Skip to contentSkip to conversation

PolarSSL 1.1.0 support?

Openvpn-devel Applied Samuli Seppänen 7 participants 19 messages Jun 7, 2012

lore
Share & tools
lore

Samuli Seppänen

author
#0 lore raw

Hi,

I noticed that my Ubuntu 10.04 and 12.04 buildslaves which had PolarSSL 1.1.0 failed build during the configure phase:

checking polarssl version... configure: error: invalid polarssl version

Updating to PolarSSL 1.1.1 or later solves this issue. However, commit 1d92d06dca5ac says "Removed support for PolarSSL < 1.1", so 1.1.0 should work, right?

Signature · 5 lines
Samuli Seppänen
Community Manager
OpenVPN Technologies, Inc

irc freenode net: mattock
#1 lore raw
Quoted 10 lines · Samuli Seppänen

Hi,

I noticed that my Ubuntu 10.04 and 12.04 buildslaves which had PolarSSL 1.1.0 failed build during the configure phase:

checking polarssl version... configure: error: invalid polarssl version

Updating to PolarSSL 1.1.1 or later solves this issue. However, commit 1d92d06dca5ac says "Removed support for PolarSSL < 1.1", so 1.1.0 should work, right?

If 1.1.0 should be supported than I prepare a patch.

#2 lore raw
Quoted 18 lines

-----Original Message-----
From: Alon Bar-Lev [mailto:[email protected]...]
Sent: donderdag 7 juni 2012 11:33
To: Samuli Seppänen
Cc: [email protected]
Subject: Re: [Openvpn-devel] PolarSSL 1.1.0 support?

Quoted 9 lines · Samuli Seppänen

Hi,

I noticed that my Ubuntu 10.04 and 12.04 buildslaves which had PolarSSL
1.1.0 failed build during the configure phase:

checking polarssl version... configure: error: invalid polarssl version

Quoted 6 lines
Quoted 1 line

Updating to PolarSSL 1.1.1 or later solves this issue. However,

commit

Quoted 2 lines

1d92d06dca5ac says "Removed support for PolarSSL < 1.1", so 1.1.0 should work, right?

If 1.1.0 should be supported than I prepare a patch.

Hmm, strange, I thought that was in the patch? I agree that 1.1 should be supported there.

Adriaan

#3 lore raw

PATCH 1/1 build: support =polarssl-1.1.0

In reply to Alon Bar-Lev
Repoted-by Samuli Seppänen <[email protected]...>
Signed-off-by Alon Bar-Lev <[email protected]...>
---
 configure.ac |    2 +-
 1 files changed, 1 insertions(+), 1 deletions(-)
configure.ac +1 -1
index 339164f..9511317 100644
@@ -755,7 +755,7 @@ if test "${with_crypto_library}" = "polarssl" ; then
 #include <polarssl/version.h>
 			]],
 			[[
-#if POLARSSL_VERSION_NUMBER <= 0x01010000
+#if POLARSSL_VERSION_NUMBER < 0x01010000
 #error invalid version
 #endif
 			]]
Signature · 1 line
1.7.3.4
author
#4 lore raw

Re: [Openvpn-devel] [PATCH] build: support =polarssl-1.1.0

Il 07.06.2012 12:37, Alon Bar-Lev ha scritto:

Quoted 11 lines
Repoted-by Samuli Seppänen <[email protected]...>
Signed-off-by Alon Bar-Lev <[email protected]...>
---
 configure.ac |    2 +-
 1 files changed, 1 insertions(+), 1 deletions(-)
configure.ac +0 -0
index 339164f..9511317 100644

configure.ac if test "${with_crypto_library}" = "polarssl" ; then · line 761

Quoted 8 lines
configure.ac +1 -1
@@ -755,7 +755,7 @@ if test "${with_crypto_library}" = "polarssl" ; then
 #include <polarssl/version.h>
 			]],
 			[[
-#if POLARSSL_VERSION_NUMBER <= 0x01010000
+#if POLARSSL_VERSION_NUMBER < 0x01010000
 #error invalid version
 #endif
 			]]

Fixes the reported issue, tested on Ubuntu 10.04.

