nortti/sortix-mirror
1
0
Fork 0
Code Issues Pull requests Projects Releases Wiki Activity
sortix-mirror/ports/libssl/libssl.patch
Jonas 'Sortie' Termansen 14c9b98e0e Move default libssl configuration to /etc/default/ssl.
2025-01-26 14:04:12 +01:00

425 lines
13 KiB
Diff
Raw Permalink Blame History

diff -Paur --no-dereference -- libssl.upstream/Makefile.in libssl/Makefile.in
--- libssl.upstream/Makefile.in
+++ libssl/Makefile.in
@@ -892,7 +892,7 @@
@if [ "@OPENSSLDIR@x" != "x" ]; then \
OPENSSLDIR="$(DESTDIR)@OPENSSLDIR@"; \
else \
- OPENSSLDIR="$(DESTDIR)$(sysconfdir)/ssl"; \
+ OPENSSLDIR="$(DESTDIR)$(sysconfdir)/default/ssl"; \
fi; \
mkdir -p "$$OPENSSLDIR/certs"; \
for i in cert.pem openssl.cnf x509v3.cnf; do \
@@ -907,7 +907,7 @@
@if [ "@OPENSSLDIR@x" != "x" ]; then \
OPENSSLDIR="$(DESTDIR)@OPENSSLDIR@"; \
else \
- OPENSSLDIR="$(DESTDIR)$(sysconfdir)/ssl"; \
+ OPENSSLDIR="$(DESTDIR)$(sysconfdir)/default/ssl"; \
fi; \
for i in cert.pem openssl.cnf x509v3.cnf; do \
if cmp -s "$$OPENSSLDIR/$$i" "$(srcdir)/$$i"; then \
diff -Paur --no-dereference -- libssl.upstream/apps/nc/netcat.c libssl/apps/nc/netcat.c
--- libssl.upstream/apps/nc/netcat.c
+++ libssl/apps/nc/netcat.c
@@ -40,7 +40,10 @@
#include <netinet/in.h>
#include <netinet/tcp.h>
#include <netinet/ip.h>
+/* PATCH: Sortix doesn't have <netinet/telnet.h> yet. */
+#if __has_include(<netinet/telnet.h>)
#include <arpa/telnet.h>
+#endif
#include <ctype.h>
#include <err.h>
@@ -467,8 +470,12 @@
} else {
strlcpy(unix_dg_tmp_socket_buf, "/tmp/nc.XXXXXXXXXX",
UNIX_DG_TMP_SOCKET_SIZE);
- if (mktemp(unix_dg_tmp_socket_buf) == NULL)
+ /* PATCH: Sortix doesn't have the obsolete mktemp(3) function. */
+ int fd = mkstemp(unix_dg_tmp_socket_buf);
+ if (fd < 0)
err(1, "mktemp");
+ unlink(unix_dg_tmp_socket_buf);
+ close(fd);
unix_dg_tmp_socket = unix_dg_tmp_socket_buf;
}
}
@@ -1387,7 +1394,8 @@
memset(&cmsgbuf, 0, sizeof(cmsgbuf));
memset(&iov, 0, sizeof(iov));
- mh.msg_control = (caddr_t)&cmsgbuf.buf;
+ /* PATCH: Sortix doesn't have the non-standard caddr_t type. */
+ mh.msg_control = (char*)&cmsgbuf.buf;
mh.msg_controllen = sizeof(cmsgbuf.buf);
cmsg = CMSG_FIRSTHDR(&mh);
cmsg->cmsg_len = CMSG_LEN(sizeof(int));
@@ -1424,6 +1432,7 @@
void
atelnet(int nfd, unsigned char *buf, unsigned int size)
{
+#ifdef IAC
unsigned char *p, *end;
unsigned char obuf[4];
@@ -1449,6 +1458,9 @@
if (atomicio(vwrite, nfd, obuf, 3) != 3)
warn("Write Error!");
}
+#else
+ errx(1, "Telnet negotation is not supported");
+#endif
}
int
@@ -1592,16 +1604,20 @@
err(1, NULL);
}
if (Tflag != -1) {
+/* PATCH: The Sortix network stack is WIP and doesn't have IP_TOS yet and
