Merge remote-tracking branch 'upstream/master' into hardened-stdenv

17 files changed, 209 insertions, 34 deletions

diff --git a/pkgs/tools/security/bruteforce-luks/default.nix b/pkgs/tools/security/bruteforce-luks/default.nix
index a28f949c7fdd..85773953af0f 100644
--- a/pkgs/tools/security/bruteforce-luks/default.nix
+++ b/pkgs/tools/security/bruteforce-luks/default.nix
@@ -2,10 +2,10 @@
 
 stdenv.mkDerivation rec {
   name = "bruteforce-luks-${version}";
-  version = "1.2.0";
+  version = "1.2.1";
 
   src = fetchFromGitHub {
-    sha256 = "0d01rn45dg7ysa75r8z0b31hj1z7w47vv5vr359pl71zxgzngjd2";
+    sha256 = "1i3qr2qgqdx3a5kjl0wrjh9kw8fx2indrj57z6911nx747pmda0n";
     rev = version;
     repo = "bruteforce-luks";
     owner = "glv2";
diff --git a/pkgs/tools/security/chaps/default.nix b/pkgs/tools/security/chaps/default.nix
index 1d3f530dd9fc..43e324ec2694 100644
--- a/pkgs/tools/security/chaps/default.nix
+++ b/pkgs/tools/security/chaps/default.nix
@@ -28,7 +28,7 @@ stdenv.mkDerivation rec {
   src = fetchgit {
     url = "https://github.com/google/chaps-linux";
     rev = "989aadc45cdb216ca35b0c97d13fc691576fa1d7";
-    sha256 = "c58e08e89d36050cd831116819d555f0e24e7bf11047cb18f2a2eead45ba67be";
+    sha256 = "0chk6pnn365d5kcz6vfqx1d0383ksk97icc0lzg0vvb0kvyj0ff1";
   };
 
   patches = [ ./fix_absolute_path.patch  ./fix_environment_variables.patch  ./fix_scons.patch  ./insert_prefetches.patch ];
diff --git a/pkgs/tools/security/fprint_demo/default.nix b/pkgs/tools/security/fprint_demo/default.nix
index 8efd04690dbe..26e0d0e45e13 100644
--- a/pkgs/tools/security/fprint_demo/default.nix
+++ b/pkgs/tools/security/fprint_demo/default.nix
@@ -6,7 +6,7 @@ stdenv.mkDerivation rec {
   src = fetchgit {
     url = "git://github.com/dsd/fprint_demo";
     rev = "5d86c3f778bf97a29b73bdafbebd1970e560bfb0";
-    sha256 = "fe5bbf8d062fedd6fa796e50c5bd95fef49580eb0a890f78d6f55bd51cc94234";
+    sha256 = "1rysqd8kdqgis1ykrbkiy1bcxav3vna8zdgbamyxw4hj5764xdcm";
   };
 
