From 095051a2c561b32238e806dad7dc698866628ca8 Mon Sep 17 00:00:00 2001 From: "Gabriel L. Somlo" Date: Sat, 2 Sep 2017 18:36:33 -0400 Subject: [PATCH 1/3] apply openssl-1.1 patch only on Fedora >= 26, to avoid epel7 (#1487003) --- vtun.spec | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/vtun.spec b/vtun.spec index b46e596..8f135f1 100644 --- a/vtun.spec +++ b/vtun.spec @@ -33,7 +33,9 @@ require modification to any kernel parts. %prep %setup -q %patch0 -p1 +%if 0%{?fedora} >= 26 %patch1 -p1 +%endif %build %{__autoconf} @@ -79,8 +81,8 @@ EOT %{_mandir}/man8/vtund.8* %changelog -* Thu Aug 03 2017 Fedora Release Engineering - 3.0.4-3 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Binutils_Mass_Rebuild +* Sat Sep 02 2017 Gabriel Somlo 3.0.3-3 +- apply openssl-1.1 patch only on Fedora >= 26, to avoid epel7 (#1487003) * Mon Jul 31 2017 Gabriel Somlo 3.0.3-2 - add /usr/lib/tmpfiles.d/vtun.conf to enable lock dir. on tmpfs From 9a63ba1b1c9e7695430281a00302938b42913be1 Mon Sep 17 00:00:00 2001 From: "Gabriel L. Somlo" Date: Sat, 2 Sep 2017 18:41:06 -0400 Subject: [PATCH 2/3] apply openssl-1.1 patch only on Fedora >= 26, to avoid epel7 (#1487003) --- vtun.spec | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/vtun.spec b/vtun.spec index 8f135f1..dd77184 100644 --- a/vtun.spec +++ b/vtun.spec @@ -1,6 +1,6 @@ Name: vtun Version: 3.0.4 -Release: 3%{?dist} +Release: 4%{?dist} Summary: Virtual tunnel over TCP/IP networks License: GPLv2+ Group: System Environment/Daemons @@ -81,9 +81,12 @@ EOT %{_mandir}/man8/vtund.8* %changelog -* Sat Sep 02 2017 Gabriel Somlo 3.0.3-3 +* Sat Sep 02 2017 Gabriel Somlo 3.0.3-4 - apply openssl-1.1 patch only on Fedora >= 26, to avoid epel7 (#1487003) +* Thu Aug 03 2017 Fedora Release Engineering - 3.0.4-3 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Binutils_Mass_Rebuild + * Mon Jul 31 2017 Gabriel Somlo 3.0.3-2 - add /usr/lib/tmpfiles.d/vtun.conf to enable lock dir. on tmpfs From feef202792e2a629b58682c3244c33cedc85e1f1 Mon Sep 17 00:00:00 2001 From: "Gabriel L. Somlo" Date: Wed, 11 Oct 2017 13:56:46 -0400 Subject: [PATCH 3/3] requiring compat-openssl1.0 on >= f26 --- vtun-openssl.patch | 287 --------------------------------------------- vtun.spec | 16 ++- 2 files changed, 10 insertions(+), 293 deletions(-) delete mode 100644 vtun-openssl.patch diff --git a/vtun-openssl.patch b/vtun-openssl.patch deleted file mode 100644 index c375789..0000000 --- a/vtun-openssl.patch +++ /dev/null @@ -1,287 +0,0 @@ -diff -NarU5 a/lfd_encrypt.c b/lfd_encrypt.c ---- a/lfd_encrypt.c 2016-10-01 17:27:51.000000000 -0400 -+++ b/lfd_encrypt.c 2017-03-20 08:43:48.013308435 -0400 -@@ -93,15 +93,15 @@ - static int dec_init_first_time; - static unsigned long sequence_num; - static char * pkey; - static char * iv_buf; - --static EVP_CIPHER_CTX ctx_enc; /* encrypt */ --static EVP_CIPHER_CTX ctx_dec; /* decrypt */ -+static EVP_CIPHER_CTX *ctx_enc; /* encrypt */ -+static EVP_CIPHER_CTX *ctx_dec; /* decrypt */ - --static