+ likewise with other features. */
+#ifdef IP_TOS
if (af == AF_INET && setsockopt(s, IPPROTO_IP,
IP_TOS, &Tflag, sizeof(Tflag)) == -1)
err(1, "set IP ToS");
+#endif
#ifdef IPV6_TCLASS
- else if (af == AF_INET6 && setsockopt(s, IPPROTO_IPV6,
+ if (af == AF_INET6 && setsockopt(s, IPPROTO_IPV6,
IPV6_TCLASS, &Tflag, sizeof(Tflag)) == -1)
err(1, "set IPv6 traffic class");
#else
- else if (af == AF_INET6) {
+ if (af == AF_INET6) {
errno = ENOPROTOOPT;
err(1, "set IPv6 traffic class not supported");
}
@@ -1619,13 +1635,16 @@
}
if (ttl != -1) {
+#ifdef IP_TTL
if (af == AF_INET && setsockopt(s, IPPROTO_IP,
IP_TTL, &ttl, sizeof(ttl)))
err(1, "set IP TTL");
-
- else if (af == AF_INET6 && setsockopt(s, IPPROTO_IPV6,
+#endif
+#ifdef IPV6_UNICAST_HOPS
+ if (af == AF_INET6 && setsockopt(s, IPPROTO_IPV6,
IPV6_UNICAST_HOPS, &ttl, sizeof(ttl)))
err(1, "set IPv6 unicast hops");
+#endif
}
if (minttl != -1) {
@@ -1663,7 +1682,9 @@
{ "af41", IPTOS_DSCP_AF41 },
{ "af42", IPTOS_DSCP_AF42 },
{ "af43", IPTOS_DSCP_AF43 },
+#ifdef IPTOS_PREC_CRITIC_ECP
{ "critical", IPTOS_PREC_CRITIC_ECP },
+#endif
{ "cs0", IPTOS_DSCP_CS0 },
{ "cs1", IPTOS_DSCP_CS1 },
{ "cs2", IPTOS_DSCP_CS2 },
@@ -1673,11 +1694,21 @@
{ "cs6", IPTOS_DSCP_CS6 },
{ "cs7", IPTOS_DSCP_CS7 },
{ "ef", IPTOS_DSCP_EF },
+#ifdef IPTOS_PREC_INTERNETCONTROL
{ "inetcontrol", IPTOS_PREC_INTERNETCONTROL },
+#endif
+#ifdef IPTOS_LOWDELAY
{ "lowdelay", IPTOS_LOWDELAY },
+#endif
+#ifdef IPTOS_PREC_NETCONTROL
{ "netcontrol", IPTOS_PREC_NETCONTROL },
+#endif
+#ifdef IPTOS_RELIABILITY
{ "reliability", IPTOS_RELIABILITY },
+#endif
+#ifdef IPTOS_THROUGHPUT
{ "throughput", IPTOS_THROUGHPUT },
+#endif
{ NULL, -1 },
};
diff -Paur --no-dereference -- libssl.upstream/apps/openssl/apps.c libssl/apps/openssl/apps.c
--- libssl.upstream/apps/openssl/apps.c
+++ libssl/apps/openssl/apps.c
@@ -147,6 +147,11 @@
#include <openssl/x509.h>
#include <openssl/x509v3.h>
+/* PATCH: For snprintf path creation that handles too long paths. */
+#if defined(__sortix__) && !defined(PATH_MAX)
+#define PATH_MAX 4096
+#endif
+
typedef struct {
const char *name;
unsigned long flag;
diff -Paur --no-dereference -- libssl.upstream/apps/openssl/ca.c libssl/apps/openssl/ca.c
--- libssl.upstream/apps/openssl/ca.c
+++ libssl/apps/openssl/ca.c
@@ -81,6 +81,13 @@
#include <openssl/x509.h>
#include <openssl/x509v3.h>
+/* PATCH: Sortix doesn't have a PATH_MAX limit. Provide a simple value for the
+ below snprintf calls that construct paths and handle overflow if paths
+ are longer than PATH_MAX. */
+#if defined(__sortix__) && !defined(PATH_MAX)
+#define PATH_MAX 4096
