1 |
commit: e5f871d9c93aa4e7ad851e7e6afc0eef3aff808a |
2 |
Author: Pacho Ramos <pacho <AT> gentoo <DOT> org> |
3 |
AuthorDate: Sat Jan 26 11:40:01 2019 +0000 |
4 |
Commit: Pacho Ramos <pacho <AT> gentoo <DOT> org> |
5 |
CommitDate: Sat Jan 26 12:42:32 2019 +0000 |
6 |
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=e5f871d9 |
7 |
|
8 |
net-misc/ssvnc: Fix openssl-1.1 |
9 |
|
10 |
Closes: https://bugs.gentoo.org/674580 |
11 |
Package-Manager: Portage-2.3.58, Repoman-2.3.12 |
12 |
Signed-off-by: Pacho Ramos <pacho <AT> gentoo.org> |
13 |
|
14 |
net-misc/ssvnc/files/ssvnc-1.0.29-openssl1.1.patch | 199 +++++++++++++++++++++ |
15 |
net-misc/ssvnc/ssvnc-1.0.29-r2.ebuild | 25 +-- |
16 |
2 files changed, 214 insertions(+), 10 deletions(-) |
17 |
|
18 |
diff --git a/net-misc/ssvnc/files/ssvnc-1.0.29-openssl1.1.patch b/net-misc/ssvnc/files/ssvnc-1.0.29-openssl1.1.patch |
19 |
new file mode 100644 |
20 |
index 00000000000..0ee278f9eea |
21 |
--- /dev/null |
22 |
+++ b/net-misc/ssvnc/files/ssvnc-1.0.29-openssl1.1.patch |
23 |
@@ -0,0 +1,199 @@ |
24 |
+--- a/vncstorepw/ultravnc_dsm_helper.c |
25 |
++++ b/vncstorepw/ultravnc_dsm_helper.c |
26 |
+@@ -414,7 +414,9 @@ void enc_do(char *ciph, char *keyfile, c |
27 |
+ if (strstr(p, "md5+") == p) { |
28 |
+ Digest = EVP_md5(); p += strlen("md5+"); |
29 |
+ } else if (strstr(p, "sha+") == p) { |
30 |
+- Digest = EVP_sha(); p += strlen("sha+"); |
31 |
++ fprintf(stderr, "%s: obsolete hash algorithm: SHA-0\n", |
32 |
++ prog, s); |
33 |
++ exit(1); |
34 |
+ } else if (strstr(p, "sha1+") == p) { |
35 |
+ Digest = EVP_sha1(); p += strlen("sha1+"); |
36 |
+ } else if (strstr(p, "ripe+") == p) { |
37 |
+@@ -655,8 +657,10 @@ static void enc_xfer(int sock_fr, int so |
38 |
+ */ |
39 |
+ unsigned char E_keystr[EVP_MAX_KEY_LENGTH]; |
40 |
+ unsigned char D_keystr[EVP_MAX_KEY_LENGTH]; |
41 |
+- EVP_CIPHER_CTX E_ctx, D_ctx; |
42 |
+- EVP_CIPHER_CTX *ctx = NULL; |
43 |
++ //openssl1.1.patch - Do NOT create two context and only use one |
44 |
++ // - that's silly. |
45 |
++ //EVP_CIPHER_CTX *E_ctx, *D_ctx; |
46 |
++ EVP_CIPHER_CTX *ctx; |
47 |
+ |
48 |
+ unsigned char buf[BSIZE], out[BSIZE]; |
49 |
+ unsigned char *psrc = NULL, *keystr; |
50 |
+@@ -698,11 +702,14 @@ static void enc_xfer(int sock_fr, int so |
51 |
+ encsym = encrypt ? "+" : "-"; |
52 |
+ |
53 |
+ /* use the encryption/decryption context variables below */ |
54 |
++ ctx = EVP_CIPHER_CTX_new(); |
55 |
++ if (!ctx) { |
56 |
++ fprintf(stderr, "Failed to create encryption/decryption context.\n"); |
57 |
++ goto finished; |
58 |
++ } |
59 |
+ if (encrypt) { |
60 |
+- ctx = &E_ctx; |
61 |
+ keystr = E_keystr; |
62 |
+ } else { |
63 |
+- ctx = &D_ctx; |
64 |
+ keystr = D_keystr; |
65 |
+ } |
66 |
+ |
67 |
+@@ -797,7 +804,6 @@ static void enc_xfer(int sock_fr, int so |
68 |
+ if (whoops) { |
69 |
