Re: [edk2] [Patch] CryptoPkg/OpensslLib: Upgrade OpenSSL version to 1.0.2g

2016-03-11 Thread David Woodhouse 
On Fri, 2016-03-11 at 00:20 -0800, Qin Long wrote:
> OpenSSL 1.0.2g was released with several severity fixes at
> 01-Mar-2016(https://www.openssl.org/news/secadv/20160301.txt).
> Upgrade the supported OpenSSL version in CryptoPkg/OpensslLib to
> catch the latest release 1.0.2g.
> (NOTE: RT4175 from David Woodhouse was included in 1.0.2g. The
>    new-generated patch will remove this part. And the line
>    endings were still kept as before in this version for
>    consistency)
> 
> CC: David Woodhouse 
> CC: Ting Ye 
> Contributed-under: TianoCore Contribution Agreement 1.0
> Signed-off-by: Qin Long 

Secure boot seems to work in OVMF using Laszlo's instructions (thanks
again). As does the Cryptest applications.

Reviewed-by: David Woodhouse 

-- 
-- 
David WoodhouseOpen Source Technology Centre
david.woodho...@intel.com  Intel Corporation



smime.p7s
Description: S/MIME cryptographic signature
___
edk2-devel mailing list
edk2-devel@lists.01.org
https://lists.01.org/mailman/listinfo/edk2-devel

[edk2] [Patch] CryptoPkg/OpensslLib: Upgrade OpenSSL version to 1.0.2g

2016-03-11 Thread Qin Long 
OpenSSL 1.0.2g was released with several severity fixes at
01-Mar-2016(https://www.openssl.org/news/secadv/20160301.txt).
Upgrade the supported OpenSSL version in CryptoPkg/OpensslLib to
catch the latest release 1.0.2g.
(NOTE: RT4175 from David Woodhouse was included in 1.0.2g. The
   new-generated patch will remove this part. And the line
   endings were still kept as before in this version for
   consistency)

CC: David Woodhouse 
CC: Ting Ye 
Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Qin Long 
---
 CryptoPkg/CryptoPkg.dec|  2 +-
 ...ssl-1.0.2f.patch => EDKII_openssl-1.0.2g.patch} | 95 --
 CryptoPkg/Library/OpensslLib/Install.cmd   |  2 +-
 CryptoPkg/Library/OpensslLib/Install.sh|  2 +-
 CryptoPkg/Library/OpensslLib/OpensslLib.inf|  2 +-
 CryptoPkg/Library/OpensslLib/Patch-HOWTO.txt   | 26 +++---
 CryptoPkg/Library/OpensslLib/opensslconf.h |  6 ++
 7 files changed, 56 insertions(+), 79 deletions(-)
 rename CryptoPkg/Library/OpensslLib/{EDKII_openssl-1.0.2f.patch => 
EDKII_openssl-1.0.2g.patch} (94%)

diff --git a/CryptoPkg/CryptoPkg.dec b/CryptoPkg/CryptoPkg.dec
index 82d24f5..e1cdb8e 100644
--- a/CryptoPkg/CryptoPkg.dec
+++ b/CryptoPkg/CryptoPkg.dec
@@ -24,7 +24,7 @@
 
 [Includes]
   Include
-  Library/OpensslLib/openssl-1.0.2f/include
+  Library/OpensslLib/openssl-1.0.2g/include
 
 [LibraryClasses]
   ##  @libraryclass  Provides basic library functions for cryptographic 
primitives.
diff --git a/CryptoPkg/Library/OpensslLib/EDKII_openssl-1.0.2f.patch 
b/CryptoPkg/Library/OpensslLib/EDKII_openssl-1.0.2g.patch
similarity index 94%
rename from CryptoPkg/Library/OpensslLib/EDKII_openssl-1.0.2f.patch
rename to CryptoPkg/Library/OpensslLib/EDKII_openssl-1.0.2g.patch
index b799bf2..25dbebc 100644
--- a/CryptoPkg/Library/OpensslLib/EDKII_openssl-1.0.2f.patch
+++ b/CryptoPkg/Library/OpensslLib/EDKII_openssl-1.0.2g.patch
@@ -1,8 +1,8 @@
 diff --git a/Configure b/Configure
-index 4a715dc..b4a4781 100755
+index c98107a..c122709 100755
 --- a/Configure
 +++ b/Configure
-@@ -605,6 +605,9 @@ my %table=(
+@@ -609,6 +609,9 @@ my %table=(
  # with itself, Applink is never engaged and can as well be omitted.
  "mingw64", "gcc:-mno-cygwin -DL_ENDIAN -O3 -Wall -DWIN32_LEAN_AND_MEAN 
-DUNICODE -D_UNICODE::-D_MT:MINGW64:-lws2_32 -lgdi32 -lcrypt32:SIXTY_FOUR_BIT 
RC4_CHUNK_LL DES_INT 
EXPORT_VAR_AS_FN:${x86_64_asm}:mingw64:win32:cygwin-shared:-D_WINDLL:-mno-cygwin:.dll.a",
  
