summaryrefslogtreecommitdiffstats
path: root/crypto
Commit message (Collapse)AuthorAgeFilesLines
* Fix two more $FreeBSD$ keywords.brooks2011-08-032-2/+2
| | | | | Reported by: pluknet Approved by: re (implicit)
* Add support for dynamically adjusted buffers to allow the full use ofbrooks2011-08-0331-43/+747
| | | | | | | | | | | | | | | | | | | | | | | | | the bandwidth of long fat pipes (i.e. 100Mbps+ trans-oceanic or trans-continental links). Bandwidth-delay products up to 64MB are supported. Also add support (not compiled by default) for the None cypher. The None cypher can only be enabled on non-interactive sessions (those without a pty where -T was not used) and must be enabled in both the client and server configuration files and on the client command line. Additionally, the None cypher will only be activated after authentication is complete. To enable the None cypher you must add -DNONE_CIPHER_ENABLED to CFLAGS via the make command line or in /etc/make.conf. This code is a style(9) compliant version of these features extracted from the patches published at: http://www.psc.edu/networking/projects/hpn-ssh/ Merging this patch has been a collaboration between me and Bjoern. Reviewed by: bz Approved by: re (kib), des (maintainer)
* Fix clang warning (why is there nowhere yyparse() is declared?).benl2011-05-181-0/+1
| | | | Approved by: philip (mentor)
* Merge two upstream patches from vendor branch. No functional changes.des2011-05-052-2/+3
|
* Upgrade to OpenSSH 5.8p2.des2011-05-04126-4246/+5749
|\
* | Fix Incorrectly formatted ClientHello SSL/TLS handshake messages couldsimon2011-02-121-1/+7
| | | | | | | | | | | | | | | | | | | | | | | | cause OpenSSL to parse past the end of the message. Note: Applications are only affected if they act as a server and call SSL_CTX_set_tlsext_status_cb on the server's SSL_CTX. This includes Apache httpd >= 2.3.3, if configured with "SSLUseStapling On". Security: http://www.openssl.org/news/secadv_20110208.txt Security: CVE-2011-0014 Obtained from: OpenSSL CVS
* | Merge OpenSSL 0.9.8q into head.simon2010-12-0317-30/+146
|\ \ | | | | | | | | | | | | | | | Security: CVE-2010-4180 Security: http://www.openssl.org/news/secadv_20101202.txt MFC after: 3 days
| * | Import OpenSSL 0.9.8q.simon2010-12-027-10/+44
| | |
| * | Import OpenSSL 0.9.8p.simon2010-11-2150-187/+276
| | |
| * | Import OpenSSL 0.9.8n.simon2010-04-0114-23/+51
| | |
* | | Merge OpenSSL 0.9.8p into head.simon2010-11-22127-535/+876
| | | | | | | | | | | | | | | Security: CVE-2010-3864 Security: http://www.openssl.org/news/secadv_20101116.txt
* | | Fix double-free in OpenSSL's SSL ECDH code.simon2010-11-141-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | It has yet to be determined if this warrants a FreeBSD Security Advisory, but we might as well get it fixed in the normal branches. Obtained from: OpenSSL CVS Security: CVE-2010-2939 X-MFC after: Not long...
