summaryrefslogtreecommitdiff
path: root/security
AgeCommit message (Collapse)AuthorFilesLines
2006-01-21Update package Makefile now that bsd.pkg.extract.mk is using thejlam2-4/+2
"extract" script for extraction. Many cases where a custom EXTRACT_CMD simply copied the distfile into the work directory are no longer needed. The extract script also hides differences between pax and tar behind a common command-line interface, so we no longer need code that's conditional on whether EXTRACT_USING is tar or pax.
2006-01-20long != time_t on x86_64; add patch trying to fix resulting build problem.wiz2-1/+23
2006-01-20Drop trailing whitespace.wiz1-2/+2
2006-01-20Changes 1.3.3:adam5-13/+15
** New API to access the TLS master secret. When possible, you should use the TLS PRF functions instead. ** Improved handling when multiple libraries use GnuTLS at the same time. Now gnutls_global_init() can be called multiple times, and gnutls_global_deinit() will only deallocate the structure when it has been called as many times as gnutls_global_init() was called. ** Added a self test of TLS resume functionality. ** Fix crash in TLS resume code, caused by TLS/IA changes. ** Add 'const' keywords in various places, from Frediano ZIGLIO. ** The code was indented again, including the external header files. ** API and ABI modifications: New functions to retrieve the master secret value: gnutls_session_get_master_secret Add a 'const' keyword to existing API: gnutls_x509_crq_get_challenge_password
2006-01-20Use x11.b3.mk instead of setting USE_X11BASE. Suggested by wiz@joerg1-3/+2
2006-01-20Always set USE_X11BASE, which is needed when neither GTK nor Qt isjoerg1-2/+4
specified. Bump revision due to changed dependencies.
2006-01-20Complete move of p5-SSLeay to p5-Crypt-SSLeaywiz6-86/+2
2006-01-20Re-import security/p5-SSLeay as security/p5-Crypt-SSLeay, towiz5-0/+84
make the directory name match PKGNAME.
2006-01-20Drop maintainership. I can't seriously be the maintainer of so manyjmmv3-6/+6
packages - specially of packages that I haven't touched for a long while or those that other people can handle better than me.
2006-01-20Fix GCC 3.4+: __FUNCTION__ doesn't permit string concat, like __func__.joerg2-5/+45
2006-01-20Fix errno.joerg2-1/+14
2006-01-20Patch configure's libtool.m4 fragment for DragonFly.joerg2-1/+40
2006-01-20va_arg has to consider int promotion of char.joerg2-1/+15
2006-01-20Use sa_family_t hack only on NetBSD, other platforms might be addedjoerg2-4/+4
later if necessary.
2006-01-20Try to catch up with OpenSSL 0.9.8 API.joerg2-1/+24
2006-01-19DragonFly support.joerg2-14/+18
2006-01-19Prefer NAME_MAX over MAXNAMLEN.joerg2-1/+18
2006-01-19limits.h is ISO C, unconditionally include it. Keep conditional forjoerg2-1/+17
sys/syslimits.h though.
2006-01-19Add DragonFly support.joerg2-1/+15
2006-01-19Remove unnecessary DECOMPRESS_CMD setting, which is automatically takenjlam1-2/+1
care if in bsd.pkg.extract.mk based on the EXTRACT_SUFX.
