From 778ddba7010febf0b5c8029f09e83a3288eaa18b Mon Sep 17 00:00:00 2001 From: Jackie Huang Date: Mon, 18 Aug 2014 03:05:02 -0400 Subject: strongswan: uprev to version 5.2.0 * removed two patches which were already integrated in 5.2.0: strongswan-4.3.3-5.1.1_asn1_unwrap.patch strongswan-5.0.0-5.1.2_reject_child_sa.patch Signed-off-by: Jackie Huang Signed-off-by: Martin Jansa --- .../files/strongswan-4.3.3-5.1.1_asn1_unwrap.patch | 28 ------------- .../strongswan-5.0.0-5.1.2_reject_child_sa.patch | 36 ----------------- .../recipes-support/strongswan/strongswan_5.1.1.bb | 47 ---------------------- .../recipes-support/strongswan/strongswan_5.2.0.bb | 45 +++++++++++++++++++++ 4 files changed, 45 insertions(+), 111 deletions(-) delete mode 100644 meta-networking/recipes-support/strongswan/files/strongswan-4.3.3-5.1.1_asn1_unwrap.patch delete mode 100644 meta-networking/recipes-support/strongswan/files/strongswan-5.0.0-5.1.2_reject_child_sa.patch delete mode 100644 meta-networking/recipes-support/strongswan/strongswan_5.1.1.bb create mode 100644 meta-networking/recipes-support/strongswan/strongswan_5.2.0.bb diff --git a/meta-networking/recipes-support/strongswan/files/strongswan-4.3.3-5.1.1_asn1_unwrap.patch b/meta-networking/recipes-support/strongswan/files/strongswan-4.3.3-5.1.1_asn1_unwrap.patch deleted file mode 100644 index 374f2cfe69..0000000000 --- a/meta-networking/recipes-support/strongswan/files/strongswan-4.3.3-5.1.1_asn1_unwrap.patch +++ /dev/null @@ -1,28 +0,0 @@ -strongswan: asn1: Properly check length in asn1_unwrap() - -Fixes CVE-2014-2891 in strongSwan releases 4.3.3-5.1.1. - -Upstream-Status: Pending - -Signed-off-by: Yue Tao - ---- - src/libstrongswan/asn1/asn1.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/src/libstrongswan/asn1/asn1.c b/src/libstrongswan/asn1/asn1.c -index d860ad9..9a5f5c5 100644 ---- a/src/libstrongswan/asn1/asn1.c -+++ b/src/libstrongswan/asn1/asn1.c -@@ -296,7 +296,7 @@ int asn1_unwrap(chunk_t *blob, chunk_t *inner) - else - { /* composite length, determine number of length octets */ - len &= 0x7f; -- if (len == 0 || len > sizeof(res.len)) -+ if (len == 0 || len > blob->len || len > sizeof(res.len)) - { - return ASN1_INVALID; - } --- -1.7.10.4 - diff --git a/meta-networking/recipes-support/strongswan/files/strongswan-5.0.0-5.1.2_reject_child_sa.patch b/meta-networking/recipes-support/strongswan/files/strongswan-5.0.0-5.1.2_reject_child_sa.patch deleted file mode 100644 index ad3459e995..0000000000 --- a/meta-networking/recipes-support/strongswan/files/strongswan-5.0.0-5.1.2_reject_child_sa.patch +++ /dev/null @@ -1,36 +0,0 @@ -From b980ba7757dcfedd756aa055b3271ea58cf85aa6 Mon Sep 17 00:00:00 2001 -From: Martin Willi -Date: Thu, 20 Feb 2014 16:08:43 +0100 -Subject: [PATCH] ikev2: Reject CREATE_CHILD_SA exchange on unestablished - IKE_SAs - -Prevents a responder peer to trick us into established state by starting -IKE_SA rekeying before the IKE_SA has been authenticated during IKE_AUTH. - -Fixes CVE-2014-2338 for 5.x versions of strongSwan. ---- - src/libcharon/sa/ikev2/task_manager_v2.c | 9 +++++++++ - 1 file changed, 9 insertions(+) - -diff --git a/src/libcharon/sa/ikev2/task_manager_v2.c b/src/libcharon/sa/ikev2/task_manager_v2.c -index ac3be90..a5252ab 100644 ---- a/src/libcharon/sa/ikev2/task_manager_v2.c -+++ b/src/libcharon/sa/ikev2/task_manager_v2.c -@@ -780,6 +780,15 @@ static status_t process_request(private_ - case CREATE_CHILD_SA: - { /* FIXME: we should prevent this on mediation connections */ - bool notify_found = FALSE, ts_found = FALSE; -+ -+ if (this->ike_sa->get_state(this->ike_sa) == IKE_CREATED || -+ this->ike_sa->get_state(this->ike_sa) == IKE_CONNECTING) -+ { -+ DBG1(DBG_IKE, "received CREATE_CHILD_SA request for " -+ "unestablished IKE_SA, rejected"); -+ return FAILED; -+ } -+ - enumerator = message->create_payload_enumerator(message); - while (enumerator->enumerate(enumerator, &payload)) - { --- -1.8.1.2 diff --git a/meta-networking/recipes-support/strongswan/strongswan_5.1.1.bb b/meta-networking/recipes-support/strongswan/strongswan_5.1.1.bb deleted file mode 100644 index cfa9abccca..0000000000 --- a/meta-networking/recipes-support/strongswan/strongswan_5.1.1.bb +++ /dev/null @@ -1,47 +0,0 @@ -DESCRIPTION = "strongSwan is an OpenSource IPsec implementation for the \ -Linux operating system." -SUMMARY = "strongSwan is an OpenSource IPsec implementation" -HOMEPAGE = "http://www.strongswan.org" -SECTION = "console/network" -LICENSE = "GPLv2" -LIC_FILES_CHKSUM = "file://COPYING;md5=b234ee4d69f5fce4486a80fdaf4a4263" -DEPENDS = "gmp openssl flex-native flex bison-native" - -SRC_URI = "http://download.strongswan.org/strongswan-${PV}.tar.bz2 \ - file://fix-funtion-parameter.patch \ - file://strongswan-5.0.0-5.1.2_reject_child_sa.patch \ - file://strongswan-4.3.3-5.1.1_asn1_unwrap.patch \ -" - -SRC_URI[md5sum] = "e3af3d493d22286be3cd794533a8966a" -SRC_URI[sha256sum] = "fbf2a668221fc4a36a34bdeac2dfeda25b96f572d551df022585177953622406" - -EXTRA_OECONF = "--enable-gmp \ - --enable-openssl \ - --without-lib-prefix \ -" - -EXTRA_OECONF += "${@base_contains('DISTRO_FEATURES', 'systemd', '--with-systemdsystemunitdir=${systemd_unitdir}/system/', '--without-systemdsystemunitdir', d)}" - -PACKAGECONFIG ??