summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorbdunahu <bdunahu@operationnull.com>2026-08-01 20:48:41 -0400
committerNguyễn Gia Phong <cnx@loang.net>2026-08-08 00:12:00 +0900
commit415de5477979bfb8e4de409eddef8386834b86d0 (patch)
tree97326b35c52df0a6a89e5a4ee54ba20124008c40
parentd7bf15330d66a661d37037ba037e750cc0639eef (diff)
gnu: Delete orphaned curl patchfile.
* gnu/packages/patches/curl-CVE-2024-8096.patch: Delete file. Merges: https://codeberg.org/guix/guix/pulls/10330 Signed-off-by: Nguyễn Gia Phong <cnx@loang.net>
-rw-r--r--gnu/packages/patches/curl-CVE-2024-8096.patch200
1 files changed, 0 insertions, 200 deletions
diff --git a/gnu/packages/patches/curl-CVE-2024-8096.patch b/gnu/packages/patches/curl-CVE-2024-8096.patch
deleted file mode 100644
index 0f780f08c32..00000000000
--- a/gnu/packages/patches/curl-CVE-2024-8096.patch
+++ /dev/null
@@ -1,200 +0,0 @@
1From aeb1a281cab13c7ba791cb104e556b20e713941f Mon Sep 17 00:00:00 2001
2From: Daniel Stenberg <daniel@haxx.se>
3Date: Tue, 20 Aug 2024 16:14:39 +0200
4Subject: [PATCH] gtls: fix OCSP stapling management
5
6Reported-by: Hiroki Kurosawa
7Closes #14642
8---
9 lib/vtls/gtls.c | 146 ++++++++++++++++++++++++------------------------
10 1 file changed, 73 insertions(+), 73 deletions(-)
11
12diff --git a/lib/vtls/gtls.c b/lib/vtls/gtls.c
13index 03d6fcc038aac3..c7589d9d39bc81 100644
14--- a/lib/vtls/gtls.c
15+++ b/lib/vtls/gtls.c
16@@ -850,6 +850,13 @@ static CURLcode gtls_client_init(struct Curl_cfilter *cf,
17 init_flags |= GNUTLS_NO_TICKETS;
18 #endif
19
20+#if defined(GNUTLS_NO_STATUS_REQUEST)
21+ if(!config->verifystatus)
22+ /* Disable the "status_request" TLS extension, enabled by default since
23+ GnuTLS 3.8.0. */
24+ init_flags |= GNUTLS_NO_STATUS_REQUEST;
25+#endif
26+
27 rc = gnutls_init(&gtls->session, init_flags);
28 if(rc != GNUTLS_E_SUCCESS) {
29 failf(data, "gnutls_init() failed: %d", rc);
30@@ -1321,104 +1328,97 @@ Curl_gtls_verifyserver(struct Curl_easy *data,
31 infof(data, " server certificate verification SKIPPED");
32
33 if(config->verifystatus) {
34- if(gnutls_ocsp_status_request_is_checked(session, 0) == 0) {
35- gnutls_datum_t status_request;
36- gnutls_ocsp_resp_t ocsp_resp;
37+ gnutls_datum_t status_request;
38+ gnutls_ocsp_resp_t ocsp_resp;
39+ gnutls_ocsp_cert_status_t status;
40+ gnutls_x509_crl_reason_t reason;
41
42- gnutls_ocsp_cert_status_t status;
43- gnutls_x509_crl_reason_t reason;
44+ rc = gnutls_ocsp_status_request_get(session, &status_request);
45
46- rc = gnutls_ocsp_status_request_get(session, &status_request);
47+ if(rc == GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE) {
48+ failf(data, "No OCSP response received");
49+ return CURLE_SSL_INVALIDCERTSTATUS;
50+ }
51
52- infof(data, " server certificate status verification FAILED");
53+ if(rc < 0) {
54+ failf(data, "Invalid OCSP response received");
55+ return CURLE_SSL_INVALIDCERTSTATUS;
56+ }
57
58- if(rc == GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE) {
59- failf(data, "No OCSP response received");
60- return CURLE_SSL_INVALIDCERTSTATUS;
61- }
62+ gnutls_ocsp_resp_init(&ocsp_resp);
63
64- if(rc < 0) {
65- failf(data, "Invalid OCSP response received");
66- return CURLE_SSL_INVALIDCERTSTATUS;
67- }
68+ rc = gnutls_ocsp_resp_import(ocsp_resp, &status_request);
69+ if(rc < 0) {
70+ failf(data, "Invalid OCSP response received");
71+ return CURLE_SSL_INVALIDCERTSTATUS;
72+ }
73
74- gnutls_ocsp_resp_init(&ocsp_resp);
75+ (void)gnutls_ocsp_resp_get_single(ocsp_resp, 0, NULL, NULL, NULL, NULL,
