summaryrefslogtreecommitdiffstats
path: root/package/strongswan
Commit message (Collapse)AuthorAgeFilesLines
* strongswan: add upstream security fix for CVE-2018-17540Peter Korsgaard2018-10-032-1/+3
| | | | | | | | | The fix for CVE-2018-16151 / 16152 contained an exploitable bug. For details, see: https://www.strongswan.org/blog/2018/10/01/strongswan-vulnerability-(cve-2018-17540).html Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* strongswan: add upstream security patchPeter Korsgaard2018-10-012-0/+3
| | | | | | | | | | | | | | | | Fixes the following security issues: CVE-2018-16151: The OID parser in the ASN.1 code in gmp allows any number of random bytes after a valid OID. CVE-2018-16152: The algorithmIdentifier parser in the ASN.1 code in gmp doesn't enforce a NULL value for the optional parameter which is not used with any PKCS#1 algorithm. For more details, see the advisory: https://www.strongswan.org/blog/2018/09/24/strongswan-vulnerability-(cve-2018-16151,-cve-2018-16152).html Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* package/strongswan: install dev headersMatt Weber2018-09-201-1/+3
| | | | | | | | | | Adds '--with-dev-headers' configure option to install development headers into staging. The package provides these headers to enable linking against pluggins. Signed-off-by: Paresh Chaudhary <paresh.chaudhary@rockwellcollins.com> Signed-off-by: Matthew Weber <matthew.weber@rockwellcollins.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
* strongswan: bump to version 5.6.3Paresh Chaudhary2018-06-234-98/+4
| | | | | | Signed-off-by: Paresh Chaudhary <paresh.chaudhary@rockwellcollins.com> Signed-off-by: Matt Weber <matthew.weber@rockwellcollins.com> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* package/*/Config.in: fix help text check-package warningsThomas Petazzoni2017-12-181-4/+6
| | | | | | | | | | | | | This commit fixes the warnings reported by check-package on the help text of all package Config.in files, related to the formatting of the help text: should start with a tab, then 2 spaces, then at most 62 characters. The vast majority of warnings fixed were caused by too long lines. A few warnings were related to spaces being used instead of a tab to indent the help text. Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
* package/strongswan: Install libraries to /usr/libSam Voss2017-12-131-1/+4
| | | | | | | | Install strongswan ipsec libraries into /usr/lib instead of /usr/lib/ipsec to place them in preferred library common location. Signed-off-by: Sam Voss <sam.voss@rockwellcollins.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
* strongswan: add missing include of stdint.hMatt Weber2017-10-031-0/+32
| | | | | | | | | | | Recent releases of glibc don't include the full stdint.h header in some network headers included by utils.h. Upstream is targetting a 5.6.1 release of the fix. Ustream: https://wiki.strongswan.org/issues/2425 Signed-off-by: Matthew Weber <matthew.weber@rockwellcollins.com> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* strongswan: add upstream security patchPeter Korsgaard2017-09-082-1/+5
| | | | | | | | | | | | | Fixes CVE-2017-11185: The gmp plugin in strongSwan before 5.6.0 allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a crafted RSA signature. For more details, see https://www.strongswan.org/blog/2017/08/14/strongswan-vulnerability-%28cve-2017-11185%29.html While we're at it, add hashes for the license files. Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* strongswan: add upstream security patchesPeter Korsgaard2017-05-302-0/+6