+#endif
+
#define BASE_SECTION "ca"
#define ENV_DEFAULT_CA "default_ca"
diff -Paur --no-dereference -- libssl.upstream/apps/openssl/certhash.c libssl/apps/openssl/certhash.c
--- libssl.upstream/apps/openssl/certhash.c
+++ libssl/apps/openssl/certhash.c
@@ -33,6 +33,11 @@
#include "apps.h"
+/* PATCH: For readlink that handles too long paths. */
+#if defined(__sortix__) && !defined(PATH_MAX)
+#define PATH_MAX 4096
+#endif
+
static struct {
int dryrun;
int verbose;
diff -Paur --no-dereference -- libssl.upstream/apps/openssl/s_socket.c libssl/apps/openssl/s_socket.c
--- libssl.upstream/apps/openssl/s_socket.c
+++ libssl/apps/openssl/s_socket.c
@@ -73,6 +73,23 @@
#include "s_apps.h"
+/* PATCH: The server below only supports IPv4 and only uses the obsolete
+ gethostbyname and gethostbyaddr instead of the getaddrinfo
+ replacement. Sortix intentionally does not have gethostbyname, so
+ simply disable the feature for now. */
+#if defined(__sortix__)
+struct hostent
+{
+ char *h_name;
+ char **h_aliases;
+ int h_addrtype;
+ int h_length;
+ char **h_addr_list;
+};
+#define gethostbyname(a) ((void) a, (struct hostent*) NULL)
+#define gethostbyaddr(a, b, c) (((void) a), ((void) b), ((void) c), (struct hostent*) NULL)
+#endif
+
static int init_server(int *sock, int port, int type);
static int init_server_long(int *sock, int port, char *ip, int type);
static int do_accept(int acc_sock, int *sock);
diff -Paur --no-dereference -- libssl.upstream/configure libssl/configure
--- libssl.upstream/configure
+++ libssl/configure
@@ -12178,6 +12178,10 @@
HOST_OS=midipix
CPPFLAGS="$CPPFLAGS -D_DEFAULT_SOURCE -D_BSD_SOURCE -D_POSIX_SOURCE -D_GNU_SOURCE"
;;
+ *sortix*)
+ HOST_OS=sortix
+ HOST_ABI=elf
+ ;;
*netbsd*)
HOST_OS=netbsd
HOST_ABI=elf
diff -Paur --no-dereference -- libssl.upstream/crypto/Makefile.in libssl/crypto/Makefile.in
--- libssl.upstream/crypto/Makefile.in
+++ libssl/crypto/Makefile.in
@@ -92,7 +92,7 @@
@ENABLE_LIBTLS_ONLY_TRUE@am__append_1 = libcrypto.la
@HAVE_EXPLICIT_BZERO_FALSE@am__append_2 = libcompatnoopt.la
@OPENSSLDIR_DEFINED_TRUE@am__append_3 = -DOPENSSLDIR=\"@OPENSSLDIR@\"
-@OPENSSLDIR_DEFINED_FALSE@am__append_4 = -DOPENSSLDIR=\"$(sysconfdir)/ssl\"
+@OPENSSLDIR_DEFINED_FALSE@am__append_4 = -DOPENSSLDIR=\"$(sysconfdir)/ssl\" -DOPENSSLDIR_DEFAULT=\"$(sysconfdir)/default/ssl\"
# compatibility functions that need to be built without optimizations
@HAVE_EXPLICIT_BZERO_FALSE@am__append_5 = libcompatnoopt.la
@@ -1448,7 +1448,8 @@
CC = @CC@
CCAS = @CCAS@
CCASDEPMODE = @CCASDEPMODE@
-CCASFLAGS = @CCASFLAGS@
+# TODO: sortix-binutils-1.1-rc3 is too old for endbr64.
