main/openssl: fix rpath and turn off ssl compression by default

System wide mitigation for CVE-2012-4929. While most affected
programs turn off compression themselves, this is safer default.

1 files changed, 32 insertions, 0 deletions

diff --git a/main/openssl/1004-crypto-engine-autoload-padlock-dynamic-engine.patch b/main/openssl/1004-crypto-engine-autoload-padlock-dynamic-engine.patch
new file mode 100644
index 0000000000..d0cdfb3b3a
--- /dev/null
+++ b/main/openssl/1004-crypto-engine-autoload-padlock-dynamic-engine.patch
@@ -0,0 +1,32 @@
+From a358a1267644829144d6ad35116733ceeef46bf1 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Timo=20Ter=C3=A4s?= <timo.teras@iki.fi>
+Date: Thu, 5 Feb 2015 09:43:37 +0200
+Subject: [PATCH] crypto/engine: autoload padlock dynamic engine
+
+---
+ crypto/engine/eng_all.c | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+diff --git a/crypto/engine/eng_all.c b/crypto/engine/eng_all.c
+index 195a3a9..bd05e4c 100644
+--- a/crypto/engine/eng_all.c
++++ b/crypto/engine/eng_all.c
+@@ -120,6 +120,15 @@ void ENGINE_load_builtin_engines(void)
+     ENGINE_load_capi();
+ # endif
+ #endif
++#ifdef OPENSSL_NO_STATIC_ENGINE
++    {
++        ENGINE *e = ENGINE_by_id("padlock");
++        if (e != NULL) {
++            ENGINE_add(e);
++            ENGINE_free(e);
++        }
++    }
++#endif
+     ENGINE_register_all_complete();
+ }
+ 
+-- 
+2.2.2
+