Unbreak build.

Somehow I forgot to include version.h in the servconf.c change that
appended our DragonFly-specific VersionAddendum to sshd.

Patch ssh vendor code for xauth's default location.

This puts the change in one obvious place instead of scattering it
around different Makefiles and makes documention correct.

sshd(8): Disable tunneled cleartext passwords.

This was previously our default that got wiped away when I removed our
local changes to OpenSSH. It's unlikely that anyone running master saw
any chang

sshd(8): Disable tunneled cleartext passwords.

This was previously our default that got wiped away when I removed our
local changes to OpenSSH. It's unlikely that anyone running master saw
any change to their sshd behavior, because they likely had the
PasswordAuthentication line uncommented in their configuration file.

show more ...

Update files for OpenSSH-7.3p1 import.

Remove most local modifications from OpenSSH.

This primarily removes the HPN patches. It's become too cumbersome to
maintain these patches as demonstrated by the fact that we haven't
updated OpenSSH

Remove most local modifications from OpenSSH.

This primarily removes the HPN patches. It's become too cumbersome to
maintain these patches as demonstrated by the fact that we haven't
updated OpenSSH in quite some time. If people want additional
functionality in their OpenSSH, it's available in dports
(security/openssh).

Instead of just silently ignoring removed options in people's
configurations, I decided to treat these as errors so that the admin
will need to decide to remove it from their configuration or install the
dport to get the functionality back.

show more ...

libcrypto(3): Remove some cruft from when we supported 32-bit.

Add IDEA support for libcrypto(3).

The patent expired years ago.

Import OpenSSL-1.0.2h.

Import OpenSSL 1.0.1t.

* Fix CVE-2016-2107, CVE-2016-2105, CVE-2016-2106, CVE-2016-2109,
CVE-2016-2176, CVE-2016-0702

For a more detailed list of changes, see crypto/openssl/CHANGES.

Import OpenSSL 1.0.1s.

* Fix CVE-2016-0800, CVE-2016-0705, CVE-2016-0798, CVE-2016-0797,
CVE-2016-0799, CVE-2016-0702

* Disable weak ciphers in SSLv3 and up in default builds of OpenSSL.

For a m

Import OpenSSL 1.0.1s.

* Fix CVE-2016-0800, CVE-2016-0705, CVE-2016-0798, CVE-2016-0797,
CVE-2016-0799, CVE-2016-0702

* Disable weak ciphers in SSLv3 and up in default builds of OpenSSL.

For a more detailed list of changes, see crypto/openssl/CHANGES.

show more ...

Import OpenSSL 1.0.1r.

* Protection for DH small subgroup attacks

* Fix CVE-2015-3197 (SSLv2 doesn't block disabled ciphers)

* Reject DH handshakes with parameters shorter than 1024 bits

ssh - Remove undocumented roaming support CVE-2016-0777 CVE-2016-0778

* Remove client-side 'roaming' feature as per openbsd patch.

* CVE-2016-0777 CVE-2016-0778. A malicious server can trick the c

ssh - Remove undocumented roaming support CVE-2016-0777 CVE-2016-0778

* Remove client-side 'roaming' feature as per openbsd patch.

* CVE-2016-0777 CVE-2016-0778. A malicious server can trick the client
into potentially leaking key material.

show more ...

Import OpenSSL 1.0.1q.

* Certificate verify crash with missing PSS parameter (CVE-2015-3194)

* X509_ATTRIBUTE memory leak (CVE-2015-3195)

* Rewrite EVP_DecodeUpdate (base64 decoding) to fix severa

Import OpenSSL 1.0.1q.

* Certificate verify crash with missing PSS parameter (CVE-2015-3194)

* X509_ATTRIBUTE memory leak (CVE-2015-3195)

* Rewrite EVP_DecodeUpdate (base64 decoding) to fix several bugs

* In DSA_generate_parameters_ex, if the provided seed is too short,
return an error

show more ...

i386 removal, part 30/x: Remove i386 specific asm files from libcrypto.

Remove i386 config file too.

ssh - Fix an openssh vulnerability

* Note that this vulnerability cannot occur with
DragonFly's defaults.

Security: CVE-2015-5600
Security: FreeBSD-SA-15:16.openssh