1 |
commit: b4bfc10ce01e37a79da48f2f8349200c7eca78ed |
2 |
Author: Patrick McLean <chutzpah <AT> gentoo <DOT> org> |
3 |
AuthorDate: Sat Jun 25 02:19:01 2016 +0000 |
4 |
Commit: Patrick McLean <chutzpah <AT> gentoo <DOT> org> |
5 |
CommitDate: Sat Jun 25 02:19:01 2016 +0000 |
6 |
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=b4bfc10c |
7 |
|
8 |
dev-libs/openssl: Revision bump to 1.0.2h-r2 to fix bug 585142 & bug 585276 |
9 |
|
10 |
This fixes CVE-2016-2177 and CVE-2016-2178. |
11 |
|
12 |
Package-Manager: portage-2.3.0 |
13 |
|
14 |
.../files/openssl-1.0.2h-CVE-2016-2177.patch | 279 +++++++++++++++++++++ |
15 |
.../files/openssl-1.0.2h-CVE-2016-2178.patch | 28 +++ |
16 |
dev-libs/openssl/openssl-1.0.2h-r2.ebuild | 254 +++++++++++++++++++ |
17 |
3 files changed, 561 insertions(+) |
18 |
|
19 |
diff --git a/dev-libs/openssl/files/openssl-1.0.2h-CVE-2016-2177.patch b/dev-libs/openssl/files/openssl-1.0.2h-CVE-2016-2177.patch |
20 |
new file mode 100644 |
21 |
index 0000000..ca934c2 |
22 |
--- /dev/null |
23 |
+++ b/dev-libs/openssl/files/openssl-1.0.2h-CVE-2016-2177.patch |
24 |
@@ -0,0 +1,279 @@ |
25 |
+From a004e72b95835136d3f1ea90517f706c24c03da7 Mon Sep 17 00:00:00 2001 |
26 |
+From: Matt Caswell <matt@×××××××.org> |
27 |
+Date: Thu, 5 May 2016 11:10:26 +0100 |
28 |
+Subject: [PATCH] Avoid some undefined pointer arithmetic |
29 |
+ |
30 |
+A common idiom in the codebase is: |
31 |
+ |
32 |
+if (p + len > limit) |
33 |
+{ |
34 |
+ return; /* Too long */ |
35 |
+} |
36 |
+ |
37 |
+Where "p" points to some malloc'd data of SIZE bytes and |
38 |
+limit == p + SIZE |
39 |
+ |
40 |
+"len" here could be from some externally supplied data (e.g. from a TLS |
41 |
+message). |
42 |
+ |
43 |
+The rules of C pointer arithmetic are such that "p + len" is only well |
44 |
+defined where len <= SIZE. Therefore the above idiom is actually |
45 |
+undefined behaviour. |
46 |
+ |
47 |
+For example this could cause problems if some malloc implementation |
48 |
+provides an address for "p" such that "p + len" actually overflows for |
49 |
+values of len that are too big and therefore p + len < limit! |
50 |
+ |
51 |
+Issue reported by Guido Vranken. |
52 |
+ |
53 |
+CVE-2016-2177 |
54 |
+ |
55 |
+Reviewed-by: Rich Salz <rsalz@×××××××.org> |
56 |
+--- |
57 |
+ ssl/s3_srvr.c | 14 +++++++------- |
58 |
+ ssl/ssl_sess.c | 2 +- |
59 |
+ ssl/t1_lib.c | 56 ++++++++++++++++++++++++++++++-------------------------- |
60 |
+ 3 files changed, 38 insertions(+), 34 deletions(-) |
61 |
+ |
62 |
+diff --git a/ssl/s3_srvr.c b/ssl/s3_srvr.c |
63 |
+index ab28702..ab7f690 100644 |
64 |
+--- a/ssl/s3_srvr.c |
65 |
++++ b/ssl/s3_srvr.c |
66 |
+@@ -980,7 +980,7 @@ int ssl3_get_client_hello(SSL *s) |
67 |
+ |
68 |
+ session_length = *(p + SSL3_RANDOM_SIZE); |
69 |
+ |
70 |
+- if (p + SSL3_RANDOM_SIZE + session_length + 1 >= d + n) { |
71 |
