Skip to Content.
Sympa Menu

sm-commit - [SM-Commit] GIT changes to master grimoire by Vlad Glagolev (9113d69ab82b9e77d1fbae81e82a80cf692d9d10)

sm-commit AT lists.ibiblio.org

Subject: Source Mage code commit list

List archive

[SM-Commit] GIT changes to master grimoire by Vlad Glagolev (9113d69ab82b9e77d1fbae81e82a80cf692d9d10)

Chronological Thread  
    < Chronological >       < Thread >
  • From: Vlad Glagolev <scm AT sourcemage.org>
  • To: sm-commit AT lists.ibiblio.org
  • Subject: [SM-Commit] GIT changes to master grimoire by Vlad Glagolev (9113d69ab82b9e77d1fbae81e82a80cf692d9d10)
  • Date: Wed, 12 Nov 2014 09:42:33 -0600
GIT changes to master grimoire by Vlad Glagolev <stealth AT sourcemage.org>:

mail/dovecot/DEPENDS | 8 +-
mail/dovecot/DETAILS | 13 ++-
mail/dovecot/HISTORY | 12 ++-
mail/dovecot/PRE_BUILD | 3
mail/dovecot/ssl_protocols.patch | 150
+++++++++++++++++++++++++++++++++++++++
5 files changed, 175 insertions(+), 11 deletions(-)

New commits:
commit 9113d69ab82b9e77d1fbae81e82a80cf692d9d10
Author: Vlad Glagolev <stealth AT sourcemage.org>
Commit: Vlad Glagolev <stealth AT sourcemage.org>

dovecot: backported official patch from branch 2.1 to support
ssl_protocols option (allows turning off SSLv3 to mitigate POODLE attack -
CVE-2014-3566)

diff --git a/mail/dovecot/DEPENDS b/mail/dovecot/DEPENDS
index d85b7fe..e353744 100755
--- a/mail/dovecot/DEPENDS
+++ b/mail/dovecot/DEPENDS
@@ -2,12 +2,12 @@ depends libtool &&

#if [[ $DOVECOT_SSL == gnutls ]]; then
#depends gnutls "--with-ssl=gnutls"
-#elif [[ $DOVECOT_SSL == SSL ]]; then
-#depends SSL "--with-ssl=openssl"
+#elif [[ $DOVECOT_SSL == openssl ]]; then
+#depends openssl "--with-ssl=openssl"
#fi &&

-optional_depends SSL \
- '--with-ssl=SSL' \
+optional_depends SSL \
+ '--with-ssl=openssl' \
'--without-ssl' \
'Enable SSL support' &&
optional_depends zlib \
diff --git a/mail/dovecot/DETAILS b/mail/dovecot/DETAILS
index 38be93e..8550eac 100755
--- a/mail/dovecot/DETAILS
+++ b/mail/dovecot/DETAILS
@@ -11,15 +11,18 @@ if [[ "$DOVECOT_PIGEONHOLE" == "y" ]]; then
PATCHLEVEL=11
SOURCE3=$SPELL-${VERSION%.*}-pigeonhole-$VERSION2.tar.gz
SOURCE4=$SPELL-${VERSION%.*}-pigeonhole-$VERSION2.tar.gz.sig
- SOURCE3_URL[0]=http://www.rename-it.nl/dovecot/${VERSION%.*}/$SOURCE3
- SOURCE4_URL[0]=http://www.rename-it.nl/dovecot/${VERSION%.*}/$SOURCE4
+
SOURCE3_URL[0]=http://pigeonhole.dovecot.org/releases/${VERSION%.*}/$SOURCE3
+
SOURCE4_URL[0]=http://pigeonhole.dovecot.org/releases/${VERSION%.*}/$SOURCE4
SOURCE4_IGNORE=signature
SOURCE3_GPG="dovecot.gpg:${SOURCE4}:UPSTREAM_KEY"
fi
-SOURCE_DIRECTORY=$BUILD_DIRECTORY/$SPELL-$VERSION
+SOURCE_DIRECTORY="$BUILD_DIRECTORY/$SPELL-$VERSION"
ENTERED=20030224
- SECURITY_PATCH=6
- LICENSE[0]=LGPL2.1/LGPL2/MIT/BSD/PublicDomain
+ SECURITY_PATCH=7
+ LICENSE[0]=LGPL
+ LICENSE[1]=MIT
+ LICENSE[2]=BSD
+ LICENSE[3]=PD
WEB_SITE=http://www.dovecot.org/
KEYWORDS="mail"
SHORT='dovecot is a secure imap/pop3 daemon'
diff --git a/mail/dovecot/HISTORY b/mail/dovecot/HISTORY
index 0ad7de7..3df741c 100644
--- a/mail/dovecot/HISTORY
+++ b/mail/dovecot/HISTORY
@@ -1,5 +1,13 @@
-2014-08-19 Treeve Jelbert <treeve AT sourcemage.org>
- * DEPENDS: openssl => SSL
+2014-11-12 Vlad Glagolev <stealth AT sourcemage.org>
+ * DETAILS: SECURITY_PATCH++ (allows turning off SSLv3); quoting paths;
+ unfold LICENSE; updated source urls for pigeonhole
+ * DEPENDS: corrected ssl flag
+ * PRE_BUILD: apply patch
+ * ssl_protocols.patch: added, backported official (406a1d52390b)
+ patch to branch 2.0
+
+2014-08-19 Treeve Jelbert <treeve AT sourcemage.org>
+ * DEPENDS: openssl => SSL

