aboutsummaryrefslogtreecommitdiff
path: root/crypto
Commit message (Collapse)AuthorAgeFilesLines
* Fix a race condition exists in the OpenSSL TLS server extension code andreleng/8.0Simon L. B. Nielsen2010-11-292-4/+15
| | | | | | | | | | | a double free in the SSL client ECDH handling code. Approved by: so (simon) Security: CVE-2010-2939, CVE-2010-3864 Security: FreeBSD-SA-10:10.openssl Notes: svn path=/releng/8.0/; revision=216063
* Disable SSL renegotiation in order to protect against a seriousColin Percival2009-12-033-5/+12
| | | | | | | | | | | | | | | | | | protocol flaw. [09:15] Correctly handle failures from unsetenv resulting from a corrupt environment in rtld-elf. [09:16] Fix permissions in freebsd-update in order to prevent leakage of sensitive files. [09:17] Approved by: so (cperciva) Security: FreeBSD-SA-09:15.ssl Security: FreeBSD-SA-09:16.rtld Security: FreeBSD-SA-09:17.freebsd-udpate Notes: svn path=/releng/8.0/; revision=200054
* MFC r196474:Simon L. B. Nielsen2009-08-294-17/+47
| | | | | | | | | | | | | | | | | | | | | Merge DTLS fixes from vendor-crypto/openssl/dist: - Fix memory consumption bug with "future epoch" DTLS records. - Fix fragment handling memory leak. - Do not access freed data structure. - Fix DTLS fragment bug - out-of-sequence message handling which could result in NULL pointer dereference in dtls1_process_out_of_seq_message(). Note that this will not get FreeBSD Security Advisory as DTLS is experimental in OpenSSL. Security: CVE-2009-1377 CVE-2009-1378 CVE-2009-1379 CVE-2009-1387 Approved by: re (kib) Notes: svn path=/stable/8/; revision=196641
* merge r196164: update & remove CVS-specific items.Dag-Erling Smørgrav2009-08-131-3/+1
| | | | | | | Approved by: re (kib) Notes: svn path=/stable/8/; revision=196165
* MFC 196133:Simon L. B. Nielsen2009-08-1243-43/+0
| | | | | | | | | | | | | Remove symlinks in OpenSSL's testing framework. These are not required for normal build, and doesn't export well to CVS. If they are needed later a script will be added to recreate the symlinks when needed at build time. Approved by: re (rwatson) Notes: svn path=/stable/8/; revision=196160
* Use the closefrom(2) system call.John Baldwin2009-06-162-2/+1
| | | | | | | Reviewed by: des Notes: svn path=/head/; revision=194297
* Merge OpenSSL 0.9.8k into head.Simon L. B. Nielsen2009-06-14795-14033/+76853
|\ | | | | | | | | | | | | Approved by: re Notes: svn path=/head/; revision=194206
| * Import OpenSSL 0.9.8k.vendor/openssl/0.9.8kSimon L. B. Nielsen2009-06-07361-3925/+24366
| | | | | | | | | | Notes: svn path=/vendor-crypto/openssl/dist/; revision=193645 svn path=/vendor-crypto/openssl/0.9.8k/; revision=193646; tag=vendor/openssl/0.9.8k
| * Vendor import of OpenSSL 0.9.8i.vendor/openssl/0.9.8iSimon L. B. Nielsen2008-09-21212-6652/+19467
| | | | | | | | | | Notes: svn path=/vendor-crypto/openssl/dist/; revision=183234 svn path=/vendor-crypto/openssl/0.9.8i/; revision=193572; tag=vendor/openssl/0.9.8i
| * Remove files from vendor tree which were not part of OpenSSL 0.9.8eSimon L. B. Nielsen2008-09-2165-21917/+0
| | | | | | | | | | | | | | | | | | | | (last vendor import). The file were removed in different earlier releases, but were not removed from the CVS vendor branch at the time. Notes: svn path=/vendor-crypto/openssl/dist/; revision=183231
| * Flatten OpenSSL vendor tree.Simon L. B. Nielsen2008-08-231806-183756/+0
| | | | | | | | Notes: svn path=/vendor-crypto/openssl/dist/; revision=182044
* | Upgrade to OpenSSH 5.2p1.Dag-Erling Smørgrav2009-05-2276-4438/+3909
|\ \ | | | | | | | | | | | | | | | | | | MFC after: 3 months Notes: svn path=/head/; revision=192595
* | | Don't leak information via uninitialized space in db(3) records. [09:07]Colin Percival2009-04-223-0/+16
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Sanity-check string lengths in order to stop OpenSSL crashing when printing corrupt BMPString or UniversalString objects. [09:08] Security: FreeBSD-SA-09:07.libc Security: FreeBSD-SA-09:08.openssl Security: CVE-2009-0590 Approved by: re (kensmith) Approved by: so (cperciva) Notes: svn path=/head/; revision=191381
* | | Prevent cross-site forgery attacks on lukemftpd(8) due to splittingSimon L. B. Nielsen2009-01-079-13/+12
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | long commands into multiple requests. [09:01] Fix incorrect OpenSSL checks for malformed signatures due to invalid check of return value from EVP_VerifyFinal(), DSA_verify, and DSA_do_verify. [09:02] Security: FreeBSD-SA-09:01.lukemftpd Security: FreeBSD-SA-09:02.openssl Obtained from: NetBSD [SA-09:01] Obtained from: OpenSSL Project [SA-09:02] Approved by: so (simon) Notes: svn path=/head/; revision=186872
