summaryrefslogtreecommitdiffhomepage
AgeCommit message (Collapse)Author
2020-05-21Make DEBUG_NOFORK a #if not #ifdefMatt Johnston
2020-05-19ext-info handling for server-sig-algsMatt Johnston
only client side is handled
2020-05-17split signkey_type and signature_type for RSA sha1 vs sha256Matt Johnston
2020-04-06use sigtype where appropriateMatt Johnston
2020-03-27When explicitly passing --disable-fuzz to ./configure fuzz was actuallyAlexander Dahl
enabled. Signed-off-by: Alexander Dahl <ada@thorsis.com>
2020-03-10Update remaining advise to edit options.hAlexander Dahl
You should edit localoptions.h instead.
2020-03-18Handle early exit when addrstring isn't setMatt Johnston
2020-03-18Improve address logging on early exit messages (#83)Kevin Darbyshire-Bryant
Change 'Early exit' and 'Exit before auth' messages to include the IP address & port as part of the message. This allows log scanning utilities such as 'fail2ban' to obtain the offending IP address as part of the failure event instead of extracting the PID from the message and then scanning the log again for match 'child connection from' messages Signed-off-by: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>
2020-03-14mergeMatt Johnston
2020-03-14Set SSH_ORIGINAL_COMMAND for "dropbear -c" too, fix build withoutMatt Johnston
DROPBEAR_SVR_PUBKEY_OPTIONS
2020-03-14Don't log authorized_keys command= every timeMatt Johnston
2020-03-14Fallback for key gen without hard link support (#89)Matt Robinson
Add a non-atomic fallback for key generation on platforms where link() is not permitted (such as most stock Android installs) or on filesystems without hard link support (such as FAT).
2020-03-14MOTD enabled by default as the manpage says (#87)zciendor
The man page (https://github.com/mkj/dropbear/blob/master/dropbear.8) says MOTD will be printed by default for any login shell, but it was disabled at compile time. Probably happened by accident when this code was moved from `options.h` to `default_options.h`.
2020-03-12Add Ed25519 support (#91)Vladislav Grishenko
* Add support for Ed25519 as a public key type Ed25519 is a elliptic curve signature scheme that offers better security than ECDSA and DSA and good performance. It may be used for both user and host keys. OpenSSH key import and fuzzer are not supported yet. Initially inspired by Peter Szabo. * Add curve25519 and ed25519 fuzzers * Add import and export of Ed25519 keys
2019-10-18bring back fsync_parent_dirMatt Johnston
2019-09-17Bring back Dropbear patch to avoid setting AR/LD/RANLIB in LTMMatt Johnston
2019-09-17Prime-related bugfixes (#81)Steffen Jaeckel
* Merge pull request #180 from czurnieden/isprimeerror Fixed bug in mp_prime_isprime (cherry picked from commit f3ff7064f3301a2fc11b84d389fd67769862d437) * do 2 MR rounds for numbers >=2048bits * back-port modified mp_prime_next_prime()
2019-09-16update ltm to 1.1.0 and enable FIPS 186.4 compliant key-generation (#79)Steffen Jaeckel
* make key-generation compliant to FIPS 186.4 * fix includes in tommath_class.h * update fuzzcorpus instead of error-out * fixup fuzzing make-targets * update Makefile.in * apply necessary patches to ltm sources * clean-up not required ltm files * update to vanilla ltm 1.1.0 this already only contains the required files * remove set/get double
2019-05-15Rename EPKA -> PluginMatt Johnston
2019-05-15External Public-Key Authentication API (#72)fabriziobertocci
* Implemented dynamic loading of an external plug-in shared library to delegate public key authentication * Moved conditional compilation of the plugin infrastructure into the configure.ac script to be able to add -ldl to dropbear build only when the flag is enabled * Added tags file to the ignore list * Updated API to have the constructor to return function pointers in the pliugin instance. Added support for passing user name to the checkpubkey function. Added options to the session returned by the plugin and have dropbear to parse and process them * Added -rdynamic to the linker flags when EPKA is enabled * Changed the API to pass a previously created session to the checkPubKey function (created during preauth) * Added documentation to the API * Added parameter addrstring to plugin creation function * Modified the API to retrieve the auth options. Instead of having them as field of the EPKASession struct, they are stored internally (plugin-dependent) in the plugin/session and retrieved through a pointer to a function (in the session) * Changed option string to be a simple char * instead of unsigned char *
2019-03-27Added signature for changeset ebcdb893992dMatt Johnston
2019-03-27Added tag DROPBEAR_2019.78 for changeset 009d52ae26d3Matt Johnston
2019-03-27Bump to 2019.78Matt Johnston
2019-03-24Fix regression where TTY modes weren't reset for clientMatt Johnston
2019-03-23Added signature for changeset 07b0d56d186dMatt Johnston
2019-03-23Added tag DROPBEAR_2019.77 for changeset 6d1bbe7d5fa5Matt Johnston
2019-03-232019.77Matt Johnston
2019-03-23use "openssl sha256"Matt Johnston
