10802677c9
Bug fixes from the ipsec-tools 0.6 branch:
...
- Fix NAT-T problems that prevented multiple peers behind the same NAT
to talk to the same machine outside the NAT. This also require kernel
fixes (already committed eralier)
- Fix a LP64 bug
- Fix NAT-T RFC conformance bugs (missing non ESP marker in packets)
- Add a -p option to setkey to display ports that could be used for ESP
over UDP when printing policies
2005-04-27 05:19:49 +00:00
d627c3edde
Don't emit struct units [] anymore. emit a struct units * const foo and
...
in the C file initialize that to the static list.
2005-04-25 17:20:51 +00:00
5ac7f26c22
Emit headers with #include <parse_units.h> so that struct units is defined
...
so that extern struct units <foo> will not cause errors with gcc4.x
2005-04-25 01:25:25 +00:00
14fc3b7ba8
Fix printf format/argument mismatch.
2005-04-24 13:31:01 +00:00
a8090b3963
add back moduli
2005-04-23 21:12:47 +00:00
31ed567522
resolve conflicts.
2005-04-23 19:31:14 +00:00
ed314b4eb0
from www.openssl.org
2005-04-23 19:10:56 +00:00
0df7655544
bring back files that this update removed.
2005-04-23 16:55:03 +00:00
8471a3b7da
resolve conflicts.
2005-04-23 16:53:28 +00:00
70917d9a4b
Import OpenSSH 4.0 from ftp.openbsd.org
2005-04-23 16:28:01 +00:00
6845962b31
Fix simple DES support (security problems for racoon to racoon setups)
...
Fix broken generated policies flush
2005-04-19 19:42:08 +00:00
97b2d3b1c8
check for pwd != NULL in getpwnam_r. From John Nemeth.
2005-04-19 12:55:31 +00:00
d3e5d568cd
Fix SA lifebyte check
2005-04-18 11:15:01 +00:00
e35111eeee
Some more minor changes, ok manu@.
2005-04-17 01:03:46 +00:00
1390e25dcf
Some more English improvements after feedback from manu@; more formatting.
2005-04-15 13:23:58 +00:00
6e35cd769e
Improve English in comments.
2005-04-15 11:10:32 +00:00
0f822df19c
Improve english, improve formatting, sort options.
2005-04-15 10:58:11 +00:00
c0259e4629
Grammar fixes & improvements.
2005-04-14 11:47:26 +00:00
57066c3ab7
Grammar improvements.
2005-04-14 11:41:53 +00:00
097b641d74
kerberos -> Kerberos.
2005-04-14 11:35:08 +00:00
1b303684c3
Fix typo.
2005-04-14 11:34:37 +00:00
6b53ca1794
all SA -> all SAs.
2005-04-14 10:31:35 +00:00
6e903fbf59
New sentence, new line; some other dot fixes found during line breaking.
2005-04-14 10:30:28 +00:00
1131da3fb1
Use capitalized spelling of NetBSD.
2005-04-14 10:26:40 +00:00
6e8a3f159a
Add LIBRARY section.
2005-04-14 10:25:58 +00:00
863b095e57
Punctuation nits.
2005-04-14 10:24:43 +00:00
0fb9995f39
Use Bq instead of [].
2005-04-14 10:24:18 +00:00
75b3bff7ae
Punctuation nits.
2005-04-14 10:23:38 +00:00
dd317f6217
Use .In for header files.
2005-04-14 10:22:11 +00:00
9e8d46e23b
No dot at end of SEE ALSO; Xr fixes.
2005-04-14 10:21:22 +00:00
9582558bf7
Mostly punctuation nits; break line after Xr arguments.
2005-04-14 10:20:01 +00:00
954b6abb72
Fix Dd and Dt arguments; fix two more typos; add comma in SEE ALSO;
...
format author with An/Aq.
2005-04-14 10:15:58 +00:00
2299aab679
We want .Os without argument.
2005-04-14 10:13:10 +00:00
f6b271af05
Add missing .Os.
2005-04-14 10:13:03 +00:00
472d87499c
Uncomment xref to racoonctl.
2005-04-14 10:11:32 +00:00
acc79b78a6
hexa-decimal -> hexadecimal.
2005-04-14 10:07:35 +00:00
db0843b173
Add an article, and 2nd -> second.
2005-04-14 10:07:10 +00:00
f7c1b62f03
Use Xr for chroot.
2005-04-14 10:06:32 +00:00
d0e3ae6a43
oakley -> Oakley.
2005-04-14 10:05:45 +00:00
caf942511e
aspell
2005-04-14 10:04:17 +00:00
2ea3f3fa43
Drop trailing whitespace.
2005-04-14 09:47:12 +00:00
03a7a7234a
New sentence, new line. Remove Os argument (we are not KAME).
...
NetBSD -> Nx. Use Sx for section cross-references.
2005-04-13 23:12:01 +00:00
6cd6ff42d8
Drop trailing whitespace.
2005-04-13 23:09:35 +00:00
5a6c417352
Resurrect TCP-MD5 support. This fixes bin/29915
2005-04-10 21:20:55 +00:00
09a5230af6
Fix a buffer overrun in ISAKMP mode config SET handler
2005-04-04 21:43:26 +00:00
55ef051c47
s/u_int32_t/uint32_t/
...
kill the rest of u32,u16,u8
2005-03-26 03:48:44 +00:00
9b98d82f76
s/u32/u_int32_t/
2005-03-26 02:23:06 +00:00
c6a84da3bd
Don't define FIPS_selftest_failed locally.
2005-03-26 02:22:42 +00:00
514fe26b5c
The last broken merge.
2005-03-25 23:03:47 +00:00
2674f87be1
Fix merge issue.
2005-03-25 21:54:20 +00:00
db19fc60e2
Missed 2 #ifdef OPENSSL_FIPS...
2005-03-25 20:19:51 +00:00
684dfceb07
Resolve conflicts.
2005-03-25 20:14:24 +00:00
e72fb54032
import openssl-0.9.7f from ftp.openssl.org
2005-03-25 19:05:51 +00:00
ac37001e7f
As observed in other modules, pull in <sys/queue.h> explicitly rather
...
than relying on namespace pollution to do so.
2005-03-17 20:40:42 +00:00
d658ac5976
Updated ipsec-tools:
...
2005-03-16 Emmanuel Dreyfus <manu@netbsd.org>
* src/racoon/{cftoken.l|localconf.h|privsep.c|racoon.conf.5}
src/racoon/remoteconf.c: When running in privsep mode, check that
private key and script paths match those given in the path section.
2005-03-15 Emmanuel Dreyfus <manu@netbsd.org>
* src/racoon/{isakmp_cfg|isakmp_cfg.h|isakmp_xauth.c}: initialize
RADIUS accounting at startup
* src/racoon/privsep.c: fix minor bug in PAM cleanup
* src/racoon/isakmp_cfg.c: only call cleanup_pam if PAM is used
2005-03-14 Emmanuel Dreyfus <manu@netbsd.org>
* configure.ac: handle correctly dynamic libradius
* src/racoon/cfparse.y: correctly initialize address pool
2005-03-16 23:53:12 +00:00
8a98c83667
Updated ipsec-tools:
...
2005-03-16 Emmanuel Dreyfus <manu@netbsd.org>
* src/racoon/{cftoken.l|localconf.h|privsep.c|racoon.conf.5}
src/racoon/remoteconf.c: When running in privsep mode, check that
private key and script paths match those given in the path section.
2005-03-15 Emmanuel Dreyfus <manu@netbsd.org>
* src/racoon/{isakmp_cfg|isakmp_cfg.h|isakmp_xauth.c}: initialize
RADIUS accounting at startup
* src/racoon/privsep.c: fix minor bug in PAM cleanup
* src/racoon/isakmp_cfg.c: only call cleanup_pam if PAM is used
2005-03-14 Emmanuel Dreyfus <manu@netbsd.org>
* configure.ac: handle correctly dynamic libradius
* src/racoon/cfparse.y: correctly initialize address pool
2005-03-16 23:52:42 +00:00
e4563075a5
Updated ipsec-tools:
...
