aboutsummaryrefslogtreecommitdiff
path: root/crypto
Commit message (Collapse)AuthorAgeFilesLines
* Add declaration of SSL_get_selected_srtp_profile() for OpenSSL.Jung-uk Kim2018-01-251-0/+1
| | | | | | | | | | | | | Because there was an extra declaration in the vendor version, we locally removed the second one in r238405 with 1.0.1c. Later, upstream fixed it in 1.0.2d but they removed the first one. Therefore, both were removed in our version unfortunately. Now we revert to the vendor one to re-add it. MFC after: 3 days Differential Revision: https://reviews.freebsd.org/D10525 Notes: svn path=/head/; revision=328419
* Merge OpenSSL 1.0.2n.Jung-uk Kim2017-12-0737-82/+278
|\ | | | | | | Notes: svn path=/head/; revision=326662
| * Import OpenSSL 1.0.2n.vendor/openssl/1.0.2nJung-uk Kim2017-12-0715-47/+63
| | | | | | | | | | Notes: svn path=/vendor-crypto/openssl/dist/; revision=326660 svn path=/vendor-crypto/openssl/1.0.2n/; revision=326661; tag=vendor/openssl/1.0.2n
* | Merge OpenSSL 1.0.2m.Jung-uk Kim2017-11-02133-348/+1576
|\| | | | | | | Notes: svn path=/head/; revision=325328
| * Import OpenSSL 1.0.2m.vendor/openssl/1.0.2mJung-uk Kim2017-11-0256-257/+753
| | | | | | | | | | Notes: svn path=/vendor-crypto/openssl/dist/; revision=325326 svn path=/vendor-crypto/openssl/1.0.2m/; revision=325327; tag=vendor/openssl/1.0.2m
* | Upgrade to OpenSSH 7.5p1.Dag-Erling Smørgrav2017-08-0473-3053/+2331
|\ \ | | | | | | | | | Notes: svn path=/head/; revision=322052
* \ \ MFV r320905: Import upstream fix for CVE-2017-11103.Xin LI2017-07-121-2/+2
|\ \ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | In _krb5_extract_ticket() the KDC-REP service name must be obtained from encrypted version stored in 'enc_part' instead of the unencrypted version stored in 'ticket'. Use of the unecrypted version provides an opportunity for successful server impersonation and other attacks. Submitted by: hrs Obtained from: Heimdal Security: FreeBSD-SA-17:05.heimdal Security: CVE-2017-11103 Notes: svn path=/head/; revision=320906
* \ \ \ Merge OpenSSL 1.0.2l.Jung-uk Kim2017-05-25126-742/+1415
|\ \ \ \ | | |_|/ | |/| | | | | | Notes: svn path=/head/; revision=318899
| * | | Import OpenSSL 1.0.2l.vendor/openssl/1.0.2lJung-uk Kim2017-05-2571-551/+793
| | | | | | | | | | | | | | | | | | | | Notes: svn path=/vendor-crypto/openssl/dist/; revision=318897 svn path=/vendor-crypto/openssl/1.0.2l/; revision=318898; tag=vendor/openssl/1.0.2l
* | | | Refine and update blacklist support in sshdKurt Lidl2017-05-128-16/+23
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Adjust notification points slightly to catch all auth failures, rather than just the ones caused by bad usernames. Modify notification point for bad usernames to send new type of BLACKLIST_BAD_USER. (Support in libblacklist will be forthcoming soon.) Add guards to allow library headers to expose the enum of action values. Reviewed by: des Approved by: des Sponsored by: The FreeBSD Foundation Notes: svn path=/head/; revision=318242
* | | | Fix linking with lld by marking OPENSSL_armcap_P as hidden.Andrew Turner2017-04-071-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Linking with lld fails as it contains a relative address, however the data this address is for may be relocated from the shared object to the main executable. Fix this by adding the hidden attribute. This stops moving this value to the main executable. It seems this is implicit upstream as it uses a version script. Approved by: jkim Sponsored by: DARPA, AFRL Notes: svn path=/head/; revision=316607