2006-01-18Update to 1.8adrianp3-14/+14
Grab maintainership From the ChangeLog (Summarised) > * ike-backoff-patterns: Added backoff patterns for Netgear ProSafe > and Netgear ADSL Firewall Router. Submitted by Paul Askew. > * ike-scan.c, ike-scan.h, configure.ac: Added new --writepkttofile > option. This option writes the output packet to the specified file > rather than sending it to the remote host. It is intended for > debugging and testing purposes, to allow the IKE packet to be > easily checked. This option is not documented, because it is > designed purely for testing. > * check-packet: New test to check IKE scan packet data. Currently > tests two sample packets: one default proposal, and one custom > proposal. > * ike-scan.c: Added --exchange option to allow the exchange field > in the ISAKMP header to be set to arbitrary values. > * ike-scan.c, isakmp.c: Added --hdrflags and --hdrmsgid options to > allow Flags and MsgID fields in the ISAKMP header to be specified. > * ike-scan.c: Added --cookie option to allow the initiator cookie in > the ISAKMP header to be set to a static value. > * ike-scan.c, isakmp.c: Add --spisize option to allow a random SPI > of the specified size to be added to the proposal payload. > * ike-vendor-ids: Added 16 new Vendor IDs, and revised some comments > on existing entries. > * ike-scan.c: Added --doi (-D) and --situation (-S) options to allow > the DOI and Situation in the SA of the outbound packets to be changed > from the default of DOI_IPSEC and SIT_IDENTITY_ONLY. > * ike-scan.c: Added --protocol (-j) and --transid (-k) options to > allow the proposal protocol and transform id of the outbound packets > to be changed from the defaults. > * ike-scan.c: Added --certreq (-C) option to add a > CertificateRequest payload to the outgoing packet. > * ike-scan.c: Added --headerlen (-L) option to allow the ISAKMP header > length to be manually specified. Normally, ike-scan will > automatically calculate the correct length; however, you can use this > option if you want to use an incorrect length value instead. > * ike-scan.c, isakmp.c: Added --mbz (-Z) option to allow the value for > the reserved (MBZ) fields to be set to non-zero values. Doing so > will make the outgoing packet non-RFC compliant. > * ike-scan.c, isakmp.c: Added --headerver (-E) option to allow the > version field in the ISAKMP header to be altered from the default of > 0x10 (v1.0). > * ike-scan.c: Added --bandwidth (-B) option to allow the outgoing > bandwidth to be specified directly instead of using --interval. > The --bandwidth option calculates the appropriate interval setting, > taking into account the size of the packet. > * ike-scan.c: Added --noncelen (-c) option to allow the length of the > nonce data to be changed. This is only applicable to aggressive > mode.
2006-01-15Updated to version 4.40.heinz4-29/+33
This fixes PR pkg/30290 by Nicolas Joly so the latest DAT files are working again. - Moved included DAT-files to shares/examples/uvscan/. - Works with PKG_CONFIG=no. - PDF manual included in share/doc/uvscan/. - Some small improvements to update_dat.sh: Option "-h" shows the available options. All the "exit" statements use distinct values. Fixed a small logic bug (-z vs. -n). Changes according to McAfee's website: - Includes technology to combat the latest and future threats. - Improved detection and cleaning. - Support for many more Packed Executable formats in which known malware is often re-packaged for obfuscation purposes. - Specific detection and reporting of files compressed or packaged with known suspicious applications. - Enhancements to the emergency DAT file (EXTRA.DAT) structure allowing a larger DAT file size. - Enhancements to enable scanning of non-standard ZIP archives.
2006-01-15Add PYTHONINSPECT to the list of environment variables to cleanadrianp3-2/+16
Fix for http://secunia.com/advisories/18358/ Bump to nb1
2006-01-14Update to 0.13.1, based on patches from recht@ via tech-pkg.wiz6-12/+175
Additionally, fix it to compile against openssl-0.9.7i, the current pkgsrc version; due to its way of checking compatibility, py-m2crypto is extremely picky about constness. If this works with other versions too, just add them to the pattern. Changes since 0.12/0.11 ------------------------- - Patches from Artur Frysiak. Thanks Artur. = Allow using a passphrase callback in class SMIME. = Added method get0_signers to class PKCS7, which retrieves signers' certificates from a PKCS7 blob. = Added methods as_pem and save_pem to class X509. = Added file version.py. = Allow SSL.Context.load_verify_locations to accept both 'cafile' and 'capath'. - Fixed BIO.read() not reading until EOF. Thanks to Egil Muller for suggestion. - Honour 'mode' parameter in SSL.Connection.makefile. Thanks again to Egil Muller. - Roger Binns contributed epydoc-generated docs for M2Crypto. Thanks Roger. - Peter Teniz contributed patches to create X.509 requests and certificates. Thanks Peter. - Updated Medusa to 0.54. - Make various OpenSSL bignum functions (written long ago) available to Python.
2006-01-10Use mk/mysql.buildlink3.mk instead of databases/mysqlX-client/bl3.mk,ghen3-5/+7
same for pgsql.bl3.mk. Bump PKGREVISION. Ok by wiz.
2006-01-09Does not need qt3-tools at runtime.wiz1-5/+2
Change to build dependency and bump PKGREVISION.
