IPFire-SCM March 2010

ipfire-scm@lists.ipfire.org

1 participants
93 discussions

[IPFire-SCM] [git.ipfire.org] IPFire 2.x development tree branch, master, updated. fcaac741a528a9d7996ed93ba1da8befda721f6d
by git＠ipfire.org 28 Mar '10

28 Mar '10

1 0

[IPFire-SCM] [git.ipfire.org] IPFire 2.x development tree branch, core37, updated. fcaac741a528a9d7996ed93ba1da8befda721f6d
by git＠ipfire.org 28 Mar '10

28 Mar '10

This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "IPFire 2.x development tree". The branch, core37 has been updated via fcaac741a528a9d7996ed93ba1da8befda721f6d (commit) via c2b08c797435bea89ae259dd16ebea0507c17a63 (commit) via 461f6df8a5eb5135f1494be959deef2d1931d345 (commit) via 781adc6748ba064737717c88b2cc1374cd1128ce (commit) via 65e8619acc66087a71b2ba11ee6babf1b2f59d5c (commit) via f60723b6a1adc1aa59fa50b73edc18ec474be6b6 (commit) via 0d4e628e81a9a04f537ad70bbd7d5caeb0f421f4 (commit) from 7e576fa244388aef1199d481ab7557502fb8be53 (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit fcaac741a528a9d7996ed93ba1da8befda721f6d Author: Arne Fitzenreiter <arne_f(a)ipfire.org> Date: Sun Mar 28 16:13:42 2010 +0200 Add qos changes to core37. commit c2b08c797435bea89ae259dd16ebea0507c17a63 Author: Arne Fitzenreiter <arne_f(a)ipfire.org> Date: Sun Mar 28 16:13:15 2010 +0200 Fix update booster permissions. commit 461f6df8a5eb5135f1494be959deef2d1931d345 Author: Arne Fitzenreiter <arne_f(a)ipfire.org> Date: Sun Mar 28 16:11:48 2010 +0200 Fix permission change of existing directories at core updates. ----------------------------------------------------------------------- Summary of changes: config/rootfiles/core/37/filelists/files | 2 + config/rootfiles/core/37/update.sh | 4 + html/cgi-bin/qos.cgi | 92 +++++++++++++++--------------- html/cgi-bin/wlanap.cgi | 4 +- langs/de/cgi-bin/de.pl | 6 ++ langs/en/cgi-bin/en.pl | 7 ++ langs/fr/cgi-bin/fr.pl | 7 ++ src/pakfire/lib/functions.sh | 2 +- 8 files changed, 75 insertions(+), 49 deletions(-) mode change 100755 => 100644 html/cgi-bin/wlanap.cgi Difference in files: diff --git a/config/rootfiles/core/37/filelists/files b/config/rootfiles/core/37/filelists/files index 0946902..951fc81 100644 --- a/config/rootfiles/core/37/filelists/files +++ b/config/rootfiles/core/37/filelists/files @@ -15,9 +15,11 @@ srv/web/ipfire/cgi-bin/urlfilter.cgi srv/web/ipfire/cgi-bin/outgoingfw.cgi srv/web/ipfire/cgi-bin/remote.cgi srv/web/ipfire/cgi-bin/media.cgi +srv/web/ipfire/cgi-bin/qos.cgi srv/web/ipfire/cgi-bin/hardwaregraphs.cgi usr/local/bin/sshctrl var/ipfire/langs/de.pl var/ipfire/langs/en.pl var/ipfire/langs/fr.pl opt/pakfire/lib/functions.pl +opt/pakfire/lib/functions.sh diff --git a/config/rootfiles/core/37/update.sh b/config/rootfiles/core/37/update.sh index 038187c..67cd0c0 100644 --- a/config/rootfiles/core/37/update.sh +++ b/config/rootfiles/core/37/update.sh @@ -48,6 +48,10 @@ ln -sf ../init.d/cyrus-sasl /etc/rc.d/rc6.d/K49cyrus-sasl perl -e "require '/var/ipfire/lang.pl'; &Lang::BuildCacheLang" # +#Fix permissions of update booster +chown -R nobody:nobody /var/ipfire/updatexlrator + +# #Run depmod to rebuld module informations depmod 2.6.27.42-ipfire depmod 2.6.27.42-ipfire-xen diff --git a/html/cgi-bin/qos.cgi b/html/cgi-bin/qos.cgi index 49031d0..1beb9e3 100644 --- a/html/cgi-bin/qos.cgi +++ b/html/cgi-bin/qos.cgi @@ -148,10 +148,10 @@ END ; close FILE; } else { - $qossettings{'ACTION'} = 'Parentklasse hinzufuegen'; + $qossettings{'ACTION'} = $Lang::tr{'parentclass add'}; } } -elsif ($qossettings{'DOCLASS'} eq 'Bearbeiten') +elsif ($qossettings{'DOCLASS'} eq $Lang::tr{'edit'}) { open( FILE, "< $classfile" ) or die "Unable to read $classfile"; @classes = <FILE>; @@ -180,7 +180,7 @@ elsif ($qossettings{'DOCLASS'} eq 'Bearbeiten') &Header::closepage(); exit } -elsif ($qossettings{'DOCLASS'} eq 'Loeschen') +elsif ($qossettings{'DOCLASS'} eq $Lang::tr{'delete'}) { open( FILE, "< $classfile" ) or die "Unable to read $classfile"; @tmp = <FILE>; @@ -226,9 +226,9 @@ END ; close FILE; } else { - $qossettings{'ACTION'} = 'Unterklasse hinzufuegen'; + $qossettings{'ACTION'} = $Lang::tr{'qos add subclass'}; } -} elsif ($qossettings{'DOSCLASS'} eq 'Loeschen') +} elsif ($qossettings{'DOSCLASS'} eq $Lang::tr{'delete'}) { open( FILE, "< $subclassfile" ) or die "Unable to read $classfile"; @tmp = <FILE>; @@ -254,13 +254,13 @@ if ($qossettings{'DOLEVEL7'} eq $Lang::tr{'save'}) if ( $qossettings{'QIP'} ne '' ) { unless ( &General::validip($qossettings{'QIP'}) ) { $qossettings{'VALID'} = 'no'; - $message = "Die Quell-IP-Adresse ist ungueltig."; + $message = $Lang::tr{'The source IP address is invalid.'}; } } if ( $qossettings{'DIP'} ne '' ) { unless ( &General::validip($qossettings{'DIP'}) ) { $qossettings{'VALID'} = 'no'; - $message = "Die Ziel-IP-Adresse ist ungueltig."; + $message = $Lang::tr{'The destination IP address is invalid.'}; } } if ($qossettings{'CLASS'} >= 100 && $qossettings{'CLASS'} < 121) { @@ -280,9 +280,9 @@ END ; close FILE; } else { - $qossettings{'ACTION'} = 'Level7-Regel hinzufuegen'; + $qossettings{'ACTION'} = $Lang::tr{'Add Level7 rule'}; } -} elsif ($qossettings{'DOLEVEL7'} eq 'Loeschen') +} elsif ($qossettings{'DOLEVEL7'} eq $Lang::tr{'delete'}) { open( FILE, "< $level7file" ) or die "Unable to read $level7file"; @l7rules = <FILE>; @@ -292,7 +292,7 @@ END { @l7ruleline = split( /\;/, $l7ruleentry ); if ( ($l7ruleline[0] eq $qossettings{'CLASS'}) && ($l7ruleline[2] eq $qossettings{'L7PROT'})) - {$message = "Level7-Regel ($qossettings{'CLASS'} - $qossettings{'L7PROT'}) wurde geloescht.";} + {$message = "$Lang::tr{'Level7 Rule'} ($qossettings{'CLASS'} - $qossettings{'L7PROT'}) $Lang::tr{'was deleted'}.";} else { open( FILE, ">> $level7file" ) or die "Unable to read $level7file"; print FILE $l7ruleentry; @@ -300,7 +300,7 @@ END } } open( FILE, "< $level7file" ) or system("touch $level7file");close FILE; - } elsif ($qossettings{'DOLEVEL7'} eq 'Bearbeiten') + } elsif ($qossettings{'DOLEVEL7'} eq $Lang::tr{'edit'}) { open( FILE, "< $level7file" ) or die "Unable to read $level7file"; @l7rules = <FILE>; @@ -329,13 +329,13 @@ if ($qossettings{'DOPORT'} eq $Lang::tr{'save'}) if ( $qossettings{'QIP'} ne '' ) { unless ( &General::validip($qossettings{'QIP'}) ) { $qossettings{'VALID'} = 'no'; - $message = "Die Quell-IP-Adresse ist ungueltig."; + $message = "$Lang::tr{'The source IP address is invalid.'}"; } } if ( $qossettings{'DIP'} ne '' ) { unless ( &General::validip($qossettings{'DIP'}) ) { $qossettings{'VALID'} = 'no'; - $message = "Die Ziel-IP-Adresse ist ungueltig."; + $message = "$Lang::tr{'The destination IP address is invalid.'}"; } } if ($qossettings{'CLASS'} >= 100 && $qossettings{'CLASS'} < 121) { @@ -355,9 +355,9 @@ END ; close FILE; } else { - $qossettings{'ACTION'} = 'Port-Regel hinzufuegen'; + $qossettings{'ACTION'} = $Lang::tr{'Add Port Rule'}; } -} elsif ($qossettings{'DOPORT'} eq 'Loeschen') +} elsif ($qossettings{'DOPORT'} eq $Lang::tr{'delete'}) { open( FILE, "< $portfile" ) or die "Unable to read $portfile"; @portrules = <FILE>; @@ -373,7 +373,7 @@ END } close FILE; $message = "$Lang::tr{'Port Rule'} ($qossettings{'CLASS'} - $qossettings{'PPROT'}) $Lang::tr{'was deleted'}."; -} elsif ($qossettings{'DOPORT'} eq 'Bearbeiten') +} elsif ($qossettings{'DOPORT'} eq $Lang::tr{'edit'}) { open( FILE, "< $portfile" ) or die "Unable to read $portfile"; @portrules = <FILE>; @@ -431,7 +431,7 @@ elsif ($qossettings{'DOTOS'} eq 'Loeschen') } close FILE; $message = "$Lang::tr{'TOS Rule'} ($qossettings{'CLASS'} - $qossettings{'TOS'}) $Lang::tr{'was deleted'}."; -} elsif ($qossettings{'DOTOS'} eq 'Bearbeiten') +} elsif ($qossettings{'DOTOS'} eq $Lang::tr{'edit'}) { open( FILE, "< $tosfile" ) or die "Unable to read $tosfile"; @tosrules = <FILE>; @@ -459,7 +459,7 @@ elsif ($qossettings{'DOTOS'} eq 'Loeschen') ############################################################################################################################ ############################################################################################################################ -if ($qossettings{'ACTION'} eq 'Start') +if ($qossettings{'ACTION'} eq $Lang::tr{'start'}) { $qossettings{'ENABLED'} = 'on'; &General::writehash("${General::swroot}/qos/settings", \%qossettings); @@ -468,7 +468,7 @@ if ($qossettings{'ACTION'} eq 'Start') system("/usr/local/bin/qosctrl start >/dev/null 2>&1"); system("logger -t ipfire 'QoS started'"); } -elsif ($qossettings{'ACTION'} eq 'Stop') +elsif ($qossettings{'ACTION'} eq $Lang::tr{'stop'}) { system("/usr/local/bin/qosctrl stop >/dev/null 2>&1"); unlink "/var/ipfire/qos/bin/qos.sh"; @@ -477,7 +477,7 @@ elsif ($qossettings{'ACTION'} eq 'Stop') $qossettings{'ENABLED'} = 'off'; &General::writehash("${General::swroot}/qos/settings", \%qossettings); } -elsif ($qossettings{'ACTION'} eq 'Neustart') +elsif ($qossettings{'ACTION'} eq $Lang::tr{'restart'}) { if ($qossettings{'ENABLED'} eq 'on'){ system("/usr/local/bin/qosctrl stop >/dev/null 2>&1"); @@ -590,7 +590,7 @@ END system("/usr/local/bin/qosctrl start >/dev/null 2>&1"); system("logger -t ipfire 'QoS started'"); } -elsif ($qossettings{'ACTION'} eq "$Lang::tr{'status'}" ) +elsif ($qossettings{'ACTION'} eq $Lang::tr{'status'} ) { &Header::openbox('100%', 'left', 'QoS Status'); if ($qossettings{'ENABLED'} eq 'on'){ @@ -604,30 +604,30 @@ elsif ($qossettings{'ACTION'} eq "$Lang::tr{'status'}" ) &Header::closepage(); exit } -elsif ($qossettings{'ACTION'} eq "$Lang::tr{'parentclass add'}" ) +elsif ($qossettings{'ACTION'} eq $Lang::tr{'parentclass add'} ) { &parentclass(); &Header::closebigbox(); &Header::closepage(); exit } -elsif ($qossettings{'ACTION'} eq 'Unterklasse hinzufuegen') +elsif ($qossettings{'ACTION'} eq $Lang::tr{'qos add subclass'}) { &subclass(); &Header::closebigbox(); &Header::closepage(); exit } -elsif ($qossettings{'ACTION'} eq 'Regel hinzufuegen') +elsif ($qossettings{'ACTION'} eq $Lang::tr{'Add Rule'}) { &Header::openbox('100%', 'center', $Lang::tr{'Add Rule'}); print <<END <table> <tr><td align='center'>$Lang::tr{'Choose Rule'} <tr><td align='center'> - <input type="button" onClick="swapVisibility('l7rule')" value='Level7-Regel' /> - <input type="button" onClick="swapVisibility('portrule')" value='Port-Regel' /> - <input type="button" onClick="swapVisibility('tosrule')" value='TOS-Regel' /> + <input type="button" onClick="swapVisibility('l7rule')" value='$Lang::tr{'Level7 Rule'}' /> + <input type="button" onClick="swapVisibility('portrule')" value='$Lang::tr{'Port Rule'}' /> + <input type="button" onClick="swapVisibility('tosrule')" value='$Lang::tr{'TOS rule'}' /> </table> END ; @@ -716,8 +716,8 @@ END <tr><td width='50%' align='left'><b>Quality of Service:</b> <td width='50%' align='center' bgcolor='$statuscolor'><font color='white'>$status</font> <tr><td width='100%' align='center' colspan='2'> - <input type='submit' name='ACTION' value="Start" /> - <input type='submit' name='ACTION' value="Stop" /> + <input type='submit' name='ACTION' value="$Lang::tr{'start'}" /> + <input type='submit' name='ACTION' value="$Lang::tr{'stop'}" /> <input type='submit' name='ACTION' value="$Lang::tr{'restart'}" /></table></form> END ; @@ -1184,7 +1184,7 @@ sub showclasses { @classline = split( /\;/, $classentry ); if ( $classline[0] eq $qossettings{'DEV'} ) { - &Header::openbox('100%', 'center', "Klasse: $classline[1]"); + &Header::openbox('100%', 'center', "$Lang::tr{'Class'}: $classline[1]"); print <<END <table border='0' width='100%' cellspacing='0'> <tr><td bgcolor='$color{'color20'}' width='10%' align='center'><b>$Lang::tr{'interface'}</b> @@ -1208,22 +1208,22 @@ sub showclasses { <table border='0'><tr> <td><form method='post' action='$ENV{'SCRIPT_NAME'}'> <input type='hidden' name='CLASS' value='$classline[1]' /> - <input type='hidden' name='ACTION' value='Unterklasse hinzufuegen' /> + <input type='hidden' name='ACTION' value='$Lang::tr{'qos add subclass'}' /> <input type='image' alt='$Lang::tr{'add subclass'}' src='/images/addblue.gif' /> </form> <td><form method='post' action='$ENV{'SCRIPT_NAME'}'> <input type='hidden' name='CLASS' value='$classline[1]' /> - <input type='hidden' name='ACTION' value='Regel hinzufuegen' /> + <input type='hidden' name='ACTION' value='$Lang::tr{'Add Rule'}' /> <input type='image' alt='$Lang::tr{'Add Rule'}' src='/images/addgreen.gif' /> </form> <td><form method='post' action='$ENV{'SCRIPT_NAME'}'> <input type='hidden' name='CLASS' value='$classline[1]' /> - <input type='hidden' name='DOCLASS' value='Bearbeiten' /> + <input type='hidden' name='DOCLASS' value='$Lang::tr{'edit'}' /> <input type='image' alt='$Lang::tr{'edit'}' src='/images/edit.gif' /> </form> <td><form method='post' action='$ENV{'SCRIPT_NAME'}'> <input type='hidden' name='CLASS' value='$classline[1]' /> - <input type='hidden' name='DOCLASS' value='Loeschen' /> + <input type='hidden' name='DOCLASS' value='$Lang::tr{'delete'}' /> <input type='image' alt='$Lang::tr{'delete'}' src='/images/delete.gif' /> </form> </table> @@ -1248,14 +1248,14 @@ END <td><form method='post' action='$ENV{'SCRIPT_NAME'}'> <input type='hidden' name='CLASS' value='$l7ruleline[0]' /> <input type='hidden' name='L7PROT' value='$l7ruleline[2]' /> - <input type='hidden' name='DOLEVEL7' value='Bearbeiten' /> - <input type='image' alt='Bearbeiten' src='/images/edit.gif' /> + <input type='hidden' name='DOLEVEL7' value='$Lang::tr{'edit'}' /> + <input type='image' alt='$Lang::tr{'edit'}' src='/images/edit.gif' /> </form> <td><form method='post' action='$ENV{'SCRIPT_NAME'}'> <input type='hidden' name='CLASS' value='$l7ruleline[0]' /> <input type='hidden' name='L7PROT' value='$l7ruleline[2]' /> - <input type='hidden' name='DOLEVEL7' value='Loeschen' /> - <input type='image' alt='Loeschen' src='/images/delete.gif' /> + <input type='hidden' name='DOLEVEL7' value='$Lang::tr{'delete'}' /> + <input type='image' alt='$Lang::tr{'delete'}' src='/images/delete.gif' /> </form> </table> END @@ -1313,7 +1313,7 @@ END <input type='hidden' name='QPORT' value='$portruleline[4]' /> <input type='hidden' name='DIP' value='$portruleline[5]' /> <input type='hidden' name='DPORT' value='$portruleline[6]' /> - <input type='hidden' name='DOPORT' value='Bearbeiten' /> + <input type='hidden' name='DOPORT' value='$Lang::tr{'edit'}' /> <input type='image' alt='$Lang::tr{'edit'}' src='/images/edit.gif' /> </form> <td><form method='post' action='$ENV{'SCRIPT_NAME'}'> @@ -1323,7 +1323,7 @@ END <input type='hidden' name='QPORT' value='$portruleline[4]' /> <input type='hidden' name='DIP' value='$portruleline[5]' /> <input type='hidden' name='DPORT' value='$portruleline[6]' /> - <input type='hidden' name='DOPORT' value='Loeschen' /> + <input type='hidden' name='DOPORT' value='$Lang::tr{'delete'}' /> <input type='image' alt='$Lang::tr{'delete'}' src='/images/delete.gif' /> </form> </table> @@ -1371,14 +1371,14 @@ END <input type='hidden' name='CLASS' value='$tosruleline[0]' /> <input type='hidden' name='DEV' value='$tosruleline[1]' /> <input type='hidden' name='TOS' value='$tosruleline[2]' /> - <input type='hidden' name='DOTOS' value='Bearbeiten' /> + <input type='hidden' name='DOTOS' value='$Lang::tr{'edit'}' /> <input type='image' alt='$Lang::tr{'edit'}' src='/images/edit.gif' /> </form> <td><form method='post' action='$ENV{'SCRIPT_NAME'}'> <input type='hidden' name='CLASS' value='$tosruleline[0]' /> <input type='hidden' name='DEV' value='$tosruleline[1]' /> <input type='hidden' name='TOS' value='$tosruleline[2]' /> - <input type='hidden' name='DOTOS' value='Loeschen' /> + <input type='hidden' name='DOTOS' value='$Lang::tr{'delete'}' /> <input type='image' alt='$Lang::tr{'delete'}' src='/images/delete.gif' /> </form> </table> @@ -1406,17 +1406,17 @@ END <table border='0'><tr> <td><form method='post' action='$ENV{'SCRIPT_NAME'}'> <input type='hidden' name='CLASS' value='$subclassline[2]' /> - <input type='hidden' name='ACTION' value='Regel hinzufuegen' /> + <input type='hidden' name='ACTION' value='$Lang::tr{'Add Rule'}' /> <input type='image' alt='$Lang::tr{'Add Rule'}' src='/images/addgreen.gif' /> </form> <td><form method='post' action='$ENV{'SCRIPT_NAME'}'> <input type='hidden' name='CLASS' value='$subclassline[2]' /> - <input type='hidden' name='DOSCLASS' value='Bearbeiten' /> + <input type='hidden' name='DOSCLASS' value='$Lang::tr{'edit'}' /> <input type='image' alt='$Lang::tr{'edit'}' src='/images/edit.gif' /> </form> <td><form method='post' action='$ENV{'SCRIPT_NAME'}'> <input type='hidden' name='CLASS' value='$subclassline[2]' /> - <input type='hidden' name='DOSCLASS' value='Loeschen' /> + <input type='hidden' name='DOSCLASS' value='$Lang::tr{'delete'}' /> <input type='image' alt='$Lang::tr{'delete'}' src='/images/delete.gif' /> </form> </table> @@ -1496,7 +1496,7 @@ sub validclass { } elsif ( $qossettings{'DEVICE'} eq $qossettings{'IMQ_DEV'} ) { if ($qossettings{'CLASS'} lt 200 || $qossettings{'CLASS'} ge 221) { $qossettings{'VALID'} = 'no'; - $message = "Die Klassennummer passt nicht zum angegebenen Interface."; + $message = "$Lang::tr{'The class number does not match the specified interface.'}"; } } open( FILE, "< $classfile" ) or die "Unable to read $classfile"; diff --git a/html/cgi-bin/wlanap.cgi b/html/cgi-bin/wlanap.cgi old mode 100755 new mode 100644 index a0b7de4..5bbb0d1 --- a/html/cgi-bin/wlanap.cgi +++ b/html/cgi-bin/wlanap.cgi @@ -343,8 +343,8 @@ print <<END <table width='95%' cellspacing='0'> <tr><td bgcolor='$color{'color20'}' colspan='4' align='left'><strong>$Lang::tr{'wlanap wlan settings'}</strong> <tr><td width='25%' class='base'>SSID: </td><td class='base' colspan='3'><input type='text' name='SSID' size='40' value='$wlanapsettings{'SSID'}' /></td></tr> -<tr><td width='25%' class='base'>SSID Broadcast: </td><td class='base' colspan='3'>on <input type='radio' name='HIDESSID' value='on' $checked{'HIDESSID'}{'on'} /> | - <input type='radio' name='HIDESSID' value='off' $checked{'HIDESSID'}{'off'} /> off</td></tr> + +<tr><td width='25%' class='base'>SSID Broadcast: </td><td class='base' colspan='3'>on <input type='radio' name='HIDESSID' value='off' $checked{'HIDESSID'}{'off'} /> | <input type='radio' name='HIDESSID' value='on' $checked{'HIDESSID'}{'on'} /> off</td></tr> <tr><td width='25%' class='base'>HW Mode: </td><td class='base' colspan='3'> <select name='HW_MODE'> <option value='a' $selected{'HW_MODE'}{'a'}>802.11a</option> diff --git a/langs/de/cgi-bin/de.pl b/langs/de/cgi-bin/de.pl index e18fdfb..138dfde 100644 --- a/langs/de/cgi-bin/de.pl +++ b/langs/de/cgi-bin/de.pl @@ -44,6 +44,12 @@ 'Pages' => 'Seiten', 'Ping' => 'Ping ', 'Port Rule' => 'Port-Regel', +'The source IP address is invalid.' => 'Die Quell-IP-Adresse ist ungültig.', +'The destination IP address is invalid.' => 'Die Ziel-IP-Adresse ist ungültig.', +'Add Level7 rule' => 'Level7-Regel hinzufügen', +'Level7 rule' => 'Level7-Regel', +'TOS rule' => 'TOS-Regel', +'The class number does not match the specified interface.' => 'Die Klassennummer passt nicht zum angegebenen Interface.', 'QoS not enabled' => 'QoS ist nicht aktiviert!', 'Queuelenght' => 'Warteschlangenlänge', 'Remote IP' => 'Entfernte IP / Hostname (DynDNS)', diff --git a/langs/en/cgi-bin/en.pl b/langs/en/cgi-bin/en.pl index 0bc5033..4908097 100644 --- a/langs/en/cgi-bin/en.pl +++ b/langs/en/cgi-bin/en.pl @@ -47,6 +47,13 @@ 'repeat' => 'Repeat', 'shuffle' => 'Shuffle', 'Port Rule' => 'Port-Rule', +'qos add subclass' => 'Add subclass', +'The source IP address is invalid.' => 'The source IP address is invalid.', +'The destination IP address is invalid.' => 'The destination IP address is invalid.', +'Add Level7 rule' => 'Add Level7 rule', +'Level7 rule' => 'Level7 rule', +'TOS rule' => 'TOS rule', +'The class number does not match the specified interface.' => 'The class number does not match the specified interface.', 'QoS not enabled' => 'QoS is not enabled!', 'Queuelenght' => 'Queuelenght', 'Remote IP' => 'Remote IP / Hostname (DynDNS):', diff --git a/langs/fr/cgi-bin/fr.pl b/langs/fr/cgi-bin/fr.pl index 0bc5033..4908097 100644 --- a/langs/fr/cgi-bin/fr.pl +++ b/langs/fr/cgi-bin/fr.pl @@ -47,6 +47,13 @@ 'repeat' => 'Repeat', 'shuffle' => 'Shuffle', 'Port Rule' => 'Port-Rule', +'qos add subclass' => 'Add subclass', +'The source IP address is invalid.' => 'The source IP address is invalid.', +'The destination IP address is invalid.' => 'The destination IP address is invalid.', +'Add Level7 rule' => 'Add Level7 rule', +'Level7 rule' => 'Level7 rule', +'TOS rule' => 'TOS rule', +'The class number does not match the specified interface.' => 'The class number does not match the specified interface.', 'QoS not enabled' => 'QoS is not enabled!', 'Queuelenght' => 'Queuelenght', 'Remote IP' => 'Remote IP / Hostname (DynDNS):', diff --git a/src/pakfire/lib/functions.sh b/src/pakfire/lib/functions.sh index 1cc4d81..e4e3d5b 100644 --- a/src/pakfire/lib/functions.sh +++ b/src/pakfire/lib/functions.sh @@ -24,7 +24,7 @@ extract_files() { echo "Extracting files..." - tar xvf /opt/pakfire/tmp/files --preserve --numeric-owner -C / + tar xvf /opt/pakfire/tmp/files --no-overwrite-dir --preserve --numeric-owner -C / echo "...Finished." } hooks/post-receive -- IPFire 2.x development tree

1 0

[IPFire-SCM] [git.ipfire.org] IPFire 3.x development tree branch, master, updated. ebecf4942916d7043ba680d91ee7d8abbc4a8664
by git＠ipfire.org 28 Mar '10

28 Mar '10

1 0

[IPFire-SCM] [git.ipfire.org] IPFire 2.x development tree branch, next, updated. 5ba51b82044c90706e3fd2313621fd2f7646ae76
by git＠ipfire.org 27 Mar '10

27 Mar '10

This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "IPFire 2.x development tree". The branch, next has been updated via 5ba51b82044c90706e3fd2313621fd2f7646ae76 (commit) from db073a101e354ae047e1c5c113b50d03de1058de (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit 5ba51b82044c90706e3fd2313621fd2f7646ae76 Author: Arne Fitzenreiter <arne_f(a)ipfire.org> Date: Sat Mar 27 22:17:04 2010 +0100 Fix connection.cgi display for strongswan. ----------------------------------------------------------------------- Summary of changes: html/cgi-bin/connections.cgi | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) Difference in files: diff --git a/html/cgi-bin/connections.cgi b/html/cgi-bin/connections.cgi index 9cf4f68..b370d12 100644 --- a/html/cgi-bin/connections.cgi +++ b/html/cgi-bin/connections.cgi @@ -57,7 +57,7 @@ if (open(IP, "${General::swroot}/red/local-ipaddress")) { push(@colour, ${Header::colourfw} ); } -my @vpn = ` route -n | grep ipsec | awk '{ print \$1" "\$3}'`; +my @vpn = `grep "rightsubnet=" /etc/ipsec.conf | cut -f2 -d"=" | sed "s|/| |g"`; foreach my $route (@vpn) { chomp($route); my @temp = split(/[\t ]+/, $route); hooks/post-receive -- IPFire 2.x development tree

1 0

[IPFire-SCM] [git.ipfire.org] IPFire 2.x development tree branch, next, updated. db073a101e354ae047e1c5c113b50d03de1058de
by git＠ipfire.org 27 Mar '10

