Hello community, here is the log from the commit of package libfilezilla for openSUSE:Factory checked in at 2020-08-24 15:10:13 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/libfilezilla (Old) and /work/SRC/openSUSE:Factory/.libfilezilla.new.3399 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "libfilezilla" Mon Aug 24 15:10:13 2020 rev:33 rq:828725 version:0.24.0 Changes: -------- --- /work/SRC/openSUSE:Factory/libfilezilla/libfilezilla.changes 2020-08-18 15:10:51.044035692 +0200 +++ /work/SRC/openSUSE:Factory/.libfilezilla.new.3399/libfilezilla.changes 2020-08-24 15:10:55.470622749 +0200 @@ -1,0 +2,10 @@ +Sat Aug 22 20:15:42 UTC 2020 - ecsos <[email protected]> + +- Update to 0.24.0 + * New features: + - Added fz::equal_consttime + * Bugfixes and minor changes: + - fz::sprintf now works corrcetly if arguments are passed as + (w)string_view + +------------------------------------------------------------------- Old: ---- libfilezilla-0.23.0.tar.bz2 New: ---- libfilezilla-0.24.0.tar.bz2 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ libfilezilla.spec ++++++ --- /var/tmp/diff_new_pack.kfINrV/_old 2020-08-24 15:10:57.002623495 +0200 +++ /var/tmp/diff_new_pack.kfINrV/_new 2020-08-24 15:10:57.006623497 +0200 @@ -16,11 +16,11 @@ # -%define major 8 +%define major 9 %define libname %{name}%{major} %define develname %{name}-devel Name: libfilezilla -Version: 0.23.0 +Version: 0.24.0 Release: 0 Summary: C++ library for filezilla License: GPL-2.0-or-later ++++++ libfilezilla-0.23.0.tar.bz2 -> libfilezilla-0.24.0.tar.bz2 ++++++ diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/libfilezilla-0.23.0/Makefile.in new/libfilezilla-0.24.0/Makefile.in --- old/libfilezilla-0.23.0/Makefile.in 2020-07-07 14:09:22.000000000 +0200 +++ new/libfilezilla-0.24.0/Makefile.in 2020-08-21 15:35:21.000000000 +0200 @@ -185,8 +185,8 @@ $(top_srcdir)/lib/libfilezilla/version.hpp.in \ $(top_srcdir)/lib/windows/version.rc.in AUTHORS COPYING \ ChangeLog INSTALL NEWS README config/compile \ - config/config.guess config/config.sub config/install-sh \ - config/ltmain.sh config/missing + config/config.guess config/config.sub config/depcomp \ + config/install-sh config/ltmain.sh config/missing DISTFILES = $(DIST_COMMON) $(DIST_SOURCES) $(TEXINFOS) $(EXTRA_DIST) distdir = $(PACKAGE)-$(VERSION) top_distdir = $(distdir) diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/libfilezilla-0.23.0/NEWS new/libfilezilla-0.24.0/NEWS --- old/libfilezilla-0.23.0/NEWS 2020-07-07 14:07:30.000000000 +0200 +++ new/libfilezilla-0.24.0/NEWS 2020-08-21 15:35:14.000000000 +0200 @@ -1,3 +1,8 @@ +0.24.0 (2020-08-21) + ++ Added fz::equal_consttime +- fz::sprintf now works corrcetly if arguments are passed as (w)string_view + 0.23.0 (2020-07-07) + Added reader/writer locks diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/libfilezilla-0.23.0/configure new/libfilezilla-0.24.0/configure --- old/libfilezilla-0.23.0/configure 2020-07-07 14:09:22.000000000 +0200 +++ new/libfilezilla-0.24.0/configure 2020-08-21 15:35:21.000000000 +0200 @@ -1,6 +1,6 @@ #! /bin/sh # Guess values for system-dependent variables and create Makefiles. -# Generated by GNU Autoconf 2.69 for libfilezilla 0.23.0. +# Generated by GNU Autoconf 2.69 for libfilezilla 0.24.0. # # Report bugs to <[email protected]>. # @@ -590,8 +590,8 @@ # Identity of this