Aren/NetBSD
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
170,235 Commits 606 Branches 0 Tags 3.1 GiB
aa3b40a116
Commit Graph

1199 Commits

Author SHA1 Message Date
mgrooms
8628a88239 Update NEWS file with additional 0.7 improvements. 2007-07-24 04:29:23 +00:00
mgrooms
9b7e05e155 Various racoon configuration manpage updates. 2007-07-18 22:50:47 +00:00
christos
0878f17383 PR/36665: Matthias Scheler: Thread support is not enabled in NetBSD's OpenSSL 
I enabled it.
 2007-07-18 20:19:56 +00:00
vanhu
c3bc7fe364 use a single PATH_IPSEC_H to fix some path_to_ipsec.h issues 2007-07-18 12:07:49 +00:00
vanhu
9f7ae421ea fixed a socket leak 2007-07-16 15:05:10 +00:00
vanhu
0fd2ceaf72 indentation 2007-07-16 15:03:13 +00:00
christos
4d0c78dab0 PR/36624: Edgar Fu: sshd should not check pw_{expire,change} if UsePam is 
enabled. This is what the "portable" version of openssh does.
 2007-07-10 15:48:56 +00:00
christos
a39c84a8c3 PR/36623: Edgar Fu: ssh publickey authentification fails if homedir not present 
Removed extra realpath check that was introduced by a bogus merge.
 2007-07-10 14:56:25 +00:00
christos
30638c77c3 PR/36562: Takeshi Nakayama: sshd(8) HostbasedAuthentication fails after 
upgrading to 4.0_BETA
Remove $HOME test since this is also used by sshd.
 2007-06-26 18:28:34 +00:00
christos
d1cb3ec527 remove unused variable. 2007-06-25 01:42:31 +00:00
christos
c6b86acffc don't use __progname for the pam service name. Hard-code it to "sshd" 2007-06-24 23:48:30 +00:00
manu
72fe4c3a84 From Paul Winder <Paul.Winder@tadpole.com>: 
Fix ignored INTERNAL_DNS4_LIST
 2007-06-07 20:04:26 +00:00
vanhu
6ae0ffb7d9 From Rong-En Fan: fix compilation with gcc 4.2 2007-06-06 15:37:15 +00:00
vanhu
cc41629a4c fixed compilation with gcc 4.2 2007-06-06 15:37:14 +00:00
vanhu
6817ea28d9 speeds up interfaces update when they changed 2007-06-06 09:47:30 +00:00
vanhu
1ed22670fa From Jianli Liu: speed up interfaces update when they change. 2007-06-06 09:47:29 +00:00
vanhu
7c53bfe0b6 ignore obsolete lifebyte when validating reloaded configuration 2007-06-06 09:18:16 +00:00
manu
a16fcccee0 From Joy Latten <latten@austin.ibm.com> 
Fix file descriptor shortage when using labeled IPsec.
 2007-05-31 19:54:54 +00:00
manu
23326f5b62 From Jianli Liu <jlliu@nortel.com>: 
In racoonctl, use the specified socket path instead of the default location
 2007-05-30 21:02:39 +00:00
christos
5d1825b2a1 Use RESCUEDIR if set. 2007-05-17 00:17:50 +00:00
christos
538010e358 coverity CID 4168: yyerror() does not return, so we proceed to de-reference 
NULL. Make it return -1 instead like in other places.
 2007-05-16 21:00:40 +00:00
christos
dc073934fe coverity CID 4170: yyerror() does not return, so we proceed to de-reference 
NULL. Make it return -1 instead like in other places.
 2007-05-16 20:59:04 +00:00
vanhu
5e29f1f1bb search a ph1 by address if iph2->ph1 is NULL when validating the new config 2007-05-04 14:33:38 +00:00
vanhu
79dfa780cb ... 2007-05-04 09:10:07 +00:00
vanhu
0f20ab497d added some debug in getph1byaddr() to track some port matching problems with NAT-T 2007-05-04 09:09:54 +00:00
vanhu
e91f01072a added some debug in isakmp_chkph1there() to track some port matching problems with NAT-T 2007-05-04 09:09:47 +00:00
vanhu
ff0f36d165 added some debug for DELETE_SA process 2007-05-04 09:09:35 +00:00
vanhu
ae24f5b259 Force the update of ph2 in pk_recvupdate() if NAT_T support, to solve some port match problems with the first IPSec SAs negociated as initiator 2007-05-04 09:09:26 +00:00
plunky
e3a1867a4d fix usage error: use type for .Ft 2007-04-13 18:22:08 +00:00
vanhu
ace683e685 checks proto_id in ipsecdoi_chkcmpids() 2007-04-04 13:09:36 +00:00
vanhu
f31c3aee8e dumps peer's ID and peer's certificate subject /subjectaltname if they don't match 2007-04-04 13:07:31 +00:00
vanhu
52c7a2891e Store the DPD main scheduler in ph1 handler, to be able to cancel it when removing the handler, and some minor cleanups in DPD code 2007-03-26 15:58:07 +00:00
christos
8f6921b522 PR/36069: Huang Yushuo: racoon can't work with pam_group 
Set RUSER.
