summaryrefslogtreecommitdiffstats
path: root/serverloop.c (follow)
Commit message (Collapse)AuthorAgeFilesLines
...
* upstream commitdjm@openbsd.org2017-09-041-4/+4
| | | | | | | pass packet state down to some of the channels function (more to come...); ok markus@ Upstream-ID: d8ce7a94f4059d7ac1e01fb0eb01de0c4b36c81b
* upstream commitdtucker@openbsd.org2017-08-121-2/+2
| | | | | | | | Tweak previous keepalive commit: if last_time + keepalive <= now instead of just "<" so client_alive_check will fire if the select happens to return on exact second of the timeout. ok djm@ Upstream-ID: e02756bd6038d11bb8522bfd75a4761c3a684fcc
* upstream commitdtucker@openbsd.org2017-08-121-3/+15
| | | | | | | | | | | | Keep track of the last time we actually heard from the client and use this to also schedule a client_alive_check(). Prevents activity on a forwarded port from indefinitely preventing the select timeout so that client_alive_check() will eventually (although not optimally) be called. Analysis by willchan at google com via bz#2756, feedback & ok djm@ Upstream-ID: c08721e0bbda55c6d18e2760f3fe1b17fb71169e
* upstream commitmarkus@openbsd.org2017-06-011-2/+2
| | | | | | remove now obsolete ctx from ssh_dispatch_run; ok djm@ Upstream-ID: 9870aabf7f4d71660c31fda91b942b19a8e68d29
* upstream commitmarkus@openbsd.org2017-05-311-5/+5
| | | | | | protocol handlers all get struct ssh passed; ok djm@ Upstream-ID: 0ca9ea2a5d01a6d2ded94c5024456a930c5bfb5d
* upstream commitdtucker@openbsd.org2017-02-031-7/+10
| | | | | | | Return true reason for port forwarding failures where feasible rather than always "administratively prohibited". bz#2674, ok djm@ Upstream-ID: d901d9887951774e604ca970e1827afaaef9e419
* upstream commitdjm@openbsd.org2017-01-301-8/+13
| | | | | | | unbreak Unix domain socket forwarding for root; ok markus@ Upstream-ID: 6649c76eb7a3fa15409373295ca71badf56920a2
* upstream commitdjm@openbsd.org2016-12-141-3/+5
| | | | | | | disable Unix-domain socket forwarding when privsep is disabled Upstream-ID: ab61516ae0faadad407857808517efa900a0d6d0
* upstream commitdjm@openbsd.org2016-11-301-5/+5
| | | | | | | | | | | | Add a sshd_config DisableForwaring option that disables X11, agent, TCP, tunnel and Unix domain socket forwarding, as well as anything else we might implement in the future. This, like the 'restrict' authorized_keys flag, is intended to be a simple and future-proof way of restricting an account. Suggested as a complement to 'restrict' by Jann Horn; ok markus@ Upstream-ID: 203803f66e533a474086b38a59ceb4cf2410fcf7
* upstream commitdtucker@openbsd.org2016-10-241-3/+3
| | | | | | | | | Factor out "can bind to low ports" check into its own function. This will make it easier for Portable to support platforms with permissions models other than uid==0 (eg bz#2625). ok djm@, "doesn't offend me too much" deraadt@. Upstream-ID: 86213df4183e92b8f189a6d2dac858c994bfface
* upstream commitderaadt@openbsd.org2016-09-121-5/+4
| | | | | | | | Add MAXIMUM(), MINIMUM(), and ROUNDUP() to misc.h, then use those definitions rather than pulling <sys/param.h> and unknown namespace pollution. ok djm markus dtucker Upstream-ID: 712cafa816c9f012a61628b66b9fbd5687223fb8
* upstream commitmarkus@openbsd.org2016-08-141-574/+22
| | | | | | remove ssh1 server code; ok djm@ Upstream-ID: c24c0c32c49b91740d5a94ae914fb1898ea5f534
* Remove NO_IPPORT_RESERVED_CONCEPTDarren Tucker2016-04-081-6/+3
| | | | | | | Replace by defining IPPORT_RESERVED to zero on Cygwin, which should have the same effect without causing problems syncing patches with OpenBSD. Resync the two affected functions with OpenBSD. ok djm, sanity checked by Corinna.
