From 58676c5004aa1a48df9dbef4ad7c85e1293bfedc Mon Sep 17 00:00:00 2001 From: Daniel Black Date: Fri, 5 Nov 2004 15:12:13 +0000 Subject: [PATCH] Fixed insecure temp file creation as per bug #68407. stable on x86 and ppc --- dev-libs/openssl/ChangeLog | 8 +- dev-libs/openssl/Manifest | 27 +- .../openssl/files/digest-openssl-0.9.7d-r2 | 2 + .../files/openssl-0.9.7c-tempfile.patch | 78 +++++ dev-libs/openssl/openssl-0.9.7d-r2.ebuild | 298 ++++++++++++++++++ 5 files changed, 405 insertions(+), 8 deletions(-) create mode 100644 dev-libs/openssl/files/digest-openssl-0.9.7d-r2 create mode 100644 dev-libs/openssl/files/openssl-0.9.7c-tempfile.patch create mode 100644 dev-libs/openssl/openssl-0.9.7d-r2.ebuild diff --git a/dev-libs/openssl/ChangeLog b/dev-libs/openssl/ChangeLog index 9cff4a5343e8..8ece7ce24e61 100644 --- a/dev-libs/openssl/ChangeLog +++ b/dev-libs/openssl/ChangeLog @@ -1,6 +1,12 @@ # ChangeLog for dev-libs/openssl # Copyright 2002-2004 Gentoo Foundation; Distributed under the GPL v2 -# $Header: /var/cvsroot/gentoo-x86/dev-libs/openssl/ChangeLog,v 1.93 2004/09/22 01:25:05 mr_bones_ Exp $ +# $Header: /var/cvsroot/gentoo-x86/dev-libs/openssl/ChangeLog,v 1.94 2004/11/05 15:12:12 dragonheart Exp $ + +*openssl-0.9.7d-r2 (06 Nov 2004) + + 06 Nov 2004; Daniel Black + +files/openssl-0.9.7c-tempfile.patch, +openssl-0.9.7d-r2.ebuild: + Fixed insecure temp file creation as per bug #68407. stable on x86 and ppc 21 Sep 2004; Michael Sterrett openssl-0.9.7d-r1.ebuild: diff --git a/dev-libs/openssl/Manifest b/dev-libs/openssl/Manifest index 69ea5d7f8178..62176d4f74e5 100644 --- a/dev-libs/openssl/Manifest +++ b/dev-libs/openssl/Manifest @@ -1,18 +1,31 @@ -MD5 139d6bdf47adcc8fd2e7a735aa104827 ChangeLog 15113 +-----BEGIN PGP SIGNED MESSAGE----- +Hash: SHA1 + +MD5 6081e87d852836152f40fc4195cf448c ChangeLog 15347 MD5 37236013e0d26d43c6bff35a8a48e8ec metadata.xml 220 MD5 b2bb47be1c71efedd650243576212700 openssl-0.9.6m.ebuild 3088 +MD5 a5a3e6682c17e1ee6d679f67d162a15a openssl-0.9.7d.ebuild 7801 +MD5 f486886e3b46bc6502733a497592cac1 openssl-0.9.7d-r1.ebuild 8558 +MD5 bbe66c466cbc610d084fec22d3b81726 openssl-0.9.7d-r2.ebuild 8902 MD5 8348f8cb6117f6228e58d01f3625c2e2 openssl-0.9.7c-r1.ebuild 7021 MD5 9eb521df91b2ae08a45484d1986e44e4 openssl-0.9.7c.ebuild 4961 -MD5 f486886e3b46bc6502733a497592cac1 openssl-0.9.7d-r1.ebuild 8558 -MD5 a5a3e6682c17e1ee6d679f67d162a15a openssl-0.9.7d.ebuild 7801 MD5 2e6ed24d513a8f2b1b6f03709ab5ba18 files/digest-openssl-0.9.6m 67 MD5 897d293325315cdeeb390745ed5cdd1b files/digest-openssl-0.9.7d 134 MD5 cebd09d1819c07b0fab14ad90b0da884 files/openssl-0.9.6m-gentoo.diff 1591 -MD5 744b358cd3b68b2ca6561c214c541fc0 