2005-03-16 Emmanuel Dreyfus <manu@netbsd.org>
* src/racoon/{cftoken.l|localconf.h|privsep.c|racoon.conf.5}
src/racoon/remoteconf.c: When running in privsep mode, check that
private key and script paths match those given in the path section.
2005-03-15 Emmanuel Dreyfus <manu@netbsd.org>
* src/racoon/{isakmp_cfg|isakmp_cfg.h|isakmp_xauth.c}: initialize
RADIUS accounting at startup
* src/racoon/privsep.c: fix minor bug in PAM cleanup
* src/racoon/isakmp_cfg.c: only call cleanup_pam if PAM is used
2005-03-14 Emmanuel Dreyfus <manu@netbsd.org>
* configure.ac: handle correctly dynamic libradius
* src/racoon/cfparse.y: correctly initialize address pool
2005-03-16 23:51:44 +00:00
e298dc4582
Import ipsec-tools ipsec-tools-0_6-20050314
2005-03-14 08:14:24 +00:00
daee9fbceb
Add UsePam yes
2005-02-28 02:35:10 +00:00
519aeb19a0
Resolve conflict
2005-02-24 20:59:24 +00:00
6159f46a8d
Import ipsec-tools ipsec-tools-0_6-20050224
2005-02-24 20:52:25 +00:00
88856e235d
Resolve conficts and remove autoconf files that were committed by mistake
2005-02-23 15:17:50 +00:00
8006965b1b
Import ipsec-tools 0.6 branch as of 2005/02/23. News from last imported version
...
according to ipsec-tools' ChangeLog:
2005-02-23 Emmanuel Dreyfus <manu@netbsd.org>
* configure.ac, src/racoon/{Makefile.am|crypto_openssl.c}: optionnal
support for patented algorithms: IDEA and RC5.
* src/racoon/{isakmp_xauth.c|main.c}: don't initialize RADIUS if it
is not required in the configuration
* src/racoon/isakmp.c: do not reject addresses for which kernel
refused UDP encapsulation, they can still be used for non NAT-T
traffic (eg: NAT-T enabled racoon on non NAT-T enabled kernel)
2005-02-18 Emmanuel Dreyfus <manu@netbsd.org>
* src/racoon/{main.c|eaytest.c|plairsa-gen.c}
src/setkey/setkey.c: don't use fuzzy paths for package_version.h
2005-02-18 Yvan Vanhullebus <vanhu@free.fr>
* src/racoon/isakmp_inf.c: Purge generated SPDs when getting a
related DELETE_SA
* src/racoon/pfkey.c: do NOT unbindph12() when SA acquire
2005-02-17 Emmanuel Dreyfus <manu@netbsd.org>
From Fred Senault <fred.letter@lacave.net>
* src/racoon/remoteconf.c: Fix a bug in script init
2005-02-17 Yvan Vanhullebus <vanhu@free.fr>
* src/racoon/ipsec_doi.c: Workaround for phase1 lifetime checks
2005-02-15 Michal Ludvig <michal@logix.cz>
* configure.ac: Changed --enable-natt_NN to --enable-natt-versions=NN,NN
2005-02-23 14:53:33 +00:00
3e9f769ad6
Turn protocol 1 krb5 support back on.
2005-02-22 02:29:32 +00:00
0e4368712b
Fix Xref.
2005-02-20 21:10:54 +00:00
54c5fce210
Sort sections, whitespace nit, use .In.
2005-02-20 21:10:04 +00:00
a7d348371a
Remove KAME racoon distribution, which is not used anymore
2005-02-20 15:50:02 +00:00
9bd25f488a
re-enable smime encrypt. fix from openssl-0.9.7e
2005-02-20 03:33:47 +00:00
3029ac0bc4
Use __inline instead of inline.
2005-02-19 22:02:59 +00:00
c4362dc746
Move duplicate block for pam to the 1.5 dispatch block where it belongs.
...
Restore KRB4 and KRB5 blocks to the 1.5 dispatch block.
XXX: Should we remove the KRB4 block from the 2.0 dispatch block?
2005-02-19 03:08:23 +00:00
2a7ae5ee05
Fix package_version.h include path so it has a chance of working in
...
our source tree.
2005-02-18 06:28:52 +00:00
b4668e17e3
Alter the include path for package_version.h so that it has a chance
...
of working in our source tree.
2005-02-18 06:24:38 +00:00
48f369dafd
Put Kerberos configuration options back into client config parsing
...
routines.
2005-02-16 05:04:05 +00:00
e4afa5eb28
A sig_atomic_t isn't necessarily compatible with a %d printf format;
...
on evbsh5 sig_atomic_t is an __int64_t. Since this only stores a
signal number, cast to int before printing.
2005-02-15 16:22:12 +00:00
0b6f3b5222
add moduli from openssh-3.9p1
2005-02-13 19:34:24 +00:00
d6e447b0f6
Add PAM hooks from portable OpenSSH.
2005-02-13 18:14:04 +00:00
b3a1b19bc5
Make this compile.
2005-02-13 18:13:34 +00:00
cb2bba8c62
Add pam files from portable openssh 3.9p1
2005-02-13 18:11:30 +00:00
ea7d905559
Bring back files we need from the dead.
2005-02-13 06:01:36 +00:00
43dbbb7ed8
Merge conflicts.
2005-02-13 06:01:14 +00:00
8b8ab8547b
Resolve conflicts.
2005-02-13 05:57:25 +00:00
797648d563
Change the order of the set{e,}{u,g}id calls. NetBSD is stricter and needs
...
to keep the euid until the end. Add a bit of debugging.
2005-02-13 05:54:27 +00:00
cad419c94d
from ftp.openbsd.org
2005-02-13 00:52:40 +00:00
1cbaff0bc3
Remove .cvsignore files commtted by mistake
2005-02-12 15:52:36 +00:00
a8f0ad3c37
Import ipsec-tools (tag ipsec-tools-0_6-base in ipsec-tools CVS)
...
ipsec-tools is a fork from KAME racoon/libipsec/setkey, with many
enhancements.
2005-02-12 11:11:11 +00:00
9cbc979889
Bring closer to reality.
2005-02-07 12:26:56 +00:00
83da2f6968
don't throw const away for no reason.
2004-12-11 06:58:20 +00:00
fbed044c7e
Grr, this was not updating lastlogx!
2004-11-11 22:08:39 +00:00
b454543f45
Apply patches as discussed on:
...
http://mail-index.netbsd.org/tech-net/2004/11/05/0004.html
Slightly modified to differentiate the version string from a stock racoon.
* auth_gssapi.h (GSSAPI_DEF_NAME): Change from "ike" to "host".
(gssapi_get_default_id): Rename to gssapi_get_id.
(gssapi_get_default_gss_id): New prototype.
* cfparse.y (GSSAPI_ID): Rename to GSS_ID.
(GSS_ID_ENC, GSS_ID_ENCTYPE): New tokens.
(gssenc_statement): New statement.
(isakmpproposal_spec): Use GSS_ID token.
(expand_isakmpspec): Fill in gssid in the new proposal only
if authmethod is OAKLEY_ATTR_AUTH_METHOD_GSSAPI_KRB. If the
GSS ID is not provided, call gssapi_get_default_gss_id() to
place the default ID in the proposal.
* cftoken.l (S_GSSENC): New start condition.
(<S_RMTP>gss_id): New, return the GSS_ID token.
(<S_RMTP>gssapi_id): Return the GSS_ID token.
(<S_INI>gss_id_enc, <S_GSSENC>latin1, <S_GSSENC>utf-16le)
(<S_GSSENC>{semi}): New, tokenize the "gss_id_enc enctype;"
statement.
* gssapi.c: Include <unistd.h>.
(gssapi_get_default_gss_id): New function.
(gssapi_init): Disable a broken debugging message. Make
printf formats consistent in their handling of non-NUL-terminated
strings.
(gssapi_get_default_id): Rename to...
(gssapi_get_id): ...this. If the proposal has a gssid, vdup()
that and return it. Disable a broken debugging message. Make
printf formats consistent in their handling of non-NUL-terminated
strings.
* ipsec_doi.c: Include <iconv.h>.
(get_ph1approval): Make printf formats consistent in their handling
of non-NUL-terminated strings. Call gssapi_get_id() instead of
gssapi_get_default_id(), and remove some complexity that has been
pushed into that function.
