Many hyperlinks are disabled.
Use anonymous login
to enable hyperlinks.
128 check-ins using file windows/winctrls.c version 33116a303a
|
2014-02-24
| ||
| 17:35 | Add a missing bn_restore_invariant in RSA blinding code. We were inventing a random number by starting with a long zero bignum and then setting bits at random, which left an opportunity for the result to be a non-normalised representation (with a leading zero word) and hence fail an assertion in bignum_cmp. Leaf check-in: d7de89b12b user: simon tags: trunk | |
|
2014-02-22
| ||
| 12:02 | Add some assertions in sshzlib.c. gcc 4.8 compiling with -O3 gives a new warning about the access to st->pending at the top of lz77_compress, because for some reason it thinks there's an out-of-bounds array access there (or perhaps just a potential one, I'm not really sure which side -Warray-bounds is erring on). Add an assertion reassuring it that st->npending can't get bigger than the size of st->pending at the site it's complaining about, and a second one at the site where st->npending is increased (just in case my analysis of why it can't happen was wrong!). Also add a comment explaining the assertions. check-in: d59600bfab user: simon tags: trunk | |
| 12:02 | Add the autogenerated empty.h to CLEANFILES. Colin Watson points out that it's untidy to create it with the makefile but not clean it up again in the same way. check-in: 9bdcecee98 user: simon tags: trunk | |
| 12:02 | Add the 'subdir-objects' option in the automake makefile. This rearranges the object files so that they each live alongside their original source file, instead of all being in the same directory. To my way of thinking this is a more or less neutral change (perhaps marginally less tidy), but autotools is apparently beginning to think it's the One True Way and 1.14 will give a warning if you don't have it enabled. check-in: 30b2a618a6 user: simon tags: trunk | |
| 12:01 | Move the Unix configure script up to the top level. Previously, 'configure' and its assorted machinery lived in the 'unix' subdir, because that seemed like a clean place to keep it given that all the other per-platform Makefiles live in their platform directories. However, this never sat all that happily with autotools, and even less so now that it likes to have object file pathnames parallel source file pathnames: if you have Makefile.am refer to source files outside its subdir as "../terminal.c" and enable subdir-objects then any out-of-tree build calls the corresponding object file "../terminal.o" and so your build products mostly end up at the directory above your build dir! And as of autotools 1.14 my previous compensatory bodge of prefixing every source file path in Makefile.am with "$(srcdir)" has stopped working too. So I'm giving in to necessity, and changing policy by moving the configure machinery up to the top level of the source tree where autotools will be less confused by it. This should not be taken as any indication of the primacy of the Unix port, only of the recalcitrance of autotools. Whereas before we had a trivial script called 'configure' at the top level that invoked unix/configure to effectively do an 'out-of-tree build' (for make purposes) at the top level of the source tree, we now have a similar script in unix/configure. So this _should_ make very little difference: people who were previously running configure from the top level should still be able to, and likewise people who were running it from the unix subdir. check-in: c37628a5ae user: simon tags: trunk | |
|
2014-02-16
| ||
| 10:40 | Enable xterm mouse reporting of wheel actions in GTK. I had somehow missed this completely out of the GTK mouse-button handling and never noticed until now! Of course, like any other mouse action, if you want it to be handled locally rather than passed through then you can hold down Shift. check-in: 7b7fe7cab5 user: simon tags: trunk | |
| 10:40 | Stop sending release events for mouse wheel 'buttons' in X mouse mode. On Windows (X mouse reporting of the mouse wheel isn't currently done by the Unix front end, though I'm shortly about to fix that too) a mouse wheel event is translated into a virtual button, and we send both a press and a release of that button to terminal.c, which encodes both in X mouse reporting escape sequences and passes them on to the server. This isn't consistent with what xterm does - scroll-wheel events are encoded _like_ button presses, but differ semantically in that they don't have matching releases. So we're updating to match xterm. check-in: 318dea6985 user: simon tags: trunk | |
|
2014-02-05
| ||
| 15:51 | Revert half of r10135, and re-fix properly. One of my changes in uxnet.c was outside the NO_IPV6 ifdef, and broke compilation in the normal mode. Revert all changes in that file and replace with a reference to the 'step' parameter in the no-IPv6 version of the SOCKADDR_FAMILY macro, so that those warnings are squelched anyway. check-in: abd47d5258 user: simon tags: trunk | |
|
2014-02-04
| ||
| 16:37 | Fix warnings when compiling with -DNO_IPV6. A user pointed out that 'family' was uninitialised in config.c, and when I tried test-building with -DNO_IPV6 (and the usual -Werror, of course) some unused variables showed up in uxnet.c too. check-in: a3ff424718 user: simon tags: trunk | |
|
2014-01-25
| ||
| 12:38 | Don't unconditionally reset scrollback on certain escape sequences. Handlers for a number of escape sequences, notably including ESC[J and the sequences that switch to/from the alternate screen, were unconditionally resetting the scrollback instead of first checking the 'Reset scrollback on display activity' configuration option. I've added the missing if statements, so now 'Reset scrollback on display activity' should actually mean what it says. For example, this would have inconvenienced an mplayer user, who wouldn't be able to go up and check their scrollback while mplayer was repeatedly redisplaying its status line, because mplayer uses ESC[J to erase each version of the status line before printing the next version. check-in: 02395144a9 user: simon tags: trunk | |
