Index: user/cperciva/freebsd-update-build/patches/10.0-BETA1/1-EN-13:04.freebsd-update =================================================================== --- user/cperciva/freebsd-update-build/patches/10.0-BETA1/1-EN-13:04.freebsd-update (nonexistent) +++ user/cperciva/freebsd-update-build/patches/10.0-BETA1/1-EN-13:04.freebsd-update (revision 293366) @@ -0,0 +1,78 @@ +Index: usr.sbin/freebsd-update/freebsd-update.sh +=================================================================== +--- usr.sbin/freebsd-update/freebsd-update.sh ++++ usr.sbin/freebsd-update/freebsd-update.sh +@@ -1200,7 +1200,7 @@ + # Some aliases to save space later: ${P} is a character which can + # appear in a path; ${M} is the four numeric metadata fields; and + # ${H} is a sha256 hash. +- P="[-+./:=%@_[[:alnum:]]" ++ P="[-+./:=%@_[~[:alnum:]]" + M="[0-9]+\|[0-9]+\|[0-9]+\|[0-9]+" + H="[0-9a-f]{64}" + +@@ -2814,16 +2814,24 @@ + + # If we haven't already dealt with the world, deal with it. + if ! [ -f $1/worlddone ]; then ++ # Create any necessary directories first ++ grep -vE '^/boot/' $1/INDEX-NEW | ++ grep -E '^[^|]+\|d\|' > INDEX-NEW ++ install_from_index INDEX-NEW || return 1 ++ + # Install new shared libraries next + grep -vE '^/boot/' $1/INDEX-NEW | +- grep -E '/lib/.*\.so\.[0-9]+\|' > INDEX-NEW ++ grep -vE '^[^|]+\|d\|' | ++ grep -E '^[^|]*/lib/[^|]*\.so\.[0-9]+\|' > INDEX-NEW + install_from_index INDEX-NEW || return 1 + + # Deal with everything else + grep -vE '^/boot/' $1/INDEX-OLD | +- grep -vE '/lib/.*\.so\.[0-9]+\|' > INDEX-OLD ++ grep -vE '^[^|]+\|d\|' | ++ grep -vE '^[^|]*/lib/[^|]*\.so\.[0-9]+\|' > INDEX-OLD + grep -vE '^/boot/' $1/INDEX-NEW | +- grep -vE '/lib/.*\.so\.[0-9]+\|' > INDEX-NEW ++ grep -vE '^[^|]+\|d\|' | ++ grep -vE '^[^|]*/lib/[^|]*\.so\.[0-9]+\|' > INDEX-NEW + install_from_index INDEX-NEW || return 1 + install_delete INDEX-OLD INDEX-NEW || return 1 + +@@ -2844,11 +2852,11 @@ + + # Do we need to ask the user to portupgrade now? + grep -vE '^/boot/' $1/INDEX-NEW | +- grep -E '/lib/.*\.so\.[0-9]+\|' | ++ grep -E '^[^|]*/lib/[^|]*\.so\.[0-9]+\|' | + cut -f 1 -d '|' | + sort > newfiles + if grep -vE '^/boot/' $1/INDEX-OLD | +- grep -E '/lib/.*\.so\.[0-9]+\|' | ++ grep -E '^[^|]*/lib/[^|]*\.so\.[0-9]+\|' | + cut -f 1 -d '|' | + sort | + join -v 1 - newfiles | +@@ -2868,11 +2876,20 @@ + + # Remove old shared libraries + grep -vE '^/boot/' $1/INDEX-NEW | +- grep -E '/lib/.*\.so\.[0-9]+\|' > INDEX-NEW ++ grep -vE '^[^|]+\|d\|' | ++ grep -E '^[^|]*/lib/[^|]*\.so\.[0-9]+\|' > INDEX-NEW + grep -vE '^/boot/' $1/INDEX-OLD | +- grep -E '/lib/.*\.so\.[0-9]+\|' > INDEX-OLD ++ grep -vE '^[^|]+\|d\|' | ++ grep -E '^[^|]*/lib/[^|]*\.so\.[0-9]+\|' > INDEX-OLD + install_delete INDEX-OLD INDEX-NEW || return 1 + ++ # Remove old directories ++ grep -vE '^/boot/' $1/INDEX-OLD | ++ grep -E '^[^|]+\|d\|' > INDEX-OLD ++ grep -vE '^/boot/' $1/INDEX-OLD | ++ grep -E '^[^|]+\|d\|' > INDEX-OLD ++ install_delete INDEX-OLD INDEX-NEW || return 1 ++ + # Remove temporary files + rm INDEX-OLD INDEX-NEW + } Index: user/cperciva/freebsd-update-build/patches/10.0-BETA1/2-SA-13:14.openssh =================================================================== --- user/cperciva/freebsd-update-build/patches/10.0-BETA1/2-SA-13:14.openssh (nonexistent) +++ user/cperciva/freebsd-update-build/patches/10.0-BETA1/2-SA-13:14.openssh (revision 293366) @@ -0,0 +1,13 @@ +Index: crypto/openssh/monitor_wrap.c +=================================================================== +--- crypto/openssh/monitor_wrap.c (revision 257864) ++++ crypto/openssh/monitor_wrap.c (working copy) +@@ -480,7 +480,7 @@ mm_newkeys_from_blob(u_char *blob, int blen) + buffer_init(&b); + buffer_append(&b, blob, blen); + +- newkey = xmalloc(sizeof(*newkey)); ++ newkey = xcalloc(1, sizeof(*newkey)); + enc = &newkey->enc; + mac = &newkey->mac; + comp = &newkey->comp; Index: user/cperciva/freebsd-update-build/patches/10.0-BETA1/3-EN-13:05.freebsd-update =================================================================== --- user/cperciva/freebsd-update-build/patches/10.0-BETA1/3-EN-13:05.freebsd-update (nonexistent) +++ user/cperciva/freebsd-update-build/patches/10.0-BETA1/3-EN-13:05.freebsd-update (revision 293366) @@ -0,0 +1,17 @@ +Index: usr.sbin/freebsd-update/freebsd-update.sh +=================================================================== +--- usr.sbin/freebsd-update/freebsd-update.sh (revision 257878) ++++ usr.sbin/freebsd-update/freebsd-update.sh (revision 257879) +@@ -2884,10 +2884,10 @@ + install_delete INDEX-OLD INDEX-NEW || return 1 + + # Remove old directories ++ grep -vE '^/boot/' $1/INDEX-NEW | ++ grep -E '^[^|]+\|d\|' > INDEX-NEW + grep -vE '^/boot/' $1/INDEX-OLD | + grep -E '^[^|]+\|d\|' > INDEX-OLD +- grep -vE '^/boot/' $1/INDEX-OLD | +- grep -E '^[^|]+\|d\|' > INDEX-OLD + install_delete INDEX-OLD INDEX-NEW || return 1 + + # Remove temporary files Index: user/cperciva/freebsd-update-build/patches/10.0-BETA2/1-SA-13:14.openssh =================================================================== --- user/cperciva/freebsd-update-build/patches/10.0-BETA2/1-SA-13:14.openssh (nonexistent) +++ user/cperciva/freebsd-update-build/patches/10.0-BETA2/1-SA-13:14.openssh (revision 293366) @@ -0,0 +1,13 @@ +Index: crypto/openssh/monitor_wrap.c +=================================================================== +--- crypto/openssh/monitor_wrap.c (revision 257864) ++++ crypto/openssh/monitor_wrap.c (working copy) +@@ -480,7 +480,7 @@ mm_newkeys_from_blob(u_char *blob, int blen) + buffer_init(&b); + buffer_append(&b, blob, blen); + +- newkey = xmalloc(sizeof(*newkey)); ++ newkey = xcalloc(1, sizeof(*newkey)); + enc = &newkey->enc; + mac = &newkey->mac; + comp = &newkey->comp; Index: user/cperciva/freebsd-update-build/patches/10.0-BETA2/2-EN-13:05.freebsd-update =================================================================== --- user/cperciva/freebsd-update-build/patches/10.0-BETA2/2-EN-13:05.freebsd-update (nonexistent) +++ user/cperciva/freebsd-update-build/patches/10.0-BETA2/2-EN-13:05.freebsd-update (revision 293366) @@ -0,0 +1,17 @@ +Index: usr.sbin/freebsd-update/freebsd-update.sh +=================================================================== +--- usr.sbin/freebsd-update/freebsd-update.sh (revision 257878) ++++ usr.sbin/freebsd-update/freebsd-update.sh (revision 257879) +@@ -2884,10 +2884,10 @@ + install_delete INDEX-OLD INDEX-NEW || return 1 + + # Remove old directories ++ grep -vE '^/boot/' $1/INDEX-NEW | ++ grep -E '^[^|]+\|d\|' > INDEX-NEW + grep -vE '^/boot/' $1/INDEX-OLD | + grep -E '^[^|]+\|d\|' > INDEX-OLD +- grep -vE '^/boot/' $1/INDEX-OLD | +- grep -E '^[^|]+\|d\|' > INDEX-OLD + install_delete INDEX-OLD INDEX-NEW || return 1 + + # Remove temporary files Index: user/cperciva/freebsd-update-build/patches/10.0-BETA3/1-SA-13:14.openssh =================================================================== --- user/cperciva/freebsd-update-build/patches/10.0-BETA3/1-SA-13:14.openssh (nonexistent) +++ user/cperciva/freebsd-update-build/patches/10.0-BETA3/1-SA-13:14.openssh (revision 293366) @@ -0,0 +1,13 @@ +Index: crypto/openssh/monitor_wrap.c +=================================================================== +--- crypto/openssh/monitor_wrap.c (revision 257864) ++++ crypto/openssh/monitor_wrap.c (working copy) +@@ -480,7 +480,7 @@ mm_newkeys_from_blob(u_char *blob, int blen) + buffer_init(&b); + buffer_append(&b, blob, blen); + +- newkey = xmalloc(sizeof(*newkey)); ++ newkey = xcalloc(1, sizeof(*newkey)); + enc = &newkey->enc; + mac = &newkey->mac; + comp = &newkey->comp; Index: user/cperciva/freebsd-update-build/patches/10.0-BETA3/2-EN-13:05.freebsd-update =================================================================== --- user/cperciva/freebsd-update-build/patches/10.0-BETA3/2-EN-13:05.freebsd-update (nonexistent) +++ user/cperciva/freebsd-update-build/patches/10.0-BETA3/2-EN-13:05.freebsd-update (revision 293366) @@ -0,0 +1,17 @@ +Index: usr.sbin/freebsd-update/freebsd-update.sh +=================================================================== +--- usr.sbin/freebsd-update/freebsd-update.sh (revision 257878) ++++ usr.sbin/freebsd-update/freebsd-update.sh (revision 257879) +@@ -2884,10 +2884,10 @@ + install_delete INDEX-OLD INDEX-NEW || return 1 + + # Remove old directories ++ grep -vE '^/boot/' $1/INDEX-NEW | ++ grep -E '^[^|]+\|d\|' > INDEX-NEW + grep -vE '^/boot/' $1/INDEX-OLD | + grep -E '^[^|]+\|d\|' > INDEX-OLD +- grep -vE '^/boot/' $1/INDEX-OLD | +- grep -E '^[^|]+\|d\|' > INDEX-OLD + install_delete INDEX-OLD INDEX-NEW || return 1 + + # Remove temporary files Index: user/cperciva/freebsd-update-build/patches/10.0-RC1/1-EN-14:02.mmap =================================================================== --- user/cperciva/freebsd-update-build/patches/10.0-RC1/1-EN-14:02.mmap (nonexistent) +++ user/cperciva/freebsd-update-build/patches/10.0-RC1/1-EN-14:02.mmap (revision 293366) @@ -0,0 +1,20 @@ +Index: sys/vm/vm_map.c +=================================================================== +--- sys/vm/vm_map.c (revision 259950) ++++ sys/vm/vm_map.c (revision 259951) +@@ -1207,6 +1207,7 @@ charged: + } + else if ((prev_entry != &map->header) && + (prev_entry->eflags == protoeflags) && ++ (cow & (MAP_ENTRY_GROWS_DOWN | MAP_ENTRY_GROWS_UP)) == 0 && + (prev_entry->end == start) && + (prev_entry->wired_count == 0) && + (prev_entry->cred == cred || +@@ -3339,7 +3340,6 @@ vm_map_stack(vm_map_t map, vm_offset_t addrbos, vm + * NOTE: We explicitly allow bi-directional stacks. + */ + orient = cow & (MAP_STACK_GROWS_DOWN|MAP_STACK_GROWS_UP); +- cow &= ~orient; + KASSERT(orient != 0, ("No stack grow direction")); + + if (addrbos < vm_map_min(map) || Index: user/cperciva/freebsd-update-build/patches/10.0-RC1/1-SA-14:01.bsnmpd =================================================================== --- user/cperciva/freebsd-update-build/patches/10.0-RC1/1-SA-14:01.bsnmpd (nonexistent) +++ user/cperciva/freebsd-update-build/patches/10.0-RC1/1-SA-14:01.bsnmpd (revision 293366) @@ -0,0 +1,16 @@ +Index: contrib/bsnmp/lib/snmpagent.c +=================================================================== +--- contrib/bsnmp/lib/snmpagent.c (revision 259661) ++++ contrib/bsnmp/lib/snmpagent.c (working copy) +@@ -488,6 +488,11 @@ snmp_getbulk(struct snmp_pdu *pdu, struct asn_buf + for (cnt = 0; cnt < pdu->error_index; cnt++) { + eomib = 1; + for (i = non_rep; i < pdu->nbindings; i++) { ++ ++ if (resp->nbindings == SNMP_MAX_BINDINGS) ++ /* PDU is full */ ++ goto done; ++ + if (cnt == 0) + result = do_getnext(&context, &pdu->bindings[i], + &resp->bindings[resp->nbindings], pdu); Index: user/cperciva/freebsd-update-build/patches/10.0-RC1/1-SA-14:02.ntpd =================================================================== --- user/cperciva/freebsd-update-build/patches/10.0-RC1/1-SA-14:02.ntpd (nonexistent) +++ user/cperciva/freebsd-update-build/patches/10.0-RC1/1-SA-14:02.ntpd (revision 293366) @@ -0,0 +1,13 @@ +Index: contrib/ntp/ntpd/ntp_config.c +=================================================================== +--- contrib/ntp/ntpd/ntp_config.c (revision 259828) ++++ contrib/ntp/ntpd/ntp_config.c (working copy) +@@ -597,6 +597,8 @@ getconfig( + #endif /* not SYS_WINNT */ + } + ++ proto_config(PROTO_MONITOR, 0, 0., NULL); ++ + for (;;) { + if (tok == CONFIG_END) + break; Index: user/cperciva/freebsd-update-build/patches/10.0-RC1/1-SA-14:03.openssl =================================================================== --- user/cperciva/freebsd-update-build/patches/10.0-RC1/1-SA-14:03.openssl (nonexistent) +++ user/cperciva/freebsd-update-build/patches/10.0-RC1/1-SA-14:03.openssl (revision 293366) @@ -0,0 +1,91 @@ +Index: crypto/openssl/ssl/d1_both.c +=================================================================== +--- crypto/openssl/ssl/d1_both.c (revision 260378) ++++ crypto/openssl/ssl/d1_both.c (working copy) +@@ -214,6 +214,12 @@ dtls1_hm_fragment_new(unsigned long frag_len, int + static void + dtls1_hm_fragment_free(hm_fragment *frag) + { ++ ++ if (frag->msg_header.is_ccs) ++ { ++ EVP_CIPHER_CTX_free(frag->msg_header.saved_retransmit_state.enc_write_ctx); ++ EVP_MD_CTX_destroy(frag->msg_header.saved_retransmit_state.write_hash); ++ } + if (frag->fragment) OPENSSL_free(frag->fragment); + if (frag->reassembly) OPENSSL_free(frag->reassembly); + OPENSSL_free(frag); +Index: crypto/openssl/ssl/s3_both.c +=================================================================== +--- crypto/openssl/ssl/s3_both.c (revision 260378) ++++ crypto/openssl/ssl/s3_both.c (working copy) +@@ -208,7 +208,11 @@ static void ssl3_take_mac(SSL *s) + { + const char *sender; + int slen; +- ++ /* If no new cipher setup return immediately: other functions will ++ * set the appropriate error. ++ */ ++ if (s->s3->tmp.new_cipher == NULL) ++ return; + if (s->state & SSL_ST_CONNECT) + { + sender=s->method->ssl3_enc->server_finished_label; +Index: crypto/openssl/ssl/s3_lib.c +=================================================================== +--- crypto/openssl/ssl/s3_lib.c (revision 260378) ++++ crypto/openssl/ssl/s3_lib.c (working copy) +@@ -4274,7 +4274,7 @@ need to go to SSL_ST_ACCEPT. + long ssl_get_algorithm2(SSL *s) + { + long alg2 = s->s3->tmp.new_cipher->algorithm2; +- if (TLS1_get_version(s) >= TLS1_2_VERSION && ++ if (s->method->version == TLS1_2_VERSION && + alg2 == (SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF)) + return SSL_HANDSHAKE_MAC_SHA256 | TLS1_PRF_SHA256; + return alg2; +Index: crypto/openssl/ssl/ssl_locl.h +=================================================================== +--- crypto/openssl/ssl/ssl_locl.h (revision 260378) ++++ crypto/openssl/ssl/ssl_locl.h (working copy) +@@ -621,6 +621,8 @@ extern SSL3_ENC_METHOD TLSv1_enc_data; + extern SSL3_ENC_METHOD SSLv3_enc_data; + extern SSL3_ENC_METHOD DTLSv1_enc_data; + ++#define SSL_IS_DTLS(s) (s->method->version == DTLS1_VERSION) ++ + #define IMPLEMENT_tls_meth_func(version, func_name, s_accept, s_connect, \ + s_get_meth) \ + const SSL_METHOD *func_name(void) \ +Index: crypto/openssl/ssl/t1_enc.c +=================================================================== +--- crypto/openssl/ssl/t1_enc.c (revision 260378) ++++ crypto/openssl/ssl/t1_enc.c (working copy) +@@ -414,15 +414,20 @@ int tls1_change_cipher_state(SSL *s, int which) + s->mac_flags |= SSL_MAC_FLAG_WRITE_MAC_STREAM; + else + s->mac_flags &= ~SSL_MAC_FLAG_WRITE_MAC_STREAM; +- if (s->enc_write_ctx != NULL) ++ if (s->enc_write_ctx != NULL && !SSL_IS_DTLS(s)) + reuse_dd = 1; +- else if ((s->enc_write_ctx=OPENSSL_malloc(sizeof(EVP_CIPHER_CTX))) == NULL) ++ else if ((s->enc_write_ctx=EVP_CIPHER_CTX_new()) == NULL) + goto err; ++ dd= s->enc_write_ctx; ++ if (SSL_IS_DTLS(s)) ++ { ++ mac_ctx = EVP_MD_CTX_create(); ++ if (!mac_ctx) ++ goto err; ++ s->write_hash = mac_ctx; ++ } + else +- /* make sure it's intialized in case we exit later with an error */ +- EVP_CIPHER_CTX_init(s->enc_write_ctx); +- dd= s->enc_write_ctx; +- mac_ctx = ssl_replace_hash(&s->write_hash,NULL); ++ mac_ctx = ssl_replace_hash(&s->write_hash,NULL); + #ifndef OPENSSL_NO_COMP + if (s->compress != NULL) + { Index: user/cperciva/freebsd-update-build/patches/10.0-RC2/1-EN-14:02.mmap =================================================================== --- user/cperciva/freebsd-update-build/patches/10.0-RC2/1-EN-14:02.mmap (nonexistent) +++ user/cperciva/freebsd-update-build/patches/10.0-RC2/1-EN-14:02.mmap (revision 293366) @@ -0,0 +1,20 @@ +Index: sys/vm/vm_map.c +=================================================================== +--- sys/vm/vm_map.c (revision 259950) ++++ sys/vm/vm_map.c (revision 259951) +@@ -1207,6 +1207,7 @@ charged: + } + else if ((prev_entry != &map->header) && + (prev_entry->eflags == protoeflags) && ++ (cow & (MAP_ENTRY_GROWS_DOWN | MAP_ENTRY_GROWS_UP)) == 0 && + (prev_entry->end == start) && + (prev_entry->wired_count == 0) && + (prev_entry->cred == cred || +@@ -3339,7 +3340,6 @@ vm_map_stack(vm_map_t map, vm_offset_t addrbos, vm + * NOTE: We explicitly allow bi-directional stacks. + */ + orient = cow & (MAP_STACK_GROWS_DOWN|MAP_STACK_GROWS_UP); +- cow &= ~orient; + KASSERT(orient != 0, ("No stack grow direction")); + + if (addrbos < vm_map_min(map) || Index: user/cperciva/freebsd-update-build/patches/10.0-RC2/1-SA-14:01.bsnmpd =================================================================== --- user/cperciva/freebsd-update-build/patches/10.0-RC2/1-SA-14:01.bsnmpd (nonexistent) +++ user/cperciva/freebsd-update-build/patches/10.0-RC2/1-SA-14:01.bsnmpd (revision 293366) @@ -0,0 +1,16 @@ +Index: contrib/bsnmp/lib/snmpagent.c +=================================================================== +--- contrib/bsnmp/lib/snmpagent.c (revision 259661) ++++ contrib/bsnmp/lib/snmpagent.c (working copy) +@@ -488,6 +488,11 @@ snmp_getbulk(struct snmp_pdu *pdu, struct asn_buf + for (cnt = 0; cnt < pdu->error_index; cnt++) { + eomib = 1; + for (i = non_rep; i < pdu->nbindings; i++) { ++ ++ if (resp->nbindings == SNMP_MAX_BINDINGS) ++ /* PDU is full */ ++ goto done; ++ + if (cnt == 0) + result = do_getnext(&context, &pdu->bindings[i], + &resp->bindings[resp->nbindings], pdu); Index: user/cperciva/freebsd-update-build/patches/10.0-RC2/1-SA-14:02.ntpd =================================================================== --- user/cperciva/freebsd-update-build/patches/10.0-RC2/1-SA-14:02.ntpd (nonexistent) +++ user/cperciva/freebsd-update-build/patches/10.0-RC2/1-SA-14:02.ntpd (revision 293366) @@ -0,0 +1,13 @@ +Index: contrib/ntp/ntpd/ntp_config.c +=================================================================== +--- contrib/ntp/ntpd/ntp_config.c (revision 259828) ++++ contrib/ntp/ntpd/ntp_config.c (working copy) +@@ -597,6 +597,8 @@ getconfig( + #endif /* not SYS_WINNT */ + } + ++ proto_config(PROTO_MONITOR, 0, 0., NULL); ++ + for (;;) { + if (tok == CONFIG_END) + break; Index: user/cperciva/freebsd-update-build/patches/10.0-RC2/1-SA-14:03.openssl =================================================================== --- user/cperciva/freebsd-update-build/patches/10.0-RC2/1-SA-14:03.openssl (nonexistent) +++ user/cperciva/freebsd-update-build/patches/10.0-RC2/1-SA-14:03.openssl (revision 293366) @@ -0,0 +1,91 @@ +Index: crypto/openssl/ssl/d1_both.c +=================================================================== +--- crypto/openssl/ssl/d1_both.c (revision 260378) ++++ crypto/openssl/ssl/d1_both.c (working copy) +@@ -214,6 +214,12 @@ dtls1_hm_fragment_new(unsigned long frag_len, int + static void + dtls1_hm_fragment_free(hm_fragment *frag) + { ++ ++ if (frag->msg_header.is_ccs) ++ { ++ EVP_CIPHER_CTX_free(frag->msg_header.saved_retransmit_state.enc_write_ctx); ++ EVP_MD_CTX_destroy(frag->msg_header.saved_retransmit_state.write_hash); ++ } + if (frag->fragment) OPENSSL_free(frag->fragment); + if (frag->reassembly) OPENSSL_free(frag->reassembly); + OPENSSL_free(frag); +Index: crypto/openssl/ssl/s3_both.c +=================================================================== +--- crypto/openssl/ssl/s3_both.c (revision 260378) ++++ crypto/openssl/ssl/s3_both.c (working copy) +@@ -208,7 +208,11 @@ static void ssl3_take_mac(SSL *s) + { + const char *sender; + int slen; +- ++ /* If no new cipher setup return immediately: other functions will ++ * set the appropriate error. ++ */ ++ if (s->s3->tmp.new_cipher == NULL) ++ return; + if (s->state & SSL_ST_CONNECT) + { + sender=s->method->ssl3_enc->server_finished_label; +Index: crypto/openssl/ssl/s3_lib.c +=================================================================== +--- crypto/openssl/ssl/s3_lib.c (revision 260378) ++++ crypto/openssl/ssl/s3_lib.c (working copy) +@@ -4274,7 +4274,7 @@ need to go to SSL_ST_ACCEPT. + long ssl_get_algorithm2(SSL *s) + { + long alg2 = s->s3->tmp.new_cipher->algorithm2; +- if (TLS1_get_version(s) >= TLS1_2_VERSION && ++ if (s->method->version == TLS1_2_VERSION && + alg2 == (SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF)) + return SSL_HANDSHAKE_MAC_SHA256 | TLS1_PRF_SHA256; + return alg2; +Index: crypto/openssl/ssl/ssl_locl.h +=================================================================== +--- crypto/openssl/ssl/ssl_locl.h (revision 260378) ++++ crypto/openssl/ssl/ssl_locl.h (working copy) +@@ -621,6 +621,8 @@ extern SSL3_ENC_METHOD TLSv1_enc_data; + extern SSL3_ENC_METHOD SSLv3_enc_data; + extern SSL3_ENC_METHOD DTLSv1_enc_data; + ++#define SSL_IS_DTLS(s) (s->method->version == DTLS1_VERSION) ++ + #define IMPLEMENT_tls_meth_func(version, func_name, s_accept, s_connect, \ + s_get_meth) \ + const SSL_METHOD *func_name(void) \ +Index: crypto/openssl/ssl/t1_enc.c +=================================================================== +--- crypto/openssl/ssl/t1_enc.c (revision 260378) ++++ crypto/openssl/ssl/t1_enc.c (working copy) +@@ -414,15 +414,20 @@ int tls1_change_cipher_state(SSL *s, int which) + s->mac_flags |= SSL_MAC_FLAG_WRITE_MAC_STREAM; + else + s->mac_flags &= ~SSL_MAC_FLAG_WRITE_MAC_STREAM; +- if (s->enc_write_ctx != NULL) ++ if (s->enc_write_ctx != NULL && !SSL_IS_DTLS(s)) + reuse_dd = 1; +- else if ((s->enc_write_ctx=OPENSSL_malloc(sizeof(EVP_CIPHER_CTX))) == NULL) ++ else if ((s->enc_write_ctx=EVP_CIPHER_CTX_new()) == NULL) + goto err; ++ dd= s->enc_write_ctx; ++ if (SSL_IS_DTLS(s)) ++ { ++ mac_ctx = EVP_MD_CTX_create(); ++ if (!mac_ctx) ++ goto err; ++ s->write_hash = mac_ctx; ++ } + else +- /* make sure it's intialized in case we exit later with an error */ +- EVP_CIPHER_CTX_init(s->enc_write_ctx); +- dd= s->enc_write_ctx; +- mac_ctx = ssl_replace_hash(&s->write_hash,NULL); ++ mac_ctx = ssl_replace_hash(&s->write_hash,NULL); + #ifndef OPENSSL_NO_COMP + if (s->compress != NULL) + { Index: user/cperciva/freebsd-update-build/patches/10.0-RC3/1-EN-14:02.mmap =================================================================== --- user/cperciva/freebsd-update-build/patches/10.0-RC3/1-EN-14:02.mmap (nonexistent) +++ user/cperciva/freebsd-update-build/patches/10.0-RC3/1-EN-14:02.mmap (revision 293366) @@ -0,0 +1,20 @@ +Index: sys/vm/vm_map.c +=================================================================== +--- sys/vm/vm_map.c (revision 259950) ++++ sys/vm/vm_map.c (revision 259951) +@@ -1207,6 +1207,7 @@ charged: + } + else if ((prev_entry != &map->header) && + (prev_entry->eflags == protoeflags) && ++ (cow & (MAP_ENTRY_GROWS_DOWN | MAP_ENTRY_GROWS_UP)) == 0 && + (prev_entry->end == start) && + (prev_entry->wired_count == 0) && + (prev_entry->cred == cred || +@@ -3339,7 +3340,6 @@ vm_map_stack(vm_map_t map, vm_offset_t addrbos, vm + * NOTE: We explicitly allow bi-directional stacks. + */ + orient = cow & (MAP_STACK_GROWS_DOWN|MAP_STACK_GROWS_UP); +- cow &= ~orient; + KASSERT(orient != 0, ("No stack grow direction")); + + if (addrbos < vm_map_min(map) || Index: user/cperciva/freebsd-update-build/patches/10.0-RC3/1-SA-14:01.bsnmpd =================================================================== --- user/cperciva/freebsd-update-build/patches/10.0-RC3/1-SA-14:01.bsnmpd (nonexistent) +++ user/cperciva/freebsd-update-build/patches/10.0-RC3/1-SA-14:01.bsnmpd (revision 293366) @@ -0,0 +1,16 @@ +Index: contrib/bsnmp/lib/snmpagent.c +=================================================================== +--- contrib/bsnmp/lib/snmpagent.c (revision 259661) ++++ contrib/bsnmp/lib/snmpagent.c (working copy) +@@ -488,6 +488,11 @@ snmp_getbulk(struct snmp_pdu *pdu, struct asn_buf + for (cnt = 0; cnt < pdu->error_index; cnt++) { + eomib = 1; + for (i = non_rep; i < pdu->nbindings; i++) { ++ ++ if (resp->nbindings == SNMP_MAX_BINDINGS) ++ /* PDU is full */ ++ goto done; ++ + if (cnt == 0) + result = do_getnext(&context, &pdu->bindings[i], + &resp->bindings[resp->nbindings], pdu); Index: user/cperciva/freebsd-update-build/patches/10.0-RC3/1-SA-14:02.ntpd =================================================================== --- user/cperciva/freebsd-update-build/patches/10.0-RC3/1-SA-14:02.ntpd (nonexistent) +++ user/cperciva/freebsd-update-build/patches/10.0-RC3/1-SA-14:02.ntpd (revision 293366) @@ -0,0 +1,13 @@ +Index: contrib/ntp/ntpd/ntp_config.c +=================================================================== +--- contrib/ntp/ntpd/ntp_config.c (revision 259828) ++++ contrib/ntp/ntpd/ntp_config.c (working copy) +@@ -597,6 +597,8 @@ getconfig( + #endif /* not SYS_WINNT */ + } + ++ proto_config(PROTO_MONITOR, 0, 0., NULL); ++ + for (;;) { + if (tok == CONFIG_END) + break; Index: user/cperciva/freebsd-update-build/patches/10.0-RC3/1-SA-14:03.openssl =================================================================== --- user/cperciva/freebsd-update-build/patches/10.0-RC3/1-SA-14:03.openssl (nonexistent) +++ user/cperciva/freebsd-update-build/patches/10.0-RC3/1-SA-14:03.openssl (revision 293366) @@ -0,0 +1,91 @@ +Index: crypto/openssl/ssl/d1_both.c +=================================================================== +--- crypto/openssl/ssl/d1_both.c (revision 260378) ++++ crypto/openssl/ssl/d1_both.c (working copy) +@@ -214,6 +214,12 @@ dtls1_hm_fragment_new(unsigned long frag_len, int + static void + dtls1_hm_fragment_free(hm_fragment *frag) + { ++ ++ if (frag->msg_header.is_ccs) ++ { ++ EVP_CIPHER_CTX_free(frag->msg_header.saved_retransmit_state.enc_write_ctx); ++ EVP_MD_CTX_destroy(frag->msg_header.saved_retransmit_state.write_hash); ++ } + if (frag->fragment) OPENSSL_free(frag->fragment); + if (frag->reassembly) OPENSSL_free(frag->reassembly); + OPENSSL_free(frag); +Index: crypto/openssl/ssl/s3_both.c +=================================================================== +--- crypto/openssl/ssl/s3_both.c (revision 260378) ++++ crypto/openssl/ssl/s3_both.c (working copy) +@@ -208,7 +208,11 @@ static void ssl3_take_mac(SSL *s) + { + const char *sender; + int slen; +- ++ /* If no new cipher setup return immediately: other functions will ++ * set the appropriate error. ++ */ ++ if (s->s3->tmp.new_cipher == NULL) ++ return; + if (s->state & SSL_ST_CONNECT) + { + sender=s->method->ssl3_enc->server_finished_label; +Index: crypto/openssl/ssl/s3_lib.c +=================================================================== +--- crypto/openssl/ssl/s3_lib.c (revision 260378) ++++ crypto/openssl/ssl/s3_lib.c (working copy) +@@ -4274,7 +4274,7 @@ need to go to SSL_ST_ACCEPT. + long ssl_get_algorithm2(SSL *s) + { + long alg2 = s->s3->tmp.new_cipher->algorithm2; +- if (TLS1_get_version(s) >= TLS1_2_VERSION && ++ if (s->method->version == TLS1_2_VERSION && + alg2 == (SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF)) + return SSL_HANDSHAKE_MAC_SHA256 | TLS1_PRF_SHA256; + return alg2; +Index: crypto/openssl/ssl/ssl_locl.h +=================================================================== +--- crypto/openssl/ssl/ssl_locl.h (revision 260378) ++++ crypto/openssl/ssl/ssl_locl.h (working copy) +@@ -621,6 +621,8 @@ extern SSL3_ENC_METHOD TLSv1_enc_data; + extern SSL3_ENC_METHOD SSLv3_enc_data; + extern SSL3_ENC_METHOD DTLSv1_enc_data; + ++#define SSL_IS_DTLS(s) (s->method->version == DTLS1_VERSION) ++ + #define IMPLEMENT_tls_meth_func(version, func_name, s_accept, s_connect, \ + s_get_meth) \ + const SSL_METHOD *func_name(void) \ +Index: crypto/openssl/ssl/t1_enc.c +=================================================================== +--- crypto/openssl/ssl/t1_enc.c (revision 260378) ++++ crypto/openssl/ssl/t1_enc.c (working copy) +@@ -414,15 +414,20 @@ int tls1_change_cipher_state(SSL *s, int which) + s->mac_flags |= SSL_MAC_FLAG_WRITE_MAC_STREAM; + else + s->mac_flags &= ~SSL_MAC_FLAG_WRITE_MAC_STREAM; +- if (s->enc_write_ctx != NULL) ++ if (s->enc_write_ctx != NULL && !SSL_IS_DTLS(s)) + reuse_dd = 1; +- else if ((s->enc_write_ctx=OPENSSL_malloc(sizeof(EVP_CIPHER_CTX))) == NULL) ++ else if ((s->enc_write_ctx=EVP_CIPHER_CTX_new()) == NULL) + goto err; ++ dd= s->enc_write_ctx; ++ if (SSL_IS_DTLS(s)) ++ { ++ mac_ctx = EVP_MD_CTX_create(); ++ if (!mac_ctx) ++ goto err; ++ s->write_hash = mac_ctx; ++ } + else +- /* make sure it's intialized in case we exit later with an error */ +- EVP_CIPHER_CTX_init(s->enc_write_ctx); +- dd= s->enc_write_ctx; +- mac_ctx = ssl_replace_hash(&s->write_hash,NULL); ++ mac_ctx = ssl_replace_hash(&s->write_hash,NULL); + #ifndef OPENSSL_NO_COMP + if (s->compress != NULL) + { Index: user/cperciva/freebsd-update-build/patches/10.0-RC4/1-SA-14:01.bsnmpd =================================================================== --- user/cperciva/freebsd-update-build/patches/10.0-RC4/1-SA-14:01.bsnmpd (nonexistent) +++ user/cperciva/freebsd-update-build/patches/10.0-RC4/1-SA-14:01.bsnmpd (revision 293366) @@ -0,0 +1,16 @@ +Index: contrib/bsnmp/lib/snmpagent.c +=================================================================== +--- contrib/bsnmp/lib/snmpagent.c (revision 259661) ++++ contrib/bsnmp/lib/snmpagent.c (working copy) +@@ -488,6 +488,11 @@ snmp_getbulk(struct snmp_pdu *pdu, struct asn_buf + for (cnt = 0; cnt < pdu->error_index; cnt++) { + eomib = 1; + for (i = non_rep; i < pdu->nbindings; i++) { ++ ++ if (resp->nbindings == SNMP_MAX_BINDINGS) ++ /* PDU is full */ ++ goto done; ++ + if (cnt == 0) + result = do_getnext(&context, &pdu->bindings[i], + &resp->bindings[resp->nbindings], pdu); Index: user/cperciva/freebsd-update-build/patches/10.0-RC4/1-SA-14:02.ntpd =================================================================== --- user/cperciva/freebsd-update-build/patches/10.0-RC4/1-SA-14:02.ntpd (nonexistent) +++ user/cperciva/freebsd-update-build/patches/10.0-RC4/1-SA-14:02.ntpd (revision 293366) @@ -0,0 +1,13 @@ +Index: contrib/ntp/ntpd/ntp_config.c +=================================================================== +--- contrib/ntp/ntpd/ntp_config.c (revision 259828) ++++ contrib/ntp/ntpd/ntp_config.c (working copy) +@@ -597,6 +597,8 @@ getconfig( + #endif /* not SYS_WINNT */ + } + ++ proto_config(PROTO_MONITOR, 0, 0., NULL); ++ + for (;;) { + if (tok == CONFIG_END) + break; Index: user/cperciva/freebsd-update-build/patches/10.0-RC4/1-SA-14:03.openssl =================================================================== --- user/cperciva/freebsd-update-build/patches/10.0-RC4/1-SA-14:03.openssl (nonexistent) +++ user/cperciva/freebsd-update-build/patches/10.0-RC4/1-SA-14:03.openssl (revision 293366) @@ -0,0 +1,91 @@ +Index: crypto/openssl/ssl/d1_both.c +=================================================================== +--- crypto/openssl/ssl/d1_both.c (revision 260378) ++++ crypto/openssl/ssl/d1_both.c (working copy) +@@ -214,6 +214,12 @@ dtls1_hm_fragment_new(unsigned long frag_len, int + static void + dtls1_hm_fragment_free(hm_fragment *frag) + { ++ ++ if (frag->msg_header.is_ccs) ++ { ++ EVP_CIPHER_CTX_free(frag->msg_header.saved_retransmit_state.enc_write_ctx); ++ EVP_MD_CTX_destroy(frag->msg_header.saved_retransmit_state.write_hash); ++ } + if (frag->fragment) OPENSSL_free(frag->fragment); + if (frag->reassembly) OPENSSL_free(frag->reassembly); + OPENSSL_free(frag); +Index: crypto/openssl/ssl/s3_both.c +=================================================================== +--- crypto/openssl/ssl/s3_both.c (revision 260378) ++++ crypto/openssl/ssl/s3_both.c (working copy) +@@ -208,7 +208,11 @@ static void ssl3_take_mac(SSL *s) + { + const char *sender; + int slen; +- ++ /* If no new cipher setup return immediately: other functions will ++ * set the appropriate error. ++ */ ++ if (s->s3->tmp.new_cipher == NULL) ++ return; + if (s->state & SSL_ST_CONNECT) + { + sender=s->method->ssl3_enc->server_finished_label; +Index: crypto/openssl/ssl/s3_lib.c +=================================================================== +--- crypto/openssl/ssl/s3_lib.c (revision 260378) ++++ crypto/openssl/ssl/s3_lib.c (working copy) +@@ -4274,7 +4274,7 @@ need to go to SSL_ST_ACCEPT. + long ssl_get_algorithm2(SSL *s) + { + long alg2 = s->s3->tmp.new_cipher->algorithm2; +- if (TLS1_get_version(s) >= TLS1_2_VERSION && ++ if (s->method->version == TLS1_2_VERSION && + alg2 == (SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF)) + return SSL_HANDSHAKE_MAC_SHA256 | TLS1_PRF_SHA256; + return alg2; +Index: crypto/openssl/ssl/ssl_locl.h +=================================================================== +--- crypto/openssl/ssl/ssl_locl.h (revision 260378) ++++ crypto/openssl/ssl/ssl_locl.h (working copy) +@@ -621,6 +621,8 @@ extern SSL3_ENC_METHOD TLSv1_enc_data; + extern SSL3_ENC_METHOD SSLv3_enc_data; + extern SSL3_ENC_METHOD DTLSv1_enc_data; + ++#define SSL_IS_DTLS(s) (s->method->version == DTLS1_VERSION) ++ + #define IMPLEMENT_tls_meth_func(version, func_name, s_accept, s_connect, \ + s_get_meth) \ + const SSL_METHOD *func_name(void) \ +Index: crypto/openssl/ssl/t1_enc.c +=================================================================== +--- crypto/openssl/ssl/t1_enc.c (revision 260378) ++++ crypto/openssl/ssl/t1_enc.c (working copy) +@@ -414,15 +414,20 @@ int tls1_change_cipher_state(SSL *s, int which) + s->mac_flags |= SSL_MAC_FLAG_WRITE_MAC_STREAM; + else + s->mac_flags &= ~SSL_MAC_FLAG_WRITE_MAC_STREAM; +- if (s->enc_write_ctx != NULL) ++ if (s->enc_write_ctx != NULL && !SSL_IS_DTLS(s)) + reuse_dd = 1; +- else if ((s->enc_write_ctx=OPENSSL_malloc(sizeof(EVP_CIPHER_CTX))) == NULL) ++ else if ((s->enc_write_ctx=EVP_CIPHER_CTX_new()) == NULL) + goto err; ++ dd= s->enc_write_ctx; ++ if (SSL_IS_DTLS(s)) ++ { ++ mac_ctx = EVP_MD_CTX_create(); ++ if (!mac_ctx) ++ goto err; ++ s->write_hash = mac_ctx; ++ } + else +- /* make sure it's intialized in case we exit later with an error */ +- EVP_CIPHER_CTX_init(s->enc_write_ctx); +- dd= s->enc_write_ctx; +- mac_ctx = ssl_replace_hash(&s->write_hash,NULL); ++ mac_ctx = ssl_replace_hash(&s->write_hash,NULL); + #ifndef OPENSSL_NO_COMP + if (s->compress != NULL) + { Index: user/cperciva/freebsd-update-build/patches/10.0-RC5/1-SA-14:01.bsnmpd =================================================================== --- user/cperciva/freebsd-update-build/patches/10.0-RC5/1-SA-14:01.bsnmpd (nonexistent) +++ user/cperciva/freebsd-update-build/patches/10.0-RC5/1-SA-14:01.bsnmpd (revision 293366) @@ -0,0 +1,16 @@ +Index: contrib/bsnmp/lib/snmpagent.c +=================================================================== +--- contrib/bsnmp/lib/snmpagent.c (revision 259661) ++++ contrib/bsnmp/lib/snmpagent.c (working copy) +@@ -488,6 +488,11 @@ snmp_getbulk(struct snmp_pdu *pdu, struct asn_buf + for (cnt = 0; cnt < pdu->error_index; cnt++) { + eomib = 1; + for (i = non_rep; i < pdu->nbindings; i++) { ++ ++ if (resp->nbindings == SNMP_MAX_BINDINGS) ++ /* PDU is full */ ++ goto done; ++ + if (cnt == 0) + result = do_getnext(&context, &pdu->bindings[i], + &resp->bindings[resp->nbindings], pdu); Index: user/cperciva/freebsd-update-build/patches/10.0-RC5/1-SA-14:02.ntpd =================================================================== --- user/cperciva/freebsd-update-build/patches/10.0-RC5/1-SA-14:02.ntpd (nonexistent) +++ user/cperciva/freebsd-update-build/patches/10.0-RC5/1-SA-14:02.ntpd (revision 293366) @@ -0,0 +1,13 @@ +Index: contrib/ntp/ntpd/ntp_config.c +=================================================================== +--- contrib/ntp/ntpd/ntp_config.c (revision 259828) ++++ contrib/ntp/ntpd/ntp_config.c (working copy) +@@ -597,6 +597,8 @@ getconfig( + #endif /* not SYS_WINNT */ + } + ++ proto_config(PROTO_MONITOR, 0, 0., NULL); ++ + for (;;) { + if (tok == CONFIG_END) + break; Index: user/cperciva/freebsd-update-build/patches/10.1-BETA1/1-SA-14:19.tcp =================================================================== --- user/cperciva/freebsd-update-build/patches/10.1-BETA1/1-SA-14:19.tcp (nonexistent) +++ user/cperciva/freebsd-update-build/patches/10.1-BETA1/1-SA-14:19.tcp (revision 293366) @@ -0,0 +1,17 @@ +Index: sys/netinet/tcp_input.c +=================================================================== +--- sys/netinet/tcp_input.c (revision 271383) ++++ sys/netinet/tcp_input.c (working copy) +@@ -2092,11 +2092,7 @@ tcp_do_segment(struct mbuf *m, struct tcphdr *th, + + todrop = tp->rcv_nxt - th->th_seq; + if (todrop > 0) { +- /* +- * If this is a duplicate SYN for our current connection, +- * advance over it and pretend and it's not a SYN. +- */ +- if (thflags & TH_SYN && th->th_seq == tp->irs) { ++ if (thflags & TH_SYN) { + thflags &= ~TH_SYN; + th->th_seq++; + if (th->th_urp > 1) Index: user/cperciva/freebsd-update-build/patches/10.1-BETA3/1-SA-14:20.rtsold =================================================================== --- user/cperciva/freebsd-update-build/patches/10.1-BETA3/1-SA-14:20.rtsold (nonexistent) +++ user/cperciva/freebsd-update-build/patches/10.1-BETA3/1-SA-14:20.rtsold (revision 293366) @@ -0,0 +1,14 @@ +Index: usr.sbin/rtsold/rtsol.c +=================================================================== +--- usr.sbin/rtsold/rtsol.c.orig ++++ usr.sbin/rtsold/rtsol.c +@@ -933,7 +933,8 @@ + dst_origin = dst; + memset(dst, '\0', dlen); + while (src && (len = (uint8_t)(*src++) & 0x3f) && +- (src + len) <= src_last) { ++ (src + len) <= src_last && ++ (dst - dst_origin < (ssize_t)dlen)) { + if (dst != dst_origin) + *dst++ = '.'; + warnmsg(LOG_DEBUG, __func__, "labellen = %zd", len); Index: user/cperciva/freebsd-update-build/patches/10.1-BETA3/1-SA-14:21.routed =================================================================== --- user/cperciva/freebsd-update-build/patches/10.1-BETA3/1-SA-14:21.routed (nonexistent) +++ user/cperciva/freebsd-update-build/patches/10.1-BETA3/1-SA-14:21.routed (revision 293366) @@ -0,0 +1,15 @@ +Index: sbin/routed/input.c +=================================================================== +--- sbin/routed/input.c.orig ++++ sbin/routed/input.c +@@ -288,6 +288,10 @@ + /* Answer a query from a utility program + * with all we know. + */ ++ if (aifp == NULL) { ++ trace_pkt("ignore remote query"); ++ return; ++ } + if (from->sin_port != htons(RIP_PORT)) { + supply(from, aifp, OUT_QUERY, 0, + rip->rip_vers, ap != 0); Index: user/cperciva/freebsd-update-build/patches/10.1-BETA3/1-SA-14:22.namei =================================================================== --- user/cperciva/freebsd-update-build/patches/10.1-BETA3/1-SA-14:22.namei (nonexistent) +++ user/cperciva/freebsd-update-build/patches/10.1-BETA3/1-SA-14:22.namei (revision 293366) @@ -0,0 +1,94 @@ +Index: sys/kern/vfs_lookup.c +=================================================================== +--- sys/kern/vfs_lookup.c (revision 273277) ++++ sys/kern/vfs_lookup.c (working copy) +@@ -121,6 +121,16 @@ + * if symbolic link, massage name in buffer and continue + * } + */ ++static void ++namei_cleanup_cnp(struct componentname *cnp) ++{ ++ uma_zfree(namei_zone, cnp->cn_pnbuf); ++#ifdef DIAGNOSTIC ++ cnp->cn_pnbuf = NULL; ++ cnp->cn_nameptr = NULL; ++#endif ++} ++ + int + namei(struct nameidata *ndp) + { +@@ -185,11 +195,7 @@ + } + #endif + if (error) { +- uma_zfree(namei_zone, cnp->cn_pnbuf); +-#ifdef DIAGNOSTIC +- cnp->cn_pnbuf = NULL; +- cnp->cn_nameptr = NULL; +-#endif ++ namei_cleanup_cnp(cnp); + ndp->ni_vp = NULL; + return (error); + } +@@ -256,11 +262,7 @@ + } + } + if (error) { +- uma_zfree(namei_zone, cnp->cn_pnbuf); +-#ifdef DIAGNOSTIC +- cnp->cn_pnbuf = NULL; +- cnp->cn_nameptr = NULL; +-#endif ++ namei_cleanup_cnp(cnp); + return (error); + } + } +@@ -286,6 +288,7 @@ + if (KTRPOINT(curthread, KTR_CAPFAIL)) + ktrcapfail(CAPFAIL_LOOKUP, NULL, NULL); + #endif ++ namei_cleanup_cnp(cnp); + return (ENOTCAPABLE); + } + while (*(cnp->cn_nameptr) == '/') { +@@ -298,11 +301,7 @@ + ndp->ni_startdir = dp; + error = lookup(ndp); + if (error) { +- uma_zfree(namei_zone, cnp->cn_pnbuf); +-#ifdef DIAGNOSTIC +- cnp->cn_pnbuf = NULL; +- cnp->cn_nameptr = NULL; +-#endif ++ namei_cleanup_cnp(cnp); + SDT_PROBE(vfs, namei, lookup, return, error, NULL, 0, + 0, 0); + return (error); +@@ -312,11 +311,7 @@ + */ + if ((cnp->cn_flags & ISSYMLINK) == 0) { + if ((cnp->cn_flags & (SAVENAME | SAVESTART)) == 0) { +- uma_zfree(namei_zone, cnp->cn_pnbuf); +-#ifdef DIAGNOSTIC +- cnp->cn_pnbuf = NULL; +- cnp->cn_nameptr = NULL; +-#endif ++ namei_cleanup_cnp(cnp); + } else + cnp->cn_flags |= HASBUF; + +@@ -378,11 +373,7 @@ + vput(ndp->ni_vp); + dp = ndp->ni_dvp; + } +- uma_zfree(namei_zone, cnp->cn_pnbuf); +-#ifdef DIAGNOSTIC +- cnp->cn_pnbuf = NULL; +- cnp->cn_nameptr = NULL; +-#endif ++ namei_cleanup_cnp(cnp); + vput(ndp->ni_vp); + ndp->ni_vp = NULL; + vrele(ndp->ni_dvp); Index: user/cperciva/freebsd-update-build/patches/10.1-BETA3/1-SA-14:23.openssl =================================================================== --- user/cperciva/freebsd-update-build/patches/10.1-BETA3/1-SA-14:23.openssl (nonexistent) +++ user/cperciva/freebsd-update-build/patches/10.1-BETA3/1-SA-14:23.openssl (revision 293366) @@ -0,0 +1,10217 @@ +Index: crypto/openssl/CHANGES +=================================================================== +--- crypto/openssl/CHANGES (revision 273303) ++++ crypto/openssl/CHANGES (working copy) +@@ -2,6 +2,57 @@ + OpenSSL CHANGES + _______________ + ++ Changes between 1.0.1i and 1.0.1j [15 Oct 2014] ++ ++ *) SRTP Memory Leak. ++ ++ A flaw in the DTLS SRTP extension parsing code allows an attacker, who ++ sends a carefully crafted handshake message, to cause OpenSSL to fail ++ to free up to 64k of memory causing a memory leak. This could be ++ exploited in a Denial Of Service attack. This issue affects OpenSSL ++ 1.0.1 server implementations for both SSL/TLS and DTLS regardless of ++ whether SRTP is used or configured. Implementations of OpenSSL that ++ have been compiled with OPENSSL_NO_SRTP defined are not affected. ++ ++ The fix was developed by the OpenSSL team. ++ (CVE-2014-3513) ++ [OpenSSL team] ++ ++ *) Session Ticket Memory Leak. ++ ++ When an OpenSSL SSL/TLS/DTLS server receives a session ticket the ++ integrity of that ticket is first verified. In the event of a session ++ ticket integrity check failing, OpenSSL will fail to free memory ++ causing a memory leak. By sending a large number of invalid session ++ tickets an attacker could exploit this issue in a Denial Of Service ++ attack. ++ (CVE-2014-3567) ++ [Steve Henson] ++ ++ *) Build option no-ssl3 is incomplete. ++ ++ When OpenSSL is configured with "no-ssl3" as a build option, servers ++ could accept and complete a SSL 3.0 handshake, and clients could be ++ configured to send them. ++ (CVE-2014-3568) ++ [Akamai and the OpenSSL team] ++ ++ *) Add support for TLS_FALLBACK_SCSV. ++ Client applications doing fallback retries should call ++ SSL_set_mode(s, SSL_MODE_SEND_FALLBACK_SCSV). ++ (CVE-2014-3566) ++ [Adam Langley, Bodo Moeller] ++ ++ *) Add additional DigestInfo checks. ++ ++ Reencode DigestInto in DER and check against the original when ++ verifying RSA signature: this will reject any improperly encoded ++ DigestInfo structures. ++ ++ Note: this is a precautionary measure and no attacks are currently known. ++ ++ [Steve Henson] ++ + Changes between 1.0.1h and 1.0.1i [6 Aug 2014] + + *) Fix SRP buffer overrun vulnerability. Invalid parameters passed to the +Index: crypto/openssl/Configure +=================================================================== +--- crypto/openssl/Configure (revision 273303) ++++ crypto/openssl/Configure (working copy) +@@ -1767,6 +1767,9 @@ open(OUT,'>crypto/opensslconf.h.new') || die "unab + print OUT "/* opensslconf.h */\n"; + print OUT "/* WARNING: Generated automatically from opensslconf.h.in by Configure. */\n\n"; + ++print OUT "#ifdef __cplusplus\n"; ++print OUT "extern \"C\" {\n"; ++print OUT "#endif\n"; + print OUT "/* OpenSSL was configured with the following options: */\n"; + my $openssl_algorithm_defines_trans = $openssl_algorithm_defines; + $openssl_experimental_defines =~ s/^\s*#\s*define\s+OPENSSL_NO_(.*)/#ifndef OPENSSL_EXPERIMENTAL_$1\n# ifndef OPENSSL_NO_$1\n# define OPENSSL_NO_$1\n# endif\n#endif/mg; +@@ -1871,6 +1874,9 @@ while () + { print OUT $_; } + } + close(IN); ++print OUT "#ifdef __cplusplus\n"; ++print OUT "}\n"; ++print OUT "#endif\n"; + close(OUT); + rename("crypto/opensslconf.h","crypto/opensslconf.h.bak") || die "unable to rename crypto/opensslconf.h\n" if -e "crypto/opensslconf.h"; + rename("crypto/opensslconf.h.new","crypto/opensslconf.h") || die "unable to rename crypto/opensslconf.h.new\n"; +Index: crypto/openssl/Makefile +=================================================================== +--- crypto/openssl/Makefile (revision 273303) ++++ crypto/openssl/Makefile (working copy) +@@ -4,7 +4,7 @@ + ## Makefile for OpenSSL + ## + +-VERSION=1.0.1i ++VERSION=1.0.1j + MAJOR=1 + MINOR=0.1 + SHLIB_VERSION_NUMBER=1.0.0 +Index: crypto/openssl/NEWS +=================================================================== +--- crypto/openssl/NEWS (revision 273303) ++++ crypto/openssl/NEWS (working copy) +@@ -5,6 +5,13 @@ + This file gives a brief overview of the major changes between each OpenSSL + release. For more details please read the CHANGES file. + ++ Major changes between OpenSSL 1.0.1i and OpenSSL 1.0.1j [15 Oct 2014] ++ ++ o Fix for CVE-2014-3513 ++ o Fix for CVE-2014-3567 ++ o Mitigation for CVE-2014-3566 (SSL protocol vulnerability) ++ o Fix for CVE-2014-3568 ++ + Major changes between OpenSSL 1.0.1h and OpenSSL 1.0.1i [6 Aug 2014] + + o Fix for CVE-2014-3512 +Index: crypto/openssl/README +=================================================================== +--- crypto/openssl/README (revision 273303) ++++ crypto/openssl/README (working copy) +@@ -1,5 +1,5 @@ + +- OpenSSL 1.0.1i 6 Aug 2014 ++ OpenSSL 1.0.1j 15 Oct 2014 + + Copyright (c) 1998-2011 The OpenSSL Project + Copyright (c) 1995-1998 Eric A. Young, Tim J. Hudson +Index: crypto/openssl/apps/s_client.c +=================================================================== +--- crypto/openssl/apps/s_client.c (revision 273303) ++++ crypto/openssl/apps/s_client.c (working copy) +@@ -337,6 +337,7 @@ static void sc_usage(void) + BIO_printf(bio_err," -tls1_1 - just use TLSv1.1\n"); + BIO_printf(bio_err," -tls1 - just use TLSv1\n"); + BIO_printf(bio_err," -dtls1 - just use DTLSv1\n"); ++ BIO_printf(bio_err," -fallback_scsv - send TLS_FALLBACK_SCSV\n"); + BIO_printf(bio_err," -mtu - set the link layer MTU\n"); + BIO_printf(bio_err," -no_tls1_2/-no_tls1_1/-no_tls1/-no_ssl3/-no_ssl2 - turn off that protocol\n"); + BIO_printf(bio_err," -bugs - Switch on all SSL implementation bug workarounds\n"); +@@ -617,6 +618,7 @@ int MAIN(int argc, char **argv) + char *sess_out = NULL; + struct sockaddr peer; + int peerlen = sizeof(peer); ++ int fallback_scsv = 0; + int enable_timeouts = 0 ; + long socket_mtu = 0; + #ifndef OPENSSL_NO_JPAKE +@@ -823,6 +825,10 @@ int MAIN(int argc, char **argv) + meth=DTLSv1_client_method(); + socket_type=SOCK_DGRAM; + } ++ else if (strcmp(*argv,"-fallback_scsv") == 0) ++ { ++ fallback_scsv = 1; ++ } + else if (strcmp(*argv,"-timeout") == 0) + enable_timeouts=1; + else if (strcmp(*argv,"-mtu") == 0) +@@ -1235,6 +1241,10 @@ bad: + SSL_set_session(con, sess); + SSL_SESSION_free(sess); + } ++ ++ if (fallback_scsv) ++ SSL_set_mode(con, SSL_MODE_SEND_FALLBACK_SCSV); ++ + #ifndef OPENSSL_NO_TLSEXT + if (servername != NULL) + { +Index: crypto/openssl/crypto/Makefile +=================================================================== +--- crypto/openssl/crypto/Makefile (revision 273303) ++++ crypto/openssl/crypto/Makefile (working copy) +@@ -32,6 +32,7 @@ CPUID_OBJ=mem_clr.o + LIBS= + + GENERAL=Makefile README crypto-lib.com install.com ++TEST=constant_time_test.c + + LIB= $(TOP)/libcrypto.a + SHARED_LIB= libcrypto$(SHLIB_EXT) +@@ -44,7 +45,8 @@ SRC= $(LIBSRC) + + EXHEADER= crypto.h opensslv.h opensslconf.h ebcdic.h symhacks.h \ + ossl_typ.h +-HEADER= cryptlib.h buildinf.h md32_common.h o_time.h o_str.h o_dir.h $(EXHEADER) ++HEADER= cryptlib.h buildinf.h md32_common.h o_time.h o_str.h o_dir.h \ ++ constant_time_locl.h $(EXHEADER) + + ALL= $(GENERAL) $(SRC) $(HEADER) + +Index: crypto/openssl/crypto/aes/asm/aesni-x86_64.pl +=================================================================== +--- crypto/openssl/crypto/aes/asm/aesni-x86_64.pl (revision 273303) ++++ crypto/openssl/crypto/aes/asm/aesni-x86_64.pl (working copy) +@@ -525,6 +525,16 @@ $code.=<<___; + .type aesni_ecb_encrypt,\@function,5 + .align 16 + aesni_ecb_encrypt: ++___ ++$code.=<<___ if ($win64); ++ lea -0x58(%rsp),%rsp ++ movaps %xmm6,(%rsp) ++ movaps %xmm7,0x10(%rsp) ++ movaps %xmm8,0x20(%rsp) ++ movaps %xmm9,0x30(%rsp) ++.Lecb_enc_body: ++___ ++$code.=<<___; + and \$-16,$len + jz .Lecb_ret + +@@ -805,6 +815,16 @@ $code.=<<___; + movups $inout5,0x50($out) + + .Lecb_ret: ++___ ++$code.=<<___ if ($win64); ++ movaps (%rsp),%xmm6 ++ movaps 0x10(%rsp),%xmm7 ++ movaps 0x20(%rsp),%xmm8 ++ movaps 0x30(%rsp),%xmm9 ++ lea 0x58(%rsp),%rsp ++.Lecb_enc_ret: ++___ ++$code.=<<___; + ret + .size aesni_ecb_encrypt,.-aesni_ecb_encrypt + ___ +@@ -2730,9 +2750,9 @@ $code.=<<___; + .extern __imp_RtlVirtualUnwind + ___ + $code.=<<___ if ($PREFIX eq "aesni"); +-.type ecb_se_handler,\@abi-omnipotent ++.type ecb_ccm64_se_handler,\@abi-omnipotent + .align 16 +-ecb_se_handler: ++ecb_ccm64_se_handler: + push %rsi + push %rdi + push %rbx +@@ -2744,25 +2764,6 @@ $code.=<<___ if ($PREFIX eq "aesni"); + pushfq + sub \$64,%rsp + +- mov 152($context),%rax # pull context->Rsp +- +- jmp .Lcommon_seh_tail +-.size ecb_se_handler,.-ecb_se_handler +- +-.type ccm64_se_handler,\@abi-omnipotent +-.align 16 +-ccm64_se_handler: +- push %rsi +- push %rdi +- push %rbx +- push %rbp +- push %r12 +- push %r13 +- push %r14 +- push %r15 +- pushfq +- sub \$64,%rsp +- + mov 120($context),%rax # pull context->Rax + mov 248($context),%rbx # pull context->Rip + +@@ -2788,7 +2789,7 @@ $code.=<<___ if ($PREFIX eq "aesni"); + lea 0x58(%rax),%rax # adjust stack pointer + + jmp .Lcommon_seh_tail +-.size ccm64_se_handler,.-ccm64_se_handler ++.size ecb_ccm64_se_handler,.-ecb_ccm64_se_handler + + .type ctr32_se_handler,\@abi-omnipotent + .align 16 +@@ -2993,14 +2994,15 @@ ___ + $code.=<<___ if ($PREFIX eq "aesni"); + .LSEH_info_ecb: + .byte 9,0,0,0 +- .rva ecb_se_handler ++ .rva ecb_ccm64_se_handler ++ .rva .Lecb_enc_body,.Lecb_enc_ret # HandlerData[] + .LSEH_info_ccm64_enc: + .byte 9,0,0,0 +- .rva ccm64_se_handler ++ .rva ecb_ccm64_se_handler + .rva .Lccm64_enc_body,.Lccm64_enc_ret # HandlerData[] + .LSEH_info_ccm64_dec: + .byte 9,0,0,0 +- .rva ccm64_se_handler ++ .rva ecb_ccm64_se_handler + .rva .Lccm64_dec_body,.Lccm64_dec_ret # HandlerData[] + .LSEH_info_ctr32: + .byte 9,0,0,0 +Index: crypto/openssl/crypto/asn1/a_strex.c +=================================================================== +--- crypto/openssl/crypto/asn1/a_strex.c (revision 273303) ++++ crypto/openssl/crypto/asn1/a_strex.c (working copy) +@@ -568,6 +568,7 @@ int ASN1_STRING_to_UTF8(unsigned char **out, ASN1_ + mbflag |= MBSTRING_FLAG; + stmp.data = NULL; + stmp.length = 0; ++ stmp.flags = 0; + ret = ASN1_mbstring_copy(&str, in->data, in->length, mbflag, B_ASN1_UTF8STRING); + if(ret < 0) return ret; + *out = stmp.data; +Index: crypto/openssl/crypto/bn/asm/x86_64-gcc.c +=================================================================== +--- crypto/openssl/crypto/bn/asm/x86_64-gcc.c (revision 273303) ++++ crypto/openssl/crypto/bn/asm/x86_64-gcc.c (working copy) +@@ -189,7 +189,7 @@ BN_ULONG bn_add_words (BN_ULONG *rp, const BN_ULON + + if (n <= 0) return 0; + +- asm ( ++ asm volatile ( + " subq %2,%2 \n" + ".p2align 4 \n" + "1: movq (%4,%2,8),%0 \n" +@@ -200,7 +200,7 @@ BN_ULONG bn_add_words (BN_ULONG *rp, const BN_ULON + " sbbq %0,%0 \n" + : "=&a"(ret),"+c"(n),"=&r"(i) + : "r"(rp),"r"(ap),"r"(bp) +- : "cc" ++ : "cc", "memory" + ); + + return ret&1; +@@ -212,7 +212,7 @@ BN_ULONG bn_sub_words (BN_ULONG *rp, const BN_ULON + + if (n <= 0) return 0; + +- asm ( ++ asm volatile ( + " subq %2,%2 \n" + ".p2align 4 \n" + "1: movq (%4,%2,8),%0 \n" +@@ -223,7 +223,7 @@ BN_ULONG bn_sub_words (BN_ULONG *rp, const BN_ULON + " sbbq %0,%0 \n" + : "=&a"(ret),"+c"(n),"=&r"(i) + : "r"(rp),"r"(ap),"r"(bp) +- : "cc" ++ : "cc", "memory" + ); + + return ret&1; +Index: crypto/openssl/crypto/bn/bn_exp.c +=================================================================== +--- crypto/openssl/crypto/bn/bn_exp.c (revision 273303) ++++ crypto/openssl/crypto/bn/bn_exp.c (working copy) +@@ -874,7 +874,14 @@ int BN_mod_exp_mont_word(BIGNUM *rr, BN_ULONG a, c + bits = BN_num_bits(p); + if (bits == 0) + { +- ret = BN_one(rr); ++ /* x**0 mod 1 is still zero. */ ++ if (BN_is_one(m)) ++ { ++ ret = 1; ++ BN_zero(rr); ++ } ++ else ++ ret = BN_one(rr); + return ret; + } + if (a == 0) +Index: crypto/openssl/crypto/bn/bn_nist.c +=================================================================== +--- crypto/openssl/crypto/bn/bn_nist.c (revision 273303) ++++ crypto/openssl/crypto/bn/bn_nist.c (working copy) +@@ -1088,9 +1088,9 @@ int BN_nist_mod_521(BIGNUM *r, const BIGNUM *a, co + /* ... and right shift */ + for (val=t_d[0],i=0; i>BN_NIST_521_RSHIFT; +- val = t_d[i+1]; +- t_d[i] = (tmp | val<>BN_NIST_521_RSHIFT | ++ (tmp=t_d[i+1])<>BN_NIST_521_RSHIFT; + /* lower 521 bits */ +Index: crypto/openssl/crypto/bn/exptest.c +=================================================================== +--- crypto/openssl/crypto/bn/exptest.c (revision 273303) ++++ crypto/openssl/crypto/bn/exptest.c (working copy) +@@ -71,6 +71,43 @@ + + static const char rnd_seed[] = "string to make the random number generator think it has entropy"; + ++/* test_exp_mod_zero tests that x**0 mod 1 == 0. It returns zero on success. */ ++static int test_exp_mod_zero() { ++ BIGNUM a, p, m; ++ BIGNUM r; ++ BN_CTX *ctx = BN_CTX_new(); ++ int ret = 1; ++ ++ BN_init(&m); ++ BN_one(&m); ++ ++ BN_init(&a); ++ BN_one(&a); ++ ++ BN_init(&p); ++ BN_zero(&p); ++ ++ BN_init(&r); ++ BN_mod_exp(&r, &a, &p, &m, ctx); ++ BN_CTX_free(ctx); ++ ++ if (BN_is_zero(&r)) ++ ret = 0; ++ else ++ { ++ printf("1**0 mod 1 = "); ++ BN_print_fp(stdout, &r); ++ printf(", should be 0\n"); ++ } ++ ++ BN_free(&r); ++ BN_free(&a); ++ BN_free(&p); ++ BN_free(&m); ++ ++ return ret; ++} ++ + int main(int argc, char *argv[]) + { + BN_CTX *ctx; +@@ -190,7 +227,13 @@ int main(int argc, char *argv[]) + ERR_remove_thread_state(NULL); + CRYPTO_mem_leaks(out); + BIO_free(out); +- printf(" done\n"); ++ printf("\n"); ++ ++ if (test_exp_mod_zero() != 0) ++ goto err; ++ ++ printf("done\n"); ++ + EXIT(0); + err: + ERR_load_crypto_strings(); +Index: crypto/openssl/crypto/constant_time_locl.h +=================================================================== +--- crypto/openssl/crypto/constant_time_locl.h (revision 0) ++++ crypto/openssl/crypto/constant_time_locl.h (working copy) +@@ -0,0 +1,216 @@ ++/* crypto/constant_time_locl.h */ ++/* ++ * Utilities for constant-time cryptography. ++ * ++ * Author: Emilia Kasper (emilia@openssl.org) ++ * Based on previous work by Bodo Moeller, Emilia Kasper, Adam Langley ++ * (Google). ++ * ==================================================================== ++ * Copyright (c) 2014 The OpenSSL Project. All rights reserved. ++ * ++ * Redistribution and use in source and binary forms, with or without ++ * modification, are permitted provided that the following conditions ++ * are met: ++ * 1. Redistributions of source code must retain the copyright ++ * notice, this list of conditions and the following disclaimer. ++ * 2. Redistributions in binary form must reproduce the above copyright ++ * notice, this list of conditions and the following disclaimer in the ++ * documentation and/or other materials provided with the distribution. ++ * 3. All advertising materials mentioning features or use of this software ++ * must display the following acknowledgement: ++ * "This product includes cryptographic software written by ++ * Eric Young (eay@cryptsoft.com)" ++ * The word 'cryptographic' can be left out if the rouines from the library ++ * being used are not cryptographic related :-). ++ * 4. If you include any Windows specific code (or a derivative thereof) from ++ * the apps directory (application code) you must include an acknowledgement: ++ * "This product includes software written by Tim Hudson (tjh@cryptsoft.com)" ++ * ++ * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND ++ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE ++ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ++ * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE ++ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL ++ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS ++ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) ++ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT ++ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY ++ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF ++ * SUCH DAMAGE. ++ * ++ * The licence and distribution terms for any publically available version or ++ * derivative of this code cannot be changed. i.e. this code cannot simply be ++ * copied and put under another distribution licence ++ * [including the GNU Public Licence.] ++ */ ++ ++#ifndef HEADER_CONSTANT_TIME_LOCL_H ++#define HEADER_CONSTANT_TIME_LOCL_H ++ ++#include "e_os.h" /* For 'inline' */ ++ ++#ifdef __cplusplus ++extern "C" { ++#endif ++ ++/* ++ * The boolean methods return a bitmask of all ones (0xff...f) for true ++ * and 0 for false. This is useful for choosing a value based on the result ++ * of a conditional in constant time. For example, ++ * ++ * if (a < b) { ++ * c = a; ++ * } else { ++ * c = b; ++ * } ++ * ++ * can be written as ++ * ++ * unsigned int lt = constant_time_lt(a, b); ++ * c = constant_time_select(lt, a, b); ++ */ ++ ++/* ++ * Returns the given value with the MSB copied to all the other ++ * bits. Uses the fact that arithmetic shift shifts-in the sign bit. ++ * However, this is not ensured by the C standard so you may need to ++ * replace this with something else on odd CPUs. ++ */ ++static inline unsigned int constant_time_msb(unsigned int a); ++ ++/* ++ * Returns 0xff..f if a < b and 0 otherwise. ++ */ ++static inline unsigned int constant_time_lt(unsigned int a, unsigned int b); ++/* Convenience method for getting an 8-bit mask. */ ++static inline unsigned char constant_time_lt_8(unsigned int a, unsigned int b); ++ ++/* ++ * Returns 0xff..f if a >= b and 0 otherwise. ++ */ ++static inline unsigned int constant_time_ge(unsigned int a, unsigned int b); ++/* Convenience method for getting an 8-bit mask. */ ++static inline unsigned char constant_time_ge_8(unsigned int a, unsigned int b); ++ ++/* ++ * Returns 0xff..f if a == 0 and 0 otherwise. ++ */ ++static inline unsigned int constant_time_is_zero(unsigned int a); ++/* Convenience method for getting an 8-bit mask. */ ++static inline unsigned char constant_time_is_zero_8(unsigned int a); ++ ++ ++/* ++ * Returns 0xff..f if a == b and 0 otherwise. ++ */ ++static inline unsigned int constant_time_eq(unsigned int a, unsigned int b); ++/* Convenience method for getting an 8-bit mask. */ ++static inline unsigned char constant_time_eq_8(unsigned int a, unsigned int b); ++/* Signed integers. */ ++static inline unsigned int constant_time_eq_int(int a, int b); ++/* Convenience method for getting an 8-bit mask. */ ++static inline unsigned char constant_time_eq_int_8(int a, int b); ++ ++ ++/* ++ * Returns (mask & a) | (~mask & b). ++ * ++ * When |mask| is all 1s or all 0s (as returned by the methods above), ++ * the select methods return either |a| (if |mask| is nonzero) or |b| ++ * (if |mask| is zero). ++ */ ++static inline unsigned int constant_time_select(unsigned int mask, ++ unsigned int a, unsigned int b); ++/* Convenience method for unsigned chars. */ ++static inline unsigned char constant_time_select_8(unsigned char mask, ++ unsigned char a, unsigned char b); ++/* Convenience method for signed integers. */ ++static inline int constant_time_select_int(unsigned int mask, int a, int b); ++ ++static inline unsigned int constant_time_msb(unsigned int a) ++ { ++ return (unsigned int)((int)(a) >> (sizeof(int) * 8 - 1)); ++ } ++ ++static inline unsigned int constant_time_lt(unsigned int a, unsigned int b) ++ { ++ unsigned int lt; ++ /* Case 1: msb(a) == msb(b). a < b iff the MSB of a - b is set.*/ ++ lt = ~(a ^ b) & (a - b); ++ /* Case 2: msb(a) != msb(b). a < b iff the MSB of b is set. */ ++ lt |= ~a & b; ++ return constant_time_msb(lt); ++ } ++ ++static inline unsigned char constant_time_lt_8(unsigned int a, unsigned int b) ++ { ++ return (unsigned char)(constant_time_lt(a, b)); ++ } ++ ++static inline unsigned int constant_time_ge(unsigned int a, unsigned int b) ++ { ++ unsigned int ge; ++ /* Case 1: msb(a) == msb(b). a >= b iff the MSB of a - b is not set.*/ ++ ge = ~((a ^ b) | (a - b)); ++ /* Case 2: msb(a) != msb(b). a >= b iff the MSB of a is set. */ ++ ge |= a & ~b; ++ return constant_time_msb(ge); ++ } ++ ++static inline unsigned char constant_time_ge_8(unsigned int a, unsigned int b) ++ { ++ return (unsigned char)(constant_time_ge(a, b)); ++ } ++ ++static inline unsigned int constant_time_is_zero(unsigned int a) ++ { ++ return constant_time_msb(~a & (a - 1)); ++ } ++ ++static inline unsigned char constant_time_is_zero_8(unsigned int a) ++ { ++ return (unsigned char)(constant_time_is_zero(a)); ++ } ++ ++static inline unsigned int constant_time_eq(unsigned int a, unsigned int b) ++ { ++ return constant_time_is_zero(a ^ b); ++ } ++ ++static inline unsigned char constant_time_eq_8(unsigned int a, unsigned int b) ++ { ++ return (unsigned char)(constant_time_eq(a, b)); ++ } ++ ++static inline unsigned int constant_time_eq_int(int a, int b) ++ { ++ return constant_time_eq((unsigned)(a), (unsigned)(b)); ++ } ++ ++static inline unsigned char constant_time_eq_int_8(int a, int b) ++ { ++ return constant_time_eq_8((unsigned)(a), (unsigned)(b)); ++ } ++ ++static inline unsigned int constant_time_select(unsigned int mask, ++ unsigned int a, unsigned int b) ++ { ++ return (mask & a) | (~mask & b); ++ } ++ ++static inline unsigned char constant_time_select_8(unsigned char mask, ++ unsigned char a, unsigned char b) ++ { ++ return (unsigned char)(constant_time_select(mask, a, b)); ++ } ++ ++inline int constant_time_select_int(unsigned int mask, int a, int b) ++ { ++ return (int)(constant_time_select(mask, (unsigned)(a), (unsigned)(b))); ++ } ++ ++#ifdef __cplusplus ++} ++#endif ++ ++#endif /* HEADER_CONSTANT_TIME_LOCL_H */ + +Property changes on: crypto/openssl/crypto/constant_time_locl.h +___________________________________________________________________ +Added: svn:keywords +## -0,0 +1 ## ++FreeBSD=%H +\ No newline at end of property +Added: svn:eol-style +## -0,0 +1 ## ++native +\ No newline at end of property +Added: svn:mime-type +## -0,0 +1 ## ++text/plain +\ No newline at end of property +Index: crypto/openssl/crypto/constant_time_test.c +=================================================================== +--- crypto/openssl/crypto/constant_time_test.c (revision 0) ++++ crypto/openssl/crypto/constant_time_test.c (working copy) +@@ -0,0 +1,330 @@ ++/* crypto/constant_time_test.c */ ++/* ++ * Utilities for constant-time cryptography. ++ * ++ * Author: Emilia Kasper (emilia@openssl.org) ++ * Based on previous work by Bodo Moeller, Emilia Kasper, Adam Langley ++ * (Google). ++ * ==================================================================== ++ * Copyright (c) 2014 The OpenSSL Project. All rights reserved. ++ * ++ * Redistribution and use in source and binary forms, with or without ++ * modification, are permitted provided that the following conditions ++ * are met: ++ * 1. Redistributions of source code must retain the copyright ++ * notice, this list of conditions and the following disclaimer. ++ * 2. Redistributions in binary form must reproduce the above copyright ++ * notice, this list of conditions and the following disclaimer in the ++ * documentation and/or other materials provided with the distribution. ++ * 3. All advertising materials mentioning features or use of this software ++ * must display the following acknowledgement: ++ * "This product includes cryptographic software written by ++ * Eric Young (eay@cryptsoft.com)" ++ * The word 'cryptographic' can be left out if the rouines from the library ++ * being used are not cryptographic related :-). ++ * 4. If you include any Windows specific code (or a derivative thereof) from ++ * the apps directory (application code) you must include an acknowledgement: ++ * "This product includes software written by Tim Hudson (tjh@cryptsoft.com)" ++ * ++ * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND ++ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE ++ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ++ * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE ++ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL ++ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS ++ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) ++ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT ++ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY ++ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF ++ * SUCH DAMAGE. ++ * ++ * The licence and distribution terms for any publically available version or ++ * derivative of this code cannot be changed. i.e. this code cannot simply be ++ * copied and put under another distribution licence ++ * [including the GNU Public Licence.] ++ */ ++ ++#include "../crypto/constant_time_locl.h" ++ ++#include ++#include ++#include ++ ++static const unsigned int CONSTTIME_TRUE = (unsigned)(~0); ++static const unsigned int CONSTTIME_FALSE = 0; ++static const unsigned char CONSTTIME_TRUE_8 = 0xff; ++static const unsigned char CONSTTIME_FALSE_8 = 0; ++ ++static int test_binary_op(unsigned int (*op)(unsigned int a, unsigned int b), ++ const char* op_name, unsigned int a, unsigned int b, int is_true) ++ { ++ unsigned c = op(a, b); ++ if (is_true && c != CONSTTIME_TRUE) ++ { ++ fprintf(stderr, "Test failed for %s(%du, %du): expected %du " ++ "(TRUE), got %du\n", op_name, a, b, CONSTTIME_TRUE, c); ++ return 1; ++ } ++ else if (!is_true && c != CONSTTIME_FALSE) ++ { ++ fprintf(stderr, "Test failed for %s(%du, %du): expected %du " ++ "(FALSE), got %du\n", op_name, a, b, CONSTTIME_FALSE, ++ c); ++ return 1; ++ } ++ return 0; ++ } ++ ++static int test_binary_op_8(unsigned char (*op)(unsigned int a, unsigned int b), ++ const char* op_name, unsigned int a, unsigned int b, int is_true) ++ { ++ unsigned char c = op(a, b); ++ if (is_true && c != CONSTTIME_TRUE_8) ++ { ++ fprintf(stderr, "Test failed for %s(%du, %du): expected %u " ++ "(TRUE), got %u\n", op_name, a, b, CONSTTIME_TRUE_8, c); ++ return 1; ++ } ++ else if (!is_true && c != CONSTTIME_FALSE_8) ++ { ++ fprintf(stderr, "Test failed for %s(%du, %du): expected %u " ++ "(FALSE), got %u\n", op_name, a, b, CONSTTIME_FALSE_8, ++ c); ++ return 1; ++ } ++ return 0; ++ } ++ ++static int test_is_zero(unsigned int a) ++ { ++ unsigned int c = constant_time_is_zero(a); ++ if (a == 0 && c != CONSTTIME_TRUE) ++ { ++ fprintf(stderr, "Test failed for constant_time_is_zero(%du): " ++ "expected %du (TRUE), got %du\n", a, CONSTTIME_TRUE, c); ++ return 1; ++ } ++ else if (a != 0 && c != CONSTTIME_FALSE) ++ { ++ fprintf(stderr, "Test failed for constant_time_is_zero(%du): " ++ "expected %du (FALSE), got %du\n", a, CONSTTIME_FALSE, ++ c); ++ return 1; ++ } ++ return 0; ++ } ++ ++static int test_is_zero_8(unsigned int a) ++ { ++ unsigned char c = constant_time_is_zero_8(a); ++ if (a == 0 && c != CONSTTIME_TRUE_8) ++ { ++ fprintf(stderr, "Test failed for constant_time_is_zero(%du): " ++ "expected %u (TRUE), got %u\n", a, CONSTTIME_TRUE_8, c); ++ return 1; ++ } ++ else if (a != 0 && c != CONSTTIME_FALSE) ++ { ++ fprintf(stderr, "Test failed for constant_time_is_zero(%du): " ++ "expected %u (FALSE), got %u\n", a, CONSTTIME_FALSE_8, ++ c); ++ return 1; ++ } ++ return 0; ++ } ++ ++static int test_select(unsigned int a, unsigned int b) ++ { ++ unsigned int selected = constant_time_select(CONSTTIME_TRUE, a, b); ++ if (selected != a) ++ { ++ fprintf(stderr, "Test failed for constant_time_select(%du, %du," ++ "%du): expected %du(first value), got %du\n", ++ CONSTTIME_TRUE, a, b, a, selected); ++ return 1; ++ } ++ selected = constant_time_select(CONSTTIME_FALSE, a, b); ++ if (selected != b) ++ { ++ fprintf(stderr, "Test failed for constant_time_select(%du, %du," ++ "%du): expected %du(second value), got %du\n", ++ CONSTTIME_FALSE, a, b, b, selected); ++ return 1; ++ } ++ return 0; ++ } ++ ++static int test_select_8(unsigned char a, unsigned char b) ++ { ++ unsigned char selected = constant_time_select_8(CONSTTIME_TRUE_8, a, b); ++ if (selected != a) ++ { ++ fprintf(stderr, "Test failed for constant_time_select(%u, %u," ++ "%u): expected %u(first value), got %u\n", ++ CONSTTIME_TRUE, a, b, a, selected); ++ return 1; ++ } ++ selected = constant_time_select_8(CONSTTIME_FALSE_8, a, b); ++ if (selected != b) ++ { ++ fprintf(stderr, "Test failed for constant_time_select(%u, %u," ++ "%u): expected %u(second value), got %u\n", ++ CONSTTIME_FALSE, a, b, b, selected); ++ return 1; ++ } ++ return 0; ++ } ++ ++static int test_select_int(int a, int b) ++ { ++ int selected = constant_time_select_int(CONSTTIME_TRUE, a, b); ++ if (selected != a) ++ { ++ fprintf(stderr, "Test failed for constant_time_select(%du, %d," ++ "%d): expected %d(first value), got %d\n", ++ CONSTTIME_TRUE, a, b, a, selected); ++ return 1; ++ } ++ selected = constant_time_select_int(CONSTTIME_FALSE, a, b); ++ if (selected != b) ++ { ++ fprintf(stderr, "Test failed for constant_time_select(%du, %d," ++ "%d): expected %d(second value), got %d\n", ++ CONSTTIME_FALSE, a, b, b, selected); ++ return 1; ++ } ++ return 0; ++ } ++ ++static int test_eq_int(int a, int b) ++ { ++ unsigned int equal = constant_time_eq_int(a, b); ++ if (a == b && equal != CONSTTIME_TRUE) ++ { ++ fprintf(stderr, "Test failed for constant_time_eq_int(%d, %d): " ++ "expected %du(TRUE), got %du\n", ++ a, b, CONSTTIME_TRUE, equal); ++ return 1; ++ } ++ else if (a != b && equal != CONSTTIME_FALSE) ++ { ++ fprintf(stderr, "Test failed for constant_time_eq_int(%d, %d): " ++ "expected %du(FALSE), got %du\n", ++ a, b, CONSTTIME_FALSE, equal); ++ return 1; ++ } ++ return 0; ++ } ++ ++static int test_eq_int_8(int a, int b) ++ { ++ unsigned char equal = constant_time_eq_int_8(a, b); ++ if (a == b && equal != CONSTTIME_TRUE_8) ++ { ++ fprintf(stderr, "Test failed for constant_time_eq_int_8(%d, %d): " ++ "expected %u(TRUE), got %u\n", ++ a, b, CONSTTIME_TRUE_8, equal); ++ return 1; ++ } ++ else if (a != b && equal != CONSTTIME_FALSE_8) ++ { ++ fprintf(stderr, "Test failed for constant_time_eq_int_8(%d, %d): " ++ "expected %u(FALSE), got %u\n", ++ a, b, CONSTTIME_FALSE_8, equal); ++ return 1; ++ } ++ return 0; ++ } ++ ++static unsigned int test_values[] = {0, 1, 1024, 12345, 32000, UINT_MAX/2-1, ++ UINT_MAX/2, UINT_MAX/2+1, UINT_MAX-1, ++ UINT_MAX}; ++ ++static unsigned char test_values_8[] = {0, 1, 2, 20, 32, 127, 128, 129, 255}; ++ ++static int signed_test_values[] = {0, 1, -1, 1024, -1024, 12345, -12345, ++ 32000, -32000, INT_MAX, INT_MIN, INT_MAX-1, ++ INT_MIN+1}; ++ ++ ++int main(int argc, char *argv[]) ++ { ++ unsigned int a, b, i, j; ++ int c, d; ++ unsigned char e, f; ++ int num_failed = 0, num_all = 0; ++ fprintf(stdout, "Testing constant time operations...\n"); ++ ++ for (i = 0; i < sizeof(test_values)/sizeof(int); ++i) ++ { ++ a = test_values[i]; ++ num_failed += test_is_zero(a); ++ num_failed += test_is_zero_8(a); ++ num_all += 2; ++ for (j = 0; j < sizeof(test_values)/sizeof(int); ++j) ++ { ++ b = test_values[j]; ++ num_failed += test_binary_op(&constant_time_lt, ++ "constant_time_lt", a, b, a < b); ++ num_failed += test_binary_op_8(&constant_time_lt_8, ++ "constant_time_lt_8", a, b, a < b); ++ num_failed += test_binary_op(&constant_time_lt, ++ "constant_time_lt_8", b, a, b < a); ++ num_failed += test_binary_op_8(&constant_time_lt_8, ++ "constant_time_lt_8", b, a, b < a); ++ num_failed += test_binary_op(&constant_time_ge, ++ "constant_time_ge", a, b, a >= b); ++ num_failed += test_binary_op_8(&constant_time_ge_8, ++ "constant_time_ge_8", a, b, a >= b); ++ num_failed += test_binary_op(&constant_time_ge, ++ "constant_time_ge", b, a, b >= a); ++ num_failed += test_binary_op_8(&constant_time_ge_8, ++ "constant_time_ge_8", b, a, b >= a); ++ num_failed += test_binary_op(&constant_time_eq, ++ "constant_time_eq", a, b, a == b); ++ num_failed += test_binary_op_8(&constant_time_eq_8, ++ "constant_time_eq_8", a, b, a == b); ++ num_failed += test_binary_op(&constant_time_eq, ++ "constant_time_eq", b, a, b == a); ++ num_failed += test_binary_op_8(&constant_time_eq_8, ++ "constant_time_eq_8", b, a, b == a); ++ num_failed += test_select(a, b); ++ num_all += 13; ++ } ++ } ++ ++ for (i = 0; i < sizeof(signed_test_values)/sizeof(int); ++i) ++ { ++ c = signed_test_values[i]; ++ for (j = 0; j < sizeof(signed_test_values)/sizeof(int); ++j) ++ { ++ d = signed_test_values[j]; ++ num_failed += test_select_int(c, d); ++ num_failed += test_eq_int(c, d); ++ num_failed += test_eq_int_8(c, d); ++ num_all += 3; ++ } ++ } ++ ++ for (i = 0; i < sizeof(test_values_8); ++i) ++ { ++ e = test_values_8[i]; ++ for (j = 0; j < sizeof(test_values_8); ++j) ++ { ++ f = test_values_8[j]; ++ num_failed += test_select_8(e, f); ++ num_all += 1; ++ } ++ } ++ ++ if (!num_failed) ++ { ++ fprintf(stdout, "ok (ran %d tests)\n", num_all); ++ return EXIT_SUCCESS; ++ } ++ else ++ { ++ fprintf(stdout, "%d of %d tests failed!\n", num_failed, num_all); ++ return EXIT_FAILURE; ++ } ++ } + +Property changes on: crypto/openssl/crypto/constant_time_test.c +___________________________________________________________________ +Added: svn:eol-style +## -0,0 +1 ## ++native +\ No newline at end of property +Added: svn:mime-type +## -0,0 +1 ## ++text/plain +\ No newline at end of property +Added: svn:keywords +## -0,0 +1 ## ++FreeBSD=%H +\ No newline at end of property +Index: crypto/openssl/crypto/dsa/dsa_ameth.c +=================================================================== +--- crypto/openssl/crypto/dsa/dsa_ameth.c (revision 273303) ++++ crypto/openssl/crypto/dsa/dsa_ameth.c (working copy) +@@ -307,6 +307,12 @@ static int dsa_priv_encode(PKCS8_PRIV_KEY_INFO *p8 + unsigned char *dp = NULL; + int dplen; + ++ if (!pkey->pkey.dsa || !pkey->pkey.dsa->priv_key) ++ { ++ DSAerr(DSA_F_DSA_PRIV_ENCODE,DSA_R_MISSING_PARAMETERS); ++ goto err; ++ } ++ + params = ASN1_STRING_new(); + + if (!params) +@@ -701,4 +707,3 @@ const EVP_PKEY_ASN1_METHOD dsa_asn1_meths[] = + old_dsa_priv_encode + } + }; +- +Index: crypto/openssl/crypto/ebcdic.h +=================================================================== +--- crypto/openssl/crypto/ebcdic.h (revision 273303) ++++ crypto/openssl/crypto/ebcdic.h (working copy) +@@ -5,6 +5,10 @@ + + #include + ++#ifdef __cplusplus ++extern "C" { ++#endif ++ + /* Avoid name clashes with other applications */ + #define os_toascii _openssl_os_toascii + #define os_toebcdic _openssl_os_toebcdic +@@ -16,4 +20,7 @@ extern const unsigned char os_toebcdic[256]; + void *ebcdic2ascii(void *dest, const void *srce, size_t count); + void *ascii2ebcdic(void *dest, const void *srce, size_t count); + ++#ifdef __cplusplus ++} + #endif ++#endif +Index: crypto/openssl/crypto/ec/ec.h +=================================================================== +--- crypto/openssl/crypto/ec/ec.h (revision 273303) ++++ crypto/openssl/crypto/ec/ec.h (working copy) +@@ -629,7 +629,7 @@ int EC_POINT_cmp(const EC_GROUP *group, const EC_P + int EC_POINT_make_affine(const EC_GROUP *group, EC_POINT *point, BN_CTX *ctx); + int EC_POINTs_make_affine(const EC_GROUP *group, size_t num, EC_POINT *points[], BN_CTX *ctx); + +-/** Computes r = generator * n sum_{i=0}^num p[i] * m[i] ++/** Computes r = generator * n sum_{i=0}^{num-1} p[i] * m[i] + * \param group underlying EC_GROUP object + * \param r EC_POINT object for the result + * \param n BIGNUM with the multiplier for the group generator (optional) +Index: crypto/openssl/crypto/ec/ec2_smpl.c +=================================================================== +--- crypto/openssl/crypto/ec/ec2_smpl.c (revision 273303) ++++ crypto/openssl/crypto/ec/ec2_smpl.c (working copy) +@@ -80,9 +80,6 @@ + + const EC_METHOD *EC_GF2m_simple_method(void) + { +-#ifdef OPENSSL_FIPS +- return fips_ec_gf2m_simple_method(); +-#else + static const EC_METHOD ret = { + EC_FLAGS_DEFAULT_OCT, + NID_X9_62_characteristic_two_field, +@@ -125,8 +122,12 @@ const EC_METHOD *EC_GF2m_simple_method(void) + 0 /* field_decode */, + 0 /* field_set_to_one */ }; + ++#ifdef OPENSSL_FIPS ++ if (FIPS_mode()) ++ return fips_ec_gf2m_simple_method(); ++#endif ++ + return &ret; +-#endif + } + + +Index: crypto/openssl/crypto/ec/ec_ameth.c +=================================================================== +--- crypto/openssl/crypto/ec/ec_ameth.c (revision 273303) ++++ crypto/openssl/crypto/ec/ec_ameth.c (working copy) +@@ -453,14 +453,16 @@ static int do_EC_KEY_print(BIO *bp, const EC_KEY * + if (ktype > 0) + { + public_key = EC_KEY_get0_public_key(x); +- if ((pub_key = EC_POINT_point2bn(group, public_key, +- EC_KEY_get_conv_form(x), NULL, ctx)) == NULL) ++ if (public_key != NULL) + { +- reason = ERR_R_EC_LIB; +- goto err; ++ if ((pub_key = EC_POINT_point2bn(group, public_key, ++ EC_KEY_get_conv_form(x), NULL, ctx)) == NULL) ++ { ++ reason = ERR_R_EC_LIB; ++ goto err; ++ } ++ buf_len = (size_t)BN_num_bytes(pub_key); + } +- if (pub_key) +- buf_len = (size_t)BN_num_bytes(pub_key); + } + + if (ktype == 2) +Index: crypto/openssl/crypto/ec/ec_asn1.c +=================================================================== +--- crypto/openssl/crypto/ec/ec_asn1.c (revision 273303) ++++ crypto/openssl/crypto/ec/ec_asn1.c (working copy) +@@ -1183,30 +1183,47 @@ EC_KEY *d2i_ECPrivateKey(EC_KEY **a, const unsigne + goto err; + } + ++ if (ret->pub_key) ++ EC_POINT_clear_free(ret->pub_key); ++ ret->pub_key = EC_POINT_new(ret->group); ++ if (ret->pub_key == NULL) ++ { ++ ECerr(EC_F_D2I_ECPRIVATEKEY, ERR_R_EC_LIB); ++ goto err; ++ } ++ + if (priv_key->publicKey) + { + const unsigned char *pub_oct; +- size_t pub_oct_len; ++ int pub_oct_len; + +- if (ret->pub_key) +- EC_POINT_clear_free(ret->pub_key); +- ret->pub_key = EC_POINT_new(ret->group); +- if (ret->pub_key == NULL) ++ pub_oct = M_ASN1_STRING_data(priv_key->publicKey); ++ pub_oct_len = M_ASN1_STRING_length(priv_key->publicKey); ++ /* The first byte - point conversion form - must be present. */ ++ if (pub_oct_len <= 0) + { +- ECerr(EC_F_D2I_ECPRIVATEKEY, ERR_R_EC_LIB); ++ ECerr(EC_F_D2I_ECPRIVATEKEY, EC_R_BUFFER_TOO_SMALL); + goto err; + } +- pub_oct = M_ASN1_STRING_data(priv_key->publicKey); +- pub_oct_len = M_ASN1_STRING_length(priv_key->publicKey); +- /* save the point conversion form */ ++ /* Save the point conversion form. */ + ret->conv_form = (point_conversion_form_t)(pub_oct[0] & ~0x01); + if (!EC_POINT_oct2point(ret->group, ret->pub_key, +- pub_oct, pub_oct_len, NULL)) ++ pub_oct, (size_t)(pub_oct_len), NULL)) + { + ECerr(EC_F_D2I_ECPRIVATEKEY, ERR_R_EC_LIB); + goto err; + } + } ++ else ++ { ++ if (!EC_POINT_mul(ret->group, ret->pub_key, ret->priv_key, NULL, NULL, NULL)) ++ { ++ ECerr(EC_F_D2I_ECPRIVATEKEY, ERR_R_EC_LIB); ++ goto err; ++ } ++ /* Remember the original private-key-only encoding. */ ++ ret->enc_flag |= EC_PKEY_NO_PUBKEY; ++ } + + ok = 1; + err: +@@ -1230,7 +1247,8 @@ int i2d_ECPrivateKey(EC_KEY *a, unsigned char **ou + size_t buf_len=0, tmp_len; + EC_PRIVATEKEY *priv_key=NULL; + +- if (a == NULL || a->group == NULL || a->priv_key == NULL) ++ if (a == NULL || a->group == NULL || a->priv_key == NULL || ++ (!(a->enc_flag & EC_PKEY_NO_PUBKEY) && a->pub_key == NULL)) + { + ECerr(EC_F_I2D_ECPRIVATEKEY, + ERR_R_PASSED_NULL_PARAMETER); +Index: crypto/openssl/crypto/ec/ecp_mont.c +=================================================================== +--- crypto/openssl/crypto/ec/ecp_mont.c (revision 273303) ++++ crypto/openssl/crypto/ec/ecp_mont.c (working copy) +@@ -72,9 +72,6 @@ + + const EC_METHOD *EC_GFp_mont_method(void) + { +-#ifdef OPENSSL_FIPS +- return fips_ec_gfp_mont_method(); +-#else + static const EC_METHOD ret = { + EC_FLAGS_DEFAULT_OCT, + NID_X9_62_prime_field, +@@ -114,8 +111,12 @@ const EC_METHOD *EC_GFp_mont_method(void) + ec_GFp_mont_field_decode, + ec_GFp_mont_field_set_to_one }; + ++#ifdef OPENSSL_FIPS ++ if (FIPS_mode()) ++ return fips_ec_gfp_mont_method(); ++#endif ++ + return &ret; +-#endif + } + + +Index: crypto/openssl/crypto/ec/ecp_nist.c +=================================================================== +--- crypto/openssl/crypto/ec/ecp_nist.c (revision 273303) ++++ crypto/openssl/crypto/ec/ecp_nist.c (working copy) +@@ -73,9 +73,6 @@ + + const EC_METHOD *EC_GFp_nist_method(void) + { +-#ifdef OPENSSL_FIPS +- return fips_ec_gfp_nist_method(); +-#else + static const EC_METHOD ret = { + EC_FLAGS_DEFAULT_OCT, + NID_X9_62_prime_field, +@@ -115,8 +112,12 @@ const EC_METHOD *EC_GFp_nist_method(void) + 0 /* field_decode */, + 0 /* field_set_to_one */ }; + ++#ifdef OPENSSL_FIPS ++ if (FIPS_mode()) ++ return fips_ec_gfp_nist_method(); ++#endif ++ + return &ret; +-#endif + } + + int ec_GFp_nist_group_copy(EC_GROUP *dest, const EC_GROUP *src) +Index: crypto/openssl/crypto/ec/ecp_smpl.c +=================================================================== +--- crypto/openssl/crypto/ec/ecp_smpl.c (revision 273303) ++++ crypto/openssl/crypto/ec/ecp_smpl.c (working copy) +@@ -73,9 +73,6 @@ + + const EC_METHOD *EC_GFp_simple_method(void) + { +-#ifdef OPENSSL_FIPS +- return fips_ec_gfp_simple_method(); +-#else + static const EC_METHOD ret = { + EC_FLAGS_DEFAULT_OCT, + NID_X9_62_prime_field, +@@ -115,8 +112,12 @@ const EC_METHOD *EC_GFp_simple_method(void) + 0 /* field_decode */, + 0 /* field_set_to_one */ }; + ++#ifdef OPENSSL_FIPS ++ if (FIPS_mode()) ++ return fips_ec_gfp_simple_method(); ++#endif ++ + return &ret; +-#endif + } + + +@@ -1317,8 +1318,8 @@ int ec_GFp_simple_points_make_affine(const EC_GROU + { + for (i = 0; i < num; i++) + { +- if (prod_Z[i] != NULL) +- BN_clear_free(prod_Z[i]); ++ if (prod_Z[i] == NULL) break; ++ BN_clear_free(prod_Z[i]); + } + OPENSSL_free(prod_Z); + } +Index: crypto/openssl/crypto/ec/ectest.c +=================================================================== +--- crypto/openssl/crypto/ec/ectest.c (revision 273303) ++++ crypto/openssl/crypto/ec/ectest.c (working copy) +@@ -251,6 +251,7 @@ static void group_order_tests(EC_GROUP *group) + if (!EC_POINT_is_at_infinity(group, Q)) ABORT; + + /* Exercise EC_POINTs_mul, including corner cases. */ ++ if (EC_POINT_is_at_infinity(group, P)) ABORT; + scalars[0] = n1; points[0] = Q; /* => infinity */ + scalars[1] = n2; points[1] = P; /* => -P */ + scalars[2] = n1; points[2] = Q; /* => infinity */ +@@ -257,8 +258,8 @@ static void group_order_tests(EC_GROUP *group) + scalars[3] = n2; points[3] = Q; /* => infinity */ + scalars[4] = n1; points[4] = P; /* => P */ + scalars[5] = n2; points[5] = Q; /* => infinity */ +- if (!EC_POINTs_mul(group, Q, NULL, 5, points, scalars, ctx)) ABORT; +- if (!EC_POINT_is_at_infinity(group, Q)) ABORT; ++ if (!EC_POINTs_mul(group, P, NULL, 6, points, scalars, ctx)) ABORT; ++ if (!EC_POINT_is_at_infinity(group, P)) ABORT; + } + fprintf(stdout, "ok\n"); + +Index: crypto/openssl/crypto/evp/Makefile +=================================================================== +--- crypto/openssl/crypto/evp/Makefile (revision 273303) ++++ crypto/openssl/crypto/evp/Makefile (working copy) +@@ -383,7 +383,7 @@ evp_enc.o: ../../include/openssl/pkcs7.h ../../inc + evp_enc.o: ../../include/openssl/safestack.h ../../include/openssl/sha.h + evp_enc.o: ../../include/openssl/stack.h ../../include/openssl/symhacks.h + evp_enc.o: ../../include/openssl/x509.h ../../include/openssl/x509_vfy.h +-evp_enc.o: ../cryptlib.h evp_enc.c evp_locl.h ++evp_enc.o: ../constant_time_locl.h ../cryptlib.h evp_enc.c evp_locl.h + evp_err.o: ../../include/openssl/asn1.h ../../include/openssl/bio.h + evp_err.o: ../../include/openssl/crypto.h ../../include/openssl/e_os2.h + evp_err.o: ../../include/openssl/err.h ../../include/openssl/evp.h +Index: crypto/openssl/crypto/evp/e_aes.c +=================================================================== +--- crypto/openssl/crypto/evp/e_aes.c (revision 273303) ++++ crypto/openssl/crypto/evp/e_aes.c (working copy) +@@ -166,7 +166,7 @@ extern unsigned int OPENSSL_ia32cap_P[2]; + #define VPAES_CAPABLE (OPENSSL_ia32cap_P[1]&(1<<(41-32))) + #endif + #ifdef BSAES_ASM +-#define BSAES_CAPABLE VPAES_CAPABLE ++#define BSAES_CAPABLE (OPENSSL_ia32cap_P[1]&(1<<(41-32))) + #endif + /* + * AES-NI section +Index: crypto/openssl/crypto/evp/evp_enc.c +=================================================================== +--- crypto/openssl/crypto/evp/evp_enc.c (revision 273303) ++++ crypto/openssl/crypto/evp/evp_enc.c (working copy) +@@ -67,6 +67,7 @@ + #ifdef OPENSSL_FIPS + #include + #endif ++#include "constant_time_locl.h" + #include "evp_locl.h" + + #ifdef OPENSSL_FIPS +@@ -500,21 +501,21 @@ int EVP_DecryptFinal(EVP_CIPHER_CTX *ctx, unsigned + + int EVP_DecryptFinal_ex(EVP_CIPHER_CTX *ctx, unsigned char *out, int *outl) + { +- int i,n; +- unsigned int b; ++ unsigned int i, b; ++ unsigned char pad, padding_good; + *outl=0; + + if (ctx->cipher->flags & EVP_CIPH_FLAG_CUSTOM_CIPHER) + { +- i = M_do_cipher(ctx, out, NULL, 0); +- if (i < 0) ++ int ret = M_do_cipher(ctx, out, NULL, 0); ++ if (ret < 0) + return 0; + else +- *outl = i; ++ *outl = ret; + return 1; + } + +- b=ctx->cipher->block_size; ++ b=(unsigned int)(ctx->cipher->block_size); + if (ctx->flags & EVP_CIPH_NO_PADDING) + { + if(ctx->buf_len) +@@ -533,28 +534,34 @@ int EVP_DecryptFinal_ex(EVP_CIPHER_CTX *ctx, unsig + return(0); + } + OPENSSL_assert(b <= sizeof ctx->final); +- n=ctx->final[b-1]; +- if (n == 0 || n > (int)b) ++ pad=ctx->final[b-1]; ++ ++ padding_good = (unsigned char)(~constant_time_is_zero_8(pad)); ++ padding_good &= constant_time_ge_8(b, pad); ++ ++ for (i = 1; i < b; ++i) + { +- EVPerr(EVP_F_EVP_DECRYPTFINAL_EX,EVP_R_BAD_DECRYPT); +- return(0); ++ unsigned char is_pad_index = constant_time_lt_8(i, pad); ++ unsigned char pad_byte_good = constant_time_eq_8(ctx->final[b-i-1], pad); ++ padding_good &= constant_time_select_8(is_pad_index, pad_byte_good, 0xff); + } +- for (i=0; ifinal[--b] != n) +- { +- EVPerr(EVP_F_EVP_DECRYPTFINAL_EX,EVP_R_BAD_DECRYPT); +- return(0); +- } +- } +- n=ctx->cipher->block_size-n; +- for (i=0; ifinal[i]; +- *outl=n; ++ ++ /* ++ * At least 1 byte is always padding, so we always write b - 1 ++ * bytes to avoid a timing leak. The caller is required to have |b| ++ * bytes space in |out| by the API contract. ++ */ ++ for (i = 0; i < b - 1; ++i) ++ out[i] = ctx->final[i] & padding_good; ++ /* Safe cast: for a good padding, EVP_MAX_IV_LENGTH >= b >= pad */ ++ *outl = padding_good & ((unsigned char)(b - pad)); ++ return padding_good & 1; + } + else +- *outl=0; +- return(1); ++ { ++ *outl = 0; ++ return 1; ++ } + } + + void EVP_CIPHER_CTX_free(EVP_CIPHER_CTX *ctx) +@@ -678,4 +685,3 @@ int EVP_CIPHER_CTX_copy(EVP_CIPHER_CTX *out, const + return in->cipher->ctrl((EVP_CIPHER_CTX *)in, EVP_CTRL_COPY, 0, out); + return 1; + } +- +Index: crypto/openssl/crypto/md5/asm/md5-x86_64.pl +=================================================================== +--- crypto/openssl/crypto/md5/asm/md5-x86_64.pl (revision 273303) ++++ crypto/openssl/crypto/md5/asm/md5-x86_64.pl (working copy) +@@ -108,6 +108,7 @@ sub round4_step + EOF + } + ++no warnings qw(uninitialized); + my $flavour = shift; + my $output = shift; + if ($flavour =~ /\./) { $output = $flavour; undef $flavour; } +@@ -119,7 +120,6 @@ $0 =~ m/(.*[\/\\])[^\/\\]+$/; my $dir=$1; my $xlat + ( $xlate="${dir}../../perlasm/x86_64-xlate.pl" and -f $xlate) or + die "can't locate x86_64-xlate.pl"; + +-no warnings qw(uninitialized); + open OUT,"| \"$^X\" $xlate $flavour $output"; + *STDOUT=*OUT; + +Index: crypto/openssl/crypto/modes/modes.h +=================================================================== +--- crypto/openssl/crypto/modes/modes.h (revision 273303) ++++ crypto/openssl/crypto/modes/modes.h (working copy) +@@ -7,6 +7,9 @@ + + #include + ++#ifdef __cplusplus ++extern "C" { ++#endif + typedef void (*block128_f)(const unsigned char in[16], + unsigned char out[16], + const void *key); +@@ -133,3 +136,6 @@ typedef struct xts128_context XTS128_CONTEXT; + + int CRYPTO_xts128_encrypt(const XTS128_CONTEXT *ctx, const unsigned char iv[16], + const unsigned char *inp, unsigned char *out, size_t len, int enc); ++#ifdef __cplusplus ++} ++#endif +Index: crypto/openssl/crypto/ocsp/ocsp_vfy.c +=================================================================== +--- crypto/openssl/crypto/ocsp/ocsp_vfy.c (revision 273303) ++++ crypto/openssl/crypto/ocsp/ocsp_vfy.c (working copy) +@@ -436,8 +436,11 @@ static int ocsp_req_find_signer(X509 **psigner, OC + if(!(flags & OCSP_NOINTERN)) + { + signer = X509_find_by_subject(req->optionalSignature->certs, nm); +- *psigner = signer; +- return 1; ++ if (signer) ++ { ++ *psigner = signer; ++ return 1; ++ } + } + + signer = X509_find_by_subject(certs, nm); +Index: crypto/openssl/crypto/opensslconf.h +=================================================================== +--- crypto/openssl/crypto/opensslconf.h (revision 273303) ++++ crypto/openssl/crypto/opensslconf.h (working copy) +@@ -1,6 +1,9 @@ + /* opensslconf.h */ + /* WARNING: Generated automatically from opensslconf.h.in by Configure. */ + ++#ifdef __cplusplus ++extern "C" { ++#endif + /* OpenSSL was configured with the following options: */ + #ifndef OPENSSL_DOING_MAKEDEPEND + +@@ -233,3 +236,6 @@ YOU SHOULD NOT HAVE BOTH DES_RISC1 AND DES_RISC2 D + + #endif /* DES_DEFAULT_OPTIONS */ + #endif /* HEADER_DES_LOCL_H */ ++#ifdef __cplusplus ++} ++#endif +Index: crypto/openssl/crypto/opensslv.h +=================================================================== +--- crypto/openssl/crypto/opensslv.h (revision 273303) ++++ crypto/openssl/crypto/opensslv.h (working copy) +@@ -1,6 +1,10 @@ + #ifndef HEADER_OPENSSLV_H + #define HEADER_OPENSSLV_H + ++#ifdef __cplusplus ++extern "C" { ++#endif ++ + /* Numeric release version identifier: + * MNNFFPPS: major minor fix patch status + * The status nibble has one of the values 0 for development, 1 to e for betas +@@ -25,11 +29,11 @@ + * (Prior to 0.9.5a beta1, a different scheme was used: MMNNFFRBB for + * major minor fix final patch/beta) + */ +-#define OPENSSL_VERSION_NUMBER 0x1000109fL ++#define OPENSSL_VERSION_NUMBER 0x100010afL + #ifdef OPENSSL_FIPS +-#define OPENSSL_VERSION_TEXT "OpenSSL 1.0.1i-fips 6 Aug 2014" ++#define OPENSSL_VERSION_TEXT "OpenSSL 1.0.1j-fips 15 Oct 2014" + #else +-#define OPENSSL_VERSION_TEXT "OpenSSL 1.0.1i-freebsd 6 Aug 2014" ++#define OPENSSL_VERSION_TEXT "OpenSSL 1.0.1j-freebsd 15 Oct 2014" + #endif + #define OPENSSL_VERSION_PTEXT " part of " OPENSSL_VERSION_TEXT + +@@ -86,4 +90,7 @@ + #define SHLIB_VERSION_NUMBER "7" + + ++#ifdef __cplusplus ++} ++#endif + #endif /* HEADER_OPENSSLV_H */ +Index: crypto/openssl/crypto/ossl_typ.h +=================================================================== +--- crypto/openssl/crypto/ossl_typ.h (revision 273303) ++++ crypto/openssl/crypto/ossl_typ.h (working copy) +@@ -55,6 +55,10 @@ + #ifndef HEADER_OPENSSL_TYPES_H + #define HEADER_OPENSSL_TYPES_H + ++#ifdef __cplusplus ++extern "C" { ++#endif ++ + #include + + #ifdef NO_ASN1_TYPEDEFS +@@ -199,4 +203,7 @@ typedef struct ocsp_req_ctx_st OCSP_REQ_CTX; + typedef struct ocsp_response_st OCSP_RESPONSE; + typedef struct ocsp_responder_id_st OCSP_RESPID; + ++#ifdef __cplusplus ++} ++#endif + #endif /* def HEADER_OPENSSL_TYPES_H */ +Index: crypto/openssl/crypto/pkcs7/pkcs7.h +=================================================================== +--- crypto/openssl/crypto/pkcs7/pkcs7.h (revision 273303) ++++ crypto/openssl/crypto/pkcs7/pkcs7.h (working copy) +@@ -233,11 +233,7 @@ DECLARE_PKCS12_STACK_OF(PKCS7) + (OBJ_obj2nid((a)->type) == NID_pkcs7_signedAndEnveloped) + #define PKCS7_type_is_data(a) (OBJ_obj2nid((a)->type) == NID_pkcs7_data) + #define PKCS7_type_is_digest(a) (OBJ_obj2nid((a)->type) == NID_pkcs7_digest) +-#define PKCS7_type_is_encrypted(a) \ +- (OBJ_obj2nid((a)->type) == NID_pkcs7_encrypted) + +-#define PKCS7_type_is_digest(a) (OBJ_obj2nid((a)->type) == NID_pkcs7_digest) +- + #define PKCS7_set_detached(p,v) \ + PKCS7_ctrl(p,PKCS7_OP_SET_DETACHED_SIGNATURE,v,NULL) + #define PKCS7_get_detached(p) \ +Index: crypto/openssl/crypto/pqueue/pqueue.h +=================================================================== +--- crypto/openssl/crypto/pqueue/pqueue.h (revision 273303) ++++ crypto/openssl/crypto/pqueue/pqueue.h (working copy) +@@ -64,6 +64,9 @@ + #include + #include + ++#ifdef __cplusplus ++extern "C" { ++#endif + typedef struct _pqueue *pqueue; + + typedef struct _pitem +@@ -91,4 +94,7 @@ pitem *pqueue_next(piterator *iter); + void pqueue_print(pqueue pq); + int pqueue_size(pqueue pq); + ++#ifdef __cplusplus ++} ++#endif + #endif /* ! HEADER_PQUEUE_H */ +Index: crypto/openssl/crypto/rsa/Makefile +=================================================================== +--- crypto/openssl/crypto/rsa/Makefile (revision 273303) ++++ crypto/openssl/crypto/rsa/Makefile (working copy) +@@ -212,7 +212,7 @@ rsa_oaep.o: ../../include/openssl/opensslv.h ../.. + rsa_oaep.o: ../../include/openssl/rand.h ../../include/openssl/rsa.h + rsa_oaep.o: ../../include/openssl/safestack.h ../../include/openssl/sha.h + rsa_oaep.o: ../../include/openssl/stack.h ../../include/openssl/symhacks.h +-rsa_oaep.o: ../cryptlib.h rsa_oaep.c ++rsa_oaep.o: ../constant_time_locl.h ../cryptlib.h rsa_oaep.c + rsa_pk1.o: ../../e_os.h ../../include/openssl/asn1.h + rsa_pk1.o: ../../include/openssl/bio.h ../../include/openssl/bn.h + rsa_pk1.o: ../../include/openssl/buffer.h ../../include/openssl/crypto.h +@@ -221,7 +221,8 @@ rsa_pk1.o: ../../include/openssl/lhash.h ../../inc + rsa_pk1.o: ../../include/openssl/opensslv.h ../../include/openssl/ossl_typ.h + rsa_pk1.o: ../../include/openssl/rand.h ../../include/openssl/rsa.h + rsa_pk1.o: ../../include/openssl/safestack.h ../../include/openssl/stack.h +-rsa_pk1.o: ../../include/openssl/symhacks.h ../cryptlib.h rsa_pk1.c ++rsa_pk1.o: ../../include/openssl/symhacks.h ../constant_time_locl.h ++rsa_pk1.o: ../cryptlib.h rsa_pk1.c + rsa_pmeth.o: ../../e_os.h ../../include/openssl/asn1.h + rsa_pmeth.o: ../../include/openssl/asn1t.h ../../include/openssl/bio.h + rsa_pmeth.o: ../../include/openssl/bn.h ../../include/openssl/buffer.h +Index: crypto/openssl/crypto/rsa/rsa.h +=================================================================== +--- crypto/openssl/crypto/rsa/rsa.h (revision 273303) ++++ crypto/openssl/crypto/rsa/rsa.h (working copy) +@@ -559,6 +559,7 @@ void ERR_load_RSA_strings(void); + #define RSA_R_OPERATION_NOT_ALLOWED_IN_FIPS_MODE 158 + #define RSA_R_OPERATION_NOT_SUPPORTED_FOR_THIS_KEYTYPE 148 + #define RSA_R_PADDING_CHECK_FAILED 114 ++#define RSA_R_PKCS_DECODING_ERROR 159 + #define RSA_R_P_NOT_PRIME 128 + #define RSA_R_Q_NOT_PRIME 129 + #define RSA_R_RSA_OPERATIONS_NOT_SUPPORTED 130 +Index: crypto/openssl/crypto/rsa/rsa_err.c +=================================================================== +--- crypto/openssl/crypto/rsa/rsa_err.c (revision 273303) ++++ crypto/openssl/crypto/rsa/rsa_err.c (working copy) +@@ -175,6 +175,7 @@ static ERR_STRING_DATA RSA_str_reasons[]= + {ERR_REASON(RSA_R_OPERATION_NOT_ALLOWED_IN_FIPS_MODE),"operation not allowed in fips mode"}, + {ERR_REASON(RSA_R_OPERATION_NOT_SUPPORTED_FOR_THIS_KEYTYPE),"operation not supported for this keytype"}, + {ERR_REASON(RSA_R_PADDING_CHECK_FAILED) ,"padding check failed"}, ++{ERR_REASON(RSA_R_PKCS_DECODING_ERROR) ,"pkcs decoding error"}, + {ERR_REASON(RSA_R_P_NOT_PRIME) ,"p not prime"}, + {ERR_REASON(RSA_R_Q_NOT_PRIME) ,"q not prime"}, + {ERR_REASON(RSA_R_RSA_OPERATIONS_NOT_SUPPORTED),"rsa operations not supported"}, +Index: crypto/openssl/crypto/rsa/rsa_oaep.c +=================================================================== +--- crypto/openssl/crypto/rsa/rsa_oaep.c (revision 273303) ++++ crypto/openssl/crypto/rsa/rsa_oaep.c (working copy) +@@ -18,6 +18,7 @@ + * an equivalent notion. + */ + ++#include "constant_time_locl.h" + + #if !defined(OPENSSL_NO_SHA) && !defined(OPENSSL_NO_SHA1) + #include +@@ -95,92 +96,117 @@ int RSA_padding_check_PKCS1_OAEP(unsigned char *to + const unsigned char *from, int flen, int num, + const unsigned char *param, int plen) + { +- int i, dblen, mlen = -1; +- const unsigned char *maskeddb; +- int lzero; +- unsigned char *db = NULL, seed[SHA_DIGEST_LENGTH], phash[SHA_DIGEST_LENGTH]; +- unsigned char *padded_from; +- int bad = 0; ++ int i, dblen, mlen = -1, one_index = 0, msg_index; ++ unsigned int good, found_one_byte; ++ const unsigned char *maskedseed, *maskeddb; ++ /* |em| is the encoded message, zero-padded to exactly |num| bytes: ++ * em = Y || maskedSeed || maskedDB */ ++ unsigned char *db = NULL, *em = NULL, seed[EVP_MAX_MD_SIZE], ++ phash[EVP_MAX_MD_SIZE]; + +- if (--num < 2 * SHA_DIGEST_LENGTH + 1) +- /* 'num' is the length of the modulus, i.e. does not depend on the +- * particular ciphertext. */ ++ if (tlen <= 0 || flen <= 0) ++ return -1; ++ ++ /* ++ * |num| is the length of the modulus; |flen| is the length of the ++ * encoded message. Therefore, for any |from| that was obtained by ++ * decrypting a ciphertext, we must have |flen| <= |num|. Similarly, ++ * num < 2 * SHA_DIGEST_LENGTH + 2 must hold for the modulus ++ * irrespective of the ciphertext, see PKCS #1 v2.2, section 7.1.2. ++ * This does not leak any side-channel information. ++ */ ++ if (num < flen || num < 2 * SHA_DIGEST_LENGTH + 2) + goto decoding_err; + +- lzero = num - flen; +- if (lzero < 0) ++ dblen = num - SHA_DIGEST_LENGTH - 1; ++ db = OPENSSL_malloc(dblen); ++ em = OPENSSL_malloc(num); ++ if (db == NULL || em == NULL) + { +- /* signalling this error immediately after detection might allow +- * for side-channel attacks (e.g. timing if 'plen' is huge +- * -- cf. James H. Manger, "A Chosen Ciphertext Attack on RSA Optimal +- * Asymmetric Encryption Padding (OAEP) [...]", CRYPTO 2001), +- * so we use a 'bad' flag */ +- bad = 1; +- lzero = 0; +- flen = num; /* don't overflow the memcpy to padded_from */ +- } +- +- dblen = num - SHA_DIGEST_LENGTH; +- db = OPENSSL_malloc(dblen + num); +- if (db == NULL) +- { + RSAerr(RSA_F_RSA_PADDING_CHECK_PKCS1_OAEP, ERR_R_MALLOC_FAILURE); +- return -1; ++ goto cleanup; + } + +- /* Always do this zero-padding copy (even when lzero == 0) +- * to avoid leaking timing info about the value of lzero. */ +- padded_from = db + dblen; +- memset(padded_from, 0, lzero); +- memcpy(padded_from + lzero, from, flen); ++ /* ++ * Always do this zero-padding copy (even when num == flen) to avoid ++ * leaking that information. The copy still leaks some side-channel ++ * information, but it's impossible to have a fixed memory access ++ * pattern since we can't read out of the bounds of |from|. ++ * ++ * TODO(emilia): Consider porting BN_bn2bin_padded from BoringSSL. ++ */ ++ memset(em, 0, num); ++ memcpy(em + num - flen, from, flen); + +- maskeddb = padded_from + SHA_DIGEST_LENGTH; ++ /* ++ * The first byte must be zero, however we must not leak if this is ++ * true. See James H. Manger, "A Chosen Ciphertext Attack on RSA ++ * Optimal Asymmetric Encryption Padding (OAEP) [...]", CRYPTO 2001). ++ */ ++ good = constant_time_is_zero(em[0]); + ++ maskedseed = em + 1; ++ maskeddb = em + 1 + SHA_DIGEST_LENGTH; ++ + if (MGF1(seed, SHA_DIGEST_LENGTH, maskeddb, dblen)) +- return -1; ++ goto cleanup; + for (i = 0; i < SHA_DIGEST_LENGTH; i++) +- seed[i] ^= padded_from[i]; +- ++ seed[i] ^= maskedseed[i]; ++ + if (MGF1(db, dblen, seed, SHA_DIGEST_LENGTH)) +- return -1; ++ goto cleanup; + for (i = 0; i < dblen; i++) + db[i] ^= maskeddb[i]; + + if (!EVP_Digest((void *)param, plen, phash, NULL, EVP_sha1(), NULL)) +- return -1; ++ goto cleanup; + +- if (CRYPTO_memcmp(db, phash, SHA_DIGEST_LENGTH) != 0 || bad) ++ good &= constant_time_is_zero(CRYPTO_memcmp(db, phash, SHA_DIGEST_LENGTH)); ++ ++ found_one_byte = 0; ++ for (i = SHA_DIGEST_LENGTH; i < dblen; i++) ++ { ++ /* Padding consists of a number of 0-bytes, followed by a 1. */ ++ unsigned int equals1 = constant_time_eq(db[i], 1); ++ unsigned int equals0 = constant_time_is_zero(db[i]); ++ one_index = constant_time_select_int(~found_one_byte & equals1, ++ i, one_index); ++ found_one_byte |= equals1; ++ good &= (found_one_byte | equals0); ++ } ++ ++ good &= found_one_byte; ++ ++ /* ++ * At this point |good| is zero unless the plaintext was valid, ++ * so plaintext-awareness ensures timing side-channels are no longer a ++ * concern. ++ */ ++ if (!good) + goto decoding_err; ++ ++ msg_index = one_index + 1; ++ mlen = dblen - msg_index; ++ ++ if (tlen < mlen) ++ { ++ RSAerr(RSA_F_RSA_PADDING_CHECK_PKCS1_OAEP, RSA_R_DATA_TOO_LARGE); ++ mlen = -1; ++ } + else + { +- for (i = SHA_DIGEST_LENGTH; i < dblen; i++) +- if (db[i] != 0x00) +- break; +- if (i == dblen || db[i] != 0x01) +- goto decoding_err; +- else +- { +- /* everything looks OK */ +- +- mlen = dblen - ++i; +- if (tlen < mlen) +- { +- RSAerr(RSA_F_RSA_PADDING_CHECK_PKCS1_OAEP, RSA_R_DATA_TOO_LARGE); +- mlen = -1; +- } +- else +- memcpy(to, db + i, mlen); +- } ++ memcpy(to, db + msg_index, mlen); ++ goto cleanup; + } +- OPENSSL_free(db); +- return mlen; + + decoding_err: +- /* to avoid chosen ciphertext attacks, the error message should not reveal +- * which kind of decoding error happened */ ++ /* To avoid chosen ciphertext attacks, the error message should not reveal ++ * which kind of decoding error happened. */ + RSAerr(RSA_F_RSA_PADDING_CHECK_PKCS1_OAEP, RSA_R_OAEP_DECODING_ERROR); ++cleanup: + if (db != NULL) OPENSSL_free(db); +- return -1; ++ if (em != NULL) OPENSSL_free(em); ++ return mlen; + } + + int PKCS1_MGF1(unsigned char *mask, long len, +Index: crypto/openssl/crypto/rsa/rsa_pk1.c +=================================================================== +--- crypto/openssl/crypto/rsa/rsa_pk1.c (revision 273303) ++++ crypto/openssl/crypto/rsa/rsa_pk1.c (working copy) +@@ -56,6 +56,8 @@ + * [including the GNU Public Licence.] + */ + ++#include "constant_time_locl.h" ++ + #include + #include "cryptlib.h" + #include +@@ -181,44 +183,87 @@ int RSA_padding_add_PKCS1_type_2(unsigned char *to + int RSA_padding_check_PKCS1_type_2(unsigned char *to, int tlen, + const unsigned char *from, int flen, int num) + { +- int i,j; +- const unsigned char *p; ++ int i; ++ /* |em| is the encoded message, zero-padded to exactly |num| bytes */ ++ unsigned char *em = NULL; ++ unsigned int good, found_zero_byte; ++ int zero_index = 0, msg_index, mlen = -1; + +- p=from; +- if ((num != (flen+1)) || (*(p++) != 02)) ++ if (tlen < 0 || flen < 0) ++ return -1; ++ ++ /* PKCS#1 v1.5 decryption. See "PKCS #1 v2.2: RSA Cryptography ++ * Standard", section 7.2.2. */ ++ ++ if (flen > num) ++ goto err; ++ ++ if (num < 11) ++ goto err; ++ ++ em = OPENSSL_malloc(num); ++ if (em == NULL) + { +- RSAerr(RSA_F_RSA_PADDING_CHECK_PKCS1_TYPE_2,RSA_R_BLOCK_TYPE_IS_NOT_02); +- return(-1); ++ RSAerr(RSA_F_RSA_PADDING_CHECK_PKCS1_TYPE_2, ERR_R_MALLOC_FAILURE); ++ return -1; + } +-#ifdef PKCS1_CHECK +- return(num-11); +-#endif ++ memset(em, 0, num); ++ /* ++ * Always do this zero-padding copy (even when num == flen) to avoid ++ * leaking that information. The copy still leaks some side-channel ++ * information, but it's impossible to have a fixed memory access ++ * pattern since we can't read out of the bounds of |from|. ++ * ++ * TODO(emilia): Consider porting BN_bn2bin_padded from BoringSSL. ++ */ ++ memcpy(em + num - flen, from, flen); + +- /* scan over padding data */ +- j=flen-1; /* one for type. */ +- for (i=0; i tlen) +- { +- RSAerr(RSA_F_RSA_PADDING_CHECK_PKCS1_TYPE_2,RSA_R_DATA_TOO_LARGE); +- return(-1); +- } +- memcpy(to,p,(unsigned int)j); + +- return(j); ++ memcpy(to, em + msg_index, mlen); ++ ++err: ++ if (em != NULL) ++ OPENSSL_free(em); ++ if (mlen == -1) ++ RSAerr(RSA_F_RSA_PADDING_CHECK_PKCS1_TYPE_2, RSA_R_PKCS_DECODING_ERROR); ++ return mlen; + } +- +Index: crypto/openssl/crypto/rsa/rsa_sign.c +=================================================================== +--- crypto/openssl/crypto/rsa/rsa_sign.c (revision 273303) ++++ crypto/openssl/crypto/rsa/rsa_sign.c (working copy) +@@ -151,6 +151,25 @@ int RSA_sign(int type, const unsigned char *m, uns + return(ret); + } + ++/* ++ * Check DigestInfo structure does not contain extraneous data by reencoding ++ * using DER and checking encoding against original. ++ */ ++static int rsa_check_digestinfo(X509_SIG *sig, const unsigned char *dinfo, int dinfolen) ++ { ++ unsigned char *der = NULL; ++ int derlen; ++ int ret = 0; ++ derlen = i2d_X509_SIG(sig, &der); ++ if (derlen <= 0) ++ return 0; ++ if (derlen == dinfolen && !memcmp(dinfo, der, derlen)) ++ ret = 1; ++ OPENSSL_cleanse(der, derlen); ++ OPENSSL_free(der); ++ return ret; ++ } ++ + int int_rsa_verify(int dtype, const unsigned char *m, + unsigned int m_len, + unsigned char *rm, size_t *prm_len, +@@ -228,7 +247,7 @@ int int_rsa_verify(int dtype, const unsigned char + if (sig == NULL) goto err; + + /* Excess data can be used to create forgeries */ +- if(p != s+i) ++ if(p != s+i || !rsa_check_digestinfo(sig, s, i)) + { + RSAerr(RSA_F_INT_RSA_VERIFY,RSA_R_BAD_SIGNATURE); + goto err; +Index: crypto/openssl/crypto/stack/safestack.h +=================================================================== +--- crypto/openssl/crypto/stack/safestack.h (revision 273303) ++++ crypto/openssl/crypto/stack/safestack.h (working copy) +@@ -57,6 +57,10 @@ + + #include + ++#ifdef __cplusplus ++extern "C" { ++#endif ++ + #ifndef CHECKED_PTR_OF + #define CHECKED_PTR_OF(type, p) \ + ((void*) (1 ? p : (type*)0)) +@@ -2660,4 +2664,8 @@ DECLARE_SPECIAL_STACK_OF(OPENSSL_BLOCK, void) + #define lh_SSL_SESSION_free(lh) LHM_lh_free(SSL_SESSION,lh) + /* End of util/mkstack.pl block, you may now edit :-) */ + ++ ++#ifdef __cplusplus ++} ++#endif + #endif /* !defined HEADER_SAFESTACK_H */ +Index: crypto/openssl/doc/apps/c_rehash.pod +=================================================================== +--- crypto/openssl/doc/apps/c_rehash.pod (revision 0) ++++ crypto/openssl/doc/apps/c_rehash.pod (working copy) +@@ -0,0 +1,81 @@ ++=pod ++ ++=for comment ++Original text by James Westby, contributed under the OpenSSL license. ++ ++=head1 NAME ++ ++c_rehash - Create symbolic links to files named by the hash values ++ ++=head1 SYNOPSIS ++ ++B ++[ I...] ++ ++=head1 DESCRIPTION ++ ++B scans directories and calculates a hash value of each C<.pem> ++file in the specified directory list and creates symbolic links ++for each file, where the name of the link is the hash value. ++This utility is useful as many programs that use OpenSSL require ++directories to be set up like this in order to find certificates. ++ ++If any directories are named on the command line, then those are ++processed in turn. If not, then the B environment variable ++is consulted; this shold be a colon-separated list of directories, ++like the Unix B variable. ++If that is not set then the default directory (installation-specific ++but often B) is processed. ++ ++In order for a directory to be processed, the user must have write ++permissions on that directory, otherwise it will be skipped. ++The links created are of the form C, where each B ++is a hexadecimal character and B is a single decimal digit. ++When processing a directory, B will first remove all links ++that have a name in that syntax. If you have links in that format ++used for other purposes, they will be removed. ++Hashes for CRL's look similar except the letter B appears after ++the period, like this: C. ++ ++Multiple objects may have the same hash; they will be indicated by ++incrementing the B value. Duplicates are found by comparing the ++full SHA-1 fingerprint. A warning will be displayed if a duplicate ++is found. ++ ++A warning will also be displayed if there are B<.pem> files that ++cannot be parsed as either a certificate or a CRL. ++ ++The program uses the B program to compute the hashes and ++fingerprints. If not found in the user's B, then set the ++B environment variable to the full pathname. ++Any program can be used, it will be invoked as follows for either ++a certificate or CRL: ++ ++ $OPENSSL x509 -hash -fingerprint -noout -in FFFFFF ++ $OPENSSL crl -hash -fingerprint -noout -in FFFFFF ++ ++where B is the filename. It must output the hash of the ++file on the first line, and the fingerprint on the second, ++optionally prefixed with some text and an equals sign. ++ ++=head1 ENVIRONMENT ++ ++=over ++ ++=item B ++ ++The path to an executable to use to generate hashes and ++fingerprints (see above). ++ ++=item B ++ ++Colon separated list of directories to operate on. ++Ignored if directories are listed on the command line. ++ ++=back ++ ++=head1 SEE ALSO ++ ++L, ++L. ++L. +Index: crypto/openssl/doc/apps/dgst.pod +=================================================================== +--- crypto/openssl/doc/apps/dgst.pod (revision 273303) ++++ crypto/openssl/doc/apps/dgst.pod (working copy) +@@ -2,16 +2,17 @@ + + =head1 NAME + +-dgst, md5, md4, md2, sha1, sha, mdc2, ripemd160 - message digests ++dgst, sha, sha1, mdc2, ripemd160, sha224, sha256, sha384, sha512, md2, md4, md5, dss1 - message digests + + =head1 SYNOPSIS + + B B +-[B<-md5|-md4|-md2|-sha1|-sha|-mdc2|-ripemd160|-dss1>] ++[B<-sha|-sha1|-mdc2|-ripemd160|-sha224|-sha256|-sha384|-sha512|-md2|-md4|-md5|-dss1>] + [B<-c>] + [B<-d>] + [B<-hex>] + [B<-binary>] ++[B<-r>] + [B<-out filename>] + [B<-sign filename>] + [B<-keyform arg>] +@@ -20,17 +21,19 @@ B B + [B<-prverify filename>] + [B<-signature filename>] + [B<-hmac key>] ++[B<-non-fips-allow>] ++[B<-fips-fingerprint>] + [B] + +-[B] +-[B<-c>] +-[B<-d>] +-[B] ++B ++[I] ++[B<...>] + + =head1 DESCRIPTION + + The digest functions output the message digest of a supplied file or files +-in hexadecimal form. They can also be used for digital signing and verification. ++in hexadecimal. The digest functions also generate and verify digital ++signatures using message digests. + + =head1 OPTIONS + +@@ -48,12 +51,17 @@ print out BIO debugging information. + =item B<-hex> + + digest is to be output as a hex dump. This is the default case for a "normal" +-digest as opposed to a digital signature. ++digest as opposed to a digital signature. See NOTES below for digital ++signatures using B<-hex>. + + =item B<-binary> + + output the digest or signature in binary form. + ++=item B<-r> ++ ++output the digest in the "coreutils" format used by programs like B. ++ + =item B<-out filename> + + filename to output to, or standard output by default. +@@ -64,8 +72,8 @@ digitally sign the digest using the private key in + + =item B<-keyform arg> + +-Specifies the key format to sign digest with. Only PEM and ENGINE +-formats are supported by the B command. ++Specifies the key format to sign digest with. The DER, PEM, P12, ++and ENGINE formats are supported. + + =item B<-engine id> + +@@ -117,7 +125,7 @@ Following options are supported by both by B + =over 8 + + =item B +- ++ + Specifies MAC key as alphnumeric string (use if key contain printable + characters only). String length must conform to any restrictions of + the MAC algorithm for example exactly 32 chars for gost-mac. +@@ -138,6 +146,15 @@ Multiple files can be specified separated by a OS- + The separator is B<;> for MS-Windows, B<,> for OpenVMS, and B<:> for + all others. + ++=item B<-non-fips-allow> ++ ++enable use of non-FIPS algorithms such as MD5 even in FIPS mode. ++ ++=item B<-fips-fingerprint> ++ ++compute HMAC using a specific key ++for certain OpenSSL-FIPS operations. ++ + =item B + + file or files to digest. If no files are specified then standard input is +@@ -145,18 +162,41 @@ used. + + =back + ++ ++=head1 EXAMPLES ++ ++To create a hex-encoded message digest of a file: ++ openssl dgst -md5 -hex file.txt ++ ++To sign a file using SHA-256 with binary file output: ++ openssl dgst -sha256 -sign privatekey.pem -out signature.sign file.txt ++ ++To verify a signature: ++ openssl dgst -sha256 -verify publickey.pem \ ++ -signature signature.sign \ ++ file.txt ++ ++ + =head1 NOTES + + The digest of choice for all new applications is SHA1. Other digests are + however still widely used. + +-If you wish to sign or verify data using the DSA algorithm then the dss1 +-digest must be used. ++When signing a file, B will automatically determine the algorithm ++(RSA, ECC, etc) to use for signing based on the private key's ASN.1 info. ++When verifying signatures, it only handles the RSA, DSA, or ECDSA signature ++itself, not the related data to identify the signer and algorithm used in ++formats such as x.509, CMS, and S/MIME. + + A source of random numbers is required for certain signing algorithms, in +-particular DSA. ++particular ECDSA and DSA. + + The signing and verify options should only be used if a single file is + being signed or verified. + ++Hex signatures cannot be verified using B. Instead, use "xxd -r" ++or similar program to transform the hex signature into a binary signature ++prior to verification. ++ ++ + =cut +Index: crypto/openssl/doc/crypto/BIO_s_accept.pod +=================================================================== +--- crypto/openssl/doc/crypto/BIO_s_accept.pod (revision 273303) ++++ crypto/openssl/doc/crypto/BIO_s_accept.pod (working copy) +@@ -59,8 +59,8 @@ the accept socket. See L + BIO_set_accept_port() uses the string B to set the accept + port. The port is represented as a string of the form "host:port", + where "host" is the interface to use and "port" is the port. +-Either or both values can be "*" which is interpreted as meaning +-any interface or port respectively. "port" has the same syntax ++The host can be can be "*" which is interpreted as meaning ++any interface; "port" has the same syntax + as the port specified in BIO_set_conn_port() for connect BIOs, + that is it can be a numerical port string or a string to lookup + using getservbyname() and a string table. +Index: crypto/openssl/doc/crypto/CMS_add1_signer.pod +=================================================================== +--- crypto/openssl/doc/crypto/CMS_add1_signer.pod (revision 0) ++++ crypto/openssl/doc/crypto/CMS_add1_signer.pod (working copy) +@@ -0,0 +1,101 @@ ++=pod ++ ++=head1 NAME ++ ++ CMS_add1_signer, CMS_SignerInfo_sign - add a signer to a CMS_ContentInfo signed data structure. ++ ++=head1 SYNOPSIS ++ ++ #include ++ ++ CMS_SignerInfo *CMS_add1_signer(CMS_ContentInfo *cms, X509 *signcert, EVP_PKEY *pkey, const EVP_MD *md, unsigned int flags); ++ ++ int CMS_SignerInfo_sign(CMS_SignerInfo *si); ++ ++ ++=head1 DESCRIPTION ++ ++CMS_add1_signer() adds a signer with certificate B and private ++key B using message digest B to CMS_ContentInfo SignedData ++structure B. ++ ++The CMS_ContentInfo structure should be obtained from an initial call to ++CMS_sign() with the flag B set or in the case or re-signing a ++valid CMS_ContentInfo SignedData structure. ++ ++If the B parameter is B then the default digest for the public ++key algorithm will be used. ++ ++Unless the B flag is set the returned CMS_ContentInfo ++structure is not complete and must be finalized either by streaming (if ++applicable) or a call to CMS_final(). ++ ++The CMS_SignerInfo_sign() function will explicitly sign a CMS_SignerInfo ++structure, its main use is when B and B flags ++are both set. ++ ++=head1 NOTES ++ ++The main purpose of CMS_add1_signer() is to provide finer control ++over a CMS signed data structure where the simpler CMS_sign() function defaults ++are not appropriate. For example if multiple signers or non default digest ++algorithms are needed. New attributes can also be added using the returned ++CMS_SignerInfo structure and the CMS attribute utility functions or the ++CMS signed receipt request functions. ++ ++Any of the following flags (ored together) can be passed in the B ++parameter. ++ ++If B is set then an attempt is made to copy the content ++digest value from the CMS_ContentInfo structure: to add a signer to an existing ++structure. An error occurs if a matching digest value cannot be found to copy. ++The returned CMS_ContentInfo structure will be valid and finalized when this ++flag is set. ++ ++If B is set in addition to B then the ++CMS_SignerInfo structure will not be finalized so additional attributes ++can be added. In this case an explicit call to CMS_SignerInfo_sign() is ++needed to finalize it. ++ ++If B is set the signer's certificate will not be included in the ++CMS_ContentInfo structure, the signer's certificate must still be supplied in ++the B parameter though. This can reduce the size of the signature if ++the signers certificate can be obtained by other means: for example a ++previously signed message. ++ ++The SignedData structure includes several CMS signedAttributes including the ++signing time, the CMS content type and the supported list of ciphers in an ++SMIMECapabilities attribute. If B is set then no signedAttributes ++will be used. If B is set then just the SMIMECapabilities are ++omitted. ++ ++OpenSSL will by default identify signing certificates using issuer name ++and serial number. If B is set it will use the subject key ++identifier value instead. An error occurs if the signing certificate does not ++have a subject key identifier extension. ++ ++If present the SMIMECapabilities attribute indicates support for the following ++algorithms in preference order: 256 bit AES, Gost R3411-94, Gost 28147-89, 192 ++bit AES, 128 bit AES, triple DES, 128 bit RC2, 64 bit RC2, DES and 40 bit RC2. ++If any of these algorithms is not available then it will not be included: for example the GOST algorithms will not be included if the GOST ENGINE is ++not loaded. ++ ++CMS_add1_signer() returns an internal pointer to the CMS_SignerInfo ++structure just added, this can be used to set additional attributes ++before it is finalized. ++ ++=head1 RETURN VALUES ++ ++CMS_add1_signer() returns an internal pointer to the CMS_SignerInfo ++structure just added or NULL if an error occurs. ++ ++=head1 SEE ALSO ++ ++L, L, ++L, ++ ++=head1 HISTORY ++ ++CMS_add1_signer() was added to OpenSSL 0.9.8 ++ ++=cut +Index: crypto/openssl/doc/crypto/CMS_sign_add1_signer.pod +=================================================================== +--- crypto/openssl/doc/crypto/CMS_sign_add1_signer.pod (revision 273303) ++++ crypto/openssl/doc/crypto/CMS_sign_add1_signer.pod (working copy) +@@ -1,101 +0,0 @@ +-=pod +- +-=head1 NAME +- +- CMS_sign_add1_signer, CMS_SignerInfo_sign - add a signer to a CMS_ContentInfo signed data structure. +- +-=head1 SYNOPSIS +- +- #include +- +- CMS_SignerInfo *CMS_sign_add1_signer(CMS_ContentInfo *cms, X509 *signcert, EVP_PKEY *pkey, const EVP_MD *md, unsigned int flags); +- +- int CMS_SignerInfo_sign(CMS_SignerInfo *si); +- +- +-=head1 DESCRIPTION +- +-CMS_sign_add1_signer() adds a signer with certificate B and private +-key B using message digest B to CMS_ContentInfo SignedData +-structure B. +- +-The CMS_ContentInfo structure should be obtained from an initial call to +-CMS_sign() with the flag B set or in the case or re-signing a +-valid CMS_ContentInfo SignedData structure. +- +-If the B parameter is B then the default digest for the public +-key algorithm will be used. +- +-Unless the B flag is set the returned CMS_ContentInfo +-structure is not complete and must be finalized either by streaming (if +-applicable) or a call to CMS_final(). +- +-The CMS_SignerInfo_sign() function will explicitly sign a CMS_SignerInfo +-structure, its main use is when B and B flags +-are both set. +- +-=head1 NOTES +- +-The main purpose of CMS_sign_add1_signer() is to provide finer control +-over a CMS signed data structure where the simpler CMS_sign() function defaults +-are not appropriate. For example if multiple signers or non default digest +-algorithms are needed. New attributes can also be added using the returned +-CMS_SignerInfo structure and the CMS attribute utility functions or the +-CMS signed receipt request functions. +- +-Any of the following flags (ored together) can be passed in the B +-parameter. +- +-If B is set then an attempt is made to copy the content +-digest value from the CMS_ContentInfo structure: to add a signer to an existing +-structure. An error occurs if a matching digest value cannot be found to copy. +-The returned CMS_ContentInfo structure will be valid and finalized when this +-flag is set. +- +-If B is set in addition to B then the +-CMS_SignerInfo structure will not be finalized so additional attributes +-can be added. In this case an explicit call to CMS_SignerInfo_sign() is +-needed to finalize it. +- +-If B is set the signer's certificate will not be included in the +-CMS_ContentInfo structure, the signer's certificate must still be supplied in +-the B parameter though. This can reduce the size of the signature if +-the signers certificate can be obtained by other means: for example a +-previously signed message. +- +-The SignedData structure includes several CMS signedAttributes including the +-signing time, the CMS content type and the supported list of ciphers in an +-SMIMECapabilities attribute. If B is set then no signedAttributes +-will be used. If B is set then just the SMIMECapabilities are +-omitted. +- +-OpenSSL will by default identify signing certificates using issuer name +-and serial number. If B is set it will use the subject key +-identifier value instead. An error occurs if the signing certificate does not +-have a subject key identifier extension. +- +-If present the SMIMECapabilities attribute indicates support for the following +-algorithms in preference order: 256 bit AES, Gost R3411-94, Gost 28147-89, 192 +-bit AES, 128 bit AES, triple DES, 128 bit RC2, 64 bit RC2, DES and 40 bit RC2. +-If any of these algorithms is not available then it will not be included: for example the GOST algorithms will not be included if the GOST ENGINE is +-not loaded. +- +-CMS_sign_add1_signer() returns an internal pointer to the CMS_SignerInfo +-structure just added, this can be used to set additional attributes +-before it is finalized. +- +-=head1 RETURN VALUES +- +-CMS_sign1_add_signers() returns an internal pointer to the CMS_SignerInfo +-structure just added or NULL if an error occurs. +- +-=head1 SEE ALSO +- +-L, L, +-L, +- +-=head1 HISTORY +- +-CMS_sign_add1_signer() was added to OpenSSL 0.9.8 +- +-=cut +Index: crypto/openssl/doc/crypto/EVP_DigestInit.pod +=================================================================== +--- crypto/openssl/doc/crypto/EVP_DigestInit.pod (revision 273303) ++++ crypto/openssl/doc/crypto/EVP_DigestInit.pod (working copy) +@@ -26,13 +26,13 @@ EVP digest routines + int EVP_MD_CTX_cleanup(EVP_MD_CTX *ctx); + void EVP_MD_CTX_destroy(EVP_MD_CTX *ctx); + +- int EVP_MD_CTX_copy_ex(EVP_MD_CTX *out,const EVP_MD_CTX *in); ++ int EVP_MD_CTX_copy_ex(EVP_MD_CTX *out,const EVP_MD_CTX *in); + + int EVP_DigestInit(EVP_MD_CTX *ctx, const EVP_MD *type); + int EVP_DigestFinal(EVP_MD_CTX *ctx, unsigned char *md, + unsigned int *s); + +- int EVP_MD_CTX_copy(EVP_MD_CTX *out,EVP_MD_CTX *in); ++ int EVP_MD_CTX_copy(EVP_MD_CTX *out,EVP_MD_CTX *in); + + #define EVP_MAX_MD_SIZE 64 /* SHA512 */ + +@@ -136,10 +136,10 @@ reasons. + EVP_md2(), EVP_md5(), EVP_sha(), EVP_sha1(), EVP_sha224(), EVP_sha256(), + EVP_sha384(), EVP_sha512(), EVP_mdc2() and EVP_ripemd160() return B + structures for the MD2, MD5, SHA, SHA1, SHA224, SHA256, SHA384, SHA512, MDC2 +-and RIPEMD160 digest algorithms respectively. ++and RIPEMD160 digest algorithms respectively. + + EVP_dss() and EVP_dss1() return B structures for SHA and SHA1 digest +-algorithms but using DSS (DSA) for the signature algorithm. Note: there is ++algorithms but using DSS (DSA) for the signature algorithm. Note: there is + no need to use these pseudo-digests in OpenSSL 1.0.0 and later, they are + however retained for compatibility. + +@@ -177,21 +177,21 @@ The B interface to message digests should alm + preference to the low level interfaces. This is because the code then becomes + transparent to the digest used and much more flexible. + +-New applications should use the SHA2 digest algorithms such as SHA256. ++New applications should use the SHA2 digest algorithms such as SHA256. + The other digest algorithms are still in common use. + + For most applications the B parameter to EVP_DigestInit_ex() will be + set to NULL to use the default digest implementation. + +-The functions EVP_DigestInit(), EVP_DigestFinal() and EVP_MD_CTX_copy() are ++The functions EVP_DigestInit(), EVP_DigestFinal() and EVP_MD_CTX_copy() are + obsolete but are retained to maintain compatibility with existing code. New +-applications should use EVP_DigestInit_ex(), EVP_DigestFinal_ex() and ++applications should use EVP_DigestInit_ex(), EVP_DigestFinal_ex() and + EVP_MD_CTX_copy_ex() because they can efficiently reuse a digest context + instead of initializing and cleaning it up on each call and allow non default + implementations of digests to be specified. + + In OpenSSL 0.9.7 and later if digest contexts are not cleaned up after use +-memory leaks will occur. ++memory leaks will occur. + + Stack allocation of EVP_MD_CTX structures is common, for example: + +@@ -245,15 +245,19 @@ digest name passed on the command line. + EVP_MD_CTX_destroy(mdctx); + + printf("Digest is: "); +- for(i = 0; i < md_len; i++) printf("%02x", md_value[i]); ++ for(i = 0; i < md_len; i++) ++ printf("%02x", md_value[i]); + printf("\n"); ++ ++ /* Call this once before exit. */ ++ EVP_cleanup(); ++ exit(0); + } + + =head1 SEE ALSO + +-L, L, L, +-L, L, L, +-L, L ++L, ++L + + =head1 HISTORY + +@@ -269,7 +273,7 @@ EVP_dss(), EVP_dss1(), EVP_mdc2() and EVP_ripemd16 + changed to return truely const EVP_MD * in OpenSSL 0.9.7. + + The link between digests and signing algorithms was fixed in OpenSSL 1.0 and +-later, so now EVP_sha1() can be used with RSA and DSA, there is no need to ++later, so now EVP_sha1() can be used with RSA and DSA; there is no need to + use EVP_dss1() any more. + + OpenSSL 1.0 and later does not include the MD2 digest algorithm in the +Index: crypto/openssl/doc/crypto/EVP_DigestVerifyInit.pod +=================================================================== +--- crypto/openssl/doc/crypto/EVP_DigestVerifyInit.pod (revision 273303) ++++ crypto/openssl/doc/crypto/EVP_DigestVerifyInit.pod (working copy) +@@ -38,7 +38,7 @@ or a negative value for failure. In particular a r + the operation is not supported by the public key algorithm. + + Unlike other functions the return value 0 from EVP_DigestVerifyFinal() only +-indicates that the signature did not not verify successfully (that is tbs did ++indicates that the signature did not verify successfully (that is tbs did + not match the original data or the signature was of invalid form) it is not an + indication of a more serious error. + +@@ -59,7 +59,7 @@ For some key types and parameters the random numbe + or the operation will fail. + + The call to EVP_DigestVerifyFinal() internally finalizes a copy of the digest +-context. This means that calls to EVP_VerifyUpdate() and EVP_VerifyFinal() can ++context. This means that EVP_VerifyUpdate() and EVP_VerifyFinal() can + be called later to digest and verify additional data. + + Since only a copy of the digest context is ever finalized the context must +Index: crypto/openssl/doc/crypto/EVP_EncryptInit.pod +=================================================================== +--- crypto/openssl/doc/crypto/EVP_EncryptInit.pod (revision 273303) ++++ crypto/openssl/doc/crypto/EVP_EncryptInit.pod (working copy) +@@ -387,28 +387,8 @@ for certain common S/MIME ciphers (RC2, DES, tripl + + =head1 EXAMPLES + +-Get the number of rounds used in RC5: ++Encrypt a string using IDEA: + +- int nrounds; +- EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_GET_RC5_ROUNDS, 0, &nrounds); +- +-Get the RC2 effective key length: +- +- int key_bits; +- EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_GET_RC2_KEY_BITS, 0, &key_bits); +- +-Set the number of rounds used in RC5: +- +- int nrounds; +- EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_SET_RC5_ROUNDS, nrounds, NULL); +- +-Set the effective key length used in RC2: +- +- int key_bits; +- EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_SET_RC2_KEY_BITS, key_bits, NULL); +- +-Encrypt a string using blowfish: +- + int do_crypt(char *outfile) + { + unsigned char outbuf[1024]; +@@ -421,8 +401,9 @@ for certain common S/MIME ciphers (RC2, DES, tripl + char intext[] = "Some Crypto Text"; + EVP_CIPHER_CTX ctx; + FILE *out; ++ + EVP_CIPHER_CTX_init(&ctx); +- EVP_EncryptInit_ex(&ctx, EVP_bf_cbc(), NULL, key, iv); ++ EVP_EncryptInit_ex(&ctx, EVP_idea_cbc(), NULL, key, iv); + + if(!EVP_EncryptUpdate(&ctx, outbuf, &outlen, intext, strlen(intext))) + { +@@ -451,28 +432,34 @@ for certain common S/MIME ciphers (RC2, DES, tripl + } + + The ciphertext from the above example can be decrypted using the B +-utility with the command line: ++utility with the command line (shown on two lines for clarity): + +- S ++ openssl idea -d or + B if the key is not of the correct type. + +-EVP_PKEY_assign_RSA() EVP_PKEY_assign_DSA(), EVP_PKEY_assign_DH() ++EVP_PKEY_assign_RSA(), EVP_PKEY_assign_DSA(), EVP_PKEY_assign_DH() + and EVP_PKEY_assign_EC_KEY() also set the referenced key to B + however these use the supplied B internally and so B + will be freed when the parent B is freed. +@@ -54,8 +54,8 @@ In accordance with the OpenSSL naming convention t + from or assigned to the B using the B<1> functions must be + freed as well as B. + +-EVP_PKEY_assign_RSA() EVP_PKEY_assign_DSA(), EVP_PKEY_assign_DH() +-EVP_PKEY_assign_EC_KEY() are implemented as macros. ++EVP_PKEY_assign_RSA(), EVP_PKEY_assign_DSA(), EVP_PKEY_assign_DH() ++and EVP_PKEY_assign_EC_KEY() are implemented as macros. + + =head1 RETURN VALUES + +@@ -66,7 +66,7 @@ EVP_PKEY_get1_RSA(), EVP_PKEY_get1_DSA(), EVP_PKEY + EVP_PKEY_get1_EC_KEY() return the referenced key or B if + an error occurred. + +-EVP_PKEY_assign_RSA() EVP_PKEY_assign_DSA(), EVP_PKEY_assign_DH() ++EVP_PKEY_assign_RSA(), EVP_PKEY_assign_DSA(), EVP_PKEY_assign_DH() + and EVP_PKEY_assign_EC_KEY() return 1 for success and 0 for failure. + + =head1 SEE ALSO +Index: crypto/openssl/doc/crypto/EVP_PKEY_sign.pod +=================================================================== +--- crypto/openssl/doc/crypto/EVP_PKEY_sign.pod (revision 273303) ++++ crypto/openssl/doc/crypto/EVP_PKEY_sign.pod (working copy) +@@ -28,9 +28,14 @@ B and the amount of data written to B + + =head1 NOTES + ++EVP_PKEY_sign() does not hash the data to be signed, and therefore is ++normally used to sign digests. For signing arbitrary messages, see the ++L and ++L signing interfaces instead. ++ + After the call to EVP_PKEY_sign_init() algorithm specific control + operations can be performed to set any appropriate parameters for the +-operation. ++operation (see L). + + The function EVP_PKEY_sign() can be called more than once on the same + context if several operations are performed using the same parameters. +@@ -49,13 +54,17 @@ Sign data using RSA with PKCS#1 padding and SHA256 + #include + + EVP_PKEY_CTX *ctx; ++ /* md is a SHA-256 digest in this example. */ + unsigned char *md, *sig; +- size_t mdlen, siglen; ++ size_t mdlen = 32, siglen; + EVP_PKEY *signing_key; +- /* NB: assumes signing_key, md and mdlen are already set up +- * and that signing_key is an RSA private key ++ ++ /* ++ * NB: assumes signing_key and md are set up before the next ++ * step. signing_key must be an RSA private key and md must ++ * point to the SHA-256 digest to be signed. + */ +- ctx = EVP_PKEY_CTX_new(signing_key); ++ ctx = EVP_PKEY_CTX_new(signing_key, NULL /* no engine */); + if (!ctx) + /* Error occurred */ + if (EVP_PKEY_sign_init(ctx) <= 0) +@@ -83,6 +92,7 @@ Sign data using RSA with PKCS#1 padding and SHA256 + =head1 SEE ALSO + + L, ++L, + L, + L, + L, +Index: crypto/openssl/doc/ssl/SSL_CTX_set_tmp_dh_callback.pod +=================================================================== +--- crypto/openssl/doc/ssl/SSL_CTX_set_tmp_dh_callback.pod (revision 273303) ++++ crypto/openssl/doc/ssl/SSL_CTX_set_tmp_dh_callback.pod (working copy) +@@ -48,12 +48,13 @@ even if he gets hold of the normal (certified) key + only used for signing. + + In order to perform a DH key exchange the server must use a DH group +-(DH parameters) and generate a DH key. The server will always generate a new +-DH key during the negotiation, when the DH parameters are supplied via +-callback and/or when the SSL_OP_SINGLE_DH_USE option of +-L is set. It will +-immediately create a DH key, when DH parameters are supplied via +-SSL_CTX_set_tmp_dh() and SSL_OP_SINGLE_DH_USE is not set. In this case, ++(DH parameters) and generate a DH key. ++The server will always generate a new DH key during the negotiation ++if either the DH parameters are supplied via callback or the ++SSL_OP_SINGLE_DH_USE option of SSL_CTX_set_options(3) is set (or both). ++It will immediately create a DH key if DH parameters are supplied via ++SSL_CTX_set_tmp_dh() and SSL_OP_SINGLE_DH_USE is not set. ++In this case, + it may happen that a key is generated on initialization without later + being needed, while on the other hand the computer time during the + negotiation is being saved. +@@ -139,7 +140,7 @@ partly left out.) + dh_tmp = dh_512; + break; + case 1024: +- if (!dh_1024) ++ if (!dh_1024) + dh_1024 = get_dh1024(); + dh_tmp = dh_1024; + break; +Index: crypto/openssl/e_os.h +=================================================================== +--- crypto/openssl/e_os.h (revision 273303) ++++ crypto/openssl/e_os.h (working copy) +@@ -373,8 +373,17 @@ static unsigned int _strlen31(const char *str) + # define check_winnt() (1) + #else + # define check_winnt() (GetVersion() < 0x80000000) +-#endif ++#endif + ++/* ++ * Visual Studio: inline is available in C++ only, however ++ * __inline is available for C, see ++ * http://msdn.microsoft.com/en-us/library/z8y1yy88.aspx ++ */ ++#if defined(_MSC_VER) && !defined(__cplusplus) && !defined(inline) ++# define inline __inline ++#endif ++ + #else /* The non-microsoft world */ + + # ifdef OPENSSL_SYS_VMS +@@ -738,4 +747,3 @@ struct servent *getservbyname(const char *name, co + #endif + + #endif +- +Index: crypto/openssl/ssl/Makefile +=================================================================== +--- crypto/openssl/ssl/Makefile (revision 273303) ++++ crypto/openssl/ssl/Makefile (working copy) +@@ -547,26 +547,27 @@ s3_both.o: ../include/openssl/ssl23.h ../include/o + s3_both.o: ../include/openssl/stack.h ../include/openssl/symhacks.h + s3_both.o: ../include/openssl/tls1.h ../include/openssl/x509.h + s3_both.o: ../include/openssl/x509_vfy.h s3_both.c ssl_locl.h +-s3_cbc.o: ../e_os.h ../include/openssl/asn1.h ../include/openssl/bio.h +-s3_cbc.o: ../include/openssl/buffer.h ../include/openssl/comp.h +-s3_cbc.o: ../include/openssl/crypto.h ../include/openssl/dsa.h +-s3_cbc.o: ../include/openssl/dtls1.h ../include/openssl/e_os2.h +-s3_cbc.o: ../include/openssl/ec.h ../include/openssl/ecdh.h +-s3_cbc.o: ../include/openssl/ecdsa.h ../include/openssl/err.h +-s3_cbc.o: ../include/openssl/evp.h ../include/openssl/hmac.h +-s3_cbc.o: ../include/openssl/kssl.h ../include/openssl/lhash.h +-s3_cbc.o: ../include/openssl/md5.h ../include/openssl/obj_mac.h +-s3_cbc.o: ../include/openssl/objects.h ../include/openssl/opensslconf.h +-s3_cbc.o: ../include/openssl/opensslv.h ../include/openssl/ossl_typ.h +-s3_cbc.o: ../include/openssl/pem.h ../include/openssl/pem2.h +-s3_cbc.o: ../include/openssl/pkcs7.h ../include/openssl/pqueue.h +-s3_cbc.o: ../include/openssl/rsa.h ../include/openssl/safestack.h +-s3_cbc.o: ../include/openssl/sha.h ../include/openssl/srtp.h +-s3_cbc.o: ../include/openssl/ssl.h ../include/openssl/ssl2.h +-s3_cbc.o: ../include/openssl/ssl23.h ../include/openssl/ssl3.h +-s3_cbc.o: ../include/openssl/stack.h ../include/openssl/symhacks.h +-s3_cbc.o: ../include/openssl/tls1.h ../include/openssl/x509.h +-s3_cbc.o: ../include/openssl/x509_vfy.h s3_cbc.c ssl_locl.h ++s3_cbc.o: ../crypto/constant_time_locl.h ../e_os.h ../include/openssl/asn1.h ++s3_cbc.o: ../include/openssl/bio.h ../include/openssl/buffer.h ++s3_cbc.o: ../include/openssl/comp.h ../include/openssl/crypto.h ++s3_cbc.o: ../include/openssl/dsa.h ../include/openssl/dtls1.h ++s3_cbc.o: ../include/openssl/e_os2.h ../include/openssl/ec.h ++s3_cbc.o: ../include/openssl/ecdh.h ../include/openssl/ecdsa.h ++s3_cbc.o: ../include/openssl/err.h ../include/openssl/evp.h ++s3_cbc.o: ../include/openssl/hmac.h ../include/openssl/kssl.h ++s3_cbc.o: ../include/openssl/lhash.h ../include/openssl/md5.h ++s3_cbc.o: ../include/openssl/obj_mac.h ../include/openssl/objects.h ++s3_cbc.o: ../include/openssl/opensslconf.h ../include/openssl/opensslv.h ++s3_cbc.o: ../include/openssl/ossl_typ.h ../include/openssl/pem.h ++s3_cbc.o: ../include/openssl/pem2.h ../include/openssl/pkcs7.h ++s3_cbc.o: ../include/openssl/pqueue.h ../include/openssl/rsa.h ++s3_cbc.o: ../include/openssl/safestack.h ../include/openssl/sha.h ++s3_cbc.o: ../include/openssl/srtp.h ../include/openssl/ssl.h ++s3_cbc.o: ../include/openssl/ssl2.h ../include/openssl/ssl23.h ++s3_cbc.o: ../include/openssl/ssl3.h ../include/openssl/stack.h ++s3_cbc.o: ../include/openssl/symhacks.h ../include/openssl/tls1.h ++s3_cbc.o: ../include/openssl/x509.h ../include/openssl/x509_vfy.h s3_cbc.c ++s3_cbc.o: ssl_locl.h + s3_clnt.o: ../e_os.h ../include/openssl/asn1.h ../include/openssl/bio.h + s3_clnt.o: ../include/openssl/bn.h ../include/openssl/buffer.h + s3_clnt.o: ../include/openssl/comp.h ../include/openssl/crypto.h +@@ -671,28 +672,29 @@ s3_pkt.o: ../include/openssl/ssl23.h ../include/op + s3_pkt.o: ../include/openssl/stack.h ../include/openssl/symhacks.h + s3_pkt.o: ../include/openssl/tls1.h ../include/openssl/x509.h + s3_pkt.o: ../include/openssl/x509_vfy.h s3_pkt.c ssl_locl.h +-s3_srvr.o: ../e_os.h ../include/openssl/asn1.h ../include/openssl/bio.h +-s3_srvr.o: ../include/openssl/bn.h ../include/openssl/buffer.h +-s3_srvr.o: ../include/openssl/comp.h ../include/openssl/crypto.h +-s3_srvr.o: ../include/openssl/dh.h ../include/openssl/dsa.h +-s3_srvr.o: ../include/openssl/dtls1.h ../include/openssl/e_os2.h +-s3_srvr.o: ../include/openssl/ec.h ../include/openssl/ecdh.h +-s3_srvr.o: ../include/openssl/ecdsa.h ../include/openssl/err.h +-s3_srvr.o: ../include/openssl/evp.h ../include/openssl/hmac.h +-s3_srvr.o: ../include/openssl/krb5_asn.h ../include/openssl/kssl.h +-s3_srvr.o: ../include/openssl/lhash.h ../include/openssl/md5.h +-s3_srvr.o: ../include/openssl/obj_mac.h ../include/openssl/objects.h +-s3_srvr.o: ../include/openssl/opensslconf.h ../include/openssl/opensslv.h +-s3_srvr.o: ../include/openssl/ossl_typ.h ../include/openssl/pem.h +-s3_srvr.o: ../include/openssl/pem2.h ../include/openssl/pkcs7.h +-s3_srvr.o: ../include/openssl/pqueue.h ../include/openssl/rand.h +-s3_srvr.o: ../include/openssl/rsa.h ../include/openssl/safestack.h +-s3_srvr.o: ../include/openssl/sha.h ../include/openssl/srtp.h +-s3_srvr.o: ../include/openssl/ssl.h ../include/openssl/ssl2.h +-s3_srvr.o: ../include/openssl/ssl23.h ../include/openssl/ssl3.h +-s3_srvr.o: ../include/openssl/stack.h ../include/openssl/symhacks.h +-s3_srvr.o: ../include/openssl/tls1.h ../include/openssl/x509.h +-s3_srvr.o: ../include/openssl/x509_vfy.h kssl_lcl.h s3_srvr.c ssl_locl.h ++s3_srvr.o: ../crypto/constant_time_locl.h ../e_os.h ../include/openssl/asn1.h ++s3_srvr.o: ../include/openssl/bio.h ../include/openssl/bn.h ++s3_srvr.o: ../include/openssl/buffer.h ../include/openssl/comp.h ++s3_srvr.o: ../include/openssl/crypto.h ../include/openssl/dh.h ++s3_srvr.o: ../include/openssl/dsa.h ../include/openssl/dtls1.h ++s3_srvr.o: ../include/openssl/e_os2.h ../include/openssl/ec.h ++s3_srvr.o: ../include/openssl/ecdh.h ../include/openssl/ecdsa.h ++s3_srvr.o: ../include/openssl/err.h ../include/openssl/evp.h ++s3_srvr.o: ../include/openssl/hmac.h ../include/openssl/krb5_asn.h ++s3_srvr.o: ../include/openssl/kssl.h ../include/openssl/lhash.h ++s3_srvr.o: ../include/openssl/md5.h ../include/openssl/obj_mac.h ++s3_srvr.o: ../include/openssl/objects.h ../include/openssl/opensslconf.h ++s3_srvr.o: ../include/openssl/opensslv.h ../include/openssl/ossl_typ.h ++s3_srvr.o: ../include/openssl/pem.h ../include/openssl/pem2.h ++s3_srvr.o: ../include/openssl/pkcs7.h ../include/openssl/pqueue.h ++s3_srvr.o: ../include/openssl/rand.h ../include/openssl/rsa.h ++s3_srvr.o: ../include/openssl/safestack.h ../include/openssl/sha.h ++s3_srvr.o: ../include/openssl/srtp.h ../include/openssl/ssl.h ++s3_srvr.o: ../include/openssl/ssl2.h ../include/openssl/ssl23.h ++s3_srvr.o: ../include/openssl/ssl3.h ../include/openssl/stack.h ++s3_srvr.o: ../include/openssl/symhacks.h ../include/openssl/tls1.h ++s3_srvr.o: ../include/openssl/x509.h ../include/openssl/x509_vfy.h kssl_lcl.h ++s3_srvr.o: s3_srvr.c ssl_locl.h + ssl_algs.o: ../e_os.h ../include/openssl/asn1.h ../include/openssl/bio.h + ssl_algs.o: ../include/openssl/buffer.h ../include/openssl/comp.h + ssl_algs.o: ../include/openssl/crypto.h ../include/openssl/dsa.h +Index: crypto/openssl/ssl/d1_both.c +=================================================================== +--- crypto/openssl/ssl/d1_both.c (revision 273303) ++++ crypto/openssl/ssl/d1_both.c (working copy) +@@ -1492,6 +1492,9 @@ dtls1_process_heartbeat(SSL *s) + /* Read type and payload length first */ + if (1 + 2 + 16 > s->s3->rrec.length) + return 0; /* silently discard */ ++ if (s->s3->rrec.length > SSL3_RT_MAX_PLAIN_LENGTH) ++ return 0; /* silently discard per RFC 6520 sec. 4 */ ++ + hbtype = *p++; + n2s(p, payload); + if (1 + 2 + payload + 16 > s->s3->rrec.length) +Index: crypto/openssl/ssl/d1_lib.c +=================================================================== +--- crypto/openssl/ssl/d1_lib.c (revision 273303) ++++ crypto/openssl/ssl/d1_lib.c (working copy) +@@ -266,6 +266,16 @@ long dtls1_ctrl(SSL *s, int cmd, long larg, void * + case DTLS_CTRL_LISTEN: + ret = dtls1_listen(s, parg); + break; ++ case SSL_CTRL_CHECK_PROTO_VERSION: ++ /* For library-internal use; checks that the current protocol ++ * is the highest enabled version (according to s->ctx->method, ++ * as version negotiation may have changed s->method). */ ++#if DTLS_MAX_VERSION != DTLS1_VERSION ++# error Code needs update for DTLS_method() support beyond DTLS1_VERSION. ++#endif ++ /* Just one protocol version is supported so far; ++ * fail closed if the version is not as expected. */ ++ return s->version == DTLS_MAX_VERSION; + + default: + ret = ssl3_ctrl(s, cmd, larg, parg); +Index: crypto/openssl/ssl/d1_srtp.c +=================================================================== +--- crypto/openssl/ssl/d1_srtp.c (revision 273303) ++++ crypto/openssl/ssl/d1_srtp.c (working copy) +@@ -168,25 +168,6 @@ static int find_profile_by_name(char *profile_name + return 1; + } + +-static int find_profile_by_num(unsigned profile_num, +- SRTP_PROTECTION_PROFILE **pptr) +- { +- SRTP_PROTECTION_PROFILE *p; +- +- p=srtp_known_profiles; +- while(p->name) +- { +- if(p->id == profile_num) +- { +- *pptr=p; +- return 0; +- } +- p++; +- } +- +- return 1; +- } +- + static int ssl_ctx_make_profiles(const char *profiles_string,STACK_OF(SRTP_PROTECTION_PROFILE) **out) + { + STACK_OF(SRTP_PROTECTION_PROFILE) *profiles; +@@ -209,11 +190,19 @@ static int ssl_ctx_make_profiles(const char *profi + if(!find_profile_by_name(ptr,&p, + col ? col-ptr : (int)strlen(ptr))) + { ++ if (sk_SRTP_PROTECTION_PROFILE_find(profiles,p) >= 0) ++ { ++ SSLerr(SSL_F_SSL_CTX_MAKE_PROFILES,SSL_R_BAD_SRTP_PROTECTION_PROFILE_LIST); ++ sk_SRTP_PROTECTION_PROFILE_free(profiles); ++ return 1; ++ } ++ + sk_SRTP_PROTECTION_PROFILE_push(profiles,p); + } + else + { + SSLerr(SSL_F_SSL_CTX_MAKE_PROFILES,SSL_R_SRTP_UNKNOWN_PROTECTION_PROFILE); ++ sk_SRTP_PROTECTION_PROFILE_free(profiles); + return 1; + } + +@@ -305,13 +294,12 @@ int ssl_add_clienthello_use_srtp_ext(SSL *s, unsig + + int ssl_parse_clienthello_use_srtp_ext(SSL *s, unsigned char *d, int len,int *al) + { +- SRTP_PROTECTION_PROFILE *cprof,*sprof; +- STACK_OF(SRTP_PROTECTION_PROFILE) *clnt=0,*srvr; ++ SRTP_PROTECTION_PROFILE *sprof; ++ STACK_OF(SRTP_PROTECTION_PROFILE) *srvr; + int ct; + int mki_len; +- int i,j; +- int id; +- int ret; ++ int i, srtp_pref; ++ unsigned int id; + + /* Length value + the MKI length */ + if(len < 3) +@@ -341,9 +329,11 @@ int ssl_parse_clienthello_use_srtp_ext(SSL *s, uns + return 1; + } + ++ srvr=SSL_get_srtp_profiles(s); ++ s->srtp_profile = NULL; ++ /* Search all profiles for a match initially */ ++ srtp_pref = sk_SRTP_PROTECTION_PROFILE_num(srvr); + +- clnt=sk_SRTP_PROTECTION_PROFILE_new_null(); +- + while(ct) + { + n2s(d,id); +@@ -350,14 +340,22 @@ int ssl_parse_clienthello_use_srtp_ext(SSL *s, uns + ct-=2; + len-=2; + +- if(!find_profile_by_num(id,&cprof)) ++ /* ++ * Only look for match in profiles of higher preference than ++ * current match. ++ * If no profiles have been have been configured then this ++ * does nothing. ++ */ ++ for (i = 0; i < srtp_pref; i++) + { +- sk_SRTP_PROTECTION_PROFILE_push(clnt,cprof); ++ sprof = sk_SRTP_PROTECTION_PROFILE_value(srvr, i); ++ if (sprof->id == id) ++ { ++ s->srtp_profile = sprof; ++ srtp_pref = i; ++ break; ++ } + } +- else +- { +- ; /* Ignore */ +- } + } + + /* Now extract the MKI value as a sanity check, but discard it for now */ +@@ -371,36 +369,7 @@ int ssl_parse_clienthello_use_srtp_ext(SSL *s, uns + return 1; + } + +- srvr=SSL_get_srtp_profiles(s); +- +- /* Pick our most preferred profile. If no profiles have been +- configured then the outer loop doesn't run +- (sk_SRTP_PROTECTION_PROFILE_num() = -1) +- and so we just return without doing anything */ +- for(i=0;iid==sprof->id) +- { +- s->srtp_profile=sprof; +- *al=0; +- ret=0; +- goto done; +- } +- } +- } +- +- ret=0; +- +-done: +- if(clnt) sk_SRTP_PROTECTION_PROFILE_free(clnt); +- +- return ret; ++ return 0; + } + + int ssl_add_serverhello_use_srtp_ext(SSL *s, unsigned char *p, int *len, int maxlen) +Index: crypto/openssl/ssl/dtls1.h +=================================================================== +--- crypto/openssl/ssl/dtls1.h (revision 273303) ++++ crypto/openssl/ssl/dtls1.h (working copy) +@@ -84,6 +84,8 @@ extern "C" { + #endif + + #define DTLS1_VERSION 0xFEFF ++#define DTLS_MAX_VERSION DTLS1_VERSION ++ + #define DTLS1_BAD_VER 0x0100 + + #if 0 +@@ -284,4 +286,3 @@ typedef struct dtls1_record_data_st + } + #endif + #endif +- +Index: crypto/openssl/ssl/s23_clnt.c +=================================================================== +--- crypto/openssl/ssl/s23_clnt.c (revision 273303) ++++ crypto/openssl/ssl/s23_clnt.c (working copy) +@@ -125,9 +125,11 @@ static const SSL_METHOD *ssl23_get_client_method(i + if (ver == SSL2_VERSION) + return(SSLv2_client_method()); + #endif ++#ifndef OPENSSL_NO_SSL3 + if (ver == SSL3_VERSION) + return(SSLv3_client_method()); +- else if (ver == TLS1_VERSION) ++#endif ++ if (ver == TLS1_VERSION) + return(TLSv1_client_method()); + else if (ver == TLS1_1_VERSION) + return(TLSv1_1_client_method()); +@@ -698,6 +700,7 @@ static int ssl23_get_server_hello(SSL *s) + { + /* we have sslv3 or tls1 (server hello or alert) */ + ++#ifndef OPENSSL_NO_SSL3 + if ((p[2] == SSL3_VERSION_MINOR) && + !(s->options & SSL_OP_NO_SSLv3)) + { +@@ -712,7 +715,9 @@ static int ssl23_get_server_hello(SSL *s) + s->version=SSL3_VERSION; + s->method=SSLv3_client_method(); + } +- else if ((p[2] == TLS1_VERSION_MINOR) && ++ else ++#endif ++ if ((p[2] == TLS1_VERSION_MINOR) && + !(s->options & SSL_OP_NO_TLSv1)) + { + s->version=TLS1_VERSION; +@@ -736,6 +741,9 @@ static int ssl23_get_server_hello(SSL *s) + goto err; + } + ++ /* ensure that TLS_MAX_VERSION is up-to-date */ ++ OPENSSL_assert(s->version <= TLS_MAX_VERSION); ++ + if (p[0] == SSL3_RT_ALERT && p[5] != SSL3_AL_WARNING) + { + /* fatal alert */ +Index: crypto/openssl/ssl/s23_srvr.c +=================================================================== +--- crypto/openssl/ssl/s23_srvr.c (revision 273303) ++++ crypto/openssl/ssl/s23_srvr.c (working copy) +@@ -127,9 +127,11 @@ static const SSL_METHOD *ssl23_get_server_method(i + if (ver == SSL2_VERSION) + return(SSLv2_server_method()); + #endif ++#ifndef OPENSSL_NO_SSL3 + if (ver == SSL3_VERSION) + return(SSLv3_server_method()); +- else if (ver == TLS1_VERSION) ++#endif ++ if (ver == TLS1_VERSION) + return(TLSv1_server_method()); + else if (ver == TLS1_1_VERSION) + return(TLSv1_1_server_method()); +@@ -421,6 +423,9 @@ int ssl23_get_client_hello(SSL *s) + } + } + ++ /* ensure that TLS_MAX_VERSION is up-to-date */ ++ OPENSSL_assert(s->version <= TLS_MAX_VERSION); ++ + #ifdef OPENSSL_FIPS + if (FIPS_mode() && (s->version < TLS1_VERSION)) + { +@@ -597,6 +602,12 @@ int ssl23_get_client_hello(SSL *s) + if ((type == 2) || (type == 3)) + { + /* we have SSLv3/TLSv1 (type 2: SSL2 style, type 3: SSL3/TLS style) */ ++ s->method = ssl23_get_server_method(s->version); ++ if (s->method == NULL) ++ { ++ SSLerr(SSL_F_SSL23_GET_CLIENT_HELLO,SSL_R_UNSUPPORTED_PROTOCOL); ++ goto err; ++ } + + if (!ssl_init_wbio_buffer(s,1)) goto err; + +@@ -624,14 +635,6 @@ int ssl23_get_client_hello(SSL *s) + s->s3->rbuf.left=0; + s->s3->rbuf.offset=0; + } +- if (s->version == TLS1_2_VERSION) +- s->method = TLSv1_2_server_method(); +- else if (s->version == TLS1_1_VERSION) +- s->method = TLSv1_1_server_method(); +- else if (s->version == TLS1_VERSION) +- s->method = TLSv1_server_method(); +- else +- s->method = SSLv3_server_method(); + #if 0 /* ssl3_get_client_hello does this */ + s->client_version=(v[0]<<8)|v[1]; + #endif +Index: crypto/openssl/ssl/s2_lib.c +=================================================================== +--- crypto/openssl/ssl/s2_lib.c (revision 273303) ++++ crypto/openssl/ssl/s2_lib.c (working copy) +@@ -391,6 +391,8 @@ long ssl2_ctrl(SSL *s, int cmd, long larg, void *p + case SSL_CTRL_GET_SESSION_REUSED: + ret=s->hit; + break; ++ case SSL_CTRL_CHECK_PROTO_VERSION: ++ return ssl3_ctrl(s, SSL_CTRL_CHECK_PROTO_VERSION, larg, parg); + default: + break; + } +@@ -437,7 +439,7 @@ int ssl2_put_cipher_by_char(const SSL_CIPHER *c, u + if (p != NULL) + { + l=c->id; +- if ((l & 0xff000000) != 0x02000000) return(0); ++ if ((l & 0xff000000) != 0x02000000 && l != SSL3_CK_FALLBACK_SCSV) return(0); + p[0]=((unsigned char)(l>>16L))&0xFF; + p[1]=((unsigned char)(l>> 8L))&0xFF; + p[2]=((unsigned char)(l ))&0xFF; +Index: crypto/openssl/ssl/s3_cbc.c +=================================================================== +--- crypto/openssl/ssl/s3_cbc.c (revision 273303) ++++ crypto/openssl/ssl/s3_cbc.c (working copy) +@@ -53,6 +53,7 @@ + * + */ + ++#include "../crypto/constant_time_locl.h" + #include "ssl_locl.h" + + #include +@@ -67,37 +68,6 @@ + * supported by TLS.) */ + #define MAX_HASH_BLOCK_SIZE 128 + +-/* Some utility functions are needed: +- * +- * These macros return the given value with the MSB copied to all the other +- * bits. They use the fact that arithmetic shift shifts-in the sign bit. +- * However, this is not ensured by the C standard so you may need to replace +- * them with something else on odd CPUs. */ +-#define DUPLICATE_MSB_TO_ALL(x) ( (unsigned)( (int)(x) >> (sizeof(int)*8-1) ) ) +-#define DUPLICATE_MSB_TO_ALL_8(x) ((unsigned char)(DUPLICATE_MSB_TO_ALL(x))) +- +-/* constant_time_lt returns 0xff if a=b and 0x00 otherwise. */ +-static unsigned constant_time_ge(unsigned a, unsigned b) +- { +- a -= b; +- return DUPLICATE_MSB_TO_ALL(~a); +- } +- +-/* constant_time_eq_8 returns 0xff if a==b and 0x00 otherwise. */ +-static unsigned char constant_time_eq_8(unsigned a, unsigned b) +- { +- unsigned c = a ^ b; +- c--; +- return DUPLICATE_MSB_TO_ALL_8(c); +- } +- + /* ssl3_cbc_remove_padding removes padding from the decrypted, SSLv3, CBC + * record in |rec| by updating |rec->length| in constant time. + * +@@ -126,8 +96,8 @@ int ssl3_cbc_remove_padding(const SSL* s, + padding_length = good & (padding_length+1); + rec->length -= padding_length; + rec->type |= padding_length<<8; /* kludge: pass padding length */ +- return (int)((good & 1) | (~good & -1)); +-} ++ return constant_time_select_int(good, 1, -1); ++ } + + /* tls1_cbc_remove_padding removes the CBC padding from the decrypted, TLS, CBC + * record in |rec| in constant time and returns 1 if the padding is valid and +@@ -208,7 +178,7 @@ int tls1_cbc_remove_padding(const SSL* s, + + for (i = 0; i < to_check; i++) + { +- unsigned char mask = constant_time_ge(padding_length, i); ++ unsigned char mask = constant_time_ge_8(padding_length, i); + unsigned char b = rec->data[rec->length-1-i]; + /* The final |padding_length+1| bytes should all have the value + * |padding_length|. Therefore the XOR should be zero. */ +@@ -216,20 +186,14 @@ int tls1_cbc_remove_padding(const SSL* s, + } + + /* If any of the final |padding_length+1| bytes had the wrong value, +- * one or more of the lower eight bits of |good| will be cleared. We +- * AND the bottom 8 bits together and duplicate the result to all the +- * bits. */ +- good &= good >> 4; +- good &= good >> 2; +- good &= good >> 1; +- good <<= sizeof(good)*8-1; +- good = DUPLICATE_MSB_TO_ALL(good); +- ++ * one or more of the lower eight bits of |good| will be cleared. ++ */ ++ good = constant_time_eq(0xff, good & 0xff); + padding_length = good & (padding_length+1); + rec->length -= padding_length; + rec->type |= padding_length<<8; /* kludge: pass padding length */ + +- return (int)((good & 1) | (~good & -1)); ++ return constant_time_select_int(good, 1, -1); + } + + /* ssl3_cbc_copy_mac copies |md_size| bytes from the end of |rec| to |out| in +@@ -296,8 +260,8 @@ void ssl3_cbc_copy_mac(unsigned char* out, + memset(rotated_mac, 0, md_size); + for (i = scan_start, j = 0; i < orig_len; i++) + { +- unsigned char mac_started = constant_time_ge(i, mac_start); +- unsigned char mac_ended = constant_time_ge(i, mac_end); ++ unsigned char mac_started = constant_time_ge_8(i, mac_start); ++ unsigned char mac_ended = constant_time_ge_8(i, mac_end); + unsigned char b = rec->data[i]; + rotated_mac[j++] |= b & mac_started & ~mac_ended; + j &= constant_time_lt(j,md_size); +@@ -683,12 +647,12 @@ void ssl3_cbc_digest_record( + b = data[k-header_length]; + k++; + +- is_past_c = is_block_a & constant_time_ge(j, c); +- is_past_cp1 = is_block_a & constant_time_ge(j, c+1); ++ is_past_c = is_block_a & constant_time_ge_8(j, c); ++ is_past_cp1 = is_block_a & constant_time_ge_8(j, c+1); + /* If this is the block containing the end of the + * application data, and we are at the offset for the + * 0x80 value, then overwrite b with 0x80. */ +- b = (b&~is_past_c) | (0x80&is_past_c); ++ b = constant_time_select_8(is_past_c, 0x80, b); + /* If this the the block containing the end of the + * application data and we're past the 0x80 value then + * just write zero. */ +@@ -704,7 +668,8 @@ void ssl3_cbc_digest_record( + if (j >= md_block_size - md_length_size) + { + /* If this is index_b, write a length byte. */ +- b = (b&~is_block_b) | (is_block_b&length_bytes[j-(md_block_size-md_length_size)]); ++ b = constant_time_select_8( ++ is_block_b, length_bytes[j-(md_block_size-md_length_size)], b); + } + block[j] = b; + } +Index: crypto/openssl/ssl/s3_clnt.c +=================================================================== +--- crypto/openssl/ssl/s3_clnt.c (revision 273303) ++++ crypto/openssl/ssl/s3_clnt.c (working copy) +@@ -326,9 +326,9 @@ int ssl3_connect(SSL *s) + break; + } + #endif +- /* Check if it is anon DH/ECDH */ ++ /* Check if it is anon DH/ECDH, SRP auth */ + /* or PSK */ +- if (!(s->s3->tmp.new_cipher->algorithm_auth & SSL_aNULL) && ++ if (!(s->s3->tmp.new_cipher->algorithm_auth & (SSL_aNULL|SSL_aSRP)) && + !(s->s3->tmp.new_cipher->algorithm_mkey & SSL_kPSK)) + { + ret=ssl3_get_server_certificate(s); +@@ -1277,8 +1277,8 @@ int ssl3_get_key_exchange(SSL *s) + #endif + EVP_MD_CTX md_ctx; + unsigned char *param,*p; +- int al,i,j,param_len,ok; +- long n,alg_k,alg_a; ++ int al,j,ok; ++ long i,param_len,n,alg_k,alg_a; + EVP_PKEY *pkey=NULL; + const EVP_MD *md = NULL; + #ifndef OPENSSL_NO_RSA +@@ -1354,19 +1354,29 @@ int ssl3_get_key_exchange(SSL *s) + s->session->sess_cert=ssl_sess_cert_new(); + } + ++ /* Total length of the parameters including the length prefix */ + param_len=0; ++ + alg_k=s->s3->tmp.new_cipher->algorithm_mkey; + alg_a=s->s3->tmp.new_cipher->algorithm_auth; + EVP_MD_CTX_init(&md_ctx); + ++ al=SSL_AD_DECODE_ERROR; ++ + #ifndef OPENSSL_NO_PSK + if (alg_k & SSL_kPSK) + { + char tmp_id_hint[PSK_MAX_IDENTITY_LEN+1]; + +- al=SSL_AD_HANDSHAKE_FAILURE; ++ param_len = 2; ++ if (param_len > n) ++ { ++ SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE, ++ SSL_R_LENGTH_TOO_SHORT); ++ goto f_err; ++ } + n2s(p,i); +- param_len=i+2; ++ + /* Store PSK identity hint for later use, hint is used + * in ssl3_send_client_key_exchange. Assume that the + * maximum length of a PSK identity hint can be as +@@ -1373,17 +1383,19 @@ int ssl3_get_key_exchange(SSL *s) + * long as the maximum length of a PSK identity. */ + if (i > PSK_MAX_IDENTITY_LEN) + { ++ al=SSL_AD_HANDSHAKE_FAILURE; + SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE, + SSL_R_DATA_LENGTH_TOO_LONG); + goto f_err; + } +- if (param_len > n) ++ if (i > n - param_len) + { +- al=SSL_AD_DECODE_ERROR; + SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE, + SSL_R_BAD_PSK_IDENTITY_HINT_LENGTH); + goto f_err; + } ++ param_len += i; ++ + /* If received PSK identity hint contains NULL + * characters, the hint is truncated from the first + * NULL. p may not be ending with NULL, so create a +@@ -1395,6 +1407,7 @@ int ssl3_get_key_exchange(SSL *s) + s->ctx->psk_identity_hint = BUF_strdup(tmp_id_hint); + if (s->ctx->psk_identity_hint == NULL) + { ++ al=SSL_AD_HANDSHAKE_FAILURE; + SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE, ERR_R_MALLOC_FAILURE); + goto f_err; + } +@@ -1407,14 +1420,22 @@ int ssl3_get_key_exchange(SSL *s) + #ifndef OPENSSL_NO_SRP + if (alg_k & SSL_kSRP) + { +- n2s(p,i); +- param_len=i+2; ++ param_len = 2; + if (param_len > n) + { +- al=SSL_AD_DECODE_ERROR; ++ SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE, ++ SSL_R_LENGTH_TOO_SHORT); ++ goto f_err; ++ } ++ n2s(p,i); ++ ++ if (i > n - param_len) ++ { + SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,SSL_R_BAD_SRP_N_LENGTH); + goto f_err; + } ++ param_len += i; ++ + if (!(s->srp_ctx.N=BN_bin2bn(p,i,NULL))) + { + SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,ERR_R_BN_LIB); +@@ -1422,14 +1443,24 @@ int ssl3_get_key_exchange(SSL *s) + } + p+=i; + ++ ++ if (2 > n - param_len) ++ { ++ SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE, ++ SSL_R_LENGTH_TOO_SHORT); ++ goto f_err; ++ } ++ param_len += 2; ++ + n2s(p,i); +- param_len+=i+2; +- if (param_len > n) ++ ++ if (i > n - param_len) + { +- al=SSL_AD_DECODE_ERROR; + SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,SSL_R_BAD_SRP_G_LENGTH); + goto f_err; + } ++ param_len += i; ++ + if (!(s->srp_ctx.g=BN_bin2bn(p,i,NULL))) + { + SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,ERR_R_BN_LIB); +@@ -1437,15 +1468,25 @@ int ssl3_get_key_exchange(SSL *s) + } + p+=i; + ++ ++ if (1 > n - param_len) ++ { ++ SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE, ++ SSL_R_LENGTH_TOO_SHORT); ++ goto f_err; ++ } ++ param_len += 1; ++ + i = (unsigned int)(p[0]); + p++; +- param_len+=i+1; +- if (param_len > n) ++ ++ if (i > n - param_len) + { +- al=SSL_AD_DECODE_ERROR; + SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,SSL_R_BAD_SRP_S_LENGTH); + goto f_err; + } ++ param_len += i; ++ + if (!(s->srp_ctx.s=BN_bin2bn(p,i,NULL))) + { + SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,ERR_R_BN_LIB); +@@ -1453,14 +1494,23 @@ int ssl3_get_key_exchange(SSL *s) + } + p+=i; + ++ if (2 > n - param_len) ++ { ++ SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE, ++ SSL_R_LENGTH_TOO_SHORT); ++ goto f_err; ++ } ++ param_len += 2; ++ + n2s(p,i); +- param_len+=i+2; +- if (param_len > n) ++ ++ if (i > n - param_len) + { +- al=SSL_AD_DECODE_ERROR; + SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,SSL_R_BAD_SRP_B_LENGTH); + goto f_err; + } ++ param_len += i; ++ + if (!(s->srp_ctx.B=BN_bin2bn(p,i,NULL))) + { + SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,ERR_R_BN_LIB); +@@ -1498,14 +1548,23 @@ int ssl3_get_key_exchange(SSL *s) + SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,ERR_R_MALLOC_FAILURE); + goto err; + } +- n2s(p,i); +- param_len=i+2; ++ ++ param_len = 2; + if (param_len > n) + { +- al=SSL_AD_DECODE_ERROR; ++ SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE, ++ SSL_R_LENGTH_TOO_SHORT); ++ goto f_err; ++ } ++ n2s(p,i); ++ ++ if (i > n - param_len) ++ { + SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,SSL_R_BAD_RSA_MODULUS_LENGTH); + goto f_err; + } ++ param_len += i; ++ + if (!(rsa->n=BN_bin2bn(p,i,rsa->n))) + { + SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,ERR_R_BN_LIB); +@@ -1513,14 +1572,23 @@ int ssl3_get_key_exchange(SSL *s) + } + p+=i; + ++ if (2 > n - param_len) ++ { ++ SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE, ++ SSL_R_LENGTH_TOO_SHORT); ++ goto f_err; ++ } ++ param_len += 2; ++ + n2s(p,i); +- param_len+=i+2; +- if (param_len > n) ++ ++ if (i > n - param_len) + { +- al=SSL_AD_DECODE_ERROR; + SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,SSL_R_BAD_RSA_E_LENGTH); + goto f_err; + } ++ param_len += i; ++ + if (!(rsa->e=BN_bin2bn(p,i,rsa->e))) + { + SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,ERR_R_BN_LIB); +@@ -1552,14 +1620,23 @@ int ssl3_get_key_exchange(SSL *s) + SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,ERR_R_DH_LIB); + goto err; + } +- n2s(p,i); +- param_len=i+2; ++ ++ param_len = 2; + if (param_len > n) + { +- al=SSL_AD_DECODE_ERROR; ++ SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE, ++ SSL_R_LENGTH_TOO_SHORT); ++ goto f_err; ++ } ++ n2s(p,i); ++ ++ if (i > n - param_len) ++ { + SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,SSL_R_BAD_DH_P_LENGTH); + goto f_err; + } ++ param_len += i; ++ + if (!(dh->p=BN_bin2bn(p,i,NULL))) + { + SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,ERR_R_BN_LIB); +@@ -1567,14 +1644,23 @@ int ssl3_get_key_exchange(SSL *s) + } + p+=i; + ++ if (2 > n - param_len) ++ { ++ SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE, ++ SSL_R_LENGTH_TOO_SHORT); ++ goto f_err; ++ } ++ param_len += 2; ++ + n2s(p,i); +- param_len+=i+2; +- if (param_len > n) ++ ++ if (i > n - param_len) + { +- al=SSL_AD_DECODE_ERROR; + SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,SSL_R_BAD_DH_G_LENGTH); + goto f_err; + } ++ param_len += i; ++ + if (!(dh->g=BN_bin2bn(p,i,NULL))) + { + SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,ERR_R_BN_LIB); +@@ -1582,14 +1668,23 @@ int ssl3_get_key_exchange(SSL *s) + } + p+=i; + ++ if (2 > n - param_len) ++ { ++ SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE, ++ SSL_R_LENGTH_TOO_SHORT); ++ goto f_err; ++ } ++ param_len += 2; ++ + n2s(p,i); +- param_len+=i+2; +- if (param_len > n) ++ ++ if (i > n - param_len) + { +- al=SSL_AD_DECODE_ERROR; + SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,SSL_R_BAD_DH_PUB_KEY_LENGTH); + goto f_err; + } ++ param_len += i; ++ + if (!(dh->pub_key=BN_bin2bn(p,i,NULL))) + { + SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,ERR_R_BN_LIB); +@@ -1641,13 +1736,20 @@ int ssl3_get_key_exchange(SSL *s) + */ + + /* XXX: For now we only support named (not generic) curves +- * and the ECParameters in this case is just three bytes. ++ * and the ECParameters in this case is just three bytes. We ++ * also need one byte for the length of the encoded point + */ +- param_len=3; +- if ((param_len > n) || +- (*p != NAMED_CURVE_TYPE) || +- ((curve_nid = tls1_ec_curve_id2nid(*(p + 2))) == 0)) ++ param_len=4; ++ if (param_len > n) + { ++ SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE, ++ SSL_R_LENGTH_TOO_SHORT); ++ goto f_err; ++ } ++ ++ if ((*p != NAMED_CURVE_TYPE) || ++ ((curve_nid = tls1_ec_curve_id2nid(*(p + 2))) == 0)) ++ { + al=SSL_AD_INTERNAL_ERROR; + SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,SSL_R_UNABLE_TO_FIND_ECDH_PARAMETERS); + goto f_err; +@@ -1688,15 +1790,15 @@ int ssl3_get_key_exchange(SSL *s) + + encoded_pt_len = *p; /* length of encoded point */ + p+=1; +- param_len += (1 + encoded_pt_len); +- if ((param_len > n) || ++ ++ if ((encoded_pt_len > n - param_len) || + (EC_POINT_oct2point(group, srvr_ecpoint, + p, encoded_pt_len, bn_ctx) == 0)) + { +- al=SSL_AD_DECODE_ERROR; + SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,SSL_R_BAD_ECPOINT); + goto f_err; + } ++ param_len += encoded_pt_len; + + n-=param_len; + p+=encoded_pt_len; +@@ -1739,7 +1841,15 @@ int ssl3_get_key_exchange(SSL *s) + { + if (TLS1_get_version(s) >= TLS1_2_VERSION) + { +- int sigalg = tls12_get_sigid(pkey); ++ int sigalg; ++ if (2 > n) ++ { ++ SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE, ++ SSL_R_LENGTH_TOO_SHORT); ++ goto f_err; ++ } ++ ++ sigalg = tls12_get_sigid(pkey); + /* Should never happen */ + if (sigalg == -1) + { +@@ -1757,7 +1867,6 @@ int ssl3_get_key_exchange(SSL *s) + if (md == NULL) + { + SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,SSL_R_UNKNOWN_DIGEST); +- al=SSL_AD_DECODE_ERROR; + goto f_err; + } + #ifdef SSL_DEBUG +@@ -1768,15 +1877,21 @@ fprintf(stderr, "USING TLSv1.2 HASH %s\n", EVP_MD_ + } + else + md = EVP_sha1(); +- ++ ++ if (2 > n) ++ { ++ SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE, ++ SSL_R_LENGTH_TOO_SHORT); ++ goto f_err; ++ } + n2s(p,i); + n-=2; + j=EVP_PKEY_size(pkey); + ++ /* Check signature length. If n is 0 then signature is empty */ + if ((i != n) || (n > j) || (n <= 0)) + { + /* wrong packet length */ +- al=SSL_AD_DECODE_ERROR; + SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,SSL_R_WRONG_SIGNATURE_LENGTH); + goto f_err; + } +@@ -1785,6 +1900,7 @@ fprintf(stderr, "USING TLSv1.2 HASH %s\n", EVP_MD_ + if (pkey->type == EVP_PKEY_RSA && TLS1_get_version(s) < TLS1_2_VERSION) + { + int num; ++ unsigned int size; + + j=0; + q=md_buf; +@@ -1797,9 +1913,9 @@ fprintf(stderr, "USING TLSv1.2 HASH %s\n", EVP_MD_ + EVP_DigestUpdate(&md_ctx,&(s->s3->client_random[0]),SSL3_RANDOM_SIZE); + EVP_DigestUpdate(&md_ctx,&(s->s3->server_random[0]),SSL3_RANDOM_SIZE); + EVP_DigestUpdate(&md_ctx,param,param_len); +- EVP_DigestFinal_ex(&md_ctx,q,(unsigned int *)&i); +- q+=i; +- j+=i; ++ EVP_DigestFinal_ex(&md_ctx,q,&size); ++ q+=size; ++ j+=size; + } + i=RSA_verify(NID_md5_sha1, md_buf, j, p, n, + pkey->pkey.rsa); +@@ -1835,8 +1951,8 @@ fprintf(stderr, "USING TLSv1.2 HASH %s\n", EVP_MD_ + } + else + { +- if (!(alg_a & SSL_aNULL) && !(alg_k & SSL_kPSK)) +- /* aNULL or kPSK do not need public keys */ ++ /* aNULL, aSRP or kPSK do not need public keys */ ++ if (!(alg_a & (SSL_aNULL|SSL_aSRP)) && !(alg_k & SSL_kPSK)) + { + SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,ERR_R_INTERNAL_ERROR); + goto err; +@@ -1844,7 +1960,6 @@ fprintf(stderr, "USING TLSv1.2 HASH %s\n", EVP_MD_ + /* still data left over */ + if (n != 0) + { +- al=SSL_AD_DECODE_ERROR; + SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,SSL_R_EXTRA_DATA_IN_MESSAGE); + goto f_err; + } +@@ -2846,7 +2961,11 @@ int ssl3_send_client_key_exchange(SSL *s) + #ifndef OPENSSL_NO_PSK + else if (alg_k & SSL_kPSK) + { +- char identity[PSK_MAX_IDENTITY_LEN]; ++ /* The callback needs PSK_MAX_IDENTITY_LEN + 1 bytes ++ * to return a \0-terminated identity. The last byte ++ * is for us for simulating strnlen. */ ++ char identity[PSK_MAX_IDENTITY_LEN + 2]; ++ size_t identity_len; + unsigned char *t = NULL; + unsigned char psk_or_pre_ms[PSK_MAX_PSK_LEN*2+4]; + unsigned int pre_ms_len = 0, psk_len = 0; +@@ -2860,8 +2979,9 @@ int ssl3_send_client_key_exchange(SSL *s) + goto err; + } + ++ memset(identity, 0, sizeof(identity)); + psk_len = s->psk_client_callback(s, s->ctx->psk_identity_hint, +- identity, PSK_MAX_IDENTITY_LEN, ++ identity, sizeof(identity) - 1, + psk_or_pre_ms, sizeof(psk_or_pre_ms)); + if (psk_len > PSK_MAX_PSK_LEN) + { +@@ -2875,7 +2995,14 @@ int ssl3_send_client_key_exchange(SSL *s) + SSL_R_PSK_IDENTITY_NOT_FOUND); + goto psk_err; + } +- ++ identity[PSK_MAX_IDENTITY_LEN + 1] = '\0'; ++ identity_len = strlen(identity); ++ if (identity_len > PSK_MAX_IDENTITY_LEN) ++ { ++ SSLerr(SSL_F_SSL3_SEND_CLIENT_KEY_EXCHANGE, ++ ERR_R_INTERNAL_ERROR); ++ goto psk_err; ++ } + /* create PSK pre_master_secret */ + pre_ms_len = 2+psk_len+2+psk_len; + t = psk_or_pre_ms; +@@ -2909,14 +3036,13 @@ int ssl3_send_client_key_exchange(SSL *s) + s->session->master_key_length = + s->method->ssl3_enc->generate_master_secret(s, + s->session->master_key, +- psk_or_pre_ms, pre_ms_len); +- n = strlen(identity); +- s2n(n, p); +- memcpy(p, identity, n); +- n+=2; ++ psk_or_pre_ms, pre_ms_len); ++ s2n(identity_len, p); ++ memcpy(p, identity, identity_len); ++ n = 2 + identity_len; + psk_err = 0; + psk_err: +- OPENSSL_cleanse(identity, PSK_MAX_IDENTITY_LEN); ++ OPENSSL_cleanse(identity, sizeof(identity)); + OPENSSL_cleanse(psk_or_pre_ms, sizeof(psk_or_pre_ms)); + if (psk_err != 0) + { +Index: crypto/openssl/ssl/s3_enc.c +=================================================================== +--- crypto/openssl/ssl/s3_enc.c (revision 273303) ++++ crypto/openssl/ssl/s3_enc.c (working copy) +@@ -900,7 +900,7 @@ int ssl3_alert_code(int code) + case SSL_AD_BAD_CERTIFICATE_STATUS_RESPONSE: return(SSL3_AD_HANDSHAKE_FAILURE); + case SSL_AD_BAD_CERTIFICATE_HASH_VALUE: return(SSL3_AD_HANDSHAKE_FAILURE); + case SSL_AD_UNKNOWN_PSK_IDENTITY:return(TLS1_AD_UNKNOWN_PSK_IDENTITY); ++ case SSL_AD_INAPPROPRIATE_FALLBACK:return(TLS1_AD_INAPPROPRIATE_FALLBACK); + default: return(-1); + } + } +- +Index: crypto/openssl/ssl/s3_lib.c +=================================================================== +--- crypto/openssl/ssl/s3_lib.c (revision 273303) ++++ crypto/openssl/ssl/s3_lib.c (working copy) +@@ -3355,6 +3355,33 @@ long ssl3_ctrl(SSL *s, int cmd, long larg, void *p + #endif + + #endif /* !OPENSSL_NO_TLSEXT */ ++ ++ case SSL_CTRL_CHECK_PROTO_VERSION: ++ /* For library-internal use; checks that the current protocol ++ * is the highest enabled version (according to s->ctx->method, ++ * as version negotiation may have changed s->method). */ ++ if (s->version == s->ctx->method->version) ++ return 1; ++ /* Apparently we're using a version-flexible SSL_METHOD ++ * (not at its highest protocol version). */ ++ if (s->ctx->method->version == SSLv23_method()->version) ++ { ++#if TLS_MAX_VERSION != TLS1_2_VERSION ++# error Code needs update for SSLv23_method() support beyond TLS1_2_VERSION. ++#endif ++ if (!(s->options & SSL_OP_NO_TLSv1_2)) ++ return s->version == TLS1_2_VERSION; ++ if (!(s->options & SSL_OP_NO_TLSv1_1)) ++ return s->version == TLS1_1_VERSION; ++ if (!(s->options & SSL_OP_NO_TLSv1)) ++ return s->version == TLS1_VERSION; ++ if (!(s->options & SSL_OP_NO_SSLv3)) ++ return s->version == SSL3_VERSION; ++ if (!(s->options & SSL_OP_NO_SSLv2)) ++ return s->version == SSL2_VERSION; ++ } ++ return 0; /* Unexpected state; fail closed. */ ++ + default: + break; + } +@@ -3714,6 +3741,7 @@ long ssl3_ctx_callback_ctrl(SSL_CTX *ctx, int cmd, + break; + #endif + #endif ++ + default: + return(0); + } +@@ -3822,10 +3850,15 @@ SSL_CIPHER *ssl3_choose_cipher(SSL *s, STACK_OF(SS + emask_k = cert->export_mask_k; + emask_a = cert->export_mask_a; + #ifndef OPENSSL_NO_SRP +- mask_k=cert->mask_k | s->srp_ctx.srp_Mask; +- emask_k=cert->export_mask_k | s->srp_ctx.srp_Mask; ++ if (s->srp_ctx.srp_Mask & SSL_kSRP) ++ { ++ mask_k |= SSL_kSRP; ++ emask_k |= SSL_kSRP; ++ mask_a |= SSL_aSRP; ++ emask_a |= SSL_aSRP; ++ } + #endif +- ++ + #ifdef KSSL_DEBUG + /* printf("ssl3_choose_cipher %d alg= %lx\n", i,c->algorithms);*/ + #endif /* KSSL_DEBUG */ +@@ -4291,4 +4324,3 @@ long ssl_get_algorithm2(SSL *s) + return SSL_HANDSHAKE_MAC_SHA256 | TLS1_PRF_SHA256; + return alg2; + } +- +Index: crypto/openssl/ssl/s3_pkt.c +=================================================================== +--- crypto/openssl/ssl/s3_pkt.c (revision 273303) ++++ crypto/openssl/ssl/s3_pkt.c (working copy) +@@ -273,6 +273,12 @@ int ssl3_read_n(SSL *s, int n, int max, int extend + return(n); + } + ++/* MAX_EMPTY_RECORDS defines the number of consecutive, empty records that will ++ * be processed per call to ssl3_get_record. Without this limit an attacker ++ * could send empty records at a faster rate than we can process and cause ++ * ssl3_get_record to loop forever. */ ++#define MAX_EMPTY_RECORDS 32 ++ + /* Call this to get a new input record. + * It will return <= 0 if more data is needed, normally due to an error + * or non-blocking IO. +@@ -293,6 +299,7 @@ static int ssl3_get_record(SSL *s) + short version; + unsigned mac_size, orig_len; + size_t extra; ++ unsigned empty_record_count = 0; + + rr= &(s->s3->rrec); + sess=s->session; +@@ -523,7 +530,17 @@ printf("\n"); + s->packet_length=0; + + /* just read a 0 length packet */ +- if (rr->length == 0) goto again; ++ if (rr->length == 0) ++ { ++ empty_record_count++; ++ if (empty_record_count > MAX_EMPTY_RECORDS) ++ { ++ al=SSL_AD_UNEXPECTED_MESSAGE; ++ SSLerr(SSL_F_SSL3_GET_RECORD,SSL_R_RECORD_TOO_SMALL); ++ goto f_err; ++ } ++ goto again; ++ } + + #if 0 + fprintf(stderr, "Ultimate Record type=%d, Length=%d\n", rr->type, rr->length); +Index: crypto/openssl/ssl/s3_srvr.c +=================================================================== +--- crypto/openssl/ssl/s3_srvr.c (revision 273303) ++++ crypto/openssl/ssl/s3_srvr.c (working copy) +@@ -154,6 +154,7 @@ + #include + #include "ssl_locl.h" + #include "kssl_lcl.h" ++#include "../crypto/constant_time_locl.h" + #include + #include + #include +@@ -410,9 +411,8 @@ int ssl3_accept(SSL *s) + case SSL3_ST_SW_CERT_B: + /* Check if it is anon DH or anon ECDH, */ + /* normal PSK or KRB5 or SRP */ +- if (!(s->s3->tmp.new_cipher->algorithm_auth & SSL_aNULL) +- && !(s->s3->tmp.new_cipher->algorithm_mkey & SSL_kPSK) +- && !(s->s3->tmp.new_cipher->algorithm_auth & SSL_aKRB5)) ++ if (!(s->s3->tmp.new_cipher->algorithm_auth & (SSL_aNULL|SSL_aKRB5|SSL_aSRP)) ++ && !(s->s3->tmp.new_cipher->algorithm_mkey & SSL_kPSK)) + { + ret=ssl3_send_server_certificate(s); + if (ret <= 0) goto end; +@@ -515,7 +515,9 @@ int ssl3_accept(SSL *s) + * (against the specs, but s3_clnt.c accepts this for SSL 3) */ + !(s->verify_mode & SSL_VERIFY_FAIL_IF_NO_PEER_CERT)) || + /* never request cert in Kerberos ciphersuites */ +- (s->s3->tmp.new_cipher->algorithm_auth & SSL_aKRB5) ++ (s->s3->tmp.new_cipher->algorithm_auth & SSL_aKRB5) || ++ /* don't request certificate for SRP auth */ ++ (s->s3->tmp.new_cipher->algorithm_auth & SSL_aSRP) + /* With normal PSK Certificates and + * Certificate Requests are omitted */ + || (s->s3->tmp.new_cipher->algorithm_mkey & SSL_kPSK)) +@@ -1846,7 +1848,7 @@ int ssl3_send_server_key_exchange(SSL *s) + n+=2+nr[i]; + } + +- if (!(s->s3->tmp.new_cipher->algorithm_auth & SSL_aNULL) ++ if (!(s->s3->tmp.new_cipher->algorithm_auth & (SSL_aNULL|SSL_aSRP)) + && !(s->s3->tmp.new_cipher->algorithm_mkey & SSL_kPSK)) + { + if ((pkey=ssl_get_sign_pkey(s,s->s3->tmp.new_cipher,&md)) +@@ -2166,6 +2168,10 @@ int ssl3_get_client_key_exchange(SSL *s) + #ifndef OPENSSL_NO_RSA + if (alg_k & SSL_kRSA) + { ++ unsigned char rand_premaster_secret[SSL_MAX_MASTER_KEY_LENGTH]; ++ int decrypt_len; ++ unsigned char decrypt_good, version_good; ++ + /* FIX THIS UP EAY EAY EAY EAY */ + if (s->s3->tmp.use_rsa_tmp) + { +@@ -2213,54 +2219,61 @@ int ssl3_get_client_key_exchange(SSL *s) + n=i; + } + +- i=RSA_private_decrypt((int)n,p,p,rsa,RSA_PKCS1_PADDING); ++ /* We must not leak whether a decryption failure occurs because ++ * of Bleichenbacher's attack on PKCS #1 v1.5 RSA padding (see ++ * RFC 2246, section 7.4.7.1). The code follows that advice of ++ * the TLS RFC and generates a random premaster secret for the ++ * case that the decrypt fails. See ++ * https://tools.ietf.org/html/rfc5246#section-7.4.7.1 */ + +- al = -1; +- +- if (i != SSL_MAX_MASTER_KEY_LENGTH) ++ /* should be RAND_bytes, but we cannot work around a failure. */ ++ if (RAND_pseudo_bytes(rand_premaster_secret, ++ sizeof(rand_premaster_secret)) <= 0) ++ goto err; ++ decrypt_len = RSA_private_decrypt((int)n,p,p,rsa,RSA_PKCS1_PADDING); ++ ERR_clear_error(); ++ ++ /* decrypt_len should be SSL_MAX_MASTER_KEY_LENGTH. ++ * decrypt_good will be 0xff if so and zero otherwise. */ ++ decrypt_good = constant_time_eq_int_8(decrypt_len, SSL_MAX_MASTER_KEY_LENGTH); ++ ++ /* If the version in the decrypted pre-master secret is correct ++ * then version_good will be 0xff, otherwise it'll be zero. ++ * The Klima-Pokorny-Rosa extension of Bleichenbacher's attack ++ * (http://eprint.iacr.org/2003/052/) exploits the version ++ * number check as a "bad version oracle". Thus version checks ++ * are done in constant time and are treated like any other ++ * decryption error. */ ++ version_good = constant_time_eq_8(p[0], (unsigned)(s->client_version>>8)); ++ version_good &= constant_time_eq_8(p[1], (unsigned)(s->client_version&0xff)); ++ ++ /* The premaster secret must contain the same version number as ++ * the ClientHello to detect version rollback attacks ++ * (strangely, the protocol does not offer such protection for ++ * DH ciphersuites). However, buggy clients exist that send the ++ * negotiated protocol version instead if the server does not ++ * support the requested protocol version. If ++ * SSL_OP_TLS_ROLLBACK_BUG is set, tolerate such clients. */ ++ if (s->options & SSL_OP_TLS_ROLLBACK_BUG) + { +- al=SSL_AD_DECODE_ERROR; +- /* SSLerr(SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE,SSL_R_BAD_RSA_DECRYPT); */ ++ unsigned char workaround_good; ++ workaround_good = constant_time_eq_8(p[0], (unsigned)(s->version>>8)); ++ workaround_good &= constant_time_eq_8(p[1], (unsigned)(s->version&0xff)); ++ version_good |= workaround_good; + } + +- if ((al == -1) && !((p[0] == (s->client_version>>8)) && (p[1] == (s->client_version & 0xff)))) ++ /* Both decryption and version must be good for decrypt_good ++ * to remain non-zero (0xff). */ ++ decrypt_good &= version_good; ++ ++ /* Now copy rand_premaster_secret over p using ++ * decrypt_good_mask. */ ++ for (i = 0; i < (int) sizeof(rand_premaster_secret); i++) + { +- /* The premaster secret must contain the same version number as the +- * ClientHello to detect version rollback attacks (strangely, the +- * protocol does not offer such protection for DH ciphersuites). +- * However, buggy clients exist that send the negotiated protocol +- * version instead if the server does not support the requested +- * protocol version. +- * If SSL_OP_TLS_ROLLBACK_BUG is set, tolerate such clients. */ +- if (!((s->options & SSL_OP_TLS_ROLLBACK_BUG) && +- (p[0] == (s->version>>8)) && (p[1] == (s->version & 0xff)))) +- { +- al=SSL_AD_DECODE_ERROR; +- /* SSLerr(SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE,SSL_R_BAD_PROTOCOL_VERSION_NUMBER); */ +- +- /* The Klima-Pokorny-Rosa extension of Bleichenbacher's attack +- * (http://eprint.iacr.org/2003/052/) exploits the version +- * number check as a "bad version oracle" -- an alert would +- * reveal that the plaintext corresponding to some ciphertext +- * made up by the adversary is properly formatted except +- * that the version number is wrong. To avoid such attacks, +- * we should treat this just like any other decryption error. */ +- } ++ p[i] = constant_time_select_8(decrypt_good, p[i], ++ rand_premaster_secret[i]); + } + +- if (al != -1) +- { +- /* Some decryption failure -- use random value instead as countermeasure +- * against Bleichenbacher's attack on PKCS #1 v1.5 RSA padding +- * (see RFC 2246, section 7.4.7.1). */ +- ERR_clear_error(); +- i = SSL_MAX_MASTER_KEY_LENGTH; +- p[0] = s->client_version >> 8; +- p[1] = s->client_version & 0xff; +- if (RAND_pseudo_bytes(p+2, i-2) <= 0) /* should be RAND_bytes, but we cannot work around a failure */ +- goto err; +- } +- + s->session->master_key_length= + s->method->ssl3_enc->generate_master_secret(s, + s->session->master_key, +Index: crypto/openssl/ssl/srtp.h +=================================================================== +--- crypto/openssl/ssl/srtp.h (revision 273303) ++++ crypto/openssl/ssl/srtp.h (working copy) +@@ -130,6 +130,8 @@ extern "C" { + #define SRTP_NULL_SHA1_80 0x0005 + #define SRTP_NULL_SHA1_32 0x0006 + ++#ifndef OPENSSL_NO_SRTP ++ + int SSL_CTX_set_tlsext_use_srtp(SSL_CTX *ctx, const char *profiles); + int SSL_set_tlsext_use_srtp(SSL *ctx, const char *profiles); + SRTP_PROTECTION_PROFILE *SSL_get_selected_srtp_profile(SSL *s); +@@ -136,6 +138,8 @@ SRTP_PROTECTION_PROFILE *SSL_get_selected_srtp_pro + + STACK_OF(SRTP_PROTECTION_PROFILE) *SSL_get_srtp_profiles(SSL *ssl); + ++#endif ++ + #ifdef __cplusplus + } + #endif +Index: crypto/openssl/ssl/ssl.h +=================================================================== +--- crypto/openssl/ssl/ssl.h (revision 273303) ++++ crypto/openssl/ssl/ssl.h (working copy) +@@ -653,6 +653,10 @@ struct ssl_session_st + */ + #define SSL_MODE_SEND_CLIENTHELLO_TIME 0x00000020L + #define SSL_MODE_SEND_SERVERHELLO_TIME 0x00000040L ++/* Send TLS_FALLBACK_SCSV in the ClientHello. ++ * To be set by applications that reconnect with a downgraded protocol ++ * version; see draft-ietf-tls-downgrade-scsv-00 for details. */ ++#define SSL_MODE_SEND_FALLBACK_SCSV 0x00000080L + + /* Note: SSL[_CTX]_set_{options,mode} use |= op on the previous value, + * they cannot be used to clear bits. */ +@@ -1511,6 +1515,7 @@ DECLARE_PEM_rw(SSL_SESSION, SSL_SESSION) + #define SSL_AD_BAD_CERTIFICATE_STATUS_RESPONSE TLS1_AD_BAD_CERTIFICATE_STATUS_RESPONSE + #define SSL_AD_BAD_CERTIFICATE_HASH_VALUE TLS1_AD_BAD_CERTIFICATE_HASH_VALUE + #define SSL_AD_UNKNOWN_PSK_IDENTITY TLS1_AD_UNKNOWN_PSK_IDENTITY /* fatal */ ++#define SSL_AD_INAPPROPRIATE_FALLBACK TLS1_AD_INAPPROPRIATE_FALLBACK /* fatal */ + + #define SSL_ERROR_NONE 0 + #define SSL_ERROR_SSL 1 +@@ -1621,6 +1626,8 @@ DECLARE_PEM_rw(SSL_SESSION, SSL_SESSION) + #define SSL_CTRL_GET_EXTRA_CHAIN_CERTS 82 + #define SSL_CTRL_CLEAR_EXTRA_CHAIN_CERTS 83 + ++#define SSL_CTRL_CHECK_PROTO_VERSION 119 ++ + #define DTLSv1_get_timeout(ssl, arg) \ + SSL_ctrl(ssl,DTLS_CTRL_GET_TIMEOUT,0, (void *)arg) + #define DTLSv1_handle_timeout(ssl) \ +@@ -2379,6 +2386,7 @@ void ERR_load_SSL_strings(void); + #define SSL_R_HTTPS_PROXY_REQUEST 155 + #define SSL_R_HTTP_REQUEST 156 + #define SSL_R_ILLEGAL_PADDING 283 ++#define SSL_R_INAPPROPRIATE_FALLBACK 373 + #define SSL_R_INCONSISTENT_COMPRESSION 340 + #define SSL_R_INVALID_CHALLENGE_LENGTH 158 + #define SSL_R_INVALID_COMMAND 280 +@@ -2525,6 +2533,7 @@ void ERR_load_SSL_strings(void); + #define SSL_R_TLSV1_ALERT_DECRYPTION_FAILED 1021 + #define SSL_R_TLSV1_ALERT_DECRYPT_ERROR 1051 + #define SSL_R_TLSV1_ALERT_EXPORT_RESTRICTION 1060 ++#define SSL_R_TLSV1_ALERT_INAPPROPRIATE_FALLBACK 1086 + #define SSL_R_TLSV1_ALERT_INSUFFICIENT_SECURITY 1071 + #define SSL_R_TLSV1_ALERT_INTERNAL_ERROR 1080 + #define SSL_R_TLSV1_ALERT_NO_RENEGOTIATION 1100 +Index: crypto/openssl/ssl/ssl3.h +=================================================================== +--- crypto/openssl/ssl/ssl3.h (revision 273303) ++++ crypto/openssl/ssl/ssl3.h (working copy) +@@ -128,9 +128,14 @@ + extern "C" { + #endif + +-/* Signalling cipher suite value: from draft-ietf-tls-renegotiation-03.txt */ ++/* Signalling cipher suite value from RFC 5746 ++ * (TLS_EMPTY_RENEGOTIATION_INFO_SCSV) */ + #define SSL3_CK_SCSV 0x030000FF + ++/* Signalling cipher suite value from draft-ietf-tls-downgrade-scsv-00 ++ * (TLS_FALLBACK_SCSV) */ ++#define SSL3_CK_FALLBACK_SCSV 0x03005600 ++ + #define SSL3_CK_RSA_NULL_MD5 0x03000001 + #define SSL3_CK_RSA_NULL_SHA 0x03000002 + #define SSL3_CK_RSA_RC4_40_MD5 0x03000003 +Index: crypto/openssl/ssl/ssl_err.c +=================================================================== +--- crypto/openssl/ssl/ssl_err.c (revision 273303) ++++ crypto/openssl/ssl/ssl_err.c (working copy) +@@ -383,6 +383,7 @@ static ERR_STRING_DATA SSL_str_reasons[]= + {ERR_REASON(SSL_R_HTTPS_PROXY_REQUEST) ,"https proxy request"}, + {ERR_REASON(SSL_R_HTTP_REQUEST) ,"http request"}, + {ERR_REASON(SSL_R_ILLEGAL_PADDING) ,"illegal padding"}, ++{ERR_REASON(SSL_R_INAPPROPRIATE_FALLBACK),"inappropriate fallback"}, + {ERR_REASON(SSL_R_INCONSISTENT_COMPRESSION),"inconsistent compression"}, + {ERR_REASON(SSL_R_INVALID_CHALLENGE_LENGTH),"invalid challenge length"}, + {ERR_REASON(SSL_R_INVALID_COMMAND) ,"invalid command"}, +@@ -529,6 +530,7 @@ static ERR_STRING_DATA SSL_str_reasons[]= + {ERR_REASON(SSL_R_TLSV1_ALERT_DECRYPTION_FAILED),"tlsv1 alert decryption failed"}, + {ERR_REASON(SSL_R_TLSV1_ALERT_DECRYPT_ERROR),"tlsv1 alert decrypt error"}, + {ERR_REASON(SSL_R_TLSV1_ALERT_EXPORT_RESTRICTION),"tlsv1 alert export restriction"}, ++{ERR_REASON(SSL_R_TLSV1_ALERT_INAPPROPRIATE_FALLBACK),"tlsv1 alert inappropriate fallback"}, + {ERR_REASON(SSL_R_TLSV1_ALERT_INSUFFICIENT_SECURITY),"tlsv1 alert insufficient security"}, + {ERR_REASON(SSL_R_TLSV1_ALERT_INTERNAL_ERROR),"tlsv1 alert internal error"}, + {ERR_REASON(SSL_R_TLSV1_ALERT_NO_RENEGOTIATION),"tlsv1 alert no renegotiation"}, +Index: crypto/openssl/ssl/ssl_lib.c +=================================================================== +--- crypto/openssl/ssl/ssl_lib.c (revision 273303) ++++ crypto/openssl/ssl/ssl_lib.c (working copy) +@@ -1387,6 +1387,8 @@ int ssl_cipher_list_to_bytes(SSL *s,STACK_OF(SSL_C + + if (sk == NULL) return(0); + q=p; ++ if (put_cb == NULL) ++ put_cb = s->method->put_cipher_by_char; + + for (i=0; isrp_ctx.srp_Mask & SSL_kSRP)) + continue; + #endif /* OPENSSL_NO_SRP */ +- j = put_cb ? put_cb(c,p) : ssl_put_cipher_by_char(s,c,p); ++ j = put_cb(c,p); + p+=j; + } +- /* If p == q, no ciphers and caller indicates an error. Otherwise +- * add SCSV if not renegotiating. +- */ +- if (p != q && !s->renegotiate) ++ /* If p == q, no ciphers; caller indicates an error. ++ * Otherwise, add applicable SCSVs. */ ++ if (p != q) + { +- static SSL_CIPHER scsv = ++ if (!s->renegotiate) + { +- 0, NULL, SSL3_CK_SCSV, 0, 0, 0, 0, 0, 0, 0, 0, 0 +- }; +- j = put_cb ? put_cb(&scsv,p) : ssl_put_cipher_by_char(s,&scsv,p); +- p+=j; ++ static SSL_CIPHER scsv = ++ { ++ 0, NULL, SSL3_CK_SCSV, 0, 0, 0, 0, 0, 0, 0, 0, 0 ++ }; ++ j = put_cb(&scsv,p); ++ p+=j; + #ifdef OPENSSL_RI_DEBUG +- fprintf(stderr, "SCSV sent by client\n"); ++ fprintf(stderr, "TLS_EMPTY_RENEGOTIATION_INFO_SCSV sent by client\n"); + #endif +- } ++ } + ++ if (s->mode & SSL_MODE_SEND_FALLBACK_SCSV) ++ { ++ static SSL_CIPHER scsv = ++ { ++ 0, NULL, SSL3_CK_FALLBACK_SCSV, 0, 0, 0, 0, 0, 0, 0, 0, 0 ++ }; ++ j = put_cb(&scsv,p); ++ p+=j; ++ } ++ } ++ + return(p-q); + } + +@@ -1439,11 +1453,12 @@ STACK_OF(SSL_CIPHER) *ssl_bytes_to_cipher_list(SSL + const SSL_CIPHER *c; + STACK_OF(SSL_CIPHER) *sk; + int i,n; ++ + if (s->s3) + s->s3->send_connection_binding = 0; + + n=ssl_put_cipher_by_char(s,NULL,NULL); +- if ((num%n) != 0) ++ if (n == 0 || (num%n) != 0) + { + SSLerr(SSL_F_SSL_BYTES_TO_CIPHER_LIST,SSL_R_ERROR_IN_RECEIVED_CIPHER_LIST); + return(NULL); +@@ -1458,7 +1473,7 @@ STACK_OF(SSL_CIPHER) *ssl_bytes_to_cipher_list(SSL + + for (i=0; is3 && (n != 3 || !p[0]) && + (p[n-2] == ((SSL3_CK_SCSV >> 8) & 0xff)) && + (p[n-1] == (SSL3_CK_SCSV & 0xff))) +@@ -1478,6 +1493,23 @@ STACK_OF(SSL_CIPHER) *ssl_bytes_to_cipher_list(SSL + continue; + } + ++ /* Check for TLS_FALLBACK_SCSV */ ++ if ((n != 3 || !p[0]) && ++ (p[n-2] == ((SSL3_CK_FALLBACK_SCSV >> 8) & 0xff)) && ++ (p[n-1] == (SSL3_CK_FALLBACK_SCSV & 0xff))) ++ { ++ /* The SCSV indicates that the client previously tried a higher version. ++ * Fail if the current version is an unexpected downgrade. */ ++ if (!SSL_ctrl(s, SSL_CTRL_CHECK_PROTO_VERSION, 0, NULL)) ++ { ++ SSLerr(SSL_F_SSL_BYTES_TO_CIPHER_LIST,SSL_R_INAPPROPRIATE_FALLBACK); ++ if (s->s3) ++ ssl3_send_alert(s,SSL3_AL_FATAL,SSL_AD_INAPPROPRIATE_FALLBACK); ++ goto err; ++ } ++ continue; ++ } ++ + c=ssl_get_cipher_by_char(s,p); + p+=n; + if (c != NULL) +@@ -2944,6 +2976,7 @@ SSL_CTX *SSL_get_SSL_CTX(const SSL *ssl) + + SSL_CTX *SSL_set_SSL_CTX(SSL *ssl, SSL_CTX* ctx) + { ++ CERT *ocert = ssl->cert; + if (ssl->ctx == ctx) + return ssl->ctx; + #ifndef OPENSSL_NO_TLSEXT +@@ -2950,9 +2983,19 @@ SSL_CTX *SSL_set_SSL_CTX(SSL *ssl, SSL_CTX* ctx) + if (ctx == NULL) + ctx = ssl->initial_ctx; + #endif +- if (ssl->cert != NULL) +- ssl_cert_free(ssl->cert); + ssl->cert = ssl_cert_dup(ctx->cert); ++ if (ocert != NULL) ++ { ++ int i; ++ /* Copy negotiated digests from original */ ++ for (i = 0; i < SSL_PKEY_NUM; i++) ++ { ++ CERT_PKEY *cpk = ocert->pkeys + i; ++ CERT_PKEY *rpk = ssl->cert->pkeys + i; ++ rpk->digest = cpk->digest; ++ } ++ ssl_cert_free(ocert); ++ } + CRYPTO_add(&ctx->references,1,CRYPTO_LOCK_SSL_CTX); + if (ssl->ctx != NULL) + SSL_CTX_free(ssl->ctx); /* decrement reference count */ +Index: crypto/openssl/ssl/t1_enc.c +=================================================================== +--- crypto/openssl/ssl/t1_enc.c (revision 273303) ++++ crypto/openssl/ssl/t1_enc.c (working copy) +@@ -1241,6 +1241,7 @@ int tls1_alert_code(int code) + case SSL_AD_BAD_CERTIFICATE_STATUS_RESPONSE: return(TLS1_AD_BAD_CERTIFICATE_STATUS_RESPONSE); + case SSL_AD_BAD_CERTIFICATE_HASH_VALUE: return(TLS1_AD_BAD_CERTIFICATE_HASH_VALUE); + case SSL_AD_UNKNOWN_PSK_IDENTITY:return(TLS1_AD_UNKNOWN_PSK_IDENTITY); ++ case SSL_AD_INAPPROPRIATE_FALLBACK:return(TLS1_AD_INAPPROPRIATE_FALLBACK); + #if 0 /* not appropriate for TLS, not used for DTLS */ + case DTLS1_AD_MISSING_HANDSHAKE_MESSAGE: return + (DTLS1_AD_MISSING_HANDSHAKE_MESSAGE); +Index: crypto/openssl/ssl/t1_lib.c +=================================================================== +--- crypto/openssl/ssl/t1_lib.c (revision 273303) ++++ crypto/openssl/ssl/t1_lib.c (working copy) +@@ -643,7 +643,7 @@ unsigned char *ssl_add_clienthello_tlsext(SSL *s, + #endif + + #ifndef OPENSSL_NO_SRTP +- if(SSL_get_srtp_profiles(s)) ++ if(SSL_IS_DTLS(s) && SSL_get_srtp_profiles(s)) + { + int el; + +@@ -806,7 +806,7 @@ unsigned char *ssl_add_serverhello_tlsext(SSL *s, + #endif + + #ifndef OPENSSL_NO_SRTP +- if(s->srtp_profile) ++ if(SSL_IS_DTLS(s) && s->srtp_profile) + { + int el; + +@@ -1444,7 +1444,8 @@ int ssl_parse_clienthello_tlsext(SSL *s, unsigned + + /* session ticket processed earlier */ + #ifndef OPENSSL_NO_SRTP +- else if (type == TLSEXT_TYPE_use_srtp) ++ else if (SSL_IS_DTLS(s) && SSL_get_srtp_profiles(s) ++ && type == TLSEXT_TYPE_use_srtp) + { + if(ssl_parse_clienthello_use_srtp_ext(s, data, size, + al)) +@@ -1698,7 +1699,7 @@ int ssl_parse_serverhello_tlsext(SSL *s, unsigned + } + #endif + #ifndef OPENSSL_NO_SRTP +- else if (type == TLSEXT_TYPE_use_srtp) ++ else if (SSL_IS_DTLS(s) && type == TLSEXT_TYPE_use_srtp) + { + if(ssl_parse_serverhello_use_srtp_ext(s, data, size, + al)) +@@ -2347,7 +2348,10 @@ static int tls_decrypt_ticket(SSL *s, const unsign + HMAC_Final(&hctx, tick_hmac, NULL); + HMAC_CTX_cleanup(&hctx); + if (CRYPTO_memcmp(tick_hmac, etick + eticklen, mlen)) ++ { ++ EVP_CIPHER_CTX_cleanup(&ctx); + return 2; ++ } + /* Attempt to decrypt session data */ + /* Move p after IV to start of encrypted ticket, update length */ + p = etick + 16 + EVP_CIPHER_CTX_iv_length(&ctx); +Index: crypto/openssl/ssl/tls1.h +=================================================================== +--- crypto/openssl/ssl/tls1.h (revision 273303) ++++ crypto/openssl/ssl/tls1.h (working copy) +@@ -159,17 +159,19 @@ extern "C" { + + #define TLS1_ALLOW_EXPERIMENTAL_CIPHERSUITES 0 + ++#define TLS1_VERSION 0x0301 ++#define TLS1_1_VERSION 0x0302 + #define TLS1_2_VERSION 0x0303 +-#define TLS1_2_VERSION_MAJOR 0x03 +-#define TLS1_2_VERSION_MINOR 0x03 ++#define TLS_MAX_VERSION TLS1_2_VERSION + +-#define TLS1_1_VERSION 0x0302 ++#define TLS1_VERSION_MAJOR 0x03 ++#define TLS1_VERSION_MINOR 0x01 ++ + #define TLS1_1_VERSION_MAJOR 0x03 + #define TLS1_1_VERSION_MINOR 0x02 + +-#define TLS1_VERSION 0x0301 +-#define TLS1_VERSION_MAJOR 0x03 +-#define TLS1_VERSION_MINOR 0x01 ++#define TLS1_2_VERSION_MAJOR 0x03 ++#define TLS1_2_VERSION_MINOR 0x03 + + #define TLS1_get_version(s) \ + ((s->version >> 8) == TLS1_VERSION_MAJOR ? s->version : 0) +@@ -187,6 +189,7 @@ extern "C" { + #define TLS1_AD_PROTOCOL_VERSION 70 /* fatal */ + #define TLS1_AD_INSUFFICIENT_SECURITY 71 /* fatal */ + #define TLS1_AD_INTERNAL_ERROR 80 /* fatal */ ++#define TLS1_AD_INAPPROPRIATE_FALLBACK 86 /* fatal */ + #define TLS1_AD_USER_CANCELLED 90 + #define TLS1_AD_NO_RENEGOTIATION 100 + /* codes 110-114 are from RFC3546 */ +Index: crypto/openssl/util/mk1mf.pl +=================================================================== +--- crypto/openssl/util/mk1mf.pl (revision 273303) ++++ crypto/openssl/util/mk1mf.pl (working copy) +@@ -1145,6 +1145,7 @@ sub read_options + "dll" => \$shlib, + "shared" => 0, + "no-sctp" => 0, ++ "no-srtp" => 0, + "no-gmp" => 0, + "no-rfc3779" => 0, + "no-montasm" => 0, +Index: crypto/openssl/util/mkdef.pl +=================================================================== +--- crypto/openssl/util/mkdef.pl (revision 273303) ++++ crypto/openssl/util/mkdef.pl (working copy) +@@ -117,6 +117,8 @@ my @known_algorithms = ( "RC2", "RC4", "RC5", "IDE + "SSL_INTERN", + # SCTP + "SCTP", ++ # SRTP ++ "SRTP", + # Unit testing + "UNIT_TEST"); + +@@ -138,7 +140,7 @@ my $no_ec; my $no_ecdsa; my $no_ecdh; my $no_engin + my $no_fp_api; my $no_static_engine=1; my $no_gmp; my $no_deprecated; + my $no_rfc3779; my $no_psk; my $no_tlsext; my $no_cms; my $no_capieng; + my $no_jpake; my $no_srp; my $no_ssl2; my $no_ec2m; my $no_nistp_gcc; +-my $no_nextprotoneg; my $no_sctp; ++my $no_nextprotoneg; my $no_sctp; my $no_srtp; + my $no_unit_test; + + my $fips; +@@ -238,6 +240,7 @@ foreach (@ARGV, split(/ /, $options)) + elsif (/^no-jpake$/) { $no_jpake=1; } + elsif (/^no-srp$/) { $no_srp=1; } + elsif (/^no-sctp$/) { $no_sctp=1; } ++ elsif (/^no-srtp$/) { $no_srtp=1; } + elsif (/^no-unit-test$/){ $no_unit_test=1; } + } + +@@ -1209,6 +1212,7 @@ sub is_valid + if ($keyword eq "JPAKE" && $no_jpake) { return 0; } + if ($keyword eq "SRP" && $no_srp) { return 0; } + if ($keyword eq "SCTP" && $no_sctp) { return 0; } ++ if ($keyword eq "SRTP" && $no_srtp) { return 0; } + if ($keyword eq "UNIT_TEST" && $no_unit_test) { return 0; } + if ($keyword eq "DEPRECATED" && $no_deprecated) { return 0; } + +Index: crypto/openssl/util/ssleay.num +=================================================================== +--- crypto/openssl/util/ssleay.num (revision 273303) ++++ crypto/openssl/util/ssleay.num (working copy) +@@ -310,14 +310,14 @@ TLSv1_2_method 350 EXIST: + SSL_SESSION_get_id_len 351 NOEXIST::FUNCTION: + kssl_ctx_get0_client_princ 352 EXIST::FUNCTION:KRB5 + SSL_export_keying_material 353 EXIST::FUNCTION:TLSEXT +-SSL_set_tlsext_use_srtp 354 EXIST::FUNCTION: ++SSL_set_tlsext_use_srtp 354 EXIST::FUNCTION:SRTP + SSL_CTX_set_next_protos_advertised_cb 355 EXIST:!VMS:FUNCTION:NEXTPROTONEG + SSL_CTX_set_next_protos_adv_cb 355 EXIST:VMS:FUNCTION:NEXTPROTONEG + SSL_get0_next_proto_negotiated 356 EXIST::FUNCTION:NEXTPROTONEG +-SSL_get_selected_srtp_profile 357 EXIST::FUNCTION: +-SSL_CTX_set_tlsext_use_srtp 358 EXIST::FUNCTION: ++SSL_get_selected_srtp_profile 357 EXIST::FUNCTION:SRTP ++SSL_CTX_set_tlsext_use_srtp 358 EXIST::FUNCTION:SRTP + SSL_select_next_proto 359 EXIST::FUNCTION:NEXTPROTONEG +-SSL_get_srtp_profiles 360 EXIST::FUNCTION: ++SSL_get_srtp_profiles 360 EXIST::FUNCTION:SRTP + SSL_CTX_set_next_proto_select_cb 361 EXIST:!VMS:FUNCTION:NEXTPROTONEG + SSL_CTX_set_next_proto_sel_cb 361 EXIST:VMS:FUNCTION:NEXTPROTONEG + SSL_SESSION_get_compress_id 362 EXIST::FUNCTION: +Index: secure/lib/libcrypto/Makefile.inc +=================================================================== +--- secure/lib/libcrypto/Makefile.inc (revision 273303) ++++ secure/lib/libcrypto/Makefile.inc (working copy) +@@ -3,8 +3,8 @@ + .include + + # OpenSSL version used for manual page generation +-OPENSSL_VER= 1.0.1i +-OPENSSL_DATE= 2014-08-06 ++OPENSSL_VER= 1.0.1j ++OPENSSL_DATE= 2014-10-15 + + LCRYPTO_SRC= ${.CURDIR}/../../../crypto/openssl + LCRYPTO_DOC= ${.CURDIR}/../../../crypto/openssl/doc +Index: secure/lib/libcrypto/Makefile.man +=================================================================== +--- secure/lib/libcrypto/Makefile.man (revision 273303) ++++ secure/lib/libcrypto/Makefile.man (working copy) +@@ -47,6 +47,7 @@ MAN+= BN_swap.3 + MAN+= BN_zero.3 + MAN+= CMS_add0_cert.3 + MAN+= CMS_add1_recipient_cert.3 ++MAN+= CMS_add1_signer.3 + MAN+= CMS_compress.3 + MAN+= CMS_decrypt.3 + MAN+= CMS_encrypt.3 +@@ -56,7 +57,6 @@ MAN+= CMS_get0_SignerInfos.3 + MAN+= CMS_get0_type.3 + MAN+= CMS_get1_ReceiptRequest.3 + MAN+= CMS_sign.3 +-MAN+= CMS_sign_add1_signer.3 + MAN+= CMS_sign_receipt.3 + MAN+= CMS_uncompress.3 + MAN+= CMS_verify.3 +@@ -397,6 +397,7 @@ MLINKS+= CMS_add0_cert.3 CMS_get1_certs.3 + MLINKS+= CMS_add0_cert.3 CMS_add0_crl.3 + MLINKS+= CMS_add0_cert.3 CMS_get1_crls.3 + MLINKS+= CMS_add1_recipient_cert.3 CMS_add0_recipient_key.3 ++MLINKS+= CMS_add1_signer.3 CMS_SignerInfo_sign.3 + MLINKS+= CMS_get0_RecipientInfos.3 CMS_RecipientInfo_type.3 + MLINKS+= CMS_get0_RecipientInfos.3 CMS_RecipientInfo_ktri_get0_signer_id.3 + MLINKS+= CMS_get0_RecipientInfos.3 CMS_RecipientInfo_ktri_cert_cmp.3 +@@ -413,7 +414,6 @@ MLINKS+= CMS_get0_type.3 CMS_get0_eContentType.3 + MLINKS+= CMS_get1_ReceiptRequest.3 CMS_ReceiptRequest_create0.3 + MLINKS+= CMS_get1_ReceiptRequest.3 CMS_add1_ReceiptRequest.3 + MLINKS+= CMS_get1_ReceiptRequest.3 CMS_ReceiptRequest_get0_values.3 +-MLINKS+= CMS_sign_add1_signer.3 CMS_SignerInfo_sign.3 + MLINKS+= CONF_modules_free.3 CONF_modules_finish.3 + MLINKS+= CONF_modules_free.3 CONF_modules_unload.3 + MLINKS+= CONF_modules_load_file.3 CONF_modules_load.3 +Index: secure/lib/libcrypto/man/ASN1_OBJECT_new.3 +=================================================================== +--- secure/lib/libcrypto/man/ASN1_OBJECT_new.3 (revision 273303) ++++ secure/lib/libcrypto/man/ASN1_OBJECT_new.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "ASN1_OBJECT_new 3" +-.TH ASN1_OBJECT_new 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH ASN1_OBJECT_new 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/ASN1_STRING_length.3 +=================================================================== +--- secure/lib/libcrypto/man/ASN1_STRING_length.3 (revision 273303) ++++ secure/lib/libcrypto/man/ASN1_STRING_length.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "ASN1_STRING_length 3" +-.TH ASN1_STRING_length 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH ASN1_STRING_length 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/ASN1_STRING_new.3 +=================================================================== +--- secure/lib/libcrypto/man/ASN1_STRING_new.3 (revision 273303) ++++ secure/lib/libcrypto/man/ASN1_STRING_new.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "ASN1_STRING_new 3" +-.TH ASN1_STRING_new 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH ASN1_STRING_new 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/ASN1_STRING_print_ex.3 +=================================================================== +--- secure/lib/libcrypto/man/ASN1_STRING_print_ex.3 (revision 273303) ++++ secure/lib/libcrypto/man/ASN1_STRING_print_ex.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "ASN1_STRING_print_ex 3" +-.TH ASN1_STRING_print_ex 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH ASN1_STRING_print_ex 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/ASN1_generate_nconf.3 +=================================================================== +--- secure/lib/libcrypto/man/ASN1_generate_nconf.3 (revision 273303) ++++ secure/lib/libcrypto/man/ASN1_generate_nconf.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "ASN1_generate_nconf 3" +-.TH ASN1_generate_nconf 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH ASN1_generate_nconf 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/BIO_ctrl.3 +=================================================================== +--- secure/lib/libcrypto/man/BIO_ctrl.3 (revision 273303) ++++ secure/lib/libcrypto/man/BIO_ctrl.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "BIO_ctrl 3" +-.TH BIO_ctrl 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH BIO_ctrl 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/BIO_f_base64.3 +=================================================================== +--- secure/lib/libcrypto/man/BIO_f_base64.3 (revision 273303) ++++ secure/lib/libcrypto/man/BIO_f_base64.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "BIO_f_base64 3" +-.TH BIO_f_base64 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH BIO_f_base64 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/BIO_f_buffer.3 +=================================================================== +--- secure/lib/libcrypto/man/BIO_f_buffer.3 (revision 273303) ++++ secure/lib/libcrypto/man/BIO_f_buffer.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "BIO_f_buffer 3" +-.TH BIO_f_buffer 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH BIO_f_buffer 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/BIO_f_cipher.3 +=================================================================== +--- secure/lib/libcrypto/man/BIO_f_cipher.3 (revision 273303) ++++ secure/lib/libcrypto/man/BIO_f_cipher.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "BIO_f_cipher 3" +-.TH BIO_f_cipher 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH BIO_f_cipher 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/BIO_f_md.3 +=================================================================== +--- secure/lib/libcrypto/man/BIO_f_md.3 (revision 273303) ++++ secure/lib/libcrypto/man/BIO_f_md.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "BIO_f_md 3" +-.TH BIO_f_md 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH BIO_f_md 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/BIO_f_null.3 +=================================================================== +--- secure/lib/libcrypto/man/BIO_f_null.3 (revision 273303) ++++ secure/lib/libcrypto/man/BIO_f_null.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "BIO_f_null 3" +-.TH BIO_f_null 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH BIO_f_null 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/BIO_f_ssl.3 +=================================================================== +--- secure/lib/libcrypto/man/BIO_f_ssl.3 (revision 273303) ++++ secure/lib/libcrypto/man/BIO_f_ssl.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "BIO_f_ssl 3" +-.TH BIO_f_ssl 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH BIO_f_ssl 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/BIO_find_type.3 +=================================================================== +--- secure/lib/libcrypto/man/BIO_find_type.3 (revision 273303) ++++ secure/lib/libcrypto/man/BIO_find_type.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "BIO_find_type 3" +-.TH BIO_find_type 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH BIO_find_type 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/BIO_new.3 +=================================================================== +--- secure/lib/libcrypto/man/BIO_new.3 (revision 273303) ++++ secure/lib/libcrypto/man/BIO_new.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "BIO_new 3" +-.TH BIO_new 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH BIO_new 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/BIO_new_CMS.3 +=================================================================== +--- secure/lib/libcrypto/man/BIO_new_CMS.3 (revision 273303) ++++ secure/lib/libcrypto/man/BIO_new_CMS.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "BIO_new_CMS 3" +-.TH BIO_new_CMS 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH BIO_new_CMS 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/BIO_push.3 +=================================================================== +--- secure/lib/libcrypto/man/BIO_push.3 (revision 273303) ++++ secure/lib/libcrypto/man/BIO_push.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "BIO_push 3" +-.TH BIO_push 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH BIO_push 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/BIO_read.3 +=================================================================== +--- secure/lib/libcrypto/man/BIO_read.3 (revision 273303) ++++ secure/lib/libcrypto/man/BIO_read.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "BIO_read 3" +-.TH BIO_read 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH BIO_read 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/BIO_s_accept.3 +=================================================================== +--- secure/lib/libcrypto/man/BIO_s_accept.3 (revision 273303) ++++ secure/lib/libcrypto/man/BIO_s_accept.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "BIO_s_accept 3" +-.TH BIO_s_accept 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH BIO_s_accept 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +@@ -187,8 +187,8 @@ the accept socket. See \fIBIO_s_fd\fR\|(3) + \&\fIBIO_set_accept_port()\fR uses the string \fBname\fR to set the accept + port. The port is represented as a string of the form \*(L"host:port\*(R", + where \*(L"host\*(R" is the interface to use and \*(L"port\*(R" is the port. +-Either or both values can be \*(L"*\*(R" which is interpreted as meaning +-any interface or port respectively. \*(L"port\*(R" has the same syntax ++The host can be can be \*(L"*\*(R" which is interpreted as meaning ++any interface; \*(L"port\*(R" has the same syntax + as the port specified in \fIBIO_set_conn_port()\fR for connect BIOs, + that is it can be a numerical port string or a string to lookup + using \fIgetservbyname()\fR and a string table. +Index: secure/lib/libcrypto/man/BIO_s_bio.3 +=================================================================== +--- secure/lib/libcrypto/man/BIO_s_bio.3 (revision 273303) ++++ secure/lib/libcrypto/man/BIO_s_bio.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "BIO_s_bio 3" +-.TH BIO_s_bio 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH BIO_s_bio 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/BIO_s_connect.3 +=================================================================== +--- secure/lib/libcrypto/man/BIO_s_connect.3 (revision 273303) ++++ secure/lib/libcrypto/man/BIO_s_connect.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "BIO_s_connect 3" +-.TH BIO_s_connect 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH BIO_s_connect 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/BIO_s_fd.3 +=================================================================== +--- secure/lib/libcrypto/man/BIO_s_fd.3 (revision 273303) ++++ secure/lib/libcrypto/man/BIO_s_fd.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "BIO_s_fd 3" +-.TH BIO_s_fd 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH BIO_s_fd 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/BIO_s_file.3 +=================================================================== +--- secure/lib/libcrypto/man/BIO_s_file.3 (revision 273303) ++++ secure/lib/libcrypto/man/BIO_s_file.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "BIO_s_file 3" +-.TH BIO_s_file 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH BIO_s_file 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/BIO_s_mem.3 +=================================================================== +--- secure/lib/libcrypto/man/BIO_s_mem.3 (revision 273303) ++++ secure/lib/libcrypto/man/BIO_s_mem.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "BIO_s_mem 3" +-.TH BIO_s_mem 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH BIO_s_mem 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/BIO_s_null.3 +=================================================================== +--- secure/lib/libcrypto/man/BIO_s_null.3 (revision 273303) ++++ secure/lib/libcrypto/man/BIO_s_null.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "BIO_s_null 3" +-.TH BIO_s_null 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH BIO_s_null 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/BIO_s_socket.3 +=================================================================== +--- secure/lib/libcrypto/man/BIO_s_socket.3 (revision 273303) ++++ secure/lib/libcrypto/man/BIO_s_socket.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "BIO_s_socket 3" +-.TH BIO_s_socket 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH BIO_s_socket 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/BIO_set_callback.3 +=================================================================== +--- secure/lib/libcrypto/man/BIO_set_callback.3 (revision 273303) ++++ secure/lib/libcrypto/man/BIO_set_callback.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "BIO_set_callback 3" +-.TH BIO_set_callback 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH BIO_set_callback 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/BIO_should_retry.3 +=================================================================== +--- secure/lib/libcrypto/man/BIO_should_retry.3 (revision 273303) ++++ secure/lib/libcrypto/man/BIO_should_retry.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "BIO_should_retry 3" +-.TH BIO_should_retry 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH BIO_should_retry 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/BN_BLINDING_new.3 +=================================================================== +--- secure/lib/libcrypto/man/BN_BLINDING_new.3 (revision 273303) ++++ secure/lib/libcrypto/man/BN_BLINDING_new.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "BN_BLINDING_new 3" +-.TH BN_BLINDING_new 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH BN_BLINDING_new 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/BN_CTX_new.3 +=================================================================== +--- secure/lib/libcrypto/man/BN_CTX_new.3 (revision 273303) ++++ secure/lib/libcrypto/man/BN_CTX_new.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "BN_CTX_new 3" +-.TH BN_CTX_new 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH BN_CTX_new 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/BN_CTX_start.3 +=================================================================== +--- secure/lib/libcrypto/man/BN_CTX_start.3 (revision 273303) ++++ secure/lib/libcrypto/man/BN_CTX_start.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "BN_CTX_start 3" +-.TH BN_CTX_start 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH BN_CTX_start 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/BN_add.3 +=================================================================== +--- secure/lib/libcrypto/man/BN_add.3 (revision 273303) ++++ secure/lib/libcrypto/man/BN_add.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "BN_add 3" +-.TH BN_add 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH BN_add 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/BN_add_word.3 +=================================================================== +--- secure/lib/libcrypto/man/BN_add_word.3 (revision 273303) ++++ secure/lib/libcrypto/man/BN_add_word.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "BN_add_word 3" +-.TH BN_add_word 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH BN_add_word 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/BN_bn2bin.3 +=================================================================== +--- secure/lib/libcrypto/man/BN_bn2bin.3 (revision 273303) ++++ secure/lib/libcrypto/man/BN_bn2bin.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "BN_bn2bin 3" +-.TH BN_bn2bin 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH BN_bn2bin 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/BN_cmp.3 +=================================================================== +--- secure/lib/libcrypto/man/BN_cmp.3 (revision 273303) ++++ secure/lib/libcrypto/man/BN_cmp.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "BN_cmp 3" +-.TH BN_cmp 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH BN_cmp 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/BN_copy.3 +=================================================================== +--- secure/lib/libcrypto/man/BN_copy.3 (revision 273303) ++++ secure/lib/libcrypto/man/BN_copy.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "BN_copy 3" +-.TH BN_copy 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH BN_copy 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/BN_generate_prime.3 +=================================================================== +--- secure/lib/libcrypto/man/BN_generate_prime.3 (revision 273303) ++++ secure/lib/libcrypto/man/BN_generate_prime.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "BN_generate_prime 3" +-.TH BN_generate_prime 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH BN_generate_prime 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/BN_mod_inverse.3 +=================================================================== +--- secure/lib/libcrypto/man/BN_mod_inverse.3 (revision 273303) ++++ secure/lib/libcrypto/man/BN_mod_inverse.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "BN_mod_inverse 3" +-.TH BN_mod_inverse 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH BN_mod_inverse 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/BN_mod_mul_montgomery.3 +=================================================================== +--- secure/lib/libcrypto/man/BN_mod_mul_montgomery.3 (revision 273303) ++++ secure/lib/libcrypto/man/BN_mod_mul_montgomery.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "BN_mod_mul_montgomery 3" +-.TH BN_mod_mul_montgomery 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH BN_mod_mul_montgomery 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/BN_mod_mul_reciprocal.3 +=================================================================== +--- secure/lib/libcrypto/man/BN_mod_mul_reciprocal.3 (revision 273303) ++++ secure/lib/libcrypto/man/BN_mod_mul_reciprocal.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "BN_mod_mul_reciprocal 3" +-.TH BN_mod_mul_reciprocal 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH BN_mod_mul_reciprocal 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/BN_new.3 +=================================================================== +--- secure/lib/libcrypto/man/BN_new.3 (revision 273303) ++++ secure/lib/libcrypto/man/BN_new.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "BN_new 3" +-.TH BN_new 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH BN_new 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/BN_num_bytes.3 +=================================================================== +--- secure/lib/libcrypto/man/BN_num_bytes.3 (revision 273303) ++++ secure/lib/libcrypto/man/BN_num_bytes.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "BN_num_bytes 3" +-.TH BN_num_bytes 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH BN_num_bytes 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/BN_rand.3 +=================================================================== +--- secure/lib/libcrypto/man/BN_rand.3 (revision 273303) ++++ secure/lib/libcrypto/man/BN_rand.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "BN_rand 3" +-.TH BN_rand 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH BN_rand 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/BN_set_bit.3 +=================================================================== +--- secure/lib/libcrypto/man/BN_set_bit.3 (revision 273303) ++++ secure/lib/libcrypto/man/BN_set_bit.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "BN_set_bit 3" +-.TH BN_set_bit 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH BN_set_bit 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/BN_swap.3 +=================================================================== +--- secure/lib/libcrypto/man/BN_swap.3 (revision 273303) ++++ secure/lib/libcrypto/man/BN_swap.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "BN_swap 3" +-.TH BN_swap 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH BN_swap 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/BN_zero.3 +=================================================================== +--- secure/lib/libcrypto/man/BN_zero.3 (revision 273303) ++++ secure/lib/libcrypto/man/BN_zero.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "BN_zero 3" +-.TH BN_zero 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH BN_zero 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/CMS_add0_cert.3 +=================================================================== +--- secure/lib/libcrypto/man/CMS_add0_cert.3 (revision 273303) ++++ secure/lib/libcrypto/man/CMS_add0_cert.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "CMS_add0_cert 3" +-.TH CMS_add0_cert 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH CMS_add0_cert 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/CMS_add1_recipient_cert.3 +=================================================================== +--- secure/lib/libcrypto/man/CMS_add1_recipient_cert.3 (revision 273303) ++++ secure/lib/libcrypto/man/CMS_add1_recipient_cert.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "CMS_add1_recipient_cert 3" +-.TH CMS_add1_recipient_cert 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH CMS_add1_recipient_cert 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/CMS_add1_signer.3 +=================================================================== +--- secure/lib/libcrypto/man/CMS_add1_signer.3 (revision 0) ++++ secure/lib/libcrypto/man/CMS_add1_signer.3 (working copy) +@@ -0,0 +1,224 @@ ++.\" Automatically generated by Pod::Man 2.25 (Pod::Simple 3.28) ++.\" ++.\" Standard preamble: ++.\" ======================================================================== ++.de Sp \" Vertical space (when we can't use .PP) ++.if t .sp .5v ++.if n .sp ++.. ++.de Vb \" Begin verbatim text ++.ft CW ++.nf ++.ne \\$1 ++.. ++.de Ve \" End verbatim text ++.ft R ++.fi ++.. ++.\" Set up some character translations and predefined strings. \*(-- will ++.\" give an unbreakable dash, \*(PI will give pi, \*(L" will give a left ++.\" double quote, and \*(R" will give a right double quote. \*(C+ will ++.\" give a nicer C++. Capital omega is used to do unbreakable dashes and ++.\" therefore won't be available. \*(C` and \*(C' expand to `' in nroff, ++.\" nothing in troff, for use with C<>. ++.tr \(*W- ++.ds C+ C\v'-.1v'\h'-1p'\s-2+\h'-1p'+\s0\v'.1v'\h'-1p' ++.ie n \{\ ++. ds -- \(*W- ++. ds PI pi ++. if (\n(.H=4u)&(1m=24u) .ds -- \(*W\h'-12u'\(*W\h'-12u'-\" diablo 10 pitch ++. if (\n(.H=4u)&(1m=20u) .ds -- \(*W\h'-12u'\(*W\h'-8u'-\" diablo 12 pitch ++. ds L" "" ++. ds R" "" ++. ds C` "" ++. ds C' "" ++'br\} ++.el\{\ ++. ds -- \|\(em\| ++. ds PI \(*p ++. ds L" `` ++. ds R" '' ++'br\} ++.\" ++.\" Escape single quotes in literal strings from groff's Unicode transform. ++.ie \n(.g .ds Aq \(aq ++.el .ds Aq ' ++.\" ++.\" If the F register is turned on, we'll generate index entries on stderr for ++.\" titles (.TH), headers (.SH), subsections (.SS), items (.Ip), and index ++.\" entries marked with X<> in POD. Of course, you'll have to process the ++.\" output yourself in some meaningful fashion. ++.ie \nF \{\ ++. de IX ++. tm Index:\\$1\t\\n%\t"\\$2" ++.. ++. nr % 0 ++. rr F ++.\} ++.el \{\ ++. de IX ++.. ++.\} ++.\" ++.\" Accent mark definitions (@(#)ms.acc 1.5 88/02/08 SMI; from UCB 4.2). ++.\" Fear. Run. Save yourself. No user-serviceable parts. ++. \" fudge factors for nroff and troff ++.if n \{\ ++. ds #H 0 ++. ds #V .8m ++. ds #F .3m ++. ds #[ \f1 ++. ds #] \fP ++.\} ++.if t \{\ ++. ds #H ((1u-(\\\\n(.fu%2u))*.13m) ++. ds #V .6m ++. ds #F 0 ++. ds #[ \& ++. ds #] \& ++.\} ++. \" simple accents for nroff and troff ++.if n \{\ ++. ds ' \& ++. ds ` \& ++. ds ^ \& ++. ds , \& ++. ds ~ ~ ++. ds / ++.\} ++.if t \{\ ++. ds ' \\k:\h'-(\\n(.wu*8/10-\*(#H)'\'\h"|\\n:u" ++. ds ` \\k:\h'-(\\n(.wu*8/10-\*(#H)'\`\h'|\\n:u' ++. ds ^ \\k:\h'-(\\n(.wu*10/11-\*(#H)'^\h'|\\n:u' ++. ds , \\k:\h'-(\\n(.wu*8/10)',\h'|\\n:u' ++. ds ~ \\k:\h'-(\\n(.wu-\*(#H-.1m)'~\h'|\\n:u' ++. ds / \\k:\h'-(\\n(.wu*8/10-\*(#H)'\z\(sl\h'|\\n:u' ++.\} ++. \" troff and (daisy-wheel) nroff accents ++.ds : \\k:\h'-(\\n(.wu*8/10-\*(#H+.1m+\*(#F)'\v'-\*(#V'\z.\h'.2m+\*(#F'.\h'|\\n:u'\v'\*(#V' ++.ds 8 \h'\*(#H'\(*b\h'-\*(#H' ++.ds o \\k:\h'-(\\n(.wu+\w'\(de'u-\*(#H)/2u'\v'-.3n'\*(#[\z\(de\v'.3n'\h'|\\n:u'\*(#] ++.ds d- \h'\*(#H'\(pd\h'-\w'~'u'\v'-.25m'\f2\(hy\fP\v'.25m'\h'-\*(#H' ++.ds D- D\\k:\h'-\w'D'u'\v'-.11m'\z\(hy\v'.11m'\h'|\\n:u' ++.ds th \*(#[\v'.3m'\s+1I\s-1\v'-.3m'\h'-(\w'I'u*2/3)'\s-1o\s+1\*(#] ++.ds Th \*(#[\s+2I\s-2\h'-\w'I'u*3/5'\v'-.3m'o\v'.3m'\*(#] ++.ds ae a\h'-(\w'a'u*4/10)'e ++.ds Ae A\h'-(\w'A'u*4/10)'E ++. \" corrections for vroff ++.if v .ds ~ \\k:\h'-(\\n(.wu*9/10-\*(#H)'\s-2\u~\d\s+2\h'|\\n:u' ++.if v .ds ^ \\k:\h'-(\\n(.wu*10/11-\*(#H)'\v'-.4m'^\v'.4m'\h'|\\n:u' ++. \" for low resolution devices (crt and lpr) ++.if \n(.H>23 .if \n(.V>19 \ ++\{\ ++. ds : e ++. ds 8 ss ++. ds o a ++. ds d- d\h'-1'\(ga ++. ds D- D\h'-1'\(hy ++. ds th \o'bp' ++. ds Th \o'LP' ++. ds ae ae ++. ds Ae AE ++.\} ++.rm #[ #] #H #V #F C ++.\" ======================================================================== ++.\" ++.IX Title "CMS_add1_signer 3" ++.TH CMS_add1_signer 3 "2014-10-15" "1.0.1j" "OpenSSL" ++.\" For nroff, turn off justification. Always turn off hyphenation; it makes ++.\" way too many mistakes in technical documents. ++.if n .ad l ++.nh ++.SH "NAME" ++.Vb 1 ++\& CMS_add1_signer, CMS_SignerInfo_sign \- add a signer to a CMS_ContentInfo signed data structure. ++.Ve ++.SH "SYNOPSIS" ++.IX Header "SYNOPSIS" ++.Vb 1 ++\& #include ++\& ++\& CMS_SignerInfo *CMS_add1_signer(CMS_ContentInfo *cms, X509 *signcert, EVP_PKEY *pkey, const EVP_MD *md, unsigned int flags); ++\& ++\& int CMS_SignerInfo_sign(CMS_SignerInfo *si); ++.Ve ++.SH "DESCRIPTION" ++.IX Header "DESCRIPTION" ++\&\fICMS_add1_signer()\fR adds a signer with certificate \fBsigncert\fR and private ++key \fBpkey\fR using message digest \fBmd\fR to CMS_ContentInfo SignedData ++structure \fBcms\fR. ++.PP ++The CMS_ContentInfo structure should be obtained from an initial call to ++\&\fICMS_sign()\fR with the flag \fB\s-1CMS_PARTIAL\s0\fR set or in the case or re-signing a ++valid CMS_ContentInfo SignedData structure. ++.PP ++If the \fBmd\fR parameter is \fB\s-1NULL\s0\fR then the default digest for the public ++key algorithm will be used. ++.PP ++Unless the \fB\s-1CMS_REUSE_DIGEST\s0\fR flag is set the returned CMS_ContentInfo ++structure is not complete and must be finalized either by streaming (if ++applicable) or a call to \fICMS_final()\fR. ++.PP ++The \fICMS_SignerInfo_sign()\fR function will explicitly sign a CMS_SignerInfo ++structure, its main use is when \fB\s-1CMS_REUSE_DIGEST\s0\fR and \fB\s-1CMS_PARTIAL\s0\fR flags ++are both set. ++.SH "NOTES" ++.IX Header "NOTES" ++The main purpose of \fICMS_add1_signer()\fR is to provide finer control ++over a \s-1CMS\s0 signed data structure where the simpler \fICMS_sign()\fR function defaults ++are not appropriate. For example if multiple signers or non default digest ++algorithms are needed. New attributes can also be added using the returned ++CMS_SignerInfo structure and the \s-1CMS\s0 attribute utility functions or the ++\&\s-1CMS\s0 signed receipt request functions. ++.PP ++Any of the following flags (ored together) can be passed in the \fBflags\fR ++parameter. ++.PP ++If \fB\s-1CMS_REUSE_DIGEST\s0\fR is set then an attempt is made to copy the content ++digest value from the CMS_ContentInfo structure: to add a signer to an existing ++structure. An error occurs if a matching digest value cannot be found to copy. ++The returned CMS_ContentInfo structure will be valid and finalized when this ++flag is set. ++.PP ++If \fB\s-1CMS_PARTIAL\s0\fR is set in addition to \fB\s-1CMS_REUSE_DIGEST\s0\fR then the ++CMS_SignerInfo structure will not be finalized so additional attributes ++can be added. In this case an explicit call to \fICMS_SignerInfo_sign()\fR is ++needed to finalize it. ++.PP ++If \fB\s-1CMS_NOCERTS\s0\fR is set the signer's certificate will not be included in the ++CMS_ContentInfo structure, the signer's certificate must still be supplied in ++the \fBsigncert\fR parameter though. This can reduce the size of the signature if ++the signers certificate can be obtained by other means: for example a ++previously signed message. ++.PP ++The SignedData structure includes several \s-1CMS\s0 signedAttributes including the ++signing time, the \s-1CMS\s0 content type and the supported list of ciphers in an ++SMIMECapabilities attribute. If \fB\s-1CMS_NOATTR\s0\fR is set then no signedAttributes ++will be used. If \fB\s-1CMS_NOSMIMECAP\s0\fR is set then just the SMIMECapabilities are ++omitted. ++.PP ++OpenSSL will by default identify signing certificates using issuer name ++and serial number. If \fB\s-1CMS_USE_KEYID\s0\fR is set it will use the subject key ++identifier value instead. An error occurs if the signing certificate does not ++have a subject key identifier extension. ++.PP ++If present the SMIMECapabilities attribute indicates support for the following ++algorithms in preference order: 256 bit \s-1AES\s0, Gost R3411\-94, Gost 28147\-89, 192 ++bit \s-1AES\s0, 128 bit \s-1AES\s0, triple \s-1DES\s0, 128 bit \s-1RC2\s0, 64 bit \s-1RC2\s0, \s-1DES\s0 and 40 bit \s-1RC2\s0. ++If any of these algorithms is not available then it will not be included: for example the \s-1GOST\s0 algorithms will not be included if the \s-1GOST\s0 \s-1ENGINE\s0 is ++not loaded. ++.PP ++\&\fICMS_add1_signer()\fR returns an internal pointer to the CMS_SignerInfo ++structure just added, this can be used to set additional attributes ++before it is finalized. ++.SH "RETURN VALUES" ++.IX Header "RETURN VALUES" ++\&\fICMS_add1_signer()\fR returns an internal pointer to the CMS_SignerInfo ++structure just added or \s-1NULL\s0 if an error occurs. ++.SH "SEE ALSO" ++.IX Header "SEE ALSO" ++\&\fIERR_get_error\fR\|(3), \fICMS_sign\fR\|(3), ++\&\fICMS_final\fR\|(3), ++.SH "HISTORY" ++.IX Header "HISTORY" ++\&\fICMS_add1_signer()\fR was added to OpenSSL 0.9.8 + +Property changes on: secure/lib/libcrypto/man/CMS_add1_signer.3 +___________________________________________________________________ +Added: svn:eol-style +## -0,0 +1 ## ++native +\ No newline at end of property +Added: svn:mime-type +## -0,0 +1 ## ++text/plain +\ No newline at end of property +Added: svn:keywords +## -0,0 +1 ## ++FreeBSD=%H +\ No newline at end of property +Index: secure/lib/libcrypto/man/CMS_compress.3 +=================================================================== +--- secure/lib/libcrypto/man/CMS_compress.3 (revision 273303) ++++ secure/lib/libcrypto/man/CMS_compress.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "CMS_compress 3" +-.TH CMS_compress 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH CMS_compress 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/CMS_decrypt.3 +=================================================================== +--- secure/lib/libcrypto/man/CMS_decrypt.3 (revision 273303) ++++ secure/lib/libcrypto/man/CMS_decrypt.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "CMS_decrypt 3" +-.TH CMS_decrypt 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH CMS_decrypt 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/CMS_encrypt.3 +=================================================================== +--- secure/lib/libcrypto/man/CMS_encrypt.3 (revision 273303) ++++ secure/lib/libcrypto/man/CMS_encrypt.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "CMS_encrypt 3" +-.TH CMS_encrypt 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH CMS_encrypt 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/CMS_final.3 +=================================================================== +--- secure/lib/libcrypto/man/CMS_final.3 (revision 273303) ++++ secure/lib/libcrypto/man/CMS_final.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "CMS_final 3" +-.TH CMS_final 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH CMS_final 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/CMS_get0_RecipientInfos.3 +=================================================================== +--- secure/lib/libcrypto/man/CMS_get0_RecipientInfos.3 (revision 273303) ++++ secure/lib/libcrypto/man/CMS_get0_RecipientInfos.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "CMS_get0_RecipientInfos 3" +-.TH CMS_get0_RecipientInfos 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH CMS_get0_RecipientInfos 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/CMS_get0_SignerInfos.3 +=================================================================== +--- secure/lib/libcrypto/man/CMS_get0_SignerInfos.3 (revision 273303) ++++ secure/lib/libcrypto/man/CMS_get0_SignerInfos.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "CMS_get0_SignerInfos 3" +-.TH CMS_get0_SignerInfos 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH CMS_get0_SignerInfos 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/CMS_get0_type.3 +=================================================================== +--- secure/lib/libcrypto/man/CMS_get0_type.3 (revision 273303) ++++ secure/lib/libcrypto/man/CMS_get0_type.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "CMS_get0_type 3" +-.TH CMS_get0_type 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH CMS_get0_type 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/CMS_get1_ReceiptRequest.3 +=================================================================== +--- secure/lib/libcrypto/man/CMS_get1_ReceiptRequest.3 (revision 273303) ++++ secure/lib/libcrypto/man/CMS_get1_ReceiptRequest.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "CMS_get1_ReceiptRequest 3" +-.TH CMS_get1_ReceiptRequest 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH CMS_get1_ReceiptRequest 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/CMS_sign.3 +=================================================================== +--- secure/lib/libcrypto/man/CMS_sign.3 (revision 273303) ++++ secure/lib/libcrypto/man/CMS_sign.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "CMS_sign 3" +-.TH CMS_sign 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH CMS_sign 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/CMS_sign_add1_signer.3 +=================================================================== +--- secure/lib/libcrypto/man/CMS_sign_add1_signer.3 (revision 273303) ++++ secure/lib/libcrypto/man/CMS_sign_add1_signer.3 (working copy) +@@ -1,224 +0,0 @@ +-.\" Automatically generated by Pod::Man 2.25 (Pod::Simple 3.28) +-.\" +-.\" Standard preamble: +-.\" ======================================================================== +-.de Sp \" Vertical space (when we can't use .PP) +-.if t .sp .5v +-.if n .sp +-.. +-.de Vb \" Begin verbatim text +-.ft CW +-.nf +-.ne \\$1 +-.. +-.de Ve \" End verbatim text +-.ft R +-.fi +-.. +-.\" Set up some character translations and predefined strings. \*(-- will +-.\" give an unbreakable dash, \*(PI will give pi, \*(L" will give a left +-.\" double quote, and \*(R" will give a right double quote. \*(C+ will +-.\" give a nicer C++. Capital omega is used to do unbreakable dashes and +-.\" therefore won't be available. \*(C` and \*(C' expand to `' in nroff, +-.\" nothing in troff, for use with C<>. +-.tr \(*W- +-.ds C+ C\v'-.1v'\h'-1p'\s-2+\h'-1p'+\s0\v'.1v'\h'-1p' +-.ie n \{\ +-. ds -- \(*W- +-. ds PI pi +-. if (\n(.H=4u)&(1m=24u) .ds -- \(*W\h'-12u'\(*W\h'-12u'-\" diablo 10 pitch +-. if (\n(.H=4u)&(1m=20u) .ds -- \(*W\h'-12u'\(*W\h'-8u'-\" diablo 12 pitch +-. ds L" "" +-. ds R" "" +-. ds C` "" +-. ds C' "" +-'br\} +-.el\{\ +-. ds -- \|\(em\| +-. ds PI \(*p +-. ds L" `` +-. ds R" '' +-'br\} +-.\" +-.\" Escape single quotes in literal strings from groff's Unicode transform. +-.ie \n(.g .ds Aq \(aq +-.el .ds Aq ' +-.\" +-.\" If the F register is turned on, we'll generate index entries on stderr for +-.\" titles (.TH), headers (.SH), subsections (.SS), items (.Ip), and index +-.\" entries marked with X<> in POD. Of course, you'll have to process the +-.\" output yourself in some meaningful fashion. +-.ie \nF \{\ +-. de IX +-. tm Index:\\$1\t\\n%\t"\\$2" +-.. +-. nr % 0 +-. rr F +-.\} +-.el \{\ +-. de IX +-.. +-.\} +-.\" +-.\" Accent mark definitions (@(#)ms.acc 1.5 88/02/08 SMI; from UCB 4.2). +-.\" Fear. Run. Save yourself. No user-serviceable parts. +-. \" fudge factors for nroff and troff +-.if n \{\ +-. ds #H 0 +-. ds #V .8m +-. ds #F .3m +-. ds #[ \f1 +-. ds #] \fP +-.\} +-.if t \{\ +-. ds #H ((1u-(\\\\n(.fu%2u))*.13m) +-. ds #V .6m +-. ds #F 0 +-. ds #[ \& +-. ds #] \& +-.\} +-. \" simple accents for nroff and troff +-.if n \{\ +-. ds ' \& +-. ds ` \& +-. ds ^ \& +-. ds , \& +-. ds ~ ~ +-. ds / +-.\} +-.if t \{\ +-. ds ' \\k:\h'-(\\n(.wu*8/10-\*(#H)'\'\h"|\\n:u" +-. ds ` \\k:\h'-(\\n(.wu*8/10-\*(#H)'\`\h'|\\n:u' +-. ds ^ \\k:\h'-(\\n(.wu*10/11-\*(#H)'^\h'|\\n:u' +-. ds , \\k:\h'-(\\n(.wu*8/10)',\h'|\\n:u' +-. ds ~ \\k:\h'-(\\n(.wu-\*(#H-.1m)'~\h'|\\n:u' +-. ds / \\k:\h'-(\\n(.wu*8/10-\*(#H)'\z\(sl\h'|\\n:u' +-.\} +-. \" troff and (daisy-wheel) nroff accents +-.ds : \\k:\h'-(\\n(.wu*8/10-\*(#H+.1m+\*(#F)'\v'-\*(#V'\z.\h'.2m+\*(#F'.\h'|\\n:u'\v'\*(#V' +-.ds 8 \h'\*(#H'\(*b\h'-\*(#H' +-.ds o \\k:\h'-(\\n(.wu+\w'\(de'u-\*(#H)/2u'\v'-.3n'\*(#[\z\(de\v'.3n'\h'|\\n:u'\*(#] +-.ds d- \h'\*(#H'\(pd\h'-\w'~'u'\v'-.25m'\f2\(hy\fP\v'.25m'\h'-\*(#H' +-.ds D- D\\k:\h'-\w'D'u'\v'-.11m'\z\(hy\v'.11m'\h'|\\n:u' +-.ds th \*(#[\v'.3m'\s+1I\s-1\v'-.3m'\h'-(\w'I'u*2/3)'\s-1o\s+1\*(#] +-.ds Th \*(#[\s+2I\s-2\h'-\w'I'u*3/5'\v'-.3m'o\v'.3m'\*(#] +-.ds ae a\h'-(\w'a'u*4/10)'e +-.ds Ae A\h'-(\w'A'u*4/10)'E +-. \" corrections for vroff +-.if v .ds ~ \\k:\h'-(\\n(.wu*9/10-\*(#H)'\s-2\u~\d\s+2\h'|\\n:u' +-.if v .ds ^ \\k:\h'-(\\n(.wu*10/11-\*(#H)'\v'-.4m'^\v'.4m'\h'|\\n:u' +-. \" for low resolution devices (crt and lpr) +-.if \n(.H>23 .if \n(.V>19 \ +-\{\ +-. ds : e +-. ds 8 ss +-. ds o a +-. ds d- d\h'-1'\(ga +-. ds D- D\h'-1'\(hy +-. ds th \o'bp' +-. ds Th \o'LP' +-. ds ae ae +-. ds Ae AE +-.\} +-.rm #[ #] #H #V #F C +-.\" ======================================================================== +-.\" +-.IX Title "CMS_sign_add1_signer 3" +-.TH CMS_sign_add1_signer 3 "2014-08-06" "1.0.1i" "OpenSSL" +-.\" For nroff, turn off justification. Always turn off hyphenation; it makes +-.\" way too many mistakes in technical documents. +-.if n .ad l +-.nh +-.SH "NAME" +-.Vb 1 +-\& CMS_sign_add1_signer, CMS_SignerInfo_sign \- add a signer to a CMS_ContentInfo signed data structure. +-.Ve +-.SH "SYNOPSIS" +-.IX Header "SYNOPSIS" +-.Vb 1 +-\& #include +-\& +-\& CMS_SignerInfo *CMS_sign_add1_signer(CMS_ContentInfo *cms, X509 *signcert, EVP_PKEY *pkey, const EVP_MD *md, unsigned int flags); +-\& +-\& int CMS_SignerInfo_sign(CMS_SignerInfo *si); +-.Ve +-.SH "DESCRIPTION" +-.IX Header "DESCRIPTION" +-\&\fICMS_sign_add1_signer()\fR adds a signer with certificate \fBsigncert\fR and private +-key \fBpkey\fR using message digest \fBmd\fR to CMS_ContentInfo SignedData +-structure \fBcms\fR. +-.PP +-The CMS_ContentInfo structure should be obtained from an initial call to +-\&\fICMS_sign()\fR with the flag \fB\s-1CMS_PARTIAL\s0\fR set or in the case or re-signing a +-valid CMS_ContentInfo SignedData structure. +-.PP +-If the \fBmd\fR parameter is \fB\s-1NULL\s0\fR then the default digest for the public +-key algorithm will be used. +-.PP +-Unless the \fB\s-1CMS_REUSE_DIGEST\s0\fR flag is set the returned CMS_ContentInfo +-structure is not complete and must be finalized either by streaming (if +-applicable) or a call to \fICMS_final()\fR. +-.PP +-The \fICMS_SignerInfo_sign()\fR function will explicitly sign a CMS_SignerInfo +-structure, its main use is when \fB\s-1CMS_REUSE_DIGEST\s0\fR and \fB\s-1CMS_PARTIAL\s0\fR flags +-are both set. +-.SH "NOTES" +-.IX Header "NOTES" +-The main purpose of \fICMS_sign_add1_signer()\fR is to provide finer control +-over a \s-1CMS\s0 signed data structure where the simpler \fICMS_sign()\fR function defaults +-are not appropriate. For example if multiple signers or non default digest +-algorithms are needed. New attributes can also be added using the returned +-CMS_SignerInfo structure and the \s-1CMS\s0 attribute utility functions or the +-\&\s-1CMS\s0 signed receipt request functions. +-.PP +-Any of the following flags (ored together) can be passed in the \fBflags\fR +-parameter. +-.PP +-If \fB\s-1CMS_REUSE_DIGEST\s0\fR is set then an attempt is made to copy the content +-digest value from the CMS_ContentInfo structure: to add a signer to an existing +-structure. An error occurs if a matching digest value cannot be found to copy. +-The returned CMS_ContentInfo structure will be valid and finalized when this +-flag is set. +-.PP +-If \fB\s-1CMS_PARTIAL\s0\fR is set in addition to \fB\s-1CMS_REUSE_DIGEST\s0\fR then the +-CMS_SignerInfo structure will not be finalized so additional attributes +-can be added. In this case an explicit call to \fICMS_SignerInfo_sign()\fR is +-needed to finalize it. +-.PP +-If \fB\s-1CMS_NOCERTS\s0\fR is set the signer's certificate will not be included in the +-CMS_ContentInfo structure, the signer's certificate must still be supplied in +-the \fBsigncert\fR parameter though. This can reduce the size of the signature if +-the signers certificate can be obtained by other means: for example a +-previously signed message. +-.PP +-The SignedData structure includes several \s-1CMS\s0 signedAttributes including the +-signing time, the \s-1CMS\s0 content type and the supported list of ciphers in an +-SMIMECapabilities attribute. If \fB\s-1CMS_NOATTR\s0\fR is set then no signedAttributes +-will be used. If \fB\s-1CMS_NOSMIMECAP\s0\fR is set then just the SMIMECapabilities are +-omitted. +-.PP +-OpenSSL will by default identify signing certificates using issuer name +-and serial number. If \fB\s-1CMS_USE_KEYID\s0\fR is set it will use the subject key +-identifier value instead. An error occurs if the signing certificate does not +-have a subject key identifier extension. +-.PP +-If present the SMIMECapabilities attribute indicates support for the following +-algorithms in preference order: 256 bit \s-1AES\s0, Gost R3411\-94, Gost 28147\-89, 192 +-bit \s-1AES\s0, 128 bit \s-1AES\s0, triple \s-1DES\s0, 128 bit \s-1RC2\s0, 64 bit \s-1RC2\s0, \s-1DES\s0 and 40 bit \s-1RC2\s0. +-If any of these algorithms is not available then it will not be included: for example the \s-1GOST\s0 algorithms will not be included if the \s-1GOST\s0 \s-1ENGINE\s0 is +-not loaded. +-.PP +-\&\fICMS_sign_add1_signer()\fR returns an internal pointer to the CMS_SignerInfo +-structure just added, this can be used to set additional attributes +-before it is finalized. +-.SH "RETURN VALUES" +-.IX Header "RETURN VALUES" +-\&\fICMS_sign1_add_signers()\fR returns an internal pointer to the CMS_SignerInfo +-structure just added or \s-1NULL\s0 if an error occurs. +-.SH "SEE ALSO" +-.IX Header "SEE ALSO" +-\&\fIERR_get_error\fR\|(3), \fICMS_sign\fR\|(3), +-\&\fICMS_final\fR\|(3), +-.SH "HISTORY" +-.IX Header "HISTORY" +-\&\fICMS_sign_add1_signer()\fR was added to OpenSSL 0.9.8 +Index: secure/lib/libcrypto/man/CMS_sign_receipt.3 +=================================================================== +--- secure/lib/libcrypto/man/CMS_sign_receipt.3 (revision 273303) ++++ secure/lib/libcrypto/man/CMS_sign_receipt.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "CMS_sign_receipt 3" +-.TH CMS_sign_receipt 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH CMS_sign_receipt 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/CMS_uncompress.3 +=================================================================== +--- secure/lib/libcrypto/man/CMS_uncompress.3 (revision 273303) ++++ secure/lib/libcrypto/man/CMS_uncompress.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "CMS_uncompress 3" +-.TH CMS_uncompress 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH CMS_uncompress 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/CMS_verify.3 +=================================================================== +--- secure/lib/libcrypto/man/CMS_verify.3 (revision 273303) ++++ secure/lib/libcrypto/man/CMS_verify.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "CMS_verify 3" +-.TH CMS_verify 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH CMS_verify 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/CMS_verify_receipt.3 +=================================================================== +--- secure/lib/libcrypto/man/CMS_verify_receipt.3 (revision 273303) ++++ secure/lib/libcrypto/man/CMS_verify_receipt.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "CMS_verify_receipt 3" +-.TH CMS_verify_receipt 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH CMS_verify_receipt 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/CONF_modules_free.3 +=================================================================== +--- secure/lib/libcrypto/man/CONF_modules_free.3 (revision 273303) ++++ secure/lib/libcrypto/man/CONF_modules_free.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "CONF_modules_free 3" +-.TH CONF_modules_free 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH CONF_modules_free 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/CONF_modules_load_file.3 +=================================================================== +--- secure/lib/libcrypto/man/CONF_modules_load_file.3 (revision 273303) ++++ secure/lib/libcrypto/man/CONF_modules_load_file.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "CONF_modules_load_file 3" +-.TH CONF_modules_load_file 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH CONF_modules_load_file 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/CRYPTO_set_ex_data.3 +=================================================================== +--- secure/lib/libcrypto/man/CRYPTO_set_ex_data.3 (revision 273303) ++++ secure/lib/libcrypto/man/CRYPTO_set_ex_data.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "CRYPTO_set_ex_data 3" +-.TH CRYPTO_set_ex_data 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH CRYPTO_set_ex_data 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/DH_generate_key.3 +=================================================================== +--- secure/lib/libcrypto/man/DH_generate_key.3 (revision 273303) ++++ secure/lib/libcrypto/man/DH_generate_key.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "DH_generate_key 3" +-.TH DH_generate_key 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH DH_generate_key 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/DH_generate_parameters.3 +=================================================================== +--- secure/lib/libcrypto/man/DH_generate_parameters.3 (revision 273303) ++++ secure/lib/libcrypto/man/DH_generate_parameters.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "DH_generate_parameters 3" +-.TH DH_generate_parameters 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH DH_generate_parameters 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/DH_get_ex_new_index.3 +=================================================================== +--- secure/lib/libcrypto/man/DH_get_ex_new_index.3 (revision 273303) ++++ secure/lib/libcrypto/man/DH_get_ex_new_index.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "DH_get_ex_new_index 3" +-.TH DH_get_ex_new_index 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH DH_get_ex_new_index 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/DH_new.3 +=================================================================== +--- secure/lib/libcrypto/man/DH_new.3 (revision 273303) ++++ secure/lib/libcrypto/man/DH_new.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "DH_new 3" +-.TH DH_new 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH DH_new 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/DH_set_method.3 +=================================================================== +--- secure/lib/libcrypto/man/DH_set_method.3 (revision 273303) ++++ secure/lib/libcrypto/man/DH_set_method.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "DH_set_method 3" +-.TH DH_set_method 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH DH_set_method 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/DH_size.3 +=================================================================== +--- secure/lib/libcrypto/man/DH_size.3 (revision 273303) ++++ secure/lib/libcrypto/man/DH_size.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "DH_size 3" +-.TH DH_size 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH DH_size 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/DSA_SIG_new.3 +=================================================================== +--- secure/lib/libcrypto/man/DSA_SIG_new.3 (revision 273303) ++++ secure/lib/libcrypto/man/DSA_SIG_new.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "DSA_SIG_new 3" +-.TH DSA_SIG_new 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH DSA_SIG_new 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/DSA_do_sign.3 +=================================================================== +--- secure/lib/libcrypto/man/DSA_do_sign.3 (revision 273303) ++++ secure/lib/libcrypto/man/DSA_do_sign.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "DSA_do_sign 3" +-.TH DSA_do_sign 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH DSA_do_sign 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/DSA_dup_DH.3 +=================================================================== +--- secure/lib/libcrypto/man/DSA_dup_DH.3 (revision 273303) ++++ secure/lib/libcrypto/man/DSA_dup_DH.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "DSA_dup_DH 3" +-.TH DSA_dup_DH 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH DSA_dup_DH 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/DSA_generate_key.3 +=================================================================== +--- secure/lib/libcrypto/man/DSA_generate_key.3 (revision 273303) ++++ secure/lib/libcrypto/man/DSA_generate_key.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "DSA_generate_key 3" +-.TH DSA_generate_key 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH DSA_generate_key 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/DSA_generate_parameters.3 +=================================================================== +--- secure/lib/libcrypto/man/DSA_generate_parameters.3 (revision 273303) ++++ secure/lib/libcrypto/man/DSA_generate_parameters.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "DSA_generate_parameters 3" +-.TH DSA_generate_parameters 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH DSA_generate_parameters 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/DSA_get_ex_new_index.3 +=================================================================== +--- secure/lib/libcrypto/man/DSA_get_ex_new_index.3 (revision 273303) ++++ secure/lib/libcrypto/man/DSA_get_ex_new_index.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "DSA_get_ex_new_index 3" +-.TH DSA_get_ex_new_index 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH DSA_get_ex_new_index 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/DSA_new.3 +=================================================================== +--- secure/lib/libcrypto/man/DSA_new.3 (revision 273303) ++++ secure/lib/libcrypto/man/DSA_new.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "DSA_new 3" +-.TH DSA_new 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH DSA_new 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/DSA_set_method.3 +=================================================================== +--- secure/lib/libcrypto/man/DSA_set_method.3 (revision 273303) ++++ secure/lib/libcrypto/man/DSA_set_method.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "DSA_set_method 3" +-.TH DSA_set_method 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH DSA_set_method 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/DSA_sign.3 +=================================================================== +--- secure/lib/libcrypto/man/DSA_sign.3 (revision 273303) ++++ secure/lib/libcrypto/man/DSA_sign.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "DSA_sign 3" +-.TH DSA_sign 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH DSA_sign 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/DSA_size.3 +=================================================================== +--- secure/lib/libcrypto/man/DSA_size.3 (revision 273303) ++++ secure/lib/libcrypto/man/DSA_size.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "DSA_size 3" +-.TH DSA_size 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH DSA_size 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/ERR_GET_LIB.3 +=================================================================== +--- secure/lib/libcrypto/man/ERR_GET_LIB.3 (revision 273303) ++++ secure/lib/libcrypto/man/ERR_GET_LIB.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "ERR_GET_LIB 3" +-.TH ERR_GET_LIB 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH ERR_GET_LIB 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/ERR_clear_error.3 +=================================================================== +--- secure/lib/libcrypto/man/ERR_clear_error.3 (revision 273303) ++++ secure/lib/libcrypto/man/ERR_clear_error.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "ERR_clear_error 3" +-.TH ERR_clear_error 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH ERR_clear_error 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/ERR_error_string.3 +=================================================================== +--- secure/lib/libcrypto/man/ERR_error_string.3 (revision 273303) ++++ secure/lib/libcrypto/man/ERR_error_string.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "ERR_error_string 3" +-.TH ERR_error_string 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH ERR_error_string 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/ERR_get_error.3 +=================================================================== +--- secure/lib/libcrypto/man/ERR_get_error.3 (revision 273303) ++++ secure/lib/libcrypto/man/ERR_get_error.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "ERR_get_error 3" +-.TH ERR_get_error 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH ERR_get_error 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/ERR_load_crypto_strings.3 +=================================================================== +--- secure/lib/libcrypto/man/ERR_load_crypto_strings.3 (revision 273303) ++++ secure/lib/libcrypto/man/ERR_load_crypto_strings.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "ERR_load_crypto_strings 3" +-.TH ERR_load_crypto_strings 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH ERR_load_crypto_strings 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/ERR_load_strings.3 +=================================================================== +--- secure/lib/libcrypto/man/ERR_load_strings.3 (revision 273303) ++++ secure/lib/libcrypto/man/ERR_load_strings.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "ERR_load_strings 3" +-.TH ERR_load_strings 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH ERR_load_strings 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/ERR_print_errors.3 +=================================================================== +--- secure/lib/libcrypto/man/ERR_print_errors.3 (revision 273303) ++++ secure/lib/libcrypto/man/ERR_print_errors.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "ERR_print_errors 3" +-.TH ERR_print_errors 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH ERR_print_errors 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/ERR_put_error.3 +=================================================================== +--- secure/lib/libcrypto/man/ERR_put_error.3 (revision 273303) ++++ secure/lib/libcrypto/man/ERR_put_error.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "ERR_put_error 3" +-.TH ERR_put_error 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH ERR_put_error 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/ERR_remove_state.3 +=================================================================== +--- secure/lib/libcrypto/man/ERR_remove_state.3 (revision 273303) ++++ secure/lib/libcrypto/man/ERR_remove_state.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "ERR_remove_state 3" +-.TH ERR_remove_state 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH ERR_remove_state 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/ERR_set_mark.3 +=================================================================== +--- secure/lib/libcrypto/man/ERR_set_mark.3 (revision 273303) ++++ secure/lib/libcrypto/man/ERR_set_mark.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "ERR_set_mark 3" +-.TH ERR_set_mark 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH ERR_set_mark 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/EVP_BytesToKey.3 +=================================================================== +--- secure/lib/libcrypto/man/EVP_BytesToKey.3 (revision 273303) ++++ secure/lib/libcrypto/man/EVP_BytesToKey.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "EVP_BytesToKey 3" +-.TH EVP_BytesToKey 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH EVP_BytesToKey 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/EVP_DigestInit.3 +=================================================================== +--- secure/lib/libcrypto/man/EVP_DigestInit.3 (revision 273303) ++++ secure/lib/libcrypto/man/EVP_DigestInit.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "EVP_DigestInit 3" +-.TH EVP_DigestInit 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH EVP_DigestInit 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +@@ -154,13 +154,13 @@ EVP digest routines + \& int EVP_MD_CTX_cleanup(EVP_MD_CTX *ctx); + \& void EVP_MD_CTX_destroy(EVP_MD_CTX *ctx); + \& +-\& int EVP_MD_CTX_copy_ex(EVP_MD_CTX *out,const EVP_MD_CTX *in); ++\& int EVP_MD_CTX_copy_ex(EVP_MD_CTX *out,const EVP_MD_CTX *in); + \& + \& int EVP_DigestInit(EVP_MD_CTX *ctx, const EVP_MD *type); + \& int EVP_DigestFinal(EVP_MD_CTX *ctx, unsigned char *md, + \& unsigned int *s); + \& +-\& int EVP_MD_CTX_copy(EVP_MD_CTX *out,EVP_MD_CTX *in); ++\& int EVP_MD_CTX_copy(EVP_MD_CTX *out,EVP_MD_CTX *in); + \& + \& #define EVP_MAX_MD_SIZE 64 /* SHA512 */ + \& +@@ -267,7 +267,7 @@ structures for the \s-1MD2\s0, \s-1MD5\s0, \s-1SHA + and \s-1RIPEMD160\s0 digest algorithms respectively. + .PP + \&\fIEVP_dss()\fR and \fIEVP_dss1()\fR return \fB\s-1EVP_MD\s0\fR structures for \s-1SHA\s0 and \s-1SHA1\s0 digest +-algorithms but using \s-1DSS\s0 (\s-1DSA\s0) for the signature algorithm. Note: there is ++algorithms but using \s-1DSS\s0 (\s-1DSA\s0) for the signature algorithm. Note: there is + no need to use these pseudo-digests in OpenSSL 1.0.0 and later, they are + however retained for compatibility. + .PP +@@ -303,15 +303,15 @@ The \fB\s-1EVP\s0\fR interface to message digests + preference to the low level interfaces. This is because the code then becomes + transparent to the digest used and much more flexible. + .PP +-New applications should use the \s-1SHA2\s0 digest algorithms such as \s-1SHA256\s0. ++New applications should use the \s-1SHA2\s0 digest algorithms such as \s-1SHA256\s0. + The other digest algorithms are still in common use. + .PP + For most applications the \fBimpl\fR parameter to \fIEVP_DigestInit_ex()\fR will be + set to \s-1NULL\s0 to use the default digest implementation. + .PP +-The functions \fIEVP_DigestInit()\fR, \fIEVP_DigestFinal()\fR and \fIEVP_MD_CTX_copy()\fR are ++The functions \fIEVP_DigestInit()\fR, \fIEVP_DigestFinal()\fR and \fIEVP_MD_CTX_copy()\fR are + obsolete but are retained to maintain compatibility with existing code. New +-applications should use \fIEVP_DigestInit_ex()\fR, \fIEVP_DigestFinal_ex()\fR and ++applications should use \fIEVP_DigestInit_ex()\fR, \fIEVP_DigestFinal_ex()\fR and + \&\fIEVP_MD_CTX_copy_ex()\fR because they can efficiently reuse a digest context + instead of initializing and cleaning it up on each call and allow non default + implementations of digests to be specified. +@@ -374,15 +374,19 @@ digest name passed on the command line. + \& EVP_MD_CTX_destroy(mdctx); + \& + \& printf("Digest is: "); +-\& for(i = 0; i < md_len; i++) printf("%02x", md_value[i]); ++\& for(i = 0; i < md_len; i++) ++\& printf("%02x", md_value[i]); + \& printf("\en"); ++\& ++\& /* Call this once before exit. */ ++\& EVP_cleanup(); ++\& exit(0); + \& } + .Ve + .SH "SEE ALSO" + .IX Header "SEE ALSO" +-\&\fIevp\fR\|(3), \fIhmac\fR\|(3), \fImd2\fR\|(3), +-\&\fImd5\fR\|(3), \fImdc2\fR\|(3), \fIripemd\fR\|(3), +-\&\fIsha\fR\|(3), \fIdgst\fR\|(1) ++\&\fIdgst\fR\|(1), ++\&\fIevp\fR\|(3) + .SH "HISTORY" + .IX Header "HISTORY" + \&\fIEVP_DigestInit()\fR, \fIEVP_DigestUpdate()\fR and \fIEVP_DigestFinal()\fR are +@@ -397,7 +401,7 @@ and \fIEVP_DigestFinal_ex()\fR were added in OpenS + changed to return truely const \s-1EVP_MD\s0 * in OpenSSL 0.9.7. + .PP + The link between digests and signing algorithms was fixed in OpenSSL 1.0 and +-later, so now \fIEVP_sha1()\fR can be used with \s-1RSA\s0 and \s-1DSA\s0, there is no need to ++later, so now \fIEVP_sha1()\fR can be used with \s-1RSA\s0 and \s-1DSA\s0; there is no need to + use \fIEVP_dss1()\fR any more. + .PP + OpenSSL 1.0 and later does not include the \s-1MD2\s0 digest algorithm in the +Index: secure/lib/libcrypto/man/EVP_DigestSignInit.3 +=================================================================== +--- secure/lib/libcrypto/man/EVP_DigestSignInit.3 (revision 273303) ++++ secure/lib/libcrypto/man/EVP_DigestSignInit.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "EVP_DigestSignInit 3" +-.TH EVP_DigestSignInit 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH EVP_DigestSignInit 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/EVP_DigestVerifyInit.3 +=================================================================== +--- secure/lib/libcrypto/man/EVP_DigestVerifyInit.3 (revision 273303) ++++ secure/lib/libcrypto/man/EVP_DigestVerifyInit.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "EVP_DigestVerifyInit 3" +-.TH EVP_DigestVerifyInit 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH EVP_DigestVerifyInit 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +@@ -165,7 +165,7 @@ or a negative value for failure. In particular a r + the operation is not supported by the public key algorithm. + .PP + Unlike other functions the return value 0 from \fIEVP_DigestVerifyFinal()\fR only +-indicates that the signature did not not verify successfully (that is tbs did ++indicates that the signature did not verify successfully (that is tbs did + not match the original data or the signature was of invalid form) it is not an + indication of a more serious error. + .PP +@@ -185,7 +185,7 @@ For some key types and parameters the random numbe + or the operation will fail. + .PP + The call to \fIEVP_DigestVerifyFinal()\fR internally finalizes a copy of the digest +-context. This means that calls to \fIEVP_VerifyUpdate()\fR and \fIEVP_VerifyFinal()\fR can ++context. This means that \fIEVP_VerifyUpdate()\fR and \fIEVP_VerifyFinal()\fR can + be called later to digest and verify additional data. + .PP + Since only a copy of the digest context is ever finalized the context must +Index: secure/lib/libcrypto/man/EVP_EncryptInit.3 +=================================================================== +--- secure/lib/libcrypto/man/EVP_EncryptInit.3 (revision 273303) ++++ secure/lib/libcrypto/man/EVP_EncryptInit.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "EVP_EncryptInit 3" +-.TH EVP_EncryptInit 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH EVP_EncryptInit 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +@@ -493,37 +493,9 @@ The \s-1ASN1\s0 code is incomplete (and sometimes + for certain common S/MIME ciphers (\s-1RC2\s0, \s-1DES\s0, triple \s-1DES\s0) in \s-1CBC\s0 mode. + .SH "EXAMPLES" + .IX Header "EXAMPLES" +-Get the number of rounds used in \s-1RC5:\s0 ++Encrypt a string using \s-1IDEA:\s0 + .PP +-.Vb 2 +-\& int nrounds; +-\& EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_GET_RC5_ROUNDS, 0, &nrounds); +-.Ve +-.PP +-Get the \s-1RC2\s0 effective key length: +-.PP +-.Vb 2 +-\& int key_bits; +-\& EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_GET_RC2_KEY_BITS, 0, &key_bits); +-.Ve +-.PP +-Set the number of rounds used in \s-1RC5:\s0 +-.PP +-.Vb 2 +-\& int nrounds; +-\& EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_SET_RC5_ROUNDS, nrounds, NULL); +-.Ve +-.PP +-Set the effective key length used in \s-1RC2:\s0 +-.PP +-.Vb 2 +-\& int key_bits; +-\& EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_SET_RC2_KEY_BITS, key_bits, NULL); +-.Ve +-.PP +-Encrypt a string using blowfish: +-.PP +-.Vb 10 ++.Vb 12 + \& int do_crypt(char *outfile) + \& { + \& unsigned char outbuf[1024]; +@@ -536,8 +508,9 @@ for certain common S/MIME ciphers (\s-1RC2\s0, \s- + \& char intext[] = "Some Crypto Text"; + \& EVP_CIPHER_CTX ctx; + \& FILE *out; ++\& + \& EVP_CIPHER_CTX_init(&ctx); +-\& EVP_EncryptInit_ex(&ctx, EVP_bf_cbc(), NULL, key, iv); ++\& EVP_EncryptInit_ex(&ctx, EVP_idea_cbc(), NULL, key, iv); + \& + \& if(!EVP_EncryptUpdate(&ctx, outbuf, &outlen, intext, strlen(intext))) + \& { +@@ -567,31 +540,37 @@ for certain common S/MIME ciphers (\s-1RC2\s0, \s- + .Ve + .PP + The ciphertext from the above example can be decrypted using the \fBopenssl\fR +-utility with the command line: ++utility with the command line (shown on two lines for clarity): + .PP +-.Vb 1 +-\& S ++.Vb 2 ++\& openssl idea \-d + \& + \& EVP_PKEY_CTX *ctx; ++\& /* md is a SHA\-256 digest in this example. */ + \& unsigned char *md, *sig; +-\& size_t mdlen, siglen; ++\& size_t mdlen = 32, siglen; + \& EVP_PKEY *signing_key; +-\& /* NB: assumes signing_key, md and mdlen are already set up +-\& * and that signing_key is an RSA private key ++\& ++\& /* ++\& * NB: assumes signing_key and md are set up before the next ++\& * step. signing_key must be an RSA private key and md must ++\& * point to the SHA\-256 digest to be signed. + \& */ +-\& ctx = EVP_PKEY_CTX_new(signing_key); ++\& ctx = EVP_PKEY_CTX_new(signing_key, NULL /* no engine */); + \& if (!ctx) + \& /* Error occurred */ + \& if (EVP_PKEY_sign_init(ctx) <= 0) +@@ -208,6 +217,7 @@ Sign data using \s-1RSA\s0 with PKCS#1 padding and + .SH "SEE ALSO" + .IX Header "SEE ALSO" + \&\fIEVP_PKEY_CTX_new\fR\|(3), ++\&\fIEVP_PKEY_CTX_ctrl\fR\|(3), + \&\fIEVP_PKEY_encrypt\fR\|(3), + \&\fIEVP_PKEY_decrypt\fR\|(3), + \&\fIEVP_PKEY_verify\fR\|(3), +Index: secure/lib/libcrypto/man/EVP_PKEY_verify.3 +=================================================================== +--- secure/lib/libcrypto/man/EVP_PKEY_verify.3 (revision 273303) ++++ secure/lib/libcrypto/man/EVP_PKEY_verify.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "EVP_PKEY_verify 3" +-.TH EVP_PKEY_verify 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH EVP_PKEY_verify 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/EVP_PKEY_verify_recover.3 +=================================================================== +--- secure/lib/libcrypto/man/EVP_PKEY_verify_recover.3 (revision 273303) ++++ secure/lib/libcrypto/man/EVP_PKEY_verify_recover.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "EVP_PKEY_verify_recover 3" +-.TH EVP_PKEY_verify_recover 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH EVP_PKEY_verify_recover 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/EVP_SealInit.3 +=================================================================== +--- secure/lib/libcrypto/man/EVP_SealInit.3 (revision 273303) ++++ secure/lib/libcrypto/man/EVP_SealInit.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "EVP_SealInit 3" +-.TH EVP_SealInit 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH EVP_SealInit 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/EVP_SignInit.3 +=================================================================== +--- secure/lib/libcrypto/man/EVP_SignInit.3 (revision 273303) ++++ secure/lib/libcrypto/man/EVP_SignInit.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "EVP_SignInit 3" +-.TH EVP_SignInit 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH EVP_SignInit 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/EVP_VerifyInit.3 +=================================================================== +--- secure/lib/libcrypto/man/EVP_VerifyInit.3 (revision 273303) ++++ secure/lib/libcrypto/man/EVP_VerifyInit.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "EVP_VerifyInit 3" +-.TH EVP_VerifyInit 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH EVP_VerifyInit 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/OBJ_nid2obj.3 +=================================================================== +--- secure/lib/libcrypto/man/OBJ_nid2obj.3 (revision 273303) ++++ secure/lib/libcrypto/man/OBJ_nid2obj.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "OBJ_nid2obj 3" +-.TH OBJ_nid2obj 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH OBJ_nid2obj 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/OPENSSL_Applink.3 +=================================================================== +--- secure/lib/libcrypto/man/OPENSSL_Applink.3 (revision 273303) ++++ secure/lib/libcrypto/man/OPENSSL_Applink.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "OPENSSL_Applink 3" +-.TH OPENSSL_Applink 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH OPENSSL_Applink 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/OPENSSL_VERSION_NUMBER.3 +=================================================================== +--- secure/lib/libcrypto/man/OPENSSL_VERSION_NUMBER.3 (revision 273303) ++++ secure/lib/libcrypto/man/OPENSSL_VERSION_NUMBER.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "OPENSSL_VERSION_NUMBER 3" +-.TH OPENSSL_VERSION_NUMBER 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH OPENSSL_VERSION_NUMBER 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/OPENSSL_config.3 +=================================================================== +--- secure/lib/libcrypto/man/OPENSSL_config.3 (revision 273303) ++++ secure/lib/libcrypto/man/OPENSSL_config.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "OPENSSL_config 3" +-.TH OPENSSL_config 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH OPENSSL_config 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/OPENSSL_ia32cap.3 +=================================================================== +--- secure/lib/libcrypto/man/OPENSSL_ia32cap.3 (revision 273303) ++++ secure/lib/libcrypto/man/OPENSSL_ia32cap.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "OPENSSL_ia32cap 3" +-.TH OPENSSL_ia32cap 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH OPENSSL_ia32cap 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/OPENSSL_load_builtin_modules.3 +=================================================================== +--- secure/lib/libcrypto/man/OPENSSL_load_builtin_modules.3 (revision 273303) ++++ secure/lib/libcrypto/man/OPENSSL_load_builtin_modules.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "OPENSSL_load_builtin_modules 3" +-.TH OPENSSL_load_builtin_modules 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH OPENSSL_load_builtin_modules 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/OpenSSL_add_all_algorithms.3 +=================================================================== +--- secure/lib/libcrypto/man/OpenSSL_add_all_algorithms.3 (revision 273303) ++++ secure/lib/libcrypto/man/OpenSSL_add_all_algorithms.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "OpenSSL_add_all_algorithms 3" +-.TH OpenSSL_add_all_algorithms 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH OpenSSL_add_all_algorithms 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/PEM_write_bio_CMS_stream.3 +=================================================================== +--- secure/lib/libcrypto/man/PEM_write_bio_CMS_stream.3 (revision 273303) ++++ secure/lib/libcrypto/man/PEM_write_bio_CMS_stream.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "PEM_write_bio_CMS_stream 3" +-.TH PEM_write_bio_CMS_stream 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH PEM_write_bio_CMS_stream 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/PEM_write_bio_PKCS7_stream.3 +=================================================================== +--- secure/lib/libcrypto/man/PEM_write_bio_PKCS7_stream.3 (revision 273303) ++++ secure/lib/libcrypto/man/PEM_write_bio_PKCS7_stream.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "PEM_write_bio_PKCS7_stream 3" +-.TH PEM_write_bio_PKCS7_stream 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH PEM_write_bio_PKCS7_stream 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/PKCS12_create.3 +=================================================================== +--- secure/lib/libcrypto/man/PKCS12_create.3 (revision 273303) ++++ secure/lib/libcrypto/man/PKCS12_create.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "PKCS12_create 3" +-.TH PKCS12_create 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH PKCS12_create 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/PKCS12_parse.3 +=================================================================== +--- secure/lib/libcrypto/man/PKCS12_parse.3 (revision 273303) ++++ secure/lib/libcrypto/man/PKCS12_parse.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "PKCS12_parse 3" +-.TH PKCS12_parse 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH PKCS12_parse 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/PKCS7_decrypt.3 +=================================================================== +--- secure/lib/libcrypto/man/PKCS7_decrypt.3 (revision 273303) ++++ secure/lib/libcrypto/man/PKCS7_decrypt.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "PKCS7_decrypt 3" +-.TH PKCS7_decrypt 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH PKCS7_decrypt 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/PKCS7_encrypt.3 +=================================================================== +--- secure/lib/libcrypto/man/PKCS7_encrypt.3 (revision 273303) ++++ secure/lib/libcrypto/man/PKCS7_encrypt.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "PKCS7_encrypt 3" +-.TH PKCS7_encrypt 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH PKCS7_encrypt 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/PKCS7_sign.3 +=================================================================== +--- secure/lib/libcrypto/man/PKCS7_sign.3 (revision 273303) ++++ secure/lib/libcrypto/man/PKCS7_sign.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "PKCS7_sign 3" +-.TH PKCS7_sign 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH PKCS7_sign 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/PKCS7_sign_add_signer.3 +=================================================================== +--- secure/lib/libcrypto/man/PKCS7_sign_add_signer.3 (revision 273303) ++++ secure/lib/libcrypto/man/PKCS7_sign_add_signer.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "PKCS7_sign_add_signer 3" +-.TH PKCS7_sign_add_signer 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH PKCS7_sign_add_signer 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/PKCS7_verify.3 +=================================================================== +--- secure/lib/libcrypto/man/PKCS7_verify.3 (revision 273303) ++++ secure/lib/libcrypto/man/PKCS7_verify.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "PKCS7_verify 3" +-.TH PKCS7_verify 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH PKCS7_verify 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/RAND_add.3 +=================================================================== +--- secure/lib/libcrypto/man/RAND_add.3 (revision 273303) ++++ secure/lib/libcrypto/man/RAND_add.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "RAND_add 3" +-.TH RAND_add 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH RAND_add 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/RAND_bytes.3 +=================================================================== +--- secure/lib/libcrypto/man/RAND_bytes.3 (revision 273303) ++++ secure/lib/libcrypto/man/RAND_bytes.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "RAND_bytes 3" +-.TH RAND_bytes 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH RAND_bytes 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/RAND_cleanup.3 +=================================================================== +--- secure/lib/libcrypto/man/RAND_cleanup.3 (revision 273303) ++++ secure/lib/libcrypto/man/RAND_cleanup.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "RAND_cleanup 3" +-.TH RAND_cleanup 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH RAND_cleanup 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/RAND_egd.3 +=================================================================== +--- secure/lib/libcrypto/man/RAND_egd.3 (revision 273303) ++++ secure/lib/libcrypto/man/RAND_egd.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "RAND_egd 3" +-.TH RAND_egd 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH RAND_egd 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/RAND_load_file.3 +=================================================================== +--- secure/lib/libcrypto/man/RAND_load_file.3 (revision 273303) ++++ secure/lib/libcrypto/man/RAND_load_file.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "RAND_load_file 3" +-.TH RAND_load_file 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH RAND_load_file 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/RAND_set_rand_method.3 +=================================================================== +--- secure/lib/libcrypto/man/RAND_set_rand_method.3 (revision 273303) ++++ secure/lib/libcrypto/man/RAND_set_rand_method.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "RAND_set_rand_method 3" +-.TH RAND_set_rand_method 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH RAND_set_rand_method 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/RSA_blinding_on.3 +=================================================================== +--- secure/lib/libcrypto/man/RSA_blinding_on.3 (revision 273303) ++++ secure/lib/libcrypto/man/RSA_blinding_on.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "RSA_blinding_on 3" +-.TH RSA_blinding_on 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH RSA_blinding_on 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/RSA_check_key.3 +=================================================================== +--- secure/lib/libcrypto/man/RSA_check_key.3 (revision 273303) ++++ secure/lib/libcrypto/man/RSA_check_key.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "RSA_check_key 3" +-.TH RSA_check_key 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH RSA_check_key 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/RSA_generate_key.3 +=================================================================== +--- secure/lib/libcrypto/man/RSA_generate_key.3 (revision 273303) ++++ secure/lib/libcrypto/man/RSA_generate_key.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "RSA_generate_key 3" +-.TH RSA_generate_key 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH RSA_generate_key 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/RSA_get_ex_new_index.3 +=================================================================== +--- secure/lib/libcrypto/man/RSA_get_ex_new_index.3 (revision 273303) ++++ secure/lib/libcrypto/man/RSA_get_ex_new_index.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "RSA_get_ex_new_index 3" +-.TH RSA_get_ex_new_index 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH RSA_get_ex_new_index 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/RSA_new.3 +=================================================================== +--- secure/lib/libcrypto/man/RSA_new.3 (revision 273303) ++++ secure/lib/libcrypto/man/RSA_new.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "RSA_new 3" +-.TH RSA_new 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH RSA_new 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/RSA_padding_add_PKCS1_type_1.3 +=================================================================== +--- secure/lib/libcrypto/man/RSA_padding_add_PKCS1_type_1.3 (revision 273303) ++++ secure/lib/libcrypto/man/RSA_padding_add_PKCS1_type_1.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "RSA_padding_add_PKCS1_type_1 3" +-.TH RSA_padding_add_PKCS1_type_1 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH RSA_padding_add_PKCS1_type_1 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/RSA_print.3 +=================================================================== +--- secure/lib/libcrypto/man/RSA_print.3 (revision 273303) ++++ secure/lib/libcrypto/man/RSA_print.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "RSA_print 3" +-.TH RSA_print 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH RSA_print 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/RSA_private_encrypt.3 +=================================================================== +--- secure/lib/libcrypto/man/RSA_private_encrypt.3 (revision 273303) ++++ secure/lib/libcrypto/man/RSA_private_encrypt.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "RSA_private_encrypt 3" +-.TH RSA_private_encrypt 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH RSA_private_encrypt 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/RSA_public_encrypt.3 +=================================================================== +--- secure/lib/libcrypto/man/RSA_public_encrypt.3 (revision 273303) ++++ secure/lib/libcrypto/man/RSA_public_encrypt.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "RSA_public_encrypt 3" +-.TH RSA_public_encrypt 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH RSA_public_encrypt 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/RSA_set_method.3 +=================================================================== +--- secure/lib/libcrypto/man/RSA_set_method.3 (revision 273303) ++++ secure/lib/libcrypto/man/RSA_set_method.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "RSA_set_method 3" +-.TH RSA_set_method 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH RSA_set_method 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/RSA_sign.3 +=================================================================== +--- secure/lib/libcrypto/man/RSA_sign.3 (revision 273303) ++++ secure/lib/libcrypto/man/RSA_sign.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "RSA_sign 3" +-.TH RSA_sign 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH RSA_sign 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/RSA_sign_ASN1_OCTET_STRING.3 +=================================================================== +--- secure/lib/libcrypto/man/RSA_sign_ASN1_OCTET_STRING.3 (revision 273303) ++++ secure/lib/libcrypto/man/RSA_sign_ASN1_OCTET_STRING.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "RSA_sign_ASN1_OCTET_STRING 3" +-.TH RSA_sign_ASN1_OCTET_STRING 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH RSA_sign_ASN1_OCTET_STRING 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/RSA_size.3 +=================================================================== +--- secure/lib/libcrypto/man/RSA_size.3 (revision 273303) ++++ secure/lib/libcrypto/man/RSA_size.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "RSA_size 3" +-.TH RSA_size 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH RSA_size 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/SMIME_read_CMS.3 +=================================================================== +--- secure/lib/libcrypto/man/SMIME_read_CMS.3 (revision 273303) ++++ secure/lib/libcrypto/man/SMIME_read_CMS.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "SMIME_read_CMS 3" +-.TH SMIME_read_CMS 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH SMIME_read_CMS 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/SMIME_read_PKCS7.3 +=================================================================== +--- secure/lib/libcrypto/man/SMIME_read_PKCS7.3 (revision 273303) ++++ secure/lib/libcrypto/man/SMIME_read_PKCS7.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "SMIME_read_PKCS7 3" +-.TH SMIME_read_PKCS7 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH SMIME_read_PKCS7 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/SMIME_write_CMS.3 +=================================================================== +--- secure/lib/libcrypto/man/SMIME_write_CMS.3 (revision 273303) ++++ secure/lib/libcrypto/man/SMIME_write_CMS.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "SMIME_write_CMS 3" +-.TH SMIME_write_CMS 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH SMIME_write_CMS 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/SMIME_write_PKCS7.3 +=================================================================== +--- secure/lib/libcrypto/man/SMIME_write_PKCS7.3 (revision 273303) ++++ secure/lib/libcrypto/man/SMIME_write_PKCS7.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "SMIME_write_PKCS7 3" +-.TH SMIME_write_PKCS7 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH SMIME_write_PKCS7 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/X509_NAME_ENTRY_get_object.3 +=================================================================== +--- secure/lib/libcrypto/man/X509_NAME_ENTRY_get_object.3 (revision 273303) ++++ secure/lib/libcrypto/man/X509_NAME_ENTRY_get_object.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "X509_NAME_ENTRY_get_object 3" +-.TH X509_NAME_ENTRY_get_object 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH X509_NAME_ENTRY_get_object 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/X509_NAME_add_entry_by_txt.3 +=================================================================== +--- secure/lib/libcrypto/man/X509_NAME_add_entry_by_txt.3 (revision 273303) ++++ secure/lib/libcrypto/man/X509_NAME_add_entry_by_txt.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "X509_NAME_add_entry_by_txt 3" +-.TH X509_NAME_add_entry_by_txt 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH X509_NAME_add_entry_by_txt 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/X509_NAME_get_index_by_NID.3 +=================================================================== +--- secure/lib/libcrypto/man/X509_NAME_get_index_by_NID.3 (revision 273303) ++++ secure/lib/libcrypto/man/X509_NAME_get_index_by_NID.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "X509_NAME_get_index_by_NID 3" +-.TH X509_NAME_get_index_by_NID 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH X509_NAME_get_index_by_NID 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/X509_NAME_print_ex.3 +=================================================================== +--- secure/lib/libcrypto/man/X509_NAME_print_ex.3 (revision 273303) ++++ secure/lib/libcrypto/man/X509_NAME_print_ex.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "X509_NAME_print_ex 3" +-.TH X509_NAME_print_ex 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH X509_NAME_print_ex 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/X509_STORE_CTX_get_error.3 +=================================================================== +--- secure/lib/libcrypto/man/X509_STORE_CTX_get_error.3 (revision 273303) ++++ secure/lib/libcrypto/man/X509_STORE_CTX_get_error.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "X509_STORE_CTX_get_error 3" +-.TH X509_STORE_CTX_get_error 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH X509_STORE_CTX_get_error 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/X509_STORE_CTX_get_ex_new_index.3 +=================================================================== +--- secure/lib/libcrypto/man/X509_STORE_CTX_get_ex_new_index.3 (revision 273303) ++++ secure/lib/libcrypto/man/X509_STORE_CTX_get_ex_new_index.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "X509_STORE_CTX_get_ex_new_index 3" +-.TH X509_STORE_CTX_get_ex_new_index 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH X509_STORE_CTX_get_ex_new_index 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/X509_STORE_CTX_new.3 +=================================================================== +--- secure/lib/libcrypto/man/X509_STORE_CTX_new.3 (revision 273303) ++++ secure/lib/libcrypto/man/X509_STORE_CTX_new.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "X509_STORE_CTX_new 3" +-.TH X509_STORE_CTX_new 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH X509_STORE_CTX_new 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/X509_STORE_CTX_set_verify_cb.3 +=================================================================== +--- secure/lib/libcrypto/man/X509_STORE_CTX_set_verify_cb.3 (revision 273303) ++++ secure/lib/libcrypto/man/X509_STORE_CTX_set_verify_cb.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "X509_STORE_CTX_set_verify_cb 3" +-.TH X509_STORE_CTX_set_verify_cb 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH X509_STORE_CTX_set_verify_cb 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/X509_STORE_set_verify_cb_func.3 +=================================================================== +--- secure/lib/libcrypto/man/X509_STORE_set_verify_cb_func.3 (revision 273303) ++++ secure/lib/libcrypto/man/X509_STORE_set_verify_cb_func.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "X509_STORE_set_verify_cb_func 3" +-.TH X509_STORE_set_verify_cb_func 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH X509_STORE_set_verify_cb_func 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/X509_VERIFY_PARAM_set_flags.3 +=================================================================== +--- secure/lib/libcrypto/man/X509_VERIFY_PARAM_set_flags.3 (revision 273303) ++++ secure/lib/libcrypto/man/X509_VERIFY_PARAM_set_flags.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "X509_VERIFY_PARAM_set_flags 3" +-.TH X509_VERIFY_PARAM_set_flags 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH X509_VERIFY_PARAM_set_flags 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/X509_new.3 +=================================================================== +--- secure/lib/libcrypto/man/X509_new.3 (revision 273303) ++++ secure/lib/libcrypto/man/X509_new.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "X509_new 3" +-.TH X509_new 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH X509_new 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/X509_verify_cert.3 +=================================================================== +--- secure/lib/libcrypto/man/X509_verify_cert.3 (revision 273303) ++++ secure/lib/libcrypto/man/X509_verify_cert.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "X509_verify_cert 3" +-.TH X509_verify_cert 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH X509_verify_cert 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/bio.3 +=================================================================== +--- secure/lib/libcrypto/man/bio.3 (revision 273303) ++++ secure/lib/libcrypto/man/bio.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "bio 3" +-.TH bio 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH bio 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/blowfish.3 +=================================================================== +--- secure/lib/libcrypto/man/blowfish.3 (revision 273303) ++++ secure/lib/libcrypto/man/blowfish.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "blowfish 3" +-.TH blowfish 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH blowfish 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/bn.3 +=================================================================== +--- secure/lib/libcrypto/man/bn.3 (revision 273303) ++++ secure/lib/libcrypto/man/bn.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "bn 3" +-.TH bn 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH bn 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/bn_internal.3 +=================================================================== +--- secure/lib/libcrypto/man/bn_internal.3 (revision 273303) ++++ secure/lib/libcrypto/man/bn_internal.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "bn_internal 3" +-.TH bn_internal 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH bn_internal 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/buffer.3 +=================================================================== +--- secure/lib/libcrypto/man/buffer.3 (revision 273303) ++++ secure/lib/libcrypto/man/buffer.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "buffer 3" +-.TH buffer 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH buffer 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/crypto.3 +=================================================================== +--- secure/lib/libcrypto/man/crypto.3 (revision 273303) ++++ secure/lib/libcrypto/man/crypto.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "crypto 3" +-.TH crypto 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH crypto 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/d2i_ASN1_OBJECT.3 +=================================================================== +--- secure/lib/libcrypto/man/d2i_ASN1_OBJECT.3 (revision 273303) ++++ secure/lib/libcrypto/man/d2i_ASN1_OBJECT.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "d2i_ASN1_OBJECT 3" +-.TH d2i_ASN1_OBJECT 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH d2i_ASN1_OBJECT 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/d2i_DHparams.3 +=================================================================== +--- secure/lib/libcrypto/man/d2i_DHparams.3 (revision 273303) ++++ secure/lib/libcrypto/man/d2i_DHparams.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "d2i_DHparams 3" +-.TH d2i_DHparams 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH d2i_DHparams 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/d2i_DSAPublicKey.3 +=================================================================== +--- secure/lib/libcrypto/man/d2i_DSAPublicKey.3 (revision 273303) ++++ secure/lib/libcrypto/man/d2i_DSAPublicKey.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "d2i_DSAPublicKey 3" +-.TH d2i_DSAPublicKey 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH d2i_DSAPublicKey 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/d2i_PKCS8PrivateKey.3 +=================================================================== +--- secure/lib/libcrypto/man/d2i_PKCS8PrivateKey.3 (revision 273303) ++++ secure/lib/libcrypto/man/d2i_PKCS8PrivateKey.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "d2i_PKCS8PrivateKey 3" +-.TH d2i_PKCS8PrivateKey 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH d2i_PKCS8PrivateKey 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/d2i_RSAPublicKey.3 +=================================================================== +--- secure/lib/libcrypto/man/d2i_RSAPublicKey.3 (revision 273303) ++++ secure/lib/libcrypto/man/d2i_RSAPublicKey.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "d2i_RSAPublicKey 3" +-.TH d2i_RSAPublicKey 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH d2i_RSAPublicKey 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/d2i_X509.3 +=================================================================== +--- secure/lib/libcrypto/man/d2i_X509.3 (revision 273303) ++++ secure/lib/libcrypto/man/d2i_X509.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "d2i_X509 3" +-.TH d2i_X509 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH d2i_X509 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/d2i_X509_ALGOR.3 +=================================================================== +--- secure/lib/libcrypto/man/d2i_X509_ALGOR.3 (revision 273303) ++++ secure/lib/libcrypto/man/d2i_X509_ALGOR.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "d2i_X509_ALGOR 3" +-.TH d2i_X509_ALGOR 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH d2i_X509_ALGOR 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/d2i_X509_CRL.3 +=================================================================== +--- secure/lib/libcrypto/man/d2i_X509_CRL.3 (revision 273303) ++++ secure/lib/libcrypto/man/d2i_X509_CRL.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "d2i_X509_CRL 3" +-.TH d2i_X509_CRL 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH d2i_X509_CRL 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/d2i_X509_NAME.3 +=================================================================== +--- secure/lib/libcrypto/man/d2i_X509_NAME.3 (revision 273303) ++++ secure/lib/libcrypto/man/d2i_X509_NAME.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "d2i_X509_NAME 3" +-.TH d2i_X509_NAME 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH d2i_X509_NAME 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/d2i_X509_REQ.3 +=================================================================== +--- secure/lib/libcrypto/man/d2i_X509_REQ.3 (revision 273303) ++++ secure/lib/libcrypto/man/d2i_X509_REQ.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "d2i_X509_REQ 3" +-.TH d2i_X509_REQ 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH d2i_X509_REQ 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/d2i_X509_SIG.3 +=================================================================== +--- secure/lib/libcrypto/man/d2i_X509_SIG.3 (revision 273303) ++++ secure/lib/libcrypto/man/d2i_X509_SIG.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "d2i_X509_SIG 3" +-.TH d2i_X509_SIG 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH d2i_X509_SIG 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/des.3 +=================================================================== +--- secure/lib/libcrypto/man/des.3 (revision 273303) ++++ secure/lib/libcrypto/man/des.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "des 3" +-.TH des 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH des 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/dh.3 +=================================================================== +--- secure/lib/libcrypto/man/dh.3 (revision 273303) ++++ secure/lib/libcrypto/man/dh.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "dh 3" +-.TH dh 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH dh 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/dsa.3 +=================================================================== +--- secure/lib/libcrypto/man/dsa.3 (revision 273303) ++++ secure/lib/libcrypto/man/dsa.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "dsa 3" +-.TH dsa 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH dsa 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/ecdsa.3 +=================================================================== +--- secure/lib/libcrypto/man/ecdsa.3 (revision 273303) ++++ secure/lib/libcrypto/man/ecdsa.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "ecdsa 3" +-.TH ecdsa 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH ecdsa 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/engine.3 +=================================================================== +--- secure/lib/libcrypto/man/engine.3 (revision 273303) ++++ secure/lib/libcrypto/man/engine.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "engine 3" +-.TH engine 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH engine 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/err.3 +=================================================================== +--- secure/lib/libcrypto/man/err.3 (revision 273303) ++++ secure/lib/libcrypto/man/err.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "err 3" +-.TH err 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH err 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/evp.3 +=================================================================== +--- secure/lib/libcrypto/man/evp.3 (revision 273303) ++++ secure/lib/libcrypto/man/evp.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "evp 3" +-.TH evp 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH evp 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/hmac.3 +=================================================================== +--- secure/lib/libcrypto/man/hmac.3 (revision 273303) ++++ secure/lib/libcrypto/man/hmac.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "hmac 3" +-.TH hmac 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH hmac 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/i2d_CMS_bio_stream.3 +=================================================================== +--- secure/lib/libcrypto/man/i2d_CMS_bio_stream.3 (revision 273303) ++++ secure/lib/libcrypto/man/i2d_CMS_bio_stream.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "i2d_CMS_bio_stream 3" +-.TH i2d_CMS_bio_stream 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH i2d_CMS_bio_stream 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/i2d_PKCS7_bio_stream.3 +=================================================================== +--- secure/lib/libcrypto/man/i2d_PKCS7_bio_stream.3 (revision 273303) ++++ secure/lib/libcrypto/man/i2d_PKCS7_bio_stream.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "i2d_PKCS7_bio_stream 3" +-.TH i2d_PKCS7_bio_stream 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH i2d_PKCS7_bio_stream 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/lh_stats.3 +=================================================================== +--- secure/lib/libcrypto/man/lh_stats.3 (revision 273303) ++++ secure/lib/libcrypto/man/lh_stats.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "lh_stats 3" +-.TH lh_stats 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH lh_stats 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/lhash.3 +=================================================================== +--- secure/lib/libcrypto/man/lhash.3 (revision 273303) ++++ secure/lib/libcrypto/man/lhash.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "lhash 3" +-.TH lhash 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH lhash 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/md5.3 +=================================================================== +--- secure/lib/libcrypto/man/md5.3 (revision 273303) ++++ secure/lib/libcrypto/man/md5.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "md5 3" +-.TH md5 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH md5 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/mdc2.3 +=================================================================== +--- secure/lib/libcrypto/man/mdc2.3 (revision 273303) ++++ secure/lib/libcrypto/man/mdc2.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "mdc2 3" +-.TH mdc2 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH mdc2 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/pem.3 +=================================================================== +--- secure/lib/libcrypto/man/pem.3 (revision 273303) ++++ secure/lib/libcrypto/man/pem.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "pem 3" +-.TH pem 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH pem 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/rand.3 +=================================================================== +--- secure/lib/libcrypto/man/rand.3 (revision 273303) ++++ secure/lib/libcrypto/man/rand.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "rand 3" +-.TH rand 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH rand 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/rc4.3 +=================================================================== +--- secure/lib/libcrypto/man/rc4.3 (revision 273303) ++++ secure/lib/libcrypto/man/rc4.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "rc4 3" +-.TH rc4 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH rc4 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/ripemd.3 +=================================================================== +--- secure/lib/libcrypto/man/ripemd.3 (revision 273303) ++++ secure/lib/libcrypto/man/ripemd.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "ripemd 3" +-.TH ripemd 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH ripemd 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/rsa.3 +=================================================================== +--- secure/lib/libcrypto/man/rsa.3 (revision 273303) ++++ secure/lib/libcrypto/man/rsa.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "rsa 3" +-.TH rsa 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH rsa 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/sha.3 +=================================================================== +--- secure/lib/libcrypto/man/sha.3 (revision 273303) ++++ secure/lib/libcrypto/man/sha.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "sha 3" +-.TH sha 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH sha 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/threads.3 +=================================================================== +--- secure/lib/libcrypto/man/threads.3 (revision 273303) ++++ secure/lib/libcrypto/man/threads.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "threads 3" +-.TH threads 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH threads 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/ui.3 +=================================================================== +--- secure/lib/libcrypto/man/ui.3 (revision 273303) ++++ secure/lib/libcrypto/man/ui.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "ui 3" +-.TH ui 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH ui 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/ui_compat.3 +=================================================================== +--- secure/lib/libcrypto/man/ui_compat.3 (revision 273303) ++++ secure/lib/libcrypto/man/ui_compat.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "ui_compat 3" +-.TH ui_compat 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH ui_compat 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/x509.3 +=================================================================== +--- secure/lib/libcrypto/man/x509.3 (revision 273303) ++++ secure/lib/libcrypto/man/x509.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "x509 3" +-.TH x509 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH x509 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libssl/man/SSL_CIPHER_get_name.3 +=================================================================== +--- secure/lib/libssl/man/SSL_CIPHER_get_name.3 (revision 273303) ++++ secure/lib/libssl/man/SSL_CIPHER_get_name.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "SSL_CIPHER_get_name 3" +-.TH SSL_CIPHER_get_name 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH SSL_CIPHER_get_name 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libssl/man/SSL_COMP_add_compression_method.3 +=================================================================== +--- secure/lib/libssl/man/SSL_COMP_add_compression_method.3 (revision 273303) ++++ secure/lib/libssl/man/SSL_COMP_add_compression_method.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "SSL_COMP_add_compression_method 3" +-.TH SSL_COMP_add_compression_method 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH SSL_COMP_add_compression_method 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libssl/man/SSL_CTX_add_extra_chain_cert.3 +=================================================================== +--- secure/lib/libssl/man/SSL_CTX_add_extra_chain_cert.3 (revision 273303) ++++ secure/lib/libssl/man/SSL_CTX_add_extra_chain_cert.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "SSL_CTX_add_extra_chain_cert 3" +-.TH SSL_CTX_add_extra_chain_cert 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH SSL_CTX_add_extra_chain_cert 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libssl/man/SSL_CTX_add_session.3 +=================================================================== +--- secure/lib/libssl/man/SSL_CTX_add_session.3 (revision 273303) ++++ secure/lib/libssl/man/SSL_CTX_add_session.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "SSL_CTX_add_session 3" +-.TH SSL_CTX_add_session 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH SSL_CTX_add_session 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libssl/man/SSL_CTX_ctrl.3 +=================================================================== +--- secure/lib/libssl/man/SSL_CTX_ctrl.3 (revision 273303) ++++ secure/lib/libssl/man/SSL_CTX_ctrl.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "SSL_CTX_ctrl 3" +-.TH SSL_CTX_ctrl 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH SSL_CTX_ctrl 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libssl/man/SSL_CTX_flush_sessions.3 +=================================================================== +--- secure/lib/libssl/man/SSL_CTX_flush_sessions.3 (revision 273303) ++++ secure/lib/libssl/man/SSL_CTX_flush_sessions.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "SSL_CTX_flush_sessions 3" +-.TH SSL_CTX_flush_sessions 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH SSL_CTX_flush_sessions 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libssl/man/SSL_CTX_free.3 +=================================================================== +--- secure/lib/libssl/man/SSL_CTX_free.3 (revision 273303) ++++ secure/lib/libssl/man/SSL_CTX_free.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "SSL_CTX_free 3" +-.TH SSL_CTX_free 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH SSL_CTX_free 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libssl/man/SSL_CTX_get_ex_new_index.3 +=================================================================== +--- secure/lib/libssl/man/SSL_CTX_get_ex_new_index.3 (revision 273303) ++++ secure/lib/libssl/man/SSL_CTX_get_ex_new_index.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "SSL_CTX_get_ex_new_index 3" +-.TH SSL_CTX_get_ex_new_index 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH SSL_CTX_get_ex_new_index 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libssl/man/SSL_CTX_get_verify_mode.3 +=================================================================== +--- secure/lib/libssl/man/SSL_CTX_get_verify_mode.3 (revision 273303) ++++ secure/lib/libssl/man/SSL_CTX_get_verify_mode.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "SSL_CTX_get_verify_mode 3" +-.TH SSL_CTX_get_verify_mode 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH SSL_CTX_get_verify_mode 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libssl/man/SSL_CTX_load_verify_locations.3 +=================================================================== +--- secure/lib/libssl/man/SSL_CTX_load_verify_locations.3 (revision 273303) ++++ secure/lib/libssl/man/SSL_CTX_load_verify_locations.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "SSL_CTX_load_verify_locations 3" +-.TH SSL_CTX_load_verify_locations 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH SSL_CTX_load_verify_locations 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libssl/man/SSL_CTX_new.3 +=================================================================== +--- secure/lib/libssl/man/SSL_CTX_new.3 (revision 273303) ++++ secure/lib/libssl/man/SSL_CTX_new.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "SSL_CTX_new 3" +-.TH SSL_CTX_new 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH SSL_CTX_new 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libssl/man/SSL_CTX_sess_number.3 +=================================================================== +--- secure/lib/libssl/man/SSL_CTX_sess_number.3 (revision 273303) ++++ secure/lib/libssl/man/SSL_CTX_sess_number.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "SSL_CTX_sess_number 3" +-.TH SSL_CTX_sess_number 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH SSL_CTX_sess_number 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libssl/man/SSL_CTX_sess_set_cache_size.3 +=================================================================== +--- secure/lib/libssl/man/SSL_CTX_sess_set_cache_size.3 (revision 273303) ++++ secure/lib/libssl/man/SSL_CTX_sess_set_cache_size.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "SSL_CTX_sess_set_cache_size 3" +-.TH SSL_CTX_sess_set_cache_size 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH SSL_CTX_sess_set_cache_size 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libssl/man/SSL_CTX_sess_set_get_cb.3 +=================================================================== +--- secure/lib/libssl/man/SSL_CTX_sess_set_get_cb.3 (revision 273303) ++++ secure/lib/libssl/man/SSL_CTX_sess_set_get_cb.