(t2isakmpsa): When parsing the OAKLEY_ATTR_GSS_ID attribute,
check convert the attribute from UTF-16LE to ISO-Latin-1, unless
we are configured to assume the attribute is already ISO-Latin-1
encoded.
(setph1attr): When setting the OAKLEY_ATTR_GSS_ID attribute,
convert the attribute from ISO-Latin-1 to UTF-16LE, unless we
are configured to encode the attribute in ISO-Latin-1.
* localconf.c (setdefault): Set the default GSS ID encoding type
to UTF-16LE.
* localconf.h (LC_GSSENC_UTF16LE, LC_GSSENC_LATIN1)
(LC_GSSENC_MAX): New constants.
(struct localconf): Add gss_id_enc member.
* main.c (RACOON_VERSION): Append " - NetBSD 20041110" to the
version string.
* racoon.conf.5: Document changes to GSS ID encoding and default
GSS ID computation. Document "gss_id_enc enctype;" statement.
* samples/racoon.conf.sample-gssapi: Update and add comments to
provide more information.
2004-11-10 20:23:28 +00:00
d08f4201ee
For ptys of the form /dev/pts/n, print foo@pts/n instead of foo@n. Check
...
that strrchr() returns non null before using it.
2004-11-10 16:55:55 +00:00
1869f0e146
Add (unsigned char) cast to ctype functions
2004-11-05 21:56:01 +00:00
3d446c0f42
Add (unsigned char) cast to ctype functions
2004-11-03 21:01:45 +00:00
e2f49bd9e2
Add (unsigned char) cast to ctype functions
2004-10-30 15:15:37 +00:00
8668419e38
Add (unsigned char) cast to ctype functions
2004-10-30 08:34:24 +00:00
2c875217bb
Merge in changes between 0.6.2 and 0.6.3
2004-09-14 08:08:19 +00:00
ac5d4384ae
remove generated files
2004-09-14 07:50:24 +00:00
a53f6df83e
Import heimdal 0.6.3
...
Changes in release 0.6.3
* fix vulnerabilities in ftpd
* support for linux AFS /proc "syscalls"
* support for RFC3244 (Windows 2000 Kerberos Change/Set Password) in
kpasswdd
* fix possible KDC denial of service
* bug fixes
2004-09-14 07:45:53 +00:00
6e317e9e72
Disable the "may kill you" message, because:
...
1) It's not documented anywhere.
2) The problem it's attempting to warn about is not documented anywhere.
3) There are no example configs (or any I found with Google) that use the
"listen" directive.
4) In any event, it's poorly worded and unclear what it's talking about.
2004-08-06 13:57:05 +00:00
14c8904f79
rename local pow10 function to avoid conflicts with the C99 libm one;
...
while not implemented in NetBSD yet is is considered reserved by gcc-3.4
2004-08-05 16:55:34 +00:00
e8e1e9c2fe
Sync with Heimdal: krb5_set_password.3,v 1.7 (except for a reference to
...
a man page we don't have yet):
Document krb5_set_password_using_ccache and krb5_passwd_result_to_string.
Ok'd by lha.
2004-07-18 15:08:50 +00:00
258b1bfb2e
Remove superfluous comma; grammar fixes; split sentence
...
in two for better understanding.
XXX: krb5_set_password_using_ccache not described.
2004-07-14 09:21:59 +00:00
8045e967b9
Fix typo (space added at beginning of line in an editor window under
...
the shell where I retested the Makefile changes, sigh...)
2004-07-14 07:12:25 +00:00
f17171cf5d
Restore Heimdal Id as $Heimdal:, add NetBSD ID.
2004-07-14 07:06:44 +00:00
98b92eb4a5
Commit manpage for krb5_set_password(3), based on Heimdal-20040606,
...
with small revisions by myself, reviewed/approved by Love.
2004-07-14 07:02:07 +00:00
8416ac87c6
Print ssize_t-typed variables using %zd format, not just %d.
...
Fixes build problem observed when compiling for hpcarm.
2004-07-13 14:15:17 +00:00
e5f57f3a70
Commit changes from Heimdal-current, as per discussion with Love
...
(lha@NetBSD.ORG ), to incorporate contemporary (last-year-ish)
set-password and change-password extensions derived RFC-3244
(Microsoft set-password/change-password extensions), and the
subsequent MIT-KRB5 APIs for changing and setting passwords.
Required for compatibility with recent (2002/2003-ish) open-source
code which uses the MIT KRB5 APIs for setting passwords, or for
joining Microsoft domains as a "computer account".
Modified files (for pullup tracking purposes):
lib/libasn1/Makefile
crypto/dist/heimdal/lib/asn1/k5.asn1
crypto/dist/heimdal/lib/krb5/changepw.c
crypto/dist/heimdal/lib/krb5/krb5-protos.h
crypto/dist/heimdal/lib/krb5/krb5.h
2004-07-12 20:44:56 +00:00
763b8e76a6
Now that we have addrlen, use it.
2004-07-06 02:59:55 +00:00
c62dff1bf7
fix a const'ification inconsistency, noticed by gcc-3.4
2004-07-01 21:27:42 +00:00
5e420ba772
restore behaviour before the 0.9.7d import: fall back to /dev/urandom
...
if ~/.rnd is not present.
(This code is with #ifdef __OpenBSD__ in openssl now; this change just
generalizes it.)
(approved by tls)
2004-06-21 15:14:16 +00:00
166adfa9e5
sync w/ 20040617.
2004-06-17 03:42:55 +00:00
f7968a3c82
version 20040617a, includes important fix about cert handling
2004-06-17 03:38:44 +00:00
76164d845a
Now that we have res_nsearch, use it. Thanks christos for adding it.
2004-05-25 11:15:43 +00:00
bba70dc29c
Merge changes between Heimdal 0.6.1 and 0.6.2
2004-05-08 13:27:58 +00:00
0575824546
Import of Heimdal release 0.6.2
...
* Fix possible buffer overrun in v4 kadmin (which now defaults to off)
2004-05-08 13:15:02 +00:00
e0bc90b23e
Set LoginGraceTime back to 600 like it used to be. This should
...
help slow machines with long keys to still work like they did with
NetBSD 1.6 and before.
2004-05-01 06:06:33 +00:00
b4a3a9e6c1
properly validate phase 1 signature.
...
http://www.vuxml.org/freebsd/d8769838-8814-11d8-90d1-0020ed76ef5a.html
2004-04-12 03:34:05 +00:00
604a0b444a
KAME racoon as of 2004/4/12
2004-04-12 03:26:57 +00:00
e4e583e45c
From Heimdal, cast size_t to unsigned long for LP64 platforms.
2004-04-02 20:58:36 +00:00
8aa367e8da
more text how to do imports
2004-04-02 15:11:21 +00:00
4d21efe5f7
Merge changes between heimdal-0.6 and heimdal-0.6.1
2004-04-02 14:59:46 +00:00
a08e247c98
Import heimdal-0.6.1
...
Changes in release 0.6.1
* Fixed ARCFOUR suppport
* Cross realm vulnerability
* kdc: fix denial of service attack
* kdc: stop clients from renewing kerberos 4 tickets into the future
* bug fixes
2004-04-02 14:47:00 +00:00
7fba5a69cf
reject packet with too big isakmp message length field.
2004-03-31 07:19:27 +00:00
4b32eb44a7
Resolve conflicts. In particular, prefer OpenSSL's BIO_strl* and
...
BIO_strncpy over ours.
2004-03-20 04:32:34 +00:00
5a374ad0ce
Import OpenSSL 0.9.7d to address:
...
1. Null-pointer assignment during SSL handshake
2. Out-of-bounds read affects Kerberos ciphersuites
2004-03-20 04:22:06 +00:00
0684427439
Import OpenSSL 0.9.7d to address:
...
1. Null-pointer assignment during SSL handshake
2. Out-of-bounds read affects Kerberos ciphersuites
2004-03-20 04:22:04 +00:00
eec56f3b12
Bump date for previous.
2004-03-06 23:38:40 +00:00
da6bd485cd
add missing description of "EnableSshKeysign".