| 09:59 | Fix a potential crash in ssh_setup_portfwd. If we search for a colon by computing ptr + host_strcspn(ptr,":"), then the resulting pointer is always non-NULL, and the 'not found' condition is not !p but !*p. This typo could have caused PuTTY to overrun a string, but not in a security-bug sense because any such string would have to have been loaded from the configuration rather than received from a hostile source. check-in: 55833059a8 user: simon tags: trunk | |
| 09:58 | Support explicit IPv6 source addresses in Windows port forwarding. There's been a long-standing FIXME in Windows's sk_newlistener which says that in IPv6 mode, an explicit source address (e.g. from a command-line option of the form -L srcaddr:12345:dest:22) is ignored. Now it's honoured if possible. check-in: 54d31acb43 user: simon tags: trunk | |
| 09:58 | Avoid misidentifying unbracketed IPv6 literals as host:port. Both GUI PuTTY front ends have a piece of logic whereby a string is interpreted as host:port if there's _one_ colon in it, but if there's more than one colon then it's assumed to be an IPv6 literal with no trailing port number. This permits the PuTTY command line to take strings such as 'host', 'host:22' or '[::1]:22', but also cope with a bare v6 literal such as '::1'. This logic is also required in the two Plink front ends and in the processing of CONF_loghost for host key indexing in ssh.c, but was missing in all those places. Add it. check-in: dac07879fa user: simon tags: trunk | |
| 09:58 | Use the new host_str* functions to improve IPv6 literal support. I've gone through everywhere we handle host names / addresses (on command lines, in PuTTY config, in port forwarding, in X display names, in host key storage...) and tried to make them handle IPv6 literals sensibly, by using the host_str* functions I introduced in my previous commit. Generally it's now OK to use a bracketed IPv6 literal anywhere a hostname might have been valid; in a few cases where no ambiguity exists (e.g. no :port suffix is permitted anyway) unbracketed IPv6 literals are also acceptable. check-in: 7c4cad97cb user: simon tags: trunk | |
| 09:58 | New hostname-handling functions in misc.c. These are intended to make it easier to handle strings of the form "hostname:port" or other colon-separated things including hostnames (such as the -L and -R command-line option arguments), even though the hostname part might be a square-bracketed IPv6 address literal containing colons that have to _not_ be treated as separating the top-level string components. Three of these functions have semantics as much like existing C library functions as I could make them (host_strchr, host_strrchr, host_strcspn) so that it wouldn't be too error-prone to replace existing C functions with them at lots of call sites. The fourth function (host_strduptrim) just strips square brackets off anything that looks like an IPv6 literal. check-in: fb9857d0e6 user: simon tags: trunk | |
|
2014-01-16
| ||
| 13:16 | Fix assertion failure in Unix PuTTYgen exports. The assertions I added to sshrand.c in r9930 are now justified, because they were failing when cmdgen was used to convert a key into either foreign private key file format - both the export functions require random_byte() for one reason or another, and random_ref() hadn't been called first. check-in: fbcd95cbc9 user: simon tags: trunk | |
|
2014-01-15
| ||
| 17:57 | It's a new year. check-in: be67deef94 user: jacob tags: trunk | |
| 17:46 | Remove mention of ASCIICTLS. It hasn't done anything since r673 in 2000. check-in: 6b47391217 user: jacob tags: trunk | |
|
2014-01-11
| ||
| 05:23 | Generate IDE project files for Visual Studio 2010 and 2012. Thanks to Mike Edenfield for the initial version of this patch; I've polished it up a bit (in particular inventing a more overengineered GUID generation strategy) but most of it is his. check-in: bf25c6f428 user: simon tags: trunk | |
|
2014-01-09
| ||
| 03:42 | More work towards smartcard support Leaf check-in: fdc3acb4a7 user: rkeene tags: smartcard | |
|
2014-01-07
| ||
| 17:26 | Rename the handle-type enumeration values. Mike Edenfield points out that modern versions of the Windows SDK have decided that 'INPUT' is a sensible name for an OS data structure (sigh), and provided a patch to add a disambiguating prefix to winhandl.c's enum values INPUT, OUTPUT and FOREIGN. check-in: c4c02ad9d3 user: simon tags: trunk | |
| 06:21 | More work towards adding Smartcard support check-in: ac99fad22c user: rkeene tags: smartcard | |
| 05:30 | Stubbed out module loading check-in: ddd30aa4a3 user: rkeene tags: smartcard | |
| 05:13 | Corrected issues with copying in the provider/pin check-in: cd84c88205 user: rkeene tags: smartcard | |
| 05:09 | Merged in Cygwin fixes check-in: fdef7bc4c1 user: rkeene tags: smartcard | |
| 05:08 | Updated to always indicate that PROPERTYKEY is defined in Cygwin/Mingw32 Leaf check-in: c10746d902 user: rkeene tags: new-cygwin-fixes | |
| 05:03 | Corrected issue with HIGH_SURROGATE_START being undefined in some cases check-in: 2483280575 user: rkeene tags: new-cygwin-fixes | |
| 05:01 | Fixed INPUT conflict with tagINPUT in winuser.h check-in: a588f6596d user: rkeene tags: new-cygwin-fixes | |
| 04:59 | Removed "-mno-cygwin" as it is no longer used in mingw32 check-in: 7d5a75bea0 user: rkeene tags: new-cygwin-fixes | |
| 04:57 | Create new branch named "new-cygwin-fixes" check-in: 697fe1728c user: rkeene tags: new-cygwin-fixes | |
| 04:56 | Start of work on adding smartcard support check-in: 0f7cb20b46 user: rkeene tags: smartcard | |
| 00:10 | Create new branch named "smartcard" check-in: 9be29e78b7 user: rkeene tags: smartcard | |
|
2013-12-02
| ||
| 13:27 | Include another autoconf dropping in svn:ignore. check-in: 19507fbbd4 user: simon tags: trunk | |
| 13:26 | Fix breakage of SSH-2 packet decompression by r10070. The line that resets st->pktin->length to cover only the semantic payload of the SSH message was overwriting the modification to st->pktin->length performed by the optional decompression step. I didn't notice because I don't habitually enable compression. check-in: bcffebc70c user: simon tags: trunk | |
|
2013-12-01
| ||
| 12:02 | Use printf rather than echo to generate \versionid. (Sacrificing the ability to build PuTTY docs from Halibut source on SunOS 4, apparently, but I expect we'll live.) check-in: 4468ef8629 user: jacob tags: trunk | |
