summaryrefslogtreecommitdiff
path: root/security
AgeCommit message (Collapse)AuthorFilesLines
2003-10-21Let the Configure script handle NetBSD-arm too.kristerw2-7/+8
2003-10-18Add RCS IDscjep2-0/+2
2003-10-18Use ${TOUCH} rather than touchcjep1-2/+2
2003-10-18Update audit-packages to 1.25.agc3-21/+120
+ get rid of unnecessary awk invocation in audit-packages, use shell construction instead, pointed out by enami tsugutomo. Cuts system and user execution times for audit-packages in half. + add (4-clause) licences to audit-packages and download-vulnerability-list + check integrity of pkg-vulnerabilities file in audit-packages by using the same construct as in download-vulnerability-list + CSE in error checking in audit-packages + properly terminate a case expression in download-vulnerability-list
2003-10-18Make this package use the libtasn library that comes with it, instead of ourjmmv2-5/+10
own security/libtasn1 package, which is too new to work fine with gnutls. While here, add missing dependency on devel/zlib. Fixes PR pkg/23172; reviewed by wiz@. Bump PKGREVISION to 1.
2003-10-17Update audit-packages to 1.24:agc2-4/+4
Simplify quoting syntax in the awk command, so that gawk-3.1.3 (as found in NetBSD-current) doesn't have a problem with a malformed escape sequence. With thanks to Johnny Lam for testing with an older version of gawk.
2003-10-14Changed SVR4_PKGNAME (p5sh2 already used by p5-Digest-SHA)heinz1-2/+2
2003-10-13Obsoleted in 20030903 (and also distinfo-orphaned); this is now fixedkleink1-11/+0
correctly in the stock distribution.
2003-10-12set LD=CC again for all platforms with an appropriate comment - Igrant1-9/+11
don't know why this didn't originally work as it should, but I've just tested it with gcc3 and Forte 8 on Solaris and I couldn't make it fail. fixes coredump problem on Solaris observed by some, and also PR pkg/23120 from Alex Gerasimoff. bump PKGREVISION to differentiate between broken and unbroken package.
2003-10-12add a missing .elif OPSYS == NetBSD, which was resulting in passinggrant1-1/+2
"--with-skey=... --without-skey" on Solaris :)
2003-10-11bump PKGREVISIONs after bump of expat BUILDLINK_DEPENDS.grant1-1/+2
2003-10-11comment block which uses non-existant variable (because we don't needgrant2-16/+19
the supplied db2). fixes PR pkg/22912 from Jonathan Perkin.
2003-10-11require GNU sed for GNU sed specific expressions.grant1-1/+3
fixes PR pkg/21493.
2003-10-10Update to isakmpd version 20030903.agc10-152/+120
No changelog available, but many bugs fixed, and these sources will compile with gcc-3.3.1 (well, after I tweaked them). With thanks to Christoph Badura for most of this work, I merely did the gcc-3.3.1 patching.
2003-10-10Bump PKGREVISION since libnids update.cube2-2/+4
2003-10-10Buildlinkify and remove hard-coded dependency on libnids-1.14.cube2-14/+10
2003-10-08Improve message (because on some systems it is okay to install to thereed1-2/+2
PAM directory too).
2003-10-07Use pkgsrc defined version of install path, fixes install on SunOS.rtr2-1/+12
From Jonathan Perkin <jonathan@perkin.org.uk> pr pkg/22911
2003-10-06Bump revision.christos1-1/+2
2003-10-06regenchristos1-2/+2
2003-10-06Fix uninitialized variable that caused core-dumps.christos1-3/+13
2003-10-06Only create one directory per invocation of install(1), and run the Crackjlam3-16/+22
script with ${SH} instead of /bin/sh since some OSes have dumb /bin/sh, e.g. Solaris. From pkg/22914 by Jonathan Perkin.
2003-10-06Sniff needs to depend on the libpcap package on non-NetBSD systems, sojlam3-8/+22
convert to use buildlink2 and include libpcap/buildlink2.mk to handle this correctly. Also fix network library problems on Solaris. From pkg/22915 by Jonathan Perkin.
2003-10-05Add BUILD_DEFS line for USE_PAM and SASL_USE_GSSAPI.chris1-1/+3
2003-10-051) Solaris (and others) require libpcap from pkgsrc. Use buildlink2recht3-3/+35
2) Fix the SunOS makefile, which isn't complete. Tidy up while here. 3) Re-order COMMENT/HOMEPAGE to appease pkglint. provided by Jonathan Perkin in PR 22916.
