Compare commits
No commits in common. 'c9' and 'i10cs' have entirely different histories.
@ -1 +1 @@
|
|||||||
SOURCES/librelp-1.10.0.tar.gz
|
SOURCES/librelp-1.11.0.tar.gz
|
||||||
|
|||||||
@ -1 +1 @@
|
|||||||
595a718aabe368762d2c14512956bf94364da489 SOURCES/librelp-1.10.0.tar.gz
|
72b0ffdc57444972e3b5eaf287f1b79f28f7d1be SOURCES/librelp-1.11.0.tar.gz
|
||||||
|
|||||||
@ -0,0 +1,21 @@
|
|||||||
|
diff -up librelp-1.11.0/src/tcp.c.orig librelp-1.11.0/src/tcp.c
|
||||||
|
--- librelp-1.11.0/src/tcp.c.orig 2024-08-15 08:31:29.699002010 +0200
|
||||||
|
+++ librelp-1.11.0/src/tcp.c 2024-08-15 08:31:46.552178361 +0200
|
||||||
|
@@ -69,7 +69,7 @@
|
||||||
|
# if OPENSSL_VERSION_NUMBER >= 0x30000000L && !defined(LIBRESSL_VERSION_NUMBER)
|
||||||
|
# include <openssl/bioerr.h>
|
||||||
|
# endif
|
||||||
|
-# include <openssl/engine.h>
|
||||||
|
+// # include <openssl/engine.h>
|
||||||
|
/* OpenSSL API differences */
|
||||||
|
# if OPENSSL_VERSION_NUMBER >= 0x10100000L
|
||||||
|
# define RSYSLOG_X509_NAME_oneline(X509CERT) X509_get_subject_name(X509CERT)
|
||||||
|
@@ -1989,7 +1989,7 @@ relpTcpExitTLS_ossl(void)
|
||||||
|
SSL_CTX_free(ctx);
|
||||||
|
ctx = NULL;
|
||||||
|
}
|
||||||
|
- ENGINE_cleanup();
|
||||||
|
+ // ENGINE_cleanup();
|
||||||
|
ERR_free_strings();
|
||||||
|
EVP_cleanup();
|
||||||
|
CRYPTO_cleanup_all_ex_data();
|
||||||
@ -1,88 +0,0 @@
|
|||||||
diff -up librelp-1.10.0/src/tcp.c.crypto-compliance librelp-1.10.0/src/tcp.c
|
|
||||||
--- librelp-1.10.0/src/tcp.c.crypto-compliance 2021-02-16 09:07:24.000000000 +0100
|
|
||||||
+++ librelp-1.10.0/src/tcp.c 2021-08-17 10:13:53.368936612 +0200
|
|
||||||
@@ -1155,32 +1155,8 @@ static relpRetVal LIBRELP_ATTR_NONNULL()
|
|
||||||
relpTcpTLSSetPrio_gtls(relpTcp_t *const pThis)
|
|
||||||
{
|
|
||||||
int r;
|
|
||||||
- char pristringBuf[4096];
|
|
||||||
- char *pristring;
|
|
||||||
ENTER_RELPFUNC;
|
|
||||||
- /* Set default priority string (in simple cases where the user does not care...) */
|
|
||||||
- if(pThis->pristring == NULL) {
|
|
||||||
- if (pThis->authmode == eRelpAuthMode_None) {
|
|
||||||
- if(pThis->bEnableTLSZip) {
|
|
||||||
- strncpy(pristringBuf, "NORMAL:+ANON-DH:+COMP-ALL", sizeof(pristringBuf));
|
|
||||||
- } else {
|
|
||||||
- strncpy(pristringBuf, "NORMAL:+ANON-DH:+COMP-NULL", sizeof(pristringBuf));
|
|
||||||
- }
|
|
||||||
- pristringBuf[sizeof(pristringBuf)-1] = '\0';
|
|
||||||
- pristring = pristringBuf;
|
|
||||||
- r = gnutls_priority_set_direct(pThis->session, pristring, NULL);
|
|
||||||
- } else {
|
|
||||||
- r = gnutls_set_default_priority(pThis->session);
|
|
||||||
- strncpy(pristringBuf, "to recommended system default", sizeof(pristringBuf));
|
|
||||||
- pristringBuf[sizeof(pristringBuf)-1] = '\0';
|
|
||||||
- pristring = pristringBuf;
|
|
||||||
- }
|
|
||||||
-
|
|
||||||
- } else {
|
|
||||||
- pristring = pThis->pristring;
|
|
||||||
- r = gnutls_priority_set_direct(pThis->session, pristring, NULL);
|
|
||||||
- }
|
|
||||||
-
|
|
||||||
+ r = gnutls_set_default_priority(pThis->session);
|
|
||||||
if(r == GNUTLS_E_INVALID_REQUEST) {
|
|
||||||
ABORT_FINALIZE(RELP_RET_INVLD_TLS_PRIO);
|
|
||||||
} else if(r != GNUTLS_E_SUCCESS) {
|
|
||||||
@@ -1188,7 +1164,7 @@ relpTcpTLSSetPrio_gtls(relpTcp_t *const
|
|
||||||
}
|
|
||||||
|
|
||||||
finalize_it:
|
|
||||||
