Attachment #179879 for bug #217006

View | Details | Raw Unified | Return to bug 217006
Collapse All | Expand All

Lines 1-6 Link Here

(-)security/libp11/files/patch-configure.ac (-2 / +2 lines)
1	--- configure.ac.orig 2016-03-28 16:04:04 UTC	1	--- configure.ac.orig 2017-01-26 21:19:45 UTC
2	+++ configure.ac	2	+++ configure.ac
3	@@ -191,7 +191,7 @@ if test -n "${pkcs11_module}"; then	3	@@ -208,7 +208,7 @@ if test -n "${pkcs11_module}"; then
4	[Default PKCS#11 module.])	4	[Default PKCS#11 module.])
5	fi	5	fi
6		6

Line 0 Link Here

(-)security/libp11/files/patch-examples_auth.c (+11 lines)
	1	--- examples/auth.c.orig 2017-01-26 21:19:45 UTC
	2	+++ examples/auth.c
	3	@@ -212,7 +212,7 @@ int main(int argc, char *argv[])
	4
	5	/* now verify the result */
	6	rc = RSA_verify(NID_sha1, random, RANDOM_SIZE,
	7	-#if OPENSSL_VERSION_NUMBER >= 0x10100003L
	8	+#if OPENSSL_VERSION_NUMBER >= 0x10100003L && !defined(LIBRESSL_VERSION_NUMBER)
	9	signature, siglen, EVP_PKEY_get0_RSA(pubkey));
	10	#else
	11	signature, siglen, pubkey->pkey.rsa);




--- examples/decrypt.c.orig	2017-01-26 21:19:45 UTC
+++ examples/decrypt.c
@@ -131,7 +131,7 @@ int main(int argc, char *argv[])
 	}
 
 	/* allocate destination buffer */
-#if OPENSSL_VERSION_NUMBER >= 0x10100003L
+#if OPENSSL_VERSION_NUMBER >= 0x10100003L && !defined(LIBRESSL_VERSION_NUMBER)
 	encrypted = OPENSSL_malloc(RSA_size(EVP_PKEY_get0_RSA(pubkey)));
 #else
 	encrypted = OPENSSL_malloc(RSA_size(pubkey->pkey.rsa));
@@ -143,7 +143,7 @@ int main(int argc, char *argv[])
 
 	/* use public key for encryption */
 	len = RSA_public_encrypt(RANDOM_SIZE, random, encrypted,
-#if OPENSSL_VERSION_NUMBER >= 0x10100003L
+#if OPENSSL_VERSION_NUMBER >= 0x10100003L && !defined(LIBRESSL_VERSION_NUMBER)
 			EVP_PKEY_get0_RSA(pubkey),
 #else
 			pubkey->pkey.rsa,
@@ -200,7 +200,7 @@ loggedin:
 	}
 
 	/* allocate space for decrypted data */
-#if OPENSSL_VERSION_NUMBER >= 0x10100003L
+#if OPENSSL_VERSION_NUMBER >= 0x10100003L && !defined(LIBRESSL_VERSION_NUMBER)
 	decrypted = OPENSSL_malloc(RSA_size(EVP_PKEY_get0_RSA(pubkey)));
 #else
 	decrypted = OPENSSL_malloc(RSA_size(pubkey->pkey.rsa));




--- src/eng_back.c.orig	2017-01-26 21:19:45 UTC
+++ src/eng_back.c
@@ -49,7 +49,7 @@ struct st_engine_ctx {
 	char *init_args;
 
 	/* Engine initialization mutex */
-#if OPENSSL_VERSION_NUMBER >= 0x10100004L
+#if OPENSSL_VERSION_NUMBER >= 0x10100004L && !defined(LIBRESSL_VERSION_NUMBER)
 	CRYPTO_RWLOCK *rwlock;
 #else
 	int rwlock;
@@ -206,7 +206,7 @@ ENGINE_CTX *ctx_new()
 #endif
 	}
 
-#if OPENSSL_VERSION_NUMBER >= 0x10100004L
+#if OPENSSL_VERSION_NUMBER >= 0x10100004L && !defined(LIBRESSL_VERSION_NUMBER)
 	ctx->rwlock = CRYPTO_THREAD_lock_new();
 #else
 	ctx->rwlock = CRYPTO_get_dynlock_create_callback() ?
@@ -224,7 +224,7 @@ int ctx_destroy(ENGINE_CTX *ctx)
 		ctx_destroy_pin(ctx);
 		OPENSSL_free(ctx->module);
 		OPENSSL_free(ctx->init_args);
-#if OPENSSL_VERSION_NUMBER >= 0x10100004L
+#if OPENSSL_VERSION_NUMBER >= 0x10100004L && !defined(LIBRESSL_VERSION_NUMBER)
 		CRYPTO_THREAD_lock_free(ctx->rwlock);
 #else
 		if (ctx->rwlock)
@@ -274,7 +274,7 @@ static void ctx_init_libp11_unlocked(ENG
 
