30 Jan
2009
30 Jan
'09
7:08 a.m.
hi, i update the openssl package to the latest rawhide plus my previous patches. the full hg diff is too large so i collect the changes:
- add all new patch files from openssl-0.9.8j-6.fc11.src.rpm
- mingw32-openssl-0.9.8g-shared.patch updated to mingw32-openssl-0.9.8j-shared.patch (attached)
- remove these patches since no longer needed: openssl-0.9.7-beta5-version-add-engines.patch openssl-0.9.7f-ca-dir.patch openssl-0.9.8a-enginesdir.patch openssl-0.9.8g-bn-mul-bug.patch openssl-0.9.8g-cve-2008-0891.patch openssl-0.9.8g-cve-2008-1671.patch openssl-0.9.8g-redhat.patch openssl-0.9.8g-shlib-version.patch openssl-0.9.8g-soversion.patch openssl-0.9.8g-speed-bug.patch
and my spec file patch which is attached where i try to merge with native spec file. a few comments about it: - rename with_tests to run_tests (since it's called in that way in ptheads package), - update the patch sections, - remove the gcc hack and replace Configure scripts with our macros, - enable pthread tests too - add files under pki/ - add license
--
Levente "Si vis pacem para bellum!"
diff -r 8bd4182dafe0 openssl/mingw32-openssl.spec
--- a/openssl/mingw32-openssl.spec Wed Jan 28 19:29:56 2009 +0000
+++ b/openssl/mingw32-openssl.spec Fri Jan 30 13:37:21 2009 +0100
@@ -4,14 +4,29 @@
%define __find_requires %{_mingw32_findrequires}
%define __find_provides %{_mingw32_findprovides}
+# For the curious:
+# 0.9.5a soversion = 0
+# 0.9.6 soversion = 1
+# 0.9.6a soversion = 2
+# 0.9.6c soversion = 3
+# 0.9.7a soversion = 4
+# 0.9.7ef soversion = 5
+# 0.9.8ab soversion = 6
+# 0.9.8g soversion = 7
+# 0.9.8j + EAP-FAST soversion = 8
+%define soversion 8
+
# Enable the tests.
# These only work some of the time, but fail randomly at other times
# (although I have had them complete a few times, so I don't think
# there is any actual problem with the binaries).
-%define with_tests 0
+%define run_tests 0
+
+# Number of threads to spawn when testing some threading fixes.
+%define thread_test_threads %{?threads:%{threads}}%{!?threads:1}
Name: mingw32-openssl
-Version: 0.9.8g
+Version: 0.9.8j
Release: 1%{?dist}
Summary: MinGW port of the OpenSSL toolkit
@@ -30,34 +45,44 @@ Source10: opensslconf-new-warning.