ACK.

Signature · 5 lines
Samuli Seppänen
Community Manager
OpenVPN Technologies, Inc

irc freenode net: mattock
#5 lore raw

Re: [Openvpn-devel] [PATCH] build: support =polarssl-1.1.0

Ah, it was an off-by-one, that's why I missed it.

Ack!

Adriaan

Quoted 51 lines

-----Original Message-----
From: Samuli Seppänen [mailto:[email protected]...]
Sent: donderdag 7 juni 2012 11:54
To: Alon Bar-Lev
Cc: [email protected]
Subject: Re: [Openvpn-devel] [PATCH] build: support =polarssl-1.1.0

Il 07.06.2012 12:37, Alon Bar-Lev ha scritto:

configure.ac index 339164f..9511317

Quoted 7 lines
Repoted-by Samuli Seppänen <[email protected]...>
Signed-off-by Alon Bar-Lev <[email protected]...>
---
 configure.ac |    2 +-
 1 files changed, 1 insertions(+), 1 deletions(-)
configure.ac index 339164f..9511317 renamed from configure.ac +0 -0

100644

configure.ac if test "${with_crypto_library}" = "polarssl" ; then · line 761

Quoted 11 lines
configure.ac +0 -0
@@ -755,7 +755,7 @@ if test "${with_crypto_library}" = "polarssl" ;

then #include <polarssl/version.h>

configure.ac +1 -1
 			]],
 			[[
-#if POLARSSL_VERSION_NUMBER <= 0x01010000
+#if POLARSSL_VERSION_NUMBER < 0x01010000
 #error invalid version
 #endif
 			]]

Fixes the reported issue, tested on Ubuntu 10.04.

ACK.

--
Samuli Seppänen
Community Manager
OpenVPN Technologies, Inc

irc freenode net: mattock

-----------------------------------------------------------------------
-------
Live Security Virtual Conference
Exclusive live event will cover all the ways today's security and threat landscape has changed and how IT managers can respond. Discussions will include endpoint security, mobile security and the latest in malware threats.
http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/
_______________________________________________
Openvpn-devel mailing list [email protected]
https://lists.sourceforge.net/lists/listinfo/openvpn-devel

Applied
#6 lore raw

Re: [Openvpn-devel] [PATCH] build: support =polarssl-1.1.0

In reply to Alon Bar-Lev

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Quoted 4 lines · Alon Bar-Lev
Repoted-by Samuli Seppänen <[email protected]...> Signed-off-by:

Alon Bar-Lev <[email protected]...> --- configure.ac | 2 +- 1
files changed, 1 insertions(+), 1 deletions(-)

Applied to the master branch. I fixed a typo in the commit message and made the the subject clearer.

commit 9eb058556d3e550e9b811a3ddc30be66635d4221

Author: Alon Bar-Lev <[email protected]...>
Date:   Thu Jun 7 12:37:04 2012 +0300
    build: do not support <polarssl-1.1.0

    Reported-by: Samuli Seppänen <[email protected]...>
    Signed-off-by: Alon Bar-Lev <[email protected]...>
    Acked-by: Samuli Seppänen <[email protected]...>
    Acked-by: Adriaan de Jong <[email protected]...>
    Message-Id: [email protected]...
    URL: http://article.gmane.org/gmane.network.openvpn.devel/6686
    Signed-off-by: David Sommerseth <[email protected]...>

kind regards,

David Sommerseth
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/

iEYEARECAAYFAk/QkPQACgkQDC186MBRfrpiJACgsXg16hYEmH8D/npFrTem7dGT SYcAmwZKgwMHB/nfxpUA//SbFs9ZTzCW
=g5eZ
-----END PGP SIGNATURE-----

#7 lore raw
In reply to Samuli Seppänen

Maybe this should actually be changed to >= 1.1.2, since there is a security issue with versions from 0.99-pre4 up to and including PolarSSL 1.1.1.

