Commit Graph

1057 Commits

Author SHA1 Message Date
jkim
a6d6a27870 Change "the the" to "the". It is a continuation of r226436 and missed in
r237658.

Approved by:	benl (maintainer, implicit)
2013-02-13 22:38:20 +00:00
jkim
9069337c83 Import OpenSSL 1.0.1e.
Approved by:	secteam (delphij, simon), benl (silence)
2013-02-13 22:15:56 +00:00
pfg
245e35ae97 Clean some 'svn:executable' properties in the tree.
Submitted by:	Christoph Mallon
MFC after:	3 days
2013-01-26 22:08:21 +00:00
delphij
2dfa3a3e47 Indicate that we are using OpenSSL with some local modifications.
X-MFC after:	with r244974
2013-01-02 21:00:00 +00:00
delphij
339eb8a5c4 MFV r244973:
Integrate OpenSSL changeset 22950 (appro):

        bn_word.c: fix overflow bug in BN_add_word.

MFC after:	2 weeks
2013-01-02 20:58:46 +00:00
delphij
90d033541a Integrate OpenSSL changeset 22950 (appro):
bn_word.c: fix overflow bug in BN_add_word.
2013-01-02 20:56:53 +00:00
eadler
0af88b7eae Clean up hardcoded ar(1) flags in the tree to use the global ARFLAGS in
share/mk/sys.mk instead.

This is part of a medium term project to permit deterministic builds of
FreeBSD.

Submitted by:	Erik Cederstrand <erik@cederstrand.dk>
Reviewed by:	imp, toolchain@
Approved by:	cperciva
MFC after:	2 weeks
2012-12-06 01:31:25 +00:00
pjd
ee39d48b3c Allow OpenSSL to use arc4random(3) on FreeBSD. arc4random(3) was modified
some time ago to use sysctl instead of /dev/random to get random data,
so is now much better choice, especially for sandboxed processes that have
no direct access to /dev/random.

Approved by:	benl
MFC after:	2 weeks
2012-11-30 22:23:23 +00:00
dim
0572fba032 In crypto/heimdal/lib/sl/slc-lex.l, don't define YY_NO_INPUT, since
%option nounput is already specified.

MFC after:	3 days
2012-11-14 18:49:03 +00:00
avg
4267c6aa52 openssl: change SHLIB_VERSION_NUMBER to reflect the reality
Note: I timed out waiting for an exp-run for this change but I survived
having it locally for quite a long time.

MFC after:	1 month
X-MFC note:	SHLIB_MAJOR is 6 in stable/8 and stable/9
2012-09-11 06:10:49 +00:00
des
00f3582ac6 Upgrade OpenSSH to 6.1p1. 2012-09-03 16:51:41 +00:00
jkim
e393e47b1e Merge OpenSSL 1.0.1c.
Approved by:	benl (maintainer)
2012-07-12 19:30:53 +00:00
jkim
532b4084cb Import OpenSSL 1.0.1c.
Approved by:	benl (maintainer)
2012-07-11 23:31:36 +00:00
jkim
c4d8545b00 Partially redo r226436, i. e., change "the the" to "the". ca(1), dgst(1),
and engine(3) are generated from these pod files during merge process and
we do not want to re-apply these changes over and over again.

Approved by:	benl (maintainer, implicit)
2012-06-27 19:23:29 +00:00
jkim
299ab12592 Merge OpenSSL 0.9.8x.
Reviewed by:	stas
Approved by:	benl (maintainer)
MFC after:	3 days
2012-06-27 18:44:36 +00:00
jkim
1554498e64 Import OpenSSL 0.9.8x. 2012-06-27 16:44:58 +00:00
delphij
85590af6fa MFV (r237567):
Fetch both ECDSA and RSA keys by default in ssh-keyscan(1).

Approved by:	des
Obtained from:	OpenSSH portable
MFC after:	1 week
2012-06-25 19:01:04 +00:00
bz
d2e144fbe8 Update the previous openssl fix. [12:01]
Fix a bug in crypt(3) ignoring characters of a passphrase. [12:02]

Security:	FreeBSD-SA-12:01.openssl (revised)
Security:	FreeBSD-SA-12:02.crypt
Approved by:	so (bz, simon)
2012-05-30 12:01:28 +00:00
rea
3f61b471d9 OpenSSH: allow VersionAddendum to be used again
Prior to this, setting VersionAddendum will be a no-op: one will
always have BASE_VERSION + " " + VERSION_HPN for VersionAddendum
set in the config and a bare BASE_VERSION + VERSION_HPN when there
is no VersionAddendum is set.

HPN patch requires both parties to have the "hpn" inside their
advertized versions, so we add VERSION_HPN to the VERSION_BASE
if HPN is enabled and omitting it if HPN is disabled.

VersionAddendum now uses the following logics:
 * unset (default value): append " " and VERSION_ADDENDUM;
 * VersionAddendum is set and isn't empty: append " "
   and VersionAddendum;
 * VersionAddendum is set and empty: don't append anything.

Approved by: des
Reviewed by: bz
MFC after: 3 days
2012-05-27 06:53:35 +00:00
bz
48f59d28b6 Fix multiple OpenSSL vulnerabilities.
Security:	CVE-2011-4576, CVE-2011-4619, CVE-2011-4109
Security:	CVE-2012-0884, CVE-2012-2110
Security:	FreeBSD-SA-12:01.openssl
Approved by:	so (bz,simon)
2012-05-03 15:25:11 +00:00
stas
e98d05b4f0 - Update FreeBSD's Heimdal distribution to 1.5.2. This is a bugfix
release, which fixes a DoS issue in libkrb5.
2012-04-08 08:19:17 +00:00
stas
e7e0b34988 - Update FreeBSD Heimdal distribution to version 1.5.1. This also brings
several new kerberos related libraries and applications to FreeBSD:
  o kgetcred(1) allows one to manually get a ticket for a particular service.
  o kf(1) securily forwards ticket to another host through an authenticated
    and encrypted stream.
  o kcc(1) is an umbrella program around klist(1), kswitch(1), kgetcred(1)
    and other user kerberos operations. klist and kswitch are just symlinks
    to kcc(1) now.
  o kswitch(1) allows you to easily switch between kerberos credentials if
    you're running KCM.
  o hxtool(1) is a certificate management tool to use with PKINIT.
  o string2key(1) maps a password into key.
  o kdigest(8) is a userland tool to access the KDC's digest interface.
  o kimpersonate(8) creates a "fake" ticket for a service.

