Remove MKCRYPTO option.

Originally, MKCRYPTO was introduced because the United States
classified cryptography as a munition and restricted its export. The
export controls were substantially relaxed fifteen years ago, and are
essentially irrelevant for software with published source code.

In the intervening time, nobody bothered to remove the option after
its motivation -- the US export restriction -- was eliminated. I'm
not aware of any other operating system that has a similar option; I
expect it is mainly out of apathy for churn that we still have it.
Today, cryptography is an essential part of modern computing -- you
can't use the internet responsibly without cryptography.

The position of the TNF board of directors is that TNF makes no
representation that MKCRYPTO=no satisfies any country's cryptography
regulations.

My personal position is that the availability of cryptography is a
basic human right; that any local laws restricting it to a privileged
few are fundamentally immoral; and that it is wrong for developers to
spend effort crippling cryptography to work around such laws.

As proposed on tech-crypto, tech-security, and tech-userlevel to no
objections:

https://mail-index.netbsd.org/tech-crypto/2017/05/06/msg000719.html
https://mail-index.netbsd.org/tech-security/2017/05/06/msg000928.html
https://mail-index.netbsd.org/tech-userlevel/2017/05/06/msg010547.html

P.S. Reviewing all the uses of MKCRYPTO in src revealed a lot of
*bad* crypto that was conditional on it, e.g. DES in telnet... That
should probably be removed too, but on the grounds that it is bad,
not on the grounds that it is (nominally) crypto.

Don't depend on HAVE_GCC being always defined.

These directories default to WARNS?=5

PR/45805: Borodin Oleg: telnet/telnetd with -DAUTHENTICATION -DENCRYPTION
(rfc2941)
- minimal fixes to compile with WARNS=4
- separate kerberos (USE_KERBEROS) from encryption (MKCRYPTO)

branches: 1.33.2;
remove most of the remaining HAVE_GCC tests that are always true in
the modern world.

branches: 1.32.2;
We no longer need to -I/usr/include/krb5.

Wrap compiler-specific flags with HAVE_GCC and HAVE_PCC as necessary. Add a few flags for PCC.

Add test for HAVE_PCC with HAVE_GCC which turn off compiler warning flags.

branches: 1.29.2;
Rename MKPRIVATELIB to LIBISPRIVATE, to make it clearer that this is
a variable that is used by in-tree Makefiles to control behaviour.
(MKsomevar variables are generally intended to be controlled by the end-user)

branches: 1.28.10;
Add new Makefile knob, USE_FORT, which extends USE_SSP by turning on the
FORTIFY_SOURCE feature of libssp, thus checking the size of arguments to
various string and memory copy and set functions (as well as a few system
calls and other miscellany) where known at function entry. RedHat has
evidently built all "core system packages" with this option for some time.

This option should be used at the top of Makefiles (or Makefile.inc where
this is used for subdirectories) but after any setting of LIB.

This is only useful for userland code, and cannot be used in libc or in
any code which includes the libc internals, because it overrides certain
libc functions with macros. Some effort has been made to make USE_FORT=yes
work correctly for a full-system build by having the bsd.sys.mk logic
disable the feature where it should not be used (libc, libssp iteself,
the kernel) but no attempt has been made to build the entire system with
USE_FORT and doing so will doubtless expose numerous bugs and misfeatures.

Adjust the system build so that all programs and libraries that are setuid,
directly handle network data (including serial comm data), perform
authentication, or appear likely to have (or have a history of having)
data-driven bugs (e.g. file(1)) are built with USE_FORT=yes by default,
with the exception of libc, which cannot use USE_FORT and thus uses
only USE_SSP by default. Tested on i386 with no ill results; USE_FORT=no
per-directory or in a system build will disable if desired.

make MKCRYPTO=no work again.

sprinkle some -fno-strict-aliasing and -Wno-pointer-sign with GCC4.

Goodbye KerberosIV

Fix pk to use BN_ instead of libmp.

PAM support from FreeBSD.

Use MKPRIVATELIB=yes instead of providing an empty libinstall:: target and
setting NOLINT, NOPIC, NOPROFILE (etc)

Fix the checkflist for builds without Kerberos 4 (MKKERBEROS4=no)
and without Kerberos 4 & 5 (MKKERBEROS=no). Previously checkflist
complained of missing files.

* move kerberos- and kerberos 4-only files into new flists,
distrib/sets/lists/*/krb.*

* make the flist generators grok MKKERBEROS{,4} variables

* fix Makefiles which treat MKKERBEROS=no as MKKERBEROS5=no.
9 out of 10 experts agree that it is ludicrous to build w/
KERBEROS4 and w/o KERBEROS5.

