summaryrefslogtreecommitdiff
path: root/crypto
Commit message (Collapse)AuthorAgeFilesLines
* MFS r273149 (jkim): MFC: r273144, r273146Xin LI2014-10-2179-608/+1819
| | | | | | | | | | | Merge OpenSSL 1.0.1j. This is part of an upcoming FreeBSD security advisory. Approved by: re (so@ blanket) Notes: svn path=/releng/10.1/; revision=273399
* MFC r271284:Glen Barber2014-09-121-1/+1
| | | | | | | | | | | Include the gssapi_krb5 library in KRB5_LDFLAGS. PR: 156245 Approved by: re (marius) Sponsored by: The FreeBSD Foundation Notes: svn path=/stable/10/; revision=271473
* MFC: r269682Jung-uk Kim2014-08-07158-4989/+3288
| | | | | | | Merge OpenSSL 1.0.1i. Notes: svn path=/stable/10/; revision=269686
* MFC: r267256Jung-uk Kim2014-06-0966-141/+824
| | | | | | | | | Merge OpenSSL 1.0.1h. Approved by: so (delphij) Notes: svn path=/stable/10/; revision=267258
* Fix OpenSSL multiple vulnerabilities.Xin LI2014-06-055-3/+36
| | | | | | | | | Security: CVE-2014-0195, CVE-2014-0221, CVE-2014-0224, CVE-2014-3470 Security: SA-14:14.openssl Notes: svn path=/stable/10/; revision=267103
* Fix OpenSSL NULL pointer deference vulnerability.Xin LI2014-05-131-0/+4
| | | | | | | | | Obtained from: OpenBSD Security: FreeBSD-SA-14:09.openssl Security: CVE-2014-0198 Notes: svn path=/stable/10/; revision=265986
* Fix devfs rules not applied by default for jails.Xin LI2014-04-301-1/+1
| | | | | | | | | | | | | | | | Fix OpenSSL use-after-free vulnerability. Fix TCP reassembly vulnerability. Security: FreeBSD-SA-14:07.devfs Security: CVE-2014-3001 Security: FreeBSD-SA-14:08.tcp Security: CVE-2014-3000 Security: FreeBSD-SA-14:09.openssl Security: CVE-2010-5298 Notes: svn path=/stable/10/; revision=265122
* MFH (r264691): merge upstream patch for EC calculation bugDag-Erling Smørgrav2014-04-2010-9/+35
| | | | Notes: svn path=/stable/10/; revision=264692
* MFH (r263712): upgrade openssh to 6.6p1Dag-Erling Smørgrav2014-04-12123-2462/+1522
| | | | | | | MFH (r264308): restore p level in debugging output Notes: svn path=/stable/10/; revision=264377
* MFC: r261037, r264278Jung-uk Kim2014-04-10148-920/+1786
| | | | | | | Merge OpenSSL 1.0.1f and 1.0.1g. Notes: svn path=/stable/10/; revision=264331
* Fix NFS deadlock vulnerability. [SA-14:05]Xin LI2014-04-085-24/+106
| | | | | | | | Fix "Heartbleed" vulnerability and ECDSA Cache Side-channel Attack in OpenSSL. [SA-14:06] Notes: svn path=/stable/10/; revision=264266
* MFC r261499 (pjd):Xin LI2014-03-031-2/+4
| | | | | | | Fix installations that use kernels without CAPABILITIES support. Notes: svn path=/stable/10/; revision=262718
* MFH (r261320): upgrade openssh to 6.5p1Dag-Erling Smørgrav2014-02-27204-4434/+13544
| | | | | | | MFH (r261340): enable sandboxing by default Notes: svn path=/stable/10/; revision=262566
* MFC r260403 (MFV r260399):Xin LI2014-01-075-8/+25
| | | | | | | | | | | | | | | | | | | | | | | Apply vendor commits: 197e0ea Fix for TLS record tampering bug. (CVE-2013-4353). 3462896 For DTLS we might need to retransmit messages from the previous session so keep a copy of write context in DTLS retransmission buffers instead of replacing it after sending CCS. (CVE-2013-6450). ca98926 When deciding whether to use TLS 1.2 PRF and record hash algorithms use the version number in the corresponding SSL_METHOD structure instead of the SSL structure. The SSL structure version is sometimes inaccurate. Note: OpenSSL 1.0.2 and later effectively do this already. (CVE-2013-6449). Security: CVE-2013-4353 Security: CVE-2013-6449 Security: CVE-2013-6450 Notes: svn path=/stable/10/; revision=260404
