mark-devkit: [mark-31] Bump dev-libs/openssl-3.0.18

dev-libs/openssl/Manifest

@@ -1 +1,2 @@
 DIST openssl-1.1.1q.tar.gz 9864061 BLAKE2B fc8fd6a62dc291d0bda328a051e253175fb04442cc4b8f45d67c3a5027748a0fc5fb372d0483bc9024ae0bff119c4fac8f1e982a182612427696d6d09f5935f5 SHA512 cb9f184ec4974a3423ef59c8ec86b6bf523d5b887da2087ae58c217249da3246896fdd6966ee9c13aea9e6306783365239197e9f742c508a0e35e5744e3e085f
+DIST openssl-3.0.18-c10e643.tar.gz 15496305 BLAKE2B 030f44eead393046bf86f40261d75db858ad340b58ec68a920eb3c82964700fc547e3949a4956e5a3e69bad9645f14ae47aec256952e5765125a3dd6b937036c SHA512 93b6071825550c389dab8fab9d68bf9c3c26f22092e392fba56ba5cc0a38a341ee7909df84b82f9be02b98e32b314d3ccd29736fc26dabbf88fb99d0eebf9cdc

dev-libs/openssl/files/CVE-2023-5678.patch

@@ -0,0 +1,178 @@
+based on: https://build.opensuse.org/package/view_file/openSUSE:Factory/openssl-1_1/openssl-CVE-2023-5678.patch?expand=1
+
+From db925ae2e65d0d925adef429afc37f75bd1c2017 Mon Sep 17 00:00:00 2001
+From: Richard Levitte <levitte@openssl.org>
+Date: Fri, 20 Oct 2023 09:18:19 +0200
+Subject: [PATCH] Make DH_check_pub_key() and DH_generate_key() safer yet
+
+We already check for an excessively large P in DH_generate_key(), but not in
+DH_check_pub_key(), and none of them check for an excessively large Q.
+
+This change adds all the missing excessive size checks of P and Q.
+
+It's to be noted that behaviours surrounding excessively sized P and Q
+differ.  DH_check() raises an error on the excessively sized P, but only
+sets a flag for the excessively sized Q.  This behaviour is mimicked in
+DH_check_pub_key().
+
+Reviewed-by: Tomas Mraz <tomas@openssl.org>
+Reviewed-by: Matt Caswell <matt@openssl.org>
+Reviewed-by: Hugo Landau <hlandau@openssl.org>
+(Merged from https://github.com/openssl/openssl/pull/22518)
+
+(cherry picked from commit ddeb4b6c6d527e54ce9a99cba785c0f7776e54b6)
+---
+ crypto/dh/dh_check.c    | 12 ++++++++++++
+ crypto/dh/dh_err.c      |  3 ++-
+ crypto/dh/dh_key.c      | 12 ++++++++++++
+ crypto/err/openssl.txt  |  1 +
+ include/crypto/dherr.h  |  2 +-
+ include/openssl/dh.h    |  6 +++---
+ include/openssl/dherr.h |  3 ++-
+ 7 files changed, 33 insertions(+), 6 deletions(-)
+
+Index: openssl-1.1.1w/crypto/dh/dh_err.c
+===================================================================
+--- openssl-1.1.1w.orig/crypto/dh/dh_err.c
++++ openssl-1.1.1w/crypto/dh/dh_err.c
+@@ -21,6 +21,7 @@ static const ERR_STRING_DATA DH_str_func
+     {ERR_PACK(ERR_LIB_DH, DH_F_DH_CHECK, 0), "DH_check"},
+     {ERR_PACK(ERR_LIB_DH, DH_F_DH_CHECK_EX, 0), "DH_check_ex"},
