From 0ca37ce5e56fed356792e69f65672e42dd6caadf5f0f2278257321d1d474c857 Mon Sep 17 00:00:00 2001
From: Peter Simons <peter.simons@suse.com>
Date: Tue, 29 Jun 2021 11:17:01 +0000
Subject: [PATCH] refresh patches for the new version
OBS-URL: https://build.opensuse.org/package/show/network/vsftpd?expand=0&rev=150
---
...ntroduce-TLSv1.1-and-TLSv1.2-options.patch | 149 ------------------
seccomp-fixes.patch | 20 +--
vsftpd-2.0.4-lib64.diff | 22 +--
vsftpd-3.0.3-build-with-openssl-1.1.patch | 12 +-
vsftpd.changes | 2 +
vsftpd.spec | 2 +-
6 files changed, 26 insertions(+), 181 deletions(-)
delete mode 100644 0001-Introduce-TLSv1.1-and-TLSv1.2-options.patch
diff --git a/0001-Introduce-TLSv1.1-and-TLSv1.2-options.patch b/0001-Introduce-TLSv1.1-and-TLSv1.2-options.patch
deleted file mode 100644
index ab3fc62..0000000
--- a/0001-Introduce-TLSv1.1-and-TLSv1.2-options.patch
+++ /dev/null
@@ -1,149 +0,0 @@
-From 01bef55a1987700af3d43cdc5f5be88d3843ab85 Mon Sep 17 00:00:00 2001
-From: Martin Sehnoutka <msehnout@redhat.com>
-Date: Thu, 17 Nov 2016 13:36:17 +0100
-Subject: [PATCH] Introduce TLSv1.1 and TLSv1.2 options.
-
-Users can now enable a specific version of TLS protocol.
----
- parseconf.c | 2 ++
- ssl.c | 8 ++++++++
- tunables.c | 9 +++++++--
- tunables.h | 2 ++
- vsftpd.conf.5 | 24 ++++++++++++++++++++----
- 5 files changed, 39 insertions(+), 6 deletions(-)
-
-Index: vsftpd-3.0.3/parseconf.c
-===================================================================
---- vsftpd-3.0.3.orig/parseconf.c 2020-11-13 09:52:41.369111000 +0000
-+++ vsftpd-3.0.3/parseconf.c 2020-11-13 09:52:48.881045043 +0000
-@@ -85,6 +85,8 @@ parseconf_bool_array[] =
- { "ssl_sslv2", &tunable_sslv2 },
- { "ssl_sslv3", &tunable_sslv3 },
- { "ssl_tlsv1", &tunable_tlsv1 },
-+ { "ssl_tlsv1_1", &tunable_tlsv1_1 },
-+ { "ssl_tlsv1_2", &tunable_tlsv1_2 },
- { "tilde_user_enable", &tunable_tilde_user_enable },
- { "force_anon_logins_ssl", &tunable_force_anon_logins_ssl },
- { "force_anon_data_ssl", &tunable_force_anon_data_ssl },
-Index: vsftpd-3.0.3/ssl.c
-===================================================================
---- vsftpd-3.0.3.orig/ssl.c 2020-11-13 09:52:41.369111000 +0000
-+++ vsftpd-3.0.3/ssl.c 2020-11-13 09:52:48.881045043 +0000
-@@ -78,6 +78,14 @@ ssl_init(struct vsf_session* p_sess)
- {
- options |= SSL_OP_NO_TLSv1;
- }
-+ if (!tunable_tlsv1_1)
-+ {
-+ options |= SSL_OP_NO_TLSv1_1;
-+ }
-+ if (!tunable_tlsv1_2)
-+ {
-+ options |= SSL_OP_NO_TLSv1_2;
-+ }
- SSL_CTX_set_options(p_ctx, options);
- if (tunable_rsa_cert_file)
- {
-Index: vsftpd-3.0.3/tunables.c
-===================================================================
---- vsftpd-3.0.3.orig/tunables.c 2020-11-13 09:52:41.369111000 +0000
-+++ vsftpd-3.0.3/tunables.c 2020-11-13 09:56:53.162888596 +0000
-@@ -66,6 +66,8 @@ int tunable_force_local_data_ssl;
