Author: mladen.turk(a)jboss.com Date: 2013-02-08 03:16:11 -0500 (Fri, 08 Feb 2013) New Revision: 3060 Added: trunk/build/patch/openssl-1.0.1d.patch Modified: trunk/build/unix/build.sh trunk/build/unix/package.list Log: Fix and update openssl to 1.0.1d Added: trunk/build/patch/openssl-1.0.1d.patch =================================================================== --- trunk/build/patch/openssl-1.0.1d.patch (rev 0) +++ trunk/build/patch/openssl-1.0.1d.patch 2013-02-08 08:16:11 UTC (rev 3060) @@ -0,0 +1,83 @@ +--- util/pl/VC-32.pl ++++ util/pl/VC-32.pl +@@ -43,7 +43,7 @@ + # considered safe to ignore. + # + $base_cflags= " $mf_cflag"; +- my $f = $shlib || $fips ?' /MD':' /MT'; ++ my $f = ' /MD'; + $lib_cflag='/Zl' if (!$shlib); # remove /DEFAULTLIBs from static lib + $opt_cflags=$f.' /Ox'; + $dbg_cflags=$f.'d /Od -DDEBUG -D_DEBUG'; +@@ -124,7 +124,7 @@ + else # Win32 + { + $base_cflags= " $mf_cflag"; +- my $f = $shlib || $fips ?' /MD':' /MT'; ++ my $f = ' /MD'; + $lib_cflag='/Zl' if (!$shlib); # remove /DEFAULTLIBs from static lib + $opt_cflags=$f.' /Ox /O2 /Ob2'; + $dbg_cflags=$f.'d /Od -DDEBUG -D_DEBUG'; +@@ -175,6 +175,7 @@ + { + $ex_libs.=' gdi32.lib advapi32.lib crypt32.lib user32.lib'; + $ex_libs.=' bufferoverflowu.lib' if ($FLAVOR =~ /WIN64/ and `cl 2>&1` =~ /14\.00\.4[0-9]{4}\./); ++ $ex_libs.=' $(EXTRA_LIBS)'; + # WIN32 UNICODE build gets linked with unicows.lib for + # backward compatibility with Win9x. + $ex_libs="unicows.lib $ex_libs" if ($FLAVOR =~ /WIN32/ and $cflags =~ /\-DUNICODE/); +--- ssl/s3_cbc.c ++++ ssl/s3_cbc.c +@@ -139,31 +139,22 @@ int tls1_cbc_remove_padding(const SSL* s, + unsigned mac_size) + { + unsigned padding_length, good, to_check, i; +- const char has_explicit_iv = +- s->version >= TLS1_1_VERSION || s->version == DTLS1_VERSION; +- const unsigned overhead = 1 /* padding length byte */ + +- mac_size + +- (has_explicit_iv ? block_size : 0); +- +- /* These lengths are all public so we can test them in non-constant +- * time. */ +- if (overhead > rec->length) +- return 0; +- +- /* We can always safely skip the explicit IV. We check at the beginning +- * of this function that the record has at least enough space for the +- * IV, MAC and padding length byte. (These can be checked in +- * non-constant time because it's all public information.) So, if the +- * padding was invalid, then we didn't change |rec->length| and this is +- * safe. If the padding was valid then we know that we have at least +- * overhead+padding_length bytes of space and so this is still safe +- * because overhead accounts for the explicit IV. */ +- if (has_explicit_iv) ++ const unsigned overhead = 1 /* padding length byte */ + mac_size; ++ /* Check if version requires explicit IV */ ++ if (s->version >= TLS1_1_VERSION || s->version == DTLS1_VERSION) + { ++ /* These lengths are all public so we can test them in ++ * non-constant time. ++ */ ++ if (overhead + block_size > rec->length) ++ return 0; ++ /* We can now safely skip explicit IV */ + rec->data += block_size; + rec->input += block_size; + rec->length -= block_size; + } ++ else if (overhead > rec->length) ++ return 0; + + padding_length = rec->data[rec->length-1]; + +@@ -190,7 +181,7 @@ int tls1_cbc_remove_padding(const SSL* s, + if (EVP_CIPHER_flags(s->enc_read_ctx->cipher)&EVP_CIPH_FLAG_AEAD_CIPHER) + { + /* padding is already verified */ +- rec->length -= padding_length; ++ rec->length -= padding_length + 1; + return 1; + } + + Property changes on: trunk/build/patch/openssl-1.0.1d.patch ___________________________________________________________________ Added: svn:eol-style + LF Modified: trunk/build/unix/build.sh =================================================================== --- trunk/build/unix/build.sh 2013-01-25 14:36:28 UTC (rev 3059) +++ trunk/build/unix/build.sh 2013-02-08 08:16:11 UTC (rev 3060) @@ -721,6 +721,7 @@ ./Configure ${ssl_target} ${ssl_common_flags} ${ssl_build_flags} linux-ppc64 || exit 1 ;; windows-x86) + rm -rf out32 rm -rf tmp32 # rm -rf engines cygspawn perl Configure ${ssl_target} ${ssl_common_flags} ${ssl_build_flags} VC-WIN32 @@ -734,27 +735,23 @@ ;; windows-x64|windows-amd64) echo "Doing: perl Configure ${ssl_target} ${ssl_common_flags} VC-WIN64A" + rm -rf out32 + rm -rf tmp32 rm -rf engines cygspawn perl Configure ${ssl_target} ${ssl_common_flags} VC-WIN64A ms/do_win64a.bat -# mkdir tmp32dll -# cygspawn perl crypto/x86_64cpuid.pl nasm tmp32dll/x86_64cpuid.asm -# nmake -f ms/ntdll.mak || exit 1 - #CPERL=`cygpath -w /usr/bin/perl` - #nmake -f ms/nt.mak install PERL="$CPERL" - nmake -f ms/ntdll.mak install PERL=sperl || exit 1 - # fix the ml to ml64... - #sed "s:=ml :=ml64 :" ms/nt.mak > $$.mak - #mv $$.mak ms/nt.mak - #sed "s:=ml :=ml64 :" ms/ntdll.mak > $$.mak - #mv $$.mak ms/ntdll.mak + nmake -f ms/nt.mak || exit 1 + nmake -f ms/nt.mak install ;; windows-i64) echo "Doing: perl Configure ${ssl_target} ${ssl_common_flags} VC-WIN64I" + rm -rf out32 + rm -rf tmp32 rm -rf engines cygspawn perl Configure ${ssl_target} ${ssl_common_flags} VC-WIN64I ms/do_win64i.bat - nmake -f ms/ntdll.mak install PERL=sperl || exit 1 + nmake -f ms/nt.mak || exit 1 + nmake -f ms/nt.mak install #nmake -f ms/nt.mak #sed "s:=ml :=ias :" ms/nt.mak > $$.mak #mv $$.mak ms/nt.mak Modified: trunk/build/unix/package.list =================================================================== --- trunk/build/unix/package.list 2013-01-25 14:36:28 UTC (rev 3059) +++ trunk/build/unix/package.list 2013-02-08 08:16:11 UTC (rev 3060) @@ -13,8 +13,8 @@ jboss-native|2.0.9|TOMCAT_NATIVE_1_1_20|apr:v:1.3.8|apu:v:1.3.9|api:v:1.2.1|ssl:v:0.9.8k|zlib:v:1.2.3 jboss-native|2.0.10|TOMCAT_NATIVE_1_1_22|apr:v:1.3.12|ssl:v:0.9.8r jboss-native|2.0.11|TOMCAT_NATIVE_1_1_24|apr:v:1.3.12|ssl:v:0.9.8r -jboss-native|2.0.12-dev|branches/1.1.x|apr:v:1.4.6|ssl:v:1.0.1c jboss-native|2.0.12|TOMCAT_NATIVE_1_1_26|apr:v:1.4.6|ssl:v:1.0.1c +jboss-native|2.0.12-dev|branches/1.1.x|apr:v:1.4.6|ssl:v:1.0.1d # SIGHT jboss-sight|1.0.0|trunk|apr:v:1.2.9|apu:v:1.2.8|api:v:1.2.1 jboss-sight|1.0.1|trunk|apr:v:1.2.8|apu:v:1.2.8|api:v:1.2.1