Gentoo Archives: gentoo-commits

From: Thomas Deutschmann <whissi@g.o>
To: gentoo-commits@l.g.o
Subject: [gentoo-commits] repo/gentoo:master commit in: dev-libs/openssl/files/, dev-libs/openssl/
Date: Fri, 31 Aug 2018 20:45:50
Message-Id: 1535748308.a759287ff6a18f8e07dcc1b571d1369dbace720c.whissi@gentoo
1 commit: a759287ff6a18f8e07dcc1b571d1369dbace720c
2 Author: Thomas Deutschmann <whissi <AT> gentoo <DOT> org>
3 AuthorDate: Fri Aug 31 20:44:18 2018 +0000
4 Commit: Thomas Deutschmann <whissi <AT> gentoo <DOT> org>
5 CommitDate: Fri Aug 31 20:45:08 2018 +0000
6 URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=a759287f
7
8 dev-libs/openssl: fix USE=bindist
9
10 Update hobble ECC patch against openssl-1.0.2p [Link 1].
11
12 Link 1: https://github.com/openssl/openssl/commit/949ff36623eafc3523a9f91784992965018ffb05
13 Closes: https://bugs.gentoo.org/664254
14 Package-Manager: Portage-2.3.48, Repoman-2.3.10
15
16 .../openssl/files/openssl-1.0.2p-hobble-ecc.patch | 283 +++++++++++++++++++++
17 dev-libs/openssl/openssl-1.0.2p.ebuild | 2 +-
18 2 files changed, 284 insertions(+), 1 deletion(-)
19
20 diff --git a/dev-libs/openssl/files/openssl-1.0.2p-hobble-ecc.patch b/dev-libs/openssl/files/openssl-1.0.2p-hobble-ecc.patch
21 new file mode 100644
22 index 00000000000..3a458a78360
23 --- /dev/null
24 +++ b/dev-libs/openssl/files/openssl-1.0.2p-hobble-ecc.patch
25 @@ -0,0 +1,283 @@
26 +Port of Fedora's Hobble-EC patches for OpenSSL 1.0 series.
27 +
28 +From https://src.fedoraproject.org/git/rpms/openssl.git
29 +
30 +Contains parts of the following patches, rediffed. The patches are on various
31 +different branches.
32 +f23 openssl-1.0.2c-ecc-suiteb.patch
33 +f23 openssl-1.0.2a-fips-ec.patch
34 +f28 openssl-1.1.0-ec-curves.patch
35 +
36 +Signed-off-By: Robin H. Johnson <robbat2@g.o>
37 +
38 +--- a/apps/speed.c
39 ++++ b/apps/speed.c
40 +@@ -989,10 +989,7 @@ int MAIN(int argc, char **argv)
41 + } else
42 + # endif
43 + # ifndef OPENSSL_NO_ECDSA
44 +- if (strcmp(*argv, "ecdsap160") == 0)
45 +- ecdsa_doit[R_EC_P160] = 2;
46 +- else if (strcmp(*argv, "ecdsap192") == 0)
47 +- ecdsa_doit[R_EC_P192] = 2;
48 ++ if (0) {}
49 + else if (strcmp(*argv, "ecdsap224") == 0)
50 + ecdsa_doit[R_EC_P224] = 2;
51 + else if (strcmp(*argv, "ecdsap256") == 0)
52 +@@ -1001,36 +998,13 @@ int MAIN(int argc, char **argv)
53 + ecdsa_doit[R_EC_P384] = 2;
54 + else if (strcmp(*argv, "ecdsap521") == 0)
55 + ecdsa_doit[R_EC_P521] = 2;
56 +- else if (strcmp(*argv, "ecdsak163") == 0)
57 +- ecdsa_doit[R_EC_K163] = 2;
58 +- else if (strcmp(*argv, "ecdsak233") == 0)
59 +- ecdsa_doit[R_EC_K233] = 2;
60 +- else if (strcmp(*argv, "ecdsak283") == 0)
61 +- ecdsa_doit[R_EC_K283] = 2;
62 +- else if (strcmp(*argv, "ecdsak409") == 0)
63 +- ecdsa_doit[R_EC_K409] = 2;
64 +- else if (strcmp(*argv, "ecdsak571") == 0)
65 +- ecdsa_doit[R_EC_K571] = 2;
66 +- else if (strcmp(*argv, "ecdsab163") == 0)
67 +- ecdsa_doit[R_EC_B163] = 2;
68 +- else if (strcmp(*argv, "ecdsab233") == 0)