* | | At some point, construct_utmp() was changed to use realhostname() to fillDag-Erling Smørgrav2008-10-212-4/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | in the struct utmp due to concerns about the length of the hostname buffer. However, this breaks the UseDNS option. There is a simpler and better solution: initialize utmp_len to the correct value (UT_HOSTSIZE instead of MAXHOSTNAMELEN) and let get_remote_name_or_ip() worry about the size of the buffer. PR: bin/97499 Submitted by: Bruce Cran <bruce@cran.org.uk> MFC after: 1 week Notes: svn path=/head/; revision=184122
* | | Our groff doesn't understand $Mdocdate$, so replace them with bare dates.Dag-Erling Smørgrav2008-09-2913-13/+13
| | | | | | | | | | | | | | | | | | | | | MFC after: 3 days Notes: svn path=/head/; revision=183458
* | | MFV "xmalloc: zero size" fix.Dag-Erling Smørgrav2008-09-241-1/+2
|\| | | | | | | | | | | | | | | | | | | | MFC after: 1 week Notes: svn path=/head/; revision=183336
* | | The vendor area is the proper home for these files now.Simon L. B. Nielsen2008-09-212-93/+0
| | | | | | | | | | | | Notes: svn path=/head/; revision=183229
* | | Remove some unused files.Dag-Erling Smørgrav2008-09-012-1251/+0
|\| | | | | | | | | | | Notes: svn path=/head/; revision=182614
* | | Set SIZEOF_LONG_INT and SIZEOF_LONG_LONG_INT to plausible values. TheyDag-Erling Smørgrav2008-09-011-2/+2
| | | | | | | | | | | | | | | | | | | | | aren't used for anything, but that's no excuse for being silly. Notes: svn path=/head/; revision=182601
* | | Use net.inet.ip.portrange.reservedhigh instead of IPPORT_RESERVED.Dag-Erling Smørgrav2008-08-201-1/+14
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Submitted upstream, no reaction. Submitted by: delphij@ MFC after: 2 weeks Notes: svn path=/head/; revision=181918
* | | Upgrade to OpenSSH 5.1p1.Dag-Erling Smørgrav2008-08-01171-4653/+13140
|\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | I have worked hard to reduce diffs against the vendor branch. One notable change in that respect is that we no longer prefer DSA over RSA - the reasons for doing so went away years ago. This may cause some surprises, as ssh will warn about unknown host keys even for hosts whose keys haven't changed. MFC after: 6 weeks Notes: svn path=/head/; revision=181111
| * | Properly flatten openssh/dist.Dag-Erling Smørgrav2008-07-22407-109174/+0
| | | | | | | | | | | | Notes: svn path=/vendor-crypto/openssh/dist/; revision=180720
* | | Another file with no local changes.Dag-Erling Smørgrav2008-08-011-1/+0
| | | | | | | | | | | | | | | | | | | | | "This time for sure!" Notes: svn path=/head/; revision=181109
* | | Another file with no local changes.Dag-Erling Smørgrav2008-08-011-1/+0
| | | | | | | | | | | | Notes: svn path=/head/; revision=181108
* | | Another four files without local changes. This is driving me nuts -Dag-Erling Smørgrav2008-08-014-4/+0
| | | | | | | | | | | | | | | | | | | | | every time I think I got them all, another one pops up. Notes: svn path=/head/; revision=181107
* | | Yet another file with no local changes.Dag-Erling Smørgrav2008-08-011-1/+0
| | | | | | | | | | | | Notes: svn path=/head/; revision=181106
* | | Accidentally mangled this one in the previous commit.Dag-Erling Smørgrav2008-08-011-1/+1
| | | | | | | | | | | | Notes: svn path=/head/; revision=181105
* | | More files which no longer have any local changes.Dag-Erling Smørgrav2008-08-018-8/+0
| | | | | | | | | | | | Notes: svn path=/head/; revision=181104
* | | These two files have no local patches except to prevent expansion of theDag-Erling Smørgrav2008-08-012-4/+2
| | | | | | | | | | | | | | | | | | | | | | | | original $FreeBSD$ keywords. Revert those changes, and simply disable keyword expansion. Notes: svn path=/head/; revision=181103
* | | Last remains of old OPIE patchDag-Erling Smørgrav2008-08-011-8/+0
| | | | | | | | | | | | Notes: svn path=/head/; revision=181101
* | | We no longer have any local changes here.Dag-Erling Smørgrav2008-08-011-1/+0
| | | | | | | | | | | | Notes: svn path=/head/; revision=181098
* | | Tag expansion is no longer needed (svn handles them correctly).Dag-Erling Smørgrav2008-08-011-8/+2
| | | | | | | | | | | | | | | | | | | | | Add svn command to diff against vendor branch. Notes: svn path=/head/; revision=181096