* MFC r259286,259424,259425:Benjamin Kaduk2013-12-161-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Apply patch from upstream Heimdal for encoding fix RFC 4402 specifies the implementation of the gss_pseudo_random() function for the krb5 mechanism (and the C bindings therein). The implementation uses a PRF+ function that concatenates the output of individual krb5 pseudo-random operations produced with a counter and seed. The original implementation of this function in Heimdal incorrectly encoded the counter as a little-endian integer, but the RFC specifies the counter encoding as big-endian. The implementation initializes the counter to zero, so the first block of output (16 octets, for the modern AES enctypes 17 and 18) is unchanged. (RFC 4402 specifies that the counter should begin at 1, but both existing implementations begin with zero and it looks like the standard will be re-issued, with test vectors, to begin at zero.) This is upstream's commit f85652af868e64811f2b32b815d4198e7f9017f6, from 13 October, 2013: % Fix krb5's gss_pseudo_random() (n is big-endian) % % The first enctype RFC3961 prf output length's bytes are correct because % the little- and big-endian representations of unsigned zero are the % same. The second block of output was wrong because the counter was not % being encoded as big-endian. % % This change could break applications. But those applications would not % have been interoperating with other implementations anyways (in % particular: MIT's). Bump __FreeBSD_version accordingly and add a note in UPDATING. Approved by: hrs (mentor, src committer) Notes: svn path=/stable/10/; revision=259447
* MFH (r257954): upgrade to OpenSSH 6.4p1Dag-Erling Smørgrav2013-11-1926-53/+69
| | | | | | | Approved by: re (kib) Notes: svn path=/stable/10/; revision=258343
* Pre-zero the MAC context.Dag-Erling Smørgrav2013-11-191-1/+1
| | | | | | | | | Security: CVE-2013-4548 Security: FreeBSD-SA-13:14.openssh Approved by: re (implicit) Notes: svn path=/stable/10/; revision=258335
* Unbreak the WITHOUT_KERBEROS build and try to reduce the odds of aDag-Erling Smørgrav2013-09-236-17/+64
| | | | | | | | | | | | repeat performance by introducing a script that runs configure with and without Kerberos, diffs the result and generates krb5_config.h, which contains the preprocessor macros that need to be defined in the Kerberos case and undefined otherwise. Approved by: re (marius) Notes: svn path=/head/; revision=255829
* Pull in all the OpenSSH bits that we'd previously left out because weDag-Erling Smørgrav2013-09-21146-0/+43001
|\ | | | | | | | | | | | | | | | | | | didn't use them. This will make future merges from the vendor tree much easier. Approved by: re (gjb) Notes: svn path=/head/; revision=255774
* | Upgrade to 6.3p1.Dag-Erling Smørgrav2013-09-21154-2392/+4263
|\| | | | | | | | | | | | | Approved by: re (gjb) Notes: svn path=/head/; revision=255767
* | Change the default value of VerifyHostKeyDNS to "yes" if compiled withDag-Erling Smørgrav2013-09-103-1/+11
| | | | | | | | | | | | | | | | | | | | | | LDNS. With that setting, OpenSSH will silently accept host keys that match verified SSHFP records. If an SSHFP record exists but could not be verified, OpenSSH will print a message and prompt the user as usual. Approved by: re (blanket) Notes: svn path=/head/; revision=255461
* | These three files appeared in 6.0p1, which was imported into the vendorDag-Erling Smørgrav2013-09-093-0/+558
|\| | | | | | | | | | | | | | | | | | | | | | | branch but never merged to head. They were inadvertantly left out when 6.1p1 was merged to head. It didn't make any difference at the time, because they were unused, but one of them is required for DNS-based host key verification. Approved by: re (blanket) Notes: svn path=/head/; revision=255422
