Commit Graph

1057 Commits

Author SHA1 Message Date
jkim
c81d3e3cad Import OpenSSL 1.0.2l. 2017-05-25 19:38:38 +00:00
lidl
64d41a9ba5 Refine and update blacklist support in sshd
Adjust notification points slightly to catch all auth failures,
rather than just the ones caused by bad usernames.

Modify notification point for bad usernames to send new type of
BLACKLIST_BAD_USER. (Support in libblacklist will be forthcoming soon.)
Add guards to allow library headers to expose the enum of action values.

Reviewed by:	des
Approved by:	des
Sponsored by:	The FreeBSD Foundation
2017-05-12 15:20:12 +00:00
andrew
fc2648bb76 Fix linking with lld by marking OPENSSL_armcap_P as hidden.
Linking with lld fails as it contains a relative address, however the data
this address is for may be relocated from the shared object to the main
executable.

Fix this by adding the hidden attribute. This stops moving this value to
the main executable. It seems this is implicit upstream as it uses a
version script.

Approved by:	jkim
Sponsored by:	DARPA, AFRL
2017-04-07 12:41:57 +00:00
des
c995370269 Upgrade to OpenSSH 7.4p1. 2017-03-06 01:37:05 +00:00
des
229b651a25 Re-apply part of r311585 which was inadvertantly reverted in the upgrade
to 7.3p1.  The other part (which adds -DLIBWRAP to sshd's CFLAGS) is
still in place.

Reported by:	ngie
2017-03-03 14:25:55 +00:00
des
0f3c0d66a4 Forgot to bump the version addendum date. 2017-03-03 01:50:10 +00:00
des
dc519490bb Upgrade to OpenSSH 7.3p1. 2017-03-02 00:11:32 +00:00
imp
7e6cabd06e Renumber copyright clause 4
Renumber cluase 4 to 3, per what everybody else did when BSD granted
them permission to remove clause 3. My insistance on keeping the same
numbering for legal reasons is too pedantic, so give up on that point.

Submitted by:	Jan Schaumann <jschauma@stevens.edu>
Pull Request:	https://github.com/freebsd/freebsd/pull/96
2017-02-28 23:42:47 +00:00
des
427bf4fd96 Avoid picking up MIT Kerberos from ports (if installed). 2017-02-26 19:00:55 +00:00
des
308f28721f Fix amusingly harmless mis-merge. 2017-02-26 16:34:58 +00:00
lidl
fd982d3dfd Only notify blacklistd for successful logins in auth.c
Reported by:	Rick Adams
Reviewed by:	des
MFC after:	3 days
Sponsored by:	The FreeBSD Foundation
2017-02-19 20:35:39 +00:00
jkim
4834c2f7b9 Merge OpenSSL 1.0.2k. 2017-01-26 19:10:29 +00:00
jkim
d6ae4fddb5 Import OpenSSL 1.0.2k. 2017-01-26 18:32:12 +00:00
delphij
db4ad7afa3 MFV r311913:
Fix multiple OpenSSH vulnerabilities.

Submitted by:	des
Approved by:	so
2017-01-11 05:49:39 +00:00
ngie
078b533dd4 Conditionalize building libwrap support into sshd
Only build libwrap support into sshd if MK_TCP_WRAPPERS != no

This will unbreak the build if libwrap has been removed from the system

MFC after:	2 weeks
PR:		210141
Submitted by:	kpect@protonmail.com
Differential Revision:	D9049
2017-01-07 08:08:35 +00:00
delphij
40a7840d69 MFV r308196:
Fix OpenSSH remote Denial of Service vulnerability.

