[pkgsrc/trunk]: pkgsrc/security/openssl Update to 0.9.6k:

To: pkgsrc-changes-hg%NetBSD.org@localhost
Subject: [pkgsrc/trunk]: pkgsrc/security/openssl Update to 0.9.6k:
From: jschauma <jschauma%pkgsrc.org@localhost>
Date: Wed, 13 Oct 2021 23:03:59 +0000
details:   https://anonhg.NetBSD.org/pkgsrc/rev/41dcae0f16d6
branches:  trunk
changeset: 462405:41dcae0f16d6
user:      jschauma <jschauma%pkgsrc.org@localhost>
date:      Thu Oct 02 02:34:39 2003 +0000

description:
Update to 0.9.6k:

 Changes between 0.9.6j and 0.9.6k  [30 Sep 2003]

  *) Fix various bugs revealed by running the NISCC test suite:

     Stop out of bounds reads in the ASN1 code when presented with
     invalid tags (CAN-2003-0543 and CAN-2003-0544).

     If verify callback ignores invalid public key errors don't try to check
     certificate signature with the NULL public key.

     [Steve Henson]

  *) In ssl3_accept() (ssl/s3_srvr.c) only accept a client certificate
     if the server requested one: as stated in TLS 1.0 and SSL 3.0
     specifications.
     [Steve Henson]

  *) In ssl3_get_client_hello() (ssl/s3_srvr.c), tolerate additional
     extra data after the compression methods not only for TLS 1.0
     but also for SSL 3.0 (as required by the specification).
     [Bodo Moeller; problem pointed out by Matthias Loepfe]

  *) Change X509_certificate_type() to mark the key as exported/exportable
     when it's 512 *bits* long, not 512 bytes.
     [Richard Levitte]

 Changes between 0.9.6i and 0.9.6j  [10 Apr 2003]

  *) Countermeasure against the Klima-Pokorny-Rosa extension of
     Bleichbacher's attack on PKCS #1 v1.5 padding: treat
     a protocol version number mismatch like a decryption error
     in ssl3_get_client_key_exchange (ssl/s3_srvr.c).
     [Bodo Moeller]

  *) Turn on RSA blinding by default in the default implementation
     to avoid a timing attack. Applications that don't want it can call
     RSA_blinding_off() or use the new flag RSA_FLAG_NO_BLINDING.
     They would be ill-advised to do so in most cases.
     [Ben Laurie, Steve Henson, Geoff Thorpe, Bodo Moeller]

  *) Change RSA blinding code so that it works when the PRNG is not
     seeded (in this case, the secret RSA exponent is abused as
     an unpredictable seed -- if it is not unpredictable, there
     is no point in blinding anyway).  Make RSA blinding thread-safe
     by remembering the creator's thread ID in rsa->blinding and
     having all other threads use local one-time blinding factors
     (this requires more computation than sharing rsa->blinding, but
     avoids excessive locking; and if an RSA object is not shared
     between threads, blinding will still be very fast).
     [Bodo Moeller]

 Changes between 0.9.6h and 0.9.6i  [19 Feb 2003]

  *) In ssl3_get_record (ssl/s3_pkt.c), minimize information leaked
     via timing by performing a MAC computation even if incorrrect
     block cipher padding has been found.  This is a countermeasure
     against active attacks where the attacker has to distinguish
     between bad padding and a MAC verification error. (CAN-2003-0078)

     [Bodo Moeller; problem pointed out by Brice Canvel (EPFL),
     Alain Hiltgen (UBS), Serge Vaudenay (EPFL), and
     Martin Vuagnoux (EPFL, Ilion)]

 Changes between 0.9.6g and 0.9.6h  [5 Dec 2002]

  *) New function OPENSSL_cleanse(), which is used to cleanse a section of
     memory from it's contents.  This is done with a counter that will
     place alternating values in each byte.  This can be used to solve
     two issues: 1) the removal of calls to memset() by highly optimizing
     compilers, and 2) cleansing with other values than 0, since those can
     be read through on certain media, for example a swap space on disk.
     [Geoff Thorpe]

