aboutsummaryrefslogtreecommitdiffstats
path: root/package/network/services/openvpn/patches
diff options
context:
space:
mode:
authorMagnus Kroken <mkroken@gmail.com>2017-06-22 23:01:01 +0200
committerJo-Philipp Wich <jo@mein.io>2017-06-26 09:57:11 +0200
commit57289ae6403d9d03a419337f266194d3ae6909d0 (patch)
tree3272b71bc5630b32fd75da29ebfdc5beca810fc0 /package/network/services/openvpn/patches
parent73e81a8318d1038cbcb2ad788bf8d956f338f587 (diff)
downloadupstream-57289ae6403d9d03a419337f266194d3ae6909d0.tar.gz
upstream-57289ae6403d9d03a419337f266194d3ae6909d0.tar.bz2
upstream-57289ae6403d9d03a419337f266194d3ae6909d0.zip
openvpn: update to 2.4.3
Fixes for security and other issues. See security announcement for more details: https://community.openvpn.net/openvpn/wiki/VulnerabilitiesFixedInOpenVPN243 * Remotely-triggerable ASSERT() on malformed IPv6 packet (CVE-2017-7508) * Pre-authentication remote crash/information disclosure for clients (CVE-2017-7520) * Potential double-free in --x509-alt-username (CVE-2017-7521) * Remote-triggerable memory leaks (CVE-2017-7512) * Post-authentication remote DoS when using the --x509-track option (CVE-2017-7522) * Null-pointer dereference in establish_http_proxy_passthru() * Restrict --x509-alt-username extension types * Fix potential 1-byte overread in TCP option parsing * Fix mbedtls fingerprint calculation * openssl: fix overflow check for long --tls-cipher option * Ensure option array p[] is always NULL-terminated * Pass correct buffer size to GetModuleFileNameW() (Quarkslabs finding 5.6) Signed-off-by: Magnus Kroken <mkroken@gmail.com>
Diffstat (limited to 'package/network/services/openvpn/patches')
-rw-r--r--package/network/services/openvpn/patches/001-reproducible-remove_DATE.patch2
-rw-r--r--package/network/services/openvpn/patches/100-mbedtls-disable-runtime-version-check.patch2
-rw-r--r--package/network/services/openvpn/patches/210-build_always_use_internal_lz4.patch2
-rw-r--r--package/network/services/openvpn/patches/220-disable_des.patch14
4 files changed, 10 insertions, 10 deletions
diff --git a/package/network/services/openvpn/patches/001-reproducible-remove_DATE.patch b/package/network/services/openvpn/patches/001-reproducible-remove_DATE.patch
index 5f23994b5c..101fa12ba2 100644
--- a/package/network/services/openvpn/patches/001-reproducible-remove_DATE.patch
+++ b/package/network/services/openvpn/patches/001-reproducible-remove_DATE.patch
@@ -1,6 +1,6 @@
--- a/src/openvpn/options.c
+++ b/src/openvpn/options.c
-@@ -107,7 +107,6 @@ const char title_string[] =
+@@ -106,7 +106,6 @@ const char title_string[] =
#ifdef HAVE_AEAD_CIPHER_MODES
" [AEAD]"
#endif
diff --git a/package/network/services/openvpn/patches/100-mbedtls-disable-runtime-version-check.patch b/package/network/services/openvpn/patches/100-mbedtls-disable-runtime-version-check.patch
index 75e306234f..8209bca4f7 100644
--- a/package/network/services/openvpn/patches/100-mbedtls-disable-runtime-version-check.patch
+++ b/package/network/services/openvpn/patches/100-mbedtls-disable-runtime-version-check.patch
@@ -1,6 +1,6 @@
--- a/src/openvpn/ssl_mbedtls.c
+++ b/src/openvpn/ssl_mbedtls.c
-@@ -1337,7 +1337,7 @@ const char *
+@@ -1336,7 +1336,7 @@ const char *
get_ssl_library_version(void)
{
static char mbedtls_version[30];
diff --git a/package/network/services/openvpn/patches/210-build_always_use_internal_lz4.patch b/package/network/services/openvpn/patches/210-build_always_use_internal_lz4.patch
index 45a0207565..b0fe00df9b 100644
--- a/package/network/services/openvpn/patches/210-build_always_use_internal_lz4.patch
+++ b/package/network/services/openvpn/patches/210-build_always_use_internal_lz4.patch
@@ -1,6 +1,6 @@
--- a/configure.ac
+++ b/configure.ac
-@@ -1058,37 +1058,14 @@ dnl
+@@ -1076,37 +1076,14 @@ dnl
AC_ARG_VAR([LZ4_CFLAGS], [C compiler flags for lz4])
AC_ARG_VAR([LZ4_LIBS], [linker flags for lz4])
if test "$enable_lz4" = "yes" && test "$enable_comp_stub" = "no"; then
diff --git a/package/network/services/openvpn/patches/220-disable_des.patch b/package/network/services/openvpn/patches/220-disable_des.patch
index cd930709cb..030958d1bc 100644
--- a/package/network/services/openvpn/patches/220-disable_des.patch
+++ b/package/network/services/openvpn/patches/220-disable_des.patch
@@ -1,6 +1,6 @@
--- a/src/openvpn/syshead.h
+++ b/src/openvpn/syshead.h
-@@ -594,11 +594,11 @@ socket_defined(const socket_descriptor_t
+@@ -597,11 +597,11 @@ socket_defined(const socket_descriptor_t
/*
* Should we include NTLM proxy functionality
*/
@@ -18,7 +18,7 @@
* Should we include proxy digest auth functionality
--- a/src/openvpn/crypto_mbedtls.c
+++ b/src/openvpn/crypto_mbedtls.c
-@@ -320,6 +320,7 @@ int
+@@ -319,6 +319,7 @@ int
key_des_num_cblocks(const mbedtls_cipher_info_t *kt)
{
int ret = 0;
@@ -26,7 +26,7 @@
if (kt->type == MBEDTLS_CIPHER_DES_CBC)
{
ret = 1;
-@@ -332,6 +333,7 @@ key_des_num_cblocks(const mbedtls_cipher
+@@ -331,6 +332,7 @@ key_des_num_cblocks(const mbedtls_cipher
{
ret = 3;
}
@@ -34,7 +34,7 @@
dmsg(D_CRYPTO_DEBUG, "CRYPTO INFO: n_DES_cblocks=%d", ret);
return ret;
-@@ -340,6 +342,7 @@ key_des_num_cblocks(const mbedtls_cipher
+@@ -339,6 +341,7 @@ key_des_num_cblocks(const mbedtls_cipher
bool
key_des_check(uint8_t *key, int key_len, int ndc)
{
@@ -42,7 +42,7 @@
int i;
struct buffer b;
-@@ -368,11 +371,15 @@ key_des_check(uint8_t *key, int key_len,
+@@ -367,11 +370,15 @@ key_des_check(uint8_t *key, int key_len,
err:
return false;
@@ -58,7 +58,7 @@
int i;
struct buffer b;
-@@ -387,6 +394,7 @@ key_des_fixup(uint8_t *key, int key_len,
+@@ -386,6 +393,7 @@ key_des_fixup(uint8_t *key, int key_len,
}
mbedtls_des_key_set_parity(key);
}
@@ -66,7 +66,7 @@
}
/*
-@@ -698,10 +706,12 @@ cipher_des_encrypt_ecb(const unsigned ch
+@@ -710,10 +718,12 @@ cipher_des_encrypt_ecb(const unsigned ch
unsigned char *src,
unsigned char *dst)
{