uyuni/boringssl
SHA256
8
0
Fork 0
forked from pool/boringssl
Code Issues Pull Requests Activity

Accepting request 809901 from home:mrostecki:branches:security:tls

Browse Source 
- Remove patch for enabling shared linking - it was enabled
  upstream.
  * 0001-add-soversion-option.patch
- Add boringssl-source subpackage.

- Update to version 20200122:
  * Define EVP compatibility constants for X448 and Ed448.
  * Allow shared libraries in the external CMake build.
  * Add a few little-endian functions to CBS/CBB.
  * Move iOS asm tricks up in external CMake build.
  * Try again to deal with expensive tests.
  * Restore ARM CPU variation tests on builders.
  * Remove SSL_CTX_set_rsa_pss_rsae_certs_enabled.
  * Work around another NULL/0 C language bug.
  * Use the MAYBE/DISABLED pattern in RSATest.BlindingCacheConcurrency.
  * Switch an #if-0-gated test to DISABLED_Foo.
  * Proxy: send whole SSL records through the handshaker.
  * Disable Wycheproof primality test cases on non-x86 (too slow)
  * test_state.cc: serialize the test clock.
  * Output after every Wycheproof primality test.
  * Maybe fix generated-CMake build on Android and iOS.
  * Detect the NDK path from CMAKE_TOOLCHAIN_FILE.
  * Tell Go to build for GOOS=android when running on Android.
  * Reland bitsliced aes_nohw implementation.
  * Add bssl client option to load a hashed directory of cacerts.
  * No-op change to run the new NO_SSE2 builders.
  * Clarify that we perform the point-on-curve check.
  * Reduce size of BlindingCacheConcurrency test under TSAN.
  * Compare vpaes/bsaes conversions against a reference implementation.
  * Enable the SSE2 Poly1305 implementation on clang-cl.

OBS-URL: https://build.opensuse.org/request/show/809901
OBS-URL: https://build.opensuse.org/package/show/security:tls/boringssl?expand=0&rev=30
This commit is contained in:
Michał Rostecki
2020-05-28 10:24:38 +00:00
committed by Git OBS Bridge
parent be0ff33ecb
commit af197498c9
11 changed files with 312 additions and 242 deletions
Download Patch File Download Diff File Expand all files Collapse all files
boringssl.changes
+225
View File
@@ -1,3 +1,228 @@
-------------------------------------------------------------------
Wed May 27 18:40:47 UTC 2020 - Michał Rostecki <mrostecki@suse.com>
- Remove patch for enabling shared linking - it was enabled
upstream.
* 0001-add-soversion-option.patch
- Add boringssl-source subpackage.
-------------------------------------------------------------------
Wed May 27 14:18:19 UTC 2020 - mrostecki@suse.com
- Update to version 20200122:
* Define EVP compatibility constants for X448 and Ed448.
* Allow shared libraries in the external CMake build.
* Add a few little-endian functions to CBS/CBB.
* Move iOS asm tricks up in external CMake build.
* Try again to deal with expensive tests.
* Restore ARM CPU variation tests on builders.
* Remove SSL_CTX_set_rsa_pss_rsae_certs_enabled.
* Work around another NULL/0 C language bug.
* Use the MAYBE/DISABLED pattern in RSATest.BlindingCacheConcurrency.
* Switch an #if-0-gated test to DISABLED_Foo.
* Proxy: send whole SSL records through the handshaker.
* Disable Wycheproof primality test cases on non-x86 (too slow)
* test_state.cc: serialize the test clock.
* Output after every Wycheproof primality test.
* Maybe fix generated-CMake build on Android and iOS.
* Detect the NDK path from CMAKE_TOOLCHAIN_FILE.
* Tell Go to build for GOOS=android when running on Android.
* Reland bitsliced aes_nohw implementation.
* Add bssl client option to load a hashed directory of cacerts.
* No-op change to run the new NO_SSE2 builders.
* Clarify that we perform the point-on-curve check.
* Reduce size of BlindingCacheConcurrency test under TSAN.
* Compare vpaes/bsaes conversions against a reference implementation.
* Enable the SSE2 Poly1305 implementation on clang-cl.
* Remove alignment requirement on CRYPTO_poly1305_finish.
* Fix double-free under load.
* Add some XTS tests.
* Add EncodeHex and DecodeHex functions to test_util.h.
* Revert "Replace aes_nohw with a bitsliced implementation."
* Replace aes_nohw with a bitsliced implementation.
* Switch HRSS inversion algorithm.
* Run EVP_CIPHER tests in-place.
* Add an option to disable SSE2 intrinsics for testing.
* Dummy change to trigger master-with-bazel builder.
* Drop use of alignas(64) in aead_test.cc
* Add standalone CMake build to generate_build_files.py
* TLS 1.3 split handshake initial support.
* Import Wycheproof primality tests.
* Split BN_prime_checks into two constants for generation and validation.