  *) Bugfix: client side session caching did not work with external caching,
     because the session->cipher setting was not restored when reloading
     from the external cache. This problem was masked, when
     SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG (part of SSL_OP_ALL) was set.
     (Found by Steve Haslam <steve%araqnid.ddts.net@localhost>.)
     [Lutz Jaenicke]

  *) Fix client_certificate (ssl/s2_clnt.c): The permissible total
     length of the REQUEST-CERTIFICATE message is 18 .. 34, not 17 .. 33.
     [Zeev Lieber <zeev-l%yahoo.com@localhost>]

  *) Undo an undocumented change introduced in 0.9.6e which caused
     repeated calls to OpenSSL_add_all_ciphers() and
     OpenSSL_add_all_digests() to be ignored, even after calling
     EVP_cleanup().
     [Richard Levitte]

  *) Change the default configuration reader to deal with last line not
     being properly terminated.
     [Richard Levitte]

  *) Change X509_NAME_cmp() so it applies the special rules on handling
     DN values that are of type PrintableString, as well as RDNs of type
     emailAddress where the value has the type ia5String.
     [stefank%valicert.com@localhost via Richard Levitte]

  *) Add a SSL_SESS_CACHE_NO_INTERNAL_STORE flag to take over half
     the job SSL_SESS_CACHE_NO_INTERNAL_LOOKUP was inconsistently
     doing, define a new flag (SSL_SESS_CACHE_NO_INTERNAL) to be
     the bitwise-OR of the two for use by the majority of applications
     wanting this behaviour, and update the docs. The documented
     behaviour and actual behaviour were inconsistent and had been
     changing anyway, so this is more a bug-fix than a behavioural
     change.
     [Geoff Thorpe, diagnosed by Nadav Har'El]

  *) Don't impose a 16-byte length minimum on session IDs in ssl/s3_clnt.c
     (the SSL 3.0 and TLS 1.0 specifications allow any length up to 32 bytes).
     [Bodo Moeller]

  *) Fix initialization code race conditions in
        SSLv23_method(),  SSLv23_client_method(),   SSLv23_server_method(),
        SSLv2_method(),   SSLv2_client_method(),    SSLv2_server_method(),
        SSLv3_method(),   SSLv3_client_method(),    SSLv3_server_method(),
        TLSv1_method(),   TLSv1_client_method(),    TLSv1_server_method(),
        ssl2_get_cipher_by_char(),
        ssl3_get_cipher_by_char().
     [Patrick McCormick <patrick%tellme.com@localhost>, Bodo Moeller]

  *) Reorder cleanup sequence in SSL_CTX_free(): only remove the ex_data after
     the cached sessions are flushed, as the remove_cb() might use ex_data
     contents. Bug found by Sam Varshavchik <mrsam%courier-mta.com@localhost>
     (see [openssl.org #212]).
     [Geoff Thorpe, Lutz Jaenicke]

  *) Fix typo in OBJ_txt2obj which incorrectly passed the content
     length, instead of the encoding length to d2i_ASN1_OBJECT.
     [Steve Henson]

diffstat:

 security/openssl/Makefile         |    5 +-
 security/openssl/PLIST.darwin     |    6 +-
 security/openssl/PLIST.freebsd    |    6 +-
 security/openssl/PLIST.irix       |    6 +-
 security/openssl/PLIST.netbsd     |    6 +-
 security/openssl/PLIST.solaris    |    6 +-
 security/openssl/distinfo         |   15 ++---
 security/openssl/patches/patch-ab |    4 +-
 security/openssl/patches/patch-ac |   41 +++++++-------
 security/openssl/patches/patch-ag |  101 --------------------------------------
 security/openssl/patches/patch-ah |   55 --------------------
 security/openssl/patches/patch-ai |   52 -------------------
 security/openssl/patches/patch-aj |   18 ++----
 13 files changed, 52 insertions(+), 269 deletions(-)

diffs (truncated from 444 to 300 lines):

diff -r ec9881da06f3 -r 41dcae0f16d6 security/openssl/Makefile
--- a/security/openssl/Makefile Thu Oct 02 01:16:40 2003 +0000
+++ b/security/openssl/Makefile Thu Oct 02 02:34:39 2003 +0000
@@ -1,7 +1,6 @@
-# $NetBSD: Makefile,v 1.80 2003/09/22 03:15:33 grant Exp $
+# $NetBSD: Makefile,v 1.81 2003/10/02 02:34:39 jschauma Exp $
 