2004-03-06 14:33:08 +00:00
c6a556a5b6
endian mismatch. from iij seil team
2004-01-16 02:25:14 +00:00
3c3791b847
validate hash on info exchange. bugtraq <20040113213940.GA1727@hzeroseven.org>
2004-01-14 09:17:42 +00:00
4758291178
Fix the checkflist for builds without Kerberos 4 (MKKERBEROS4=no)
...
and without Kerberos 4 & 5 (MKKERBEROS=no). Previously checkflist
complained of missing files.
* move kerberos- and kerberos 4-only files into new flists,
distrib/sets/lists/*/krb.*
* make the flist generators grok MKKERBEROS{,4} variables
* fix Makefiles which treat MKKERBEROS=no as MKKERBEROS5=no.
9 out of 10 experts agree that it is ludicrous to build w/
KERBEROS4 and w/o KERBEROS5.
* fix header files, also, which treat MKKERBEROS=no as MKKERBEROS5=no.
* omit some Kerberos-only subdirectories from the build as
MKKERBEROS{,4} indicate
(I acknowledge the sentiment that flists are the wrong way to go,
and that the makefiles should produce the metalog directly. That
sounds to me like the right way to go, but I am not prepared to do
revamp all the makefiles. While my approach is expedient, it fits
painlessly within the current build architecture until we are
delivered from flist purgatory, and it does not postpone our
delivery. Fair enough?)
2003-12-11 09:46:26 +00:00
2a85abd333
avoid memory leak. hint from Andrew Lunn
2003-11-23 08:33:13 +00:00
5451f8a14e
do not malloc(0). Andrew Lunn
2003-11-23 08:23:02 +00:00
dedf78268d
Patch OpenSSL to use opencrypto (aka /dev/crypto), if configured and
...
(per kernel policy) for crypto transforms for which hardware
acceleration is available. Affects:
crypto/dist/openssl/crypto/engine/eng_all.c
crypto/dist/openssl/crypto/engine/hw_cryptodev.c
crypto/dist/openssl/crypto/evp/c_all.c
as posted to tech-crypto for review/comment on 2003-08-21.
2003-11-20 00:55:51 +00:00
4bbfee09ca
Various typo fixes from Jonathon Gray via jmc@openbsd.
2003-11-17 11:16:10 +00:00
6de72ce0f8
typo. minoura
2003-11-13 10:35:40 +00:00
1356e8977e
pfkey_dump_sadb: when it get an error using sysctl,
...
mimic an error msg from keysock so that caller can process it correctly.
PR/23122.
2003-11-09 15:37:24 +00:00
aec01dda91
sync w/ openssl 0.9.7c. shlib minor bump for libcrypto.
...
(ERR_release_err_state_table() added)
2003-11-04 23:54:26 +00:00
385718bc5c
more unifdef
2003-11-04 23:45:56 +00:00
6b4e6697c9
openssl 0.9.7c. security changes are already in place
2003-11-04 23:25:09 +00:00
746d6bb953
bring in kame rev 1.32. PR 23122
2003-11-04 04:30:38 +00:00
1244cc6c62
Fix NULL vs 0 mixup.
2003-10-25 20:48:10 +00:00
f90a2e28b1
do not build "null ESP and no AUTH" proposal. (racoon 174) by Tom Lendacky
2003-10-23 07:23:50 +00:00
6a6c3ca82f
Don't assign NULL as an integer.
2003-10-21 03:06:55 +00:00
73d47a4f07
Don't return NULL as an integer.
2003-10-21 03:03:39 +00:00
eb3570747f
Make sure HAVE_OPENSSL is undefined, to avoid depending on both
...
libcrypto and libdes. Patch by lha@, posted to tech-userlevel.
2003-10-09 04:31:17 +00:00
ac0a546d0d
realloc error check failure; Greg Troxel, sync w/kame
2003-10-03 21:53:32 +00:00
48b0bfaad0
support policy w/o selector.
2003-10-02 19:53:01 +00:00
3c068c5948
correct unsafe realloc().
2003-10-02 19:52:43 +00:00
b3cd345741
more fixes from 0.9.7c, from openbsd
2003-10-02 02:26:17 +00:00
ae91503b5d
from openbsd:
...
Correct some off-by-ones. They currently don't matter, but this
is for future safety and consistency.
OK krw@, markus@
2003-10-02 02:25:05 +00:00
0a7cc0d7d1
Apply security fix: http://www.openssl.org/news/secadv_20030930.txt
...
Changelog from: http://cvs.openssl.org/chngview?cn=11471
2003-09-30 15:59:53 +00:00
5749c53775
Fix what is obviously a bug: valloc() -> vmalloc(). Now racoon(8) doesn't core
...
dump all the time.
2003-09-25 01:00:32 +00:00
34439bf0c9
off-by-one. from openbsd
2003-09-22 22:12:05 +00:00
28c3d43114
typo. markus@openbsd
2003-09-18 12:42:33 +00:00
841f7944e5
protect against double free; #660 ; zardoz at users.sf.net
...
from openbsd
2003-09-18 08:16:40 +00:00
c2011dbc01
missing buffer_free(&encrypted); #662 ; zardoz at users.sf.net
...
from openbsd
2003-09-18 08:16:15 +00:00
898af9fa6c
make sure we init nalloc.
2003-09-18 01:41:56 +00:00
3171afa413
fix problem in previous patch
2003-09-18 01:35:07 +00:00
d4d840dd36
More buffer size adjusted before allocation succeeded fixes. Bump to 20030917.
...
From FreeBSD (with an additional one from me).
2003-09-17 23:19:02 +00:00
51b1a61a2d
dammit, don't apply patches blindly.
2003-09-16 23:18:24 +00:00
08d244b791
bring more fixes from 3.7.1
2003-09-16 23:16:59 +00:00
5de000c8d7
crank __NETBSDSSH_VERSION for buffer.c fix
2003-09-16 17:39:32 +00:00
325fccf53f
Do not record expanded size before attempting to reallocate the associated
...
memory. From OpenBSD, via FreeBSD.
2003-09-16 13:22:57 +00:00
249c9d88ea
use sysctl to dump SAs if possible (not really tested)
2003-09-12 08:44:34 +00:00
efbe374b9f
SKEY and BSDAUTH #ifdef mixup
2003-09-08 21:00:41 +00:00
f13cb0c7b2
bzero() 2nd arg mistake. found by openbsd guys. from kame
2003-09-04 00:12:56 +00:00
ca14877c77
reject rc5/idea/mdc2 commands if OPENSSL_NO_xx is specified
2003-08-27 21:05:02 +00:00
31fd31ccf7
Make getlastlogx have the pathname to the lastlogx database as first
...
argument, to be consistent with updlastlogx.
Approved by christos, reviewed by kleink.
[The lastlogxname function should not be used any longer.]
2003-08-26 16:48:32 +00:00
d9c46578d1
update racoon to 2003/8/26 version. mostly minor bugfixes.
2003-08-26 03:31:50 +00:00
2cfb643fda
KAME racoon, as of 2003/08/26
2003-08-26 03:27:01 +00:00
b5f8b9a7c0
KAME libipsec/libpfkey, 2003/08/26
2003-08-26 03:25:29 +00:00
eb24db53ab
style; total size of buf is (num + 3)
2003-08-13 01:29:41 +00:00
658a8c458e
Fix bad use of "sizeof(pointer)" where the length of a buffer was the
...
intention. Fixes problems with least ssh's known_hosts file and factor.
Patch from Berndt Josef Wulf's PR lib/22347.
2003-08-12 03:25:24 +00:00
dc4f8c2e1a
Move UCB-licensed code from 4-clause to 3-clause licence.
...
Patches provided by Joel Baker in PR 22252, verified by myself.
2003-08-07 09:15:17 +00:00
5de5abdd3d
consistently use new DES API, re-enable des regression test
2003-07-31 08:53:58 +00:00
965395c9f3
re-enable __RCSID, sys/cdefs_elf.h rev 1.15 fixed the problem
2003-07-30 00:34:16 +00:00
f33c57af22
disable __RCSID for now, somehow it puts some of integer variables
...
into .text region
2003-07-29 23:17:39 +00:00
308bb7eb39
remove unused macro. PR 21150
2003-07-29 04:45:39 +00:00
4c43ef4ce1
xx_keylen has to return bits, not bytes. KAME-PR-488
2003-07-29 04:30:54 +00:00
3514116803
Apply patch from lha@, via OpenBSD portable SSH's revision 1.11 of this file:
...
mcc -> fcc; from Love Hörnquist Åstrand <lha@it.su.se>
otherwise the kerberos credentinal is stored in a memory cache
in the privileged sshd.
