1 |
commit: a759287ff6a18f8e07dcc1b571d1369dbace720c |
2 |
Author: Thomas Deutschmann <whissi <AT> gentoo <DOT> org> |
3 |
AuthorDate: Fri Aug 31 20:44:18 2018 +0000 |
4 |
Commit: Thomas Deutschmann <whissi <AT> gentoo <DOT> org> |
5 |
CommitDate: Fri Aug 31 20:45:08 2018 +0000 |
6 |
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=a759287f |
7 |
|
8 |
dev-libs/openssl: fix USE=bindist |
9 |
|
10 |
Update hobble ECC patch against openssl-1.0.2p [Link 1]. |
11 |
|
12 |
Link 1: https://github.com/openssl/openssl/commit/949ff36623eafc3523a9f91784992965018ffb05 |
13 |
Closes: https://bugs.gentoo.org/664254 |
14 |
Package-Manager: Portage-2.3.48, Repoman-2.3.10 |
15 |
|
16 |
.../openssl/files/openssl-1.0.2p-hobble-ecc.patch | 283 +++++++++++++++++++++ |
17 |
dev-libs/openssl/openssl-1.0.2p.ebuild | 2 +- |
18 |
2 files changed, 284 insertions(+), 1 deletion(-) |
19 |
|
20 |
diff --git a/dev-libs/openssl/files/openssl-1.0.2p-hobble-ecc.patch b/dev-libs/openssl/files/openssl-1.0.2p-hobble-ecc.patch |
21 |
new file mode 100644 |
22 |
index 00000000000..3a458a78360 |
23 |
--- /dev/null |
24 |
+++ b/dev-libs/openssl/files/openssl-1.0.2p-hobble-ecc.patch |
25 |
@@ -0,0 +1,283 @@ |
26 |
+Port of Fedora's Hobble-EC patches for OpenSSL 1.0 series. |
27 |
+ |
28 |
+From https://src.fedoraproject.org/git/rpms/openssl.git |
29 |
+ |
30 |
+Contains parts of the following patches, rediffed. The patches are on various |
31 |
+different branches. |
32 |
+f23 openssl-1.0.2c-ecc-suiteb.patch |
33 |
+f23 openssl-1.0.2a-fips-ec.patch |
34 |
+f28 openssl-1.1.0-ec-curves.patch |
35 |
+ |
36 |
+Signed-off-By: Robin H. Johnson <robbat2@g.o> |
37 |
+ |
38 |
+--- a/apps/speed.c |
39 |
++++ b/apps/speed.c |
40 |
+@@ -989,10 +989,7 @@ int MAIN(int argc, char **argv) |
41 |
+ } else |
42 |
+ # endif |
43 |
+ # ifndef OPENSSL_NO_ECDSA |
44 |
+- if (strcmp(*argv, "ecdsap160") == 0) |
45 |
+- ecdsa_doit[R_EC_P160] = 2; |
46 |
+- else if (strcmp(*argv, "ecdsap192") == 0) |
47 |
+- ecdsa_doit[R_EC_P192] = 2; |
48 |
++ if (0) {} |
49 |
+ else if (strcmp(*argv, "ecdsap224") == 0) |
50 |
+ ecdsa_doit[R_EC_P224] = 2; |
51 |
+ else if (strcmp(*argv, "ecdsap256") == 0) |
52 |
+@@ -1001,36 +998,13 @@ int MAIN(int argc, char **argv) |
53 |
+ ecdsa_doit[R_EC_P384] = 2; |
54 |
+ else if (strcmp(*argv, "ecdsap521") == 0) |
55 |
+ ecdsa_doit[R_EC_P521] = 2; |
56 |
+- else if (strcmp(*argv, "ecdsak163") == 0) |
57 |
+- ecdsa_doit[R_EC_K163] = 2; |
58 |
+- else if (strcmp(*argv, "ecdsak233") == 0) |
59 |
+- ecdsa_doit[R_EC_K233] = 2; |
60 |