  We also now install manpages for some lirbaries that were not installed
  before, libheimntlm and libhx509.

- The new HEIMDAL version no longer supports Kerberos 4.  All users are
  recommended to switch to Kerberos 5.

- Weak ciphers are now disabled by default.  To enable DES support (used
  by telnet(8)), use "allow_weak_crypto" option in krb5.conf.

- libtelnet, pam_ksu and pam_krb5 are now compiled with error on warnings
  disabled due to the function they use (krb5_get_err_text(3)) being
  deprecated.  I plan to work on this next.

- Heimdal's KDC now require sqlite to operate.  We use the bundled version
  and install it as libheimsqlite.  If some other FreeBSD components will
  require it in the future we can rename it to libbsdsqlite and use for these
  components as well.

- This is not a latest Heimdal version, the new one was released while I was
  working on the update.  I will update it to 1.5.2 soon, as it fixes some
  important bugs and security issues.
2012-03-22 08:48:42 +00:00
ed
b36b72f154 Polish diff against upstream.
- Revert unneeded whitespace changes.
- Revert modifications to loginrec.c, as the upstream version already
  does the right thing.
- Fix indentation and whitespace of local changes.

Approved by:	des
MFC after:	1 month
2012-02-13 11:59:59 +00:00
cperciva
6d6844d3db Fix a problem whereby a corrupt DNS record can cause named to crash. [11:06]
Add an API for alerting internal libc routines to the presence of
"unsafe" paths post-chroot, and use it in ftpd. [11:07]

Fix a buffer overflow in telnetd. [11:08]

Make pam_ssh ignore unpassphrased keys unless the "nullok" option is
specified. [11:09]

Add sanity checking of service names in pam_start. [11:10]

Approved by:    so (cperciva)
Approved by:    re (bz)
Security:       FreeBSD-SA-11:06.bind
Security:       FreeBSD-SA-11:07.chroot
Security:       FreeBSD-SA-11:08.telnetd
Security:       FreeBSD-SA-11:09.pam_ssh
Security:       FreeBSD-SA-11:10.pam
2011-12-23 15:00:37 +00:00
des
0caa0a85dd Add a -x option that causes ssh-agent(1) to exit when all clients have
disconnected.

MFC after:	1 week
2011-10-07 13:10:16 +00:00
des
038442ad80 Upgrade to OpenSSH 5.9p1.
MFC after:	3 months
2011-10-05 22:08:17 +00:00
stas
f6e720bf7e - Flatten the vendor heimdal tree. 2011-09-29 05:23:57 +00:00
des
a0397fe027 Belatedly regenerate after application of the HPN patch. 2011-09-28 20:42:22 +00:00
des
bf8fedabcd Remove the svn:keywords property and restore the historical $FreeBSD$ tag.
Approved by:	re (kib)
MFC after:	3 weeks
2011-09-16 11:14:10 +00:00
delphij
41cd87c13e Fix SSL memory handlig for (EC)DH cipher suites, in particular for
multi-threaded use of ECDH.

Security:	CVE-2011-3210
Reviewed by:	stas
Obtained from:	OpenSSL CVS
Approved by:	re (kib)
2011-09-08 09:33:49 +00:00
brooks
28f5522cfe Fix two more $FreeBSD$ keywords.
Reported by:	pluknet
Approved by:	re (implicit)
2011-08-03 20:21:52 +00:00
brooks
0f65fdcb29 Add support for dynamically adjusted buffers to allow the full use of
the bandwidth of long fat pipes (i.e. 100Mbps+ trans-oceanic or
trans-continental links).  Bandwidth-delay products up to 64MB are
supported.

Also add support (not compiled by default) for the None cypher.  The
None cypher can only be enabled on non-interactive sessions (those
without a pty where -T was not used) and must be enabled in both
the client and server configuration files and on the client command
line.  Additionally, the None cypher will only be activated after
authentication is complete.  To enable the None cypher you must add
-DNONE_CIPHER_ENABLED to CFLAGS via the make command line or in
/etc/make.conf.

This code is a style(9) compliant version of these features extracted
from the patches published at:

http://www.psc.edu/networking/projects/hpn-ssh/

Merging this patch has been a collaboration between me and Bjoern.

Reviewed by:	bz
Approved by:	re (kib), des (maintainer)
2011-08-03 19:14:22 +00:00
benl
437ee49691 Fix clang warning (why is there nowhere yyparse() is declared?).
Approved by:	philip (mentor)
2011-05-18 20:57:23 +00:00
des
2e02cf00cc Merge two upstream patches from vendor branch. No functional changes. 2011-05-05 08:08:18 +00:00
des
ee2afa8165 Upgrade to OpenSSH 5.8p2. 2011-05-04 07:34:44 +00:00
simon
4fe7a7870a Fix Incorrectly formatted ClientHello SSL/TLS handshake messages could
cause OpenSSL to parse past the end of the message.

Note: Applications are only affected if they act as a server and call
SSL_CTX_set_tlsext_status_cb on the server's SSL_CTX. This includes
Apache httpd >= 2.3.3, if configured with "SSLUseStapling On".

Security:	http://www.openssl.org/news/secadv_20110208.txt
Security:	CVE-2011-0014
Obtained from:	OpenSSL CVS
2011-02-12 21:30:46 +00:00
simon
2e75518768 Merge OpenSSL 0.9.8q into head.
Security:	CVE-2010-4180
Security:	http://www.openssl.org/news/secadv_20101202.txt
MFC after:	3 days
2010-12-03 22:59:54 +00:00
simon
ae03beb758 Import OpenSSL 0.9.8q. 2010-12-02 22:36:51 +00:00
simon
7a23485c98 Merge OpenSSL 0.9.8p into head.
Security:	CVE-2010-3864
Security:	http://www.openssl.org/news/secadv_20101116.txt
2010-11-22 18:23:44 +00:00
simon
94e5505da6 Import OpenSSL 0.9.8p. 2010-11-21 22:45:18 +00:00
simon
5b9f7b2fde Fix double-free in OpenSSL's SSL ECDH code.
It has yet to be determined if this warrants a FreeBSD Security
Advisory, but we might as well get it fixed in the normal branches.

Obtained from:	OpenSSL CVS
Security:	CVE-2010-2939
X-MFC after:	Not long...
2010-11-14 09:33:47 +00:00
des
59d1af2322 Upgrade to OpenSSH 5.6p1. 2010-11-11 11:46:19 +00:00
des
3c6dca852a Forgot to svn rm this when I imported 5.4p1. 2010-11-10 08:21:25 +00:00
emaste
3c1b275767 Remove copyright strings printed at login time via login(1) or sshd(8).
It is not clear to what this copyright should apply, and this is in line
with what other operating systems do.

