← Back to branch summary

~ubuntu-branches/ubuntu/lucid/openvpn/lucid-proposed

« back to all changes in this revision

Viewing changes to debian/patches/debian_openssl_vulnkeys.patch

  • Committer: Bazaar Package Importer
  • Author(s): Andres Rodriguez
  • Date: 2009-05-05 14:25:37 UTC
  • mfrom: (1.1.12 upstream) (10.1.2 squeeze)
  • Revision ID: james.westby@ubuntu.com-20090505142537-vq38z4k80bpltxb9
Tags: 2.1~rc15-1ubuntu1
https://launchpad.net/bugs/372358
* Merge from debian unstable (LP: #372358), remaining changes:
  - debian/openvpn.init.d: 
    - Do not use start-stop-daemon and use < /dev/null to avoid blocking boot
    - show per-VPN result messages 
    - add "--script-security 2" by default for backwards compatibility
    - Added lsb-base>=3.2-14 depend to allow status_of_proc()

Show diffs side-by-side

added added

removed removed

Lines of Context:
debian/patches/debian_openssl_vulnkeys.patch
1
 
Index: trunk/init.c
 
1
Index: openvpn-2.1_rc15/init.c
2
2
===================================================================
3
 
--- trunk/init.c        (revision 56669)
4
 
+++ trunk/init.c        (working copy)
5
 
@@ -1513,6 +1513,23 @@
 
3
--- openvpn-2.1_rc15.orig/init.c        2009-04-30 12:58:46.264809894 +0200
 
4
+++ openvpn-2.1_rc15/init.c     2009-04-30 12:59:07.530865201 +0200
 
5
@@ -1536,6 +1536,23 @@
6
6
   const struct options *options = &c->options;
7
7
   ASSERT (options->shared_secret_file);
8
8
 
26
26
   init_crypto_pre (c, flags);
27
27
 
28
28
   /* Initialize packet ID tracking */
29
 
@@ -1598,6 +1615,7 @@
 
29
@@ -1621,6 +1638,7 @@
30
30
 do_init_crypto_tls_c1 (struct context *c)
31
31
 {
32
32
   const struct options *options = &c->options;
34
34
 
35
35
   if (!c->c1.ks.ssl_ctx)
36
36
     {
37
 
@@ -1634,6 +1652,53 @@
38
 
                     options->ciphername_defined, options->authname,
39
 
                     options->authname_defined, options->keysize, true, true);
 
37
@@ -1660,6 +1678,53 @@
 
38
       /* Initialize PRNG with config-specified digest */
 
39
       prng_init (options->prng_hash, options->prng_nonce_secret_len);
40
40
 
41
41
+      /* CVE-2008-0166 (Debian weak key checks)
42
42
+       * Obtain the modulus and bits from the certificate that was initialized,