+- else if (strcmp(*argv, "ecdsak283") == 0) |
61 |
+- ecdsa_doit[R_EC_K283] = 2; |
62 |
+- else if (strcmp(*argv, "ecdsak409") == 0) |
63 |
+- ecdsa_doit[R_EC_K409] = 2; |
64 |
+- else if (strcmp(*argv, "ecdsak571") == 0) |
65 |
+- ecdsa_doit[R_EC_K571] = 2; |
66 |
+- else if (strcmp(*argv, "ecdsab163") == 0) |
67 |
+- ecdsa_doit[R_EC_B163] = 2; |
68 |
+- else if (strcmp(*argv, "ecdsab233") == 0) |
69 |
+- ecdsa_doit[R_EC_B233] = 2; |
70 |
+- else if (strcmp(*argv, "ecdsab283") == 0) |
71 |
+- ecdsa_doit[R_EC_B283] = 2; |
72 |
+- else if (strcmp(*argv, "ecdsab409") == 0) |
73 |
+- ecdsa_doit[R_EC_B409] = 2; |
74 |
+- else if (strcmp(*argv, "ecdsab571") == 0) |
75 |
+- ecdsa_doit[R_EC_B571] = 2; |
76 |
+ else if (strcmp(*argv, "ecdsa") == 0) { |
77 |
+- for (i = 0; i < EC_NUM; i++) |
78 |
++ for (i = R_EC_P224; i < R_EC_P521; i++) |
79 |
+ ecdsa_doit[i] = 1; |
80 |
+ } else |
81 |
+ # endif |
82 |
+ # ifndef OPENSSL_NO_ECDH |
83 |
+- if (strcmp(*argv, "ecdhp160") == 0) |
84 |
+- ecdh_doit[R_EC_P160] = 2; |
85 |
+- else if (strcmp(*argv, "ecdhp192") == 0) |
86 |
+- ecdh_doit[R_EC_P192] = 2; |
87 |
++ if (0) {} |
88 |
+ else if (strcmp(*argv, "ecdhp224") == 0) |
89 |
+ ecdh_doit[R_EC_P224] = 2; |
90 |
+ else if (strcmp(*argv, "ecdhp256") == 0) |
91 |
+@@ -1039,28 +1013,8 @@ int MAIN(int argc, char **argv) |
92 |
+ ecdh_doit[R_EC_P384] = 2; |
93 |
+ else if (strcmp(*argv, "ecdhp521") == 0) |
94 |
+ ecdh_doit[R_EC_P521] = 2; |
95 |
+- else if (strcmp(*argv, "ecdhk163") == 0) |
96 |
+- ecdh_doit[R_EC_K163] = 2; |
97 |
+- else if (strcmp(*argv, "ecdhk233") == 0) |
98 |
+- ecdh_doit[R_EC_K233] = 2; |
99 |
+- else if (strcmp(*argv, "ecdhk283") == 0) |
100 |
+- ecdh_doit[R_EC_K283] = 2; |
101 |
+- else if (strcmp(*argv, "ecdhk409") == 0) |
102 |
+- ecdh_doit[R_EC_K409] = 2; |
103 |
+- else if (strcmp(*argv, "ecdhk571") == 0) |
104 |
+- ecdh_doit[R_EC_K571] = 2; |
105 |
+- else if (strcmp(*argv, "ecdhb163") == 0) |
106 |
+- ecdh_doit[R_EC_B163] = 2; |
107 |
+- else if (strcmp(*argv, "ecdhb233") == 0) |
108 |
+- ecdh_doit[R_EC_B233] = 2; |
109 |
+- else if (strcmp(*argv, "ecdhb283") == 0) |
110 |
+- ecdh_doit[R_EC_B283] = 2; |
111 |
+- else if (strcmp(*argv, "ecdhb409") == 0) |
112 |
+- ecdh_doit[R_EC_B409] = 2; |
113 |
+- else if (strcmp(*argv, "ecdhb571") == 0) |
114 |
+- ecdh_doit[R_EC_B571] = 2; |
115 |
+ else if (strcmp(*argv, "ecdh") == 0) { |
116 |
+- for (i = 0; i < EC_NUM; i++) |
117 |
++ for (i = R_EC_P224; i <= R_EC_P521; i++) |
118 |
+ ecdh_doit[i] = 1; |
119 |
+ } else |
120 |
+ # endif |
121 |
+@@ -1149,21 +1103,13 @@ int MAIN(int argc, char **argv) |
