Security update

7 files changed, 284 insertions, 1 deletions

diff --git a/dev-libs/openssl/ChangeLog b/dev-libs/openssl/ChangeLog
index 36d5077e1bad..51ccad7a13ad 100644
--- a/dev-libs/openssl/ChangeLog
+++ b/dev-libs/openssl/ChangeLog
@@ -1,6 +1,16 @@
 # ChangeLog for dev-libs/openssl
 # Copyright 2002-2003 Gentoo Technologies, Inc.; Distributed under the GPL v2
-# $Header: /var/cvsroot/gentoo-x86/dev-libs/openssl/ChangeLog,v 1.32 2003/03/19 09:26:09 aliz Exp $
+# $Header: /var/cvsroot/gentoo-x86/dev-libs/openssl/ChangeLog,v 1.33 2003/03/24 10:29:46 aliz Exp $
+
+*openssl-0.9.6i-r2 (24 Mar 2003)
+
+  19 Mar 2003; Daniel Ahlberg <aliz@gentoo.org> :
+  Security update. Added patch against Klima-Pokorny-Rosa attack.
+
+*openssl-0.9.7a-r2 (24 Mar 2003)
+
+  19 Mar 2003; Daniel Ahlberg <aliz@gentoo.org> :
+  Security update. Added patch against Klima-Pokorny-Rosa attack.
 
 *openssl-0.9.6i-r1 (19 Mar 2003)
 
diff --git a/dev-libs/openssl/files/digest-openssl-0.9.6i-r2 b/dev-libs/openssl/files/digest-openssl-0.9.6i-r2
new file mode 100644
index 000000000000..145478a9699f
--- /dev/null
+++ b/dev-libs/openssl/files/digest-openssl-0.9.6i-r2
@@ -0,0 +1 @@
+MD5 9c4db437c17e0b6412c5e4645b6fcf5c openssl-0.9.6i.tar.gz 2179559
diff --git a/dev-libs/openssl/files/digest-openssl-0.9.7a-r2 b/dev-libs/openssl/files/digest-openssl-0.9.7a-r2
new file mode 100644
index 000000000000..60ac183e3e6d
--- /dev/null
+++ b/dev-libs/openssl/files/digest-openssl-0.9.7a-r2
@@ -0,0 +1 @@
+MD5 a0d3203ecf10989fdc61c784ae82e531 openssl-0.9.7a.tar.gz 2776582
diff --git a/dev-libs/openssl/files/openssl-0.9.6i-klima_pokorny_rosa_attack.patch b/dev-libs/openssl/files/openssl-0.9.6i-klima_pokorny_rosa_attack.patch
new file mode 100644
index 000000000000..d43c9a090a72
--- /dev/null
+++ b/dev-libs/openssl/files/openssl-0.9.6i-klima_pokorny_rosa_attack.patch
@@ -0,0 +1,53 @@
+--- ssl/s3_srvr.c	29 Nov 2002 11:31:51 -0000	1.85.2.14
++++ ssl/s3_srvr.c	19 Mar 2003 18:00:00 -0000
+@@ -1447,7 +1447,7 @@
+ 		if (i != SSL_MAX_MASTER_KEY_LENGTH)
+ 			{
+ 			al=SSL_AD_DECODE_ERROR;
+-			SSLerr(SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE,SSL_R_BAD_RSA_DECRYPT);
++			/* SSLerr(SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE,SSL_R_BAD_RSA_DECRYPT); */
+ 			}
+
+ 		if ((al == -1) && !((p[0] == (s->client_version>>8)) && (p[1] == (s->client_version & 0xff))))
+@@ -1463,30 +1463,29 @@
+ 				(p[0] == (s->version>>8)) && (p[1] == (s->version & 0xff))))
+ 				{
+ 				al=SSL_AD_DECODE_ERROR;
+-				SSLerr(SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE,SSL_R_BAD_PROTOCOL_VERSION_NUMBER);
+-				goto f_err;
++				/* SSLerr(SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE,SSL_R_BAD_PROTOCOL_VERSION_NUMBER); */
++
++				/* The Klima-Pokorny-Rosa extension of Bleichenbacher's attack
++				 * (http://eprint.iacr.org/2003/052/) exploits the version
++				 * number check as a "bad version oracle" -- an alert would
++				 * reveal that the plaintext corresponding to some ciphertext
++				 * made up by the adversary is properly formatted except
++				 * that the version number is wrong.  To avoid such attacks,
++				 * we should treat this just like any other decryption error. */
++				p[0] = (char)(int) "CAN-2003-0131 patch 2003-03-19";
+ 				}
+ 			}
+
+ 		if (al != -1)
+ 			{
+-#if 0
+-			goto f_err;
+-#else
+ 			/* Some decryption failure -- use random value instead as countermeasure
+ 			 * against Bleichenbacher's attack on PKCS #1 v1.5 RSA padding
+-			 * (see RFC 2246, section 7.4.7.1).