files/addppc64support.diff 1327 +MD5 7483d6f0412e857e9063dce4aecf2991 files/openssl-0.9.7d-gentoo.diff 936 MD5 8ad6215b1b4c9d53c435ceff6b537e35 files/digest-openssl-0.9.7c 134 -MD5 897d293325315cdeeb390745ed5cdd1b files/digest-openssl-0.9.7d-r1 134 +MD5 f8b9ae9e3ed08f964620aa832aec4d0c files/digest-openssl-0.9.7c-r1 134 MD5 b901850df9952252974316e78775673b files/openssl-0.9.6-mips.diff 1487 -MD5 7483d6f0412e857e9063dce4aecf2991 files/openssl-0.9.7d-gentoo.diff 936 +MD5 744b358cd3b68b2ca6561c214c541fc0 files/addppc64support.diff 1327 +MD5 897d293325315cdeeb390745ed5cdd1b files/digest-openssl-0.9.7d-r1 134 MD5 91854bcd6c83f040927d490b104bb5a0 files/openssl-0.9.7d-smime.patch 641 +MD5 f804ea4df3b388d22451cde6e9458f2b files/openssl-0.9.7c-tempfile.patch 2178 +MD5 897d293325315cdeeb390745ed5cdd1b files/digest-openssl-0.9.7d-r2 134 MD5 7483d6f0412e857e9063dce4aecf2991 files/openssl-0.9.7c-gentoo.diff 936 -MD5 f8b9ae9e3ed08f964620aa832aec4d0c files/digest-openssl-0.9.7c-r1 134 +-----BEGIN PGP SIGNATURE----- +Version: GnuPG v1.2.6 (GNU/Linux) + +iD8DBQFBi5hamdTrptrqvGERAnTAAJ4wYmVgEi6baGUUoeD16qaWtGeY4QCfSFA8 +Og5nqtCgo/4vd3hpu2doWP0= +=Ccc/ +-----END PGP SIGNATURE----- diff --git a/dev-libs/openssl/files/digest-openssl-0.9.7d-r2 b/dev-libs/openssl/files/digest-openssl-0.9.7d-r2 new file mode 100644 index 000000000000..53244e8e53f6 --- /dev/null +++ b/dev-libs/openssl/files/digest-openssl-0.9.7d-r2 @@ -0,0 +1,2 @@ +MD5 1b49e90fc8a75c3a507c0a624529aca5 openssl-0.9.7d.tar.gz 2798433 +MD5 1b63bfdca1c37837dddde9f1623498f9 openssl-0.9.6m.tar.gz 2184918 diff --git a/dev-libs/openssl/files/openssl-0.9.7c-tempfile.patch b/dev-libs/openssl/files/openssl-0.9.7c-tempfile.patch new file mode 100644 index 000000000000..a94821a84491 --- /dev/null +++ b/dev-libs/openssl/files/openssl-0.9.7c-tempfile.patch @@ -0,0 +1,78 @@ +diff -ur openssl-0.9.7c.orig/apps/der_chop openssl-0.9.7c/apps/der_chop +--- openssl-0.9.7c.orig/apps/der_chop 2003-09-30 14:38:15.000000000 +0200 ++++ openssl-0.9.7c/apps/der_chop 2004-09-13 13:46:06.000000000 +0200 +@@ -65,7 +65,7 @@ + } + else + { +- $file="/tmp/a$$.DER"; ++ $file=`mktemp -t a$$.DER.XXXXXX` || die $!; + open(OUT,">$file") || die "unable to open $file:$!\n"; + for (;;) + { +@@ -139,7 +139,7 @@ + { + local($str)=@_; + local(*OUT,*IN,@a,$t,$d,$ret); +- local($file)="/tmp/b$$.DER"; ++ local($file)=`mktemp -t b$$.DER.XXXXXX` || die $!; + local(@ret); + + open(OUT,">$file"); +@@ -225,7 +225,7 @@ + sub do_private_key + { + local($data,@struct)=@_; +- local($file)="/tmp/b$$.DER"; ++ local($file)=`mktemp -t b$$.DER.XXXXXX` || die $!; + local($off,$d,$hl,$len,$_,$b,@p,$s); + + ($type)=($struct[4] =~ /OBJECT_IDENTIFIER :(.