[openssl] more fixes from upstream
Tomáš Mráz
tmraz at fedoraproject.org
Wed Jan 30 17:33:05 UTC 2013
commit 0fd0958b75aef4d9073397acdec7765dcd3e5b34
Author: Tomas Mraz <tmraz at fedoraproject.org>
Date: Wed Jan 30 18:32:56 2013 +0100
more fixes from upstream
- fix errors in manual causing build failure (#904777)
openssl-1.0.1c-manfix.patch | 474 +++++++++++++++++++++++++++++++++++++
openssl-1.0.1c-verify-error.patch | 77 ++++++
openssl.spec | 10 +-
3 files changed, 560 insertions(+), 1 deletions(-)
---
diff --git a/openssl-1.0.1c-manfix.patch b/openssl-1.0.1c-manfix.patch
new file mode 100644
index 0000000..c4053d9
--- /dev/null
+++ b/openssl-1.0.1c-manfix.patch
@@ -0,0 +1,474 @@
+diff -up openssl-1.0.1c/doc/apps/verify.pod.manfix openssl-1.0.1c/doc/apps/verify.pod
+--- openssl-1.0.1c/doc/apps/verify.pod.manfix 2010-02-23 15:09:22.000000000 +0100
++++ openssl-1.0.1c/doc/apps/verify.pod 2013-01-30 17:36:15.277264650 +0100
+@@ -54,35 +54,37 @@ in PEM format concatenated together.
+ =item B<-untrusted file>
+
+ A file of untrusted certificates. The file should contain multiple certificates
++in PEM format concatenated together.
+
+ =item B<-purpose purpose>
+
+-the intended use for the certificate. Without this option no chain verification
+-will be done. Currently accepted uses are B<sslclient>, B<sslserver>,
+-B<nssslserver>, B<smimesign>, B<smimeencrypt>. See the B<VERIFY OPERATION>
+-section for more information.
++The intended use for the certificate. If this option is not specified,
++B<verify> will not consider certificate purpose during chain verification.
++Currently accepted uses are B<sslclient>, B<sslserver>, B<nssslserver>,
++B<smimesign>, B<smimeencrypt>. See the B<VERIFY OPERATION> section for more
++information.
+
+ =item B<-help>
+
+-prints out a usage message.
++Print out a usage message.
+
+ =item B<-verbose>
+
+-print extra information about the operations being performed.
++Print extra information about the operations being performed.
+
+ =item B<-issuer_checks>
+
+-print out diagnostics relating to searches for the issuer certificate
+-of the current certificate. This shows why each candidate issuer
+-certificate was rejected. However the presence of rejection messages
+-does not itself imply that anything is wrong: during the normal
+-verify process several rejections may take place.
++Print out diagnostics relating to searches for the issuer certificate of the
++current certificate. This shows why each candidate issuer certificate was
++rejected. The presence of rejection messages does not itself imply that
++anything is wrong; during the normal verification process, several
++rejections may take place.
+
+ =item B<-policy arg>
+
+-Enable policy processing and add B<arg> to the user-initial-policy-set
+-(see RFC3280 et al). The policy B<arg> can be an object name an OID in numeric
+-form. This argument can appear more than once.
++Enable policy processing and add B<arg> to the user-initial-policy-set (see
++RFC5280). The policy B<arg> can be an object name an OID in numeric form.
++This argument can appear more than once.
+
+ =item B<-policy_check>
+
+@@ -90,41 +92,40 @@ Enables certificate policy processing.
+
+ =item B<-explicit_policy>
+
+-Set policy variable require-explicit-policy (see RFC3280 et al).
++Set policy variable require-explicit-policy (see RFC5280).
+
+ =item B<-inhibit_any>
+
+-Set policy variable inhibit-any-policy (see RFC3280 et al).
++Set policy variable inhibit-any-policy (see RFC5280).
+
+ =item B<-inhibit_map>
+
+-Set policy variable inhibit-policy-mapping (see RFC3280 et al).
++Set policy variable inhibit-policy-mapping (see RFC5280).
