Skip to content

[wip] merge#842

Open
tgauth wants to merge 721 commits into
PowerShell:latestw_allfrom
tgauth:scratch-merge-v10.3P1-20260420
Open

[wip] merge#842
tgauth wants to merge 721 commits into
PowerShell:latestw_allfrom
tgauth:scratch-merge-v10.3P1-20260420

Conversation

@tgauth

@tgauth tgauth commented Apr 21, 2026

Copy link
Copy Markdown
Collaborator

PR Summary

PR Context

daztucker and others added 30 commits December 16, 2025 20:40
applied to login attempts for usernames that do not match real accounts.
Defaults to 5s to match 'authfail' but allows administrators to block such
sources for longer if desired.  with & ok djm@

OpenBSD-Commit-ID: bb62797bcf2adceb96f608ce86d0bb042aff5834
Bonehead mistake spotted by otto@, ok djm@

OpenBSD-Commit-ID: 4ad67ac402e0b4c013f4f4e386d22b88969a5dd7
OpenBSD-Commit-ID: 4db8cb254792df8a4dce11825852e089ae3d053a
OpenBSD-Commit-ID: 23974d7c98b2ba4fea7f5143676c34e04ffd4128
Match blocks at startup rather than failing later at runtime;

noticed via bz#3906; ok dtucker

OpenBSD-Commit-ID: e6035ff0baa375de6c9f22c883ed530a8649dfed
lacks any subsystem directive but one is defined in a Match block

bz#3906; ok dtucker

OpenBSD-Commit-ID: 2eb9024726d6f10eaa41958faeca9c9ba5ca7d8a
blocks are noticed at startup; bz#3906

OpenBSD-Regress-ID: b9171bde4cc24757a826b3da0e9eadc33995a453
time if the config lacks a subsystem directive but one is defined in a match
block.

OpenBSD-Regress-ID: 5290553665307ccddaec2499ec1eb196bb2efc84
(was repeatedly checking the subsystem name) spotted by Coverity (CID 898836)

OpenBSD-Commit-ID: dabea2b499de8280f76f7291dd52086df6831cb0
OpenBSD-Commit-ID: f72306b86953e74f358096db141b4f9c00d33ed7
get a running mux process to show information about what channels are
currently open; ok dtucker@ markus@

OpenBSD-Commit-ID: 80bb3953b306a50839f9a4bc5679faebc32e5bb8
field. This value is supposed to be the number of handles a server will allow
to be opened and not a number of outstanding read/write requests that can be
sent during an upload/download.

ok markus@

OpenBSD-Commit-ID: 14ebb6690acbd488e748ce8ce3302bd7e1e8a5b0
certificates were originally specified to represent any principal if the
principals list was empty.

This was, in retrospect, a mistake as it created a fail-open
situation if a CA could be convinced to accidentally sign a
certificate with no principals. This actually happened in a 3rd-
party CA product (CVE-2024-7594).

Somewhat fortunately, the main pathway for using certificates in
sshd (TrustedUserCAKeys) never supported empty-principals
certificates, so the blast radius of such mistakes was
substantially reduced.

This change removes this footcannon and requires all certificates
include principals sections. It also fixes interpretation of
wildcard principals, and properly enables them for host
certificates only.

This is a behaviour change that will permanently break uses of
certificates with empty principals sections.

ok markus@

OpenBSD-Commit-ID: 0a901f03c567c100724a492cf91e02939904712e
generates these (yet)

OpenBSD-Regress-ID: 48d59b7c4768c2a22ce3d8cf3b455e6ada9fc7b0
sections (which are now unconditionally refused) and for certificates with
wildcard principals (which should only be accepted in host certs)

OpenBSD-Regress-ID: fdca88845a68424060547b4f9f32f90a7cf82e73
OpenBSD-Commit-ID: fe7461c93dfaef98a007a246af837a8275a1e539
lest it expand to an unrelated filename in the working directory

OpenBSD-Regress-ID: 8a9eb716d3ea7986d26c1a931758b996aa93c58e
Add a missing "/" in the default allowed providers list.
parsing patterns using parent/child buffer; ok markus@

OpenBSD-Commit-ID: c11ed27907751f2a16c1283313e77f88617e4852
pre-authentication phase

OpenSSH doesn't support rekeying before authentication completes to
minimise pre-auth attack surface.

Given LoginGraceTime, MaxAuthTries and strict KEX, it would be
difficult to send enough data or packets before authentication
completes to reach a point where rekeying is required, but we'd
prefer it to be completely impossible.

So this applies the default volume/packet rekeying limits to the
pre-auth phase. If these limits are exceeded the connection will
simply be closed.

ok dtucker markus

OpenBSD-Commit-ID: 70415098db739058006e4ebd1630b6bae8cc8bf6
support rekeying. AFAIK this is only an ancient Sun SSH version.

If such an implementation tries to interoperate with OpenSSH, it
will eventually fail when the transport needs rekeying.

This is probably long enough to use it to download a modern SSH
implementation that lacks this problem :)

ok markus@ deraadt@

OpenBSD-Commit-ID: 228a502fee808cf8b7caee23169eb6a1ab1c331a
OpenBSD-Regress-ID: 13cbd0370ebca7c61c35346b3e0356517719a447
ssh_packet_check_rekey_blocklimit() called before the encrypted transport is
brought up.

OpenBSD-Commit-ID: fb998ccbe59865e33a8ab6a6577f254d39bdc72f
OpenBSD-Commit-ID: 31b2ec6e0b3dbd08c60ba2d969dd687cd80c25fd
@tgauth

tgauth commented Jul 17, 2026

Copy link
Copy Markdown
Collaborator Author

/azp run

@azure-pipelines

Copy link
Copy Markdown
Azure Pipelines:
Successfully started running 1 pipeline(s).

@tgauth

tgauth commented Jul 20, 2026

Copy link
Copy Markdown
Collaborator Author

/azp run

@azure-pipelines

Copy link
Copy Markdown
Azure Pipelines:
Successfully started running 1 pipeline(s).

@tgauth

tgauth commented Jul 21, 2026

Copy link
Copy Markdown
Collaborator Author

/azp run

@azure-pipelines

Copy link
Copy Markdown
Azure Pipelines:
Successfully started running 1 pipeline(s).

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

7 participants