Presumably, this will also come in as part of a later OpenSSH release via
`cvs import', but this is worth having now.
2003-07-28 15:50:17 +00:00
c6912d0211
remove duplicate manual
2003-07-26 15:11:43 +00:00
08a1c4bcd3
empty commit, just to update timestamp and force rebuild of krb.h.
2003-07-26 01:07:35 +00:00
805c102737
fix compilation on sparc64. reported by Juergen Hannken-Illjes
2003-07-25 09:06:02 +00:00
e8876f361f
avoid "unsigned u_int32_t"
2003-07-25 02:02:43 +00:00
88ec7d3792
bring back krb4 support, just to suppress unwanted noise from other developers.
...
note that official openssh distribution have already dropped kerberosIV support,
therefore maintenance cost needs to be paid by us. and have no intent to help.
2003-07-24 15:31:52 +00:00
f4401cd869
upgrade openssl to 0.9.7b. (AES is now supported)
...
alter des.h to be friendly with openssl/des.h (you can include both in the
same file)
make libkrb to depend on libdes. bump major.
massage various portioin of heimdal to be friendly with openssl 0.9.7b.
2003-07-24 14:16:30 +00:00
2836295a36
OpenSSL 0.9.7b, major API changes included
2003-07-24 08:25:41 +00:00
0f3017142e
use snprintf (actually, "addr" can be supplied from outside, and if "addr"
...
points to shorter-than-24 buffer we will overrun buffer. bad API)
2003-07-24 04:41:13 +00:00
7b7c18c4c5
the block is just for krb4 (not for krb5) so should be removed. lha
2003-07-23 21:25:08 +00:00
c55f89ad19
typo on #if condition converesion
2003-07-23 21:03:03 +00:00
0091553542
define symbols even when !KRB4, to simplify shlib management. lha
2003-07-23 20:48:34 +00:00
8556dff80c
remove KRB4 and AFS support. sync w/ openssh main tree
2003-07-23 03:52:16 +00:00
a9503412ba
license clarification (UCB 3-clause, and progressmeter)
2003-07-23 03:51:27 +00:00
46471dc1e9
cast for signed/unsigned mixup
2003-07-14 18:27:48 +00:00
1bffbcd4a1
correct ^@ incorrectly committed
2003-07-14 18:26:05 +00:00
a157f97782
unifdef VMS/WIN16/WIN32 in public headers, at least
2003-07-14 14:06:14 +00:00
c187ba994b
use bounded string op (only one sprintf remains - still no clue)
2003-07-14 13:24:00 +00:00
a395b35ba2
delint
2003-07-14 13:07:05 +00:00
848c8ac0ef
use bounded string ops (especially libraries)
2003-07-14 13:05:19 +00:00
afdee9affa
__RCSID. add missing copyright in *.y and *.l (sync w/kame)
2003-07-12 09:37:09 +00:00
03eefe2ecf
sync w/ latest racoon
2003-07-12 09:02:24 +00:00
dc30725eaf
kame racoon 2003/7/12. lots of lots of stability fixes.
2003-07-12 08:45:39 +00:00
b1395375fd
add __RCSID("$NetBSD$"), because it's hard to track our changes in a
...
binary when we only have the vendor's RCSID.
2003-07-10 01:09:41 +00:00
fc3229a199
Undo unintended commit.
2003-07-04 21:57:16 +00:00
ee8924aa2e
Fix off-by-one. From William Allen Simpson in PR 22012.
2003-07-04 21:56:48 +00:00
f9cc3a858b
Bump date for recent changes.
2003-07-04 12:33:11 +00:00
de2728383c
Punctuation fixes.
2003-07-04 12:31:33 +00:00
d9fb607438
Quote punctuation so it gets marked up.
2003-06-30 11:52:01 +00:00
ed9861f855
Remove dot from middle of sentence.
2003-06-27 23:10:37 +00:00
554f6e9041
Quote question mark; punctuation fix; new sentence, new line.
2003-06-27 22:37:13 +00:00
a4fd08f60c
Quote question mark.
2003-06-27 22:35:48 +00:00
5e88ad0f63
Remove superfluous macro calls, add newline where missing, and
...
use \&[ (and similar) instead of \*(lB, since it works with both old and new groff.
2003-06-27 22:31:29 +00:00
bb64da9790
Drop trailing spaces; fix punctuation problems;
...
put Nd argument in double quotes since it contains more than 9 words; spell out month.
2003-06-27 14:46:55 +00:00
e6ecde23a1
Be consistent in how we call .rhosts authentication.
2003-06-27 09:14:56 +00:00
7e3682db3e
Sort sections; replace man macro with mdoc macro;
...
sort SEE ALSO; empty line -> .Pp.
2003-06-26 10:03:39 +00:00
9bdcb47acd
add missing #ifdef __RCSID
...
(these files are compiled as host tools)
from Nicolas Ollinger, fixes PR#21892
2003-06-23 20:02:53 +00:00
1430af815a
discourage the use of aggressive mode
2003-06-16 08:40:11 +00:00
9d1e759d63
typo: get correct counters; introduced during rekeying change. (openbsd rev 1.26)
2003-05-26 07:57:38 +00:00
49838f37b9
adapt to heimdal 0.6
2003-05-25 22:07:56 +00:00
3f62dc6d24
strlcpy
2003-05-17 18:19:20 +00:00
93851338f2
sscanf overrun
2003-05-17 01:12:28 +00:00
b224fef26e
Fix up rcsid lossage
2003-05-15 21:36:30 +00:00
f80f84e684
no longer used
2003-05-15 20:56:45 +00:00
28d69ea823
merge in heimdal 0.6
2003-05-15 20:44:06 +00:00
245a590853
import of heimdal 0.6
2003-05-15 20:28:38 +00:00
dec326ca84
64bit issue; reported by Havard Eidnes and Juergen Hannken-Illjes, sync w/
...
openssh master tree
2003-05-15 14:10:24 +00:00
56d0ea03cf
>implement kerberos over ssh2 ("kerberos-2@ssh.com"); tested with jakob@
...
>server interops with commercial client; ok jakob@ djm@
markus@openbsd
2003-05-14 18:22:07 +00:00
d6fa2807d4
markus@openbsd, for PR 20550
...
>change key_load_public to try to read a public from:
>rsa1 private or rsa1 public and ssh2 keys.
>this makes ssh-keygen -e fail for ssh1 keys more gracefully
>for example; report from itojun (netbsd pr 20550).
2003-05-14 18:17:02 +00:00
5e9a67bb93
OpenSSH 3.6.1 as of 20030514 - krb5 over ssh2
2003-05-14 18:12:50 +00:00
d75f1336b3
Uppercase URL.
2003-05-14 14:30:59 +00:00
5b3e029874
setup -> set up.
2003-05-14 13:10:57 +00:00
bb2f5dbc31
setup -> set up.
2003-05-14 12:06:11 +00:00
0230a54dfb
plug memory leak. jgraessley at apple.com
2003-05-09 05:32:36 +00:00
a59c37eb75
parse EOS before performing #include. Joshua Graessley of apple (via kame)
2003-05-08 07:58:54 +00:00
c42e1fac66
Management, not managment. Mostly from jmc@openbsd.
2003-04-26 22:07:12 +00:00
5116f9caae
fix "round up to 8" code. from kame
2003-04-24 02:22:26 +00:00
bf3ca3dcee
do not assume 32bit (%d fits into 12 chars); sumikawa@freebsd
2003-04-17 07:37:05 +00:00
3fd1d09240
Fix typo, and break overly long line.
2003-04-16 13:10:40 +00:00
670e872d62
10 char is not sufficient here. sync w/ kame
2003-04-15 07:31:23 +00:00
5a6a4446f8
avoid hardcoded SOCK_xx; with markus; should allow ssh over SCTP
2003-04-14 14:36:47 +00:00
6605cddb45
new copyright notice (w/ TNF copyright). thanks millert
2003-04-08 01:19:08 +00:00
07d13217f3
Some e.g. cleanup: replace "eg" with "e.g.,". From Igor Sobrado in PR 19692.