For ssh specifically, printing of the copyright string is not in the
upstream version so this reduces our FreeBSD-local diffs.

Approved by:	core, des (ssh)
2010-09-28 20:57:14 +00:00
rpaulo
619042c668 Bring in OpenSSL checkin 19821:
Make inline assembler clang-friendly [from HEAD].

 openssl/crypto/md32_common.h     	1.45.2.1 -> 1.45.2.2
 openssl/crypto/rc5/rc5_locl.h     	1.8 -> 1.8.8.1

Approved by:	simon
2010-09-21 10:22:29 +00:00
des
9bef2d9553 More commas 2010-06-01 22:46:57 +00:00
des
28662c6994 Missing commas 2010-06-01 15:11:29 +00:00
cperciva
b4dba7d518 Fix .Dd line: FreeBSD's mdoc code doesn't understand OpenBSD's $Mdocdate$.
MFC after:	3 days
2010-05-28 01:06:40 +00:00
des
fc607a2e80 Upgrade to OpenSSH 5.5p1. 2010-04-28 10:36:33 +00:00
kib
961511b433 Enhance r199804 by marking the daemonised child as immune to OOM instead
of short-living parent. Only mark the master process that accepts
connections, do not protect connection handlers spawned from inetd.

Submitted by:	Mykola Dzham <i levsha me>
Reviewed by:	attilio
MFC after:	1 week
2010-04-08 12:07:40 +00:00
simon
2176e0cd52 Merge OpenSSL 0.9.8n into head.
This fixes CVE-2010-0740 which only affected -CURRENT (OpenSSL 0.9.8m)
but not -STABLE branches.

I have not yet been able to find out if CVE-2010-0433 impacts FreeBSD.
This will be investigated further.

Security:	CVE-2010-0433, CVE-2010-0740
Security:	http://www.openssl.org/news/secadv_20100324.txt
2010-04-01 15:19:51 +00:00
simon
d92ad4708f Import OpenSSL 0.9.8n. 2010-04-01 12:25:40 +00:00
simon
a93ba965a7 Readd $FreeBSD$ to the OpenSSL config file as that's useful for
mergemaster.

Suggested by:	dougb
2010-03-13 22:37:07 +00:00
simon
0d816bbd98 Merge OpenSSL 0.9.8m into head.
This also "reverts" some FreeBSD local changes so we should now
be back to using entirely stock OpenSSL.  The local changes were
simple $FreeBSD$ lines additions, which were required in the CVS
days, and the patch for FreeBSD-SA-09:15.ssl which has been
superseded with OpenSSL 0.9.8m's RFC5746 'TLS renegotiation
extension' support.

MFC after:	3 weeks
2010-03-13 19:22:41 +00:00
des
c3510f9e73 Upgrade to OpenSSH 5.4p1.
MFC after:	1 month
2010-03-09 19:16:43 +00:00
simon
cdb6eef1f0 Import OpenSSL 0.9.8m. 2010-02-28 18:49:43 +00:00
ed
c69b7d3b1a Add a missing $FreeBSD$ string.
I was requested to add this string to any file that was modified by my
commit, which I forgot to do so.

Requested by:	des
2010-01-13 20:30:16 +00:00
ed
495b1a6bbd Make OpenSSH work with utmpx.
- Partially revert r184122 (sshd.c). Our ut_host is now big enough to
  fit proper hostnames.

- Change config.h to match reality.

- defines.h requires UTMPX_FILE to be set by <utmpx.h> before it allows
  the utmpx code to work. This makes no sense to me. I've already
  mentioned this upstream.

- Add our own platform-specific handling of lastlog. The version I will
  send to the OpenSSH folks will use proper autoconf generated
  definitions instead of `#if 1'.
2010-01-13 18:43:32 +00:00
brooks
48e182a5c8 The size of credential messages is limited by CMGROUP_MAX rather than
NGROUPS.

MFC after:	1 week
2010-01-03 20:45:49 +00:00
cperciva
e4106d9e8f Disable SSL renegotiation in order to protect against a serious
protocol flaw. [09:15]

Correctly handle failures from unsetenv resulting from a corrupt
environment in rtld-elf. [09:16]

Fix permissions in freebsd-update in order to prevent leakage of
sensitive files. [09:17]

Approved by:	so (cperciva)
Security:	FreeBSD-SA-09:15.ssl
Security:	FreeBSD-SA-09:16.rtld
Security:	FreeBSD-SA-09:17.freebsd-udpate
2009-12-03 09:18:40 +00:00
attilio
99524169bf Avoid sshd, cron, syslogd and inetd to be killed under high-pressure swap
environments.
Please note that this can't be done while such processes run in jails.

Note: in future it would be interesting to find a way to do that
selectively for any desired proccess (choosen by user himself), probabilly
via a ptrace interface or whatever.

Obtained from:	Sandvine Incorporated
Reviewed by:	emaste, arch@
Sponsored by:	Sandvine Incorporated
MFC:		1 month
2009-11-25 15:12:24 +00:00
des
ca406db9c3 Fix globbing
Noticed by:	delphij, David Cornejo <dave@dogwood.com>
Forgotten by:	des
2009-11-10 09:45:43 +00:00
des
9c86ec8748 Remove dupe. 2009-10-11 14:27:33 +00:00
des
62e4403f72 Add more symbols that need to be masked:
- initialized and uninitialized data
 - symbols from roaming_dummy.c which end up in pam_ssh

Update the command line used to generate the #defines.
2009-10-05 18:55:13 +00:00
des
c6a1085fef Upgrade to OpenSSH 5.3p1. 2009-10-01 17:12:52 +00:00
simon
5868b7c961 Merge DTLS fixes from vendor-crypto/openssl/dist:
- Fix memory consumption bug with "future epoch" DTLS records.
- Fix fragment handling memory leak.
- Do not access freed data structure.
- Fix DTLS fragment bug - out-of-sequence message handling which could
  result in NULL pointer dereference in
  dtls1_process_out_of_seq_message().

Note that this will not get FreeBSD Security Advisory as DTLS is
experimental in OpenSSL.

MFC after:	1 week
Security:	CVE-2009-1377 CVE-2009-1378 CVE-2009-1379 CVE-2009-1387
2009-08-23 16:29:47 +00:00
simon
649055c02f Import DTLS fix from upstream OpenSSL 0.9.8 branch:
Fix memory consumption bug with "future epoch" DTLS records.

