Received: from mail.netbsd.org (mail.netbsd.org [199.233.217.200]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client CN "mail.netbsd.org", Issuer "Postmaster NetBSD.org" (verified OK)) by mollari.NetBSD.org (Postfix) with ESMTPS id 44D537A475 for ; Fri, 8 Jul 2016 08:49:43 +0000 (UTC) Received: by mail.netbsd.org (Postfix, from userid 605) id DCC0285EC6; Fri, 8 Jul 2016 08:49:42 +0000 (UTC) Received: from localhost (localhost [127.0.0.1]) by mail.netbsd.org (Postfix) with ESMTP id 6EA0885E78 for ; Fri, 8 Jul 2016 08:49:42 +0000 (UTC) X-Virus-Scanned: amavisd-new at netbsd.org Received: from mail.netbsd.org ([IPv6:::1]) by localhost (mail.netbsd.org [IPv6:::1]) (amavisd-new, port 10025) with ESMTP id qGAKdDm0zRnX for ; Fri, 8 Jul 2016 08:49:41 +0000 (UTC) Received: from cvs.NetBSD.org (ivanova.netbsd.org [199.233.217.197]) by mail.netbsd.org (Postfix) with ESMTP id 516C284CF0 for ; Fri, 8 Jul 2016 08:49:41 +0000 (UTC) Received: by cvs.NetBSD.org (Postfix, from userid 500) id 4C414FBB5; Fri, 8 Jul 2016 08:49:41 +0000 (UTC) Content-Transfer-Encoding: 7bit Content-Type: multipart/mixed; boundary="_----------=_1467967781142770" MIME-Version: 1.0 Date: Fri, 8 Jul 2016 08:49:41 +0000 From: "Jonathan Perkin" Subject: CVS commit: pkgsrc/net/openvpn To: pkgsrc-changes@NetBSD.org Reply-To: jperkin@netbsd.org X-Mailer: log_accum Message-Id: <20160708084941.4C414FBB5@cvs.NetBSD.org> Sender: pkgsrc-changes-owner@NetBSD.org List-Id: pkgsrc-changes.NetBSD.org Precedence: bulk This is a multi-part message in MIME format. --_----------=_1467967781142770 Content-Disposition: inline Content-Transfer-Encoding: 8bit Content-Type: text/plain; charset="US-ASCII" Module Name: pkgsrc Committed By: jperkin Date: Fri Jul 8 08:49:41 UTC 2016 Modified Files: pkgsrc/net/openvpn: Makefile Makefile.common distinfo pkgsrc/net/openvpn/patches: patch-ac patch-ad patch-ae patch-af Log Message: Update net/openvpn to 2.3.11. Changes since 2.3.6: 2016.05.09 -- Version 2.3.11 Fixed port-share bug with DoS potential Make intent of utun device name validation clear Fix buffer overflow by user supplied data Correctly report TCP connection timeout on windows. Report Windows bitness Fix undefined signed shift overflow Fix build with libressl Improve LZO, PAM and OpenSSL documentation Ensure input read using systemd-ask-password is null terminated Support reading the challenge-response from console openssl: improve logging polarssl: improve logging Update manpage: OpenSSL might also need /dev/urandom inside chroot socks.c: fix check on get_user_pass() return value(s) Fix OCSP_check.sh hardening: add safe FD_SET() wrapper openvpn_fd_set() Fix memory leak in argv_extract_cmd_name() Replace MSG_TEST() macro for static inline msg_test() Restrict default TLS cipher list Various Changes.rst fixes Clarify mssfix documentation Clarify --block-outside-dns documentation Update --block-outside-dns to work on Windows Vista 2016.01.04 -- Version 2.3.10 Prepare for v2.3.10 release, list PolarSSL 1.2 to 1.3 upgrade Make certificate expiry warning patch (091edd8e299686) work on OpenSSL 1.0.1 and earlier. Repair