Pisilinux/core
5
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

openssl 1.1.1d

Browse Source
This commit is contained in:
idriskalp
2019-12-23 04:28:25 +03:00
parent 109b4783df
commit 1b0822c7f4
23 changed files with 353 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files
system/base/openssl/actions.py
Regular → Executable
+6 -6
View File
@@ -17,7 +17,7 @@ def setup():
--openssldir=/etc/ssl \
shared -Wa,--noexecstack \
zlib enable-camellia enable-idea \
enable-seed enable-tlsext enable-rfc3779 enable-rc5 \
enable-seed enable-rfc3779 enable-rc5 \
enable-cms enable-md2 enable-mdc2 threads"
if get.buildTYPE() == "_emul32":
@@ -41,7 +41,7 @@ def setup():
def build():
autotools.make("depend")
autotools.make("-j1")
autotools.make("rehash")
#autotools.make("rehash")
def check():
#Revert ca-dir patch not to fail test
@@ -56,12 +56,12 @@ def check():
#shelltools.system("patch -p1 < openssl-1.0.0-beta4-ca-dir.patch")
def install():
autotools.rawInstall("INSTALL_PREFIX=%s MANDIR=/usr/share/man" % get.installDIR())
autotools.rawInstall("DESTDIR=%s MANDIR=/usr/share/man" % get.installDIR())
# Rename conflicting manpages
pisitools.rename("/usr/share/man/man1/passwd.1", "ssl-passwd.1")
pisitools.rename("/usr/share/man/man3/rand.3", "ssl-rand.3")
pisitools.rename("/usr/share/man/man3/err.3", "ssl-err.3")
#pisitools.rename("/usr/share/man/man3/rand.3", "ssl-rand.3")
#pisitools.rename("/usr/share/man/man3/err.3", "ssl-err.3")
if get.buildTYPE() == "_emul32":
#from distutils.dir_util import copy_tree
@@ -74,7 +74,7 @@ def install():
# Move engines to /usr/lib/openssl/engines
pisitools.dodir("/usr/lib/openssl")
pisitools.domove("/usr/lib/engines", "/usr/lib/openssl")
#pisitools.domove("/usr/lib/engines", "/usr/lib/openssl")
# Certificate stuff
pisitools.dobin("tools/c_rehash")
system/base/openssl/comar/package.py
Regular → Executable
View File
system/base/openssl/files/ca-dir.patch
+31
View File
@@ -0,0 +1,31 @@
--- apps/CA.pl.in 2018-09-11 14:48:19.000000000 +0200
+++ apps/CA.pl.in 2018-09-11 16:16:32.125629435 +0200
@@ -33,7 +33,7 @@
my $PKCS12 = "$openssl pkcs12";
# default openssl.cnf file has setup as per the following
-my $CATOP = "./demoCA";
+my $CATOP = "/etc/ssl";
my $CAKEY = "cakey.pem";
my $CAREQ = "careq.pem";
my $CACERT = "cacert.pem";
--- apps/openssl.cnf 2018-09-11 14:48:20.000000000 +0200
+++ apps/openssl.cnf 2018-09-11 16:16:32.125629435 +0200
@@ -43,7 +43,7 @@
####################################################################
[ CA_default ]
-dir = ./demoCA # Where everything is kept
+dir = /etc/ssl # Where everything is kept
certs = $dir/certs # Where the issued certs are kept
crl_dir = $dir/crl # Where the issued crl are kept
database = $dir/index.txt # database index file.