Note that this will not get FreeBSD Security Advisory as DTLS is
experimental in OpenSSL.

Security:	CVE-2009-1377
Obtained from:	OpenSSL CVS
		http://cvs.openssl.org/chngview?cn=18187
2009-08-23 13:58:25 +00:00
des
32589bd8e2 Update and remove CVS-specific items
Approved by:	re (kib)
2009-08-13 06:07:38 +00:00
simon
af8069fdc9 Remove symlinks in OpenSSL's testing framework. These are not required
for normal build, and doesn't export well to CVS.

If they are needed later a script will be added to recreate the symlinks
when needed at build time.

Approved by:	re (rwatson)
2009-08-12 12:10:00 +00:00
jhb
056d36800b Use the closefrom(2) system call.
Reviewed by:	des
2009-06-16 15:30:10 +00:00
simon
5fb395764b Merge OpenSSL 0.9.8k into head.
Approved by:	re
2009-06-14 19:45:16 +00:00
simon
fc5b6d55de Import OpenSSL 0.9.8k. 2009-06-07 19:56:18 +00:00
des
8bf56a9772 Upgrade to OpenSSH 5.2p1.
MFC after:	3 months
2009-05-22 18:46:28 +00:00
cperciva
442576453c Don't leak information via uninitialized space in db(3) records. [09:07]
Sanity-check string lengths in order to stop OpenSSL crashing
when printing corrupt BMPString or UniversalString objects. [09:08]

Security:	FreeBSD-SA-09:07.libc
Security:	FreeBSD-SA-09:08.openssl
Security:	CVE-2009-0590
Approved by:	re (kensmith)
Approved by:	so (cperciva)
2009-04-22 14:07:14 +00:00
simon
abe6016909 Prevent cross-site forgery attacks on lukemftpd(8) due to splitting
long commands into multiple requests. [09:01]

Fix incorrect OpenSSL checks for malformed signatures due to invalid
check of return value from EVP_VerifyFinal(), DSA_verify, and
DSA_do_verify. [09:02]

Security:	FreeBSD-SA-09:01.lukemftpd
Security:	FreeBSD-SA-09:02.openssl
Obtained from:	NetBSD [SA-09:01]
Obtained from:	OpenSSL Project [SA-09:02]
Approved by:	so (simon)
2009-01-07 20:17:55 +00:00
des
a9989b9d40 At some point, construct_utmp() was changed to use realhostname() to fill
in the struct utmp due to concerns about the length of the hostname buffer.
However, this breaks the UseDNS option.  There is a simpler and better
solution: initialize utmp_len to the correct value (UT_HOSTSIZE instead of
MAXHOSTNAMELEN) and let get_remote_name_or_ip() worry about the size of the
buffer.

PR:		bin/97499
Submitted by:	Bruce Cran <bruce@cran.org.uk>
MFC after:	1 week
2008-10-21 11:58:26 +00:00
des
a51772f108 Our groff doesn't understand $Mdocdate$, so replace them with bare dates.
MFC after:	3 days
2008-09-29 10:53:05 +00:00
des
ab1a43cf51 MFV "xmalloc: zero size" fix.
MFC after:	1 week
2008-09-24 21:20:44 +00:00
simon
859b6dcfcc Vendor import of OpenSSL 0.9.8i. 2008-09-21 14:56:30 +00:00
simon
798997ea06 Remove files from vendor tree which were not part of OpenSSL 0.9.8e
(last vendor import).

The file were removed in different earlier releases, but were not
removed from the CVS vendor branch at the time.
2008-09-21 14:12:30 +00:00
simon
8eda466e5c The vendor area is the proper home for these files now. 2008-09-21 13:18:25 +00:00
des
364610d759 Remove some unused files. 2008-09-01 16:34:02 +00:00
des
f50b650b57 Set SIZEOF_LONG_INT and SIZEOF_LONG_LONG_INT to plausible values. They
aren't used for anything, but that's no excuse for being silly.
2008-09-01 14:15:57 +00:00
simon
64fcbc70db Flatten OpenSSL vendor tree. 2008-08-23 10:51:00 +00:00
des
f53f7dd853 Use net.inet.ip.portrange.reservedhigh instead of IPPORT_RESERVED.
Submitted upstream, no reaction.

Submitted by:	delphij@
MFC after:	2 weeks
2008-08-20 10:40:07 +00:00
des
b7aa600c41 Upgrade to OpenSSH 5.1p1.
I have worked hard to reduce diffs against the vendor branch.  One
notable change in that respect is that we no longer prefer DSA over
RSA - the reasons for doing so went away years ago.  This may cause
some surprises, as ssh will warn about unknown host keys even for
hosts whose keys haven't changed.

MFC after:	6 weeks
2008-08-01 02:48:36 +00:00
des
f672f908e1 Another file with no local changes.
"This time for sure!"
2008-08-01 01:50:55 +00:00
des
47d27c283c Another file with no local changes. 2008-08-01 01:48:33 +00:00
des
d1eccf1850 Another four files without local changes. This is driving me nuts -
every time I think I got them all, another one pops up.
2008-08-01 01:45:56 +00:00
des
0afede05d8 Yet another file with no local changes. 2008-08-01 01:38:50 +00:00
des
9472224e68 Accidentally mangled this one in the previous commit. 2008-08-01 01:38:24 +00:00
des
ab05c9d6e0 More files which no longer have any local changes. 2008-08-01 01:32:56 +00:00
des
aec4b2ce63 These two files have no local patches except to prevent expansion of the
original $FreeBSD$ keywords.  Revert those changes, and simply disable
keyword expansion.
2008-08-01 01:30:26 +00:00
des
c16d19ef38 Last remains of old OPIE patch 2008-08-01 01:24:42 +00:00
des
1d5516fdb1 We no longer have any local changes here. 2008-08-01 01:19:13 +00:00
des
0a6d19e874 Tag expansion is no longer needed (svn handles them correctly).
Add svn command to diff against vendor branch.
2008-08-01 01:05:27 +00:00
des
e4b4e186ba This is no longer needed. 2008-08-01 01:04:52 +00:00
des
ed6e3a816d Cleanup. 2008-08-01 01:00:34 +00:00
des
fa78b524d4 Ugh. Set svn:mergeinfo correctly. 2008-08-01 00:34:37 +00:00
des
ce65202984 Catch up with reality. 2008-08-01 00:28:50 +00:00
des
e253d923d4 Revert an old hack I put in to replace S/Key with OPIE. We haven't used
that code in ages - we use pam_opie(8) instead - so this is a NOP.
2008-08-01 00:27:48 +00:00
des
a0701212a1 Add missing #include for strlen() 2008-07-31 23:33:26 +00:00
des
0c146c189c Fix alignment of the cmsg buffer by placing it in a union with a struct
cmsghdr.  Derived from upstream patch.

