Grab maintainership
From the ChangeLog (Summarised)
> * ike-backoff-patterns: Added backoff patterns for Netgear ProSafe
> and Netgear ADSL Firewall Router. Submitted by Paul Askew.
> * ike-scan.c, ike-scan.h, configure.ac: Added new --writepkttofile
> option. This option writes the output packet to the specified file
> rather than sending it to the remote host. It is intended for
> debugging and testing purposes, to allow the IKE packet to be
> easily checked. This option is not documented, because it is
> designed purely for testing.
> * check-packet: New test to check IKE scan packet data. Currently
> tests two sample packets: one default proposal, and one custom
> proposal.
> * ike-scan.c: Added --exchange option to allow the exchange field
> in the ISAKMP header to be set to arbitrary values.
> * ike-scan.c, isakmp.c: Added --hdrflags and --hdrmsgid options to
> allow Flags and MsgID fields in the ISAKMP header to be specified.
> * ike-scan.c: Added --cookie option to allow the initiator cookie in
> the ISAKMP header to be set to a static value.
> * ike-scan.c, isakmp.c: Add --spisize option to allow a random SPI
> of the specified size to be added to the proposal payload.
> * ike-vendor-ids: Added 16 new Vendor IDs, and revised some comments
> on existing entries.
> * ike-scan.c: Added --doi (-D) and --situation (-S) options to allow
> the DOI and Situation in the SA of the outbound packets to be changed
> from the default of DOI_IPSEC and SIT_IDENTITY_ONLY.
> * ike-scan.c: Added --protocol (-j) and --transid (-k) options to
> allow the proposal protocol and transform id of the outbound packets
> to be changed from the defaults.
> * ike-scan.c: Added --certreq (-C) option to add a
> CertificateRequest payload to the outgoing packet.
> * ike-scan.c: Added --headerlen (-L) option to allow the ISAKMP header
> length to be manually specified. Normally, ike-scan will
> automatically calculate the correct length; however, you can use this
> option if you want to use an incorrect length value instead.
> * ike-scan.c, isakmp.c: Added --mbz (-Z) option to allow the value for
> the reserved (MBZ) fields to be set to non-zero values. Doing so
> will make the outgoing packet non-RFC compliant.
> * ike-scan.c, isakmp.c: Added --headerver (-E) option to allow the
> version field in the ISAKMP header to be altered from the default of
> 0x10 (v1.0).
> * ike-scan.c: Added --bandwidth (-B) option to allow the outgoing
> bandwidth to be specified directly instead of using --interval.
> The --bandwidth option calculates the appropriate interval setting,
> taking into account the size of the packet.
> * ike-scan.c: Added --noncelen (-c) option to allow the length of the
> nonce data to be changed. This is only applicable to aggressive
> mode.
This fixes PR pkg/30290 by Nicolas Joly so the latest DAT files are working
again.
- Moved included DAT-files to shares/examples/uvscan/.
- Works with PKG_CONFIG=no.
- PDF manual included in share/doc/uvscan/.
- Some small improvements to update_dat.sh:
Option "-h" shows the available options.
All the "exit" statements use distinct values.
Fixed a small logic bug (-z vs. -n).
Changes according to McAfee's website:
- Includes technology to combat the latest and
future threats.
- Improved detection and cleaning.
- Support for many more Packed Executable formats
in which known malware is often re-packaged
for obfuscation purposes.
- Specific detection and reporting of files
compressed or packaged with known suspicious
applications.
- Enhancements to the emergency DAT file (EXTRA.DAT)
structure allowing a larger DAT file size.
- Enhancements to enable scanning of non-standard
ZIP archives.
Additionally, fix it to compile against openssl-0.9.7i, the
current pkgsrc version; due to its way of checking compatibility,
py-m2crypto is extremely picky about constness.
If this works with other versions too, just add them to the pattern.
Changes since 0.12/0.11
-------------------------
- Patches from Artur Frysiak. Thanks Artur.
= Allow using a passphrase callback in class SMIME.
= Added method get0_signers to class PKCS7, which retrieves signers'
certificates from a PKCS7 blob.
= Added methods as_pem and save_pem to class X509.
= Added file version.py.
= Allow SSL.Context.load_verify_locations to accept both 'cafile' and
'capath'.
- Fixed BIO.read() not reading until EOF. Thanks to Egil Muller
for suggestion.
- Honour 'mode' parameter in SSL.Connection.makefile. Thanks again to Egil
Muller.
- Roger Binns contributed epydoc-generated docs for M2Crypto. Thanks Roger.
- Peter Teniz contributed patches to create X.509 requests and certificates.
Thanks Peter.
- Updated Medusa to 0.54.
- Make various OpenSSL bignum functions (written long ago) available to Python.
long. PR#32378 by Stefan Krüger.
Changes:
Added PS4 and SHELLOPTS to the list of variables to remove from
the environment. (Already in pkgsrc)
Added JAVA_TOOL_OPTIONS to the list of variables to remove from
the environment.
Added PERLLIB, PERL5LIB and PERL5OPT to the list of variables to
remove from the environment. (Already in pkgsrc)
without affecting packages that are currently using it.