|
2013-11-30
| ||
| 14:01 | Document the 'bold black' hazard of bold-as-font. check-in: 4c056f3084 user: jacob tags: trunk | |
| 12:04 | Make GTK idle and quit function setup idempotent. I found last week that when a local proxy process terminated unexpectedly, Unix PuTTY went into a tight loop calling quit functions, because if idle_toplevel_callback_func is called from inside a subsidiary gtk_main then it will schedule a quit function and _not_ disable itself, so that that quit function keeps being rescheduled on subsequent calls. To fix, I've tried to make the whole handling of idle and quit functions more sensibly robust: we keep our own boolean flag indicating whether each of our functions has already been scheduled with GTK, and if so, we don't schedule the same one again. Also, when idle_toplevel_callback_func schedules a quit function, it should unschedule itself since it's now done everything it can until a gtk_main instance quits. check-in: f92a403fe9 user: simon tags: trunk | |
|
2013-11-25
| ||
| 13:46 | Fix interaction of insch() with selection highlights. Previously I had unthinkingly called the general-purpose check_selection() routine to indicate that I was going to mess with n character cells right of the cursor position, causing the selection highlight to be removed if it intersected that region. This is all wrong, since actually the whole region from cursor to EOL is modified by any character insertion or deletion, so if we were going to call check_selection it should be on that whole region. (Quick demo: select part of the line to the right of the cursor, then emit ESC[P or ESC[@ and see the text move left or right while the highlight stays put.) So we could just call check_selection() on that larger affected region, and that would be correct. However, we can do something slightly more elegant in the case where the selection is contained entirely within the subregion that moves to one side (as opposed to the characters that actually vanish at one or other end): we can move the selection highlight with the text under it, to preserve the visual reminder of which text was selected for as long as possible. check-in: 8850239d61 user: simon tags: trunk | |
| 12:35 | Switch to using SIDs in make_private_security_descriptor(). Daniel Meidlinger reports that at least one Windows machine which is not obviously otherwise misconfigured will respond to our SetEntriesInAcl call with odd errors like ERROR_NONE_MAPPED or ERROR_TRUSTED_RELATIONSHIP_FAILURE. This is apparently to do with failure to convert the names "EVERYONE" and "CURRENT_USER" used in the ACL specification to SIDs. (Or perhaps only one of them is the problem - I didn't investigate in that direction.) If we instead construct a fully SID-based ACL, using the well-known world SID in place of EVERYONE and calling our existing get_user_sid routine in place of CURRENT_USER, he reports that the problem goes away, so let's do that instead. While I'm here, I've slightly simplified the function prototype of make_private_security_descriptor(), by turning 'networksid' into an internal static that we can reuse in subsequent calls once we've set it up. (Mostly because I didn't fancy adding another two pointless parameters at every call site for the two new SIDs.) check-in: 349ccaac0a user: simon tags: trunk | |
|
2013-11-23
| ||
| 10:54 | Remove an unused variable orphaned by r10092. check-in: 837e4c1632 user: simon tags: trunk | |
|
2013-11-22
| ||
| 13:41 | SetEntriesInAcl returns its error code directly. According to the MSDN documentation, that is. Why oh why? Everything _else_ leaves it in GetLastError(). check-in: acd593e0ad user: simon tags: trunk | |
| 13:41 | Pass the right number of entries to SetEntriesInAcl! check-in: 074d8b4052 user: simon tags: trunk | |
| 13:41 | Include the numeric error code in win_strerror's output. This will be useful if someone gets a mysterious Windows error on a system configured into a language we don't speak - if they cut and paste the error message to send to us, then we won't have to try to translate it. check-in: e00724f199 user: simon tags: trunk | |
|
2013-11-18
| ||
| 16:34 | Fix up the Windows help context stuff for the new connection sharing controls. check-in: 5d4d60ef11 user: jacob tags: trunk | |
| 13:07 | Gracefully degrade in the absence of CryptProtectMemory. XP doesn't have it, and I think having connection sharing work without its privacy enhancement is better than having it not work at all. check-in: e5114b37b0 user: simon tags: trunk | |
| 13:07 | Restore compatibility with older autoconfs. The one in Ubuntu 10.04 doesn't know what AM_PROG_AR means, so configure.ac was broken in r10053 when fixing compatibility with later versions; you can't win... check-in: 72ed2c889b user: simon tags: trunk | |
|
2013-11-17
| ||
| 08:05 | Fix an assortment of dupprintf() format string bugs. I've enabled gcc's format-string checking on dupprintf, by declaring it in misc.h to have the appropriate GNU-specific attribute. This pointed out a selection of warnings, which I've fixed. check-in: 44f33ce7e0 user: simon tags: trunk | |
| 08:05 | Implement connection sharing between instances of PuTTY. The basic strategy is described at the top of the new source file sshshare.c. In very brief: an 'upstream' PuTTY opens a Unix-domain socket or Windows named pipe, and listens for connections from other PuTTYs wanting to run sessions on the same server. The protocol spoken down that socket/pipe is essentially the bare ssh-connection protocol, using a trivial binary packet protocol with no encryption, and the upstream has to do some fiddly transformations that I've been referring to as 'channel-number NAT' to avoid resource clashes between the sessions it's managing. This is quite different from OpenSSH's approach of using the Unix- domain socket as a means of passing file descriptors around; the main reason for that is that fd-passing is Unix-specific but this system has to work on Windows too. However, there are additional advantages, such as making it easy for each downstream PuTTY to run its own independent set of port and X11 forwardings (though the method for making the latter work is quite painful). Sharing is off by default, but configuration is intended to be very easy in the normal case - just tick one box in the SSH config panel and everything else happens automatically. check-in: 998dfad436 user: simon tags: trunk | |
