Age | Commit message (Collapse) | Author | Files | Lines |
|
without affecting packages that are currently using it.
Packages which previously didn't set BUILDLINK_DEPMETHOD to neither "full" nor
"build" now set it to "full", but should be checked whether they really need it
(comment added). Packages which previously set it to "build" now don't set it
anymore.
Ok by jlam, wiz.
|
|
rather than PKG_FAIL_REASON, so that they provide useful error
messages in build logs, and so that they continue to work on platforms
where they aren't broken.
|
|
security/base
|
|
engine to search and process a database of security events generated by
various IDSes, firewalls, and network monitoring tools. The features currently
include:
o Query-builder and search interface for finding alerts matching
on alert meta information (e.g. signature, detection time) as well as
the underlying network evidence (e.g. source/destination address, ports,
payload, or flags).
o Packet viewer (decoder) will graphically display the layer-3 and
layer-4 packet information of logged alerts
o Alert management by providing constructs to logically group alerts
to create incidents (alert groups), deleting the handled alerts or
false positives, exporting to email for collaboration, or archiving of
alerts to transfer them between alert databases.
o Chart and statistic generation based on time, sensor, signature, protocol,
IP address, TCP/UDP ports, or classification
|
|
|
|
Second, update distinfo and/or stop using USE_RUBY_DIST_SUBDIR in Makefiles.
|
|
* Re-enable pam_acct_mgmt hook.
* Add support for shadow password expiration.
* Configurable daemon socket timeout,
* Add a section for LDAP environment variable options.
* Replace LDAP_SERVER and LDAP_PORT settings with LDAP_URI,
which obsoletes LDAP_TLS.
* Fix LDAP error checking.
|
|
conflicting local version.
|
|
|
|
Add a MESSAGE about false-positive results on non-supported platforms
Helps to address PR# 31813 reported by Eric Mumpower
From the README:
02/22/2005 - Version 0.45 chkproc.c: better support for Linux
threads. New rootkit detected: Fu,
Kenga3, ESRK. New test: chkutmp. -n
option improvement. Minor bug fixes.
10/26/2005 - Version 0.46 chkproc.c: more fixes to better support
Linux threads. chkutmp.c: improved
execution speed. chkwtmp.c: segfault
fixed. New rootkit detected: rootedoor.
Mac OS X support added. Minor bug fixes.
10/28/2005 - Version 0.46a chkproc.c: bug fix for FreeBSD: chkproc
was sending a SIGXFSZ (kill -25) to init,
causing a reboot.
|
|
2005-11-30 Gisle Aas
Release 2.36
Fix documentation typo.
2005-11-26 Gisle Aas
Release 2.35
Forgot to incorporate fixes already applied to bleadperl :-(
- doc typo
- consting
- unused my_na
- USE_HEAP_INSTEAD_OF_STACK for Symbian
2005-11-26 Gisle Aas
Release 2.34
Document that it is now easy to generate different messages that produce the
same MD5 digest.
Use XSLoader; perl-5.6 is now required.
Tweaks to the processing of $? after running the test program.
|
|
2005-11-26 Gisle Aas
Release 1.14
Documentation tweaks.
|
|
Bump BUILDLINK_RECOMMENDED.
|
|
|
|
Changes in version 0.4.6 are:
* Confirm password when selecting new password
|
|
* Version 1.3.2 (released 2005-12-15)
** GnuTLS now support TLS Inner application (TLS/IA).
This is per draft-funk-tls-inner-application-extension-01. This
functionality is added to libgnutls-extra, so it is licensed under the
GNU General Public License.
** New APIs to access the TLS Pseudo-Random-Function (PRF).
The PRF is used by some protocols building on TLS, such as EAP-PEAP
and EAP-TTLS. One function to access the raw PRF and one to access
the PRF seeded with the client/server random fields are provided.
Suggested by Jouni Malinen <jkmaline@cc.hut.fi>.
** New APIs to acceess the client and server random fields in a session.
These fields can be useful by protocols using TLS. Note that these
fields are typically used as input to the TLS PRF, and if this is your
intended use, you should use the TLS PRF API that use the
client/server random field directly. Suggested by Jouni Malinen
<jkmaline@cc.hut.fi>.
** Internal type cleanups.
The uint8, uint16, uint32 types have been replaced by uint8_t,
uint16_t, uint32_t. Gnulib is used to guarantee the presence of
correct types on platforms that lack them. The uint type have been
replaced by unsigned.
