9:16 a.m.
Author: mladen.turk(a)jboss.com
Date: 2013-02-08 03:16:11 -0500 (Fri, 08 Feb 2013)
New Revision: 3060
Added:
trunk/build/patch/openssl-1.0.1d.patch
Modified:
trunk/build/unix/build.sh
trunk/build/unix/package.list
Log:
Fix and update openssl to 1.0.1d
Added: trunk/build/patch/openssl-1.0.1d.patch
===================================================================
--- trunk/build/patch/openssl-1.0.1d.patch (rev 0)
+++ trunk/build/patch/openssl-1.0.1d.patch 2013-02-08 08:16:11 UTC (rev 3060)
@@ -0,0 +1,83 @@
+--- util/pl/VC-32.pl
++++ util/pl/VC-32.pl
+@@ -43,7 +43,7 @@
+ # considered safe to ignore.
+ #
+ $base_cflags= " $mf_cflag";
+- my $f = $shlib || $fips ?' /MD':' /MT';
++ my $f = ' /MD';
+ $lib_cflag='/Zl' if (!$shlib); # remove /DEFAULTLIBs from static lib
+ $opt_cflags=$f.' /Ox';
+ $dbg_cflags=$f.'d /Od -DDEBUG -D_DEBUG';
+@@ -124,7 +124,7 @@
+ else # Win32
+ {
+ $base_cflags= " $mf_cflag";
+- my $f = $shlib || $fips ?' /MD':' /MT';
++ my $f = ' /MD';
+ $lib_cflag='/Zl' if (!$shlib); # remove /DEFAULTLIBs from static lib
+ $opt_cflags=$f.' /Ox /O2 /Ob2';
+ $dbg_cflags=$f.'d /Od -DDEBUG -D_DEBUG';
+@@ -175,6 +175,7 @@
+ {
+ $ex_libs.=' gdi32.lib advapi32.lib crypt32.lib user32.lib';
+ $ex_libs.=' bufferoverflowu.lib' if ($FLAVOR =~ /WIN64/ and `cl 2>&1` =~
/14\.00\.4[0-9]{4}\./);
++ $ex_libs.=' $(EXTRA_LIBS)';
+ # WIN32 UNICODE build gets linked with unicows.lib for
+ # backward compatibility with Win9x.
+ $ex_libs="unicows.lib $ex_libs" if ($FLAVOR =~ /WIN32/ and $cflags =~
/\-DUNICODE/);
+--- ssl/s3_cbc.c
++++ ssl/s3_cbc.c
+@@ -139,31 +139,22 @@ int tls1_cbc_remove_padding(const SSL* s,
+ unsigned mac_size)
+ {
+ unsigned padding_length, good, to_check, i;
+- const char has_explicit_iv =
+- s->version >= TLS1_1_VERSION || s->version == DTLS1_VERSION;
+- const unsigned overhead = 1 /* padding length byte */ +
+- mac_size +
+- (has_explicit_iv ? block_size : 0);
+-
+- /* These lengths are all public so we can test them in non-constant
+- * time. */
+- if (overhead > rec->length)
+- return 0;
+-
+- /* We can always safely skip the explicit IV. We check at the beginning
+- * of this function that the record has at least enough space for the
+- * IV, MAC and padding length byte. (These can be checked in
+- * non-constant time because it's all public information.) So, if the
+- * padding was invalid, then we didn't change |rec->length| and this is
+- * safe. If the padding was valid then we know that we have at least
+- * overhead+padding_length bytes of space and so this is still safe
+- * because overhead accounts for the explicit IV. */
+- if (has_explicit_iv)
++ const unsigned overhead = 1 /* padding length byte */ + mac_size;
++ /* Check if version requires explicit IV */
++ if (s->version >= TLS1_1_VERSION || s->version == DTLS1_VERSION)
+ {
++ /* These lengths are all public so we can test them in
++ * non-constant time.
