summaryrefslogtreecommitdiff
path: root/security/openssl
AgeCommit message (Collapse)AuthorFilesLines
2004-02-17Don't use sysctl to determine the machine arch when ${MACHINE_ARCH} alreadyjlam3-5/+6
has the correct value. Fixes build on NetBSD-1.5.3/sparc, which doesn't understand "sysctl hw.machine_arch", reported in PR 24448.
2004-02-12s/_BUILTIN_OPENSSL/BUILDLINK_IS_BUILTIN.openssl/gjlam1-3/+3
2004-02-12Create a new variable PREFER_NATIVE that has the opposite semanticsjlam2-6/+26
as PREFER_PKGSRC. Preferences are determined by the most specific instance of the package in either PREFER_PKGSRC or PREFER_NATIVE. If a package is specified in neither or in both variables, then PREFER_PKGSRC has precedence over PREFER_NATIVE.
2004-02-12Reorganize code so that any dependencies are checked as part of decidingjlam2-48/+48
whether the software is built-in or not. This facilitates implementing the forthcoming PKGSRC_NATIVE variable.
2004-02-06If we're passing through MAKEFLAGS variables whose values may containjlam2-6/+6
spaces, use the :Q modifier instead of double-quoting the value. This avoids breakage when executing the just-in-time su targets.
2004-02-05Make PREFER_PKGSRC just yes/no or a list of packages. This makes itjlam2-10/+6
simpler to understand.
2004-02-05Rename BUILDLINK_PREFER_PKGSRC to PREFER_PKGSRC so that we can use itsjlam2-10/+8
value outside of buildlink-related files.
2004-02-05Support a new global variable:jlam2-2/+18
BUILDLINK_PREFER_PKGSRC This variable determines whether or not to prefer the pkgsrc versions of software that is also present in the base system. This variable is multi-state: defined, or "yes" always prefer the pkgsrc versions not defined, or "no" only use the pkgsrc versions if needed by dependency requirements This can also take a list of packages for which to prefer the pkgsrc-installed software. The package names may be found by consulting the value added to BUILDLINK_PACKAGES in the buildlink[23].mk files for that package.
2004-01-30Ensure that -lcrypt appears before -lcrypto on the command line so thatjlam1-1/+7
the system crypt(), which is considerably smarter than the OpenSSL crypt(), is used.
2004-01-24Support BUILDLINK_DEPENDS.<pkg> being a list of values.jlam1-5/+14
2004-01-21Only point SSLCERTS into ${PKG_SYSCONFDIR} if we're not using the built-injlam2-2/+6
OpenSSL software. Otherwise, set it to /etc/ssl/certs, which is where a lot of Linux distros store certs. The behaviour on NetBSD systems is unchanged -- always set to /etc/openssl/certs. Fixes PR 24161.
2004-01-07From the log for rev. 1.1260 of bsd.pkg.mk:jlam2-4/+4
"Package Makefiles should refer to PKG_SYSCONFBASEDIR instead of PKG_SYSCONFBASE when they want PKG_SYSCONFDIR stripped of PKG_SYSCONFSUBDIR. This makes PKG_SYSCONFBASE=/etc work with pkgviews by installing all config files into /etc/packages/<pkg> instead of occasionally putting some directly into /etc."
2004-01-05bl3ifyjlam1-5/+6
2004-01-05Use S/+$// instead of C/\+$// to save a backslash. Very highlyjlam1-2/+2
recommended by seb :)
2004-01-05Sow BUILDLINK_USE_BUILTIN.<pkg> and reap _NEED_<PKG> variables.jlam1-17/+19
2004-01-04Re-arrange to match example buildlink3.mk file in bsd.buildlink3.mk.jlam1-4/+4
2004-01-03Initial sprinkling of work-in-progress buildlink3.mk files for using thejlam1-0/+161
buildlink3 framework.
2003-12-03Add an empty plist for AIX.erh1-0/+1
2003-12-03The PLIST.linux was empty, but should be registering thereed1-1/+7
libssl.so* and libcrypto.so* files. So added this.
2003-11-27Fix OpenSSL version number parsing. Patch from PR 23532 by Michael vanjlam1-10/+24
Elst with style modifications by me.
2003-11-25If the built-in OpenSSL software is 0.9.6g, then check whether itjlam1-2/+18
contains the 0.9.6g -> 0.9.6l security fixes pulled up to netbsd-1-6 on 2003-11-07 by checking for the presence of the preprocessor symbol OPENSSL_HAS_20031107_FIX. If it does, then allow the built-in OpenSSL to satisfy dependencies for openssl>=0.9.6l.
2003-11-19textproc/glimpse and security/openssl no longer conflict, as openssljschauma1-2/+2
does no longer install bin/cast. Noted by Bernhard Riedel.
2003-11-19OpenSSL has not had base64 for a while now, so these two no longer needjschauma1-3/+2
to conflict. Noted by Bernhard Riedel.