@@ -327,7 +327,7 @@
[ tsa_config1 ]
# These are used by the TSA reply generation only.
-dir = ./demoCA # TSA root directory
+dir = /etc/ssl # TSA root directory
serial = $dir/tsaserial # The current serial number (mandatory)
crypto_device = builtin # OpenSSL engine to use for signing
signer_cert = $dir/tsacert.pem # The TSA signing certificate
system/base/openssl/files/openssl-1.0.0-beta4-ca-dir.patch
Regular → Executable
View File
system/base/openssl/files/openssl-1.0.2a-x32-asm.patch
+43
View File
@@ -0,0 +1,43 @@
https://rt.openssl.org/Ticket/Display.html?id=3759&user=guest&pass=guest
From 6257d59b3a68d2feb9d64317a1c556dc3813ee61 Mon Sep 17 00:00:00 2001
From: Mike Frysinger <vapier@gentoo.org>
Date: Sat, 21 Mar 2015 06:01:25 -0400
Subject: [PATCH] crypto: use bigint in x86-64 perl
When building on x32 systems where the default type is 32bit, make sure
we can transparently represent 64bit integers. Otherwise we end up with
build errors like:
/usr/bin/perl asm/ghash-x86_64.pl elf > ghash-x86_64.s
Integer overflow in hexadecimal number at asm/../../perlasm/x86_64-xlate.pl line 201, <> line 890.
...
ghash-x86_64.s: Assembler messages:
ghash-x86_64.s:890: Error: junk '.15473355479995e+19' after expression
We don't enable this globally as there are some cases where we'd get
32bit values interpreted as unsigned when we need them as signed.
Reported-by: Bertrand Jacquin <bertrand@jacquin.bzh>
URL: https://bugs.gentoo.org/542618
---
crypto/perlasm/x86_64-xlate.pl | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/crypto/perlasm/x86_64-xlate.pl b/crypto/perlasm/x86_64-xlate.pl
index aae8288..0bf9774 100755
--- a/crypto/perlasm/x86_64-xlate.pl
+++ b/crypto/perlasm/x86_64-xlate.pl
@@ -195,6 +195,10 @@ my %globals;
sub out {
my $self = shift;
+ # When building on x32 ABIs, the expanded hex value might be too
+ # big to fit into 32bits. Enable transparent 64bit support here
+ # so we can safely print it out.
+ use bigint;
if ($gas) {
# Solaris /usr/ccs/bin/as can't handle multiplications
# in $self->{value}
--
2.3.3
system/base/openssl/files/openssl-1.1.0l-fix-no-ec2m-in-ec_curve.c.patch
+30
View File
@@ -0,0 +1,30 @@
From bcf6a94c4bc912ad313ea21abdf7e83bbae450e5 Mon Sep 17 00:00:00 2001
From: Nicola Tuveri <nic.tuv@gmail.com>
Date: Thu, 12 Sep 2019 01:57:47 +0300
Subject: [PATCH] Fix no-ec2m in ec_curve.c (1.1.0)
I made a mistake in d4a5dac9f9242c580fb9d0a4389440eccd3494a7 and
inverted the GF2m and GFp calls in ec_point_get_affine_coordinates, this
fixes it.