++ if (SSL3_RANDOM_SIZE + session_length + 1 >= (d + n) - p) { |
72 |
+ al = SSL_AD_DECODE_ERROR; |
73 |
+ SSLerr(SSL_F_SSL3_GET_CLIENT_HELLO, SSL_R_LENGTH_TOO_SHORT); |
74 |
+ goto f_err; |
75 |
+@@ -998,7 +998,7 @@ int ssl3_get_client_hello(SSL *s) |
76 |
+ /* get the session-id */ |
77 |
+ j = *(p++); |
78 |
+ |
79 |
+- if (p + j > d + n) { |
80 |
++ if ((d + n) - p < j) { |
81 |
+ al = SSL_AD_DECODE_ERROR; |
82 |
+ SSLerr(SSL_F_SSL3_GET_CLIENT_HELLO, SSL_R_LENGTH_TOO_SHORT); |
83 |
+ goto f_err; |
84 |
+@@ -1054,14 +1054,14 @@ int ssl3_get_client_hello(SSL *s) |
85 |
+ |
86 |
+ if (SSL_IS_DTLS(s)) { |
87 |
+ /* cookie stuff */ |
88 |
+- if (p + 1 > d + n) { |
89 |
++ if ((d + n) - p < 1) { |
90 |
+ al = SSL_AD_DECODE_ERROR; |
91 |
+ SSLerr(SSL_F_SSL3_GET_CLIENT_HELLO, SSL_R_LENGTH_TOO_SHORT); |
92 |
+ goto f_err; |
93 |
+ } |
94 |
+ cookie_len = *(p++); |
95 |
+ |
96 |
+- if (p + cookie_len > d + n) { |
97 |
++ if ((d + n ) - p < cookie_len) { |
98 |
+ al = SSL_AD_DECODE_ERROR; |
99 |
+ SSLerr(SSL_F_SSL3_GET_CLIENT_HELLO, SSL_R_LENGTH_TOO_SHORT); |
100 |
+ goto f_err; |
101 |
+@@ -1131,7 +1131,7 @@ int ssl3_get_client_hello(SSL *s) |
102 |
+ } |
103 |
+ } |
104 |
+ |
105 |
+- if (p + 2 > d + n) { |
106 |
++ if ((d + n ) - p < 2) { |
107 |
+ al = SSL_AD_DECODE_ERROR; |
108 |
+ SSLerr(SSL_F_SSL3_GET_CLIENT_HELLO, SSL_R_LENGTH_TOO_SHORT); |
109 |
+ goto f_err; |
110 |
+@@ -1145,7 +1145,7 @@ int ssl3_get_client_hello(SSL *s) |
111 |
+ } |
112 |
+ |
113 |
+ /* i bytes of cipher data + 1 byte for compression length later */ |
114 |
+- if ((p + i + 1) > (d + n)) { |
115 |
++ if ((d + n) - p < i + 1) { |
116 |
+ /* not enough data */ |
117 |
+ al = SSL_AD_DECODE_ERROR; |
118 |
+ SSLerr(SSL_F_SSL3_GET_CLIENT_HELLO, SSL_R_LENGTH_MISMATCH); |
119 |
+@@ -1211,7 +1211,7 @@ int ssl3_get_client_hello(SSL *s) |
120 |
+ |
121 |
+ /* compression */ |
122 |
+ i = *(p++); |
123 |
+- if ((p + i) > (d + n)) { |
124 |
++ if ((d + n) - p < i) { |
125 |
+ /* not enough data */ |
126 |
+ al = SSL_AD_DECODE_ERROR; |
127 |
+ SSLerr(SSL_F_SSL3_GET_CLIENT_HELLO, SSL_R_LENGTH_MISMATCH); |
128 |
+diff --git a/ssl/ssl_sess.c b/ssl/ssl_sess.c |
129 |
+index b182998..54ee783 100644 |
130 |
+--- a/ssl/ssl_sess.c |
131 |
++++ b/ssl/ssl_sess.c |
132 |
+@@ -573,7 +573,7 @@ int ssl_get_prev_session(SSL *s, unsigned char *session_id, int len, |
133 |
+ int r; |
134 |
+ #endif |
135 |
+ |
136 |
+- if (session_id + len > limit) { |
137 |
++ if (limit - session_id < len) { |
138 |
+ fatal = 1; |
139 |
+ goto err; |
140 |
+ } |
141 |
+diff --git a/ssl/t1_lib.c b/ssl/t1_lib.c |
142 |
+index fb64607..cdac011 100644 |
143 |
+--- a/ssl/t1_lib.c |
144 |
++++ b/ssl/t1_lib.c |
145 |
+@@ -1867,11 +1867,11 @@ static void ssl_check_for_safari(SSL *s, const unsigned char *data, |
146 |
+ 0x02, 0x03, /* SHA-1/ECDSA */ |
147 |
+ }; |
148 |
+ |
149 |
+- if (data >= (limit - 2)) |
