svn commit: r567824 - in head/security/wolfssl: . files

Santhosh Raju fox at FreeBSD.org
Mon Mar 8 04:10:54 UTC 2021 

Author: fox
Date: Mon Mar  8 04:10:53 2021
New Revision: 567824
URL: https://svnweb.freebsd.org/changeset/ports/567824

Log:
  security/wolfssl: Updates to v4.7.0
  
  - Remove the memory leak patch since now it is upstreamed.
  
  Changes since v4.6.0:
  
  wolfSSL Release 4.7.0 (February 16, 2021)
  
  Release 4.7.0 of wolfSSL embedded TLS has bug fixes and new features including:
  New Feature Additions
  
    * Compatibility Layer expansion SSL_get_verify_mode, X509_VERIFY_PARAM API,
      X509_STORE_CTX API added
    * WOLFSSL_PSK_IDENTITY_ALERT macro added for enabling a subset of TLS alerts
    * Function wolfSSL_CTX_NoTicketTLSv12 added to enable turning off session
      tickets with TLS 1.2 while keeping TLS 1.3 session tickets available
    * Implement RFC 5705: Keying Material Exporters for TLS
    * Added --enable-reproducible-build flag for making more deterministic
      library outputs to assist debugging
    * Added support for S/MIME (Secure/Multipurpose Internet Mail Extensions)
      bundles
  
  Fixes
  
    * Fix to free mutex when cert manager is free’d
    * Compatibility layer EVP function to return the correct block size and type
    * DTLS secure renegotiation fixes including resetting timeout and retransmit
      on duplicate HelloRequest
    * Fix for edge case with shrink buffer and secure renegotiation
    * Compile fix for type used with curve448 and PPC64
    * Fixes for SP math all with PPC64 and other embedded compilers
    * SP math all fix when performing montgomery reduction on one word modulus
    * Fixes to SP math all to better support digit size of 8-bit
    * Fix for results of edge case with SP integer square operation
    * Stop non-ct mod inv from using register x29 with SP ARM64 build
    * Fix edge case when generating z value of ECC with SP code
    * Fixes for PKCS7 with crypto callback (devId) with RSA and RNG
    * Fix for compiling builds with RSA verify and public only
    * Fix for PKCS11 not properly exporting the public key due to a missing key
      type field
    * Call certificate callback with certificate depth issues
    * Fix for out-of-bounds read in TLSX_CSR_Parse()
    * Fix incorrect AES-GCM tag generation in the EVP layer
    * Fix for out of bounds write with SP math all enabled and an edge case of
      calling sp_tohex on the result of sp_mont_norm
    * Fix for parameter check in sp_rand_prime to handle 0 length values
    * Fix for edge case of failing malloc resulting in an out of bounds write
      with SHA256/SHA512 when small stack is enabled
  
  Improvements/Optimizations
  
    * Added --enable-wolftpm option for easily building wolfSSL to be used with
      wolfTPM
    * DTLS macro WOLFSSL_DTLS_RESEND_ONLY_TIMEOUT added for resending flight
      only after a timeout
    * Update linux kernel module to use kvmalloc and kvfree
    * Add user settings option to cmake build
    * Added support for AES GCM session ticket encryption
    * Thread protection for global RNG used by wolfSSL_RAND_bytes function calls
    * Sanity check on FIPs configure flag used against the version of FIPs
      bundle
    * --enable-aesgcm=table now is compatible with --enable-linuxkm
    * Increase output buffer size that wolfSSL_RAND_bytes can handle
    * Out of directory builds resolved, wolfSSL can now be built in a separate
      directory than the root wolfssl directory
  