+
+ =item B<-policy_print>
+
+-Print out diagnostics, related to policy checking
++Print out diagnostics related to policy processing.
+
+ =item B<-crl_check>
+
+-Checks end entity certificate validity by attempting to lookup a valid CRL.
++Checks end entity certificate validity by attempting to look up a valid CRL.
+ If a valid CRL cannot be found an error occurs.
+
+ =item B<-crl_check_all>
+
+ Checks the validity of B<all> certificates in the chain by attempting
+-to lookup valid CRLs.
++to look up valid CRLs.
+
+ =item B<-ignore_critical>
+
+ Normally if an unhandled critical extension is present which is not
+-supported by OpenSSL the certificate is rejected (as required by
+-RFC3280 et al). If this option is set critical extensions are
+-ignored.
++supported by OpenSSL the certificate is rejected (as required by RFC5280).
++If this option is set critical extensions are ignored.
+
+ =item B<-x509_strict>
+
+-Disable workarounds for broken certificates which have to be disabled
+-for strict X.509 compliance.
++For strict X.509 compliance, disable non-compliant workarounds for broken
++certificates.
+
+ =item B<-extended_crl>
+
+@@ -142,16 +143,15 @@ because it doesn't add any security.
+
+ =item B<->
+
+-marks the last option. All arguments following this are assumed to be
++Indicates the last option. All arguments following this are assumed to be
+ certificate files. This is useful if the first certificate filename begins
+ with a B<->.
+
+ =item B<certificates>
+
+-one or more certificates to verify. If no certificate filenames are included
+-then an attempt is made to read a certificate from standard input. They should
+-all be in PEM format.
+-
++One or more certificates to verify. If no certificates are given, B<verify>
++will attempt to read a certificate from standard input. Certificates must be
++in PEM format.
+
+ =back
+
+diff -up openssl-1.0.1c/doc/apps/x509.pod.manfix openssl-1.0.1c/doc/apps/x509.pod
+--- openssl-1.0.1c/doc/apps/x509.pod.manfix 2013-01-10 10:26:11.000000000 +0100
++++ openssl-1.0.1c/doc/apps/x509.pod 2013-01-30 17:35:38.952458133 +0100
+@@ -29,6 +29,7 @@ B<openssl> B<x509>
+ [B<-purpose>]
+ [B<-dates>]
+ [B<-modulus>]
++[B<-pubkey>]
+ [B<-fingerprint>]
+ [B<-alias>]
+ [B<-noout>]
+@@ -136,6 +137,10 @@ section for more information.
+
+ this option prevents output of the encoded version of the request.
+
++=item B<-pubkey>
++
++outputs the the certificate's SubjectPublicKeyInfo block in PEM format.
++
+ =item B<-modulus>
+
+ this option prints out the value of the modulus of the public key
+diff -up openssl-1.0.1c/doc/crypto/EVP_PKEY_CTX_ctrl.pod.manfix openssl-1.0.1c/doc/crypto/EVP_PKEY_CTX_ctrl.pod
+--- openssl-1.0.1c/doc/crypto/EVP_PKEY_CTX_ctrl.pod.manfix 2009-10-01 01:40:47.000000000 +0200
