102-wanboot.patch revision 6858
2505N/A#
2505N/A# This patch file makes the changes neccessary to build wanboot-openssl.o
2505N/A# binary. This is Solaris-specific: not suitable for upstream.
2505N/A#
4364N/A--- openssl-1.0.0g/Makefile.org 2010-01-27 08:06:58.000000000 -0800
4364N/A+++ openssl-1.0.0g-1/Makefile.org 2012-03-26 03:04:08.440194448 -0700
4820N/A@@ -139,7 +139,13 @@
1426N/A
1426N/A BASEADDR=
1426N/A
797N/A+# For wanboot, we only need crypto and ssl.
797N/A+# 'apps' are not patched to work in stand-alone environment anyway.
797N/A+ifeq ($(PLATFORM), solaris64-sparcv9-cc-sunw-wanboot)
797N/A+DIRS= crypto ssl
797N/A+else
797N/A DIRS= crypto ssl engines apps test tools
797N/A+endif
797N/A ENGDIRS= ccgost
797N/A SHLIBDIRS= crypto ssl
1426N/A
4364N/A--- openssl-1.0.0g/Makefile 2012-01-18 05:42:28.000000000 -0800
4364N/A+++ openssl-1.0.0g-1/Makefile 2012-03-26 03:03:59.170540344 -0700
4820N/A@@ -138,7 +138,13 @@
1426N/A
1426N/A BASEADDR=0xFB00000
1426N/A
797N/A+# For wanboot, we only need crypto and ssl.
797N/A+# 'apps' are not patched to work in stand-alone environment anyway.
797N/A+ifeq ($(PLATFORM), solaris64-sparcv9-cc-sunw-wanboot)
797N/A+DIRS= crypto ssl
797N/A+else
797N/A DIRS= crypto ssl engines apps test tools
797N/A+endif
797N/A ENGDIRS= ccgost
797N/A SHLIBDIRS= crypto ssl
1426N/A
4364N/A--- openssl-1.0.0e/crypto/cryptlib.c 2011-06-22 08:39:00.000000000 -0700
6858N/A+++ openssl-1.0.0e/crypto/cryptlib.c 2011-12-12 06:17:45.422476900 -0800
4364N/A@@ -421,11 +421,13 @@
2505N/A static void solaris_locking_callback(int mode, int type, const char *file,
2505N/A int line)
4364N/A {
4364N/A+#ifndef _BOOT
4364N/A if (mode & CRYPTO_LOCK) {
6858N/A (void) pthread_mutex_lock(&solaris_openssl_locks[type]);
4364N/A } else {
6858N/A (void) pthread_mutex_unlock(&solaris_openssl_locks[type]);
4364N/A }
2505N/A+#endif
4364N/A }
4002N/A
4820N/A /*
4820N/A@@ -434,6 +436,7 @@
4364N/A static struct CRYPTO_dynlock_value *
4364N/A solaris_dynlock_create(const char *file, int line)
4364N/A {
4364N/A+#ifndef _BOOT
4364N/A int ret;
4364N/A pthread_mutex_t *dynlock;
6858N/A
4820N/A@@ -446,6 +449,9 @@
6617N/A OPENSSL_assert(ret == 0);
6858N/A
4364N/A return ((struct CRYPTO_dynlock_value *)dynlock);
4364N/A+#else
4364N/A+ return (NULL);
4364N/A+#endif
4364N/A }
6858N/A
4364N/A static void
4820N/A@@ -452,6 +458,7 @@
4614N/A solaris_dynlock_lock(int mode, struct CRYPTO_dynlock_value *dynlock,
4364N/A const char *file, int line)
4364N/A {
4364N/A+#ifndef _BOOT
4364N/A int ret;
4614N/A
4364N/A if (mode & CRYPTO_LOCK) {
4820N/A@@ -461,6 +468,7 @@
4364N/A }
6858N/A
4364N/A OPENSSL_assert(ret == 0);
4364N/A+#endif
4364N/A }
6858N/A
4364N/A static void
6858N/A@@ -467,23 +475,28 @@
4364N/A solaris_dynlock_destroy(struct CRYPTO_dynlock_value *dynlock,
4364N/A const char *file, int line)
4364N/A {
4364N/A+#ifndef _BOOT
4364N/A int ret;
4364N/A ret = pthread_mutex_destroy((pthread_mutex_t *)dynlock);
6617N/A OPENSSL_assert(ret == 0);
4364N/A+#endif
4364N/A }
6858N/A
6858N/A
6858N/A static void solaris_fork_prep(void)
6858N/A {
6858N/A+#ifndef _BOOT
6858N/A int i;
6858N/A
6858N/A for (i = 0; i < CRYPTO_NUM_LOCKS; i++) {
6858N/A (void) pthread_mutex_lock(&solaris_openssl_locks[i]);
6858N/A }
6858N/A+#endif
6858N/A }
6858N/A
6858N/A static void solaris_fork_post(void)
6858N/A {
6858N/A+#ifndef _BOOT
6858N/A int i;
6858N/A
6858N/A for (i = CRYPTO_NUM_LOCKS - 1; i >= 0; i--) {
6858N/A@@ -494,6 +507,7 @@
6858N/A OPENSSL_assert(dynlock_lock_callback == solaris_dynlock_lock);
6858N/A OPENSSL_assert(dynlock_destroy_callback == solaris_dynlock_destroy);
6858N/A OPENSSL_assert(locking_callback == solaris_locking_callback);
6858N/A+#endif
6858N/A }
6858N/A
6858N/A /*
6858N/A@@ -517,6 +531,12 @@
6858N/A locking_callback = solaris_locking_callback;
4364N/A }
2505N/A
6858N/A+ /*
4364N/A+ * pthread_* can't be used in wanboot.