package. PACKAGE_NAME='libfilezilla' PACKAGE_TARNAME='libfilezilla' -PACKAGE_VERSION='0.23.0' -PACKAGE_STRING='libfilezilla 0.23.0' +PACKAGE_VERSION='0.24.0' +PACKAGE_STRING='libfilezilla 0.24.0' PACKAGE_BUGREPORT='[email protected]' PACKAGE_URL='https://lib.filezilla-project.org/' @@ -1444,7 +1444,7 @@ # Omit some internal or obsolete options to make the list less imposing. # This message is too long to be a string in the A/UX 3.1 sh. cat <<_ACEOF -\`configure' configures libfilezilla 0.23.0 to adapt to many kinds of systems. +\`configure' configures libfilezilla 0.24.0 to adapt to many kinds of systems. Usage: $0 [OPTION]... [VAR=VALUE]... @@ -1515,7 +1515,7 @@ if test -n "$ac_init_help"; then case $ac_init_help in - short | recursive ) echo "Configuration of libfilezilla 0.23.0:";; + short | recursive ) echo "Configuration of libfilezilla 0.24.0:";; esac cat <<\_ACEOF @@ -1666,7 +1666,7 @@ test -n "$ac_init_help" && exit $ac_status if $ac_init_version; then cat <<\_ACEOF -libfilezilla configure 0.23.0 +libfilezilla configure 0.24.0 generated by GNU Autoconf 2.69 Copyright (C) 2012 Free Software Foundation, Inc. @@ -2111,7 +2111,7 @@ This file contains any messages produced by compilers while running configure, to aid debugging if configure makes a mistake. -It was created by libfilezilla $as_me 0.23.0, which was +It was created by libfilezilla $as_me 0.24.0, which was generated by GNU Autoconf 2.69. Invocation command line was $ $0 $@ @@ -2466,7 +2466,7 @@ # If any interfaces have been added since the last public release, then increment age. # If any interfaces have been removed or changed since the last public release, then set age to 0. # CURRENT:REVISION:AGE -LIBRARY_VERSION=8:0:0 +LIBRARY_VERSION=9:0:0 ac_config_headers="$ac_config_headers config/config.hpp" @@ -2987,7 +2987,7 @@ # Define the identity of the package. PACKAGE='libfilezilla' - VERSION='0.23.0' + VERSION='0.24.0' cat >>confdefs.h <<_ACEOF @@ -22238,7 +22238,7 @@ # report actual input values of CONFIG_FILES etc. instead of their # values after options handling. ac_log=" -This file was extended by libfilezilla $as_me 0.23.0, which was +This file was extended by libfilezilla $as_me 0.24.0, which was generated by GNU Autoconf 2.69. Invocation command line was CONFIG_FILES = $CONFIG_FILES @@ -22305,7 +22305,7 @@ cat >>$CONFIG_STATUS <<_ACEOF || ac_write_fail=1 ac_cs_config="`$as_echo "$ac_configure_args" | sed 's/^ //; s/[\\""\`\$]/\\\\&/g'`" ac_cs_version="\\ -libfilezilla config.status 0.23.0 +libfilezilla config.status 0.24.0 configured by $0, generated by GNU Autoconf 2.69, with options \\"\$ac_cs_config\\" diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/libfilezilla-0.23.0/configure.ac new/libfilezilla-0.24.0/configure.ac --- old/libfilezilla-0.23.0/configure.ac 2020-07-07 14:08:18.000000000 +0200 +++ new/libfilezilla-0.24.0/configure.ac 2020-08-21 15:35:14.000000000 +0200 @@ -1,4 +1,4 @@ -AC_INIT([libfilezilla],[0.23.0],[[email protected]],[],[https://lib.filezilla-project.org/]) +AC_INIT([libfilezilla],[0.24.0],[[email protected]],[],[https://lib.filezilla-project.org/]) # Update the version information only immediately before a public release of your software # If the library source code has changed at all since the last update, then increment revision (‘c:r:a’ becomes ‘c:r+1:a’). @@ -6,7 +6,7 @@ # If any interfaces have been added since the last public