++++ openssl-1.0.1c/doc/crypto/EVP_PKEY_CTX_ctrl.pod 2013-01-30 17:36:05.381045128 +0100
+@@ -117,7 +117,7 @@ L<EVP_PKEY_encrypt(3)|EVP_PKEY_encrypt(3
+ L<EVP_PKEY_decrypt(3)|EVP_PKEY_decrypt(3)>,
+ L<EVP_PKEY_sign(3)|EVP_PKEY_sign(3)>,
+ L<EVP_PKEY_verify(3)|EVP_PKEY_verify(3)>,
+-L<EVP_PKEY_verifyrecover(3)|EVP_PKEY_verifyrecover(3)>,
++L<EVP_PKEY_verify_recover(3)|EVP_PKEY_verify_recover(3)>,
+ L<EVP_PKEY_derive(3)|EVP_PKEY_derive(3)>
+ L<EVP_PKEY_keygen(3)|EVP_PKEY_keygen(3)>
+
+diff -up openssl-1.0.1c/doc/crypto/EVP_PKEY_decrypt.pod.manfix openssl-1.0.1c/doc/crypto/EVP_PKEY_decrypt.pod
+--- openssl-1.0.1c/doc/crypto/EVP_PKEY_decrypt.pod.manfix 2009-10-01 01:40:48.000000000 +0200
++++ openssl-1.0.1c/doc/crypto/EVP_PKEY_decrypt.pod 2013-01-30 17:36:05.381045128 +0100
+@@ -83,7 +83,7 @@ L<EVP_PKEY_CTX_new(3)|EVP_PKEY_CTX_new(3
+ L<EVP_PKEY_encrypt(3)|EVP_PKEY_encrypt(3)>,
+ L<EVP_PKEY_sign(3)|EVP_PKEY_sign(3)>,
+ L<EVP_PKEY_verify(3)|EVP_PKEY_verify(3)>,
+-L<EVP_PKEY_verifyrecover(3)|EVP_PKEY_verifyrecover(3)>,
++L<EVP_PKEY_verify_recover(3)|EVP_PKEY_verify_recover(3)>,
+ L<EVP_PKEY_derive(3)|EVP_PKEY_derive(3)>
+
+ =head1 HISTORY
+diff -up openssl-1.0.1c/doc/crypto/EVP_PKEY_derive.pod.manfix openssl-1.0.1c/doc/crypto/EVP_PKEY_derive.pod
+--- openssl-1.0.1c/doc/crypto/EVP_PKEY_derive.pod.manfix 2009-10-01 01:40:48.000000000 +0200
++++ openssl-1.0.1c/doc/crypto/EVP_PKEY_derive.pod 2013-01-30 17:36:05.381045128 +0100
+@@ -84,7 +84,7 @@ L<EVP_PKEY_encrypt(3)|EVP_PKEY_encrypt(3
+ L<EVP_PKEY_decrypt(3)|EVP_PKEY_decrypt(3)>,
+ L<EVP_PKEY_sign(3)|EVP_PKEY_sign(3)>,
+ L<EVP_PKEY_verify(3)|EVP_PKEY_verify(3)>,
+-L<EVP_PKEY_verifyrecover(3)|EVP_PKEY_verifyrecover(3)>,
++L<EVP_PKEY_verify_recover(3)|EVP_PKEY_verify_recover(3)>,
+
+ =head1 HISTORY
+
+diff -up openssl-1.0.1c/doc/crypto/EVP_PKEY_encrypt.pod.manfix openssl-1.0.1c/doc/crypto/EVP_PKEY_encrypt.pod
+--- openssl-1.0.1c/doc/crypto/EVP_PKEY_encrypt.pod.manfix 2009-10-01 01:40:48.000000000 +0200
++++ openssl-1.0.1c/doc/crypto/EVP_PKEY_encrypt.pod 2013-01-30 17:36:05.382045143 +0100
+@@ -83,7 +83,7 @@ L<EVP_PKEY_CTX_new(3)|EVP_PKEY_CTX_new(3
+ L<EVP_PKEY_decrypt(3)|EVP_PKEY_decrypt(3)>,
+ L<EVP_PKEY_sign(3)|EVP_PKEY_sign(3)>,
+ L<EVP_PKEY_verify(3)|EVP_PKEY_verify(3)>,
+-L<EVP_PKEY_verifyrecover(3)|EVP_PKEY_verifyrecover(3)>,
++L<EVP_PKEY_verify_recover(3)|EVP_PKEY_verify_recover(3)>,
+ L<EVP_PKEY_derive(3)|EVP_PKEY_derive(3)>
+
+ =head1 HISTORY
+diff -up openssl-1.0.1c/doc/crypto/EVP_PKEY_get_default_digest.pod.manfix openssl-1.0.1c/doc/crypto/EVP_PKEY_get_default_digest.pod
+--- openssl-1.0.1c/doc/crypto/EVP_PKEY_get_default_digest.pod.manfix 2009-10-01 01:40:48.000000000 +0200
++++ openssl-1.0.1c/doc/crypto/EVP_PKEY_get_default_digest.pod 2013-01-30 17:36:05.382045143 +0100
+@@ -32,7 +32,7 @@ public key algorithm.
