summaryrefslogtreecommitdiff
path: root/crypto
AgeCommit message (Collapse)Author
2014-03-04check the correct field in the structure in dsa_verify - pointed out byagc
joerg - thanks!
2014-03-02Use assembler code for 32-bit sparc compat library on sparc64.nakayama
2014-03-02Use more assembler code on sparc64.nakayama
bn-sparcv9.S and OPENSSL_BN_ASM_MONT don't work well since they assume BN_ULONG is 32-bit, so don't use them.
2014-03-02Fix assembler code generation: pass option -m64 properly, andnakayama
generate more code.
2014-02-27From Adam Majer <adamm@zombino.com>: Support IPv6 in X509 subjectAltNametteras
2014-02-21Update to version 20140220agc
Changes from previous version: + portability fixes from xtraeme for his Linux distribution: + add search for ar(1) into autoconf + define __printflike if it's not already defined + fix missing asprintf (I fixed this differently)
2014-02-20Don't print an empty line after the debug message "Enabled Dynamicgson
Window Scaling".
2014-02-17Avoid a warning on Gentoo Linux about fwrite(3) -- their glibcagc
declares fwrite(3) with the warn_unused_result attribute, from Razvan Cojocaru
2014-02-17Manual page fixes from Anthony J. Bentley, with many thanks!agc
Addresses PR/48395
2014-02-17Update the autoconf-based infrastructure for another release.agc
The main change in this infrastructure is to get rid of the libnetpgp-based netpgpverify. This functionality is provided by the standalone netpgpverify and libnetpgpverify in pkgsrc, and verification can also be performed using "netpgp -v".
2014-02-04When building up a PGP public key from an ssh key, do not use the keyagc
file's mtime as the birthtime of the signature - rather, just zero this value (the key birthtime is an inherent part of calculating the key id) This allows public key files to be copied to other file systems, machines or directories, and still produce the same key id.
2014-01-28Mark a potentially unused variable (depending on #ifdef)martin
2014-01-18Use basename(filename) in "Generated from %s" comments in output files,apb
to avoid embedding the path to the build tree.
2014-01-16eliminate use of bsd.sys.mk from Makefileschristos
2014-01-11merge conflictschristos
2014-01-11regenchristos
2014-01-11zero %excchristos
2014-01-11 Changes between 1.0.1e and 1.0.1f [6 Jan 2014]christos
*) Fix for TLS record tampering bug. A carefully crafted invalid handshake could crash OpenSSL with a NULL pointer exception. Thanks to Anton Johansson for reporting this issues. (CVE-2013-4353) *) Keep original DTLS digest and encryption contexts in retransmission structures so we can use the previous session parameters if they need to be resent. (CVE-2013-6450) [Steve Henson] *) Add option SSL_OP_SAFARI_ECDHE_ECDSA_BUG (part of SSL_OP_ALL) which avoids preferring ECDHE-ECDSA ciphers when the client appears to be Safari on OS X. Safari on OS X 10.8..10.8.3 advertises support for several ECDHE-ECDSA ciphers, but fails to negotiate them. The bug is fixed in OS X 10.8.4, but Apple have ruled out both hot fixing 10.8..10.8.3 and forcing users to upgrade to 10.8.4 or newer. [Rob Stradling, Adam Langley]
2014-01-07Format string checks for do_log.joerg
2014-01-06Fix build (cast to const char *).htodd
2014-01-06Move __printflike to the prototype. Add explicit cast for void * ->joerg
char * to make GCC happy.
2014-01-06Add __printflike.joerg
2014-01-06Add __printflike where necessary.joerg
2014-01-06Remove extra trailing spaces in functions arguments.njoly
2014-01-02Do not install files in usr/share/ when MKSHARE=notho
ok christos@
2013-12-25Resort libraries according to dependencies.joerg
2013-12-15Coverity issues 996120 and 996121, Use after freespz
Use the M_CP_STROPT definition exclusive to servconf.c twice and you have freed your original string. servconf.h won copying authorized_keys_command and authorized_keys_command_user in COPY_MATCH_STRING_OPTS in 1.107, but servconf.c didn't drop its own, so it walks into this trap. Remove the duplicate copies, and disarm the trap. Note this is on a code path where authorized_keys_command and authorized_keys_command_user don't actually get used except for a debug dump of the config, and dump_cfg_string protects itself against trying to print NULL pointers, so all you get is sshd -T -C ... giving wrong results, which is rather insignificant as far as security issues go.