| 08:05 | Move the dynamic loading of advapi into its own module. There's now a winsecur.[ch], which centralises helper functions using the Windows security stuff in advapi.h (currently just get_user_sid), and also centralises the run-time loading of those functions and checking they're all there. check-in: fea133a5df user: simon tags: trunk | |
| 08:05 | Get rid of the error-return mechanism from x11_init. Now that it doesn't actually make a network connection because that's deferred until after the X authorisation exchange, there's no point in having it return an error message and write the real output through a pointer argument. Instead, we can just have it return xconn directly and simplify the call sites. check-in: 73c26030cf user: simon tags: trunk | |
| 08:05 | Refactor the construction of X protocol greetings. I've moved it out into a separate function, preparatory to calling it from somewhere completely different in changes to come. Also, we now retain the peer address sent from the SSH server in string form, rather than translating it immediately into a numeric IP address, so that its original form will be available later to pass on elsewhere. check-in: 6ce24b09de user: simon tags: trunk | |
| 08:05 | Prepare to have multiple X11 auth cookies valid at once. Rather than the top-level component of X forwarding being an X11Display structure which owns some auth data, it's now a collection of X11FakeAuth structures, each of which owns a display. The idea is that when we receive an X connection, we wait to see which of our available auth cookies it matches, and then connect to whatever X display that auth cookie identifies. At present the tree will only have one thing in it; this is all groundwork for later changes. check-in: dce51d4dc0 user: simon tags: trunk | |
| 08:05 | Decouple X socket opening from x11_init(). Now we wait to open the socket to the X server until we've seen the authorisation data. This prepares us to do something else with the channel if we see different auth data, which will come up in connection sharing. check-in: 17981b3538 user: simon tags: trunk | |
| 08:05 | Add missing 'const' in the des_*_xdmauth functions. check-in: d5d9fea99c user: simon tags: trunk | |
| 08:04 | Add a missing null pointer check in s_write. I don't know that this can ever be triggered in the current state of the code, but when I start mucking around with SSH session closing in the near future, it may be handy to have it. check-in: 4e49a3898d user: simon tags: trunk | |
| 08:04 | Remove sk_{get,set}_private_ptr completely! It was only actually used in X11 and port forwarding, to find internal state structures given only the Socket that ssh.c held. So now that that lookup has been reworked to be the sensible way round, private_ptr is no longer used for anything and can be removed. check-in: 19677e577d user: simon tags: trunk | |
| 08:04 | Refactor ssh.c's APIs to x11fwd.c and portfwd.c. The most important change is that, where previously ssh.c held the Socket pointer for each X11 and port forwarding, and the support modules would find their internal state structure by calling sk_get_private_ptr on that Socket, it's now the other way round. ssh.c now directly holds the internal state structure pointer for each forwarding, and when the support module needs the Socket it looks it up in a field of that. This will come in handy when I decouple socket creation from logical forwarding setup, so that X forwardings can delay actually opening a connection to an X server until they look at the authentication data and see which server it has to be. However, while I'm here, I've also taken the opportunity to clean up a few other points, notably error message handling, and also the fact that the same kind of state structure was used for both connection-type and listening-type port forwardings. Now there are separate PortForwarding and PortListener structure types, which seems far more sensible. check-in: 7ab21bb146 user: simon tags: trunk | |
| 08:04 | Reliably initialise uxnet's socket fd fields to -1. This prevents embarrassing mess-ups involving getting back a Socket which has mostly been memset to 0 but contains an error message, sk_close()ing it to free the memory, and finding that standard input has been closed as a side effect. check-in: 3f38d36d6e user: simon tags: trunk | |
| 08:04 | Add support in uxnet.c for Unix-domain listening sockets. There are two new functions: one to construct a SockAddr wrapping a Unix socket pathname (which can also be used as the destination for new_connection), and one to establish a new listening Unix-domain socket. check-in: fe289d405b user: simon tags: trunk | |
| 08:04 | Complete rewrite of the packet log censoring code. Because the upcoming connection sharing changes are going to involve us emitting outgoing SSH packets into our log file that we didn't construct ourselves, we can no longer rely on metadata inserted at packet construction time to tell us which parts of which packets have to be blanked or omitted in the SSH packet log. Instead, we now have functions that deal with constructing the blanks array just before passing all kinds of packet (both SSH-1 and SSH-2, incoming and outgoing) to logging.c; the blanks/nblanks fields in struct Packet are therefore no longer needed. check-in: 88f08b9cb9 user: simon tags: trunk | |
| 08:04 | Clean up the 'data' vs 'body' pointers in struct Packet. There's always been some confusion over exactly what it all means. I haven't cleaned it up to the point of complete sensibleness, but I've got it to a point where I can at least understand and document the remaining non-sensibleness. check-in: c011fa97b1 user: simon tags: trunk | |
