aboutsummaryrefslogtreecommitdiff
diff options
context:
space:
mode:
Diffstat
-rw-r--r--.github/workflows/c-cpp.yml8
-rw-r--r--.github/workflows/selfhosted.yml1
-rw-r--r--.github/workflows/upstream.yml2
-rw-r--r--.github/workflows/vm.yml15
-rw-r--r--auth-pam.c21
-rw-r--r--configure.ac18
-rw-r--r--monitor.c1
-rw-r--r--openbsd-compat/bsd-poll.h4
-rw-r--r--sandbox-seccomp-filter.c3
-rw-r--r--ssh-pkcs11.c6
10 files changed, 55 insertions, 24 deletions
diff --git a/.github/workflows/c-cpp.yml b/.github/workflows/c-cpp.yml
index f64803b55ef6..a132ed87f65f 100644
--- a/.github/workflows/c-cpp.yml
+++ b/.github/workflows/c-cpp.yml
@@ -29,9 +29,9 @@ jobs:
- ubuntu-latest
- ubuntu-22.04-arm
- ubuntu-24.04-arm
- - macos-13
- macos-14
- macos-15
+ - macos-15-intel
- windows-2022
- windows-2025
config: [default]
@@ -79,8 +79,9 @@ jobs:
- { target: ubuntu-latest, config: libressl-3.7.3 }
- { target: ubuntu-latest, config: libressl-3.8.4 }
- { target: ubuntu-latest, config: libressl-3.9.2 }
- - { target: ubuntu-latest, config: libressl-4.0.0 }
- - { target: ubuntu-latest, config: libressl-4.1.0 }
+ - { target: ubuntu-latest, config: libressl-4.0.1 }
+ - { target: ubuntu-latest, config: libressl-4.1.1 }
+ - { target: ubuntu-latest, config: libressl-4.2.0 }
- { target: ubuntu-latest, config: openssl-master }
- { target: ubuntu-latest, config: openssl-noec }
- { target: ubuntu-latest, config: openssl-1.1.1 }
@@ -111,7 +112,6 @@ jobs:
- { target: ubuntu-latest, config: musl }
- { target: ubuntu-22.04-arm, config: kitchensink }
- { target: ubuntu-24.04-arm, config: kitchensink }
- - { target: macos-13, config: pam }
- { target: macos-14, config: pam }
- { target: macos-15, config: pam }
runs-on: ${{ matrix.target }}
diff --git a/.github/workflows/selfhosted.yml b/.github/workflows/selfhosted.yml
index a46d8a451aa7..aa01c8b296a9 100644
--- a/.github/workflows/selfhosted.yml
+++ b/.github/workflows/selfhosted.yml
@@ -51,6 +51,7 @@ jobs:
- obsd74
- obsd76
- obsd77
+ - obsd78
- obsdsnap
- obsdsnap-i386
- omnios
diff --git a/.github/workflows/upstream.yml b/.github/workflows/upstream.yml
index 6cb08fd41032..420b2439b009 100644
--- a/.github/workflows/upstream.yml
+++ b/.github/workflows/upstream.yml
@@ -42,7 +42,7 @@ jobs:
run: sshfs_mount
working-directory: ${{ runner.temp }}
- name: update source
- run: vmrun "cd /usr/src && cvs -q up -dPA usr.bin/ssh regress/usr.bin/ssh usr.bin/nc"
+ run: vmrun "cd /usr/src && if [ -d .git ]; then git pull && git log -n1; else cvs -q up -dPA usr.bin/ssh regress/usr.bin/ssh usr.bin/nc; fi"
- name: update netcat
run: vmrun "cd /usr/src/usr.bin/nc && make clean all && sudo make install"
- name: make clean
diff --git a/.github/workflows/vm.yml b/.github/workflows/vm.yml
index 9dcf5fcca764..759de69cbe33 100644
--- a/.github/workflows/vm.yml
+++ b/.github/workflows/vm.yml
@@ -282,9 +282,12 @@ jobs:
release: ${{ matrix.target }}
usesh: true
prepare: |
- env PKG_PATH=https://ftp.openbsd.org/pub/OpenBSD/${{matrix.target}}/packages/amd64 pkg_add sudo--
useradd -m builder
- echo "builder ALL=(ALL:ALL) NOPASSWD: ALL" >>/etc/sudoers
+ echo "permit nopass keepenv root" >/etc/doas.conf
+ echo "permit nopass keepenv builder" >>/etc/doas.conf
+ ls -l /etc/doas.conf
+ chown root:wheel /etc/doas.conf
+ chmod 644 /etc/doas.conf
mkdir -p /var/empty /usr/local/etc
cp $GITHUB_WORKSPACE/moduli /usr/local/etc/moduli
@@ -293,18 +296,18 @@ jobs:
run: cd $GITHUB_WORKSPACE && chown -R builder .
