April 2012 - openSUSE Commits - openSUSE Mailing Lists

commit xen for openSUSE:12.1:Update
by root＠hilbert.suse.de 23 Apr '12

23 Apr '12

Hello community, here is the log from the commit of package xen for openSUSE:12.1:Update checked in at 2012-04-23 11:28:36 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:12.1:Update/xen (Old) and /work/SRC/openSUSE:12.1:Update/.xen.new (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Package is "xen", Maintainer is "CARNOLD(a)suse.com" Changes: -------- New Changes file: NO CHANGES FILE!!! ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ _link ++++++ --- /var/tmp/diff_new_pack.o7ELWV/_old 2012-04-23 11:28:38.000000000 +0200 +++ /var/tmp/diff_new_pack.o7ELWV/_new 2012-04-23 11:28:38.000000000 +0200 @@ -1 +1 @@ -<link package='xen.280' cicount='copy' /> +<link package='xen.436' cicount='copy' /> -- To unsubscribe, e-mail: opensuse-commit+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-commit+help(a)opensuse.org

1 0

commit openssl for openSUSE:12.1:Update
by root＠hilbert.suse.de 23 Apr '12

23 Apr '12

Hello community, here is the log from the commit of package openssl for openSUSE:12.1:Update checked in at 2012-04-23 11:05:40 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:12.1:Update/openssl (Old) and /work/SRC/openSUSE:12.1:Update/.openssl.new (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Package is "openssl", Maintainer is "GJHe(a)suse.com" Changes: -------- New Changes file: NO CHANGES FILE!!! ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ _link ++++++ --- /var/tmp/diff_new_pack.6SHvw4/_old 2012-04-23 11:05:40.000000000 +0200 +++ /var/tmp/diff_new_pack.6SHvw4/_new 2012-04-23 11:05:40.000000000 +0200 @@ -1 +1 @@ -<link package='openssl.410' cicount='copy' /> +<link package='openssl.444' cicount='copy' /> -- To unsubscribe, e-mail: opensuse-commit+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-commit+help(a)opensuse.org

1 0

commit openssl for openSUSE:11.4:Update
by root＠hilbert.suse.de 23 Apr '12

23 Apr '12

Hello community, here is the log from the commit of package openssl for openSUSE:11.4:Update checked in at 2012-04-23 11:05:34 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:11.4:Update/openssl (Old) and /work/SRC/openSUSE:11.4:Update/.openssl.new (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Package is "openssl", Maintainer is "GJHe(a)suse.com" Changes: -------- New Changes file: NO CHANGES FILE!!! ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ _link ++++++ --- /var/tmp/diff_new_pack.whQefs/_old 2012-04-23 11:05:38.000000000 +0200 +++ /var/tmp/diff_new_pack.whQefs/_new 2012-04-23 11:05:38.000000000 +0200 @@ -1 +1 @@ -<link package='openssl.410' cicount='copy' /> +<link package='openssl.444' cicount='copy' /> -- To unsubscribe, e-mail: opensuse-commit+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-commit+help(a)opensuse.org