Source10: opensslconf-new-warning.h
# Patches from Fedora native package.
-Patch0: openssl-0.9.8g-redhat.patch
+# Build changes
+Patch0: openssl-0.9.8j-redhat.patch
Patch1: openssl-0.9.8a-defaults.patch
Patch2: openssl-0.9.8a-link-krb5.patch
-Patch3: openssl-0.9.8g-soversion.patch
-Patch4: openssl-0.9.8a-enginesdir.patch
+Patch3: openssl-0.9.8j-soversion.patch
+Patch4: openssl-0.9.8j-enginesdir.patch
Patch5: openssl-0.9.8a-no-rpath.patch
Patch6: openssl-0.9.8b-test-use-localhost.patch
-Patch7: openssl-0.9.8g-shlib-version.patch
+Patch7: openssl-0.9.8j-shlib-version.patch
+# Bug fixes
Patch21: openssl-0.9.8b-aliasing-bug.patch
Patch22: openssl-0.9.8b-x509-name-cmp.patch
Patch23: openssl-0.9.8g-default-paths.patch
Patch24: openssl-0.9.8g-no-extssl.patch
+# Functionality changes
Patch32: openssl-0.9.8g-ia64.patch
-Patch33: openssl-0.9.7f-ca-dir.patch
+Patch33: openssl-0.9.8j-ca-dir.patch
Patch34: openssl-0.9.6-x509.patch
-Patch35: openssl-0.9.7-beta5-version-add-engines.patch
+Patch35: openssl-0.9.8j-version-add-engines.patch
Patch38: openssl-0.9.8a-reuse-cipher-change.patch
# Disabled this because it uses getaddrinfo which is lacking on Windows.
#Patch39: openssl-0.9.8g-ipv6-apps.patch
-Patch50: openssl-0.9.8g-speed-bug.patch
-Patch51: openssl-0.9.8g-bn-mul-bug.patch
-Patch52: openssl-0.9.8g-cve-2008-0891.patch
-Patch53: openssl-0.9.8g-cve-2008-1671.patch
+Patch40: openssl-0.9.8j-nocanister.patch
+Patch41: openssl-0.9.8j-use-fipscheck.patch
+Patch42: openssl-0.9.8j-fipscheck-hmac.patch
+Patch43: openssl-0.9.8j-evp-nonfips.patch
+Patch44: openssl-0.9.8j-kernel-fipsmode.patch
+Patch45: openssl-0.9.8j-env-nozlib.patch
+Patch46: openssl-0.9.8j-eap-fast.patch
+Patch47: openssl-0.9.8j-readme-warning.patch
+Patch48: openssl-0.9.8j-bad-mime.patch
+Patch49: openssl-0.9.8j-fips-no-pairwise.patch
+# Backported fixes including security fixes
# MinGW-specific patches.
Patch100: mingw32-openssl-0.9.8g-header-files.patch
Patch101: mingw32-openssl-0.9.8g-configure.patch
-Patch102: mingw32-openssl-0.9.8g-shared.patch
+Patch102: mingw32-openssl-0.9.8j-shared.patch
Patch103: mingw32-openssl-0.9.8g-global.patch
Patch104: mingw32-openssl-0.9.8g-sfx.patch
@@ -65,11 +90,12 @@ BuildRoot: %{_tmppath}/%{name}-%{ve
BuildArch: noarch
-BuildRequires: mingw32-filesystem >= 26
+BuildRequires: mingw32-filesystem >= 40
BuildRequires: mingw32-gcc
BuildRequires: mingw32-binutils
BuildRequires: mingw32-zlib
+BuildRequires: mingw32-pthreads
BuildRequires: mktemp
#BuildRequires: krb5-devel
@@ -82,12 +108,12 @@ BuildRequires: /usr/bin/rename
# /usr/bin/makedepend which comes from imake.
BuildRequires: imake
+%if %{run_tests}
# Required both to build, and to run the tests.
# XXX This needs to be fixed - cross-compilation should not
# require running executables.
BuildRequires: wine
-%if %{with_tests}
# Required to run the tests.
BuildRequires: xorg-x11-server-Xvfb
%endif
@@ -130,10 +156,16 @@ This package contains Windows (MinGW) li
%patch35 -p1 -b .version-add-engines
%patch38 -p1 -b .cipher-change
#%patch39 -p1 -b .ipv6-apps
-%patch50 -p1 -b .speed-bug
-%patch51 -p1 -b .bn-mul-bug
-%patch52 -p0 -b .srvname-crash
-%patch53 -p0 -b .srv-kex-crash
+%patch40 -p1 -b .nocanister
+%patch41 -p1 -b .use-fipscheck
+%patch42 -p1 -b .fipscheck-hmac
+%patch43 -p1 -b .evp-nonfips
+%patch44 -p1 -b .fipsmode
+%patch45 -p1 -b .env-nozlib
+%patch46 -p1 -b .eap-fast
+%patch47 -p1 -b .warning
+%patch48 -p1 -b .bad-mime
+%patch49 -p1 -b .no-pairwise
%patch100 -p1 -b .mingw-header-files
%patch101 -p1 -b .mingw-configure
@@ -148,17 +180,11 @@ touch Makefile
touch Makefile
make TABLE PERL=%{__perl}
-
%build
-
-cat > gcc <<EOS
-#!/bin/sh -
-%{_bindir}/i686-pc-mingw32-gcc -m32 "$@"
-EOS
-export PATH=.:$PATH
-
# NB: 'no-hw' is vital. MinGW cannot build the hardware drivers
# and if you don't have this you'll get an obscure link error.
+%{_mingw32_env}; \
+sed -i -e "s/MINGW32_CC/%{_mingw32_cc}/" -e "s/MINGW32_CFLAGS/%{_mingw32_cflags}/" -e "s/MINGW32_RANLIB/%{_mingw32_ranlib}/" Configure; \
./Configure \
--prefix=%{_mingw32_prefix} \
--openssldir=%{_mingw32_sysconfdir}/pki/tls \
@@ -168,11 +194,13 @@ export PATH=.:$PATH
mingw
# --with-krb5-flavor=MIT
# -I%{_mingw32_prefix}/kerberos/include -L%{_mingw32_prefix}/kerberos/%{_lib}
-make depend
-make all build-shared
-make rehash build-shared
-
-%if %{with_tests}
+%{_mingw32_make} depend
+%{_mingw32_make} all build-shared
+
+# Generate hashes for the included certs.