- name: configure
shell: openbsd {0}
- run: cd $GITHUB_WORKSPACE && sudo -u builder ./configure
+ run: cd $GITHUB_WORKSPACE && doas -u builder ./configure
- name: make clean
shell: openbsd {0}
- run: cd $GITHUB_WORKSPACE && sudo -u builder make clean
+ run: cd $GITHUB_WORKSPACE && doas -u builder make clean
- name: make
shell: openbsd {0}
- run: cd $GITHUB_WORKSPACE && sudo -u builder make -j4
+ run: cd $GITHUB_WORKSPACE && doas -u builder make -j4
- name: make tests
shell: openbsd {0}
run: |
cd $GITHUB_WORKSPACE
- sudo -u builder env SUDO=sudo make tests
+ doas -u builder env SUDO=doas make tests
solaris:
diff --git a/auth-pam.c b/auth-pam.c
index 5591f094ece3..1bb813277f63 100644
--- a/auth-pam.c
+++ b/auth-pam.c
@@ -237,6 +237,7 @@ pthread_join(sp_pthread_t thread, void **value)
static pam_handle_t *sshpam_handle = NULL;
+static char *sshpam_initial_user;
static int sshpam_err = 0;
static int sshpam_authenticated = 0;
static int sshpam_session_open = 0;
@@ -485,10 +486,11 @@ check_pam_user(Authctxt *authctxt)
return PAM_USER_UNKNOWN;
}
- if (strcmp(authctxt->pw->pw_name, pam_user) != 0) {
- debug("PAM user \"%s\" does not match expected \"%s\"",
- pam_user, authctxt->pw->pw_name);
- return PAM_USER_UNKNOWN;
+ if (sshpam_initial_user == NULL)
+ fatal_f("internal error: sshpam_initial_user NULL");
+ if (strcmp(sshpam_initial_user, pam_user) != 0) {
+ error_f("PAM user \"%s\" does not match previous \"%s\"",
+ pam_user, sshpam_initial_user);
}
return PAM_SUCCESS;
}
@@ -709,6 +711,8 @@ sshpam_cleanup(void)
sshpam_authenticated = 0;
pam_end(sshpam_handle, sshpam_err);
sshpam_handle = NULL;
+ free(sshpam_initial_user);
+ sshpam_initial_user = NULL;
}
static int
@@ -725,12 +729,8 @@ sshpam_init(struct ssh *ssh, Authctxt *authctxt)
fatal("Username too long from %s port %d",
ssh_remote_ipaddr(ssh), ssh_remote_port(ssh));
#endif
- if (sshpam_handle == NULL) {
- if (ssh == NULL) {
- fatal("%s: called initially with no "
- "packet context", __func__);
- }
- }
+ if (sshpam_handle == NULL && ssh == NULL)
+ fatal("%s: called initially with no packet context", __func__);
if (sshpam_handle != NULL) {
/* We already have a PAM context; check if the user matches */
if ((sshpam_err = check_pam_user(authctxt)) != PAM_SUCCESS)
@@ -740,6 +740,7 @@ sshpam_init(struct ssh *ssh, Authctxt *authctxt)
options.pam_service_name);
sshpam_err = pam_start(options.pam_service_name, user,
&store_conv, &sshpam_handle);
+ sshpam_initial_user = xstrdup(user);
sshpam_authctxt = authctxt;
if (sshpam_err != PAM_SUCCESS) {
diff --git a/configure.ac b/configure.ac
index db5211013f43..916ba032e36d 100644
--- a/configure.ac
+++ b/configure.ac
@@ -3773,6 +3773,24 @@ AC_CHECK_TYPES([nfds_t], , , [
#endif
])
+if test "x$ac_cv_type_nfds_t" != "xyes"; then
