Created attachment 223348 [details] Patch to update security/nettle to 3.7.1 Update to 3.7.1 Changes: https://git.lysator.liu.se/nettle/nettle/-/blob/nettle_3.7.1_release_20210217/ChangeLog Fixes bug #247646
Created attachment 223349 [details] Patch to update security/nettle to 3.7.1 Mark content as patch
Note that 3.7.2 with further bug and security fixes has been released in the meanwhile.
Comment on attachment 223349 [details] Patch to update security/nettle to 3.7.1 we should go all the way to 3.7.2 instead
Security: 80f9dbd3-8eec-11eb-b9e8-3525f51429a0 This is now in VuXML. Commit r569321. https://svnweb.freebsd.org/ports/head/security/vuxml/vuln.xml?r1=569321&r2=569320&pathrev=569321
Created attachment 223640 [details] patch to update nettle to 3.7.2 This patch updates nettle to 3.7.2, fixing security bugs.
@jhixson - John, net/libstorj does not compile with nettle 3.7.2. I am not sure if it does with 3.6. Please check libstorj and prepare it for the nettle 3.7.2 update. [00:00:42] =======================<phase: build >============================ [00:00:42] ===> Building for libstorj-1.0.3_4 [00:00:42] gmake[1]: Entering directory '/wrkdirs/usr/ports/net/libstorj/work/libstorj-1.0.3' [00:00:42] Making all in src [00:00:42] gmake[2]: Entering directory '/wrkdirs/usr/ports/net/libstorj/work/libstorj-1.0.3/src' [00:00:42] cc -DPACKAGE_NAME=\"libstorj\" -DPACKAGE_TARNAME=\"libstorj\" -DPACKAGE_VERSION=\"1.0.3\" -DPACKAGE_STRING=\"libstorj\ 1.0.3\" -DPACKAGE_BUGREPORT=\"\" -DPACKAGE_URL=\"\" -DPACKAGE=\"libstorj\" -DVERSION=\"1.0.3\" -DSTDC_HEADERS=1 -DHAVE_SYS_TYPES_H=1 -DHAVE_SYS_STAT_H=1 -DHAVE_STDLIB_H=1 -DHAVE_STRING_H=1 -DHAVE_MEMORY_H=1 -DHAVE_STRINGS_H=1 -DHAVE_INTTYPES_H=1 -DHAVE_STDINT_H=1 -DHAVE_UNISTD_H=1 -DHAVE_DLFCN_H=1 -DLT_OBJDIR=\".libs/\" -DHAVE_CURL_CURL_H=1 -DHAVE_NETTLE_AES_H=1 -DHAVE_JSON_C_JSON_H=1 -DHAVE_UV_H=1 -DHAVE_MICROHTTPD_H=1 -DHAVE_ALIGNED_ALLOC=1 -DHAVE_POSIX_MEMALIGN=1 -DHAVE_POSIX_FALLOCATE=1 -I. -isystem /usr/local/include -O2 -pipe -fstack-protector-strong -isystem /usr/local/include -fno-strict-aliasing -std=gnu99 -O3 -MT cli.o -MD -MP -MF .deps/cli.Tpo -c -o cli.o cli.c [00:00:42] mv -f .deps/cli.Tpo .deps/cli.Po [00:00:42] /bin/sh ../libtool --tag=CC --mode=compile cc -DPACKAGE_NAME=\"libstorj\" -DPACKAGE_TARNAME=\"libstorj\" -DPACKAGE_VERSION=\"1.0.3\" -DPACKAGE_STRING=\"libstorj\ 1.0.3\" -DPACKAGE_BUGREPORT=\"\" -DPACKAGE_URL=\"\" -DPACKAGE=\"libstorj\" -DVERSION=\"1.0.3\" -DSTDC_HEADERS=1 -DHAVE_SYS_TYPES_H=1 -DHAVE_SYS_STAT_H=1 -DHAVE_STDLIB_H=1 -DHAVE_STRING_H=1 -DHAVE_MEMORY_H=1 -DHAVE_STRINGS_H=1 -DHAVE_INTTYPES_H=1 -DHAVE_STDINT_H=1 -DHAVE_UNISTD_H=1 -DHAVE_DLFCN_H=1 -DLT_OBJDIR=\".libs/\" -DHAVE_CURL_CURL_H=1 -DHAVE_NETTLE_AES_H=1 -DHAVE_JSON_C_JSON_H=1 -DHAVE_UV_H=1 -DHAVE_MICROHTTPD_H=1 -DHAVE_ALIGNED_ALLOC=1 -DHAVE_POSIX_MEMALIGN=1 -DHAVE_POSIX_FALLOCATE=1 -I. -isystem /usr/local/include -O2 -pipe -fstack-protector-strong -isystem /usr/local/include -fno-strict-aliasing -std=gnu99 -O3 -MT storj.lo -MD -MP -MF .deps/storj.Tpo -c -o storj.lo storj.c [00:00:43] libtool: compile: cc -DPACKAGE_NAME=\"libstorj\" -DPACKAGE_TARNAME=\"libstorj\" -DPACKAGE_VERSION=\"1.0.3\" "-DPACKAGE_STRING=\"libstorj 1.0.3\"" -DPACKAGE_BUGREPORT=\"\" -DPACKAGE_URL=\"\" -DPACKAGE=\"libstorj\" -DVERSION=\"1.0.3\" -DSTDC_HEADERS=1 -DHAVE_SYS_TYPES_H=1 -DHAVE_SYS_STAT_H=1 -DHAVE_STDLIB_H=1 -DHAVE_STRING_H=1 -DHAVE_MEMORY_H=1 -DHAVE_STRINGS_H=1 -DHAVE_INTTYPES_H=1 -DHAVE_STDINT_H=1 -DHAVE_UNISTD_H=1 -DHAVE_DLFCN_H=1 -DLT_OBJDIR=\".libs/\" -DHAVE_CURL_CURL_H=1 -DHAVE_NETTLE_AES_H=1 -DHAVE_JSON_C_JSON_H=1 -DHAVE_UV_H=1 -DHAVE_MICROHTTPD_H=1 -DHAVE_ALIGNED_ALLOC=1 -DHAVE_POSIX_MEMALIGN=1 -DHAVE_POSIX_FALLOCATE=1 -I. -isystem /usr/local/include -O2 -pipe -fstack-protector-strong -isystem /usr/local/include -fno-strict-aliasing -std=gnu99 -O3 -MT storj.lo -MD -MP -MF .deps/storj.Tpo -c storj.c -fPIC -DPIC -o .libs/storj.o [00:00:43] In file included from storj.c:2: [00:00:43] In file included from ./http.h:20: [00:00:43] ./crypto.h:43:6: error: conflicting types for 'nettle_pbkdf2_hmac_sha512' [00:00:43] void pbkdf2_hmac_sha512(unsigned key_length, [00:00:43] ^ [00:00:43] /usr/local/include/nettle/pbkdf2.h:49:28: note: expanded from macro 'pbkdf2_hmac_sha512' [00:00:43] #define pbkdf2_hmac_sha512 nettle_pbkdf2_hmac_sha512 [00:00:43] ^ [00:00:43] /usr/local/include/nettle/pbkdf2.h:91:1: note: previous declaration is here [00:00:43] pbkdf2_hmac_sha512 (size_t key_length, const uint8_t *key, [00:00:43] ^ [00:00:43] /usr/local/include/nettle/pbkdf2.h:49:28: note: expanded from macro 'pbkdf2_hmac_sha512' [00:00:43] #define pbkdf2_hmac_sha512 nettle_pbkdf2_hmac_sha512 [00:00:43] ^ [00:00:43] 1 error generated. [00:00:43] gmake[2]: *** [Makefile:524: storj.lo] Error 1 [00:00:43] gmake[2]: Leaving directory '/wrkdirs/usr/ports/net/libstorj/work/libstorj-1.0.3/src' [00:00:43] gmake[1]: *** [Makefile:457: all-recursive] Error 1 [00:00:43] gmake[1]: Leaving directory '/wrkdirs/usr/ports/net/libstorj/work/libstorj-1.0.3' [00:00:43] *** Error code 1 [00:00:43] [00:00:43] Stop. [00:00:43] make: stopped in /usr/ports/net/libstorj
Changelog of 3.7.2: https://git.lysator.liu.se/nettle/nettle/-/blob/nettle_3.7.2_release_20210321/ChangeLog Cc'ing portmgr@ and ports-secteam@. Intend to invoke maintainer timeout and commit on March 31st already due to security impact. Ports that directly depend on nettle: biology/ncbi-blast+ biology/ncbi-toolkit devel/opendht devel/pijul dns/dnsmasq dns/dnsmasq-devel emulators/qemu emulators/qemu-cheri emulators/qemu-devel emulators/qemu31 emulators/qemu41 emulators/qemu42 emulators/qemu50 ftp/filezilla ftp/libfilezilla games/supertuxkart graphics/aseprite mail/claws-mail mail/mailfromd multimedia/gstreamer1-plugins-hls multimedia/libav net-p2p/ncdc net/chrony net/libstorj net/ocserv net/radcli net/radsecproxy net/rdesktop security/bitwarden_rs security/gnutls security/libkpass security/sequoia sysutils/rdup www/epiphany www/lighttpd
Comment on attachment 223640 [details] patch to update nettle to 3.7.2 Note that my 3.7.2 update patch addresses a few other issues: - avoid EXAMPLES on FreeBSD 11 if building with base OpenSSL (1.0.2 in 11.4) because the nettle benchmark/example require OpenSSL 1.1.0 or newer. - where EXAMPLES can build, set USES=ssl and set include path properly for the ports OpenSSL implementation (LibreSSL apparently works at a brief glance, but I won't support it) - rearrange and reformat with portclippy/portfmt - add TEST_TARGET so that "make test" just works. Test builds of ports directly requiring nettle ongoing (that's how I figured the libstorj failure). Watch comments for updates.
