From owner-freebsd-ports-bugs@FreeBSD.ORG Mon Sep 15 08:00:07 2008 Return-Path: Delivered-To: freebsd-ports-bugs@hub.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 516151065683 for ; Mon, 15 Sep 2008 08:00:07 +0000 (UTC) (envelope-from gnats@FreeBSD.org) Received: from freefall.freebsd.org (freefall.freebsd.org [IPv6:2001:4f8:fff6::28]) by mx1.freebsd.org (Postfix) with ESMTP id 273E68FC14 for ; Mon, 15 Sep 2008 08:00:07 +0000 (UTC) (envelope-from gnats@FreeBSD.org) Received: from freefall.freebsd.org (gnats@localhost [127.0.0.1]) by freefall.freebsd.org (8.14.2/8.14.2) with ESMTP id m8F806cB080903 for ; Mon, 15 Sep 2008 08:00:06 GMT (envelope-from gnats@freefall.freebsd.org) Received: (from gnats@localhost) by freefall.freebsd.org (8.14.2/8.14.1/Submit) id m8F806DW080902; Mon, 15 Sep 2008 08:00:06 GMT (envelope-from gnats) Resent-Date: Mon, 15 Sep 2008 08:00:06 GMT Resent-Message-Id: <200809150800.m8F806DW080902@freefall.freebsd.org> Resent-From: FreeBSD-gnats-submit@FreeBSD.org (GNATS Filer) Resent-To: freebsd-ports-bugs@FreeBSD.org Resent-Reply-To: FreeBSD-gnats-submit@FreeBSD.org, Matthias Andree Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 60715106567B for ; Mon, 15 Sep 2008 07:56:44 +0000 (UTC) (envelope-from matthias.andree@gmx.de) Received: from mail.gmx.net (mail.gmx.net [213.165.64.20]) by mx1.freebsd.org (Postfix) with SMTP id A005D8FC29 for ; Mon, 15 Sep 2008 07:56:43 +0000 (UTC) (envelope-from matthias.andree@gmx.de) Received: (qmail invoked by alias); 15 Sep 2008 07:56:41 -0000 Received: from g227120084.adsl.alicedsl.de (EHLO m2a2.dyndns.org) [92.227.120.84] by mail.gmx.net (mp063) with SMTP; 15 Sep 2008 09:56:42 +0200 Received: by merlin.emma.line.org (Postfix, from userid 500) id C8027C812; Mon, 15 Sep 2008 09:56:39 +0200 (CEST) Message-Id: <20080915075639.C8027C812@merlin.emma.line.org> Date: Mon, 15 Sep 2008 09:56:39 +0200 (CEST) From: Matthias Andree To: FreeBSD-gnats-submit@FreeBSD.org X-Send-Pr-Version: 3.113 Cc: Subject: ports/127392: [MAINTAINER] security/openvpn-devel: update to _rc11 X-BeenThere: freebsd-ports-bugs@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Ports bug reports List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 15 Sep 2008 08:00:07 -0000 >Number: 127392 >Category: ports >Synopsis: [MAINTAINER] security/openvpn-devel: update to _rc11 >Confidential: no >Severity: serious >Priority: medium >Responsible: freebsd-ports-bugs >State: open >Quarter: >Keywords: >Date-Required: >Class: maintainer-update >Submitter-Id: current-users >Arrival-Date: Mon Sep 15 08:00:06 UTC 2008 >Closed-Date: >Last-Modified: >Originator: Matthias Andree >Release: FreeBSD 6.3-STABLE i386 >Organization: >Environment: System: FreeBSD merlin.emma.line.org 6.3-STABLE FreeBSD 6.3-STABLE #36: Tue Jul 29 11:16:09 CEST 2008 >Description: Supersedes: ports/127378 Fixes a major bug (not security critical) that was in _rc9 and _rc10. Upstream changelog: OpenVPN Copyright (C) 2002-2008 Telethra, Inc. $Id: ChangeLog 3330 2008-09-15 01:46:29Z james $ 2008.09.14 -- Version 2.1_rc11 * Fixed a bug that can cause SSL/TLS negotiations in UDP mode to fail if UDP packets are dropped. 