From: RISCi_ATOM <bob@bobcall.me>
Date: Tue, 20 Mar 2018 19:45:16 +0000 (-0400)
Subject:     mbedtls: update to version 2.7.0
X-Git-Tag: v1.4.3~8
X-Git-Url: https://git.librecmc.org/?a=commitdiff_plain;h=b2c562bd9ca46788dbd65c4a8e6aab08ab0ac41d;p=librecmc%2Flibrecmc.git

mbedtls: update to version 2.7.0

    This fixes the following security problems:
    * CVE-2018-0488: Risk of remote code execution when truncated HMAC is enabled
    * CVE-2018-0487: Risk of remote code execution when verifying RSASSA-PSS signatures

    This release is also ABI incompatible with the previous one, but it is
    API compatible.

    Some functions used by a lot of other software was renamed and the old
    function names are provided as a static inline now, but they are only
    active when deprecated functions are allowed, deactivate the removal of
    deprecated functions for now.

    Also increase the PKG_RELEASE version to force a rebuild and update of
    packages depending on mbedtls to handle the changed ABI.

    Picked from upstream commit : f609913b5c60f7c65c462730993cd1c752083fd6
---

diff --git a/package/libs/mbedtls/Makefile b/package/libs/mbedtls/Makefile
index 0e3383150d..4ffe04cd4d 100644
--- a/package/libs/mbedtls/Makefile
+++ b/package/libs/mbedtls/Makefile
@@ -8,13 +8,13 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=mbedtls
-PKG_VERSION:=2.6.0
+PKG_VERSION:=2.7.0
 PKG_RELEASE:=1
 PKG_USE_MIPS16:=0
 
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION)-gpl.tgz
 PKG_SOURCE_URL:=https://tls.mbed.org/download/
-PKG_HASH:=a99959d7360def22f9108d2d487c9de384fe76c349697176b1f22370080d5810
+PKG_HASH:=2c6fe289b4b50bf67b4839e81b07fcf52a19f5129d0241d2aa4d49cb1ef11e4f
 
 PKG_BUILD_PARALLEL:=1
 PKG_LICENSE:=GPL-2.0+
diff --git a/package/libs/mbedtls/patches/200-config.patch b/package/libs/mbedtls/patches/200-config.patch
index ce32be76a5..55403c9b5b 100644
--- a/package/libs/mbedtls/patches/200-config.patch
+++ b/package/libs/mbedtls/patches/200-config.patch
@@ -1,15 +1,6 @@
 --- a/include/mbedtls/config.h
 +++ b/include/mbedtls/config.h
-@@ -220,7 +220,7 @@
-  *
-  * Uncomment to get errors on using deprecated functions.
-  */
--//#define MBEDTLS_DEPRECATED_REMOVED
-+#define MBEDTLS_DEPRECATED_REMOVED
- 
- /* \} name SECTION: System support */
- 
-@@ -539,17 +539,17 @@
+@@ -566,17 +566,17 @@
   *
   * Comment macros to disable the curve and functions for it
   */
@@ -35,7 +26,7 @@
  #define MBEDTLS_ECP_DP_CURVE25519_ENABLED
  
  /**
-@@ -574,8 +574,8 @@
+@@ -601,8 +601,8 @@
   * Requires: MBEDTLS_HMAC_DRBG_C
   *
   * Comment this macro to disable deterministic ECDSA.
@@ -45,16 +36,16 @@
  
  /**
   * \def MBEDTLS_KEY_EXCHANGE_PSK_ENABLED
-@@ -621,7 +621,7 @@
-  *      MBEDTLS_TLS_DHE_PSK_WITH_3DES_EDE_CBC_SHA
-  *      MBEDTLS_TLS_DHE_PSK_WITH_RC4_128_SHA
+@@ -655,7 +655,7 @@
+  *             See dhm.h for more details.
+  *
   */
 -#define MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED
 +//#define MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED
  
  /**
   * \def MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED
-@@ -640,8 +640,8 @@
+@@ -674,8 +674,8 @@
   *      MBEDTLS_TLS_ECDHE_PSK_WITH_CAMELLIA_128_CBC_SHA256
   *      MBEDTLS_TLS_ECDHE_PSK_WITH_3DES_EDE_CBC_SHA
   *      MBEDTLS_TLS_ECDHE_PSK_WITH_RC4_128_SHA
@@ -64,7 +55,7 @@
  