* | | This is no longer needed.Dag-Erling Smørgrav2008-08-011-9/+0
| | | | | | | | | | | | Notes: svn path=/head/; revision=181095
* | | Cleanup.Dag-Erling Smørgrav2008-08-012-27/+26
| | | | | | | | | | | | Notes: svn path=/head/; revision=181094
* | | Ugh. Set svn:mergeinfo correctly.Dag-Erling Smørgrav2008-08-011-0/+1
| | | | | | | | | | | | Notes: svn path=/head/; revision=181092
* | | Catch up with reality.Dag-Erling Smørgrav2008-08-011-8/+1
| | | | | | | | | | | | Notes: svn path=/head/; revision=181091
* | | Revert an old hack I put in to replace S/Key with OPIE. We haven't usedDag-Erling Smørgrav2008-08-013-21/+0
| | | | | | | | | | | | | | | | | | | | | that code in ages - we use pam_opie(8) instead - so this is a NOP. Notes: svn path=/head/; revision=181090
* | | Add missing #include for strlen()Dag-Erling Smørgrav2008-07-311-0/+3
| | | | | | | | | | | | Notes: svn path=/head/; revision=181087
* | | Fix alignment of the cmsg buffer by placing it in a union with a structDag-Erling Smørgrav2008-07-301-6/+12
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | cmsghdr. Derived from upstream patch. Submitted by: cognet MFC after: 2 weeks Notes: svn path=/head/; revision=180989
* | | Remove a bunch of files we don't need to build OpenSSH. They are stillDag-Erling Smørgrav2008-07-2380-11367/+0
| | | | | | | | | | | | | | | | | | | | | available in base/vendor-crypto/openssh/dist/. Notes: svn path=/head/; revision=180765
* | | Fix conflicts after heimdal-1.1 import and add build infrastructure. ImportDoug Rabson2008-05-0782-13783/+1340
| | | | | | | | | | | | | | | | | | | | | all non-style changes made by heimdal to our own libgssapi. Notes: svn path=/head/; revision=178828
* | | This commit was generated by cvs2svn to compensate for changes in r178825,Doug Rabson2008-05-071483-48177/+252364
|\ \ \ | | | | | | | | | | | | | | | | | | | | | | | | which included commits to RCS files with non-trunk default branches. Notes: svn path=/head/; revision=178826
| * | | Vendor import of Heimdal 1.1Doug Rabson2008-05-071493-48898/+253677
| | | | | | | | | | | | | | | | Notes: svn path=/vendor-crypto/heimdal/dist/; revision=178825
* | | | Fix the Xlist so it actually works with 'tar -X', and update the upgradeDag-Erling Smørgrav2008-02-062-11/+10
| | | | | | | | | | | | | | | | | | | | | | | | | | | | instructions accordingly. Notes: svn path=/head/; revision=176070
* | | | As per discussion, commit experimental metadata for my contrib packages.Dag-Erling Smørgrav2008-02-061-0/+8
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The idea is to have a FREEBSD-vendor file for every third-party package in the tree. Notes: svn path=/head/; revision=176069
* | | | Unbreak detection of cryptodev support for FreeBSD which was brokenSimon L. B. Nielsen2008-01-131-1/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | with OpenSSL 0.9.8 import. Note that this does not enable cryptodev by default, as it was the case with OpenSSL 0.9.7 in FreeBSD base, but this change makes it possible to enable cryptodev at all. This has been submitted upstream as: http://rt.openssl.org/Ticket/Display.html?id=1624 Submitted by: nork Notes: svn path=/head/; revision=175292
* | | | This commit was generated by cvs2svn to compensate for changes in r172767,Simon L. B. Nielsen2007-10-184-586/+515
|\ \ \ \ | | |_|/ | |/| | | | | | | | | | | | | | | | | | which included commits to RCS files with non-trunk default branches. Notes: svn path=/head/; revision=172768
| * | | Import DTLS security fix from upstream OpenSSL_0_9_8-stable branch.Simon L. B. Nielsen2007-10-184-586/+515
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | From the OpenSSL advisory: Andy Polyakov discovered a flaw in OpenSSL's DTLS implementation which could lead to the compromise of clients and servers with DTLS enabled. DTLS is a datagram variant of TLS specified in RFC 4347 first supported in OpenSSL version 0.9.8. Note that the vulnerabilities do not affect SSL and TLS so only clients and servers explicitly using DTLS are affected. We believe this flaw will permit remote code execution. Security: CVE-2007-4995 Security: http://www.openssl.org/news/secadv_20071012.txt Notes: svn path=/vendor-crypto/openssl/dist/; revision=172767
* | | | Remove _FREEFALL_CONFIG hacks. su+pam_ksu works well enough to use onPeter Wemm2007-10-182-18/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | the freebsd.org cluster. Notes: svn path=/head/; revision=172765
generated by cgit v1.3 (git 2.53.0) at 2026-04-18 16:24:59 +0000