* Add some Miller-Rabin tests from Wycheproof.
* Import Wycheproof PKCS#1 decrypt tests.
* Import Wycheproof OAEP tests.
* Import Wycheproof PKCS#1 signing tests.
* Skip JWK keys when converting Wycheproof tests.
* Import Wycheproof's size-specific RSA PKCS#1 verifying tests.
* Handle "acceptable" Wycheproof inputs unambiguously.
* Import Wycheproof XChaCha20-Poly1305 tests.
* Import Wycheproof HMAC tests.
* Import Wycheproof HKDF tests.
* bytestring: add methods for int64.
* Update Wycheproof test vectors.
* Add mock QUIC transport to runner
* Add test vectors for CVE-2019-1551 (not affected).
* Fix check_bn_tests.go.
* Fix MSan error in SSLTest.Handoff test.
* SSLTest.Handoff: extend to include a session resumption.
* inject_hash preserves filemode
* Move TLS 1.3 state machine constants to internal.h.
* Add a ppc64le ABI tester.
* Allocate small TLS read buffers inline.
* Remove unused labels from ARM ABI test assembly.
* Update AAPCS and AAPCS64 links.
* Fix EVP_has_aes_hardware on ppc64le.
* Remove remnants of end_of_early_data alert from tests.
* Add a test for ERR_error_string_n.
* Remove post-quantum experiment signal extension.
* Give ERR_error_string_n a return value for convenience.
* Defer early keys to QUIC clients to after certificate reverification.
* Defer releasing early secrets to QUIC servers.
* Halve the size of the kNIDsIn* constants
* modulewrapper: manage buffer with |unique_ptr|.
* Add missing boringssl_prefix_symbols_asm.h include.
* acvptool: add support for ECDSA
* Inline gcm_init_4bit into gcm_init_ssse3.
* Vectorize gcm_mul32_nohw and replace gcm_gmult_4bit_mmx.
* Add a constant-time fallback GHASH implementation.
* Conditionally define PTRACE_O_EXITKILL in urandom_test.cc
* Fix build warning if _SCL_SECURE_NO_WARNINGS is defined globally
* modulewrapper: use a raw string.
* acvptool: add license headers.
* Enable TLS 1.3 by default.
* acvptool: Add support for DRBG
* Discard user_canceled alerts in TLS 1.3.
* Work around more C language bugs with empty spans.
* No-op commit to test the new builder.
* acvptool: Add support for HMAC
* Add stub functions for RSA-PSS keygen parameters.
* HelloRetryRequest getter
* Add break-tests-android.sh script.
* Add compatibility functions for sigalgs
* Run AES-192-GCM in CAVP tests.
* Rename a number of BUF_* functions to OPENSSL_*.
* List bn_div fuzzer in documentation.
* Reenable bn_div fuzzer.
* Drop CECPQ2b code.
* Add urandom_test to all_tests.json
* Fix the standalone Android FIPS build.
* Add sanity checks to FIPS module construction.
* Correct relative path.
* Add test for urandom.c
* break-hash.go: Search ELF dynamic symbols if symbols not found.
* Fix $OPENSSL_ia32cap handling.
* Switch probable_prime to rejection sampling.
* Rename the last remnants of the early_data_info extension.
* Fix up BN_GENCB_call calls.
* Do fewer trial divisions for larger RSA keygens.
* Fix GRND_NONBLOCK flag when calling getrandom.
* Simplify bn_miller_rabin_iteration slightly.
* Add some notes on RSA key generation performance.
* Break early on composites in the primality test.
* Extract and test the deterministic part of Miller-Rabin.
* Fix the FIPS + fuzzing build.
* FIPS.md: document some recent Android changes.
* Add a function to derive an EC key from some input secret.
* Fix run_android_tests.go with shared library builds.
* No-op change to test new builders.
* Move no-exec-stack sections outside of #ifs.
* Add |SSL_get_min_proto_version| and |SSL_get_max_proto_version|
* Make FIPS build work for Android cross-compile.
* Enable optional GRND_RANDOM flag to be passed to getrandom on Android.
* Switch cert_compression_algs to GrowableArray.
* Add GrowableArray<T> to ssl/internal.h.
* Fixed quic_method lookup in TLS 1.3 server side handshake.
* Add .note.GNU-stack at the source level.
* -Wno-vla -> -Wvla
* Add an option for explicit renegotiations.
* tool: add -json flag to |speed|
* Set -Wno-vla.
* Use a pointer to module_hash in boringssl_fips_self_test() args.
* Use a smaller hex digest in FIPS flag files when SHA-256 used.
* Switch to using SHA-256 for FIPS integrity check on Android.
* Use getentropy on macOS 10.12 and later.
* Move #include of "internal.h", which defines |OPENSSL_URANDOM|.
* Style nit.
* Assert that BN_CTX_end is actually called.
* Test some known large primes.
* Test some Euler pseudoprimes.