++ */
++ if (overhead + block_size > rec->length)
++ return 0;
++ /* We can now safely skip explicit IV */
+ rec->data += block_size;
+ rec->input += block_size;
+ rec->length -= block_size;
+ }
++ else if (overhead > rec->length)
++ return 0;
+
+ padding_length = rec->data[rec->length-1];
+
+@@ -190,7 +181,7 @@ int tls1_cbc_remove_padding(const SSL* s,
+ if (EVP_CIPHER_flags(s->enc_read_ctx->cipher)&EVP_CIPH_FLAG_AEAD_CIPHER)
+ {
+ /* padding is already verified */
+- rec->length -= padding_length;
++ rec->length -= padding_length + 1;
+ return 1;
+ }
+
+
Property changes on: trunk/build/patch/openssl-1.0.1d.patch
___________________________________________________________________
Added: svn:eol-style
+ LF
Modified: trunk/build/unix/build.sh
===================================================================
--- trunk/build/unix/build.sh 2013-01-25 14:36:28 UTC (rev 3059)
+++ trunk/build/unix/build.sh 2013-02-08 08:16:11 UTC (rev 3060)
@@ -721,6 +721,7 @@
./Configure ${ssl_target} ${ssl_common_flags} ${ssl_build_flags} linux-ppc64 ||
exit 1
;;
windows-x86)
+ rm -rf out32
rm -rf tmp32
# rm -rf engines
cygspawn perl Configure ${ssl_target} ${ssl_common_flags} ${ssl_build_flags}
VC-WIN32
@@ -734,27 +735,23 @@
;;
windows-x64|windows-amd64)
echo "Doing: perl Configure ${ssl_target} ${ssl_common_flags}
VC-WIN64A"
+ rm -rf out32
+ rm -rf tmp32
rm -rf engines
cygspawn perl Configure ${ssl_target} ${ssl_common_flags} VC-WIN64A
ms/do_win64a.bat
-# mkdir tmp32dll
-# cygspawn perl crypto/x86_64cpuid.pl nasm tmp32dll/x86_64cpuid.asm
-# nmake -f ms/ntdll.mak || exit 1
- #CPERL=`cygpath -w /usr/bin/perl`
- #nmake -f ms/nt.mak install PERL="$CPERL"
- nmake -f ms/ntdll.mak install PERL=sperl || exit 1
- # fix the ml to ml64...
- #sed "s:=ml :=ml64 :" ms/nt.mak > $$.mak
- #mv $$.mak ms/nt.mak
- #sed "s:=ml :=ml64 :" ms/ntdll.mak > $$.mak
- #mv $$.mak ms/ntdll.mak
+ nmake -f ms/nt.mak || exit 1
+ nmake -f ms/nt.mak install
;;
windows-i64)
echo "Doing: perl Configure ${ssl_target} ${ssl_common_flags}
VC-WIN64I"
+ rm -rf out32
+ rm -rf tmp32
rm -rf engines
cygspawn perl Configure ${ssl_target} ${ssl_common_flags} VC-WIN64I
ms/do_win64i.bat
- nmake -f ms/ntdll.mak install PERL=sperl || exit 1
+ nmake -f ms/nt.mak || exit 1
+ nmake -f ms/nt.mak install
#nmake -f ms/nt.mak
#sed "s:=ml :=ias :" ms/nt.mak > $$.mak
#mv $$.mak ms/nt.mak
Modified: trunk/build/unix/package.list
===================================================================
--- trunk/build/unix/package.list 2013-01-25 14:36:28 UTC (rev 3059)
+++ trunk/build/unix/package.list 2013-02-08 08:16:11 UTC (rev 3060)
@@ -13,8 +13,8 @@
jboss-native|2.0.9|TOMCAT_NATIVE_1_1_20|apr:v:1.3.8|apu:v:1.3.9|api:v:1.2.1|ssl:v:0.9.8k|zlib:v:1.2.3
jboss-native|2.0.10|TOMCAT_NATIVE_1_1_22|apr:v:1.3.12|ssl:v:0.9.8r
jboss-native|2.0.11|TOMCAT_NATIVE_1_1_24|apr:v:1.3.12|ssl:v:0.9.8r
-jboss-native|2.0.12-dev|branches/1.1.x|apr:v:1.4.6|ssl:v:1.0.1c
jboss-native|2.0.12|TOMCAT_NATIVE_1_1_26|apr:v:1.4.6|ssl:v:1.0.1c
+jboss-native|2.0.12-dev|branches/1.1.x|apr:v:1.4.6|ssl:v:1.0.1d
# SIGHT
jboss-sight|1.0.0|trunk|apr:v:1.2.9|apu:v:1.2.8|api:v:1.2.1
jboss-sight|1.0.1|trunk|apr:v:1.2.8|apu:v:1.2.8|api:v:1.2.1