summaryrefslogtreecommitdiff
path: root/security
AgeCommit message (Collapse)AuthorFilesLines
2012-12-15security/racoon2: Fix variable set but not used errorsmarino3-1/+52
With -Werror set on this package, racoon2 would not build with gcc4.6+
2012-12-15bump revisionpettai2-2/+4
2012-12-15Build fix for a more modern pcsc-lite.pettai4-2/+81
2012-12-151.4.21pettai5-20/+42
- Do not log the time every second on "old" PC/SC without support of \\?PnP?\Notification like on Mac OS X. - 79 new ATRS - minor fixes 1.4.20 - 16 June 2012, Ludovic ROUSSEAU - Makefile: Add arguments to CFLAGS instead of overwritting them - 3 new ATRs 1.4.19 - ATR_analysis: use XDG_CACHE_HOME env variable The smartcard_list.txt file is now searched in ~/.cache/ by default - 115 new ATRs 1.4.18 - gscriptor: Display hex dumps in lines of 16 bytes instead of 17 - gscriptor: Display bytes of value 0x20 as ' ' instead of '.' - scriptor: Display lines of 16 bytes instead of 24 - 223 new ATRs - pcsc_scan: Correctly detect reader Plug and Play support 1.4.17 - 153 new ATRs - Allow to build with pcsc-lite >= 1.6.2 1.4.16 - 153 new ATR - pcsc_scan.c: check for PnP support at run time instead of using a #define - ATR_analysis: use curl instead of wget on Darwin - gscriptor: ReaderConfig(): escape metacharacters []() in the reader name when using reader name as a pattern matching
2012-12-15A major version bump gives a long changelog...pettai7-79/+56
1.4.5: - Add support of Alcor Micro AU9540, Ubisys 13.56MHz RFID (CCID), BIFIT USB-Token iBank2key, BIFIT iBank2Key, Gemalto Ezio Shield PinPad reader, Gemalto SA .NET Dual, Precise Sense MC reader (with fingerprint), SDS DOMINO-Key TWIN Pro - Add support of bPPDUSupport and FEATURE_CCID_ESC_COMMAND - SCARD_ATTR_VENDOR_NAME and SCARD_ATTR_VENDOR_IFD_VERSION are not the vendor name and version of the driver but of the IFD: InterFace Device i.e. the smart card reader. We then return the USB iManufacturer string as SCARD_ATTR_VENDOR_NAME and USB bcdDevice as SCARD_ATTR_VENDOR_IFD_VERSION - reduce binary size bu removing unused features from simclist - Fix some warnings reported bu Coverity 1.4.4: - Add support of Gemalto Ezio Shield, Gemalto Ezio CB+, Gemalto Ezio Shield Secure Channel, Gemalto Ezio Shield PinPad and Gemalto Ezio Generic - Activate USB automatic power suspend. The Linux kernel should power off the reader automatically if it is not used (pcscd is not running). - Add support of TLV Properties wLcdMaxCharacters and wLcdMaxLines. They just duplicate wLcdLayout - some minor bugs removed 1.4.3: - Add support of Neowave Weneo, Vasco DIGIPASS 920, SCM SCL011, Feitian ePass2003 readers - use :libudev: instead of :libhal: naming scheme. - Do not install RSA_SecurID_getpasswd and Kobil_mIDentity_switch and the associated documentation. - the Secure Pin Entry of the HP USB Smart Card Keyboard is bogus so disable it - some minor bugs removed 1.4.2: - Add support of Feitian SCR310 reader (also known as 301v2), ACS APG8201 PINhandy 1, Oberthur ID-ONE TOKEN SLIM v2, new Neowave Weneo token, Vasco DIGIPASS KEY 860, Vasco DIGIPASS KEY 200, Xiring Leo v2, Xiring MyLeo, Aktiv Rutoken lite readers - Add back support of "bogus" Oz776, REINER SCT and BLUDRIVE II - Ease detection of OpenCT by pcsc-lite - disable use of interrupt card events for multi slots readers (the algorithm is bogus and can't be used) - fix minor problems detected by the clang tool - some minor bugs removed 1.4.1: - Add support of Gemalto Smart Guardian (SG CCID), ReinerSCT cyberJack RFID basis, Akasa AK-CR-03, BZH uKeyCI800-K18, Free Software Initiative of Japan Gnuk token readers - Remove O2 Micro Oz776 and Blutronics Bludrive II CCID since they are no more supported since version 1.4.0 - SecurePINVerify() & SecurePINModify(): Accept big and little endian byte orders for multibytes fields. The application should not use HOST_TO_CCID_16() and HOST_TO_CCID_32() any more and just use the normal byte order of the architecture. - Need pcsc-lite 1.6.5 for TAG_IFD_POLLING_THREAD_WITH_TIMEOUT - Add --enable-embedded (default is no) to build libccid for an embedded system. This will activate the NO_LOG option to disable logging and limit RAM and disk consumption. - Remove --enable-udev option since it is not used anymore with libhal. The udev rules file is now used to change the access rights of the device and not send a hotplug signal to pcscd. See http://ludovicrousseau.blogspot.com/2010/09/pcscd-auto-start.html - some minor bugs removed 1.4.0: - add support of Kingtrust Multi-Reader, Dectel CI692, Todos CX00, C3PO LTC36, ACS AET65, Broadcom 5880, Tianyu Smart Card Reader, Gemalto Hybrid Smartcard Reader - Add support of the SCM SDI 010 again. At least the contact interface can be used. - Use libusb-1.0 instead of libusb-0.1 - add support of TAG_IFD_STOP_POLLING_THREAD and use of the asynchronous libusb API to be able to stop a transfer. - Request pcsc-lite 1.6.2 minimum (instead of 1.6.0) to have TAG_IFD_STOP_POLLING_THREAD defined - The O2MICRO OZ776 patch (for OZ776, OZ776_7772, REINER_SCT and BLUDRIVEII_CCID) is no more supported with libusb-1.0 - correctly get the IFSC from the ATR (ATR parsing was not always correct) - some minor bugs removed