- int tunable_sslv2;
- int tunable_sslv3;
- int tunable_tlsv1;
-+int tunable_tlsv1_1;
-+int tunable_tlsv1_2;
- int tunable_tilde_user_enable;
- int tunable_force_anon_logins_ssl;
- int tunable_force_anon_data_ssl;
-@@ -207,7 +209,10 @@ tunables_load_defaults()
- tunable_force_local_data_ssl = 1;
- tunable_sslv2 = 0;
- tunable_sslv3 = 0;
-+ /* TLSv1 up to TLSv1.2 is enabled by default */
- tunable_tlsv1 = 1;
-+ tunable_tlsv1_1 = 1;
-+ tunable_tlsv1_2 = 1;
- tunable_tilde_user_enable = 0;
- tunable_force_anon_logins_ssl = 0;
- tunable_force_anon_data_ssl = 0;
-@@ -288,7 +293,8 @@ tunables_load_defaults()
- install_str_setting("/usr/share/ssl/certs/vsftpd.pem",
- &tunable_rsa_cert_file);
- install_str_setting(0, &tunable_dsa_cert_file);
-- install_str_setting("ECDHE-RSA-AES256-GCM-SHA384", &tunable_ssl_ciphers);
-+ install_str_setting("AES128-SHA:DES-CBC3-SHA:DHE-RSA-AES256-SHA:ECDHE-RSA-AES128-SHA:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384",
-+ &tunable_ssl_ciphers);
- install_str_setting(0, &tunable_rsa_private_key_file);
- install_str_setting(0, &tunable_dsa_private_key_file);
- install_str_setting(0, &tunable_ca_certs_file);
-Index: vsftpd-3.0.3/tunables.h
-===================================================================
---- vsftpd-3.0.3.orig/tunables.h 2020-11-13 09:52:41.369111000 +0000
-+++ vsftpd-3.0.3/tunables.h 2020-11-13 09:52:48.881045043 +0000
-@@ -67,6 +67,8 @@ extern int tunable_force_local_data_ssl;
- extern int tunable_sslv2; /* Allow SSLv2 */
- extern int tunable_sslv3; /* Allow SSLv3 */
- extern int tunable_tlsv1; /* Allow TLSv1 */
-+extern int tunable_tlsv1_1; /* Allow TLSv1.1 */
-+extern int tunable_tlsv1_2; /* Allow TLSv1.2 */
- extern int tunable_tilde_user_enable; /* Support e.g. ~chris */
- extern int tunable_force_anon_logins_ssl; /* Require anon logins use SSL */
- extern int tunable_force_anon_data_ssl; /* Require anon data uses SSL */
-Index: vsftpd-3.0.3/vsftpd.conf.5
-===================================================================
---- vsftpd-3.0.3.orig/vsftpd.conf.5 2020-11-13 09:52:41.370110991 +0000
-+++ vsftpd-3.0.3/vsftpd.conf.5 2020-11-13 09:52:48.881045043 +0000
-@@ -486,7 +486,7 @@ Default: YES
- Only applies if
- .BR ssl_enable
- is activated. If enabled, this option will permit SSL v2 protocol connections.
--TLS v1 connections are preferred.
-+TLS v1.2 connections are preferred.
-
- Default: NO
- .TP
-@@ -494,7 +494,7 @@ Default: NO
- Only applies if
- .BR ssl_enable
- is activated. If enabled, this option will permit SSL v3 protocol connections.
--TLS v1 connections are preferred.
-+TLS v1.2 connections are preferred.
-
- Default: NO
- .TP
-@@ -502,7 +502,23 @@ Default: NO
- Only applies if
- .BR ssl_enable
- is activated. If enabled, this option will permit TLS v1 protocol connections.