* fix header files, also, which treat MKKERBEROS=no as MKKERBEROS5=no.

* omit some Kerberos-only subdirectories from the build as
MKKERBEROS{,4} indicate

(I acknowledge the sentiment that flists are the wrong way to go,
and that the makefiles should produce the metalog directly. That
sounds to me like the right way to go, but I am not prepared to do
revamp all the makefiles. While my approach is expedient, it fits
painlessly within the current build architecture until we are
delivered from flist purgatory, and it does not postpone our
delivery. Fair enough?)

no longer need to -I/usr/include first (yes, it's still confusing, i admit)

Fix build problem caused by recent "Makefile" changes.

split MKKERBEROS4 from MKKERBEROS. based on work by lha at stacken.kth.se
(build confirmed with both MKKERBEROS4=yes and MKKERBEROS4=no)

do not build/install shlib

Remove GCC 3.3 hack; the libtelnet code has been changed to avoid the
warning.

Split the notion of building Hesiod, Kerberos, S/key, and YP
infrastructure and using that infrastructure in programs.

* MKHESIOD, MKKERBEROS, MKSKEY, and MKYP control building
of the infratsructure (libraries, support programs, etc.)

* USE_HESIOD, USE_KERBEROS, USE_SKEY, and USE_YP control
building of support for using the corresponding API
in various libraries/programs that can use it.

As discussed on tech-toolchain.

Hack around GCC PR optmization/5230 if HAVE_GCC3 is set. (GCC 3.x
issues spurious warning when compiling a Duff's device with optimization.)

explicitly set to WARNS?=1

Add MK... variables to enable/disable various aspects of building
crypto support into the system. See share/mk/bsd.README for more
a full description.

Bring the telnet situation back into better shape. Specifically,
pull in just about all of the differences from the crypto-us telnet
suite (which includes Kerberos 4 and connection encryption support).
Also bring in the Kerberos 5 support from the Heimdal telnet, and
frob a little so that it can work with the non-Heimdal telnet suite.

There is still some work left to do, specifically:
- Add Heimdal's ticket forwarding support to the Berkeley Kerberos 4
module.
- Add connection encryption support to the Heimdal Kerberos 5
module. Hints on this can be taken from the MIT Kerberos 5
module which still exists in crypto-us.

However, even with the shortcomings listed above, this is a
better situation than using the stock Heimdal telnet suite,
which does not understand the IPSec policy stuff, and is also
based on much older code which contains bugs that we have already
fixed in the NetBSD sources.

branches: 1.10.2;
Merge a bunch of things from crypto-us and crypto-intl into basesrc,
adding support for Heimdal/KTH Kerberos where easy to do so. Eliminate
bsd.crypto.mk.

There is still a bunch more work to do, but crypto is now more-or-less
fully merged into the base NetBSD distribution.

branches: 1.9.6;
optionally include CRYPTOPATH Makefile.frag files.

Use bsd.crypto.mk.

use CPPFLAGS instead of CFLAGS

branches: 1.6.2;
update libtelnet with changes through 95.10.23 version

we have cgetent()

new libtelnet from ftp.cray.com. Encryption support ripped out, pending
figuring out what to do about it...

Add RCS identifiers.

Be able to build telnet without enc_des.c

branches: 1.1.1;
Initial revision

more const

branches: 1.15.82; 1.15.84;
Remove KRB4 dependent code (Jukka Salmi)

PAM support from FreeBSD.

de-__P (really de-P)

Move UCB-licensed code from 4-clause to 3-clause licence.

Patches provided by Joel Baker in PR 22280, verified by myself.

use bounded string op. bump shlib major for libtelnet due to API change.

be friendly to unifdef(1)

protect against multiple inclusions, and remove redundant decls.

branches: 1.8.8;
More trailing white space.

const poisoning.

WARNSify and RCSID cleanups

update libtelnet with changes through 95.10.23 version

Prototypes (PR#1104).

new libtelnet from ftp.cray.com. Encryption support ripped out, pending
figuring out what to do about it...

Add RCS identifiers.

branches: 1.1.1;
Initial revision

s/Plese/Please/ in comment, and fix an article in obio_wdc.c comment.

unifdef RSA_ENCPWD. The matching code does not exist.