   buildInputs = [ libfprint gtk2 ];
diff --git a/pkgs/tools/security/hologram/default.nix b/pkgs/tools/security/hologram/default.nix
new file mode 100644
index 000000000000..5e8d260d6936
--- /dev/null
+++ b/pkgs/tools/security/hologram/default.nix
@@ -0,0 +1,17 @@
+{ stdenv, lib, buildGoPackage, fetchgit, fetchhg, fetchbzr, fetchsvn }:
+
+buildGoPackage rec {
+  name = "hologram-${version}";
+  version = "20160209-${stdenv.lib.strings.substring 0 7 rev}";
+  rev = "8d86e3fdcbfd967ba58d8de02f5e8173c101212e";
+
+  goPackagePath = "github.com/AdRoll/hologram";
+
+  src = fetchgit {
+    inherit rev;
+    url = "https://github.com/AdRoll/hologram";
+    sha256 = "0i0p170brdsczfz079mqbc5y7x7mdph04p3wgqsd7xcrddvlkkaf";
+  };
+
+  goDeps = ./deps.json;
+}
diff --git a/pkgs/tools/security/hologram/deps.json b/pkgs/tools/security/hologram/deps.json
new file mode 100644
index 000000000000..177c960933e8
--- /dev/null
+++ b/pkgs/tools/security/hologram/deps.json
@@ -0,0 +1,19 @@
+[
+  {
+    "include": "../../libs.json",
+    "packages": [
+      "github.com/aybabtme/rgbterm",
+      "github.com/vaughan0/go-ini",
+      "github.com/howeyc/gopass",
+      "github.com/AdRoll/hologram",
+      "github.com/mitchellh/go-homedir",
+      "github.com/goamz/goamz",
+      "github.com/nmcclain/asn1-ber",
+      "gopkg.in/asn1-ber.v1",
+      "github.com/peterbourgon/g2s",
+      "github.com/nmcclain/ldap",
+      "github.com/golang/protobuf",
+      "golang.org/x/crypto"
+    ]
+  }
+]
diff --git a/pkgs/tools/security/nsjail/default.nix b/pkgs/tools/security/nsjail/default.nix
index f2ec3af139fa..3e4ddcd880e9 100644
--- a/pkgs/tools/security/nsjail/default.nix
+++ b/pkgs/tools/security/nsjail/default.nix
@@ -6,7 +6,7 @@ stdenv.mkDerivation rec {
   src = fetchgit {
     url = https://github.com/google/nsjail;
     rev = "8b951e6c2827386786cde4a124cd1846d25b9404";
-    sha256 = "b3b863423cc676111d2d1afbac524eee6fa824588cafccb7c42ff470508a13b1";
+    sha256 = "02bmwd48l6ngp0nc65flw395mpj66brx3808d5xd19qn5524lnni";
   };
 
   installPhase = ''
diff --git a/pkgs/tools/security/pcsc-cyberjack/default.nix b/pkgs/tools/security/pcsc-cyberjack/default.nix
new file mode 100644
index 000000000000..18c3af7924a9
--- /dev/null
+++ b/pkgs/tools/security/pcsc-cyberjack/default.nix
@@ -0,0 +1,30 @@
+{ stdenv, fetchurl, pkgconfig, libusb, pcsclite }:
+
+stdenv.mkDerivation rec {
+  name = "pcsc-cyberjack-${version}";
+  version = "3.99.5_SP09";
+
+  src = with stdenv.lib; let
+    splittedVer = splitString "_" version;
+    mainVer = if length splittedVer >= 1 then head splittedVer else version;
+    spVer = optionalString (length splittedVer >= 1) ("." + last splittedVer);
+    tarballVersion = "${mainVer}final${spVer}";
+  in fetchurl {
+    url = "http://support.reiner-sct.de/downloads/LINUX/V${version}"
+        + "/pcsc-cyberjack-${tarballVersion}.tar.bz2";
+    sha256 = "1m1r26q0k2hrxfi73j4v25qfh20x4b1hcbcpgjgv7qxa33dbi30z";
+  };
+
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ libusb pcsclite ];
+
+  configureFlags = [ "--with-usbdropdir=\${prefix}/pcsc/drivers" ];
+
+  meta = with stdenv.lib; {
+    description = "REINER SCT cyberJack USB chipcard reader user space driver";
+    homepage = "http://www.reiner-sct.com/";
+    license = licenses.gpl2Plus;
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ aszlig ];
+  };
+}
diff --git a/pkgs/tools/security/pcsclite/default.nix b/pkgs/tools/security/pcsclite/default.nix
index e75b6a8372cf..509a8a12092b 100644
--- a/pkgs/tools/security/pcsclite/default.nix
+++ b/pkgs/tools/security/pcsclite/default.nix
@@ -1,20 +1,30 @@
 { stdenv, fetchurl, pkgconfig, udev, dbus_libs, perl, python2 }:
 
 stdenv.mkDerivation rec {
-  name = "pcsclite-1.8.16";
+  name = "pcsclite-${version}";
+  version = "1.8.17";
 
   src = fetchurl {
-    url = "https://alioth.debian.org/frs/download.php/file/4164/pcsc-lite-1.8.16.tar.bz2";
-    sha256 = "12k8q0ckyy1fqcfh7x0b7kfrlfiscrqaqmidcggnzs4pi2iqml77";
+    url = "https://alioth.debian.org/frs/download.php/file/4173/pcsc-lite-${version}.tar.bz2";
+    sha256 = "0vq2291kvnbg8czlakqahxrdhsvp74fqy3z75lfjlkq2aj36yayp";
   };
 