** API and ABI modifications:
New functions to invoke the TLS Pseudo-Random-Function (PRF):
gnutls_prf
gnutls_prf_raw
New functions to retrieve the session's client and server random values:
gnutls_session_get_server_random
gnutls_session_get_client_random
New function, to perform TLS/IA handshake:
gnutls_ia_handshake
New function to decide whether to do a TLS/IA handshake:
gnutls_ia_handshake_p
New functions to allocate a TLS/IA credential:
gnutls_ia_allocate_client_credentials
gnutls_ia_free_client_credentials
gnutls_ia_allocate_server_credentials
gnutls_ia_free_server_credentials
New functions to handle the AVP callback:
gnutls_ia_set_client_avp_function
gnutls_ia_set_client_avp_ptr
gnutls_ia_get_client_avp_ptr
gnutls_ia_set_server_avp_function
gnutls_ia_set_server_avp_ptr
gnutls_ia_get_server_avp_ptr
New functions, to toggle TLS/IA application phases:
gnutls_ia_require_inner_phase
New function to mix session keys with inner secret:
gnutls_ia_permute_inner_secret
Low-level API (used internally by gnutls_ia_handshake):
gnutls_ia_endphase_send
gnutls_ia_send
gnutls_ia_recv
New functions that can be used after successful TLS/IA negotiation:
gnutls_ia_generate_challenge
gnutls_ia_extract_inner_secret
Enum type with TLS/IA modes:
gnutls_ia_mode_t
Enum type with TLS/IA packet types:
gnutls_ia_apptype_t
Enum values for TLS/IA alerts:
GNUTLS_A_INNER_APPLICATION_FAILURE
GNUTLS_A_INNER_APPLICATION_VERIFICATION
New error codes, to signal when an application phase has finished:
GNUTLS_E_WARNING_IA_IPHF_RECEIVED
GNUTLS_E_WARNING_IA_FPHF_RECEIVED
New error code to signal TLS/IA verify failure:
GNUTLS_E_IA_VERIFY_FAILED
* Version 1.3.1 (released 2005-12-08)
** Support for DHE-PSK cipher suites has been added.
This method offers perfect forward secrecy.
** Fix gnutls-cli STARTTLS hang when SIGINT is sent too quickly, thanks to
Otto Maddox <ottomaddox@fastmail.fm> and Nozomu Ando <nand@mac.com>.
** Corrected a bug in certtool for 64 bit machines. Reported
by Max Kellermann <max@duempel.org>.
** New function to set a X.509 private key and certificate pairs, and/or
CRLs, from an PKCS#12 file, suggested by Emile van Bergen
<emile@e-advies.nl>.
The integrity of the PKCS#12 file is protected through a password
based MAC; public-key based signatures for integrity protection are
not supported. PKCS#12 bags may be encrypted using password derived
symmetric keys, public-key based encryption is not supported. The
PKCS#8 keys may be encrypted using passwords. The API use the same
password for all operations. We believe that any more flexibility
create too much complexity that would hurt overall security, but may
add more PKCS#12 related APIs if real-world experience indicate
otherwise.
** gnutls_x509_privkey_import_pkcs8 now accept unencrypted PEM PKCS#8 keys,
reported by Emile van Bergen <emile@e-advies.nl>.
This will enable "certtool -k -8" to parse those keys.
** Certtool now generate keys in unencrypted PKCS#8 format for empty passwords.
Use "certtool -p -8" and press press enter at the prompt. Earlier,
certtool would have encrypted the key using an empty password.
** Certtool now accept --password for --key-info and encrypted PKCS#8 keys.
Earlier it would have prompted the user for it, even if --password was
supplied.
** Added self test of PKCS#8 parsing.
Unencrypted and encrypted (pbeWithSHAAnd3-KeyTripleDES-CBC and
pbeWithSHAAnd40BitRC2-CBC) formats are tested. The test is in
tests/pkcs8.
** API and ABI modifications:
New function to set X.509 credentials from a PKCS#12 file:
gnutls_certificate_set_x509_simple_pkcs12_file
New gnutls_kx_algorithm_t enum type:
GNUTLS_KX_DHE_PSK
New API to return session data (better data types than
gnutls_session_get_data):
gnutls_session_get_data2
New API to set PSK Diffie-Hellman parameters:
gnutls_psk_set_server_dh_params
* Version 1.3.0 (2005-11-15)
** Support for TLS Pre-Shared Key (TLS-PSK) ciphersuites have been added.
This add several new APIs, see below. Read the updated manual for
more information. A new self test "pskself" has been added, that will
test this functionality.
** The session resumption data are now system independent.
** The code has been re-indented to conform to the GNU coding style.
** Removed the RIPEMD ciphersuites.
** Added a discussion of the internals of gnutls in manual.
** Fixes for Tru64 UNIX 4.0D that lack MAP_FAILED, from Albert Chin.
** Remove trailing comma in enums, for IBM C v6, from Albert Chin.
** Make sure config.h is included first in a few files, from Albert Chin.
** Don't use C++ comments ("//") as they are invalid, from Albert Chin.
** Don't install SRP programs and man pages if --disable-srp-authentication,
from Albert Chin.