* | | | Upgrade to OpenSSH 7.4p1.Dag-Erling Smørgrav2017-03-06195-6730/+5978
|\ \ \ \ | | |_|/ | |/| | | | | | Notes: svn path=/head/; revision=314720
* | | | Re-apply part of r311585 which was inadvertantly reverted in the upgradeDag-Erling Smørgrav2017-03-031-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | to 7.3p1. The other part (which adds -DLIBWRAP to sshd's CFLAGS) is still in place. Reported by: ngie Notes: svn path=/head/; revision=314601
* | | | Forgot to bump the version addendum date.Dag-Erling Smørgrav2017-03-035-5/+5
| | | | | | | | | | | | | | | | Notes: svn path=/head/; revision=314576
* | | | Upgrade to OpenSSH 7.3p1.Dag-Erling Smørgrav2017-03-02154-3237/+5943
|\| | | | | | | | | | | | | | | Notes: svn path=/head/; revision=314527
* | | | Renumber copyright clause 4Warner Losh2017-02-281-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Renumber cluase 4 to 3, per what everybody else did when BSD granted them permission to remove clause 3. My insistance on keeping the same numbering for legal reasons is too pedantic, so give up on that point. Submitted by: Jan Schaumann <jschauma@stevens.edu> Pull Request: https://github.com/freebsd/freebsd/pull/96 Notes: svn path=/head/; revision=314436
* | | | Avoid picking up MIT Kerberos from ports (if installed).Dag-Erling Smørgrav2017-02-261-1/+1
| | | | | | | | | | | | | | | | Notes: svn path=/head/; revision=314306
* | | | Fix amusingly harmless mis-merge.Dag-Erling Smørgrav2017-02-261-1/+0
| | | | | | | | | | | | | | | | Notes: svn path=/head/; revision=314304
* | | | Only notify blacklistd for successful logins in auth.cKurt Lidl2017-02-191-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Reported by: Rick Adams Reviewed by: des MFC after: 3 days Sponsored by: The FreeBSD Foundation Notes: svn path=/head/; revision=313965
* | | | Merge OpenSSL 1.0.2k.Jung-uk Kim2017-01-26100-634/+836
|\ \ \ \ | | |/ / | |/| | | | | | Notes: svn path=/head/; revision=312825
| * | | Import OpenSSL 1.0.2k.vendor/openssl/1.0.2kJung-uk Kim2017-01-2630-184/+215
| | | | | | | | | | | | | | | | | | | | Notes: svn path=/vendor-crypto/openssl/dist/; revision=312823 svn path=/vendor-crypto/openssl/1.0.2k/; revision=312824; tag=vendor/openssl/1.0.2k
* | | | MFV r311913:Xin LI2017-01-118-15/+55
|\ \ \ \ | | |/ / | |/| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Fix multiple OpenSSH vulnerabilities. Submitted by: des Approved by: so Notes: svn path=/head/; revision=311914
* | | | Conditionalize building libwrap support into sshdEnji Cooper2017-01-071-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Only build libwrap support into sshd if MK_TCP_WRAPPERS != no This will unbreak the build if libwrap has been removed from the system MFC after: 2 weeks PR: 210141 Submitted by: kpect@protonmail.com Differential Revision: D9049 Notes: svn path=/head/; revision=311585
* | | | MFV r308196:Xin LI2016-11-021-0/+1
|\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Fix OpenSSH remote Denial of Service vulnerability. Security: CVE-2016-8858 Notes: svn path=/head/; revision=308197
* | | | Build OpenSSL assembly sources for aarch64. Tested with ThunderX by andrew.Jung-uk Kim2016-10-263-3/+2
| | | | | | | | | | | | | | | | Notes: svn path=/head/; revision=307976
* | | | Merge OpenSSL 1.0.2j.Jung-uk Kim2016-09-268-8/+26
|\ \ \ \ | | |/ / | |/| | | | | | Notes: svn path=/head/; revision=306342