| | | | | | | | | | | | | | | | | | | | | | Fixes: CVE-2017-9022 - RSA public keys passed to the gmp plugin aren't validated sufficiently before attempting signature verification, so that invalid input might lead to a floating point exception and crash of the process. A certificate with an appropriately prepared public key sent by a peer could be used for a denial-of-service attack. https://www.strongswan.org/blog/2017/05/30/strongswan-vulnerability-%28cve-2017-9022%29.html CVE-2017-9023 - ASN.1 CHOICE types are not correctly handled by the ASN.1 parser when parsing X.509 certificates with extensions that use such types. This could lead to infinite looping of the thread parsing a specifically crafted certificate. https://www.strongswan.org/blog/2017/05/30/strongswan-vulnerability-%28cve-2017-9023%29.html Signed-off-by: Peter Korsgaard <peter@korsgaard.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
* strongswan: fix crypt() redefinitionBaruch Siach2017-05-111-0/+55
| | | | | | | | | | | | | | Add patch from upstream pending pull request (#72) to fix crypt() definition conflict. Fixes: http://autobuild.buildroot.net/results/612/6120add5ad6e7f5d575fc2a2442cd7fe5302eb46/ http://autobuild.buildroot.net/results/ba1/ba1298e71ef28857654ae8d4593d09e4fe8cdda0/ http://autobuild.buildroot.net/results/6b9/6b928e2a6a35bfb21c792fca083bc4cbdaef9304/ Cc: Jérôme Pouiller <jezz@sysmic.org> Signed-off-by: Baruch Siach <baruch@tkos.co.il> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
* package/s*/Config.in: fix ordering of statementsAdam Duskett2017-05-021-2/+2
| | | | | | | | | | | | | The check-package script when ran gives warnings on ordering issues on all of these Config files. This patch cleans up all warnings related to the ordering in the Config files for packages starting with the letter s in the package directory. The appropriate ordering is: type, default, depends on, select, help See http://nightly.buildroot.org/#_config_files for more information. Signed-off-by: Adam Duskett <Adamduskett@outlook.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
* boot, linux, package: use SPDX short identifier for GPLv2/GPLv2+Rahul Bedarkar2017-04-011-1/+1
| | | | | | | | | | | We want to use SPDX identifier for license strings as much as possible. SPDX short identifier for GPLv2/GPLv2+ is GPL-2.0/GPL-2.0+. This change is done by using following command. find . -name "*.mk" | xargs sed -ri '/LICENSE( )?[\+:]?=/s/\<GPLv2\>/GPL-2.0/g' Signed-off-by: Rahul Bedarkar <rahulbedarkar89@gmail.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
* package/libgpg-error: bump to version 1.23Jörg Krause2016-07-041-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch is based on a patch sent by Vicente Olivert Riera and commented by Arnout Vandecappelle [1]. - Bump version to 1.23 - Add a hook to fix cross-compilation - Fix license and license files - Remove patch applied upstream - Add a BR2_PACKAGE_LIBGPG_ERROR_ARCH_SUPPORTS variable - Propagate the dependencies using that variable: * package/cppcms * package/crda * package/gnupg2 - package/gcr - package/midori * package/kodi * package/libaacs * package/libassuan * package/libgcrypt * package/libgpgme * package/libksba * package/libmicrohttpd - package/janus-gateway - package/kodi - package/ola - package/systemd * package/libssh * package/libssh2 - package/php-ssh2 * package/netatalk * package/network-manager * package/ntfs-3g * package/opkg * package/php-gnupg * package/rng-tools * package/strongswan * package/vpnc [1] http://patchwork.ozlabs.org/patch/416427/ Cc: Arnout Vandecappelle <arnout@mind.be> Cc: Vicente Olivert Riera <Vincent.Riera@imgtec.com> Signed-off-by: Jörg Krause <joerg.krause@embedded.rocks> [Thomas: - rebase on master - changing systemd no longer needed, as it no longer selects libgcrypt.] Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com> [Maxime: - rebase on master - bump to new version - propagate dependencies to missing packages] Signed-off-by: Maxime Hadjinlian <maxime.hadjinlian@gmail.com> Reviewed-by: Romain Naour <romain.naour@gmail.com> [Thomas: - fix hash file. - change the way to handle the various arch so that it works properly for uClibc. - add nios2 arch support. - Maxime Hadjinlian learned some basic Emacs-fu to do the final fixups of this commit.] Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