2012-12-14bump reversionpettai1-2/+2
2012-12-14A major version bump gives a long changelog...pettai16-212/+68
1.7.4: - Fix a stupid bug from the previous version. T=1 cards were not working. 1.7.3: - COPYING: Add my name as copyright holder - hotplug libudev: support libudev >= 171 - hotplug libusb: Fix a memory leak - pcscd: exit immediately in case of SIGTERM Closes Debian bug #620305 "pcscd slows down shutdown/restart" - Send logs to stdout instead of stderr It is now possible to use tee(1) to redirect logs in a file without first redirecting stderr to stdout - Add command line option -T, --color: force use of colored logs The idea is to have colored logs even if they are redirected to a file or a pipe. - Define g_rgSCardT?Pci as const structures to be more Windows like I do not expect a regression or compilation problem in WinSCard API users but how knows... - log at level PCSC_LOG_DEBUG instead of PCSC_LOG_ERROR to avoid filling the system log file - Remove the deprecated define FEATURE_MCT_READERDIRECT (replaced by FEATURE_MCT_READER_DIRECT) - better Hurd support - some other minor improvements and bug corrections 1.7.2: - fix a crash if a specific driver fails to work and no class driver is available 1.7.1 - use libudev only on Linux and libusb elsewhere. The configuration now works by default on GNU/kFreeBSD systems - Try to use a (CCID) class driver if a specific driver fails to use the reader. - fix a potential crash 1.7.0: - use libudev instead of (the deprecated) libhal 1.6.7: - better Mac OS X support - Fix Alioth bug [#312960] SCardDisconnect when other context has transaction - add support of multi-interfaces readers with libusb and not just libhal - add a API tracing feature in the client side (#define DO_TRACE) - allow the use of tracing and profiling features from different application threads - fix a problem with a multi-slots reader - fix minor problems detected by the clang tool - some other minor improvements and bug corrections 1.6.6: - SCardGetStatusChange(): fix a bug on 64-bits systems - Fix another bug because of a regression in internal list manager 1.6.5: - Power on the card _only_ if an application requests a connection. You can disable the feature using DISABLE_ON_DEMAND_POWER_ON in src/pcscd.h.in If DISABLE_AUTO_POWER_ON is defined then do not automatically power on the card. The card will be powered on on the first SCardConnect() See http://ludovicrousseau.blogspot.com/2010/10/card-auto-power-on-and-off.html - SCardReconnect(): return SCARD_E_NO_SMARTCARD when card is removed and SCARD_W_UNRESPONSIVE_CARD when card is unresponsive instead of SCARD_E_PROTO_MISMATCH - Install pcscd as sgid pcscd instead of suid root See http://ludovicrousseau.blogspot.com/2010/09/pcscd-auto-start.html - SCardSetTimeout() is no more provided. This function is not provided by Microsoft and is deprecated since 2004 in pcsc-lite. - SCardCancelTransaction() is no more provided. This function is not provided by Microsoft and is deprecated since 2005 in pcsc-lite. - Parsing the CCID Info.plist (159 readers supported) was, on a i386 machine, done in 264306 #s and is now done 5547 #s => gain x47 or 4600% See http://ludovicrousseau.blogspot.com/2010/08/ram-and-cpu-improvements-in-pcsc-lite.html - It is now possible to configure the local socket name to use using the environment variable PCSCLITE_CSOCK_NAME See http://ludovicrousseau.blogspot.com/2010/11/pcsc-client-and-server-on-two-different.html - Wait until all connected readers have a chance to power up a possibly inserted card before accepting clients. - restrict pcscd features when not run by root (so using suid): APDU logging or setting parameters are disabled for example - fix compilation problem on kfreebsd-* systems - PCSC/reader.h: HOST_TO_CCID_16() and HOST_TO_CCID_32() are now identity functions Since libccid 1.4.1 (revision 5252) the byte order is no more important - If you want to use IFDHCreateChannel() instead of IFDHCreateChannelByName() then do not use any DEVICENAME line in the configuration file. IFDHCreateChannel() will then be called with the CHANNELID parameter. - the CHANNELID parameter can also be a decimal number. - Remove the support of IFDHandler v1 API. I don't know any driver using this API. See http://ludovicrousseau.blogspot.com/2010/10/ifdhandler-version-1-support-removed.html - avoids a buffer overflow with badly formed ATR - some other minor improvements and bug corrections 1.6.4: - Do not use sysconfdir as configuration directory but "${sysconfdir}/reader.conf.d" instead. Use --enable-confdir=DIR if you want to set a specific value without the "reader.conf.d" appended. 