1 0

commit openssl.444 for openSUSE:11.4:Update
by root＠hilbert.suse.de 23 Apr '12

23 Apr '12

Hello community, here is the log from the commit of package openssl.444 for openSUSE:11.4:Update checked in at 2012-04-23 11:05:26 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:11.4:Update/openssl.444 (Old) and /work/SRC/openSUSE:11.4:Update/.openssl.444.new (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Package is "openssl.444", Maintainer is "" Changes: -------- New Changes file: --- /dev/null 2012-04-12 17:09:43.803558694 +0200 +++ /work/SRC/openSUSE:11.4:Update/.openssl.444.new/openssl.changes 2012-04-23 11:05:27.000000000 +0200 @@ -0,0 +1,1292 @@ +------------------------------------------------------------------- +Wed Mar 28 01:50:28 UTC 2012 - gjhe(a)suse.com + +- fix bug[bnc#749735] - Memory leak when creating public keys. + fix bug[bnc#751977] - CMS and S/MIME Bleichenbacher attack + CVE-2012-0884 + +------------------------------------------------------------------- +Thu Mar 22 04:54:58 UTC 2012 - gjhe(a)suse.com + +- fix Bug[bnc#751946] - S/MIME verification may erroneously fail + CVE-2012-1165 + +------------------------------------------------------------------- +Wed Mar 21 03:00:20 UTC 2012 - gjhe(a)suse.com + +- fix bug[bnc#749213]-Free headers after use in error message + and bug[bnc#749210]-Symmetric crypto errors in PKCS7_decrypt + +------------------------------------------------------------------- +Fri Feb 24 02:52:14 UTC 2012 - gjhe(a)suse.com + +- fix bug[bnc#748738] - Tolerate bad MIME headers in openssl's + asn1 parser. + CVE-2006-7250 + +------------------------------------------------------------------- +Thu Feb 2 07:22:17 UTC 2012 - gjhe(a)suse.com + +- fix security bug [bnc#742821] - DTLS DoS Attack + CVE-2012-0050 + +------------------------------------------------------------------- +Wed Jan 11 07:10:32 UTC 2012 - gjhe(a)suse.com + +- fix security bug[bnc#739719] - openssl: various security issues + DTLS Plaintext Recovery Attack (CVE-2011-4108) + Uninitialized SSL 3.0 Padding (CVE-2011-4576) + Malformed RFC 3779 Data Can Cause Assertion Failures (CVE-2011-4577) + SGC Restart DoS Attack (CVE-2011-4619) + Invalid GOST parameters DoS Attack (CVE-2012-0027) + + not affected: + Double-free in Policy Checks (CVE-2011-4109) + +------------------------------------------------------------------- +Tue Sep 20 08:47:15 UTC 2011 - gjhe(a)suse.com + +- fix bug[bnc#716144] - VUL-0: openssl ECDH crash. + CVE-2011-3210 + +------------------------------------------------------------------- +Tue Sep 13 03:05:41 UTC 2011 - gjhe(a)suse.com + +- Fix bug[bnc#716143].Fix bug where CRLs with nextUpdate + in the past are sometimes accepted by initialising + X509_STORE_CTX properly. (CVE-2011-3207) + +------------------------------------------------------------------- +Tue May 31 07:27:46 UTC 2011 - gjhe(a)novell.com + +- fix bug[bnc#693027]. + Add protection against ECDSA timing attacks as mentioned in the paper + by Billy Bob Brumley and Nicola Tuveri, see: + http://eprint.iacr.org/2011/232.pdf + [Billy Bob Brumley and Nicola Tuveri] + +------------------------------------------------------------------- +Sat Jan 15 19:58:51 UTC 2011 - cristian.rodriguez(a)opensuse.org + +- Add patch from upstream in order to support AES-NI instruction + set present on current Intel and AMD processors + +------------------------------------------------------------------- +Mon Jan 10 11:45:27 CET 2011 - meissner(a)suse.de + +- enable -DPURIFY to avoid valgrind errors. + +------------------------------------------------------------------- +Thu Dec 9 07:04:32 UTC 2010 - gjhe(a)novell.com + +- update to stable version 1.0.0c. + patch included: + CVE-2010-1633_and_CVE-2010-0742.patch + patchset-19727.diff + CVE-2010-2939.patch + CVE-2010-3864.patch + +------------------------------------------------------------------- +Thu Nov 18 07:53:12 UTC 2010 - gjhe(a)novell.com + +- fix bug [bnc#651003] + CVE-2010-3864 + +------------------------------------------------------------------- +Sat Sep 25 08:55:02 UTC 2010 - gjhe(a)novell.com + +- fix bug [bnc#629905] + CVE-2010-2939 + +------------------------------------------------------------------- +Wed Jul 28 20:55:18 UTC 2010 - cristian.rodriguez(a)opensuse.org + +- Exclude static libraries, see what breaks and fix that + instead + +------------------------------------------------------------------- +Wed Jun 30 08:47:39 UTC 2010 - jengelh(a)medozas.de + +- fix two compile errors on SPARC + +------------------------------------------------------------------- +Tue Jun 15 09:53:54 UTC 2010 - bg(a)novell.com + +- -fstack-protector is not supported on hppa + +------------------------------------------------------------------- +Fri Jun 4 07:11:28 UTC 2010 - gjhe(a)novell.com + +- fix bnc #610642 + CVE-2010-0742 + CVE-2010-1633 + +------------------------------------------------------------------- +Mon May 31 03:06:39 UTC 2010 - gjhe(a)novell.com + +- fix bnc #610223,change Configure to tell openssl to load engines + from /%{_lib} instead of %{_libdir} + +------------------------------------------------------------------- +Mon May 10 16:11:54 UTC 2010 - aj(a)suse.de + +- Do not compile in build time but use mtime of changes file instead. + This allows build-compare to identify that no changes have happened. + +------------------------------------------------------------------- +Tue May 4 02:55:52 UTC 2010 - gjhe(a)novell.com + +- build libopenssl to /%{_lib} dir,and keep only one + libopenssl-devel for new developping programs. + +------------------------------------------------------------------- +Tue Apr 27 05:44:32 UTC 2010 - gjhe(a)novell.com + +- build libopenssl and libopenssl-devel to a version directory + +------------------------------------------------------------------- +Sat Apr 24 09:46:37 UTC 2010 - coolo(a)novell.com + +- buildrequire pkg-config to fix provides + +------------------------------------------------------------------- +Wed Apr 21 13:54:15 UTC 2010 - lnussel(a)suse.de + +- also create old certificate hash in /etc/ssl/certs for + compatibility with applications that still link against 0.9.8 + +------------------------------------------------------------------- +Mon Apr 12 16:12:08 CEST 2010 - meissner(a)suse.de + +- Disable our own build targets, instead use the openSSL provided ones + as they are now good (or should be good at least). + +- add -Wa,--noexecstack to the Configure call, this is the upstream + approved way to avoid exec-stack marking + +------------------------------------------------------------------- +Mon Apr 12 04:57:17 UTC 2010 - gjhe(a)novell.com + +- update to 1.0.0 + Merge the following patches from 0.9.8k: + openssl-0.9.6g-alpha.diff + openssl-0.9.7f-ppc64.diff + openssl-0.9.8-flags-priority.dif + openssl-0.9.8-sparc.dif + openssl-allow-arch.diff + openssl-hppa-config.diff + +------------------------------------------------------------------- +Fri Apr 9 11:42:51 CEST 2010 - meissner(a)suse.de + +- fixed "exectuable stack" for libcrypto.so issue on i586 by + adjusting the assembler output during MMX builds. + +------------------------------------------------------------------- +Wed Apr 7 14:08:05 CEST 2010 - meissner(a)suse.de + +- Openssl is now partially converted to libdir usage upstream, + merge that in to fix lib64 builds. + +------------------------------------------------------------------- +Thu Mar 25 02:18:22 UTC 2010 - gjhe(a)novell.com + +- fix security bug [bnc#590833] + CVE-2010-0740 + +------------------------------------------------------------------- ++++ 1095 more lines (skipped) ++++ between /dev/null ++++ and /work/SRC/openSUSE:11.4:Update/.openssl.444.new/openssl.changes New: ---- Bug748738_Tolerate_bad_MIME_headers.patch CVE-2011-3207.patch CVE-2011-3210.patch CVE-2011-4108.patch CVE-2011-4576.patch CVE-2011-4577.patch CVE-2011-4619.patch CVE-2012-0027.patch CVE-2012-0050.patch CVE-2012-0884.patch CVE-2012-1165.patch ECDSA_signatures_timing_attack.patch README.SuSE baselibs.conf bug610223.patch bug749210-Symmetric-crypto-errors-in-PKCS7_decrypt.patch bug749213-Free-headers-after-use.patch bug749735.patch merge_from_0.9.8k.patch openssl-1.0.0-c_rehash-compat.diff openssl-1.0.0b-aesni.patch openssl-1.0.0c.tar.bz2 openssl.changes openssl.spec openssl.test ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ openssl.spec ++++++ # # spec file for package openssl # # Copyright (c) 2012 SUSE LINUX Products GmbH, Nuernberg, Germany. # # All modifications and additions to the file contributed by third parties # remain the property of their copyright owners, unless otherwise agreed # upon. The license for this file, and modifications and additions to the # file, is the same license as for the pristine package itself (unless the # license for the pristine package is not an Open Source License, in which # case the license is the MIT License). An "Open Source License" is a # license that conforms to the Open Source Definition (Version 1.9) # published by the Open Source Initiative. # Please submit bugfixes or comments via http://bugs.opensuse.org/ # # norootforbuild Name: openssl BuildRequires: bc ed pkg-config zlib-devel %define ssletcdir %{_sysconfdir}/ssl %define num_version %(echo "%{version}" | sed -e "s+[a-zA-Z]++g; s+_.*++g") License: BSD3c(or similar) Group: Productivity/Networking/Security Provides: ssl AutoReqProv: on # bug437293 %ifarch ppc64 Obsoletes: openssl-64bit %endif Version: 1.0.0c Release: 18.<RELEASE27> Summary: Secure Sockets and Transport Layer Security Url: http://www.openssl.org/ Source: http://www.