* Be consistent about Miller-Rabin vs Rabin-Miller.
* fix build with armv6 Error: .size expression for _vpaes_decrypt_consts does not evaluate to a constant
* Mark ssl_early_data_reason_t values stable.
* Make the dispatch tests opt-in.
* Bound the number of API calls in ssl_ctx_api.cc.
* Only attempt to mprotect FIPS module for AArch64.
* Opportunistically read entropy from the OS in FIPS mode.
* Update INSTANTIATE_TEST_SUITE_P calls missing first argument.
* Ignore build32 and build64 subdirectories.
* Add page protection logic to BCM self test.
* Disable unwind tests in FIPS mode.
* Disable RDRAND on AMD family 0x17, models 0x70–0x7f.
* Don't allow SGC EKUs for server certificates.
* Add |SSL_CIPHER_get_value| to get the IANA number of a cipher suite.
* Add XOF compilation compatibility flags
* Replace BIO_printf with ASN1_STRING_print in GENERAL_NAME_print
* Trigger a build on the ARM mode builder.
* Fix vpaes-armv7.pl in ARM mode.
* Add AES-192-GCM support to EVP_AEAD.
* Add AES-256 CFB to libdecrepit.
* Parse explicit EC curves more strictly.
* Use the Go 1.13 standard library ed25519.
* Update build tools.
* Use ScopedEVP_AEAD_CTX in ImplDispatchTest.AEAD_AES_GCM.
* Use a mix of bsaes and vpaes for CTR on NEON.
* Use vpaes + conversion to setup CBC decrypt on NEON.
* Add NEON vpaes-to-bsaes key converters.
* Add vpaes-armv7.pl and replace non-parallel modes.
* Correct comments for x86_64 _vpaes_encrypt_core_2x.
* Add benchmarks for AES block operations.
* Only write self test flag files if an environment variable is set.
* Const-correct EC_KEY_set_public_key_affine_coordinates.
* Revert "Fix VS build when assembler is enabled"
* Support compilation via emscripten
* Fix cross-compile of Android on Windows.
* Move the config->async check into RetryAsync.
* Clear *out in ReadHandshakeData's empty case.
* Add initial support for 0-RTT with QUIC.
* Have some more fun with spans.
* Add OPENSSL_FALLTHROUGH to a few files.
* Limit __attribute__ ((fallthrough)) to Clang >= 5.
* Make |EVP_CIPHER_CTX_reset| return one.
* Add Fallthru support for clang 10.
* Add self-test suppression flag file for Android FIPS builds.
* Align 0-RTT and resumption state machines slightly
* Require getrandom in Android FIPS builds.
* acvp: allow passing custom subprocess I/O.
* Add a function to convert SSL_ERROR_* values to strings.
* Fold SSL_want constants into SSL_get_error constants.
* Use spans for the various TLS 1.3 secrets.
* Switch another low-level function to spans.
* Switch tls13_enc.cc to spans.
* Check the second ClientHello's PSK binder on resumption.
* Introduce libcrypto_bcm_sources for Android.
* Remove stale TODO.
* Add an android-cmake option to generate_build_files.py
* Add a QUIC test for HelloRetryRequest.
* Add missing ".text" to Windows code for dummy_chacha20_poly1305_asm
* Update TODO to note that Clang git doesn't have the POWER bug.
* Fix paths in break-tests.sh.
* Fix POWER build with OPENSSL_NO_ASM.
* Workaround Clang bug on POWER.
* Add assembly support for -fsanitize=hwaddress tagged globals.
* Fix typo in valgrind constant-time annotations.
* acvp: add support for AES-ECB and AES-CBC.
* Fix misspelled TODO.
* Move CCM fragments out of the FIPS module.
* Add EVP_PKEY_base_id.
* Add some project links to README.md.
* Make alert_dispatch into a bool.
* Trim some more per-connection memory.
* Remove SSL_export_early_keying_material.
* Add EVP_PKEY support for X25519.
* Make EVP_PKEY_bits return 253 for Ed25519.
* Make SSL_get_servername work in the early callback.
-------------------------------------------------------------------
Tue Mar 10 20:00:43 UTC 2020 - Guillaume GARDET <guillaume.gardet@opensuse.org>
boringssl.spec
+50 -32
View File
@@ -18,23 +18,26 @@
%define sover 1
%define libname libboringssl%{sover}
%define src_install_dir /usr/src/%{name}
Name: boringssl
Version: 20190916
Version: 20200122
Release: 0
Summary: An SSL/TLS protocol implementation
License: OpenSSL
Group: Development/Sources
URL: https://boringssl.googlesource.com/boringssl/
Source: %{name}-%{version}.tar.xz
Patch1: 0001-add-soversion-option.patch
Patch2: 0002-crypto-Fix-aead_test-build-on-aarch64.patch
Patch3: 0003-enable-s390x-builds.patch
Patch4: 0004-fix-alignment-for-ppc64le.patch
Patch5: 0005-fix-alignment-for-arm.patch
Patch0: 0002-crypto-Fix-aead_test-build-on-aarch64.patch
Patch1: 0003-enable-s390x-builds.patch
Patch2: 0004-fix-alignment-for-ppc64le.patch
Patch3: 0005-fix-alignment-for-arm.patch
BuildRequires: cmake >= 3.0
BuildRequires: fdupes
BuildRequires: gcc-c++
BuildRequires: go
BuildRequires: libunwind-devel
BuildRequires: ninja
BuildRequires: patchelf
ExclusiveArch: %{ix86} x86_64 aarch64 s390x ppc64le %arm
%description
@@ -43,6 +46,7 @@ Transport Layer Security (TLS) protocols, derived from OpenSSL.