2008.09.10 -- Version 2.1_rc10 * Added "--server-bridge" (without parameters) to enable DHCP proxy mode: Configure server mode for ethernet bridging using a DHCP-proxy, where clients talk to the OpenVPN server-side DHCP server to receive their IP address allocation and DNS server addresses. * Added "--route-gateway dhcp", to enable the extraction of the gateway address from a DHCP negotiation with the OpenVPN server-side LAN. * Fixed minor issue with --redirect-gateway bypass-dhcp or bypass-dns on Windows. If the bypass IP address is 0.0.0.0 or 255.255.255.255, ignore it. * Warn when ethernet bridging that the IP address of the bridge adapter is probably not the same address that the LAN adapter was set to previously. * When running as a server, warn if the LAN network address is the all-popular 192.168.[0|1].x, since this condition commonly leads to subnet conflicts down the road. * Primarily on the client, check for subnet conflicts between the local LAN and the VPN subnet. * Added a 'netmask' parameter to get_default_gateway, to return the netmask of the adapter containing the default gateway. Only implemented on Windows so far. Other platforms will return 255.255.255.0. Currently the netmask information is only used to warn about subnet conflicts. * Minor fix to cryptoapi.c to not compile itself unless USE_CRYPTO and USE_SSL flags are enabled (Alon Bar-Lev). * Updated openvpn/t_cltsrv.sh (used by "make check") to conform to new --script-security rules. Also adds retrying if the addresses are in use (Matthias Andree). * Fixed build issue with ./configure --disable-socks --disable-http. * Fixed separate compile errors in options.c and ntlm.c that occur on strict C compilers (such as old versions of gcc) that require that C variable declarations occur at the start of a {} block, not in the middle. * Workaround bug in OpenSSL 0.9.6b ASN1_STRING_to_UTF8, which the new implementation of extract_x509_field_ssl depends on. * LZO compression buffer overflow errors will now invalidate the packet rather than trigger a fatal assertion. * Fixed minor compile issue in ntlm.c (mid-block declaration). * Added --allow-pull-fqdn option which allows client to pull DNS names from server (rather than only IP address) for --ifconfig, --route, and --route-gateway. OpenVPN versions 2.1_rc7 and earlier allowed DNS names for these options to be pulled and translated to IP addresses by default. Now --allow-pull-fqdn will be explicitly required on the client to enable DNS-name-to-IP-address translation of pulled options. * 2.1_rc8 and earlier did implicit shell expansion on script arguments since all scripts were called by system(). The security hardening changes made to 2.1_rc9 no longer use system(), but rather use the safer execve or CreateProcess system calls. The security hardening also introduced a backward incompatibility with 2.1_rc8 and earlier in that script parameters were no longer shell-expanded, so for example: client-connect "docc CLIENT-CONNECT" would fail to work because execve would try to execute a script called "docc CLIENT-CONNECT" instead of "docc" with "CLIENT-CONNECT" as the first argument. This patch fixes the issue, bringing the script argument semantics back to pre 2.1_rc9 behavior in order to preserve backward compatibility while still using execve or CreateProcess to execute the script/executable. * Modified ip_or_dns_addr_safe, which validates pulled DNS names, to more closely conform to RFC 3696: (1) DNS name length must not exceed 255 characters (2) DNS name characters must be limited to alphanumeric, dash ('-'), and dot ('.') * Fixed bug in intra-session TLS key rollover that was introduced with deferred authentication features in 2.1_rc8. Added file(s): - files/patch-t_cltsrv-down.sh Removed file(s): - files/patch-update-t_cltsrv Generated with FreeBSD Port Tools 0.77 >How-To-Repeat: >Fix: --- openvpn-devel-2.1.r11.patch