*)\s*$/); +@@ -260,7 +260,7 @@ + sub do_certificate + { + local($data,@struct)=@_; +- local($file)="/tmp/b$$.DER"; ++ local($file)=`mktemp -t b$$.DER.XXXXXX` || die $!; + local($off,$d,$hl,$len,$_,$b,@p,$s); + + ($off,$d,$hl,$len)=&parse_line($struct[2]); +diff -ur openssl-0.9.7c.orig/apps/der_chop.in openssl-0.9.7c/apps/der_chop.in +--- openssl-0.9.7c.orig/apps/der_chop.in 1999-05-26 00:31:49.000000000 +0200 ++++ openssl-0.9.7c/apps/der_chop.in 2004-09-13 13:43:46.000000000 +0200 +@@ -65,7 +65,7 @@ + } + else + { +- $file="/tmp/a$$.DER"; ++ $file=`mktemp -t a$$.DER.XXXXXX` || die $!; + open(OUT,">$file") || die "unable to open $file:$!\n"; + for (;;) + { +@@ -139,7 +139,7 @@ + { + local($str)=@_; + local(*OUT,*IN,@a,$t,$d,$ret); +- local($file)="/tmp/b$$.DER"; ++ local($file)=`mktemp -t b$$.DER.XXXXXX` || die $!; + local(@ret); + + open(OUT,">$file"); +@@ -225,7 +225,7 @@ + sub do_private_key + { + local($data,@struct)=@_; +- local($file)="/tmp/b$$.DER"; ++ local($file)=`mktemp -t b$$.DER.XXXXXX` || die $!; + local($off,$d,$hl,$len,$_,$b,@p,$s); + + ($type)=($struct[4] =~ /OBJECT_IDENTIFIER :(.*)\s*$/); +@@ -260,7 +260,7 @@ + sub do_certificate + { + local($data,@struct)=@_; +- local($file)="/tmp/b$$.DER"; ++ local($file)=`mktemp -t b$$.DER.XXXXXX` || die $!; + local($off,$d,$hl,$len,$_,$b,@p,$s); + + ($off,$d,$hl,$len)=&parse_line($struct[2]); diff --git a/dev-libs/openssl/openssl-0.9.7d-r2.ebuild b/dev-libs/openssl/openssl-0.9.7d-r2.ebuild new file mode 100644 index 000000000000..7789c3a9188b --- /dev/null +++ b/dev-libs/openssl/openssl-0.9.7d-r2.ebuild @@ -0,0 +1,298 @@ +# Copyright 1999-2004 Gentoo Foundation +# Distributed under the terms of the GNU General Public License v2 +# $Header: /var/cvsroot/gentoo-x86/dev-libs/openssl/openssl-0.9.7d-r2.ebuild,v 1.1 2004/11/05 15:12:13 dragonheart Exp $ + +inherit eutils flag-o-matic gcc + +OLD_096_P="${PN}-0.9.6m" + +DESCRIPTION="Toolkit for SSL v2/v3 and TLS v1" +HOMEPAGE="http://www.openssl.org/" +SRC_URI="mirror://openssl/source/${P}.tar.gz + mirror://openssl/source/${OLD_096_P}.tar.gz" + +LICENSE="as-is" +SLOT="0" +KEYWORDS="x86 ppc ~sparc ~mips ~alpha ~arm ~hppa ~amd64 ~ia64 ~ppc64 ~s390" +IUSE="emacs uclibc" + +RDEPEND="virtual/libc" +DEPEND="${RDEPEND} + sys-apps/diffutils + >=dev-lang/perl-5 + >=sys-apps/sed-4 + !uclibc? ( sys-devel/bc )" + +S=${WORKDIR} + +src_unpack() { + unpack ${A} + + # openssl-0.9.7 + cd ${WORKDIR}/${P} + + epatch ${FILESDIR}/openssl-0.9.7c-tempfile.patch || die "patch failed" + + if [ "${ARCH}" = "ppc64" ]; then + epatch ${FILESDIR}/addppc64support.diff + fi + + epatch ${FILESDIR}/${P}-gentoo.diff + epatch ${FILESDIR}/${P}-smime.patch + + if [ "${ARCH}" = "hppa" ]; then + # Tells to compile a static version of openssl + sed -i -e \ + 's!