+     {ERR_PACK(ERR_LIB_DH, DH_F_DH_CHECK_PARAMS_EX, 0), "DH_check_params_ex"},
++    {ERR_PACK(ERR_LIB_DH, DH_F_DH_CHECK_PUB_KEY, 0), "DH_check_pub_key"},
+     {ERR_PACK(ERR_LIB_DH, DH_F_DH_CHECK_PUB_KEY_EX, 0), "DH_check_pub_key_ex"},
+     {ERR_PACK(ERR_LIB_DH, DH_F_DH_CMS_DECRYPT, 0), "dh_cms_decrypt"},
+     {ERR_PACK(ERR_LIB_DH, DH_F_DH_CMS_SET_PEERKEY, 0), "dh_cms_set_peerkey"},
+@@ -87,6 +88,7 @@ static const ERR_STRING_DATA DH_str_reas
+     {ERR_PACK(ERR_LIB_DH, 0, DH_R_PARAMETER_ENCODING_ERROR),
+     "parameter encoding error"},
+     {ERR_PACK(ERR_LIB_DH, 0, DH_R_PEER_KEY_ERROR), "peer key error"},
++    {ERR_PACK(ERR_LIB_DH, 0, DH_R_Q_TOO_LARGE), "q too large"},
+     {ERR_PACK(ERR_LIB_DH, 0, DH_R_SHARED_INFO_ERROR), "shared info error"},
+     {ERR_PACK(ERR_LIB_DH, 0, DH_R_UNABLE_TO_CHECK_GENERATOR),
+     "unable to check generator"},
+Index: openssl-1.1.1w/crypto/err/openssl.txt
+===================================================================
+--- openssl-1.1.1w.orig/crypto/err/openssl.txt
++++ openssl-1.1.1w/crypto/err/openssl.txt
+@@ -404,6 +404,7 @@ DH_F_DH_BUILTIN_GENPARAMS:106:dh_builtin
+ DH_F_DH_CHECK:126:DH_check
+ DH_F_DH_CHECK_EX:121:DH_check_ex
+ DH_F_DH_CHECK_PARAMS_EX:122:DH_check_params_ex
++DH_F_DH_CHECK_PUB_KEY:128:DH_check_pub_key
+ DH_F_DH_CHECK_PUB_KEY_EX:123:DH_check_pub_key_ex
+ DH_F_DH_CMS_DECRYPT:114:dh_cms_decrypt
+ DH_F_DH_CMS_SET_PEERKEY:115:dh_cms_set_peerkey
+@@ -2226,6 +2227,7 @@ DH_R_NO_PARAMETERS_SET:107:no parameters
+ DH_R_NO_PRIVATE_VALUE:100:no private value
+ DH_R_PARAMETER_ENCODING_ERROR:105:parameter encoding error
+ DH_R_PEER_KEY_ERROR:111:peer key error
++DH_R_Q_TOO_LARGE:130:q too large
+ DH_R_SHARED_INFO_ERROR:113:shared info error
+ DH_R_UNABLE_TO_CHECK_GENERATOR:121:unable to check generator
+ DSA_R_BAD_Q_VALUE:102:bad q value
+Index: openssl-1.1.1w/include/openssl/dherr.h
+===================================================================
+--- openssl-1.1.1w.orig/include/openssl/dherr.h
++++ openssl-1.1.1w/include/openssl/dherr.h
+@@ -31,6 +31,7 @@ int ERR_load_DH_strings(void);
+ #  define DH_F_DH_CHECK                                    126
+ #  define DH_F_DH_CHECK_EX                                 121
+ #  define DH_F_DH_CHECK_PARAMS_EX                          122
++#  define DH_F_DH_CHECK_PUB_KEY                            128
+ #  define DH_F_DH_CHECK_PUB_KEY_EX                         123
+ #  define DH_F_DH_CMS_DECRYPT                              114
+ #  define DH_F_DH_CMS_SET_PEERKEY                          115
+@@ -84,6 +85,7 @@ int ERR_load_DH_strings(void);
+ #  define DH_R_NO_PRIVATE_VALUE                            100