 2007-03-24 02:07:42 +00:00
vanhu
2af4eed892 From Joy Latten: fix a segfault when using security labels between 32bit and 64bit host. 2007-03-23 15:43:19 +00:00
vanhu
38a126966c fixed a segfault when using security labels between a 32bit and a 64bit host 2007-03-23 15:43:18 +00:00
vanhu
27934310cd expire zombie handlers in getph2byid(), to avoid situations where we'll never negociate a phase2 again 2007-03-23 15:34:31 +00:00
vanhu
1046a9e619 From Cyrus Rahman: give more details about what is checked when using certificates to authenticate 2007-03-23 09:57:29 +00:00
vanhu
a1d41ca41d give more details about what is checked when using certificates to authenticate 2007-03-23 09:57:28 +00:00
vanhu
27187d08ab fixed subnet check to generate IPV4_ADDRESS when needed in sockaddr2id() 2007-03-22 10:26:19 +00:00
vanhu
002f3b4723 checks if arg is NULL in SCHED_KILL 2007-03-21 14:37:58 +00:00
vanhu
452cfb7edf NULL sched check is now done in SCHED_KILL 2007-03-21 14:29:22 +00:00
vanhu
43c152a498 checks if arg is NULL in SCHED_KILL 2007-03-21 14:28:59 +00:00
vanhu
a270a7afb9 From Yves-Alexis Perez: enable monitoring of ipv6 address changes on Linux. 2007-03-15 14:12:12 +00:00
vanhu
7a26f531db enable monitoring of ipv6 addresse changes on linux 2007-03-15 14:12:11 +00:00
vanhu
0fca99dc2f Consider a negociation timeout when retry_counter is <=0 instead of < 0 2007-03-15 10:37:44 +00:00
christos
2cf8149db2 resurect files that we need and make things compile again. 2007-03-10 23:05:24 +00:00
christos
06993fb381 resolve conflicts. 2007-03-10 22:52:04 +00:00
christos
38f7168c16 PR/35965: Kazushi Marukawa: SSHD doesn't work under protocol 1 
This is a manifestation of a bug in OpenSSL 0.9.8e, which breaks
certain ciphers in OpenSSH <= 4.5p1. See:
    http://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/ssh2-aesctr-openssh.html
    http://bugzilla.mindrot.org/show_bug.cgi?id=1291
 2007-03-10 17:18:31 +00:00
christos
f0f7c41448 enable RFC/3779, requested by George Michaelson 2007-03-10 00:49:47 +00:00
dogcow
01abf44400 resolve the not-quite-resolved cvs conflicts (a missing #endif) 2007-03-07 02:34:59 +00:00
mjf
d774015c29 resolve conflicts 2007-03-06 23:47:18 +00:00
mjf
b22ff73a10 Import OpenSSL 0.9.8e 2007-03-06 21:12:00 +00:00
christos
17fe25abca eliminate caddr_t 2007-03-04 08:21:34 +00:00
mgrooms
adf474a143 Add logic to allow ip address ids to be matched to ip subnet ids when 
appropriate.