* strongswan: needs __atomic operationsThomas Petazzoni2016-05-242-0/+6
| | | | | | | | | | | strongswan uses the __atomic_*() intrinsics, so we make it depend on BR2_TOOLCHAIN_HAS_ATOMIC and link with libatomic when available. This allows to fix the build on SPARC, therefore fixing: http://autobuild.buildroot.org/results/7e090237801874fb889c76f84863dc4c2ca20450/ Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* strongswan: disable iptables supportWaldemar Brodkorb2016-04-131-7/+2
| | | | | | | | | | | | | | | | | There is a new conflict between Linux header (linux/if.h) and C library header (net/if.h) introduced by this commit to the Linux kernel: 1ffad83dffd675cd742286ae82dca7d746cb0da8 Mikko Rapeli is working on a solution, but it requires changes to the Linux kernel and C library. For now I would just disable the iptables feature in Strongswan. The changes fixes following autobuild error: http://autobuild.buildroot.net/results/e1693a714eb690988c1798b733d0ff143e50b3b9/ Signed-off-by: Waldemar Brodkorb <wbx@openadk.org> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
* strongswan: update to 5.4.0Waldemar Brodkorb2016-04-132-4/+4
| | | | | | | Update to 5.4.0 Signed-off-by: Waldemar Brodkorb <wbx@openadk.org> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
* strongswan: unavailable for static buildsGustavo Zacarias2016-02-011-2/+3
| | | | | | | | Uses dlopen in plugin_loader (not optional), fixes: http://autobuild.buildroot.net/results/601/601d8dc1654d8733db49b195139e12437663034c/ Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
* strongswan: bump to version 5.3.5Gustavo Zacarias2015-11-262-4/+4
| | | | | | | | Fixes only one connection regresssion in 5.3.4, see https://wiki.strongswan.org/issues/1213 Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* strongswan: security bump to version 5.3.4Gustavo Zacarias2015-11-162-4/+4
| | | | | | | | | | | Fixes: CVE-2015-8023 - authentication bypass vulnerability in the eap-mschapv2 plugin that was caused by insufficient verification of the internal state when handling EAP-MSCHAPv2 Success messages received by the client. Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
* strongswan: bump to version 5.3.3Gustavo Zacarias2015-09-072-3/+5
| | | | | | | Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar> Reviewed-by: Vicente Olivert Riera <Vincent.Riera@imgtec.com> Tested-by: Vicente Olivert Riera <Vincent.Riera@imgtec.com> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* strongswan: security bump to version 5.3.2Gustavo Zacarias2015-06-092-3/+3
| | | | | | | | | | | Fixes: CVE-2015-4171 - rogue servers with a valid certificate accepted by the client to trick it into disclosing its username and even password (if the client accepts EAP-GTC). Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
* strongswan: security bump to version 5.3.1Gustavo Zacarias2015-06-022-3/+3
| | | | | | | | | | | | Fixes: CVE-2015-3991 - denial-of-service and potential remote code execution vulnerability triggered by IKEv1/IKEv2 messages that contain payloads for the respective other IKE version. other IKE version Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* packages: remove non-IPv6 dependencies and tweaksGustavo Zacarias2015-04-222-5/+2
| | | | | | | | Now that IPv6 is mandatory remove package dependencies and conditionals for it. Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
* strongswan: bump to version 5.3.0Gustavo Zacarias2015-04-082-3/+15
| | | | | | | | | | Enable connmark and forecast plugins when iptables is selected. And always enable the led plugin, though it's not new to 5.3.0. [Thomas: also update hash file.] Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
* strongswan: kill unnecessary whitespaceGustavo Zacarias2015-04-081-46/+46
| | | | | Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
* strongswan: security bump to version 5.2.2Gustavo Zacarias2015-01-063-7/+20
