From 22a08e76f76bb50dc4b4e962db64a8f7b839e9a5 Mon Sep 17 00:00:00 2001 From: "Gabriel L. Somlo" Date: Mon, 20 Mar 2017 09:04:22 -0400 Subject: [PATCH 1/6] update to 3.0.4; fix openssl-1.1 build (BZ1424526) --- vtun-client-sighup.patch | 33 ----- vtun-nostrip.patch | 10 +- vtun-openssl.patch | 287 +++++++++++++++++++++++++++++++++++++++ vtun.spec | 10 +- 4 files changed, 300 insertions(+), 40 deletions(-) delete mode 100644 vtun-client-sighup.patch create mode 100644 vtun-openssl.patch diff --git a/vtun-client-sighup.patch b/vtun-client-sighup.patch deleted file mode 100644 index c67bc91..0000000 --- a/vtun-client-sighup.patch +++ /dev/null @@ -1,33 +0,0 @@ -When sending a SIGHUP to a vtun client process which is unable to connect -to the remote server, it will attempt to reconnect without sleeping between -consecutive attempts. This results in a CPU usage spike, and a flood of -data sent to syslog. -This patch causes the first sleep after SIGHUP to be discarded, then allows -sleep to be used again in subsequent iterations. -diff -NarU5 a/client.c b/client.c ---- a/client.c 2012-07-08 01:32:57.000000000 -0400 -+++ b/client.c 2016-03-21 17:17:34.111775616 -0400 -@@ -131,10 +131,11 @@ - - if( connect_t(s,(struct sockaddr *) &svr_addr, host->timeout) ){ - if (!vtun.quiet || errno != ETIMEDOUT) - vtun_syslog(LOG_INFO,"Connect to %s failed. %s(%d)", vtun.svr_name, - strerror(errno), errno); -+ client_term = 0; - } else { - if( auth_client(s, host) ){ - vtun_syslog(LOG_INFO,"Session %s[%s] opened",host->host,vtun.svr_name); - - host->rmt_fd = s; -@@ -143,10 +144,11 @@ - client_term = tunnel(host); - - vtun_syslog(LOG_INFO,"Session %s[%s] closed",host->host,vtun.svr_name); - } else { - vtun_syslog(LOG_INFO,"Connection denied by %s",vtun.svr_name); -+ client_term = 0; - } - } - close(s); - free_sopt(&host->sopt); - } diff --git a/vtun-nostrip.patch b/vtun-nostrip.patch index fb4aa65..cd07a1a 100644 --- a/vtun-nostrip.patch +++ b/vtun-nostrip.patch @@ -1,7 +1,9 @@ -diff -up vtun-3.0.3/Makefile.in~ vtun-3.0.3/Makefile.in ---- vtun-3.0.3/Makefile.in~ 2012-07-09 07:55:38.000000000 +0300 -+++ vtun-3.0.3/Makefile.in 2012-09-16 16:12:41.176283091 +0300 -@@ -99,6 +99,5 @@ install: vtund install_config install_ma +diff -NarU5 a/Makefile.in b/Makefile.in +--- a/Makefile.in 2016-10-01 17:46:00.000000000 -0400 ++++ b/Makefile.in 2017-03-17 16:49:16.195772745 -0400 +@@ -97,8 +97,7 @@ + $(INSTALL) -d -m 755 $(INSTALL_OWNER) $(DESTDIR)$(VAR_DIR)/run + $(INSTALL) -d -m 755 $(INSTALL_OWNER) $(DESTDIR)$(STAT_DIR) $(INSTALL) -d -m 755 $(INSTALL_OWNER) $(DESTDIR)$(LOCK_DIR) $(INSTALL) -d -m 755 $(INSTALL_OWNER) $(DESTDIR)$(SBIN_DIR) $(INSTALL) -m 755 $(INSTALL_OWNER) vtund $(DESTDIR)$(SBIN_DIR) diff --git a/vtun-openssl.patch b/vtun-openssl.patch new file mode 100644 index 0000000..c375789 --- /dev/null +++ b/vtun-openssl.patch @@ -0,0 +1,287 @@ +diff -NarU5 a/lfd_encrypt.c b/lfd_encrypt.c +--- a/lfd_encrypt.c 2016-10-01 17:27:51.000000000 -0400 ++++ b/lfd_encrypt.c 2017-03-20 08:43:48.013308435 -0400 +@@ -93,15 +93,15 @@ + static int dec_init_first_time; + static unsigned long sequence_num; + static char * pkey; + static char * iv_buf; + +-static EVP_CIPHER_CTX ctx_enc; /* encrypt */ +-static EVP_CIPHER_CTX ctx_dec; /* decrypt */ ++static EVP_CIPHER_CTX *ctx_enc; /* encrypt */ ++static EVP_CIPHER_CTX *ctx_dec; /* decrypt */ + +-static EVP_CIPHER_CTX ctx_enc_ecb; /* sideband ecb encrypt */ +-static EVP_CIPHER_CTX ctx_dec_ecb; /* sideband ecb decrypt */ ++static EVP_CIPHER_CTX *ctx_enc_ecb; /* sideband ecb encrypt */ ++static EVP_CIPHER_CTX *ctx_dec_ecb; /* sideband ecb decrypt */ + + static int send_msg(int len, char *in, char **out); + static int recv_msg(int len, char *in, char **out); + static int send_ib_mesg(int *len, char **in); + static int recv_ib_mesg(int *len, char **in); +@@ -180,37 +180,37 @@ + case VTUN_ENC_AES256CBC: + blocksize = 16; + keysize = 32; + sb_init = 1; + cipher_type = EVP_aes_256_ecb(); +- pctx_enc = &ctx_enc_ecb; +- pctx_dec = &ctx_dec_ecb; ++ pctx_enc = ctx_enc_ecb; ++ pctx_dec = ctx_dec_ecb; + break; + + case VTUN_ENC_AES256ECB: + blocksize = 16; + keysize = 32; +- pctx_enc = &ctx_enc; +- pctx_dec = &ctx_dec; ++ pctx_enc = ctx_enc; ++ pctx_dec = ctx_dec; + cipher_type = EVP_aes_256_ecb(); + strcpy(cipher_name,"AES-256-ECB"); + break; + case VTUN_ENC_AES128OFB: + case VTUN_ENC_AES128CFB: + case VTUN_ENC_AES128CBC: + blocksize = 16; + keysize = 16; + sb_init=1; + cipher_type = EVP_aes_128_ecb(); +- pctx_enc = &ctx_enc_ecb; +- pctx_dec = &ctx_dec_ecb; ++ pctx_enc = ctx_enc_ecb; ++ pctx_dec = ctx_dec_ecb; + break; + case VTUN_ENC_AES128ECB: + blocksize = 16; + keysize = 16; +- pctx_enc = &ctx_enc; +- pctx_dec = &ctx_dec; ++ pctx_enc = ctx_enc; ++ pctx_dec = ctx_dec; + cipher_type = EVP_aes_128_ecb(); + strcpy(cipher_name,"AES-128-ECB"); + break; + + case VTUN_ENC_BF256OFB: +@@ -219,20 +219,20 @@ + blocksize = 8; + keysize = 32; + var_key = 1; + sb_init = 1; + cipher_type = EVP_bf_ecb(); +- pctx_enc = &ctx_enc_ecb; +- pctx_dec = &ctx_dec_ecb; ++ pctx_enc = ctx_enc_ecb; ++ pctx_dec = ctx_dec_ecb; + break; + + case VTUN_ENC_BF256ECB: + blocksize = 8; + keysize = 32; + var_key = 1; +- pctx_enc = &ctx_enc; +- pctx_dec = &ctx_dec; ++ pctx_enc = ctx_enc; ++ pctx_dec = ctx_dec; + cipher_type = EVP_bf_ecb(); + strcpy(cipher_name,"Blowfish-256-ECB"); + break; + + case VTUN_ENC_BF128OFB: +@@ -241,26 +241,28 @@ + blocksize = 8; + keysize = 16; + var_key = 1; + sb_init = 1; + cipher_type = EVP_bf_ecb(); +- pctx_enc = &ctx_enc_ecb; +- pctx_dec = &ctx_dec_ecb; ++ pctx_enc = ctx_enc_ecb; ++ pctx_dec = ctx_dec_ecb; + break; + case VTUN_ENC_BF128ECB: /* blowfish 128 ecb is the default */ + default: + blocksize = 8; + keysize = 16; + var_key = 1; +- pctx_enc = &ctx_enc; +- pctx_dec = &ctx_dec; ++ pctx_enc = ctx_enc; ++ pctx_dec = ctx_dec; + cipher_type = EVP_bf_ecb(); + strcpy(cipher_name,"Blowfish-128-ECB"); + break; + } /* switch(host->cipher) */ + + if (prep_key(&pkey, keysize, host) != 0) return -1; ++ pctx_enc = EVP_CIPHER_CTX_new(); ++ pctx_dec = EVP_CIPHER_CTX_new(); + EVP_CIPHER_CTX_init(pctx_enc); + EVP_CIPHER_CTX_init(pctx_dec); + EVP_EncryptInit_ex(pctx_enc, cipher_type, NULL, NULL, NULL); + EVP_DecryptInit_ex(pctx_dec, cipher_type, NULL, NULL, NULL); + if (var_key) +@@ -292,14 +294,14 @@ + free_key(pkey); pkey = NULL; + + lfd_free(enc_buf); enc_buf = NULL; + lfd_free(dec_buf); dec_buf = NULL; + +- EVP_CIPHER_CTX_cleanup(&ctx_enc); +- EVP_CIPHER_CTX_cleanup(&ctx_dec); +- EVP_CIPHER_CTX_cleanup(&ctx_enc_ecb); +- EVP_CIPHER_CTX_cleanup(&ctx_dec_ecb); ++ EVP_CIPHER_CTX_free(ctx_enc); ++ EVP_CIPHER_CTX_free(ctx_dec); ++ EVP_CIPHER_CTX_free(ctx_enc_ecb); ++ EVP_CIPHER_CTX_free(ctx_dec_ecb); + + return 0; + } + + static int encrypt_buf(int len, char *in, char **out) +@@ -321,11 +323,11 @@ + + memset(in_ptr+len, pad, pad); + outlen=len+pad; + if (pad == blocksize) + RAND_bytes(in_ptr+len, blocksize-1); +- EVP_EncryptUpdate(&ctx_enc, out_ptr, &outlen, in_ptr, len+pad); ++ EVP_EncryptUpdate(ctx_enc, out_ptr, &outlen, in_ptr, len+pad); + *out = enc_buf; + + sequence_num++; + + return outlen+msg_len; +@@ -341,11 +343,11 @@ + in = *out; + in_ptr = in; + + outlen=len; + if (!len) return 0; +- EVP_DecryptUpdate(&ctx_dec, out_ptr, &outlen, in_ptr, len); ++ EVP_DecryptUpdate(ctx_dec, out_ptr, &outlen, in_ptr, len); + recv_ib_mesg(&outlen, &out_ptr); + if (!outlen) return 0; + tmp_ptr = out_ptr + outlen; tmp_ptr--; + pad = *tmp_ptr; + if (pad < 1 || pad > blocksize) { +@@ -429,17 +431,18 @@ + /* if we're here, something weird's going on */ + return -1; + break; + } /* switch(cipher) */ + +- EVP_CIPHER_CTX_init(&ctx_enc); +- EVP_EncryptInit_ex(&ctx_enc, cipher_type, NULL, NULL, NULL); ++ ctx_enc = EVP_CIPHER_CTX_new(); ++ EVP_CIPHER_CTX_init(ctx_enc); ++ EVP_EncryptInit_ex(ctx_enc, cipher_type, NULL, NULL, NULL); + if (var_key) +- EVP_CIPHER_CTX_set_key_length(&ctx_enc, keysize); +- EVP_EncryptInit_ex(&ctx_enc, NULL, NULL, pkey, NULL); +- EVP_EncryptInit_ex(&ctx_enc, NULL, NULL, NULL, iv); +- EVP_CIPHER_CTX_set_padding(&ctx_enc, 0); ++ EVP_CIPHER_CTX_set_key_length(ctx_enc, keysize); ++ EVP_EncryptInit_ex(ctx_enc, NULL, NULL, pkey, NULL); ++ EVP_EncryptInit_ex(ctx_enc, NULL, NULL, NULL, iv); ++ EVP_CIPHER_CTX_set_padding(ctx_enc, 0); + if (enc_init_first_time) + { + sprintf(tmpstr,"%s encryption initialized", cipher_name); + vtun_syslog(LOG_INFO, tmpstr); + enc_init_first_time = 0; +@@ -519,17 +522,18 @@ + /* if we're here, something weird's going on */ + return -1; + break; + } /* switch(cipher) */ + +- EVP_CIPHER_CTX_init(&ctx_dec); +- EVP_DecryptInit_ex(&ctx_dec, cipher_type, NULL, NULL, NULL); ++ ctx_dec = EVP_CIPHER_CTX_new(); ++ EVP_CIPHER_CTX_init(ctx_dec); ++ EVP_DecryptInit_ex(ctx_dec, cipher_type, NULL, NULL, NULL); + if (var_key) +- EVP_CIPHER_CTX_set_key_length(&ctx_dec, keysize); +- EVP_DecryptInit_ex(&ctx_dec, NULL, NULL, pkey, NULL); +- EVP_DecryptInit_ex(&ctx_dec, NULL, NULL, NULL, iv); +- EVP_CIPHER_CTX_set_padding(&ctx_dec, 0); ++ EVP_CIPHER_CTX_set_key_length(ctx_dec, keysize); ++ EVP_DecryptInit_ex(ctx_dec, NULL, NULL, pkey, NULL); ++ EVP_DecryptInit_ex(ctx_dec, NULL, NULL, NULL, iv); ++ EVP_CIPHER_CTX_set_padding(ctx_dec, 0); + if (dec_init_first_time) + { + sprintf(tmpstr,"%s decryption initialized", cipher_name); + vtun_syslog(LOG_INFO, tmpstr); + dec_init_first_time = 0; +@@ -557,11 +561,11 @@ + memset(iv,0,blocksize); free(iv); iv = NULL; + RAND_bytes(in_ptr, in - in_ptr); + + in_ptr = in - blocksize*2; + outlen = blocksize*2; +- EVP_EncryptUpdate(&ctx_enc_ecb, in_ptr, ++ EVP_EncryptUpdate(ctx_enc_ecb, in_ptr, + &outlen, in_ptr, blocksize*2); + *out = in_ptr; + len = outlen; + cipher_enc_state = CIPHER_SEQUENCE; + break; +@@ -584,11 +588,11 @@ + { + case CIPHER_INIT: + in_ptr = in; + iv = malloc(blocksize); + outlen = blocksize*2; +- EVP_DecryptUpdate(&ctx_dec_ecb, in_ptr, &outlen, in_ptr, blocksize*2); ++ EVP_DecryptUpdate(ctx_dec_ecb, in_ptr, &outlen, in_ptr, blocksize*2); + + if ( !strncmp(in_ptr, "ivec", 4) ) + { + memcpy(iv, in_ptr+4, blocksize); + cipher_dec_init(iv); +@@ -627,11 +631,11 @@ + "Max. gibberish threshold reached"); + #endif + if (cipher_enc_state != CIPHER_INIT) + { + cipher_enc_state = CIPHER_INIT; +- EVP_CIPHER_CTX_cleanup(&ctx_enc); ++ EVP_CIPHER_CTX_free(ctx_enc); + #ifdef LFD_ENCRYPT_DEBUG + vtun_syslog(LOG_INFO, + "Forcing local encryptor re-init"); + #endif + } +@@ -708,11 +712,11 @@ + *len -= blocksize; + + if (cipher_enc_state != CIPHER_INIT) + { + cipher_enc_state = CIPHER_INIT; +- EVP_CIPHER_CTX_cleanup(&ctx_enc); ++ EVP_CIPHER_CTX_free(ctx_enc); + } + #ifdef LFD_ENCRYPT_DEBUG + vtun_syslog(LOG_INFO, "Remote requests encryptor re-init"); + #endif + } +@@ -722,11 +726,11 @@ + + if (cipher_dec_state != CIPHER_INIT && + cipher_enc_state != CIPHER_REQ_INIT && + cipher_enc_state != CIPHER_INIT) + { +- EVP_CIPHER_CTX_cleanup (&ctx_dec); ++ EVP_CIPHER_CTX_free (ctx_dec); + cipher_dec_state = CIPHER_INIT; + cipher_enc_state = CIPHER_REQ_INIT; + } + #ifdef LFD_ENCRYPT_DEBUG + vtun_syslog(LOG_INFO, "Local decryptor out of sync"); diff --git a/vtun.spec b/vtun.spec index bb1ac44..bbd3c7d 100644 --- a/vtun.spec +++ b/vtun.spec @@ -1,6 +1,6 @@ Name: vtun -Version: 3.0.3 -Release: 16%{?dist} +Version: 3.0.4 +Release: 1%{?dist} Summary: Virtual tunnel over TCP/IP networks License: GPLv2+ Group: System Environment/Daemons @@ -10,7 +10,7 @@ Source1: vtun.socket Source2: vtun.service Source3: vtun.sysconfig Patch0: vtun-nostrip.patch -Patch1: vtun-client-sighup.patch +Patch1: vtun-openssl.patch Requires(post): systemd-units Requires(preun): systemd-units @@ -73,6 +73,10 @@ make install DESTDIR=%{buildroot} INSTALL_OWNER= INSTALL="/usr/bin/install -p" %{_mandir}/man8/vtund.8* %changelog +* Fri Mar 17 2017 Gabriel Somlo 3.0.3-1 +- update to 3.0.4 +- patch for openssl-1.1 transition + * Sat Feb 11 2017 Fedora Release Engineering - 3.0.3-16 - Rebuilt for https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild From 39450d08656a6f1934163c9641d0edc3f022f8c5 Mon Sep 17 00:00:00 2001 From: "Gabriel L. Somlo" Date: Wed, 22 Mar 2017 09:11:03 -0400 Subject: [PATCH 2/6] push 3.0.4 vtun source to lookaside cache --- .gitignore | 1 + sources | 2 +- 2 files changed, 2 insertions(+), 1 deletion(-) diff --git a/.gitignore b/.gitignore index f9c375d..2711247 100644 --- a/.gitignore +++ b/.gitignore @@ -1,3 +1,4 @@ vtun-3.0.1.tar.gz /vtun-3.0.1.tar.gz /vtun-3.0.3.tar.gz +/vtun-3.0.4.tar.gz diff --git a/sources b/sources index d62f2f2..1487886 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -f3becf2a0270910a841060c08d1db824 vtun-3.0.3.tar.gz +SHA512 (vtun-3.0.4.tar.gz) = b1bb7294bd745c2ca888704e2b0f8e05447b5e01bec0f921648afe363d61a19508dea9e26663993cd69c506aa92621e76f36045bddf7c3723d13a72741ca6781 From 9bd9d732c03824ebee8d255a47270fef0c22ea55 Mon Sep 17 00:00:00 2001 From: "Gabriel L. Somlo" Date: Mon, 31 Jul 2017 14:44:55 -0400 Subject: [PATCH 3/6] add /usr/lib/tmpfiles.d/vtun.conf to enable lock dir. on tmpfs --- vtun.spec | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-) diff --git a/vtun.spec b/vtun.spec index bbd3c7d..f98c756 100644 --- a/vtun.spec +++ b/vtun.spec @@ -1,6 +1,6 @@ Name: vtun Version: 3.0.4 -Release: 1%{?dist} +Release: 2%{?dist} Summary: Virtual tunnel over TCP/IP networks License: GPLv2+ Group: System Environment/Daemons @@ -48,6 +48,11 @@ install -D -m 0644 -p %{SOURCE1} %{buildroot}/%{_unitdir}/vtun.socket install -D -m 0644 -p %{SOURCE2} %{buildroot}/%{_unitdir}/vtun.service install -D -m 0644 -p %{SOURCE3} %{buildroot}/%{_sysconfdir}/sysconfig/vtun make install DESTDIR=%{buildroot} INSTALL_OWNER= INSTALL="/usr/bin/install -p" +# tmpfiles.d configuration for /var/lock/vtund: +mkdir -p %{buildroot}/%{_tmpfilesdir} +cat > %{buildroot}/%{_tmpfilesdir}/%{name}.conf << EOT +d %{_localstatedir}/lock/vtund 0755 root root - +EOT %post %systemd_post vtun.service vtun.socket @@ -66,13 +71,17 @@ make install DESTDIR=%{buildroot} INSTALL_OWNER= INSTALL="/usr/bin/install -p" %{_unitdir}/vtun.socket %{_unitdir}/vtun.service %{_sbindir}/vtund +%{_tmpfilesdir}/%{name}.conf %dir %{_localstatedir}/log/vtund -%ghost %dir %{_localstatedir}/lock/vtund +%dir %{_localstatedir}/lock/vtund %{_mandir}/man5/vtund.conf.5* %{_mandir}/man8/vtun.8* %{_mandir}/man8/vtund.8* %changelog +* Mon Jul 31 2017 Gabriel Somlo 3.0.3-2 +- add /usr/lib/tmpfiles.d/vtun.conf to enable lock dir. on tmpfs + * Fri Mar 17 2017 Gabriel Somlo 3.0.3-1 - update to 3.0.4 - patch for openssl-1.1 transition From 11ce4d6a2b4996597a186442e00d8b67c5e5a5ae Mon Sep 17 00:00:00 2001 From: "Gabriel L. Somlo" Date: Sat, 2 Sep 2017 18:36:42 -0400 Subject: [PATCH 4/6] apply openssl-1.1 patch only on Fedora >= 26, to avoid epel7 (#1487003) --- vtun.spec | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/vtun.spec b/vtun.spec index f98c756..8f135f1 100644 --- a/vtun.spec +++ b/vtun.spec @@ -1,6 +1,6 @@ Name: vtun Version: 3.0.4 -Release: 2%{?dist} +Release: 3%{?dist} Summary: Virtual tunnel over TCP/IP networks License: GPLv2+ Group: System Environment/Daemons @@ -33,7 +33,9 @@ require modification to any kernel parts. %prep %setup -q %patch0 -p1 +%if 0%{?fedora} >= 26 %patch1 -p1 +%endif %build %{__autoconf} @@ -79,6 +81,9 @@ EOT %{_mandir}/man8/vtund.8* %changelog +* Sat Sep 02 2017 Gabriel Somlo 3.0.3-3 +- apply openssl-1.1 patch only on Fedora >= 26, to avoid epel7 (#1487003) + * Mon Jul 31 2017 Gabriel Somlo 3.0.3-2 - add /usr/lib/tmpfiles.d/vtun.conf to enable lock dir. on tmpfs From fcff830fb8d0128cdc63e3efa02293f3e320dddc Mon Sep 17 00:00:00 2001 From: "Gabriel L. Somlo" Date: Sat, 2 Sep 2017 18:41:13 -0400 Subject: [PATCH 5/6] apply openssl-1.1 patch only on Fedora >= 26, to avoid epel7 (#1487003) --- vtun.spec | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/vtun.spec b/vtun.spec index 8f135f1..dd77184 100644 --- a/vtun.spec +++ b/vtun.spec @@ -1,6 +1,6 @@ Name: vtun Version: 3.0.4 -Release: 3%{?dist} +Release: 4%{?dist} Summary: Virtual tunnel over TCP/IP networks License: GPLv2+ Group: System Environment/Daemons @@ -81,9 +81,12 @@ EOT %{_mandir}/man8/vtund.8* %changelog -* Sat Sep 02 2017 Gabriel Somlo 3.0.3-3 +* Sat Sep 02 2017 Gabriel Somlo 3.0.3-4 - apply openssl-1.1 patch only on Fedora >= 26, to avoid epel7 (#1487003) +* Thu Aug 03 2017 Fedora Release Engineering - 3.0.4-3 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Binutils_Mass_Rebuild + * Mon Jul 31 2017 Gabriel Somlo 3.0.3-2 - add /usr/lib/tmpfiles.d/vtun.conf to enable lock dir. on tmpfs From 7d038dbecee050cda72a4e86da806643b1425e28 Mon Sep 17 00:00:00 