aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorBaptiste Jonglez <git@bitsofnetworks.org>2017-07-30 17:57:37 +0200
committerHauke Mehrtens <hauke@hauke-m.de>2017-08-11 20:45:28 +0200
commit3e35eb13ada3b87e87cd108f9d459b9484446e9c (patch)
treec330f5183115c887bab82d331819f399587fe7c7
parentff414fb575a43ada264186fe74e57fb605f20b7f (diff)
downloadupstream-3e35eb13ada3b87e87cd108f9d459b9484446e9c.tar.gz
upstream-3e35eb13ada3b87e87cd108f9d459b9484446e9c.tar.bz2
upstream-3e35eb13ada3b87e87cd108f9d459b9484446e9c.zip
mbedtls: Re-allow SHA1-signed certificates
Since mbedtls 2.5.1, SHA1 has been disallowed in TLS certificates. This breaks openvpn clients that try to connect to servers that present a TLS certificate signed with SHA1, which is fairly common. Run-tested with openvpn-mbedtls 2.4.3, LEDE 17.01.2, on ar71xx. Fixes: FS#942 Signed-off-by: Baptiste Jonglez <git@bitsofnetworks.org>
-rw-r--r--package/libs/mbedtls/Makefile2
-rw-r--r--package/libs/mbedtls/patches/200-config.patch9
2 files changed, 10 insertions, 1 deletions
diff --git a/package/libs/mbedtls/Makefile b/package/libs/mbedtls/Makefile
index 4cceb743d5..101324de07 100644
--- a/package/libs/mbedtls/Makefile
+++ b/package/libs/mbedtls/Makefile
@@ -9,7 +9,7 @@ include $(TOPDIR)/rules.mk
PKG_NAME:=mbedtls
PKG_VERSION:=2.5.1
-PKG_RELEASE:=1
+PKG_RELEASE:=2
PKG_USE_MIPS16:=0
PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION)-gpl.tgz
diff --git a/package/libs/mbedtls/patches/200-config.patch b/package/libs/mbedtls/patches/200-config.patch
index 39de3cc1ec..fb5a74fc65 100644
--- a/package/libs/mbedtls/patches/200-config.patch
+++ b/package/libs/mbedtls/patches/200-config.patch
@@ -269,3 +269,12 @@
/* \} name SECTION: mbed TLS modules */
+@@ -2646,7 +2646,7 @@
+ * recommended because of it is possible to generte SHA-1 collisions, however
+ * this may be safe for legacy infrastructure where additional controls apply.
+ */
+-// #define MBEDTLS_TLS_DEFAULT_ALLOW_SHA1_IN_CERTIFICATES
++#define MBEDTLS_TLS_DEFAULT_ALLOW_SHA1_IN_CERTIFICATES
+
+ /**
+ * Allow SHA-1 in the default TLS configuration for TLS 1.2 handshake