1 |
commit: b986809e95f5466c28c66132dac475c5b04884ba |
2 |
Author: Michael Orlitzky <mjo <AT> gentoo <DOT> org> |
3 |
AuthorDate: Wed Aug 24 00:29:01 2016 +0000 |
4 |
Commit: Michael Orlitzky <mjo <AT> gentoo <DOT> org> |
5 |
CommitDate: Wed Aug 24 00:32:55 2016 +0000 |
6 |
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=b986809e |
7 |
|
8 |
net-misc/tn5250: new revision sans SSLv2/SSLv3 support. |
9 |
|
10 |
This new revision adds two custom patches. The first drops SSLv2/SSLv3 |
11 |
support by disabling the user's ability to specify "ssl2" or "ssl3" as |
12 |
his "ssl_method". The fallback "auto" should still work and choose |
13 |
something secure. |
14 |
|
15 |
The second patch fixes the build with -Werror=format-security and |
16 |
consists of trivial format string additions. |
17 |
|
18 |
Gentoo-Bug: 591940 |
19 |
|
20 |
Package-Manager: portage-2.2.28 |
21 |
|
22 |
.../tn5250/files/disable-sslv2-and-sslv3.patch | 61 +++++++++++++++++++++ |
23 |
.../files/fix-Wformat-security-warnings.patch | 62 ++++++++++++++++++++++ |
24 |
net-misc/tn5250/tn5250-0.17.4-r2.ebuild | 62 ++++++++++++++++++++++ |
25 |
3 files changed, 185 insertions(+) |
26 |
|
27 |
diff --git a/net-misc/tn5250/files/disable-sslv2-and-sslv3.patch b/net-misc/tn5250/files/disable-sslv2-and-sslv3.patch |
28 |
new file mode 100644 |
29 |
index 00000000..9c8d04f |
30 |
--- /dev/null |
31 |
+++ b/net-misc/tn5250/files/disable-sslv2-and-sslv3.patch |
32 |
@@ -0,0 +1,61 @@ |
33 |
+From 1acfebd966e8804e6573cbe9287b8b6f028a646c Mon Sep 17 00:00:00 2001 |
34 |
+From: Michael Orlitzky <michael@××××××××.com> |
35 |
+Date: Tue, 23 Aug 2016 18:13:47 -0400 |
36 |
+Subject: [PATCH 1/1] sslstream.c: ignore the user's choice of ssl_method. |
37 |
+ |
38 |
+The SSLv2 and SSLv3 protocols are insecure, and people have begun to |
39 |
+operate without them. LibreSSL, for example, does not have them |
40 |
+enabled, and it is possible to build OpenSSL in the same manner. |
41 |
+ |
42 |
+If SSLv[23] are disabled, the user would not be able to choose "ssl2" |
43 |
+or "ssl3" as his "ssl_method", an option that was undocumented |
44 |
+anywhere. Therefore there is not much lost, and some security to gain, |
45 |
+by removing the option completely. This commit does that, and uses the |
46 |
+automatic protocol choice that is capable of negotiating TLSv1, |
47 |
+TLSv1.1 and TLSv1.2. |
48 |
+ |
49 |
+Gentoo-Bug: 591940 |
50 |
+--- |
51 |
+ lib5250/sslstream.c | 26 ++++++++++---------------- |
52 |
+ 1 file changed, 10 insertions(+), 16 deletions(-) |
53 |
+ |
54 |
+diff --git a/lib5250/sslstream.c b/lib5250/sslstream.c |
55 |
+index 7181566..2f91d1a 100644 |
56 |
+--- a/lib5250/sslstream.c |
57 |
++++ b/lib5250/sslstream.c |
58 |
+@@ -362,22 +362,16 @@ int tn5250_ssl_stream_init (Tn5250Stream *This) |
59 |
+ |
60 |
+ /* which SSL method do we use? */ |
61 |
+ |
62 |
+- strcpy(methstr,"auto"); |
63 |
+- if (This->config!=NULL && tn5250_config_get (This->config, "ssl_method")) { |
64 |
+- strncpy(methstr, tn5250_config_get (This->config, "ssl_method"), 4); |
65 |
+- methstr[4] = '\0'; |
66 |
+- } |
