Make writes of the hibernate signature go through the I/O page of the
piglet. This fixes a potential issue on arm64 where the kernel might
have been loaded into memory that isn't DMA reachable. It will also
help with implementing some future changes to make the side-effect free
I/O functions support hardware without cache-coherent DMA or IOMMUs.
ok deraadt@, mlarkin@
Add a few more fields directly to exec_package so that the front-end
and back-end of the ELF code doesn't need to communicate them via an
malloc'd structure. Much simpler.
ok kettenis
Don't override ignored signals when setting up signal handlers
for readpassphrase(3), avoids spin when called with no controlling TTY,
in a background process group, and with SIGTTIN and/or SIGTTOU already
set to SIG_IGN by its parent.
Portable OpenSSH b3995; with/ok millert and guenther
daemon_logger makes no sense without rc_bg being set as well; so error out
if that's the case.
The tree is currently clean of these but it will prevent potential future
issues.
ok sthen@
switch from SUPERCOP ed25519 to libsodium
The libsodium implementation includes a number of strictness and
malleability checks over the original reference implementation we
have used to this point.
libsodium also offers a more traditional "detached" signature
verification API (SUPERCOP required the signature to be contiguous
with the signed data). Switch to this and avoid a bunch of fiddly
code.
ok markus, deraadt
Reset GSSAPI client state before authentication
Avoids situation where a partially-completed GSSAPI authentication attempt
can retain state that is subsequently used by a later attempt.
Report and feedback Moritz Theile, also reported by several others.
ok markus, deraadt
Correctly handle some options that accept "none"
Some options, including AuthorizedPrincipalsFile were documented as accepting
"none" as a way to disable them, however when overriddes by a ssh_config(5)
Match keyword, this argument was being interpreted as a literal file.
With Chris Rohlf in collaboration with Claude and Anthropic Research
ok markus, deraadt
Propagate authorized_keys "resrict" keyword
The "restrict" keyword was not pervasively being applied to TunnelForwarding
connections (which are administratively disabled by default). This is a
separate problem to the one fixed in openssh-10.5
reported by several people; ok markus, deraadt
Check key and CA sig type during key parsing
Checks key type and CA signature algorithm allowlists as early as
possible during public key deserialisation.
Use this in the client and server to reduce attack surface from
disallowed key/signature types.
With Chris Rohlf in collaboration with Claude and Anthropic Research
ok markus, deraadt
Add WarnWeakCrypto to sshd
This option was previously available for the client only. This adds it to
sshd, so allow logging of non-PQ key exchanges.
ok markus, deraadt
Add ACPI layer into vmd
This creates the required tables for most modern OSes as well as providing
a PM timer and HPET implementation for when that is hooked up later.
This code is compiled into vmd but not yet used.
ok dv@
Allow specification of agent socket directories
Add AgentSocketPath for sshd_config and -A flag for ssh-agent.
Agent socket directories may be shared or user-specific.
Shared directories (specified like "shared:/tmp") will cause the listening
program to create a temporary subdirectory ssh-XXXXXXXXXX under the requeted
path to hold the socket. This supports the old sshd/ssh-agent behaviour before
we switched to the socket directory being under ~/.ssh/agent
User-specific directories just create the socket directly in the requested
directory. This is the default, as user:.ssh/agent
bz3860; ok markus, deraadt
relayd: use a per-host random ICMP echo id
The echo id used to be a single pid-derived value shared by all hosts for the
whole process lifetime. Give each host its own random id, refreshed on every
check cycle.
"Looks like a good enough step" deraadt@
Read TLSv1.2 records into a dedicated structure.
Provide a struct tls12_record and read TLSv1.2 records into it following the
same pattern used for TLSv1.3. This simplifies things considerably and means
that we no longer use s->s3->rbuf, s->s3->rrec or s->s3->packet for non-DTLS
in the legacy stack.
ok kenjiro@ tb@
Account pubkey checks separately to auth attempts
Add a `PubkeyOptions max-pk-ok:nnnn` option to allow PK_OK tests (asking
whether the server might accept a given public key) that do not count
against MaxAuthTries, defaulting to 6 attempts.
After these attempts are exhausted, futher attempts count as failed
authentications against MaxAuthTries.
ok markus, deraadt
relayd: add patters(7) support and improve glob(7) documentation
Filter rules on cookie, header, path, query, and url now accept an optional
"pattern" keyword before the key or value string. With "pattern", the string is
interpreted as a patterns(7) expression instead of the default glob(7) rules.
glob(7) support was already there before, but it wasn't really documented. The
documentation now describes all the possibilities and limitations.
Tested by Mischa, feedback by claudio@, OK kirill@
Extend TCPKeepAlive to support forwardings too
This allows the existing client and server TCPKeepAlive option to optionally
enable keepalives on TCP connections that are created for forwardings.
Previously this option controlled keepalives on the connection socket only.
TCPKeepAlive "yes" or "transport" enables keepalives on the connection
socket. "TCPKeepAlive all" additionally enables them for forwarding
sockets.
bz3921. ok markus, deraadt
Mask SIGTERM/SIGQUIT when processing a SIGHUP restart request.
This ensures that these signals are subsequently delivered after
the restart has been completed, rather than ignored. bz3981
RFC 3779: fix inheritance for leaves
It's been publicly known at least since Frank Denis's "security audit"
dumps back in May that the RFC 3779 inheritance handling in libcrypto's
path validation is broken. Namely, if the certificate to be validated
inherits resources, X509v3_asid_validate_path(3) and friends can succeed
even if one of the certs on the path does not have the corresponding
resource delegation extension at all. RFC 3779's sections 2.3 and 3.3
clearly require that every cert on the entire validating path have the
relevant INR delegation extensions. Frank Denis flagged this for ASIDs,
but it is obvious that IP addresses have the same problem.
For rpki-client, one of the very few (the only?) consumers of this code
in libcrypto, this doesn't matter all that much because it duplicates
much of the work on INR validation. Per the specification, EE certs with
inherit elements are only in MFTs, TAKs (of which there are none) and
the no longer supported GBRs (of which there is one - malformed).
Correct nesting and presence of RFC 3779 extensions is ensured by
rpki-client (until recently inheriting leaves were skipped due to a
[51 lines not shown]