begins here --- diff -ruN --exclude=CVS /usr/ports/security/openvpn-devel/Makefile /usr/home/emma/ports/security/openvpn-devel/Makefile --- /usr/ports/security/openvpn-devel/Makefile 2008-08-21 08:18:19.000000000 +0200 +++ /usr/home/emma/ports/security/openvpn-devel/Makefile 2008-09-15 09:50:22.000000000 +0200 @@ -6,7 +6,7 @@ # PORTNAME= openvpn -DISTVERSION= 2.1_rc9 +DISTVERSION= 2.1_rc11 CATEGORIES= security net MASTER_SITES= http://openvpn.net/release/ PKGNAMESUFFIX= -devel diff -ruN --exclude=CVS /usr/ports/security/openvpn-devel/distinfo /usr/home/emma/ports/security/openvpn-devel/distinfo --- /usr/ports/security/openvpn-devel/distinfo 2008-08-10 23:48:26.000000000 +0200 +++ /usr/home/emma/ports/security/openvpn-devel/distinfo 2008-09-15 09:52:05.000000000 +0200 @@ -1,3 +1,3 @@ -MD5 (openvpn-2.1_rc9.tar.gz) = f435e4ad43cf4323e942da570bae4951 -SHA256 (openvpn-2.1_rc9.tar.gz) = f73ec227a5fb7f4c73190e7ae52a59a4db149e8d628f22e8a0a762a58fbb424d -SIZE (openvpn-2.1_rc9.tar.gz) = 818716 +MD5 (openvpn-2.1_rc11.tar.gz) = 424d9305b478ae112a7d2d8bfdd4b7f5 +SHA256 (openvpn-2.1_rc11.tar.gz) = 4d0b4a07f5e7da5d2c707f5c73e8dfde5244baae972d525d0ceb8f0ffa6b56d4 +SIZE (openvpn-2.1_rc11.tar.gz) = 824442 diff -ruN --exclude=CVS /usr/ports/security/openvpn-devel/files/patch-t_cltsrv-down.sh /usr/home/emma/ports/security/openvpn-devel/files/patch-t_cltsrv-down.sh --- /usr/ports/security/openvpn-devel/files/patch-t_cltsrv-down.sh 1970-01-01 01:00:00.000000000 +0100 +++ /usr/home/emma/ports/security/openvpn-devel/files/patch-t_cltsrv-down.sh 2008-09-14 17:10:11.000000000 +0200 @@ -0,0 +1,5 @@ +--- ./t_cltsrv-down.sh.orig 2008-08-07 23:24:40.000000000 +0200 ++++ ./t_cltsrv-down.sh 2008-08-07 23:28:40.000000000 +0200 +@@ -0,0 +1,2 @@ ++#! /bin/sh ++echo "${role}:${signal}" >&3 diff -ruN --exclude=CVS /usr/ports/security/openvpn-devel/files/patch-update-t_cltsrv /usr/home/emma/ports/security/openvpn-devel/files/patch-update-t_cltsrv --- /usr/ports/security/openvpn-devel/files/patch-update-t_cltsrv 2008-08-10 23:52:04.000000000 +0200 +++ /usr/home/emma/ports/security/openvpn-devel/files/patch-update-t_cltsrv 1970-01-01 01:00:00.000000000 +0100 @@ -1,23 +0,0 @@ ---- ./t_cltsrv.sh.orig 2008-08-07 23:14:55.000000000 +0200 -+++ ./t_cltsrv.sh 2008-08-07 23:53:27.000000000 +0200 -@@ -38,11 +38,13 @@ - fi - ;; - esac -+downscript="${srcdir}/t_cltsrv-down.sh" -+test -x $downscript || chmod +x $downscript || { echo >&2 "$downscript is not executable, failing." ; exit 1 ; } - echo "the following test will take about two minutes..." >&2 - set +e - ( --./openvpn --cd "${srcdir}" ${addopts} --down 'echo "srv:${signal}" >&3 ; : #' --tls-exit --ping-exit 180 --config sample-config-files/loopback-server & --./openvpn --cd "${srcdir}" ${addopts} --down 'echo "clt:${signal}" >&3 ; : #' --tls-exit --ping-exit 180 --config sample-config-files/loopback-client -+./openvpn --script-security 2 --cd "${srcdir}" ${addopts} --setenv role srv --down "$downscript" --tls-exit --ping-exit 180 --config sample-config-files/loopback-server & -+./openvpn --script-security 2 --cd "${srcdir}" ${addopts} --setenv role clt --down "$downscript" --tls-exit --ping-exit 180 --config sample-config-files/loopback-client - ) 3>log.$$.signal >log.$$ 2>&1 - e1=$? - wait $! ---- ./t_cltsrv-down.sh.orig 2008-08-07 23:24:40.000000000 +0200 -+++ ./t_cltsrv-down.sh 2008-08-07 23:28:40.000000000 +0200 -@@ -0,0 +1,2 @@ -+#! /bin/sh -+echo "${role}:${signal}" >&3 --- openvpn-devel-2.1.r11.patch ends here --- >Release-Note: >Audit-Trail: >Unformatted: