aboutsummaryrefslogtreecommitdiff
path: root/secure/usr.bin
Commit message (Collapse)AuthorAgeFilesLines
* ssh: Update to OpenSSH 9.6p1Ed Maste2024-01-071-1/+1
| | | | | | | | | | | | | | | | | | From the release notes, > This release contains a number of security fixes, some small features > and bugfixes. The most significant change in 9.6p1 is a set of fixes for a newly- discovered weakness in the SSH transport protocol. The fix was already merged into FreeBSD and released as FreeBSD-SA-23:19.openssh. Full release notes at https://www.openssh.com/txt/release-9.6 Relnotes: Yes Sponsored by: The FreeBSD Foundation (cherry picked from commit 069ac18495ad8fde2748bc94b0f80a50250bb01d)
* OpenSSL: update to 3.0.11Pierre Pronchery2023-10-1260-197/+206
| | | | | | | | | | | | OpenSSL 3.0.11 addresses: POLY1305 MAC implementation corrupts XMM registers on Windows (CVE-2023-4807) Relnotes: Yes Pull request: https://github.com/freebsd/freebsd-src/pull/852 Sponsored by: The FreeBSD Foundation (cherry picked from commit 6f1af0d7d2af54b339b5212434cd6d4fda628d80)
* Remove $FreeBSD$: one-line sh patternWarner Losh2023-08-1622-22/+0
| | | | Remove /^\s*#[#!]?\s*\$FreeBSD\$.*$\n/
* OpenSSL: update to 3.0.10Pierre Pronchery2023-08-1060-87/+102
| | | | | | | | | | | | | OpenSSL 3.0.10 addresses: - CVE-2023-3817 - CVE-2023-3446 - CVE-2023-2975 (Note that the vendor branch commit incorrectly referenced 3.0.9.) Relnotes: Yes Pull request: https://github.com/freebsd/freebsd-src/pull/808 Sponsored by: The FreeBSD Foundation
* Merge OpenSSL 3.0.9Pierre Pronchery2023-06-2366-6448/+12453
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Migrate to OpenSSL 3.0 in advance of FreeBSD 14.0. OpenSSL 1.1.1 (the version we were previously using) will be EOL as of 2023-09-11. Most of the base system has already been updated for a seamless switch to OpenSSL 3.0. For many components we've added `-DOPENSSL_API_COMPAT=0x10100000L` to CFLAGS to specify the API version, which avoids deprecation warnings from OpenSSL 3.0. Changes have also been made to avoid OpenSSL APIs that were already deprecated in OpenSSL 1.1.1. The process of updating to contemporary APIs can continue after this merge. Additional changes are still required for libarchive and Kerberos- related libraries or tools; workarounds will immediately follow this commit. Fixes are in progress in the upstream projects and will be incorporated when those are next updated. There are some performance regressions in benchmarks (certain tests in `openssl speed`) and in some OpenSSL consumers in ports (e.g. haproxy). Investigation will continue for these. Netflix's testing showed no functional regression and a rather small, albeit statistically significant, increase in CPU consumption with OpenSSL 3.0. Thanks to ngie@ and des@ for updating base system components, to antoine@ and bofh@ for ports exp-runs and port fixes/workarounds, and to Netflix and everyone who tested prior to commit or contributed to this update in other ways. PR: 271615 PR: 271656 [exp-run] Relnotes: Yes Sponsored by: The FreeBSD Foundation
* OpenSSL: Regen manual pages for OpenSSL 1.1.1uJung-uk Kim2023-05-3049-49/+49
|
* Update/fix Makefile.depend for userlandSimon J. Gerraty2023-04-198-32/+1
|
* OpenSSL: Regen manual pages for OpenSSL 1.1.1tJung-uk Kim2023-02-0749-49/+49
|
* OpenSSL: Regen manual pages for OpenSSL 1.1.1sJung-uk Kim2022-11-0149-59/+63
|