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "SSL_CTX_sess_set_get_cb 3" +-.TH SSL_CTX_sess_set_get_cb 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH SSL_CTX_sess_set_get_cb 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libssl/man/SSL_CTX_sessions.3 +=================================================================== +--- secure/lib/libssl/man/SSL_CTX_sessions.3 (revision 273303) ++++ secure/lib/libssl/man/SSL_CTX_sessions.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "SSL_CTX_sessions 3" +-.TH SSL_CTX_sessions 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH SSL_CTX_sessions 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libssl/man/SSL_CTX_set_cert_store.3 +=================================================================== +--- secure/lib/libssl/man/SSL_CTX_set_cert_store.3 (revision 273303) ++++ secure/lib/libssl/man/SSL_CTX_set_cert_store.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "SSL_CTX_set_cert_store 3" +-.TH SSL_CTX_set_cert_store 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH SSL_CTX_set_cert_store 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libssl/man/SSL_CTX_set_cert_verify_callback.3 +=================================================================== +--- secure/lib/libssl/man/SSL_CTX_set_cert_verify_callback.3 (revision 273303) ++++ secure/lib/libssl/man/SSL_CTX_set_cert_verify_callback.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "SSL_CTX_set_cert_verify_callback 3" +-.TH SSL_CTX_set_cert_verify_callback 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH SSL_CTX_set_cert_verify_callback 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libssl/man/SSL_CTX_set_cipher_list.3 +=================================================================== +--- secure/lib/libssl/man/SSL_CTX_set_cipher_list.3 (revision 273303) ++++ secure/lib/libssl/man/SSL_CTX_set_cipher_list.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "SSL_CTX_set_cipher_list 3" +-.TH SSL_CTX_set_cipher_list 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH SSL_CTX_set_cipher_list 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libssl/man/SSL_CTX_set_client_CA_list.3 +=================================================================== +--- secure/lib/libssl/man/SSL_CTX_set_client_CA_list.3 (revision 273303) ++++ secure/lib/libssl/man/SSL_CTX_set_client_CA_list.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "SSL_CTX_set_client_CA_list 3" +-.TH SSL_CTX_set_client_CA_list 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH SSL_CTX_set_client_CA_list 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libssl/man/SSL_CTX_set_client_cert_cb.3 +=================================================================== +--- secure/lib/libssl/man/SSL_CTX_set_client_cert_cb.3 (revision 273303) ++++ secure/lib/libssl/man/SSL_CTX_set_client_cert_cb.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "SSL_CTX_set_client_cert_cb 3" +-.TH SSL_CTX_set_client_cert_cb 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH SSL_CTX_set_client_cert_cb 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libssl/man/SSL_CTX_set_default_passwd_cb.3 +=================================================================== +--- secure/lib/libssl/man/SSL_CTX_set_default_passwd_cb.3 (revision 273303) ++++ secure/lib/libssl/man/SSL_CTX_set_default_passwd_cb.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "SSL_CTX_set_default_passwd_cb 3" +-.TH SSL_CTX_set_default_passwd_cb 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH SSL_CTX_set_default_passwd_cb 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libssl/man/SSL_CTX_set_generate_session_id.3 +=================================================================== +--- secure/lib/libssl/man/SSL_CTX_set_generate_session_id.3 (revision 273303) ++++ secure/lib/libssl/man/SSL_CTX_set_generate_session_id.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "SSL_CTX_set_generate_session_id 3" +-.TH SSL_CTX_set_generate_session_id 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH SSL_CTX_set_generate_session_id 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libssl/man/SSL_CTX_set_info_callback.3 +=================================================================== +--- secure/lib/libssl/man/SSL_CTX_set_info_callback.3 (revision 273303) ++++ secure/lib/libssl/man/SSL_CTX_set_info_callback.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "SSL_CTX_set_info_callback 3" +-.TH SSL_CTX_set_info_callback 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH SSL_CTX_set_info_callback 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libssl/man/SSL_CTX_set_max_cert_list.3 +=================================================================== +--- secure/lib/libssl/man/SSL_CTX_set_max_cert_list.3 (revision 273303) ++++ secure/lib/libssl/man/SSL_CTX_set_max_cert_list.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "SSL_CTX_set_max_cert_list 3" +-.TH SSL_CTX_set_max_cert_list 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH SSL_CTX_set_max_cert_list 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libssl/man/SSL_CTX_set_mode.3 +=================================================================== +--- secure/lib/libssl/man/SSL_CTX_set_mode.3 (revision 273303) ++++ secure/lib/libssl/man/SSL_CTX_set_mode.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "SSL_CTX_set_mode 3" +-.TH SSL_CTX_set_mode 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH SSL_CTX_set_mode 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libssl/man/SSL_CTX_set_msg_callback.3 +=================================================================== +--- secure/lib/libssl/man/SSL_CTX_set_msg_callback.3 (revision 273303) ++++ secure/lib/libssl/man/SSL_CTX_set_msg_callback.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "SSL_CTX_set_msg_callback 3" +-.TH SSL_CTX_set_msg_callback 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH SSL_CTX_set_msg_callback 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libssl/man/SSL_CTX_set_options.3 +=================================================================== +--- secure/lib/libssl/man/SSL_CTX_set_options.3 (revision 273303) ++++ secure/lib/libssl/man/SSL_CTX_set_options.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "SSL_CTX_set_options 3" +-.TH SSL_CTX_set_options 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH SSL_CTX_set_options 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libssl/man/SSL_CTX_set_psk_client_callback.3 +=================================================================== +--- secure/lib/libssl/man/SSL_CTX_set_psk_client_callback.3 (revision 273303) ++++ secure/lib/libssl/man/SSL_CTX_set_psk_client_callback.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "SSL_CTX_set_psk_client_callback 3" +-.TH SSL_CTX_set_psk_client_callback 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH SSL_CTX_set_psk_client_callback 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libssl/man/SSL_CTX_set_quiet_shutdown.3 +=================================================================== +--- secure/lib/libssl/man/SSL_CTX_set_quiet_shutdown.3 (revision 273303) ++++ secure/lib/libssl/man/SSL_CTX_set_quiet_shutdown.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "SSL_CTX_set_quiet_shutdown 3" +-.TH SSL_CTX_set_quiet_shutdown 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH SSL_CTX_set_quiet_shutdown 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libssl/man/SSL_CTX_set_session_cache_mode.3 +=================================================================== +--- secure/lib/libssl/man/SSL_CTX_set_session_cache_mode.3 (revision 273303) ++++ secure/lib/libssl/man/SSL_CTX_set_session_cache_mode.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "SSL_CTX_set_session_cache_mode 3" +-.TH SSL_CTX_set_session_cache_mode 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH SSL_CTX_set_session_cache_mode 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libssl/man/SSL_CTX_set_session_id_context.3 +=================================================================== +--- secure/lib/libssl/man/SSL_CTX_set_session_id_context.3 (revision 273303) ++++ secure/lib/libssl/man/SSL_CTX_set_session_id_context.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "SSL_CTX_set_session_id_context 3" +-.TH SSL_CTX_set_session_id_context 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH SSL_CTX_set_session_id_context 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libssl/man/SSL_CTX_set_ssl_version.3 +=================================================================== +--- secure/lib/libssl/man/SSL_CTX_set_ssl_version.3 (revision 273303) ++++ secure/lib/libssl/man/SSL_CTX_set_ssl_version.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "SSL_CTX_set_ssl_version 3" +-.TH SSL_CTX_set_ssl_version 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH SSL_CTX_set_ssl_version 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libssl/man/SSL_CTX_set_timeout.3 +=================================================================== +--- secure/lib/libssl/man/SSL_CTX_set_timeout.3 (revision 273303) ++++ secure/lib/libssl/man/SSL_CTX_set_timeout.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "SSL_CTX_set_timeout 3" +-.TH SSL_CTX_set_timeout 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH SSL_CTX_set_timeout 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libssl/man/SSL_CTX_set_tlsext_ticket_key_cb.3 +=================================================================== +--- secure/lib/libssl/man/SSL_CTX_set_tlsext_ticket_key_cb.3 (revision 273303) ++++ secure/lib/libssl/man/SSL_CTX_set_tlsext_ticket_key_cb.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "SSL_CTX_set_tlsext_ticket_key_cb 3" +-.TH SSL_CTX_set_tlsext_ticket_key_cb 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH SSL_CTX_set_tlsext_ticket_key_cb 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libssl/man/SSL_CTX_set_tmp_dh_callback.3 +=================================================================== +--- secure/lib/libssl/man/SSL_CTX_set_tmp_dh_callback.3 (revision 273303) ++++ secure/lib/libssl/man/SSL_CTX_set_tmp_dh_callback.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "SSL_CTX_set_tmp_dh_callback 3" +-.TH SSL_CTX_set_tmp_dh_callback 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH SSL_CTX_set_tmp_dh_callback 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +@@ -175,12 +175,13 @@ even if he gets hold of the normal (certified) key + only used for signing. + .PP + In order to perform a \s-1DH\s0 key exchange the server must use a \s-1DH\s0 group +-(\s-1DH\s0 parameters) and generate a \s-1DH\s0 key. The server will always generate a new +-\&\s-1DH\s0 key during the negotiation, when the \s-1DH\s0 parameters are supplied via +-callback and/or when the \s-1SSL_OP_SINGLE_DH_USE\s0 option of +-\&\fISSL_CTX_set_options\fR\|(3) is set. It will +-immediately create a \s-1DH\s0 key, when \s-1DH\s0 parameters are supplied via +-\&\fISSL_CTX_set_tmp_dh()\fR and \s-1SSL_OP_SINGLE_DH_USE\s0 is not set. In this case, ++(\s-1DH\s0 parameters) and generate a \s-1DH\s0 key. ++The server will always generate a new \s-1DH\s0 key during the negotiation ++if either the \s-1DH\s0 parameters are supplied via callback or the ++\&\s-1SSL_OP_SINGLE_DH_USE\s0 option of \fISSL_CTX_set_options\fR\|(3) is set (or both). ++It will immediately create a \s-1DH\s0 key if \s-1DH\s0 parameters are supplied via ++\&\fISSL_CTX_set_tmp_dh()\fR and \s-1SSL_OP_SINGLE_DH_USE\s0 is not set. ++In this case, + it may happen that a key is generated on initialization without later + being needed, while on the other hand the computer time during the + negotiation is being saved. +@@ -266,7 +267,7 @@ partly left out.) + \& dh_tmp = dh_512; + \& break; + \& case 1024: +-\& if (!dh_1024) ++\& if (!dh_1024) + \& dh_1024 = get_dh1024(); + \& dh_tmp = dh_1024; + \& break; +Index: secure/lib/libssl/man/SSL_CTX_set_tmp_rsa_callback.3 +=================================================================== +--- secure/lib/libssl/man/SSL_CTX_set_tmp_rsa_callback.3 (revision 273303) ++++ secure/lib/libssl/man/SSL_CTX_set_tmp_rsa_callback.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "SSL_CTX_set_tmp_rsa_callback 3" +-.TH SSL_CTX_set_tmp_rsa_callback 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH SSL_CTX_set_tmp_rsa_callback 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libssl/man/SSL_CTX_set_verify.3 +=================================================================== +--- secure/lib/libssl/man/SSL_CTX_set_verify.3 (revision 273303) ++++ secure/lib/libssl/man/SSL_CTX_set_verify.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "SSL_CTX_set_verify 3" +-.TH SSL_CTX_set_verify 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH SSL_CTX_set_verify 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libssl/man/SSL_CTX_use_certificate.3 +=================================================================== +--- secure/lib/libssl/man/SSL_CTX_use_certificate.3 (revision 273303) ++++ secure/lib/libssl/man/SSL_CTX_use_certificate.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "SSL_CTX_use_certificate 3" +-.TH SSL_CTX_use_certificate 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH SSL_CTX_use_certificate 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libssl/man/SSL_CTX_use_psk_identity_hint.3 +=================================================================== +--- secure/lib/libssl/man/SSL_CTX_use_psk_identity_hint.3 (revision 273303) ++++ secure/lib/libssl/man/SSL_CTX_use_psk_identity_hint.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "SSL_CTX_use_psk_identity_hint 3" +-.TH SSL_CTX_use_psk_identity_hint 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH SSL_CTX_use_psk_identity_hint 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libssl/man/SSL_SESSION_free.3 +=================================================================== +--- secure/lib/libssl/man/SSL_SESSION_free.3 (revision 273303) ++++ secure/lib/libssl/man/SSL_SESSION_free.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "SSL_SESSION_free 3" +-.TH SSL_SESSION_free 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH SSL_SESSION_free 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libssl/man/SSL_SESSION_get_ex_new_index.3 +=================================================================== +--- secure/lib/libssl/man/SSL_SESSION_get_ex_new_index.3 (revision 273303) ++++ secure/lib/libssl/man/SSL_SESSION_get_ex_new_index.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "SSL_SESSION_get_ex_new_index 3" +-.TH SSL_SESSION_get_ex_new_index 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH SSL_SESSION_get_ex_new_index 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libssl/man/SSL_SESSION_get_time.3 +=================================================================== +--- secure/lib/libssl/man/SSL_SESSION_get_time.3 (revision 273303) ++++ secure/lib/libssl/man/SSL_SESSION_get_time.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "SSL_SESSION_get_time 3" +-.TH SSL_SESSION_get_time 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH SSL_SESSION_get_time 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libssl/man/SSL_accept.3 +=================================================================== +--- secure/lib/libssl/man/SSL_accept.3 (revision 273303) ++++ secure/lib/libssl/man/SSL_accept.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "SSL_accept 3" +-.TH SSL_accept 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH SSL_accept 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libssl/man/SSL_alert_type_string.3 +=================================================================== +--- secure/lib/libssl/man/SSL_alert_type_string.3 (revision 273303) ++++ secure/lib/libssl/man/SSL_alert_type_string.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "SSL_alert_type_string 3" +-.TH SSL_alert_type_string 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH SSL_alert_type_string 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libssl/man/SSL_clear.3 +=================================================================== +--- secure/lib/libssl/man/SSL_clear.3 (revision 273303) ++++ secure/lib/libssl/man/SSL_clear.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "SSL_clear 3" +-.TH SSL_clear 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH SSL_clear 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libssl/man/SSL_connect.3 +=================================================================== +--- secure/lib/libssl/man/SSL_connect.3 (revision 273303) ++++ secure/lib/libssl/man/SSL_connect.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "SSL_connect 3" +-.TH SSL_connect 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH SSL_connect 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libssl/man/SSL_do_handshake.3 +=================================================================== +--- secure/lib/libssl/man/SSL_do_handshake.3 (revision 273303) ++++ secure/lib/libssl/man/SSL_do_handshake.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "SSL_do_handshake 3" +-.TH SSL_do_handshake 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH SSL_do_handshake 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libssl/man/SSL_free.3 +=================================================================== +--- secure/lib/libssl/man/SSL_free.3 (revision 273303) ++++ secure/lib/libssl/man/SSL_free.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "SSL_free 3" +-.TH SSL_free 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH SSL_free 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libssl/man/SSL_get_SSL_CTX.3 +=================================================================== +--- secure/lib/libssl/man/SSL_get_SSL_CTX.3 (revision 273303) ++++ secure/lib/libssl/man/SSL_get_SSL_CTX.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "SSL_get_SSL_CTX 3" +-.TH SSL_get_SSL_CTX 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH SSL_get_SSL_CTX 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libssl/man/SSL_get_ciphers.3 +=================================================================== +--- secure/lib/libssl/man/SSL_get_ciphers.3 (revision 273303) ++++ secure/lib/libssl/man/SSL_get_ciphers.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "SSL_get_ciphers 3" +-.TH SSL_get_ciphers 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH SSL_get_ciphers 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libssl/man/SSL_get_client_CA_list.3 +=================================================================== +--- secure/lib/libssl/man/SSL_get_client_CA_list.3 (revision 273303) ++++ secure/lib/libssl/man/SSL_get_client_CA_list.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "SSL_get_client_CA_list 3" +-.TH SSL_get_client_CA_list 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH SSL_get_client_CA_list 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libssl/man/SSL_get_current_cipher.3 +=================================================================== +--- secure/lib/libssl/man/SSL_get_current_cipher.3 (revision 273303) ++++ secure/lib/libssl/man/SSL_get_current_cipher.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "SSL_get_current_cipher 3" +-.TH SSL_get_current_cipher 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH SSL_get_current_cipher 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libssl/man/SSL_get_default_timeout.3 +=================================================================== +--- secure/lib/libssl/man/SSL_get_default_timeout.3 (revision 273303) ++++ secure/lib/libssl/man/SSL_get_default_timeout.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "SSL_get_default_timeout 3" +-.TH SSL_get_default_timeout 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH SSL_get_default_timeout 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libssl/man/SSL_get_error.3 +=================================================================== +--- secure/lib/libssl/man/SSL_get_error.3 (revision 273303) ++++ secure/lib/libssl/man/SSL_get_error.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "SSL_get_error 3" +-.TH SSL_get_error 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH SSL_get_error 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libssl/man/SSL_get_ex_data_X509_STORE_CTX_idx.3 +=================================================================== +--- secure/lib/libssl/man/SSL_get_ex_data_X509_STORE_CTX_idx.3 (revision 273303) ++++ secure/lib/libssl/man/SSL_get_ex_data_X509_STORE_CTX_idx.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "SSL_get_ex_data_X509_STORE_CTX_idx 3" +-.TH SSL_get_ex_data_X509_STORE_CTX_idx 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH SSL_get_ex_data_X509_STORE_CTX_idx 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libssl/man/SSL_get_ex_new_index.3 +=================================================================== +--- secure/lib/libssl/man/SSL_get_ex_new_index.3 (revision 273303) ++++ secure/lib/libssl/man/SSL_get_ex_new_index.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "SSL_get_ex_new_index 3" +-.TH SSL_get_ex_new_index 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH SSL_get_ex_new_index 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libssl/man/SSL_get_fd.3 +=================================================================== +--- secure/lib/libssl/man/SSL_get_fd.3 (revision 273303) ++++ secure/lib/libssl/man/SSL_get_fd.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "SSL_get_fd 3" +-.TH SSL_get_fd 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH SSL_get_fd 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libssl/man/SSL_get_peer_cert_chain.3 +=================================================================== +--- secure/lib/libssl/man/SSL_get_peer_cert_chain.3 (revision 273303) ++++ secure/lib/libssl/man/SSL_get_peer_cert_chain.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "SSL_get_peer_cert_chain 3" +-.TH SSL_get_peer_cert_chain 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH SSL_get_peer_cert_chain 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libssl/man/SSL_get_peer_certificate.3 +=================================================================== +--- secure/lib/libssl/man/SSL_get_peer_certificate.3 (revision 273303) ++++ secure/lib/libssl/man/SSL_get_peer_certificate.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "SSL_get_peer_certificate 3" +-.TH SSL_get_peer_certificate 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH SSL_get_peer_certificate 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libssl/man/SSL_get_psk_identity.3 +=================================================================== +--- secure/lib/libssl/man/SSL_get_psk_identity.3 (revision 273303) ++++ secure/lib/libssl/man/SSL_get_psk_identity.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "SSL_get_psk_identity 3" +-.TH SSL_get_psk_identity 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH SSL_get_psk_identity 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libssl/man/SSL_get_rbio.3 +=================================================================== +--- secure/lib/libssl/man/SSL_get_rbio.3 (revision 273303) ++++ secure/lib/libssl/man/SSL_get_rbio.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "SSL_get_rbio 3" +-.TH SSL_get_rbio 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH SSL_get_rbio 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libssl/man/SSL_get_session.3 +=================================================================== +--- secure/lib/libssl/man/SSL_get_session.3 (revision 273303) ++++ secure/lib/libssl/man/SSL_get_session.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "SSL_get_session 3" +-.TH SSL_get_session 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH SSL_get_session 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libssl/man/SSL_get_verify_result.3 +=================================================================== +--- secure/lib/libssl/man/SSL_get_verify_result.3 (revision 273303) ++++ secure/lib/libssl/man/SSL_get_verify_result.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "SSL_get_verify_result 3" +-.TH SSL_get_verify_result 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH SSL_get_verify_result 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libssl/man/SSL_get_version.3 +=================================================================== +--- secure/lib/libssl/man/SSL_get_version.3 (revision 273303) ++++ secure/lib/libssl/man/SSL_get_version.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "SSL_get_version 3" +-.TH SSL_get_version 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH SSL_get_version 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libssl/man/SSL_library_init.3 +=================================================================== +--- secure/lib/libssl/man/SSL_library_init.3 (revision 273303) ++++ secure/lib/libssl/man/SSL_library_init.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "SSL_library_init 3" +-.TH SSL_library_init 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH SSL_library_init 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libssl/man/SSL_load_client_CA_file.3 +=================================================================== +--- secure/lib/libssl/man/SSL_load_client_CA_file.3 (revision 273303) ++++ secure/lib/libssl/man/SSL_load_client_CA_file.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "SSL_load_client_CA_file 3" +-.TH SSL_load_client_CA_file 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH SSL_load_client_CA_file 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libssl/man/SSL_new.3 +=================================================================== +--- secure/lib/libssl/man/SSL_new.3 (revision 273303) ++++ secure/lib/libssl/man/SSL_new.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "SSL_new 3" +-.TH SSL_new 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH SSL_new 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libssl/man/SSL_pending.3 +=================================================================== +--- secure/lib/libssl/man/SSL_pending.3 (revision 273303) ++++ secure/lib/libssl/man/SSL_pending.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "SSL_pending 3" +-.TH SSL_pending 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH SSL_pending 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libssl/man/SSL_read.3 +=================================================================== +--- secure/lib/libssl/man/SSL_read.3 (revision 273303) ++++ secure/lib/libssl/man/SSL_read.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "SSL_read 3" +-.TH SSL_read 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH SSL_read 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libssl/man/SSL_rstate_string.3 +=================================================================== +--- secure/lib/libssl/man/SSL_rstate_string.3 (revision 273303) ++++ secure/lib/libssl/man/SSL_rstate_string.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "SSL_rstate_string 3" +-.TH SSL_rstate_string 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH SSL_rstate_string 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libssl/man/SSL_session_reused.3 +=================================================================== +--- secure/lib/libssl/man/SSL_session_reused.3 (revision 273303) ++++ secure/lib/libssl/man/SSL_session_reused.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "SSL_session_reused 3" +-.TH SSL_session_reused 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH SSL_session_reused 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libssl/man/SSL_set_bio.3 +=================================================================== +--- secure/lib/libssl/man/SSL_set_bio.3 (revision 273303) ++++ secure/lib/libssl/man/SSL_set_bio.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "SSL_set_bio 3" +-.TH SSL_set_bio 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH SSL_set_bio 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libssl/man/SSL_set_connect_state.3 +=================================================================== +--- secure/lib/libssl/man/SSL_set_connect_state.3 (revision 273303) ++++ secure/lib/libssl/man/SSL_set_connect_state.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "SSL_set_connect_state 3" +-.TH SSL_set_connect_state 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH SSL_set_connect_state 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libssl/man/SSL_set_fd.3 +=================================================================== +--- secure/lib/libssl/man/SSL_set_fd.3 (revision 273303) ++++ secure/lib/libssl/man/SSL_set_fd.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "SSL_set_fd 3" +-.TH SSL_set_fd 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH SSL_set_fd 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libssl/man/SSL_set_session.3 +=================================================================== +--- secure/lib/libssl/man/SSL_set_session.3 (revision 273303) ++++ secure/lib/libssl/man/SSL_set_session.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "SSL_set_session 3" +-.TH SSL_set_session 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH SSL_set_session 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libssl/man/SSL_set_shutdown.3 +=================================================================== +--- secure/lib/libssl/man/SSL_set_shutdown.3 (revision 273303) ++++ secure/lib/libssl/man/SSL_set_shutdown.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "SSL_set_shutdown 3" +-.TH SSL_set_shutdown 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH SSL_set_shutdown 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libssl/man/SSL_set_verify_result.3 +=================================================================== +--- secure/lib/libssl/man/SSL_set_verify_result.3 (revision 273303) ++++ secure/lib/libssl/man/SSL_set_verify_result.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "SSL_set_verify_result 3" +-.TH SSL_set_verify_result 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH SSL_set_verify_result 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libssl/man/SSL_shutdown.3 +=================================================================== +--- secure/lib/libssl/man/SSL_shutdown.3 (revision 273303) ++++ secure/lib/libssl/man/SSL_shutdown.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "SSL_shutdown 3" +-.TH SSL_shutdown 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH SSL_shutdown 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libssl/man/SSL_state_string.3 +=================================================================== +--- secure/lib/libssl/man/SSL_state_string.3 (revision 273303) ++++ secure/lib/libssl/man/SSL_state_string.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "SSL_state_string 3" +-.TH SSL_state_string 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH SSL_state_string 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libssl/man/SSL_want.3 +=================================================================== +--- secure/lib/libssl/man/SSL_want.3 (revision 273303) ++++ secure/lib/libssl/man/SSL_want.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "SSL_want 3" +-.TH SSL_want 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH SSL_want 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libssl/man/SSL_write.3 +=================================================================== +--- secure/lib/libssl/man/SSL_write.3 (revision 273303) ++++ secure/lib/libssl/man/SSL_write.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "SSL_write 3" +-.TH SSL_write 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH SSL_write 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libssl/man/d2i_SSL_SESSION.3 +=================================================================== +--- secure/lib/libssl/man/d2i_SSL_SESSION.3 (revision 273303) ++++ secure/lib/libssl/man/d2i_SSL_SESSION.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "d2i_SSL_SESSION 3" +-.TH d2i_SSL_SESSION 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH d2i_SSL_SESSION 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libssl/man/ssl.3 +=================================================================== +--- secure/lib/libssl/man/ssl.3 (revision 273303) ++++ secure/lib/libssl/man/ssl.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "ssl 3" +-.TH ssl 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH ssl 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/usr.bin/openssl/Makefile.man +=================================================================== +--- secure/usr.bin/openssl/Makefile.man (revision 273303) ++++ secure/usr.bin/openssl/Makefile.man (working copy) +@@ -2,6 +2,7 @@ + # DO NOT EDIT: generated from man-makefile-update target + MAN+= CA.pl.1 + MAN+= asn1parse.1 ++MAN+= c_rehash.1 + MAN+= ca.1 + MAN+= ciphers.1 + MAN+= cms.1 +@@ -45,10 +46,15 @@ MAN+= verify.1 + MAN+= version.1 + MAN+= x509.1 + MAN+= x509v3_config.1 +-MLINKS+= dgst.1 md5.1 +-MLINKS+= dgst.1 md4.1 +-MLINKS+= dgst.1 md2.1 ++MLINKS+= dgst.1 sha.1 + MLINKS+= dgst.1 sha1.1 +-MLINKS+= dgst.1 sha.1 + MLINKS+= dgst.1 mdc2.1 + MLINKS+= dgst.1 ripemd160.1 ++MLINKS+= dgst.1 sha224.1 ++MLINKS+= dgst.1 sha256.1 ++MLINKS+= dgst.1 sha384.1 ++MLINKS+= dgst.1 sha512.1 ++MLINKS+= dgst.1 md2.1 ++MLINKS+= dgst.1 md4.1 ++MLINKS+= dgst.1 md5.1 ++MLINKS+= dgst.1 dss1.1 +Index: secure/usr.bin/openssl/man/CA.pl.1 +=================================================================== +--- secure/usr.bin/openssl/man/CA.pl.1 (revision 273303) ++++ secure/usr.bin/openssl/man/CA.pl.1 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "CA.PL 1" +-.TH CA.PL 1 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH CA.PL 1 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/usr.bin/openssl/man/asn1parse.1 +=================================================================== +--- secure/usr.bin/openssl/man/asn1parse.1 (revision 273303) ++++ secure/usr.bin/openssl/man/asn1parse.1 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "ASN1PARSE 1" +-.TH ASN1PARSE 1 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH ASN1PARSE 1 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/usr.bin/openssl/man/c_rehash.1 +=================================================================== +--- secure/usr.bin/openssl/man/c_rehash.1 (revision 0) ++++ secure/usr.bin/openssl/man/c_rehash.1 (working copy) +@@ -0,0 +1,199 @@ ++.\" Automatically generated by Pod::Man 2.25 (Pod::Simple 3.28) ++.\" ++.\" Standard preamble: ++.\" ======================================================================== ++.de Sp \" Vertical space (when we can't use .PP) ++.if t .sp .5v ++.if n .sp ++.. ++.de Vb \" Begin verbatim text ++.ft CW ++.nf ++.ne \\$1 ++.. ++.de Ve \" End verbatim text ++.ft R ++.fi ++.. ++.\" Set up some character translations and predefined strings. \*(-- will ++.\" give an unbreakable dash, \*(PI will give pi, \*(L" will give a left ++.\" double quote, and \*(R" will give a right double quote. \*(C+ will ++.\" give a nicer C++. Capital omega is used to do unbreakable dashes and ++.\" therefore won't be available. \*(C` and \*(C' expand to `' in nroff, ++.\" nothing in troff, for use with C<>. ++.tr \(*W- ++.ds C+ C\v'-.1v'\h'-1p'\s-2+\h'-1p'+\s0\v'.1v'\h'-1p' ++.ie n \{\ ++. ds -- \(*W- ++. ds PI pi ++. if (\n(.H=4u)&(1m=24u) .ds -- \(*W\h'-12u'\(*W\h'-12u'-\" diablo 10 pitch ++. if (\n(.H=4u)&(1m=20u) .ds -- \(*W\h'-12u'\(*W\h'-8u'-\" diablo 12 pitch ++. ds L" "" ++. ds R" "" ++. ds C` "" ++. ds C' "" ++'br\} ++.el\{\ ++. ds -- \|\(em\| ++. ds PI \(*p ++. ds L" `` ++. ds R" '' ++'br\} ++.\" ++.\" Escape single quotes in literal strings from groff's Unicode transform. ++.ie \n(.g .ds Aq \(aq ++.el .ds Aq ' ++.\" ++.\" If the F register is turned on, we'll generate index entries on stderr for ++.\" titles (.TH), headers (.SH), subsections (.SS), items (.Ip), and index ++.\" entries marked with X<> in POD. Of course, you'll have to process the ++.\" output yourself in some meaningful fashion. ++.ie \nF \{\ ++. de IX ++. tm Index:\\$1\t\\n%\t"\\$2" ++.. ++. nr % 0 ++. rr F ++.\} ++.el \{\ ++. de IX ++.. ++.\} ++.\" ++.\" Accent mark definitions (@(#)ms.acc 1.5 88/02/08 SMI; from UCB 4.2). ++.\" Fear. Run. Save yourself. No user-serviceable parts. ++. \" fudge factors for nroff and troff ++.if n \{\ ++. ds #H 0 ++. ds #V .8m ++. ds #F .3m ++. ds #[ \f1 ++. ds #] \fP ++.\} ++.if t \{\ ++. ds #H ((1u-(\\\\n(.fu%2u))*.13m) ++. ds #V .6m ++. ds #F 0 ++. ds #[ \& ++. ds #] \& ++.\} ++. \" simple accents for nroff and troff ++.if n \{\ ++. ds ' \& ++. ds ` \& ++. ds ^ \& ++. ds , \& ++. ds ~ ~ ++. ds / ++.\} ++.if t \{\ ++. ds ' \\k:\h'-(\\n(.wu*8/10-\*(#H)'\'\h"|\\n:u" ++. ds ` \\k:\h'-(\\n(.wu*8/10-\*(#H)'\`\h'|\\n:u' ++. ds ^ \\k:\h'-(\\n(.wu*10/11-\*(#H)'^\h'|\\n:u' ++. ds , \\k:\h'-(\\n(.wu*8/10)',\h'|\\n:u' ++. ds ~ \\k:\h'-(\\n(.wu-\*(#H-.1m)'~\h'|\\n:u' ++. ds / \\k:\h'-(\\n(.wu*8/10-\*(#H)'\z\(sl\h'|\\n:u' ++.\} ++. \" troff and (daisy-wheel) nroff accents ++.ds : \\k:\h'-(\\n(.wu*8/10-\*(#H+.1m+\*(#F)'\v'-\*(#V'\z.\h'.2m+\*(#F'.\h'|\\n:u'\v'\*(#V' ++.ds 8 \h'\*(#H'\(*b\h'-\*(#H' ++.ds o \\k:\h'-(\\n(.wu+\w'\(de'u-\*(#H)/2u'\v'-.3n'\*(#[\z\(de\v'.3n'\h'|\\n:u'\*(#] ++.ds d- \h'\*(#H'\(pd\h'-\w'~'u'\v'-.25m'\f2\(hy\fP\v'.25m'\h'-\*(#H' ++.ds D- D\\k:\h'-\w'D'u'\v'-.11m'\z\(hy\v'.11m'\h'|\\n:u' ++.ds th \*(#[\v'.3m'\s+1I\s-1\v'-.3m'\h'-(\w'I'u*2/3)'\s-1o\s+1\*(#] ++.ds Th \*(#[\s+2I\s-2\h'-\w'I'u*3/5'\v'-.3m'o\v'.3m'\*(#] ++.ds ae a\h'-(\w'a'u*4/10)'e ++.ds Ae A\h'-(\w'A'u*4/10)'E ++. \" corrections for vroff ++.if v .ds ~ \\k:\h'-(\\n(.wu*9/10-\*(#H)'\s-2\u~\d\s+2\h'|\\n:u' ++.if v .ds ^ \\k:\h'-(\\n(.wu*10/11-\*(#H)'\v'-.4m'^\v'.4m'\h'|\\n:u' ++. \" for low resolution devices (crt and lpr) ++.if \n(.H>23 .if \n(.V>19 \ ++\{\ ++. ds : e ++. ds 8 ss ++. ds o a ++. ds d- d\h'-1'\(ga ++. ds D- D\h'-1'\(hy ++. ds th \o'bp' ++. ds Th \o'LP' ++. ds ae ae ++. ds Ae AE ++.\} ++.rm #[ #] #H #V #F C ++.\" ======================================================================== ++.\" ++.IX Title "C_REHASH 1" ++.TH C_REHASH 1 "2014-10-15" "1.0.1j" "OpenSSL" ++.\" For nroff, turn off justification. Always turn off hyphenation; it makes ++.\" way too many mistakes in technical documents. ++.if n .ad l ++.nh ++.SH "NAME" ++c_rehash \- Create symbolic links to files named by the hash values ++.SH "SYNOPSIS" ++.IX Header "SYNOPSIS" ++\&\fBc_rehash\fR ++[ \fIdirectory\fR...] ++.SH "DESCRIPTION" ++.IX Header "DESCRIPTION" ++\&\fBc_rehash\fR scans directories and calculates a hash value of each \f(CW\*(C`.pem\*(C'\fR ++file in the specified directory list and creates symbolic links ++for each file, where the name of the link is the hash value. ++This utility is useful as many programs that use OpenSSL require ++directories to be set up like this in order to find certificates. ++.PP ++If any directories are named on the command line, then those are ++processed in turn. If not, then the \fB\s-1SSL_CERT_DIR\s0\fR environment variable ++is consulted; this shold be a colon-separated list of directories, ++like the Unix \fB\s-1PATH\s0\fR variable. ++If that is not set then the default directory (installation-specific ++but often \fB/usr/local/ssl/certs\fR) is processed. ++.PP ++In order for a directory to be processed, the user must have write ++permissions on that directory, otherwise it will be skipped. ++The links created are of the form \f(CW\*(C`HHHHHHHH.D\*(C'\fR, where each \fBH\fR ++is a hexadecimal character and \fBD\fR is a single decimal digit. ++When processing a directory, \fBc_rehash\fR will first remove all links ++that have a name in that syntax. If you have links in that format ++used for other purposes, they will be removed. ++Hashes for \s-1CRL\s0's look similar except the letter \fBr\fR appears after ++the period, like this: \f(CW\*(C`HHHHHHHH.rD\*(C'\fR. ++.PP ++Multiple objects may have the same hash; they will be indicated by ++incrementing the \fBD\fR value. Duplicates are found by comparing the ++full \s-1SHA\-1\s0 fingerprint. A warning will be displayed if a duplicate ++is found. ++.PP ++A warning will also be displayed if there are \fB.pem\fR files that ++cannot be parsed as either a certificate or a \s-1CRL\s0. ++.PP ++The program uses the \fBopenssl\fR program to compute the hashes and ++fingerprints. If not found in the user's \fB\s-1PATH\s0\fR, then set the ++\&\fB\s-1OPENSSL\s0\fR environment variable to the full pathname. ++Any program can be used, it will be invoked as follows for either ++a certificate or \s-1CRL:\s0 ++.PP ++.Vb 2 ++\& $OPENSSL x509 \-hash \-fingerprint \-noout \-in FFFFFF ++\& $OPENSSL crl \-hash \-fingerprint \-noout \-in FFFFFF ++.Ve ++.PP ++where \fB\s-1FFFFFF\s0\fR is the filename. It must output the hash of the ++file on the first line, and the fingerprint on the second, ++optionally prefixed with some text and an equals sign. ++.SH "ENVIRONMENT" ++.IX Header "ENVIRONMENT" ++.IP "\fB\s-1OPENSSL\s0\fR" 4 ++.IX Item "OPENSSL" ++The path to an executable to use to generate hashes and ++fingerprints (see above). ++.IP "\fB\s-1SSL_CERT_DIR\s0\fR" 4 ++.IX Item "SSL_CERT_DIR" ++Colon separated list of directories to operate on. ++Ignored if directories are listed on the command line. ++.SH "SEE ALSO" ++.IX Header "SEE ALSO" ++\&\fIopenssl\fR\|(1), ++\&\fIcrl\fR\|(1). ++\&\fIx509\fR\|(1). + +Property changes on: secure/usr.bin/openssl/man/c_rehash.1 +___________________________________________________________________ +Added: svn:keywords +## -0,0 +1 ## ++FreeBSD=%H +\ No newline at end of property +Added: svn:eol-style +## -0,0 +1 ## ++native +\ No newline at end of property +Added: svn:mime-type +## -0,0 +1 ## ++text/plain +\ No newline at end of property +Index: secure/usr.bin/openssl/man/ca.1 +=================================================================== +--- secure/usr.bin/openssl/man/ca.1 (revision 273303) ++++ secure/usr.bin/openssl/man/ca.1 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "CA 1" +-.TH CA 1 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH CA 1 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/usr.bin/openssl/man/ciphers.1 +=================================================================== +--- secure/usr.bin/openssl/man/ciphers.1 (revision 273303) ++++ secure/usr.bin/openssl/man/ciphers.1 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "CIPHERS 1" +-.TH CIPHERS 1 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH CIPHERS 1 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/usr.bin/openssl/man/cms.1 +=================================================================== +--- secure/usr.bin/openssl/man/cms.1 (revision 273303) ++++ secure/usr.bin/openssl/man/cms.1 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "CMS 1" +-.TH CMS 1 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH CMS 1 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/usr.bin/openssl/man/crl.1 +=================================================================== +--- secure/usr.bin/openssl/man/crl.1 (revision 273303) ++++ secure/usr.bin/openssl/man/crl.1 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "CRL 1" +-.TH CRL 1 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH CRL 1 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/usr.bin/openssl/man/crl2pkcs7.1 +=================================================================== +--- secure/usr.bin/openssl/man/crl2pkcs7.1 (revision 273303) ++++ secure/usr.bin/openssl/man/crl2pkcs7.1 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "CRL2PKCS7 1" +-.TH CRL2PKCS7 1 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH CRL2PKCS7 1 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/usr.bin/openssl/man/dgst.1 +=================================================================== +--- secure/usr.bin/openssl/man/dgst.1 (revision 273303) ++++ secure/usr.bin/openssl/man/dgst.1 (working copy) +@@ -124,21 +124,22 @@ + .\" ======================================================================== + .\" + .IX Title "DGST 1" +-.TH DGST 1 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH DGST 1 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l + .nh + .SH "NAME" +-dgst, md5, md4, md2, sha1, sha, mdc2, ripemd160 \- message digests ++dgst, sha, sha1, mdc2, ripemd160, sha224, sha256, sha384, sha512, md2, md4, md5, dss1 \- message digests + .SH "SYNOPSIS" + .IX Header "SYNOPSIS" + \&\fBopenssl\fR \fBdgst\fR +-[\fB\-md5|\-md4|\-md2|\-sha1|\-sha|\-mdc2|\-ripemd160|\-dss1\fR] ++[\fB\-sha|\-sha1|\-mdc2|\-ripemd160|\-sha224|\-sha256|\-sha384|\-sha512|\-md2|\-md4|\-md5|\-dss1\fR] + [\fB\-c\fR] + [\fB\-d\fR] + [\fB\-hex\fR] + [\fB\-binary\fR] ++[\fB\-r\fR] + [\fB\-out filename\fR] + [\fB\-sign filename\fR] + [\fB\-keyform arg\fR] +@@ -147,16 +148,18 @@ + [\fB\-prverify filename\fR] + [\fB\-signature filename\fR] + [\fB\-hmac key\fR] ++[\fB\-non\-fips\-allow\fR] ++[\fB\-fips\-fingerprint\fR] + [\fBfile...\fR] + .PP +-[\fBmd5|md4|md2|sha1|sha|mdc2|ripemd160\fR] +-[\fB\-c\fR] +-[\fB\-d\fR] +-[\fBfile...\fR] ++\&\fBopenssl\fR ++[\fIdigest\fR] ++[\fB...\fR] + .SH "DESCRIPTION" + .IX Header "DESCRIPTION" + The digest functions output the message digest of a supplied file or files +-in hexadecimal form. They can also be used for digital signing and verification. ++in hexadecimal. The digest functions also generate and verify digital ++signatures using message digests. + .SH "OPTIONS" + .IX Header "OPTIONS" + .IP "\fB\-c\fR" 4 +@@ -169,10 +172,14 @@ print out \s-1BIO\s0 debugging information. + .IP "\fB\-hex\fR" 4 + .IX Item "-hex" + digest is to be output as a hex dump. This is the default case for a \*(L"normal\*(R" +-digest as opposed to a digital signature. ++digest as opposed to a digital signature. See \s-1NOTES\s0 below for digital ++signatures using \fB\-hex\fR. + .IP "\fB\-binary\fR" 4 + .IX Item "-binary" + output the digest or signature in binary form. ++.IP "\fB\-r\fR" 4 ++.IX Item "-r" ++output the digest in the \*(L"coreutils\*(R" format used by programs like \fBsha1sum\fR. + .IP "\fB\-out filename\fR" 4 + .IX Item "-out filename" + filename to output to, or standard output by default. +@@ -181,8 +188,8 @@ filename to output to, or standard output by defau + digitally sign the digest using the private key in \*(L"filename\*(R". + .IP "\fB\-keyform arg\fR" 4 + .IX Item "-keyform arg" +-Specifies the key format to sign digest with. Only \s-1PEM\s0 and \s-1ENGINE\s0 +-formats are supported by the \fBdgst\fR command. ++Specifies the key format to sign digest with. The \s-1DER\s0, \s-1PEM\s0, P12, ++and \s-1ENGINE\s0 formats are supported. + .IP "\fB\-engine id\fR" 4 + .IX Item "-engine id" + Use engine \fBid\fR for operations (including private key storage). +@@ -241,20 +248,46 @@ generator, or an \s-1EGD\s0 socket (see \fIRAND_eg + Multiple files can be specified separated by a OS-dependent character. + The separator is \fB;\fR for MS-Windows, \fB,\fR for OpenVMS, and \fB:\fR for + all others. ++.IP "\fB\-non\-fips\-allow\fR" 4 ++.IX Item "-non-fips-allow" ++enable use of non-FIPS algorithms such as \s-1MD5\s0 even in \s-1FIPS\s0 mode. ++.IP "\fB\-fips\-fingerprint\fR" 4 ++.IX Item "-fips-fingerprint" ++compute \s-1HMAC\s0 using a specific key ++for certain OpenSSL-FIPS operations. + .IP "\fBfile...\fR" 4 + .IX Item "file..." + file or files to digest. If no files are specified then standard input is + used. ++.SH "EXAMPLES" ++.IX Header "EXAMPLES" ++To create a hex-encoded message digest of a file: ++ openssl dgst \-md5 \-hex file.txt ++.PP ++To sign a file using \s-1SHA\-256\s0 with binary file output: ++ openssl dgst \-sha256 \-sign privatekey.pem \-out signature.sign file.txt ++.PP ++To verify a signature: ++ openssl dgst \-sha256 \-verify publickey.pem \e ++ \-signature signature.sign \e ++ file.txt + .SH "NOTES" + .IX Header "NOTES" + The digest of choice for all new applications is \s-1SHA1\s0. Other digests are + however still widely used. + .PP +-If you wish to sign or verify data using the \s-1DSA\s0 algorithm then the dss1 +-digest must be used. ++When signing a file, \fBdgst\fR will automatically determine the algorithm ++(\s-1RSA\s0, \s-1ECC\s0, etc) to use for signing based on the private key's \s-1ASN\s0.1 info. ++When verifying signatures, it only handles the \s-1RSA\s0, \s-1DSA\s0, or \s-1ECDSA\s0 signature ++itself, not the related data to identify the signer and algorithm used in ++formats such as x.509, \s-1CMS\s0, and S/MIME. + .PP + A source of random numbers is required for certain signing algorithms, in +-particular \s-1DSA\s0. ++particular \s-1ECDSA\s0 and \s-1DSA\s0. + .PP + The signing and verify options should only be used if a single file is + being signed or verified. ++.PP ++Hex signatures cannot be verified using \fBopenssl\fR. Instead, use \*(L"xxd \-r\*(R" ++or similar program to transform the hex signature into a binary signature ++prior to verification. +Index: secure/usr.bin/openssl/man/dhparam.1 +=================================================================== +--- secure/usr.bin/openssl/man/dhparam.1 (revision 273303) ++++ secure/usr.bin/openssl/man/dhparam.1 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "DHPARAM 1" +-.TH DHPARAM 1 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH DHPARAM 1 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/usr.bin/openssl/man/dsa.1 +=================================================================== +--- secure/usr.bin/openssl/man/dsa.1 (revision 273303) ++++ secure/usr.bin/openssl/man/dsa.1 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "DSA 1" +-.TH DSA 1 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH DSA 1 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/usr.bin/openssl/man/dsaparam.1 +=================================================================== +--- secure/usr.bin/openssl/man/dsaparam.1 (revision 273303) ++++ secure/usr.bin/openssl/man/dsaparam.1 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "DSAPARAM 1" +-.TH DSAPARAM 1 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH DSAPARAM 1 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/usr.bin/openssl/man/ec.1 +=================================================================== +--- secure/usr.bin/openssl/man/ec.1 (revision 273303) ++++ secure/usr.bin/openssl/man/ec.1 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "EC 1" +-.TH EC 1 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH EC 1 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/usr.bin/openssl/man/ecparam.1 +=================================================================== +--- secure/usr.bin/openssl/man/ecparam.1 (revision 273303) ++++ secure/usr.bin/openssl/man/ecparam.1 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "ECPARAM 1" +-.TH ECPARAM 1 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH ECPARAM 1 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/usr.bin/openssl/man/enc.1 +=================================================================== +--- secure/usr.bin/openssl/man/enc.1 (revision 273303) ++++ secure/usr.bin/openssl/man/enc.1 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "ENC 1" +-.TH ENC 1 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH ENC 1 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/usr.bin/openssl/man/errstr.1 +=================================================================== +--- secure/usr.bin/openssl/man/errstr.1 (revision 273303) ++++ secure/usr.bin/openssl/man/errstr.1 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "ERRSTR 1" +-.TH ERRSTR 1 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH ERRSTR 1 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/usr.bin/openssl/man/gendsa.1 +=================================================================== +--- secure/usr.bin/openssl/man/gendsa.1 (revision 273303) ++++ secure/usr.bin/openssl/man/gendsa.1 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "GENDSA 1" +-.TH GENDSA 1 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH GENDSA 1 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/usr.bin/openssl/man/genpkey.1 +=================================================================== +--- secure/usr.bin/openssl/man/genpkey.1 (revision 273303) ++++ secure/usr.bin/openssl/man/genpkey.1 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "GENPKEY 1" +-.TH GENPKEY 1 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH GENPKEY 1 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/usr.bin/openssl/man/genrsa.1 +=================================================================== +--- secure/usr.bin/openssl/man/genrsa.1 (revision 273303) ++++ secure/usr.bin/openssl/man/genrsa.1 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "GENRSA 1" +-.TH GENRSA 1 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH GENRSA 1 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/usr.bin/openssl/man/nseq.1 +=================================================================== +--- secure/usr.bin/openssl/man/nseq.1 (revision 273303) ++++ secure/usr.bin/openssl/man/nseq.1 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "NSEQ 1" +-.TH NSEQ 1 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH NSEQ 1 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/usr.bin/openssl/man/ocsp.1 +=================================================================== +--- secure/usr.bin/openssl/man/ocsp.1 (revision 273303) ++++ secure/usr.bin/openssl/man/ocsp.1 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "OCSP 1" +-.TH OCSP 1 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH OCSP 1 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/usr.bin/openssl/man/openssl.1 +=================================================================== +--- secure/usr.bin/openssl/man/openssl.1 (revision 273303) ++++ secure/usr.bin/openssl/man/openssl.1 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "OPENSSL 1" +-.TH OPENSSL 1 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH OPENSSL 1 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/usr.bin/openssl/man/passwd.1 +=================================================================== +--- secure/usr.bin/openssl/man/passwd.1 (revision 273303) ++++ secure/usr.bin/openssl/man/passwd.1 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "PASSWD 1" +-.TH PASSWD 1 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH PASSWD 1 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/usr.bin/openssl/man/pkcs12.1 +=================================================================== +--- secure/usr.bin/openssl/man/pkcs12.1 (revision 273303) ++++ secure/usr.bin/openssl/man/pkcs12.1 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "PKCS12 1" +-.TH PKCS12 1 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH PKCS12 1 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/usr.bin/openssl/man/pkcs7.1 +=================================================================== +--- secure/usr.bin/openssl/man/pkcs7.1 (revision 273303) ++++ secure/usr.bin/openssl/man/pkcs7.1 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "PKCS7 1" +-.TH PKCS7 1 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH PKCS7 1 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/usr.bin/openssl/man/pkcs8.1 +=================================================================== +--- secure/usr.bin/openssl/man/pkcs8.1 (revision 273303) ++++ secure/usr.bin/openssl/man/pkcs8.1 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "PKCS8 1" +-.TH PKCS8 1 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH PKCS8 1 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/usr.bin/openssl/man/pkey.1 +=================================================================== +--- secure/usr.bin/openssl/man/pkey.1 (revision 273303) ++++ secure/usr.bin/openssl/man/pkey.1 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "PKEY 1" +-.TH PKEY 1 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH PKEY 1 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/usr.bin/openssl/man/pkeyparam.1 +=================================================================== +--- secure/usr.bin/openssl/man/pkeyparam.1 (revision 273303) ++++ secure/usr.bin/openssl/man/pkeyparam.1 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "PKEYPARAM 1" +-.TH PKEYPARAM 1 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH PKEYPARAM 1 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/usr.bin/openssl/man/pkeyutl.1 +=================================================================== +--- secure/usr.bin/openssl/man/pkeyutl.1 (revision 273303) ++++ secure/usr.bin/openssl/man/pkeyutl.1 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "PKEYUTL 1" +-.TH PKEYUTL 1 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH PKEYUTL 1 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/usr.bin/openssl/man/rand.1 +=================================================================== +--- secure/usr.bin/openssl/man/rand.1 (revision 273303) ++++ secure/usr.bin/openssl/man/rand.1 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "RAND 1" +-.TH RAND 1 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH RAND 1 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/usr.bin/openssl/man/req.1 +=================================================================== +--- secure/usr.bin/openssl/man/req.1 (revision 273303) ++++ secure/usr.bin/openssl/man/req.1 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "REQ 1" +-.TH REQ 1 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH REQ 1 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/usr.bin/openssl/man/rsa.1 +=================================================================== +--- secure/usr.bin/openssl/man/rsa.1 (revision 273303) ++++ secure/usr.bin/openssl/man/rsa.1 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "RSA 1" +-.TH RSA 1 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH RSA 1 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/usr.bin/openssl/man/rsautl.1 +=================================================================== +--- secure/usr.bin/openssl/man/rsautl.1 (revision 273303) ++++ secure/usr.bin/openssl/man/rsautl.1 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "RSAUTL 1" +-.TH RSAUTL 1 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH RSAUTL 1 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/usr.bin/openssl/man/s_client.1 +=================================================================== +--- secure/usr.bin/openssl/man/s_client.1 (revision 273303) ++++ secure/usr.bin/openssl/man/s_client.1 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "S_CLIENT 1" +-.TH S_CLIENT 1 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH S_CLIENT 1 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/usr.bin/openssl/man/s_server.1 +=================================================================== +--- secure/usr.bin/openssl/man/s_server.1 (revision 273303) ++++ secure/usr.bin/openssl/man/s_server.1 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "S_SERVER 1" +-.TH S_SERVER 1 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH S_SERVER 1 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/usr.bin/openssl/man/s_time.1 +=================================================================== +--- secure/usr.bin/openssl/man/s_time.1 (revision 273303) ++++ secure/usr.bin/openssl/man/s_time.1 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "S_TIME 1" +-.TH S_TIME 1 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH S_TIME 1 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/usr.bin/openssl/man/sess_id.1 +=================================================================== +--- secure/usr.bin/openssl/man/sess_id.1 (revision 273303) ++++ secure/usr.bin/openssl/man/sess_id.1 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "SESS_ID 1" +-.TH SESS_ID 1 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH SESS_ID 1 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/usr.bin/openssl/man/smime.1 +=================================================================== +--- secure/usr.bin/openssl/man/smime.1 (revision 273303) ++++ secure/usr.bin/openssl/man/smime.1 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "SMIME 1" +-.TH SMIME 1 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH SMIME 1 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/usr.bin/openssl/man/speed.1 +=================================================================== +--- secure/usr.bin/openssl/man/speed.1 (revision 273303) ++++ secure/usr.bin/openssl/man/speed.1 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "SPEED 1" +-.TH SPEED 1 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH SPEED 1 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/usr.bin/openssl/man/spkac.1 +=================================================================== +--- secure/usr.bin/openssl/man/spkac.1 (revision 273303) ++++ secure/usr.bin/openssl/man/spkac.1 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "SPKAC 1" +-.TH SPKAC 1 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH SPKAC 1 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/usr.bin/openssl/man/ts.1 +=================================================================== +--- secure/usr.bin/openssl/man/ts.1 (revision 273303) ++++ secure/usr.bin/openssl/man/ts.1 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "TS 1" +-.TH TS 1 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH TS 1 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/usr.bin/openssl/man/tsget.1 +=================================================================== +--- secure/usr.bin/openssl/man/tsget.1 (revision 273303) ++++ secure/usr.bin/openssl/man/tsget.1 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "TSGET 1" +-.TH TSGET 1 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH TSGET 1 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/usr.bin/openssl/man/verify.1 +=================================================================== +--- secure/usr.bin/openssl/man/verify.1 (revision 273303) ++++ secure/usr.bin/openssl/man/verify.1 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "VERIFY 1" +-.TH VERIFY 1 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH VERIFY 1 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/usr.bin/openssl/man/version.1 +=================================================================== +--- secure/usr.bin/openssl/man/version.1 (revision 273303) ++++ secure/usr.bin/openssl/man/version.1 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "VERSION 1" +-.TH VERSION 1 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH VERSION 1 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/usr.bin/openssl/man/x509.1 +=================================================================== +--- secure/usr.bin/openssl/man/x509.1 (revision 273303) ++++ secure/usr.bin/openssl/man/x509.1 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "X509 1" +-.TH X509 1 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH X509 1 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/usr.bin/openssl/man/x509v3_config.1 +=================================================================== +--- secure/usr.bin/openssl/man/x509v3_config.1 (revision 273303) ++++ secure/usr.bin/openssl/man/x509v3_config.1 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "X509V3_CONFIG 1" +-.TH X509V3_CONFIG 1 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH X509V3_CONFIG 1 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l Index: user/cperciva/freebsd-update-build/patches/10.1-BETA3/2-EN-14:11.crypt =================================================================== --- user/cperciva/freebsd-update-build/patches/10.1-BETA3/2-EN-14:11.crypt (nonexistent) +++ user/cperciva/freebsd-update-build/patches/10.1-BETA3/2-EN-14:11.crypt (revision 293366) @@ -0,0 +1,49 @@ +Index: lib/libcrypt/crypt.c +=================================================================== +--- lib/libcrypt/crypt.c (revision 273303) ++++ lib/libcrypt/crypt.c (working copy) +@@ -37,8 +37,13 @@ __FBSDID("$FreeBSD$"); + #include "crypt.h" + + /* +- * List of supported crypt(3) formats. The first element in the list will +- * be the default. ++ * List of supported crypt(3) formats. ++ * ++ * The default algorithm is the last entry in the list (second-to-last ++ * array element since the last is a sentinel). The reason for placing ++ * the default last rather than first is that DES needs to be at the ++ * bottom for the algorithm guessing logic in crypt(3) to work correctly, ++ * and it needs to be the default for backward compatibility. + */ + static const struct crypt_format { + const char *const name; +@@ -45,10 +50,6 @@ static const struct crypt_format { + char *(*const func)(const char *, const char *); + const char *const magic; + } crypt_formats[] = { +- /* default format */ +- { "sha512", crypt_sha512, "$6$" }, +- +- /* other supported formats */ + { "md5", crypt_md5, "$1$" }, + #ifdef HAS_BLOWFISH + { "blf", crypt_blowfish, "$2" }, +@@ -55,6 +56,7 @@ static const struct crypt_format { + #endif + { "nth", crypt_nthash, "$3$" }, + { "sha256", crypt_sha256, "$5$" }, ++ { "sha512", crypt_sha512, "$6$" }, + #ifdef HAS_DES + { "des", crypt_des, "_" }, + #endif +@@ -63,7 +65,8 @@ static const struct crypt_format { + { NULL, NULL, NULL } + }; + +-static const struct crypt_format *crypt_format = &crypt_formats[0]; ++static const struct crypt_format *crypt_format = ++ &crypt_formats[(sizeof crypt_formats / sizeof *crypt_formats) - 2]; + + #define DES_SALT_ALPHABET \ + "./0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz" Index: user/cperciva/freebsd-update-build/patches/10.1-RC1/1-SA-14:20.rtsold =================================================================== --- user/cperciva/freebsd-update-build/patches/10.1-RC1/1-SA-14:20.rtsold (nonexistent) +++ user/cperciva/freebsd-update-build/patches/10.1-RC1/1-SA-14:20.rtsold (revision 293366) @@ -0,0 +1,14 @@ +Index: usr.sbin/rtsold/rtsol.c +=================================================================== +--- usr.sbin/rtsold/rtsol.c.orig ++++ usr.sbin/rtsold/rtsol.c +@@ -933,7 +933,8 @@ + dst_origin = dst; + memset(dst, '\0', dlen); + while (src && (len = (uint8_t)(*src++) & 0x3f) && +- (src + len) <= src_last) { ++ (src + len) <= src_last && ++ (dst - dst_origin < (ssize_t)dlen)) { + if (dst != dst_origin) + *dst++ = '.'; + warnmsg(LOG_DEBUG, __func__, "labellen = %zd", len); Index: user/cperciva/freebsd-update-build/patches/10.1-RC1/1-SA-14:21.routed =================================================================== --- user/cperciva/freebsd-update-build/patches/10.1-RC1/1-SA-14:21.routed (nonexistent) +++ user/cperciva/freebsd-update-build/patches/10.1-RC1/1-SA-14:21.routed (revision 293366) @@ -0,0 +1,15 @@ +Index: sbin/routed/input.c +=================================================================== +--- sbin/routed/input.c.orig ++++ sbin/routed/input.c +@@ -288,6 +288,10 @@ + /* Answer a query from a utility program + * with all we know. + */ ++ if (aifp == NULL) { ++ trace_pkt("ignore remote query"); ++ return; ++ } + if (from->sin_port != htons(RIP_PORT)) { + supply(from, aifp, OUT_QUERY, 0, + rip->rip_vers, ap != 0); Index: user/cperciva/freebsd-update-build/patches/10.1-RC1/1-SA-14:22.namei =================================================================== --- user/cperciva/freebsd-update-build/patches/10.1-RC1/1-SA-14:22.namei (nonexistent) +++ user/cperciva/freebsd-update-build/patches/10.1-RC1/1-SA-14:22.namei (revision 293366) @@ -0,0 +1,94 @@ +Index: sys/kern/vfs_lookup.c +=================================================================== +--- sys/kern/vfs_lookup.c (revision 273277) ++++ sys/kern/vfs_lookup.c (working copy) +@@ -121,6 +121,16 @@ + * if symbolic link, massage name in buffer and continue + * } + */ ++static void ++namei_cleanup_cnp(struct componentname *cnp) ++{ ++ uma_zfree(namei_zone, cnp->cn_pnbuf); ++#ifdef DIAGNOSTIC ++ cnp->cn_pnbuf = NULL; ++ cnp->cn_nameptr = NULL; ++#endif ++} ++ + int + namei(struct nameidata *ndp) + { +@@ -185,11 +195,7 @@ + } + #endif + if (error) { +- uma_zfree(namei_zone, cnp->cn_pnbuf); +-#ifdef DIAGNOSTIC +- cnp->cn_pnbuf = NULL; +- cnp->cn_nameptr = NULL; +-#endif ++ namei_cleanup_cnp(cnp); + ndp->ni_vp = NULL; + return (error); + } +@@ -256,11 +262,7 @@ + } + } + if (error) { +- uma_zfree(namei_zone, cnp->cn_pnbuf); +-#ifdef DIAGNOSTIC +- cnp->cn_pnbuf = NULL; +- cnp->cn_nameptr = NULL; +-#endif ++ namei_cleanup_cnp(cnp); + return (error); + } + } +@@ -286,6 +288,7 @@ + if (KTRPOINT(curthread, KTR_CAPFAIL)) + ktrcapfail(CAPFAIL_LOOKUP, NULL, NULL); + #endif ++ namei_cleanup_cnp(cnp); + return (ENOTCAPABLE); + } + while (*(cnp->cn_nameptr) == '/') { +@@ -298,11 +301,7 @@ + ndp->ni_startdir = dp; + error = lookup(ndp); + if (error) { +- uma_zfree(namei_zone, cnp->cn_pnbuf); +-#ifdef DIAGNOSTIC +- cnp->cn_pnbuf = NULL; +- cnp->cn_nameptr = NULL; +-#endif ++ namei_cleanup_cnp(cnp); + SDT_PROBE(vfs, namei, lookup, return, error, NULL, 0, + 0, 0); + return (error); +@@ -312,11 +311,7 @@ + */ + if ((cnp->cn_flags & ISSYMLINK) == 0) { + if ((cnp->cn_flags & (SAVENAME | SAVESTART)) == 0) { +- uma_zfree(namei_zone, cnp->cn_pnbuf); +-#ifdef DIAGNOSTIC +- cnp->cn_pnbuf = NULL; +- cnp->cn_nameptr = NULL; +-#endif ++ namei_cleanup_cnp(cnp); + } else + cnp->cn_flags |= HASBUF; + +@@ -378,11 +373,7 @@ + vput(ndp->ni_vp); + dp = ndp->ni_dvp; + } +- uma_zfree(namei_zone, cnp->cn_pnbuf); +-#ifdef DIAGNOSTIC +- cnp->cn_pnbuf = NULL; +- cnp->cn_nameptr = NULL; +-#endif ++ namei_cleanup_cnp(cnp); + vput(ndp->ni_vp); + ndp->ni_vp = NULL; + vrele(ndp->ni_dvp); Index: user/cperciva/freebsd-update-build/patches/10.1-RC1/1-SA-14:23.openssl =================================================================== --- user/cperciva/freebsd-update-build/patches/10.1-RC1/1-SA-14:23.openssl (nonexistent) +++ user/cperciva/freebsd-update-build/patches/10.1-RC1/1-SA-14:23.openssl (revision 293366) @@ -0,0 +1,10230 @@ +Index: ObsoleteFiles.inc +=================================================================== +--- ObsoleteFiles.inc (revision 273303) ++++ ObsoleteFiles.inc (working copy) +@@ -38,6 +38,8 @@ + # xargs -n1 | sort | uniq -d; + # done + ++# 20141015: OpenSSL 1.0.1j import ++OLD_FILES+=usr/share/openssl/man/man3/CMS_sign_add1_signer.3.gz + # 20140917: hv_kvpd rc.d script removed in favor of devd configuration + OLD_FILES+=etc/rc.d/hv_kvpd + # 20140814: libopie version bump +Index: crypto/openssl/CHANGES +=================================================================== +--- crypto/openssl/CHANGES (revision 273303) ++++ crypto/openssl/CHANGES (working copy) +@@ -2,6 +2,57 @@ + OpenSSL CHANGES + _______________ + ++ Changes between 1.0.1i and 1.0.1j [15 Oct 2014] ++ ++ *) SRTP Memory Leak. ++ ++ A flaw in the DTLS SRTP extension parsing code allows an attacker, who ++ sends a carefully crafted handshake message, to cause OpenSSL to fail ++ to free up to 64k of memory causing a memory leak. This could be ++ exploited in a Denial Of Service attack. This issue affects OpenSSL ++ 1.0.1 server implementations for both SSL/TLS and DTLS regardless of ++ whether SRTP is used or configured. Implementations of OpenSSL that ++ have been compiled with OPENSSL_NO_SRTP defined are not affected. ++ ++ The fix was developed by the OpenSSL team. ++ (CVE-2014-3513) ++ [OpenSSL team] ++ ++ *) Session Ticket Memory Leak. ++ ++ When an OpenSSL SSL/TLS/DTLS server receives a session ticket the ++ integrity of that ticket is first verified. In the event of a session ++ ticket integrity check failing, OpenSSL will fail to free memory ++ causing a memory leak. By sending a large number of invalid session ++ tickets an attacker could exploit this issue in a Denial Of Service ++ attack. ++ (CVE-2014-3567) ++ [Steve Henson] ++ ++ *) Build option no-ssl3 is incomplete. ++ ++ When OpenSSL is configured with "no-ssl3" as a build option, servers ++ could accept and complete a SSL 3.0 handshake, and clients could be ++ configured to send them. ++ (CVE-2014-3568) ++ [Akamai and the OpenSSL team] ++ ++ *) Add support for TLS_FALLBACK_SCSV. ++ Client applications doing fallback retries should call ++ SSL_set_mode(s, SSL_MODE_SEND_FALLBACK_SCSV). ++ (CVE-2014-3566) ++ [Adam Langley, Bodo Moeller] ++ ++ *) Add additional DigestInfo checks. ++ ++ Reencode DigestInto in DER and check against the original when ++ verifying RSA signature: this will reject any improperly encoded ++ DigestInfo structures. ++ ++ Note: this is a precautionary measure and no attacks are currently known. ++ ++ [Steve Henson] ++ + Changes between 1.0.1h and 1.0.1i [6 Aug 2014] + + *) Fix SRP buffer overrun vulnerability. Invalid parameters passed to the +Index: crypto/openssl/Configure +=================================================================== +--- crypto/openssl/Configure (revision 273303) ++++ crypto/openssl/Configure (working copy) +@@ -1767,6 +1767,9 @@ open(OUT,'>crypto/opensslconf.h.new') || die "unab + print OUT "/* opensslconf.h */\n"; + print OUT "/* WARNING: Generated automatically from opensslconf.h.in by Configure. */\n\n"; + ++print OUT "#ifdef __cplusplus\n"; ++print OUT "extern \"C\" {\n"; ++print OUT "#endif\n"; + print OUT "/* OpenSSL was configured with the following options: */\n"; + my $openssl_algorithm_defines_trans = $openssl_algorithm_defines; + $openssl_experimental_defines =~ s/^\s*#\s*define\s+OPENSSL_NO_(.*)/#ifndef OPENSSL_EXPERIMENTAL_$1\n# ifndef OPENSSL_NO_$1\n# define OPENSSL_NO_$1\n# endif\n#endif/mg; +@@ -1871,6 +1874,9 @@ while () + { print OUT $_; } + } + close(IN); ++print OUT "#ifdef __cplusplus\n"; ++print OUT "}\n"; ++print OUT "#endif\n"; + close(OUT); + rename("crypto/opensslconf.h","crypto/opensslconf.h.bak") || die "unable to rename crypto/opensslconf.h\n" if -e "crypto/opensslconf.h"; + rename("crypto/opensslconf.h.new","crypto/opensslconf.h") || die "unable to rename crypto/opensslconf.h.new\n"; +Index: crypto/openssl/Makefile +=================================================================== +--- crypto/openssl/Makefile (revision 273303) ++++ crypto/openssl/Makefile (working copy) +@@ -4,7 +4,7 @@ + ## Makefile for OpenSSL + ## + +-VERSION=1.0.1i ++VERSION=1.0.1j + MAJOR=1 + MINOR=0.1 + SHLIB_VERSION_NUMBER=1.0.0 +Index: crypto/openssl/NEWS +=================================================================== +--- crypto/openssl/NEWS (revision 273303) ++++ crypto/openssl/NEWS (working copy) +@@ -5,6 +5,13 @@ + This file gives a brief overview of the major changes between each OpenSSL + release. For more details please read the CHANGES file. + ++ Major changes between OpenSSL 1.0.1i and OpenSSL 1.0.1j [15 Oct 2014] ++ ++ o Fix for CVE-2014-3513 ++ o Fix for CVE-2014-3567 ++ o Mitigation for CVE-2014-3566 (SSL protocol vulnerability) ++ o Fix for CVE-2014-3568 ++ + Major changes between OpenSSL 1.0.1h and OpenSSL 1.0.1i [6 Aug 2014] + + o Fix for CVE-2014-3512 +Index: crypto/openssl/README +=================================================================== +--- crypto/openssl/README (revision 273303) ++++ crypto/openssl/README (working copy) +@@ -1,5 +1,5 @@ + +- OpenSSL 1.0.1i 6 Aug 2014 ++ OpenSSL 1.0.1j 15 Oct 2014 + + Copyright (c) 1998-2011 The OpenSSL Project + Copyright (c) 1995-1998 Eric A. Young, Tim J. Hudson +Index: crypto/openssl/apps/s_client.c +=================================================================== +--- crypto/openssl/apps/s_client.c (revision 273303) ++++ crypto/openssl/apps/s_client.c (working copy) +@@ -337,6 +337,7 @@ static void sc_usage(void) + BIO_printf(bio_err," -tls1_1 - just use TLSv1.1\n"); + BIO_printf(bio_err," -tls1 - just use TLSv1\n"); + BIO_printf(bio_err," -dtls1 - just use DTLSv1\n"); ++ BIO_printf(bio_err," -fallback_scsv - send TLS_FALLBACK_SCSV\n"); + BIO_printf(bio_err," -mtu - set the link layer MTU\n"); + BIO_printf(bio_err," -no_tls1_2/-no_tls1_1/-no_tls1/-no_ssl3/-no_ssl2 - turn off that protocol\n"); + BIO_printf(bio_err," -bugs - Switch on all SSL implementation bug workarounds\n"); +@@ -617,6 +618,7 @@ int MAIN(int argc, char **argv) + char *sess_out = NULL; + struct sockaddr peer; + int peerlen = sizeof(peer); ++ int fallback_scsv = 0; + int enable_timeouts = 0 ; + long socket_mtu = 0; + #ifndef OPENSSL_NO_JPAKE +@@ -823,6 +825,10 @@ int MAIN(int argc, char **argv) + meth=DTLSv1_client_method(); + socket_type=SOCK_DGRAM; + } ++ else if (strcmp(*argv,"-fallback_scsv") == 0) ++ { ++ fallback_scsv = 1; ++ } + else if (strcmp(*argv,"-timeout") == 0) + enable_timeouts=1; + else if (strcmp(*argv,"-mtu") == 0) +@@ -1235,6 +1241,10 @@ bad: + SSL_set_session(con, sess); + SSL_SESSION_free(sess); + } ++ ++ if (fallback_scsv) ++ SSL_set_mode(con, SSL_MODE_SEND_FALLBACK_SCSV); ++ + #ifndef OPENSSL_NO_TLSEXT + if (servername != NULL) + { +Index: crypto/openssl/crypto/Makefile +=================================================================== +--- crypto/openssl/crypto/Makefile (revision 273303) ++++ crypto/openssl/crypto/Makefile (working copy) +@@ -32,6 +32,7 @@ CPUID_OBJ=mem_clr.o + LIBS= + + GENERAL=Makefile README crypto-lib.com install.com ++TEST=constant_time_test.c + + LIB= $(TOP)/libcrypto.a + SHARED_LIB= libcrypto$(SHLIB_EXT) +@@ -44,7 +45,8 @@ SRC= $(LIBSRC) + + EXHEADER= crypto.h opensslv.h opensslconf.h ebcdic.h symhacks.h \ + ossl_typ.h +-HEADER= cryptlib.h buildinf.h md32_common.h o_time.h o_str.h o_dir.h $(EXHEADER) ++HEADER= cryptlib.h buildinf.h md32_common.h o_time.h o_str.h o_dir.h \ ++ constant_time_locl.h $(EXHEADER) + + ALL= $(GENERAL) $(SRC) $(HEADER) + +Index: crypto/openssl/crypto/aes/asm/aesni-x86_64.pl +=================================================================== +--- crypto/openssl/crypto/aes/asm/aesni-x86_64.pl (revision 273303) ++++ crypto/openssl/crypto/aes/asm/aesni-x86_64.pl (working copy) +@@ -525,6 +525,16 @@ $code.=<<___; + .type aesni_ecb_encrypt,\@function,5 + .align 16 + aesni_ecb_encrypt: ++___ ++$code.=<<___ if ($win64); ++ lea -0x58(%rsp),%rsp ++ movaps %xmm6,(%rsp) ++ movaps %xmm7,0x10(%rsp) ++ movaps %xmm8,0x20(%rsp) ++ movaps %xmm9,0x30(%rsp) ++.Lecb_enc_body: ++___ ++$code.=<<___; + and \$-16,$len + jz .Lecb_ret + +@@ -805,6 +815,16 @@ $code.=<<___; + movups $inout5,0x50($out) + + .Lecb_ret: ++___ ++$code.=<<___ if ($win64); ++ movaps (%rsp),%xmm6 ++ movaps 0x10(%rsp),%xmm7 ++ movaps 0x20(%rsp),%xmm8 ++ movaps 0x30(%rsp),%xmm9 ++ lea 0x58(%rsp),%rsp ++.Lecb_enc_ret: ++___ ++$code.=<<___; + ret + .size aesni_ecb_encrypt,.-aesni_ecb_encrypt + ___ +@@ -2730,9 +2750,9 @@ $code.=<<___; + .extern __imp_RtlVirtualUnwind + ___ + $code.=<<___ if ($PREFIX eq "aesni"); +-.type ecb_se_handler,\@abi-omnipotent ++.type ecb_ccm64_se_handler,\@abi-omnipotent + .align 16 +-ecb_se_handler: ++ecb_ccm64_se_handler: + push %rsi + push %rdi + push %rbx +@@ -2744,25 +2764,6 @@ $code.=<<___ if ($PREFIX eq "aesni"); + pushfq + sub \$64,%rsp + +- mov 152($context),%rax # pull context->Rsp +- +- jmp .Lcommon_seh_tail +-.size ecb_se_handler,.-ecb_se_handler +- +-.type ccm64_se_handler,\@abi-omnipotent +-.align 16 +-ccm64_se_handler: +- push %rsi +- push %rdi +- push %rbx +- push %rbp +- push %r12 +- push %r13 +- push %r14 +- push %r15 +- pushfq +- sub \$64,%rsp +- + mov 120($context),%rax # pull context->Rax + mov 248($context),%rbx # pull context->Rip + +@@ -2788,7 +2789,7 @@ $code.=<<___ if ($PREFIX eq "aesni"); + lea 0x58(%rax),%rax # adjust stack pointer + + jmp .Lcommon_seh_tail +-.size ccm64_se_handler,.-ccm64_se_handler ++.size ecb_ccm64_se_handler,.-ecb_ccm64_se_handler + + .type ctr32_se_handler,\@abi-omnipotent + .align 16 +@@ -2993,14 +2994,15 @@ ___ + $code.=<<___ if ($PREFIX eq "aesni"); + .LSEH_info_ecb: + .byte 9,0,0,0 +- .rva ecb_se_handler ++ .rva ecb_ccm64_se_handler ++ .rva .Lecb_enc_body,.Lecb_enc_ret # HandlerData[] + .LSEH_info_ccm64_enc: + .byte 9,0,0,0 +- .rva ccm64_se_handler ++ .rva ecb_ccm64_se_handler + .rva .Lccm64_enc_body,.Lccm64_enc_ret # HandlerData[] + .LSEH_info_ccm64_dec: + .byte 9,0,0,0 +- .rva ccm64_se_handler ++ .rva ecb_ccm64_se_handler + .rva .Lccm64_dec_body,.Lccm64_dec_ret # HandlerData[] + .LSEH_info_ctr32: + .byte 9,0,0,0 +Index: crypto/openssl/crypto/asn1/a_strex.c +=================================================================== +--- crypto/openssl/crypto/asn1/a_strex.c (revision 273303) ++++ crypto/openssl/crypto/asn1/a_strex.c (working copy) +@@ -568,6 +568,7 @@ int ASN1_STRING_to_UTF8(unsigned char **out, ASN1_ + mbflag |= MBSTRING_FLAG; + stmp.data = NULL; + stmp.length = 0; ++ stmp.flags = 0; + ret = ASN1_mbstring_copy(&str, in->data, in->length, mbflag, B_ASN1_UTF8STRING); + if(ret < 0) return ret; + *out = stmp.data; +Index: crypto/openssl/crypto/bn/asm/x86_64-gcc.c +=================================================================== +--- crypto/openssl/crypto/bn/asm/x86_64-gcc.c (revision 273303) ++++ crypto/openssl/crypto/bn/asm/x86_64-gcc.c (working copy) +@@ -189,7 +189,7 @@ BN_ULONG bn_add_words (BN_ULONG *rp, const BN_ULON + + if (n <= 0) return 0; + +- asm ( ++ asm volatile ( + " subq %2,%2 \n" + ".p2align 4 \n" + "1: movq (%4,%2,8),%0 \n" +@@ -200,7 +200,7 @@ BN_ULONG bn_add_words (BN_ULONG *rp, const BN_ULON + " sbbq %0,%0 \n" + : "=&a"(ret),"+c"(n),"=&r"(i) + : "r"(rp),"r"(ap),"r"(bp) +- : "cc" ++ : "cc", "memory" + ); + + return ret&1; +@@ -212,7 +212,7 @@ BN_ULONG bn_sub_words (BN_ULONG *rp, const BN_ULON + + if (n <= 0) return 0; + +- asm ( ++ asm volatile ( + " subq %2,%2 \n" + ".p2align 4 \n" + "1: movq (%4,%2,8),%0 \n" +@@ -223,7 +223,7 @@ BN_ULONG bn_sub_words (BN_ULONG *rp, const BN_ULON + " sbbq %0,%0 \n" + : "=&a"(ret),"+c"(n),"=&r"(i) + : "r"(rp),"r"(ap),"r"(bp) +- : "cc" ++ : "cc", "memory" + ); + + return ret&1; +Index: crypto/openssl/crypto/bn/bn_exp.c +=================================================================== +--- crypto/openssl/crypto/bn/bn_exp.c (revision 273303) ++++ crypto/openssl/crypto/bn/bn_exp.c (working copy) +@@ -874,7 +874,14 @@ int BN_mod_exp_mont_word(BIGNUM *rr, BN_ULONG a, c + bits = BN_num_bits(p); + if (bits == 0) + { +- ret = BN_one(rr); ++ /* x**0 mod 1 is still zero. */ ++ if (BN_is_one(m)) ++ { ++ ret = 1; ++ BN_zero(rr); ++ } ++ else ++ ret = BN_one(rr); + return ret; + } + if (a == 0) +Index: crypto/openssl/crypto/bn/bn_nist.c +=================================================================== +--- crypto/openssl/crypto/bn/bn_nist.c (revision 273303) ++++ crypto/openssl/crypto/bn/bn_nist.c (working copy) +@@ -1088,9 +1088,9 @@ int BN_nist_mod_521(BIGNUM *r, const BIGNUM *a, co + /* ... and right shift */ + for (val=t_d[0],i=0; i>BN_NIST_521_RSHIFT; +- val = t_d[i+1]; +- t_d[i] = (tmp | val<>BN_NIST_521_RSHIFT | ++ (tmp=t_d[i+1])<>BN_NIST_521_RSHIFT; + /* lower 521 bits */ +Index: crypto/openssl/crypto/bn/exptest.c +=================================================================== +--- crypto/openssl/crypto/bn/exptest.c (revision 273303) ++++ crypto/openssl/crypto/bn/exptest.c (working copy) +@@ -71,6 +71,43 @@ + + static const char rnd_seed[] = "string to make the random number generator think it has entropy"; + ++/* test_exp_mod_zero tests that x**0 mod 1 == 0. It returns zero on success. */ ++static int test_exp_mod_zero() { ++ BIGNUM a, p, m; ++ BIGNUM r; ++ BN_CTX *ctx = BN_CTX_new(); ++ int ret = 1; ++ ++ BN_init(&m); ++ BN_one(&m); ++ ++ BN_init(&a); ++ BN_one(&a); ++ ++ BN_init(&p); ++ BN_zero(&p); ++ ++ BN_init(&r); ++ BN_mod_exp(&r, &a, &p, &m, ctx); ++ BN_CTX_free(ctx); ++ ++ if (BN_is_zero(&r)) ++ ret = 0; ++ else ++ { ++ printf("1**0 mod 1 = "); ++ BN_print_fp(stdout, &r); ++ printf(", should be 0\n"); ++ } ++ ++ BN_free(&r); ++ BN_free(&a); ++ BN_free(&p); ++ BN_free(&m); ++ ++ return ret; ++} ++ + int main(int argc, char *argv[]) + { + BN_CTX *ctx; +@@ -190,7 +227,13 @@ int main(int argc, char *argv[]) + ERR_remove_thread_state(NULL); + CRYPTO_mem_leaks(out); + BIO_free(out); +- printf(" done\n"); ++ printf("\n"); ++ ++ if (test_exp_mod_zero() != 0) ++ goto err; ++ ++ printf("done\n"); ++ + EXIT(0); + err: + ERR_load_crypto_strings(); +Index: crypto/openssl/crypto/constant_time_locl.h +=================================================================== +--- crypto/openssl/crypto/constant_time_locl.h (revision 0) ++++ crypto/openssl/crypto/constant_time_locl.h (working copy) +@@ -0,0 +1,216 @@ ++/* crypto/constant_time_locl.h */ ++/* ++ * Utilities for constant-time cryptography. ++ * ++ * Author: Emilia Kasper (emilia@openssl.org) ++ * Based on previous work by Bodo Moeller, Emilia Kasper, Adam Langley ++ * (Google). ++ * ==================================================================== ++ * Copyright (c) 2014 The OpenSSL Project. All rights reserved. ++ * ++ * Redistribution and use in source and binary forms, with or without ++ * modification, are permitted provided that the following conditions ++ * are met: ++ * 1. Redistributions of source code must retain the copyright ++ * notice, this list of conditions and the following disclaimer. ++ * 2. Redistributions in binary form must reproduce the above copyright ++ * notice, this list of conditions and the following disclaimer in the ++ * documentation and/or other materials provided with the distribution. ++ * 3. All advertising materials mentioning features or use of this software ++ * must display the following acknowledgement: ++ * "This product includes cryptographic software written by ++ * Eric Young (eay@cryptsoft.com)" ++ * The word 'cryptographic' can be left out if the rouines from the library ++ * being used are not cryptographic related :-). ++ * 4. If you include any Windows specific code (or a derivative thereof) from ++ * the apps directory (application code) you must include an acknowledgement: ++ * "This product includes software written by Tim Hudson (tjh@cryptsoft.com)" ++ * ++ * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND ++ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE ++ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ++ * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE ++ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL ++ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS ++ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) ++ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT ++ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY ++ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF ++ * SUCH DAMAGE. ++ * ++ * The licence and distribution terms for any publically available version or ++ * derivative of this code cannot be changed. i.e. this code cannot simply be ++ * copied and put under another distribution licence ++ * [including the GNU Public Licence.] ++ */ ++ ++#ifndef HEADER_CONSTANT_TIME_LOCL_H ++#define HEADER_CONSTANT_TIME_LOCL_H ++ ++#include "e_os.h" /* For 'inline' */ ++ ++#ifdef __cplusplus ++extern "C" { ++#endif ++ ++/* ++ * The boolean methods return a bitmask of all ones (0xff...f) for true ++ * and 0 for false. This is useful for choosing a value based on the result ++ * of a conditional in constant time. For example, ++ * ++ * if (a < b) { ++ * c = a; ++ * } else { ++ * c = b; ++ * } ++ * ++ * can be written as ++ * ++ * unsigned int lt = constant_time_lt(a, b); ++ * c = constant_time_select(lt, a, b); ++ */ ++ ++/* ++ * Returns the given value with the MSB copied to all the other ++ * bits. Uses the fact that arithmetic shift shifts-in the sign bit. ++ * However, this is not ensured by the C standard so you may need to ++ * replace this with something else on odd CPUs. ++ */ ++static inline unsigned int constant_time_msb(unsigned int a); ++ ++/* ++ * Returns 0xff..f if a < b and 0 otherwise. ++ */ ++static inline unsigned int constant_time_lt(unsigned int a, unsigned int b); ++/* Convenience method for getting an 8-bit mask. */ ++static inline unsigned char constant_time_lt_8(unsigned int a, unsigned int b); ++ ++/* ++ * Returns 0xff..f if a >= b and 0 otherwise. ++ */ ++static inline unsigned int constant_time_ge(unsigned int a, unsigned int b); ++/* Convenience method for getting an 8-bit mask. */ ++static inline unsigned char constant_time_ge_8(unsigned int a, unsigned int b); ++ ++/* ++ * Returns 0xff..f if a == 0 and 0 otherwise. ++ */ ++static inline unsigned int constant_time_is_zero(unsigned int a); ++/* Convenience method for getting an 8-bit mask. */ ++static inline unsigned char constant_time_is_zero_8(unsigned int a); ++ ++ ++/* ++ * Returns 0xff..f if a == b and 0 otherwise. ++ */ ++static inline unsigned int constant_time_eq(unsigned int a, unsigned int b); ++/* Convenience method for getting an 8-bit mask. */ ++static inline unsigned char constant_time_eq_8(unsigned int a, unsigned int b); ++/* Signed integers. */ ++static inline unsigned int constant_time_eq_int(int a, int b); ++/* Convenience method for getting an 8-bit mask. */ ++static inline unsigned char constant_time_eq_int_8(int a, int b); ++ ++ ++/* ++ * Returns (mask & a) | (~mask & b). ++ * ++ * When |mask| is all 1s or all 0s (as returned by the methods above), ++ * the select methods return either |a| (if |mask| is nonzero) or |b| ++ * (if |mask| is zero). ++ */ ++static inline unsigned int constant_time_select(unsigned int mask, ++ unsigned int a, unsigned int b); ++/* Convenience method for unsigned chars. */ ++static inline unsigned char constant_time_select_8(unsigned char mask, ++ unsigned char a, unsigned char b); ++/* Convenience method for signed integers. */ ++static inline int constant_time_select_int(unsigned int mask, int a, int b); ++ ++static inline unsigned int constant_time_msb(unsigned int a) ++ { ++ return (unsigned int)((int)(a) >> (sizeof(int) * 8 - 1)); ++ } ++ ++static inline unsigned int constant_time_lt(unsigned int a, unsigned int b) ++ { ++ unsigned int lt; ++ /* Case 1: msb(a) == msb(b). a < b iff the MSB of a - b is set.*/ ++ lt = ~(a ^ b) & (a - b); ++ /* Case 2: msb(a) != msb(b). a < b iff the MSB of b is set. */ ++ lt |= ~a & b; ++ return constant_time_msb(lt); ++ } ++ ++static inline unsigned char constant_time_lt_8(unsigned int a, unsigned int b) ++ { ++ return (unsigned char)(constant_time_lt(a, b)); ++ } ++ ++static inline unsigned int constant_time_ge(unsigned int a, unsigned int b) ++ { ++ unsigned int ge; ++ /* Case 1: msb(a) == msb(b). a >= b iff the MSB of a - b is not set.*/ ++ ge = ~((a ^ b) | (a - b)); ++ /* Case 2: msb(a) != msb(b). a >= b iff the MSB of a is set. */ ++ ge |= a & ~b; ++ return constant_time_msb(ge); ++ } ++ ++static inline unsigned char constant_time_ge_8(unsigned int a, unsigned int b) ++ { ++ return (unsigned char)(constant_time_ge(a, b)); ++ } ++ ++static inline unsigned int constant_time_is_zero(unsigned int a) ++ { ++ return constant_time_msb(~a & (a - 1)); ++ } ++ ++static inline unsigned char constant_time_is_zero_8(unsigned int a) ++ { ++ return (unsigned char)(constant_time_is_zero(a)); ++ } ++ ++static inline unsigned int constant_time_eq(unsigned int a, unsigned int b) ++ { ++ return constant_time_is_zero(a ^ b); ++ } ++ ++static inline unsigned char constant_time_eq_8(unsigned int a, unsigned int b) ++ { ++ return (unsigned char)(constant_time_eq(a, b)); ++ } ++ ++static inline unsigned int constant_time_eq_int(int a, int b) ++ { ++ return constant_time_eq((unsigned)(a), (unsigned)(b)); ++ } ++ ++static inline unsigned char constant_time_eq_int_8(int a, int b) ++ { ++ return constant_time_eq_8((unsigned)(a), (unsigned)(b)); ++ } ++ ++static inline unsigned int constant_time_select(unsigned int mask, ++ unsigned int a, unsigned int b) ++ { ++ return (mask & a) | (~mask & b); ++ } ++ ++static inline unsigned char constant_time_select_8(unsigned char mask, ++ unsigned char a, unsigned char b) ++ { ++ return (unsigned char)(constant_time_select(mask, a, b)); ++ } ++ ++inline int constant_time_select_int(unsigned int mask, int a, int b) ++ { ++ return (int)(constant_time_select(mask, (unsigned)(a), (unsigned)(b))); ++ } ++ ++#ifdef __cplusplus ++} ++#endif ++ ++#endif /* HEADER_CONSTANT_TIME_LOCL_H */ + +Property changes on: crypto/openssl/crypto/constant_time_locl.h +___________________________________________________________________ +Added: svn:keywords +## -0,0 +1 ## ++FreeBSD=%H +\ No newline at end of property +Added: svn:eol-style +## -0,0 +1 ## ++native +\ No newline at end of property +Added: svn:mime-type +## -0,0 +1 ## ++text/plain +\ No newline at end of property +Index: crypto/openssl/crypto/constant_time_test.c +=================================================================== +--- crypto/openssl/crypto/constant_time_test.c (revision 0) ++++ crypto/openssl/crypto/constant_time_test.c (working copy) +@@ -0,0 +1,330 @@ ++/* crypto/constant_time_test.c */ ++/* ++ * Utilities for constant-time cryptography. ++ * ++ * Author: Emilia Kasper (emilia@openssl.org) ++ * Based on previous work by Bodo Moeller, Emilia Kasper, Adam Langley ++ * (Google). ++ * ==================================================================== ++ * Copyright (c) 2014 The OpenSSL Project. All rights reserved. ++ * ++ * Redistribution and use in source and binary forms, with or without ++ * modification, are permitted provided that the following conditions ++ * are met: ++ * 1. Redistributions of source code must retain the copyright ++ * notice, this list of conditions and the following disclaimer. ++ * 2. Redistributions in binary form must reproduce the above copyright ++ * notice, this list of conditions and the following disclaimer in the ++ * documentation and/or other materials provided with the distribution. ++ * 3. All advertising materials mentioning features or use of this software ++ * must display the following acknowledgement: ++ * "This product includes cryptographic software written by ++ * Eric Young (eay@cryptsoft.com)" ++ * The word 'cryptographic' can be left out if the rouines from the library ++ * being used are not cryptographic related :-). ++ * 4. If you include any Windows specific code (or a derivative thereof) from ++ * the apps directory (application code) you must include an acknowledgement: ++ * "This product includes software written by Tim Hudson (tjh@cryptsoft.com)" ++ * ++ * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND ++ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE ++ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ++ * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE ++ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL ++ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS ++ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) ++ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT ++ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY ++ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF ++ * SUCH DAMAGE. ++ * ++ * The licence and distribution terms for any publically available version or ++ * derivative of this code cannot be changed. i.e. this code cannot simply be ++ * copied and put under another distribution licence ++ * [including the GNU Public Licence.] ++ */ ++ ++#include "../crypto/constant_time_locl.h" ++ ++#include ++#include ++#include ++ ++static const unsigned int CONSTTIME_TRUE = (unsigned)(~0); ++static const unsigned int CONSTTIME_FALSE = 0; ++static const unsigned char CONSTTIME_TRUE_8 = 0xff; ++static const unsigned char CONSTTIME_FALSE_8 = 0; ++ ++static int test_binary_op(unsigned int (*op)(unsigned int a, unsigned int b), ++ const char* op_name, unsigned int a, unsigned int b, int is_true) ++ { ++ unsigned c = op(a, b); ++ if (is_true && c != CONSTTIME_TRUE) ++ { ++ fprintf(stderr, "Test failed for %s(%du, %du): expected %du " ++ "(TRUE), got %du\n", op_name, a, b, CONSTTIME_TRUE, c); ++ return 1; ++ } ++ else if (!is_true && c != CONSTTIME_FALSE) ++ { ++ fprintf(stderr, "Test failed for %s(%du, %du): expected %du " ++ "(FALSE), got %du\n", op_name, a, b, CONSTTIME_FALSE, ++ c); ++ return 1; ++ } ++ return 0; ++ } ++ ++static int test_binary_op_8(unsigned char (*op)(unsigned int a, unsigned int b), ++ const char* op_name, unsigned int a, unsigned int b, int is_true) ++ { ++ unsigned char c = op(a, b); ++ if (is_true && c != CONSTTIME_TRUE_8) ++ { ++ fprintf(stderr, "Test failed for %s(%du, %du): expected %u " ++ "(TRUE), got %u\n", op_name, a, b, CONSTTIME_TRUE_8, c); ++ return 1; ++ } ++ else if (!is_true && c != CONSTTIME_FALSE_8) ++ { ++ fprintf(stderr, "Test failed for %s(%du, %du): expected %u " ++ "(FALSE), got %u\n", op_name, a, b, CONSTTIME_FALSE_8, ++ c); ++ return 1; ++ } ++ return 0; ++ } ++ ++static int test_is_zero(unsigned int a) ++ { ++ unsigned int c = constant_time_is_zero(a); ++ if (a == 0 && c != CONSTTIME_TRUE) ++ { ++ fprintf(stderr, "Test failed for constant_time_is_zero(%du): " ++ "expected %du (TRUE), got %du\n", a, CONSTTIME_TRUE, c); ++ return 1; ++ } ++ else if (a != 0 && c != CONSTTIME_FALSE) ++ { ++ fprintf(stderr, "Test failed for constant_time_is_zero(%du): " ++ "expected %du (FALSE), got %du\n", a, CONSTTIME_FALSE, ++ c); ++ return 1; ++ } ++ return 0; ++ } ++ ++static int test_is_zero_8(unsigned int a) ++ { ++ unsigned char c = constant_time_is_zero_8(a); ++ if (a == 0 && c != CONSTTIME_TRUE_8) ++ { ++ fprintf(stderr, "Test failed for constant_time_is_zero(%du): " ++ "expected %u (TRUE), got %u\n", a, CONSTTIME_TRUE_8, c); ++ return 1; ++ } ++ else if (a != 0 && c != CONSTTIME_FALSE) ++ { ++ fprintf(stderr, "Test failed for constant_time_is_zero(%du): " ++ "expected %u (FALSE), got %u\n", a, CONSTTIME_FALSE_8, ++ c); ++ return 1; ++ } ++ return 0; ++ } ++ ++static int test_select(unsigned int a, unsigned int b) ++ { ++ unsigned int selected = constant_time_select(CONSTTIME_TRUE, a, b); ++ if (selected != a) ++ { ++ fprintf(stderr, "Test failed for constant_time_select(%du, %du," ++ "%du): expected %du(first value), got %du\n", ++ CONSTTIME_TRUE, a, b, a, selected); ++ return 1; ++ } ++ selected = constant_time_select(CONSTTIME_FALSE, a, b); ++ if (selected != b) ++ { ++ fprintf(stderr, "Test failed for constant_time_select(%du, %du," ++ "%du): expected %du(second value), got %du\n", ++ CONSTTIME_FALSE, a, b, b, selected); ++ return 1; ++ } ++ return 0; ++ } ++ ++static int test_select_8(unsigned char a, unsigned char b) ++ { ++ unsigned char selected = constant_time_select_8(CONSTTIME_TRUE_8, a, b); ++ if (selected != a) ++ { ++ fprintf(stderr, "Test failed for constant_time_select(%u, %u," ++ "%u): expected %u(first value), got %u\n", ++ CONSTTIME_TRUE, a, b, a, selected); ++ return 1; ++ } ++ selected = constant_time_select_8(CONSTTIME_FALSE_8, a, b); ++ if (selected != b) ++ { ++ fprintf(stderr, "Test failed for constant_time_select(%u, %u," ++ "%u): expected %u(second value), got %u\n", ++ CONSTTIME_FALSE, a, b, b, selected); ++ return 1; ++ } ++ return 0; ++ } ++ ++static int test_select_int(int a, int b) ++ { ++ int selected = constant_time_select_int(CONSTTIME_TRUE, a, b); ++ if (selected != a) ++ { ++ fprintf(stderr, "Test failed for constant_time_select(%du, %d," ++ "%d): expected %d(first value), got %d\n", ++ CONSTTIME_TRUE, a, b, a, selected); ++ return 1; ++ } ++ selected = constant_time_select_int(CONSTTIME_FALSE, a, b); ++ if (selected != b) ++ { ++ fprintf(stderr, "Test failed for constant_time_select(%du, %d," ++ "%d): expected %d(second value), got %d\n", ++ CONSTTIME_FALSE, a, b, b, selected); ++ return 1; ++ } ++ return 0; ++ } ++ ++static int test_eq_int(int a, int b) ++ { ++ unsigned int equal = constant_time_eq_int(a, b); ++ if (a == b && equal != CONSTTIME_TRUE) ++ { ++ fprintf(stderr, "Test failed for constant_time_eq_int(%d, %d): " ++ "expected %du(TRUE), got %du\n", ++ a, b, CONSTTIME_TRUE, equal); ++ return 1; ++ } ++ else if (a != b && equal != CONSTTIME_FALSE) ++ { ++ fprintf(stderr, "Test failed for constant_time_eq_int(%d, %d): " ++ "expected %du(FALSE), got %du\n", ++ a, b, CONSTTIME_FALSE, equal); ++ return 1; ++ } ++ return 0; ++ } ++ ++static int test_eq_int_8(int a, int b) ++ { ++ unsigned char equal = constant_time_eq_int_8(a, b); ++ if (a == b && equal != CONSTTIME_TRUE_8) ++ { ++ fprintf(stderr, "Test failed for constant_time_eq_int_8(%d, %d): " ++ "expected %u(TRUE), got %u\n", ++ a, b, CONSTTIME_TRUE_8, equal); ++ return 1; ++ } ++ else if (a != b && equal != CONSTTIME_FALSE_8) ++ { ++ fprintf(stderr, "Test failed for constant_time_eq_int_8(%d, %d): " ++ "expected %u(FALSE), got %u\n", ++ a, b, CONSTTIME_FALSE_8, equal); ++ return 1; ++ } ++ return 0; ++ } ++ ++static unsigned int test_values[] = {0, 1, 1024, 12345, 32000, UINT_MAX/2-1, ++ UINT_MAX/2, UINT_MAX/2+1, UINT_MAX-1, ++ UINT_MAX}; ++ ++static unsigned char test_values_8[] = {0, 1, 2, 20, 32, 127, 128, 129, 255}; ++ ++static int signed_test_values[] = {0, 1, -1, 1024, -1024, 12345, -12345, ++ 32000, -32000, INT_MAX, INT_MIN, INT_MAX-1, ++ INT_MIN+1}; ++ ++ ++int main(int argc, char *argv[]) ++ { ++ unsigned int a, b, i, j; ++ int c, d; ++ unsigned char e, f; ++ int num_failed = 0, num_all = 0; ++ fprintf(stdout, "Testing constant time operations...\n"); ++ ++ for (i = 0; i < sizeof(test_values)/sizeof(int); ++i) ++ { ++ a = test_values[i]; ++ num_failed += test_is_zero(a); ++ num_failed += test_is_zero_8(a); ++ num_all += 2; ++ for (j = 0; j < sizeof(test_values)/sizeof(int); ++j) ++ { ++ b = test_values[j]; ++ num_failed += test_binary_op(&constant_time_lt, ++ "constant_time_lt", a, b, a < b); ++ num_failed += test_binary_op_8(&constant_time_lt_8, ++ "constant_time_lt_8", a, b, a < b); ++ num_failed += test_binary_op(&constant_time_lt, ++ "constant_time_lt_8", b, a, b < a); ++ num_failed += test_binary_op_8(&constant_time_lt_8, ++ "constant_time_lt_8", b, a, b < a); ++ num_failed += test_binary_op(&constant_time_ge, ++ "constant_time_ge", a, b, a >= b); ++ num_failed += test_binary_op_8(&constant_time_ge_8, ++ "constant_time_ge_8", a, b, a >= b); ++ num_failed += test_binary_op(&constant_time_ge, ++ "constant_time_ge", b, a, b >= a); ++ num_failed += test_binary_op_8(&constant_time_ge_8, ++ "constant_time_ge_8", b, a, b >= a); ++ num_failed += test_binary_op(&constant_time_eq, ++ "constant_time_eq", a, b, a == b); ++ num_failed += test_binary_op_8(&constant_time_eq_8, ++ "constant_time_eq_8", a, b, a == b); ++ num_failed += test_binary_op(&constant_time_eq, ++ "constant_time_eq", b, a, b == a); ++ num_failed += test_binary_op_8(&constant_time_eq_8, ++ "constant_time_eq_8", b, a, b == a); ++ num_failed += test_select(a, b); ++ num_all += 13; ++ } ++ } ++ ++ for (i = 0; i < sizeof(signed_test_values)/sizeof(int); ++i) ++ { ++ c = signed_test_values[i]; ++ for (j = 0; j < sizeof(signed_test_values)/sizeof(int); ++j) ++ { ++ d = signed_test_values[j]; ++ num_failed += test_select_int(c, d); ++ num_failed += test_eq_int(c, d); ++ num_failed += test_eq_int_8(c, d); ++ num_all += 3; ++ } ++ } ++ ++ for (i = 0; i < sizeof(test_values_8); ++i) ++ { ++ e = test_values_8[i]; ++ for (j = 0; j < sizeof(test_values_8); ++j) ++ { ++ f = test_values_8[j]; ++ num_failed += test_select_8(e, f); ++ num_all += 1; ++ } ++ } ++ ++ if (!num_failed) ++ { ++ fprintf(stdout, "ok (ran %d tests)\n", num_all); ++ return EXIT_SUCCESS; ++ } ++ else ++ { ++ fprintf(stdout, "%d of %d tests failed!