summaryrefslogtreecommitdiff
path: root/security/openssl
AgeCommit message (Collapse)AuthorFilesLines
2004-08-05Convert to use bsd.options.mk.jlam1-2/+4
2004-08-05Document the "rsaref" build option.jlam1-1/+5
2004-07-30Convert to use bsd.options.mk. The relevant options variable to setjlam1-2/+15
for each package can be determined by invoking: make show-var VARNAME=PKG_OPTIONS_VAR The old options are still supported unless the variable named in PKG_OPTIONS_VAR is set within make(1) (usually via /etc/mk.conf).
2004-07-06Unused.wiz1-178/+0
2004-04-25Make compile on Interix. No-op change for other platforms, so no PKGREVISIONtv4-13/+36
bump. (Main MI change: -soname -> -h, as some GNU ld(1) wants --soname instead of -soname, but -h works on all GNU ld(1) versions.)
2004-04-07If the native OpenSSL contains the security fixes pulled up to thetron1-6/+6
netbsd-1-6 branch on 2004-04-01, then pretend it's openssl-0.9.6m.
2004-04-02Grammar fix.wiz1-3/+3
2004-04-02If the native OpenSSL contains the security fixes pulled up to thejlam1-9/+19
netbsd-1-6 branch on 2004-04-01, then pretend it's openssl-0.9.6m.
2004-03-29Fix build on NetBSD sparc64 with perl 5.8.seb2-1/+24
usage of perl's int() causes trouble with perl 5.8.3 (5.8*?) on at least NetBSD sparc64/1.6.2. The perl script openssl-0.9.6m/crypto/bn/bn_prime.pl uses the perl function int() to truncate the return of sqrt() function. On the above mentioned platform this leads to execution error: ... /usr/pkg/bin/perl bn_prime.pl >bn_prime.h Illegal modulus zero at bn_prime.pl line 16. Tracing the problem I've found that this int() usage may be the key of the problem. Please note the following: $ uname -srm; perl -v | grep 'This is perl'; perl -e 'print int(sqrt(3)),"\n"' NetBSD 1.6.2 sparc64 This is perl, v5.8.3 built for sparc64-netbsd 2 And... $ uname -srm; perl -v | grep 'This is perl'; perl -e 'print int(sqrt(3)),"\n"' NetBSD 1.6.2 sparc64 This is perl, v5.6.1 built for sparc64-netbsd 1 Also note that perlfunc(3) warns about int() used for rounding and recommends to use sprintf, printf, POSIX::floor or POSIX::ceil when applicable. My workaround is to use POSIX::floor() instead of int().
2004-03-26Consolidate all of the PLIST.* files that duplicated each other into ajlam7-38/+10
single file PLIST.shlib. Only have PLIST.${LOWER_OPSYS} if it differs from PLIST.shlib.
2004-03-26Don't rebuild openssl again as part of installing it.jlam2-5/+10
2004-03-26Allow the rehash of the certs database to not error out during the buildjlam3-14/+23
due to libssl.so.300 not being found by correctly setting LD_LIBRARY_PATH.
2004-03-26We can't use ${PKGBASE} on the left-hand side of an assignment since it'sjlam1-2/+2
not defined yet until bsd.pkg.mk. Explicitly use "openssl" instead. This correctly forces NetBSD installations of openssl to use /etc/openssl as the configuration file directory as originally intended.
2004-03-26Add some mirror sites since the main OpenSSL site seems to be dead at thejlam1-2/+7
moment.
2004-03-26Update to 0.9.6m:wiz9-39/+38
Changes between 0.9.6l and 0.9.6m [17 Mar 2004] *) Fix null-pointer assignment in do_change_cipher_spec() revealed by using the Codenomicon TLS Test Tool (CAN-2004-0079) [Joe Orton, Steve Henson]
2004-03-18Fix serious bug where BUILDLINK_PACKAGES wasn't being ordered properlyjlam1-3/+2
by moving the inclusion of buildlink3.mk files outside of the protected region. This bug would be seen by users that have set PREFER_PKGSRC or PREFER_NATIVE to non-default values. BUILDLINK_PACKAGES should be ordered so that for any package in the list, that package doesn't depend on any packages to the left of it in the list. This ordering property is used to check for builtin packages in the correct order. The problem was that including a buildlink3.mk file for <pkg> correctly ensured that <pkg> was removed from BUILDLINK_PACKAGES and appended to the end. However, since the inclusion of any other buildlink3.mk files within that buildlink3.mk was in a region that was protected against multiple inclusion, those dependencies weren't also moved to the end of BUILDLINK_PACKAGES.