1.6.3: - "/reader.conf.d" is only appended to sysconfdir if no value of sysconfdir is provided - Define LPSCARD_READERSTATE since this is used in the MSDN prototype. Use LPSCARD_READERSTATE in winscard.h instead of (SCARD_READERSTATE *) to mimic the MSDN API. - fix a pcscd crash when the application uses a PCSC handle after a fork. The crash was with openvpn. - some other minor improvements and bug corrections 1.6.2: - implement a "Forced suicide" mechanism. After 3 Ctrl-C without much reaction from pcscd (in fact the drivers) we force the suicide. Sometimes libusb is blocked in a kind of dead-lock and kill -9 was the only option. - Add support of TAG_IFD_STOP_POLLING_THREAD to request the stop of the driver polling function. - Avoid a division by 0. Closes [#312555] "simclist bug in pcsc-lite" - if pcscd is stared by libpcsclite then close all file handles except stdin, stdout and stderr so that pcscd does not confiscate ressources allocated by the application - in case of auto exit create a new session so that Ctrl-C on the application will not also quit pcscd - src/hotplug_libusb.c: port from libusb-0.1 to libusb-1.0 - default configuration is now $sysconfdir/reader.conf.d - fix crash with empty config dir - src/PCSC/winscard.h: Remove definitions of SCARD_READERSTATE_A PSCARD_READERSTATE_A and LPSCARD_READERSTATE_A types - some other minor improvements and bug corrections 1.6.1: - SCardControl(): do not check for card events since we are talking to the reader not the card. A smart card removal should not make SCardControl() fail with SCARD_W_REMOVED_CARD - pcscd do not timeout any more after 2 minutes of inactivity. If the other side of the socket dies we will get an error from the kernel. The problem was that if a client does nothing during PCSCLITE_READ_TIMEOUT (120 seconds by default) then pcscd considers it as a dead client and closes the connection. I guess this problem was present since the first version of pcsc-lite but nobody complained before. - pcscd: do not return before most of the initialisation are done correctly. The idea is that pcscd can return an error code if the daemon fails to start correctly (hald not started for example). Before the patch pcscd became a daemon, then returned 0 (success) and then continued with the initialisation. If the initialisation failed it was too late to return an error code. The /etc/init.d/pcscd script was not aware of the failure. Closes https://bugzilla.redhat.com/show_bug.cgi?id=580321 "/usr/sbin/pcscd exit codes broken" - src/hotplug_libusb.c: Add a synchronisation so that if pcscd is auto started the initial reader list is available before the server takes commands from clients. Before the change early calls of SCardListReaders() returned an empty list of readers even if a reader was connected. - SCardConnect() & SCardReconnect(): do not reset the cardProtocol in SCARD_SHARE_DIRECT case since the card have _not_ been reseted. A new PPS negociation would fail. - Do not install files in /etc any more. Serial drivers are rare now. - Avoids a crash if a client sends a unknown command. - some other minor improvements and bug corrections 1.6.0: - redesign the client/server communication: * no more shared memory used (allow pcscd and libpcsclite1.so to be on different computer and talk over a network) * no more difference between short and extended APDU * no more use of a /var/run/pcscd/pcscd.events/ directory. events are sent through the socket * simpler command format between client and server The side effect is that you are not able to mix an old pcscd with a new libpcsclite1.so or the reverse. SCardEstablishContext() will fail unless you update both sides of the communication. - Use lists instead of fixed size arrays to store handles. It is now possible to have: - 200 simultaneous PC/SC clients instead of 16 - 200 SCardConnect per client instead of 16 - 200 clients per reader instead of 16 The default value of 200 can be changed by giving an argument to pcscd --max-thread --max-card-handle-per-thread --max-card-handle-per-reader - Make SCardReconnect(), SCardStatus() and SCardTransmit() block instead of returning SCARD_E_SHARING_VIOLATION immediately. These functions will then behave like on Windows. This can happen if these functions are called when the reader is locked by a PCSC transaction (SCardBeginTransaction/SCardEndTransaction). You can define the environment variable PCSCLITE_NO_BLOCKING to use the old behavior. http://archives.neohapsis.com/archives/dev/muscle/2010-q1/0041.html - SCardEstablishContext(): try to start the pcscd daemon if not already running. . pcscd will suicide itself after 60 seconds of inactivity if it is started using --auto-exit. This is the default behavior when pcscd is started by libpcsclite . Set PCSCLITE_PCSCD_ARGS with the argument you want to pass to pcscd in autostart Only one argument is passed. The space character is not a separator. example: export PCSCLITE_PCSCD_ARGS=-dfa - SCardListReaders(): can use SCARD_AUTOALLOCATE - SCardGetAttrib(): return SCARD_E_INSUFFICIENT_BUFFER if the driver returns IFD_ERROR_INSUFFICIENT_BUFFER . add support of SCARD_ATTR_DEVICE_FRIENDLY_NAME as it is better implemented in pcscd (it knows the friendly name) - SCardGetStatusChange(): Calling with cReaders == 0 will now just return SCARD_S_SUCCESS . Use the special reader name "\\?PnP?