mirror of
https://github.com/openwrt/openwrt.git
synced 2024-12-22 23:12:32 +00:00
openvpn: update to 2.4.3
Fixes for security and other issues. See security announcement for more details: https://community.openvpn.net/openvpn/wiki/VulnerabilitiesFixedInOpenVPN243 * Remotely-triggerable ASSERT() on malformed IPv6 packet (CVE-2017-7508) * Pre-authentication remote crash/information disclosure for clients (CVE-2017-7520) * Potential double-free in --x509-alt-username (CVE-2017-7521) * Remote-triggerable memory leaks (CVE-2017-7512) * Post-authentication remote DoS when using the --x509-track option (CVE-2017-7522) * Null-pointer dereference in establish_http_proxy_passthru() * Restrict --x509-alt-username extension types * Fix potential 1-byte overread in TCP option parsing * Fix mbedtls fingerprint calculation * openssl: fix overflow check for long --tls-cipher option * Ensure option array p[] is always NULL-terminated * Pass correct buffer size to GetModuleFileNameW() (Quarkslabs finding 5.6) Signed-off-by: Magnus Kroken <mkroken@gmail.com>
This commit is contained in:
parent
73e81a8318
commit
57289ae640
@ -9,14 +9,15 @@ include $(TOPDIR)/rules.mk
|
|||||||
|
|
||||||
PKG_NAME:=openvpn
|
PKG_NAME:=openvpn
|
||||||
|
|
||||||
PKG_VERSION:=2.4.2
|
PKG_VERSION:=2.4.3
|
||||||
PKG_RELEASE:=1
|
PKG_RELEASE:=1
|
||||||
|
|
||||||
PKG_SOURCE_URL:=\
|
PKG_SOURCE_URL:=\
|
||||||
https://build.openvpn.net/downloads/releases/ \
|
https://build.openvpn.net/downloads/releases/ \
|
||||||
https://swupdate.openvpn.net/community/releases/
|
https://swupdate.openvpn.net/community/releases/ \
|
||||||
|
http://www.eurephia.net/openvpn/
|
||||||
PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.xz
|
PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.xz
|
||||||
PKG_HASH:=df5c4f384b7df6b08a2f6fa8a84b9fd382baf59c2cef1836f82e2a7f62f1bff9
|
PKG_HASH:=7aa86167a5b8923e54e8795b814ed77288c793671f59fd830d9ab76d4b480571
|
||||||
|
|
||||||
PKG_BUILD_DIR:=$(BUILD_DIR)/$(PKG_NAME)-$(BUILD_VARIANT)/$(PKG_NAME)-$(PKG_VERSION)
|
PKG_BUILD_DIR:=$(BUILD_DIR)/$(PKG_NAME)-$(BUILD_VARIANT)/$(PKG_NAME)-$(PKG_VERSION)
|
||||||
PKG_MAINTAINER:=Felix Fietkau <nbd@nbd.name>
|
PKG_MAINTAINER:=Felix Fietkau <nbd@nbd.name>
|
||||||
|
@ -1,6 +1,6 @@
|
|||||||
--- a/src/openvpn/options.c
|
--- a/src/openvpn/options.c
|
||||||
+++ b/src/openvpn/options.c
|
+++ b/src/openvpn/options.c
|
||||||
@@ -107,7 +107,6 @@ const char title_string[] =
|
@@ -106,7 +106,6 @@ const char title_string[] =
|
||||||
#ifdef HAVE_AEAD_CIPHER_MODES
|
#ifdef HAVE_AEAD_CIPHER_MODES
|
||||||
" [AEAD]"
|
" [AEAD]"
|
||||||
#endif
|
#endif
|
||||||
|
@ -1,6 +1,6 @@
|
|||||||
--- a/src/openvpn/ssl_mbedtls.c
|
--- a/src/openvpn/ssl_mbedtls.c
|
||||||
+++ b/src/openvpn/ssl_mbedtls.c
|
+++ b/src/openvpn/ssl_mbedtls.c
|
||||||
@@ -1337,7 +1337,7 @@ const char *
|
@@ -1336,7 +1336,7 @@ const char *
|
||||||
get_ssl_library_version(void)
|
get_ssl_library_version(void)
|
||||||
{
|
{
|
||||||
static char mbedtls_version[30];
|
static char mbedtls_version[30];
|
||||||
|
@ -1,6 +1,6 @@
|
|||||||
--- a/configure.ac
|
--- a/configure.ac
|
||||||
+++ b/configure.ac
|
+++ b/configure.ac
|
||||||
@@ -1058,37 +1058,14 @@ dnl
|
@@ -1076,37 +1076,14 @@ dnl
