ac5d4384ae
remove generated files
2004-09-14 07:50:24 +00:00
a53f6df83e
Import heimdal 0.6.3
...
Changes in release 0.6.3
* fix vulnerabilities in ftpd
* support for linux AFS /proc "syscalls"
* support for RFC3244 (Windows 2000 Kerberos Change/Set Password) in
kpasswdd
* fix possible KDC denial of service
* bug fixes
2004-09-14 07:45:53 +00:00
6e317e9e72
Disable the "may kill you" message, because:
...
1) It's not documented anywhere.
2) The problem it's attempting to warn about is not documented anywhere.
3) There are no example configs (or any I found with Google) that use the
"listen" directive.
4) In any event, it's poorly worded and unclear what it's talking about.
2004-08-06 13:57:05 +00:00
14c8904f79
rename local pow10 function to avoid conflicts with the C99 libm one;
...
while not implemented in NetBSD yet is is considered reserved by gcc-3.4
2004-08-05 16:55:34 +00:00
e8e1e9c2fe
Sync with Heimdal: krb5_set_password.3,v 1.7 (except for a reference to
...
a man page we don't have yet):
Document krb5_set_password_using_ccache and krb5_passwd_result_to_string.
Ok'd by lha.
2004-07-18 15:08:50 +00:00
258b1bfb2e
Remove superfluous comma; grammar fixes; split sentence
...
in two for better understanding.
XXX: krb5_set_password_using_ccache not described.
2004-07-14 09:21:59 +00:00
8045e967b9
Fix typo (space added at beginning of line in an editor window under
...
the shell where I retested the Makefile changes, sigh...)
2004-07-14 07:12:25 +00:00
f17171cf5d
Restore Heimdal Id as $Heimdal:, add NetBSD ID.
2004-07-14 07:06:44 +00:00
98b92eb4a5
Commit manpage for krb5_set_password(3), based on Heimdal-20040606,
...
with small revisions by myself, reviewed/approved by Love.
2004-07-14 07:02:07 +00:00
8416ac87c6
Print ssize_t-typed variables using %zd format, not just %d.
...
Fixes build problem observed when compiling for hpcarm.
2004-07-13 14:15:17 +00:00
e5f57f3a70
Commit changes from Heimdal-current, as per discussion with Love
...
(lha@NetBSD.ORG ), to incorporate contemporary (last-year-ish)
set-password and change-password extensions derived RFC-3244
(Microsoft set-password/change-password extensions), and the
subsequent MIT-KRB5 APIs for changing and setting passwords.
Required for compatibility with recent (2002/2003-ish) open-source
code which uses the MIT KRB5 APIs for setting passwords, or for
joining Microsoft domains as a "computer account".
Modified files (for pullup tracking purposes):
lib/libasn1/Makefile
crypto/dist/heimdal/lib/asn1/k5.asn1
crypto/dist/heimdal/lib/krb5/changepw.c
crypto/dist/heimdal/lib/krb5/krb5-protos.h
crypto/dist/heimdal/lib/krb5/krb5.h
2004-07-12 20:44:56 +00:00
763b8e76a6
Now that we have addrlen, use it.
2004-07-06 02:59:55 +00:00
c62dff1bf7
fix a const'ification inconsistency, noticed by gcc-3.4
2004-07-01 21:27:42 +00:00
5e420ba772
restore behaviour before the 0.9.7d import: fall back to /dev/urandom
...
if ~/.rnd is not present.
(This code is with #ifdef __OpenBSD__ in openssl now; this change just
generalizes it.)
(approved by tls)
2004-06-21 15:14:16 +00:00
166adfa9e5
sync w/ 20040617.
2004-06-17 03:42:55 +00:00
f7968a3c82
version 20040617a, includes important fix about cert handling
2004-06-17 03:38:44 +00:00
76164d845a
Now that we have res_nsearch, use it. Thanks christos for adding it.
2004-05-25 11:15:43 +00:00
bba70dc29c
Merge changes between Heimdal 0.6.1 and 0.6.2
2004-05-08 13:27:58 +00:00
0575824546
Import of Heimdal release 0.6.2
...
* Fix possible buffer overrun in v4 kadmin (which now defaults to off)
2004-05-08 13:15:02 +00:00
e0bc90b23e
Set LoginGraceTime back to 600 like it used to be. This should
...
help slow machines with long keys to still work like they did with
NetBSD 1.6 and before.