+ L<EVP_PKEY_CTX_new(3)|EVP_PKEY_CTX_new(3)>,
+ L<EVP_PKEY_sign(3)|EVP_PKEY_sign(3)>,
+ L<EVP_PKEY_verify(3)|EVP_PKEY_verify(3)>,
+-L<EVP_PKEY_verifyrecover(3)|EVP_PKEY_verifyrecover(3)>,
++L<EVP_PKEY_verify_recover(3)|EVP_PKEY_verify_recover(3)>,
+
+ =head1 HISTORY
+
+diff -up openssl-1.0.1c/doc/crypto/EVP_PKEY_keygen.pod.manfix openssl-1.0.1c/doc/crypto/EVP_PKEY_keygen.pod
+--- openssl-1.0.1c/doc/crypto/EVP_PKEY_keygen.pod.manfix 2009-10-01 01:40:49.000000000 +0200
++++ openssl-1.0.1c/doc/crypto/EVP_PKEY_keygen.pod 2013-01-30 17:36:05.382045143 +0100
+@@ -151,7 +151,7 @@ L<EVP_PKEY_encrypt(3)|EVP_PKEY_encrypt(3
+ L<EVP_PKEY_decrypt(3)|EVP_PKEY_decrypt(3)>,
+ L<EVP_PKEY_sign(3)|EVP_PKEY_sign(3)>,
+ L<EVP_PKEY_verify(3)|EVP_PKEY_verify(3)>,
+-L<EVP_PKEY_verifyrecover(3)|EVP_PKEY_verifyrecover(3)>,
++L<EVP_PKEY_verify_recover(3)|EVP_PKEY_verify_recover(3)>,
+ L<EVP_PKEY_derive(3)|EVP_PKEY_derive(3)>
+
+ =head1 HISTORY
+diff -up openssl-1.0.1c/doc/crypto/EVP_PKEY_sign.pod.manfix openssl-1.0.1c/doc/crypto/EVP_PKEY_sign.pod
+--- openssl-1.0.1c/doc/crypto/EVP_PKEY_sign.pod.manfix 2009-10-01 01:40:50.000000000 +0200
++++ openssl-1.0.1c/doc/crypto/EVP_PKEY_sign.pod 2013-01-30 17:36:05.383045149 +0100
+@@ -86,7 +86,7 @@ L<EVP_PKEY_CTX_new(3)|EVP_PKEY_CTX_new(3
+ L<EVP_PKEY_encrypt(3)|EVP_PKEY_encrypt(3)>,
+ L<EVP_PKEY_decrypt(3)|EVP_PKEY_decrypt(3)>,
+ L<EVP_PKEY_verify(3)|EVP_PKEY_verify(3)>,
+-L<EVP_PKEY_verifyrecover(3)|EVP_PKEY_verifyrecover(3)>,
++L<EVP_PKEY_verify_recover(3)|EVP_PKEY_verify_recover(3)>,
+ L<EVP_PKEY_derive(3)|EVP_PKEY_derive(3)>
+
+ =head1 HISTORY
+diff -up openssl-1.0.1c/doc/crypto/EVP_PKEY_verify.pod.manfix openssl-1.0.1c/doc/crypto/EVP_PKEY_verify.pod
+--- openssl-1.0.1c/doc/crypto/EVP_PKEY_verify.pod.manfix 2010-12-02 14:45:25.000000000 +0100
++++ openssl-1.0.1c/doc/crypto/EVP_PKEY_verify.pod 2013-01-30 17:36:05.383045149 +0100
+@@ -81,7 +81,7 @@ L<EVP_PKEY_CTX_new(3)|EVP_PKEY_CTX_new(3
+ L<EVP_PKEY_encrypt(3)|EVP_PKEY_encrypt(3)>,
+ L<EVP_PKEY_decrypt(3)|EVP_PKEY_decrypt(3)>,
+ L<EVP_PKEY_sign(3)|EVP_PKEY_sign(3)>,
+-L<EVP_PKEY_verifyrecover(3)|EVP_PKEY_verifyrecover(3)>,
++L<EVP_PKEY_verify_recover(3)|EVP_PKEY_verify_recover(3)>,
+ L<EVP_PKEY_derive(3)|EVP_PKEY_derive(3)>
+
+ =head1 HISTORY
+diff -up openssl-1.0.1c/doc/crypto/EVP_PKEY_verify_recover.pod.manfix openssl-1.0.1c/doc/crypto/EVP_PKEY_verify_recover.pod
+--- openssl-1.0.1c/doc/crypto/EVP_PKEY_verify_recover.pod.manfix 2013-01-30 17:36:05.383045149 +0100
++++ openssl-1.0.1c/doc/crypto/EVP_PKEY_verify_recover.pod 2013-01-30 17:36:05.383045149 +0100
+@@ -0,0 +1,103 @@
++=pod
++
++=head1 NAME
++
++EVP_PKEY_verify_recover_init, EVP_PKEY_verify_recover - recover signature using a public key algorithm
++
++=head1 SYNOPSIS
++
++ #include <openssl/evp.h>
++
++ int EVP_PKEY_verify_recover_init(EVP_PKEY_CTX *ctx);
++ int EVP_PKEY_verify_recover(EVP_PKEY_CTX *ctx,
++ unsigned char *rout, size_t *routlen,
++ const unsigned char *sig, size_t siglen);
++
++=head1 DESCRIPTION
++
