- Copy stable/10 (r259064) to releng/10.0 as part of the
10.0-RELEASE cycle.
- Update __FreeBSD_version [1]
- Set branch name to -RC1

[1] 10.0-CURRENT __FreeBSD_version value ended at '55', so
start releng/10.0 at '100' so the branch is started with
a value ending in zero.

Approved by: re (implicit)
Sponsored by: The FreeBSD Foundation

Copy head (r256279) to stable/10 as part of the 10.0-RELEASE cycle.

Approved by: re (implicit)
Sponsored by: The FreeBSD Foundation

In contrib/opie/opiekey.c, use the correct length to zero the secret.

Found by: clang ToT
Reviewed by: delphij
MFC after: 3 days

Clean up hardcoded ar(1) flags in the tree to use the global ARFLAGS in
share/mk/sys.mk instead.

This is part of a medium term project to permit deterministic builds of
FreeBSD.

Submitted by: Erik Cederstrand <erik@cederstrand.dk>
Reviewed by: imp, toolchain@
Approved by: cperciva
MFC after: 2 weeks

RFC 2289 requires all hashes be stored in little endian format before
folding to 64 bits, while SHA1 code is big endian. Therefore, a bswap32
is required before using the value.

Without this change, the implementation does not conform to test vector
found in RFC 2289.

PR: bin/170519
Submitted by: Arthur Mesh <arthurmesh gmail com> (with changes)
MFC after: 1 week

Change the current working directory to be inside the jail created by
the jail(8) command. [10:04]

Fix a one-NUL-byte buffer overflow in libopie. [10:05]

Correctly sanity-check a buffer length in nfs mount. [10:06]

Approved by: so (cperciva)
Approved by: re (kensmith)
Security: FreeBSD-SA-10:04.jail
Security: FreeBSD-SA-10:05.opie
Security: FreeBSD-SA-10:06.nfsclient

Don't include <utmp.h> when using <utmpx.h>.

libopie includes both <utmp.h> and <utmpx.h> in this case and uses some
#defines to let the code use struct utmpx and its utility functions.
We'd better not include <utmp.h> here, because maybe it will not be
present in the future.

- Remove non-existing reference
- Fix trailing comma

PR: docs/85118
Submitted by: vs
MFC after: 3 days

Add missing code needed for the detection of IPSec packet replays. [1]

Correctly identify the user running opiepasswd(1) when the login name
differs from the account name. [2]

Security: FreeBSD-SA-06:11.ipsec [1]
Security: FreeBSD-SA-06:12.opie [2]

Create /etc/opiekeys with 0600, not 0644

PR: 84221

FreeBSD does not use this code, but ftpd_popen() contains a buffer overflow.
We might as well patch it.

Submitted by: Przemyslaw Frasunek <venglin@freebsd.lublin.pl>
PR: bin/23352
MFC After: The average time before an unpatched Windows 2000 server gets owned

When computing a new seed for an existing user, opienewseed() would
incorrectly compute the length of the numeric portion of the previous
seed, causing the new seed to be one character shorter than the old
one.

This patch has been submitted to the vendor; I'm committing it right
away since the file is already off the vendor branch.

MFC after: 3 days

Resolve conflicts.

This commit was generated by cvs2svn to compensate for changes in r92906,
which included commits to RCS files with non-trunk default branches.

Zeroing memset() in opiechallenge() really is not needed because it is the
very first thing immediately following opielookup() does being entered, i.e.
look at this:

int opielookup FUNCTION((opie, principal), struct opie *opie AND char
*principal
)
{
int i;

memset(opie, 0, sizeof(struct opie));
...

Make the -a flag to opiekey(1) actually work as advertised.

Reviewed by: ache, audit, security
MFC after: 1 week

Repo copied to /usr/src/lib/libopie/

Add heuristic to detect SSH connection (in the same style as other
heuristics already here which not supposed to be secure, just helpers).

Approved by: security@ silence

Fix overflow problem when giving a username that is too long.
Also minor declaration/header fixes while auditing the code.

Fix uninitialized "force" variable.

PR: 23203
Submitted by: fenner
Approved by: markm

Fix SHA1 hashing.

Usse a better method to get a user's credentials, as uid's may be
legally duplicated.

Requested by: ache

Eliminate troff(1) warnings that were hiding some useful text.

Make the similar changes as in our keyinfo, i.e. allow user to get his own
sequence and allow root to get everybody's one. Before this change user
can't get his own sequence, root required.

This commit was generated by cvs2svn to compensate for changes in r73569,
which included commits to RCS files with non-trunk default branches.

Correct security hole in setproctitle(). We don't compile this code, but
having the security hole there makes my skin itch.

Add some extra functions adapted from OpenBSD, in preparation for
OpenSSH OPIE support.

Allow applications to disable the installation of the atexit() handler
which cleans up OPIE lockfiles. This is required for pam_opie.

Submitted by: Jim Bloom <bloom@acm.org>

Resolve conflicts

This commit was generated by cvs2svn to compensate for changes in r59118,
which included commits to RCS files with non-trunk default branches.

- Use proper markup for a section header.
- Replace nonexistent OPIE_PROMPT_MAX with OPIE_CHALLENGE_MAX

PR: 16209
Submitted by: Tetsuro Furuya <tfuruya@ppp142197.asahi-net.or.jp>

sprintf -> snprintf

Fixed printf format errors.

'They They' -> 'They'

PR: 6912
Submitted by: Stefan Eggers <seggers@semyam.dinoco.de>

YTK fix.

Make this manpage reveal its true identity. A diff of these
changes has also been sent to opie-bugs@inner.net.

PR: 5129
Submitted by: jkh

Move locks from /etc/opielocks to /var/run/opielocks to keep
/etc non-writeable as possible

This commit was generated by cvs2svn to compensate for changes in r29975,
which included commits to RCS files with non-trunk default branches.

Oops, __END_DECLS was in wrong place

Not used in this version

Moved to libopie

Merge

This commit was generated by cvs2svn to compensate for changes in r29964,
which included commits to RCS files with non-trunk default branches.

Remove bits of libmissing we don't care about.

Update synopsis. A partial fix has also been submitted to opie@bugs@inner.net
Submitted by: bde

Detect null secret as error, it is temp. fix until next release
Submitted by: Craig Metz <cmetz@inner.net>

Make OPIE's public API use BSD conventions.

Config information for FreeBSD

Minimal man page changes to reflect integrated ftpd/login/su

Disconnect OPIE from internal MD4/5 routines

This commit was generated by cvs2svn to compensate for changes in r22347,
which included commits to RCS files with non-trunk default branches.