+-			 * But note that due to length and protocol version checking, the
+-			 * attack is impractical anyway (see section 5 in D. Bleichenbacher:
+-			 * "Chosen Ciphertext Attacks Against Protocols Based on the RSA
+-			 * Encryption Standard PKCS #1", CRYPTO '98, LNCS 1462, pp. 1-12).
+-			 */
++			 * (see RFC 2246, section 7.4.7.1). */
+ 			ERR_clear_error();
+ 			i = SSL_MAX_MASTER_KEY_LENGTH;
+ 			p[0] = s->client_version >> 8;
+ 			p[1] = s->client_version & 0xff;
+ 			RAND_pseudo_bytes(p+2, i-2); /* should be RAND_bytes, but we cannot work around a failure */
+-#endif
+ 			}
+
+ 		s->session->master_key_length=
diff --git a/dev-libs/openssl/files/openssl-0.9.7a-klima_pokorny_rosa_attack.patch b/dev-libs/openssl/files/openssl-0.9.7a-klima_pokorny_rosa_attack.patch
new file mode 100644
index 000000000000..d43c9a090a72
--- /dev/null
+++ b/dev-libs/openssl/files/openssl-0.9.7a-klima_pokorny_rosa_attack.patch
@@ -0,0 +1,53 @@
+--- ssl/s3_srvr.c	29 Nov 2002 11:31:51 -0000	1.85.2.14
++++ ssl/s3_srvr.c	19 Mar 2003 18:00:00 -0000
+@@ -1447,7 +1447,7 @@
+ 		if (i != SSL_MAX_MASTER_KEY_LENGTH)
+ 			{
+ 			al=SSL_AD_DECODE_ERROR;
+-			SSLerr(SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE,SSL_R_BAD_RSA_DECRYPT);
++			/* SSLerr(SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE,SSL_R_BAD_RSA_DECRYPT); */
+ 			}
+
+ 		if ((al == -1) && !((p[0] == (s->client_version>>8)) && (p[1] == (s->client_version & 0xff))))
+@@ -1463,30 +1463,29 @@
+ 				(p[0] == (s->version>>8)) && (p[1] == (s->version & 0xff))))
+ 				{
+ 				al=SSL_AD_DECODE_ERROR;
+-				SSLerr(SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE,SSL_R_BAD_PROTOCOL_VERSION_NUMBER);
+-				goto f_err;
++				/* SSLerr(SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE,SSL_R_BAD_PROTOCOL_VERSION_NUMBER); */
++
++				/* The Klima-Pokorny-Rosa extension of Bleichenbacher's attack
++				 * (http://eprint.iacr.org/2003/052/) exploits the version
++				 * number check as a "bad version oracle" -- an alert would
++				 * reveal that the plaintext corresponding to some ciphertext
++				 * made up by the adversary is properly formatted except
++				 * that the version number is wrong.  To avoid such attacks,
++				 * we should treat this just like any other decryption error. */
++				p[0] = (char)(int) "CAN-2003-0131 patch 2003-03-19";
+ 				}
+ 			}
+
+ 		if (al != -1)
+ 			{
+-#if 0
+-			goto f_err;
+-#else
+ 			/* Some decryption failure -- use random value instead as countermeasure
+ 			 * against Bleichenbacher's attack on PKCS #1 v1.5 RSA padding
+-			 * (see RFC 2246, section 7.4.7.1).
+-			 * But note that due to length and protocol version checking, the
+-			 * attack is impractical anyway (see section 5 in D. Bleichenbacher:
+-			 * "Chosen Ciphertext Attacks Against Protocols Based on the RSA
+-			 * Encryption Standard PKCS #1", CRYPTO '98, LNCS 1462, pp. 1-12).