2003-10-04Add support for BSD/OS.reed1-0/+7
2003-10-03Some xargs (Hi Sun) run the command even when stdin is "empty". Compareseb1-2/+2
'echo | xargs echo' on NetBSD and Solaris... Workaround this in post-extract target's 'rm' by adding a '-f' argument to it. XXX Current upstream tarball does not have .orig files, I could have removed this post-extract target...
2003-10-02Work around non-termination of the build when using Solaris sed.gavan1-1/+3
2003-10-02Added support for FreeBSDmartti3-2/+209
2003-10-02Update to 0.9.6k:jschauma13-269/+52
Changes between 0.9.6j and 0.9.6k [30 Sep 2003] *) Fix various bugs revealed by running the NISCC test suite: Stop out of bounds reads in the ASN1 code when presented with invalid tags (CAN-2003-0543 and CAN-2003-0544). If verify callback ignores invalid public key errors don't try to check certificate signature with the NULL public key. [Steve Henson] *) In ssl3_accept() (ssl/s3_srvr.c) only accept a client certificate if the server requested one: as stated in TLS 1.0 and SSL 3.0 specifications. [Steve Henson] *) In ssl3_get_client_hello() (ssl/s3_srvr.c), tolerate additional extra data after the compression methods not only for TLS 1.0 but also for SSL 3.0 (as required by the specification). [Bodo Moeller; problem pointed out by Matthias Loepfe] *) Change X509_certificate_type() to mark the key as exported/exportable when it's 512 *bits* long, not 512 bytes. [Richard Levitte] Changes between 0.9.6i and 0.9.6j [10 Apr 2003] *) Countermeasure against the Klima-Pokorny-Rosa extension of Bleichbacher's attack on PKCS #1 v1.5 padding: treat a protocol version number mismatch like a decryption error in ssl3_get_client_key_exchange (ssl/s3_srvr.c). [Bodo Moeller] *) Turn on RSA blinding by default in the default implementation to avoid a timing attack. Applications that don't want it can call RSA_blinding_off() or use the new flag RSA_FLAG_NO_BLINDING. They would be ill-advised to do so in most cases. [Ben Laurie, Steve Henson, Geoff Thorpe, Bodo Moeller] *) Change RSA blinding code so that it works when the PRNG is not seeded (in this case, the secret RSA exponent is abused as an unpredictable seed -- if it is not unpredictable, there is no point in blinding anyway). Make RSA blinding thread-safe by remembering the creator's thread ID in rsa->blinding and having all other threads use local one-time blinding factors (this requires more computation than sharing rsa->blinding, but avoids excessive locking; and if an RSA object is not shared between threads, blinding will still be very fast). [Bodo Moeller] Changes between 0.9.6h and 0.9.6i [19 Feb 2003] *) In ssl3_get_record (ssl/s3_pkt.c), minimize information leaked via timing by performing a MAC computation even if incorrrect block cipher padding has been found. This is a countermeasure against active attacks where the attacker has to distinguish between bad padding and a MAC verification error. (CAN-2003-0078) [Bodo Moeller; problem pointed out by Brice Canvel (EPFL), Alain Hiltgen (UBS), Serge Vaudenay (EPFL), and Martin Vuagnoux (EPFL, Ilion)] Changes between 0.9.6g and 0.9.6h [5 Dec 2002] *) New function OPENSSL_cleanse(), which is used to cleanse a section of memory from it's contents. This is done with a counter that will place alternating values in each byte. This can be used to solve two issues: 1) the removal of calls to memset() by highly optimizing compilers, and 2) cleansing with other values than 0, since those can be read through on certain media, for example a swap space on disk. [Geoff Thorpe] *) Bugfix: client side session caching did not work with external caching, because the session->cipher setting was not restored when reloading from the external cache. This problem was masked, when SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG (part of SSL_OP_ALL) was set. (Found by Steve Haslam <steve@araqnid.ddts.net>.) [Lutz Jaenicke] *) Fix client_certificate (ssl/s2_clnt.c): The permissible total length of the REQUEST-CERTIFICATE message is 18 .. 34, not 17 .. 33. [Zeev Lieber <zeev-l@yahoo.com>] *) Undo an undocumented change introduced in 0.9.6e which caused repeated calls to OpenSSL_add_all_ciphers() and OpenSSL_add_all_digests() to be ignored, even after calling EVP_cleanup(). [Richard Levitte] *) Change the default configuration reader to deal with last line not being properly terminated. [Richard Levitte] *) Change X509_NAME_cmp() so it applies the special rules on handling DN values that are of type PrintableString, as well as RDNs of type emailAddress where the value has the type ia5String. [stefank@valicert.com via Richard Levitte] *) Add a SSL_SESS_CACHE_NO_INTERNAL_STORE flag to take over half the job SSL_SESS_CACHE_NO_INTERNAL_LOOKUP was inconsistently doing, define a new flag (SSL_SESS_CACHE_NO_INTERNAL) to be the bitwise-OR