summaryrefslogtreecommitdiff
path: root/security
AgeCommit message (Collapse)AuthorFilesLines
2005-12-31Update to 1.3.2:wiz3-7/+51
* Version 1.3.2 (released 2005-12-15) ** GnuTLS now support TLS Inner application (TLS/IA). This is per draft-funk-tls-inner-application-extension-01. This functionality is added to libgnutls-extra, so it is licensed under the GNU General Public License. ** New APIs to access the TLS Pseudo-Random-Function (PRF). The PRF is used by some protocols building on TLS, such as EAP-PEAP and EAP-TTLS. One function to access the raw PRF and one to access the PRF seeded with the client/server random fields are provided. Suggested by Jouni Malinen <jkmaline@cc.hut.fi>. ** New APIs to acceess the client and server random fields in a session. These fields can be useful by protocols using TLS. Note that these fields are typically used as input to the TLS PRF, and if this is your intended use, you should use the TLS PRF API that use the client/server random field directly. Suggested by Jouni Malinen <jkmaline@cc.hut.fi>. ** Internal type cleanups. The uint8, uint16, uint32 types have been replaced by uint8_t, uint16_t, uint32_t. Gnulib is used to guarantee the presence of correct types on platforms that lack them. The uint type have been replaced by unsigned. ** API and ABI modifications: New functions to invoke the TLS Pseudo-Random-Function (PRF): gnutls_prf gnutls_prf_raw New functions to retrieve the session's client and server random values: gnutls_session_get_server_random gnutls_session_get_client_random New function, to perform TLS/IA handshake: gnutls_ia_handshake New function to decide whether to do a TLS/IA handshake: gnutls_ia_handshake_p New functions to allocate a TLS/IA credential: gnutls_ia_allocate_client_credentials gnutls_ia_free_client_credentials gnutls_ia_allocate_server_credentials gnutls_ia_free_server_credentials New functions to handle the AVP callback: gnutls_ia_set_client_avp_function gnutls_ia_set_client_avp_ptr gnutls_ia_get_client_avp_ptr gnutls_ia_set_server_avp_function gnutls_ia_set_server_avp_ptr gnutls_ia_get_server_avp_ptr New functions, to toggle TLS/IA application phases: gnutls_ia_require_inner_phase New function to mix session keys with inner secret: gnutls_ia_permute_inner_secret Low-level API (used internally by gnutls_ia_handshake): gnutls_ia_endphase_send gnutls_ia_send gnutls_ia_recv New functions that can be used after successful TLS/IA negotiation: gnutls_ia_generate_challenge gnutls_ia_extract_inner_secret Enum type with TLS/IA modes: gnutls_ia_mode_t Enum type with TLS/IA packet types: gnutls_ia_apptype_t Enum values for TLS/IA alerts: GNUTLS_A_INNER_APPLICATION_FAILURE GNUTLS_A_INNER_APPLICATION_VERIFICATION New error codes, to signal when an application phase has finished: GNUTLS_E_WARNING_IA_IPHF_RECEIVED GNUTLS_E_WARNING_IA_FPHF_RECEIVED New error code to signal TLS/IA verify failure: GNUTLS_E_IA_VERIFY_FAILED * Version 1.3.1 (released 2005-12-08) ** Support for DHE-PSK cipher suites has been added. This method offers perfect forward secrecy. ** Fix gnutls-cli STARTTLS hang when SIGINT is sent too quickly, thanks to Otto Maddox <ottomaddox@fastmail.fm> and Nozomu Ando <nand@mac.com>. ** Corrected a bug in certtool for 64 bit machines. Reported by Max Kellermann <max@duempel.org>. ** New function to set a X.509 private key and certificate pairs, and/or CRLs, from an PKCS#12 file, suggested by Emile van Bergen <emile@e-advies.nl>. The integrity of the PKCS#12 file is protected through a password based MAC; public-key based signatures for integrity protection are not supported. PKCS#12 bags may be encrypted using password derived symmetric keys, public-key based encryption is not supported. The PKCS#8 keys may be encrypted using passwords. The API use the same password for all operations. We believe that any more flexibility create too much complexity that would hurt overall security, but may add more PKCS#12 related APIs if real-world experience indicate otherwise. ** gnutls_x509_privkey_import_pkcs8 now accept unencrypted PEM PKCS#8 keys, reported by Emile van Bergen <emile@e-advies.nl>. This will enable "certtool -k -8" to