diff options
author | Magnus Kroken <mkroken@gmail.com> | 2017-06-22 23:01:01 +0200 |
---|---|---|
committer | Jo-Philipp Wich <jo@mein.io> | 2017-06-26 09:57:11 +0200 |
commit | 57289ae6403d9d03a419337f266194d3ae6909d0 (patch) | |
tree | 3272b71bc5630b32fd75da29ebfdc5beca810fc0 /package | |
parent | 73e81a8318d1038cbcb2ad788bf8d956f338f587 (diff) | |
download | mtk-20170518-57289ae6403d9d03a419337f266194d3ae6909d0.zip mtk-20170518-57289ae6403d9d03a419337f266194d3ae6909d0.tar.gz mtk-20170518-57289ae6403d9d03a419337f266194d3ae6909d0.tar.bz2 |
openvpn: update to 2.4.3
Fixes for security and other issues. See security announcement for more details:
https://community.openvpn.net/openvpn/wiki/VulnerabilitiesFixedInOpenVPN243
* Remotely-triggerable ASSERT() on malformed IPv6 packet (CVE-2017-7508)
* Pre-authentication remote crash/information disclosure for clients (CVE-2017-7520)
* Potential double-free in --x509-alt-username (CVE-2017-7521)
* Remote-triggerable memory leaks (CVE-2017-7512)
* Post-authentication remote DoS when using the --x509-track option (CVE-2017-7522)
* Null-pointer dereference in establish_http_proxy_passthru()
* Restrict --x509-alt-username extension types
* Fix potential 1-byte overread in TCP option parsing
* Fix mbedtls fingerprint calculation
* openssl: fix overflow check for long --tls-cipher option
* Ensure option array p[] is always NULL-terminated
* Pass correct buffer size to GetModuleFileNameW() (Quarkslabs finding 5.6)
Signed-off-by: Magnus Kroken <mkroken@gmail.com>
Diffstat (limited to 'package')
5 files changed, 14 insertions, 13 deletions
diff --git a/package/network/services/openvpn/Makefile b/package/network/services/openvpn/Makefile index ea3ac3d..537a1bf 100644 --- a/package/network/services/openvpn/Makefile +++ b/package/network/services/openvpn/Makefile @@ -9,14 +9,15 @@ include $(TOPDIR)/rules.mk PKG_NAME:=openvpn -PKG_VERSION:=2.4.2 +PKG_VERSION:=2.4.3 PKG_RELEASE:=1 PKG_SOURCE_URL:=\ https://build.openvpn.net/downloads/releases/ \ - https://swupdate.openvpn.net/community/releases/ + https://swupdate.openvpn.net/community/releases/ \ + http://www.eurephia.net/openvpn/ PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.xz -PKG_HASH:=df5c4f384b7df6b08a2f6fa8a84b9fd382baf59c2cef1836f82e2a7f62f1bff9 +PKG_HASH:=7aa86167a5b8923e54e8795b814ed77288c793671f59fd830d9ab76d4b480571 PKG_BUILD_DIR:=$(BUILD_DIR)/$(PKG_NAME)-$(BUILD_VARIANT)/$(PKG_NAME)-$(PKG_VERSION) PKG_MAINTAINER:=Felix Fietkau <nbd@nbd.name> diff --git a/package/network/services/openvpn/patches/001-reproducible-remove_DATE.patch b/package/network/services/openvpn/patches/001-reproducible-remove_DATE.patch index 5f23994..101fa12 100644 --- a/package/network/services/openvpn/patches/001-reproducible-remove_DATE.patch +++ b/package/network/services/openvpn/patches/001-reproducible-remove_DATE.patch @@ -1,6 +1,6 @@ --- a/src/openvpn/options.c +++ b/src/openvpn/options.c -@@ -107,7 +107,6 @@ const char title_string[] = +@@ -106,7 +106,6 @@ const char title_string[] = #ifdef HAVE_AEAD_CIPHER_MODES " [AEAD]" #endif diff --git