openssl upgrade

deleted file mode 100644
index 39592e2..0000000
@@ -1,81 +0,0 @@
-From 34628967f1e65dc8f34e000f0f5518e21afbfc7b Mon Sep 17 00:00:00 2001
-From: "Dr. Stephen Henson" <[email protected]>
-Date: Fri, 20 Dec 2013 15:26:50 +0000
-Subject: [PATCH] Fix DTLS retransmission from previous session.
-
-Upstream-Status: Backport
-commit 34628967f1e65dc8f34e000f0f5518e21afbfc7b upstream
-
-For DTLS we might need to retransmit messages from the previous session
-so keep a copy of write context in DTLS retransmission buffers instead
-of replacing it after sending CCS. CVE-2013-6450.
----
- ssl/d1_both.c  |    6 ++++++
- ssl/ssl_locl.h |    2 ++
- ssl/t1_enc.c   |   17 +++++++++++------
- 4 files changed, 24 insertions(+), 6 deletions(-)
-
-diff --git a/ssl/d1_both.c b/ssl/d1_both.c
-index 65ec001..7a5596a 100644
---- a/ssl/d1_both.c
-+++ b/ssl/d1_both.c
-@@ -214,6 +214,12 @@ dtls1_hm_fragment_new(unsigned long frag_len, int reassembly)
- static void
- dtls1_hm_fragment_free(hm_fragment *frag)
- 	{
-+
-+	if (frag->msg_header.is_ccs)
-+		{
-+		EVP_CIPHER_CTX_free(frag->msg_header.saved_retransmit_state.enc_write_ctx);
-+		EVP_MD_CTX_destroy(frag->msg_header.saved_retransmit_state.write_hash);
-+		}
- 	if (frag->fragment) OPENSSL_free(frag->fragment);
- 	if (frag->reassembly) OPENSSL_free(frag->reassembly);
- 	OPENSSL_free(frag);
-diff --git a/ssl/ssl_locl.h b/ssl/ssl_locl.h
-index 96ce9a7..e485907 100644
---- a/ssl/ssl_locl.h
-+++ b/ssl/ssl_locl.h
-@@ -621,6 +621,8 @@ extern SSL3_ENC_METHOD TLSv1_enc_data;
- extern SSL3_ENC_METHOD SSLv3_enc_data;
- extern SSL3_ENC_METHOD DTLSv1_enc_data;
- 
-+#define SSL_IS_DTLS(s) (s->method->version == DTLS1_VERSION)
-+
- #define IMPLEMENT_tls_meth_func(version, func_name, s_accept, s_connect, \
- 				s_get_meth) \
- const SSL_METHOD *func_name(void)  \
-diff --git a/ssl/t1_enc.c b/ssl/t1_enc.c
-index 72015f5..56db834 100644
---- a/ssl/t1_enc.c
-+++ b/ssl/t1_enc.c
-@@ -414,15 +414,20 @@ int tls1_change_cipher_state(SSL *s, int which)
- 			s->mac_flags |= SSL_MAC_FLAG_WRITE_MAC_STREAM;
- 			else
- 			s->mac_flags &= ~SSL_MAC_FLAG_WRITE_MAC_STREAM;
--		if (s->enc_write_ctx != NULL)
-+		if (s->enc_write_ctx != NULL && !SSL_IS_DTLS(s))
- 			reuse_dd = 1;
--		else if ((s->enc_write_ctx=OPENSSL_malloc(sizeof(EVP_CIPHER_CTX))) == NULL)
-+		else if ((s->enc_write_ctx=EVP_CIPHER_CTX_new()) == NULL)
- 			goto err;
--		else
--			/* make sure it's intialized in case we exit later with an error */
--			EVP_CIPHER_CTX_init(s->enc_write_ctx);
- 		dd= s->enc_write_ctx;
--		mac_ctx = ssl_replace_hash(&s->write_hash,NULL);
-+		if (SSL_IS_DTLS(s))
-+			{
-+			mac_ctx = EVP_MD_CTX_create();
-+			if (!mac_ctx)
-+				goto err;
-+			s->write_hash = mac_ctx;
-+			}
-+		else
-+			mac_ctx = ssl_replace_hash(&s->write_hash,NULL);
- #ifndef OPENSSL_NO_COMP
- 		if (s->compress != NULL)
- 			{
--- 
-1.7.5.4
-