27 Mar '10

This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "IPFire 2.x development tree". The branch, next has been updated via db073a101e354ae047e1c5c113b50d03de1058de (commit) from 5e21bae9cdc9969058d068e5d024d6766c7413e9 (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit db073a101e354ae047e1c5c113b50d03de1058de Author: Arne Fitzenreiter <arne_f(a)ipfire.org> Date: Sat Mar 27 21:15:46 2010 +0100 Some changes for strongswan. Still need a replacement for ipsec auto --replace ----------------------------------------------------------------------- Summary of changes: doc/packages-list.txt | 2 +- html/cgi-bin/index.cgi | 2 +- html/cgi-bin/vpnmain.cgi | 2 +- src/initscripts/init.d/firewall | 3 +- src/misc-progs/ipsecctrl.c | 130 +++++----------------------- src/patches/strongswan-4.3.6_ipfire.patch | 121 ++++++++------------------- 6 files changed, 63 insertions(+), 197 deletions(-) Difference in files: diff --git a/doc/packages-list.txt b/doc/packages-list.txt index 1b7287d..3d8ff07 100644 --- a/doc/packages-list.txt +++ b/doc/packages-list.txt @@ -61,7 +61,7 @@ * cacti-0.8.7e * calamaris-2.59 * capi4k-utils-2005-07-18 -* ccache-2.4 +* ccache-3.0pre0 * cdrtools-2.01.01 * centerim-4.22.1 * clamav-0.95.3 diff --git a/html/cgi-bin/index.cgi b/html/cgi-bin/index.cgi index 6a78baa..dfe65bf 100644 --- a/html/cgi-bin/index.cgi +++ b/html/cgi-bin/index.cgi @@ -337,7 +337,7 @@ END if ( `cat /var/ipfire/vpn/settings | grep ^ENABLED=on` || `cat /var/ipfire/vpn/settings | grep ^ENABLED_BLUE=on` ) { my $ipsecip = `cat /var/ipfire/vpn/settings | grep ^VPN_IP= | cut -c 8-`; - my @status = `/usr/sbin/ipsec auto --status`; + my @status = `/usr/local/bin/ipsecctrl I`; my %confighash = (); &General::readhasharray("${General::swroot}/vpn/config", \%confighash); print <<END; diff --git a/html/cgi-bin/vpnmain.cgi b/html/cgi-bin/vpnmain.cgi index 9e75c69..280055e 100644 --- a/html/cgi-bin/vpnmain.cgi +++ b/html/cgi-bin/vpnmain.cgi @@ -2387,7 +2387,7 @@ EOF &General::readhasharray("${General::swroot}/vpn/config", \%confighash); $cgiparams{'CA_NAME'} = ''; - my @status = `/usr/sbin/ipsec auto --status`; + my @status = `/usr/local/bin/ipsecctrl I`; # suggest a default name for this side if ($cgiparams{'VPN_IP'} eq '' && -e "${General::swroot}/red/active") { diff --git a/src/initscripts/init.d/firewall b/src/initscripts/init.d/firewall index 55bc066..9b70869 100644 --- a/src/initscripts/init.d/firewall +++ b/src/initscripts/init.d/firewall @@ -116,7 +116,8 @@ iptables_red() { /sbin/iptables -A REDINPUT -p udp --source-port 67 --destination-port 68 -i $IFACE -j ACCEPT fi - # Outgoing masquerading + # Outgoing masquerading (don't masqerade IPSEC (mark 50)) + /sbin/iptables -t nat -A REDNAT -m mark --mark 50 -o $IFACE -j RETURN /sbin/iptables -t nat -A REDNAT -o $IFACE -j MASQUERADE fi diff --git a/src/misc-progs/ipsecctrl.c b/src/misc-progs/ipsecctrl.c index c46bc06..d443edc 100644 --- a/src/misc-progs/ipsecctrl.c +++ b/src/misc-progs/ipsecctrl.c @@ -30,21 +30,16 @@ */ -#define phystable "IPSECPHYSICAL" -#define virtualtable "IPSECVIRTUAL" - void usage() { fprintf (stderr, "Usage:\n"); fprintf (stderr, "\tipsecctrl S [connectionkey]\n"); fprintf (stderr, "\tipsecctrl D [connectionkey]\n"); fprintf (stderr, "\tipsecctrl R\n"); + fprintf (stderr, "\tipsecctrl I\n"); fprintf (stderr, "\t\tS : Start/Restart Connection\n"); fprintf (stderr, "\t\tD : Stop Connection\n"); fprintf (stderr, "\t\tR : Reload Certificates and Secrets\n"); -} - -void load_modules() { -// safe_system("/sbin/modprobe ipsec"); + fprintf (stderr, "\t\tI : Print Statusinfo\n"); } /* @@ -54,108 +49,31 @@ void open_physical (char *interface, int nat_traversal_port) { char str[STRING_SIZE]; // GRE ??? - sprintf(str, "/sbin/iptables -A " phystable " -p 47 -i %s -j ACCEPT", interface); +// sprintf(str, "/sbin/iptables -A " phystable " -p 47 -i %s -j ACCEPT", interface); // safe_system(str); // ESP - sprintf(str, "/sbin/iptables -A " phystable " -p 50 -i %s -j ACCEPT", interface); +// sprintf(str, "/sbin/iptables -A " phystable " -p 50 -i %s -j ACCEPT", interface); // safe_system(str); // AH - sprintf(str, "/sbin/iptables -A " phystable " -p 51 -i %s -j ACCEPT", interface); +// sprintf(str, "/sbin/iptables -A " phystable " -p 51 -i %s -j ACCEPT", interface); // safe_system(str); // IKE - sprintf(str, "/sbin/iptables -A " phystable " -p udp -i %s --sport 500 --dport 500 -j ACCEPT", interface); -// safe_system(str); + sprintf(str, "/sbin/iptables -A IPSECINPUT -p udp -i %s --sport 500 --dport 500 -j ACCEPT", interface); + safe_system(str); if (! nat_traversal_port) return; - sprintf(str, "/sbin/iptables -A " phystable " -p udp -i %s --dport %i -j ACCEPT", interface, nat_traversal_port); -// safe_system(str); -} - -/* - Basic control for what can flow from/to ipsecX interfaces. - - rc.firewall call this chain just before ACCEPTing everything - from green (-i DEV_GREEN -j ACCEPT). -*/ -void open_virtual (void) { - // allow anything from any ipsec to go on all interface, including other ipsec -// safe_system("/sbin/iptables -A " virtualtable " -i ipsec+ -j ACCEPT"); - //todo: BOT extension?; allowing ipsec0<<==port-list-filter==>>GREEN ? + sprintf(str, "/sbin/iptables -A IPSECINPUT -p udp -i %s --dport %i -j ACCEPT", interface, nat_traversal_port); + safe_system(str); } void ipsec_norules() { /* clear input rules */ -// safe_system("/sbin/iptables -F " phystable); -// safe_system("/sbin/iptables -F " virtualtable); - - // unmap red alias ???? -} - - -void add_alias_interfaces(char *configtype, - char *redtype, - char *redif, - int offset) //reserve room for ipsec0=red, ipsec1=green, ipsec2=orange,ipsec3=blue -{ - FILE *file = NULL; - char s[STRING_SIZE]; - int alias=0; - - /* Check for CONFIG_TYPE=2 or 3 i.e. RED ethernet present. If not, - * exit gracefully. This is not an error... */ - if (!((strcmp(configtype, "1")==0) || (strcmp(configtype, "2")==0) || (strcmp(configtype, "3")==0) || (strcmp(configtype, "4")==0))) - return; - - /* Now check the RED_TYPE - aliases only work with STATIC. */ - if (!(strcmp(redtype, "STATIC")==0)) - return; + safe_system("/sbin/iptables -F IPSECINPUT"); + safe_system("/sbin/iptables -F IPSECFORWARD"); + safe_system("/sbin/iptables -F IPSECOUTPUT"); - /* Now set up the new aliases from the config file */ - if (!(file = fopen(CONFIG_ROOT "/ethernet/aliases", "r"))) - { - fprintf(stderr, "Unable to open aliases configuration file\n"); - return; - } - while (fgets(s, STRING_SIZE, file) != NULL && (offset+alias) < 16 ) - { - if (s[strlen(s) - 1] == '\n') - s[strlen(s) - 1] = '\0'; - int count = 0; - char *aliasip=NULL; - char *enabled=NULL; - char *comment=NULL; - char *sptr = strtok(s, ","); - while (sptr) - { - if (count == 0) - aliasip = sptr; - if (count == 1) - enabled = sptr; - else - comment = sptr; - count++; - sptr = strtok(NULL, ","); - } - - if (!(aliasip && enabled)) - continue; - - if (!VALID_IP(aliasip)) - { - fprintf(stderr, "Bad alias : %s\n", aliasip); - return; - } - - if (strcmp(enabled, "on") == 0) - { - memset(s, 0, STRING_SIZE); - snprintf(s, STRING_SIZE-1, "/usr/sbin/ipsec tncfg --attach --virtual ipsec%d --physical %s:%d >/dev/null", offset+alias, redif, alias); -// safe_system(s); - alias++; - } - } } /* @@ -220,7 +138,7 @@ int decode_line (char *s, void turn_connection_on (char *name, char *type) { char command[STRING_SIZE]; - safe_system("/usr/sbin/ipsec auto --rereadsecrets >/dev/null"); + safe_system("/usr/sbin/ipsec whack --rereadsecrets >/dev/null"); memset(command, 0, STRING_SIZE); snprintf(command, STRING_SIZE - 1, "/usr/sbin/ipsec auto --replace %s >/dev/null", name); @@ -228,7 +146,7 @@ void turn_connection_on (char *name, char *type) { if (strcmp(type, "net") == 0) { memset(command, 0, STRING_SIZE); snprintf(command, STRING_SIZE - 1, - "/usr/sbin/ipsec auto --asynchronous --up %s >/dev/null", name); + "/usr/sbin/ipsec whack --asynchronous --name %s --initiate >/dev/null", name); safe_system(command); } } @@ -240,13 +158,13 @@ void turn_connection_off (char *name) { memset(command, 0, STRING_SIZE); snprintf(command, STRING_SIZE - 1, - "/usr/sbin/ipsec auto --down %s >/dev/null", name); + "/usr/sbin/ipsec whack --name %s --terminate >/dev/null", name); safe_system(command); memset(command, 0, STRING_SIZE); snprintf(command, STRING_SIZE - 1, - "/usr/sbin/ipsec auto --delete %s >/dev/null", name); + "/usr/sbin/ipsec whack --delete --name %s >/dev/null", name); safe_system(command); - safe_system("/usr/sbin/ipsec auto --rereadsecrets >/dev/null"); + safe_system("/usr/sbin/ipsec whack --rereadsecrets >/dev/null"); } @@ -291,9 +209,15 @@ int main(int argc, char *argv[]) { } if (strcmp(argv[1], "R") == 0) { - safe_system("/usr/sbin/ipsec auto --rereadall"); + safe_system("/usr/sbin/ipsec whack --rereadall"); + exit(0); + } + + if (strcmp(argv[1], "I") == 0) { + safe_system("/usr/sbin/ipsec whack --status"); exit(0); } + } /* clear iptables vpn rules */ @@ -422,15 +346,9 @@ int main(int argc, char *argv[]) { if (enable_blue==2) open_physical(if_blue, 4500); - // then open the ipsecX - open_virtual(); - // start the system if ((argc == 2) && strcmp(argv[1], "S") == 0) { - load_modules(); - safe_system("/usr/sbin/ipsec tncfg --clear >/dev/null"); safe_system("/etc/rc.d/init.d/ipsec restart >/dev/null"); - add_alias_interfaces(configtype, redtype, if_red, (enable_red+enable_green+enable_orange+enable_blue) >>1 ); safe_system("/usr/local/bin/vpn-watch &"); exit(0); } diff --git a/src/patches/strongswan-4.3.6_ipfire.patch b/src/patches/strongswan-4.3.6_ipfire.patch index 69f2aba..26cc357 100644 --- a/src/patches/strongswan-4.3.6_ipfire.patch +++ b/src/patches/strongswan-4.3.6_ipfire.patch @@ -1,7 +1,7 @@ diff -Naur strongswan-4.3.6.org/src/_updown/_updown.in strongswan-4.3.6/src/_updown/_updown.in --- strongswan-4.3.6.org/src/_updown/_updown.in 2009-09-27 21:50:42.000000000 +0200 -+++ strongswan-4.3.6/src/_updown/_updown.in 2010-03-20 18:44:11.000000000 +0100 -@@ -374,10 +374,10 @@ ++++ strongswan-4.3.6/src/_updown/_updown.in 2010-03-27 16:32:13.000000000 +0100 +@@ -374,12 +374,12 @@ # connection to me, with (left/right)firewall=yes, coming up # This is used only by the default updown script, not by your custom # ones, so do not mess with it; see CAUTION comment up at top. @@ -12,8 +12,11 @@ diff -Naur strongswan-4.3.6.org/src/_updown/_updown.in strongswan-4.3.6/src/_upd - iptables -I OUTPUT 1 -o $PLUTO_INTERFACE -p $PLUTO_PEER_PROTOCOL \ + iptables -I IPSECOUTPUT 1 -o $PLUTO_INTERFACE -p $PLUTO_PEER_PROTOCOL \ -s $PLUTO_ME $S_MY_PORT $IPSEC_POLICY_OUT \ - -d $PLUTO_PEER_CLIENT $D_PEER_PORT -j ACCEPT +- -d $PLUTO_PEER_CLIENT $D_PEER_PORT -j ACCEPT ++ -d $PLUTO_PEER_CLIENT $D_PEER_PORT -j MARK --set-mark 50 # + # log IPsec host connection setup + if [ $VPN_LOGGING ] @@ -387,10 +387,10 @@ if [ "$PLUTO_PEER_CLIENT" = "$PLUTO_PEER/32" ] then @@ -27,7 +30,7 @@ diff -Naur strongswan-4.3.6.org/src/_updown/_updown.in strongswan-4.3.6/src/_upd fi fi ;; -@@ -398,10 +398,10 @@ +@@ -398,12 +398,12 @@ # connection to me, with (left/right)firewall=yes, going down # This is used only by the default updown script, not by your custom # ones, so do not mess with it; see CAUTION comment up at top. @@ -38,8 +41,11 @@ diff -Naur strongswan-4.3.6.org/src/_updown/_updown.in strongswan-4.3.6/src/_upd - iptables -D OUTPUT -o $PLUTO_INTERFACE -p $PLUTO_PEER_PROTOCOL \ + iptables -D IPSECOUTPUT -o $PLUTO_INTERFACE -p $PLUTO_PEER_PROTOCOL \ -s $PLUTO_ME $S_MY_PORT $IPSEC_POLICY_OUT \ - -d $PLUTO_PEER_CLIENT $D_PEER_PORT -j ACCEPT +- -d $PLUTO_PEER_CLIENT $D_PEER_PORT -j ACCEPT ++ -d $PLUTO_PEER_CLIENT $D_PEER_PORT -j MARK --set-mark 50 # + # log IPsec host connection teardown + if [ $VPN_LOGGING ] @@ -411,10 +411,10 @@ if [ "$PLUTO_PEER_CLIENT" = "$PLUTO_PEER/32" ] then @@ -60,13 +66,14 @@ diff -Naur strongswan-4.3.6.org/src/_updown/_updown.in strongswan-4.3.6/src/_upd - iptables -I FORWARD 1 -o $PLUTO_INTERFACE -p $PLUTO_PEER_PROTOCOL \ + iptables -I IPSECFORWARD 1 -o $PLUTO_INTERFACE -p $PLUTO_PEER_PROTOCOL \ -s $PLUTO_MY_CLIENT $S_MY_PORT \ - -d $PLUTO_PEER_CLIENT $D_PEER_PORT $IPSEC_POLICY_OUT -j ACCEPT +- -d $PLUTO_PEER_CLIENT $D_PEER_PORT $IPSEC_POLICY_OUT -j ACCEPT - iptables -I FORWARD 1 -i $PLUTO_INTERFACE -p $PLUTO_MY_PROTOCOL \ ++ -d $PLUTO_PEER_CLIENT $D_PEER_PORT $IPSEC_POLICY_OUT -j MARK --set-mark 50 + iptables -I IPSECFORWARD 1 -i $PLUTO_INTERFACE -p $PLUTO_MY_PROTOCOL \ -s $PLUTO_PEER_CLIENT $S_PEER_PORT \ -d $PLUTO_MY_CLIENT $D_MY_PORT $IPSEC_POLICY_IN -j ACCEPT fi -@@ -436,10 +436,10 @@ +@@ -436,12 +436,12 @@ # or sometimes host access via the internal IP is needed if [ -n "$PLUTO_MY_SOURCEIP" -o -n "$PLUTO_HOST_ACCESS" ] then @@ -77,8 +84,11 @@ diff -Naur strongswan-4.3.6.org/src/_updown/_updown.in strongswan-4.3.6/src/_upd - iptables -I OUTPUT 1 -o $PLUTO_INTERFACE -p $PLUTO_PEER_PROTOCOL \ + iptables -I IPSECOUTPUT 1 -o $PLUTO_INTERFACE -p $PLUTO_PEER_PROTOCOL \ -s $PLUTO_MY_CLIENT $S_MY_PORT \ - -d $PLUTO_PEER_CLIENT $D_PEER_PORT $IPSEC_POLICY_OUT -j ACCEPT +- -d $PLUTO_PEER_CLIENT $D_PEER_PORT $IPSEC_POLICY_OUT -j ACCEPT ++ -d $PLUTO_PEER_CLIENT $D_PEER_PORT $IPSEC_POLICY_OUT -j MARK --set-mark 50 fi + # + # log IPsec client connection setup @@ -450,12 +450,27 @@ if [ "$PLUTO_PEER_CLIENT" = "$PLUTO_PEER/32" ] then @@ -93,13 +103,13 @@ diff -Naur strongswan-4.3.6.org/src/_updown/_updown.in strongswan-4.3.6/src/_upd fi + + # -+ # Open Firewall for ESP Traffic ++ # Open Firewall for AH + ESP Traffic ++ iptables -I IPSECINPUT 1 -i $PLUTO_INTERFACE -p AH \ ++ -s $PLUTO_PEER $S_PEER_PORT \ ++ -d $PLUTO_ME $D_MY_PORT -j ACCEPT + iptables -I IPSECINPUT 1 -i $PLUTO_INTERFACE -p ESP \ + -s $PLUTO_PEER $S_PEER_PORT \ + -d $PLUTO_ME $D_MY_PORT -j ACCEPT -+ iptables -I IPSECOUTPUT 1 -o $PLUTO_INTERFACE -p ESP \ -+ -d $PLUTO_PEER $S_PEER_PORT \ -+ -s $PLUTO_ME $D_MY_PORT -j ACCEPT + if [ $VPN_LOGGING ] + then + logger -t $TAG -p $FAC_PRIO \ @@ -117,13 +127,14 @@ diff -Naur strongswan-4.3.6.org/src/_updown/_updown.in strongswan-4.3.6/src/_upd + iptables -D IPSECFORWARD -o $PLUTO_INTERFACE -p $PLUTO_PEER_PROTOCOL \ -s $PLUTO_MY_CLIENT $S_MY_PORT \ -d $PLUTO_PEER_CLIENT $D_PEER_PORT \ - $IPSEC_POLICY_OUT -j ACCEPT +- $IPSEC_POLICY_OUT -j ACCEPT - iptables -D FORWARD -i $PLUTO_INTERFACE -p $PLUTO_MY_PROTOCOL \ ++ $IPSEC_POLICY_OUT -j MARK --set-mark 50 + iptables -D IPSECFORWARD -i $PLUTO_INTERFACE -p $PLUTO_MY_PROTOCOL \ -s $PLUTO_PEER_CLIENT $S_PEER_PORT \ -d $PLUTO_MY_CLIENT $D_MY_PORT \ $IPSEC_POLICY_IN -j ACCEPT -@@ -477,11 +492,11 @@ +@@ -477,14 +492,14 @@ # or sometimes host access via the internal IP is needed if [ -n "$PLUTO_MY_SOURCEIP" -o -n "$PLUTO_HOST_ACCESS" ] then @@ -136,7 +147,11 @@ diff -Naur strongswan-4.3.6.org/src/_updown/_updown.in strongswan-4.3.6/src/_upd + iptables -D IPSECOUTPUT -o $PLUTO_INTERFACE -p $PLUTO_PEER_PROTOCOL \ -s $PLUTO_MY_CLIENT $S_MY_PORT \ -d $PLUTO_PEER_CLIENT $D_PEER_PORT \ - $IPSEC_POLICY_OUT -j ACCEPT +- $IPSEC_POLICY_OUT -j ACCEPT ++ $IPSEC_POLICY_OUT -j MARK --set-mark 50 + fi + # + # log IPsec client connection teardown @@ -493,12 +508,27 @@ if [ "$PLUTO_PEER_CLIENT" = "$PLUTO_PEER/32" ] then @@ -151,13 +166,13 @@ diff -Naur strongswan-4.3.6.org/src/_updown/_updown.in strongswan-4.3.6/src/_upd fi + + # -+ # Close Firewall for ESP Traffic ++ # Close Firewall for AH+ESP Traffic ++ iptables -D IPSECINPUT -i $PLUTO_INTERFACE -p AH \ ++ -s $PLUTO_PEER $S_PEER_PORT \ ++ -d $PLUTO_ME $D_MY_PORT -j ACCEPT + iptables -D IPSECINPUT -i $PLUTO_INTERFACE -p ESP \ + -s $PLUTO_PEER $S_PEER_PORT \ + -d $PLUTO_ME $D_MY_PORT -j ACCEPT -+ iptables -D IPSECOUTPUT -o $PLUTO_INTERFACE -p ESP \ -+ -d $PLUTO_PEER $S_PEER_PORT \ -+ -s $PLUTO_ME $D_MY_PORT -j ACCEPT + if [ $VPN_LOGGING ] + then + logger -t $TAG -p $FAC_PRIO \ @@ -247,71 +262,3 @@ diff -Naur strongswan-4.3.6.org/src/_updown/_updown.in strongswan-4.3.6/src/_upd -s $PLUTO_MY_CLIENT $S_MY_PORT \ -d $PLUTO_PEER_CLIENT $D_PEER_PORT \ $IPSEC_POLICY_OUT -j ACCEPT -diff -Naur strongswan-4.3.6.org/src/_updown_espmark/_updown_espmark strongswan-4.3.6/src/_updown_espmark/_updown_espmark ---- strongswan-4.3.6.org/src/_updown_espmark/_updown_espmark 2009-09-27 21:50:42.000000000 +0200 -+++ strongswan-4.3.6/src/_updown_espmark/_updown_espmark 2010-03-15 18:52:28.000000000 +0100 -@@ -247,10 +247,10 @@ - ESP_MARK=50 - - # add the following static rule to the INPUT chain in the mangle table --# iptables -t mangle -A INPUT -p 50 -j MARK --set-mark 50 -+# iptables -t mangle -A IPSECINPUT -p 50 -j MARK --set-mark 50 - - # NAT traversal via UDP encapsulation is supported with the rule --# iptables -t mangle -A INPUT -p udp --dport 4500 -j MARK --set-mark 50 -+# iptables -t mangle -A IPSECINPUT -p udp --dport 4500 -j MARK --set-mark 50 - - # in the presence of KLIPS and ipsecN interfaces do not use ESP mark rules - if [ `echo "$PLUTO_INTERFACE" | grep "ipsec"` ] -@@ -325,10 +325,10 @@ - up-host:*) - # connection to me coming up - # If you are doing a custom version, firewall commands go here. -- iptables -I INPUT 1 -i $PLUTO_INTERFACE -p $PLUTO_MY_PROTOCOL \ -+ iptables -I IPSECINPUT 1 -i $PLUTO_INTERFACE -p $PLUTO_MY_PROTOCOL \ - -s $PLUTO_PEER_CLIENT_NET/$PLUTO_PEER_CLIENT_MASK $S_PEER_PORT \ - -d $PLUTO_ME $D_MY_PORT $CHECK_MARK -j ACCEPT -- iptables -I OUTPUT 1 -o $PLUTO_INTERFACE -p $PLUTO_PEER_PROTOCOL \ -+ iptables -I IPSECOUTPUT 1 -o $PLUTO_INTERFACE -p $PLUTO_PEER_PROTOCOL \ - -s $PLUTO_ME $S_MY_PORT \ - -d $PLUTO_PEER_CLIENT_NET/$PLUTO_PEER_CLIENT_MASK $D_PEER_PORT -j ACCEPT - # -@@ -346,10 +346,10 @@ - # If you are doing a custom version, firewall commands go here. - # connection to me going down - # If you are doing a custom version, firewall commands go here. -- iptables -D INPUT -i $PLUTO_INTERFACE -p $PLUTO_MY_PROTOCOL \ -+ iptables -D IPSECINPUT -i $PLUTO_INTERFACE -p $PLUTO_MY_PROTOCOL \ - -s $PLUTO_PEER_CLIENT_NET/$PLUTO_PEER_CLIENT_MASK $S_PEER_PORT \ - -d $PLUTO_ME $D_MY_PORT $CHECK_MARK -j ACCEPT -- iptables -D OUTPUT -o $PLUTO_INTERFACE -p $PLUTO_PEER_PROTOCOL \ -+ iptables -D IPSECOUTPUT -o $PLUTO_INTERFACE -p $PLUTO_PEER_PROTOCOL \ - -s $PLUTO_ME $S_MY_PORT \ - -d $PLUTO_PEER_CLIENT_NET/$PLUTO_PEER_CLIENT_MASK $D_PEER_PORT -j ACCEPT - # -@@ -365,10 +365,10 @@ - up-client:) - # connection to my client subnet coming up - # If you are doing a custom version, firewall commands go here. -- iptables -I FORWARD 1 -o $PLUTO_INTERFACE -p $PLUTO_PEER_PROTOCOL \ -+ iptables -I IPSECFORWARD 1 -o $PLUTO_INTERFACE -p $PLUTO_PEER_PROTOCOL \ - -s $PLUTO_MY_CLIENT_NET/$PLUTO_MY_CLIENT_MASK $S_MY_PORT \ - -d $PLUTO_PEER_CLIENT_NET/$PLUTO_PEER_CLIENT_MASK $D_PEER_PORT -j ACCEPT -- iptables -I FORWARD 1 -i $PLUTO_INTERFACE -p $PLUTO_MY_PROTOCOL \ -+ iptables -I IPSECFORWARD 1 -i $PLUTO_INTERFACE -p $PLUTO_MY_PROTOCOL \ - -s $PLUTO_PEER_CLIENT_NET/$PLUTO_PEER_CLIENT_MASK $S_PEER_PORT \ - -d $PLUTO_MY_CLIENT_NET/$PLUTO_MY_CLIENT_MASK $D_MY_PORT \ - $CHECK_MARK -j ACCEPT -@@ -385,10 +385,10 @@ - down-client:) - # connection to my client subnet going down - # If you are doing a custom version, firewall commands go here. -- iptables -D FORWARD -o $PLUTO_INTERFACE -p $PLUTO_PEER_PROTOCOL \ -+ iptables -D IPSECFORWARD -o $PLUTO_INTERFACE -p $PLUTO_PEER_PROTOCOL \ - -s $PLUTO_MY_CLIENT_NET/$PLUTO_MY_CLIENT_MASK $S_MY_PORT \ - -d $PLUTO_PEER_CLIENT_NET/$PLUTO_PEER_CLIENT_MASK $D_PEER_PORT -j ACCEPT -- iptables -D FORWARD -i $PLUTO_INTERFACE -p $PLUTO_MY_PROTOCOL \ -+ iptables -D IPSECFORWARD -i $PLUTO_INTERFACE -p $PLUTO_MY_PROTOCOL \ - -s $PLUTO_PEER_CLIENT_NET/$PLUTO_PEER_CLIENT_MASK $S_PEER_PORT \ - -d $PLUTO_MY_CLIENT_NET/$PLUTO_MY_CLIENT_MASK $D_MY_PORT \ - $CHECK_MARK -j ACCEPT hooks/post-receive -- IPFire 2.x development tree

1 0

[IPFire-SCM] [git.ipfire.org] IPFire 3.x development tree branch, master, updated. f21b66c3e5098d210c4844c9253a44b86c5ea449
by git＠ipfire.org 27 Mar '10

27 Mar '10

This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "IPFire 3.x development tree". The branch, master has been updated via f21b66c3e5098d210c4844c9253a44b86c5ea449 (commit) via e4ded842e6a86c8f269b15b263619f97ae6a4068 (commit) via 9d9cdcea29f3cbe45e522010a0b00b5740670b3c (commit) via 4b879ca6e4d682f776f336772abcd5a13ba3bf86 (commit) via 69ee93bdeb4614ff165ed4018af446e47d815252 (commit) via 4f8bded91b9a9935ca4e8c137803f5d0921410d8 (commit) via 2806efe0bad509823800c50f0d1b123dbe0fa8c5 (commit) via 4dc127c160f3bbfcbc43efb41e1a7917fd513edc (commit) via 621ba37d68acfe0dc9951f852e0b9e729b653e53 (commit) via 82685415eaa0bd8daa7f5674e860e793a6f0ee9d (commit) via f7af87f1ebfedc103e2c4ab061150813be676fdd (commit) via 6d167802aa8f51a65eed2b9eb35ae1ce5619b66a (commit) via 40f0451efc251229429aef8531a82827c25ac9a1 (commit) via 93d20e633ba17de39ebd12663c3ce5099afdba82 (commit) via 71f3c2d019d331ba7182b65f1dc2e00bdbe486ad (commit) from eae1d2740f141e3cdb0739f35368bae5ee50f1f4 (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit f21b66c3e5098d210c4844c9253a44b86c5ea449 Merge: e4ded842e6a86c8f269b15b263619f97ae6a4068 2806efe0bad509823800c50f0d1b123dbe0fa8c5 Author: Michael Tremer <michael.tremer(a)ipfire.org> Date: Sat Mar 27 16:41:23 2010 +0100 Merge commit 'stevee/lighttpd' into next commit e4ded842e6a86c8f269b15b263619f97ae6a4068 Merge: 9d9cdcea29f3cbe45e522010a0b00b5740670b3c 4dc127c160f3bbfcbc43efb41e1a7917fd513edc Author: Michael Tremer <michael.tremer(a)ipfire.org> Date: Sat Mar 27 16:41:02 2010 +0100 Merge commit 'stevee/man-db' into next commit 9d9cdcea29f3cbe45e522010a0b00b5740670b3c Merge: 4b879ca6e4d682f776f336772abcd5a13ba3bf86 82685415eaa0bd8daa7f5674e860e793a6f0ee9d Author: Michael Tremer <michael.tremer(a)ipfire.org> Date: Sat Mar 27 16:40:56 2010 +0100 Merge commit 'stevee/openssh' into next commit 4b879ca6e4d682f776f336772abcd5a13ba3bf86 Merge: 69ee93bdeb4614ff165ed4018af446e47d815252 6d167802aa8f51a65eed2b9eb35ae1ce5619b66a Author: Michael Tremer <michael.tremer(a)ipfire.org> Date: Sat Mar 27 16:40:47 2010 +0100 Merge commit 'stevee/glib2' into next commit 69ee93bdeb4614ff165ed4018af446e47d815252 Merge: 4f8bded91b9a9935ca4e8c137803f5d0921410d8 40f0451efc251229429aef8531a82827c25ac9a1 Author: Michael Tremer <michael.tremer(a)ipfire.org> Date: Sat Mar 27 16:40:39 2010 +0100 Merge commit 'stevee/strongswan' into next commit 4f8bded91b9a9935ca4e8c137803f5d0921410d8 Merge: 71f3c2d019d331ba7182b65f1dc2e00bdbe486ad 93d20e633ba17de39ebd12663c3ce5099afdba82 Author: Michael Tremer <michael.tremer(a)ipfire.org> Date: Sat Mar 27 16:40:28 2010 +0100 Merge commit 'stevee/openldap' into next commit 2806efe0bad509823800c50f0d1b123dbe0fa8c5 Author: Schantl Stefan <Stevee(a)ipfire.org> Date: Sat Mar 27 15:21:12 2010 +0100 lighttpd: Update to version 1.4.26. Fixes issue #516. commit 4dc127c160f3bbfcbc43efb41e1a7917fd513edc Author: Schantl Stefan <Stevee(a)ipfire.org> Date: Sat Mar 27 15:17:57 2010 +0100 man-db: Clean up naoki-makefile. commit 621ba37d68acfe0dc9951f852e0b9e729b653e53 Author: Schantl Stefan <Stevee(a)ipfire.org> Date: Sat Mar 27 15:16:59 2010 +0100 man-db: Update to version 2.5.7. Fixes issue #573. commit 82685415eaa0bd8daa7f5674e860e793a6f0ee9d Author: Schantl Stefan <Stevee(a)ipfire.org> Date: Sat Mar 27 15:10:00 2010 +0100 openssh: Clean up naoki-makefile. commit f7af87f1ebfedc103e2c4ab061150813be676fdd Author: Schantl Stefan <Stevee(a)ipfire.org> Date: Sat Mar 27 15:08:58 2010 +0100 openssh: Update to version 5.4p1. Fixes issue #567. commit 6d167802aa8f51a65eed2b9eb35ae1ce5619b66a Author: Schantl Stefan <Stevee(a)ipfire.org> Date: Sat Mar 27 15:00:38 2010 +0100 glib2: Update to version 2.24.0. Fixes issue #568. commit 40f0451efc251229429aef8531a82827c25ac9a1 Author: Schantl Stefan <Stevee(a)ipfire.org> Date: Sat Mar 27 14:53:48 2010 +0100 strongswan: Update to version 4.3.6. Fixes issue #501. commit 93d20e633ba17de39ebd12663c3ce5099afdba82 Author: Schantl Stefan <Stevee(a)ipfire.org> Date: Sat Mar 27 14:49:37 2010 +0100 openldap: Fix symlinks. commit 71f3c2d019d331ba7182b65f1dc2e00bdbe486ad Author: Schantl Stefan <Stevee(a)ipfire.org> Date: Sat Mar 27 14:46:14 2010 +0100 curl: Update to version 7.20.0. ----------------------------------------------------------------------- Summary of changes: pkgs/core/curl/curl.nm | 2 +- pkgs/core/glib2/glib2.nm | 2 +- pkgs/core/lighttpd/lighttpd.nm | 2 +- pkgs/core/man-db/man-db.nm | 6 +----- pkgs/core/openldap/openldap.nm | 13 ++++++++++--- pkgs/core/openssh/openssh.nm | 6 +----- pkgs/core/strongswan/strongswan.nm | 2 +- 7 files changed, 16 insertions(+), 17 deletions(-) Difference in files: diff --git a/pkgs/core/curl/curl.nm b/pkgs/core/curl/curl.nm index 0f343b3..6a5e523 100644 --- a/pkgs/core/curl/curl.nm +++ b/pkgs/core/curl/curl.nm @@ -25,7 +25,7 @@ include $(PKGROOT)/Include PKG_NAME = curl -PKG_VER = 7.19.7 +PKG_VER = 7.20.0 PKG_REL = 0 PKG_MAINTAINER = diff --git a/pkgs/core/glib2/glib2.nm b/pkgs/core/glib2/glib2.nm index 7011034..b8b2a35 100644 --- a/pkgs/core/glib2/glib2.nm +++ b/pkgs/core/glib2/glib2.nm @@ -25,7 +25,7 @@ include $(PKGROOT)/Include PKG_NAME = glib -PKG_VER = 2.23.4 +PKG_VER = 2.24.0 PKG_REL = 0 PKG_MAINTAINER = diff --git a/pkgs/core/lighttpd/lighttpd.nm b/pkgs/core/lighttpd/lighttpd.nm index f533ef4..11329e0 100644 --- a/pkgs/core/lighttpd/lighttpd.nm +++ b/pkgs/core/lighttpd/lighttpd.nm @@ -25,7 +25,7 @@ include $(PKGROOT)/Include PKG_NAME = lighttpd -PKG_VER = 1.4.23 +PKG_VER = 1.4.26 PKG_REL = 0 PKG_MAINTAINER = Michael Tremer <michael.tremer(a)ipfire.org> diff --git a/pkgs/core/man-db/man-db.nm b/pkgs/core/man-db/man-db.nm index ef54f25..69442b5 100644 --- a/pkgs/core/man-db/man-db.nm +++ b/pkgs/core/man-db/man-db.nm @@ -25,7 +25,7 @@ include $(PKGROOT)/Include PKG_NAME = man-db -PKG_VER = 2.5.6 +PKG_VER = 2.5.7 PKG_REL = 0 PKG_MAINTAINER = @@ -54,10 +54,6 @@ CONFIGURE_OPTIONS += \ --with-vgrind=/usr/bin/vgrind \ --with-grap=/usr/bin/grap -############################################################################### -# Installation Details -############################################################################### - define STAGE_PREPARE_CMDS cd $(DIR_APP) && sed -i -e '\%\t/usr/man%d' -e '\%\t/usr/local/man%d' \ src/man_db.conf.in diff --git a/pkgs/core/openldap/openldap.nm b/pkgs/core/openldap/openldap.nm index 67e7e35..aa379f3 100644 --- a/pkgs/core/openldap/openldap.nm +++ b/pkgs/core/openldap/openldap.nm @@ -48,9 +48,6 @@ endef PKG_TARBALL = $(THISAPP).tgz -############################################################################### -# Installation Details -############################################################################### CONFIGURE_OPTIONS += \ --libexecdir=/usr/lib \ --sysconfdir=/etc \ @@ -75,6 +72,16 @@ CONFIGURE_OPTIONS += \ define STAGE_INSTALL_CMDS mv -v $(BUILDROOT)/usr/lib/slapd $(BUILDROOT)/usr/sbin/slapd + ln -svf slapd $(BUILDROOT)/usr/sbin/slapacl + ln -svf slapd $(BUILDROOT)/usr/sbin/slapadd + ln -svf slapd $(BUILDROOT)/usr/sbin/slapauth + ln -svf slapd $(BUILDROOT)/usr/sbin/slapcat + ln -svf slapd $(BUILDROOT)/usr/sbin/slapdn + ln -svf slapd $(BUILDROOT)/usr/sbin/slapindex + ln -svf slapd $(BUILDROOT)/usr/sbin/slappasswd + ln -svf slapd $(BUILDROOT)/usr/sbin/slapschema + ln -svf slapd $(BUILDROOT)/usr/sbin/slaptest + rm -rvf $(BUILDROOT)/var/openldap-data for LINK in lber ldap ldap_r; do \ diff --git a/pkgs/core/openssh/openssh.nm b/pkgs/core/openssh/openssh.nm index 5505653..531b87f 100644 --- a/pkgs/core/openssh/openssh.nm +++ b/pkgs/core/openssh/openssh.nm @@ -25,7 +25,7 @@ include $(PKGROOT)/Include PKG_NAME = openssh -PKG_VER = 5.3p1 +PKG_VER = 5.4p1 PKG_REL = 0 PKG_MAINTAINER = @@ -45,10 +45,6 @@ endef PKG_TARBALL = $(THISAPP).tar.gz -############################################################################### -# Installation Details -############################################################################### - CONFIGURE_OPTIONS += \ --sysconfdir=/etc/ssh \ --datadir=/usr/share/sshd \ diff --git a/pkgs/core/strongswan/strongswan.nm b/pkgs/core/strongswan/strongswan.nm index 7520626..6420f51 100644 --- a/pkgs/core/strongswan/strongswan.nm +++ b/pkgs/core/strongswan/strongswan.nm @@ -25,7 +25,7 @@ include $(PKGROOT)/Include PKG_NAME = strongswan -PKG_VER = 4.3.3 +PKG_VER = 4.3.6 PKG_REL = 0 PKG_MAINTAINER = hooks/post-receive -- IPFire 3.x development tree

1 0

[IPFire-SCM] [git.ipfire.org] IPFire 3.x development tree branch, master, updated. eae1d2740f141e3cdb0739f35368bae5ee50f1f4
by git＠ipfire.org 27 Mar '10