%{name}.org/source/%{name}-%{version}.tar.bz2 # to get mtime of file: Source1: openssl.changes Source2: baselibs.conf Source10: README.SuSE Patch0: merge_from_0.9.8k.patch Patch1: openssl-1.0.0-c_rehash-compat.diff Patch2: bug610223.patch #Patch3: CVE-2010-1633_and_CVE-2010-0742.patch #Patch4: patchset-19727.diff #Patch5: CVE-2010-2939.patch #Patch6: CVE-2010-3864.patch Patch7: openssl-1.0.0b-aesni.patch Patch8: ECDSA_signatures_timing_attack.patch Patch9: CVE-2011-3207.patch Patch10: CVE-2011-3210.patch Patch21: CVE-2011-4108.patch Patch22: CVE-2011-4576.patch Patch23: CVE-2011-4577.patch Patch24: CVE-2011-4619.patch Patch25: CVE-2012-0027.patch Patch26: CVE-2012-0050.patch Patch27: Bug748738_Tolerate_bad_MIME_headers.patch Patch28: bug749213-Free-headers-after-use.patch Patch29: bug749210-Symmetric-crypto-errors-in-PKCS7_decrypt.patch Patch30: CVE-2012-1165.patch Patch31: CVE-2012-0884.patch Patch32: bug749735.patch BuildRoot: %{_tmppath}/%{name}-%{version}-build %description The OpenSSL Project is a collaborative effort to develop a robust, commercial-grade, full-featured, and open source toolkit implementing the Secure Sockets Layer (SSL v2/v3) and Transport Layer Security (TLS v1) protocols with full-strength cryptography. The project is managed by a worldwide community of volunteers that use the Internet to communicate, plan, and develop the OpenSSL toolkit and its related documentation. Derivation and License OpenSSL is based on the excellent SSLeay library developed by Eric A. Young and Tim J. Hudson. The OpenSSL toolkit is licensed under an Apache-style license, which basically means that you are free to get it and to use it for commercial and noncommercial purposes. Authors: -------- Mark J. Cox <mark(a)openssl.org> Ralf S. Engelschall <rse(a)openssl.org> Dr. Stephen Henson <steve(a)openssl.org> Ben Laurie <ben(a)openssl.org> Bodo Moeller <bodo(a)openssl.org> Ulf Moeller <ulf(a)openssl.org> Holger Reif <holger(a)openssl.org> Paul C. Sutton <paul(a)openssl.org> %package -n libopenssl1_0_0 License: BSD3c(or similar) Summary: Secure Sockets and Transport Layer Security Group: Productivity/Networking/Security Recommends: openssl-certs # bug437293 %ifarch ppc64 Obsoletes: openssl-64bit %endif # %description -n libopenssl1_0_0 The OpenSSL Project is a collaborative effort to develop a robust, commercial-grade, full-featured, and open source toolkit implementing the Secure Sockets Layer (SSL v2/v3) and Transport Layer Security (TLS v1) protocols with full-strength cryptography. The project is managed by a worldwide community of volunteers that use the Internet to communicate, plan, and develop the OpenSSL toolkit and its related documentation. Derivation and License OpenSSL is based on the excellent SSLeay library developed by Eric A. Young and Tim J. Hudson. The OpenSSL toolkit is licensed under an Apache-style license, which basically means that you are free to get it and to use it for commercial and noncommercial purposes. Authors: -------- Mark J. Cox <mark(a)openssl.org> Ralf S. Engelschall <rse(a)openssl.org> Dr. Stephen Henson <steve(a)openssl.org> Ben Laurie <ben(a)openssl.org> Bodo Moeller <bodo(a)openssl.org> Ulf Moeller <ulf(a)openssl.org> Holger Reif <holger(a)openssl.org> Paul C. Sutton <paul(a)openssl.org> %package -n libopenssl-devel License: BSD3c(or similar) Summary: Include Files and Libraries mandatory for Development Group: Development/Libraries/C and C++ Obsoletes: openssl-devel < %{version} Requires: libopenssl1_0_0 = %{version} zlib-devel Provides: openssl-devel = %{version} # bug437293 %ifarch ppc64 Obsoletes: openssl-devel-64bit %endif # %description -n libopenssl-devel This package contains all necessary include files and libraries needed to develop applications that require these. Authors: -------- Mark J. Cox <mark(a)openssl.org> Ralf S. Engelschall <rse(a)openssl.org> Dr. Stephen <Henson steve(a)openssl.org> Ben Laurie <ben(a)openssl.org> Bodo Moeller <bodo(a)openssl.org> Ulf Moeller <ulf(a)openssl.org> Holger Reif <holger(a)openssl.org> Paul C. Sutton <paul(a)openssl.org> %package doc License: BSD3c(or similar) Summary: Additional Package Documentation Group: Productivity/Networking/Security BuildArch: noarch %description doc This package contains optional documentation provided in addition to this package's base documentation. Authors: -------- Mark J. Cox <mark(a)openssl.org> Ralf S. Engelschall <rse(a)openssl.org> Dr. Stephen <Henson steve(a)openssl.org> Ben Laurie <ben(a)openssl.org> Bodo Moeller <bodo(a)openssl.org> Ulf Moeller <ulf(a)openssl.org> Holger Reif <holger(a)openssl.org> Paul C. Sutton <paul(a)openssl.org> %prep %setup -q %patch0 -p1 %patch1 -p1 %patch2 -p1 #%patch3 -p1 #%patch4 -p1 #%patch5 -p1 #%patch6 -p1 %patch7 -p1 %patch8 -p1 %patch9 -p1 %patch10 -p1 %patch21 -p1 %patch22 -p1 %patch23 -p1 %patch24 -p1 %patch25 -p1 %patch26 -p1 %patch27 -p1 %patch28 -p1 %patch29 -p1 %patch30 -p1 %patch31 -p1 %patch32 -p1 cp -p %{S:10} . echo "adding/overwriting some entries in the 'table' hash in Configure" # $dso_scheme:$shared_target:$shared_cflag:$shared_ldflag:$shared_extension:$ranlib:$arflags export DSO_SCHEME='dlfcn:linux-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)::' cat <<EOF_ED | ed -s Configure /^); - i # # local configuration added from specfile # ... MOST of those are now correct in openssl's Configure already, # so only add them for new ports! # #config-string, $cc:$cflags:$unistd:$thread_cflag:$sys_id:$lflags:$bn_ops:$cpuid_obj:$bn_obj:$des_obj:$aes_obj:$bf_obj:$md5_obj:$sha1_obj:$cast_obj:$rc4_obj:$rmd160_obj:$rc5_obj:$wp_obj:$cmll_obj:$dso_scheme:$shared_target:$shared_cflag:$shared_ldflag:$shared_extension:$ranlib:$arflags:$multilib #"linux-elf", "gcc:-DL_ENDIAN ::-D_REENTRANT::-ldl:BN_LLONG \${x86_gcc_des} \${x86_gcc_opts}:\${x86_elf_asm}:$DSO_SCHEME:", #"linux-ia64", "gcc:-DL_ENDIAN -DMD32_REG_T=int::-D_REENTRANT::-ldl:SIXTY_FOUR_BIT_LONG RC4_CHUNK RC4_CHAR:\${ia64_asm}: $DSO_SCHEME:", #"linux-ppc", "gcc:-DB_ENDIAN ::-D_REENTRANT::-ldl:BN_LLONG RC4_CHAR RC4_CHUNK DES_RISC1 DES_UNROLL:\${no_asm}: $DSO_SCHEME:", #"linux-ppc64", "gcc:-DB_ENDIAN -DMD32_REG_T=int::-D_REENTRANT::-ldl:RC4_CHAR RC4_CHUNK DES_RISC1 DES_UNROLL SIXTY_FOUR_BIT_LONG:\${no_asm}: $DSO_SCHEME:64", "linux-elf-arm","gcc:-DL_ENDIAN ::-D_REENTRANT::-ldl:BN_LLONG:\${no_asm}: $DSO_SCHEME:", "linux-mips", "gcc:-DB_ENDIAN ::-D_REENTRANT::-ldl:BN_LLONG RC4_CHAR RC4_CHUNK DES_RISC1 DES_UNROLL:\${no_asm}: $DSO_SCHEME:", "linux-sparcv7","gcc:-DB_ENDIAN ::-D_REENTRANT::-ldl:BN_LLONG RC4_CHAR RC4_CHUNK DES_UNROLL BF_PTR:\${no_asm}: $DSO_SCHEME:", "linux-sparcv8","gcc:-DB_ENDIAN -DBN_DIV2W -mv8 ::-D_REENTRANT::-ldl:BN_LLONG RC4_CHAR RC4_CHUNK DES_UNROLL BF_PTR::asm/sparcv8.o::::::::::::: $DSO_SCHEME:", #"linux-x86_64", "gcc:-DL_ENDIAN -DNO_ASM -DMD32_REG_T=int::-D_REENTRANT::-ldl:SIXTY_FOUR_BIT_LONG:\${no_asm}: $DSO_SCHEME:64", #"linux-s390", "gcc:-DB_ENDIAN ::(unknown): :-ldl:BN_LLONG:\${no_asm}: $DSO_SCHEME:", #"linux-s390x", "gcc:-DB_ENDIAN -DNO_ASM -DMD32_REG_T=int::-D_REENTRANT::-ldl:SIXTY_FOUR_BIT_LONG:\${no_asm}: $DSO_SCHEME:64", "linux-parisc", "gcc:-DB_ENDIAN ::-D_REENTRANT::-ldl:BN_LLONG RC4_CHAR DES_PTR DES_UNROLL DES_RISC1:\${no_asm}: $DSO_SCHEME:", . wq EOF_ED # fix ENGINESDIR path sed -i 's,/lib/engines,/%_lib/engines,' Configure # Record mtime of changes file instead of build time CHANGES=`stat --format="%y" %SOURCE1` sed -i -e "s|#define DATE $.*$.LC_ALL.*date.|#define DATE \1$CHANGES|" crypto/Makefile %build ./config --test-sanity # config_flags="threads shared no-rc5 no-idea \ enable-camellia \ zlib \ --prefix=%{_prefix} \ --libdir=%{_lib} \ --openssldir=%{ssletcdir} \ $RPM_OPT_FLAGS \ -Wa,--noexecstack \ -fomit-frame-pointer \ -fno-strict-aliasing \ -DTERMIO \ -DPURIFY \ %ifnarch hppa -Wall \ -fstack-protector " %else -Wall " %endif # #%{!?do_profiling:%define do_profiling 0} #%if %do_profiling # # generate feedback # ./config $config_flags # make depend CC="gcc %cflags_profile_generate" # make CC="gcc %cflags_profile_generate" # LD_LIBRARY_PATH=`pwd` make rehash CC="gcc %cflags_profile_generate" # LD_LIBRARY_PATH=`pwd` make test CC="gcc %cflags_profile_generate" # LD_LIBRARY_PATH=`pwd` apps/openssl speed # make clean # # compile with feedback # # but not if it makes a cipher slower: # #find crypto/aes -name '*.da' | xargs -r rm # ./config $config_flags %cflags_profile_feedback # make depend # make # LD_LIBRARY_PATH=`pwd` make rehash # LD_LIBRARY_PATH=`pwd` make test #%else # OpenSSL relies on uname -m (not good). Thus that little sparc line. ./config \ %ifarch sparc64 linux64-sparcv9 \ %endif $config_flags make depend make LD_LIBRARY_PATH=`pwd` make rehash %ifnarch armv4l LD_LIBRARY_PATH=`pwd` make test %endif #%endif # show settings make TABLE echo $RPM_OPT_FLAGS eval $(egrep PLATFORM='[[:alnum:]]' Makefile) grep -B1 -A22 "^\*\*\* $PLATFORM$" TABLE %install rm -rf $RPM_BUILD_ROOT make MANDIR=%{_mandir} INSTALL_PREFIX=$RPM_BUILD_ROOT install # install standard root certificates cp -pr certs/* $RPM_BUILD_ROOT%{ssletcdir}/certs ln -sf ./%{name} $RPM_BUILD_ROOT/%{_includedir}/ssl mkdir $RPM_BUILD_ROOT/%{_datadir}/ssl mv $RPM_BUILD_ROOT/%{ssletcdir}/misc $RPM_BUILD_ROOT/%{_datadir}/ssl/ # ln -s %{ssletcdir}/certs $RPM_BUILD_ROOT/%{_datadir}/ssl/certs # ln -s %{ssletcdir}/private $RPM_BUILD_ROOT/%{_datadir}/ssl/private # ln -s %{ssletcdir}/openssl.cnf $RPM_BUILD_ROOT/%{_datadir}/ssl/openssl.cnf # # avoid file conflicts with man pages from other packages # pushd $RPM_BUILD_ROOT/%{_mandir} # some man pages now contain spaces. This makes several scripts go havoc, among them /usr/sbin/Check. # replace spaces by underscores #for i in man?/*\ *; do mv -v "$i" "${i// /_}"; done which readlink &>/dev/null || function readlink { ( set +x; target=$(file $1 2>/dev/null); target=${target//* }; test -f $target && echo $target; ) } for i in man?/*; do if test -L $i ; then LDEST=`readlink $i` rm -f $i ${i}ssl ln -sf ${LDEST}ssl ${i}ssl else mv $i ${i}ssl fi case `basename ${i%.