From owner-svn-src-vendor@FreeBSD.ORG Thu Apr 1 12:25:41 2010 Return-Path: Delivered-To: svn-src-vendor@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 876E6106566B; Thu, 1 Apr 2010 12:25:41 +0000 (UTC) (envelope-from simon@FreeBSD.org) Received: from svn.freebsd.org (svn.freebsd.org [IPv6:2001:4f8:fff6::2c]) by mx1.freebsd.org (Postfix) with ESMTP id 730108FC13; Thu, 1 Apr 2010 12:25:41 +0000 (UTC) Received: from svn.freebsd.org (localhost [127.0.0.1]) by svn.freebsd.org (8.14.3/8.14.3) with ESMTP id o31CPfZ6029602; Thu, 1 Apr 2010 12:25:41 GMT (envelope-from simon@svn.freebsd.org) Received: (from simon@localhost) by svn.freebsd.org (8.14.3/8.14.3/Submit) id o31CPfPb029573; Thu, 1 Apr 2010 12:25:41 GMT (envelope-from simon@svn.freebsd.org) Message-Id: <201004011225.o31CPfPb029573@svn.freebsd.org> From: "Simon L. Nielsen" Date: Thu, 1 Apr 2010 12:25:41 +0000 (UTC) To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-vendor@freebsd.org X-SVN-Group: vendor-crypto MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Cc: Subject: svn commit: r206035 - in vendor-crypto/openssl/dist: . apps crypto crypto/asn1 crypto/bio crypto/bn crypto/bn/asm crypto/engine crypto/evp crypto/ocsp crypto/rand engines fips ssl X-BeenThere: svn-src-vendor@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: SVN commit messages for the vendor work area tree List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 01 Apr 2010 12:25:41 -0000 Author: simon Date: Thu Apr 1 12:25:40 2010 New Revision: 206035 URL: http://svn.freebsd.org/changeset/base/206035 Log: Import OpenSSL 0.9.8n. Modified: vendor-crypto/openssl/dist/CHANGES vendor-crypto/openssl/dist/FAQ vendor-crypto/openssl/dist/Makefile vendor-crypto/openssl/dist/NEWS vendor-crypto/openssl/dist/README vendor-crypto/openssl/dist/apps/req.c vendor-crypto/openssl/dist/apps/speed.c vendor-crypto/openssl/dist/config vendor-crypto/openssl/dist/crypto/asn1/a_object.c vendor-crypto/openssl/dist/crypto/bio/bss_file.c vendor-crypto/openssl/dist/crypto/bn/asm/ppc.pl vendor-crypto/openssl/dist/crypto/bn/asm/x86_64-gcc.c vendor-crypto/openssl/dist/crypto/bn/bn_div.c vendor-crypto/openssl/dist/crypto/engine/eng_all.c vendor-crypto/openssl/dist/crypto/engine/eng_cryptodev.c vendor-crypto/openssl/dist/crypto/evp/digest.c vendor-crypto/openssl/dist/crypto/evp/evp_locl.h vendor-crypto/openssl/dist/crypto/evp/names.c vendor-crypto/openssl/dist/crypto/md32_common.h vendor-crypto/openssl/dist/crypto/ocsp/ocsp_prn.c vendor-crypto/openssl/dist/crypto/opensslv.h vendor-crypto/openssl/dist/crypto/rand/rand_win.c vendor-crypto/openssl/dist/engines/e_capi.c vendor-crypto/openssl/dist/engines/e_chil.c vendor-crypto/openssl/dist/fips/Makefile vendor-crypto/openssl/dist/openssl.spec vendor-crypto/openssl/dist/ssl/kssl.c vendor-crypto/openssl/dist/ssl/s3_pkt.c Modified: vendor-crypto/openssl/dist/CHANGES ============================================================================== --- vendor-crypto/openssl/dist/CHANGES