Script 'mail_helper' called by obssrc
Hello community,
here is the log from the commit of package ghc-ech-config for openSUSE:Factory
checked in at 2026-11-06 19:48:49
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Comparing /work/SRC/openSUSE:Factory/ghc-ech-config (Old)
and /work/SRC/openSUSE:Factory/.ghc-ech-config.new.3759290 (New)
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "ghc-ech-config"
Fri Nov 6 19:48:49 2026 rev:3 rq:1395530 version:0.0.2
Changes:
--------
--- /work/SRC/openSUSE:Factory/ghc-ech-config/ghc-ech-config.changes
2026-06-10 16:00:44.903602589 +0200
+++
/work/SRC/openSUSE:Factory/.ghc-ech-config.new.3759290/ghc-ech-config.changes
2026-11-06 19:55:20.131546973 +0100
@@ -1,0 +2,9 @@
+Sun Oct 25 08:56:55 UTC 2026 - Peter Simons <[email protected]>
+
+- Update ech-config to version 0.0.2.
+ ## 0.0.2
+
+ * Refuse trailing data and ignore ECHConfigs of unknown versions.
+ [#621](https://github.com/haskell-tls/hs-tls/pull/621)
+
+-------------------------------------------------------------------
Old:
----
ech-config-0.0.1.tar.gz
ech-config.cabal
New:
----
ech-config-0.0.2.tar.gz
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Other differences:
------------------
++++++ ghc-ech-config.spec ++++++
--- /var/tmp/diff_new_pack.b6IYtz/_old 2026-11-06 19:55:21.561606850 +0100
+++ /var/tmp/diff_new_pack.b6IYtz/_new 2026-11-06 19:55:21.566607059 +0100
@@ -19,13 +19,12 @@
%global pkg_name ech-config
%global pkgver %{pkg_name}-%{version}
Name: ghc-%{pkg_name}
-Version: 0.0.1
+Version: 0.0.2
Release: 0
Summary: Config for TLS Encrypted Client Hello
License: BSD-3-Clause
URL: https://hackage.haskell.org/package/%{pkg_name}
Source0:
https://hackage.haskell.org/package/%{pkg_name}-%{version}/%{pkg_name}-%{version}.tar.gz
-Source1:
https://hackage.haskell.org/package/%{pkg_name}-%{version}/revision/1.cabal#/%{pkg_name}.cabal
BuildRequires: ghc-Cabal-devel
BuildRequires: ghc-base-devel
BuildRequires: ghc-base-prof
@@ -71,7 +70,6 @@
%prep
%autosetup -n %{pkg_name}-%{version}
-cp -p %{SOURCE1} %{pkg_name}.cabal
%build
%ghc_lib_build
++++++ ech-config-0.0.1.tar.gz -> ech-config-0.0.2.tar.gz ++++++
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/ech-config-0.0.1/ChangeLog.md
new/ech-config-0.0.2/ChangeLog.md
--- old/ech-config-0.0.1/ChangeLog.md 2001-09-09 03:46:40.000000000 +0200
+++ new/ech-config-0.0.2/ChangeLog.md 2001-09-09 03:46:40.000000000 +0200
@@ -1,5 +1,10 @@
# ChangeLog for ech-config
+## 0.0.2
+
+* Refuse trailing data and ignore ECHConfigs of unknown versions.
+ [#621](https://github.com/haskell-tls/hs-tls/pull/621)
+
## 0.0.1
* Making Show more friendly to dnsext-*
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/ech-config-0.0.1/Network/TLS/ECH/Config.hs
new/ech-config-0.0.2/Network/TLS/ECH/Config.hs
--- old/ech-config-0.0.1/Network/TLS/ECH/Config.hs 2001-09-09
03:46:40.000000000 +0200
+++ new/ech-config-0.0.2/Network/TLS/ECH/Config.hs 2001-09-09
03:46:40.000000000 +0200
@@ -33,10 +33,12 @@
) where
import qualified Control.Exception as E
+import Control.Monad (unless, when)
import qualified Data.ByteString as BS
import qualified Data.ByteString.Base16 as B16
import qualified Data.ByteString.Char8 as C8
import Data.Char (isDigit)
+import Data.Maybe (catMaybes)
import Data.Word
import Network.ByteOrder
import System.FilePath (takeFileName)
@@ -221,7 +223,7 @@
----------------------------------------------------------------
-- | Type for configuration of encrypted client hello.
-data ECHConfig = ECHConfig
+newtype ECHConfig = ECHConfig
{ contents :: ECHConfigContents
}
deriving (Eq, Ord)
@@ -233,10 +235,18 @@
show ECHConfig{..} = show contents
getECHConfig :: ReadBuffer -> IO ECHConfig
-getECHConfig rbuf = do
- _ver <- read16 rbuf
- _len <- read16 rbuf
- ECHConfig <$> getECHConfigContents rbuf
+getECHConfig rbuf =
+ getECHConfig' rbuf >>= maybe (fail "unknown ECHConfig version") return
+
+-- The contents fill the length exactly. One of an unknown version is
+-- skipped by its length and gives Nothing.