*}` in asn1parse|ca|config|crl|crl2pkcs7|crypto|dgst|dhparam|dsa|dsaparam|enc|gendsa|genrsa|nseq|openssl|passwd|pkcs12|pkcs7|pkcs8|rand|req|rsa|rsautl|s_client|s_server|smime|spkac|ssl|verify|version|x509) # these are the pages mentioned in openssl(1). They go into the main package. echo %doc %{_mandir}/${i}ssl.gz >> $OLDPWD/filelist;; *) # the rest goes into the openssl-doc package. echo %doc %{_mandir}/${i}ssl.gz >> $OLDPWD/filelist.doc;; esac done popd # # check wether some shared library has been installed # ls -l $RPM_BUILD_ROOT%{_libdir} test -f $RPM_BUILD_ROOT%{_libdir}/libssl.so.%{num_version} test -f $RPM_BUILD_ROOT%{_libdir}/libcrypto.so.%{num_version} test -L $RPM_BUILD_ROOT%{_libdir}/libssl.so test -L $RPM_BUILD_ROOT%{_libdir}/libcrypto.so # # see what we've got # cat > showciphers.c <<EOF #include <openssl/err.h> #include <openssl/ssl.h> int main(){ unsigned int i; SSL_CTX *ctx; SSL *ssl; SSL_METHOD *meth; meth = SSLv2_client_method(); SSLeay_add_ssl_algorithms(); ctx = SSL_CTX_new(meth); if (ctx == NULL) return 0; ssl = SSL_new(ctx); if (!ssl) return 0; for (i=0; ; i++) { int j, k; SSL_CIPHER *sc; sc = (meth->get_cipher)(i); if (!sc) break; k = SSL_CIPHER_get_bits(sc, &j); printf("%s\n", sc->name); } return 0; }; EOF gcc $RPM_OPT_FLAGS -I${RPM_BUILD_ROOT}%{_includedir} -c showciphers.c gcc -o showciphers showciphers.o -L${RPM_BUILD_ROOT}%{_libdir} -lssl -lcrypto LD_LIBRARY_PATH=${RPM_BUILD_ROOT}%{_libdir} ./showciphers > AVAILABLE_CIPHERS || true cat AVAILABLE_CIPHERS # Do not install demo scripts executable under /usr/share/doc find demos -type f -perm /111 -exec chmod 644 {} \; #process openssllib mkdir $RPM_BUILD_ROOT/%{_lib} mv $RPM_BUILD_ROOT%{_libdir}/libssl.so.%{num_version} $RPM_BUILD_ROOT/%{_lib}/ mv $RPM_BUILD_ROOT%{_libdir}/libcrypto.so.%{num_version} $RPM_BUILD_ROOT/%{_lib}/ mv $RPM_BUILD_ROOT%{_libdir}/engines $RPM_BUILD_ROOT/%{_lib}/ cd $RPM_BUILD_ROOT%{_libdir}/ ln -sf /%{_lib}/libssl.so.%{num_version} ./libssl.so ln -sf /%{_lib}/libcrypto.so.%{num_version} ./libcrypto.so %clean if ! test -f /.buildenv; then rm -rf $RPM_BUILD_ROOT; fi %post -n libopenssl1_0_0 /sbin/ldconfig %postun -n libopenssl1_0_0 /sbin/ldconfig %files -n libopenssl1_0_0 %defattr(-, root, root) /%{_lib}/libssl.so.%{num_version} /%{_lib}/libcrypto.so.%{num_version} /%{_lib}/engines %files -n libopenssl-devel %defattr(-, root, root) %{_includedir}/%{name}/ %{_includedir}/ssl %exclude %{_libdir}/libcrypto.a %exclude %{_libdir}/libssl.a %{_libdir}/libssl.so %{_libdir}/libcrypto.so %_libdir/pkgconfig/libcrypto.pc %_libdir/pkgconfig/libssl.pc %_libdir/pkgconfig/openssl.pc %files doc -f filelist.doc %defattr(-, root, root) %doc doc/* demos %doc showciphers.c %files -f filelist %defattr(-, root, root) %doc CHANGE* INSTAL* AVAILABLE_CIPHERS %doc LICENSE NEWS README README.SuSE %dir %{ssletcdir} %dir %{ssletcdir}/certs %{ssletcdir}/certs/* %config (noreplace) %{ssletcdir}/openssl.cnf %attr(700,root,root) %{ssletcdir}/private %dir %{_datadir}/ssl %{_datadir}/ssl/misc %{_bindir}/c_rehash %{_bindir}/%{name} %changelog ++++++ Bug748738_Tolerate_bad_MIME_headers.patch ++++++ Index: openssl-1.0.0g/crypto/asn1/asn_mime.c =================================================================== --- openssl-1.0.0g.orig/crypto/asn1/asn_mime.c +++ openssl-1.0.0g/crypto/asn1/asn_mime.c @@ -858,6 +858,10 @@ static int mime_hdr_addparam(MIME_HEADER static int mime_hdr_cmp(const MIME_HEADER * const *a, const MIME_HEADER * const *b) { + if ((*a)->name == NULL || (*b)->name == NULL) + return (*a)->name - (*b)->name < 0 ? -1 : + (*a)->name - (*b)->name > 0 ? 1 : 0; + return(strcmp((*a)->name, (*b)->name)); } ++++++ CVE-2011-3207.patch ++++++ Index: openssl-1.0.0c/crypto/x509/x509_vfy.c =================================================================== --- openssl-1.0.0c.orig/crypto/x509/x509_vfy.c +++ openssl-1.0.0c/crypto/x509/x509_vfy.c @@ -703,6 +703,7 @@ static int check_cert(X509_STORE_CTX *ct x = sk_X509_value(ctx->chain, cnum); ctx->current_cert = x; ctx->current_issuer = NULL; + ctx->current_crl_score = 0; ctx->current_reasons = 0; while (ctx->current_reasons != CRLDP_ALL_REASONS) { @@ -2015,6 +2016,9 @@ int X509_STORE_CTX_init(X509_STORE_CTX * ctx->error_depth=0; ctx->current_cert=NULL; ctx->current_issuer=NULL; + ctx->current_crl=NULL; + ctx->current_crl_score=0; + ctx->current_reasons=0; ctx->tree = NULL; ctx->parent = NULL; ++++++ CVE-2011-3210.patch ++++++ Index: openssl-1.0.0c/ssl/d1_srvr.c =================================================================== --- openssl-1.0.0c.orig/ssl/d1_srvr.c +++ openssl-1.0.0c/ssl/d1_srvr.c @@ -1017,12 +1017,11 @@ int dtls1_send_server_key_exchange(SSL * SSLerr(SSL_F_DTLS1_SEND_SERVER_KEY_EXCHANGE,ERR_R_ECDH_LIB); goto err; } - if (!EC_KEY_up_ref(ecdhp)) + if ((ecdh = EC_KEY_dup(ecdhp)) == NULL) { SSLerr(SSL_F_DTLS1_SEND_SERVER_KEY_EXCHANGE,ERR_R_ECDH_LIB); goto err; } - ecdh = ecdhp; s->s3->tmp.ecdh=ecdh; if ((EC_KEY_get0_public_key(ecdh) == NULL) || Index: openssl-1.0.0c/ssl/s3_lib.c =================================================================== --- openssl-1.0.0c.orig/ssl/s3_lib.c +++ openssl-1.0.0c/ssl/s3_lib.c @@ -2198,11 +2198,17 @@ void ssl3_clear(SSL *s) } #ifndef OPENSSL_NO_DH if (s->s3->tmp.dh != NULL) + { DH_free(s->s3->tmp.dh); + s->s3->tmp.dh = NULL; + } #endif #ifndef OPENSSL_NO_ECDH if (s->s3->tmp.ecdh != NULL) + { EC_KEY_free(s->s3->tmp.ecdh); + s->s3->tmp.ecdh = NULL; + } #endif rp = s->s3->rbuf.buf; Index: openssl-1.0.0c/ssl/s3_srvr.c =================================================================== --- openssl-1.0.0c.orig/ssl/s3_srvr.c +++ openssl-1.0.0c/ssl/s3_srvr.c @@ -778,6 +778,13 @@ int ssl3_check_client_hello(SSL *s) s->s3->tmp.dh = NULL; } #endif +#ifndef OPENSSL_NO_ECDH + if (s->s3->tmp.ecdh != NULL) + { + EC_KEY_free(s->s3->tmp.ecdh); + s->s3->tmp.ecdh = NULL; + } +#endif return 2; } return 1; @@ -1491,7 +1498,6 @@ int ssl3_send_server_key_exchange(SSL *s if (s->s3->tmp.dh != NULL) { - DH_free(dh); SSLerr(SSL_F_SSL3_SEND_SERVER_KEY_EXCHANGE, ERR_R_INTERNAL_ERROR); goto err; } @@ -1552,7 +1558,6 @@ int ssl3_send_server_key_exchange(SSL *s if (s->s3->tmp.ecdh != NULL) { - EC_KEY_free(s->s3->tmp.ecdh); SSLerr(SSL_F_SSL3_SEND_SERVER_KEY_EXCHANGE, ERR_R_INTERNAL_ERROR); goto err; } @@ -1563,12 +1568,11 @@ int ssl3_send_server_key_exchange(SSL *s SSLerr(SSL_F_SSL3_SEND_SERVER_KEY_EXCHANGE,ERR_R_ECDH_LIB); goto err; } - if (!EC_KEY_up_ref(ecdhp)) + if ((ecdh = EC_KEY_dup(ecdhp)) == NULL) { SSLerr(SSL_F_SSL3_SEND_SERVER_KEY_EXCHANGE,ERR_R_ECDH_LIB); goto err; } - ecdh = ecdhp; s->s3->tmp.ecdh=ecdh; if ((EC_KEY_get0_public_key(ecdh) == NULL) || @@ -2440,6 +2444,12 @@ int ssl3_get_client_key_exchange(SSL *s) /* Get encoded point length */ i = *p; p += 1; + if (n != 1 + i) + { + SSLerr(SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE, + ERR_R_EC_LIB); + goto err; + } if (EC_POINT_oct2point(group, clnt_ecpoint, p, i, bn_ctx) == 0) { ++++++ CVE-2011-4108.patch ++++++ Index: openssl-1.0.0c/ssl/d1_pkt.c =================================================================== --- openssl-1.0.0c.orig/ssl/d1_pkt.c +++ openssl-1.0.0c/ssl/d1_pkt.c @@ -375,6 +375,7 @@ dtls1_process_record(SSL *s) SSL3_RECORD *rr; unsigned int mac_size; unsigned char md[EVP_MAX_MD_SIZE]; + int decryption_failed_or_bad_record_mac = 0; rr= &(s->s3->rrec); @@ -409,12 +410,10 @@ dtls1_process_record(SSL *s) enc_err = s->method->ssl3_enc->enc(s,0); if (enc_err <= 0) { - if (enc_err == 0) - /* SSLerr() and ssl3_send_alert() have been called */ - goto err; - - /* otherwise enc_err == -1 */ - goto err; + /* To minimize information leaked via timing, we will always + * perform all computations before discarding the message. + */ + decryption_failed_or_bad_record_mac = 1; } #ifdef TLS_DEBUG @@ -444,7 +443,7 @@ printf("\n"); SSLerr(SSL_F_DTLS1_PROCESS_RECORD,SSL_R_PRE_MAC_LENGTH_TOO_LONG); goto f_err; #else - goto err; + decryption_failed_or_bad_record_mac = 1; #endif } /* check the MAC for rr->input (it's in mac_size bytes at the tail) */ @@ -455,17 +454,25 @@ printf("\n"); SSLerr(SSL_F_DTLS1_PROCESS_RECORD,SSL_R_LENGTH_TOO_SHORT); goto f_err; #else - goto err; + decryption_failed_or_bad_record_mac = 1; #endif } rr->length-=mac_size; i=s->method->ssl3_enc->mac(s,md,0); if (i < 0 || memcmp(md,&(rr->data[rr->length]),mac_size) != 0) { - goto err; + decryption_failed_or_bad_record_mac = 1; } } + if (decryption_failed_or_bad_record_mac) + { + /* decryption failed, silently discard message */ + rr->length = 0; + s->packet_length = 0; + goto err; + } + /* r->length is now just compressed */ if (s->expand != NULL) { ++++++ CVE-2011-4576.patch ++++++ Index: openssl-1.0.0c/ssl/s3_enc.c =================================================================== --- openssl-1.0.0c.orig/ssl/s3_enc.c +++ openssl-1.0.0c/ssl/s3_enc.c @@ -511,6 +511,9 @@ int ssl3_enc(SSL *s, int send) /* we need to add 'i-1' padding bytes */ l+=i; + /* the last of these zero bytes will be overwritten + * with the padding length. */ + memset(&rec->input[rec->length], 0, i); rec->length+=i; rec->input[l-1]=(i-1); } ++++++ CVE-2011-4577.patch ++++++ Index: openssl-1.0.0c/crypto/x509v3/v3_addr.c =================================================================== --- openssl-1.0.0c.orig/crypto/x509v3/v3_addr.c +++ openssl-1.0.0c/crypto/x509v3/v3_addr.c @@ -142,12 +142,13 @@ unsigned int v3_addr_get_afi(const IPAdd * Expand the bitstring form of an address into a raw byte array. * At the moment this is coded for simplicity, not speed. */ -static void addr_expand(unsigned char *addr, +static int addr_expand(unsigned char *addr, const ASN1_BIT_STRING *bs, const int length, const unsigned char fill) { - OPENSSL_assert(bs->length >= 0 && bs->length <= length); + if (bs->length < 0 || bs->length > length) + return 0; if (bs->length > 0) { memcpy(addr, bs->data, bs->length); if ((bs->flags & 7) != 0) { @@ -159,6 +160,7 @@ static void addr_expand(unsigned char *a } } memset(addr + bs->length, fill, length - bs->length); + return 1; } /* @@ -179,11 +181,13 @@ static int i2r_address(BIO *out, switch (afi) { case IANA_AFI_IPV4: - addr_expand(addr, bs, 4, fill); + if (!addr_expand(addr, bs, 4, fill)) + return 0; BIO_printf(out, "%d.