76+ &status, NULL, NULL, NULL, &reason);
77
78- rc = gnutls_ocsp_resp_import(ocsp_resp, &status_request);
79- if(rc < 0) {
80- failf(data, "Invalid OCSP response received");
81- return CURLE_SSL_INVALIDCERTSTATUS;
82- }
83+ switch(status) {
84+ case GNUTLS_OCSP_CERT_GOOD:
85+ break;
86
87- (void)gnutls_ocsp_resp_get_single(ocsp_resp, 0, NULL, NULL, NULL, NULL,
88- &status, NULL, NULL, NULL, &reason);
89+ case GNUTLS_OCSP_CERT_REVOKED: {
90+ const char *crl_reason;
91
92- switch(status) {
93- case GNUTLS_OCSP_CERT_GOOD:
94+ switch(reason) {
95+ default:
96+ case GNUTLS_X509_CRLREASON_UNSPECIFIED:
97+ crl_reason = "unspecified reason";
98 break;
99
100- case GNUTLS_OCSP_CERT_REVOKED: {
101- const char *crl_reason;
102-
103- switch(reason) {
104- default:
105- case GNUTLS_X509_CRLREASON_UNSPECIFIED:
106- crl_reason = "unspecified reason";
107- break;
108-
109- case GNUTLS_X509_CRLREASON_KEYCOMPROMISE:
110- crl_reason = "private key compromised";
111- break;
112-
113- case GNUTLS_X509_CRLREASON_CACOMPROMISE:
114- crl_reason = "CA compromised";
115- break;
116-
117- case GNUTLS_X509_CRLREASON_AFFILIATIONCHANGED:
118- crl_reason = "affiliation has changed";
119- break;
120+ case GNUTLS_X509_CRLREASON_KEYCOMPROMISE:
121+ crl_reason = "private key compromised";
122+ break;
123
124- case GNUTLS_X509_CRLREASON_SUPERSEDED:
125- crl_reason = "certificate superseded";
126- break;
127+ case GNUTLS_X509_CRLREASON_CACOMPROMISE:
128+ crl_reason = "CA compromised";
129+ break;
130
131- case GNUTLS_X509_CRLREASON_CESSATIONOFOPERATION:
132- crl_reason = "operation has ceased";
133- break;
134+ case GNUTLS_X509_CRLREASON_AFFILIATIONCHANGED:
135+ crl_reason = "affiliation has changed";
136+ break;
137
138- case GNUTLS_X509_CRLREASON_CERTIFICATEHOLD:
139- crl_reason = "certificate is on hold";
140- break;
141+ case GNUTLS_X509_CRLREASON_SUPERSEDED:
142+ crl_reason = "certificate superseded";
143+ break;
144
145- case GNUTLS_X509_CRLREASON_REMOVEFROMCRL:
146- crl_reason = "will be removed from delta CRL";
147- break;
148+ case GNUTLS_X509_CRLREASON_CESSATIONOFOPERATION:
149+ crl_reason = "operation has ceased";
150+ break;
151
152- case GNUTLS_X509_CRLREASON_PRIVILEGEWITHDRAWN:
153- crl_reason = "privilege withdrawn";
154- break;
155+ case GNUTLS_X509_CRLREASON_CERTIFICATEHOLD:
156+ crl_reason = "certificate is on hold";
157+ break;
158
159- case GNUTLS_X509_CRLREASON_AACOMPROMISE:
160- crl_reason = "AA compromised";
161- break;
162- }
163+ case GNUTLS_X509_CRLREASON_REMOVEFROMCRL:
164+ crl_reason = "will be removed from delta CRL";
165+ break;
166
167- failf(data, "Server certificate was revoked: %s", crl_reason);
168+ case GNUTLS_X509_CRLREASON_PRIVILEGEWITHDRAWN:
169+ crl_reason = "privilege withdrawn";
170 break;
171- }
172
173- default:
174- case GNUTLS_OCSP_CERT_UNKNOWN:
175- failf(data, "Server certificate status is unknown");
176+ case GNUTLS_X509_CRLREASON_AACOMPROMISE:
177+ crl_reason = "AA compromised";
178 break;
179 }
180
181- gnutls_ocsp_resp_deinit(ocsp_resp);
182+ failf(data, "Server certificate was revoked: %s", crl_reason);
183+ break;
184+ }
185
186- return CURLE_SSL_INVALIDCERTSTATUS;
187+ default:
188+ case GNUTLS_OCSP_CERT_UNKNOWN:
189+ failf(data, "Server certificate status is unknown");
190+ break;
191 }
192- else
193- infof(data, " server certificate status verification OK");
194+
195+ gnutls_ocsp_resp_deinit(ocsp_resp);
196+ if(status != GNUTLS_OCSP_CERT_GOOD)
197+ return CURLE_SSL_INVALIDCERTSTATUS;
198 }
199 else
200 infof(data, " server certificate status verification SKIPPED");