Git-Url: http://git.frugalware.org/gitweb/gitweb.cgi?p=frugalware-current.git;a=commitdiff;h=3fed3e86ef5d21ce870abcb6159b8a93b85ea64f
commit 3fed3e86ef5d21ce870abcb6159b8a93b85ea64f Author: DeX77 <[email protected]> Date: Thu May 28 11:23:12 2015 +0200 openvpn-2.3.6-1-x86_64 * take maintainership * version bump diff --git a/source/network-extra/openvpn/CVE-2013-2061.patch b/source/network-extra/openvpn/CVE-2013-2061.patch deleted file mode 100644 index 91283d0..0000000 --- a/source/network-extra/openvpn/CVE-2013-2061.patch +++ /dev/null @@ -1,80 +0,0 @@ -Backport of: - -From 11d21349a4e7e38a025849479b36ace7c2eec2ee Mon Sep 17 00:00:00 2001 -From: Steffan Karger <[email protected]> -Date: Tue, 19 Mar 2013 13:01:50 +0100 -Subject: [PATCH] Use constant time memcmp when comparing HMACs in - openvpn_decrypt. - -Signed-off-by: Steffan Karger <[email protected]> -Acked-by: Gert Doering <[email protected]> -Signed-off-by: Gert Doering <[email protected]> ---- - src/openvpn/buffer.h | 8 ++++++++ - src/openvpn/crypto.c | 20 +++++++++++++++++++- - 2 files changed, 27 insertions(+), 1 deletion(-) - -Index: openvpn-2.2.1/buffer.h -=================================================================== ---- openvpn-2.2.1.orig/buffer.h 2014-09-30 14:55:10.821364908 -0400 -+++ openvpn-2.2.1/buffer.h 2014-09-30 14:55:10.813364908 -0400 -@@ -620,6 +620,10 @@ - } - } - -+/** -+ * Compare src buffer contents with match. -+ * *NOT* constant time. Do not use when comparing HMACs. -+ */ - static inline bool - buf_string_match (const struct buffer *src, const void *match, int size) - { -@@ -628,6 +632,10 @@ - return memcmp (BPTR (src), match, size) == 0; - } - -+/** -+ * Compare first size bytes of src buffer contents with match. -+ * *NOT* constant time. Do not use when comparing HMACs. -+ */ - static inline bool - buf_string_match_head (const struct buffer *src, const void *match, int size) - { -Index: openvpn-2.2.1/crypto.c -=================================================================== ---- openvpn-2.2.1.orig/crypto.c 2014-09-30 14:55:10.821364908 -0400 -+++ openvpn-2.2.1/crypto.c 2014-09-30 14:55:10.813364908 -0400 -@@ -70,6 +70,24 @@ - #define CRYPT_ERROR(format) \ - do { msg (D_CRYPT_ERRORS, "%s: " format, error_prefix); goto error_exit; } while (false) - -+/** -+ * As memcmp(), but constant-time. -+ * Returns 0 when data is equal, non-zero otherwise. -+ */ -+static int -+memcmp_constant_time (const void *a, const void *b, size_t size) { -+ const uint8_t * a1 = a; -+ const uint8_t * b1 = b; -+ int ret = 0; -+ size_t i; -+ -+ for (i = 0; i < size; i++) { -+ ret |= *a1++ ^ *b1++; -+ } -+ -+ return ret; -+} -+ - void - openvpn_encrypt (struct buffer *buf, struct buffer work, - const struct crypto_options *opt, -@@ -254,7 +272,7 @@ - ASSERT (hmac_len == in_hmac_len); - - /* Compare locally computed HMAC with packet HMAC */ -- if (memcmp (local_hmac, BPTR (buf), hmac_len)) -+ if (memcmp_constant_time (local_hmac, BPTR (buf), hmac_len)) - CRYPT_ERROR ("packet HMAC authentication failed"); - - ASSERT (buf_advance (buf, hmac_len)); diff --git a/source/network-extra/openvpn/CVE-2014-8104.patch b/source/network-extra/openvpn/CVE-2014-8104.patch deleted file mode 100644 index 68c3e92..0000000 --- a/source/network-extra/openvpn/CVE-2014-8104.patch +++ /dev/null @@ -1,42 +0,0 @@ -From c5590a6821e37f3b29735f55eb0c2b9c0924138c Mon Sep 17 00:00:00 2001 -From: Steffan Karger <[email protected]> -Date: Thu, 20 Nov 2014 13:43:05 +0100 -Subject: [PATCH] Drop too-short control channel packets instead of asserting - out. - -This fixes a denial-of-service vulnerability where an authenticated client -could stop the server