Security:	CVE-2016-8858
2016-11-02 06:49:25 +00:00
jkim
8fe6e36c80 Build OpenSSL assembly sources for aarch64. Tested with ThunderX by andrew. 2016-10-26 20:02:22 +00:00
jkim
665faf046c Merge OpenSSL 1.0.2j. 2016-09-26 14:22:17 +00:00
jkim
8a88e44577 Import OpenSSL 1.0.2j. 2016-09-26 14:13:11 +00:00
jkim
97091e1369 Merge OpenSSL 1.0.2i. 2016-09-22 13:27:44 +00:00
jkim
301c0382f7 Import OpenSSL 1.0.2i. 2016-09-22 13:04:03 +00:00
lidl
7235884959 Add refactored blacklist support to sshd
Change the calls to of blacklist_init() and blacklist_notify to be
macros defined in the blacklist_client.h file.  This avoids
the need for #ifdef USE_BLACKLIST / #endif except in the
blacklist.c file.

Remove redundent initialization attempts from within
blacklist_notify - everything always goes through
blacklistd_init().

Added UseBlacklist option to sshd, which defaults to off.
To enable the functionality, use '-o UseBlacklist=yes' on
the command line, or uncomment in the sshd_config file.

Reviewed by:	des
Approved by:	des
MFC after:		1 week
Sponsored by:	The FreeBSD Foundation
Differential Revision:	https://reviews.freebsd.org/D7051
2016-08-30 14:09:24 +00:00
jkim
690cff5182 Build OpenSSL assembly sources for arm. Tested with Raspberry Pi 2 Model B.
MFC after:	1 week
2016-08-22 20:59:34 +00:00
emaste
a5b76e1c59 Remove duplicate symbol from libhx509 version-script.map
Upstream commit r21331 (7758a5d0) added semiprivate function
_hx509_request_to_pkcs10 twice. This change has been committed upstream
as 8ef0071d.
2016-08-22 18:50:57 +00:00
des
291f74b116 Try to check whether each key file exists before adding it, and bail out
if we didn't find any of them.  This reduces log spam about key files for
deprecated algorithms, which we look for but don't generate.

PR:		208254
MFC after:	3 days
2016-08-08 10:46:18 +00:00
des
7b7845b35c Remove DSA from default cipher list and disable SSH1.
Upstream did this a long time ago, but we kept DSA and SSH1 in FreeBSD for
reasons which boil down to POLA.  Now is a good time to catch up.

MFC after:	3 days
Relnotes:	yes
2016-08-03 16:08:21 +00:00
emaste
296c49e36f Remove duplicate symbols from libroken version-script.map
Upstream commit r24759 (efed563) prefixed some symbols with rk_, but
introduced 6 duplicate symbols in the version script (because the
rk_-prefixed versions of the symbols were already present).
2016-07-21 18:12:39 +00:00
gjb
7095173950 Revert r301551, which added blacklistd(8) to sshd(8).
This change has functional impact, and other concerns raised
by the OpenSSH maintainer.

Requested by:	des
PR:		210479 (related)
Approved by:	re (marius)
Sponsored by:	The FreeBSD Foundation
2016-06-24 23:22:42 +00:00
lidl
9b5f176b51 Add blacklist support to sshd
Reviewed by:	rpaulo
Approved by:	rpaulo (earlier version of changes)
Relnotes:	YES
Sponsored by:	The FreeBSD Foundation
Differential Revision:	https://reviews.freebsd.org/D5915
2016-06-07 16:18:09 +00:00
avg
1926b48f81 openssl: change SHLIB_VERSION_NUMBER to reflect the reality
Some consumers actually use this definition.

We probably need some procedure to ensure that SHLIB_VERSION_NUMBER
is updated whenever we change the library version in
secure/lib/libssl/Makefile.
2016-06-03 14:09:38 +00:00
cem
2bcae162c5 libkrb5: Fix potential double-free
If krb5_make_principal fails, tmp_creds.server may remain a pointer to freed
memory and then be double-freed.  After freeing it the first time, initialize
it to NULL, which causes subsequent krb5_free_principal calls to do the right
thing.

