Aren/NetBSD
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
135,005 Commits 606 Branches 0 Tags 3.1 GiB
37840e8766
Commit Graph

705 Commits

Author SHA1 Message Date
drochner
5e420ba772 restore behaviour before the 0.9.7d import: fall back to /dev/urandom 
if ~/.rnd is not present.
(This code is with #ifdef __OpenBSD__ in openssl now; this change just
generalizes it.)
(approved by tls)
 2004-06-21 15:14:16 +00:00
itojun
166adfa9e5 sync w/ 20040617. 2004-06-17 03:42:55 +00:00
itojun
f7968a3c82 version 20040617a, includes important fix about cert handling 2004-06-17 03:38:44 +00:00
lha
76164d845a Now that we have res_nsearch, use it. Thanks christos for adding it. 2004-05-25 11:15:43 +00:00
lha
bba70dc29c Merge changes between Heimdal 0.6.1 and 0.6.2 2004-05-08 13:27:58 +00:00
lha
0575824546 Import of Heimdal release 0.6.2 
* Fix possible buffer overrun in v4 kadmin (which now defaults to off)
 2004-05-08 13:15:02 +00:00
jonb
e0bc90b23e Set LoginGraceTime back to 600 like it used to be. This should 
help slow machines with long keys to still work like they did with
NetBSD 1.6 and before.
 2004-05-01 06:06:33 +00:00
itojun
b4a3a9e6c1 properly validate phase 1 signature. 
http://www.vuxml.org/freebsd/d8769838-8814-11d8-90d1-0020ed76ef5a.html
 2004-04-12 03:34:05 +00:00
itojun
604a0b444a KAME racoon as of 2004/4/12 2004-04-12 03:26:57 +00:00
lha
e4e583e45c From Heimdal, cast size_t to unsigned long for LP64 platforms. 2004-04-02 20:58:36 +00:00
lha
8aa367e8da more text how to do imports 2004-04-02 15:11:21 +00:00
lha
4d21efe5f7 Merge changes between heimdal-0.6 and heimdal-0.6.1 2004-04-02 14:59:46 +00:00
lha
a08e247c98 Import heimdal-0.6.1 
Changes in release 0.6.1
 * Fixed ARCFOUR suppport
 * Cross realm vulnerability
 * kdc: fix denial of service attack
 * kdc: stop clients from renewing kerberos 4 tickets into the future
 * bug fixes
 2004-04-02 14:47:00 +00:00
itojun
7fba5a69cf reject packet with too big isakmp message length field. 2004-03-31 07:19:27 +00:00
groo
4b32eb44a7 Resolve conflicts. In particular, prefer OpenSSL's BIO_strl* and 
BIO_strncpy over ours.
 2004-03-20 04:32:34 +00:00
groo
5a374ad0ce Import OpenSSL 0.9.7d to address: 
1. Null-pointer assignment during SSL handshake
	2. Out-of-bounds read affects Kerberos ciphersuites
 2004-03-20 04:22:06 +00:00
groo
0684427439 Import OpenSSL 0.9.7d to address: 
1. Null-pointer assignment during SSL handshake
	2. Out-of-bounds read affects Kerberos ciphersuites
 2004-03-20 04:22:04 +00:00
wiz
eec56f3b12 Bump date for previous. 2004-03-06 23:38:40 +00:00
itojun
da6bd485cd add missing description of "EnableSshKeysign". 2004-03-06 14:33:08 +00:00
itojun
c6a556a5b6 endian mismatch. from iij seil team 2004-01-16 02:25:14 +00:00
itojun
3c3791b847 validate hash on info exchange. bugtraq <20040113213940.GA1727@hzeroseven.org> 2004-01-14 09:17:42 +00:00
dyoung
4758291178 Fix the checkflist for builds without Kerberos 4 (MKKERBEROS4=no) 
and without Kerberos 4 & 5 (MKKERBEROS=no). Previously checkflist
complained of missing files.

* move kerberos- and kerberos 4-only files into new flists,
  distrib/sets/lists/*/krb.*

* make the flist generators grok MKKERBEROS{,4} variables

* fix Makefiles which treat MKKERBEROS=no as MKKERBEROS5=no.
  9 out of 10 experts agree that it is ludicrous to build w/
  KERBEROS4 and w/o KERBEROS5.

