Some versions of clang-19 report:
error: invalid feature combination: +avx10.1-256; will be promoted to
avx10.1-512 [-Werror,-Winvalid-feature-combination]
touch-required and verify-required flags on FIDO private keys when resetting
the passphrase.
feedback/ok tb@
OpenBSD-Commit-ID: 8895e62eae5778711fe7dd6c09f8679acb2e6674
locked, otherwise forwarding sessions established with an agent was locked
will be treated as local, rather than remote.
Reported by sn0x-sharma
OpenBSD-Commit-ID: 524f210c6f2b3a06e0a2f6d0af5188a9a75fa2c7
remote forwarding is added via the local session multiplexing socket while a
remote forwarding open request is pending with the server.
Report and fix from Brian Mingus of Cognatory
OpenBSD-Commit-ID: c7888d566576386d0e96859f9ec7310a1e2d3609
This is documented to be allowed, and was up until 10.4p1 when a
transcription error in the config handling rework reverted it to
global-only, ie not allowed inside Match. bz#3987.
authentication to prefer FIDO keys that do not require user presence (touch)
first, followed by ones that do and with FIDO keys that require user
verification via PIN or biometrics last.
This effectively tries low-friction authenticators before higher
friction authenticators.
ok dtucker@
OpenBSD-Commit-ID: 067076c652dbb4f2aa89c6e82b19d8cbfec1d1be
will be tried for authentication in the order that they will be used.
feedback tb@ ok dtucker@
OpenBSD-Commit-ID: 617a7f149d1410980eac551e4780280190a5f218
Previously we supported building without NISTP521 in libcrypto since
some vendors shipped without it, but this now seems uncommon. This
removes that support, requiring a fully functional libcrypto.
This removes another set of diffs vs upstream and should reduce the
maintenance burden. ok djm@
Since 2010, we have supported building against an OpenSSL that did not
have any ECC support, since at the time many systems still shipped with
OpenSSL versions prior to ECC being added. We no longer support OpenSSL
versions that old, and while it's possible to build a modern libcrypto
without ECC, doing so seems very uncommon.
Having OPENSSL_HAS_ECC sprinkled throughout the code increases the
cost of syncing changes and is a maintenance burden, so this has now
outlived its usefulness and is being removed. It is still possible to
build --without-openssl on such systems if required.
This includes a few whitespace and header order changes to bring
Portable back into sync with OpenBSD in those places, and removes the
corresponding test.
ok djm@
to before parsing of the key sent by the peer.
This removes at least some key parsing and verification paths from
the pre-auth attack surface.
Suggested by Christopher Paul Rohlf of Anthropic, ok deraadt@
OpenBSD-Commit-ID: 4560b53b5cd2fe9b875436e48995a1829c2a9dea
harness), and also use freezero where possible from Christopher Paul Rohlf at
Anthropic ok djm
OpenBSD-Commit-ID: 50227bff4ffd4a93aad399f21fc20f1c3cbf2c69
the packet code as this provides context of the failing peer (address, port,
user, etc). Based on patch from Dag-Erling Smørgrav
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
OpenBSD-Commit-ID: 2e50ab08ab697722230f5d7dbebc9ea3c4f2931b
and test IPv6 parsing if found. This should always be enabled on OpenBSD,
but allows us to use the same test in Portable without modifications
that make syncs harder.
OpenBSD-Regress-ID: 80dce2465e9414695d878a9af18a3d75711f7861
This lets us skip them in Portable on platforms that don't support IPv6
all in one place, removing diffs from within the tests themselves and
making syncs easier.
OpenBSD-Regress-ID: be5d2d67c28f8134f84e8baab09f303be8ceb626
to tunnel forwarding (which is administratively disabled by default).
Reported by Erichen, Institute of Computing Technology,
Chinese Academy of Sciences
OpenBSD-Commit-ID: 5b3cc987a64749c94b20e12755db32a83f8f01e6
