepend

Commit 83657eac4 started removing .depend before running makedepend
to reset the contents of .depend to a known state. Unfortunately
this broke the depend-check step as now .depend.bak would only ever
be created as an empty file.

ok dtucker

show more ...

Remove use of tail for 'make depend'.

Not every tail supports +N and we can do with out it so just remove it.
Prompted by mforney at mforney.org.

Put the values from env vars back.

This merges the values from the recently removed environment into make's
command line arguments since we actually need those.

Pass configure's egrep through to test-exec.sh.

Use it to create a wrapper function to call it from tests. Fixes the
keygen-comment test on platforms with impoverished default egrep (eg

Pass configure's egrep through to test-exec.sh.

Use it to create a wrapper function to call it from tests. Fixes the
keygen-comment test on platforms with impoverished default egrep (eg
Solaris).

show more ...

Remove unneeded env vars from t-exec invocation.

prefer libcrypto chacha20-poly1305 where possible

upstream: factor out reading/writing sshbufs to dedicated

functions; feedback and ok markus@

OpenBSD-Commit-ID: dc09e5f1950b7acc91b8fdf8015347782d2ecd3d

only link ssh-sk-helper against libfido2

adapt Makefile to ssh-sk-client everywhere

Sort .depend when rebuilding.

This makes diffs more stable between makedepend implementations.

compile sk-dummy.so with no-PIE version of LDFLAGS

This lets it pick up the -L path to libcrypto for example.

(yet) another x-platform fix for sk-dummy.so

Check for -fPIC support from compiler

Compile libopenbsd-compat -fPIC

Don't mix -fPIE and -fPIC when compiling

another attempt at sk-dummy.so working x-platform

include a fatal() implementation to satisfy libopenbsd-compat

clean up .lo and .so files

.gitignore .lo and .so files

upstream: lots of dependencies go away here with ed25519 no longer

needing the ssh_digest API.

OpenBSD-Regress-ID: 785847ec78cb580d141e29abce351a436d6b5d49

$< doesn't work as` I thought; explicily list objs