  /**
   * \def MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED
-@@ -666,7 +666,7 @@
+@@ -700,7 +700,7 @@
   *      MBEDTLS_TLS_RSA_PSK_WITH_3DES_EDE_CBC_SHA
   *      MBEDTLS_TLS_RSA_PSK_WITH_RC4_128_SHA
   */
@@ -73,7 +64,7 @@
  
  /**
   * \def MBEDTLS_KEY_EXCHANGE_RSA_ENABLED
-@@ -793,7 +793,7 @@
+@@ -834,7 +834,7 @@
   *      MBEDTLS_TLS_ECDH_ECDSA_WITH_CAMELLIA_128_GCM_SHA256
   *      MBEDTLS_TLS_ECDH_ECDSA_WITH_CAMELLIA_256_GCM_SHA384
   */
@@ -82,7 +73,7 @@
  
  /**
   * \def MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED
-@@ -817,7 +817,7 @@
+@@ -858,7 +858,7 @@
   *      MBEDTLS_TLS_ECDH_RSA_WITH_CAMELLIA_128_GCM_SHA256
   *      MBEDTLS_TLS_ECDH_RSA_WITH_CAMELLIA_256_GCM_SHA384
   */
@@ -91,7 +82,7 @@
  
  /**
   * \def MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED
-@@ -921,7 +921,7 @@
+@@ -962,7 +962,7 @@
   * This option is only useful if both MBEDTLS_SHA256_C and
   * MBEDTLS_SHA512_C are defined. Otherwise the available hash module is used.
   */
@@ -100,7 +91,7 @@
  
  /**
   * \def MBEDTLS_ENTROPY_NV_SEED
-@@ -1015,14 +1015,14 @@
+@@ -1056,14 +1056,14 @@
   * Uncomment this macro to disable the use of CRT in RSA.
   *
   */
@@ -117,7 +108,7 @@
  
  /**
   * \def MBEDTLS_SHA256_SMALLER
-@@ -1038,7 +1038,7 @@
+@@ -1079,7 +1079,7 @@
   *
   * Uncomment to enable the smaller implementation of SHA256.
   */
@@ -126,17 +117,16 @@
  
  /**
   * \def MBEDTLS_SSL_ALL_ALERT_MESSAGES
-@@ -1157,8 +1157,8 @@
-  * misuse/misunderstand.
+@@ -1206,7 +1206,7 @@
+  *          configuration of this extension).
   *
-  * Comment this to disable support for renegotiation.
-- */
- #define MBEDTLS_SSL_RENEGOTIATION
-+ */
+  */
+-#define MBEDTLS_SSL_RENEGOTIATION
++//#define MBEDTLS_SSL_RENEGOTIATION
  
  /**
   * \def MBEDTLS_SSL_SRV_SUPPORT_SSLV2_CLIENT_HELLO
-@@ -1332,8 +1332,8 @@
+@@ -1380,8 +1380,8 @@
   * callbacks are provided by MBEDTLS_SSL_TICKET_C.
   *
   * Comment this macro to disable support for SSL session tickets
@@ -146,7 +136,7 @@
  
  /**
   * \def MBEDTLS_SSL_EXPORT_KEYS
-@@ -1363,7 +1363,7 @@
+@@ -1411,7 +1411,7 @@
   *
   * Comment this macro to disable support for truncated HMAC in SSL
   */
@@ -155,7 +145,7 @@
  
  /**
   * \def MBEDTLS_THREADING_ALT
-@@ -1397,8 +1397,8 @@
+@@ -1445,8 +1445,8 @@
   * Requires: MBEDTLS_VERSION_C
   *
   * Comment this to disable run-time checking and save ROM space
@@ -165,7 +155,7 @@
  
  /**
   * \def MBEDTLS_X509_ALLOW_EXTENSIONS_NON_V3
-@@ -1719,7 +1719,7 @@
+@@ -1773,7 +1773,7 @@
   *      MBEDTLS_TLS_PSK_WITH_CAMELLIA_128_GCM_SHA256
   *      MBEDTLS_TLS_PSK_WITH_CAMELLIA_128_CBC_SHA256
   */
@@ -174,7 +164,7 @@
  