\n", num_failed, num_all); ++ return EXIT_FAILURE; ++ } ++ } + +Property changes on: crypto/openssl/crypto/constant_time_test.c +___________________________________________________________________ +Added: svn:eol-style +## -0,0 +1 ## ++native +\ No newline at end of property +Added: svn:mime-type +## -0,0 +1 ## ++text/plain +\ No newline at end of property +Added: svn:keywords +## -0,0 +1 ## ++FreeBSD=%H +\ No newline at end of property +Index: crypto/openssl/crypto/dsa/dsa_ameth.c +=================================================================== +--- crypto/openssl/crypto/dsa/dsa_ameth.c (revision 273303) ++++ crypto/openssl/crypto/dsa/dsa_ameth.c (working copy) +@@ -307,6 +307,12 @@ static int dsa_priv_encode(PKCS8_PRIV_KEY_INFO *p8 + unsigned char *dp = NULL; + int dplen; + ++ if (!pkey->pkey.dsa || !pkey->pkey.dsa->priv_key) ++ { ++ DSAerr(DSA_F_DSA_PRIV_ENCODE,DSA_R_MISSING_PARAMETERS); ++ goto err; ++ } ++ + params = ASN1_STRING_new(); + + if (!params) +@@ -701,4 +707,3 @@ const EVP_PKEY_ASN1_METHOD dsa_asn1_meths[] = + old_dsa_priv_encode + } + }; +- +Index: crypto/openssl/crypto/ebcdic.h +=================================================================== +--- crypto/openssl/crypto/ebcdic.h (revision 273303) ++++ crypto/openssl/crypto/ebcdic.h (working copy) +@@ -5,6 +5,10 @@ + + #include + ++#ifdef __cplusplus ++extern "C" { ++#endif ++ + /* Avoid name clashes with other applications */ + #define os_toascii _openssl_os_toascii + #define os_toebcdic _openssl_os_toebcdic +@@ -16,4 +20,7 @@ extern const unsigned char os_toebcdic[256]; + void *ebcdic2ascii(void *dest, const void *srce, size_t count); + void *ascii2ebcdic(void *dest, const void *srce, size_t count); + ++#ifdef __cplusplus ++} + #endif ++#endif +Index: crypto/openssl/crypto/ec/ec.h +=================================================================== +--- crypto/openssl/crypto/ec/ec.h (revision 273303) ++++ crypto/openssl/crypto/ec/ec.h (working copy) +@@ -629,7 +629,7 @@ int EC_POINT_cmp(const EC_GROUP *group, const EC_P + int EC_POINT_make_affine(const EC_GROUP *group, EC_POINT *point, BN_CTX *ctx); + int EC_POINTs_make_affine(const EC_GROUP *group, size_t num, EC_POINT *points[], BN_CTX *ctx); + +-/** Computes r = generator * n sum_{i=0}^num p[i] * m[i] ++/** Computes r = generator * n sum_{i=0}^{num-1} p[i] * m[i] + * \param group underlying EC_GROUP object + * \param r EC_POINT object for the result + * \param n BIGNUM with the multiplier for the group generator (optional) +Index: crypto/openssl/crypto/ec/ec2_smpl.c +=================================================================== +--- crypto/openssl/crypto/ec/ec2_smpl.c (revision 273303) ++++ crypto/openssl/crypto/ec/ec2_smpl.c (working copy) +@@ -80,9 +80,6 @@ + + const EC_METHOD *EC_GF2m_simple_method(void) + { +-#ifdef OPENSSL_FIPS +- return fips_ec_gf2m_simple_method(); +-#else + static const EC_METHOD ret = { + EC_FLAGS_DEFAULT_OCT, + NID_X9_62_characteristic_two_field, +@@ -125,8 +122,12 @@ const EC_METHOD *EC_GF2m_simple_method(void) + 0 /* field_decode */, + 0 /* field_set_to_one */ }; + ++#ifdef OPENSSL_FIPS ++ if (FIPS_mode()) ++ return fips_ec_gf2m_simple_method(); ++#endif ++ + return &ret; +-#endif + } + + +Index: crypto/openssl/crypto/ec/ec_ameth.c +=================================================================== +--- crypto/openssl/crypto/ec/ec_ameth.c (revision 273303) ++++ crypto/openssl/crypto/ec/ec_ameth.c (working copy) +@@ -453,14 +453,16 @@ static int do_EC_KEY_print(BIO *bp, const EC_KEY * + if (ktype > 0) + { + public_key = EC_KEY_get0_public_key(x); +- if ((pub_key = EC_POINT_point2bn(group, public_key, +- EC_KEY_get_conv_form(x), NULL, ctx)) == NULL) ++ if (public_key != NULL) + { +- reason = ERR_R_EC_LIB; +- goto err; ++ if ((pub_key = EC_POINT_point2bn(group, public_key, ++ EC_KEY_get_conv_form(x), NULL, ctx)) == NULL) ++ { ++ reason = ERR_R_EC_LIB; ++ goto err; ++ } ++ buf_len = (size_t)BN_num_bytes(pub_key); + } +- if (pub_key) +- buf_len = (size_t)BN_num_bytes(pub_key); + } + + if (ktype == 2) +Index: crypto/openssl/crypto/ec/ec_asn1.c +=================================================================== +--- crypto/openssl/crypto/ec/ec_asn1.c (revision 273303) ++++ crypto/openssl/crypto/ec/ec_asn1.c (working copy) +@@ -1183,30 +1183,47 @@ EC_KEY *d2i_ECPrivateKey(EC_KEY **a, const unsigne + goto err; + } + ++ if (ret->pub_key) ++ EC_POINT_clear_free(ret->pub_key); ++ ret->pub_key = EC_POINT_new(ret->group); ++ if (ret->pub_key == NULL) ++ { ++ ECerr(EC_F_D2I_ECPRIVATEKEY, ERR_R_EC_LIB); ++ goto err; ++ } ++ + if (priv_key->publicKey) + { + const unsigned char *pub_oct; +- size_t pub_oct_len; ++ int pub_oct_len; + +- if (ret->pub_key) +- EC_POINT_clear_free(ret->pub_key); +- ret->pub_key = EC_POINT_new(ret->group); +- if (ret->pub_key == NULL) ++ pub_oct = M_ASN1_STRING_data(priv_key->publicKey); ++ pub_oct_len = M_ASN1_STRING_length(priv_key->publicKey); ++ /* The first byte - point conversion form - must be present. */ ++ if (pub_oct_len <= 0) + { +- ECerr(EC_F_D2I_ECPRIVATEKEY, ERR_R_EC_LIB); ++ ECerr(EC_F_D2I_ECPRIVATEKEY, EC_R_BUFFER_TOO_SMALL); + goto err; + } +- pub_oct = M_ASN1_STRING_data(priv_key->publicKey); +- pub_oct_len = M_ASN1_STRING_length(priv_key->publicKey); +- /* save the point conversion form */ ++ /* Save the point conversion form. */ + ret->conv_form = (point_conversion_form_t)(pub_oct[0] & ~0x01); + if (!EC_POINT_oct2point(ret->group, ret->pub_key, +- pub_oct, pub_oct_len, NULL)) ++ pub_oct, (size_t)(pub_oct_len), NULL)) + { + ECerr(EC_F_D2I_ECPRIVATEKEY, ERR_R_EC_LIB); + goto err; + } + } ++ else ++ { ++ if (!EC_POINT_mul(ret->group, ret->pub_key, ret->priv_key, NULL, NULL, NULL)) ++ { ++ ECerr(EC_F_D2I_ECPRIVATEKEY, ERR_R_EC_LIB); ++ goto err; ++ } ++ /* Remember the original private-key-only encoding. */ ++ ret->enc_flag |= EC_PKEY_NO_PUBKEY; ++ } + + ok = 1; + err: +@@ -1230,7 +1247,8 @@ int i2d_ECPrivateKey(EC_KEY *a, unsigned char **ou + size_t buf_len=0, tmp_len; + EC_PRIVATEKEY *priv_key=NULL; + +- if (a == NULL || a->group == NULL || a->priv_key == NULL) ++ if (a == NULL || a->group == NULL || a->priv_key == NULL || ++ (!(a->enc_flag & EC_PKEY_NO_PUBKEY) && a->pub_key == NULL)) + { + ECerr(EC_F_I2D_ECPRIVATEKEY, + ERR_R_PASSED_NULL_PARAMETER); +Index: crypto/openssl/crypto/ec/ecp_mont.c +=================================================================== +--- crypto/openssl/crypto/ec/ecp_mont.c (revision 273303) ++++ crypto/openssl/crypto/ec/ecp_mont.c (working copy) +@@ -72,9 +72,6 @@ + + const EC_METHOD *EC_GFp_mont_method(void) + { +-#ifdef OPENSSL_FIPS +- return fips_ec_gfp_mont_method(); +-#else + static const EC_METHOD ret = { + EC_FLAGS_DEFAULT_OCT, + NID_X9_62_prime_field, +@@ -114,8 +111,12 @@ const EC_METHOD *EC_GFp_mont_method(void) + ec_GFp_mont_field_decode, + ec_GFp_mont_field_set_to_one }; + ++#ifdef OPENSSL_FIPS ++ if (FIPS_mode()) ++ return fips_ec_gfp_mont_method(); ++#endif ++ + return &ret; +-#endif + } + + +Index: crypto/openssl/crypto/ec/ecp_nist.c +=================================================================== +--- crypto/openssl/crypto/ec/ecp_nist.c (revision 273303) ++++ crypto/openssl/crypto/ec/ecp_nist.c (working copy) +@@ -73,9 +73,6 @@ + + const EC_METHOD *EC_GFp_nist_method(void) + { +-#ifdef OPENSSL_FIPS +- return fips_ec_gfp_nist_method(); +-#else + static const EC_METHOD ret = { + EC_FLAGS_DEFAULT_OCT, + NID_X9_62_prime_field, +@@ -115,8 +112,12 @@ const EC_METHOD *EC_GFp_nist_method(void) + 0 /* field_decode */, + 0 /* field_set_to_one */ }; + ++#ifdef OPENSSL_FIPS ++ if (FIPS_mode()) ++ return fips_ec_gfp_nist_method(); ++#endif ++ + return &ret; +-#endif + } + + int ec_GFp_nist_group_copy(EC_GROUP *dest, const EC_GROUP *src) +Index: crypto/openssl/crypto/ec/ecp_smpl.c +=================================================================== +--- crypto/openssl/crypto/ec/ecp_smpl.c (revision 273303) ++++ crypto/openssl/crypto/ec/ecp_smpl.c (working copy) +@@ -73,9 +73,6 @@ + + const EC_METHOD *EC_GFp_simple_method(void) + { +-#ifdef OPENSSL_FIPS +- return fips_ec_gfp_simple_method(); +-#else + static const EC_METHOD ret = { + EC_FLAGS_DEFAULT_OCT, + NID_X9_62_prime_field, +@@ -115,8 +112,12 @@ const EC_METHOD *EC_GFp_simple_method(void) + 0 /* field_decode */, + 0 /* field_set_to_one */ }; + ++#ifdef OPENSSL_FIPS ++ if (FIPS_mode()) ++ return fips_ec_gfp_simple_method(); ++#endif ++ + return &ret; +-#endif + } + + +@@ -1317,8 +1318,8 @@ int ec_GFp_simple_points_make_affine(const EC_GROU + { + for (i = 0; i < num; i++) + { +- if (prod_Z[i] != NULL) +- BN_clear_free(prod_Z[i]); ++ if (prod_Z[i] == NULL) break; ++ BN_clear_free(prod_Z[i]); + } + OPENSSL_free(prod_Z); + } +Index: crypto/openssl/crypto/ec/ectest.c +=================================================================== +--- crypto/openssl/crypto/ec/ectest.c (revision 273303) ++++ crypto/openssl/crypto/ec/ectest.c (working copy) +@@ -251,6 +251,7 @@ static void group_order_tests(EC_GROUP *group) + if (!EC_POINT_is_at_infinity(group, Q)) ABORT; + + /* Exercise EC_POINTs_mul, including corner cases. */ ++ if (EC_POINT_is_at_infinity(group, P)) ABORT; + scalars[0] = n1; points[0] = Q; /* => infinity */ + scalars[1] = n2; points[1] = P; /* => -P */ + scalars[2] = n1; points[2] = Q; /* => infinity */ +@@ -257,8 +258,8 @@ static void group_order_tests(EC_GROUP *group) + scalars[3] = n2; points[3] = Q; /* => infinity */ + scalars[4] = n1; points[4] = P; /* => P */ + scalars[5] = n2; points[5] = Q; /* => infinity */ +- if (!EC_POINTs_mul(group, Q, NULL, 5, points, scalars, ctx)) ABORT; +- if (!EC_POINT_is_at_infinity(group, Q)) ABORT; ++ if (!EC_POINTs_mul(group, P, NULL, 6, points, scalars, ctx)) ABORT; ++ if (!EC_POINT_is_at_infinity(group, P)) ABORT; + } + fprintf(stdout, "ok\n"); + +Index: crypto/openssl/crypto/evp/Makefile +=================================================================== +--- crypto/openssl/crypto/evp/Makefile (revision 273303) ++++ crypto/openssl/crypto/evp/Makefile (working copy) +@@ -383,7 +383,7 @@ evp_enc.o: ../../include/openssl/pkcs7.h ../../inc + evp_enc.o: ../../include/openssl/safestack.h ../../include/openssl/sha.h + evp_enc.o: ../../include/openssl/stack.h ../../include/openssl/symhacks.h + evp_enc.o: ../../include/openssl/x509.h ../../include/openssl/x509_vfy.h +-evp_enc.o: ../cryptlib.h evp_enc.c evp_locl.h ++evp_enc.o: ../constant_time_locl.h ../cryptlib.h evp_enc.c evp_locl.h + evp_err.o: ../../include/openssl/asn1.h ../../include/openssl/bio.h + evp_err.o: ../../include/openssl/crypto.h ../../include/openssl/e_os2.h + evp_err.o: ../../include/openssl/err.h ../../include/openssl/evp.h +Index: crypto/openssl/crypto/evp/e_aes.c +=================================================================== +--- crypto/openssl/crypto/evp/e_aes.c (revision 273303) ++++ crypto/openssl/crypto/evp/e_aes.c (working copy) +@@ -166,7 +166,7 @@ extern unsigned int OPENSSL_ia32cap_P[2]; + #define VPAES_CAPABLE (OPENSSL_ia32cap_P[1]&(1<<(41-32))) + #endif + #ifdef BSAES_ASM +-#define BSAES_CAPABLE VPAES_CAPABLE ++#define BSAES_CAPABLE (OPENSSL_ia32cap_P[1]&(1<<(41-32))) + #endif + /* + * AES-NI section +Index: crypto/openssl/crypto/evp/evp_enc.c +=================================================================== +--- crypto/openssl/crypto/evp/evp_enc.c (revision 273303) ++++ crypto/openssl/crypto/evp/evp_enc.c (working copy) +@@ -67,6 +67,7 @@ + #ifdef OPENSSL_FIPS + #include + #endif ++#include "constant_time_locl.h" + #include "evp_locl.h" + + #ifdef OPENSSL_FIPS +@@ -500,21 +501,21 @@ int EVP_DecryptFinal(EVP_CIPHER_CTX *ctx, unsigned + + int EVP_DecryptFinal_ex(EVP_CIPHER_CTX *ctx, unsigned char *out, int *outl) + { +- int i,n; +- unsigned int b; ++ unsigned int i, b; ++ unsigned char pad, padding_good; + *outl=0; + + if (ctx->cipher->flags & EVP_CIPH_FLAG_CUSTOM_CIPHER) + { +- i = M_do_cipher(ctx, out, NULL, 0); +- if (i < 0) ++ int ret = M_do_cipher(ctx, out, NULL, 0); ++ if (ret < 0) + return 0; + else +- *outl = i; ++ *outl = ret; + return 1; + } + +- b=ctx->cipher->block_size; ++ b=(unsigned int)(ctx->cipher->block_size); + if (ctx->flags & EVP_CIPH_NO_PADDING) + { + if(ctx->buf_len) +@@ -533,28 +534,34 @@ int EVP_DecryptFinal_ex(EVP_CIPHER_CTX *ctx, unsig + return(0); + } + OPENSSL_assert(b <= sizeof ctx->final); +- n=ctx->final[b-1]; +- if (n == 0 || n > (int)b) ++ pad=ctx->final[b-1]; ++ ++ padding_good = (unsigned char)(~constant_time_is_zero_8(pad)); ++ padding_good &= constant_time_ge_8(b, pad); ++ ++ for (i = 1; i < b; ++i) + { +- EVPerr(EVP_F_EVP_DECRYPTFINAL_EX,EVP_R_BAD_DECRYPT); +- return(0); ++ unsigned char is_pad_index = constant_time_lt_8(i, pad); ++ unsigned char pad_byte_good = constant_time_eq_8(ctx->final[b-i-1], pad); ++ padding_good &= constant_time_select_8(is_pad_index, pad_byte_good, 0xff); + } +- for (i=0; ifinal[--b] != n) +- { +- EVPerr(EVP_F_EVP_DECRYPTFINAL_EX,EVP_R_BAD_DECRYPT); +- return(0); +- } +- } +- n=ctx->cipher->block_size-n; +- for (i=0; ifinal[i]; +- *outl=n; ++ ++ /* ++ * At least 1 byte is always padding, so we always write b - 1 ++ * bytes to avoid a timing leak. The caller is required to have |b| ++ * bytes space in |out| by the API contract. ++ */ ++ for (i = 0; i < b - 1; ++i) ++ out[i] = ctx->final[i] & padding_good; ++ /* Safe cast: for a good padding, EVP_MAX_IV_LENGTH >= b >= pad */ ++ *outl = padding_good & ((unsigned char)(b - pad)); ++ return padding_good & 1; + } + else +- *outl=0; +- return(1); ++ { ++ *outl = 0; ++ return 1; ++ } + } + + void EVP_CIPHER_CTX_free(EVP_CIPHER_CTX *ctx) +@@ -678,4 +685,3 @@ int EVP_CIPHER_CTX_copy(EVP_CIPHER_CTX *out, const + return in->cipher->ctrl((EVP_CIPHER_CTX *)in, EVP_CTRL_COPY, 0, out); + return 1; + } +- +Index: crypto/openssl/crypto/md5/asm/md5-x86_64.pl +=================================================================== +--- crypto/openssl/crypto/md5/asm/md5-x86_64.pl (revision 273303) ++++ crypto/openssl/crypto/md5/asm/md5-x86_64.pl (working copy) +@@ -108,6 +108,7 @@ sub round4_step + EOF + } + ++no warnings qw(uninitialized); + my $flavour = shift; + my $output = shift; + if ($flavour =~ /\./) { $output = $flavour; undef $flavour; } +@@ -119,7 +120,6 @@ $0 =~ m/(.*[\/\\])[^\/\\]+$/; my $dir=$1; my $xlat + ( $xlate="${dir}../../perlasm/x86_64-xlate.pl" and -f $xlate) or + die "can't locate x86_64-xlate.pl"; + +-no warnings qw(uninitialized); + open OUT,"| \"$^X\" $xlate $flavour $output"; + *STDOUT=*OUT; + +Index: crypto/openssl/crypto/modes/modes.h +=================================================================== +--- crypto/openssl/crypto/modes/modes.h (revision 273303) ++++ crypto/openssl/crypto/modes/modes.h (working copy) +@@ -7,6 +7,9 @@ + + #include + ++#ifdef __cplusplus ++extern "C" { ++#endif + typedef void (*block128_f)(const unsigned char in[16], + unsigned char out[16], + const void *key); +@@ -133,3 +136,6 @@ typedef struct xts128_context XTS128_CONTEXT; + + int CRYPTO_xts128_encrypt(const XTS128_CONTEXT *ctx, const unsigned char iv[16], + const unsigned char *inp, unsigned char *out, size_t len, int enc); ++#ifdef __cplusplus ++} ++#endif +Index: crypto/openssl/crypto/ocsp/ocsp_vfy.c +=================================================================== +--- crypto/openssl/crypto/ocsp/ocsp_vfy.c (revision 273303) ++++ crypto/openssl/crypto/ocsp/ocsp_vfy.c (working copy) +@@ -436,8 +436,11 @@ static int ocsp_req_find_signer(X509 **psigner, OC + if(!(flags & OCSP_NOINTERN)) + { + signer = X509_find_by_subject(req->optionalSignature->certs, nm); +- *psigner = signer; +- return 1; ++ if (signer) ++ { ++ *psigner = signer; ++ return 1; ++ } + } + + signer = X509_find_by_subject(certs, nm); +Index: crypto/openssl/crypto/opensslconf.h +=================================================================== +--- crypto/openssl/crypto/opensslconf.h (revision 273303) ++++ crypto/openssl/crypto/opensslconf.h (working copy) +@@ -1,6 +1,9 @@ + /* opensslconf.h */ + /* WARNING: Generated automatically from opensslconf.h.in by Configure. */ + ++#ifdef __cplusplus ++extern "C" { ++#endif + /* OpenSSL was configured with the following options: */ + #ifndef OPENSSL_DOING_MAKEDEPEND + +@@ -233,3 +236,6 @@ YOU SHOULD NOT HAVE BOTH DES_RISC1 AND DES_RISC2 D + + #endif /* DES_DEFAULT_OPTIONS */ + #endif /* HEADER_DES_LOCL_H */ ++#ifdef __cplusplus ++} ++#endif +Index: crypto/openssl/crypto/opensslv.h +=================================================================== +--- crypto/openssl/crypto/opensslv.h (revision 273303) ++++ crypto/openssl/crypto/opensslv.h (working copy) +@@ -1,6 +1,10 @@ + #ifndef HEADER_OPENSSLV_H + #define HEADER_OPENSSLV_H + ++#ifdef __cplusplus ++extern "C" { ++#endif ++ + /* Numeric release version identifier: + * MNNFFPPS: major minor fix patch status + * The status nibble has one of the values 0 for development, 1 to e for betas +@@ -25,11 +29,11 @@ + * (Prior to 0.9.5a beta1, a different scheme was used: MMNNFFRBB for + * major minor fix final patch/beta) + */ +-#define OPENSSL_VERSION_NUMBER 0x1000109fL ++#define OPENSSL_VERSION_NUMBER 0x100010afL + #ifdef OPENSSL_FIPS +-#define OPENSSL_VERSION_TEXT "OpenSSL 1.0.1i-fips 6 Aug 2014" ++#define OPENSSL_VERSION_TEXT "OpenSSL 1.0.1j-fips 15 Oct 2014" + #else +-#define OPENSSL_VERSION_TEXT "OpenSSL 1.0.1i-freebsd 6 Aug 2014" ++#define OPENSSL_VERSION_TEXT "OpenSSL 1.0.1j-freebsd 15 Oct 2014" + #endif + #define OPENSSL_VERSION_PTEXT " part of " OPENSSL_VERSION_TEXT + +@@ -86,4 +90,7 @@ + #define SHLIB_VERSION_NUMBER "7" + + ++#ifdef __cplusplus ++} ++#endif + #endif /* HEADER_OPENSSLV_H */ +Index: crypto/openssl/crypto/ossl_typ.h +=================================================================== +--- crypto/openssl/crypto/ossl_typ.h (revision 273303) ++++ crypto/openssl/crypto/ossl_typ.h (working copy) +@@ -55,6 +55,10 @@ + #ifndef HEADER_OPENSSL_TYPES_H + #define HEADER_OPENSSL_TYPES_H + ++#ifdef __cplusplus ++extern "C" { ++#endif ++ + #include + + #ifdef NO_ASN1_TYPEDEFS +@@ -199,4 +203,7 @@ typedef struct ocsp_req_ctx_st OCSP_REQ_CTX; + typedef struct ocsp_response_st OCSP_RESPONSE; + typedef struct ocsp_responder_id_st OCSP_RESPID; + ++#ifdef __cplusplus ++} ++#endif + #endif /* def HEADER_OPENSSL_TYPES_H */ +Index: crypto/openssl/crypto/pkcs7/pkcs7.h +=================================================================== +--- crypto/openssl/crypto/pkcs7/pkcs7.h (revision 273303) ++++ crypto/openssl/crypto/pkcs7/pkcs7.h (working copy) +@@ -233,11 +233,7 @@ DECLARE_PKCS12_STACK_OF(PKCS7) + (OBJ_obj2nid((a)->type) == NID_pkcs7_signedAndEnveloped) + #define PKCS7_type_is_data(a) (OBJ_obj2nid((a)->type) == NID_pkcs7_data) + #define PKCS7_type_is_digest(a) (OBJ_obj2nid((a)->type) == NID_pkcs7_digest) +-#define PKCS7_type_is_encrypted(a) \ +- (OBJ_obj2nid((a)->type) == NID_pkcs7_encrypted) + +-#define PKCS7_type_is_digest(a) (OBJ_obj2nid((a)->type) == NID_pkcs7_digest) +- + #define PKCS7_set_detached(p,v) \ + PKCS7_ctrl(p,PKCS7_OP_SET_DETACHED_SIGNATURE,v,NULL) + #define PKCS7_get_detached(p) \ +Index: crypto/openssl/crypto/pqueue/pqueue.h +=================================================================== +--- crypto/openssl/crypto/pqueue/pqueue.h (revision 273303) ++++ crypto/openssl/crypto/pqueue/pqueue.h (working copy) +@@ -64,6 +64,9 @@ + #include + #include + ++#ifdef __cplusplus ++extern "C" { ++#endif + typedef struct _pqueue *pqueue; + + typedef struct _pitem +@@ -91,4 +94,7 @@ pitem *pqueue_next(piterator *iter); + void pqueue_print(pqueue pq); + int pqueue_size(pqueue pq); + ++#ifdef __cplusplus ++} ++#endif + #endif /* ! HEADER_PQUEUE_H */ +Index: crypto/openssl/crypto/rsa/Makefile +=================================================================== +--- crypto/openssl/crypto/rsa/Makefile (revision 273303) ++++ crypto/openssl/crypto/rsa/Makefile (working copy) +@@ -212,7 +212,7 @@ rsa_oaep.o: ../../include/openssl/opensslv.h ../.. + rsa_oaep.o: ../../include/openssl/rand.h ../../include/openssl/rsa.h + rsa_oaep.o: ../../include/openssl/safestack.h ../../include/openssl/sha.h + rsa_oaep.o: ../../include/openssl/stack.h ../../include/openssl/symhacks.h +-rsa_oaep.o: ../cryptlib.h rsa_oaep.c ++rsa_oaep.o: ../constant_time_locl.h ../cryptlib.h rsa_oaep.c + rsa_pk1.o: ../../e_os.h ../../include/openssl/asn1.h + rsa_pk1.o: ../../include/openssl/bio.h ../../include/openssl/bn.h + rsa_pk1.o: ../../include/openssl/buffer.h ../../include/openssl/crypto.h +@@ -221,7 +221,8 @@ rsa_pk1.o: ../../include/openssl/lhash.h ../../inc + rsa_pk1.o: ../../include/openssl/opensslv.h ../../include/openssl/ossl_typ.h + rsa_pk1.o: ../../include/openssl/rand.h ../../include/openssl/rsa.h + rsa_pk1.o: ../../include/openssl/safestack.h ../../include/openssl/stack.h +-rsa_pk1.o: ../../include/openssl/symhacks.h ../cryptlib.h rsa_pk1.c ++rsa_pk1.o: ../../include/openssl/symhacks.h ../constant_time_locl.h ++rsa_pk1.o: ../cryptlib.h rsa_pk1.c + rsa_pmeth.o: ../../e_os.h ../../include/openssl/asn1.h + rsa_pmeth.o: ../../include/openssl/asn1t.h ../../include/openssl/bio.h + rsa_pmeth.o: ../../include/openssl/bn.h ../../include/openssl/buffer.h +Index: crypto/openssl/crypto/rsa/rsa.h +=================================================================== +--- crypto/openssl/crypto/rsa/rsa.h (revision 273303) ++++ crypto/openssl/crypto/rsa/rsa.h (working copy) +@@ -559,6 +559,7 @@ void ERR_load_RSA_strings(void); + #define RSA_R_OPERATION_NOT_ALLOWED_IN_FIPS_MODE 158 + #define RSA_R_OPERATION_NOT_SUPPORTED_FOR_THIS_KEYTYPE 148 + #define RSA_R_PADDING_CHECK_FAILED 114 ++#define RSA_R_PKCS_DECODING_ERROR 159 + #define RSA_R_P_NOT_PRIME 128 + #define RSA_R_Q_NOT_PRIME 129 + #define RSA_R_RSA_OPERATIONS_NOT_SUPPORTED 130 +Index: crypto/openssl/crypto/rsa/rsa_err.c +=================================================================== +--- crypto/openssl/crypto/rsa/rsa_err.c (revision 273303) ++++ crypto/openssl/crypto/rsa/rsa_err.c (working copy) +@@ -175,6 +175,7 @@ static ERR_STRING_DATA RSA_str_reasons[]= + {ERR_REASON(RSA_R_OPERATION_NOT_ALLOWED_IN_FIPS_MODE),"operation not allowed in fips mode"}, + {ERR_REASON(RSA_R_OPERATION_NOT_SUPPORTED_FOR_THIS_KEYTYPE),"operation not supported for this keytype"}, + {ERR_REASON(RSA_R_PADDING_CHECK_FAILED) ,"padding check failed"}, ++{ERR_REASON(RSA_R_PKCS_DECODING_ERROR) ,"pkcs decoding error"}, + {ERR_REASON(RSA_R_P_NOT_PRIME) ,"p not prime"}, + {ERR_REASON(RSA_R_Q_NOT_PRIME) ,"q not prime"}, + {ERR_REASON(RSA_R_RSA_OPERATIONS_NOT_SUPPORTED),"rsa operations not supported"}, +Index: crypto/openssl/crypto/rsa/rsa_oaep.c +=================================================================== +--- crypto/openssl/crypto/rsa/rsa_oaep.c (revision 273303) ++++ crypto/openssl/crypto/rsa/rsa_oaep.c (working copy) +@@ -18,6 +18,7 @@ + * an equivalent notion. + */ + ++#include "constant_time_locl.h" + + #if !defined(OPENSSL_NO_SHA) && !defined(OPENSSL_NO_SHA1) + #include +@@ -95,92 +96,117 @@ int RSA_padding_check_PKCS1_OAEP(unsigned char *to + const unsigned char *from, int flen, int num, + const unsigned char *param, int plen) + { +- int i, dblen, mlen = -1; +- const unsigned char *maskeddb; +- int lzero; +- unsigned char *db = NULL, seed[SHA_DIGEST_LENGTH], phash[SHA_DIGEST_LENGTH]; +- unsigned char *padded_from; +- int bad = 0; ++ int i, dblen, mlen = -1, one_index = 0, msg_index; ++ unsigned int good, found_one_byte; ++ const unsigned char *maskedseed, *maskeddb; ++ /* |em| is the encoded message, zero-padded to exactly |num| bytes: ++ * em = Y || maskedSeed || maskedDB */ ++ unsigned char *db = NULL, *em = NULL, seed[EVP_MAX_MD_SIZE], ++ phash[EVP_MAX_MD_SIZE]; + +- if (--num < 2 * SHA_DIGEST_LENGTH + 1) +- /* 'num' is the length of the modulus, i.e. does not depend on the +- * particular ciphertext. */ ++ if (tlen <= 0 || flen <= 0) ++ return -1; ++ ++ /* ++ * |num| is the length of the modulus; |flen| is the length of the ++ * encoded message. Therefore, for any |from| that was obtained by ++ * decrypting a ciphertext, we must have |flen| <= |num|. Similarly, ++ * num < 2 * SHA_DIGEST_LENGTH + 2 must hold for the modulus ++ * irrespective of the ciphertext, see PKCS #1 v2.2, section 7.1.2. ++ * This does not leak any side-channel information. ++ */ ++ if (num < flen || num < 2 * SHA_DIGEST_LENGTH + 2) + goto decoding_err; + +- lzero = num - flen; +- if (lzero < 0) ++ dblen = num - SHA_DIGEST_LENGTH - 1; ++ db = OPENSSL_malloc(dblen); ++ em = OPENSSL_malloc(num); ++ if (db == NULL || em == NULL) + { +- /* signalling this error immediately after detection might allow +- * for side-channel attacks (e.g. timing if 'plen' is huge +- * -- cf. James H. Manger, "A Chosen Ciphertext Attack on RSA Optimal +- * Asymmetric Encryption Padding (OAEP) [...]", CRYPTO 2001), +- * so we use a 'bad' flag */ +- bad = 1; +- lzero = 0; +- flen = num; /* don't overflow the memcpy to padded_from */ +- } +- +- dblen = num - SHA_DIGEST_LENGTH; +- db = OPENSSL_malloc(dblen + num); +- if (db == NULL) +- { + RSAerr(RSA_F_RSA_PADDING_CHECK_PKCS1_OAEP, ERR_R_MALLOC_FAILURE); +- return -1; ++ goto cleanup; + } + +- /* Always do this zero-padding copy (even when lzero == 0) +- * to avoid leaking timing info about the value of lzero. */ +- padded_from = db + dblen; +- memset(padded_from, 0, lzero); +- memcpy(padded_from + lzero, from, flen); ++ /* ++ * Always do this zero-padding copy (even when num == flen) to avoid ++ * leaking that information. The copy still leaks some side-channel ++ * information, but it's impossible to have a fixed memory access ++ * pattern since we can't read out of the bounds of |from|. ++ * ++ * TODO(emilia): Consider porting BN_bn2bin_padded from BoringSSL. ++ */ ++ memset(em, 0, num); ++ memcpy(em + num - flen, from, flen); + +- maskeddb = padded_from + SHA_DIGEST_LENGTH; ++ /* ++ * The first byte must be zero, however we must not leak if this is ++ * true. See James H. Manger, "A Chosen Ciphertext Attack on RSA ++ * Optimal Asymmetric Encryption Padding (OAEP) [...]", CRYPTO 2001). ++ */ ++ good = constant_time_is_zero(em[0]); + ++ maskedseed = em + 1; ++ maskeddb = em + 1 + SHA_DIGEST_LENGTH; ++ + if (MGF1(seed, SHA_DIGEST_LENGTH, maskeddb, dblen)) +- return -1; ++ goto cleanup; + for (i = 0; i < SHA_DIGEST_LENGTH; i++) +- seed[i] ^= padded_from[i]; +- ++ seed[i] ^= maskedseed[i]; ++ + if (MGF1(db, dblen, seed, SHA_DIGEST_LENGTH)) +- return -1; ++ goto cleanup; + for (i = 0; i < dblen; i++) + db[i] ^= maskeddb[i]; + + if (!EVP_Digest((void *)param, plen, phash, NULL, EVP_sha1(), NULL)) +- return -1; ++ goto cleanup; + +- if (CRYPTO_memcmp(db, phash, SHA_DIGEST_LENGTH) != 0 || bad) ++ good &= constant_time_is_zero(CRYPTO_memcmp(db, phash, SHA_DIGEST_LENGTH)); ++ ++ found_one_byte = 0; ++ for (i = SHA_DIGEST_LENGTH; i < dblen; i++) ++ { ++ /* Padding consists of a number of 0-bytes, followed by a 1. */ ++ unsigned int equals1 = constant_time_eq(db[i], 1); ++ unsigned int equals0 = constant_time_is_zero(db[i]); ++ one_index = constant_time_select_int(~found_one_byte & equals1, ++ i, one_index); ++ found_one_byte |= equals1; ++ good &= (found_one_byte | equals0); ++ } ++ ++ good &= found_one_byte; ++ ++ /* ++ * At this point |good| is zero unless the plaintext was valid, ++ * so plaintext-awareness ensures timing side-channels are no longer a ++ * concern. ++ */ ++ if (!good) + goto decoding_err; ++ ++ msg_index = one_index + 1; ++ mlen = dblen - msg_index; ++ ++ if (tlen < mlen) ++ { ++ RSAerr(RSA_F_RSA_PADDING_CHECK_PKCS1_OAEP, RSA_R_DATA_TOO_LARGE); ++ mlen = -1; ++ } + else + { +- for (i = SHA_DIGEST_LENGTH; i < dblen; i++) +- if (db[i] != 0x00) +- break; +- if (i == dblen || db[i] != 0x01) +- goto decoding_err; +- else +- { +- /* everything looks OK */ +- +- mlen = dblen - ++i; +- if (tlen < mlen) +- { +- RSAerr(RSA_F_RSA_PADDING_CHECK_PKCS1_OAEP, RSA_R_DATA_TOO_LARGE); +- mlen = -1; +- } +- else +- memcpy(to, db + i, mlen); +- } ++ memcpy(to, db + msg_index, mlen); ++ goto cleanup; + } +- OPENSSL_free(db); +- return mlen; + + decoding_err: +- /* to avoid chosen ciphertext attacks, the error message should not reveal +- * which kind of decoding error happened */ ++ /* To avoid chosen ciphertext attacks, the error message should not reveal ++ * which kind of decoding error happened. */ + RSAerr(RSA_F_RSA_PADDING_CHECK_PKCS1_OAEP, RSA_R_OAEP_DECODING_ERROR); ++cleanup: + if (db != NULL) OPENSSL_free(db); +- return -1; ++ if (em != NULL) OPENSSL_free(em); ++ return mlen; + } + + int PKCS1_MGF1(unsigned char *mask, long len, +Index: crypto/openssl/crypto/rsa/rsa_pk1.c +=================================================================== +--- crypto/openssl/crypto/rsa/rsa_pk1.c (revision 273303) ++++ crypto/openssl/crypto/rsa/rsa_pk1.c (working copy) +@@ -56,6 +56,8 @@ + * [including the GNU Public Licence.] + */ + ++#include "constant_time_locl.h" ++ + #include + #include "cryptlib.h" + #include +@@ -181,44 +183,87 @@ int RSA_padding_add_PKCS1_type_2(unsigned char *to + int RSA_padding_check_PKCS1_type_2(unsigned char *to, int tlen, + const unsigned char *from, int flen, int num) + { +- int i,j; +- const unsigned char *p; ++ int i; ++ /* |em| is the encoded message, zero-padded to exactly |num| bytes */ ++ unsigned char *em = NULL; ++ unsigned int good, found_zero_byte; ++ int zero_index = 0, msg_index, mlen = -1; + +- p=from; +- if ((num != (flen+1)) || (*(p++) != 02)) ++ if (tlen < 0 || flen < 0) ++ return -1; ++ ++ /* PKCS#1 v1.5 decryption. See "PKCS #1 v2.2: RSA Cryptography ++ * Standard", section 7.2.2. */ ++ ++ if (flen > num) ++ goto err; ++ ++ if (num < 11) ++ goto err; ++ ++ em = OPENSSL_malloc(num); ++ if (em == NULL) + { +- RSAerr(RSA_F_RSA_PADDING_CHECK_PKCS1_TYPE_2,RSA_R_BLOCK_TYPE_IS_NOT_02); +- return(-1); ++ RSAerr(RSA_F_RSA_PADDING_CHECK_PKCS1_TYPE_2, ERR_R_MALLOC_FAILURE); ++ return -1; + } +-#ifdef PKCS1_CHECK +- return(num-11); +-#endif ++ memset(em, 0, num); ++ /* ++ * Always do this zero-padding copy (even when num == flen) to avoid ++ * leaking that information. The copy still leaks some side-channel ++ * information, but it's impossible to have a fixed memory access ++ * pattern since we can't read out of the bounds of |from|. ++ * ++ * TODO(emilia): Consider porting BN_bn2bin_padded from BoringSSL. ++ */ ++ memcpy(em + num - flen, from, flen); + +- /* scan over padding data */ +- j=flen-1; /* one for type. */ +- for (i=0; i tlen) +- { +- RSAerr(RSA_F_RSA_PADDING_CHECK_PKCS1_TYPE_2,RSA_R_DATA_TOO_LARGE); +- return(-1); +- } +- memcpy(to,p,(unsigned int)j); + +- return(j); ++ memcpy(to, em + msg_index, mlen); ++ ++err: ++ if (em != NULL) ++ OPENSSL_free(em); ++ if (mlen == -1) ++ RSAerr(RSA_F_RSA_PADDING_CHECK_PKCS1_TYPE_2, RSA_R_PKCS_DECODING_ERROR); ++ return mlen; + } +- +Index: crypto/openssl/crypto/rsa/rsa_sign.c +=================================================================== +--- crypto/openssl/crypto/rsa/rsa_sign.c (revision 273303) ++++ crypto/openssl/crypto/rsa/rsa_sign.c (working copy) +@@ -151,6 +151,25 @@ int RSA_sign(int type, const unsigned char *m, uns + return(ret); + } + ++/* ++ * Check DigestInfo structure does not contain extraneous data by reencoding ++ * using DER and checking encoding against original. ++ */ ++static int rsa_check_digestinfo(X509_SIG *sig, const unsigned char *dinfo, int dinfolen) ++ { ++ unsigned char *der = NULL; ++ int derlen; ++ int ret = 0; ++ derlen = i2d_X509_SIG(sig, &der); ++ if (derlen <= 0) ++ return 0; ++ if (derlen == dinfolen && !memcmp(dinfo, der, derlen)) ++ ret = 1; ++ OPENSSL_cleanse(der, derlen); ++ OPENSSL_free(der); ++ return ret; ++ } ++ + int int_rsa_verify(int dtype, const unsigned char *m, + unsigned int m_len, + unsigned char *rm, size_t *prm_len, +@@ -228,7 +247,7 @@ int int_rsa_verify(int dtype, const unsigned char + if (sig == NULL) goto err; + + /* Excess data can be used to create forgeries */ +- if(p != s+i) ++ if(p != s+i || !rsa_check_digestinfo(sig, s, i)) + { + RSAerr(RSA_F_INT_RSA_VERIFY,RSA_R_BAD_SIGNATURE); + goto err; +Index: crypto/openssl/crypto/stack/safestack.h +=================================================================== +--- crypto/openssl/crypto/stack/safestack.h (revision 273303) ++++ crypto/openssl/crypto/stack/safestack.h (working copy) +@@ -57,6 +57,10 @@ + + #include + ++#ifdef __cplusplus ++extern "C" { ++#endif ++ + #ifndef CHECKED_PTR_OF + #define CHECKED_PTR_OF(type, p) \ + ((void*) (1 ? p : (type*)0)) +@@ -2660,4 +2664,8 @@ DECLARE_SPECIAL_STACK_OF(OPENSSL_BLOCK, void) + #define lh_SSL_SESSION_free(lh) LHM_lh_free(SSL_SESSION,lh) + /* End of util/mkstack.pl block, you may now edit :-) */ + ++ ++#ifdef __cplusplus ++} ++#endif + #endif /* !defined HEADER_SAFESTACK_H */ +Index: crypto/openssl/doc/apps/c_rehash.pod +=================================================================== +--- crypto/openssl/doc/apps/c_rehash.pod (revision 0) ++++ crypto/openssl/doc/apps/c_rehash.pod (working copy) +@@ -0,0 +1,81 @@ ++=pod ++ ++=for comment ++Original text by James Westby, contributed under the OpenSSL license. ++ ++=head1 NAME ++ ++c_rehash - Create symbolic links to files named by the hash values ++ ++=head1 SYNOPSIS ++ ++B ++[ I...] ++ ++=head1 DESCRIPTION ++ ++B scans directories and calculates a hash value of each C<.pem> ++file in the specified directory list and creates symbolic links ++for each file, where the name of the link is the hash value. ++This utility is useful as many programs that use OpenSSL require ++directories to be set up like this in order to find certificates. ++ ++If any directories are named on the command line, then those are ++processed in turn. If not, then the B environment variable ++is consulted; this shold be a colon-separated list of directories, ++like the Unix B variable. ++If that is not set then the default directory (installation-specific ++but often B) is processed. ++ ++In order for a directory to be processed, the user must have write ++permissions on that directory, otherwise it will be skipped. ++The links created are of the form C, where each B ++is a hexadecimal character and B is a single decimal digit. ++When processing a directory, B will first remove all links ++that have a name in that syntax. If you have links in that format ++used for other purposes, they will be removed. ++Hashes for CRL's look similar except the letter B appears after ++the period, like this: C. ++ ++Multiple objects may have the same hash; they will be indicated by ++incrementing the B value. Duplicates are found by comparing the ++full SHA-1 fingerprint. A warning will be displayed if a duplicate ++is found. ++ ++A warning will also be displayed if there are B<.pem> files that ++cannot be parsed as either a certificate or a CRL. ++ ++The program uses the B program to compute the hashes and ++fingerprints. If not found in the user's B, then set the ++B environment variable to the full pathname. ++Any program can be used, it will be invoked as follows for either ++a certificate or CRL: ++ ++ $OPENSSL x509 -hash -fingerprint -noout -in FFFFFF ++ $OPENSSL crl -hash -fingerprint -noout -in FFFFFF ++ ++where B is the filename. It must output the hash of the ++file on the first line, and the fingerprint on the second, ++optionally prefixed with some text and an equals sign. ++ ++=head1 ENVIRONMENT ++ ++=over ++ ++=item B ++ ++The path to an executable to use to generate hashes and ++fingerprints (see above). ++ ++=item B ++ ++Colon separated list of directories to operate on. ++Ignored if directories are listed on the command line. ++ ++=back ++ ++=head1 SEE ALSO ++ ++L, ++L. ++L. +Index: crypto/openssl/doc/apps/dgst.pod +=================================================================== +--- crypto/openssl/doc/apps/dgst.pod (revision 273303) ++++ crypto/openssl/doc/apps/dgst.pod (working copy) +@@ -2,16 +2,17 @@ + + =head1 NAME + +-dgst, md5, md4, md2, sha1, sha, mdc2, ripemd160 - message digests ++dgst, sha, sha1, mdc2, ripemd160, sha224, sha256, sha384, sha512, md2, md4, md5, dss1 - message digests + + =head1 SYNOPSIS + + B B +-[B<-md5|-md4|-md2|-sha1|-sha|-mdc2|-ripemd160|-dss1>] ++[B<-sha|-sha1|-mdc2|-ripemd160|-sha224|-sha256|-sha384|-sha512|-md2|-md4|-md5|-dss1>] + [B<-c>] + [B<-d>] + [B<-hex>] + [B<-binary>] ++[B<-r>] + [B<-out filename>] + [B<-sign filename>] + [B<-keyform arg>] +@@ -20,17 +21,19 @@ B B + [B<-prverify filename>] + [B<-signature filename>] + [B<-hmac key>] ++[B<-non-fips-allow>] ++[B<-fips-fingerprint>] + [B] + +-[B] +-[B<-c>] +-[B<-d>] +-[B] ++B ++[I] ++[B<...>] + + =head1 DESCRIPTION + + The digest functions output the message digest of a supplied file or files +-in hexadecimal form. They can also be used for digital signing and verification. ++in hexadecimal. The digest functions also generate and verify digital ++signatures using message digests. + + =head1 OPTIONS + +@@ -48,12 +51,17 @@ print out BIO debugging information. + =item B<-hex> + + digest is to be output as a hex dump. This is the default case for a "normal" +-digest as opposed to a digital signature. ++digest as opposed to a digital signature. See NOTES below for digital ++signatures using B<-hex>. + + =item B<-binary> + + output the digest or signature in binary form. + ++=item B<-r> ++ ++output the digest in the "coreutils" format used by programs like B. ++ + =item B<-out filename> + + filename to output to, or standard output by default. +@@ -64,8 +72,8 @@ digitally sign the digest using the private key in + + =item B<-keyform arg> + +-Specifies the key format to sign digest with. Only PEM and ENGINE +-formats are supported by the B command. ++Specifies the key format to sign digest with. The DER, PEM, P12, ++and ENGINE formats are supported. + + =item B<-engine id> + +@@ -117,7 +125,7 @@ Following options are supported by both by B + =over 8 + + =item B +- ++ + Specifies MAC key as alphnumeric string (use if key contain printable + characters only). String length must conform to any restrictions of + the MAC algorithm for example exactly 32 chars for gost-mac. +@@ -138,6 +146,15 @@ Multiple files can be specified separated by a OS- + The separator is B<;> for MS-Windows, B<,> for OpenVMS, and B<:> for + all others. + ++=item B<-non-fips-allow> ++ ++enable use of non-FIPS algorithms such as MD5 even in FIPS mode. ++ ++=item B<-fips-fingerprint> ++ ++compute HMAC using a specific key ++for certain OpenSSL-FIPS operations. ++ + =item B + + file or files to digest. If no files are specified then standard input is +@@ -145,18 +162,41 @@ used. + + =back + ++ ++=head1 EXAMPLES ++ ++To create a hex-encoded message digest of a file: ++ openssl dgst -md5 -hex file.txt ++ ++To sign a file using SHA-256 with binary file output: ++ openssl dgst -sha256 -sign privatekey.pem -out signature.sign file.txt ++ ++To verify a signature: ++ openssl dgst -sha256 -verify publickey.pem \ ++ -signature signature.sign \ ++ file.txt ++ ++ + =head1 NOTES + + The digest of choice for all new applications is SHA1. Other digests are + however still widely used. + +-If you wish to sign or verify data using the DSA algorithm then the dss1 +-digest must be used. ++When signing a file, B will automatically determine the algorithm ++(RSA, ECC, etc) to use for signing based on the private key's ASN.1 info. ++When verifying signatures, it only handles the RSA, DSA, or ECDSA signature ++itself, not the related data to identify the signer and algorithm used in ++formats such as x.509, CMS, and S/MIME. + + A source of random numbers is required for certain signing algorithms, in +-particular DSA. ++particular ECDSA and DSA. + + The signing and verify options should only be used if a single file is + being signed or verified. + ++Hex signatures cannot be verified using B. Instead, use "xxd -r" ++or similar program to transform the hex signature into a binary signature ++prior to verification. ++ ++ + =cut +Index: crypto/openssl/doc/crypto/BIO_s_accept.pod +=================================================================== +--- crypto/openssl/doc/crypto/BIO_s_accept.pod (revision 273303) ++++ crypto/openssl/doc/crypto/BIO_s_accept.pod (working copy) +@@ -59,8 +59,8 @@ the accept socket. See L + BIO_set_accept_port() uses the string B to set the accept + port. The port is represented as a string of the form "host:port", + where "host" is the interface to use and "port" is the port. +-Either or both values can be "*" which is interpreted as meaning +-any interface or port respectively. "port" has the same syntax ++The host can be can be "*" which is interpreted as meaning ++any interface; "port" has the same syntax + as the port specified in BIO_set_conn_port() for connect BIOs, + that is it can be a numerical port string or a string to lookup + using getservbyname() and a string table. +Index: crypto/openssl/doc/crypto/CMS_add1_signer.pod +=================================================================== +--- crypto/openssl/doc/crypto/CMS_add1_signer.pod (revision 0) ++++ crypto/openssl/doc/crypto/CMS_add1_signer.pod (working copy) +@@ -0,0 +1,101 @@ ++=pod ++ ++=head1 NAME ++ ++ CMS_add1_signer, CMS_SignerInfo_sign - add a signer to a CMS_ContentInfo signed data structure. ++ ++=head1 SYNOPSIS ++ ++ #include ++ ++ CMS_SignerInfo *CMS_add1_signer(CMS_ContentInfo *cms, X509 *signcert, EVP_PKEY *pkey, const EVP_MD *md, unsigned int flags); ++ ++ int CMS_SignerInfo_sign(CMS_SignerInfo *si); ++ ++ ++=head1 DESCRIPTION ++ ++CMS_add1_signer() adds a signer with certificate B and private ++key B using message digest B to CMS_ContentInfo SignedData ++structure B. ++ ++The CMS_ContentInfo structure should be obtained from an initial call to ++CMS_sign() with the flag B set or in the case or re-signing a ++valid CMS_ContentInfo SignedData structure. ++ ++If the B parameter is B then the default digest for the public ++key algorithm will be used. ++ ++Unless the B flag is set the returned CMS_ContentInfo ++structure is not complete and must be finalized either by streaming (if ++applicable) or a call to CMS_final(). ++ ++The CMS_SignerInfo_sign() function will explicitly sign a CMS_SignerInfo ++structure, its main use is when B and B flags ++are both set. ++ ++=head1 NOTES ++ ++The main purpose of CMS_add1_signer() is to provide finer control ++over a CMS signed data structure where the simpler CMS_sign() function defaults ++are not appropriate. For example if multiple signers or non default digest ++algorithms are needed. New attributes can also be added using the returned ++CMS_SignerInfo structure and the CMS attribute utility functions or the ++CMS signed receipt request functions. ++ ++Any of the following flags (ored together) can be passed in the B ++parameter. ++ ++If B is set then an attempt is made to copy the content ++digest value from the CMS_ContentInfo structure: to add a signer to an existing ++structure. An error occurs if a matching digest value cannot be found to copy. ++The returned CMS_ContentInfo structure will be valid and finalized when this ++flag is set. ++ ++If B is set in addition to B then the ++CMS_SignerInfo structure will not be finalized so additional attributes ++can be added. In this case an explicit call to CMS_SignerInfo_sign() is ++needed to finalize it. ++ ++If B is set the signer's certificate will not be included in the ++CMS_ContentInfo structure, the signer's certificate must still be supplied in ++the B parameter though. This can reduce the size of the signature if ++the signers certificate can be obtained by other means: for example a ++previously signed message. ++ ++The SignedData structure includes several CMS signedAttributes including the ++signing time, the CMS content type and the supported list of ciphers in an ++SMIMECapabilities attribute. If B is set then no signedAttributes ++will be used. If B is set then just the SMIMECapabilities are ++omitted. ++ ++OpenSSL will by default identify signing certificates using issuer name ++and serial number. If B is set it will use the subject key ++identifier value instead. An error occurs if the signing certificate does not ++have a subject key identifier extension. ++ ++If present the SMIMECapabilities attribute indicates support for the following ++algorithms in preference order: 256 bit AES, Gost R3411-94, Gost 28147-89, 192 ++bit AES, 128 bit AES, triple DES, 128 bit RC2, 64 bit RC2, DES and 40 bit RC2. ++If any of these algorithms is not available then it will not be included: for example the GOST algorithms will not be included if the GOST ENGINE is ++not loaded. ++ ++CMS_add1_signer() returns an internal pointer to the CMS_SignerInfo ++structure just added, this can be used to set additional attributes ++before it is finalized. ++ ++=head1 RETURN VALUES ++ ++CMS_add1_signer() returns an internal pointer to the CMS_SignerInfo ++structure just added or NULL if an error occurs. ++ ++=head1 SEE ALSO ++ ++L, L, ++L, ++ ++=head1 HISTORY ++ ++CMS_add1_signer() was added to OpenSSL 0.9.8 ++ ++=cut +Index: crypto/openssl/doc/crypto/CMS_sign_add1_signer.pod +=================================================================== +--- crypto/openssl/doc/crypto/CMS_sign_add1_signer.pod (revision 273303) ++++ crypto/openssl/doc/crypto/CMS_sign_add1_signer.pod (working copy) +@@ -1,101 +0,0 @@ +-=pod +- +-=head1 NAME +- +- CMS_sign_add1_signer, CMS_SignerInfo_sign - add a signer to a CMS_ContentInfo signed data structure. +- +-=head1 SYNOPSIS +- +- #include +- +- CMS_SignerInfo *CMS_sign_add1_signer(CMS_ContentInfo *cms, X509 *signcert, EVP_PKEY *pkey, const EVP_MD *md, unsigned int flags); +- +- int CMS_SignerInfo_sign(CMS_SignerInfo *si); +- +- +-=head1 DESCRIPTION +- +-CMS_sign_add1_signer() adds a signer with certificate B and private +-key B using message digest B to CMS_ContentInfo SignedData +-structure B. +- +-The CMS_ContentInfo structure should be obtained from an initial call to +-CMS_sign() with the flag B set or in the case or re-signing a +-valid CMS_ContentInfo SignedData structure. +- +-If the B parameter is B then the default digest for the public +-key algorithm will be used. +- +-Unless the B flag is set the returned CMS_ContentInfo +-structure is not complete and must be finalized either by streaming (if +-applicable) or a call to CMS_final(). +- +-The CMS_SignerInfo_sign() function will explicitly sign a CMS_SignerInfo +-structure, its main use is when B and B flags +-are both set. +- +-=head1 NOTES +- +-The main purpose of CMS_sign_add1_signer() is to provide finer control +-over a CMS signed data structure where the simpler CMS_sign() function defaults +-are not appropriate. For example if multiple signers or non default digest +-algorithms are needed. New attributes can also be added using the returned +-CMS_SignerInfo structure and the CMS attribute utility functions or the +-CMS signed receipt request functions. +- +-Any of the following flags (ored together) can be passed in the B +-parameter. +- +-If B is set then an attempt is made to copy the content +-digest value from the CMS_ContentInfo structure: to add a signer to an existing +-structure. An error occurs if a matching digest value cannot be found to copy. +-The returned CMS_ContentInfo structure will be valid and finalized when this +-flag is set. +- +-If B is set in addition to B then the +-CMS_SignerInfo structure will not be finalized so additional attributes +-can be added. In this case an explicit call to CMS_SignerInfo_sign() is +-needed to finalize it. +- +-If B is set the signer's certificate will not be included in the +-CMS_ContentInfo structure, the signer's certificate must still be supplied in +-the B parameter though. This can reduce the size of the signature if +-the signers certificate can be obtained by other means: for example a +-previously signed message. +- +-The SignedData structure includes several CMS signedAttributes including the +-signing time, the CMS content type and the supported list of ciphers in an +-SMIMECapabilities attribute. If B is set then no signedAttributes +-will be used. If B is set then just the SMIMECapabilities are +-omitted. +- +-OpenSSL will by default identify signing certificates using issuer name +-and serial number. If B is set it will use the subject key +-identifier value instead. An error occurs if the signing certificate does not +-have a subject key identifier extension. +- +-If present the SMIMECapabilities attribute indicates support for the following +-algorithms in preference order: 256 bit AES, Gost R3411-94, Gost 28147-89, 192 +-bit AES, 128 bit AES, triple DES, 128 bit RC2, 64 bit RC2, DES and 40 bit RC2. +-If any of these algorithms is not available then it will not be included: for example the GOST algorithms will not be included if the GOST ENGINE is +-not loaded. +- +-CMS_sign_add1_signer() returns an internal pointer to the CMS_SignerInfo +-structure just added, this can be used to set additional attributes +-before it is finalized. +- +-=head1 RETURN VALUES +- +-CMS_sign1_add_signers() returns an internal pointer to the CMS_SignerInfo +-structure just added or NULL if an error occurs. +- +-=head1 SEE ALSO +- +-L, L, +-L, +- +-=head1 HISTORY +- +-CMS_sign_add1_signer() was added to OpenSSL 0.9.8 +- +-=cut +Index: crypto/openssl/doc/crypto/EVP_DigestInit.pod +=================================================================== +--- crypto/openssl/doc/crypto/EVP_DigestInit.pod (revision 273303) ++++ crypto/openssl/doc/crypto/EVP_DigestInit.pod (working copy) +@@ -26,13 +26,13 @@ EVP digest routines + int EVP_MD_CTX_cleanup(EVP_MD_CTX *ctx); + void EVP_MD_CTX_destroy(EVP_MD_CTX *ctx); + +- int EVP_MD_CTX_copy_ex(EVP_MD_CTX *out,const EVP_MD_CTX *in); ++ int EVP_MD_CTX_copy_ex(EVP_MD_CTX *out,const EVP_MD_CTX *in); + + int EVP_DigestInit(EVP_MD_CTX *ctx, const EVP_MD *type); + int EVP_DigestFinal(EVP_MD_CTX *ctx, unsigned char *md, + unsigned int *s); + +- int EVP_MD_CTX_copy(EVP_MD_CTX *out,EVP_MD_CTX *in); ++ int EVP_MD_CTX_copy(EVP_MD_CTX *out,EVP_MD_CTX *in); + + #define EVP_MAX_MD_SIZE 64 /* SHA512 */ + +@@ -136,10 +136,10 @@ reasons. + EVP_md2(), EVP_md5(), EVP_sha(), EVP_sha1(), EVP_sha224(), EVP_sha256(), + EVP_sha384(), EVP_sha512(), EVP_mdc2() and EVP_ripemd160() return B + structures for the MD2, MD5, SHA, SHA1, SHA224, SHA256, SHA384, SHA512, MDC2 +-and RIPEMD160 digest algorithms respectively. ++and RIPEMD160 digest algorithms respectively. + + EVP_dss() and EVP_dss1() return B structures for SHA and SHA1 digest +-algorithms but using DSS (DSA) for the signature algorithm. Note: there is ++algorithms but using DSS (DSA) for the signature algorithm. Note: there is + no need to use these pseudo-digests in OpenSSL 1.0.0 and later, they are + however retained for compatibility. + +@@ -177,21 +177,21 @@ The B interface to message digests should alm + preference to the low level interfaces. This is because the code then becomes + transparent to the digest used and much more flexible. + +-New applications should use the SHA2 digest algorithms such as SHA256. ++New applications should use the SHA2 digest algorithms such as SHA256. + The other digest algorithms are still in common use. + + For most applications the B parameter to EVP_DigestInit_ex() will be + set to NULL to use the default digest implementation. + +-The functions EVP_DigestInit(), EVP_DigestFinal() and EVP_MD_CTX_copy() are ++The functions EVP_DigestInit(), EVP_DigestFinal() and EVP_MD_CTX_copy() are + obsolete but are retained to maintain compatibility with existing code. New +-applications should use EVP_DigestInit_ex(), EVP_DigestFinal_ex() and ++applications should use EVP_DigestInit_ex(), EVP_DigestFinal_ex() and + EVP_MD_CTX_copy_ex() because they can efficiently reuse a digest context + instead of initializing and cleaning it up on each call and allow non default + implementations of digests to be specified. + + In OpenSSL 0.9.7 and later if digest contexts are not cleaned up after use +-memory leaks will occur. ++memory leaks will occur. + + Stack allocation of EVP_MD_CTX structures is common, for example: + +@@ -245,15 +245,19 @@ digest name passed on the command line. + EVP_MD_CTX_destroy(mdctx); + + printf("Digest is: "); +- for(i = 0; i < md_len; i++) printf("%02x", md_value[i]); ++ for(i = 0; i < md_len; i++) ++ printf("%02x", md_value[i]); + printf("\n"); ++ ++ /* Call this once before exit. */ ++ EVP_cleanup(); ++ exit(0); + } + + =head1 SEE ALSO + +-L, L, L, +-L, L, L, +-L, L ++L, ++L + + =head1 HISTORY + +@@ -269,7 +273,7 @@ EVP_dss(), EVP_dss1(), EVP_mdc2() and EVP_ripemd16 + changed to return truely const EVP_MD * in OpenSSL 0.9.7. + + The link between digests and signing algorithms was fixed in OpenSSL 1.0 and +-later, so now EVP_sha1() can be used with RSA and DSA, there is no need to ++later, so now EVP_sha1() can be used with RSA and DSA; there is no need to + use EVP_dss1() any more. + + OpenSSL 1.0 and later does not include the MD2 digest algorithm in the +Index: crypto/openssl/doc/crypto/EVP_DigestVerifyInit.pod +=================================================================== +--- crypto/openssl/doc/crypto/EVP_DigestVerifyInit.pod (revision 273303) ++++ crypto/openssl/doc/crypto/EVP_DigestVerifyInit.pod (working copy) +@@ -38,7 +38,7 @@ or a negative value for failure. In particular a r + the operation is not supported by the public key algorithm. + + Unlike other functions the return value 0 from EVP_DigestVerifyFinal() only +-indicates that the signature did not not verify successfully (that is tbs did ++indicates that the signature did not verify successfully (that is tbs did + not match the original data or the signature was of invalid form) it is not an + indication of a more serious error. + +@@ -59,7 +59,7 @@ For some key types and parameters the random numbe + or the operation will fail. + + The call to EVP_DigestVerifyFinal() internally finalizes a copy of the digest +-context. This means that calls to EVP_VerifyUpdate() and EVP_VerifyFinal() can ++context. This means that EVP_VerifyUpdate() and EVP_VerifyFinal() can + be called later to digest and verify additional data. + + Since only a copy of the digest context is ever finalized the context must +Index: crypto/openssl/doc/crypto/EVP_EncryptInit.pod +=================================================================== +--- crypto/openssl/doc/crypto/EVP_EncryptInit.pod (revision 273303) ++++ crypto/openssl/doc/crypto/EVP_EncryptInit.pod (working copy) +@@ -387,28 +387,8 @@ for certain common S/MIME ciphers (RC2, DES, tripl + + =head1 EXAMPLES + +-Get the number of rounds used in RC5: ++Encrypt a string using IDEA: + +- int nrounds; +- EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_GET_RC5_ROUNDS, 0, &nrounds); +- +-Get the RC2 effective key length: +- +- int key_bits; +- EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_GET_RC2_KEY_BITS, 0, &key_bits); +- +-Set the number of rounds used in RC5: +- +- int nrounds; +- EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_SET_RC5_ROUNDS, nrounds, NULL); +- +-Set the effective key length used in RC2: +- +- int key_bits; +- EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_SET_RC2_KEY_BITS, key_bits, NULL); +- +-Encrypt a string using blowfish: +- + int do_crypt(char *outfile) + { + unsigned char outbuf[1024]; +@@ -421,8 +401,9 @@ for certain common S/MIME ciphers (RC2, DES, tripl + char intext[] = "Some Crypto Text"; + EVP_CIPHER_CTX ctx; + FILE *out; ++ + EVP_CIPHER_CTX_init(&ctx); +- EVP_EncryptInit_ex(&ctx, EVP_bf_cbc(), NULL, key, iv); ++ EVP_EncryptInit_ex(&ctx, EVP_idea_cbc(), NULL, key, iv); + + if(!EVP_EncryptUpdate(&ctx, outbuf, &outlen, intext, strlen(intext))) + { +@@ -451,28 +432,34 @@ for certain common S/MIME ciphers (RC2, DES, tripl + } + + The ciphertext from the above example can be decrypted using the B +-utility with the command line: ++utility with the command line (shown on two lines for clarity): + +- S ++ openssl idea -d or + B if the key is not of the correct type. + +-EVP_PKEY_assign_RSA() EVP_PKEY_assign_DSA(), EVP_PKEY_assign_DH() ++EVP_PKEY_assign_RSA(), EVP_PKEY_assign_DSA(), EVP_PKEY_assign_DH() + and EVP_PKEY_assign_EC_KEY() also set the referenced key to B + however these use the supplied B internally and so B + will be freed when the parent B is freed. +@@ -54,8 +54,8 @@ In accordance with the OpenSSL naming convention t + from or assigned to the B using the B<1> functions must be + freed as well as B. + +-EVP_PKEY_assign_RSA() EVP_PKEY_assign_DSA(), EVP_PKEY_assign_DH() +-EVP_PKEY_assign_EC_KEY() are implemented as macros. ++EVP_PKEY_assign_RSA(), EVP_PKEY_assign_DSA(), EVP_PKEY_assign_DH() ++and EVP_PKEY_assign_EC_KEY() are implemented as macros. + + =head1 RETURN VALUES + +@@ -66,7 +66,7 @@ EVP_PKEY_get1_RSA(), EVP_PKEY_get1_DSA(), EVP_PKEY + EVP_PKEY_get1_EC_KEY() return the referenced key or B if + an error occurred. + +-EVP_PKEY_assign_RSA() EVP_PKEY_assign_DSA(), EVP_PKEY_assign_DH() ++EVP_PKEY_assign_RSA(), EVP_PKEY_assign_DSA(), EVP_PKEY_assign_DH() + and EVP_PKEY_assign_EC_KEY() return 1 for success and 0 for failure. + + =head1 SEE ALSO +Index: crypto/openssl/doc/crypto/EVP_PKEY_sign.pod +=================================================================== +--- crypto/openssl/doc/crypto/EVP_PKEY_sign.pod (revision 273303) ++++ crypto/openssl/doc/crypto/EVP_PKEY_sign.pod (working copy) +@@ -28,9 +28,14 @@ B and the amount of data written to B + + =head1 NOTES + ++EVP_PKEY_sign() does not hash the data to be signed, and therefore is ++normally used to sign digests. For signing arbitrary messages, see the ++L and ++L signing interfaces instead. ++ + After the call to EVP_PKEY_sign_init() algorithm specific control + operations can be performed to set any appropriate parameters for the +-operation. ++operation (see L). + + The function EVP_PKEY_sign() can be called more than once on the same + context if several operations are performed using the same parameters. +@@ -49,13 +54,17 @@ Sign data using RSA with PKCS#1 padding and SHA256 + #include + + EVP_PKEY_CTX *ctx; ++ /* md is a SHA-256 digest in this example. */ + unsigned char *md, *sig; +- size_t mdlen, siglen; ++ size_t mdlen = 32, siglen; + EVP_PKEY *signing_key; +- /* NB: assumes signing_key, md and mdlen are already set up +- * and that signing_key is an RSA private key ++ ++ /* ++ * NB: assumes signing_key and md are set up before the next ++ * step. signing_key must be an RSA private key and md must ++ * point to the SHA-256 digest to be signed. + */ +- ctx = EVP_PKEY_CTX_new(signing_key); ++ ctx = EVP_PKEY_CTX_new(signing_key, NULL /* no engine */); + if (!ctx) + /* Error occurred */ + if (EVP_PKEY_sign_init(ctx) <= 0) +@@ -83,6 +92,7 @@ Sign data using RSA with PKCS#1 padding and SHA256 + =head1 SEE ALSO + + L, ++L, + L, + L, + L, +Index: crypto/openssl/doc/ssl/SSL_CTX_set_tmp_dh_callback.pod +=================================================================== +--- crypto/openssl/doc/ssl/SSL_CTX_set_tmp_dh_callback.pod (revision 273303) ++++ crypto/openssl/doc/ssl/SSL_CTX_set_tmp_dh_callback.pod (working copy) +@@ -48,12 +48,13 @@ even if he gets hold of the normal (certified) key + only used for signing. + + In order to perform a DH key exchange the server must use a DH group +-(DH parameters) and generate a DH key. The server will always generate a new +-DH key during the negotiation, when the DH parameters are supplied via +-callback and/or when the SSL_OP_SINGLE_DH_USE option of +-L is set. It will +-immediately create a DH key, when DH parameters are supplied via +-SSL_CTX_set_tmp_dh() and SSL_OP_SINGLE_DH_USE is not set. In this case, ++(DH parameters) and generate a DH key. ++The server will always generate a new DH key during the negotiation ++if either the DH parameters are supplied via callback or the ++SSL_OP_SINGLE_DH_USE option of SSL_CTX_set_options(3) is set (or both). ++It will immediately create a DH key if DH parameters are supplied via ++SSL_CTX_set_tmp_dh() and SSL_OP_SINGLE_DH_USE is not set. ++In this case, + it may happen that a key is generated on initialization without later + being needed, while on the other hand the computer time during the + negotiation is being saved. +@@ -139,7 +140,7 @@ partly left out.) + dh_tmp = dh_512; + break; + case 1024: +- if (!dh_1024) ++ if (!dh_1024) + dh_1024 = get_dh1024(); + dh_tmp = dh_1024; + break; +Index: crypto/openssl/e_os.h +=================================================================== +--- crypto/openssl/e_os.h (revision 273303) ++++ crypto/openssl/e_os.h (working copy) +@@ -373,8 +373,17 @@ static unsigned int _strlen31(const char *str) + # define check_winnt() (1) + #else + # define check_winnt() (GetVersion() < 0x80000000) +-#endif ++#endif + ++/* ++ * Visual Studio: inline is available in C++ only, however ++ * __inline is available for C, see ++ * http://msdn.microsoft.com/en-us/library/z8y1yy88.aspx ++ */ ++#if defined(_MSC_VER) && !defined(__cplusplus) && !defined(inline) ++# define inline __inline ++#endif ++ + #else /* The non-microsoft world */ + + # ifdef OPENSSL_SYS_VMS +@@ -738,4 +747,3 @@ struct servent *getservbyname(const char *name, co + #endif + + #endif +- +Index: crypto/openssl/ssl/Makefile +=================================================================== +--- crypto/openssl/ssl/Makefile (revision 273303) ++++ crypto/openssl/ssl/Makefile (working copy) +@@ -547,26 +547,27 @@ s3_both.o: ../include/openssl/ssl23.h ../include/o + s3_both.o: ../include/openssl/stack.h ../include/openssl/symhacks.h + s3_both.o: ../include/openssl/tls1.h ../include/openssl/x509.h + s3_both.o: ../include/openssl/x509_vfy.h s3_both.c ssl_locl.h +-s3_cbc.o: ../e_os.h ../include/openssl/asn1.h ../include/openssl/bio.h +-s3_cbc.o: ../include/openssl/buffer.h ../include/openssl/comp.h +-s3_cbc.o: ../include/openssl/crypto.h ../include/openssl/dsa.h +-s3_cbc.o: ../include/openssl/dtls1.h ../include/openssl/e_os2.h +-s3_cbc.o: ../include/openssl/ec.h ../include/openssl/ecdh.h +-s3_cbc.o: ../include/openssl/ecdsa.h ../include/openssl/err.h +-s3_cbc.o: ../include/openssl/evp.h ../include/openssl/hmac.h +-s3_cbc.o: ../include/openssl/kssl.h ../include/openssl/lhash.h +-s3_cbc.o: ../include/openssl/md5.h ../include/openssl/obj_mac.h +-s3_cbc.o: ../include/openssl/objects.h ../include/openssl/opensslconf.h +-s3_cbc.o: ../include/openssl/opensslv.h ../include/openssl/ossl_typ.h +-s3_cbc.o: ../include/openssl/pem.h ../include/openssl/pem2.h +-s3_cbc.o: ../include/openssl/pkcs7.h ../include/openssl/pqueue.h +-s3_cbc.o: ../include/openssl/rsa.h ../include/openssl/safestack.h +-s3_cbc.o: ../include/openssl/sha.h ../include/openssl/srtp.h +-s3_cbc.o: ../include/openssl/ssl.h ../include/openssl/ssl2.h +-s3_cbc.o: ../include/openssl/ssl23.h ../include/openssl/ssl3.h +-s3_cbc.o: ../include/openssl/stack.h ../include/openssl/symhacks.h +-s3_cbc.o: ../include/openssl/tls1.h ../include/openssl/x509.h +-s3_cbc.o: ../include/openssl/x509_vfy.h s3_cbc.c ssl_locl.h ++s3_cbc.o: ../crypto/constant_time_locl.h ../e_os.h ../include/openssl/asn1.h ++s3_cbc.o: ../include/openssl/bio.h ../include/openssl/buffer.h ++s3_cbc.o: ../include/openssl/comp.h ../include/openssl/crypto.h ++s3_cbc.o: ../include/openssl/dsa.h ../include/openssl/dtls1.h ++s3_cbc.o: ../include/openssl/e_os2.h ../include/openssl/ec.h ++s3_cbc.o: ../include/openssl/ecdh.h ../include/openssl/ecdsa.h ++s3_cbc.o: ../include/openssl/err.h ../include/openssl/evp.h ++s3_cbc.o: ../include/openssl/hmac.h ../include/openssl/kssl.h ++s3_cbc.o: ../include/openssl/lhash.h ../include/openssl/md5.h ++s3_cbc.o: ../include/openssl/obj_mac.h ../include/openssl/objects.h ++s3_cbc.o: ../include/openssl/opensslconf.h ../include/openssl/opensslv.h ++s3_cbc.o: ../include/openssl/ossl_typ.h ../include/openssl/pem.h ++s3_cbc.o: ../include/openssl/pem2.h ../include/openssl/pkcs7.h ++s3_cbc.o: ../include/openssl/pqueue.h ../include/openssl/rsa.h ++s3_cbc.o: ../include/openssl/safestack.h ../include/openssl/sha.h ++s3_cbc.o: ../include/openssl/srtp.h ../include/openssl/ssl.h ++s3_cbc.o: ../include/openssl/ssl2.h ../include/openssl/ssl23.h ++s3_cbc.o: ../include/openssl/ssl3.h ../include/openssl/stack.h ++s3_cbc.o: ../include/openssl/symhacks.h ../include/openssl/tls1.h ++s3_cbc.o: ../include/openssl/x509.h ../include/openssl/x509_vfy.h s3_cbc.c ++s3_cbc.o: ssl_locl.h + s3_clnt.o: ../e_os.h ../include/openssl/asn1.h ../include/openssl/bio.h + s3_clnt.o: ../include/openssl/bn.h ../include/openssl/buffer.h + s3_clnt.o: ../include/openssl/comp.h ../include/openssl/crypto.h +@@ -671,28 +672,29 @@ s3_pkt.o: ../include/openssl/ssl23.h ../include/op + s3_pkt.o: ../include/openssl/stack.h ../include/openssl/symhacks.h + s3_pkt.o: ../include/openssl/tls1.h ../include/openssl/x509.h + s3_pkt.o: ../include/openssl/x509_vfy.h s3_pkt.c ssl_locl.h +-s3_srvr.o: ../e_os.h ../include/openssl/asn1.h ../include/openssl/bio.h +-s3_srvr.o: ../include/openssl/bn.h ../include/openssl/buffer.h +-s3_srvr.o: ../include/openssl/comp.h ../include/openssl/crypto.h +-s3_srvr.o: ../include/openssl/dh.h ../include/openssl/dsa.h +-s3_srvr.o: ../include/openssl/dtls1.h ../include/openssl/e_os2.h +-s3_srvr.o: ../include/openssl/ec.h ../include/openssl/ecdh.h +-s3_srvr.o: ../include/openssl/ecdsa.h ../include/openssl/err.h +-s3_srvr.o: ../include/openssl/evp.h ../include/openssl/hmac.h +-s3_srvr.o: ../include/openssl/krb5_asn.h ../include/openssl/kssl.h +-s3_srvr.o: ../include/openssl/lhash.h ../include/openssl/md5.h +-s3_srvr.o: ../include/openssl/obj_mac.h ../include/openssl/objects.h +-s3_srvr.o: ../include/openssl/opensslconf.h ../include/openssl/opensslv.h +-s3_srvr.o: ../include/openssl/ossl_typ.h ../include/openssl/pem.h +-s3_srvr.o: ../include/openssl/pem2.h ../include/openssl/pkcs7.h +-s3_srvr.o: ../include/openssl/pqueue.h ../include/openssl/rand.h +-s3_srvr.o: ../include/openssl/rsa.h ../include/openssl/safestack.h +-s3_srvr.o: ../include/openssl/sha.h ../include/openssl/srtp.h +-s3_srvr.o: ../include/openssl/ssl.h ../include/openssl/ssl2.h +-s3_srvr.o: ../include/openssl/ssl23.h ../include/openssl/ssl3.h +-s3_srvr.o: ../include/openssl/stack.h ../include/openssl/symhacks.h +-s3_srvr.o: ../include/openssl/tls1.h ../include/openssl/x509.h +-s3_srvr.o: ../include/openssl/x509_vfy.h kssl_lcl.h s3_srvr.c ssl_locl.h ++s3_srvr.o: ../crypto/constant_time_locl.h ../e_os.h ../include/openssl/asn1.h ++s3_srvr.o: ../include/openssl/bio.h ../include/openssl/bn.h ++s3_srvr.o: ../include/openssl/buffer.h ../include/openssl/comp.h ++s3_srvr.o: ../include/openssl/crypto.h ../include/openssl/dh.h ++s3_srvr.o: ../include/openssl/dsa.h ../include/openssl/dtls1.h ++s3_srvr.o: ../include/openssl/e_os2.h ../include/openssl/ec.h ++s3_srvr.o: ../include/openssl/ecdh.h ../include/openssl/ecdsa.h ++s3_srvr.o: ../include/openssl/err.h ../include/openssl/evp.h ++s3_srvr.o: ../include/openssl/hmac.h ../include/openssl/krb5_asn.h ++s3_srvr.o: ../include/openssl/kssl.h ../include/openssl/lhash.h ++s3_srvr.o: ../include/openssl/md5.h ../include/openssl/obj_mac.h ++s3_srvr.o: ../include/openssl/objects.h ../include/openssl/opensslconf.h ++s3_srvr.o: ../include/openssl/opensslv.h ../include/openssl/ossl_typ.h ++s3_srvr.o: ../include/openssl/pem.h ../include/openssl/pem2.h ++s3_srvr.o: ../include/openssl/pkcs7.h ../include/openssl/pqueue.h ++s3_srvr.o: ../include/openssl/rand.h ../include/openssl/rsa.h ++s3_srvr.o: ../include/openssl/safestack.h ../include/openssl/sha.h ++s3_srvr.o: ../include/openssl/srtp.h ../include/openssl/ssl.h ++s3_srvr.o: ../include/openssl/ssl2.h ../include/openssl/ssl23.h ++s3_srvr.o: ../include/openssl/ssl3.h ../include/openssl/stack.h ++s3_srvr.o: ../include/openssl/symhacks.h ../include/openssl/tls1.h ++s3_srvr.o: ../include/openssl/x509.h ../include/openssl/x509_vfy.h kssl_lcl.h ++s3_srvr.o: s3_srvr.c ssl_locl.h + ssl_algs.o: ../e_os.h ../include/openssl/asn1.h ../include/openssl/bio.h + ssl_algs.o: ../include/openssl/buffer.h ../include/openssl/comp.h + ssl_algs.o: ../include/openssl/crypto.h ../include/openssl/dsa.h +Index: crypto/openssl/ssl/d1_both.c +=================================================================== +--- crypto/openssl/ssl/d1_both.c (revision 273303) ++++ crypto/openssl/ssl/d1_both.c (working copy) +@@ -1492,6 +1492,9 @@ dtls1_process_heartbeat(SSL *s) + /* Read type and payload length first */ + if (1 + 2 + 16 > s->s3->rrec.length) + return 0; /* silently discard */ ++ if (s->s3->rrec.length > SSL3_RT_MAX_PLAIN_LENGTH) ++ return 0; /* silently discard per RFC 6520 sec. 4 */ ++ + hbtype = *p++; + n2s(p, payload); + if (1 + 2 + payload + 16 > s->s3->rrec.length) +Index: crypto/openssl/ssl/d1_lib.c +=================================================================== +--- crypto/openssl/ssl/d1_lib.c (revision 273303) ++++ crypto/openssl/ssl/d1_lib.c (working copy) +@@ -266,6 +266,16 @@ long dtls1_ctrl(SSL *s, int cmd, long larg, void * + case DTLS_CTRL_LISTEN: + ret = dtls1_listen(s, parg); + break; ++ case SSL_CTRL_CHECK_PROTO_VERSION: ++ /* For library-internal use; checks that the current protocol ++ * is the highest enabled version (according to s->ctx->method, ++ * as version negotiation may have changed s->method). */ ++#if DTLS_MAX_VERSION != DTLS1_VERSION ++# error Code needs update for DTLS_method() support beyond DTLS1_VERSION. ++#endif ++ /* Just one protocol version is supported so far; ++ * fail closed if the version is not as expected. */ ++ return s->version == DTLS_MAX_VERSION; + + default: + ret = ssl3_ctrl(s, cmd, larg, parg); +Index: crypto/openssl/ssl/d1_srtp.c +=================================================================== +--- crypto/openssl/ssl/d1_srtp.c (revision 273303) ++++ crypto/openssl/ssl/d1_srtp.c (working copy) +@@ -168,25 +168,6 @@ static int find_profile_by_name(char *profile_name + return 1; + } + +-static int find_profile_by_num(unsigned profile_num, +- SRTP_PROTECTION_PROFILE **pptr) +- { +- SRTP_PROTECTION_PROFILE *p; +- +- p=srtp_known_profiles; +- while(p->name) +- { +- if(p->id == profile_num) +- { +- *pptr=p; +- return 0; +- } +- p++; +- } +- +- return 1; +- } +- + static int ssl_ctx_make_profiles(const char *profiles_string,STACK_OF(SRTP_PROTECTION_PROFILE) **out) + { + STACK_OF(SRTP_PROTECTION_PROFILE) *profiles; +@@ -209,11 +190,19 @@ static int ssl_ctx_make_profiles(const char *profi + if(!find_profile_by_name(ptr,&p, + col ? col-ptr : (int)strlen(ptr))) + { ++ if (sk_SRTP_PROTECTION_PROFILE_find(profiles,p) >= 0) ++ { ++ SSLerr(SSL_F_SSL_CTX_MAKE_PROFILES,SSL_R_BAD_SRTP_PROTECTION_PROFILE_LIST); ++ sk_SRTP_PROTECTION_PROFILE_free(profiles); ++ return 1; ++ } ++ + sk_SRTP_PROTECTION_PROFILE_push(profiles,p); + } + else + { + SSLerr(SSL_F_SSL_CTX_MAKE_PROFILES,SSL_R_SRTP_UNKNOWN_PROTECTION_PROFILE); ++ sk_SRTP_PROTECTION_PROFILE_free(profiles); + return 1; + } + +@@ -305,13 +294,12 @@ int ssl_add_clienthello_use_srtp_ext(SSL *s, unsig + + int ssl_parse_clienthello_use_srtp_ext(SSL *s, unsigned char *d, int len,int *al) + { +- SRTP_PROTECTION_PROFILE *cprof,*sprof; +- STACK_OF(SRTP_PROTECTION_PROFILE) *clnt=0,*srvr; ++ SRTP_PROTECTION_PROFILE *sprof; ++ STACK_OF(SRTP_PROTECTION_PROFILE) *srvr; + int ct; + int mki_len; +- int i,j; +- int id; +- int ret; ++ int i, srtp_pref; ++ unsigned int id; + + /* Length value + the MKI length */ + if(len < 3) +@@ -341,9 +329,11 @@ int ssl_parse_clienthello_use_srtp_ext(SSL *s, uns + return 1; + } + ++ srvr=SSL_get_srtp_profiles(s); ++ s->srtp_profile = NULL; ++ /* Search all profiles for a match initially */ ++ srtp_pref = sk_SRTP_PROTECTION_PROFILE_num(srvr); + +- clnt=sk_SRTP_PROTECTION_PROFILE_new_null(); +- + while(ct) + { + n2s(d,id); +@@ -350,14 +340,22 @@ int ssl_parse_clienthello_use_srtp_ext(SSL *s, uns + ct-=2; + len-=2; + +- if(!find_profile_by_num(id,&cprof)) ++ /* ++ * Only look for match in profiles of higher preference than ++ * current match. ++ * If no profiles have been have been configured then this ++ * does nothing. ++ */ ++ for (i = 0; i < srtp_pref; i++) + { +- sk_SRTP_PROTECTION_PROFILE_push(clnt,cprof); ++ sprof = sk_SRTP_PROTECTION_PROFILE_value(srvr, i); ++ if (sprof->id == id) ++ { ++ s->srtp_profile = sprof; ++ srtp_pref = i; ++ break; ++ } + } +- else +- { +- ; /* Ignore */ +- } + } + + /* Now extract the MKI value as a sanity check, but discard it for now */ +@@ -371,36 +369,7 @@ int ssl_parse_clienthello_use_srtp_ext(SSL *s, uns + return 1; + } + +- srvr=SSL_get_srtp_profiles(s); +- +- /* Pick our most preferred profile. If no profiles have been +- configured then the outer loop doesn't run +- (sk_SRTP_PROTECTION_PROFILE_num() = -1) +- and so we just return without doing anything */ +- for(i=0;iid==sprof->id) +- { +- s->srtp_profile=sprof; +- *al=0; +- ret=0; +- goto done; +- } +- } +- } +- +- ret=0; +- +-done: +- if(clnt) sk_SRTP_PROTECTION_PROFILE_free(clnt); +- +- return ret; ++ return 0; + } + + int ssl_add_serverhello_use_srtp_ext(SSL *s, unsigned char *p, int *len, int maxlen) +Index: crypto/openssl/ssl/dtls1.h +=================================================================== +--- crypto/openssl/ssl/dtls1.h (revision 273303) ++++ crypto/openssl/ssl/dtls1.h (working copy) +@@ -84,6 +84,8 @@ extern "C" { + #endif + + #define DTLS1_VERSION 0xFEFF ++#define DTLS_MAX_VERSION DTLS1_VERSION ++ + #define DTLS1_BAD_VER 0x0100 + + #if 0 +@@ -284,4 +286,3 @@ typedef struct dtls1_record_data_st + } + #endif + #endif +- +Index: crypto/openssl/ssl/s23_clnt.c +=================================================================== +--- crypto/openssl/ssl/s23_clnt.c (revision 273303) ++++ crypto/openssl/ssl/s23_clnt.c (working copy) +@@ -125,9 +125,11 @@ static const SSL_METHOD *ssl23_get_client_method(i + if (ver == SSL2_VERSION) + return(SSLv2_client_method()); + #endif ++#ifndef OPENSSL_NO_SSL3 + if (ver == SSL3_VERSION) + return(SSLv3_client_method()); +- else if (ver == TLS1_VERSION) ++#endif ++ if (ver == TLS1_VERSION) + return(TLSv1_client_method()); + else if (ver == TLS1_1_VERSION) + return(TLSv1_1_client_method()); +@@ -698,6 +700,7 @@ static int ssl23_get_server_hello(SSL *s) + { + /* we have sslv3 or tls1 (server hello or alert) */ + ++#ifndef OPENSSL_NO_SSL3 + if ((p[2] == SSL3_VERSION_MINOR) && + !(s->options & SSL_OP_NO_SSLv3)) + { +@@ -712,7 +715,9 @@ static int ssl23_get_server_hello(SSL *s) + s->version=SSL3_VERSION; + s->method=SSLv3_client_method(); + } +- else if ((p[2] == TLS1_VERSION_MINOR) && ++ else ++#endif ++ if ((p[2] == TLS1_VERSION_MINOR) && + !(s->options & SSL_OP_NO_TLSv1)) + { + s->version=TLS1_VERSION; +@@ -736,6 +741,9 @@ static int ssl23_get_server_hello(SSL *s) + goto err; + } + ++ /* ensure that TLS_MAX_VERSION is up-to-date */ ++ OPENSSL_assert(s->version <= TLS_MAX_VERSION); ++ + if (p[0] == SSL3_RT_ALERT && p[5] != SSL3_AL_WARNING) + { + /* fatal alert */ +Index: crypto/openssl/ssl/s23_srvr.c +=================================================================== +--- crypto/openssl/ssl/s23_srvr.c (revision 273303) ++++ crypto/openssl/ssl/s23_srvr.c (working copy) +@@ -127,9 +127,11 @@ static const SSL_METHOD *ssl23_get_server_method(i + if (ver == SSL2_VERSION) + return(SSLv2_server_method()); + #endif ++#ifndef OPENSSL_NO_SSL3 + if (ver == SSL3_VERSION) + return(SSLv3_server_method()); +- else if (ver == TLS1_VERSION) ++#endif ++ if (ver == TLS1_VERSION) + return(TLSv1_server_method()); + else if (ver == TLS1_1_VERSION) + return(TLSv1_1_server_method()); +@@ -421,6 +423,9 @@ int ssl23_get_client_hello(SSL *s) + } + } + ++ /* ensure that TLS_MAX_VERSION is up-to-date */ ++ OPENSSL_assert(s->version <= TLS_MAX_VERSION); ++ + #ifdef OPENSSL_FIPS + if (FIPS_mode() && (s->version < TLS1_VERSION)) + { +@@ -597,6 +602,12 @@ int ssl23_get_client_hello(SSL *s) + if ((type == 2) || (type == 3)) + { + /* we have SSLv3/TLSv1 (type 2: SSL2 style, type 3: SSL3/TLS style) */ ++ s->method = ssl23_get_server_method(s->version); ++ if (s->method == NULL) ++ { ++ SSLerr(SSL_F_SSL23_GET_CLIENT_HELLO,SSL_R_UNSUPPORTED_PROTOCOL); ++ goto err; ++ } + + if (!ssl_init_wbio_buffer(s,1)) goto err; + +@@ -624,14 +635,6 @@ int ssl23_get_client_hello(SSL *s) + s->s3->rbuf.left=0; + s->s3->rbuf.offset=0; + } +- if (s->version == TLS1_2_VERSION) +- s->method = TLSv1_2_server_method(); +- else if (s->version == TLS1_1_VERSION) +- s->method = TLSv1_1_server_method(); +- else if (s->version == TLS1_VERSION) +- s->method = TLSv1_server_method(); +- else +- s->method = SSLv3_server_method(); + #if 0 /* ssl3_get_client_hello does this */ + s->client_version=(v[0]<<8)|v[1]; + #endif +Index: crypto/openssl/ssl/s2_lib.c +=================================================================== +--- crypto/openssl/ssl/s2_lib.c (revision 273303) ++++ crypto/openssl/ssl/s2_lib.c (working copy) +@@ -391,6 +391,8 @@ long ssl2_ctrl(SSL *s, int cmd, long larg, void *p + case SSL_CTRL_GET_SESSION_REUSED: + ret=s->hit; + break; ++ case SSL_CTRL_CHECK_PROTO_VERSION: ++ return ssl3_ctrl(s, SSL_CTRL_CHECK_PROTO_VERSION, larg, parg); + default: + break; + } +@@ -437,7 +439,7 @@ int ssl2_put_cipher_by_char(const SSL_CIPHER *c, u + if (p != NULL) + { + l=c->id; +- if ((l & 0xff000000) != 0x02000000) return(0); ++ if ((l & 0xff000000) != 0x02000000 && l != SSL3_CK_FALLBACK_SCSV) return(0); + p[0]=((unsigned char)(l>>16L))&0xFF; + p[1]=((unsigned char)(l>> 8L))&0xFF; + p[2]=((unsigned char)(l ))&0xFF; +Index: crypto/openssl/ssl/s3_cbc.c +=================================================================== +--- crypto/openssl/ssl/s3_cbc.c (revision 273303) ++++ crypto/openssl/ssl/s3_cbc.c (working copy) +@@ -53,6 +53,7 @@ + * + */ + ++#include "../crypto/constant_time_locl.h" + #include "ssl_locl.h" + + #include +@@ -67,37 +68,6 @@ + * supported by TLS.) */ + #define MAX_HASH_BLOCK_SIZE 128 + +-/* Some utility functions are needed: +- * +- * These macros return the given value with the MSB copied to all the other +- * bits. They use the fact that arithmetic shift shifts-in the sign bit. +- * However, this is not ensured by the C standard so you may need to replace +- * them with something else on odd CPUs. */ +-#define DUPLICATE_MSB_TO_ALL(x) ( (unsigned)( (int)(x) >> (sizeof(int)*8-1) ) ) +-#define DUPLICATE_MSB_TO_ALL_8(x) ((unsigned char)(DUPLICATE_MSB_TO_ALL(x))) +- +-/* constant_time_lt returns 0xff if a=b and 0x00 otherwise. */ +-static unsigned constant_time_ge(unsigned a, unsigned b) +- { +- a -= b; +- return DUPLICATE_MSB_TO_ALL(~a); +- } +- +-/* constant_time_eq_8 returns 0xff if a==b and 0x00 otherwise. */ +-static unsigned char constant_time_eq_8(unsigned a, unsigned b) +- { +- unsigned c = a ^ b; +- c--; +- return DUPLICATE_MSB_TO_ALL_8(c); +- } +- + /* ssl3_cbc_remove_padding removes padding from the decrypted, SSLv3, CBC + * record in |rec| by updating |rec->length| in constant time. + * +@@ -126,8 +96,8 @@ int ssl3_cbc_remove_padding(const SSL* s, + padding_length = good & (padding_length+1); + rec->length -= padding_length; + rec->type |= padding_length<<8; /* kludge: pass padding length */ +- return (int)((good & 1) | (~good & -1)); +-} ++ return constant_time_select_int(good, 1, -1); ++ } + + /* tls1_cbc_remove_padding removes the CBC padding from the decrypted, TLS, CBC + * record in |rec| in constant time and returns 1 if the padding is valid and +@@ -208,7 +178,7 @@ int tls1_cbc_remove_padding(const SSL* s, + + for (i = 0; i < to_check; i++) + { +- unsigned char mask = constant_time_ge(padding_length, i); ++ unsigned char mask = constant_time_ge_8(padding_length, i); + unsigned char b = rec->data[rec->length-1-i]; + /* The final |padding_length+1| bytes should all have the value + * |padding_length|. Therefore the XOR should be zero. */ +@@ -216,20 +186,14 @@ int tls1_cbc_remove_padding(const SSL* s, + } + + /* If any of the final |padding_length+1| bytes had the wrong value, +- * one or more of the lower eight bits of |good| will be cleared. We +- * AND the bottom 8 bits together and duplicate the result to all the +- * bits. */ +- good &= good >> 4; +- good &= good >> 2; +- good &= good >> 1; +- good <<= sizeof(good)*8-1; +- good = DUPLICATE_MSB_TO_ALL(good); +- ++ * one or more of the lower eight bits of |good| will be cleared. ++ */ ++ good = constant_time_eq(0xff, good & 0xff); + padding_length = good & (padding_length+1); + rec->length -= padding_length; + rec->type |= padding_length<<8; /* kludge: pass padding length */ + +- return (int)((good & 1) | (~good & -1)); ++ return constant_time_select_int(good, 1, -1); + } + + /* ssl3_cbc_copy_mac copies |md_size| bytes from the end of |rec| to |out| in +@@ -296,8 +260,8 @@ void ssl3_cbc_copy_mac(unsigned char* out, + memset(rotated_mac, 0, md_size); + for (i = scan_start, j = 0; i < orig_len; i++) + { +- unsigned char mac_started = constant_time_ge(i, mac_start); +- unsigned char mac_ended = constant_time_ge(i, mac_end); ++ unsigned char mac_started = constant_time_ge_8(i, mac_start); ++ unsigned char mac_ended = constant_time_ge_8(i, mac_end); + unsigned char b = rec->data[i]; + rotated_mac[j++] |= b & mac_started & ~mac_ended; + j &= constant_time_lt(j,md_size); +@@ -683,12 +647,12 @@ void ssl3_cbc_digest_record( + b = data[k-header_length]; + k++; + +- is_past_c = is_block_a & constant_time_ge(j, c); +- is_past_cp1 = is_block_a & constant_time_ge(j, c+1); ++ is_past_c = is_block_a & constant_time_ge_8(j, c); ++ is_past_cp1 = is_block_a & constant_time_ge_8(j, c+1); + /* If this is the block containing the end of the + * application data, and we are at the offset for the + * 0x80 value, then overwrite b with 0x80. */ +- b = (b&~is_past_c) | (0x80&is_past_c); ++ b = constant_time_select_8(is_past_c, 0x80, b); + /* If this the the block containing the end of the + * application data and we're past the 0x80 value then + * just write zero. */ +@@ -704,7 +668,8 @@ void ssl3_cbc_digest_record( + if (j >= md_block_size - md_length_size) + { + /* If this is index_b, write a length byte. */ +- b = (b&~is_block_b) | (is_block_b&length_bytes[j-(md_block_size-md_length_size)]); ++ b = constant_time_select_8( ++ is_block_b, length_bytes[j-(md_block_size-md_length_size)], b); + } + block[j] = b; + } +Index: crypto/openssl/ssl/s3_clnt.c +=================================================================== +--- crypto/openssl/ssl/s3_clnt.c (revision 273303) ++++ crypto/openssl/ssl/s3_clnt.c (working copy) +@@ -326,9 +326,9 @@ int ssl3_connect(SSL *s) + break; + } + #endif +- /* Check if it is anon DH/ECDH */ ++ /* Check if it is anon DH/ECDH, SRP auth */ + /* or PSK */ +- if (!(s->s3->tmp.new_cipher->algorithm_auth & SSL_aNULL) && ++ if (!(s->s3->tmp.new_cipher->algorithm_auth & (SSL_aNULL|SSL_aSRP)) && + !(s->s3->tmp.new_cipher->algorithm_mkey & SSL_kPSK)) + { + ret=ssl3_get_server_certificate(s); +@@ -1277,8 +1277,8 @@ int ssl3_get_key_exchange(SSL *s) + #endif + EVP_MD_CTX md_ctx; + unsigned char *param,*p; +- int al,i,j,param_len,ok; +- long n,alg_k,alg_a; ++ int al,j,ok; ++ long i,param_len,n,alg_k,alg_a; + EVP_PKEY *pkey=NULL; + const EVP_MD *md = NULL; + #ifndef OPENSSL_NO_RSA +@@ -1354,19 +1354,29 @@ int ssl3_get_key_exchange(SSL *s) + s->session->sess_cert=ssl_sess_cert_new(); + } + ++ /* Total length of the parameters including the length prefix */ + param_len=0; ++ + alg_k=s->s3->tmp.new_cipher->algorithm_mkey; + alg_a=s->s3->tmp.new_cipher->algorithm_auth; + EVP_MD_CTX_init(&md_ctx); + ++ al=SSL_AD_DECODE_ERROR; ++ + #ifndef OPENSSL_NO_PSK + if (alg_k & SSL_kPSK) + { + char tmp_id_hint[PSK_MAX_IDENTITY_LEN+1]; + +- al=SSL_AD_HANDSHAKE_FAILURE; ++ param_len = 2; ++ if (param_len > n) ++ { ++ SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE, ++ SSL_R_LENGTH_TOO_SHORT); ++ goto f_err; ++ } + n2s(p,i); +- param_len=i+2; ++ + /* Store PSK identity hint for later use, hint is used + * in ssl3_send_client_key_exchange. Assume that the + * maximum length of a PSK identity hint can be as +@@ -1373,17 +1383,19 @@ int ssl3_get_key_exchange(SSL *s) + * long as the maximum length of a PSK identity. */ + if (i > PSK_MAX_IDENTITY_LEN) + { ++ al=SSL_AD_HANDSHAKE_FAILURE; + SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE, + SSL_R_DATA_LENGTH_TOO_LONG); + goto f_err; + } +- if (param_len > n) ++ if (i > n - param_len) + { +- al=SSL_AD_DECODE_ERROR; + SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE, + SSL_R_BAD_PSK_IDENTITY_HINT_LENGTH); + goto f_err; + } ++ param_len += i; ++ + /* If received PSK identity hint contains NULL + * characters, the hint is truncated from the first + * NULL. p may not be ending with NULL, so create a +@@ -1395,6 +1407,7 @@ int ssl3_get_key_exchange(SSL *s) + s->ctx->psk_identity_hint = BUF_strdup(tmp_id_hint); + if (s->ctx->psk_identity_hint == NULL) + { ++ al=SSL_AD_HANDSHAKE_FAILURE; + SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE, ERR_R_MALLOC_FAILURE); + goto f_err; + } +@@ -1407,14 +1420,22 @@ int ssl3_get_key_exchange(SSL *s) + #ifndef OPENSSL_NO_SRP + if (alg_k & SSL_kSRP) + { +- n2s(p,i); +- param_len=i+2; ++ param_len = 2; + if (param_len > n) + { +- al=SSL_AD_DECODE_ERROR; ++ SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE, ++ SSL_R_LENGTH_TOO_SHORT); ++ goto f_err; ++ } ++ n2s(p,i); ++ ++ if (i > n - param_len) ++ { + SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,SSL_R_BAD_SRP_N_LENGTH); + goto f_err; + } ++ param_len += i; ++ + if (!(s->srp_ctx.N=BN_bin2bn(p,i,NULL))) + { + SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,ERR_R_BN_LIB); +@@ -1422,14 +1443,24 @@ int ssl3_get_key_exchange(SSL *s) + } + p+=i; + ++ ++ if (2 > n - param_len) ++ { ++ SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE, ++ SSL_R_LENGTH_TOO_SHORT); ++ goto f_err; ++ } ++ param_len += 2; ++ + n2s(p,i); +- param_len+=i+2; +- if (param_len > n) ++ ++ if (i > n - param_len) + { +- al=SSL_AD_DECODE_ERROR; + SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,SSL_R_BAD_SRP_G_LENGTH); + goto f_err; + } ++ param_len += i; ++ + if (!(s->srp_ctx.g=BN_bin2bn(p,i,NULL))) + { + SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,ERR_R_BN_LIB); +@@ -1437,15 +1468,25 @@ int ssl3_get_key_exchange(SSL *s) + } + p+=i; + ++ ++ if (1 > n - param_len) ++ { ++ SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE, ++ SSL_R_LENGTH_TOO_SHORT); ++ goto f_err; ++ } ++ param_len += 1; ++ + i = (unsigned int)(p[0]); + p++; +- param_len+=i+1; +- if (param_len > n) ++ ++ if (i > n - param_len) + { +- al=SSL_AD_DECODE_ERROR; + SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,SSL_R_BAD_SRP_S_LENGTH); + goto f_err; + } ++ param_len += i; ++ + if (!(s->srp_ctx.s=BN_bin2bn(p,i,NULL))) + { + SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,ERR_R_BN_LIB); +@@ -1453,14 +1494,23 @@ int ssl3_get_key_exchange(SSL *s) + } + p+=i; + ++ if (2 > n - param_len) ++ { ++ SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE, ++ SSL_R_LENGTH_TOO_SHORT); ++ goto f_err; ++ } ++ param_len += 2; ++ + n2s(p,i); +- param_len+=i+2; +- if (param_len > n) ++ ++ if (i > n - param_len) + { +- al=SSL_AD_DECODE_ERROR; + SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,SSL_R_BAD_SRP_B_LENGTH); + goto f_err; + } ++ param_len += i; ++ + if (!(s->srp_ctx.B=BN_bin2bn(p,i,NULL))) + { + SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,ERR_R_BN_LIB); +@@ -1498,14 +1548,23 @@ int ssl3_get_key_exchange(SSL *s) + SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,ERR_R_MALLOC_FAILURE); + goto err; + } +- n2s(p,i); +- param_len=i+2; ++ ++ param_len = 2; + if (param_len > n) + { +- al=SSL_AD_DECODE_ERROR; ++ SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE, ++ SSL_R_LENGTH_TOO_SHORT); ++ goto f_err; ++ } ++ n2s(p,i); ++ ++ if (i > n - param_len) ++ { + SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,SSL_R_BAD_RSA_MODULUS_LENGTH); + goto f_err; + } ++ param_len += i; ++ + if (!(rsa->n=BN_bin2bn(p,i,rsa->n))) + { + SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,ERR_R_BN_LIB); +@@ -1513,14 +1572,23 @@ int ssl3_get_key_exchange(SSL *s) + } + p+=i; + ++ if (2 > n - param_len) ++ { ++ SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE, ++ SSL_R_LENGTH_TOO_SHORT); ++ goto f_err; ++ } ++ param_len += 2; ++ + n2s(p,i); +- param_len+=i+2; +- if (param_len > n) ++ ++ if (i > n - param_len) + { +- al=SSL_AD_DECODE_ERROR; + SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,SSL_R_BAD_RSA_E_LENGTH); + goto f_err; + } ++ param_len += i; ++ + if (!(rsa->e=BN_bin2bn(p,i,rsa->e))) + { + SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,ERR_R_BN_LIB); +@@ -1552,14 +1620,23 @@ int ssl3_get_key_exchange(SSL *s) + SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,ERR_R_DH_LIB); + goto err; + } +- n2s(p,i); +- param_len=i+2; ++ ++ param_len = 2; + if (param_len > n) + { +- al=SSL_AD_DECODE_ERROR; ++ SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE, ++ SSL_R_LENGTH_TOO_SHORT); ++ goto f_err; ++ } ++ n2s(p,i); ++ ++ if (i > n - param_len) ++ { + SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,SSL_R_BAD_DH_P_LENGTH); + goto f_err; + } ++ param_len += i; ++ + if (!(dh->p=BN_bin2bn(p,i,NULL))) + { + SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,ERR_R_BN_LIB); +@@ -1567,14 +1644,23 @@ int ssl3_get_key_exchange(SSL *s) + } + p+=i; + ++ if (2 > n - param_len) ++ { ++ SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE, ++ SSL_R_LENGTH_TOO_SHORT); ++ goto f_err; ++ } ++ param_len += 2; ++ + n2s(p,i); +- param_len+=i+2; +- if (param_len > n) ++ ++ if (i > n - param_len) + { +- al=SSL_AD_DECODE_ERROR; + SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,SSL_R_BAD_DH_G_LENGTH); + goto f_err; + } ++ param_len += i; ++ + if (!(dh->g=BN_bin2bn(p,i,NULL))) + { + SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,ERR_R_BN_LIB); +@@ -1582,14 +1668,23 @@ int ssl3_get_key_exchange(SSL *s) + } + p+=i; + ++ if (2 > n - param_len) ++ { ++ SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE, ++ SSL_R_LENGTH_TOO_SHORT); ++ goto f_err; ++ } ++ param_len += 2; ++ + n2s(p,i); +- param_len+=i+2; +- if (param_len > n) ++ ++ if (i > n - param_len) + { +- al=SSL_AD_DECODE_ERROR; + SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,SSL_R_BAD_DH_PUB_KEY_LENGTH); + goto f_err; + } ++ param_len += i; ++ + if (!(dh->pub_key=BN_bin2bn(p,i,NULL))) + { + SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,ERR_R_BN_LIB); +@@ -1641,13 +1736,20 @@ int ssl3_get_key_exchange(SSL *s) + */ + + /* XXX: For now we only support named (not generic) curves +- * and the ECParameters in this case is just three bytes. ++ * and the ECParameters in this case is just three bytes. We ++ * also need one byte for the length of the encoded point + */ +- param_len=3; +- if ((param_len > n) || +- (*p != NAMED_CURVE_TYPE) || +- ((curve_nid = tls1_ec_curve_id2nid(*(p + 2))) == 0)) ++ param_len=4; ++ if (param_len > n) + { ++ SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE, ++ SSL_R_LENGTH_TOO_SHORT); ++ goto f_err; ++ } ++ ++ if ((*p != NAMED_CURVE_TYPE) || ++ ((curve_nid = tls1_ec_curve_id2nid(*(p + 2))) == 0)) ++ { + al=SSL_AD_INTERNAL_ERROR; + SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,SSL_R_UNABLE_TO_FIND_ECDH_PARAMETERS); + goto f_err; +@@ -1688,15 +1790,15 @@ int ssl3_get_key_exchange(SSL *s) + + encoded_pt_len = *p; /* length of encoded point */ + p+=1; +- param_len += (1 + encoded_pt_len); +- if ((param_len > n) || ++ ++ if ((encoded_pt_len > n - param_len) || + (EC_POINT_oct2point(group, srvr_ecpoint, + p, encoded_pt_len, bn_ctx) == 0)) + { +- al=SSL_AD_DECODE_ERROR; + SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,SSL_R_BAD_ECPOINT); + goto f_err; + } ++ param_len += encoded_pt_len; + + n-=param_len; + p+=encoded_pt_len; +@@ -1739,7 +1841,15 @@ int ssl3_get_key_exchange(SSL *s) + { + if (TLS1_get_version(s) >= TLS1_2_VERSION) + { +- int sigalg = tls12_get_sigid(pkey); ++ int sigalg; ++ if (2 > n) ++ { ++ SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE, ++ SSL_R_LENGTH_TOO_SHORT); ++ goto f_err; ++ } ++ ++ sigalg = tls12_get_sigid(pkey); + /* Should never happen */ + if (sigalg == -1) + { +@@ -1757,7 +1867,6 @@ int ssl3_get_key_exchange(SSL *s) + if (md == NULL) + { + SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,SSL_R_UNKNOWN_DIGEST); +- al=SSL_AD_DECODE_ERROR; + goto f_err; + } + #ifdef SSL_DEBUG +@@ -1768,15 +1877,21 @@ fprintf(stderr, "USING TLSv1.2 HASH %s\n", EVP_MD_ + } + else + md = EVP_sha1(); +- ++ ++ if (2 > n) ++ { ++ SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE, ++ SSL_R_LENGTH_TOO_SHORT); ++ goto f_err; ++ } + n2s(p,i); + n-=2; + j=EVP_PKEY_size(pkey); + ++ /* Check signature length. If n is 0 then signature is empty */ + if ((i != n) || (n > j) || (n <= 0)) + { + /* wrong packet length */ +- al=SSL_AD_DECODE_ERROR; + SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,SSL_R_WRONG_SIGNATURE_LENGTH); + goto f_err; + } +@@ -1785,6 +1900,7 @@ fprintf(stderr, "USING TLSv1.2 HASH %s\n", EVP_MD_ + if (pkey->type == EVP_PKEY_RSA && TLS1_get_version(s) < TLS1_2_VERSION) + { + int num; ++ unsigned int size; + + j=0; + q=md_buf; +@@ -1797,9 +1913,9 @@ fprintf(stderr, "USING TLSv1.2 HASH %s\n", EVP_MD_ + EVP_DigestUpdate(&md_ctx,&(s->s3->client_random[0]),SSL3_RANDOM_SIZE); + EVP_DigestUpdate(&md_ctx,&(s->s3->server_random[0]),SSL3_RANDOM_SIZE); + EVP_DigestUpdate(&md_ctx,param,param_len); +- EVP_DigestFinal_ex(&md_ctx,q,(unsigned int *)&i); +- q+=i; +- j+=i; ++ EVP_DigestFinal_ex(&md_ctx,q,&size); ++ q+=size; ++ j+=size; + } + i=RSA_verify(NID_md5_sha1, md_buf, j, p, n, + pkey->pkey.rsa); +@@ -1835,8 +1951,8 @@ fprintf(stderr, "USING TLSv1.2 HASH %s\n", EVP_MD_ + } + else + { +- if (!(alg_a & SSL_aNULL) && !(alg_k & SSL_kPSK)) +- /* aNULL or kPSK do not need public keys */ ++ /* aNULL, aSRP or kPSK do not need public keys */ ++ if (!(alg_a & (SSL_aNULL|SSL_aSRP)) && !(alg_k & SSL_kPSK)) + { + SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,ERR_R_INTERNAL_ERROR); + goto err; +@@ -1844,7 +1960,6 @@ fprintf(stderr, "USING TLSv1.2 HASH %s\n", EVP_MD_ + /* still data left over */ + if (n != 0) + { +- al=SSL_AD_DECODE_ERROR; + SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,SSL_R_EXTRA_DATA_IN_MESSAGE); + goto f_err; + } +@@ -2846,7 +2961,11 @@ int ssl3_send_client_key_exchange(SSL *s) + #ifndef OPENSSL_NO_PSK + else if (alg_k & SSL_kPSK) + { +- char identity[PSK_MAX_IDENTITY_LEN]; ++ /* The callback needs PSK_MAX_IDENTITY_LEN + 1 bytes ++ * to return a \0-terminated identity. The last byte ++ * is for us for simulating strnlen. */ ++ char identity[PSK_MAX_IDENTITY_LEN + 2]; ++ size_t identity_len; + unsigned char *t = NULL; + unsigned char psk_or_pre_ms[PSK_MAX_PSK_LEN*2+4]; + unsigned int pre_ms_len = 0, psk_len = 0; +@@ -2860,8 +2979,9 @@ int ssl3_send_client_key_exchange(SSL *s) + goto err; + } + ++ memset(identity, 0, sizeof(identity)); + psk_len = s->psk_client_callback(s, s->ctx->psk_identity_hint, +- identity, PSK_MAX_IDENTITY_LEN, ++ identity, sizeof(identity) - 1, + psk_or_pre_ms, sizeof(psk_or_pre_ms)); + if (psk_len > PSK_MAX_PSK_LEN) + { +@@ -2875,7 +2995,14 @@ int ssl3_send_client_key_exchange(SSL *s) + SSL_R_PSK_IDENTITY_NOT_FOUND); + goto psk_err; + } +- ++ identity[PSK_MAX_IDENTITY_LEN + 1] = '\0'; ++ identity_len = strlen(identity); ++ if (identity_len > PSK_MAX_IDENTITY_LEN) ++ { ++ SSLerr(SSL_F_SSL3_SEND_CLIENT_KEY_EXCHANGE, ++ ERR_R_INTERNAL_ERROR); ++ goto psk_err; ++ } + /* create PSK pre_master_secret */ + pre_ms_len = 2+psk_len+2+psk_len; + t = psk_or_pre_ms; +@@ -2909,14 +3036,13 @@ int ssl3_send_client_key_exchange(SSL *s) + s->session->master_key_length = + s->method->ssl3_enc->generate_master_secret(s, + s->session->master_key, +- psk_or_pre_ms, pre_ms_len); +- n = strlen(identity); +- s2n(n, p); +- memcpy(p, identity, n); +- n+=2; ++ psk_or_pre_ms, pre_ms_len); ++ s2n(identity_len, p); ++ memcpy(p, identity, identity_len); ++ n = 2 + identity_len; + psk_err = 0; + psk_err: +- OPENSSL_cleanse(identity, PSK_MAX_IDENTITY_LEN); ++ OPENSSL_cleanse(identity, sizeof(identity)); + OPENSSL_cleanse(psk_or_pre_ms, sizeof(psk_or_pre_ms)); + if (psk_err != 0) + { +Index: crypto/openssl/ssl/s3_enc.c +=================================================================== +--- crypto/openssl/ssl/s3_enc.c (revision 273303) ++++ crypto/openssl/ssl/s3_enc.c (working copy) +@@ -900,7 +900,7 @@ int ssl3_alert_code(int code) + case SSL_AD_BAD_CERTIFICATE_STATUS_RESPONSE: return(SSL3_AD_HANDSHAKE_FAILURE); + case SSL_AD_BAD_CERTIFICATE_HASH_VALUE: return(SSL3_AD_HANDSHAKE_FAILURE); + case SSL_AD_UNKNOWN_PSK_IDENTITY:return(TLS1_AD_UNKNOWN_PSK_IDENTITY); ++ case SSL_AD_INAPPROPRIATE_FALLBACK:return(TLS1_AD_INAPPROPRIATE_FALLBACK); + default: return(-1); + } + } +- +Index: crypto/openssl/ssl/s3_lib.c +=================================================================== +--- crypto/openssl/ssl/s3_lib.c (revision 273303) ++++ crypto/openssl/ssl/s3_lib.c (working copy) +@@ -3355,6 +3355,33 @@ long ssl3_ctrl(SSL *s, int cmd, long larg, void *p + #endif + + #endif /* !OPENSSL_NO_TLSEXT */ ++ ++ case SSL_CTRL_CHECK_PROTO_VERSION: ++ /* For library-internal use; checks that the current protocol ++ * is the highest enabled version (according to s->ctx->method, ++ * as version negotiation may have changed s->method). */ ++ if (s->version == s->ctx->method->version) ++ return 1; ++ /* Apparently we're using a version-flexible SSL_METHOD ++ * (not at its highest protocol version). */ ++ if (s->ctx->method->version == SSLv23_method()->version) ++ { ++#if TLS_MAX_VERSION != TLS1_2_VERSION ++# error Code needs update for SSLv23_method() support beyond TLS1_2_VERSION. ++#endif ++ if (!(s->options & SSL_OP_NO_TLSv1_2)) ++ return s->version == TLS1_2_VERSION; ++ if (!(s->options & SSL_OP_NO_TLSv1_1)) ++ return s->version == TLS1_1_VERSION; ++ if (!(s->options & SSL_OP_NO_TLSv1)) ++ return s->version == TLS1_VERSION; ++ if (!(s->options & SSL_OP_NO_SSLv3)) ++ return s->version == SSL3_VERSION; ++ if (!(s->options & SSL_OP_NO_SSLv2)) ++ return s->version == SSL2_VERSION; ++ } ++ return 0; /* Unexpected state; fail closed. */ ++ + default: + break; + } +@@ -3714,6 +3741,7 @@ long ssl3_ctx_callback_ctrl(SSL_CTX *ctx, int cmd, + break; + #endif + #endif ++ + default: + return(0); + } +@@ -3822,10 +3850,15 @@ SSL_CIPHER *ssl3_choose_cipher(SSL *s, STACK_OF(SS + emask_k = cert->export_mask_k; + emask_a = cert->export_mask_a; + #ifndef OPENSSL_NO_SRP +- mask_k=cert->mask_k | s->srp_ctx.srp_Mask; +- emask_k=cert->export_mask_k | s->srp_ctx.srp_Mask; ++ if (s->srp_ctx.srp_Mask & SSL_kSRP) ++ { ++ mask_k |= SSL_kSRP; ++ emask_k |= SSL_kSRP; ++ mask_a |= SSL_aSRP; ++ emask_a |= SSL_aSRP; ++ } + #endif +- ++ + #ifdef KSSL_DEBUG + /* printf("ssl3_choose_cipher %d alg= %lx\n", i,c->algorithms);*/ + #endif /* KSSL_DEBUG */ +@@ -4291,4 +4324,3 @@ long ssl_get_algorithm2(SSL *s) + return SSL_HANDSHAKE_MAC_SHA256 | TLS1_PRF_SHA256; + return alg2; + } +- +Index: crypto/openssl/ssl/s3_pkt.c +=================================================================== +--- crypto/openssl/ssl/s3_pkt.c (revision 273303) ++++ crypto/openssl/ssl/s3_pkt.c (working copy) +@@ -273,6 +273,12 @@ int ssl3_read_n(SSL *s, int n, int max, int extend + return(n); + } + ++/* MAX_EMPTY_RECORDS defines the number of consecutive, empty records that will ++ * be processed per call to ssl3_get_record. Without this limit an attacker ++ * could send empty records at a faster rate than we can process and cause ++ * ssl3_get_record to loop forever. */ ++#define MAX_EMPTY_RECORDS 32 ++ + /* Call this to get a new input record. + * It will return <= 0 if more data is needed, normally due to an error + * or non-blocking IO. +@@ -293,6 +299,7 @@ static int ssl3_get_record(SSL *s) + short version; + unsigned mac_size, orig_len; + size_t extra; ++ unsigned empty_record_count = 0; + + rr= &(s->s3->rrec); + sess=s->session; +@@ -523,7 +530,17 @@ printf("\n"); + s->packet_length=0; + + /* just read a 0 length packet */ +- if (rr->length == 0) goto again; ++ if (rr->length == 0) ++ { ++ empty_record_count++; ++ if (empty_record_count > MAX_EMPTY_RECORDS) ++ { ++ al=SSL_AD_UNEXPECTED_MESSAGE; ++ SSLerr(SSL_F_SSL3_GET_RECORD,SSL_R_RECORD_TOO_SMALL); ++ goto f_err; ++ } ++ goto again; ++ } + + #if 0 + fprintf(stderr, "Ultimate Record type=%d, Length=%d\n", rr->type, rr->length); +Index: crypto/openssl/ssl/s3_srvr.c +=================================================================== +--- crypto/openssl/ssl/s3_srvr.c (revision 273303) ++++ crypto/openssl/ssl/s3_srvr.c (working copy) +@@ -154,6 +154,7 @@ + #include + #include "ssl_locl.h" + #include "kssl_lcl.h" ++#include "../crypto/constant_time_locl.h" + #include + #include + #include +@@ -410,9 +411,8 @@ int ssl3_accept(SSL *s) + case SSL3_ST_SW_CERT_B: + /* Check if it is anon DH or anon ECDH, */ + /* normal PSK or KRB5 or SRP */ +- if (!(s->s3->tmp.new_cipher->algorithm_auth & SSL_aNULL) +- && !(s->s3->tmp.new_cipher->algorithm_mkey & SSL_kPSK) +- && !(s->s3->tmp.new_cipher->algorithm_auth & SSL_aKRB5)) ++ if (!(s->s3->tmp.new_cipher->algorithm_auth & (SSL_aNULL|SSL_aKRB5|SSL_aSRP)) ++ && !(s->s3->tmp.new_cipher->algorithm_mkey & SSL_kPSK)) + { + ret=ssl3_send_server_certificate(s); + if (ret <= 0) goto end; +@@ -515,7 +515,9 @@ int ssl3_accept(SSL *s) + * (against the specs, but s3_clnt.c accepts this for SSL 3) */ + !(s->verify_mode & SSL_VERIFY_FAIL_IF_NO_PEER_CERT)) || + /* never request cert in Kerberos ciphersuites */ +- (s->s3->tmp.new_cipher->algorithm_auth & SSL_aKRB5) ++ (s->s3->tmp.new_cipher->algorithm_auth & SSL_aKRB5) || ++ /* don't request certificate for SRP auth */ ++ (s->s3->tmp.new_cipher->algorithm_auth & SSL_aSRP) + /* With normal PSK Certificates and + * Certificate Requests are omitted */ + || (s->s3->tmp.new_cipher->algorithm_mkey & SSL_kPSK)) +@@ -1846,7 +1848,7 @@ int ssl3_send_server_key_exchange(SSL *s) + n+=2+nr[i]; + } + +- if (!(s->s3->tmp.new_cipher->algorithm_auth & SSL_aNULL) ++ if (!(s->s3->tmp.new_cipher->algorithm_auth & (SSL_aNULL|SSL_aSRP)) + && !