Copy stable/9 to releng/9.3 as part of the 9.3-RELEASE cycle.

Approved by: re (implicit)
Sponsored by: The FreeBSD Foundation

MFC r239169:

RFC 2289 requires all hashes be stored in little endian format before
folding to 64 bits, while SHA1 code is big endian. Therefore, a bswap32
is required before using the value.

Without this change, the implementation does not conform to test vector
found in RFC 2289.

PR: bin/170519
Submitted by: Arthur Mesh <arthurmesh gmail com> (with changes)

Copy head to stable/9 as part of 9.0-RELEASE release cycle.

Approved by: re (implicit)

Change the current working directory to be inside the jail created by
the jail(8) command. [10:04]

Fix a one-NUL-byte buffer overflow in libopie. [10:05]

Correctly sanity-check a buffer length in nfs mount. [10:06]

Approved by: so (cperciva)
Approved by: re (kensmith)
Security: FreeBSD-SA-10:04.jail
Security: FreeBSD-SA-10:05.opie
Security: FreeBSD-SA-10:06.nfsclient

Don't include <utmp.h> when using <utmpx.h>.

libopie includes both <utmp.h> and <utmpx.h> in this case and uses some
#defines to let the code use struct utmpx and its utility functions.
We'd better not include <utmp.h> here, because maybe it will not be
present in the future.

Create /etc/opiekeys with 0600, not 0644

PR: 84221

When computing a new seed for an existing user, opienewseed() would
incorrectly compute the length of the numeric portion of the previous
seed, causing the new seed to be one character shorter than the old
one.

This patch has been submitted to the vendor; I'm committing it right
away since the file is already off the vendor branch.

MFC after: 3 days

Resolve conflicts.

This commit was generated by cvs2svn to compensate for changes in r92906,
which included commits to RCS files with non-trunk default branches.

Zeroing memset() in opiechallenge() really is not needed because it is the
very first thing immediately following opielookup() does being entered, i.e.
look at this:

int opielookup FUNCTION((opie, principal), struct opie *opie AND char
*principal
)
{
int i;

memset(opie, 0, sizeof(struct opie));
...

Add heuristic to detect SSH connection (in the same style as other
heuristics already here which not supposed to be secure, just helpers).

Approved by: security@ silence

Fix SHA1 hashing.

Allow applications to disable the installation of the atexit() handler
which cleans up OPIE lockfiles. This is required for pam_opie.

Submitted by: Jim Bloom <bloom@acm.org>

Resolve conflicts

This commit was generated by cvs2svn to compensate for changes in r59118,
which included commits to RCS files with non-trunk default branches.

Fixed printf format errors.

Merge

This commit was generated by cvs2svn to compensate for changes in r29964,
which included commits to RCS files with non-trunk default branches.

Detect null secret as error, it is temp. fix until next release
Submitted by: Craig Metz <cmetz@inner.net>

Disconnect OPIE from internal MD4/5 routines

This commit was generated by cvs2svn to compensate for changes in r22347,
which included commits to RCS files with non-trunk default branches.