27 Mar '10

This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "IPFire 3.x development tree". The branch, master has been updated via eae1d2740f141e3cdb0739f35368bae5ee50f1f4 (commit) via 23ace5ecaf98b74ee5c13a54014fadfa334b8a2d (commit) via a6db38b3da3a25161407881d9639af769096a051 (commit) via a4109585ab27279e8f5349092cb8581d8dc9bdf9 (commit) via e7de1c0be6628b84f86c70f883f7e943d1997dad (commit) via 4ed71b9f088dcb85de5366ce31de6e828048e008 (commit) via 68d15d217ed17bdb27642ea98ba0e6e2ad08b90b (commit) via f126de55740981339c46ee506fc507c1e80850c7 (commit) via 8b74cf247f170fc553fa569669091da3e4fd6ced (commit) via a4453cdaad686e814daee73e1bc76d73a4b5759c (commit) from 7975e1c9468c146c312430a8e8d01a4cb158ef46 (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit eae1d2740f141e3cdb0739f35368bae5ee50f1f4 Merge: a6db38b3da3a25161407881d9639af769096a051 23ace5ecaf98b74ee5c13a54014fadfa334b8a2d Author: Michael Tremer <michael.tremer(a)ipfire.org> Date: Sat Mar 27 12:47:43 2010 +0100 Merge commit 'stevee/nasm' into next commit 23ace5ecaf98b74ee5c13a54014fadfa334b8a2d Author: Schantl Stefan <Stevee(a)ipfire.org> Date: Sat Mar 27 11:48:11 2010 +0100 nasm: Update to version 2.08.01. This fixes issue #603. commit a6db38b3da3a25161407881d9639af769096a051 Merge: a4109585ab27279e8f5349092cb8581d8dc9bdf9 e7de1c0be6628b84f86c70f883f7e943d1997dad Author: Michael Tremer <michael.tremer(a)ipfire.org> Date: Sat Mar 27 11:43:34 2010 +0100 Merge commit 'stevee/bison' into next commit a4109585ab27279e8f5349092cb8581d8dc9bdf9 Merge: 4ed71b9f088dcb85de5366ce31de6e828048e008 8b74cf247f170fc553fa569669091da3e4fd6ced Author: Michael Tremer <michael.tremer(a)ipfire.org> Date: Sat Mar 27 11:36:52 2010 +0100 Merge commit 'stevee/updates' into next commit e7de1c0be6628b84f86c70f883f7e943d1997dad Author: Schantl Stefan <Stevee(a)ipfire.org> Date: Sat Mar 27 11:05:58 2010 +0100 bison: Update to version 2.4.2. commit 4ed71b9f088dcb85de5366ce31de6e828048e008 Merge: 68d15d217ed17bdb27642ea98ba0e6e2ad08b90b f126de55740981339c46ee506fc507c1e80850c7 Author: Michael Tremer <michael.tremer(a)ipfire.org> Date: Sat Mar 27 10:33:30 2010 +0100 Merge branch 'master' of ssh://git.ipfire.org/pub/git/people/ms/ipfire-3.x into next commit 68d15d217ed17bdb27642ea98ba0e6e2ad08b90b Author: Michael Tremer <michael.tremer(a)ipfire.org> Date: Sat Mar 27 10:31:20 2010 +0100 openssl: Update to 1.0.0-beta5. commit f126de55740981339c46ee506fc507c1e80850c7 Merge: 9e777ed08f3e304a3f3bb5c1d6b46a3a1be216ca a4580ae3b5046a4261d29d3dfb468fb93653d8ed Author: Michael Tremer <michael.tremer(a)ipfire.org> Date: Fri Mar 26 15:01:07 2010 +0100 Merge remote branch 'origin/master' into next commit 8b74cf247f170fc553fa569669091da3e4fd6ced Author: Schantl Stefan <Stevee(a)ipfire.org> Date: Wed Mar 24 00:17:39 2010 +0100 util-linux-ng: Update to version 2.17.2. This fixes issue #598. commit a4453cdaad686e814daee73e1bc76d73a4b5759c Author: Schantl Stefan <Stevee(a)ipfire.org> Date: Wed Mar 24 00:07:41 2010 +0100 util-linux-ng: Clean up naoki-makefile. ----------------------------------------------------------------------- Summary of changes: pkgs/core/bison/bison.nm | 2 +- .../bison/patches/bison-2.4-reap_subpipe.patch | 87 - pkgs/core/nasm/nasm.nm | 2 +- pkgs/core/openssl/openssl.nm | 23 +- .../openssl-0.9.8b-test-use-localhost.patch | 24 + .../patches/openssl-0.9.8j-env-nozlib.patch | 13 + .../openssl-0.9.8j-version-add-engines.patch | 48 + .../patches/openssl-0.9.8k-enginesdir.patch | 39 - .../patches/openssl-0.9.8k-fix_manpages-1.patch | 1888 -------------------- .../patches/openssl-1.0.0-beta3-soversion.patch | 44 + .../patches/openssl-1.0.0-beta4-redhat.patch | 59 + .../patches/openssl-1.0.0-beta5-enginesdir.patch | 52 + .../patches/openssl-1.0.0-beta5-version.patch | 14 + pkgs/core/util-linux-ng/util-linux-ng.nm | 40 +- 14 files changed, 285 insertions(+), 2050 deletions(-) delete mode 100644 pkgs/core/bison/patches/bison-2.4-reap_subpipe.patch create mode 100644 pkgs/core/openssl/patches/openssl-0.9.8b-test-use-localhost.patch create mode 100644 pkgs/core/openssl/patches/openssl-0.9.8j-env-nozlib.patch create mode 100644 pkgs/core/openssl/patches/openssl-0.9.8j-version-add-engines.patch delete mode 100644 pkgs/core/openssl/patches/openssl-0.9.8k-enginesdir.patch delete mode 100644 pkgs/core/openssl/patches/openssl-0.9.8k-fix_manpages-1.patch create mode 100644 pkgs/core/openssl/patches/openssl-1.0.0-beta3-soversion.patch create mode 100644 pkgs/core/openssl/patches/openssl-1.0.0-beta4-redhat.patch create mode 100644 pkgs/core/openssl/patches/openssl-1.0.0-beta5-enginesdir.patch create mode 100644 pkgs/core/openssl/patches/openssl-1.0.0-beta5-version.patch Difference in files: diff --git a/pkgs/core/bison/bison.nm b/pkgs/core/bison/bison.nm index 1d856c6..ca31db9 100644 --- a/pkgs/core/bison/bison.nm +++ b/pkgs/core/bison/bison.nm @@ -25,7 +25,7 @@ include $(PKGROOT)/Include PKG_NAME = bison -PKG_VER = 2.4.1 +PKG_VER = 2.4.2 PKG_REL = 0 PKG_MAINTAINER = diff --git a/pkgs/core/bison/patches/bison-2.4-reap_subpipe.patch b/pkgs/core/bison/patches/bison-2.4-reap_subpipe.patch deleted file mode 100644 index 3f72c3e..0000000 --- a/pkgs/core/bison/patches/bison-2.4-reap_subpipe.patch +++ /dev/null @@ -1,87 +0,0 @@ -diff -urp bison-2.4-pm/lib/subpipe.c bison-2.4/lib/subpipe.c ---- bison-2.4-pm/lib/subpipe.c 2008-07-14 10:56:12.000000000 +0200 -+++ bison-2.4/lib/subpipe.c 2008-11-20 14:37:42.000000000 +0100 -@@ -143,7 +143,9 @@ create_subpipe (char const * const *argv - } - - --/* Wait for the subprocess to exit. */ -+/* Wait for the subprocess to exit. PROGRAM==NULL means errors -+ shouldn't be emitted, typically becuase we are reaping the subpipe -+ in response to some other error. */ - - void - reap_subpipe (pid_t pid, char const *program) -@@ -151,11 +153,14 @@ reap_subpipe (pid_t pid, char const *pro - #if HAVE_WAITPID || defined waitpid - int wstatus; - if (waitpid (pid, &wstatus, 0) < 0) -- error (EXIT_FAILURE, errno, "waitpid"); -+ { -+ if (program) -+ error (EXIT_FAILURE, errno, "waitpid"); -+ } - else - { - int status = WIFEXITED (wstatus) ? WEXITSTATUS (wstatus) : -1; -- if (status) -+ if (status && program) - error (EXIT_FAILURE, 0, - _(status == 126 - ? "subsidiary program `%s' could not be invoked" -diff -urp bison-2.4-pm/src/output.c bison-2.4/src/output.c ---- bison-2.4-pm/src/output.c 2008-11-02 19:09:10.000000000 +0100 -+++ bison-2.4/src/output.c 2008-11-20 14:39:08.000000000 +0100 -@@ -467,6 +467,21 @@ prepare_actions (void) - | Call the skeleton parser. | - `---------------------------*/ - -+static pid_t pid = 0; -+ -+/* Clean up opened pipe. */ -+static void -+die (void) -+{ -+ static int dying = 0; -+ if (pid && !dying) -+ { -+ dying = 1; -+ reap_subpipe (pid, NULL); -+ pid = 0; -+ } -+} -+ - static void - output_skeleton (void) - { -@@ -474,7 +489,6 @@ output_skeleton (void) - FILE *out; - int filter_fd[2]; - char const *argv[9]; -- pid_t pid; - - /* Compute the names of the package data dir and skeleton files. */ - char const m4sugar[] = "m4sugar/m4sugar.m4"; -@@ -586,6 +600,7 @@ output_skeleton (void) - scan_skel (in); - xfclose (in); - reap_subpipe (pid, m4); -+ pid = 0; - timevar_pop (TV_M4); - } - -@@ -653,6 +669,14 @@ prepare (void) - void - output (void) - { -+ /* Register shutdown handler. */ -+ static int registered = 0; -+ if (!registered) -+ { -+ registered = 1; -+ atexit (die); -+ } -+ - obstack_init (&format_obstack); - - prepare_symbols (); diff --git a/pkgs/core/nasm/nasm.nm b/pkgs/core/nasm/nasm.nm index 5ce2bbc..9d8536c 100644 --- a/pkgs/core/nasm/nasm.nm +++ b/pkgs/core/nasm/nasm.nm @@ -25,7 +25,7 @@ include $(PKGROOT)/Include PKG_NAME = nasm -PKG_VER = 2.02 +PKG_VER = 2.08.01 PKG_REL = 0 PKG_MAINTAINER = diff --git a/pkgs/core/openssl/openssl.nm b/pkgs/core/openssl/openssl.nm index 95c1e3c..bc32f57 100644 --- a/pkgs/core/openssl/openssl.nm +++ b/pkgs/core/openssl/openssl.nm @@ -25,10 +25,10 @@ include $(PKGROOT)/Include PKG_NAME = openssl -PKG_VER = 0.9.8k +PKG_VER = 1.0.0-beta5 PKG_REL = 0 -PKG_MAINTAINER = +PKG_MAINTAINER = Michael Tremer <michael.tremer(a)ipfire.org> PKG_GROUP = System/Libraries PKG_URL = http://www.openssl.org/ PKG_LICENSE = OpenSSL @@ -58,13 +58,7 @@ endif #endif #endif -############################################################################### -# Installation Details -############################################################################### - define STAGE_PREPARE_CMDS - cd $(DIR_APP) && sed -e 's/-O3 -fomit-frame-pointer/$(CFLAGS)/' -i Configure - cd $(DIR_APP) && sed -e 's/__OpenBSD__/__linux__/' -e 's/arandom/urandom/' \ -i crypto/rand/randfile.c @@ -72,6 +66,13 @@ define STAGE_PREPARE_CMDS cd $(DIR_APP) && find crypto/ -name Makefile -exec \ sed 's/^ASFLAGS=/&-Wa,--noexecstack /' -i {} \; + + # # Modify the various perl scripts to reference perl in the right location. + cd $(DIR_APP) && perl util/perlpath.pl /usr/bin + + # Generate a table with the compile settings for my perusal. + cd $(DIR_APP) && touch Makefile + cd $(DIR_APP) && make TABLE PERL=/usr/bin/perl endef define STAGE_BUILD @@ -96,7 +97,7 @@ define STAGE_BUILD -DSSL_FORBID_ENULL # Build. - cd $(DIR_APP) && make all build-shared #$(PARALLELISMFLAGS) + cd $(DIR_APP) && make depend all build-shared RPM_OPT_FLAGS="$(CFLAGS)" #$(PARALLELISMFLAGS) # Generate hashes for the included certs. cd $(DIR_APP) && make rehash build-shared @@ -109,6 +110,10 @@ endef define STAGE_INSTALL cd $(DIR_APP) && make install build-shared INSTALL_PREFIX=$(BUILDROOT) + # Install manpages do right place + -mkdir -pv $(BUILDROOT)/usr/share + mv -v $(BUILDROOT)/etc/pki/tls/man $(BUILDROOT)/usr/share/ + -mkdir -pv $(BUILDROOT)/usr/lib/openssl mv -v $(BUILDROOT)/usr/lib/engines $(BUILDROOT)/usr/lib/openssl diff --git a/pkgs/core/openssl/patches/openssl-0.9.8b-test-use-localhost.patch b/pkgs/core/openssl/patches/openssl-0.9.8b-test-use-localhost.patch new file mode 100644 index 0000000..08adf1c --- /dev/null +++ b/pkgs/core/openssl/patches/openssl-0.9.8b-test-use-localhost.patch @@ -0,0 +1,24 @@ +diff -up openssl-0.9.8b/ssl/ssltest.c.use-localhost openssl-0.9.8b/ssl/ssltest.c +--- openssl-0.9.8b/ssl/ssltest.c.use-localhost 2006-02-24 18:58:35.000000000 +0100 ++++ openssl-0.9.8b/ssl/ssltest.c 2007-08-03 14:06:16.000000000 +0200 +@@ -839,19 +839,8 @@ bad: + #ifndef OPENSSL_NO_KRB5 + if (c_ssl && c_ssl->kssl_ctx) + { +- char localhost[MAXHOSTNAMELEN+2]; +- +- if (gethostname(localhost, sizeof localhost-1) == 0) +- { +- localhost[sizeof localhost-1]='\0'; +- if(strlen(localhost) == sizeof localhost-1) +- { +- BIO_printf(bio_err,"localhost name too long\n"); +- goto end; +- } + kssl_ctx_setstring(c_ssl->kssl_ctx, KSSL_SERVER, +- localhost); +- } ++ "localhost"); + } + #endif /* OPENSSL_NO_KRB5 */ + diff --git a/pkgs/core/openssl/patches/openssl-0.9.8j-env-nozlib.patch b/pkgs/core/openssl/patches/openssl-0.9.8j-env-nozlib.patch new file mode 100644 index 0000000..65af5a8 --- /dev/null +++ b/pkgs/core/openssl/patches/openssl-0.9.8j-env-nozlib.patch @@ -0,0 +1,13 @@ +Do not implicitly load the zlib support if OPENSSL_NO_DEFAULT_ZLIB is set. +diff -up openssl-0.9.8j/ssl/ssl_ciph.c.env-nozlib openssl-0.9.8j/ssl/ssl_ciph.c +--- openssl-0.9.8j/ssl/ssl_ciph.c.env-nozlib 2009-01-05 15:43:07.000000000 +0100 ++++ openssl-0.9.8j/ssl/ssl_ciph.c 2009-01-14 17:47:46.000000000 +0100 +@@ -287,7 +287,7 @@ static void load_builtin_compressions(vo + + MemCheck_off(); + ssl_comp_methods=sk_SSL_COMP_new(sk_comp_cmp); +- if (ssl_comp_methods != NULL) ++ if (ssl_comp_methods != NULL && getenv("OPENSSL_NO_DEFAULT_ZLIB") == NULL) + { + comp=(SSL_COMP *)OPENSSL_malloc(sizeof(SSL_COMP)); + if (comp != NULL) diff --git a/pkgs/core/openssl/patches/openssl-0.9.8j-version-add-engines.patch b/pkgs/core/openssl/patches/openssl-0.9.8j-version-add-engines.patch new file mode 100644 index 0000000..f54326c --- /dev/null +++ b/pkgs/core/openssl/patches/openssl-0.9.8j-version-add-engines.patch @@ -0,0 +1,48 @@ +diff -up openssl-0.9.8j/apps/version.c.version-add-engines openssl-0.9.8j/apps/version.c +--- openssl-0.9.8j/apps/version.c.version-add-engines 2008-10-20 14:53:33.000000000 +0200 ++++ openssl-0.9.8j/apps/version.c 2009-01-13 23:22:03.000000000 +0100 +@@ -131,6 +131,7 @@ + #ifndef OPENSSL_NO_BF + # include <openssl/blowfish.h> + #endif ++#include <openssl/engine.h> + + #undef PROG + #define PROG version_main +@@ -140,7 +141,7 @@ int MAIN(int, char **); + int MAIN(int argc, char **argv) + { + int i,ret=0; +- int cflags=0,version=0,date=0,options=0,platform=0,dir=0; ++ int cflags=0,version=0,date=0,options=0,platform=0,dir=0,engines=0; + + apps_startup(); + +@@ -164,7 +165,7 @@ int MAIN(int argc, char **argv) + else if (strcmp(argv[i],"-d") == 0) + dir=1; + else if (strcmp(argv[i],"-a") == 0) +- date=version=cflags=options=platform=dir=1; ++ date=version=cflags=options=platform=dir=engines=1; + else + { + BIO_printf(bio_err,"usage:version -[avbofpd]\n"); +@@ -211,6 +212,18 @@ int MAIN(int argc, char **argv) + } + if (cflags) printf("%s\n",SSLeay_version(SSLEAY_CFLAGS)); + if (dir) printf("%s\n",SSLeay_version(SSLEAY_DIR)); ++ if (engines) ++ { ++ ENGINE *e; ++ printf("engines: "); ++ e = ENGINE_get_first(); ++ while (e) ++ { ++ printf("%s ", ENGINE_get_id(e)); ++ e = ENGINE_get_next(e); ++ } ++ printf("\n"); ++ } + end: + apps_shutdown(); + OPENSSL_EXIT(ret); diff --git a/pkgs/core/openssl/patches/openssl-0.9.8k-enginesdir.patch b/pkgs/core/openssl/patches/openssl-0.9.8k-enginesdir.patch deleted file mode 100644 index 0c33b74..0000000 --- a/pkgs/core/openssl/patches/openssl-0.9.8k-enginesdir.patch +++ /dev/null @@ -1,39 +0,0 @@ ---- openssl-0.9.8a/Configure.enginesdir 2005-11-04 15:06:37.000000000 +0100 -+++ openssl-0.9.8a/Configure 2005-11-07 14:15:12.000000000 +0100 -@@ -560,6 +560,7 @@ - - my $prefix=""; - my $openssldir=""; -+my $enginesdir=""; - my $exe_ext=""; - my $install_prefix=""; - my $no_threads=0; -@@ -739,6 +740,10 @@ - { - $openssldir=$1; - } -+ elsif (/^--enginesdir=(.*)$/) -+ { -+ $enginesdir=$1; -+ } - elsif (/^--install.prefix=(.*)$/) - { - $install_prefix=$1; -@@ -923,7 +928,7 @@ - - $openssldir=$prefix . "/ssl" if $openssldir eq ""; - $openssldir=$prefix . "/" . $openssldir if $openssldir !~ /(^\/|^[a-zA-Z]:[\\\/])/; -- -+$enginesdir="$prefix/lib/engines" if $enginesdir eq ""; - - print "IsMK1MF=$IsMK1MF\n"; - -@@ -1430,7 +1435,7 @@ - if (/^#define\s+OPENSSLDIR/) - { print OUT "#define OPENSSLDIR \"$openssldir\"\n"; } - elsif (/^#define\s+ENGINESDIR/) -- { print OUT "#define ENGINESDIR \"$prefix/lib/engines\"\n"; } -+ { print OUT "#define ENGINESDIR \"$enginesdir\"\n"; } - elsif (/^#((define)|(undef))\s+OPENSSL_EXPORT_VAR_AS_FUNCTION/) - { printf OUT "#undef OPENSSL_EXPORT_VAR_AS_FUNCTION\n" - if $export_var_as_fn; diff --git a/pkgs/core/openssl/patches/openssl-0.9.8k-fix_manpages-1.patch b/pkgs/core/openssl/patches/openssl-0.9.8k-fix_manpages-1.patch deleted file mode 100644 index 69189c9..0000000 --- a/pkgs/core/openssl/patches/openssl-0.9.8k-fix_manpages-1.patch +++ /dev/null @@ -1,1888 +0,0 @@ -Submitted By: Robert Connolly <robert at linuxfromscratch dot org> -Date: 2005-11-13 -Initial Package Version: 0.9.8a -Upstream Status: Submitted upstream -Origin: Anderson Lizardo -Description: This patch fixes conflicts between man pages - installed by OpenSSL and those found on other - packages (particulary Shadow, Perl, and - Man-pages). It also fixes syntax errors on some - POD files that generates slightly broken man - pages. - -$LastChangedBy: igor $ -$Date: 2005-04-03 16:54:23 -0600 (Sun, 03 Apr 2005) $ - -diff -Naur openssl-0.9.8a.orig/FAQ openssl-0.9.8a/FAQ ---- openssl-0.9.8a.orig/FAQ 2005-10-11 10:16:06.000000000 +0000 -+++ openssl-0.9.8a/FAQ 2005-11-14 03:59:59.000000000 +0000 -@@ -680,7 +680,7 @@ - - Multi-threaded applications must provide two callback functions to - OpenSSL by calling CRYPTO_set_locking_callback() and --CRYPTO_set_id_callback(). This is described in the threads(3) -+CRYPTO_set_id_callback(). This is described in the openssl_threads(3) - manpage. - - * I've compiled a program under Windows and it crashes: why? -diff -Naur openssl-0.9.8a.orig/crypto/rand/md_rand.c openssl-0.9.8a/crypto/rand/md_rand.c ---- openssl-0.9.8a.orig/crypto/rand/md_rand.c 2005-04-07 22:53:35.000000000 +0000 -+++ openssl-0.9.8a/crypto/rand/md_rand.c 2005-11-14 03:59:59.000000000 +0000 -@@ -196,7 +196,7 @@ - int do_not_lock; - - /* -- * (Based on the rand(3) manpage) -+ * (Based on the openssl_rand(3) manpage) - * - * The input is chopped up into units of 20 bytes (or less for - * the last block). Each of these blocks is run through the hash -@@ -351,7 +351,7 @@ - num_ceil = (1 + (num-1)/(MD_DIGEST_LENGTH/2)) * (MD_DIGEST_LENGTH/2); - - /* -- * (Based on the rand(3) manpage:) -+ * (Based on the openssl_rand(3) manpage) - * - * For each group of 10 bytes (or less), we do the following: - * -diff -Naur openssl-0.9.8a.orig/doc/apps/openssl-passwd.pod openssl-0.9.8a/doc/apps/openssl-passwd.pod ---- openssl-0.9.8a.orig/doc/apps/openssl-passwd.pod 1970-01-01 00:00:00.000000000 +0000 -+++ openssl-0.9.8a/doc/apps/openssl-passwd.pod 2005-11-14 03:59:59.000000000 +0000 -@@ -0,0 +1,82 @@ -+=pod -+ -+=head1 NAME -+ -+openssl-passwd - compute password hashes -+ -+=head1 SYNOPSIS -+ -+B<openssl passwd> -+[B<-crypt>] -+[B<-1>] -+[B<-apr1>] -+[B<-salt> I<string>] -+[B<-in> I<file>] -+[B<-stdin>] -+[B<-noverify>] -+[B<-quiet>] -+[B<-table>] -+{I<password>} -+ -+=head1 DESCRIPTION -+ -+The B<passwd> command computes the hash of a password typed at -+run-time or the hash of each password in a list. The password list is -+taken from the named file for option B<-in file>, from stdin for -+option B<-stdin>, or from the command line, or from the terminal otherwise. -+The Unix standard algorithm B<crypt> and the MD5-based BSD password -+algorithm B<1> and its Apache variant B<apr1> are available. -+ -+=head1 OPTIONS -+ -+=over 4 -+ -+=item B<-crypt> -+ -+Use the B<crypt> algorithm (default). -+ -+=item B<-1> -+ -+Use the MD5 based BSD password algorithm B<1>. -+ -+=item B<-apr1> -+ -+Use the B<apr1> algorithm (Apache variant of the BSD algorithm). -+ -+=item B<-salt> I<string> -+ -+Use the specified salt. -+When reading a password from the terminal, this implies B<-noverify>. -+ -+=item B<-in> I<file> -+ -+Read passwords from I<file>. -+ -+=item B<-stdin> -+ -+Read passwords from B<stdin>. -+ -+=item B<-noverify> -+ -+Don't verify when reading a password from the terminal. -+ -+=item B<-quiet> -+ -+Don't output warnings when passwords given at the command line are truncated. -+ -+=item B<-table> -+ -+In the output list, prepend the cleartext password and a TAB character -+to each password hash. -+ -+=back -+ -+=head1 EXAMPLES -+ -+B<openssl passwd -crypt -salt xx password> prints B<xxj31ZMTZzkVA>. -+ -+B<openssl passwd -1 -salt xxxxxxxx password> prints B<$1$xxxxxxxx$UYCIxa628.9qXjpQCjM4a.>. -+ -+B<openssl passwd -apr1 -salt xxxxxxxx password> prints B<$apr1$xxxxxxxx$dxHfLAsjHkDRmG83UXe8K0>. -+ -+=cut -diff -Naur openssl-0.9.8a.orig/doc/apps/openssl.pod openssl-0.9.8a/doc/apps/openssl.pod ---- openssl-0.9.8a.orig/doc/apps/openssl.pod 2004-01-04 18:59:14.000000000 +0000 -+++ openssl-0.9.8a/doc/apps/openssl.pod 2005-11-14 03:59:59.000000000 +0000 -@@ -125,7 +125,7 @@ - - Online Certificate Status Protocol utility. - --=item L<B<passwd>|passwd(1)> -+=item L<B<passwd>|openssl-passwd(1)> - - Generation of hashed passwords. - -@@ -325,7 +325,7 @@ - L<dhparam(1)|dhparam(1)>, L<dsa(1)|dsa(1)>, L<dsaparam(1)|dsaparam(1)>, - L<enc(1)|enc(1)>, L<gendsa(1)|gendsa(1)>, - L<genrsa(1)|genrsa(1)>, L<nseq(1)|nseq(1)>, L<openssl(1)|openssl(1)>, --L<passwd(1)|passwd(1)>, -+L<openssl-passwd(1)|openssl-passwd(1)>, - L<pkcs12(1)|pkcs12(1)>, L<pkcs7(1)|pkcs7(1)>, L<pkcs8(1)|pkcs8(1)>, - L<rand(1)|rand(1)>, L<req(1)|req(1)>, L<rsa(1)|rsa(1)>, - L<rsautl(1)|rsautl(1)>, L<s_client(1)|s_client(1)>, -diff -Naur openssl-0.9.8a.orig/doc/apps/passwd.pod openssl-0.9.8a/doc/apps/passwd.pod ---- openssl-0.9.8a.orig/doc/apps/passwd.pod 2002-10-04 12:59:00.000000000 +0000 -+++ openssl-0.9.8a/doc/apps/passwd.pod 1970-01-01 00:00:00.000000000 +0000 -@@ -1,82 +0,0 @@ --=pod -- --=head1 NAME -- --passwd - compute password hashes -- --=head1 SYNOPSIS -- --B<openssl passwd> --[B<-crypt>] --[B<-1>] --[B<-apr1>] --[B<-salt> I<string>] --[B<-in> I<file>] --[B<-stdin>] --[B<-noverify>] --[B<-quiet>] --[B<-table>] --{I<password>} -- --=head1 DESCRIPTION -- --The B<passwd> command computes the hash of a password typed at --run-time or the hash of each password in a list. The password list is --taken from the named file for option B<-in file>, from stdin for --option B<-stdin>, or from the command line, or from the terminal otherwise. --The Unix standard algorithm B<crypt> and the MD5-based BSD password --algorithm B<1> and its Apache variant B<apr1> are available. -- --=head1 OPTIONS -- --=over 4 -- --=item B<-crypt> -- --Use the B<crypt> algorithm (default). -- --=item B<-1> -- --Use the MD5 based BSD password algorithm B<1>. -- --=item B<-apr1> -- --Use the B<apr1> algorithm (Apache variant of the BSD algorithm). -- --=item B<-salt> I<string> -- --Use the specified salt. --When reading a password from the terminal, this implies B<-noverify>. -- --=item B<-in> I<file> -- --Read passwords from I<file>. -- --=item B<-stdin> -- --Read passwords from B<stdin>. -- --=item B<-noverify> -- --Don't verify when reading a password from the terminal. -- --=item B<-quiet> -- --Don't output warnings when passwords given at the command line are truncated. -- --=item B<-table> -- --In the output list, prepend the cleartext password and a TAB character --to each password hash. -- --=back -- --=head1 EXAMPLES -- --B<openssl passwd -crypt -salt xx password> prints B<xxj31ZMTZzkVA>. -- --B<openssl passwd -1 -salt xxxxxxxx password> prints B<$1$xxxxxxxx$UYCIxa628.9qXjpQCjM4a.>. -- --B<openssl passwd -apr1 -salt xxxxxxxx password> prints B<$apr1$xxxxxxxx$dxHfLAsjHkDRmG83UXe8K0>. -- --=cut -diff -Naur openssl-0.9.8a.orig/doc/crypto/BN_generate_prime.pod openssl-0.9.8a/doc/crypto/BN_generate_prime.pod ---- openssl-0.9.8a.orig/doc/crypto/BN_generate_prime.pod 2003-01-13 13:18:22.000000000 +0000 -+++ openssl-0.9.8a/doc/crypto/BN_generate_prime.pod 2005-11-14 03:59:59.000000000 +0000 -@@ -90,7 +90,7 @@ - - =head1 SEE ALSO - --L<bn(3)|bn(3)>, L<ERR_get_error(3)|ERR_get_error(3)>, L<rand(3)|rand(3)> -+L<bn(3)|bn(3)>, L<ERR_get_error(3)|ERR_get_error(3)>, L<openssl_rand(3)|openssl_rand(3)> - - =head1 HISTORY - -diff -Naur openssl-0.9.8a.orig/doc/crypto/BN_rand.pod openssl-0.9.8a/doc/crypto/BN_rand.pod ---- openssl-0.9.8a.orig/doc/crypto/BN_rand.pod 2002-09-25 13:33:26.000000000 +0000 -+++ openssl-0.9.8a/doc/crypto/BN_rand.pod 2005-11-14 03:59:59.000000000 +0000 -@@ -45,7 +45,7 @@ - - =head1 SEE ALSO - --L<bn(3)|bn(3)>, L<ERR_get_error(3)|ERR_get_error(3)>, L<rand(3)|rand(3)>, -+L<bn(3)|bn(3)>, L<ERR_get_error(3)|ERR_get_error(3)>, L<openssl_rand(3)|openssl_rand(3)>, - L<RAND_add(3)|RAND_add(3)>, L<RAND_bytes(3)|RAND_bytes(3)> - - =head1 HISTORY -diff -Naur openssl-0.9.8a.orig/doc/crypto/CONF_modules_free.pod openssl-0.9.8a/doc/crypto/CONF_modules_free.pod ---- openssl-0.9.8a.orig/doc/crypto/CONF_modules_free.pod 2004-03-02 13:31:32.000000000 +0000 -+++ openssl-0.9.8a/doc/crypto/CONF_modules_free.pod 2005-11-14 03:59:59.000000000 +0000 -@@ -37,7 +37,7 @@ - =head1 SEE ALSO - - L<conf(5)|conf(5)>, L<OPENSSL_config(3)|OPENSSL_config(3)>, --L<CONF_modules_load_file(3), CONF_modules_load_file(3)> -+L<CONF_modules_load_file(3)|CONF_modules_load_file(3)> - - =head1 HISTORY - -diff -Naur openssl-0.9.8a.orig/doc/crypto/CONF_modules_load_file.pod openssl-0.9.8a/doc/crypto/CONF_modules_load_file.pod ---- openssl-0.9.8a.orig/doc/crypto/CONF_modules_load_file.pod 2004-03-02 13:31:32.000000000 +0000 -+++ openssl-0.9.8a/doc/crypto/CONF_modules_load_file.pod 2005-11-14 03:59:59.000000000 +0000 -@@ -51,7 +51,7 @@ - =head1 SEE ALSO - - L<conf(5)|conf(5)>, L<OPENSSL_config(3)|OPENSSL_config(3)>, --L<CONF_free(3), CONF_free(3)>, L<err(3),err(3)> -+L<CONF_free(3)|CONF_free(3)>, L<openssl_err(3)|openssl_err(3)> - - =head1 HISTORY - -diff -Naur openssl-0.9.8a.orig/doc/crypto/DH_generate_key.pod openssl-0.9.8a/doc/crypto/DH_generate_key.pod ---- openssl-0.9.8a.orig/doc/crypto/DH_generate_key.pod 2002-09-25 13:33:27.000000000 +0000 -+++ openssl-0.9.8a/doc/crypto/DH_generate_key.pod 2005-11-14 03:59:59.000000000 +0000 -@@ -40,7 +40,7 @@ - - =head1 SEE ALSO - --L<dh(3)|dh(3)>, L<ERR_get_error(3)|ERR_get_error(3)>, L<rand(3)|rand(3)>, L<DH_size(3)|DH_size(3)> -+L<dh(3)|dh(3)>, L<ERR_get_error(3)|ERR_get_error(3)>, L<openssl_rand(3)|openssl_rand(3)>, L<DH_size(3)|DH_size(3)> - - =head1 HISTORY - -diff -Naur openssl-0.9.8a.orig/doc/crypto/DH_generate_parameters.pod openssl-0.9.8a/doc/crypto/DH_generate_parameters.pod ---- openssl-0.9.8a.orig/doc/crypto/DH_generate_parameters.pod 2002-09-25 13:33:27.000000000 +0000 -+++ openssl-0.9.8a/doc/crypto/DH_generate_parameters.pod 2005-11-14 03:59:59.000000000 +0000 -@@ -59,7 +59,7 @@ - - =head1 SEE ALSO - --L<dh(3)|dh(3)>, L<ERR_get_error(3)|ERR_get_error(3)>, L<rand(3)|rand(3)>, -+L<dh(3)|dh(3)>, L<ERR_get_error(3)|ERR_get_error(3)>, L<openssl_rand(3)|openssl_rand(3)>, - L<DH_free(3)|DH_free(3)> - - =head1 HISTORY -diff -Naur openssl-0.9.8a.orig/doc/crypto/DSA_do_sign.pod openssl-0.9.8a/doc/crypto/DSA_do_sign.pod ---- openssl-0.9.8a.orig/doc/crypto/DSA_do_sign.pod 2002-09-25 13:33:27.000000000 +0000 -+++ openssl-0.9.8a/doc/crypto/DSA_do_sign.pod 2005-11-14 03:59:59.000000000 +0000 -@@ -36,7 +36,7 @@ - - =head1 SEE ALSO - --L<dsa(3)|dsa(3)>, L<ERR_get_error(3)|ERR_get_error(3)>, L<rand(3)|rand(3)>, -+L<dsa(3)|dsa(3)>, L<ERR_get_error(3)|ERR_get_error(3)>, L<openssl_rand(3)|openssl_rand(3)>, - L<DSA_SIG_new(3)|DSA_SIG_new(3)>, - L<DSA_sign(3)|DSA_sign(3)> - -diff -Naur openssl-0.9.8a.orig/doc/crypto/DSA_generate_key.pod openssl-0.9.8a/doc/crypto/DSA_generate_key.pod ---- openssl-0.9.8a.orig/doc/crypto/DSA_generate_key.pod 2002-09-25 13:33:27.000000000 +0000 -+++ openssl-0.9.8a/doc/crypto/DSA_generate_key.pod 2005-11-14 03:59:59.000000000 +0000 -@@ -24,7 +24,7 @@ - - =head1 