From 1f094f8114a4b7febe8df2ad7bdec387d35a8a21 Mon Sep 17 00:00:00 2001 From: Dirk Meyer Date: Wed, 19 Mar 2003 06:28:03 +0000 Subject: - switch to USE_PERL5_BUILD - add security patch Approved by: kris Obtained from: http://www.openssl.org/news/secadv_20030317.txt --- security/openssl-beta/Makefile | 3 +- security/openssl-beta/files/patch-security | 77 ++++++++++++++++++++++++++++++ 2 files changed, 79 insertions(+), 1 deletion(-) create mode 100644 security/openssl-beta/files/patch-security (limited to 'security/openssl-beta') diff --git a/security/openssl-beta/Makefile b/security/openssl-beta/Makefile index a51c5b8bf24b..66166c5e351e 100644 --- a/security/openssl-beta/Makefile +++ b/security/openssl-beta/Makefile @@ -10,6 +10,7 @@ PORTNAME= openssl PORTREVISION!= date -v-1d +%Y%m%d .else PORTVERSION= 0.9.7a +PORTREVISION= 1 .endif CATEGORIES= security devel .ifdef OPENSSL_SNAPSHOT @@ -37,6 +38,7 @@ COMMENT= SSL and crypto library NOPRECIOUSMAKEVARS= Too many _MLINKS for fetch NO_LATEST_LINK= yes +USE_PERL5_BUILD= yes MAN1= CA.pl.1 asn1parse.1 ca.1 ciphers.1 crl.1 crl2pkcs7.1 dgst.1 dhparam.1 \ dsa.1 dsaparam.1 enc.1 gendsa.1 genrsa.1 nseq.1 ocsp.1 openssl.1 \ @@ -836,7 +838,6 @@ MAKE_ARGS+= WHOLE_ARCHIVE_FLAG=-Bforcearchive MAKE_ARGS+= WHOLE_ARCHIVE_FLAG=--whole-archive .endif -USE_PERL5= yes .if defined(NOSHARED) PLIST_SUB+= SHARED="@comment " .else diff --git a/security/openssl-beta/files/patch-security b/security/openssl-beta/files/patch-security new file mode 100644 index 000000000000..4e3eefb36688 --- /dev/null +++ b/security/openssl-beta/files/patch-security @@ -0,0 +1,77 @@ +Index: crypto/rsa/rsa_eay.c +=================================================================== +RCS file: /e/openssl/cvs/openssl/crypto/rsa/rsa_eay.c,v +retrieving revision 1.28.2.3 +diff -u -r1.28.2.3 rsa_eay.c +--- crypto/rsa/rsa_eay.c 30 Jan 2003 17:37:46 -0000 1.28.2.3 ++++ crypto/rsa/rsa_eay.c 16 Mar 2003 10:34:13 -0000 +@@ -195,6 +195,25 @@ + return(r); + } + ++static int rsa_eay_blinding(RSA *rsa, BN_CTX *ctx) ++ { ++ int ret = 1; ++ CRYPTO_w_lock(CRYPTO_LOCK_RSA); ++ /* Check again inside the lock - the macro's check is racey */ ++ if(rsa->blinding == NULL) ++ ret = RSA_blinding_on(rsa, ctx); ++ CRYPTO_w_unlock(CRYPTO_LOCK_RSA); ++ return ret; ++ } ++ ++#define BLINDING_HELPER(rsa, ctx, err_instr) \ ++ do { \ ++ if(((rsa)->flags & RSA_FLAG_BLINDING) && \ ++ ((rsa)->blinding == NULL) && \ ++ !rsa_eay_blinding(rsa, ctx)) \ ++ err_instr \ ++ } while(0) ++ + /* signing */ + static int RSA_eay_private_encrypt(int flen, const unsigned char *from, + unsigned char *to, RSA *rsa, int padding) +@@ -239,8 +258,8 @@ + goto err; + } + +- if ((rsa->flags & RSA_FLAG_BLINDING) && (rsa->blinding == NULL)) +- RSA_blinding_on(rsa,ctx); ++ BLINDING_HELPER(rsa, ctx, goto err;); ++ + if (rsa->flags & RSA_FLAG_BLINDING) + if (!BN_BLINDING_convert(&f,rsa->blinding,ctx)) goto err; + +@@ -318,8 +337,8 @@ + goto err; + } + +- if ((rsa->flags & RSA_FLAG_BLINDING) && (rsa->blinding == NULL)) +- RSA_blinding_on(rsa,ctx); ++ BLINDING_HELPER(rsa, ctx, goto err;); ++ + if (rsa->flags & RSA_FLAG_BLINDING) + if (!BN_BLINDING_convert(&f,rsa->blinding,ctx)) goto err; + +Index: crypto/rsa/rsa_lib.c +=================================================================== +RCS file: /e/openssl/cvs/openssl/crypto/rsa/rsa_lib.c,v +retrieving revision 1.30.2.2 +diff -u -r1.30.2.2 rsa_lib.c +--- crypto/rsa/rsa_lib.c 30 Jan 2003 17:37:46 -0000 1.30.2.2 ++++ crypto/rsa/rsa_lib.c 16 Mar 2003 10:34:13 -0000 +@@ -72,7 +72,13 @@ + + RSA *RSA_new(void) + { +- return(RSA_new_method(NULL)); ++ RSA *r=RSA_new_method(NULL); ++ ++#ifndef OPENSSL_NO_FORCE_RSA_BLINDING ++ r->flags|=RSA_FLAG_BLINDING; ++#endif ++ ++ return r; + } + + void RSA_set_default_method(const RSA_METHOD *meth) -- cgit v1.2.3