2001 From: "Gabriel L. Somlo" Date: Wed, 11 Oct 2017 13:56:56 -0400 Subject: [PATCH 6/6] requiring compat-openssl1.0 on >= f26 --- vtun-openssl.patch | 287 --------------------------------------------- vtun.spec | 16 ++- 2 files changed, 10 insertions(+), 293 deletions(-) delete mode 100644 vtun-openssl.patch diff --git a/vtun-openssl.patch b/vtun-openssl.patch deleted file mode 100644 index c375789..0000000 --- a/vtun-openssl.patch +++ /dev/null @@ -1,287 +0,0 @@ -diff -NarU5 a/lfd_encrypt.c b/lfd_encrypt.c ---- a/lfd_encrypt.c 2016-10-01 17:27:51.000000000 -0400 -+++ b/lfd_encrypt.c 2017-03-20 08:43:48.013308435 -0400 -@@ -93,15 +93,15 @@ - static int dec_init_first_time; - static unsigned long sequence_num; - static char * pkey; - static char * iv_buf; - --static EVP_CIPHER_CTX ctx_enc; /* encrypt */ --static EVP_CIPHER_CTX ctx_dec; /* decrypt */ -+static EVP_CIPHER_CTX *ctx_enc; /* encrypt */ -+static EVP_CIPHER_CTX *ctx_dec; /* decrypt */ - --static EVP_CIPHER_CTX ctx_enc_ecb; /* sideband ecb encrypt */ --static EVP_CIPHER_CTX ctx_dec_ecb; /* sideband ecb decrypt */ -+static EVP_CIPHER_CTX *ctx_enc_ecb; /* sideband ecb encrypt */ -+static EVP_CIPHER_CTX *ctx_dec_ecb; /* sideband ecb decrypt */ - - static int send_msg(int len, char *in, char **out); - static int recv_msg(int len, char *in, char **out); - static int send_ib_mesg(int *len, char **in); - static int recv_ib_mesg(int *len, char **in); -@@ -180,37 +180,37 @@ - case VTUN_ENC_AES256CBC: - blocksize = 16; - keysize = 32; - sb_init = 1; - cipher_type = EVP_aes_256_ecb(); -- pctx_enc = &ctx_enc_ecb; -- pctx_dec = &ctx_dec_ecb; -+ pctx_enc = ctx_enc_ecb; -+ pctx_dec = ctx_dec_ecb; - break; - - case VTUN_ENC_AES256ECB: - blocksize = 16; - keysize = 32; -- pctx_enc = &ctx_enc; -- pctx_dec = &ctx_dec; -+ pctx_enc = ctx_enc; -+ pctx_dec = ctx_dec; - cipher_type = EVP_aes_256_ecb(); - strcpy(cipher_name,"AES-256-ECB"); - break; - case VTUN_ENC_AES128OFB: - case VTUN_ENC_AES128CFB: - case VTUN_ENC_AES128CBC: - blocksize = 16; - keysize = 16; - sb_init=1; - cipher_type = EVP_aes_128_ecb(); -- pctx_enc = &ctx_enc_ecb; -- pctx_dec = &ctx_dec_ecb; -+ pctx_enc = ctx_enc_ecb; -+ pctx_dec = ctx_dec_ecb; - break; - case VTUN_ENC_AES128ECB: - blocksize = 16; - keysize = 16; -- pctx_enc = &ctx_enc; -- pctx_dec = &ctx_dec; -+ pctx_enc = ctx_enc; -+ pctx_dec = ctx_dec; - cipher_type = EVP_aes_128_ecb(); - strcpy(cipher_name,"AES-128-ECB"); - break; - - case VTUN_ENC_BF256OFB: -@@ -219,20 +219,20 @@ - blocksize = 8; - keysize = 32; - var_key = 1; - sb_init = 1; - cipher_type = EVP_bf_ecb(); -- pctx_enc = &ctx_enc_ecb; -- pctx_dec = &ctx_dec_ecb; -+ pctx_enc = ctx_enc_ecb; -+ pctx_dec = ctx_dec_ecb; - break; - - case VTUN_ENC_BF256ECB: - blocksize = 8; - keysize = 32; - var_key = 1; -- pctx_enc = &ctx_enc; -- pctx_dec = &ctx_dec; -+ pctx_enc = ctx_enc; -+ pctx_dec = ctx_dec; - cipher_type = EVP_bf_ecb(); - strcpy(cipher_name,"Blowfish-256-ECB"); - break; - - case VTUN_ENC_BF128OFB: -@@ -241,26 +241,28 @@ - blocksize = 8; - keysize = 16; - var_key = 1; - sb_init = 1; - cipher_type = EVP_bf_ecb(); -- pctx_enc = &ctx_enc_ecb; -- pctx_dec = &ctx_dec_ecb; -+ pctx_enc = ctx_enc_ecb; -+ pctx_dec = ctx_dec_ecb; - break; - case VTUN_ENC_BF128ECB: /* blowfish 128 ecb is the default */ - default: - blocksize = 