%package -n %{libname}
Summary: An SSL/TLS protocol implementation
Group: Development/Sources
Recommends: ca-certificates-mozilla
%description -n %{libname}
@@ -51,6 +55,7 @@ Transport Layer Security (TLS) protocols, derived from OpenSSL.
%package devel
Summary: Development files for BoringSSL
Group: Development/Sources
Requires: %{libname} = %{version}
%description devel
@@ -58,57 +63,70 @@ Development files for BoringSSL - an implementation of the Secure
Sockets Layer (SSL) and Transport Layer Security (TLS) protocols,
derived from OpenSSL.
%package source
Summary: Source code of BoringSSL
Group: Development/Sources
BuildArch: noarch
%description source
Source files for BoringSSL implementation
%prep
%setup -q
%patch1 -p1
%patch2 -p1
%patch3 -p1
%patch4 -p1
%patch5 -p1
%autosetup -p1
%build
%define _lto_cflags %{nil}
%define __builder ninja
%cmake \
-DCMAKE_C_FLAGS="%{optflags} -pthread" \
-DCMAKE_CXX_FLAGS="%{optflags} -pthread" \
-DSOVERSION=%{sover}
-DCMAKE_SHARED_LINKER_FLAGS="%{?build_ldflags} -Wl,--as-needed -Wl,-z,now"
%cmake_build
%install
install -D -m0755 build/crypto/libcrypto.so.%{sover} %{buildroot}%{_libdir}/libboringssl_crypto.so.%{sover}
install -D -m0755 build/crypto/libcrypto.so %{buildroot}%{_libdir}/libboringssl_crypto.so
install -D -m0755 build/ssl/libssl.so.%{sover} %{buildroot}%{_libdir}/libboringssl_ssl.so.%{sover}
install -D -m0755 build/ssl/libssl.so %{buildroot}%{_libdir}/libboringssl_ssl.so
install -D -m0755 build/decrepit/libdecrepit.so.%{sover} %{buildroot}%{_libdir}/libboringssl_decrepit.so.%{sover}
install -D -m0755 build/decrepit/libdecrepit.so %{buildroot}%{_libdir}/libboringssl_decrepit.so
install -D -m0755 build/libboringssl_gtest.so.%{sover} %{buildroot}%{_libdir}/libboringssl_gtest.so.%{sover}
install -D -m0755 build/libboringssl_gtest.so %{buildroot}%{_libdir}/libboringssl_gtest.so
# Install libraries
install -D -m0755 build/libcrypto.so %{buildroot}%{_libdir}/libboringssl_crypto.so.%{sover}
install -D -m0755 build/libssl.so %{buildroot}%{_libdir}/libboringssl_ssl.so.%{sover}
# Add SOVER to SONAME fields in libraries
patchelf --set-soname libboringssl_crypto.so.%{sover} %{buildroot}%{_libdir}/libboringssl_crypto.so.%{sover}
patchelf --set-soname libboringssl_ssl.so.%{sover} %{buildroot}%{_libdir}/libboringssl_ssl.so.%{sover}
# Create links from *.so to *.so.SOVER
ln -sf libboringssl_crypto.so.%{sover} %{buildroot}%{_libdir}/libboringssl_crypto.so
ln -sf libboringssl_ssl.so.%{sover} %{buildroot}%{_libdir}/libboringssl_ssl.so
# Install sources
rm -rf build/
mkdir -p %{buildroot}%{src_install_dir}
cp -r * %{buildroot}%{src_install_dir}
%fdupes %{buildroot}%{src_install_dir}
# Fix arch-independent-package-contains-binary-or-object
find %{buildroot}%{src_install_dir} -type f \( -name "*.a" -o -name "*.lib" -o -name "*.o" \) -exec rm -f "{}" +
# Fix non-executable-script warning.
find %{buildroot}%{src_install_dir} -type f -name "*.sh" -exec chmod +x "{}" +
# Fix env-script-interpreter error.
find %{buildroot}%{src_install_dir} -type f -name "*.pl" -exec sed -i 's|#!.*/usr/bin/env perl|#!/usr/bin/perl|' "{}" +
find %{buildroot}%{src_install_dir} -type f -name "*.py" -exec sed -i 's|#!.*/usr/bin/env python.*|#!/usr/bin/python3|' "{}" +
find %{buildroot}%{src_install_dir} -type f -name "*.sh" -exec sed -i 's|#!.*/usr/bin/env bash|#!/bin/bash|' "{}" +
