simon
abe6016909
Prevent cross-site forgery attacks on lukemftpd(8) due to splitting
...
long commands into multiple requests. [09:01]
Fix incorrect OpenSSL checks for malformed signatures due to invalid
check of return value from EVP_VerifyFinal(), DSA_verify, and
DSA_do_verify. [09:02]
Security: FreeBSD-SA-09:01.lukemftpd
Security: FreeBSD-SA-09:02.openssl
Obtained from: NetBSD [SA-09:01]
Obtained from: OpenSSL Project [SA-09:02]
Approved by: so (simon)
2009-01-07 20:17:55 +00:00
des
a9989b9d40
At some point, construct_utmp() was changed to use realhostname() to fill
...
in the struct utmp due to concerns about the length of the hostname buffer.
However, this breaks the UseDNS option. There is a simpler and better
solution: initialize utmp_len to the correct value (UT_HOSTSIZE instead of
MAXHOSTNAMELEN) and let get_remote_name_or_ip() worry about the size of the
buffer.
PR: bin/97499
Submitted by: Bruce Cran <bruce@cran.org.uk>
MFC after: 1 week
2008-10-21 11:58:26 +00:00
des
a51772f108
Our groff doesn't understand $Mdocdate$, so replace them with bare dates.
...
MFC after: 3 days
2008-09-29 10:53:05 +00:00
des
ab1a43cf51
MFV "xmalloc: zero size" fix.
...
MFC after: 1 week
2008-09-24 21:20:44 +00:00
simon
859b6dcfcc
Vendor import of OpenSSL 0.9.8i.
2008-09-21 14:56:30 +00:00
simon
798997ea06
Remove files from vendor tree which were not part of OpenSSL 0.9.8e
...
(last vendor import).
The file were removed in different earlier releases, but were not
removed from the CVS vendor branch at the time.
2008-09-21 14:12:30 +00:00
simon
8eda466e5c
The vendor area is the proper home for these files now.
2008-09-21 13:18:25 +00:00
des
364610d759
Remove some unused files.
2008-09-01 16:34:02 +00:00
des
f50b650b57
Set SIZEOF_LONG_INT and SIZEOF_LONG_LONG_INT to plausible values. They
...
aren't used for anything, but that's no excuse for being silly.
2008-09-01 14:15:57 +00:00
simon
64fcbc70db
Flatten OpenSSL vendor tree.
2008-08-23 10:51:00 +00:00
des
f53f7dd853
Use net.inet.ip.portrange.reservedhigh instead of IPPORT_RESERVED.
...
Submitted upstream, no reaction.
Submitted by: delphij@
MFC after: 2 weeks
2008-08-20 10:40:07 +00:00
des
b7aa600c41
Upgrade to OpenSSH 5.1p1.
...
I have worked hard to reduce diffs against the vendor branch. One
notable change in that respect is that we no longer prefer DSA over
RSA - the reasons for doing so went away years ago. This may cause
some surprises, as ssh will warn about unknown host keys even for
hosts whose keys haven't changed.
MFC after: 6 weeks
2008-08-01 02:48:36 +00:00
des
f672f908e1
Another file with no local changes.
...
"This time for sure!"
2008-08-01 01:50:55 +00:00
des
47d27c283c
Another file with no local changes.
2008-08-01 01:48:33 +00:00
des
d1eccf1850
Another four files without local changes. This is driving me nuts -
...
every time I think I got them all, another one pops up.
2008-08-01 01:45:56 +00:00
des
0afede05d8
Yet another file with no local changes.
2008-08-01 01:38:50 +00:00
des
9472224e68
Accidentally mangled this one in the previous commit.
2008-08-01 01:38:24 +00:00
des
ab05c9d6e0
More files which no longer have any local changes.
2008-08-01 01:32:56 +00:00
des
aec4b2ce63
These two files have no local patches except to prevent expansion of the
...
original $FreeBSD$ keywords. Revert those changes, and simply disable
keyword expansion.
2008-08-01 01:30:26 +00:00
des
c16d19ef38
Last remains of old OPIE patch
2008-08-01 01:24:42 +00:00
des
1d5516fdb1
We no longer have any local changes here.
2008-08-01 01:19:13 +00:00
des
0a6d19e874
Tag expansion is no longer needed (svn handles them correctly).
...
Add svn command to diff against vendor branch.
2008-08-01 01:05:27 +00:00
des
e4b4e186ba
This is no longer needed.
2008-08-01 01:04:52 +00:00
des
ed6e3a816d
Cleanup.
2008-08-01 01:00:34 +00:00
des
fa78b524d4
Ugh. Set svn:mergeinfo correctly.
2008-08-01 00:34:37 +00:00
des
ce65202984
Catch up with reality.
