diff options
| -rw-r--r-- | main/openssl/APKBUILD | 36 | ||||
| -rw-r--r-- | main/openssl/openssl-0.9.8l-CVE-2009-1377.patch | 53 | ||||
| -rw-r--r-- | main/openssl/openssl-0.9.8l-CVE-2009-1378.patch | 24 | ||||
| -rw-r--r-- | main/openssl/openssl-0.9.8l-CVE-2009-1379.patch | 22 | ||||
| -rw-r--r-- | main/openssl/openssl-0.9.8l-CVE-2009-1387.patch | 59 | ||||
| -rw-r--r-- | main/openssl/openssl-0.9.8l-CVE-2009-2409.patch | 71 |
6 files changed, 16 insertions, 249 deletions
diff --git a/main/openssl/APKBUILD b/main/openssl/APKBUILD index fddbf2119d..8efcefea75 100644 --- a/main/openssl/APKBUILD +++ b/main/openssl/APKBUILD @@ -1,7 +1,7 @@ # Maintainer: Natanael Copa <ncopa@alpinelinux.org> pkgname=openssl -pkgver=0.9.8l -pkgrel=1 +pkgver=0.9.8m +pkgrel=0 pkgdesc="Toolkit for SSL v2/v3 and TLS v1" url=http://openssl.org depends= @@ -13,25 +13,27 @@ subpackages="$pkgname-dev $pkgname-doc libcrypto" source="http://www.openssl.org/source/${pkgname}-${pkgver}.tar.gz http://www.linuxfromscratch.org/patches/downloads/openssl/openssl-0.9.8g-fix_manpages-1.patch openssl-bb-basename.patch - openssl-0.9.8k-quote-cc.patch openssl-0.9.8k-padlock-sha.patch - openssl-0.9.8l-CVE-2009-1377.patch - openssl-0.9.8l-CVE-2009-1378.patch - openssl-0.9.8l-CVE-2009-1379.patch - openssl-0.9.8l-CVE-2009-1387.patch - openssl-0.9.8l-CVE-2009-2409.patch " - -build() { - cd "$startdir"/src/$pkgname-$pkgver + +_builddir="$srcdir"/$pkgname-$pkgver +prepare() { + cd "$_builddir" for i in ../*.patch; do msg "Applying $i..." - patch -p1 < $i || return 1 + patch -p1 -N < $i || return 1 done +} +build() { + cd "$_builddir" ./config --prefix=/usr --openssldir=/etc/ssl shared enable-montasm make -j1 || return 1 +} + +package() { + cd "$_builddir" make -j1 INSTALL_PREFIX="$pkgdir" MANDIR=/usr/share/man install } @@ -46,13 +48,7 @@ libcrypto() { mv "$pkgdir"/usr/lib/engines "$subpkgdir"/usr/lib/ } -md5sums="05a0ece1372392a2cf310ebb96333025 openssl-0.9.8l.tar.gz +md5sums="898bf125370926d5f692a2201124f8ec openssl-0.9.8m.tar.gz 04a6a88c2ee4badd4f8649792b73eaf3 openssl-0.9.8g-fix_manpages-1.patch c6a9857a5dbd30cead0404aa7dd73977 openssl-bb-basename.patch -c838eb8488896cfeb7de957a0cbe04ae openssl-0.9.8k-quote-cc.patch -86b7f1bf50e1f3ba407ec62001a51a0d openssl-0.9.8k-padlock-sha.patch -36694a8dd1c7164f1021f6f24ef20ab9 openssl-0.9.8l-CVE-2009-1377.patch -80b8c77288a6fde633f8ac3a33e21d31 openssl-0.9.8l-CVE-2009-1378.patch -da60b14279e076a19e783f07d8a60d24 openssl-0.9.8l-CVE-2009-1379.patch -926b151cb1e32dc6e9b1c9a25f218a31 openssl-0.9.8l-CVE-2009-1387.patch -595f5bda14198b3aa83a854b1d4fcfb0 openssl-0.9.8l-CVE-2009-2409.patch" +86b7f1bf50e1f3ba407ec62001a51a0d openssl-0.9.8k-padlock-sha.patch" diff --git a/main/openssl/openssl-0.9.8l-CVE-2009-1377.patch