+%{_mingw32_make} rehash build-shared
+
+%if %{run_tests}
#----------------------------------------------------------------------
# Run some tests. I don't know why this isn't in a %-check section
# but this is how it is in the native RPM.
@@ -204,27 +232,36 @@ DISPLAY=$display
DISPLAY=$display
export DISPLAY
-make LDCMD=%{_mingw32_cc} -C test apps tests
+%{_mingw32_make} LDCMD=%{_mingw32_cc} -C test apps tests
# Disable this thread test, because we don't have pthread on Windows.
-#%-{_mingw32_cc} -o openssl-thread-test \
-# -I./include \
-# %-{_mingw32_cflags} \
-# %-{SOURCE8} \
-# -L. \
-# -lssl -lcrypto \
-# -lpthread -lz -ldl
-#
+%{_mingw32_cc} -o openssl-thread-test \
+ -I./include \
+ %-{_mingw32_cflags} \
+ %-{SOURCE8} \
+ -L. \
+ -lssl -lcrypto \
+ -lpthread -lz -ldl
+
## `krb5-config --cflags`
## `krb5-config --libs`
#
-#./openssl-thread-test --threads %{thread_test_threads}
+./openssl-thread-test --threads %{thread_test_threads}
#----------------------------------------------------------------------
%endif
# Patch33 must be patched after tests otherwise they will fail
patch -p1 -b -z .ca-dir < %{PATCH33}
+
+# Add generation of HMAC checksum of the final stripped library
+#%define __spec_install_post \
+# %{?__debug_package:%{__debug_install_post}} \
+# %{__arch_install_post} \
+# %{__os_install_post} \
+# fips/fips_standalone_sha1 $RPM_BUILD_ROOT/%{_lib}/libcrypto.so.%{version} >$RPM_BUILD_ROOT/%{_lib}/.libcrypto.so.%{version}.hmac \
+# ln -sf .libcrypto.so.%{version}.hmac $RPM_BUILD_ROOT/%{_lib}/.libcrypto.so.%{soversion}.hmac \
+#%{nil}
if ! iconv -f UTF-8 -t ASCII//TRANSLIT CHANGES >/dev/null 2>&1 ; then
iconv -f ISO-8859-1 -t UTF-8 -o CHANGES.utf8 CHANGES && \
@@ -242,8 +279,8 @@ make INSTALL_PREFIX=$RPM_BUILD_ROOT inst
make INSTALL_PREFIX=$RPM_BUILD_ROOT install build-shared
# Install the actual DLLs.
-install libcrypto-7.dll $RPM_BUILD_ROOT%{_mingw32_bindir}
-install libssl-7.dll $RPM_BUILD_ROOT%{_mingw32_bindir}
+install libcrypto-%{soversion}.dll $RPM_BUILD_ROOT%{_mingw32_bindir}
+install libssl-%{soversion}.dll $RPM_BUILD_ROOT%{_mingw32_bindir}
# Remove static libraries but DON'T remove *.dll.a files.
rm $RPM_BUILD_ROOT%{_mingw32_libdir}/libcrypto.a
@@ -257,6 +294,19 @@ chmod 0755 $RPM_BUILD_ROOT%{_mingw32_lib
chmod 0755 $RPM_BUILD_ROOT%{_mingw32_libdir}/libcrypto.dll.a
chmod 0755 $RPM_BUILD_ROOT%{_mingw32_libdir}/libssl.dll.a
+# Install a makefile for generating keys and self-signed certs, and a script
+# for generating them on the fly.
+mkdir -p $RPM_BUILD_ROOT%{_mingw32_sysconfdir}/pki/tls/certs
+install -m644 %{SOURCE2} $RPM_BUILD_ROOT%{_mingw32_sysconfdir}/pki/tls/certs/Makefile
+install -m755 %{SOURCE6} $RPM_BUILD_ROOT%{_mingw32_sysconfdir}/pki/tls/certs/make-dummy-cert
+
+# Pick a CA script.