 static int ctx_init_libp11(ENGINE_CTX *ctx)
 {
-#if OPENSSL_VERSION_NUMBER >= 0x10100004L
+#if OPENSSL_VERSION_NUMBER >= 0x10100004L && !defined(LIBRESSL_VERSION_NUMBER)
 	CRYPTO_THREAD_write_lock(ctx->rwlock);
 #else
 	if (ctx->rwlock)
@@ -282,7 +282,7 @@ static int ctx_init_libp11(ENGINE_CTX *c
 #endif
 	if (ctx->pkcs11_ctx == NULL || ctx->slot_list == NULL)
 		ctx_init_libp11_unlocked(ctx);
-#if OPENSSL_VERSION_NUMBER >= 0x10100004L
+#if OPENSSL_VERSION_NUMBER >= 0x10100004L && !defined(LIBRESSL_VERSION_NUMBER)
 	CRYPTO_THREAD_unlock(ctx->rwlock);
 #else
 	if (ctx->rwlock)
@@ -302,7 +302,7 @@ int ctx_init(ENGINE_CTX *ctx)
 	/* Only attempt initialization when dynamic locks are unavailable.
 	 * This likely also indicates a single-threaded application,
 	 * so temporarily unlocking CRYPTO_LOCK_ENGINE should be safe. */
-#if OPENSSL_VERSION_NUMBER < 0x10100004L
+#if OPENSSL_VERSION_NUMBER < 0x10100004L && !defined(LIBRESSL_VERSION_NUMBER)
 	if (CRYPTO_get_dynlock_create_callback() == NULL ||
 			CRYPTO_get_dynlock_lock_callback() == NULL ||
 			CRYPTO_get_dynlock_destroy_callback() == NULL) {




--- src/libp11-int.h.orig	2017-01-26 21:19:45 UTC
+++ src/libp11-int.h
@@ -32,7 +32,7 @@
 extern void *C_LoadModule(const char *name, CK_FUNCTION_LIST_PTR_PTR);
 extern CK_RV C_UnloadModule(void *module);
 
-#if OPENSSL_VERSION_NUMBER < 0x10100004L
+#if OPENSSL_VERSION_NUMBER < 0x10100004L || defined(LIBRESSL_VERSION_NUMBER)
 typedef int PKCS11_RWLOCK;
 #else
 typedef CRYPTO_RWLOCK *PKCS11_RWLOCK;
@@ -144,7 +144,7 @@ typedef struct pkcs11_cert_private {
 #define PKCS11_DUP(s) \
 	pkcs11_strdup((char *) s, sizeof(s))
 
-#if OPENSSL_VERSION_NUMBER < 0x10100004L
+#if OPENSSL_VERSION_NUMBER < 0x10100004L || defined(LIBRESSL_VERSION_NUMBER)
 /* Emulate the OpenSSL 1.1 locking API for older OpenSSL versions */
 int CRYPTO_THREAD_lock_new();
 void CRYPTO_THREAD_lock_free(int);

Line 0 Link Here

(-)security/libp11/files/patch-src_libp11.h (+11 lines)
	1	--- src/libp11.h.orig 2017-01-26 21:19:45 UTC
	2	+++ src/libp11.h
	3	@@ -370,7 +370,7 @@ extern int PKCS11_generate_random(PKCS11
	4	*/
	5	RSA_METHOD *PKCS11_get_rsa_method(void);
	6	/* Also define unsupported methods to retain backward compatibility */
	7	-#if OPENSSL_VERSION_NUMBER >= 0x10100002L
	8	+#if OPENSSL_VERSION_NUMBER >= 0x10100002L && !defined(LIBRESSL_VERSION_NUMBER)
	9	EC_KEY_METHOD *PKCS11_get_ec_key_method(void);
	10	void *PKCS11_get_ecdsa_method(void);
	11	void *PKCS11_get_ecdh_method(void);




--- src/p11_ec.c.orig	2017-01-26 21:19:45 UTC
+++ src/p11_ec.c
@@ -37,7 +37,7 @@
 #include <openssl/ecdh.h>
 #endif
 
-#if OPENSSL_VERSION_NUMBER >= 0x10100004L
+#if OPENSSL_VERSION_NUMBER >= 0x10100004L && !defined(LIBRESSL_VERSION_NUMBER)
 typedef int (*compute_key_fn)(unsigned char **, size_t *,
 	const EC_POINT *, const EC_KEY *);
 #else
@@ -73,7 +73,7 @@ struct ecdsa_method {
 
 #endif /* OPENSSL_VERSION_NUMBER < 0x10100000L */
 
-#if OPENSSL_VERSION_NUMBER < 0x10002000L
+#if OPENSSL_VERSION_NUMBER < 0x10002000L || defined(LIBRESSL_VERSION_NUMBER)
 
 /* Define missing functions */
 
@@ -104,7 +104,7 @@ void ECDSA_METHOD_set_sign(ECDSA_METHOD 
 
 /********** Missing ECDH_METHOD functions for OpenSSL < 1.1.0 */
 
-#if OPENSSL_VERSION_NUMBER < 0x10100000L
+#if OPENSSL_VERSION_NUMBER < 0x10100000L || defined(LIBRESSL_VERSION_NUMBER)
 
 /* ecdh_method maintains unchanged layout between 0.9.8 and 1.0.2 */
 
@@ -156,7 +156,7 @@ static void alloc_ec_ex_index()
 {
 	if (ec_ex_index == 0) {
 		while (ec_ex_index == 0) /* Workaround for OpenSSL RT3710 */
-#if OPENSSL_VERSION_NUMBER >= 0x10100002L
+#if OPENSSL_VERSION_NUMBER >= 0x10100002L && !defined(LIBRESSL_VERSION_NUMBER)
 			ec_ex_index = EC_KEY_get_ex_new_index(0, "libp11 ec_key",
 				NULL, NULL, NULL);
 #else
@@ -265,7 +265,7 @@ static EVP_PKEY *pkcs11_get_evp_key_ec(P
 	EVP_PKEY_set1_EC_KEY(pk, ec); /* Also increments the ec ref count */
 
 	if (key->isPrivate) {
-#if OPENSSL_VERSION_NUMBER >= 0x10100000L
+#if OPENSSL_VERSION_NUMBER >= 0x10100000L && !defined(LIBRESSL_VERSION_NUMBER)
 		EC_KEY_set_method(ec, PKCS11_get_ec_key_method());
 #else
 		ECDSA_set_method(ec, PKCS11_get_ecdsa_method());
@@ -275,7 +275,7 @@ static EVP_PKEY *pkcs11_get_evp_key_ec(P
 	/* TODO: Retrieve the ECDSA private key object attributes instead,
 	 * unless the key has the "sensitive" attribute set */
 