@@ -12,7 +12,7 @@ index 4a715dc..b4a4781 100755
  # UWIN 
  "UWIN", "cc:-DTERMIOS -DL_ENDIAN -O -Wall:::UWIN::BN_LLONG ${x86_gcc_des} 
${x86_gcc_opts}:${no_asm}:win32",
  
-@@ -1082,7 +1085,7 @@ if (defined($disabled{"tls1"}))
+@@ -1088,7 +1091,7 @@ if (defined($disabled{"tls1"}))
}
  
  if (defined($disabled{"ec"}) || defined($disabled{"dsa"})
@@ -22,7 +22,7 @@ index 4a715dc..b4a4781 100755
$disabled{"gost"} = "forced";
}
 diff --git a/apps/apps.c b/apps/apps.c
-index 2e77805..e21e759 100644
+index b1dd970..8278c28 100644
 --- a/apps/apps.c
 +++ b/apps/apps.c
 @@ -2374,6 +2374,8 @@ int args_verify(char ***pargs, int *pargc,
@@ -462,7 +462,7 @@ index c042cf2..a25b636 100644
  }
  
 diff --git a/crypto/cryptlib.c b/crypto/cryptlib.c
-index c9f674b..39ead7f 100644
+index 1925428..da4b34d 100644
 --- a/crypto/cryptlib.c
 +++ b/crypto/cryptlib.c
 @@ -263,7 +263,7 @@ int CRYPTO_get_new_dynlockid(void)
@@ -525,7 +525,7 @@ index c9f674b..39ead7f 100644
  }
 +#endif
  
- int CRYPTO_memcmp(const void *in_a, const void *in_b, size_t len)
+ int CRYPTO_memcmp(const volatile void *in_a, const volatile void *in_b, 
size_t len)
  {
 diff --git a/crypto/cryptlib.h b/crypto/cryptlib.h
 index fba180a..3e3ea5e 100644
@@ -542,7 +542,7 @@ index fba180a..3e3ea5e 100644
  
  #ifdef  __cplusplus
 diff --git a/crypto/crypto.h b/crypto/crypto.h
-index c450d7a..063d78e 100644
+index 6c644ce..bea4ca1 100644
 --- a/crypto/crypto.h
 +++ b/crypto/crypto.h
 @@ -235,15 +235,15 @@ typedef struct openssl_item_st {
@@ -656,7 +656,7 @@ index 46fa5ac..cc366ec 100644
  dh_kdf.o: ../../include/openssl/crypto.h ../../include/openssl/dh.h
  dh_kdf.o: ../../include/openssl/e_os2.h ../../include/openssl/ec.h
 diff --git a/crypto/dh/dh.h b/crypto/dh/dh.h
-index 5498a9d..4a5c665 100644
+index a5bd901..6488879 100644
 --- a/crypto/dh/dh.h
 +++ b/crypto/dh/dh.h
 @@ -240,11 +240,13 @@ DH *DH_get_1024_160(void);
@@ -1021,7 +1021,7 @@ index 5747c73..fe465cc 100644
   * These functions write a private key in PKCS#8 format: it is a "drop in"
   * replacement for PEM_write_bio_PrivateKey() and friends. As usual if 'enc'
 diff --git a/crypto/pkcs7/pk7_smime.c b/crypto/pkcs7/pk7_smime.c
-index c4d3724..0bc3d43 100644
+index dc9b484..0bc3d43 100644
 --- a/crypto/pkcs7/pk7_smime.c
 +++ b/crypto/pkcs7/pk7_smime.c
 @@ -64,6 +64,9 @@
@@ -1043,37 +1043,7 @@ index c4d3724..0bc3d43 100644
  int i,