* upstream commitdjm@openbsd.org2016-03-071-5/+7
| | | | | | | | | | refactor canohost.c: move functions that cache results closer to the places that use them (authn and session code). After this, no state is cached in canohost.c feedback and ok markus@ Upstream-ID: 5f2e4df88d4803fc8ec59ec53629105e23ce625e
* upstream commitdjm@openbsd.org2016-03-041-13/+15
| | | | | | | | fix ClientAliveInterval when a time-based RekeyLimit is set; previously keepalive packets were not being sent. bz#2252 report and analysis by Christian Wittenhorst and Garrett Lee feedback and ok dtucker@ Upstream-ID: d48f9deadd35fdacdd5106b41bb07630ddd4aa81
* upstream commitdjm@openbsd.org2016-02-081-13/+7
| | | | | | | | | | | | | | | refactor activation of rekeying This makes automatic rekeying internal to the packet code (previously the server and client loops needed to assist). In doing to it makes application of rekey limits more accurate by accounting for packets about to be sent as well as packets queued during rekeying events themselves. Based on a patch from dtucker@ which was in turn based on a patch Aleksander Adamowski in bz#2521; ok markus@ Upstream-ID: a441227fd64f9739850ca97b4cf794202860fcd8
* upstream commitmarkus@openbsd.org2016-01-271-6/+2
| | | | | | remove roaming support; ok djm@ Upstream-ID: 2cab8f4b197bc95776fb1c8dc2859dad0c64dc56
* upstream commitmarkus@openbsd.org2015-12-071-2/+2
| | | | | | | | implement SHA2-{256,512} for RSASSA-PKCS1-v1_5 signatures (user and host auth) based on draft-rsa-dsa-sha2-256-03.txt and draft-ssh-ext-info-04.txt; with & ok djm@ Upstream-ID: cf82ce532b2733e5c4b34bb7b7c94835632db309
* upstream commitdjm@openbsd.org2015-11-281-2/+3
| | | | | | | | don't include port number in tcpip-forward replies for requests that don't allocate a port; bz#2509 diagnosed by Ron Frederick ok markus Upstream-ID: 77efad818addb61ec638b5a2362f1554e21a970a
* upstream commitdjm@openbsd.org2015-02-201-5/+5
| | | | | | | | | | | | | | | | UpdateHostKeys fixes: I accidentally changed the format of the hostkeys@openssh.com messages last week without changing the extension name, and this has been causing connection failures for people who are running -current. First reported by sthen@ s/hostkeys@openssh.com/hostkeys-00@openssh.com/ Change the name of the proof message too, and reorder it a little. Also, UpdateHostKeys=ask is incompatible with ControlPersist (no TTY available to read the response) so disable UpdateHostKeys if it is in ask mode and ControlPersist is active (and document this)
* upstream commitdjm@openbsd.org2015-02-161-4/+84
| | | | | | | | | | | | Revise hostkeys@openssh.com hostkey learning extension. The client will not ask the server to prove ownership of the private halves of any hitherto-unseen hostkeys it offers to the client. Allow UpdateHostKeys option to take an 'ask' argument to let the user manually review keys offered. ok markus@
* upstream commitderaadt@openbsd.org2015-01-261-2/+2
| | | | | Reduce use of <sys/param.h> and transition to <limits.h> throughout. ok djm markus
* upstream commitmarkus@openbsd.org2015-01-191-3/+3
| | | | adapt kex to sshbuf and struct ssh; ok djm@
* upstream commitmarkus@openbsd.org2015-01-191-9/+16
| | | | move dispatch to struct ssh; ok djm@
* upstream commitmarkus@openbsd.org2015-01-191-6/+5
| | | | | | | | update packet.c & isolate, introduce struct ssh a) switch packet.c to buffer api and isolate per-connection info into struct ssh b) (de)serialization of the state is moved from monitor to packet.c c) the old packet.c API is implemented in opacket.[ch] d) compress.c/h is removed and integrated into packet.c with and ok djm@
* - (djm) [serverloop.c] Fix syntax error on Cygwin; from Corinna VinschenDamien Miller2014-08-191-2/+2
|
* - millert@cvs.openbsd.org 2014/07/15 15:54:14Damien Miller2014-07-181-23/+84