-DISTNAME=              openssl-0.9.6g
-PKGREVISION=           2
+DISTNAME=              openssl-0.9.6k
 SVR4_PKGNAME=          ossl
 CATEGORIES=            security
 MASTER_SITES=          ftp://ftp.openssl.org/source/
diff -r ec9881da06f3 -r 41dcae0f16d6 security/openssl/PLIST.darwin
--- a/security/openssl/PLIST.darwin     Thu Oct 02 01:16:40 2003 +0000
+++ b/security/openssl/PLIST.darwin     Thu Oct 02 02:34:39 2003 +0000
@@ -1,7 +1,7 @@
-@comment $NetBSD: PLIST.darwin,v 1.3 2002/08/25 19:23:17 jlam Exp $
-lib/libcrypto.300.0.dylib
+@comment $NetBSD: PLIST.darwin,v 1.4 2003/10/02 02:34:39 jschauma Exp $
+lib/libcrypto.300.1.dylib
 lib/libcrypto.300.dylib
 lib/libcrypto.dylib
-lib/libssl.300.0.dylib
+lib/libssl.300.1.dylib
 lib/libssl.300.dylib
 lib/libssl.dylib
diff -r ec9881da06f3 -r 41dcae0f16d6 security/openssl/PLIST.freebsd
--- a/security/openssl/PLIST.freebsd    Thu Oct 02 01:16:40 2003 +0000
+++ b/security/openssl/PLIST.freebsd    Thu Oct 02 02:34:39 2003 +0000
@@ -1,7 +1,7 @@
-@comment $NetBSD: PLIST.freebsd,v 1.1 2003/05/14 12:07:45 wiz Exp $
+@comment $NetBSD: PLIST.freebsd,v 1.2 2003/10/02 02:34:39 jschauma Exp $
 lib/libcrypto.so
 lib/libcrypto.so.300
-lib/libcrypto.so.300.0
+lib/libcrypto.so.300.1
 lib/libssl.so
 lib/libssl.so.300
-lib/libssl.so.300.0
+lib/libssl.so.300.1
diff -r ec9881da06f3 -r 41dcae0f16d6 security/openssl/PLIST.irix
--- a/security/openssl/PLIST.irix       Thu Oct 02 01:16:40 2003 +0000
+++ b/security/openssl/PLIST.irix       Thu Oct 02 02:34:39 2003 +0000
@@ -1,7 +1,7 @@
-@comment $NetBSD: PLIST.irix,v 1.1 2003/06/10 18:02:26 jschauma Exp $
+@comment $NetBSD: PLIST.irix,v 1.2 2003/10/02 02:34:39 jschauma Exp $
 lib/libcrypto.so
 lib/libcrypto.so.300
-lib/libcrypto.so.300.0
+lib/libcrypto.so.300.1
 lib/libssl.so
 lib/libssl.so.300
-lib/libssl.so.300.0
+lib/libssl.so.300.1
diff -r ec9881da06f3 -r 41dcae0f16d6 security/openssl/PLIST.netbsd
--- a/security/openssl/PLIST.netbsd     Thu Oct 02 01:16:40 2003 +0000
+++ b/security/openssl/PLIST.netbsd     Thu Oct 02 02:34:39 2003 +0000
@@ -1,7 +1,7 @@
-@comment $NetBSD: PLIST.netbsd,v 1.3 2002/08/25 19:23:17 jlam Exp $
+@comment $NetBSD: PLIST.netbsd,v 1.4 2003/10/02 02:34:39 jschauma Exp $
 lib/libcrypto.so
 lib/libcrypto.so.300
-lib/libcrypto.so.300.0
+lib/libcrypto.so.300.1
 lib/libssl.so
 lib/libssl.so.300
-lib/libssl.so.300.0
+lib/libssl.so.300.1
diff -r ec9881da06f3 -r 41dcae0f16d6 security/openssl/PLIST.solaris
--- a/security/openssl/PLIST.solaris    Thu Oct 02 01:16:40 2003 +0000
+++ b/security/openssl/PLIST.solaris    Thu Oct 02 02:34:39 2003 +0000
@@ -1,7 +1,7 @@
-@comment $NetBSD: PLIST.solaris,v 1.2 2002/09/09 22:17:00 markd Exp $
+@comment $NetBSD: PLIST.solaris,v 1.3 2003/10/02 02:34:39 jschauma Exp $
 lib/libcrypto.so
 lib/libcrypto.so.300
-lib/libcrypto.so.300.0
+lib/libcrypto.so.300.1
 lib/libssl.so
 lib/libssl.so.300
-lib/libssl.so.300.0
+lib/libssl.so.300.1
diff -r ec9881da06f3 -r 41dcae0f16d6 security/openssl/distinfo
--- a/security/openssl/distinfo Thu Oct 02 01:16:40 2003 +0000
+++ b/security/openssl/distinfo Thu Oct 02 02:34:39 2003 +0000
@@ -1,16 +1,13 @@
-$NetBSD: distinfo,v 1.21 2003/09/10 16:05:09 jlam Exp $
+$NetBSD: distinfo,v 1.22 2003/10/02 02:34:39 jschauma Exp $
 
