FreeBSD Bugzilla – Attachment 150707 Details for
Bug 196082
[MAINTAINER] mail/heirloom-mailx: Remove SSLv2 and SSLv3 support
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
Remember
[x]
|
Forgot Password
Login:
[x]
update patch, produced with portutils
heirloom-mailx.diff (text/plain), 7.38 KB, created by
Jamie Landeg-Jones
on 2014-12-18 06:20:09 UTC
(
hide
)
Description:
update patch, produced with portutils
Filename:
MIME Type:
Creator:
Jamie Landeg-Jones
Created:
2014-12-18 06:20:09 UTC
Size:
7.38 KB
patch
obsolete
>===> Generating patch >===> Viewing diff with more >diff -ruN /tmp/mail/heirloom-mailx/Makefile ./Makefile >--- /tmp/mail/heirloom-mailx/Makefile 2014-08-05 01:20:20.000000000 +0100 >+++ ./Makefile 2014-12-18 05:50:47.000000000 +0000 >@@ -2,7 +2,7 @@ > > PORTNAME= mailx > PORTVERSION= 12.4 >-PORTREVISION= 6 >+PORTREVISION= 7 > CATEGORIES= mail ipv6 > MASTER_SITES= SF/heirloom/heirloom-${PORTNAME}/${PORTVERSION} > PKGNAMEPREFIX= heirloom- >@@ -21,6 +21,7 @@ > USE_OPENSSL= yes > MAKE_ARGS= PREFIX="${PREFIX}" \ > SYSCONFDIR="${PREFIX}/etc" \ >+ SENDMAIL="/usr/sbin/sendmail" \ > CPPFLAGS="${CPPFLAGS}" \ > LDFLAGS="${LDFLAGS}" > >diff -ruN /tmp/mail/heirloom-mailx/files/patch-mailx.1 ./files/patch-mailx.1 >--- /tmp/mail/heirloom-mailx/files/patch-mailx.1 1970-01-01 01:00:00.000000000 +0100 >+++ ./files/patch-mailx.1 2014-12-18 05:44:06.000000000 +0000 >@@ -0,0 +1,21 @@ >+--- mailx.1.orig 2007-10-01 14:00:39.000000000 +0100 >++++ mailx.1 2014-12-18 05:40:32.000000000 +0000 >+@@ -2684,8 +2684,7 @@ >+ Only applicable if SSL/TLS support is built using OpenSSL. >+ .TP >+ .B ssl-v2-allow >+-Accept SSLv2 connections. >+-These are normally not allowed >++This option now does nothing. SSLv2 connections are no longer supported >+ because this protocol version is insecure. >+ .TP >+ .B stealthmua >+@@ -3560,7 +3559,7 @@ >+ .TP >+ .B ssl-method >+ Selects a SSL/TLS protocol version; >+-valid values are `ssl2', `ssl3', and `tls1'. >++valid values are `tls1', `tls1.1', and `tls1.2'. >+ If unset, the method is selected automatically, >+ if possible. >+ .TP >diff -ruN /tmp/mail/heirloom-mailx/files/patch-mailx.1.html ./files/patch-mailx.1.html >--- /tmp/mail/heirloom-mailx/files/patch-mailx.1.html 1970-01-01 01:00:00.000000000 +0100 >+++ ./files/patch-mailx.1.html 2014-12-18 05:44:42.000000000 +0000 >@@ -0,0 +1,21 @@ >+--- mailx.1.html.orig 2008-07-28 23:33:37.000000000 +0100 >++++ mailx.1.html 2014-12-18 05:40:11.000000000 +0000 >+@@ -2954,8 +2954,7 @@ >+ </TD></TR> >+ <TR valign=top><TD colspan=2> >+ <B>ssl-v2-allow</B> </TD></TR><TR valign=top><TD width=6%> </TD><TD> >+-Accept SSLv2 connections. >+-These are normally not allowed >++This option now does nothing. SSLv2 connections are no