8; - keysize = 16; - var_key = 1; -- pctx_enc = &ctx_enc; -- pctx_dec = &ctx_dec; -+ pctx_enc = ctx_enc; -+ pctx_dec = ctx_dec; - cipher_type = EVP_bf_ecb(); - strcpy(cipher_name,"Blowfish-128-ECB"); - break; - } /* switch(host->cipher) */ - - if (prep_key(&pkey, keysize, host) != 0) return -1; -+ pctx_enc = EVP_CIPHER_CTX_new(); -+ pctx_dec = EVP_CIPHER_CTX_new(); - EVP_CIPHER_CTX_init(pctx_enc); - EVP_CIPHER_CTX_init(pctx_dec); - EVP_EncryptInit_ex(pctx_enc, cipher_type, NULL, NULL, NULL); - EVP_DecryptInit_ex(pctx_dec, cipher_type, NULL, NULL, NULL); - if (var_key) -@@ -292,14 +294,14 @@ - free_key(pkey); pkey = NULL; - - lfd_free(enc_buf); enc_buf = NULL; - lfd_free(dec_buf); dec_buf = NULL; - -- EVP_CIPHER_CTX_cleanup(&ctx_enc); -- EVP_CIPHER_CTX_cleanup(&ctx_dec); -- EVP_CIPHER_CTX_cleanup(&ctx_enc_ecb); -- EVP_CIPHER_CTX_cleanup(&ctx_dec_ecb); -+ EVP_CIPHER_CTX_free(ctx_enc); -+ EVP_CIPHER_CTX_free(ctx_dec); -+ EVP_CIPHER_CTX_free(ctx_enc_ecb); -+ EVP_CIPHER_CTX_free(ctx_dec_ecb); - - return 0; - } - - static int encrypt_buf(int len, char *in, char **out) -@@ -321,11 +323,11 @@ - - memset(in_ptr+len, pad, pad); - outlen=len+pad; - if (pad == blocksize) - RAND_bytes(in_ptr+len, blocksize-1); -- EVP_EncryptUpdate(&ctx_enc, out_ptr, &outlen, in_ptr, len+pad); -+ EVP_EncryptUpdate(ctx_enc, out_ptr, &outlen, in_ptr, len+pad); - *out = enc_buf; - - sequence_num++; - - return outlen+msg_len; -@@ -341,11 +343,11 @@ - in = *out; - in_ptr = in; - - outlen=len; - if (!len) return 0; -- EVP_DecryptUpdate(&ctx_dec, out_ptr, &outlen, in_ptr, len); -+ EVP_DecryptUpdate(ctx_dec, out_ptr, &outlen, in_ptr, len); - recv_ib_mesg(&outlen, &out_ptr); - if (!outlen) return 0; - tmp_ptr = out_ptr + outlen; tmp_ptr--; - pad = *tmp_ptr; - if (pad < 1 || pad > blocksize) { -@@ -429,17 +431,18 @@ - /* if we're here, something weird's going on */ - return -1; - break; - } /* switch(cipher) */ - -- EVP_CIPHER_CTX_init(&ctx_enc); -- EVP_EncryptInit_ex(&ctx_enc, cipher_type, NULL, NULL, NULL); -+ ctx_enc = EVP_CIPHER_CTX_new(); -+ EVP_CIPHER_CTX_init(ctx_enc); -+ EVP_EncryptInit_ex(ctx_enc, cipher_type, NULL, NULL, NULL); - if (var_key) -- EVP_CIPHER_CTX_set_key_length(&ctx_enc, keysize); -- EVP_EncryptInit_ex(&ctx_enc, NULL, NULL, pkey, NULL); -- EVP_EncryptInit_ex(&ctx_enc, NULL, NULL, NULL, iv); -- EVP_CIPHER_CTX_set_padding(&ctx_enc, 0); -+ EVP_CIPHER_CTX_set_key_length(ctx_enc, keysize); -+ EVP_EncryptInit_ex(ctx_enc, NULL, NULL, pkey, NULL); -+ EVP_EncryptInit_ex(ctx_enc, NULL, NULL, NULL, iv); -+ EVP_CIPHER_CTX_set_padding(ctx_enc, 0); - if (enc_init_first_time) - { - sprintf(tmpstr,"%s encryption initialized", cipher_name); - vtun_syslog(LOG_INFO, tmpstr); - enc_init_first_time = 0; -@@ -519,17 +522,18 @@ - /* if we're here, something weird's going on */ - return -1; - break; - } /* switch(cipher) */ - -- EVP_CIPHER_CTX_init(&ctx_dec); -- EVP_DecryptInit_ex(&ctx_dec, cipher_type, NULL, NULL, NULL); -+ ctx_dec = EVP_CIPHER_CTX_new(); -+ EVP_CIPHER_CTX_init(ctx_dec); -+ EVP_DecryptInit_ex(ctx_dec, cipher_type, NULL, NULL, NULL); - if (var_key) -- EVP_CIPHER_CTX_set_key_length(&ctx_dec, keysize); -- EVP_DecryptInit_ex(&ctx_dec, NULL, NULL, pkey, NULL); -- EVP_DecryptInit_ex(&ctx_dec, NULL, NULL, NULL, iv); -- EVP_CIPHER_CTX_set_padding(&ctx_dec, 0); -+ EVP_CIPHER_CTX_set_key_length(ctx_dec, keysize); -+ EVP_DecryptInit_ex(ctx_dec, NULL, NULL, pkey, NULL); -+ EVP_DecryptInit_ex(ctx_dec, NULL, NULL, NULL, iv); -+ EVP_CIPHER_CTX_set_padding(ctx_dec, 0); - if (dec_init_first_time) - { - sprintf(tmpstr,"%s decryption initialized", cipher_name); - vtun_syslog(LOG_INFO, tmpstr); - dec_init_first_time = 0; -@@ -557,11 +561,11 @@ - memset(iv,0,blocksize); free(iv); iv = NULL; - RAND_bytes(in_ptr, in - in_ptr); - - in_ptr = in - blocksize*2; - outlen = blocksize*2; -- EVP_EncryptUpdate(&ctx_enc_ecb, in_ptr, -+ EVP_EncryptUpdate(ctx_enc_ecb, in_ptr, - &outlen, in_ptr, blocksize*2); - *out = in_ptr; - len = outlen; - cipher_enc_state = CIPHER_SEQUENCE; - break; -@@ -584,11 +588,11 @@ - { - case CIPHER_INIT: - in_ptr = in; - iv = malloc(blocksize); - outlen = blocksize*2; -- EVP_DecryptUpdate(&ctx_dec_ecb, in_ptr, &outlen, in_ptr, blocksize*2); -+ EVP_DecryptUpdate(ctx_dec_ecb, in_ptr, &outlen, in_ptr, blocksize*2); - - if ( !strncmp(in_ptr, "ivec", 4) ) - { - memcpy(iv, in_ptr+4, blocksize); - cipher_dec_init(iv); -@@ -627,11 +631,11 @@ - "Max. gibberish threshold reached"); - #endif - if (cipher_enc_state != CIPHER_INIT) - { - cipher_enc_state = CIPHER_INIT; -- EVP_CIPHER_CTX_cleanup(&ctx_enc); -+ EVP_CIPHER_CTX_free(ctx_enc); - #ifdef LFD_ENCRYPT_DEBUG - vtun_syslog(LOG_INFO, - "Forcing local encryptor re-init"); - #endif - } -@@ -708,11 +712,11 @@ - *len -= blocksize; - - if (cipher_enc_state != CIPHER_INIT) - { - cipher_enc_state = CIPHER_INIT; -- EVP_CIPHER_CTX_cleanup(&ctx_enc); -+ EVP_CIPHER_CTX_free(ctx_enc); - } - #ifdef LFD_ENCRYPT_DEBUG - vtun_syslog(LOG_INFO, "Remote requests encryptor re-init"); - #endif - } -@@ -722,11 +726,11 @@ - - if (cipher_dec_state != CIPHER_INIT && - cipher_enc_state != CIPHER_REQ_INIT && - cipher_enc_state != CIPHER_INIT) - { -- EVP_CIPHER_CTX_cleanup (&ctx_dec); -+ EVP_CIPHER_CTX_free (ctx_dec); - cipher_dec_state = CIPHER_INIT; - cipher_enc_state = CIPHER_REQ_INIT; - } - #ifdef LFD_ENCRYPT_DEBUG - vtun_syslog(LOG_INFO, "Local decryptor out of sync"); diff --git a/vtun.spec b/vtun.spec index dd77184..8c642de 100644 --- a/vtun.spec +++ b/vtun.spec @@ -1,6 +1,6 @@ Name: vtun Version: 3.0.4 -Release: 4%{?dist} +Release: 5%{?dist} Summary: Virtual tunnel over TCP/IP networks License: GPLv2+ Group: System Environment/Daemons @@ -10,12 +10,16 @@ Source1: vtun.socket Source2: vtun.service Source3: vtun.sysconfig Patch0: vtun-nostrip.patch -Patch1: vtun-openssl.patch Requires(post): systemd-units Requires(preun): systemd-units Requires(postun): systemd-units -BuildRequires: zlib-devel lzo-devel openssl-devel bison flex systemd-units autoconf +BuildRequires: zlib-devel lzo-devel bison flex systemd-units autoconf +%if 0%{?fedora} >= 26 +BuildRequires: compat-openssl10-devel +%else +BuildRequires: openssl-devel +%endif #enable PIE/PIC: %global _hardened_build 1 @@ -33,9 +37,6 @@ require modification to any kernel parts. %prep %setup -q %patch0 -p1 -%if 0%{?fedora} >= 26 -%patch1 -p1 -%endif %build %{__autoconf} @@ -81,6 +82,9 @@ EOT %{_mandir}/man8/vtund.8* %changelog +* Sat Sep 02 2017 Gabriel Somlo 3.0.3-5 +- remove segfaulting openssl-1.1 patch; use compat-openssl10 instead + * Sat Sep 02 2017 Gabriel Somlo 3.0.3-4 - apply openssl-1.1 patch only on Fedora >= 26, to avoid epel7 (#1487003)