summaryrefslogtreecommitdiff
path: root/security
AgeCommit message (Collapse)AuthorFilesLines
2008-09-16Finish removal of security/Ai{CA,SSLtelnet} that should have been partgdt9-230/+0
of last commit.
2008-09-16Remove security/AiCA, security/AiSSLtelnet, security/smimemsg.gdt21-391/+1
These packages have unfetchable distfiles and unreachable HOMEPAGEs. Removal proposed on pkgsrc-users with no objections received.
2008-09-16Add & enable p5-Authen-CAS-Clientseb1-1/+2
2008-09-16Initial import of p5-Authen-CAS-Client version 0.03 in the NetBSDseb3-0/+32
Packages Collection. The Perl 5 module Authen::CAS::Client provides a simple interface for authenticating users using JA-SIG's CAS protocol. Both CAS v1.0 and v2.0 are supported.
2008-09-16Update openssh package to 5.1.1 (5.1p1)taca9-110/+28
Changes from OpenSSH 5.0 is huge to write here, please refer its release note: http://www.openssh.com/txt/release-5.1. I quote only Security section from the release note. Security: * sshd(8): Avoid X11 man-in-the-middle attack on HP/UX (and possibly other platforms) when X11UseLocalhost=no When attempting to bind(2) to a port that has previously been bound with SO_REUSEADDR set, most operating systems check that either the effective user-id matches the previous bind (common on BSD-derived systems) or that the bind addresses do not overlap (Linux and Solaris). Some operating systems, such as HP/UX, do not perform these checks and are vulnerable to an X11 man-in-the-middle attack when the sshd_config(5) option X11UseLocalhost has been set to "no" - an attacker may establish a more-specific bind, which will be used in preference to sshd's wildcard listener. Modern BSD operating systems, Linux, OS X and Solaris implement the above checks and are not vulnerable to this attack, nor are systems where the X11UseLocalhost has been left at the default value of "yes". Portable OpenSSH 5.1 avoids this problem for all operating systems by not setting SO_REUSEADDR when X11UseLocalhost is set to no. This vulnerability was reported by sway2004009 AT hotmail.com.
2008-09-12Update from version 1.06 to 1.07.he2-6/+6
Upstream changes: 1.07 - Fri Aug 15 16:53:36 2008 * Fixed the odd character problems in some of the files * No need to upgrade if you already have this installed 1.06_03 - Sun Jun 22 11:32:46 2008 * Trying the __sgi definition. If this doesn't make things blow up, this release will get bumped to 1.07. 1.06_02 - Thu Jun 19 11:55:21 2008 * Removed wide chars from the header file. Some compilers like to complain about things that are wrong. :( 1.06_01 - Wed Jun 18 09:37:34 2008 This is a test of a fix for Irix. 1.06_01 - Wed Jun 4 19:18:57 2008 * This is a test of a fix for Irix.
2008-09-12Clarify that the vague patent claims are made by the licensor.gdt1-2/+2
2008-09-12+generic-nonlicense, NO_*_ON_* because one can't read the license duegdt1-1/+5
to distfile/homepage lossage. candidate for removal.
2008-09-12Add LICENSE=generic-nonlicense, set NO_*_ON_* due to unfetchablegdt1-1/+5
distfile.
2008-09-08Changes 0.2.28:adam3-7/+8
* Rewrite to use poll instead of select. * Improve Windows installation instructions in the manual. * tests: New self test of gsasl_mechanism_name function.
2008-09-07Update to libassuan-1.0.5. As shipped, it builds with -fPIC on linux.bjs7-8/+246
This is not acceptable for us. Instead, we patch to use libtool. The included test passes. Changes since 1.0.3: * Minor fixes. * Build library for GNU/Linux as PIC [**but we use libtool**] * New hook feature to enhance the internal I/O functions.
2008-09-06Bump PKGREVISION for libevent users due to 1.4.3->1.4.5 shlib name change.wiz4-8/+8
2008-09-06Recursive PKGREVISION/ABI-depends bump for db4 4.6->4.7 update (shlibwiz1-1/+2
name change).
2008-09-06Update to 1.15:wiz2-6/+6
v1.15 - change internal behavior when SSL handshake failed (like when verify callback returned an error) in the hope to fix spurios errors in t/auto_verify_hostname.t
2008-08-31Update to 5.4adrianp6-27/+166
- Make this compile on amd64 - Don't silently look for libraries when we don't need them. This should fix PR 39318 - Add missing depends on apr Release 5.4 ########### * Fixes to the http modules as some Apache installations are picky * The MySQL module also works with mysqld-5.0, updated * Added AS/400 return code checks to pop3 module * Fixed memory leaks in the http-form module. * Implemented a proposal by Jean-Baptiste.BEAUFRETON (at) turbomeca.fr to check for "530 user unknown" message in the ftp module * Added a performance patch by alejandro.mendiondo (at) baicom.com. This one needs stability testing! * Beautification to remove compiler warnings of modern gcc
2008-08-27Update to 0.9.15. Changes:shannonjr4-10/+25
- preludedb-admin has a bew 'count' command, printing the result of a COUNT() on the database. - preludedb-admin work on smaller set of data, to prevent large retrieval error (fix #220, refs #305). - preludedb-admin handling of interrupted transaction was improved. - Fix MySQL and SQLite MacOSX detection, by Uwe Schwartz <usx303 at googlemail.com>. (fix #296).
