From owner-svn-ports-head@freebsd.org Fri May 13 16:07:28 2016 Return-Path: Delivered-To: svn-ports-head@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id 02B2FB3A3C4; Fri, 13 May 2016 16:07:28 +0000 (UTC) (envelope-from mandree@FreeBSD.org) Received: from repo.freebsd.org (repo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:0]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by mx1.freebsd.org (Postfix) with ESMTPS id B120D1D6A; Fri, 13 May 2016 16:07:27 +0000 (UTC) (envelope-from mandree@FreeBSD.org) Received: from repo.freebsd.org ([127.0.1.37]) by repo.freebsd.org (8.15.2/8.15.2) with ESMTP id u4DG7QDD005889; Fri, 13 May 2016 16:07:26 GMT (envelope-from mandree@FreeBSD.org) Received: (from mandree@localhost) by repo.freebsd.org (8.15.2/8.15.2/Submit) id u4DG7QC1005887; Fri, 13 May 2016 16:07:26 GMT (envelope-from mandree@FreeBSD.org) Message-Id: <201605131607.u4DG7QC1005887@repo.freebsd.org> X-Authentication-Warning: repo.freebsd.org: mandree set sender to mandree@FreeBSD.org using -f From: Matthias Andree Date: Fri, 13 May 2016 16:07:26 +0000 (UTC) To: ports-committers@freebsd.org, svn-ports-all@freebsd.org, svn-ports-head@freebsd.org Subject: svn commit: r415116 - in head/security/openvpn: . files X-SVN-Group: ports-head MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-BeenThere: svn-ports-head@freebsd.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: SVN commit messages for the ports tree for head List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 13 May 2016 16:07:28 -0000 Author: mandree Date: Fri May 13 16:07:26 2016 New Revision: 415116 URL: https://svnweb.freebsd.org/changeset/ports/415116 Log: Fix PolarSSL-based builds. The upstream backported a change from the master branch that fixes the PolarSSL-based builds to go with the PolarSSL 1.3.X built-in defaults. Add a patch picked from the upstream's release/2.3 branch. Remove the BROKEN= line and conditional. No PORTREVISION bump because the patch only affects an option that was formerly marked BROKEN. (TRYBROKEN users need to force a rebuild and reinstallation manually.) Added: head/security/openvpn/files/patch-629baad8 (contents, props changed) Modified: head/security/openvpn/Makefile Modified: head/security/openvpn/Makefile ============================================================================== --- head/security/openvpn/Makefile Fri May 13 14:25:21 2016 (r415115) +++ head/security/openvpn/Makefile Fri May 13 16:07:26 2016 (r415116) @@ -119,10 +119,4 @@ post-install-EXAMPLES-on: (cd ${WRKSRC}/sample && ${COPYTREE_SHARE} \* ${STAGEDIR}${EXAMPLESDIR}/) ${CHMOD} ${BINMODE} ${STAGEDIR}${EXAMPLESDIR}/sample-scripts/* -.include - -.if ${PORT_OPTIONS:MPOLARSSL} -BROKEN=OpenVPN 2.3.11 with PolarSSL crashes on start unless TLS ciphers specified explicitly -.endif - -.include +.include Added: head/security/openvpn/files/patch-629baad8 ============================================================================== --- /dev/null 00:00:00 1970 (empty, because file is newly added) +++ head/security/openvpn/files/patch-629baad8 Fri May 13 16:07:26 2016 (r415116) @@ -0,0 +1,37 @@ +commit 629baad8f89af261445a2ace03694601f8e476f9 +Author: Steffan Karger +Date: Fri May 13 08:54:52 2016 +0200 + + Fix polarssl / mbedtls builds + + Commit 8a399cd3 hardened the OpenSSL default cipher list, + but also introduced a change in shared code that causes + polarssl / mbedtls builds to break when no --tls-cipher is + specified. + + This fix is backported code from the master branch. + + Signed-off-by: Steffan Karger + Acked-by: Gert Doering + Message-Id: <1463122492-701-1-git-send-email-steffan@karger.me> + URL: http://article.gmane.org/gmane.network.openvpn.devel/11647 + Signed-off-by: Gert Doering + +diff --git a/src/openvpn/ssl_polarssl.c b/src/openvpn/ssl_polarssl.c +index 1f58369..9263698 100644 +--- ./src/openvpn/ssl_polarssl.c ++++ ./src/openvpn/ssl_polarssl.c +@@ -176,7 +176,12 @@ tls_ctx_restrict_ciphers(struct tls_root_ctx *ctx, const char *ciphers) + { + char *tmp_ciphers, *tmp_ciphers_orig, *token; + int i, cipher_count; +- int ciphers_len = strlen (ciphers); ++ int ciphers_len; ++ ++ if (NULL == ciphers) ++ return; /* Nothing to do */ ++ ++ ciphers_len = strlen (ciphers); + + ASSERT (NULL != ctx); + ASSERT (0 != ciphers_len);