150 |
++ if (limit - data <= 2) |
151 |
+ return; |
152 |
+ data += 2; |
153 |
+ |
154 |
+- if (data > (limit - 4)) |
155 |
++ if (limit - data < 4) |
156 |
+ return; |
157 |
+ n2s(data, type); |
158 |
+ n2s(data, size); |
159 |
+@@ -1879,7 +1879,7 @@ static void ssl_check_for_safari(SSL *s, const unsigned char *data, |
160 |
+ if (type != TLSEXT_TYPE_server_name) |
161 |
+ return; |
162 |
+ |
163 |
+- if (data + size > limit) |
164 |
++ if (limit - data < size) |
165 |
+ return; |
166 |
+ data += size; |
167 |
+ |
168 |
+@@ -1887,7 +1887,7 @@ static void ssl_check_for_safari(SSL *s, const unsigned char *data, |
169 |
+ const size_t len1 = sizeof(kSafariExtensionsBlock); |
170 |
+ const size_t len2 = sizeof(kSafariTLS12ExtensionsBlock); |
171 |
+ |
172 |
+- if (data + len1 + len2 != limit) |
173 |
++ if (limit - data != (int)(len1 + len2)) |
174 |
+ return; |
175 |
+ if (memcmp(data, kSafariExtensionsBlock, len1) != 0) |
176 |
+ return; |
177 |
+@@ -1896,7 +1896,7 @@ static void ssl_check_for_safari(SSL *s, const unsigned char *data, |
178 |
+ } else { |
179 |
+ const size_t len = sizeof(kSafariExtensionsBlock); |
180 |
+ |
181 |
+- if (data + len != limit) |
182 |
++ if (limit - data != (int)(len)) |
183 |
+ return; |
184 |
+ if (memcmp(data, kSafariExtensionsBlock, len) != 0) |
185 |
+ return; |
186 |
+@@ -2053,19 +2053,19 @@ static int ssl_scan_clienthello_tlsext(SSL *s, unsigned char **p, |
187 |
+ if (data == limit) |
188 |
+ goto ri_check; |
189 |
+ |
190 |
+- if (data > (limit - 2)) |
191 |
++ if (limit - data < 2) |
192 |
+ goto err; |
193 |
+ |
194 |
+ n2s(data, len); |
195 |
+ |
196 |
+- if (data + len != limit) |
197 |
++ if (limit - data != len) |
198 |
+ goto err; |
199 |
+ |
200 |
+- while (data <= (limit - 4)) { |
201 |
++ while (limit - data >= 4) { |
202 |
+ n2s(data, type); |
203 |
+ n2s(data, size); |
204 |
+ |
205 |
+- if (data + size > (limit)) |
206 |
++ if (limit - data < size) |
207 |
+ goto err; |
208 |
+ # if 0 |
209 |
+ fprintf(stderr, "Received extension type %d size %d\n", type, size); |
210 |
+@@ -2472,18 +2472,18 @@ static int ssl_scan_clienthello_custom_tlsext(SSL *s, |
211 |
+ if (s->hit || s->cert->srv_ext.meths_count == 0) |
212 |
+ return 1; |
213 |
+ |
214 |
+- if (data >= limit - 2) |
215 |
++ if (limit - data <= 2) |
216 |
+ return 1; |
217 |
+ n2s(data, len); |
218 |
+ |
219 |
+- if (data > limit - len) |
220 |
++ if (limit - data < len) |
221 |
+ return 1; |
222 |
+ |
223 |
+- while (data <= limit - 4) { |
224 |
++ while (limit - data >= 4) { |
225 |
+ n2s(data, type); |
226 |
+ n2s(data, size); |
227 |
+ |
228 |
+- if (data + size > limit) |
229 |
++ if (limit - data < size) |
230 |
+ return 1; |
231 |
+ if (custom_ext_parse(s, 1 /* server */ , type, data, size, al) <= 0) |
232 |
+ return 0; |
233 |
+@@ -2569,20 +2569,20 @@ static int ssl_scan_serverhello_tlsext(SSL *s, unsigned char **p, |