* | Apply upstream revision 1.151 (fix relative symlinks)Dag-Erling Smørgrav2013-08-131-1/+2
|\| | | | | | | | | | | | | MFC after: 3 days Notes: svn path=/head/; revision=254278
* | MFV r254106 (OpenSSL bugfix for RT #2984):Xin LI2013-08-081-1/+1
|\ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Check DTLS_BAD_VER for version number. The version check for DTLS1_VERSION was redundant as DTLS1_VERSION > TLS1_1_VERSION, however we do need to check for DTLS1_BAD_VER for compatibility. Requested by: zi Approved by: benl Notes: svn path=/head/; revision=254107
* | | Fix gssapi/gssapi_krb5.h after Heimdal 1.5.1 import.Hiroki Sato2013-06-301-1/+1
| | | | | | | | | | | | | | | | | | | | | Reviewed by: dfr Notes: svn path=/head/; revision=252409
* | | r251088 reverted the default value for UsePrivilegeSeparation fromDag-Erling Smørgrav2013-06-282-2/+2
| | | | | | | | | | | | | | | | | | | | | "sandbox" to "yes", but did not update the documentation to match. Notes: svn path=/head/; revision=252338
* | | Revert a local change that sets the default for UsePrivilegeSeparation toDag-Erling Smørgrav2013-05-291-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | "sandbox" instead of "yes". In sandbox mode, the privsep child is unable to load additional libraries and will therefore crash when trying to take advantage of crypto offloading on CPUs that support it. Notes: svn path=/head/; revision=251088
* | | Have the ipropd-master listen on an IPv6 socket in addition to an IPv4Bjoern A. Zeeb2013-05-181-6/+62
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | socket to allow propagation of changes to a Heimdal Kerberos database from the KDC master to the slave(s) work on IPv6 as well. Update the stats logging to also handle IPv6 addresses. Reported by: peter (found on FreeBSD cluster) X-to-be-tested-by: peter MFC after: 3 weeks Notes: svn path=/head/; revision=250782
* | | Upgrade to OpenSSH 6.2p2. Mostly a no-op since I had already patchedDag-Erling Smørgrav2013-05-1712-30/+65
|\ \ \ | | |/ | |/| | | | | | | | | | | | | the issues that affected us. Notes: svn path=/head/; revision=250739
* | | The HPN patch added a new BUG bit for SSH_BUG_LARGEWINDOWBryan Drewery2013-05-131-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | and the update to 6.1 added SSH_BUG_DYNAMIC_RPORT with the same value. Fix the HPN SSH_BUG_LARGEWINDOW bit so it is unique. Approved by: des MFC after: 2 weeks Notes: svn path=/head/; revision=250595
* | | Merge updated "no such identity file" patch.Dag-Erling Smørgrav2013-04-243-34/+29
|\| | | | | | | | | | | | | | | | | | | | PR: bin/178060 Notes: svn path=/head/; revision=249839
* | | Silence "received disconnect" in the common case.Dag-Erling Smørgrav2013-04-141-2/+6
|\| | | | | | | | | | | Notes: svn path=/head/; revision=249475
* | | Merge upstream patch to silence spurious "no such identity file" warnings.Dag-Erling Smørgrav2013-04-024-14/+29
|\| | | | | | | | | | | Notes: svn path=/head/; revision=249016
* | | Silence printf format warnings.Dag-Erling Smørgrav2013-04-021-5/+10
| | | | | | | | | | | | Notes: svn path=/head/; revision=249015
* | | Silence warnings about redefined macros.Dag-Erling Smørgrav2013-04-011-0/+4
| | | | | | | | | | | | Notes: svn path=/head/; revision=248975
* | | Revert r247892 now that this has been fixed upstream.Dag-Erling Smørgrav2013-03-231-1/+0
| | | | | | | | | | | | Notes: svn path=/head/; revision=248648
* | | Upgrade to OpenSSH 6.2p1. The most important new features are supportDag-Erling Smørgrav2013-03-2294-1238/+4985