2003-04-07 06:56:38 +00:00
2b75215a67
IPsec, not IPSEC. From Igor Sobrado in PR 19691.
2003-04-06 20:24:35 +00:00
fcb31fad16
sync w/ 3.6.1 (remove files that are removed on openssh repo)
2003-04-03 06:33:42 +00:00
e7e7c84a6a
sync w/ 3.6.1
2003-04-03 06:21:31 +00:00
f9930e137b
OpenSSH 3.6.1 as of 2003/4/3
...
* The 'kex guesses' bugfix from OpenSSH 3.6 triggers a bug
in a few other SSH v2 implementations and causes connections to
stall. OpenSSH 3.6.1 disables this bugfix when interoperating
with these implementations.
* RSA blinding is now used by ssh(1), sshd(8) and ssh-agent(1).
in order to avoid potential timing attacks against the RSA keys.
Older versions of OpenSSH have been using RSA blinding in
ssh-keysign(1) only.
* ssh-agent(1) optionally requires user confirmation if a key gets
used, see '-c' in ssh-add(1).
* sshd(8) now handles PermitRootLogin correctly when UsePrivilegeSeparation
is enabled.
* sshd(8) now removes X11 cookies when a session gets closed.
* ssh-keysign(8) is disabled by default and only enabled if the
new EnableSSHKeysign option is set in the global ssh_config(5)
file.
* ssh(1) and sshd(8) now handle 'kex guesses' correctly (key exchange
guesses).
* ssh(1) no longer overwrites SIG_IGN. This matches behaviour from
rsh(1) and is used by backup tools.
* setting ProxyCommand to 'none' disables the proxy feature, see
ssh_config(5).
* scp(1) supports add -1 and -2.
* scp(1) supports bandwidth limiting.
* sftp(1) displays a progressmeter.
* sftp(1) has improved error handling for scripting.
2003-04-03 05:57:11 +00:00
6012957147
Don't build crypt() on NetBSD either.
2003-04-02 20:28:00 +00:00
0ac531f887
beeing->being from Igor Sobrado, PR misc/19814
2003-03-31 18:54:15 +00:00
0fe9c931b1
authenication->authentication, Instititute->Institute
...
from Igor Sobrado, PR misc/19814
2003-03-31 18:52:13 +00:00
5ffdabb8bc
kefile->keyfile (Igor Sobrado, PR misc/19909)
2003-03-31 16:54:47 +00:00
6653459566
principal, not pricipal.
2003-03-31 09:34:09 +00:00
7287c6007d
crential->credential princial->principal (Igor Sobrado, PR misc/19700)
2003-03-31 02:30:50 +00:00
9ef7047603
spelling fixes, one from PR misc/20753 (Igor Sobrado) + others
2003-03-31 00:04:03 +00:00
3ba55178f8
encype->enctype, from PR misc/20754 by Igor Sobrado
2003-03-30 23:57:54 +00:00
0acfa3bb9e
Consistently spell occurrence with two rs.
2003-03-29 22:48:37 +00:00
d544e20194
Support populating the environment from login.conf(5)'s "setenv"
...
capability, using a variation of setuserenv() from login_cap.c.
From Jim Bernard <jbernard@mines.edu>.
2003-03-26 11:16:13 +00:00
fe8a628004
Add missing
...
hp = strtok(NULL, ",");
to end of while loop which parses "host.allow" from login.conf(5).
Otherwise, sshd(8) would just infinite loop unless there was a
(positive or negative) match in the first word of the "host.allow" list...
2003-03-24 18:31:39 +00:00
829c77a0ca
* Add log messages for password or account expiry; it makes it much easier
...
to debug (on the server) why a login failed with this information.
* If _PASSWORD_CHGNOW is defined (it's -1 in NetBSD), check that pw_change
is not set to that before testing if the password has expired.
Still prevent the login, but log a different failure message in this case.
XXX: we need to decide if we let interactive logins occur in this case,
but force a password change, a la login(1).
2003-03-24 18:25:21 +00:00
6e22da944c
Fix Kerberos 4 procotocol problem mentioned in
...
[MIT krb5 Security Advisory 2003-004]/[heimdal-0.5.2 release notes]
by disable support for it.
2003-03-20 19:20:59 +00:00
359e4b88f5
OpenSSL Security Advisory [19 March 2003]
...
Klima-Pokorny-Rosa attack on RSA in SSL/TLS
2003-03-19 23:06:33 +00:00
9e2d007f93
enable RSA blinding by defualt. from bugtraq posting <3E758B85.6090300@algroup.co.uk>
2003-03-17 14:33:50 +00:00
990562bfef
.Nm does not need a dummy argument ("") before punctuation or
...
for correct formatting of the SYNOPSIS any longer.
2003-02-25 10:34:36 +00:00
658b9c6d28
In ssl3_get_record (ssl/s3_pkt.c), minimize information leaked
...
via timing by performing a MAC computation even if incorrect
block cipher padding has been found. This is a countermeasure
against active attacks where the attacker has to distinguish
between bad padding and a MAC verification error. (CAN-2003-0078)
2003-02-20 07:39:17 +00:00
8a49ec08e4
"Utilize" has exactly the same meaning as "use," but it is more
...
difficult to read and understand. Most manuals of English style
therefore say that you should use "use".
2003-02-04 23:07:28 +00:00
86932ac56e
allocate, not alocate. Noted by mjl, not mjll.
2003-01-28 22:26:33 +00:00
bcc72a236b
The last change I made was a little aggressive in changing the paths of
...
the includes and broke cross builds from non-NetBSD arches. In this I
revert the problem section. (pointed out by uwe.)
2003-01-27 06:19:40 +00:00
0e936e5ed7
Fix password return values.
...
Addresses PR: lib/20074
2003-01-27 03:33:36 +00:00
3e20adf4a8
Prepend krb5/ to include paths that live in /usr/include/krb5/ so that
...
we can deprecate the requirement of -I/usr/include/krb5 when building
kerberos apps.
2003-01-26 22:06:39 +00:00
e218521496
Forgot one include file from the last change.
2003-01-26 21:59:49 +00:00
ebf72d8cce
Update script to modify include file paths to start the process of
...
deprecating the need to -I/usr/include/krb5.
2003-01-26 20:51:58 +00:00
5832481e3d
posesses -> possesses
...
Noted by Igor Sobrado in PR misc/19641
2003-01-03 04:20:09 +00:00
addd3c9aaa
Use standard section headers.
2003-01-02 13:00:49 +00:00
a04a0d4f28
Use standard section headers; sort sections.
2003-01-02 13:00:16 +00:00
cbe71a4b1a
Use standard section headers; space before punctuation in macro arguments.
2003-01-02 12:59:59 +00:00
1b6cc917f0
Use standard section headers.
2003-01-02 12:59:31 +00:00
0f34826bec
Sort sections.
2003-01-02 12:58:56 +00:00
a366ee7021
Fix Xref section, use standard section headers.
2003-01-02 12:57:31 +00:00
65e190048a
Add RCS Id.
2003-01-02 12:57:03 +00:00
432d470724
Fix typos pointed out by Igor Sobrado in PR misc/19621.
2003-01-02 00:22:29 +00:00
ec3682baa1
interal -> internal
...
equvalent -> equivalent
Pointed out by Igor Sobrado in PR misc/19629
2003-01-01 22:06:27 +00:00
50526e4837
It is not valid C++ to have a semicolon after
...
extern "C" {}
so remove it from __END_DECLS.
Noted by Andrew Pinski.
2002-12-31 02:13:20 +00:00
4027f3ad48
compatibility, not compatability; from Adrian Mrva.
2002-12-21 13:22:20 +00:00
7023f7abe2
described, not decribed.
2002-12-21 13:21:38 +00:00
d83bca180e
Two typos from Adrian Mrva.
2002-12-21 13:20:09 +00:00
1b706e9293
charcted probably means character.
2002-12-21 13:17:23 +00:00
c511c34d7c
securely, not securly. From Adrian Mrva.
2002-12-21 13:16:09 +00:00
8f9e9a2299
Correct misspellings of authentication and available. From Adrian Mrva.
