1 |
commit: 84dd7ff3292161696670435a2e1bda4dc2091cbd |
2 |
Author: Jason A. Donenfeld <zx2c4 <AT> gentoo <DOT> org> |
3 |
AuthorDate: Wed Jan 2 19:07:17 2019 +0000 |
4 |
Commit: Jason A. Donenfeld <zx2c4 <AT> gentoo <DOT> org> |
5 |
CommitDate: Wed Jan 2 19:11:04 2019 +0000 |
6 |
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=84dd7ff3 |
7 |
|
8 |
mail-mta/opensmtpd: port to openssl 1.1 |
9 |
|
10 |
Package-Manager: Portage-2.3.53, Repoman-2.3.12 |
11 |
Signed-off-by: Jason A. Donenfeld <zx2c4 <AT> gentoo.org> |
12 |
|
13 |
.../opensmtpd-6.0.3_p1-fix-crash-on-auth.patch | 43 ++ |
14 |
.../files/opensmtpd-6.0.3_p1-openssl_1.1.patch | 722 +++++++++++++++++++++ |
15 |
....0.3_p1.ebuild => opensmtpd-6.0.3_p1-r1.ebuild} | 6 +- |
16 |
3 files changed, 770 insertions(+), 1 deletion(-) |
17 |
|
18 |
diff --git a/mail-mta/opensmtpd/files/opensmtpd-6.0.3_p1-fix-crash-on-auth.patch b/mail-mta/opensmtpd/files/opensmtpd-6.0.3_p1-fix-crash-on-auth.patch |
19 |
new file mode 100644 |
20 |
index 00000000000..c20b5e0a0ef |
21 |
--- /dev/null |
22 |
+++ b/mail-mta/opensmtpd/files/opensmtpd-6.0.3_p1-fix-crash-on-auth.patch |
23 |
@@ -0,0 +1,43 @@ |
24 |
+From 9b5f70b93e038df5446bd37a4adac5a0380748e7 Mon Sep 17 00:00:00 2001 |
25 |
+From: johannes <johannes.brechtmann@×××××.com> |
26 |
+Date: Wed, 21 Feb 2018 23:57:11 +0100 |
27 |
+Subject: [PATCH] crypt_checkpass: include HAVE_CRYPT_H definition, add NULL |
28 |
+ check |
29 |
+ |
30 |
+--- |
31 |
+ openbsd-compat/crypt_checkpass.c | 9 ++++++++- |
32 |
+ 1 file changed, 8 insertions(+), 1 deletion(-) |
33 |
+ |
34 |
+diff --git a/openbsd-compat/crypt_checkpass.c b/openbsd-compat/crypt_checkpass.c |
35 |
+index dafd2dae..d10b3a57 100644 |
36 |
+--- a/openbsd-compat/crypt_checkpass.c |
37 |
++++ b/openbsd-compat/crypt_checkpass.c |
38 |
+@@ -1,5 +1,6 @@ |
39 |
+ /* OPENBSD ORIGINAL: lib/libc/crypt/cryptutil.c */ |
40 |
+ |
41 |
++#include "includes.h" |
42 |
+ #include <errno.h> |
43 |
+ #ifdef HAVE_CRYPT_H |
44 |
+ #include <crypt.h> |
45 |
+@@ -10,6 +11,8 @@ |
46 |
+ int |
47 |
+ crypt_checkpass(const char *pass, const char *goodhash) |
48 |
+ { |
49 |
++ char *c; |
50 |
++ |
51 |
+ if (goodhash == NULL) |
52 |
+ goto fail; |
53 |
+ |
54 |
+@@ -17,7 +20,11 @@ crypt_checkpass(const char *pass, const char *goodhash) |
55 |
+ if (strlen(goodhash) == 0 && strlen(pass) == 0) |
56 |
+ return 0; |
57 |
+ |
58 |
+- if (strcmp(crypt(pass, goodhash), goodhash) == 0) |
59 |
++ c = crypt(pass, goodhash); |
60 |
++ if (c == NULL) |
61 |
++ goto fail; |
62 |
++ |
63 |
++ if (strcmp(c, goodhash) == 0) |
64 |
+ return 0; |
65 |
+ |
66 |
+ fail: |
67 |
|
68 |
diff --git a/mail-mta/opensmtpd/files/opensmtpd-6.0.3_p1-openssl_1.1.patch b/mail-mta/opensmtpd/files/opensmtpd-6.0.3_p1-openssl_1.1.patch |
69 |
new file mode 100644 |
70 |
index 00000000000..40a62ae9251 |
71 |
--- /dev/null |
72 |
+++ b/mail-mta/opensmtpd/files/opensmtpd-6.0.3_p1-openssl_1.1.patch |
73 |
@@ -0,0 +1,722 @@ |
74 |
+Description: Enable support for OpenSSL 1.1 |
75 |
+Author: Sebastian Andrzej Siewior <sebastian@××××××××××.cc> |
76 |
+ Ryan Kavanagh <rak@××××××.org> |
77 |
+Origin: Debian |
78 |
+Bug: https://github.com/OpenSMTPD/OpenSMTPD/issues/738 |
79 |
+Bug-Debian: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=859544 |
80 |
+Forwarded: https://github.com/OpenSMTPD/OpenSMTPD/pull/825 |
81 |
+Last-Update: 2018-03-18 |
82 |
+--- |
83 |
+This patch header follows DEP-3: http://dep.debian.net/deps/dep3/ |
84 |
+diff --git a/openbsd-compat/libressl.c b/openbsd-compat/libressl.c |
85 |
+index f4f2b52e..d06e006f 100644 |
86 |
+--- a/openbsd-compat/libressl.c |
87 |
++++ b/openbsd-compat/libressl.c |
88 |
+@@ -81,14 +81,14 @@ SSL_CTX_use_certificate_chain(SSL_CTX *ctx, char *buf, off_t len) |
89 |
+ x = ca = NULL; |
90 |
+ |
91 |
+ if ((in = BIO_new_mem_buf(buf, len)) == NULL) { |
92 |
+- SSLerr(SSL_F_SSL_CTX_USE_CERTIFICATE_CHAIN_FILE, ERR_R_BUF_LIB); |
93 |
++ SSLerr(SSL_F_SSL_CTX_USE_CERTIFICATE_FILE, ERR_R_BUF_LIB); |
94 |
+ goto end; |
95 |
+ } |
96 |
+ |
97 |
+ if ((x = PEM_read_bio_X509(in, NULL, |
98 |
+- ctx->default_passwd_callback, |
99 |
+- ctx->default_passwd_callback_userdata)) == NULL) { |
100 |
+- SSLerr(SSL_F_SSL_CTX_USE_CERTIFICATE_CHAIN_FILE, ERR_R_PEM_LIB); |
101 |
++ SSL_CTX_get_default_passwd_cb(ctx), |
102 |
++ SSL_CTX_get_default_passwd_cb_userdata(ctx))) == NULL) { |
103 |
++ SSLerr(SSL_F_SSL_CTX_USE_CERTIFICATE_FILE, ERR_R_PEM_LIB); |
104 |
+ goto end; |
105 |
+ } |
106 |
+ |
107 |
+@@ -99,14 +99,11 @@ SSL_CTX_use_certificate_chain(SSL_CTX *ctx, char *buf, off_t len) |
108 |
+ * the CA certificates. |
109 |
+ */ |
110 |
+ |
111 |
+- if (ctx->extra_certs != NULL) { |
112 |
+- sk_X509_pop_free(ctx->extra_certs, X509_free); |
113 |
+- ctx->extra_certs = NULL; |
114 |
+- } |
115 |
++ SSL_CTX_clear_extra_chain_certs(ctx); |
116 |
+ |
117 |
+ while ((ca = PEM_read_bio_X509(in, NULL, |
118 |
+- ctx->default_passwd_callback, |
119 |
+- ctx->default_passwd_callback_userdata)) != NULL) { |
120 |
++ SSL_CTX_get_default_passwd_cb(ctx), |
121 |
++ SSL_CTX_get_default_passwd_cb_userdata(ctx))) != NULL) { |
122 |
+ |
123 |
+ if (!SSL_CTX_add_extra_chain_cert(ctx, ca)) |
124 |
+ goto end; |
125 |
+diff --git a/smtpd/ca.c b/smtpd/ca.c |
126 |
+index e383c6a1..29a44b9b 100644 |
127 |
+--- a/smtpd/ca.c |
128 |
++++ b/smtpd/ca.c |
129 |
+@@ -170,6 +170,190 @@ ca_verify_cb(int ok, X509_STORE_CTX *ctx) |
130 |
+ return ok; |
131 |
+ } |
132 |
+ |
133 |
++#if (OPENSSL_VERSION_NUMBER < 0x10100000L) || defined(LIBRESSL_VERSION_NUMBER) |
134 |
++ |
135 |
++static int RSA_meth_get_flags(RSA_METHOD *meth) |
136 |
++{ |
137 |
++ return meth->flags; |
138 |
++} |
139 |
++ |
140 |
++static int RSA_meth_set_flags(RSA_METHOD *meth, int flags) |
141 |
++{ |
142 |
++ meth->flags = flags; |
143 |
++ return 1; |
144 |
++} |
145 |
++ |
146 |
++static void *RSA_meth_get0_app_data(const RSA_METHOD *meth) |
147 |
++{ |
148 |
++ return meth->app_data; |
149 |
++} |
150 |
++ |
151 |
++static int RSA_meth_set0_app_data(RSA_METHOD *meth, void *app_data) |
152 |
++{ |
153 |
++ meth->app_data = app_data; |
154 |
++ return 1; |
155 |
++} |
156 |
++ |
157 |
++static int (*RSA_meth_get_pub_enc(const RSA_METHOD *meth)) |
158 |
++(int flen, const unsigned char *from, unsigned char *to, RSA *rsa, int padding) |
159 |
++{ |
160 |
++ return meth->rsa_pub_enc; |
161 |
++} |
162 |
++ |
163 |
++static int RSA_meth_set_pub_enc(RSA_METHOD *meth, |
164 |
++ int (*pub_enc) (int flen, const unsigned char *from, |
165 |
++ unsigned char *to, RSA *rsa, |
166 |
++ int padding)) |
167 |
++{ |
168 |
++ meth->rsa_pub_enc = pub_enc; |
169 |
++ return 1; |
170 |
++} |
171 |
++ |
172 |
++static int (*RSA_meth_get_pub_dec(const RSA_METHOD *meth)) |
173 |
++(int flen, const unsigned char *from, unsigned char *to, RSA *rsa, int padding) |
174 |
++{ |
175 |
++ return meth->rsa_pub_dec; |
176 |
++} |
177 |
++ |
178 |
++static int (*RSA_meth_get_priv_enc(const RSA_METHOD *meth)) |
179 |
++(int flen, const unsigned char *from, unsigned char *to, RSA *rsa, int padding) |
180 |
++{ |
181 |
++ return meth->rsa_priv_enc; |
182 |
++} |
183 |
++ |
184 |
++int RSA_meth_set_priv_enc(RSA_METHOD *meth, |
185 |
++ int (*priv_enc) (int flen, const unsigned char *from, |
186 |
++ unsigned char *to, RSA *rsa, int padding)) |
187 |
++{ |
188 |
++ meth->rsa_priv_enc = priv_enc; |
189 |
++ return 1; |
190 |
++} |
191 |
++ |
192 |
++static int (*RSA_meth_get_priv_dec(const RSA_METHOD *meth)) |
193 |
++(int flen, const unsigned char *from, unsigned char *to, RSA *rsa, int padding) |
194 |
++{ |
195 |
++ return meth->rsa_priv_dec; |
196 |
++} |
197 |
++ |
198 |
++static int RSA_meth_set_priv_dec(RSA_METHOD *meth, |
199 |
++ int (*priv_dec) (int flen, const unsigned char *from, |
200 |
++ unsigned char *to, RSA *rsa, int padding)) |
201 |
++{ |
202 |
++ meth->rsa_priv_dec = priv_dec; |
203 |
++ return 1; |
204 |
++} |
205 |
++ |
206 |
++static int (*RSA_meth_get_mod_exp(const RSA_METHOD *meth)) |
207 |
++ (BIGNUM *r0, const BIGNUM *I, RSA *rsa, BN_CTX *ctx) |
208 |
++{ |
209 |
++ return meth->rsa_mod_exp; |
210 |
++} |
211 |
++ |
212 |
++static int RSA_meth_set_mod_exp(RSA_METHOD *meth, |
213 |
++ int (*mod_exp) (BIGNUM *r0, const BIGNUM *I, RSA *rsa, BN_CTX *ctx)) |
214 |
++{ |
215 |
++ meth->rsa_mod_exp = mod_exp; |
216 |
++ return 1; |
217 |
++} |
218 |
++ |
219 |
++static int (*RSA_meth_get_bn_mod_exp(const RSA_METHOD *meth)) |
220 |
++(BIGNUM *r, const BIGNUM *a, const BIGNUM *p, const BIGNUM *m, BN_CTX *ctx, BN_MONT_CTX *m_ctx) |
221 |
++{ |
222 |
++ return meth->bn_mod_exp; |
223 |
++} |
224 |
++ |
225 |
++static int RSA_meth_set_bn_mod_exp(RSA_METHOD *meth, int (*bn_mod_exp) |
226 |
++ (BIGNUM *r, const BIGNUM *a, const BIGNUM *p, const BIGNUM *m, |
227 |
++ BN_CTX *ctx, BN_MONT_CTX *m_ctx)) |
228 |
++{ |
229 |
++ meth->bn_mod_exp = bn_mod_exp; |
230 |
++ return 1; |
231 |
++} |
232 |
++ |
233 |
++static int (*RSA_meth_get_init(const RSA_METHOD *meth)) (RSA *rsa) |
234 |
++{ |
235 |
++ return meth->init; |
236 |
++} |
237 |
++ |
238 |
++static int RSA_meth_set_init(RSA_METHOD *meth, int (*init) (RSA *rsa)) |
239 |
++{ |
240 |
++ meth->init = init; |
241 |
++ return 1; |
242 |
++} |
243 |
++ |
244 |
++static int (*RSA_meth_get_finish(const RSA_METHOD *meth)) (RSA *rsa) |
245 |
++{ |
246 |
++ return meth->finish; |
247 |
++} |
248 |
++ |
249 |
++static int RSA_meth_set_finish(RSA_METHOD *meth, int (*finish) (RSA *rsa)) |
250 |
++{ |
251 |
++ meth->finish = finish; |
252 |
++ return 1; |
253 |
++} |
254 |
++ |
255 |
++static int (*RSA_meth_get_keygen(const RSA_METHOD *meth)) |
256 |
++ (RSA *rsa, int bits, BIGNUM *e, BN_GENCB *cb) |
257 |
++{ |
258 |
++ return meth->rsa_keygen; |
259 |
++} |
260 |
++ |
261 |
++static int RSA_meth_set_keygen(RSA_METHOD *meth, int (*keygen) |
262 |
++ (RSA *rsa, int bits, BIGNUM *e, BN_GENCB *cb)) |
263 |
++{ |
264 |
++ meth->rsa_keygen = keygen; |
265 |
++ return 1; |
266 |
++} |
267 |
++ |
268 |
++static int (*RSA_meth_get_verify(const RSA_METHOD *meth)) |
269 |
++ (int dtype, const unsigned char *m, |
270 |
++ unsigned int m_length, const unsigned char *sigbuf, |
271 |
++ unsigned int siglen, const RSA *rsa) |
272 |
++{ |
273 |
++ if (meth->flags & RSA_FLAG_SIGN_VER) |
274 |
++ return meth->rsa_verify; |
275 |
++ return NULL; |
276 |
++} |
277 |
++ |
278 |
++static int (*RSA_meth_get_sign(const RSA_METHOD *meth)) |
279 |
++ (int type, |
280 |
++ const unsigned char *m, unsigned int m_length, |
281 |
++ unsigned char *sigret, unsigned int *siglen, |
282 |
++ const RSA *rsa) |
283 |
++{ |
284 |
++ if (meth->flags & RSA_FLAG_SIGN_VER) |
285 |
++ return meth->rsa_sign; |
286 |
++ return NULL; |
287 |
++} |
288 |
++ |
289 |
++static int RSA_meth_set_pub_dec(RSA_METHOD *meth, |
290 |
++ int (*pub_dec) (int flen, const unsigned char *from, |
291 |
++ unsigned char *to, RSA *rsa, int padding)) |
292 |
++{ |
293 |
++ meth->rsa_pub_dec = pub_dec; |
294 |
++ return 1; |
295 |
++} |
296 |
++ |
297 |
++static RSA_METHOD *RSA_meth_new(const char *name, int flags) |
298 |
++{ |
299 |
++ RSA_METHOD *meth = malloc(sizeof(*meth)); |
300 |
++ |
301 |
++ if (meth != NULL) { |
302 |
++ memset(meth, 0, sizeof(*meth)); |
303 |
++ meth->flags = flags; |
304 |
++ |
305 |
++ meth->name = strdup(name); |
306 |
++ if (meth->name != NULL) |
307 |
++ return meth; |
308 |
++ |
309 |
++ free(meth); |
310 |
++ } |
311 |
++ |
312 |
++ return NULL; |
313 |
++} |
314 |
++ |
315 |
++#endif |
316 |
++ |
317 |
+ int |
318 |
+ ca_X509_verify(void *certificate, void *chain, const char *CAfile, |
319 |
+ const char *CRLfile, const char **errstr) |