* ssh: update to OpenSSH 9.1p1Ed Maste2022-10-191-1/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Release notes are available at https://www.openssh.com/txt/release-9.1 9.1 contains fixes for three minor memory safety problems; these have lready been merged to the copy of OpenSSH 9.0 that is in the FreeBSD base system. Some highlights copied from the release notes: Potentially-incompatible changes -------------------------------- * ssh(1), sshd(8): SetEnv directives in ssh_config and sshd_config are now first-match-wins to match other directives. Previously if an environment variable was multiply specified the last set value would have been used. bz3438 * ssh-keygen(8): ssh-keygen -A (generate all default host key types) will no longer generate DSA keys, as these are insecure and have not been used by default for some years. New features ------------ * ssh(1), sshd(8): add a RequiredRSASize directive to set a minimum RSA key length. Keys below this length will be ignored for user authentication and for host authentication in sshd(8). * sftp-server(8): add a "users-groups-by-id@openssh.com" extension request that allows the client to obtain user/group names that correspond to a set of uids/gids. * sftp(1): use "users-groups-by-id@openssh.com" sftp-server extension (when available) to fill in user/group names for directory listings. * sftp-server(8): support the "home-directory" extension request defined in draft-ietf-secsh-filexfer-extensions-00. This overlaps a bit with the existing "expand-path@openssh.com", but some other clients support it. * ssh-keygen(1), sshd(8): allow certificate validity intervals, sshsig verification times and authorized_keys expiry-time options to accept dates in the UTC time zone in addition to the default of interpreting them in the system time zone. YYYYMMDD and YYMMDDHHMM[SS] dates/times will be interpreted as UTC if suffixed with a 'Z' character. Also allow certificate validity intervals to be specified in raw seconds-since-epoch as hex value, e.g. -V 0x1234:0x4567890. This is intended for use by regress tests and other tools that call ssh-keygen as part of a CA workflow. bz3468 * sftp(1): allow arguments to the sftp -D option, e.g. sftp -D "/usr/libexec/sftp-server -el debug3" * ssh-keygen(1): allow the existing -U (use agent) flag to work with "-Y sign" operations, where it will be interpreted to require that the private keys is hosted in an agent; bz3429 MFC after: 2 weeks Relnotes: Yes Sponsored by: The FreeBSD Foundation
* OpenSSL: Regen manual pages for OpenSSL 1.1.1qJung-uk Kim2022-07-0549-49/+49
|
* OpenSSL: Regen manual pages for OpenSSL 1.1.1pJung-uk Kim2022-06-2149-98/+98
|
* OpenSSL: Merge OpenSSL 1.1.1oJung-uk Kim2022-05-0349-49/+49
|
* OpenSSL: Merge OpenSSL 1.1.1nJung-uk Kim2022-03-1549-50/+53
|
* OpenSSL: Merge OpenSSL 1.1.1mJung-uk Kim2021-12-1449-52/+61
|
* ssh: move common Makefile boilerplate to a new ssh.mkEd Maste2021-11-037-15/+7
| | | | | | | | | | This moves SSHDIR and ssh_namespace.h handling to a common location, and will simplify future work such as adding U2F support (D32509). Reviewed by: kevans MFC after: 1 week Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D32808
* openssh: update to OpenSSH v8.7p1Ed Maste2021-09-083-3/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Some notable changes, from upstream's release notes: - sshd(8): Remove support for obsolete "host/port" syntax. - ssh(1): When prompting whether to record a new host key, accept the key fingerprint as a synonym for "yes". - ssh-keygen(1): when acting as a CA and signing certificates with an RSA key, default to using the rsa-sha2-512 signature algorithm. - ssh(1), sshd(8), ssh-keygen(1): this release removes the "ssh-rsa" (RSA/SHA1) algorithm from those accepted for certificate signatures. - ssh-sk-helper(8): this is a new binary. It is used by the FIDO/U2F support to provide address-space isolation for token middleware libraries (including the internal one). - ssh(1): this release enables UpdateHostkeys by default subject to some conservative preconditions. - scp(1): this release changes the behaviour of remote to remote copies (e.g. "scp host-a:/path host-b:") to transfer through the local host by default. - scp(1): experimental support for transfers using the SFTP protocol as a replacement for the venerable SCP/RCP protocol that it has traditionally used. Additional integration work is needed to support FIDO/U2F in the base system. Deprecation Notice ------------------ OpenSSH will disable the ssh-rsa signature scheme by default in the next release. Reviewed by: imp MFC after: 1 month Relnotes: Yes Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D29985