\Notification" to wait for a reader event notification - SCardTransmit(): do not limit the minimum size of an APDU to 4 bytes. non ISO 7816-4 compliant cards (like Mifare DESFIRE) may use shorter commands - SCardStatus(): returns SCARD_E_SHARING_VIOLATION if the reader is already used More conform to Windows - PCSC/reader.h: update sruct PIN_PROPERTIES_STRUCTURE to be conform with Revision 2.02.06, April 2009 of PCSCv2 part 10 Fields wLcdMaxCharacters and wLcdMaxLines have been removed . rename FEATURE_MCT_READERDIRECT in FEATURE_MCT_READER_DIRECT to be conform with ch. 2.3 of PCSC v2 part 10 . add FEATURE_GET_TLV_PROPERTIES and FEATURE_CCID_ESC_COMMAND from PC/SC part 10 v2.02.07 March 2010 . Add PCSCv2_PART10_PROPERTY_* defines - SCardControl() return SCARD_E_UNSUPPORTED_FEATURE if the driver returned IFD_ERROR_NOT_SUPPORTED or IFD_NOT_SUPPORTED This is used to separate an unsupported value of ControlCode from a general error - Use the standard --sysconfdir=DIR ($prefix/etc by default) instead of --enable-confdir=DIR for defining the directory containing reader.conf - remove SCF support (PC/SC over Smart Card Framework). I never used this feature and SCF is now dead and replaced by JSR 268 (javax.smartcardio) - Better handling of PCSCLITE_STATIC_DRIVER as can be used on platforms using #Clinux (without dynamic loader). This is used to statically link the reader driver to pcscd. Since the link is static you must define the IFDHandler API version at compilation time. Either define IFDHANDLERv1, IFDHANDLERv2 or IFDHANDLERv3 - Use dynamic instead of static allocation for the driver library filename. The filename is no more limited to 100 characters. Closes: [#312332] MAX_LIBNAME too short? - force the return codes SCARD_* to be long since the SCard* functions return a LONG type - Add the ability to parse all the configuration files of a directory instead of just one configuration file. update-reader.conf is then now obsolete. - Add --enable-embedded (default is no) to build pcsc-lite for an embedded system. This will activate the NO_LOG option to disable logging and limit RAM and disk consumption. - If NO_LOG is defined then no log are displayed. The idea is to limit the binaries size on disk and RAM consumption at execution time. With NO_LOG defined we gain 26% (17 kB) for the .text segment of pcscd and 15% (4 kB) for the .text segment of libpcsclite.so (for i386) - Define a minimal pcsc_stringify_error() if NO_LOG is defined. Only the error code in hex is displayed in this case. Gain: 2kB of .text (10%) for libpcsclite - Add --disable-serial and --disable-usb options --disable-serial removes support of /etc/reader.conf gain: 8.0kB of .text (12%) and 160 bytes of .bss (4%) for pcscd --disable-usb removes support of USB hotplug gain: 9.7kB of .text (14%) and 960 bytes of .bss (23%) for pcscd If you use both options (and use a static driver configuration) gain: 17.7kB of .text (26%) and 1152 bytes of .bss (28%) for pcscd - Better support of Android - some other minor improvements and bug corrections
2012-12-12- ssh2.wiz1-2/+1
2012-12-12"Hygiene demands it."gendalia41-1633/+0
Sources are from 2003, current tectia client/server has vulnterabilities, there are no security eyes on this version.
2012-12-12Fix build.ryoon1-1/+3
For man pages generation, xsltproc from textproc/libxslt is needed. Thank you, joerg@.
2012-12-11+polarsslgdt1-1/+2
2012-12-11Import polarssl-1.2.0 as security/polarssl.gdt6-0/+144
PolarSSL is an SSL library written in ANSI C. PolarSSL makes it easy for developers to include cryptographic and SSL/TLS capabilities in their (embedded) products with as little hassle as possible. It is designed to be readable, documented, tested, loosely coupled and portable. This package includes headers/libs only, not the demo programs. PolarSSL is GPLv2, but offers exceptions to be distributed with other works licensed as Apache, BSD, CC0, EUPL, LGPL, ISC, WTFPL, X11, zlib/libpng.
2012-12-05OpenDNSSEC 1.3.12 - 2012-12-03pettai2-7/+7
Bugfixes: * SUPPORT-42: ./configure fails on FreeBSD (or if ldns is not installed in a directory in the default search path of the complier). * OpenDNSSEC does not compile against ldns 1.6.16 on platforms that rely on the OpenDNSSEC implementation of strlcpy/cat
2012-12-03Update to 0.6.20.gdt2-7/+6
New in 0.6.20; 2010-02-16; Andreas Jellinghaus * Modify Rutoken S binary interfaces by Aktiv Co. * Makefiles fixed in doc/ directory New in 0.6.19; 2010-01-07; Andreas Jellinghaus * update on udev rules. Please now use udev instead of hal, as distributions are deprecating hal in favor for udev. * Thanks to Daniel Kahn Gillmor for testing on debian.
2012-12-03Make cardreader package choice an option group.gdt1-4/+5
No functional change, other than building with both or neither cardreader package will error from the options framework instead of at configure time.
2012-12-03Merge Makefile.common into Makefile, because opensc-signer is gone.gdt2-32/+28
This does not make any functional changes - it is just rearranging and comments.
2012-11-30Add libsecretryoon1-1/+2
2012-11-30Import libsecret-0.12 as security/libsecret.ryoon5-0/+126
libsecret is a library for storing and retrieving passwords and other secrets. It communicates with the "Secret Service" using DBus. gnome-keyring and ksecretservice are both implementations of a Secret Service.