|
||||||
AC_ARG_VAR([LZ4_CFLAGS], [C compiler flags for lz4])
|
AC_ARG_VAR([LZ4_CFLAGS], [C compiler flags for lz4])
|
||||||
AC_ARG_VAR([LZ4_LIBS], [linker flags for lz4])
|
AC_ARG_VAR([LZ4_LIBS], [linker flags for lz4])
|
||||||
if test "$enable_lz4" = "yes" && test "$enable_comp_stub" = "no"; then
|
if test "$enable_lz4" = "yes" && test "$enable_comp_stub" = "no"; then
|
||||||
|
@ -1,6 +1,6 @@
|
|||||||
--- a/src/openvpn/syshead.h
|
--- a/src/openvpn/syshead.h
|
||||||
+++ b/src/openvpn/syshead.h
|
+++ b/src/openvpn/syshead.h
|
||||||
@@ -594,11 +594,11 @@ socket_defined(const socket_descriptor_t
|
@@ -597,11 +597,11 @@ socket_defined(const socket_descriptor_t
|
||||||
/*
|
/*
|
||||||
* Should we include NTLM proxy functionality
|
* Should we include NTLM proxy functionality
|
||||||
*/
|
*/
|
||||||
@ -18,7 +18,7 @@
|
|||||||
* Should we include proxy digest auth functionality
|
* Should we include proxy digest auth functionality
|
||||||
--- a/src/openvpn/crypto_mbedtls.c
|
--- a/src/openvpn/crypto_mbedtls.c
|
||||||
+++ b/src/openvpn/crypto_mbedtls.c
|
+++ b/src/openvpn/crypto_mbedtls.c
|
||||||
@@ -320,6 +320,7 @@ int
|
@@ -319,6 +319,7 @@ int
|
||||||
key_des_num_cblocks(const mbedtls_cipher_info_t *kt)
|
key_des_num_cblocks(const mbedtls_cipher_info_t *kt)
|
||||||
{
|
{
|
||||||
int ret = 0;
|
int ret = 0;
|
||||||
@ -26,7 +26,7 @@
|
|||||||
if (kt->type == MBEDTLS_CIPHER_DES_CBC)
|
if (kt->type == MBEDTLS_CIPHER_DES_CBC)
|
||||||
{
|
{
|
||||||
ret = 1;
|
ret = 1;
|
||||||
@@ -332,6 +333,7 @@ key_des_num_cblocks(const mbedtls_cipher
|
@@ -331,6 +332,7 @@ key_des_num_cblocks(const mbedtls_cipher
|
||||||
{
|
{
|
||||||
ret = 3;
|
ret = 3;
|
||||||
}
|
}
|
||||||
@ -34,7 +34,7 @@
|
|||||||
|
|
||||||
dmsg(D_CRYPTO_DEBUG, "CRYPTO INFO: n_DES_cblocks=%d", ret);
|
dmsg(D_CRYPTO_DEBUG, "CRYPTO INFO: n_DES_cblocks=%d", ret);
|
||||||
return ret;
|
return ret;
|
||||||
@@ -340,6 +342,7 @@ key_des_num_cblocks(const mbedtls_cipher
|
@@ -339,6 +341,7 @@ key_des_num_cblocks(const mbedtls_cipher
|
||||||
bool
|
bool
|
||||||
key_des_check(uint8_t *key, int key_len, int ndc)
|
key_des_check(uint8_t *key, int key_len, int ndc)
|
||||||
{
|
{
|
||||||
@ -42,7 +42,7 @@
|
|||||||
int i;
|
int i;
|
||||||
struct buffer b;
|
struct buffer b;
|
||||||
|
|
||||||
@@ -368,11 +371,15 @@ key_des_check(uint8_t *key, int key_len,
|
@@ -367,11 +370,15 @@ key_des_check(uint8_t *key, int key_len,
|
||||||
|
|
||||||
err:
|
err:
|
||||||
return false;
|
return false;
|
||||||
@ -58,7 +58,7 @@
|
|||||||
int i;
|
int i;
|
||||||
struct buffer b;
|
struct buffer b;
|
||||||
|
|
||||||
@@ -387,6 +394,7 @@ key_des_fixup(uint8_t *key, int key_len,
|
@@ -386,6 +393,7 @@ key_des_fixup(uint8_t *key, int key_len,
|
||||||
}
|
}
|
||||||
mbedtls_des_key_set_parity(key);
|
mbedtls_des_key_set_parity(key);
|
||||||
}
|
}
|
||||||
@ -66,7 +66,7 @@
|
|||||||
}
|
}
|
||||||
|
|
||||||
/*
|
/*
|
||||||
@@ -698,10 +706,12 @@ cipher_des_encrypt_ecb(const unsigned ch
|
@@ -710,10 +718,12 @@ cipher_des_encrypt_ecb(const unsigned ch
|
||||||
unsigned char *src,
|
unsigned char *src,
|
||||||
unsigned char *dst)
|
unsigned char *dst)
|
||||||
{
|
{
|
||||||
|
Loading…
Reference in New Issue
Block a user