122 |
+ BIO_printf(bio_err, "dsa512 dsa1024 dsa2048\n"); |
123 |
+ # endif |
124 |
+ # ifndef OPENSSL_NO_ECDSA |
125 |
+- BIO_printf(bio_err, "ecdsap160 ecdsap192 ecdsap224 " |
126 |
++ BIO_printf(bio_err, "ecdsap224 " |
127 |
+ "ecdsap256 ecdsap384 ecdsap521\n"); |
128 |
+- BIO_printf(bio_err, |
129 |
+- "ecdsak163 ecdsak233 ecdsak283 ecdsak409 ecdsak571\n"); |
130 |
+- BIO_printf(bio_err, |
131 |
+- "ecdsab163 ecdsab233 ecdsab283 ecdsab409 ecdsab571\n"); |
132 |
+ BIO_printf(bio_err, "ecdsa\n"); |
133 |
+ # endif |
134 |
+ # ifndef OPENSSL_NO_ECDH |
135 |
+- BIO_printf(bio_err, "ecdhp160 ecdhp192 ecdhp224 " |
136 |
++ BIO_printf(bio_err, "ecdhp224 " |
137 |
+ "ecdhp256 ecdhp384 ecdhp521\n"); |
138 |
+- BIO_printf(bio_err, |
139 |
+- "ecdhk163 ecdhk233 ecdhk283 ecdhk409 ecdhk571\n"); |
140 |
+- BIO_printf(bio_err, |
141 |
+- "ecdhb163 ecdhb233 ecdhb283 ecdhb409 ecdhb571\n"); |
142 |
+ BIO_printf(bio_err, "ecdh\n"); |
143 |
+ # endif |
144 |
+ |
145 |
+@@ -1242,11 +1188,11 @@ int MAIN(int argc, char **argv) |
146 |
+ for (i = 0; i < DSA_NUM; i++) |
147 |
+ dsa_doit[i] = 1; |
148 |
+ # ifndef OPENSSL_NO_ECDSA |
149 |
+- for (i = 0; i < EC_NUM; i++) |
150 |
++ for (i = R_EC_P224; i <= R_EC_P521; i++) |
151 |
+ ecdsa_doit[i] = 1; |
152 |
+ # endif |
153 |
+ # ifndef OPENSSL_NO_ECDH |
154 |
+- for (i = 0; i < EC_NUM; i++) |
155 |
++ for (i = R_EC_P224; i <= R_EC_P521; i++) |
156 |
+ ecdh_doit[i] = 1; |
157 |
+ # endif |
158 |
+ } |
159 |
+--- a/crypto/ec/ecp_smpl.c |
160 |
++++ b/crypto/ec/ecp_smpl.c |
161 |
+@@ -187,6 +187,11 @@ int ec_GFp_simple_group_set_curve(EC_GROUP *group, |
162 |
+ return 0; |
163 |
+ } |
164 |
+ |
165 |
++ if (BN_num_bits(p) < 224) { |
166 |
++ ECerr(EC_F_EC_GFP_SIMPLE_GROUP_SET_CURVE, EC_R_UNSUPPORTED_FIELD); |
167 |
++ return 0; |
168 |
++ } |
169 |
++ |
170 |
+ if (ctx == NULL) { |
171 |
+ ctx = new_ctx = BN_CTX_new(); |
172 |
+ if (ctx == NULL) |
173 |
+--- a/crypto/ecdh/ecdhtest.c |
174 |
++++ b/crypto/ecdh/ecdhtest.c |
175 |
+@@ -501,11 +501,13 @@ int main(int argc, char *argv[]) |
176 |
+ goto err; |
177 |
+ |
178 |
+ /* NIST PRIME CURVES TESTS */ |
179 |
++# if 0 |
180 |
+ if (!test_ecdh_curve |
181 |
+ (NID_X9_62_prime192v1, "NIST Prime-Curve P-192", ctx, out)) |
182 |
+ goto err; |
183 |
+ if (!test_ecdh_curve(NID_secp224r1, "NIST Prime-Curve P-224", ctx, out)) |
184 |
+ goto err; |
185 |
++# endif |
186 |
+ if (!test_ecdh_curve |
187 |
+ (NID_X9_62_prime256v1, "NIST Prime-Curve P-256", ctx, out)) |
188 |
+ goto err; |
189 |
+@@ -536,13 +538,14 @@ int main(int argc, char *argv[]) |