|\| | | | | | | | | | | | | | | | | | | | for a key revocation list and more fine-grained authentication control. Notes: svn path=/head/; revision=248619
* | | Keep the default AuthorizedKeysFile setting. Although authorized_keys2Dag-Erling Smørgrav2013-03-181-2/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | has been deprecated for a while, some people still use it and were unpleasantly surprised by this change. I may revert this commit at a later date if I can come up with a way to give users who still have authorized_keys2 files sufficient advance warning. MFC after: ASAP Notes: svn path=/head/; revision=248465
* | | Unlike OpenBSD's, our setusercontext() will intentionally ignore the user'sDag-Erling Smørgrav2013-03-131-0/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | own umask setting (from ~/.login.conf) unless running with the user's UID. Therefore, we need to call it again with LOGIN_SETUMASK after changing UID. PR: bin/176740 Submitted by: John Marshall <john.marshall@riverwillow.com.au> MFC after: 1 week Notes: svn path=/head/; revision=248231
* | | Partially revert r247892 and r247904 since our strnvis() does notDag-Erling Smørgrav2013-03-072-2/+5
| | | | | | | | | | | | | | | | | | | | | behave the way OpenSSH expects. Notes: svn path=/head/; revision=247916
* | | Remove strnvis(), strvis(), strvisx().Dag-Erling Smørgrav2013-03-061-3/+0
| | | | | | | | | | | | Notes: svn path=/head/; revision=247904
* | | Explicitly disable lastlog, utmp and wtmp.Dag-Erling Smørgrav2013-03-062-8/+44
| | | | | | | | | | | | Notes: svn path=/head/; revision=247892
* | | Import change 6d783560e4aad1e680097d11e89755647a5aba87 from upstreamDimitry Andric2013-02-191-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | heimdal: fix sizeof(uuid) Found by: clang ToT Reviewed by: stas Notes: svn path=/head/; revision=247002
* | | Merge OpenSSL 1.0.1e.Jung-uk Kim2013-02-13174-867/+2665
|\ \ \ | | |/ | |/| | | | | | | | | | | | | Approved by: secteam (simon), benl (silence) Notes: svn path=/head/; revision=246772
| * | Import OpenSSL 1.0.1e.vendor/openssl/1.0.1eJung-uk Kim2013-02-13103-374/+995
| | | | | | | | | | | | | | | | | | | | | | | | Approved by: secteam (delphij, simon), benl (silence) Notes: svn path=/vendor-crypto/openssl/dist/; revision=246769 svn path=/vendor-crypto/openssl/1.0.1e/; revision=246770; tag=vendor/openssl/1.0.1e
* | | Change "the the" to "the". It is a continuation of r226436 and missed inJung-uk Kim2013-02-131-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | r237658. Approved by: benl (maintainer, implicit) Notes: svn path=/head/; revision=246771
* | | Clean some 'svn:executable' properties in the tree.Pedro F. Giffuni2013-01-2611-0/+0
| | | | | | | | | | | | | | | | | | | | | | | | Submitted by: Christoph Mallon MFC after: 3 days Notes: svn path=/head/; revision=245952
* | | Indicate that we are using OpenSSL with some local modifications.Xin LI2013-01-021-1/+1
| | | | | | | | | | | | | | | | | | | | | X-MFC after: with r244974 Notes: svn path=/head/; revision=244975
* | | MFV r244973:Xin LI2013-01-021-17/+8
|\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Integrate OpenSSL changeset 22950 (appro): bn_word.c: fix overflow bug in BN_add_word. MFC after: 2 weeks Notes: svn path=/head/; revision=244974
| * | Integrate OpenSSL changeset 22950 (appro):Xin LI2013-01-021-17/+8
| | | | | | | | | | | | | | | | | | | | | bn_word.c: fix overflow bug in BN_add_word. Notes: svn path=/vendor-crypto/openssl/dist/; revision=244973
generated by cgit v1.3 (git 2.53.0) at 2026-05-11 17:04:33 +0000