4364N/A+ * wanboot needs not be thread-safe and mutexes and locking callback
4364N/A+ * function will not be setup for wanboot.
4364N/A+ */
4364N/A+#ifndef _BOOT
6858N/A /* allocate and initialize locks needed by OpenSSL */
6858N/A solaris_openssl_locks =
6858N/A OPENSSL_malloc(sizeof (pthread_mutex_t) * CRYPTO_NUM_LOCKS);
6858N/A@@ -530,6 +550,7 @@
4364N/A }
6858N/A
6858N/A (void) pthread_atfork(solaris_fork_prep, solaris_fork_post, solaris_fork_post);
2505N/A+#endif
4002N/A }
2505N/A
6858N/A
4820N/A@@ -1104,6 +1120,12 @@
5169N/A MessageBox(NULL, buf, _T("OpenSSL: FATAL"), MB_OK | MB_ICONERROR);
797N/A }
797N/A #else
4002N/A+/*
4002N/A+ * Solaris libsa.a used for WAN boot doesn't provide for vfprintf(). Since
4002N/A+ * OPENSSL_showfatal() is not used anywhere else then here we can safely use
4002N/A+ * the code from 0.9.7d version.
4002N/A+ */
4364N/A+#ifndef _BOOT
4002N/A void OPENSSL_showfatal(const char *fmta, ...)
4002N/A {
4002N/A va_list ap;
4820N/A@@ -1112,6 +1134,7 @@
4002N/A vfprintf(stderr, fmta, ap);
4002N/A va_end(ap);
797N/A }
4364N/A+#endif /* _BOOT */
4002N/A
4002N/A int OPENSSL_isservice(void)
4002N/A {
4820N/A@@ -1121,9 +1144,15 @@
797N/A
4002N/A void OpenSSLDie(const char *file, int line, const char *assertion)
4002N/A {
6858N/A+#ifndef _BOOT
4002N/A OPENSSL_showfatal
4002N/A ("%s(%d): OpenSSL internal error, assertion failed: %s\n", file, line,
4002N/A assertion);
797N/A+#else
4364N/A+ fprintf(stderr,
4364N/A+ "%s(%d): OpenSSL internal error, assertion failed: %s\n",
4364N/A+ file,line,assertion);
6858N/A+#endif
797N/A #if !defined(_WIN32) || defined(__CYGWIN__)
4002N/A abort();
797N/A #else
4364N/A--- openssl-1.0.0e/crypto/err/err_all.c 2009-08-09 07:58:05.000000000 -0700
4364N/A+++ openssl-1.0.0e_patched/crypto/err/err_all.c 2011-12-13 05:22:01.205351400 -0800
1426N/A@@ -148,7 +148,9 @@
4002N/A ERR_load_X509V3_strings();
4002N/A ERR_load_PKCS12_strings();
4002N/A ERR_load_RAND_strings();
797N/A+#ifndef _BOOT
4002N/A ERR_load_DSO_strings();
797N/A+#endif /* _BOOT */
4002N/A ERR_load_TS_strings();
4002N/A # ifndef OPENSSL_NO_ENGINE
4002N/A ERR_load_ENGINE_strings();
4364N/A--- openssl-1.0.0e/crypto/evp/evp_key.c 2010-03-27 12:27:50.000000000 -0700
4364N/A+++ openssl-1.0.0e_patched/crypto/evp/evp_key.c 2011-12-13 05:19:32.956908600 -0800
4002N/A@@ -83,7 +83,7 @@
4002N/A else
4002N/A return (prompt_string);
4002N/A }
797N/A-
4364N/A+#ifndef _BOOT
4002N/A /*
4002N/A * For historical reasons, the standard function for reading passwords is in
4002N/A * the DES library -- if someone ever wants to disable DES, this function
4002N/A@@ -115,6 +115,7 @@
4002N/A OPENSSL_cleanse(buff, BUFSIZ);
4002N/A return ret;
4002N/A }
4364N/A+#endif /* !_BOOT */
797N/A
4002N/A int EVP_BytesToKey(const EVP_CIPHER *type, const EVP_MD *md,
4002N/A const unsigned char *salt, const unsigned char *data,
4364N/A--- openssl-1.0.0e/crypto/rand/rand_unix.c 2009-04-06 07:31:36.000000000 -0700
4364N/A+++ openssl-1.0.0e_patched/crypto/rand/rand_unix.c 2011-12-19 07:28:39.988944800 -0800
797N/A@@ -122,7 +122,11 @@
4002N/A # include <sys/time.h>
4002N/A # include <sys/times.h>
4002N/A # include <sys/stat.h>
4364N/A+#ifdef _BOOT
4002N/A+# include <sys/fcntl.h>
797N/A+#else
4002N/A # include <fcntl.h>
797N/A+#endif
4002N/A # include <unistd.h>
4002N/A # include <time.h>
4002N/A # if defined(OPENSSL_SYS_LINUX) /* should actually be available virtually
4002N/A@@ -259,6 +263,11 @@
4002N/A const char **egdsocket = NULL;
4002N/A # endif
797N/A
797N/A+#ifdef _BOOT
797N/A+/* open() is provided by standalone libsa not visible from here */
797N/A+extern int open(const char *, int);
797N/A+#endif
797N/A+
4002N/A # ifdef DEVRANDOM
4002N/A memset(randomstats, 0, sizeof(randomstats));
4002N/A /*
4002N/A@@ -307,11 +316,15 @@
4002N/A do {
4002N/A int try_read = 0;
4002N/A
4002N/A-# if defined(OPENSSL_SYS_BEOS_R5)
4002N/A+# if defined(OPENSSL_SYS_BEOS_R5) || defined(_BOOT)
4002N/A /*
4002N/A * select() is broken in BeOS R5, so we simply try to read
4002N/A * something and snooze if we couldn't
4002N/A */
4002N/A+ /*
4002N/A+ * select() is not available when linking stand-alone
4002N/A+ * library for wanboot
4002N/A+ */
4002N/A try_read = 1;
797N/A
4002N/A # elif defined(OPENSSL_SYS_LINUX)
4002N/A@@ -365,6 +378,7 @@
4002N/A } else
4002N/A r = -1;
4002N/A
4002N/A+#ifndef _BOOT
4002N/A /*
4002N/A * Some Unixen will update t in select(), some won't. For
4002N/A * those who won't, or if we didn't use select() in the first
4002N/A@@ -377,13 +391,17 @@
4002N/A while ((r > 0 ||
4002N/A (errno == EINTR || errno == EAGAIN)) && usec != 0
4002N/A && n < ENTROPY_NEEDED);
4002N/A+#else /* _BOOT */
4002N/A+ }
4002N/A+ while (r > 0 && n < ENTROPY_NEEDED);
4002N/A+#endif /* _BOOT */
4002N/A
4002N/A close(fd);
4002N/A }
4002N/A }
4002N/A # endif /* defined(DEVRANDOM) */
4002N/A
4002N/A-# ifdef DEVRANDOM_EGD
4002N/A+# if defined(DEVRANDOM_EGD) && !defined(_BOOT)
4002N/A /*
4002N/A * Use an EGD socket to read entropy from an EGD or PRNGD entropy
4002N/A * collecting daemon.
