[openssh-commits] [openssh] branch master updated (ae7373dfe -> bc15793b2)
git+noreply at mindrot.org
git+noreply at mindrot.org
Wed Sep 16 11:15:54 AEST 2026
This is an automated email from the git hooks/post-receive script.
djm pushed a change to branch master
in repository openssh.
from ae7373dfe fix merge botch that put lines in wrong function
new 0f90a8417 upstream: Mask SIGTERM/SIGQUIT when processing a SIGHUP restart
new 8895b5ae1 upstream: Extend TCPKeepAlive to support forwardings too
new 14843e73b upstream: Account pubkey checks separately to auth attempts
new cee6aedb1 upstream: Allow specification of agent socket directories
new 813f670cc upstream: Add WarnWeakCrypto to sshd
new 65666f4e8 upstream: Check key and CA sig type during key parsing
new 991f1f31d upstream: Propagate authorized_keys "resrict" keyword
new 526fd2771 upstream: Correctly handle some options that accept "none"
new 670510d1e upstream: Reset GSSAPI client state before authentication
new 6f9cd19af upstream: Only store GSSAPI creds when authn succeeds
new eab916613 upstream: switch from SUPERCOP ed25519 to libsodium
new c5c4ca2b7 upstream: missing part of previous commit: update script to
new fc5bed4b1 upstream: adapt to libsodium ed25519 implementation
new bc15793b2 upstream: whitespace
The 14 revisions listed above as "new" are entirely new to this
repository and will be described in separate emails. The revisions
listed as "add" were already present in the repository and have only
been added to this reference.
Detailed log of new commits:
commit bc15793b2abce850340be6c0b36b83c330c7a887
Author: djm at openbsd.org <djm at openbsd.org>
Date: Wed Sep 16 00:59:12 2026 +0000
upstream: whitespace
OpenBSD-Commit-ID: b8d7e0a0b7b1a15941df5bfa91998f988e2346e2
commit fc5bed4b1c71441db27b8040bfcae237f1786656
Author: djm at openbsd.org <djm at openbsd.org>
Date: Wed Sep 16 00:45:03 2026 +0000
upstream: adapt to libsodium ed25519 implementation
OpenBSD-Regress-ID: d084e761416cea1f00d4f295aa92b737b28cebae
commit c5c4ca2b77fa8f4498d46d59dde81a57111c5660
Author: djm at openbsd.org <djm at openbsd.org>
Date: Wed Sep 16 00:46:17 2026 +0000
upstream: missing part of previous commit: update script to
import ed25519 implementation from libsodium
OpenBSD-Commit-ID: 1f3d60686a8ce15212d8730814dfb8213fdf96ac
commit eab91661367a61debb1fcf94b46fff4278999f81
Author: djm at openbsd.org <djm at openbsd.org>
Date: Wed Sep 16 00:43:00 2026 +0000
upstream: switch from SUPERCOP ed25519 to libsodium
The libsodium implementation includes a number of strictness and
malleability checks over the original reference implementation we
have used to this point.
libsodium also offers a more traditional "detached" signature
verification API (SUPERCOP required the signature to be contiguous
with the signed data). Switch to this and avoid a bunch of fiddly
code.
ok markus, deraadt
OpenBSD-Commit-ID: ea9c958435790c391b031bd9f0599f1ebf48d516
commit 6f9cd19af05aa828d7778cfb047faaed1679e8b7
Author: djm at openbsd.org <djm at openbsd.org>
Date: Wed Sep 16 00:37:52 2026 +0000
upstream: Only store GSSAPI creds when authn succeeds
Issue report and patch from Moritz Theile
ok markus, deraadt
OpenBSD-Commit-ID: 812bbd22b8dd5a1583094ab2b6ff0045e4088467
commit 670510d1e190b0f4e47066f24498c04ada1da0f0
Author: djm at openbsd.org <djm at openbsd.org>
Date: Wed Sep 16 00:37:07 2026 +0000
upstream: Reset GSSAPI client state before authentication
Avoids situation where a partially-completed GSSAPI authentication attempt
can retain state that is subsequently used by a later attempt.
Report and feedback Moritz Theile, also reported by several others.
ok markus, deraadt
OpenBSD-Commit-ID: 95758f23e358b7c19e6205ac1c979193a9145556
commit 526fd2771342f36142099bec82c49ce0457c5016
Author: djm at openbsd.org <djm at openbsd.org>
Date: Wed Sep 16 00:35:09 2026 +0000
upstream: Correctly handle some options that accept "none"
Some options, including AuthorizedPrincipalsFile were documented as accepting
"none" as a way to disable them, however when overriddes by a ssh_config(5)
Match keyword, this argument was being interpreted as a literal file.
With Chris Rohlf in collaboration with Claude and Anthropic Research
ok markus, deraadt
OpenBSD-Commit-ID: 802f3a7695eba20924c05e500b0ecd34ec877756
commit 991f1f31dde2797416acaf4319dbebe764446c6f
Author: djm at openbsd.org <djm at openbsd.org>
Date: Wed Sep 16 00:33:44 2026 +0000
upstream: Propagate authorized_keys "resrict" keyword
The "restrict" keyword was not pervasively being applied to TunnelForwarding
connections (which are administratively disabled by default). This is a
separate problem to the one fixed in openssh-10.5
reported by several people; ok markus, deraadt
OpenBSD-Commit-ID: 8c36c31dc2bdbc0c432d1056496b2f1ce93198d1
commit 65666f4e820051da00c4a8ef0b1555a9f881050a
Author: djm at openbsd.org <djm at openbsd.org>
Date: Wed Sep 16 00:31:27 2026 +0000
upstream: Check key and CA sig type during key parsing
Checks key type and CA signature algorithm allowlists as early as
possible during public key deserialisation.