234 |
+ SSL_TLSEXT_HB_DONT_SEND_REQUESTS); |
235 |
+ # endif |
236 |
+ |
237 |
+- if (data >= (d + n - 2)) |
238 |
++ if ((d + n) - data <= 2) |
239 |
+ goto ri_check; |
240 |
+ |
241 |
+ n2s(data, length); |
242 |
+- if (data + length != d + n) { |
243 |
++ if ((d + n) - data != length) { |
244 |
+ *al = SSL_AD_DECODE_ERROR; |
245 |
+ return 0; |
246 |
+ } |
247 |
+ |
248 |
+- while (data <= (d + n - 4)) { |
249 |
++ while ((d + n) - data >= 4) { |
250 |
+ n2s(data, type); |
251 |
+ n2s(data, size); |
252 |
+ |
253 |
+- if (data + size > (d + n)) |
254 |
++ if ((d + n) - data < size) |
255 |
+ goto ri_check; |
256 |
+ |
257 |
+ if (s->tlsext_debug_cb) |
258 |
+@@ -3307,29 +3307,33 @@ int tls1_process_ticket(SSL *s, unsigned char *session_id, int len, |
259 |
+ /* Skip past DTLS cookie */ |
260 |
+ if (SSL_IS_DTLS(s)) { |
261 |
+ i = *(p++); |
262 |
+- p += i; |
263 |
+- if (p >= limit) |
264 |
++ |
265 |
++ if (limit - p <= i) |
266 |
+ return -1; |
267 |
++ |
268 |
++ p += i; |
269 |
+ } |
270 |
+ /* Skip past cipher list */ |
271 |
+ n2s(p, i); |
272 |
+- p += i; |
273 |
+- if (p >= limit) |
274 |
++ if (limit - p <= i) |
275 |
+ return -1; |
276 |
++ p += i; |
277 |
++ |
278 |
+ /* Skip past compression algorithm list */ |
279 |
+ i = *(p++); |
280 |
+- p += i; |
281 |
+- if (p > limit) |
282 |
++ if (limit - p < i) |
283 |
+ return -1; |
284 |
++ p += i; |
285 |
++ |
286 |
+ /* Now at start of extensions */ |
287 |
+- if ((p + 2) >= limit) |
288 |
++ if (limit - p <= 2) |
289 |
+ return 0; |
290 |
+ n2s(p, i); |
291 |
+- while ((p + 4) <= limit) { |
292 |
++ while (limit - p >= 4) { |
293 |
+ unsigned short type, size; |
294 |
+ n2s(p, type); |
295 |
+ n2s(p, size); |
296 |
+- if (p + size > limit) |
297 |
++ if (limit - p < size) |
298 |
+ return 0; |
299 |
+ if (type == TLSEXT_TYPE_session_ticket) { |
300 |
+ int r; |
301 |
+-- |
302 |
+1.9.1 |
303 |
+ |
304 |
|
305 |
diff --git a/dev-libs/openssl/files/openssl-1.0.2h-CVE-2016-2178.patch b/dev-libs/openssl/files/openssl-1.0.2h-CVE-2016-2178.patch |
306 |
new file mode 100644 |
307 |
index 0000000..a64141f |
308 |
--- /dev/null |
309 |
+++ b/dev-libs/openssl/files/openssl-1.0.2h-CVE-2016-2178.patch |
310 |
@@ -0,0 +1,28 @@ |
311 |
+X-Git-Url: https://git.openssl.org/?p=openssl.git;a=blobdiff_plain;f=crypto%2Fdsa%2Fdsa_ossl.c;h=beb62b2ff058d3e2bde0397fbddd355e11cd457b;hp=ce1da1cd6fa121f1ae0961ac2d2e9f81de4d8c9b;hb=399944622df7bd81af62e67ea967c470534090e2;hpb=0a4c87a90c6cf6628c688868cd5f13e4b9a5f19d |
312 |
+ |
313 |
+diff --git a/crypto/dsa/dsa_ossl.c b/crypto/dsa/dsa_ossl.c |
314 |
+index ce1da1c..beb62b2 100644 |
315 |
+--- a/crypto/dsa/dsa_ossl.c |
316 |
++++ b/crypto/dsa/dsa_ossl.c |
317 |
+@@ -248,9 +248,6 @@ |
318 |
+ if (!BN_rand_range(&k, dsa->q)) |
319 |
+ goto err; |
320 |
+ while (BN_is_zero(&k)) ; |
321 |