4002N/A@@ -407,6 +424,7 @@
4002N/A }
4002N/A # endif
797N/A
4364N/A+#ifndef _BOOT
4002N/A /* put in some default random data, we need more than just this */
4002N/A l = curr_pid;
4002N/A RAND_add(&l, sizeof(l), 0.0);
4002N/A@@ -415,6 +433,7 @@
797N/A
4002N/A l = time(NULL);
4002N/A RAND_add(&l, sizeof(l), 0.0);
4364N/A+#endif /* !_BOOT */
797N/A
4002N/A # if defined(OPENSSL_SYS_BEOS)
4002N/A {
4364N/A--- openssl-1.0.0e/crypto/rand/randfile.c 2011-03-19 02:44:37.000000000 -0700
4364N/A+++ openssl-1.0.0e_patched/crypto/rand/randfile.c 2011-12-13 05:26:51.884824200 -0800
1426N/A@@ -57,9 +57,11 @@
797N/A */
797N/A
797N/A /* We need to define this to get macros like S_IFBLK and S_IFCHR */
4364N/A+#ifndef _BOOT
1426N/A #if !defined(OPENSSL_SYS_VXWORKS)
4002N/A # define _XOPEN_SOURCE 500
1426N/A #endif
4364N/A+#endif /* _BOOT */
797N/A
797N/A #include <errno.h>
797N/A #include <stdio.h>
4002N/A@@ -191,6 +193,7 @@
4002N/A return (ret);
4002N/A }
3070N/A
4364N/A+#ifndef _BOOT
3070N/A int RAND_write_file(const char *file)
4002N/A {
4002N/A unsigned char buf[BUFSIZE];
4002N/A@@ -335,3 +338,5 @@
3070N/A #endif
4002N/A return (buf);
4002N/A }
3070N/A+
3070N/A+#endif /* _BOOT */
4364N/A--- openssl-1.0.0e/crypto/x509v3/v3_utl.c 2009-07-27 14:08:53.000000000 -0700
4364N/A+++ openssl-1.0.0e_patched/crypto/x509v3/v3_utl.c 2011-12-13 05:10:08.844191400 -0800
4820N/A@@ -1146,9 +1146,50 @@
4002N/A }
4002N/A }
797N/A
4364N/A+#if defined(_BOOT)
797N/A+/* This function was copied from bio/b_sock.c */
797N/A+static int get_ip(const char *str, unsigned char ip[4])
4002N/A+{
4002N/A+ unsigned int tmp[4];
4002N/A+ int num = 0, c, ok = 0;
797N/A+
4002N/A+ tmp[0]=tmp[1]=tmp[2]=tmp[3]=0;
797N/A+
4002N/A+ for (;;) {
4002N/A+ c = *(str++);
4002N/A+ if ((c >= '0') && (c <= '9')) {
4002N/A+ ok = 1;
4002N/A+ tmp[num] = tmp[num]*10+c-'0';
4002N/A+ if (tmp[num] > 255)
4002N/A+ return(0);
4002N/A+ } else if (c == '.') {
4002N/A+ if (!ok)
4002N/A+ return (-1);
4002N/A+ if (num == 3)
4002N/A+ return (0);
4002N/A+ num++;
4002N/A+ ok = 0;
4002N/A+ } else if (c == '\0' && (num == 3) && ok)
4002N/A+ break;
4002N/A+ else
4002N/A+ return(0);
4002N/A+ }
4002N/A+ ip[0]=tmp[0];
4002N/A+ ip[1]=tmp[1];
4002N/A+ ip[2]=tmp[2];
4002N/A+ ip[3]=tmp[3];
4002N/A+ return(1);
4002N/A+}
797N/A+#endif /* _BOOT */
797N/A+
797N/A static int ipv4_from_asc(unsigned char *v4, const char *in)
4002N/A {
4002N/A int a0, a1, a2, a3;
797N/A+
4364N/A+#if defined(_BOOT)
4364N/A+ if (get_ip(in, v4) != 1)
4364N/A+ return 0;
4364N/A+#else /* _BOOT */
4002N/A if (sscanf(in, "%d.%d.%d.%d", &a0, &a1, &a2, &a3) != 4)
4002N/A return 0;
4002N/A if ((a0 < 0) || (a0 > 255) || (a1 < 0) || (a1 > 255)
4820N/A@@ -1158,6 +1199,7 @@
4002N/A v4[1] = a1;
4002N/A v4[2] = a2;
4002N/A v4[3] = a3;
4364N/A+#endif /* _BOOT */
4002N/A return 1;
4002N/A }
4002N/A
4364N/A--- openssl-1.0.0e/e_os.h 2011-12-19 04:17:51.631087400 -0800
4364N/A+++ openssl-1.0.0e_patched/e_os.h 2011-12-19 04:15:15.776668900 -0800
4002N/A@@ -213,10 +213,19 @@
4002N/A # define get_last_socket_error() errno
4002N/A # define clear_socket_error() errno=0
4002N/A # define ioctlsocket(a,b,c) ioctl(a,b,c)
4364N/A+#ifdef _BOOT
797N/A+#include <netinet/in.h>
797N/A+extern int socket_read(int, void *, size_t, int);