parse those keys. ** Certtool now generate keys in unencrypted PKCS#8 format for empty passwords. Use "certtool -p -8" and press press enter at the prompt. Earlier, certtool would have encrypted the key using an empty password. ** Certtool now accept --password for --key-info and encrypted PKCS#8 keys. Earlier it would have prompted the user for it, even if --password was supplied. ** Added self test of PKCS#8 parsing. Unencrypted and encrypted (pbeWithSHAAnd3-KeyTripleDES-CBC and pbeWithSHAAnd40BitRC2-CBC) formats are tested. The test is in tests/pkcs8. ** API and ABI modifications: New function to set X.509 credentials from a PKCS#12 file: gnutls_certificate_set_x509_simple_pkcs12_file New gnutls_kx_algorithm_t enum type: GNUTLS_KX_DHE_PSK New API to return session data (better data types than gnutls_session_get_data): gnutls_session_get_data2 New API to set PSK Diffie-Hellman parameters: gnutls_psk_set_server_dh_params * Version 1.3.0 (2005-11-15) ** Support for TLS Pre-Shared Key (TLS-PSK) ciphersuites have been added. This add several new APIs, see below. Read the updated manual for more information. A new self test "pskself" has been added, that will test this functionality. ** The session resumption data are now system independent. ** The code has been re-indented to conform to the GNU coding style. ** Removed the RIPEMD ciphersuites. ** Added a discussion of the internals of gnutls in manual. ** Fixes for Tru64 UNIX 4.0D that lack MAP_FAILED, from Albert Chin. ** Remove trailing comma in enums, for IBM C v6, from Albert Chin. ** Make sure config.h is included first in a few files, from Albert Chin. ** Don't use C++ comments ("//") as they are invalid, from Albert Chin. ** Don't install SRP programs and man pages if --disable-srp-authentication, from Albert Chin. ** API and ABI modifications: New gnutls_kx_algorithm_t key exchange type: GNUTLS_KX_PSK New gnutls_credentials_type_t credential type: GNUTLS_CRD_PSK New credential types: gnutls_psk_server_credentials_t gnutls_psk_client_credentials_t New functions to allocate PSK credentials: gnutls_psk_allocate_client_credentials gnutls_psk_free_client_credentials gnutls_psk_free_server_credentials gnutls_psk_allocate_server_credentials New enum type for PSK key flags: gnutls_psk_key_flags New function prototypes for credential callback: gnutls_psk_client_credentials_function gnutls_psk_server_credentials_function New function to set PSK username and key: gnutls_psk_set_client_credentials New function to set PSK passwd file: gnutls_psk_set_server_credentials_file New function to extract PSK user in server: gnutls_psk_server_get_username New functions to set PSK callback: gnutls_psk_set_server_credentials_function gnutls_psk_set_client_credentials_function Use size_t instead of int for output size parameter: gnutls_srp_base64_encode gnutls_srp_base64_decode
2005-12-29Use an ${OPSYS}-specific message file for DragonFly, to get the rightagc2-1/+30
local security information. With thanks to Joerg Sonnenberger for the DragonFly help, and Trevor Kendall for the original report.
2005-12-29Avoid changing FS as it triggers an odd bug on some awk versions, withkim6-1/+176
incorrect field calculation for the second field if the first field is numeric and there are only 2 fields total in the input record (line). The buggy awk was in 2.99.* and early 3.99.*, and identifies itself as awk version 20030729. However, not all awk's with this version number exhibit the problem (so it could be related to a library used by awk). Recent 3.99.* builds don't have this problem, and the awk versio on them is also much more recent.
2005-12-29Remove USE_PKGINSTALL from pkgsrc now that mk/install/pkginstall.mkjlam41-82/+41
automatically detects whether we want the pkginstall machinery to be used by the package Makefile.
2005-12-28Fix typo in DESCR.reed2-3/+3
Reword COMMENT (which also removes the typo).
2005-12-27Add to description:reed1-2/+2
It includes a server, client and tools to generate server keys and to convert OpenSSH keys for Dropbear.
2005-12-27Use PKGMANDIR instead of hard-coded "man".reed1-5/+5
(No PKGREVISION bump because this is the default setting.)