IPv6 netsh calls if Win XP is detected Use bob.example.com and alice.example.com to improve clarity of documentation Remove unused variables from ssl_verify_polarssl.c's x509_get_serial() Upgrade OpenVPN 2.3 to PolarSSL 1.3 Warn user if their certificate has expired Make assert_failed() print the failed condition cleanup: get rid of httpdigest.c type warnings Fix regression in setups without a client certificate polarssl: fix unreachable code 2015.12.15 -- Version 2.3.9 Show extra-certs in current parameters. Fix commit a3160fc1bd7368395745b9cee6e40fb819f5564c Do not set the buffer size by default but rely on the operation system default. Remove --enable-password-save option Reflect enable-password-save change in documentation Also remove second instance of enable-password-save in the man page Detect config lines that are too long and give a warning/error Log serial number of revoked certificate Adjust server-ipv6 documentation Avoid partial authentication state when using --disabled in CCD configs Make "block-outside-dns" option platform agnostic Un-break --auth-user-pass on windows Replace unaligned 16bit access to TCP MSS value with bytewise access Repair test_local_addr() on WIN32 Fix possible heap overflow on read accessing getaddrinfo() result. Fix FreeBSD-specific mishandling of gc arena pointer in create_arbitrary_remote() remove unused gc_arena in FreeBSD close_tun() Fix isatty() check for good. put virtual IPv6 addresses into env Use adapter index instead of name for windows IPv6 interface config Client-side part for server restart notification Use adapter index for add/delete_route_ipv6 Pass adapter index to up/down scripts Fix VS2013 compilation Fix privilege drop if first connection attempt fails Support for username-only auth file. Add CONTRIBUTING.rst Updates to Changes.rst Fix termination when windows suspends/sleeps Do not hard-code windows systemroot in env_block Handle ctrl-C and ctrl-break events on Windows Unbreak read username password from management Replace strdup() calls for string_alloc() calls Check return value of ms_error_text() Increase control channel packet size for faster handshakes hardening: add insurance to exit on a failed ASSERT() Fix memory leak in auth-pam plugin Fix (potential) memory leak in init_route_list() Fix unintialized variable in plugin_vlog() Add macro to ensure we exit on fatal errors Fix memory leak in add_option() by simplifying get_ipv6_addr openssl: properly check return value of RAND_bytes() Fix rand_bytes return value checking Add Windows DNS Leak fix using WFP ('block-outside-dns') Fix "White space before end tags can break the config parser" 2015.08.03 -- Version 2.3.8 Report missing endtags of inline files as warnings Fix commit e473b7c if an inline file happens to have a line break exactly at buffer limit Produce a meaningful error message if --daemon gets in the way of asking for passwords. Document --daemon changes and consequences (--askpass, --auth-nocache). Del ipv6 addr on close of linux tun interface Fix --askpass not allowing for password input via stdin write pid file immediately