797N/A+extern int socket_close(int);
4002N/A+# define closesocket(s) socket_close(s)
4002N/A+# define readsocket(s,b,n) socket_read((s),(b),(n), 200)
4002N/A+# define writesocket(s,b,n) send((s),(b),(n), 0)
797N/A+#else /* !_BOOT */
4002N/A # define closesocket(s) close(s)
4002N/A # define readsocket(s,b,n) read((s),(b),(n))
4002N/A # define writesocket(s,b,n) write((s),(b),(n))
4002N/A # endif
797N/A+#endif
797N/A
4002N/A # ifdef WIN16 /* never the case */
4002N/A # define MS_CALLBACK _far _loadds
4368N/A--- openssl-1.0.0e/crypto/sparcv9cap.c 2010-09-05 12:48:01.000000000 -0700
4368N/A+++ openssl-1.0.0e_patched/crypto/sparcv9cap.c 2011-12-23 05:24:02.011607700 -0800
4820N/A@@ -12,7 +12,11 @@
4820N/A #if defined(__GNUC__) && defined(__linux)
4820N/A __attribute__ ((visibility("hidden")))
4820N/A #endif
4002N/A+#ifndef _BOOT
4820N/A unsigned int OPENSSL_sparcv9cap_P[2] = { SPARCV9_TICK_PRIVILEGED, 0 };
797N/A+#else
4820N/A+unsigned int OPENSSL_sparcv9cap_P[2] = { SPARCV9_VIS1, 0 };
797N/A+#endif
797N/A
4002N/A int bn_mul_mont(BN_ULONG *rp, const BN_ULONG *ap, const BN_ULONG *bp,
4002N/A const BN_ULONG *np, const BN_ULONG *n0, int num)
4820N/A@@ -74,6 +78,7 @@
4820N/A size_t _sparcv9_vis1_instrument_bus(unsigned int *, size_t);
4820N/A size_t _sparcv9_vis1_instrument_bus2(unsigned int *, size_t, size_t);
797N/A
797N/A+#ifndef _BOOT
797N/A unsigned long OPENSSL_rdtsc(void)
4002N/A {
4820N/A if (OPENSSL_sparcv9cap_P[0] & SPARCV9_TICK_PRIVILEGED)
4820N/A@@ -103,9 +108,20 @@
4002N/A else
4820N/A return 0;
4002N/A }
797N/A+#endif
4820N/A
4820N/A-#if 0 && defined(__sun) && defined(__SVR4)
797N/A+#if defined(_BOOT)
4820N/A /*
797N/A+ * Hardcoding sparc capabilities for wanboot.
797N/A+ * Older CPUs are EOLed anyway.
797N/A+ */
797N/A+void OPENSSL_cpuid_setup(void)
4820N/A+{
4820N/A+ OPENSSL_sparcv9cap_P[0] = SPARCV9_VIS1;
4820N/A+}
4820N/A+
797N/A+#elif 0 && defined(__sun) && defined(__SVR4)
4820N/A+/*
4002N/A * This code path is disabled, because of incompatibility of libdevinfo.so.1
4002N/A * and libmalloc.so.1 (see below for details)
4820N/A */
4368N/A--- openssl-1.0.0e/crypto/sparccpuid.S 2010-09-05 12:48:01.000000000 -0700
4368N/A+++ openssl-1.0.0e_patched/crypto/sparccpuid.S 2012-02-13 07:42:58.259478325 -0800
4820N/A@@ -400,6 +400,7 @@
797N/A .type OPENSSL_cleanse,#function
797N/A .size OPENSSL_cleanse,.-OPENSSL_cleanse
4820N/A
797N/A+#ifndef _BOOT
4820N/A .global _sparcv9_vis1_instrument_bus
4820N/A .align 8
4820N/A _sparcv9_vis1_instrument_bus:
4820N/A@@ -501,3 +502,7 @@
2505N/A nop
4364N/A call OPENSSL_cpuid_setup
4364N/A nop
797N/A+#else
797N/A+ nop
797N/A+ nop
797N/A+#endif
1426N/A--- openssl-1.0.1c/crypto/Makefile Thu Aug 2 12:56:38 2012
1426N/A+++ openssl-1.0.1c/crypto/Makefile.new Thu Aug 2 12:59:43 2012
4002N/A@@ -36,9 +36,9 @@
797N/A LIB= $(TOP)/libcrypto.a
797N/A SHARED_LIB= libcrypto$(SHLIB_EXT)
1426N/A LIBSRC= cryptlib.c mem.c mem_clr.c mem_dbg.c cversion.c ex_data.c cpt_err.c \
1426N/A- ebcdic.c uid.c o_time.c o_str.c o_dir.c o_fips.c o_init.c fips_ers.c
1426N/A+ ebcdic.c uid.c o_time.c o_str.c o_dir.c o_fips.c o_init.c fips_ers.c wanboot-stubs.c
1426N/A LIBOBJ= cryptlib.o mem.o mem_dbg.o cversion.o ex_data.o cpt_err.o ebcdic.o \