Quoted 33 lines · Samuli Seppänen

Hi,

I noticed that my Ubuntu 10.04 and 12.04 buildslaves which had PolarSSL 1.1.0 failed build during the configure phase:

checking polarssl version... configure: error: invalid polarssl version

Updating to PolarSSL 1.1.1 or later solves this issue. However, commit 1d92d06dca5ac says "Removed support for PolarSSL < 1.1", so 1.1.0 should work, right?

Signature · 21 lines
Samuli Seppänen
Community Manager
OpenVPN Technologies, Inc

irc freenode net: mattock





--------------------------------------------------------------------------
----
Live Security Virtual Conference
Exclusive live event will cover all the ways today's security and
threat landscape has changed and how IT managers can respond. Discussions
will include endpoint security, mobile security and the latest in malware
threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/
_______________________________________________
Openvpn-devel mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/openvpn-devel
#8 lore raw

Hello,
Build system should only care about the interface, not the "quality" of the dependency.
So if we are built OK with >=1.1.0 than this should be the boundary. Thanks,
Alon.

Quoted 51 lines · Frank de Brabander

Maybe this should actually be changed to >= 1.1.2, since there is a security issue with versions from 0.99-pre4 up to and including PolarSSL 1.1.1.

Quoted 22 lines · Samuli Seppänen

Hi,

I noticed that my Ubuntu 10.04 and 12.04 buildslaves which had PolarSSL 1.1.0 failed build during the configure phase:

checking polarssl version... configure: error: invalid polarssl version

Updating to PolarSSL 1.1.1 or later solves this issue. However, commit 1d92d06dca5ac says "Removed support for PolarSSL < 1.1", so 1.1.0 should work, right?

--
Samuli Seppänen
Community Manager
OpenVPN Technologies, Inc

irc freenode net: mattock

Quoted 11 lines

--------------------------------------------------------------------------
----
Live Security Virtual Conference
Exclusive live event will cover all the ways today's security and threat landscape has changed and how IT managers can respond. Discussions will include endpoint security, mobile security and the latest in malware threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/
_______________________________________________
Openvpn-devel mailing list [email protected]
https://lists.sourceforge.net/lists/listinfo/openvpn-devel

------------------------------------------------------------------------------
Live Security Virtual Conference
Exclusive live event will cover all the ways today's security and threat landscape has changed and how IT managers can respond. Discussions will include endpoint security, mobile security and the latest in malware threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/
_______________________________________________
Openvpn-devel mailing list [email protected]
https://lists.sourceforge.net/lists/listinfo/openvpn-devel

#9 lore raw
In reply to Frank de Brabander
Quoted 10 lines

-----Original Message-----
From: Frank de Brabander [mailto:[email protected]...]
Sent: donderdag 7 juni 2012 11:36
To: Samuli Seppänen; [email protected]
Subject: Re: [Openvpn-devel] PolarSSL 1.1.0 support?

Maybe this should actually be changed to >= 1.1.2, since there is a security issue with versions from 0.99-pre4 up to and including PolarSSL 1.1.1.

The trouble there is that some distro's tend to only backport the security patches, and not the version patches. This would throw an extra obstacle in their way. Is it really our responsibility to verify that you are using a secure version of an SSL library?

Adriaan

#10 lore raw

Agreed as well..

Quoted 24 lines · Adriaan de Jong
Quoted 10 lines

-----Original Message-----
From: Frank de Brabander [mailto:[email protected]...]
Sent: donderdag 7 juni 2012 11:36
To: Samuli Seppänen; [email protected]
Subject: Re: [Openvpn-devel] PolarSSL 1.1.0 support?

Maybe this should actually be changed to >= 1.1.2, since there is a security issue with versions from 0.99-pre4 up to and including PolarSSL 1.1.1.