320 |
+@@ -201,7 +385,7 @@ end: |
321 |
+ *errstr = NULL; |
322 |
+ if (ret != 1) { |
323 |
+ if (xsc) |
324 |
+- *errstr = X509_verify_cert_error_string(xsc->error); |
325 |
++ *errstr = X509_verify_cert_error_string(X509_STORE_CTX_get_error(xsc)); |
326 |
+ else if (ERR_peek_last_error()) |
327 |
+ *errstr = ERR_error_string(ERR_peek_last_error(), NULL); |
328 |
+ } |
329 |
+@@ -302,24 +486,9 @@ ca_imsg(struct mproc *p, struct imsg *imsg) |
330 |
+ * RSA privsep engine (called from unprivileged processes) |
331 |
+ */ |
332 |
+ |
333 |
+-const RSA_METHOD *rsa_default = NULL; |
334 |
+- |
335 |
+-static RSA_METHOD rsae_method = { |
336 |
+- "RSA privsep engine", |
337 |
+- rsae_pub_enc, |
338 |
+- rsae_pub_dec, |
339 |
+- rsae_priv_enc, |
340 |
+- rsae_priv_dec, |
341 |
+- rsae_mod_exp, |
342 |
+- rsae_bn_mod_exp, |
343 |
+- rsae_init, |
344 |
+- rsae_finish, |
345 |
+- 0, |
346 |
+- NULL, |
347 |
+- NULL, |
348 |
+- NULL, |
349 |
+- rsae_keygen |
350 |
+-}; |
351 |
++static const RSA_METHOD *rsa_default = NULL; |
352 |
++ |
353 |
++static const char *rsae_method_name = "RSA privsep engine"; |
354 |
+ |
355 |
+ static int |
356 |
+ rsae_send_imsg(int flen, const unsigned char *from, unsigned char *to, |
357 |
+@@ -404,7 +573,7 @@ rsae_pub_enc(int flen,const unsigned char *from, unsigned char *to, RSA *rsa, |
358 |
+ int padding) |
359 |
+ { |
360 |
+ log_debug("debug: %s: %s", proc_name(smtpd_process), __func__); |
361 |
+- return (rsa_default->rsa_pub_enc(flen, from, to, rsa, padding)); |
362 |
++ return (RSA_meth_get_pub_enc(rsa_default)(flen, from, to, rsa, padding)); |
363 |
+ } |
364 |
+ |
365 |
+ static int |
366 |
+@@ -412,7 +581,7 @@ rsae_pub_dec(int flen,const unsigned char *from, unsigned char *to, RSA *rsa, |
367 |
+ int padding) |
368 |
+ { |
369 |
+ log_debug("debug: %s: %s", proc_name(smtpd_process), __func__); |
370 |
+- return (rsa_default->rsa_pub_dec(flen, from, to, rsa, padding)); |
371 |
++ return (RSA_meth_get_pub_dec(rsa_default)(flen, from, to, rsa, padding)); |
372 |
+ } |
373 |
+ |
374 |
+ static int |
375 |
+@@ -424,7 +593,7 @@ rsae_priv_enc(int flen, const unsigned char *from, unsigned char *to, RSA *rsa, |
376 |
+ return (rsae_send_imsg(flen, from, to, rsa, padding, |
377 |
+ IMSG_CA_PRIVENC)); |
378 |
+ } |
379 |
+- return (rsa_default->rsa_priv_enc(flen, from, to, rsa, padding)); |
380 |
++ return (RSA_meth_get_priv_enc(rsa_default)(flen, from, to, rsa, padding)); |
381 |
+ } |
382 |
+ |
383 |
+ static int |
384 |
+@@ -436,14 +605,14 @@ rsae_priv_dec(int flen, const unsigned char *from, unsigned char *to, RSA *rsa, |
385 |
+ return (rsae_send_imsg(flen, from, to, rsa, padding, |
386 |
+ IMSG_CA_PRIVDEC)); |
387 |
+ } |
388 |
+- return (rsa_default->rsa_priv_dec(flen, from, to, rsa, padding)); |
389 |
++ return (RSA_meth_get_priv_dec(rsa_default)(flen, from, to, rsa, padding)); |
390 |
+ } |
391 |
+ |
392 |
+ static int |
393 |
+ rsae_mod_exp(BIGNUM *r0, const BIGNUM *I, RSA *rsa, BN_CTX *ctx) |
394 |
+ { |
395 |
+ log_debug("debug: %s: %s", proc_name(smtpd_process), __func__); |
396 |
+- return (rsa_default->rsa_mod_exp(r0, I, rsa, ctx)); |
397 |
++ return (RSA_meth_get_mod_exp(rsa_default)(r0, I, rsa, ctx)); |
398 |
+ } |
399 |
+ |
400 |
+ static int |
401 |
+@@ -451,34 +620,36 @@ rsae_bn_mod_exp(BIGNUM *r, const BIGNUM *a, const BIGNUM *p, |
402 |
+ const BIGNUM *m, BN_CTX *ctx, BN_MONT_CTX *m_ctx) |
403 |
+ { |
404 |
+ log_debug("debug: %s: %s", proc_name(smtpd_process), __func__); |
405 |
+- return (rsa_default->bn_mod_exp(r, a, p, m, ctx, m_ctx)); |
406 |
++ return (RSA_meth_get_bn_mod_exp(rsa_default)(r, a, p, m, ctx, m_ctx)); |
407 |
+ } |
408 |
+ |
409 |
+ static int |
410 |
+ rsae_init(RSA *rsa) |
411 |
+ { |
412 |
+ log_debug("debug: %s: %s", proc_name(smtpd_process), __func__); |
413 |
+- if (rsa_default->init == NULL) |
414 |