| | | | | | | | | | Fixes CVE-2014-9221 - denial-of-service vulnerability triggered by an IKEv2 Key Exchange payload that contains the Diffie-Hellman group 1025. Also add hash file. Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
* Rename BR2_PREFER_STATIC_LIB to BR2_STATIC_LIBSThomas Petazzoni2014-12-111-1/+1
| | | | | | | | | | | | | | | | | | | | | | | Since a while, the semantic of BR2_PREFER_STATIC_LIB has been changed from "prefer static libraries when possible" to "use only static libraries". The former semantic didn't make much sense, since the user had absolutely no control/idea of which package would use static libraries, and which packages would not. Therefore, for quite some time, we have been starting to enforce that BR2_PREFER_STATIC_LIB should really build everything with static libraries. As a consequence, this patch renames BR2_PREFER_STATIC_LIB to BR2_STATIC_LIBS, and adjust the Config.in option accordingly. This also helps preparing the addition of other options to select shared, shared+static or just static. Note that we have verified that this commit can be reproduced by simply doing a global rename of BR2_PREFER_STATIC_LIB to BR2_STATIC_LIBS plus adding BR2_PREFER_STATIC_LIB to Config.in.legacy. Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com> Reviewed-by: "Yann E. MORIN" <yann.morin.1998@free.fr>
* package: indentation cleanupJerzy Grzegorek2014-10-261-48/+48
| | | | | Signed-off-by: Jerzy Grzegorek <jerzy.grzegorek@trzebnica.net> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* packages: rename FOO_CONF_OPT into FOO_CONF_OPTSThomas De Schampheleire2014-10-041-2/+2
| | | | | | | | | | | | To be consistent with the recent change of FOO_MAKE_OPT into FOO_MAKE_OPTS, make the same change for FOO_CONF_OPT. Sed command used: find * -type f | xargs sed -i 's#_CONF_OPT\>#&S#g' Signed-off-by: Thomas De Schampheleire <thomas.de.schampheleire@gmail.com> Reviewed-by: "Yann E. MORIN" <yann.morin.1998@free.fr> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
* strongswan: bump to version 5.1.3Gustavo Zacarias2014-06-026-190/+1
| | | | | Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* strongswan: only show comment if applicablePeter Korsgaard2014-03-111-0/+1
| | | | | | strongswan needs USE_MMU, so only show comment if that is available. Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* pcsc-lite: not available for static buildsVicente Olivert Riera2014-03-111-0/+1
| | | | | | | | | | | | This package requires dlopen and checks for it in the configure phase. If it's not present, then the build process is stopped. Fixes: http://autobuild.buildroot.net/results/34b/34b83c3ea4a8aac6aeda225e5859bd318b13a676/ [Peter: propagate deps to reverse dependencies, merge toolchain comments] Signed-off-by: Vicente Olivert Riera <Vincent.Riera@imgtec.com> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* strongswan: needs threadsGustavo Zacarias2014-02-251-0/+4
| | | | | | | | Fixes: http://autobuild.buildroot.net/results/e23/e2394705545dad8e33ffc558df518014c15f5271/ Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* package: fixup dependencies after mysql_client -> mysql renamePeter Korsgaard2014-01-222-2/+2
| | | | Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* strongswan: add security patchesGustavo Zacarias2013-11-013-0/+83
| | | | | | | Security patches to fix CVE-2013-5018, CVE-2013-6075 and CVE-2013-6076. Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
* Config.in files: unify comments of toolchain option dependenciesThomas De Schampheleire2013-10-141-1/+1