Thu Apr 1 12:18:44 2010 (r206034) +++ vendor-crypto/openssl/dist/CHANGES Thu Apr 1 12:25:40 2010 (r206035) @@ -2,6 +2,21 @@ OpenSSL CHANGES _______________ + Changes between 0.9.8m and 0.9.8n [24 Mar 2010] + + *) When rejecting SSL/TLS records due to an incorrect version number, never + update s->server with a new major version number. As of + - OpenSSL 0.9.8m if 'short' is a 16-bit type, + - OpenSSL 0.9.8f if 'short' is longer than 16 bits, + the previous behavior could result in a read attempt at NULL when + receiving specific incorrect SSL/TLS records once record payload + protection is active. (CVE-2010-0740) + [Bodo Moeller, Adam Langley ] + + *) Fix for CVE-2010-0433 where some kerberos enabled versions of OpenSSL + could be crashed if the relevant tables were not present (e.g. chrooted). + [Tomas Hoger ] + Changes between 0.9.8l and 0.9.8m [25 Feb 2010] *) Always check bn_wexpend() return values for failure. (CVE-2009-3245) Modified: vendor-crypto/openssl/dist/FAQ ============================================================================== --- vendor-crypto/openssl/dist/FAQ Thu Apr 1 12:18:44 2010 (r206034) +++ vendor-crypto/openssl/dist/FAQ Thu Apr 1 12:25:40 2010 (r206035) @@ -78,7 +78,7 @@ OpenSSL - Frequently Asked Questions * Which is the current version of OpenSSL? The current version is available from . -OpenSSL 0.9.8m was released on Feb 25th, 2010. +OpenSSL 0.9.8n was released on Mar 24th, 2010. In addition to the current stable release, you can also access daily snapshots of the OpenSSL development version at value,def,value,nid,n_min,n_max, chtype)) Modified: vendor-crypto/openssl/dist/apps/speed.c ============================================================================== --- vendor-crypto/openssl/dist/apps/speed.c Thu Apr 1 12:18:44 2010 (r206034) +++ vendor-crypto/openssl/dist/apps/speed.c Thu Apr 1 12:25:40 2010 (r206035) @@ -254,12 +254,18 @@ # endif #endif -#if defined(OPENSSL_SYS_VMS) || defined(OPENSSL_SYS_WINDOWS) || defined(OPENSSL_SYS_MACINTOSH_CLASSIC) || defined(OPENSSL_SYS_OS2) || defined(OPENSSL_SYS_NETWARE) -# define NO_FORK 1 -#elif HAVE_FORK +#ifndef HAVE_FORK +# if defined(OPENSSL_SYS_VMS) || defined(OPENSSL_SYS_WINDOWS) || defined(OPENSSL_SYS_MACINTOSH_CLASSIC) || defined(OPENSSL_SYS_OS2) || defined(OPENSSL_SYS_NETWARE) +# define HAVE_FORK 0 +# else +# define HAVE_FORK 1 +# endif +#endif + +#if HAVE_FORK # undef NO_FORK #else -# define NO_FORK 1 +# define NO_FORK #endif #undef BUFSIZE Modified: vendor-crypto/openssl/dist/config ============================================================================== --- vendor-crypto/openssl/dist/config Thu Apr 1 12:18:44 2010 (r206034) +++ vendor-crypto/openssl/dist/config Thu Apr 1 12:25:40 2010 (r206035) @@ -741,6 +741,10 @@ case "$GUESSOS" in OBJECT_MODE=${OBJECT_MODE:-32} if [ "$CC" = "gcc" ]; then OUT="aix-gcc" + if [ $OBJECT_MODE -eq 64 ]; then + echo 'Your $OBJECT_MODE was found to be set to 64' + OUT="aix64-gcc" + fi elif [ $OBJECT_MODE -eq 