2004-05-01 06:06:33 +00:00
b4a3a9e6c1
properly validate phase 1 signature.
...
http://www.vuxml.org/freebsd/d8769838-8814-11d8-90d1-0020ed76ef5a.html
2004-04-12 03:34:05 +00:00
604a0b444a
KAME racoon as of 2004/4/12
2004-04-12 03:26:57 +00:00
e4e583e45c
From Heimdal, cast size_t to unsigned long for LP64 platforms.
2004-04-02 20:58:36 +00:00
8aa367e8da
more text how to do imports
2004-04-02 15:11:21 +00:00
4d21efe5f7
Merge changes between heimdal-0.6 and heimdal-0.6.1
2004-04-02 14:59:46 +00:00
a08e247c98
Import heimdal-0.6.1
...
Changes in release 0.6.1
* Fixed ARCFOUR suppport
* Cross realm vulnerability
* kdc: fix denial of service attack
* kdc: stop clients from renewing kerberos 4 tickets into the future
* bug fixes
2004-04-02 14:47:00 +00:00
7fba5a69cf
reject packet with too big isakmp message length field.
2004-03-31 07:19:27 +00:00
4b32eb44a7
Resolve conflicts. In particular, prefer OpenSSL's BIO_strl* and
...
BIO_strncpy over ours.
2004-03-20 04:32:34 +00:00
5a374ad0ce
Import OpenSSL 0.9.7d to address:
...
1. Null-pointer assignment during SSL handshake
2. Out-of-bounds read affects Kerberos ciphersuites
2004-03-20 04:22:06 +00:00
0684427439
Import OpenSSL 0.9.7d to address:
...
1. Null-pointer assignment during SSL handshake
2. Out-of-bounds read affects Kerberos ciphersuites
2004-03-20 04:22:04 +00:00
eec56f3b12
Bump date for previous.
2004-03-06 23:38:40 +00:00
da6bd485cd
add missing description of "EnableSshKeysign".
2004-03-06 14:33:08 +00:00
c6a556a5b6
endian mismatch. from iij seil team
2004-01-16 02:25:14 +00:00
3c3791b847
validate hash on info exchange. bugtraq <20040113213940.GA1727@hzeroseven.org>
2004-01-14 09:17:42 +00:00
4758291178
Fix the checkflist for builds without Kerberos 4 (MKKERBEROS4=no)
...
and without Kerberos 4 & 5 (MKKERBEROS=no). Previously checkflist
complained of missing files.
* move kerberos- and kerberos 4-only files into new flists,
distrib/sets/lists/*/krb.*
* make the flist generators grok MKKERBEROS{,4} variables
* fix Makefiles which treat MKKERBEROS=no as MKKERBEROS5=no.
9 out of 10 experts agree that it is ludicrous to build w/
KERBEROS4 and w/o KERBEROS5.
* fix header files, also, which treat MKKERBEROS=no as MKKERBEROS5=no.
* omit some Kerberos-only subdirectories from the build as
MKKERBEROS{,4} indicate
(I acknowledge the sentiment that flists are the wrong way to go,
and that the makefiles should produce the metalog directly. That
sounds to me like the right way to go, but I am not prepared to do
revamp all the makefiles. While my approach is expedient, it fits
painlessly within the current build architecture until we are
delivered from flist purgatory, and it does not postpone our
delivery. Fair enough?)
2003-12-11 09:46:26 +00:00
2a85abd333
avoid memory leak. hint from Andrew Lunn
2003-11-23 08:33:13 +00:00
5451f8a14e
do not malloc(0). Andrew Lunn
2003-11-23 08:23:02 +00:00
dedf78268d
Patch OpenSSL to use opencrypto (aka /dev/crypto), if configured and
...
(per kernel policy) for crypto transforms for which hardware
acceleration is available. Affects:
crypto/dist/openssl/crypto/engine/eng_all.c
crypto/dist/openssl/crypto/engine/hw_cryptodev.c
crypto/dist/openssl/crypto/evp/c_all.c
as posted to tech-crypto for review/comment on 2003-08-21.
2003-11-20 00:55:51 +00:00
4bbfee09ca
Various typo fixes from Jonathon Gray via jmc@openbsd.