-SHA1 (openssl-0.9.6g.tar.gz) = 5b3cdad1d33134c97f659a8ad5dbf4ca4cf3d9c8
-Size (openssl-0.9.6g.tar.gz) = 2170570 bytes
+SHA1 (openssl-0.9.6k.tar.gz) = 34e051c5b6074c285ac3abeee4bc9440cfc262e7
+Size (openssl-0.9.6k.tar.gz) = 2183608 bytes
 SHA1 (openssl-0.9.6g-20020810-netbsd.patch.gz) = 37cf5db32ba045b8a23af71ea95ab2f90b886e46
 Size (openssl-0.9.6g-20020810-netbsd.patch.gz) = 27608 bytes
 SHA1 (patch-aa) = c4766edba4704374ae67d75c2f9454bc70782eea
-SHA1 (patch-ab) = 9bdac032996bd97834b00cb661f79c00dc31bac1
-SHA1 (patch-ac) = 3d8fcb927da1dcf51a87b5c0cd89fadccafe0955
+SHA1 (patch-ab) = cfbcaa52bec88987b8a63725b84adfd58b324032
+SHA1 (patch-ac) = de5e5c062767c6595ec8f68f5ab0cc861e0b51a2
 SHA1 (patch-ad) = 950d57633fcb494564641f9b7e6385b96912c05d
 SHA1 (patch-ae) = f4bf6ae5aa41b55d9978376e4e50ee10c10dd288
 SHA1 (patch-af) = 25481e491acd7c2e3cd9587fe038a37e41071a24
-SHA1 (patch-ag) = d470c7da2cff7ba37ac38d6ceb79751a7d21d432
-SHA1 (patch-ah) = f8a6522c5e00605c47e149f8c70878960257c65a
-SHA1 (patch-ai) = 9d2e1dae0882450b7c10cdd2ea8156dced550c4a
-SHA1 (patch-aj) = 8c71a29e8f2cbbe9c105f9bec27f4dc1835f5338
+SHA1 (patch-aj) = e300ae91c19214faf3419e7499214a1b536aac18
diff -r ec9881da06f3 -r 41dcae0f16d6 security/openssl/patches/patch-ab
--- a/security/openssl/patches/patch-ab Thu Oct 02 01:16:40 2003 +0000
+++ b/security/openssl/patches/patch-ab Thu Oct 02 02:34:39 2003 +0000
@@ -1,4 +1,4 @@
-$NetBSD: patch-ab,v 1.9 2002/08/25 19:23:18 jlam Exp $
+$NetBSD: patch-ab,v 1.10 2003/10/02 02:34:40 jschauma Exp $
 
 --- crypto/opensslv.h.orig     Tue Jul 30 05:34:28 2002
 +++ crypto/opensslv.h
@@ -7,7 +7,7 @@
   */
  #define SHLIB_VERSION_HISTORY ""
 -#define SHLIB_VERSION_NUMBER "0.9.6"
-+#define SHLIB_VERSION_NUMBER "300.0"
++#define SHLIB_VERSION_NUMBER "300.1"
  