of the two for use by the majority of applications wanting this behaviour, and update the docs. The documented behaviour and actual behaviour were inconsistent and had been changing anyway, so this is more a bug-fix than a behavioural change. [Geoff Thorpe, diagnosed by Nadav Har'El] *) Don't impose a 16-byte length minimum on session IDs in ssl/s3_clnt.c (the SSL 3.0 and TLS 1.0 specifications allow any length up to 32 bytes). [Bodo Moeller] *) Fix initialization code race conditions in SSLv23_method(), SSLv23_client_method(), SSLv23_server_method(), SSLv2_method(), SSLv2_client_method(), SSLv2_server_method(), SSLv3_method(), SSLv3_client_method(), SSLv3_server_method(), TLSv1_method(), TLSv1_client_method(), TLSv1_server_method(), ssl2_get_cipher_by_char(), ssl3_get_cipher_by_char(). [Patrick McCormick <patrick@tellme.com>, Bodo Moeller] *) Reorder cleanup sequence in SSL_CTX_free(): only remove the ex_data after the cached sessions are flushed, as the remove_cb() might use ex_data contents. Bug found by Sam Varshavchik <mrsam@courier-mta.com> (see [openssl.org #212]). [Geoff Thorpe, Lutz Jaenicke] *) Fix typo in OBJ_txt2obj which incorrectly passed the content length, instead of the encoding length to d2i_ASN1_OBJECT. [Steve Henson]
2003-10-01dig DIST_SUBDIR so that we can build newer version without removingitojun2-4/+6
pkgsrc/distrib/p0f.tgz manually
2003-10-01Update to 2.0.2recht5-7/+67
patch provided in PR 22939 by Adrian Portelli Version 2.0.2: -------------- Cleanup of the RST mess in p0fr.fp and p0f.c parser. Added isprint() text preview for -x mode. [BUG] Fixed packet size reporting and matching for packets over 255 bytes (_u8 -> _u16). Extended RST+ACK to also cover plain RST, added some sane explanations of the purpose of each mode. Clarification of the RST vs RST+ACK occurences; test/sendack.c added. Added -R option for RST+ACK fingerprinting. Created an empty database. Moved databases from /etc to /etc/p0f/ Windows memory leak mystery solved. No longer using pcap timeouts for anything. They suck. I first wanted to use SIGALRM with no SA_RESTART, but it's broken on Linux on this particular syscall. Fortunately, I spotted an mis-documented pcap_fileno and can now use select(). I just hope it won't break. Note to self: despite of the documentation saying pcap_open_live with timeout 0 will simply never timeout (which is irrelevant for pcap_loop anyway), it does not work on FreeBSD, inhibiting all packet processing instead. Works fine on Linux. Go figure. Some minor p0fq fixes to prevent warnings. Added some SYN+ACK signatures from rfp (p0fa.fp). Hooray! p0fa.fp is now official. Moved from test/ to ., etc. README updated. [BUG] Fixed the default TTL for IRIX and Tru64 (60), added a note to p0f.fp, fixed TTL checker to also support %30 values. [BUG] Fixed query mode lookup. The old code didn't handle reverse lookups properly. Masquerade scoring data is now available via the query interface. P0fq utility updated to handle this. Dropped /bin/bash from p0frep, /bin/sh would suffice. Added a new -c option for -M and -Q cache size scaling, packet ratio information on Ctrl-C to help estimate the right parameter. Extra masquerade detection flags: -T for threshold, -V for detailed flag breakdown; masquerade reporting now recognizes -r. The new -w option writes all matching packets to a pcap file (regardless of -K and -U settings). Added -M option (unix only until p0f-query.c gets ported). This option enables advanced masquerade detection based on the cyclic buffer used by -Q. Added - signature flag to the config file. Some documentation for the new functionality. [BUG] Cleaned up the -K and -U semantics with -Q. Replaced some single-character printfs with putchars in signature reporting code (should be a tad faster). Added signature check reporting, generic signature count and some other minor tweaks. The new -x option provides a hexadecimal TCP/IP packet dump. Useful when comparing two colliding fingerprints to find some differences not covered by the current quirks set. PPPoE interface is now handled correctly on NetBSD. Added a shoddy manpage and updated makefiles. Removed E quirk and added E to the regular options; removed needless EOL append code from the parser. Breaks the old signature format in some rare cases, but the old quirk is still recognized, and the user will be advised to change it. [BUG] Fixed ? option parsing bug that prevented RISC OS signature from working (and would prevent all ? signatures from working, should there be any other ;-). New signatures and other database additions, of course. [BUG] Fixed a very minor parser bug that could cause it to loop over an unknown option with a declared length of zero. This is not a DoS condition, because the parser would quit the loop after parsing max. 16 options anyway.
