IMPORT openssh-9.8p1

* Fixes CVE-2024-6387-openssh

* NOTE that DragonFly is not known to be vulnerable to this CVE, but
because it is a general signal race we are updating sshd anyway,
just in

IMPORT openssh-9.8p1

* Fixes CVE-2024-6387-openssh

* NOTE that DragonFly is not known to be vulnerable to this CVE, but
because it is a general signal race we are updating sshd anyway,
just in case.

show more ...

ldns: Adjust makefiles for ldns-1.8.3 update.

- Bump soname for api changes, 1.8.3 has major as 3.
- Update ldns/ headers and remove them from the vendor branch.
- Adjust lib/libssh Makefile to i

ldns: Adjust makefiles for ldns-1.8.3 update.

- Bump soname for api changes, 1.8.3 has major as 3.
- Update ldns/ headers and remove them from the vendor branch.
- Adjust lib/libssh Makefile to include the headers from ldns.
- Update READMES.

Currently only user of the libprivate_ldns is drill(1).
OpenSSH will be adjusted to use this lib next.

show more ...

Local adjustments for OpenSSH-8.3p1.

Build libssh with ldns support. 2/2

Hook ldns support into libssh via our libprivate_ldns:

- revise libraries build order
- adapt Makefiles
- update libssh/config.h
- drop libssh/openbsd-compat/get

Build libssh with ldns support. 2/2

Hook ldns support into libssh via our libprivate_ldns:

- revise libraries build order
- adapt Makefiles
- update libssh/config.h
- drop libssh/openbsd-compat/getrrsetbyname.c, import
getrrsetbyname-ldns.c instead

Approved by: Rimvydas Jasinskas

show more ...

Upgrade openssh. 2/2

- update README.{DELETED,DRAGONFLY)
- adapt Makefiles
- regenerate config.h and openbsd-compat/

libssh: Bump shlib version for api change.

The private libssh does not install any headers. Make it shpub.
There are few issues that need to be addressed later on.
For now just document its dependen

libssh: Bump shlib version for api change.

The private libssh does not install any headers. Make it shpub.
There are few issues that need to be addressed later on.
For now just document its dependency on libutil, adjust order.
The libprivate_ssh.so must be built before libpam shared modules.

show more ...

Inline Makefile.ssh.common

This fixes path, include and libraries order sequences and will be needed
for further PRIV changes.

Requested-by: swildner

Adjust makefiles for OpenSSH 8.0p1 update.

Update pam_ssh module to use new sshkey api.
The pkcs11 support explicitly disabled to avoid use of dlopen().
If security token/card support is needed it c

Adjust makefiles for OpenSSH 8.0p1 update.

Update pam_ssh module to use new sshkey api.
The pkcs11 support explicitly disabled to avoid use of dlopen().
If security token/card support is needed it can be enabled back.

This update brings several backwards compatibilty breakages.
More in official release notes.

show more ...

Make libssh and mandoc use reallocarray() from libc.

libssh: No need of compat vis.c as we support VIS_ALL

This helps avoid the vis.o symbol conflicts between libc and libssh.

Revert "libssh: Remove local vis.c from the build."

This reverts commit dc312142da731a4dd82f924bf4442734ec45e880.

It needs further thought, our <vis.h> does not have VIS_ALL
(see BROKEN_STRNVIS in

Revert "libssh: Remove local vis.c from the build."

This reverts commit dc312142da731a4dd82f924bf4442734ec45e880.

It needs further thought, our <vis.h> does not have VIS_ALL
(see BROKEN_STRNVIS in lib/libssh/config.h).

show more ...

libssh: Remove local vis.c from the build.

Import OpenSSH-7.6p1

* Adjust build to match import

LIBPRIV: Introduce PRIVATELIB knob (just like INTERNALLIB).

Collect common private libraries path handling bits into share/mk/bsd.lib.mk.
It is cleaner this way, prevents issues like manual paths an

LIBPRIV: Introduce PRIVATELIB knob (just like INTERNALLIB).

Collect common private libraries path handling bits into share/mk/bsd.lib.mk.
It is cleaner this way, prevents issues like manual paths and/or ignoring stale
.depend for /usr/obj/usr/src/world_x86_64/usr/lib/priv/priv/libprivate_ncurses.a

show more ...

build - Rewire secure, remove conflicts from libmd, libcrypt

* Remove /usr/src/secure, folding all of its subsystems into
/usr/src. There's no point having a /usr/src/secure any more,
the syste

build - Rewire secure, remove conflicts from libmd, libcrypt

* Remove /usr/src/secure, folding all of its subsystems into
/usr/src. There's no point having a /usr/src/secure any more,
the system won't run without the secure stuff, the idea that some foreign
actor could segregate it in order to legally download code without crypto
is absurd on the modern internet, and the U.S. government stopped caring
decades ago.

* Remove conflicts from libmd and libcrypt. Essentially this removes
the SHA*_*() and MD5_*() APIs from libmd because these APIs already
exist in lib[re]ssl.

The older SHA*() and MD5*() APIs are partially retained for legacy base
code, but will be removed in a later stage (moved to direct-linking the
needed support source).

Conflicting routines in libcrypt have been renamed and internalized to
be libcrypt-only.

* Major rewiring of the Makefile's to support the changes.

show more ...