* OpenSSL: Regen manual pages for 1.1.1lJung-uk Kim2021-09-0149-102/+102
|
* pkgbase: Put openssl in its own packageEmmanuel Vadot2021-05-131-0/+1
| | | | | | | | This is useful for upgrade and also to make tiny jail so they won't depend on FreeBSD-utilities (where openssl was packaged before). MFC after: 1 month Differential Revision: https://reviews.freebsd.org/D30081
* Revert "Add workaround for a QoS-related bug in VMWare Workstation."Ed Maste2021-04-251-3/+0
| | | | | | | | | | | | | | | This reverts commit 77c2fe20df6a9a7c1a353e1a4ab2ba80fefab881. The VMware Workstation issue was fixed in 2019[1], and we'd rather not carry unnecessary local changes in OpenSSH. [1] https://communities.vmware.com/t5/VMware-Workstation-Pro/Regression-ssh-results-in-broken-pipe-upon-connecting-in-Vmware/m-p/486105/highlight/true#M25470 PR: 234426 Discussed with: yuripv Approved by: des MFC after: 2 weeks Sponsored by: The FreeBSD Foundation
* OpenSSL: Regen manual pages for 1.1.1kJung-uk Kim2021-03-2549-49/+49
|
* OpenSSL: Regen manual pages for OpenSSL 1.1.1j.Jung-uk Kim2021-02-1650-106/+106
|
* OpenSSL: Regenerate manual pages.Jung-uk Kim2021-01-2849-51/+51
| | | | MFC after: 1 week
* Merge OpenSSL 1.1.1i.Jung-uk Kim2020-12-0947-98/+102
| | | | Notes: svn path=/head/; revision=368472
* Replace literal uses of /usr/local in C sources with _PATH_LOCALBASEStefan Eßer2020-10-271-0/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | Literal references to /usr/local exist in a large number of files in the FreeBSD base system. Many are in contributed software, in configuration files, or in the documentation, but 19 uses have been identified in C source files or headers outside the contrib and sys/contrib directories. This commit makes it possible to set _PATH_LOCALBASE in paths.h to use a different prefix for locally installed software. In order to avoid changes to openssh source files, LOCALBASE is passed to the build via Makefiles under src/secure. While _PATH_LOCALBASE could have been used here, there is precedent in the construction of the path used to a xauth program which depends on the LOCALBASE value passed on the compiler command line to select a non-default directory. This could be changed in a later commit to make the openssh build consistently use _PATH_LOCALBASE. It is considered out-of-scope for this commit. Reviewed by: imp MFC after: 1 month Differential Revision: https://reviews.freebsd.org/D26942 Notes: svn path=/head/; revision=367075
* Merge OpenSSL 1.1.1h.Jung-uk Kim2020-09-2249-195/+197
| | | | Notes: svn path=/head/; revision=366004
* Merge OpenSSL 1.1.1g.Jung-uk Kim2020-04-2149-51/+51
| | | | Notes: svn path=/head/; revision=360175
* Merge OpenSSL 1.1.1f.Jung-uk Kim2020-03-3149-49/+49
| | | | Notes: svn path=/head/; revision=359486
* Merge OpenSSL 1.1.1e.Jung-uk Kim2020-03-1849-121/+167
| | | | Notes: svn path=/head/; revision=359060
* Update Makefile.depend filesSimon J. Gerraty2019-12-111-2/+2
| | | | | | | | | | | | | Update a bunch of Makefile.depend files as a result of adding Makefile.depend.options files Reviewed by: bdrewery MFC after: 1 week Sponsored by: Juniper Networks Differential Revision: https://reviews.freebsd.org/D22494 Notes: svn path=/head/; revision=355617
* Add Makefile.depend.optionsSimon J. Gerraty2019-12-111-0/+6