-#if OPENSSL_VERSION_NUMBER >= 0x10100000L
+#if OPENSSL_VERSION_NUMBER >= 0x10100000L && !defined(LIBRESSL_VERSION_NUMBER)
 	EC_KEY_set_ex_data(ec, ec_ex_index, key);
 #else
 	ECDSA_set_ex_data(ec, ec_ex_index, key);
@@ -345,14 +345,14 @@ static ECDSA_SIG *pkcs11_ecdsa_sign_sig(
 	(void)kinv; /* Precomputed values are not used for PKCS#11 */
 	(void)rp; /* Precomputed values are not used for PKCS#11 */
 
-#if OPENSSL_VERSION_NUMBER >= 0x10100000L
+#if OPENSSL_VERSION_NUMBER >= 0x10100000L && !defined(LIBRESSL_VERSION_NUMBER)
 	key = (PKCS11_KEY *)EC_KEY_get_ex_data(ec, ec_ex_index);
 #else
 	key = (PKCS11_KEY *)ECDSA_get_ex_data(ec, ec_ex_index);
 #endif
 	if (key == NULL) {
 		sign_sig_fn orig_sign_sig;
-#if OPENSSL_VERSION_NUMBER >= 0x10100000L
+#if OPENSSL_VERSION_NUMBER >= 0x10100000L && !defined(LIBRESSL_VERSION_NUMBER)
 		const EC_KEY_METHOD *meth = EC_KEY_OpenSSL();
 		EC_KEY_METHOD_get_sign((EC_KEY_METHOD *)meth,
 			NULL, NULL, &orig_sign_sig);
@@ -385,7 +385,7 @@ static ECDSA_SIG *pkcs11_ecdsa_sign_sig(
 	sig = ECDSA_SIG_new();
 	if (sig == NULL)
 		return NULL;
-#if OPENSSL_VERSION_NUMBER >= 0x10100000L
+#if OPENSSL_VERSION_NUMBER >= 0x10100000L && !defined(LIBRESSL_VERSION_NUMBER)
 	ECDSA_SIG_set0(sig, r, s);
 #else
 	BN_free(sig->r);
@@ -515,7 +515,7 @@ static int pkcs11_ecdh_derive(unsigned c
 	return 0;
 }
 
-#if OPENSSL_VERSION_NUMBER >= 0x10100004L
+#if OPENSSL_VERSION_NUMBER >= 0x10100004L && !defined(LIBRESSL_VERSION_NUMBER)
 
 /**
  * ECDH key derivation method (replaces ossl_ecdh_compute_key)
@@ -578,7 +578,7 @@ static int pkcs11_ec_ckey(void *out, siz
 	size_t buflen;
 	int rv;
 
-#if OPENSSL_VERSION_NUMBER >= 0x10100000L
+#if OPENSSL_VERSION_NUMBER >= 0x10100000L && !defined(LIBRESSL_VERSION_NUMBER)
 	key = (PKCS11_KEY *)EC_KEY_get_ex_data(ecdh, ec_ex_index);
 #else
 	key = (PKCS11_KEY *)ECDSA_get_ex_data((EC_KEY *)ecdh, ec_ex_index);
@@ -623,7 +623,7 @@ static int pkcs11_ec_ckey(void *out, siz
 /* New way to allocate an ECDSA_METOD object */
 /* OpenSSL 1.1 has single method  EC_KEY_METHOD for ECDSA and ECDH */
 
-#if OPENSSL_VERSION_NUMBER >= 0x10100000L
+#if OPENSSL_VERSION_NUMBER >= 0x10100000L && !defined(LIBRESSL_VERSION_NUMBER)
 
 EC_KEY_METHOD *PKCS11_get_ec_key_method(void)
 {




--- src/p11_key.c.orig	2017-01-26 21:19:45 UTC
+++ src/p11_key.c
@@ -138,7 +138,7 @@ int pkcs11_generate_key(PKCS11_TOKEN *to
 	EVP_PKEY *pk;
 	RSA *rsa;
 	BIO *err;
-#if OPENSSL_VERSION_NUMBER >= 0x10100000L
+#if OPENSSL_VERSION_NUMBER >= 0x10100000L && !defined(LIBRESSL_VERSION_NUMBER)
 	BIGNUM *exp = NULL;
 	BN_GENCB *gencb = NULL;
 #endif
@@ -151,7 +151,7 @@ int pkcs11_generate_key(PKCS11_TOKEN *to
 
 	err = BIO_new_fp(stderr, BIO_NOCLOSE);
 
