racoon/gssapi.c in IPsec-Tools 0.8.2 allows remote attackers to cause a denial of service (NULL pointer dereference and IKE daemon crash) via a series of crafted UDP requests.
VuXML only (0) · listed, port not fixed yet
None. pkg audit reports nothing for this version.
Fixed (4)
VuXML entries whose affected range this version has left, plus CVEs whose record still lists this version although VuXML considers them fixed (usually a backported fix).
The racoon daemon in IPsec-Tools 0.8.2 contains a remotely exploitable computational-complexity attack when parsing and storing ISAKMP fragments. The implementation permits a remote attacker to exhaust computational resources on the remote endpoint by repeatedly sending ISAKMP fragment packets in a particular order such that the worst-case computational com…
security/ipsec-tools: fix build for FreeBSD 15
FreeBSD 15.0 got some incompatible changes to the header
/usr/include/netipsec/ipsec.h breaking build of this legacy code
due to added "const".
Fix it providing some patches that do not change the behavior.
While here, suppress some warnings that pollute build log
using modern Clang.
This fixes build, so PORTREVISION not bumped.
security/ipsec-tools: re-add the port
I use the software and will maintain the port.
Our port has no known security issues, it has patches obtained
from NetBSD CVS Repository. Change WWW to point to that repo.
Still, download same distfile from the SourceForge.
Add TIMESTAMP to distinfo.
Mk/**ldap.mk: Convert USE_LDAP to USES=ldap
Convert the USE_LDAP=yes to USES=ldap and adds the following features:
- Adds the argument USES=ldap:server to add openldap2{4|5|6}-server as
RUN_DEPENDS
- Adds the argument USES=ldap<version> and replaces WANT_OPENLDAP_VER
- Adds OPENLDAP versions in bsd.default-versions.mk
- Adds USE_OPENLDAP/WANT_OPENLDAP_VER in Mk/bsd.sanity.mk
- Changes consumers to use the features
Reviewed by: delphij
Approved by: portmgr
Differential Revision: https://reviews.freebsd.org/D38233
Remove WWW entries moved into port Makefiles
Commit b7f05445c00f has added WWW entries to port Makefiles based on
WWW: lines in pkg-descr files.
This commit removes the WWW: lines of moved-over URLs from these
pkg-descr files.
Approved by: portmgr (tcberner)
Add WWW entries to port Makefiles
It has been common practice to have one or more URLs at the end of the
ports' pkg-descr files, one per line and prefixed with "WWW:". These
URLs should point at a project website or other relevant resources.
Access to these URLs required processing of the pkg-descr files, and
they have often become stale over time. If more than one such URL was
present in a pkg-descr file, only the first one was tarnsfered into
the port INDEX, but for many ports only the last line did contain the
port specific URL to further information.
There have been several proposals to make a project URL available as
a macro in the ports' Makefiles, over time.
This commit implements such a proposal and moves one of the WWW: entries
of each pkg-descr file into the respective port's Makefile. A heuristic
attempts to identify the most relevant URL in case there is more than
one WWW: entry in some pkg-descr file. URLs that are not moved into the
Makefile are prefixed with "See also:" instead of "WWW:" in the pkg-descr
files in order to preserve them.
There are 1256 ports that had no WWW: entries in pkg-descr files. These
ports will not be touched in this commit.
The portlint port has been adjusted to expect a WWW entry in each port
Makefile, and to flag any remaining "WWW:" lines in pkg-descr files as
deprecated.
Approved by: portmgr (tcberner)
all: drop support for EOL FreeBSD 12.2
- Mk/bsd.port.mk: bump minimal FreeBSD version to 12.3,
update an example
- sysutils/lsof: drop support for ancient FreeBSD releases.
- multimedia/ustreamer: remove inline patch for 12.2
- x11/wayland-logout: remove support for FreeBSD < 12.3
- sysutils/bhyve+: remove support for FreeBSD 12.2
- databases/clickhouse: remove support for FreeBSD 12.2
- databases/mariadb106-server: remove support for FreeBSD 12.2
- devel/cvsd: no need to test for FreeBSD >=5 anymore
- devel/imake: no need to support a.out anymore
- japanese/kterm: no need to support FreeBSD <= 9
- math/igraph: remove support for FreeBSD 12.2
- net/onedrive: remove support for FreeBSD 12.2
- security/ipsec-tools: no need to test for FreeBSD >= 11
- emulators/rpcs3: Revert "emulators/rpcs3: unbreak on FreeBSD 12.2 after 49f593b2f77f"
Reviewed by: brnrd, fluffy, jbeich, ler, yuri, x11 (zeising)
Approved by: portmgr (implicit)
Differential Revision: https://reviews.freebsd.org/D34523
*/*: Remove redundant '-[0-9]*' from CONFLICTS
The conflict checks compare the patterns first against the package
names without version (as reported by "pkg query "%n"), then - if
there was no match - agsinst the full package names including the
version (as reported by "pkg query "%n-%v").
Many CONFLICTS definitions used patterns like "bash-[0-9]*" to filter
for the bash package in any version. But that pattern is functionally
identical with just "bash".
Approved by: portmgr (blanket)
security/ipsec-tools: make upgrade less painful
Partially revert r516983 to make upgrade from old versions
less painful. For example, upgrade path from 9.3 via 10.4
then to 11.0 and later should not break due to non-existing
required module ipsec.ko.
security/ipsec-tool: minor port cleanup
Remove non-existing configure options --enable-debug and --with-pkgversion.
Remove option NATTF that changed --enable-natt=yes to --enable-natt=kernel
that is exactly same for FreeBSD releases since 8.0-RELEASE.