[00:13:00] ====> Running Q/A tests (stage-qa) [00:13:00] Warning: 'bin/bitwarden_rs' is not stripped consider trying INSTALL_TARGET=install-strip or using ${STRIP_CMD} [00:13:02] ====> Checking for pkg-plist issues (check-plist) [00:13:02] ===> Parsing plist [00:13:02] ===> Checking for items in STAGEDIR missing from pkg-plist [00:13:02] ===> Checking for items in pkg-plist which are not in STAGEDIR [00:13:02] Error: Missing: etc/rc.d/bitwarden_rs [00:13:02] ===> Error: Plist issues found. [00:13:02] *** Error code 1 [00:13:02] [00:13:02] Stop. [00:13:02] make: stopped in /usr/ports/security/bitwarden_rs [00:13:02] =>> Error: check-plist failures detected [00:13:03] =>> Cleaning up wrkdir [00:13:06] ===> Cleaning for bitwarden_rs-1.19.0
Whoops. This does not belong here. Unrelated to nettle. Please discuss at https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=254605
Created attachment 223644 [details] incremental patch for net/libstorj compatibility with newer nettle versions since 3.7.1. (In reply to Matthias Andree from comment #6) @jhixson - John, it would seem that libstorj's local crypto.h and crypto.c define their own pbkdf2_hmac_sha512() function that has a similar but not identical signature to nettle, and it might need to be patched out, or renamed along with its caller in src/bip39.c. This attached patch fixes compilation, but I cannot run-time test it. It "should work" because the Nettle and the Libstorj crypto.? interfaces look caller-compatible and as long as the prototypes are being used properly, everything should be fine.
Created attachment 223645 [details] patch v2 to update nettle to 3.7.2 vs 1st patch, * drop the FreeBSD-to-EXAMPLES logic and make OpenSSL an option that implies EXAMPLES, as proposed in https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=247646, so that the other EXAMPLES can be had on FreeBSD 11. * deorbit static libraries
(In reply to Matthias Andree from comment #7) no further fallout observed that is traceable to the nettle upgrade itself.
security/linux-c7-nettle/ is at 2.7.1 but <https://www.freshports.org/security/linux-c7-nettle/> not marked as vulnerable. Is 2.7.1 truly not vulnerable?
Barring further investigation, and after seeing that the NEWS file mentions ECDSA signatures were new in 2.7, I am now marking linux-c7-nettle vulnerable and adding its maintainer to Cc:. emulation@ colleagues, please check.
A commit references this bug: Author: mandree Date: Sun Mar 28 21:37:55 UTC 2021 New revision: 569416 URL: https://svnweb.freebsd.org/changeset/ports/569416 Log: security/linux-c7-nettle: mark vulnerable, too See https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=254355#c14 PR: 254355 Reported by: Graham Perrin <grahamperrin@gmail.com> Changes: head/security/vuxml/vuln.xml
A commit references this bug: Author: sunpoet Date: Tue Mar 30 19:16:47 UTC 2021 New revision: 569585 URL: https://svnweb.freebsd.org/changeset/ports/569585 Log: Fix build with nettle 3.7.2 PR: 254355 Submitted by: mandree Changes: head/net/libstorj/files/ head/net/libstorj/files/patch-src_crypto.c head/net/libstorj/files/patch-src_crypto.h
(In reply to commit-hook from comment #17) does this work by itself? I only tested with nettle 3.7.2 and was thinking that libstorj and nettle be updated simulaneously. My apologies for not writing this down.
(In reply to Matthias Andree from comment #18) I finalized my nettle 3.7 update to 3.7.2 and committed it as r569572. Later, I patched examples/nettle-openssl.c to build examples on both OpenSSL versions in r569597.
A commit references this bug: Author: sunpoet Date: Tue Mar 30 21:06:17 UTC 2021 New revision: 569599 URL: https://svnweb.freebsd.org/changeset/ports/569599 Log: MFH: r569585 Fix build with nettle 3.7.2 PR: 254355 Submitted by: mandree Changes: _U branches/2021Q1/ branches/2021Q1/net/libstorj/files/
Committed. Thanks!