mirror of
https://github.com/openwrt/openwrt.git
synced 2024-12-26 08:51:13 +00:00
45f4f6649a
Fixes for security and other issues. See security announcement for more details: https://community.openvpn.net/openvpn/wiki/VulnerabilitiesFixedInOpenVPN243 * Remotely-triggerable ASSERT() on malformed IPv6 packet (CVE-2017-7508) * Pre-authentication remote crash/information disclosure for clients (CVE-2017-7520) * Potential double-free in --x509-alt-username (CVE-2017-7521) * Remote-triggerable memory leaks (CVE-2017-7512) * Post-authentication remote DoS when using the --x509-track option (CVE-2017-7522) * Null-pointer dereference in establish_http_proxy_passthru() * Restrict --x509-alt-username extension types * Fix potential 1-byte overread in TCP option parsing * Fix mbedtls fingerprint calculation * openssl: fix overflow check for long --tls-cipher option * Ensure option array p[] is always NULL-terminated * Pass correct buffer size to GetModuleFileNameW() (Quarkslabs finding 5.6) Signed-off-by: Magnus Kroken <mkroken@gmail.com>
82 lines
1.7 KiB
Diff
82 lines
1.7 KiB
Diff
--- a/src/openvpn/syshead.h
|
|
+++ b/src/openvpn/syshead.h
|
|
@@ -597,11 +597,11 @@ socket_defined(const socket_descriptor_t
|
|
/*
|
|
* Should we include NTLM proxy functionality
|
|
*/
|
|
-#if defined(ENABLE_CRYPTO)
|
|
-#define NTLM 1
|
|
-#else
|
|
+//#if defined(ENABLE_CRYPTO)
|
|
+//#define NTLM 1
|
|
+//#else
|
|
#define NTLM 0
|
|
-#endif
|
|
+//#endif
|
|
|
|
/*
|
|
* Should we include proxy digest auth functionality
|
|
--- a/src/openvpn/crypto_mbedtls.c
|
|
+++ b/src/openvpn/crypto_mbedtls.c
|
|
@@ -319,6 +319,7 @@ int
|
|
key_des_num_cblocks(const mbedtls_cipher_info_t *kt)
|
|
{
|
|
int ret = 0;
|
|
+#ifdef MBEDTLS_DES_C
|
|
if (kt->type == MBEDTLS_CIPHER_DES_CBC)
|
|
{
|
|
ret = 1;
|
|
@@ -331,6 +332,7 @@ key_des_num_cblocks(const mbedtls_cipher
|
|
{
|
|
ret = 3;
|
|
}
|
|
+#endif
|
|
|
|
dmsg(D_CRYPTO_DEBUG, "CRYPTO INFO: n_DES_cblocks=%d", ret);
|
|
return ret;
|
|
@@ -339,6 +341,7 @@ key_des_num_cblocks(const mbedtls_cipher
|
|
bool
|
|
key_des_check(uint8_t *key, int key_len, int ndc)
|
|
{
|
|
+#ifdef MBEDTLS_DES_C
|
|
int i;
|
|
struct buffer b;
|
|
|
|
@@ -367,11 +370,15 @@ key_des_check(uint8_t *key, int key_len,
|
|
|
|
err:
|
|
return false;
|
|
+#else
|
|
+ return true;
|
|
+#endif
|
|
}
|
|
|
|
void
|
|
key_des_fixup(uint8_t *key, int key_len, int ndc)
|
|
{
|
|
+#ifdef MBEDTLS_DES_C
|
|
int i;
|
|
struct buffer b;
|
|
|
|
@@ -386,6 +393,7 @@ key_des_fixup(uint8_t *key, int key_len,
|
|
}
|
|
mbedtls_des_key_set_parity(key);
|
|
}
|
|
+#endif
|
|
}
|
|
|
|
/*
|
|
@@ -710,10 +718,12 @@ cipher_des_encrypt_ecb(const unsigned ch
|
|
unsigned char *src,
|
|
unsigned char *dst)
|
|
{
|
|
+#ifdef MBEDTLS_DES_C
|
|
mbedtls_des_context ctx;
|
|
|
|
ASSERT(mbed_ok(mbedtls_des_setkey_enc(&ctx, key)));
|
|
ASSERT(mbed_ok(mbedtls_des_crypt_ecb(&ctx, src, dst)));
|
|
+#endif
|
|
}
|
|
|
|
|