---
crypto/ec/ec_curve.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/crypto/ec/ec_curve.c b/crypto/ec/ec_curve.c
index 2d28d7f70bb..6a58b3a23e0 100644
--- a/crypto/ec/ec_curve.c
+++ b/crypto/ec/ec_curve.c
@@ -3200,11 +3200,11 @@ int ec_point_get_affine_coordinates(const EC_GROUP *group,
#ifndef OPENSSL_NO_EC2M
if (field_nid == NID_X9_62_characteristic_two_field) {
- return EC_POINT_get_affine_coordinates_GFp(group, point, x, y, ctx);
+ return EC_POINT_get_affine_coordinates_GF2m(group, point, x, y, ctx);
} else
#endif /* !def(OPENSSL_NO_EC2M) */
if (field_nid == NID_X9_62_prime_field) {
- return EC_POINT_get_affine_coordinates_GF2m(group, point, x, y, ctx);
+ return EC_POINT_get_affine_coordinates_GFp(group, point, x, y, ctx);
} else {
/* this should never happen */
return 0;
system/base/openssl/files/openssl-1.1.1d-fix-potential-memleaks-w-BN_to_ASN1_INTEGER.patch
+107
View File
@@ -0,0 +1,107 @@
From 515c728dbaa92211d2eafb0041ab9fcd258fdc41 Mon Sep 17 00:00:00 2001
From: Bernd Edlinger <bernd.edlinger@hotmail.de>
Date: Mon, 9 Sep 2019 19:12:25 +0200
Subject: [PATCH] Fix potential memory leaks with BN_to_ASN1_INTEGER
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/9833)
(cherry picked from commit f28bc7d386b25fb75625d0c62c6b2e6d21de0d09)
---
crypto/ec/ec_asn1.c | 7 +++++--
crypto/x509v3/v3_asid.c | 26 ++++++++++++++++++++------
2 files changed, 25 insertions(+), 8 deletions(-)
diff --git a/crypto/ec/ec_asn1.c b/crypto/ec/ec_asn1.c
index 1ce1181fc10..7cbf8de9813 100644
--- a/crypto/ec/ec_asn1.c
+++ b/crypto/ec/ec_asn1.c
@@ -446,6 +446,7 @@ ECPARAMETERS *EC_GROUP_get_ecparameters(const EC_GROUP *group,
unsigned char *buffer = NULL;
const EC_POINT *point = NULL;
point_conversion_form_t form;
+ ASN1_INTEGER *orig;
if (params == NULL) {
if ((ret = ECPARAMETERS_new()) == NULL) {
@@ -496,8 +497,9 @@ ECPARAMETERS *EC_GROUP_get_ecparameters(const EC_GROUP *group,
ECerr(EC_F_EC_GROUP_GET_ECPARAMETERS, ERR_R_EC_LIB);
goto err;
}
- ret->order = BN_to_ASN1_INTEGER(tmp, ret->order);
+ ret->order = BN_to_ASN1_INTEGER(tmp, orig = ret->order);
if (ret->order == NULL) {
+ ret->order = orig;
ECerr(EC_F_EC_GROUP_GET_ECPARAMETERS, ERR_R_ASN1_LIB);
goto err;
}
@@ -505,8 +507,9 @@ ECPARAMETERS *EC_GROUP_get_ecparameters(const EC_GROUP *group,
/* set the cofactor (optional) */
tmp = EC_GROUP_get0_cofactor(group);
if (tmp != NULL) {
- ret->cofactor = BN_to_ASN1_INTEGER(tmp, ret->cofactor);
+ ret->cofactor = BN_to_ASN1_INTEGER(tmp, orig = ret->cofactor);
if (ret->cofactor == NULL) {
+ ret->cofactor = orig;
ECerr(EC_F_EC_GROUP_GET_ECPARAMETERS, ERR_R_ASN1_LIB);
goto err;
}
diff --git a/crypto/x509v3/v3_asid.c b/crypto/x509v3/v3_asid.c
index 089f2ae29f0..ef2d64826fb 100644
--- a/crypto/x509v3/v3_asid.c
+++ b/crypto/x509v3/v3_asid.c
@@ -256,6 +256,7 @@ static int extract_min_max(ASIdOrRange *aor,
static int ASIdentifierChoice_is_canonical(ASIdentifierChoice *choice)
{
ASN1_INTEGER *a_max_plus_one = NULL;
+ ASN1_INTEGER *orig;
BIGNUM *bn = NULL;
int i, ret = 0;
@@ -298,9 +299,15 @@ static int ASIdentifierChoice_is_canonical(ASIdentifierChoice *choice)
*/
if ((bn == NULL && (bn = BN_new()) == NULL) ||
ASN1_INTEGER_to_BN(a_max, bn) == NULL ||