--TLS v1 connections are preferred.
-+TLS v1.2 connections are preferred.
-+
-+Default: YES
-+.TP
-+.B ssl_tlsv1_1
-+Only applies if
-+.BR ssl_enable
-+is activated. If enabled, this option will permit TLS v1.1 protocol connections.
-+TLS v1.2 connections are preferred.
-+
-+Default: YES
-+.TP
-+.B ssl_tlsv1_2
-+Only applies if
-+.BR ssl_enable
-+is activated. If enabled, this option will permit TLS v1.2 protocol connections.
-+TLS v1.2 connections are preferred.
-
- Default: YES
- .TP
-@@ -1001,7 +1017,7 @@ man page for further details. Note that
- security precaution as it prevents malicious remote parties forcing a cipher
- which they have found problems with.
-
--Default: DES-CBC3-SHA
-+Default: AES128-SHA:DES-CBC3-SHA:DHE-RSA-AES256-SHA:ECDHE-RSA-AES128-SHA:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384
- .TP
- .B user_config_dir
- This powerful option allows the override of any config option specified in
diff --git a/seccomp-fixes.patch b/seccomp-fixes.patch
index 1bc1225..9062295 100644
--- a/seccomp-fixes.patch
+++ b/seccomp-fixes.patch
@@ -1,7 +1,7 @@
-Index: vsftpd-3.0.3/seccompsandbox.c
+Index: vsftpd-3.0.4/seccompsandbox.c
===================================================================
---- vsftpd-3.0.3.orig/seccompsandbox.c
-+++ vsftpd-3.0.3/seccompsandbox.c
+--- vsftpd-3.0.4.orig/seccompsandbox.c 2021-06-15 08:06:29.165512830 +0000
++++ vsftpd-3.0.4/seccompsandbox.c 2021-06-15 08:06:42.778484808 +0000
@@ -18,6 +18,7 @@
#include "utility.h"
@@ -10,7 +10,7 @@ Index: vsftpd-3.0.3/seccompsandbox.c
#include <netinet/in.h>
#include <netinet/tcp.h>
-@@ -60,6 +61,7 @@
+@@ -63,6 +64,7 @@
#define kMaxSyscalls 100
@@ -18,7 +18,7 @@ Index: vsftpd-3.0.3/seccompsandbox.c
#ifdef DEBUG_SIGSYS
#include <signal.h>
-@@ -68,7 +70,10 @@
+@@ -71,7 +73,10 @@
void
handle_sigsys(int sig)
{
@@ -30,15 +30,7 @@ Index: vsftpd-3.0.3/seccompsandbox.c
}
#endif
-@@ -443,6 +448,7 @@ seccomp_sandbox_setup_postlogin(const st
- allow_nr(__NR_getcwd);
- allow_nr(__NR_chdir);
- allow_nr(__NR_getdents);
-+ allow_nr(__NR_getdents64);
- /* Misc */
- allow_nr(__NR_umask);
-
-@@ -579,8 +585,8 @@ seccomp_sandbox_lockdown()
+@@ -586,8 +591,8 @@ seccomp_sandbox_lockdown()
p_filter->code = BPF_LD+BPF_W+BPF_ABS;
p_filter->jt = 0;
p_filter->jf = 0;
