Commit Graph

801 Commits

Author SHA1 Message Date
Simon L. B. Nielsen
ac7fbc6abd Readd $FreeBSD$ to the OpenSSL config file as that's useful for
mergemaster.

Suggested by:	dougb
2010-03-13 22:37:07 +00:00
Simon L. B. Nielsen
6a599222bb Merge OpenSSL 0.9.8m into head.
This also "reverts" some FreeBSD local changes so we should now
be back to using entirely stock OpenSSL.  The local changes were
simple $FreeBSD$ lines additions, which were required in the CVS
days, and the patch for FreeBSD-SA-09:15.ssl which has been
superseded with OpenSSL 0.9.8m's RFC5746 'TLS renegotiation
extension' support.

MFC after:	3 weeks
2010-03-13 19:22:41 +00:00
Dag-Erling Smørgrav
b15c83408c Upgrade to OpenSSH 5.4p1.
MFC after:	1 month
2010-03-09 19:16:43 +00:00
Simon L. B. Nielsen
f7a1b4761c Import OpenSSL 0.9.8m. 2010-02-28 18:49:43 +00:00
Ed Schouten
9567147bea Add a missing $FreeBSD$ string.
I was requested to add this string to any file that was modified by my
commit, which I forgot to do so.

Requested by:	des
2010-01-13 20:30:16 +00:00
Ed Schouten
b40cdde64c Make OpenSSH work with utmpx.
- Partially revert r184122 (sshd.c). Our ut_host is now big enough to
  fit proper hostnames.

- Change config.h to match reality.

- defines.h requires UTMPX_FILE to be set by <utmpx.h> before it allows
  the utmpx code to work. This makes no sense to me. I've already
  mentioned this upstream.

- Add our own platform-specific handling of lastlog. The version I will
  send to the OpenSSH folks will use proper autoconf generated
  definitions instead of `#if 1'.
2010-01-13 18:43:32 +00:00
Brooks Davis
2f70892f19 The size of credential messages is limited by CMGROUP_MAX rather than
NGROUPS.

MFC after:	1 week
2010-01-03 20:45:49 +00:00
Colin Percival
a235643007 Disable SSL renegotiation in order to protect against a serious
protocol flaw. [09:15]

Correctly handle failures from unsetenv resulting from a corrupt
environment in rtld-elf. [09:16]

Fix permissions in freebsd-update in order to prevent leakage of
sensitive files. [09:17]

Approved by:	so (cperciva)
Security:	FreeBSD-SA-09:15.ssl
Security:	FreeBSD-SA-09:16.rtld
Security:	FreeBSD-SA-09:17.freebsd-udpate
2009-12-03 09:18:40 +00:00
Attilio Rao
7a7043c787 Avoid sshd, cron, syslogd and inetd to be killed under high-pressure swap
environments.
Please note that this can't be done while such processes run in jails.

Note: in future it would be interesting to find a way to do that
selectively for any desired proccess (choosen by user himself), probabilly
via a ptrace interface or whatever.

Obtained from:	Sandvine Incorporated
Reviewed by:	emaste, arch@
Sponsored by:	Sandvine Incorporated
MFC:		1 month
2009-11-25 15:12:24 +00:00
Dag-Erling Smørgrav
0c56c384d6 Fix globbing
Noticed by:	delphij, David Cornejo <dave@dogwood.com>
Forgotten by:	des
2009-11-10 09:45:43 +00:00
Dag-Erling Smørgrav
5972f81bbe Remove dupe. 2009-10-11 14:27:33 +00:00
Dag-Erling Smørgrav
e21bf2c43b Add more symbols that need to be masked:
- initialized and uninitialized data
 - symbols from roaming_dummy.c which end up in pam_ssh

Update the command line used to generate the #defines.
2009-10-05 18:55:13 +00:00
Dag-Erling Smørgrav
7aee6ffee0 Upgrade to OpenSSH 5.3p1. 2009-10-01 17:12:52 +00:00
Simon L. B. Nielsen
2f1ff7669c Merge DTLS fixes from vendor-crypto/openssl/dist:
- Fix memory consumption bug with "future epoch" DTLS records.
- Fix fragment handling memory leak.
- Do not access freed data structure.
- Fix DTLS fragment bug - out-of-sequence message handling which could
  result in NULL pointer dereference in
  dtls1_process_out_of_seq_message().

