diff options
| author | bdunahu <bdunahu@operationnull.com> | 2026-08-01 20:48:41 -0400 |
|---|---|---|
| committer | Nguyễn Gia Phong <cnx@loang.net> | 2026-08-08 00:12:00 +0900 |
| commit | 415de5477979bfb8e4de409eddef8386834b86d0 (patch) | |
| tree | 97326b35c52df0a6a89e5a4ee54ba20124008c40 | |
| parent | d7bf15330d66a661d37037ba037e750cc0639eef (diff) | |
gnu: Delete orphaned curl patchfile.
* gnu/packages/patches/curl-CVE-2024-8096.patch: Delete file.
Merges: https://codeberg.org/guix/guix/pulls/10330
Signed-off-by: Nguyễn Gia Phong <cnx@loang.net>
| -rw-r--r-- | gnu/packages/patches/curl-CVE-2024-8096.patch | 200 |
1 files changed, 0 insertions, 200 deletions
diff --git a/gnu/packages/patches/curl-CVE-2024-8096.patch b/gnu/packages/patches/curl-CVE-2024-8096.patch deleted file mode 100644 index 0f780f08c32..00000000000 --- a/gnu/packages/patches/curl-CVE-2024-8096.patch +++ /dev/null | |||
| @@ -1,200 +0,0 @@ | |||
| 1 | From aeb1a281cab13c7ba791cb104e556b20e713941f Mon Sep 17 00:00:00 2001 | ||
| 2 | From: Daniel Stenberg <daniel@haxx.se> | ||
| 3 | Date: Tue, 20 Aug 2024 16:14:39 +0200 | ||
| 4 | Subject: [PATCH] gtls: fix OCSP stapling management | ||
| 5 | |||
| 6 | Reported-by: Hiroki Kurosawa | ||
| 7 | Closes #14642 | ||
| 8 | --- | ||
| 9 | lib/vtls/gtls.c | 146 ++++++++++++++++++++++++------------------------ | ||
| 10 | 1 file changed, 73 insertions(+), 73 deletions(-) | ||
| 11 | |||
| 12 | diff --git a/lib/vtls/gtls.c b/lib/vtls/gtls.c | ||
| 13 | index 03d6fcc038aac3..c7589d9d39bc81 100644 | ||
| 14 | --- a/lib/vtls/gtls.c | ||
| 15 | +++ b/lib/vtls/gtls.c | ||
| 16 | @@ -850,6 +850,13 @@ static CURLcode gtls_client_init(struct Curl_cfilter *cf, | ||
| 17 | init_flags |= GNUTLS_NO_TICKETS; | ||
| 18 | #endif | ||
| 19 | |||
| 20 | +#if defined(GNUTLS_NO_STATUS_REQUEST) | ||
| 21 | + if(!config->verifystatus) | ||
| 22 | + /* Disable the "status_request" TLS extension, enabled by default since | ||
| 23 | + GnuTLS 3.8.0. */ | ||
| 24 | + init_flags |= GNUTLS_NO_STATUS_REQUEST; | ||
| 25 | +#endif | ||
| 26 | + | ||
| 27 | rc = gnutls_init(>ls->session, init_flags); | ||
| 28 | if(rc != GNUTLS_E_SUCCESS) { | ||
| 29 | failf(data, "gnutls_init() failed: %d", rc); | ||
| 30 | @@ -1321,104 +1328,97 @@ Curl_gtls_verifyserver(struct Curl_easy *data, | ||
| 31 | infof(data, " server certificate verification SKIPPED"); | ||
| 32 | |||
| 33 | if(config->verifystatus) { | ||
| 34 | - if(gnutls_ocsp_status_request_is_checked(session, 0) == 0) { | ||
| 35 | - gnutls_datum_t status_request; | ||
| 36 | - gnutls_ocsp_resp_t ocsp_resp; | ||
| 37 | + gnutls_datum_t status_request; | ||
| 38 | + gnutls_ocsp_resp_t ocsp_resp; | ||
| 39 | + gnutls_ocsp_cert_status_t status; | ||
| 40 | + gnutls_x509_crl_reason_t reason; | ||
| 41 | |||
| 42 | - gnutls_ocsp_cert_status_t status; | ||
| 43 | - gnutls_x509_crl_reason_t reason; | ||
| 44 | + rc = gnutls_ocsp_status_request_get(session, &status_request); | ||
| 45 | |||
| 46 | - rc = gnutls_ocsp_status_request_get(session, &status_request); | ||