2008-08-01 00:28:50 +00:00
des
e253d923d4
Revert an old hack I put in to replace S/Key with OPIE. We haven't used
...
that code in ages - we use pam_opie(8) instead - so this is a NOP.
2008-08-01 00:27:48 +00:00
des
a0701212a1
Add missing #include for strlen()
2008-07-31 23:33:26 +00:00
des
0c146c189c
Fix alignment of the cmsg buffer by placing it in a union with a struct
...
cmsghdr. Derived from upstream patch.
Submitted by: cognet
MFC after: 2 weeks
2008-07-30 09:16:46 +00:00
des
01d1a97b94
Remove a bunch of files we don't need to build OpenSSH. They are still
...
available in base/vendor-crypto/openssh/dist/.
2008-07-23 17:02:25 +00:00
des
f1596419c2
Properly flatten openssh/dist.
2008-07-22 19:01:18 +00:00
des
666aa9cc16
Revert part of 180714 - the intent was to flatten dist, not to nuke it.
2008-07-22 18:58:19 +00:00
des
624d93001f
Flatten the OpenSSH vendor tree for 3.x and newer.
2008-07-22 17:13:05 +00:00
dfr
be0348cb75
Fix conflicts after heimdal-1.1 import and add build infrastructure. Import
...
all non-style changes made by heimdal to our own libgssapi.
2008-05-07 13:53:12 +00:00
dfr
52bf09d819
This commit was generated by cvs2svn to compensate for changes in r178825,
...
which included commits to RCS files with non-trunk default branches.
2008-05-07 13:39:42 +00:00
dfr
51b6601db4
Vendor import of Heimdal 1.1
2008-05-07 13:39:42 +00:00
des
081081cbe3
Fix the Xlist so it actually works with 'tar -X', and update the upgrade
...
instructions accordingly.
2008-02-06 23:14:24 +00:00
des
76b6e0b06e
As per discussion, commit experimental metadata for my contrib packages.
...
The idea is to have a FREEBSD-vendor file for every third-party package
in the tree.
2008-02-06 23:06:24 +00:00
simon
1ee7c30aa9
Unbreak detection of cryptodev support for FreeBSD which was broken
...
with OpenSSL 0.9.8 import.
Note that this does not enable cryptodev by default, as it was the
case with OpenSSL 0.9.7 in FreeBSD base, but this change makes it
possible to enable cryptodev at all.
This has been submitted upstream as:
http://rt.openssl.org/Ticket/Display.html?id=1624
Submitted by: nork
2008-01-13 11:44:47 +00:00
simon
8f21bfc175
Import DTLS security fix from upstream OpenSSL_0_9_8-stable branch.
...
From the OpenSSL advisory:
Andy Polyakov discovered a flaw in OpenSSL's DTLS
implementation which could lead to the compromise of clients
and servers with DTLS enabled.
DTLS is a datagram variant of TLS specified in RFC 4347 first
supported in OpenSSL version 0.9.8. Note that the
vulnerabilities do not affect SSL and TLS so only clients and
servers explicitly using DTLS are affected.
We believe this flaw will permit remote code execution.
Security: CVE-2007-4995
Security: http://www.openssl.org/news/secadv_20071012.txt
2007-10-18 20:19:33 +00:00
simon
efafc844b6
This commit was generated by cvs2svn to compensate for changes in r172767,
...
which included commits to RCS files with non-trunk default branches.
2007-10-18 20:19:33 +00:00
peter
0dcad926c5
Remove _FREEFALL_CONFIG hacks. su+pam_ksu works well enough to use on
...
the freebsd.org cluster.
2007-10-18 19:36:31 +00:00
simon
6d467b2229
Correct a buffer overflow in OpenSSL SSL_get_shared_ciphers().
...
Security: FreeBSD-SA-07:08.openssl
Approved by: re (security blanket)
2007-10-03 21:38:57 +00:00
des
91a576f9b7
s/X11R6/local/g
2007-05-24 22:04:07 +00:00
simon
fbc9e81620
Fix runtime crash in OpenSSL with "Illegal instruction" by making some
...
casts a bit less evil.
This was e.g. seen when using portsnap as:
Fetching snapshot tag from portsnap3.FreeBSD.org... Illegal instruction
Note the patch is slightly different from kan's original patch to
match style in the OpenSSL source files a bit better.
Submitted by: kan
Tested by: many
2007-05-22 20:28:19 +00:00
simon
9bb7d4296b
- Bring upgrade produce up-to-date for OpenSSL 0.9.8e.
...
- Add reminder to bump version numer in Makefile.inc.
2007-03-15 21:06:48 +00:00
simon
8e9898839e
Import fix from upstream OpenSSL_0_9_8-stable branch:
...
EVP_CIPHER_CTX_key_length() should return the set key length
in the EVP_CIPHER_CTX structure which may not be the same as
the underlying cipher key length for variable length ciphers.