  /**
   * \def MBEDTLS_CCM_C
-@@ -1733,7 +1733,7 @@
+@@ -1787,7 +1787,7 @@
   * This module enables the AES-CCM ciphersuites, if other requisites are
   * enabled as well.
   */
@@ -183,7 +173,7 @@
  
  /**
   * \def MBEDTLS_CERTS_C
-@@ -1745,7 +1745,7 @@
+@@ -1799,7 +1799,7 @@
   *
   * This module is used for testing (ssl_client/server).
   */
@@ -192,7 +182,7 @@
  
  /**
   * \def MBEDTLS_CIPHER_C
-@@ -1798,7 +1798,7 @@
+@@ -1852,7 +1852,7 @@
   *
   * This module provides debugging functions.
   */
@@ -201,17 +191,16 @@
  
  /**
   * \def MBEDTLS_DES_C
-@@ -1823,8 +1823,8 @@
-  *      MBEDTLS_TLS_PSK_WITH_3DES_EDE_CBC_SHA
-  *
-  * PEM_PARSE uses DES/3DES for decrypting encrypted keys.
-- */
- #define MBEDTLS_DES_C
-+ */
+@@ -1881,7 +1881,7 @@
+  * \warning   DES is considered a weak cipher and its use constitutes a
+  *            security risk. We recommend considering stronger ciphers instead.
+  */
+-#define MBEDTLS_DES_C
++//#define MBEDTLS_DES_C
  
  /**
   * \def MBEDTLS_DHM_C
-@@ -1978,8 +1978,8 @@
+@@ -2042,8 +2042,8 @@
   * Requires: MBEDTLS_MD_C
   *
   * Uncomment to enable the HMAC_DRBG random number geerator.
@@ -221,7 +210,7 @@
  
  /**
   * \def MBEDTLS_MD_C
-@@ -2256,7 +2256,7 @@
+@@ -2337,7 +2337,7 @@
   * Caller:  library/md.c
   *
   */
@@ -230,7 +219,7 @@
  
  /**
   * \def MBEDTLS_RSA_C
-@@ -2334,8 +2334,8 @@
+@@ -2421,8 +2421,8 @@
   * Caller:
   *
   * Requires: MBEDTLS_SSL_CACHE_C
@@ -240,7 +229,7 @@
  
  /**
   * \def MBEDTLS_SSL_COOKIE_C
-@@ -2356,8 +2356,8 @@
+@@ -2443,8 +2443,8 @@
   * Caller:
   *
   * Requires: MBEDTLS_CIPHER_C
@@ -250,7 +239,7 @@
  
  /**
   * \def MBEDTLS_SSL_CLI_C
-@@ -2456,8 +2456,8 @@
+@@ -2543,8 +2543,8 @@
   * Module:  library/version.c
   *
   * This module provides run-time version information.
@@ -260,7 +249,7 @@
  
  /**
   * \def MBEDTLS_X509_USE_C
-@@ -2567,7 +2567,7 @@
+@@ -2654,7 +2654,7 @@
   * Module:  library/xtea.c
   * Caller:
   */
diff --git a/package/libs/ustream-ssl/Makefile b/package/libs/ustream-ssl/Makefile
index ff6c4b7d01..b9b9e19dfb 100644
--- a/package/libs/ustream-ssl/Makefile
+++ b/package/libs/ustream-ssl/Makefile
@@ -1,7 +1,7 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=ustream-ssl
-PKG_RELEASE:=2
+PKG_RELEASE:=3
 
 PKG_SOURCE_PROTO:=git
 PKG_SOURCE_URL=$(LEDE_GIT)/project/ustream-ssl.git
diff --git a/package/network/services/openvpn/Makefile b/package/network/services/openvpn/Makefile
index fee0296ed4..7e0677baa3 100644
--- a/package/network/services/openvpn/Makefile
+++ b/package/network/services/openvpn/Makefile
@@ -10,7 +10,7 @@ include $(TOPDIR)/rules.mk
 PKG_NAME:=openvpn
 