(s->s3->tmp.new_cipher->algorithm_mkey & SSL_kPSK)) + { + if ((pkey=ssl_get_sign_pkey(s,s->s3->tmp.new_cipher,&md)) +@@ -2166,6 +2168,10 @@ int ssl3_get_client_key_exchange(SSL *s) + #ifndef OPENSSL_NO_RSA + if (alg_k & SSL_kRSA) + { ++ unsigned char rand_premaster_secret[SSL_MAX_MASTER_KEY_LENGTH]; ++ int decrypt_len; ++ unsigned char decrypt_good, version_good; ++ + /* FIX THIS UP EAY EAY EAY EAY */ + if (s->s3->tmp.use_rsa_tmp) + { +@@ -2213,54 +2219,61 @@ int ssl3_get_client_key_exchange(SSL *s) + n=i; + } + +- i=RSA_private_decrypt((int)n,p,p,rsa,RSA_PKCS1_PADDING); ++ /* We must not leak whether a decryption failure occurs because ++ * of Bleichenbacher's attack on PKCS #1 v1.5 RSA padding (see ++ * RFC 2246, section 7.4.7.1). The code follows that advice of ++ * the TLS RFC and generates a random premaster secret for the ++ * case that the decrypt fails. See ++ * https://tools.ietf.org/html/rfc5246#section-7.4.7.1 */ + +- al = -1; +- +- if (i != SSL_MAX_MASTER_KEY_LENGTH) ++ /* should be RAND_bytes, but we cannot work around a failure. */ ++ if (RAND_pseudo_bytes(rand_premaster_secret, ++ sizeof(rand_premaster_secret)) <= 0) ++ goto err; ++ decrypt_len = RSA_private_decrypt((int)n,p,p,rsa,RSA_PKCS1_PADDING); ++ ERR_clear_error(); ++ ++ /* decrypt_len should be SSL_MAX_MASTER_KEY_LENGTH. ++ * decrypt_good will be 0xff if so and zero otherwise. */ ++ decrypt_good = constant_time_eq_int_8(decrypt_len, SSL_MAX_MASTER_KEY_LENGTH); ++ ++ /* If the version in the decrypted pre-master secret is correct ++ * then version_good will be 0xff, otherwise it'll be zero. ++ * The Klima-Pokorny-Rosa extension of Bleichenbacher's attack ++ * (http://eprint.iacr.org/2003/052/) exploits the version ++ * number check as a "bad version oracle". Thus version checks ++ * are done in constant time and are treated like any other ++ * decryption error. */ ++ version_good = constant_time_eq_8(p[0], (unsigned)(s->client_version>>8)); ++ version_good &= constant_time_eq_8(p[1], (unsigned)(s->client_version&0xff)); ++ ++ /* The premaster secret must contain the same version number as ++ * the ClientHello to detect version rollback attacks ++ * (strangely, the protocol does not offer such protection for ++ * DH ciphersuites). However, buggy clients exist that send the ++ * negotiated protocol version instead if the server does not ++ * support the requested protocol version. If ++ * SSL_OP_TLS_ROLLBACK_BUG is set, tolerate such clients. */ ++ if (s->options & SSL_OP_TLS_ROLLBACK_BUG) + { +- al=SSL_AD_DECODE_ERROR; +- /* SSLerr(SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE,SSL_R_BAD_RSA_DECRYPT); */ ++ unsigned char workaround_good; ++ workaround_good = constant_time_eq_8(p[0], (unsigned)(s->version>>8)); ++ workaround_good &= constant_time_eq_8(p[1], (unsigned)(s->version&0xff)); ++ version_good |= workaround_good; + } + +- if ((al == -1) && !((p[0] == (s->client_version>>8)) && (p[1] == (s->client_version & 0xff)))) ++ /* Both decryption and version must be good for decrypt_good ++ * to remain non-zero (0xff). */ ++ decrypt_good &= version_good; ++ ++ /* Now copy rand_premaster_secret over p using ++ * decrypt_good_mask. */ ++ for (i = 0; i < (int) sizeof(rand_premaster_secret); i++) + { +- /* The premaster secret must contain the same version number as the +- * ClientHello to detect version rollback attacks (strangely, the +- * protocol does not offer such protection for DH ciphersuites). +- * However, buggy clients exist that send the negotiated protocol +- * version instead if the server does not support the requested +- * protocol version. +- * If SSL_OP_TLS_ROLLBACK_BUG is set, tolerate such clients. */ +- if (!((s->options & SSL_OP_TLS_ROLLBACK_BUG) && +- (p[0] == (s->version>>8)) && (p[1] == (s->version & 0xff)))) +- { +- al=SSL_AD_DECODE_ERROR; +- /* SSLerr(SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE,SSL_R_BAD_PROTOCOL_VERSION_NUMBER); */ +- +- /* The Klima-Pokorny-Rosa extension of Bleichenbacher's attack +- * (http://eprint.iacr.org/2003/052/) exploits the version +- * number check as a "bad version oracle" -- an alert would +- * reveal that the plaintext corresponding to some ciphertext +- * made up by the adversary is properly formatted except +- * that the version number is wrong. To avoid such attacks, +- * we should treat this just like any other decryption error. */ +- } ++ p[i] = constant_time_select_8(decrypt_good, p[i], ++ rand_premaster_secret[i]); + } + +- if (al != -1) +- { +- /* Some decryption failure -- use random value instead as countermeasure +- * against Bleichenbacher's attack on PKCS #1 v1.5 RSA padding +- * (see RFC 2246, section 7.4.7.1). */ +- ERR_clear_error(); +- i = SSL_MAX_MASTER_KEY_LENGTH; +- p[0] = s->client_version >> 8; +- p[1] = s->client_version & 0xff; +- if (RAND_pseudo_bytes(p+2, i-2) <= 0) /* should be RAND_bytes, but we cannot work around a failure */ +- goto err; +- } +- + s->session->master_key_length= + s->method->ssl3_enc->generate_master_secret(s, + s->session->master_key, +Index: crypto/openssl/ssl/srtp.h +=================================================================== +--- crypto/openssl/ssl/srtp.h (revision 273303) ++++ crypto/openssl/ssl/srtp.h (working copy) +@@ -130,6 +130,8 @@ extern "C" { + #define SRTP_NULL_SHA1_80 0x0005 + #define SRTP_NULL_SHA1_32 0x0006 + ++#ifndef OPENSSL_NO_SRTP ++ + int SSL_CTX_set_tlsext_use_srtp(SSL_CTX *ctx, const char *profiles); + int SSL_set_tlsext_use_srtp(SSL *ctx, const char *profiles); + SRTP_PROTECTION_PROFILE *SSL_get_selected_srtp_profile(SSL *s); +@@ -136,6 +138,8 @@ SRTP_PROTECTION_PROFILE *SSL_get_selected_srtp_pro + + STACK_OF(SRTP_PROTECTION_PROFILE) *SSL_get_srtp_profiles(SSL *ssl); + ++#endif ++ + #ifdef __cplusplus + } + #endif +Index: crypto/openssl/ssl/ssl.h +=================================================================== +--- crypto/openssl/ssl/ssl.h (revision 273303) ++++ crypto/openssl/ssl/ssl.h (working copy) +@@ -653,6 +653,10 @@ struct ssl_session_st + */ + #define SSL_MODE_SEND_CLIENTHELLO_TIME 0x00000020L + #define SSL_MODE_SEND_SERVERHELLO_TIME 0x00000040L ++/* Send TLS_FALLBACK_SCSV in the ClientHello. ++ * To be set by applications that reconnect with a downgraded protocol ++ * version; see draft-ietf-tls-downgrade-scsv-00 for details. */ ++#define SSL_MODE_SEND_FALLBACK_SCSV 0x00000080L + + /* Note: SSL[_CTX]_set_{options,mode} use |= op on the previous value, + * they cannot be used to clear bits. */ +@@ -1511,6 +1515,7 @@ DECLARE_PEM_rw(SSL_SESSION, SSL_SESSION) + #define SSL_AD_BAD_CERTIFICATE_STATUS_RESPONSE TLS1_AD_BAD_CERTIFICATE_STATUS_RESPONSE + #define SSL_AD_BAD_CERTIFICATE_HASH_VALUE TLS1_AD_BAD_CERTIFICATE_HASH_VALUE + #define SSL_AD_UNKNOWN_PSK_IDENTITY TLS1_AD_UNKNOWN_PSK_IDENTITY /* fatal */ ++#define SSL_AD_INAPPROPRIATE_FALLBACK TLS1_AD_INAPPROPRIATE_FALLBACK /* fatal */ + + #define SSL_ERROR_NONE 0 + #define SSL_ERROR_SSL 1 +@@ -1621,6 +1626,8 @@ DECLARE_PEM_rw(SSL_SESSION, SSL_SESSION) + #define SSL_CTRL_GET_EXTRA_CHAIN_CERTS 82 + #define SSL_CTRL_CLEAR_EXTRA_CHAIN_CERTS 83 + ++#define SSL_CTRL_CHECK_PROTO_VERSION 119 ++ + #define DTLSv1_get_timeout(ssl, arg) \ + SSL_ctrl(ssl,DTLS_CTRL_GET_TIMEOUT,0, (void *)arg) + #define DTLSv1_handle_timeout(ssl) \ +@@ -2379,6 +2386,7 @@ void ERR_load_SSL_strings(void); + #define SSL_R_HTTPS_PROXY_REQUEST 155 + #define SSL_R_HTTP_REQUEST 156 + #define SSL_R_ILLEGAL_PADDING 283 ++#define SSL_R_INAPPROPRIATE_FALLBACK 373 + #define SSL_R_INCONSISTENT_COMPRESSION 340 + #define SSL_R_INVALID_CHALLENGE_LENGTH 158 + #define SSL_R_INVALID_COMMAND 280 +@@ -2525,6 +2533,7 @@ void ERR_load_SSL_strings(void); + #define SSL_R_TLSV1_ALERT_DECRYPTION_FAILED 1021 + #define SSL_R_TLSV1_ALERT_DECRYPT_ERROR 1051 + #define SSL_R_TLSV1_ALERT_EXPORT_RESTRICTION 1060 ++#define SSL_R_TLSV1_ALERT_INAPPROPRIATE_FALLBACK 1086 + #define SSL_R_TLSV1_ALERT_INSUFFICIENT_SECURITY 1071 + #define SSL_R_TLSV1_ALERT_INTERNAL_ERROR 1080 + #define SSL_R_TLSV1_ALERT_NO_RENEGOTIATION 1100 +Index: crypto/openssl/ssl/ssl3.h +=================================================================== +--- crypto/openssl/ssl/ssl3.h (revision 273303) ++++ crypto/openssl/ssl/ssl3.h (working copy) +@@ -128,9 +128,14 @@ + extern "C" { + #endif + +-/* Signalling cipher suite value: from draft-ietf-tls-renegotiation-03.txt */ ++/* Signalling cipher suite value from RFC 5746 ++ * (TLS_EMPTY_RENEGOTIATION_INFO_SCSV) */ + #define SSL3_CK_SCSV 0x030000FF + ++/* Signalling cipher suite value from draft-ietf-tls-downgrade-scsv-00 ++ * (TLS_FALLBACK_SCSV) */ ++#define SSL3_CK_FALLBACK_SCSV 0x03005600 ++ + #define SSL3_CK_RSA_NULL_MD5 0x03000001 + #define SSL3_CK_RSA_NULL_SHA 0x03000002 + #define SSL3_CK_RSA_RC4_40_MD5 0x03000003 +Index: crypto/openssl/ssl/ssl_err.c +=================================================================== +--- crypto/openssl/ssl/ssl_err.c (revision 273303) ++++ crypto/openssl/ssl/ssl_err.c (working copy) +@@ -383,6 +383,7 @@ static ERR_STRING_DATA SSL_str_reasons[]= + {ERR_REASON(SSL_R_HTTPS_PROXY_REQUEST) ,"https proxy request"}, + {ERR_REASON(SSL_R_HTTP_REQUEST) ,"http request"}, + {ERR_REASON(SSL_R_ILLEGAL_PADDING) ,"illegal padding"}, ++{ERR_REASON(SSL_R_INAPPROPRIATE_FALLBACK),"inappropriate fallback"}, + {ERR_REASON(SSL_R_INCONSISTENT_COMPRESSION),"inconsistent compression"}, + {ERR_REASON(SSL_R_INVALID_CHALLENGE_LENGTH),"invalid challenge length"}, + {ERR_REASON(SSL_R_INVALID_COMMAND) ,"invalid command"}, +@@ -529,6 +530,7 @@ static ERR_STRING_DATA SSL_str_reasons[]= + {ERR_REASON(SSL_R_TLSV1_ALERT_DECRYPTION_FAILED),"tlsv1 alert decryption failed"}, + {ERR_REASON(SSL_R_TLSV1_ALERT_DECRYPT_ERROR),"tlsv1 alert decrypt error"}, + {ERR_REASON(SSL_R_TLSV1_ALERT_EXPORT_RESTRICTION),"tlsv1 alert export restriction"}, ++{ERR_REASON(SSL_R_TLSV1_ALERT_INAPPROPRIATE_FALLBACK),"tlsv1 alert inappropriate fallback"}, + {ERR_REASON(SSL_R_TLSV1_ALERT_INSUFFICIENT_SECURITY),"tlsv1 alert insufficient security"}, + {ERR_REASON(SSL_R_TLSV1_ALERT_INTERNAL_ERROR),"tlsv1 alert internal error"}, + {ERR_REASON(SSL_R_TLSV1_ALERT_NO_RENEGOTIATION),"tlsv1 alert no renegotiation"}, +Index: crypto/openssl/ssl/ssl_lib.c +=================================================================== +--- crypto/openssl/ssl/ssl_lib.c (revision 273303) ++++ crypto/openssl/ssl/ssl_lib.c (working copy) +@@ -1387,6 +1387,8 @@ int ssl_cipher_list_to_bytes(SSL *s,STACK_OF(SSL_C + + if (sk == NULL) return(0); + q=p; ++ if (put_cb == NULL) ++ put_cb = s->method->put_cipher_by_char; + + for (i=0; isrp_ctx.srp_Mask & SSL_kSRP)) + continue; + #endif /* OPENSSL_NO_SRP */ +- j = put_cb ? put_cb(c,p) : ssl_put_cipher_by_char(s,c,p); ++ j = put_cb(c,p); + p+=j; + } +- /* If p == q, no ciphers and caller indicates an error. Otherwise +- * add SCSV if not renegotiating. +- */ +- if (p != q && !s->renegotiate) ++ /* If p == q, no ciphers; caller indicates an error. ++ * Otherwise, add applicable SCSVs. */ ++ if (p != q) + { +- static SSL_CIPHER scsv = ++ if (!s->renegotiate) + { +- 0, NULL, SSL3_CK_SCSV, 0, 0, 0, 0, 0, 0, 0, 0, 0 +- }; +- j = put_cb ? put_cb(&scsv,p) : ssl_put_cipher_by_char(s,&scsv,p); +- p+=j; ++ static SSL_CIPHER scsv = ++ { ++ 0, NULL, SSL3_CK_SCSV, 0, 0, 0, 0, 0, 0, 0, 0, 0 ++ }; ++ j = put_cb(&scsv,p); ++ p+=j; + #ifdef OPENSSL_RI_DEBUG +- fprintf(stderr, "SCSV sent by client\n"); ++ fprintf(stderr, "TLS_EMPTY_RENEGOTIATION_INFO_SCSV sent by client\n"); + #endif +- } ++ } + ++ if (s->mode & SSL_MODE_SEND_FALLBACK_SCSV) ++ { ++ static SSL_CIPHER scsv = ++ { ++ 0, NULL, SSL3_CK_FALLBACK_SCSV, 0, 0, 0, 0, 0, 0, 0, 0, 0 ++ }; ++ j = put_cb(&scsv,p); ++ p+=j; ++ } ++ } ++ + return(p-q); + } + +@@ -1439,11 +1453,12 @@ STACK_OF(SSL_CIPHER) *ssl_bytes_to_cipher_list(SSL + const SSL_CIPHER *c; + STACK_OF(SSL_CIPHER) *sk; + int i,n; ++ + if (s->s3) + s->s3->send_connection_binding = 0; + + n=ssl_put_cipher_by_char(s,NULL,NULL); +- if ((num%n) != 0) ++ if (n == 0 || (num%n) != 0) + { + SSLerr(SSL_F_SSL_BYTES_TO_CIPHER_LIST,SSL_R_ERROR_IN_RECEIVED_CIPHER_LIST); + return(NULL); +@@ -1458,7 +1473,7 @@ STACK_OF(SSL_CIPHER) *ssl_bytes_to_cipher_list(SSL + + for (i=0; is3 && (n != 3 || !p[0]) && + (p[n-2] == ((SSL3_CK_SCSV >> 8) & 0xff)) && + (p[n-1] == (SSL3_CK_SCSV & 0xff))) +@@ -1478,6 +1493,23 @@ STACK_OF(SSL_CIPHER) *ssl_bytes_to_cipher_list(SSL + continue; + } + ++ /* Check for TLS_FALLBACK_SCSV */ ++ if ((n != 3 || !p[0]) && ++ (p[n-2] == ((SSL3_CK_FALLBACK_SCSV >> 8) & 0xff)) && ++ (p[n-1] == (SSL3_CK_FALLBACK_SCSV & 0xff))) ++ { ++ /* The SCSV indicates that the client previously tried a higher version. ++ * Fail if the current version is an unexpected downgrade. */ ++ if (!SSL_ctrl(s, SSL_CTRL_CHECK_PROTO_VERSION, 0, NULL)) ++ { ++ SSLerr(SSL_F_SSL_BYTES_TO_CIPHER_LIST,SSL_R_INAPPROPRIATE_FALLBACK); ++ if (s->s3) ++ ssl3_send_alert(s,SSL3_AL_FATAL,SSL_AD_INAPPROPRIATE_FALLBACK); ++ goto err; ++ } ++ continue; ++ } ++ + c=ssl_get_cipher_by_char(s,p); + p+=n; + if (c != NULL) +@@ -2944,6 +2976,7 @@ SSL_CTX *SSL_get_SSL_CTX(const SSL *ssl) + + SSL_CTX *SSL_set_SSL_CTX(SSL *ssl, SSL_CTX* ctx) + { ++ CERT *ocert = ssl->cert; + if (ssl->ctx == ctx) + return ssl->ctx; + #ifndef OPENSSL_NO_TLSEXT +@@ -2950,9 +2983,19 @@ SSL_CTX *SSL_set_SSL_CTX(SSL *ssl, SSL_CTX* ctx) + if (ctx == NULL) + ctx = ssl->initial_ctx; + #endif +- if (ssl->cert != NULL) +- ssl_cert_free(ssl->cert); + ssl->cert = ssl_cert_dup(ctx->cert); ++ if (ocert != NULL) ++ { ++ int i; ++ /* Copy negotiated digests from original */ ++ for (i = 0; i < SSL_PKEY_NUM; i++) ++ { ++ CERT_PKEY *cpk = ocert->pkeys + i; ++ CERT_PKEY *rpk = ssl->cert->pkeys + i; ++ rpk->digest = cpk->digest; ++ } ++ ssl_cert_free(ocert); ++ } + CRYPTO_add(&ctx->references,1,CRYPTO_LOCK_SSL_CTX); + if (ssl->ctx != NULL) + SSL_CTX_free(ssl->ctx); /* decrement reference count */ +Index: crypto/openssl/ssl/t1_enc.c +=================================================================== +--- crypto/openssl/ssl/t1_enc.c (revision 273303) ++++ crypto/openssl/ssl/t1_enc.c (working copy) +@@ -1241,6 +1241,7 @@ int tls1_alert_code(int code) + case SSL_AD_BAD_CERTIFICATE_STATUS_RESPONSE: return(TLS1_AD_BAD_CERTIFICATE_STATUS_RESPONSE); + case SSL_AD_BAD_CERTIFICATE_HASH_VALUE: return(TLS1_AD_BAD_CERTIFICATE_HASH_VALUE); + case SSL_AD_UNKNOWN_PSK_IDENTITY:return(TLS1_AD_UNKNOWN_PSK_IDENTITY); ++ case SSL_AD_INAPPROPRIATE_FALLBACK:return(TLS1_AD_INAPPROPRIATE_FALLBACK); + #if 0 /* not appropriate for TLS, not used for DTLS */ + case DTLS1_AD_MISSING_HANDSHAKE_MESSAGE: return + (DTLS1_AD_MISSING_HANDSHAKE_MESSAGE); +Index: crypto/openssl/ssl/t1_lib.c +=================================================================== +--- crypto/openssl/ssl/t1_lib.c (revision 273303) ++++ crypto/openssl/ssl/t1_lib.c (working copy) +@@ -643,7 +643,7 @@ unsigned char *ssl_add_clienthello_tlsext(SSL *s, + #endif + + #ifndef OPENSSL_NO_SRTP +- if(SSL_get_srtp_profiles(s)) ++ if(SSL_IS_DTLS(s) && SSL_get_srtp_profiles(s)) + { + int el; + +@@ -806,7 +806,7 @@ unsigned char *ssl_add_serverhello_tlsext(SSL *s, + #endif + + #ifndef OPENSSL_NO_SRTP +- if(s->srtp_profile) ++ if(SSL_IS_DTLS(s) && s->srtp_profile) + { + int el; + +@@ -1444,7 +1444,8 @@ int ssl_parse_clienthello_tlsext(SSL *s, unsigned + + /* session ticket processed earlier */ + #ifndef OPENSSL_NO_SRTP +- else if (type == TLSEXT_TYPE_use_srtp) ++ else if (SSL_IS_DTLS(s) && SSL_get_srtp_profiles(s) ++ && type == TLSEXT_TYPE_use_srtp) + { + if(ssl_parse_clienthello_use_srtp_ext(s, data, size, + al)) +@@ -1698,7 +1699,7 @@ int ssl_parse_serverhello_tlsext(SSL *s, unsigned + } + #endif + #ifndef OPENSSL_NO_SRTP +- else if (type == TLSEXT_TYPE_use_srtp) ++ else if (SSL_IS_DTLS(s) && type == TLSEXT_TYPE_use_srtp) + { + if(ssl_parse_serverhello_use_srtp_ext(s, data, size, + al)) +@@ -2347,7 +2348,10 @@ static int tls_decrypt_ticket(SSL *s, const unsign + HMAC_Final(&hctx, tick_hmac, NULL); + HMAC_CTX_cleanup(&hctx); + if (CRYPTO_memcmp(tick_hmac, etick + eticklen, mlen)) ++ { ++ EVP_CIPHER_CTX_cleanup(&ctx); + return 2; ++ } + /* Attempt to decrypt session data */ + /* Move p after IV to start of encrypted ticket, update length */ + p = etick + 16 + EVP_CIPHER_CTX_iv_length(&ctx); +Index: crypto/openssl/ssl/tls1.h +=================================================================== +--- crypto/openssl/ssl/tls1.h (revision 273303) ++++ crypto/openssl/ssl/tls1.h (working copy) +@@ -159,17 +159,19 @@ extern "C" { + + #define TLS1_ALLOW_EXPERIMENTAL_CIPHERSUITES 0 + ++#define TLS1_VERSION 0x0301 ++#define TLS1_1_VERSION 0x0302 + #define TLS1_2_VERSION 0x0303 +-#define TLS1_2_VERSION_MAJOR 0x03 +-#define TLS1_2_VERSION_MINOR 0x03 ++#define TLS_MAX_VERSION TLS1_2_VERSION + +-#define TLS1_1_VERSION 0x0302 ++#define TLS1_VERSION_MAJOR 0x03 ++#define TLS1_VERSION_MINOR 0x01 ++ + #define TLS1_1_VERSION_MAJOR 0x03 + #define TLS1_1_VERSION_MINOR 0x02 + +-#define TLS1_VERSION 0x0301 +-#define TLS1_VERSION_MAJOR 0x03 +-#define TLS1_VERSION_MINOR 0x01 ++#define TLS1_2_VERSION_MAJOR 0x03 ++#define TLS1_2_VERSION_MINOR 0x03 + + #define TLS1_get_version(s) \ + ((s->version >> 8) == TLS1_VERSION_MAJOR ? s->version : 0) +@@ -187,6 +189,7 @@ extern "C" { + #define TLS1_AD_PROTOCOL_VERSION 70 /* fatal */ + #define TLS1_AD_INSUFFICIENT_SECURITY 71 /* fatal */ + #define TLS1_AD_INTERNAL_ERROR 80 /* fatal */ ++#define TLS1_AD_INAPPROPRIATE_FALLBACK 86 /* fatal */ + #define TLS1_AD_USER_CANCELLED 90 + #define TLS1_AD_NO_RENEGOTIATION 100 + /* codes 110-114 are from RFC3546 */ +Index: crypto/openssl/util/mk1mf.pl +=================================================================== +--- crypto/openssl/util/mk1mf.pl (revision 273303) ++++ crypto/openssl/util/mk1mf.pl (working copy) +@@ -1145,6 +1145,7 @@ sub read_options + "dll" => \$shlib, + "shared" => 0, + "no-sctp" => 0, ++ "no-srtp" => 0, + "no-gmp" => 0, + "no-rfc3779" => 0, + "no-montasm" => 0, +Index: crypto/openssl/util/mkdef.pl +=================================================================== +--- crypto/openssl/util/mkdef.pl (revision 273303) ++++ crypto/openssl/util/mkdef.pl (working copy) +@@ -117,6 +117,8 @@ my @known_algorithms = ( "RC2", "RC4", "RC5", "IDE + "SSL_INTERN", + # SCTP + "SCTP", ++ # SRTP ++ "SRTP", + # Unit testing + "UNIT_TEST"); + +@@ -138,7 +140,7 @@ my $no_ec; my $no_ecdsa; my $no_ecdh; my $no_engin + my $no_fp_api; my $no_static_engine=1; my $no_gmp; my $no_deprecated; + my $no_rfc3779; my $no_psk; my $no_tlsext; my $no_cms; my $no_capieng; + my $no_jpake; my $no_srp; my $no_ssl2; my $no_ec2m; my $no_nistp_gcc; +-my $no_nextprotoneg; my $no_sctp; ++my $no_nextprotoneg; my $no_sctp; my $no_srtp; + my $no_unit_test; + + my $fips; +@@ -238,6 +240,7 @@ foreach (@ARGV, split(/ /, $options)) + elsif (/^no-jpake$/) { $no_jpake=1; } + elsif (/^no-srp$/) { $no_srp=1; } + elsif (/^no-sctp$/) { $no_sctp=1; } ++ elsif (/^no-srtp$/) { $no_srtp=1; } + elsif (/^no-unit-test$/){ $no_unit_test=1; } + } + +@@ -1209,6 +1212,7 @@ sub is_valid + if ($keyword eq "JPAKE" && $no_jpake) { return 0; } + if ($keyword eq "SRP" && $no_srp) { return 0; } + if ($keyword eq "SCTP" && $no_sctp) { return 0; } ++ if ($keyword eq "SRTP" && $no_srtp) { return 0; } + if ($keyword eq "UNIT_TEST" && $no_unit_test) { return 0; } + if ($keyword eq "DEPRECATED" && $no_deprecated) { return 0; } + +Index: crypto/openssl/util/ssleay.num +=================================================================== +--- crypto/openssl/util/ssleay.num (revision 273303) ++++ crypto/openssl/util/ssleay.num (working copy) +@@ -310,14 +310,14 @@ TLSv1_2_method 350 EXIST: + SSL_SESSION_get_id_len 351 NOEXIST::FUNCTION: + kssl_ctx_get0_client_princ 352 EXIST::FUNCTION:KRB5 + SSL_export_keying_material 353 EXIST::FUNCTION:TLSEXT +-SSL_set_tlsext_use_srtp 354 EXIST::FUNCTION: ++SSL_set_tlsext_use_srtp 354 EXIST::FUNCTION:SRTP + SSL_CTX_set_next_protos_advertised_cb 355 EXIST:!VMS:FUNCTION:NEXTPROTONEG + SSL_CTX_set_next_protos_adv_cb 355 EXIST:VMS:FUNCTION:NEXTPROTONEG + SSL_get0_next_proto_negotiated 356 EXIST::FUNCTION:NEXTPROTONEG +-SSL_get_selected_srtp_profile 357 EXIST::FUNCTION: +-SSL_CTX_set_tlsext_use_srtp 358 EXIST::FUNCTION: ++SSL_get_selected_srtp_profile 357 EXIST::FUNCTION:SRTP ++SSL_CTX_set_tlsext_use_srtp 358 EXIST::FUNCTION:SRTP + SSL_select_next_proto 359 EXIST::FUNCTION:NEXTPROTONEG +-SSL_get_srtp_profiles 360 EXIST::FUNCTION: ++SSL_get_srtp_profiles 360 EXIST::FUNCTION:SRTP + SSL_CTX_set_next_proto_select_cb 361 EXIST:!VMS:FUNCTION:NEXTPROTONEG + SSL_CTX_set_next_proto_sel_cb 361 EXIST:VMS:FUNCTION:NEXTPROTONEG + SSL_SESSION_get_compress_id 362 EXIST::FUNCTION: +Index: secure/lib/libcrypto/Makefile.inc +=================================================================== +--- secure/lib/libcrypto/Makefile.inc (revision 273303) ++++ secure/lib/libcrypto/Makefile.inc (working copy) +@@ -3,8 +3,8 @@ + .include + + # OpenSSL version used for manual page generation +-OPENSSL_VER= 1.0.1i +-OPENSSL_DATE= 2014-08-06 ++OPENSSL_VER= 1.0.1j ++OPENSSL_DATE= 2014-10-15 + + LCRYPTO_SRC= ${.CURDIR}/../../../crypto/openssl + LCRYPTO_DOC= ${.CURDIR}/../../../crypto/openssl/doc +Index: secure/lib/libcrypto/Makefile.man +=================================================================== +--- secure/lib/libcrypto/Makefile.man (revision 273303) ++++ secure/lib/libcrypto/Makefile.man (working copy) +@@ -47,6 +47,7 @@ MAN+= BN_swap.3 + MAN+= BN_zero.3 + MAN+= CMS_add0_cert.3 + MAN+= CMS_add1_recipient_cert.3 ++MAN+= CMS_add1_signer.3 + MAN+= CMS_compress.3 + MAN+= CMS_decrypt.3 + MAN+= CMS_encrypt.3 +@@ -56,7 +57,6 @@ MAN+= CMS_get0_SignerInfos.3 + MAN+= CMS_get0_type.3 + MAN+= CMS_get1_ReceiptRequest.3 + MAN+= CMS_sign.3 +-MAN+= CMS_sign_add1_signer.3 + MAN+= CMS_sign_receipt.3 + MAN+= CMS_uncompress.3 + MAN+= CMS_verify.3 +@@ -397,6 +397,7 @@ MLINKS+= CMS_add0_cert.3 CMS_get1_certs.3 + MLINKS+= CMS_add0_cert.3 CMS_add0_crl.3 + MLINKS+= CMS_add0_cert.3 CMS_get1_crls.3 + MLINKS+= CMS_add1_recipient_cert.3 CMS_add0_recipient_key.3 ++MLINKS+= CMS_add1_signer.3 CMS_SignerInfo_sign.3 + MLINKS+= CMS_get0_RecipientInfos.3 CMS_RecipientInfo_type.3 + MLINKS+= CMS_get0_RecipientInfos.3 CMS_RecipientInfo_ktri_get0_signer_id.3 + MLINKS+= CMS_get0_RecipientInfos.3 CMS_RecipientInfo_ktri_cert_cmp.3 +@@ -413,7 +414,6 @@ MLINKS+= CMS_get0_type.3 CMS_get0_eContentType.3 + MLINKS+= CMS_get1_ReceiptRequest.3 CMS_ReceiptRequest_create0.3 + MLINKS+= CMS_get1_ReceiptRequest.3 CMS_add1_ReceiptRequest.3 + MLINKS+= CMS_get1_ReceiptRequest.3 CMS_ReceiptRequest_get0_values.3 +-MLINKS+= CMS_sign_add1_signer.3 CMS_SignerInfo_sign.3 + MLINKS+= CONF_modules_free.3 CONF_modules_finish.3 + MLINKS+= CONF_modules_free.3 CONF_modules_unload.3 + MLINKS+= CONF_modules_load_file.3 CONF_modules_load.3 +Index: secure/lib/libcrypto/man/ASN1_OBJECT_new.3 +=================================================================== +--- secure/lib/libcrypto/man/ASN1_OBJECT_new.3 (revision 273303) ++++ secure/lib/libcrypto/man/ASN1_OBJECT_new.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "ASN1_OBJECT_new 3" +-.TH ASN1_OBJECT_new 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH ASN1_OBJECT_new 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/ASN1_STRING_length.3 +=================================================================== +--- secure/lib/libcrypto/man/ASN1_STRING_length.3 (revision 273303) ++++ secure/lib/libcrypto/man/ASN1_STRING_length.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "ASN1_STRING_length 3" +-.TH ASN1_STRING_length 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH ASN1_STRING_length 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/ASN1_STRING_new.3 +=================================================================== +--- secure/lib/libcrypto/man/ASN1_STRING_new.3 (revision 273303) ++++ secure/lib/libcrypto/man/ASN1_STRING_new.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "ASN1_STRING_new 3" +-.TH ASN1_STRING_new 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH ASN1_STRING_new 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/ASN1_STRING_print_ex.3 +=================================================================== +--- secure/lib/libcrypto/man/ASN1_STRING_print_ex.3 (revision 273303) ++++ secure/lib/libcrypto/man/ASN1_STRING_print_ex.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "ASN1_STRING_print_ex 3" +-.TH ASN1_STRING_print_ex 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH ASN1_STRING_print_ex 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/ASN1_generate_nconf.3 +=================================================================== +--- secure/lib/libcrypto/man/ASN1_generate_nconf.3 (revision 273303) ++++ secure/lib/libcrypto/man/ASN1_generate_nconf.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "ASN1_generate_nconf 3" +-.TH ASN1_generate_nconf 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH ASN1_generate_nconf 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/BIO_ctrl.3 +=================================================================== +--- secure/lib/libcrypto/man/BIO_ctrl.3 (revision 273303) ++++ secure/lib/libcrypto/man/BIO_ctrl.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "BIO_ctrl 3" +-.TH BIO_ctrl 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH BIO_ctrl 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/BIO_f_base64.3 +=================================================================== +--- secure/lib/libcrypto/man/BIO_f_base64.3 (revision 273303) ++++ secure/lib/libcrypto/man/BIO_f_base64.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "BIO_f_base64 3" +-.TH BIO_f_base64 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH BIO_f_base64 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/BIO_f_buffer.3 +=================================================================== +--- secure/lib/libcrypto/man/BIO_f_buffer.3 (revision 273303) ++++ secure/lib/libcrypto/man/BIO_f_buffer.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "BIO_f_buffer 3" +-.TH BIO_f_buffer 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH BIO_f_buffer 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/BIO_f_cipher.3 +=================================================================== +--- secure/lib/libcrypto/man/BIO_f_cipher.3 (revision 273303) ++++ secure/lib/libcrypto/man/BIO_f_cipher.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "BIO_f_cipher 3" +-.TH BIO_f_cipher 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH BIO_f_cipher 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/BIO_f_md.3 +=================================================================== +--- secure/lib/libcrypto/man/BIO_f_md.3 (revision 273303) ++++ secure/lib/libcrypto/man/BIO_f_md.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "BIO_f_md 3" +-.TH BIO_f_md 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH BIO_f_md 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/BIO_f_null.3 +=================================================================== +--- secure/lib/libcrypto/man/BIO_f_null.3 (revision 273303) ++++ secure/lib/libcrypto/man/BIO_f_null.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "BIO_f_null 3" +-.TH BIO_f_null 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH BIO_f_null 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/BIO_f_ssl.3 +=================================================================== +--- secure/lib/libcrypto/man/BIO_f_ssl.3 (revision 273303) ++++ secure/lib/libcrypto/man/BIO_f_ssl.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "BIO_f_ssl 3" +-.TH BIO_f_ssl 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH BIO_f_ssl 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/BIO_find_type.3 +=================================================================== +--- secure/lib/libcrypto/man/BIO_find_type.3 (revision 273303) ++++ secure/lib/libcrypto/man/BIO_find_type.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "BIO_find_type 3" +-.TH BIO_find_type 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH BIO_find_type 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/BIO_new.3 +=================================================================== +--- secure/lib/libcrypto/man/BIO_new.3 (revision 273303) ++++ secure/lib/libcrypto/man/BIO_new.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "BIO_new 3" +-.TH BIO_new 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH BIO_new 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/BIO_new_CMS.3 +=================================================================== +--- secure/lib/libcrypto/man/BIO_new_CMS.3 (revision 273303) ++++ secure/lib/libcrypto/man/BIO_new_CMS.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "BIO_new_CMS 3" +-.TH BIO_new_CMS 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH BIO_new_CMS 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/BIO_push.3 +=================================================================== +--- secure/lib/libcrypto/man/BIO_push.3 (revision 273303) ++++ secure/lib/libcrypto/man/BIO_push.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "BIO_push 3" +-.TH BIO_push 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH BIO_push 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/BIO_read.3 +=================================================================== +--- secure/lib/libcrypto/man/BIO_read.3 (revision 273303) ++++ secure/lib/libcrypto/man/BIO_read.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "BIO_read 3" +-.TH BIO_read 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH BIO_read 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/BIO_s_accept.3 +=================================================================== +--- secure/lib/libcrypto/man/BIO_s_accept.3 (revision 273303) ++++ secure/lib/libcrypto/man/BIO_s_accept.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "BIO_s_accept 3" +-.TH BIO_s_accept 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH BIO_s_accept 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +@@ -187,8 +187,8 @@ the accept socket. See \fIBIO_s_fd\fR\|(3) + \&\fIBIO_set_accept_port()\fR uses the string \fBname\fR to set the accept + port. The port is represented as a string of the form \*(L"host:port\*(R", + where \*(L"host\*(R" is the interface to use and \*(L"port\*(R" is the port. +-Either or both values can be \*(L"*\*(R" which is interpreted as meaning +-any interface or port respectively. \*(L"port\*(R" has the same syntax ++The host can be can be \*(L"*\*(R" which is interpreted as meaning ++any interface; \*(L"port\*(R" has the same syntax + as the port specified in \fIBIO_set_conn_port()\fR for connect BIOs, + that is it can be a numerical port string or a string to lookup + using \fIgetservbyname()\fR and a string table. +Index: secure/lib/libcrypto/man/BIO_s_bio.3 +=================================================================== +--- secure/lib/libcrypto/man/BIO_s_bio.3 (revision 273303) ++++ secure/lib/libcrypto/man/BIO_s_bio.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "BIO_s_bio 3" +-.TH BIO_s_bio 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH BIO_s_bio 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/BIO_s_connect.3 +=================================================================== +--- secure/lib/libcrypto/man/BIO_s_connect.3 (revision 273303) ++++ secure/lib/libcrypto/man/BIO_s_connect.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "BIO_s_connect 3" +-.TH BIO_s_connect 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH BIO_s_connect 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/BIO_s_fd.3 +=================================================================== +--- secure/lib/libcrypto/man/BIO_s_fd.3 (revision 273303) ++++ secure/lib/libcrypto/man/BIO_s_fd.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "BIO_s_fd 3" +-.TH BIO_s_fd 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH BIO_s_fd 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/BIO_s_file.3 +=================================================================== +--- secure/lib/libcrypto/man/BIO_s_file.3 (revision 273303) ++++ secure/lib/libcrypto/man/BIO_s_file.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "BIO_s_file 3" +-.TH BIO_s_file 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH BIO_s_file 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/BIO_s_mem.3 +=================================================================== +--- secure/lib/libcrypto/man/BIO_s_mem.3 (revision 273303) ++++ secure/lib/libcrypto/man/BIO_s_mem.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "BIO_s_mem 3" +-.TH BIO_s_mem 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH BIO_s_mem 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/BIO_s_null.3 +=================================================================== +--- secure/lib/libcrypto/man/BIO_s_null.3 (revision 273303) ++++ secure/lib/libcrypto/man/BIO_s_null.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "BIO_s_null 3" +-.TH BIO_s_null 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH BIO_s_null 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/BIO_s_socket.3 +=================================================================== +--- secure/lib/libcrypto/man/BIO_s_socket.3 (revision 273303) ++++ secure/lib/libcrypto/man/BIO_s_socket.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "BIO_s_socket 3" +-.TH BIO_s_socket 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH BIO_s_socket 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/BIO_set_callback.3 +=================================================================== +--- secure/lib/libcrypto/man/BIO_set_callback.3 (revision 273303) ++++ secure/lib/libcrypto/man/BIO_set_callback.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "BIO_set_callback 3" +-.TH BIO_set_callback 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH BIO_set_callback 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/BIO_should_retry.3 +=================================================================== +--- secure/lib/libcrypto/man/BIO_should_retry.3 (revision 273303) ++++ secure/lib/libcrypto/man/BIO_should_retry.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "BIO_should_retry 3" +-.TH BIO_should_retry 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH BIO_should_retry 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/BN_BLINDING_new.3 +=================================================================== +--- secure/lib/libcrypto/man/BN_BLINDING_new.3 (revision 273303) ++++ secure/lib/libcrypto/man/BN_BLINDING_new.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "BN_BLINDING_new 3" +-.TH BN_BLINDING_new 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH BN_BLINDING_new 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/BN_CTX_new.3 +=================================================================== +--- secure/lib/libcrypto/man/BN_CTX_new.3 (revision 273303) ++++ secure/lib/libcrypto/man/BN_CTX_new.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "BN_CTX_new 3" +-.TH BN_CTX_new 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH BN_CTX_new 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/BN_CTX_start.3 +=================================================================== +--- secure/lib/libcrypto/man/BN_CTX_start.3 (revision 273303) ++++ secure/lib/libcrypto/man/BN_CTX_start.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "BN_CTX_start 3" +-.TH BN_CTX_start 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH BN_CTX_start 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/BN_add.3 +=================================================================== +--- secure/lib/libcrypto/man/BN_add.3 (revision 273303) ++++ secure/lib/libcrypto/man/BN_add.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "BN_add 3" +-.TH BN_add 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH BN_add 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/BN_add_word.3 +=================================================================== +--- secure/lib/libcrypto/man/BN_add_word.3 (revision 273303) ++++ secure/lib/libcrypto/man/BN_add_word.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "BN_add_word 3" +-.TH BN_add_word 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH BN_add_word 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/BN_bn2bin.3 +=================================================================== +--- secure/lib/libcrypto/man/BN_bn2bin.3 (revision 273303) ++++ secure/lib/libcrypto/man/BN_bn2bin.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "BN_bn2bin 3" +-.TH BN_bn2bin 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH BN_bn2bin 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/BN_cmp.3 +=================================================================== +--- secure/lib/libcrypto/man/BN_cmp.3 (revision 273303) ++++ secure/lib/libcrypto/man/BN_cmp.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "BN_cmp 3" +-.TH BN_cmp 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH BN_cmp 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/BN_copy.3 +=================================================================== +--- secure/lib/libcrypto/man/BN_copy.3 (revision 273303) ++++ secure/lib/libcrypto/man/BN_copy.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "BN_copy 3" +-.TH BN_copy 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH BN_copy 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/BN_generate_prime.3 +=================================================================== +--- secure/lib/libcrypto/man/BN_generate_prime.3 (revision 273303) ++++ secure/lib/libcrypto/man/BN_generate_prime.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "BN_generate_prime 3" +-.TH BN_generate_prime 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH BN_generate_prime 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/BN_mod_inverse.3 +=================================================================== +--- secure/lib/libcrypto/man/BN_mod_inverse.3 (revision 273303) ++++ secure/lib/libcrypto/man/BN_mod_inverse.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "BN_mod_inverse 3" +-.TH BN_mod_inverse 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH BN_mod_inverse 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/BN_mod_mul_montgomery.3 +=================================================================== +--- secure/lib/libcrypto/man/BN_mod_mul_montgomery.3 (revision 273303) ++++ secure/lib/libcrypto/man/BN_mod_mul_montgomery.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "BN_mod_mul_montgomery 3" +-.TH BN_mod_mul_montgomery 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH BN_mod_mul_montgomery 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/BN_mod_mul_reciprocal.3 +=================================================================== +--- secure/lib/libcrypto/man/BN_mod_mul_reciprocal.3 (revision 273303) ++++ secure/lib/libcrypto/man/BN_mod_mul_reciprocal.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "BN_mod_mul_reciprocal 3" +-.TH BN_mod_mul_reciprocal 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH BN_mod_mul_reciprocal 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/BN_new.3 +=================================================================== +--- secure/lib/libcrypto/man/BN_new.3 (revision 273303) ++++ secure/lib/libcrypto/man/BN_new.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "BN_new 3" +-.TH BN_new 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH BN_new 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/BN_num_bytes.3 +=================================================================== +--- secure/lib/libcrypto/man/BN_num_bytes.3 (revision 273303) ++++ secure/lib/libcrypto/man/BN_num_bytes.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "BN_num_bytes 3" +-.TH BN_num_bytes 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH BN_num_bytes 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/BN_rand.3 +=================================================================== +--- secure/lib/libcrypto/man/BN_rand.3 (revision 273303) ++++ secure/lib/libcrypto/man/BN_rand.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "BN_rand 3" +-.TH BN_rand 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH BN_rand 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/BN_set_bit.3 +=================================================================== +--- secure/lib/libcrypto/man/BN_set_bit.3 (revision 273303) ++++ secure/lib/libcrypto/man/BN_set_bit.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "BN_set_bit 3" +-.TH BN_set_bit 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH BN_set_bit 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/BN_swap.3 +=================================================================== +--- secure/lib/libcrypto/man/BN_swap.3 (revision 273303) ++++ secure/lib/libcrypto/man/BN_swap.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "BN_swap 3" +-.TH BN_swap 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH BN_swap 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/BN_zero.3 +=================================================================== +--- secure/lib/libcrypto/man/BN_zero.3 (revision 273303) ++++ secure/lib/libcrypto/man/BN_zero.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "BN_zero 3" +-.TH BN_zero 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH BN_zero 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/CMS_add0_cert.3 +=================================================================== +--- secure/lib/libcrypto/man/CMS_add0_cert.3 (revision 273303) ++++ secure/lib/libcrypto/man/CMS_add0_cert.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "CMS_add0_cert 3" +-.TH CMS_add0_cert 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH CMS_add0_cert 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/CMS_add1_recipient_cert.3 +=================================================================== +--- secure/lib/libcrypto/man/CMS_add1_recipient_cert.3 (revision 273303) ++++ secure/lib/libcrypto/man/CMS_add1_recipient_cert.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "CMS_add1_recipient_cert 3" +-.TH CMS_add1_recipient_cert 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH CMS_add1_recipient_cert 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/CMS_add1_signer.3 +=================================================================== +--- secure/lib/libcrypto/man/CMS_add1_signer.3 (revision 0) ++++ secure/lib/libcrypto/man/CMS_add1_signer.3 (working copy) +@@ -0,0 +1,224 @@ ++.\" Automatically generated by Pod::Man 2.25 (Pod::Simple 3.28) ++.\" ++.\" Standard preamble: ++.\" ======================================================================== ++.de Sp \" Vertical space (when we can't use .PP) ++.if t .sp .5v ++.if n .sp ++.. ++.de Vb \" Begin verbatim text ++.ft CW ++.nf ++.ne \\$1 ++.. ++.de Ve \" End verbatim text ++.ft R ++.fi ++.. ++.\" Set up some character translations and predefined strings. \*(-- will ++.\" give an unbreakable dash, \*(PI will give pi, \*(L" will give a left ++.\" double quote, and \*(R" will give a right double quote. \*(C+ will ++.\" give a nicer C++. Capital omega is used to do unbreakable dashes and ++.\" therefore won't be available. \*(C` and \*(C' expand to `' in nroff, ++.\" nothing in troff, for use with C<>. ++.tr \(*W- ++.ds C+ C\v'-.1v'\h'-1p'\s-2+\h'-1p'+\s0\v'.1v'\h'-1p' ++.ie n \{\ ++. ds -- \(*W- ++. ds PI pi ++. if (\n(.H=4u)&(1m=24u) .ds -- \(*W\h'-12u'\(*W\h'-12u'-\" diablo 10 pitch ++. if (\n(.H=4u)&(1m=20u) .ds -- \(*W\h'-12u'\(*W\h'-8u'-\" diablo 12 pitch ++. ds L" "" ++. ds R" "" ++. ds C` "" ++. ds C' "" ++'br\} ++.el\{\ ++. ds -- \|\(em\| ++. ds PI \(*p ++. ds L" `` ++. ds R" '' ++'br\} ++.\" ++.\" Escape single quotes in literal strings from groff's Unicode transform. ++.ie \n(.g .ds Aq \(aq ++.el .ds Aq ' ++.\" ++.\" If the F register is turned on, we'll generate index entries on stderr for ++.\" titles (.TH), headers (.SH), subsections (.SS), items (.Ip), and index ++.\" entries marked with X<> in POD. Of course, you'll have to process the ++.\" output yourself in some meaningful fashion. ++.ie \nF \{\ ++. de IX ++. tm Index:\\$1\t\\n%\t"\\$2" ++.. ++. nr % 0 ++. rr F ++.\} ++.el \{\ ++. de IX ++.. ++.\} ++.\" ++.\" Accent mark definitions (@(#)ms.acc 1.5 88/02/08 SMI; from UCB 4.2). ++.\" Fear. Run. Save yourself. No user-serviceable parts. ++. \" fudge factors for nroff and troff ++.if n \{\ ++. ds #H 0 ++. ds #V .8m ++. ds #F .3m ++. ds #[ \f1 ++. ds #] \fP ++.\} ++.if t \{\ ++. ds #H ((1u-(\\\\n(.fu%2u))*.13m) ++. ds #V .6m ++. ds #F 0 ++. ds #[ \& ++. ds #] \& ++.\} ++. \" simple accents for nroff and troff ++.if n \{\ ++. ds ' \& ++. ds ` \& ++. ds ^ \& ++. ds , \& ++. ds ~ ~ ++. ds / ++.\} ++.if t \{\ ++. ds ' \\k:\h'-(\\n(.wu*8/10-\*(#H)'\'\h"|\\n:u" ++. ds ` \\k:\h'-(\\n(.wu*8/10-\*(#H)'\`\h'|\\n:u' ++. ds ^ \\k:\h'-(\\n(.wu*10/11-\*(#H)'^\h'|\\n:u' ++. ds , \\k:\h'-(\\n(.wu*8/10)',\h'|\\n:u' ++. ds ~ \\k:\h'-(\\n(.wu-\*(#H-.1m)'~\h'|\\n:u' ++. ds / \\k:\h'-(\\n(.wu*8/10-\*(#H)'\z\(sl\h'|\\n:u' ++.\} ++. \" troff and (daisy-wheel) nroff accents ++.ds : \\k:\h'-(\\n(.wu*8/10-\*(#H+.1m+\*(#F)'\v'-\*(#V'\z.\h'.2m+\*(#F'.\h'|\\n:u'\v'\*(#V' ++.ds 8 \h'\*(#H'\(*b\h'-\*(#H' ++.ds o \\k:\h'-(\\n(.wu+\w'\(de'u-\*(#H)/2u'\v'-.3n'\*(#[\z\(de\v'.3n'\h'|\\n:u'\*(#] ++.ds d- \h'\*(#H'\(pd\h'-\w'~'u'\v'-.25m'\f2\(hy\fP\v'.25m'\h'-\*(#H' ++.ds D- D\\k:\h'-\w'D'u'\v'-.11m'\z\(hy\v'.11m'\h'|\\n:u' ++.ds th \*(#[\v'.3m'\s+1I\s-1\v'-.3m'\h'-(\w'I'u*2/3)'\s-1o\s+1\*(#] ++.ds Th \*(#[\s+2I\s-2\h'-\w'I'u*3/5'\v'-.3m'o\v'.3m'\*(#] ++.ds ae a\h'-(\w'a'u*4/10)'e ++.ds Ae A\h'-(\w'A'u*4/10)'E ++. \" corrections for vroff ++.if v .ds ~ \\k:\h'-(\\n(.wu*9/10-\*(#H)'\s-2\u~\d\s+2\h'|\\n:u' ++.if v .ds ^ \\k:\h'-(\\n(.wu*10/11-\*(#H)'\v'-.4m'^\v'.4m'\h'|\\n:u' ++. \" for low resolution devices (crt and lpr) ++.if \n(.H>23 .if \n(.V>19 \ ++\{\ ++. ds : e ++. ds 8 ss ++. ds o a ++. ds d- d\h'-1'\(ga ++. ds D- D\h'-1'\(hy ++. ds th \o'bp' ++. ds Th \o'LP' ++. ds ae ae ++. ds Ae AE ++.\} ++.rm #[ #] #H #V #F C ++.\" ======================================================================== ++.\" ++.IX Title "CMS_add1_signer 3" ++.TH CMS_add1_signer 3 "2014-10-15" "1.0.1j" "OpenSSL" ++.\" For nroff, turn off justification. Always turn off hyphenation; it makes ++.\" way too many mistakes in technical documents. ++.if n .ad l ++.nh ++.SH "NAME" ++.Vb 1 ++\& CMS_add1_signer, CMS_SignerInfo_sign \- add a signer to a CMS_ContentInfo signed data structure. ++.Ve ++.SH "SYNOPSIS" ++.IX Header "SYNOPSIS" ++.Vb 1 ++\& #include ++\& ++\& CMS_SignerInfo *CMS_add1_signer(CMS_ContentInfo *cms, X509 *signcert, EVP_PKEY *pkey, const EVP_MD *md, unsigned int flags); ++\& ++\& int CMS_SignerInfo_sign(CMS_SignerInfo *si); ++.Ve ++.SH "DESCRIPTION" ++.IX Header "DESCRIPTION" ++\&\fICMS_add1_signer()\fR adds a signer with certificate \fBsigncert\fR and private ++key \fBpkey\fR using message digest \fBmd\fR to CMS_ContentInfo SignedData ++structure \fBcms\fR. ++.PP ++The CMS_ContentInfo structure should be obtained from an initial call to ++\&\fICMS_sign()\fR with the flag \fB\s-1CMS_PARTIAL\s0\fR set or in the case or re-signing a ++valid CMS_ContentInfo SignedData structure. ++.PP ++If the \fBmd\fR parameter is \fB\s-1NULL\s0\fR then the default digest for the public ++key algorithm will be used. ++.PP ++Unless the \fB\s-1CMS_REUSE_DIGEST\s0\fR flag is set the returned CMS_ContentInfo ++structure is not complete and must be finalized either by streaming (if ++applicable) or a call to \fICMS_final()\fR. ++.PP ++The \fICMS_SignerInfo_sign()\fR function will explicitly sign a CMS_SignerInfo ++structure, its main use is when \fB\s-1CMS_REUSE_DIGEST\s0\fR and \fB\s-1CMS_PARTIAL\s0\fR flags ++are both set. ++.SH "NOTES" ++.IX Header "NOTES" ++The main purpose of \fICMS_add1_signer()\fR is to provide finer control ++over a \s-1CMS\s0 signed data structure where the simpler \fICMS_sign()\fR function defaults ++are not appropriate. For example if multiple signers or non default digest ++algorithms are needed. New attributes can also be added using the returned ++CMS_SignerInfo structure and the \s-1CMS\s0 attribute utility functions or the ++\&\s-1CMS\s0 signed receipt request functions. ++.PP ++Any of the following flags (ored together) can be passed in the \fBflags\fR ++parameter. ++.PP ++If \fB\s-1CMS_REUSE_DIGEST\s0\fR is set then an attempt is made to copy the content ++digest value from the CMS_ContentInfo structure: to add a signer to an existing ++structure. An error occurs if a matching digest value cannot be found to copy. ++The returned CMS_ContentInfo structure will be valid and finalized when this ++flag is set. ++.PP ++If \fB\s-1CMS_PARTIAL\s0\fR is set in addition to \fB\s-1CMS_REUSE_DIGEST\s0\fR then the ++CMS_SignerInfo structure will not be finalized so additional attributes ++can be added. In this case an explicit call to \fICMS_SignerInfo_sign()\fR is ++needed to finalize it. ++.PP ++If \fB\s-1CMS_NOCERTS\s0\fR is set the signer's certificate will not be included in the ++CMS_ContentInfo structure, the signer's certificate must still be supplied in ++the \fBsigncert\fR parameter though. This can reduce the size of the signature if ++the signers certificate can be obtained by other means: for example a ++previously signed message. ++.PP ++The SignedData structure includes several \s-1CMS\s0 signedAttributes including the ++signing time, the \s-1CMS\s0 content type and the supported list of ciphers in an ++SMIMECapabilities attribute. If \fB\s-1CMS_NOATTR\s0\fR is set then no signedAttributes ++will be used. If \fB\s-1CMS_NOSMIMECAP\s0\fR is set then just the SMIMECapabilities are ++omitted. ++.PP ++OpenSSL will by default identify signing certificates using issuer name ++and serial number. If \fB\s-1CMS_USE_KEYID\s0\fR is set it will use the subject key ++identifier value instead. An error occurs if the signing certificate does not ++have a subject key identifier extension. ++.PP ++If present the SMIMECapabilities attribute indicates support for the following ++algorithms in preference order: 256 bit \s-1AES\s0, Gost R3411\-94, Gost 28147\-89, 192 ++bit \s-1AES\s0, 128 bit \s-1AES\s0, triple \s-1DES\s0, 128 bit \s-1RC2\s0, 64 bit \s-1RC2\s0, \s-1DES\s0 and 40 bit \s-1RC2\s0. ++If any of these algorithms is not available then it will not be included: for example the \s-1GOST\s0 algorithms will not be included if the \s-1GOST\s0 \s-1ENGINE\s0 is ++not loaded. ++.PP ++\&\fICMS_add1_signer()\fR returns an internal pointer to the CMS_SignerInfo ++structure just added, this can be used to set additional attributes ++before it is finalized. ++.SH "RETURN VALUES" ++.IX Header "RETURN VALUES" ++\&\fICMS_add1_signer()\fR returns an internal pointer to the CMS_SignerInfo ++structure just added or \s-1NULL\s0 if an error occurs. ++.SH "SEE ALSO" ++.IX Header "SEE ALSO" ++\&\fIERR_get_error\fR\|(3), \fICMS_sign\fR\|(3), ++\&\fICMS_final\fR\|(3), ++.SH "HISTORY" ++.IX Header "HISTORY" ++\&\fICMS_add1_signer()\fR was added to OpenSSL 0.9.8 + +Property changes on: secure/lib/libcrypto/man/CMS_add1_signer.3 +___________________________________________________________________ +Added: svn:eol-style +## -0,0 +1 ## ++native +\ No newline at end of property +Added: svn:mime-type +## -0,0 +1 ## ++text/plain +\ No newline at end of property +Added: svn:keywords +## -0,0 +1 ## ++FreeBSD=%H +\ No newline at end of property +Index: secure/lib/libcrypto/man/CMS_compress.3 +=================================================================== +--- secure/lib/libcrypto/man/CMS_compress.3 (revision 273303) ++++ secure/lib/libcrypto/man/CMS_compress.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "CMS_compress 3" +-.TH CMS_compress 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH CMS_compress 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/CMS_decrypt.3 +=================================================================== +--- secure/lib/libcrypto/man/CMS_decrypt.3 (revision 273303) ++++ secure/lib/libcrypto/man/CMS_decrypt.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "CMS_decrypt 3" +-.TH CMS_decrypt 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH CMS_decrypt 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/CMS_encrypt.3 +=================================================================== +--- secure/lib/libcrypto/man/CMS_encrypt.3 (revision 273303) ++++ secure/lib/libcrypto/man/CMS_encrypt.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "CMS_encrypt 3" +-.TH CMS_encrypt 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH CMS_encrypt 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/CMS_final.3 +=================================================================== +--- secure/lib/libcrypto/man/CMS_final.3 (revision 273303) ++++ secure/lib/libcrypto/man/CMS_final.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "CMS_final 3" +-.TH CMS_final 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH CMS_final 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/CMS_get0_RecipientInfos.3 +=================================================================== +--- secure/lib/libcrypto/man/CMS_get0_RecipientInfos.3 (revision 273303) ++++ secure/lib/libcrypto/man/CMS_get0_RecipientInfos.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "CMS_get0_RecipientInfos 3" +-.TH CMS_get0_RecipientInfos 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH CMS_get0_RecipientInfos 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/CMS_get0_SignerInfos.3 +=================================================================== +--- secure/lib/libcrypto/man/CMS_get0_SignerInfos.3 (revision 273303) ++++ secure/lib/libcrypto/man/CMS_get0_SignerInfos.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "CMS_get0_SignerInfos 3" +-.TH CMS_get0_SignerInfos 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH CMS_get0_SignerInfos 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/CMS_get0_type.3 +=================================================================== +--- secure/lib/libcrypto/man/CMS_get0_type.3 (revision 273303) ++++ secure/lib/libcrypto/man/CMS_get0_type.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "CMS_get0_type 3" +-.TH CMS_get0_type 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH CMS_get0_type 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/CMS_get1_ReceiptRequest.3 +=================================================================== +--- secure/lib/libcrypto/man/CMS_get1_ReceiptRequest.3 (revision 273303) ++++ secure/lib/libcrypto/man/CMS_get1_ReceiptRequest.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "CMS_get1_ReceiptRequest 3" +-.TH CMS_get1_ReceiptRequest 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH CMS_get1_ReceiptRequest 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/CMS_sign.3 +=================================================================== +--- secure/lib/libcrypto/man/CMS_sign.3 (revision 273303) ++++ secure/lib/libcrypto/man/CMS_sign.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "CMS_sign 3" +-.TH CMS_sign 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH CMS_sign 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/CMS_sign_add1_signer.3 +=================================================================== +--- secure/lib/libcrypto/man/CMS_sign_add1_signer.3 (revision 273303) ++++ secure/lib/libcrypto/man/CMS_sign_add1_signer.3 (working copy) +@@ -1,224 +0,0 @@ +-.\" Automatically generated by Pod::Man 2.25 (Pod::Simple 3.28) +-.\" +-.\" Standard preamble: +-.\" ======================================================================== +-.de Sp \" Vertical space (when we can't use .PP) +-.if t .sp .5v +-.if n .sp +-.. +-.de Vb \" Begin verbatim text +-.ft CW +-.nf +-.ne \\$1 +-.. +-.de Ve \" End verbatim text +-.ft R +-.fi +-.. +-.\" Set up some character translations and predefined strings. \*(-- will +-.\" give an unbreakable dash, \*(PI will give pi, \*(L" will give a left +-.\" double quote, and \*(R" will give a right double quote. \*(C+ will +-.\" give a nicer C++. Capital omega is used to do unbreakable dashes and +-.\" therefore won't be available. \*(C` and \*(C' expand to `' in nroff, +-.\" nothing in troff, for use with C<>. +-.tr \(*W- +-.ds C+ C\v'-.1v'\h'-1p'\s-2+\h'-1p'+\s0\v'.1v'\h'-1p' +-.ie n \{\ +-. ds -- \(*W- +-. ds PI pi +-. if (\n(.H=4u)&(1m=24u) .ds -- \(*W\h'-12u'\(*W\h'-12u'-\" diablo 10 pitch +-. if (\n(.H=4u)&(1m=20u) .ds -- \(*W\h'-12u'\(*W\h'-8u'-\" diablo 12 pitch +-. ds L" "" +-. ds R" "" +-. ds C` "" +-. ds C' "" +-'br\} +-.el\{\ +-. ds -- \|\(em\| +-. ds PI \(*p +-. ds L" `` +-. ds R" '' +-'br\} +-.\" +-.\" Escape single quotes in literal strings from groff's Unicode transform. +-.ie \n(.g .ds Aq \(aq +-.el .ds Aq ' +-.\" +-.\" If the F register is turned on, we'll generate index entries on stderr for +-.\" titles (.TH), headers (.SH), subsections (.SS), items (.Ip), and index +-.\" entries marked with X<> in POD. Of course, you'll have to process the +-.\" output yourself in some meaningful fashion. +-.ie \nF \{\ +-. de IX +-. tm Index:\\$1\t\\n%\t"\\$2" +-.. +-. nr % 0 +-. rr F +-.\} +-.el \{\ +-. de IX +-.. +-.\} +-.\" +-.\" Accent mark definitions (@(#)ms.acc 1.5 88/02/08 SMI; from UCB 4.2). +-.\" Fear. Run. Save yourself. No user-serviceable parts. +-. \" fudge factors for nroff and troff +-.if n \{\ +-. ds #H 0 +-. ds #V .8m +-. ds #F .3m +-. ds #[ \f1 +-. ds #] \fP +-.\} +-.if t \{\ +-. ds #H ((1u-(\\\\n(.fu%2u))*.13m) +-. ds #V .6m +-. ds #F 0 +-. ds #[ \& +-. ds #] \& +-.\} +-. \" simple accents for nroff and troff +-.if n \{\ +-. ds ' \& +-. ds ` \& +-. ds ^ \& +-. ds , \& +-. ds ~ ~ +-. ds / +-.\} +-.if t \{\ +-. ds ' \\k:\h'-(\\n(.wu*8/10-\*(#H)'\'\h"|\\n:u" +-. ds ` \\k:\h'-(\\n(.wu*8/10-\*(#H)'\`\h'|\\n:u' +-. ds ^ \\k:\h'-(\\n(.wu*10/11-\*(#H)'^\h'|\\n:u' +-. ds , \\k:\h'-(\\n(.wu*8/10)',\h'|\\n:u' +-. ds ~ \\k:\h'-(\\n(.wu-\*(#H-.1m)'~\h'|\\n:u' +-. ds / \\k:\h'-(\\n(.wu*8/10-\*(#H)'\z\(sl\h'|\\n:u' +-.\} +-. \" troff and (daisy-wheel) nroff accents +-.ds : \\k:\h'-(\\n(.wu*8/10-\*(#H+.1m+\*(#F)'\v'-\*(#V'\z.\h'.2m+\*(#F'.\h'|\\n:u'\v'\*(#V' +-.ds 8 \h'\*(#H'\(*b\h'-\*(#H' +-.ds o \\k:\h'-(\\n(.wu+\w'\(de'u-\*(#H)/2u'\v'-.3n'\*(#[\z\(de\v'.3n'\h'|\\n:u'\*(#] +-.ds d- \h'\*(#H'\(pd\h'-\w'~'u'\v'-.25m'\f2\(hy\fP\v'.25m'\h'-\*(#H' +-.ds D- D\\k:\h'-\w'D'u'\v'-.11m'\z\(hy\v'.11m'\h'|\\n:u' +-.ds th \*(#[\v'.3m'\s+1I\s-1\v'-.3m'\h'-(\w'I'u*2/3)'\s-1o\s+1\*(#] +-.ds Th \*(#[\s+2I\s-2\h'-\w'I'u*3/5'\v'-.3m'o\v'.3m'\*(#] +-.ds ae a\h'-(\w'a'u*4/10)'e +-.ds Ae A\h'-(\w'A'u*4/10)'E +-. \" corrections for vroff +-.if v .ds ~ \\k:\h'-(\\n(.wu*9/10-\*(#H)'\s-2\u~\d\s+2\h'|\\n:u' +-.if v .ds ^ \\k:\h'-(\\n(.wu*10/11-\*(#H)'\v'-.4m'^\v'.4m'\h'|\\n:u' +-. \" for low resolution devices (crt and lpr) +-.if \n(.H>23 .if \n(.V>19 \ +-\{\ +-. ds : e +-. ds 8 ss +-. ds o a +-. ds d- d\h'-1'\(ga +-. ds D- D\h'-1'\(hy +-. ds th \o'bp' +-. ds Th \o'LP' +-. ds ae ae +-. ds Ae AE +-.\} +-.rm #[ #] #H #V #F C +-.\" ======================================================================== +-.\" +-.IX Title "CMS_sign_add1_signer 3" +-.TH CMS_sign_add1_signer 3 "2014-08-06" "1.0.1i" "OpenSSL" +-.\" For nroff, turn off justification. Always turn off hyphenation; it makes +-.\" way too many mistakes in technical documents. +-.if n .ad l +-.nh +-.SH "NAME" +-.Vb 1 +-\& CMS_sign_add1_signer, CMS_SignerInfo_sign \- add a signer to a CMS_ContentInfo signed data structure. +-.Ve +-.SH "SYNOPSIS" +-.IX Header "SYNOPSIS" +-.Vb 1 +-\& #include +-\& +-\& CMS_SignerInfo *CMS_sign_add1_signer(CMS_ContentInfo *cms, X509 *signcert, EVP_PKEY *pkey, const EVP_MD *md, unsigned int flags); +-\& +-\& int CMS_SignerInfo_sign(CMS_SignerInfo *si); +-.Ve +-.SH "DESCRIPTION" +-.IX Header "DESCRIPTION" +-\&\fICMS_sign_add1_signer()\fR adds a signer with certificate \fBsigncert\fR and private +-key \fBpkey\fR using message digest \fBmd\fR to CMS_ContentInfo SignedData +-structure \fBcms\fR. +-.PP +-The CMS_ContentInfo structure should be obtained from an initial call to +-\&\fICMS_sign()\fR with the flag \fB\s-1CMS_PARTIAL\s0\fR set or in the case or re-signing a +-valid CMS_ContentInfo SignedData structure. +-.PP +-If the \fBmd\fR parameter is \fB\s-1NULL\s0\fR then the default digest for the public +-key algorithm will be used. +-.PP +-Unless the \fB\s-1CMS_REUSE_DIGEST\s0\fR flag is set the returned CMS_ContentInfo +-structure is not complete and must be finalized either by streaming (if +-applicable) or a call to \fICMS_final()\fR. +-.PP +-The \fICMS_SignerInfo_sign()\fR function will explicitly sign a CMS_SignerInfo +-structure, its main use is when \fB\s-1CMS_REUSE_DIGEST\s0\fR and \fB\s-1CMS_PARTIAL\s0\fR flags +-are both set. +-.SH "NOTES" +-.IX Header "NOTES" +-The main purpose of \fICMS_sign_add1_signer()\fR is to provide finer control +-over a \s-1CMS\s0 signed data structure where the simpler \fICMS_sign()\fR function defaults +-are not appropriate. For example if multiple signers or non default digest +-algorithms are needed. New attributes can also be added using the returned +-CMS_SignerInfo structure and the \s-1CMS\s0 attribute utility functions or the +-\&\s-1CMS\s0 signed receipt request functions. +-.PP +-Any of the following flags (ored together) can be passed in the \fBflags\fR +-parameter. +-.PP +-If \fB\s-1CMS_REUSE_DIGEST\s0\fR is set then an attempt is made to copy the content +-digest value from the CMS_ContentInfo structure: to add a signer to an existing +-structure. An error occurs if a matching digest value cannot be found to copy. +-The returned CMS_ContentInfo structure will be valid and finalized when this +-flag is set. +-.PP +-If \fB\s-1CMS_PARTIAL\s0\fR is set in addition to \fB\s-1CMS_REUSE_DIGEST\s0\fR then the +-CMS_SignerInfo structure will not be finalized so additional attributes +-can be added. In this case an explicit call to \fICMS_SignerInfo_sign()\fR is +-needed to finalize it. +-.PP +-If \fB\s-1CMS_NOCERTS\s0\fR is set the signer's certificate will not be included in the +-CMS_ContentInfo structure, the signer's certificate must still be supplied in +-the \fBsigncert\fR parameter though. This can reduce the size of the signature if +-the signers certificate can be obtained by other means: for example a +-previously signed message. +-.PP +-The SignedData structure includes several \s-1CMS\s0 signedAttributes including the +-signing time, the \s-1CMS\s0 content type and the supported list of ciphers in an +-SMIMECapabilities attribute. If \fB\s-1CMS_NOATTR\s0\fR is set then no signedAttributes +-will be used. If \fB\s-1CMS_NOSMIMECAP\s0\fR is set then just the SMIMECapabilities are +-omitted. +-.PP +-OpenSSL will by default identify signing certificates using issuer name +-and serial number. If \fB\s-1CMS_USE_KEYID\s0\fR is set it will use the subject key +-identifier value instead. An error occurs if the signing certificate does not +-have a subject key identifier extension. +-.PP +-If present the SMIMECapabilities attribute indicates support for the following +-algorithms in preference order: 256 bit \s-1AES\s0, Gost R3411\-94, Gost 28147\-89, 192 +-bit \s-1AES\s0, 128 bit \s-1AES\s0, triple \s-1DES\s0, 128 bit \s-1RC2\s0, 64 bit \s-1RC2\s0, \s-1DES\s0 and 40 bit \s-1RC2\s0. +-If any of these algorithms is not available then it will not be included: for example the \s-1GOST\s0 algorithms will not be included if the \s-1GOST\s0 \s-1ENGINE\s0 is +-not loaded. +-.PP +-\&\fICMS_sign_add1_signer()\fR returns an internal pointer to the CMS_SignerInfo +-structure just added, this can be used to set additional attributes +-before it is finalized. +-.SH "RETURN VALUES" +-.IX Header "RETURN VALUES" +-\&\fICMS_sign1_add_signers()\fR returns an internal pointer to the CMS_SignerInfo +-structure just added or \s-1NULL\s0 if an error occurs. +-.SH "SEE ALSO" +-.IX Header "SEE ALSO" +-\&\fIERR_get_error\fR\|(3), \fICMS_sign\fR\|(3), +-\&\fICMS_final\fR\|(3), +-.SH "HISTORY" +-.IX Header "HISTORY" +-\&\fICMS_sign_add1_signer()\fR was added to OpenSSL 0.9.8 +Index: secure/lib/libcrypto/man/CMS_sign_receipt.3 +=================================================================== +--- secure/lib/libcrypto/man/CMS_sign_receipt.3 (revision 273303) ++++ secure/lib/libcrypto/man/CMS_sign_receipt.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "CMS_sign_receipt 3" +-.TH CMS_sign_receipt 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH CMS_sign_receipt 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/CMS_uncompress.3 +=================================================================== +--- secure/lib/libcrypto/man/CMS_uncompress.3 (revision 273303) ++++ secure/lib/libcrypto/man/CMS_uncompress.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "CMS_uncompress 3" +-.TH CMS_uncompress 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH CMS_uncompress 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/CMS_verify.3 +=================================================================== +--- secure/lib/libcrypto/man/CMS_verify.3 (revision 273303) ++++ secure/lib/libcrypto/man/CMS_verify.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "CMS_verify 3" +-.TH CMS_verify 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH CMS_verify 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/CMS_verify_receipt.3 +=================================================================== +--- secure/lib/libcrypto/man/CMS_verify_receipt.3 (revision 273303) ++++ secure/lib/libcrypto/man/CMS_verify_receipt.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "CMS_verify_receipt 3" +-.TH CMS_verify_receipt 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH CMS_verify_receipt 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/CONF_modules_free.3 +=================================================================== +--- secure/lib/libcrypto/man/CONF_modules_free.3 (revision 273303) ++++ secure/lib/libcrypto/man/CONF_modules_free.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "CONF_modules_free 3" +-.TH CONF_modules_free 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH CONF_modules_free 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/CONF_modules_load_file.3 +=================================================================== +--- secure/lib/libcrypto/man/CONF_modules_load_file.3 (revision 273303) ++++ secure/lib/libcrypto/man/CONF_modules_load_file.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "CONF_modules_load_file 3" +-.TH CONF_modules_load_file 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH CONF_modules_load_file 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/CRYPTO_set_ex_data.3 +=================================================================== +--- secure/lib/libcrypto/man/CRYPTO_set_ex_data.3 (revision 273303) ++++ secure/lib/libcrypto/man/CRYPTO_set_ex_data.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "CRYPTO_set_ex_data 3" +-.TH CRYPTO_set_ex_data 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH CRYPTO_set_ex_data 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/DH_generate_key.3 +=================================================================== +--- secure/lib/libcrypto/man/DH_generate_key.3 (revision 273303) ++++ secure/lib/libcrypto/man/DH_generate_key.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "DH_generate_key 3" +-.TH DH_generate_key 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH DH_generate_key 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/DH_generate_parameters.3 +=================================================================== +--- secure/lib/libcrypto/man/DH_generate_parameters.3 (revision 273303) ++++ secure/lib/libcrypto/man/DH_generate_parameters.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "DH_generate_parameters 3" +-.TH DH_generate_parameters 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH DH_generate_parameters 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/DH_get_ex_new_index.3 +=================================================================== +--- secure/lib/libcrypto/man/DH_get_ex_new_index.3 (revision 273303) ++++ secure/lib/libcrypto/man/DH_get_ex_new_index.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "DH_get_ex_new_index 3" +-.TH DH_get_ex_new_index 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH DH_get_ex_new_index 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/DH_new.3 +=================================================================== +--- secure/lib/libcrypto/man/DH_new.3 (revision 273303) ++++ secure/lib/libcrypto/man/DH_new.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "DH_new 3" +-.TH DH_new 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH DH_new 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/DH_set_method.3 +=================================================================== +--- secure/lib/libcrypto/man/DH_set_method.3 (revision 273303) ++++ secure/lib/libcrypto/man/DH_set_method.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "DH_set_method 3" +-.TH DH_set_method 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH DH_set_method 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/DH_size.3 +=================================================================== +--- secure/lib/libcrypto/man/DH_size.3 (revision 273303) ++++ secure/lib/libcrypto/man/DH_size.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "DH_size 3" +-.TH DH_size 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH DH_size 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/DSA_SIG_new.3 +=================================================================== +--- secure/lib/libcrypto/man/DSA_SIG_new.3 (revision 273303) ++++ secure/lib/libcrypto/man/DSA_SIG_new.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "DSA_SIG_new 3" +-.TH DSA_SIG_new 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH DSA_SIG_new 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/DSA_do_sign.3 +=================================================================== +--- secure/lib/libcrypto/man/DSA_do_sign.3 (revision 273303) ++++ secure/lib/libcrypto/man/DSA_do_sign.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "DSA_do_sign 3" +-.TH DSA_do_sign 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH DSA_do_sign 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/DSA_dup_DH.3 +=================================================================== +--- secure/lib/libcrypto/man/DSA_dup_DH.3 (revision 273303) ++++ secure/lib/libcrypto/man/DSA_dup_DH.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "DSA_dup_DH 3" +-.TH DSA_dup_DH 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH DSA_dup_DH 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/DSA_generate_key.3 +=================================================================== +--- secure/lib/libcrypto/man/DSA_generate_key.3 (revision 273303) ++++ secure/lib/libcrypto/man/DSA_generate_key.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "DSA_generate_key 3" +-.TH DSA_generate_key 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH DSA_generate_key 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/DSA_generate_parameters.3 +=================================================================== +--- secure/lib/libcrypto/man/DSA_generate_parameters.3 (revision 273303) ++++ secure/lib/libcrypto/man/DSA_generate_parameters.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "DSA_generate_parameters 3" +-.TH DSA_generate_parameters 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH DSA_generate_parameters 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/DSA_get_ex_new_index.3 +=================================================================== +--- secure/lib/libcrypto/man/DSA_get_ex_new_index.3 (revision 273303) ++++ secure/lib/libcrypto/man/DSA_get_ex_new_index.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "DSA_get_ex_new_index 3" +-.TH DSA_get_ex_new_index 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH DSA_get_ex_new_index 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/DSA_new.3 +=================================================================== +--- secure/lib/libcrypto/man/DSA_new.3 (revision 273303) ++++ secure/lib/libcrypto/man/DSA_new.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "DSA_new 3" +-.TH DSA_new 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH DSA_new 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/DSA_set_method.3 +=================================================================== +--- secure/lib/libcrypto/man/DSA_set_method.3 (revision 273303) ++++ secure/lib/libcrypto/man/DSA_set_method.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "DSA_set_method 3" +-.TH DSA_set_method 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH DSA_set_method 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/DSA_sign.3 +=================================================================== +--- secure/lib/libcrypto/man/DSA_sign.3 (revision 273303) ++++ secure/lib/libcrypto/man/DSA_sign.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "DSA_sign 3" +-.TH DSA_sign 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH DSA_sign 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/DSA_size.3 +=================================================================== +--- secure/lib/libcrypto/man/DSA_size.3 (revision 273303) ++++ secure/lib/libcrypto/man/DSA_size.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "DSA_size 3" +-.TH DSA_size 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH DSA_size 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/ERR_GET_LIB.3 +=================================================================== +--- secure/lib/libcrypto/man/ERR_GET_LIB.3 (revision 273303) ++++ secure/lib/libcrypto/man/ERR_GET_LIB.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "ERR_GET_LIB 3" +-.TH ERR_GET_LIB 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH ERR_GET_LIB 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/ERR_clear_error.3 +=================================================================== +--- secure/lib/libcrypto/man/ERR_clear_error.3 (revision 273303) ++++ secure/lib/libcrypto/man/ERR_clear_error.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "ERR_clear_error 3" +-.TH ERR_clear_error 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH ERR_clear_error 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/ERR_error_string.3 +=================================================================== +--- secure/lib/libcrypto/man/ERR_error_string.3 (revision 273303) ++++ secure/lib/libcrypto/man/ERR_error_string.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "ERR_error_string 3" +-.TH ERR_error_string 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH ERR_error_string 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/ERR_get_error.3 +=================================================================== +--- secure/lib/libcrypto/man/ERR_get_error.3 (revision 273303) ++++ secure/lib/libcrypto/man/ERR_get_error.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "ERR_get_error 3" +-.TH ERR_get_error 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH ERR_get_error 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/ERR_load_crypto_strings.3 +=================================================================== +--- secure/lib/libcrypto/man/ERR_load_crypto_strings.3 (revision 273303) ++++ secure/lib/libcrypto/man/ERR_load_crypto_strings.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "ERR_load_crypto_strings 3" +-.TH ERR_load_crypto_strings 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH ERR_load_crypto_strings 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/ERR_load_strings.3 +=================================================================== +--- secure/lib/libcrypto/man/ERR_load_strings.3 (revision 273303) ++++ secure/lib/libcrypto/man/ERR_load_strings.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "ERR_load_strings 3" +-.TH ERR_load_strings 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH ERR_load_strings 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/ERR_print_errors.3 +=================================================================== +--- secure/lib/libcrypto/man/ERR_print_errors.3 (revision 273303) ++++ secure/lib/libcrypto/man/ERR_print_errors.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "ERR_print_errors 3" +-.TH ERR_print_errors 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH ERR_print_errors 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/ERR_put_error.3 +=================================================================== +--- secure/lib/libcrypto/man/ERR_put_error.3 (revision 273303) ++++ secure/lib/libcrypto/man/ERR_put_error.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "ERR_put_error 3" +-.TH ERR_put_error 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH ERR_put_error 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/ERR_remove_state.3 +=================================================================== +--- secure/lib/libcrypto/man/ERR_remove_state.3 (revision 273303) ++++ secure/lib/libcrypto/man/ERR_remove_state.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "ERR_remove_state 3" +-.TH ERR_remove_state 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH ERR_remove_state 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/ERR_set_mark.3 +=================================================================== +--- secure/lib/libcrypto/man/ERR_set_mark.3 (revision 273303) ++++ secure/lib/libcrypto/man/ERR_set_mark.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "ERR_set_mark 3" +-.TH ERR_set_mark 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH ERR_set_mark 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/EVP_BytesToKey.3 +=================================================================== +--- secure/lib/libcrypto/man/EVP_BytesToKey.3 (revision 273303) ++++ secure/lib/libcrypto/man/EVP_BytesToKey.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "EVP_BytesToKey 3" +-.TH EVP_BytesToKey 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH EVP_BytesToKey 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/EVP_DigestInit.3 +=================================================================== +--- secure/lib/libcrypto/man/EVP_DigestInit.3 (revision 273303) ++++ secure/lib/libcrypto/man/EVP_DigestInit.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "EVP_DigestInit 3" +-.TH EVP_DigestInit 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH EVP_DigestInit 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +@@ -154,13 +154,13 @@ EVP digest routines + \& int EVP_MD_CTX_cleanup(EVP_MD_CTX *ctx); + \& void EVP_MD_CTX_destroy(EVP_MD_CTX *ctx); + \& +-\& int EVP_MD_CTX_copy_ex(EVP_MD_CTX *out,const EVP_MD_CTX *in); ++\& int EVP_MD_CTX_copy_ex(EVP_MD_CTX *out,const EVP_MD_CTX *in); + \& + \& int EVP_DigestInit(EVP_MD_CTX *ctx, const EVP_MD *type); + \& int EVP_DigestFinal(EVP_MD_CTX *ctx, unsigned char *md, + \& unsigned int *s); + \& +-\& int EVP_MD_CTX_copy(EVP_MD_CTX *out,EVP_MD_CTX *in); ++\& int EVP_MD_CTX_copy(EVP_MD_CTX *out,EVP_MD_CTX *in); + \& + \& #define EVP_MAX_MD_SIZE 64 /* SHA512 */ + \& +@@ -267,7 +267,7 @@ structures for the \s-1MD2\s0, \s-1MD5\s0, \s-1SHA + and \s-1RIPEMD160\s0 digest algorithms respectively. + .PP + \&\fIEVP_dss()\fR and \fIEVP_dss1()\fR return \fB\s-1EVP_MD\s0\fR structures for \s-1SHA\s0 and \s-1SHA1\s0 digest +-algorithms but using \s-1DSS\s0 (\s-1DSA\s0) for the signature algorithm. Note: there is ++algorithms but using \s-1DSS\s0 (\s-1DSA\s0) for the signature algorithm. Note: there is + no need to use these pseudo-digests in OpenSSL 1.0.0 and later, they are + however retained for compatibility. + .PP +@@ -303,15 +303,15 @@ The \fB\s-1EVP\s0\fR interface to message digests + preference to the low level interfaces. This is because the code then becomes + transparent to the digest used and much more flexible. + .PP +-New applications should use the \s-1SHA2\s0 digest algorithms such as \s-1SHA256\s0. ++New applications should use the \s-1SHA2\s0 digest algorithms such as \s-1SHA256\s0. + The other digest algorithms are still in common use. + .PP + For most applications the \fBimpl\fR parameter to \fIEVP_DigestInit_ex()\fR will be + set to \s-1NULL\s0 to use the default digest implementation. + .PP +-The functions \fIEVP_DigestInit()\fR, \fIEVP_DigestFinal()\fR and \fIEVP_MD_CTX_copy()\fR are ++The functions \fIEVP_DigestInit()\fR, \fIEVP_DigestFinal()\fR and \fIEVP_MD_CTX_copy()\fR are + obsolete but are retained to maintain compatibility with existing code. New +-applications should use \fIEVP_DigestInit_ex()\fR, \fIEVP_DigestFinal_ex()\fR and ++applications should use \fIEVP_DigestInit_ex()\fR, \fIEVP_DigestFinal_ex()\fR and + \&\fIEVP_MD_CTX_copy_ex()\fR because they can efficiently reuse a digest context + instead of initializing and cleaning it up on each call and allow non default + implementations of digests to be specified. +@@ -374,15 +374,19 @@ digest name passed on the command line. + \& EVP_MD_CTX_destroy(mdctx); + \& + \& printf("Digest is: "); +-\& for(i = 0; i < md_len; i++) printf("%02x", md_value[i]); ++\& for(i = 0; i < md_len; i++) ++\& printf("%02x", md_value[i]); + \& printf("\en"); ++\& ++\& /* Call this once before exit. */ ++\& EVP_cleanup(); ++\& exit(0); + \& } + .Ve + .SH "SEE ALSO" + .IX Header "SEE ALSO" +-\&\fIevp\fR\|(3), \fIhmac\fR\|(3), \fImd2\fR\|(3), +-\&\fImd5\fR\|(3), \fImdc2\fR\|(3), \fIripemd\fR\|(3), +-\&\fIsha\fR\|(3), \fIdgst\fR\|(1) ++\&\fIdgst\fR\|(1), ++\&\fIevp\fR\|(3) + .SH "HISTORY" + .IX Header "HISTORY" + \&\fIEVP_DigestInit()\fR, \fIEVP_DigestUpdate()\fR and \fIEVP_DigestFinal()\fR are +@@ -397,7 +401,7 @@ and \fIEVP_DigestFinal_ex()\fR were added in OpenS + changed to return truely const \s-1EVP_MD\s0 * in OpenSSL 0.9.7. + .PP + The link between digests and signing algorithms was fixed in OpenSSL 1.0 and +-later, so now \fIEVP_sha1()\fR can be used with \s-1RSA\s0 and \s-1DSA\s0, there is no need to ++later, so now \fIEVP_sha1()\fR can be used with \s-1RSA\s0 and \s-1DSA\s0; there is no need to + use \fIEVP_dss1()\fR any more. + .PP + OpenSSL 1.0 and later does not include the \s-1MD2\s0 digest algorithm in the +Index: secure/lib/libcrypto/man/EVP_DigestSignInit.3 +=================================================================== +--- secure/lib/libcrypto/man/EVP_DigestSignInit.3 (revision 273303) ++++ secure/lib/libcrypto/man/EVP_DigestSignInit.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "EVP_DigestSignInit 3" +-.TH EVP_DigestSignInit 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH EVP_DigestSignInit 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/EVP_DigestVerifyInit.3 +=================================================================== +--- secure/lib/libcrypto/man/EVP_DigestVerifyInit.3 (revision 273303) ++++ secure/lib/libcrypto/man/EVP_DigestVerifyInit.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "EVP_DigestVerifyInit 3" +-.TH EVP_DigestVerifyInit 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH EVP_DigestVerifyInit 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +@@ -165,7 +165,7 @@ or a negative value for failure. In particular a r + the operation is not supported by the public key algorithm. + .PP + Unlike other functions the return value 0 from \fIEVP_DigestVerifyFinal()\fR only +-indicates that the signature did not not verify successfully (that is tbs did ++indicates that the signature did not verify successfully (that is tbs did + not match the original data or the signature was of invalid form) it is not an + indication of a more serious error. + .PP +@@ -185,7 +185,7 @@ For some key types and parameters the random numbe + or the operation will fail. + .PP + The call to \fIEVP_DigestVerifyFinal()\fR internally finalizes a copy of the digest +-context. This means that calls to \fIEVP_VerifyUpdate()\fR and \fIEVP_VerifyFinal()\fR can ++context. This means that \fIEVP_VerifyUpdate()\fR and \fIEVP_VerifyFinal()\fR can + be called later to digest and verify additional data. + .PP + Since only a copy of the digest context is ever finalized the context must +Index: secure/lib/libcrypto/man/EVP_EncryptInit.3 +=================================================================== +--- secure/lib/libcrypto/man/EVP_EncryptInit.3 (revision 273303) ++++ secure/lib/libcrypto/man/EVP_EncryptInit.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "EVP_EncryptInit 3" +-.TH EVP_EncryptInit 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH EVP_EncryptInit 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +@@ -493,37 +493,9 @@ The \s-1ASN1\s0 code is incomplete (and sometimes + for certain common S/MIME ciphers (\s-1RC2\s0, \s-1DES\s0, triple \s-1DES\s0) in \s-1CBC\s0 mode. + .SH "EXAMPLES" + .IX Header "EXAMPLES" +-Get the number of rounds used in \s-1RC5:\s0 ++Encrypt a string using \s-1IDEA:\s0 + .PP +-.Vb 2 +-\& int nrounds; +-\& EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_GET_RC5_ROUNDS, 0, &nrounds); +-.Ve +-.PP +-Get the \s-1RC2\s0 effective key length: +-.PP +-.Vb 2 +-\& int key_bits; +-\& EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_GET_RC2_KEY_BITS, 0, &key_bits); +-.Ve +-.PP +-Set the number of rounds used in \s-1RC5:\s0 +-.PP +-.Vb 2 +-\& int nrounds; +-\& EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_SET_RC5_ROUNDS, nrounds, NULL); +-.Ve +-.PP +-Set the effective key length used in \s-1RC2:\s0 +-.PP +-.Vb 2 +-\& int key_bits; +-\& EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_SET_RC2_KEY_BITS, key_bits, NULL); +-.Ve +-.PP +-Encrypt a string using blowfish: +-.PP +-.Vb 10 ++.Vb 12 + \& int do_crypt(char *outfile) + \& { + \& unsigned char outbuf[1024]; +@@ -536,8 +508,9 @@ for certain common S/MIME ciphers (\s-1RC2\s0, \s- + \& char intext[] = "Some Crypto Text"; + \& EVP_CIPHER_CTX ctx; + \& FILE *out; ++\& + \& EVP_CIPHER_CTX_init(&ctx); +-\& EVP_EncryptInit_ex(&ctx, EVP_bf_cbc(), NULL, key, iv); ++\& EVP_EncryptInit_ex(&ctx, EVP_idea_cbc(), NULL, key, iv); + \& + \& if(!EVP_EncryptUpdate(&ctx, outbuf, &outlen, intext, strlen(intext))) + \& { +@@ -567,31 +540,37 @@ for certain common S/MIME ciphers (\s-1RC2\s0, \s- + .Ve + .PP + The ciphertext from the above example can be decrypted using the \fBopenssl\fR +-utility with the command line: ++utility with the command line (shown on two lines for clarity): + .PP +-.Vb 1 +-\& S ++.Vb 2 ++\& openssl idea \-d + \& + \& EVP_PKEY_CTX *ctx; ++\& /* md is a SHA\-256 digest in this example. */ + \& unsigned char *md, *sig; +-\& size_t mdlen, siglen; ++\& size_t mdlen = 32, siglen; + \& EVP_PKEY *signing_key; +-\& /* NB: assumes signing_key, md and mdlen are already set up +-\& * and that signing_key is an RSA private key ++\& ++\& /* ++\& * NB: assumes signing_key and md are set up before the next ++\& * step. signing_key must be an RSA private key and md must ++\& * point to the SHA\-256 digest to be signed. + \& */ +-\& ctx = EVP_PKEY_CTX_new(signing_key); ++\& ctx = EVP_PKEY_CTX_new(signing_key, NULL /* no engine */); + \& if (!ctx) + \& /* Error occurred */ + \& if (EVP_PKEY_sign_init(ctx) <= 0) +@@ -208,6 +217,7 @@ Sign data using \s-1RSA\s0 with PKCS#1 padding and + .SH "SEE ALSO" + .IX Header "SEE ALSO" + \&\fIEVP_PKEY_CTX_new\fR\|(3), ++\&\fIEVP_PKEY_CTX_ctrl\fR\|(3), + \&\fIEVP_PKEY_encrypt\fR\|(3), + \&\fIEVP_PKEY_decrypt\fR\|(3), + \&\fIEVP_PKEY_verify\fR\|(3), +Index: secure/lib/libcrypto/man/EVP_PKEY_verify.3 +=================================================================== +--- secure/lib/libcrypto/man/EVP_PKEY_verify.3 (revision 273303) ++++ secure/lib/libcrypto/man/EVP_PKEY_verify.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "EVP_PKEY_verify 3" +-.TH EVP_PKEY_verify 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH EVP_PKEY_verify 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/EVP_PKEY_verify_recover.3 +=================================================================== +--- secure/lib/libcrypto/man/EVP_PKEY_verify_recover.3 (revision 273303) ++++ secure/lib/libcrypto/man/EVP_PKEY_verify_recover.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "EVP_PKEY_verify_recover 3" +-.TH EVP_PKEY_verify_recover 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH EVP_PKEY_verify_recover 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/EVP_SealInit.3 +=================================================================== +--- secure/lib/libcrypto/man/EVP_SealInit.3 (revision 273303) ++++ secure/lib/libcrypto/man/EVP_SealInit.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "EVP_SealInit 3" +-.TH EVP_SealInit 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH EVP_SealInit 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/EVP_SignInit.3 +=================================================================== +--- secure/lib/libcrypto/man/EVP_SignInit.3 (revision 273303) ++++ secure/lib/libcrypto/man/EVP_SignInit.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "EVP_SignInit 3" +-.TH EVP_SignInit 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH EVP_SignInit 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/EVP_VerifyInit.3 +=================================================================== +--- secure/lib/libcrypto/man/EVP_VerifyInit.3 (revision 273303) ++++ secure/lib/libcrypto/man/EVP_VerifyInit.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "EVP_VerifyInit 3" +-.TH EVP_VerifyInit 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH EVP_VerifyInit 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/OBJ_nid2obj.3 +=================================================================== +--- secure/lib/libcrypto/man/OBJ_nid2obj.3 (revision 273303) ++++ secure/lib/libcrypto/man/OBJ_nid2obj.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "OBJ_nid2obj 3" +-.TH OBJ_nid2obj 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH OBJ_nid2obj 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/OPENSSL_Applink.3 +=================================================================== +--- secure/lib/libcrypto/man/OPENSSL_Applink.3 (revision 273303) ++++ secure/lib/libcrypto/man/OPENSSL_Applink.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "OPENSSL_Applink 3" +-.TH OPENSSL_Applink 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH OPENSSL_Applink 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/OPENSSL_VERSION_NUMBER.3 +=================================================================== +--- secure/lib/libcrypto/man/OPENSSL_VERSION_NUMBER.3 (revision 273303) ++++ secure/lib/libcrypto/man/OPENSSL_VERSION_NUMBER.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "OPENSSL_VERSION_NUMBER 3" +-.TH OPENSSL_VERSION_NUMBER 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH OPENSSL_VERSION_NUMBER 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/OPENSSL_config.3 +=================================================================== +--- secure/lib/libcrypto/man/OPENSSL_config.3 (revision 273303) ++++ secure/lib/libcrypto/man/OPENSSL_config.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "OPENSSL_config 3" +-.TH OPENSSL_config 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH OPENSSL_config 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/OPENSSL_ia32cap.3 +=================================================================== +--- secure/lib/libcrypto/man/OPENSSL_ia32cap.3 (revision 273303) ++++ secure/lib/libcrypto/man/OPENSSL_ia32cap.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "OPENSSL_ia32cap 3" +-.TH OPENSSL_ia32cap 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH OPENSSL_ia32cap 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/OPENSSL_load_builtin_modules.3 +=================================================================== +--- secure/lib/libcrypto/man/OPENSSL_load_builtin_modules.3 (revision 273303) ++++ secure/lib/libcrypto/man/OPENSSL_load_builtin_modules.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "OPENSSL_load_builtin_modules 3" +-.TH OPENSSL_load_builtin_modules 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH OPENSSL_load_builtin_modules 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/OpenSSL_add_all_algorithms.3 +=================================================================== +--- secure/lib/libcrypto/man/OpenSSL_add_all_algorithms.3 (revision 273303) ++++ secure/lib/libcrypto/man/OpenSSL_add_all_algorithms.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "OpenSSL_add_all_algorithms 3" +-.TH OpenSSL_add_all_algorithms 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH OpenSSL_add_all_algorithms 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/PEM_write_bio_CMS_stream.3 +=================================================================== +--- secure/lib/libcrypto/man/PEM_write_bio_CMS_stream.3 (revision 273303) ++++ secure/lib/libcrypto/man/PEM_write_bio_CMS_stream.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "PEM_write_bio_CMS_stream 3" +-.TH PEM_write_bio_CMS_stream 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH PEM_write_bio_CMS_stream 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/PEM_write_bio_PKCS7_stream.3 +=================================================================== +--- secure/lib/libcrypto/man/PEM_write_bio_PKCS7_stream.3 (revision 273303) ++++ secure/lib/libcrypto/man/PEM_write_bio_PKCS7_stream.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "PEM_write_bio_PKCS7_stream 3" +-.TH PEM_write_bio_PKCS7_stream 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH PEM_write_bio_PKCS7_stream 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/PKCS12_create.3 +=================================================================== +--- secure/lib/libcrypto/man/PKCS12_create.3 (revision 273303) ++++ secure/lib/libcrypto/man/PKCS12_create.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "PKCS12_create 3" +-.TH PKCS12_create 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH PKCS12_create 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/PKCS12_parse.3 +=================================================================== +--- secure/lib/libcrypto/man/PKCS12_parse.3 (revision 273303) ++++ secure/lib/libcrypto/man/PKCS12_parse.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "PKCS12_parse 3" +-.TH PKCS12_parse 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH PKCS12_parse 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/PKCS7_decrypt.3 +=================================================================== +--- secure/lib/libcrypto/man/PKCS7_decrypt.3 (revision 273303) ++++ secure/lib/libcrypto/man/PKCS7_decrypt.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "PKCS7_decrypt 3" +-.TH PKCS7_decrypt 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH PKCS7_decrypt 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/PKCS7_encrypt.3 +=================================================================== +--- secure/lib/libcrypto/man/PKCS7_encrypt.3 (revision 273303) ++++ secure/lib/libcrypto/man/PKCS7_encrypt.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "PKCS7_encrypt 3" +-.TH PKCS7_encrypt 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH PKCS7_encrypt 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/PKCS7_sign.3 +=================================================================== +--- secure/lib/libcrypto/man/PKCS7_sign.3 (revision 273303) ++++ secure/lib/libcrypto/man/PKCS7_sign.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "PKCS7_sign 3" +-.TH PKCS7_sign 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH PKCS7_sign 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/PKCS7_sign_add_signer.3 +=================================================================== +--- secure/lib/libcrypto/man/PKCS7_sign_add_signer.3 (revision 273303) ++++ secure/lib/libcrypto/man/PKCS7_sign_add_signer.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "PKCS7_sign_add_signer 3" +-.TH PKCS7_sign_add_signer 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH PKCS7_sign_add_signer 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/PKCS7_verify.3 +=================================================================== +--- secure/lib/libcrypto/man/PKCS7_verify.3 (revision 273303) ++++ secure/lib/libcrypto/man/PKCS7_verify.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "PKCS7_verify 3" +-.TH PKCS7_verify 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH PKCS7_verify 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/RAND_add.3 +=================================================================== +--- secure/lib/libcrypto/man/RAND_add.3 (revision 273303) ++++ secure/lib/libcrypto/man/RAND_add.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "RAND_add 3" +-.TH RAND_add 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH RAND_add 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/RAND_bytes.3 +=================================================================== +--- secure/lib/libcrypto/man/RAND_bytes.3 (revision 273303) ++++ secure/lib/libcrypto/man/RAND_bytes.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "RAND_bytes 3" +-.TH RAND_bytes 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH RAND_bytes 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/RAND_cleanup.3 +=================================================================== +--- secure/lib/libcrypto/man/RAND_cleanup.3 (revision 273303) ++++ secure/lib/libcrypto/man/RAND_cleanup.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "RAND_cleanup 3" +-.TH RAND_cleanup 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH RAND_cleanup 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/RAND_egd.3 +=================================================================== +--- secure/lib/libcrypto/man/RAND_egd.3 (revision 273303) ++++ secure/lib/libcrypto/man/RAND_egd.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "RAND_egd 3" +-.TH RAND_egd 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH RAND_egd 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/RAND_load_file.3 +=================================================================== +--- secure/lib/libcrypto/man/RAND_load_file.3 (revision 273303) ++++ secure/lib/libcrypto/man/RAND_load_file.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "RAND_load_file 3" +-.TH RAND_load_file 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH RAND_load_file 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/RAND_set_rand_method.3 +=================================================================== +--- secure/lib/libcrypto/man/RAND_set_rand_method.3 (revision 273303) ++++ secure/lib/libcrypto/man/RAND_set_rand_method.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "RAND_set_rand_method 3" +-.TH RAND_set_rand_method 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH RAND_set_rand_method 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/RSA_blinding_on.3 +=================================================================== +--- secure/lib/libcrypto/man/RSA_blinding_on.3 (revision 273303) ++++ secure/lib/libcrypto/man/RSA_blinding_on.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "RSA_blinding_on 3" +-.TH RSA_blinding_on 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH RSA_blinding_on 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/RSA_check_key.3 +=================================================================== +--- secure/lib/libcrypto/man/RSA_check_key.3 (revision 273303) ++++ secure/lib/libcrypto/man/RSA_check_key.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "RSA_check_key 3" +-.TH RSA_check_key 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH RSA_check_key 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/RSA_generate_key.3 +=================================================================== +--- secure/lib/libcrypto/man/RSA_generate_key.3 (revision 273303) ++++ secure/lib/libcrypto/man/RSA_generate_key.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "RSA_generate_key 3" +-.TH RSA_generate_key 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH RSA_generate_key 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/RSA_get_ex_new_index.3 +=================================================================== +--- secure/lib/libcrypto/man/RSA_get_ex_new_index.3 (revision 273303) ++++ secure/lib/libcrypto/man/RSA_get_ex_new_index.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "RSA_get_ex_new_index 3" +-.TH RSA_get_ex_new_index 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH RSA_get_ex_new_index 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/RSA_new.3 +=================================================================== +--- secure/lib/libcrypto/man/RSA_new.3 (revision 273303) ++++ secure/lib/libcrypto/man/RSA_new.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "RSA_new 3" +-.TH RSA_new 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH RSA_new 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/RSA_padding_add_PKCS1_type_1.3 +=================================================================== +--- secure/lib/libcrypto/man/RSA_padding_add_PKCS1_type_1.3 (revision 273303) ++++ secure/lib/libcrypto/man/RSA_padding_add_PKCS1_type_1.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "RSA_padding_add_PKCS1_type_1 3" +-.TH RSA_padding_add_PKCS1_type_1 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH RSA_padding_add_PKCS1_type_1 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/RSA_print.3 +=================================================================== +--- secure/lib/libcrypto/man/RSA_print.3 (revision 273303) ++++ secure/lib/libcrypto/man/RSA_print.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "RSA_print 3" +-.TH RSA_print 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH RSA_print 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/RSA_private_encrypt.3 +=================================================================== +--- secure/lib/libcrypto/man/RSA_private_encrypt.3 (revision 273303) ++++ secure/lib/libcrypto/man/RSA_private_encrypt.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "RSA_private_encrypt 3" +-.TH RSA_private_encrypt 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH RSA_private_encrypt 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/RSA_public_encrypt.3 +=================================================================== +--- secure/lib/libcrypto/man/RSA_public_encrypt.3 (revision 273303) ++++ secure/lib/libcrypto/man/RSA_public_encrypt.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "RSA_public_encrypt 3" +-.TH RSA_public_encrypt 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH RSA_public_encrypt 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/RSA_set_method.3 +=================================================================== +--- secure/lib/libcrypto/man/RSA_set_method.3 (revision 273303) ++++ secure/lib/libcrypto/man/RSA_set_method.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "RSA_set_method 3" +-.TH RSA_set_method 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH RSA_set_method 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/RSA_sign.3 +=================================================================== +--- secure/lib/libcrypto/man/RSA_sign.3 (revision 273303) ++++ secure/lib/libcrypto/man/RSA_sign.