This fixes problems in OpenSSH using some ciphers, and possibly other
applications.
See also: http://bugzilla.mindrot.org/show_bug.cgi?id=1291
2007-03-15 20:26:26 +00:00
simon
86271f334e
This commit was generated by cvs2svn to compensate for changes in r167617,
...
which included commits to RCS files with non-trunk default branches.
2007-03-15 20:26:26 +00:00
simon
394ba190a3
Resolve conflicts after import of OpenSSL 0.9.8e.
2007-03-15 20:07:27 +00:00
simon
ee48ceb6a8
Vendor import of OpenSSL 0.9.8e.
2007-03-15 20:03:30 +00:00
simon
699a8581f9
This commit was generated by cvs2svn to compensate for changes in r167612,
...
which included commits to RCS files with non-trunk default branches.
2007-03-15 20:03:30 +00:00
des
f486315183
Resolve conflicts.
2006-11-10 16:52:41 +00:00
des
f591b3e29c
Vendor import of OpenSSH 4.5p1.
2006-11-10 16:39:21 +00:00
des
11e3a8c8c1
This commit was generated by cvs2svn to compensate for changes in r164146,
...
which included commits to RCS files with non-trunk default branches.
2006-11-10 16:39:21 +00:00
des
d75fd1fec6
Don't define XAUTH_PATH here, we either pass it in on the compiler command
...
line or rely on the built-in default.
2006-10-06 14:27:26 +00:00
des
91390ee9f2
Go figure how an extra $Id$ line crept in...
2006-10-04 10:21:00 +00:00
des
178eb45ceb
Merge vendor patch.
2006-10-04 10:15:53 +00:00
des
e6cc400c8f
Apply vendor patch to fix detection of tap / tun headers and ENGINE support.
2006-10-04 10:14:30 +00:00
des
351bcb5c21
Tweak ifdefs for backward compatibility.
2006-10-03 11:33:25 +00:00
des
24e2cf96ac
Dead files.
2006-10-02 13:29:41 +00:00
des
a74a69e336
Regenerate; no effect on the code as it doesn't actually use the handful of
...
conditionals that changed in this revision.
2006-10-02 12:45:27 +00:00
des
14ad83d6bf
Update configure options and add some missing steps.
...
The section about our local changes needs reviewing, and some of those
changes should probably be reconsidered (such as preferring DSA over RSA,
which made sense when RSA was encumbered but probably doesn't any more)
2006-10-02 12:39:28 +00:00
simon
25dab5b4c1
Import from upstream OpenSSL 0.9.8 branch:
...
Fix uninitialized free of ctx in compute_key() when the
OPENSSL_DH_MAX_MODULUS_BITS check is triggered.
This fixes the same issue as FreeBSD-SA-06:23.openssl v1.1.
2006-10-01 08:09:46 +00:00
simon
ac7fb23be5
This commit was generated by cvs2svn to compensate for changes in r162916,
...
which included commits to RCS files with non-trunk default branches.
2006-10-01 08:09:46 +00:00
simon
de193995a6
Resolve conflicts after import of OpenSSL 0.9.8d.
2006-10-01 07:46:16 +00:00
simon
387e65d767
Vendor import of OpenSSL 0.9.8d.
2006-10-01 07:38:44 +00:00
simon
b2881e9eb1
This commit was generated by cvs2svn to compensate for changes in r162911,
...
which included commits to RCS files with non-trunk default branches.
2006-10-01 07:38:44 +00:00
des
0824f0c0e7
Regenerate.
...
MFC after: 1 week
2006-09-30 13:40:56 +00:00
des
ac038c1070
#include <errno.h>; this has the unfortunate side effect of taking the file
...
off the vendor branch.
MFC after: 1 week
2006-09-30 13:40:35 +00:00
des
0f481d7c8c
Removed from vendor branch.
...
MFC after: 1 week
2006-09-30 13:39:35 +00:00
des
e16bfbb7bc
Bump version addendum.
...
MFC after: 1 week
2006-09-30 13:39:07 +00:00
des
4ff234ef46
Merge conflicts.
...
MFC after: 1 week
2006-09-30 13:38:06 +00:00
des
2f35ce4773
Vendor import of OpenSSH 4.4p1.
2006-09-30 13:29:51 +00:00
des
abd7c8704b
This commit was generated by cvs2svn to compensate for changes in r162852,
...
which included commits to RCS files with non-trunk default branches.
2006-09-30 13:29:51 +00:00
des
97a1b8f884
Merge vendor patch for BSM problem in protocol version 1.
...
MFC after: 1 week
2006-09-16 15:12:58 +00:00
des
03ef9d989b
Vendor patch for a problem that prevented using protocol version 1 when
...
BSM was enabled.