67 |
+- |
68 |
+- if (!strcmp(methstr, "ssl2")) { |
69 |
+- meth = SSLv2_client_method(); |
70 |
+- TN5250_LOG(("SSL Method = SSLv2_client_method()\n")); |
71 |
+- } else if (!strcmp(methstr, "ssl3")) { |
72 |
+- meth = SSLv3_client_method(); |
73 |
+- TN5250_LOG(("SSL Method = SSLv3_client_method()\n")); |
74 |
+- } else { |
75 |
+- meth = SSLv23_client_method(); |
76 |
+- TN5250_LOG(("SSL Method = SSLv23_client_method()\n")); |
77 |
+- } |
78 |
++ /* Ignore the user's choice of ssl_method (which isn't documented |
79 |
++ * anyway...) if it was either "ssl2" or "ssl3". Both are insecure, |
80 |
++ * and this is only safe supported method left. |
81 |
++ * |
82 |
++ * This is a Gentoo-specific modification that lets us build |
83 |
++ * against LibreSSL and newer OpenSSL with its insecure protocols |
84 |
++ * disabled. |
85 |
++ */ |
86 |
++ meth = SSLv23_client_method(); |
87 |
++ TN5250_LOG(("SSL Method = SSLv23_client_method()\n")); |
88 |
+ |
89 |
+ /* create a new SSL context */ |
90 |
+ |
91 |
+-- |
92 |
+2.7.3 |
93 |
+ |
94 |
|
95 |
diff --git a/net-misc/tn5250/files/fix-Wformat-security-warnings.patch b/net-misc/tn5250/files/fix-Wformat-security-warnings.patch |
96 |
new file mode 100644 |
97 |
index 00000000..4927bce |
98 |
--- /dev/null |
99 |
+++ b/net-misc/tn5250/files/fix-Wformat-security-warnings.patch |
100 |
@@ -0,0 +1,62 @@ |
101 |
+From 1bc9cac45be4bac46f58e325779bdb8c7b7bf502 Mon Sep 17 00:00:00 2001 |
102 |
+From: Michael Orlitzky <michael@××××××××.com> |
103 |
+Date: Tue, 23 Aug 2016 20:20:15 -0400 |
104 |
+Subject: [PATCH 1/1] Fix format-security warnings. |
105 |
+ |
106 |
+Newer versions of GCC have the ability to warn you (or throw errors) |
107 |
+about insecure format strings. Generally this is due to an omitted |
108 |
+format string in the printf family of functions, and a few of those |
109 |
+issues existed in the code base. They were all fixed by adding a |
110 |
+trivial "%s" format string. The project now builds with |
111 |
+-Werror=format-security. |
112 |
+--- |
113 |
+ curses/cursesterm.c | 4 ++-- |
114 |
+ lib5250/sslstream.c | 2 +- |
115 |
+ lib5250/telnetstr.c | 2 +- |
116 |
+ 3 files changed, 4 insertions(+), 4 deletions(-) |
117 |
+ |
118 |
+diff --git a/curses/cursesterm.c b/curses/cursesterm.c |
119 |
+index bf20f05..3032966 100644 |
120 |
+--- a/curses/cursesterm.c |
121 |
++++ b/curses/cursesterm.c |
122 |
+@@ -640,9 +640,9 @@ static void curses_terminal_update(Tn5250Terminal * This, Tn5250Display *display |
123 |
+ if(This->data->is_xterm) { |
124 |
+ if (This->data->font_132!=NULL) { |
125 |
+ if (tn5250_display_width (display)>100) |
126 |
+- printf(This->data->font_132); |
127 |
++ printf("%s", This->data->font_132); |
128 |
+ else |
129 |
+- printf(This->data->font_80); |
130 |
++ printf("%s", This->data->font_80); |
131 |
+ } |
132 |
+ printf ("\x1b[8;%d;%dt", tn5250_display_height (display)+1, |
133 |
+ tn5250_display_width (display)); |
134 |
+diff --git a/lib5250/sslstream.c b/lib5250/sslstream.c |
135 |
+index 2f91d1a..7f3009e 100644 |
136 |
+--- a/lib5250/sslstream.c |
137 |