G/C SPX support

It was presented as a draft in 1993. I don't see any mentions since. it
was not enabled.

more const

branches: 1.21.30; 1.21.32;
Use C89 functions definitions.
Remove use of __P

PR/45805: Borodin Oleg: telnet/telnetd with -DAUTHENTICATION -DENCRYPTION
(rfc2941)
- minimal fixes to compile with WARNS=4
- separate kerberos (USE_KERBEROS) from encryption (MKCRYPTO)

branches: 1.19.42;
Goodbye KerberosIV

PAM support from FreeBSD.

de-__P (really de-P)

Move UCB-licensed code from 4-clause to 3-clause licence.

Patches provided by Joel Baker in PR 22280, verified by myself.

use bounded string op. bump shlib major for libtelnet due to API change.

use bounded string op

be friendly to unifdef(1)

__STDC__ is always defined on NetBSD.

Bring the telnet situation back into better shape. Specifically,
pull in just about all of the differences from the crypto-us telnet
suite (which includes Kerberos 4 and connection encryption support).
Also bring in the Kerberos 5 support from the Heimdal telnet, and
frob a little so that it can work with the non-Heimdal telnet suite.

There is still some work left to do, specifically:
- Add Heimdal's ticket forwarding support to the Berkeley Kerberos 4
module.
- Add connection encryption support to the Heimdal Kerberos 5
module. Hints on this can be taken from the MIT Kerberos 5
module which still exists in crypto-us.

However, even with the shortcomings listed above, this is a
better situation than using the stock Heimdal telnet suite,
which does not understand the IPSec policy stuff, and is also
based on much older code which contains bugs that we have already
fixed in the NetBSD sources.

branches: 1.10.4;
assar missed one net_write -> telnet_net_write

const poisoning.

Fix printf format on the Alpha.

WARNSify and RCSID cleanups

WARNSify

update libtelnet with changes through 95.10.23 version

Prototypes (PR#1104).

new libtelnet from ftp.cray.com. Encryption support ripped out, pending
figuring out what to do about it...

Add RCS identifiers.

branches: 1.1.1;
Initial revision

de-__P (really de-P)

Move UCB-licensed code from 4-clause to 3-clause licence.

Patches provided by Joel Baker in PR 22280, verified by myself.

use bounded string op. bump shlib major for libtelnet due to API change.

Make kerberos5 authentication work, and kerberos5 forwarding mostly work.

Add explicit int types for egcs.

WARNSify and RCSID cleanups

update libtelnet with changes through 95.10.23 version

Prototypes (PR#1104).

new libtelnet from ftp.cray.com. Encryption support ripped out, pending
figuring out what to do about it...

Add RCS identifiers.

branches: 1.1.1;
Initial revision

PR bin/58787 libtelnet - avoid using a global variable

From RVP -- make 'encrypt_debug_mode' be a static (file scope)
variable instead of extern, and convert the (had been recently
anyway) unused function encrypt_debug() into an accensor function
for it.

This is the minor (almost irrelevant) change from PR bin/58787

branches: 1.10.2; 1.10.10; 1.10.12;
Match the function prototype of encrypthandler instead of casting to it.
Make GCC 9 snapshot happier with the code

While here, remove unnecessary braces around return (KNF).

branches: 1.9.38; 1.9.40;
PR/45805: Borodin Oleg: telnet/telnetd with -DAUTHENTICATION -DENCRYPTION
(rfc2941)
- minimal fixes to compile with WARNS=4
- separate kerberos (USE_KERBEROS) from encryption (MKCRYPTO)

branches: 1.8.48;
Another fall-out from the de-__Ping round.

remove unneeded definition of "P" macro

de-__P (really de-P), and fix the broken prototype for printsub

Move UCB-licensed code from 4-clause to 3-clause licence.

Patches provided by Joel Baker in PR 22280, verified by myself.

branches: 1.4.2;
Bring the telnet situation back into better shape. Specifically,
pull in just about all of the differences from the crypto-us telnet
suite (which includes Kerberos 4 and connection encryption support).
Also bring in the Kerberos 5 support from the Heimdal telnet, and
frob a little so that it can work with the non-Heimdal telnet suite.

There is still some work left to do, specifically:
- Add Heimdal's ticket forwarding support to the Berkeley Kerberos 4
module.
- Add connection encryption support to the Heimdal Kerberos 5
module. Hints on this can be taken from the MIT Kerberos 5
module which still exists in crypto-us.

However, even with the shortcomings listed above, this is a
better situation than using the stock Heimdal telnet suite,
which does not understand the IPSec policy stuff, and is also
based on much older code which contains bugs that we have already
fixed in the NetBSD sources.