* | | Upgrade to OpenSSH 5.6p1.des2010-11-1168-979/+3236
|\ \ \ | | |/ | |/|
* | | Forgot to svn rm this when I imported 5.4p1.des2010-11-101-25/+0
| | |
* | | Remove copyright strings printed at login time via login(1) or sshd(8).emaste2010-09-281-18/+0
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | It is not clear to what this copyright should apply, and this is in line with what other operating systems do. For ssh specifically, printing of the copyright string is not in the upstream version so this reduces our FreeBSD-local diffs. Approved by: core, des (ssh)
* | | Bring in OpenSSL checkin 19821:rpaulo2010-09-212-6/+13
| | | | | | | | | | | | | | | | | | | | | | | | | | | Make inline assembler clang-friendly [from HEAD]. openssl/crypto/md32_common.h 1.45.2.1 -> 1.45.2.2 openssl/crypto/rc5/rc5_locl.h 1.8 -> 1.8.8.1 Approved by: simon
* | | More commasdes2010-06-012-2/+2
| | |
* | | Missing commasdes2010-06-0111-11/+11
| | |
* | | Fix .Dd line: FreeBSD's mdoc code doesn't understand OpenBSD's $Mdocdate$.cperciva2010-05-281-1/+1
| | | | | | | | | | | | MFC after: 3 days
* | | Upgrade to OpenSSH 5.5p1.des2010-04-2825-88/+254
| | |
* | | Enhance r199804 by marking the daemonised child as immune to OOM insteadkib2010-04-081-4/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | of short-living parent. Only mark the master process that accepts connections, do not protect connection handlers spawned from inetd. Submitted by: Mykola Dzham <i levsha me> Reviewed by: attilio MFC after: 1 week
* | | Merge OpenSSL 0.9.8n into head.simon2010-04-0128-37/+115
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This fixes CVE-2010-0740 which only affected -CURRENT (OpenSSL 0.9.8m) but not -STABLE branches. I have not yet been able to find out if CVE-2010-0433 impacts FreeBSD. This will be investigated further. Security: CVE-2010-0433, CVE-2010-0740 Security: http://www.openssl.org/news/secadv_20100324.txt
* | | Readd $FreeBSD$ to the OpenSSL config file as that's useful forsimon2010-03-131-0/+1
| | | | | | | | | | | | | | | | | | mergemaster. Suggested by: dougb
* | | Merge OpenSSL 0.9.8m into head.simon2010-03-13238-19819/+4290
|\ \ \ | | |/ | |/| | | | | | | | | | | | | | | | | | | | | | | | | This also "reverts" some FreeBSD local changes so we should now be back to using entirely stock OpenSSL. The local changes were simple $FreeBSD$ lines additions, which were required in the CVS days, and the patch for FreeBSD-SA-09:15.ssl which has been superseded with OpenSSL 0.9.8m's RFC5746 'TLS renegotiation extension' support. MFC after: 3 weeks
| * | Import OpenSSL 0.9.8m.simon2010-02-28113-16066/+1266
| | |
| * | Import DTLS fix from upstream OpenSSL 0.9.8 branch:simon2009-08-232-0/+15
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Fix memory consumption bug with "future epoch" DTLS records. Note that this will not get FreeBSD Security Advisory as DTLS is experimental in OpenSSL. Security: CVE-2009-1377 Obtained from: OpenSSL CVS http://cvs.openssl.org/chngview?cn=18187
* | | Upgrade to OpenSSH 5.4p1.des2010-03-09124-3006/+10880
|\ \ \ | | |/ | |/| | | | MFC after: 1 month
* | | Add a missing $FreeBSD$ string.ed2010-01-131-0/+1
| | | | | | | | | | | | | | | | | | | | | I was requested to add this string to any file that was modified by my commit, which I forgot to do so. Requested by: des
* | | Make OpenSSH work with utmpx.ed2010-01-134-27/+56
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | - Partially revert r184122 (sshd.c). Our ut_host is now big enough to fit proper hostnames. - Change config.h to match reality. - defines.h requires UTMPX_FILE to be set by <utmpx.h> before it allows the utmpx code to work. This makes no sense to me. I've already mentioned this upstream. - Add our own platform-specific handling of lastlog. The version I will send to the OpenSSH folks will use proper autoconf generated definitions instead of `#if 1'.
* | | The size of credential messages is limited by CMGROUP_MAX rather thanbrooks2010-01-031-1/+1
| | | | | | | | | | | | | | | | | | NGROUPS. MFC after: 1 week
* | | Disable SSL renegotiation in order to protect against a seriouscperciva2009-12-033-5/+12
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | protocol flaw. [09:15] Correctly handle failures from unsetenv resulting from a corrupt environment in rtld-elf. [09:16] Fix permissions in freebsd-update in order to prevent leakage of sensitive files. [09:17] Approved by: so (cperciva) Security: FreeBSD-SA-09:15.ssl Security: FreeBSD-SA-09:16.rtld Security: FreeBSD-SA-09:17.freebsd-udpate
* | | Avoid sshd, cron, syslogd and inetd to be killed under high-pressure swapattilio2009-11-251-0/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | environments. Please note that this can't be done while such processes run in jails. Note: in future it would be interesting to find a way to do that selectively for any desired proccess (choosen by user himself), probabilly via a ptrace interface or whatever. Obtained from: Sandvine Incorporated Reviewed by: emaste, arch@ Sponsored by: Sandvine Incorporated MFC: 1 month
* | | Fix globbingdes2009-11-101-0/+2
| | | | | | | | | | | | | | | Noticed by: delphij, David Cornejo <dave@dogwood.com> Forgotten by: des
* | | Remove dupe.des2009-10-111-1/+0
| | |
* | | Add more symbols that need to be masked:des2009-10-051-1/+19
| | | | | | | | | | | | | | | | | | | | | - initialized and uninitialized data - symbols from roaming_dummy.c which end up in pam_ssh Update the command line used to generate the #defines.
