diff options
author | Jackie Huang <jackie.huang@windriver.com> | 2014-08-18 03:05:02 -0400 |
---|---|---|
committer | Martin Jansa <Martin.Jansa@gmail.com> | 2014-08-21 21:35:07 +0200 |
commit | 778ddba7010febf0b5c8029f09e83a3288eaa18b (patch) | |
tree | 81ffc747848c4fe700ac484d7f3e1294a189414d /meta-networking/recipes-support/strongswan | |
parent | c73e26932dcbb8bbe1895ba969e0c41cd9bbf850 (diff) | |
download | meta-openembedded-778ddba7010febf0b5c8029f09e83a3288eaa18b.tar.gz |
strongswan: uprev to version 5.2.0
* removed two patches which were already integrated in 5.2.0:
strongswan-4.3.3-5.1.1_asn1_unwrap.patch
strongswan-5.0.0-5.1.2_reject_child_sa.patch
Signed-off-by: Jackie Huang <jackie.huang@windriver.com>
Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
Diffstat (limited to 'meta-networking/recipes-support/strongswan')
-rw-r--r-- | meta-networking/recipes-support/strongswan/files/strongswan-4.3.3-5.1.1_asn1_unwrap.patch | 28 | ||||
-rw-r--r-- | meta-networking/recipes-support/strongswan/files/strongswan-5.0.0-5.1.2_reject_child_sa.patch | 36 | ||||
-rw-r--r-- | meta-networking/recipes-support/strongswan/strongswan_5.2.0.bb (renamed from meta-networking/recipes-support/strongswan/strongswan_5.1.1.bb) | 6 |
3 files changed, 2 insertions, 68 deletions
diff --git a/meta-networking/recipes-support/strongswan/files/strongswan-4.3.3-5.1.1_asn1_unwrap.patch b/meta-networking/recipes-support/strongswan/files/strongswan-4.3.3-5.1.1_asn1_unwrap.patch deleted file mode 100644 index 374f2cfe6..000000000 --- a/meta-networking/recipes-support/strongswan/files/strongswan-4.3.3-5.1.1_asn1_unwrap.patch +++ /dev/null | |||
@@ -1,28 +0,0 @@ | |||
1 | strongswan: asn1: Properly check length in asn1_unwrap() | ||
2 | |||
3 | Fixes CVE-2014-2891 in strongSwan releases 4.3.3-5.1.1. | ||
4 | |||
5 | Upstream-Status: Pending | ||
6 | |||
7 | Signed-off-by: Yue Tao <yue.tao@windriver.com> | ||
8 | |||
9 | --- | ||
10 | src/libstrongswan/asn1/asn1.c | 2 +- | ||
11 | 1 file changed, 1 insertion(+), 1 deletion(-) | ||
12 | |||
13 | diff --git a/src/libstrongswan/asn1/asn1.c b/src/libstrongswan/asn1/asn1.c | ||
14 | index d860ad9..9a5f5c5 100644 | ||
15 | --- a/src/libstrongswan/asn1/asn1.c | ||
16 | +++ b/src/libstrongswan/asn1/asn1.c | ||
17 | @@ -296,7 +296,7 @@ int asn1_unwrap(chunk_t *blob, chunk_t *inner) | ||
18 | else | ||
19 | { /* composite length, determine number of length octets */ | ||
20 | len &= 0x7f; | ||
21 | - if (len == 0 || len > sizeof(res.len)) | ||
22 | + if (len == 0 || len > blob->len || len > sizeof(res.len)) | ||
23 | { | ||
24 | return ASN1_INVALID; | ||
25 | } | ||
26 | -- | ||
27 | 1.7.10.4 | ||
28 | |||
diff --git a/meta-networking/recipes-support/strongswan/files/strongswan-5.0.0-5.1.2_reject_child_sa.patch b/meta-networking/recipes-support/strongswan/files/strongswan-5.0.0-5.1.2_reject_child_sa.patch deleted file mode 100644 index ad3459e99..000000000 --- a/meta-networking/recipes-support/strongswan/files/strongswan-5.0.0-5.1.2_reject_child_sa.patch +++ /dev/null | |||