2019-03-23Update config.sub to 2019-01-05 and config.guess to 2019-03-04Matt Johnston
2019-03-21fix constness build errorMatt Johnston
2019-03-21limit password length to 100Matt Johnston
2019-03-20Increase MAX_USERNAME_LEN to 100Matt Johnston
2019-03-20dropbearconvert: keyimport.c: fix BER encoding of secp521r1 keys (#69)Christian Hohnstädt
keysizes >= 128 octets will be encoded with a 3 byte header which must be accounted by the optional-header Reproduce: master:~/build/dropbear$ ./dropbearkey -t ecdsa -s 521 -f K Generating 521 bit ecdsa key, this may take a while... master:~/build/dropbear$ ./dropbearconvert d o K L Key is a ecdsa-sha2-nistp521 key Wrote key to 'L' master:~/build/dropbear$ openssl ec < L read EC key unable to load Key 139769806448384:error:0D07209B:asn1 encoding routines:ASN1_get_object:too long:crypto/asn1/asn1_lib.c:91:
2019-03-20support openssh long option -o Port=XXXX (#68)xcko
2019-03-20cygwin competibility fix (#64)karel-m
2019-03-20drop obsolete definition for MAX_KEXHASHBUF (#65)Andre McCurdy
The last code to make use of MAX_KEXHASHBUF was removed in 2005: https://github.com/mkj/dropbear/commit/736f370dce614b717193f45d084e9e009de723ce Signed-off-by: Andre McCurdy <armccurdy@gmail.com>
2019-03-20Add a sanity check for DROPBEAR_SVR_MULTIUSER==0 modeMatt Johnston
2019-03-20Support servers without multiple user support (#76)Patrick Stewart
2019-03-20packet: remove stale comment about "packet_type" (#63)Konstantin Demin
clean up after 7f15910541 Signed-off-by: Konstantin Demin <rockdrilla@gmail.com>
2019-03-20fix some gcc warnings (#73)François Perrad
* tweak string size fix gcc8 warnings ``` svr-agentfwd.c: In function 'bindagent': svr-agentfwd.c:254:53: warning: '%s' directive output may be truncated writing up to 107 bytes into a region of size between 0 and 107 [-Wformat-truncation=] snprintf(addr.sun_path, sizeof(addr.sun_path), "%s/%s", path, sockfile); ^~ ~~~~~~~~ svr-agentfwd.c:254:2: note: 'snprintf' output between 2 and 216 bytes into a destination of size 108 snprintf(addr.sun_path, sizeof(addr.sun_path), "%s/%s", path, sockfile); ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ``` * cleanup signed/unsigned comparison fix gcc8 warnings ``` scp.c: In function 'do_local_cmd': scp.c:132:17: warning: comparison of integer expressions of different signedness: 'u_int' {aka 'unsigned int'} and 'int' [-Wsign-compare] for (i = 0; i < a->num; i++) ^ scpmisc.c: In function 'addargs': scpmisc.c:161:25: warning: comparison of integer expressions of different signedness: 'int' and 'u_int' {aka 'unsigned int'} [-Wsign-compare] } else if (args->num+2 >= nalloc) ^~ scpmisc.c: In function 'replacearg': scpmisc.c:183:12: warning: comparison of integer expressions of different signedness: 'u_int' {aka 'unsigned int'} and 'int' [-Wsign-compare] if (which >= args->num) ^~ scpmisc.c: In function 'freeargs': scpmisc.c:196:17: warning: comparison of integer expressions of different signedness: 'u_int' {aka 'unsigned int'} and 'int' [-Wsign-compare] for (i = 0; i < args->num; i++) ^ ``` see https://cvsweb.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/misc.h.diff?r1=1.16&r2=1.17
2019-03-20use strlcpy & strlcat (#74)François Perrad
* refactor checkpubkeyperms() with safe BSD functions fix gcc8 warnings ``` svr-authpubkey.c: In function 'checkpubkeyperms': svr-authpubkey.c:427:2: warning: 'strncat' specified bound 5 equals source length [-Wstringop-overflow=] strncat(filename, "/.ssh", 5); /* strlen("/.ssh") == 5 */ ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~ svr-authpubkey.c:433:2: warning: 'strncat' specified bound 16 equals source length [-Wstringop-overflow=] strncat(filename, "/authorized_keys", 16); ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ``` see https://www.sudo.ws/todd/papers/strlcpy.html * restore strlcpy in xstrdup see original https://cvsweb.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/xmalloc.c?rev=1.16
2019-03-20Fix for issue successfull login of disabled user (#78)vincentto13
This commit introduces fix for scenario: 1. Root login disabled on dropbear 2. PAM authentication model enabled While login as root user, after prompt for password user is being notified about login failrue, but after second attempt of prompt for password within same session, login becames succesfull. Signed-off-by: Pawel Rapkiewicz <pawel.rapkiewicz@gmail.com>
2019-03-20Add missing word to readme (#77)Michael Jones
2019-01-07add missing initializer (#71)François Perrad
2018-11-14mergeMatt Johnston
2018-11-14Split ChanType closehandler() and cleanup() so that dbclient doesn'tMatt Johnston
lose exit status messages
2018-11-14Remove some cluttering TRACE printoutsMatt Johnston
2018-11-06Remove incorrect _POSIX_C_SOURCEMatt Johnston
2018-11-05- Add adaptive authentication failure delayMatt Johnston
- Rework monotonic_now/gettime_wrapper and use clock_gettime on more platforms
2018-09-07merge remote forward fixMatt Johnston
generated by cgit v1.2.3 (git 2.39.1) at 2025-01-15 20:02:13 +0000