| 47 | + if(rc == GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE) { | ||
| 48 | + failf(data, "No OCSP response received"); | ||
| 49 | + return CURLE_SSL_INVALIDCERTSTATUS; | ||
| 50 | + } | ||
| 51 | |||
| 52 | - infof(data, " server certificate status verification FAILED"); | ||
| 53 | + if(rc < 0) { | ||
| 54 | + failf(data, "Invalid OCSP response received"); | ||
| 55 | + return CURLE_SSL_INVALIDCERTSTATUS; | ||
| 56 | + } | ||
| 57 | |||
| 58 | - if(rc == GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE) { | ||
| 59 | - failf(data, "No OCSP response received"); | ||
| 60 | - return CURLE_SSL_INVALIDCERTSTATUS; | ||
| 61 | - } | ||
| 62 | + gnutls_ocsp_resp_init(&ocsp_resp); | ||
| 63 | |||
| 64 | - if(rc < 0) { | ||
| 65 | - failf(data, "Invalid OCSP response received"); | ||
| 66 | - return CURLE_SSL_INVALIDCERTSTATUS; | ||
| 67 | - } | ||
| 68 | + rc = gnutls_ocsp_resp_import(ocsp_resp, &status_request); | ||
| 69 | + if(rc < 0) { | ||
| 70 | + failf(data, "Invalid OCSP response received"); | ||
| 71 | + return CURLE_SSL_INVALIDCERTSTATUS; | ||
| 72 | + } | ||
| 73 | |||
| 74 | - gnutls_ocsp_resp_init(&ocsp_resp); | ||
| 75 | + (void)gnutls_ocsp_resp_get_single(ocsp_resp, 0, NULL, NULL, NULL, NULL, | ||
| 76 | + &status, NULL, NULL, NULL, &reason); | ||
| 77 | |||
| 78 | - rc = gnutls_ocsp_resp_import(ocsp_resp, &status_request); | ||
| 79 | - if(rc < 0) { | ||
| 80 | - failf(data, "Invalid OCSP response received"); | ||
| 81 | - return CURLE_SSL_INVALIDCERTSTATUS; | ||
| 82 | - } | ||
| 83 | + switch(status) { | ||
| 84 | + case GNUTLS_OCSP_CERT_GOOD: | ||
| 85 | + break; | ||
| 86 | |||
| 87 | - (void)gnutls_ocsp_resp_get_single(ocsp_resp, 0, NULL, NULL, NULL, NULL, | ||
| 88 | - &status, NULL, NULL, NULL, &reason); | ||
| 89 | + case GNUTLS_OCSP_CERT_REVOKED: { | ||
| 90 | + const char *crl_reason; | ||
| 91 | |||
| 92 | - switch(status) { | ||
| 93 | - case GNUTLS_OCSP_CERT_GOOD: | ||
| 94 | + switch(reason) { | ||
| 95 | + default: | ||
| 96 | + case GNUTLS_X509_CRLREASON_UNSPECIFIED: | ||
| 97 | + crl_reason = "unspecified reason"; | ||
| 98 | break; | ||
| 99 | |||
| 100 | - case GNUTLS_OCSP_CERT_REVOKED: { | ||
| 101 | - const char *crl_reason; | ||
| 102 | - | ||
| 103 | - switch(reason) { | ||
| 104 | - default: | ||
| 105 | - case GNUTLS_X509_CRLREASON_UNSPECIFIED: | ||
| 106 | - crl_reason = "unspecified reason"; | ||
| 107 | - break; | ||
| 108 | - | ||
| 109 | - case GNUTLS_X509_CRLREASON_KEYCOMPROMISE: | ||
| 110 | - crl_reason = "private key compromised"; | ||
| 111 | - break; | ||
| 112 | - | ||
| 113 | - case GNUTLS_X509_CRLREASON_CACOMPROMISE: | ||
| 114 | - crl_reason = "CA compromised"; | ||
| 115 | - break; | ||
| 116 | - | ||
| 117 | - case GNUTLS_X509_CRLREASON_AFFILIATIONCHANGED: | ||
| 118 | - crl_reason = "affiliation has changed"; | ||
| 119 | - break; | ||
| 120 | + case GNUTLS_X509_CRLREASON_KEYCOMPROMISE: | ||
| 121 | + crl_reason = "private key compromised"; | ||
| 122 | + break; | ||