2006-09-16 15:10:13 +00:00
simon
22f3e61de2
Correct incorrect PKCS#1 v1.5 padding validation in crypto(3).
...
Obtained from: OpenSSL project
Security: FreeBSD-SA-06:19.openssl
2006-09-10 20:16:43 +00:00
simon
76f00e0285
Resolve conflicts after import of OpenSSL 0.9.8b.
...
This was missed the first time around since eng_padlock.c was not part
of OpenSSL 0.9.7e and therefor did not have the v0_9_7e CVS tag used
during original resolve of conflicts.
Noticed by: Antoine Brodin <antoine.brodin@laposte.net>
2006-07-30 14:17:54 +00:00
simon
870bdce538
Sync FREEBSD-Xlist with what was actually excluded from OpenSSL 0.9.8b
...
import.
2006-07-29 22:40:45 +00:00
simon
00e07ea415
Add some rough notes on how to import a new OpenSSL version into the
...
FreeBSD base system. Parts are inspired by the OpenSSH upgrade notes.
2006-07-29 22:01:26 +00:00
simon
e07cc0214a
Resolve conflicts after import of OpenSSL 0.9.8b.
2006-07-29 19:14:51 +00:00
simon
fb3c70eda8
Vendor import of OpenSSL 0.9.8b
2006-07-29 19:10:21 +00:00
simon
9159ca2b0e
This commit was generated by cvs2svn to compensate for changes in r160814,
...
which included commits to RCS files with non-trunk default branches.
2006-07-29 19:10:21 +00:00
des
d9ba51b5fc
Our glob(3) has all the required features.
...
Submitted by: ache
2006-06-09 08:39:05 +00:00
des
a34ad0a5f7
Revert inadvertant commit of debugging code.
2006-06-09 07:23:14 +00:00
des
148092431d
Introduce a namespace munging hack inspired by NetBSD to avoid polluting
...
the namespace of applications which inadvertantly link in libssh (usually
through pam_ssh)
Suggested by: lukem@netbsd.org
MFC after: 6 weeks
2006-05-13 13:47:45 +00:00
des
9c68158992
Fix utmp. There is some clever logic in configure.ac which attempts to
...
determine whether struct utmp contains the ut_host and ut_time fields.
Unfortunately, it reports a false negative for both on FreeBSD, and I
didn't check the resulting config.h closely enough to catch the error.
Noticed by: ache
2006-03-23 21:31:42 +00:00
des
eb091e1fc6
Regenerate.
2006-03-22 20:41:53 +00:00
des
7c07891caf
Merge conflicts.
2006-03-22 20:41:37 +00:00
des
448503722a
Vendor import of OpenSSH 4.3p1.
2006-03-22 19:46:12 +00:00
des
c2efe9a305
This commit was generated by cvs2svn to compensate for changes in r157016,
...
which included commits to RCS files with non-trunk default branches.
2006-03-22 19:46:12 +00:00
ru
388e590f95
Reimplementation of world/kernel build options. For details, see:
...
http://lists.freebsd.org/pipermail/freebsd-current/2006-March/061725.html
The src.conf(5) manpage is to follow in a few days.
Brought to you by: imp, jhb, kris, phk, ru (all bugs are mine)
2006-03-17 18:54:44 +00:00
dfr
65ca66cee3
Fix the amd64 (and presumably ia64) lib32 build by ensuring that the
...
heimdal GSS-API mechanism uses its own version of gssapi.h, including all
the implementation-dependant pollution contained therein.
This moves the file off the vendor branch, sadly.
Submitted by: bz
2006-01-02 11:28:42 +00:00
dfr
d9cbcb50b5
Add a new extensible GSS-API layer which can support GSS-API plugins,
...
similar the the Solaris implementation. Repackage the krb5 GSS mechanism
as a plugin library for the new implementation. This also includes a
comprehensive set of manpages for the GSS-API functions with text mostly
taken from the RFC.
Reviewed by: Love Hörnquist Åstrand <lha@it.su.se>, ru (build system), des (openssh parts)
2005-12-29 14:40:22 +00:00
cperciva
45ad656456
Correct a man-in-the-middle SSL version rollback vulnerability.
...
Security: FreeBSD-SA-05:21.openssl
2005-10-11 11:50:36 +00:00
des
fbfe6dd7e0
Regenerate
2005-09-03 07:08:51 +00:00
des
88c7c9558b
Resolve conflicts.
2005-09-03 07:04:25 +00:00
des
755a16fa86
Vendor import of OpenSSH 4.2p1.
2005-09-03 06:59:33 +00:00
des
1ea3628aba
This commit was generated by cvs2svn to compensate for changes in r149749,
...
which included commits to RCS files with non-trunk default branches.
2005-09-03 06:59:33 +00:00
des
f0dcade643
fine-tune.
2005-09-03 06:42:11 +00:00