++The EVP_PKEY_verify_recover_init() function initializes a public key algorithm
++context using key B<pkey> for a verify recover operation.
++
++The EVP_PKEY_verify_recover() function recovers signed data
++using B<ctx>. The signature is specified using the B<sig> and
++B<siglen> parameters. If B<rout> is B<NULL> then the maximum size of the output
++buffer is written to the B<routlen> parameter. If B<rout> is not B<NULL> then
++before the call the B<routlen> parameter should contain the length of the
++B<rout> buffer, if the call is successful recovered data is written to
++B<rout> and the amount of data written to B<routlen>.
++
++=head1 NOTES
++
++Normally an application is only interested in whether a signature verification
++operation is successful in those cases the EVP_verify() function should be
++used.
++
++Sometimes however it is useful to obtain the data originally signed using a
++signing operation. Only certain public key algorithms can recover a signature
++in this way (for example RSA in PKCS padding mode).
++
++After the call to EVP_PKEY_verify_recover_init() algorithm specific control
++operations can be performed to set any appropriate parameters for the
++operation.
++
++The function EVP_PKEY_verify_recover() can be called more than once on the same
++context if several operations are performed using the same parameters.
++
++=head1 RETURN VALUES
++
++EVP_PKEY_verify_recover_init() and EVP_PKEY_verify_recover() return 1 for success
++and 0 or a negative value for failure. In particular a return value of -2
++indicates the operation is not supported by the public key algorithm.
++
++=head1 EXAMPLE
++
++Recover digest originally signed using PKCS#1 and SHA256 digest:
++
++ #include <openssl/evp.h>
++ #include <openssl/rsa.h>
++
++ EVP_PKEY_CTX *ctx;
++ unsigned char *rout, *sig;
++ size_t routlen, siglen;
++ EVP_PKEY *verify_key;
++ /* NB: assumes verify_key, sig and siglen are already set up
++ * and that verify_key is an RSA public key
++ */
++ ctx = EVP_PKEY_CTX_new(verify_key);
++ if (!ctx)
++ /* Error occurred */
++ if (EVP_PKEY_verify_recover_init(ctx) <= 0)
++ /* Error */
++ if (EVP_PKEY_CTX_set_rsa_padding(ctx, RSA_PKCS1_PADDING) <= 0)
++ /* Error */
++ if (EVP_PKEY_CTX_set_signature_md(ctx, EVP_sha256()) <= 0)
++ /* Error */
++
++ /* Determine buffer length */
++ if (EVP_PKEY_verify_recover(ctx, NULL, &routlen, sig, siglen) <= 0)
++ /* Error */
++
++ rout = OPENSSL_malloc(routlen);
++
++ if (!rout)
++ /* malloc failure */
++
++ if (EVP_PKEY_verify_recover(ctx, rout, &routlen, sig, siglen) <= 0)
++ /* Error */
++
++ /* Recovered data is routlen bytes written to buffer rout */
++
++=head1 SEE ALSO
++
++L<EVP_PKEY_CTX_new(3)|EVP_PKEY_CTX_new(3)>,
++L<EVP_PKEY_encrypt(3)|EVP_PKEY_encrypt(3)>,
++L<EVP_PKEY_decrypt(3)|EVP_PKEY_decrypt(3)>,
++L<EVP_PKEY_sign(3)|EVP_PKEY_sign(3)>,
++L<EVP_PKEY_verify(3)|EVP_PKEY_verify(3)>,
++L<EVP_PKEY_derive(3)|EVP_PKEY_derive(3)>
++
++=head1 HISTORY
++
++These functions were first added to OpenSSL 1.0.0.
