From owner-svn-ports-head@freebsd.org Sat Dec 16 17:33:33 2017 Return-Path: Delivered-To: svn-ports-head@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id B613CE892C5; Sat, 16 Dec 2017 17:33:33 +0000 (UTC) (envelope-from olgeni@FreeBSD.org) Received: from repo.freebsd.org (repo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:0]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by mx1.freebsd.org (Postfix) with ESMTPS id 87A476BDB0; Sat, 16 Dec 2017 17:33:33 +0000 (UTC) (envelope-from olgeni@FreeBSD.org) Received: from repo.freebsd.org ([127.0.1.37]) by repo.freebsd.org (8.15.2/8.15.2) with ESMTP id vBGHXWvI003614; Sat, 16 Dec 2017 17:33:32 GMT (envelope-from olgeni@FreeBSD.org) Received: (from olgeni@localhost) by repo.freebsd.org (8.15.2/8.15.2/Submit) id vBGHXWdT003610; Sat, 16 Dec 2017 17:33:32 GMT (envelope-from olgeni@FreeBSD.org) Message-Id: <201712161733.vBGHXWdT003610@repo.freebsd.org> X-Authentication-Warning: repo.freebsd.org: olgeni set sender to olgeni@FreeBSD.org using -f From: Jimmy Olgeni Date: Sat, 16 Dec 2017 17:33:32 +0000 (UTC) To: ports-committers@freebsd.org, svn-ports-all@freebsd.org, svn-ports-head@freebsd.org Subject: svn commit: r456477 - in head/lang/erlang-runtime17: . files X-SVN-Group: ports-head X-SVN-Commit-Author: olgeni X-SVN-Commit-Paths: in head/lang/erlang-runtime17: . files X-SVN-Commit-Revision: 456477 X-SVN-Commit-Repository: ports MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-BeenThere: svn-ports-head@freebsd.org X-Mailman-Version: 2.1.25 Precedence: list List-Id: SVN commit messages for the ports tree for head List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 16 Dec 2017 17:33:33 -0000 Author: olgeni Date: Sat Dec 16 17:33:32 2017 New Revision: 456477 URL: https://svnweb.freebsd.org/changeset/ports/456477 Log: lang/erlang-runtime17: backport fix for CVE-2017-1000385 from erlang-runtime18. PR: 224278 Submitted by: Stefan Grundmann Added: head/lang/erlang-runtime17/files/patch-lib_ssl_src_ssl__connection.erl (contents, props changed) head/lang/erlang-runtime17/files/patch-lib_ssl_src_ssl__connection.hrl (contents, props changed) head/lang/erlang-runtime17/files/patch-lib_ssl_src_tls__connection.erl (contents, props changed) Modified: head/lang/erlang-runtime17/Makefile Modified: head/lang/erlang-runtime17/Makefile ============================================================================== --- head/lang/erlang-runtime17/Makefile Sat Dec 16 17:18:36 2017 (r456476) +++ head/lang/erlang-runtime17/Makefile Sat Dec 16 17:33:32 2017 (r456477) @@ -3,7 +3,7 @@ PORTNAME= erlang PORTVERSION= 17.5.6.9 -PORTREVISION= 6 +PORTREVISION= 7 CATEGORIES= lang parallel java MASTER_SITES= http://www.erlang.org/download/:erlangorg \ http://erlang.stacken.kth.se/download/:erlangorg \ Added: head/lang/erlang-runtime17/files/patch-lib_ssl_src_ssl__connection.erl ============================================================================== --- /dev/null 00:00:00 1970 (empty, because file is newly added) +++ head/lang/erlang-runtime17/files/patch-lib_ssl_src_ssl__connection.erl Sat Dec 16 17:33:32 2017 (r456477) @@ -0,0 +1,30 @@ +--- lib/ssl/src/ssl_connection.erl.orig 2015-03-31 12:32:52.000000000 +0000 ++++ lib/ssl/src/ssl_connection.erl 2017-12-14 13:13:46.570861000 +0000 +@@ -1135,8 +1135,25 @@ + request_client_cert(State2, Connection). + + certify_client_key_exchange(#encrypted_premaster_secret{premaster_secret= EncPMS}, +- #state{private_key = Key} = State, Connection) -> +- PremasterSecret = ssl_handshake:premaster_secret(EncPMS, Key), ++ #state{private_key = Key, client_hello_version = {Major, Minor} = Version } = State, Connection) -> ++ ++ %% Countermeasure for Bleichenbacher attack always provide some kind of premaster secret ++ %% and fail handshake later.RFC 5246 section 7.4.7.1. ++ PremasterSecret = ++ try ssl_handshake:premaster_secret(EncPMS, Key) of ++ Secret when erlang:byte_size(Secret) == ?NUM_OF_PREMASTERSECRET_BYTES -> ++ case Secret of ++ <> -> %% Correct ++ Secret; ++ <> -> %% Version mismatch ++ <> ++ end; ++ _ -> %% erlang:byte_size(Secret) =/= ?NUM_OF_PREMASTERSECRET_BYTES ++ make_premaster_secret(Version, rsa) ++ catch ++ #alert{description = ?DECRYPT_ERROR} -> ++ make_premaster_secret(Version, rsa) ++ end, + calculate_master_secret(PremasterSecret, State, Connection, certify, cipher); + + certify_client_key_exchange(#client_diffie_hellman_public{dh_public = ClientPublicDhKey}, Added: head/lang/erlang-runtime17/files/patch-lib_ssl_src_ssl__connection.hrl ============================================================================== --- /dev/null 00:00:00 1970 (empty, because file is newly added) +++ head/lang/erlang-runtime17/files/patch-lib_ssl_src_ssl__connection.hrl Sat Dec 16 17:33:32 2017 (r456477) @@ -0,0 +1,12 @@ +--- lib/ssl/src/ssl_connection.hrl.orig 2015-03-31 12:32:52.000000000 +0000 ++++ lib/ssl/src/ssl_connection.hrl 2017-12-14 13:18:02.736638000 +0000 +@@ -53,7 +53,8 @@ + session :: #session{} | secret_printout(), + session_cache :: db_handle(), + session_cache_cb :: atom(), +- negotiated_version :: ssl_record:ssl_version(), ++ negotiated_version :: ssl_record:ssl_version() | 'undefined', ++ client_hello_version :: ssl_record:ssl_version() | 'undefined', + client_certificate_requested = false :: boolean(), + key_algorithm :: ssl_cipher:key_algo(), + hashsign_algorithm = {undefined, undefined}, Added: head/lang/erlang-runtime17/files/patch-lib_ssl_src_tls__connection.erl ============================================================================== --- /dev/null 00:00:00 1970 (empty, because file is newly added) +++ head/lang/erlang-runtime17/files/patch-lib_ssl_src_tls__connection.erl Sat Dec 16 17:33:32 2017 (r456477) @@ -0,0 +1,10 @@ +--- lib/ssl/src/tls_connection.erl.orig 2015-03-31 12:32:52.000000000 +0000 ++++ lib/ssl/src/tls_connection.erl 2017-12-14 13:22:41.792681000 +0000 +@@ -197,6 +197,7 @@ + ssl_connection:hello({common_client_hello, Type, ServerHelloExt, HashSign}, + State#state{connection_states = ConnectionStates, + negotiated_version = Version, ++ client_hello_version = ClientVersion, + session = Session, + client_ecc = {EllipticCurves, EcPointFormats}}, ?MODULE); + #alert{} = Alert ->