Packages which previously didn't set BUILDLINK_DEPMETHOD to neither "full" nor
"build" now set it to "full", but should be checked whether they really need it
(comment added). Packages which previously set it to "build" now don't set it
anymore.
Ok by jlam, wiz.
rather than PKG_FAIL_REASON, so that they provide useful error
messages in build logs, and so that they continue to work on platforms
where they aren't broken.
engine to search and process a database of security events generated by
various IDSes, firewalls, and network monitoring tools. The features currently
include:
o Query-builder and search interface for finding alerts matching
on alert meta information (e.g. signature, detection time) as well as
the underlying network evidence (e.g. source/destination address, ports,
payload, or flags).
o Packet viewer (decoder) will graphically display the layer-3 and
layer-4 packet information of logged alerts
o Alert management by providing constructs to logically group alerts
to create incidents (alert groups), deleting the handled alerts or
false positives, exporting to email for collaboration, or archiving of
alerts to transfer them between alert databases.
o Chart and statistic generation based on time, sensor, signature, protocol,
IP address, TCP/UDP ports, or classification
Add a MESSAGE about false-positive results on non-supported platforms
Helps to address PR# 31813 reported by Eric Mumpower
From the README:
02/22/2005 - Version 0.45 chkproc.c: better support for Linux
threads. New rootkit detected: Fu,
Kenga3, ESRK. New test: chkutmp. -n
option improvement. Minor bug fixes.
10/26/2005 - Version 0.46 chkproc.c: more fixes to better support
Linux threads. chkutmp.c: improved
execution speed. chkwtmp.c: segfault
fixed. New rootkit detected: rootedoor.
Mac OS X support added. Minor bug fixes.
10/28/2005 - Version 0.46a chkproc.c: bug fix for FreeBSD: chkproc
was sending a SIGXFSZ (kill -25) to init,
causing a reboot.
2005-11-30 Gisle Aas
Release 2.36
Fix documentation typo.
2005-11-26 Gisle Aas
Release 2.35
Forgot to incorporate fixes already applied to bleadperl :-(
- doc typo
- consting
- unused my_na
- USE_HEAP_INSTEAD_OF_STACK for Symbian
2005-11-26 Gisle Aas
Release 2.34
Document that it is now easy to generate different messages that produce the
same MD5 digest.
Use XSLoader; perl-5.6 is now required.
Tweaks to the processing of $? after running the test program.
* Version 1.3.2 (released 2005-12-15)
** GnuTLS now support TLS Inner application (TLS/IA).
This is per draft-funk-tls-inner-application-extension-01. This
functionality is added to libgnutls-extra, so it is licensed under the
GNU General Public License.
** New APIs to access the TLS Pseudo-Random-Function (PRF).
The PRF is used by some protocols building on TLS, such as EAP-PEAP
and EAP-TTLS. One function to access the raw PRF and one to access
the PRF seeded with the client/server random fields are provided.
Suggested by Jouni Malinen <jkmaline@cc.hut.fi>.
** New APIs to acceess the client and server random fields in a session.
These fields can be useful by protocols using TLS. Note that these
fields are typically used as input to the TLS PRF, and if this is your
intended use, you should use the TLS PRF API that use the
client/server random field directly. Suggested by Jouni Malinen
<jkmaline@cc.hut.fi>.
** Internal type cleanups.
The uint8, uint16, uint32 types have been replaced by uint8_t,
uint16_t, uint32_t. Gnulib is used to guarantee the presence of
correct types on platforms that lack them. The uint type have been
replaced by unsigned.
** API and ABI modifications:
New functions to invoke the TLS Pseudo-Random-Function (PRF):
gnutls_prf
gnutls_prf_raw
New functions to retrieve the session's client and server random values:
gnutls_session_get_server_random
gnutls_session_get_client_random
New function, to perform TLS/IA handshake:
gnutls_ia_handshake
New function to decide whether to do a TLS/IA handshake:
gnutls_ia_handshake_p
New functions to allocate a TLS/IA credential:
gnutls_ia_allocate_client_credentials
gnutls_ia_free_client_credentials
gnutls_ia_allocate_server_credentials
gnutls_ia_free_server_credentials
New functions to handle the AVP callback:
gnutls_ia_set_client_avp_function
gnutls_ia_set_client_avp_ptr
gnutls_ia_get_client_avp_ptr
gnutls_ia_set_server_avp_function
gnutls_ia_set_server_avp_ptr
gnutls_ia_get_server_avp_ptr
New functions, to toggle TLS/IA application phases:
gnutls_ia_require_inner_phase
New function to mix session keys with inner secret:
gnutls_ia_permute_inner_secret
Low-level API (used internally by gnutls_ia_handshake):
gnutls_ia_endphase_send
gnutls_ia_send
gnutls_ia_recv
New functions that can be used after successful TLS/IA negotiation:
gnutls_ia_generate_challenge
gnutls_ia_extract_inner_secret
Enum type with TLS/IA modes:
gnutls_ia_mode_t
Enum type with TLS/IA packet types:
gnutls_ia_apptype_t
Enum values for TLS/IA alerts:
GNUTLS_A_INNER_APPLICATION_FAILURE
GNUTLS_A_INNER_APPLICATION_VERIFICATION
New error codes, to signal when an application phase has finished:
GNUTLS_E_WARNING_IA_IPHF_RECEIVED
GNUTLS_E_WARNING_IA_FPHF_RECEIVED
New error code to signal TLS/IA verify failure:
GNUTLS_E_IA_VERIFY_FAILED
* Version 1.3.1 (released 2005-12-08)
** Support for DHE-PSK cipher suites has been added.
This method offers perfect forward secrecy.
