[git.ipfire.org] IPFire 2.x development tree branch, master, updated. 165b25b2dc8fce3dbba64711eab1eed709ffb0a5

[git@ipfire.org]

[-- Attachment #1: Type: text/plain, Size: 4537 bytes --]

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "IPFire 2.x development tree".

The branch, master has been updated
       via  165b25b2dc8fce3dbba64711eab1eed709ffb0a5 (commit)
       via  09e3b0fa356c087b27ca7197024bf0210455a73c (commit)
      from  3ec88e97cdcafe2818fec9826e46dc08a35ca9c3 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 165b25b2dc8fce3dbba64711eab1eed709ffb0a5
Author: Christoph Anderegg <christoph(a)christoph-anderegg.ch>
Date:   Mon Mar 2 22:10:13 2015 +0100

    vpnmain.cgi: Added inclusion of ipsec.user-post.conf to the end of ipsec.conf in order to allow connection parameters to be overwritten in ipsec.user.conf.

commit 09e3b0fa356c087b27ca7197024bf0210455a73c
Author: Michael Tremer <michael.tremer(a)ipfire.org>
Date:   Fri May 16 17:13:19 2014 +0200

    pound: Allow to use legacy renegotiation.

-----------------------------------------------------------------------

Summary of changes:
 html/cgi-bin/vpnmain.cgi                          |  8 ++++++++
 lfs/pound                                         |  3 ++-
 src/patches/pound-2.7-legacy-regnegotiation.patch | 25 +++++++++++++++++++++++
 3 files changed, 35 insertions(+), 1 deletion(-)
 create mode 100644 src/patches/pound-2.7-legacy-regnegotiation.patch

Difference in files:
diff --git a/html/cgi-bin/vpnmain.cgi b/html/cgi-bin/vpnmain.cgi
index f5ec500..d86a613 100644
--- a/html/cgi-bin/vpnmain.cgi
+++ b/html/cgi-bin/vpnmain.cgi
@@ -437,6 +437,14 @@ sub writeipsecfiles {
 	}
 	print CONF "\n";
     }#foreach key
+
+    # Add post user includes to config file
+    # After the GUI-connections allows to patch connections.
+    if (-e "/etc/ipsec.user-post.conf") {
+        print CONF "include /etc/ipsec.user-post.conf\n";
+        print CONF "\n";
+    }
+
     print SECRETS $last_secrets if ($last_secrets);
     close(CONF);
     close(SECRETS);
diff --git a/lfs/pound b/lfs/pound
index a0f6f29..52fb293 100644
--- a/lfs/pound
+++ b/lfs/pound
@@ -32,7 +32,7 @@ DL_FROM    = $(URL_IPFIRE)
 DIR_APP    = $(DIR_SRC)/$(THISAPP)
 TARGET     = $(DIR_INFO)/$(THISAPP)
 PROG       = pound
-PAK_VER    = 7
+PAK_VER    = 8
 
 DEPS       = ""
 
@@ -77,6 +77,7 @@ $(subst %,%_MD5,$(objects)) :
 $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects))
 	@$(PREBUILD)
 	@rm -rf $(DIR_APP) && cd $(DIR_SRC) && tar zxf $(DIR_DL)/$(DL_FILE)
+	cd $(DIR_APP) && patch -p1 -i $(DIR_SRC)/src/patches/pound-2.7-legacy-regnegotiation.patch
 	cd $(DIR_APP) && ./configure --prefix=/usr --sysconfdir=/etc
 	cd $(DIR_APP) && make $(MAKETUNING)
 	cd $(DIR_APP) && make install
diff --git a/src/patches/pound-2.7-legacy-regnegotiation.patch b/src/patches/pound-2.7-legacy-regnegotiation.patch
new file mode 100644
index 0000000..eb1d772
--- /dev/null
+++ b/src/patches/pound-2.7-legacy-regnegotiation.patch
@@ -0,0 +1,25 @@
+diff -Nur Pound-2.7c-vanilla/config.c Pound-2.7c/config.c
+--- Pound-2.7c-vanilla/config.c	2014-04-21 13:16:08.000000000 +0200
++++ Pound-2.7c/config.c	2014-05-16 12:57:33.273583192 +0200
+@@ -345,8 +345,10 @@
+ #ifdef  SSL_OP_NO_COMPRESSION
+             SSL_CTX_set_options(res->ctx, SSL_OP_NO_COMPRESSION);
+ #endif
++#if 0
+             SSL_CTX_clear_options(res->ctx, SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION);
+             SSL_CTX_clear_options(res->ctx, SSL_OP_LEGACY_SERVER_CONNECT);
++#endif
+             sprintf(lin, "%d-Pound-%ld", getpid(), random());
+             SSL_CTX_set_session_id_context(res->ctx, (unsigned char *)lin, strlen(lin));
+             SSL_CTX_set_tmp_rsa_callback(res->ctx, RSA_tmp_callback);
+@@ -368,8 +370,10 @@
+ #ifdef  SSL_OP_NO_COMPRESSION
+             SSL_CTX_set_options(res->ctx, SSL_OP_NO_COMPRESSION);
+ #endif
++#if 0
+             SSL_CTX_clear_options(res->ctx, SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION);
+             SSL_CTX_clear_options(res->ctx, SSL_OP_LEGACY_SERVER_CONNECT);
++#endif
+             sprintf(lin, "%d-Pound-%ld", getpid(), random());
+             SSL_CTX_set_session_id_context(res->ctx, (unsigned char *)lin, strlen(lin));
+             SSL_CTX_set_tmp_rsa_callback(res->ctx, RSA_tmp_callback);


hooks/post-receive
--
IPFire 2.x development tree