2005-12-27Update patch to also use PKGMANDIR instead of "man" for thereed2-4/+4
MANDIR in the makefile.
2005-12-27Mention this is version 1 in the COMMENT.reed1-2/+2
2005-12-27Add some more OpenSSL 0.9.7 fixes for DragonFly.joerg2-1/+30
2005-12-27Enable security/CSP.cube1-1/+2
2005-12-27Initial import of CSP, version 0.32, into the NetBSD Packages Collection. Ifcube5-0/+83
you think you might have read the openssl man pages one time too much for your own sanity, you might like this package. Certificate Service Provider is a perl wrapper around openssl that allows you to run multiple simple certificate authorities (CAs). CSP is designed to be simple (almost to a fault) and is ideally suited to small PKIs (< 1000 entities) where security is paramount. CSP is meant to be run on isolated, offline computers while still allowing CRLs and certificate repositories to be easily published. The package includes a patch that lets the program run out-of-the-box, without setting up CSPHOME and OPENSSL in the environment. Defining them is of course still permitted.
2005-12-27Remove paragraph about "MAILING LISTS".reed1-9/+0
2005-12-27Sort.reed1-2/+2
2005-12-27Lower expectations, both others' and mine: relinquish stewardshipseb5-10/+10
2005-12-26Mark packages for pkgsrc-2005Q4 that don't build on NetBSD/i386schmonz3-3/+12
3.0. If one of these is important to you, please fix it in time for pkgsrc-2006Q1, or it may be removed.
2005-12-21Add a non-conflicting definition for load_rc_config_var so thatjlam3-4/+30
platforms with older versions of /etc/rc.subr can run smbd.sh and winbindd.sh without updating /etc/rc.subr. Bump PKGREVISION to 2.
2005-12-17Change my MAINTAINER email address to the one I've been using forjlam6-12/+12
pkgsrc work.
2005-12-14Add security patch fromreed3-2/+19
http://lists.ucc.gu.uwa.edu.au/pipermail/dropbear/2005q4/000312.html Noted by waldeck of hk2.uwaterloo.ca via pkgsrc-bugs. Bump PKGREVISION. Tested build on NetBSD and Linux. Tested dropbear server on NetBSD. (This is during a freeze. Other stuff to be done later: update to latest version. Install man pages. Mention "client" in COMMENT and DESCR. Use CONF_FILES and sysconfdir. And maybe install the "scp" tool also.)
2005-12-13Reset maintainer, mail server unreachable for one week.joerg1-2/+2
2005-12-12Update fwbuilder and libfwbuilder to 2.0.10.bad10-51/+26
Bugs fixed since 2.0.9: * bug #1349326 "ulogd option does not work". There was a typo in the class iptAdvancedDialog ( 'useULOG' instead of 'use_ULOG' ) * bug #1315892: "fwbuilder crashes on missing OS template" The GUI crashed if user added new hostOS or firewall platform template under resources/os or resources/platforms, then reinstalled the package (and therefore lost their custom template files), then tried to open firewall or host OS settings dialog for the object using new template. * bug #1305933: "fwbuilder/Solaris: compilation errors". Another case of implicit type conversion QString->string which does not compile on systems with QT built w/o STL support. * bug #1304878: fwbuilder: signal.h required (Solaris). Using 'AC_CHECK_HEADERS([signal.h])' in configure.in to check for the appropriate #include. * bug #1304764: "configure script: Sun make check fails". Need to use ${MAKE-make} instead of $ac_make when checking for GNU make. * bug #1304785: "fwbuilder - Solaris has no libutil". Using better way to check whether we need to link with libutil. Bugs fixed in policy compiler for iptables since 2.0.9: * bug #1342495: "SNAT with address range". Compiler used to print warning "Adding virtual addresses for NAT is not supported for address range" even if adding virtual addresses for NAT was turned off. * bug #1313420: "OUTPUT chain is built wrong under certain conditions." Rules that have firewall in SRC and DST, while DST has negation, should be split so that the second generated rule goes into OUTPUT chain rather than FORWARD
2005-12-12First step at reworking Linux binary packages.joerg1-3/+6
Change most pkgs to depend on either emulators/suse_linux/Makefile.application (normal pkgs) or Makefile.common (suse91 and suse themselves) to filter out Operating Systems without Linux ABI support. Use CPU masks to limit the pkg to supported platforms.
