Ben Harris [Wed, 2 Feb 2005 23:51:58 +0000 (23:51 +0000)]
Implement anti-replay protection for XDM-AUTHORIZATION-1, as required by
the specification. We keep a cache of tickets we've seen recently and
reject duplicates. Once a ticket in our cache is old enough that we
wouldn't accept a duplicate anyway, we expire it.
Owen Dunn [Sun, 30 Jan 2005 14:10:05 +0000 (14:10 +0000)]
The HI guidelines seem adamant that the File menu should never be called
anything but File, and two Mac users expressed profound distress at the
thought of it being called Session. File it is.
Owen Dunn [Sat, 29 Jan 2005 22:50:18 +0000 (22:50 +0000)]
Another compiler pickiness. It feels wrong to be doing this to
perfectly idiomatic code, somehow, and I half wonder whether the
Mac compilers are too stupid to be allowed to treat warnings as
errors.
Ben Harris [Fri, 28 Jan 2005 13:47:37 +0000 (13:47 +0000)]
Split discussion of diabling rekeys between time-based and data-based, since
disabling the former is much more useful, and much safer, than disabling the
latter. The new wording on data-based rekeys might need some polishing.
Ben Harris [Fri, 28 Jan 2005 11:39:45 +0000 (11:39 +0000)]
Overhaul of client-side XDM-AUTHORIZATION-1:
* Make sk_getxdmdata() return an arbitrary string rather than two integers.
This better matches the spec, even if the current version always returns
six bytes
* On Unix, for PF_UNIX sockets, return a counter rather than a constant along
with the PID. This should allow multiple clients to connect within one
second, and is what Xlib does.
* On Unix, interpret AF_INET6 addresses like Xlib does, returning the
embedded IPv4 address for v4-mapped addresses, and six bytes of zeroes
otherwise. The latter is silly, but if I'm going to do anything more sane
I need to check that X servers won't reject it.
Ben Harris [Wed, 26 Jan 2005 20:18:33 +0000 (20:18 +0000)]
Move sockaddr_is_loopback() to before sk_address_is_local(), and define the
latter in terms of the former. Also adjust the definition of
ipv4_is_loopback() to avoid using the non-standard inet_netof() and
IN_LOOPBACKNET, and move it next to its remaining uses.
Ben Harris [Sun, 23 Jan 2005 14:31:08 +0000 (14:31 +0000)]
When checking if a connection comes from localhost, don't assume it's an IPv4
connection. Instead, correctly check IPv4 and IPv6 connections, assume that
AF_LOCAL is always local, and anything else is always remote.
This makes trivial local-to-remote forwarding work on my system.
Ben Harris [Sat, 22 Jan 2005 16:06:21 +0000 (16:06 +0000)]
Don't abuse a remote channel number of (unsigned)(-1) to indicate a channel
for which we don't yet have a remote number, and instead add a flag to indicate
this fact. Fixes bug ssh-remoteid-minusone.
Ben Harris [Sat, 22 Jan 2005 13:32:41 +0000 (13:32 +0000)]
Probable support for first_kex_packet_follows in KEXINIT. Not significantly
tested since none of the common key-exchange protocols starts with a packet
from the server, so I don't have a server that implements this.
Ben Harris [Mon, 17 Jan 2005 16:38:55 +0000 (16:38 +0000)]
Currentish ssh.com supports single-DES in SSH2 as "des-cbc@ssh.com". It
seems to be entirely the same as "des-cbc", so supporting it is trivial
and we may as well do so. If nothing else, it makes it clear whose fault
it is.
Ben Harris [Sun, 16 Jan 2005 14:43:12 +0000 (14:43 +0000)]
Be a little less enthusiastic about sending SSH_MSG_CHANNEL_WINDOW_ADJUST:
only send it when it will significantly increase the server's idea of our
window. This avoids the slew of one-byte WINDOW_ADJUSTs that an interactive
shell typically generates.
Ben Harris [Sat, 15 Jan 2005 20:39:27 +0000 (20:39 +0000)]
Turn of ICRNL in the client tty when we're not in editing mode. This
means that we send literal CRs and let the remote pty layer work out what to
do with them, so that if it wants raw mode it can have it.
Ben Harris [Fri, 14 Jan 2005 12:26:38 +0000 (12:26 +0000)]
Don't use GNUish pattern rules in the Unix Makefile, since they're not
supported by non-GNU makes. This allows the standard Solaris /usr/ccs/bin/make
to handle that Makefile.
Simon Tatham [Tue, 11 Jan 2005 19:33:41 +0000 (19:33 +0000)]
Fix `disconnect': arrange that we keep track of when we're expecting
to see the server slam the TCP connection shut (i.e. almost never,
unless it's just sent us an SSH_MSG_DISCONNECT), and treat an
unexpected closure as a non-clean session termination. Previously
any server-initiated connection closure was being treated as a clean
exit, which was a hangover from the good old Telnet-only days.