* fix header files, also, which treat MKKERBEROS=no as MKKERBEROS5=no.

* omit some Kerberos-only subdirectories from the build as
  MKKERBEROS{,4} indicate

(I acknowledge the sentiment that flists are the wrong way to go,
and that the makefiles should produce the metalog directly.  That
sounds to me like the right way to go, but I am not prepared to do
revamp all the makefiles.  While my approach is expedient, it fits
painlessly within the current build architecture until we are
delivered from flist purgatory, and it does not postpone our
delivery. Fair enough?)
 2003-12-11 09:46:26 +00:00
itojun
2a85abd333 avoid memory leak. hint from Andrew Lunn 2003-11-23 08:33:13 +00:00
itojun
5451f8a14e do not malloc(0). Andrew Lunn 2003-11-23 08:23:02 +00:00
jonathan
dedf78268d Patch OpenSSL to use opencrypto (aka /dev/crypto), if configured and 
(per kernel policy) for crypto transforms for which hardware
acceleration is available. Affects:

   crypto/dist/openssl/crypto/engine/eng_all.c
   crypto/dist/openssl/crypto/engine/hw_cryptodev.c
   crypto/dist/openssl/crypto/evp/c_all.c

as posted to tech-crypto for review/comment on 2003-08-21.
 2003-11-20 00:55:51 +00:00
wiz
4bbfee09ca Various typo fixes from Jonathon Gray via jmc@openbsd. 2003-11-17 11:16:10 +00:00
itojun
6de72ce0f8 typo. minoura 2003-11-13 10:35:40 +00:00
yamt
1356e8977e pfkey_dump_sadb: when it get an error using sysctl, 
mimic an error msg from keysock so that caller can process it correctly.

PR/23122.
 2003-11-09 15:37:24 +00:00
itojun
aec01dda91 sync w/ openssl 0.9.7c. shlib minor bump for libcrypto. 
(ERR_release_err_state_table() added)
 2003-11-04 23:54:26 +00:00
itojun
385718bc5c more unifdef 2003-11-04 23:45:56 +00:00
itojun
6b4e6697c9 openssl 0.9.7c. security changes are already in place 2003-11-04 23:25:09 +00:00
itojun
746d6bb953 bring in kame rev 1.32. PR 23122 2003-11-04 04:30:38 +00:00
thorpej
1244cc6c62 Fix NULL vs 0 mixup. 2003-10-25 20:48:10 +00:00
itojun
f90a2e28b1 do not build "null ESP and no AUTH" proposal. (racoon 174) by Tom Lendacky 2003-10-23 07:23:50 +00:00
fvdl
6a6c3ca82f Don't assign NULL as an integer. 2003-10-21 03:06:55 +00:00
fvdl
73d47a4f07 Don't return NULL as an integer. 2003-10-21 03:03:39 +00:00
thorpej
eb3570747f Make sure HAVE_OPENSSL is undefined, to avoid depending on both 
libcrypto and libdes.  Patch by lha@, posted to tech-userlevel.
 2003-10-09 04:31:17 +00:00
itojun
ac0a546d0d realloc error check failure; Greg Troxel, sync w/kame 2003-10-03 21:53:32 +00:00
itojun
48b0bfaad0 support policy w/o selector. 2003-10-02 19:53:01 +00:00
itojun
3c068c5948 correct unsafe realloc(). 2003-10-02 19:52:43 +00:00
itojun
b3cd345741 more fixes from 0.9.7c, from openbsd 2003-10-02 02:26:17 +00:00
itojun
ae91503b5d from openbsd: 
Correct some off-by-ones.  They currently don't matter, but this
is for future safety and consistency.
OK krw@, markus@
 2003-10-02 02:25:05 +00:00
christos
0a7cc0d7d1 Apply security fix: http://www.openssl.org/news/secadv_20030930.txt 
Changelog from: http://cvs.openssl.org/chngview?cn=11471
 2003-09-30 15:59:53 +00:00
mycroft
5749c53775 Fix what is obviously a bug: valloc() -> vmalloc(). Now racoon(8) doesn't core 
dump all the time.
 2003-09-25 01:00:32 +00:00
itojun
34439bf0c9 off-by-one. from openbsd 2003-09-22 22:12:05 +00:00
itojun
28c3d43114 typo. markus@openbsd 2003-09-18 12:42:33 +00:00
itojun
841f7944e5 protect against double free; #660; zardoz at users.sf.net 
from openbsd
 2003-09-18 08:16:40 +00:00
itojun
c2011dbc01 missing buffer_free(&encrypted); #662; zardoz at users.sf.net 
from openbsd
 2003-09-18 08:16:15 +00:00
christos
898af9fa6c make sure we init nalloc. 2003-09-18 01:41:56 +00:00
christos
3171afa413 fix problem in previous patch 2003-09-18 01:35:07 +00:00
christos
d4d840dd36 More buffer size adjusted before allocation succeeded fixes. Bump to 20030917. 
From FreeBSD (with an additional one from me).
 2003-09-17 23:19:02 +00:00
christos
51b1a61a2d dammit, don't apply patches blindly. 2003-09-16 23:18:24 +00:00
christos
08d244b791 bring more fixes from 3.7.1 2003-09-16 23:16:59 +00:00
lukem
5de000c8d7 crank __NETBSDSSH_VERSION for buffer.c fix 2003-09-16 17:39:32 +00:00
christos
325fccf53f Do not record expanded size before attempting to reallocate the associated 
memory. From OpenBSD, via FreeBSD.
 2003-09-16 13:22:57 +00:00
itojun
249c9d88ea use sysctl to dump SAs if possible (not really tested) 2003-09-12 08:44:34 +00:00
itojun
efbe374b9f SKEY and BSDAUTH #ifdef mixup 2003-09-08 21:00:41 +00:00
itojun
f13cb0c7b2 bzero() 2nd arg mistake. found by openbsd guys. from kame 2003-09-04 00:12:56 +00:00
itojun
ca14877c77 reject rc5/idea/mdc2 commands if OPENSSL_NO_xx is specified 2003-08-27 21:05:02 +00:00
wiz
31fd31ccf7 Make getlastlogx have the pathname to the lastlogx database as first 
argument, to be consistent with updlastlogx.