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "RSA_sign 3" +-.TH RSA_sign 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH RSA_sign 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/RSA_sign_ASN1_OCTET_STRING.3 +=================================================================== +--- secure/lib/libcrypto/man/RSA_sign_ASN1_OCTET_STRING.3 (revision 273303) ++++ secure/lib/libcrypto/man/RSA_sign_ASN1_OCTET_STRING.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "RSA_sign_ASN1_OCTET_STRING 3" +-.TH RSA_sign_ASN1_OCTET_STRING 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH RSA_sign_ASN1_OCTET_STRING 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/RSA_size.3 +=================================================================== +--- secure/lib/libcrypto/man/RSA_size.3 (revision 273303) ++++ secure/lib/libcrypto/man/RSA_size.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "RSA_size 3" +-.TH RSA_size 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH RSA_size 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/SMIME_read_CMS.3 +=================================================================== +--- secure/lib/libcrypto/man/SMIME_read_CMS.3 (revision 273303) ++++ secure/lib/libcrypto/man/SMIME_read_CMS.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "SMIME_read_CMS 3" +-.TH SMIME_read_CMS 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH SMIME_read_CMS 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/SMIME_read_PKCS7.3 +=================================================================== +--- secure/lib/libcrypto/man/SMIME_read_PKCS7.3 (revision 273303) ++++ secure/lib/libcrypto/man/SMIME_read_PKCS7.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "SMIME_read_PKCS7 3" +-.TH SMIME_read_PKCS7 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH SMIME_read_PKCS7 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/SMIME_write_CMS.3 +=================================================================== +--- secure/lib/libcrypto/man/SMIME_write_CMS.3 (revision 273303) ++++ secure/lib/libcrypto/man/SMIME_write_CMS.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "SMIME_write_CMS 3" +-.TH SMIME_write_CMS 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH SMIME_write_CMS 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/SMIME_write_PKCS7.3 +=================================================================== +--- secure/lib/libcrypto/man/SMIME_write_PKCS7.3 (revision 273303) ++++ secure/lib/libcrypto/man/SMIME_write_PKCS7.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "SMIME_write_PKCS7 3" +-.TH SMIME_write_PKCS7 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH SMIME_write_PKCS7 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/X509_NAME_ENTRY_get_object.3 +=================================================================== +--- secure/lib/libcrypto/man/X509_NAME_ENTRY_get_object.3 (revision 273303) ++++ secure/lib/libcrypto/man/X509_NAME_ENTRY_get_object.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "X509_NAME_ENTRY_get_object 3" +-.TH X509_NAME_ENTRY_get_object 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH X509_NAME_ENTRY_get_object 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/X509_NAME_add_entry_by_txt.3 +=================================================================== +--- secure/lib/libcrypto/man/X509_NAME_add_entry_by_txt.3 (revision 273303) ++++ secure/lib/libcrypto/man/X509_NAME_add_entry_by_txt.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "X509_NAME_add_entry_by_txt 3" +-.TH X509_NAME_add_entry_by_txt 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH X509_NAME_add_entry_by_txt 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/X509_NAME_get_index_by_NID.3 +=================================================================== +--- secure/lib/libcrypto/man/X509_NAME_get_index_by_NID.3 (revision 273303) ++++ secure/lib/libcrypto/man/X509_NAME_get_index_by_NID.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "X509_NAME_get_index_by_NID 3" +-.TH X509_NAME_get_index_by_NID 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH X509_NAME_get_index_by_NID 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/X509_NAME_print_ex.3 +=================================================================== +--- secure/lib/libcrypto/man/X509_NAME_print_ex.3 (revision 273303) ++++ secure/lib/libcrypto/man/X509_NAME_print_ex.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "X509_NAME_print_ex 3" +-.TH X509_NAME_print_ex 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH X509_NAME_print_ex 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/X509_STORE_CTX_get_error.3 +=================================================================== +--- secure/lib/libcrypto/man/X509_STORE_CTX_get_error.3 (revision 273303) ++++ secure/lib/libcrypto/man/X509_STORE_CTX_get_error.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "X509_STORE_CTX_get_error 3" +-.TH X509_STORE_CTX_get_error 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH X509_STORE_CTX_get_error 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/X509_STORE_CTX_get_ex_new_index.3 +=================================================================== +--- secure/lib/libcrypto/man/X509_STORE_CTX_get_ex_new_index.3 (revision 273303) ++++ secure/lib/libcrypto/man/X509_STORE_CTX_get_ex_new_index.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "X509_STORE_CTX_get_ex_new_index 3" +-.TH X509_STORE_CTX_get_ex_new_index 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH X509_STORE_CTX_get_ex_new_index 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/X509_STORE_CTX_new.3 +=================================================================== +--- secure/lib/libcrypto/man/X509_STORE_CTX_new.3 (revision 273303) ++++ secure/lib/libcrypto/man/X509_STORE_CTX_new.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "X509_STORE_CTX_new 3" +-.TH X509_STORE_CTX_new 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH X509_STORE_CTX_new 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/X509_STORE_CTX_set_verify_cb.3 +=================================================================== +--- secure/lib/libcrypto/man/X509_STORE_CTX_set_verify_cb.3 (revision 273303) ++++ secure/lib/libcrypto/man/X509_STORE_CTX_set_verify_cb.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "X509_STORE_CTX_set_verify_cb 3" +-.TH X509_STORE_CTX_set_verify_cb 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH X509_STORE_CTX_set_verify_cb 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/X509_STORE_set_verify_cb_func.3 +=================================================================== +--- secure/lib/libcrypto/man/X509_STORE_set_verify_cb_func.3 (revision 273303) ++++ secure/lib/libcrypto/man/X509_STORE_set_verify_cb_func.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "X509_STORE_set_verify_cb_func 3" +-.TH X509_STORE_set_verify_cb_func 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH X509_STORE_set_verify_cb_func 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/X509_VERIFY_PARAM_set_flags.3 +=================================================================== +--- secure/lib/libcrypto/man/X509_VERIFY_PARAM_set_flags.3 (revision 273303) ++++ secure/lib/libcrypto/man/X509_VERIFY_PARAM_set_flags.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "X509_VERIFY_PARAM_set_flags 3" +-.TH X509_VERIFY_PARAM_set_flags 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH X509_VERIFY_PARAM_set_flags 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/X509_new.3 +=================================================================== +--- secure/lib/libcrypto/man/X509_new.3 (revision 273303) ++++ secure/lib/libcrypto/man/X509_new.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "X509_new 3" +-.TH X509_new 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH X509_new 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/X509_verify_cert.3 +=================================================================== +--- secure/lib/libcrypto/man/X509_verify_cert.3 (revision 273303) ++++ secure/lib/libcrypto/man/X509_verify_cert.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "X509_verify_cert 3" +-.TH X509_verify_cert 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH X509_verify_cert 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/bio.3 +=================================================================== +--- secure/lib/libcrypto/man/bio.3 (revision 273303) ++++ secure/lib/libcrypto/man/bio.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "bio 3" +-.TH bio 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH bio 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/blowfish.3 +=================================================================== +--- secure/lib/libcrypto/man/blowfish.3 (revision 273303) ++++ secure/lib/libcrypto/man/blowfish.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "blowfish 3" +-.TH blowfish 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH blowfish 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/bn.3 +=================================================================== +--- secure/lib/libcrypto/man/bn.3 (revision 273303) ++++ secure/lib/libcrypto/man/bn.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "bn 3" +-.TH bn 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH bn 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/bn_internal.3 +=================================================================== +--- secure/lib/libcrypto/man/bn_internal.3 (revision 273303) ++++ secure/lib/libcrypto/man/bn_internal.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "bn_internal 3" +-.TH bn_internal 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH bn_internal 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/buffer.3 +=================================================================== +--- secure/lib/libcrypto/man/buffer.3 (revision 273303) ++++ secure/lib/libcrypto/man/buffer.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "buffer 3" +-.TH buffer 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH buffer 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/crypto.3 +=================================================================== +--- secure/lib/libcrypto/man/crypto.3 (revision 273303) ++++ secure/lib/libcrypto/man/crypto.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "crypto 3" +-.TH crypto 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH crypto 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/d2i_ASN1_OBJECT.3 +=================================================================== +--- secure/lib/libcrypto/man/d2i_ASN1_OBJECT.3 (revision 273303) ++++ secure/lib/libcrypto/man/d2i_ASN1_OBJECT.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "d2i_ASN1_OBJECT 3" +-.TH d2i_ASN1_OBJECT 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH d2i_ASN1_OBJECT 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/d2i_DHparams.3 +=================================================================== +--- secure/lib/libcrypto/man/d2i_DHparams.3 (revision 273303) ++++ secure/lib/libcrypto/man/d2i_DHparams.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "d2i_DHparams 3" +-.TH d2i_DHparams 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH d2i_DHparams 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/d2i_DSAPublicKey.3 +=================================================================== +--- secure/lib/libcrypto/man/d2i_DSAPublicKey.3 (revision 273303) ++++ secure/lib/libcrypto/man/d2i_DSAPublicKey.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "d2i_DSAPublicKey 3" +-.TH d2i_DSAPublicKey 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH d2i_DSAPublicKey 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/d2i_PKCS8PrivateKey.3 +=================================================================== +--- secure/lib/libcrypto/man/d2i_PKCS8PrivateKey.3 (revision 273303) ++++ secure/lib/libcrypto/man/d2i_PKCS8PrivateKey.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "d2i_PKCS8PrivateKey 3" +-.TH d2i_PKCS8PrivateKey 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH d2i_PKCS8PrivateKey 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/d2i_RSAPublicKey.3 +=================================================================== +--- secure/lib/libcrypto/man/d2i_RSAPublicKey.3 (revision 273303) ++++ secure/lib/libcrypto/man/d2i_RSAPublicKey.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "d2i_RSAPublicKey 3" +-.TH d2i_RSAPublicKey 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH d2i_RSAPublicKey 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/d2i_X509.3 +=================================================================== +--- secure/lib/libcrypto/man/d2i_X509.3 (revision 273303) ++++ secure/lib/libcrypto/man/d2i_X509.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "d2i_X509 3" +-.TH d2i_X509 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH d2i_X509 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/d2i_X509_ALGOR.3 +=================================================================== +--- secure/lib/libcrypto/man/d2i_X509_ALGOR.3 (revision 273303) ++++ secure/lib/libcrypto/man/d2i_X509_ALGOR.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "d2i_X509_ALGOR 3" +-.TH d2i_X509_ALGOR 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH d2i_X509_ALGOR 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/d2i_X509_CRL.3 +=================================================================== +--- secure/lib/libcrypto/man/d2i_X509_CRL.3 (revision 273303) ++++ secure/lib/libcrypto/man/d2i_X509_CRL.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "d2i_X509_CRL 3" +-.TH d2i_X509_CRL 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH d2i_X509_CRL 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/d2i_X509_NAME.3 +=================================================================== +--- secure/lib/libcrypto/man/d2i_X509_NAME.3 (revision 273303) ++++ secure/lib/libcrypto/man/d2i_X509_NAME.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "d2i_X509_NAME 3" +-.TH d2i_X509_NAME 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH d2i_X509_NAME 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/d2i_X509_REQ.3 +=================================================================== +--- secure/lib/libcrypto/man/d2i_X509_REQ.3 (revision 273303) ++++ secure/lib/libcrypto/man/d2i_X509_REQ.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "d2i_X509_REQ 3" +-.TH d2i_X509_REQ 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH d2i_X509_REQ 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/d2i_X509_SIG.3 +=================================================================== +--- secure/lib/libcrypto/man/d2i_X509_SIG.3 (revision 273303) ++++ secure/lib/libcrypto/man/d2i_X509_SIG.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "d2i_X509_SIG 3" +-.TH d2i_X509_SIG 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH d2i_X509_SIG 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/des.3 +=================================================================== +--- secure/lib/libcrypto/man/des.3 (revision 273303) ++++ secure/lib/libcrypto/man/des.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "des 3" +-.TH des 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH des 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/dh.3 +=================================================================== +--- secure/lib/libcrypto/man/dh.3 (revision 273303) ++++ secure/lib/libcrypto/man/dh.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "dh 3" +-.TH dh 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH dh 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/dsa.3 +=================================================================== +--- secure/lib/libcrypto/man/dsa.3 (revision 273303) ++++ secure/lib/libcrypto/man/dsa.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "dsa 3" +-.TH dsa 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH dsa 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/ecdsa.3 +=================================================================== +--- secure/lib/libcrypto/man/ecdsa.3 (revision 273303) ++++ secure/lib/libcrypto/man/ecdsa.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "ecdsa 3" +-.TH ecdsa 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH ecdsa 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/engine.3 +=================================================================== +--- secure/lib/libcrypto/man/engine.3 (revision 273303) ++++ secure/lib/libcrypto/man/engine.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "engine 3" +-.TH engine 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH engine 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/err.3 +=================================================================== +--- secure/lib/libcrypto/man/err.3 (revision 273303) ++++ secure/lib/libcrypto/man/err.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "err 3" +-.TH err 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH err 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/evp.3 +=================================================================== +--- secure/lib/libcrypto/man/evp.3 (revision 273303) ++++ secure/lib/libcrypto/man/evp.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "evp 3" +-.TH evp 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH evp 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/hmac.3 +=================================================================== +--- secure/lib/libcrypto/man/hmac.3 (revision 273303) ++++ secure/lib/libcrypto/man/hmac.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "hmac 3" +-.TH hmac 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH hmac 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/i2d_CMS_bio_stream.3 +=================================================================== +--- secure/lib/libcrypto/man/i2d_CMS_bio_stream.3 (revision 273303) ++++ secure/lib/libcrypto/man/i2d_CMS_bio_stream.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "i2d_CMS_bio_stream 3" +-.TH i2d_CMS_bio_stream 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH i2d_CMS_bio_stream 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/i2d_PKCS7_bio_stream.3 +=================================================================== +--- secure/lib/libcrypto/man/i2d_PKCS7_bio_stream.3 (revision 273303) ++++ secure/lib/libcrypto/man/i2d_PKCS7_bio_stream.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "i2d_PKCS7_bio_stream 3" +-.TH i2d_PKCS7_bio_stream 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH i2d_PKCS7_bio_stream 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/lh_stats.3 +=================================================================== +--- secure/lib/libcrypto/man/lh_stats.3 (revision 273303) ++++ secure/lib/libcrypto/man/lh_stats.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "lh_stats 3" +-.TH lh_stats 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH lh_stats 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/lhash.3 +=================================================================== +--- secure/lib/libcrypto/man/lhash.3 (revision 273303) ++++ secure/lib/libcrypto/man/lhash.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "lhash 3" +-.TH lhash 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH lhash 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/md5.3 +=================================================================== +--- secure/lib/libcrypto/man/md5.3 (revision 273303) ++++ secure/lib/libcrypto/man/md5.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "md5 3" +-.TH md5 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH md5 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/mdc2.3 +=================================================================== +--- secure/lib/libcrypto/man/mdc2.3 (revision 273303) ++++ secure/lib/libcrypto/man/mdc2.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "mdc2 3" +-.TH mdc2 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH mdc2 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/pem.3 +=================================================================== +--- secure/lib/libcrypto/man/pem.3 (revision 273303) ++++ secure/lib/libcrypto/man/pem.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "pem 3" +-.TH pem 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH pem 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/rand.3 +=================================================================== +--- secure/lib/libcrypto/man/rand.3 (revision 273303) ++++ secure/lib/libcrypto/man/rand.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "rand 3" +-.TH rand 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH rand 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/rc4.3 +=================================================================== +--- secure/lib/libcrypto/man/rc4.3 (revision 273303) ++++ secure/lib/libcrypto/man/rc4.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "rc4 3" +-.TH rc4 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH rc4 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/ripemd.3 +=================================================================== +--- secure/lib/libcrypto/man/ripemd.3 (revision 273303) ++++ secure/lib/libcrypto/man/ripemd.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "ripemd 3" +-.TH ripemd 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH ripemd 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/rsa.3 +=================================================================== +--- secure/lib/libcrypto/man/rsa.3 (revision 273303) ++++ secure/lib/libcrypto/man/rsa.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "rsa 3" +-.TH rsa 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH rsa 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/sha.3 +=================================================================== +--- secure/lib/libcrypto/man/sha.3 (revision 273303) ++++ secure/lib/libcrypto/man/sha.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "sha 3" +-.TH sha 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH sha 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/threads.3 +=================================================================== +--- secure/lib/libcrypto/man/threads.3 (revision 273303) ++++ secure/lib/libcrypto/man/threads.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "threads 3" +-.TH threads 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH threads 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/ui.3 +=================================================================== +--- secure/lib/libcrypto/man/ui.3 (revision 273303) ++++ secure/lib/libcrypto/man/ui.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "ui 3" +-.TH ui 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH ui 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/ui_compat.3 +=================================================================== +--- secure/lib/libcrypto/man/ui_compat.3 (revision 273303) ++++ secure/lib/libcrypto/man/ui_compat.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "ui_compat 3" +-.TH ui_compat 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH ui_compat 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/x509.3 +=================================================================== +--- secure/lib/libcrypto/man/x509.3 (revision 273303) ++++ secure/lib/libcrypto/man/x509.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "x509 3" +-.TH x509 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH x509 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libssl/man/SSL_CIPHER_get_name.3 +=================================================================== +--- secure/lib/libssl/man/SSL_CIPHER_get_name.3 (revision 273303) ++++ secure/lib/libssl/man/SSL_CIPHER_get_name.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "SSL_CIPHER_get_name 3" +-.TH SSL_CIPHER_get_name 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH SSL_CIPHER_get_name 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libssl/man/SSL_COMP_add_compression_method.3 +=================================================================== +--- secure/lib/libssl/man/SSL_COMP_add_compression_method.3 (revision 273303) ++++ secure/lib/libssl/man/SSL_COMP_add_compression_method.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "SSL_COMP_add_compression_method 3" +-.TH SSL_COMP_add_compression_method 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH SSL_COMP_add_compression_method 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libssl/man/SSL_CTX_add_extra_chain_cert.3 +=================================================================== +--- secure/lib/libssl/man/SSL_CTX_add_extra_chain_cert.3 (revision 273303) ++++ secure/lib/libssl/man/SSL_CTX_add_extra_chain_cert.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "SSL_CTX_add_extra_chain_cert 3" +-.TH SSL_CTX_add_extra_chain_cert 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH SSL_CTX_add_extra_chain_cert 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libssl/man/SSL_CTX_add_session.3 +=================================================================== +--- secure/lib/libssl/man/SSL_CTX_add_session.3 (revision 273303) ++++ secure/lib/libssl/man/SSL_CTX_add_session.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "SSL_CTX_add_session 3" +-.TH SSL_CTX_add_session 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH SSL_CTX_add_session 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libssl/man/SSL_CTX_ctrl.3 +=================================================================== +--- secure/lib/libssl/man/SSL_CTX_ctrl.3 (revision 273303) ++++ secure/lib/libssl/man/SSL_CTX_ctrl.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "SSL_CTX_ctrl 3" +-.TH SSL_CTX_ctrl 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH SSL_CTX_ctrl 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libssl/man/SSL_CTX_flush_sessions.3 +=================================================================== +--- secure/lib/libssl/man/SSL_CTX_flush_sessions.3 (revision 273303) ++++ secure/lib/libssl/man/SSL_CTX_flush_sessions.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "SSL_CTX_flush_sessions 3" +-.TH SSL_CTX_flush_sessions 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH SSL_CTX_flush_sessions 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libssl/man/SSL_CTX_free.3 +=================================================================== +--- secure/lib/libssl/man/SSL_CTX_free.3 (revision 273303) ++++ secure/lib/libssl/man/SSL_CTX_free.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "SSL_CTX_free 3" +-.TH SSL_CTX_free 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH SSL_CTX_free 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libssl/man/SSL_CTX_get_ex_new_index.3 +=================================================================== +--- secure/lib/libssl/man/SSL_CTX_get_ex_new_index.3 (revision 273303) ++++ secure/lib/libssl/man/SSL_CTX_get_ex_new_index.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "SSL_CTX_get_ex_new_index 3" +-.TH SSL_CTX_get_ex_new_index 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH SSL_CTX_get_ex_new_index 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libssl/man/SSL_CTX_get_verify_mode.3 +=================================================================== +--- secure/lib/libssl/man/SSL_CTX_get_verify_mode.3 (revision 273303) ++++ secure/lib/libssl/man/SSL_CTX_get_verify_mode.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "SSL_CTX_get_verify_mode 3" +-.TH SSL_CTX_get_verify_mode 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH SSL_CTX_get_verify_mode 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libssl/man/SSL_CTX_load_verify_locations.3 +=================================================================== +--- secure/lib/libssl/man/SSL_CTX_load_verify_locations.3 (revision 273303) ++++ secure/lib/libssl/man/SSL_CTX_load_verify_locations.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "SSL_CTX_load_verify_locations 3" +-.TH SSL_CTX_load_verify_locations 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH SSL_CTX_load_verify_locations 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libssl/man/SSL_CTX_new.3 +=================================================================== +--- secure/lib/libssl/man/SSL_CTX_new.3 (revision 273303) ++++ secure/lib/libssl/man/SSL_CTX_new.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "SSL_CTX_new 3" +-.TH SSL_CTX_new 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH SSL_CTX_new 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libssl/man/SSL_CTX_sess_number.3 +=================================================================== +--- secure/lib/libssl/man/SSL_CTX_sess_number.3 (revision 273303) ++++ secure/lib/libssl/man/SSL_CTX_sess_number.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "SSL_CTX_sess_number 3" +-.TH SSL_CTX_sess_number 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH SSL_CTX_sess_number 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libssl/man/SSL_CTX_sess_set_cache_size.3 +=================================================================== +--- secure/lib/libssl/man/SSL_CTX_sess_set_cache_size.3 (revision 273303) ++++ secure/lib/libssl/man/SSL_CTX_sess_set_cache_size.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "SSL_CTX_sess_set_cache_size 3" +-.TH SSL_CTX_sess_set_cache_size 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH SSL_CTX_sess_set_cache_size 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libssl/man/SSL_CTX_sess_set_get_cb.3 +=================================================================== +--- secure/lib/libssl/man/SSL_CTX_sess_set_get_cb.3 (revision 273303) ++++ secure/lib/libssl/man/SSL_CTX_sess_set_get_cb.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "SSL_CTX_sess_set_get_cb 3" +-.TH SSL_CTX_sess_set_get_cb 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH SSL_CTX_sess_set_get_cb 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libssl/man/SSL_CTX_sessions.3 +=================================================================== +--- secure/lib/libssl/man/SSL_CTX_sessions.3 (revision 273303) ++++ secure/lib/libssl/man/SSL_CTX_sessions.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "SSL_CTX_sessions 3" +-.TH SSL_CTX_sessions 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH SSL_CTX_sessions 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libssl/man/SSL_CTX_set_cert_store.3 +=================================================================== +--- secure/lib/libssl/man/SSL_CTX_set_cert_store.3 (revision 273303) ++++ secure/lib/libssl/man/SSL_CTX_set_cert_store.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "SSL_CTX_set_cert_store 3" +-.TH SSL_CTX_set_cert_store 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH SSL_CTX_set_cert_store 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libssl/man/SSL_CTX_set_cert_verify_callback.3 +=================================================================== +--- secure/lib/libssl/man/SSL_CTX_set_cert_verify_callback.3 (revision 273303) ++++ secure/lib/libssl/man/SSL_CTX_set_cert_verify_callback.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "SSL_CTX_set_cert_verify_callback 3" +-.TH SSL_CTX_set_cert_verify_callback 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH SSL_CTX_set_cert_verify_callback 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libssl/man/SSL_CTX_set_cipher_list.3 +=================================================================== +--- secure/lib/libssl/man/SSL_CTX_set_cipher_list.3 (revision 273303) ++++ secure/lib/libssl/man/SSL_CTX_set_cipher_list.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "SSL_CTX_set_cipher_list 3" +-.TH SSL_CTX_set_cipher_list 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH SSL_CTX_set_cipher_list 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libssl/man/SSL_CTX_set_client_CA_list.3 +=================================================================== +--- secure/lib/libssl/man/SSL_CTX_set_client_CA_list.3 (revision 273303) ++++ secure/lib/libssl/man/SSL_CTX_set_client_CA_list.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "SSL_CTX_set_client_CA_list 3" +-.TH SSL_CTX_set_client_CA_list 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH SSL_CTX_set_client_CA_list 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libssl/man/SSL_CTX_set_client_cert_cb.3 +=================================================================== +--- secure/lib/libssl/man/SSL_CTX_set_client_cert_cb.3 (revision 273303) ++++ secure/lib/libssl/man/SSL_CTX_set_client_cert_cb.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "SSL_CTX_set_client_cert_cb 3" +-.TH SSL_CTX_set_client_cert_cb 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH SSL_CTX_set_client_cert_cb 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libssl/man/SSL_CTX_set_default_passwd_cb.3 +=================================================================== +--- secure/lib/libssl/man/SSL_CTX_set_default_passwd_cb.3 (revision 273303) ++++ secure/lib/libssl/man/SSL_CTX_set_default_passwd_cb.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "SSL_CTX_set_default_passwd_cb 3" +-.TH SSL_CTX_set_default_passwd_cb 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH SSL_CTX_set_default_passwd_cb 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libssl/man/SSL_CTX_set_generate_session_id.3 +=================================================================== +--- secure/lib/libssl/man/SSL_CTX_set_generate_session_id.3 (revision 273303) ++++ secure/lib/libssl/man/SSL_CTX_set_generate_session_id.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "SSL_CTX_set_generate_session_id 3" +-.TH SSL_CTX_set_generate_session_id 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH SSL_CTX_set_generate_session_id 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libssl/man/SSL_CTX_set_info_callback.3 +=================================================================== +--- secure/lib/libssl/man/SSL_CTX_set_info_callback.3 (revision 273303) ++++ secure/lib/libssl/man/SSL_CTX_set_info_callback.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "SSL_CTX_set_info_callback 3" +-.TH SSL_CTX_set_info_callback 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH SSL_CTX_set_info_callback 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libssl/man/SSL_CTX_set_max_cert_list.3 +=================================================================== +--- secure/lib/libssl/man/SSL_CTX_set_max_cert_list.3 (revision 273303) ++++ secure/lib/libssl/man/SSL_CTX_set_max_cert_list.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "SSL_CTX_set_max_cert_list 3" +-.TH SSL_CTX_set_max_cert_list 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH SSL_CTX_set_max_cert_list 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libssl/man/SSL_CTX_set_mode.3 +=================================================================== +--- secure/lib/libssl/man/SSL_CTX_set_mode.3 (revision 273303) ++++ secure/lib/libssl/man/SSL_CTX_set_mode.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "SSL_CTX_set_mode 3" +-.TH SSL_CTX_set_mode 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH SSL_CTX_set_mode 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libssl/man/SSL_CTX_set_msg_callback.3 +=================================================================== +--- secure/lib/libssl/man/SSL_CTX_set_msg_callback.3 (revision 273303) ++++ secure/lib/libssl/man/SSL_CTX_set_msg_callback.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "SSL_CTX_set_msg_callback 3" +-.TH SSL_CTX_set_msg_callback 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH SSL_CTX_set_msg_callback 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libssl/man/SSL_CTX_set_options.3 +=================================================================== +--- secure/lib/libssl/man/SSL_CTX_set_options.3 (revision 273303) ++++ secure/lib/libssl/man/SSL_CTX_set_options.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "SSL_CTX_set_options 3" +-.TH SSL_CTX_set_options 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH SSL_CTX_set_options 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libssl/man/SSL_CTX_set_psk_client_callback.3 +=================================================================== +--- secure/lib/libssl/man/SSL_CTX_set_psk_client_callback.3 (revision 273303) ++++ secure/lib/libssl/man/SSL_CTX_set_psk_client_callback.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "SSL_CTX_set_psk_client_callback 3" +-.TH SSL_CTX_set_psk_client_callback 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH SSL_CTX_set_psk_client_callback 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libssl/man/SSL_CTX_set_quiet_shutdown.3 +=================================================================== +--- secure/lib/libssl/man/SSL_CTX_set_quiet_shutdown.3 (revision 273303) ++++ secure/lib/libssl/man/SSL_CTX_set_quiet_shutdown.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "SSL_CTX_set_quiet_shutdown 3" +-.TH SSL_CTX_set_quiet_shutdown 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH SSL_CTX_set_quiet_shutdown 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libssl/man/SSL_CTX_set_session_cache_mode.3 +=================================================================== +--- secure/lib/libssl/man/SSL_CTX_set_session_cache_mode.3 (revision 273303) ++++ secure/lib/libssl/man/SSL_CTX_set_session_cache_mode.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "SSL_CTX_set_session_cache_mode 3" +-.TH SSL_CTX_set_session_cache_mode 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH SSL_CTX_set_session_cache_mode 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libssl/man/SSL_CTX_set_session_id_context.3 +=================================================================== +--- secure/lib/libssl/man/SSL_CTX_set_session_id_context.3 (revision 273303) ++++ secure/lib/libssl/man/SSL_CTX_set_session_id_context.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "SSL_CTX_set_session_id_context 3" +-.TH SSL_CTX_set_session_id_context 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH SSL_CTX_set_session_id_context 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libssl/man/SSL_CTX_set_ssl_version.3 +=================================================================== +--- secure/lib/libssl/man/SSL_CTX_set_ssl_version.3 (revision 273303) ++++ secure/lib/libssl/man/SSL_CTX_set_ssl_version.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "SSL_CTX_set_ssl_version 3" +-.TH SSL_CTX_set_ssl_version 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH SSL_CTX_set_ssl_version 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libssl/man/SSL_CTX_set_timeout.3 +=================================================================== +--- secure/lib/libssl/man/SSL_CTX_set_timeout.3 (revision 273303) ++++ secure/lib/libssl/man/SSL_CTX_set_timeout.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "SSL_CTX_set_timeout 3" +-.TH SSL_CTX_set_timeout 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH SSL_CTX_set_timeout 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libssl/man/SSL_CTX_set_tlsext_ticket_key_cb.3 +=================================================================== +--- secure/lib/libssl/man/SSL_CTX_set_tlsext_ticket_key_cb.3 (revision 273303) ++++ secure/lib/libssl/man/SSL_CTX_set_tlsext_ticket_key_cb.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "SSL_CTX_set_tlsext_ticket_key_cb 3" +-.TH SSL_CTX_set_tlsext_ticket_key_cb 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH SSL_CTX_set_tlsext_ticket_key_cb 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libssl/man/SSL_CTX_set_tmp_dh_callback.3 +=================================================================== +--- secure/lib/libssl/man/SSL_CTX_set_tmp_dh_callback.3 (revision 273303) ++++ secure/lib/libssl/man/SSL_CTX_set_tmp_dh_callback.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "SSL_CTX_set_tmp_dh_callback 3" +-.TH SSL_CTX_set_tmp_dh_callback 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH SSL_CTX_set_tmp_dh_callback 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +@@ -175,12 +175,13 @@ even if he gets hold of the normal (certified) key + only used for signing. + .PP + In order to perform a \s-1DH\s0 key exchange the server must use a \s-1DH\s0 group +-(\s-1DH\s0 parameters) and generate a \s-1DH\s0 key. The server will always generate a new +-\&\s-1DH\s0 key during the negotiation, when the \s-1DH\s0 parameters are supplied via +-callback and/or when the \s-1SSL_OP_SINGLE_DH_USE\s0 option of +-\&\fISSL_CTX_set_options\fR\|(3) is set. It will +-immediately create a \s-1DH\s0 key, when \s-1DH\s0 parameters are supplied via +-\&\fISSL_CTX_set_tmp_dh()\fR and \s-1SSL_OP_SINGLE_DH_USE\s0 is not set. In this case, ++(\s-1DH\s0 parameters) and generate a \s-1DH\s0 key. ++The server will always generate a new \s-1DH\s0 key during the negotiation ++if either the \s-1DH\s0 parameters are supplied via callback or the ++\&\s-1SSL_OP_SINGLE_DH_USE\s0 option of \fISSL_CTX_set_options\fR\|(3) is set (or both). ++It will immediately create a \s-1DH\s0 key if \s-1DH\s0 parameters are supplied via ++\&\fISSL_CTX_set_tmp_dh()\fR and \s-1SSL_OP_SINGLE_DH_USE\s0 is not set. ++In this case, + it may happen that a key is generated on initialization without later + being needed, while on the other hand the computer time during the + negotiation is being saved. +@@ -266,7 +267,7 @@ partly left out.) + \& dh_tmp = dh_512; + \& break; + \& case 1024: +-\& if (!dh_1024) ++\& if (!dh_1024) + \& dh_1024 = get_dh1024(); + \& dh_tmp = dh_1024; + \& break; +Index: secure/lib/libssl/man/SSL_CTX_set_tmp_rsa_callback.3 +=================================================================== +--- secure/lib/libssl/man/SSL_CTX_set_tmp_rsa_callback.3 (revision 273303) ++++ secure/lib/libssl/man/SSL_CTX_set_tmp_rsa_callback.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "SSL_CTX_set_tmp_rsa_callback 3" +-.TH SSL_CTX_set_tmp_rsa_callback 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH SSL_CTX_set_tmp_rsa_callback 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libssl/man/SSL_CTX_set_verify.3 +=================================================================== +--- secure/lib/libssl/man/SSL_CTX_set_verify.3 (revision 273303) ++++ secure/lib/libssl/man/SSL_CTX_set_verify.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "SSL_CTX_set_verify 3" +-.TH SSL_CTX_set_verify 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH SSL_CTX_set_verify 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libssl/man/SSL_CTX_use_certificate.3 +=================================================================== +--- secure/lib/libssl/man/SSL_CTX_use_certificate.3 (revision 273303) ++++ secure/lib/libssl/man/SSL_CTX_use_certificate.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "SSL_CTX_use_certificate 3" +-.TH SSL_CTX_use_certificate 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH SSL_CTX_use_certificate 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libssl/man/SSL_CTX_use_psk_identity_hint.3 +=================================================================== +--- secure/lib/libssl/man/SSL_CTX_use_psk_identity_hint.3 (revision 273303) ++++ secure/lib/libssl/man/SSL_CTX_use_psk_identity_hint.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "SSL_CTX_use_psk_identity_hint 3" +-.TH SSL_CTX_use_psk_identity_hint 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH SSL_CTX_use_psk_identity_hint 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libssl/man/SSL_SESSION_free.3 +=================================================================== +--- secure/lib/libssl/man/SSL_SESSION_free.3 (revision 273303) ++++ secure/lib/libssl/man/SSL_SESSION_free.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "SSL_SESSION_free 3" +-.TH SSL_SESSION_free 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH SSL_SESSION_free 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libssl/man/SSL_SESSION_get_ex_new_index.3 +=================================================================== +--- secure/lib/libssl/man/SSL_SESSION_get_ex_new_index.3 (revision 273303) ++++ secure/lib/libssl/man/SSL_SESSION_get_ex_new_index.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "SSL_SESSION_get_ex_new_index 3" +-.TH SSL_SESSION_get_ex_new_index 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH SSL_SESSION_get_ex_new_index 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libssl/man/SSL_SESSION_get_time.3 +=================================================================== +--- secure/lib/libssl/man/SSL_SESSION_get_time.3 (revision 273303) ++++ secure/lib/libssl/man/SSL_SESSION_get_time.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "SSL_SESSION_get_time 3" +-.TH SSL_SESSION_get_time 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH SSL_SESSION_get_time 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libssl/man/SSL_accept.3 +=================================================================== +--- secure/lib/libssl/man/SSL_accept.3 (revision 273303) ++++ secure/lib/libssl/man/SSL_accept.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "SSL_accept 3" +-.TH SSL_accept 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH SSL_accept 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libssl/man/SSL_alert_type_string.3 +=================================================================== +--- secure/lib/libssl/man/SSL_alert_type_string.3 (revision 273303) ++++ secure/lib/libssl/man/SSL_alert_type_string.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "SSL_alert_type_string 3" +-.TH SSL_alert_type_string 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH SSL_alert_type_string 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libssl/man/SSL_clear.3 +=================================================================== +--- secure/lib/libssl/man/SSL_clear.3 (revision 273303) ++++ secure/lib/libssl/man/SSL_clear.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "SSL_clear 3" +-.TH SSL_clear 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH SSL_clear 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libssl/man/SSL_connect.3 +=================================================================== +--- secure/lib/libssl/man/SSL_connect.3 (revision 273303) ++++ secure/lib/libssl/man/SSL_connect.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "SSL_connect 3" +-.TH SSL_connect 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH SSL_connect 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libssl/man/SSL_do_handshake.3 +=================================================================== +--- secure/lib/libssl/man/SSL_do_handshake.3 (revision 273303) ++++ secure/lib/libssl/man/SSL_do_handshake.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "SSL_do_handshake 3" +-.TH SSL_do_handshake 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH SSL_do_handshake 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libssl/man/SSL_free.3 +=================================================================== +--- secure/lib/libssl/man/SSL_free.3 (revision 273303) ++++ secure/lib/libssl/man/SSL_free.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "SSL_free 3" +-.TH SSL_free 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH SSL_free 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libssl/man/SSL_get_SSL_CTX.3 +=================================================================== +--- secure/lib/libssl/man/SSL_get_SSL_CTX.3 (revision 273303) ++++ secure/lib/libssl/man/SSL_get_SSL_CTX.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "SSL_get_SSL_CTX 3" +-.TH SSL_get_SSL_CTX 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH SSL_get_SSL_CTX 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libssl/man/SSL_get_ciphers.3 +=================================================================== +--- secure/lib/libssl/man/SSL_get_ciphers.3 (revision 273303) ++++ secure/lib/libssl/man/SSL_get_ciphers.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "SSL_get_ciphers 3" +-.TH SSL_get_ciphers 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH SSL_get_ciphers 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libssl/man/SSL_get_client_CA_list.3 +=================================================================== +--- secure/lib/libssl/man/SSL_get_client_CA_list.3 (revision 273303) ++++ secure/lib/libssl/man/SSL_get_client_CA_list.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "SSL_get_client_CA_list 3" +-.TH SSL_get_client_CA_list 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH SSL_get_client_CA_list 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libssl/man/SSL_get_current_cipher.3 +=================================================================== +--- secure/lib/libssl/man/SSL_get_current_cipher.3 (revision 273303) ++++ secure/lib/libssl/man/SSL_get_current_cipher.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "SSL_get_current_cipher 3" +-.TH SSL_get_current_cipher 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH SSL_get_current_cipher 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libssl/man/SSL_get_default_timeout.3 +=================================================================== +--- secure/lib/libssl/man/SSL_get_default_timeout.3 (revision 273303) ++++ secure/lib/libssl/man/SSL_get_default_timeout.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "SSL_get_default_timeout 3" +-.TH SSL_get_default_timeout 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH SSL_get_default_timeout 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libssl/man/SSL_get_error.3 +=================================================================== +--- secure/lib/libssl/man/SSL_get_error.3 (revision 273303) ++++ secure/lib/libssl/man/SSL_get_error.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "SSL_get_error 3" +-.TH SSL_get_error 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH SSL_get_error 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libssl/man/SSL_get_ex_data_X509_STORE_CTX_idx.3 +=================================================================== +--- secure/lib/libssl/man/SSL_get_ex_data_X509_STORE_CTX_idx.3 (revision 273303) ++++ secure/lib/libssl/man/SSL_get_ex_data_X509_STORE_CTX_idx.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "SSL_get_ex_data_X509_STORE_CTX_idx 3" +-.TH SSL_get_ex_data_X509_STORE_CTX_idx 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH SSL_get_ex_data_X509_STORE_CTX_idx 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libssl/man/SSL_get_ex_new_index.3 +=================================================================== +--- secure/lib/libssl/man/SSL_get_ex_new_index.3 (revision 273303) ++++ secure/lib/libssl/man/SSL_get_ex_new_index.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "SSL_get_ex_new_index 3" +-.TH SSL_get_ex_new_index 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH SSL_get_ex_new_index 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libssl/man/SSL_get_fd.3 +=================================================================== +--- secure/lib/libssl/man/SSL_get_fd.3 (revision 273303) ++++ secure/lib/libssl/man/SSL_get_fd.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "SSL_get_fd 3" +-.TH SSL_get_fd 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH SSL_get_fd 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libssl/man/SSL_get_peer_cert_chain.3 +=================================================================== +--- secure/lib/libssl/man/SSL_get_peer_cert_chain.3 (revision 273303) ++++ secure/lib/libssl/man/SSL_get_peer_cert_chain.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "SSL_get_peer_cert_chain 3" +-.TH SSL_get_peer_cert_chain 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH SSL_get_peer_cert_chain 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libssl/man/SSL_get_peer_certificate.3 +=================================================================== +--- secure/lib/libssl/man/SSL_get_peer_certificate.3 (revision 273303) ++++ secure/lib/libssl/man/SSL_get_peer_certificate.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "SSL_get_peer_certificate 3" +-.TH SSL_get_peer_certificate 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH SSL_get_peer_certificate 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libssl/man/SSL_get_psk_identity.3 +=================================================================== +--- secure/lib/libssl/man/SSL_get_psk_identity.3 (revision 273303) ++++ secure/lib/libssl/man/SSL_get_psk_identity.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "SSL_get_psk_identity 3" +-.TH SSL_get_psk_identity 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH SSL_get_psk_identity 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libssl/man/SSL_get_rbio.3 +=================================================================== +--- secure/lib/libssl/man/SSL_get_rbio.3 (revision 273303) ++++ secure/lib/libssl/man/SSL_get_rbio.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "SSL_get_rbio 3" +-.TH SSL_get_rbio 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH SSL_get_rbio 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libssl/man/SSL_get_session.3 +=================================================================== +--- secure/lib/libssl/man/SSL_get_session.3 (revision 273303) ++++ secure/lib/libssl/man/SSL_get_session.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "SSL_get_session 3" +-.TH SSL_get_session 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH SSL_get_session 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libssl/man/SSL_get_verify_result.3 +=================================================================== +--- secure/lib/libssl/man/SSL_get_verify_result.3 (revision 273303) ++++ secure/lib/libssl/man/SSL_get_verify_result.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "SSL_get_verify_result 3" +-.TH SSL_get_verify_result 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH SSL_get_verify_result 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libssl/man/SSL_get_version.3 +=================================================================== +--- secure/lib/libssl/man/SSL_get_version.3 (revision 273303) ++++ secure/lib/libssl/man/SSL_get_version.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "SSL_get_version 3" +-.TH SSL_get_version 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH SSL_get_version 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libssl/man/SSL_library_init.3 +=================================================================== +--- secure/lib/libssl/man/SSL_library_init.3 (revision 273303) ++++ secure/lib/libssl/man/SSL_library_init.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "SSL_library_init 3" +-.TH SSL_library_init 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH SSL_library_init 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libssl/man/SSL_load_client_CA_file.3 +=================================================================== +--- secure/lib/libssl/man/SSL_load_client_CA_file.3 (revision 273303) ++++ secure/lib/libssl/man/SSL_load_client_CA_file.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "SSL_load_client_CA_file 3" +-.TH SSL_load_client_CA_file 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH SSL_load_client_CA_file 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libssl/man/SSL_new.3 +=================================================================== +--- secure/lib/libssl/man/SSL_new.3 (revision 273303) ++++ secure/lib/libssl/man/SSL_new.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "SSL_new 3" +-.TH SSL_new 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH SSL_new 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libssl/man/SSL_pending.3 +=================================================================== +--- secure/lib/libssl/man/SSL_pending.3 (revision 273303) ++++ secure/lib/libssl/man/SSL_pending.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "SSL_pending 3" +-.TH SSL_pending 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH SSL_pending 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libssl/man/SSL_read.3 +=================================================================== +--- secure/lib/libssl/man/SSL_read.3 (revision 273303) ++++ secure/lib/libssl/man/SSL_read.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "SSL_read 3" +-.TH SSL_read 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH SSL_read 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libssl/man/SSL_rstate_string.3 +=================================================================== +--- secure/lib/libssl/man/SSL_rstate_string.3 (revision 273303) ++++ secure/lib/libssl/man/SSL_rstate_string.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "SSL_rstate_string 3" +-.TH SSL_rstate_string 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH SSL_rstate_string 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libssl/man/SSL_session_reused.3 +=================================================================== +--- secure/lib/libssl/man/SSL_session_reused.3 (revision 273303) ++++ secure/lib/libssl/man/SSL_session_reused.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "SSL_session_reused 3" +-.TH SSL_session_reused 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH SSL_session_reused 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libssl/man/SSL_set_bio.3 +=================================================================== +--- secure/lib/libssl/man/SSL_set_bio.3 (revision 273303) ++++ secure/lib/libssl/man/SSL_set_bio.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "SSL_set_bio 3" +-.TH SSL_set_bio 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH SSL_set_bio 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libssl/man/SSL_set_connect_state.3 +=================================================================== +--- secure/lib/libssl/man/SSL_set_connect_state.3 (revision 273303) ++++ secure/lib/libssl/man/SSL_set_connect_state.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "SSL_set_connect_state 3" +-.TH SSL_set_connect_state 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH SSL_set_connect_state 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libssl/man/SSL_set_fd.3 +=================================================================== +--- secure/lib/libssl/man/SSL_set_fd.3 (revision 273303) ++++ secure/lib/libssl/man/SSL_set_fd.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "SSL_set_fd 3" +-.TH SSL_set_fd 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH SSL_set_fd 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libssl/man/SSL_set_session.3 +=================================================================== +--- secure/lib/libssl/man/SSL_set_session.3 (revision 273303) ++++ secure/lib/libssl/man/SSL_set_session.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "SSL_set_session 3" +-.TH SSL_set_session 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH SSL_set_session 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libssl/man/SSL_set_shutdown.3 +=================================================================== +--- secure/lib/libssl/man/SSL_set_shutdown.3 (revision 273303) ++++ secure/lib/libssl/man/SSL_set_shutdown.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "SSL_set_shutdown 3" +-.TH SSL_set_shutdown 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH SSL_set_shutdown 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libssl/man/SSL_set_verify_result.3 +=================================================================== +--- secure/lib/libssl/man/SSL_set_verify_result.3 (revision 273303) ++++ secure/lib/libssl/man/SSL_set_verify_result.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "SSL_set_verify_result 3" +-.TH SSL_set_verify_result 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH SSL_set_verify_result 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libssl/man/SSL_shutdown.3 +=================================================================== +--- secure/lib/libssl/man/SSL_shutdown.3 (revision 273303) ++++ secure/lib/libssl/man/SSL_shutdown.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "SSL_shutdown 3" +-.TH SSL_shutdown 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH SSL_shutdown 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libssl/man/SSL_state_string.3 +=================================================================== +--- secure/lib/libssl/man/SSL_state_string.3 (revision 273303) ++++ secure/lib/libssl/man/SSL_state_string.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "SSL_state_string 3" +-.TH SSL_state_string 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH SSL_state_string 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libssl/man/SSL_want.3 +=================================================================== +--- secure/lib/libssl/man/SSL_want.3 (revision 273303) ++++ secure/lib/libssl/man/SSL_want.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "SSL_want 3" +-.TH SSL_want 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH SSL_want 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libssl/man/SSL_write.3 +=================================================================== +--- secure/lib/libssl/man/SSL_write.3 (revision 273303) ++++ secure/lib/libssl/man/SSL_write.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "SSL_write 3" +-.TH SSL_write 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH SSL_write 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libssl/man/d2i_SSL_SESSION.3 +=================================================================== +--- secure/lib/libssl/man/d2i_SSL_SESSION.3 (revision 273303) ++++ secure/lib/libssl/man/d2i_SSL_SESSION.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "d2i_SSL_SESSION 3" +-.TH d2i_SSL_SESSION 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH d2i_SSL_SESSION 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libssl/man/ssl.3 +=================================================================== +--- secure/lib/libssl/man/ssl.3 (revision 273303) ++++ secure/lib/libssl/man/ssl.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "ssl 3" +-.TH ssl 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH ssl 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/usr.bin/openssl/Makefile.man +=================================================================== +--- secure/usr.bin/openssl/Makefile.man (revision 273303) ++++ secure/usr.bin/openssl/Makefile.man (working copy) +@@ -2,6 +2,7 @@ + # DO NOT EDIT: generated from man-makefile-update target + MAN+= CA.pl.1 + MAN+= asn1parse.1 ++MAN+= c_rehash.1 + MAN+= ca.1 + MAN+= ciphers.1 + MAN+= cms.1 +@@ -45,10 +46,15 @@ MAN+= verify.1 + MAN+= version.1 + MAN+= x509.1 + MAN+= x509v3_config.1 +-MLINKS+= dgst.1 md5.1 +-MLINKS+= dgst.1 md4.1 +-MLINKS+= dgst.1 md2.1 ++MLINKS+= dgst.1 sha.1 + MLINKS+= dgst.1 sha1.1 +-MLINKS+= dgst.1 sha.1 + MLINKS+= dgst.1 mdc2.1 + MLINKS+= dgst.1 ripemd160.1 ++MLINKS+= dgst.1 sha224.1 ++MLINKS+= dgst.1 sha256.1 ++MLINKS+= dgst.1 sha384.1 ++MLINKS+= dgst.1 sha512.1 ++MLINKS+= dgst.1 md2.1 ++MLINKS+= dgst.1 md4.1 ++MLINKS+= dgst.1 md5.1 ++MLINKS+= dgst.1 dss1.1 +Index: secure/usr.bin/openssl/man/CA.pl.1 +=================================================================== +--- secure/usr.bin/openssl/man/CA.pl.1 (revision 273303) ++++ secure/usr.bin/openssl/man/CA.pl.1 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "CA.PL 1" +-.TH CA.PL 1 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH CA.PL 1 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/usr.bin/openssl/man/asn1parse.1 +=================================================================== +--- secure/usr.bin/openssl/man/asn1parse.1 (revision 273303) ++++ secure/usr.bin/openssl/man/asn1parse.1 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "ASN1PARSE 1" +-.TH ASN1PARSE 1 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH ASN1PARSE 1 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/usr.bin/openssl/man/c_rehash.1 +=================================================================== +--- secure/usr.bin/openssl/man/c_rehash.1 (revision 0) ++++ secure/usr.bin/openssl/man/c_rehash.1 (working copy) +@@ -0,0 +1,199 @@ ++.\" Automatically generated by Pod::Man 2.25 (Pod::Simple 3.28) ++.\" ++.\" Standard preamble: ++.\" ======================================================================== ++.de Sp \" Vertical space (when we can't use .PP) ++.if t .sp .5v ++.if n .sp ++.. ++.de Vb \" Begin verbatim text ++.ft CW ++.nf ++.ne \\$1 ++.. ++.de Ve \" End verbatim text ++.ft R ++.fi ++.. ++.\" Set up some character translations and predefined strings. \*(-- will ++.\" give an unbreakable dash, \*(PI will give pi, \*(L" will give a left ++.\" double quote, and \*(R" will give a right double quote. \*(C+ will ++.\" give a nicer C++. Capital omega is used to do unbreakable dashes and ++.\" therefore won't be available. \*(C` and \*(C' expand to `' in nroff, ++.\" nothing in troff, for use with C<>. ++.tr \(*W- ++.ds C+ C\v'-.1v'\h'-1p'\s-2+\h'-1p'+\s0\v'.1v'\h'-1p' ++.ie n \{\ ++. ds -- \(*W- ++. ds PI pi ++. if (\n(.H=4u)&(1m=24u) .ds -- \(*W\h'-12u'\(*W\h'-12u'-\" diablo 10 pitch ++. if (\n(.H=4u)&(1m=20u) .ds -- \(*W\h'-12u'\(*W\h'-8u'-\" diablo 12 pitch ++. ds L" "" ++. ds R" "" ++. ds C` "" ++. ds C' "" ++'br\} ++.el\{\ ++. ds -- \|\(em\| ++. ds PI \(*p ++. ds L" `` ++. ds R" '' ++'br\} ++.\" ++.\" Escape single quotes in literal strings from groff's Unicode transform. ++.ie \n(.g .ds Aq \(aq ++.el .ds Aq ' ++.\" ++.\" If the F register is turned on, we'll generate index entries on stderr for ++.\" titles (.TH), headers (.SH), subsections (.SS), items (.Ip), and index ++.\" entries marked with X<> in POD. Of course, you'll have to process the ++.\" output yourself in some meaningful fashion. ++.ie \nF \{\ ++. de IX ++. tm Index:\\$1\t\\n%\t"\\$2" ++.. ++. nr % 0 ++. rr F ++.\} ++.el \{\ ++. de IX ++.. ++.\} ++.\" ++.\" Accent mark definitions (@(#)ms.acc 1.5 88/02/08 SMI; from UCB 4.2). ++.\" Fear. Run. Save yourself. No user-serviceable parts. ++. \" fudge factors for nroff and troff ++.if n \{\ ++. ds #H 0 ++. ds #V .8m ++. ds #F .3m ++. ds #[ \f1 ++. ds #] \fP ++.\} ++.if t \{\ ++. ds #H ((1u-(\\\\n(.fu%2u))*.13m) ++. ds #V .6m ++. ds #F 0 ++. ds #[ \& ++. ds #] \& ++.\} ++. \" simple accents for nroff and troff ++.if n \{\ ++. ds ' \& ++. ds ` \& ++. ds ^ \& ++. ds , \& ++. ds ~ ~ ++. ds / ++.\} ++.if t \{\ ++. ds ' \\k:\h'-(\\n(.wu*8/10-\*(#H)'\'\h"|\\n:u" ++. ds ` \\k:\h'-(\\n(.wu*8/10-\*(#H)'\`\h'|\\n:u' ++. ds ^ \\k:\h'-(\\n(.wu*10/11-\*(#H)'^\h'|\\n:u' ++. ds , \\k:\h'-(\\n(.wu*8/10)',\h'|\\n:u' ++. ds ~ \\k:\h'-(\\n(.wu-\*(#H-.1m)'~\h'|\\n:u' ++. ds / \\k:\h'-(\\n(.wu*8/10-\*(#H)'\z\(sl\h'|\\n:u' ++.\} ++. \" troff and (daisy-wheel) nroff accents ++.ds : \\k:\h'-(\\n(.wu*8/10-\*(#H+.1m+\*(#F)'\v'-\*(#V'\z.\h'.2m+\*(#F'.\h'|\\n:u'\v'\*(#V' ++.ds 8 \h'\*(#H'\(*b\h'-\*(#H' ++.ds o \\k:\h'-(\\n(.wu+\w'\(de'u-\*(#H)/2u'\v'-.3n'\*(#[\z\(de\v'.3n'\h'|\\n:u'\*(#] ++.ds d- \h'\*(#H'\(pd\h'-\w'~'u'\v'-.25m'\f2\(hy\fP\v'.25m'\h'-\*(#H' ++.ds D- D\\k:\h'-\w'D'u'\v'-.11m'\z\(hy\v'.11m'\h'|\\n:u' ++.ds th \*(#[\v'.3m'\s+1I\s-1\v'-.3m'\h'-(\w'I'u*2/3)'\s-1o\s+1\*(#] ++.ds Th \*(#[\s+2I\s-2\h'-\w'I'u*3/5'\v'-.3m'o\v'.3m'\*(#] ++.ds ae a\h'-(\w'a'u*4/10)'e ++.ds Ae A\h'-(\w'A'u*4/10)'E ++. \" corrections for vroff ++.if v .ds ~ \\k:\h'-(\\n(.wu*9/10-\*(#H)'\s-2\u~\d\s+2\h'|\\n:u' ++.if v .ds ^ \\k:\h'-(\\n(.wu*10/11-\*(#H)'\v'-.4m'^\v'.4m'\h'|\\n:u' ++. \" for low resolution devices (crt and lpr) ++.if \n(.H>23 .if \n(.V>19 \ ++\{\ ++. ds : e ++. ds 8 ss ++. ds o a ++. ds d- d\h'-1'\(ga ++. ds D- D\h'-1'\(hy ++. ds th \o'bp' ++. ds Th \o'LP' ++. ds ae ae ++. ds Ae AE ++.\} ++.rm #[ #] #H #V #F C ++.\" ======================================================================== ++.\" ++.IX Title "C_REHASH 1" ++.TH C_REHASH 1 "2014-10-15" "1.0.1j" "OpenSSL" ++.\" For nroff, turn off justification. Always turn off hyphenation; it makes ++.\" way too many mistakes in technical documents. ++.if n .ad l ++.nh ++.SH "NAME" ++c_rehash \- Create symbolic links to files named by the hash values ++.SH "SYNOPSIS" ++.IX Header "SYNOPSIS" ++\&\fBc_rehash\fR ++[ \fIdirectory\fR...] ++.SH "DESCRIPTION" ++.IX Header "DESCRIPTION" ++\&\fBc_rehash\fR scans directories and calculates a hash value of each \f(CW\*(C`.pem\*(C'\fR ++file in the specified directory list and creates symbolic links ++for each file, where the name of the link is the hash value. ++This utility is useful as many programs that use OpenSSL require ++directories to be set up like this in order to find certificates. ++.PP ++If any directories are named on the command line, then those are ++processed in turn. If not, then the \fB\s-1SSL_CERT_DIR\s0\fR environment variable ++is consulted; this shold be a colon-separated list of directories, ++like the Unix \fB\s-1PATH\s0\fR variable. ++If that is not set then the default directory (installation-specific ++but often \fB/usr/local/ssl/certs\fR) is processed. ++.PP ++In order for a directory to be processed, the user must have write ++permissions on that directory, otherwise it will be skipped. ++The links created are of the form \f(CW\*(C`HHHHHHHH.D\*(C'\fR, where each \fBH\fR ++is a hexadecimal character and \fBD\fR is a single decimal digit. ++When processing a directory, \fBc_rehash\fR will first remove all links ++that have a name in that syntax. If you have links in that format ++used for other purposes, they will be removed. ++Hashes for \s-1CRL\s0's look similar except the letter \fBr\fR appears after ++the period, like this: \f(CW\*(C`HHHHHHHH.rD\*(C'\fR. ++.PP ++Multiple objects may have the same hash; they will be indicated by ++incrementing the \fBD\fR value. Duplicates are found by comparing the ++full \s-1SHA\-1\s0 fingerprint. A warning will be displayed if a duplicate ++is found. ++.PP ++A warning will also be displayed if there are \fB.pem\fR files that ++cannot be parsed as either a certificate or a \s-1CRL\s0. ++.PP ++The program uses the \fBopenssl\fR program to compute the hashes and ++fingerprints. If not found in the user's \fB\s-1PATH\s0\fR, then set the ++\&\fB\s-1OPENSSL\s0\fR environment variable to the full pathname. ++Any program can be used, it will be invoked as follows for either ++a certificate or \s-1CRL:\s0 ++.PP ++.Vb 2 ++\& $OPENSSL x509 \-hash \-fingerprint \-noout \-in FFFFFF ++\& $OPENSSL crl \-hash \-fingerprint \-noout \-in FFFFFF ++.Ve ++.PP ++where \fB\s-1FFFFFF\s0\fR is the filename. It must output the hash of the ++file on the first line, and the fingerprint on the second, ++optionally prefixed with some text and an equals sign. ++.SH "ENVIRONMENT" ++.IX Header "ENVIRONMENT" ++.IP "\fB\s-1OPENSSL\s0\fR" 4 ++.IX Item "OPENSSL" ++The path to an executable to use to generate hashes and ++fingerprints (see above). ++.IP "\fB\s-1SSL_CERT_DIR\s0\fR" 4 ++.IX Item "SSL_CERT_DIR" ++Colon separated list of directories to operate on. ++Ignored if directories are listed on the command line. ++.SH "SEE ALSO" ++.IX Header "SEE ALSO" ++\&\fIopenssl\fR\|(1), ++\&\fIcrl\fR\|(1). ++\&\fIx509\fR\|(1). + +Property changes on: secure/usr.bin/openssl/man/c_rehash.1 +___________________________________________________________________ +Added: svn:keywords +## -0,0 +1 ## ++FreeBSD=%H +\ No newline at end of property +Added: svn:eol-style +## -0,0 +1 ## ++native +\ No newline at end of property +Added: svn:mime-type +## -0,0 +1 ## ++text/plain +\ No newline at end of property +Index: secure/usr.bin/openssl/man/ca.1 +=================================================================== +--- secure/usr.bin/openssl/man/ca.1 (revision 273303) ++++ secure/usr.bin/openssl/man/ca.1 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "CA 1" +-.TH CA 1 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH CA 1 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/usr.bin/openssl/man/ciphers.1 +=================================================================== +--- secure/usr.bin/openssl/man/ciphers.1 (revision 273303) ++++ secure/usr.bin/openssl/man/ciphers.1 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "CIPHERS 1" +-.TH CIPHERS 1 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH CIPHERS 1 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/usr.bin/openssl/man/cms.1 +=================================================================== +--- secure/usr.bin/openssl/man/cms.1 (revision 273303) ++++ secure/usr.bin/openssl/man/cms.1 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "CMS 1" +-.TH CMS 1 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH CMS 1 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/usr.bin/openssl/man/crl.1 +=================================================================== +--- secure/usr.bin/openssl/man/crl.1 (revision 273303) ++++ secure/usr.bin/openssl/man/crl.1 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "CRL 1" +-.TH CRL 1 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH CRL 1 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/usr.bin/openssl/man/crl2pkcs7.1 +=================================================================== +--- secure/usr.bin/openssl/man/crl2pkcs7.1 (revision 273303) ++++ secure/usr.bin/openssl/man/crl2pkcs7.1 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "CRL2PKCS7 1" +-.TH CRL2PKCS7 1 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH CRL2PKCS7 1 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/usr.bin/openssl/man/dgst.1 +=================================================================== +--- secure/usr.bin/openssl/man/dgst.1 (revision 273303) ++++ secure/usr.bin/openssl/man/dgst.1 (working copy) +@@ -124,21 +124,22 @@ + .\" ======================================================================== + .\" + .IX Title "DGST 1" +-.TH DGST 1 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH DGST 1 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l + .nh + .SH "NAME" +-dgst, md5, md4, md2, sha1, sha, mdc2, ripemd160 \- message digests ++dgst, sha, sha1, mdc2, ripemd160, sha224, sha256, sha384, sha512, md2, md4, md5, dss1 \- message digests + .SH "SYNOPSIS" + .IX Header "SYNOPSIS" + \&\fBopenssl\fR \fBdgst\fR +-[\fB\-md5|\-md4|\-md2|\-sha1|\-sha|\-mdc2|\-ripemd160|\-dss1\fR] ++[\fB\-sha|\-sha1|\-mdc2|\-ripemd160|\-sha224|\-sha256|\-sha384|\-sha512|\-md2|\-md4|\-md5|\-dss1\fR] + [\fB\-c\fR] + [\fB\-d\fR] + [\fB\-hex\fR] + [\fB\-binary\fR] ++[\fB\-r\fR] + [\fB\-out filename\fR] + [\fB\-sign filename\fR] + [\fB\-keyform arg\fR] +@@ -147,16 +148,18 @@ + [\fB\-prverify filename\fR] + [\fB\-signature filename\fR] + [\fB\-hmac key\fR] ++[\fB\-non\-fips\-allow\fR] ++[\fB\-fips\-fingerprint\fR] + [\fBfile...\fR] + .PP +-[\fBmd5|md4|md2|sha1|sha|mdc2|ripemd160\fR] +-[\fB\-c\fR] +-[\fB\-d\fR] +-[\fBfile...\fR] ++\&\fBopenssl\fR ++[\fIdigest\fR] ++[\fB...\fR] + .SH "DESCRIPTION" + .IX Header "DESCRIPTION" + The digest functions output the message digest of a supplied file or files +-in hexadecimal form. They can also be used for digital signing and verification. ++in hexadecimal. The digest functions also generate and verify digital ++signatures using message digests. + .SH "OPTIONS" + .IX Header "OPTIONS" + .IP "\fB\-c\fR" 4 +@@ -169,10 +172,14 @@ print out \s-1BIO\s0 debugging information. + .IP "\fB\-hex\fR" 4 + .IX Item "-hex" + digest is to be output as a hex dump. This is the default case for a \*(L"normal\*(R" +-digest as opposed to a digital signature. ++digest as opposed to a digital signature. See \s-1NOTES\s0 below for digital ++signatures using \fB\-hex\fR. + .IP "\fB\-binary\fR" 4 + .IX Item "-binary" + output the digest or signature in binary form. ++.IP "\fB\-r\fR" 4 ++.IX Item "-r" ++output the digest in the \*(L"coreutils\*(R" format used by programs like \fBsha1sum\fR. + .IP "\fB\-out filename\fR" 4 + .IX Item "-out filename" + filename to output to, or standard output by default. +@@ -181,8 +188,8 @@ filename to output to, or standard output by defau + digitally sign the digest using the private key in \*(L"filename\*(R". + .IP "\fB\-keyform arg\fR" 4 + .IX Item "-keyform arg" +-Specifies the key format to sign digest with. Only \s-1PEM\s0 and \s-1ENGINE\s0 +-formats are supported by the \fBdgst\fR command. ++Specifies the key format to sign digest with. The \s-1DER\s0, \s-1PEM\s0, P12, ++and \s-1ENGINE\s0 formats are supported. + .IP "\fB\-engine id\fR" 4 + .IX Item "-engine id" + Use engine \fBid\fR for operations (including private key storage). +@@ -241,20 +248,46 @@ generator, or an \s-1EGD\s0 socket (see \fIRAND_eg + Multiple files can be specified separated by a OS-dependent character. + The separator is \fB;\fR for MS-Windows, \fB,\fR for OpenVMS, and \fB:\fR for + all others. ++.IP "\fB\-non\-fips\-allow\fR" 4 ++.IX Item "-non-fips-allow" ++enable use of non-FIPS algorithms such as \s-1MD5\s0 even in \s-1FIPS\s0 mode. ++.IP "\fB\-fips\-fingerprint\fR" 4 ++.IX Item "-fips-fingerprint" ++compute \s-1HMAC\s0 using a specific key ++for certain OpenSSL-FIPS operations. + .IP "\fBfile...\fR" 4 + .IX Item "file..." + file or files to digest. If no files are specified then standard input is + used. ++.SH "EXAMPLES" ++.IX Header "EXAMPLES" ++To create a hex-encoded message digest of a file: ++ openssl dgst \-md5 \-hex file.txt ++.PP ++To sign a file using \s-1SHA\-256\s0 with binary file output: ++ openssl dgst \-sha256 \-sign privatekey.pem \-out signature.sign file.txt ++.PP ++To verify a signature: ++ openssl dgst \-sha256 \-verify publickey.pem \e ++ \-signature signature.sign \e ++ file.txt + .SH "NOTES" + .IX Header "NOTES" + The digest of choice for all new applications is \s-1SHA1\s0. Other digests are + however still widely used. + .PP +-If you wish to sign or verify data using the \s-1DSA\s0 algorithm then the dss1 +-digest must be used. ++When signing a file, \fBdgst\fR will automatically determine the algorithm ++(\s-1RSA\s0, \s-1ECC\s0, etc) to use for signing based on the private key's \s-1ASN\s0.1 info. ++When verifying signatures, it only handles the \s-1RSA\s0, \s-1DSA\s0, or \s-1ECDSA\s0 signature ++itself, not the related data to identify the signer and algorithm used in ++formats such as x.509, \s-1CMS\s0, and S/MIME. + .PP + A source of random numbers is required for certain signing algorithms, in +-particular \s-1DSA\s0. ++particular \s-1ECDSA\s0 and \s-1DSA\s0. + .PP + The signing and verify options should only be used if a single file is + being signed or verified. ++.PP ++Hex signatures cannot be verified using \fBopenssl\fR. Instead, use \*(L"xxd \-r\*(R" ++or similar program to transform the hex signature into a binary signature ++prior to verification. +Index: secure/usr.bin/openssl/man/dhparam.1 +=================================================================== +--- secure/usr.bin/openssl/man/dhparam.1 (revision 273303) ++++ secure/usr.bin/openssl/man/dhparam.1 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "DHPARAM 1" +-.TH DHPARAM 1 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH DHPARAM 1 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/usr.bin/openssl/man/dsa.1 +=================================================================== +--- secure/usr.bin/openssl/man/dsa.1 (revision 273303) ++++ secure/usr.bin/openssl/man/dsa.1 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "DSA 1" +-.TH DSA 1 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH DSA 1 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/usr.bin/openssl/man/dsaparam.1 +=================================================================== +--- secure/usr.bin/openssl/man/dsaparam.1 (revision 273303) ++++ secure/usr.bin/openssl/man/dsaparam.1 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "DSAPARAM 1" +-.TH DSAPARAM 1 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH DSAPARAM 1 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/usr.bin/openssl/man/ec.1 +=================================================================== +--- secure/usr.bin/openssl/man/ec.1 (revision 273303) ++++ secure/usr.bin/openssl/man/ec.1 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "EC 1" +-.TH EC 1 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH EC 1 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/usr.bin/openssl/man/ecparam.1 +=================================================================== +--- secure/usr.bin/openssl/man/ecparam.1 (revision 273303) ++++ secure/usr.bin/openssl/man/ecparam.1 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "ECPARAM 1" +-.TH ECPARAM 1 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH ECPARAM 1 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/usr.bin/openssl/man/enc.1 +=================================================================== +--- secure/usr.bin/openssl/man/enc.1 (revision 273303) ++++ secure/usr.bin/openssl/man/enc.1 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "ENC 1" +-.TH ENC 1 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH ENC 1 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/usr.bin/openssl/man/errstr.1 +=================================================================== +--- secure/usr.bin/openssl/man/errstr.1 (revision 273303) ++++ secure/usr.bin/openssl/man/errstr.1 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "ERRSTR 1" +-.TH ERRSTR 1 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH ERRSTR 1 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/usr.bin/openssl/man/gendsa.1 +=================================================================== +--- secure/usr.bin/openssl/man/gendsa.1 (revision 273303) ++++ secure/usr.bin/openssl/man/gendsa.1 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "GENDSA 1" +-.TH GENDSA 1 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH GENDSA 1 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/usr.bin/openssl/man/genpkey.1 +=================================================================== +--- secure/usr.bin/openssl/man/genpkey.1 (revision 273303) ++++ secure/usr.bin/openssl/man/genpkey.1 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "GENPKEY 1" +-.TH GENPKEY 1 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH GENPKEY 1 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/usr.bin/openssl/man/genrsa.1 +=================================================================== +--- secure/usr.bin/openssl/man/genrsa.1 (revision 273303) ++++ secure/usr.bin/openssl/man/genrsa.1 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "GENRSA 1" +-.TH GENRSA 1 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH GENRSA 1 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/usr.bin/openssl/man/nseq.1 +=================================================================== +--- secure/usr.bin/openssl/man/nseq.1 (revision 273303) ++++ secure/usr.bin/openssl/man/nseq.1 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "NSEQ 1" +-.TH NSEQ 1 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH NSEQ 1 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/usr.bin/openssl/man/ocsp.1 +=================================================================== +--- secure/usr.bin/openssl/man/ocsp.1 (revision 273303) ++++ secure/usr.bin/openssl/man/ocsp.1 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "OCSP 1" +-.TH OCSP 1 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH OCSP 1 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/usr.bin/openssl/man/openssl.1 +=================================================================== +--- secure/usr.bin/openssl/man/openssl.1 (revision 273303) ++++ secure/usr.bin/openssl/man/openssl.1 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "OPENSSL 1" +-.TH OPENSSL 1 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH OPENSSL 1 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/usr.bin/openssl/man/passwd.1 +=================================================================== +--- secure/usr.bin/openssl/man/passwd.1 (revision 273303) ++++ secure/usr.bin/openssl/man/passwd.1 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "PASSWD 1" +-.TH PASSWD 1 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH PASSWD 1 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/usr.bin/openssl/man/pkcs12.1 +=================================================================== +--- secure/usr.bin/openssl/man/pkcs12.1 (revision 273303) ++++ secure/usr.bin/openssl/man/pkcs12.1 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "PKCS12 1" +-.TH PKCS12 1 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH PKCS12 1 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/usr.bin/openssl/man/pkcs7.1 +=================================================================== +--- secure/usr.bin/openssl/man/pkcs7.1 (revision 273303) ++++ secure/usr.bin/openssl/man/pkcs7.1 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "PKCS7 1" +-.TH PKCS7 1 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH PKCS7 1 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/usr.bin/openssl/man/pkcs8.1 +=================================================================== +--- secure/usr.bin/openssl/man/pkcs8.1 (revision 273303) ++++ secure/usr.bin/openssl/man/pkcs8.1 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "PKCS8 1" +-.TH PKCS8 1 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH PKCS8 1 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/usr.bin/openssl/man/pkey.1 +=================================================================== +--- secure/usr.bin/openssl/man/pkey.1 (revision 273303) ++++ secure/usr.bin/openssl/man/pkey.1 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "PKEY 1" +-.TH PKEY 1 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH PKEY 1 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/usr.bin/openssl/man/pkeyparam.1 +=================================================================== +--- secure/usr.bin/openssl/man/pkeyparam.1 (revision 273303) ++++ secure/usr.bin/openssl/man/pkeyparam.1 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "PKEYPARAM 1" +-.TH PKEYPARAM 1 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH PKEYPARAM 1 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/usr.bin/openssl/man/pkeyutl.1 +=================================================================== +--- secure/usr.bin/openssl/man/pkeyutl.1 (revision 273303) ++++ secure/usr.bin/openssl/man/pkeyutl.1 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "PKEYUTL 1" +-.TH PKEYUTL 1 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH PKEYUTL 1 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/usr.bin/openssl/man/rand.1 +=================================================================== +--- secure/usr.bin/openssl/man/rand.1 (revision 273303) ++++ secure/usr.bin/openssl/man/rand.1 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "RAND 1" +-.TH RAND 1 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH RAND 1 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/usr.bin/openssl/man/req.1 +=================================================================== +--- secure/usr.bin/openssl/man/req.1 (revision 273303) ++++ secure/usr.bin/openssl/man/req.1 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "REQ 1" +-.TH REQ 1 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH REQ 1 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/usr.bin/openssl/man/rsa.1 +=================================================================== +--- secure/usr.bin/openssl/man/rsa.1 (revision 273303) ++++ secure/usr.bin/openssl/man/rsa.1 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "RSA 1" +-.TH RSA 1 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH RSA 1 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/usr.bin/openssl/man/rsautl.1 +=================================================================== +--- secure/usr.bin/openssl/man/rsautl.1 (revision 273303) ++++ secure/usr.bin/openssl/man/rsautl.1 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "RSAUTL 1" +-.TH RSAUTL 1 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH RSAUTL 1 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/usr.bin/openssl/man/s_client.1 +=================================================================== +--- secure/usr.bin/openssl/man/s_client.1 (revision 273303) ++++ secure/usr.bin/openssl/man/s_client.1 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "S_CLIENT 1" +-.TH S_CLIENT 1 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH S_CLIENT 1 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/usr.bin/openssl/man/s_server.1 +=================================================================== +--- secure/usr.bin/openssl/man/s_server.1 (revision 273303) ++++ secure/usr.bin/openssl/man/s_server.1 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "S_SERVER 1" +-.TH S_SERVER 1 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH S_SERVER 1 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/usr.bin/openssl/man/s_time.1 +=================================================================== +--- secure/usr.bin/openssl/man/s_time.1 (revision 273303) ++++ secure/usr.bin/openssl/man/s_time.1 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "S_TIME 1" +-.TH S_TIME 1 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH S_TIME 1 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/usr.bin/openssl/man/sess_id.1 +=================================================================== +--- secure/usr.bin/openssl/man/sess_id.1 (revision 273303) ++++ secure/usr.bin/openssl/man/sess_id.1 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "SESS_ID 1" +-.TH SESS_ID 1 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH SESS_ID 1 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/usr.bin/openssl/man/smime.1 +=================================================================== +--- secure/usr.bin/openssl/man/smime.1 (revision 273303) ++++ secure/usr.bin/openssl/man/smime.1 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "SMIME 1" +-.TH SMIME 1 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH SMIME 1 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/usr.bin/openssl/man/speed.1 +=================================================================== +--- secure/usr.bin/openssl/man/speed.1 (revision 273303) ++++ secure/usr.bin/openssl/man/speed.1 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "SPEED 1" +-.TH SPEED 1 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH SPEED 1 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/usr.bin/openssl/man/spkac.1 +=================================================================== +--- secure/usr.bin/openssl/man/spkac.1 (revision 273303) ++++ secure/usr.bin/openssl/man/spkac.1 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "SPKAC 1" +-.TH SPKAC 1 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH SPKAC 1 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/usr.bin/openssl/man/ts.1 +=================================================================== +--- secure/usr.bin/openssl/man/ts.1 (revision 273303) ++++ secure/usr.bin/openssl/man/ts.1 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "TS 1" +-.TH TS 1 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH TS 1 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/usr.bin/openssl/man/tsget.1 +=================================================================== +--- secure/usr.bin/openssl/man/tsget.1 (revision 273303) ++++ secure/usr.bin/openssl/man/tsget.1 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "TSGET 1" +-.TH TSGET 1 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH TSGET 1 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/usr.bin/openssl/man/verify.1 +=================================================================== +--- secure/usr.bin/openssl/man/verify.1 (revision 273303) ++++ secure/usr.bin/openssl/man/verify.1 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "VERIFY 1" +-.TH VERIFY 1 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH VERIFY 1 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/usr.bin/openssl/man/version.1 +=================================================================== +--- secure/usr.bin/openssl/man/version.1 (revision 273303) ++++ secure/usr.bin/openssl/man/version.1 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "VERSION 1" +-.TH VERSION 1 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH VERSION 1 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/usr.bin/openssl/man/x509.1 +=================================================================== +--- secure/usr.bin/openssl/man/x509.1 (revision 273303) ++++ secure/usr.bin/openssl/man/x509.1 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "X509 1" +-.TH X509 1 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH X509 1 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/usr.bin/openssl/man/x509v3_config.1 +=================================================================== +--- secure/usr.bin/openssl/man/x509v3_config.1 (revision 273303) ++++ secure/usr.bin/openssl/man/x509v3_config.1 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "X509V3_CONFIG 1" +-.TH X509V3_CONFIG 1 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH X509V3_CONFIG 1 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l Index: user/cperciva/freebsd-update-build/patches/10.1-RC1/2-EN-14:11.crypt =================================================================== --- user/cperciva/freebsd-update-build/patches/10.1-RC1/2-EN-14:11.crypt (nonexistent) +++ user/cperciva/freebsd-update-build/patches/10.1-RC1/2-EN-14:11.crypt (revision 293366) @@ -0,0 +1,49 @@ +Index: lib/libcrypt/crypt.c +=================================================================== +--- lib/libcrypt/crypt.c (revision 273303) ++++ lib/libcrypt/crypt.c (working copy) +@@ -37,8 +37,13 @@ __FBSDID("$FreeBSD$"); + #include "crypt.h" + + /* +- * List of supported crypt(3) formats. The first element in the list will +- * be the default. ++ * List of supported crypt(3) formats. ++ * ++ * The default algorithm is the last entry in the list (second-to-last ++ * array element since the last is a sentinel). The reason for placing ++ * the default last rather than first is that DES needs to be at the ++ * bottom for the algorithm guessing logic in crypt(3) to work correctly, ++ * and it needs to be the default for backward compatibility. + */ + static const struct crypt_format { + const char *const name; +@@ -45,10 +50,6 @@ static const struct crypt_format { + char *(*const func)(const char *, const char *); + const char *const magic; + } crypt_formats[] = { +- /* default format */ +- { "sha512", crypt_sha512, "$6$" }, +- +- /* other supported formats */ + { "md5", crypt_md5, "$1$" }, + #ifdef HAS_BLOWFISH + { "blf", crypt_blowfish, "$2" }, +@@ -55,6 +56,7 @@ static const struct crypt_format { + #endif + { "nth", crypt_nthash, "$3$" }, + { "sha256", crypt_sha256, "$5$" }, ++ { "sha512", crypt_sha512, "$6$" }, + #ifdef HAS_DES + { "des", crypt_des, "_" }, + #endif +@@ -63,7 +65,8 @@ static const struct crypt_format { + { NULL, NULL, NULL } + }; + +-static const struct crypt_format *crypt_format = &crypt_formats[0]; ++static const struct crypt_format *crypt_format = ++ &crypt_formats[(sizeof crypt_formats / sizeof *crypt_formats) - 2]; + + #define DES_SALT_ALPHABET \ + "./0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz" Index: user/cperciva/freebsd-update-build/patches/10.1-RC2/1-SA-14:20.rtsold =================================================================== --- user/cperciva/freebsd-update-build/patches/10.1-RC2/1-SA-14:20.rtsold (nonexistent) +++ user/cperciva/freebsd-update-build/patches/10.1-RC2/1-SA-14:20.rtsold (revision 293366) @@ -0,0 +1,14 @@ +Index: usr.sbin/rtsold/rtsol.c +=================================================================== +--- usr.sbin/rtsold/rtsol.c.orig ++++ usr.sbin/rtsold/rtsol.c +@@ -933,7 +933,8 @@ + dst_origin = dst; + memset(dst, '\0', dlen); + while (src && (len = (uint8_t)(*src++) & 0x3f) && +- (src + len) <= src_last) { ++ (src + len) <= src_last && ++ (dst - dst_origin < (ssize_t)dlen)) { + if (dst != dst_origin) + *dst++ = '.'; + warnmsg(LOG_DEBUG, __func__, "labellen = %zd", len); Index: user/cperciva/freebsd-update-build/patches/10.1-RC2/1-SA-14:21.routed =================================================================== --- user/cperciva/freebsd-update-build/patches/10.1-RC2/1-SA-14:21.routed (nonexistent) +++ user/cperciva/freebsd-update-build/patches/10.1-RC2/1-SA-14:21.routed (revision 293366) @@ -0,0 +1,15 @@ +Index: sbin/routed/input.c +=================================================================== +--- sbin/routed/input.c.orig ++++ sbin/routed/input.c +@@ -288,6 +288,10 @@ + /* Answer a query from a utility program + * with all we know. + */ ++ if (aifp == NULL) { ++ trace_pkt("ignore remote query"); ++ return; ++ } + if (from->sin_port != htons(RIP_PORT)) { + supply(from, aifp, OUT_QUERY, 0, + rip->rip_vers, ap != 0); Index: user/cperciva/freebsd-update-build/patches/10.1-RC2/1-SA-14:22.namei =================================================================== --- user/cperciva/freebsd-update-build/patches/10.1-RC2/1-SA-14:22.namei (nonexistent) +++ user/cperciva/freebsd-update-build/patches/10.1-RC2/1-SA-14:22.namei (revision 293366) @@ -0,0 +1,94 @@ +Index: sys/kern/vfs_lookup.c +=================================================================== +--- sys/kern/vfs_lookup.c (revision 273277) ++++ sys/kern/vfs_lookup.c (working copy) +@@ -121,6 +121,16 @@ + * if symbolic link, massage name in buffer and continue + * } + */ ++static void ++namei_cleanup_cnp(struct componentname *cnp) ++{ ++ uma_zfree(namei_zone, cnp->cn_pnbuf); ++#ifdef DIAGNOSTIC ++ cnp->cn_pnbuf = NULL; ++ cnp->cn_nameptr = NULL; ++#endif ++} ++ + int + namei(struct nameidata *ndp) + { +@@ -185,11 +195,7 @@ + } + #endif + if (error) { +- uma_zfree(namei_zone, cnp->cn_pnbuf); +-#ifdef DIAGNOSTIC +- cnp->cn_pnbuf = NULL; +- cnp->cn_nameptr = NULL; +-#endif ++ namei_cleanup_cnp(cnp); + ndp->ni_vp = NULL; + return (error); + } +@@ -256,11 +262,7 @@ + } + } + if (error) { +- uma_zfree(namei_zone, cnp->cn_pnbuf); +-#ifdef DIAGNOSTIC +- cnp->cn_pnbuf = NULL; +- cnp->cn_nameptr = NULL; +-#endif ++ namei_cleanup_cnp(cnp); + return (error); + } + } +@@ -286,6 +288,7 @@ + if (KTRPOINT(curthread, KTR_CAPFAIL)) + ktrcapfail(CAPFAIL_LOOKUP, NULL, NULL); + #endif ++ namei_cleanup_cnp(cnp); + return (ENOTCAPABLE); + } + while (*(cnp->cn_nameptr) == '/') { +@@ -298,11 +301,7 @@ + ndp->ni_startdir = dp; + error = lookup(ndp); + if (error) { +- uma_zfree(namei_zone, cnp->cn_pnbuf); +-#ifdef DIAGNOSTIC +- cnp->cn_pnbuf = NULL; +- cnp->cn_nameptr = NULL; +-#endif ++ namei_cleanup_cnp(cnp); + SDT_PROBE(vfs, namei, lookup, return, error, NULL, 0, + 0, 0); + return (error); +@@ -312,11 +311,7 @@ + */ + if ((cnp->cn_flags & ISSYMLINK) == 0) { + if ((cnp->cn_flags & (SAVENAME | SAVESTART)) == 0) { +- uma_zfree(namei_zone, cnp->cn_pnbuf); +-#ifdef DIAGNOSTIC +- cnp->cn_pnbuf = NULL; +- cnp->cn_nameptr = NULL; +-#endif ++ namei_cleanup_cnp(cnp); + } else + cnp->cn_flags |= HASBUF; + +@@ -378,11 +373,7 @@ + vput(ndp->ni_vp); + dp = ndp->ni_dvp; + } +- uma_zfree(namei_zone, cnp->cn_pnbuf); +-#ifdef DIAGNOSTIC +- cnp->cn_pnbuf = NULL; +- cnp->cn_nameptr = NULL; +-#endif ++ namei_cleanup_cnp(cnp); + vput(ndp->ni_vp); + ndp->ni_vp = NULL; + vrele(ndp->ni_dvp); Index: user/cperciva/freebsd-update-build/patches/10.1-RC2/1-SA-14:23.openssl =================================================================== --- user/cperciva/freebsd-update-build/patches/10.1-RC2/1-SA-14:23.openssl (nonexistent) +++ user/cperciva/freebsd-update-build/patches/10.1-RC2/1-SA-14:23.openssl (revision 293366) @@ -0,0 +1,10230 @@ +Index: ObsoleteFiles.inc +=================================================================== +--- ObsoleteFiles.inc (revision 273303) ++++ ObsoleteFiles.inc (working copy) +@@ -38,6 +38,8 @@ + # xargs -n1 | sort | uniq -d; + # done + ++# 20141015: OpenSSL 1.0.1j import ++OLD_FILES+=usr/share/openssl/man/man3/CMS_sign_add1_signer.3.gz + # 20140917: hv_kvpd rc.d script removed in favor of devd configuration + OLD_FILES+=etc/rc.d/hv_kvpd + # 20140814: libopie version bump +Index: crypto/openssl/CHANGES +=================================================================== +--- crypto/openssl/CHANGES (revision 273303) ++++ crypto/openssl/CHANGES (working copy) +@@ -2,6 +2,57 @@ + OpenSSL CHANGES + _______________ + ++ Changes between 1.0.1i and 1.0.1j [15 Oct 2014] ++ ++ *) SRTP Memory Leak. ++ ++ A flaw in the DTLS SRTP extension parsing code allows an attacker, who ++ sends a carefully crafted handshake message, to cause OpenSSL to fail ++ to free up to 64k of memory causing a memory leak. This could be ++ exploited in a Denial Of Service attack. This issue affects OpenSSL ++ 1.0.1 server implementations for both SSL/TLS and DTLS regardless of ++ whether SRTP is used or configured. Implementations of OpenSSL that ++ have been compiled with OPENSSL_NO_SRTP defined are not affected. ++ ++ The fix was developed by the OpenSSL team. ++ (CVE-2014-3513) ++ [OpenSSL team] ++ ++ *) Session Ticket Memory Leak. ++ ++ When an OpenSSL SSL/TLS/DTLS server receives a session ticket the ++ integrity of that ticket is first verified. In the event of a session ++ ticket integrity check failing, OpenSSL will fail to free memory ++ causing a memory leak. By sending a large number of invalid session ++ tickets an attacker could exploit this issue in a Denial Of Service ++ attack. ++ (CVE-2014-3567) ++ [Steve Henson] ++ ++ *) Build option no-ssl3 is incomplete. ++ ++ When OpenSSL is configured with "no-ssl3" as a build option, servers ++ could accept and complete a SSL 3.0 handshake, and clients could be ++ configured to send them. ++ (CVE-2014-3568) ++ [Akamai and the OpenSSL team] ++ ++ *) Add support for TLS_FALLBACK_SCSV. ++ Client applications doing fallback retries should call ++ SSL_set_mode(s, SSL_MODE_SEND_FALLBACK_SCSV). ++ (CVE-2014-3566) ++ [Adam Langley, Bodo Moeller] ++ ++ *) Add additional DigestInfo checks. ++ ++ Reencode DigestInto in DER and check against the original when ++ verifying RSA signature: this will reject any improperly encoded ++ DigestInfo structures. ++ ++ Note: this is a precautionary measure and no attacks are currently known. ++ ++ [Steve Henson] ++ + Changes between 1.0.1h and 1.0.1i [6 Aug 2014] + + *) Fix SRP buffer overrun vulnerability. Invalid parameters passed to the +Index: crypto/openssl/Configure +=================================================================== +--- crypto/openssl/Configure (revision 273303) ++++ crypto/openssl/Configure (working copy) +@@ -1767,6 +1767,9 @@ open(OUT,'>crypto/opensslconf.h.new') || die "unab + print OUT "/* opensslconf.h */\n"; + print OUT "/* WARNING: Generated automatically from opensslconf.h.in by Configure. */\n\n"; + ++print OUT "#ifdef __cplusplus\n"; ++print OUT "extern \"C\" {\n"; ++print OUT "#endif\n"; + print OUT "/* OpenSSL was configured with the following options: */\n"; + my $openssl_algorithm_defines_trans = $openssl_algorithm_defines; + $openssl_experimental_defines =~ s/^\s*#\s*define\s+OPENSSL_NO_(.