Ben Harris [Tue, 11 Jan 2005 16:33:08 +0000 (16:33 +0000)]
Versions of OpenSSH before 2.5.4 kill the connection if the client attempts
to rekey. Extend the description of SSH2_BUG_REKEY to cover this situation
and apply it to the relevant OpenSSH versions.
Simon Tatham [Tue, 11 Jan 2005 10:45:43 +0000 (10:45 +0000)]
The Unix `make install' target now allows you to define UTMP_GROUP,
in which case pterm will be installed setgid that, or to define
UTMP_USER in which case it will be installed setuid that. If you
define neither, it will be installed without any set-id bits as
before.
Simon Tatham [Tue, 11 Jan 2005 10:37:55 +0000 (10:37 +0000)]
Servers announcing themselves as `Sun_SSH_1.0' apparently cannot
deal with rekeys at all: they totally ignore mid-session KEXINIT
sent by the client. Hence, a new bug entry so we don't try it.
Simon Tatham [Sun, 9 Jan 2005 14:55:55 +0000 (14:55 +0000)]
sk_namelookup() on Unix was failing to translate from our platform-
independent ADDRTYPE_* constants to real AF_* ones, causing explicit
protocol specification to fail.
Owen Dunn [Sun, 9 Jan 2005 14:27:48 +0000 (14:27 +0000)]
New function ltime() returns a struct tm of the current local time.
Fixes crashes when time() returns (time_t)-1 on Windows by using the
Win32 GetLocalTime() function. (The Unix implementation still just
uses time() and localtime().)
Simon Tatham [Sun, 9 Jan 2005 11:44:21 +0000 (11:44 +0000)]
I've changed my mind about what the IP version selection options in
the config should do when IPv6 is configured out. They shouldn't sit
there looking silly with only `Auto' and `IPv4' settings: they
should instead be completely absent. I had thought the former was
acceptable since IPv4-only was a configuration that people should
only be using if their compilers didn't support IPv6, but now it
occurs to me that ports to fundamentally non-IPv6-supporting
platforms are not implausible, and on such ports the presence of a
vestigial config option under the _standard_ build conditions would
be a low-quality solution.
Simon Tatham [Sat, 8 Jan 2005 14:45:26 +0000 (14:45 +0000)]
For local and dynamic port forwardings (i.e. the ones which listen
on a local port), the `Auto' protocol option on the Tunnels panel
should always produce a port you can connect to in _either_ of IPv4
and v6, because the aim is for the user not to have to know or care
which one they're using. This was not the case on Windows, and now
is. Also, updated the docs to give more detail on issues like this.
Simon Tatham [Sat, 8 Jan 2005 14:02:06 +0000 (14:02 +0000)]
Cleanups to sk_namelookup(). In particular, it now doesn't segfault
if you explicitly specify IPv6 and then try to look up a hostname
which doesn't have an IPv6 address.
Simon Tatham [Sat, 8 Jan 2005 13:28:41 +0000 (13:28 +0000)]
Clear the kex-specific context in ssh->pkt_ctx for every new key
exchange. Without doing this, after we have done one specific-group
DH exchange (group1 or group14), ssh2_pkt_type _always_ translates
30 and 31 as KEXDH_INIT and KEXDH_REPLY, making a subsequent
group-exchange kex look rather strange in an SSH packet log.
Simon Tatham [Sat, 8 Jan 2005 13:08:32 +0000 (13:08 +0000)]
Jacob points out that changing TICKSPERSEC in unix.h changed the
meaning of BellOverload{T,S} in Unix saved sessions. Add a Unix-
specific backwards compatibility wart to settings.c to compensate.
Of course when I do the serious config format revamp, I will ensure
that no config item depends on internal #defines (these time
intervals will be specified as a floating-point number of seconds)
and this horror will be relegated to the old-config-compatibility
code.
Jacob Nevins [Fri, 7 Jan 2005 16:55:45 +0000 (16:55 +0000)]
Simon points out that r5068 broke keyboard-interactive with multiple
INFO_REQUESTs, and for some reason Debian OpenSSH is sending INFO_REQUESTs
containing no prompts after a normal password authentication, so this
should fix Shai's problem.
Simon Tatham [Fri, 7 Jan 2005 14:22:17 +0000 (14:22 +0000)]
Proxy command formatting now recognises `%proxyhost' and
`%proxyport' in addition to the other things it interpolates. This
is useful when using the Unix-only `Local' proxy type: it allows me
to, for example, set up a proxy command such as
ssh %proxyhost nc -q0 %host %port
and then enter the name of the proxy machine in `Proxy hostname',
which makes it marginally more convenient to quickly change to using
a different proxy to get at the same target.