2008-08-26Update to 0.9.14.2. Changes: Various build fixes (#306)shannonjr2-7/+6
2008-08-26Update to 0.9.13. Changes:shannonjr3-10/+10
ModSecurity ruleset rewrite, by Peter Vrabec <pvrabec@redhat.com> and Dan Kopecek <dkopecek@redhat.com>. This ruleset handle ModSecurity 2.0 output. (Fix #216). - New rulesets for FreeBSD su attempts, by Alexander Afonyashin <firm@iname.com> (Fix #304). - Add additional format to the default configuration to deal with apache error_log file format, by Alexander Afonyashin <firm@iname.com> (Fix #307). - Normalize some classification: introduce Remote Login, and Credentials Change. Cleanup SSH ruleset, and remove duplicated rules.
2008-08-26Update to 0.9.19. Changes:shannonjr3-7/+8
- EasyBindings inclusion! EasyBindings provide simple C++, Python, Perl, Ruby, and Lua bindings for using libprelude. They are still considered experimental, thus you need to use (--enable-easy-bindings) to activate them. Thanks to Sebastien Tricaud <toady@inl.fr> and Pierre Chifflier <p.chifflier@inl.fr> for their contribution to this project! - Use automake/autoconf for building/installing Python extension. - Fix 0.9.18 regression (alert created with empty CreateTime). - Implement reference counting for the idmef-criteria and prelude-connection API. - Automatic casting when setting IDMEF Value to a field that is of different type. Until now, if an user tried to set a path of a specific type with an idmef_value_t object containing another type, idmef_path_set() would return an error. - Various bug fixes.
2008-08-24Add and enable p5-Crypt-OpenSSL-AES.obache1-1/+2
2008-08-24Import p5-Crypt-OpenSSL-AES-0.02 as security/p5-Crypt-OpenSSL-AES.obache3-0/+40
Based on PR 39222 by Jens Rehsack. This module implements a wrapper around OpenSSL. Specifically, it wraps the methods related to the US Government's Advanced Encryption Standard (the Rijndael algorithm). This module is compatible with Crypt::CBC (and likely other modules that utilize a block cipher to make a stream cipher). This module is an alternative to the implementation provided by Crypt::Rijndael which implements AES itself. In contrast, this module is simply a wrapper around the OpenSSL library. The Crypt::Rijndael implementation seems to produce inaccurate results on 64-bit x86 machines. By using OpenSSL, this module aims to avoid architecture specific problems, allowing the OpenSSL maintainers to overcome such issues.
2008-08-23Remove unresolvable hosts from MASTER_SITES.obache1-4/+2
Noticed by Zafer Aydogan via private mail.
2008-08-23Set MAKE_JOBS_SAFE=noepg1-1/+3
2008-08-21Push new Python OpenSSL module. Changes since version 0.6:tonnerre3-8/+17
- Removed some unused variables. - Improved Python 2.3 compatibility. - Fixed various threading bugs. - Some improvements in the test suite.
2008-08-20Add p5-Net-DNS-SEC-Maint-Key.he1-1/+2
2008-08-20Import p5-Net-DNS-SEC-Maint-Key version 0.013.he7-0/+290
This is the RIPE NCC DNSSEC Key Management tools, described at https://www.ripe.net/projects/disi/dnssec_maint_tool/ This class implements an interface to a database of private keys used during DNSSEC administration. This package includes some diffs to the self-tests, so that they pass.
2008-08-17Update p5-GSSAPI to 0.26markd2-6/+6
0.22 Mo Mai 29 21:15:17 CEST 2006 - Bugfixs 0.23 Mi Aug 2 15:48:19 UTC 2006 - Re-added support of MIT Kerberos 1.2.x 0.24 Wed, 21 Feb 2007 20:59:39 +0100 - Changed tests as an answer to FAIL 413320 0.25 So 3. Feb 20:18:16 UTC 2008 - Enhancement to use OpenSolaris/Solaris 10 native gss library 0.26 Fr 15. Feb 22:32:10 UTC 2008 - modified Makefile.PL to trigger no FAIL testreports in case of missing prerequirements.