| 123 | |||
| 124 | - case GNUTLS_X509_CRLREASON_SUPERSEDED: | ||
| 125 | - crl_reason = "certificate superseded"; | ||
| 126 | - break; | ||
| 127 | + case GNUTLS_X509_CRLREASON_CACOMPROMISE: | ||
| 128 | + crl_reason = "CA compromised"; | ||
| 129 | + break; | ||
| 130 | |||
| 131 | - case GNUTLS_X509_CRLREASON_CESSATIONOFOPERATION: | ||
| 132 | - crl_reason = "operation has ceased"; | ||
| 133 | - break; | ||
| 134 | + case GNUTLS_X509_CRLREASON_AFFILIATIONCHANGED: | ||
| 135 | + crl_reason = "affiliation has changed"; | ||
| 136 | + break; | ||
| 137 | |||
| 138 | - case GNUTLS_X509_CRLREASON_CERTIFICATEHOLD: | ||
| 139 | - crl_reason = "certificate is on hold"; | ||
| 140 | - break; | ||
| 141 | + case GNUTLS_X509_CRLREASON_SUPERSEDED: | ||
| 142 | + crl_reason = "certificate superseded"; | ||
| 143 | + break; | ||
| 144 | |||
| 145 | - case GNUTLS_X509_CRLREASON_REMOVEFROMCRL: | ||
| 146 | - crl_reason = "will be removed from delta CRL"; | ||
| 147 | - break; | ||
| 148 | + case GNUTLS_X509_CRLREASON_CESSATIONOFOPERATION: | ||
| 149 | + crl_reason = "operation has ceased"; | ||
| 150 | + break; | ||
| 151 | |||
| 152 | - case GNUTLS_X509_CRLREASON_PRIVILEGEWITHDRAWN: | ||
| 153 | - crl_reason = "privilege withdrawn"; | ||
| 154 | - break; | ||
| 155 | + case GNUTLS_X509_CRLREASON_CERTIFICATEHOLD: | ||
| 156 | + crl_reason = "certificate is on hold"; | ||
| 157 | + break; | ||
| 158 | |||
| 159 | - case GNUTLS_X509_CRLREASON_AACOMPROMISE: | ||
| 160 | - crl_reason = "AA compromised"; | ||
| 161 | - break; | ||
| 162 | - } | ||
| 163 | + case GNUTLS_X509_CRLREASON_REMOVEFROMCRL: | ||
| 164 | + crl_reason = "will be removed from delta CRL"; | ||
| 165 | + break; | ||
| 166 | |||
| 167 | - failf(data, "Server certificate was revoked: %s", crl_reason); | ||
| 168 | + case GNUTLS_X509_CRLREASON_PRIVILEGEWITHDRAWN: | ||
| 169 | + crl_reason = "privilege withdrawn"; | ||
| 170 | break; | ||
| 171 | - } | ||
| 172 | |||
| 173 | - default: | ||
| 174 | - case GNUTLS_OCSP_CERT_UNKNOWN: | ||
| 175 | - failf(data, "Server certificate status is unknown"); | ||
| 176 | + case GNUTLS_X509_CRLREASON_AACOMPROMISE: | ||
| 177 | + crl_reason = "AA compromised"; | ||
| 178 | break; | ||
| 179 | } | ||
| 180 | |||
| 181 | - gnutls_ocsp_resp_deinit(ocsp_resp); | ||
| 182 | + failf(data, "Server certificate was revoked: %s", crl_reason); | ||
| 183 | + break; | ||
| 184 | + } | ||
| 185 | |||
| 186 | - return CURLE_SSL_INVALIDCERTSTATUS; | ||
| 187 | + default: | ||
| 188 | + case GNUTLS_OCSP_CERT_UNKNOWN: | ||
| 189 | + failf(data, "Server certificate status is unknown"); | ||
| 190 | + break; | ||
| 191 | } | ||
| 192 | - else | ||
| 193 | - infof(data, " server certificate status verification OK"); | ||
| 194 | + | ||
| 195 | + gnutls_ocsp_resp_deinit(ocsp_resp); | ||
| 196 | + if(status != GNUTLS_OCSP_CERT_GOOD) | ||
| 197 | + return CURLE_SSL_INVALIDCERTSTATUS; | ||
| 198 | } | ||
| 199 | else | ||
| 200 | infof(data, " server certificate status verification SKIPPED"); | ||