1426N/A- uid.o o_time.o o_str.o o_dir.o o_fips.o o_init.o fips_ers.o $(CPUID_OBJ)
1426N/A+ uid.o o_time.o o_str.o o_dir.o o_fips.o o_init.o fips_ers.o wanboot-stubs.o $(CPUID_OBJ)
1426N/A
797N/A SRC= $(LIBSRC)
1426N/A
2377N/A--- openssl-1.0.1f/ssl/s3_clnt.c Thu Jan 30 02:53:33 2014
2377N/A+++ openssl-1.0.1f/ssl/s3_clnt.c.new Thu Jan 30 02:57:51 2014
4820N/A@@ -698,6 +698,7 @@
4820N/A if (!ssl_get_new_session(s, 0))
4820N/A goto err;
4820N/A }
4820N/A+#ifndef _BOOT
4820N/A if (s->method->version == DTLS_ANY_VERSION) {
4820N/A /* Determine which DTLS version to use */
4820N/A int options = s->options;
4820N/A@@ -730,6 +731,7 @@
4820N/A }
4820N/A s->client_version = s->version;
4820N/A }
4820N/A+#endif
4820N/A /* else use the pre-loaded session */
4002N/A
4820N/A p = s->s3->client_random;
4820N/A@@ -750,8 +750,12 @@
4820N/A } else
4820N/A i = 1;
4820N/A
4364N/A+#ifndef _BOOT
4820N/A if (i && ssl_fill_hello_random(s, 0, p,
4820N/A sizeof(s->s3->client_random)) <= 0)
2377N/A+#else
4820N/A+ if (i && RAND_pseudo_bytes(p, sizeof(s->s3->client_random)) <= 0)
2377N/A+#endif
4002N/A goto err;
2377N/A
4002N/A /* Do the message type and length last */
4820N/A@@ -938,6 +942,7 @@
4820N/A }
4820N/A
4820N/A d = p = (unsigned char *)s->init_msg;
4820N/A+#ifndef _BOOT
4820N/A if (s->method->version == DTLS_ANY_VERSION) {
4820N/A /* Work out correct protocol version to use */
4820N/A int hversion = (p[0] << 8) | p[1];
4820N/A@@ -960,6 +965,7 @@
4820N/A }
4820N/A s->session->ssl_version = s->version = s->method->version;
4820N/A }
4820N/A+#endif
4820N/A
4820N/A if ((p[0] != (s->version >> 8)) || (p[1] != (s->version & 0xff))) {
4820N/A SSLerr(SSL_F_SSL3_GET_SERVER_HELLO, SSL_R_WRONG_SSL_VERSION);
3325N/A--- openssl-1.0.1f/ssl/s3_lib.c Wed Oct 15 11:18:30 2014
3325N/A+++ openssl-1.0.1f/ssl/s3_lib.c.new Wed Oct 15 11:20:07 2014
4820N/A@@ -3574,7 +3574,11 @@
4002N/A * Apparently we're using a version-flexible SSL_METHOD (not at its
4002N/A * highest protocol version).
4002N/A */
4364N/A+#ifndef _BOOT
4002N/A if (s->ctx->method->version == SSLv23_method()->version) {
3325N/A+#else
4002N/A+ if (s->ctx->method->version == TLS1_2_VERSION) {
3325N/A+#endif
3325N/A #if TLS_MAX_VERSION != TLS1_2_VERSION
4002N/A # error Code needs update for SSLv23_method() support beyond TLS1_2_VERSION.
4002N/A #endif
4820N/A--- openssl-1.0.2d/ssl/ssl_algs.c.orig Fri Aug 7 08:54:56 2015
4820N/A+++ openssl-1.0.2d/ssl/ssl_algs.c Fri Aug 7 08:14:38 2015
4820N/A@@ -96,8 +96,10 @@
4820N/A EVP_add_cipher(EVP_aes_256_cbc_hmac_sha1());
4820N/A # endif
4820N/A # if !defined(OPENSSL_NO_SHA) && !defined(OPENSSL_NO_SHA256)
4820N/A+#ifndef _BOOT
4820N/A EVP_add_cipher(EVP_aes_128_cbc_hmac_sha256());
4820N/A EVP_add_cipher(EVP_aes_256_cbc_hmac_sha256());
4820N/A+#endif
4820N/A # endif
4820N/A
4820N/A #endif
4820N/A--- openssl-1.0.2d/ssl/ssl_cert.c.orig Fri Aug 7 08:57:29 2015
4820N/A+++ openssl-1.0.2d/ssl/ssl_cert.c Fri Aug 7 08:14:37 2015
4820N/A@@ -384,11 +384,13 @@
4820N/A ret->ciphers_raw = NULL;
4820N/A
4820N/A #ifndef OPENSSL_NO_TLSEXT
4820N/A+#ifndef _BOOT
4820N/A if (!custom_exts_copy(&ret->cli_ext, &cert->cli_ext))
4820N/A goto err;
4820N/A if (!custom_exts_copy(&ret->srv_ext, &cert->srv_ext))
4820N/A goto err;
4820N/A #endif