SEE ALSO - --L<dsa(3)|dsa(3)>, L<ERR_get_error(3)|ERR_get_error(3)>, L<rand(3)|rand(3)>, -+L<dsa(3)|dsa(3)>, L<ERR_get_error(3)|ERR_get_error(3)>, L<openssl_rand(3)|openssl_rand(3)>, - L<DSA_generate_parameters(3)|DSA_generate_parameters(3)> - - =head1 HISTORY -diff -Naur openssl-0.9.8a.orig/doc/crypto/DSA_generate_parameters.pod openssl-0.9.8a/doc/crypto/DSA_generate_parameters.pod ---- openssl-0.9.8a.orig/doc/crypto/DSA_generate_parameters.pod 2002-09-25 13:33:27.000000000 +0000 -+++ openssl-0.9.8a/doc/crypto/DSA_generate_parameters.pod 2005-11-14 03:59:59.000000000 +0000 -@@ -90,7 +90,7 @@ - - =head1 SEE ALSO - --L<dsa(3)|dsa(3)>, L<ERR_get_error(3)|ERR_get_error(3)>, L<rand(3)|rand(3)>, -+L<dsa(3)|dsa(3)>, L<ERR_get_error(3)|ERR_get_error(3)>, L<openssl_rand(3)|openssl_rand(3)>, - L<DSA_free(3)|DSA_free(3)> - - =head1 HISTORY -diff -Naur openssl-0.9.8a.orig/doc/crypto/DSA_sign.pod openssl-0.9.8a/doc/crypto/DSA_sign.pod ---- openssl-0.9.8a.orig/doc/crypto/DSA_sign.pod 2002-09-25 13:33:27.000000000 +0000 -+++ openssl-0.9.8a/doc/crypto/DSA_sign.pod 2005-11-14 03:59:59.000000000 +0000 -@@ -55,7 +55,7 @@ - - =head1 SEE ALSO - --L<dsa(3)|dsa(3)>, L<ERR_get_error(3)|ERR_get_error(3)>, L<rand(3)|rand(3)>, -+L<dsa(3)|dsa(3)>, L<ERR_get_error(3)|ERR_get_error(3)>, L<openssl_rand(3)|openssl_rand(3)>, - L<DSA_do_sign(3)|DSA_do_sign(3)> - - =head1 HISTORY -diff -Naur openssl-0.9.8a.orig/doc/crypto/ERR_GET_LIB.pod openssl-0.9.8a/doc/crypto/ERR_GET_LIB.pod ---- openssl-0.9.8a.orig/doc/crypto/ERR_GET_LIB.pod 2000-02-01 01:36:58.000000000 +0000 -+++ openssl-0.9.8a/doc/crypto/ERR_GET_LIB.pod 2005-11-14 03:59:59.000000000 +0000 -@@ -41,7 +41,7 @@ - - =head1 SEE ALSO - --L<err(3)|err(3)>, L<ERR_get_error(3)|ERR_get_error(3)> -+L<openssl_err(3)|openssl_err(3)>, L<ERR_get_error(3)|ERR_get_error(3)> - - =head1 HISTORY - -diff -Naur openssl-0.9.8a.orig/doc/crypto/ERR_clear_error.pod openssl-0.9.8a/doc/crypto/ERR_clear_error.pod ---- openssl-0.9.8a.orig/doc/crypto/ERR_clear_error.pod 2000-02-01 01:36:58.000000000 +0000 -+++ openssl-0.9.8a/doc/crypto/ERR_clear_error.pod 2005-11-14 03:59:59.000000000 +0000 -@@ -20,7 +20,7 @@ - - =head1 SEE ALSO - --L<err(3)|err(3)>, L<ERR_get_error(3)|ERR_get_error(3)> -+L<openssl_err(3)|openssl_err(3)>, L<ERR_get_error(3)|ERR_get_error(3)> - - =head1 HISTORY - -diff -Naur openssl-0.9.8a.orig/doc/crypto/ERR_error_string.pod openssl-0.9.8a/doc/crypto/ERR_error_string.pod ---- openssl-0.9.8a.orig/doc/crypto/ERR_error_string.pod 2004-11-14 15:11:37.000000000 +0000 -+++ openssl-0.9.8a/doc/crypto/ERR_error_string.pod 2005-11-14 03:59:59.000000000 +0000 -@@ -60,7 +60,7 @@ - - =head1 SEE ALSO - --L<err(3)|err(3)>, L<ERR_get_error(3)|ERR_get_error(3)>, -+L<openssl_err(3)|openssl_err(3)>, L<ERR_get_error(3)|ERR_get_error(3)>, - L<ERR_load_crypto_strings(3)|ERR_load_crypto_strings(3)>, - L<SSL_load_error_strings(3)|SSL_load_error_strings(3)> - L<ERR_print_errors(3)|ERR_print_errors(3)> -diff -Naur openssl-0.9.8a.orig/doc/crypto/ERR_get_error.pod openssl-0.9.8a/doc/crypto/ERR_get_error.pod ---- openssl-0.9.8a.orig/doc/crypto/ERR_get_error.pod 2002-11-29 14:21:54.000000000 +0000 -+++ openssl-0.9.8a/doc/crypto/ERR_get_error.pod 2005-11-14 03:59:59.000000000 +0000 -@@ -61,7 +61,7 @@ - - =head1 SEE ALSO - --L<err(3)|err(3)>, L<ERR_error_string(3)|ERR_error_string(3)>, -+L<openssl_err(3)|openssl_err(3)>, L<ERR_error_string(3)|ERR_error_string(3)>, - L<ERR_GET_LIB(3)|ERR_GET_LIB(3)> - - =head1 HISTORY -diff -Naur openssl-0.9.8a.orig/doc/crypto/ERR_load_crypto_strings.pod openssl-0.9.8a/doc/crypto/ERR_load_crypto_strings.pod ---- openssl-0.9.8a.orig/doc/crypto/ERR_load_crypto_strings.pod 2000-02-24 11:55:08.000000000 +0000 -+++ openssl-0.9.8a/doc/crypto/ERR_load_crypto_strings.pod 2005-11-14 03:59:59.000000000 +0000 -@@ -35,7 +35,7 @@ - - =head1 SEE ALSO - --L<err(3)|err(3)>, L<ERR_error_string(3)|ERR_error_string(3)> -+L<openssl_err(3)|openssl_err(3)>, L<ERR_error_string(3)|ERR_error_string(3)> - - =head1 HISTORY - -diff -Naur openssl-0.9.8a.orig/doc/crypto/ERR_load_strings.pod openssl-0.9.8a/doc/crypto/ERR_load_strings.pod ---- openssl-0.9.8a.orig/doc/crypto/ERR_load_strings.pod 2000-02-24 11:55:08.000000000 +0000 -+++ openssl-0.9.8a/doc/crypto/ERR_load_strings.pod 2005-11-14 03:59:59.000000000 +0000 -@@ -43,7 +43,7 @@ - - =head1 SEE ALSO - --L<err(3)|err(3)>, L<ERR_load_strings(3)|ERR_load_strings(3)> -+L<openssl_err(3)|openssl_err(3)>, L<ERR_load_strings(3)|ERR_load_strings(3)> - - =head1 HISTORY - -diff -Naur openssl-0.9.8a.orig/doc/crypto/ERR_print_errors.pod openssl-0.9.8a/doc/crypto/ERR_print_errors.pod ---- openssl-0.9.8a.orig/doc/crypto/ERR_print_errors.pod 2000-02-01 01:36:59.000000000 +0000 -+++ openssl-0.9.8a/doc/crypto/ERR_print_errors.pod 2005-11-14 03:59:59.000000000 +0000 -@@ -38,7 +38,7 @@ - - =head1 SEE ALSO - --L<err(3)|err(3)>, L<ERR_error_string(3)|ERR_error_string(3)>, -+L<openssl_err(3)|openssl_err(3)>, L<ERR_error_string(3)|ERR_error_string(3)>, - L<ERR_get_error(3)|ERR_get_error(3)>, - L<ERR_load_crypto_strings(3)|ERR_load_crypto_strings(3)>, - L<SSL_load_error_strings(3)|SSL_load_error_strings(3)> -diff -Naur openssl-0.9.8a.orig/doc/crypto/ERR_put_error.pod openssl-0.9.8a/doc/crypto/ERR_put_error.pod ---- openssl-0.9.8a.orig/doc/crypto/ERR_put_error.pod 2000-02-24 11:55:08.000000000 +0000 -+++ openssl-0.9.8a/doc/crypto/ERR_put_error.pod 2005-11-14 03:59:59.000000000 +0000 -@@ -34,7 +34,7 @@ - - =head1 SEE ALSO - --L<err(3)|err(3)>, L<ERR_load_strings(3)|ERR_load_strings(3)> -+L<openssl_err(3)|openssl_err(3)>, L<ERR_load_strings(3)|ERR_load_strings(3)> - - =head1 HISTORY - -diff -Naur openssl-0.9.8a.orig/doc/crypto/ERR_remove_state.pod openssl-0.9.8a/doc/crypto/ERR_remove_state.pod ---- openssl-0.9.8a.orig/doc/crypto/ERR_remove_state.pod 2000-05-19 07:54:42.000000000 +0000 -+++ openssl-0.9.8a/doc/crypto/ERR_remove_state.pod 2005-11-14 03:59:59.000000000 +0000 -@@ -25,7 +25,7 @@ - - =head1 SEE ALSO - --L<err(3)|err(3)> -+L<openssl_err(3)|openssl_err(3)> - - =head1 HISTORY - -diff -Naur openssl-0.9.8a.orig/doc/crypto/EVP_BytesToKey.pod openssl-0.9.8a/doc/crypto/EVP_BytesToKey.pod ---- openssl-0.9.8a.orig/doc/crypto/EVP_BytesToKey.pod 2004-11-25 17:47:30.000000000 +0000 -+++ openssl-0.9.8a/doc/crypto/EVP_BytesToKey.pod 2005-11-14 04:00:45.000000000 +0000 -@@ -59,7 +59,7 @@ - - =head1 SEE ALSO - --L<evp(3)|evp(3)>, L<rand(3)|rand(3)>, -+L<evp(3)|evp(3)>, L<openssl_rand(3)|openssl_rand(3)>, - L<EVP_EncryptInit(3)|EVP_EncryptInit(3)> - - =head1 HISTORY -diff -Naur openssl-0.9.8a.orig/doc/crypto/EVP_OpenInit.pod openssl-0.9.8a/doc/crypto/EVP_OpenInit.pod ---- openssl-0.9.8a.orig/doc/crypto/EVP_OpenInit.pod 2000-09-23 07:16:14.000000000 +0000 -+++ openssl-0.9.8a/doc/crypto/EVP_OpenInit.pod 2005-11-14 03:59:59.000000000 +0000 -@@ -54,7 +54,7 @@ - - =head1 SEE ALSO - --L<evp(3)|evp(3)>, L<rand(3)|rand(3)>, -+L<evp(3)|evp(3)>, L<openssl_rand(3)|openssl_rand(3)>, - L<EVP_EncryptInit(3)|EVP_EncryptInit(3)>, - L<EVP_SealInit(3)|EVP_SealInit(3)> - -diff -Naur openssl-0.9.8a.orig/doc/crypto/EVP_SealInit.pod openssl-0.9.8a/doc/crypto/EVP_SealInit.pod ---- openssl-0.9.8a.orig/doc/crypto/EVP_SealInit.pod 2005-03-29 17:50:08.000000000 +0000 -+++ openssl-0.9.8a/doc/crypto/EVP_SealInit.pod 2005-11-14 03:59:59.000000000 +0000 -@@ -74,7 +74,7 @@ - - =head1 SEE ALSO - --L<evp(3)|evp(3)>, L<rand(3)|rand(3)>, -+L<evp(3)|evp(3)>, L<openssl_rand(3)|openssl_rand(3)>, - L<EVP_EncryptInit(3)|EVP_EncryptInit(3)>, - L<EVP_OpenInit(3)|EVP_OpenInit(3)> - -diff -Naur openssl-0.9.8a.orig/doc/crypto/EVP_SignInit.pod openssl-0.9.8a/doc/crypto/EVP_SignInit.pod ---- openssl-0.9.8a.orig/doc/crypto/EVP_SignInit.pod 2005-03-22 17:55:33.000000000 +0000 -+++ openssl-0.9.8a/doc/crypto/EVP_SignInit.pod 2005-11-14 03:59:59.000000000 +0000 -@@ -80,7 +80,7 @@ - =head1 SEE ALSO - - L<EVP_VerifyInit(3)|EVP_VerifyInit(3)>, --L<EVP_DigestInit(3)|EVP_DigestInit(3)>, L<err(3)|err(3)>, -+L<EVP_DigestInit(3)|EVP_DigestInit(3)>, L<openssl_err(3)|openssl_err(3)>, - L<evp(3)|evp(3)>, L<hmac(3)|hmac(3)>, L<md2(3)|md2(3)>, - L<md5(3)|md5(3)>, L<mdc2(3)|mdc2(3)>, L<ripemd(3)|ripemd(3)>, - L<sha(3)|sha(3)>, L<dgst(1)|dgst(1)> -diff -Naur openssl-0.9.8a.orig/doc/crypto/EVP_VerifyInit.pod openssl-0.9.8a/doc/crypto/EVP_VerifyInit.pod ---- openssl-0.9.8a.orig/doc/crypto/EVP_VerifyInit.pod 2002-07-10 19:35:46.000000000 +0000 -+++ openssl-0.9.8a/doc/crypto/EVP_VerifyInit.pod 2005-11-14 03:59:59.000000000 +0000 -@@ -71,7 +71,7 @@ - - L<evp(3)|evp(3)>, - L<EVP_SignInit(3)|EVP_SignInit(3)>, --L<EVP_DigestInit(3)|EVP_DigestInit(3)>, L<err(3)|err(3)>, -+L<EVP_DigestInit(3)|EVP_DigestInit(3)>, L<openssl_err(3)|openssl_err(3)>, - L<evp(3)|evp(3)>, L<hmac(3)|hmac(3)>, L<md2(3)|md2(3)>, - L<md5(3)|md5(3)>, L<mdc2(3)|mdc2(3)>, L<ripemd(3)|ripemd(3)>, - L<sha(3)|sha(3)>, L<dgst(1)|dgst(1)> -diff -Naur openssl-0.9.8a.orig/doc/crypto/OPENSSL_config.pod openssl-0.9.8a/doc/crypto/OPENSSL_config.pod ---- openssl-0.9.8a.orig/doc/crypto/OPENSSL_config.pod 2005-06-02 23:17:38.000000000 +0000 -+++ openssl-0.9.8a/doc/crypto/OPENSSL_config.pod 2005-11-14 03:59:59.000000000 +0000 -@@ -73,7 +73,7 @@ - =head1 SEE ALSO - - L<conf(5)|conf(5)>, L<CONF_load_modules_file(3)|CONF_load_modules_file(3)>, --L<CONF_modules_free(3),CONF_modules_free(3)> -+L<CONF_modules_free(3)|CONF_modules_free(3)> - - =head1 HISTORY - -diff -Naur openssl-0.9.8a.orig/doc/crypto/RAND_add.pod openssl-0.9.8a/doc/crypto/RAND_add.pod ---- openssl-0.9.8a.orig/doc/crypto/RAND_add.pod 2000-03-22 15:30:03.000000000 +0000 -+++ openssl-0.9.8a/doc/crypto/RAND_add.pod 2005-11-14 03:59:59.000000000 +0000 -@@ -65,7 +65,7 @@ - - =head1 SEE ALSO - --L<rand(3)|rand(3)>, L<RAND_egd(3)|RAND_egd(3)>, -+L<openssl_rand(3)|openssl_rand(3)>, L<RAND_egd(3)|RAND_egd(3)>, - L<RAND_load_file(3)|RAND_load_file(3)>, L<RAND_cleanup(3)|RAND_cleanup(3)> - - =head1 HISTORY -diff -Naur openssl-0.9.8a.orig/doc/crypto/RAND_bytes.pod openssl-0.9.8a/doc/crypto/RAND_bytes.pod ---- openssl-0.9.8a.orig/doc/crypto/RAND_bytes.pod 2002-09-25 13:33:27.000000000 +0000 -+++ openssl-0.9.8a/doc/crypto/RAND_bytes.pod 2005-11-14 03:59:59.000000000 +0000 -@@ -35,7 +35,7 @@ - - =head1 SEE ALSO - --L<rand(3)|rand(3)>, L<ERR_get_error(3)|ERR_get_error(3)>, -+L<openssl_rand(3)|openssl_rand(3)>, L<ERR_get_error(3)|ERR_get_error(3)>, - L<RAND_add(3)|RAND_add(3)> - - =head1 HISTORY -diff -Naur openssl-0.9.8a.orig/doc/crypto/RAND_cleanup.pod openssl-0.9.8a/doc/crypto/RAND_cleanup.pod ---- openssl-0.9.8a.orig/doc/crypto/RAND_cleanup.pod 2000-01-27 01:25:06.000000000 +0000 -+++ openssl-0.9.8a/doc/crypto/RAND_cleanup.pod 2005-11-14 03:59:59.000000000 +0000 -@@ -20,7 +20,7 @@ - - =head1 SEE ALSO - --L<rand(3)|rand(3)> -+L<openssl_rand(3)|openssl_rand(3)> - - =head1 HISTORY - -diff -Naur openssl-0.9.8a.orig/doc/crypto/RAND_egd.pod openssl-0.9.8a/doc/crypto/RAND_egd.pod ---- openssl-0.9.8a.orig/doc/crypto/RAND_egd.pod 2001-02-10 19:10:36.000000000 +0000 -+++ openssl-0.9.8a/doc/crypto/RAND_egd.pod 2005-11-14 03:59:59.000000000 +0000 -@@ -69,7 +69,7 @@ - - =head1 SEE ALSO - --L<rand(3)|rand(3)>, L<RAND_add(3)|RAND_add(3)>, -+L<openssl_rand(3)|openssl_rand(3)>, L<RAND_add(3)|RAND_add(3)>, - L<RAND_cleanup(3)|RAND_cleanup(3)> - - =head1 HISTORY -diff -Naur openssl-0.9.8a.orig/doc/crypto/RAND_load_file.pod openssl-0.9.8a/doc/crypto/RAND_load_file.pod ---- openssl-0.9.8a.orig/doc/crypto/RAND_load_file.pod 2001-03-21 15:25:56.000000000 +0000 -+++ openssl-0.9.8a/doc/crypto/RAND_load_file.pod 2005-11-14 03:59:59.000000000 +0000 -@@ -43,7 +43,7 @@ - - =head1 SEE ALSO - --L<rand(3)|rand(3)>, L<RAND_add(3)|RAND_add(3)>, L<RAND_cleanup(3)|RAND_cleanup(3)> -+L<openssl_rand(3)|openssl_rand(3)>, L<RAND_add(3)|RAND_add(3)>, L<RAND_cleanup(3)|RAND_cleanup(3)> - - =head1 HISTORY - -diff -Naur openssl-0.9.8a.orig/doc/crypto/RAND_set_rand_method.pod openssl-0.9.8a/doc/crypto/RAND_set_rand_method.pod ---- openssl-0.9.8a.orig/doc/crypto/RAND_set_rand_method.pod 2002-08-05 16:27:01.000000000 +0000 -+++ openssl-0.9.8a/doc/crypto/RAND_set_rand_method.pod 2005-11-14 03:59:59.000000000 +0000 -@@ -67,7 +67,7 @@ - - =head1 SEE ALSO - --L<rand(3)|rand(3)>, L<engine(3)|engine(3)> -+L<openssl_rand(3)|openssl_rand(3)>, L<engine(3)|engine(3)> - - =head1 HISTORY - -diff -Naur openssl-0.9.8a.orig/doc/crypto/RSA_blinding_on.pod openssl-0.9.8a/doc/crypto/RSA_blinding_on.pod ---- openssl-0.9.8a.orig/doc/crypto/RSA_blinding_on.pod 2000-02-24 11:55:10.000000000 +0000 -+++ openssl-0.9.8a/doc/crypto/RSA_blinding_on.pod 2005-11-14 03:59:59.000000000 +0000 -@@ -34,7 +34,7 @@ - - =head1 SEE ALSO - --L<rsa(3)|rsa(3)>, L<rand(3)|rand(3)> -+L<rsa(3)|rsa(3)>, L<openssl_rand(3)|openssl_rand(3)> - - =head1 HISTORY - -diff -Naur openssl-0.9.8a.orig/doc/crypto/RSA_generate_key.pod openssl-0.9.8a/doc/crypto/RSA_generate_key.pod ---- openssl-0.9.8a.orig/doc/crypto/RSA_generate_key.pod 2002-09-25 13:33:27.000000000 +0000 -+++ openssl-0.9.8a/doc/crypto/RSA_generate_key.pod 2005-11-14 03:59:59.000000000 +0000 -@@ -59,7 +59,7 @@ - - =head1 SEE ALSO - --L<ERR_get_error(3)|ERR_get_error(3)>, L<rand(3)|rand(3)>, L<rsa(3)|rsa(3)>, -+L<ERR_get_error(3)|ERR_get_error(3)>, L<openssl_rand(3)|openssl_rand(3)>, L<rsa(3)|rsa(3)>, - L<RSA_free(3)|RSA_free(3)> - - =head1 HISTORY -diff -Naur openssl-0.9.8a.orig/doc/crypto/RSA_public_encrypt.pod openssl-0.9.8a/doc/crypto/RSA_public_encrypt.pod ---- openssl-0.9.8a.orig/doc/crypto/RSA_public_encrypt.pod 2004-03-23 21:01:34.000000000 +0000 -+++ openssl-0.9.8a/doc/crypto/RSA_public_encrypt.pod 2005-11-14 03:59:59.000000000 +0000 -@@ -73,7 +73,7 @@ - - =head1 SEE ALSO - --L<ERR_get_error(3)|ERR_get_error(3)>, L<rand(3)|rand(3)>, L<rsa(3)|rsa(3)>, -+L<ERR_get_error(3)|ERR_get_error(3)>, L<openssl_rand(3)|openssl_rand(3)>, L<rsa(3)|rsa(3)>, - L<RSA_size(3)|RSA_size(3)> - - =head1 HISTORY -diff -Naur openssl-0.9.8a.orig/doc/crypto/RSA_sign_ASN1_OCTET_STRING.pod openssl-0.9.8a/doc/crypto/RSA_sign_ASN1_OCTET_STRING.pod ---- openssl-0.9.8a.orig/doc/crypto/RSA_sign_ASN1_OCTET_STRING.pod 2002-09-25 13:33:28.000000000 +0000 -+++ openssl-0.9.8a/doc/crypto/RSA_sign_ASN1_OCTET_STRING.pod 2005-11-14 03:59:59.000000000 +0000 -@@ -48,7 +48,7 @@ - =head1 SEE ALSO - - L<ERR_get_error(3)|ERR_get_error(3)>, L<objects(3)|objects(3)>, --L<rand(3)|rand(3)>, L<rsa(3)|rsa(3)>, L<RSA_sign(3)|RSA_sign(3)>, -+L<openssl_rand(3)|openssl_rand(3)>, L<rsa(3)|rsa(3)>, L<RSA_sign(3)|RSA_sign(3)>, - L<RSA_verify(3)|RSA_verify(3)> - - =head1 HISTORY -diff -Naur openssl-0.9.8a.orig/doc/crypto/X509_NAME_ENTRY_get_object.pod openssl-0.9.8a/doc/crypto/X509_NAME_ENTRY_get_object.pod ---- openssl-0.9.8a.orig/doc/crypto/X509_NAME_ENTRY_get_object.pod 2005-03-30 11:50:14.000000000 +0000 -+++ openssl-0.9.8a/doc/crypto/X509_NAME_ENTRY_get_object.pod 2005-11-14 03:59:59.000000000 +0000 -@@ -63,7 +63,7 @@ - =head1 SEE ALSO - - L<ERR_get_error(3)|ERR_get_error(3)>, L<d2i_X509_NAME(3)|d2i_X509_NAME(3)>, --L<OBJ_nid2obj(3),OBJ_nid2obj(3)> -+L<OBJ_nid2obj(3)|OBJ_nid2obj(3)> - - =head1 HISTORY - -diff -Naur openssl-0.9.8a.orig/doc/crypto/bn.pod openssl-0.9.8a/doc/crypto/bn.pod ---- openssl-0.9.8a.orig/doc/crypto/bn.pod 2005-04-29 15:07:34.000000000 +0000 -+++ openssl-0.9.8a/doc/crypto/bn.pod 2005-11-14 03:59:59.000000000 +0000 -@@ -167,7 +167,7 @@ - =head1 SEE ALSO - - L<bn_internal(3)|bn_internal(3)>, --L<dh(3)|dh(3)>, L<err(3)|err(3)>, L<rand(3)|rand(3)>, L<rsa(3)|rsa(3)>, -+L<dh(3)|dh(3)>, L<openssl_err(3)|openssl_err(3)>, L<openssl_rand(3)|openssl_rand(3)>, L<rsa(3)|rsa(3)>, - L<BN_new(3)|BN_new(3)>, L<BN_CTX_new(3)|BN_CTX_new(3)>, - L<BN_copy(3)|BN_copy(3)>, L<BN_swap(3)|BN_swap(3)>, L<BN_num_bytes(3)|BN_num_bytes(3)>, - L<BN_add(3)|BN_add(3)>, L<BN_add_word(3)|BN_add_word(3)>, -diff -Naur openssl-0.9.8a.orig/doc/crypto/crypto.pod openssl-0.9.8a/doc/crypto/crypto.pod ---- openssl-0.9.8a.orig/doc/crypto/crypto.pod 2002-10-06 12:59:25.000000000 +0000 -+++ openssl-0.9.8a/doc/crypto/crypto.pod 2005-11-14 03:59:59.000000000 +0000 -@@ -46,7 +46,7 @@ - - =item AUXILIARY FUNCTIONS - --L<err(3)|err(3)>, L<threads(3)|threads(3)>, L<rand(3)|rand(3)>, -+L<openssl_err(3)|openssl_err(3)>, L<openssl_threads(3)|openssl_threads(3)>, L<openssl_rand(3)|openssl_rand(3)>, - L<OPENSSL_VERSION_NUMBER(3)|OPENSSL_VERSION_NUMBER(3)> - - =item INPUT/OUTPUT, DATA ENCODING -diff -Naur openssl-0.9.8a.orig/doc/crypto/des.pod openssl-0.9.8a/doc/crypto/des.pod ---- openssl-0.9.8a.orig/doc/crypto/des.pod 2003-10-01 15:02:45.000000000 +0000 -+++ openssl-0.9.8a/doc/crypto/des.pod 2005-11-14 03:59:59.000000000 +0000 -@@ -115,7 +115,7 @@ - the key; it is used to speed the encryption process. - - DES_random_key() generates a random key. The PRNG must be seeded --prior to using this function (see L<rand(3)|rand(3)>). If the PRNG -+prior to using this function (see L<openssl_rand(3)|openssl_rand(3)>). If the PRNG - could not generate a secure key, 0 is returned. - - Before a DES key can be used, it must be converted into the -@@ -317,7 +317,7 @@ - - =head1 SEE ALSO - --crypt(3), L<des_modes(7)|des_modes(7)>, L<evp(3)|evp(3)>, L<rand(3)|rand(3)> -+crypt(3), L<des_modes(7)|des_modes(7)>, L<evp(3)|evp(3)>, L<openssl_rand(3)|openssl_rand(3)> - - =head1 HISTORY - -diff -Naur openssl-0.9.8a.orig/doc/crypto/dh.pod openssl-0.9.8a/doc/crypto/dh.pod ---- openssl-0.9.8a.orig/doc/crypto/dh.pod 2002-08-05 16:27:01.000000000 +0000 -+++ openssl-0.9.8a/doc/crypto/dh.pod 2005-11-14 03:59:59.000000000 +0000 -@@ -67,8 +67,8 @@ - - =head1 SEE ALSO - --L<dhparam(1)|dhparam(1)>, L<bn(3)|bn(3)>, L<dsa(3)|dsa(3)>, L<err(3)|err(3)>, --L<rand(3)|rand(3)>, L<rsa(3)|rsa(3)>, L<engine(3)|engine(3)>, -+L<dhparam(1)|dhparam(1)>, L<bn(3)|bn(3)>, L<dsa(3)|dsa(3)>, L<openssl_err(3)|openssl_err(3)>, -+L<openssl_rand(3)|openssl_rand(3)>, L<rsa(3)|rsa(3)>, L<engine(3)|engine(3)>, - L<DH_set_method(3)|DH_set_method(3)>, L<DH_new(3)|DH_new(3)>, - L<DH_get_ex_new_index(3)|DH_get_ex_new_index(3)>, - L<DH_generate_parameters(3)|DH_generate_parameters(3)>, -diff -Naur openssl-0.9.8a.orig/doc/crypto/dsa.pod openssl-0.9.8a/doc/crypto/dsa.pod ---- openssl-0.9.8a.orig/doc/crypto/dsa.pod 2002-08-05 16:27:01.000000000 +0000 -+++ openssl-0.9.8a/doc/crypto/dsa.pod 2005-11-14 03:59:59.000000000 +0000 -@@ -100,7 +100,7 @@ - - =head1 SEE ALSO - --L<bn(3)|bn(3)>, L<dh(3)|dh(3)>, L<err(3)|err(3)>, L<rand(3)|rand(3)>, -+L<bn(3)|bn(3)>, L<dh(3)|dh(3)>, L<openssl_err(3)|openssl_err(3)>, L<openssl_rand(3)|openssl_rand(3)>, - L<rsa(3)|rsa(3)>, L<sha(3)|sha(3)>, L<engine(3)|engine(3)>, - L<DSA_new(3)|DSA_new(3)>, - L<DSA_size(3)|DSA_size(3)>, -diff -Naur openssl-0.9.8a.orig/doc/crypto/engine.pod openssl-0.9.8a/doc/crypto/engine.pod ---- openssl-0.9.8a.orig/doc/crypto/engine.pod 2004-06-17 23:40:14.000000000 +0000 -+++ openssl-0.9.8a/doc/crypto/engine.pod 2005-11-14 04:01:19.000000000 +0000 -@@ -594,6 +594,6 @@ - - =head1 SEE ALSO - --L<rsa(3)|rsa(3)>, L<dsa(3)|dsa(3)>, L<dh(3)|dh(3)>, L<rand(3)|rand(3)> -+L<rsa(3)|rsa(3)>, L<dsa(3)|dsa(3)>, L<dh(3)|dh(3)>, L<openssl_rand(3)|openssl_rand(3)> - - =cut -diff -Naur openssl-0.9.8a.orig/doc/crypto/err.pod openssl-0.9.8a/doc/crypto/err.pod ---- openssl-0.9.8a.orig/doc/crypto/err.pod 2002-07-10 19:35:46.000000000 +0000 -+++ openssl-0.9.8a/doc/crypto/err.pod 1970-01-01 00:00:00.000000000 +0000 -@@ -1,187 +0,0 @@ --=pod -- --=head1 NAME -- --err - error codes -- --=head1 SYNOPSIS -- -- #include <openssl/err.h> -- -- unsigned long ERR_get_error(void); -- unsigned long ERR_peek_error(void); -- unsigned long ERR_get_error_line(const char **file, int *line); -- unsigned long ERR_peek_error_line(const char **file, int *line); -- unsigned long ERR_get_error_line_data(const char **file, int *line, -- const char **data, int *flags); -- unsigned long ERR_peek_error_line_data(const char **file, int *line, -- const char **data, int *flags); -- -- int ERR_GET_LIB(unsigned long e); -- int ERR_GET_FUNC(unsigned long e); -- int ERR_GET_REASON(unsigned long e); -- -- void ERR_clear_error(void); -- -- char *ERR_error_string(unsigned long e, char *buf); -- const char *ERR_lib_error_string(unsigned long e); -- const char *ERR_func_error_string(unsigned long e); -- const char *ERR_reason_error_string(unsigned long e); -- -- void ERR_print_errors(BIO *bp); -- void ERR_print_errors_fp(FILE *fp); -- -- void ERR_load_crypto_strings(void); -- void ERR_free_strings(void); -- -- void ERR_remove_state(unsigned long pid); -- -- void ERR_put_error(int lib, int func, int reason, const char *file, -- int line); -- void ERR_add_error_data(int num, ...); -- -- void ERR_load_strings(int lib,ERR_STRING_DATA str[]); -- unsigned long ERR_PACK(int lib, int func, int reason); -- int ERR_get_next_error_library(void); -- --=head1 DESCRIPTION -- --When a call to the OpenSSL library fails, this is usually signalled --by the return value, and an error code is stored in an error queue --associated with the current thread. The B<err> library provides --functions to obtain these error codes and textual error messages. -- --The L<ERR_get_error(3)|ERR_get_error(3)> manpage describes how to --access error codes. -- --Error codes contain information about where the error occurred, and --what went wrong. L<ERR_GET_LIB(3)|ERR_GET_LIB(3)> describes how to --extract this information. A method to obtain human-readable error --messages is described in L<ERR_error_string(3)|ERR_error_string(3)>. -- --L<ERR_clear_error(3)|ERR_clear_error(3)> can be used to clear the --error queue. -- --Note that L<ERR_remove_state(3)|ERR_remove_state(3)> should be used to --avoid memory leaks when threads are terminated. -- --=head1 ADDING NEW ERROR CODES TO OPENSSL -- --See L<ERR_put_error(3)> if you want to record error codes in the --OpenSSL error system from within your application. -- --The remainder of this section is of interest only if you want to add --new error codes to OpenSSL or add error codes from external libraries. -- --=head2 Reporting errors -- --Each sub-library has a specific macro XXXerr() that is used to report --errors. Its first argument is a function code B<XXX_F_...>, the second --argument is a reason code B<XXX_R_...>. Function codes are derived --from the function names; reason codes consist of textual error --descriptions. For example, the function ssl23_read() reports a --"handshake failure" as follows: -- -- SSLerr(SSL_F_SSL23_READ, SSL_R_SSL_HANDSHAKE_FAILURE); -- --Function and reason codes should consist of upper case characters, --numbers and underscores only. The error file generation script translates --function codes into function names by looking in the header files --for an appropriate function name, if none is found it just uses --the capitalized form such as "SSL23_READ" in the above example. -- --The trailing section of a reason code (after the "_R_") is translated --into lower case and underscores changed to spaces. -- --When you are using new function or reason codes, run B<make errors>. --The necessary B<#define>s will then automatically be added to the --sub-library's header file. -- --Although a library will normally report errors using its own specific --XXXerr macro, another library's macro can be used. This is normally --only done when a library wants to include ASN1 code which must use --the ASN1err() macro. -- --=head2 Adding new libraries -- --When adding a new sub-library to OpenSSL, assign it a library number --B<ERR_LIB_XXX>, define a macro XXXerr() (both in B<err.h>), add its --name to B<ERR_str_libraries[]> (in B<crypto/err/err.c>), and add --C<ERR_load_XXX_strings()> to the ERR_load_crypto_strings() function --(in B<crypto/err/err_all.c>). Finally, add an entry -- -- L XXX xxx.h xxx_err.c -- --to B<crypto/err/openssl.ec>, and add B<xxx_err.c> to the Makefile. --Running B<make errors> will then generate a file B<xxx_err.c>, and --add all error codes used in the library to B<xxx.h>. -- --Additionally the library include file must have a certain form. --Typically it will initially look like this: -- -- #ifndef HEADER_XXX_H -- #define HEADER_XXX_H -- -- #ifdef __cplusplus -- extern "C" { -- #endif -- -- /* Include files */ -- -- #include <openssl/bio.h> -- #include <openssl/x509.h> -- -- /* Macros, structures and function prototypes */ -- -- -- /* BEGIN ERROR CODES */ -- --The B<BEGIN ERROR CODES> sequence is used by the error code --generation script as the point to place new error codes, any text --after this point will be overwritten when B<make errors> is run. --The closing #endif etc will be automatically added by the script. -- --The generated C error code file B<xxx_err.c> will load the header --files B<stdio.h>, B<openssl/err.h> and B<openssl/xxx.h> so the --header file must load any additional header files containing any --definitions it uses. -- --=head1 USING ERROR CODES IN EXTERNAL LIBRARIES -- --It is also possible to use OpenSSL's error code scheme in external --libraries. The library needs to load its own codes and call the OpenSSL --error code insertion script B<mkerr.pl> explicitly to add codes to --the header file and generate the C error code file. This will normally --be done if the external library needs to generate new ASN1 structures --but it can also be used to add more general purpose error code handling. -- --TBA more details -- --=head1 INTERNALS -- --The error queues are stored in a hash table with one B<ERR_STATE> --entry for each pid. ERR_get_state() returns the current thread's --B<ERR_STATE>. An B<ERR_STATE> can hold up to B<ERR_NUM_ERRORS> error --codes. When more error codes are added, the old ones are overwritten, --on the assumption that the most recent errors are most important. -- --Error strings are also stored in hash table. The hash tables can --be obtained by calling ERR_get_err_state_table(void) and --ERR_get_string_table(void) respectively. -- --=head1 SEE ALSO -- --L<CRYPTO_set_id_callback(3)|CRYPTO_set_id_callback(3)>, --L<CRYPTO_set_locking_callback(3)|CRYPTO_set_locking_callback(3)>, --L<ERR_get_error(3)|ERR_get_error(3)>, --L<ERR_GET_LIB(3)|ERR_GET_LIB(3)>, --L<ERR_clear_error(3)|ERR_clear_error(3)>, --L<ERR_error_string(3)|ERR_error_string(3)>, --L<ERR_print_errors(3)|ERR_print_errors(3)>, --L<ERR_load_crypto_strings(3)|ERR_load_crypto_strings(3)>, --L<ERR_remove_state(3)|ERR_remove_state(3)>, --L<ERR_put_error(3)|ERR_put_error(3)>, --L<ERR_load_strings(3)|ERR_load_strings(3)>, --L<SSL_get_error(3)|SSL_get_error(3)> -- --=cut -diff -Naur openssl-0.9.8a.orig/doc/crypto/openssl_err.pod openssl-0.9.8a/doc/crypto/openssl_err.pod ---- openssl-0.9.8a.orig/doc/crypto/openssl_err.pod 1970-01-01 00:00:00.000000000 +0000 -+++ openssl-0.9.8a/doc/crypto/openssl_err.pod 2005-11-14 03:59:59.000000000 +0000 -@@ -0,0 +1,187 @@ -+=pod -+ -+=head1 NAME -+ -+openssl_err - error codes -+ -+=head1 SYNOPSIS -+ -+ #include <openssl/err.h> -+ -+ unsigned long ERR_get_error(void); -+ unsigned long ERR_peek_error(void); -+ unsigned long ERR_get_error_line(const char **file, int *line); -+ unsigned long ERR_peek_error_line(const char **file, int *line); -+ unsigned long ERR_get_error_line_data(const char **file, int *line, -+ const char **data, int *flags); -+ unsigned long ERR_peek_error_line_data(const char **file, int *line, -+ const char **data, int *flags); -+ -+ int ERR_GET_LIB(unsigned long e); -+ int ERR_GET_FUNC(unsigned long e); -+ int ERR_GET_REASON(unsigned long e); -+ -+ void ERR_clear_error(void); -+ -+ char *ERR_error_string(unsigned long e, char *buf); -+ const char *ERR_lib_error_string(unsigned long e); -+ const char *ERR_func_error_string(unsigned long e); -+ const char *ERR_reason_error_string(unsigned long e); -+ -+ void ERR_print_errors(BIO *bp); -+ void ERR_print_errors_fp(FILE *fp); -+ -+ void ERR_load_crypto_strings(void); -+ void ERR_free_strings(void); -+ -+ void ERR_remove_state(unsigned long pid); -+ -+ void ERR_put_error(int lib, int func, int reason, const char *file, -+ int line); -+ void ERR_add_error_data(int num, ...); -+ -+ void ERR_load_strings(int lib,ERR_STRING_DATA str[]); -+ unsigned long ERR_PACK(int lib, int func, int reason); -+ int ERR_get_next_error_library(void); -+ -+=head1 DESCRIPTION -+ -+When a call to the OpenSSL library fails, this is usually signalled -+by the return value, and an error code is stored in an error queue -+associated with the current thread. The B<err> library provides -+functions to obtain these error codes and textual error messages. -+ -+The L<ERR_get_error(3)|ERR_get_error(3)> manpage describes how to -+access error codes. -+ -+Error codes contain information about where the error occurred, and -+what went wrong. L<ERR_GET_LIB(3)|ERR_GET_LIB(3)> describes how to -+extract this information. A method to obtain human-readable error -+messages is described in L<ERR_error_string(3)|ERR_error_string(3)>. -+ -+L<ERR_clear_error(3)|ERR_clear_error(3)> can be used to clear the -+error queue. -+ -+Note that L<ERR_remove_state(3)|ERR_remove_state(3)> should be used to -+avoid memory leaks when threads are terminated. -+ -+=head1 ADDING NEW ERROR CODES TO OPENSSL -+ -+See L<ERR_put_error(3)> if you want to record error codes in the -+OpenSSL error system from within your application. -+ -+The remainder of this section is of interest only if you want to add -+new error codes to OpenSSL or add error codes from external libraries. -+ -+=head2 Reporting errors -+ -+Each sub-library has a specific macro XXXerr() that is used to report -+errors. Its first argument is a function code B<XXX_F_...