190 |
+ if (!test_ecdh_curve(NID_sect571r1, "NIST Binary-Curve B-571", ctx, out)) |
191 |
+ goto err; |
192 |
+ # endif |
193 |
++# if 0 |
194 |
+ if (!test_ecdh_kat(out, "Brainpool Prime-Curve brainpoolP256r1", 256)) |
195 |
+ goto err; |
196 |
+ if (!test_ecdh_kat(out, "Brainpool Prime-Curve brainpoolP384r1", 384)) |
197 |
+ goto err; |
198 |
+ if (!test_ecdh_kat(out, "Brainpool Prime-Curve brainpoolP512r1", 512)) |
199 |
+ goto err; |
200 |
+- |
201 |
++# endif |
202 |
+ ret = 0; |
203 |
+ |
204 |
+ err: |
205 |
+--- a/crypto/ecdsa/ecdsatest.c |
206 |
++++ b/crypto/ecdsa/ecdsatest.c |
207 |
+@@ -138,9 +138,12 @@ int restore_rand(void) |
208 |
+ } |
209 |
+ |
210 |
+ static int fbytes_counter = 0, use_fake = 0; |
211 |
+-static const char *numbers[8] = { |
212 |
++static const char *numbers[10] = { |
213 |
++ "651056770906015076056810763456358567190100156695615665659", |
214 |
+ "651056770906015076056810763456358567190100156695615665659", |
215 |
+ "6140507067065001063065065565667405560006161556565665656654", |
216 |
++ "8763001015071075675010661307616710783570106710677817767166" |
217 |
++ "71676178726717", |
218 |
+ "8763001015071075675010661307616710783570106710677817767166" |
219 |
+ "71676178726717", |
220 |
+ "7000000175690566466555057817571571075705015757757057795755" |
221 |
+@@ -163,7 +166,7 @@ int fbytes(unsigned char *buf, int num) |
222 |
+ |
223 |
+ use_fake = 0; |
224 |
+ |
225 |
+- if (fbytes_counter >= 8) |
226 |
++ if (fbytes_counter >= 10) |
227 |
+ return 0; |
228 |
+ tmp = BN_new(); |
229 |
+ if (!tmp) |
230 |
+@@ -539,8 +542,10 @@ int main(void) |
231 |
+ RAND_seed(rnd_seed, sizeof(rnd_seed)); |
232 |
+ |
233 |
+ /* the tests */ |
234 |
++# if 0 |
235 |
+ if (!x9_62_tests(out)) |
236 |
+ goto err; |
237 |
++# endif |
238 |
+ if (!test_builtin(out)) |
239 |
+ goto err; |
240 |
+ |
241 |
+--- a/ssl/t1_lib.c |
242 |
++++ b/ssl/t1_lib.c |
243 |
+@@ -271,10 +271,7 @@ static const unsigned char eccurves_auto[] = { |
244 |
+ 0, 23, /* secp256r1 (23) */ |
245 |
+ /* Other >= 256-bit prime curves. */ |
246 |
+ 0, 25, /* secp521r1 (25) */ |
247 |
+- 0, 28, /* brainpool512r1 (28) */ |
248 |
+- 0, 27, /* brainpoolP384r1 (27) */ |
249 |
+ 0, 24, /* secp384r1 (24) */ |
250 |
+- 0, 26, /* brainpoolP256r1 (26) */ |
251 |
+ 0, 22, /* secp256k1 (22) */ |
252 |
+ # ifndef OPENSSL_NO_EC2M |
253 |
+ /* >= 256-bit binary curves. */ |
254 |
+@@ -292,10 +289,7 @@ static const unsigned char eccurves_all[] = { |
255 |
+ 0, 23, /* secp256r1 (23) */ |
256 |
+ /* Other >= 256-bit prime curves. */ |