+ #  define DH_R_PARAMETER_ENCODING_ERROR                    105
+ #  define DH_R_PEER_KEY_ERROR                              111
++#  define DH_R_Q_TOO_LARGE                                 130
+ #  define DH_R_SHARED_INFO_ERROR                           113
+ #  define DH_R_UNABLE_TO_CHECK_GENERATOR                   121
+
+Index: openssl-1.1.1w/crypto/dh/dh_check.c
+===================================================================
+--- openssl-1.1.1w.orig/crypto/dh/dh_check.c
++++ openssl-1.1.1w/crypto/dh/dh_check.c
+@@ -193,6 +193,18 @@
+
+ int DH_check_pub_key(const DH *dh, const BIGNUM *pub_key, int *ret)
+ {
++    /* Don't do any checks at all with an excessively large modulus */
++    if (BN_num_bits(dh->p) > OPENSSL_DH_CHECK_MAX_MODULUS_BITS) {
++        DHerr(DH_F_DH_CHECK_PUB_KEY, DH_R_MODULUS_TOO_LARGE);
++        *ret = DH_MODULUS_TOO_LARGE | DH_CHECK_PUBKEY_INVALID;
++        return 0;
++    }
++
++    if (dh->q != NULL && BN_ucmp(dh->p, dh->q) < 0) {
++        *ret |= DH_CHECK_INVALID_Q_VALUE | DH_CHECK_PUBKEY_INVALID;
++        return 1;
++    }
++
+     int ok = 0;
+     BIGNUM *tmp = NULL;
+     BN_CTX *ctx = NULL;
+
+Index: openssl-1.1.1w/crypto/dh/dh_key.c
+===================================================================
+--- openssl-1.1.1w.orig/crypto/dh/dh_key.c
++++ openssl-1.1.1w/crypto/dh/dh_key.c
+@@ -51,6 +51,12 @@ int DH_compute_key(unsigned char *key, c
+     int ret = 0, i;
+     volatile size_t npad = 0, mask = 1;
+
++    if (dh->q != NULL
++        && BN_num_bits(dh->q) > OPENSSL_DH_MAX_MODULUS_BITS) {
++        DHerr(DH_F_COMPUTE_KEY, DH_R_Q_TOO_LARGE);
++        return 0;
++    }
++
+     /* compute the key; ret is constant unless compute_key is external */
+     if ((ret = dh->meth->compute_key(key, pub_key, dh)) <= 0)
+         return ret;
+@@ -147,6 +153,12 @@ static int generate_key(DH *dh)
+         return 0;
+     }
+
++    if (dh->q != NULL
++        && BN_num_bits(dh->q) > OPENSSL_DH_MAX_MODULUS_BITS) {
++        DHerr(DH_F_GENERATE_KEY, DH_R_Q_TOO_LARGE);
++        return 0;
++    }
++
+     ctx = BN_CTX_new();
+     if (ctx == NULL)
+         goto err;
+Index: openssl-1.1.1w/doc/man3/DH_generate_parameters.pod
+===================================================================
+--- openssl-1.1.1w.orig/doc/man3/DH_generate_parameters.pod
++++ openssl-1.1.1w/doc/man3/DH_generate_parameters.pod
+@@ -73,6 +73,10 @@ The generator B<g> is not suitable.
+ Note that the lack of this bit doesn't guarantee that B<g> is
+ suitable, unless B<p> is known to be a strong prime.
+
++=item DH_MODULUS_TOO_LARGE
++
++The modulus is too large.