+ fprintf(stderr, "%s: %s - WARNING: MSRC4 mode and IGNORING random salt\n", prog, encstr); |
70 |
+ fprintf(stderr, "%s: %s - WARNING: and initialization vector!!\n", prog, encstr); |
71 |
+- EVP_CIPHER_CTX_init(ctx); |
72 |
+ if (pw_in) { |
73 |
+ /* for pw=xxxx a md5 hash is used */ |
74 |
+ EVP_BytesToKey(Cipher, Digest, NULL, (unsigned char *) keydata, |
75 |
+@@ -816,7 +822,6 @@ static void enc_xfer(int sock_fr, int so |
76 |
+ |
77 |
+ EVP_BytesToKey(Cipher, Digest, NULL, (unsigned char *) keydata, |
78 |
+ keydata_len, 1, keystr, ivec); |
79 |
+- EVP_CIPHER_CTX_init(ctx); |
80 |
+ EVP_CipherInit_ex(ctx, Cipher, NULL, keystr, ivec, |
81 |
+ encrypt); |
82 |
+ } |
83 |
+@@ -836,9 +841,9 @@ static void enc_xfer(int sock_fr, int so |
84 |
+ in_salt = salt; |
85 |
+ } |
86 |
+ |
87 |
+- if (ivec_size < Cipher->iv_len && !securevnc) { |
88 |
++ if (ivec_size < EVP_CIPHER_iv_length(Cipher) && !securevnc) { |
89 |
+ fprintf(stderr, "%s: %s - WARNING: short IV %d < %d\n", |
90 |
+- prog, encstr, ivec_size, Cipher->iv_len); |
91 |
++ prog, encstr, ivec_size, EVP_CIPHER_iv_length(Cipher)); |
92 |
+ } |
93 |
+ |
94 |
+ /* make the hashed value and place in keystr */ |
95 |
+@@ -877,9 +882,6 @@ static void enc_xfer(int sock_fr, int so |
96 |
+ } |
97 |
+ |
98 |
+ |
99 |
+- /* initialize the context */ |
100 |
+- EVP_CIPHER_CTX_init(ctx); |
101 |
+- |
102 |
+ |
103 |
+ /* set the cipher & initialize */ |
104 |
+ |
105 |
+@@ -986,6 +988,7 @@ static void enc_xfer(int sock_fr, int so |
106 |
+ /* transfer done (viewer exited or some error) */ |
107 |
+ finished: |
108 |
+ |
109 |
++ if (ctx) EVP_CIPHER_CTX_free(ctx); |
110 |
+ fprintf(stderr, "\n%s: %s - close sock_to\n", prog, encstr); |
111 |
+ close(sock_to); |
112 |
+ |
113 |
+@@ -1060,14 +1063,14 @@ static int securevnc_server_rsa_save_dia |
114 |
+ } |
115 |
+ |
116 |
+ static char *rsa_md5_sum(unsigned char* rsabuf) { |
117 |
+- EVP_MD_CTX md; |
118 |
++ EVP_MD_CTX *md = EVP_MD_CTX_create(); |
119 |
+ char digest[EVP_MAX_MD_SIZE], tmp[16]; |
120 |
+ char md5str[EVP_MAX_MD_SIZE * 8]; |
121 |
+ unsigned int i, size = 0; |
122 |
+ |
123 |
+- EVP_DigestInit(&md, EVP_md5()); |
124 |
+- EVP_DigestUpdate(&md, rsabuf, SECUREVNC_RSA_PUBKEY_SIZE); |
125 |
+- EVP_DigestFinal(&md, (unsigned char *)digest, &size); |
126 |
++ EVP_DigestInit(md, EVP_md5()); |
127 |
++ EVP_DigestUpdate(md, rsabuf, SECUREVNC_RSA_PUBKEY_SIZE); |
128 |
++ EVP_DigestFinal(md, (unsigned char *)digest, &size); |
129 |
+ |
130 |
+ memset(md5str, 0, sizeof(md5str)); |
131 |
+ for (i=0; i < size; i++) { |
132 |
+@@ -1075,6 +1078,7 @@ static char *rsa_md5_sum(unsigned char* |
133 |
+ sprintf(tmp, "%02x", (int) uc); |
134 |
+ strcat(md5str, tmp); |
135 |
+ } |
136 |
++ EVP_MD_CTX_destroy(md); |
137 |
+ return strdup(md5str); |
138 |
+ } |
139 |
+ |
140 |