>, the second -+argument is a reason code B<XXX_R_...>. Function codes are derived -+from the function names; reason codes consist of textual error -+descriptions. For example, the function ssl23_read() reports a -+"handshake failure" as follows: -+ -+ SSLerr(SSL_F_SSL23_READ, SSL_R_SSL_HANDSHAKE_FAILURE); -+ -+Function and reason codes should consist of upper case characters, -+numbers and underscores only. The error file generation script translates -+function codes into function names by looking in the header files -+for an appropriate function name, if none is found it just uses -+the capitalized form such as "SSL23_READ" in the above example. -+ -+The trailing section of a reason code (after the "_R_") is translated -+into lower case and underscores changed to spaces. -+ -+When you are using new function or reason codes, run B<make errors>. -+The necessary B<#define>s will then automatically be added to the -+sub-library's header file. -+ -+Although a library will normally report errors using its own specific -+XXXerr macro, another library's macro can be used. This is normally -+only done when a library wants to include ASN1 code which must use -+the ASN1err() macro. -+ -+=head2 Adding new libraries -+ -+When adding a new sub-library to OpenSSL, assign it a library number -+B<ERR_LIB_XXX>, define a macro XXXerr() (both in B<err.h>), add its -+name to B<ERR_str_libraries[]> (in B<crypto/err/err.c>), and add -+C<ERR_load_XXX_strings()> to the ERR_load_crypto_strings() function -+(in B<crypto/err/err_all.c>). Finally, add an entry -+ -+ L XXX xxx.h xxx_err.c -+ -+to B<crypto/err/openssl.ec>, and add B<xxx_err.c> to the Makefile. -+Running B<make errors> will then generate a file B<xxx_err.c>, and -+add all error codes used in the library to B<xxx.h>. -+ -+Additionally the library include file must have a certain form. -+Typically it will initially look like this: -+ -+ #ifndef HEADER_XXX_H -+ #define HEADER_XXX_H -+ -+ #ifdef __cplusplus -+ extern "C" { -+ #endif -+ -+ /* Include files */ -+ -+ #include <openssl/bio.h> -+ #include <openssl/x509.h> -+ -+ /* Macros, structures and function prototypes */ -+ -+ -+ /* BEGIN ERROR CODES */ -+ -+The B<BEGIN ERROR CODES> sequence is used by the error code -+generation script as the point to place new error codes, any text -+after this point will be overwritten when B<make errors> is run. -+The closing #endif etc will be automatically added by the script. -+ -+The generated C error code file B<xxx_err.c> will load the header -+files B<stdio.h>, B<openssl/err.h> and B<openssl/xxx.h> so the -+header file must load any additional header files containing any -+definitions it uses. -+ -+=head1 USING ERROR CODES IN EXTERNAL LIBRARIES -+ -+It is also possible to use OpenSSL's error code scheme in external -+libraries. The library needs to load its own codes and call the OpenSSL -+error code insertion script B<mkerr.pl> explicitly to add codes to -+the header file and generate the C error code file. This will normally -+be done if the external library needs to generate new ASN1 structures -+but it can also be used to add more general purpose error code handling. -+ -+TBA more details -+ -+=head1 INTERNALS -+ -+The error queues are stored in a hash table with one B<ERR_STATE> -+entry for each pid. ERR_get_state() returns the current thread's -+B<ERR_STATE>. An B<ERR_STATE> can hold up to B<ERR_NUM_ERRORS> error -+codes. When more error codes are added, the old ones are overwritten, -+on the assumption that the most recent errors are most important. -+ -+Error strings are also stored in hash table. The hash tables can -+be obtained by calling ERR_get_err_state_table(void) and -+ERR_get_string_table(void) respectively. -+ -+=head1 SEE ALSO -+ -+L<CRYPTO_set_id_callback(3)|CRYPTO_set_id_callback(3)>, -+L<CRYPTO_set_locking_callback(3)|CRYPTO_set_locking_callback(3)>, -+L<ERR_get_error(3)|ERR_get_error(3)>, -+L<ERR_GET_LIB(3)|ERR_GET_LIB(3)>, -+L<ERR_clear_error(3)|ERR_clear_error(3)>, -+L<ERR_error_string(3)|ERR_error_string(3)>, -+L<ERR_print_errors(3)|ERR_print_errors(3)>, -+L<ERR_load_crypto_strings(3)|ERR_load_crypto_strings(3)>, -+L<ERR_remove_state(3)|ERR_remove_state(3)>, -+L<ERR_put_error(3)|ERR_put_error(3)>, -+L<ERR_load_strings(3)|ERR_load_strings(3)>, -+L<SSL_get_error(3)|SSL_get_error(3)> -+ -+=cut -diff -Naur openssl-0.9.8a.orig/doc/crypto/openssl_rand.pod openssl-0.9.8a/doc/crypto/openssl_rand.pod ---- openssl-0.9.8a.orig/doc/crypto/openssl_rand.pod 1970-01-01 00:00:00.000000000 +0000 -+++ openssl-0.9.8a/doc/crypto/openssl_rand.pod 2005-11-14 03:59:59.000000000 +0000 -@@ -0,0 +1,175 @@ -+=pod -+ -+=head1 NAME -+ -+openssl_rand - pseudo-random number generator -+ -+=head1 SYNOPSIS -+ -+ #include <openssl/rand.h> -+ -+ int RAND_set_rand_engine(ENGINE *engine); -+ -+ int RAND_bytes(unsigned char *buf, int num); -+ int RAND_pseudo_bytes(unsigned char *buf, int num); -+ -+ void RAND_seed(const void *buf, int num); -+ void RAND_add(const void *buf, int num, int entropy); -+ int RAND_status(void); -+ -+ int RAND_load_file(const char *file, long max_bytes); -+ int RAND_write_file(const char *file); -+ const char *RAND_file_name(char *file, size_t num); -+ -+ int RAND_egd(const char *path); -+ -+ void RAND_set_rand_method(const RAND_METHOD *meth); -+ const RAND_METHOD *RAND_get_rand_method(void); -+ RAND_METHOD *RAND_SSLeay(void); -+ -+ void RAND_cleanup(void); -+ -+ /* For Win32 only */ -+ void RAND_screen(void); -+ int RAND_event(UINT, WPARAM, LPARAM); -+ -+=head1 DESCRIPTION -+ -+Since the introduction of the ENGINE API, the recommended way of controlling -+default implementations is by using the ENGINE API functions. The default -+B<RAND_METHOD>, as set by RAND_set_rand_method() and returned by -+RAND_get_rand_method(), is only used if no ENGINE has been set as the default -+"rand" implementation. Hence, these two functions are no longer the recommened -+way to control defaults. -+ -+If an alternative B<RAND_METHOD> implementation is being used (either set -+directly or as provided by an ENGINE module), then it is entirely responsible -+for the generation and management of a cryptographically secure PRNG stream. The -+mechanisms described below relate solely to the software PRNG implementation -+built in to OpenSSL and used by default. -+ -+These functions implement a cryptographically secure pseudo-random -+number generator (PRNG). It is used by other library functions for -+example to generate random keys, and applications can use it when they -+need randomness. -+ -+A cryptographic PRNG must be seeded with unpredictable data such as -+mouse movements or keys pressed at random by the user. This is -+described in L<RAND_add(3)|RAND_add(3)>. Its state can be saved in a seed file -+(see L<RAND_load_file(3)|RAND_load_file(3)>) to avoid having to go through the -+seeding process whenever the application is started. -+ -+L<RAND_bytes(3)|RAND_bytes(3)> describes how to obtain random data from the -+PRNG. -+ -+=head1 INTERNALS -+ -+The RAND_SSLeay() method implements a PRNG based on a cryptographic -+hash function. -+ -+The following description of its design is based on the SSLeay -+documentation: -+ -+First up I will state the things I believe I need for a good RNG. -+ -+=over 4 -+ -+=item 1 -+ -+A good hashing algorithm to mix things up and to convert the RNG 'state' -+to random numbers. -+ -+=item 2 -+ -+An initial source of random 'state'. -+ -+=item 3 -+ -+The state should be very large. If the RNG is being used to generate -+4096 bit RSA keys, 2 2048 bit random strings are required (at a minimum). -+If your RNG state only has 128 bits, you are obviously limiting the -+search space to 128 bits, not 2048. I'm probably getting a little -+carried away on this last point but it does indicate that it may not be -+a bad idea to keep quite a lot of RNG state. It should be easier to -+break a cipher than guess the RNG seed data. -+ -+=item 4 -+ -+Any RNG seed data should influence all subsequent random numbers -+generated. This implies that any random seed data entered will have -+an influence on all subsequent random numbers generated. -+ -+=item 5 -+ -+When using data to seed the RNG state, the data used should not be -+extractable from the RNG state. I believe this should be a -+requirement because one possible source of 'secret' semi random -+data would be a private key or a password. This data must -+not be disclosed by either subsequent random numbers or a -+'core' dump left by a program crash. -+ -+=item 6 -+ -+Given the same initial 'state', 2 systems should deviate in their RNG state -+(and hence the random numbers generated) over time if at all possible. -+ -+=item 7 -+ -+Given the random number output stream, it should not be possible to determine -+the RNG state or the next random number. -+ -+=back -+ -+The algorithm is as follows. -+ -+There is global state made up of a 1023 byte buffer (the 'state'), a -+working hash value ('md'), and a counter ('count'). -+ -+Whenever seed data is added, it is inserted into the 'state' as -+follows. -+ -+The input is chopped up into units of 20 bytes (or less for -+the last block). Each of these blocks is run through the hash -+function as follows: The data passed to the hash function -+is the current 'md', the same number of bytes from the 'state' -+(the location determined by in incremented looping index) as -+the current 'block', the new key data 'block', and 'count' -+(which is incremented after each use). -+The result of this is kept in 'md' and also xored into the -+'state' at the same locations that were used as input into the -+hash function. I -+believe this system addresses points 1 (hash function; currently -+SHA-1), 3 (the 'state'), 4 (via the 'md'), 5 (by the use of a hash -+function and xor). -+ -+When bytes are extracted from the RNG, the following process is used. -+For each group of 10 bytes (or less), we do the following: -+ -+Input into the hash function the local 'md' (which is initialized from -+the global 'md' before any bytes are generated), the bytes that are to -+be overwritten by the random bytes, and bytes from the 'state' -+(incrementing looping index). From this digest output (which is kept -+in 'md'), the top (up to) 10 bytes are returned to the caller and the -+bottom 10 bytes are xored into the 'state'. -+ -+Finally, after we have finished 'num' random bytes for the caller, -+'count' (which is incremented) and the local and global 'md' are fed -+into the hash function and the results are kept in the global 'md'. -+ -+I believe the above addressed points 1 (use of SHA-1), 6 (by hashing -+into the 'state' the 'old' data from the caller that is about to be -+overwritten) and 7 (by not using the 10 bytes given to the caller to -+update the 'state', but they are used to update 'md'). -+ -+So of the points raised, only 2 is not addressed (but see -+L<RAND_add(3)|RAND_add(3)>). -+ -+=head1 SEE ALSO -+ -+L<BN_rand(3)|BN_rand(3)>, L<RAND_add(3)|RAND_add(3)>, -+L<RAND_load_file(3)|RAND_load_file(3)>, L<RAND_egd(3)|RAND_egd(3)>, -+L<RAND_bytes(3)|RAND_bytes(3)>, -+L<RAND_set_rand_method(3)|RAND_set_rand_method(3)>, -+L<RAND_cleanup(3)|RAND_cleanup(3)> -+ -+=cut -diff -Naur openssl-0.9.8a.orig/doc/crypto/openssl_threads.pod openssl-0.9.8a/doc/crypto/openssl_threads.pod ---- openssl-0.9.8a.orig/doc/crypto/openssl_threads.pod 1970-01-01 00:00:00.000000000 +0000 -+++ openssl-0.9.8a/doc/crypto/openssl_threads.pod 2005-11-14 03:59:59.000000000 +0000 -@@ -0,0 +1,175 @@ -+=pod -+ -+=head1 NAME -+ -+CRYPTO_set_locking_callback, CRYPTO_set_id_callback, CRYPTO_num_locks, -+CRYPTO_set_dynlock_create_callback, CRYPTO_set_dynlock_lock_callback, -+CRYPTO_set_dynlock_destroy_callback, CRYPTO_get_new_dynlockid, -+CRYPTO_destroy_dynlockid, CRYPTO_lock - OpenSSL thread support -+ -+=head1 SYNOPSIS -+ -+ #include <openssl/crypto.h> -+ -+ void CRYPTO_set_locking_callback(void (*locking_function)(int mode, -+ int n, const char *file, int line)); -+ -+ void CRYPTO_set_id_callback(unsigned long (*id_function)(void)); -+ -+ int CRYPTO_num_locks(void); -+ -+ -+ /* struct CRYPTO_dynlock_value needs to be defined by the user */ -+ struct CRYPTO_dynlock_value; -+ -+ void CRYPTO_set_dynlock_create_callback(struct CRYPTO_dynlock_value * -+ (*dyn_create_function)(char *file, int line)); -+ void CRYPTO_set_dynlock_lock_callback(void (*dyn_lock_function) -+ (int mode, struct CRYPTO_dynlock_value *l, -+ const char *file, int line)); -+ void CRYPTO_set_dynlock_destroy_callback(void (*dyn_destroy_function) -+ (struct CRYPTO_dynlock_value *l, const char *file, int line)); -+ -+ int CRYPTO_get_new_dynlockid(void); -+ -+ void CRYPTO_destroy_dynlockid(int i); -+ -+ void CRYPTO_lock(int mode, int n, const char *file, int line); -+ -+ #define CRYPTO_w_lock(type) \ -+ CRYPTO_lock(CRYPTO_LOCK|CRYPTO_WRITE,type,__FILE__,__LINE__) -+ #define CRYPTO_w_unlock(type) \ -+ CRYPTO_lock(CRYPTO_UNLOCK|CRYPTO_WRITE,type,__FILE__,__LINE__) -+ #define CRYPTO_r_lock(type) \ -+ CRYPTO_lock(CRYPTO_LOCK|CRYPTO_READ,type,__FILE__,__LINE__) -+ #define CRYPTO_r_unlock(type) \ -+ CRYPTO_lock(CRYPTO_UNLOCK|CRYPTO_READ,type,__FILE__,__LINE__) -+ #define CRYPTO_add(addr,amount,type) \ -+ CRYPTO_add_lock(addr,amount,type,__FILE__,__LINE__) -+ -+=head1 DESCRIPTION -+ -+OpenSSL can safely be used in multi-threaded applications provided -+that at least two callback functions are set. -+ -+locking_function(int mode, int n, const char *file, int line) is -+needed to perform locking on shared data structures. -+(Note that OpenSSL uses a number of global data structures that -+will be implicitly shared whenever multiple threads use OpenSSL.) -+Multi-threaded applications will crash at random if it is not set. -+ -+locking_function() must be able to handle up to CRYPTO_num_locks() -+different mutex locks. It sets the B<n>-th lock if B<mode> & -+B<CRYPTO_LOCK>, and releases it otherwise. -+ -+B<file> and B<line> are the file number of the function setting the -+lock. They can be useful for debugging. -+ -+id_function(void) is a function that returns a thread ID, for example -+pthread_self() if it returns an integer (see NOTES below). It isn't -+needed on Windows nor on platforms where getpid() returns a different -+ID for each thread (see NOTES below). -+ -+Additionally, OpenSSL supports dynamic locks, and sometimes, some parts -+of OpenSSL need it for better performance. To enable this, the following -+is required: -+ -+=over 4 -+ -+=item * -+Three additional callback function, dyn_create_function, dyn_lock_function -+and dyn_destroy_function. -+ -+=item * -+A structure defined with the data that each lock needs to handle. -+ -+=back -+ -+struct CRYPTO_dynlock_value has to be defined to contain whatever structure -+is needed to handle locks. -+ -+dyn_create_function(const char *file, int line) is needed to create a -+lock. Multi-threaded applications might crash at random if it is not set. -+ -+dyn_lock_function(int mode, CRYPTO_dynlock *l, const char *file, int line) -+is needed to perform locking off dynamic lock numbered n. Multi-threaded -+applications might crash at random if it is not set. -+ -+dyn_destroy_function(CRYPTO_dynlock *l, const char *file, int line) is -+needed to destroy the lock l. Multi-threaded applications might crash at -+random if it is not set. -+ -+CRYPTO_get_new_dynlockid() is used to create locks. It will call -+dyn_create_function for the actual creation. -+ -+CRYPTO_destroy_dynlockid() is used to destroy locks. It will call -+dyn_destroy_function for the actual destruction. -+ -+CRYPTO_lock() is used to lock and unlock the locks. mode is a bitfield -+describing what should be done with the lock. n is the number of the -+lock as returned from CRYPTO_get_new_dynlockid(). mode can be combined -+from the following values. These values are pairwise exclusive, with -+undefined behaviour if misused (for example, CRYPTO_READ and CRYPTO_WRITE -+should not be used together): -+ -+ CRYPTO_LOCK 0x01 -+ CRYPTO_UNLOCK 0x02 -+ CRYPTO_READ 0x04 -+ CRYPTO_WRITE 0x08 -+ -+=head1 RETURN VALUES -+ -+CRYPTO_num_locks() returns the required number of locks. -+ -+CRYPTO_get_new_dynlockid() returns the index to the newly created lock. -+ -+The other functions return no values. -+ -+=head1 NOTES -+ -+You can find out if OpenSSL was configured with thread support: -+ -+ #define OPENSSL_THREAD_DEFINES -+ #include <openssl/opensslconf.h> -+ #if defined(OPENSSL_THREADS) -+ // thread support enabled -+ #else -+ // no thread support -+ #endif -+ -+Also, dynamic locks are currently not used internally by OpenSSL, but -+may do so in the future. -+ -+Defining id_function(void) has it's own issues. Generally speaking, -+pthread_self() should be used, even on platforms where getpid() gives -+different answers in each thread, since that may depend on the machine -+the program is run on, not the machine where the program is being -+compiled. For instance, Red Hat 8 Linux and earlier used -+LinuxThreads, whose getpid() returns a different value for each -+thread. Red Hat 9 Linux and later use NPTL, which is -+Posix-conformant, and has a getpid() that returns the same value for -+all threads in a process. A program compiled on Red Hat 8 and run on -+Red Hat 9 will therefore see getpid() returning the same value for -+all threads. -+ -+There is still the issue of platforms where pthread_self() returns -+something other than an integer. This is a bit unusual, and this -+manual has no cookbook solution for that case. -+ -+=head1 EXAMPLES -+ -+B<crypto/threads/mttest.c> shows examples of the callback functions on -+Solaris, Irix and Win32. -+ -+=head1 HISTORY -+ -+CRYPTO_set_locking_callback() and CRYPTO_set_id_callback() are -+available in all versions of SSLeay and OpenSSL. -+CRYPTO_num_locks() was added in OpenSSL 0.9.4. -+All functions dealing with dynamic locks were added in OpenSSL 0.9.5b-dev. -+ -+=head1 SEE ALSO -+ -+L<crypto(3)|crypto(3)> -+ -+=cut -diff -Naur openssl-0.9.8a.orig/doc/crypto/rand.pod openssl-0.9.8a/doc/crypto/rand.pod ---- openssl-0.9.8a.orig/doc/crypto/rand.pod 2002-08-05 16:27:01.000000000 +0000 -+++ openssl-0.9.8a/doc/crypto/rand.pod 1970-01-01 00:00:00.000000000 +0000 -@@ -1,175 +0,0 @@ --=pod -- --=head1 NAME -- --rand - pseudo-random number generator -- --=head1 SYNOPSIS -- -- #include <openssl/rand.h> -- -- int RAND_set_rand_engine(ENGINE *engine); -- -- int RAND_bytes(unsigned char *buf, int num); -- int RAND_pseudo_bytes(unsigned char *buf, int num); -- -- void RAND_seed(const void *buf, int num); -- void RAND_add(const void *buf, int num, int entropy); -- int RAND_status(void); -- -- int RAND_load_file(const char *file, long max_bytes); -- int RAND_write_file(const char *file); -- const char *RAND_file_name(char *file, size_t num); -- -- int RAND_egd(const char *path); -- -- void RAND_set_rand_method(const RAND_METHOD *meth); -- const RAND_METHOD *RAND_get_rand_method(void); -- RAND_METHOD *RAND_SSLeay(void); -- -- void RAND_cleanup(void); -- -- /* For Win32 only */ -- void RAND_screen(void); -- int RAND_event(UINT, WPARAM, LPARAM); -- --=head1 DESCRIPTION -- --Since the introduction of the ENGINE API, the recommended way of controlling --default implementations is by using the ENGINE API functions. The default --B<RAND_METHOD>, as set by RAND_set_rand_method() and returned by --RAND_get_rand_method(), is only used if no ENGINE has been set as the default --"rand" implementation. Hence, these two functions are no longer the recommened --way to control defaults. -- --If an alternative B<RAND_METHOD> implementation is being used (either set --directly or as provided by an ENGINE module), then it is entirely responsible --for the generation and management of a cryptographically secure PRNG stream. The --mechanisms described below relate solely to the software PRNG implementation --built in to OpenSSL and used by default. -- --These functions implement a cryptographically secure pseudo-random --number generator (PRNG). It is used by other library functions for --example to generate random keys, and applications can use it when they --need randomness. -- --A cryptographic PRNG must be seeded with unpredictable data such as --mouse movements or keys pressed at random by the user. This is --described in L<RAND_add(3)|RAND_add(3)>. Its state can be saved in a seed file --(see L<RAND_load_file(3)|RAND_load_file(3)>) to avoid having to go through the --seeding process whenever the application is started. -- --L<RAND_bytes(3)|RAND_bytes(3)> describes how to obtain random data from the --PRNG. -- --=head1 INTERNALS -- --The RAND_SSLeay() method implements a PRNG based on a cryptographic --hash function. -- --The following description of its design is based on the SSLeay --documentation: -- --First up I will state the things I believe I need for a good RNG. -- --=over 4 -- --=item 1 -- --A good hashing algorithm to mix things up and to convert the RNG 'state' --to random numbers. -- --=item 2 -- --An initial source of random 'state'. -- --=item 3 -- --The state should be very large. If the RNG is being used to generate --4096 bit RSA keys, 2 2048 bit random strings are required (at a minimum). --If your RNG state only has 128 bits, you are obviously limiting the --search space to 128 bits, not 2048. I'm probably getting a little --carried away on this last point but it does indicate that it may not be --a bad idea to keep quite a lot of RNG state. It should be easier to --break a cipher than guess the RNG seed data. -- --=item 4 -- --Any RNG seed data should influence all subsequent random numbers --generated. This implies that any random seed data entered will have --an influence on all subsequent random numbers generated. -- --=item 5 -- --When using data to seed the RNG state, the data used should not be --extractable from the RNG state. I believe this should be a --requirement because one possible source of 'secret' semi random --data would be a private key or a password. This data must --not be disclosed by either subsequent random numbers or a --'core' dump left by a program crash. -- --=item 6 -- --Given the same initial 'state', 2 systems should deviate in their RNG state --(and hence the random numbers generated) over time if at all possible. -- --=item 7 -- --Given the random number output stream, it should not be possible to determine --the RNG state or the next random number. -- --=back -- --The algorithm is as follows. -- --There is global state made up of a 1023 byte buffer (the 'state'), a --working hash value ('md'), and a counter ('count'). -- --Whenever seed data is added, it is inserted into the 'state' as --follows. -- --The input is chopped up into units of 20 bytes (or less for --the last block). Each of these blocks is run through the hash --function as follows: The data passed to the hash function --is the current 'md', the same number of bytes from the 'state' --(the location