4820N/A+#endif
4820N/A
4820N/A return (ret);
4820N/A
4820N/A@@ -409,9 +411,11 @@
4820N/A #endif
4820N/A
4820N/A #ifndef OPENSSL_NO_TLSEXT
4820N/A+#ifndef _BOOT
4820N/A custom_exts_free(&ret->cli_ext);
4820N/A custom_exts_free(&ret->srv_ext);
4820N/A #endif
4820N/A+#endif
4820N/A
4820N/A ssl_cert_clear_certs(ret);
4820N/A
6245N/A@@ -502,11 +506,13 @@
4820N/A if (c->ciphers_raw)
4820N/A OPENSSL_free(c->ciphers_raw);
4820N/A #ifndef OPENSSL_NO_TLSEXT
6245N/A+#ifndef _BOOT
4820N/A custom_exts_free(&c->cli_ext);
4820N/A custom_exts_free(&c->srv_ext);
5912N/A if (c->alpn_proposed)
5912N/A OPENSSL_free(c->alpn_proposed);
4820N/A #endif
4820N/A+#endif
4820N/A OPENSSL_free(c);
4820N/A }
4820N/A
4820N/A--- openssl-1.0.2d/ssl/ssl_conf.c.orig Fri Aug 7 08:57:43 2015
4820N/A+++ openssl-1.0.2d/ssl/ssl_conf.c Fri Aug 7 08:14:38 2015
4820N/A@@ -386,6 +386,7 @@
4820N/A return rv > 0;
4820N/A }
4820N/A
4820N/A+#ifndef _BOOT
4820N/A static int cmd_ServerInfoFile(SSL_CONF_CTX *cctx, const char *value)
4820N/A {
4820N/A int rv = 1;
4820N/A@@ -398,6 +399,8 @@
4820N/A return rv > 0;
4820N/A }
4820N/A
4820N/A+#endif
4820N/A+
4820N/A #ifndef OPENSSL_NO_DH
4820N/A static int cmd_DHParameters(SSL_CONF_CTX *cctx, const char *value)
4820N/A {
4820N/A@@ -456,7 +459,9 @@
4820N/A SSL_CONF_CMD_STRING(Options, NULL),
4820N/A SSL_CONF_CMD(Certificate, "cert", SSL_CONF_TYPE_FILE),
4820N/A SSL_CONF_CMD(PrivateKey, "key", SSL_CONF_TYPE_FILE),
4820N/A+#ifndef _BOOT
4820N/A SSL_CONF_CMD(ServerInfoFile, NULL, SSL_CONF_TYPE_FILE),
4820N/A+#endif
4820N/A #ifndef OPENSSL_NO_DH
4820N/A SSL_CONF_CMD(DHParameters, "dhparam", SSL_CONF_TYPE_FILE)
4820N/A #endif
4820N/A--- openssl-1.0.2d/ssl/ssl_rsa.c.orig Fri Aug 7 08:58:26 2015
4820N/A+++ openssl-1.0.2d/ssl/ssl_rsa.c Fri Aug 7 08:14:38 2015
4820N/A@@ -788,6 +788,7 @@
4820N/A return 0; /* Error */
4820N/A }
4820N/A
4820N/A+#ifndef _BOOT
4820N/A static int serverinfo_srv_parse_cb(SSL *s, unsigned int ext_type,
4820N/A const unsigned char *in,
4820N/A size_t inlen, int *al, void *arg)
4820N/A@@ -1005,4 +1006,5 @@
4820N/A return ret;
4820N/A }
4820N/A # endif /* OPENSSL_NO_STDIO */
4820N/A+#endif /*!_BOOT*/
4820N/A #endif /* OPENSSL_NO_TLSEXT */
4820N/A--- openssl-1.0.2d/ssl/t1_lib.c.orig Fri Aug 7 08:59:39 2015
4820N/A+++ openssl-1.0.2d/ssl/t1_lib.c Fri Aug 7 09:01:32 2015
4820N/A@@ -1559,10 +1559,12 @@
4820N/A ret += el;
4820N/A }
4820N/A # endif
4820N/A+#ifndef _BOOT
4820N/A custom_ext_init(&s->cert->cli_ext);
4820N/A /* Add custom TLS Extensions to ClientHello */
4820N/A if (!custom_ext_add(s, 0, &ret, limit, al))
4820N/A return NULL;
4820N/A+#endif
4820N/A
4820N/A /*
4820N/A * Add padding to workaround bugs in F5 terminators. See
4820N/A@@ -1798,8 +1800,10 @@
4820N/A }
4820N/A }
4820N/A # endif
4820N/A+#ifndef _BOOT
4820N/A if (!custom_ext_add(s, 1, &ret, limit, al))
4820N/A return NULL;
4820N/A+#endif
4820N/A
4820N/A if (s->s3->alpn_selected) {
4820N/A const unsigned char *selected = s->s3->alpn_selected;
4820N/A@@ -2428,6 +2432,7 @@
4820N/A return 0;
4820N/A }
4820N/A
4820N/A+#ifndef _BOOT
4820N/A /*
4820N/A * Parse any custom extensions found. "data" is the start of the extension data
4820N/A * and "limit" is the end of the record. TODO: add strict syntax checking.