+@@ -1184,7 +1188,7 @@ static void sslexit(char *msg) { |
141 |
+ |
142 |
+ static void securevnc_setup(int conn1, int conn2) { |
143 |
+ RSA *rsa = NULL; |
144 |
+- EVP_CIPHER_CTX init_ctx; |
145 |
++ EVP_CIPHER_CTX *init_ctx = EVP_CIPHER_CTX_new(); |
146 |
+ unsigned char keystr[EVP_MAX_KEY_LENGTH]; |
147 |
+ unsigned char *rsabuf, *rsasav; |
148 |
+ unsigned char *encrypted_keybuf; |
149 |
+@@ -1203,6 +1207,8 @@ static void securevnc_setup(int conn1, i |
150 |
+ |
151 |
+ ERR_load_crypto_strings(); |
152 |
+ |
153 |
++ if (!init_ctx) sslexit("securevnc_setup: EVP_CIPHER_CTX_new() failed"); |
154 |
++ |
155 |
+ /* alloc and read from server the 270 comprising the rsa public key: */ |
156 |
+ rsabuf = (unsigned char *) calloc(SECUREVNC_RSA_PUBKEY_SIZE, 1); |
157 |
+ rsasav = (unsigned char *) calloc(SECUREVNC_RSA_PUBKEY_SIZE, 1); |
158 |
+@@ -1323,8 +1329,7 @@ static void securevnc_setup(int conn1, i |
159 |
+ /* |
160 |
+ * Back to the work involving the tmp obscuring key: |
161 |
+ */ |
162 |
+- EVP_CIPHER_CTX_init(&init_ctx); |
163 |
+- rc = EVP_CipherInit_ex(&init_ctx, EVP_rc4(), NULL, initkey, NULL, 1); |
164 |
++ rc = EVP_CipherInit_ex(init_ctx, EVP_rc4(), NULL, initkey, NULL, 1); |
165 |
+ if (rc == 0) { |
166 |
+ sslexit("securevnc_setup: EVP_CipherInit_ex(init_ctx) failed"); |
167 |
+ } |
168 |
+@@ -1340,13 +1345,13 @@ static void securevnc_setup(int conn1, i |
169 |
+ /* decode with the tmp key */ |
170 |
+ if (n > 0) { |
171 |
+ memset(to_viewer, 0, sizeof(to_viewer)); |
172 |
+- if (EVP_CipherUpdate(&init_ctx, to_viewer, &len, buf, n) == 0) { |
173 |
++ if (EVP_CipherUpdate(init_ctx, to_viewer, &len, buf, n) == 0) { |
174 |
+ sslexit("securevnc_setup: EVP_CipherUpdate(init_ctx) failed"); |
175 |
+ exit(1); |
176 |
+ } |
177 |
+ to_viewer_len = len; |
178 |
+ } |
179 |
+- EVP_CIPHER_CTX_cleanup(&init_ctx); |
180 |
++ EVP_CIPHER_CTX_free(init_ctx); |
181 |
+ free(initkey); |
182 |
+ |
183 |
+ /* print what we would send to the viewer (sent below): */ |
184 |
+@@ -1407,7 +1412,7 @@ static void securevnc_setup(int conn1, i |
185 |
+ |
186 |
+ if (client_auth_req && client_auth) { |
187 |
+ RSA *client_rsa = load_client_auth(client_auth); |
188 |
+- EVP_MD_CTX dctx; |
189 |
++ EVP_MD_CTX *dctx = EVP_MD_CTX_create(); |
190 |
+ unsigned char digest[EVP_MAX_MD_SIZE], *signature; |
191 |
+ unsigned int ndig = 0, nsig = 0; |
192 |
+ |
193 |
+@@ -1421,8 +1426,8 @@ static void securevnc_setup(int conn1, i |
194 |
+ exit(1); |
195 |
+ } |
196 |
+ |
197 |
+- EVP_DigestInit(&dctx, EVP_sha1()); |
198 |
+- EVP_DigestUpdate(&dctx, keystr, SECUREVNC_KEY_SIZE); |
199 |
++ EVP_DigestInit(dctx, EVP_sha1()); |
200 |
++ EVP_DigestUpdate(dctx, keystr, SECUREVNC_KEY_SIZE); |
201 |
+ /* |
202 |
+ * Without something like the following MITM is still possible. |
203 |
+ * This is because the MITM knows keystr and can use it with |