- !BN_add_word(bn, 1) ||
- (a_max_plus_one =
- BN_to_ASN1_INTEGER(bn, a_max_plus_one)) == NULL) {
+ !BN_add_word(bn, 1)) {
+ X509V3err(X509V3_F_ASIDENTIFIERCHOICE_IS_CANONICAL,
+ ERR_R_MALLOC_FAILURE);
+ goto done;
+ }
+
+ if ((a_max_plus_one =
+ BN_to_ASN1_INTEGER(bn, orig = a_max_plus_one)) == NULL) {
+ a_max_plus_one = orig;
X509V3err(X509V3_F_ASIDENTIFIERCHOICE_IS_CANONICAL,
ERR_R_MALLOC_FAILURE);
goto done;
@@ -351,6 +358,7 @@ int X509v3_asid_is_canonical(ASIdentifiers *asid)
static int ASIdentifierChoice_canonize(ASIdentifierChoice *choice)
{
ASN1_INTEGER *a_max_plus_one = NULL;
+ ASN1_INTEGER *orig;
BIGNUM *bn = NULL;
int i, ret = 0;
@@ -416,9 +424,15 @@ static int ASIdentifierChoice_canonize(ASIdentifierChoice *choice)
*/
if ((bn == NULL && (bn = BN_new()) == NULL) ||
ASN1_INTEGER_to_BN(a_max, bn) == NULL ||
- !BN_add_word(bn, 1) ||
- (a_max_plus_one =
- BN_to_ASN1_INTEGER(bn, a_max_plus_one)) == NULL) {
+ !BN_add_word(bn, 1)) {
+ X509V3err(X509V3_F_ASIDENTIFIERCHOICE_CANONIZE,
+ ERR_R_MALLOC_FAILURE);
+ goto done;
+ }
+
+ if ((a_max_plus_one =
+ BN_to_ASN1_INTEGER(bn, orig = a_max_plus_one)) == NULL) {
+ a_max_plus_one = orig;
X509V3err(X509V3_F_ASIDENTIFIERCHOICE_CANONIZE,
ERR_R_MALLOC_FAILURE);
goto done;
system/base/openssl/files/openssl-1.1.1d-fix-zlib.patch
+52
View File
@@ -0,0 +1,52 @@
From 86ed78676c660b553696cc10c682962522dfeb6c Mon Sep 17 00:00:00 2001
From: Tomas Mraz <tmraz@fedoraproject.org>
Date: Thu, 12 Sep 2019 12:27:36 +0200
Subject: [PATCH] BIO_f_zlib: Properly handle BIO_CTRL_PENDING and
BIO_CTRL_WPENDING calls.
There can be data to write in output buffer and data to read that were
not yet read in the input stream.
Fixes #9866
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/9877)
(cherry picked from commit 6beb8b39ba8e4cb005c1fcd2586ba19e17f04b95)
---
crypto/comp/c_zlib.c | 22 ++++++++++++++++++++++
1 file changed, 22 insertions(+)
diff --git a/crypto/comp/c_zlib.c b/crypto/comp/c_zlib.c
index d688deee5f2..7c1be358fd7 100644
--- a/crypto/comp/c_zlib.c
+++ b/crypto/comp/c_zlib.c
@@ -598,6 +598,28 @@ static long bio_zlib_ctrl(BIO *b, int cmd, long num, void *ptr)
BIO_copy_next_retry(b);
break;
+ case BIO_CTRL_WPENDING:
+ if (ctx->obuf == NULL)
+ return 0;
+
+ if (ctx->odone) {
+ ret = ctx->ocount;
+ } else {
+ ret = ctx->ocount;
+ if (ret == 0)
+ /* Unknown amount pending but we are not finished */
+ ret = 1;
+ }
+ if (ret == 0)
+ ret = BIO_ctrl(next, cmd, num, ptr);
+ break;
+
+ case BIO_CTRL_PENDING:
+ ret = ctx->zin.avail_in;
+ if (ret == 0)
+ ret = BIO_ctrl(next, cmd, num, ptr);
+ break;
+
default:
ret = BIO_ctrl(next, cmd, num, ptr);
break;
system/base/openssl/files/openssl-1.1.1d-reenable-the-stitched-AES-CBC-HMAC-SHA-implementations.patch
+62
View File
@@ -0,0 +1,62 @@
From 61cc715240d2d3f9511ca88043a3e9797c11482f Mon Sep 17 00:00:00 2001
From: Richard Levitte <levitte@openssl.org>
Date: Thu, 3 Oct 2019 08:28:31 +0200
Subject: [PATCH] Define AESNI_ASM if AESNI assembler is included, and use it
Because we have cases where basic assembler support isn't present, but
AESNI asssembler support is, we need a separate macro that indicates
that, and use it.
Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/10080)
---
Configure | 1 +
crypto/evp/e_aes_cbc_hmac_sha1.c | 2 +-
crypto/evp/e_aes_cbc_hmac_sha256.c | 4 ++--
3 files changed, 4 insertions(+), 3 deletions(-)
diff --git a/Configure b/Configure
index 811bee81f54..f498ac2f81b 100755
--- a/Configure
+++ b/Configure
@@ -1376,6 +1376,7 @@ unless ($disabled{asm}) {
}
if ($target{aes_asm_src}) {
push @{$config{lib_defines}}, "AES_ASM" if ($target{aes_asm_src} =~ m/\baes-/);;
+ push @{$config{lib_defines}}, "AESNI_ASM" if ($target{aes_asm_src} =~ m/\baesni-/);;
# aes-ctr.fake is not a real file, only indication that assembler
# module implements AES_ctr32_encrypt...
push @{$config{lib_defines}}, "AES_CTR_ASM" if ($target{aes_asm_src} =~ s/\s*aes-ctr\.fake//);
diff --git a/crypto/evp/e_aes_cbc_hmac_sha1.c b/crypto/evp/e_aes_cbc_hmac_sha1.c
index c9f5969162c..27c36b46e7a 100644
--- a/crypto/evp/e_aes_cbc_hmac_sha1.c
+++ b/crypto/evp/e_aes_cbc_hmac_sha1.c
@@ -33,7 +33,7 @@ typedef struct {
#define NO_PAYLOAD_LENGTH ((size_t)-1)
-#if defined(AES_ASM) && ( \
+#if defined(AESNI_ASM) && ( \
defined(__x86_64) || defined(__x86_64__) || \
defined(_M_AMD64) || defined(_M_X64) )
diff --git a/crypto/evp/e_aes_cbc_hmac_sha256.c b/crypto/evp/e_aes_cbc_hmac_sha256.c
index d5178313ae3..cc622b6faa8 100644
--- a/crypto/evp/e_aes_cbc_hmac_sha256.c
+++ b/crypto/evp/e_aes_cbc_hmac_sha256.c
@@ -34,7 +34,7 @@ typedef struct {
# define NO_PAYLOAD_LENGTH ((size_t)-1)
-#if defined(AES_ASM) && ( \
+#if defined(AESNI_ASM) && ( \
defined(__x86_64) || defined(__x86_64__) || \
defined(_M_AMD64) || defined(_M_X64) )
@@ -947,4 +947,4 @@ const EVP_CIPHER *EVP_aes_256_cbc_hmac_sha256(void)
{
return NULL;
}
-#endif
+#endif /* AESNI_ASM */
system/base/openssl/files/openssl-alpha-ccc.patch
Regular → Executable
View File
system/base/openssl/files/openssl-asflag.patch
Regular → Executable
View File
system/base/openssl/files/openssl-c_rehash.sh
Regular → Executable
View File
system/base/openssl/files/openssl-ca-certificates.patch
Regular → Executable
View File
system/base/openssl/files/openssl-find.patch
Regular → Executable
View File
system/base/openssl/files/openssl-include.patch
Regular → Executable
View File
system/base/openssl/files/openssl-ldflags.patch
Regular → Executable
View File
system/base/openssl/files/openssl-man-namespace.patch
Regular → Executable
View File
system/base/openssl/files/openssl-optflags.patch
Regular → Executable
View File
system/base/openssl/files/openssl-ssl-certificate.sh
Regular → Executable
View File
system/base/openssl/files/openssl_fix_for_x32.patch
Regular → Executable
View File
system/base/openssl/files/pic.patch