Submitted by:	cognet
MFC after:	2 weeks
2008-07-30 09:16:46 +00:00
des
01d1a97b94 Remove a bunch of files we don't need to build OpenSSH. They are still
available in base/vendor-crypto/openssh/dist/.
2008-07-23 17:02:25 +00:00
des
f1596419c2 Properly flatten openssh/dist. 2008-07-22 19:01:18 +00:00
des
666aa9cc16 Revert part of 180714 - the intent was to flatten dist, not to nuke it. 2008-07-22 18:58:19 +00:00
des
624d93001f Flatten the OpenSSH vendor tree for 3.x and newer. 2008-07-22 17:13:05 +00:00
dfr
be0348cb75 Fix conflicts after heimdal-1.1 import and add build infrastructure. Import
all non-style changes made by heimdal to our own libgssapi.
2008-05-07 13:53:12 +00:00
dfr
51b6601db4 Vendor import of Heimdal 1.1 2008-05-07 13:39:42 +00:00
dfr
52bf09d819 This commit was generated by cvs2svn to compensate for changes in r178825,
which included commits to RCS files with non-trunk default branches.
2008-05-07 13:39:42 +00:00
des
081081cbe3 Fix the Xlist so it actually works with 'tar -X', and update the upgrade
instructions accordingly.
2008-02-06 23:14:24 +00:00
des
76b6e0b06e As per discussion, commit experimental metadata for my contrib packages.
The idea is to have a FREEBSD-vendor file for every third-party package
in the tree.
2008-02-06 23:06:24 +00:00
simon
1ee7c30aa9 Unbreak detection of cryptodev support for FreeBSD which was broken
with OpenSSL 0.9.8 import.

Note that this does not enable cryptodev by default, as it was the
case with OpenSSL 0.9.7 in FreeBSD base, but this change makes it
possible to enable cryptodev at all.

This has been submitted upstream as:
http://rt.openssl.org/Ticket/Display.html?id=1624

Submitted by:	nork
2008-01-13 11:44:47 +00:00
simon
8f21bfc175 Import DTLS security fix from upstream OpenSSL_0_9_8-stable branch.
From the OpenSSL advisory:

	Andy Polyakov discovered a flaw in OpenSSL's DTLS
	implementation which could lead to the compromise of clients
	and servers with DTLS enabled.

	DTLS is a datagram variant of TLS specified in RFC 4347 first
	supported in OpenSSL version 0.9.8. Note that the
	vulnerabilities do not affect SSL and TLS so only clients and
	servers explicitly using DTLS are affected.

	We believe this flaw will permit remote code execution.

Security:	CVE-2007-4995
Security:	http://www.openssl.org/news/secadv_20071012.txt
2007-10-18 20:19:33 +00:00
simon
efafc844b6 This commit was generated by cvs2svn to compensate for changes in r172767,
which included commits to RCS files with non-trunk default branches.
2007-10-18 20:19:33 +00:00
peter
0dcad926c5 Remove _FREEFALL_CONFIG hacks. su+pam_ksu works well enough to use on
the freebsd.org cluster.
2007-10-18 19:36:31 +00:00
simon
6d467b2229 Correct a buffer overflow in OpenSSL SSL_get_shared_ciphers().
Security:	FreeBSD-SA-07:08.openssl
Approved by:	re (security blanket)
2007-10-03 21:38:57 +00:00
des
91a576f9b7 s/X11R6/local/g 2007-05-24 22:04:07 +00:00
simon
fbc9e81620 Fix runtime crash in OpenSSL with "Illegal instruction" by making some
casts a bit less evil.

This was e.g. seen when using portsnap as:

  Fetching snapshot tag from portsnap3.FreeBSD.org... Illegal instruction

Note the patch is slightly different from kan's original patch to
match style in the OpenSSL source files a bit better.

Submitted by:	kan
Tested by:	many
2007-05-22 20:28:19 +00:00
simon
9bb7d4296b - Bring upgrade produce up-to-date for OpenSSL 0.9.8e.
- Add reminder to bump version numer in Makefile.inc.
2007-03-15 21:06:48 +00:00
simon
8e9898839e Import fix from upstream OpenSSL_0_9_8-stable branch:
EVP_CIPHER_CTX_key_length() should return the set key length
	in the EVP_CIPHER_CTX structure which may not be the same as
	the underlying cipher key length for variable length ciphers.

This fixes problems in OpenSSH using some ciphers, and possibly other
applications.

See also:	http://bugzilla.mindrot.org/show_bug.cgi?id=1291
2007-03-15 20:26:26 +00:00
simon
86271f334e This commit was generated by cvs2svn to compensate for changes in r167617,
which included commits to RCS files with non-trunk default branches.
2007-03-15 20:26:26 +00:00
simon
394ba190a3 Resolve conflicts after import of OpenSSL 0.9.8e. 2007-03-15 20:07:27 +00:00
simon
ee48ceb6a8 Vendor import of OpenSSL 0.9.8e. 2007-03-15 20:03:30 +00:00
simon
699a8581f9 This commit was generated by cvs2svn to compensate for changes in r167612,
which included commits to RCS files with non-trunk default branches.
2007-03-15 20:03:30 +00:00
des
f486315183 Resolve conflicts. 2006-11-10 16:52:41 +00:00
des
f591b3e29c Vendor import of OpenSSH 4.5p1. 2006-11-10 16:39:21 +00:00
des
11e3a8c8c1 This commit was generated by cvs2svn to compensate for changes in r164146,
which included commits to RCS files with non-trunk default branches.
2006-11-10 16:39:21 +00:00
des
d75fd1fec6 Don't define XAUTH_PATH here, we either pass it in on the compiler command
line or rely on the built-in default.
2006-10-06 14:27:26 +00:00
des
91390ee9f2 Go figure how an extra $Id$ line crept in... 2006-10-04 10:21:00 +00:00
des
178eb45ceb Merge vendor patch. 2006-10-04 10:15:53 +00:00
des
e6cc400c8f Apply vendor patch to fix detection of tap / tun headers and ENGINE support. 2006-10-04 10:14:30 +00:00
des
351bcb5c21 Tweak ifdefs for backward compatibility. 2006-10-03 11:33:25 +00:00
des
24e2cf96ac Dead files. 2006-10-02 13:29:41 +00:00
des
a74a69e336 Regenerate; no effect on the code as it doesn't actually use the handful of
conditionals that changed in this revision.
2006-10-02 12:45:27 +00:00
des
14ad83d6bf Update configure options and add some missing steps.
The section about our local changes needs reviewing, and some of those
changes should probably be reconsidered (such as preferring DSA over RSA,
which made sense when RSA was encumbered but probably doesn't any more)
2006-10-02 12:39:28 +00:00
simon
25dab5b4c1 Import from upstream OpenSSL 0.9.8 branch:
Fix uninitialized free of ctx in compute_key() when the
OPENSSL_DH_MAX_MODULUS_BITS check is triggered.