++
++=cut
+diff -up openssl-1.0.1c/doc/crypto/X509_STORE_CTX_get_error.pod.manfix openssl-1.0.1c/doc/crypto/X509_STORE_CTX_get_error.pod
+--- openssl-1.0.1c/doc/crypto/X509_STORE_CTX_get_error.pod.manfix 2009-10-18 17:28:59.000000000 +0200
++++ openssl-1.0.1c/doc/crypto/X509_STORE_CTX_get_error.pod 2013-01-30 17:34:16.315630759 +0100
+@@ -278,6 +278,8 @@ happen if extended CRL checking is enabl
+ an application specific error. This will never be returned unless explicitly
+ set by an application.
+
++=back
++
+ =head1 NOTES
+
+ The above functions should be used instead of directly referencing the fields
+diff -up openssl-1.0.1c/doc/crypto/EVP_PKEY_verifyrecover.pod /dev/null
+--- openssl-1.0.1c/doc/crypto/EVP_PKEY_verifyrecover.pod
++++ /dev/null
+@@ -1,103 +0,0 @@
+-=pod
+-
+-=head1 NAME
+-
+-EVP_PKEY_verifyrecover_init, EVP_PKEY_verifyrecover - recover signature using a public key algorithm
+-
+-=head1 SYNOPSIS
+-
+- #include <openssl/evp.h>
+-
+- int EVP_PKEY_verifyrecover_init(EVP_PKEY_CTX *ctx);
+- int EVP_PKEY_verifyrecover(EVP_PKEY_CTX *ctx,
+- unsigned char *rout, size_t *routlen,
+- const unsigned char *sig, size_t siglen);
+-
+-=head1 DESCRIPTION
+-
+-The EVP_PKEY_verifyrecover_init() function initializes a public key algorithm
+-context using key B<pkey> for a verify recover operation.
+-
+-The EVP_PKEY_verifyrecover() function recovers signed data
+-using B<ctx>. The signature is specified using the B<sig> and
+-B<siglen> parameters. If B<rout> is B<NULL> then the maximum size of the output
+-buffer is written to the B<routlen> parameter. If B<rout> is not B<NULL> then
+-before the call the B<routlen> parameter should contain the length of the
+-B<rout> buffer, if the call is successful recovered data is written to
+-B<rout> and the amount of data written to B<routlen>.
+-
+-=head1 NOTES
+-
+-Normally an application is only interested in whether a signature verification
+-operation is successful in those cases the EVP_verify() function should be
+-used.
+-
+-Sometimes however it is useful to obtain the data originally signed using a
+-signing operation. Only certain public key algorithms can recover a signature
+-in this way (for example RSA in PKCS padding mode).
+-
+-After the call to EVP_PKEY_verifyrecover_init() algorithm specific control
+-operations can be performed to set any appropriate parameters for the
+-operation.
+-
+-The function EVP_PKEY_verifyrecover() can be called more than once on the same
+-context if several operations are performed using the same parameters.