Clean up deleted files.

Add RCS identifiers.

branches: 1.1.1;
Initial revision

PR bin/58787 libtelnet - avoid using a global variable

From RVP -- make 'encrypt_debug_mode' be a static (file scope)
variable instead of extern, and convert the (had been recently
anyway) unused function encrypt_debug() into an accensor function
for it.

This is the minor (almost irrelevant) change from PR bin/58787

fix a/an grammar in obvious cases

branches: 1.16.34; 1.16.42; 1.16.44;
Use C89 functions definitions.
Remove use of __P

PR/45805: Borodin Oleg: telnet/telnetd with -DAUTHENTICATION -DENCRYPTION
(rfc2941)
- minimal fixes to compile with WARNS=4
- separate kerberos (USE_KERBEROS) from encryption (MKCRYPTO)

branches: 1.14.2;
Correct typo, while here, unfold lines.

Remove more duplicate #includes, and a few spurious whitespaces at EOL
From Slava Semushin <slava.semushin@gmail.com>

de-__P (really de-P)

Move UCB-licensed code from 4-clause to 3-clause licence.

Patches provided by Joel Baker in PR 22280, verified by myself.

use bounded string op

backout previous, <des.h> is part of kerberos 4 API

openssl/des.h, not des.h

__STDC__ is always defined on NetBSD.

fix WARNS=2 warnings

eliminate redundant decls.

branches: 1.4.2;
Bring the telnet situation back into better shape. Specifically,
pull in just about all of the differences from the crypto-us telnet
suite (which includes Kerberos 4 and connection encryption support).
Also bring in the Kerberos 5 support from the Heimdal telnet, and
frob a little so that it can work with the non-Heimdal telnet suite.

There is still some work left to do, specifically:
- Add Heimdal's ticket forwarding support to the Berkeley Kerberos 4
module.
- Add connection encryption support to the Heimdal Kerberos 5
module. Hints on this can be taken from the MIT Kerberos 5
module which still exists in crypto-us.

However, even with the shortcomings listed above, this is a
better situation than using the stock Heimdal telnet suite,
which does not understand the IPSec policy stuff, and is also
based on much older code which contains bugs that we have already
fixed in the NetBSD sources.

Clean up deleted files.

Add RCS identifiers.

branches: 1.1.1;
Initial revision

PR bin/58787 libtelnet - avoid using a global variable

From RVP -- make 'encrypt_debug_mode' be a static (file scope)
variable instead of extern, and convert the (had been recently
anyway) unused function encrypt_debug() into an accensor function
for it.

This is the minor (almost irrelevant) change from PR bin/58787

branches: 1.19.2; 1.19.4;
fix various typos in comments, mainly immediatly/immediately/,
as well shared and recently fixed typos in OpenBSD code by Jonathan Grey.

branches: 1.18.2;
Match the function prototype of encrypthandler instead of casting to it.
Make GCC 9 snapshot happier with the code

While here, remove unnecessary braces around return (KNF).

branches: 1.17.30; 1.17.32;
Use C89 functions definitions.
Remove use of __P

PR/45805: Borodin Oleg: telnet/telnetd with -DAUTHENTICATION -DENCRYPTION
(rfc2941)
- minimal fixes to compile with WARNS=4
- separate kerberos (USE_KERBEROS) from encryption (MKCRYPTO)

Avoid buffer overflow, reported by Colin Percival at FreeBSD

branches: 1.14.18; 1.14.22; 1.14.26; 1.14.34;
Remove more duplicate #includes, and a few spurious whitespaces at EOL
From Slava Semushin <slava.semushin@gmail.com>

branches: 1.13.10; 1.13.14;
de-__P (really de-P)

Move UCB-licensed code from 4-clause to 3-clause licence.

Patches provided by Joel Baker in PR 22280, verified by myself.

use bounded string op

The Double-Semi-Colon Police.

__STDC__ is always defined on NetBSD.

eliminate redundant decls.

Bring the telnet situation back into better shape. Specifically,
pull in just about all of the differences from the crypto-us telnet
suite (which includes Kerberos 4 and connection encryption support).
Also bring in the Kerberos 5 support from the Heimdal telnet, and
frob a little so that it can work with the non-Heimdal telnet suite.

There is still some work left to do, specifically:
- Add Heimdal's ticket forwarding support to the Berkeley Kerberos 4
module.
- Add connection encryption support to the Heimdal Kerberos 5
module. Hints on this can be taken from the MIT Kerberos 5
module which still exists in crypto-us.

