bsd.own.mk: rename to CC_WNO_ADDRESS_OF_PACKED_MEMBER

Provide a single variable
CC_WNO_ADDRESS_OF_PACKED_MEMBER
with options for both clang and gcc, to replace
CLANG_NO_ADDR_OF_PACKED_MEMBER
CC_N

bsd.own.mk: rename to CC_WNO_ADDRESS_OF_PACKED_MEMBER

Provide a single variable
CC_WNO_ADDRESS_OF_PACKED_MEMBER
with options for both clang and gcc, to replace
CLANG_NO_ADDR_OF_PACKED_MEMBER
CC_NO_ADDR_OF_PACKED_MEMBER
GCC_NO_ADDR_OF_PACKED_MEMBER

Using the convention CC_compilerflag, where compilerflag
is based on the full compiler flag name.

show more ...

Handle OpenSSL-3.x

deal with OpenSSL-3.x

One more ldap change

apply -fcommon to sources that still rely upon it.

Explicitly link liblber and libssl when ldap support is enabled.
Fix sun2, i.e., MKPIC=no build.

Enable ldap support in racoon(8). Proposed on tech-userlevel,
"Go for it" from christos@

add support for new GCC 9 warnings that may be too much to fix
right now. new address-of-packed-member and format-overflow
warnings have new GCC_NO_ADDR_OF_PACKED_MEMBER amd
GCC_NO_FORMAT_OVERFLOW v

add support for new GCC 9 warnings that may be too much to fix
right now. new address-of-packed-member and format-overflow
warnings have new GCC_NO_ADDR_OF_PACKED_MEMBER amd
GCC_NO_FORMAT_OVERFLOW variables to remove these warnings.

apply to a bunch of the tree. mostly, these are real bugs that
should be fixed, but in many cases, only by removing the 'packed'
attribute from some structure that doesn't really need it. (i
looked at many different ones, and while perhaps 60-80% were
already properly aligned, it wasn't clear to me that the uses
were always coming from sane data vs network alignment, so it
doesn't seem safe to remove packed without careful research for
each affect struct.) clang already warned (and was not erroring)
for many of these cases, but gcc picked up dozens more.

show more ...

add commented out debugging options.

add LIBKRB5_LDADD/LIBKRB5_DPADD and their static counterparts
to bsd.prog.mk. use them instead of hard coding various lists
of libraries for krb5.

this fixes static builds.

No RC5 for OpenSSL-1.1

disable compat api setting for openssl 1.1

needs the OpenSSL-1.1 api to build

Remove MKCRYPTO_RC5. Unconditionally include RC5 in libcrypto.so.

This option existed only because RC5 is covered by patents that, twenty
years ago, we had reason to suspect the patent holder, RSA,

Remove MKCRYPTO_RC5. Unconditionally include RC5 in libcrypto.so.

This option existed only because RC5 is covered by patents that, twenty
years ago, we had reason to suspect the patent holder, RSA, Inc., might
litigate. The two US patents in question are 5,724,428 and 5,835,600.

According to the USPTO Patent Term Calculator web site at
<https://www.uspto.gov/patent/laws-and-regulations/patent-term-calculator#heading-5>
(retrieved 2017-05-21), patents filed after 1995-06-07 expire twenty
years after the filing date.

number filing date
5,724,428 1995-11-01
5,835,600 1997-04-21

Thus, these patents appear to be expired.

As proposed on tech-crypto and tech-security:

https://mail-index.netbsd.org/tech-crypto/2017/05/05/msg000718.html
https://mail-index.netbsd.org/tech-security/2017/05/05/msg000927.html

show more ...

GC some GCC 4.8 specific sh3 HACKS entries.

These existed to avoid compile errors, and haven't been effect
since gcc.old was removed.

add sqlite3

more sh3 hacks.

Enable wildcard matching in psk files. We are big kids and if we put a *
in the psk file, we mean it.

MKCRYPTO_IDEA is no more

-consistently use "char *" for the compiled policy buffer in the
ipsec_*_policy() functions, as it was documented and used by clients
-remove "ipsec_policy_t" which was undocumented and only present

-consistently use "char *" for the compiled policy buffer in the
ipsec_*_policy() functions, as it was documented and used by clients
-remove "ipsec_policy_t" which was undocumented and only present
in the KAME version of the ipsec.h header
-misc cleanup of historical artefacts, and to remove unnecessary
differences between KAME ans FAST_IPSEC

show more ...

Ignore warnings when building with clang for now.

Enable WARNS=4 by default, except for:
cpuctl dumplfs hprop ipf iprop-log kadmin kcm kdc kdigest
kimpersonate kstash ktutil makefs ndbootd ntp pppd quot
racoon racoonctl rtadvd s

Enable WARNS=4 by default, except for:
cpuctl dumplfs hprop ipf iprop-log kadmin kcm kdc kdigest
kimpersonate kstash ktutil makefs ndbootd ntp pppd quot
racoon racoonctl rtadvd sntp sup tcpdchk tcpdmatch tcpdump
traceroute traceroute6 user veriexecgen wsmoused zic
(Mostly third-party applications)

show more ...

Add more libraries required by libkrb5 etc. in NOPIC case.

Not the right way to fix this.

Because privsep.c uses CMSG_SPACE() to size two local arrays, these
ends up as c99 variable-sized local arrays (CMSG_SPACE() uses a function
as part of calculating its result). This causes the stack

Because privsep.c uses CMSG_SPACE() to size two local arrays, these
ends up as c99 variable-sized local arrays (CMSG_SPACE() uses a function
as part of calculating its result). This causes the stack protection
code in the compiler to complain, so build this one with -fno-stack-protector
to avoid the problem.

Gets us back to buildability for this program for a number of our ports.

show more ...