lp://staging/~zulcss/ubuntu/intrepid/ipsec-tools/src-374185

Branch merges

Propose for merging

No branches dependent on this one.

Ready for review for merging into lp://staging/ubuntu/intrepid/ipsec-tools

Steve Beattie (community): Approve (sru) on 2009-10-13

Diff: 235 lines

5 files modified

debian/changelog (+25/-0)
src/racoon/crypto_openssl.c (+2/-0)
src/racoon/ipsec_doi.c (+41/-23)
src/racoon/isakmp_frag.c (+2/-1)
src/racoon/nattraversal.c (+11/-4)

api

Related source package recipes

No recipes using this branch. (?)

Create packaging recipe

Related snap packages

Related bugs

Bug #374185: [SRU] racoon crashes when racoon.conf contains sainfo section for ipv6

Medium

Won't Fix

Link a bug report

Related blueprints

20. By Chuck Short on 2009-10-01

src/racoon/ipsec_doi.c: Patched to fix segfault when using
ipv6 addresses in sainfo section of racoon.conf. Thanks to
Fredrik Ljunggren. (LP: #374185)

19. By Marc Deslauriers on 2009-06-04

* SECURITY UPDATE: denial of service via fragmented packets without a
  payload.
  - src/racoon/isakmp_frag.c: validate size of payload data.
  - http://cvsweb.netbsd.org/bsdweb.cgi/src/crypto/dist/ipsec-tools/src/racoon/isakmp_frag.c.diff?r1=1.4&r2=1.4.6.1&f=h
  - CVE-2009-1574
* SECURITY UPDATE: denial of service via multiple memory leaks.
  - src/racoon/crypto_openssl.c: call X509_free().
  - src/racoon/nattraversal.c: add new natt_keepalive_delete() function
    that also frees ka->src and ka->dst.
  - http://cvsweb.netbsd.org/bsdweb.cgi/src/crypto/dist/ipsec-tools/src/racoon/crypto_openssl.c.diff?r1=1.11.6.4&r2=1.11.6.5&f=u
  - http://cvsweb.netbsd.org/bsdweb.cgi/src/crypto/dist/ipsec-tools/src/racoon/nattraversal.c.diff?r1=1.6&r2=1.6.6.1&f=u
  - CVE-2009-1632

18. By Mathias Gug on 2008-06-18

* Merge from debian unstable, remaining changes:
  - debian/control:
    - Set Ubuntu maintainer address.
    - Depend on lsb-base.
  - debian/ipsec-tools.setkey.init:
    - LSB init script.
* Dropped:
  - debian/ipsec-tools.setkey.init:
    - restart method: stop then start.
    - Use {} instead of () in usage (bash_completion).
  - debian/racoon.init:
    - Create /var/run/racoon.
    - Use {} instead of () in usage (bash_completion).
* Bug fixed by this merge:
    - fix XAuth with U-FQDN (LP: #234166).
* Enable build with hardened options:
  - src/libipsec/policy_token.c: don't check return code of fwrite.
  - src/setkey/setkey.c: stop scanning stdin if fgets fails.

17. By Mathias Gug on 2007-11-26

* Merge from debian unstable, remaining changes:
  - debian/control:
    - Set Ubuntu maintainer address.
    - Depend on lsb-base.
  - debian/ipsec-tools.setkey.init:
    - LSB init script.
    - restart method: stop then start.
    - Use {} instead of () in usage (bash_completion).
  - debian/racoon.init:
    - Create /var/run/racoon.
    - Use {} instead of () in usage (bash_completion).
* Dropped:
  - src/racoon/isakmp_inf.c: upstream fix for unecrypted ISAKMP packets.
  - src/racoon/grabmyaddr.c: Define IFA_RTA and #include <linux/if_addr.h>.

16. By Patrick Hetu on 2007-07-10

fix racoon.init to work with bash_completion (LP: #88153)

15. By Matthias Klose on 2007-05-29

Fix compilation errors with GCC-4.2.

14. By Kees Cook on 2007-05-08

* Merge from debian unstable, remaining changes:
  - src/racoon/isakmp_inf.c: upstream fix for unecrypted ISAKMP packets.
  - src/racoon/grabmyaddr.c: Define IFA_RTA and #include <linux/if_addr.h>.
  - debian/control: Set Ubuntu maintainer address.
  - LSB init script.
  - debian/racoon.init: Create /var/run/racoon.

13. By Kees Cook on 2007-04-04

* SECURITY UPDATE: remote ipsec tunnel disruption.
* src/racoon/isakmp_inf.c: upstream fix for unecrypted ISAKMP packets
  causing tunnels to be disconnected.
* References
  CVE-2007-1841

12. By Matthias Klose on 2007-03-05

* Rebuild for changes in the amd64 toolchain.
* Set Ubuntu maintainer address.

11. By Martin Pitt on 2006-11-03

* Merge from debian unstable.
  - LSB init script.
  - debian/racoon.init: Create /var/run/racoon.
* src/racoon/grabmyaddr.c: Define IFA_RTA and #include <linux/if_addr.h>.