However, even with the shortcomings listed above, this is a
better situation than using the stock Heimdal telnet suite,
which does not understand the IPSec policy stuff, and is also
based on much older code which contains bugs that we have already
fixed in the NetBSD sources.

branches: 1.6.10;
WARNSify and RCSID cleanups

WARNSify

update libtelnet with changes through 95.10.23 version

new libtelnet from ftp.cray.com. Encryption support ripped out, pending
figuring out what to do about it...

Add RCS identifiers.

branches: 1.1.1;
Initial revision

PR bin/58787 libtelnet - avoid using a global variable

From RVP -- make 'encrypt_debug_mode' be a static (file scope)
variable instead of extern, and convert the (had been recently
anyway) unused function encrypt_debug() into an accensor function
for it.

This is the minor (almost irrelevant) change from PR bin/58787

branches: 1.9.42; 1.9.50; 1.9.52;
PR/45805: Borodin Oleg: telnet/telnetd with -DAUTHENTICATION -DENCRYPTION
(rfc2941)
- minimal fixes to compile with WARNS=4
- separate kerberos (USE_KERBEROS) from encryption (MKCRYPTO)

branches: 1.8.48;
de-__P (really de-P)

Move UCB-licensed code from 4-clause to 3-clause licence.

Patches provided by Joel Baker in PR 22280, verified by myself.

Bring the telnet situation back into better shape. Specifically,
pull in just about all of the differences from the crypto-us telnet
suite (which includes Kerberos 4 and connection encryption support).
Also bring in the Kerberos 5 support from the Heimdal telnet, and
frob a little so that it can work with the non-Heimdal telnet suite.

There is still some work left to do, specifically:
- Add Heimdal's ticket forwarding support to the Berkeley Kerberos 4
module.
- Add connection encryption support to the Heimdal Kerberos 5
module. Hints on this can be taken from the MIT Kerberos 5
module which still exists in crypto-us.

However, even with the shortcomings listed above, this is a
better situation than using the stock Heimdal telnet suite,
which does not understand the IPSec policy stuff, and is also
based on much older code which contains bugs that we have already
fixed in the NetBSD sources.

branches: 1.5.10;
WARNSify and RCSID cleanups

update libtelnet with changes through 95.10.23 version

new libtelnet from ftp.cray.com. Encryption support ripped out, pending
figuring out what to do about it...

Add RCS identifiers.

branches: 1.1.1;
Initial revision

de-__P (really de-P)

use bounded string op

branches: 1.1.2;
Bring the telnet situation back into better shape. Specifically,
pull in just about all of the differences from the crypto-us telnet
suite (which includes Kerberos 4 and connection encryption support).
Also bring in the Kerberos 5 support from the Heimdal telnet, and
frob a little so that it can work with the non-Heimdal telnet suite.

There is still some work left to do, specifically:
- Add Heimdal's ticket forwarding support to the Berkeley Kerberos 4
module.
- Add connection encryption support to the Heimdal Kerberos 5
module. Hints on this can be taken from the MIT Kerberos 5
module which still exists in crypto-us.

However, even with the shortcomings listed above, this is a
better situation than using the stock Heimdal telnet suite,
which does not understand the IPSec policy stuff, and is also
based on much older code which contains bugs that we have already
fixed in the NetBSD sources.

more const

branches: 1.13.30; 1.13.32;
Use C89 functions definitions.
Remove use of __P

PR/45805: Borodin Oleg: telnet/telnetd with -DAUTHENTICATION -DENCRYPTION
(rfc2941)
- minimal fixes to compile with WARNS=4
- separate kerberos (USE_KERBEROS) from encryption (MKCRYPTO)

branches: 1.11.48;
Use (unsigned char) cast to sanitise arguments to ctype functions.

Fix a load of international alphabet problems with isxxx() and toupper()
Change isspace(*char_ptr) to isspace(*char_ptr & 0xff) so that the correct
piece of memory is looked at for the bit mask.
gcc optimises out the '& 0xff' (on i386 at least).
Fixes problems found by gcc when the splurious (int) cast is removed
from the #defines in ctype.h

Move UCB-licensed code from 4-clause to 3-clause licence.

Patches provided by Joel Baker in PR 22280, verified by myself.

char -> unsigned char

WARNSify and RCSID cleanups

WARNSify

update libtelnet with changes through 95.10.23 version

Prototypes (PR#1104).

new libtelnet from ftp.cray.com. Encryption support ripped out, pending
figuring out what to do about it...