+pushd $RPM_BUILD_ROOT%{_mingw32_sysconfdir}/pki/tls/misc
+mv CA.sh CA
+popd
+
+mkdir -m700 $RPM_BUILD_ROOT%{_mingw32_sysconfdir}/pki/CA
+mkdir -m700 $RPM_BUILD_ROOT%{_mingw32_sysconfdir}/pki/CA/private
%clean
rm -rf $RPM_BUILD_ROOT
@@ -264,10 +314,12 @@ rm -rf $RPM_BUILD_ROOT
%files
%defattr(-,root,root)
+%doc LICENSE
%{_mingw32_bindir}/openssl.exe
%{_mingw32_bindir}/c_rehash
-%{_mingw32_bindir}/libcrypto-7.dll
-%{_mingw32_bindir}/libssl-7.dll
+%{_mingw32_bindir}/libcrypto-%{soversion}.dll
+%{_mingw32_bindir}/libssl-%{soversion}.dll
+#{_mingw32_bindir}/.libcrypto*.hmac
%{_mingw32_libdir}/libcrypto.dll.a
%{_mingw32_libdir}/libssl.dll.a
%{_mingw32_libdir}/engines
@@ -277,5 +329,11 @@ rm -rf $RPM_BUILD_ROOT
%changelog
+* Wed Jan 28 2009 Levente Farkas lfarkas@lfarkas.org - 0.9.8j-1
+- update to new upstream version.
+
+* Mon Dec 29 2008 Levente Farkas lfarkas@lfarkas.org - 0.9.8g-2
+- minor cleanup.
+
* Tue Sep 30 2008 Richard W.M. Jones rjones@redhat.com - 0.9.8g-1
- Initial RPM release.
--- ./Makefile.shared.lfarkas 2009-01-28 16:39:05.000000000 +0100
+++ ./Makefile.shared 2009-01-28 16:41:51.000000000 +0100
@@ -238,7 +238,7 @@
SHLIB=cyg$(LIBNAME); \
base=-Wl,--enable-auto-image-base; \
if expr $(PLATFORM) : 'mingw' > /dev/null; then \
- SHLIB=$(LIBNAME)eay32; base=; \
+ SHLIB=lib$(LIBNAME); base=; \
fi; \
SHLIB_SUFFIX=.dll; \
LIBVERSION="$(LIBVERSION)"; \
@@ -253,7 +253,7 @@
SHLIB=cyg$(LIBNAME); \
base=-Wl,--enable-auto-image-base; \
if expr $(PLATFORM) : 'mingw' > /dev/null; then \
- SHLIB=$(LIBNAME)eay32; \
+ SHLIB=lib$(LIBNAME); \
base=; [ $(LIBNAME) = "crypto" ] && base=-Wl,--image-base,0x63000000; \
fi; \
SHLIB_SUFFIX=.dll; \
1 Feb
1 Feb
5:22 p.m.
On Fri, Jan 30, 2009 at 02:08:29PM +0100, Farkas Levente wrote:
hi, i update the openssl package to the latest rawhide plus my previous patches. the full hg diff is too large so i collect the changes:
I looked over this, and it seems good to me. I'll apply the patch to our Mercurial repo later once I've done a bit more testing.
Rich.
--
Richard Jones, Emerging Technologies, Red Hat http://et.redhat.com/~rjones
virt-df lists disk usage of guests without needing to install any
software inside the virtual machine. Supports Linux and Windows.
http://et.redhat.com/~rjones/virt-df/
5:42 p.m.
I didn't really look into it in detail yet, but I got a build failure in Koji:
http://koji.fedoraproject.org/koji/getfile?taskID=1097899&name=build.log
It built fine on my local machine though.
Rich.
--
Richard Jones, Emerging Technologies, Red Hat http://et.redhat.com/~rjones
virt-top is 'top' for virtual machines. Tiny program with many
powerful monitoring features, net stats, disk stats, logging, etc.
http://et.redhat.com/~rjones/virt-top
2 Feb
2 Feb
12:02 p.m.
Richard W.M. Jones wrote:
I didn't really look into it in detail yet, but I got a build failure in Koji:
http://koji.fedoraproject.org/koji/getfile?taskID=1097899&name=build.log
It built fine on my local machine though.
it's really strange, since centos's patch can work with it:-( anyway here is a patch for the spec file and two new patch. of course 0.9.8j replace the previous 0.9.8g patches. previously i forget to send the configure patch and header was updated.
ps. you can also remove openssl-0.9.8a-enginesdir.patch from hg.
--
Levente "Si vis pacem para bellum!"
--- ./crypto/seed/seed_ecb.c.mingw-header-files 2007-04-24 01:50:10.000000000 +0200
+++ ./crypto/seed/seed_ecb.c 2009-02-02 18:28:55.000000000 +0100
@@ -49,7 +49,7 @@
*
*/
-#include <openssl/seed.h>
+#include "seed.h"
void SEED_ecb_encrypt(const unsigned char *in, unsigned char *out, const SEED_KEY_SCHEDULE *ks, int enc)
{
--- ./crypto/seed/seed_locl.h.mingw-header-files 2009-02-02 18:28:48.000000000 +0100
+++ ./crypto/seed/seed_locl.h 2009-02-02 18:28:55.000000000 +0100
@@ -27,7 +27,7 @@
#define HEADER_SEED_LOCL_H
#include "openssl/e_os2.h"
-#include <openssl/seed.h>
+#include "seed.h"
#ifdef SEED_LONG /* need 32-bit type */
--- ./crypto/seed/seed.c.mingw-header-files 2007-04-24 01:50:10.000000000 +0200
+++ ./crypto/seed/seed.c 2009-02-02 18:28:55.000000000 +0100
@@ -32,7 +32,7 @@
#include <memory.h>
#endif
-#include <openssl/seed.h>
+#include "seed.h"
#include "seed_locl.h"
static seed_word SS[4][256] = { {
--- ./crypto/camellia/cmll_cbc.c.mingw-header-files 2006-12-02 13:00:27.000000000 +0100
+++ ./crypto/camellia/cmll_cbc.c 2009-02-02 18:28:54.000000000 +0100
@@ -58,7 +58,7 @@
#include <stdio.h>
#include <string.h>
-#include <openssl/camellia.h>
+#include "camellia.h"
#include "cmll_locl.h"
void Camellia_cbc_encrypt(const unsigned char *in, unsigned char *out,
--- ./crypto/camellia/cmll_cfb.c.mingw-header-files 2006-06-10 00:31:05.000000000 +0200
+++ ./crypto/camellia/cmll_cfb.c 2009-02-02 18:28:54.000000000 +0100
@@ -113,7 +113,7 @@
#include <assert.h>
#include <string.h>
-#include <openssl/camellia.h>
+#include "camellia.h"
#include "cmll_locl.h"
#include "e_os.h"
--- ./crypto/camellia/cmll_ofb.c.mingw-header-files 2006-06-10 00:31:05.000000000 +0200
+++ ./crypto/camellia/cmll_ofb.c 2009-02-02 18:28:55.000000000 +0100
@@ -111,7 +111,7 @@
# endif
#endif
#include <assert.h>
-#include <openssl/camellia.h>
+#include "camellia.h"
#include "cmll_locl.h"
/* The input and output encrypted as though 128bit ofb mode is being
--- ./crypto/camellia/cmll_misc.c.mingw-header-files 2009-02-02 18:29:19.000000000 +0100
+++ ./crypto/camellia/cmll_misc.c 2009-02-02 18:29:32.000000000 +0100
@@ -50,7 +50,7 @@
*/
#include <openssl/opensslv.h>
-#include <openssl/camellia.h>
+#include "camellia.h"
#include "cmll_locl.h"
#include <openssl/crypto.h>
#ifdef OPENSSL_FIPS
--- ./crypto/camellia/cmll_ecb.c.mingw-header-files 2006-06-10 00:31:05.000000000 +0200
+++ ./crypto/camellia/cmll_ecb.c 2009-02-02 18:28:54.000000000 +0100
@@ -56,7 +56,7 @@
#endif
#include <assert.h>
-#include <openssl/camellia.h>
+#include "camellia.h"
#include "cmll_locl.h"
void Camellia_ecb_encrypt(const unsigned char *in, unsigned char *out,
--- ./crypto/camellia/cmll_ctr.c.mingw-header-files 2006-06-10 00:31:05.000000000 +0200
+++ ./crypto/camellia/cmll_ctr.c 2009-02-02 18:28:54.000000000 +0100
@@ -56,7 +56,7 @@
#endif
#include <assert.h>
-#include <openssl/camellia.h>
+#include "camellia.h"
#include "cmll_locl.h"
/* NOTE: the IV/counter CTR mode is big-endian. The rest of the Camellia code
--- ./crypto/evp/e_seed.c.mingw-header-files 2007-07-04 14:56:32.000000000 +0200
+++ ./crypto/evp/e_seed.c 2009-02-02 18:28:55.000000000 +0100
@@ -59,7 +59,7 @@
#include <string.h>
#include <assert.h>
#ifndef OPENSSL_NO_SEED
-#include <openssl/seed.h>
+#include "../seed/seed.h"
#include "evp_locl.h"
static int seed_init_key(EVP_CIPHER_CTX *ctx, const unsigned char *key, const unsigned char *iv, int enc);
--- ./crypto/evp/e_camellia.c.mingw-header-files 2008-09-21 12:24:08.000000000 +0200
+++ ./crypto/evp/e_camellia.c 2009-02-02 18:28:55.000000000 +0100
@@ -59,7 +59,7 @@
#include <openssl/err.h>
#include <string.h>
#include <assert.h>
-#include <openssl/camellia.h>
+#include "../camellia/camellia.h"
#include "evp_locl.h"
static int camellia_init_key(EVP_CIPHER_CTX *ctx, const unsigned char *key,
--- ./apps/speed.c.mingw-header-files 2009-01-07 11:48:22.000000000 +0100
+++ ./apps/speed.c 2009-02-02 18:28:54.000000000 +0100
@@ -165,7 +165,7 @@
#include <openssl/aes.h>
#endif
#ifndef OPENSSL_NO_CAMELLIA
-#include <openssl/camellia.h>
+#include "../crypto/camellia/camellia.h"
#endif
#ifndef OPENSSL_NO_MD2
#include <openssl/md2.h>
@@ -202,7 +202,7 @@
#include <openssl/idea.h>
#endif
#ifndef OPENSSL_NO_SEED
-#include <openssl/seed.h>
+#include "../crypto/seed/seed.h"
