Bump to version 1.0.0j to fix CVE-2012-2333
Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar>
Signed-off-by: Peter Korsgaard <jacmet@sunsite.dk>
Remove builtin OCF support from the openssl package into a new package.
Even though ocf support is just a header file we'd rather have it in a
separate package because of unrelated version bumps and to fetch it from
source.
Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar>
Signed-off-by: Peter Korsgaard <jacmet@sunsite.dk>
Bump to version 1.0.0h to fix CMS and S/MIME Bleichenbacher attack (CVE-2012-0884)
Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar>
Signed-off-by: Peter Korsgaard <jacmet@sunsite.dk>
Thanks to the pkgparentdir and pkgname functions, we can rewrite the
GENTARGETS macro in a way that avoids the need for each package to
repeat its name and the directory in which it is present.
[Peter: pkgdir->pkgparentdir]
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
Signed-off-by: Peter Korsgaard <jacmet@sunsite.dk>
Changes between 1.0.0d and 1.0.0e [6 Sep 2011]
*) Fix bug where CRLs with nextUpdate in the past are sometimes accepted
by initialising X509_STORE_CTX properly. (CVE-2011-3207)
[Kaspar Brand <ossl@velox.ch>]
*) Fix SSL memory handling for (EC)DH ciphersuites, in particular
for multi-threaded use of ECDH. (CVE-2011-3210)
[Adam Langley (Google)]
*) Fix x509_name_ex_d2i memory leak on bad inputs.
[Bodo Moeller]
*) Remove hard coded ecdsaWithSHA1 signature tests in ssl code and check
signature public key algorithm by using OID xref utilities instead.
Before this you could only use some ECC ciphersuites with SHA1 only.
[Steve Henson]
*) Add protection against ECDSA timing attacks as mentioned in the paper
by Billy Bob Brumley and Nicola Tuveri, see:
http://eprint.iacr.org/2011/232.pdf
[Billy Bob Brumley and Nicola Tuveri]
Signed-off-by: Yegor Yefremov <yegorslists@googlemail.com>
Acked-by: Gustavo Zacarias <gustavo@zacarias.com.ar>
Signed-off-by: Peter Korsgaard <jacmet@sunsite.dk>
Closes#3445.
OpenSSL emits bswap instructions when building for i386 targets which
unfortunately is only available on 486+ class processors.
Since the normal workaround is detected at build time and we are cross
compiling we need to specify this.
Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar>
Signed-off-by: Peter Korsgaard <jacmet@sunsite.dk>
Closes#3205
OpenSSL's build system tries to be too wise for it's own good when
guessing what libdir should be.
This causes problems like the one reported in bug #3205 so just specify
libdir to point to /lib (since it's prefixed it would finally be
/usr/lib) since it should be present on 32 and 64 bit targets.
Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar>
Signed-off-by: Peter Korsgaard <jacmet@sunsite.dk>
Enable OCF (cryptodev) support for openssl as an option.
This requires a patched kernel to export hardware acceleration for
openssl to use it.
If you lack a patched kernel or support it won't break anything, it will
simply fall back to the default software engine from openssl, you'll
just have a slightly bigger libssl/libcrypto.
Tested with 20100325 release + 20101223 patch from the mailing list.
[Peter: slightly tweaked .mk]
Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar>
Signed-off-by: Peter Korsgaard <jacmet@sunsite.dk>
OpenSSL is not using the autotools as its build system. Therefore, we
must use the generic infrastructure instead of the autotools one.
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
Signed-off-by: Peter Korsgaard <jacmet@sunsite.dk>
Upstream openssl doesn't have avr32 support, and we dropped the
avr32 optimization patch some time ago.
Signed-off-by: Peter Korsgaard <jacmet@sunsite.dk>
And remove the unnedded c_rehash binary while we're at it.
Patch by Gustavo Zacarias <gustavo@zacarias.com.br>, closes#307.
Saves ~250k on PPC with default config (E.G. -Os)
Patch by Gustavo Zacarias <gustavo@zacarias.com.ar>
Closes#151.
* Avoid fips directory completely since it just installs source file cruft
inlib
* Point openssldir to a more friendly and common /etc/ssl rather than
/usr/lib/ssl
This patch will default to linux-generic32, unless a known optimized
architecture is selected.
As of today it will select optimized config for; avr32, ia64, powerpc and
x86_64.
This fixes bug #5344.
Signed-off-by: Hans-Christian Egtvedt <hans-christian.egtvedt@atmel.com>
This patch will use linux-generic32 for all i386 target architectures, which
fixes bug #5274.
Signed-off-by: Hans-Christian Egtvedt <hans-christian.egtvedt@atmel.com>
This patch converts building of OpenSSL to use Makefile.autotools.in and bumps
the version to 0.9.8g. The patches are updated to reflect this version upgrade.
A kconfig option for adding the OpenSSL engines is also added.
Signed-off-by: Hans-Christian Egtvedt <hans-christian.egtvedt@atmel.com>