2004-03-10Split out the code that deals with checking whether the software isjlam2-175/+146
built-in or not into a separate builtin.mk file. The code to deal checking for built-in software is much simpler to deal with in pkgsrc. The buildlink3.mk file for a package will be of the usual format regardless of the package, which makes it simpler for packagers to update a package. The builtin.mk file for a package must define a single yes/no variable USE_BUILTIN.<pkg> that is used by bsd.buildlink3.mk to decide whether to use the built-in software or to use the pkgsrc software.
2004-03-09Don't build and install openssl with IDEA, MDC2, or RC5 support.reed2-8/+5
According to README, "RSA Security holds software patents on the RC5 algorithm. If you intend to use this cipher, you must contact RSA Security for licensing conditions." And "The IDEA algorithm is patented by Ascom ... They should be contacted if that algorithm is to be used." The openssl FAQ says "For patent reasons, support for IDEA, RC5 and MDC2 is disabled in this [Red Hat Linux] version." The FAQ lists patent numbers and expiry dates of US patents: MDC-2: 4,908,861 13/03/2007 IDEA: 5,214,703 25/05/2010 RC5: 5,724,428 03/03/2015 Now fee-based-commercial-use ACCEPTABLE_LICENSES is not needed.
2004-02-29include mk/compiler.mk before testing ${CC}grant1-1/+2
2004-02-18Reorder some lines so that BUILDLINK_USE_BUILTIN.<pkg> set in thejlam1-16/+18
environment overrides all other settings.
2004-02-17Don't use sysctl to determine the machine arch when ${MACHINE_ARCH} alreadyjlam3-5/+6
has the correct value. Fixes build on NetBSD-1.5.3/sparc, which doesn't understand "sysctl hw.machine_arch", reported in PR 24448.
2004-02-12s/_BUILTIN_OPENSSL/BUILDLINK_IS_BUILTIN.openssl/gjlam1-3/+3
2004-02-12Create a new variable PREFER_NATIVE that has the opposite semanticsjlam2-6/+26
as PREFER_PKGSRC. Preferences are determined by the most specific instance of the package in either PREFER_PKGSRC or PREFER_NATIVE. If a package is specified in neither or in both variables, then PREFER_PKGSRC has precedence over PREFER_NATIVE.
2004-02-12Reorganize code so that any dependencies are checked as part of decidingjlam2-48/+48
whether the software is built-in or not. This facilitates implementing the forthcoming PKGSRC_NATIVE variable.
2004-02-06If we're passing through MAKEFLAGS variables whose values may containjlam2-6/+6
spaces, use the :Q modifier instead of double-quoting the value. This avoids breakage when executing the just-in-time su targets.
2004-02-05Make PREFER_PKGSRC just yes/no or a list of packages. This makes itjlam2-10/+6
simpler to understand.
2004-02-05Rename BUILDLINK_PREFER_PKGSRC to PREFER_PKGSRC so that we can use itsjlam2-10/+8
value outside of buildlink-related files.
2004-02-05Support a new global variable:jlam2-2/+18
BUILDLINK_PREFER_PKGSRC This variable determines whether or not to prefer the pkgsrc versions of software that is also present in the base system. This variable is multi-state: defined, or "yes" always prefer the pkgsrc versions not defined, or "no" only use the pkgsrc versions if needed by dependency requirements This can also take a list of packages for which to prefer the pkgsrc-installed software. The package names may be found by consulting the value added to BUILDLINK_PACKAGES in the buildlink[23].mk files for that package.
2004-01-30Ensure that -lcrypt appears before -lcrypto on the command line so thatjlam1-1/+7
the system crypt(), which is considerably smarter than the OpenSSL crypt(), is used.
2004-01-24Support BUILDLINK_DEPENDS.<pkg> being a list of values.jlam1-5/+14
2004-01-21Only point SSLCERTS into ${PKG_SYSCONFDIR} if we're not using the built-injlam2-2/+6
OpenSSL software. Otherwise, set it to /etc/ssl/certs, which is where a lot of Linux distros store certs. The behaviour on NetBSD systems is unchanged -- always set to /etc/openssl/certs. Fixes PR 24161.