after daemonizing Make __func__ work with Visual Studio too fix regression: query password before becoming daemon Fix using management interface to get passwords. Fix overflow check in openvpn_decrypt() 2015.06.02 -- Version 2.3.7 Default gateway can't be determined on illumos/Solaris platforms Warn that tls-auth with free form files is going to be removed from OpenVPN 2.4 autotools: Fix wrong ./configure help screen default values down-root plugin: Replaced system() calls with execve() down-root: Improve error messages plugin, down-root: Fix compiler warnings sockets: Remove the limitation of --tcp-nodelay to be server-only plugins, down-root: Code style clean-up pkcs11: Load p11-kit-proxy.so module by default Make 'provider' option to --show-pkcs11-ids optional where p11-kit is present Use OPENVPN_ETH_P_* so that is unecessary New approach to handle peer-id related changes to link-mtu (2.3 version) Fix incorrect use of get_ipv6_addr() for iroute options. Print helpful error message on --mktun/--rmtun if not available. explain effect of --topology subnet on --ifconfig Add note about file permissions and --crl-verify to manpage. repair --dev null breakage caused by db950be85d37 assume res_init() is always there. Correct note about DNS randomization in openvpn.8 Disallow usage of --server-poll-timeout in --secret key mode. slightly enhance documentation about --cipher Enforce "serial-tests" behaviour for tests/Makefile Revert "Enforce "serial-tests" behaviour for tests/Makefile" On signal reception, return EAI_SYSTEM from openvpn_getaddrinfo(). Use configure.ac hack to apply serial_test AM option only if supported. Use EAI_AGAIN instead of EAI_SYSTEM for openvpn_getaddrinfo(). Move res_init() call to inner openvpn_getaddrinfo() loop Fix FreeBSD ifconfig for topology subnet tunnels. Fix --redirect-private in --dev tap mode. include ifconfig_ environment variables in --up-restart env set Fix null pointer dereference in options.c Fix mssfix default value in connection_list context Manual page update for Re-enabled TLS version negotiation. Include systemd units in the source tarball (make dist) Updated manpage for --rport and --lport Properly escape dashes on the man-page Improve documentation in --script-security section of the man-page Really fix '--cipher none' regression Update doxygen (a bit) Set tls-version-max to 1.1 if cryptoapicert is used Account for peer-id in frame size calculation Disable SSL compression Fix frame size calculation for non-CBC modes. Allow for CN/username of 64 characters (fixes off-by-one) Remove unneeded parameter 'first_time' from possibly_become_daemon() Re-enable TLS version negotiation by default Remove size limit for files inlined in config Improve --tls-cipher and --show-tls man page description Re-read auth-user-pass file on (re)connect if required Clarify --capath option in manpage Call daemon() before initializing crypto library To generate a diff of this commit: cvs rdiff -u -r1.58 -r1.59 pkgsrc/net/openvpn/Makefile cvs rdiff -u -r1.4 -r1.5 pkgsrc/net/openvpn/Makefile.common cvs rdiff -u -r1.32 -r1.33 pkgsrc/net/openvpn/distinfo