+- if ((dsa->flags & DSA_FLAG_NO_EXP_CONSTTIME) == 0) { |
322 |
+- BN_set_flags(&k, BN_FLG_CONSTTIME); |
323 |
+- } |
324 |
+ |
325 |
+ if (dsa->flags & DSA_FLAG_CACHE_MONT_P) { |
326 |
+ if (!BN_MONT_CTX_set_locked(&dsa->method_mont_p, |
327 |
+@@ -238,6 +234,11 @@ static int dsa_sign_setup(DSA *dsa, BN_CTX *ctx_in, |
328 |
+ } else { |
329 |
+ K = k; |
330 |
+ } |
331 |
++ |
332 |
++ if ((dsa->flags & DSA_FLAG_NO_EXP_CONSTTIME) == 0) { |
333 |
++ BN_set_flags(K, BN_FLG_CONSTTIME); |
334 |
++ } |
335 |
++ |
336 |
+ DSA_BN_MOD_EXP(goto err, dsa, r, dsa->g, K, dsa->p, ctx, |
337 |
+ dsa->method_mont_p); |
338 |
+ if (!BN_mod(r, r, dsa->q, ctx)) |
339 |
|
340 |
diff --git a/dev-libs/openssl/openssl-1.0.2h-r2.ebuild b/dev-libs/openssl/openssl-1.0.2h-r2.ebuild |
341 |
new file mode 100644 |
342 |
index 0000000..2a2a0dd |
343 |
--- /dev/null |
344 |
+++ b/dev-libs/openssl/openssl-1.0.2h-r2.ebuild |
345 |
@@ -0,0 +1,254 @@ |
346 |
+# Copyright 1999-2016 Gentoo Foundation |
347 |
+# Distributed under the terms of the GNU General Public License v2 |
348 |
+# $Id$ |
349 |
+ |
350 |
+EAPI="5" |
351 |
+ |
352 |
+inherit eutils flag-o-matic toolchain-funcs multilib multilib-minimal |
353 |
+ |
354 |
+MY_P=${P/_/-} |
355 |
+DESCRIPTION="full-strength general purpose cryptography library (including SSL and TLS)" |
356 |
+HOMEPAGE="http://www.openssl.org/" |
357 |
+SRC_URI="mirror://openssl/source/${MY_P}.tar.gz" |
358 |
+ |
359 |
+LICENSE="openssl" |
360 |
+SLOT="0" |
361 |
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~s390 ~sh ~sparc ~x86 ~amd64-fbsd ~sparc-fbsd ~x86-fbsd ~arm-linux ~x86-linux" |
362 |
+IUSE="+asm bindist gmp kerberos rfc3779 sctp cpu_flags_x86_sse2 sslv2 +sslv3 static-libs test +tls-heartbeat vanilla zlib" |
363 |
+RESTRICT="!bindist? ( bindist )" |
364 |
+ |
365 |
+RDEPEND=">=app-misc/c_rehash-1.7-r1 |
366 |
+ gmp? ( >=dev-libs/gmp-5.1.3-r1[static-libs(+)?,${MULTILIB_USEDEP}] ) |
367 |
+ zlib? ( >=sys-libs/zlib-1.2.8-r1[static-libs(+)?,${MULTILIB_USEDEP}] ) |
368 |
+ kerberos? ( >=app-crypt/mit-krb5-1.11.4[${MULTILIB_USEDEP}] )" |
369 |
+DEPEND="${RDEPEND} |
370 |
+ >=dev-lang/perl-5 |
371 |
+ sctp? ( >=net-misc/lksctp-tools-1.0.12 ) |
372 |
+ test? ( |
373 |
+ sys-apps/diffutils |
374 |
+ sys-devel/bc |
375 |
+ )" |
376 |
+PDEPEND="app-misc/ca-certificates" |
377 |
+ |
378 |
+S="${WORKDIR}/${MY_P}" |
379 |
+ |
380 |
+MULTILIB_WRAPPED_HEADERS=( |
381 |
+ usr/include/openssl/opensslconf.h |
382 |
+) |
383 |
+ |
384 |
+src_prepare() { |
385 |
+ # keep this in sync with app-misc/c_rehash |
386 |
+ SSL_CNF_DIR="/etc/ssl" |
387 |
+ |
388 |
+ # Make sure we only ever touch Makefile.org and avoid patching a file |
389 |
+ # that gets blown away anyways by the Configure script in src_configure |
390 |
+ rm -f Makefile |
391 |
+ |
392 |
+ # bugs 585142 and 585276 |
393 |
+ epatch "${FILESDIR}"/${P}-CVE-2016-2177.patch |