+getECHConfig' :: ReadBuffer -> IO (Maybe ECHConfig)
+getECHConfig' rbuf = do
+ ver <- read16 rbuf
+ body <- getOpaque16 rbuf
+ if ver /= 0xfe0d
+ then return Nothing
+ else Just . ECHConfig <$> withReadBuffer body (whole
getECHConfigContents)
putECHConfig :: WriteBuffer -> ECHConfig -> IO ()
putECHConfig wbuf ECHConfig{..} = do
@@ -244,7 +254,7 @@
withLength16 wbuf $ putECHConfigContents wbuf contents
sizeOfECHConfig :: ECHConfig -> Int
-sizeOfECHConfig cnf = sizeof cnf
+sizeOfECHConfig = sizeof
-- | Encoder for 'ECHConfig'.
encodeECHConfig :: ECHConfig -> ByteString
@@ -258,7 +268,7 @@
unsafePerformIO $
E.handle handler $
withReadBuffer bs $
- \rbuf -> Just <$> getECHConfig rbuf
+ \rbuf -> Just <$> whole getECHConfig rbuf
where
handler (E.SomeException _) = return Nothing
@@ -267,8 +277,9 @@
-- | A list of 'ECHConfig'.
type ECHConfigList = [ECHConfig]
+-- | ECHConfigs of unknown versions are ignored (RFC 9849 Section 4).
getECHConfigList :: ReadBuffer -> IO [ECHConfig]
-getECHConfigList rbuf = getList16 rbuf getECHConfig
+getECHConfigList rbuf = catMaybes <$> getList16 rbuf getECHConfig'
putECHConfigList :: WriteBuffer -> [ECHConfig] -> IO ()
putECHConfigList wbuf configs =
@@ -290,7 +301,7 @@
unsafePerformIO $
E.handle handler $
withReadBuffer bs $
- \rbuf -> Just <$> getECHConfigList rbuf
+ \rbuf -> Just <$> whole getECHConfigList rbuf
where
handler (E.SomeException _) = return Nothing
@@ -299,7 +310,7 @@
loadECHConfigList :: FilePath -> IO [ECHConfig]
loadECHConfigList file = do
bs <- C8.readFile file
- withReadBuffer bs $ getECHConfigList
+ withReadBuffer bs getECHConfigList
-- | Loading secret keys stored in files whose names
-- are "\<num\>.key".
@@ -349,7 +360,18 @@
then do
x <- parer rbuf
loop lim (build . (x :))
- else return $ build []
+ else do
+ -- The last element must not run past the list.
+ when (cur > lim) $ fail "list overrun"
+ return $ build []
+
+-- Fails unless the parser consumes the whole buffer.
+whole :: (ReadBuffer -> IO a) -> ReadBuffer -> IO a
+whole parser rbuf = do
+ x <- parser rbuf
+ r <- remainingSize rbuf
+ unless (r == 0) $ fail "trailing data"
+ return x
withLength16 :: WriteBuffer -> IO () -> IO ()
withLength16 wbuf builder = do
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/ech-config-0.0.1/ech-config.cabal
new/ech-config-0.0.2/ech-config.cabal
--- old/ech-config-0.0.1/ech-config.cabal 2001-09-09 03:46:40.000000000
+0200
+++ new/ech-config-0.0.2/ech-config.cabal 2001-09-09 03:46:40.000000000
+0200
@@ -1,6 +1,6 @@
-cabal-version: >=1.10
+cabal-version: 2.0
name: ech-config
-version: 0.0.1
+version: 0.0.2
license: BSD3
license-file: LICENSE
maintainer: [email protected]
@@ -27,7 +27,7 @@
base16-bytestring,
bytestring,
filepath,
- network-byte-order
+ network-byte-order >=0.1.7
executable ech-gen
main-is: ech-gen.hs
@@ -50,4 +50,4 @@
source-repository head
type: git
location: https://github.com/haskell-tls/hs-tls
- subdir: tls
+ subdir: ech-config
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/ech-config-0.0.1/util/ech-gen.hs
new/ech-config-0.0.2/util/ech-gen.hs
--- old/ech-config-0.0.1/util/ech-gen.hs 2001-09-09 03:46:40.000000000
+0200
+++ new/ech-config-0.0.2/util/ech-gen.hs 2001-09-09 03:46:40.000000000
+0200
@@ -99,7 +99,7 @@
BS.writeFile secfileP secPEM
{-
let secfileN = num ++ ".nss"
- x = magic <> skm -- FIXME: pk is neccessary, sigh.
+ x = magic <> skm -- FIXME: pk is necessary, sigh.
len = BS.length x
(a, b) = len `divMod` 256
y = BS.pack [fromIntegral a, fromIntegral b] <> x
<> encodedConfigList