++
+ =back
+
+ DH_check() confirms that the Diffie-Hellman parameters B<dh> are valid. The
+Index: openssl-1.1.1w/include/openssl/dh.h
+===================================================================
+--- openssl-1.1.1w.orig/include/openssl/dh.h
++++ openssl-1.1.1w/include/openssl/dh.h
+@@ -78,8 +78,9 @@ DECLARE_ASN1_ITEM(DHparams)
+ # define DH_UNABLE_TO_CHECK_GENERATOR    0x04
+ # define DH_NOT_SUITABLE_GENERATOR       0x08
+ # define DH_CHECK_Q_NOT_PRIME            0x10
+-# define DH_CHECK_INVALID_Q_VALUE        0x20
++# define DH_CHECK_INVALID_Q_VALUE        0x20 /* +DH_check_pub_key */
+ # define DH_CHECK_INVALID_J_VALUE        0x40
++# define DH_MODULUS_TOO_LARGE            0x100 /* +DH_check_pub_key */
+
+ /* DH_check_pub_key error codes */
+ # define DH_CHECK_PUBKEY_TOO_SMALL       0x01
+

dev-libs/openssl/openssl-3.0.18.ebuild

@@ -0,0 +1,175 @@
+# Distributed under the terms of the GNU General Public License v2
+# Autogen by MARK Devkit
+
+EAPI=7
+
+PRESERVE_LIB_FORCE=1
+inherit flag-o-matic toolchain-funcs preserve-libs
+
+DESCRIPTION="TLS/SSL and crypto library"
+HOMEPAGE="https://github.com/openssl/openssl"
+SRC_URI="https://api.github.com/repos/openssl/openssl/tarball/openssl-3.0.18 -> openssl-3.0.18-c10e643.tar.gz"
+
+LICENSE="Apache-2.0"
+SLOT="0/${PVR}" # Funtoo change -- force more frequent rebuilds.
+KEYWORDS="*"
+# TODO: Add support for fips
+IUSE="+asm libc_musl rfc3779 sctp cpu_flags_x86_sse2 static-libs +tls-compression vanilla weak-ssl-ciphers"
+RESTRICT=""
+
+# app-misc/c_rehash is deprecated by https://bugs.funtoo.org/browse/FL-10434
+# openssl installs perl version of c_rehash by default
+# openssl also comes with its own C version of rehash, which is now preferred
+# See https://nvd.nist.gov/vuln/detail/CVE-2022-2068 for more details on c_rehash deprecation
+# Ensure we block app-misc/c_rehash for new openssl versions
+RDEPEND="
+	!app-misc/c_rehash
+	tls-compression? ( >=sys-libs/zlib-1.2.8-r1[static-libs(+)] )
+	"
+DEPEND="${RDEPEND}"
+BDEPEND="
+	>=dev-lang/perl-5
+	sctp? ( >=net-misc/lksctp-tools-1.0.12 )
+	"
+PDEPEND="app-misc/ca-certificates"
+
+post_src_unpack() {
+	mv openssl-openssl-* ${S}
+}
+
+src_prepare() {
+	# Make sure we only ever touch Makefile.org and avoid patching a file
+	# that gets blown away anyways by the Configure script in src_configure
+	rm -f Makefile
+
+	eapply_user #332661
+
+	rm test/recipes/80-test_ssl_new.t || die
+	rm test/recipes/30-test_afalg.t || die
+
+	default
+}
+
+src_configure() {
+	local _target _optflags
+	SSL_CNF_DIR="/etc/ssl"
+
+	[[ ${CC} == *clang* ]] && append-flags -Qunused-arguments
+
+	append-flags -fno-strict-aliasing
+	append-flags $(test-flags-CC -Wa,--noexecstack)
+	append-cppflags -DOPENSSL_NO_BUF_FREELISTS
+
+	unset APPS
+	unset SCRIPTS
+	unset CROSS_COMPILE
+
+	tc-export AR CC CXX RANLIB RC
+
+	use_ssl() { usex $1 "enable-${2:-$1}" "no-${2:-$1}" " ${*:3}" ; }
+	echoit() { echo "$@" ; "$@" ; }
+
+
+	CARCH=${CHOST%%-*}
+	case "$CARCH" in
+		aarch64*)   _target="linux-aarch64" ;;
+		arm*)       _target="linux-armv4" ;;