| | | | | | | | | | | | | | | | | | | | Leaf directories that have dependencies impacted by options need a Makefile.depend.options file to avoid churn in Makefile.depend DIRDEPS for cases such as OPENSSL, TCP_WRAPPERS etc can be set in local.dirdeps-options.mk which can add to those set in Makefile.depend.options See share/mk/dirdeps-options.mk Reviewed by: bdrewery MFC after: 1 week Sponsored by: Juniper Networks Differential Revision: https://reviews.freebsd.org/D22469 Notes: svn path=/head/; revision=355616
* Merge OpenSSL 1.1.1d.Jung-uk Kim2019-09-1049-110/+111
| | | | Notes: svn path=/head/; revision=352191
* Merge OpenSSL 1.1.1c.Jung-uk Kim2019-05-2849-69/+69
| | | | Notes: svn path=/head/; revision=348340
* Add workaround for a QoS-related bug in VMWare Workstation.Dag-Erling Smørgrav2019-03-271-0/+3
| | | | | | | | Submitted by: yuripv Differential Revision: https://reviews.freebsd.org/D18636 Notes: svn path=/head/; revision=345579
* Merge OpenSSL 1.1.1b.Jung-uk Kim2019-02-2649-678/+898
| | | | Notes: svn path=/head/; revision=344602
* Merge OpenSSL 1.1.1a.Jung-uk Kim2018-11-2049-106/+167
| | | | Notes: svn path=/head/; revision=340703
* MFH r338661 through r339200.Glen Barber2018-10-051-0/+2
|\ | | | | | | | | | | | | Sponsored by: The FreeBSD Foundation Notes: svn path=/projects/openssl111/; revision=339201
| * Move the openssl.cnf install to secure/usr.bin/openssl/Brad Davis2018-09-201-0/+2
| | | | | | | | | | | | | | | | | | | | This leverages CONFS to do the install Approved by: re (pkgbase, blanket), bapt (mentor) Differential Revision: https://reviews.freebsd.org/D17245 Notes: svn path=/head/; revision=338825
* | Remove MD dirdeps from Makefile.depend.Jung-uk Kim2018-09-251-1/+0
| | | | | | | | | | | | | | It can't be right. :-( Notes: svn path=/projects/openssl111/; revision=338936
* | Regen Makefile.depend.Jung-uk Kim2018-09-251-0/+1
| | | | | | | | Notes: svn path=/projects/openssl111/; revision=338933
* | Remove pthread from LIBADD for openssl(1).Jung-uk Kim2018-09-201-1/+1
| | | | | | | | | | | | | | libcrypto is linked with pthread since r338816. Notes: svn path=/projects/openssl111/; revision=338848
* | Build openssl(1).Jung-uk Kim2018-09-191-9/+10
| | | | | | | | Notes: svn path=/projects/openssl111/; revision=338768
* | Regen manual pages.Jung-uk Kim2018-09-1351-3100/+5820
|/ | | | | | | Note the manual pages are not automatically generated for now. Notes: svn path=/projects/openssl111/; revision=338671
* Move ssh config file handling into the ssh Makefiles.Brad Davis2018-08-151-0/+2
| | | | | | | | | | This helps with pkgbase by using CONFS and tagging these as config files. Approved by: allanjude (mentor), des Differential Revision: https://reviews.freebsd.org/D16678 Notes: svn path=/head/; revision=337852
* Merge OpenSSL 1.0.2p.Jung-uk Kim2018-08-1445-185/+256
| | | | Notes: svn path=/head/; revision=337791
* Upgrade to OpenSSH 7.6p1. This will be followed shortly by 7.7p1.Dag-Erling Smørgrav2018-05-081-1/+1
| | | | | | | | | This completely removes client-side support for the SSH 1 protocol, which was already disabled in 12 but is still enabled in 11. For that reason, we will not be able to merge 7.6p1 or newer back to 11. Notes: svn path=/head/; revision=333389
* Merge OpenSSL 1.0.2o.Jung-uk Kim2018-03-2745-66/+60
| | | | Notes: svn path=/head/; revision=331627
* Remove c_rehash(1) to not confuse users. We do not install the Perl script.Jung-uk Kim2018-02-082-230/+0
| | | | | | | MFC after: 3 days Notes: svn path=/head/; revision=329024
* Merge OpenSSL 1.0.2n.Jung-uk Kim2017-12-0746-46/+46
| | | | Notes: svn path=/head/; revision=326662
* Merge OpenSSL 1.0.2m.Jung-uk Kim2017-11-0247-51/+134
| | | | Notes: svn path=/head/; revision=325328
generated by cgit v1.3 (git 2.53.0) at 2026-04-17 21:41:45 +0000