394 |
+ epatch "${FILESDIR}"/${P}-CVE-2016-2178.patch |
395 |
+ |
396 |
+ if ! use vanilla ; then |
397 |
+ epatch "${FILESDIR}"/${PN}-1.0.0a-ldflags.patch #327421 |
398 |
+ epatch "${FILESDIR}"/${PN}-1.0.0d-windres.patch #373743 |
399 |
+ epatch "${FILESDIR}"/${PN}-1.0.2g-parallel-build.patch |
400 |
+ epatch "${FILESDIR}"/${PN}-1.0.2a-parallel-obj-headers.patch |
401 |
+ epatch "${FILESDIR}"/${PN}-1.0.2a-parallel-install-dirs.patch |
402 |
+ epatch "${FILESDIR}"/${PN}-1.0.2a-parallel-symlinking.patch #545028 |
403 |
+ epatch "${FILESDIR}"/${PN}-1.0.2-ipv6.patch |
404 |
+ epatch "${FILESDIR}"/${PN}-1.0.2a-x32-asm.patch #542618 |
405 |
+ epatch "${FILESDIR}"/${PN}-1.0.1p-default-source.patch #554338 |
406 |
+ |
407 |
+ epatch_user #332661 |
408 |
+ fi |
409 |
+ |
410 |
+ # disable fips in the build |
411 |
+ # make sure the man pages are suffixed #302165 |
412 |
+ # don't bother building man pages if they're disabled |
413 |
+ sed -i \ |
414 |
+ -e '/DIRS/s: fips : :g' \ |
415 |
+ -e '/^MANSUFFIX/s:=.*:=ssl:' \ |
416 |
+ -e '/^MAKEDEPPROG/s:=.*:=$(CC):' \ |
417 |
+ -e $(has noman FEATURES \ |
418 |
+ && echo '/^install:/s:install_docs::' \ |
419 |
+ || echo '/^MANDIR=/s:=.*:='${EPREFIX}'/usr/share/man:') \ |
420 |
+ Makefile.org \ |
421 |
+ || die |
422 |
+ # show the actual commands in the log |
423 |
+ sed -i '/^SET_X/s:=.*:=set -x:' Makefile.shared |
424 |
+ |
425 |
+ # since we're forcing $(CC) as makedep anyway, just fix |
426 |
+ # the conditional as always-on |
427 |
+ # helps clang (#417795), and versioned gcc (#499818) |
428 |
+ sed -i 's/expr.*MAKEDEPEND.*;/true;/' util/domd || die |
429 |
+ |
430 |
+ # quiet out unknown driver argument warnings since openssl |
431 |
+ # doesn't have well-split CFLAGS and we're making it even worse |
432 |
+ # and 'make depend' uses -Werror for added fun (#417795 again) |
433 |
+ [[ ${CC} == *clang* ]] && append-flags -Qunused-arguments |
434 |
+ |
435 |
+ # allow openssl to be cross-compiled |
436 |
+ cp "${FILESDIR}"/gentoo.config-1.0.2 gentoo.config || die |
437 |
+ chmod a+rx gentoo.config |
438 |
+ |
439 |
+ append-flags -fno-strict-aliasing |
440 |
+ append-flags $(test-flags-CC -Wa,--noexecstack) |
441 |
+ append-cppflags -DOPENSSL_NO_BUF_FREELISTS |
442 |
+ |
443 |
+ sed -i '1s,^:$,#!'${EPREFIX}'/usr/bin/perl,' Configure #141906 |
444 |
+ # The config script does stupid stuff to prompt the user. Kill it. |
445 |
+ sed -i '/stty -icanon min 0 time 50; read waste/d' config || die |
446 |
+ ./config --test-sanity || die "I AM NOT SANE" |
447 |
+ |
448 |
+ multilib_copy_sources |
449 |
+} |
450 |
+ |
451 |
+multilib_src_configure() { |
452 |
+ unset APPS #197996 |
453 |
+ unset SCRIPTS #312551 |
454 |
+ unset CROSS_COMPILE #311473 |
455 |
+ |
456 |
+ tc-export CC AR RANLIB RC |
457 |
+ |
458 |
+ # Clean out patent-or-otherwise-encumbered code |