- pThis->pEngine->dbgprint((char*)"relpTcpTLSSetPrio_gtls: Setting ciphers '%s' iRet=%d\n", pristring, iRet);
|
|
||||||
+ pThis->pEngine->dbgprint((char*)"relpTcpTLSSetPrio_gtls: Setting ciphers to system default iRet=%d\n", iRet);
|
|
||||||
|
|
||||||
if(iRet != RELP_RET_OK) {
|
|
||||||
chkGnutlsCode(pThis, "Failed to set GnuTLS priority", iRet, r);
|
|
||||||
@@ -1207,38 +1183,15 @@ relpTcpTLSSetPrio_gtls(LIBRELP_ATTR_UNUS
|
|
||||||
static relpRetVal LIBRELP_ATTR_NONNULL()
|
|
||||||
relpTcpTLSSetPrio_ossl(relpTcp_t *const pThis)
|
|
||||||
{
|
|
||||||
- char pristringBuf[4096];
|
|
||||||
- char *pristring;
|
|
||||||
ENTER_RELPFUNC;
|
|
||||||
- /* Compute priority string (in simple cases where the user does not care...) */
|
|
||||||
- if(pThis->pristring == NULL) {
|
|
||||||
- if (pThis->authmode == eRelpAuthMode_None) {
|
|
||||||
- #if OPENSSL_VERSION_NUMBER >= 0x10100000L \
|
|
||||||
- && !defined(LIBRESSL_VERSION_NUMBER)
|
|
||||||
- /* NOTE: do never use: +eNULL, it DISABLES encryption! */
|
|
||||||
- strncpy(pristringBuf, "ALL:+COMPLEMENTOFDEFAULT:+ADH:+ECDH:+aNULL@SECLEVEL=0",
|
|
||||||
- sizeof(pristringBuf));
|
|
||||||
- #else
|
|
||||||
- strncpy(pristringBuf, "ALL:+COMPLEMENTOFDEFAULT:+ADH:+ECDH:+aNULL",
|
|
||||||
- sizeof(pristringBuf));
|
|
||||||
- #endif
|
|
||||||
- } else {
|
|
||||||
- strncpy(pristringBuf, "DEFAULT", sizeof(pristringBuf));
|
|
||||||
- }
|
|
||||||
- pristringBuf[sizeof(pristringBuf)-1] = '\0';
|
|
||||||
- pristring = pristringBuf;
|
|
||||||
- } else {
|
|
||||||
- /* We use custom CipherString if used sets it by SslConfCmd */
|
|
||||||
- pristring = pThis->pristring;
|
|
||||||
- }
|
|
||||||
|
|
||||||
- if ( SSL_set_cipher_list(pThis->ssl, pristring) == 0 ){
|
|
||||||
- pThis->pEngine->dbgprint((char*)"relpTcpTLSSetPrio_ossl: Error setting ciphers '%s'\n", pristring);
|
|
||||||
+ if (SSL_set_cipher_list(pThis->ssl, "PROFILE=SYSTEM") == 0){
|
|
||||||
+ pThis->pEngine->dbgprint((char*)"relpTcpTLSSetPrio_ossl: Error setting ciphers to system default\n");
|
|
||||||
ABORT_FINALIZE(RELP_RET_ERR_TLS_SETUP);
|
|
||||||
}
|
|
||||||
|
|
||||||
finalize_it:
|
|
||||||
- pThis->pEngine->dbgprint((char*)"relpTcpTLSSetPrio_ossl: Setting ciphers '%s' iRet=%d\n", pristring, iRet);
|
|
||||||
+ pThis->pEngine->dbgprint((char*)"relpTcpTLSSetPrio_ossl: Setting ciphers to system default iRet=%d\n", iRet);
|
|
||||||
LEAVE_RELPFUNC;
|
|
||||||
}
|
|
||||||
#else
|
|
||||||
@ -1,15 +0,0 @@
|
|||||||
diff -up librelp-1.10.0/src/relp.c.orig librelp-1.10.0/src/relp.c
|
|
||||||
--- librelp-1.10.0/src/relp.c.orig 2021-08-17 08:33:12.416786299 +0200
|
|
||||||
+++ librelp-1.10.0/src/relp.c 2021-08-17 08:33:45.070119507 +0200
|
|
||||||
@@ -385,9 +385,9 @@ relpEngineSetTLSLibByName(relpEngine_t *
|
|
||||||
}
|
|
||||||
|
|
||||||
if(!strcasecmp(name, "gnutls")) {
|
|
||||||
- relpEngineSetTLSLib(pThis, RELP_USE_GNUTLS);
|
|
||||||
+ CHKRet(relpEngineSetTLSLib(pThis, RELP_USE_GNUTLS));
|
|
||||||
}else if(!strcasecmp(name, "openssl")) {
|
|
||||||
- relpEngineSetTLSLib(pThis, RELP_USE_OPENSSL);
|
|
||||||
+ CHKRet(relpEngineSetTLSLib(pThis, RELP_USE_OPENSSL));
|
|
||||||
} else {
|
|
||||||
relpEngineCallOnGenericErr(pThis, "librelp", RELP_RET_PARAM_ERROR,
|
|
||||||
"invalid tls lib '%s' requested; this version of "
|
|
||||||
Loading…
Reference in new issue