Reported by:	Coverity
CID:		1273430
Sponsored by:	EMC / Isilon Storage Division
2016-05-11 23:25:59 +00:00
jkim
00a878d06e Merge OpenSSL 1.0.2h.
Relnotes:	yes
2016-05-03 18:50:10 +00:00
jkim
acb827e308 Import OpenSSL 1.0.2h. 2016-05-03 18:00:27 +00:00
des
ba453f42f3 Re-add AES-CBC ciphers to the default cipher list on the server.
PR:		207679
2016-03-11 00:23:10 +00:00
des
bb6f58c772 Upgrade to OpenSSH 7.2p2. 2016-03-11 00:15:29 +00:00
jkim
de2249f81c Merge OpenSSL 1.0.2g.
Relnotes:	yes
2016-03-01 22:08:28 +00:00
jkim
72d32bf80d Import OpenSSL 1.0.2g. 2016-03-01 17:57:01 +00:00
des
d381a76dda Document our modified default value for PermitRootLogin. 2016-02-02 10:02:38 +00:00
jkim
f91c9c2798 Merge OpenSSL 1.0.2f.
Relnotes:	yes
2016-01-28 20:15:22 +00:00
jkim
71cece53f2 Import OpenSSL 1.0.2f. 2016-01-28 18:41:59 +00:00
des
bf4d314681 Switch UseDNS back on 2016-01-27 13:40:44 +00:00
des
84fe0a03f6 r294563 was incomplete; re-add the client-side options as well. 2016-01-22 14:22:11 +00:00
des
150b570cfa Instead of removing the NoneEnabled option, mark it as unsupported.
(should have done this in r291198, but didn't think of it until now)
2016-01-22 13:13:46 +00:00
des
316c45f5be Update the instructions and the list of major local modifications. 2016-01-21 12:42:31 +00:00
des
e5b44dd19f Explain why we don't include VersionAddendum in the debug mode banner. 2016-01-21 12:41:02 +00:00
des
0c80faa259 Upgrade to OpenSSH 7.1p2. 2016-01-21 11:54:34 +00:00
des
65f3eb83cd Enable DSA keys by default. They were disabled in OpenSSH 6.9p1.
Noticed by:	glebius
2016-01-21 11:10:14 +00:00
des
d53b167ff8 Take care not to pick up the wrong version of OpenSSL when running in an
environment that has OpenSSL from ports in addition to the base version.
2016-01-21 10:57:45 +00:00
des
75cd33d704 Remove RCS tags from files in which we no longer have any local
modifications, and add them to two files in which we do.
2016-01-20 23:23:08 +00:00
des
dfe3d69533 Remove a number of generated files which are either out-of-date (because
they are never regenerated to reflect our changes) or in the way of
freebsd-configure.sh.
2016-01-20 23:08:57 +00:00
des
9b2207f860 Upgrade to OpenSSH 7.0p1. 2016-01-20 22:57:10 +00:00
des
b856a45731 Upgrade to OpenSSH 6.9p1. 2016-01-19 18:55:44 +00:00
des
76107b0880 Re-add HPN configuration options as deprecated options to avoid breaking
existing configurations that use them.  Note that there is no functional
difference between OpenSSH with HPN and OpenSSH without HPN.
2016-01-19 18:38:17 +00:00
des
7a7bc643b5 Upgrade to OpenSSH 6.8p1. 2016-01-19 18:28:23 +00:00
des
0a44f26c1c Now that we have local modifications in configure.ac and configure, run
autoheader and autoconf to avoid having to patch configure manually.
2016-01-19 17:20:07 +00:00
des
14172c52f8 Upgrade to OpenSSH 6.7p1, retaining libwrap support (which has been removed
upstream) and a number of security fixes which we had already backported.