+-			 */
++			 * (see RFC 2246, section 7.4.7.1). */
+ 			ERR_clear_error();
+ 			i = SSL_MAX_MASTER_KEY_LENGTH;
+ 			p[0] = s->client_version >> 8;
+ 			p[1] = s->client_version & 0xff;
+ 			RAND_pseudo_bytes(p+2, i-2); /* should be RAND_bytes, but we cannot work around a failure */
+-#endif
+ 			}
+
+ 		s->session->master_key_length=
diff --git a/dev-libs/openssl/openssl-0.9.6i-r2.ebuild b/dev-libs/openssl/openssl-0.9.6i-r2.ebuild
new file mode 100644
index 000000000000..6b56af72ecd1
--- /dev/null
+++ b/dev-libs/openssl/openssl-0.9.6i-r2.ebuild
@@ -0,0 +1,86 @@
+# Copyright 1999-2003 Gentoo Technologies, Inc.
+# Distributed under the terms of the GNU General Public License v2
+# $Header: /var/cvsroot/gentoo-x86/dev-libs/openssl/openssl-0.9.6i-r2.ebuild,v 1.1 2003/03/24 10:29:46 aliz Exp $
+
+inherit eutils
+
+S=${WORKDIR}/${P}
+DESCRIPTION="Toolkit for SSL v2/v3 and TLS v1"
+SRC_URI="http://www.openssl.org/source/${P}.tar.gz"
+HOMEPAGE="http://www.openssl.org/"
+
+RDEPEND="virtual/glibc"
+DEPEND="${RDEPEND} >=dev-lang/perl-5"
+LICENSE="as-is"
+SLOT="0"
+KEYWORDS="x86 ppc alpha sparc mips hppa arm"
+IUSE=""
+
+if [ "$PROFILE_ARCH" = "sparc" -a "`uname -m`" = "sparc64" ]; then
+	SSH_TARGET="linux-sparcv8"
+fi
+
+src_unpack() {
+	unpack ${A} ; cd ${S}
+	
+	epatch ${FILESDIR}/${P}-klima_pokorny_rosa_attack.patch
+	epatch ${FILESDIR}/${P}-blinding.patch
+	epatch ${FILESDIR}/${P}-gentoo.diff
+
+	if [ "${ARCH}" = "mips" ]
+	then
+		cd ${S}
+		epatch ${FILESDIR}/openssl-0.9.6-mips.diff
+	fi
+
+	if [ "${ARCH}" = "arm" ]; then
+		# patch linker to add -ldl or things linking aginst libcrypto fail
+		sed -e \
+			's!^"linux-elf-arm"\(.*\)::BN\(.*\)!"linux-elf-arm"\1:-ldl:BN\2!' \
+			Configure > Configure.orig
+	elif [ "${ARCH}" = "hppa" ]; then
+		sed -e \
+		's!^"linux-parisc"\(.*\)::BN\(.*\)::!"linux-parisc"\1:-ldl:BN\2::::::::::dlfcn:linux-shared:-fPIC::.so.\\$(SHLIB_MAJOR).\\$(SHLIB_MINOR)!' \
+			Configure > Configure.orig
+	else
+		cp Configure Configure.orig
+	fi
+	sed -e "s/-O3/$CFLAGS/" -e "s/-m486//" Configure.orig > Configure
+}
+
+src_compile() {
+	if [ ${SSH_TARGET} ]; then
+		einfo "Forcing ${SSH_TARGET} compile"
+		./Configure ${SSH_TARGET} --prefix=/usr \
+			--openssldir=/etc/ssl shared threads || die
+	else
+		./config --prefix=/usr --openssldir=/etc/ssl shared threads || die
+	fi
+	# i think parallel make has problems
+	make all || die
+}
+
+src_install() {
+	make INSTALL_PREFIX=${D} MANDIR=/usr/share/man install || die
+	dodoc CHANGES* FAQ LICENSE NEWS README
+	dodoc doc/*.txt
+	dohtml doc/*
+	insinto /usr/share/emacs/site-lisp
+	doins doc/c-indentation.el
+
+	# The man pages rand.3 and passwd.1 conflict with other packages
+	# Rename them to ssl-* and also make a symlink from openssl-* to ssl-*
+	cd ${D}/usr/share/man/man1
+	mv passwd.1 ssl-passwd.1
+	ln -sf ssl-passwd.1 openssl-passwd.1
+	cd ${D}/usr/share/man/man3
+	mv rand.3 ssl-rand.3
+	ln -sf ssl-rand.3 openssl-rand.3
+
+	# create the certs directory.  Previous openssl builds
+	# would need to create /usr/lib/ssl/certs but this looks
+	# to be the more FHS compliant setup... -raker
+	dodir /etc/ssl/certs
+
+}
+
diff --git a/dev-libs/openssl/openssl-0.9.7a-r2.ebuild b/dev-libs/openssl/openssl-0.9.7a-r2.ebuild
new file mode 100644
index 000000000000..43b609edf316
--- /dev/null
+++ b/dev-libs/openssl/openssl-0.9.7a-r2.ebuild
@@ -0,0 +1,79 @@
+# Copyright 1999-2003 Gentoo Technologies, Inc.