The trouble there is that some distro's tend to only backport the security patches, and not the version patches. This would throw an extra obstacle in their way. Is it really our responsibility to verify that you are using a secure version of an SSL library?

Adriaan

------------------------------------------------------------------------------
Live Security Virtual Conference
Exclusive live event will cover all the ways today's security and threat landscape has changed and how IT managers can respond. Discussions will include endpoint security, mobile security and the latest in malware threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/
_______________________________________________
Openvpn-devel mailing list [email protected]
https://lists.sourceforge.net/lists/listinfo/openvpn-devel

#11 lore raw

Hi,

Quoted 1 line · Paul Bakker

Agreed as well..

So what...? 1.1.4 or "1.1.0, and put the responsibility on the distro"?

(How's the work on blowfish going? Only semi-joking, as I'd really like to run cross-ssl-library client tests on the buildslaves, without forcing the OpenSSL servers to non-default crypto settings)

gert

Signature · 4 lines
USENET is *not* the non-clickable part of WWW!
                                                           //www.muc.de/~gert/
Gert Doering - Munich, Germany                             [email protected]...
fax: +49-89-35655025                        [email protected]...
#12 lore raw
Quoted 2 lines · Gert Doering

So what...? 1.1.4 or "1.1.0, and put the responsibility on the distro"?

1.1.0 and put the respsonsibility on the distro!

Quoted 4 lines

(How's the work on blowfish going? Only semi-joking, as I'd really like to run cross-ssl-library client tests on the buildslaves, without forcing the OpenSSL servers to non-default crypto settings)

WIP. Currently being worked on by one of my developers. So: Yes, we are actually coding for it now :)

Paul

#13 lore raw

Hi,

Quoted 3 lines · Paul Bakker
Quoted 1 line · Gert Doering

So what...? 1.1.4 or "1.1.0, and put the responsibility on the distro"?

1.1.0 and put the respsonsibility on the distro!

Ok - so I'll ACK the patch Alon has posted as well. Thanks.

Quoted 5 lines
Quoted 3 lines

(How's the work on blowfish going? Only semi-joking, as I'd really like to run cross-ssl-library client tests on the buildslaves, without forcing the OpenSSL servers to non-default crypto settings)

WIP. Currently being worked on by one of my developers. So: Yes, we are actually coding for it now :)

Great news! (Even if it means we might have to update that check again...)

gert

Signature · 4 lines
USENET is *not* the non-clickable part of WWW!
                                                           //www.muc.de/~gert/
Gert Doering - Munich, Germany                             [email protected]...
fax: +49-89-35655025                        [email protected]...
author
#14 lore raw
In reply to Gert Doering
Quoted 7 lines

Hi,

Quoted 1 line · Paul Bakker

Agreed as well..

So what...? 1.1.4 or "1.1.0, and put the responsibility on the distro"?

I think this question is related to our project policies, not just to PolarSSL support. Do we want to try to protect packagers and those building from source from security issues by trying to force them to use latest libraries? In practice, some OS/distro packagers (e.g. for Debian stable) would have to circumvent our version checks due their own project policies.

Anyways, whatever we decide, I think we should at least be consistent.

Samuli

#15 lore raw

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Quoted 8 lines · Samuli Seppänen
Quoted 8 lines

Hi,

Quoted 1 line · Paul Bakker

Agreed as well..

So what...? 1.1.4 or "1.1.0, and put the responsibility on the distro"?

Quoted 6 lines

I think this question is related to our project policies, not just to PolarSSL support. Do we want to try to protect packagers and those building from source from security issues by trying to force them to use latest libraries? In practice, some OS/distro packagers (e.g. for Debian stable) would have to circumvent our version checks due their own project policies.

I probably lean more towards what Alon said earlier in this thread. We should bother about APIs not which security level/issues each version have. Otherwise, we make life miserable for package maintainers, where they might often backport security fixes without altering the major/minor version number - which Adriaan also said.

