summaryrefslogtreecommitdiffstats
path: root/crypto/openssh
Commit message (Collapse)AuthorAgeFilesLines
* Fix multiple vulnerabilities of OpenSSH.delphij2017-01-113-9/+49
| | | | | | | Security: FreeBSD-SA-17:01.openssh Security: CVE-2016-10009 Security: CVE-2016-10010 Approved by: so
* Fix OpenSSH remote Denial of Service vulnerability. [SA-16:33]delphij2016-11-021-0/+1
| | | | | | | | Fix OpenSSL remote DoS vulnerability. [SA-16:35] Security: FreeBSD-SA-16:33.openssh Security: FreeBSD-SA-16:35.openssl Approved by: so
* MFS (r296781):des2016-03-14141-3295/+5777
| | | | | | | | | | MFH (r296633): upgrade to 7.2p2 (fixes xauth command injection bug) MFH (r296634): re-add aes-cbc to server-side default cipher list MFH (r296651, r296657): fix gcc build of pam_ssh PR: 207679 Security: CVE-2016-3115 Approved by: re (marius)
* MFH (r265214, r294333, r294407, r294467): misc prop fixesdes2016-02-07467-24586/+46067
| | | | | | | | | | | | | | | | MFH (r285975, r287143): register mergeinfo for security fixes MFH (r294497, r294498, r295139): internal documentation MFH (r294328): upgrade to openssh 6.7p1, re-add libwrap MFH (r294332): upgrade to openssh 6.8p1 MFH (r294367): update pam_ssh for api changes MFH (r294909): switch usedns back on MFH (r294336): upgrade to openssh 6.9p1 MFH (r294495): re-enable dsa keys MFH (r294464): upgrade to openssh 7.0p1 MFH (r294496): upgrade to openssh 7.1p2 Approved by: re (gjb) Relnotes: yes
* MFH (r291198, r291260, r291261, r291375, r294325, r294335, r294563)des2016-01-2444-776/+169
| | | | Remove the HPN and None cipher patches.
* MFH (r263234, r263691, r266465, r290671, r290672, r290673, r290674,des2016-01-2453-22220/+152
| | | | | | r294320, r294322, r294324, r294330, r294469, r294494, r294466) Reduce diffs to head in preparation for removing HPN and None.
* MFH (r292408): use correct length in calloc() calldes2016-01-161-1/+1
|
* Merge r294048: fix OpenSSH client information leak.glebius2016-01-141-3/+2
| | | | | Security: SA-16:07.openssh Security: CVE-2016-0777
* MFC: Fix OpenSSH multiple vulnerabilities.delphij2015-08-253-6/+7
| | | | Security: FreeBSD-SA-15:22.openssh
* Fix patch(1) shell injection vulnerability. [SA-15:14]delphij2015-07-282-18/+33
| | | | | | Fix resource exhaustion in TCP reassembly. [SA-15:15] Fix OpenSSH multiple vulnerabilities. [SA-15:16]
* MFC r285642vangyzen2015-07-211-0/+17
| | | | | | | | | | | | | | | | ssh: canonicize the host name before looking it up in the host file Re-apply r99054 by des in 2002. This was accidentally dropped by the update to OpenSSH 6.5p1 (r261320). This change is actually taken from r387082 of ports/security/openssh-portable/files/patch-ssh.c Differential Revision: https://reviews.freebsd.org/D3103 PR: 198043 Approved by: re (gjb), kib (mentor) Sponsored by: Dell Inc. Relnotes: yes
* MFH (r283578): import new moduli from upstreamdes2015-06-301-261/+275
|
* MFC r280999:bdrewery2015-04-231-1/+1
| | | | Use proper CHAN_TCP_PACKET_DEFAULT for agent forwarding when HPN disabled.
* MFC r280360:bdrewery2015-04-072-2/+8
| | | | Document "none" for VersionAddendum.