2006-01-09Sync with latest sudo release (1.6.8pl12). The actual diff is one linecube3-32/+7
long. PR#32378 by Stefan Krüger. Changes: Added PS4 and SHELLOPTS to the list of variables to remove from the environment. (Already in pkgsrc) Added JAVA_TOOL_OPTIONS to the list of variables to remove from the environment. Added PERLLIB, PERL5LIB and PERL5OPT to the list of variables to remove from the environment. (Already in pkgsrc)
2006-01-08Bump PKGREVISION due to mysql.buildlink3.mk changes (default mysqlxtraeme2-2/+4
pkg has been changed to 5.x). Reminded by wiz... thanks.
2006-01-06Use SUBST framework. gtar used as run time depency -> added, revisionjoerg1-4/+19
bumped.
2006-01-06DEPENDS and PKGREVISION bumps because db4's library name changed.wiz5-9/+10
2006-01-06Update to 1.9.20. This is a bugfix release.shannonjr5-30/+17
2006-01-06Update to 0.9.3. This is a bug fix release.shannonjr2-6/+7
2006-01-06Update to 0.9.13. This is a bug fix release.shannonjr2-6/+7
2006-01-05Fix compilation with OpenSSL 0.9.8.joerg2-1/+18
2006-01-05Change the default for BUILDLINK_DEPMETHOD.qt3-tools from "full" to "build",ghen5-7/+18
without affecting packages that are currently using it. Packages which previously didn't set BUILDLINK_DEPMETHOD to neither "full" nor "build" now set it to "full", but should be checked whether they really need it (comment added). Packages which previously set it to "build" now don't set it anymore. Ok by jlam, wiz.
2006-01-04Express these packages' brokenness with BROKEN_IN=pkgsrc-2005Q4schmonz3-9/+6
rather than PKG_FAIL_REASON, so that they provide useful error messages in build logs, and so that they continue to work on platforms where they aren't broken.
2006-01-03Add:adrianp1-1/+2
security/base
2006-01-03The Basic Analysis and Security Engine (BASE) is a PHP-based analysisadrianp8-0/+331
engine to search and process a database of security events generated by various IDSes, firewalls, and network monitoring tools. The features currently include: o Query-builder and search interface for finding alerts matching on alert meta information (e.g. signature, detection time) as well as the underlying network evidence (e.g. source/destination address, ports, payload, or flags). o Packet viewer (decoder) will graphically display the layer-3 and layer-4 packet information of logged alerts o Alert management by providing constructs to logically group alerts to create incidents (alert groups), deleting the handled alerts or false positives, exporting to email for collaboration, or archiving of alerts to transfer them between alert databases. o Chart and statistic generation based on time, sensor, signature, protocol, IP address, TCP/UDP ports, or classification
2006-01-03Bump PKGREVISION by update of ruby18-base package.taca1-2/+2
2006-01-03Stop handling DIST_SUBDIR default for Ruby based packages.taca1-4/+4
Second, update distinfo and/or stop using USE_RUBY_DIST_SUBDIR in Makefiles.
2006-01-03Update security/courier-authlib to 0.58. Changes from version 0.57 include:jlam3-19/+6
* Re-enable pam_acct_mgmt hook. * Add support for shadow password expiration. * Configurable daemon socket timeout, * Add a section for LDAP environment variable options. * Replace LDAP_SERVER and LDAP_PORT settings with LDAP_URI, which obsoletes LDAP_TLS. * Fix LDAP error checking.
2006-01-02strnstr exists on DragonFly, use the system version instead of thejoerg3-1/+36
conflicting local version.
2006-01-02Add hack to fix build on OS X with BIND9 system resolver.schmonz1-0/+9
2006-01-02Update chkrootkit to 0.46aadrianp4-20/+17
Add a MESSAGE about false-positive results on non-supported platforms Helps to address PR# 31813 reported by Eric Mumpower From the README: 02/22/2005 - Version 0.45 chkproc.c: better support for Linux threads. New rootkit detected: Fu, Kenga3, ESRK. New test: chkutmp. -n option improvement. Minor bug fixes. 10/26/2005 - Version 0.46 chkproc.c: more fixes to better support Linux threads. chkutmp.c: improved execution speed. chkwtmp.c: segfault fixed. New rootkit detected: rootedoor. Mac OS X support added. Minor bug fixes. 10/28/2005 - Version 0.46a chkproc.c: bug fix for FreeBSD: chkproc was sending a SIGXFSZ (kill -25) to init, causing a reboot.