257 |
+ 0, 25, /* secp521r1 (25) */ |
258 |
+- 0, 28, /* brainpool512r1 (28) */ |
259 |
+- 0, 27, /* brainpoolP384r1 (27) */ |
260 |
+ 0, 24, /* secp384r1 (24) */ |
261 |
+- 0, 26, /* brainpoolP256r1 (26) */ |
262 |
+ 0, 22, /* secp256k1 (22) */ |
263 |
+ # ifndef OPENSSL_NO_EC2M |
264 |
+ /* >= 256-bit binary curves. */ |
265 |
+@@ -310,13 +304,6 @@ static const unsigned char eccurves_all[] = { |
266 |
+ * Remaining curves disabled by default but still permitted if set |
267 |
+ * via an explicit callback or parameters. |
268 |
+ */ |
269 |
+- 0, 20, /* secp224k1 (20) */ |
270 |
+- 0, 21, /* secp224r1 (21) */ |
271 |
+- 0, 18, /* secp192k1 (18) */ |
272 |
+- 0, 19, /* secp192r1 (19) */ |
273 |
+- 0, 15, /* secp160k1 (15) */ |
274 |
+- 0, 16, /* secp160r1 (16) */ |
275 |
+- 0, 17, /* secp160r2 (17) */ |
276 |
+ # ifndef OPENSSL_NO_EC2M |
277 |
+ 0, 8, /* sect239k1 (8) */ |
278 |
+ 0, 6, /* sect233k1 (6) */ |
279 |
+@@ -351,29 +338,21 @@ static const unsigned char fips_curves_default[] = { |
280 |
+ 0, 9, /* sect283k1 (9) */ |
281 |
+ 0, 10, /* sect283r1 (10) */ |
282 |
+ # endif |
283 |
+- 0, 22, /* secp256k1 (22) */ |
284 |
+ 0, 23, /* secp256r1 (23) */ |
285 |
+ # ifndef OPENSSL_NO_EC2M |
286 |
+ 0, 8, /* sect239k1 (8) */ |
287 |
+ 0, 6, /* sect233k1 (6) */ |
288 |
+ 0, 7, /* sect233r1 (7) */ |
289 |
+ # endif |
290 |
+- 0, 20, /* secp224k1 (20) */ |
291 |
+- 0, 21, /* secp224r1 (21) */ |
292 |
+ # ifndef OPENSSL_NO_EC2M |
293 |
+ 0, 4, /* sect193r1 (4) */ |
294 |
+ 0, 5, /* sect193r2 (5) */ |
295 |
+ # endif |
296 |
+- 0, 18, /* secp192k1 (18) */ |
297 |
+- 0, 19, /* secp192r1 (19) */ |
298 |
+ # ifndef OPENSSL_NO_EC2M |
299 |
+ 0, 1, /* sect163k1 (1) */ |
300 |
+ 0, 2, /* sect163r1 (2) */ |
301 |
+ 0, 3, /* sect163r2 (3) */ |
302 |
+ # endif |
303 |
+- 0, 15, /* secp160k1 (15) */ |
304 |
+- 0, 16, /* secp160r1 (16) */ |
305 |
+- 0, 17, /* secp160r2 (17) */ |
306 |
+ }; |
307 |
+ # endif |
308 |
+ |
309 |
|
310 |
diff --git a/dev-libs/openssl/openssl-1.0.2p.ebuild b/dev-libs/openssl/openssl-1.0.2p.ebuild |
311 |
index 42179a0775b..148b2fd52a7 100644 |
312 |
--- a/dev-libs/openssl/openssl-1.0.2p.ebuild |
313 |
+++ b/dev-libs/openssl/openssl-1.0.2p.ebuild |
314 |
@@ -77,7 +77,7 @@ src_prepare() { |
315 |
for i in "${FEDORA_PATCH[@]}" ; do |
316 |
eapply "${DISTDIR}"/"${i}" |
317 |
done |
318 |
- eapply "${FILESDIR}"/openssl-1.0.2o-hobble-ecc.patch |
319 |
+ eapply "${FILESDIR}"/openssl-1.0.2p-hobble-ecc.patch |
320 |
# Also see the configure parts below: |
321 |
# enable-ec \ |
322 |
# $(use_ssl !bindist ec2m) \ |