2005-12-11Since I don't want to hack around with config.*, patch amap to notjoerg5-17/+61
use the bundled pcre, but devel/pcre instead.
2005-12-11Compile with the OpenSSL in NetBSD-current.salo3-3/+26
Patch from ssldump bug tracker, via <veego>.
2005-12-11Compile with the OpenSSL in NetBSD-current.salo2-4/+13
Patch from Debian bug tracker, via <veego>.
2005-12-08Add DragonFly support.joerg2-7/+16
2005-12-08Use NetBSD rules for DragonFly as well. Don't include both, net/bpf.hjoerg3-2/+20
and pcap.h, on DragonFly.
2005-12-08Fix errno.joerg2-1/+27
2005-12-08Fix errno.joerg2-1/+14
2005-12-08Fix OpenSSL test, it doesn't work out of the box on DragonFlyjoerg2-1/+14
due to missing size_t.
2005-12-08Fix errno. Don't declare sys_nerr on FreeBSD and DragonFly.joerg8-4/+86
2005-12-08Use FreeBSD config.h fragment on FreeBSD and DragonFly.joerg2-1/+30
2005-12-08Fix errno.joerg5-6/+47
2005-12-07Also check for the pfvar.h file in the subdirectory 'pf', DragonFly installspeter1-1/+2
it there.
2005-12-07Change ONLY_FOR_PLATFORM to NetBSD 2.x. NetBSD 3 has pf in base so thispeter1-2/+2
pkg is redundant on that version and on -current it doesn't even build without errors.
2005-12-06Add and enable p5-Crypt-SmbHashwiz1-1/+2
2005-12-06Import p5-Crypt-SmbHash-0.12 from pkgsrc-wip, packaged by Murray Armfield:wiz4-0/+28
This module provides functions to generate LM/NT hashes used in Samba's 'password' files, like smbpasswd.
2005-12-05Ran "pkglint --autofix", which corrected some of the quoting issues inrillig41-118/+118
CONFIGURE_ARGS.
2005-12-05Fixed pkglint warnings. The warnings are mostly quoting issues, forrillig82-210/+203
example MAKE_ENV+=FOO=${BAR} is changed to MAKE_ENV+=FOO=${BAR:Q}. Some other changes are outlined in http://mail-index.netbsd.org/tech-pkg/2005/12/02/0034.html
2005-12-03Just dirrm the docs dir -- nothing should add files there.wiz1-2/+2
2005-12-03Create installation directory to fix bulk build.wiz1-1/+2
2005-12-02Add detection for pf from OpenBSD 3.8.peter1-4/+10
2005-12-01Split multipatch into multiple patches.wiz7-53/+62
2005-12-01Do not suggest rsaref (testing artifact).wiz1-2/+1
2005-12-01Convert to options framework.wiz2-39/+42
2005-11-25Bump PKGREVISION for libgsf dependencies, and BUILDLINK_DEPENDS becausewiz1-1/+2
of the libgsf shlib major bump and associated BUILDLINK_DEPENDS bump.
2005-11-23Update to 5.31:wiz2-8/+6
5.31 Mon Sep 5 00:52:42 MST 2005 - added standard tests for pod and pod-coverage checking - inserted subtest to check for failure when using unrecognized SHA algorithm 5.30 Sat Aug 20 16:46:08 MST 2005 - updated docs with recent NIST statement on SHA-1 -- advises use of larger and stronger hash functions (i.e. SHA-224/256/384/512) for new developments 5.29 Sun Aug 14 04:48:34 MST 2005 - added explicit casts in "shaload" routine (ref. "ldvals") -- thanks to E. Allen Smith for pointing out SGI compiler warnings on IPxx-irix platforms - updated docs with cautionary note about SHA-1
2005-11-23Update to 1.13:wiz2-6/+6
2005-10-18 Gisle Aas Release 1.13 Fixed documentation typo.
2005-11-22Depend on p5-Sort-Versions instead of p5-SortVersions.wiz1-3/+3
Bump PKGREVISION.
2005-11-22Update "ipsec-tools" package to version 0.6.3. Changes since 0.6.1:tron2-6/+6
- Various bug fixes - ISAKMP mode config works without Xauth This update fixes the security vulnerability reported in SA17668.
generated by cgit v1.2.3 (git 2.39.1) at 2024-07-13 06:40:02 +0000