determined by in incremented looping index) as --the current 'block', the new key data 'block', and 'count' --(which is incremented after each use). --The result of this is kept in 'md' and also xored into the --'state' at the same locations that were used as input into the --hash function. I --believe this system addresses points 1 (hash function; currently --SHA-1), 3 (the 'state'), 4 (via the 'md'), 5 (by the use of a hash --function and xor). -- --When bytes are extracted from the RNG, the following process is used. --For each group of 10 bytes (or less), we do the following: -- --Input into the hash function the local 'md' (which is initialized from --the global 'md' before any bytes are generated), the bytes that are to --be overwritten by the random bytes, and bytes from the 'state' --(incrementing looping index). From this digest output (which is kept --in 'md'), the top (up to) 10 bytes are returned to the caller and the --bottom 10 bytes are xored into the 'state'. -- --Finally, after we have finished 'num' random bytes for the caller, --'count' (which is incremented) and the local and global 'md' are fed --into the hash function and the results are kept in the global 'md'. -- --I believe the above addressed points 1 (use of SHA-1), 6 (by hashing --into the 'state' the 'old' data from the caller that is about to be --overwritten) and 7 (by not using the 10 bytes given to the caller to --update the 'state', but they are used to update 'md'). -- --So of the points raised, only 2 is not addressed (but see --L<RAND_add(3)|RAND_add(3)>). -- --=head1 SEE ALSO -- --L<BN_rand(3)|BN_rand(3)>, L<RAND_add(3)|RAND_add(3)>, --L<RAND_load_file(3)|RAND_load_file(3)>, L<RAND_egd(3)|RAND_egd(3)>, --L<RAND_bytes(3)|RAND_bytes(3)>, --L<RAND_set_rand_method(3)|RAND_set_rand_method(3)>, --L<RAND_cleanup(3)|RAND_cleanup(3)> -- --=cut -diff -Naur openssl-0.9.8a.orig/doc/crypto/rsa.pod openssl-0.9.8a/doc/crypto/rsa.pod ---- openssl-0.9.8a.orig/doc/crypto/rsa.pod 2002-08-04 21:08:36.000000000 +0000 -+++ openssl-0.9.8a/doc/crypto/rsa.pod 2005-11-14 03:59:59.000000000 +0000 -@@ -108,7 +108,7 @@ - =head1 SEE ALSO - - L<rsa(1)|rsa(1)>, L<bn(3)|bn(3)>, L<dsa(3)|dsa(3)>, L<dh(3)|dh(3)>, --L<rand(3)|rand(3)>, L<engine(3)|engine(3)>, L<RSA_new(3)|RSA_new(3)>, -+L<openssl_rand(3)|openssl_rand(3)>, L<engine(3)|engine(3)>, L<RSA_new(3)|RSA_new(3)>, - L<RSA_public_encrypt(3)|RSA_public_encrypt(3)>, - L<RSA_sign(3)|RSA_sign(3)>, L<RSA_size(3)|RSA_size(3)>, - L<RSA_generate_key(3)|RSA_generate_key(3)>, -diff -Naur openssl-0.9.8a.orig/doc/crypto/threads.pod openssl-0.9.8a/doc/crypto/threads.pod ---- openssl-0.9.8a.orig/doc/crypto/threads.pod 2005-06-18 05:52:23.000000000 +0000 -+++ openssl-0.9.8a/doc/crypto/threads.pod 1970-01-01 00:00:00.000000000 +0000 -@@ -1,175 +0,0 @@ --=pod -- --=head1 NAME -- --CRYPTO_set_locking_callback, CRYPTO_set_id_callback, CRYPTO_num_locks, --CRYPTO_set_dynlock_create_callback, CRYPTO_set_dynlock_lock_callback, --CRYPTO_set_dynlock_destroy_callback, CRYPTO_get_new_dynlockid, --CRYPTO_destroy_dynlockid, CRYPTO_lock - OpenSSL thread support -- --=head1 SYNOPSIS -- -- #include <openssl/crypto.h> -- -- void CRYPTO_set_locking_callback(void (*locking_function)(int mode, -- int n, const char *file, int line)); -- -- void CRYPTO_set_id_callback(unsigned long (*id_function)(void)); -- -- int CRYPTO_num_locks(void); -- -- -- /* struct CRYPTO_dynlock_value needs to be defined by the user */ -- struct CRYPTO_dynlock_value; -- -- void CRYPTO_set_dynlock_create_callback(struct CRYPTO_dynlock_value * -- (*dyn_create_function)(char *file, int line)); -- void CRYPTO_set_dynlock_lock_callback(void (*dyn_lock_function) -- (int mode, struct CRYPTO_dynlock_value *l, -- const char *file, int line)); -- void CRYPTO_set_dynlock_destroy_callback(void (*dyn_destroy_function) -- (struct CRYPTO_dynlock_value *l, const char *file, int line)); -- -- int CRYPTO_get_new_dynlockid(void); -- -- void CRYPTO_destroy_dynlockid(int i); -- -- void CRYPTO_lock(int mode, int n, const char *file, int line); -- -- #define CRYPTO_w_lock(type) \ -- CRYPTO_lock(CRYPTO_LOCK|CRYPTO_WRITE,type,__FILE__,__LINE__) -- #define CRYPTO_w_unlock(type) \ -- CRYPTO_lock(CRYPTO_UNLOCK|CRYPTO_WRITE,type,__FILE__,__LINE__) -- #define CRYPTO_r_lock(type) \ -- CRYPTO_lock(CRYPTO_LOCK|CRYPTO_READ,type,__FILE__,__LINE__) -- #define CRYPTO_r_unlock(type) \ -- CRYPTO_lock(CRYPTO_UNLOCK|CRYPTO_READ,type,__FILE__,__LINE__) -- #define CRYPTO_add(addr,amount,type) \ -- CRYPTO_add_lock(addr,amount,type,__FILE__,__LINE__) -- --=head1 DESCRIPTION -- --OpenSSL can safely be used in multi-threaded applications provided --that at least two callback functions are set. -- --locking_function(int mode, int n, const char *file, int line) is --needed to perform locking on shared data structures. --(Note that OpenSSL uses a number of global data structures that --will be implicitly shared whenever multiple threads use OpenSSL.) --Multi-threaded applications will crash at random if it is not set. -- --locking_function() must be able to handle up to CRYPTO_num_locks() --different mutex locks. It sets the B<n>-th lock if B<mode> & --B<CRYPTO_LOCK>, and releases it otherwise. -- --B<file> and B<line> are the file number of the function setting the --lock. They can be useful for debugging. -- --id_function(void) is a function that returns a thread ID, for example --pthread_self() if it returns an integer (see NOTES below). It isn't --needed on Windows nor on platforms where getpid() returns a different --ID for each thread (see NOTES below). -- --Additionally, OpenSSL supports dynamic locks, and sometimes, some parts --of OpenSSL need it for better performance. To enable this, the following --is required: -- --=over 4 -- --=item * --Three additional callback function, dyn_create_function, dyn_lock_function --and dyn_destroy_function. -- --=item * --A structure defined with the data that each lock needs to handle. -- --=back -- --struct CRYPTO_dynlock_value has to be defined to contain whatever structure --is needed to handle locks. -- --dyn_create_function(const char *file, int line) is needed to create a --lock. Multi-threaded applications might crash at random if it is not set. -- --dyn_lock_function(int mode, CRYPTO_dynlock *l, const char *file, int line) --is needed to perform locking off dynamic lock numbered n. Multi-threaded --applications might crash at random if it is not set. -- --dyn_destroy_function(CRYPTO_dynlock *l, const char *file, int line) is --needed to destroy the lock l. Multi-threaded applications might crash at --random if it is not set. -- --CRYPTO_get_new_dynlockid() is used to create locks. It will call --dyn_create_function for the actual creation. -- --CRYPTO_destroy_dynlockid() is used to destroy locks. It will call --dyn_destroy_function for the actual destruction. -- --CRYPTO_lock() is used to lock and unlock the locks. mode is a bitfield --describing what should be done with the lock. n is the number of the --lock as returned from CRYPTO_get_new_dynlockid(). mode can be combined --from the following values. These values are pairwise exclusive, with --undefined behaviour if misused (for example, CRYPTO_READ and CRYPTO_WRITE --should not be used together): -- -- CRYPTO_LOCK 0x01 -- CRYPTO_UNLOCK 0x02 -- CRYPTO_READ 0x04 -- CRYPTO_WRITE 0x08 -- --=head1 RETURN VALUES -- --CRYPTO_num_locks() returns the required number of locks. -- --CRYPTO_get_new_dynlockid() returns the index to the newly created lock. -- --The other functions return no values. -- --=head1 NOTES -- --You can find out if OpenSSL was configured with thread support: -- -- #define OPENSSL_THREAD_DEFINES -- #include <openssl/opensslconf.h> -- #if defined(OPENSSL_THREADS) -- // thread support enabled -- #else -- // no thread support -- #endif -- --Also, dynamic locks are currently not used internally by OpenSSL, but --may do so in the future. -- --Defining id_function(void) has it's own issues. Generally speaking, --pthread_self() should be used, even on platforms where getpid() gives --different answers in each thread, since that may depend on the machine --the program is run on, not the machine where the program is being --compiled. For instance, Red Hat 8 Linux and earlier used --LinuxThreads, whose getpid() returns a different value for each --thread. Red Hat 9 Linux and later use NPTL, which is --Posix-conformant, and has a getpid() that returns the same value for --all threads in a process. A program compiled on Red Hat 8 and run on --Red Hat 9 will therefore see getpid() returning the same value for --all threads. -- --There is still the issue of platforms where pthread_self() returns --something other than an integer. This is a bit unusual, and this --manual has no cookbook solution for that case. -- --=head1 EXAMPLES -- --B<crypto/threads/mttest.c> shows examples of the callback functions on --Solaris, Irix and Win32. -- --=head1 HISTORY -- --CRYPTO_set_locking_callback() and CRYPTO_set_id_callback() are --available in all versions of SSLeay and OpenSSL. --CRYPTO_num_locks() was added in OpenSSL 0.9.4. --All functions dealing with dynamic locks were added in OpenSSL 0.9.5b-dev. -- --=head1 SEE ALSO -- --L<crypto(3)|crypto(3)> -- --=cut -diff -Naur openssl-0.9.8a.orig/doc/ssl/SSL_get_error.pod openssl-0.9.8a/doc/ssl/SSL_get_error.pod ---- openssl-0.9.8a.orig/doc/ssl/SSL_get_error.pod 2005-03-30 11:50:14.000000000 +0000 -+++ openssl-0.9.8a/doc/ssl/SSL_get_error.pod 2005-11-14 03:59:59.000000000 +0000 -@@ -105,7 +105,7 @@ - - =head1 SEE ALSO - --L<ssl(3)|ssl(3)>, L<err(3)|err(3)> -+L<ssl(3)|ssl(3)>, L<openssl_err(3)|openssl_err(3)> - - =head1 HISTORY - -diff -Naur openssl-0.9.8a.orig/doc/ssl/SSL_want.pod openssl-0.9.8a/doc/ssl/SSL_want.pod ---- openssl-0.9.8a.orig/doc/ssl/SSL_want.pod 2005-03-30 11:50:14.000000000 +0000 -+++ openssl-0.9.8a/doc/ssl/SSL_want.pod 2005-11-14 03:59:59.000000000 +0000 -@@ -72,6 +72,6 @@ - - =head1 SEE ALSO - --L<ssl(3)|ssl(3)>, L<err(3)|err(3)>, L<SSL_get_error(3)|SSL_get_error(3)> -+L<ssl(3)|ssl(3)>, L<openssl_err(3)|openssl_err(3)>, L<SSL_get_error(3)|SSL_get_error(3)> - - =cut diff --git a/pkgs/core/openssl/patches/openssl-1.0.0-beta3-soversion.patch b/pkgs/core/openssl/patches/openssl-1.0.0-beta3-soversion.patch new file mode 100644 index 0000000..3836e89 --- /dev/null +++ b/pkgs/core/openssl/patches/openssl-1.0.0-beta3-soversion.patch @@ -0,0 +1,44 @@ +diff -up openssl-1.0.0-beta3/Configure.soversion openssl-1.0.0-beta3/Configure +--- openssl-1.0.0-beta3/Configure.soversion 2009-08-04 23:06:52.000000000 +0200 ++++ openssl-1.0.0-beta3/Configure 2009-08-04 23:06:52.000000000 +0200 +@@ -1514,7 +1514,7 @@ while (<IN>) + elsif ($shared_extension ne "" && $shared_extension =~ /^\.s([ol])\.[^\.]*\.[^\.]*$/) + { + my $sotmp = $1; +- s/^SHARED_LIBS_LINK_EXTS=.*/SHARED_LIBS_LINK_EXTS=.s$sotmp.\$(SHLIB_MAJOR) .s$sotmp/; ++ s/^SHARED_LIBS_LINK_EXTS=.*/SHARED_LIBS_LINK_EXTS=.s$sotmp.\$(SHLIB_SONAMEVER) .s$sotmp/; + } + elsif ($shared_extension ne "" && $shared_extension =~ /^\.[^\.]*\.[^\.]*\.dylib$/) + { +diff -up openssl-1.0.0-beta3/Makefile.org.soversion openssl-1.0.0-beta3/Makefile.org +--- openssl-1.0.0-beta3/Makefile.org.soversion 2009-08-04 23:06:52.000000000 +0200 ++++ openssl-1.0.0-beta3/Makefile.org 2009-08-04 23:11:01.000000000 +0200 +@@ -10,6 +10,7 @@ SHLIB_VERSION_HISTORY= + SHLIB_MAJOR= + SHLIB_MINOR= + SHLIB_EXT= ++SHLIB_SONAMEVER=10 + PLATFORM=dist + OPTIONS= + CONFIGURE_ARGS= +@@ -289,10 +290,9 @@ clean-shared: + link-shared: + @ set -e; for i in $(SHLIBDIRS); do \ + $(MAKE) -f $(HERE)/Makefile.shared -e $(BUILDENV) \ +- LIBNAME=$$i LIBVERSION=$(SHLIB_MAJOR).$(SHLIB_MINOR) \ ++ LIBNAME=$$i LIBVERSION=$(SHLIB_SONAMEVER) \ + LIBCOMPATVERSIONS=";$(SHLIB_VERSION_HISTORY)" \ + symlink.$(SHLIB_TARGET); \ +- libs="$$libs -l$$i"; \ + done + + build-shared: do_$(SHLIB_TARGET) link-shared +@@ -303,7 +303,7 @@ do_$(SHLIB_TARGET): + libs="$(LIBKRB5) $$libs"; \ + fi; \ + $(CLEARENV) && $(MAKE) -f Makefile.shared -e $(BUILDENV) \ +- LIBNAME=$$i LIBVERSION=$(SHLIB_MAJOR).$(SHLIB_MINOR) \ ++ LIBNAME=$$i LIBVERSION=$(SHLIB_SONAMEVER) \ + LIBCOMPATVERSIONS=";$(SHLIB_VERSION_HISTORY)" \ + LIBDEPS="$$libs $(EX_LIBS)" \ + link_a.$(SHLIB_TARGET); \ diff --git a/pkgs/core/openssl/patches/openssl-1.0.0-beta4-redhat.patch b/pkgs/core/openssl/patches/openssl-1.0.0-beta4-redhat.patch new file mode 100644 index 0000000..4356e41 --- /dev/null +++ b/pkgs/core/openssl/patches/openssl-1.0.0-beta4-redhat.patch @@ -0,0 +1,59 @@ +diff -up openssl-1.0.0-beta4/Configure.redhat openssl-1.0.0-beta4/Configure +--- openssl-1.0.0-beta4/Configure.redhat 2009-11-09 15:11:13.000000000 +0100 ++++ openssl-1.0.0-beta4/Configure 2009-11-12 12:15:27.000000000 +0100 +@@ -336,32 +336,32 @@ my %table=( + #### + # *-generic* is endian-neutral target, but ./config is free to + # throw in -D[BL]_ENDIAN, whichever appropriate... +-"linux-generic32","gcc:-DTERMIO -O3 -fomit-frame-pointer -Wall::-D_REENTRANT::-ldl:BN_LLONG RC4_CHAR RC4_CHUNK DES_INT DES_UNROLL BF_PTR:${no_asm}:dlfcn:linux-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)", +-"linux-ppc", "gcc:-DB_ENDIAN -DTERMIO -O3 -Wall::-D_REENTRANT::-ldl:BN_LLONG RC4_CHAR RC4_CHUNK DES_RISC1 DES_UNROLL:${ppc32_asm}:linux32:dlfcn:linux-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)", ++"linux-generic32","gcc:-DTERMIO -Wall \$(RPM_OPT_FLAGS)::-D_REENTRANT::-ldl:BN_LLONG RC4_CHAR RC4_CHUNK DES_INT DES_UNROLL BF_PTR:${no_asm}:dlfcn:linux-shared:-fPIC:\$(RPM_OPT_FLAGS):.so.\$(SHLIB_SONAMEVER)", ++"linux-ppc", "gcc:-DB_ENDIAN -DTERMIO -Wall \$(RPM_OPT_FLAGS)::-D_REENTRANT::-ldl:BN_LLONG RC4_CHAR RC4_CHUNK DES_RISC1 DES_UNROLL:${ppc32_asm}:linux32:dlfcn:linux-shared:-fPIC:\$(RPM_OPT_FLAGS):.so.\$(SHLIB_SONAMEVER)", + # It's believed that majority of ARM toolchains predefine appropriate -march. + # If you compiler does not, do complement config command line with one! +-"linux-armv4", "gcc:-DTERMIO -O3 -Wall::-D_REENTRANT::-ldl:BN_LLONG RC4_CHAR RC4_CHUNK DES_INT DES_UNROLL BF_PTR:${armv4_asm}:dlfcn:linux-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)", ++"linux-armv4", "gcc:-DTERMIO -Wall \$(RPM_OPT_FLAGS)::-D_REENTRANT::-ldl:BN_LLONG RC4_CHAR RC4_CHUNK DES_INT DES_UNROLL BF_PTR:${armv4_asm}:dlfcn:linux-shared:-fPIC:\$(RPM_OPT_FLAGS):.so.\$(SHLIB_SONAMEVER)", + #### IA-32 targets... + "linux-ia32-icc", "icc:-DL_ENDIAN -DTERMIO -O2 -no_cpprt::-D_REENTRANT::-ldl:BN_LLONG ${x86_gcc_des} ${x86_gcc_opts}:${x86_elf_asm}:dlfcn:linux-shared:-KPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)", +-"linux-elf", "gcc:-DL_ENDIAN -DTERMIO -O3 -fomit-frame-pointer -Wall::-D_REENTRANT::-ldl:BN_LLONG ${x86_gcc_des} ${x86_gcc_opts}:${x86_elf_asm}:dlfcn:linux-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)", ++"linux-elf", "gcc:-DL_ENDIAN -DTERMIO -Wall \$(RPM_OPT_FLAGS)::-D_REENTRANT::-ldl:BN_LLONG ${x86_gcc_des} ${x86_gcc_opts}:${x86_elf_asm}:dlfcn:linux-shared:-fPIC:\$(RPM_OPT_FLAGS):.so.\$(SHLIB_SONAMEVER)", + "linux-aout", "gcc:-DL_ENDIAN -DTERMIO -O3 -fomit-frame-pointer -march=i486 -Wall::(unknown):::BN_LLONG ${x86_gcc_des} ${x86_gcc_opts}:${x86_asm}:a.out", + #### +-"linux-generic64","gcc:-DTERMIO -O3 -Wall::-D_REENTRANT::-ldl:SIXTY_FOUR_BIT_LONG RC4_CHAR RC4_CHUNK DES_INT DES_UNROLL BF_PTR:${no_asm}:dlfcn:linux-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)", +-"linux-ppc64", "gcc:-m64 -DB_ENDIAN -DTERMIO -O3 -Wall::-D_REENTRANT::-ldl:SIXTY_FOUR_BIT_LONG RC4_CHAR RC4_CHUNK DES_RISC1 DES_UNROLL:${ppc64_asm}:linux64:dlfcn:linux-shared:-fPIC:-m64:.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR):::64", +-"linux-ia64", "gcc:-DL_ENDIAN -DTERMIO -O3 -Wall::-D_REENTRANT::-ldl:SIXTY_FOUR_BIT_LONG RC4_CHUNK DES_UNROLL DES_INT:${ia64_asm}:dlfcn:linux-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)", ++"linux-generic64","gcc:-DTERMIO -Wall \$(RPM_OPT_FLAGS)::-D_REENTRANT::-ldl:SIXTY_FOUR_BIT_LONG RC4_CHAR RC4_CHUNK DES_INT DES_UNROLL BF_PTR:${no_asm}:dlfcn:linux-shared:-fPIC:\$(RPM_OPT_FLAGS):.so.\$(SHLIB_SONAMEVER)", ++"linux-ppc64", "gcc:-m64 -DB_ENDIAN -DTERMIO -Wall \$(RPM_OPT_FLAGS)::-D_REENTRANT::-ldl:SIXTY_FOUR_BIT_LONG RC4_CHAR RC4_CHUNK DES_RISC1 DES_UNROLL:${ppc64_asm}:linux64:dlfcn:linux-shared:-fPIC:-m64 \$(RPM_OPT_FLAGS):.so.\$(SHLIB_SONAMEVER):::64", ++"linux-ia64", "gcc:-DL_ENDIAN -DTERMIO -Wall \$(RPM_OPT_FLAGS)::-D_REENTRANT::-ldl:SIXTY_FOUR_BIT_LONG RC4_CHUNK DES_UNROLL DES_INT:${ia64_asm}:dlfcn:linux-shared:-fPIC:\$(RPM_OPT_FLAGS):.so.\$(SHLIB_SONAMEVER)", + "linux-ia64-ecc","ecc:-DL_ENDIAN -DTERMIO -O2 -Wall -no_cpprt::-D_REENTRANT::-ldl:SIXTY_FOUR_BIT_LONG RC4_CHUNK DES_INT:${ia64_asm}:dlfcn:linux-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)", + "linux-ia64-icc","icc:-DL_ENDIAN -DTERMIO -O2 -Wall -no_cpprt::-D_REENTRANT::-ldl:SIXTY_FOUR_BIT_LONG RC4_CHUNK DES_RISC1 DES_INT:${ia64_asm}:dlfcn:linux-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)", +-"linux-x86_64", "gcc:-m64 -DL_ENDIAN -DTERMIO -O3 -Wall -DMD32_REG_T=int::-D_REENTRANT::-ldl:SIXTY_FOUR_BIT_LONG RC4_CHUNK DES_INT DES_UNROLL:${x86_64_asm}:elf:dlfcn:linux-shared:-fPIC:-m64:.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR):::64", +-"linux-s390x", "gcc:-m64 -DB_ENDIAN -DTERMIO -O3 -Wall::-D_REENTRANT::-ldl:SIXTY_FOUR_BIT_LONG RC4_CHAR RC4_CHUNK DES_INT DES_UNROLL:${s390x_asm}:dlfcn:linux-shared:-fPIC:-m64:.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR):::64", ++"linux-x86_64", "gcc:-m64 -DL_ENDIAN -DTERMIO -Wall \$(RPM_OPT_FLAGS) -DMD32_REG_T=int::-D_REENTRANT::-ldl:SIXTY_FOUR_BIT_LONG RC4_CHUNK DES_INT DES_UNROLL:${x86_64_asm}:elf:dlfcn:linux-shared:-fPIC:-m64 \$(RPM_OPT_FLAGS):.so.\$(SHLIB_SONAMEVER):::64", ++"linux-s390x", "gcc:-m64 -DB_ENDIAN -DTERMIO -Wall \$(RPM_OPT_FLAGS)::-D_REENTRANT::-ldl:SIXTY_FOUR_BIT_LONG RC4_CHAR RC4_CHUNK DES_INT DES_UNROLL:${s390x_asm}:dlfcn:linux-shared:-fPIC:-m64 \$(RPM_OPT_FLAGS):.so.\$(SHLIB_SONAMEVER):::64", + #### SPARC Linux setups + # Ray Miller <ray.miller(a)computing-services.oxford.ac.uk> has patiently + # assisted with debugging of following two configs. +-"linux-sparcv8","gcc:-mv8 -DB_ENDIAN -DTERMIO -O3 -fomit-frame-pointer -Wall -DBN_DIV2W::-D_REENTRANT::-ldl:BN_LLONG RC4_CHAR RC4_CHUNK DES_UNROLL BF_PTR:${sparcv8_asm}:dlfcn:linux-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)", ++"linux-sparcv8","gcc:-DB_ENDIAN -DTERMIO -Wall \$(RPM_OPT_FLAGS) -DBN_DIV2W::-D_REENTRANT::-ldl:BN_LLONG RC4_CHAR RC4_CHUNK DES_UNROLL BF_PTR:${sparcv8_asm}:dlfcn:linux-shared:-fPIC:\$(RPM_OPT_FLAGS):.so.\$(SHLIB_SONAMEVER)", + # it's a real mess with -mcpu=ultrasparc option under Linux, but + # -Wa,-Av8plus should do the trick no matter what. +-"linux-sparcv9","gcc:-m32 -mcpu=ultrasparc -DB_ENDIAN -DTERMIO -O3 -fomit-frame-pointer -Wall -Wa,-Av8plus -DBN_DIV2W::-D_REENTRANT:ULTRASPARC:-ldl:BN_LLONG RC4_CHAR RC4_CHUNK DES_UNROLL BF_PTR:${sparcv9_asm}:dlfcn:linux-shared:-fPIC:-m32:.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)", ++"linux-sparcv9","gcc:-DB_ENDIAN -DTERMIO -Wall \$(RPM_OPT_FLAGS) -DBN_DIV2W::-D_REENTRANT:ULTRASPARC:-ldl:BN_LLONG RC4_CHAR RC4_CHUNK DES_UNROLL BF_PTR:${sparcv9_asm}:dlfcn:linux-shared:-fPIC:\$(RPM_OPT_FLAGS):.so.\$(SHLIB_SONAMEVER)", + # GCC 3.1 is a requirement +-"linux64-sparcv9","gcc:-m64 -mcpu=ultrasparc -DB_ENDIAN -DTERMIO -O3 -fomit-frame-pointer -Wall::-D_REENTRANT:ULTRASPARC:-ldl:BN_LLONG RC4_CHAR RC4_CHUNK DES_INT DES_PTR DES_RISC1 DES_UNROLL BF_PTR:${sparcv9_asm}:dlfcn:linux-shared:-fPIC:-m64:.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR):::64", ++"linux64-sparcv9","gcc:-DB_ENDIAN -DTERMIO -Wall \$(RPM_OPT_FLAGS)::-D_REENTRANT:ULTRASPARC:-ldl:BN_LLONG RC4_CHAR RC4_CHUNK DES_INT DES_PTR DES_RISC1 DES_UNROLL BF_PTR:${sparcv9_asm}:dlfcn:linux-shared:-fPIC:\$(RPM_OPT_FLAGS):.so.\$(SHLIB_SONAMEVER):::64", + #### Alpha Linux with GNU C and Compaq C setups + # Special notes: + # - linux-alpha+bwx-gcc is ment to be used from ./config only. If you +@@ -375,8 +375,8 @@ my %table=( + # + # <appro(a)fy.chalmers.se> + # +-"linux-alpha-gcc","gcc:-O3 -DL_ENDIAN -DTERMIO::-D_REENTRANT::-ldl:SIXTY_FOUR_BIT_LONG RC4_CHUNK DES_RISC1 DES_UNROLL:${alpha_asm}:dlfcn:linux-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)", +-"linux-alpha+bwx-gcc","gcc:-O3 -DL_ENDIAN -DTERMIO::-D_REENTRANT::-ldl:SIXTY_FOUR_BIT_LONG RC4_CHAR RC4_CHUNK DES_RISC1 DES_UNROLL:${alpha_asm}:dlfcn:linux-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)", ++"linux-alpha-gcc","gcc:-DL_ENDIAN -DTERMIO -Wall \$(RPM_OPT_FLAGS)::-D_REENTRANT::-ldl:SIXTY_FOUR_BIT_LONG RC4_CHUNK DES_RISC1 DES_UNROLL:${alpha_asm}:dlfcn:linux-shared:-fPIC:\$(RPM_OPT_FLAGS):.so.\$(SHLIB_SONAMEVER)", ++"linux-alpha+bwx-gcc","gcc:-DL_ENDIAN -DTERMIO -Wall \$(RPM_OPT_FLAGS)::-D_REENTRANT::-ldl:SIXTY_FOUR_BIT_LONG RC4_CHAR RC4_CHUNK DES_RISC1 DES_UNROLL:${alpha_asm}:dlfcn:linux-shared:-fPIC:\$(RPM_OPT_FLAGS):.so.\$(SHLIB_SONAMEVER)", + "linux-alpha-ccc","ccc:-fast -readonly_strings -DL_ENDIAN -DTERMIO::-D_REENTRANT:::SIXTY_FOUR_BIT_LONG RC4_CHUNK DES_INT DES_PTR DES_RISC1 DES_UNROLL:${alpha_asm}", + "linux-alpha+bwx-ccc","ccc:-fast -readonly_strings -DL_ENDIAN -DTERMIO::-D_REENTRANT:::SIXTY_FOUR_BIT_LONG RC4_CHAR RC4_CHUNK DES_INT DES_PTR DES_RISC1 DES_UNROLL:${alpha_asm}", + diff --git a/pkgs/core/openssl/patches/openssl-1.0.0-beta5-enginesdir.patch b/pkgs/core/openssl/patches/openssl-1.0.0-beta5-enginesdir.patch new file mode 100644 index 0000000..d942d6e --- /dev/null +++ b/pkgs/core/openssl/patches/openssl-1.0.0-beta5-enginesdir.patch @@ -0,0 +1,52 @@ +diff -up openssl-1.0.0-beta5/Configure.enginesdir openssl-1.0.0-beta5/Configure +--- openssl-1.0.0-beta5/Configure.enginesdir 2010-01-20 18:07:05.000000000 +0100 ++++ openssl-1.0.0-beta5/Configure 2010-01-20 18:10:48.000000000 +0100 +@@ -622,6 +622,7 @@ my $idx_multilib = $idx++; + my $prefix=""; + my $libdir=""; + my $openssldir=""; ++my $enginesdir=""; + my $exe_ext=""; + my $install_prefix= "$ENV{'INSTALL_PREFIX'}"; + my $cross_compile_prefix=""; +@@ -833,6 +834,10 @@ PROCESS_ARGS: + { + $openssldir=$1; + } ++ elsif (/^--enginesdir=(.*)$/) ++ { ++ $enginesdir=$1; ++ } + elsif (/^--install.prefix=(.*)$/) + { + $install_prefix=$1; +@@ -1053,7 +1058,7 @@ chop $prefix if $prefix =~ /.\/$/; + + $openssldir=$prefix . "/ssl" if $openssldir eq ""; + $openssldir=$prefix . "/" . $openssldir if $openssldir !~ /(^\/|^[a-zA-Z]:[\\\/])/; +- ++$enginesdir="$prefix/lib/engines" if $enginesdir eq ""; + + print "IsMK1MF=$IsMK1MF\n"; + +@@ -1673,7 +1678,7 @@ while (<IN>) + } + elsif (/^#define\s+ENGINESDIR/) + { +- my $foo = "$prefix/$libdir/engines"; ++ my $foo = "$enginesdir"; + $foo =~ s/\\/\\\\/g; + print OUT "#define ENGINESDIR \"$foo\"\n"; + } +diff -up openssl-1.0.0-beta5/engines/Makefile.enginesdir openssl-1.0.0-beta5/engines/Makefile +--- openssl-1.0.0-beta5/engines/Makefile.enginesdir 2010-01-16 21:06:09.000000000 +0100 ++++ openssl-1.0.0-beta5/engines/Makefile 2010-01-20 18:07:05.000000000 +0100 +@@ -124,7 +124,7 @@ install: + sfx=".so"; \ + cp cyg$$l.dll $(INSTALL_PREFIX)$(INSTALLTOP)/$(LIBDIR)/engines/$$pfx$$l$$sfx.new; \ + fi; \ +- chmod 555 $(INSTALL_PREFIX)$(INSTALLTOP)/$(LIBDIR)/engines/$$pfx$$l$$sfx.new; \ ++ chmod 755 $(INSTALL_PREFIX)$(INSTALLTOP)/$(LIBDIR)/engines/$$pfx$$l$$sfx.new; \ + mv -f $(INSTALL_PREFIX)$(INSTALLTOP)/$(LIBDIR)/engines/$$pfx$$l$$sfx.new $(INSTALL_PREFIX)$(INSTALLTOP)/$(LIBDIR)/engines/$$pfx$$l$$sfx ); \ + done; \ + fi diff --git a/pkgs/core/openssl/patches/openssl-1.0.0-beta5-version.patch b/pkgs/core/openssl/patches/openssl-1.0.0-beta5-version.patch new file mode 100644 index 0000000..cf3bcf6 --- /dev/null +++ b/pkgs/core/openssl/patches/openssl-1.0.0-beta5-version.patch @@ -0,0 +1,14 @@ +We have to keep the beta status on 3 as some applications (OpenSSH) incorrectly insist +on having the same beta status of OpenSSL library as they were built against. +diff -up openssl-1.0.0-beta5/crypto/opensslv.h.version openssl-1.0.0-beta5/crypto/opensslv.h +--- openssl-1.0.0-beta5/crypto/opensslv.h.version 2010-01-20 18:16:43.000000000 +0100 ++++ openssl-1.0.0-beta5/crypto/opensslv.h 2010-01-20 20:20:23.000000000 +0100 +@@ -25,7 +25,7 @@ + * (Prior to 0.9.5a beta1, a different scheme was used: MMNNFFRBB for + * major minor fix final patch/beta) + */ +-#define OPENSSL_VERSION_NUMBER 0x10000005L ++#define OPENSSL_VERSION_NUMBER 0x10000003L + #ifdef OPENSSL_FIPS + #define OPENSSL_VERSION_TEXT "OpenSSL 1.0.0-fips-beta5 20 Jan 2010" + #else diff --git a/pkgs/core/util-linux-ng/util-linux-ng.nm b/pkgs/core/util-linux-ng/util-linux-ng.nm index 3ae5289..8c6ba4b 100644 --- a/pkgs/core/util-linux-ng/util-linux-ng.nm +++ b/pkgs/core/util-linux-ng/util-linux-ng.nm @@ -25,7 +25,7 @@ include $(PKGROOT)/Include PKG_NAME = util-linux-ng -PKG_VER = 2.17 +PKG_VER = 2.17.2 PKG_REL = 0 PKG_MAINTAINER = @@ -48,40 +48,30 @@ PKG_TARBALL = $(THISAPP).tar.bz2 CFLAGS += -D_LARGEFILE_SOURCE -D_LARGEFILE64_SOURCE -D_FILE_OFFSET_BITS=64 -############################################################################### -# Installation Details -############################################################################### +CONFIGURE_OPTIONS += \ + --bindir=/bin \ + --sbindir=/sbin \ + --disable-wall \ + --enable-arch \ + --enable-kill \ + --enable-login-utils \ + --enable-partx \ + --enable-write \ + --disable-makeinstall-chown \ + --disable-static + define STAGE_PREPARE_CMDS cd $(DIR_APP) && sed -e 's@etc/adjtime@var/lib/hwclock/adjtime@g' \ -i $$(grep -rl '/etc/adjtime' .) endef -define STAGE_BUILD - cd $(DIR_APP) && \ - ./configure \ - --prefix=/usr \ - --bindir=/bin \ - --sbindir=/sbin \ - --disable-wall \ - --enable-arch \ - --enable-kill \ - --enable-login-utils \ - --enable-partx \ - --enable-write \ - --disable-makeinstall-chown \ - --disable-static - - cd $(DIR_APP) && make $(PARALLELISMFLAGS) - +define STAGE_BUILD_CMDS # Build nologin cd $(DIR_APP) && gcc $(CFLAGS) -o nologin $(DIR_SOURCE)/nologin.c - endef -define STAGE_INSTALL - cd $(DIR_APP) && make install DESTDIR=$(BUILDROOT) - +define STAGE_INSTALL_CMDS -mkdir -pv $(BUILDROOT)/sbin \ $(BUILDROOT)/var/lib/hwclock \ $(BUILDROOT)/usr/share/man/man8 \ hooks/post-receive -- IPFire 3.x development tree