* Merge an applicable subset of r263234 from HEAD to stable/10:rwatson2015-03-191-1/+1
| | | | | | | | | | | | | Update most userspace consumers of capability.h to use capsicum.h instead. auditdistd is not updated as I will make the change upstream and then do a vendor import sometime in the next week or two. Note that a significant fraction does not apply, as FreeBSD 10 doesn't contain a Capsicumised ping, casperd, libcasper, etc. When these features are merged, the capsicum.h change will need to be merged with them. Sponsored by: Google, Inc.
* MFH (r264691): merge upstream patch for EC calculation bugdes2014-04-2010-9/+35
|
* MFH (r263712): upgrade openssh to 6.6p1des2014-04-12123-2462/+1522
| | | | MFH (r264308): restore p level in debugging output
* MFC r261499 (pjd):delphij2014-03-031-2/+4
| | | | Fix installations that use kernels without CAPABILITIES support.
* MFH (r261320): upgrade openssh to 6.5p1des2014-02-27204-4435/+13545
| | | | MFH (r261340): enable sandboxing by default
* MFH (r257954): upgrade to OpenSSH 6.4p1des2013-11-1926-53/+69
| | | | Approved by: re (kib)
* Pre-zero the MAC context.des2013-11-191-1/+1
| | | | | | Security: CVE-2013-4548 Security: FreeBSD-SA-13:14.openssh Approved by: re (implicit)
* Unbreak the WITHOUT_KERBEROS build and try to reduce the odds of ades2013-09-236-17/+64
| | | | | | | | | repeat performance by introducing a script that runs configure with and without Kerberos, diffs the result and generates krb5_config.h, which contains the preprocessor macros that need to be defined in the Kerberos case and undefined otherwise. Approved by: re (marius)
* Pull in all the OpenSSH bits that we'd previously left out because wedes2013-09-21146-0/+43001
|\ | | | | | | | | | | | | didn't use them. This will make future merges from the vendor tree much easier. Approved by: re (gjb)
* \ Upgrade to 6.3p1.des2013-09-21154-2393/+4264
|\ \ | |/ | | | | Approved by: re (gjb)
* | Change the default value of VerifyHostKeyDNS to "yes" if compiled withdes2013-09-103-1/+11
| | | | | | | | | | | | | | | | LDNS. With that setting, OpenSSH will silently accept host keys that match verified SSHFP records. If an SSHFP record exists but could not be verified, OpenSSH will print a message and prompt the user as usual. Approved by: re (blanket)
* | These three files appeared in 6.0p1, which was imported into the vendordes2013-09-093-0/+558
|\ \ | |/ | | | | | | | | | | | | | | branch but never merged to head. They were inadvertantly left out when 6.1p1 was merged to head. It didn't make any difference at the time, because they were unused, but one of them is required for DNS-based host key verification. Approved by: re (blanket)
* | Apply upstream revision 1.151 (fix relative symlinks)des2013-08-131-1/+2
| | | | | | | | MFC after: 3 days
* | r251088 reverted the default value for UsePrivilegeSeparation fromdes2013-06-282-2/+2
| | | | | | | | "sandbox" to "yes", but did not update the documentation to match.
* | Revert a local change that sets the default for UsePrivilegeSeparation todes2013-05-291-1/+1
| | | | | | | | | | | | "sandbox" instead of "yes". In sandbox mode, the privsep child is unable to load additional libraries and will therefore crash when trying to take advantage of crypto offloading on CPUs that support it.
* | Upgrade to OpenSSH 6.2p2. Mostly a no-op since I had already patcheddes2013-05-1712-30/+65
| | | | | | | | the issues that affected us.