This fixes the same issue as FreeBSD-SA-06:23.openssl v1.1.
2006-10-01 08:09:46 +00:00
simon
ac7fb23be5 This commit was generated by cvs2svn to compensate for changes in r162916,
which included commits to RCS files with non-trunk default branches.
2006-10-01 08:09:46 +00:00
simon
de193995a6 Resolve conflicts after import of OpenSSL 0.9.8d. 2006-10-01 07:46:16 +00:00
simon
387e65d767 Vendor import of OpenSSL 0.9.8d. 2006-10-01 07:38:44 +00:00
simon
b2881e9eb1 This commit was generated by cvs2svn to compensate for changes in r162911,
which included commits to RCS files with non-trunk default branches.
2006-10-01 07:38:44 +00:00
des
0824f0c0e7 Regenerate.
MFC after:	1 week
2006-09-30 13:40:56 +00:00
des
ac038c1070 #include <errno.h>; this has the unfortunate side effect of taking the file
off the vendor branch.

MFC after:	1 week
2006-09-30 13:40:35 +00:00
des
0f481d7c8c Removed from vendor branch.
MFC after:	1 week
2006-09-30 13:39:35 +00:00
des
e16bfbb7bc Bump version addendum.
MFC after:	1 week
2006-09-30 13:39:07 +00:00
des
4ff234ef46 Merge conflicts.
MFC after:	1 week
2006-09-30 13:38:06 +00:00
des
2f35ce4773 Vendor import of OpenSSH 4.4p1. 2006-09-30 13:29:51 +00:00
des
abd7c8704b This commit was generated by cvs2svn to compensate for changes in r162852,
which included commits to RCS files with non-trunk default branches.
2006-09-30 13:29:51 +00:00
des
97a1b8f884 Merge vendor patch for BSM problem in protocol version 1.
MFC after:	1 week
2006-09-16 15:12:58 +00:00
des
03ef9d989b Vendor patch for a problem that prevented using protocol version 1 when
BSM was enabled.
2006-09-16 15:10:13 +00:00
simon
22f3e61de2 Correct incorrect PKCS#1 v1.5 padding validation in crypto(3).
Obtained from:	OpenSSL project
Security:	FreeBSD-SA-06:19.openssl
2006-09-10 20:16:43 +00:00
simon
76f00e0285 Resolve conflicts after import of OpenSSL 0.9.8b.
This was missed the first time around since eng_padlock.c was not part
of OpenSSL 0.9.7e and therefor did not have the v0_9_7e CVS tag used
during original resolve of conflicts.

Noticed by:	Antoine Brodin <antoine.brodin@laposte.net>
2006-07-30 14:17:54 +00:00
simon
870bdce538 Sync FREEBSD-Xlist with what was actually excluded from OpenSSL 0.9.8b
import.
2006-07-29 22:40:45 +00:00
simon
00e07ea415 Add some rough notes on how to import a new OpenSSL version into the
FreeBSD base system.  Parts are inspired by the OpenSSH upgrade notes.
2006-07-29 22:01:26 +00:00
simon
e07cc0214a Resolve conflicts after import of OpenSSL 0.9.8b. 2006-07-29 19:14:51 +00:00
simon
fb3c70eda8 Vendor import of OpenSSL 0.9.8b 2006-07-29 19:10:21 +00:00
simon
9159ca2b0e This commit was generated by cvs2svn to compensate for changes in r160814,
which included commits to RCS files with non-trunk default branches.
2006-07-29 19:10:21 +00:00
des
d9ba51b5fc Our glob(3) has all the required features.
Submitted by:	ache
2006-06-09 08:39:05 +00:00
des
a34ad0a5f7 Revert inadvertant commit of debugging code. 2006-06-09 07:23:14 +00:00
des
148092431d Introduce a namespace munging hack inspired by NetBSD to avoid polluting
the namespace of applications which inadvertantly link in libssh (usually
through pam_ssh)

Suggested by:	lukem@netbsd.org
MFC after:	6 weeks
2006-05-13 13:47:45 +00:00
des
9c68158992 Fix utmp. There is some clever logic in configure.ac which attempts to
determine whether struct utmp contains the ut_host and ut_time fields.
Unfortunately, it reports a false negative for both on FreeBSD, and I
didn't check the resulting config.h closely enough to catch the error.

Noticed by:	ache
2006-03-23 21:31:42 +00:00
des
eb091e1fc6 Regenerate. 2006-03-22 20:41:53 +00:00
des
7c07891caf Merge conflicts. 2006-03-22 20:41:37 +00:00
des
448503722a Vendor import of OpenSSH 4.3p1. 2006-03-22 19:46:12 +00:00
des
c2efe9a305 This commit was generated by cvs2svn to compensate for changes in r157016,
which included commits to RCS files with non-trunk default branches.
2006-03-22 19:46:12 +00:00
ru
388e590f95 Reimplementation of world/kernel build options. For details, see:
http://lists.freebsd.org/pipermail/freebsd-current/2006-March/061725.html

The src.conf(5) manpage is to follow in a few days.

Brought to you by:	imp, jhb, kris, phk, ru (all bugs are mine)
2006-03-17 18:54:44 +00:00
dfr
65ca66cee3 Fix the amd64 (and presumably ia64) lib32 build by ensuring that the
heimdal GSS-API mechanism uses its own version of gssapi.h, including all
the implementation-dependant pollution contained therein.

This moves the file off the vendor branch, sadly.

Submitted by: bz
2006-01-02 11:28:42 +00:00
dfr
d9cbcb50b5 Add a new extensible GSS-API layer which can support GSS-API plugins,
similar the the Solaris implementation. Repackage the krb5 GSS mechanism
as a plugin library for the new implementation. This also includes a
comprehensive set of manpages for the GSS-API functions with text mostly
taken from the RFC.