2003-11-17Remove OPENSSL_HAS_*FIX code; corresponding check was removed inwiz1-9/+1
previous commit to this file. Noted superfluous by Todd Vierling.
2003-11-12Depend on latest openssl package (hi jan!).wiz1-16/+4
Remove some obsolete code. Fix rsaref reference, we do not want to include a buildlink3.mk here.
2003-11-12Update to openssl-0.9.6l:jschauma2-7/+5
*) Fix additional bug revealed by the NISCC test suite: Stop bug triggering large recursion when presented with certain ASN.1 tags (CAN-2003-0851) [Steve Henson]
2003-10-21Let the Configure script handle NetBSD-arm too.kristerw2-7/+8
2003-10-04Add support for BSD/OS.reed1-0/+7
2003-10-02Update to 0.9.6k:jschauma13-269/+52
Changes between 0.9.6j and 0.9.6k [30 Sep 2003] *) Fix various bugs revealed by running the NISCC test suite: Stop out of bounds reads in the ASN1 code when presented with invalid tags (CAN-2003-0543 and CAN-2003-0544). If verify callback ignores invalid public key errors don't try to check certificate signature with the NULL public key. [Steve Henson] *) In ssl3_accept() (ssl/s3_srvr.c) only accept a client certificate if the server requested one: as stated in TLS 1.0 and SSL 3.0 specifications. [Steve Henson] *) In ssl3_get_client_hello() (ssl/s3_srvr.c), tolerate additional extra data after the compression methods not only for TLS 1.0 but also for SSL 3.0 (as required by the specification). [Bodo Moeller; problem pointed out by Matthias Loepfe] *) Change X509_certificate_type() to mark the key as exported/exportable when it's 512 *bits* long, not 512 bytes. [Richard Levitte] Changes between 0.9.6i and 0.9.6j [10 Apr 2003] *) Countermeasure against the Klima-Pokorny-Rosa extension of Bleichbacher's attack on PKCS #1 v1.5 padding: treat a protocol version number mismatch like a decryption error in ssl3_get_client_key_exchange (ssl/s3_srvr.c). [Bodo Moeller] *) Turn on RSA blinding by default in the default implementation to avoid a timing attack. Applications that don't want it can call RSA_blinding_off() or use the new flag RSA_FLAG_NO_BLINDING. They would be ill-advised to do so in most cases. [Ben Laurie, Steve Henson, Geoff Thorpe, Bodo Moeller] *) Change RSA blinding code so that it works when the PRNG is not seeded (in this case, the secret RSA exponent is abused as an unpredictable seed -- if it is not unpredictable, there is no point in blinding anyway). Make RSA blinding thread-safe by remembering the creator's thread ID in rsa->blinding and having all other threads use local one-time blinding factors (this requires more computation than sharing rsa->blinding, but avoids excessive locking; and if an RSA object is not shared between threads, blinding will still be very fast). [Bodo Moeller] Changes between 0.9.6h and 0.9.6i [19 Feb 2003] *) In ssl3_get_record (ssl/s3_pkt.c), minimize information leaked via timing by performing a MAC computation even if incorrrect block cipher padding has been found. This is a countermeasure against active attacks where the attacker has to distinguish between bad padding and a MAC verification error. (CAN-2003-0078) [Bodo Moeller; problem pointed out by Brice Canvel (EPFL), Alain Hiltgen (UBS), Serge Vaudenay (EPFL), and Martin Vuagnoux (EPFL, Ilion)] Changes between 0.9.6g and 0.9.6h [5 Dec 2002] *) New function OPENSSL_cleanse(), which is used to cleanse a section of memory from it's contents. This is done with a counter that will place alternating values in each byte. This can be used to solve two issues: 1) the removal of calls to memset() by highly optimizing compilers, and 2) cleansing with other values than 0, since those can be read through on certain media, for example a swap space on disk. [Geoff Thorpe] *) Bugfix: client side session caching did not work with external caching, because the session->cipher setting was not restored when reloading from the external cache. This problem was masked, when SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG (part of SSL_OP_ALL) was set. (Found by Steve Haslam <steve@araqnid.ddts.net>.) [Lutz Jaenicke] *) Fix client_certificate (ssl/s2_clnt.c): The permissible total length of the REQUEST-CERTIFICATE message is 18 .. 34, not 17 .. 