* | | Upgrade to OpenSSH 5.3p1.des2009-10-0173-1077/+1931
|\ \ \ | |/ /
* | | Merge DTLS fixes from vendor-crypto/openssl/dist:simon2009-08-234-17/+47
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | - Fix memory consumption bug with "future epoch" DTLS records. - Fix fragment handling memory leak. - Do not access freed data structure. - Fix DTLS fragment bug - out-of-sequence message handling which could result in NULL pointer dereference in dtls1_process_out_of_seq_message(). Note that this will not get FreeBSD Security Advisory as DTLS is experimental in OpenSSL. MFC after: 1 week Security: CVE-2009-1377 CVE-2009-1378 CVE-2009-1379 CVE-2009-1387
* | | Update and remove CVS-specific itemsdes2009-08-131-3/+1
| | | | | | | | | | | | Approved by: re (kib)
* | | Remove symlinks in OpenSSL's testing framework. These are not requiredsimon2009-08-1243-43/+0
| | | | | | | | | | | | | | | | | | | | | | | | | | | for normal build, and doesn't export well to CVS. If they are needed later a script will be added to recreate the symlinks when needed at build time. Approved by: re (rwatson)
* | | Use the closefrom(2) system call.jhb2009-06-162-2/+1
| | | | | | | | | | | | Reviewed by: des
* | | Merge OpenSSL 0.9.8k into head.simon2009-06-14795-14045/+76865
|\ \ \ | | |/ | |/| | | | Approved by: re
| * | Import OpenSSL 0.9.8k.simon2009-06-07361-3926/+24367
| | |
| * | Vendor import of OpenSSL 0.9.8i.simon2008-09-21212-6663/+19478
| | |
| * | Remove files from vendor tree which were not part of OpenSSL 0.9.8esimon2008-09-2165-21917/+0
| | | | | | | | | | | | | | | | | | | | | (last vendor import). The file were removed in different earlier releases, but were not removed from the CVS vendor branch at the time.
| * | Flatten OpenSSL vendor tree.simon2008-08-231806-183756/+0
| | |
* | | Upgrade to OpenSSH 5.2p1.des2009-05-2276-4439/+3910
|\ \ \ | | |/ | |/| | | | MFC after: 3 months
* | | Don't leak information via uninitialized space in db(3) records. [09:07]cperciva2009-04-223-0/+16
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Sanity-check string lengths in order to stop OpenSSL crashing when printing corrupt BMPString or UniversalString objects. [09:08] Security: FreeBSD-SA-09:07.libc Security: FreeBSD-SA-09:08.openssl Security: CVE-2009-0590 Approved by: re (kensmith) Approved by: so (cperciva)
* | | Prevent cross-site forgery attacks on lukemftpd(8) due to splittingsimon2009-01-079-13/+12
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | long commands into multiple requests. [09:01] Fix incorrect OpenSSL checks for malformed signatures due to invalid check of return value from EVP_VerifyFinal(), DSA_verify, and DSA_do_verify. [09:02] Security: FreeBSD-SA-09:01.lukemftpd Security: FreeBSD-SA-09:02.openssl Obtained from: NetBSD [SA-09:01] Obtained from: OpenSSL Project [SA-09:02] Approved by: so (simon)
* | | At some point, construct_utmp() was changed to use realhostname() to filldes2008-10-212-4/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | in the struct utmp due to concerns about the length of the hostname buffer. However, this breaks the UseDNS option. There is a simpler and better solution: initialize utmp_len to the correct value (UT_HOSTSIZE instead of MAXHOSTNAMELEN) and let get_remote_name_or_ip() worry about the size of the buffer. PR: bin/97499 Submitted by: Bruce Cran <bruce@cran.org.uk> MFC after: 1 week
* | | Our groff doesn't understand $Mdocdate$, so replace them with bare dates.des2008-09-2913-13/+13
| | | | | | | | | | | | MFC after: 3 days
OpenPOWER on IntegriCloud