release, then increment age. # If any interfaces have been removed or changed since the last public release, then set age to 0. # CURRENT:REVISION:AGE -LIBRARY_VERSION=8:0:0 +LIBRARY_VERSION=9:0:0 AC_CONFIG_HEADERS([config/config.hpp]) diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/libfilezilla-0.23.0/lib/encryption.cpp new/libfilezilla-0.24.0/lib/encryption.cpp --- old/libfilezilla-0.23.0/lib/encryption.cpp 2020-07-07 14:06:31.000000000 +0200 +++ new/libfilezilla-0.24.0/lib/encryption.cpp 2020-08-21 15:35:14.000000000 +0200 @@ -428,6 +428,18 @@ return ret; } +bool operator==(symmetric_key const& lhs, symmetric_key const& rhs) +{ + if (!lhs) { + return !rhs; + } + else if (!rhs) { + return false; + } + + // By definition both key and salt are non-empty and have the same size in each. + return nettle_memeql_sec(lhs.salt().data(), rhs.salt().data(), lhs.salt().size()) && nettle_memeql_sec(lhs.key().data(), rhs.key().data(), lhs.key().size()); +} size_t symmetric_key::encryption_overhead() { diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/libfilezilla-0.23.0/lib/libfilezilla/encryption.hpp new/libfilezilla-0.24.0/lib/libfilezilla/encryption.hpp --- old/libfilezilla-0.23.0/lib/libfilezilla/encryption.hpp 2020-07-07 14:06:30.000000000 +0200 +++ new/libfilezilla-0.24.0/lib/libfilezilla/encryption.hpp 2020-08-21 15:35:14.000000000 +0200 @@ -210,7 +210,7 @@ std::vector<uint8_t> encrypt_key(fz::public_key const& kek); static symmetric_key decrypt_key(std::vector<uint8_t> const& encrypted, fz::private_key const& kek); - FZ_PRIVATE_SYMBOL std::vector<uint8_t> const& key() const; + std::vector<uint8_t> const& key() const; static size_t encryption_overhead(); private: @@ -218,6 +218,12 @@ std::vector<uint8_t> salt_; }; +/// Side-channel safe comparison +bool FZ_PUBLIC_SYMBOL operator==(symmetric_key const& lhs, symmetric_key const& rhs); +inline bool FZ_PUBLIC_SYMBOL operator!=(symmetric_key const& lhs, symmetric_key const& rhs) { + return !(lhs == rhs); +} + /** \brief Encrypt the plaintext using the given symmetric key. * * \par Encryption algorithm: diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/libfilezilla-0.23.0/lib/libfilezilla/format.hpp new/libfilezilla-0.24.0/lib/libfilezilla/format.hpp --- old/libfilezilla-0.23.0/lib/libfilezilla/format.hpp 2020-07-07 14:06:30.000000000 +0200 +++ new/libfilezilla-0.24.0/lib/libfilezilla/format.hpp 2020-08-21 15:35:14.000000000 +0200 @@ -133,21 +133,6 @@ template<typename String, class Arg> struct has_toString<String, Arg, std::void_t<decltype(toString<String>(std::declval<Arg>()))>> : std::true_type {}; -template<typename String, typename Arg> -String arg_to_string(Arg&& arg) -{ - if constexpr (has_toString<String, Arg>::value) { - // Converts argument to string - // if toString(arg) is valid expression - return toString<String>(std::forward<Arg>(arg)); - } - else { - // Otherwise assert - format_assert(0); - return String(); - } -} - // Converts integral type to hex string with desired string type template<typename String, bool Lowercase, typename Arg> String integral_to_hex_string(Arg && arg) noexcept @@ -219,7 +204,18 @@ { String ret; if (f.type == 's') { - ret = arg_to_string<String>(std::forward<Arg>(arg)); + if constexpr (std::is_same_v<String, std::decay_t<Arg>>) { + ret = arg; + } + else if constexpr (has_toString<String, Arg>::value) { + // Converts