++ if (RSA_meth_get_init(rsa_default) == NULL) |
415 |
+ return (1); |
416 |
+- return (rsa_default->init(rsa)); |
417 |
++ return (RSA_meth_get_init(rsa_default)(rsa)); |
418 |
+ } |
419 |
+ |
420 |
+ static int |
421 |
+ rsae_finish(RSA *rsa) |
422 |
+ { |
423 |
+ log_debug("debug: %s: %s", proc_name(smtpd_process), __func__); |
424 |
+- if (rsa_default->finish == NULL) |
425 |
++ if (RSA_meth_get_finish(rsa_default) == NULL) |
426 |
+ return (1); |
427 |
+- return (rsa_default->finish(rsa)); |
428 |
++ return (RSA_meth_get_finish(rsa_default)(rsa)); |
429 |
+ } |
430 |
+ |
431 |
+ static int |
432 |
+ rsae_keygen(RSA *rsa, int bits, BIGNUM *e, BN_GENCB *cb) |
433 |
+ { |
434 |
+ log_debug("debug: %s: %s", proc_name(smtpd_process), __func__); |
435 |
+- return (rsa_default->rsa_keygen(rsa, bits, e, cb)); |
436 |
++ return (RSA_meth_get_keygen(rsa_default)(rsa, bits, e, cb)); |
437 |
+ } |
438 |
+ |
439 |
++static RSA_METHOD *rsae_method; |
440 |
++ |
441 |
+ void |
442 |
+ ca_engine_init(void) |
443 |
+ { |
444 |
+@@ -490,7 +661,7 @@ ca_engine_init(void) |
445 |
+ errstr = "ENGINE_new"; |
446 |
+ goto fail; |
447 |
+ } |
448 |
+- if (!ENGINE_set_name(e, rsae_method.name)) { |
449 |
++ if (!ENGINE_set_name(e, rsae_method_name)) { |
450 |
+ errstr = "ENGINE_set_name"; |
451 |
+ goto fail; |
452 |
+ } |
453 |
+@@ -503,25 +674,58 @@ ca_engine_init(void) |
454 |
+ goto fail; |
455 |
+ } |
456 |
+ |
457 |
++ rsae_method = RSA_meth_new(rsae_method_name, 0); |
458 |
++ if (!rsae_method) { |
459 |
++ errstr = "RSA_meth_new"; |
460 |
++ goto fail; |
461 |
++ } |
462 |
++ |
463 |
+ if ((name = ENGINE_get_name(e)) == NULL) |
464 |
+ name = "unknown RSA engine"; |
465 |
+ |
466 |
+ log_debug("debug: %s: using %s", __func__, name); |
467 |
+ |
468 |
+- if (rsa_default->flags & RSA_FLAG_SIGN_VER) |
469 |
++ if (RSA_meth_get_sign(rsa_default) || |
470 |
++ RSA_meth_get_verify(rsa_default)) |
471 |
+ fatalx("unsupported RSA engine"); |
472 |
+ |
473 |
+- if (rsa_default->rsa_mod_exp == NULL) |
474 |
+- rsae_method.rsa_mod_exp = NULL; |
475 |
+- if (rsa_default->bn_mod_exp == NULL) |
476 |
+- rsae_method.bn_mod_exp = NULL; |
477 |
+- if (rsa_default->rsa_keygen == NULL) |
478 |
+- rsae_method.rsa_keygen = NULL; |
479 |
+- rsae_method.flags = rsa_default->flags | |
480 |
+- RSA_METHOD_FLAG_NO_CHECK; |
481 |
+- rsae_method.app_data = rsa_default->app_data; |
482 |
+- |
483 |
+- if (!ENGINE_set_RSA(e, &rsae_method)) { |
484 |
++ errstr = "Setting callback"; |
485 |
++ if (!RSA_meth_set_pub_enc(rsae_method, rsae_pub_enc)) |
486 |
++ goto fail; |
487 |
++ if (!RSA_meth_set_pub_dec(rsae_method, rsae_pub_dec)) |
488 |
++ goto fail; |
489 |
++ if (!RSA_meth_set_priv_enc(rsae_method, rsae_priv_enc)) |
490 |
++ goto fail; |
491 |
++ if (!RSA_meth_set_priv_dec(rsae_method, rsae_priv_dec)) |
492 |
++ goto fail; |
493 |
++ |
494 |
++ if (RSA_meth_get_mod_exp(rsa_default)) { |
495 |
++ if (!RSA_meth_set_mod_exp(rsae_method, rsae_mod_exp)) |
496 |
++ goto fail; |
497 |
++ } |
498 |
++ |
499 |
++ if (RSA_meth_get_bn_mod_exp(rsa_default)) |
500 |
++ if (!RSA_meth_set_bn_mod_exp(rsae_method, rsae_bn_mod_exp)) |
501 |
++ goto fail; |
502 |
++ if (!RSA_meth_set_init(rsae_method, rsae_init)) |
503 |
++ goto fail; |
504 |
++ if (!RSA_meth_set_finish(rsae_method, rsae_finish)) |
505 |
++ goto fail; |
506 |
++ |
507 |
++ if (RSA_meth_get_keygen(rsa_default)) { |
508 |
++ if (!RSA_meth_set_keygen(rsae_method, rsae_keygen)) |
509 |
++ goto fail; |
510 |
++ } |
511 |
++ |
512 |
++ if (!RSA_meth_set_flags(rsae_method, |
513 |
++ RSA_meth_get_flags(rsa_default) | |
514 |
++ RSA_METHOD_FLAG_NO_CHECK)) |
515 |
++ goto fail; |
516 |
++ |
517 |
++ if (!RSA_meth_set0_app_data(rsae_method, RSA_meth_get0_app_data(rsa_default))) |
518 |
++ goto fail; |
519 |
++ |
520 |
++ if (!ENGINE_set_RSA(e, rsae_method)) { |
521 |
+ errstr = "ENGINE_set_RSA"; |
522 |
+ goto fail; |