2008-08-17Update from version 2.10 to 2.11.he2-7/+7
Pkgsrc changes: o Change MAINTAINER to pkgsrc-users@ as per communication with maintainer Upstream changes: Authen-SASL 2.11 -- Mon Apr 21 10:23:19 CDT 2008 Enhancements * implement securesocket() in the ::Perl set of plugins Bug Fixes * fix parsing challenges from GnuSASL * update tests for DIGEST-MD5 * New test from Phil Pennock for testing final server response
2008-08-17This installs a bash script. Handle it properly.dholland1-2/+4
PKGREVISION++
2008-08-17Fix DESTDIR.dholland1-3/+3
2008-08-16Update to ipsec-tools 0.7.1, fixes CVE-2008-3652manu2-8/+7
Changes since the 0.6 branch: 0.7.1 - 23 July 2008 o Fixes a memory leak when invalid proposal received o Some fixes in DPD o do not set default gss id if xauth is used o fixed hybrid enabled builds o fixed compilation on FreeBSD8 o cleanup in network port value manipulation o gets ports from SADB_X_EXT_NAT_T_[SD]PORT if present in purge_ipsec_sp i() o Generates a log if cert validation has been disabled by configuration o better handling for pfkey socket read errors o Fixes in yacc / bison stuff o new plog() macro (reduced CPU usage when logging is disabled) o Try to works better with huge SPD/SAD o Corrected modecfg option syntax o Many other various fixes... 0.7 - 09 August 2007 o Xauth with pre-shared key PSK o Xauth with certificates o SHA2 support o pkcs7 support o system accounting (utmp) o Darwin support o configuration can be reloaded o Support for UNIQUE generated policies o Support for semi anonymous sainfos o Support for ph1id to remoteid matching o Plain RSA authentication o Native LDAP support for Xauth and modecfg o Group membership checks for Xauth and sainfo selection o Camellia cipher support o IKE Fragment force option o Modecfg SplitNet attribute support o Modecfg SplitDNS attribute support ( server side ) o Modecfg Default Domain attribute support o Modecfg DNS/WINS server multiple attribute support
2008-08-14Remove idea option -- I can't find a patch for the current PKGVERSION.wiz1-24/+2
Addresses PR 39316.
2008-08-14Changes 0.2.27:adam3-7/+8
* Fix SASL operations through TLS. * Update gnulib files, and include gnulib self-tests. * Update translations.
2008-08-12Add DESTDIR support.obache12-39/+62
2008-08-10PLIST correction.shannonjr2-3/+4
2008-08-08PLIST correction.shannonjr2-2/+7
2008-08-08Re: pkg/39314 (security/ccid update to 1.3.8)shannonjr5-44/+16
Update to 1.3.8
2008-08-08Re: pkg/39315shannonjr6-49/+24
Update to 1.4.102. Patches ag and ah are deleted because they are no longer required (change included in unmodified system).
2008-08-04Change MASITER_SITES to one still have old distfile.obache1-2/+2
from Zafer Aydogan via private mail.
2008-08-03Update from version 1.13 to 1.14. Changes:he2-6/+6
v1.14 - added support for verification of hostname from certificate including subjectAltNames, support for IDN etc based on patch and input from christopher[AT]odenbachs[DOT]de and achim[AT]grolmsnet[DOT]de. It is also possible to get more information from peer_certificate based on this patch. See documentation for peer_certificate and verify_hostname - automatic verification of hostnames with SSL_verifycn_scheme and SSL_verifycn_name - global setting of default context options like SSL_verifycn_scheme, SSL_verify_mode with set_ctx_defaults - fix import of inet4,inet6 which got broken within 1.13_X. Thanks to <at[AT]altlinux[DOT]ru> for bugreport and patch - clarified and enhanced debugging supppport based on bugreport http://rt.cpan.org/Ticket/Display.html?id=32960 - put information into README regarding the supported and recommanded version of Net::SSLeay
2008-08-03Update from version 1.32nb1 to 1.35. Changes:he2-8/+8
1.35 25.07.208 - Fix test plan for autoload.t if Test::Exception isn't available. - Skip rsa_generate_key.t if Test::Exception isn't available. 