#endif
#ifndef OPENSSL_NO_BF
#include <openssl/blowfish.h>
diff -r 9ce8bc84c7bc openssl/mingw32-openssl.spec
--- a/openssl/mingw32-openssl.spec Mon Feb 02 15:27:49 2009 +0000
+++ b/openssl/mingw32-openssl.spec Mon Feb 02 18:44:42 2009 +0100
@@ -80,8 +80,8 @@ Patch49: openssl-0.9.8j-fips-no-p
# Backported fixes including security fixes
# MinGW-specific patches.
-Patch100: mingw32-openssl-0.9.8g-header-files.patch
-Patch101: mingw32-openssl-0.9.8g-configure.patch
+Patch100: mingw32-openssl-0.9.8j-header-files.patch
+Patch101: mingw32-openssl-0.9.8j-configure.patch
Patch102: mingw32-openssl-0.9.8j-shared.patch
Patch103: mingw32-openssl-0.9.8g-global.patch
Patch104: mingw32-openssl-0.9.8g-sfx.patch
The 'mingw' target to Configure has some problems with cross-compilation.
- RWMJ 2008-09-30
diff -ur openssl-0.9.8g.orig/Configure openssl-0.9.8g.mingw/Configure
--- openssl-0.9.8g.orig/Configure 2008-09-30 14:16:16.000000000 +0100
+++ openssl-0.9.8g.mingw/Configure 2008-09-30 14:59:34.000000000 +0100
@@ -468,7 +468,7 @@
"BC-32","bcc32::::WIN32::BN_LLONG DES_PTR RC4_INDEX EXPORT_VAR_AS_FN:${no_asm}:win32",
# MinGW
-"mingw", "gcc:-mno-cygwin -DL_ENDIAN -fomit-frame-pointer -O3 -march=i486 -Wall -D_WIN32_WINNT=0x333:::MINGW32:-lwsock32 -lgdi32:BN_LLONG ${x86_gcc_des} ${x86_gcc_opts} EXPORT_VAR_AS_FN:${x86_coff_asm}:win32:cygwin-shared:-D_WINDLL -DOPENSSL_USE_APPLINK:-mno-cygwin -shared:.dll.a",
+"mingw", "MINGW32_CC:-DL_ENDIAN -Wall MINGW32_CFLAGS -D_WIN32_WINNT=0x333 -DMK1MF_BUILD:::MINGW32:-lwsock32 -lgdi32:BN_LLONG ${x86_gcc_des} ${x86_gcc_opts} EXPORT_VAR_AS_FN:${x86_coff_asm}:win32:cygwin-shared:-D_WINDLL -DOPENSSL_USE_APPLINK:-shared:.dll.a:MINGW32_RANLIB",
# UWIN
"UWIN", "cc:-DTERMIOS -DL_ENDIAN -O -Wall:::UWIN::BN_LLONG ${x86_gcc_des} ${x86_gcc_opts}:${no_asm}:win32",
1:05 p.m.
ACKed and applied to the Mercurial repository.
Rich.
--
Richard Jones, Emerging Technologies, Red Hat http://et.redhat.com/~rjones
virt-p2v converts physical machines to virtual machines. Boot with a
live CD or over the network (PXE) and turn machines into Xen guests.
http://et.redhat.com/~rjones/virt-p2v
1:50 p.m.
Richard W.M. Jones wrote:
ACKed and applied to the Mercurial repository.
now it seems to work for me on my centos-5 and on fedora: http://koji.fedoraproject.org/koji/taskinfo?taskID=1099869
--
Levente "Si vis pacem para bellum!"
3:32 p.m.
Richard W.M. Jones wrote:
ACKed and applied to the Mercurial repository.
in the meantime there is a newer native version:-( and here is the patches for this.