| 08:04 | Add support for Windows named pipes. This commit adds two new support modules, winnpc.c and winnps.c, which deal respectively with being a client and server of a Windows named pipe (which, in spite of what Unix programmers will infer from that name, is actually closer to Windows's analogue of a Unix-domain socket). Each one provides a fully featured Socket wrapper around the hairy Windows named pipe API, so that the rest of the code base should be able to use these interchangeably with ordinary sockets and hardly notice the difference. As part of this work, I've introduced a mechanism in winhandl.c to permit it to store handles of event objects on behalf of other Windows support modules and deal with passing them to applications' main event loops as necessary. (Perhaps it would have been cleaner to split winhandl.c into an event-object tracking layer analogous to uxsel, and the handle management which is winhandl.c's proper job, but this is less disruptive for the present.) check-in: 8ceffb2b33 user: simon tags: trunk | |
| 08:03 | Replace the hacky 'OSSocket' type with a closure. The mechanism for constructing a new connection-type Socket when a listening one receives an incoming connection previously worked by passing a platform-specific 'OSSocket' type to the plug_accepting function, which would then call sk_register to wrap it with a proper Socket instance. This is less flexible than ideal, because it presumes that only one kind of OS object might ever need to be turned into a Socket. So I've replaced OSSocket throughout the code base with a pair of parameters consisting of a function pointer and a context such that passing the latter to the former returns the appropriate Socket; this will permit different classes of listening Socket to pass different function pointers. In deference to the reality that OSSockets tend to be small integers or pointer-sized OS handles, I've made the context parameter an int/pointer union that can hold either of those directly, rather than the usual approach of making it a plain 'void *' and requiring a context structure to be dynamically allocated every time. check-in: c7d41826aa user: simon tags: trunk | |
| 08:03 | Implement freezing on Windows handle sockets. That's been a FIXME in the code for ages, because it's difficult to get winhandl.c to stop an already-started read from a handle (since the read is a blocking system call running in a separate thread). But I now realise it isn't absolutely necessary to do so - you can just buffer one lot of data from winhandl and _then_ tell it to stop. check-in: 2fcad446d4 user: simon tags: trunk | |
| 08:03 | Factor out the HANDLE-to-Socket adapter from winproxy.c. It's now kept in a separate module, where it can be reused conveniently for other kinds of Windows HANDLE that I want to wrap in the PuTTY Socket abstraction - for example, the named pipes that I shortly plan to use for the Windows side of connection-sharing IPC. check-in: b85c096215 user: simon tags: trunk | |
| 08:03 | Add a Socket implementation which just holds an error message. This isn't yet used, but I plan to use it in situations where you have to report errors by returning a valid Socket on which the client wlil call sk_socket_error, but in fact you notice the error _before_ instantiating your usual kind of Socket. The resulting Socket is usable for nothing except reading out the error string and closing it. check-in: 20d72c8bd1 user: simon tags: trunk | |
| 08:03 | Move SSH protocol enumerations out into ssh.h. This permits packet type codes and other magic numbers to be accessed from modules other than ssh.c. check-in: 71d87820cd user: simon tags: trunk | |
| 08:03 | Move cipher settings into their own config panel. This makes room in the main SSH panel for new options about connection sharing, which I'm shortly going to add. check-in: 5a25ae6602 user: simon tags: trunk | |
| 08:03 | Clean up the semantics of the ssh_rportfwd structure. It's now indexed by source hostname as well as source port (so that separate requests for the server to listen on addr1:1234 and addr2:1234 can be disambiguated), and also its destination host name is dynamically allocated rather than a fixed-size buffer. check-in: 87da2eda2d user: simon tags: trunk | |
| 08:03 | Find ToUnicodeEx() at run time, not load time. This restores PuTTY's backward compatibility to versions of Windows too old to have ToUnicodeEx in their system libraries, which was accidentally broken in 0.63. check-in: f163f89666 user: simon tags: trunk | |
|
2013-11-11
| ||
| 17:01 | Replace GetQueueStatus with PeekMessage(PM_NOREMOVE). A couple of users report that my recent reworking of the Windows top-level message loop has led to messages occasionally being lost, and MsgWaitForMultipleObjects blocking when it ought to have been called with a zero timeout. I haven't been able to reproduce this myself, but according to one reporter, PeekMessage(PM_NOREMOVE) is effective at checking for a non-empty message queue in a way that GetQueueStatus is not. Switch to using that instead. Thanks to Eric Flumerfelt for debugging and testing help. check-in: 0eada414dc user: simon tags: trunk | |
|
2013-10-26
| ||
| 09:00 | Fix build failures on Ubuntu 13.10. Automake now insists that we run AM_PROG_AR if we're going to build a library, and AM_PROG_CC_C_O if we're going to build anything with extra compile options. Those extra macros seem harmless in previous versions of automake. check-in: 4dc573c397 user: simon tags: trunk | |
|
2013-10-25
| ||
| 12:44 | Avoid leaving unread Windows messages in the queue. Jochen Erwied points out that once you've used PeekMessage to remove _one_ message from the message queue, MsgWaitForMultipleObjects will consider the whole queue to have been 'read', or at least looked at and deemed uninteresting, and so it will block until a further message comes in. Hence, my change in r10040 which stops us from looping on PeekMessage until the queue is empty has the effect of causing the rest of the message queue not to be acted on until a new message comes in to unblock it. Fix by checking if the queue is nonempty in advance of calling MsgWaitForMultipleObjects, and if so, giving it a zero timeout just as we do if there's a pending toplevel callback. check-in: bb372d7013 user: simon tags: trunk | |
|
2013-10-09
| ||
