openvpn: update to 2.4.3

Fixes for security and other issues. See security announcement for more details:
https://community.openvpn.net/openvpn/wiki/VulnerabilitiesFixedInOpenVPN243

* Remotely-triggerable ASSERT() on malformed IPv6 packet (CVE-2017-7508)
* Pre-authentication remote crash/information disclosure for clients (CVE-2017-7520)
* Potential double-free in --x509-alt-username (CVE-2017-7521)
* Remote-triggerable memory leaks (CVE-2017-7512)
* Post-authentication remote DoS when using the --x509-track option (CVE-2017-7522)
* Null-pointer dereference in establish_http_proxy_passthru()
* Restrict --x509-alt-username extension types
* Fix potential 1-byte overread in TCP option parsing
* Fix mbedtls fingerprint calculation
* openssl: fix overflow check for long --tls-cipher option
* Ensure option array p[] is always NULL-terminated
* Pass correct buffer size to GetModuleFileNameW() (Quarkslabs finding 5.6)

Signed-off-by: Magnus Kroken <mkroken@gmail.com>

diff --git a/package/network/services/openvpn/Makefile b/package/network/services/openvpn/Makefile
index ea3ac3d83dadccdbe4588c78658f427dc47630c9..537a1bfe2d4579c9a4b793eeac4dbe976c2c19e3 100644 (file)
--- a/package/network/services/openvpn/Makefile
+++ b/package/network/services/openvpn/Makefile
@@ -9,14 +9,15 @@ include $(TOPDIR)/rules.mk
 
 PKG_NAME:=openvpn
 
-PKG_VERSION:=2.4.2
+PKG_VERSION:=2.4.3
 PKG_RELEASE:=1
 
 PKG_SOURCE_URL:=\
        https://build.openvpn.net/downloads/releases/ \
-       https://swupdate.openvpn.net/community/releases/
+       https://swupdate.openvpn.net/community/releases/ \
+       http://www.eurephia.net/openvpn/
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.xz
-PKG_HASH:=df5c4f384b7df6b08a2f6fa8a84b9fd382baf59c2cef1836f82e2a7f62f1bff9
+PKG_HASH:=7aa86167a5b8923e54e8795b814ed77288c793671f59fd830d9ab76d4b480571
 
 PKG_BUILD_DIR:=$(BUILD_DIR)/$(PKG_NAME)-$(BUILD_VARIANT)/$(PKG_NAME)-$(PKG_VERSION)
 PKG_MAINTAINER:=Felix Fietkau <nbd@nbd.name>

diff --git a/package/network/services/openvpn/patches/001-reproducible-remove_DATE.patch b/package/network/services/openvpn/patches/001-reproducible-remove_DATE.patch
index 5f23994b5c73790edc033869e68a17e1ede592b6..101fa12ba22f2c9b16db0349febe3d83b30fa58c 100644 (file)
--- a/package/network/services/openvpn/patches/001-reproducible-remove_DATE.patch
+++ b/package/network/services/openvpn/patches/001-reproducible-remove_DATE.patch
@@ -1,6 +1,6 @@
 --- a/src/openvpn/options.c
 +++ b/src/openvpn/options.c
-@@ -107,7 +107,6 @@ const char title_string[] =
+@@ -106,7 +106,6 @@ const char title_string[] =
  #ifdef HAVE_AEAD_CIPHER_MODES
      " [AEAD]"
  #endif

diff --git a/package/network/services/openvpn/patches/100-mbedtls-disable-runtime-version-check.patch b/package/network/services/openvpn/patches/100-mbedtls-disable-runtime-version-check.patch
index 75e306234f0d354ab9d0fe8c41763574fe55268b..8209bca4f722c9c6f8026e202d6be697018c0057 100644 (file)
--- a/package/network/services/openvpn/patches/100-mbedtls-disable-runtime-version-check.patch
+++ b/package/network/services/openvpn/patches/100-mbedtls-disable-runtime-version-check.patch
@@ -1,6 +1,6 @@
 --- a/src/openvpn/ssl_mbedtls.c
 +++ b/src/openvpn/ssl_mbedtls.c
-@@ -1337,7 +1337,7 @@ const char *
+@@ -1336,7 +1336,7 @@ const char *
  get_ssl_library_version(void)
  {
      static char mbedtls_version[30];

