From f609913b5c60f7c65c462730993cd1c752083fd6 Mon Sep 17 00:00:00 2001 From: Hauke Mehrtens Date: Sun, 4 Mar 2018 20:38:00 +0100 Subject: [PATCH] mbedtls: update to version 2.7.0 This fixes the following security problems: * CVE-2018-0488: Risk of remote code execution when truncated HMAC is enabled * CVE-2018-0487: Risk of remote code execution when verifying RSASSA-PSS signatures This release is also ABI incompatible with the previous one, but it is API compatible. Some functions used by a lot of other software was renamed and the old function names are provided as a static inline now, but they are only active when deprecated functions are allowed, deactivate the removal of deprecated functions for now. Also increase the PKG_RELEASE version to force a rebuild and update of packages depending on mbedtls to handle the changed ABI. Signed-off-by: Hauke Mehrtens --- package/libs/mbedtls/Makefile | 4 +- package/libs/mbedtls/patches/200-config.patch | 83 ++++++++----------- package/libs/ustream-ssl/Makefile | 2 +- package/network/services/openvpn/Makefile | 2 +- package/network/utils/curl/Makefile | 2 +- package/utils/px5g/Makefile | 2 +- 6 files changed, 42 insertions(+), 53 deletions(-) diff --git a/package/libs/mbedtls/Makefile b/package/libs/mbedtls/Makefile index 0e3383150d..4ffe04cd4d 100644 --- a/package/libs/mbedtls/Makefile +++ b/package/libs/mbedtls/Makefile @@ -8,13 +8,13 @@ include $(TOPDIR)/rules.mk PKG_NAME:=mbedtls -PKG_VERSION:=2.6.0 +PKG_VERSION:=2.7.0 PKG_RELEASE:=1 PKG_USE_MIPS16:=0 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION)-gpl.tgz PKG_SOURCE_URL:=https://tls.mbed.org/download/ -PKG_HASH:=a99959d7360def22f9108d2d487c9de384fe76c349697176b1f22370080d5810 +PKG_HASH:=2c6fe289b4b50bf67b4839e81b07fcf52a19f5129d0241d2aa4d49cb1ef11e4f PKG_BUILD_PARALLEL:=1 PKG_LICENSE:=GPL-2.0+ diff --git a/package/libs/mbedtls/patches/200-config.patch b/package/libs/mbedtls/patches/200-config.patch index ce32be76a5..55403c9b5b 100644 --- a/package/libs/mbedtls/patches/200-config.patch +++ b/package/libs/mbedtls/patches/200-config.patch @@ -1,15 +1,6 @@ --- a/include/mbedtls/config.h +++ b/include/mbedtls/config.h -@@ -220,7 +220,7 @@ - * - * Uncomment to get errors on using deprecated functions. - */ --//#define MBEDTLS_DEPRECATED_REMOVED -+#define MBEDTLS_DEPRECATED_REMOVED - - /* \} name SECTION: System support */ - -@@ -539,17 +539,17 @@ +@@ -566,17 +566,17 @@ * * Comment macros to disable the curve and functions for it */ @@ -35,7 +26,7 @@ #define MBEDTLS_ECP_DP_CURVE25519_ENABLED /** -@@ -574,8 +574,8 @@ +@@ -601,8 +601,8 @@ * Requires: MBEDTLS_HMAC_DRBG_C * * Comment this macro to disable deterministic ECDSA. @@ -45,16 +36,16 @@ /** * \def MBEDTLS_KEY_EXCHANGE_PSK_ENABLED -@@ -621,7 +621,7 @@ - * MBEDTLS_TLS_DHE_PSK_WITH_3DES_EDE_CBC_SHA - * MBEDTLS_TLS_DHE_PSK_WITH_RC4_128_SHA +@@ -655,7 +655,7 @@ + * See dhm.h for more details. + * */ -#define MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED +//#define MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED /** * \def MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED -@@ -640,8 +640,8 @@ +@@ -674,8 +674,8 @@ * MBEDTLS_TLS_ECDHE_PSK_WITH_CAMELLIA_128_CBC_SHA256 * MBEDTLS_TLS_ECDHE_PSK_WITH_3DES_EDE_CBC_SHA * MBEDTLS_TLS_ECDHE_PSK_WITH_RC4_128_SHA @@ -64,7 +55,7 @@ /** * \def MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED -@@ -666,7 +666,7 @@ +@@ -700,7 +700,7 @@ * MBEDTLS_TLS_RSA_PSK_WITH_3DES_EDE_CBC_SHA * MBEDTLS_TLS_RSA_PSK_WITH_RC4_128_SHA */ @@ -73,7 +64,7 @@ /** * \def MBEDTLS_KEY_EXCHANGE_RSA_ENABLED -@@ -793,7 +793,7 @@ +@@ -834,7 +834,7 @@ * MBEDTLS_TLS_ECDH_ECDSA_WITH_CAMELLIA_128_GCM_SHA256 * MBEDTLS_TLS_ECDH_ECDSA_WITH_CAMELLIA_256_GCM_SHA384 */ @@ -82,7 +73,7 @@ /** * \def MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED -@@ -817,7 +817,7 @@ +@@ -858,7 +858,7 @@ * MBEDTLS_TLS_ECDH_RSA_WITH_CAMELLIA_128_GCM_SHA256 * MBEDTLS_TLS_ECDH_RSA_WITH_CAMELLIA_256_GCM_SHA384 */ @@ -91,7 +82,7 @@ /** * \def MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED -@@ -921,7 +921,7 @@ +@@ -962,7 +962,7 @@ * This option is only useful if both MBEDTLS_SHA256_C and * MBEDTLS_SHA512_C are defined. Otherwise the available hash module is used. */ @@ -100,7 +91,7 @@ /** * \def MBEDTLS_ENTROPY_NV_SEED -@@ -1015,14 +1015,14 @@ +@@ -1056,14 +1056,14 @@ * Uncomment this macro to disable the use of CRT in RSA. * */ @@ -117,7 +108,7 @@ /** * \def MBEDTLS_SHA256_SMALLER -@@ -1038,7 +1038,7 @@ +@@ -1079,7 +1079,7 @@ * * Uncomment to enable the smaller implementation of SHA256. */ @@ -126,17 +117,16 @@ /** * \def MBEDTLS_SSL_ALL_ALERT_MESSAGES -@@ -1157,8 +1157,8 @@ - * misuse/misunderstand. +@@ -1206,7 +1206,7 @@ + * configuration of this extension). * - * Comment this to disable support for renegotiation. -- */ - #define MBEDTLS_SSL_RENEGOTIATION -+ */ + */ +-#define MBEDTLS_SSL_RENEGOTIATION ++//#define MBEDTLS_SSL_RENEGOTIATION /** * \def MBEDTLS_SSL_SRV_SUPPORT_SSLV2_CLIENT_HELLO -@@ -1332,8 +1332,8 @@ +@@ -1380,8 +1380,8 @@ * callbacks are provided by MBEDTLS_SSL_TICKET_C. * * Comment this macro to disable support for SSL session tickets @@ -146,7 +136,7 @@ /** * \def MBEDTLS_SSL_EXPORT_KEYS -@@ -1363,7 +1363,7 @@ +@@ -1411,7 +1411,7 @@ * * Comment this macro to disable support for truncated HMAC in SSL */ @@ -155,7 +145,7 @@ /** * \def MBEDTLS_THREADING_ALT -@@ -1397,8 +1397,8 @@ +@@ -1445,8 +1445,8 @@ * Requires: MBEDTLS_VERSION_C * * Comment this to disable run-time checking and save ROM space @@ -165,7 +155,7 @@ /** * \def MBEDTLS_X509_ALLOW_EXTENSIONS_NON_V3 -@@ -1719,7 +1719,7 @@ +@@ -1773,7 +1773,7 @@ * MBEDTLS_TLS_PSK_WITH_CAMELLIA_128_GCM_SHA256 * MBEDTLS_TLS_PSK_WITH_CAMELLIA_128_CBC_SHA256 */ @@ -174,7 +164,7 @@ /** * \def MBEDTLS_CCM_C -@@ -1733,7 +1733,7 @@ +@@ -1787,7 +1787,7 @@ * This module enables the AES-CCM ciphersuites, if other requisites are * enabled as well. */ @@ -183,7 +173,7 @@ /** * \def MBEDTLS_CERTS_C -@@ -1745,7 +1745,7 @@ +@@ -1799,7 +1799,7 @@ * * This module is used for testing (ssl_client/server). */ @@ -192,7 +182,7 @@ /** * \def MBEDTLS_CIPHER_C -@@ -1798,7 +1798,7 @@ +@@ -1852,7 +1852,7 @@ * * This module provides debugging functions. */ @@ -201,17 +191,16 @@ /** * \def MBEDTLS_DES_C -@@ -1823,8 +1823,8 @@ - * MBEDTLS_TLS_PSK_WITH_3DES_EDE_CBC_SHA - * - * PEM_PARSE uses DES/3DES for decrypting encrypted keys. -- */ - #define MBEDTLS_DES_C -+ */ +@@ -1881,7 +1881,7 @@ + * \warning DES is considered a weak cipher and its use constitutes a + * security risk. We recommend considering stronger ciphers instead. + */ +-#define MBEDTLS_DES_C ++//#define MBEDTLS_DES_C /** * \def MBEDTLS_DHM_C -@@ -1978,8 +1978,8 @@ +@@ -2042,8 +2042,8 @@ * Requires: MBEDTLS_MD_C * * Uncomment to enable the HMAC_DRBG random number geerator. @@ -221,7 +210,7 @@ /** * \def MBEDTLS_MD_C -@@ -2256,7 +2256,7 @@ +@@ -2337,7 +2337,7 @@ * Caller: library/md.c * */ @@ -230,7 +219,7 @@ /** * \def MBEDTLS_RSA_C -@@ -2334,8 +2334,8 @@ +@@ -2421,8 +2421,8 @@ * Caller: * * Requires: MBEDTLS_SSL_CACHE_C @@ -240,7 +229,7 @@ /** * \def MBEDTLS_SSL_COOKIE_C -@@ -2356,8 +2356,8 @@ +@@ -2443,8 +2443,8 @@ * Caller: * * Requires: MBEDTLS_CIPHER_C @@ -250,7 +239,7 @@ /** * \def MBEDTLS_SSL_CLI_C -@@ -2456,8 +2456,8 @@ +@@ -2543,8 +2543,8 @@ * Module: library/version.c * * This module provides run-time version information. @@ -260,7 +249,7 @@ /** * \def MBEDTLS_X509_USE_C -@@ -2567,7 +2567,7 @@ +@@ -2654,7 +2654,7 @@ * Module: library/xtea.c * Caller: */ diff --git a/package/libs/ustream-ssl/Makefile b/package/libs/ustream-ssl/Makefile index ff6c4b7d01..b9b9e19dfb 100644 --- a/package/libs/ustream-ssl/Makefile +++ b/package/libs/ustream-ssl/Makefile @@ -1,7 +1,7 @@ include $(TOPDIR)/rules.mk PKG_NAME:=ustream-ssl -PKG_RELEASE:=2 +PKG_RELEASE:=3 PKG_SOURCE_PROTO:=git PKG_SOURCE_URL=$(LEDE_GIT)/project/ustream-ssl.git diff --git a/package/network/services/openvpn/Makefile b/package/network/services/openvpn/Makefile index fee0296ed4..7e0677baa3 100644 --- a/package/network/services/openvpn/Makefile +++ b/package/network/services/openvpn/Makefile @@ -10,7 +10,7 @@ include $(TOPDIR)/rules.mk PKG_NAME:=openvpn PKG_VERSION:=2.4.4 -PKG_RELEASE:=2 +PKG_RELEASE:=3 PKG_SOURCE_URL:=\ https://build.openvpn.net/downloads/releases/ \ diff --git a/package/network/utils/curl/Makefile b/package/network/utils/curl/Makefile index 56bf503c64..07056a2cd0 100644 --- a/package/network/utils/curl/Makefile +++ b/package/network/utils/curl/Makefile @@ -9,7 +9,7 @@ include $(TOPDIR)/rules.mk PKG_NAME:=curl PKG_VERSION:=7.52.1 -PKG_RELEASE:=7 +PKG_RELEASE:=8 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.bz2 PKG_SOURCE_URL:=http://curl.haxx.se/download/ \ diff --git a/package/utils/px5g/Makefile b/package/utils/px5g/Makefile index 8d1f04d60f..4ea495867c 100644 --- a/package/utils/px5g/Makefile +++ b/package/utils/px5g/Makefile @@ -8,7 +8,7 @@ include $(TOPDIR)/rules.mk PKG_NAME:=px5g -PKG_RELEASE:=4 +PKG_RELEASE:=5 PKG_LICENSE:=LGPL-2.1 PKG_BUILD_DIR:=$(BUILD_DIR)/px5g-$(BUILD_VARIANT) -- 2.25.1