%d.%d.%d", addr[0], addr[1], addr[2], addr[3]); break; case IANA_AFI_IPV6: - addr_expand(addr, bs, 16, fill); + if (!addr_expand(addr, bs, 16, fill)) + return 0; for (n = 16; n > 1 && addr[n-1] == 0x00 && addr[n-2] == 0x00; n -= 2) ; for (i = 0; i < n; i += 2) @@ -309,6 +313,12 @@ static int i2r_IPAddrBlocks(const X509V3 /* * Sort comparison function for a sequence of IPAddressOrRange * elements. + * + * There's no sane answer we can give if addr_expand() fails, and an + * assertion failure on externally supplied data is seriously uncool, + * so we just arbitrarily declare that if given invalid inputs this + * function returns -1. If this messes up your preferred sort order + * for garbage input, tough noogies. */ static int IPAddressOrRange_cmp(const IPAddressOrRange *a, const IPAddressOrRange *b, @@ -320,22 +330,26 @@ static int IPAddressOrRange_cmp(const IP switch (a->type) { case IPAddressOrRange_addressPrefix: - addr_expand(addr_a, a->u.addressPrefix, length, 0x00); + if (!addr_expand(addr_a, a->u.addressPrefix, length, 0x00)) + return -1; prefixlen_a = addr_prefixlen(a->u.addressPrefix); break; case IPAddressOrRange_addressRange: - addr_expand(addr_a, a->u.addressRange->min, length, 0x00); + if (!addr_expand(addr_a, a->u.addressRange->min, length, 0x00)) + return -1; prefixlen_a = length * 8; break; } switch (b->type) { case IPAddressOrRange_addressPrefix: - addr_expand(addr_b, b->u.addressPrefix, length, 0x00); + if (!addr_expand(addr_b, b->u.addressPrefix, length, 0x00)) + return -1; prefixlen_b = addr_prefixlen(b->u.addressPrefix); break; case IPAddressOrRange_addressRange: - addr_expand(addr_b, b->u.addressRange->min, length, 0x00); + if (!addr_expand(addr_b, b->u.addressRange->min, length, 0x00)) + return -1; prefixlen_b = length * 8; break; } @@ -650,22 +664,22 @@ int v3_addr_add_range(IPAddrBlocks *addr /* * Extract min and max values from an IPAddressOrRange. */ -static void extract_min_max(IPAddressOrRange *aor, +static int extract_min_max(IPAddressOrRange *aor, unsigned char *min, unsigned char *max, int length) { - OPENSSL_assert(aor != NULL && min != NULL && max != NULL); + if (aor == NULL || min == NULL || max == NULL) + return 0; switch (aor->type) { case IPAddressOrRange_addressPrefix: - addr_expand(min, aor->u.addressPrefix, length, 0x00); - addr_expand(max, aor->u.addressPrefix, length, 0xFF); - return; + return (addr_expand(min, aor->u.addressPrefix, length, 0x00) && + addr_expand(max, aor->u.addressPrefix, length, 0xFF)); case IPAddressOrRange_addressRange: - addr_expand(min, aor->u.addressRange->min, length, 0x00); - addr_expand(max, aor->u.addressRange->max, length, 0xFF); - return; + return (addr_expand(min, aor->u.addressRange->min, length, 0x00) && + addr_expand(max, aor->u.addressRange->max, length, 0xFF)); } + return 0; } /* @@ -681,9 +695,9 @@ int v3_addr_get_range(IPAddressOrRange * if (aor == NULL || min == NULL || max == NULL || afi_length == 0 || length < afi_length || (aor->type != IPAddressOrRange_addressPrefix && - aor->type != IPAddressOrRange_addressRange)) + aor->type != IPAddressOrRange_addressRange) || + !extract_min_max(aor, min, max, afi_length)) return 0; - extract_min_max(aor, min, max, afi_length); return afi_length; } @@ -765,8 +779,9 @@ int v3_addr_is_canonical(IPAddrBlocks *a IPAddressOrRange *a = sk_IPAddressOrRange_value(aors, j); IPAddressOrRange *b = sk_IPAddressOrRange_value(aors, j + 1); - extract_min_max(a, a_min, a_max, length); - extract_min_max(b, b_min, b_max, length); + if (!extract_min_max(a, a_min, a_max, length) || + !extract_min_max(b, b_min, b_max, length)) + return 0; /* * Punt misordered list, overlapping start, or inverted range. @@ -799,8 +814,9 @@ int v3_addr_is_canonical(IPAddrBlocks *a j = sk_IPAddressOrRange_num(aors) - 1; { IPAddressOrRange *a = sk_IPAddressOrRange_value(aors, j); - if (a->type == IPAddressOrRange_addressRange) { - extract_min_max(a, a_min, a_max, length); + if (a != NULL && a->type == IPAddressOrRange_addressRange) { + if (!extract_min_max(a, a_min, a_max, length)) + return 0; if (range_should_be_prefix(a_min, a_max, length) >= 0) return 0; } @@ -835,8 +851,9 @@ static int IPAddressOrRanges_canonize(IP unsigned char a_min[ADDR_RAW_BUF_LEN], a_max[ADDR_RAW_BUF_LEN]; unsigned char b_min[ADDR_RAW_BUF_LEN], b_max[ADDR_RAW_BUF_LEN]; - extract_min_max(a, a_min, a_max, length); - extract_min_max(b, b_min, b_max, length); + if (!extract_min_max(a, a_min, a_max, length) || + !extract_min_max(b, b_min, b_max, length)) + return 0; /* * Punt overlaps. @@ -1096,13 +1113,15 @@ static int addr_contains(IPAddressOrRang p = 0; for (c = 0; c < sk_IPAddressOrRange_num(child); c++) { - extract_min_max(sk_IPAddressOrRange_value(child, c), - c_min, c_max, length); + if (!extract_min_max(sk_IPAddressOrRange_value(child, c), + c_min, c_max, length)) + return -1; for (;; p++) { if (p >= sk_IPAddressOrRange_num(parent)) return 0; - extract_min_max(sk_IPAddressOrRange_value(parent, p), - p_min, p_max, length); + if (!extract_min_max(sk_IPAddressOrRange_value(parent, p), + p_min, p_max, length)) + return 0; if (memcmp(p_max, c_max, length) < 0) continue; if (memcmp(p_min, c_min, length) > 0) ++++++ CVE-2011-4619.patch ++++++ Index: openssl-1.0.0c/ssl/s3_srvr.c =================================================================== --- openssl-1.0.0c.orig/ssl/s3_srvr.c +++ openssl-1.0.0c/ssl/s3_srvr.c @@ -258,6 +258,7 @@ int ssl3_accept(SSL *s) } s->init_num=0; + s->s3->flags &= ~SSL3_FLAGS_SGC_RESTART_DONE; if (s->state != SSL_ST_RENEGOTIATE) { @@ -755,6 +756,14 @@ int ssl3_check_client_hello(SSL *s) int ok; long n; + /* We only allow the client to restart the handshake once per + * negotiation. */ + if (s->s3->flags & SSL3_FLAGS_SGC_RESTART_DONE) + { + SSLerr(SSL_F_SSL3_CHECK_CLIENT_HELLO, SSL_R_MULTIPLE_SGC_RESTARTS); + return -1; + } + /* this function is called when we really expect a Certificate message, * so permit appropriate message length */ n=s->method->ssl_get_message(s, @@ -785,6 +794,7 @@ int ssl3_check_client_hello(SSL *s) s->s3->tmp.ecdh = NULL; } #endif + s->s3->flags |= SSL3_FLAGS_SGC_RESTART_DONE; return 2; } return 1; Index: openssl-1.0.0c/ssl/ssl.h =================================================================== --- openssl-1.0.0c.orig/ssl/ssl.h +++ openssl-1.0.0c/ssl/ssl.h @@ -1882,6 +1882,7 @@ void ERR_load_SSL_strings(void); #define SSL_F_SSL3_CALLBACK_CTRL 233 #define SSL_F_SSL3_CHANGE_CIPHER_STATE 129 #define SSL_F_SSL3_CHECK_CERT_AND_ALGORITHM 130 +#define SSL_F_SSL3_CHECK_CLIENT_HELLO 304 #define SSL_F_SSL3_CLIENT_HELLO 131 #define SSL_F_SSL3_CONNECT 132 #define SSL_F_SSL3_CTRL 213 @@ -2139,6 +2140,7 @@ void ERR_load_SSL_strings(void); #define SSL_R_MISSING_TMP_RSA_KEY 172 #define SSL_R_MISSING_TMP_RSA_PKEY 173 #define SSL_R_MISSING_VERIFY_MESSAGE 174 +#define SSL_R_MULTIPLE_SGC_RESTARTS 346 #define SSL_R_NON_SSLV2_INITIAL_PACKET 175 #define SSL_R_NO_CERTIFICATES_RETURNED 176 #define SSL_R_NO_CERTIFICATE_ASSIGNED 177 Index: openssl-1.0.0c/ssl/ssl3.h =================================================================== --- openssl-1.0.0c.orig/ssl/ssl3.h +++ openssl-1.0.0c/ssl/ssl3.h @@ -379,6 +379,17 @@ typedef struct ssl3_buffer_st #define SSL3_FLAGS_POP_BUFFER 0x0004 #define TLS1_FLAGS_TLS_PADDING_BUG 0x0008 #define TLS1_FLAGS_SKIP_CERT_VERIFY 0x0010 + +/* SSL3_FLAGS_SGC_RESTART_DONE is set when we + * restart a handshake because of MS SGC and so prevents us + * from restarting the handshake in a loop. It's reset on a + * renegotiation, so effectively limits the client to one restart + * per negotiation. This limits the possibility of a DDoS + * attack where the client handshakes in a loop using SGC to + * restart. Servers which permit renegotiation can still be + * effected, but we can't prevent that. + */ +#define SSL3_FLAGS_SGC_RESTART_DONE 0x0040 typedef struct ssl3_state_st { Index: openssl-1.0.0c/ssl/ssl_err.c =================================================================== --- openssl-1.0.0c.orig/ssl/ssl_err.c +++ openssl-1.0.0c/ssl/ssl_err.c @@ -1,6 +1,6 @@ /* ssl/ssl_err.c */ /* ==================================================================== - * Copyright (c) 1999-2009 The OpenSSL Project. All rights reserved. + * Copyright (c) 1999-2011 The OpenSSL Project. All rights reserved. * * Redistribution and use in source and binary forms, with or without * modification, are permitted provided that the following conditions @@ -137,6 +137,7 @@ static ERR_STRING_DATA SSL_str_functs[]= {ERR_FUNC(SSL_F_SSL3_CALLBACK_CTRL), "SSL3_CALLBACK_CTRL"}, {ERR_FUNC(SSL_F_SSL3_CHANGE_CIPHER_STATE), "SSL3_CHANGE_CIPHER_STATE"}, {ERR_FUNC(SSL_F_SSL3_CHECK_CERT_AND_ALGORITHM), "SSL3_CHECK_CERT_AND_ALGORITHM"}, +{ERR_FUNC(SSL_F_SSL3_CHECK_CLIENT_HELLO), "SSL3_CHECK_CLIENT_HELLO"}, {ERR_FUNC(SSL_F_SSL3_CLIENT_HELLO), "SSL3_CLIENT_HELLO"}, {ERR_FUNC(SSL_F_SSL3_CONNECT), "SSL3_CONNECT"}, {ERR_FUNC(SSL_F_SSL3_CTRL), "SSL3_CTRL"}, @@ -397,6 +398,7 @@ static ERR_STRING_DATA SSL_str_reasons[] {ERR_REASON(SSL_R_MISSING_TMP_RSA_KEY) ,"missing tmp rsa key"}, {ERR_REASON(SSL_R_MISSING_TMP_RSA_PKEY) ,"missing tmp rsa pkey"}, {ERR_REASON(SSL_R_MISSING_VERIFY_MESSAGE),"missing verify message"}, +{ERR_REASON(SSL_R_MULTIPLE_SGC_RESTARTS) ,"multiple sgc restarts"}, {ERR_REASON(SSL_R_NON_SSLV2_INITIAL_PACKET),"non sslv2 initial packet"}, {ERR_REASON(SSL_R_NO_CERTIFICATES_RETURNED),"no certificates returned"}, {ERR_REASON(SSL_R_NO_CERTIFICATE_ASSIGNED),"no certificate assigned"}, ++++++ CVE-2012-0027.patch ++++++ Index: openssl-1.0.0c/engines/ccgost/gost2001_keyx.c =================================================================== --- openssl-1.0.0c.orig/engines/ccgost/gost2001_keyx.c +++ openssl-1.0.0c/engines/ccgost/gost2001_keyx.c @@ -280,6 +280,10 @@ int pkey_GOST01cp_decrypt(EVP_PKEY_CTX * } param = get_encryption_params(gkt->key_agreement_info->cipher); + if(!param){ + goto err; + } + gost_init(&ctx,param->sblock); OPENSSL_assert(gkt->key_agreement_info->eph_iv->length==8); memcpy(wrappedKey,gkt->key_agreement_info->eph_iv->data,8); Index: openssl-1.0.0c/engines/ccgost/gost94_keyx.c =================================================================== --- openssl-1.0.0c.orig/engines/ccgost/gost94_keyx.c +++ openssl-1.0.0c/engines/ccgost/gost94_keyx.c @@ -261,6 +261,10 @@ int pkey_GOST94cp_decrypt(EVP_PKEY_CTX * } param = get_encryption_params(gkt->key_agreement_info->cipher); + if(!param){ + goto err; + } + gost_init(&cctx,param->sblock); OPENSSL_assert(gkt->key_agreement_info->eph_iv->length==8); memcpy(wrappedKey,gkt->key_agreement_info->eph_iv->data,8); ++++++ CVE-2012-0050.patch ++++++ Index: openssl-1.0.0e/ssl/d1_pkt.c =================================================================== --- openssl-1.0.0e.orig/ssl/d1_pkt.c +++ openssl-1.0.0e/ssl/d1_pkt.c @@ -376,6 +376,7 @@ dtls1_process_record(SSL *s) unsigned int mac_size; unsigned char md[EVP_MAX_MD_SIZE]; int decryption_failed_or_bad_record_mac = 0; + unsigned char *mac = NULL; rr= &(s->s3->rrec); @@ -447,19 +448,15 @@ printf("\n"); #endif } /* check the MAC for rr->input (it's in mac_size bytes at the tail) */ - if (rr->length < mac_size) + if (rr->length >= mac_size) { -#if 0 /* OK only for stream ciphers */ - al=SSL_AD_DECODE_ERROR; - SSLerr(SSL_F_DTLS1_PROCESS_RECORD,SSL_R_LENGTH_TOO_SHORT); - goto f_err; -#else - decryption_failed_or_bad_record_mac = 1; -#endif + rr->length -= mac_size; + mac = &rr->data[rr->length]; } - rr->length-=mac_size; + else + rr->length = 0; i=s->method->ssl3_enc->mac(s,md,0); - if (i < 0 || memcmp(md,&(rr->data[rr->length]),mac_size) != 0) + if (i < 0 || mac == NULL || memcmp(md, mac, mac_size) != 0) { decryption_failed_or_bad_record_mac = 1; } ++++++ CVE-2012-0884.patch ++++++ Index: openssl-1.0.0c/crypto/cms/cms.h =================================================================== --- openssl-1.0.0c.orig/crypto/cms/cms.h +++ openssl-1.0.0c/crypto/cms/cms.h @@ -111,6 +111,7 @@ DECLARE_ASN1_PRINT_FUNCTION(CMS_ContentI #define CMS_PARTIAL 0x4000 #define CMS_REUSE_DIGEST 0x8000 #define CMS_USE_KEYID 0x10000 +#define CMS_DEBUG_DECRYPT 0x20000 const ASN1_OBJECT *CMS_get0_type(CMS_ContentInfo *cms); Index: openssl-1.0.0c/crypto/cms/cms_enc.c =================================================================== --- openssl-1.0.0c.orig/crypto/cms/cms_enc.c +++ openssl-1.0.0c/crypto/cms/cms_enc.c @@ -73,6 +73,8 @@ BIO *cms_EncryptedContent_init_bio(CMS_E const EVP_CIPHER *ciph; X509_ALGOR *calg = ec->contentEncryptionAlgorithm; unsigned char iv[EVP_MAX_IV_LENGTH], *piv = NULL; + unsigned char *tkey = NULL; + size_t tkeylen; int ok = 0; @@ -139,30 +141,55 @@ BIO *cms_EncryptedContent_init_bio(CMS_E } - if (enc && !ec->key) + /* Generate random session key */ + if (!enc || !ec->key) { - /* Generate random key */ - if (!ec->keylen) - ec->keylen = EVP_CIPHER_CTX_key_length(ctx); - ec->key = OPENSSL_malloc(ec->keylen); - if (!ec->key) + tkeylen = EVP_CIPHER_CTX_key_length(ctx); + tkey = OPENSSL_malloc(tkeylen); + if (!tkey) { CMSerr(CMS_F_CMS_ENCRYPTEDCONTENT_INIT_BIO, ERR_R_MALLOC_FAILURE); goto err; } - if (EVP_CIPHER_CTX_rand_key(ctx, ec->key) <= 0) + if (EVP_CIPHER_CTX_rand_key(ctx, tkey) <= 0) goto err; - keep_key = 1; } - else if (ec->keylen != (unsigned int)EVP_CIPHER_CTX_key_length(ctx)) + if (!ec->key) + { + ec->key = tkey; + ec->keylen = tkeylen; + tkey = NULL; + if (enc) + keep_key = 1; + else + ERR_clear_error(); + } + + if (ec->keylen != tkeylen) { /* If necessary set key length */ if (EVP_CIPHER_CTX_set_key_length(ctx, ec->keylen) <= 0) { - CMSerr(CMS_F_CMS_ENCRYPTEDCONTENT_INIT_BIO, - CMS_R_INVALID_KEY_LENGTH); - goto err; + /* Only reveal failure if debugging so we don't + * leak information which may be useful in MMA. + */ + if (ec->debug) + { + CMSerr(CMS_F_CMS_ENCRYPTEDCONTENT_INIT_BIO, + CMS_R_INVALID_KEY_LENGTH); + goto err; + } + else + { + /* Use random key */ + OPENSSL_cleanse(ec->key, ec->keylen); + OPENSSL_free(ec->key); + ec->key = tkey; + ec->keylen = tkeylen; + tkey = NULL; + ERR_clear_error(); + } } } @@ -198,6 +225,11 @@ BIO *cms_EncryptedContent_init_bio(CMS_E OPENSSL_free(ec->key); ec->key = NULL; } + if (tkey) + { + OPENSSL_cleanse(tkey, tkeylen); + OPENSSL_free(tkey); + } if (ok) return b; BIO_free(b); Index: openssl-1.0.0c/crypto/cms/cms_env.c =================================================================== --- openssl-1.0.0c.orig/crypto/cms/cms_env.c +++ openssl-1.0.0c/crypto/cms/cms_env.c @@ -371,6 +371,8 @@ static int cms_RecipientInfo_ktri_decryp unsigned char *ek = NULL; size_t eklen; int ret = 0; + CMS_EncryptedContentInfo *ec; + ec = cms->d.envelopedData->encryptedContentInfo; if (ktri->pkey == NULL) { @@ -417,8 +419,14 @@ static int cms_RecipientInfo_ktri_decryp ret = 1; - cms->d.envelopedData->encryptedContentInfo->key = ek; - cms->d.envelopedData->encryptedContentInfo->keylen = eklen; + if (ec->key) + { + OPENSSL_cleanse(ec->key, ec->keylen); + OPENSSL_free(ec->key); + } + + ec->key = ek; + ec->keylen = eklen; err: if (pctx) Index: openssl-1.0.0c/crypto/cms/cms_lcl.h =================================================================== --- openssl-1.0.0c.orig/crypto/cms/cms_lcl.h +++ openssl-1.0.0c/crypto/cms/cms_lcl.h @@ -175,6 +175,8 @@ struct CMS_EncryptedContentInfo_st const EVP_CIPHER *cipher; unsigned char *key; size_t keylen; + /* Set to 1 if we are debugging decrypt and don't fake keys for MMA */ + int debug; }; struct CMS_RecipientInfo_st Index: openssl-1.0.0c/crypto/cms/cms_smime.c =================================================================== --- openssl-1.0.0c.orig/crypto/cms/cms_smime.c +++ openssl-1.0.0c/crypto/cms/cms_smime.c @@ -611,7 +611,10 @@ int CMS_decrypt_set1_pkey(CMS_ContentInf STACK_OF(CMS_RecipientInfo) *ris; CMS_RecipientInfo *ri; int i, r; + int debug = 0; ris = CMS_get0_RecipientInfos(cms); + if (ris) + debug = cms->d.envelopedData->encryptedContentInfo->debug; for (i = 0; i < sk_CMS_RecipientInfo_num(ris); i++) { ri = sk_CMS_RecipientInfo_value(ris, i); @@ -625,17 +628,38 @@ int CMS_decrypt_set1_pkey(CMS_ContentInf CMS_RecipientInfo_set0_pkey(ri, pk); r = CMS_RecipientInfo_decrypt(cms, ri); CMS_RecipientInfo_set0_pkey(ri, NULL); - if (r > 0) - return 1; if (cert) { + /* If not debugging clear any error and + * return success to avoid leaking of + * information useful to MMA + */ + if (!debug) + { + ERR_clear_error(); + return 1; + } + if (r > 0) + return 1; CMSerr(CMS_F_CMS_DECRYPT_SET1_PKEY, CMS_R_DECRYPT_ERROR); return 0; } - ERR_clear_error(); + /* If no cert and not debugging don't leave loop + * after first successful decrypt. Always attempt + * to decrypt all recipients to avoid leaking timing + * of a successful decrypt. + */ + else if (r > 0 && debug) + return 1; } } + /* If no cert and not debugging always return success */ + if (!cert && !debug) + { + ERR_clear_error(); + return 1; + } CMSerr(CMS_F_CMS_DECRYPT_SET1_PKEY, CMS_R_NO_MATCHING_RECIPIENT); return 0; @@ -694,6 +718,12 @@ int CMS_decrypt(CMS_ContentInfo *cms, EV } if (!dcont && !check_content(cms)) return 0; + if (flags & CMS_DEBUG_DECRYPT) + cms->d.envelopedData->encryptedContentInfo->debug = 1; + else + cms->d.envelopedData->encryptedContentInfo->debug = 0; + if (!pk && !cert && !dcont && !out) + return 1; if (pk && !CMS_decrypt_set1_pkey(cms, pk, cert)) return 0; Index: openssl-1.0.0c/crypto/pkcs7/pk7_doit.c =================================================================== --- openssl-1.0.0c.orig/crypto/pkcs7/pk7_doit.c +++ openssl-1.0.0c/crypto/pkcs7/pk7_doit.c @@ -204,11 +204,11 @@ static int pkcs7_decrypt_rinfo(unsigned unsigned char *ek = NULL; size_t eklen; - int ret = 0; + int ret = -1; pctx = EVP_PKEY_CTX_new(pkey, NULL); if (!pctx) - return 0; + return -1; if (EVP_PKEY_decrypt_init(pctx) <= 0) goto err; @@ -235,12 +235,19 @@ static int pkcs7_decrypt_rinfo(unsigned if (EVP_PKEY_decrypt(pctx, ek, &eklen, ri->enc_key->data, ri->enc_key->length) <= 0) { + ret = 0; PKCS7err(PKCS7_F_PKCS7_DECRYPT_RINFO, ERR_R_EVP_LIB); goto err; } ret = 1; + if (*pek) + { + OPENSSL_cleanse(*pek, *peklen); + OPENSSL_free(*pek); + } + *pek = ek; *peklen = eklen; @@ -500,8 +507,8 @@ BIO *PKCS7_dataDecode(PKCS7 *p7, EVP_PKE int max; X509_OBJECT ret; #endif - unsigned char *ek = NULL; - int eklen; + unsigned char *ek = NULL, *tkey = NULL; + int eklen, tkeylen; if ((etmp=BIO_new(BIO_f_cipher())) == NULL) { @@ -537,26 +544,25 @@ BIO *PKCS7_dataDecode(PKCS7 *p7, EVP_PKE if (pcert == NULL) { + /* Always attempt to decrypt all rinfo even + * after sucess as a defence against MMA timing + * attacks. + */ for (i=0; i<sk_PKCS7_RECIP_INFO_num(rsk); i++) { ri=sk_PKCS7_RECIP_INFO_value(rsk,i); if (pkcs7_decrypt_rinfo(&ek, &eklen, - ri, pkey) > 0) - break; + ri, pkey) < 0) + goto err; ERR_clear_error(); - ri = NULL; - } - if (ri == NULL) - { - PKCS7err(PKCS7_F_PKCS7_DATADECODE, - PKCS7_R_NO_RECIPIENT_MATCHES_KEY); - goto err; } } else { - if (pkcs7_decrypt_rinfo(&ek, &eklen, ri, pkey) <= 0) + /* Only exit on fatal errors, not decrypt failure */ + if (pkcs7_decrypt_rinfo(&ek, &eklen, ri, pkey) < 0) goto err; + ERR_clear_error(); } evp_ctx=NULL; @@ -566,6 +572,20 @@ BIO *PKCS7_dataDecode(PKCS7 *p7, EVP_PKE if (EVP_CIPHER_asn1_to_param(evp_ctx,enc_alg->parameter) < 0) goto err; + /* Generate random key as MMA defence */ + tkeylen = EVP_CIPHER_CTX_key_length(evp_ctx); + tkey = OPENSSL_malloc(tkeylen); + if (!tkey) + goto err; + if (EVP_CIPHER_CTX_rand_key(evp_ctx, tkey) <= 0) + goto err; + if (ek == NULL) + { + ek = tkey; + eklen = tkeylen; + tkey = NULL; + } + if (eklen != EVP_CIPHER_CTX_key_length(evp_ctx)) { /* Some S/MIME clients don't use the same key * and effective key length. The key length is @@ -573,11 +593,16 @@ BIO *PKCS7_dataDecode(PKCS7 *p7, EVP_PKE */ if(!EVP_CIPHER_CTX_set_key_length(evp_ctx, eklen)) { - PKCS7err(PKCS7_F_PKCS7_DATADECODE, - PKCS7_R_DECRYPTED_KEY_IS_WRONG_LENGTH); - goto err; + /* Use random key as MMA defence */ + OPENSSL_cleanse(ek, eklen); + OPENSSL_free(ek); + ek = tkey; + eklen = tkeylen; + tkey = NULL; } } + /* Clear errors so we don't leak information useful in MMA */ + ERR_clear_error(); if (EVP_CipherInit_ex(evp_ctx,NULL,NULL,ek,NULL,0) <= 0) goto err; @@ -587,6 +612,12 @@ BIO *PKCS7_dataDecode(PKCS7 *p7, EVP_PKE OPENSSL_free(ek); } + if (tkey) + { + OPENSSL_cleanse(tkey,tkeylen); + OPENSSL_free(tkey); + } + if (out == NULL) out=etmp; else ++++++ CVE-2012-1165.patch ++++++ Index: openssl-1.0.0g/crypto/asn1/asn_mime.c =================================================================== --- openssl-1.0.0g.orig/crypto/asn1/asn_mime.c +++ openssl-1.0.0g/crypto/asn1/asn_mime.c @@ -858,9 +858,8 @@ static int mime_hdr_addparam(MIME_HEADER static int mime_hdr_cmp(const MIME_HEADER * const *a, const MIME_HEADER * const *b) { - if ((*a)->name == NULL || (*b)->name == NULL) - return (*a)->name - (*b)->name < 0 ? -1 : - (*a)->name - (*b)->name > 0 ? 