  
  #endif /* HEADER_OPENSSLV_H */
diff -r ec9881da06f3 -r 41dcae0f16d6 security/openssl/patches/patch-ac
--- a/security/openssl/patches/patch-ac Thu Oct 02 01:16:40 2003 +0000
+++ b/security/openssl/patches/patch-ac Thu Oct 02 02:34:39 2003 +0000
@@ -1,7 +1,7 @@
-$NetBSD: patch-ac,v 1.13 2003/09/10 16:05:10 jlam Exp $
+$NetBSD: patch-ac,v 1.14 2003/10/02 02:34:40 jschauma Exp $
 
---- Configure.orig     Wed Sep 10 11:47:42 2003
-+++ Configure  Wed Sep 10 11:56:17 2003
+--- Configure.orig     2002-11-15 05:28:38.000000000 -0500
++++ Configure  2003-10-01 21:41:19.000000000 -0400
 @@ -129,55 +129,6 @@
  "gcc",                "gcc:-O3::(unknown)::BN_LLONG:::",
  "cc",         "cc:-O::(unknown):::::",
@@ -89,23 +89,23 @@
  "FreeBSD-elf",  "gcc:-DTERMIOS -DL_ENDIAN -fomit-frame-pointer -O3 -m486 -Wall::-pthread -D_REENTRANT -D_THREAD_SAFE -D_THREADSAFE::BN_LLONG ${x86_gcc_des} 
${x86_gcc_opts}:${x86_elf_asm}:dlfcn:bsd-gcc-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
  "FreeBSD",      "gcc:-DTERMIOS -DL_ENDIAN -fomit-frame-pointer -O3 -m486 -Wall::(unknown)::BN_LLONG ${x86_gcc_des} ${x86_gcc_opts}:${x86_out_asm}",
  "bsdi-gcc",     "gcc:-O3 -ffast-math -DL_ENDIAN -DPERL5 -m486::(unknown)::RSA_LLONG ${x86_gcc_des} ${x86_gcc_opts}:${x86_bsdi_asm}",
-@@ -501,6 +435,89 @@
- ##### VxWorks for various targets
- "vxworks-ppc405","ccppc:-g -msoft-float -mlongcall -DVXWORKS -DCPU=PPC405 -I\$(WIND_BASE)/target/h:::-r:::::",
+@@ -507,6 +441,88 @@
+ ##### Compaq Non-Stop Kernel (Tandem)
+ "tandem-c89","c89:-Ww -D__TANDEM -D_XOPEN_SOURCE -D_XOPEN_SOURCE_EXTENDED=1 -D_TANDEM_SOURCE -DB_ENDIAN::(unknown)::THIRTY_TWO_BIT:::",
  