= "sqlite3 curl \ - ${@base_contains('DISTRO_FEATURES', 'ldap', 'ldap', '', d)} \ -" -PACKAGECONFIG[sqlite3] = "--enable-sqlite,--disable-sqlite,sqlite3," -PACKAGECONFIG[ldap] = "--enable-ldap,--disable-ldap,openldap," -PACKAGECONFIG[curl] = "--enable-curl,--disable-curl,curl," -PACKAGECONFIG[soup] = "--enable-soup,--disable-soup,libsoup-2.4," -PACKAGECONFIG[mysql] = "--enable-mysql,--disable-mysql,mysql5," - -inherit autotools systemd pkgconfig - -RRECOMMENDS_${PN} = "kernel-module-ipsec" - -FILES_${PN} += "${libdir}/ipsec/lib*${SOLIBS} ${libdir}/ipsec/plugins/*.so" -FILES_${PN}-dbg += "${libdir}/ipsec/.debug ${libdir}/ipsec/plugins/.debug ${libexecdir}/ipsec/.debug" -FILES_${PN}-dev += "${libdir}/ipsec/lib*${SOLIBSDEV} ${libdir}/ipsec/*.la ${libdir}/ipsec/plugins/*.la" -FILES_${PN}-staticdev += "${libdir}/ipsec/*.a ${libdir}/ipsec/plugins/*.a" - -RPROVIDES_${PN} += "${PN}-systemd" -RREPLACES_${PN} += "${PN}-systemd" -RCONFLICTS_${PN} += "${PN}-systemd" -SYSTEMD_SERVICE_${PN} = "${BPN}.service" diff --git a/meta-networking/recipes-support/strongswan/strongswan_5.2.0.bb b/meta-networking/recipes-support/strongswan/strongswan_5.2.0.bb new file mode 100644 index 0000000000..0997fd03c1 --- /dev/null +++ b/meta-networking/recipes-support/strongswan/strongswan_5.2.0.bb @@ -0,0 +1,45 @@ +DESCRIPTION = "strongSwan is an OpenSource IPsec implementation for the \ +Linux operating system." +SUMMARY = "strongSwan is an OpenSource IPsec implementation" +HOMEPAGE = "http://www.strongswan.org" +SECTION = "console/network" +LICENSE = "GPLv2" +LIC_FILES_CHKSUM = "file://COPYING;md5=b234ee4d69f5fce4486a80fdaf4a4263" +DEPENDS = "gmp openssl flex-native flex bison-native" + +SRC_URI = "http://download.strongswan.org/strongswan-${PV}.tar.bz2 \ + file://fix-funtion-parameter.patch \ +" + +SRC_URI[md5sum] = "5cee4ee1a6ccb74400758b3ace54d46e" +SRC_URI[sha256sum] = "b00c30bd2e60ff2e5fc85f54bbad54fe246585812fdf212dbe777a5258da26ce" + +EXTRA_OECONF = "--enable-gmp \ + --enable-openssl \ + --without-lib-prefix \ +" + +EXTRA_OECONF += "${@base_contains('DISTRO_FEATURES', 'systemd', '--with-systemdsystemunitdir=${systemd_unitdir}/system/', '--without-systemdsystemunitdir', d)}" + +PACKAGECONFIG ??= "sqlite3 curl \ + ${@base_contains('DISTRO_FEATURES', 'ldap', 'ldap', '', d)} \ +" +PACKAGECONFIG[sqlite3] = "--enable-sqlite,--disable-sqlite,sqlite3," +PACKAGECONFIG[ldap] = "--enable-ldap,--disable-ldap,openldap," +PACKAGECONFIG[curl] = "--enable-curl,--disable-curl,curl," +PACKAGECONFIG[soup] = "--enable-soup,--disable-soup,libsoup-2.4," +PACKAGECONFIG[mysql] = "--enable-mysql,--disable-mysql,mysql5," + +inherit autotools systemd pkgconfig + +RRECOMMENDS_${PN} = "kernel-module-ipsec" + +FILES_${PN} += "${libdir}/ipsec/lib*${SOLIBS} ${libdir}/ipsec/plugins/*.so" +FILES_${PN}-dbg += "${libdir}/ipsec/.debug ${libdir}/ipsec/plugins/.debug ${libexecdir}/ipsec/.debug" +FILES_${PN}-dev += "${libdir}/ipsec/lib*${SOLIBSDEV} ${libdir}/ipsec/*.la ${libdir}/ipsec/plugins/*.la" +FILES_${PN}-staticdev += "${libdir}/ipsec/*.a ${libdir}/ipsec/plugins/*.a" + +RPROVIDES_${PN} += "${PN}-systemd" +RREPLACES_${PN} += "${PN}-systemd" +RCONFLICTS_${PN} += "${PN}-systemd" +SYSTEMD_SERVICE_${PN} = "${BPN}.service" -- cgit 1.2.3-korg