longer supported >+ because this protocol version is insecure. >+ </TD></TR> >+ <TR valign=top><TD colspan=2> >+@@ -3892,7 +3891,7 @@ >+ <TR valign=top><TD colspan=2> >+ <B>ssl-method</B> </TD></TR><TR valign=top><TD width=6%> </TD><TD> >+ Selects a SSL/TLS protocol version; >+-valid values are 'ssl2', 'ssl3', and 'tls1'. >++valid values are 'tls1', 'tls1.1', and 'tls1.2'. >+ If unset, the method is selected automatically, >+ if possible. >+ </TD></TR> >diff -ruN /tmp/mail/heirloom-mailx/files/patch-nss.c ./files/patch-nss.c >--- /tmp/mail/heirloom-mailx/files/patch-nss.c 1970-01-01 01:00:00.000000000 +0100 >+++ ./files/patch-nss.c 2014-12-18 05:43:33.000000000 +0000 >@@ -0,0 +1,37 @@ >+--- nss.c.orig 2007-08-04 12:38:02.000000000 +0100 >++++ nss.c 2014-12-18 05:33:36.000000000 +0000 >+@@ -252,31 +252,16 @@ >+ nss_select_method(const char *uhp) >+ { >+ char *cp; >+- enum { >+- SSL2 = 01, >+- SSL3 = 02, >+- TLS1 = 03 >+- } methods; >+ >+- methods = SSL2|SSL3|TLS1; >+ cp = ssl_method_string(uhp); >+ if (cp != NULL) { >+- if (equal(cp, "ssl2")) >+- methods = SSL2; >+- else if (equal(cp, "ssl3")) >+- methods = SSL3; >+- else if (equal(cp, "tls1")) >+- methods = TLS1; >+- else { >++ if (!equal(cp, "tls1")) >++ { >+ fprintf(stderr, catgets(catd, CATSET, 244, >+ "Invalid SSL method \"%s\"\n"), cp); >+ } >+ } >+- if (value("ssl-v2-allow") == NULL) >+- methods &= ~SSL2; >+- SSL_OptionSetDefault(SSL_ENABLE_SSL2, methods&SSL2 ? PR_TRUE:PR_FALSE); >+- SSL_OptionSetDefault(SSL_ENABLE_SSL3, methods&SSL3 ? PR_TRUE:PR_FALSE); >+- SSL_OptionSetDefault(SSL_ENABLE_TLS, methods&TLS1 ? PR_TRUE:PR_FALSE); >++ SSL_OptionSetDefault(SSL_ENABLE_TLS, PR_TRUE); >+ } >+ >+ enum okay >diff -ruN /tmp/mail/heirloom-mailx/files/patch-nsserr.c ./files/patch-nsserr.c >--- /tmp/mail/heirloom-mailx/files/patch-nsserr.c 1970-01-01 01:00:00.000000000 +0100 >+++ ./files/patch-nsserr.c 2014-12-18 05:43:44.000000000 +0000 >@@ -0,0 +1,12 @@ >+--- nsserr.c.orig 2006-03-04 00:01:19.000000000 +0000 >++++ nsserr.c 2014-12-18 05:35:38.000000000 +0000 >+@@ -79,9 +79,6 @@ >+ case SSL_ERROR_POST_WARNING: >+ cp = "(unused)"; >+ break; >+- case SSL_ERROR_SSL2_DISABLED: >+- cp = "Peer only supports SSL version 2, which is locally disabled"; >+- break; >+ case SSL_ERROR_BAD_MAC_READ: >+ cp = "SSL received a record with an incorrect Message Authentication Code"; >+ break; >diff -ruN /tmp/mail/heirloom-mailx/files/patch-openssl.c ./files/patch-openssl.c >--- /tmp/mail/heirloom-mailx/files/patch-openssl.c 2014-01-22 17:40:44.000000000 +0000 >+++ ./files/patch-openssl.c 2014-12-18 05:18:38.000000000 +0000 >@@ -1,5 +1,5 @@ >---- openssl.c 2007/08/04 11:41:36 1.12 >-+++ openssl.c 2009/05/26 21:04:15 1.13 >+--- openssl.c.orig 2007-08-04 12:38:03.000000000 +0100 >++++ openssl.c 2014-12-18 04:24:05.000000000 +0000 > @@ -101,12 +101,17 @@ > static int ssl_rand_init(void); > static void ssl_init(void); >@@ -19,7 +19,7 @@ > static EVP_CIPHER *smime_cipher(const char *name); > static int ssl_password_cb(char *buf, int size, int rwflag, void *userdata); > static FILE *smime_sign_cert(const char *xname, const char *xname2, int warn); >-@@ -203,10 +208,10 @@ >+@@ -203,23 +208,23 @@ > return 1; > } > >@@ -32,6 +32,25 @@ > char *cp; > > cp = ssl_method_string(uhp); >+ if (cp != NULL) { >+- if (equal(cp, "ssl2")) >+- method = SSLv2_client_method(); >+- else if (equal(cp, "ssl3")) >+- method = SSLv3_client_method(); >+- else if (equal(cp, "tls1")) >++ if (equal(cp, "tls1")) >+ method = TLSv1_client_method(); >++ else if (equal(cp, "tls1.1")) >++ method = TLSv1_1_client_method(); >++ else if (equal(cp, "tls1.2")) >++ method = TLSv1_2_client_method(); >+ else { >+ fprintf(stderr, catgets(catd, CATSET, 244, >+- "Invalid SSL method \"%s\"\n"), cp); >++ "Invalid SSL/TLS method \"%s\"\n"), cp); >+ method = SSLv23_client_method(); >+ } >+ } else > @@ -308,7 +313,11 @@ > X509 *cert; > X509_NAME *subj; >@@ -54,7 +73,16 @@ > ssl_gen_err(catgets(catd, CATSET, 261, "SSL_CTX_new() failed")); > return STOP; > } >-@@ -496,7 +506,11 @@ >+@@ -366,8 +376,6 @@ >+ SSL_CTX_set_mode(sp->s_ctx, SSL_MODE_AUTO_RETRY); >+ #endif /* SSL_MODE_AUTO_RETRY */ >+ options = SSL_OP_ALL; >+- if (value("ssl-v2-allow") == NULL) >+- options |= SSL_OP_NO_SSLv2; >+ SSL_CTX_set_options(sp->s_ctx, options); >+ ssl_load_verifications(sp); >+ ssl_certificate(sp, uhp); >+@@ -496,7 +504,11 @@ > } > > static int >@@ -66,7 +94,7 @@ > { > struct message *x; > char *cp, *sender, *to, *cc, *cnttype; >-@@ -505,7 +519,12 @@ >+@@ -505,7 +517,12 @@ > off_t size; > BIO *fb, *pb; > PKCS7 *pkcs7; >@@ -79,7 +107,7 @@ > X509 *cert; > X509_NAME *subj; > char data[LINESIZE]; >-@@ -614,7 +633,11 @@ >+@@ -614,7 +631,11 @@ > { > int *msgvec = vp, *ip; > int ec = 0; >@@ -91,7 +119,7 @@ > X509_STORE *store; > char *ca_dir, *ca_file; > >-@@ -687,7 +710,11 @@ >+@@ -687,7 +708,11 @@ > X509 *cert; > PKCS7 *pkcs7; > BIO *bb, *yb; >@@ -103,7 +131,7 @@ > EVP_CIPHER *cipher; > > certfile = expand((char *)certfile); >-@@ -950,9 +977,14 @@ >+@@ -950,9 +975,14 @@ > off_t size; > BIO *fb, *pb; > PKCS7 *pkcs7; >diff -ruN /tmp/mail/heirloom-mailx/heirloom-mailx.diff ./heirloom-mailx.diff >--- /tmp/mail/heirloom-mailx/heirloom-mailx.diff 1970-01-01 01:00:00.000000000 +0100 >+++ ./heirloom-mailx.diff 2014-12-18 06:01:29.000000000 +0000 >@@ -0,0 +1 @@ >+===> Generating patch >====> Cleaning up >===> Done
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Raw
Actions:
View
Attachments on
bug 196082
:
150707
|
150750
|
152549