-+##### NetBSD
-+"NetBSD-alpha", "gcc:-DTERMIOS -O2 -Wall::(unknown):-Wl,-R\$(INSTALLTOP)/lib:SIXTY_FOUR_BIT_LONG DES_INT DES_PTR DES_RISC2::::::::::dlfcn:bsd-gcc-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
-+"NetBSD-arm32", "gcc:-DTERMIOS -O2 -Wall -DL_ENDIAN::(unknown):-Wl,-R\$(INSTALLTOP)/lib:BN_LLONG MD2_CHAR RC4_INDEX 
DES_UNROLL::::::::::dlfcn:bsd-gcc-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
-+"NetBSD-m68000", "gcc:-DTERMIOS -O2 -Wall -DB_ENDIAN::(unknown):-Wl,-R\$(INSTALLTOP)/lib:BN_LLONG MD2_CHAR RC4_INDEX::::::::::dlfcn:bsd-gcc-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
-+"NetBSD-m68k",        "gcc:-DTERMIOS -O2 -m68020-40 -Wall -DB_ENDIAN::(unknown):-Wl,-R\$(INSTALLTOP)/lib:BN_LLONG MD2_CHAR 
RC4_INDEX::::::::::dlfcn:bsd-gcc-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
-+"NetBSD-mipseb", "gcc:-DTERMIOS -O2 -Wall -DB_ENDIAN::(unknown):-Wl,-R\$(INSTALLTOP)/lib:BN_LLONG MD2_CHAR RC4_INDEX 
DES_UNROLL::::::::::dlfcn:bsd-gcc-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
-+"NetBSD-mipsel", "gcc:-DTERMIOS -O2 -Wall -DL_ENDIAN::(unknown):-Wl,-R\$(INSTALLTOP)/lib:BN_LLONG MD2_CHAR RC4_INDEX 
DES_UNROLL::::::::::dlfcn:bsd-gcc-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
-+"NetBSD-ns32k", "gcc:-DTERMIOS -O2 -Wall -DL_ENDIAN::(unknown):-Wl,-R\$(INSTALLTOP)/lib:BN_LLONG MD2_CHAR RC4_INDEX 
DES_UNROLL::::::::::dlfcn:bsd-gcc-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
-+"NetBSD-powerpc", "gcc:-DTERMIOS -O2 -Wall -DB_ENDIAN::(unknown):-Wl,-R\$(INSTALLTOP)/lib:BN_LLONG MD2_CHAR RC4_INDEX 
DES_UNROLL::::::::::dlfcn:bsd-gcc-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
-+"NetBSD-sparc",       "gcc:-DTERMIOS -O2 -Wall -DB_ENDIAN::(unknown):-Wl,-R\$(INSTALLTOP)/lib:BN_LLONG MD2_CHAR RC4_INDEX 
DES_UNROLL::::::::::dlfcn:bsd-gcc-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
-+"NetBSD-sparc64", "gcc:-DTERMIOS -O2 -Wall::(unknown):-Wl,-R\$(INSTALLTOP)/lib:SIXTY_FOUR_BIT_LONG DES_INT DES_RISC1::::::::::dlfcn:bsd-gcc-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
-+"NetBSD-vax", "gcc:-DTERMIOS -O2 -Wall -DL_ENDIAN::(unknown):-Wl,-R\$(INSTALLTOP)/lib:BN_LLONG MD2_CHAR RC4_INDEX 
DES_UNROLL::::::::::dlfcn:bsd-gcc-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
-+"NetBSD-x86", "gcc:-DTERMIOS -O2 -Wall::(unknown):-Wl,-R\$(INSTALLTOP)/lib:BN_LLONG ${x86_gcc_des} ${x86_gcc_opts}::::::::::dlfcn:bsd-gcc-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
++ ##### NetBSD
++ "NetBSD-alpha", "gcc:-DTERMIOS -O2 -Wall::(unknown):-Wl,-R\$(INSTALLTOP)/lib:SIXTY_FOUR_BIT_LONG DES_INT DES_PTR DES_RISC2::::::::::dlfcn:bsd-gcc-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