4820N/A@@ -2464,6 +2469,7 @@
4820N/A
4820N/A return 1;
4820N/A }
4820N/A+#endif /*!_BOOT*/
4820N/A
5169N/A int ssl_parse_clienthello_tlsext(SSL *s, unsigned char **p,
5169N/A unsigned char *limit)
4820N/A@@ -2486,11 +2492,13 @@
4820N/A return 0;
4820N/A }
4820N/A
4820N/A+#ifndef _BOOT
4820N/A custom_ext_init(&s->cert->srv_ext);
5169N/A if (ssl_scan_clienthello_custom_tlsext(s, ptmp, limit, &al) <= 0) {
4820N/A ssl3_send_alert(s, SSL3_AL_FATAL, al);
4820N/A return 0;
4820N/A }
4820N/A+#endif
4820N/A
4820N/A return 1;
4820N/A }
4820N/A@@ -2762,6 +2770,7 @@
4820N/A return 0;
4820N/A }
4820N/A # endif
4820N/A+#ifndef _BOOT
4820N/A /*
4820N/A * If this extension type was not otherwise handled, but matches a
4820N/A * custom_cli_ext_record, then send it to the c callback
4820N/A@@ -2768,6 +2777,7 @@
4820N/A */
4820N/A else if (custom_ext_parse(s, 0, type, data, size, al) <= 0)
4820N/A return 0;
4820N/A+#endif
4820N/A
4820N/A data += size;
4820N/A }
4820N/A--- openssl-1.0.2d/crypto/x509/x_all.c.orig Fri Aug 7 09:28:54 2015
4820N/A+++ openssl-1.0.2d/crypto/x509/x_all.c Fri Aug 7 08:14:33 2015
4820N/A@@ -106,11 +106,13 @@
4820N/A x->sig_alg, x->signature, x->cert_info, ctx);
4820N/A }
4820N/A
4820N/A+#ifndef _BOOT
4820N/A int X509_http_nbio(OCSP_REQ_CTX *rctx, X509 **pcert)
4820N/A {
4820N/A return OCSP_REQ_CTX_nbio_d2i(rctx,
4820N/A (ASN1_VALUE **)pcert, ASN1_ITEM_rptr(X509));
4820N/A }
4820N/A+#endif
4820N/A
4820N/A int X509_REQ_sign(X509_REQ *x, EVP_PKEY *pkey, const EVP_MD *md)
4820N/A {
4820N/A@@ -140,6 +142,7 @@
4820N/A x->crl, ctx);
4820N/A }
4820N/A
4820N/A+#ifndef _BOOT
4820N/A int X509_CRL_http_nbio(OCSP_REQ_CTX *rctx, X509_CRL **pcrl)
4820N/A {
4820N/A return OCSP_REQ_CTX_nbio_d2i(rctx,
4820N/A@@ -146,6 +149,7 @@
4820N/A (ASN1_VALUE **)pcrl,
4820N/A ASN1_ITEM_rptr(X509_CRL));
4820N/A }
4820N/A+#endif
4820N/A
4820N/A int NETSCAPE_SPKI_sign(NETSCAPE_SPKI *x, EVP_PKEY *pkey, const EVP_MD *md)
4820N/A {
4820N/A--- openssl-1.0.2d/crypto/dh/dh_ameth.c.orig Fri Aug 7 10:19:49 2015
4820N/A+++ openssl-1.0.2d/crypto/dh/dh_ameth.c Fri Aug 7 08:14:35 2015
4820N/A@@ -557,6 +557,7 @@
4820N/A return do_dh_print(bp, x, 4, NULL, 0);
4820N/A }
4820N/A
4820N/A+#ifndef _BOOT
4820N/A #ifndef OPENSSL_NO_CMS
4820N/A static int dh_cms_decrypt(CMS_RecipientInfo *ri);
4820N/A static int dh_cms_encrypt(CMS_RecipientInfo *ri);
4820N/A@@ -583,6 +584,7 @@
4820N/A }
4820N/A
4820N/A }
4820N/A+#endif
4820N/A
4820N/A const EVP_PKEY_ASN1_METHOD dh_asn1_meth = {
4820N/A EVP_PKEY_DH,
4820N/A@@ -645,9 +647,14 @@
4820N/A 0,
4820N/A
4820N/A int_dh_free,
4820N/A+#ifndef _BOOT
4820N/A dh_pkey_ctrl
4820N/A+#else
4820N/A+ 0
4820N/A+#endif
4820N/A };
4820N/A
4820N/A+#ifndef _BOOT
4820N/A #ifndef OPENSSL_NO_CMS
4820N/A
4820N/A static int dh_cms_set_peerkey(EVP_PKEY_CTX *pctx,
4820N/A@@ -955,3 +962,5 @@
4820N/A }
4820N/A
4820N/A #endif
4820N/A+
4820N/A+#endif
4820N/A--- openssl-1.0.2d/crypto/dh/dh_pmeth.c.orig Fri Aug 7 10:16:52 2015
4820N/A+++ openssl-1.0.2d/crypto/dh/dh_pmeth.c Fri Aug 7 08:14:34 2015
4820N/A@@ -194,11 +194,13 @@
4820N/A dctx->use_dsa = p1;
4820N/A return 1;
4820N/A
4820N/A+#ifndef _BOOT
4820N/A case EVP_PKEY_CTRL_DH_RFC5114:
4820N/A if (p1 < 1 || p1 > 3)
4820N/A return -2;
4820N/A dctx->rfc5114_param = p1;
4820N/A return 1;
4820N/A+#endif
4820N/A
4820N/A case EVP_PKEY_CTRL_PEER_KEY:
4820N/A /* Default behaviour is OK */
4820N/A@@ -207,7 +209,11 @@
4820N/A case EVP_PKEY_CTRL_DH_KDF_TYPE:
4820N/A if (p1 == -2)
4820N/A return dctx->kdf_type;
4820N/A+#ifndef _BOOT
4820N/A if (p1 != EVP_PKEY_DH_KDF_NONE && p1 != EVP_PKEY_DH_KDF_X9_42)
4820N/A+#else
4820N/A+ if (p1 != EVP_PKEY_DH_KDF_NONE)
4820N/A+#endif
4820N/A return -2;
4820N/A dctx->kdf_type = p1;
4820N/A return 1;
4820N/A@@ -268,6 +274,7 @@
4820N/A len = atoi(value);
4820N/A return EVP_PKEY_CTX_set_dh_paramgen_prime_len(ctx, len);
4820N/A }
4820N/A+#ifndef _BOOT