MFC after:	1 week
2016-01-19 16:18:26 +00:00
des
43b4a69321 As previously threatened, remove the HPN patch from OpenSSH. 2016-01-19 14:38:20 +00:00
des
23cbd2460d Use 'svn list -R' instead of find, and recognize comments in shell scripts
and {ssh,sshd}_config.
2016-01-19 14:25:22 +00:00
des
1fb8b3ddb1 Recognize *roff comments. 2016-01-19 13:15:57 +00:00
des
a5f4b9478d Update the pre- and post-merge scripts to work correctly after the recent
cleanup.  A round-trip (./freebsd-pre-merge.sh ; ./freebsd-post-merge.sh)
now results in an unchanged working copy.
2016-01-19 12:38:53 +00:00
glebius
6185680860 Fix OpenSSH client information leak.
Security:	SA-16:07.openssh
Security:	CVE-2016-0777
2016-01-14 22:40:46 +00:00
des
0a0682484a Incorrect length in calloc() call, already fixed upstream.
PR:		204769
Submitted by:	David Binderman <dcb314@hotmail.com>
MFC after:	1 week
2015-12-17 19:36:25 +00:00
jkim
8d77ecefb7 Merge OpenSSL 1.0.2e. 2015-12-03 21:13:35 +00:00
jkim
afd52a5fc9 Import OpenSSL 1.0.2e. 2015-12-03 17:22:58 +00:00
des
954c038d83 r291198 inadvertantly reverted a local patch for the default location
of ssh-askpass and xauth, breaking X11 forwarding.
2015-11-26 23:05:40 +00:00
des
a02e9843fe Revert inadvertent commit of an incorrect patch 2015-11-24 16:07:03 +00:00
des
70c2c51da2 Remove description of the now-defunct NoneEnabled option. 2015-11-24 16:06:15 +00:00
des
24641fd80b Retire the NONE cipher option. 2015-11-23 12:48:13 +00:00
jkim
4a83aa80d5 Remove duplicate manual pages.
Reported by:	brd
2015-11-16 21:36:15 +00:00
des
83b666668a Remove dead code. 2015-11-11 13:47:23 +00:00
des
9be32654da One more $Mdocdate$ 2015-11-11 13:27:58 +00:00
des
72179a6f4b Remove /* $FreeBSD$ */ from files that already have __RCSID("$FreeBSD$"). 2015-11-11 13:26:47 +00:00
des
f4baee681e Now that we have mandoc, we can leave $Mdocdate$ tags as-is. Unfortunately,
there is (currently) no way to make Subversion generate correct $Mdocdate$
tags, but perhas we can teach mandoc to read Subversion's %d format.
2015-11-11 13:23:07 +00:00
jkim
6b741bee15 Merge OpenSSL 1.0.2d. 2015-10-30 20:51:33 +00:00
jkim
64cb0c902e Import OpenSSL 1.0.2d. 2015-10-23 19:46:02 +00:00
delphij
991c19271a Fix OpenSSH multiple vulnerabilities by backporting three changes
from OpenSSH-portable master.

Git revisions:	45b0eb752c94954a6de046bfaaf129e518ad4b5b
		5e75f5198769056089fb06c4d738ab0e5abc66f7
		d4697fe9a28dab7255c60433e4dd23cf7fce8a8b
Reviewed by:	des
Security:	FreeBSD-SA-15:22.openssh
2015-08-25 20:48:37 +00:00
delphij
e4eb287ad0 Fix multiple OpenSSH vulnerabilities.
Security:	CVE-2014-2653
Security:	CVE-2015-5600
Security:	FreeBSD-SA-15:16.openssh
2015-07-28 19:58:38 +00:00
vangyzen
2eb95738be ssh: canonicize the host name before looking it up in the host file
Re-apply r99054 by des in 2002.  This was accidentally dropped
by the update to OpenSSH 6.5p1 (r261320).

