aboutsummaryrefslogtreecommitdiff
path: root/conform
diff options
context:
space:
mode:
authorZack Weinberg <zackw@panix.com>2018-06-29 16:53:18 +0200
committerFlorian Weimer <fweimer@redhat.com>2018-06-29 16:53:18 +0200
commitb10a0accee709a5efff2fadf0b0bbb79ff0ad759 (patch)
tree27796fe83ec5f82a8f36a36afa169fe6dddf8b27 /conform
parent524d796d5f52913d5d33edede74a5075dbda25ca (diff)
downloadglibc-b10a0accee709a5efff2fadf0b0bbb79ff0ad759.zip
glibc-b10a0accee709a5efff2fadf0b0bbb79ff0ad759.tar.gz
glibc-b10a0accee709a5efff2fadf0b0bbb79ff0ad759.tar.bz2
Disallow use of DES encryption functions in new programs.
The functions encrypt, setkey, encrypt_r, setkey_r, cbc_crypt, ecb_crypt, and des_setparity should not be used in new programs, because they use the DES block cipher, which is unacceptably weak by modern standards. Demote all of them to compatibility symbols, and remove their prototypes from installed headers. cbc_crypt, ecb_crypt, and des_setparity were already compat symbols when glibc was configured with --disable-obsolete-rpc. POSIX requires encrypt and setkey to be available when _XOPEN_CRYPT is defined, so this change also removes the definition of X_OPEN_CRYPT from <unistd.h>. The entire "DES Encryption" section is dropped from the manual, as is the mention of AUTH_DES and FIPS 140-2 in the introduction to crypt.texi. The documentation of 'memfrob' cross-referenced the DES Encryption section, which is replaced by a hyperlink to libgcrypt, and while I was in there I spruced up the actual documentation of 'memfrob' and 'strfry' a little. It's still fairly jokey, because those functions _are_ jokes, but they do also have real use cases, so people trying to use them for real should have all the information they need. DES-based authentication for Sun RPC is also insecure and should be deprecated or even removed, but maybe that can be left as TI-RPC's problem.
Diffstat (limited to 'conform')
-rw-r--r--conform/data/stdlib.h-data3
-rw-r--r--conform/data/unistd.h-data6
2 files changed, 0 insertions, 9 deletions
diff --git a/conform/data/stdlib.h-data b/conform/data/stdlib.h-data
index d8fcccc..6913828 100644
--- a/conform/data/stdlib.h-data
+++ b/conform/data/stdlib.h-data
@@ -149,9 +149,6 @@ function {unsigned short int*} seed48 (unsigned short int[3])
#if !defined ISO && !defined ISO99 && !defined ISO11 && !defined POSIX && !defined XPG4 && !defined XPG42 && !defined UNIX98
function int setenv (const char*, const char*, int)
#endif
-#if !defined ISO && !defined ISO99 && !defined ISO11 && !defined POSIX && !defined POSIX2008
-function void setkey (const char*)
-#endif
#if !defined ISO && !defined ISO99 && !defined ISO11 && !defined XPG4 && !defined POSIX && !defined POSIX2008
function {char*} setstate (char*)
#endif
diff --git a/conform/data/unistd.h-data b/conform/data/unistd.h-data
index ddf4f25..aa07052 100644
--- a/conform/data/unistd.h-data
+++ b/conform/data/unistd.h-data
@@ -437,9 +437,6 @@ function int chroot (const char*)
function int chown (const char*, uid_t, gid_t)
function int close (int)
function size_t confstr (int, char*, size_t)
-#if !defined POSIX && !defined POSIX2008
-function {char*} crypt (const char*, const char*)
-#endif
#if defined XPG4 || defined XPG42 || defined UNIX98
function {char*} ctermid (char*)
function {char*} cuserid (char*)
@@ -449,9 +446,6 @@ allow cuserid
#endif
function int dup (int)
function int dup2 (int, int)
-#if !defined POSIX && !defined POSIX2008
-function void encrypt (char[64], int)
-#endif
function int execl (const char*, const char*, ...)
function int execle (const char*, const char*, ...)
function int execlp (const char*, const char*, ...)