| | | | | | | | | | | | | | | | [PROTOCOL auth-options.c auth-passwd.c auth-rh-rsa.c auth-rhosts.c] [auth-rsa.c auth.c auth1.c auth2-hostbased.c auth2-kbdint.c auth2-none.c] [auth2-passwd.c auth2-pubkey.c auth2.c canohost.c channels.c channels.h] [clientloop.c misc.c misc.h monitor.c mux.c packet.c readconf.c] [readconf.h servconf.c servconf.h serverloop.c session.c ssh-agent.c] [ssh.c ssh_config.5 sshconnect.c sshconnect1.c sshconnect2.c sshd.c] [sshd_config.5 sshlogin.c] Add support for Unix domain socket forwarding. A remote TCP port may be forwarded to a local Unix domain socket and vice versa or both ends may be a Unix domain socket. This is a reimplementation of the streamlocal patches by William Ahern from: http://www.25thandclement.com/~william/projects/streamlocal.html OK djm@ markus@
* - djm@cvs.openbsd.org 2014/04/29 13:10:30Damien Miller2014-05-151-2/+2
| | | | | | | [clientloop.c serverloop.c] bz#1818 - don't send channel success/failre replies on channels that have sent a close already; analysis and patch from Simon Tatham; ok markus@
* - djm@cvs.openbsd.org 2014/02/02 03:44:32Damien Miller2014-02-041-2/+2
| | | | | | | | | | | [auth1.c auth2-chall.c auth2-passwd.c authfile.c bufaux.c bufbn.c] [buffer.c cipher-3des1.c cipher.c clientloop.c gss-serv.c kex.c] [kexdhc.c kexdhs.c kexecdhc.c kexgexc.c kexecdhs.c kexgexs.c key.c] [monitor.c monitor_wrap.c packet.c readpass.c rsa.c serverloop.c] [ssh-add.c ssh-agent.c ssh-dss.c ssh-ecdsa.c ssh-ed25519.c] [ssh-keygen.c ssh-rsa.c sshconnect.c sshconnect1.c sshconnect2.c] [sshd.c] convert memset of potentially-private data to explicit_bzero()
* - dtucker@cvs.openbsd.org 2013/12/19 00:19:12Damien Miller2013-12-291-2/+3
| | | | | | | [serverloop.c] Cast client_alive_interval to u_int64_t before assinging to max_time_milliseconds to avoid potential integer overflow in the timeout. bz#2170, patch from Loganaden Velvindron, ok djm@
* - djm@cvs.openbsd.org 2013/07/12 00:19:59Damien Miller2013-07-181-2/+3
| | | | | | [auth-options.c auth-rsa.c bufaux.c buffer.h channels.c hostfile.c] [hostfile.h mux.c packet.c packet.h roaming_common.c serverloop.c] fix pointer-signedness warnings from clang/llvm-3.3; "seems nice" deraadt@
* - djm@cvs.openbsd.org 2013/05/17 00:13:13Darren Tucker2013-06-011-18/+14
| | | | | | | | | | | | | | | | | | [xmalloc.h cipher.c sftp-glob.c ssh-keyscan.c ssh.c sftp-common.c ssh-ecdsa.c auth2-chall.c compat.c readconf.c kexgexs.c monitor.c gss-genr.c cipher-3des1.c kex.c monitor_wrap.c ssh-pkcs11-client.c auth-options.c rsa.c auth2-pubkey.c sftp.c hostfile.c auth2.c servconf.c auth.c authfile.c xmalloc.c uuencode.c sftp-client.c auth2-gss.c sftp-server.c bufaux.c mac.c session.c jpake.c kexgexc.c sshconnect.c auth-chall.c auth2-passwd.c sshconnect1.c buffer.c kexecdhs.c kexdhs.c ssh-rsa.c auth1.c ssh-pkcs11.c auth2-kbdint.c kexdhc.c sshd.c umac.c ssh-dss.c auth2-jpake.c bufbn.c clientloop.c monitor_mm.c scp.c roaming_client.c serverloop.c key.c auth-rsa.c ssh-pkcs11-helper.c ssh-keysign.c ssh-keygen.c match.c channels.c sshconnect2.c addrmatch.c mux.c canohost.c kexecdhc.c schnorr.c ssh-add.c misc.c auth2-hostbased.c ssh-agent.c bufec.c groupaccess.c dns.c packet.c readpass.c authfd.c moduli.c] bye, bye xfree(); ok markus@
* - dtucker@cvs.openbsd.org 2013/05/16 09:08:41Darren Tucker2013-05-161-2/+2
| | | | | | [log.c scp.c sshd.c serverloop.c schnorr.c sftp.c] Fix some "unused result" warnings found via clang and -portable. ok markus@
* - dtucker@cvs.openbsd.org 2013/05/16 04:09:14Darren Tucker2013-05-161-4/+10
| | | | | | | [sshd_config.5 servconf.c servconf.h packet.c serverloop.c monitor.c sshd_config sshd.c] Add RekeyLimit to sshd with the same syntax as the client allowing rekeying based on traffic volume or time. ok djm@, help & ok jmc@ for the man page.