-#if OPENSSL_VERSION_NUMBER >= 0x10100000L
+#if OPENSSL_VERSION_NUMBER >= 0x10100000L && !defined(LIBRESSL_VERSION_NUMBER)
 	exp = BN_new();
 	rsa = RSA_new();
 	gencb = BN_GENCB_new();
@@ -247,7 +247,7 @@ static int pkcs11_store_key(PKCS11_TOKEN
 		pkcs11_addattr_bool(attrs + n++, CKA_VERIFY, TRUE);
 		pkcs11_addattr_bool(attrs + n++, CKA_WRAP, TRUE);
 	}
-#if OPENSSL_VERSION_NUMBER >= 0x10100003L
+#if OPENSSL_VERSION_NUMBER >= 0x10100003L && !defined(LIBRESSL_VERSION_NUMBER)
 	if (EVP_PKEY_base_id(pk) == EVP_PKEY_RSA) {
 		RSA *rsa = EVP_PKEY_get1_RSA(pk);
 #else
@@ -255,7 +255,7 @@ static int pkcs11_store_key(PKCS11_TOKEN
 		RSA *rsa = pk->pkey.rsa;
 #endif
 		pkcs11_addattr_int(attrs + n++, CKA_KEY_TYPE, CKK_RSA);
-#if OPENSSL_VERSION_NUMBER >= 0x10100005L
+#if OPENSSL_VERSION_NUMBER >= 0x10100005L && !defined(LIBRESSL_VERSION_NUMBER)
 		RSA_get0_key(rsa, &rsa_n, &rsa_e, &rsa_d);
 		RSA_get0_factors(rsa, &rsa_p, &rsa_q);
 #else
@@ -325,7 +325,7 @@ EVP_PKEY *pkcs11_get_key(PKCS11_KEY *key
 				fprintf(stderr, "Missing CKA_ALWAYS_AUTHENTICATE attribute\n");
 		}
 	}
-#if OPENSSL_VERSION_NUMBER >= 0x10100000L
+#if OPENSSL_VERSION_NUMBER >= 0x10100000L && !defined(LIBRESSL_VERSION_NUMBER)
 	EVP_PKEY_up_ref(key->evp_key);
 #else
 	CRYPTO_add(&key->evp_key->references, 1, CRYPTO_LOCK_EVP_PKEY);

Line 0 Link Here

(-)security/libp11/files/patch-src_p11__misc.c (+11 lines)
	1	--- src/p11_misc.c.orig 2017-02-11 19:26:33 UTC
	2	+++ src/p11_misc.c
	3	@@ -43,7 +43,7 @@ char pkcs11_strdup(char mem, size_t si
	4	* CRYPTO dynlock wrappers: 0 is an invalid dynamic lock ID
	5	*/
	6
	7	-#if OPENSSL_VERSION_NUMBER < 0x10100004L
	8	+#if OPENSSL_VERSION_NUMBER < 0x10100004L \|\| defined(LIBRESSL_VERSION_NUMBER)
	9
	10	int CRYPTO_THREAD_lock_new()
	11	{




--- src/p11_rsa.c.orig	2017-01-26 21:19:45 UTC
+++ src/p11_rsa.c
@@ -29,7 +29,7 @@
 
 static int rsa_ex_index = 0;
 
-#if OPENSSL_VERSION_NUMBER < 0x10100003L
+#if OPENSSL_VERSION_NUMBER < 0x10100003L || defined(LIBRESSL_VERSION_NUMBER)
 #define EVP_PKEY_get0_RSA(key) ((key)->pkey.rsa)
 #endif
 
@@ -226,7 +226,7 @@ failure:
 	return NULL;
 
 success:
-#if OPENSSL_VERSION_NUMBER >= 0x10100005L
+#if OPENSSL_VERSION_NUMBER >= 0x10100005L && !defined(LIBRESSL_VERSION_NUMBER)
 		RSA_set0_key(rsa, rsa_n, rsa_e, NULL);
 #else
 		rsa->n=rsa_n;
@@ -275,7 +275,7 @@ int pkcs11_get_key_modulus(PKCS11_KEY *k
 
 	if (rsa == NULL)
 		return 0;
-#if OPENSSL_VERSION_NUMBER >= 0x10100005L
+#if OPENSSL_VERSION_NUMBER >= 0x10100005L && !defined(LIBRESSL_VERSION_NUMBER)
 	RSA_get0_key(rsa, &rsa_n, NULL, NULL);
 #else
 	rsa_n=rsa->n;
@@ -292,7 +292,7 @@ int pkcs11_get_key_exponent(PKCS11_KEY *
 
 	if (rsa == NULL)
 		return 0;
-#if OPENSSL_VERSION_NUMBER >= 0x10100005L
+#if OPENSSL_VERSION_NUMBER >= 0x10100005L && !defined(LIBRESSL_VERSION_NUMBER)
 	RSA_get0_key(rsa, NULL, &rsa_e, NULL);
 #else
 	rsa_e=rsa->e;
@@ -310,7 +310,7 @@ int pkcs11_get_key_size(PKCS11_KEY *key)
 	return RSA_size(rsa);
 }
 
-#if OPENSSL_VERSION_NUMBER < 0x10100005L
+#if OPENSSL_VERSION_NUMBER < 0x10100005L || defined(LIBRESSL_VERSION_NUMBER)
 
 int (*RSA_meth_get_priv_enc(const RSA_METHOD *meth))
 		(int flen, const unsigned char *from,
@@ -374,7 +374,7 @@ static void alloc_rsa_ex_index()
 static void free_rsa_ex_index()
 {
 	/* CRYPTO_free_ex_index requires OpenSSL version >= 1.1.0-pre1 */
-#if OPENSSL_VERSION_NUMBER >= 0x10100001L
+#if OPENSSL_VERSION_NUMBER >= 0x10100001L && !defined(LIBRESSL_VERSION_NUMBER)
 	if (rsa_ex_index > 0) {
 		CRYPTO_free_ex_index(CRYPTO_EX_INDEX_RSA, rsa_ex_index);
 		rsa_ex_index = 0;
@@ -382,7 +382,7 @@ static void free_rsa_ex_index()
 #endif
 }
 
