This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "IPFire 2.x development tree".

The branch, master has been updated via 165b25b2dc8fce3dbba64711eab1eed709ffb0a5 (commit) via 09e3b0fa356c087b27ca7197024bf0210455a73c (commit) from 3ec88e97cdcafe2818fec9826e46dc08a35ca9c3 (commit)

Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below.

- Log ----------------------------------------------------------------- commit 165b25b2dc8fce3dbba64711eab1eed709ffb0a5 Author: Christoph Anderegg christoph@christoph-anderegg.ch Date: Mon Mar 2 22:10:13 2015 +0100

vpnmain.cgi: Added inclusion of ipsec.user-post.conf to the end of ipsec.conf in order to allow connection parameters to be overwritten in ipsec.user.conf.

commit 09e3b0fa356c087b27ca7197024bf0210455a73c Author: Michael Tremer michael.tremer@ipfire.org Date: Fri May 16 17:13:19 2014 +0200

pound: Allow to use legacy renegotiation.

-----------------------------------------------------------------------

Summary of changes: html/cgi-bin/vpnmain.cgi | 8 ++++++++ lfs/pound | 3 ++- src/patches/pound-2.7-legacy-regnegotiation.patch | 25 +++++++++++++++++++++++ 3 files changed, 35 insertions(+), 1 deletion(-) create mode 100644 src/patches/pound-2.7-legacy-regnegotiation.patch

Difference in files: diff --git a/html/cgi-bin/vpnmain.cgi b/html/cgi-bin/vpnmain.cgi index f5ec500..d86a613 100644 --- a/html/cgi-bin/vpnmain.cgi +++ b/html/cgi-bin/vpnmain.cgi @@ -437,6 +437,14 @@ sub writeipsecfiles { } print CONF "\n"; }#foreach key + + # Add post user includes to config file + # After the GUI-connections allows to patch connections. + if (-e "/etc/ipsec.user-post.conf") { + print CONF "include /etc/ipsec.user-post.conf\n"; + print CONF "\n"; + } + print SECRETS $last_secrets if ($last_secrets); close(CONF); close(SECRETS); diff --git a/lfs/pound b/lfs/pound index a0f6f29..52fb293 100644 --- a/lfs/pound +++ b/lfs/pound @@ -32,7 +32,7 @@ DL_FROM = $(URL_IPFIRE) DIR_APP = $(DIR_SRC)/$(THISAPP) TARGET = $(DIR_INFO)/$(THISAPP) PROG = pound -PAK_VER = 7 +PAK_VER = 8

DEPS = ""

@@ -77,6 +77,7 @@ $(subst %,%_MD5,$(objects)) : $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects)) @$(PREBUILD) @rm -rf $(DIR_APP) && cd $(DIR_SRC) && tar zxf $(DIR_DL)/$(DL_FILE) + cd $(DIR_APP) && patch -p1 -i $(DIR_SRC)/src/patches/pound-2.7-legacy-regnegotiation.patch cd $(DIR_APP) && ./configure --prefix=/usr --sysconfdir=/etc cd $(DIR_APP) && make $(MAKETUNING) cd $(DIR_APP) && make install diff --git a/src/patches/pound-2.7-legacy-regnegotiation.patch b/src/patches/pound-2.7-legacy-regnegotiation.patch new file mode 100644 index 0000000..eb1d772 --- /dev/null +++ b/src/patches/pound-2.7-legacy-regnegotiation.patch @@ -0,0 +1,25 @@ +diff -Nur Pound-2.7c-vanilla/config.c Pound-2.7c/config.c +--- Pound-2.7c-vanilla/config.c 2014-04-21 13:16:08.000000000 +0200 ++++ Pound-2.7c/config.c 2014-05-16 12:57:33.273583192 +0200 +@@ -345,8 +345,10 @@ + #ifdef SSL_OP_NO_COMPRESSION + SSL_CTX_set_options(res->ctx, SSL_OP_NO_COMPRESSION); + #endif ++#if 0 + SSL_CTX_clear_options(res->ctx, SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION); + SSL_CTX_clear_options(res->ctx, SSL_OP_LEGACY_SERVER_CONNECT); ++#endif + sprintf(lin, "%d-Pound-%ld", getpid(), random()); + SSL_CTX_set_session_id_context(res->ctx, (unsigned char *)lin, strlen(lin)); + SSL_CTX_set_tmp_rsa_callback(res->ctx, RSA_tmp_callback); +@@ -368,8 +370,10 @@ + #ifdef SSL_OP_NO_COMPRESSION + SSL_CTX_set_options(res->ctx, SSL_OP_NO_COMPRESSION); + #endif ++#if 0 + SSL_CTX_clear_options(res->ctx, SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION); + SSL_CTX_clear_options(res->ctx, SSL_OP_LEGACY_SERVER_CONNECT); ++#endif + sprintf(lin, "%d-Pound-%ld", getpid(), random()); + SSL_CTX_set_session_id_context(res->ctx, (unsigned char *)lin, strlen(lin)); + SSL_CTX_set_tmp_rsa_callback(res->ctx, RSA_tmp_callback);

hooks/post-receive -- IPFire 2.x development tree