2012-11-30Update to 0.12.2.gdt20-387/+137
Thanks to manu@ for testing and resolving pcsc-lite ptthread leakage problems. Note that pcsc-lite and openct should be an options group. Disable some obsolete CONFIGURE_ARGS. Work around assumption that either getopt_long_only is present or allgetopt functions must be provided. Finnish EID patches have been applied upstream (from whence they came, perhaps). From upstream NEWS: Complete change history is available online: http://www.opensc-project.org/opensc/timeline New in 0.12.2; 2011-07-15 * Builds are now silent by default when OpenSC is built from source on Unix. * Using --wait with command line tools works with 64bit Linux again. * Greatly improved OpenPGP card support, including OpenPGP 2.0 cards like the one found in German Privacy Foundation CryptoStick. * Fixed support for FINeID cards issued after 01.03.2011 with 2048bit keys. * #256: Fixed support for TCOS cards (broken since 0.12.0). * Added support for IDKey-cards to TCOS3 driver. * #361: Improved PC/SC driver to fetch the maximum PIN sizes from the open source CCID driver. This fixes the issue for Linux/OSX with recent driver. * WindowsInstaller now installs only static DLL-s (PKCS#11, minidriver) to system folder. * Fix FINeID cards for organizations. * Several smaller bugs and compiler warnings fixed. New in 0.12.1; 2011-05-17 * New card driver: IAS/ECC 1.0.1 * rutoken-tool has been deprecated and removed. * eidenv and piv-tool utilities now have manual pages. * pkcs11-tool now requires the use of --module parameter. * All tools can now use an ATR as an argument to --reader, to skip to the card with given ATR. * opensc-tool -l with -v now shows information about the inserted cards. * Creating files have an enforced upper size limit, 64K * Support for multiple PKCS#15 applications with different AID-s. PKCS#15 applications can be listed with pkcs15-tool --list-applications. Binding to a specific AID with PKCS#15 tools can be done with --aid. * Hex strings (like card ATR or APDU-s) can now be separated by space, in addition to colons. * Pinpad readers known to be bogus are now ignored by OpenSC. At the moment only "HP USB Smart Card Keyboard" is disabled. * Windows installer is now distributed as a statically built MSI, for both x86 and x64. * Numerous compiler warnings, unused code and internal bugs have been eliminated. New in 0.12.0; 2010-12-22 * OpenSC uses a single reader driver, specified at compile time. * New card driver: Italian eID (CNS) by Emanuele Pucciarelli. * New card driver: Portuguese eID by João Poupino. * New card driver: westcos by François Leblanc. * pkcs11-tool can use a slot based on ID, label or index in the slot list. * PIN flags are updated from supported cards when C_GetTokenInfo is called. * Support for CardOS 4.4 cards added. * Fature to exclude readers from OpenSC PKCS#11 via "ignored_readers" configuration file entry. * #229: Support semi-automatic fixes to cards personalized with older and broken OpenSC versions. * Software keys removed from pkcs15-init and the PKCS#11 module. OpenSC can either generate keys on card or import plaintext keys to the card, but will never generate plaintext key material in software by itself. All traces of a software token (PKCS#15 Section 7) shall be removed. * Updates to PC/SC driver to build with pcsc-lite >= 1.6.2 * Build script for a binary Mac OS X installer for 10.5 and 10.6 systems. Binary installer includes OpenSC.tokend for platform integration. 10.6 installer includes engine_pkcs11. * Modify Rutoken S binary interfaces by Aktiv Co. * Support GOST R 34.10-2001 and GOST R 34.11-94 by Aktiv Co. * CardOS driver now emulates sign on rsa keys with sign+decrypt usage with padding and decrypt(). This is compatible with old cards and card initialized by Siemens software. Removed "--split-key" option, as it is no longer needed. * Improved debugging support: debug level 3 will show everything except of ASN1 and card matching debugging (usualy not needed). * Massive changes to libopensc. This library is now internal, only used by opensc-pkcs11.so and command line tools. Header files are no longer installed, library should not be used by other applications. Please use generic PKCS#11 interface instead. * #include file statements cleaned up: first include "config.h", then system headers, then additional libraries, then headers in opensc (but from other directories), then header files from same directory. Fix path to reference headers, remove src/include/ directory. * Various source code fixes and improvements. * OpenSC now depends on xsltproc utility and docbook-xsl to build docs and man * Remove iconv dependency. EstEID driver now uses the commonName from the certificate for card label. * Possibility to change the default behavior for card resets via opensc.conf.
2012-11-30Don't pass pthread flags to depending packages.gdt8-15/+89
This is necessary to avoid making opensc threaded, since then it can't be dlopened by a non-threaded program. Add patch comments. Set LICENSE (modified-bsd, verified via wdiff). This change is almost entirely due to manu@.
2012-11-29patch-gssftp_ftp_ftp_var.h rewrittenadam2-10/+32
2012-11-29Remove obsolete package opensc-signer.gdt3-33/+0
Upstream has removed the code that this package uses, as upstream believes there are no users. (Proposed on pkgsrc-users with no objections.)