459 |
+ # Camellia: Royalty Free http://en.wikipedia.org/wiki/Camellia_(cipher) |
460 |
+ # IDEA: Expired http://en.wikipedia.org/wiki/International_Data_Encryption_Algorithm |
461 |
+ # EC: ????????? ??/??/2015 http://en.wikipedia.org/wiki/Elliptic_Curve_Cryptography |
462 |
+ # MDC2: Expired http://en.wikipedia.org/wiki/MDC-2 |
463 |
+ # RC5: Expired http://en.wikipedia.org/wiki/RC5 |
464 |
+ |
465 |
+ use_ssl() { usex $1 "enable-${2:-$1}" "no-${2:-$1}" " ${*:3}" ; } |
466 |
+ echoit() { echo "$@" ; "$@" ; } |
467 |
+ |
468 |
+ local krb5=$(has_version app-crypt/mit-krb5 && echo "MIT" || echo "Heimdal") |
469 |
+ |
470 |
+ # See if our toolchain supports __uint128_t. If so, it's 64bit |
471 |
+ # friendly and can use the nicely optimized code paths. #460790 |
472 |
+ local ec_nistp_64_gcc_128 |
473 |
+ # Disable it for now though #469976 |
474 |
+ #if ! use bindist ; then |
475 |
+ # echo "__uint128_t i;" > "${T}"/128.c |
476 |
+ # if ${CC} ${CFLAGS} -c "${T}"/128.c -o /dev/null >&/dev/null ; then |
477 |
+ # ec_nistp_64_gcc_128="enable-ec_nistp_64_gcc_128" |
478 |
+ # fi |
479 |
+ #fi |
480 |
+ |
481 |
+ local sslout=$(./gentoo.config) |
482 |
+ einfo "Use configuration ${sslout:-(openssl knows best)}" |
483 |
+ local config="Configure" |
484 |
+ [[ -z ${sslout} ]] && config="config" |
485 |
+ |
486 |
+ echoit \ |
487 |
+ ./${config} \ |
488 |
+ ${sslout} \ |
489 |
+ $(use cpu_flags_x86_sse2 || echo "no-sse2") \ |
490 |
+ enable-camellia \ |
491 |
+ $(use_ssl !bindist ec) \ |
492 |
+ ${ec_nistp_64_gcc_128} \ |
493 |
+ enable-idea \ |
494 |
+ enable-mdc2 \ |
495 |
+ enable-rc5 \ |
496 |
+ enable-tlsext \ |
497 |
+ $(use_ssl asm) \ |
498 |
+ $(use_ssl gmp gmp -lgmp) \ |
499 |
+ $(use_ssl kerberos krb5 --with-krb5-flavor=${krb5}) \ |
500 |
+ $(use_ssl rfc3779) \ |
501 |
+ $(use_ssl sctp) \ |
502 |
+ $(use_ssl sslv2 ssl2) \ |
503 |
+ $(use_ssl sslv3 ssl3) \ |
504 |
+ $(use_ssl tls-heartbeat heartbeats) \ |
505 |
+ $(use_ssl zlib) \ |
506 |
+ --prefix="${EPREFIX}"/usr \ |
507 |
+ --openssldir="${EPREFIX}"${SSL_CNF_DIR} \ |
508 |
+ --libdir=$(get_libdir) \ |
509 |
+ shared threads \ |
510 |
+ || die |
511 |
+ |
512 |
+ # Clean out hardcoded flags that openssl uses |
513 |
+ local CFLAG=$(grep ^CFLAG= Makefile | LC_ALL=C sed \ |
514 |
+ -e 's:^CFLAG=::' \ |
515 |
+ -e 's:-fomit-frame-pointer ::g' \ |
516 |
+ -e 's:-O[0-9] ::g' \ |
517 |
+ -e 's:-march=[-a-z0-9]* ::g' \ |
518 |
+ -e 's:-mcpu=[-a-z0-9]* ::g' \ |
519 |
+ -e 's:-m[a-z0-9]* ::g' \ |
520 |
+ ) |
521 |
+ sed -i \ |
522 |
+ -e "/^CFLAG/s|=.*|=${CFLAG} ${CFLAGS}|" \ |
523 |
+ -e "/^SHARED_LDFLAGS=/s|$| ${LDFLAGS}|" \ |
524 |
+ Makefile || die |
525 |
+} |
526 |
+ |
527 |
+multilib_src_compile() { |
528 |
+ # depend is needed to use $confopts; it also doesn't matter |
529 |
+ # that it's -j1 as the code itself serializes subdirs |
530 |
+ emake -j1 depend |