Update devel/automake to 1.16.2.
mail/bogofilter security/ipsec-tools:
Patch Makefile.in instead of Makefile.am so automake is not required.
PR: 245599
Approved by: portmgr (antoine)
Exp-run by: antoine
Clean up support for FreeBSD 11.2.
While here, modernize some comments in Mk/bsd.*.mk.
Note that graphics/drm-fbsd11.2-kmod is not renamed yet, this was somewhat
under discussion.
Submitted by: rene
Reviewed by: antoine, jbeich, mat, zeising
Differential Revision: https://reviews.freebsd.org/D21974
security/ipsec-tools: unbreak racoon_create_dirs
Specifying required_dirs and creating it at prestart stage does not work
because required_dirs is checked before running prestart these days.
So it fails to start for mfs-based /var even if racoon_create_dirs=YES
Unbreak this by replacing "required_dirs" and "mkdir -p"
in the racoon_prestart with "install -d" that returns error in case
of failure and does nothing if the directory already exists.
Reported by: Cybil Courraud <freebsd@cyb.fr>
security/ipsec-tools: fix aggressive mode tunnels with wildcard-psk config
Wilcard patch exposures existing bug where agressive tunnels using ip addresses
for identification were not matching the entry in the PSK file,
due to the identifier not being cast to a 'xxx.xxx.xxx.xxx' notation.
PR: 203308
Submitted by: andywhite@gmail.com (based on)
security/ipsec-tools: autoload ipsec.ko if possible
Check for IPSEC support in kernel and auto-load ipsec.ko
if needed while starting racoon except of 11.0-RELEASE
that had not IPSEC as a module.
security/ipsec-tools: small correction NATT patch
This change fixes rare case for "site to site" IPSec tunnel mode
when remote peer is behind NAT and has its own LAN behind.
Now this works too (previously NATT worked only for single host behind NAT).
security/ipsec-tools: make binary package more useful
- enable options ADMINPORT and WCPSKEY by default;
- polish NATT_DESC a bit as we have releases past 11.0-STABLE;
- bump PORTREVISION.
Fix phase 1 initiation in the racoon daemon after base system change r285204
PR: 192774, 222065
Submitted by: Andreas Longwitz <longwitz@incore.de>
Approved by: VANHULLEBUS Yvan (maintainer, implicitly)
security/ipsec-tools: fix CVE-2016-10396
The racoon daemon in IPsec-Tools 0.8.2 contains a remotely exploitable
computational-complexity attack when parsing and storing ISAKMP fragments.
The implementation permits a remote attacker to exhaust computational
resources on the remote endpoint by repeatedly sending ISAKMP fragment
packets in a particular order such that the worst-case computational
complexity is realized in the algorithm utilized to determine
if reassembly of the fragments can take place.
The fix obtained from NetBSD CVS head with a command:
cvs diff -D 2017-01-24 -D 2017-09-01 \
src/racoon/handler.h \
src/racoon/isakmp.c \
src/racoon/isakmp_frag.c \
src/racoon/isakmp_inf.c
While here, add LICENSE.
PR: 225066
Approved by: VANHULLEBUS Yvan (maintainer timeout, 3 months)
Obtained from: NetBSD
MFH: 2018Q1
Security: CVE-2016-10396
This patch adds NATT_EXTRA_PATCHES=natt.diff and enables only UDP encapsulation defined in RFC3948.
The natt.diff patch contains the following changes:
* added support for SADB_X_EXT_NAT_T_OAI and SADB_X_EXT_NAT_T_OAR PF_KEY messages;
* used NAT address instead of original for SAs created by racoon;
* NAT-T keep-alives now sends only by NATed host.
Tested with 11.0-STABLE after projects/ipsec merge.
PR: 217131
Submitted by: Andrey V. Elsukov
Approved by: VANHULLEBUS Yvan (maintainer timeout, 2 months), vsevolod (mentor)
security/ipsec-tools: 0.8.1 -> 0.8.2
From ChangeLog:
- Fix admin port establish-sa for tunnel mode SAs (Alexander Sbitnev)
- Fix source port selection regression from version 0.8.1
- Various logging improvements
- Additional compliance and build fixes
From submitter:
- extra patch to adding wildcard psk option
PR: 196930
Submitted by: Harald Schmalzbauer <bugzilla.freebsd@omnilan.de>,
Ed Schouten <ed@80368.nl>
Approved by: vanhu (maintainer)
When linking a library libA with a library libB using libtool, if libB.la exists, libtool will add all libraries libB.la refers to (dependency_libs field) to the linker command line and store them in the dependency_libs field of libA.la. So everything that subsequently links with libA will also link to these extra libraries. This causes too much overlinking.
This commit modifies Mk/Uses/libtool.mk so it empties the dependency_libs
field in .la libraries during staging. However, because .la libraries have
very limited use when dependency_libs is empty it makes sense to completely
remove them during staging.
So with this commit USES=libtool is modified to remove .la libraries and a
new form (USES=libtool:keepla) is introduced in case they need to be kept
(dependency_libs is still emptied).
PORTREVISION is bumped on all ports with USES=libtool that install .la
libraries. Most ports are also changed to add :keepla because .la
libraries have to be kept around as long as there are dependent ports with
.la libraries that refer to them in their dependency_libs field. In most
cases :keepla can be removed again as soon as all dependent ports that
install .la libraries have some form of USES=libtool added to their
Makefile.
PR: ports/188759
Exp-run: bdrewery
Approved by: portmgr (bdrewery)