argument to string + // if toString(arg) is valid expression + ret = toString<String>(std::forward<Arg>(arg)); + } + else { + // Otherwise assert + format_assert(0); + } pad_arg(ret, f); } else if (f.type == 'd' || f.type == 'i') { diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/libfilezilla-0.23.0/lib/libfilezilla/string.hpp new/libfilezilla-0.24.0/lib/libfilezilla/string.hpp --- old/libfilezilla-0.23.0/lib/libfilezilla/string.hpp 2020-07-07 14:06:31.000000000 +0200 +++ new/libfilezilla-0.24.0/lib/libfilezilla/string.hpp 2020-08-21 15:35:14.000000000 +0200 @@ -50,7 +50,7 @@ */ native_string FZ_PUBLIC_SYMBOL to_native(std::wstring_view const& in); -/// Avoid converting native_string to native_string_view and back to string_view +/// Avoid converting native_string to native_string_view and back to native_string template<typename T, typename std::enable_if_t<std::is_same_v<native_string, typename std::decay_t<T>>, int> = 0> inline native_string to_native(T const& in) { return in; @@ -157,9 +157,16 @@ * \return the converted string on success. On failure an empty string is returned. */ std::wstring FZ_PUBLIC_SYMBOL to_wstring(std::string_view const& in); +inline std::wstring FZ_PUBLIC_SYMBOL to_wstring(std::wstring_view const& in) { return std::wstring(in); } -/// Returns identity, that way to_wstring can be called with native_string. -inline std::wstring FZ_PUBLIC_SYMBOL to_wstring(std::wstring const& in) { return in; } +/** \brief Returns identity, that way to_wstring can be called with native_string. + * + * This template prevents converting std::wstring to std::wstring_view and back to std::wstring + */ +template<typename T, typename std::enable_if_t<std::is_same_v<std::wstring, typename std::decay_t<T>>, int> = 0> +inline std::wstring to_wstring(T const& in) { + return in; +} /// Converts from arithmetic type to std::wstring template<typename Arg> @@ -181,9 +188,17 @@ * \return the converted string on success. On failure an empty string is returned. */ std::string FZ_PUBLIC_SYMBOL to_string(std::wstring_view const& in); +inline std::string FZ_PUBLIC_SYMBOL to_string(std::string_view const& in) { return std::string(in); } + +/** \brief Returns identity, that way to_wstring can be called with native_string. + * + * This template prevents converting std::wstring to std::wstring_view and back to std::wstring + */ +template<typename T, typename std::enable_if_t<std::is_same_v<std::string, typename std::decay_t<T>>, int> = 0> +inline std::string to_string(T const& in) { + return in; +} -/// Returns identity, that way to_string can be called with native_string. -inline std::string FZ_PUBLIC_SYMBOL to_string(std::string const& in) { return in; } /// Converts from arithmetic type to std::string template<typename Arg> diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/libfilezilla-0.23.0/lib/libfilezilla/util.hpp new/libfilezilla-0.24.0/lib/libfilezilla/util.hpp --- old/libfilezilla-0.23.0/lib/libfilezilla/util.hpp 2020-07-07 14:06:31.000000000 +0200 +++ new/libfilezilla-0.24.0/lib/libfilezilla/util.hpp 2020-08-21 15:35:14.000000000 +0200 @@ -52,6 +52,22 @@ */ uint64_t FZ_PUBLIC_SYMBOL bitscan_reverse(uint64_t v); +/** \brief Secure equality test in constant time + * + * As long as both inputs are of the same size, comparison is done in constant + * time to prevent timing attacks. + */ +bool FZ_PUBLIC_SYMBOL