@@ -1,36 +0,0 @@ | |||
1 | From b980ba7757dcfedd756aa055b3271ea58cf85aa6 Mon Sep 17 00:00:00 2001 | ||
2 | From: Martin Willi <martin@revosec.ch> | ||
3 | Date: Thu, 20 Feb 2014 16:08:43 +0100 | ||
4 | Subject: [PATCH] ikev2: Reject CREATE_CHILD_SA exchange on unestablished | ||
5 | IKE_SAs | ||
6 | |||
7 | Prevents a responder peer to trick us into established state by starting | ||
8 | IKE_SA rekeying before the IKE_SA has been authenticated during IKE_AUTH. | ||
9 | |||
10 | Fixes CVE-2014-2338 for 5.x versions of strongSwan. | ||
11 | --- | ||
12 | src/libcharon/sa/ikev2/task_manager_v2.c | 9 +++++++++ | ||
13 | 1 file changed, 9 insertions(+) | ||
14 | |||
15 | diff --git a/src/libcharon/sa/ikev2/task_manager_v2.c b/src/libcharon/sa/ikev2/task_manager_v2.c | ||
16 | index ac3be90..a5252ab 100644 | ||
17 | --- a/src/libcharon/sa/ikev2/task_manager_v2.c | ||
18 | +++ b/src/libcharon/sa/ikev2/task_manager_v2.c | ||
19 | @@ -780,6 +780,15 @@ static status_t process_request(private_ | ||
20 | case CREATE_CHILD_SA: | ||
21 | { /* FIXME: we should prevent this on mediation connections */ | ||
22 | bool notify_found = FALSE, ts_found = FALSE; | ||
23 | + | ||
24 | + if (this->ike_sa->get_state(this->ike_sa) == IKE_CREATED || | ||
25 | + this->ike_sa->get_state(this->ike_sa) == IKE_CONNECTING) | ||
26 | + { | ||
27 | + DBG1(DBG_IKE, "received CREATE_CHILD_SA request for " | ||
28 | + "unestablished IKE_SA, rejected"); | ||
29 | + return FAILED; | ||
30 | + } | ||
31 | + | ||
32 | enumerator = message->create_payload_enumerator(message); | ||
33 | while (enumerator->enumerate(enumerator, &payload)) | ||
34 | { | ||
35 | -- | ||
36 | 1.8.1.2 | ||
diff --git a/meta-networking/recipes-support/strongswan/strongswan_5.1.1.bb b/meta-networking/recipes-support/strongswan/strongswan_5.2.0.bb index cfa9abccc..0997fd03c 100644 --- a/meta-networking/recipes-support/strongswan/strongswan_5.1.1.bb +++ b/meta-networking/recipes-support/strongswan/strongswan_5.2.0.bb | |||
@@ -9,12 +9,10 @@ DEPENDS = "gmp openssl flex-native flex bison-native" | |||
9 | 9 | ||
10 | SRC_URI = "http://download.strongswan.org/strongswan-${PV}.tar.bz2 \ | 10 | SRC_URI = "http://download.strongswan.org/strongswan-${PV}.tar.bz2 \ |
11 | file://fix-funtion-parameter.patch \ | 11 | file://fix-funtion-parameter.patch \ |
12 | file://strongswan-5.0.0-5.1.2_reject_child_sa.patch \ | ||
13 | file://strongswan-4.3.3-5.1.1_asn1_unwrap.patch \ | ||
14 | " | 12 | " |
15 | 13 | ||
16 | SRC_URI[md5sum] = "e3af3d493d22286be3cd794533a8966a" | 14 | SRC_URI[md5sum] = "5cee4ee1a6ccb74400758b3ace54d46e" |
17 | SRC_URI[sha256sum] = "fbf2a668221fc4a36a34bdeac2dfeda25b96f572d551df022585177953622406" | 15 | SRC_URI[sha256sum] = "b00c30bd2e60ff2e5fc85f54bbad54fe246585812fdf212dbe777a5258da26ce" |
18 | 16 | ||
19 | EXTRA_OECONF = "--enable-gmp \ | 17 | EXTRA_OECONF = "--enable-gmp \ |
20 | --enable-openssl \ | 18 | --enable-openssl \ |