| 13:38 | random_ref() should always increment the reference count. No current PuTTY utility was calling random_ref more than once per run (ssh.c and the two main PuTTYgen programs call it once each), but if one ever does (or if derived code does), it will want the reference count to actually work sensibly. check-in: 8a375b13f8 user: simon tags: trunk | |
| 13:36 | Don't pass WinSock error codes to strerror. Martin Prikryl helpfully points out that when I revamped the socket error mechanism using toplevel callbacks, I also accidentally passed the error code to the wrong function. Use winsock_error_string instead. check-in: b4dcae4371 user: simon tags: trunk | |
|
2013-09-23
| ||
| 09:35 | Fix cut-and-paste errors in nonfatal() implementations. Unix GUI programs should not say 'Fatal Error' in the message box title, and Plink should not destroy its logging context as a side effect of printing a non-fatal error. Both appear to have been due to inattentive cut and paste from the pre-existing fatal error functions. check-in: 3a81deedf0 user: simon tags: trunk | |
|
2013-09-15
| ||
| 09:40 | Oops! Remove a tight-looping diagnostic. I temporarily applied it as a means of testing the revised event loops in r10040, and accidentally folded it into my final commit instead of backing it out. Ahem. check-in: 5bed7cc5ee user: simon tags: trunk | |
| 09:05 | Remove the timed part of the terminal paste mechanism. In r10020 I carefully reimplemented using timing.c and callback.c the same policy for large pastes that the previous code appeared to be implementing ad-hoc, which included a 450ms delay between sending successive lines of pasted text if no visible acknowledgment of the just-sent line (in the form of a \n or \r) came back from the application. However, it turns out that that *wasn't* what the old code was doing. It *would* have done that, but for the bug that it never actually set the 'last_paste' variable, and never has done since it was first introduced way back in r516! So the policy I thought had been in force forever has in fact only been in force since I unwittingly fixed that bug in r10020 - and it turns out to be a bad idea, breaking pastes into vi in particular. So I've removed the timed paste code completely, on the basis that it's never actually worked and nobody seems to have been unhappy about that. Now we still break large pastes into separate lines and send them in successive top-level callbacks, and the user can still press a key to interrupt a paste if they manage to catch it still going on, but there's no attempted *delay* any more. (It's possible that what I *really* ought to be doing is calling back->sendbuffer() to see whether the backend is consuming the data pasted so far, and if not, deferring the rest of the paste until the send buffer becomes smaller. Then we could have pasting be delayed by back-pressure from the recipient, and still manually interruptible during that delay, but not have it delayed by anything else. But what we have here should at least manage to be equivalent to the *actual* rather than the intended old policy.) check-in: 926b4f918a user: simon tags: trunk | |
| 09:05 | Only run one toplevel callback per event loop iteration. This change attempts to reinstate as a universal property something which was sporadically true of the ad-hockery that came before toplevel callbacks: that if there's a _very long_ queue of things to be done through the callback mechanism, the doing of them will be interleaved with re-checks of other event sources, which might (e.g.) cause a flag to be set which makes the next callback decide not to do anything after all. check-in: 36d3c24f08 user: simon tags: trunk | |
|
2013-09-08
| ||
| 08:20 | Handle socket errors on half-open channels. Anthony Ho reports that this can occur naturally in some situation involving Windows 8 + IE 11 and dynamic port forwarding: apparently we get through the SOCKS negotiation, send our CHANNEL_OPEN, and then *immediately* suffer a local WSAECONNABORTED error before the server has sent back its OPEN_CONFIRMATION or OPEN_FAILURE. In this situation ssh2_channel_check_close was failing to notice that the channel didn't yet have a valid server id, and sending out a CHANNEL_CLOSE anyway containing 32 bits of uninitialised nonsense. We now handle this by turning our half-open CHAN_SOCKDATA_DORMANT into a half-open CHAN_ZOMBIE, which means in turn that our handler functions for OPEN_CONFIRMATION and OPEN_FAILURE have to recognise and handle that case, the former by immediately initiating channel closure once we _do_ have the channel's server id to do it with. check-in: 1593971ebd user: simon tags: trunk | |
| 02:14 | Pass an error message through to sshfwd_unclean_close. We have access to one at every call site, so there's really no reason not to send it through to ssh.c to be logged. check-in: 36349ac57c user: simon tags: trunk | |
|
2013-09-07
| ||
| 11:15 | Fix SSH2_MSG_CHANNEL_EXTENDED_DATA in logparse. It looks as if it's never worked at all: it had a spurious second printf, it completely forgot to allow for the uint32 type code that SSH2_MSG_CHANNEL_DATA doesn't have, it accessed the channel state's sequence number fields in a way that made no sense and didn't match the rest of the program, *and* it misinvoked the file opening API. I must have never had an occasion to test it. check-in: a938a3ac2e user: simon tags: trunk | |
| 11:15 | Make logparse handle completely bogus channel numbers. Previously it would throw a bunch of Perl undefined-variable-usage warnings; now it cleanly detects the problem, dumps as much of the message as it still reasonably can, and doesn't update any channel states. check-in: 21376cee1b user: simon tags: trunk | |
|
2013-08-26
| ||
| 06:55 | Fix free of an uninitialised pointer. CHAN_AGENT channels need c->u.a.message to be either NULL or valid dynamically allocated memory, because it'll be freed by ssh_channel_destroy. This bug triggers if an agent forwarding channel is opened and closed without having sent any queries. check-in: 7b9042322c user: simon tags: trunk | |
|
2013-08-22
| ||