-#if OPENSSL_VERSION_NUMBER < 0x10100005L
+#if OPENSSL_VERSION_NUMBER < 0x10100005L || defined(LIBRESSL_VERSION_NUMBER)
 
 static RSA_METHOD *RSA_meth_dup(const RSA_METHOD *meth)
 {

Return to bug 217006

Line 0 Link Here

(-)security/libp11/files/patch-examples_decrypt.c (+29 lines)
	1	--- examples/decrypt.c.orig 2017-01-26 21:19:45 UTC
	2	+++ examples/decrypt.c
	3	@@ -131,7 +131,7 @@ int main(int argc, char *argv[])
	4	}
	5
	6	/* allocate destination buffer */
	7	-#if OPENSSL_VERSION_NUMBER >= 0x10100003L
	8	+#if OPENSSL_VERSION_NUMBER >= 0x10100003L && !defined(LIBRESSL_VERSION_NUMBER)
	9	encrypted = OPENSSL_malloc(RSA_size(EVP_PKEY_get0_RSA(pubkey)));
	10	#else
	11	encrypted = OPENSSL_malloc(RSA_size(pubkey->pkey.rsa));
	12	@@ -143,7 +143,7 @@ int main(int argc, char *argv[])
	13
	14	/* use public key for encryption */
	15	len = RSA_public_encrypt(RANDOM_SIZE, random, encrypted,
	16	-#if OPENSSL_VERSION_NUMBER >= 0x10100003L
	17	+#if OPENSSL_VERSION_NUMBER >= 0x10100003L && !defined(LIBRESSL_VERSION_NUMBER)
	18	EVP_PKEY_get0_RSA(pubkey),
	19	#else
	20	pubkey->pkey.rsa,
	21	@@ -200,7 +200,7 @@ loggedin:
	22	}
	23
	24	/* allocate space for decrypted data */
	25	-#if OPENSSL_VERSION_NUMBER >= 0x10100003L
	26	+#if OPENSSL_VERSION_NUMBER >= 0x10100003L && !defined(LIBRESSL_VERSION_NUMBER)
	27	decrypted = OPENSSL_malloc(RSA_size(EVP_PKEY_get0_RSA(pubkey)));
	28	#else
	29	decrypted = OPENSSL_malloc(RSA_size(pubkey->pkey.rsa));

Line 0 Link Here

(-)security/libp11/files/patch-src_eng__back.c (+56 lines)
	1	--- src/eng_back.c.orig 2017-01-26 21:19:45 UTC
	2	+++ src/eng_back.c
	3	@@ -49,7 +49,7 @@ struct st_engine_ctx {
	4	char *init_args;
	5
	6	/* Engine initialization mutex */
	7	-#if OPENSSL_VERSION_NUMBER >= 0x10100004L
	8	+#if OPENSSL_VERSION_NUMBER >= 0x10100004L && !defined(LIBRESSL_VERSION_NUMBER)
	9	CRYPTO_RWLOCK *rwlock;
	10	#else
	11	int rwlock;
	12	@@ -206,7 +206,7 @@ ENGINE_CTX *ctx_new()
	13	#endif
	14	}
	15
	16	-#if OPENSSL_VERSION_NUMBER >= 0x10100004L
	17	+#if OPENSSL_VERSION_NUMBER >= 0x10100004L && !defined(LIBRESSL_VERSION_NUMBER)
	18	ctx->rwlock = CRYPTO_THREAD_lock_new();
	19	#else
	20	ctx->rwlock = CRYPTO_get_dynlock_create_callback() ?
	21	@@ -224,7 +224,7 @@ int ctx_destroy(ENGINE_CTX *ctx)
	22	ctx_destroy_pin(ctx);
	23	OPENSSL_free(ctx->module);
	24	OPENSSL_free(ctx->init_args);
	25	-#if OPENSSL_VERSION_NUMBER >= 0x10100004L
	26	+#if OPENSSL_VERSION_NUMBER >= 0x10100004L && !defined(LIBRESSL_VERSION_NUMBER)
	27	CRYPTO_THREAD_lock_free(ctx->rwlock);
	28	#else
	29	if (ctx->rwlock)
	30	@@ -274,7 +274,7 @@ static void ctx_init_libp11_unlocked(ENG
	31
	32	static int ctx_init_libp11(ENGINE_CTX *ctx)
	33	{
	34	-#if OPENSSL_VERSION_NUMBER >= 0x10100004L
	35	+#if OPENSSL_VERSION_NUMBER >= 0x10100004L && !defined(LIBRESSL_VERSION_NUMBER)
	36	CRYPTO_THREAD_write_lock(ctx->rwlock);
	37	#else
	38	if (ctx->rwlock)
	39	@@ -282,7 +282,7 @@ static int ctx_init_libp11(ENGINE_CTX *c
	40	#endif
	41	if (ctx->pkcs11_ctx == NULL \|\| ctx->slot_list == NULL)
	42	ctx_init_libp11_unlocked(ctx);
	43	-#if OPENSSL_VERSION_NUMBER >= 0x10100004L
	44	+#if OPENSSL_VERSION_NUMBER >= 0x10100004L && !defined(LIBRESSL_VERSION_NUMBER)
	45	CRYPTO_THREAD_unlock(ctx->rwlock);
	46	#else
	47	if (ctx->rwlock)
	48	@@ -302,7 +302,7 @@ int ctx_init(ENGINE_CTX *ctx)
	49	/* Only attempt initialization when dynamic locks are unavailable.
	50	* This likely also indicates a single-threaded application,
	51	* so temporarily unlocking CRYPTO_LOCK_ENGINE should be safe. */
	52	-#if OPENSSL_VERSION_NUMBER < 0x10100004L
	53	+#if OPENSSL_VERSION_NUMBER < 0x10100004L && !defined(LIBRESSL_VERSION_NUMBER)
	54	if (CRYPTO_get_dynlock_create_callback() == NULL \|\|
	55	CRYPTO_get_dynlock_lock_callback() == NULL \|\|
	56	CRYPTO_get_dynlock_destroy_callback() == NULL) {