Reviewed by: Love Hörnquist Åstrand <lha@it.su.se>, ru (build system), des (openssh parts)
2005-12-29 14:40:22 +00:00
cperciva
45ad656456 Correct a man-in-the-middle SSL version rollback vulnerability.
Security:	FreeBSD-SA-05:21.openssl
2005-10-11 11:50:36 +00:00
des
fbfe6dd7e0 Regenerate 2005-09-03 07:08:51 +00:00
des
88c7c9558b Resolve conflicts. 2005-09-03 07:04:25 +00:00
des
755a16fa86 Vendor import of OpenSSH 4.2p1. 2005-09-03 06:59:33 +00:00
des
1ea3628aba This commit was generated by cvs2svn to compensate for changes in r149749,
which included commits to RCS files with non-trunk default branches.
2005-09-03 06:59:33 +00:00
des
f0dcade643 fine-tune. 2005-09-03 06:42:11 +00:00
kensmith
28b7f562fc This is sort of an MFS. Peter made these changes to the RELENG_*
branches but missed HEAD.  This patch extends his a little bit,
setting it up via the Makefiles so that adding _FREEFALL_CONFIG
to /etc/make.conf is the only thing needed to cluster-ize things
(current setup also requires overriding CFLAGS).

From Peter's commit to the RELENG_* branches:
> Add the freebsd.org custer's source modifications under #ifdefs to aid
> keeping things in sync.  For ksu:
> * install suid-root by default
> * don't fall back to asking for a unix password (ie: be pure kerberos)
> * allow custom user instances for things like www and not just root

The Makefile tweaks will be MFC-ed, the rest is already done.

MFC after:      3 days
Approved by:    re (dwhite)
2005-07-07 14:16:38 +00:00
des
af7fe6f7d6 Forgot to bump the version addendum. 2005-06-05 18:30:53 +00:00
des
ec61b1c40a Regenerate. 2005-06-05 15:46:27 +00:00
des
983ad11a1c Resolve conflicts. 2005-06-05 15:46:09 +00:00
des
3c5bc6b274 Update for 4.1p1. 2005-06-05 15:43:57 +00:00
des
c4dfc1ed3b Vendor import of OpenSSH 4.1p1. 2005-06-05 15:41:57 +00:00
des
35c298a910 This commit was generated by cvs2svn to compensate for changes in r147001,
which included commits to RCS files with non-trunk default branches.
2005-06-05 15:41:57 +00:00
des
11a09ab416 Vendor import of OpenSSH 4.0p1. 2005-06-05 15:40:50 +00:00
des
7688286f9d This commit was generated by cvs2svn to compensate for changes in r146998,
which included commits to RCS files with non-trunk default branches.
2005-06-05 15:40:50 +00:00
des
9230b25dd7 Rewrite some of the regexps so they don't match themselves. 2005-06-04 23:18:33 +00:00
nectar
21cef1ac2a File removed in update from OpenSSL 0.9.7d -> 0.9.7e. 2005-02-25 06:22:30 +00:00
nectar
3c8d7d9993 Remove files that are no longer part of OpenSSL from the vendor
branch.  This time, these are mostly the `Makefile.ssl' files.
2005-02-25 06:14:53 +00:00
nectar
0d4d2c2cec This commit was generated by cvs2svn to compensate for changes in r142430,
which included commits to RCS files with non-trunk default branches.
2005-02-25 06:14:53 +00:00
nectar
ced877b043 Resolve conflicts after import of OpenSSL 0.9.7e. 2005-02-25 05:49:44 +00:00
nectar
78a59572b3 Vendor import of OpenSSL 0.9.7e. 2005-02-25 05:39:05 +00:00
nectar
52bc459a40 This commit was generated by cvs2svn to compensate for changes in r142425,
which included commits to RCS files with non-trunk default branches.
2005-02-25 05:39:05 +00:00
nectar
a876e908ea Update list of files to remove prior to import of OpenSSL 0.9.7e. 2005-02-25 05:31:23 +00:00
nectar
a55ec1447a Clean up the OpenSSL vendor branch by removing files that are not
part of recent releases.
2005-02-25 05:25:37 +00:00
nectar
86364e2030 This commit was generated by cvs2svn to compensate for changes in r142421,
which included commits to RCS files with non-trunk default branches.
2005-02-25 05:25:37 +00:00
nectar
2565fa1348 Vendor import of Heimdal 0.6.3. 2005-02-24 22:22:53 +00:00
nectar
cf46be8ba9 This commit was generated by cvs2svn to compensate for changes in r142403,
which included commits to RCS files with non-trunk default branches.
2005-02-24 22:22:53 +00:00
nectar
3dc1e39cf7 Do not include lib/kdfs in future imports. 2005-02-24 22:17:13 +00:00
nectar
1473734316 Remove lib/kdfs from vendor branch: we do not build it, and it will not
be included in future imports.
2005-02-24 22:16:35 +00:00
nectar
412870c336 Clean up the Heimdal vendor branch by removing files not included in
any import for several years.

If memory serves, this was
Suggested by:	ru
an awfully long time ago-- sorry for the delay!
2005-02-24 22:14:04 +00:00
des
2ed082fd66 Better Xlist command line. 2004-10-28 16:13:28 +00:00
des
a744ec13ad Resolve conflicts 2004-10-28 16:11:31 +00:00
des
d5d493f03a Vendor import of OpenSSH 3.9p1. 2004-10-28 16:03:53 +00:00
des
b0cdf22191 This commit was generated by cvs2svn to compensate for changes in r137015,
which included commits to RCS files with non-trunk default branches.
2004-10-28 16:03:53 +00:00
des
0a4f1e0cd4 These are unnecessary and have been causing imp@ trouble. 2004-10-27 19:07:36 +00:00
markm
1659a5207b Add support for C3 Nehemiah ACE ("Padlock") AES crypto. This comes
from OpenSSL 0.9.5 (yet to be released), and is pretty complete.
2004-08-14 13:38:35 +00:00
markm
402a1009de Bring in support for VIA C3 Nehemiah Padlock crypto support (AES).
This is from the upcoming OpenSSL 0.9.8 release.
2004-08-13 19:37:23 +00:00
markm
d57fb14ce4 This commit was generated by cvs2svn to compensate for changes in r133665,
which included commits to RCS files with non-trunk default branches.
2004-08-13 19:37:23 +00:00
des
aaa4408d55 Regenerate. 2004-04-20 09:49:37 +00:00
des
6e7fa35a0a One more conflict. 2004-04-20 09:47:13 +00:00
des
e5d801b2d6 Resolve conflicts. 2004-04-20 09:46:41 +00:00
des
efa3572464 Adjust version number and addendum. 2004-04-20 09:37:29 +00:00
des
c69db9c5a2 Vendor import of OpenSSH 3.8.1p1. 2004-04-20 09:35:04 +00:00
des
13038249fe This commit was generated by cvs2svn to compensate for changes in r128456,
which included commits to RCS files with non-trunk default branches.
2004-04-20 09:35:04 +00:00
nectar
4f072b64b0 Repair a regression in OpenSSL 0.9.7d: processing an unsigned PKCS#7
object could cause a null pointer dereference.