+CCASFLAGS = @CCASFLAGS@ -Dendbr64=
CCDEPMODE = @CCDEPMODE@
CFLAGS = @CFLAGS@
CPPFLAGS = @CPPFLAGS@
diff -Paur --no-dereference -- libssl.upstream/crypto/bio/b_sock.c libssl/crypto/bio/b_sock.c
--- libssl.upstream/crypto/bio/b_sock.c
+++ libssl/crypto/bio/b_sock.c
@@ -34,6 +34,21 @@
#include <openssl/buffer.h>
#include <openssl/err.h>
+/* PATCH: Sortix intentionally doesn't have the obsolete gethostbyname family
+ but only the modern getaddrinfo(3) family. Actually none of my ports
+ use BIO_gethostbyname, maybe it can just be removed. */
+#if defined(__sortix__)
+struct hostent
+{
+ char *h_name;
+ char **h_aliases;
+ int h_addrtype;
+ int h_length;
+ char **h_addr_list;
+};
+#define gethostbyname(a) ((void) a, (struct hostent*) NULL)
+#endif
+
int
BIO_get_host_ip(const char *str, unsigned char *ip)
{
diff -Paur --no-dereference -- libssl.upstream/crypto/bio/bss_bio.c libssl/crypto/bio/bss_bio.c
--- libssl.upstream/crypto/bio/bss_bio.c
+++ libssl/crypto/bio/bss_bio.c
@@ -74,6 +74,11 @@
# endif
#endif
+/* PATCH: Sortix <limits.h> is buggy and doesn't define SSIZE_MAX right now. */
+#if defined(__sortix__)
+#include <sys/types.h>
+#endif
+
#include <assert.h>
#include <limits.h>
#include <stdlib.h>
diff -Paur --no-dereference -- libssl.upstream/crypto/cryptlib.h libssl/crypto/cryptlib.h
--- libssl.upstream/crypto/cryptlib.h
+++ libssl/crypto/cryptlib.h
@@ -72,6 +72,13 @@
#define X509_CERT_DIR_EVP "SSL_CERT_DIR"
#define X509_CERT_FILE_EVP "SSL_CERT_FILE"
+// PATCH: Search /etc/default/ssl if /etc/ssl doesn't exist.
+#ifdef OPENSSLDIR_DEFAULT
+#define X509_CERT_AREA_DEFAULT OPENSSLDIR_DEFAULT
+#define X509_CERT_DIR_DEFAULT OPENSSLDIR_DEFAULT "/certs"
+#define X509_CERT_FILE_DEFAULT OPENSSLDIR_DEFAULT "/cert.pem"
+#endif
+
#define CTLOG_FILE OPENSSLDIR "/ct_log_list.cnf"
#define CTLOG_FILE_EVP "CTLOG_FILE"
diff -Paur --no-dereference -- libssl.upstream/crypto/x509/x509_def.c libssl/crypto/x509/x509_def.c
--- libssl.upstream/crypto/x509/x509_def.c
+++ libssl/crypto/x509/x509_def.c
@@ -57,6 +57,7 @@
*/
#include <stdio.h>
+#include <unistd.h>
#include "cryptlib.h"
#include <openssl/crypto.h>
#include <openssl/x509.h>
@@ -71,6 +72,10 @@
const char *
X509_get_default_cert_area(void)
{
+#ifdef X509_CERT_AREA_DEFAULT
+ if (access(X509_CERT_AREA, F_OK) == -1)
+ return X509_CERT_AREA_DEFAULT;
+#endif
return (X509_CERT_AREA);
}
LCRYPTO_ALIAS(X509_get_default_cert_area);
@@ -78,6 +83,10 @@
const char *
X509_get_default_cert_dir(void)
{
+#ifdef X509_CERT_DIR_DEFAULT
+ if (access(X509_CERT_DIR, F_OK) == -1)
+ return X509_CERT_DIR_DEFAULT;
+#endif
return (X509_CERT_DIR);