2004-01-07From the log for rev. 1.1260 of bsd.pkg.mk:jlam2-4/+4
"Package Makefiles should refer to PKG_SYSCONFBASEDIR instead of PKG_SYSCONFBASE when they want PKG_SYSCONFDIR stripped of PKG_SYSCONFSUBDIR. This makes PKG_SYSCONFBASE=/etc work with pkgviews by installing all config files into /etc/packages/<pkg> instead of occasionally putting some directly into /etc."
2004-01-05bl3ifyjlam1-5/+6
2004-01-05Use S/+$// instead of C/\+$// to save a backslash. Very highlyjlam1-2/+2
recommended by seb :)
2004-01-05Sow BUILDLINK_USE_BUILTIN.<pkg> and reap _NEED_<PKG> variables.jlam1-17/+19
2004-01-04Re-arrange to match example buildlink3.mk file in bsd.buildlink3.mk.jlam1-4/+4
2004-01-03Initial sprinkling of work-in-progress buildlink3.mk files for using thejlam1-0/+161
buildlink3 framework.
2003-12-03Add an empty plist for AIX.erh1-0/+1
2003-12-03The PLIST.linux was empty, but should be registering thereed1-1/+7
libssl.so* and libcrypto.so* files. So added this.
2003-11-27Fix OpenSSL version number parsing. Patch from PR 23532 by Michael vanjlam1-10/+24
Elst with style modifications by me.
2003-11-25If the built-in OpenSSL software is 0.9.6g, then check whether itjlam1-2/+18
contains the 0.9.6g -> 0.9.6l security fixes pulled up to netbsd-1-6 on 2003-11-07 by checking for the presence of the preprocessor symbol OPENSSL_HAS_20031107_FIX. If it does, then allow the built-in OpenSSL to satisfy dependencies for openssl>=0.9.6l.
2003-11-19textproc/glimpse and security/openssl no longer conflict, as openssljschauma1-2/+2
does no longer install bin/cast. Noted by Bernhard Riedel.
2003-11-19OpenSSL has not had base64 for a while now, so these two no longer needjschauma1-3/+2
to conflict. Noted by Bernhard Riedel.
2003-11-17Remove OPENSSL_HAS_*FIX code; corresponding check was removed inwiz1-9/+1
previous commit to this file. Noted superfluous by Todd Vierling.
2003-11-12Depend on latest openssl package (hi jan!).wiz1-16/+4
Remove some obsolete code. Fix rsaref reference, we do not want to include a buildlink3.mk here.
2003-11-12Update to openssl-0.9.6l:jschauma2-7/+5
*) Fix additional bug revealed by the NISCC test suite: Stop bug triggering large recursion when presented with certain ASN.1 tags (CAN-2003-0851) [Steve Henson]
2003-10-21Let the Configure script handle NetBSD-arm too.kristerw2-7/+8
2003-10-04Add support for BSD/OS.reed1-0/+7
2003-10-02Update to 0.9.6k:jschauma13-269/+52
Changes between 0.9.6j and 0.9.6k [30 Sep 2003] *) Fix various bugs revealed by running the NISCC test suite: Stop out of bounds reads in the ASN1 code when presented with invalid tags (CAN-2003-0543 and CAN-2003-0544). If verify callback ignores invalid public key errors don't try to check certificate signature with the NULL public key. [Steve Henson] *) In ssl3_accept() (ssl/s3_srvr.c) only accept a client certificate if the server requested one: as stated in TLS 1.0 and SSL 3.0 specifications. [Steve Henson] *) In ssl3_get_client_hello() (ssl/s3_srvr.c), tolerate additional extra data after the compression methods not only for TLS 1.0 but also for SSL 3.0 (as required by the specification). [Bodo Moeller; problem pointed out by Matthias Loepfe] *) Change X509_certificate_type() to mark the key as exported/exportable when it's 512 *bits* long, not 512 bytes. [Richard Levitte] Changes between 0.9.6i and 0.9.6j [10 Apr 2003] *) Countermeasure against the Klima-Pokorny-Rosa extension of Bleichbacher's attack on PKCS #1 v1.5 padding: treat a protocol version number mismatch like a decryption error in ssl3_get_client_key_exchange (ssl/s3_srvr.c). [Bodo Moeller] *) Turn on RSA blinding by default in the default implementation to avoid a timing attack. Applications that don't want it can call RSA_blinding_off() or use the new flag RSA_FLAG_NO_BLINDING. They would be ill-advised to do so in most cases. [Ben Laurie, Steve Henson, Geoff Thorpe, Bodo Moeller] *) Change RSA blinding code so that it works when the PRNG is not seeded (in this case, the secret RSA exponent is abused as an unpredictable