From 09620746b58af6a434003b3b81d6878db551aa30 Mon Sep 17 00:00:00 2001 From: "Alex Xu (Hello71)" Date: Tue, 4 Aug 2020 13:46:05 -0400 Subject: dev-libs/openssl: new package undisable ec_nistp_64_gcc_128, disable bad algorithms --- dev-libs/openssl/files/gentoo.config-1.0.2 | 170 +++++++++++++++++++++ .../openssl/files/openssl-1.0.2a-x32-asm.patch | 43 ++++++ .../openssl-1.1.0j-parallel_install_fix.patch | 21 +++ .../files/openssl-1.1.0k-fix-test_fuzz.patch | 19 +++ .../openssl-1.1.0l-fix-no-ec2m-in-ec_curve.c.patch | 30 ++++ 5 files changed, 283 insertions(+) create mode 100644 dev-libs/openssl/files/gentoo.config-1.0.2 create mode 100644 dev-libs/openssl/files/openssl-1.0.2a-x32-asm.patch create mode 100644 dev-libs/openssl/files/openssl-1.1.0j-parallel_install_fix.patch create mode 100644 dev-libs/openssl/files/openssl-1.1.0k-fix-test_fuzz.patch create mode 100644 dev-libs/openssl/files/openssl-1.1.0l-fix-no-ec2m-in-ec_curve.c.patch (limited to 'dev-libs/openssl/files') diff --git a/dev-libs/openssl/files/gentoo.config-1.0.2 b/dev-libs/openssl/files/gentoo.config-1.0.2 new file mode 100644 index 0000000..4e88dba --- /dev/null +++ b/dev-libs/openssl/files/gentoo.config-1.0.2 @@ -0,0 +1,170 @@ +#!/usr/bin/env bash +# Copyright 1999-2018 Gentoo Foundation +# Distributed under the terms of the GNU General Public License v2 +# +# Openssl doesn't play along nicely with cross-compiling +# like autotools based projects, so let's teach it new tricks. +# +# Review the bundled 'config' script to see why kind of targets +# we can pass to the 'Configure' script. + + +# Testing routines +if [[ $1 == "test" ]] ; then + for c in \ + "arm-gentoo-linux-uclibc |linux-generic32 -DL_ENDIAN" \ + "armv5b-linux-gnu |linux-armv4 -DB_ENDIAN" \ + "x86_64-pc-linux-gnu |linux-x86_64" \ + "alpha-linux-gnu |linux-alpha-gcc" \ + "alphaev56-unknown-linux-gnu |linux-alpha+bwx-gcc" \ + "i686-pc-linux-gnu |linux-elf" \ + "whatever-gentoo-freebsdX.Y |BSD-generic32" \ + "i686-gentoo-freebsdX.Y |BSD-x86-elf" \ + "sparc64-alpha-freebsdX.Y |BSD-sparc64" \ + "ia64-gentoo-freebsd5.99234 |BSD-ia64" \ + "x86_64-gentoo-freebsdX.Y |BSD-x86_64" \ + "hppa64-aldsF-linux-gnu5.3 |linux-generic32 -DB_ENDIAN" \ + "powerpc-gentOO-linux-uclibc |linux-ppc" \ + "powerpc64-unk-linux-gnu |linux-ppc64" \ + "powerpc64le-linux-gnu |linux-ppc64le" \ + "x86_64-apple-darwinX |darwin64-x86_64-cc" \ + "powerpc64-apple-darwinX |darwin64-ppc-cc" \ + "i686-apple-darwinX |darwin-i386-cc" \ + "i386-apple-darwinX |darwin-i386-cc" \ + "powerpc-apple-darwinX |darwin-ppc-cc" \ + "i586-pc-winnt |winnt-parity" \ + "s390-ibm-linux-gnu |linux-generic32 -DB_ENDIAN" \ + "s390x-linux-gnu |linux64-s390x" \ + ;do + CHOST=${c/|*} + ret_want=${c/*|} + ret_got=$(CHOST=${CHOST} "$0") + + if [[ ${ret_want} == "${ret_got}" ]] ; then + echo "PASS: ${CHOST}" + else + echo "FAIL: ${CHOST}" + echo -e "\twanted: ${ret_want}" + echo -e "\twe got: ${ret_got}" + fi + done + exit 0 +fi +[[ -z ${CHOST} && -n $1 ]] && CHOST=$1 + + +# Detect the operating system +case ${CHOST} in + *-aix*) system="aix";; + *-darwin*) system="darwin";; + *-freebsd*) system="BSD";; + *-hpux*) system="hpux";; + *-linux*) system="linux";; + *-solaris*) system="solaris";; + *-winnt*) system="winnt";; + x86_64-*-mingw*) system="mingw64";; + *mingw*) system="mingw";; + *) exit 0;; +esac + + +# Compiler munging +compiler="gcc" +if [[ ${CC} == "ccc" ]] ; then + compiler=${CC} +fi + + +# Detect target arch +machine="" +chost_machine=${CHOST%%-*} +case ${system} in +linux) + case ${chost_machine}:${ABI} in + aarch64*be*) machine="aarch64 -DB_ENDIAN";; + aarch64*) machine="aarch64 -DL_ENDIAN";; + alphaev56*|\ + alphaev[678]*)machine=alpha+bwx-${compiler};; + alpha*) machine=alpha-${compiler};; + armv[4-9]*b*) machine="armv4 -DB_ENDIAN";; + armv[4-9]*) machine="armv4 -DL_ENDIAN";; + arm*b*) machine="generic32 -DB_ENDIAN";; + arm*) machine="generic32 -DL_ENDIAN";; + avr*) machine="generic32 -DL_ENDIAN";; + bfin*) machine="generic32 -DL_ENDIAN";; + # hppa64*) machine=parisc64;; + hppa*) machine="generic32 -DB_ENDIAN";; + i[0-9]86*|\ + x86_64*:x86) machine=elf;; + ia64*) machine=ia64;; + m68*) machine="generic32 -DB_ENDIAN";; + mips*el*) machine="generic32 -DL_ENDIAN";; + mips*) machine="generic32 -DB_ENDIAN";; + powerpc64*le*)machine=ppc64le;; + powerpc64*) machine=ppc64;; + powerpc*le*) machine="generic32 -DL_ENDIAN";; + powerpc*) machine=ppc;; + riscv64*) machine="generic64 -DL_ENDIAN";; + # sh64*) machine=elf;; + sh*b*) machine="generic32 -DB_ENDIAN";; + sh*) machine="generic32 -DL_ENDIAN";; + # TODO: Might want to do -mcpu probing like glibc to determine a + # better default for sparc-linux-gnu targets. This logic will + # break v7 and older systems when they use it. + sparc*v7*) machine="generic32 -DB_ENDIAN";; + sparc64*) machine=sparcv9 system=linux64;; + sparc*v9*) machine=sparcv9;; + sparc*v8*) machine=sparcv8;; + sparc*) machine=sparcv8;; + s390x*) machine=s390x system=linux64;; + s390*) machine="generic32 -DB_ENDIAN";; + x86_64*:x32) machine=x32;; + x86_64*) machine=x86_64;; + esac + ;; +BSD) + case ${chost_machine} in + alpha*) machine=generic64;; + i[6-9]86*) machine=x86-elf;; + ia64*) machine=ia64;; + sparc64*) machine=sparc64;; + x86_64*) machine=x86_64;; + *) machine=generic32;; + esac + ;; +aix) + machine=${compiler} + ;; +darwin) + case ${chost_machine} in + powerpc64) machine=ppc-cc; system=${system}64;; + powerpc) machine=ppc-cc;; + i?86*) machine=i386-cc;; + x86_64) machine=x86_64-cc; system=${system}64;; + esac + ;; +hpux) + case ${chost_machine} in + ia64) machine=ia64-${compiler} ;; + esac + ;; +solaris) + case ${chost_machine} in + i386) machine=x86-${compiler} ;; + x86_64*) machine=x86_64-${compiler}; system=${system}64;; + sparcv9*) machine=sparcv9-${compiler}; system=${system}64;; + sparc*) machine=sparcv8-${compiler};; + esac + ;; +winnt) + machine=parity + ;; +mingw*) + # special case ... no xxx-yyy style name + echo ${system} + ;; +esac + + +# If we have something, show it +[[ -n ${machine} ]] && echo ${system}-${machine} diff --git a/dev-libs/openssl/files/openssl-1.0.2a-x32-asm.patch b/dev-libs/openssl/files/openssl-1.0.2a-x32-asm.patch new file mode 100644 index 0000000..3a005c9 --- /dev/null +++ b/dev-libs/openssl/files/openssl-1.0.2a-x32-asm.patch @@ -0,0 +1,43 @@ +https://rt.openssl.org/Ticket/Display.html?id=3759&user=guest&pass=guest + +From 6257d59b3a68d2feb9d64317a1c556dc3813ee61 Mon Sep 17 00:00:00 2001 +From: Mike Frysinger +Date: Sat, 21 Mar 2015 06:01:25 -0400 +Subject: [PATCH] crypto: use bigint in x86-64 perl + +When building on x32 systems where the default type is 32bit, make sure +we can transparently represent 64bit integers. Otherwise we end up with +build errors like: +/usr/bin/perl asm/ghash-x86_64.pl elf > ghash-x86_64.s +Integer overflow in hexadecimal number at asm/../../perlasm/x86_64-xlate.pl line 201, <> line 890. +... +ghash-x86_64.s: Assembler messages: +ghash-x86_64.s:890: Error: junk '.15473355479995e+19' after expression + +We don't enable this globally as there are some cases where we'd get +32bit values interpreted as unsigned when we need them as signed. + +Reported-by: Bertrand Jacquin +URL: https://bugs.gentoo.org/542618 +--- + crypto/perlasm/x86_64-xlate.pl | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/crypto/perlasm/x86_64-xlate.pl b/crypto/perlasm/x86_64-xlate.pl +index aae8288..0bf9774 100755 +--- a/crypto/perlasm/x86_64-xlate.pl ++++ b/crypto/perlasm/x86_64-xlate.pl +@@ -195,6 +195,10 @@ my %globals; + sub out { + my $self = shift; + ++ # When building on x32 ABIs, the expanded hex value might be too ++ # big to fit into 32bits. Enable transparent 64bit support here ++ # so we can safely print it out. ++ use bigint; + if ($gas) { + # Solaris /usr/ccs/bin/as can't handle multiplications + # in $self->{value} +-- +2.3.3 + diff --git a/dev-libs/openssl/files/openssl-1.1.0j-parallel_install_fix.patch b/dev-libs/openssl/files/openssl-1.1.0j-parallel_install_fix.patch new file mode 100644 index 0000000..c837e20 --- /dev/null +++ b/dev-libs/openssl/files/openssl-1.1.0j-parallel_install_fix.patch @@ -0,0 +1,21 @@ +https://github.com/openssl/openssl/issues/7679 + +--- a/Configurations/unix-Makefile.tmpl ++++ b/Configurations/unix-Makefile.tmpl +@@ -77,8 +77,14 @@ + # to. You're welcome. + sub dependmagic { + my $target = shift; +- +- return "$target: build_generated\n\t\$(MAKE) depend && \$(MAKE) _$target\n_$target"; ++ my $magic = <<"_____"; ++$target: build_generated depend ++ \$(MAKE) _$target ++_$target ++_____ ++ # Remove line ending ++ $magic =~ s|\R$||; ++ return $magic; + } + ''; + -} diff --git a/dev-libs/openssl/files/openssl-1.1.0k-fix-test_fuzz.patch b/dev-libs/openssl/files/openssl-1.1.0k-fix-test_fuzz.patch new file mode 100644 index 0000000..2c4cc31 --- /dev/null +++ b/dev-libs/openssl/files/openssl-1.1.0k-fix-test_fuzz.patch @@ -0,0 +1,19 @@ +Test fuzz was forgotten when + + Perl: Use our own globbing wrapper rather than File::Glob::glob + +was backported to openssl-1.1.0 branch. + +Link: https://github.com/openssl/openssl/commit/b81cfa07ada850fd287d0a0c82ba280907f18ce7 + +--- a/test/recipes/90-test_fuzz.t ++++ b/test/recipes/90-test_fuzz.t +@@ -9,7 +9,7 @@ + use strict; + use warnings; + +-use if $^O ne "VMS", 'File::Glob' => qw/glob/; ++use OpenSSL::Glob; + use OpenSSL::Test qw/:DEFAULT srctop_file/; + use OpenSSL::Test::Utils; + diff --git a/dev-libs/openssl/files/openssl-1.1.0l-fix-no-ec2m-in-ec_curve.c.patch b/dev-libs/openssl/files/openssl-1.1.0l-fix-no-ec2m-in-ec_curve.c.patch new file mode 100644 index 0000000..35a435d --- /dev/null +++ b/dev-libs/openssl/files/openssl-1.1.0l-fix-no-ec2m-in-ec_curve.c.patch @@ -0,0 +1,30 @@ +From bcf6a94c4bc912ad313ea21abdf7e83bbae450e5 Mon Sep 17 00:00:00 2001 +From: Nicola Tuveri +Date: Thu, 12 Sep 2019 01:57:47 +0300 +Subject: [PATCH] Fix no-ec2m in ec_curve.c (1.1.0) + +I made a mistake in d4a5dac9f9242c580fb9d0a4389440eccd3494a7 and +inverted the GF2m and GFp calls in ec_point_get_affine_coordinates, this +fixes it. +--- + crypto/ec/ec_curve.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/crypto/ec/ec_curve.c b/crypto/ec/ec_curve.c +index 2d28d7f70bb..6a58b3a23e0 100644 +--- a/crypto/ec/ec_curve.c ++++ b/crypto/ec/ec_curve.c +@@ -3200,11 +3200,11 @@ int ec_point_get_affine_coordinates(const EC_GROUP *group, + + #ifndef OPENSSL_NO_EC2M + if (field_nid == NID_X9_62_characteristic_two_field) { +- return EC_POINT_get_affine_coordinates_GFp(group, point, x, y, ctx); ++ return EC_POINT_get_affine_coordinates_GF2m(group, point, x, y, ctx); + } else + #endif /* !def(OPENSSL_NO_EC2M) */ + if (field_nid == NID_X9_62_prime_field) { +- return EC_POINT_get_affine_coordinates_GF2m(group, point, x, y, ctx); ++ return EC_POINT_get_affine_coordinates_GFp(group, point, x, y, ctx); + } else { + /* this should never happen */ + return 0; -- cgit v1.2.3-54-g00ecf