1 : 0; + if (!(*a)->name || !(*b)->name) + return !!(*a)->name - !!(*b)->name; return(strcmp((*a)->name, (*b)->name)); } @@ -868,6 +867,8 @@ static int mime_hdr_cmp(const MIME_HEADE static int mime_param_cmp(const MIME_PARAM * const *a, const MIME_PARAM * const *b) { + if (!(*a)->param_name || !(*b)->param_name) + return !!(*a)->param_name - !!(*b)->param_name; return(strcmp((*a)->param_name, (*b)->param_name)); } ++++++ ECDSA_signatures_timing_attack.patch ++++++ Index: openssl-1.0.0c/crypto/ecdsa/ecs_ossl.c =================================================================== --- openssl-1.0.0c.orig/crypto/ecdsa/ecs_ossl.c +++ openssl-1.0.0c/crypto/ecdsa/ecs_ossl.c @@ -144,6 +144,16 @@ static int ecdsa_sign_setup(EC_KEY *ecke } while (BN_is_zero(k)); +#ifdef ECDSA_POINT_MUL_NO_CONSTTIME + /* We do not want timing information to leak the length of k, + * so we compute G*k using an equivalent scalar of fixed + * bit-length. */ + + if (!BN_add(k, k, order)) goto err; + if (BN_num_bits(k) <= BN_num_bits(order)) + if (!BN_add(k, k, order)) goto err; +#endif /* def(ECDSA_POINT_MUL_NO_CONSTTIME) */ + /* compute r the x-coordinate of generator * k */ if (!EC_POINT_mul(group, tmp_point, k, NULL, NULL, ctx)) { Index: openssl-1.0.0c/crypto/ocsp/ocsp_lib.c =================================================================== --- openssl-1.0.0c.orig/crypto/ocsp/ocsp_lib.c +++ openssl-1.0.0c/crypto/ocsp/ocsp_lib.c @@ -170,13 +170,14 @@ int OCSP_parse_url(char *url, char **pho char *host, *port; + *phost = NULL; + *pport = NULL; + *ppath = NULL; + /* dup the buffer since we are going to mess with it */ buf = BUF_strdup(url); if (!buf) goto mem_err; - *phost = NULL; - *pport = NULL; - *ppath = NULL; /* Check for initial colon */ p = strchr(buf, ':'); ++++++ README.SuSE ++++++ Please note that the man pages for the openssl libraries and tools have been placed in a package on its own right: openssl-doc Please install the openssl-doc package if you need the man pages, HTML documentation or sample C programs. The C header files and static libraries have also been extracted, they can now be found in the openssl-devel package. Your SuSE Team. ++++++ baselibs.conf ++++++ libopenssl1_0_0 obsoletes "openssl-<targettype> <= <version>" ++++++ bug610223.patch ++++++ Index: openssl-1.0.0/Configure =================================================================== --- openssl-1.0.0.orig/Configure +++ openssl-1.0.0/Configure @@ -1673,7 +1673,8 @@ while (<IN>) } elsif (/^#define\s+ENGINESDIR/) { - my $foo = "$prefix/$libdir/engines"; + #my $foo = "$prefix/$libdir/engines"; + my $foo = "/$libdir/engines"; $foo =~ s/\\/\\\\/g; print OUT "#define ENGINESDIR \"$foo\"\n"; } ++++++ bug749210-Symmetric-crypto-errors-in-PKCS7_decrypt.patch ++++++ Index: openssl-1.0.0g/crypto/pkcs7/pk7_smime.c =================================================================== --- openssl-1.0.0g.orig/crypto/pkcs7/pk7_smime.c +++ openssl-1.0.0g/crypto/pkcs7/pk7_smime.c @@ -573,15 +573,30 @@ int PKCS7_decrypt(PKCS7 *p7, EVP_PKEY *p return 0; } ret = SMIME_text(bread, data); + if (ret > 0 && BIO_method_type(tmpmem) == BIO_TYPE_CIPHER) + { + if (!BIO_get_cipher_status(tmpmem)) + ret = 0; + } BIO_free_all(bread); return ret; } else { for(;;) { i = BIO_read(tmpmem, buf, sizeof(buf)); - if(i <= 0) break; + if(i <= 0) + { + ret = 1; + if (BIO_method_type(tmpmem) == BIO_TYPE_CIPHER) + { + if (!BIO_get_cipher_status(tmpmem)) + ret = 0; + } + + break; + } BIO_write(data, buf, i); } BIO_free_all(tmpmem); - return 1; + return ret; } } ++++++ bug749213-Free-headers-after-use.patch ++++++ Index: openssl-1.0.0g/crypto/asn1/asn_mime.c =================================================================== --- openssl-1.0.0g.orig/crypto/asn1/asn_mime.c +++ openssl-1.0.0g/crypto/asn1/asn_mime.c @@ -486,9 +486,9 @@ ASN1_VALUE *SMIME_read_ASN1(BIO *bio, BI if(strcmp(hdr->value, "application/x-pkcs7-signature") && strcmp(hdr->value, "application/pkcs7-signature")) { - sk_MIME_HEADER_pop_free(headers, mime_hdr_free); ASN1err(ASN1_F_SMIME_READ_ASN1,ASN1_R_SIG_INVALID_MIME_TYPE); ERR_add_error_data(2, "type: ", hdr->value); + sk_MIME_HEADER_pop_free(headers, mime_hdr_free); sk_BIO_pop_free(parts, BIO_vfree); return NULL; } ++++++ bug749735.patch ++++++ Index: openssl-1.0.0c/crypto/asn1/x_pubkey.c =================================================================== --- openssl-1.0.0c.orig/crypto/asn1/x_pubkey.c +++ openssl-1.0.0c/crypto/asn1/x_pubkey.c @@ -171,7 +171,16 @@ EVP_PKEY *X509_PUBKEY_get(X509_PUBKEY *k goto error; } - key->pkey = ret; + /* Check to see if another thread set key->pkey first */ + CRYPTO_w_lock(CRYPTO_LOCK_EVP_PKEY); + if (key->pkey) + { + EVP_PKEY_free(ret); + ret = key->pkey; + } + else + key->pkey = ret; + CRYPTO_w_unlock(CRYPTO_LOCK_EVP_PKEY); CRYPTO_add(&ret->references, 1, CRYPTO_LOCK_EVP_PKEY); return ret; ++++++ merge_from_0.9.8k.patch ++++++ Index: openssl-1.0.0/Configure =================================================================== --- openssl-1.0.0.orig/Configure +++ openssl-1.0.0/Configure @@ -866,7 +866,7 @@ PROCESS_ARGS: } else { - die "target already defined - $target (offending arg: $_)\n" if ($target ne ""); + warn "target already defined - $target (offending arg: $_)\n" if ($target ne ""); $target=$_; } @@ -1105,7 +1105,7 @@ else { $lflags=$prelflags; undef $pre my $no_shared_warn=0; my $no_user_cflags=0; -if ($flags ne "") { $cflags="$flags$cflags"; } +if ($flags ne "") { $cflags="$cflags $flags"; } else { $no_user_cflags=1; } # Kerberos settings. The flavor must be provided from outside, either through Index: openssl-1.0.0/config =================================================================== --- openssl-1.0.0.orig/config +++ openssl-1.0.0/config @@ -560,7 +560,8 @@ case "$GUESSOS" in fi OUT="darwin-i386-cc" ;; alpha-*-linux2) - ISA=`awk '/cpu model/{print$4;exit(0);}' /proc/cpuinfo` + #ISA=`awk '/cpu model/{print$4;exit(0);}' /proc/cpuinfo` + ISA=EV56 case ${ISA:-generic} in *[678]) OUT="linux-alpha+bwx-$CC" ;; *) OUT="linux-alpha-$CC" ;; @@ -580,7 +581,8 @@ case "$GUESSOS" in echo " You have about 5 seconds to press Ctrl-C to abort." (trap "stty `stty -g`" 2 0; stty -icanon min 0 time 50; read waste) <&1 fi - OUT="linux-ppc" + # we have the target and force it here + OUT="linux-ppc64" ;; ppc-*-linux2) OUT="linux-ppc" ;; ia64-*-linux?) OUT="linux-ia64" ;; @@ -596,10 +598,10 @@ case "$GUESSOS" in sparc-*-linux2) KARCH=`awk '/^type/{print$3;exit(0);}' /proc/cpuinfo` case ${KARCH:-sun4} in - sun4u*) OUT="linux-sparcv9" ;; - sun4m) OUT="linux-sparcv8" ;; - sun4d) OUT="linux-sparcv8" ;; - *) OUT="linux-generic32"; options="$options -DB_ENDIAN" ;; +# sun4u*) OUT="linux-sparcv9" ;; +# sun4m) OUT="linux-sparcv8" ;; +# sun4d) OUT="linux-sparcv8" ;; + *) OUT="linux-sparcv8" ;; esac ;; parisc*-*-linux2) # 64-bit builds under parisc64 linux are not supported and @@ -618,7 +620,11 @@ case "$GUESSOS" in # PA8500 -> 8000 (2.0) # PA8600 -> 8000 (2.0) - CPUSCHEDULE=`echo $CPUSCHEDULE|sed -e 's/7300LC/7100LC/' -e 's/8.00/8000/'` + # CPUSCHEDULE=`echo $CPUSCHEDULE|sed -e 's/7300LC/7100LC/' -e 's/8?00/8000/'` + # lets have CPUSCHEDULE for 1.1: + CPUSCHEDULE=7100LC + # we want to support 1.1 CPUs as well: + CPUARCH=1.1 # Finish Model transformations options="$options -DB_ENDIAN -mschedule=$CPUSCHEDULE -march=$CPUARCH" ++++++ openssl-1.0.0-c_rehash-compat.diff ++++++ >From 83f318d68bbdab1ca898c94576a838cc97df4700 Mon Sep 17 00:00:00 2001 From: Ludwig Nussel <ludwig.nussel(a)suse.de> Date: Wed, 21 Apr 2010 15:52:10 +0200 Subject: [PATCH] also create old hash for compatibility --- tools/c_rehash.in | 8 +++++++- 1 files changed, 7 insertions(+), 1 deletions(-) diff --git a/tools/c_rehash.in b/tools/c_rehash.in index bfc4a69..f8d0ce1 100644 --- a/tools/c_rehash.in +++ b/tools/c_rehash.in @@ -83,6 +83,7 @@ sub hash_dir { next; } link_hash_cert($fname) if($cert); + link_hash_cert_old($fname) if($cert); link_hash_crl($fname) if($crl); } } @@ -116,8 +117,9 @@ sub check_file { sub link_hash_cert { my $fname = $_[0]; + my $hashopt = $_[1] || '-subject_hash'; $fname =~ s/'/'\\''/g; - my ($hash, $fprint) = `"$openssl" x509 -hash -fingerprint -noout -in "$fname"`; + my ($hash, $fprint) = `"$openssl" x509 $hashopt -fingerprint -noout -in "$fname"`; chomp $hash; chomp $fprint; $fprint =~ s/^.*=//; @@ -147,6 +149,10 @@ sub link_hash_cert { $hashlist{$hash} = $fprint; } +sub link_hash_cert_old { + link_hash_cert($_[0], '-subject_hash_old'); +} + # Same as above except for a CRL. CRL links are of the form <hash>.r<n> sub link_hash_crl { -- 1.6.4.2 ++++++ openssl-1.0.0b-aesni.patch ++++++ ++++ 2388 lines (skipped) ++++++ openssl.test ++++++ openssl autmatically tests iteslf, no further testing needed -- To unsubscribe, e-mail: opensuse-commit+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-commit+help(a)opensuse.org