** API and ABI modifications:
New gnutls_kx_algorithm_t key exchange type: GNUTLS_KX_PSK
New gnutls_credentials_type_t credential type:
GNUTLS_CRD_PSK
New credential types:
gnutls_psk_server_credentials_t
gnutls_psk_client_credentials_t
New functions to allocate PSK credentials:
gnutls_psk_allocate_client_credentials
gnutls_psk_free_client_credentials
gnutls_psk_free_server_credentials
gnutls_psk_allocate_server_credentials
New enum type for PSK key flags:
gnutls_psk_key_flags
New function prototypes for credential callback:
gnutls_psk_client_credentials_function
gnutls_psk_server_credentials_function
New function to set PSK username and key:
gnutls_psk_set_client_credentials
New function to set PSK passwd file:
gnutls_psk_set_server_credentials_file
New function to extract PSK user in server:
gnutls_psk_server_get_username
New functions to set PSK callback:
gnutls_psk_set_server_credentials_function
gnutls_psk_set_client_credentials_function
Use size_t instead of int for output size parameter:
gnutls_srp_base64_encode
gnutls_srp_base64_decode
|
|
local security information.
With thanks to Joerg Sonnenberger for the DragonFly help, and Trevor
Kendall for the original report.
|
|
incorrect field calculation for the second field if the first field is
numeric and there are only 2 fields total in the input record (line).
The buggy awk was in 2.99.* and early 3.99.*, and identifies itself as
awk version 20030729. However, not all awk's with this version number
exhibit the problem (so it could be related to a library used by awk).
Recent 3.99.* builds don't have this problem, and the awk versio on
them is also much more recent.
|
|
automatically detects whether we want the pkginstall machinery to be
used by the package Makefile.
|
|
Reword COMMENT (which also removes the typo).
|
|
It includes a server, client and tools to generate server keys
and to convert OpenSSH keys for Dropbear.
|
|
(No PKGREVISION bump because this is the default setting.)
|
|
MANDIR in the makefile.
|
|
|
|
|
|
|
|
you think you might have read the openssl man pages one time too much for
your own sanity, you might like this package.
Certificate Service Provider is a perl wrapper around openssl that allows you
to run multiple simple certificate authorities (CAs). CSP is designed to be
simple (almost to a fault) and is ideally suited to small PKIs (< 1000
entities) where security is paramount. CSP is meant to be run on isolated,
offline computers while still allowing CRLs and certificate repositories to be
easily published.
The package includes a patch that lets the program run out-of-the-box,
without setting up CSPHOME and OPENSSL in the environment. Defining them
is of course still permitted.
|
|
|
|
|
|
|
|
3.0. If one of these is important to you, please fix it in time
for pkgsrc-2006Q1, or it may be removed.
|
|
platforms with older versions of /etc/rc.subr can run smbd.sh and
winbindd.sh without updating /etc/rc.subr.
Bump PKGREVISION to 2.
|
|
pkgsrc work.
|
|
http://lists.ucc.gu.uwa.edu.au/pipermail/dropbear/2005q4/000312.html
Noted by waldeck of hk2.uwaterloo.ca via pkgsrc-bugs.
Bump PKGREVISION.
Tested build on NetBSD and Linux. Tested dropbear server on NetBSD.
(This is during a freeze. Other stuff to be done later:
update to latest version. Install man pages. Mention "client" in
COMMENT and DESCR. Use CONF_FILES and sysconfdir. And maybe install the
"scp" tool also.)
|
|
|
|
Bugs fixed since 2.0.9:
* bug #1349326 "ulogd option does not work". There was a typo in the
class iptAdvancedDialog ( 'useULOG' instead of 'use_ULOG' )
* bug #1315892: "fwbuilder crashes on missing OS template" The GUI
crashed if user added new hostOS or firewall platform template under
resources/os or resources/platforms, then reinstalled the package (and
therefore lost their custom template files), then tried to open
firewall or host OS settings dialog for the object using new template.
* bug #1305933: "fwbuilder/Solaris: compilation errors". Another case of
implicit type conversion QString->string which does not compile on
systems with QT built w/o STL support.
* bug #1304878: fwbuilder: signal.h required (Solaris). Using
'AC_CHECK_HEADERS([signal.h])' in configure.in to check for the
appropriate #include.
* bug #1304764: "configure script: Sun make check fails". Need to use
${MAKE-make} instead of $ac_make when checking for GNU make.
* bug #1304785: "fwbuilder - Solaris has no libutil". Using better way
to check whether we need to link with libutil.
Bugs fixed in policy compiler for iptables since 2.0.9:
* bug #1342495: "SNAT with address range". Compiler used to print
warning "Adding virtual addresses for NAT is not supported for
address range" even if adding virtual addresses for NAT was turned off.
* bug #1313420: "OUTPUT chain is built wrong under certain conditions."
Rules that have firewall in SRC and DST, while DST has negation,
should be split so that the second generated rule goes into OUTPUT
chain rather than FORWARD
|
|
Change most pkgs to depend on either
emulators/suse_linux/Makefile.application (normal pkgs) or
Makefile.common (suse91 and suse themselves) to filter out Operating
Systems without Linux ABI support. Use CPU masks to limit the pkg to
supported platforms.
|
|
use the bundled pcre, but devel/pcre instead.
|
|
Patch from ssldump bug tracker, via <veego>.
|
|
Patch from Debian bug tracker, via <veego>.
|
|
|
|
and pcap.h, on DragonFly.
|
|
|
|
|
|
due to missing size_t.
|
|
|
|
|
|
|
|
it there.
|
|
pkg is redundant on that version and on -current it doesn't even build
without errors.
|