2002-12-21 12:22:12 +00:00
5e3e5e1ae9
ther -> their, from Adrian Mrva.
2002-12-21 12:19:33 +00:00
b33be07056
Avoid conflict with reserved identifier "log".
2002-12-06 03:39:06 +00:00
5da0736e3a
Avoid strict alias warning.
2002-12-06 01:27:10 +00:00
512a461832
Change all functions that call gssapi_krb5_init() to call one of
...
two macros GSSAPI_KRB5_INIT() or GSSAPI_KRB5_INIT_MS() which call
the former, check its return code and bail on error.
Addresses PR lib/19191
Given a quick look by joda@.
2002-11-28 11:21:16 +00:00
8084625896
racoon.conf can be found in /etc/racoon, not /etc
2002-11-27 09:51:50 +00:00
a426f44395
sync w/ kame source from 2002/11/20.
...
- plug some memory leaks
- correct phase 2 proposal reqid handling
- check for fd_set overrun
2002-11-20 03:35:57 +00:00
7285409e64
KAME racoon as of 2002/11/20
2002-11-20 03:30:18 +00:00
314a4f35b5
correct panic() condition - it was backwards. remove kame-local diff
...
which was committed by mistake.
From: Rafal Boni <rafal@attbi.com>
2002-11-18 23:36:18 +00:00
bc13d2aefa
don't blindly trust rlen; from Heimdal 0.5.1
2002-10-21 19:39:51 +00:00
32b88027c7
use readlink with bufsize - 1; approved thorpej.
2002-10-19 20:33:17 +00:00
df884fac23
revert previous. need more time to think.
2002-10-18 23:51:07 +00:00
8201174690
condition to panic() was backwards. sync w/kame
...
From: Rafal Boni <rafal@attbi.com>
2002-10-18 23:44:58 +00:00
4752a4465b
discourage the use of aggressive mode for identity disclosure.
2002-10-18 14:34:04 +00:00
a2e26d6e11
back out the previous change. We really don't want to enable login on a
...
mode 666 tty.
In order to use sshd logins with a read-only /dev, the administrator has to
make the tty mode 600 root/wheel before the partition gets read-only.
2002-10-15 15:33:04 +00:00
9dc3c4ee08
Re-allow connection when /dev is read-only, and the tty is owned by the
...
user or owned by root.
2002-10-15 15:19:02 +00:00
173446ddd0
use cast to unsigned long long, instead of PRIu64
...
(to make it easier to move the change back to main openssh distribution)
2002-10-04 02:22:05 +00:00
31b9b01a31
use PRIu64 for u_int64_t.
2002-10-03 07:41:10 +00:00
f07ce00ec5
Turn on strict alignment #define's, because racoon reliably core
...
dumps on machines which require strict alignment such as sparc64.
2002-10-02 17:53:11 +00:00
ef7d24574a
upgrade to openssh 3.5. major changes include:
...
- krb4/5 support for privsep (krb5 diff was already applied)
includes fake implementaation of getpeereid() from openssh-portable, which
does nothing useful - need improvement.
2002-10-01 14:07:26 +00:00
604e45f4cd
OpenSSH 3.5 as of Oct 1, 2002
2002-10-01 13:39:55 +00:00
75bc91b4e4
Changed documentation of the default setting for PermitRootLogin
...
to ``no'', to match our actual default setting.
Addresses PR: bin/18445
2002-09-28 15:07:33 +00:00
5431e7941f
tweak the example $HOME/.ssh/rc script to not show on any cmdline the
...
sensitive data it handles. This fixes bug # 402 as reported by
kolya@mit.edu (Nickolai Zeldovich).
2002-09-25 03:43:19 +00:00
1268ff2729
select() -> poll()
2002-09-20 22:16:02 +00:00
c83fcd876c
select() -> poll()
2002-09-20 22:05:59 +00:00
016f903642
select() -> poll()
2002-09-20 21:48:58 +00:00
ee48615074
select() -> poll()
2002-09-20 21:34:31 +00:00
ee1dfded94
change unconfigured error code back to ENXIO
2002-09-19 19:48:33 +00:00
7417b5942f
de-__P and comment out all parameter names
2002-09-19 19:22:53 +00:00
17e856961c
don't quit while creating X11 listening socket.
...
address (first) problem described in
http://mail-index.netbsd.org/current-users/2002/09/16/0005.html
2002-09-17 06:26:18 +00:00
f603ddfaad
__RCSID is not a portable macro to be using in a host tool (which
...
these files are). As a short-term work-around, only use it if it
is defined. A better solution will be worked out with the Heimdal
folks later.
Fixes building these host tools on Solaris 8.
2002-09-13 19:09:00 +00:00
72be5e0769
invert detach flag to match previous NetBSD behaviour
2002-09-12 17:16:38 +00:00
cae4f88ee0
kill some warnings
2002-09-12 15:35:02 +00:00
2c3a59b23a
krb5_socklen_t and krb5_ssize_t should not go here
2002-09-12 14:52:33 +00:00
91f0927074
make this actually do something
2002-09-12 14:12:18 +00:00
58cc4c1950
alias dns functions so we don't have to bump major
2002-09-12 14:10:25 +00:00
da086653ff
resolve import conflicts
2002-09-12 13:18:49 +00:00
0444766465
import heimdal 0.5
2002-09-12 12:41:31 +00:00
5146dc79e7
import helper
2002-09-12 12:35:03 +00:00
3cc6c8c775
resolve import conflicts
2002-09-12 12:33:10 +00:00
cfa4cd31bb
import krb4 1.2
2002-09-12 12:22:01 +00:00
32e004f92a
kerberos support w/ privsep. confirmed to work by lha@stacken.kth.se
2002-09-09 06:45:17 +00:00
42ebaa698b
don't touch free'ed memory. From: wang.zhong3@zte.com.cn, sync w/kame
2002-09-03 14:38:13 +00:00
2b9b8f5bd3
reduce #ifdef related to OPENSSLDIR - we want it be static
2002-09-01 11:38:34 +00:00
50d422c24f
e_os.h is not part of exported openssl interface, so don't install it into
...
/usr/include/openssl (e_os.h has an explicit comment about it). it obviously
is a bug in openssl 0.9.6 Makefile.
based on openssl 0.9.7 snapshot.
2002-08-31 10:46:36 +00:00
e1754c22c2
if () statement error. From: Krister Walfridsson <cato@df.lth.se>
...
(not compiled) sync w/kame
2002-08-31 07:56:14 +00:00
7049b3bdab
blank commit to force rebuild of krb.h
2002-08-29 14:34:11 +00:00
f613969b8a
somehow main trunk was not in sync with 0.9.6f for this file. noted by havard.
2002-08-28 23:10:30 +00:00
bcb0cf6929
tighten isakmp header length validation. from kame
2002-08-28 04:44:04 +00:00
b57bfa3f73
Drop superfluous Ns, sort sections.
2002-08-20 16:05:46 +00:00
4f40f42275
Remove superfluous Ns, drop trailing whitespace, fix a Xr, don't let lines
...
get longer than 80 characters.
2002-08-20 16:04:13 +00:00
2610a5c4d8
Remove superfluous Ns; while here, remove trailing whitespace and fix a
...
punctuation problem.
2002-08-20 15:59:37 +00:00
158398c921
Fix Ns abuse.
2002-08-20 15:32:12 +00:00
9bf08abfd4
Remove some unnecessary .Ns and trailing whitespace.
2002-08-20 15:24:38 +00:00
a6315c15ad
utmpx.ut_id is required.
...
PR 17998 with slight modification (deal with ttyname shorter than 4)
2002-08-20 07:42:53 +00:00
1146a80999
more NO_xx cleanup. can't catch these by openssl-unifdef.pl
2002-08-17 21:41:59 +00:00
08597903ce
sync with 0.9.6g
2002-08-09 15:58:46 +00:00
5eb341dcb6
openssl 0.9.6g, build framework fixes
2002-08-09 15:45:08 +00:00
182c0b6e08
sync with 0.9.6f. prevents DoS attack and regen of manpages.
2002-08-08 23:47:34 +00:00
f5e63fe4c2
openssl 0.9.6f, with security fixes
2002-08-08 23:14:54 +00:00
7bab20a582
bitmask operation audit (s/&&/&/). from openbsd
2002-08-08 15:12:09 +00:00
e8859ea868
remove files mistakenly shipped with openssl 0.9.6e.