cvs rdiff -u -r1.10 -r1.11 pkgsrc/net/openvpn/patches/patch-ac cvs rdiff -u -r1.5 -r1.6 pkgsrc/net/openvpn/patches/patch-ad cvs rdiff -u -r1.7 -r1.8 pkgsrc/net/openvpn/patches/patch-ae cvs rdiff -u -r1.8 -r1.9 pkgsrc/net/openvpn/patches/patch-af Please note that diffs are not public domain; they are subject to the copyright notices on the relevant files. --_----------=_1467967781142770 Content-Disposition: inline Content-Length: 5757 Content-Transfer-Encoding: binary Content-Type: text/x-diff; charset=us-ascii Modified files: Index: pkgsrc/net/openvpn/Makefile diff -u pkgsrc/net/openvpn/Makefile:1.58 pkgsrc/net/openvpn/Makefile:1.59 --- pkgsrc/net/openvpn/Makefile:1.58 Sat Mar 5 11:29:09 2016 +++ pkgsrc/net/openvpn/Makefile Fri Jul 8 08:49:41 2016 @@ -1,7 +1,6 @@ -# $NetBSD: Makefile,v 1.58 2016/03/05 11:29:09 jperkin Exp $ +# $NetBSD: Makefile,v 1.59 2016/07/08 08:49:41 jperkin Exp $ DISTNAME= ${OPENVPN_DISTNAME} -PKGREVISION= 3 CATEGORIES= net MASTER_SITES= ${OPENVPN_MASTER_SITES} EXTRACT_SUFX= .tar.xz Index: pkgsrc/net/openvpn/Makefile.common diff -u pkgsrc/net/openvpn/Makefile.common:1.4 pkgsrc/net/openvpn/Makefile.common:1.5 --- pkgsrc/net/openvpn/Makefile.common:1.4 Wed Dec 3 10:09:01 2014 +++ pkgsrc/net/openvpn/Makefile.common Fri Jul 8 08:49:41 2016 @@ -1,10 +1,10 @@ -# $NetBSD: Makefile.common,v 1.4 2014/12/03 10:09:01 wiz Exp $ +# $NetBSD: Makefile.common,v 1.5 2016/07/08 08:49:41 jperkin Exp $ # used by net/openvpn/Makefile # used by net/openvpn-acct-wtmpx/Makefile # used by net/openvpn-nagios/Makefile -OPENVPN_DISTNAME= openvpn-2.3.6 +OPENVPN_DISTNAME= openvpn-2.3.11 OPENVPN_DISTFILE= ${OPENVPN_DISTNAME}.tar.xz OPENVPN_MASTER_SITES= http://swupdate.openvpn.net/community/releases/ SITES.${OPENVPN_DISTFILE}= ${OPENVPN_MASTER_SITES} Index: pkgsrc/net/openvpn/distinfo diff -u pkgsrc/net/openvpn/distinfo:1.32 pkgsrc/net/openvpn/distinfo:1.33 --- pkgsrc/net/openvpn/distinfo:1.32 Wed Nov 4 00:35:18 2015 +++ pkgsrc/net/openvpn/distinfo Fri Jul 8 08:49:41 2016 @@ -1,13 +1,13 @@ -$NetBSD: distinfo,v 1.32 2015/11/04 00:35:18 agc Exp $ +$NetBSD: distinfo,v 1.33 2016/07/08 08:49:41 jperkin Exp $ -SHA1 (openvpn-2.3.6.tar.xz) = f360b4b858f70378f18853c334b0cd2f9219adbb -RMD160 (openvpn-2.3.6.tar.xz) = 8b34467bc4759380e10688c4839a67afa6a58abf -SHA512 (openvpn-2.3.6.tar.xz) = 2d9d8f818e95d6aa00388074479704cb89a901e03bc3f89ada0188034d65b30ecfafe3e298384997a9972e708537a6a8e7d32c0158099631a3b4b94708652e17 -Size (openvpn-2.3.6.tar.xz) = 809348 bytes -SHA1 (patch-ac) = d1918a08f8b3dd150b44737a236da58be7fa1f8c -SHA1 (patch-ad) = 1406764c57687665df34a489474255ab0c3c8179 -SHA1 (patch-ae) = e6e3e5977d1d9c09c0638d84e599c1c4956e27c8 -SHA1 (patch-af) = 6c5cbb2fcd465a8519e947532cd8b09eb3499f65 +SHA1 (openvpn-2.3.11.tar.xz) = 48ba3ada2da84be4cf66ffbd35a66d4ce30e0e5b +RMD160 (openvpn-2.3.11.tar.xz) = cfaf087bfb9d562b6028a225c43000fbe96041ce +SHA512 (openvpn-2.3.11.tar.xz) = 1fd2798beca074f0a094efbd4a9260f8a62d488afacb023b3f867698e6177bfc02702209e8c7f300ba8c662d292c65dc05d3f2cf615ebb91b90d4798fd3b99cd +Size (openvpn-2.3.11.tar.xz) = 833496 bytes +SHA1 (patch-ac) = 