** Fix gnutls-cli STARTTLS hang when SIGINT is sent too quickly, thanks to
Otto Maddox <ottomaddox@fastmail.fm> and Nozomu Ando <nand@mac.com>.
** Corrected a bug in certtool for 64 bit machines. Reported
by Max Kellermann <max@duempel.org>.
** New function to set a X.509 private key and certificate pairs, and/or
CRLs, from an PKCS#12 file, suggested by Emile van Bergen
<emile@e-advies.nl>.
The integrity of the PKCS#12 file is protected through a password
based MAC; public-key based signatures for integrity protection are
not supported. PKCS#12 bags may be encrypted using password derived
symmetric keys, public-key based encryption is not supported. The
PKCS#8 keys may be encrypted using passwords. The API use the same
password for all operations. We believe that any more flexibility
create too much complexity that would hurt overall security, but may
add more PKCS#12 related APIs if real-world experience indicate
otherwise.
** gnutls_x509_privkey_import_pkcs8 now accept unencrypted PEM PKCS#8 keys,
reported by Emile van Bergen <emile@e-advies.nl>.
This will enable "certtool -k -8" to parse those keys.
** Certtool now generate keys in unencrypted PKCS#8 format for empty passwords.
Use "certtool -p -8" and press press enter at the prompt. Earlier,
certtool would have encrypted the key using an empty password.
** Certtool now accept --password for --key-info and encrypted PKCS#8 keys.
Earlier it would have prompted the user for it, even if --password was
supplied.
** Added self test of PKCS#8 parsing.
Unencrypted and encrypted (pbeWithSHAAnd3-KeyTripleDES-CBC and
pbeWithSHAAnd40BitRC2-CBC) formats are tested. The test is in
tests/pkcs8.
** API and ABI modifications:
New function to set X.509 credentials from a PKCS#12 file:
gnutls_certificate_set_x509_simple_pkcs12_file
New gnutls_kx_algorithm_t enum type:
GNUTLS_KX_DHE_PSK
New API to return session data (better data types than
gnutls_session_get_data):
gnutls_session_get_data2
New API to set PSK Diffie-Hellman parameters:
gnutls_psk_set_server_dh_params
* Version 1.3.0 (2005-11-15)
** Support for TLS Pre-Shared Key (TLS-PSK) ciphersuites have been added.
This add several new APIs, see below. Read the updated manual for
more information. A new self test "pskself" has been added, that will
test this functionality.
** The session resumption data are now system independent.
** The code has been re-indented to conform to the GNU coding style.
** Removed the RIPEMD ciphersuites.
** Added a discussion of the internals of gnutls in manual.
** Fixes for Tru64 UNIX 4.0D that lack MAP_FAILED, from Albert Chin.
** Remove trailing comma in enums, for IBM C v6, from Albert Chin.
** Make sure config.h is included first in a few files, from Albert Chin.
** Don't use C++ comments ("//") as they are invalid, from Albert Chin.
** Don't install SRP programs and man pages if --disable-srp-authentication,
from Albert Chin.
** API and ABI modifications:
New gnutls_kx_algorithm_t key exchange type: GNUTLS_KX_PSK
New gnutls_credentials_type_t credential type:
GNUTLS_CRD_PSK
New credential types:
gnutls_psk_server_credentials_t
gnutls_psk_client_credentials_t
New functions to allocate PSK credentials:
gnutls_psk_allocate_client_credentials
gnutls_psk_free_client_credentials
gnutls_psk_free_server_credentials
gnutls_psk_allocate_server_credentials
New enum type for PSK key flags:
gnutls_psk_key_flags
New function prototypes for credential callback:
gnutls_psk_client_credentials_function
gnutls_psk_server_credentials_function
New function to set PSK username and key:
gnutls_psk_set_client_credentials
New function to set PSK passwd file:
gnutls_psk_set_server_credentials_file
New function to extract PSK user in server:
gnutls_psk_server_get_username
New functions to set PSK callback:
gnutls_psk_set_server_credentials_function
gnutls_psk_set_client_credentials_function
Use size_t instead of int for output size parameter:
gnutls_srp_base64_encode
gnutls_srp_base64_decode
incorrect field calculation for the second field if the first field is
numeric and there are only 2 fields total in the input record (line).
The buggy awk was in 2.99.* and early 3.99.*, and identifies itself as
awk version 20030729. However, not all awk's with this version number
exhibit the problem (so it could be related to a library used by awk).
Recent 3.99.* builds don't have this problem, and the awk versio on
them is also much more recent.