b/main/openssl/openssl-0.9.8l-CVE-2009-1377.patch deleted file mode 100644 index a3a51f0fd1..0000000000 --- a/main/openssl/openssl-0.9.8l-CVE-2009-1377.patch +++ /dev/null @@ -1,53 +0,0 @@ -http://rt.openssl.org/Ticket/Display.html?id=1931&user=guest&pass=guest - -Index: openssl/crypto/pqueue/pqueue.c -RCS File: /v/openssl/cvs/openssl/crypto/pqueue/pqueue.c,v -rcsdiff -q -kk '-r1.2.2.4' '-r1.2.2.5' -u '/v/openssl/cvs/openssl/crypto/pqueue/pqueue.c,v' 2>/dev/null ---- a/crypto/pqueue/pqueue.c 2005/06/28 12:53:33 1.2.2.4 -+++ b/crypto/pqueue/pqueue.c 2009/05/16 16:18:44 1.2.2.5 -@@ -234,3 +234,17 @@ - - return ret; - } -+ -+int -+pqueue_size(pqueue_s *pq) -+{ -+ pitem *item = pq->items; -+ int count = 0; -+ -+ while(item != NULL) -+ { -+ count++; -+ item = item->next; -+ } -+ return count; -+} -Index: openssl/crypto/pqueue/pqueue.h -RCS File: /v/openssl/cvs/openssl/crypto/pqueue/pqueue.h,v -rcsdiff -q -kk '-r1.2.2.1' '-r1.2.2.2' -u '/v/openssl/cvs/openssl/crypto/pqueue/pqueue.h,v' 2>/dev/null ---- a/crypto/pqueue/pqueue.h 2005/05/30 22:34:27 1.2.2.1 -+++ b/crypto/pqueue/pqueue.h 2009/05/16 16:18:44 1.2.2.2 -@@ -91,5 +91,6 @@ - pitem *pqueue_next(piterator *iter); - - void pqueue_print(pqueue pq); -+int pqueue_size(pqueue pq); - - #endif /* ! HEADER_PQUEUE_H */ -Index: openssl/ssl/d1_pkt.c -RCS File: /v/openssl/cvs/openssl/ssl/d1_pkt.c,v -rcsdiff -q -kk '-r1.4.2.17' '-r1.4.2.18' -u '/v/openssl/cvs/openssl/ssl/d1_pkt.c,v' 2>/dev/null ---- a/ssl/d1_pkt.c 2009/05/16 15:51:59 1.4.2.17 -+++ b/ssl/d1_pkt.c 2009/05/16 16:18:45 1.4.2.18 -@@ -167,6 +167,10 @@ - DTLS1_RECORD_DATA *rdata; - pitem *item; - -+ /* Limit the size of the queue to prevent DOS attacks */ -+ if (pqueue_size(queue->q) >= 100) -+ return 0; -+ - rdata = OPENSSL_malloc(sizeof(DTLS1_RECORD_DATA)); - item = pitem_new(priority, rdata); - if (rdata == NULL || item == NULL) diff --git a/main/openssl/openssl-0.9.8l-CVE-2009-1378.patch b/main/openssl/openssl-0.9.8l-CVE-2009-1378.patch deleted file mode 100644 index 9ec8a9f3a8..0000000000 --- a/main/openssl/openssl-0.9.8l-CVE-2009-1378.patch +++ /dev/null @@ -1,24 +0,0 @@ -http://rt.openssl.org/Ticket/Display.html?id=1931&user=guest&pass=guest - -Index: ssl/d1_both.c -=================================================================== ---- a/ssl/d1_both.c.orig -+++ b/ssl/d1_both.c -@@ -561,7 +561,16 @@ dtls1_process_out_of_seq_message(SSL *s, - if ((msg_hdr->frag_off+frag_len) > msg_hdr->msg_len) - goto err; - -- if (msg_hdr->seq <= s->d1->handshake_read_seq) -+ /* Try to find item in queue, to prevent duplicate entries */ -+ pq_64bit_init(&seq64); -+ pq_64bit_assign_word(&seq64, msg_hdr->seq); -+ item = pqueue_find(s->d1->buffered_messages, seq64); -+ pq_64bit_free(&seq64); -+ -+ /* Discard the