cubixle/packages
1
0
Fork 0
mirror of https://github.com/novatiq/packages.git synced 2026-04-30 07:28:39 +01:00
Code Issues Packages Projects Releases Wiki Activity

openvpn: update to 2.5.0

Browse Source 
New features:
* Per client tls-crypt keys
* ChaCha20-Poly1305 can be used to encrypt the data channel
* Routes are added/removed via Netlink instead of ifconfig/route
  (unless iproute2 support is enabled).
* VLAN support when using a TAP device

Significant changes:
* Server support can no longer be disabled.
* Crypto support can no longer be disabled, remove nossl variant.
* Blowfish (BF-CBC) is no longer implicitly the default cipher.
  OpenVPN peers prior to 2.4, or peers with data cipher negotiation
  disabled, will not be able to connect to a 2.5 peer unless
  option data_fallback_ciphers is set on the 2.5 peer and it contains a
  cipher supported by the client.

Signed-off-by: Magnus Kroken <mkroken@gmail.com>
This commit is contained in:
Magnus Kroken
2020-12-01 10:57:07 +01:00
committed by Rosen Penev
parent 4434915571
commit 2e55fc8b2d
12 changed files with 69 additions and 238 deletions
Download Patch File Download Diff File Expand all files Collapse all files
net/openvpn/patches/001-reproducible-remove_DATE.patch
+3 -3
View File
@@ -1,9 +1,9 @@
--- a/src/openvpn/options.c
+++ b/src/openvpn/options.c
@@ -106,7 +106,6 @@ const char title_string[] =
#ifdef HAVE_AEAD_CIPHER_MODES
" [AEAD]"
@@ -105,7 +105,6 @@ const char title_string[] =
#endif
#endif
" [AEAD]"
- " built on " __DATE__
;
net/openvpn/patches/100-mbedtls-disable-runtime-version-check.patch
+1 -1
View File
@@ -1,6 +1,6 @@
--- a/src/openvpn/ssl_mbedtls.c
+++ b/src/openvpn/ssl_mbedtls.c
@@ -1415,7 +1415,7 @@ const char *
@@ -1520,7 +1520,7 @@ const char *
get_ssl_library_version(void)
{
static char mbedtls_version[30];
net/openvpn/patches/110-openssl-dont-use-deprecated-ssleay-symbols.patch
-58
View File
@@ -1,58 +0,0 @@
From 17a476fd5c8cc49f1d103a50199e87ede76b1b67 Mon Sep 17 00:00:00 2001
From: Steffan Karger <steffan@karger.me>
Date: Sun, 26 Nov 2017 16:04:00 +0100
Subject: [PATCH] openssl: don't use deprecated SSLEAY/SSLeay symbols
Compiling our current master against OpenSSL 1.1 with
-DOPENSSL_API_COMPAT=0x10100000L screams bloody murder. This patch fixes
the errors about the deprecated SSLEAY/SSLeay symbols and defines.
Signed-off-by: Steffan Karger <steffan@karger.me>
Acked-by: Gert Doering <gert@greenie.muc.de>
Message-Id: <20171126150401.28565-1-steffan@karger.me>
URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg15934.html
Signed-off-by: Gert Doering <gert@greenie.muc.de>
---
configure.ac | 1 +
src/openvpn/openssl_compat.h | 8 ++++++++
src/openvpn/ssl_openssl.c | 2 +-
3 files changed, 10 insertions(+), 1 deletion(-)
--- a/configure.ac
+++ b/configure.ac
@@ -904,6 +904,7 @@ if test "${enable_crypto}" = "yes" -a "$
EVP_MD_CTX_free \
EVP_MD_CTX_reset \
EVP_CIPHER_CTX_reset \
+ OpenSSL_version \
SSL_CTX_get_default_passwd_cb \
SSL_CTX_get_default_passwd_cb_userdata \
SSL_CTX_set_security_level \
--- a/src/openvpn/openssl_compat.h
+++ b/src/openvpn/openssl_compat.h
@@ -689,6 +689,14 @@ EC_GROUP_order_bits(const EC_GROUP *grou
#endif
/* SSLeay symbols have been renamed in OpenSSL 1.1 */
+#ifndef OPENSSL_VERSION
+#define OPENSSL_VERSION SSLEAY_VERSION
+#endif
+
+#ifndef HAVE_OPENSSL_VERSION
+#define OpenSSL_version SSLeay_version
+#endif
+
#if !defined(RSA_F_RSA_OSSL_PRIVATE_ENCRYPT)
#define RSA_F_RSA_OSSL_PRIVATE_ENCRYPT RSA_F_RSA_EAY_PRIVATE_ENCRYPT
#endif
--- a/src/openvpn/ssl_openssl.c
+++ b/src/openvpn/ssl_openssl.c
@@ -2008,7 +2008,7 @@ get_highest_preference_tls_cipher(char *
const char *
get_ssl_library_version(void)
{
- return SSLeay_version(SSLEAY_VERSION);
+ return OpenSSL_version(OPENSSL_VERSION);
}
#endif /* defined(ENABLE_CRYPTO) && defined(ENABLE_CRYPTO_OPENSSL) */
net/openvpn/patches/111-openssl-add-missing-include-statements.patch
-65
View File
@@ -1,65 +0,0 @@
From 1987498271abadf042d8bb3feee1fe0d877a9d55 Mon Sep 17 00:00:00 2001