Add RCS identifiers.

branches: 1.1.1;
Initial revision

Use C89 functions definitions.
Remove use of __P

branches: 1.10.48;
de-__P (really de-P)

sprinkle const.

Move UCB-licensed code from 4-clause to 3-clause licence.

Patches provided by Joel Baker in PR 22280, verified by myself.

WARNSify and RCSID cleanups

WARNSify

update libtelnet with changes through 95.10.23 version

Prototypes (PR#1104).

new libtelnet from ftp.cray.com. Encryption support ripped out, pending
figuring out what to do about it...

Add RCS identifiers.

branches: 1.1.1;
Initial revision

Goodbye KerberosIV

Coverity CID 1247: Don't use negative index.

de-__P (really de-P)

Don't compare an int to NULL.

Move UCB-licensed code from 4-clause to 3-clause licence.

Patches provided by Joel Baker in PR 22280, verified by myself.

use bounded string op. bump shlib major for libtelnet due to API change.

use bounded string op

Restructure the Duff's device in kerberos4_cksum() to avoid
a bogus unreachable-code warning from GCC 3.x.

backout previous, <des.h> is part of kerberos 4 API

openssl/des.h, not des.h

__STDC__ is always defined on NetBSD.

fix WARNS=2 warnings

eliminate redundant decls.

branches: 1.4.2;
Bring the telnet situation back into better shape. Specifically,
pull in just about all of the differences from the crypto-us telnet
suite (which includes Kerberos 4 and connection encryption support).
Also bring in the Kerberos 5 support from the Heimdal telnet, and
frob a little so that it can work with the non-Heimdal telnet suite.

There is still some work left to do, specifically:
- Add Heimdal's ticket forwarding support to the Berkeley Kerberos 4
module.
- Add connection encryption support to the Heimdal Kerberos 5
module. Hints on this can be taken from the MIT Kerberos 5
module which still exists in crypto-us.

However, even with the shortcomings listed above, this is a
better situation than using the stock Heimdal telnet suite,
which does not understand the IPSec policy stuff, and is also
based on much older code which contains bugs that we have already
fixed in the NetBSD sources.

Clean up deleted files.

Add RCS identifiers.

branches: 1.1.1;
Initial revision

pass the right enum to krb5_auth_con_setkeytype().

Avoid enum type mismatch.

branches: 1.19.6; 1.19.16;
PR/45805: Borodin Oleg: telnet/telnetd with -DAUTHENTICATION -DENCRYPTION
(rfc2941)
- minimal fixes to compile with WARNS=4
- separate kerberos (USE_KERBEROS) from encryption (MKCRYPTO)

branches: 1.18.4;
Stop using functions that are deprecated in Heimdal.

Coverity CID 2757: Avoid leaking key_block

Revert part of previous free'ing because it was really a bug in -lkrb5.
Coverity CID 918: Avoid NULL deref (not strictly necessary).

Coverity CID 1907: Free keyblock, not just the contents.

check pwd != NULL

Use getpwnam_r. From john nemeth.

branches: 1.12.6;
Move UCB-licensed code from 4-clause to 3-clause licence.

Patches provided by Joel Baker in PR 22280, verified by myself.

use bounded string op. bump shlib major for libtelnet due to API change.

context -> telnet_context in two places.

make sure the client creates a subkey; also make the server check that
it actually got a subkey, and if not use the session key

update infrastructure for krb4 1.1 and heimdal 0.4e

update for new libkrb5

eliminate redundant decls.

Handle krb5_init_context() failure, rather than dumping core.

branches: 1.4.2;
Bring the telnet situation back into better shape. Specifically,
pull in just about all of the differences from the crypto-us telnet
suite (which includes Kerberos 4 and connection encryption support).
Also bring in the Kerberos 5 support from the Heimdal telnet, and
frob a little so that it can work with the non-Heimdal telnet suite.

There is still some work left to do, specifically:
- Add Heimdal's ticket forwarding support to the Berkeley Kerberos 4
module.
- Add connection encryption support to the Heimdal Kerberos 5
module. Hints on this can be taken from the MIT Kerberos 5
module which still exists in crypto-us.

However, even with the shortcomings listed above, this is a
better situation than using the stock Heimdal telnet suite,
which does not understand the IPSec policy stuff, and is also
based on much older code which contains bugs that we have already
fixed in the NetBSD sources.

Clean up deleted files.

Add RCS identifiers.

branches: 1.1.1;
Initial revision

de-__P (really de-P)

Move UCB-licensed code from 4-clause to 3-clause licence.