Note that this will not get FreeBSD Security Advisory as DTLS is
experimental in OpenSSL.

MFC after:	1 week
Security:	CVE-2009-1377 CVE-2009-1378 CVE-2009-1379 CVE-2009-1387
2009-08-23 16:29:47 +00:00
Simon L. B. Nielsen
b7421a6928 Import DTLS fix from upstream OpenSSL 0.9.8 branch:
Fix memory consumption bug with "future epoch" DTLS records.

Note that this will not get FreeBSD Security Advisory as DTLS is
experimental in OpenSSL.

Security:	CVE-2009-1377
Obtained from:	OpenSSL CVS
		http://cvs.openssl.org/chngview?cn=18187
2009-08-23 13:58:25 +00:00
Dag-Erling Smørgrav
9517e86625 Update and remove CVS-specific items
Approved by:	re (kib)
2009-08-13 06:07:38 +00:00
Simon L. B. Nielsen
829d7315d7 Remove symlinks in OpenSSL's testing framework. These are not required
for normal build, and doesn't export well to CVS.

If they are needed later a script will be added to recreate the symlinks
when needed at build time.

Approved by:	re (rwatson)
2009-08-12 12:10:00 +00:00
John Baldwin
5d54b264b7 Use the closefrom(2) system call.
Reviewed by:	des
2009-06-16 15:30:10 +00:00
Simon L. B. Nielsen
db522d3ae4 Merge OpenSSL 0.9.8k into head.
Approved by:	re
2009-06-14 19:45:16 +00:00
Simon L. B. Nielsen
518099af59 Import OpenSSL 0.9.8k. 2009-06-07 19:56:18 +00:00
Dag-Erling Smørgrav
cce7d3464f Upgrade to OpenSSH 5.2p1.
MFC after:	3 months
2009-05-22 18:46:28 +00:00
Colin Percival
e55ab0a54b Don't leak information via uninitialized space in db(3) records. [09:07]
Sanity-check string lengths in order to stop OpenSSL crashing
when printing corrupt BMPString or UniversalString objects. [09:08]

Security:	FreeBSD-SA-09:07.libc
Security:	FreeBSD-SA-09:08.openssl
Security:	CVE-2009-0590
Approved by:	re (kensmith)
Approved by:	so (cperciva)
2009-04-22 14:07:14 +00:00
Simon L. B. Nielsen
8978d9e7ef Prevent cross-site forgery attacks on lukemftpd(8) due to splitting
long commands into multiple requests. [09:01]

Fix incorrect OpenSSL checks for malformed signatures due to invalid
check of return value from EVP_VerifyFinal(), DSA_verify, and
DSA_do_verify. [09:02]

Security:	FreeBSD-SA-09:01.lukemftpd
Security:	FreeBSD-SA-09:02.openssl
Obtained from:	NetBSD [SA-09:01]
Obtained from:	OpenSSL Project [SA-09:02]
Approved by:	so (simon)
2009-01-07 20:17:55 +00:00
Dag-Erling Smørgrav
0aeb000d7b At some point, construct_utmp() was changed to use realhostname() to fill
in the struct utmp due to concerns about the length of the hostname buffer.
However, this breaks the UseDNS option.  There is a simpler and better
solution: initialize utmp_len to the correct value (UT_HOSTSIZE instead of
MAXHOSTNAMELEN) and let get_remote_name_or_ip() worry about the size of the
buffer.

PR:		bin/97499
Submitted by:	Bruce Cran <bruce@cran.org.uk>
MFC after:	1 week
2008-10-21 11:58:26 +00:00
Dag-Erling Smørgrav
a29f9ec52c Our groff doesn't understand $Mdocdate$, so replace them with bare dates.
MFC after:	3 days
2008-09-29 10:53:05 +00:00
Dag-Erling Smørgrav
8137f50df5 MFV "xmalloc: zero size" fix.
MFC after:	1 week
2008-09-24 21:20:44 +00:00
Simon L. B. Nielsen
bb1499d2aa Vendor import of OpenSSL 0.9.8i. 2008-09-21 14:56:30 +00:00
Simon L. B. Nielsen
11bac091f5 Remove files from vendor tree which were not part of OpenSSL 0.9.8e
(last vendor import).