2013-12-03Coverity fix:spz
979928 Use after free debug3 line moved to before one of its arguments is freed
2013-11-19CID 1129615: close argument can't be negativechristos
2013-11-14CID 240779: Wrong sizeof used in allocationchristos
2013-11-11CID 1128376: check ftruncate resultchristos
2013-11-11CID 1092495: Widen operation to prevent overflowchristos
2013-11-11CID 1092473: Fix file descriptor leakchristos
2013-11-11CID-1128381: Avoid use after freechristos
2013-11-08merge conflicts.christos
2013-11-08Import new openssh to addresschristos
Changes since OpenSSH 6.3 ========================= This release fixes a security bug: * sshd(8): fix a memory corruption problem triggered during rekeying when an AES-GCM cipher is selected. Full details of the vulnerability are available at: http://www.openssh.com/txt/gcmrekey.adv Checksums: ========== - SHA1 (openssh-6.4.tar.gz) = 4caf1a50eb3a3da821c16298c4aaa576fe24210c - SHA1 (openssh-6.4p1.tar.gz) = cf5fe0eb118d7e4f9296fbc5d6884965885fc55d Reporting Bugs: =============== - Please read http://www.openssh.com/report.html Security bugs should be reported directly to openssh@openssh.com OpenSSH is brought to you by Markus Friedl, Niels Provos, Theo de Raadt, Kevin Steves, Damien Miller, Darren Tucker, Jason McIntyre, Tim Rice and Ben Lindstrom.
2013-10-20remove unused variableschristos
2013-10-20remove unused variableschristos
2013-10-20- provide the right size to the zeroing memory functionchristos
- remove unused variables
2013-10-20fix wrong argument to sizeof.christos
2013-10-19avoid casts when the necessary union member is already available.mrg
from apb.
2013-10-06Enable VerifyHostKeyDNS (SSHFP records verification) from DNS for hostsjym
under NetBSD.org domain. Multiple TNF hosts have an up-to-date SSHFP record inside the DNS. This offers a second channel verification for host key fingerprints (weaker than known_hosts, but spoofing a host on first connect would also require DNS forgery). This can provide a trusted second channel (like DANE TLSA records) once DNSSEC gets more widely used, but for now it is purely informational. No regression expected, except that the ssh client will print a message upon first connect to confirm/infirm that it got a correct SSHFP record from DNS. Only done for NetBSD.org domain, SSHFP are sadly more an exception than the rule. Notified on netbsd-users@, no objection after a week -- committed.
2013-09-29add libcrypto; needed by new binutilschristos
2013-09-11If a library needs a symbol from another library, pull that library injoerg
explicitly, even if the DT_NEEDED closure would normally already ensure the presence.
2013-09-11Add dependency on libz and libbz2.joerg
2013-08-28Publish explicit_memset and consttime_memequal in userland libc.riastradh
Remove the double-underscore from the userland versions, and do the weak alias dance instead, now that these are public parts of libc. As discussed on tech-userlevel: https://mail-index.netbsd.org/tech-userlevel/2013/06/24/msg007843.html (option 3)
2013-08-28Fix sense of consttime_memequal and update all callers.riastradh
Now it returns true (nonzero) to mean equal and false (zero) to mean inequal, as the name suggests. As promised on tech-userlevel back in June: https://mail-index.netbsd.org/tech-userlevel/2013/06/24/msg007843.html
2013-08-04Prefer "." for the current address and not the PPC specific "$".joerg
2013-07-28Re-check the entropy level after we call RAND_poll(), so that we dotls
not continuously suck data out of /dev/urandom if we receive a stream of requests larger than the initial-entropy threshold (hi Roland!).
2013-07-20Use Mt for email addresses.wiz