2012-11-29-opensc-signer, about to be removed.gdt1-2/+1
2012-11-27Update security/py-paramiko to 1.9.0.gls4-9/+12
Fix a tyop in DESCR. Upstream changes: ----------------- v1.9.0 (6th Nov 2012) --------------------- * #97 (with a little #93): Improve config parsing of `ProxyCommand` directives and provide a wrapper class to allow subprocess-driven proxy commands to be used as `sock=` arguments for `SSHClient.connect`. * #77: Allow `SSHClient.connect()` to take an explicit `sock` parameter overriding creation of an internal, implicit socket object. * Thanks in no particular order to Erwin Bolwidt, Oskari Saarenmaa, Steven Noonan, Vladimir Lazarenko, Lincoln de Sousa, Valentino Volonghi, Olle Lundberg, and Github user `@acrish` for the various and sundry patches leading to the above changes. v1.8.1 (6th Nov 2012) --------------------- * #90: Ensure that callbacks handed to `SFTPClient.get()` always fire at least once, even for zero-length files downloaded. Thanks to Github user `@enB` for the catch. * #85: Paramiko's test suite overrides `unittest.TestCase.assertTrue/assertFalse` to provide these modern assertions to Python 2.2/2.3, which lacked them. However on newer Pythons such as 2.7, this now causes deprecation warnings. The overrides have been patched to only execute when necessary. Thanks to `@Arfrever` for catch & patch. v1.8.0 (3rd Oct 2012) --------------------- * #17 ('ssh' 28): Fix spurious `NoneType has no attribute 'error'` and similar exceptions that crop up on interpreter exit. * 'ssh' 32: Raise a more useful error explaining which `known_hosts` key line was problematic, when encountering `binascii` issues decoding known host keys. Thanks to `@thomasvs` for catch & patch. * 'ssh' 33: Bring `ssh_config` parsing more in line with OpenSSH spec, re: order of setting overrides by `Host` specifiers. Specifically, the overrides now go by file order instead of automatically sorting by `Host` value length. In addition, the first value found per config key (e.g. `Port`, `User` etc) wins, instead of the last. Thanks to Jan Brauer for the contribution. * 'ssh' 36: Support new server two-factor authentication option (`RequiredAuthentications2`), at least re: combining key-based & password auth. Thanks to Github user `bninja`. * 'ssh' 11: When raising an exception for hosts not listed in `known_hosts` (when `RejectPolicy` is in effect) the exception message was confusing/vague. This has been improved somewhat. Thanks to Cal Leeming for highlighting the issue. * 'ssh' 40: Fixed up & expanded EINTR signal handling. Thanks to Douglas Turk. * 'ssh' 15: Implemented parameter substitution in SSHConfig, matching the implementation of `ssh_config(5)`. Thanks to Olle Lundberg for the patch. * 'ssh' 24: Switch some internal type checking to use `isinstance` to help prevent problems with client libraries using subclasses of builtin types. Thanks to Alex Morega for the patch. * Fabric #562: Agent forwarding would error out (with `Authentication response too long`) or freeze, when more than one remote connection to the local agent was active at the same time. This has been fixed. Thanks to Steven McDonald for assisting in troubleshooting/patching, and to GitHub user `@lynxis` for providing the final version of the patch. * 'ssh' 5: Moved a `fcntl` import closer to where it's used to help avoid `ImportError` problems on Windows platforms. Thanks to Jason Coombs for the catch + suggested fix. * 'ssh' 4: Updated implementation of WinPageant integration to work on 64-bit Windows. Thanks again to Jason Coombs for the patch. * Added an IO loop sleep() call to avoid needless CPU usage when agent forwarding is in use. * Handful of internal tweaks to version number storage. * Updated `setup.py` with `==dev` install URL for `pip` users. * Updated `setup.py` to account for packaging problems in PyCrypto 2.4.0 * Added an extra `atfork()` call to help prevent spurious RNG errors when running under high parallel (multiprocess) load. * Merge PR #28: https://github.com/paramiko/paramiko/pull/28 which adds a ssh-keygen like demo module. (Sofian Brabez) v1.7.7.2 16may12 ---------------- * Merge pull request #63: https://github.com/paramiko/paramiko/pull/63 which fixes exceptions that occur when re-keying over fast connections. (Dwayne Litzenberger)
2012-11-26SoftHSM 1.3.4 - 2012-11-24pettai2-6/+6
* SOFTHSM-28: Support RSASSA-PSS signature scheme. * SOFTHSM-29: The default location of the token database is now $localstatedir/lib/softhsm/.
2012-11-23Fix missing prototypes and return values and other goodies, so that itjoerg3-1/+70
passes -Werror with clang.
2012-11-23make provided/required versions match exactly - it seems that newerdrochner3-3/+16
tcl versions are more strict about this, should fix PR pkg/47186 by Joern Clausen bump PKGREV being here, set LICENSE (same as tcl)
2012-11-22Update to 1.10.gdt2-8/+13
Change MASTER_SITE, and therefore fetch with curl. Specify C99, after guessing that from warnings. Enable extra warnings (reported upstream). 2012-02-29 - Version 1.10 * PolarSSL crypto engine by Adriaan de Jong * build: --disable-crypto-engine-win32 renamed to --disable-crypto-engine-cryptoapi * api: PKCS11H_FEATURE_MASK_ENGINE_CRYPTO_WIN32 renamed to PKCS11H_FEATURE_MASK_ENGINE_CRYPTO_CRYPTOAPI. * api: PKCS11H_ENGINE_CRYPTO_WIN32 renamed to PKCS11H_ENGINE_CRYPTO_CRYPTOAPI 2011-08-16 - Version 1.09 * Do not retry if CKR_BUFFER_TOO_SMALL and none NULL target. * Fixup OpenSSL engine's rsa_priv_enc to use RSA size output buffer.
2012-11-21Take maintainership.gdt1-2/+2
2012-11-19Version 1.9.0 (released 2012-11-08)pettai4-10/+11
* ykinfo: New tool to print information about YubiKey. * ykpersonalize: Add -z flag to zap configuration on YubiKey. * Fix PBKDF2 implementation.
2012-11-19Mark a function void that never returns a value. Provide proper returnjoerg4-3/+79
values if in non-void functions.