EVP_CIPHER_CTX ctx_enc_ecb; /* sideband ecb encrypt */ --static EVP_CIPHER_CTX ctx_dec_ecb; /* sideband ecb decrypt */ -+static EVP_CIPHER_CTX *ctx_enc_ecb; /* sideband ecb encrypt */ -+static EVP_CIPHER_CTX *ctx_dec_ecb; /* sideband ecb decrypt */ - - static int send_msg(int len, char *in, char **out); - static int recv_msg(int len, char *in, char **out); - static int send_ib_mesg(int *len, char **in); - static int recv_ib_mesg(int *len, char **in); -@@ -180,37 +180,37 @@ - case VTUN_ENC_AES256CBC: - blocksize = 16; - keysize = 32; - sb_init = 1; - cipher_type = EVP_aes_256_ecb(); -- pctx_enc = &ctx_enc_ecb; -- pctx_dec = &ctx_dec_ecb; -+ pctx_enc = ctx_enc_ecb; -+ pctx_dec = ctx_dec_ecb; - break; - - case VTUN_ENC_AES256ECB: - blocksize = 16; - keysize = 32; -- pctx_enc = &ctx_enc; -- pctx_dec = &ctx_dec; -+ pctx_enc = ctx_enc; -+ pctx_dec = ctx_dec; - cipher_type = EVP_aes_256_ecb(); - strcpy(cipher_name,"AES-256-ECB"); - break; - case VTUN_ENC_AES128OFB: - case VTUN_ENC_AES128CFB: - case VTUN_ENC_AES128CBC: - blocksize = 16; - keysize = 16; - sb_init=1; - cipher_type = EVP_aes_128_ecb(); -- pctx_enc = &ctx_enc_ecb; -- pctx_dec = &ctx_dec_ecb; -+ pctx_enc = ctx_enc_ecb; -+ pctx_dec = ctx_dec_ecb; - break; - case VTUN_ENC_AES128ECB: - blocksize = 16; - keysize = 16; -- pctx_enc = &ctx_enc; -- pctx_dec = &ctx_dec; -+ pctx_enc = ctx_enc; -+ pctx_dec = ctx_dec; - cipher_type = EVP_aes_128_ecb(); - strcpy(cipher_name,"AES-128-ECB"); - break; - - case VTUN_ENC_BF256OFB: -@@ -219,20 +219,20 @@ - blocksize = 8; - keysize = 32; - var_key = 1; - sb_init = 1; - cipher_type = EVP_bf_ecb(); -- pctx_enc = &ctx_enc_ecb; -- pctx_dec = &ctx_dec_ecb; -+ pctx_enc = ctx_enc_ecb; -+ pctx_dec = ctx_dec_ecb; - break; - - case VTUN_ENC_BF256ECB: - blocksize = 8; - keysize = 32; - var_key = 1; -- pctx_enc = &ctx_enc; -- pctx_dec = &ctx_dec; -+ pctx_enc = ctx_enc; -+ pctx_dec = ctx_dec; - cipher_type = EVP_bf_ecb(); - strcpy(cipher_name,"Blowfish-256-ECB"); - break; - - case VTUN_ENC_BF128OFB: -@@ -241,26 +241,28 @@ - blocksize = 8; - keysize = 16; - var_key = 1; - sb_init = 1; - cipher_type = EVP_bf_ecb(); -- pctx_enc = &ctx_enc_ecb; -- pctx_dec = &ctx_dec_ecb; -+ pctx_enc = ctx_enc_ecb; -+ pctx_dec = ctx_dec_ecb; - break; - case VTUN_ENC_BF128ECB: /* blowfish 128 ecb is the default */ - default: - blocksize = 8; - keysize = 16; - var_key = 1; -- pctx_enc = &ctx_enc; -- pctx_dec = &ctx_dec; -+ pctx_enc = ctx_enc; -+ pctx_dec = ctx_dec; - cipher_type = EVP_bf_ecb(); - strcpy(cipher_name,"Blowfish-128-ECB"); - break; - } /* switch(host->cipher) */ - - if (prep_key(&pkey, keysize, host) != 0) return -1; -+ pctx_enc = EVP_CIPHER_CTX_new(); -+ pctx_dec = EVP_CIPHER_CTX_new(); - EVP_CIPHER_CTX_init(pctx_enc); - EVP_CIPHER_CTX_init(pctx_dec); - EVP_EncryptInit_ex(pctx_enc, cipher_type, NULL, NULL, NULL); - EVP_DecryptInit_ex(pctx_dec, cipher_type, NULL, NULL, NULL); - if (var_key) -@@ -292,14 +294,14 @@ - free_key(pkey); pkey = NULL; - - lfd_free(enc_buf); enc_buf = NULL; - lfd_free(dec_buf); dec_buf = NULL; - -- EVP_CIPHER_CTX_cleanup(&ctx_enc); -- EVP_CIPHER_CTX_cleanup(&ctx_dec); -- EVP_CIPHER_CTX_cleanup(&ctx_enc_ecb); -- EVP_CIPHER_CTX_cleanup(&ctx_dec_ecb); -+ EVP_CIPHER_CTX_free(ctx_enc); -+ EVP_CIPHER_CTX_free(ctx_dec); -+ EVP_CIPHER_CTX_free(ctx_enc_ecb); -+ EVP_CIPHER_CTX_free(ctx_dec_ecb); - - return 0; - } - - static int encrypt_buf(int len, char *in, char **out) -@@ -321,11 +323,11 @@ - - memset(in_ptr+len, pad, pad); - outlen=len+pad; - if (pad == blocksize) - RAND_bytes(in_ptr+len, blocksize-1); -- EVP_EncryptUpdate(&ctx_enc, out_ptr, &outlen, in_ptr, len+pad); -+ EVP_EncryptUpdate(ctx_enc, out_ptr, &outlen, in_ptr, len+pad); - *out = enc_buf; - - sequence_num++; - - return outlen+msg_len; -@@ -341,11 +343,11 @@ - in = *out; - in_ptr = in; - - outlen=len; - if (!len) return 0; -- EVP_DecryptUpdate(&ctx_dec, out_ptr, &outlen, in_ptr, len); -+ EVP_DecryptUpdate(ctx_dec, out_ptr, &outlen, in_ptr, len); - recv_ib_mesg(&outlen, &out_ptr); - if (!outlen) return 0; - tmp_ptr = out_ptr + outlen; tmp_ptr--; - pad = *tmp_ptr; - if (pad < 1 || pad > blocksize) { -@@ -429,17 +431,18 @@ - /* if we're here, something weird's going on */ - return -1; - break; - } /* switch(cipher) */ - -- EVP_CIPHER_CTX_init(&ctx_enc); -- EVP_EncryptInit_ex(&ctx_enc, cipher_type, NULL, NULL, NULL); -+ ctx_enc = EVP_CIPHER_CTX_new(); -+ EVP_CIPHER_CTX_init(ctx_enc); -+ EVP_EncryptInit_ex(ctx_enc, cipher_type, NULL, NULL, NULL); - if (var_key) -- EVP_CIPHER_CTX_set_key_length(&ctx_enc, keysize); -- EVP_EncryptInit_ex(&ctx_enc, NULL, NULL, pkey, NULL); -- EVP_EncryptInit_ex(&ctx_enc, NULL, NULL, NULL, iv); -- EVP_CIPHER_CTX_set_padding(&ctx_enc, 0); -+ EVP_CIPHER_CTX_set_key_length(ctx_enc, keysize); -+ EVP_EncryptInit_ex(ctx_enc, NULL, NULL, pkey, NULL); -+ EVP_EncryptInit_ex(ctx_enc, NULL, NULL, NULL, iv); -+ EVP_CIPHER_CTX_set_padding(ctx_enc, 0); - if (enc_init_first_time) - { - sprintf(tmpstr,"%s encryption initialized", cipher_name); - vtun_syslog(LOG_INFO, tmpstr); - enc_init_first_time = 0; -@@ -519,17 +522,18 @@ - /* if we're here, something weird's going on */ - return -1; - break; - } /* switch(cipher) */ - -- EVP_CIPHER_CTX_init(&ctx_dec); -- EVP_DecryptInit_ex(&ctx_dec, cipher_type, NULL, NULL, NULL); -+ ctx_dec = EVP_CIPHER_CTX_new(); -+ EVP_CIPHER_CTX_init(ctx_dec); -+ EVP_DecryptInit_ex(ctx_dec, cipher_type, NULL, NULL, NULL); - if (var_key) -- EVP_CIPHER_CTX_set_key_length(&ctx_dec, keysize); -- EVP_DecryptInit_ex(&ctx_dec, NULL, NULL, pkey, NULL); -- EVP_DecryptInit_ex(&ctx_dec, NULL, NULL, NULL, iv); -- EVP_CIPHER_CTX_set_padding(&ctx_dec, 0); -+ EVP_CIPHER_CTX_set_key_length(ctx_dec, keysize); -+ EVP_DecryptInit_ex(ctx_dec, NULL, NULL, pkey, NULL); -+ EVP_DecryptInit_ex(ctx_dec, NULL, NULL, NULL, iv); -+ EVP_CIPHER_CTX_set_padding(ctx_dec, 0); - if (dec_init_first_time) - { - sprintf(tmpstr,"%s decryption initialized", cipher_name); - vtun_syslog(LOG_INFO, tmpstr); - dec_init_first_time = 0; -@@ -557,11 +561,11 @@ - memset(iv,0,blocksize); free(iv); iv = NULL; - RAND_bytes(in_ptr, in - in_ptr); - - in_ptr = in - blocksize*2; - outlen = blocksize*2; -- EVP_EncryptUpdate(&ctx_enc_ecb, in_ptr, -+ EVP_EncryptUpdate(ctx_enc_ecb, in_ptr, - &outlen, in_ptr, blocksize*2); - *out = in_ptr; - len = outlen; - cipher_enc_state = CIPHER_SEQUENCE; - break; -@@ -584,11 +588,11 @@ - { - case CIPHER_INIT: - in_ptr = in; - iv = malloc(blocksize); - outlen = blocksize*2; -- EVP_DecryptUpdate(&ctx_dec_ecb, in_ptr, &outlen, in_ptr, blocksize*2); -+ EVP_DecryptUpdate(ctx_dec_ecb, in_ptr, &outlen, in_ptr, blocksize*2); - - if ( !strncmp(in_ptr, "ivec", 4) ) - { - memcpy(iv, in_ptr+4, blocksize); - cipher_dec_init(iv); -@@ -627,11 +631,11 @@ - "Max. gibberish threshold reached"); - #endif - if (cipher_enc_state != CIPHER_INIT) - { - cipher_enc_state = CIPHER_INIT; -- EVP_CIPHER_CTX_cleanup(&ctx_enc); -+ EVP_CIPHER_CTX_free(ctx_enc); - #ifdef LFD_ENCRYPT_DEBUG - vtun_syslog(LOG_INFO, - "Forcing local encryptor re-init"); - #endif - } -@@ -708,11 +712,11 @@ - *len -= blocksize; - - if (cipher_enc_state != CIPHER_INIT) - { - cipher_enc_state = CIPHER_INIT; -- EVP_CIPHER_CTX_cleanup(&ctx_enc); -+ EVP_CIPHER_CTX_free(ctx_enc); - } - #ifdef LFD_ENCRYPT_DEBUG - vtun_syslog(LOG_INFO, "Remote requests encryptor re-init"); - #endif - } -@@ -722,11 +726,11 @@ - - if (cipher_dec_state != CIPHER_INIT && - cipher_enc_state != CIPHER_REQ_INIT && - cipher_enc_state != CIPHER_INIT) - { -- EVP_CIPHER_CTX_cleanup (&ctx_dec); -+ EVP_CIPHER_CTX_free (ctx_dec); - cipher_dec_state = CIPHER_INIT; - cipher_enc_state = CIPHER_REQ_INIT; - } - #ifdef LFD_ENCRYPT_DEBUG - vtun_syslog(LOG_INFO, "Local decryptor out of sync"); diff --git a/vtun.spec b/vtun.spec index dd77184..8c642de 100644 --- a/vtun.spec +++ b/vtun.spec @@ -1,6 +1,6 @@ Name: vtun Version: 3.0.4 -Release: 4%{?dist} +Release: 5%{?dist} Summary: Virtual tunnel over TCP/IP networks License: GPLv2+ Group: System Environment/Daemons @@ -10,12 +10,16 @@ Source1: vtun.socket Source2: vtun.service Source3: vtun.sysconfig Patch0: vtun-nostrip.patch -Patch1: vtun-openssl.patch Requires(post): systemd-units Requires(preun): systemd-units Requires(postun): systemd-units -BuildRequires: zlib-devel lzo-devel openssl-devel bison flex systemd-units autoconf +BuildRequires: zlib-devel lzo-devel bison flex systemd-units autoconf +%if 0%{?fedora} >= 26 +BuildRequires: compat-openssl10-devel +%else +BuildRequires: openssl-devel +%endif #enable PIE/PIC: %global _hardened_build 1 @@ -33,9 +37,6 @@ require modification to any kernel parts. %prep %setup -q %patch0 -p1 -%if 0%{?fedora} >= 26 -%patch1 -p1 -%endif %build %{__autoconf} @@ -81,6 +82,9 @@ EOT %{_mandir}/man8/vtund.8* %changelog +* Sat Sep 02 2017 Gabriel Somlo 3.0.3-5 +- remove segfaulting openssl-1.1 patch; use compat-openssl10 instead + * Sat Sep 02 2017 Gabriel Somlo 3.0.3-4 - apply openssl-1.1 patch only on Fedora >= 26, to avoid epel7 (#1487003)