deleted file mode 100644
index d03dc06..0000000
@@ -1,31 +0,0 @@
-From 197e0ea817ad64820789d86711d55ff50d71f631 Mon Sep 17 00:00:00 2001
-From: "Dr. Stephen Henson" <[email protected]>
-Date: Mon, 6 Jan 2014 14:35:04 +0000
-Subject: [PATCH] Fix for TLS record tampering bug CVE-2013-4353
-
-Upstream-Status: Backport
-commit 197e0ea817ad64820789d86711d55ff50d71f631 upstream
-
- ssl/s3_both.c |    6 +++++-
- 3 files changed, 11 insertions(+), 1 deletions(-)
-
-diff --git a/ssl/s3_both.c b/ssl/s3_both.c
-index 1e5dcab..53b9390 100644
---- a/ssl/s3_both.c
-+++ b/ssl/s3_both.c
-@@ -210,7 +210,11 @@ static void ssl3_take_mac(SSL *s)
- 	{
- 	const char *sender;
- 	int slen;
--
-+	/* If no new cipher setup return immediately: other functions will
-+	 * set the appropriate error.
-+	 */
-+	if (s->s3->tmp.new_cipher == NULL)
-+		return;
- 	if (s->state & SSL_ST_CONNECT)
- 		{
- 		sender=s->method->ssl3_enc->server_finished_label;
--- 
-1.7.5.4
-

deleted file mode 100644
index e5a8ade..0000000
@@ -1,33 +0,0 @@
-From ca989269a2876bae79393bd54c3e72d49975fc75 Mon Sep 17 00:00:00 2001
-From: "Dr. Stephen Henson" <[email protected]>
-Date: Thu, 19 Dec 2013 14:37:39 +0000
-Subject: [PATCH] Use version in SSL_METHOD not SSL structure.
-
-Upstream-Status: Backport
-commit ca989269a2876bae79393bd54c3e72d49975fc75 upstream
-
-When deciding whether to use TLS 1.2 PRF and record hash algorithms
-use the version number in the corresponding SSL_METHOD structure
-instead of the SSL structure. The SSL structure version is sometimes
-inaccurate. Note: OpenSSL 1.0.2 and later effectively do this already.
-(CVE-2013-6449)
----
- ssl/s3_lib.c |    2 +-
- 1 files changed, 1 insertions(+), 1 deletions(-)
-
-diff --git a/ssl/s3_lib.c b/ssl/s3_lib.c
-index bf832bb..c4ef273 100644
---- a/ssl/s3_lib.c
-+++ b/ssl/s3_lib.c
-@@ -4286,7 +4286,7 @@ need to go to SSL_ST_ACCEPT.
- long ssl_get_algorithm2(SSL *s)
- 	{
- 	long alg2 = s->s3->tmp.new_cipher->algorithm2;
--	if (TLS1_get_version(s) >= TLS1_2_VERSION &&
-+	if (s->method->version == TLS1_2_VERSION &&
- 	    alg2 == (SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF))
- 		return SSL_HANDSHAKE_MAC_SHA256 | TLS1_PRF_SHA256;
- 	return alg2;
--- 
-1.7.5.4
-

index e924914..ee02fb7 100644
@@ -4,9 +4,6 @@ HOMEPAGE = "http://www.openssl.org/"
 BUGTRACKER = "http://www.openssl.org/news/vulnerabilities.html"
 SECTION = "libs/network"
 
-# Big Jump for OpenSSL 1.0 support with meta-oe
-INC_PR = "r15"
-
 # "openssl | SSLeay" dual license
 LICENSE = "openssl"
 LIC_FILES_CHKSUM = "file://LICENSE;md5=f9a8f968107345e0b75aa8c2ecaa7ec8"

similarity index 100%
rename from meta/recipes-connectivity/openssl/openssl-1.0.1e/configure-targets.patch
rename to meta/recipes-connectivity/openssl/openssl/configure-targets.patch

similarity index 100%
rename from meta/recipes-connectivity/openssl/openssl-1.0.1e/debian/c_rehash-compat.patch
rename to meta/recipes-connectivity/openssl/openssl/debian/c_rehash-compat.patch

similarity index 100%
rename from meta/recipes-connectivity/openssl/openssl-1.0.1e/debian/ca.patch
rename to meta/recipes-connectivity/openssl/openssl/debian/ca.patch

similarity index 100%
rename from meta/recipes-connectivity/openssl/openssl-1.0.1e/debian/debian-targets.patch
rename to meta/recipes-connectivity/openssl/openssl/debian/debian-targets.patch

similarity index 100%
rename from meta/recipes-connectivity/openssl/openssl-1.0.1e/debian/make-targets.patch
rename to meta/recipes-connectivity/openssl/openssl/debian/make-targets.patch

similarity index 100%
rename from meta/recipes-connectivity/openssl/openssl-1.0.1e/debian/man-dir.patch
rename to meta/recipes-connectivity/openssl/openssl/debian/man-dir.patch

similarity index 100%
rename from meta/recipes-connectivity/openssl/openssl-1.0.1e/debian/man-section.patch
rename to meta/recipes-connectivity/openssl/openssl/debian/man-section.patch

similarity index 100%
rename from meta/recipes-connectivity/openssl/openssl-1.0.1e/debian/no-rpath.patch
rename to meta/recipes-connectivity/openssl/openssl/debian/no-rpath.patch