 PKG_VERSION:=2.4.4
-PKG_RELEASE:=2
+PKG_RELEASE:=3
 
 PKG_SOURCE_URL:=\
 	https://build.openvpn.net/downloads/releases/ \
diff --git a/package/network/utils/curl/Makefile b/package/network/utils/curl/Makefile
index 5d829547aa..07056a2cd0 100644
--- a/package/network/utils/curl/Makefile
+++ b/package/network/utils/curl/Makefile
@@ -9,7 +9,7 @@ include $(TOPDIR)/rules.mk
 
 PKG_NAME:=curl
 PKG_VERSION:=7.52.1
-PKG_RELEASE:=6
+PKG_RELEASE:=8
 
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.bz2
 PKG_SOURCE_URL:=http://curl.haxx.se/download/ \
diff --git a/package/network/utils/curl/patches/320-mbedtls-nonblocking-handshake.patch b/package/network/utils/curl/patches/320-mbedtls-nonblocking-handshake.patch
new file mode 100644
index 0000000000..33ab296e56
--- /dev/null
+++ b/package/network/utils/curl/patches/320-mbedtls-nonblocking-handshake.patch
@@ -0,0 +1,27 @@
+From b993d2cca536870ecdf3b4611de9f77215af8eb8 Mon Sep 17 00:00:00 2001
+From: Antoine Aubert <a.aubert@overkiz.com>
+Date: Fri, 20 Jan 2017 08:10:28 +0100
+Subject: [PATCH] vtls: fix mbedtls multi non blocking handshake.
+
+When using multi, mbedtls handshake is in non blocking mode.
+vtls must set wait for read/write flags for the socket.
+---
+ lib/vtls/vtls.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/lib/vtls/vtls.c b/lib/vtls/vtls.c
+index fad9335bbf..871622fef1 100644
+--- a/lib/vtls/vtls.c
++++ b/lib/vtls/vtls.c
+@@ -485,8 +485,9 @@ void Curl_ssl_close_all(struct Curl_easy *data)
+ }
+ 
+ #if defined(USE_OPENSSL) || defined(USE_GNUTLS) || defined(USE_SCHANNEL) || \
+-    defined(USE_DARWINSSL) || defined(USE_NSS)
+-/* This function is for OpenSSL, GnuTLS, darwinssl, and schannel only. */
++    defined(USE_DARWINSSL) || defined(USE_NSS) || defined(USE_MBEDTLS)
++/* This function is for OpenSSL, GnuTLS, darwinssl, mbedtls, and schannel
++   only. */
+ int Curl_ssl_getsock(struct connectdata *conn, curl_socket_t *socks,
+                      int numsocks)
+ {
diff --git a/package/utils/px5g/Makefile b/package/utils/px5g/Makefile
index 6fd73e3a48..4ea495867c 100644
--- a/package/utils/px5g/Makefile
+++ b/package/utils/px5g/Makefile
@@ -8,7 +8,7 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=px5g
-PKG_RELEASE:=4
+PKG_RELEASE:=5
 PKG_LICENSE:=LGPL-2.1
 PKG_BUILD_DIR:=$(BUILD_DIR)/px5g-$(BUILD_VARIANT)
 
@@ -47,7 +47,7 @@ define Build/Prepare
 	mkdir -p $(PKG_BUILD_DIR)
 endef
 
-TARGET_LDFLAGS := -lmbedtls -lmbedx509 -lmbedcrypto
+TARGET_LDFLAGS += -lmbedtls -lmbedx509 -lmbedcrypto
 
 ifeq ($(BUILD_VARIANT),standalone)
   TARGET_LDFLAGS := -Wl,-Bstatic $(TARGET_LDFLAGS) -Wl,-Bdynamic
@@ -56,7 +56,7 @@ endif
 TARGET_CFLAGS += -Wl,--gc-sections
 
 define Build/Compile
-	$(TARGET_CC) $(TARGET_CFLAGS) -o $(PKG_BUILD_DIR)/px5g px5g.c $(TARGET_LDFLAGS)
+	$(TARGET_CC) $(TARGET_CPPFLAGS) $(TARGET_CFLAGS) -o $(PKG_BUILD_DIR)/px5g px5g.c $(TARGET_LDFLAGS)
 endef
 
 define Package/px5g-mbedtls/install