2013-01-29 Vlad Glagolev <stealth AT sourcemage.org>
* DETAILS: updated spell to 2.0.21; SECURITY_PATCH++ (fixes several
diff --git a/mail/dovecot/PRE_BUILD b/mail/dovecot/PRE_BUILD
index bb97586..bdabc87 100755
--- a/mail/dovecot/PRE_BUILD
+++ b/mail/dovecot/PRE_BUILD
@@ -1,5 +1,8 @@
default_pre_build &&
cd $SOURCE_DIRECTORY &&
+
+patch -p0 < "$SPELL_DIRECTORY/ssl_protocols.patch" &&
+
if [[ "$DOVECOT_PIGEONHOLE" == "y" ]]; then
unpack_file 3
fi
diff --git a/mail/dovecot/ssl_protocols.patch
b/mail/dovecot/ssl_protocols.patch
new file mode 100644
index 0000000..d400652
--- /dev/null
+++ b/mail/dovecot/ssl_protocols.patch
@@ -0,0 +1,150 @@
+--- doc/example-config/conf.d/10-ssl.conf.orig 2011-12-13 14:38:27.000000000
+0300
++++ doc/example-config/conf.d/10-ssl.conf 2014-11-12 17:02:11.099183165
+0300
+@@ -37,5 +37,8 @@
+ # entirely.
+ #ssl_parameters_regenerate = 168
+
++# SSL protocols to use
++#ssl_protocols = !SSLv2 !SSLv3
++
+ # SSL ciphers to use
+ #ssl_cipher_list = ALL:!LOW:!SSLv2:!EXP:!aNULL
+--- src/login-common/login-settings.c.orig 2012-02-09 20:32:48.000000000
+0300
++++ src/login-common/login-settings.c 2014-11-12 17:04:31.862715871 +0300
+@@ -31,6 +31,7 @@
+ DEF(SET_STR, ssl_key),
+ DEF(SET_STR, ssl_key_password),
+ DEF(SET_STR, ssl_cipher_list),
++ DEF(SET_STR, ssl_protocols),
+ DEF(SET_STR, ssl_cert_username_field),
+ DEF(SET_STR, ssl_client_cert),
+ DEF(SET_STR, ssl_client_key),
+@@ -62,6 +63,7 @@
+ .ssl_key = "",
+ .ssl_key_password = "",
+ .ssl_cipher_list = "ALL:!LOW:!SSLv2:!EXP:!aNULL",
++ .ssl_protocols = "!SSLv2 !SSLv3",
+ .ssl_cert_username_field = "commonName",
+ .ssl_client_cert = "",
+ .ssl_client_key = "",
+--- src/login-common/login-settings.h.orig 2012-02-09 20:32:48.000000000
+0300
++++ src/login-common/login-settings.h 2014-11-12 17:04:57.913369657 +0300
+@@ -13,6 +13,7 @@
+ const char *ssl_key;
+ const char *ssl_key_password;
+ const char *ssl_cipher_list;
++ const char *ssl_protocols;
+ const char *ssl_cert_username_field;
+ const char *ssl_client_cert;
+ const char *ssl_client_key;
+--- src/login-common/ssl-proxy-openssl.c.orig 2012-05-14 21:08:02.000000000
+0300
++++ src/login-common/ssl-proxy-openssl.c 2014-11-12 17:15:30.299304760
+0300
+@@ -88,6 +88,7 @@
+ const char *key;
+ const char *ca;
+ const char *cipher_list;
++ const char *protocols;
+ bool verify_client_cert;
+ };
+
+@@ -139,6 +140,8 @@
+ return 1;
+ if (null_strcmp(ctx1->cipher_list, ctx2->cipher_list) != 0)
+ return 1;
++ if (null_strcmp(ctx1->protocols, ctx2->protocols) != 0)
++ return 1;
+
+ return ctx1->verify_client_cert == ctx2->verify_client_cert ? 0 : 1;
+ }
+@@ -606,6 +609,7 @@
+ lookup_ctx.key = set->ssl_key;
+ lookup_ctx.ca = set->ssl_ca;
+ lookup_ctx.cipher_list = set->ssl_cipher_list;
++ lookup_ctx.protocols = set->ssl_protocols;
+ lookup_ctx.verify_client_cert = set->ssl_verify_client_cert;
+