1 0

[IPFire-SCM] [git.ipfire.org] IPFire 3.x development tree branch, master, updated. 7975e1c9468c146c312430a8e8d01a4cb158ef46
by git＠ipfire.org 26 Mar '10

26 Mar '10

1 0

[IPFire-SCM] [git.ipfire.org] IPFire 3.x development tree branch, master, updated. a4580ae3b5046a4261d29d3dfb468fb93653d8ed
by git＠ipfire.org 25 Mar '10

25 Mar '10

1 0

[IPFire-SCM] [git.ipfire.org] IPFire 3.x development tree branch, master, updated. a23abe6dc5b8559c5c3a5938a74d62d7f26f8c3d
by git＠ipfire.org 23 Mar '10

23 Mar '10

This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "IPFire 3.x development tree". The branch, master has been updated via a23abe6dc5b8559c5c3a5938a74d62d7f26f8c3d (commit) via 5b75a72d379bd059c137029824e5224135a9546c (commit) via 15a8a13f0f7d34527e99bdaa199e52db63b498bf (commit) via 47540df94d0f6691af3debb05a0f9c7caeed4c06 (commit) from 0d9ae7080d575dedf3a578771e56e41afc932eef (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit a23abe6dc5b8559c5c3a5938a74d62d7f26f8c3d Merge: 5b75a72d379bd059c137029824e5224135a9546c 47540df94d0f6691af3debb05a0f9c7caeed4c06 Author: Michael Tremer <michael.tremer(a)ipfire.org> Date: Tue Mar 23 23:36:50 2010 +0100 Merge branch 'naoki' commit 5b75a72d379bd059c137029824e5224135a9546c Author: Michael Tremer <michael.tremer(a)ipfire.org> Date: Tue Mar 23 23:35:34 2010 +0100 naoki: Remove a finally condition that is not supported by python 2.4. It doesn't make sense to capture the time when build was broken. commit 15a8a13f0f7d34527e99bdaa199e52db63b498bf Author: Michael Tremer <michael.tremer(a)ipfire.org> Date: Tue Mar 23 23:34:42 2010 +0100 elfutils: New package. commit 47540df94d0f6691af3debb05a0f9c7caeed4c06 Author: Michael Tremer <michael.tremer(a)ipfire.org> Date: Mon Mar 22 23:10:07 2010 +0100 naoki: Add /etc/hosts to chroot which will resolve localhost. Indirectly fixes bug #596. ----------------------------------------------------------------------- Summary of changes: naoki/chroot.py | 11 +- .../python-tornado.nm => elfutils/elfutils.nm} | 36 +- .../core/elfutils/patches/elfutils-robustify.patch | 1683 ++++++++++++++++++++ 3 files changed, 1712 insertions(+), 18 deletions(-) copy pkgs/core/{python-tornado/python-tornado.nm => elfutils/elfutils.nm} (71%) create mode 100644 pkgs/core/elfutils/patches/elfutils-robustify.patch Difference in files: diff --git a/naoki/chroot.py b/naoki/chroot.py index e6b5fdc..efcaf07 100644 --- a/naoki/chroot.py +++ b/naoki/chroot.py @@ -239,6 +239,11 @@ class Environment(object): f.write("nameserver %s" % nameserver) f.close() + self.log.debug("Creating record for localhost") + f = open(self.chrootPath("etc", "hosts"), "w") + f.write("127.0.0.1 localhost\n") + f.close() + def _mountall(self): """mount 'normal' fs like /dev/ /proc/ /sys""" for cmd in self.mountCmds: @@ -268,9 +273,9 @@ class Environment(object): if config["cleanup_on_failure"]: self.clean() raise - finally: - time_end = time.time() - self.log.debug("Package build took %.2fs" % (time_end - time_start)) + + time_end = time.time() + self.log.debug("Package build took %.2fs" % (time_end - time_start)) if config["cleanup_on_success"]: self.clean() diff --git a/pkgs/core/elfutils/elfutils.nm b/pkgs/core/elfutils/elfutils.nm new file mode 100644 index 0000000..e218905 --- /dev/null +++ b/pkgs/core/elfutils/elfutils.nm @@ -0,0 +1,59 @@ +############################################################################### +# # +# IPFire.org - A linux based firewall # +# Copyright (C) 2007, 2008 Michael Tremer & Christian Schmidt # +# # +# This program is free software: you can redistribute it and/or modify # +# it under the terms of the GNU General Public License as published by # +# the Free Software Foundation, either version 3 of the License, or # +# (at your option) any later version. # +# # +# This program is distributed in the hope that it will be useful, # +# but WITHOUT ANY WARRANTY; without even the implied warranty of # +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # +# GNU General Public License for more details. # +# # +# You should have received a copy of the GNU General Public License # +# along with this program. If not, see <http://www.gnu.org/licenses/>. # +# # +############################################################################### + +############################################################################### +# Definitions +############################################################################### + +include $(PKGROOT)/Include + +PKG_NAME = elfutils +PKG_VER = 0.145 +PKG_REL = 0 + +PKG_MAINTAINER = Michael Tremer <michael.tremer(a)ipfire.org> +PKG_GROUP = Development/Libraries +PKG_URL = https://fedorahosted.org/elfutils/ +PKG_LICENSE = GPLv2 with exceptions +PKG_SUMMARY = A collection of utilities and DSOs to handle compiled objects. + +PKG_DEPS += bzip2 xz zlib + +define PKG_DESCRIPTION + Elfutils is a collection of utilities, including ld (a linker), \ + nm (for listing symbols from object files), size (for listing the \ + section sizes of an object or archive file), strip (for discarding \ + symbols), readelf (to see the raw ELF file structures), and elflint \ + (to check for well-formed ELF files). +endef + +PKG_TARBALL = $(THISAPP).tar.bz2 + +CONFIGURE_OPTIONS += \ + --program-prefix=eu- + +define QUALITY_AGENT_WHITELIST_RPATH + /usr/lib/libdw-*.so* +endef + +# fails +#define STAGE_TEST +# cd $(DIR_APP) && make check +#endef diff --git a/pkgs/core/elfutils/patches/elfutils-robustify.patch b/pkgs/core/elfutils/patches/elfutils-robustify.patch new file mode 100644 index 0000000..8e6f545 --- /dev/null +++ b/pkgs/core/elfutils/patches/elfutils-robustify.patch @@ -0,0 +1,1683 @@ +--- elfutils/libelf/ChangeLog ++++ elfutils/libelf/ChangeLog +@@ -616,6 +616,49 @@ + If section content hasn't been read yet, do it before looking for the + block size. If no section data present, infer size of section header. + ++2005-05-17 Jakub Jelinek <jakub(a)redhat.com> ++ ++ * elf32_getphdr.c (elfw2(LIBELFBITS,getphdr)): Check if program header ++ table fits into object's bounds. ++ * elf_getshstrndx.c (elf_getshstrndx): Add elf->start_offset to ++ elf->map_address. Check if first section header fits into object's ++ bounds. ++ * elf32_getshdr.c (elfw2(LIBELFBITS,getshdr)): ++ Check if section header table fits into object's bounds. ++ * elf_begin.c (get_shnum): Ensure section headers fits into ++ object's bounds. ++ (file_read_elf): Make sure scncnt is small enough to allocate both ++ ElfXX_Shdr and Elf_Scn array. Make sure section and program header ++ tables fit into object's bounds. Avoid memory leak on failure. ++ ++2005-05-14 Jakub Jelinek <jakub(a)redhat.com> ++ ++ * libelfP.h (INVALID_NDX): Define. ++ * gelf_getdyn.c (gelf_getdyn): Use it. Remove ndx < 0 test if any. ++ * gelf_getlib.c (gelf_getlib): Likewise. ++ * gelf_getmove.c (gelf_getmove): Likewise. ++ * gelf_getrel.c (gelf_getrel): Likewise. ++ * gelf_getrela.c (gelf_getrela): Likewise. ++ * gelf_getsym.c (gelf_getsym): Likewise. ++ * gelf_getsyminfo.c (gelf_getsyminfo): Likewise. ++ * gelf_getsymshndx.c (gelf_getsymshndx): Likewise. ++ * gelf_getversym.c (gelf_getversym): Likewise. ++ * gelf_update_dyn.c (gelf_update_dyn): Likewise. ++ * gelf_update_lib.c (gelf_update_lib): Likewise. ++ * gelf_update_move.c (gelf_update_move): Likewise. ++ * gelf_update_rel.c (gelf_update_rel): Likewise. ++ * gelf_update_rela.c (gelf_update_rela): Likewise. ++ * gelf_update_sym.c (gelf_update_sym): Likewise. ++ * gelf_update_syminfo.c (gelf_update_syminfo): Likewise. ++ * gelf_update_symshndx.c (gelf_update_symshndx): Likewise. ++ * gelf_update_versym.c (gelf_update_versym): Likewise. ++ * elf_newscn.c (elf_newscn): Check for overflow. ++ * elf32_updatefile.c (__elfw2(LIBELFBITS,updatemmap)): Likewise. ++ (__elfw2(LIBELFBITS,updatefile)): Likewise. ++ * elf_begin.c (file_read_elf): Likewise. ++ * elf32_newphdr.c (elfw2(LIBELFBITS,newphdr)): Likewise. ++ * elf_getarsym.c (elf_getarsym): Likewise. ++ * elf32_getshdr.c (elfw2(LIBELFBITS,getshdr)): Likewise. + 2005-05-11 Ulrich Drepper <drepper(a)redhat.com> + + * elf.h: Update again. +--- elfutils/libelf/elf32_getphdr.c ++++ elfutils/libelf/elf32_getphdr.c +@@ -107,6 +107,16 @@ __elfw2(LIBELFBITS,getphdr_wrlock) (elf) + + if (elf->map_address != NULL) + { ++ /* First see whether the information in the ELF header is ++ valid and it does not ask for too much. */ ++ if (unlikely (ehdr->e_phoff >= elf->maximum_size) ++ || unlikely (elf->maximum_size - ehdr->e_phoff < size)) ++ { ++ /* Something is wrong. */ ++ __libelf_seterrno (ELF_E_INVALID_PHDR); ++ goto out; ++ } ++ + /* All the data is already mapped. Use it. */ + void *file_phdr = ((char *) elf->map_address + + elf->start_offset + ehdr->e_phoff); +--- elfutils/libelf/elf32_getshdr.c ++++ elfutils/libelf/elf32_getshdr.c +@@ -1,5 +1,5 @@ + /* Return section header. +- Copyright (C) 1998, 1999, 2000, 2001, 2002, 2005, 2007, 2009 Red Hat, Inc. ++ Copyright (C) 1998-2009 Red Hat, Inc. + This file is part of Red Hat elfutils. + Written by Ulrich Drepper <drepper(a)redhat.com>, 1998. + +@@ -81,7 +81,8 @@ load_shdr_wrlock (Elf_Scn *scn) + goto out; + + size_t shnum; +- if (__elf_getshdrnum_rdlock (elf, &shnum) != 0) ++ if (__elf_getshdrnum_rdlock (elf, &shnum) != 0 ++ || shnum > SIZE_MAX / sizeof (ElfW2(LIBELFBITS,Shdr))) + goto out; + size_t size = shnum * sizeof (ElfW2(LIBELFBITS,Shdr)); + +@@ -98,6 +99,16 @@ load_shdr_wrlock (Elf_Scn *scn) + + if (elf->map_address != NULL) + { ++ /* First see whether the information in the ELF header is ++ valid and it does not ask for too much. */ ++ if (unlikely (ehdr->e_shoff >= elf->maximum_size) ++ || unlikely (elf->maximum_size - ehdr->e_shoff < size)) ++ { ++ /* Something is wrong. */ ++ __libelf_seterrno (ELF_E_INVALID_SECTION_HEADER); ++ goto free_and_out; ++ } ++ + ElfW2(LIBELFBITS,Shdr) *notcvt; + + /* All the data is already mapped. If we could use it +--- elfutils/libelf/elf32_newphdr.c ++++ elfutils/libelf/elf32_newphdr.c +@@ -135,6 +135,12 @@ elfw2(LIBELFBITS,newphdr) (elf, count) + || count == PN_XNUM + || elf->state.ELFW(elf,LIBELFBITS).phdr == NULL) + { ++ if (unlikely (count > SIZE_MAX / sizeof (ElfW2(LIBELFBITS,Phdr)))) ++ { ++ result = NULL; ++ goto out; ++ } ++ + /* Allocate a new program header with the appropriate number of + elements. */ + result = (ElfW2(LIBELFBITS,Phdr) *) +--- elfutils/libelf/elf32_updatefile.c ++++ elfutils/libelf/elf32_updatefile.c +@@ -223,6 +223,9 @@ __elfw2(LIBELFBITS,updatemmap) (Elf *elf + /* Write all the sections. Well, only those which are modified. */ + if (shnum > 0) + { ++ if (unlikely (shnum > SIZE_MAX / sizeof (Elf_Scn *))) ++ return 1; ++ + Elf_ScnList *list = &elf->state.ELFW(elf,LIBELFBITS).scns; + Elf_Scn **scns = (Elf_Scn **) alloca (shnum * sizeof (Elf_Scn *)); + char *const shdr_start = ((char *) elf->map_address + elf->start_offset +@@ -645,6 +648,10 @@ __elfw2(LIBELFBITS,updatefile) (Elf *elf + /* Write all the sections. Well, only those which are modified. */ + if (shnum > 0) + { ++ if (unlikely (shnum > SIZE_MAX / (sizeof (Elf_Scn *) ++ + sizeof (ElfW2(LIBELFBITS,Shdr))))) ++ return 1; ++ + off_t shdr_offset = elf->start_offset + ehdr->e_shoff; + #if EV_NUM != 2 + xfct_t shdr_fctp = __elf_xfctstom[__libelf_version - 1][EV_CURRENT - 1][ELFW(ELFCLASS, LIBELFBITS) - 1][ELF_T_SHDR]; +--- elfutils/libelf/elf_begin.c ++++ elfutils/libelf/elf_begin.c +@@ -165,7 +165,8 @@ get_shnum (void *map_address, unsigned c + + if (unlikely (result == 0) && ehdr.e32->e_shoff != 0) + { +- if (ehdr.e32->e_shoff + sizeof (Elf32_Shdr) > maxsize) ++ if (unlikely (ehdr.e32->e_shoff >= maxsize) ++ || unlikely (maxsize - ehdr.e32->e_shoff < sizeof (Elf32_Shdr))) + /* Cannot read the first section header. */ + return 0; + +@@ -213,7 +214,8 @@ get_shnum (void *map_address, unsigned c + + if (unlikely (result == 0) && ehdr.e64->e_shoff != 0) + { +- if (ehdr.e64->e_shoff + sizeof (Elf64_Shdr) > maxsize) ++ if (unlikely (ehdr.e64->e_shoff >= maxsize) ++ || unlikely (ehdr.e64->e_shoff + sizeof (Elf64_Shdr) > maxsize)) + /* Cannot read the first section header. */ + return 0; + +@@ -285,6 +287,15 @@ file_read_elf (int fildes, void *map_add + /* Could not determine the number of sections. */ + return NULL; + ++ /* Check for too many sections. */ ++ if (e_ident[EI_CLASS] == ELFCLASS32) ++ { ++ if (scncnt > SIZE_MAX / (sizeof (Elf_Scn) + sizeof (Elf32_Shdr))) ++ return NULL; ++ } ++ else if (scncnt > SIZE_MAX / (sizeof (Elf_Scn) + sizeof (Elf64_Shdr))) ++ return NULL; ++ + /* We can now allocate the memory. Even if there are no section headers, + we allocate space for a zeroth section in case we need it later. */ + const size_t scnmax = (scncnt ?: (cmd == ELF_C_RDWR || cmd == ELF_C_RDWR_MMAP) +@@ -324,13 +335,33 @@ file_read_elf (int fildes, void *map_add + { + /* We can use the mmapped memory. */ + elf->state.elf32.ehdr = ehdr; ++ ++ if (unlikely (ehdr->e_shoff >= maxsize) ++ || unlikely (maxsize - ehdr->e_shoff ++ < scncnt * sizeof (Elf32_Shdr))) ++ { ++ free_and_out: ++ free (elf); ++ __libelf_seterrno (ELF_E_INVALID_FILE); ++ return NULL; ++ } + elf->state.elf32.shdr + = (Elf32_Shdr *) ((char *) ehdr + ehdr->e_shoff); +- if (ehdr->e_phnum > 0) +- /* Assign a value only if there really is a program +- header. Otherwise the value remains NULL. */ +- elf->state.elf32.phdr +- = (Elf32_Phdr *) ((char *) ehdr + ehdr->e_phoff); ++ ++ size_t phnum = ehdr->e_phnum; ++ if (phnum == PN_XNUM && scncnt > 0) ++ phnum = elf->state.elf32.shdr[0].sh_info; ++ if (phnum > 0) ++ { ++ /* Assign a value only if there really is a program ++ header. Otherwise the value remains NULL. */ ++ if (unlikely (ehdr->e_phoff >= maxsize) ++ || unlikely (maxsize - ehdr->e_phoff ++ < phnum * sizeof (Elf32_Phdr))) ++ goto free_and_out; ++ elf->state.elf32.phdr ++ = (Elf32_Phdr *) ((char *) ehdr + ehdr->e_phoff); ++ } + + for (size_t cnt = 0; cnt < scncnt; ++cnt) + { +@@ -412,13 +443,28 @@ file_read_elf (int fildes, void *map_add + { + /* We can use the mmapped memory. */ + elf->state.elf64.ehdr = ehdr; ++ ++ if (unlikely (ehdr->e_shoff >= maxsize) ++ || unlikely (ehdr->e_shoff ++ + scncnt * sizeof (Elf32_Shdr) > maxsize)) ++ goto free_and_out; + elf->state.elf64.shdr + = (Elf64_Shdr *) ((char *) ehdr + ehdr->e_shoff); +- if (ehdr->e_phnum > 0) +- /* Assign a value only if there really is a program +- header. Otherwise the value remains NULL. */ +- elf->state.elf64.phdr +- = (Elf64_Phdr *) ((char *) ehdr + ehdr->e_phoff); ++ ++ size_t phnum = ehdr->e_phnum; ++ if (phnum == PN_XNUM && scncnt > 0) ++ phnum = elf->state.elf64.shdr[0].sh_info; ++ if (phnum > 0) ++ { ++ /* Assign a value only if there really is a program ++ header. Otherwise the value remains NULL. */ ++ if (unlikely (ehdr->e_phoff >= maxsize) ++ || unlikely (ehdr->e_phoff ++ + phnum * sizeof (Elf32_Phdr) > maxsize)) ++ goto free_and_out; ++ elf->state.elf64.phdr ++ = (Elf64_Phdr *) ((char *) ehdr + ehdr->e_phoff); ++ } + + for (size_t cnt = 0; cnt < scncnt; ++cnt) + { +--- elfutils/libelf/elf_getarsym.c ++++ elfutils/libelf/elf_getarsym.c +@@ -179,6 +179,9 @@ elf_getarsym (elf, ptr) + size_t index_size = atol (tmpbuf); + + if (SARMAG + sizeof (struct ar_hdr) + index_size > elf->maximum_size ++#if SIZE_MAX <= 4294967295U ++ || n >= SIZE_MAX / sizeof (Elf_Arsym) ++#endif + || n * sizeof (uint32_t) > index_size) + { + /* This index table cannot be right since it does not fit into +--- elfutils/libelf/elf_getshdrstrndx.c ++++ elfutils/libelf/elf_getshdrstrndx.c +@@ -125,10 +125,25 @@ elf_getshdrstrndx (elf, dst) + if (elf->map_address != NULL + && elf->state.elf32.ehdr->e_ident[EI_DATA] == MY_ELFDATA + && (ALLOW_UNALIGNED +- || (((size_t) ((char *) elf->map_address + offset)) ++ || (((size_t) ((char *) elf->map_address ++ + elf->start_offset + offset)) + & (__alignof__ (Elf32_Shdr) - 1)) == 0)) +- /* We can directly access the memory. */ +- num = ((Elf32_Shdr *) (elf->map_address + offset))->sh_link; ++ { ++ /* First see whether the information in the ELF header is ++ valid and it does not ask for too much. */ ++ if (unlikely (elf->maximum_size - offset ++ < sizeof (Elf32_Shdr))) ++ { ++ /* Something is wrong. */ ++ __libelf_seterrno (ELF_E_INVALID_SECTION_HEADER); ++ result = -1; ++ goto out; ++ } ++ ++ /* We can directly access the memory. */ ++ num = ((Elf32_Shdr *) (elf->map_address + elf->start_offset ++ + offset))->sh_link; ++ } + else + { + /* We avoid reading in all the section headers. Just read +@@ -163,10 +178,25 @@ elf_getshdrstrndx (elf, dst) + if (elf->map_address != NULL + && elf->state.elf64.ehdr->e_ident[EI_DATA] == MY_ELFDATA + && (ALLOW_UNALIGNED +- || (((size_t) ((char *) elf->map_address + offset)) ++ || (((size_t) ((char *) elf->map_address ++ + elf->start_offset + offset)) + & (__alignof__ (Elf64_Shdr) - 1)) == 0)) +- /* We can directly access the memory. */ +- num = ((Elf64_Shdr *) (elf->map_address + offset))->sh_link; ++ { ++ /* First see whether the information in the ELF header is ++ valid and it does not ask for too much. */ ++ if (unlikely (elf->maximum_size - offset ++ < sizeof (Elf64_Shdr))) ++ { ++ /* Something is wrong. */ ++ __libelf_seterrno (ELF_E_INVALID_SECTION_HEADER); ++ result = -1; ++ goto out; ++ } ++ ++ /* We can directly access the memory. */ ++ num = ((Elf64_Shdr *) (elf->map_address + elf->start_offset ++ + offset))->sh_link; ++ } + else + { + /* We avoid reading in all the section headers. Just read +--- elfutils/libelf/elf_newscn.c ++++ elfutils/libelf/elf_newscn.c +@@ -104,10 +104,18 @@ elf_newscn (elf) + else + { + /* We must allocate a new element. */ +- Elf_ScnList *newp; ++ Elf_ScnList *newp = NULL; + + assert (elf->state.elf.scnincr > 0); + ++ if ( ++#if SIZE_MAX <= 4294967295U ++ likely (elf->state.elf.scnincr ++ < SIZE_MAX / 2 / sizeof (Elf_Scn) - sizeof (Elf_ScnList)) ++#else ++ 1 ++#endif ++ ) + newp = (Elf_ScnList *) calloc (sizeof (Elf_ScnList) + + ((elf->state.elf.scnincr *= 2) + * sizeof (Elf_Scn)), 1); +--- elfutils/libelf/gelf_getdyn.c ++++ elfutils/libelf/gelf_getdyn.c +@@ -1,5 +1,5 @@ + /* Get information from dynamic table at the given index. +- Copyright (C) 2000, 2001, 2002 Red Hat, Inc. ++ Copyright (C) 2000-2009 Red Hat, Inc. + This file is part of Red Hat elfutils. + Written by Ulrich Drepper <drepper(a)redhat.com>, 2000. + +@@ -93,7 +93,7 @@ gelf_getdyn (data, ndx, dst) + table entries has to be adopted. The user better has provided + a buffer where we can store the information. While copying the + data we are converting the format. */ +- if (unlikely ((ndx + 1) * sizeof (Elf32_Dyn) > data_scn->d.d_size)) ++ if (INVALID_NDX (ndx, Elf32_Dyn, &data_scn->d)) + { + __libelf_seterrno (ELF_E_INVALID_INDEX); + goto out; +@@ -114,7 +114,7 @@ gelf_getdyn (data, ndx, dst) + + /* The data is already in the correct form. Just make sure the + index is OK. */ +- if (unlikely ((ndx + 1) * sizeof (GElf_Dyn) > data_scn->d.d_size)) ++ if (INVALID_NDX (ndx, GElf_Dyn, &data_scn->d)) + { + __libelf_seterrno (ELF_E_INVALID_INDEX); + goto out; +--- elfutils/libelf/gelf_getlib.c ++++ elfutils/libelf/gelf_getlib.c +@@ -1,5 +1,5 @@ + /* Get library from table at the given index. +- Copyright (C) 2004 Red Hat, Inc. ++ Copyright (C) 2004-2009 Red Hat, Inc. + This file is part of Red Hat elfutils. + Written by Ulrich Drepper <drepper(a)redhat.com>, 2004. + +@@ -86,7 +86,7 @@ gelf_getlib (data, ndx, dst) + /* The data is already in the correct form. Just make sure the + index is OK. */ + GElf_Lib *result = NULL; +- if (unlikely ((ndx + 1) * sizeof (GElf_Lib) > data->d_size)) ++ if (INVALID_NDX (ndx, GElf_Lib, data)) + __libelf_seterrno (ELF_E_INVALID_INDEX); + else + { +--- elfutils/libelf/gelf_getmove.c ++++ elfutils/libelf/gelf_getmove.c +@@ -1,5 +1,5 @@ + /* Get move structure at the given index. +- Copyright (C) 2000, 2001, 2002 Red Hat, Inc. ++ Copyright (C) 2000-2009 Red Hat, Inc. + This file is part of Red Hat elfutils. + Written by Ulrich Drepper <drepper(a)redhat.com>, 2000. + +@@ -83,7 +83,7 @@ gelf_getmove (data, ndx, dst) + + /* The data is already in the correct form. Just make sure the + index is OK. */ +- if (unlikely ((ndx + 1) * sizeof (GElf_Move) > data->d_size)) ++ if (INVALID_NDX (ndx, GElf_Move, data)) + { + __libelf_seterrno (ELF_E_INVALID_INDEX); + goto out; +--- elfutils/libelf/gelf_getrela.c ++++ elfutils/libelf/gelf_getrela.c +@@ -1,5 +1,5 @@ + /* Get RELA relocation information at given index. +- Copyright (C) 2000, 2001, 2002 Red Hat, Inc. ++ Copyright (C) 2000-2009 Red Hat, Inc. + This file is part of Red Hat elfutils. + Written by Ulrich Drepper <drepper(a)redhat.com>, 2000. + +@@ -71,12 +71,6 @@ gelf_getrela (data, ndx, dst) + if (data_scn == NULL) + return NULL; + +- if (unlikely (ndx < 0)) +- { +- __libelf_seterrno (ELF_E_INVALID_INDEX); +- return NULL; +- } +- + if (unlikely (data_scn->d.d_type != ELF_T_RELA)) + { + __libelf_seterrno (ELF_E_INVALID_HANDLE); +@@ -93,7 +87,7 @@ gelf_getrela (data, ndx, dst) + if (scn->elf->class == ELFCLASS32) + { + /* We have to convert the data. */ +- if (unlikely ((ndx + 1) * sizeof (Elf32_Rela) > data_scn->d.d_size)) ++ if (INVALID_NDX (ndx, Elf32_Rela, &data_scn->d)) + { + __libelf_seterrno (ELF_E_INVALID_INDEX); + result = NULL; +@@ -114,7 +108,7 @@ gelf_getrela (data, ndx, dst) + { + /* Simply copy the data after we made sure we are actually getting + correct data. */ +- if (unlikely ((ndx + 1) * sizeof (Elf64_Rela) > data_scn->d.d_size)) ++ if (INVALID_NDX (ndx, Elf64_Rela, &data_scn->d)) + { + __libelf_seterrno (ELF_E_INVALID_INDEX); + result = NULL; +--- elfutils/libelf/gelf_getrel.c ++++ elfutils/libelf/gelf_getrel.c +@@ -1,5 +1,5 @@ + /* Get REL relocation information at given index. +- Copyright (C) 2000, 2001, 2002 Red Hat, Inc. ++ Copyright (C) 2000-2009 Red Hat, Inc. + This file is part of Red Hat elfutils. + Written by Ulrich Drepper <drepper(a)redhat.com>, 2000. + +@@ -71,12 +71,6 @@ gelf_getrel (data, ndx, dst) + if (data_scn == NULL) + return NULL; + +- if (unlikely (ndx < 0)) +- { +- __libelf_seterrno (ELF_E_INVALID_INDEX); +- return NULL; +- } +- + if (unlikely (data_scn->d.d_type != ELF_T_REL)) + { + __libelf_seterrno (ELF_E_INVALID_HANDLE); +@@ -93,7 +87,7 @@ gelf_getrel (data, ndx, dst) + if (scn->elf->class == ELFCLASS32) + { + /* We have to convert the data. */ +- if (unlikely ((ndx + 1) * sizeof (Elf32_Rel) > data_scn->d.d_size)) ++ if (INVALID_NDX (ndx, Elf32_Rel, &data_scn->d)) + { + __libelf_seterrno (ELF_E_INVALID_INDEX); + result = NULL; +@@ -113,7 +107,7 @@ gelf_getrel (data, ndx, dst) + { + /* Simply copy the data after we made sure we are actually getting + correct data. */ +- if (unlikely ((ndx + 1) * sizeof (Elf64_Rel) > data_scn->d.d_size)) ++ if (INVALID_NDX (ndx, Elf64_Rel, &data_scn->d)) + { + __libelf_seterrno (ELF_E_INVALID_INDEX); + result = NULL; +--- elfutils/libelf/gelf_getsym.c ++++ elfutils/libelf/gelf_getsym.c +@@ -1,5 +1,5 @@ + /* Get symbol information from symbol table at the given index. +- Copyright (C) 1999, 2000, 2001, 2002 Red Hat, Inc. ++ Copyright (C) 1999-2009 Red Hat, Inc. + This file is part of Red Hat elfutils. + Written by Ulrich Drepper <drepper(a)redhat.com>, 1999. + +@@ -90,7 +90,7 @@ gelf_getsym (data, ndx, dst) + table entries has to be adopted. The user better has provided + a buffer where we can store the information. While copying the + data we are converting the format. */ +- if (unlikely ((ndx + 1) * sizeof (Elf32_Sym) > data->d_size)) ++ if (INVALID_NDX (ndx, Elf32_Sym, data)) + { + __libelf_seterrno (ELF_E_INVALID_INDEX); + goto out; +@@ -119,7 +119,7 @@ gelf_getsym (data, ndx, dst) + + /* The data is already in the correct form. Just make sure the + index is OK. */ +- if (unlikely ((ndx + 1) * sizeof (GElf_Sym) > data->d_size)) ++ if (INVALID_NDX (ndx, GElf_Sym, data)) + { + __libelf_seterrno (ELF_E_INVALID_INDEX); + goto out; +--- elfutils/libelf/gelf_getsyminfo.c ++++ elfutils/libelf/gelf_getsyminfo.c +@@ -1,5 +1,5 @@ + /* Get additional symbol information from symbol table at the given index. +- Copyright (C) 2000, 2001, 2002 Red Hat, Inc. ++ Copyright (C) 2000-2009 Red Hat, Inc. + This file is part of Red Hat elfutils. + Written by Ulrich Drepper <drepper(a)redhat.com>, 2000. + +@@ -84,7 +84,7 @@ gelf_getsyminfo (data, ndx, dst) + + /* The data is already in the correct form. Just make sure the + index is OK. */ +- if (unlikely ((ndx + 1) * sizeof (GElf_Syminfo) > data->d_size)) ++ if (INVALID_NDX (ndx, GElf_Syminfo, data)) + { + __libelf_seterrno (ELF_E_INVALID_INDEX); + goto out; +--- elfutils/libelf/gelf_getsymshndx.c ++++ elfutils/libelf/gelf_getsymshndx.c +@@ -1,6 +1,6 @@ + /* Get symbol information and separate section index from symbol table + at the given index. +- Copyright (C) 2000, 2001, 2002 Red Hat, Inc. ++ Copyright (C) 2000-2009 Red Hat, Inc. + This file is part of Red Hat elfutils. + Written by Ulrich Drepper <drepper(a)redhat.com>, 2000. + +@@ -90,7 +90,7 @@ gelf_getsymshndx (symdata, shndxdata, nd + section index table. */ + if (likely (shndxdata_scn != NULL)) + { +- if (unlikely ((ndx + 1) * sizeof (Elf32_Word) > shndxdata_scn->d.d_size)) ++ if (INVALID_NDX (ndx, Elf32_Word, &shndxdata_scn->d)) + { + __libelf_seterrno (ELF_E_INVALID_INDEX); + goto out; +@@ -110,7 +110,7 @@ gelf_getsymshndx (symdata, shndxdata, nd + table entries has to be adopted. The user better has provided + a buffer where we can store the information. While copying the + data we are converting the format. */ +- if (unlikely ((ndx + 1) * sizeof (Elf32_Sym) > symdata->d_size)) ++ if (INVALID_NDX (ndx, Elf32_Sym, symdata)) + { + __libelf_seterrno (ELF_E_INVALID_INDEX); + goto out; +@@ -139,7 +139,7 @@ gelf_getsymshndx (symdata, shndxdata, nd + + /* The data is already in the correct form. Just make sure the + index is OK. */ +- if (unlikely ((ndx + 1) * sizeof (GElf_Sym) > symdata->d_size)) ++ if (INVALID_NDX (ndx, GElf_Sym, symdata)) + { + __libelf_seterrno (ELF_E_INVALID_INDEX); + goto out; +--- elfutils/libelf/gelf_getversym.c ++++ elfutils/libelf/gelf_getversym.c +@@ -1,5 +1,5 @@ + /* Get symbol version information at the given index. +- Copyright (C) 1999, 2000, 2001, 2002 Red Hat, Inc. ++ Copyright (C) 1999-2009 Red Hat, Inc. + This file is part of Red Hat elfutils. + Written by Ulrich Drepper <drepper(a)redhat.com>, 1999. + +@@ -92,7 +92,7 @@ gelf_getversym (data, ndx, dst) + + /* The data is already in the correct form. Just make sure the + index is OK. */ +- if (unlikely ((ndx + 1) * sizeof (GElf_Versym) > data->d_size)) ++ if (INVALID_NDX (ndx, GElf_Versym, data)) + { + __libelf_seterrno (ELF_E_INVALID_INDEX); + result = NULL; +--- elfutils/libelf/gelf_update_dyn.c ++++ elfutils/libelf/gelf_update_dyn.c +@@ -1,5 +1,5 @@ + /* Update information in dynamic table at the given index. +- Copyright (C) 2000, 2001, 2002 Red Hat, Inc. ++ Copyright (C) 2000-2009 Red Hat, Inc. + This file is part of Red Hat elfutils. + Written by Ulrich Drepper <drepper(a)redhat.com>, 2000. + +@@ -71,12 +71,6 @@ gelf_update_dyn (data, ndx, src) + if (data == NULL) + return 0; + +- if (unlikely (ndx < 0)) +- { +- __libelf_seterrno (ELF_E_INVALID_INDEX); +- return 0; +- } +- + if (unlikely (data_scn->d.d_type != ELF_T_DYN)) + { + /* The type of the data better should match. */ +@@ -102,7 +96,7 @@ gelf_update_dyn (data, ndx, src) + } + + /* Check whether we have to resize the data buffer. */ +- if (unlikely ((ndx + 1) * sizeof (Elf32_Dyn) > data_scn->d.d_size)) ++ if (INVALID_NDX (ndx, Elf32_Dyn, &data_scn->d)) + { + __libelf_seterrno (ELF_E_INVALID_INDEX); + goto out; +@@ -116,7 +110,7 @@ gelf_update_dyn (data, ndx, src) + else + { + /* Check whether we have to resize the data buffer. */ +- if (unlikely ((ndx + 1) * sizeof (Elf64_Dyn) > data_scn->d.d_size)) ++ if (INVALID_NDX (ndx, Elf64_Dyn, &data_scn->d)) + { + __libelf_seterrno (ELF_E_INVALID_INDEX); + goto out; +--- elfutils/libelf/gelf_update_lib.c ++++ elfutils/libelf/gelf_update_lib.c +@@ -1,5 +1,5 @@ + /* Update library in table at the given index. +- Copyright (C) 2004 Red Hat, Inc. ++ Copyright (C) 2004-2009 Red Hat, Inc. + This file is part of Red Hat elfutils. + Written by Ulrich Drepper <drepper(a)redhat.com>, 2004. + +@@ -68,12 +68,6 @@ gelf_update_lib (data, ndx, src) + if (data == NULL) + return 0; + +- if (unlikely (ndx < 0)) +- { +- __libelf_seterrno (ELF_E_INVALID_INDEX); +- return 0; +- } +- + Elf_Data_Scn *data_scn = (Elf_Data_Scn *) data; + if (unlikely (data_scn->d.d_type != ELF_T_LIB)) + { +@@ -87,7 +81,7 @@ gelf_update_lib (data, ndx, src) + + /* Check whether we have to resize the data buffer. */ + int result = 0; +- if (unlikely ((ndx + 1) * sizeof (Elf64_Lib) > data_scn->d.d_size)) ++ if (INVALID_NDX (ndx, Elf64_Lib, &data_scn->d)) + __libelf_seterrno (ELF_E_INVALID_INDEX); + else + { +--- elfutils/libelf/gelf_update_move.c ++++ elfutils/libelf/gelf_update_move.c +@@ -1,5 +1,5 @@ + /* Update move structure at the given index. +- Copyright (C) 2000, 2001, 2002 Red Hat, Inc. ++ Copyright (C) 2000-2009 Red Hat, Inc. + This file is part of Red Hat elfutils. + Written by Ulrich Drepper <drepper(a)redhat.com>, 2000. + +@@ -75,8 +75,7 @@ gelf_update_move (data, ndx, src) + assert (sizeof (GElf_Move) == sizeof (Elf64_Move)); + + /* Check whether we have to resize the data buffer. */ +- if (unlikely (ndx < 0) +- || unlikely ((ndx + 1) * sizeof (GElf_Move) > data_scn->d.d_size)) ++ if (INVALID_NDX (ndx, GElf_Move, &data_scn->d)) + { + __libelf_seterrno (ELF_E_INVALID_INDEX); + return 0; +--- elfutils/libelf/gelf_update_rela.c ++++ elfutils/libelf/gelf_update_rela.c +@@ -1,5 +1,5 @@ + /* Update RELA relocation information at given index. +- Copyright (C) 2000, 2001, 2002 Red Hat, Inc. ++ Copyright (C) 2000-2009 Red Hat, Inc. + This file is part of Red Hat elfutils. + Written by Ulrich Drepper <drepper(a)redhat.com>, 2000. + +@@ -68,12 +68,6 @@ gelf_update_rela (Elf_Data *dst, int ndx + if (dst == NULL) + return 0; + +- if (unlikely (ndx < 0)) +- { +- __libelf_seterrno (ELF_E_INVALID_INDEX); +- return 0; +- } +- + if (unlikely (data_scn->d.d_type != ELF_T_RELA)) + { + /* The type of the data better should match. */ +@@ -101,7 +95,7 @@ gelf_update_rela (Elf_Data *dst, int ndx + } + + /* Check whether we have to resize the data buffer. */ +- if (unlikely ((ndx + 1) * sizeof (Elf32_Rela) > data_scn->d.d_size)) ++ if (INVALID_NDX (ndx, Elf32_Rela, &data_scn->d)) + { + __libelf_seterrno (ELF_E_INVALID_INDEX); + goto out; +@@ -117,7 +111,7 @@ gelf_update_rela (Elf_Data *dst, int ndx + else + { + /* Check whether we have to resize the data buffer. */ +- if (unlikely ((ndx + 1) * sizeof (Elf64_Rela) > data_scn->d.d_size)) ++ if (INVALID_NDX (ndx, Elf64_Rela, &data_scn->d)) + { + __libelf_seterrno (ELF_E_INVALID_INDEX); + goto out; +--- elfutils/libelf/gelf_update_rel.c ++++ elfutils/libelf/gelf_update_rel.c +@@ -1,5 +1,5 @@ + /* Update REL relocation information at given index. +- Copyright (C) 2000, 2001, 2002 Red Hat, Inc. ++ Copyright (C) 2000-2009 Red Hat, Inc. + This file is part of Red Hat elfutils. + Written by Ulrich Drepper <drepper(a)redhat.com>, 2000. + +@@ -68,12 +68,6 @@ gelf_update_rel (Elf_Data *dst, int ndx, + if (dst == NULL) + return 0; + +- if (unlikely (ndx < 0)) +- { +- __libelf_seterrno (ELF_E_INVALID_INDEX); +- return 0; +- } +- + if (unlikely (data_scn->d.d_type != ELF_T_REL)) + { + /* The type of the data better should match. */ +@@ -99,7 +93,7 @@ gelf_update_rel (Elf_Data *dst, int ndx, + } + + /* Check whether we have to resize the data buffer. */ +- if (unlikely ((ndx + 1) * sizeof (Elf32_Rel) > data_scn->d.d_size)) ++ if (INVALID_NDX (ndx, Elf32_Rel, &data_scn->d)) + { + __libelf_seterrno (ELF_E_INVALID_INDEX); + goto out; +@@ -114,7 +108,7 @@ gelf_update_rel (Elf_Data *dst, int ndx, + else + { + /* Check whether we have