+		mips64*)    _target="linux64-mips64" ;;
+		# explicit _optflags is needed to prevent automatic -mips3 addition
+		mips*)      _target="linux-mips32"; _optflags="-mips32" ;;
+		ppc)        _target="linux-ppc" ;;
+		ppc64)      _target="linux-ppc64" ;;
+		ppc64le)    _target="linux-ppc64le" ;;
+ 		x86)        _target="linux-elf" ;;
+		x86_64)     _target="linux-x86_64"; _optflags="enable-ec_nistp_64_gcc_128" ;;
+		s390x)      _target="linux64-s390x";;
+		riscv64)    _target="linux64-riscv64";;
+ 		loongarch64)_target="linux64-loongarch64";;
+ 		*)          die "Unable to determine architecture from (arch=$CARCH)" ;;
+ 	esac
+
+	CFLAGS= LDFLAGS= echoit \
+	perl ./Configure \
+		${_target} \
+		--prefix="${EPREFIX}"/usr \
+		--openssldir="${EPREFIX}"${SSL_CNF_DIR} \
+		--libdir=$(get_libdir) \
+		${_optflags} \
+		$(use cpu_flags_x86_sse2 || echo "no-sse2") \
+		enable-camellia \
+		enable-ec \
+		enable-ec2m \
+		enable-sm2 \
+		enable-srp \
+		$(use elibc_musl && echo "no-async") \
+		enable-idea \
+		enable-mdc2 \
+		enable-rc5 \
+		no-tests \
+		$(use_ssl asm) \
+		$(use_ssl rfc3779) \
+		$(use_ssl sctp) \
+		$(use_ssl tls-compression zlib) \
+		$(use_ssl weak-ssl-ciphers) \
+		shared threads \
+		|| die
+
+	perl configdata.pm --dump
+}
+
+src_compile() {
+	# depend is needed to use $confopts; it also doesn't matter
+	# that it's -j1 as the code itself serializes subdirs
+	emake -j1 depend
+	emake all
+}
+
+src_install() {
+	# We need to create $ED/usr on our own to avoid a race condition #665130
+	if [[ ! -d "${ED}/usr" ]]; then
+		# We can only create this directory once
+		mkdir "${ED}"/usr || die
+	fi
+
+	emake DESTDIR="${D}" install
+
+	# This is crappy in that the static archives are still built even
+	# when USE=static-libs.  But this is due to a failing in the openssl
+	# build system: the static archives are built as PIC all the time.
+	# Only way around this would be to manually configure+compile openssl
+	# twice; once with shared lib support enabled and once without.
+	if ! use static-libs; then
+		rm "${ED}"/usr/$(get_libdir)/lib{crypto,ssl}.a || die
+	fi
+
+	dodoc {AUTHORS,CHANGES,NEWS,README,README-PROVIDERS}.md doc/*.txt doc/${PN}-c-indent.el
+	# create the certs directory
+	keepdir ${SSL_CNF_DIR}/certs
+
+	dodir /etc/sandbox.d #254521
+	echo 'SANDBOX_PREDICT="/dev/crypto"' > "${ED}"/etc/sandbox.d/10openssl
+
+	diropts -m0700
+	keepdir ${SSL_CNF_DIR}/private
+}
+
+pkg_preinst() {
+	# Force preseve of libssl.so.1.1 if prsent
+	if [ -e /usr/$(get_libdir)/libssl$(get_libname 1.1) ] ; then
+		preserve_old_lib /usr/$(get_libdir)/lib{crypto,ssl}$(get_libname 1) \
+			/usr/$(get_libdir)/lib{crypto,ssl}$(get_libname 1.1)
+	fi
+}
+
+pkg_postinst() {
+	ebegin "Running 'openssl rehash ${EROOT}${SSL_CNF_DIR}/certs/' to rebuild hashes #333069"
+	openssl rehash "${EROOT}${SSL_CNF_DIR}/certs" >/dev/null
+	eend $?
+
+	if [ -e /usr/$(get_libdir)/libssl$(get_libname 1.1) ] ; then
+		preserve_old_lib_notify /usr/$(get_libdir)/lib{crypto,ssl}$(get_libname 1) \
+			/usr/$(get_libdir)/lib{crypto,ssl}$(get_libname 1.1)
+	fi
+}
+
+# vim: filetype=ebuild