2006-01-01Update to 2.36:wiz2-7/+6
2005-11-30 Gisle Aas Release 2.36 Fix documentation typo. 2005-11-26 Gisle Aas Release 2.35 Forgot to incorporate fixes already applied to bleadperl :-( - doc typo - consting - unused my_na - USE_HEAP_INSTEAD_OF_STACK for Symbian 2005-11-26 Gisle Aas Release 2.34 Document that it is now easy to generate different messages that produce the same MD5 digest. Use XSLoader; perl-5.6 is now required. Tweaks to the processing of $? after running the test program.
2006-01-01Update to 1.14:wiz2-6/+6
2005-11-26 Gisle Aas Release 1.14 Documentation tweaks.
2005-12-31Recursive PKGREVISION bump for gnutls shlib major bump.wiz3-6/+6
Bump BUILDLINK_RECOMMENDED.
2005-12-31Update to 1.3.2 bumped library major version -- bump BUILDLINK_RECOMMENDED.wiz1-2/+2
2005-12-31Update to 0.4.6:wiz2-6/+6
Changes in version 0.4.6 are: * Confirm password when selecting new password
2005-12-31Update to 1.3.2:wiz3-7/+51
* Version 1.3.2 (released 2005-12-15) ** GnuTLS now support TLS Inner application (TLS/IA). This is per draft-funk-tls-inner-application-extension-01. This functionality is added to libgnutls-extra, so it is licensed under the GNU General Public License. ** New APIs to access the TLS Pseudo-Random-Function (PRF). The PRF is used by some protocols building on TLS, such as EAP-PEAP and EAP-TTLS. One function to access the raw PRF and one to access the PRF seeded with the client/server random fields are provided. Suggested by Jouni Malinen <jkmaline@cc.hut.fi>. ** New APIs to acceess the client and server random fields in a session. These fields can be useful by protocols using TLS. Note that these fields are typically used as input to the TLS PRF, and if this is your intended use, you should use the TLS PRF API that use the client/server random field directly. Suggested by Jouni Malinen <jkmaline@cc.hut.fi>. ** Internal type cleanups. The uint8, uint16, uint32 types have been replaced by uint8_t, uint16_t, uint32_t. Gnulib is used to guarantee the presence of correct types on platforms that lack them. The uint type have been replaced by unsigned. ** API and ABI modifications: New functions to invoke the TLS Pseudo-Random-Function (PRF): gnutls_prf gnutls_prf_raw New functions to retrieve the session's client and server random values: gnutls_session_get_server_random gnutls_session_get_client_random New function, to perform TLS/IA handshake: gnutls_ia_handshake New function to decide whether to do a TLS/IA handshake: gnutls_ia_handshake_p New functions to allocate a TLS/IA credential: gnutls_ia_allocate_client_credentials gnutls_ia_free_client_credentials gnutls_ia_allocate_server_credentials gnutls_ia_free_server_credentials New functions to handle the AVP callback: gnutls_ia_set_client_avp_function gnutls_ia_set_client_avp_ptr gnutls_ia_get_client_avp_ptr gnutls_ia_set_server_avp_function gnutls_ia_set_server_avp_ptr gnutls_ia_get_server_avp_ptr New functions, to toggle TLS/IA application phases: gnutls_ia_require_inner_phase New function to mix session keys with inner secret: gnutls_ia_permute_inner_secret Low-level API (used internally by gnutls_ia_handshake): gnutls_ia_endphase_send gnutls_ia_send gnutls_ia_recv New functions that can be used after successful TLS/IA negotiation: gnutls_ia_generate_challenge gnutls_ia_extract_inner_secret Enum type with TLS/IA modes: gnutls_ia_mode_t Enum type with TLS/IA packet types: gnutls_ia_apptype_t Enum values for TLS/IA alerts: GNUTLS_A_INNER_APPLICATION_FAILURE GNUTLS_A_INNER_APPLICATION_VERIFICATION New error codes, to signal when an application phase has finished: GNUTLS_E_WARNING_IA_IPHF_RECEIVED GNUTLS_E_WARNING_IA_FPHF_RECEIVED New error code to signal TLS/IA verify failure: GNUTLS_E_IA_VERIFY_FAILED * Version 1.3.1 (released 2005-12-08) ** Support for DHE-PSK cipher suites has been added. This method offers perfect forward secrecy. ** Fix gnutls-cli STARTTLS hang when SIGINT is sent too quickly, thanks to Otto