[ptxdist] [PATCHv2 1/2] strongswan: version bump 5.2.2 -> 5.3.2

[ptxdist] [PATCHv2 1/2] strongswan: version bump 5.2.2 -> 5.3.2

[Bruno Thomsen]

This fixes the EAP or PSK IKEv2 authentication vulnerability aka CVE-2015-4171.
Added new configure options: aesni, connmark, forecast, ruby-gems and python-eggs.
Removed obsolete unit-tester option.

Version 2:
Disabled configure options: ruby-gems-install, python-eggs-install and files.
Fixed typo in subject.

Signed-off-by: Bruno Thomsen <bth@kamstrup.com>
---
 rules/strongswan.make | 14 ++++++++++----
 1 file changed, 10 insertions(+), 4 deletions(-)

diff --git a/rules/strongswan.make b/rules/strongswan.make
index 5e4a76d..2cc0a69 100644
--- a/rules/strongswan.make
+++ b/rules/strongswan.make
@@ -17,8 +17,8 @@ PACKAGES-$(PTXCONF_STRONGSWAN) += strongswan
 #
 # Paths and names
 #
-STRONGSWAN_VERSION	:= 5.2.2
-STRONGSWAN_MD5		:= 7ee1a33060b2bde35be0f6d78a1d26d0
+STRONGSWAN_VERSION	:= 5.3.2
+STRONGSWAN_MD5		:= fab014be1477ef4ebf9a765e10f8802c
 STRONGSWAN		:= strongswan-$(STRONGSWAN_VERSION)
 STRONGSWAN_SUFFIX	:= tar.bz2
 STRONGSWAN_URL		:= http://download.strongswan.org/$(STRONGSWAN).$(STRONGSWAN_SUFFIX)
@@ -43,6 +43,7 @@ STRONGSWAN_CONF_OPT	:= \
 	--disable-blowfish \
 	--disable-md4 \
 	--enable-md5 \
+	--disable-aesni \
 	--enable-sha1 \
 	--enable-sha2 \
 	--enable-fips-prf \
@@ -80,7 +81,6 @@ STRONGSWAN_CONF_OPT	:= \
 	--disable-sql \
 	--disable-leak-detective \
 	--disable-lock-profiler \
-	--disable-unit-tester \
 	--disable-load-tester \
 	--disable-dnscert \
 	--disable-eap-sim \
@@ -170,6 +170,8 @@ STRONGSWAN_CONF_OPT	:= \
 	--disable-lookip \
 	--disable-error-notify \
 	--disable-certexpire \
+	--disable-connmark \
+	--disable-forecast \
 	--disable-systime-fix \
 	--disable-led \
 	--disable-duplicheck \
@@ -178,8 +180,12 @@ STRONGSWAN_CONF_OPT	:= \
 	--disable-monolithic \
 	--disable-bfd-backtraces \
 	--disable-unwind-backtraces \
+	--disable-ruby-gems \
+	--disable-ruby-gems-install \
+	--disable-python-eggs \
+	--disable-python-eggs-install \
+	--disable-files \
 	--disable-coverage \
-	--disable-unit-tester \
 	--disable-tkm \
 	--disable-defaults \
 	--enable-dependency-tracking \
-- 
2.1.4


-- 
ptxdist mailing list
ptxdist@pengutronix.de

[ptxdist] [PATCHv2 2/2] strongswan: removed md5 hash and des encryption support.

[Bruno Thomsen]

Removed legacy crypto support.

Version 2: no changes.

Signed-off-by: Bruno Thomsen <bth@kamstrup.com>
---
 rules/strongswan.make | 6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)

diff --git a/rules/strongswan.make b/rules/strongswan.make
index 2cc0a69..9a9dd40 100644
--- a/rules/strongswan.make
+++ b/rules/strongswan.make
@@ -39,10 +39,10 @@ STRONGSWAN_CONF_OPT	:= \
 	--disable-soup \
 	--disable-ldap \
 	--enable-aes \
-	--enable-des \
+	--disable-des \
 	--disable-blowfish \
 	--disable-md4 \
-	--enable-md5 \
+	--disable-md5 \
 	--disable-aesni \
 	--enable-sha1 \
 	--enable-sha2 \
@@ -205,14 +205,12 @@ STRONGSWAN_PLUGINS := \
 	libstrongswan-attr.so \
 	libstrongswan-cmac.so \
 	libstrongswan-constraints.so \
-	libstrongswan-des.so \
 	libstrongswan-dnskey.so \
 	libstrongswan-fips-prf.so \
 	libstrongswan-gcm.so \
 	libstrongswan-gmp.so \
 	libstrongswan-hmac.so \
 	libstrongswan-kernel-netlink.so \
-	libstrongswan-md5.so \
 	libstrongswan-nonce.so \
 	libstrongswan-pem.so \
 	libstrongswan-pgp.so \
-- 
2.1.4