Line 0 Link Here

(-)security/libp11/files/patch-src_libp11-int.h (+20 lines)
	1	--- src/libp11-int.h.orig 2017-01-26 21:19:45 UTC
	2	+++ src/libp11-int.h
	3	@@ -32,7 +32,7 @@
	4	extern void C_LoadModule(const char name, CK_FUNCTION_LIST_PTR_PTR);
	5	extern CK_RV C_UnloadModule(void *module);
	6
	7	-#if OPENSSL_VERSION_NUMBER < 0x10100004L
	8	+#if OPENSSL_VERSION_NUMBER < 0x10100004L \|\| defined(LIBRESSL_VERSION_NUMBER)
	9	typedef int PKCS11_RWLOCK;
	10	#else
	11	typedef CRYPTO_RWLOCK *PKCS11_RWLOCK;
	12	@@ -144,7 +144,7 @@ typedef struct pkcs11_cert_private {
	13	#define PKCS11_DUP(s) \
	14	pkcs11_strdup((char *) s, sizeof(s))
	15
	16	-#if OPENSSL_VERSION_NUMBER < 0x10100004L
	17	+#if OPENSSL_VERSION_NUMBER < 0x10100004L \|\| defined(LIBRESSL_VERSION_NUMBER)
	18	/* Emulate the OpenSSL 1.1 locking API for older OpenSSL versions */
	19	int CRYPTO_THREAD_lock_new();
	20	void CRYPTO_THREAD_lock_free(int);