Patches provided by Joel Baker in PR 22280, verified by myself.

branches: 1.4.2;
Bring the telnet situation back into better shape. Specifically,
pull in just about all of the differences from the crypto-us telnet
suite (which includes Kerberos 4 and connection encryption support).
Also bring in the Kerberos 5 support from the Heimdal telnet, and
frob a little so that it can work with the non-Heimdal telnet suite.

There is still some work left to do, specifically:
- Add Heimdal's ticket forwarding support to the Berkeley Kerberos 4
module.
- Add connection encryption support to the Heimdal Kerberos 5
module. Hints on this can be taken from the MIT Kerberos 5
module which still exists in crypto-us.

However, even with the shortcomings listed above, this is a
better situation than using the stock Heimdal telnet suite,
which does not understand the IPSec policy stuff, and is also
based on much older code which contains bugs that we have already
fixed in the NetBSD sources.

Clean up deleted files.

Add RCS identifiers.

branches: 1.1.1;
Initial revision

Goodbye KerberosIV

check pwd != NULL

Use getpwnam_r. From john nemeth.

branches: 1.6.2;
de-__P (really de-P)

Move UCB-licensed code from 4-clause to 3-clause licence.

Patches provided by Joel Baker in PR 22280, verified by myself.

use bounded string op. bump shlib major for libtelnet due to API change.

use bounded string op

__STDC__ is always defined on NetBSD.

branches: 1.1.2;
Bring the telnet situation back into better shape. Specifically,
pull in just about all of the differences from the crypto-us telnet
suite (which includes Kerberos 4 and connection encryption support).
Also bring in the Kerberos 5 support from the Heimdal telnet, and
frob a little so that it can work with the non-Heimdal telnet suite.

There is still some work left to do, specifically:
- Add Heimdal's ticket forwarding support to the Berkeley Kerberos 4
module.
- Add connection encryption support to the Heimdal Kerberos 5
module. Hints on this can be taken from the MIT Kerberos 5
module which still exists in crypto-us.

However, even with the shortcomings listed above, this is a
better situation than using the stock Heimdal telnet suite,
which does not understand the IPSec policy stuff, and is also
based on much older code which contains bugs that we have already
fixed in the NetBSD sources.

Clean up deleted files.

Add RCS identifiers.

branches: 1.1.1;
Initial revision

de-__P (really de-P)

Move UCB-licensed code from 4-clause to 3-clause licence.

Patches provided by Joel Baker in PR 22280, verified by myself.

(printd): update prorotype with const
(net_write): rename to telnet_net_write

const poisoning.

WARNSify and RCSID cleanups

update libtelnet with changes through 95.10.23 version

Prototypes (PR#1104).

new libtelnet from ftp.cray.com. Encryption support ripped out, pending
figuring out what to do about it...

Add RCS identifiers.

branches: 1.1.1;
Initial revision

Use C89 functions definitions.
Remove use of __P

branches: 1.12.54;
Move UCB-licensed code from 4-clause to 3-clause licence.

Patches provided by Joel Baker in PR 22280, verified by myself.

be friendly to unifdef(1)

Bring the telnet situation back into better shape. Specifically,
pull in just about all of the differences from the crypto-us telnet
suite (which includes Kerberos 4 and connection encryption support).
Also bring in the Kerberos 5 support from the Heimdal telnet, and
frob a little so that it can work with the non-Heimdal telnet suite.

There is still some work left to do, specifically:
- Add Heimdal's ticket forwarding support to the Berkeley Kerberos 4
module.
- Add connection encryption support to the Heimdal Kerberos 5
module. Hints on this can be taken from the MIT Kerberos 5
module which still exists in crypto-us.

However, even with the shortcomings listed above, this is a
better situation than using the stock Heimdal telnet suite,
which does not understand the IPSec policy stuff, and is also
based on much older code which contains bugs that we have already
fixed in the NetBSD sources.

branches: 1.9.4;
(printd): const-poision

add missing "const".

WARNSify and RCSID cleanups

WARNSify

update libtelnet with changes through 95.10.23 version

Prototypes (PR#1104).

new libtelnet from ftp.cray.com. Encryption support ripped out, pending
figuring out what to do about it...

Add RCS identifiers.

branches: 1.1.1;
Initial revision

more const

branches: 1.9.38; 1.9.40;
PR/45805: Borodin Oleg: telnet/telnetd with -DAUTHENTICATION -DENCRYPTION
(rfc2941)
- minimal fixes to compile with WARNS=4
- separate kerberos (USE_KERBEROS) from encryption (MKCRYPTO)

branches: 1.8.48;
de-__P (really de-P)

Move UCB-licensed code from 4-clause to 3-clause licence.