equal_consttime(std::basic_string_view<uint8_t> const& lhs, std::basic_string_view<uint8_t> const& rhs); + +template <typename First, typename Second, + std::enable_if_t<sizeof(typename First::value_type) == sizeof(uint8_t) && + sizeof(typename Second::value_type) == sizeof(uint8_t)>* = nullptr> +inline bool equal_consttime(First const& lhs, Second const& rhs) +{ + return equal_consttime(std::basic_string_view<uint8_t>(reinterpret_cast<uint8_t const*>(lhs.data()), rhs.size()), + std::basic_string_view<uint8_t>(reinterpret_cast<uint8_t const*>(lhs.data()), rhs.size())); +} + } #endif diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/libfilezilla-0.23.0/lib/rate_limited_layer.cpp new/libfilezilla-0.24.0/lib/rate_limited_layer.cpp --- old/libfilezilla-0.23.0/lib/rate_limited_layer.cpp 2020-07-07 14:06:31.000000000 +0200 +++ new/libfilezilla-0.24.0/lib/rate_limited_layer.cpp 2020-08-21 15:35:14.000000000 +0200 @@ -40,7 +40,7 @@ } static_assert(sizeof(size) <= sizeof(max)); - if (max < static_cast<decltype(max)>(size)) { + if (max < static_cast<std::decay_t<decltype(max)>>(size)) { size = static_cast<unsigned int>(max); } @@ -61,7 +61,7 @@ } static_assert(sizeof(size) <= sizeof(max)); - if (max < static_cast<decltype(max)>(size)) { + if (max < static_cast<std::decay_t<decltype(max)>>(size)) { size = static_cast<unsigned int>(max); } diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/libfilezilla-0.23.0/lib/socket.cpp new/libfilezilla-0.24.0/lib/socket.cpp --- old/libfilezilla-0.23.0/lib/socket.cpp 2020-07-07 14:06:31.000000000 +0200 +++ new/libfilezilla-0.24.0/lib/socket.cpp 2020-08-21 15:35:14.000000000 +0200 @@ -268,6 +268,8 @@ if (res != 0) { return last_socket_error(); } +#else + (void)keepalive_interval; #endif #endif } diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/libfilezilla-0.23.0/lib/util.cpp new/libfilezilla-0.24.0/lib/util.cpp --- old/libfilezilla-0.23.0/lib/util.cpp 2020-07-07 14:06:31.000000000 +0200 +++ new/libfilezilla-0.24.0/lib/util.cpp 2020-08-21 15:35:14.000000000 +0200 @@ -7,6 +7,8 @@ #include <time.h> #include <string.h> +#include <nettle/memops.h> + #if defined(FZ_WINDOWS) && !defined(_MSC_VER) #include "libfilezilla/private/windows.hpp" #include <wincrypt.h> @@ -147,4 +149,17 @@ #endif } +bool equal_consttime(std::basic_string_view<uint8_t> const& lhs, std::basic_string_view<uint8_t> const& rhs) +{ + if (lhs.size() != rhs.size()) { + return false; + } + + if (lhs.empty()) { + return true; + } + + return nettle_memeql_sec(lhs.data(), rhs.data(), lhs.size()) != 0; +} + } diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/libfilezilla-0.23.0/tests/format.cpp new/libfilezilla-0.24.0/tests/format.cpp --- old/libfilezilla-0.23.0/tests/format.cpp 2020-07-07 14:06:31.000000000 +0200 +++ new/libfilezilla-0.24.0/tests/format.cpp 2020-08-21 15:35:14.000000000 +0200 @@ -117,4 +117,9 @@ CPPUNIT_ASSERT_EQUAL(std::string("x"), fz::sprintf("%c", char('x'))); CPPUNIT_ASSERT_EQUAL(std::string("x"), fz::sprintf("%c", int('x'))); + + CPPUNIT_ASSERT_EQUAL(std::string("x"), fz::sprintf("%s", std::string_view("x", 1))); + CPPUNIT_ASSERT_EQUAL(std::string("x"), fz::sprintf("%s", std::wstring_view(L"x", 1))); + //CPPUNIT_ASSERT_EQUAL(std::wstring(L"x"), fz::sprintf(L"%s", std::string_view("x", 1))); + //CPPUNIT_ASSERT_EQUAL(std::wstring(L"x"), fz::sprintf(L"%s", std::wstring_view(L"x", 1))); }
