[wip] merge#842
Open
tgauth wants to merge 721 commits into
Open
Conversation
applied to login attempts for usernames that do not match real accounts. Defaults to 5s to match 'authfail' but allows administrators to block such sources for longer if desired. with & ok djm@ OpenBSD-Commit-ID: bb62797bcf2adceb96f608ce86d0bb042aff5834
Bonehead mistake spotted by otto@, ok djm@ OpenBSD-Commit-ID: 4ad67ac402e0b4c013f4f4e386d22b88969a5dd7
OpenBSD-Commit-ID: 4db8cb254792df8a4dce11825852e089ae3d053a
OpenBSD-Commit-ID: 23974d7c98b2ba4fea7f5143676c34e04ffd4128
Match blocks at startup rather than failing later at runtime; noticed via bz#3906; ok dtucker OpenBSD-Commit-ID: e6035ff0baa375de6c9f22c883ed530a8649dfed
lacks any subsystem directive but one is defined in a Match block bz#3906; ok dtucker OpenBSD-Commit-ID: 2eb9024726d6f10eaa41958faeca9c9ba5ca7d8a
blocks are noticed at startup; bz#3906 OpenBSD-Regress-ID: b9171bde4cc24757a826b3da0e9eadc33995a453
time if the config lacks a subsystem directive but one is defined in a match block. OpenBSD-Regress-ID: 5290553665307ccddaec2499ec1eb196bb2efc84
(was repeatedly checking the subsystem name) spotted by Coverity (CID 898836) OpenBSD-Commit-ID: dabea2b499de8280f76f7291dd52086df6831cb0
OpenBSD-Commit-ID: f72306b86953e74f358096db141b4f9c00d33ed7
get a running mux process to show information about what channels are currently open; ok dtucker@ markus@ OpenBSD-Commit-ID: 80bb3953b306a50839f9a4bc5679faebc32e5bb8
field. This value is supposed to be the number of handles a server will allow to be opened and not a number of outstanding read/write requests that can be sent during an upload/download. ok markus@ OpenBSD-Commit-ID: 14ebb6690acbd488e748ce8ce3302bd7e1e8a5b0
certificates were originally specified to represent any principal if the principals list was empty. This was, in retrospect, a mistake as it created a fail-open situation if a CA could be convinced to accidentally sign a certificate with no principals. This actually happened in a 3rd- party CA product (CVE-2024-7594). Somewhat fortunately, the main pathway for using certificates in sshd (TrustedUserCAKeys) never supported empty-principals certificates, so the blast radius of such mistakes was substantially reduced. This change removes this footcannon and requires all certificates include principals sections. It also fixes interpretation of wildcard principals, and properly enables them for host certificates only. This is a behaviour change that will permanently break uses of certificates with empty principals sections. ok markus@ OpenBSD-Commit-ID: 0a901f03c567c100724a492cf91e02939904712e
generates these (yet) OpenBSD-Regress-ID: 48d59b7c4768c2a22ce3d8cf3b455e6ada9fc7b0
sections (which are now unconditionally refused) and for certificates with wildcard principals (which should only be accepted in host certs) OpenBSD-Regress-ID: fdca88845a68424060547b4f9f32f90a7cf82e73
OpenBSD-Commit-ID: fe7461c93dfaef98a007a246af837a8275a1e539
lest it expand to an unrelated filename in the working directory OpenBSD-Regress-ID: 8a9eb716d3ea7986d26c1a931758b996aa93c58e
Add a missing "/" in the default allowed providers list.
parsing patterns using parent/child buffer; ok markus@ OpenBSD-Commit-ID: c11ed27907751f2a16c1283313e77f88617e4852
pre-authentication phase OpenSSH doesn't support rekeying before authentication completes to minimise pre-auth attack surface. Given LoginGraceTime, MaxAuthTries and strict KEX, it would be difficult to send enough data or packets before authentication completes to reach a point where rekeying is required, but we'd prefer it to be completely impossible. So this applies the default volume/packet rekeying limits to the pre-auth phase. If these limits are exceeded the connection will simply be closed. ok dtucker markus OpenBSD-Commit-ID: 70415098db739058006e4ebd1630b6bae8cc8bf6
support rekeying. AFAIK this is only an ancient Sun SSH version. If such an implementation tries to interoperate with OpenSSH, it will eventually fail when the transport needs rekeying. This is probably long enough to use it to download a modern SSH implementation that lacks this problem :) ok markus@ deraadt@ OpenBSD-Commit-ID: 228a502fee808cf8b7caee23169eb6a1ab1c331a
OpenBSD-Regress-ID: 13cbd0370ebca7c61c35346b3e0356517719a447
ssh_packet_check_rekey_blocklimit() called before the encrypted transport is brought up. OpenBSD-Commit-ID: fb998ccbe59865e33a8ab6a6577f254d39bdc72f
OpenBSD-Commit-ID: 31b2ec6e0b3dbd08c60ba2d969dd687cd80c25fd
…merge-v10.3P1-20260420
…merge-v10.3P1-20260420
…merge-v10.3P1-20260420
…merge-v10.3P1-20260420
Collaborator
Author
|
/azp run |
|
Azure Pipelines: Successfully started running 1 pipeline(s). |
…merge-v10.3P1-20260420
…merge-v10.3P1-20260420
…merge-v10.3P1-20260420
…merge-v10.3P1-20260420
…merge-v10.3P1-20260420
…merge-v10.3P1-20260420
…merge-v10.3P1-20260420
…merge-v10.3P1-20260420
…merge-v10.3P1-20260420
…merge-v10.3P1-20260420
Collaborator
Author
|
/azp run |
|
Azure Pipelines: Successfully started running 1 pipeline(s). |
…merge-v10.3P1-20260420
…merge-v10.3P1-20260420
…merge-v10.3P1-20260420
…merge-v10.3P1-20260420
…merge-v10.3P1-20260420
…merge-v10.3P1-20260420
…merge-v10.3P1-20260420
…merge-v10.3P1-20260420
Collaborator
Author
|
/azp run |
|
Azure Pipelines: Successfully started running 1 pipeline(s). |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
PR Summary
PR Context