69 +- ecdsa_doit[R_EC_B233] = 2;
70 +- else if (strcmp(*argv, "ecdsab283") == 0)
71 +- ecdsa_doit[R_EC_B283] = 2;
72 +- else if (strcmp(*argv, "ecdsab409") == 0)
73 +- ecdsa_doit[R_EC_B409] = 2;
74 +- else if (strcmp(*argv, "ecdsab571") == 0)
75 +- ecdsa_doit[R_EC_B571] = 2;
76 + else if (strcmp(*argv, "ecdsa") == 0) {
77 +- for (i = 0; i < EC_NUM; i++)
78 ++ for (i = R_EC_P224; i < R_EC_P521; i++)
79 + ecdsa_doit[i] = 1;
80 + } else
81 + # endif
82 + # ifndef OPENSSL_NO_ECDH
83 +- if (strcmp(*argv, "ecdhp160") == 0)
84 +- ecdh_doit[R_EC_P160] = 2;
85 +- else if (strcmp(*argv, "ecdhp192") == 0)
86 +- ecdh_doit[R_EC_P192] = 2;
87 ++ if (0) {}
88 + else if (strcmp(*argv, "ecdhp224") == 0)
89 + ecdh_doit[R_EC_P224] = 2;
90 + else if (strcmp(*argv, "ecdhp256") == 0)
91 +@@ -1039,28 +1013,8 @@ int MAIN(int argc, char **argv)
92 + ecdh_doit[R_EC_P384] = 2;
93 + else if (strcmp(*argv, "ecdhp521") == 0)
94 + ecdh_doit[R_EC_P521] = 2;
95 +- else if (strcmp(*argv, "ecdhk163") == 0)
96 +- ecdh_doit[R_EC_K163] = 2;
97 +- else if (strcmp(*argv, "ecdhk233") == 0)
98 +- ecdh_doit[R_EC_K233] = 2;
99 +- else if (strcmp(*argv, "ecdhk283") == 0)
100 +- ecdh_doit[R_EC_K283] = 2;
101 +- else if (strcmp(*argv, "ecdhk409") == 0)
102 +- ecdh_doit[R_EC_K409] = 2;
103 +- else if (strcmp(*argv, "ecdhk571") == 0)
104 +- ecdh_doit[R_EC_K571] = 2;
105 +- else if (strcmp(*argv, "ecdhb163") == 0)
106 +- ecdh_doit[R_EC_B163] = 2;
107 +- else if (strcmp(*argv, "ecdhb233") == 0)
108 +- ecdh_doit[R_EC_B233] = 2;
109 +- else if (strcmp(*argv, "ecdhb283") == 0)
110 +- ecdh_doit[R_EC_B283] = 2;
111 +- else if (strcmp(*argv, "ecdhb409") == 0)
112 +- ecdh_doit[R_EC_B409] = 2;
113 +- else if (strcmp(*argv, "ecdhb571") == 0)
114 +- ecdh_doit[R_EC_B571] = 2;
115 + else if (strcmp(*argv, "ecdh") == 0) {
116 +- for (i = 0; i < EC_NUM; i++)
117 ++ for (i = R_EC_P224; i <= R_EC_P521; i++)
118 + ecdh_doit[i] = 1;
119 + } else
120 + # endif
121 +@@ -1149,21 +1103,13 @@ int MAIN(int argc, char **argv)
122 + BIO_printf(bio_err, "dsa512 dsa1024 dsa2048\n");
123 + # endif
124 + # ifndef OPENSSL_NO_ECDSA
125 +- BIO_printf(bio_err, "ecdsap160 ecdsap192 ecdsap224 "
126 ++ BIO_printf(bio_err, "ecdsap224 "
127 + "ecdsap256 ecdsap384 ecdsap521\n");
128 +- BIO_printf(bio_err,
129 +- "ecdsak163 ecdsak233 ecdsak283 ecdsak409 ecdsak571\n");
130 +- BIO_printf(bio_err,
131 +- "ecdsab163 ecdsab233 ecdsab283 ecdsab409 ecdsab571\n");
132 + BIO_printf(bio_err, "ecdsa\n");
133 + # endif
134 + # ifndef OPENSSL_NO_ECDH
135 +- BIO_printf(bio_err, "ecdhp160 ecdhp192 ecdhp224 "
136 ++ BIO_printf(bio_err, "ecdhp224 "
137 + "ecdhp256 ecdhp384 ecdhp521\n");
138 +- BIO_printf(bio_err,
139 +- "ecdhk163 ecdhk233 ecdhk283 ecdhk409 ecdhk571\n");
140 +- BIO_printf(bio_err,
141 +- "ecdhb163 ecdhb233 ecdhb283 ecdhb409 ecdhb571\n");
142 + BIO_printf(bio_err, "ecdh\n");
143 + # endif
144 +
145 +@@ -1242,11 +1188,11 @@ int MAIN(int argc, char **argv)