33. [Zeev Lieber <zeev-l@yahoo.com>] *) Undo an undocumented change introduced in 0.9.6e which caused repeated calls to OpenSSL_add_all_ciphers() and OpenSSL_add_all_digests() to be ignored, even after calling EVP_cleanup(). [Richard Levitte] *) Change the default configuration reader to deal with last line not being properly terminated. [Richard Levitte] *) Change X509_NAME_cmp() so it applies the special rules on handling DN values that are of type PrintableString, as well as RDNs of type emailAddress where the value has the type ia5String. [stefank@valicert.com via Richard Levitte] *) Add a SSL_SESS_CACHE_NO_INTERNAL_STORE flag to take over half the job SSL_SESS_CACHE_NO_INTERNAL_LOOKUP was inconsistently doing, define a new flag (SSL_SESS_CACHE_NO_INTERNAL) to be the bitwise-OR of the two for use by the majority of applications wanting this behaviour, and update the docs. The documented behaviour and actual behaviour were inconsistent and had been changing anyway, so this is more a bug-fix than a behavioural change. [Geoff Thorpe, diagnosed by Nadav Har'El] *) Don't impose a 16-byte length minimum on session IDs in ssl/s3_clnt.c (the SSL 3.0 and TLS 1.0 specifications allow any length up to 32 bytes). [Bodo Moeller] *) Fix initialization code race conditions in SSLv23_method(), SSLv23_client_method(), SSLv23_server_method(), SSLv2_method(), SSLv2_client_method(), SSLv2_server_method(), SSLv3_method(), SSLv3_client_method(), SSLv3_server_method(), TLSv1_method(), TLSv1_client_method(), TLSv1_server_method(), ssl2_get_cipher_by_char(), ssl3_get_cipher_by_char(). [Patrick McCormick <patrick@tellme.com>, Bodo Moeller] *) Reorder cleanup sequence in SSL_CTX_free(): only remove the ex_data after the cached sessions are flushed, as the remove_cb() might use ex_data contents. Bug found by Sam Varshavchik <mrsam@courier-mta.com> (see [openssl.org #212]). [Geoff Thorpe, Lutz Jaenicke] *) Fix typo in OBJ_txt2obj which incorrectly passed the content length, instead of the encoding length to d2i_ASN1_OBJECT. [Steve Henson]
2003-09-22style nitsgrant1-3/+2
2003-09-22formatting nitsgrant1-4/+5
2003-09-11Rewrite this file so that we can specify the version of OpenSSL that wejlam1-94/+112
need by simply setting BUILDLINK_DEPENDS.openssl. This buildlink2.mk file now functions just like any other typical buildlink2.mk file.
2003-09-10Note version numbers for 0.9.6[hij].jlam1-1/+4
2003-09-10Only check if we need to add the rsaref dependency if we need the pkgsrcjlam1-3/+5
openssl.
2003-09-10Use the built-in HAS_CONFIGURE and TEST_TARGET infrastructure to do thejlam1-44/+37
configure and test phases.
2003-09-10Honor CFLAGS/LDFLAGS from the environment.jlam3-7/+18
2003-09-10Back out the make -> @MAKE@ -> ${MAKE} changes since we workaround thejlam8-86/+12
bare "make" problem using tools.mk.
2003-08-25Several of the Makefile used in this package call 'make' directly. Ifjschauma8-25/+102
an operating system does not have a 'make' (ie only bmake), or if the OS supplied 'make' is sufficiently broken (Irix), this will cause the build to fail (interestingly enough apparently only if build as a dependency, not if build from this directory). Patch Makefiles to use @MAKE@, which then, after patching, is substituted with the actual ${MAKE} (can't use "MAKE= ${MAKE} -f Makefile.ssl"). While here, tweak Irix configure a bit.
2003-08-04If 0.9.7a or 0.9.7b are required and not otherwise installed on the systemjmc1-1/+15
set PKG_SKIP_REASON and move on. The package only supports to 0.9.6g currently otherwise.
2003-07-29add openssl 0.9.7a, as found in Slackware Linux 9.grant1-1/+9
XXX there really must be a better way to (not have to) do this.
2003-07-24Add support for OpenSSL 0.9.7b shipped with NetBSD-current.tron1-1/+9
2003-07-22Remove fallout from ruby-openssl mis-reimport.wiz1-11/+0
2003-07-22Re-import security/ruby-openssl 0.1.4.1.taca2-10/+12
2003-07-17s/netbsd.org/NetBSD.org/grant1-2/+2
2003-07-12don't define test target directly, use do-test insteaddillo1-2/+2
2003-07-02style nits, join two .if's.grant1-8/+6
2003-07-02more brutally attack the CONFIGURE_ARGS target issue on Solaris.grant1-2/+6
force gcc if *gcc* - Sun's compiler is never going to be installed into a path with 'gcc' in it(!)
2003-06-27Make this work on IRIX64.jschauma1-1/+6
2003-06-10Rename PLIST.irix6 to PLIST.irix to match the others and set thejschauma2-3/+3
PLIST_SRC accordingly after we recently set LOWER_OPSYS on IRIX to what most applications seem to expect (ie irix6.5 rather than irix6).
2003-06-02Use tech-pkg@ in favor of packages@ as MAINTAINER for orphaned packages.jschauma1-2/+2
Should anybody feel like they could be the maintainer for any of thewe packages, please adjust.
generated by cgit v1.2.3 (git 2.39.1) at 2024-12-28 23:10:40 +0000