by triggering a server-side ASSERT(). - -OpenVPN would previously ASSERT() that control channel packets have a -payload of at least 4 bytes. An authenticated client could trigger this -assert by sending a too-short control channel packet to the server. - -Thanks to Dragana Damjanovic for reporting the issue. - -This bug has been assigned CVE-2014-8104. - -Signed-off-by: Steffan Karger <[email protected]> -Acked-by: Gert Doering <[email protected]> -Message-Id: <[email protected]> -Signed-off-by: Gert Doering <[email protected]> ---- - ssl.c | 6 +++++- - 1 file changed, 5 insertions(+), 1 deletion(-) - -Index: openvpn-2.2.1/ssl.c -=================================================================== ---- openvpn-2.2.1.orig/ssl.c 2011-06-24 08:13:39.000000000 +0200 -+++ openvpn-2.2.1/ssl.c 2014-12-01 16:28:25.003615544 +0100 -@@ -3751,7 +3751,11 @@ - ALLOC_ARRAY_CLEAR_GC (options, char, TLS_OPTIONS_LEN, &gc); - - /* discard leading uint32 */ -- ASSERT (buf_advance (buf, 4)); -+ if (!buf_advance (buf, 4)) { -+ msg (D_TLS_ERRORS, "TLS ERROR: Plaintext buffer too short (%d bytes).", -+ buf->len); -+ goto error; -+ } - - /* get key method */ - key_method_flags = buf_read_u8 (buf); diff --git a/source/network-extra/openvpn/FrugalBuild b/source/network-extra/openvpn/FrugalBuild index 978b170..1d1309e 100644 --- a/source/network-extra/openvpn/FrugalBuild +++ b/source/network-extra/openvpn/FrugalBuild @@ -1,38 +1,37 @@ # Compiling Time: 0.17 SBU # Contributor: Christian Hamar alias krix <[email protected]> -# Maintainer: bouleetbil <[email protected]> +# Contributor: bouleetbil <[email protected]> +# Maintainer: DeX77 <[email protected]> + +options+=('asneeded') pkgname=openvpn -pkgver=2.1.3 -pkgrel=8 +pkgver=2.3.6 +pkgrel=1 pkgdesc="A secure tunneling daemon" -url="http://www.openvpn.org/"; -depends=('openssl>=1.0.0' 'lzo' 'pam') +url="https://www.openvpn.net"; +depends=('openssl>=1.0.0' 'lzo' 'pam' 'iproute2') +makedepends=('ca-certificates') groups=('network-extra') archs=('i686' 'x86_64' 'arm') -up2date="lynx -dump 'http://openvpn.net/release/?C=M&O=D' |grep -v beta| grep '$pkgname.*.tar.\(gz\|bz2\)' | sed -ne 's|.*$pkgname-\(.*\).tar.*|\1|g;1 p'" -source=(http://www.openvpn.net/release/$pkgname-$pkgver.tar.gz [email protected]) -sha1sums=('91058e78c58c2e66298c7132bea1ddba52baaa82' \ - 'c79ce19443d14334600aaaa1caf072490a6e9da0') +up2date="Flasttar https://swupdate.openvpn.org/community/releases/"; +source=(https://swupdate.openvpn.org/community/releases/$pkgname-$pkgver.tar.xz \ + [email protected]) +signatures=("${source[0]}.asc" "") _F_systemd_units=(openvpn@=) Finclude systemd -# FSA fix *** -source=(${source[@]} CVE-2013-2061.patch CVE-2014-8104.patch) -sha1sums=(${sha1sums[@]} '482b91d4943f6c53d630423477bb8ff35d98f625' \ - '2906c568c6a5b28094692697f0781ece3c087df3') -# *********** - +Fconfopts+=" --sysconfdir=/etc/openvpn \ + --prefix=/usr \ + --enable-iproute2 \ + --enable-systemd" build() { - Fbuild --sysconfdir=/etc/openvpn --prefix=/usr + Fbuild Fmkdir {/etc,/var/run}/openvpn /usr/share/doc/$pkgname-$pkgver - cp -ar sample-{config-files,keys,scripts} $Fdestdir/usr/share/doc/$pkgname-$pkgver - cp -ar easy-rsa $Fdestdir/usr/share/doc/$pkgname-$pkgver - cd plugin/auth-pam/ || Fdie - Fmake - Fmkdir usr/lib/openvpn - Fcp $pkgname-$pkgver/plugin/auth-pam/openvpn-auth-pam.so /usr/lib/openvpn/ + + Fexec cp -ar sample/sample-{config-files,keys,scripts} $Fdestdir/usr/share/doc/$pkgname-$pkgver + # systemd tmpfiles Frm var/run Fmkdir /etc/tmpfiles.d _______________________________________________ Frugalware-git mailing list [email protected] http://frugalware.org/mailman/listinfo/frugalware-git