4820N/A if (!strcmp(type, "dh_rfc5114")) {
4820N/A DH_PKEY_CTX *dctx = ctx->data;
4820N/A int len;
4820N/A@@ -277,6 +284,7 @@
4820N/A dctx->rfc5114_param = len;
4820N/A return 1;
4820N/A }
4820N/A+#endif
4820N/A if (!strcmp(type, "dh_paramgen_generator")) {
4820N/A int len;
4820N/A len = atoi(value);
4820N/A@@ -355,6 +363,7 @@
4820N/A DH_PKEY_CTX *dctx = ctx->data;
4820N/A BN_GENCB *pcb, cb;
4820N/A int ret;
4820N/A+#ifndef _BOOT
4820N/A if (dctx->rfc5114_param) {
4820N/A switch (dctx->rfc5114_param) {
4820N/A case 1:
4820N/A@@ -375,6 +384,7 @@
4820N/A EVP_PKEY_assign(pkey, EVP_PKEY_DHX, dh);
4820N/A return 1;
4820N/A }
4820N/A+#endif
4820N/A
4820N/A if (ctx->pkey_gencb) {
4820N/A pcb = &cb;
4820N/A@@ -448,6 +458,7 @@
4820N/A return ret;
4820N/A *keylen = ret;
4820N/A return 1;
4820N/A+#ifndef _BOOT
4820N/A } else if (dctx->kdf_type == EVP_PKEY_DH_KDF_X9_42) {
4820N/A unsigned char *Z = NULL;
4820N/A size_t Zlen = 0;
4820N/A@@ -478,6 +489,7 @@
4820N/A OPENSSL_free(Z);
4820N/A }
4820N/A return ret;
4820N/A+#endif
4820N/A }
4820N/A return 1;
4820N/A }
4820N/A--- openssl-1.0.2d/crypto/evp/e_des3.c.orig Fri Aug 7 10:22:12 2015
4820N/A+++ openssl-1.0.2d/crypto/evp/e_des3.c Fri Aug 7 10:23:16 2015
4820N/A@@ -381,6 +381,8 @@
4820N/A return &des_ede3_ecb;
4820N/A }
4820N/A
4820N/A+#ifndef _BOOT
4820N/A+
4820N/A # ifndef OPENSSL_NO_SHA
4820N/A
4820N/A # include <openssl/sha.h>
4820N/A@@ -491,4 +493,6 @@
4820N/A }
4820N/A
4820N/A # endif
4820N/A+#endif
4820N/A+
4820N/A #endif
4820N/A--- openssl-1.0.2d/crypto/evp/c_allc.c.orig Fri Aug 7 10:21:48 2015
4820N/A+++ openssl-1.0.2d/crypto/evp/c_allc.c Fri Aug 7 08:14:31 2015
4820N/A@@ -93,8 +93,10 @@
4820N/A EVP_add_cipher(EVP_des_ecb());
4820N/A EVP_add_cipher(EVP_des_ede());
4820N/A EVP_add_cipher(EVP_des_ede3());
4820N/A+#ifndef _BOOT
4820N/A EVP_add_cipher(EVP_des_ede3_wrap());
4820N/A #endif
4820N/A+#endif
4820N/A
4820N/A #ifndef OPENSSL_NO_RC4
4820N/A EVP_add_cipher(EVP_rc4());
4820N/A@@ -207,8 +209,10 @@
4820N/A EVP_add_cipher(EVP_aes_256_cbc_hmac_sha1());
4820N/A # endif
4820N/A # if !defined(OPENSSL_NO_SHA) && !defined(OPENSSL_NO_SHA256)
4820N/A+#ifndef _BOOT
4820N/A EVP_add_cipher(EVP_aes_128_cbc_hmac_sha256());
4820N/A EVP_add_cipher(EVP_aes_256_cbc_hmac_sha256());
4820N/A+#endif
4820N/A # endif
4820N/A #endif
4820N/A
4820N/A--- openssl-1.0.2d/crypto/cms/cms_env.c.orig Fri Aug 7 10:25:00 2015
4820N/A+++ openssl-1.0.2d/crypto/cms/cms_env.c Fri Aug 7 10:25:37 2015
4820N/A@@ -106,6 +106,7 @@
4820N/A int i;
4820N/A if (ri->type == CMS_RECIPINFO_TRANS)
4820N/A pkey = ri->d.ktri->pkey;
4820N/A+#ifndef _BOOT
4820N/A else if (ri->type == CMS_RECIPINFO_AGREE) {
4820N/A EVP_PKEY_CTX *pctx = ri->d.kari->pctx;
4820N/A if (!pctx)
4820N/A@@ -114,6 +115,9 @@
4820N/A if (!pkey)
4820N/A return 0;
4820N/A } else
4820N/A+#else
4820N/A+ else
4820N/A+#endif
4820N/A return 0;
4820N/A if (!pkey->ameth || !pkey->ameth->pkey_ctrl)
4820N/A return 1;
4820N/A@@ -148,8 +152,10 @@
4820N/A {
4820N/A if (ri->type == CMS_RECIPINFO_TRANS)
4820N/A return ri->d.ktri->pctx;
4820N/A+#ifndef _BOOT
4820N/A else if (ri->type == CMS_RECIPINFO_AGREE)
4820N/A return ri->d.kari->pctx;
4820N/A+#endif
4820N/A return NULL;
4820N/A }
4820N/A
4820N/A@@ -255,10 +261,12 @@
4820N/A goto err;
4820N/A break;
4820N/A
4820N/A+#ifndef _BOOT
4820N/A case CMS_RECIPINFO_AGREE:
4820N/A if (!cms_RecipientInfo_kari_init(ri, recip, pk, flags))
4820N/A goto err;
4820N/A break;
4820N/A+#endif
4820N/A
4820N/A default:
4820N/A CMSerr(CMS_F_CMS_ADD1_RECIPIENT_CERT,
4820N/A@@ -827,8 +835,10 @@
4820N/A case CMS_RECIPINFO_TRANS:
4820N/A return cms_RecipientInfo_ktri_encrypt(cms, ri);
4820N/A
4820N/A+#ifndef _BOOT
4820N/A case CMS_RECIPINFO_AGREE:
4820N/A return cms_RecipientInfo_kari_encrypt(cms, ri);
4820N/A+#endif
4820N/A
4820N/A case CMS_RECIPINFO_KEK:
4820N/A return cms_RecipientInfo_kekri_encrypt(cms, ri);