146 + for (i = 0; i < DSA_NUM; i++)
147 + dsa_doit[i] = 1;
148 + # ifndef OPENSSL_NO_ECDSA
149 +- for (i = 0; i < EC_NUM; i++)
150 ++ for (i = R_EC_P224; i <= R_EC_P521; i++)
151 + ecdsa_doit[i] = 1;
152 + # endif
153 + # ifndef OPENSSL_NO_ECDH
154 +- for (i = 0; i < EC_NUM; i++)
155 ++ for (i = R_EC_P224; i <= R_EC_P521; i++)
156 + ecdh_doit[i] = 1;
157 + # endif
158 + }
159 +--- a/crypto/ec/ecp_smpl.c
160 ++++ b/crypto/ec/ecp_smpl.c
161 +@@ -187,6 +187,11 @@ int ec_GFp_simple_group_set_curve(EC_GROUP *group,
162 + return 0;
163 + }
164 +
165 ++ if (BN_num_bits(p) < 224) {
166 ++ ECerr(EC_F_EC_GFP_SIMPLE_GROUP_SET_CURVE, EC_R_UNSUPPORTED_FIELD);
167 ++ return 0;
168 ++ }
169 ++
170 + if (ctx == NULL) {
171 + ctx = new_ctx = BN_CTX_new();
172 + if (ctx == NULL)
173 +--- a/crypto/ecdh/ecdhtest.c
174 ++++ b/crypto/ecdh/ecdhtest.c
175 +@@ -501,11 +501,13 @@ int main(int argc, char *argv[])
176 + goto err;
177 +
178 + /* NIST PRIME CURVES TESTS */
179 ++# if 0
180 + if (!test_ecdh_curve
181 + (NID_X9_62_prime192v1, "NIST Prime-Curve P-192", ctx, out))
182 + goto err;
183 + if (!test_ecdh_curve(NID_secp224r1, "NIST Prime-Curve P-224", ctx, out))
184 + goto err;
185 ++# endif
186 + if (!test_ecdh_curve
187 + (NID_X9_62_prime256v1, "NIST Prime-Curve P-256", ctx, out))
188 + goto err;
189 +@@ -536,13 +538,14 @@ int main(int argc, char *argv[])
190 + if (!test_ecdh_curve(NID_sect571r1, "NIST Binary-Curve B-571", ctx, out))
191 + goto err;
192 + # endif
193 ++# if 0
194 + if (!test_ecdh_kat(out, "Brainpool Prime-Curve brainpoolP256r1", 256))
195 + goto err;
196 + if (!test_ecdh_kat(out, "Brainpool Prime-Curve brainpoolP384r1", 384))
197 + goto err;
198 + if (!test_ecdh_kat(out, "Brainpool Prime-Curve brainpoolP512r1", 512))
199 + goto err;
200 +-
201 ++# endif
202 + ret = 0;
203 +
204 + err:
205 +--- a/crypto/ecdsa/ecdsatest.c
206 ++++ b/crypto/ecdsa/ecdsatest.c
207 +@@ -138,9 +138,12 @@ int restore_rand(void)
208 + }
209 +
210 + static int fbytes_counter = 0, use_fake = 0;
211 +-static const char *numbers[8] = {
212 ++static const char *numbers[10] = {
213 ++ "651056770906015076056810763456358567190100156695615665659",
214 + "651056770906015076056810763456358567190100156695615665659",
215 + "6140507067065001063065065565667405560006161556565665656654",
216 ++ "8763001015071075675010661307616710783570106710677817767166"
217 ++ "71676178726717",
218 + "8763001015071075675010661307616710783570106710677817767166"
219 + "71676178726717",
220 + "7000000175690566466555057817571571075705015757757057795755"
221 +@@ -163,7 +166,7 @@ int fbytes(unsigned char *buf, int num)
222 +
223 + use_fake = 0;
224 +
225 +- if (fbytes_counter >= 8)
226 ++ if (fbytes_counter >= 10)
227 + return 0;
228 + tmp = BN_new();
229 + if (!tmp)
230 +@@ -539,8 +542,10 @@ int main(void)
231 + RAND_seed(rnd_seed, sizeof(rnd_seed));
232 +
233 + /* the tests */
234 ++# if 0
235 + if (!x9_62_tests(out))
236 + goto err;
237 ++# endif
238 + if (!test_builtin(out))