+ AC_MSG_CHECKING([if poll nfds_t is unsigned long])
+ AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[
+#include <sys/types.h>
+#ifdef HAVE_POLL_H
+#include <poll.h>
+#endif
+#ifdef HAVE_SYS_POLL_H
+#include <sys/poll.h>
+#endif
+ int poll(struct pollfd *, unsigned long, int timeout);
+ ]], [[return poll(0, 0, 0);]])],
+ [AC_MSG_RESULT([yes])
+ AC_DEFINE(POLL_NFDS_T_ULONG, 1, [Define if poll 2nd arg is ulong])],
+ [AC_MSG_RESULT([no])]
+ )
+fi
+
# Decide which sandbox style to use
sandbox_arg=""
AC_ARG_WITH([sandbox],
diff --git a/monitor.c b/monitor.c
index a9e854bec831..ad086c300287 100644
--- a/monitor.c
+++ b/monitor.c
@@ -1129,6 +1129,7 @@ mm_answer_pam_account(struct ssh *ssh, int sock, struct sshbuf *m)
if ((r = sshbuf_put_u32(m, ret)) != 0 ||
(r = sshbuf_put_stringb(m, loginmsg)) != 0)
fatal_fr(r, "buffer error");
+ sshbuf_reset(loginmsg);
mm_request_send(sock, MONITOR_ANS_PAM_ACCOUNT, m);
diff --git a/openbsd-compat/bsd-poll.h b/openbsd-compat/bsd-poll.h
index 67fd8c66f803..bebd5d87d05a 100644
--- a/openbsd-compat/bsd-poll.h
+++ b/openbsd-compat/bsd-poll.h
@@ -72,7 +72,11 @@ typedef struct pollfd {
#endif /* !HAVE_STRUCT_POLLFD_FD */
#ifndef HAVE_NFDS_T
+# ifdef POLL_NFDS_T_ULONG
+typedef unsigned long nfds_t;
+# else
typedef unsigned int nfds_t;
+# endif
#endif
#ifndef HAVE_POLL
diff --git a/sandbox-seccomp-filter.c b/sandbox-seccomp-filter.c
index a0692dd2f5bd..b3da8d5877b1 100644
--- a/sandbox-seccomp-filter.c
+++ b/sandbox-seccomp-filter.c
@@ -435,6 +435,9 @@ static const struct sock_filter preauth_insns[] = {
#ifdef __NR_getpeername
SC_ALLOW(__NR_getpeername),
#endif
+#ifdef __NR_uname
+ SC_ALLOW(__NR_uname),
+#endif
#ifdef __NR_setsockopt
SC_ALLOW_SETSOCKOPT(IPPROTO_IPV6, IPV6_TCLASS),
SC_ALLOW_SETSOCKOPT(IPPROTO_IP, IP_TOS),
diff --git a/ssh-pkcs11.c b/ssh-pkcs11.c
index c8817947395a..5e956208bb72 100644
--- a/ssh-pkcs11.c
+++ b/ssh-pkcs11.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: ssh-pkcs11.c,v 1.73 2025/10/08 21:02:16 djm Exp $ */
+/* $OpenBSD: ssh-pkcs11.c,v 1.74 2025/10/09 23:25:23 djm Exp $ */
/*
* Copyright (c) 2010 Markus Friedl. All rights reserved.
* Copyright (c) 2014 Pedro Martelletto. All rights reserved.
@@ -1486,7 +1486,7 @@ pkcs11_fetch_certs(struct pkcs11_provider *p, CK_ULONG slotidx,
case CKC_X_509:
if (pkcs11_fetch_x509_pubkey(p, slotidx, &obj,
&key, &label) != 0) {
- error("failed to fetch key");
+ debug_f("failed to fetch key");
continue;
}
break;
@@ -1613,7 +1613,7 @@ pkcs11_fetch_keys(struct pkcs11_provider *p, CK_ULONG slotidx,
}
if (key == NULL) {
- error("failed to fetch key");
+ debug_f("failed to fetch key");
continue;
}
note_key(p, slotidx, __func__, key);
generated by cgit v1.3 (git 2.53.0) at 2026-07-26 10:42:05 +0000