  Vulnerabilities
  
    * [HIGH] CVE-2021-3336: In earlier versions of wolfSSL there exists a
      potential man in the middle attack on TLS 1.3 clients. Malicious
      attackers with a privileged network position can impersonate TLS 1.3
      servers and bypass authentication. Users that have applications with
      client side code and have TLS 1.3 turned on, should update to the latest
      version of wolfSSL. Users that do not have TLS 1.3 turned on, or that are
      server side only, are NOT affected by this report. For the code change
      see #3676. Thanks to Aina Toky Rasoamanana and Olivier Levillain from
      Télécom SudParis for the report.
    * [LOW] In the case of using custom ECC curves there is the potential for a
      crafted compressed ECC key that has a custom prime value to cause a hang
      when imported. This only affects applications that are loading in ECC keys
      with wolfSSL builds that have compressed ECC keys and custom ECC curves
      enabled.
    * [LOW] With TLS 1.3 authenticated-only ciphers a section of the server
      hello could contain 16 bytes of uninitialized data when sent to the
      connected peer. This affects only a specific build of wolfSSL with TLS
      1.3 early data enabled and using authenticated-only ciphers with TLS 1.3.
  
  For additional vulnerability information visit the vulnerability page at
  https://www.wolfssl.com/docs/security-vulnerabilities/
  
  See INSTALL file for build instructions.
  More info can be found on-line at https://wolfssl.com/wolfSSL/Docs.html

Deleted:
  head/security/wolfssl/files/
Modified:
  head/security/wolfssl/Makefile
  head/security/wolfssl/distinfo
  head/security/wolfssl/pkg-plist

Modified: head/security/wolfssl/Makefile
==============================================================================
--- head/security/wolfssl/Makefile	Mon Mar  8 03:38:53 2021	(r567823)
+++ head/security/wolfssl/Makefile	Mon Mar  8 04:10:53 2021	(r567824)
@@ -1,8 +1,7 @@
 # $FreeBSD$
 
 PORTNAME=	wolfssl
-PORTVERSION=	4.6.0
-PORTREVISION=	1
+PORTVERSION=	4.7.0
 CATEGORIES=	security devel
 MASTER_SITES=	https://www.wolfssl.com/ \
 		LOCAL/fox

Modified: head/security/wolfssl/distinfo
==============================================================================
--- head/security/wolfssl/distinfo	Mon Mar  8 03:38:53 2021	(r567823)
+++ head/security/wolfssl/distinfo	Mon Mar  8 04:10:53 2021	(r567824)
@@ -1,5 +1,3 @@
-TIMESTAMP = 1609170566
-SHA256 (wolfssl-4.6.0.zip) = f44ad0fc260acde4e42e60167b218034b4c8bf73718410f2f3b431a6c41edea8
-SIZE (wolfssl-4.6.0.zip) = 9071773
-SHA256 (e9b1ceae7e1daac6206d399e30c04bd51e3f8c7f.patch) = d012891c56b9d82d1dde9d956affc49c596d4ebf2d71f4ee0cc3ff1c50aa6fbd
-SIZE (e9b1ceae7e1daac6206d399e30c04bd51e3f8c7f.patch) = 1043
+TIMESTAMP = 1615175830
+SHA256 (wolfssl-4.7.0.zip) = 59edfb6b70c17c82f2ef6126198549adf6cbccee8f013cfca88323590f8cbd43
+SIZE (wolfssl-4.7.0.zip) = 9121149

Modified: head/security/wolfssl/pkg-plist
==============================================================================
--- head/security/wolfssl/pkg-plist	Mon Mar  8 03:38:53 2021	(r567823)
+++ head/security/wolfssl/pkg-plist	Mon Mar  8 04:10:53 2021	(r567824)
@@ -224,7 +224,7 @@ include/wolfssl/wolfio.h
 lib/libwolfssl.a
 lib/libwolfssl.so
 lib/libwolfssl.so.24
-lib/libwolfssl.so.24.3.0
+lib/libwolfssl.so.24.4.0
 libdata/pkgconfig/wolfssl.pc
 %%PORTDOCS%%%%DOCSDIR%%/README.txt
 %%PORTDOCS%%%%DOCSDIR%%/example/client.c

More information about the svn-ports-head mailing list