++++ b/lib5250/sslstream.c |
138 |
+@@ -307,7 +307,7 @@ static void ssl_log_SB_buf(unsigned char *buf, int len) |
139 |
+ |
140 |
+ if (!tn5250_logfile) |
141 |
+ return; |
142 |
+- fprintf(tn5250_logfile,ssl_getTelOpt(type=*buf++)); |
143 |
++ fprintf(tn5250_logfile,"%s",ssl_getTelOpt(type=*buf++)); |
144 |
+ switch (c=*buf++) { |
145 |
+ case IS: |
146 |
+ fputs("<IS>",tn5250_logfile); |
147 |
+diff --git a/lib5250/telnetstr.c b/lib5250/telnetstr.c |
148 |
+index 9ad2624..cf1576f 100644 |
149 |
+--- a/lib5250/telnetstr.c |
150 |
++++ b/lib5250/telnetstr.c |
151 |
+@@ -282,7 +282,7 @@ static void log_SB_buf(unsigned char *buf, int len) |
152 |
+ |
153 |
+ if (!tn5250_logfile) |
154 |
+ return; |
155 |
+- fprintf(tn5250_logfile,getTelOpt(type=*buf++)); |
156 |
++ fprintf(tn5250_logfile,"%s",getTelOpt(type=*buf++)); |
157 |
+ switch (c=*buf++) { |
158 |
+ case IS: |
159 |
+ fputs("<IS>",tn5250_logfile); |
160 |
+-- |
161 |
+2.7.3 |
162 |
+ |
163 |
|
164 |
diff --git a/net-misc/tn5250/tn5250-0.17.4-r2.ebuild b/net-misc/tn5250/tn5250-0.17.4-r2.ebuild |
165 |
new file mode 100644 |
166 |
index 00000000..7d7db50 |
167 |
--- /dev/null |
168 |
+++ b/net-misc/tn5250/tn5250-0.17.4-r2.ebuild |
169 |
@@ -0,0 +1,62 @@ |
170 |
+# Copyright 1999-2016 Gentoo Foundation |
171 |
+# Distributed under the terms of the GNU General Public License v2 |
172 |
+# $Id$ |
173 |
+ |
174 |
+EAPI=6 |
175 |
+inherit eutils |
176 |
+ |
177 |
+DESCRIPTION="IBM AS/400 telnet client which emulates 5250 terminals/printers" |
178 |
+HOMEPAGE="http://tn5250.sourceforge.net/" |
179 |
+SRC_URI="mirror://sourceforge/${PN}/${P}.tar.gz" |
180 |
+ |
181 |
+LICENSE="LGPL-2.1" |
182 |
+SLOT="0" |
183 |
+KEYWORDS="~amd64 ~ppc ~sparc ~x86" |
184 |
+IUSE="X libressl ssl" |
185 |
+ |
186 |
+RDEPEND=" |
187 |
+ sys-libs/ncurses:= |
188 |
+ ssl? ( |
189 |
+ !libressl? ( dev-libs/openssl:0= ) |
190 |
+ libressl? ( dev-libs/libressl:0= ) |
191 |
+ ) |
192 |
+" |
193 |
+ |
194 |
+DEPEND="${RDEPEND} |
195 |
+ X? ( x11-libs/libXt ) |
196 |
+" |
197 |
+ |
198 |
+PATCHES=( |
199 |
+ "${FILESDIR}/disable-sslv2-and-sslv3.patch" |
200 |
+ "${FILESDIR}/fix-Wformat-security-warnings.patch" |
201 |
+) |
202 |
+ |
203 |
+src_prepare() { |
204 |
+ default |
205 |
+ |
206 |
+ # Next, the Makefile for the terminfo settings tries to remove |
207 |
+ # some files it doesn't have access to. We can just remove those |
208 |
+ # lines. |
209 |
+ sed -i \ |
210 |
+ -e "/rm -f \/usr\/.*\/terminfo.*5250/d" linux/Makefile.in \ |
211 |
+ || die "sed Makefile.in failed" |
212 |
+} |
213 |
+ |
214 |
+src_configure() { |
215 |
+ econf \ |
216 |
+ --disable-static \ |
217 |
+ --without-python \ |
218 |
+ $(use_with X x) \ |
219 |
+ $(use_with ssl) |
220 |
+} |
221 |
+ |
222 |
+src_install() { |
223 |
+ # The TERMINFO variable needs to be defined for the install |
224 |
+ # to work, because the install calls "tic." man tic for |
225 |
+ # details. |
226 |
+ dodir /usr/share/terminfo |
227 |
+ emake DESTDIR="${D}" TERMINFO="${D}/usr/share/terminfo" install |
228 |
+ |
229 |
+ einstalldocs |
230 |
+ prune_libtool_files |
231 |
+} |