--
Levente "Si vis pacem para bellum!"
diff -up openssl-0.9.8j/crypto/rand/rand_lcl.h.rng-seed openssl-0.9.8j/crypto/rand/rand_lcl.h
--- openssl-0.9.8j/crypto/rand/rand_lcl.h.rng-seed 2009-02-02 13:40:37.000000000 +0100
+++ openssl-0.9.8j/crypto/rand/rand_lcl.h 2009-02-02 13:50:42.000000000 +0100
@@ -112,7 +112,7 @@
#ifndef HEADER_RAND_LCL_H
#define HEADER_RAND_LCL_H
-#define ENTROPY_NEEDED 32 /* require 256 bits = 32 bytes of randomness */
+#define ENTROPY_NEEDED 48 /* we need 48 bytes of randomness for FIPS rng */
#if !defined(USE_MD5_RAND) && !defined(USE_SHA1_RAND) && !defined(USE_MDC2_RAND) && !defined(USE_MD2_RAND)
diff -up openssl-0.9.8j/fips/rand/fips_rand.c.rng-seed openssl-0.9.8j/fips/rand/fips_rand.c
--- openssl-0.9.8j/fips/rand/fips_rand.c.rng-seed 2008-09-16 12:12:18.000000000 +0200
+++ openssl-0.9.8j/fips/rand/fips_rand.c 2009-02-02 14:06:58.000000000 +0100
@@ -155,7 +155,18 @@ static int fips_set_prng_seed(FIPS_PRNG_
{
int i;
if (!ctx->keyed)
- return 0;
+ {
+ FIPS_RAND_SIZE_T keylen = 16;
+
+ if (seedlen - keylen < AES_BLOCK_LENGTH)
+ return 0;
+ if (seedlen - keylen - 8 >= AES_BLOCK_LENGTH)
+ keylen += 8;
+ if (seedlen - keylen - 8 >= AES_BLOCK_LENGTH)
+ keylen += 8;
+ seedlen -= keylen;
+ fips_set_prng_key(ctx, seed+seedlen, keylen);
+ }
/* In test mode seed is just supplied data */
if (ctx->test_mode)
{
diff -up openssl-0.9.8j/fips/fips.c.rng-seed openssl-0.9.8j/fips/fips.c
--- openssl-0.9.8j/fips/fips.c.rng-seed 2009-02-02 13:40:38.000000000 +0100
+++ openssl-0.9.8j/fips/fips.c 2009-02-02 13:49:32.000000000 +0100
@@ -509,22 +509,22 @@ int FIPS_mode_set(int onoff)
goto end;
}
+ /* now switch into FIPS mode */
+ fips_set_rand_check(FIPS_rand_method());
+ RAND_set_rand_method(FIPS_rand_method());
+
/* automagically seed PRNG if not already seeded */
if(!FIPS_rand_status())
{
- if(RAND_bytes(buf,sizeof buf) <= 0)
+ RAND_poll();
+ if (!FIPS_rand_status())
{
fips_selftest_fail = 1;
ret = 0;
goto end;
}
- FIPS_rand_set_key(buf,32);
- FIPS_rand_seed(buf+32,16);
}
- /* now switch into FIPS mode */
- fips_set_rand_check(FIPS_rand_method());
- RAND_set_rand_method(FIPS_rand_method());
if(FIPS_selftest())
fips_set_mode(1);