similarity index 100%
rename from meta/recipes-connectivity/openssl/openssl-1.0.1e/debian/no-symbolic.patch
rename to meta/recipes-connectivity/openssl/openssl/debian/no-symbolic.patch

similarity index 100%
rename from meta/recipes-connectivity/openssl/openssl-1.0.1e/debian/pic.patch
rename to meta/recipes-connectivity/openssl/openssl/debian/pic.patch

similarity index 100%
rename from meta/recipes-connectivity/openssl/openssl-1.0.1e/debian/version-script.patch
rename to meta/recipes-connectivity/openssl/openssl/debian/version-script.patch

similarity index 100%
rename from meta/recipes-connectivity/openssl/openssl-1.0.1e/engines-install-in-libdir-ssl.patch
rename to meta/recipes-connectivity/openssl/openssl/engines-install-in-libdir-ssl.patch

similarity index 100%
rename from meta/recipes-connectivity/openssl/openssl-1.0.1e/find.pl
rename to meta/recipes-connectivity/openssl/openssl/find.pl

similarity index 100%
rename from meta/recipes-connectivity/openssl/openssl-1.0.1e/fix-cipher-des-ede3-cfb1.patch
rename to meta/recipes-connectivity/openssl/openssl/fix-cipher-des-ede3-cfb1.patch

156 lines not on this page · raw message

similarity index 100%
rename from meta/recipes-connectivity/openssl/openssl-1.0.1e/oe-ldflags.patch
rename to meta/recipes-connectivity/openssl/openssl/oe-ldflags.patch

similarity index 100%
rename from meta/recipes-connectivity/openssl/openssl-1.0.1e/openssl-avoid-NULL-pointer-dereference-in-EVP_DigestInit_ex.patch
rename to meta/recipes-connectivity/openssl/openssl/openssl-avoid-NULL-pointer-dereference-in-EVP_DigestInit_ex.patch

similarity index 100%
rename from meta/recipes-connectivity/openssl/openssl-1.0.1e/openssl-avoid-NULL-pointer-dereference-in-dh_pub_encode.patch
rename to meta/recipes-connectivity/openssl/openssl/openssl-avoid-NULL-pointer-dereference-in-dh_pub_encode.patch

similarity index 100%
rename from meta/recipes-connectivity/openssl/openssl-1.0.1e/openssl-fix-des.pod-error.patch
rename to meta/recipes-connectivity/openssl/openssl/openssl-fix-des.pod-error.patch

417 lines not on this page · raw message

similarity index 100%
rename from meta/recipes-connectivity/openssl/openssl-1.0.1e/openssl-fix-link.patch
rename to meta/recipes-connectivity/openssl/openssl/openssl-fix-link.patch

similarity index 100%
rename from meta/recipes-connectivity/openssl/openssl-1.0.1e/openssl_fix_for_x32.patch
rename to meta/recipes-connectivity/openssl/openssl/openssl_fix_for_x32.patch

similarity index 100%
rename from meta/recipes-connectivity/openssl/openssl-1.0.1e/shared-libs.patch
rename to meta/recipes-connectivity/openssl/openssl/shared-libs.patch

similarity index 81%
rename from meta/recipes-connectivity/openssl/openssl_1.0.1e.bb
rename to meta/recipes-connectivity/openssl/openssl_1.0.1g.bb
index 618ba68..f3c20e8 100644
@@ -6,8 +6,6 @@ DEPENDS += "cryptodev-linux"
 
 CFLAG += "-DHAVE_CRYPTODEV -DUSE_CRYPTODEV_DIGESTS"
 
-PR = "${INC_PR}.0"
-
 LIC_FILES_CHKSUM = "file://LICENSE;md5=f9a8f968107345e0b75aa8c2ecaa7ec8"
 
 export DIRS = "crypto ssl apps engines"

@@ -36,13 +34,10 @@ SRC_URI += "file://configure-targets.patch \
             file://initial-aarch64-bits.patch \
             file://find.pl \
             file://openssl-fix-des.pod-error.patch \
-            file://0001-Fix-for-TLS-record-tampering-bug-CVE-2013-4353.patch \
-            file://0001-Fix-DTLS-retransmission-from-previous-session.patch \
-            file://0001-Use-version-in-SSL_METHOD-not-SSL-structure.patch \
            "
 
-SRC_URI[md5sum] = "66bf6f10f060d561929de96f9dfe5b8c"
-SRC_URI[sha256sum] = "f74f15e8c8ff11aa3d5bb5f276d202ec18d7246e95f961db76054199c69c1ae3"
+SRC_URI[md5sum] = "de62b43dfcd858e66a74bee1c834e959"
+SRC_URI[sha256sum] = "53cb818c3b90e507a8348f4f5eaedb05d8bfe5358aabb508b7263cc670c3e028"
 
 PACKAGES =+ " \
 	${PN}-engines \