Move the the flags used by the OpenWRT distro to mipsel target and
enable OpenSSL on all targets to improve coverage.
Explicitly disable security key and openssl on mips target so that host
end of the bigendian interop tests don't attempt them and fail (since
they're not enabled on the target side).
Where our test target is a bigendian system, do an additional build on
the runner host (which is little endian) and test interop between the two.
Should hopefully catch obvious endianness bugs.
FIDO application IDs for security key-backed keys, to prevent web key handles
from being used remotely as this would likely lead to unpleasant surprises.
By default, only application IDs that start with "ssh:*" are allowed.
This adds a -Owebsafe-allow=... argument that can override the default
list with a more or less restrictive one. The default remains unchanged.
ok markus@
OpenBSD-Commit-ID: 957c1ed92a8d7c87453b9341f70cb3f4e6b23e8d
to getgrouplist(3)
Our kernel supports 16 groups (NGROUPS_MAX), but nothing prevents
an admin from adding a user to more groups. With that tweak we'll keep
on ignoring them instead of potentially reading past the buffer passed to
getgrouplist(3). That behavior is explicitely described in initgroups(3).
ok millert@ gilles@
OpenBSD-Commit-ID: a959fc45ea3431b36f52eda04faefc58bcde00db
It got broken by the sshd-auth change, it's not obvious why, and the
platform lacks the debugging tools (eg gdb, strace) to figure it out.
The upstream project seems effectively dead (6 years since the last
commit, 10 since the last release). It was useful while it lasted
(we found a real bug because of it) but its time seems to have passed.
Instead of maintaing state (pipe descriptors, signal handlers) across
pselect-on-select invocations, set up and restore them each call.
This prevents outside factors (eg a closefrom or signal handler
installation) from potentially causing problems. This does result in a
drop in throughput of a couple of percent on geriatric platforms without
a native pselect due to the extra overhead. Tweaks & ok djm@
... and ssh and sshd log wrappers before recreating them. Prevents "can't
create" errors during tests when running tests without SUDO after having
run them with SUDO.
OpenBSD-Regress-ID: 2f0a83532e3dccd673a9bf0291090277268c69a6
... to run all of the subprograms from the build directory while
developing and debugging. Should help prevent accidentally testing
against unchanged installed sshd-auth and sshd-session binaries. ok djm@
OpenBSD-Commit-ID: 61760cdc98c2bc8f1e9f83a6f97cca0f66b52e69
Prevents problems on platforms where this isn't safe (which it's not
required to be). ok djm@
OpenBSD-Commit-ID: 8fa4ce3ad90915c925b81b99a79ab920b0523387
arranging the hostkey algorithms. AFAIK this code is unused in OpenSSH, but I
guess others are using it
based on GHPR387 from Pawel Jakub Dawidek
OpenBSD-Commit-ID: 4d462495ac0c40f7b7dd66178e0005b9b2128225
^x' commandline to be exactly two characters long. Avoids one by OOB read if
ssh is invoked as "ssh -e^ ..."
Spotted by Maciej Domanski in GHPR368
OpenBSD-Commit-ID: baa72bc60898fc5639e6c62de7493a202c95823d
visbility-restrict ones that are unused outside the implementation itself;
based on GHPR#282 by tobias@
OpenBSD-Commit-ID: a0140f2418b4d46cfaa7b33febc0a0931f9b2744
Makes builds configured --without-openssl work again since otherwise
the first use of the RNG comes after the sandbox init and it can't
open /dev/random.