to resize the data buffer. */ +- if (unlikely ((ndx + 1) * sizeof (Elf64_Rel) > data_scn->d.d_size)) ++ if (INVALID_NDX (ndx, Elf64_Rel, &data_scn->d)) + { + __libelf_seterrno (ELF_E_INVALID_INDEX); + goto out; +--- elfutils/libelf/gelf_update_sym.c ++++ elfutils/libelf/gelf_update_sym.c +@@ -1,5 +1,5 @@ + /* Update symbol information in symbol table at the given index. +- Copyright (C) 2000, 2001, 2002 Red Hat, Inc. ++ Copyright (C) 2000-2009 Red Hat, Inc. + This file is part of Red Hat elfutils. + Written by Ulrich Drepper <drepper(a)redhat.com>, 2000. + +@@ -72,12 +72,6 @@ gelf_update_sym (data, ndx, src) + if (data == NULL) + return 0; + +- if (unlikely (ndx < 0)) +- { +- __libelf_seterrno (ELF_E_INVALID_INDEX); +- return 0; +- } +- + if (unlikely (data_scn->d.d_type != ELF_T_SYM)) + { + /* The type of the data better should match. */ +@@ -102,7 +96,7 @@ gelf_update_sym (data, ndx, src) + } + + /* Check whether we have to resize the data buffer. */ +- if (unlikely ((ndx + 1) * sizeof (Elf32_Sym) > data_scn->d.d_size)) ++ if (INVALID_NDX (ndx, Elf32_Sym, &data_scn->d)) + { + __libelf_seterrno (ELF_E_INVALID_INDEX); + goto out; +@@ -125,7 +119,7 @@ gelf_update_sym (data, ndx, src) + else + { + /* Check whether we have to resize the data buffer. */ +- if (unlikely ((ndx + 1) * sizeof (Elf64_Sym) > data_scn->d.d_size)) ++ if (INVALID_NDX (ndx, Elf64_Sym, &data_scn->d)) + { + __libelf_seterrno (ELF_E_INVALID_INDEX); + goto out; +--- elfutils/libelf/gelf_update_syminfo.c ++++ elfutils/libelf/gelf_update_syminfo.c +@@ -1,5 +1,5 @@ + /* Update additional symbol information in symbol table at the given index. +- Copyright (C) 2000, 2001, 2002 Red Hat, Inc. ++ Copyright (C) 2000-2009 Red Hat, Inc. + This file is part of Red Hat elfutils. + Written by Ulrich Drepper <drepper(a)redhat.com>, 2000. + +@@ -72,12 +72,6 @@ gelf_update_syminfo (data, ndx, src) + if (data == NULL) + return 0; + +- if (unlikely (ndx < 0)) +- { +- __libelf_seterrno (ELF_E_INVALID_INDEX); +- return 0; +- } +- + if (unlikely (data_scn->d.d_type != ELF_T_SYMINFO)) + { + /* The type of the data better should match. */ +@@ -93,7 +87,7 @@ gelf_update_syminfo (data, ndx, src) + rwlock_wrlock (scn->elf->lock); + + /* Check whether we have to resize the data buffer. */ +- if (unlikely ((ndx + 1) * sizeof (GElf_Syminfo) > data_scn->d.d_size)) ++ if (INVALID_NDX (ndx, GElf_Syminfo, &data_scn->d)) + { + __libelf_seterrno (ELF_E_INVALID_INDEX); + goto out; +--- elfutils/libelf/gelf_update_symshndx.c ++++ elfutils/libelf/gelf_update_symshndx.c +@@ -1,6 +1,6 @@ + /* Update symbol information and section index in symbol table at the + given index. +- Copyright (C) 2000, 2001, 2002 Red Hat, Inc. ++ Copyright (C) 2000-2009 Red Hat, Inc. + This file is part of Red Hat elfutils. + Written by Ulrich Drepper <drepper(a)redhat.com>, 2000. + +@@ -77,12 +77,6 @@ gelf_update_symshndx (symdata, shndxdata + if (symdata == NULL) + return 0; + +- if (unlikely (ndx < 0)) +- { +- __libelf_seterrno (ELF_E_INVALID_INDEX); +- return 0; +- } +- + if (unlikely (symdata_scn->d.d_type != ELF_T_SYM)) + { + /* The type of the data better should match. */ +@@ -128,7 +122,7 @@ gelf_update_symshndx (symdata, shndxdata + } + + /* Check whether we have to resize the data buffer. */ +- if (unlikely ((ndx + 1) * sizeof (Elf32_Sym) > symdata_scn->d.d_size)) ++ if (INVALID_NDX (ndx, Elf32_Sym, &symdata_scn->d)) + { + __libelf_seterrno (ELF_E_INVALID_INDEX); + goto out; +@@ -151,7 +145,7 @@ gelf_update_symshndx (symdata, shndxdata + else + { + /* Check whether we have to resize the data buffer. */ +- if (unlikely ((ndx + 1) * sizeof (Elf64_Sym) > symdata_scn->d.d_size)) ++ if (INVALID_NDX (ndx, Elf64_Sym, &symdata_scn->d)) + { + __libelf_seterrno (ELF_E_INVALID_INDEX); + goto out; +--- elfutils/libelf/gelf_update_versym.c ++++ elfutils/libelf/gelf_update_versym.c +@@ -1,5 +1,5 @@ + /* Update symbol version information. +- Copyright (C) 2001, 2002 Red Hat, Inc. ++ Copyright (C) 2001-2009 Red Hat, Inc. + This file is part of Red Hat elfutils. + Written by Ulrich Drepper <drepper(a)redhat.com>, 2001. + +@@ -75,8 +75,7 @@ gelf_update_versym (data, ndx, src) + assert (sizeof (GElf_Versym) == sizeof (Elf64_Versym)); + + /* Check whether we have to resize the data buffer. */ +- if (unlikely (ndx < 0) +- || unlikely ((ndx + 1) * sizeof (GElf_Versym) > data_scn->d.d_size)) ++ if (INVALID_NDX (ndx, GElf_Versym, &data_scn->d)) + { + __libelf_seterrno (ELF_E_INVALID_INDEX); + return 0; +--- elfutils/libelf/libelfP.h ++++ elfutils/libelf/libelfP.h +@@ -608,4 +608,8 @@ extern uint32_t __libelf_crc32 (uint32_t + /* Align offset to 4 bytes as needed for note name and descriptor data. */ + #define NOTE_ALIGN(n) (((n) + 3) & -4U) + ++/* Convenience macro. */ ++#define INVALID_NDX(ndx, type, data) \ ++ unlikely ((data)->d_size / sizeof (type) <= (unsigned int) (ndx)) ++ + #endif /* libelfP.h */ +--- elfutils/src/ChangeLog ++++ elfutils/src/ChangeLog +@@ -1532,6 +1532,16 @@ + object symbols or symbols with unknown type. + (check_rel): Likewise. + ++2005-06-09 Roland McGrath <roland(a)redhat.com> ++ ++ * readelf.c (handle_dynamic, handle_symtab): Check for bogus sh_link. ++ (handle_verneed, handle_verdef, handle_versym, handle_hash): Likewise. ++ (handle_scngrp): Check for bogus sh_info. ++ ++ * strip.c (handle_elf): Check for bogus values in sh_link, sh_info, ++ st_shndx, e_shstrndx, and SHT_GROUP or SHT_SYMTAB_SHNDX data. ++ Don't use assert on input values, instead bail with "illformed" error. ++ + 2005-06-08 Roland McGrath <roland(a)redhat.com> + + * readelf.c (print_ops): Add consts. +@@ -1577,6 +1587,19 @@ + + * readelf.c (dwarf_tag_string): Add new tags. + ++2005-05-17 Jakub Jelinek <jakub(a)redhat.com> ++ ++ * elflint.c (check_hash): Don't check entries beyond end of section. ++ (check_note): Don't crash if gelf_rawchunk fails. ++ (section_name): Return <invalid> if gelf_getshdr returns NULL. ++ ++2005-05-14 Jakub Jelinek <jakub(a)redhat.com> ++ ++ * elflint.c (section_name): Return "<invalid>" instead of ++ crashing on invalid section name. ++ (check_symtab, is_rel_dyn, check_rela, check_rel, check_dynamic, ++ check_symtab_shndx, check_hash, check_versym): Robustify. ++ + 2005-05-08 Roland McGrath <roland(a)redhat.com> + + * strip.c (handle_elf): Don't translate hash and versym data formats, +--- elfutils/src/elflint.c ++++ elfutils/src/elflint.c +@@ -131,6 +131,10 @@ static uint32_t shstrndx; + /* Array to count references in section groups. */ + static int *scnref; + ++/* Numbers of sections and program headers. */ ++static unsigned int shnum; ++static unsigned int phnum; ++ + + int + main (int argc, char *argv[]) +@@ -319,10 +323,19 @@ section_name (Ebl *ebl, int idx) + { + GElf_Shdr shdr_mem; + GElf_Shdr *shdr; ++ const char *ret; ++ ++ if ((unsigned int) idx > shnum) ++ return "<invalid>"; + + shdr = gelf_getshdr (elf_getscn (ebl->elf, idx), &shdr_mem); ++ if (shdr == NULL) ++ return "<invalid>"; + +- return elf_strptr (ebl->elf, shstrndx, shdr->sh_name); ++ ret = elf_strptr (ebl->elf, shstrndx, shdr->sh_name); ++ if (ret == NULL) ++ return "<invalid>"; ++ return ret; + } + + +@@ -344,11 +357,6 @@ static const int valid_e_machine[] = + (sizeof (valid_e_machine) / sizeof (valid_e_machine[0])) + + +-/* Numbers of sections and program headers. */ +-static unsigned int shnum; +-static unsigned int phnum; +- +- + static void + check_elf_header (Ebl *ebl, GElf_Ehdr *ehdr, size_t size) + { +@@ -632,7 +640,8 @@ section [%2d] '%s': symbol table cannot + } + } + +- if (shdr->sh_entsize != gelf_fsize (ebl->elf, ELF_T_SYM, 1, EV_CURRENT)) ++ size_t sh_entsize = gelf_fsize (ebl->elf, ELF_T_SYM, 1, EV_CURRENT); ++ if (shdr->sh_entsize != sh_entsize) + ERROR (gettext ("\ + section [%2u] '%s': entry size is does not match ElfXX_Sym\n"), + idx, section_name (ebl, idx)); +@@ -670,7 +679,7 @@ section [%2d] '%s': XINDEX for zeroth en + xndxscnidx, section_name (ebl, xndxscnidx)); + } + +- for (size_t cnt = 1; cnt < shdr->sh_size / shdr->sh_entsize; ++cnt) ++ for (size_t cnt = 1; cnt < shdr->sh_size / sh_entsize; ++cnt) + { + sym = gelf_getsymshndx (data, xndxdata, cnt, &sym_mem, &xndx); + if (sym == NULL) +@@ -690,7 +699,8 @@ section [%2d] '%s': symbol %zu: invalid + else + { + name = elf_strptr (ebl->elf, shdr->sh_link, sym->st_name); +- assert (name != NULL); ++ assert (name != NULL ++ || strshdr->sh_type != SHT_STRTAB); + } + + if (sym->st_shndx == SHN_XINDEX) +@@ -1038,9 +1048,11 @@ is_rel_dyn (Ebl *ebl, const GElf_Ehdr *e + { + GElf_Shdr rcshdr_mem; + const GElf_Shdr *rcshdr = gelf_getshdr (scn, &rcshdr_mem); +- assert (rcshdr != NULL); + +- if (rcshdr->sh_type == SHT_DYNAMIC) ++ if (rcshdr == NULL) ++ break; ++ ++ if (rcshdr->sh_type == SHT_DYNAMIC && rcshdr->sh_entsize) + { + /* Found the dynamic section. Look through it. */ + Elf_Data *d = elf_getdata (scn, NULL); +@@ -1050,7 +1062,9 @@ is_rel_dyn (Ebl *ebl, const GElf_Ehdr *e + { + GElf_Dyn dyn_mem; + GElf_Dyn *dyn = gelf_getdyn (d, cnt, &dyn_mem); +- assert (dyn != NULL); ++ ++ if (dyn == NULL) ++ break; + + if (dyn->d_tag == DT_RELCOUNT) + { +@@ -1064,7 +1078,9 @@ section [%2d] '%s': DT_RELCOUNT used for + /* Does the number specified number of relative + relocations exceed the total number of + relocations? */ +- if (dyn->d_un.d_val > shdr->sh_size / shdr->sh_entsize) ++ if (shdr->sh_entsize != 0 ++ && dyn->d_un.d_val > (shdr->sh_size ++ / shdr->sh_entsize)) + ERROR (gettext ("\ + section [%2d] '%s': DT_RELCOUNT value %d too high for this section\n"), + idx, section_name (ebl, idx), +@@ -1224,7 +1240,8 @@ section [%2d] '%s': no relocations for m + } + } + +- if (shdr->sh_entsize != gelf_fsize (ebl->elf, reltype, 1, EV_CURRENT)) ++ size_t sh_entsize = gelf_fsize (ebl->elf, reltype, 1, EV_CURRENT); ++ if (shdr->sh_entsize != sh_entsize) + ERROR (gettext (reltype == ELF_T_RELA ? "\ + section [%2d] '%s': section entry size does not match ElfXX_Rela\n" : "\ + section [%2d] '%s': section entry size does not match ElfXX_Rel\n"), +@@ -1447,7 +1464,8 @@ check_rela (Ebl *ebl, GElf_Ehdr *ehdr, G + Elf_Data *symdata = elf_getdata (symscn, NULL); + enum load_state state = state_undecided; + +- for (size_t cnt = 0; cnt < shdr->sh_size / shdr->sh_entsize; ++cnt) ++ size_t sh_entsize = gelf_fsize (ebl->elf, ELF_T_RELA, 1, EV_CURRENT); ++ for (size_t cnt = 0; cnt < shdr->sh_size / sh_entsize; ++cnt) + { + GElf_Rela rela_mem; + GElf_Rela *rela = gelf_getrela (data, cnt, &rela_mem); +@@ -1497,7 +1515,8 @@ check_rel (Ebl *ebl, GElf_Ehdr *ehdr, GE + Elf_Data *symdata = elf_getdata (symscn, NULL); + enum load_state state = state_undecided; + +- for (size_t cnt = 0; cnt < shdr->sh_size / shdr->sh_entsize; ++cnt) ++ size_t sh_entsize = gelf_fsize (ebl->elf, ELF_T_REL, 1, EV_CURRENT); ++ for (size_t cnt = 0; cnt < shdr->sh_size / sh_entsize; ++cnt) + { + GElf_Rel rel_mem; + GElf_Rel *rel = gelf_getrel (data, cnt, &rel_mem); +@@ -1600,7 +1619,8 @@ section [%2d] '%s': referenced as string + shdr->sh_link, section_name (ebl, shdr->sh_link), + idx, section_name (ebl, idx)); + +- if (shdr->sh_entsize != gelf_fsize (ebl->elf, ELF_T_DYN, 1, EV_CURRENT)) ++ size_t sh_entsize = gelf_fsize (ebl->elf, ELF_T_DYN, 1, EV_CURRENT); ++ if (shdr->sh_entsize != sh_entsize) + ERROR (gettext ("\ + section [%2d] '%s': section entry size does not match ElfXX_Dyn\n"), + idx, section_name (ebl, idx)); +@@ -1610,7 +1630,7 @@ section [%2d] '%s': section entry size d + idx, section_name (ebl, idx)); + + bool non_null_warned = false; +- for (cnt = 0; cnt < shdr->sh_size / shdr->sh_entsize; ++cnt) ++ for (cnt = 0; cnt < shdr->sh_size / sh_entsize; ++cnt) + { + GElf_Dyn dyn_mem; + GElf_Dyn *dyn = gelf_getdyn (data, cnt, &dyn_mem); +@@ -1891,6 +1911,8 @@ section [%2d] '%s': entry size does not + idx, section_name (ebl, idx)); + + if (symshdr != NULL ++ && shdr->sh_entsize ++ && symshdr->sh_entsize + && (shdr->sh_size / shdr->sh_entsize + < symshdr->sh_size / symshdr->sh_entsize)) + ERROR (gettext ("\ +@@ -1917,6 +1939,12 @@ section [%2d] '%s': extended section ind + } + + Elf_Data *data = elf_getdata (elf_getscn (ebl->elf, idx), NULL); ++ if (data == NULL) ++ { ++ ERROR (gettext ("section [%2d] '%s': cannot get section data\n"), ++ idx, section_name (ebl, idx)); ++ return; ++ } + + if (*((Elf32_Word *) data->d_buf) != 0) + ERROR (gettext ("symbol 0 should have zero extended section index\n")); +@@ -1959,7 +1987,7 @@ section [%2d] '%s': hash table section i + + size_t maxidx = nchain; + +- if (symshdr != NULL) ++ if (symshdr != NULL && symshdr->sh_entsize != 0) + { + size_t symsize = symshdr->sh_size / symshdr->sh_entsize; + +@@ -1970,18 +1998,28 @@ section [%2d] '%s': hash table section i + maxidx = symsize; + } + ++ Elf32_Word *buf = (Elf32_Word *) data->d_buf; ++ Elf32_Word *end = (Elf32_Word *) ((char *) data->d_buf + shdr->sh_size); + size_t cnt; + for (cnt = 2; cnt < 2 + nbucket; ++cnt) +- if (((Elf32_Word *) data->d_buf)[cnt] >= maxidx) ++ { ++ if (buf + cnt >= end) ++ break; ++ else if (buf[cnt] >= maxidx) + ERROR (gettext ("\ + section [%2d] '%s': hash bucket reference %zu out of bounds\n"), + idx, section_name (ebl, idx), cnt - 2); ++ } + + for (; cnt < 2 + nbucket + nchain; ++cnt) +- if (((Elf32_Word *) data->d_buf)[cnt] >= maxidx) ++ { ++ if (buf + cnt >= end) ++ break; ++ else if (buf[cnt] >= maxidx) + ERROR (gettext ("\ + section [%2d] '%s': hash chain reference %zu out of bounds\n"), + idx, section_name (ebl, idx), cnt - 2 - nbucket); ++ } + } + + +@@ -2011,18 +2049,28 @@ section [%2d] '%s': hash table section i + maxidx = symsize; + } + ++ Elf64_Xword *buf = (Elf64_Xword *) data->d_buf; ++ Elf64_Xword *end = (Elf64_Xword *) ((char *) data->d_buf + shdr->sh_size); + size_t cnt; + for (cnt = 2; cnt < 2 + nbucket; ++cnt) +- if (((Elf64_Xword *) data->d_buf)[cnt] >= maxidx) ++ { ++ if (buf + cnt >= end) ++ break; ++ else if (buf[cnt] >= maxidx) + ERROR (gettext ("\ + section [%2d] '%s': hash bucket reference %zu out of bounds\n"), + idx, section_name (ebl, idx), cnt - 2); ++ } + + for (; cnt < 2 + nbucket + nchain; ++cnt) +- if (((Elf64_Xword *) data->d_buf)[cnt] >= maxidx) ++ { ++ if (buf + cnt >= end) ++ break; ++ else if (buf[cnt] >= maxidx) + ERROR (gettext ("\ + section [%2d] '%s': hash chain reference %" PRIu64 " out of bounds\n"), +- idx, section_name (ebl, idx), (uint64_t) (cnt - 2 - nbucket)); ++ idx, section_name (ebl, idx), (uint64_t) cnt - 2 - nbucket); ++ } + } + + +@@ -2047,7 +2095,7 @@ section [%2d] '%s': bitmask size not pow + if (shdr->sh_size < (4 + bitmask_words + nbuckets) * sizeof (Elf32_Word)) + { + ERROR (gettext ("\ +-section [%2d] '%s': hash table section is too small (is %ld, expected at least%ld)\n"), ++section [%2d] '%s': hash table section is too small (is %ld, expected at least %ld)\n"), + idx, section_name (ebl, idx), (long int) shdr->sh_size, + (long int) ((4 + bitmask_words + nbuckets) * sizeof (Elf32_Word))); + return; +@@ -2719,8 +2767,9 @@ section [%2d] '%s' refers in sh_link to + + /* The number of elements in the version symbol table must be the + same as the number of symbols. */ +- if (shdr->sh_size / shdr->sh_entsize +- != symshdr->sh_size / symshdr->sh_entsize) ++ if (shdr->sh_entsize && symshdr->sh_entsize ++ && (shdr->sh_size / shdr->sh_entsize ++ != symshdr->sh_size / symshdr->sh_entsize)) + ERROR (gettext ("\ + section [%2d] '%s' has different number of entries than symbol table [%2d] '%s'\n"), + idx, section_name (ebl, idx), +--- elfutils/src/readelf.c ++++ elfutils/src/readelf.c +@@ -1170,6 +1170,8 @@ handle_scngrp (Ebl *ebl, Elf_Scn *scn, G + Elf32_Word *grpref = (Elf32_Word *) data->d_buf; + + GElf_Sym sym_mem; ++ GElf_Sym *sym = gelf_getsym (symdata, shdr->sh_info, &sym_mem); ++ + printf ((grpref[0] & GRP_COMDAT) + ? ngettext ("\ + \nCOMDAT section group [%2zu] '%s' with signature '%s' contains %zu entry:\n", +@@ -1182,8 +1184,8 @@ handle_scngrp (Ebl *ebl, Elf_Scn *scn, G + data->d_size / sizeof (Elf32_Word) - 1), + elf_ndxscn (scn), + elf_strptr (ebl->elf, shstrndx, shdr->sh_name), +- elf_strptr (ebl->elf, symshdr->sh_link, +- gelf_getsym (symdata, shdr->sh_info, &sym_mem)->st_name) ++ (sym == NULL ? NULL ++ : elf_strptr (ebl->elf, symshdr->sh_link, sym->st_name)) + ?: gettext ("<INVALID SYMBOL>"), + data->d_size / sizeof (Elf32_Word) - 1); + +@@ -1334,7 +1336,8 @@ static void + handle_dynamic (Ebl *ebl, Elf_Scn *scn, GElf_Shdr *shdr) + { + int class = gelf_getclass (ebl->elf); +- GElf_Shdr glink; ++ GElf_Shdr glink_mem; ++ GElf_Shdr *glink; + Elf_Data *data; + size_t cnt; + size_t shstrndx; +@@ -1349,6 +1352,11 @@ handle_dynamic (Ebl *ebl, Elf_Scn *scn, + error (EXIT_FAILURE, 0, + gettext ("cannot get section header string table index")); + ++ glink = gelf_getshdr (elf_getscn (ebl->elf, shdr->sh_link), &glink_mem); ++ if (glink == NULL) ++ error (EXIT_FAILURE, 0, gettext ("invalid sh_link value in section %Zu"), ++ elf_ndxscn (scn)); ++ + printf (ngettext ("\ + \nDynamic segment contains %lu entry:\n Addr: %#0*" PRIx64 " Offset: %#08" PRIx64 " Link to section: [%2u] '%s'\n", + "\ +@@ -1358,9 +1366,7 @@ handle_dynamic (Ebl *ebl, Elf_Scn *scn, + class == ELFCLASS32 ? 10 : 18, shdr->sh_addr, + shdr->sh_offset, + (int) shdr->sh_link, +- elf_strptr (ebl->elf, shstrndx, +- gelf_getshdr (elf_getscn (ebl->elf, shdr->sh_link), +- &glink)->sh_name)); ++ elf_strptr (ebl->elf, shstrndx, glink->sh_name)); + fputs_unlocked (gettext (" Type Value\n"), stdout); + + for (cnt = 0; cnt < shdr->sh_size / shdr->sh_entsize; ++cnt) +@@ -1943,6 +1949,13 @@ handle_symtab (Ebl *ebl, Elf_Scn *scn, G + error (EXIT_FAILURE, 0, + gettext ("cannot get section header string table index")); + ++ GElf_Shdr glink_mem; ++ GElf_Shdr *glink = gelf_getshdr (elf_getscn (ebl->elf, shdr->sh_link), ++ &glink_mem); ++ if (glink == NULL) ++ error (EXIT_FAILURE, 0, gettext ("invalid sh_link value in section %Zu"), ++ elf_ndxscn (scn)); ++ + /* Now we can compute the number of entries in the section. */ + unsigned int nsyms = data->d_size / (class == ELFCLASS32 + ? sizeof (Elf32_Sym) +@@ -1953,15 +1966,12 @@ handle_symtab (Ebl *ebl, Elf_Scn *scn, G + nsyms), + (unsigned int) elf_ndxscn (scn), + elf_strptr (ebl->elf, shstrndx, shdr->sh_name), nsyms); +- GElf_Shdr glink; + printf (ngettext (" %lu local symbol String table: [%2u] '%s'\n", + " %lu local symbols String table: [%2u] '%s'\n", + shdr->sh_info), + (unsigned long int) shdr->sh_info, + (unsigned int) shdr->sh_link, +- elf_strptr (ebl->elf, shstrndx, +- gelf_getshdr (elf_getscn (ebl->elf, shdr->sh_link), +- &glink)->sh_name)); ++ elf_strptr (ebl->elf, shstrndx, glink->sh_name)); + + fputs_unlocked (class == ELFCLASS32 + ? gettext ("\ +@@ -2197,7 +2207,13 @@ handle_verneed (Ebl *ebl, Elf_Scn *scn, + error (EXIT_FAILURE, 0, + gettext ("cannot get section header string table index")); + +- GElf_Shdr glink; ++ GElf_Shdr glink_mem; ++ GElf_Shdr *glink = gelf_getshdr (elf_getscn (ebl->elf, shdr->sh_link), ++ &glink_mem); ++ if (glink == NULL) ++ error (EXIT_FAILURE, 0, gettext ("invalid sh_link value in section %Zu"), ++ elf_ndxscn (scn)); ++ + printf (ngettext ("\ + \nVersion needs section [%2u] '%s' contains %d entry:\n Addr: %#0*" PRIx64 " Offset: %#08" PRIx64 " Link to section: [%2u] '%s'\n", + "\ +@@ -2208,9 +2224,7 @@ handle_verneed (Ebl *ebl, Elf_Scn *scn, + class == ELFCLASS32 ? 10 : 18, shdr->sh_addr, + shdr->sh_offset, + (unsigned int) shdr->sh_link, +- elf_strptr (ebl->elf, shstrndx, +- gelf_getshdr (elf_getscn (ebl->elf, shdr->sh_link), +- &glink)->sh_name)); ++ elf_strptr (ebl->elf, shstrndx, glink->sh_name)); + + unsigned int offset = 0; + for (int cnt = shdr->sh_info; --cnt >= 0; ) +@@ -2263,8 +2277,14 @@ handle_verdef (Ebl *ebl, Elf_Scn *scn, G + error (EXIT_FAILURE, 0, + gettext ("cannot get section header string table index")); + ++ GElf_Shdr glink_mem; ++ GElf_Shdr *glink = gelf_getshdr (elf_getscn (ebl->elf, shdr->sh_link), ++ &glink_mem); ++ if (glink == NULL) ++ error (EXIT_FAILURE, 0, gettext ("invalid sh_link value in section %Zu"), ++ elf_ndxscn (scn)); ++ + int class = gelf_getclass (ebl->elf); +- GElf_Shdr glink; + printf (ngettext ("\ + \nVersion definition section [%2u] '%s' contains %d entry:\n Addr: %#0*" PRIx64 " Offset: %#08" PRIx64 " Link to section: [%2u] '%s'\n", + "\ +@@ -2276,9 +2296,7 @@ handle_verdef (Ebl *ebl, Elf_Scn *scn, G + class == ELFCLASS32 ? 10 : 18, shdr->sh_addr, + shdr->sh_offset, + (unsigned int) shdr->sh_link, +- elf_strptr (ebl->elf, shstrndx, +- gelf_getshdr (elf_getscn (ebl->elf, shdr->sh_link), +- &glink)->sh_name)); ++ elf_strptr (ebl->elf, shstrndx, glink->sh_name)); + + unsigned int offset = 0; + for (int cnt = shdr->sh_info; --cnt >= 0; ) +@@ -2540,8 +2558,14 @@ handle_versym (Ebl *ebl, Elf_Scn *scn, G + filename = NULL; + } + ++ GElf_Shdr glink_mem; ++ GElf_Shdr *glink = gelf_getshdr (elf_getscn (ebl->elf, shdr->sh_link), ++ &glink_mem); ++ if (glink == NULL) ++ error (EXIT_FAILURE, 0, gettext ("invalid sh_link value in section %Zu"), ++ elf_ndxscn (scn)); ++ + /* Print the header. */ +- GElf_Shdr glink; + printf (ngettext ("\ + \nVersion symbols section [%2u] '%s' contains %d entry:\n Addr: %#0*" PRIx64 " Offset: %#08" PRIx64 " Link to section: [%2u] '%s'", + "\ +@@ -2553,9 +2577,7 @@ handle_versym (Ebl *ebl, Elf_Scn *scn, G + class == ELFCLASS32 ? 10 : 18, shdr->sh_addr, + shdr->sh_offset, + (unsigned int) shdr->sh_link, +- elf_strptr (ebl->elf, shstrndx, +- gelf_getshdr (elf_getscn (ebl->elf, shdr->sh_link), +- &glink)->sh_name)); ++ elf_strptr (ebl->elf, shstrndx, glink->sh_name)); + + /* Now we can finally look at the actual contents of this section. */ + for (unsigned int cnt = 0; cnt < shdr->sh_size / shdr->sh_entsize; ++cnt) +@@ -2607,7 +2629,17 @@ print_hash_info (Ebl *ebl, Elf_Scn *scn, + for (Elf32_Word cnt = 0; cnt < nbucket; ++cnt) + ++counts[lengths[cnt]]; + +- GElf_Shdr glink; ++ GElf_Shdr glink_mem; ++ GElf_Shdr *glink = gelf_getshdr (elf_getscn (ebl->elf, ++ shdr->sh_link), ++ &glink_mem); ++ if (glink == NULL) ++ { ++ error (0, 0, gettext ("invalid sh_link value in section %Zu"), ++ elf_ndxscn (scn)); ++ return; ++ } ++ + printf (ngettext ("\ + \nHistogram for bucket list length in section [%2u] '%s' (total of %d bucket):\n Addr: %#0*" PRIx64 " Offset: %#08" PRIx64 " Link to section: [%2u] '%s'\n", + "\ +@@ -2620,9 +2652,7 @@ print_hash_info (Ebl *ebl, Elf_Scn *scn, + shdr->sh_addr, + shdr->sh_offset, + (unsigned int) shdr->sh_link, +- elf_strptr (ebl->elf, shstrndx, +- gelf_getshdr (elf_getscn (ebl->elf, shdr->sh_link), +- &glink)->sh_name)); ++ elf_strptr (ebl->elf, shstrndx, glink->sh_name)); + + if (extrastr != NULL) + fputs (extrastr, stdout); +@@ -4263,6 +4293,16 @@ print_debug_aranges_section (Dwfl_Module + return; + } + ++ GElf_Shdr glink_mem; ++ GElf_Shdr *glink; ++ glink = gelf_getshdr (elf_getscn (ebl->elf, shdr->sh_link), &glink_mem); ++ if (glink == NULL) ++ { ++ error (0, 0, gettext ("invalid sh_link value in section %Zu"), ++ elf_ndxscn (scn)); ++ return; ++ } ++ + printf (ngettext ("\ + \nDWARF section [%2zu] '%s' at offset %#" PRIx64 " contains %zu entry:\n", + "\ +--- elfutils/src/strip.c ++++ elfutils/src/strip.c +@@ -545,6 +545,11 @@ handle_elf (int fd, Elf *elf, const char + goto fail_close; + } + ++ if (shstrndx >= shnum) ++ goto illformed; ++ ++#define elf_assert(test) do { if (!(test)) goto illformed; } while (0) ++ + /* Storage for section information. We leave room for two more + entries since we unconditionally create a section header string + table. Maybe some weird tool created an ELF file without one. +@@ -566,7 +571,7 @@ handle_elf (int fd, Elf *elf, const char + { + /* This should always be true (i.e., there should not be any + holes in the numbering). */ +- assert (elf_ndxscn (scn) == cnt); ++ elf_assert (elf_ndxscn (scn) == cnt); + + shdr_info[cnt].scn = scn; + +@@ -579,6 +584,7 @@ handle_elf (int fd, Elf *elf, const char + shdr_info[cnt].shdr.sh_name); + if (shdr_info[cnt].name == NULL) + { ++ illformed: + error (0, 0, gettext ("illformed file '%s'"), fname); + goto fail_close; + } +@@ -588,6 +594,8 @@ handle_elf (int fd, Elf *elf, const char + + /* Remember the shdr.sh_link value. */ + shdr_info[cnt].old_sh_link = shdr_info[cnt].shdr.sh_link; ++ if (shdr_info[cnt].old_sh_link >= shnum) ++ goto illformed; + + /* Sections in files other than relocatable object files which + are not loaded can be freely moved by us. In relocatable +@@ -600,7 +608,7 @@ handle_elf (int fd, Elf *elf, const char + appropriate reference. */ + if (unlikely (shdr_info[cnt].shdr.sh_type == SHT_SYMTAB_SHNDX)) + { +- assert (shdr_info[shdr_info[cnt].shdr.sh_link].symtab_idx == 0); ++ elf_assert (shdr_info[shdr_info[cnt].shdr.sh_link].symtab_idx == 0); + shdr_info[shdr_info[cnt].shdr.sh_link].symtab_idx = cnt; + } + else if (unlikely (shdr_info[cnt].shdr.sh_type == SHT_GROUP)) +@@ -617,7 +625,12 @@ handle_elf (int fd, Elf *elf, const char + for (inner = 1; + inner < shdr_info[cnt].data->d_size / sizeof (Elf32_Word); + ++inner) ++ { ++ if (grpref[inner] < shnum) + shdr_info[grpref[inner]].group_idx = cnt; ++ else ++ goto illformed; ++ } + + if (inner == 1 || (inner == 2 && (grpref[0] & GRP_COMDAT) == 0)) + /* If the section group contains only one element and this +@@ -628,7 +641,7 @@ handle_elf (int fd, Elf *elf, const char + } + else if (unlikely (shdr_info[cnt].shdr.sh_type == SHT_GNU_versym)) + { +- assert (shdr_info[shdr_info[cnt].shdr.sh_link].version_idx == 0); ++ elf_assert (shdr_info[shdr_info[cnt].shdr.sh_link].version_idx == 0); + shdr_info[shdr_info[cnt].shdr.sh_link].version_idx = cnt; + } + +@@ -636,7 +649,7 @@ handle_elf (int fd, Elf *elf, const char + discarded right away. */ + if ((shdr_info[cnt].shdr.sh_flags & SHF_GROUP) != 0) + { +- assert (shdr_info[cnt].group_idx != 0); ++ elf_assert (shdr_info[cnt].group_idx != 0); + + if (shdr_info[shdr_info[cnt].group_idx].idx == 0) + { +@@ -711,11 +724,15 @@ handle_elf (int fd, Elf *elf, const char + { + /* If a relocation section is marked as being removed make + sure the section it is relocating is removed, too. */ +- if ((shdr_info[cnt].shdr.sh_type == SHT_REL ++ if (shdr_info[cnt].shdr.sh_type == SHT_REL + || shdr_info[cnt].shdr.sh_type == SHT_RELA) +- && shdr_info[shdr_info[cnt].shdr.sh_info].idx != 0) ++ { ++ if (shdr_info[cnt].shdr.sh_info >= shnum) ++ goto illformed; ++ else if (shdr_info[shdr_info[cnt].shdr.sh_info].idx != 0) + shdr_info[cnt].idx = 1; + } ++ } + + if (shdr_info[cnt].idx == 1) + { +@@ -742,7 +759,7 @@ handle_elf (int fd, Elf *elf, const char + if (shdr_info[cnt].symtab_idx != 0 + && shdr_info[shdr_info[cnt].symtab_idx].data == NULL) + { +- assert (shdr_info[cnt].shdr.sh_type == SHT_SYMTAB); ++ elf_assert (shdr_info[cnt].shdr.sh_type == SHT_SYMTAB); + + shdr_info[shdr_info[cnt].symtab_idx].data + = elf_getdata (shdr_info[shdr_info[cnt].symtab_idx].scn, +@@ -782,6 +799,9 @@ handle_elf (int fd, Elf *elf, const char + else if (scnidx == SHN_XINDEX) + scnidx = xndx; + ++ if (scnidx >= shnum) ++ goto illformed; ++ + if (shdr_info[scnidx].idx == 0) + /* This symbol table has a real symbol in + a discarded section. So preserve the +@@ -812,12 +832,16 @@ handle_elf (int fd, Elf *elf, const char + } + + /* Handle references through sh_info. */ +- if (SH_INFO_LINK_P (&shdr_info[cnt].shdr) +- && shdr_info[shdr_info[cnt].shdr.sh_info].idx == 0) ++ if (SH_INFO_LINK_P (&shdr_info[cnt].shdr)) ++ { ++ if (shdr_info[cnt].shdr.sh_info >= shnum) ++ goto illformed; ++ else if ( shdr_info[shdr_info[cnt].shdr.sh_info].idx == 0) + { + shdr_info[shdr_info[cnt].shdr.sh_info].idx = 1; + changes |= shdr_info[cnt].shdr.sh_info < cnt; + } ++ } + + /* Mark the section as investigated. */ + shdr_info[cnt].idx = 2; +@@ -956,7 +980,7 @@ handle_elf (int fd, Elf *elf, const char + error (EXIT_FAILURE, 0, gettext ("while generating output file: %s"), + elf_errmsg (-1)); + +- assert (elf_ndxscn (shdr_info[cnt].newscn) == shdr_info[cnt].idx); ++ elf_assert (elf_ndxscn (shdr_info[cnt].newscn) == shdr_info[cnt].idx); + + /* Add this name to the section header string table. */ + shdr_info[cnt].se = ebl_strtabadd (shst, shdr_info[cnt].name, 0); +@@ -993,7 +1017,7 @@ handle_elf (int fd, Elf *elf, const char + error (EXIT_FAILURE, 0, + gettext ("while create section header section: %s"), + elf_errmsg (-1)); +- assert (elf_ndxscn (shdr_info[cnt].newscn) == shdr_info[cnt].idx); ++ elf_assert (elf_ndxscn (shdr_info[cnt].newscn) == shdr_info[cnt].idx); + + shdr_info[cnt].data = elf_newdata (shdr_info[cnt].newscn); + if (shdr_info[cnt].data == NULL) +@@ -1049,7 +1073,7 @@ handle_elf (int fd, Elf *elf, const char + error (EXIT_FAILURE, 0, + gettext ("while create section header section: %s"), + elf_errmsg (-1)); +- assert (elf_ndxscn (shdr_info[cnt].newscn) == idx); ++ elf_assert (elf_ndxscn (shdr_info[cnt].newscn) == idx); + + /* Finalize the string table and fill in the correct indices in the + section headers. */ +@@ -1139,20 +1163,20 @@ handle_elf (int fd, Elf *elf, const char + shndxdata = elf_getdata (shdr_info[shdr_info[cnt].symtab_idx].scn, + NULL); + +- assert ((versiondata->d_size / sizeof (Elf32_Word)) ++ elf_assert ((versiondata->d_size / sizeof (Elf32_Word)) + >= shdr_info[cnt].data->d_size / elsize); + } + + if (shdr_info[cnt].version_idx != 0) + { +- assert (shdr_info[cnt].shdr.sh_type == SHT_DYNSYM); ++ elf_assert (shdr_info[cnt].shdr.sh_type == SHT_DYNSYM); + /* This section has associated version + information. We have to modify that + information, too. */ + versiondata = elf_getdata (shdr_info[shdr_info[cnt].version_idx].scn, + NULL); + +- assert ((versiondata->d_size / sizeof (GElf_Versym)) ++ elf_assert ((versiondata->d_size / sizeof (GElf_Versym)) + >= shdr_info[cnt].data->d_size / elsize); + } + +@@ -1207,7 +1231,7 @@ handle_elf (int fd, Elf *elf, const char + sec = shdr_info[sym->st_shndx].idx; + else + { +- assert (shndxdata != NULL); ++ elf_assert (shndxdata != NULL); + + sec = shdr_info[xshndx].idx; + } +@@ -1228,7 +1252,7 @@ handle_elf (int fd, Elf *elf, const char + nxshndx = sec; + } + +- assert (sec < SHN_LORESERVE || shndxdata != NULL); ++ elf_assert (sec < SHN_LORESERVE || shndxdata != NULL); + + if ((inner != destidx || nshndx != sym->st_shndx + || (shndxdata != NULL && nxshndx != xshndx)) +@@ -1252,7 +1276,7 @@ handle_elf (int fd, Elf *elf, const char + || shdr_info[cnt].debug_data == NULL) + /* This is a section symbol for a section which has + been removed. */ +- assert (GELF_ST_TYPE (sym->st_info) == STT_SECTION); ++ elf_assert (GELF_ST_TYPE (sym->st_info) == STT_SECTION); + } + + if (destidx != inner) +@@ -1439,11 +1463,11 @@ handle_elf (int fd, Elf *elf, const char + { + GElf_Sym sym_mem; + GElf_Sym *sym = gelf_getsym (symd, inner, &sym_mem); +- assert (sym != NULL); ++ elf_assert (sym != NULL); + + const char *name = elf_strptr (elf, strshndx, + sym->st_name); +- assert (name != NULL); ++ elf_assert (name != NULL); + size_t hidx = elf_hash (name) % nbucket; + + if (bucket[hidx] == 0) +@@ -1462,7 +1486,7 @@ handle_elf (int fd, Elf *elf, const char + else + { + /* Alpha and S390 64-bit use 64-bit SHT_HASH entries. */ +- assert (shdr_info[cnt].shdr.sh_entsize ++ elf_assert (shdr_info[cnt].shdr.sh_entsize + == sizeof (Elf64_Xword)); + + Elf64_Xword *bucket = (Elf64_Xword *) hashd->d_buf; +@@ -1493,11 +1517,11 @@ handle_elf (int fd, Elf *elf, const char + { + GElf_Sym sym_mem; + GElf_Sym *sym = gelf_getsym (symd, inner, &sym_mem); +- assert (sym != NULL); ++ elf_assert (sym != NULL); + + const char *name = elf_strptr (elf, strshndx, + sym->st_name); +- assert (name != NULL); ++ elf_assert (name != NULL); + size_t hidx = elf_hash (name) % nbucket; + + if (bucket[hidx] == 0) hooks/post-receive -- IPFire 3.x development tree

1 0

← Newer
1
2
3
4
5
6
7
8
9
10
Older →

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

IPFire-SCM March 2010