From 8bd2c446d4edc2552e3827eb8026c588e05f6f1e Mon Sep 17 00:00:00 2001 From: Felix Fietkau Date: Sun, 4 Jan 2015 12:03:29 +0000 Subject: [PATCH] openvpn: backport an upstream fix for a regression in using --cipher none (fixes #18676) Signed-off-by: Felix Fietkau SVN-Revision: 43823 --- .../001-backport_cipher_none_fix.patch | 57 +++++++++++++++++++ 1 file changed, 57 insertions(+) create mode 100644 package/network/services/openvpn/patches/001-backport_cipher_none_fix.patch diff --git a/package/network/services/openvpn/patches/001-backport_cipher_none_fix.patch b/package/network/services/openvpn/patches/001-backport_cipher_none_fix.patch new file mode 100644 index 00000000000..af445e3bc85 --- /dev/null +++ b/package/network/services/openvpn/patches/001-backport_cipher_none_fix.patch @@ -0,0 +1,57 @@ +commit 98156e90e1e83133a6a6a020db8e7333ada6156b +Author: Steffan Karger +Date: Tue Dec 2 21:42:00 2014 +0100 + + Really fix '--cipher none' regression + + ... by not incorrectly hinting to the compiler the function argument of + cipher_kt_mode_{cbc,ofb_cfb}() is nonnull, since that no longer is the + case. + + Verified the fix on Debian Wheezy, one of the platforms the reporter in + trac #473 mentions with a compiler that would optimize out the required + checks. + + Also add a testcase for --cipher none to t_lpback, to prevent further + regressions. + + Signed-off-by: Steffan Karger + Acked-by: Gert Doering + Message-Id: <1417552920-31770-1-git-send-email-steffan@karger.me> + URL: http://article.gmane.org/gmane.network.openvpn.devel/9300 + Signed-off-by: Gert Doering + +--- a/src/openvpn/crypto_backend.h ++++ b/src/openvpn/crypto_backend.h +@@ -237,8 +237,7 @@ int cipher_kt_mode (const cipher_kt_t *c + * + * @return true iff the cipher is a CBC mode cipher. + */ +-bool cipher_kt_mode_cbc(const cipher_kt_t *cipher) +- __attribute__((nonnull)); ++bool cipher_kt_mode_cbc(const cipher_kt_t *cipher); + + /** + * Check if the supplied cipher is a supported OFB or CFB mode cipher. +@@ -247,8 +246,7 @@ bool cipher_kt_mode_cbc(const cipher_kt_ + * + * @return true iff the cipher is a OFB or CFB mode cipher. + */ +-bool cipher_kt_mode_ofb_cfb(const cipher_kt_t *cipher) +- __attribute__((nonnull)); ++bool cipher_kt_mode_ofb_cfb(const cipher_kt_t *cipher); + + + /** +--- a/tests/t_lpback.sh ++++ b/tests/t_lpback.sh +@@ -35,6 +35,9 @@ CIPHERS=$(${top_builddir}/src/openvpn/op + # GD, 2014-07-06 do not test RC5-* either (fails on NetBSD w/o libcrypto_rc5) + CIPHERS=$(echo "$CIPHERS" | egrep -v '^(DES-EDE3-CFB1|DES-CFB1|RC5-)' ) + ++# Also test cipher 'none' ++CIPHERS=${CIPHERS}$(printf "\nnone") ++ + "${top_builddir}/src/openvpn/openvpn" --genkey --secret key.$$ + set +e + -- 2.30.2