* - dtucker@cvs.openbsd.org 2012/12/07 01:51:35Darren Tucker2012-12-071-3/+3
| | | | | | [serverloop.c] Cast signal to int for logging. A no-op on openbsd (they're always ints) but will prevent warnings in portable. ok djm@
* - djm@cvs.openbsd.org 2012/12/02 20:46:11Damien Miller2012-12-021-6/+13
| | | | | | | | [auth-options.c channels.c servconf.c servconf.h serverloop.c session.c] [sshd_config.5] make AllowTcpForwarding accept "local" and "remote" in addition to its current "yes"/"no" to allow the server to specify whether just local or remote TCP forwarding is enabled. ok markus@
* - djm@cvs.openbsd.org 2012/06/20 04:42:58Damien Miller2012-06-201-2/+2
| | | | | | [clientloop.c serverloop.c] initialise accept() backoff timer to avoid EINVAL from select(2) in rekeying
* - djm@cvs.openbsd.org 2012/04/11 13:16:19Damien Miller2012-04-221-4/+10
| | | | | | [channels.c channels.h clientloop.c serverloop.c] don't spin in accept() when out of fds (ENFILE/ENFILE) - back off for a while; ok deraadt@ markus@
* - OpenBSD CVS SyncDamien Miller2011-05-201-3/+3
| | | | | | - djm@cvs.openbsd.org 2011/05/15 08:09:01 [authfd.c monitor.c serverloop.c] use FD_CLOEXEC consistently; patch from zion AT x96.org
* - (djm) [serverloop.c] Fix test for server-assigned remote forwarding portDamien Miller2009-09-091-1/+2
| | | | (-R 0:...); bz#1578, spotted and fix by gavin AT emf.net; ok dtucker@
* - andreas@cvs.openbsd.org 2009/05/28 16:50:16Darren Tucker2009-06-211-2/+6
| | | | | | | | | [sshd.c packet.c serverloop.c monitor_wrap.c clientloop.c sshconnect.c monitor.c Added roaming.h roaming_common.c roaming_dummy.c] Keep track of number of bytes read and written. Needed for upcoming changes. Most code from Martin Forssen, maf at appgate dot com. ok markus@ Also, applied appropriate changes to Makefile.in
* - andreas@cvs.openbsd.org 2009/05/27 06:31:25Darren Tucker2009-06-211-3/+3
| | | | | | | [canohost.h canohost.c] Add clear_cached_addr(), needed for upcoming changes allowing the peer address to change. ok markus@
* - djm@cvs.openbsd.org 2009/02/12 03:16:01Damien Miller2009-02-141-5/+6
| | | | | | [serverloop.c] tighten check for -R0:... forwarding: only allow dynamic allocation if want_reply is set in the packet
* - djm@cvs.openbsd.org 2009/02/12 03:00:56Damien Miller2009-02-141-3/+6
| | | | | | | | [canohost.c canohost.h channels.c channels.h clientloop.c readconf.c] [readconf.h serverloop.c ssh.c] support remote port forwarding with a zero listen port (-R0:...) to dyamically allocate a listen port at runtime (this is actually specified in rfc4254); bz#1003 ok markus@
* - djm@cvs.openbsd.org 2009/01/22 10:02:34Damien Miller2009-01-281-2/+2
| | | | | | | | | | | [clientloop.c misc.c readconf.c readconf.h servconf.c servconf.h] [serverloop.c ssh-keyscan.c ssh.c sshd.c] make a2port() return -1 when it encounters an invalid port number rather than 0, which it will now treat as valid (needed for future work) adjust current consumers of a2port() to check its return value is <= 0, which in turn required some things to be converted from u_short => int make use of int vs. u_short consistent in some other places too feedback & ok markus@
* - markus@cvs.openbsd.org 2008/12/02 19:08:59Damien Miller2008-12-071-3/+3
| | | | | | [serverloop.c] backout 1.149, since it's not necessary and openssh clients send broken CHANNEL_FAILURE/SUCCESS messages since about 2004; ok djm@
* - (djm) [atomicio.c channels.c clientloop.c defines.h includes.h]Damien Miller2008-07-041-6/+8
| | | | | | | [packet.c scp.c serverloop.c sftp-client.c ssh-agent.c ssh-keyscan.c] [sshd.c] Explicitly handle EWOULDBLOCK wherever we handle EAGAIN, on some platforms (HP nonstop) it is a distinct errno; bz#1467 reported by sconeu AT yahoo.com; ok dtucker@
* - djm@cvs.openbsd.org 2008/06/30 12:15:39Darren Tucker2008-07-021-2/+3
| | | | | | [serverloop.c] only pass channel requests on session channels through to the session channel handler, avoiding spurious log messages; ok! markus@
* - (dtucker) [clientloop.c serverloop.c] channel_register_filter nowDarren Tucker2008-06-121-1/+1
| | | | takes 2 more args. with djm@
* - djm@cvs.openbsd.org 2008/06/10 22:15:23Darren Tucker2008-06-111-1/+11
| | | | | | | | | | | | [PROTOCOL ssh.c serverloop.c] Add a no-more-sessions@openssh.com global request extension that the client sends when it knows that it will never request another session (i.e. when session multiplexing is disabled). This allows a server to disallow further session requests and terminate the session. Why would a non-multiplexing client ever issue additional session requests? It could have been attacked with something like SSH'jack: http://www.storm.net.nz/projects/7 feedback & ok markus
generated by cgit v1.2.3 (git 2.39.1) at 2025-01-18 11:44:52 +0100