Use this in the client and server to reduce attack surface from
disallowed key/signature types.
With Chris Rohlf in collaboration with Claude and Anthropic Research
ok markus, deraadt
OpenBSD-Commit-ID: b03cb3755506231a742eed844f269524812f560a
commit 813f670ccc086aeb48ca6bf701e6a73c098a65bb
Author: djm at openbsd.org <djm at openbsd.org>
Date: Wed Sep 16 00:29:44 2026 +0000
upstream: Add WarnWeakCrypto to sshd
This option was previously available for the client only. This adds it to
sshd, so allow logging of non-PQ key exchanges.
ok markus, deraadt
OpenBSD-Commit-ID: 524564b82a7a20a4ff984c948fb75aa2b0f9b707
commit cee6aedb1a176959164ab92556402e316469b8fb
Author: djm at openbsd.org <djm at openbsd.org>
Date: Wed Sep 16 00:25:50 2026 +0000
upstream: Allow specification of agent socket directories
Add AgentSocketPath for sshd_config and -A flag for ssh-agent.
Agent socket directories may be shared or user-specific.
Shared directories (specified like "shared:/tmp") will cause the listening
program to create a temporary subdirectory ssh-XXXXXXXXXX under the requeted
path to hold the socket. This supports the old sshd/ssh-agent behaviour before
we switched to the socket directory being under ~/.ssh/agent
User-specific directories just create the socket directly in the requested
directory. This is the default, as user:.ssh/agent
bz3860; ok markus, deraadt
OpenBSD-Commit-ID: 91b95d02f376ad8959ffb23902cc115a0b74d9bf
commit 14843e73b970e248b785d84df0e54ae9f3992cff
Author: djm at openbsd.org <djm at openbsd.org>
Date: Wed Sep 16 00:16:52 2026 +0000
upstream: Account pubkey checks separately to auth attempts
Add a `PubkeyOptions max-pk-ok:nnnn` option to allow PK_OK tests (asking
whether the server might accept a given public key) that do not count
against MaxAuthTries, defaulting to 6 attempts.
After these attempts are exhausted, futher attempts count as failed
authentications against MaxAuthTries.
ok markus, deraadt
OpenBSD-Commit-ID: 4a02d2f303f4d83c10871221dce1db1f9fe2936f
commit 8895b5ae1b638148d35c2ee0b0726c66cdd39fd0
Author: djm at openbsd.org <djm at openbsd.org>
Date: Wed Sep 16 00:13:58 2026 +0000
upstream: Extend TCPKeepAlive to support forwardings too
This allows the existing client and server TCPKeepAlive option to optionally
enable keepalives on TCP connections that are created for forwardings.
Previously this option controlled keepalives on the connection socket only.
TCPKeepAlive "yes" or "transport" enables keepalives on the connection
socket. "TCPKeepAlive all" additionally enables them for forwarding
sockets.
bz3921. ok markus, deraadt
OpenBSD-Commit-ID: c29b075968e6fa88fd9773bdea8174e70229262e
commit 0f90a8417bf6063b661cc3069b9f5a7d19c69242
Author: djm at openbsd.org <djm at openbsd.org>
Date: Wed Sep 16 00:08:52 2026 +0000
upstream: Mask SIGTERM/SIGQUIT when processing a SIGHUP restart
request. This ensures that these signals are subsequently delivered after the
restart has been completed, rather than ignored. bz3981
OpenBSD-Commit-ID: a69ff4121882583edcba319fa40adfc6ba75377c
Summary of changes:
auth-options.c | 3 +-
auth.h | 4 +-
auth2-hostbased.c | 49 +-
auth2-pubkey.c | 115 +-
auth2.c | 5 +-
channels.c | 106 +-
channels.h | 14 +-
crypto_api.h | 8 +-
ed25519-openssl.c | 53 +-
ed25519.c | 6291 ++++++++++++++++++++++---------
ed25519.sh | 431 ++-
gss-serv.c | 34 +-
kex.c | 37 +-
kex.h | 7 +-
kexgen.c | 5 +-
kexgexc.c | 5 +-
misc-agent.c | 234 +-
misc.c | 15 +-
misc.h | 11 +-
monitor.c | 4 +-
monitor_wrap.c | 5 +-
packet.c | 12 +-
pathnames.h | 9 +-
readconf.c | 18 +-
readconf.h | 6 +-
regress/misc/sk-dummy/sk-dummy.c | 18 +-
regress/unittests/crypto/test_ed25519.c | 24 +-
servconf.c | 147 +-
servconf.h | 19 +-
session.c | 11 +-
ssh-agent.1 | 39 +-
ssh-agent.c | 77 +-
ssh-ed25519-sk.c | 27 +-
ssh-ed25519.c | 49 +-
ssh-gss.h | 4 +-
ssh-mldsa-eddsa.c | 36 +-
ssh.c | 4 +-
ssh_config.5 | 37 +-
sshconnect.c | 16 +-
sshconnect2.c | 20 +-
sshd-auth.c | 5 +-
sshd-session.c | 11 +-
sshd.c | 8 +-
sshd_config.5 | 102 +-
ssherr.c | 4 +-
ssherr.h | 3 +-
sshkey.c | 73 +-
sshkey.h | 4 +-
48 files changed, 5722 insertions(+), 2497 deletions(-)
--
To stop receiving notification emails like this one, please contact
djm at mindrot.org.
More information about the openssh-commits
mailing list