Regular → Executable
View File
system/base/openssl/pspec.xml
Regular → Executable
+22 -9
View File
@@ -13,10 +13,10 @@
<IsA>library</IsA>
<Summary>Toolkit for SSL v2/v3 and TLS v1</Summary>
<Description>OpenSSL is a cryptography toolkit implementing the Secure Sockets Layer (SSL v2/v3) and Transport Layer Security (TLS v1) network protocols and related cryptography standards required by them.</Description>
<Archive sha1sum="692f5f2f1b114f8adaadaa3e7be8cce1907f38c5" type="targz">https://www.openssl.org/source/openssl-1.0.2q.tar.gz</Archive>
<Archive sha1sum="056057782325134b76d1931c48f2c7e6595d7ef4" type="targz">https://www.openssl.org/source/openssl-1.1.1d.tar.gz</Archive>
<AdditionalFiles>
<AdditionalFile target="openssl-1.0.0-beta4-ca-dir.patch">openssl-1.0.0-beta4-ca-dir.patch</AdditionalFile>
<!--AdditionalFile target="ca-dir.patch">ca-dir.patch</AdditionalFile-->
<!--<AdditionalFile target="openssl-1.0.0-beta4-ca-dir.patch">openssl-1.0.0-beta4-ca-dir.patch</AdditionalFile>-->
<!-- <AdditionalFile target="ca-dir.patch">ca-dir.patch</AdditionalFile> -->
</AdditionalFiles>
<BuildDependencies>
<Dependency>zlib-devel</Dependency>
@@ -25,16 +25,22 @@
<Dependency>sed</Dependency>
</BuildDependencies>
<Patches>
<Patch>openssl-alpha-ccc.patch</Patch>
<Patch>openssl-optflags.patch</Patch>
<Patch>openssl-include.patch</Patch>
<Patch>openssl-man-namespace.patch</Patch>
<Patch>openssl-asflag.patch</Patch>
<!-- <Patch>openssl-alpha-ccc.patch</Patch> -->
<!-- <Patch>openssl-optflags.patch</Patch> -->
<!-- <Patch>openssl-include.patch</Patch> -->
<!-- <Patch>openssl-man-namespace.patch</Patch> -->
<!-- <Patch>openssl-asflag.patch</Patch>
<Patch>openssl-ca-certificates.patch</Patch>
<Patch>openssl-ldflags.patch</Patch>
<Patch>openssl-find.patch</Patch>
<Patch>pic.patch</Patch>
<Patch>openssl_fix_for_x32.patch</Patch>
<Patch>openssl_fix_for_x32.patch</Patch>-->
<Patch level="1">openssl-1.0.2a-x32-asm.patch</Patch>
<!-- <Patch level="1">openssl-1.1.0l-fix-no-ec2m-in-ec_curve.c.patch</Patch> -->
<Patch level="1">openssl-1.1.1d-fix-potential-memleaks-w-BN_to_ASN1_INTEGER.patch</Patch>
<Patch level="1">openssl-1.1.1d-fix-zlib.patch</Patch>
<Patch level="1">openssl-1.1.1d-reenable-the-stitched-AES-CBC-HMAC-SHA-implementations.patch</Patch>
</Patches>
</Source>
@@ -92,6 +98,13 @@
</Package>
<History>
<Update release="8">
<Date>2019-12-23</Date>
<Version>1.1.1d</Version>
<Comment>Version bump.</Comment>
<Name>Idris Kalp</Name>
<Email>idriskalp@gmail.com</Email>
</Update>
<Update release="7">
<Date>2018-11-28</Date>
<Version>1.0.2q</Version>
system/base/openssl/translations.xml
Regular → Executable
View File