2003-11-17 11:16:10 +00:00
6de72ce0f8
typo. minoura
2003-11-13 10:35:40 +00:00
1356e8977e
pfkey_dump_sadb: when it get an error using sysctl,
...
mimic an error msg from keysock so that caller can process it correctly.
PR/23122.
2003-11-09 15:37:24 +00:00
aec01dda91
sync w/ openssl 0.9.7c. shlib minor bump for libcrypto.
...
(ERR_release_err_state_table() added)
2003-11-04 23:54:26 +00:00
385718bc5c
more unifdef
2003-11-04 23:45:56 +00:00
6b4e6697c9
openssl 0.9.7c. security changes are already in place
2003-11-04 23:25:09 +00:00
746d6bb953
bring in kame rev 1.32. PR 23122
2003-11-04 04:30:38 +00:00
1244cc6c62
Fix NULL vs 0 mixup.
2003-10-25 20:48:10 +00:00
f90a2e28b1
do not build "null ESP and no AUTH" proposal. (racoon 174) by Tom Lendacky
2003-10-23 07:23:50 +00:00
6a6c3ca82f
Don't assign NULL as an integer.
2003-10-21 03:06:55 +00:00
73d47a4f07
Don't return NULL as an integer.
2003-10-21 03:03:39 +00:00
eb3570747f
Make sure HAVE_OPENSSL is undefined, to avoid depending on both
...
libcrypto and libdes. Patch by lha@, posted to tech-userlevel.
2003-10-09 04:31:17 +00:00
ac0a546d0d
realloc error check failure; Greg Troxel, sync w/kame
2003-10-03 21:53:32 +00:00
48b0bfaad0
support policy w/o selector.
2003-10-02 19:53:01 +00:00
3c068c5948
correct unsafe realloc().
2003-10-02 19:52:43 +00:00
b3cd345741
more fixes from 0.9.7c, from openbsd
2003-10-02 02:26:17 +00:00
ae91503b5d
from openbsd:
...
Correct some off-by-ones. They currently don't matter, but this
is for future safety and consistency.
OK krw@, markus@
2003-10-02 02:25:05 +00:00
0a7cc0d7d1
Apply security fix: http://www.openssl.org/news/secadv_20030930.txt
...
Changelog from: http://cvs.openssl.org/chngview?cn=11471
2003-09-30 15:59:53 +00:00
5749c53775
Fix what is obviously a bug: valloc() -> vmalloc(). Now racoon(8) doesn't core
...
dump all the time.
2003-09-25 01:00:32 +00:00
34439bf0c9
off-by-one. from openbsd
2003-09-22 22:12:05 +00:00
28c3d43114
typo. markus@openbsd
2003-09-18 12:42:33 +00:00
841f7944e5
protect against double free; #660 ; zardoz at users.sf.net
...
from openbsd
2003-09-18 08:16:40 +00:00
c2011dbc01
missing buffer_free(&encrypted); #662 ; zardoz at users.sf.net
...
from openbsd
2003-09-18 08:16:15 +00:00
898af9fa6c
make sure we init nalloc.
2003-09-18 01:41:56 +00:00
3171afa413
fix problem in previous patch
2003-09-18 01:35:07 +00:00
d4d840dd36
More buffer size adjusted before allocation succeeded fixes. Bump to 20030917.
...
From FreeBSD (with an additional one from me).
2003-09-17 23:19:02 +00:00
51b1a61a2d
dammit, don't apply patches blindly.
2003-09-16 23:18:24 +00:00
08d244b791
bring more fixes from 3.7.1
2003-09-16 23:16:59 +00:00
5de000c8d7
crank __NETBSDSSH_VERSION for buffer.c fix
2003-09-16 17:39:32 +00:00
325fccf53f
Do not record expanded size before attempting to reallocate the associated
...
memory. From OpenBSD, via FreeBSD.
2003-09-16 13:22:57 +00:00
249c9d88ea
use sysctl to dump SAs if possible (not really tested)
2003-09-12 08:44:34 +00:00
efbe374b9f
SKEY and BSDAUTH #ifdef mixup
2003-09-08 21:00:41 +00:00
f13cb0c7b2
bzero() 2nd arg mistake. found by openbsd guys. from kame
2003-09-04 00:12:56 +00:00
ca14877c77
reject rc5/idea/mdc2 commands if OPENSSL_NO_xx is specified
2003-08-27 21:05:02 +00:00
31fd31ccf7
Make getlastlogx have the pathname to the lastlogx database as first
...
argument, to be consistent with updlastlogx.