2012-11-18Drop superfluous PKG_DESTDIR_SUPPORT, "user-destdir" is default these days.asau1-3/+1
2012-11-15When getting a file basename strip any leading directories.sbd3-3/+19
2012-11-13OpenDNSSEC 1.3.11pettai2-6/+6
* OPENDNSSEC-330: NSEC3PARAM TTL should be set to zero. Bugfixes: * OPENDNSSEC-306: Cant delete zone until Enforcer made signerconf. * OPENDNSSEC-281: Commandhandler sometimes unresponsive. * OPENDNSSEC-299: ods-ksmutil <enter> now includes policy import * OPENDNSSEC-300: ods-ksmutil policy purge documented with a warning * OPENDNSSEC-338: ods-ksmutil: fix zone delete on MySQL (broken by SUPPORT-27) * OPENDNSSEC-342: Auditor comparisons made case-insensitive * OPENDNSSEC-345: ods-ksmutil: use ods-control to HUP the enforcerd process
2012-11-10Added otptoolpettai1-1/+2
2012-11-10Otptool is a client utility for two-factor authentication using one-timepettai5-0/+71
passwords (OTP) generated via the HOTP/OATH algorithm defined in RFC 4226.
2012-11-10Version 1.8.2 (released 2012-10-17)pettai3-7/+9
* Add udev rules files to packed distribution. Version 1.8.1 (released 2012-10-17) * Memory leak fixes and potential crash fixes in osx backend. * Error reporting fixes in osx backend, reporting correct errors and better errors. * Provide new another udev permissions file that works on udev version greater than 188. Autodetects from configure which to use. * Add new binary ykinfo, can be used to get serial number, version and touch level from a YubiKey. Version 1.8.0 (released 2012-09-28) * Added ./configure --enable-gcc-warnings to enable a lot of warnings. * Added Continuous integration at travis-ci (http://travis-ci.org/#!/Yubico/yubikey-personalization) * Added yk_challenge_response() function for doing challenge response with a key. * Fixed functions for NDEF writing, adding: ykp_ndef_alloc(), ykp_ndef_free() and ykp_set_ndef_access_code() also providing compatible name YK_NDEF in ykcore.h and exporting yk_write_ndef() there. Change return values from ndef_construct_*() functions to make them consistent with the rest of the library. * Fixed a crash bug when the library was called from different threads. * Check return code from libusb_init() so we avoid crashing there. Also use a usb context instead of relying on default. * Fix numerous warnings. * Fix compilation in MSVC2010. Version 1.7.0 (released 2012-06-07) * Add support for new features in YubiKey 2.3: ALLOW_UPDATE flag that allows updating of configuration in slots. Update command (-u) to do update of existing config. Swap command (-x) to swap contents of two updatable slots DORMANT flag that's settable/removable if ALLOW_UPDATE is set USE_NUMERIC_KEYPAD flag for sending the OATH OTP using keypad scan codes instead FAST_TRIG flag for faster triggering of slot one if slot two is empty * Change the library around some to make the 2.3 features available. Use ykp_alloc() instead of ykp_create_config(). Use ykp_configure_version() instead of ykp_configure_for() to set the version. Use ykp_configure_command() instead of ykp_configure_for() to set slot. Use yk_write_command() instead of yk_write_config(). The new commands doesn't set any default configuration at all. * Add library support for the YubiKey NEO beta ykp_construct_ndef_uri() for preparing a URI to write. ykp_construct_ndef_text() for preparing a text to write. yk_write_ndef() to write the constructed NDEF. * Add support for the YubiKey NEO beta Writing NDEF URI with -n http://example.com/foo/ Writing NDEF Text record with -t example
2012-11-10Version 2.9 (released 2012-08-07)pettai2-6/+6
* Compability with curl versions before 7.20. * Fix signature checking on ARM (at least).
2012-11-10Version 1.12.6 (released 2012-09-04)pettai5-21/+22
* liboath: The usersfile is now fflush'ed and fsync'ed. * liboath: A memory leak fixed. * oathtool: The --counter parameter now works on 32-bit platforms. * API and ABI is backwards compatible with the previous version. OATH_FILE_FLUSH_ERROR: Added. OATH_FILE_SYNC_ERROR: Added. OATH_FILE_CLOSE_ERROR: Added. OATH_LAST_ERROR: Added. Version 1.12.5 (released 2012-08-19) * oathtool: The --counter parameter now supports larger values. Before it used an 'int' type and now it uses a 'longlong' type. Needed for eSecuTech tokens as they use a 64-bit value for their initial counter. see <https://savannah.nongnu.org/support/?108114>. * Added gnulib self-tests. * API and ABI is backwards compatible with the previous version. Version 1.12.4 (released 2012-06-17) * liboath: Usersfile code handles multiple lines for a single user. This can be used when a single user carries multiple tokens (with different OATH secrets) and any of them should be permitted. * API and ABI is backwards compatible with the previous version. Version 1.12.3 (released 2012-05-31) * pam_oath: Fix "try_first_pass". * API and ABI is backwards compatible with the previous version. Version 1.12.2 (released 2012-04-04) * liboath: usersfile function now works on FreeBSD. * tests: liboath usersfile self-test is skipped if there is no datefudge. * API and ABI is backwards compatible with the previous version. Version 1.12.1 (released 2012-04-01) * liboath, oathtool: Base32 decoding now permit lowercase characters. * API and ABI is backwards compatible with the previous version. Version 1.12.0 (released 2012-04-01) * oathtool: Added --base32 parameter to decode base32 keys. * oathtool: Verbose output (-v) now print key data in base32 format too. * liboath: Added base32 functions. Added hex encoding function. The new APIs are oath_bin2hex, oath_base32_decode, and oath_base32_encode. * liboath: Gnulib's snprintf is used for better portability. The system snprintf is known to have bugs on some systems, see the Gnulib manual for more information. * API and ABI is backwards compatible with the previous version. oath_bin2hex: New function. oath_base32_decode: New function. oath_base32_encode: New function. OATH_INVALID_BASE32: New error code. OATH_BASE32_OVERFLOW: New error code. OATH_MALLOC_ERROR: New error code.