Line 0 Link Here

(-)security/libp11/files/patch-src_p11__ec.c (+109 lines)
		1	--- src/p11_ec.c.orig 2017-01-26 21:19:45 UTC
		2	+++ src/p11_ec.c
		3	@@ -37,7 +37,7 @@
		4	#include <openssl/ecdh.h>
		5	#endif
		6
		7	-#if OPENSSL_VERSION_NUMBER >= 0x10100004L
		8	+#if OPENSSL_VERSION_NUMBER >= 0x10100004L && !defined(LIBRESSL_VERSION_NUMBER)
		9	typedef int (compute_key_fn)(unsigned char , size_t ,
		10	const EC_POINT , const EC_KEY );
		11	#else
		12	@@ -73,7 +73,7 @@ struct ecdsa_method {
		13
		14	#endif /* OPENSSL_VERSION_NUMBER < 0x10100000L */
		15
		16	-#if OPENSSL_VERSION_NUMBER < 0x10002000L
		17	+#if OPENSSL_VERSION_NUMBER < 0x10002000L \|\| defined(LIBRESSL_VERSION_NUMBER)
		18
		19	/* Define missing functions */
		20
		21	@@ -104,7 +104,7 @@ void ECDSA_METHOD_set_sign(ECDSA_METHOD
		22
		23	/********** Missing ECDH_METHOD functions for OpenSSL < 1.1.0 */
		24
		25	-#if OPENSSL_VERSION_NUMBER < 0x10100000L
		26	+#if OPENSSL_VERSION_NUMBER < 0x10100000L \|\| defined(LIBRESSL_VERSION_NUMBER)
		27
		28	/* ecdh_method maintains unchanged layout between 0.9.8 and 1.0.2 */
		29
		30	@@ -156,7 +156,7 @@ static void alloc_ec_ex_index()
		31	{
		32	if (ec_ex_index == 0) {
		33	while (ec_ex_index == 0) /* Workaround for OpenSSL RT3710 */
		34	-#if OPENSSL_VERSION_NUMBER >= 0x10100002L
		35	+#if OPENSSL_VERSION_NUMBER >= 0x10100002L && !defined(LIBRESSL_VERSION_NUMBER)
		36	ec_ex_index = EC_KEY_get_ex_new_index(0, "libp11 ec_key",
		37	NULL, NULL, NULL);
		38	#else
		39	@@ -265,7 +265,7 @@ static EVP_PKEY *pkcs11_get_evp_key_ec(P
		40	EVP_PKEY_set1_EC_KEY(pk, ec); /* Also increments the ec ref count */
		41
		42	if (key->isPrivate) {
		43	-#if OPENSSL_VERSION_NUMBER >= 0x10100000L
		44	+#if OPENSSL_VERSION_NUMBER >= 0x10100000L && !defined(LIBRESSL_VERSION_NUMBER)
		45	EC_KEY_set_method(ec, PKCS11_get_ec_key_method());
		46	#else
		47	ECDSA_set_method(ec, PKCS11_get_ecdsa_method());
		48	@@ -275,7 +275,7 @@ static EVP_PKEY *pkcs11_get_evp_key_ec(P
		49	/* TODO: Retrieve the ECDSA private key object attributes instead,
		50	* unless the key has the "sensitive" attribute set */
		51
		52	-#if OPENSSL_VERSION_NUMBER >= 0x10100000L
		53	+#if OPENSSL_VERSION_NUMBER >= 0x10100000L && !defined(LIBRESSL_VERSION_NUMBER)
		54	EC_KEY_set_ex_data(ec, ec_ex_index, key);
		55	#else
		56	ECDSA_set_ex_data(ec, ec_ex_index, key);
		57	@@ -345,14 +345,14 @@ static ECDSA_SIG *pkcs11_ecdsa_sign_sig(
		58	(void)kinv; /* Precomputed values are not used for PKCS#11 */
		59	(void)rp; /* Precomputed values are not used for PKCS#11 */
		60
		61	-#if OPENSSL_VERSION_NUMBER >= 0x10100000L
		62	+#if OPENSSL_VERSION_NUMBER >= 0x10100000L && !defined(LIBRESSL_VERSION_NUMBER)
		63	key = (PKCS11_KEY *)EC_KEY_get_ex_data(ec, ec_ex_index);
		64	#else
65	key = (PKCS11_KEY *)ECDSA_get_ex_data(ec, ec_ex_index);
66	#endif
67	if (key == NULL) {
68	sign_sig_fn orig_sign_sig;
69	-#if OPENSSL_VERSION_NUMBER >= 0x10100000L
70	+#if OPENSSL_VERSION_NUMBER >= 0x10100000L && !defined(LIBRESSL_VERSION_NUMBER)
71	const EC_KEY_METHOD *meth = EC_KEY_OpenSSL();
72	EC_KEY_METHOD_get_sign((EC_KEY_METHOD *)meth,
73	NULL, NULL, &orig_sign_sig);
74	@@ -385,7 +385,7 @@ static ECDSA_SIG *pkcs11_ecdsa_sign_sig(
75	sig = ECDSA_SIG_new();
76	if (sig == NULL)
77	return NULL;
78	-#if OPENSSL_VERSION_NUMBER >= 0x10100000L
79	+#if OPENSSL_VERSION_NUMBER >= 0x10100000L && !defined(LIBRESSL_VERSION_NUMBER)
80	ECDSA_SIG_set0(sig, r, s);
81	#else
82	BN_free(sig->r);
83	@@ -515,7 +515,7 @@ static int pkcs11_ecdh_derive(unsigned c
84	return 0;
85	}
86
87	-#if OPENSSL_VERSION_NUMBER >= 0x10100004L
88	+#if OPENSSL_VERSION_NUMBER >= 0x10100004L && !defined(LIBRESSL_VERSION_NUMBER)
89
90	/**
91	* ECDH key derivation method (replaces ossl_ecdh_compute_key)
92	@@ -578,7 +578,7 @@ static int pkcs11_ec_ckey(void *out, siz
93	size_t buflen;
94	int rv;
95
96	-#if OPENSSL_VERSION_NUMBER >= 0x10100000L
97	+#if OPENSSL_VERSION_NUMBER >= 0x10100000L && !defined(LIBRESSL_VERSION_NUMBER)
98	key = (PKCS11_KEY *)EC_KEY_get_ex_data(ecdh, ec_ex_index);
99	#else
100	key = (PKCS11_KEY )ECDSA_get_ex_data((EC_KEY )ecdh, ec_ex_index);
101	@@ -623,7 +623,7 @@ static int pkcs11_ec_ckey(void *out, siz
102	/* New way to allocate an ECDSA_METOD object */
103	/* OpenSSL 1.1 has single method EC_KEY_METHOD for ECDSA and ECDH */
104
105	-#if OPENSSL_VERSION_NUMBER >= 0x10100000L
106	+#if OPENSSL_VERSION_NUMBER >= 0x10100000L && !defined(LIBRESSL_VERSION_NUMBER)
107
108	EC_KEY_METHOD *PKCS11_get_ec_key_method(void)
109	{

Line 0 Link Here

(-)security/libp11/files/patch-src_p11__key.c (+47 lines)
	1	--- src/p11_key.c.orig 2017-01-26 21:19:45 UTC
	2	+++ src/p11_key.c
	3	@@ -138,7 +138,7 @@ int pkcs11_generate_key(PKCS11_TOKEN *to
	4	EVP_PKEY *pk;
	5	RSA *rsa;
	6	BIO *err;
	7	-#if OPENSSL_VERSION_NUMBER >= 0x10100000L
	8	+#if OPENSSL_VERSION_NUMBER >= 0x10100000L && !defined(LIBRESSL_VERSION_NUMBER)
	9	BIGNUM *exp = NULL;
	10	BN_GENCB *gencb = NULL;
	11	#endif
	12	@@ -151,7 +151,7 @@ int pkcs11_generate_key(PKCS11_TOKEN *to
	13
	14	err = BIO_new_fp(stderr, BIO_NOCLOSE);
	15
	16	-#if OPENSSL_VERSION_NUMBER >= 0x10100000L
	17	+#if OPENSSL_VERSION_NUMBER >= 0x10100000L && !defined(LIBRESSL_VERSION_NUMBER)
	18	exp = BN_new();
	19	rsa = RSA_new();
	20	gencb = BN_GENCB_new();
	21	@@ -247,7 +247,7 @@ static int pkcs11_store_key(PKCS11_TOKEN
	22	pkcs11_addattr_bool(attrs + n++, CKA_VERIFY, TRUE);
	23	pkcs11_addattr_bool(attrs + n++, CKA_WRAP, TRUE);
	24	}
	25	-#if OPENSSL_VERSION_NUMBER >= 0x10100003L
	26	+#if OPENSSL_VERSION_NUMBER >= 0x10100003L && !defined(LIBRESSL_VERSION_NUMBER)
	27	if (EVP_PKEY_base_id(pk) == EVP_PKEY_RSA) {
	28	RSA *rsa = EVP_PKEY_get1_RSA(pk);
	29	#else
	30	@@ -255,7 +255,7 @@ static int pkcs11_store_key(PKCS11_TOKEN
	31	RSA *rsa = pk->pkey.rsa;
	32	#endif
	33	pkcs11_addattr_int(attrs + n++, CKA_KEY_TYPE, CKK_RSA);
	34	-#if OPENSSL_VERSION_NUMBER >= 0x10100005L
	35	+#if OPENSSL_VERSION_NUMBER >= 0x10100005L && !defined(LIBRESSL_VERSION_NUMBER)
	36	RSA_get0_key(rsa, &rsa_n, &rsa_e, &rsa_d);
	37	RSA_get0_factors(rsa, &rsa_p, &rsa_q);
	38	#else
	39	@@ -325,7 +325,7 @@ EVP_PKEY pkcs11_get_key(PKCS11_KEY key
	40	fprintf(stderr, "Missing CKA_ALWAYS_AUTHENTICATE attribute\n");
	41	}
	42	}
	43	-#if OPENSSL_VERSION_NUMBER >= 0x10100000L
	44	+#if OPENSSL_VERSION_NUMBER >= 0x10100000L && !defined(LIBRESSL_VERSION_NUMBER)
	45	EVP_PKEY_up_ref(key->evp_key);
	46	#else
	47	CRYPTO_add(&key->evp_key->references, 1, CRYPTO_LOCK_EVP_PKEY);