+  patches = [ ./no-dropdir-literals.patch ];
+
   configureFlags = [
     # The OS should care on preparing the drivers into this location
     "--enable-usbdropdir=/var/lib/pcsc/drivers"
     "--enable-confdir=/etc"
+    "--enable-ipcdir=/run/pcscd"
   ] ++ stdenv.lib.optional stdenv.isLinux
          "--with-systemdsystemunitdir=\${out}/etc/systemd/system";
 
+  postConfigure = ''
+    sed -i -re '/^#define *PCSCLITE_HP_DROPDIR */ {
+      s/(DROPDIR *)(.*)/\1(getenv("PCSCLITE_HP_DROPDIR") ? : \2)/
+    }' config.h
+  '';
+
   nativeBuildInputs = [ pkgconfig perl python2 ];
   buildInputs = stdenv.lib.optionals stdenv.isLinux [ udev dbus_libs ];
 
diff --git a/pkgs/tools/security/pcsclite/no-dropdir-literals.patch b/pkgs/tools/security/pcsclite/no-dropdir-literals.patch
new file mode 100644
index 000000000000..6e6734c95432
--- /dev/null
+++ b/pkgs/tools/security/pcsclite/no-dropdir-literals.patch
@@ -0,0 +1,73 @@
+diff --git a/src/hotplug_libudev.c b/src/hotplug_libudev.c
+index a8ba1b8..a53700b 100644
+--- a/src/hotplug_libudev.c
++++ b/src/hotplug_libudev.c
+@@ -119,7 +119,8 @@ static LONG HPReadBundleValues(void)
+ 
+ 	if (NULL == hpDir)
+ 	{
+-		Log1(PCSC_LOG_ERROR, "Cannot open PC/SC drivers directory: " PCSCLITE_HP_DROPDIR);
++		Log2(PCSC_LOG_ERROR, "Cannot open PC/SC drivers directory: %s",
++			PCSCLITE_HP_DROPDIR);
+ 		Log1(PCSC_LOG_ERROR, "Disabling USB support for pcscd.");
+ 		return -1;
+ 	}
+@@ -722,7 +723,7 @@ ULONG HPRegisterForHotplugEvents(void)
+ 
+ 	if (driverSize <= 0)
+ 	{
+-		Log1(PCSC_LOG_INFO, "No bundle files in pcsc drivers directory: "
++		Log2(PCSC_LOG_INFO, "No bundle files in pcsc drivers directory: %s",
+ 			PCSCLITE_HP_DROPDIR);
+ 		Log1(PCSC_LOG_INFO, "Disabling USB support for pcscd");
+ 		return 0;
+diff --git a/src/hotplug_libusb.c b/src/hotplug_libusb.c
+index eff8519..8dd496d 100644
+--- a/src/hotplug_libusb.c
++++ b/src/hotplug_libusb.c
+@@ -138,7 +138,8 @@ static LONG HPReadBundleValues(void)
+ 
+ 	if (hpDir == NULL)
+ 	{
+-		Log1(PCSC_LOG_ERROR, "Cannot open PC/SC drivers directory: " PCSCLITE_HP_DROPDIR);
++		Log2(PCSC_LOG_ERROR, "Cannot open PC/SC drivers directory: %s",
++			PCSCLITE_HP_DROPDIR);
+ 		Log1(PCSC_LOG_ERROR, "Disabling USB support for pcscd.");
+ 		return -1;
+ 	}
+@@ -265,7 +266,8 @@ static LONG HPReadBundleValues(void)
+ 
+ 	if (driverSize == 0)
+ 	{
+-		Log1(PCSC_LOG_INFO, "No bundle files in pcsc drivers directory: " PCSCLITE_HP_DROPDIR);
++		Log2(PCSC_LOG_INFO, "No bundle files in pcsc drivers directory: %s",
++			PCSCLITE_HP_DROPDIR);
+ 		Log1(PCSC_LOG_INFO, "Disabling USB support for pcscd");
+ 	}
+ #ifdef DEBUG_HOTPLUG
+diff --git a/src/hotplug_linux.c b/src/hotplug_linux.c
+index bf69af8..64b0ed7 100644
+--- a/src/hotplug_linux.c
++++ b/src/hotplug_linux.c
+@@ -130,8 +130,8 @@ static LONG HPReadBundleValues(void)
+ 
+ 	if (hpDir == NULL)
+ 	{
+-		Log1(PCSC_LOG_INFO,
+-			"Cannot open PC/SC drivers directory: " PCSCLITE_HP_DROPDIR);
++		Log2(PCSC_LOG_INFO, "Cannot open PC/SC drivers directory: %s",
++			PCSCLITE_HP_DROPDIR);
+ 		Log1(PCSC_LOG_INFO, "Disabling USB support for pcscd.");
+ 		return -1;
+ 	}
+@@ -219,8 +219,8 @@ end:
+ 
+ 	if (bundleSize == 0)
+ 	{
+-		Log1(PCSC_LOG_INFO,
+-			"No bundle files in pcsc drivers directory: " PCSCLITE_HP_DROPDIR);
++		Log2(PCSC_LOG_INFO, "No bundle files in pcsc drivers directory: %s",
++			PCSCLITE_HP_DROPDIR);
+ 		Log1(PCSC_LOG_INFO, "Disabling USB support for pcscd");
+ 	}
+ 
diff --git a/pkgs/tools/security/sbsigntool/default.nix b/pkgs/tools/security/sbsigntool/default.nix
index fceb4c821281..bca93887bd4e 100644
--- a/pkgs/tools/security/sbsigntool/default.nix
+++ b/pkgs/tools/security/sbsigntool/default.nix
@@ -8,7 +8,7 @@ stdenv.mkDerivation rec {
   src = fetchgit {
     url = "git://kernel.ubuntu.com/jk/sbsigntool";
     rev = "951ee95a301674c046f55330cd7460e1314deff2";
-    sha256 = "09k8by0qq8j7ff812l1l9z9frsx5c4cmhj5in3g1sgyz3v55nfy7";
+    sha256 = "1skqrfhvsaay01l94m57sxxqp909rvn07xwmzc6vzzfcnsh6f2yk";
   };
 