2012-11-101.1.4pettai7-40/+72
- Fix X-HKP-Results-Count so that limit=0 returns no results, but include the header, to let a client poll for how many results exist, without retrieving any. See: http://lists.nongnu.org/archive/html/sks-devel/2010-11/msg00015.html - Add UPGRADING document to explain upgrading Berkeley DB without rebuilding. System bdb versions often change with new SKS releases for .deb and .rpm distros. - Cleanup build errors for bdb/bdb_stubs.c. Patch from Mike Doty - Update cryptokit from version 1.0 to 1.5 without requiring OASIS build system or other additional dependencies - build, fastbuild, & pbuild fixed to ignore signals USR1 and USR2 - common.ml and reconSC.ml were using different values for minumimum compatible version. This has been fixed. - Added new server mime-types, and trying another default document (Issue 6) In addition to the new MIME types added in 1.1.[23], the server now looks over a list and and serves the first index file that it finds Current list: index.html, index.htm, index.xhtml, index.xhtm, index.xml. - options=mr now works on get as well as (v)index operations. This is described in http://tools.ietf.org/html/draft-shaw-openpgp-hkp-00 sections 3.2.1.1. and 5.1. - Updated copyright notices in source files - Added sksclient tool, similar to old pksclient - Add no-cache instructions to HTTP response (in order for reverse proxies not to cache the output from SKS) - Use unique timestamps for keydb to reduce occurrances of Ptree corruption. - Added Interface specifications (.mli files) for modules that were missing them - Yaron pruned some no longer needed source files from the tree. - Improved the HTTP status and HTTP error codes returned for various situations and added checks for more error conditions. - Add a suffix to version (+) indicating non-release or development builds - Add an option to specify the contact details of the server administrator that shows in the status page of the server. The information is in the form of an OpenPGP KeyID and set by server_contact: in sksconf - Add a `sks version` command to provide information on the setup. - Added configuration settings for the remaining database table files. If no pagesize settings are in sksconf, SKS will use 2048 bytes for key and 512 for ptree. The remainining files' pagesize will be set by BDB based on the filesystem settings, typically this is 4096 bytes. See sampleConfig/sksconf.typical for settings recommended by db_tuner. - Makefile: Added distclean target. Dropped autogenerated file from VCS. - Allow tuning BDB environment before creation in [fast]build and pbuild. If DB_CONFIG exists in basedir, copy it to DB dir before DB creation. Preference is given to DB_CONFIG.KDB and DB_CONFIG.PTree over DB_CONFIG. - Add support for Elliptic Curve Public keys (ECDSA, ECDH) - Add check if an upload is a revocation certificate, and if it is, produce an error message tailored for this. 1.1.3 - Makefile fix for 'make dep' if .depend does not exist. Issue #4 - Makefile fix: sks and sks_add_mail fail to link w/o '-ccopt -pg' Issue #23 - Added -disable_mailsync and -disable_log_diffs to sks.pod - Added file extensions .css, .jpeg, .htm, .es, .js, .xml, .shtml, .xhtm, .xhtml and associated MIME types to server code. Part of Issue #6 - Added sample configuration files in sampleConfig directory - Added sample web page files in sampleWeb directory. Issues #7, 9, 19 - Allow requests for non-official options hget, hash, status, & clean to be preceded by '-x'. Closes issues #10, 11, 13, & 14. - Allow &search with long subkey ID (16 digit) and subkey fingerprint subkey lookup was failing with other than a short key ID. However, public key lookup was working with short and long key ID and fingerprints. This patch makes subkey lookup behave the same as full key lookup. http://lists.gnupg.org/pipermail/gnupg-users/2012-January/043495.html - Patch recon script so that POST includes HTTP version number.
2012-11-08Update crudesaml to 1.4: fix build problemsmanu4-10/+8
2012-11-07Bump PKGREVISION for patch replacements.wiz1-1/+2
2012-11-07Use upstream version of dlerror() fix.wiz3-20/+28
2012-11-07Don't use nested functions. Bump revision.joerg3-15/+63
2012-11-07Remove it-seems-unneeded FreeBSD changes that were long commented out.wiz1-12/+1
2012-11-07Use just committed upstream change addressing c99 inline semantics.wiz4-67/+31
2012-11-07+ kpcliwiz1-1/+2
2012-11-07Import kpcli-1.5 as security/kpcli.wiz4-0/+44
A command line interface (interactive shell) to work with KeePass 1.x and 2.x database files.
2012-11-07+ p5-File-KeePasswiz1-1/+2
2012-11-07Import p5-File-KeePass-2.03 as security/p5-File-KeePass.wiz3-0/+40
File::KeePass gives access to KeePass version 1 (kdb) and version 2 (kdbx) databases. The version 1 and version 2 databases are very different in construction, but the majority of information overlaps and many algorithms are similar. File::KeePass attempts to iron out as many of the differences. File::KeePass gives nearly raw data access. There are a few utility methods for manipulating groups and entries. More advanced manipulation can easily be layered on top by other modules. File::KeePass is only used for reading and writing databases and for keeping passwords scrambled while in memory. Programs dealing with UI or using of auto-type features are the domain of other modules on CPAN. File::KeePass::Agent is one example.
generated by cgit v1.2.3 (git 2.39.1) at 2025-02-13 02:17:32 +0000