Obtained from:	OpenSSL CVS (change number 12080)
MFC After:	1 day
Reported by:	Daniel Lang <dl@leo.org>
2004-04-05 19:01:57 +00:00
nectar
e0710a2e71 This commit was generated by cvs2svn to compensate for changes in r127904,
which included commits to RCS files with non-trunk default branches.
2004-04-05 19:01:57 +00:00
nectar
26e61e0326 Resolve conflicts after import of Heimdal 0.6.1. 2004-04-03 21:31:10 +00:00
nectar
bfc5316dea Vendor import of Heimdal 0.6.1. 2004-04-03 21:22:55 +00:00
nectar
0b7467aa1d This commit was generated by cvs2svn to compensate for changes in r127808,
which included commits to RCS files with non-trunk default branches.
2004-04-03 21:22:55 +00:00
nectar
2283471bb5 Resolve conflicts after import of OpenSSL 0.9.7d. 2004-03-17 17:44:39 +00:00
nectar
0f095e8a2a Vendor import of OpenSSL 0.9.7d. 2004-03-17 15:49:33 +00:00
nectar
15b921d648 This commit was generated by cvs2svn to compensate for changes in r127128,
which included commits to RCS files with non-trunk default branches.
2004-03-17 15:49:33 +00:00
nectar
e8232d78ab Correct a denial-of-service vulnerability in OpenSSL (CAN-2004-0079).
Obtained from:	OpenSSL CVS (http://cvs.openssl.org/chngview?cn=12033)
2004-03-17 12:11:08 +00:00
nectar
5899dbda42 This commit was generated by cvs2svn to compensate for changes in r127114,
which included commits to RCS files with non-trunk default branches.
2004-03-17 12:11:08 +00:00
des
2fe413a41a Correctly document the default value of UsePAM. 2004-03-15 18:38:29 +00:00
des
437b8c0fdd Update VersionAddendum in config files and man pages. 2004-02-26 11:54:03 +00:00
des
c05d4b9b43 Define HAVE_GSSAPI_H. 2004-02-26 11:06:29 +00:00
des
77d6d5a07e Regenerate. 2004-02-26 10:57:38 +00:00
des
c7ba229763 Document recently changed configuration defaults. 2004-02-26 10:57:28 +00:00
des
124c4a1415 Resolve conflicts. 2004-02-26 10:52:33 +00:00
des
7d1750f1d6 Vendor import of OpenSSH 3.8p1. 2004-02-26 10:38:49 +00:00
des
1754c77e5e This commit was generated by cvs2svn to compensate for changes in r126274,
which included commits to RCS files with non-trunk default branches.
2004-02-26 10:38:49 +00:00
des
b1ffd1f6ac Merge OpenSSH 3.8p1. 2004-02-26 10:38:38 +00:00
des
270e7d7140 Prepare for upcoming 3.8p1 import. 2004-02-26 10:37:34 +00:00
des
85717525b0 Pull asbesthos underpants on and disable protocol version 1 by default. 2004-02-26 10:24:07 +00:00
des
49dee586c1 Turn non-PAM password authentication off by default when USE_PAM is
defined.  Too many users are getting bitten by it.
2004-02-19 15:53:31 +00:00
des
84ff378ae4 Update the "overview of FreeBSD changes to OpenSSH-portable" to reflect
reality.
2004-01-25 13:09:56 +00:00
des
31d02c599b Work around removal of EAI_NODATA from netdb.h. 2004-01-18 22:31:30 +00:00
nectar
8c8a5a2b0b Re-add the FreeBSD RCS keyword for the benefit of mergemaster.
PR:		conf/50040
Requested by:	Dimitry Andric <dim@xs4all.nl>
2004-01-09 14:46:11 +00:00
des
5c8d98dfbd Don't output the terminating '\0' (already fixed in OpenSSH CVS) 2004-01-09 12:57:36 +00:00
des
c3b2098e8b This commit was generated by cvs2svn to compensate for changes in r124287,
which included commits to RCS files with non-trunk default branches.
2004-01-09 12:57:36 +00:00
des
f773ff17e4 Egg on my face: UsePAM was off by default.
Pointed out by:	Sean McNeil <sean@mcneil.com>
2004-01-09 08:07:12 +00:00
des
59fac3f07b Regenerate config.h; I don't know why this didn't hit CVS yesterday. 2004-01-08 09:42:35 +00:00
des
bd159d8b4f Remove obsolete files on the vendor branch. 2004-01-08 09:33:46 +00:00
des
ee97d7f67c Update to reflect changes since the last version. 2004-01-07 11:51:18 +00:00
des
7545fb1c7e Resolve conflicts and remove obsolete files.
Sponsored by:	registrar.no
2004-01-07 11:16:27 +00:00
des
b5d16e7138 Vendor import of OpenSSH 3.7.1p2. 2004-01-07 11:10:17 +00:00
des
b5f9e06a6d This commit was generated by cvs2svn to compensate for changes in r124208,
which included commits to RCS files with non-trunk default branches.
2004-01-07 11:10:17 +00:00
des
fd8a3b71eb Merge OpenSSH 3.7.1p2. 2004-01-07 11:10:02 +00:00
simon
b25ecb5dd4 Add a missing word.
Submitted by:	Michel Lavondes <fox@vader.aacc.cc.md.us>
Reviewed by:	des
MFC after:	1 week
2003-10-31 21:49:47 +00:00
des
365ce457b0 Plug a memory leak in the PAM child process. It is of no great consequence
as the process is short-lived, and the leak occurs very rarely and always
shortly before the process terminates.

MFC after:	3 days
2003-10-23 08:27:16 +00:00
nectar
084fdb0d6e Correct badly-formed code (missing quote) within `#if 0' section.
Newer versions of GCC error in such situations.

Obtained from:	Heimdal CVS
2003-10-09 19:52:14 +00:00