239 + goto err;
240 +
241 +--- a/ssl/t1_lib.c
242 ++++ b/ssl/t1_lib.c
243 +@@ -271,10 +271,7 @@ static const unsigned char eccurves_auto[] = {
244 + 0, 23, /* secp256r1 (23) */
245 + /* Other >= 256-bit prime curves. */
246 + 0, 25, /* secp521r1 (25) */
247 +- 0, 28, /* brainpool512r1 (28) */
248 +- 0, 27, /* brainpoolP384r1 (27) */
249 + 0, 24, /* secp384r1 (24) */
250 +- 0, 26, /* brainpoolP256r1 (26) */
251 + 0, 22, /* secp256k1 (22) */
252 + # ifndef OPENSSL_NO_EC2M
253 + /* >= 256-bit binary curves. */
254 +@@ -292,10 +289,7 @@ static const unsigned char eccurves_all[] = {
255 + 0, 23, /* secp256r1 (23) */
256 + /* Other >= 256-bit prime curves. */
257 + 0, 25, /* secp521r1 (25) */
258 +- 0, 28, /* brainpool512r1 (28) */
259 +- 0, 27, /* brainpoolP384r1 (27) */
260 + 0, 24, /* secp384r1 (24) */
261 +- 0, 26, /* brainpoolP256r1 (26) */
262 + 0, 22, /* secp256k1 (22) */
263 + # ifndef OPENSSL_NO_EC2M
264 + /* >= 256-bit binary curves. */
265 +@@ -310,13 +304,6 @@ static const unsigned char eccurves_all[] = {
266 + * Remaining curves disabled by default but still permitted if set
267 + * via an explicit callback or parameters.
268 + */
269 +- 0, 20, /* secp224k1 (20) */
270 +- 0, 21, /* secp224r1 (21) */
271 +- 0, 18, /* secp192k1 (18) */
272 +- 0, 19, /* secp192r1 (19) */
273 +- 0, 15, /* secp160k1 (15) */
274 +- 0, 16, /* secp160r1 (16) */
275 +- 0, 17, /* secp160r2 (17) */
276 + # ifndef OPENSSL_NO_EC2M
277 + 0, 8, /* sect239k1 (8) */
278 + 0, 6, /* sect233k1 (6) */
279 +@@ -351,29 +338,21 @@ static const unsigned char fips_curves_default[] = {
280 + 0, 9, /* sect283k1 (9) */
281 + 0, 10, /* sect283r1 (10) */
282 + # endif
283 +- 0, 22, /* secp256k1 (22) */
284 + 0, 23, /* secp256r1 (23) */
285 + # ifndef OPENSSL_NO_EC2M
286 + 0, 8, /* sect239k1 (8) */
287 + 0, 6, /* sect233k1 (6) */
288 + 0, 7, /* sect233r1 (7) */
289 + # endif
290 +- 0, 20, /* secp224k1 (20) */
291 +- 0, 21, /* secp224r1 (21) */
292 + # ifndef OPENSSL_NO_EC2M
293 + 0, 4, /* sect193r1 (4) */
294 + 0, 5, /* sect193r2 (5) */
295 + # endif
296 +- 0, 18, /* secp192k1 (18) */
297 +- 0, 19, /* secp192r1 (19) */
298 + # ifndef OPENSSL_NO_EC2M
299 + 0, 1, /* sect163k1 (1) */
300 + 0, 2, /* sect163r1 (2) */
301 + 0, 3, /* sect163r2 (3) */
302 + # endif
303 +- 0, 15, /* secp160k1 (15) */
304 +- 0, 16, /* secp160r1 (16) */
305 +- 0, 17, /* secp160r2 (17) */
306 + };
307 + # endif
308 +
309
310 diff --git a/dev-libs/openssl/openssl-1.0.2p.ebuild b/dev-libs/openssl/openssl-1.0.2p.ebuild
311 index 42179a0775b..148b2fd52a7 100644
312 --- a/dev-libs/openssl/openssl-1.0.2p.ebuild
313 +++ b/dev-libs/openssl/openssl-1.0.2p.ebuild
314 @@ -77,7 +77,7 @@ src_prepare() {
315 for i in "${FEDORA_PATCH[@]}" ; do
316 eapply "${DISTDIR}"/"${i}"
317 done
318 - eapply "${FILESDIR}"/openssl-1.0.2o-hobble-ecc.patch
319 + eapply "${FILESDIR}"/openssl-1.0.2p-hobble-ecc.patch
320 # Also see the configure parts below:
321 # enable-ec \
322 # $(use_ssl !bindist ec2m) \