 2007-02-28 05:36:45 +00:00
vanhu
f1c1e37275 block variable declaration before code in ipsecdoi_id2str() 2007-02-21 11:01:06 +00:00
vanhu
740b198715 Removed a debug printf.... 2007-02-20 16:32:28 +00:00
vanhu
bd81981229 Only delete a generated SPD if it's creation date matches the creation date of the SA we are currently deleting 2007-02-20 09:11:30 +00:00
vanhu
1cb0c229b8 updated delete_spd() calls 2007-02-20 09:11:14 +00:00
vanhu
19df9f5fcc fills creation date of generated SPDs 2007-02-20 09:11:03 +00:00
vanhu
57d8173408 added 'created' var 2007-02-20 09:10:47 +00:00
vanhu
3c99a9f776 Removed a debug printf.... 2007-02-19 13:08:47 +00:00
vanhu
496e74bcde From Olivier Warin: Fix a %zu in a printf. 2007-02-16 11:01:35 +00:00
vanhu
834d2e72c5 Fixed a %zu in a printf 2007-02-16 11:01:34 +00:00
manu
eac241862b Missing SELinux file 2007-02-15 16:31:38 +00:00
manu
1b2a464d38 Missing stuff for SELinux 2007-02-15 16:23:40 +00:00
vanhu
6c4dc9e4c6 From "Uncle Pedro" on sf.net: Just expire a ph1 handle when receiving a DELETE-SA instead of calling purge_remote(). 2007-02-15 13:01:26 +00:00
vanhu
5f4b4e0b21 Just expire a ph1 handle when receiving a DELETE-SA instead of calling purge_remote() 2007-02-15 13:01:25 +00:00
vanhu
6ced6eb0cd Fixed the way phase1/2 messages are sent/resent, to avoid zombie handles and acces to freed memory 2007-02-15 10:19:24 +00:00
rpaulo
b552802596 It's no longer basesrc. 2007-02-05 18:12:43 +00:00
vanhu
5374d6ac89 Fixed a check of NAT-T support in libipsec 2007-02-02 13:42:28 +00:00
vanhu
1634f1d295 From "Uncle Pedro" on sf.net: When receiving an ISAKMP DELETE_SA, get the cookie of the SA to be deleted from payload instead of just deleting the ISAKMP SA used to protect the informational exchange. 2007-02-01 08:48:32 +00:00
vanhu
e25ad0ee61 When receiving an Isakmp DELETE_SA, gets the cookie of the SA to be deleted from payload instead of just deleting the Isakmp SA used to protect the informational 2007-02-01 08:48:31 +00:00
wiz
15b0193490 Refer to RFC 4716 in two more places (instead of "IETF SECSH"). 
From jmc@openbsd.
 2007-01-23 22:21:54 +00:00
alc
a740eb5ac0 CID-4268: `c' is EOF here, remove deadcode 2006-12-26 00:06:03 +00:00
alc
bdf6fc4f47 CID-4167: check for 'iph1->approval != NULL' 2006-12-26 00:04:00 +00:00
wiz
a0a9492dc8 Talk of RFC 4716 SSH public key format instead of SECSH public key format. 
From markus@openbsd via jmc@openbsd (rev 1.73).
 2006-12-24 10:06:03 +00:00
wiz
7ce75c98d8 Mention RFC 4716. From markus@openbsd via jmc@openbsd (rev. 1.266). 2006-12-24 10:04:08 +00:00
wiz
9e2cc05c4b Use even more macros. 2006-12-23 09:29:53 +00:00
wiz
710cf70831 Use more macros. 2006-12-23 09:29:01 +00:00
wiz
fc51d9d324 Serial comma, and bump date for previous. 2006-12-23 09:22:52 +00:00
vanhu
1a38b96eff From Joy Latten: fix a memory leak 2006-12-18 10:15:30 +00:00
vanhu
591299b29f fixed a memory leak in crypto_openssl 2006-12-18 10:15:29 +00:00
manu
fcdf5459d0 branch 0.7 created 2006-12-10 22:36:06 +00:00
manu
7c683c0b23 Bring back API and ABI backward compatibility with previous libipsec before 
recent interface change. Bump libipsec minor version. Remove ifdefs in
struct pfkey_send_sa_args to avoid ABI compatibility lossage.
Add a capability flags to detect missing optional feature in libipsec
 2006-12-10 18:46:39 +00:00
manu
78f5cfece3 From Joy Latten: README.plainrsa documenting plain RSA auth 2006-12-10 05:51:14 +00:00
manu
99a403e274 From Joy Latten: Add support for SELinux security contexts. Also cleanup the 
libipsec interface for adding and updating security associations.
 2006-12-09 05:52:57 +00:00
manu
10cadc281e From Simon Chang: More hints about plain RSA authentication 2006-12-09 05:44:34 +00:00
vanhu
3db7f7800e Check keys length regarding proposal_check level 2006-12-05 13:38:40 +00:00
mgrooms
8ceadc3208 Correct issues associated with anonymous sainfo selection in racoon. 2006-11-16 00:30:55 +00:00
dogcow
ea8336c632 As uwe points out, it looks like the L on the version constant was 
accidentally removed. Add it back, especially as the documentation still
claims that the constant is a long.
 2006-11-14 22:30:33 +00:00
adrianp
1be366570b From http://www.openssh.org/txt/release-4.5: (CVE-2006-5794) 
* Fix a bug in the sshd privilege separation monitor that weakened its
  verification of successful authentication. This bug is not known to
  be exploitable in the absence of additional vulnerabilities.