204 |
+@@ -1433,7 +1438,7 @@ static void securevnc_setup(int conn1, i |
205 |
+ * he doesn't have Viewer_ClientAuth.pkey. |
206 |
+ */ |
207 |
+ if (0) { |
208 |
+- EVP_DigestUpdate(&dctx, rsasav, SECUREVNC_RSA_PUBKEY_SIZE); |
209 |
++ EVP_DigestUpdate(dctx, rsasav, SECUREVNC_RSA_PUBKEY_SIZE); |
210 |
+ if (!keystore_verified) { |
211 |
+ fprintf(stderr, "securevnc_setup:\n"); |
212 |
+ fprintf(stderr, "securevnc_setup: Warning: even *WITH* Client Authentication in SecureVNC,\n"); |
213 |
+@@ -1456,7 +1461,8 @@ static void securevnc_setup(int conn1, i |
214 |
+ fprintf(stderr, "securevnc_setup:\n"); |
215 |
+ } |
216 |
+ } |
217 |
+- EVP_DigestFinal(&dctx, (unsigned char *)digest, &ndig); |
218 |
++ EVP_DigestFinal(dctx, (unsigned char *)digest, &ndig); |
219 |
++ EVP_MD_CTX_destroy(dctx); |
220 |
+ |
221 |
+ signature = (unsigned char *) calloc(RSA_size(client_rsa), 1); |
222 |
+ RSA_sign(NID_sha1, digest, ndig, signature, &nsig, client_rsa); |
223 |
|
224 |
diff --git a/net-misc/ssvnc/ssvnc-1.0.29-r2.ebuild b/net-misc/ssvnc/ssvnc-1.0.29-r2.ebuild |
225 |
index 0304a723789..fbd99ff1512 100644 |
226 |
--- a/net-misc/ssvnc/ssvnc-1.0.29-r2.ebuild |
227 |
+++ b/net-misc/ssvnc/ssvnc-1.0.29-r2.ebuild |
228 |
@@ -1,9 +1,8 @@ |
229 |
-# Copyright 1999-2018 Gentoo Foundation |
230 |
+# Copyright 1999-2019 Gentoo Authors |
231 |
# Distributed under the terms of the GNU General Public License v2 |
232 |
|
233 |
-EAPI=6 |
234 |
- |
235 |
-inherit eutils multilib toolchain-funcs |
236 |
+EAPI=7 |
237 |
+inherit toolchain-funcs |
238 |
|
239 |
DESCRIPTION="VNC viewer that adds encryption security to VNC connections" |
240 |
HOMEPAGE="http://www.karlrunge.com/x11vnc/ssvnc.html" |
241 |
@@ -14,10 +13,11 @@ SLOT="0" |
242 |
KEYWORDS="amd64 x86 ~amd64-linux ~x86-linux" |
243 |
IUSE="java" |
244 |
|
245 |
-RDEPEND="sys-libs/zlib |
246 |
+RDEPEND=" |
247 |
+ sys-libs/zlib:0= |
248 |
virtual/jpeg:0 |
249 |
dev-libs/openssl:0= |
250 |
- dev-lang/tk:0 |
251 |
+ dev-lang/tk:0= |
252 |
net-misc/stunnel |
253 |
java? ( virtual/jre:* ) |
254 |
x11-terms/xterm |
255 |
@@ -25,11 +25,16 @@ RDEPEND="sys-libs/zlib |
256 |
x11-libs/libX11 |
257 |
x11-libs/libXext |
258 |
x11-libs/libXmu |
259 |
- x11-libs/libXt" |
260 |
+ x11-libs/libXt |
261 |
+" |
262 |
DEPEND="${RDEPEND} |
263 |
- java? ( virtual/jdk )" |
264 |
+ java? ( virtual/jdk ) |
265 |
+" |
266 |
|
267 |
-PATCHES=( "${FILESDIR}"/${PN}-1.0.29-build.patch ) |
268 |
+PATCHES=( |
269 |
+ "${FILESDIR}"/${PN}-1.0.29-build.patch |
270 |
+ "${FILESDIR}"/${PN}-1.0.29-openssl1.1.patch |
271 |
+) |
272 |
|
273 |
src_prepare() { |
274 |
default |
275 |
@@ -55,5 +60,5 @@ src_compile() { |
276 |
|
277 |
src_install() { |
278 |
emake DESTDIR="${D}" PREFIX="${EPREFIX}/usr" install |
279 |
- dodoc README |
280 |
+ einstalldocs |
281 |
} |