   patches = [ ./autoconf.patch ];
diff --git a/pkgs/tools/security/simple-tpm-pk11/default.nix b/pkgs/tools/security/simple-tpm-pk11/default.nix
index 811618d66028..f22966dca4a1 100644
--- a/pkgs/tools/security/simple-tpm-pk11/default.nix
+++ b/pkgs/tools/security/simple-tpm-pk11/default.nix
@@ -6,7 +6,7 @@ stdenv.mkDerivation rec {
   src = fetchgit {
     url = "https://github.com/ThomasHabets/simple-tpm-pk11";
     rev = "f26f10e11344560ff6e1479e6795dc0e5dc49a26";
-    sha256 = "8c9501ceed0557113ce3facf7b22b8baf6f32ebb092008c089b80334ed03cec9";
+    sha256 = "0546lhxssngpkrhg5kmrvn4bm1s2kyd20kvhz3rfavfrvr72cs9k";
   };
 
   buildInputs = [ trousers openssl opencryptoki automake autoconf libtool ];
diff --git a/pkgs/tools/security/sslscan/default.nix b/pkgs/tools/security/sslscan/default.nix
index dd124c4efe6d..50cc380b970e 100644
--- a/pkgs/tools/security/sslscan/default.nix
+++ b/pkgs/tools/security/sslscan/default.nix
@@ -2,18 +2,17 @@
 
 stdenv.mkDerivation rec {
   name = "sslscan-${version}";
-  version = "1.11.0";
+  version = "1.11.5";
 