1 0

commit cross-x86_64-gcc47-icecream-backend for openSUSE:Factory
by root＠hilbert.suse.de 23 Apr '12

23 Apr '12

Hello community, here is the log from the commit of package cross-x86_64-gcc47-icecream-backend for openSUSE:Factory checked in at 2012-04-23 10:49:30 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/cross-x86_64-gcc47-icecream-backend (Old) and /work/SRC/openSUSE:Factory/.cross-x86_64-gcc47-icecream-backend.new (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Package is "cross-x86_64-gcc47-icecream-backend", Maintainer is "" Changes: -------- New Changes file: NO CHANGES FILE!!! New: ---- _link ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ _link ++++++ <link package="gcc47" cicount="copy" /> -- To unsubscribe, e-mail: opensuse-commit+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-commit+help(a)opensuse.org

1 0

commit wxWidgets-wxcontainer24c for openSUSE:Factory
by root＠hilbert.suse.de 23 Apr '12

23 Apr '12

Hello community, here is the log from the commit of package wxWidgets-wxcontainer24c for openSUSE:Factory checked in at 2012-04-23 10:17:21 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/wxWidgets-wxcontainer24c (Old) and /work/SRC/openSUSE:Factory/.wxWidgets-wxcontainer24c.new (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Package is "wxWidgets-wxcontainer24c", Maintainer is "" Changes: -------- New Changes file: NO CHANGES FILE!!! New: ---- _link ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ _link ++++++ <link package="wxWidgets" cicount="copy" /> -- To unsubscribe, e-mail: opensuse-commit+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-commit+help(a)opensuse.org

1 0

commit u-boot-origen for openSUSE:Factory
by root＠hilbert.suse.de 23 Apr '12

23 Apr '12

Hello community, here is the log from the commit of package u-boot-origen for openSUSE:Factory checked in at 2012-04-23 10:15:44 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/u-boot-origen (Old) and /work/SRC/openSUSE:Factory/.u-boot-origen.new (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Package is "u-boot-origen", Maintainer is "" Changes: -------- New Changes file: NO CHANGES FILE!!! New: ---- _link ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ _link ++++++ <link package="u-boot-omap4panda" cicount="copy" /> -- To unsubscribe, e-mail: opensuse-commit+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-commit+help(a)opensuse.org

1 0

commit u-boot-omap3beagle for openSUSE:Factory
by root＠hilbert.suse.de 23 Apr '12

23 Apr '12

Hello community, here is the log from the commit of package u-boot-omap3beagle for openSUSE:Factory checked in at 2012-04-23 10:15:20 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/u-boot-omap3beagle (Old) and /work/SRC/openSUSE:Factory/.u-boot-omap3beagle.new (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Package is "u-boot-omap3beagle", Maintainer is "" Changes: -------- New Changes file: NO CHANGES FILE!!! New: ---- _link ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ _link ++++++ <link package="u-boot-omap4panda" cicount="copy" /> -- To unsubscribe, e-mail: opensuse-commit+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-commit+help(a)opensuse.org

1 0

commit rubygem-webyast-reboot for openSUSE:Factory
by root＠hilbert.suse.de 23 Apr '12

23 Apr '12

Hello community, here is the log from the commit of package rubygem-webyast-reboot for openSUSE:Factory checked in at 2012-04-23 10:15:03 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/rubygem-webyast-reboot (Old) and /work/SRC/openSUSE:Factory/.rubygem-webyast-reboot.new (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Package is "rubygem-webyast-reboot", Maintainer is "" Changes: -------- New Changes file: NO CHANGES FILE!!! New: ---- _link ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ _link ++++++ <link package="rubygem-webyast-system" cicount="copy" /> -- To unsubscribe, e-mail: opensuse-commit+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-commit+help(a)opensuse.org

1 0

commit python-nose-doc for openSUSE:Factory
by root＠hilbert.suse.de 23 Apr '12

23 Apr '12

Hello community, here is the log from the commit of package python-nose-doc for openSUSE:Factory checked in at 2012-04-23 10:11:27 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/python-nose-doc (Old) and /work/SRC/openSUSE:Factory/.python-nose-doc.new (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Package is "python-nose-doc", Maintainer is "" Changes: -------- New Changes file: NO CHANGES FILE!!! New: ---- _link ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ _link ++++++ <link package="python-nose" cicount="copy" /> -- To unsubscribe, e-mail: opensuse-commit+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-commit+help(a)opensuse.org

1 0