From owner-svn-ports-head@FreeBSD.ORG Sun Mar 31 16:00:03 2013 Return-Path: Delivered-To: svn-ports-head@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) by hub.freebsd.org (Postfix) with ESMTP id C7616217; Sun, 31 Mar 2013 16:00:03 +0000 (UTC) (envelope-from mandree@FreeBSD.org) Received: from svn.freebsd.org (svn.freebsd.org [IPv6:2001:1900:2254:2068::e6a:0]) by mx1.freebsd.org (Postfix) with ESMTP id AB43A1E5; Sun, 31 Mar 2013 16:00:03 +0000 (UTC) Received: from svn.freebsd.org ([127.0.1.70]) by svn.freebsd.org (8.14.6/8.14.6) with ESMTP id r2VG03Rw099318; Sun, 31 Mar 2013 16:00:03 GMT (envelope-from mandree@svn.freebsd.org) Received: (from mandree@localhost) by svn.freebsd.org (8.14.6/8.14.5/Submit) id r2VG02N6099312; Sun, 31 Mar 2013 16:00:02 GMT (envelope-from mandree@svn.freebsd.org) Message-Id: <201303311600.r2VG02N6099312@svn.freebsd.org> From: Matthias Andree Date: Sun, 31 Mar 2013 16:00:02 +0000 (UTC) To: ports-committers@freebsd.org, svn-ports-all@freebsd.org, svn-ports-head@freebsd.org Subject: svn commit: r315640 - in head/security: openvpn vuxml X-SVN-Group: ports-head MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-BeenThere: svn-ports-head@freebsd.org X-Mailman-Version: 2.1.14 Precedence: list List-Id: SVN commit messages for the ports tree for head List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 31 Mar 2013 16:00:03 -0000 Author: mandree Date: Sun Mar 31 16:00:02 2013 New Revision: 315640 URL: http://svnweb.freebsd.org/changeset/ports/315640 Log: security upgrade to OpenVPN 2.3.1; upstream release notes are "This release adds supports for PolarSSL 1.2. It also adds a fix to prevent potential side-channel attacks by switching to a constant-time memcmp when comparing HMACs in the openvpn_decrypt function. In addition, it contains several bugfixes and documentation updates, as well as some minor enhancements." Full ChangeLog: The port upgrade also offers an option to use the GPLv2+-licensed PolarSSL instead of OpenSSL (which brings in a license mix). PR: ports/177517 Reviewed by: miwi Approved by: portmgr (miwi) Security: 92f30415-9935-11e2-ad4c-080027ef73ec Modified: head/security/openvpn/Makefile head/security/openvpn/distinfo head/security/vuxml/vuln.xml Modified: head/security/openvpn/Makefile ============================================================================== --- head/security/openvpn/Makefile Sun Mar 31 15:58:20 2013 (r315639) +++ head/security/openvpn/Makefile Sun Mar 31 16:00:02 2013 (r315640) @@ -2,8 +2,7 @@ # $FreeBSD$ PORTNAME= openvpn -DISTVERSION= 2.3.0 -PORTREVISION= 3 +DISTVERSION= 2.3.1 CATEGORIES= security net MASTER_SITES= http://swupdate.openvpn.net/community/releases/ \ http://build.openvpn.net/downloads/releases/ @@ -16,18 +15,19 @@ LICENSE= GPLv2 CONFLICTS_INSTALL= openvpn-2.[!3].* openvpn-[!2].