   src = fetchurl {
     url = "https://github.com/rbsec/sslscan/archive/${version}-rbsec.tar.gz";
-    sha256 = "19d6vpcihfqs35hni4vigcpqabbnd3sndr5wyvfsladgp40vz3b9";
+    sha256 = "0mcg8hyx1r9sq716bw1r554fcsf512khgcms2ixxb1c31ng6lhq6";
   };
 
   buildInputs = [ openssl ];
 
   installFlags = [
-    "BINPATH=$(out)/bin"
-    "MANPATH=$(out)/share/man"
+    "PREFIX=$(out)"
   ];
 
   meta = with stdenv.lib; {
diff --git a/pkgs/tools/security/tcpcrypt/default.nix b/pkgs/tools/security/tcpcrypt/default.nix
index 4dbcdf71f9f9..48eefcb0f187 100644
--- a/pkgs/tools/security/tcpcrypt/default.nix
+++ b/pkgs/tools/security/tcpcrypt/default.nix
@@ -1,27 +1,34 @@
-{ fetchurl, stdenv, autoconf, automake, libtool, autoreconfHook
-, openssl, libcap, libnfnetlink, libnetfilter_queue
+{ stdenv, fetchFromGitHub, autoreconfHook
+, openssl
+, libcap, libpcap, libnfnetlink, libnetfilter_conntrack, libnetfilter_queue
 }:
 
+with stdenv.lib;
+
 stdenv.mkDerivation rec {
-  name = "tcpcrypt-0.3-rc1";
+  name = "tcpcrypt-${version}";
+  version = "0.4";
 
-  src = fetchurl {
-    url = "https://github.com/scslab/tcpcrypt/archive/v0.3-rc1.tar.gz";
-    sha256 = "1k79xfip95kyy91b6rnmsgl66g52zrnm92ln4jms133nm2k9s4sa";
-    name = "${name}.tar.gz";
+  src = fetchFromGitHub {
+    repo = "tcpcrypt";
+    owner = "scslab";
+    rev = "v${version}";
+    sha256 = "04n1qpf4x8x289xa7jndmx99xp0lbxjzjw013kf64i1n70i9wbnp";
   };
 
-  dontStrip = true;
+  postUnpack = ''mkdir -vp $sourceRoot/m4'';
 
-  buildInputs = [ autoreconfHook autoconf automake libtool openssl libcap libnfnetlink libnetfilter_queue ];
+  outputs = [ "dev" "out" "bin" ];
+  nativeBuildInputs = [ autoreconfHook ];
+  buildInputs = [ openssl ]
+    ++ optionals stdenv.isLinux [ libcap libpcap libnfnetlink libnetfilter_conntrack libnetfilter_queue ];
 
-  postUnpack = ''
-    mkdir $sourceRoot/m4
-  '';
+  enableParallelBuilding = true;
 
   meta = {
-    homepage = "http://tcpcrypt.org/";
-    description = "enable opportunistic encryption of all TCP traffic";
-    platforms = stdenv.lib.platforms.linux;
+    homepage = http://tcpcrypt.org/;
+    description = "Fast TCP encryption";
+    platforms = platforms.all;
+    license = licenses.bsd2;
   };
 }
diff --git a/pkgs/tools/security/tor/torbrowser.nix b/pkgs/tools/security/tor/torbrowser.nix
index c8f9c3dae970..03d73183704f 100644
--- a/pkgs/tools/security/tor/torbrowser.nix
+++ b/pkgs/tools/security/tor/torbrowser.nix
@@ -12,13 +12,13 @@ in
 
 stdenv.mkDerivation rec {
   name = "tor-browser-${version}";
-  version = "5.5.5";
+  version = "6.0.1";
 
   src = fetchurl {
     url = "https://archive.torproject.org/tor-package-archive/torbrowser/${version}/tor-browser-linux${if stdenv.is64bit then "64" else "32"}-${version}_en-US.tar.xz";
     sha256 = if stdenv.is64bit then
-      "0k6v41j880fb4zdxk1v13kmizdaz5rwvi5lskdbdi68iml4p53gj" else
-      "04mqjmnxwa75yi8gmdwadkzrzikgxn08bkvr50zdm7id9fj4nkza";
+      "1n3k0bhjmbmj1rdgyifqya6135wapafqygfviv6x52ng8sa2jhk1" else
+      "169f90w0fl4pqq9dbhzr6pkk15gqvp7813asqqh1p7s2a32zczza";
   };
 