| 12:45 | Fix handling of IPv6 dynamic forwardings. During the Conf revamp, I changed the internal representation of dynamic forwardings so that they were stored as the conceptually sensible L12345=D rather than the old D12345, and added compensation code to translate to the latter form for backwards-compatible data storage and for OpenSSH-harmonised GUI display. Unfortunately I forgot that keys in the forwarding data can also prefix the L/R with a character indicating IPv4/IPv6, and my translations didn't take account of that possibility. Fix them. check-in: 2ca638ec2c user: simon tags: trunk | |
|
2013-08-18
| ||
| 05:56 | Don't run toplevel callbacks in modal dialogs. Because some of them can call gtk_main_quit(), which completely confuses the dialog box system. check-in: d89571a733 user: simon tags: trunk | |
| 01:48 | Sensibly enforce non-interactive rekeying. We now only present the full set of host key algorithms we can handle in the first key exchange. In subsequent rekeys, we present only the host key algorithm that we agreed on the previous time, and then we verify the host key by simply enforcing that it's exactly the same as the one we saw at first and disconnecting rudely if it isn't. check-in: cb5323bd7c user: simon tags: trunk | |
|
2013-08-17
| ||
| 11:06 | Make calling term_nopaste() a cross-platform feature. It was one of those things that went in ages ago on Windows and never got replicated in the Unix front end. And it needn't be: ldisc.c is a perfect place to put it, since it knows which of the data it's sending is based on a keystroke and which is automatically generated, and it also has access to the terminal context. So now a keypress can interrupt a runaway paste on all platforms. check-in: 98e29c499b user: simon tags: trunk | |
| 11:06 | Revamp Windows pending_netevent using toplevel callbacks. This greatly simplifies the process of calling select_result() from the top level after receiving WM_NETEVENT. check-in: c50a760764 user: simon tags: trunk | |
| 11:06 | Revamp net_pending_errors using toplevel callbacks. Again, I've removed the special-purpose ad-hockery from the assorted front end message loops that dealt with deferred handling of socket errors, and instead uxnet.c and winnet.c arrange that for themselves by calling the new general top-level callback mechanism. check-in: 441fc5a4dd user: simon tags: trunk | |
| 11:06 | Revamp GTK's session close handling using toplevel callbacks. Instead of having a special GTK idle function for dealing with session closing, I now use the new top-level callback mechanism which is slightly simpler for calling a one-off function. Also in this commit, I've arranged for connection_fatal to queue a call to the same session close function after displaying the message box, with the effect that now all the same processing takes place no matter whether the session closes cleanly or uncleanly - e.g. the SSH specials submenu is cleaned out, as it should be. check-in: 030eccd1a1 user: simon tags: trunk | |
| 11:06 | Revamp Windows's close_session() using toplevel callbacks. Instead of setting a must_close_session flag and having special code in the message loop to check it, we'll schedule the call to close_session using the new top-level callback system. check-in: f66bde9fae user: simon tags: trunk | |
| 11:06 | Revamp the terminal paste mechanism using toplevel callbacks. I've removed the ad-hoc front-end bodgery in the Windows and GTK ports to arrange for term_paste to be called at the right moments, and instead, terminal.c itself deals with knowing when to send the next chunk of pasted data using a combination of timers and the new top-level callback mechanism. As a happy side effect, it's now all in one place so I can actually understand what it's doing! It turns out that what all that confusing code was up to is: send a line of pasted data, and delay sending the next line until either a CR or LF is returned from the server (typically indicating that the pasted text has been received and echoed) or 450ms elapse, whichever comes first. check-in: e18f3877ae user: simon tags: trunk | |
| 11:06 | Add a general way to request an immediate top-level callback. This is a little like schedule_timer, in that the callback you provide will be run from the top-level message loop of whatever application you're in; but unlike the timer mechanism, it will happen _immediately_. The aim is to provide a general way to avoid re-entrance of code, in cases where just _doing_ the thing you want done is liable to trigger a confusing recursive call to the function in which you came to the decision to do it; instead, you just request a top-level callback at the message loop's earliest convenience, and do it then. check-in: 0345763d47 user: simon tags: trunk | |
|
2013-08-15
| ||
| 01:42 | Sebastian Kuschel reports that pfd_closing can be called for a socket error with pr->c NULL, in which case calling sshfwd_unclean_close on it will dereference NULL and segfault. Write an alternative error handling path for that possibility. (I don't know if it's the only way, but one way this can happen is if you're doing dynamic forwarding and the socket error occurs during SOCKS negotiation, in which case no SSH channel has been set up yet because we haven't yet found out what we want to put in the direct-tcpip channel open message.) check-in: 88d8a274b3 user: simon tags: trunk | |
|
2013-08-13
| ||
| 01:46 | It turns out I was a little over-strict in my handling of EOF in pscp.c when I did the big revamp in r9279: I assumed that in any SCP connection we would be the first to send EOF, but in fact this isn't true - doing downloads with old-SCP, EOF is initiated by the server, so we were spuriously reporting an error for 'unexpected' EOF when everything had gone fine. Thanks to Nathan Phelan for the report. check-in: dbbbe4df65 user: simon tags: trunk | |
|
2013-08-08
| ||
| 12:22 | sbcsgen.pl uses 'select' to point Perl at a different default output handle. Revert that when we hackily call it from mkfiles.pl, so that if I have a need to insert diagnostics in the latter they won't go into the end of sbcsdat.c. check-in: 7c257e8f47 user: simon tags: trunk | |
|
2013-08-07
| ||