++ "NetBSD-arm32", "gcc:-DTERMIOS -O2 -Wall -DL_ENDIAN::(unknown):-Wl,-R\$(INSTALLTOP)/lib:BN_LLONG MD2_CHAR RC4_INDEX 
DES_UNROLL::::::::::dlfcn:bsd-gcc-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
++ "NetBSD-m68000", "gcc:-DTERMIOS -O2 -Wall -DB_ENDIAN::(unknown):-Wl,-R\$(INSTALLTOP)/lib:BN_LLONG MD2_CHAR RC4_INDEX::::::::::dlfcn:bsd-gcc-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
++ "NetBSD-m68k",       "gcc:-DTERMIOS -O2 -m68020-40 -Wall -DB_ENDIAN::(unknown):-Wl,-R\$(INSTALLTOP)/lib:BN_LLONG MD2_CHAR 
RC4_INDEX::::::::::dlfcn:bsd-gcc-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
++ "NetBSD-mipseb", "gcc:-DTERMIOS -O2 -Wall -DB_ENDIAN::(unknown):-Wl,-R\$(INSTALLTOP)/lib:BN_LLONG MD2_CHAR RC4_INDEX 
DES_UNROLL::::::::::dlfcn:bsd-gcc-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
++ "NetBSD-mipsel", "gcc:-DTERMIOS -O2 -Wall -DL_ENDIAN::(unknown):-Wl,-R\$(INSTALLTOP)/lib:BN_LLONG MD2_CHAR RC4_INDEX 
DES_UNROLL::::::::::dlfcn:bsd-gcc-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
++ "NetBSD-ns32k", "gcc:-DTERMIOS -O2 -Wall -DL_ENDIAN::(unknown):-Wl,-R\$(INSTALLTOP)/lib:BN_LLONG MD2_CHAR RC4_INDEX 
DES_UNROLL::::::::::dlfcn:bsd-gcc-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
++ "NetBSD-powerpc", "gcc:-DTERMIOS -O2 -Wall -DB_ENDIAN::(unknown):-Wl,-R\$(INSTALLTOP)/lib:BN_LLONG MD2_CHAR RC4_INDEX 
DES_UNROLL::::::::::dlfcn:bsd-gcc-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
++ "NetBSD-sparc",      "gcc:-DTERMIOS -O2 -Wall -DB_ENDIAN::(unknown):-Wl,-R\$(INSTALLTOP)/lib:BN_LLONG MD2_CHAR RC4_INDEX 
DES_UNROLL::::::::::dlfcn:bsd-gcc-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
++ "NetBSD-sparc64", "gcc:-DTERMIOS -O2 -Wall::(unknown):-Wl,-R\$(INSTALLTOP)/lib:SIXTY_FOUR_BIT_LONG DES_INT DES_RISC1::::::::::dlfcn:bsd-gcc-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
++ "NetBSD-vax", "gcc:-DTERMIOS -O2 -Wall -DL_ENDIAN::(unknown):-Wl,-R\$(INSTALLTOP)/lib:BN_LLONG MD2_CHAR RC4_INDEX 
DES_UNROLL::::::::::dlfcn:bsd-gcc-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
++ "NetBSD-x86",        "gcc:-DTERMIOS -O2 -Wall::(unknown):-Wl,-R\$(INSTALLTOP)/lib:BN_LLONG ${x86_gcc_des} ${x86_gcc_opts}::::::::::dlfcn:bsd-gcc-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
 +
 +##### Solaris (pkgsrc)
 +
@@ -175,11 +175,10 @@
 +"linux-s390x", "gcc:-DB_ENDIAN -DTERMIO -DNO_ASM -O3 -fomit-frame-pointer -Wall::-D_REENTRANT:-Wl,-R\$(INSTALLTOP)/lib 
-ldl:SIXTY_FOUR_BIT_LONG::::::::::dlfcn:linux-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
 +"linux-ia64",   "gcc:-DL_ENDIAN -DTERMIO -O3 -fomit-frame-pointer -Wall::-D_REENTRANT:-ldl:SIXTY_FOUR_BIT_LONG RC4_CHUNK 
RC4_CHAR:asm/ia64.o:::::::::dlfcn:linux-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
 +
-+
  );
  