In RHEL the packages are stabilised on a specific version and only bugfixes and security fixes are backported and only exceptionally features are backported. And even more seldom a package rebase happens. And then to need to circumvent such version restrictions when building openvpn, actually makes things harder for users.

kind regards,

David Sommerseth
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/

iEYEARECAAYFAk/QnKAACgkQDC186MBRfrqadgCfUTrnypxWo56F6W/NmmexSG/z Ma8An1ZWD4seXjE/f65+NRFUjjXcpEzQ
=vRpM
-----END PGP SIGNATURE-----

author
#16 lore raw
In reply to Adriaan de Jong
Quoted 7 lines
Quoted 7 lines

-----Original Message-----
From: Frank de Brabander [mailto:[email protected]...]
Sent: donderdag 7 juni 2012 11:36
To: Samuli Seppänen; [email protected]
Subject: Re: [Openvpn-devel] PolarSSL 1.1.0 support?

Quoted 7 lines
Quoted 4 lines

Maybe this should actually be changed to >= 1.1.2, since there is a security issue with versions from 0.99-pre4 up to and including PolarSSL 1.1.1.

The trouble there is that some distro's tend to only backport the security patches, and not the version patches. This would throw an extra obstacle in their way. Is it really our responsibility to verify that you are using a secure version of an SSL library?

Adriaan

I think it's the packager's responsibility to use/depend on secure versions of libraries - either latest ones or ones with backported security fixes. Also, if we did this for PolarSSL, we'd have to do it for OpenSSL and all other dependencies as well.

Samuli

#17 lore raw
In reply to Frank de Brabander

I'd go for >= 1.1.4

Since 1.1.2 does not handle empty packets correctly.

Quoted 50 lines · Frank de Brabander

Maybe this should actually be changed to >= 1.1.2, since there is a security issue with versions from 0.99-pre4 up to and including PolarSSL 1.1.1.

Quoted 33 lines · Samuli Seppänen

Hi,

I noticed that my Ubuntu 10.04 and 12.04 buildslaves which had PolarSSL 1.1.0 failed build during the configure phase:

checking polarssl version... configure: error: invalid polarssl version

Updating to PolarSSL 1.1.1 or later solves this issue. However, commit 1d92d06dca5ac says "Removed support for PolarSSL < 1.1", so 1.1.0 should work, right?

Signature · 21 lines
Samuli Seppänen
Community Manager
OpenVPN Technologies, Inc

irc freenode net: mattock





--------------------------------------------------------------------------
----
Live Security Virtual Conference
Exclusive live event will cover all the ways today's security and
threat landscape has changed and how IT managers can respond. Discussions
will include endpoint security, mobile security and the latest in malware
threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/
_______________________________________________
Openvpn-devel mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/openvpn-devel

------------------------------------------------------------------------------
Live Security Virtual Conference
Exclusive live event will cover all the ways today's security and threat landscape has changed and how IT managers can respond. Discussions will include endpoint security, mobile security and the latest in malware threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/
_______________________________________________
Openvpn-devel mailing list [email protected]
https://lists.sourceforge.net/lists/listinfo/openvpn-devel

#18 lore raw
In reply to Frank de Brabander

Hi,

Quoted 3 lines · Frank de Brabander

Maybe this should actually be changed to >= 1.1.2, since there is a security issue with versions from 0.99-pre4 up to and including PolarSSL 1.1.1.

If the PolarSSL author says so, we should follow :-)

Quoted 4 lines
Quoted 4 lines

I noticed that my Ubuntu 10.04 and 12.04 buildslaves which had PolarSSL 1.1.0 failed build during the configure phase:

checking polarssl version... configure: error: invalid polarssl version

It might be good to improve the error message - while at it - to print what we require. Like:

checking polarssl version...
configure: error: polarssl version too old, minimum required version 1.1.2

(or so)

gert

Signature · 4 lines
USENET is *not* the non-clickable part of WWW!
                                                           //www.muc.de/~gert/
Gert Doering - Munich, Germany                             [email protected]...
fax: +49-89-35655025                        [email protected]...