Patches provided by Joel Baker in PR 22280, verified by myself.

const poisoning.

WARNSify and RCSID cleanups

update libtelnet with changes through 95.10.23 version

new libtelnet from ftp.cray.com. Encryption support ripped out, pending
figuring out what to do about it...

Add RCS identifiers.

branches: 1.1.1;
Initial revision

constify, whitespace.

Fix whitespace.

Fix pk to use BN_ instead of libmp.

PAM support from FreeBSD.

constify, whitespace.

PAM support from FreeBSD.

bump shared libraries.

Goodbye KerberosIV

use bounded string op. bump shlib major for libtelnet due to API change.

use openssl 0.9.6a. shlib major # is bumped for libcrypto, libssl and
all kerberos libraries.

update for new libkrb5

branches: 1.6.2;
Merge a bunch of things from crypto-us and crypto-intl into basesrc,
adding support for Heimdal/KTH Kerberos where easy to do so. Eliminate
bsd.crypto.mk.

There is still a bunch more work to do, but crypto is now more-or-less
fully merged into the base NetBSD distribution.

branches: 1.5.6;
bump shlib version number to match crypto-us version number (which was bumped b/c of new libdes version number, sigh)

Add a note to update src/distrib/sets/lists/base/shl.*, and add a missing
RCS Id.

RCSID Police.

new libtelnet from ftp.cray.com. Encryption support ripped out, pending
figuring out what to do about it...

add shlib_version file, with version 0.0

G/C SPX support

It was presented as a draft in 1993. I don't see any mentions since. it
was not enabled.

Remove unused code

branches: 1.7.82; 1.7.84;
check pwd != NULL

Use getpwnam_r. From john nemeth.

branches: 1.5.6;
Move UCB-licensed code from 4-clause to 3-clause licence.

Patches provided by Joel Baker in PR 22280, verified by myself.

use bounded string op. bump shlib major for libtelnet due to API change.

use bounded string op

__STDC__ is always defined on NetBSD.

branches: 1.1.2;
Bring the telnet situation back into better shape. Specifically,
pull in just about all of the differences from the crypto-us telnet
suite (which includes Kerberos 4 and connection encryption support).
Also bring in the Kerberos 5 support from the Heimdal telnet, and
frob a little so that it can work with the non-Heimdal telnet suite.

There is still some work left to do, specifically:
- Add Heimdal's ticket forwarding support to the Berkeley Kerberos 4
module.
- Add connection encryption support to the Heimdal Kerberos 5
module. Hints on this can be taken from the MIT Kerberos 5
module which still exists in crypto-us.

However, even with the shortcomings listed above, this is a
better situation than using the stock Heimdal telnet suite,
which does not understand the IPSec policy stuff, and is also
based on much older code which contains bugs that we have already
fixed in the NetBSD sources.

libtelnet: convert malloc(x * y) to reallocarr

PR/45805: Borodin Oleg: telnet/telnetd with -DAUTHENTICATION -DENCRYPTION
(rfc2941)
- minimal fixes to compile with WARNS=4
- separate kerberos (USE_KERBEROS) from encryption (MKCRYPTO)

branches: 1.10.2;
- use defines for lengths
- strlcpy/snprintf
- KNK

Fix memset usage. XXX should use static allocate and proper sizeof()

eliminate unused passpromptlen and copy a default password each time we
don't receive one in SRA_CONTINUE.

XXX: SRA does not have a protocol feature to pass back a password prompt
which is needed for things like S/KEY. We abuse the SRA_CONTINUE message
passing the password prompt there. That is usually NULL, so SRA
implementations usually ignore it. While I am here, if telnet_gets() fails
[user hit <eof> for example], then we exit.

Don't perform a check for "secure" tty for root logins when using PAM;
that is what we provide pam_securetty(8) for.

Fix the -DNOPAM build option by allowing it to compile
(even though we don't use this source file when USE_PAM=no).

PAM may change the user name during the authentication process;
ensure that we deal with this so that SRA authenticated logins
will pass the changed user name to login(1).

Fix the check for insecure root logins in rootterm():
- It was originally referring to a bogus version of `line'.
(problem solved by using 'extern char *line' instead of 'extern char line[]')
- It wasn't stripping the leading "/dev/" off `line' before calling getttynam(3)

check pwd != NULL

Use getpwnam_r. From john nemeth.

branches: 1.1.2;
PAM support from FreeBSD.