-- 
ptxdist mailing list
ptxdist@pengutronix.de

Re: [ptxdist] [PATCHv2 1/2] strongswan: version bump 5.2.2 -> 5.3.2

[Christoph Fritz]

Hey Bruno

On Wed, 2015-07-01 at 11:46 +0200, Bruno Thomsen wrote:
>  # Paths and names
>  #
> -STRONGSWAN_VERSION	:= 5.2.2
> -STRONGSWAN_MD5		:= 7ee1a33060b2bde35be0f6d78a1d26d0
> +STRONGSWAN_VERSION	:= 5.3.2
> +STRONGSWAN_MD5		:= fab014be1477ef4ebf9a765e10f8802c
>  STRONGSWAN		:= strongswan-$(STRONGSWAN_VERSION)
>  STRONGSWAN_SUFFIX	:= tar.bz2
>  STRONGSWAN_URL		:= http://download.strongswan.org/$(STRONGSWAN).$(STRONGSWAN_SUFFIX)

Changing here to https to get this security related package would be
nice.

By the way, is there any work in the pipe to get PGP-Signature
verification into ptxdist instead of "md5summing"? 

 Thanks
  -- Christoph


-- 
ptxdist mailing list
ptxdist@pengutronix.de

Re: [ptxdist] [PATCHv2 1/2] strongswan: version bump 5.2.2 -> 5.3.2

[Bruno Thomsen]

Hi Christoph,

> >  STRONGSWAN_URL		:= http://download.strongswan.org/$(STRONGSWAN).$(STRONGSWAN_SUFFIX)
>
> Changing here to https to get this security related package would be nice.

Yes, I just tested https and it works flawlessly.
I will send it as a new patch so it's highlighted in ptxdist short log, that packages should preferably be downloaded from https/ftps urls.

> By the way, is there any work in the pipe to get PGP-Signature verification into ptxdist instead of "md5summing"? 

Yes, PGP-signature verification could be nice. Would you bundle all public keys in ptxdist git repo?

An easy step stone could be to add SHA256 hash support in ptxdist. 

Pseudo code:
if STRONGSWAN_SHA256 exist:
	hash = sha256sum STRONGSWAN_SOURCE
	return (hash == STRONGSWAN_SHA256)
else
	hash = md5sum STRONGSWAN_SOURCE
	return (hash == STRONGSWAN_MD5)


After looking at how the md5 hash check is performed, I think it's easier to add sha256 hashes to all rules and then change hash function.

/Bruno
-- 
ptxdist mailing list
ptxdist@pengutronix.de

Re: [ptxdist] [PATCHv2 1/2] strongswan: version bump 5.2.2 -> 5.3.2

[Michael Olbrich]

On Tue, Jul 07, 2015 at 01:07:46PM +0000, Bruno Thomsen wrote:
> > >  STRONGSWAN_URL		:= http://download.strongswan.org/$(STRONGSWAN).$(STRONGSWAN_SUFFIX)
> >
> > Changing here to https to get this security related package would be nice.
> 
> Yes, I just tested https and it works flawlessly.
> I will send it as a new patch so it's highlighted in ptxdist short log, that packages should preferably be downloaded from https/ftps urls.
> 
> > By the way, is there any work in the pipe to get PGP-Signature verification into ptxdist instead of "md5summing"? 
> 
> Yes, PGP-signature verification could be nice. Would you bundle all public keys in ptxdist git repo?
> 
> An easy step stone could be to add SHA256 hash support in ptxdist. 
> 
> Pseudo code:
> if STRONGSWAN_SHA256 exist:
> 	hash = sha256sum STRONGSWAN_SOURCE
> 	return (hash == STRONGSWAN_SHA256)
> else
> 	hash = md5sum STRONGSWAN_SOURCE
> 	return (hash == STRONGSWAN_MD5)
> 
> 
> After looking at how the md5 hash check is performed, I think it's easier to
> add sha256 hashes to all rules and then change hash function.

I think we can just add another argument to ptxd_make_check_src /
ptxd_make_check_src_impl for the sha256sum. Then we can change the packages
on by one.

Michael

-- 
Pengutronix e.K.                           |                             |
Industrial Linux Solutions                 | http://www.pengutronix.de/  |
Peiner Str. 6-8, 31137 Hildesheim, Germany | Phone: +49-5121-206917-0    |
Amtsgericht Hildesheim, HRA 2686           | Fax:   +49-5121-206917-5555 |

-- 
ptxdist mailing list
ptxdist@pengutronix.de