2003-09-29Trivial fix for GCC3.mycroft2-1/+15
2003-09-23On non-SunOS, bring backjschauma1-1/+4
LD=${CC}
2003-09-23This version of OpenSSH doesn't need special flags for Irix anymore.jschauma1-4/+1
2003-09-23Update to 3.7.1p2:jschauma4-26/+13
Most important chcanges: security relevant bug fixes in new PAM authentication code Changes since OpenSSH 3.7.1p1: ============================== * This release disables PAM by default. To enable it, set "UsePAM yes" in sshd_config. Due to complexity, inconsistencies in the specification and differences between vendors' PAM implementations we recommend that PAM be left disabled in sshd_config unless there is a need for its use. Sites using only public key or simple password authentication usually have little need to enable PAM support. * This release now requires zlib 1.1.4 to build correctly. Previous versions have security problems. * Fix compilation for versions of OpenSSL before 0.9.6. Some cipher modes are not supported for older OpenSSL versions. * Fix compilation problems on systems with a missing or lacking inet_ntoa() function. * Workaround problems related to unimplemented or broken setresuid/setreuid functions on several platforms. * Fix compilation on older OpenBSD systems. * Fix handling of password-less authentication (PermitEmptyPasswords=yes) that has not worked since the 3.7p1 release.
2003-09-23This needs libpcap. Do not bump revision since the package does not changejmmv1-1/+3
where it already built fine. From Jonathan Perkin in PR pkg/22913.
2003-09-22style nitsgrant1-3/+2
2003-09-22formatting nitsgrant1-4/+5
2003-09-22as this pkg now calls the linker directly, we need to explicitlygrant1-3/+5
specify -lc on Solaris. remove a bogus hack setting LD=${CC} which was also breaking the build on Solaris.
2003-09-22run ranlib over libskey.a in post-install, to appease Darwin's linkergrant1-1/+4
2003-09-21Add USE_BUILDLINK2 so this picks up a proper dependjmc1-1/+2
2003-09-21Hand generate the first part of this patch to avoid an RCS expansion onjmc2-9/+4
checkouts
2003-09-21Comment out setenv.c for NetBSD. System library has working copies andjmc1-2/+2
unsetenv conflicts anyways.
2003-09-21Comment out setenv.c for NetBSD. System library has working copies andjmc3-2/+21
unsetenv conflicts anyways.
2003-09-21Check openssl version and use new DES api if >= 0.9.7. Allows build tojmc5-2/+372
work on -current again. Bump PKGREVISION
2003-09-21Bump PKGREVISION as DES patches allow this to work on -current againjmc1-2/+2
2003-09-21Add some patches so if using openssl >= 0.9.7 the new des API is usedjmc3-1/+119
2003-09-19Mark tripwire as being only for NetBSD and Solaris right now.agc1-1/+3
The Darwin compile time configuration is easy to write, but I don't have a Darwin box handy, and so the tw.conf.darwin is a bit difficult to write as there tend to be a few non-standard paths. In response to PR 22362.
2003-09-19Remove patch-a{a,b,c,d} -- I wonder where they are :)wiz1-5/+1
generated by cgit v1.2.3 (git 2.39.1) at 2024-08-02 14:01:42 +0000