| * | | Import OpenSSL 1.0.2j.vendor/openssl/1.0.2jJung-uk Kim2016-09-263-6/+6
| | | | | | | | | | | | | | | | | | | | Notes: svn path=/vendor-crypto/openssl/dist/; revision=306340 svn path=/vendor-crypto/openssl/1.0.2j/; revision=306341; tag=vendor/openssl/1.0.2j
* | | | Merge OpenSSL 1.0.2i.Jung-uk Kim2016-09-22222-1347/+3936
|\| | | | | | | | | | | | | | | Notes: svn path=/head/; revision=306193
| * | | Import OpenSSL 1.0.2i.vendor/openssl/1.0.2iJung-uk Kim2016-09-22134-885/+1578
| | | | | | | | | | | | | | | | | | | | Notes: svn path=/vendor-crypto/openssl/dist/; revision=306189 svn path=/vendor-crypto/openssl/1.0.2i/; revision=306190; tag=vendor/openssl/1.0.2i
* | | | Add refactored blacklist support to sshdKurt Lidl2016-08-3012-1/+195
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Change the calls to of blacklist_init() and blacklist_notify to be macros defined in the blacklist_client.h file. This avoids the need for #ifdef USE_BLACKLIST / #endif except in the blacklist.c file. Remove redundent initialization attempts from within blacklist_notify - everything always goes through blacklistd_init(). Added UseBlacklist option to sshd, which defaults to off. To enable the functionality, use '-o UseBlacklist=yes' on the command line, or uncomment in the sshd_config file. Reviewed by: des Approved by: des MFC after: 1 week Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D7051 Notes: svn path=/head/; revision=305065
* | | | Build OpenSSL assembly sources for arm. Tested with Raspberry Pi 2 Model B.Jung-uk Kim2016-08-222-3/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | MFC after: 1 week Notes: svn path=/head/; revision=304636
* | | | Remove duplicate symbol from libhx509 version-script.mapEd Maste2016-08-221-1/+0
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Upstream commit r21331 (7758a5d0) added semiprivate function _hx509_request_to_pkcs10 twice. This change has been committed upstream as 8ef0071d. Notes: svn path=/head/; revision=304624
* | | | Try to check whether each key file exists before adding it, and bail outDag-Erling Smørgrav2016-08-081-10/+15
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | if we didn't find any of them. This reduces log spam about key files for deprecated algorithms, which we look for but don't generate. PR: 208254 MFC after: 3 days Notes: svn path=/head/; revision=303832
* | | | Remove DSA from default cipher list and disable SSH1.Dag-Erling Smørgrav2016-08-037-40/+19
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Upstream did this a long time ago, but we kept DSA and SSH1 in FreeBSD for reasons which boil down to POLA. Now is a good time to catch up. MFC after: 3 days Relnotes: yes Notes: svn path=/head/; revision=303716
* | | | Remove duplicate symbols from libroken version-script.mapEd Maste2016-07-211-6/+0
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Upstream commit r24759 (efed563) prefixed some symbols with rk_, but introduced 6 duplicate symbols in the version script (because the rk_-prefixed versions of the symbols were already present). Notes: svn path=/head/; revision=303156
* | | | Revert r301551, which added blacklistd(8) to sshd(8).Glen Barber2016-06-248-145/+0
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This change has functional impact, and other concerns raised by the OpenSSH maintainer. Requested by: des PR: 210479 (related) Approved by: re (marius) Sponsored by: The FreeBSD Foundation Notes: svn path=/head/; revision=302182