+# Distributed under the terms of the GNU General Public License v2
+# $Header: /var/cvsroot/gentoo-x86/dev-libs/openssl/openssl-0.9.7a-r2.ebuild,v 1.1 2003/03/24 10:29:46 aliz Exp $
+
+inherit eutils
+
+S=${WORKDIR}/${P}
+DESCRIPTION="Toolkit for SSL v2/v3 and TLS v1"
+SRC_URI="http://www.openssl.org/source/${P}.tar.gz"
+HOMEPAGE="http://www.openssl.org/"
+
+RDEPEND="virtual/glibc"
+DEPEND="${RDEPEND} >=dev-lang/perl-5"
+LICENSE="as-is"
+SLOT="0"
+KEYWORDS="~x86 ~ppc ~alpha ~sparc ~hppa"
+
+warning() {
+	ewarn "BIG FAT WARNING!!!"
+	ewarn "You must re-emerge every package that links to openssl after you have merged ${P}"
+	ewarn "This is becuse packages that links against ${PN} links against the full version"
+	ewarn "Also, if you don't have the sources for the packages you need to re-emerge you"
+	ewarn "should download them with emerge -f prior to the installation of ${P}."
+	ewarn "This is becuse wget may be linked against ${PN}."
+	ewarn "To generate a list of packages that links against ${PN} you can download"
+	ewarn "and run the script from http://cvs.gentoo.org/~aliz/openssl_update.sh"
+	ewarn "If you are using binary packages you need to rebuild those against the"
+	ewarn "new version of ${PN}"
+	sleep 10
+}
+
+src_unpack() {
+	warning
+	unpack ${A} ; cd ${S}
+
+	epatch ${FILESDIR}/${P}-klima_pokorny_rosa_attack.patch
+	epatch ${FILESDIR}/${P}-blinding.patch
+	epatch ${FILESDIR}/${P}-gentoo.diff
+
+	if [ "${ARCH}" = "hppa" ]; then
+	sed -e \
+	's!^"linux-parisc"\(.*\)::BN\(.*\)::!"linux-parisc"\1:-ldl:BN\2::::::::::dlfcn:linux-shared:-fPIC::.so.\\$(SHLIB_MAJOR).\\$(SHLIB_MINOR)!' \
+		Configure > Configure.orig
+	else
+		cp Configure Configure.orig
+	fi
+	sed -e "s/-O3/$CFLAGS/" -e "s/-m486//" Configure.orig > Configure
+}
+
+src_compile() {
+	./config --prefix=/usr --openssldir=/etc/ssl shared threads || die
+	# i think parallel make has problems
+	make all || die
+}
+
+src_install() {
+	make INSTALL_PREFIX=${D} MANDIR=/usr/share/man install || die
+	dodoc CHANGES* FAQ LICENSE NEWS README
+	dodoc doc/*.txt
+	dohtml doc/*
+	insinto /usr/share/emacs/site-lisp
+	doins doc/c-indentation.el
+
+	# The man pages rand.3 and passwd.1 conflict with other packages
+	# Rename them to ssl-* and also make a symlink from openssl-* to ssl-*
+	cd ${D}/usr/share/man/man1
+	mv passwd.1 ssl-passwd.1
+	ln -sf ssl-passwd.1 openssl-passwd.1
+	cd ${D}/usr/share/man/man3
+	mv rand.3 ssl-rand.3
+	ln -sf ssl-rand.3 openssl-rand.3
+
+	# create the certs directory.  Previous openssl builds
+	# would need to create /usr/lib/ssl/certs but this looks
+	# to be the more FHS compliant setup... -raker
+	dodir /etc/ssl/certs
+
+}
+