^"linux-parisc"\(.*\)::BN\(.*\)::!"linux-parisc"\1:-ldl:BN\2::::::::::dlfcn:linux-shared:-fPIC::.so.\\$(SHLIB_MAJOR).\\$(SHLIB_MINOR)!' \ + Configure \ + || die "sed failed" + # Fix detection of parisc running 64 bit kernel + sed -i -e 's/parisc-\*-linux2/parisc\*-\*-linux2/' config \ + || die "sed failed" + fi + if [ "${ARCH}" = "arm" ]; then + # patch linker to add -ldl or things linking aginst libcrypto fail + sed -i -e \ + 's!^"linux-elf-arm"\(.*\)::BN\(.*\)!"linux-elf-arm"\1:-ldl:BN\2!' \ + Configure \ + || die "sed failed" + fi + + if [ "${ARCH}" = "alpha" -a "${CC}" != "ccc" ]; then + # ccc compiled openssl will break things linked against + # a gcc compiled openssl, the configure will automatically detect + # ccc and use it, so stop that if user hasnt asked for it. + sed -i -e \ + 's!CC=ccc!CC=gcc!' config \ + || die "sed failed" + fi + + case $( gcc-version ) in + 3.2 ) + filter-flags -fprefetch-loop-arrays -freduce-all-givs -funroll-loop ;; + 3.4 | 3.3 ) + filter-flags -fprefetch-loop-arrays -freduce-all-givs -funroll-loops + if [ "${ARCH}" = "ppc" -o "${ARCH}" = "ppc64" ]; then + append-flags -fno-strict-aliasing + fi + ;; + esac + + # replace CFLAGS + OLDIFS=$IFS + IFS=" +" + for a in $( grep -n -e "^\"linux-" Configure ); do + LINE=$( echo $a | awk -F: '{print $1}' ) + CUR_CFLAGS=$( echo $a | awk -F: '{print $3}' ) + # for ppc64 I have to be careful given current + # toolchain issues + if [ "${ARCH}" != "ppc64" ]; then + NEW_CFLAGS="$( echo $CUR_CFLAGS | sed -r -e "s|-O[23]||" -e "s/-fomit-frame-pointer//" -e "s/-mcpu=[-a-z0-9]+//" -e "s/-m486//" ) $CFLAGS" + else + NEW_CFLAGS="$( echo $CUR_CFLAGS | sed -r -e "s|-O[23]||" -e "s/-fomit-frame-pointer//" -e "s/-mcpu=[-a-z0-9]+//" -e "s/-m486//" ) " + + fi + + sed -i "${LINE}s/$CUR_CFLAGS/$NEW_CFLAGS/" Configure \ + || die "sed failed" + done + IFS=$OLDIFS + + if [ "$(get_libdir)" != "lib" ] ; then + # using a library directory other than lib requires some magic + sed -i \ + -e "s+\(\$(INSTALL_PREFIX)\$(INSTALLTOP)\)/lib+\1/$(get_libdir)+g" \ + -e "s+libdir=\$\${exec_prefix}/lib+libdir=\$\${exec_prefix}/$(get_libdir)+g" \ + Makefile.org \ + || die "sed failed" + ./config --test-sanity || die + fi + + # openssl-0.9.6 + test -f ${ROOT}/usr/lib/libssl.so.0.9.6 && { + cd ${WORKDIR}/${OLD_096_P} + + epatch ${FILESDIR}/${OLD_096_P}-gentoo.diff + + case ${ARCH} in + mips) + epatch ${FILESDIR}/openssl-0.9.6-mips.diff + ;; + arm) + # patch linker to add -ldl or things linking aginst libcrypto fail + sed -i -e \ + 's!