Approved by christos, reviewed by kleink.

[The lastlogxname function should not be used any longer.]
 2003-08-26 16:48:32 +00:00
itojun
d9c46578d1 update racoon to 2003/8/26 version. mostly minor bugfixes. 2003-08-26 03:31:50 +00:00
itojun
2cfb643fda KAME racoon, as of 2003/08/26 2003-08-26 03:27:01 +00:00
itojun
b5f8b9a7c0 KAME libipsec/libpfkey, 2003/08/26 2003-08-26 03:25:29 +00:00
itojun
eb24db53ab style; total size of buf is (num + 3) 2003-08-13 01:29:41 +00:00
simonb
658a8c458e Fix bad use of "sizeof(pointer)" where the length of a buffer was the 
intention.  Fixes problems with least ssh's known_hosts file and factor.

Patch from Berndt Josef Wulf's PR lib/22347.
 2003-08-12 03:25:24 +00:00
agc
dc4f8c2e1a Move UCB-licensed code from 4-clause to 3-clause licence. 
Patches provided by Joel Baker in PR 22252, verified by myself.
 2003-08-07 09:15:17 +00:00
itojun
5de5abdd3d consistently use new DES API, re-enable des regression test 2003-07-31 08:53:58 +00:00
itojun
965395c9f3 re-enable __RCSID, sys/cdefs_elf.h rev 1.15 fixed the problem 2003-07-30 00:34:16 +00:00
itojun
f33c57af22 disable __RCSID for now, somehow it puts some of integer variables 
into .text region
 2003-07-29 23:17:39 +00:00
itojun
308bb7eb39 remove unused macro. PR 21150 2003-07-29 04:45:39 +00:00
itojun
4c43ef4ce1 xx_keylen has to return bits, not bytes. KAME-PR-488 2003-07-29 04:30:54 +00:00
jwise
3514116803 Apply patch from lha@, via OpenBSD portable SSH's revision 1.11 of this file: 
mcc -> fcc; from Love Hörnquist Åstrand <lha@it.su.se>
  otherwise the kerberos credentinal is stored in a memory cache
  in the privileged sshd.