| | | | | | | | This patch lines up the comments in Config.in files that clarify which toolchain options the package depends on. Signed-off-by: Thomas De Schampheleire <thomas.de.schampheleire@gmail.com> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* strongswan: fix build failure when host == target architectureThomas Petazzoni2013-08-301-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | The strongswan configure.in uses the AC_LIB_PREFIX macro, which adds --with-lib-prefix and --without-lib-prefix options, and which, by default assumes that adding ${prefix}/lib to LDFLAGS and ${prefix}/include to CPPFLAGS is a good idea. Obviously, when cross-compiling, it is definitely not a good idea. In the specific case of strongswan, the result is that when testing if the backtrace() function was available, the small C program was being built and linked with -L/usr/lib. So when the host architecture and target architecture are identical, it may find the backtrace() function in the host C library, without looking at the target C library: configure:16457: /home/test/outputs/a637f916962b6136dd6dd4f4b9ff4e1cab568ef3/output/host/usr/bin/x86_64-unknown-linux-uclibc-gcc -o conftest -D_LARGEFILE_SOURCE -D_LARGEFILE64_SOURCE -D_FILE_OFFSET_BITS=64 -pipe -Os -D_LARGEFILE_SOURCE -D_LARGEFILE64_SOURCE -D_FILE_OFFSET_BITS=64 -L/usr/lib conftest.c >&5 /home/test/outputs/a637f916962b6136dd6dd4f4b9ff4e1cab568ef3/output/host/opt/ext-toolchain/bin/../lib/gcc/x86_64-unknown-linux-uclibc/4.6.3/../../../../x86_64-unknown-linux-uclibc/bin/ld: warning: libc.so.0, needed by /home/test/outputs/a637f916962b6136dd6dd4f4b9ff4e1cab568ef3/output/host/opt/ext-toolchain/bin/../lib/gcc/x86_64-unknown-linux-uclibc/4.6.3/../../../../x86_64-unknown-linux-uclibc/lib/../lib64/libgcc_s.so, may conflict with libc.so.6 Passing --without-lib-prefix prevents this default behavior from happening, and no stupid value is added to CPPFLAGS or LDFLAGS. Fixes: http://autobuild.buildroot.net/results/a637f916962b6136dd6dd4f4b9ff4e1cab568ef3/ Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com> Signed-off-by: Peter Korsgaard <jacmet@sunsite.dk>
* strongswan: fix typo in tnccs_20 dependenciesJérôme Pouiller2013-08-221-0/+26
| | | | | | | | | | | | | It looks like there is a typing error in dependencies of tnccs_20 in strongswan configure script. Add a patch to solve it. Resolve issues detected here: http://autobuild.buildroot.net/results/b069e304c42660e7f7eba0b358f95dbaf879df64 http://autobuild.buildroot.net/results/7355ddbaa213f4fcfd1b6d37b25bed1aab525723 Signed-off-by: Jérôme Pouiller <jezz@sysmic.org> Tested-by: Thomas De Schampheleire <thomas.de.schampheleire@gmail.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
* strongswan: fix build error 'no rule to make target libtls.la'Thomas De Schampheleire2013-08-102-0/+80
| | | | | | | | | | | | In some strongswan configurations, an implicit dependency could be missing. This commit patches strongswan to force this dependency when needed. Fixes several autobuild failures, like: http://autobuild.buildroot.net/results/643f5b33973d5b12ffe6d84254bf3be9ed81d0ad/ http://autobuild.buildroot.net/results/24bcdcb83119e416c92458fa9ff2f5269957a743/ Signed-off-by: Thomas De Schampheleire <thomas.de.schampheleire@gmail.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
* strongswan: needs host-pkgconfThomas De Schampheleire2013-08-101-0/+1
| | | | | | Signed-off-by: Thomas De Schampheleire <thomas.de.schampheleire@gmail.com> Tested-by: Jérôme Pouiller <jezz@sysmic.org> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
* strongswan: scripts need charon or toolsGustavo Zacarias2013-07-311-0/+1
| | | | | | | | Fixes: http://autobuild.buildroot.net/results/007/007e75362cbe4693e36d5a7ab96c539d1f3b00fc/ Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
* strongswan: security bump to version 5.0.4Gustavo Zacarias2013-07-311-1/+1
| | | | | | | Fixes CVE-2013-2944. Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
* strongswan: new packageJérôme Pouiller2013-07-292-0/+183
strongSwan is an OpenSource IPsec implementation for the Linux operating system. It is based on the discontinued FreeS/WAN project and the X.509 patch. Signed-off-by: Jérôme Pouiller <jezz@sysmic.org> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
OpenPOWER on IntegriCloud