64 ]; then echo 'Your $OBJECT_MODE was found to be set to 64' OUT="aix64-cc" Modified: vendor-crypto/openssl/dist/crypto/asn1/a_object.c ============================================================================== --- vendor-crypto/openssl/dist/crypto/asn1/a_object.c Thu Apr 1 12:18:44 2010 (r206034) +++ vendor-crypto/openssl/dist/crypto/asn1/a_object.c Thu Apr 1 12:25:40 2010 (r206035) @@ -291,12 +291,12 @@ ASN1_OBJECT *c2i_ASN1_OBJECT(ASN1_OBJECT ASN1_OBJECT *ret=NULL; const unsigned char *p; int i; - /* Sanity check OID encoding: can't have 0x80 in subidentifiers, see: - * X.690 8.19.2 + /* Sanity check OID encoding: can't have leading 0x80 in + * subidentifiers, see: X.690 8.19.2 */ for (i = 0, p = *pp + 1; i < len - 1; i++, p++) { - if (*p == 0x80) + if (*p == 0x80 && (!i || !(p[-1] & 0x80))) { ASN1err(ASN1_F_C2I_ASN1_OBJECT,ASN1_R_INVALID_OBJECT_ENCODING); return NULL; Modified: vendor-crypto/openssl/dist/crypto/bio/bss_file.c ============================================================================== --- vendor-crypto/openssl/dist/crypto/bio/bss_file.c Thu Apr 1 12:18:44 2010 (r206034) +++ vendor-crypto/openssl/dist/crypto/bio/bss_file.c Thu Apr 1 12:25:40 2010 (r206035) @@ -272,9 +272,9 @@ static long MS_CALLBACK file_ctrl(BIO *b BIO_clear_flags(b,BIO_FLAGS_UPLINK); #endif #endif -#ifdef UP_fsetmode +#ifdef UP_fsetmod if (b->flags&BIO_FLAGS_UPLINK) - UP_fsetmode(b->ptr,num&BIO_FP_TEXT?'t':'b'); + UP_fsetmod(b->ptr,(char)((num&BIO_FP_TEXT)?'t':'b')); else #endif { Modified: vendor-crypto/openssl/dist/crypto/bn/asm/ppc.pl ============================================================================== --- vendor-crypto/openssl/dist/crypto/bn/asm/ppc.pl Thu Apr 1 12:18:44 2010 (r206034) +++ vendor-crypto/openssl/dist/crypto/bn/asm/ppc.pl Thu Apr 1 12:25:40 2010 (r206035) @@ -2074,5 +2074,7 @@ EOF $data =~ s/^(\s*)cmplw(\s+)([^,]+),(.*)/$1cmpl$2$3,0,$4/gm; # assembler X doesn't accept li, load immediate value #$data =~ s/^(\s*)li(\s+)([^,]+),(.*)/$1addi$2$3,0,$4/gm; + # assembler Y chokes on apostrophes in comments + $data =~ s/'//gm; return($data); } Modified: vendor-crypto/openssl/dist/crypto/bn/asm/x86_64-gcc.c ============================================================================== --- vendor-crypto/openssl/dist/crypto/bn/asm/x86_64-gcc.c Thu Apr 1 12:18:44 2010 (r206034) +++ vendor-crypto/openssl/dist/crypto/bn/asm/x86_64-gcc.c Thu Apr 1 12:25:40 2010 (r206035) @@ -59,6 +59,7 @@ #undef mul #undef mul_add +#undef sqr /* * "m"(a), "+m"(r) is the way to favor DirectPath µ-code; Modified: vendor-crypto/openssl/dist/crypto/bn/bn_div.c ============================================================================== --- vendor-crypto/openssl/dist/crypto/bn/bn_div.c Thu Apr 1 12:18:44 2010 (r206034) +++ vendor-crypto/openssl/dist/crypto/bn/bn_div.c Thu Apr 1 12:25:40 2010 (r206035) @@ -337,7 +337,10 @@ X) -> 0x%08X\n", t2 -= d1; } #else /* !BN_LLONG */ - BN_ULONG t2l,t2h,ql,qh; + BN_ULONG t2l,t2h; +#if !defined(BN_UMULT_LOHI) && !defined(BN_UMULT_HIGH) + BN_ULONG ql,qh; +#endif q=bn_div_words(n0,n1,d0); #ifdef BN_DEBUG_LEVITTE @@ -561,7 +564,10 @@ X) -> 0x%08X\n", t2 -= d1; } #else /* !BN_LLONG */ - BN_ULONG t2l,t2h,ql,qh; + BN_ULONG t2l,t2h; +#if !defined(BN_UMULT_LOHI) && !defined(BN_UMULT_HIGH) + BN_ULONG ql,qh; +#endif q=bn_div_words(n0,n1,d0); #ifdef BN_DEBUG_LEVITTE Modified: vendor-crypto/openssl/dist/crypto/engine/eng_all.c ============================================================================== --- vendor-crypto/openssl/dist/crypto/engine/eng_all.c Thu Apr 1 12:18:44 2010 (r206034) +++ vendor-crypto/openssl/dist/crypto/engine/eng_all.c Thu Apr 1 12:25:40 2010 (r206035) @@ -104,7 +104,7 @@ void ENGINE_load_builtin_engines(void) #endif #endif #ifndef OPENSSL_NO_HW -#if defined(__OpenBSD__) || defined(__FreeBSD__) +#if defined(__OpenBSD__) || defined(__FreeBSD__) || defined(HAVE_CRYPTODEV) ENGINE_load_cryptodev(); #endif #if defined(OPENSSL_SYS_WIN32) && !defined(OPENSSL_NO_CAPIENG) Modified: vendor-crypto/openssl/dist/crypto/engine/eng_cryptodev.c ============================================================================== --- vendor-crypto/openssl/dist/crypto/engine/eng_cryptodev.c Thu Apr 1 12:18:44 2010 (r206034) +++ vendor-crypto/openssl/dist/crypto/engine/eng_cryptodev.c Thu Apr 1 12:25:40 2010 (r206035) @@ -755,10 +755,18 @@ cryptodev_bn_mod_exp(BIGNUM *r, const BI goto err; kop.crk_iparams = 3; - if (cryptodev_asym(&kop, BN_num_bytes(m), r, 0, NULL) == -1) { + if (cryptodev_asym(&kop, BN_num_bytes(m), r, 0, NULL)) { const RSA_METHOD *meth = RSA_PKCS1_SSLeay(); + printf("OCF asym process failed, Running in software\n"); + ret = meth->bn_mod_exp(r, a, p, m, ctx, in_mont); + + } else if (ECANCELED == kop.crk_status) { + const RSA_METHOD *meth = RSA_PKCS1_SSLeay(); + printf("OCF hardware operation cancelled. Running in Software\n"); ret = meth->bn_mod_exp(r, a, p, m, ctx, in_mont); } + /* else cryptodev operation worked ok ==> ret = 1*/ + err: zapparams(&kop); return (ret); @@ -801,10 +809,18 @@ cryptodev_rsa_mod_exp(BIGNUM *r0, const goto err; kop.crk_iparams = 6; - if (cryptodev_asym(&kop, BN_num_bytes(rsa->n), r0, 0, NULL) == -1) { + if (cryptodev_asym(&kop, BN_num_bytes(rsa->n), r0, 0, NULL)) { const RSA_METHOD *meth = RSA_PKCS1_SSLeay(); + printf("OCF asym process failed, running in Software\n"); + ret = (*meth->rsa_mod_exp)(r0, I, rsa, ctx); + + } else if (ECANCELED == kop.crk_status) { + const RSA_METHOD *meth = RSA_PKCS1_SSLeay(); + printf("OCF hardware operation cancelled. Running in Software\n"); ret = (*meth->rsa_mod_exp)(r0, I, rsa, ctx); } + /* else cryptodev operation worked ok ==> ret = 1*/ + err: zapparams(&kop); return (ret); @@ -940,7 +956,8 @@ cryptodev_dsa_verify(const unsigned char kop.crk_iparams = 7; if (cryptodev_asym(&kop, 0, NULL, 0, NULL) == 0) { - dsaret = kop.crk_status; +/*OCF success value is 0, if not zero, change dsaret to fail*/ + if(0 != kop.crk_status) dsaret = 0; } else { const DSA_METHOD *meth = DSA_OpenSSL(); Modified: vendor-crypto/openssl/dist/crypto/evp/digest.c ============================================================================== --- vendor-crypto/openssl/dist/crypto/evp/digest.c Thu Apr 1 12:18:44 2010 (r206034) +++ vendor-crypto/openssl/dist/crypto/evp/digest.c Thu Apr 1 12:25:40 2010 (r206035) @@ -235,6 +235,7 @@ static int do_evp_md_engine(EVP_MD_CTX * { /* Same comment from evp_enc.c */ EVPerr(EVP_F_DO_EVP_MD_ENGINE,EVP_R_INITIALIZATION_ERROR); + ENGINE_finish(impl); return 0; } /* We'll use the ENGINE's private digest definition */ Modified: vendor-crypto/openssl/dist/crypto/evp/evp_locl.h ============================================================================== --- vendor-crypto/openssl/dist/crypto/evp/evp_locl.h Thu Apr 1 12:18:44 2010 (r206034) +++ vendor-crypto/openssl/dist/crypto/evp/evp_locl.h Thu Apr 1 12:25:40 2010 (r206035) @@ -127,9 +127,9 @@ BLOCK_CIPHER_def1(cname, cbc, cbc, CBC, #define BLOCK_CIPHER_def_cfb(cname, kstruct, nid, key_len, \ iv_len, cbits, flags, init_key, cleanup, \ set_asn1, get_asn1, ctrl) \ -BLOCK_CIPHER_def1(cname, cfb##cbits, cfb##cbits, CFB, kstruct, nid, \ - (cbits + 7)/8, key_len, iv_len, \ - flags, init_key, cleanup, set_asn1, get_asn1, ctrl) +BLOCK_CIPHER_def1(cname, cfb##cbits, cfb##cbits, CFB, kstruct, nid, 1, \ + key_len, iv_len, flags, init_key, cleanup, set_asn1, \ + get_asn1, ctrl) #define BLOCK_CIPHER_def_ofb(cname, kstruct, nid, key_len, \ iv_len, cbits, flags, init_key, cleanup, \ Modified: vendor-crypto/openssl/dist/crypto/evp/names.c ============================================================================== --- vendor-crypto/openssl/dist/crypto/evp/names.c Thu Apr 1 12:18:44 2010 (r206034) +++ vendor-crypto/openssl/dist/crypto/evp/names.c Thu Apr 1 12:25:40 2010 (r206035) @@ -90,7 +90,7 @@ int EVP_add_digest(const EVP_MD *md) r=OBJ_NAME_add(OBJ_nid2ln(md->type),OBJ_NAME_TYPE_MD_METH,(const char *)md); if (r == 0) return(0); - if (md->type != md->pkey_type) + if (md->pkey_type && md->type != md->pkey_type) { r=OBJ_NAME_add(OBJ_nid2sn(md->pkey_type), OBJ_NAME_TYPE_MD_METH|OBJ_NAME_ALIAS,name); Modified: vendor-crypto/openssl/dist/crypto/md32_common.h ============================================================================== --- vendor-crypto/openssl/dist/crypto/md32_common.h Thu Apr 1 12:18:44 2010 (r206034) +++ vendor-crypto/openssl/dist/crypto/md32_common.h Thu Apr 1 12:25:40 2010 (r206035) @@ -241,11 +241,11 @@ #ifndef PEDANTIC # if defined(__GNUC__) && __GNUC__>=2 && !defined(OPENSSL_NO_ASM) && !defined(OPENSSL_NO_INLINE_ASM) # if defined(__s390x__) -# define HOST_c2l(c,l) ({ asm ("lrv %0,0(%1)" \ - :"=r"(l) : "r"(c)); \ +# define HOST_c2l(c,l) ({ asm ("lrv %0,%1" \ + :"=d"(l) :"m"(*(const unsigned int *)(c));\ (c)+=4; (l); }) -# define HOST_l2c(l,c) ({ asm ("strv %0,0(%1)" \ - : : "r"(l),"r"(c) : "memory"); \ +# define HOST_l2c(l,c) ({ asm ("strv %1,%0" \ + :"=m"(*(unsigned int *)(c)) :"d"(l));\ (c)+=4; (l); }) # endif # endif Modified: vendor-crypto/openssl/dist/crypto/ocsp/ocsp_prn.c ============================================================================== --- vendor-crypto/openssl/dist/crypto/ocsp/ocsp_prn.c Thu Apr 1 12:18:44 2010 (r206034) +++ vendor-crypto/openssl/dist/crypto/ocsp/ocsp_prn.c Thu Apr 1 12:25:40 2010 (r206035) @@ -275,6 +275,7 @@ int OCSP_RESPONSE_print(BIO *bp, OCSP_RE } if (!X509V3_extensions_print(bp, "Response Extensions", rd->responseExtensions, flags, 4)) + goto err; if(X509_signature_print(bp, br->signatureAlgorithm, br->signature) <= 0) goto err; Modified: vendor-crypto/openssl/dist/crypto/opensslv.h ============================================================================== --- vendor-crypto/openssl/dist/crypto/opensslv.h Thu Apr 1 12:18:44 2010 (r206034) +++ vendor-crypto/openssl/dist/crypto/opensslv.h Thu Apr 1 12:25:40 2010 (r206035) @@ -25,11 +25,11 @@ * (Prior to 0.9.5a beta1, a different scheme was used: MMNNFFRBB for * major minor fix final patch/beta) */ -#define OPENSSL_VERSION_NUMBER 0x009080dfL +#define OPENSSL_VERSION_NUMBER 0x009080efL #ifdef OPENSSL_FIPS -#define OPENSSL_VERSION_TEXT "OpenSSL 0.9.8m-fips 25 Feb 2010" +#define OPENSSL_VERSION_TEXT "OpenSSL 0.9.8n-fips 24 Mar 2010" #else -#define OPENSSL_VERSION_TEXT "OpenSSL 0.9.8m 25 Feb 2010" +#define OPENSSL_VERSION_TEXT "OpenSSL 0.9.8n 24 Mar 2010" #endif #define OPENSSL_VERSION_PTEXT " part of " OPENSSL_VERSION_TEXT Modified: vendor-crypto/openssl/dist/crypto/rand/rand_win.c ============================================================================== --- vendor-crypto/openssl/dist/crypto/rand/rand_win.c Thu Apr 1 12:18:44 2010 (r206034) +++ vendor-crypto/openssl/dist/crypto/rand/rand_win.c Thu Apr 1 12:25:40 2010 (r206035) @@ -750,7 +750,7 @@ static void readscreen(void) int y; /* y-coordinate of screen lines to grab */ int n = 16; /* number of screen lines to grab at a time */ - if (GetVersion() >= 0x80000000 || !OPENSSL_isservice()) + if (GetVersion() < 0x80000000 && OPENSSL_isservice()>0) return; /* Create a screen DC and a memory DC compatible to screen DC */ Modified: vendor-crypto/openssl/dist/engines/e_capi.c ============================================================================== --- vendor-crypto/openssl/dist/engines/e_capi.c Thu Apr 1 12:18:44 2010 (r206034) +++ vendor-crypto/openssl/dist/engines/e_capi.c Thu Apr 1 12:25:40 2010 (r206035) @@ -83,6 +83,10 @@ #define CERT_STORE_CREATE_NEW_FLAG 0x00002000 #endif +#ifndef CERT_SYSTEM_STORE_CURRENT_USER +#define CERT_SYSTEM_STORE_CURRENT_USER 0x00010000 +#endif + #include #include #include Modified: vendor-crypto/openssl/dist/engines/e_chil.c ============================================================================== --- vendor-crypto/openssl/dist/engines/e_chil.c Thu Apr 1 12:18:44 2010 (r206034) +++ vendor-crypto/openssl/dist/engines/e_chil.c Thu Apr 1 12:25:40 2010 (r206035) @@ -1204,6 +1204,11 @@ static int hwcrhk_get_pass(const char *p pem_password_cb *callback = NULL; void *callback_data = NULL; UI_METHOD *ui_method = NULL; + /* Despite what the documentation says prompt_info can be + * an empty string. + */ + if (prompt_info && !