Line 0 Link Here

(-)security/libp11/files/patch-src_p11__rsa.c (+65 lines)
		1	--- src/p11_rsa.c.orig 2017-01-26 21:19:45 UTC
		2	+++ src/p11_rsa.c
		3	@@ -29,7 +29,7 @@
		4
		5	static int rsa_ex_index = 0;
		6
		7	-#if OPENSSL_VERSION_NUMBER < 0x10100003L
		8	+#if OPENSSL_VERSION_NUMBER < 0x10100003L \|\| defined(LIBRESSL_VERSION_NUMBER)
		9	#define EVP_PKEY_get0_RSA(key) ((key)->pkey.rsa)
		10	#endif
		11
		12	@@ -226,7 +226,7 @@ failure:
		13	return NULL;
		14
		15	success:
		16	-#if OPENSSL_VERSION_NUMBER >= 0x10100005L
		17	+#if OPENSSL_VERSION_NUMBER >= 0x10100005L && !defined(LIBRESSL_VERSION_NUMBER)
		18	RSA_set0_key(rsa, rsa_n, rsa_e, NULL);
		19	#else
		20	rsa->n=rsa_n;
		21	@@ -275,7 +275,7 @@ int pkcs11_get_key_modulus(PKCS11_KEY *k
		22
		23	if (rsa == NULL)
		24	return 0;
		25	-#if OPENSSL_VERSION_NUMBER >= 0x10100005L
		26	+#if OPENSSL_VERSION_NUMBER >= 0x10100005L && !defined(LIBRESSL_VERSION_NUMBER)
		27	RSA_get0_key(rsa, &rsa_n, NULL, NULL);
		28	#else
		29	rsa_n=rsa->n;
		30	@@ -292,7 +292,7 @@ int pkcs11_get_key_exponent(PKCS11_KEY *
		31
		32	if (rsa == NULL)
		33	return 0;
		34	-#if OPENSSL_VERSION_NUMBER >= 0x10100005L
		35	+#if OPENSSL_VERSION_NUMBER >= 0x10100005L && !defined(LIBRESSL_VERSION_NUMBER)
		36	RSA_get0_key(rsa, NULL, &rsa_e, NULL);
		37	#else
		38	rsa_e=rsa->e;
		39	@@ -310,7 +310,7 @@ int pkcs11_get_key_size(PKCS11_KEY *key)
		40	return RSA_size(rsa);
		41	}
		42
		43	-#if OPENSSL_VERSION_NUMBER < 0x10100005L
		44	+#if OPENSSL_VERSION_NUMBER < 0x10100005L \|\| defined(LIBRESSL_VERSION_NUMBER)
		45
		46	int (RSA_meth_get_priv_enc(const RSA_METHOD meth))
		47	(int flen, const unsigned char *from,
		48	@@ -374,7 +374,7 @@ static void alloc_rsa_ex_index()
		49	static void free_rsa_ex_index()
		50	{
		51	/* CRYPTO_free_ex_index requires OpenSSL version >= 1.1.0-pre1 */
		52	-#if OPENSSL_VERSION_NUMBER >= 0x10100001L
		53	+#if OPENSSL_VERSION_NUMBER >= 0x10100001L && !defined(LIBRESSL_VERSION_NUMBER)
		54	if (rsa_ex_index > 0) {
		55	CRYPTO_free_ex_index(CRYPTO_EX_INDEX_RSA, rsa_ex_index);
		56	rsa_ex_index = 0;
		57	@@ -382,7 +382,7 @@ static void free_rsa_ex_index()
		58	#endif
		59	}
		60
		61	-#if OPENSSL_VERSION_NUMBER < 0x10100005L
		62	+#if OPENSSL_VERSION_NUMBER < 0x10100005L \|\| defined(LIBRESSL_VERSION_NUMBER)
		63
		64	static RSA_METHOD RSA_meth_dup(const RSA_METHOD meth)
65	{