a/package/network/services/openvpn/patches/100-mbedtls-disable-runtime-version-check.patch b/package/network/services/openvpn/patches/100-mbedtls-disable-runtime-version-check.patch index 75e3062..8209bca 100644 --- a/package/network/services/openvpn/patches/100-mbedtls-disable-runtime-version-check.patch +++ b/package/network/services/openvpn/patches/100-mbedtls-disable-runtime-version-check.patch @@ -1,6 +1,6 @@ --- a/src/openvpn/ssl_mbedtls.c +++ b/src/openvpn/ssl_mbedtls.c -@@ -1337,7 +1337,7 @@ const char * +@@ -1336,7 +1336,7 @@ const char * get_ssl_library_version(void) { static char mbedtls_version[30]; diff --git a/package/network/services/openvpn/patches/210-build_always_use_internal_lz4.patch b/package/network/services/openvpn/patches/210-build_always_use_internal_lz4.patch index 45a0207..b0fe00d 100644 --- a/package/network/services/openvpn/patches/210-build_always_use_internal_lz4.patch +++ b/package/network/services/openvpn/patches/210-build_always_use_internal_lz4.patch @@ -1,6 +1,6 @@ --- a/configure.ac +++ b/configure.ac -@@ -1058,37 +1058,14 @@ dnl +@@ -1076,37 +1076,14 @@ dnl AC_ARG_VAR([LZ4_CFLAGS], [C compiler flags for lz4]) AC_ARG_VAR([LZ4_LIBS], [linker flags for lz4]) if test "$enable_lz4" = "yes" && test "$enable_comp_stub" = "no"; then diff --git a/package/network/services/openvpn/patches/220-disable_des.patch b/package/network/services/openvpn/patches/220-disable_des.patch index cd93070..030958d 100644 --- a/package/network/services/openvpn/patches/220-disable_des.patch +++ b/package/network/services/openvpn/patches/220-disable_des.patch @@ -1,6 +1,6 @@ --- a/src/openvpn/syshead.h +++ b/src/openvpn/syshead.h -@@ -594,11 +594,11 @@ socket_defined(const socket_descriptor_t +@@ -597,11 +597,11 @@ socket_defined(const socket_descriptor_t /* * Should we include NTLM proxy functionality */ @@ -18,7 +18,7 @@ * Should we include proxy digest auth functionality --- a/src/openvpn/crypto_mbedtls.c +++ b/src/openvpn/crypto_mbedtls.c -@@ -320,6 +320,7 @@ int +@@ -319,6 +319,7 @@ int key_des_num_cblocks(const mbedtls_cipher_info_t *kt) { int ret = 0; @@ -26,7 +26,7 @@ if (kt->type == MBEDTLS_CIPHER_DES_CBC) { ret = 1; -@@ -332,6 +333,7 @@ key_des_num_cblocks(const mbedtls_cipher +@@ -331,6 +332,7 @@ key_des_num_cblocks(const mbedtls_cipher { ret = 3; } @@ -34,7 +34,7 @@ dmsg(D_CRYPTO_DEBUG, "CRYPTO INFO: n_DES_cblocks=%d", ret); return ret; -@@ -340,6 +342,7 @@ key_des_num_cblocks(const mbedtls_cipher +@@ -339,6 +341,7 @@ key_des_num_cblocks(const mbedtls_cipher bool key_des_check(uint8_t *key, int key_len, int ndc) { @@ -42,7 +42,7 @@ int i; struct buffer b; -@@ -368,11 +371,15 @@ key_des_check(uint8_t *key, int key_len, +@@ -367,11 +370,15 @@ key_des_check(uint8_t *key, int key_len, err: return false; @@ -58,7 +58,7 @@ int i; struct buffer b; -@@ -387,6 +394,7 @@ key_des_fixup(uint8_t *key, int key_len, +@@ -386,6 +393,7 @@ key_des_fixup(uint8_t *key, int key_len, } mbedtls_des_key_set_parity(key); } @@ -66,7 +66,7 @@ } /* -@@ -698,10 +706,12 @@ cipher_des_encrypt_ecb(const unsigned ch +@@ -710,10 +718,12 @@ cipher_des_encrypt_ecb(const unsigned ch unsigned char *src, unsigned char *dst) { |