message if sequence number was already there, is -+ * too far in the future or the fragment is already in the queue */ -+ if (msg_hdr->seq <= s->d1->handshake_read_seq || -+ msg_hdr->seq > s->d1->handshake_read_seq + 10 || item != NULL) - { - unsigned char devnull [256]; - diff --git a/main/openssl/openssl-0.9.8l-CVE-2009-1379.patch b/main/openssl/openssl-0.9.8l-CVE-2009-1379.patch deleted file mode 100644 index b70772c976..0000000000 --- a/main/openssl/openssl-0.9.8l-CVE-2009-1379.patch +++ /dev/null @@ -1,22 +0,0 @@ -Index: openssl/ssl/d1_both.c -RCS File: /v/openssl/cvs/openssl/ssl/d1_both.c,v -rcsdiff -q -kk '-r1.14.2.6' '-r1.14.2.7' -u '/v/openssl/cvs/openssl/ssl/d1_both.c,v' 2>/dev/null ---- a/ssl/d1_both.c 2009/04/22 12:17:02 1.14.2.6 -+++ b/ssl/d1_both.c 2009/05/13 11:51:30 1.14.2.7 -@@ -519,6 +519,7 @@ - - if ( s->d1->handshake_read_seq == frag->msg_header.seq) - { -+ unsigned long frag_len = frag->msg_header.frag_len; - pqueue_pop(s->d1->buffered_messages); - - al=dtls1_preprocess_fragment(s,&frag->msg_header,max); -@@ -536,7 +537,7 @@ - if (al==0) - { - *ok = 1; -- return frag->msg_header.frag_len; -+ return frag_len; - } - - ssl3_send_alert(s,SSL3_AL_FATAL,al); diff --git a/main/openssl/openssl-0.9.8l-CVE-2009-1387.patch b/main/openssl/openssl-0.9.8l-CVE-2009-1387.patch deleted file mode 100644 index c8ff15e505..0000000000 --- a/main/openssl/openssl-0.9.8l-CVE-2009-1387.patch +++ /dev/null @@ -1,59 +0,0 @@ -http://bugs.gentoo.org/270305 - -fix from upstream - -Index: ssl/d1_both.c -=================================================================== -RCS file: /usr/local/src/openssl/CVSROOT/openssl/ssl/d1_both.c,v -retrieving revision 1.4.2.7 -retrieving revision 1.4.2.8 -diff -u -p -r1.4.2.7 -r1.4.2.8 ---- a/ssl/d1_both.c 17 Oct 2007 21:17:49 -0000 1.4.2.7 -+++ b/ssl/d1_both.c 2 Apr 2009 22:12:13 -0000 1.4.2.8 -@@ -575,30 +575,31 @@ dtls1_process_out_of_seq_message(SSL *s, - } - } - -- frag = dtls1_hm_fragment_new(frag_len); -- if ( frag == NULL) -- goto err; -+ if (frag_len) -+ { -+ frag = dtls1_hm_fragment_new(frag_len); -+ if ( frag == NULL) -+ goto err; - -- memcpy(&(frag->msg_header), msg_hdr, sizeof(*msg_hdr)); -+ memcpy(&(frag->msg_header), msg_hdr, sizeof(*msg_hdr)); - -- if (frag_len) -- { -- /* read the body of the fragment (header has already been read */ -+ /* read the body of the fragment (header has already been read) */ - i = s->method->ssl_read_bytes(s,SSL3_RT_HANDSHAKE, - frag->fragment,frag_len,0); - if (i<=0 || (unsigned long)i!