+-
+-=head1 RETURN VALUES
+-
+-EVP_PKEY_verifyrecover_init() and EVP_PKEY_verifyrecover() return 1 for success
+-and 0 or a negative value for failure. In particular a return value of -2
+-indicates the operation is not supported by the public key algorithm.
+-
+-=head1 EXAMPLE
+-
+-Recover digest originally signed using PKCS#1 and SHA256 digest:
+-
+- #include <openssl/evp.h>
+- #include <openssl/rsa.h>
+-
+- EVP_PKEY_CTX *ctx;
+- unsigned char *rout, *sig;
+- size_t routlen, siglen;
+- EVP_PKEY *verify_key;
+- /* NB: assumes verify_key, sig and siglen are already set up
+- * and that verify_key is an RSA public key
+- */
+- ctx = EVP_PKEY_CTX_new(verify_key);
+- if (!ctx)
+- /* Error occurred */
+- if (EVP_PKEY_verifyrecover_init(ctx) <= 0)
+- /* Error */
+- if (EVP_PKEY_CTX_set_rsa_padding(ctx, RSA_PKCS1_PADDING) <= 0)
+- /* Error */
+- if (EVP_PKEY_CTX_set_signature_md(ctx, EVP_sha256()) <= 0)
+- /* Error */
+-
+- /* Determine buffer length */
+- if (EVP_PKEY_verifyrecover(ctx, NULL, &routlen, sig, siglen) <= 0)
+- /* Error */
+-
+- rout = OPENSSL_malloc(routlen);
+-
+- if (!rout)
+- /* malloc failure */
+-
+- if (EVP_PKEY_verifyrecover(ctx, rout, &routlen, sig, siglen) <= 0)
+- /* Error */
+-
+- /* Recovered data is routlen bytes written to buffer rout */
+-
+-=head1 SEE ALSO
+-
+-L<EVP_PKEY_CTX_new(3)|EVP_PKEY_CTX_new(3)>,
+-L<EVP_PKEY_encrypt(3)|EVP_PKEY_encrypt(3)>,
+-L<EVP_PKEY_decrypt(3)|EVP_PKEY_decrypt(3)>,
+-L<EVP_PKEY_sign(3)|EVP_PKEY_sign(3)>,
+-L<EVP_PKEY_verify(3)|EVP_PKEY_verify(3)>,
+-L<EVP_PKEY_derive(3)|EVP_PKEY_derive(3)>
+-
+-=head1 HISTORY
+-
+-These functions were first added to OpenSSL 1.0.0.
+-
+-=cut
+--
+
diff --git a/openssl-1.0.1c-verify-error.patch b/openssl-1.0.1c-verify-error.patch
new file mode 100644
index 0000000..3bdcb48
--- /dev/null
+++ b/openssl-1.0.1c-verify-error.patch
@@ -0,0 +1,77 @@
+From 5bb6d96558ff6013826e3362f4c81513e3df23ff Mon Sep 17 00:00:00 2001
+From: Ben Laurie <ben at openssl.org>
+Date: Thu, 13 Dec 2012 15:48:42 +0000
+Subject: [PATCH] Make verify return errors.