523 |
+ } |
524 |
+diff --git a/smtpd/crypto.c b/smtpd/crypto.c |
525 |
+index 76f98807..01452851 100644 |
526 |
+--- a/smtpd/crypto.c |
527 |
++++ b/smtpd/crypto.c |
528 |
+@@ -64,7 +64,7 @@ crypto_setup(const char *key, size_t len) |
529 |
+ int |
530 |
+ crypto_encrypt_file(FILE * in, FILE * out) |
531 |
+ { |
532 |
+- EVP_CIPHER_CTX ctx; |
533 |
++ EVP_CIPHER_CTX *ctx; |
534 |
+ uint8_t ibuf[CRYPTO_BUFFER_SIZE]; |
535 |
+ uint8_t obuf[CRYPTO_BUFFER_SIZE]; |
536 |
+ uint8_t iv[IV_SIZE]; |
537 |
+@@ -91,12 +91,14 @@ crypto_encrypt_file(FILE * in, FILE * out) |
538 |
+ if ((w = fwrite(iv, 1, sizeof iv, out)) != sizeof iv) |
539 |
+ return 0; |
540 |
+ |
541 |
+- EVP_CIPHER_CTX_init(&ctx); |
542 |
+- EVP_EncryptInit_ex(&ctx, EVP_aes_256_gcm(), NULL, cp.key, iv); |
543 |
++ ctx = EVP_CIPHER_CTX_new(); |
544 |
++ if (!ctx) |
545 |
++ return 0; |
546 |
++ EVP_EncryptInit_ex(ctx, EVP_aes_256_gcm(), NULL, cp.key, iv); |
547 |
+ |
548 |
+ /* encrypt until end of file */ |
549 |
+ while ((r = fread(ibuf, 1, CRYPTO_BUFFER_SIZE, in)) != 0) { |
550 |
+- if (!EVP_EncryptUpdate(&ctx, obuf, &len, ibuf, r)) |
551 |
++ if (!EVP_EncryptUpdate(ctx, obuf, &len, ibuf, r)) |
552 |
+ goto end; |
553 |
+ if (len && (w = fwrite(obuf, len, 1, out)) != 1) |
554 |
+ goto end; |
555 |
+@@ -105,13 +107,13 @@ crypto_encrypt_file(FILE * in, FILE * out) |
556 |
+ goto end; |
557 |
+ |
558 |
+ /* finalize and write last chunk if any */ |
559 |
+- if (!EVP_EncryptFinal_ex(&ctx, obuf, &len)) |
560 |
++ if (!EVP_EncryptFinal_ex(ctx, obuf, &len)) |
561 |
+ goto end; |
562 |
+ if (len && (w = fwrite(obuf, len, 1, out)) != 1) |
563 |
+ goto end; |
564 |
+ |
565 |
+ /* get and append tag */ |
566 |
+- EVP_CIPHER_CTX_ctrl(&ctx, EVP_CTRL_GCM_GET_TAG, sizeof tag, tag); |
567 |
++ EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_GCM_GET_TAG, sizeof tag, tag); |
568 |
+ if ((w = fwrite(tag, sizeof tag, 1, out)) != 1) |
569 |
+ goto end; |
570 |
+ |
571 |
+@@ -119,14 +121,14 @@ crypto_encrypt_file(FILE * in, FILE * out) |
572 |
+ ret = 1; |
573 |
+ |
574 |
+ end: |
575 |
+- EVP_CIPHER_CTX_cleanup(&ctx); |
576 |
++ EVP_CIPHER_CTX_free(ctx); |
577 |
+ return ret; |
578 |
+ } |
579 |
+ |
580 |
+ int |
581 |
+ crypto_decrypt_file(FILE * in, FILE * out) |
582 |
+ { |
583 |
+- EVP_CIPHER_CTX ctx; |
584 |
++ EVP_CIPHER_CTX *ctx; |
585 |
+ uint8_t ibuf[CRYPTO_BUFFER_SIZE]; |
586 |
+ uint8_t obuf[CRYPTO_BUFFER_SIZE]; |
587 |
+ uint8_t iv[IV_SIZE]; |
588 |
+@@ -171,11 +173,13 @@ crypto_decrypt_file(FILE * in, FILE * out) |
589 |
+ sz -= sizeof tag; |
590 |
+ |
591 |
+ |
592 |
+- EVP_CIPHER_CTX_init(&ctx); |
593 |
+- EVP_DecryptInit_ex(&ctx, EVP_aes_256_gcm(), NULL, cp.key, iv); |
594 |
++ ctx = EVP_CIPHER_CTX_new(); |
595 |
++ if (!ctx) |
596 |
++ return 0; |
597 |
++ EVP_DecryptInit_ex(ctx, EVP_aes_256_gcm(), NULL, cp.key, iv); |
598 |
+ |
599 |
+ /* set expected tag */ |
600 |
+- EVP_CIPHER_CTX_ctrl(&ctx, EVP_CTRL_GCM_SET_TAG, sizeof tag, tag); |
601 |
++ EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_GCM_SET_TAG, sizeof tag, tag); |
602 |
+ |
603 |
+ /* decrypt until end of ciphertext */ |
604 |
+ while (sz) { |
605 |
+@@ -185,7 +189,7 @@ crypto_decrypt_file(FILE * in, FILE * out) |
606 |
+ r = fread(ibuf, 1, sz, in); |
607 |
+ if (!r) |
608 |
+ break; |
609 |
+- if (!EVP_DecryptUpdate(&ctx, obuf, &len, ibuf, r)) |
610 |
++ if (!EVP_DecryptUpdate(ctx, obuf, &len, ibuf, r)) |
611 |
+ goto end; |
612 |
+ if (len && (w = fwrite(obuf, len, 1, out)) != 1) |
613 |
+ goto end; |
614 |
+@@ -195,7 +199,7 @@ crypto_decrypt_file(FILE * in, FILE * out) |
615 |
+ goto end; |
616 |
+ |
617 |
+ /* finalize, write last chunk if any and perform authentication check */ |
618 |
+- if (!EVP_DecryptFinal_ex(&ctx, obuf, &len)) |
619 |
++ if (!EVP_DecryptFinal_ex(ctx, obuf, &len)) |
620 |
+ goto end; |
621 |
+ if (len && (w = fwrite(obuf, len, 1, out)) != 1) |