# To avoid conflicts with openssl development files, change all includes from
# openssl to boringssl.
# BoringSSL headers provided by this pachage are installed in
# /usr/include/boringssl for the same reason.
find include/openssl -type f -exec sed -i 's/openssl/boringssl/' "{}" +
find src/include/openssl -type f -exec sed -i 's/openssl/boringssl/' "{}" +
find include/openssl -type f -execdir install -D -m0644 "{}" "%{buildroot}%{_includedir}/boringssl/{}" \;
find src/include/openssl -type f -execdir install -D -m0644 "{}" "%{buildroot}%{_includedir}/boringssl/{}" \;
%post -n %{libname} -p /sbin/ldconfig
%postun -n %{libname} -p /sbin/ldconfig
%files -n %{libname}
%doc README.md
%doc src/README.md
%license LICENSE
%{_libdir}/libboringssl_crypto.so.%{sover}
%{_libdir}/libboringssl_ssl.so.%{sover}
%{_libdir}/libboringssl_decrepit.so.%{sover}
%{_libdir}/libboringssl_gtest.so.%{sover}
%files devel
%{_includedir}/boringssl
%{_libdir}/libboringssl_crypto.so
%{_libdir}/libboringssl_ssl.so
%{_libdir}/libboringssl_decrepit.so
%{_libdir}/libboringssl_gtest.so
%files source
%{src_install_dir}
%changelog
_service
+1 -1
View File
@@ -5,7 +5,7 @@
<param name="changesgenerate">enable</param>
<param name="filename">boringssl</param>
<param name="versionformat">%cd</param>
<param name="revision">chromium-stable</param>
<param name="revision">1c2769383f027befac5b75b6cedd25daf3bf4dcf</param>
</service>
<service mode="disabled" name="recompress">
<param name="file">*.tar</param>
_servicedata
+1 -1
View File
@@ -1,4 +1,4 @@
<servicedata>
<service name="tar_scm">
<param name="url">https://boringssl.googlesource.com/boringssl</param>
<param name="changesrevision">6f3e034fe58ce3bca3c1c32be6d603a6206c89af</param></service></servicedata>
<param name="changesrevision">1c2769383f027befac5b75b6cedd25daf3bf4dcf</param></service></servicedata>
0001-add-soversion-option.patch
-110
View File
@@ -1,110 +0,0 @@
From e23b950bc30e196937861b7b167a5f520c8b2118 Mon Sep 17 00:00:00 2001
From: Michal Rostecki <mrostecki@suse.de>
Date: Tue, 6 Nov 2018 20:29:25 +0100
Subject: [PATCH] cmake: Add SOVERSION option
The SOVERSION option allows to version the shared library. Version
defined there is 0 and the versioned library files have extension
`so.0`. Optional soversion is helpful for packaging and making a
difference between `lib*` package (which contains `.so.0` file)
and `*-devel` package (which contains `.so` file).
Change-Id: If52a0657de0f524a2c40cb51a6e9c36aac87024d
---
BUILDING.md | 3 +++
CMakeLists.txt | 8 ++++++++
crypto/CMakeLists.txt | 6 ++++++
decrepit/CMakeLists.txt | 6 ++++++
ssl/CMakeLists.txt | 6 ++++++
5 files changed, 29 insertions(+)
Index: boringssl-20190916/BUILDING.md
===================================================================
--- boringssl-20190916.orig/BUILDING.md
+++ boringssl-20190916/BUILDING.md
@@ -78,6 +78,9 @@ Windows, where functions need to be tagg
shared library, define `BORINGSSL_SHARED_LIBRARY` in any code which `#include`s
the BoringSSL headers.
+If you want to build a shared library with versioned `.so` files (`.so.0`), pass
+`-DSOVERSION=1`.
+
In order to serve environments where code-size is important as well as those
where performance is the overriding concern, `OPENSSL_SMALL` can be defined to
remove some code that is especially large.
