CVS log for pkgsrc/net/ucspi-ssl/PLIST

Up to [cvs.NetBSD.org] / pkgsrc / net / ucspi-ssl

Request diff between arbitrary revisions

Keyword substitution: kv
Default branch: MAIN

ucspi-ssl: update to 0.13.01. Changes:

- More verbose information for sslserver for (missing) key material.
- Removed pre OpenSSL 1.1.1 API calls. Adjusted sig handler signature.
- Still need testing on different environments (OpenSSL/LibreSSL).
- fehQlibs-25 required. getoptb() used instead getopt().
- Re-issued ECC certificates. RTS is working now fine.
- Changed error code display; ssl_error.c not used/working anymore.
- The SSL client certificate verification is happening during handshake.
- Using package/rts, sslclient can not be fed with a client keyfile
  password under OmniOS.
- Added SAN Email and FQDN as MOD_SSL variables for client and server.
- Regression tested against OpenSSL and LibreSSL (providing TLS 1.3 and
  ECC support).

ucspi-ssl: install library and header file.

From George Matsumura in PR pkg/58460.

ucspi-ssl: update to 0.12.10. Changes:

0.12.8:
- Added new x509 certs and key material; all ECC now.
- Fixed wrong evaluation of peer cert in ssl_verify (none-critical).

0.12.9:
- Included IP info in sslserver's TLS error messages for a quick lookup.
- Fixed sslhandle's wrong if nesting.
- sslserver return FATAL (and not ERROR) in case TLS is requested but missing.
- Enhanced compatibility with OpenSSL 3.x.y.

0.12.10:
- Added argument '-y cdb' to sslserver in order to allow a rule checking
  for IP addresses prior of the DNS/IDENT lookup (to cope with DDos attacks).

Update to 0.10.11. From the changelog:

- Fixed potential stack corruption in sslclient/sslhandle/sslserver
  while assigning hostname => 0.
- Improved OpenSSL + LibreSSL compatibility:
    - LibreSSL 2.5 to 2.9 is working
    - OpenSSL 1.0.2 to 1.1.1 is working
- Added SNI for sslclient.
- Fixes for sslhandle.
- Included new CIPHERLIST API for ssl_ciphers.
- Removed dependency on conf-tcpbin; modules are expected to be
  in the path.
- Modules rts.base and rts.sslperl are working now.

Update to 0.10.6, which we'll call "0.999.10.6". From the changelog:

- Complete refurbish based on fehQlibs.
- Native handling of IPv4/IPv6 address for sslclient.
- Added experimental 'ecdhparam' file.
- Removed experimental 'ecdhparam' handling -- OpenSSL does not support it.
- Finished TLS 1.3 integration (based on OpenSSL 1.1.1).
- Removed compiler flags for ECDH -- now required.
- fehQlibs-09 based.

Update to 0.99d. From the changelog:

- Added `correct` pid display in error log.
- Fixed cosmetic bug in sslserver displaying parent and not child pid in log.
  Tx Bruce Guenter.

pkgsrc changes:

- Adjust path to OpenSSL certs
- Install the provided example DH params
- Look for /etc/dnsrewrite under PKG_SYSCONFBASE
- Create a user and group for privilege separation
- Install manpages and more documentation

Remove @dirrm entries from PLISTs

Only build sslperl if option "ucspi-ssl-perl" is enabled. Bump PKGREVISION.

Initial import of ucspi-ssl, a set of command-line tools for SSL
client-server applications. They conform to the UNIX Client-Server
Program Interface, UCSPI.

sslserver listens for connections, and runs a program for each
connection it accepts. The program environment includes variables
that hold the local and remote host names, IP addresses, and port
numbers. sslserver offers a concurrency limit on acceptance of new
connections, and selective handling of connections based on client
identity.

sslclient requests a connection to a TCP socket, and runs a program.
The program environment includes the same variables as for sslserver.

The "tls" option applies Scott Gifford's patch to implement UCSPI-TLS
in sslserver.

Initial revision