* | | | Add blacklist support to sshdKurt Lidl2016-06-078-0/+145
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Reviewed by: rpaulo Approved by: rpaulo (earlier version of changes) Relnotes: YES Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D5915 Notes: svn path=/head/; revision=301551
* | | | openssl: change SHLIB_VERSION_NUMBER to reflect the realityAndriy Gapon2016-06-031-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Some consumers actually use this definition. We probably need some procedure to ensure that SHLIB_VERSION_NUMBER is updated whenever we change the library version in secure/lib/libssl/Makefile. Notes: svn path=/head/; revision=301271
* | | | libkrb5: Fix potential double-freeConrad Meyer2016-05-111-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | If krb5_make_principal fails, tmp_creds.server may remain a pointer to freed memory and then be double-freed. After freeing it the first time, initialize it to NULL, which causes subsequent krb5_free_principal calls to do the right thing. Reported by: Coverity CID: 1273430 Sponsored by: EMC / Isilon Storage Division Notes: svn path=/head/; revision=299495
* | | | Merge OpenSSL 1.0.2h.Jung-uk Kim2016-05-0367-263/+1117
|\| | | | | | | | | | | | | | | | | | | | | | | | | | | Relnotes: yes Notes: svn path=/head/; revision=298998
| * | | Import OpenSSL 1.0.2h.vendor/openssl/1.0.2hJung-uk Kim2016-05-0338-122/+334
| | | | | | | | | | | | | | | | | | | | Notes: svn path=/vendor-crypto/openssl/dist/; revision=298991 svn path=/vendor-crypto/openssl/1.0.2h/; revision=298992; tag=vendor/openssl/1.0.2h
* | | | Re-add AES-CBC ciphers to the default cipher list on the server.Dag-Erling Smørgrav2016-03-113-4/+12
| | | | | | | | | | | | | | | | | | | | | | | | | | | | PR: 207679 Notes: svn path=/head/; revision=296634
* | | | Upgrade to OpenSSH 7.2p2.Dag-Erling Smørgrav2016-03-11140-3291/+5765
|\ \ \ \ | | |/ / | |/| | | | | | Notes: svn path=/head/; revision=296633
* | | | Merge OpenSSL 1.0.2g.Jung-uk Kim2016-03-0183-1318/+2668
|\ \ \ \ | | |/ / | |/| | | | | | | | | | | | | | | | | | Relnotes: yes Notes: svn path=/head/; revision=296279
| * | | Import OpenSSL 1.0.2g.vendor/openssl/1.0.2gJung-uk Kim2016-03-0140-1046/+1741
| | | | | | | | | | | | | | | | | | | | Notes: svn path=/vendor-crypto/openssl/dist/; revision=296273 svn path=/vendor-crypto/openssl/1.0.2g/; revision=296274; tag=vendor/openssl/1.0.2g
* | | | Document our modified default value for PermitRootLogin.Dag-Erling Smørgrav2016-02-022-2/+2
| | | | | | | | | | | | | | | | Notes: svn path=/head/; revision=295139
* | | | Merge OpenSSL 1.0.2f.Jung-uk Kim2016-01-28136-443/+844
|\| | | | | | | | | | | | | | | | | | | | | | | | | | | Relnotes: yes Notes: svn path=/head/; revision=295009
| * | | Import OpenSSL 1.0.2f.vendor/openssl/1.0.2fJung-uk Kim2016-01-2896-153/+370
| | | | | | | | | | | | | | | | | | | | Notes: svn path=/vendor-crypto/openssl/dist/; revision=295001 svn path=/vendor-crypto/openssl/1.0.2f/; revision=295002; tag=vendor/openssl/1.0.2f
* | | | Switch UseDNS back onDag-Erling Smørgrav2016-01-274-4/+7
| | | | | | | | | | | | | | | | Notes: svn path=/head/; revision=294909
* | | | r294563 was incomplete; re-add the client-side options as well.Dag-Erling Smørgrav2016-01-221-0/+2
| | | | | | | | | | | | | | | | Notes: svn path=/head/; revision=294564
generated by cgit v1.2.3 (git 2.25.1) at 2024-10-26 11:28:00 +0000