The file were removed in different earlier releases, but were not
removed from the CVS vendor branch at the time.
2008-09-21 14:12:30 +00:00
Simon L. B. Nielsen
c71cd5d0b8 The vendor area is the proper home for these files now. 2008-09-21 13:18:25 +00:00
Dag-Erling Smørgrav
39fa99fb24 Remove some unused files. 2008-09-01 16:34:02 +00:00
Dag-Erling Smørgrav
d08cd9468b Set SIZEOF_LONG_INT and SIZEOF_LONG_LONG_INT to plausible values. They
aren't used for anything, but that's no excuse for being silly.
2008-09-01 14:15:57 +00:00
Simon L. B. Nielsen
c4a78426be Flatten OpenSSL vendor tree. 2008-08-23 10:51:00 +00:00
Dag-Erling Smørgrav
03f6c5cd93 Use net.inet.ip.portrange.reservedhigh instead of IPPORT_RESERVED.
Submitted upstream, no reaction.

Submitted by:	delphij@
MFC after:	2 weeks
2008-08-20 10:40:07 +00:00
Dag-Erling Smørgrav
d4af9e693f Upgrade to OpenSSH 5.1p1.
I have worked hard to reduce diffs against the vendor branch.  One
notable change in that respect is that we no longer prefer DSA over
RSA - the reasons for doing so went away years ago.  This may cause
some surprises, as ssh will warn about unknown host keys even for
hosts whose keys haven't changed.

MFC after:	6 weeks
2008-08-01 02:48:36 +00:00
Dag-Erling Smørgrav
6ef57c8cb4 Another file with no local changes.
"This time for sure!"
2008-08-01 01:50:55 +00:00
Dag-Erling Smørgrav
287d742923 Another file with no local changes. 2008-08-01 01:48:33 +00:00
Dag-Erling Smørgrav
3b137a2c3e Another four files without local changes. This is driving me nuts -
every time I think I got them all, another one pops up.
2008-08-01 01:45:56 +00:00
Dag-Erling Smørgrav
24360cb0fb Yet another file with no local changes. 2008-08-01 01:38:50 +00:00
Dag-Erling Smørgrav
28ba6a75b2 Accidentally mangled this one in the previous commit. 2008-08-01 01:38:24 +00:00
Dag-Erling Smørgrav
7ca12ebb55 More files which no longer have any local changes. 2008-08-01 01:32:56 +00:00
Dag-Erling Smørgrav
7396b2c4a1 These two files have no local patches except to prevent expansion of the
original $FreeBSD$ keywords.  Revert those changes, and simply disable
keyword expansion.
2008-08-01 01:30:26 +00:00
Dag-Erling Smørgrav
504c3e3a23 Last remains of old OPIE patch 2008-08-01 01:24:42 +00:00
Dag-Erling Smørgrav
d09462ac3e We no longer have any local changes here. 2008-08-01 01:19:13 +00:00
Dag-Erling Smørgrav
539f0548f9 Tag expansion is no longer needed (svn handles them correctly).
Add svn command to diff against vendor branch.
2008-08-01 01:05:27 +00:00
Dag-Erling Smørgrav
a84fceb333 This is no longer needed. 2008-08-01 01:04:52 +00:00
Dag-Erling Smørgrav
58055dcd5a Cleanup. 2008-08-01 01:00:34 +00:00
Dag-Erling Smørgrav
5a19634aa0 Ugh. Set svn:mergeinfo correctly. 2008-08-01 00:34:37 +00:00
Dag-Erling Smørgrav
cb7b802714 Catch up with reality. 2008-08-01 00:28:50 +00:00
Dag-Erling Smørgrav
7cbfb01447 Revert an old hack I put in to replace S/Key with OPIE. We haven't used
that code in ages - we use pam_opie(8) instead - so this is a NOP.
2008-08-01 00:27:48 +00:00
Dag-Erling Smørgrav
977e23ac4d Add missing #include for strlen() 2008-07-31 23:33:26 +00:00