From: Steffan Karger <steffan@karger.me>
Date: Sun, 26 Nov 2017 16:49:12 +0100
Subject: [PATCH] openssl: add missing #include statements
Compiling our current master against OpenSSL 1.1 with
-DOPENSSL_API_COMPAT=0x10100000L screams bloody murder. This patch fixes
the errors caused by missing includes. Previous openssl versions would
usually include 'the rest of the world', but they're fixing that. So we
should no longer rely on it.
(And sneaking in alphabetic ordering of the includes while touching them.)
Signed-off-by: Steffan Karger <steffan@karger.me>
Acked-by: Gert Doering <gert@greenie.muc.de>
Message-Id: <20171126154912.13283-1-steffan@karger.me>
URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg15936.html
Signed-off-by: Gert Doering <gert@greenie.muc.de>
---
src/openvpn/openssl_compat.h | 1 +
src/openvpn/ssl_openssl.c | 6 +++++-
src/openvpn/ssl_verify_openssl.c | 3 ++-
3 files changed, 8 insertions(+), 2 deletions(-)
--- a/src/openvpn/openssl_compat.h
+++ b/src/openvpn/openssl_compat.h
@@ -42,6 +42,7 @@
#include "buffer.h"
+#include <openssl/rsa.h>
#include <openssl/ssl.h>
#include <openssl/x509.h>
--- a/src/openvpn/ssl_openssl.c
+++ b/src/openvpn/ssl_openssl.c
@@ -52,10 +52,14 @@
#include "ssl_verify_openssl.h"
+#include <openssl/bn.h>
+#include <openssl/crypto.h>
+#include <openssl/dh.h>
+#include <openssl/dsa.h>
#include <openssl/err.h>
#include <openssl/pkcs12.h>
+#include <openssl/rsa.h>
#include <openssl/x509.h>
-#include <openssl/crypto.h>
#ifndef OPENSSL_NO_EC
#include <openssl/ec.h>
#endif
--- a/src/openvpn/ssl_verify_openssl.c
+++ b/src/openvpn/ssl_verify_openssl.c
@@ -44,8 +44,9 @@
#include "ssl_verify_backend.h"
#include "openssl_compat.h"
-#include <openssl/x509v3.h>
+#include <openssl/bn.h>
#include <openssl/err.h>
+#include <openssl/x509v3.h>
int
verify_callback(int preverify_ok, X509_STORE_CTX *ctx)
net/openvpn/patches/210-build_always_use_internal_lz4.patch
+1 -1
View File
@@ -1,6 +1,6 @@
--- a/configure.ac
+++ b/configure.ac
@@ -1080,68 +1080,15 @@ dnl
@@ -1077,68 +1077,15 @@ dnl
AC_ARG_VAR([LZ4_CFLAGS], [C compiler flags for lz4])
AC_ARG_VAR([LZ4_LIBS], [linker flags for lz4])
if test "$enable_lz4" = "yes" && test "$enable_comp_stub" = "no"; then
net/openvpn/patches/220-disable_des.patch
+7 -14
View File
@@ -1,24 +1,17 @@
--- a/src/openvpn/syshead.h
+++ b/src/openvpn/syshead.h
@@ -597,11 +597,11 @@ socket_defined(const socket_descriptor_t
@@ -572,7 +572,7 @@ socket_defined(const socket_descriptor_t
/*
* Should we include NTLM proxy functionality
*/
-#if defined(ENABLE_CRYPTO)
-#define NTLM 1
-#else
+//#if defined(ENABLE_CRYPTO)
+//#define NTLM 1
+//#else
#define NTLM 0
-#endif
+//#endif
/*
* Should we include proxy digest auth functionality
--- a/src/openvpn/crypto_mbedtls.c
+++ b/src/openvpn/crypto_mbedtls.c
@@ -319,6 +319,7 @@ int
@@ -383,6 +383,7 @@ int
key_des_num_cblocks(const mbedtls_cipher_info_t *kt)
{
int ret = 0;
@@ -26,7 +19,7 @@
if (kt->type == MBEDTLS_CIPHER_DES_CBC)
{
ret = 1;
@@ -331,6 +332,7 @@ key_des_num_cblocks(const mbedtls_cipher
@@ -395,6 +396,7 @@ key_des_num_cblocks(const mbedtls_cipher
{
ret = 3;
}
@@ -34,7 +27,7 @@
dmsg(D_CRYPTO_DEBUG, "CRYPTO INFO: n_DES_cblocks=%d", ret);
return ret;
@@ -339,6 +341,7 @@ key_des_num_cblocks(const mbedtls_cipher
@@ -403,6 +405,7 @@ key_des_num_cblocks(const mbedtls_cipher
bool
key_des_check(uint8_t *key, int key_len, int ndc)
{
@@ -42,7 +35,7 @@
int i;
struct buffer b;
@@ -367,11 +370,15 @@ key_des_check(uint8_t *key, int key_len,
@@ -431,11 +434,15 @@ key_des_check(uint8_t *key, int key_len,
err:
return false;
@@ -58,7 +51,7 @@
int i;
struct buffer b;
@@ -386,6 +393,7 @@ key_des_fixup(uint8_t *key, int key_len,
@@ -450,6 +457,7 @@ key_des_fixup(uint8_t *key, int key_len,
}
mbedtls_des_key_set_parity(key);
}
@@ -66,7 +59,7 @@
}
/*
@@ -705,10 +713,12 @@ cipher_des_encrypt_ecb(const unsigned ch
@@ -770,10 +778,12 @@ cipher_des_encrypt_ecb(const unsigned ch
unsigned char *src,
unsigned char *dst)
{