package/network/services/openvpn/patches/001-backport_cipher_none_fix.patch

   1 commit 98156e90e1e83133a6a6a020db8e7333ada6156b
   2 Author: Steffan Karger <steffan@karger.me>
   3 Date:   Tue Dec 2 21:42:00 2014 +0100
   4
   5     Really fix '--cipher none' regression
   6
   7     ... by not incorrectly hinting to the compiler the function argument of
   8     cipher_kt_mode_{cbc,ofb_cfb}() is nonnull, since that no longer is the
   9     case.
  10
  11     Verified the fix on Debian Wheezy, one of the platforms the reporter in
  12     trac #473 mentions with a compiler that would optimize out the required
  13     checks.
  14
  15     Also add a testcase for --cipher none to t_lpback, to prevent further
  16     regressions.
  17
  18     Signed-off-by: Steffan Karger <steffan@karger.me>
  19     Acked-by: Gert Doering <gert@greenie.muc.de>
  20     Message-Id: <1417552920-31770-1-git-send-email-steffan@karger.me>
  21     URL: http://article.gmane.org/gmane.network.openvpn.devel/9300
  22     Signed-off-by: Gert Doering <gert@greenie.muc.de>
  23
  24 --- a/src/openvpn/crypto_backend.h
  25 +++ b/src/openvpn/crypto_backend.h
  26 @@ -237,8 +237,7 @@ int cipher_kt_mode (const cipher_kt_t *c
  27   *
  28   * @return             true iff the cipher is a CBC mode cipher.
  29   */
  30 -bool cipher_kt_mode_cbc(const cipher_kt_t *cipher)
  31 -  __attribute__((nonnull));
  32 +bool cipher_kt_mode_cbc(const cipher_kt_t *cipher);
  33
  34  /**
  35   * Check if the supplied cipher is a supported OFB or CFB mode cipher.
  36 @@ -247,8 +246,7 @@ bool cipher_kt_mode_cbc(const cipher_kt_
  37   *
  38   * @return             true iff the cipher is a OFB or CFB mode cipher.
  39   */
  40 -bool cipher_kt_mode_ofb_cfb(const cipher_kt_t *cipher)
  41 -  __attribute__((nonnull));
  42 +bool cipher_kt_mode_ofb_cfb(const cipher_kt_t *cipher);
  43
  44
  45  /**
  46 --- a/tests/t_lpback.sh
  47 +++ b/tests/t_lpback.sh
  48 @@ -35,6 +35,9 @@ CIPHERS=$(${top_builddir}/src/openvpn/op
  49  # GD, 2014-07-06 do not test RC5-* either (fails on NetBSD w/o libcrypto_rc5)
  50  CIPHERS=$(echo "$CIPHERS" | egrep -v '^(DES-EDE3-CFB1|DES-CFB1|RC5-)' )
  51
  52 +# Also test cipher 'none'
  53 +CIPHERS=${CIPHERS}$(printf "\nnone")
  54 +
  55  "${top_builddir}/src/openvpn/openvpn" --genkey --secret key.$$
  56  set +e
  57