   desktopItem = makeDesktopItem {
@@ -59,6 +59,10 @@ stdenv.mkDerivation rec {
       mkdir -p \$HOME && cp -R $out/share/tor-browser/Browser/TorBrowser/Data \$HOME/ && chmod -R +w \$HOME
       echo "pref(\"extensions.torlauncher.tordatadir_path\", \"\$HOME/Data/Tor/\");" >> \
         ~/Data/Browser/profile.default/preferences/extension-overrides.js
+      echo "pref(\"extensions.torlauncher.torrc-defaults_path\", \"\$HOME/Data/Tor/torrc-defaults\");" >> \
+        ~/Data/Browser/profile.default/preferences/extension-overrides.js
+      echo "pref(\"extensions.torlauncher.tor_path\", \"$out/share/tor-browser/Browser/TorBrowser/Tor/tor\");" >> \
+        ~/Data/Browser/profile.default/preferences/extension-overrides.js
     fi
     export FONTCONFIG_PATH=\$HOME/Data/fontconfig
     export LD_LIBRARY_PATH=${libPath}:$out/share/tor-browser/Browser/TorBrowser/Tor
diff --git a/pkgs/tools/security/tor/torsocks.nix b/pkgs/tools/security/tor/torsocks.nix
index d7b0139df701..ee4749683a52 100644
--- a/pkgs/tools/security/tor/torsocks.nix
+++ b/pkgs/tools/security/tor/torsocks.nix
@@ -7,7 +7,7 @@ stdenv.mkDerivation rec {
   src = fetchgit {
     url    = meta.repositories.git;
     rev    = "refs/tags/v${version}";
-    sha256 = "1q7rbf0j54jh17qs76b6k9hzv4sh4044qfzidjrp6gx576ysrvsf";
+    sha256 = "1l890pg0h2hqpkabsnwc6pq2qi8mfv58qzaaicc9y62rq5nmrrws";
   };
 
   buildInputs = [ autoreconfHook ];
diff --git a/pkgs/tools/security/tpm-luks/default.nix b/pkgs/tools/security/tpm-luks/default.nix
index 70dbc65040d4..40829df56cae 100644
--- a/pkgs/tools/security/tpm-luks/default.nix
+++ b/pkgs/tools/security/tpm-luks/default.nix
@@ -7,7 +7,7 @@ stdenv.mkDerivation rec {
   src = fetchgit {
     url = "https://github.com/momiji/tpm-luks";
     rev = "c9c5b7fdddbcdac1cd4d2ea6baddd0617cc88ffa";
-    sha256 = "fdd451caddb4e51ede3f2406245e1ace57389596e85aa402c9f2606303707539";
+    sha256 = "1ms2v57f13r9km6mvf9rha5ndmlmjvrz3mcikai6nzhpj0nrjz0w";
   };
 
   buildInputs = [ autoreconfHook gawk trousers cryptsetup openssl ];
diff --git a/pkgs/tools/security/vault/default.nix b/pkgs/tools/security/vault/default.nix
new file mode 100644
index 000000000000..1197c840fc9a
--- /dev/null
+++ b/pkgs/tools/security/vault/default.nix
@@ -0,0 +1,16 @@
+{ stdenv, lib, buildGoPackage, fetchFromGitHub }:
+
+buildGoPackage rec {
+  name = "vault-${version}";
+  version = "0.5.2";
+  rev = "v${version}";
+
+  goPackagePath = "github.com/hashicorp/vault";
+
+  src = fetchFromGitHub {
+    inherit rev;
+    owner = "hashicorp";
+    repo = "vault";
+    sha256 = "085rk5i480wdlkn2p14yxi8zgsc11595nkkda1i77c4vjkllbkdy";
+  };
+}