Index: boringssl-20190916/CMakeLists.txt
===================================================================
--- boringssl-20190916.orig/CMakeLists.txt
+++ boringssl-20190916/CMakeLists.txt
@@ -1,5 +1,7 @@
cmake_minimum_required(VERSION 3.0)
+set(boringssl_SOVERSION 1)
+
# Defer enabling C and CXX languages.
project(BoringSSL NONE)
@@ -536,6 +538,12 @@ endif()
# Add minimal googletest targets. The provided one has many side-effects, and
# googletest has a very straightforward build.
add_library(boringssl_gtest third_party/googletest/src/gtest-all.cc)
+if(BUILD_SHARED_LIBS AND SOVERSION)
+ set_target_properties(
+ boringssl_gtest PROPERTIES
+ SOVERSION ${boringssl_SOVERSION}
+ )
+endif()
target_include_directories(boringssl_gtest PRIVATE third_party/googletest)
include_directories(third_party/googletest/include)
Index: boringssl-20190916/crypto/CMakeLists.txt
===================================================================
--- boringssl-20190916.orig/crypto/CMakeLists.txt
+++ boringssl-20190916/crypto/CMakeLists.txt
@@ -420,6 +420,12 @@ add_library(
${CRYPTO_ARCH_SOURCES}
${CRYPTO_FIPS_OBJECTS}
)
+if(BUILD_SHARED_LIBS AND SOVERSION)
+ set_target_properties(
+ crypto PROPERTIES
+ SOVERSION ${boringssl_SOVERSION}
+ )
+endif()
if(FIPS_SHARED)
# Rewrite libcrypto.so to inject the correct module hash value. This assumes
Index: boringssl-20190916/decrepit/CMakeLists.txt
===================================================================
--- boringssl-20190916.orig/decrepit/CMakeLists.txt
+++ boringssl-20190916/decrepit/CMakeLists.txt
@@ -21,6 +21,12 @@ add_library(
x509/x509_decrepit.c
xts/xts.c
)
+if(BUILD_SHARED_LIBS AND SOVERSION)
+ set_target_properties(
+ decrepit PROPERTIES
+ SOVERSION ${boringssl_SOVERSION}
+ )
+endif()
add_dependencies(decrepit global_target)
Index: boringssl-20190916/ssl/CMakeLists.txt
===================================================================
--- boringssl-20190916.orig/ssl/CMakeLists.txt
+++ boringssl-20190916/ssl/CMakeLists.txt
@@ -40,6 +40,12 @@ add_library(
tls13_enc.cc
tls13_server.cc
)
+if(BUILD_SHARED_LIBS AND SOVERSION)
+ set_target_properties(
+ ssl PROPERTIES
+ SOVERSION ${boringssl_SOVERSION}
+ )
+endif()
add_dependencies(ssl global_target)
0002-crypto-Fix-aead_test-build-on-aarch64.patch
+4 -46
View File
@@ -27,13 +27,13 @@ aead_test.cc:586:50: error: requested alignment 64 is larger than 16 [-Werror=at
Signed-off-by: Michal Rostecki <mrostecki@opensuse.org>
Change-Id: Iac2c6810fa260ad214abde8db733793ac914acda
---
crypto/cipher_extra/aead_test.cc | 20 +++++++++++++-------
src/crypto/cipher_extra/aead_test.cc | 20 +++++++++++++-------
1 file changed, 13 insertions(+), 7 deletions(-)
Index: boringssl-20190523/crypto/cipher_extra/aead_test.cc
Index: boringssl-20200122/src/crypto/cipher_extra/aead_test.cc
===================================================================
--- boringssl-20190523.orig/crypto/cipher_extra/aead_test.cc
+++ boringssl-20190523/crypto/cipher_extra/aead_test.cc
--- boringssl-20200122.orig/src/crypto/cipher_extra/aead_test.cc
+++ boringssl-20200122/src/crypto/cipher_extra/aead_test.cc
@@ -29,6 +29,12 @@
#include "../test/test_util.h"
#include "../test/wycheproof_util.h"
@@ -47,45 +47,3 @@ Index: boringssl-20190523/crypto/cipher_extra/aead_test.cc
struct KnownAEAD {
const char name[40];
@@ -540,10 +546,10 @@ TEST_P(PerAEADTest, AliasedBuffers) {
}
TEST_P(PerAEADTest, UnalignedInput) {
- alignas(64) uint8_t key[EVP_AEAD_MAX_KEY_LENGTH + 1];
- alignas(64) uint8_t nonce[EVP_AEAD_MAX_NONCE_LENGTH + 1];
- alignas(64) uint8_t plaintext[32 + 1];
- alignas(64) uint8_t ad[32 + 1];
+ alignas(ALIGN_BYTES) uint8_t key[EVP_AEAD_MAX_KEY_LENGTH + 1];
+ alignas(ALIGN_BYTES) uint8_t nonce[EVP_AEAD_MAX_NONCE_LENGTH + 1];
+ alignas(ALIGN_BYTES) uint8_t plaintext[32 + 1];
+ alignas(ALIGN_BYTES) uint8_t ad[32 + 1];
OPENSSL_memset(key, 'K', sizeof(key));
OPENSSL_memset(nonce, 'N', sizeof(nonce));
OPENSSL_memset(plaintext, 'P', sizeof(plaintext));
@@ -561,7 +567,7 @@ TEST_P(PerAEADTest, UnalignedInput) {
ASSERT_TRUE(EVP_AEAD_CTX_init_with_direction(
ctx.get(), aead(), key + 1, key_len, EVP_AEAD_DEFAULT_TAG_LENGTH,
evp_aead_seal));
- alignas(64) uint8_t ciphertext[sizeof(plaintext) + EVP_AEAD_MAX_OVERHEAD];
+ alignas(ALIGN_BYTES) uint8_t ciphertext[sizeof(plaintext) + EVP_AEAD_MAX_OVERHEAD];
size_t ciphertext_len;
ASSERT_TRUE(EVP_AEAD_CTX_seal(ctx.get(), ciphertext + 1, &ciphertext_len,
sizeof(ciphertext) - 1, nonce + 1, nonce_len,
@@ -569,7 +575,7 @@ TEST_P(PerAEADTest, UnalignedInput) {
ad_len));
// It must successfully decrypt.