531 |
+ emake all |
532 |
+ # rehash is needed to prep the certs/ dir; do this |
533 |
+ # separately to avoid parallel build issues. |
534 |
+ emake rehash |
535 |
+} |
536 |
+ |
537 |
+multilib_src_test() { |
538 |
+ emake -j1 test |
539 |
+} |
540 |
+ |
541 |
+multilib_src_install() { |
542 |
+ emake INSTALL_PREFIX="${D}" install |
543 |
+} |
544 |
+ |
545 |
+multilib_src_install_all() { |
546 |
+ # openssl installs perl version of c_rehash by default, but |
547 |
+ # we provide a shell version via app-misc/c_rehash |
548 |
+ rm "${ED}"/usr/bin/c_rehash || die |
549 |
+ |
550 |
+ dodoc CHANGES* FAQ NEWS README doc/*.txt doc/c-indentation.el |
551 |
+ dohtml -r doc/* |
552 |
+ use rfc3779 && dodoc engines/ccgost/README.gost |
553 |
+ |
554 |
+ # This is crappy in that the static archives are still built even |
555 |
+ # when USE=static-libs. But this is due to a failing in the openssl |
556 |
+ # build system: the static archives are built as PIC all the time. |
557 |
+ # Only way around this would be to manually configure+compile openssl |
558 |
+ # twice; once with shared lib support enabled and once without. |
559 |
+ use static-libs || rm -f "${ED}"/usr/lib*/lib*.a |
560 |
+ |
561 |
+ # create the certs directory |
562 |
+ dodir ${SSL_CNF_DIR}/certs |
563 |
+ cp -RP certs/* "${ED}"${SSL_CNF_DIR}/certs/ || die |
564 |
+ rm -r "${ED}"${SSL_CNF_DIR}/certs/{demo,expired} |
565 |
+ |
566 |
+ # Namespace openssl programs to prevent conflicts with other man pages |
567 |
+ cd "${ED}"/usr/share/man |
568 |
+ local m d s |
569 |
+ for m in $(find . -type f | xargs grep -L '#include') ; do |
570 |
+ d=${m%/*} ; d=${d#./} ; m=${m##*/} |
571 |
+ [[ ${m} == openssl.1* ]] && continue |
572 |
+ [[ -n $(find -L ${d} -type l) ]] && die "erp, broken links already!" |
573 |
+ mv ${d}/{,ssl-}${m} |
574 |
+ # fix up references to renamed man pages |
575 |
+ sed -i '/^[.]SH "SEE ALSO"/,/^[.]/s:\([^(, ]*(1)\):ssl-\1:g' ${d}/ssl-${m} |
576 |
+ ln -s ssl-${m} ${d}/openssl-${m} |
577 |
+ # locate any symlinks that point to this man page ... we assume |
578 |
+ # that any broken links are due to the above renaming |
579 |
+ for s in $(find -L ${d} -type l) ; do |
580 |
+ s=${s##*/} |
581 |
+ rm -f ${d}/${s} |
582 |
+ ln -s ssl-${m} ${d}/ssl-${s} |
583 |
+ ln -s ssl-${s} ${d}/openssl-${s} |
584 |
+ done |
585 |
+ done |
586 |
+ [[ -n $(find -L ${d} -type l) ]] && die "broken manpage links found :(" |
587 |
+ |
588 |
+ dodir /etc/sandbox.d #254521 |
589 |
+ echo 'SANDBOX_PREDICT="/dev/crypto"' > "${ED}"/etc/sandbox.d/10openssl |
590 |
+ |
591 |
+ diropts -m0700 |
592 |
+ keepdir ${SSL_CNF_DIR}/private |
593 |
+} |
594 |
+ |
595 |
+pkg_postinst() { |
596 |
+ ebegin "Running 'c_rehash ${EROOT%/}${SSL_CNF_DIR}/certs/' to rebuild hashes #333069" |
597 |
+ c_rehash "${EROOT%/}${SSL_CNF_DIR}/certs" >/dev/null |
598 |
+ eend $? |
599 |
+} |