^"linux-elf-arm"\(.*\)::BN\(.*\)!"linux-elf-arm"\1:-ldl:BN\2!' \ + Configure \ + || die "sed failed" + ;; + hppa) + # Tells to compile a static version of openssl + sed -i -e \ + 's!^"linux-parisc"\(.*\)::BN\(.*\)::!"linux-parisc"\1:-ldl:BN\2::::::::::dlfcn:linux-shared:-fPIC::.so.\\$(SHLIB_MAJOR).\\$(SHLIB_MINOR)!' \ + Configure \ + || die "sed failed" + # Fix detection of parisc running 64 bit kernel + sed -i -e 's/parisc-\*-linux2/parisc\*-\*-linux2/' config \ + || die "sed failed" + esac + + # replace CFLAGS + OLDIFS=$IFS + IFS=" +" + for a in $( grep -n -e "^\"linux-" Configure ); do + LINE=$( echo $a | awk -F: '{print $1}' ) + CUR_CFLAGS=$( echo $a | awk -F: '{print $3}' ) + NEW_CFLAGS="$( echo $CUR_CFLAGS | sed -r -e "s|-O[23]||" -e "s/-fomit-frame-pointer//" -e "s/-mcpu=[-a-z0-9]+//" -e "s/-m486//" ) $CFLAGS" + sed -i "${LINE}s/$CUR_CFLAGS/$NEW_CFLAGS/" Configure \ + || die "sed failed" + done + IFS=$OLDIFS + } +} + +src_compile() { + # openssl-0.9.7 + cd ${WORKDIR}/${P} + + # Build correctly for mips, mips64, & mipsel + if use mips; then + if [ "`echo ${CHOST} | grep "mipsel"`" ]; then + mipsarch="linux-mipsel" + else + mipsarch="linux-mips" + fi + + ./Configure ${mipsarch} --prefix=/usr --openssldir=/etc/ssl \ + shared threads || die + # We have to force the target for hppa because detection + # is broken on SMP box + elif [ "`uname -m`" = "parisc" -o "`uname -m`" = "parisc64" ]; then + ./Configure linux-parisc --prefix=/usr --openssldir=/etc/ssl \ + shared threads || die + # force sparcv8 on sparc32 profile + elif [ "$PROFILE_ARCH" = "sparc" ]; then + ./Configure linux-sparcv8 --prefix=/usr --openssldir=/etc/ssl \ + shared threads || die + else + ./config --prefix=/usr --openssldir=/etc/ssl shared threads || die + fi + + einfo "Compiling ${P}" + make all || die + + # openssl-0.9.6 + test -f ${ROOT}/usr/lib/libssl.so.0.9.6 && { + cd ${WORKDIR}/${OLD_096_P} + + # force sparcv8 on sparc32 profile + if [ "$PROFILE_ARCH" = "sparc" ]; then + SSH_TARGET="linux-sparcv8" + elif [ "`uname -m`" = "parisc" -o "`uname -m`" = "parisc64" ]; then + SSH_TARGET="linux-parisc" + elif use mips; then + if [ "`echo ${CHOST} | grep "mipsel"`" ]; then + SSH_TARGET="linux-mipsel" + else + SSH_TARGET="linux-mips" + fi + fi + + case ${CHOST} in + alphaev56*|alphaev6*) + SSH_TARGET="linux-alpha+bwx-${CC:-gcc}" + ;; + alpha*) + SSH_TARGET="linux-alpha-${CC:-gcc}" ;; + esac + + if [ ${SSH_TARGET} ]; then + einfo "Forcing ${SSH_TARGET} compile" + ./Configure ${SSH_TARGET} --prefix=/usr \ + --openssldir=/etc/ssl shared threads || die + else + ./config --prefix=/usr --openssldir=/etc/ssl shared threads || die + fi + + einfo "Compiling ${OLD_096_P}" + make all || die + } +} + +src_test() { + cd ${WORKDIR}/${P} + make test || die + + # openssl-0.9.6 + test -f ${ROOT}/usr/lib/libssl.so.0.9.6 && { + cd ${WORKDIR}/${OLD_096_P} + make all || die + } +} + +src_install() { + # openssl-0.9.7 + cd ${WORKDIR}/${P} + make INSTALL_PREFIX=${D} MANDIR=/usr/share/man install || die + dodoc CHANGES* FAQ LICENSE NEWS README + dodoc doc/*.txt + dohtml doc/* + insinto /usr/share/emacs/site-lisp + doins doc/c-indentation.el + + if use emacs ; then + insinto /usr/share/emacs/site-lisp + doins doc/c-indentation.el + fi + + # create the certs directory. Previous openssl builds + # would need to create /usr/lib/ssl/certs but this looks + # to be the more FHS compliant setup... -raker + insinto /etc/ssl/certs + doins certs/*.pem + OPENSSL=${D}/usr/bin/openssl /usr/bin/perl tools/c_rehash ${D}/etc/ssl/certs + + # The man pages rand.3 and passwd.1 conflict with other packages + # Rename them to ssl-* and also make a symlink from openssl-* to ssl-* + cd ${D}/usr/share/man/man1 + mv passwd.1 ssl-passwd.1 + ln -sf ssl-passwd.1 openssl-passwd.1 + cd ${D}/usr/share/man/man3 + mv rand.3 ssl-rand.3 + ln -sf ssl-rand.3 openssl-rand.3 + + # openssl-0.9.6 + test -f ${ROOT}/usr/lib/libssl.so.0.9.6 && { + cd ${WORKDIR}/${OLD_096_P} + make || die + dolib.so ${WORKDIR}/${OLD_096_P}/libcrypto.so.0.9.6||die "libcrypto.so.0.9.6 not found" + dolib.so ${WORKDIR}/${OLD_096_P}/libssl.so.0.9.6|| die "libssl.so.0.9.6 not found" + } + fperms a+x /usr/$(get_libdir)/pkgconfig #34088 +} + +pkg_postinst() { + local BN_H="${ROOT}$(gcc-config -L)/include/openssl/bn.h" + # Breaks things one some boxen, bug #13795. The problem is that + # if we have a 'gcc fixed' version in $(gcc-config -L) from 0.9.6, + # then breaks as it was defined as 'int BN_mod(...)' and in 0.9.7 it + # is a define with BN_div(...) - (24 Sep 2003) + if [ -f "${BN_H}" ] && [ -n "$(grep '^int[[:space:]]*BN_mod(' "${BN_H}")" ] + then + rm -f "${BN_H}" + fi + + test -f ${ROOT}/usr/lib/libssl.so.0.9.6 && { + einfo "You can now re-compile all packages that are linked against" + einfo "OpenSSL 0.9.6 by using revdep-rebuild from gentoolkit:" + einfo "# revdep-rebuild --soname libssl.so.0.9.6" + einfo "# revdep-rebuild --soname libcrypto.so.0.9.6" + einfo "After this, you can delete /usr/lib/libssl.so.0.9.6 and /usr/lib/libcrypto.so.0.9.6" + } + + + ewarn "If you do not etc-update now and update /etc/ssl/misc/der_chop to the new version, your" + ewarn "system IS VULNERABLE to a symlink attack as described in bug 68407" + ewarn "refer to http://bugs.gentoo.org/show_bug.cgi?id=68407 if you have any doubts" +} -- 2.26.2