622 |
+ goto end; |
623 |
+@@ -204,14 +208,14 @@ crypto_decrypt_file(FILE * in, FILE * out) |
624 |
+ ret = 1; |
625 |
+ |
626 |
+ end: |
627 |
+- EVP_CIPHER_CTX_cleanup(&ctx); |
628 |
++ EVP_CIPHER_CTX_free(ctx); |
629 |
+ return ret; |
630 |
+ } |
631 |
+ |
632 |
+ size_t |
633 |
+ crypto_encrypt_buffer(const char *in, size_t inlen, char *out, size_t outlen) |
634 |
+ { |
635 |
+- EVP_CIPHER_CTX ctx; |
636 |
++ EVP_CIPHER_CTX *ctx; |
637 |
+ uint8_t iv[IV_SIZE]; |
638 |
+ uint8_t tag[GCM_TAG_SIZE]; |
639 |
+ uint8_t version = API_VERSION; |
640 |
+@@ -239,33 +243,35 @@ crypto_encrypt_buffer(const char *in, size_t inlen, char *out, size_t outlen) |
641 |
+ memcpy(out + len, iv, sizeof iv); |
642 |
+ len += sizeof iv; |
643 |
+ |
644 |
+- EVP_CIPHER_CTX_init(&ctx); |
645 |
+- EVP_EncryptInit_ex(&ctx, EVP_aes_256_gcm(), NULL, cp.key, iv); |
646 |
++ ctx = EVP_CIPHER_CTX_new(); |
647 |
++ if (!ctx) |
648 |
++ return 0; |
649 |
++ EVP_EncryptInit_ex(ctx, EVP_aes_256_gcm(), NULL, cp.key, iv); |
650 |
+ |
651 |
+ /* encrypt buffer */ |
652 |
+- if (!EVP_EncryptUpdate(&ctx, out + len, &olen, in, inlen)) |
653 |
++ if (!EVP_EncryptUpdate(ctx, out + len, &olen, in, inlen)) |
654 |
+ goto end; |
655 |
+ len += olen; |
656 |
+ |
657 |
+ /* finalize and write last chunk if any */ |
658 |
+- if (!EVP_EncryptFinal_ex(&ctx, out + len, &olen)) |
659 |
++ if (!EVP_EncryptFinal_ex(ctx, out + len, &olen)) |
660 |
+ goto end; |
661 |
+ len += olen; |
662 |
+ |
663 |
+ /* get and append tag */ |
664 |
+- EVP_CIPHER_CTX_ctrl(&ctx, EVP_CTRL_GCM_GET_TAG, sizeof tag, tag); |
665 |
++ EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_GCM_GET_TAG, sizeof tag, tag); |
666 |
+ memcpy(out + len, tag, sizeof tag); |
667 |
+ ret = len + sizeof tag; |
668 |
+ |
669 |
+ end: |
670 |
+- EVP_CIPHER_CTX_cleanup(&ctx); |
671 |
++ EVP_CIPHER_CTX_cleanup(ctx); |
672 |
+ return ret; |
673 |
+ } |
674 |
+ |
675 |
+ size_t |
676 |
+ crypto_decrypt_buffer(const char *in, size_t inlen, char *out, size_t outlen) |
677 |
+ { |
678 |
+- EVP_CIPHER_CTX ctx; |
679 |
++ EVP_CIPHER_CTX *ctx; |
680 |
+ uint8_t iv[IV_SIZE]; |
681 |
+ uint8_t tag[GCM_TAG_SIZE]; |
682 |
+ int olen; |
683 |
+@@ -292,24 +298,26 @@ crypto_decrypt_buffer(const char *in, size_t inlen, char *out, size_t outlen) |
684 |
+ inlen -= sizeof iv; |
685 |
+ in += sizeof iv; |
686 |
+ |
687 |
+- EVP_CIPHER_CTX_init(&ctx); |
688 |
+- EVP_DecryptInit_ex(&ctx, EVP_aes_256_gcm(), NULL, cp.key, iv); |
689 |
++ ctx = EVP_CIPHER_CTX_new(); |
690 |
++ if (!ctx) |
691 |
++ return 0; |
692 |
++ EVP_DecryptInit_ex(ctx, EVP_aes_256_gcm(), NULL, cp.key, iv); |
693 |
+ |
694 |
+ /* set expected tag */ |
695 |
+- EVP_CIPHER_CTX_ctrl(&ctx, EVP_CTRL_GCM_SET_TAG, sizeof tag, tag); |
696 |
++ EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_GCM_SET_TAG, sizeof tag, tag); |
697 |
+ |
698 |
+ /* decrypt buffer */ |
699 |
+- if (!EVP_DecryptUpdate(&ctx, out, &olen, in, inlen)) |
700 |
++ if (!EVP_DecryptUpdate(ctx, out, &olen, in, inlen)) |
701 |
+ goto end; |
702 |
+ len += olen; |
703 |
+ |
704 |
+ /* finalize, write last chunk if any and perform authentication check */ |
705 |
+- if (!EVP_DecryptFinal_ex(&ctx, out + len, &olen)) |
706 |
++ if (!EVP_DecryptFinal_ex(ctx, out + len, &olen)) |
707 |
+ goto end; |
708 |
+ ret = len + olen; |
709 |
+ |
710 |
+ end: |
711 |
+- EVP_CIPHER_CTX_cleanup(&ctx); |
712 |
++ EVP_CIPHER_CTX_cleanup(ctx); |
713 |
+ return ret; |
714 |
+ } |
715 |
+ |
716 |
+diff --git a/smtpd/libressl.c b/smtpd/libressl.c |
717 |
+index 57d74389..db78d943 100644 |
718 |
+--- a/smtpd/libressl.c |
719 |
++++ b/smtpd/libressl.c |
720 |
+@@ -94,10 +94,10 @@ ssl_ctx_use_certificate_chain_bio(SSL_CTX *ctx, BIO *in) |
721 |
+ |
722 |
+ ERR_clear_error(); /* clear error stack for SSL_CTX_use_certificate() */ |
723 |
+ |
724 |
