vyos-strongswan.git, branch 1.3.4

cert-cache: Prevent crash due to integer overflow/sign change

2021-11-24T15:17:39+00:00

random() allocates values in the range [0, RAND_MAX], with RAND_MAX usually equaling INT_MAX = 2^31-1. Previously, values between 0 and 31 were added directly to that offset before applying`% CACHE_SIZE` to get an index into the cache array. If the random value was very high, this resulted in an integer overflow and a negative index value and, therefore, an out-of-bounds access of the array and in turn dereferencing invalid pointers when trying to acquire the read lock. This most likely results in a segmentation fault. Fixes: 764e8b2211ce ("reimplemented certificate cache") Fixes: CVE-2021-41991 Signed-off-by: Daniil Baturin

Update package version

2021-11-24T12:08:50+00:00

Reject RSASSA-PSS params with negative salt length

2021-11-24T01:06:33+00:00

The `salt_len` member in the struct is of type `ssize_t` because we use negative values for special automatic salt lengths when generating signatures. Not checking this could lead to an integer overflow. The value is assigned to the `len` field of a chunk (`size_t`), which is further used in calculations to check the padding structure and (if that is passed by a matching crafted signature value) eventually a memcpy() that will result in a segmentation fault. Fixes: a22316520b91 ("signature-params: Add functions to parse/build ASN.1 RSASSA-PSS params") Fixes: 7d6b81648b2d ("gmp: Add support for RSASSA-PSS signature verification") Fixes: CVE-2021-41990 Signed-off-by: Daniil Baturin

Jenkins: use build library from proper branch "equuleus"

2021-04-04T15:36:58+00:00

Jenkins: T2625: migrate to build library

2020-06-24T16:24:59+00:00

dmvpn: add required patches for FRR NHRP implementation

2020-06-11T23:00:19+00:00

Patches are not active. To activate bth patches add their corresponding file name to debian/patches/series. From FRR docs: nhrpd needs tight integration with IKE daemon for various reasons. Currently only strongSwan is supported as IKE daemon. nhrpd connects to strongSwan using VICI protocol based on UNIX socket (hardcoded now as /var/run/charon.vici). strongSwan currently needs few patches applied. Please check out bot git - https://git.alpinelinux.org/user/tteras/strongswan/log/?h=tteras-release - https://git.alpinelinux.org/user/tteras/strongswan/log/?h=tteras repositories for the patches.

Jenkins: T1870: support GitHub PullRequest builds

2020-03-21T17:27:30+00:00

Jenkins: make pipeline branch independent

2019-12-27T15:02:27+00:00

Jenkins: adjust to new Debian Buster build

2019-12-18T15:29:19+00:00

Jenkins: import Pipeline from vyos-1x commit 2d3539f9dec1

2019-10-09T20:35:03+00:00