  my @WinTargets=qw(VC-NT VC-WIN32 VC-WIN16 VC-W31-16 VC-W31-32 VC-MSDOS BC-32
-@@ -673,7 +690,7 @@
+@@ -680,7 +696,7 @@
                        }
                elsif (/^[-+]/)
                        {
diff -r ec9881da06f3 -r 41dcae0f16d6 security/openssl/patches/patch-ag
--- a/security/openssl/patches/patch-ag Thu Oct 02 01:16:40 2003 +0000
+++ /dev/null   Thu Jan 01 00:00:00 1970 +0000
@@ -1,101 +0,0 @@
-$NetBSD: patch-ag,v 1.8 2003/02/20 07:59:26 wiz Exp $
-
---- ssl/s3_pkt.c.orig  Fri May 10 01:07:45 2002
-+++ ssl/s3_pkt.c
-@@ -238,6 +238,8 @@ static int ssl3_get_record(SSL *s)
-       unsigned int mac_size;
-       int clear=0;
-       size_t extra;
-+      int decryption_failed_or_bad_record_mac = 0;
-+      unsigned char *mac = NULL;
- 
-       rr= &(s->s3->rrec);
-       sess=s->session;
-@@ -353,8 +355,11 @@ again:
-                       /* SSLerr() and ssl3_send_alert() have been called */
-                       goto err;
- 
--              /* otherwise enc_err == -1 */
--              goto decryption_failed_or_bad_record_mac;
-+              /* Otherwise enc_err == -1, which indicates bad padding
-+               * (rec->length has not been changed in this case).
-+               * To minimize information leaked via timing, we will perform
-+               * the MAC computation anyway. */
-+              decryption_failed_or_bad_record_mac = 1;
-               }
- 
- #ifdef TLS_DEBUG
-@@ -380,28 +385,46 @@ printf("\n");
-                       SSLerr(SSL_F_SSL3_GET_RECORD,SSL_R_PRE_MAC_LENGTH_TOO_LONG);
-                       goto f_err;
- #else
--                      goto decryption_failed_or_bad_record_mac;
-+                      decryption_failed_or_bad_record_mac = 1;
- #endif                        
-                       }
-               /* check the MAC for rr->input (it's in mac_size bytes at the tail) */
--              if (rr->length < mac_size)
-+              if (rr->length >= mac_size)
-                       {
-+                      rr->length -= mac_size;
-+                      mac = &rr->data[rr->length];
-+                      }
-+              else
-+                      {
-+                      /* record (minus padding) is too short to contain a MAC */
- #if 0 /* OK only for stream ciphers */
-                       al=SSL_AD_DECODE_ERROR;
-                       SSLerr(SSL_F_SSL3_GET_RECORD,SSL_R_LENGTH_TOO_SHORT);
-                       goto f_err;
- #else
--                      goto decryption_failed_or_bad_record_mac;
-+                      decryption_failed_or_bad_record_mac = 1;
-+                      rr->length = 0;
- #endif
-                       }
--              rr->length-=mac_size;
-               i=s->method->ssl3_enc->mac(s,md,0);
--              if (memcmp(md,&(rr->data[rr->length]),mac_size) != 0)
-+              if (mac == NULL || memcmp(md, mac, mac_size) != 0)
-                       {
--                      goto decryption_failed_or_bad_record_mac;
-+                      decryption_failed_or_bad_record_mac = 1;
-                       }
-               }
- 
-+      if (decryption_failed_or_bad_record_mac)
-+              {
-+              /* A separate 'decryption_failed' alert was introduced with TLS 1.0,
-+               * SSL 3.0 only has 'bad_record_mac'.  But unless a decryption
-+               * failure is directly visible from the ciphertext anyway,
-+               * we should not reveal which kind of error occured -- this
-+               * might become visible to an attacker (e.g. via a logfile) */
-+              al=SSL_AD_BAD_RECORD_MAC;
-+              SSLerr(SSL_F_SSL3_GET_RECORD,SSL_R_DECRYPTION_FAILED_OR_BAD_RECORD_MAC);
-+              goto f_err;
-+              }
-+
-       /* r->length is now just compressed */
-       if (s->expand != NULL)
-               {
-@@ -443,19 +466,12 @@ printf("\n");
- 
-       return(1);
- 
--decryption_failed_or_bad_record_mac:
--      /* Separate 'decryption_failed' alert was introduced with TLS 1.0,
--       * SSL 3.0 only has 'bad_record_mac'.  But unless a decryption
--       * failure is directly visible from the ciphertext anyway,
--       * we should not reveal which kind of error occured -- this
--       * might become visible to an attacker (e.g. via logfile) */
--      al=SSL_AD_BAD_RECORD_MAC;
--      SSLerr(SSL_F_SSL3_GET_RECORD,SSL_R_DECRYPTION_FAILED_OR_BAD_RECORD_MAC);
- f_err:
-       ssl3_send_alert(s,SSL3_AL_FATAL,al);
- err:
-       return(ret);
-       }
-+const char *CAN_2003_0078_patch_ID="CAN-2003-0078 patch 2003-02-19";
- 
- static int do_uncompress(SSL *ssl)
-       {
diff -r ec9881da06f3 -r 41dcae0f16d6 security/openssl/patches/patch-ah
Prev by Date: [pkgsrc/trunk]: pkgsrc/net/tspc Upgrade to version 1.0... I'd list all the c...
Next by Date: [pkgsrc/trunk]: pkgsrc/sysutils/xfce4-netload-plugin Updated xfce4-netload-pl...
Previous by Thread: [pkgsrc/trunk]: pkgsrc/net/tspc Upgrade to version 1.0... I'd list all the c...
Next by Thread: [pkgsrc/trunk]: pkgsrc/sysutils/xfce4-netload-plugin Updated xfce4-netload-pl...
Indexes:
Home | Main Index | Thread Index | Old Index