+ ctx = hash_table_lookup(ssl_servers, &lookup_ctx);
+@@ -1021,8 +1025,7 @@
+
+ /* enable all SSL workarounds, except empty fragments as it
+ makes SSL more vulnerable against attacks */
+- SSL_CTX_set_options(ssl_ctx, SSL_OP_NO_SSLv2 |
+- (SSL_OP_ALL &
~SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS));
++ SSL_CTX_set_options(ssl_ctx, SSL_OP_ALL &
~SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS);
+ #ifdef SSL_MODE_RELEASE_BUFFERS
+ SSL_CTX_set_mode(ssl_ctx, SSL_MODE_RELEASE_BUFFERS);
+ #endif
+@@ -1196,6 +1199,57 @@
+ }
+ #endif
+
++enum {
++ DOVECOT_SSL_PROTO_SSLv2 = 0x01,
++ DOVECOT_SSL_PROTO_SSLv3 = 0x02,
++ DOVECOT_SSL_PROTO_TLSv1 = 0x04,
++ DOVECOT_SSL_PROTO_ALL = 0x07
++};
++
++static void
++ssl_proxy_ctx_set_protocols(struct ssl_server_context *ssl_ctx,
++ const char *protocols)
++{
++ const char *const *tmp;
++ int proto, op = 0, include = 0, exclude = 0;
++ bool neg;
++
++ tmp = t_strsplit_spaces(protocols, " ");
++ for (; *tmp != NULL; tmp++) {
++ const char *name = *tmp;
++
++ if (*name != '!')
++ neg = FALSE;
++ else {
++ name++;
++ neg = TRUE;
++ }
++ if (strcasecmp(name, SSL_TXT_SSLV2) == 0)
++ proto = DOVECOT_SSL_PROTO_SSLv2;
++ else if (strcasecmp(name, SSL_TXT_SSLV3) == 0)
++ proto = DOVECOT_SSL_PROTO_SSLv3;
++ else if (strcasecmp(name, SSL_TXT_TLSV1) == 0)
++ proto = DOVECOT_SSL_PROTO_TLSv1;
++ else {
++ i_fatal("Invalid ssl_protocols setting: "
++ "Unknown protocol '%s'", name);
++ }
++ if (neg)
++ exclude |= proto;
++ else
++ include |= proto;
++ }
++ if (include != 0) {
++ /* exclude everything, except those that are included
++ (and let excludes still override those) */
++ exclude |= DOVECOT_SSL_PROTO_ALL & ~include;
++ }
++ if ((exclude & DOVECOT_SSL_PROTO_SSLv2) != 0) op |= SSL_OP_NO_SSLv2;
++ if ((exclude & DOVECOT_SSL_PROTO_SSLv3) != 0) op |= SSL_OP_NO_SSLv3;
++ if ((exclude & DOVECOT_SSL_PROTO_TLSv1) != 0) op |= SSL_OP_NO_TLSv1;
++ SSL_CTX_set_options(ssl_ctx->ctx, op);
++}
++
+ static struct ssl_server_context *
+ ssl_server_context_init(const struct login_settings *set)
+ {
+@@ -1211,6 +1265,7 @@
+ ctx->key = p_strdup(pool, set->ssl_key);
+ ctx->ca = p_strdup(pool, set->ssl_ca);
+ ctx->cipher_list = p_strdup(pool, set->ssl_cipher_list);
++ ctx->protocols = p_strdup(pool, set->ssl_protocols);
+ ctx->verify_client_cert = set->ssl_verify_client_cert;
+
+ ctx->ctx = ssl_ctx = SSL_CTX_new(SSLv23_server_method());
+@@ -1222,6 +1277,7 @@
+ i_fatal("Can't set cipher list to '%s': %s",
+ ctx->cipher_list, ssl_last_error());
+ }
++ ssl_proxy_ctx_set_protocols(ctx, ctx->protocols);
+
+ if (ssl_proxy_ctx_use_certificate_chain(ctx->ctx, ctx->cert) != 1) {
+ i_fatal("Can't load ssl_cert: %s",


  • [SM-Commit] GIT changes to master grimoire by Vlad Glagolev (9113d69ab82b9e77d1fbae81e82a80cf692d9d10), Vlad Glagolev, 11/12/2014

Archive powered by MHonArc 2.6.24.

Top of Page