* openvpn-beta-[0-9]* openvpn-devel-[0-9]* GNU_CONFIGURE= yes -USE_OPENSSL= yes USE_XZ= yes # let OpenVPN's configure script pick up the requisite libraries: CPPFLAGS+= -I${LOCALBASE}/include LDFLAGS+= -L${LOCALBASE}/lib -# PolarSSL is not provided; OpenVPN does not currently compile with PolarSSL 1.2.0+ OPTIONS_DEFINE= PW_SAVE PKCS11 EASYRSA -OPTIONS_DEFAULT= EASYRSA +OPTIONS_DEFAULT= EASYRSA OPENSSL +OPTIONS_SINGLE= SSL +OPTIONS_SINGLE_SSL= OPENSSL POLARSSL PW_SAVE_DESC= Interactive passwords may be read from a file PKCS11_DESC= Use security/pkcs11-helper EASYRSA_DESC= Install security/easy-rsa RSA helper package +POLARSSL_DESC= SSL/TLS support via PolarSSL .include @@ -40,7 +40,15 @@ INSTALL_TARGET= install DESTDIR=${_stage RUN_DEPENDS+= easy-rsa>=0:${PORTSDIR}/security/easy-rsa .endif -INSTALL_TARGET+= mandir=${MANPREFIX}/man +.if ${PORT_OPTIONS:MPOLARSSL} +LIB_DEPENDS+= polarssl:${PORTSDIR}/security/polarssl +CONFIGURE_ARGS+= --with-crypto-library=polarssl +.else +USE_OPENSSL= yes +CONFIGURE_ARGS+= --with-crypto-library=openssl +.endif + +.INSTALL_TARGET+= mandir=${MANPREFIX}/man MAN8= openvpn.8 USE_RC_SUBR= openvpn @@ -98,7 +106,6 @@ post-install: ${INSTALL_DATA} ${_stagedir}${PREFIX}/include/* ${PREFIX}/include/ ${INSTALL_MAN} ${_stagedir}${PREFIX}/man/man8/* ${MAN8PREFIX}/man/man8/ .if ${PORT_OPTIONS:MDOCS} - -${RMDIR} ${_stagedir}${DOCSDIR}/sample (cd ${_stagedir}${DOCSDIR} && ${COPYTREE_SHARE} \* ${DOCSDIR}/) .for i in AUTHORS ChangeLog PORTS ${INSTALL_MAN} ${WRKSRC}/${i} ${DOCSDIR}/ Modified: head/security/openvpn/distinfo ============================================================================== --- head/security/openvpn/distinfo Sun Mar 31 15:58:20 2013 (r315639) +++ head/security/openvpn/distinfo Sun Mar 31 16:00:02 2013 (r315640) @@ -1,2 +1,2 @@ -SHA256 (openvpn-2.3.0.tar.xz) = a9fcf7bc1c1cd88cd8867ff567e8f8df5e695f0e983bd0aed3a3e1f6ae14d107 -SIZE (openvpn-2.3.0.tar.xz) = 762052 +SHA256 (openvpn-2.3.1.tar.xz) = 9d7723ea83cdc0c78b32005f4b9c1f7ca1cc9e53e90b77bd643a203e6189884b +SIZE (openvpn-2.3.1.tar.xz) = 776076 Modified: head/security/vuxml/vuln.xml ============================================================================== --- head/security/vuxml/vuln.xml Sun Mar 31 15:58:20 2013 (r315639) +++ head/security/vuxml/vuln.xml Sun Mar 31 16:00:02 2013 (r315640) @@ -51,6 +51,33 @@ Note: Please add new entries to the beg --> + + OpenVPN -- potential side-channel/timing attack when comparing HMACs + + + openvpn + 2.3.1 + + + + +

The OpenVPN project reports:

+
+

[OpenVPN 2.3.1 adds a fix to prevent potential side-channel + attacks by switching to a] constant time memcmp when comparing HMACs in [the] openvpn_decrypt [function].

+
+ + + + https://community.openvpn.net/openvpn/wiki/ChangesInOpenvpn23#OpenVPN2.3.1 + http://openvpn.git.sourceforge.net/git/gitweb.cgi?p=openvpn/openvpn-testing.git;a=commit;h=11d21349a4e7e38a025849479b36ace7c2eec2ee + + + 2013-03-19 + 2013-03-31 + + + libxml2 -- cpu consumption Dos