- alignas(64) uint8_t out[sizeof(ciphertext)];
+ alignas(ALIGN_BYTES) uint8_t out[sizeof(ciphertext)];
ctx.Reset();
ASSERT_TRUE(EVP_AEAD_CTX_init_with_direction(
ctx.get(), aead(), key + 1, key_len, EVP_AEAD_DEFAULT_TAG_LENGTH,
@@ -583,7 +589,7 @@ TEST_P(PerAEADTest, UnalignedInput) {
}
TEST_P(PerAEADTest, Overflow) {
- alignas(64) uint8_t key[EVP_AEAD_MAX_KEY_LENGTH];
+ alignas(ALIGN_BYTES) uint8_t key[EVP_AEAD_MAX_KEY_LENGTH];
OPENSSL_memset(key, 'K', sizeof(key));
bssl::ScopedEVP_AEAD_CTX ctx;
0003-enable-s390x-builds.patch
+21 -42
View File
@@ -7,17 +7,17 @@ similar to the aarch64 patch, covering
- recognition of architecture
- adapting memory alignment
---
CMakeLists.txt | 2 ++
crypto/cipher_extra/aead_test.cc | 2 ++
crypto/poly1305/poly1305_test.cc | 9 +++++++--
include/openssl/base.h | 3 +++
CMakeLists.txt | 2 ++
src/crypto/cipher_extra/aead_test.cc | 2 ++
src/crypto/poly1305/poly1305_test.cc | 9 +++++++--
src/include/openssl/base.h | 3 +++
4 files changed, 14 insertions(+), 2 deletions(-)
diff --git a/CMakeLists.txt b/CMakeLists.txt
index c06b700e5144..80c9383b9af8 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -469,6 +469,8 @@ elseif(${CMAKE_SYSTEM_PROCESSOR} STREQUAL "mips")
Index: boringssl-20200122/CMakeLists.txt
===================================================================
--- boringssl-20200122.orig/CMakeLists.txt
+++ boringssl-20200122/CMakeLists.txt
@@ -93,6 +93,8 @@ elseif(${CMAKE_SYSTEM_PROCESSOR} STREQUA
set(ARCH "generic")
elseif(${CMAKE_SYSTEM_PROCESSOR} STREQUAL "ppc64le")
set(ARCH "ppc64le")
@@ -26,10 +26,10 @@ index c06b700e5144..80c9383b9af8 100644
else()
message(FATAL_ERROR "Unknown processor:" ${CMAKE_SYSTEM_PROCESSOR})
endif()
diff --git a/crypto/cipher_extra/aead_test.cc b/crypto/cipher_extra/aead_test.cc
index fd20ebc77b67..4c079e843321 100644
--- a/crypto/cipher_extra/aead_test.cc
+++ b/crypto/cipher_extra/aead_test.cc
Index: boringssl-20200122/src/crypto/cipher_extra/aead_test.cc
===================================================================
--- boringssl-20200122.orig/src/crypto/cipher_extra/aead_test.cc
+++ boringssl-20200122/src/crypto/cipher_extra/aead_test.cc
@@ -31,6 +31,8 @@
#if defined(OPENSSL_AARCH64)
@@ -39,10 +39,10 @@ index fd20ebc77b67..4c079e843321 100644
#else
#define ALIGN_BYTES 64
#endif
diff --git a/crypto/poly1305/poly1305_test.cc b/crypto/poly1305/poly1305_test.cc
index 198cca12dae5..43cd95c8eb86 100644
--- a/crypto/poly1305/poly1305_test.cc
+++ b/crypto/poly1305/poly1305_test.cc
Index: boringssl-20200122/src/crypto/poly1305/poly1305_test.cc
===================================================================
--- boringssl-20200122.orig/src/crypto/poly1305/poly1305_test.cc
+++ boringssl-20200122/src/crypto/poly1305/poly1305_test.cc
@@ -25,6 +25,11 @@
#include "../test/file_test.h"
#include "../test/test_util.h"
@@ -55,28 +55,10 @@ index 198cca12dae5..43cd95c8eb86 100644
static void TestSIMD(unsigned excess, const std::vector<uint8_t> &key,
const std::vector<uint8_t> &in,
@@ -63,7 +68,7 @@ static void TestSIMD(unsigned excess, const std::vector<uint8_t> &key,
CRYPTO_poly1305_update(&state, in.data() + done, in.size() - done);
// |CRYPTO_poly1305_finish| requires a 16-byte-aligned output.