seed -- if it is not unpredictable, there is no point in blinding anyway). Make RSA blinding thread-safe by remembering the creator's thread ID in rsa->blinding and having all other threads use local one-time blinding factors (this requires more computation than sharing rsa->blinding, but avoids excessive locking; and if an RSA object is not shared between threads, blinding will still be very fast). [Bodo Moeller] Changes between 0.9.6h and 0.9.6i [19 Feb 2003] *) In ssl3_get_record (ssl/s3_pkt.c), minimize information leaked via timing by performing a MAC computation even if incorrrect block cipher padding has been found. This is a countermeasure against active attacks where the attacker has to distinguish between bad padding and a MAC verification error. (CAN-2003-0078) [Bodo Moeller; problem pointed out by Brice Canvel (EPFL), Alain Hiltgen (UBS), Serge Vaudenay (EPFL), and Martin Vuagnoux (EPFL, Ilion)] Changes between 0.9.6g and 0.9.6h [5 Dec 2002] *) New function OPENSSL_cleanse(), which is used to cleanse a section of memory from it's contents. This is done with a counter that will place alternating values in each byte. This can be used to solve two issues: 1) the removal of calls to memset() by highly optimizing compilers, and 2) cleansing with other values than 0, since those can be read through on certain media, for example a swap space on disk. [Geoff Thorpe] *) Bugfix: client side session caching did not work with external caching, because the session->cipher setting was not restored when reloading from the external cache. This problem was masked, when SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG (part of SSL_OP_ALL) was set. (Found by Steve Haslam <steve@araqnid.ddts.net>.) [Lutz Jaenicke] *) Fix client_certificate (ssl/s2_clnt.c): The permissible total length of the REQUEST-CERTIFICATE message is 18 .. 34, not 17 .. 33. [Zeev Lieber <zeev-l@yahoo.com>] *) Undo an undocumented change introduced in 0.9.6e which caused repeated calls to OpenSSL_add_all_ciphers() and OpenSSL_add_all_digests() to be ignored, even after calling EVP_cleanup(). [Richard Levitte] *) Change the default configuration reader to deal with last line not being properly terminated. [Richard Levitte] *) Change X509_NAME_cmp() so it applies the special rules on handling DN values that are of type PrintableString, as well as RDNs of type emailAddress where the value has the type ia5String. [stefank@valicert.com via Richard Levitte] *) Add a SSL_SESS_CACHE_NO_INTERNAL_STORE flag to take over half the job SSL_SESS_CACHE_NO_INTERNAL_LOOKUP was inconsistently doing, define a new flag (SSL_SESS_CACHE_NO_INTERNAL) to be the bitwise-OR of the two for use by the majority of applications wanting this behaviour, and update the docs. The documented behaviour and actual behaviour were inconsistent and had been changing anyway, so this is more a bug-fix than a behavioural change. [Geoff Thorpe, diagnosed by Nadav Har'El] *) Don't impose a 16-byte length minimum on session IDs in ssl/s3_clnt.c (the SSL 3.0 and TLS 1.0 specifications allow any length up to 32 bytes). [Bodo Moeller] *) Fix initialization code race conditions in SSLv23_method(), SSLv23_client_method(), SSLv23_server_method(), SSLv2_method(), SSLv2_client_method(), SSLv2_server_method(), SSLv3_method(), SSLv3_client_method(), SSLv3_server_method(), TLSv1_method(), TLSv1_client_method(), TLSv1_server_method(), ssl2_get_cipher_by_char(), ssl3_get_cipher_by_char(). [Patrick McCormick <patrick@tellme.com>, Bodo Moeller] *) Reorder cleanup sequence in SSL_CTX_free(): only remove the ex_data after the cached sessions are flushed, as the remove_cb() might use ex_data contents. Bug found by Sam Varshavchik <mrsam@courier-mta.com> (see [openssl.org #212]). [Geoff Thorpe, Lutz Jaenicke] *) Fix typo in OBJ_txt2obj which incorrectly passed the content length, instead of the encoding length to d2i_ASN1_OBJECT. [Steve Henson]
2003-09-22style nitsgrant1-3/+2
generated by cgit v1.2.3 (git 2.39.1) at 2024-10-16 20:46:35 +0000