}
LCRYPTO_ALIAS(X509_get_default_cert_dir);
@@ -85,6 +94,10 @@
const char *
X509_get_default_cert_file(void)
{
+#ifdef X509_CERT_FILE_DEFAULT
+ if (access(X509_CERT_FILE, F_OK) == -1)
+ return X509_CERT_FILE_DEFAULT;
+#endif
return (X509_CERT_FILE);
}
LCRYPTO_ALIAS(X509_get_default_cert_file);
diff -Paur --no-dereference -- libssl.upstream/include/compat/unistd.h libssl/include/compat/unistd.h
--- libssl.upstream/include/compat/unistd.h
+++ libssl/include/compat/unistd.h
@@ -69,9 +69,10 @@
#include "getopt.h"
#endif
-#ifndef HAVE_GETPAGESIZE
-int getpagesize(void);
-#endif
+/* PATCH: Somehow HAVE_GETPAGESIZE doesn't get defined even though configure
+ does detect Sortix has it (with the fix). Sortix getpagesize returns
+ size_t rather than int, so remove this conflicting forward
+ declaration. */
#define pledge(request, paths) 0
#define unveil(path, permissions) 0
diff -Paur --no-dereference -- libssl.upstream/tls/Makefile.in libssl/tls/Makefile.in
--- libssl.upstream/tls/Makefile.in
+++ libssl/tls/Makefile.in
@@ -90,7 +90,7 @@
build_triplet = @build@
host_triplet = @host@
@OPENSSLDIR_DEFINED_TRUE@am__append_1 = -DTLS_DEFAULT_CA_FILE=\"@OPENSSLDIR@/cert.pem\"
-@OPENSSLDIR_DEFINED_FALSE@am__append_2 = -DTLS_DEFAULT_CA_FILE=\"$(sysconfdir)/ssl/cert.pem\"
+@OPENSSLDIR_DEFINED_FALSE@am__append_2 = -DTLS_DEFAULT_CA_FILE=\"$(sysconfdir)/ssl/cert.pem\" -DTLS_DEFAULT_CA_FILE_DEFAULT=\"$(sysconfdir)/default/ssl/cert.pem\"
@HOST_WIN_TRUE@am__append_3 = compat/ftruncate.c compat/pread.c \
@HOST_WIN_TRUE@ compat/pwrite.c
subdir = tls
diff -Paur --no-dereference -- libssl.upstream/tls/tls_config.c libssl/tls/tls_config.c
--- libssl.upstream/tls/tls_config.c
+++ libssl/tls/tls_config.c
@@ -29,11 +29,19 @@
#include "tls_internal.h"
+// PATCH: Search /etc/default/ssl if /etc/ssl doesn't exist.
static const char default_ca_file[] = TLS_DEFAULT_CA_FILE;
+#ifdef TLS_DEFAULT_CA_FILE_DEFAULT
+static const char default_ca_file_default[] = TLS_DEFAULT_CA_FILE_DEFAULT;
+#endif
const char *
tls_default_ca_cert_file(void)
{
+#ifdef TLS_DEFAULT_CA_FILE_DEFAULT
+ if (access(default_ca_file, F_OK) == -1)
+ return default_ca_file_default;
+#endif
return default_ca_file;
}
@@ -742,8 +750,8 @@
if (sb.st_uid != getuid()) {
tls_config_set_errorx(config, TLS_ERROR_UNKNOWN,
- "session file has incorrect owner (uid %u != %u)",
- sb.st_uid, getuid());
+ "session file has incorrect owner (uid %llu != %llu)",
+ (unsigned long long)sb.st_uid, (unsigned long long)getuid());
return (-1);
}
mugo = sb.st_mode & (S_IRWXU|S_IRWXG|S_IRWXO);
Reference in a new issue View git blame Copy permalink