diff --git a/package/network/services/openvpn/patches/210-build_always_use_internal_lz4.patch b/package/network/services/openvpn/patches/210-build_always_use_internal_lz4.patch
index 45a0207565f250eea857f9fde19cd5794b2d5b36..b0fe00df9b390cec2b36cf001cbec9309b3a8d50 100644 (file)
--- a/package/network/services/openvpn/patches/210-build_always_use_internal_lz4.patch
+++ b/package/network/services/openvpn/patches/210-build_always_use_internal_lz4.patch
@@ -1,6 +1,6 @@
 --- a/configure.ac
 +++ b/configure.ac
-@@ -1058,37 +1058,14 @@ dnl
+@@ -1076,37 +1076,14 @@ dnl
  AC_ARG_VAR([LZ4_CFLAGS], [C compiler flags for lz4])
  AC_ARG_VAR([LZ4_LIBS], [linker flags for lz4])
  if test "$enable_lz4" = "yes" && test "$enable_comp_stub" = "no"; then

diff --git a/package/network/services/openvpn/patches/220-disable_des.patch b/package/network/services/openvpn/patches/220-disable_des.patch
index cd930709cbab56d5746a459fccd133c2e37630cd..030958d1bcd66a5d7f05174e3f86b51f1aca93ed 100644 (file)
--- a/package/network/services/openvpn/patches/220-disable_des.patch
+++ b/package/network/services/openvpn/patches/220-disable_des.patch
@@ -1,6 +1,6 @@
 --- a/src/openvpn/syshead.h
 +++ b/src/openvpn/syshead.h
-@@ -594,11 +594,11 @@ socket_defined(const socket_descriptor_t
+@@ -597,11 +597,11 @@ socket_defined(const socket_descriptor_t
  /*
   * Should we include NTLM proxy functionality
   */
@@ -18,7 +18,7 @@
   * Should we include proxy digest auth functionality
 --- a/src/openvpn/crypto_mbedtls.c
 +++ b/src/openvpn/crypto_mbedtls.c
-@@ -320,6 +320,7 @@ int
+@@ -319,6 +319,7 @@ int
  key_des_num_cblocks(const mbedtls_cipher_info_t *kt)
  {
      int ret = 0;
@@ -26,7 +26,7 @@
      if (kt->type == MBEDTLS_CIPHER_DES_CBC)
      {
          ret = 1;
-@@ -332,6 +333,7 @@ key_des_num_cblocks(const mbedtls_cipher
+@@ -331,6 +332,7 @@ key_des_num_cblocks(const mbedtls_cipher
      {
          ret = 3;
      }
@@ -34,7 +34,7 @@
  
      dmsg(D_CRYPTO_DEBUG, "CRYPTO INFO: n_DES_cblocks=%d", ret);
      return ret;
-@@ -340,6 +342,7 @@ key_des_num_cblocks(const mbedtls_cipher
+@@ -339,6 +341,7 @@ key_des_num_cblocks(const mbedtls_cipher
  bool
  key_des_check(uint8_t *key, int key_len, int ndc)
  {
@@ -42,7 +42,7 @@
      int i;
      struct buffer b;
  
-@@ -368,11 +371,15 @@ key_des_check(uint8_t *key, int key_len,
+@@ -367,11 +370,15 @@ key_des_check(uint8_t *key, int key_len,
  
  err:
      return false;
@@ -58,7 +58,7 @@
      int i;
      struct buffer b;
  
-@@ -387,6 +394,7 @@ key_des_fixup(uint8_t *key, int key_len,
+@@ -386,6 +393,7 @@ key_des_fixup(uint8_t *key, int key_len,
          }
          mbedtls_des_key_set_parity(key);
      }
@@ -66,7 +66,7 @@
  }
  
  /*
-@@ -698,10 +706,12 @@ cipher_des_encrypt_ecb(const unsigned ch
+@@ -710,10 +718,12 @@ cipher_des_encrypt_ecb(const unsigned ch
                         unsigned char *src,
                         unsigned char *dst)
  {