comparison CHANGES @ 1546:bb8eaa26bc93 fuzz

merge from main
author Matt Johnston <matt@ucc.asn.au>
date Mon, 26 Feb 2018 22:44:48 +0800
parents d35cf9a5e0b5
children e46f7f1da56a
comparison
equal deleted inserted replaced
1530:63fa53d3b6c7 1546:bb8eaa26bc93
1 Upcoming...
2
3 - IMPORTANT:
4 Custom configuration is now specified in local_options.h rather than options.h
5 Available options and defaults can be seen in default_options.h
6
7 To migrate your configuration, compare your customised options.h against the
8 upstream options.h from your relevant version. Any customised options should
9 be put in localoptions.h
10
11 - "configure --enable-static" should now be used instead of "make STATIC=1"
12
13 - Add group14-256 and group16 key exchange options
14
15 - Set hardened build flags by default if supported by the compiler.
16 -Wl,-pie
17 -Wl,-z,now -Wl,-z,relro
18 -fstack-protector-strong
19 -D_FORTIFY_SOURCE=2
20 # spectre v2 mitigation
21 -mfunction-return=thunk
22 -mindirect-branch=thunk
23
24 These can be disabled with configure --disable-harden if needed
25 Spectre patch from Loganaden Velvindron
26
27 - Add runtime -T max_auth_tries option from Kevin Darbyshire-Bryant
28
29 - Add 'dbclient -J &fd' to allow dbclient to connect over an existing socket.
30 See dbclient manpage for a socat example. Patch from Harald Becker
31
32 - Add "-c forced_command" option. Patch from Jeremy Kerr
33
34 - Support server-chosen TCP forwarding ports, patch from houseofkodai
35
36 - Allow choosing outgoing address for dbclient with -b [bind_address][:bind_port]
37 Patch from houseofkodai
38
39 - Update bundled libtomcrypt to 1.18.1, libtommath to 1.0.1
40
41 - Minimum RSA key length has been increased to 1024 bits
42
43 - Set PAM_RHOST which is needed by modules such as pam_abl
44
45 - Improvements to DSS public key validation, found by OSS-Fuzz.
46
47 - Don't exit when an authorized_keys file has malformed entries. Found by OSS-Fuzz
48
49 - Fix null-pointer crash with malformed ECDSA or DSS keys. Found by OSS-Fuzz
50
51 - Numerous code cleanups and small issues fixed by Francois Perrad
52
53 - Test for pkt_sched.h rather than SO_PRIORITY which was problematic with some musl
54 platforms. Reported by Oliver Schneider and Andrew Bainbridge
55
56 - Fix some platform portability problems, from Ben Gardner
57
58 - Add EXEEXT filename suffix for building dropbearmulti, from William Foster
59
60 - Support --enable-<option> properly for configure, from Stefan Hauser
61
62 - configure have_openpty result can be cached, from Eric BĂ©nard
63
64 - handle platforms that return close() < -1 on failure, from Marco Wenzel
65
66 - Build and configuration cleanups from Michael Witten
67
68 - Fix libtomcrypt/libtommath linking order, from Andre McCurdy
69
70 - Fix old Linux platforms that have SYS_clock_gettime but not CLOCK_MONOTONIC
71
72 - Update curve25519-donna implementation to current version
73
1 2017.75 - 18 May 2017 74 2017.75 - 18 May 2017
2 75
3 - Security: Fix double-free in server TCP listener cleanup 76 - Security: Fix double-free in server TCP listener cleanup
4 A double-free in the server could be triggered by an authenticated user if 77 A double-free in the server could be triggered by an authenticated user if
5 dropbear is running with -a (Allow connections to forwarded ports from any host) 78 dropbear is running with -a (Allow connections to forwarded ports from any host)