Presumably, this will also come in as part of a later OpenSSH release via
`cvs import', but this is worth having now.
 2003-07-28 15:50:17 +00:00
cjep
c6912d0211 remove duplicate manual 2003-07-26 15:11:43 +00:00
itojun
08a1c4bcd3 empty commit, just to update timestamp and force rebuild of krb.h. 2003-07-26 01:07:35 +00:00
itojun
805c102737 fix compilation on sparc64. reported by Juergen Hannken-Illjes 2003-07-25 09:06:02 +00:00
itojun
e8876f361f avoid "unsigned u_int32_t" 2003-07-25 02:02:43 +00:00
itojun
88ec7d3792 bring back krb4 support, just to suppress unwanted noise from other developers. 
note that official openssh distribution have already dropped kerberosIV support,
therefore maintenance cost needs to be paid by us.  and have no intent to help.
 2003-07-24 15:31:52 +00:00
itojun
f4401cd869 upgrade openssl to 0.9.7b. (AES is now supported) 
alter des.h to be friendly with openssl/des.h (you can include both in the
same file)
make libkrb to depend on libdes.  bump major.
massage various portioin of heimdal to be friendly with openssl 0.9.7b.
 2003-07-24 14:16:30 +00:00
itojun
2836295a36 OpenSSL 0.9.7b, major API changes included 2003-07-24 08:25:41 +00:00
itojun
0f3017142e use snprintf (actually, "addr" can be supplied from outside, and if "addr" 
points to shorter-than-24 buffer we will overrun buffer.  bad API)
 2003-07-24 04:41:13 +00:00
itojun
7b7c18c4c5 the block is just for krb4 (not for krb5) so should be removed. lha 2003-07-23 21:25:08 +00:00
itojun
c55f89ad19 typo on #if condition converesion 2003-07-23 21:03:03 +00:00
itojun
0091553542 define symbols even when !KRB4, to simplify shlib management. lha 2003-07-23 20:48:34 +00:00
itojun
8556dff80c remove KRB4 and AFS support. sync w/ openssh main tree 2003-07-23 03:52:16 +00:00
itojun
a9503412ba license clarification (UCB 3-clause, and progressmeter) 2003-07-23 03:51:27 +00:00
itojun
46471dc1e9 cast for signed/unsigned mixup 2003-07-14 18:27:48 +00:00
itojun
1bffbcd4a1 correct ^@ incorrectly committed 2003-07-14 18:26:05 +00:00
itojun
a157f97782 unifdef VMS/WIN16/WIN32 in public headers, at least 2003-07-14 14:06:14 +00:00
itojun
c187ba994b use bounded string op (only one sprintf remains - still no clue) 2003-07-14 13:24:00 +00:00
itojun
a395b35ba2 delint 2003-07-14 13:07:05 +00:00
itojun
848c8ac0ef use bounded string ops (especially libraries) 2003-07-14 13:05:19 +00:00
itojun
afdee9affa __RCSID. add missing copyright in *.y and *.l (sync w/kame) 2003-07-12 09:37:09 +00:00
itojun
03eefe2ecf sync w/ latest racoon 2003-07-12 09:02:24 +00:00
itojun
dc30725eaf kame racoon 2003/7/12. lots of lots of stability fixes. 2003-07-12 08:45:39 +00:00
lukem
b1395375fd add __RCSID("$NetBSD$"), because it's hard to track our changes in a 
binary when we only have the vendor's RCSID.
 2003-07-10 01:09:41 +00:00
wiz
fc3229a199 Undo unintended commit. 2003-07-04 21:57:16 +00:00
wiz
ee8924aa2e Fix off-by-one. From William Allen Simpson in PR 22012. 2003-07-04 21:56:48 +00:00
wiz
f9cc3a858b Bump date for recent changes. 2003-07-04 12:33:11 +00:00
wiz
de2728383c Punctuation fixes. 2003-07-04 12:31:33 +00:00
wiz
d9fb607438 Quote punctuation so it gets marked up. 2003-06-30 11:52:01 +00:00