diff --git a/vsftpd-2.0.4-lib64.diff b/vsftpd-2.0.4-lib64.diff
index c86b0e7..6fb5864 100644
--- a/vsftpd-2.0.4-lib64.diff
+++ b/vsftpd-2.0.4-lib64.diff
@@ -1,7 +1,7 @@
-Index: vsf_findlibs.sh
+Index: vsftpd-3.0.4/vsf_findlibs.sh
===================================================================
---- vsf_findlibs.sh.orig
-+++ vsf_findlibs.sh
+--- vsftpd-3.0.4.orig/vsf_findlibs.sh 2021-05-18 07:14:35.000000000 +0000
++++ vsftpd-3.0.4/vsf_findlibs.sh 2021-06-29 09:24:32.833223756 +0000
@@ -14,6 +14,7 @@ fi
# crypt library.
if find_func pam_start sysdeputil.o; then
@@ -18,11 +18,11 @@ Index: vsf_findlibs.sh
locate_library /usr/lib/libcrypt.so && echo "-lcrypt";
locate_library /usr/lib64/libcrypt.so && echo "-lcrypt";
locate_library /lib/x86_64-linux-gnu/libcrypt.so && echo "-lcrypt";
-@@ -54,6 +56,7 @@ elif locate_library /lib/libcap.so.2; th
- echo "/lib/libcap.so.2";
- else
- locate_library /usr/lib/libcap.so && echo "-lcap";
-+ locate_library /usr/lib64/libcap.so && echo "-lcap";
- locate_library /lib/libcap.so && echo "-lcap";
- locate_library /lib64/libcap.so && echo "-lcap";
- fi
+@@ -52,6 +54,7 @@ locate_library /usr/lib/libsec.sl && ech
+ # /usr/bin/ld: cannot find -lcap
+ # If the libcap-devel package isn't installed.
+ locate_library /usr/lib/libcap.so && echo "-lcap";
++locate_library /usr/lib64/libcap.so && echo "-lcap";
+ locate_library /lib/libcap.so && echo "-lcap";
+ locate_library /lib64/libcap.so && echo "-lcap";
+
diff --git a/vsftpd-3.0.3-build-with-openssl-1.1.patch b/vsftpd-3.0.3-build-with-openssl-1.1.patch
index bb71436..d1dc8e4 100644
--- a/vsftpd-3.0.3-build-with-openssl-1.1.patch
+++ b/vsftpd-3.0.3-build-with-openssl-1.1.patch
@@ -1,13 +1,13 @@
-Index: vsftpd-3.0.3/vsf_findlibs.sh
+Index: vsftpd-3.0.4/vsf_findlibs.sh
===================================================================
---- vsftpd-3.0.3.orig/vsf_findlibs.sh
-+++ vsftpd-3.0.3/vsf_findlibs.sh
-@@ -72,7 +72,7 @@ locate_library /usr/shlib/librt.so && ec
+--- vsftpd-3.0.4.orig/vsf_findlibs.sh 2021-06-15 07:58:45.004475824 +0000
++++ vsftpd-3.0.4/vsf_findlibs.sh 2021-06-15 07:59:59.039320940 +0000
+@@ -69,7 +69,7 @@ locate_library /usr/shlib/librt.so && ec
locate_library /usr/lib/libsendfile.so && echo "-lsendfile";
# OpenSSL
-if find_func SSL_library_init ssl.o; then
+if find_func SSL_CTX_new ssl.o; then
echo "-lssl -lcrypto";
- fi
-
+ elif find_func SSL_new ssl.o; then
+ echo "-lssl -lcrypto";
diff --git a/vsftpd.changes b/vsftpd.changes
index c8ffd07..ac0656d 100644
--- a/vsftpd.changes
+++ b/vsftpd.changes
@@ -11,6 +11,8 @@ Tue Jun 15 07:49:13 AM UTC 2021 - Peter Simons <psimons@suse.com>
- Upstream has a new GPG key (7B89011BCAE1CFEA).
+- "0001-Introduce-TLSv1.1-and-TLSv1.2-options.patch" is now obsolete.
+
-------------------------------------------------------------------
Thu Dec 3 11:20:20 UTC 2020 - Ismail Dönmez <idonmez@suse.com>
diff --git a/vsftpd.spec b/vsftpd.spec
index 451521e..e36a414 100644
--- a/vsftpd.spec
+++ b/vsftpd.spec
@@ -122,7 +122,7 @@ tests.
%prep
%setup -q
-%patch1
+%patch1 -p1
%patch3 -p1
%patch4
%patch5