I haven't documented this, because we currently don't document the
Local proxy type at all. Possibly we should, though.
Simon Tatham [Fri, 7 Jan 2005 09:24:24 +0000 (09:24 +0000)]
Use sk_set_frozen() to ensure that no data will be accepted from an
SSH connection when we're in the middle of asking the user a
dialog-box-type question. Fixes `unix-kex-packet', which has just
bitten me when connecting to one of the work Suns.
Jacob Nevins [Thu, 6 Jan 2005 13:23:47 +0000 (13:23 +0000)]
`kbdint-failure': we now offer keyboard-interactive auth to the user for as
long as the server offers it, rather than only once, unless the server responds
to our initial USERAUTH_REQUEST("keyboard-interactive") with FAILURE, in which
case we give up on it entirely.
Simon Tatham [Tue, 4 Jan 2005 17:39:35 +0000 (17:39 +0000)]
Don't forget to initialise ret->ai to NULL in sk_nonamelookup. Was
causing segfaults in IPv6-enabled Unix PuTTY connecting through a
proxy when letting the proxy do the DNS.
Simon Tatham [Sat, 1 Jan 2005 12:34:32 +0000 (12:34 +0000)]
"Nirwana Nirwana" points out that mget, mput and ls are not the only
PSFTP commands that can make good use of wildcards! Now implemented
wildcard support in rmdir, rm, mv and chmod.
Simon Tatham [Fri, 31 Dec 2004 13:02:46 +0000 (13:02 +0000)]
Rename some of the more stupidly named files in the Unix back end.
Notably pterm.c, which was a sensible name right at the start but
became a misnomer as soon as I created Unix PuTTY.
Simon Tatham [Fri, 31 Dec 2004 11:46:28 +0000 (11:46 +0000)]
In r5043 Jacob removed the `Load' and `Delete' buttons in the saved-
sessions panel in the reconfig box. I think, given that, the title
of that box also wants work :-)
Simon Tatham [Fri, 31 Dec 2004 10:51:14 +0000 (10:51 +0000)]
Allow reconfiguration of compression and cipher settings in
mid-session in SSH2: this forces an immediate rekey to activate the
new settings. I'm not sure exactly what this will be useful for
(except possibly it might make comparative performance testing
easier?), but it has wonderful James Bond value for being able to
switch to a more secure cipher before doing anything sensitive :-)
If, that is, you weren't using the most secure one to begin with...
Simon Tatham [Thu, 30 Dec 2004 17:53:26 +0000 (17:53 +0000)]
Reinstate the textual service name in port forwarding Event Log
messages where specified. (I had removed this in the previous
revision through forgetfulness.)
Simon Tatham [Thu, 30 Dec 2004 17:48:35 +0000 (17:48 +0000)]
Jacob points out that when we reconfigure port forwarding, we ought
to be destroying old ones _before_ creating new ones, so that we can
reuse a port for a new purpose without colliding with ourselves.
Also fixed port forwarding, which my IPv6 checkin had completely
funted :-)
Ben Harris [Thu, 30 Dec 2004 17:29:54 +0000 (17:29 +0000)]
If we're going to define _XOPEN_SOURCE, we should at least define it to a
version that includes putenv(). Make it 600 (the current one) for good
measure.
Simon Tatham [Thu, 30 Dec 2004 16:45:11 +0000 (16:45 +0000)]
Integrate unfix.org's IPv6 patches up to level 10, with rather a lot
of polishing to bring them to what I think should in principle be
release quality. Unlike the unfix.org patches themselves, this
checkin enables IPv6 by default; if you want to leave it out, you
have to build with COMPAT=-DNO_IPV6.
I have tested that this compiles on Visual C 7 (so the nightlies
_should_ acquire IPv6 support without missing a beat), but since I
don't have IPv6 set up myself I haven't actually tested that it
_works_. It still seems to make correct IPv4 connections, but that's
all I've been able to verify for myself. Further testing is needed.
Simon Tatham [Thu, 30 Dec 2004 13:51:37 +0000 (13:51 +0000)]
I've decided that trying to do wildcards in PSFTP as a special case
of directory recursion was a strategic error: it obfuscates
sftp_{get,put}_file(), and also it makes it very hard to handle
subdirectory wildcards such as `foo/*'. Accordingly, here's a
completely different approach, in which sftp_{get,put}_file() are
still responsible for directory recursion, but wildcards are
expanded in sftp_general_{get,put}() before being passed thereto.
Subdirectory wildcards are now handled consistently across Unix,
Windows and the remote server.