Bump __NETBSDSSH_VERSION
 2006-11-14 21:52:09 +00:00
christos
600680c6c3 merge conflicts. 2006-11-13 21:55:36 +00:00
christos
4a5ea8ca2f import 0.9.8d 2006-11-13 21:16:04 +00:00
christos
9f3fa7dc87 eliminate the only variable stack array allocation. 2006-11-09 20:22:18 +00:00
christos
94eb6e9da8 fix typo 2006-11-09 19:51:06 +00:00
christos
f06f014bee use malloc when ssp 2006-11-09 19:50:03 +00:00
cbiere
577883a31d Don't define the deprecated IPV6_RECVDSTADDR if the "advanced IPv6 API" is 
used because IPV6_RECVPKTINFO and IPV6_PKTINFO are used to prevent
potential bugs in the future just in case that the numeric value of the
socket option is ever recycled.
 2006-10-31 00:17:21 +00:00
agc
05ad853be0 one more to catch up with the new location for sha2.h 2006-10-28 23:07:23 +00:00
vanhu
b0d7d1da89 From Michal Ruzicka: fix typos 2006-10-22 15:10:31 +00:00
vanhu
df130f3c13 fixed typos 2006-10-22 15:10:30 +00:00
vanhu
5328e8c78b Added ipsecdoi_chkcmpids() function 2006-10-19 09:36:22 +00:00
vanhu
3835b0b6a5 From Matthew Grooms: use ipsecdoi_chkcmpids() and changed src/dst to loc/rmt in getsainfo(). 2006-10-19 09:35:51 +00:00
vanhu
b0f2fc5ddb From Matthew Grooms: Added ipsecdoi_chkcmpids() function. 2006-10-19 09:35:44 +00:00
adrianp
9480ff5303 Change the default sshd configuration file so that only protocol version 2 
is enabled by default.  Users can manually add back support for protocol
version 1 in their sshd_config if they have a specific need for it.

Suggested by perry@ and ghen@. Ok'ed security-officer@ and christos@
 2006-10-15 14:01:53 +00:00
manu
966e3f130f Fix memory leak (Coverity 3438 and 3437) 2006-10-09 06:32:59 +00:00
manu
331d3b1287 List modified files for last commit 2006-10-09 06:21:11 +00:00
manu
6eca4f09f3 Correctly check read() return value: it's signed (Coverity 1251) 2006-10-09 06:17:20 +00:00
kardel
f34e7857d3 keep len correct when substituting variables - fixes PR/24458 2006-10-08 22:21:14 +00:00
manu
56f4977415 Camelia cipher support as in RFC 4312, from Tomoyuki Okazaki 
<okazaki@kick.gr.jp>
 2006-10-06 12:02:26 +00:00
christos
ee4546d741 unbreak gcc-3 builds. 2006-10-04 14:31:55 +00:00
christos
a9fc92da63 PR/34681: Scott Ellis: Explicitly include <sys/socket.h> 2006-10-04 14:30:35 +00:00
christos
1eafb02344 put back ignorerootrhosts 2006-10-04 14:26:31 +00:00
manu
20d3dfdcfa fix endianness issue introduced yesterday 2006-10-03 20:43:10 +00:00
vanhu
2b72a4f236 remoteid/ph1id support 2006-10-03 08:04:31 +00:00
vanhu
b45c893ef4 Added remoteid/ph1id syntax 2006-10-03 08:03:59 +00:00
vanhu
7d2c6acefd Parses remoteid/ph1id values 2006-10-03 08:03:33 +00:00
vanhu
dd3c365568 Uses remoteid/ph1id values 2006-10-03 08:02:51 +00:00
vanhu
80d5a8a518 Added remoteid/ph1id values 2006-10-03 08:01:56 +00:00
manu
9547d0f260 avoid reusing free'd pointer (Coverity 2613) 2006-10-02 21:51:33 +00:00
manu
1966cc3311 Check for NULL pointer (COverity 4175) 2006-10-02 21:47:32 +00:00
manu
e1ade705e1 Remove dead code (Coverity 3451) 2006-10-02 21:41:59 +00:00
manu
520ec462f7 Fix array overrun (Coverity 4172) 2006-10-02 21:33:14 +00:00
manu
e5d24ec446 Fix memory leak (Coverity 2002) 2006-10-02 21:27:08 +00:00
manu
cdb1e64a8c Fix memory leak (Coverity 2001), refactor the code to use port get/set 
functions
 2006-10-02 21:19:43 +00:00
manu
cd350eaf6d Avoid reusing free'd pointer (Coverity 4200) 2006-10-02 20:52:17 +00:00
manu
d564be9350 Don't use NULL pointer (Coverity 3443), reformat to 80 char/line 2006-10-02 18:54:46 +00:00
dogcow
f54a9b4797 If you're going to initialize a pointer, you have to init it with a pointer 
type, not an int.