| 01:22 | Revert the default for font bolding style back to using colours rather than fonts. I broke this in r9559 when I added the option for 'both', because the internal representation got offset by one so as to change from a boolean to two bitfields and I must have confused myself about what the default should be. check-in: 31522c3eb3 user: simon tags: trunk | |
|
2013-08-06
| ||
| 12:09 | Bump version number prior to tagging 0.63. check-in: ff340ac572 user: simon tags: trunk | |
| 11:45 | One more defensive assert, just to be sure. check-in: d6125310dc user: simon tags: trunk | |
|
2013-08-05
| ||
| 14:50 | The bignum code has two representations of zero, since bn_restore_invariant (and the many loops that duplicate it) leaves a single zero word in a bignum representing 0, whereas the constant 'Zero' does not have any data words at all. Cope with this in bignum_cmp. (It would be a better plan to decide on one representation and stick with it, but this is the less disruptive fix for the moment.) check-in: 87e71d1709 user: simon tags: trunk | |
| 14:50 | Add some more precautionary assertions, just in case anything wildly out of range manages to get past other recent fixes. check-in: 165e9c6988 user: simon tags: trunk | |
| 10:15 | Belatedly update the copyright year to 2013. check-in: f12ca7dab6 user: jacob tags: trunk | |
|
2013-08-04
| ||
| 17:33 | Fix memory leaks in the new error return from modinv. check-in: 831e4c58e8 user: simon tags: trunk | |
| 14:34 | Spot when we didn't successfully create an RSA public key from a public blob, and return a proper error in that situation rather than a struct with unhelpful NULLs in. check-in: 6f71c3af5a user: simon tags: trunk | |
| 14:34 | Make modinv able to return NULL if its inputs are not coprime, and check for that return value everywhere it is used. check-in: 81126a7cf8 user: simon tags: trunk | |
| 14:34 | Avoid trying to take the modular inverse of zero in response to a sufficiently silly DSA signature. check-in: ea82957c5a user: simon tags: trunk | |
| 14:33 | Another couple of memory leaks. check-in: e901ff1b64 user: simon tags: trunk | |
| 14:33 | More consistently defend against division by zero with assertions. We now check that all the modular functions (modpow, modinv, modmul, bigdivmod) have nonzero moduli, and that modinv also has a nonzero thing to try to invert. check-in: 1d79e0227d user: simon tags: trunk | |
| 14:33 | Validate newly created DSA keys more carefully. Don't want a structure half-filled with null pointers. check-in: c783761d06 user: simon tags: trunk | |
| 14:33 | Remove some redundant null-pointer checks from code that must have been written before I wrote a never-failing snew. check-in: ee86c225d3 user: simon tags: trunk | |
| 14:33 | Sanitise freeing of DSA keys. check-in: ff56f110f0 user: simon tags: trunk | |
| 14:32 | Reinstate a piece of code accidentally removed in r9214, where Windows PuTTY does not trim a colon suffix off the hostname if it contains _more than one_ colon. This allows IPv6 literals to be entered. (Really we need to do a much bigger revamp of all uses of hostnames to arrange that square-bracketed IPv6 literals work consistently, but this at least removes a regression over 0.62.) check-in: 6a08410fec user: simon tags: trunk | |
|
2013-08-02
| ||
| 17:33 | Raise the default scrollback from 200 to 2000 lines. The former was not so silly in the 1990s and before I implemented scrollback compression, but it's been a ridiculously low default for a while now. check-in: 9dde867cfc user: simon tags: trunk | |
| 14:51 | Found a lot of places in sshbn.c where for-loops zeroing out memory just before freeing it really ought to be smemclrs. check-in: 911c0d2c25 user: simon tags: trunk | |
| 01:28 | Verify RSA keys created by rsa2_openssh_createkey. check-in: d3496c3c83 user: simon tags: trunk | |
| 01:28 | Replace some 'sfree' calls of bignums with the proper 'freebn'. check-in: 1dd02ecbaf user: simon tags: trunk | |
| 01:27 | Add some missing bounds checks in signature verification routines. check-in: 0b92b855f5 user: simon tags: trunk | |
| 01:27 | Fix an array-size bug in modmul, and add some tests for it. check-in: 9061bc28f3 user: simon tags: trunk | |
|
2013-07-29
| ||
| 12:47 | Remove one of the frees added in r9916. stat_name points to somewhere within the same string that destfname points to the start of, so freeing it causes at best a double-free of destfname and more likely a free of something that isn't even the start of an allocated block. check-in: f6693a7219 user: simon tags: trunk | |
|
2013-07-27
| ||
| 13:35 | Add an assortment of missing consts I've just noticed. check-in: 9388e0e1ae user: simon tags: trunk | |
|
2013-07-24
| ||
| 14:18 | Get rid of the variable 'advapi' in Pageant's WinMain, which was never actually used for anything sensible and could have been freed while containing nonsense at program end. check-in: 216d70f276 user: simon tags: trunk | |
|
2013-07-22
| ||
| 14:56 | Back out r9964. I wasn't paying attention: every control is in the byid tree but not all of them are in the byctrl tree. check-in: 3eb328f003 user: simon tags: trunk | |
| 02:12 | Replace the type-checking COMPTR macro with my current idea of best practice in type-check macros. check-in: 6231caddfe user: simon tags: trunk | |
| 02:12 | Add missing casts in arguments to ctype functions. check-in: 2ca4f7724b user: simon tags: trunk | |
| 02:12 | Rationalise null pointer checks in both decode_codepage functions, so that decode_codepage(NULL) and decode_codepage("") both return the default character set. check-in: 52a52f87c4 user: simon tags: trunk | |
| 02:11 | Fix a double error handling goof in the winstore side of the jump list support: transform_jumplist_registry should give its caller dynamically allocated data if and only if it returns JUMPLISTREG_OK, and get_jumplist_registry_entries should test the return value against JUMPLISTREG_OK rather than a value from a totally different enum. check-in: 4308431bba user: simon tags: trunk | |
| 02:11 | Another big batch of memory leak fixes, again mostly on error paths. The most interesting one is printer_add_enum, which I've modified to take a char ** rather than a char * so that it can both realloc its input buffer _and_ return NULL to indicate error. check-in: c3f3ee12f4 user: simon tags: trunk | |