+- x = PEM_read_bio_X509_AUX(in, NULL, ctx->default_passwd_callback, |
725 |
+- ctx->default_passwd_callback_userdata); |
726 |
++ x = PEM_read_bio_X509_AUX(in, NULL, SSL_CTX_get_default_passwd_cb(ctx), |
727 |
++ SSL_CTX_get_default_passwd_cb_userdata(ctx)); |
728 |
+ if (x == NULL) { |
729 |
+- SSLerr(SSL_F_SSL_CTX_USE_CERTIFICATE_CHAIN_FILE, ERR_R_PEM_LIB); |
730 |
++ SSLerr(SSL_F_SSL_CTX_USE_CERTIFICATE_FILE, ERR_R_PEM_LIB); |
731 |
+ goto end; |
732 |
+ } |
733 |
+ |
734 |
+@@ -115,14 +115,11 @@ ssl_ctx_use_certificate_chain_bio(SSL_CTX *ctx, BIO *in) |
735 |
+ int r; |
736 |
+ unsigned long err; |
737 |
+ |
738 |
+- if (ctx->extra_certs != NULL) { |
739 |
+- sk_X509_pop_free(ctx->extra_certs, X509_free); |
740 |
+- ctx->extra_certs = NULL; |
741 |
+- } |
742 |
++ SSL_CTX_clear_extra_chain_certs(ctx); |
743 |
+ |
744 |
+ while ((ca = PEM_read_bio_X509(in, NULL, |
745 |
+- ctx->default_passwd_callback, |
746 |
+- ctx->default_passwd_callback_userdata)) != NULL) { |
747 |
++ SSL_CTX_get_default_passwd_cb(ctx), |
748 |
++ SSL_CTX_get_default_passwd_cb_userdata(ctx))) != NULL) { |
749 |
+ r = SSL_CTX_add_extra_chain_cert(ctx, ca); |
750 |
+ if (!r) { |
751 |
+ X509_free(ca); |
752 |
+@@ -160,7 +157,7 @@ SSL_CTX_use_certificate_chain_mem(SSL_CTX *ctx, void *buf, int len) |
753 |
+ |
754 |
+ in = BIO_new_mem_buf(buf, len); |
755 |
+ if (in == NULL) { |
756 |
+- SSLerr(SSL_F_SSL_CTX_USE_CERTIFICATE_CHAIN_FILE, ERR_R_BUF_LIB); |
757 |
++ SSLerr(SSL_F_SSL_CTX_USE_CERTIFICATE_FILE, ERR_R_BUF_LIB); |
758 |
+ goto end; |
759 |
+ } |
760 |
+ |
761 |
+diff --git a/smtpd/ssl.c b/smtpd/ssl.c |
762 |
+index b88360eb..0c93d87e 100644 |
763 |
+--- a/smtpd/ssl.c |
764 |
++++ b/smtpd/ssl.c |
765 |
+@@ -425,7 +425,7 @@ ssl_ctx_fake_private_key(SSL_CTX *ctx, const void *data, size_t datalen, |
766 |
+ */ |
767 |
+ ret = SSL_CTX_use_PrivateKey(ctx, pkey); |
768 |
+ if (!ret) |
769 |
+- SSLerr(SSL_F_SSL_CTX_USE_PRIVATEKEY, ERR_R_SSL_LIB); |
770 |
++ SSLerr(SSL_F_SSL_CTX_USE_PRIVATEKEY, ERR_R_SYS_LIB); |
771 |
+ |
772 |
+ if (pkeyptr != NULL) |
773 |
+ *pkeyptr = pkey; |
774 |
+diff --git a/smtpd/ssl.h b/smtpd/ssl.h |
775 |
+index 90f018d0..553120d4 100644 |
776 |
+--- a/smtpd/ssl.h |
777 |
++++ b/smtpd/ssl.h |
778 |
+@@ -73,3 +73,17 @@ void SSL_CTX_set_ecdh_auto(SSL_CTX *, int); |
779 |
+ void SSL_CTX_set_dh_auto(SSL_CTX *, int); |
780 |
+ #endif |
781 |
+ int SSL_CTX_use_certificate_chain_mem(SSL_CTX *, void *, int); |
782 |
++ |
783 |
++#if (OPENSSL_VERSION_NUMBER < 0x10100000L) || defined(LIBRESSL_VERSION_NUMBER) |
784 |
++ |
785 |
++static inline pem_password_cb *SSL_CTX_get_default_passwd_cb(SSL_CTX *ctx) |
786 |
++{ |
787 |
++ return ctx->default_passwd_callback; |
788 |
++} |
789 |
++ |
790 |
++static inline void *SSL_CTX_get_default_passwd_cb_userdata(SSL_CTX *ctx) |
791 |
++{ |
792 |
++ return ctx->default_passwd_callback_userdata; |
793 |
++} |
794 |
++ |
795 |
++#endif |
796 |
|
797 |
diff --git a/mail-mta/opensmtpd/opensmtpd-6.0.3_p1.ebuild b/mail-mta/opensmtpd/opensmtpd-6.0.3_p1-r1.ebuild |
798 |
similarity index 94% |
799 |
rename from mail-mta/opensmtpd/opensmtpd-6.0.3_p1.ebuild |
800 |
rename to mail-mta/opensmtpd/opensmtpd-6.0.3_p1-r1.ebuild |
801 |
index b8e388fa4fe..48e538cad47 100644 |
802 |
--- a/mail-mta/opensmtpd/opensmtpd-6.0.3_p1.ebuild |
803 |
+++ b/mail-mta/opensmtpd/opensmtpd-6.0.3_p1-r1.ebuild |
804 |
@@ -1,4 +1,4 @@ |
805 |
-# Copyright 1999-2018 Gentoo Authors |
806 |
+# Copyright 1999-2019 Gentoo Authors |
807 |
# Distributed under the terms of the GNU General Public License v2 |
808 |
|
809 |
EAPI=7 |
810 |
@@ -39,6 +39,10 @@ DEPEND="!libressl? ( dev-libs/openssl:0 ) |
811 |
RDEPEND="${DEPEND}" |
812 |
|
813 |
S=${WORKDIR}/${P/_} |
814 |
+PATCHES=( |
815 |
+ "${FILESDIR}/${P}-fix-crash-on-auth.patch" |
816 |
+ "${FILESDIR}/${P}-openssl_1.1.patch" |
817 |
+) |
818 |
|
819 |
src_configure() { |
820 |
tc-export AR |