+
+---
+ CHANGES | 3 +++
+ Makefile.org | 2 +-
+ apps/verify.c | 16 ++++++++++++----
+ test/Makefile | 2 +-
+ 4 files changed, 17 insertions(+), 6 deletions(-)
+
+diff --git a/Makefile.org b/Makefile.org
+index 55273ea..43d16cb 100644
+--- a/Makefile.org
++++ b/Makefile.org
+@@ -444,7 +444,7 @@ rehash.time: certs apps
+ [ -x "apps/openssl.exe" ] && OPENSSL="apps/openssl.exe" || :; \
+ OPENSSL_DEBUG_MEMORY=on; \
+ export OPENSSL OPENSSL_DEBUG_MEMORY; \
+- $(PERL) tools/c_rehash certs) && \
++ $(PERL) tools/c_rehash certs/demo) && \
+ touch rehash.time; \
+ else :; fi
+
+diff --git a/apps/verify.c b/apps/verify.c
+index 0f34b86..893670f 100644
+--- a/apps/verify.c
++++ b/apps/verify.c
+@@ -222,11 +222,19 @@ int MAIN(int argc, char **argv)
+ goto end;
+ }
+
+- if (argc < 1) check(cert_ctx, NULL, untrusted, trusted, crls, e);
++ ret = 0;
++ if (argc < 1)
++ {
++ if (1 != check(cert_ctx, NULL, untrusted, trusted, crls, e))
++ ret = -1;
++ }
+ else
++ {
+ for (i=0; i<argc; i++)
+- check(cert_ctx,argv[i], untrusted, trusted, crls, e);
+- ret=0;
++ if (1 != check(cert_ctx,argv[i], untrusted, trusted, crls, e))
++ ret = -1;
++ }
++
+ end:
+ if (ret == 1) {
+ BIO_printf(bio_err,"usage: verify [-verbose] [-CApath path] [-CAfile file] [-purpose purpose] [-crl_check]");
+@@ -252,7 +260,7 @@ end:
+ sk_X509_pop_free(trusted, X509_free);
+ sk_X509_CRL_pop_free(crls, X509_CRL_free);
+ apps_shutdown();
+- OPENSSL_EXIT(ret);
++ OPENSSL_EXIT(ret < 0 ? 2 : ret);
+ }
+
+ static int check(X509_STORE *ctx, char *file,
+diff --git a/test/Makefile b/test/Makefile
+index 09e6848..4c9eabc 100644
+--- a/test/Makefile
++++ b/test/Makefile
+@@ -246,7 +246,7 @@ test_ecdh:
+ test_verify:
+ @echo "The following command should have some OK's and some failures"
+ @echo "There are definitly a few expired certificates"
+- ../util/shlib_wrap.sh ../apps/openssl verify -CApath ../certs ../certs/*.pem
++ ../util/shlib_wrap.sh ../apps/openssl verify -CApath ../certs/demo ../certs/demo/*.pem
+
+ test_dh:
+ @echo "Generate a set of DH parameters"
+--
+1.7.7.6
+
diff --git a/openssl.spec b/openssl.spec
index 63033d2..b5352e3 100644
--- a/openssl.spec
+++ b/openssl.spec
@@ -22,7 +22,7 @@ Summary: Utilities from the general purpose cryptography library with TLS implem
Name: openssl
Version: 1.0.1c
# Do not forget to bump SHLIB_VERSION on version upgrades
-Release: 11%{?dist}
+Release: 12%{?dist}
Epoch: 1
# We have to remove certain patented algorithms from the openssl source
# tarball with the hobble-openssl script which is included below.
@@ -75,6 +75,8 @@ Patch81: openssl-1.0.1-beta2-padlock64.patch
Patch82: openssl-1.0.1c-backports.patch
Patch83: openssl-1.0.1c-ccm-init-str.patch
Patch84: openssl-1.0.1c-backports2.patch
+Patch85: openssl-1.0.1c-manfix.patch
+Patch86: openssl-1.0.1c-verify-error.patch
License: OpenSSL
Group: System Environment/Libraries
@@ -181,6 +183,8 @@ from other formats to the formats used by the OpenSSL toolkit.
%patch82 -p1 -b .backports
%patch83 -p1 -b .init-str
%patch84 -p1 -b .backports2
+%patch85 -p1 -b .manfix
+%patch86 -p1 -b .verify
# Modify the various perl scripts to reference perl in the right location.
perl util/perlpath.pl `dirname %{__perl}`
@@ -436,6 +440,10 @@ rm -rf $RPM_BUILD_ROOT/%{_libdir}/fipscanister.*
%postun libs -p /sbin/ldconfig
%changelog
+* Wed Jan 30 2013 Tomas Mraz <tmraz at redhat.com> 1.0.1c-12
+- more fixes from upstream
+- fix errors in manual causing build failure (#904777)
+
* Fri Dec 21 2012 Tomas Mraz <tmraz at redhat.com> 1.0.1c-11
- add script for renewal of a self-signed cert by Philip Prindeville (#871566)
- allow X509_issuer_and_serial_hash() produce correct result in
More information about the scm-commits
mailing list