* | The HPN patch added a new BUG bit for SSH_BUG_LARGEWINDOWbdrewery2013-05-131-1/+1
| | | | | | | | | | | | | | | | | | | | and the update to 6.1 added SSH_BUG_DYNAMIC_RPORT with the same value. Fix the HPN SSH_BUG_LARGEWINDOW bit so it is unique. Approved by: des MFC after: 2 weeks
* | Merge updated "no such identity file" patch.des2013-04-243-34/+29
| | | | | | | | PR: bin/178060
* | Silence "received disconnect" in the common case.des2013-04-141-2/+6
| |
* | Merge upstream patch to silence spurious "no such identity file" warnings.des2013-04-024-14/+29
| |
* | Silence printf format warnings.des2013-04-021-5/+10
| |
* | Silence warnings about redefined macros.des2013-04-011-0/+4
| |
* | Revert r247892 now that this has been fixed upstream.des2013-03-231-1/+0
| |
* | Upgrade to OpenSSH 6.2p1. The most important new features are supportdes2013-03-2294-1239/+4986
|\ \ | |/ | | | | for a key revocation list and more fine-grained authentication control.
* | Keep the default AuthorizedKeysFile setting. Although authorized_keys2des2013-03-181-2/+1
| | | | | | | | | | | | | | | | | | | | | | has been deprecated for a while, some people still use it and were unpleasantly surprised by this change. I may revert this commit at a later date if I can come up with a way to give users who still have authorized_keys2 files sufficient advance warning. MFC after: ASAP
* | Unlike OpenBSD's, our setusercontext() will intentionally ignore the user'sdes2013-03-131-0/+6
| | | | | | | | | | | | | | | | | | own umask setting (from ~/.login.conf) unless running with the user's UID. Therefore, we need to call it again with LOGIN_SETUMASK after changing UID. PR: bin/176740 Submitted by: John Marshall <john.marshall@riverwillow.com.au> MFC after: 1 week
* | Partially revert r247892 and r247904 since our strnvis() does notdes2013-03-072-2/+5
| | | | | | | | behave the way OpenSSH expects.
* | Remove strnvis(), strvis(), strvisx().des2013-03-061-3/+0
| |
* | Explicitly disable lastlog, utmp and wtmp.des2013-03-062-8/+44
| |
* | Upgrade OpenSSH to 6.1p1.des2012-09-0395-1090/+2649
| |
* | MFV (r237567):delphij2012-06-252-6/+9
| | | | | | | | | | | | | | | | Fetch both ECDSA and RSA keys by default in ssh-keyscan(1). Approved by: des Obtained from: OpenSSH portable MFC after: 1 week
* | OpenSSH: allow VersionAddendum to be used againrea2012-05-275-28/+60
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Prior to this, setting VersionAddendum will be a no-op: one will always have BASE_VERSION + " " + VERSION_HPN for VersionAddendum set in the config and a bare BASE_VERSION + VERSION_HPN when there is no VersionAddendum is set. HPN patch requires both parties to have the "hpn" inside their advertized versions, so we add VERSION_HPN to the VERSION_BASE if HPN is enabled and omitting it if HPN is disabled. VersionAddendum now uses the following logics: * unset (default value): append " " and VERSION_ADDENDUM; * VersionAddendum is set and isn't empty: append " " and VersionAddendum; * VersionAddendum is set and empty: don't append anything. Approved by: des Reviewed by: bz MFC after: 3 days
* | Polish diff against upstream.ed2012-02-1313-54/+50
| | | | | | | | | | | | | | | | | | | | - Revert unneeded whitespace changes. - Revert modifications to loginrec.c, as the upstream version already does the right thing. - Fix indentation and whitespace of local changes. Approved by: des MFC after: 1 month
* | Add a -x option that causes ssh-agent(1) to exit when all clients havedes2011-10-072-4/+32
| | | | | | | | | | | | disconnected. MFC after: 1 week
* | Upgrade to OpenSSH 5.9p1.des2011-10-0586-1997/+2772
|\ \ | |/ | | | | MFC after: 3 months
* | Belatedly regenerate after application of the HPN patch.des2011-09-281-1/+4
| |
OpenPOWER on IntegriCloud