Maddox <ottomaddox@fastmail.fm> and Nozomu Ando <nand@mac.com>. ** Corrected a bug in certtool for 64 bit machines. Reported by Max Kellermann <max@duempel.org>. ** New function to set a X.509 private key and certificate pairs, and/or CRLs, from an PKCS#12 file, suggested by Emile van Bergen <emile@e-advies.nl>. The integrity of the PKCS#12 file is protected through a password based MAC; public-key based signatures for integrity protection are not supported. PKCS#12 bags may be encrypted using password derived symmetric keys, public-key based encryption is not supported. The PKCS#8 keys may be encrypted using passwords. The API use the same password for all operations. We believe that any more flexibility create too much complexity that would hurt overall security, but may add more PKCS#12 related APIs if real-world experience indicate otherwise. ** gnutls_x509_privkey_import_pkcs8 now accept unencrypted PEM PKCS#8 keys, reported by Emile van Bergen <emile@e-advies.nl>. This will enable "certtool -k -8" to parse those keys. ** Certtool now generate keys in unencrypted PKCS#8 format for empty passwords. Use "certtool -p -8" and press press enter at the prompt. Earlier, certtool would have encrypted the key using an empty password. ** Certtool now accept --password for --key-info and encrypted PKCS#8 keys. Earlier it would have prompted the user for it, even if --password was supplied. ** Added self test of PKCS#8 parsing. Unencrypted and encrypted (pbeWithSHAAnd3-KeyTripleDES-CBC and pbeWithSHAAnd40BitRC2-CBC) formats are tested. The test is in tests/pkcs8. ** API and ABI modifications: New function to set X.509 credentials from a PKCS#12 file: gnutls_certificate_set_x509_simple_pkcs12_file New gnutls_kx_algorithm_t enum type: GNUTLS_KX_DHE_PSK New API to return session data (better data types than gnutls_session_get_data): gnutls_session_get_data2 New API to set PSK Diffie-Hellman parameters: gnutls_psk_set_server_dh_params * Version 1.3.0 (2005-11-15) ** Support for TLS Pre-Shared Key (TLS-PSK) ciphersuites have been added. This add several new APIs, see below. Read the updated manual for more information. A new self test "pskself" has been added, that will test this functionality. ** The session resumption data are now system independent. ** The code has been re-indented to conform to the GNU coding style. ** Removed the RIPEMD ciphersuites. ** Added a discussion of the internals of gnutls in manual. ** Fixes for Tru64 UNIX 4.0D that lack MAP_FAILED, from Albert Chin. ** Remove trailing comma in enums, for IBM C v6, from Albert Chin. ** Make sure config.h is included first in a few files, from Albert Chin. ** Don't use C++ comments ("//") as they are invalid, from Albert Chin. ** Don't install SRP programs and man pages if --disable-srp-authentication, from Albert Chin. ** API and ABI modifications: New gnutls_kx_algorithm_t key exchange type: GNUTLS_KX_PSK New gnutls_credentials_type_t credential type: GNUTLS_CRD_PSK New credential types: gnutls_psk_server_credentials_t gnutls_psk_client_credentials_t New functions to allocate PSK credentials: gnutls_psk_allocate_client_credentials gnutls_psk_free_client_credentials gnutls_psk_free_server_credentials gnutls_psk_allocate_server_credentials New enum type for PSK key flags: gnutls_psk_key_flags New function prototypes for credential callback: gnutls_psk_client_credentials_function gnutls_psk_server_credentials_function New function to set PSK username and key: gnutls_psk_set_client_credentials New function to set PSK passwd file: gnutls_psk_set_server_credentials_file New function to extract PSK user in server: gnutls_psk_server_get_username New functions to set PSK callback: gnutls_psk_set_server_credentials_function gnutls_psk_set_client_credentials_function Use size_t instead of int for output size parameter: gnutls_srp_base64_encode gnutls_srp_base64_decode
generated by cgit v1.2.3 (git 2.39.1) at 2024-07-05 20:43:39 +0000