...
(it won't affect the build)
2002-08-05 11:21:29 +00:00
85c4496982
http://marc.theaimsgroup.com/?l=openssl-cvs&m=102831422608153&w=2
...
*) Fix ASN1 checks. Check for overflow by comparing with LONG_MAX
and get fix the header length calculation.
[Florian Weimer <Weimer@CERT.Uni-Stuttgart.DE>,
Alon Kantor <alonk@checkpoint.com> (and others),
Steve Henson]
(critical)
2002-08-03 12:56:23 +00:00
e7f66af2b2
fix incorrect overrun check.
...
http://marc.theaimsgroup.com/?l=openssl-cvs&m=102831516309127&w=2
(thank todd!)
2002-08-02 23:09:03 +00:00
d103e0b575
plug memory leak. from ebisawa@iij. sync w/kame
2002-07-31 07:01:26 +00:00
ef920a0913
sync with 0.9.6e.
2002-07-31 01:29:37 +00:00
25e766824a
OpenSSL 0.9.6e. includes major security fixes (already applied)
2002-07-30 23:57:34 +00:00
e9316c8858
apply patch supplied with OpenSSL Security Advisory [30 July 2002]
...
advisory 1: four potentially remotely-exploitable vulnerability in
SSL2/SSL3 code
advisory 2: ASN1 parser vulnerability (all SSL/TLS apps affected)
2002-07-30 12:55:08 +00:00
3fd219f644
add utmpx support.
2002-07-28 23:43:33 +00:00
6742cb1812
sweep of errx/warnx, remove unnecessary trailing \n
2002-07-20 08:36:17 +00:00
24ef72afbf
print connect failure on debugging mode. sync w/openbsd
2002-07-12 13:28:36 +00:00
4b20971f01
Spell acquire with a 'c'.
2002-07-10 23:16:32 +00:00
bdfa549223
bark if all connection attemp fails. sync w/openbsd
2002-07-10 10:28:00 +00:00
92b7524e7d
silently connect(2) to next address. sync w/openbsd
2002-07-09 12:04:10 +00:00
a2a47b15ce
don't warn even if reverse lookup fails. sync w/openbsd
2002-07-09 12:03:54 +00:00
9a2478a3b0
/var/empty -> /var/chroot/sshd. PR 17519
2002-07-08 14:39:53 +00:00
968294e218
>make ssh-keysign read /etc/ssh/ssh_config
...
>and exit if HostbasedAuthentication is disabled globally. based on discussions
>with deraadt, itojun and sommerfeld; ok itojun@
sync w/openbsd
2002-07-03 14:23:13 +00:00
92ea28e291
>for compression=yes, we fallback to no-compression if the server does
...
>not support compression, vice versa for compression=no. ok mouring@
sync w/openbsd
2002-07-03 10:07:48 +00:00
673c1a7ac1
>use RSA_blinding_on() for rsa hostkeys (suggested by Bill Sommerfeld)
...
>in order to avoid a possible Kocher timing attack pointed out by Charles
>Hannum; ok provos@
2002-07-03 10:06:39 +00:00
c28e7ac1f6
correct signed/unsigned mixup; openbsd
2002-07-03 10:05:58 +00:00
8d3378688a
pednatic check on command line args. correct signed/unsigned mixup.
...
sync w/ openbsd
2002-07-01 06:17:11 +00:00
84559971ee
make use of xfree() consistent. from openbsd
2002-07-01 05:56:45 +00:00
11792b93b1
don't use freed memory. sync w/openbsd
2002-07-01 05:54:03 +00:00
5bdd56b128
sync with 3.4
2002-06-26 14:08:29 +00:00
b8f8e01057
OpenSSH 3.4 around 2002/6/26.
...
most significant change:
>make sure # of response matches # of queries, fixes int overflow; from ISS
as we have already enabled privsep by default, we should have been safe.
2002-06-26 14:02:54 +00:00
603dca2ed2
sync whitespace w/ openbsd tree
2002-06-24 15:47:25 +00:00
bc7b65a647
don't lose information while we cast
2002-06-24 15:46:34 +00:00
7d6a7caf6a
Cast arguments so that this file will compile on less forgiving architectures
...
like arm32.
2002-06-24 15:32:58 +00:00
3ea946f134
sync with openssh 3.3.
...
local mods included to make it compile with openssl 0.9.6d.
2002-06-24 05:48:24 +00:00
3dfc6702ef
clean ssh-keysign build dir before import.
2002-06-24 05:45:17 +00:00
9486e6fd01
it shouldn't be imported
2002-06-24 05:28:32 +00:00
b5222aff66
OpenSSH 3.3 as of June 24, 2002.
...
- ssh is no longer seruid root. ssh-keyscan is added to read secret host keys.
protocol version 1 rsh-like authentication is gone.
- FallBackToRsh is deprecated.
2002-06-24 05:25:39 +00:00
c650ef5756
Remove (commented out) krb_equiv(3) reference, suggested by joda.
2002-06-13 11:19:48 +00:00
d844f0d7b1
Fix Xrefs.
2002-06-13 00:15:09 +00:00
78c59017cc
Remove photurisd reference.
2002-06-13 00:14:26 +00:00
8def406232
Comment out Xref to krb_equiv(3), which does not exist.
2002-06-13 00:09:06 +00:00
b745604c00
sync sockaddr_ntop with latest openssh (minor change)
2002-06-09 22:22:55 +00:00
7c75b5ec2f
sync with 0.9.6d. shlib minor for libssl and libcrypto
...
is cranked for additional functions.
2002-06-09 16:12:52 +00:00
7720435b28
openssl 0.9.6d
2002-06-09 15:21:32 +00:00
f0231f96aa
do not propose IDEA cipher on SSL connection, as our default installation
...
does not handle IDEA.
TODO: dynamically enable IDEA if libcrypto_idea is linked
2002-06-09 02:16:18 +00:00
be5f1d082c
use getnameinfo on diag printing. sync w/openssh in openbsd
2002-06-08 21:17:57 +00:00
e67961b545
check sshd uid/chroot dir on UsePrivilegeSeparation mode, and die if they
...
do not exist. sync w/openssh
2002-05-29 23:54:29 +00:00
a5c3041a1b
bump date for rhosts auth fix
2002-05-27 13:45:40 +00:00
b274d69ad0
correct rhosts authentication. should fix PR 17023
2002-05-27 13:45:17 +00:00
a46557038c
now arc4random is in libc, we don't need to supply local version
2002-05-25 00:29:52 +00:00
a0da78395e
correct sha2 interoperability. From: "JuanJo Ciarlante" <jjo@mendoza.gov.ar>
2002-05-20 13:12:45 +00:00
e26b1052bb
use /var/chroot/sshd instead of /var/empty. suggested by christos
2002-05-16 20:59:35 +00:00
f47caddaf3
turn on privilege separation, as 3.2.1 default do.
...
requires sshd uid/gid as well as /var/empty directory.
2002-05-14 23:33:07 +00:00
ca89359407
sync with 3.2.1 as of 5/13.
...
NOTE: privilege separation is turned off by default
as it seems there still are issues with setsid().
2002-05-13 02:58:17 +00:00
24255a6a60
OpenSSH 3.2.1 as of 2002/5/13
2002-05-13 02:28:40 +00:00
c68a2428ba
correct handling of "unique" policy. bump version to 20020507
...
(corresponds to filename in ftp://ftp.kame.net/pub/kame).
2002-05-13 02:10:34 +00:00
c0fa39f338
correct plogv().
2002-05-07 08:58:32 +00:00
244b762de1
Complete the conversion back to the OpenSSH default configuration files of
...
"/etc/ssh/ssh_config" (from "/etc/ssh/ssh.conf") for ssh(1) and other
userland tools, and "/etc/ssh/sshd_config (from "/etc/ssh/sshd.conf")
for sshd(8).
etc/postinstall will detect this, and if "fix" is given, rename the files.
2002-04-29 08:23:34 +00:00
812e154ef2
netbsd uses EXIT STATUS, not RETURN VALUES, for commands
2002-04-26 02:48:54 +00:00
manu