This change is actually taken from r387082 of
ports/security/openssh-portable/files/patch-ssh.c

PR:		198043
Differential Revision:	https://reviews.freebsd.org/D3103
Reviewed by:	des
Approved by:	kib (mentor)
MFC after:	3 days
Relnotes:	yes
Sponsored by:	Dell Inc.
2015-07-16 18:44:18 +00:00
jkim
ce8a666092 Merge OpenSSL 1.0.1p. 2015-07-09 17:07:45 +00:00
jkim
e5911a7a89 Import OpenSSL 1.0.1p. 2015-07-09 16:41:34 +00:00
jkim
810d2d455b Merge OpenSSL 1.0.1o. 2015-06-12 16:48:26 +00:00
jkim
d552dfce13 Import OpenSSL 1.0.1o. 2015-06-12 16:33:55 +00:00
jkim
d675e841ef Merge OpenSSL 1.0.1n. 2015-06-11 19:00:55 +00:00
jkim
e35879fa69 Import OpenSSL 1.0.1n. 2015-06-11 17:56:16 +00:00
des
c32ee7f1c5 Import new moduli from OpenBSD. Although there is no reason to distrust
the current set, it is good hygiene to change them once in a while.

MFC after:	1 week
2015-05-26 19:46:41 +00:00
bdrewery
a636f8f94f Use proper CHAN_TCP_PACKET_DEFAULT for agent forwarding when HPN disabled.
The use of CHAN_TCP_WINDOW_DEFAULT here was fixed in upstream OpenSSH
in CVS 1.4810, git 5baa170d771de9e95cf30b4c469ece684244cf3e:

  - dtucker@cvs.openbsd.org 2007/12/28 22:34:47
    [clientloop.c]
    Use the correct packet maximum sizes for remote port and agent forwarding.
    Prevents the server from killing the connection if too much data is queued
    and an excessively large packet gets sent.  bz #1360, ok djm@.

The change was lost due to the the way the original upstream HPN patch
modified this code. It was re-adding the original OpenSSH code and never
was properly fixed to use the new value.

MFC after:	2 weeks
2015-04-02 18:43:25 +00:00
bdrewery
77d6bca5e0 Document "none" for VersionAddendum.
PR:		193127
MFC after:	2 weeks
2015-03-23 02:45:12 +00:00
jkim
d962da16eb Merge OpenSSL 1.0.1m. 2015-03-20 19:16:18 +00:00
jkim
038f65e5fb Import OpenSSL 1.0.1m. 2015-03-20 15:28:40 +00:00
jkim
3c988e56ae Merge OpenSSL 1.0.1l.
MFC after:	1 week
Relnotes:	yes
2015-01-16 21:03:23 +00:00
jkim
63414ee1a3 Import OpenSSL 1.0.1l. 2015-01-16 19:52:36 +00:00
jkim
73cdd9409f MFV: r276862
Fix build.
2015-01-09 00:42:10 +00:00
jkim
6c57594b36 Fix build failure on Windows due to undefined cflags identifier.
5c5e7e1a7e
2015-01-09 00:12:20 +00:00
jkim
4f9b1cef1a Merge OpenSSL 1.0.1k. 2015-01-08 23:42:41 +00:00
jkim
a350427e88 Import OpenSSL 1.0.1k. 2015-01-08 22:40:39 +00:00
jkim
411d431d45 Merge OpenSSL 1.0.1j. 2014-10-15 19:12:05 +00:00
jkim
9a02b27a6e Import OpenSSL 1.0.1j. 2014-10-15 17:32:57 +00:00
gjb
01f4e5a3e8 Include the gssapi_krb5 library in KRB5_LDFLAGS.
PR:		156245
MFC after:	3 days
Sponsored by:	The FreeBSD Foundation
2014-09-08 19:00:13 +00:00
jkim
3299c3be1a Merge OpenSSL 1.0.1i. 2014-08-07 18:56:10 +00:00
jkim
8bd1d6691f Import OpenSSL 1.0.1i. 2014-08-07 16:49:55 +00:00