 2006-10-02 12:44:40 +00:00
manu
68e9583818 Don't use NULL pointer (coverity 3439) 2006-10-02 12:04:53 +00:00
manu
5227e9475b Don't use NULL pointer (Coverity 1334) 2006-10-02 11:59:40 +00:00
manu
41042afaf6 Don't use NULL pointer (Coverity 944) 2006-10-02 07:17:57 +00:00
manu
01d5ad642c Don't use NULL pointer (Coverity 941) 2006-10-02 07:15:09 +00:00
manu
9a55720f5c Don't use NULL pointer (Coverity 942) 2006-10-02 07:12:26 +00:00
manu
bfd607cda0 Don't use null pointer (Coverity 863) 2006-10-02 07:08:25 +00:00
manu
626d146a75 FIx memory leak (Coverity 4181) 2006-10-01 22:04:03 +00:00
manu
7be862b0db Check that iph1->remote is not NULL before using it (Coverity 3436) 2006-10-01 19:23:57 +00:00
manu
c7242e7e9f emove dead code (Coverity 4165) 2006-09-30 21:49:37 +00:00
manu
07b750b745 Fix memory leak (Coverity 4179) 2006-09-30 21:38:39 +00:00
manu
df69765a89 update the scripts for wrorking around routing problems on NetBSD 2006-09-30 21:22:21 +00:00
manu
172675f3db Reuse existing code for closing IKE sockets, and avoid screwing things by 
setting p->sock = -1, which is not expected (Coverity 4173).
 2006-09-30 16:14:18 +00:00
manu
d5f44674f8 Do not free id and key, as they are used later 2006-09-30 15:51:42 +00:00
cube
55269b80c3 Grab a couple of lines from OpenSSH-portable that allow PAM authentication 
to succeed.  I guess the default configuration of NetBSD wasn't tested
before the import...
 2006-09-29 22:47:21 +00:00
manu
efb59e1b32 Fix the fix: handle_recv closes the socket, so we must call com_init before 
sending any data.
 2006-09-29 21:39:35 +00:00
christos
8da6ea8890 Check for cert being NULL too. 2006-09-29 17:07:32 +00:00
christos
897b34d36d http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2937 
OpenSSL 0.9.7 before 0.9.7l and 0.9.8 before 0.9.8d allows
    remote attackers to cause a denial of service (inifnite loop
    and memory consumption) via malformed ASN.1 structures that
    trigger an improperly handled error condition.

http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2940
    OpenSSL 0.9.7 before 0.9.7l, 0.9.8 before 0.9.8d, and earlier
    versions allows attackers to cause a denial of service (CPU
    consumption) via certain public keys that require extra time
    to process.

http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3738
    Buffer overflow in the SSL_get_shared_ciphers function in
    OpenSSL 0.9.7 before 0.9.7l, 0.9.8 before 0.9.8d, and earlier
    versions has unspecified impact and remote attack vectors
    involving a long list of ciphers.

http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4343
    Unspecified vulnerability in the SSLv2 client code in OpenSSL
    0.9.7 before 0.9.7l, 0.9.8 before 0.9.8d, and earlier versions
    allows remote servers to cause a denial of service (client
    crash) via unknown vectors.
 2006-09-29 15:41:08 +00:00
he
f1afbc1ee7 Use PRIu64 instead of llu when printing an u_int64_t. 
Fixes a build problem for our LP64 ports, where u_int64_t is
typically an unsigned long.
 2006-09-29 14:36:34 +00:00
he
a4970f4ee7 The "success" field in Authctxt needs to be a sig_atomic_t, not an int, 
so that we don't get a type conflict on dispatch_run() invocation.  Found
while building for alpha and amd64.
 2006-09-29 14:34:25 +00:00
christos
229f040cb9 We need this again. 2006-09-28 21:23:13 +00:00
christos
c5a8b87f73 Resolve conflicts 2006-09-28 21:22:14 +00:00
christos
49b7694919 from www.openssh.org 2006-09-28 21:14:57 +00:00
manu
ca09533497 Fix unchecked mallocs (Coverity 4176, 4174) 2006-09-28 20:30:13 +00:00