3071423ae978dd7d1d79cb140325bde96ba8d21b +SHA1 (patch-ad) = 1e2c34a37157ff9c091e0120817a8c8bae9aef4e +SHA1 (patch-ae) = fce5d2b7c8ef830cba3df4408af79301f347cafd +SHA1 (patch-af) = 8d728c36a6eccdebf6c7e5a02d457903b255f4fb SHA1 (patch-src_compat_compat-basename.c) = 45a58ef2e05f6e0265f229da8540760e60e65143 SHA1 (patch-src_openvpn_socket.c) = 74668d39f5e6fdab64825d38d4b287c8004f5af3 SHA1 (patch-src_openvpn_socket.h) = b4b952af347e0f2d0aff307a5025b3d27a2e6ee5 Index: pkgsrc/net/openvpn/patches/patch-ac diff -u pkgsrc/net/openvpn/patches/patch-ac:1.10 pkgsrc/net/openvpn/patches/patch-ac:1.11 --- pkgsrc/net/openvpn/patches/patch-ac:1.10 Sun Feb 10 05:55:07 2013 +++ pkgsrc/net/openvpn/patches/patch-ac Fri Jul 8 08:49:41 2016 @@ -1,4 +1,6 @@ -$NetBSD: patch-ac,v 1.10 2013/02/10 05:55:07 manu Exp $ +$NetBSD: patch-ac,v 1.11 2016/07/08 08:49:41 jperkin Exp $ + +Support clone devices. --- src/openvpn/tun.c.orig 2011-04-06 16:05:52.000000000 +0000 +++ src/openvpn/tun.c Index: pkgsrc/net/openvpn/patches/patch-ad diff -u pkgsrc/net/openvpn/patches/patch-ad:1.5 pkgsrc/net/openvpn/patches/patch-ad:1.6 --- pkgsrc/net/openvpn/patches/patch-ad:1.5 Wed Jul 31 06:53:21 2013 +++ pkgsrc/net/openvpn/patches/patch-ad Fri Jul 8 08:49:41 2016 @@ -1,18 +1,20 @@ -$NetBSD: patch-ad,v 1.5 2013/07/31 06:53:21 adam Exp $ +$NetBSD: patch-ad,v 1.6 2016/07/08 08:49:41 jperkin Exp $ ---- config.h.in.orig 2013-05-31 12:00:59.000000000 +0000 +Support IP_PKTINFO and net/if_tap.h + +--- config.h.in.orig 2016-05-10 06:02:53.000000000 +0000 +++ config.h.in -@@ -277,6 +277,9 @@ - /* struct in_pktinfo needed for IP_PKTINFO support */ - #undef HAVE_IN_PKTINFO +@@ -286,6 +286,9 @@ + /* struct iphdr needed for IPv6 support */ + #undef HAVE_IPHDR +/* struct in_pktinfo.ipi_spec_dst needed for IP_PKTINFO support */ +#undef HAVE_IPI_SPEC_DST + - /* struct iovec needed for IPv6 support */ - #undef HAVE_IOVEC + /* Define to 1 if you have the header file. */ + #undef HAVE_LIBGEN_H -@@ -352,6 +355,9 @@ +@@ -349,6 +352,9 @@ /* Define to 1 if you have the header file. */ #undef HAVE_NET_IF_H Index: pkgsrc/net/openvpn/patches/patch-ae diff -u pkgsrc/net/openvpn/patches/patch-ae:1.7 pkgsrc/net/openvpn/patches/patch-ae:1.8 --- pkgsrc/net/openvpn/patches/patch-ae:1.7 Wed Jul 31 06:53:21 2013 +++ pkgsrc/net/openvpn/patches/patch-ae Fri Jul 8 08:49:41 2016 @@ -1,4 +1,6 @@ -$NetBSD: patch-ae,v 1.7 2013/07/31 06:53:21 adam Exp $ +$NetBSD: patch-ae,v 1.8 2016/07/08 08:49:41 jperkin Exp $ + +Support IP_PKTINFO and net/if_tap.h --- configure.ac.orig 2013-05-31 12:00:25.000000000 +0000 +++ configure.ac Index: pkgsrc/net/openvpn/patches/patch-af diff -u pkgsrc/net/openvpn/patches/patch-af:1.8 pkgsrc/net/openvpn/patches/patch-af:1.9 --- pkgsrc/net/openvpn/patches/patch-af:1.8 Wed Jul 31 06:53:21 2013 +++ pkgsrc/net/openvpn/patches/patch-af Fri Jul 8 08:49:41 2016 @@ -1,4 +1,6 @@ -$NetBSD: patch-af,v 1.8 2013/07/31 06:53:21 adam Exp $ +$NetBSD: patch-af,v 1.9 2016/07/08 08:49:41 jperkin Exp $ + +Support IP_PKTINFO and net/if_tap.h --- configure.orig 2013-05-31 12:00:58.000000000 +0000 +++ configure --_----------=_1467967781142770--