=frag_len) - goto err; -- } - -- pq_64bit_init(&seq64); -- pq_64bit_assign_word(&seq64, msg_hdr->seq); -+ pq_64bit_init(&seq64); -+ pq_64bit_assign_word(&seq64, msg_hdr->seq); - -- item = pitem_new(seq64, frag); -- pq_64bit_free(&seq64); -- if ( item == NULL) -- goto err; -+ item = pitem_new(seq64, frag); -+ pq_64bit_free(&seq64); -+ if ( item == NULL) -+ goto err; -+ -+ pqueue_insert(s->d1->buffered_messages, item); -+ } - -- pqueue_insert(s->d1->buffered_messages, item); - return DTLS1_HM_FRAGMENT_RETRY; - - err: diff --git a/main/openssl/openssl-0.9.8l-CVE-2009-2409.patch b/main/openssl/openssl-0.9.8l-CVE-2009-2409.patch deleted file mode 100644 index 6e485c3b7c..0000000000 --- a/main/openssl/openssl-0.9.8l-CVE-2009-2409.patch +++ /dev/null @@ -1,71 +0,0 @@ -http://bugs.gentoo.org/280591 - -fix from upstream - -http://cvs.openssl.org/chngview?cn=18260 - -Index: openssl/crypto/x509/x509_vfy.c -RCS File: /v/openssl/cvs/openssl/crypto/x509/x509_vfy.c,v -rcsdiff -q -kk '-r1.77.2.8' '-r1.77.2.9' -u '/v/openssl/cvs/openssl/crypto/x509/x509_vfy.c,v' 2>/dev/null ---- a/crypto/x509/x509_vfy.c 2008/07/13 14:33:15 1.77.2.8 -+++ b/crypto/x509/x509_vfy.c 2009/06/15 14:52:38 1.77.2.9 -@@ -986,7 +986,11 @@ - while (n >= 0) - { - ctx->error_depth=n; -- if (!xs->valid) -+ -+ /* Skip signature check for self signed certificates. It -+ * doesn't add any security and just wastes time. -+ */ -+ if (!xs->valid && xs != xi) - { - if ((pkey=X509_get_pubkey(xi)) == NULL) - { -@@ -996,13 +1000,6 @@ - if (!ok) goto end; - } - else if (X509_verify(xs,pkey) <= 0) -- /* XXX For the final trusted self-signed cert, -- * this is a waste of time. That check should -- * optional so that e.g. 'openssl x509' can be -- * used to detect invalid self-signatures, but -- * we don't verify again and again in SSL -- * handshakes and the like once the cert has -- * been declared trusted. */ - { - ctx->error=X509_V_ERR_CERT_SIGNATURE_FAILURE; - ctx->current_cert=xs; - -http://cvs.openssl.org/chngview?cn=18317 - -Index: openssl/crypto/evp/c_alld.c -RCS File: /v/openssl/cvs/openssl/crypto/evp/c_alld.c,v -rcsdiff -q -kk '-r1.7' '-r1.7.2.1' -u '/v/openssl/cvs/openssl/crypto/evp/c_alld.c,v' 2>/dev/null ---- a/crypto/evp/c_alld.c 2005/04/30 21:51:40 1.7 -+++ b/crypto/evp/c_alld.c 2009/07/08 08:33:26 1.7.2.1 -@@ -64,9 +64,6 @@ - - void OpenSSL_add_all_digests(void) - { --#ifndef OPENSSL_NO_MD2 -- EVP_add_digest(EVP_md2()); --#endif - #ifndef OPENSSL_NO_MD4 - EVP_add_digest(EVP_md4()); - #endif -Index: openssl/ssl/ssl_algs.c -RCS File: /v/openssl/cvs/openssl/ssl/ssl_algs.c,v -rcsdiff -q -kk '-r1.12.2.3' '-r1.12.2.4' -u '/v/openssl/cvs/openssl/ssl/ssl_algs.c,v' 2>/dev/null ---- a/ssl/ssl_algs.c 2007/04/23 23:50:21 1.12.2.3 -+++ b/ssl/ssl_algs.c 2009/07/08 08:33:27 1.12.2.4 -@@ -92,9 +92,6 @@ - EVP_add_cipher(EVP_seed_cbc()); - #endif - --#ifndef OPENSSL_NO_MD2 -- EVP_add_digest(EVP_md2()); --#endif - #ifndef OPENSSL_NO_MD5 - EVP_add_digest(EVP_md5()); - EVP_add_digest_alias(SN_md5,"ssl2-md5"); |