1.34 24.07.2008 - Fixed problem with X509_get_subjectAltNames, where some types of Alt Name (eg DIRNAMEs) were not properly handled, resulting in seg faults. Reported by Achim Grolms. - Added support for ENGINE_load_builtin_engines and ENGINE_register_all_complete in order to enable built-in OpenSSL crypto engines for hardware acceleration etc. - Added support for ENGINE_by_id and ENGINE_set_default, required to enable Sun crypto acceleration 1.33_01 14.02.2008 - Fixed a compile problem with inc_paths /usr/kerberos/include in inc/Module/Install/PRIVATE/Net/SSLeay.pm. Reported by "J. Nick Koston via RT" - Added optional support for SSL_set_hello_extension, SSL_set_session_secret_cb to support various extension patches from a patch to openssl-0.9.9-dev contributed by Jouni Malinen. See wpa_supplicant/patches/openssl-0.9.9-session-ticket.patch in the latest (git) version 0.6 and later of wpa_suplicant at http://hostap.epitest.fi/. These additions are ifdefed to SSL_F_SSL_SET_HELLO_EXTENSION which is added by the patch Tested with openssl-SNAP-20070816. - Added SSL_SESSION_set_master_key and SSL_get_keyblock_size. - Added all SSL_OP_* options flags present in 0.9.9 - Fixed a bug in SSL_set_tmp_dh - Doc improvements in README.Win32 - Fixed a problem with proxy connections: open_proxy_tcp_connection was stopping after the first \n from teh proxy, but instead should have looked for $CRLF . $CRLF to find the beginning of the SSL content - Fixed missing / on /usr/kerberos/include, reported by several people - removed bacus.pt from host list in t/handle/external/10_destroy.t, since it seems no longer to respond. Reported by tco2. - changed t/handle/external/10_destroy.t so this list of URIs to be tested can be configured with environment variable SSLEAY_URIS, a colon separated list of host names. Suggested by tco2. - changed t/handle/external/50_external.t and t/external/08_external.t so this list of sites to be tested can be configured with environment variable SSLEAY_SITES, a colon separated list of host names. Suggested by tco2. - Fixed doucumentation in README of how to use OPENSSL_PREFIX environment variable to control the location of openssl. Reported by "Quanah Gibson-Mount via RT". - Don't use Module::Installs auto_install. - Bind NID_ and GEN_ constants. - Default to not running external tests.
2008-07-31Add and enable sshfpagc1-1/+2
2008-07-31Initial import of sshfp-1.1.3 into the Packages Collection.agc5-0/+57
sshfp is a small utility that generates RFC4255 SSHFP DNS records based on the public keys stored in a known_hosts file or obtained by using ssh-keyscan. If the nameserver of the domain allows zone tranfers (AXFR), an entire domain can be processed for all its A records. These can then be easilly added to a zone, and then secured by DNSSEC.
2008-07-30update to gnutls-2.4.1kefren4-22/+67
Changes: ** libgnutls: Fix local crash in gnutls_handshake. [GNUTLS-SA-2008-2] ** libgnutls: Fix memory leaks when doing a re-handshake. ** Fix compiler warnings. ** Fix ordering of -I's to avoid opencdk.h conflict with system headers. ** srptool: Fix a problem where --verify check does not succeed.
2008-07-30Update from version 0.34nb4 to 0.36.he2-9/+9
Pkgsrc changes: o Change to use CPAN as distribution source o Change HOMEPAGE to use search.cpan.org; leave old HOMEPAGE pointing to sourceforge commented-out Upstream changes: 0.36 Mon Aug 13 12:16:38 EDT 2007 * [rt.cpan.org #28814] - Performance improvement from mehradek (Radoslaw Zielinski) -use English; +use English qw( -no_match_vars ); 0.35 Fri Apr 20 12:33:53 EDT 2007 - Jesse Vincent <jesse@bestpractical.com> * New Maintainer: Jesse Vincent <jesse@bestpractical.com> took over maintenance of this module. * Removed test key expiry dates. (Fixes http://rt.cpan.org/Ticket/Display.html?id=17618) * Applied secret key output patch for modern GPG from http://rt.cpan.org/Ticket/Display.html?id=17619 * Applied patch to support 'tru' record types from (http://search.cpan.org/src/JRED/Mail-GPG-1.0.6/patches/)
2008-07-29Needs pkg-config.joerg1-1/+3
2008-07-28Update from version 0.06 to 0.07. Changes:he2-6/+6
0.07 Thu Jul 23 10:31:33 2008 - rt 34703 - argument logic before filehandle fetch so that they'll apply - read small chunk of file handles instead if readline() to avoid various issues
2008-07-27NetBSD at least gets glob.h installed, so check for it.joerg1-1/+2
2008-07-27Add HOMEPAGE pointing into search.cpan.org.he1-2/+2
No other change, so no version bump.
2008-07-26Update from version 0.02 to 0.04.he2-9/+14
Pkgsrc changes: o Added full list of dependencies, from Makefile.PL. Upstream changes: 0.04 Sun Jun 15 16:22:32 JST 2008 * fixed a bug caused memory greediness with too long strings :< * improved internal code for PAUSE. 0.03 Sat Jun 14 19:17:30 JST 2008 * added support for Math::Random::MT::Perl. * switched to Module::Build. * cleaned up test scripts. * added 'binary' option to rndpassword.
generated by cgit v1.2.3 (git 2.39.1) at 2024-07-16 02:43:04 +0000