*prompt_info) + prompt_info = NULL; if (cactx) { @@ -1305,8 +1310,10 @@ static int hwcrhk_insert_card(const char { char answer; char buf[BUFSIZ]; - - if (wrong_info) + /* Despite what the documentation says wrong_info can be + * an empty string. + */ + if (wrong_info && *wrong_info) BIO_snprintf(buf, sizeof(buf)-1, "Current card: \"%s\"\n", wrong_info); ok = UI_dup_info_string(ui, buf); Modified: vendor-crypto/openssl/dist/fips/Makefile ============================================================================== --- vendor-crypto/openssl/dist/fips/Makefile Thu Apr 1 12:18:44 2010 (r206034) +++ vendor-crypto/openssl/dist/fips/Makefile Thu Apr 1 12:25:40 2010 (r206035) @@ -123,7 +123,7 @@ fips_premain_dso$(EXE_EXT): fips_premain $(FIPSLIBDIR)fipscanister.o ../libcrypto.a $(EX_LIBS) # this is executed only when linking with external fipscanister.o fips_standalone_sha1$(EXE_EXT): sha/fips_standalone_sha1.c - if [ -z $(HOSTCC) ] ; then \ + if [ -z "$(HOSTCC)" ] ; then \ $(CC) $(CFLAGS) -DFIPSCANISTER_O -o $@ sha/fips_standalone_sha1.c $(FIPSLIBDIR)fipscanister.o $(EX_LIBS) ; \ else \ $(HOSTCC) $(HOSTCFLAGS) -o $ $@ -I../include -I../crypto sha/fips_standalone_sha1.c ../crypto/sha/sha1dgst.c ; \ Modified: vendor-crypto/openssl/dist/openssl.spec ============================================================================== --- vendor-crypto/openssl/dist/openssl.spec Thu Apr 1 12:18:44 2010 (r206034) +++ vendor-crypto/openssl/dist/openssl.spec Thu Apr 1 12:25:40 2010 (r206035) @@ -2,7 +2,7 @@ %define libmaj 0 %define libmin 9 %define librel 8 -%define librev m +%define librev n Release: 1 %define openssldir /var/ssl Modified: vendor-crypto/openssl/dist/ssl/kssl.c ============================================================================== --- vendor-crypto/openssl/dist/ssl/kssl.c Thu Apr 1 12:18:44 2010 (r206034) +++ vendor-crypto/openssl/dist/ssl/kssl.c Thu Apr 1 12:25:40 2010 (r206035) @@ -1802,6 +1802,9 @@ kssl_ctx_show(KSSL_CTX *kssl_ctx) kssl_ctx->service_name ? kssl_ctx->service_name: KRB5SVC, KRB5_NT_SRV_HST, &princ); + if (krb5rc) + goto exit; + krb5rc = krb5_kt_get_entry(krb5context, krb5keytab, princ, 0 /* IGNORE_VNO */, Modified: vendor-crypto/openssl/dist/ssl/s3_pkt.c ============================================================================== --- vendor-crypto/openssl/dist/ssl/s3_pkt.c Thu Apr 1 12:18:44 2010 (r206034) +++ vendor-crypto/openssl/dist/ssl/s3_pkt.c Thu Apr 1 12:25:40 2010 (r206035) @@ -291,9 +291,9 @@ again: if (version != s->version) { SSLerr(SSL_F_SSL3_GET_RECORD,SSL_R_WRONG_VERSION_NUMBER); - /* Send back error using their - * version number :-) */ - s->version=version; + if ((s->version & 0xFF00) == (version & 0xFF00)) + /* Send back error using their minor version number :-) */ + s->version = (unsigned short)version; al=SSL_AD_PROTOCOL_VERSION; goto f_err; }