- alignas(16) uint8_t out[16];
+ alignas(ALIGN_BYTES) uint8_t out[16];
CRYPTO_poly1305_finish(&state, out);
EXPECT_EQ(Bytes(out), Bytes(mac)) << "SIMD pattern " << excess << " failed.";
}
@@ -82,7 +87,7 @@ TEST(Poly1305Test, TestVectors) {
CRYPTO_poly1305_init(&state, key.data());
CRYPTO_poly1305_update(&state, in.data(), in.size());
// |CRYPTO_poly1305_finish| requires a 16-byte-aligned output.
- alignas(16) uint8_t out[16];
+ alignas(ALIGN_BYTES) uint8_t out[16];
CRYPTO_poly1305_finish(&state, out);
EXPECT_EQ(Bytes(out), Bytes(mac)) << "Single-shot Poly1305 failed.";
diff --git a/include/openssl/base.h b/include/openssl/base.h
index cb1affacacce..2e29644ceadf 100644
--- a/include/openssl/base.h
+++ b/include/openssl/base.h
Index: boringssl-20200122/src/include/openssl/base.h
===================================================================
--- boringssl-20200122.orig/src/include/openssl/base.h
+++ boringssl-20200122/src/include/openssl/base.h
@@ -99,6 +99,9 @@ extern "C" {
#elif (defined(__PPC64__) || defined(__powerpc64__)) && defined(_LITTLE_ENDIAN)
#define OPENSSL_64_BIT
@@ -87,6 +69,3 @@ index cb1affacacce..2e29644ceadf 100644
#elif defined(__mips__) && !defined(__LP64__)
#define OPENSSL_32_BIT
#define OPENSSL_MIPS
--
2.24.0
0004-fix-alignment-for-ppc64le.patch
+3 -3
View File
@@ -4,13 +4,13 @@ Date: Wed, 4 Dec 2019 08:23:17 +0100
Subject: [PATCH 4/4] fix alignment for ppc64le
---
crypto/cipher_extra/aead_test.cc | 2 +-
src/crypto/cipher_extra/aead_test.cc | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/crypto/cipher_extra/aead_test.cc b/crypto/cipher_extra/aead_test.cc
index 4c079e843321..2c7e116a4aad 100644
--- a/crypto/cipher_extra/aead_test.cc
+++ b/crypto/cipher_extra/aead_test.cc
--- a/src/crypto/cipher_extra/aead_test.cc
+++ b/src/crypto/cipher_extra/aead_test.cc
@@ -29,7 +29,7 @@
#include "../test/test_util.h"
#include "../test/wycheproof_util.h"
0005-fix-alignment-for-arm.patch
+4 -4
View File
@@ -1,6 +1,6 @@
diff -purN boringssl-20190916.orig/crypto/cipher_extra/aead_test.cc boringssl-20190916/crypto/cipher_extra/aead_test.cc
--- boringssl-20190916.orig/crypto/cipher_extra/aead_test.cc 2020-03-10 20:57:53.383996634 +0100
+++ boringssl-20190916/crypto/cipher_extra/aead_test.cc 2020-03-10 20:59:03.108731229 +0100
--- boringssl-20190916.orig/src/crypto/cipher_extra/aead_test.cc 2020-03-10 20:57:53.383996634 +0100
+++ boringssl-20190916/src/crypto/cipher_extra/aead_test.cc 2020-03-10 20:59:03.108731229 +0100
@@ -31,7 +31,7 @@
#if defined(OPENSSL_AARCH64) || defined(OPENSSL_PPC64LE)
@@ -11,8 +11,8 @@ diff -purN boringssl-20190916.orig/crypto/cipher_extra/aead_test.cc boringssl-20
#else
#define ALIGN_BYTES 64
diff -purN boringssl-20190916.orig/crypto/poly1305/poly1305_test.cc boringssl-20190916/crypto/poly1305/poly1305_test.cc
--- boringssl-20190916.orig/crypto/poly1305/poly1305_test.cc 2020-03-10 20:57:53.363996424 +0100
+++ boringssl-20190916/crypto/poly1305/poly1305_test.cc 2020-03-10 21:08:32.606731399 +0100
--- boringssl-20190916.orig/src/crypto/poly1305/poly1305_test.cc 2020-03-10 20:57:53.363996424 +0100
+++ boringssl-20190916/src/crypto/poly1305/poly1305_test.cc 2020-03-10 21:08:32.606731399 +0100
@@ -25,7 +25,7 @@
#include "../test/file_test.h"
#include "../test/test_util.h"
boringssl-20190916.tar.xz
LFS
BIN
View File
Binary file not shown.
boringssl-20200122.tar.xz
LFS
BIN
View File
Binary file not shown.