Approved by christos, reviewed by kleink.
[The lastlogxname function should not be used any longer.]
2003-08-26 16:48:32 +00:00
d9c46578d1
update racoon to 2003/8/26 version. mostly minor bugfixes.
2003-08-26 03:31:50 +00:00
2cfb643fda
KAME racoon, as of 2003/08/26
2003-08-26 03:27:01 +00:00
b5f8b9a7c0
KAME libipsec/libpfkey, 2003/08/26
2003-08-26 03:25:29 +00:00
eb24db53ab
style; total size of buf is (num + 3)
2003-08-13 01:29:41 +00:00
658a8c458e
Fix bad use of "sizeof(pointer)" where the length of a buffer was the
...
intention. Fixes problems with least ssh's known_hosts file and factor.
Patch from Berndt Josef Wulf's PR lib/22347.
2003-08-12 03:25:24 +00:00
dc4f8c2e1a
Move UCB-licensed code from 4-clause to 3-clause licence.
...
Patches provided by Joel Baker in PR 22252, verified by myself.
2003-08-07 09:15:17 +00:00
5de5abdd3d
consistently use new DES API, re-enable des regression test
2003-07-31 08:53:58 +00:00
965395c9f3
re-enable __RCSID, sys/cdefs_elf.h rev 1.15 fixed the problem
2003-07-30 00:34:16 +00:00
f33c57af22
disable __RCSID for now, somehow it puts some of integer variables
...
into .text region
2003-07-29 23:17:39 +00:00
308bb7eb39
remove unused macro. PR 21150
2003-07-29 04:45:39 +00:00
4c43ef4ce1
xx_keylen has to return bits, not bytes. KAME-PR-488
2003-07-29 04:30:54 +00:00
3514116803
Apply patch from lha@, via OpenBSD portable SSH's revision 1.11 of this file:
...
mcc -> fcc; from Love Hörnquist Åstrand <lha@it.su.se>
otherwise the kerberos credentinal is stored in a memory cache
in the privileged sshd.
Presumably, this will also come in as part of a later OpenSSH release via
`cvs import', but this is worth having now.
2003-07-28 15:50:17 +00:00
c6912d0211
remove duplicate manual
2003-07-26 15:11:43 +00:00
08a1c4bcd3
empty commit, just to update timestamp and force rebuild of krb.h.
2003-07-26 01:07:35 +00:00
805c102737
fix compilation on sparc64. reported by Juergen Hannken-Illjes
2003-07-25 09:06:02 +00:00
e8876f361f
avoid "unsigned u_int32_t"
2003-07-25 02:02:43 +00:00
88ec7d3792
bring back krb4 support, just to suppress unwanted noise from other developers.
...
note that official openssh distribution have already dropped kerberosIV support,
therefore maintenance cost needs to be paid by us. and have no intent to help.
2003-07-24 15:31:52 +00:00
f4401cd869
upgrade openssl to 0.9.7b. (AES is now supported)
...
alter des.h to be friendly with openssl/des.h (you can include both in the
same file)
make libkrb to depend on libdes. bump major.
massage various portioin of heimdal to be friendly with openssl 0.9.7b.
2003-07-24 14:16:30 +00:00
2836295a36
OpenSSL 0.9.7b, major API changes included
2003-07-24 08:25:41 +00:00
0f3017142e
use snprintf (actually, "addr" can be supplied from outside, and if "addr"
...
points to shorter-than-24 buffer we will overrun buffer. bad API)
2003-07-24 04:41:13 +00:00
7b7c18c4c5
the block is just for krb4 (not for krb5) so should be removed. lha
2003-07-23 21:25:08 +00:00
c55f89ad19
typo on #if condition converesion
2003-07-23 21:03:03 +00:00
0091553542
define symbols even when !KRB4, to simplify shlib management. lha
2003-07-23 20:48:34 +00:00
8556dff80c
remove KRB4 and AFS support. sync w/ openssh main tree
2003-07-23 03:52:16 +00:00
a9503412ba
license clarification (UCB 3-clause, and progressmeter)
2003-07-23 03:51:27 +00:00
46471dc1e9
cast for signed/unsigned mixup
2003-07-14 18:27:48 +00:00
1bffbcd4a1
correct ^@ incorrectly committed
2003-07-14 18:26:05 +00:00
lha