else
diff -r 9f58deb1a4f9 openssl/mingw32-openssl.spec
--- a/openssl/mingw32-openssl.spec Mon Feb 02 19:08:07 2009 +0000
+++ b/openssl/mingw32-openssl.spec Mon Feb 02 22:32:15 2009 +0100
@@ -27,7 +27,7 @@
Name: mingw32-openssl
Version: 0.9.8j
-Release: 2%{?dist}
+Release: 3%{?dist}
Summary: MinGW port of the OpenSSL toolkit
License: OpenSSL
@@ -77,6 +77,7 @@
Patch47: openssl-0.9.8j-readme-warning.patch
Patch48: openssl-0.9.8j-bad-mime.patch
Patch49: openssl-0.9.8j-fips-no-pairwise.patch
+Patch50: openssl-0.9.8j-fips-rng-seed.patch
# Backported fixes including security fixes
# MinGW-specific patches.
@@ -166,6 +167,7 @@
%patch47 -p1 -b .warning
%patch48 -p1 -b .bad-mime
%patch49 -p1 -b .no-pairwise
+%patch50 -p1 -b .rng-seed
%patch100 -p1 -b .mingw-header-files
%patch101 -p1 -b .mingw-configure
@@ -261,6 +263,8 @@
# %{__os_install_post} \
# fips/fips_standalone_sha1 $RPM_BUILD_ROOT/%{_lib}/libcrypto.so.%{version} >$RPM_BUILD_ROOT/%{_lib}/.libcrypto.so.%{version}.hmac \
# ln -sf .libcrypto.so.%{version}.hmac $RPM_BUILD_ROOT/%{_lib}/.libcrypto.so.%{soversion}.hmac \
+# fips/fips_standalone_sha1 $RPM_BUILD_ROOT/%{_lib}/libssl.so.%{version} >$RPM_BUILD_ROOT/%{_lib}/.libssl.so.%{version}.hmac \
+# ln -sf .libssl.so.%{version}.hmac $RPM_BUILD_ROOT/%{_lib}/.libssl.so.%{soversion}.hmac \
#%{nil}
if ! iconv -f UTF-8 -t ASCII//TRANSLIT CHANGES >/dev/null 2>&1 ; then
@@ -320,6 +324,7 @@
%{_mingw32_bindir}/libcrypto-%{soversion}.dll
%{_mingw32_bindir}/libssl-%{soversion}.dll
#{_mingw32_bindir}/.libcrypto*.hmac
+#{_mingw32_bindir}/.libssl*.hmac
%{_mingw32_libdir}/libcrypto.dll.a
%{_mingw32_libdir}/libssl.dll.a
%{_mingw32_libdir}/engines
13 Feb
13 Feb
11:20 a.m.
On Mon, Feb 02, 2009 at 10:32:58PM +0100, Farkas Levente wrote:
Richard W.M. Jones wrote:
ACKed and applied to the Mercurial repository.
in the meantime there is a newer native version:-( and here is the patches for this.
Is this patch still waiting for attention?
Rich.
--
Richard Jones, Emerging Technologies, Red Hat http://et.redhat.com/~rjones
virt-p2v converts physical machines to virtual machines. Boot with a
live CD or over the network (PXE) and turn machines into Xen guests.
http://et.redhat.com/~rjones/virt-p2v
4:57 p.m.
Richard W.M. Jones wrote:
On Mon, Feb 02, 2009 at 10:32:58PM +0100, Farkas Levente wrote:
Richard W.M. Jones wrote:
ACKed and applied to the Mercurial repository.
in the meantime there is a newer native version:-( and here is the patches for this.
Is this patch still waiting for attention?
yes imho should have to apply to the hg (at least this still diff from the hg repo). anyway why is there the hg repo when openssl is in fedora cvs?
--
Levente "Si vis pacem para bellum!"
5:32 p.m.
On Fri, Feb 13, 2009 at 11:57:54PM +0100, Farkas Levente wrote:
Richard W.M. Jones wrote:
On Mon, Feb 02, 2009 at 10:32:58PM +0100, Farkas Levente wrote:
Richard W.M. Jones wrote:
ACKed and applied to the Mercurial repository.
in the meantime there is a newer native version:-( and here is the patches for this.
Is this patch still waiting for attention?
yes imho should have to apply to the hg (at least this still diff from the hg repo). anyway why is there the hg repo when openssl is in fedora cvs?
I should have removed it from the hg repository, and if I didn't then that's a mistake. As is the case here, so I'll remove it shortly.
Can you repost the latest version of your patch against the Fedora CVS, and I'll try to take a look at it on Monday.
Rich.
--
Richard Jones, Emerging Technologies, Red Hat http://et.redhat.com/~rjones
virt-p2v converts physical machines to virtual machines. Boot with a
live CD or over the network (PXE) and turn machines into Xen guests.
http://et.redhat.com/~rjones/virt-p2v
14 Feb
14 Feb
2:09 a.m.
Richard W.M. Jones wrote:
On Fri, Feb 13, 2009 at 11:57:54PM +0100, Farkas Levente wrote:
Richard W.M. Jones wrote:
On Mon, Feb 02, 2009 at 10:32:58PM +0100, Farkas Levente wrote:
Richard W.M. Jones wrote:
ACKed and applied to the Mercurial repository.
in the meantime there is a newer native version:-( and here is the patches for this.
Is this patch still waiting for attention?
yes imho should have to apply to the hg (at least this still diff from the hg repo). anyway why is there the hg repo when openssl is in fedora cvs?
I should have removed it from the hg repository, and if I didn't then that's a mistake. As is the case here, so I'll remove it shortly.
Can you repost the latest version of your patch against the Fedora CVS, and I'll try to take a look at it on Monday.
sorry, fedora cvs already contains the latest version i just check against the hg wrongly:-(
--
Levente "Si vis pacem para bellum!"
5963
Age (days ago)
5978
Last active (days ago)
10 comments
2 participants
participants (2)
-
Farkas Levente -
Richard W.M. Jones