*)/#ifndef OPENSSL_EXPERIMENTAL_$1\n# ifndef OPENSSL_NO_$1\n# define OPENSSL_NO_$1\n# endif\n#endif/mg; +@@ -1871,6 +1874,9 @@ while () + { print OUT $_; } + } + close(IN); ++print OUT "#ifdef __cplusplus\n"; ++print OUT "}\n"; ++print OUT "#endif\n"; + close(OUT); + rename("crypto/opensslconf.h","crypto/opensslconf.h.bak") || die "unable to rename crypto/opensslconf.h\n" if -e "crypto/opensslconf.h"; + rename("crypto/opensslconf.h.new","crypto/opensslconf.h") || die "unable to rename crypto/opensslconf.h.new\n"; +Index: crypto/openssl/Makefile +=================================================================== +--- crypto/openssl/Makefile (revision 273303) ++++ crypto/openssl/Makefile (working copy) +@@ -4,7 +4,7 @@ + ## Makefile for OpenSSL + ## + +-VERSION=1.0.1i ++VERSION=1.0.1j + MAJOR=1 + MINOR=0.1 + SHLIB_VERSION_NUMBER=1.0.0 +Index: crypto/openssl/NEWS +=================================================================== +--- crypto/openssl/NEWS (revision 273303) ++++ crypto/openssl/NEWS (working copy) +@@ -5,6 +5,13 @@ + This file gives a brief overview of the major changes between each OpenSSL + release. For more details please read the CHANGES file. + ++ Major changes between OpenSSL 1.0.1i and OpenSSL 1.0.1j [15 Oct 2014] ++ ++ o Fix for CVE-2014-3513 ++ o Fix for CVE-2014-3567 ++ o Mitigation for CVE-2014-3566 (SSL protocol vulnerability) ++ o Fix for CVE-2014-3568 ++ + Major changes between OpenSSL 1.0.1h and OpenSSL 1.0.1i [6 Aug 2014] + + o Fix for CVE-2014-3512 +Index: crypto/openssl/README +=================================================================== +--- crypto/openssl/README (revision 273303) ++++ crypto/openssl/README (working copy) +@@ -1,5 +1,5 @@ + +- OpenSSL 1.0.1i 6 Aug 2014 ++ OpenSSL 1.0.1j 15 Oct 2014 + + Copyright (c) 1998-2011 The OpenSSL Project + Copyright (c) 1995-1998 Eric A. Young, Tim J. Hudson +Index: crypto/openssl/apps/s_client.c +=================================================================== +--- crypto/openssl/apps/s_client.c (revision 273303) ++++ crypto/openssl/apps/s_client.c (working copy) +@@ -337,6 +337,7 @@ static void sc_usage(void) + BIO_printf(bio_err," -tls1_1 - just use TLSv1.1\n"); + BIO_printf(bio_err," -tls1 - just use TLSv1\n"); + BIO_printf(bio_err," -dtls1 - just use DTLSv1\n"); ++ BIO_printf(bio_err," -fallback_scsv - send TLS_FALLBACK_SCSV\n"); + BIO_printf(bio_err," -mtu - set the link layer MTU\n"); + BIO_printf(bio_err," -no_tls1_2/-no_tls1_1/-no_tls1/-no_ssl3/-no_ssl2 - turn off that protocol\n"); + BIO_printf(bio_err," -bugs - Switch on all SSL implementation bug workarounds\n"); +@@ -617,6 +618,7 @@ int MAIN(int argc, char **argv) + char *sess_out = NULL; + struct sockaddr peer; + int peerlen = sizeof(peer); ++ int fallback_scsv = 0; + int enable_timeouts = 0 ; + long socket_mtu = 0; + #ifndef OPENSSL_NO_JPAKE +@@ -823,6 +825,10 @@ int MAIN(int argc, char **argv) + meth=DTLSv1_client_method(); + socket_type=SOCK_DGRAM; + } ++ else if (strcmp(*argv,"-fallback_scsv") == 0) ++ { ++ fallback_scsv = 1; ++ } + else if (strcmp(*argv,"-timeout") == 0) + enable_timeouts=1; + else if (strcmp(*argv,"-mtu") == 0) +@@ -1235,6 +1241,10 @@ bad: + SSL_set_session(con, sess); + SSL_SESSION_free(sess); + } ++ ++ if (fallback_scsv) ++ SSL_set_mode(con, SSL_MODE_SEND_FALLBACK_SCSV); ++ + #ifndef OPENSSL_NO_TLSEXT + if (servername != NULL) + { +Index: crypto/openssl/crypto/Makefile +=================================================================== +--- crypto/openssl/crypto/Makefile (revision 273303) ++++ crypto/openssl/crypto/Makefile (working copy) +@@ -32,6 +32,7 @@ CPUID_OBJ=mem_clr.o + LIBS= + + GENERAL=Makefile README crypto-lib.com install.com ++TEST=constant_time_test.c + + LIB= $(TOP)/libcrypto.a + SHARED_LIB= libcrypto$(SHLIB_EXT) +@@ -44,7 +45,8 @@ SRC= $(LIBSRC) + + EXHEADER= crypto.h opensslv.h opensslconf.h ebcdic.h symhacks.h \ + ossl_typ.h +-HEADER= cryptlib.h buildinf.h md32_common.h o_time.h o_str.h o_dir.h $(EXHEADER) ++HEADER= cryptlib.h buildinf.h md32_common.h o_time.h o_str.h o_dir.h \ ++ constant_time_locl.h $(EXHEADER) + + ALL= $(GENERAL) $(SRC) $(HEADER) + +Index: crypto/openssl/crypto/aes/asm/aesni-x86_64.pl +=================================================================== +--- crypto/openssl/crypto/aes/asm/aesni-x86_64.pl (revision 273303) ++++ crypto/openssl/crypto/aes/asm/aesni-x86_64.pl (working copy) +@@ -525,6 +525,16 @@ $code.=<<___; + .type aesni_ecb_encrypt,\@function,5 + .align 16 + aesni_ecb_encrypt: ++___ ++$code.=<<___ if ($win64); ++ lea -0x58(%rsp),%rsp ++ movaps %xmm6,(%rsp) ++ movaps %xmm7,0x10(%rsp) ++ movaps %xmm8,0x20(%rsp) ++ movaps %xmm9,0x30(%rsp) ++.Lecb_enc_body: ++___ ++$code.=<<___; + and \$-16,$len + jz .Lecb_ret + +@@ -805,6 +815,16 @@ $code.=<<___; + movups $inout5,0x50($out) + + .Lecb_ret: ++___ ++$code.=<<___ if ($win64); ++ movaps (%rsp),%xmm6 ++ movaps 0x10(%rsp),%xmm7 ++ movaps 0x20(%rsp),%xmm8 ++ movaps 0x30(%rsp),%xmm9 ++ lea 0x58(%rsp),%rsp ++.Lecb_enc_ret: ++___ ++$code.=<<___; + ret + .size aesni_ecb_encrypt,.-aesni_ecb_encrypt + ___ +@@ -2730,9 +2750,9 @@ $code.=<<___; + .extern __imp_RtlVirtualUnwind + ___ + $code.=<<___ if ($PREFIX eq "aesni"); +-.type ecb_se_handler,\@abi-omnipotent ++.type ecb_ccm64_se_handler,\@abi-omnipotent + .align 16 +-ecb_se_handler: ++ecb_ccm64_se_handler: + push %rsi + push %rdi + push %rbx +@@ -2744,25 +2764,6 @@ $code.=<<___ if ($PREFIX eq "aesni"); + pushfq + sub \$64,%rsp + +- mov 152($context),%rax # pull context->Rsp +- +- jmp .Lcommon_seh_tail +-.size ecb_se_handler,.-ecb_se_handler +- +-.type ccm64_se_handler,\@abi-omnipotent +-.align 16 +-ccm64_se_handler: +- push %rsi +- push %rdi +- push %rbx +- push %rbp +- push %r12 +- push %r13 +- push %r14 +- push %r15 +- pushfq +- sub \$64,%rsp +- + mov 120($context),%rax # pull context->Rax + mov 248($context),%rbx # pull context->Rip + +@@ -2788,7 +2789,7 @@ $code.=<<___ if ($PREFIX eq "aesni"); + lea 0x58(%rax),%rax # adjust stack pointer + + jmp .Lcommon_seh_tail +-.size ccm64_se_handler,.-ccm64_se_handler ++.size ecb_ccm64_se_handler,.-ecb_ccm64_se_handler + + .type ctr32_se_handler,\@abi-omnipotent + .align 16 +@@ -2993,14 +2994,15 @@ ___ + $code.=<<___ if ($PREFIX eq "aesni"); + .LSEH_info_ecb: + .byte 9,0,0,0 +- .rva ecb_se_handler ++ .rva ecb_ccm64_se_handler ++ .rva .Lecb_enc_body,.Lecb_enc_ret # HandlerData[] + .LSEH_info_ccm64_enc: + .byte 9,0,0,0 +- .rva ccm64_se_handler ++ .rva ecb_ccm64_se_handler + .rva .Lccm64_enc_body,.Lccm64_enc_ret # HandlerData[] + .LSEH_info_ccm64_dec: + .byte 9,0,0,0 +- .rva ccm64_se_handler ++ .rva ecb_ccm64_se_handler + .rva .Lccm64_dec_body,.Lccm64_dec_ret # HandlerData[] + .LSEH_info_ctr32: + .byte 9,0,0,0 +Index: crypto/openssl/crypto/asn1/a_strex.c +=================================================================== +--- crypto/openssl/crypto/asn1/a_strex.c (revision 273303) ++++ crypto/openssl/crypto/asn1/a_strex.c (working copy) +@@ -568,6 +568,7 @@ int ASN1_STRING_to_UTF8(unsigned char **out, ASN1_ + mbflag |= MBSTRING_FLAG; + stmp.data = NULL; + stmp.length = 0; ++ stmp.flags = 0; + ret = ASN1_mbstring_copy(&str, in->data, in->length, mbflag, B_ASN1_UTF8STRING); + if(ret < 0) return ret; + *out = stmp.data; +Index: crypto/openssl/crypto/bn/asm/x86_64-gcc.c +=================================================================== +--- crypto/openssl/crypto/bn/asm/x86_64-gcc.c (revision 273303) ++++ crypto/openssl/crypto/bn/asm/x86_64-gcc.c (working copy) +@@ -189,7 +189,7 @@ BN_ULONG bn_add_words (BN_ULONG *rp, const BN_ULON + + if (n <= 0) return 0; + +- asm ( ++ asm volatile ( + " subq %2,%2 \n" + ".p2align 4 \n" + "1: movq (%4,%2,8),%0 \n" +@@ -200,7 +200,7 @@ BN_ULONG bn_add_words (BN_ULONG *rp, const BN_ULON + " sbbq %0,%0 \n" + : "=&a"(ret),"+c"(n),"=&r"(i) + : "r"(rp),"r"(ap),"r"(bp) +- : "cc" ++ : "cc", "memory" + ); + + return ret&1; +@@ -212,7 +212,7 @@ BN_ULONG bn_sub_words (BN_ULONG *rp, const BN_ULON + + if (n <= 0) return 0; + +- asm ( ++ asm volatile ( + " subq %2,%2 \n" + ".p2align 4 \n" + "1: movq (%4,%2,8),%0 \n" +@@ -223,7 +223,7 @@ BN_ULONG bn_sub_words (BN_ULONG *rp, const BN_ULON + " sbbq %0,%0 \n" + : "=&a"(ret),"+c"(n),"=&r"(i) + : "r"(rp),"r"(ap),"r"(bp) +- : "cc" ++ : "cc", "memory" + ); + + return ret&1; +Index: crypto/openssl/crypto/bn/bn_exp.c +=================================================================== +--- crypto/openssl/crypto/bn/bn_exp.c (revision 273303) ++++ crypto/openssl/crypto/bn/bn_exp.c (working copy) +@@ -874,7 +874,14 @@ int BN_mod_exp_mont_word(BIGNUM *rr, BN_ULONG a, c + bits = BN_num_bits(p); + if (bits == 0) + { +- ret = BN_one(rr); ++ /* x**0 mod 1 is still zero. */ ++ if (BN_is_one(m)) ++ { ++ ret = 1; ++ BN_zero(rr); ++ } ++ else ++ ret = BN_one(rr); + return ret; + } + if (a == 0) +Index: crypto/openssl/crypto/bn/bn_nist.c +=================================================================== +--- crypto/openssl/crypto/bn/bn_nist.c (revision 273303) ++++ crypto/openssl/crypto/bn/bn_nist.c (working copy) +@@ -1088,9 +1088,9 @@ int BN_nist_mod_521(BIGNUM *r, const BIGNUM *a, co + /* ... and right shift */ + for (val=t_d[0],i=0; i>BN_NIST_521_RSHIFT; +- val = t_d[i+1]; +- t_d[i] = (tmp | val<>BN_NIST_521_RSHIFT | ++ (tmp=t_d[i+1])<>BN_NIST_521_RSHIFT; + /* lower 521 bits */ +Index: crypto/openssl/crypto/bn/exptest.c +=================================================================== +--- crypto/openssl/crypto/bn/exptest.c (revision 273303) ++++ crypto/openssl/crypto/bn/exptest.c (working copy) +@@ -71,6 +71,43 @@ + + static const char rnd_seed[] = "string to make the random number generator think it has entropy"; + ++/* test_exp_mod_zero tests that x**0 mod 1 == 0. It returns zero on success. */ ++static int test_exp_mod_zero() { ++ BIGNUM a, p, m; ++ BIGNUM r; ++ BN_CTX *ctx = BN_CTX_new(); ++ int ret = 1; ++ ++ BN_init(&m); ++ BN_one(&m); ++ ++ BN_init(&a); ++ BN_one(&a); ++ ++ BN_init(&p); ++ BN_zero(&p); ++ ++ BN_init(&r); ++ BN_mod_exp(&r, &a, &p, &m, ctx); ++ BN_CTX_free(ctx); ++ ++ if (BN_is_zero(&r)) ++ ret = 0; ++ else ++ { ++ printf("1**0 mod 1 = "); ++ BN_print_fp(stdout, &r); ++ printf(", should be 0\n"); ++ } ++ ++ BN_free(&r); ++ BN_free(&a); ++ BN_free(&p); ++ BN_free(&m); ++ ++ return ret; ++} ++ + int main(int argc, char *argv[]) + { + BN_CTX *ctx; +@@ -190,7 +227,13 @@ int main(int argc, char *argv[]) + ERR_remove_thread_state(NULL); + CRYPTO_mem_leaks(out); + BIO_free(out); +- printf(" done\n"); ++ printf("\n"); ++ ++ if (test_exp_mod_zero() != 0) ++ goto err; ++ ++ printf("done\n"); ++ + EXIT(0); + err: + ERR_load_crypto_strings(); +Index: crypto/openssl/crypto/constant_time_locl.h +=================================================================== +--- crypto/openssl/crypto/constant_time_locl.h (revision 0) ++++ crypto/openssl/crypto/constant_time_locl.h (working copy) +@@ -0,0 +1,216 @@ ++/* crypto/constant_time_locl.h */ ++/* ++ * Utilities for constant-time cryptography. ++ * ++ * Author: Emilia Kasper (emilia@openssl.org) ++ * Based on previous work by Bodo Moeller, Emilia Kasper, Adam Langley ++ * (Google). ++ * ==================================================================== ++ * Copyright (c) 2014 The OpenSSL Project. All rights reserved. ++ * ++ * Redistribution and use in source and binary forms, with or without ++ * modification, are permitted provided that the following conditions ++ * are met: ++ * 1. Redistributions of source code must retain the copyright ++ * notice, this list of conditions and the following disclaimer. ++ * 2. Redistributions in binary form must reproduce the above copyright ++ * notice, this list of conditions and the following disclaimer in the ++ * documentation and/or other materials provided with the distribution. ++ * 3. All advertising materials mentioning features or use of this software ++ * must display the following acknowledgement: ++ * "This product includes cryptographic software written by ++ * Eric Young (eay@cryptsoft.com)" ++ * The word 'cryptographic' can be left out if the rouines from the library ++ * being used are not cryptographic related :-). ++ * 4. If you include any Windows specific code (or a derivative thereof) from ++ * the apps directory (application code) you must include an acknowledgement: ++ * "This product includes software written by Tim Hudson (tjh@cryptsoft.com)" ++ * ++ * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND ++ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE ++ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ++ * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE ++ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL ++ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS ++ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) ++ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT ++ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY ++ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF ++ * SUCH DAMAGE. ++ * ++ * The licence and distribution terms for any publically available version or ++ * derivative of this code cannot be changed. i.e. this code cannot simply be ++ * copied and put under another distribution licence ++ * [including the GNU Public Licence.] ++ */ ++ ++#ifndef HEADER_CONSTANT_TIME_LOCL_H ++#define HEADER_CONSTANT_TIME_LOCL_H ++ ++#include "e_os.h" /* For 'inline' */ ++ ++#ifdef __cplusplus ++extern "C" { ++#endif ++ ++/* ++ * The boolean methods return a bitmask of all ones (0xff...f) for true ++ * and 0 for false. This is useful for choosing a value based on the result ++ * of a conditional in constant time. For example, ++ * ++ * if (a < b) { ++ * c = a; ++ * } else { ++ * c = b; ++ * } ++ * ++ * can be written as ++ * ++ * unsigned int lt = constant_time_lt(a, b); ++ * c = constant_time_select(lt, a, b); ++ */ ++ ++/* ++ * Returns the given value with the MSB copied to all the other ++ * bits. Uses the fact that arithmetic shift shifts-in the sign bit. ++ * However, this is not ensured by the C standard so you may need to ++ * replace this with something else on odd CPUs. ++ */ ++static inline unsigned int constant_time_msb(unsigned int a); ++ ++/* ++ * Returns 0xff..f if a < b and 0 otherwise. ++ */ ++static inline unsigned int constant_time_lt(unsigned int a, unsigned int b); ++/* Convenience method for getting an 8-bit mask. */ ++static inline unsigned char constant_time_lt_8(unsigned int a, unsigned int b); ++ ++/* ++ * Returns 0xff..f if a >= b and 0 otherwise. ++ */ ++static inline unsigned int constant_time_ge(unsigned int a, unsigned int b); ++/* Convenience method for getting an 8-bit mask. */ ++static inline unsigned char constant_time_ge_8(unsigned int a, unsigned int b); ++ ++/* ++ * Returns 0xff..f if a == 0 and 0 otherwise. ++ */ ++static inline unsigned int constant_time_is_zero(unsigned int a); ++/* Convenience method for getting an 8-bit mask. */ ++static inline unsigned char constant_time_is_zero_8(unsigned int a); ++ ++ ++/* ++ * Returns 0xff..f if a == b and 0 otherwise. ++ */ ++static inline unsigned int constant_time_eq(unsigned int a, unsigned int b); ++/* Convenience method for getting an 8-bit mask. */ ++static inline unsigned char constant_time_eq_8(unsigned int a, unsigned int b); ++/* Signed integers. */ ++static inline unsigned int constant_time_eq_int(int a, int b); ++/* Convenience method for getting an 8-bit mask. */ ++static inline unsigned char constant_time_eq_int_8(int a, int b); ++ ++ ++/* ++ * Returns (mask & a) | (~mask & b). ++ * ++ * When |mask| is all 1s or all 0s (as returned by the methods above), ++ * the select methods return either |a| (if |mask| is nonzero) or |b| ++ * (if |mask| is zero). ++ */ ++static inline unsigned int constant_time_select(unsigned int mask, ++ unsigned int a, unsigned int b); ++/* Convenience method for unsigned chars. */ ++static inline unsigned char constant_time_select_8(unsigned char mask, ++ unsigned char a, unsigned char b); ++/* Convenience method for signed integers. */ ++static inline int constant_time_select_int(unsigned int mask, int a, int b); ++ ++static inline unsigned int constant_time_msb(unsigned int a) ++ { ++ return (unsigned int)((int)(a) >> (sizeof(int) * 8 - 1)); ++ } ++ ++static inline unsigned int constant_time_lt(unsigned int a, unsigned int b) ++ { ++ unsigned int lt; ++ /* Case 1: msb(a) == msb(b). a < b iff the MSB of a - b is set.*/ ++ lt = ~(a ^ b) & (a - b); ++ /* Case 2: msb(a) != msb(b). a < b iff the MSB of b is set. */ ++ lt |= ~a & b; ++ return constant_time_msb(lt); ++ } ++ ++static inline unsigned char constant_time_lt_8(unsigned int a, unsigned int b) ++ { ++ return (unsigned char)(constant_time_lt(a, b)); ++ } ++ ++static inline unsigned int constant_time_ge(unsigned int a, unsigned int b) ++ { ++ unsigned int ge; ++ /* Case 1: msb(a) == msb(b). a >= b iff the MSB of a - b is not set.*/ ++ ge = ~((a ^ b) | (a - b)); ++ /* Case 2: msb(a) != msb(b). a >= b iff the MSB of a is set. */ ++ ge |= a & ~b; ++ return constant_time_msb(ge); ++ } ++ ++static inline unsigned char constant_time_ge_8(unsigned int a, unsigned int b) ++ { ++ return (unsigned char)(constant_time_ge(a, b)); ++ } ++ ++static inline unsigned int constant_time_is_zero(unsigned int a) ++ { ++ return constant_time_msb(~a & (a - 1)); ++ } ++ ++static inline unsigned char constant_time_is_zero_8(unsigned int a) ++ { ++ return (unsigned char)(constant_time_is_zero(a)); ++ } ++ ++static inline unsigned int constant_time_eq(unsigned int a, unsigned int b) ++ { ++ return constant_time_is_zero(a ^ b); ++ } ++ ++static inline unsigned char constant_time_eq_8(unsigned int a, unsigned int b) ++ { ++ return (unsigned char)(constant_time_eq(a, b)); ++ } ++ ++static inline unsigned int constant_time_eq_int(int a, int b) ++ { ++ return constant_time_eq((unsigned)(a), (unsigned)(b)); ++ } ++ ++static inline unsigned char constant_time_eq_int_8(int a, int b) ++ { ++ return constant_time_eq_8((unsigned)(a), (unsigned)(b)); ++ } ++ ++static inline unsigned int constant_time_select(unsigned int mask, ++ unsigned int a, unsigned int b) ++ { ++ return (mask & a) | (~mask & b); ++ } ++ ++static inline unsigned char constant_time_select_8(unsigned char mask, ++ unsigned char a, unsigned char b) ++ { ++ return (unsigned char)(constant_time_select(mask, a, b)); ++ } ++ ++inline int constant_time_select_int(unsigned int mask, int a, int b) ++ { ++ return (int)(constant_time_select(mask, (unsigned)(a), (unsigned)(b))); ++ } ++ ++#ifdef __cplusplus ++} ++#endif ++ ++#endif /* HEADER_CONSTANT_TIME_LOCL_H */ + +Property changes on: crypto/openssl/crypto/constant_time_locl.h +___________________________________________________________________ +Added: svn:keywords +## -0,0 +1 ## ++FreeBSD=%H +\ No newline at end of property +Added: svn:eol-style +## -0,0 +1 ## ++native +\ No newline at end of property +Added: svn:mime-type +## -0,0 +1 ## ++text/plain +\ No newline at end of property +Index: crypto/openssl/crypto/constant_time_test.c +=================================================================== +--- crypto/openssl/crypto/constant_time_test.c (revision 0) ++++ crypto/openssl/crypto/constant_time_test.c (working copy) +@@ -0,0 +1,330 @@ ++/* crypto/constant_time_test.c */ ++/* ++ * Utilities for constant-time cryptography. ++ * ++ * Author: Emilia Kasper (emilia@openssl.org) ++ * Based on previous work by Bodo Moeller, Emilia Kasper, Adam Langley ++ * (Google). ++ * ==================================================================== ++ * Copyright (c) 2014 The OpenSSL Project. All rights reserved. ++ * ++ * Redistribution and use in source and binary forms, with or without ++ * modification, are permitted provided that the following conditions ++ * are met: ++ * 1. Redistributions of source code must retain the copyright ++ * notice, this list of conditions and the following disclaimer. ++ * 2. Redistributions in binary form must reproduce the above copyright ++ * notice, this list of conditions and the following disclaimer in the ++ * documentation and/or other materials provided with the distribution. ++ * 3. All advertising materials mentioning features or use of this software ++ * must display the following acknowledgement: ++ * "This product includes cryptographic software written by ++ * Eric Young (eay@cryptsoft.com)" ++ * The word 'cryptographic' can be left out if the rouines from the library ++ * being used are not cryptographic related :-). ++ * 4. If you include any Windows specific code (or a derivative thereof) from ++ * the apps directory (application code) you must include an acknowledgement: ++ * "This product includes software written by Tim Hudson (tjh@cryptsoft.com)" ++ * ++ * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND ++ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE ++ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ++ * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE ++ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL ++ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS ++ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) ++ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT ++ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY ++ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF ++ * SUCH DAMAGE. ++ * ++ * The licence and distribution terms for any publically available version or ++ * derivative of this code cannot be changed. i.e. this code cannot simply be ++ * copied and put under another distribution licence ++ * [including the GNU Public Licence.] ++ */ ++ ++#include "../crypto/constant_time_locl.h" ++ ++#include ++#include ++#include ++ ++static const unsigned int CONSTTIME_TRUE = (unsigned)(~0); ++static const unsigned int CONSTTIME_FALSE = 0; ++static const unsigned char CONSTTIME_TRUE_8 = 0xff; ++static const unsigned char CONSTTIME_FALSE_8 = 0; ++ ++static int test_binary_op(unsigned int (*op)(unsigned int a, unsigned int b), ++ const char* op_name, unsigned int a, unsigned int b, int is_true) ++ { ++ unsigned c = op(a, b); ++ if (is_true && c != CONSTTIME_TRUE) ++ { ++ fprintf(stderr, "Test failed for %s(%du, %du): expected %du " ++ "(TRUE), got %du\n", op_name, a, b, CONSTTIME_TRUE, c); ++ return 1; ++ } ++ else if (!is_true && c != CONSTTIME_FALSE) ++ { ++ fprintf(stderr, "Test failed for %s(%du, %du): expected %du " ++ "(FALSE), got %du\n", op_name, a, b, CONSTTIME_FALSE, ++ c); ++ return 1; ++ } ++ return 0; ++ } ++ ++static int test_binary_op_8(unsigned char (*op)(unsigned int a, unsigned int b), ++ const char* op_name, unsigned int a, unsigned int b, int is_true) ++ { ++ unsigned char c = op(a, b); ++ if (is_true && c != CONSTTIME_TRUE_8) ++ { ++ fprintf(stderr, "Test failed for %s(%du, %du): expected %u " ++ "(TRUE), got %u\n", op_name, a, b, CONSTTIME_TRUE_8, c); ++ return 1; ++ } ++ else if (!is_true && c != CONSTTIME_FALSE_8) ++ { ++ fprintf(stderr, "Test failed for %s(%du, %du): expected %u " ++ "(FALSE), got %u\n", op_name, a, b, CONSTTIME_FALSE_8, ++ c); ++ return 1; ++ } ++ return 0; ++ } ++ ++static int test_is_zero(unsigned int a) ++ { ++ unsigned int c = constant_time_is_zero(a); ++ if (a == 0 && c != CONSTTIME_TRUE) ++ { ++ fprintf(stderr, "Test failed for constant_time_is_zero(%du): " ++ "expected %du (TRUE), got %du\n", a, CONSTTIME_TRUE, c); ++ return 1; ++ } ++ else if (a != 0 && c != CONSTTIME_FALSE) ++ { ++ fprintf(stderr, "Test failed for constant_time_is_zero(%du): " ++ "expected %du (FALSE), got %du\n", a, CONSTTIME_FALSE, ++ c); ++ return 1; ++ } ++ return 0; ++ } ++ ++static int test_is_zero_8(unsigned int a) ++ { ++ unsigned char c = constant_time_is_zero_8(a); ++ if (a == 0 && c != CONSTTIME_TRUE_8) ++ { ++ fprintf(stderr, "Test failed for constant_time_is_zero(%du): " ++ "expected %u (TRUE), got %u\n", a, CONSTTIME_TRUE_8, c); ++ return 1; ++ } ++ else if (a != 0 && c != CONSTTIME_FALSE) ++ { ++ fprintf(stderr, "Test failed for constant_time_is_zero(%du): " ++ "expected %u (FALSE), got %u\n", a, CONSTTIME_FALSE_8, ++ c); ++ return 1; ++ } ++ return 0; ++ } ++ ++static int test_select(unsigned int a, unsigned int b) ++ { ++ unsigned int selected = constant_time_select(CONSTTIME_TRUE, a, b); ++ if (selected != a) ++ { ++ fprintf(stderr, "Test failed for constant_time_select(%du, %du," ++ "%du): expected %du(first value), got %du\n", ++ CONSTTIME_TRUE, a, b, a, selected); ++ return 1; ++ } ++ selected = constant_time_select(CONSTTIME_FALSE, a, b); ++ if (selected != b) ++ { ++ fprintf(stderr, "Test failed for constant_time_select(%du, %du," ++ "%du): expected %du(second value), got %du\n", ++ CONSTTIME_FALSE, a, b, b, selected); ++ return 1; ++ } ++ return 0; ++ } ++ ++static int test_select_8(unsigned char a, unsigned char b) ++ { ++ unsigned char selected = constant_time_select_8(CONSTTIME_TRUE_8, a, b); ++ if (selected != a) ++ { ++ fprintf(stderr, "Test failed for constant_time_select(%u, %u," ++ "%u): expected %u(first value), got %u\n", ++ CONSTTIME_TRUE, a, b, a, selected); ++ return 1; ++ } ++ selected = constant_time_select_8(CONSTTIME_FALSE_8, a, b); ++ if (selected != b) ++ { ++ fprintf(stderr, "Test failed for constant_time_select(%u, %u," ++ "%u): expected %u(second value), got %u\n", ++ CONSTTIME_FALSE, a, b, b, selected); ++ return 1; ++ } ++ return 0; ++ } ++ ++static int test_select_int(int a, int b) ++ { ++ int selected = constant_time_select_int(CONSTTIME_TRUE, a, b); ++ if (selected != a) ++ { ++ fprintf(stderr, "Test failed for constant_time_select(%du, %d," ++ "%d): expected %d(first value), got %d\n", ++ CONSTTIME_TRUE, a, b, a, selected); ++ return 1; ++ } ++ selected = constant_time_select_int(CONSTTIME_FALSE, a, b); ++ if (selected != b) ++ { ++ fprintf(stderr, "Test failed for constant_time_select(%du, %d," ++ "%d): expected %d(second value), got %d\n", ++ CONSTTIME_FALSE, a, b, b, selected); ++ return 1; ++ } ++ return 0; ++ } ++ ++static int test_eq_int(int a, int b) ++ { ++ unsigned int equal = constant_time_eq_int(a, b); ++ if (a == b && equal != CONSTTIME_TRUE) ++ { ++ fprintf(stderr, "Test failed for constant_time_eq_int(%d, %d): " ++ "expected %du(TRUE), got %du\n", ++ a, b, CONSTTIME_TRUE, equal); ++ return 1; ++ } ++ else if (a != b && equal != CONSTTIME_FALSE) ++ { ++ fprintf(stderr, "Test failed for constant_time_eq_int(%d, %d): " ++ "expected %du(FALSE), got %du\n", ++ a, b, CONSTTIME_FALSE, equal); ++ return 1; ++ } ++ return 0; ++ } ++ ++static int test_eq_int_8(int a, int b) ++ { ++ unsigned char equal = constant_time_eq_int_8(a, b); ++ if (a == b && equal != CONSTTIME_TRUE_8) ++ { ++ fprintf(stderr, "Test failed for constant_time_eq_int_8(%d, %d): " ++ "expected %u(TRUE), got %u\n", ++ a, b, CONSTTIME_TRUE_8, equal); ++ return 1; ++ } ++ else if (a != b && equal != CONSTTIME_FALSE_8) ++ { ++ fprintf(stderr, "Test failed for constant_time_eq_int_8(%d, %d): " ++ "expected %u(FALSE), got %u\n", ++ a, b, CONSTTIME_FALSE_8, equal); ++ return 1; ++ } ++ return 0; ++ } ++ ++static unsigned int test_values[] = {0, 1, 1024, 12345, 32000, UINT_MAX/2-1, ++ UINT_MAX/2, UINT_MAX/2+1, UINT_MAX-1, ++ UINT_MAX}; ++ ++static unsigned char test_values_8[] = {0, 1, 2, 20, 32, 127, 128, 129, 255}; ++ ++static int signed_test_values[] = {0, 1, -1, 1024, -1024, 12345, -12345, ++ 32000, -32000, INT_MAX, INT_MIN, INT_MAX-1, ++ INT_MIN+1}; ++ ++ ++int main(int argc, char *argv[]) ++ { ++ unsigned int a, b, i, j; ++ int c, d; ++ unsigned char e, f; ++ int num_failed = 0, num_all = 0; ++ fprintf(stdout, "Testing constant time operations...\n"); ++ ++ for (i = 0; i < sizeof(test_values)/sizeof(int); ++i) ++ { ++ a = test_values[i]; ++ num_failed += test_is_zero(a); ++ num_failed += test_is_zero_8(a); ++ num_all += 2; ++ for (j = 0; j < sizeof(test_values)/sizeof(int); ++j) ++ { ++ b = test_values[j]; ++ num_failed += test_binary_op(&constant_time_lt, ++ "constant_time_lt", a, b, a < b); ++ num_failed += test_binary_op_8(&constant_time_lt_8, ++ "constant_time_lt_8", a, b, a < b); ++ num_failed += test_binary_op(&constant_time_lt, ++ "constant_time_lt_8", b, a, b < a); ++ num_failed += test_binary_op_8(&constant_time_lt_8, ++ "constant_time_lt_8", b, a, b < a); ++ num_failed += test_binary_op(&constant_time_ge, ++ "constant_time_ge", a, b, a >= b); ++ num_failed += test_binary_op_8(&constant_time_ge_8, ++ "constant_time_ge_8", a, b, a >= b); ++ num_failed += test_binary_op(&constant_time_ge, ++ "constant_time_ge", b, a, b >= a); ++ num_failed += test_binary_op_8(&constant_time_ge_8, ++ "constant_time_ge_8", b, a, b >= a); ++ num_failed += test_binary_op(&constant_time_eq, ++ "constant_time_eq", a, b, a == b); ++ num_failed += test_binary_op_8(&constant_time_eq_8, ++ "constant_time_eq_8", a, b, a == b); ++ num_failed += test_binary_op(&constant_time_eq, ++ "constant_time_eq", b, a, b == a); ++ num_failed += test_binary_op_8(&constant_time_eq_8, ++ "constant_time_eq_8", b, a, b == a); ++ num_failed += test_select(a, b); ++ num_all += 13; ++ } ++ } ++ ++ for (i = 0; i < sizeof(signed_test_values)/sizeof(int); ++i) ++ { ++ c = signed_test_values[i]; ++ for (j = 0; j < sizeof(signed_test_values)/sizeof(int); ++j) ++ { ++ d = signed_test_values[j]; ++ num_failed += test_select_int(c, d); ++ num_failed += test_eq_int(c, d); ++ num_failed += test_eq_int_8(c, d); ++ num_all += 3; ++ } ++ } ++ ++ for (i = 0; i < sizeof(test_values_8); ++i) ++ { ++ e = test_values_8[i]; ++ for (j = 0; j < sizeof(test_values_8); ++j) ++ { ++ f = test_values_8[j]; ++ num_failed += test_select_8(e, f); ++ num_all += 1; ++ } ++ } ++ ++ if (!num_failed) ++ { ++ fprintf(stdout, "ok (ran %d tests)\n", num_all); ++ return EXIT_SUCCESS; ++ } ++ else ++ { ++ fprintf(stdout, "%d of %d tests failed!\n", num_failed, num_all); ++ return EXIT_FAILURE; ++ } ++ } + +Property changes on: crypto/openssl/crypto/constant_time_test.c +___________________________________________________________________ +Added: svn:eol-style +## -0,0 +1 ## ++native +\ No newline at end of property +Added: svn:mime-type +## -0,0 +1 ## ++text/plain +\ No newline at end of property +Added: svn:keywords +## -0,0 +1 ## ++FreeBSD=%H +\ No newline at end of property +Index: crypto/openssl/crypto/dsa/dsa_ameth.c +=================================================================== +--- crypto/openssl/crypto/dsa/dsa_ameth.c (revision 273303) ++++ crypto/openssl/crypto/dsa/dsa_ameth.c (working copy) +@@ -307,6 +307,12 @@ static int dsa_priv_encode(PKCS8_PRIV_KEY_INFO *p8 + unsigned char *dp = NULL; + int dplen; + ++ if (!pkey->pkey.dsa || !pkey->pkey.dsa->priv_key) ++ { ++ DSAerr(DSA_F_DSA_PRIV_ENCODE,DSA_R_MISSING_PARAMETERS); ++ goto err; ++ } ++ + params = ASN1_STRING_new(); + + if (!params) +@@ -701,4 +707,3 @@ const EVP_PKEY_ASN1_METHOD dsa_asn1_meths[] = + old_dsa_priv_encode + } + }; +- +Index: crypto/openssl/crypto/ebcdic.h +=================================================================== +--- crypto/openssl/crypto/ebcdic.h (revision 273303) ++++ crypto/openssl/crypto/ebcdic.h (working copy) +@@ -5,6 +5,10 @@ + + #include + ++#ifdef __cplusplus ++extern "C" { ++#endif ++ + /* Avoid name clashes with other applications */ + #define os_toascii _openssl_os_toascii + #define os_toebcdic _openssl_os_toebcdic +@@ -16,4 +20,7 @@ extern const unsigned char os_toebcdic[256]; + void *ebcdic2ascii(void *dest, const void *srce, size_t count); + void *ascii2ebcdic(void *dest, const void *srce, size_t count); + ++#ifdef __cplusplus ++} + #endif ++#endif +Index: crypto/openssl/crypto/ec/ec.h +=================================================================== +--- crypto/openssl/crypto/ec/ec.h (revision 273303) ++++ crypto/openssl/crypto/ec/ec.h (working copy) +@@ -629,7 +629,7 @@ int EC_POINT_cmp(const EC_GROUP *group, const EC_P + int EC_POINT_make_affine(const EC_GROUP *group, EC_POINT *point, BN_CTX *ctx); + int EC_POINTs_make_affine(const EC_GROUP *group, size_t num, EC_POINT *points[], BN_CTX *ctx); + +-/** Computes r = generator * n sum_{i=0}^num p[i] * m[i] ++/** Computes r = generator * n sum_{i=0}^{num-1} p[i] * m[i] + * \param group underlying EC_GROUP object + * \param r EC_POINT object for the result + * \param n BIGNUM with the multiplier for the group generator (optional) +Index: crypto/openssl/crypto/ec/ec2_smpl.c +=================================================================== +--- crypto/openssl/crypto/ec/ec2_smpl.c (revision 273303) ++++ crypto/openssl/crypto/ec/ec2_smpl.c (working copy) +@@ -80,9 +80,6 @@ + + const EC_METHOD *EC_GF2m_simple_method(void) + { +-#ifdef OPENSSL_FIPS +- return fips_ec_gf2m_simple_method(); +-#else + static const EC_METHOD ret = { + EC_FLAGS_DEFAULT_OCT, + NID_X9_62_characteristic_two_field, +@@ -125,8 +122,12 @@ const EC_METHOD *EC_GF2m_simple_method(void) + 0 /* field_decode */, + 0 /* field_set_to_one */ }; + ++#ifdef OPENSSL_FIPS ++ if (FIPS_mode()) ++ return fips_ec_gf2m_simple_method(); ++#endif ++ + return &ret; +-#endif + } + + +Index: crypto/openssl/crypto/ec/ec_ameth.c +=================================================================== +--- crypto/openssl/crypto/ec/ec_ameth.c (revision 273303) ++++ crypto/openssl/crypto/ec/ec_ameth.c (working copy) +@@ -453,14 +453,16 @@ static int do_EC_KEY_print(BIO *bp, const EC_KEY * + if (ktype > 0) + { + public_key = EC_KEY_get0_public_key(x); +- if ((pub_key = EC_POINT_point2bn(group, public_key, +- EC_KEY_get_conv_form(x), NULL, ctx)) == NULL) ++ if (public_key != NULL) + { +- reason = ERR_R_EC_LIB; +- goto err; ++ if ((pub_key = EC_POINT_point2bn(group, public_key, ++ EC_KEY_get_conv_form(x), NULL, ctx)) == NULL) ++ { ++ reason = ERR_R_EC_LIB; ++ goto err; ++ } ++ buf_len = (size_t)BN_num_bytes(pub_key); + } +- if (pub_key) +- buf_len = (size_t)BN_num_bytes(pub_key); + } + + if (ktype == 2) +Index: crypto/openssl/crypto/ec/ec_asn1.c +=================================================================== +--- crypto/openssl/crypto/ec/ec_asn1.c (revision 273303) ++++ crypto/openssl/crypto/ec/ec_asn1.c (working copy) +@@ -1183,30 +1183,47 @@ EC_KEY *d2i_ECPrivateKey(EC_KEY **a, const unsigne + goto err; + } + ++ if (ret->pub_key) ++ EC_POINT_clear_free(ret->pub_key); ++ ret->pub_key = EC_POINT_new(ret->group); ++ if (ret->pub_key == NULL) ++ { ++ ECerr(EC_F_D2I_ECPRIVATEKEY, ERR_R_EC_LIB); ++ goto err; ++ } ++ + if (priv_key->publicKey) + { + const unsigned char *pub_oct; +- size_t pub_oct_len; ++ int pub_oct_len; + +- if (ret->pub_key) +- EC_POINT_clear_free(ret->pub_key); +- ret->pub_key = EC_POINT_new(ret->group); +- if (ret->pub_key == NULL) ++ pub_oct = M_ASN1_STRING_data(priv_key->publicKey); ++ pub_oct_len = M_ASN1_STRING_length(priv_key->publicKey); ++ /* The first byte - point conversion form - must be present. */ ++ if (pub_oct_len <= 0) + { +- ECerr(EC_F_D2I_ECPRIVATEKEY, ERR_R_EC_LIB); ++ ECerr(EC_F_D2I_ECPRIVATEKEY, EC_R_BUFFER_TOO_SMALL); + goto err; + } +- pub_oct = M_ASN1_STRING_data(priv_key->publicKey); +- pub_oct_len = M_ASN1_STRING_length(priv_key->publicKey); +- /* save the point conversion form */ ++ /* Save the point conversion form. */ + ret->conv_form = (point_conversion_form_t)(pub_oct[0] & ~0x01); + if (!EC_POINT_oct2point(ret->group, ret->pub_key, +- pub_oct, pub_oct_len, NULL)) ++ pub_oct, (size_t)(pub_oct_len), NULL)) + { + ECerr(EC_F_D2I_ECPRIVATEKEY, ERR_R_EC_LIB); + goto err; + } + } ++ else ++ { ++ if (!EC_POINT_mul(ret->group, ret->pub_key, ret->priv_key, NULL, NULL, NULL)) ++ { ++ ECerr(EC_F_D2I_ECPRIVATEKEY, ERR_R_EC_LIB); ++ goto err; ++ } ++ /* Remember the original private-key-only encoding. */ ++ ret->enc_flag |= EC_PKEY_NO_PUBKEY; ++ } + + ok = 1; + err: +@@ -1230,7 +1247,8 @@ int i2d_ECPrivateKey(EC_KEY *a, unsigned char **ou + size_t buf_len=0, tmp_len; + EC_PRIVATEKEY *priv_key=NULL; + +- if (a == NULL || a->group == NULL || a->priv_key == NULL) ++ if (a == NULL || a->group == NULL || a->priv_key == NULL || ++ (!(a->enc_flag & EC_PKEY_NO_PUBKEY) && a->pub_key == NULL)) + { + ECerr(EC_F_I2D_ECPRIVATEKEY, + ERR_R_PASSED_NULL_PARAMETER); +Index: crypto/openssl/crypto/ec/ecp_mont.c +=================================================================== +--- crypto/openssl/crypto/ec/ecp_mont.c (revision 273303) ++++ crypto/openssl/crypto/ec/ecp_mont.c (working copy) +@@ -72,9 +72,6 @@ + + const EC_METHOD *EC_GFp_mont_method(void) + { +-#ifdef OPENSSL_FIPS +- return fips_ec_gfp_mont_method(); +-#else + static const EC_METHOD ret = { + EC_FLAGS_DEFAULT_OCT, + NID_X9_62_prime_field, +@@ -114,8 +111,12 @@ const EC_METHOD *EC_GFp_mont_method(void) + ec_GFp_mont_field_decode, + ec_GFp_mont_field_set_to_one }; + ++#ifdef OPENSSL_FIPS ++ if (FIPS_mode()) ++ return fips_ec_gfp_mont_method(); ++#endif ++ + return &ret; +-#endif + } + + +Index: crypto/openssl/crypto/ec/ecp_nist.c +=================================================================== +--- crypto/openssl/crypto/ec/ecp_nist.c (revision 273303) ++++ crypto/openssl/crypto/ec/ecp_nist.c (working copy) +@@ -73,9 +73,6 @@ + + const EC_METHOD *EC_GFp_nist_method(void) + { +-#ifdef OPENSSL_FIPS +- return fips_ec_gfp_nist_method(); +-#else + static const EC_METHOD ret = { + EC_FLAGS_DEFAULT_OCT, + NID_X9_62_prime_field, +@@ -115,8 +112,12 @@ const EC_METHOD *EC_GFp_nist_method(void) + 0 /* field_decode */, + 0 /* field_set_to_one */ }; + ++#ifdef OPENSSL_FIPS ++ if (FIPS_mode()) ++ return fips_ec_gfp_nist_method(); ++#endif ++ + return &ret; +-#endif + } + + int ec_GFp_nist_group_copy(EC_GROUP *dest, const EC_GROUP *src) +Index: crypto/openssl/crypto/ec/ecp_smpl.c +=================================================================== +--- crypto/openssl/crypto/ec/ecp_smpl.c (revision 273303) ++++ crypto/openssl/crypto/ec/ecp_smpl.c (working copy) +@@ -73,9 +73,6 @@ + + const EC_METHOD *EC_GFp_simple_method(void) + { +-#ifdef OPENSSL_FIPS +- return fips_ec_gfp_simple_method(); +-#else + static const EC_METHOD ret = { + EC_FLAGS_DEFAULT_OCT, + NID_X9_62_prime_field, +@@ -115,8 +112,12 @@ const EC_METHOD *EC_GFp_simple_method(void) + 0 /* field_decode */, + 0 /* field_set_to_one */ }; + ++#ifdef OPENSSL_FIPS ++ if (FIPS_mode()) ++ return fips_ec_gfp_simple_method(); ++#endif ++ + return &ret; +-#endif + } + + +@@ -1317,8 +1318,8 @@ int ec_GFp_simple_points_make_affine(const EC_GROU + { + for (i = 0; i < num; i++) + { +- if (prod_Z[i] != NULL) +- BN_clear_free(prod_Z[i]); ++ if (prod_Z[i] == NULL) break; ++ BN_clear_free(prod_Z[i]); + } + OPENSSL_free(prod_Z); + } +Index: crypto/openssl/crypto/ec/ectest.c +=================================================================== +--- crypto/openssl/crypto/ec/ectest.c (revision 273303) ++++ crypto/openssl/crypto/ec/ectest.c (working copy) +@@ -251,6 +251,7 @@ static void group_order_tests(EC_GROUP *group) + if (!EC_POINT_is_at_infinity(group, Q)) ABORT; + + /* Exercise EC_POINTs_mul, including corner cases. */ ++ if (EC_POINT_is_at_infinity(group, P)) ABORT; + scalars[0] = n1; points[0] = Q; /* => infinity */ + scalars[1] = n2; points[1] = P; /* => -P */ + scalars[2] = n1; points[2] = Q; /* => infinity */ +@@ -257,8 +258,8 @@ static void group_order_tests(EC_GROUP *group) + scalars[3] = n2; points[3] = Q; /* => infinity */ + scalars[4] = n1; points[4] = P; /* => P */ + scalars[5] = n2; points[5] = Q; /* => infinity */ +- if (!EC_POINTs_mul(group, Q, NULL, 5, points, scalars, ctx)) ABORT; +- if (!EC_POINT_is_at_infinity(group, Q)) ABORT; ++ if (!EC_POINTs_mul(group, P, NULL, 6, points, scalars, ctx)) ABORT; ++ if (!EC_POINT_is_at_infinity(group, P)) ABORT; + } + fprintf(stdout, "ok\n"); + +Index: crypto/openssl/crypto/evp/Makefile +=================================================================== +--- crypto/openssl/crypto/evp/Makefile (revision 273303) ++++ crypto/openssl/crypto/evp/Makefile (working copy) +@@ -383,7 +383,7 @@ evp_enc.o: ../../include/openssl/pkcs7.h ../../inc + evp_enc.o: ../../include/openssl/safestack.h ../../include/openssl/sha.h + evp_enc.o: ../../include/openssl/stack.h ../../include/openssl/symhacks.h + evp_enc.o: ../../include/openssl/x509.h ../../include/openssl/x509_vfy.h +-evp_enc.o: ../cryptlib.h evp_enc.c evp_locl.h ++evp_enc.o: ../constant_time_locl.h ../cryptlib.h evp_enc.c evp_locl.h + evp_err.o: ../../include/openssl/asn1.h ../../include/openssl/bio.h + evp_err.o: ../../include/openssl/crypto.h ../../include/openssl/e_os2.h + evp_err.o: ../../include/openssl/err.h ../../include/openssl/evp.h +Index: crypto/openssl/crypto/evp/e_aes.c +=================================================================== +--- crypto/openssl/crypto/evp/e_aes.c (revision 273303) ++++ crypto/openssl/crypto/evp/e_aes.c (working copy) +@@ -166,7 +166,7 @@ extern unsigned int OPENSSL_ia32cap_P[2]; + #define VPAES_CAPABLE (OPENSSL_ia32cap_P[1]&(1<<(41-32))) + #endif + #ifdef BSAES_ASM +-#define BSAES_CAPABLE VPAES_CAPABLE ++#define BSAES_CAPABLE (OPENSSL_ia32cap_P[1]&(1<<(41-32))) + #endif + /* + * AES-NI section +Index: crypto/openssl/crypto/evp/evp_enc.c +=================================================================== +--- crypto/openssl/crypto/evp/evp_enc.c (revision 273303) ++++ crypto/openssl/crypto/evp/evp_enc.c (working copy) +@@ -67,6 +67,7 @@ + #ifdef OPENSSL_FIPS + #include + #endif ++#include "constant_time_locl.h" + #include "evp_locl.h" + + #ifdef OPENSSL_FIPS +@@ -500,21 +501,21 @@ int EVP_DecryptFinal(EVP_CIPHER_CTX *ctx, unsigned + + int EVP_DecryptFinal_ex(EVP_CIPHER_CTX *ctx, unsigned char *out, int *outl) + { +- int i,n; +- unsigned int b; ++ unsigned int i, b; ++ unsigned char pad, padding_good; + *outl=0; + + if (ctx->cipher->flags & EVP_CIPH_FLAG_CUSTOM_CIPHER) + { +- i = M_do_cipher(ctx, out, NULL, 0); +- if (i < 0) ++ int ret = M_do_cipher(ctx, out, NULL, 0); ++ if (ret < 0) + return 0; + else +- *outl = i; ++ *outl = ret; + return 1; + } + +- b=ctx->cipher->block_size; ++ b=(unsigned int)(ctx->cipher->block_size); + if (ctx->flags & EVP_CIPH_NO_PADDING) + { + if(ctx->buf_len) +@@ -533,28 +534,34 @@ int EVP_DecryptFinal_ex(EVP_CIPHER_CTX *ctx, unsig + return(0); + } + OPENSSL_assert(b <= sizeof ctx->final); +- n=ctx->final[b-1]; +- if (n == 0 || n > (int)b) ++ pad=ctx->final[b-1]; ++ ++ padding_good = (unsigned char)(~constant_time_is_zero_8(pad)); ++ padding_good &= constant_time_ge_8(b, pad); ++ ++ for (i = 1; i < b; ++i) + { +- EVPerr(EVP_F_EVP_DECRYPTFINAL_EX,EVP_R_BAD_DECRYPT); +- return(0); ++ unsigned char is_pad_index = constant_time_lt_8(i, pad); ++ unsigned char pad_byte_good = constant_time_eq_8(ctx->final[b-i-1], pad); ++ padding_good &= constant_time_select_8(is_pad_index, pad_byte_good, 0xff); + } +- for (i=0; ifinal[--b] != n) +- { +- EVPerr(EVP_F_EVP_DECRYPTFINAL_EX,EVP_R_BAD_DECRYPT); +- return(0); +- } +- } +- n=ctx->cipher->block_size-n; +- for (i=0; ifinal[i]; +- *outl=n; ++ ++ /* ++ * At least 1 byte is always padding, so we always write b - 1 ++ * bytes to avoid a timing leak. The caller is required to have |b| ++ * bytes space in |out| by the API contract. ++ */ ++ for (i = 0; i < b - 1; ++i) ++ out[i] = ctx->final[i] & padding_good; ++ /* Safe cast: for a good padding, EVP_MAX_IV_LENGTH >= b >= pad */ ++ *outl = padding_good & ((unsigned char)(b - pad)); ++ return padding_good & 1; + } + else +- *outl=0; +- return(1); ++ { ++ *outl = 0; ++ return 1; ++ } + } + + void EVP_CIPHER_CTX_free(EVP_CIPHER_CTX *ctx) +@@ -678,4 +685,3 @@ int EVP_CIPHER_CTX_copy(EVP_CIPHER_CTX *out, const + return in->cipher->ctrl((EVP_CIPHER_CTX *)in, EVP_CTRL_COPY, 0, out); + return 1; + } +- +Index: crypto/openssl/crypto/md5/asm/md5-x86_64.pl +=================================================================== +--- crypto/openssl/crypto/md5/asm/md5-x86_64.pl (revision 273303) ++++ crypto/openssl/crypto/md5/asm/md5-x86_64.pl (working copy) +@@ -108,6 +108,7 @@ sub round4_step + EOF + } + ++no warnings qw(uninitialized); + my $flavour = shift; + my $output = shift; + if ($flavour =~ /\./) { $output = $flavour; undef $flavour; } +@@ -119,7 +120,6 @@ $0 =~ m/(.*[\/\\])[^\/\\]+$/; my $dir=$1; my $xlat + ( $xlate="${dir}../../perlasm/x86_64-xlate.pl" and -f $xlate) or + die "can't locate x86_64-xlate.pl"; + +-no warnings qw(uninitialized); + open OUT,"| \"$^X\" $xlate $flavour $output"; + *STDOUT=*OUT; + +Index: crypto/openssl/crypto/modes/modes.h +=================================================================== +--- crypto/openssl/crypto/modes/modes.h (revision 273303) ++++ crypto/openssl/crypto/modes/modes.h (working copy) +@@ -7,6 +7,9 @@ + + #include + ++#ifdef __cplusplus ++extern "C" { ++#endif + typedef void (*block128_f)(const unsigned char in[16], + unsigned char out[16], + const void *key); +@@ -133,3 +136,6 @@ typedef struct xts128_context XTS128_CONTEXT; + + int CRYPTO_xts128_encrypt(const XTS128_CONTEXT *ctx, const unsigned char iv[16], + const unsigned char *inp, unsigned char *out, size_t len, int enc); ++#ifdef __cplusplus ++} ++#endif +Index: crypto/openssl/crypto/ocsp/ocsp_vfy.c +=================================================================== +--- crypto/openssl/crypto/ocsp/ocsp_vfy.c (revision 273303) ++++ crypto/openssl/crypto/ocsp/ocsp_vfy.c (working copy) +@@ -436,8 +436,11 @@ static int ocsp_req_find_signer(X509 **psigner, OC + if(!(flags & OCSP_NOINTERN)) + { + signer = X509_find_by_subject(req->optionalSignature->certs, nm); +- *psigner = signer; +- return 1; ++ if (signer) ++ { ++ *psigner = signer; ++ return 1; ++ } + } + + signer = X509_find_by_subject(certs, nm); +Index: crypto/openssl/crypto/opensslconf.h +=================================================================== +--- crypto/openssl/crypto/opensslconf.h (revision 273303) ++++ crypto/openssl/crypto/opensslconf.h (working copy) +@@ -1,6 +1,9 @@ + /* opensslconf.h */ + /* WARNING: Generated automatically from opensslconf.h.in by Configure. */ + ++#ifdef __cplusplus ++extern "C" { ++#endif + /* OpenSSL was configured with the following options: */ + #ifndef OPENSSL_DOING_MAKEDEPEND + +@@ -233,3 +236,6 @@ YOU SHOULD NOT HAVE BOTH DES_RISC1 AND DES_RISC2 D + + #endif /* DES_DEFAULT_OPTIONS */ + #endif /* HEADER_DES_LOCL_H */ ++#ifdef __cplusplus ++} ++#endif +Index: crypto/openssl/crypto/opensslv.h +=================================================================== +--- crypto/openssl/crypto/opensslv.h (revision 273303) ++++ crypto/openssl/crypto/opensslv.h (working copy) +@@ -1,6 +1,10 @@ + #ifndef HEADER_OPENSSLV_H + #define HEADER_OPENSSLV_H + ++#ifdef __cplusplus ++extern "C" { ++#endif ++ + /* Numeric release version identifier: + * MNNFFPPS: major minor fix patch status + * The status nibble has one of the values 0 for development, 1 to e for betas +@@ -25,11 +29,11 @@ + * (Prior to 0.9.5a beta1, a different scheme was used: MMNNFFRBB for + * major minor fix final patch/beta) + */ +-#define OPENSSL_VERSION_NUMBER 0x1000109fL ++#define OPENSSL_VERSION_NUMBER 0x100010afL + #ifdef OPENSSL_FIPS +-#define OPENSSL_VERSION_TEXT "OpenSSL 1.0.1i-fips 6 Aug 2014" ++#define OPENSSL_VERSION_TEXT "OpenSSL 1.0.1j-fips 15 Oct 2014" + #else +-#define OPENSSL_VERSION_TEXT "OpenSSL 1.0.1i-freebsd 6 Aug 2014" ++#define OPENSSL_VERSION_TEXT "OpenSSL 1.0.1j-freebsd 15 Oct 2014" + #endif + #define OPENSSL_VERSION_PTEXT " part of " OPENSSL_VERSION_TEXT + +@@ -86,4 +90,7 @@ + #define SHLIB_VERSION_NUMBER "7" + + ++#ifdef __cplusplus ++} ++#endif + #endif /* HEADER_OPENSSLV_H */ +Index: crypto/openssl/crypto/ossl_typ.h +=================================================================== +--- crypto/openssl/crypto/ossl_typ.h (revision 273303) ++++ crypto/openssl/crypto/ossl_typ.h (working copy) +@@ -55,6 +55,10 @@ + #ifndef HEADER_OPENSSL_TYPES_H + #define HEADER_OPENSSL_TYPES_H + ++#ifdef __cplusplus ++extern "C" { ++#endif ++ + #include + + #ifdef NO_ASN1_TYPEDEFS +@@ -199,4 +203,7 @@ typedef struct ocsp_req_ctx_st OCSP_REQ_CTX; + typedef struct ocsp_response_st OCSP_RESPONSE; + typedef struct ocsp_responder_id_st OCSP_RESPID; + ++#ifdef __cplusplus ++} ++#endif + #endif /* def HEADER_OPENSSL_TYPES_H */ +Index: crypto/openssl/crypto/pkcs7/pkcs7.h +=================================================================== +--- crypto/openssl/crypto/pkcs7/pkcs7.h (revision 273303) ++++ crypto/openssl/crypto/pkcs7/pkcs7.h (working copy) +@@ -233,11 +233,7 @@ DECLARE_PKCS12_STACK_OF(PKCS7) + (OBJ_obj2nid((a)->type) == NID_pkcs7_signedAndEnveloped) + #define PKCS7_type_is_data(a) (OBJ_obj2nid((a)->type) == NID_pkcs7_data) + #define PKCS7_type_is_digest(a) (OBJ_obj2nid((a)->type) == NID_pkcs7_digest) +-#define PKCS7_type_is_encrypted(a) \ +- (OBJ_obj2nid((a)->type) == NID_pkcs7_encrypted) + +-#define PKCS7_type_is_digest(a) (OBJ_obj2nid((a)->type) == NID_pkcs7_digest) +- + #define PKCS7_set_detached(p,v) \ + PKCS7_ctrl(p,PKCS7_OP_SET_DETACHED_SIGNATURE,v,NULL) + #define PKCS7_get_detached(p) \ +Index: crypto/openssl/crypto/pqueue/pqueue.h +=================================================================== +--- crypto/openssl/crypto/pqueue/pqueue.h (revision 273303) ++++ crypto/openssl/crypto/pqueue/pqueue.h (working copy) +@@ -64,6 +64,9 @@ + #include + #include + ++#ifdef __cplusplus ++extern "C" { ++#endif + typedef struct _pqueue *pqueue; + + typedef struct _pitem +@@ -91,4 +94,7 @@ pitem *pqueue_next(piterator *iter); + void pqueue_print(pqueue pq); + int pqueue_size(pqueue pq); + ++#ifdef __cplusplus ++} ++#endif + #endif /* ! HEADER_PQUEUE_H */ +Index: crypto/openssl/crypto/rsa/Makefile +=================================================================== +--- crypto/openssl/crypto/rsa/Makefile (revision 273303) ++++ crypto/openssl/crypto/rsa/Makefile (working copy) +@@ -212,7 +212,7 @@ rsa_oaep.o: ../../include/openssl/opensslv.h ../.. + rsa_oaep.o: ../../include/openssl/rand.h ../../include/openssl/rsa.h + rsa_oaep.o: ../../include/openssl/safestack.h ../../include/openssl/sha.h + rsa_oaep.o: ../../include/openssl/stack.h ../../include/openssl/symhacks.h +-rsa_oaep.o: ../cryptlib.h rsa_oaep.c ++rsa_oaep.o: ../constant_time_locl.h ../cryptlib.h rsa_oaep.c + rsa_pk1.o: ../../e_os.h ../../include/openssl/asn1.h + rsa_pk1.o: ../../include/openssl/bio.h ../../include/openssl/bn.h + rsa_pk1.o: ../../include/openssl/buffer.h ../../include/openssl/crypto.h +@@ -221,7 +221,8 @@ rsa_pk1.o: ../../include/openssl/lhash.h ../../inc + rsa_pk1.o: ../../include/openssl/opensslv.h ../../include/openssl/ossl_typ.h + rsa_pk1.o: ../../include/openssl/rand.h ../../include/openssl/rsa.h + rsa_pk1.o: ../../include/openssl/safestack.h ../../include/openssl/stack.h +-rsa_pk1.o: ../../include/openssl/symhacks.h ../cryptlib.h rsa_pk1.c ++rsa_pk1.o: ../../include/openssl/symhacks.h ../constant_time_locl.h ++rsa_pk1.o: ../cryptlib.h rsa_pk1.c + rsa_pmeth.o: ../../e_os.h ../../include/openssl/asn1.h + rsa_pmeth.o: ../../include/openssl/asn1t.h ../../include/openssl/bio.h + rsa_pmeth.o: ../../include/openssl/bn.h ../../include/openssl/buffer.h +Index: crypto/openssl/crypto/rsa/rsa.h +=================================================================== +--- crypto/openssl/crypto/rsa/rsa.h (revision 273303) ++++ crypto/openssl/crypto/rsa/rsa.h (working copy) +@@ -559,6 +559,7 @@ void ERR_load_RSA_strings(void); + #define RSA_R_OPERATION_NOT_ALLOWED_IN_FIPS_MODE 158 + #define RSA_R_OPERATION_NOT_SUPPORTED_FOR_THIS_KEYTYPE 148 + #define RSA_R_PADDING_CHECK_FAILED 114 ++#define RSA_R_PKCS_DECODING_ERROR 159 + #define RSA_R_P_NOT_PRIME 128 + #define RSA_R_Q_NOT_PRIME 129 + #define RSA_R_RSA_OPERATIONS_NOT_SUPPORTED 130 +Index: crypto/openssl/crypto/rsa/rsa_err.c +=================================================================== +--- crypto/openssl/crypto/rsa/rsa_err.c (revision 273303) ++++ crypto/openssl/crypto/rsa/rsa_err.c (working copy) +@@ -175,6 +175,7 @@ static ERR_STRING_DATA RSA_str_reasons[]= + {ERR_REASON(RSA_R_OPERATION_NOT_ALLOWED_IN_FIPS_MODE),"operation not allowed in fips mode"}, + {ERR_REASON(RSA_R_OPERATION_NOT_SUPPORTED_FOR_THIS_KEYTYPE),"operation not supported for this keytype"}, + {ERR_REASON(RSA_R_PADDING_CHECK_FAILED) ,"padding check failed"}, ++{ERR_REASON(RSA_R_PKCS_DECODING_ERROR) ,"pkcs decoding error"}, + {ERR_REASON(RSA_R_P_NOT_PRIME) ,"p not prime"}, + {ERR_REASON(RSA_R_Q_NOT_PRIME) ,"q not prime"}, + {ERR_REASON(RSA_R_RSA_OPERATIONS_NOT_SUPPORTED),"rsa operations not supported"}, +Index: crypto/openssl/crypto/rsa/rsa_oaep.c +=================================================================== +--- crypto/openssl/crypto/rsa/rsa_oaep.c (revision 273303) ++++ crypto/openssl/crypto/rsa/rsa_oaep.c (working copy) +@@ -18,6 +18,7 @@ + * an equivalent notion. + */ + ++#include "constant_time_locl.h" + + #if !defined(OPENSSL_NO_SHA) && !defined(OPENSSL_NO_SHA1) + #include +@@ -95,92 +96,117 @@ int RSA_padding_check_PKCS1_OAEP(unsigned char *to + const unsigned char *from, int flen, int num, + const unsigned char *param, int plen) + { +- int i, dblen, mlen = -1; +- const unsigned char *maskeddb; +- int lzero; +- unsigned char *db = NULL, seed[SHA_DIGEST_LENGTH], phash[SHA_DIGEST_LENGTH]; +- unsigned char *padded_from; +- int bad = 0; ++ int i, dblen, mlen = -1, one_index = 0, msg_index; ++ unsigned int good, found_one_byte; ++ const unsigned char *maskedseed, *maskeddb; ++ /* |em| is the encoded message, zero-padded to exactly |num| bytes: ++ * em = Y || maskedSeed || maskedDB */ ++ unsigned char *db = NULL, *em = NULL, seed[EVP_MAX_MD_SIZE], ++ phash[EVP_MAX_MD_SIZE]; + +- if (--num < 2 * SHA_DIGEST_LENGTH + 1) +- /* 'num' is the length of the modulus, i.e. does not depend on the +- * particular ciphertext. */ ++ if (tlen <= 0 || flen <= 0) ++ return -1; ++ ++ /* ++ * |num| is the length of the modulus; |flen| is the length of the ++ * encoded message. Therefore, for any |from| that was obtained by ++ * decrypting a ciphertext, we must have |flen| <= |num|. Similarly, ++ * num < 2 * SHA_DIGEST_LENGTH + 2 must hold for the modulus ++ * irrespective of the ciphertext, see PKCS #1 v2.2, section 7.1.2. ++ * This does not leak any side-channel information. ++ */ ++ if (num < flen || num < 2 * SHA_DIGEST_LENGTH + 2) + goto decoding_err; + +- lzero = num - flen; +- if (lzero < 0) ++ dblen = num - SHA_DIGEST_LENGTH - 1; ++ db = OPENSSL_malloc(dblen); ++ em = OPENSSL_malloc(num); ++ if (db == NULL || em == NULL) + { +- /* signalling this error immediately after detection might allow +- * for side-channel attacks (e.g. timing if 'plen' is huge +- * -- cf. James H. Manger, "A Chosen Ciphertext Attack on RSA Optimal +- * Asymmetric Encryption Padding (OAEP) [...]", CRYPTO 2001), +- * so we use a 'bad' flag */ +- bad = 1; +- lzero = 0; +- flen = num; /* don't overflow the memcpy to padded_from */ +- } +- +- dblen = num - SHA_DIGEST_LENGTH; +- db = OPENSSL_malloc(dblen + num); +- if (db == NULL) +- { + RSAerr(RSA_F_RSA_PADDING_CHECK_PKCS1_OAEP, ERR_R_MALLOC_FAILURE); +- return -1; ++ goto cleanup; + } + +- /* Always do this zero-padding copy (even when lzero == 0) +- * to avoid leaking timing info about the value of lzero. */ +- padded_from = db + dblen; +- memset(padded_from, 0, lzero); +- memcpy(padded_from + lzero, from, flen); ++ /* ++ * Always do this zero-padding copy (even when num == flen) to avoid ++ * leaking that information. The copy still leaks some side-channel ++ * information, but it's impossible to have a fixed memory access ++ * pattern since we can't read out of the bounds of |from|. ++ * ++ * TODO(emilia): Consider porting BN_bn2bin_padded from BoringSSL. ++ */ ++ memset(em, 0, num); ++ memcpy(em + num - flen, from, flen); + +- maskeddb = padded_from + SHA_DIGEST_LENGTH; ++ /* ++ * The first byte must be zero, however we must not leak if this is ++ * true. See James H. Manger, "A Chosen Ciphertext Attack on RSA ++ * Optimal Asymmetric Encryption Padding (OAEP) [...]", CRYPTO 2001). ++ */ ++ good = constant_time_is_zero(em[0]); + ++ maskedseed = em + 1; ++ maskeddb = em + 1 + SHA_DIGEST_LENGTH; ++ + if (MGF1(seed, SHA_DIGEST_LENGTH, maskeddb, dblen)) +- return -1; ++ goto cleanup; + for (i = 0; i < SHA_DIGEST_LENGTH; i++) +- seed[i] ^= padded_from[i]; +- ++ seed[i] ^= maskedseed[i]; ++ + if (MGF1(db, dblen, seed, SHA_DIGEST_LENGTH)) +- return -1; ++ goto cleanup; + for (i = 0; i < dblen; i++) + db[i] ^= maskeddb[i]; + + if (!EVP_Digest((void *)param, plen, phash, NULL, EVP_sha1(), NULL)) +- return -1; ++ goto cleanup; + +- if (CRYPTO_memcmp(db, phash, SHA_DIGEST_LENGTH) != 0 || bad) ++ good &= constant_time_is_zero(CRYPTO_memcmp(db, phash, SHA_DIGEST_LENGTH)); ++ ++ found_one_byte = 0; ++ for (i = SHA_DIGEST_LENGTH; i < dblen; i++) ++ { ++ /* Padding consists of a number of 0-bytes, followed by a 1. */ ++ unsigned int equals1 = constant_time_eq(db[i], 1); ++ unsigned int equals0 = constant_time_is_zero(db[i]); ++ one_index = constant_time_select_int(~found_one_byte & equals1, ++ i, one_index); ++ found_one_byte |= equals1; ++ good &= (found_one_byte | equals0); ++ } ++ ++ good &= found_one_byte; ++ ++ /* ++ * At this point |good| is zero unless the plaintext was valid, ++ * so plaintext-awareness ensures timing side-channels are no longer a ++ * concern. ++ */ ++ if (!good) + goto decoding_err; ++ ++ msg_index = one_index + 1; ++ mlen = dblen - msg_index; ++ ++ if (tlen < mlen) ++ { ++ RSAerr(RSA_F_RSA_PADDING_CHECK_PKCS1_OAEP, RSA_R_DATA_TOO_LARGE); ++ mlen = -1; ++ } + else + { +- for (i = SHA_DIGEST_LENGTH; i < dblen; i++) +- if (db[i] != 0x00) +- break; +- if (i == dblen || db[i] != 0x01) +- goto decoding_err; +- else +- { +- /* everything looks OK */ +- +- mlen = dblen - ++i; +- if (tlen < mlen) +- { +- RSAerr(RSA_F_RSA_PADDING_CHECK_PKCS1_OAEP, RSA_R_DATA_TOO_LARGE); +- mlen = -1; +- } +- else +- memcpy(to, db + i, mlen); +- } ++ memcpy(to, db + msg_index, mlen); ++ goto cleanup; + } +- OPENSSL_free(db); +- return mlen; + + decoding_err: +- /* to avoid chosen ciphertext attacks, the error message should not reveal +- * which kind of decoding error happened */ ++ /* To avoid chosen ciphertext attacks, the error message should not reveal ++ * which kind of decoding error happened. */ + RSAerr(RSA_F_RSA_PADDING_CHECK_PKCS1_OAEP, RSA_R_OAEP_DECODING_ERROR); ++cleanup: + if (db != NULL) OPENSSL_free(db); +- return -1; ++ if (em != NULL) OPENSSL_free(em); ++ return mlen; + } + + int PKCS1_MGF1(unsigned char *mask, long len, +Index: crypto/openssl/crypto/rsa/rsa_pk1.c +=================================================================== +--- crypto/openssl/crypto/rsa/rsa_pk1.c (revision 273303) ++++ crypto/openssl/crypto/rsa/rsa_pk1.c (working copy) +@@ -56,6 +56,8 @@ + * [including the GNU Public Licence.] + */ + ++#include "constant_time_locl.h" ++ + #include + #include "cryptlib.h" + #include +@@ -181,44 +183,87 @@ int RSA_padding_add_PKCS1_type_2(unsigned char *to + int RSA_padding_check_PKCS1_type_2(unsigned char *to, int tlen, + const unsigned char *from, int flen, int num) + { +- int i,j; +- const unsigned char *p; ++ int i; ++ /* |em| is the encoded message, zero-padded to exactly |num| bytes */ ++ unsigned char *em = NULL; ++ unsigned int good, found_zero_byte; ++ int zero_index = 0, msg_index, mlen = -1; + +- p=from; +- if ((num != (flen+1)) || (*(p++) != 02)) ++ if (tlen < 0 || flen < 0) ++ return -1; ++ ++ /* PKCS#1 v1.5 decryption. See "PKCS #1 v2.2: RSA Cryptography ++ * Standard", section 7.2.2. */ ++ ++ if (flen > num) ++ goto err; ++ ++ if (num < 11) ++ goto err; ++ ++ em = OPENSSL_malloc(num); ++ if (em == NULL) + { +- RSAerr(RSA_F_RSA_PADDING_CHECK_PKCS1_TYPE_2,RSA_R_BLOCK_TYPE_IS_NOT_02); +- return(-1); ++ RSAerr(RSA_F_RSA_PADDING_CHECK_PKCS1_TYPE_2, ERR_R_MALLOC_FAILURE); ++ return -1; + } +-#ifdef PKCS1_CHECK +- return(num-11); +-#endif ++ memset(em, 0, num); ++ /* ++ * Always do this zero-padding copy (even when num == flen) to avoid ++ * leaking that information. The copy still leaks some side-channel ++ * information, but it's impossible to have a fixed memory access ++ * pattern since we can't read out of the bounds of |from|. ++ * ++ * TODO(emilia): Consider porting BN_bn2bin_padded from BoringSSL. ++ */ ++ memcpy(em + num - flen, from, flen); + +- /* scan over padding data */ +- j=flen-1; /* one for type. */ +- for (i=0; i tlen) +- { +- RSAerr(RSA_F_RSA_PADDING_CHECK_PKCS1_TYPE_2,RSA_R_DATA_TOO_LARGE); +- return(-1); +- } +- memcpy(to,p,(unsigned int)j); + +- return(j); ++ memcpy(to, em + msg_index, mlen); ++ ++err: ++ if (em != NULL) ++ OPENSSL_free(em); ++ if (mlen == -1) ++ RSAerr(RSA_F_RSA_PADDING_CHECK_PKCS1_TYPE_2, RSA_R_PKCS_DECODING_ERROR); ++ return mlen; + } +- +Index: crypto/openssl/crypto/rsa/rsa_sign.c +=================================================================== +--- crypto/openssl/crypto/rsa/rsa_sign.c (revision 273303) ++++ crypto/openssl/crypto/rsa/rsa_sign.c (working copy) +@@ -151,6 +151,25 @@ int RSA_sign(int type, const unsigned char *m, uns + return(ret); + } + ++/* ++ * Check DigestInfo structure does not contain extraneous data by reencoding ++ * using DER and checking encoding against original. ++ */ ++static int rsa_check_digestinfo(X509_SIG *sig, const unsigned char *dinfo, int dinfolen) ++ { ++ unsigned char *der = NULL; ++ int derlen; ++ int ret = 0; ++ derlen = i2d_X509_SIG(sig, &der); ++ if (derlen <= 0) ++ return 0; ++ if (derlen == dinfolen && !memcmp(dinfo, der, derlen)) ++ ret = 1; ++ OPENSSL_cleanse(der, derlen); ++ OPENSSL_free(der); ++ return ret; ++ } ++ + int int_rsa_verify(int dtype, const unsigned char *m, + unsigned int m_len, + unsigned char *rm, size_t *prm_len, +@@ -228,7 +247,7 @@ int int_rsa_verify(int dtype, const unsigned char + if (sig == NULL) goto err; + + /* Excess data can be used to create forgeries */ +- if(p != s+i) ++ if(p != s+i || !rsa_check_digestinfo(sig, s, i)) + { + RSAerr(RSA_F_INT_RSA_VERIFY,RSA_R_BAD_SIGNATURE); + goto err; +Index: crypto/openssl/crypto/stack/safestack.h +=================================================================== +--- crypto/openssl/crypto/stack/safestack.h (revision 273303) ++++ crypto/openssl/crypto/stack/safestack.h (working copy) +@@ -57,6 +57,10 @@ + + #include + ++#ifdef __cplusplus ++extern "C" { ++#endif ++ + #ifndef CHECKED_PTR_OF + #define CHECKED_PTR_OF(type, p) \ + ((void*) (1 ? p : (type*)0)) +@@ -2660,4 +2664,8 @@ DECLARE_SPECIAL_STACK_OF(OPENSSL_BLOCK, void) + #define lh_SSL_SESSION_free(lh) LHM_lh_free(SSL_SESSION,lh) + /* End of util/mkstack.pl block, you may now edit :-) */ + ++ ++#ifdef __cplusplus ++} ++#endif + #endif /* !defined HEADER_SAFESTACK_H */ +Index: crypto/openssl/doc/apps/c_rehash.pod +=================================================================== +--- crypto/openssl/doc/apps/c_rehash.pod (revision 0) ++++ crypto/openssl/doc/apps/c_rehash.pod (working copy) +@@ -0,0 +1,81 @@ ++=pod ++ ++=for comment ++Original text by James Westby, contributed under the OpenSSL license. ++ ++=head1 NAME ++ ++c_rehash - Create symbolic links to files named by the hash values ++ ++=head1 SYNOPSIS ++ ++B ++[ I...] ++ ++=head1 DESCRIPTION ++ ++B scans directories and calculates a hash value of each C<.pem> ++file in the specified directory list and creates symbolic links ++for each file, where the name of the link is the hash value. ++This utility is useful as many programs that use OpenSSL require ++directories to be set up like this in order to find certificates. ++ ++If any directories are named on the command line, then those are ++processed in turn. If not, then the B environment variable ++is consulted; this shold be a colon-separated list of directories, ++like the Unix B variable. ++If that is not set then the default directory (installation-specific ++but often B) is processed. ++ ++In order for a directory to be processed, the user must have write ++permissions on that directory, otherwise it will be skipped. ++The links created are of the form C, where each B ++is a hexadecimal character and B is a single decimal digit. ++When processing a directory, B will first remove all links ++that have a name in that syntax. If you have links in that format ++used for other purposes, they will be removed. ++Hashes for CRL's look similar except the letter B appears after ++the period, like this: C. ++ ++Multiple objects may have the same hash; they will be indicated by ++incrementing the B value. Duplicates are found by comparing the ++full SHA-1 fingerprint. A warning will be displayed if a duplicate ++is found. ++ ++A warning will also be displayed if there are B<.pem> files that ++cannot be parsed as either a certificate or a CRL. ++ ++The program uses the B program to compute the hashes and ++fingerprints. If not found in the user's B, then set the ++B environment variable to the full pathname. ++Any program can be used, it will be invoked as follows for either ++a certificate or CRL: ++ ++ $OPENSSL x509 -hash -fingerprint -noout -in FFFFFF ++ $OPENSSL crl -hash -fingerprint -noout -in FFFFFF ++ ++where B is the filename. It must output the hash of the ++file on the first line, and the fingerprint on the second, ++optionally prefixed with some text and an equals sign. ++ ++=head1 ENVIRONMENT ++ ++=over ++ ++=item B ++ ++The path to an executable to use to generate hashes and ++fingerprints (see above). ++ ++=item B ++ ++Colon separated list of directories to operate on. ++Ignored if directories are listed on the command line. ++ ++=back ++ ++=head1 SEE ALSO ++ ++L, ++L. ++L. +Index: crypto/openssl/doc/apps/dgst.pod +=================================================================== +--- crypto/openssl/doc/apps/dgst.pod (revision 273303) ++++ crypto/openssl/doc/apps/dgst.pod (working copy) +@@ -2,16 +2,17 @@ + + =head1 NAME + +-dgst, md5, md4, md2, sha1, sha, mdc2, ripemd160 - message digests ++dgst, sha, sha1, mdc2, ripemd160, sha224, sha256, sha384, sha512, md2, md4, md5, dss1 - message digests + + =head1 SYNOPSIS + + B B +-[B<-md5|-md4|-md2|-sha1|-sha|-mdc2|-ripemd160|-dss1>] ++[B<-sha|-sha1|-mdc2|-ripemd160|-sha224|-sha256|-sha384|-sha512|-md2|-md4|-md5|-dss1>] + [B<-c>] + [B<-d>] + [B<-hex>] + [B<-binary>] ++[B<-r>] + [B<-out filename>] + [B<-sign filename>] + [B<-keyform arg>] +@@ -20,17 +21,19 @@ B B + [B<-prverify filename>] + [B<-signature filename>] + [B<-hmac key>] ++[B<-non-fips-allow>] ++[B<-fips-fingerprint>] + [B] + +-[B] +-[B<-c>] +-[B<-d>] +-[B] ++B ++[I] ++[B<...>] + + =head1 DESCRIPTION + + The digest functions output the message digest of a supplied file or files +-in hexadecimal form. They can also be used for digital signing and verification. ++in hexadecimal. The digest functions also generate and verify digital ++signatures using message digests. + + =head1 OPTIONS + +@@ -48,12 +51,17 @@ print out BIO debugging information. + =item B<-hex> + + digest is to be output as a hex dump. This is the default case for a "normal" +-digest as opposed to a digital signature. ++digest as opposed to a digital signature. See NOTES below for digital ++signatures using B<-hex>. + + =item B<-binary> + + output the digest or signature in binary form. + ++=item B<-r> ++ ++output the digest in the "coreutils" format used by programs like B. ++ + =item B<-out filename> + + filename to output to, or standard output by default. +@@ -64,8 +72,8 @@ digitally sign the digest using the private key in + + =item B<-keyform arg> + +-Specifies the key format to sign digest with. Only PEM and ENGINE +-formats are supported by the B command. ++Specifies the key format to sign digest with. The DER, PEM, P12, ++and ENGINE formats are supported. + + =item B<-engine id> + +@@ -117,7 +125,7 @@ Following options are supported by both by B + =over 8 + + =item B +- ++ + Specifies MAC key as alphnumeric string (use if key contain printable + characters only). String length must conform to any restrictions of + the MAC algorithm for example exactly 32 chars for gost-mac. +@@ -138,6 +146,15 @@ Multiple files can be specified separated by a OS- + The separator is B<;> for MS-Windows, B<,> for OpenVMS, and B<:> for + all others. + ++=item B<-non-fips-allow> ++ ++enable use of non-FIPS algorithms such as MD5 even in FIPS mode. ++ ++=item B<-fips-fingerprint> ++ ++compute HMAC using a specific key ++for certain OpenSSL-FIPS operations. ++ + =item B + + file or files to digest. If no files are specified then standard input is +@@ -145,18 +162,41 @@ used. + + =back + ++ ++=head1 EXAMPLES ++ ++To create a hex-encoded message digest of a file: ++ openssl dgst -md5 -hex file.txt ++ ++To sign a file using SHA-256 with binary file output: ++ openssl dgst -sha256 -sign privatekey.pem -out signature.sign file.txt ++ ++To verify a signature: ++ openssl dgst -sha256 -verify publickey.pem \ ++ -signature signature.sign \ ++ file.txt ++ ++ + =head1 NOTES + + The digest of choice for all new applications is SHA1. Other digests are + however still widely used. + +-If you wish to sign or verify data using the DSA algorithm then the dss1 +-digest must be used. ++When signing a file, B will automatically determine the algorithm ++(RSA, ECC, etc) to use for signing based on the private key's ASN.1 info. ++When verifying signatures, it only handles the RSA, DSA, or ECDSA signature ++itself, not the related data to identify the signer and algorithm used in ++formats such as x.509, CMS, and S/MIME. + + A source of random numbers is required for certain signing algorithms, in +-particular DSA. ++particular ECDSA and DSA. + + The signing and verify options should only be used if a single file is + being signed or verified. + ++Hex signatures cannot be verified using B. Instead, use "xxd -r" ++or similar program to transform the hex signature into a binary signature ++prior to verification. ++ ++ + =cut +Index: crypto/openssl/doc/crypto/BIO_s_accept.pod +=================================================================== +--- crypto/openssl/doc/crypto/BIO_s_accept.pod (revision 273303) ++++ crypto/openssl/doc/crypto/BIO_s_accept.pod (working copy) +@@ -59,8 +59,8 @@ the accept socket. See L + BIO_set_accept_port() uses the string B to set the accept + port. The port is represented as a string of the form "host:port", + where "host" is the interface to use and "port" is the port. +-Either or both values can be "*" which is interpreted as meaning +-any interface or port respectively. "port" has the same syntax ++The host can be can be "*" which is interpreted as meaning ++any interface; "port" has the same syntax + as the port specified in BIO_set_conn_port() for connect BIOs, + that is it can be a numerical port string or a string to lookup + using getservbyname() and a string table. +Index: crypto/openssl/doc/crypto/CMS_add1_signer.pod +=================================================================== +--- crypto/openssl/doc/crypto/CMS_add1_signer.pod (revision 0) ++++ crypto/openssl/doc/crypto/CMS_add1_signer.pod (working copy) +@@ -0,0 +1,101 @@ ++=pod ++ ++=head1 NAME ++ ++ CMS_add1_signer, CMS_SignerInfo_sign - add a signer to a CMS_ContentInfo signed data structure. ++ ++=head1 SYNOPSIS ++ ++ #include ++ ++ CMS_SignerInfo *CMS_add1_signer(CMS_ContentInfo *cms, X509 *signcert, EVP_PKEY *pkey, const EVP_MD *md, unsigned int flags); ++ ++ int CMS_SignerInfo_sign(CMS_SignerInfo *si); ++ ++ ++=head1 DESCRIPTION ++ ++CMS_add1_signer() adds a signer with certificate B and private ++key B using message digest B to CMS_ContentInfo SignedData ++structure B. ++ ++The CMS_ContentInfo structure should be obtained from an initial call to ++CMS_sign() with the flag B set or in the case or re-signing a ++valid CMS_ContentInfo SignedData structure. ++ ++If the B parameter is B then the default digest for the public ++key algorithm will be used. ++ ++Unless the B flag is set the returned CMS_ContentInfo ++structure is not complete and must be finalized either by streaming (if ++applicable) or a call to CMS_final(). ++ ++The CMS_SignerInfo_sign() function will explicitly sign a CMS_SignerInfo ++structure, its main use is when B and B flags ++are both set. ++ ++=head1 NOTES ++ ++The main purpose of CMS_add1_signer() is to provide finer control ++over a CMS signed data structure where the simpler CMS_sign() function defaults ++are not appropriate. For example if multiple signers or non default digest ++algorithms are needed. New attributes can also be added using the returned ++CMS_SignerInfo structure and the CMS attribute utility functions or the ++CMS signed receipt request functions. ++ ++Any of the following flags (ored together) can be passed in the B ++parameter. ++ ++If B is set then an attempt is made to copy the content ++digest value from the CMS_ContentInfo structure: to add a signer to an existing ++structure. An error occurs if a matching digest value cannot be found to copy. ++The returned CMS_ContentInfo structure will be valid and finalized when this ++flag is set. ++ ++If B is set in addition to B then the ++CMS_SignerInfo structure will not be finalized so additional attributes ++can be added. In this case an explicit call to CMS_SignerInfo_sign() is ++needed to finalize it. ++ ++If B is set the signer's certificate will not be included in the ++CMS_ContentInfo structure, the signer's certificate must still be supplied in ++the B parameter though. This can reduce the size of the signature if ++the signers certificate can be obtained by other means: for example a ++previously signed message. ++ ++The SignedData structure includes several CMS signedAttributes including the ++signing time, the CMS content type and the supported list of ciphers in an ++SMIMECapabilities attribute. If B is set then no signedAttributes ++will be used. If B is set then just the SMIMECapabilities are ++omitted. ++ ++OpenSSL will by default identify signing certificates using issuer name ++and serial number. If B is set it will use the subject key ++identifier value instead. An error occurs if the signing certificate does not ++have a subject key identifier extension. ++ ++If present the SMIMECapabilities attribute indicates support for the following ++algorithms in preference order: 256 bit AES, Gost R3411-94, Gost 28147-89, 192 ++bit AES, 128 bit AES, triple DES, 128 bit RC2, 64 bit RC2, DES and 40 bit RC2. ++If any of these algorithms is not available then it will not be included: for example the GOST algorithms will not be included if the GOST ENGINE is ++not loaded. ++ ++CMS_add1_signer() returns an internal pointer to the CMS_SignerInfo ++structure just added, this can be used to set additional attributes ++before it is finalized. ++ ++=head1 RETURN VALUES ++ ++CMS_add1_signer() returns an internal pointer to the CMS_SignerInfo ++structure just added or NULL if an error occurs. ++ ++=head1 SEE ALSO ++ ++L, L, ++L, ++ ++=head1 HISTORY ++ ++CMS_add1_signer() was added to OpenSSL 0.9.8 ++ ++=cut +Index: crypto/openssl/doc/crypto/CMS_sign_add1_signer.pod +=================================================================== +--- crypto/openssl/doc/crypto/CMS_sign_add1_signer.pod (revision 273303) ++++ crypto/openssl/doc/crypto/CMS_sign_add1_signer.pod (working copy) +@@ -1,101 +0,0 @@ +-=pod +- +-=head1 NAME +- +- CMS_sign_add1_signer, CMS_SignerInfo_sign - add a signer to a CMS_ContentInfo signed data structure. +- +-=head1 SYNOPSIS +- +- #include +- +- CMS_SignerInfo *CMS_sign_add1_signer(CMS_ContentInfo *cms, X509 *signcert, EVP_PKEY *pkey, const EVP_MD *md, unsigned int flags); +- +- int CMS_SignerInfo_sign(CMS_SignerInfo *si); +- +- +-=head1 DESCRIPTION +- +-CMS_sign_add1_signer() adds a signer with certificate B and private +-key B using message digest B to CMS_ContentInfo SignedData +-structure B. +- +-The CMS_ContentInfo structure should be obtained from an initial call to +-CMS_sign() with the flag B set or in the case or re-signing a +-valid CMS_ContentInfo SignedData structure. +- +-If the B parameter is B then the default digest for the public +-key algorithm will be used. +- +-Unless the B flag is set the returned CMS_ContentInfo +-structure is not complete and must be finalized either by streaming (if +-applicable) or a call to CMS_final(). +- +-The CMS_SignerInfo_sign() function will explicitly sign a CMS_SignerInfo +-structure, its main use is when B and B flags +-are both set. +- +-=head1 NOTES +- +-The main purpose of CMS_sign_add1_signer() is to provide finer control +-over a CMS signed data structure where the simpler CMS_sign() function defaults +-are not appropriate. For example if multiple signers or non default digest +-algorithms are needed. New attributes can also be added using the returned +-CMS_SignerInfo structure and the CMS attribute utility functions or the +-CMS signed receipt request functions. +- +-Any of the following flags (ored together) can be passed in the B +-parameter. +- +-If B is set then an attempt is made to copy the content +-digest value from the CMS_ContentInfo structure: to add a signer to an existing +-structure. An error occurs if a matching digest value cannot be found to copy. +-The returned CMS_ContentInfo structure will be valid and finalized when this +-flag is set. +- +-If B is set in addition to B then the +-CMS_SignerInfo structure will not be finalized so additional attributes +-can be added. In this case an explicit call to CMS_SignerInfo_sign() is +-needed to finalize it. +- +-If B is set the signer's certificate will not be included in the +-CMS_ContentInfo structure, the signer's certificate must still be supplied in +-the B parameter though. This can reduce the size of the signature if +-the signers certificate can be obtained by other means: for example a +-previously signed message. +- +-The SignedData structure includes several CMS signedAttributes including the +-signing time, the CMS content type and the supported list of ciphers in an +-SMIMECapabilities attribute. If B is set then no signedAttributes +-will be used. If B is set then just the SMIMECapabilities are +-omitted. +- +-OpenSSL will by default identify signing certificates using issuer name +-and serial number. If B is set it will use the subject key +-identifier value instead. An error occurs if the signing certificate does not +-have a subject key identifier extension. +- +-If present the SMIMECapabilities attribute indicates support for the following +-algorithms in preference order: 256 bit AES, Gost R3411-94, Gost 28147-89, 192 +-bit AES, 128 bit AES, triple DES, 128 bit RC2, 64 bit RC2, DES and 40 bit RC2. +-If any of these algorithms is not available then it will not be included: for example the GOST algorithms will not be included if the GOST ENGINE is +-not loaded. +- +-CMS_sign_add1_signer() returns an internal pointer to the CMS_SignerInfo +-structure just added, this can be used to set additional attributes +-before it is finalized. +- +-=head1 RETURN VALUES +- +-CMS_sign1_add_signers() returns an internal pointer to the CMS_SignerInfo +-structure just added or NULL if an error occurs. +- +-=head1 SEE ALSO +- +-L, L, +-L, +- +-=head1 HISTORY +- +-CMS_sign_add1_signer() was added to OpenSSL 0.9.8 +- +-=cut +Index: crypto/openssl/doc/crypto/EVP_DigestInit.pod +=================================================================== +--- crypto/openssl/doc/crypto/EVP_DigestInit.pod (revision 273303) ++++ crypto/openssl/doc/crypto/EVP_DigestInit.pod (working copy) +@@ -26,13 +26,13 @@ EVP digest routines + int EVP_MD_CTX_cleanup(EVP_MD_CTX *ctx); + void EVP_MD_CTX_destroy(EVP_MD_CTX *ctx); + +- int EVP_MD_CTX_copy_ex(EVP_MD_CTX *out,const EVP_MD_CTX *in); ++ int EVP_MD_CTX_copy_ex(EVP_MD_CTX *out,const EVP_MD_CTX *in); + + int EVP_DigestInit(EVP_MD_CTX *ctx, const EVP_MD *type); + int EVP_DigestFinal(EVP_MD_CTX *ctx, unsigned char *md, + unsigned int *s); + +- int EVP_MD_CTX_copy(EVP_MD_CTX *out,EVP_MD_CTX *in); ++ int EVP_MD_CTX_copy(EVP_MD_CTX *out,EVP_MD_CTX *in); + + #define EVP_MAX_MD_SIZE 64 /* SHA512 */ + +@@ -136,10 +136,10 @@ reasons. + EVP_md2(), EVP_md5(), EVP_sha(), EVP_sha1(), EVP_sha224(), EVP_sha256(), + EVP_sha384(), EVP_sha512(), EVP_mdc2() and EVP_ripemd160() return B + structures for the MD2, MD5, SHA, SHA1, SHA224, SHA256, SHA384, SHA512, MDC2 +-and RIPEMD160 digest algorithms respectively. ++and RIPEMD160 digest algorithms respectively. + + EVP_dss() and EVP_dss1() return B structures for SHA and SHA1 digest +-algorithms but using DSS (DSA) for the signature algorithm. Note: there is ++algorithms but using DSS (DSA) for the signature algorithm. Note: there is + no need to use these pseudo-digests in OpenSSL 1.0.0 and later, they are + however retained for compatibility. + +@@ -177,21 +177,21 @@ The B interface to message digests should alm + preference to the low level interfaces. This is because the code then becomes + transparent to the digest used and much more flexible. + +-New applications should use the SHA2 digest algorithms such as SHA256. ++New applications should use the SHA2 digest algorithms such as SHA256. + The other digest algorithms are still in common use. + + For most applications the B parameter to EVP_DigestInit_ex() will be + set to NULL to use the default digest implementation. + +-The functions EVP_DigestInit(), EVP_DigestFinal() and EVP_MD_CTX_copy() are ++The functions EVP_DigestInit(), EVP_DigestFinal() and EVP_MD_CTX_copy() are + obsolete but are retained to maintain compatibility with existing code. New +-applications should use EVP_DigestInit_ex(), EVP_DigestFinal_ex() and ++applications should use EVP_DigestInit_ex(), EVP_DigestFinal_ex() and + EVP_MD_CTX_copy_ex() because they can efficiently reuse a digest context + instead of initializing and cleaning it up on each call and allow non default + implementations of digests to be specified. + + In OpenSSL 0.9.7 and later if digest contexts are not cleaned up after use +-memory leaks will occur. ++memory leaks will occur. + + Stack allocation of EVP_MD_CTX structures is common, for example: + +@@ -245,15 +245,19 @@ digest name passed on the command line. + EVP_MD_CTX_destroy(mdctx); + + printf("Digest is: "); +- for(i = 0; i < md_len; i++) printf("%02x", md_value[i]); ++ for(i = 0; i < md_len; i++) ++ printf("%02x", md_value[i]); + printf("\n"); ++ ++ /* Call this once before exit. */ ++ EVP_cleanup(); ++ exit(0); + } + + =head1 SEE ALSO + +-L, L, L, +-L, L, L, +-L, L ++L, ++L + + =head1 HISTORY + +@@ -269,7 +273,7 @@ EVP_dss(), EVP_dss1(), EVP_mdc2() and EVP_ripemd16 + changed to return truely const EVP_MD * in OpenSSL 0.9.7. + + The link between digests and signing algorithms was fixed in OpenSSL 1.0 and +-later, so now EVP_sha1() can be used with RSA and DSA, there is no need to ++later, so now EVP_sha1() can be used with RSA and DSA; there is no need to + use EVP_dss1() any more. + + OpenSSL 1.0 and later does not include the MD2 digest algorithm in the +Index: crypto/openssl/doc/crypto/EVP_DigestVerifyInit.pod +=================================================================== +--- crypto/openssl/doc/crypto/EVP_DigestVerifyInit.pod (revision 273303) ++++ crypto/openssl/doc/crypto/EVP_DigestVerifyInit.pod (working copy) +@@ -38,7 +38,7 @@ or a negative value for failure. In particular a r + the operation is not supported by the public key algorithm. + + Unlike other functions the return value 0 from EVP_DigestVerifyFinal() only +-indicates that the signature did not not verify successfully (that is tbs did ++indicates that the signature did not verify successfully (that is tbs did + not match the original data or the signature was of invalid form) it is not an + indication of a more serious error. + +@@ -59,7 +59,7 @@ For some key types and parameters the random numbe + or the operation will fail. + + The call to EVP_DigestVerifyFinal() internally finalizes a copy of the digest +-context. This means that calls to EVP_VerifyUpdate() and EVP_VerifyFinal() can ++context. This means that EVP_VerifyUpdate() and EVP_VerifyFinal() can + be called later to digest and verify additional data. + + Since only a copy of the digest context is ever finalized the context must +Index: crypto/openssl/doc/crypto/EVP_EncryptInit.pod +=================================================================== +--- crypto/openssl/doc/crypto/EVP_EncryptInit.pod (revision 273303) ++++ crypto/openssl/doc/crypto/EVP_EncryptInit.pod (working copy) +@@ -387,28 +387,8 @@ for certain common S/MIME ciphers (RC2, DES, tripl + + =head1 EXAMPLES + +-Get the number of rounds used in RC5: ++Encrypt a string using IDEA: + +- int nrounds; +- EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_GET_RC5_ROUNDS, 0, &nrounds); +- +-Get the RC2 effective key length: +- +- int key_bits; +- EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_GET_RC2_KEY_BITS, 0, &key_bits); +- +-Set the number of rounds used in RC5: +- +- int nrounds; +- EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_SET_RC5_ROUNDS, nrounds, NULL); +- +-Set the effective key length used in RC2: +- +- int key_bits; +- EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_SET_RC2_KEY_BITS, key_bits, NULL); +- +-Encrypt a string using blowfish: +- + int do_crypt(char *outfile) + { + unsigned char outbuf[1024]; +@@ -421,8 +401,9 @@ for certain common S/MIME ciphers (RC2, DES, tripl + char intext[] = "Some Crypto Text"; + EVP_CIPHER_CTX ctx; + FILE *out; ++ + EVP_CIPHER_CTX_init(&ctx); +- EVP_EncryptInit_ex(&ctx, EVP_bf_cbc(), NULL, key, iv); ++ EVP_EncryptInit_ex(&ctx, EVP_idea_cbc(), NULL, key, iv); + + if(!EVP_EncryptUpdate(&ctx, outbuf, &outlen, intext, strlen(intext))) + { +@@ -451,28 +432,34 @@ for certain common S/MIME ciphers (RC2, DES, tripl + } + + The ciphertext from the above example can be decrypted using the B +-utility with the command line: ++utility with the command line (shown on two lines for clarity): + +- S ++ openssl idea -d or + B if the key is not of the correct type. + +-EVP_PKEY_assign_RSA() EVP_PKEY_assign_DSA(), EVP_PKEY_assign_DH() ++EVP_PKEY_assign_RSA(), EVP_PKEY_assign_DSA(), EVP_PKEY_assign_DH() + and EVP_PKEY_assign_EC_KEY() also set the referenced key to B + however these use the supplied B internally and so B + will be freed when the parent B is freed. +@@ -54,8 +54,8 @@ In accordance with the OpenSSL naming convention t + from or assigned to the B using the B<1> functions must be + freed as well as B. + +-EVP_PKEY_assign_RSA() EVP_PKEY_assign_DSA(), EVP_PKEY_assign_DH() +-EVP_PKEY_assign_EC_KEY() are implemented as macros. ++EVP_PKEY_assign_RSA(), EVP_PKEY_assign_DSA(), EVP_PKEY_assign_DH() ++and EVP_PKEY_assign_EC_KEY() are implemented as macros. + + =head1 RETURN VALUES + +@@ -66,7 +66,7 @@ EVP_PKEY_get1_RSA(), EVP_PKEY_get1_DSA(), EVP_PKEY + EVP_PKEY_get1_EC_KEY() return the referenced key or B if + an error occurred. + +-EVP_PKEY_assign_RSA() EVP_PKEY_assign_DSA(), EVP_PKEY_assign_DH() ++EVP_PKEY_assign_RSA(), EVP_PKEY_assign_DSA(), EVP_PKEY_assign_DH() + and EVP_PKEY_assign_EC_KEY() return 1 for success and 0 for failure. + + =head1 SEE ALSO +Index: crypto/openssl/doc/crypto/EVP_PKEY_sign.pod +=================================================================== +--- crypto/openssl/doc/crypto/EVP_PKEY_sign.pod (revision 273303) ++++ crypto/openssl/doc/crypto/EVP_PKEY_sign.pod (working copy) +@@ -28,9 +28,14 @@ B and the amount of data written to B + + =head1 NOTES + ++EVP_PKEY_sign() does not hash the data to be signed, and therefore is ++normally used to sign digests. For signing arbitrary messages, see the ++L and ++L signing interfaces instead. ++ + After the call to EVP_PKEY_sign_init() algorithm specific control + operations can be performed to set any appropriate parameters for the +-operation. ++operation (see L). + + The function EVP_PKEY_sign() can be called more than once on the same + context if several operations are performed using the same parameters. +@@ -49,13 +54,17 @@ Sign data using RSA with PKCS#1 padding and SHA256 + #include + + EVP_PKEY_CTX *ctx; ++ /* md is a SHA-256 digest in this example. */ + unsigned char *md, *sig; +- size_t mdlen, siglen; ++ size_t mdlen = 32, siglen; + EVP_PKEY *signing_key; +- /* NB: assumes signing_key, md and mdlen are already set up +- * and that signing_key is an RSA private key ++ ++ /* ++ * NB: assumes signing_key and md are set up before the next ++ * step. signing_key must be an RSA private key and md must ++ * point to the SHA-256 digest to be signed. + */ +- ctx = EVP_PKEY_CTX_new(signing_key); ++ ctx = EVP_PKEY_CTX_new(signing_key, NULL /* no engine */); + if (!ctx) + /* Error occurred */ + if (EVP_PKEY_sign_init(ctx) <= 0) +@@ -83,6 +92,7 @@ Sign data using RSA with PKCS#1 padding and SHA256 + =head1 SEE ALSO + + L, ++L, + L, + L, + L, +Index: crypto/openssl/doc/ssl/SSL_CTX_set_tmp_dh_callback.pod +=================================================================== +--- crypto/openssl/doc/ssl/SSL_CTX_set_tmp_dh_callback.pod (revision 273303) ++++ crypto/openssl/doc/ssl/SSL_CTX_set_tmp_dh_callback.pod (working copy) +@@ -48,12 +48,13 @@ even if he gets hold of the normal (certified) key + only used for signing. + + In order to perform a DH key exchange the server must use a DH group +-(DH parameters) and generate a DH key. The server will always generate a new +-DH key during the negotiation, when the DH parameters are supplied via +-callback and/or when the SSL_OP_SINGLE_DH_USE option of +-L is set. It will +-immediately create a DH key, when DH parameters are supplied via +-SSL_CTX_set_tmp_dh() and SSL_OP_SINGLE_DH_USE is not set. In this case, ++(DH parameters) and generate a DH key. ++The server will always generate a new DH key during the negotiation ++if either the DH parameters are supplied via callback or the ++SSL_OP_SINGLE_DH_USE option of SSL_CTX_set_options(3) is set (or both). ++It will immediately create a DH key if DH parameters are supplied via ++SSL_CTX_set_tmp_dh() and SSL_OP_SINGLE_DH_USE is not set. ++In this case, + it may happen that a key is generated on initialization without later + being needed, while on the other hand the computer time during the + negotiation is being saved. +@@ -139,7 +140,7 @@ partly left out.) + dh_tmp = dh_512; + break; + case 1024: +- if (!dh_1024) ++ if (!dh_1024) + dh_1024 = get_dh1024(); + dh_tmp = dh_1024; + break; +Index: crypto/openssl/e_os.h +=================================================================== +--- crypto/openssl/e_os.h (revision 273303) ++++ crypto/openssl/e_os.h (working copy) +@@ -373,8 +373,17 @@ static unsigned int _strlen31(const char *str) + # define check_winnt() (1) + #else + # define check_winnt() (GetVersion() < 0x80000000) +-#endif ++#endif + ++/* ++ * Visual Studio: inline is available in C++ only, however ++ * __inline is available for C, see ++ * http://msdn.microsoft.com/en-us/library/z8y1yy88.aspx ++ */ ++#if defined(_MSC_VER) && !defined(__cplusplus) && !defined(inline) ++# define inline __inline ++#endif ++ + #else /* The non-microsoft world */ + + # ifdef OPENSSL_SYS_VMS +@@ -738,4 +747,3 @@ struct servent *getservbyname(const char *name, co + #endif + + #endif +- +Index: crypto/openssl/ssl/Makefile +=================================================================== +--- crypto/openssl/ssl/Makefile (revision 273303) ++++ crypto/openssl/ssl/Makefile (working copy) +@@ -547,26 +547,27 @@ s3_both.o: ../include/openssl/ssl23.h ../include/o + s3_both.o: ../include/openssl/stack.h ../include/openssl/symhacks.h + s3_both.o: ../include/openssl/tls1.h ../include/openssl/x509.h + s3_both.o: ../include/openssl/x509_vfy.h s3_both.c ssl_locl.h +-s3_cbc.o: ../e_os.h ../include/openssl/asn1.h ../include/openssl/bio.h +-s3_cbc.o: ../include/openssl/buffer.h ../include/openssl/comp.h +-s3_cbc.o: ../include/openssl/crypto.h ../include/openssl/dsa.h +-s3_cbc.o: ../include/openssl/dtls1.h ../include/openssl/e_os2.h +-s3_cbc.o: ../include/openssl/ec.h ../include/openssl/ecdh.h +-s3_cbc.o: ../include/openssl/ecdsa.h ../include/openssl/err.h +-s3_cbc.o: ../include/openssl/evp.h ../include/openssl/hmac.h +-s3_cbc.o: ../include/openssl/kssl.h ../include/openssl/lhash.h +-s3_cbc.o: ../include/openssl/md5.h ../include/openssl/obj_mac.h +-s3_cbc.o: ../include/openssl/objects.h ../include/openssl/opensslconf.h +-s3_cbc.o: ../include/openssl/opensslv.h ../include/openssl/ossl_typ.h +-s3_cbc.o: ../include/openssl/pem.h ../include/openssl/pem2.h +-s3_cbc.o: ../include/openssl/pkcs7.h ../include/openssl/pqueue.h +-s3_cbc.o: ../include/openssl/rsa.h ../include/openssl/safestack.h +-s3_cbc.o: ../include/openssl/sha.h ../include/openssl/srtp.h +-s3_cbc.o: ../include/openssl/ssl.h ../include/openssl/ssl2.h +-s3_cbc.o: ../include/openssl/ssl23.h ../include/openssl/ssl3.h +-s3_cbc.o: ../include/openssl/stack.h ../include/openssl/symhacks.h +-s3_cbc.o: ../include/openssl/tls1.h ../include/openssl/x509.h +-s3_cbc.o: ../include/openssl/x509_vfy.h s3_cbc.c ssl_locl.h ++s3_cbc.o: ../crypto/constant_time_locl.h ../e_os.h ../include/openssl/asn1.h ++s3_cbc.o: ../include/openssl/bio.h ../include/openssl/buffer.h ++s3_cbc.o: ../include/openssl/comp.h ../include/openssl/crypto.h ++s3_cbc.o: ../include/openssl/dsa.h ../include/openssl/dtls1.h ++s3_cbc.o: ../include/openssl/e_os2.h ../include/openssl/ec.h ++s3_cbc.o: ../include/openssl/ecdh.h ../include/openssl/ecdsa.h ++s3_cbc.o: ../include/openssl/err.h ../include/openssl/evp.h ++s3_cbc.o: ../include/openssl/hmac.h ../include/openssl/kssl.h ++s3_cbc.o: ../include/openssl/lhash.h ../include/openssl/md5.h ++s3_cbc.o: ../include/openssl/obj_mac.h ../include/openssl/objects.h ++s3_cbc.o: ../include/openssl/opensslconf.h ../include/openssl/opensslv.h ++s3_cbc.o: ../include/openssl/ossl_typ.h ../include/openssl/pem.h ++s3_cbc.o: ../include/openssl/pem2.h ../include/openssl/pkcs7.h ++s3_cbc.o: ../include/openssl/pqueue.h ../include/openssl/rsa.h ++s3_cbc.o: ../include/openssl/safestack.h ../include/openssl/sha.h ++s3_cbc.o: ../include/openssl/srtp.h ../include/openssl/ssl.h ++s3_cbc.o: ../include/openssl/ssl2.h ../include/openssl/ssl23.h ++s3_cbc.o: ../include/openssl/ssl3.h ../include/openssl/stack.h ++s3_cbc.o: ../include/openssl/symhacks.h ../include/openssl/tls1.h ++s3_cbc.o: ../include/openssl/x509.h ../include/openssl/x509_vfy.h s3_cbc.c ++s3_cbc.o: ssl_locl.h + s3_clnt.o: ../e_os.h ../include/openssl/asn1.h ../include/openssl/bio.h + s3_clnt.o: ../include/openssl/bn.h ../include/openssl/buffer.h + s3_clnt.o: ../include/openssl/comp.h ../include/openssl/crypto.h +@@ -671,28 +672,29 @@ s3_pkt.o: ../include/openssl/ssl23.h ../include/op + s3_pkt.o: ../include/openssl/stack.h ../include/openssl/symhacks.h + s3_pkt.o: ../include/openssl/tls1.h ../include/openssl/x509.h + s3_pkt.o: ../include/openssl/x509_vfy.h s3_pkt.c ssl_locl.h +-s3_srvr.o: ../e_os.h ../include/openssl/asn1.h ../include/openssl/bio.h +-s3_srvr.o: ../include/openssl/bn.h ../include/openssl/buffer.h +-s3_srvr.o: ../include/openssl/comp.h ../include/openssl/crypto.h +-s3_srvr.o: ../include/openssl/dh.h ../include/openssl/dsa.h +-s3_srvr.o: ../include/openssl/dtls1.h ../include/openssl/e_os2.h +-s3_srvr.o: ../include/openssl/ec.h ../include/openssl/ecdh.h +-s3_srvr.o: ../include/openssl/ecdsa.h ../include/openssl/err.h +-s3_srvr.o: ../include/openssl/evp.h ../include/openssl/hmac.h +-s3_srvr.o: ../include/openssl/krb5_asn.h ../include/openssl/kssl.h +-s3_srvr.o: ../include/openssl/lhash.h ../include/openssl/md5.h +-s3_srvr.o: ../include/openssl/obj_mac.h ../include/openssl/objects.h +-s3_srvr.o: ../include/openssl/opensslconf.h ../include/openssl/opensslv.h +-s3_srvr.o: ../include/openssl/ossl_typ.h ../include/openssl/pem.h +-s3_srvr.o: ../include/openssl/pem2.h ../include/openssl/pkcs7.h +-s3_srvr.o: ../include/openssl/pqueue.h ../include/openssl/rand.h +-s3_srvr.o: ../include/openssl/rsa.h ../include/openssl/safestack.h +-s3_srvr.o: ../include/openssl/sha.h ../include/openssl/srtp.h +-s3_srvr.o: ../include/openssl/ssl.h ../include/openssl/ssl2.h +-s3_srvr.o: ../include/openssl/ssl23.h ../include/openssl/ssl3.h +-s3_srvr.o: ../include/openssl/stack.h ../include/openssl/symhacks.h +-s3_srvr.o: ../include/openssl/tls1.h ../include/openssl/x509.h +-s3_srvr.o: ../include/openssl/x509_vfy.h kssl_lcl.h s3_srvr.c ssl_locl.h ++s3_srvr.o: ../crypto/constant_time_locl.h ../e_os.h ../include/openssl/asn1.h ++s3_srvr.o: ../include/openssl/bio.h ../include/openssl/bn.h ++s3_srvr.o: ../include/openssl/buffer.h ../include/openssl/comp.h ++s3_srvr.o: ../include/openssl/crypto.h ../include/openssl/dh.h ++s3_srvr.o: ../include/openssl/dsa.h ../include/openssl/dtls1.h ++s3_srvr.o: ../include/openssl/e_os2.h ../include/openssl/ec.h ++s3_srvr.o: ../include/openssl/ecdh.h ../include/openssl/ecdsa.h ++s3_srvr.o: ../include/openssl/err.h ../include/openssl/evp.h ++s3_srvr.o: ../include/openssl/hmac.h ../include/openssl/krb5_asn.h ++s3_srvr.o: ../include/openssl/kssl.h ../include/openssl/lhash.h ++s3_srvr.o: ../include/openssl/md5.h ../include/openssl/obj_mac.h ++s3_srvr.o: ../include/openssl/objects.h ../include/openssl/opensslconf.h ++s3_srvr.o: ../include/openssl/opensslv.h ../include/openssl/ossl_typ.h ++s3_srvr.o: ../include/openssl/pem.h ../include/openssl/pem2.h ++s3_srvr.o: ../include/openssl/pkcs7.h ../include/openssl/pqueue.h ++s3_srvr.o: ../include/openssl/rand.h ../include/openssl/rsa.h ++s3_srvr.o: ../include/openssl/safestack.h ../include/openssl/sha.h ++s3_srvr.o: ../include/openssl/srtp.h ../include/openssl/ssl.h ++s3_srvr.o: ../include/openssl/ssl2.h ../include/openssl/ssl23.h ++s3_srvr.o: ../include/openssl/ssl3.h ../include/openssl/stack.h ++s3_srvr.o: ../include/openssl/symhacks.h ../include/openssl/tls1.h ++s3_srvr.o: ../include/openssl/x509.h ../include/openssl/x509_vfy.h kssl_lcl.h ++s3_srvr.o: s3_srvr.c ssl_locl.h + ssl_algs.o: ../e_os.h ../include/openssl/asn1.h ../include/openssl/bio.h + ssl_algs.o: ../include/openssl/buffer.h ../include/openssl/comp.h + ssl_algs.o: ../include/openssl/crypto.h ../include/openssl/dsa.h +Index: crypto/openssl/ssl/d1_both.c +=================================================================== +--- crypto/openssl/ssl/d1_both.c (revision 273303) ++++ crypto/openssl/ssl/d1_both.c (working copy) +@@ -1492,6 +1492,9 @@ dtls1_process_heartbeat(SSL *s) + /* Read type and payload length first */ + if (1 + 2 + 16 > s->s3->rrec.length) + return 0; /* silently discard */ ++ if (s->s3->rrec.length > SSL3_RT_MAX_PLAIN_LENGTH) ++ return 0; /* silently discard per RFC 6520 sec. 4 */ ++ + hbtype = *p++; + n2s(p, payload); + if (1 + 2 + payload + 16 > s->s3->rrec.length) +Index: crypto/openssl/ssl/d1_lib.c +=================================================================== +--- crypto/openssl/ssl/d1_lib.c (revision 273303) ++++ crypto/openssl/ssl/d1_lib.c (working copy) +@@ -266,6 +266,16 @@ long dtls1_ctrl(SSL *s, int cmd, long larg, void * + case DTLS_CTRL_LISTEN: + ret = dtls1_listen(s, parg); + break; ++ case SSL_CTRL_CHECK_PROTO_VERSION: ++ /* For library-internal use; checks that the current protocol ++ * is the highest enabled version (according to s->ctx->method, ++ * as version negotiation may have changed s->method). */ ++#if DTLS_MAX_VERSION != DTLS1_VERSION ++# error Code needs update for DTLS_method() support beyond DTLS1_VERSION. ++#endif ++ /* Just one protocol version is supported so far; ++ * fail closed if the version is not as expected. */ ++ return s->version == DTLS_MAX_VERSION; + + default: + ret = ssl3_ctrl(s, cmd, larg, parg); +Index: crypto/openssl/ssl/d1_srtp.c +=================================================================== +--- crypto/openssl/ssl/d1_srtp.c (revision 273303) ++++ crypto/openssl/ssl/d1_srtp.c (working copy) +@@ -168,25 +168,6 @@ static int find_profile_by_name(char *profile_name + return 1; + } + +-static int find_profile_by_num(unsigned profile_num, +- SRTP_PROTECTION_PROFILE **pptr) +- { +- SRTP_PROTECTION_PROFILE *p; +- +- p=srtp_known_profiles; +- while(p->name) +- { +- if(p->id == profile_num) +- { +- *pptr=p; +- return 0; +- } +- p++; +- } +- +- return 1; +- } +- + static int ssl_ctx_make_profiles(const char *profiles_string,STACK_OF(SRTP_PROTECTION_PROFILE) **out) + { + STACK_OF(SRTP_PROTECTION_PROFILE) *profiles; +@@ -209,11 +190,19 @@ static int ssl_ctx_make_profiles(const char *profi + if(!find_profile_by_name(ptr,&p, + col ? col-ptr : (int)strlen(ptr))) + { ++ if (sk_SRTP_PROTECTION_PROFILE_find(profiles,p) >= 0) ++ { ++ SSLerr(SSL_F_SSL_CTX_MAKE_PROFILES,SSL_R_BAD_SRTP_PROTECTION_PROFILE_LIST); ++ sk_SRTP_PROTECTION_PROFILE_free(profiles); ++ return 1; ++ } ++ + sk_SRTP_PROTECTION_PROFILE_push(profiles,p); + } + else + { + SSLerr(SSL_F_SSL_CTX_MAKE_PROFILES,SSL_R_SRTP_UNKNOWN_PROTECTION_PROFILE); ++ sk_SRTP_PROTECTION_PROFILE_free(profiles); + return 1; + } + +@@ -305,13 +294,12 @@ int ssl_add_clienthello_use_srtp_ext(SSL *s, unsig + + int ssl_parse_clienthello_use_srtp_ext(SSL *s, unsigned char *d, int len,int *al) + { +- SRTP_PROTECTION_PROFILE *cprof,*sprof; +- STACK_OF(SRTP_PROTECTION_PROFILE) *clnt=0,*srvr; ++ SRTP_PROTECTION_PROFILE *sprof; ++ STACK_OF(SRTP_PROTECTION_PROFILE) *srvr; + int ct; + int mki_len; +- int i,j; +- int id; +- int ret; ++ int i, srtp_pref; ++ unsigned int id; + + /* Length value + the MKI length */ + if(len < 3) +@@ -341,9 +329,11 @@ int ssl_parse_clienthello_use_srtp_ext(SSL *s, uns + return 1; + } + ++ srvr=SSL_get_srtp_profiles(s); ++ s->srtp_profile = NULL; ++ /* Search all profiles for a match initially */ ++ srtp_pref = sk_SRTP_PROTECTION_PROFILE_num(srvr); + +- clnt=sk_SRTP_PROTECTION_PROFILE_new_null(); +- + while(ct) + { + n2s(d,id); +@@ -350,14 +340,22 @@ int ssl_parse_clienthello_use_srtp_ext(SSL *s, uns + ct-=2; + len-=2; + +- if(!find_profile_by_num(id,&cprof)) ++ /* ++ * Only look for match in profiles of higher preference than ++ * current match. ++ * If no profiles have been have been configured then this ++ * does nothing. ++ */ ++ for (i = 0; i < srtp_pref; i++) + { +- sk_SRTP_PROTECTION_PROFILE_push(clnt,cprof); ++ sprof = sk_SRTP_PROTECTION_PROFILE_value(srvr, i); ++ if (sprof->id == id) ++ { ++ s->srtp_profile = sprof; ++ srtp_pref = i; ++ break; ++ } + } +- else +- { +- ; /* Ignore */ +- } + } + + /* Now extract the MKI value as a sanity check, but discard it for now */ +@@ -371,36 +369,7 @@ int ssl_parse_clienthello_use_srtp_ext(SSL *s, uns + return 1; + } + +- srvr=SSL_get_srtp_profiles(s); +- +- /* Pick our most preferred profile. If no profiles have been +- configured then the outer loop doesn't run +- (sk_SRTP_PROTECTION_PROFILE_num() = -1) +- and so we just return without doing anything */ +- for(i=0;iid==sprof->id) +- { +- s->srtp_profile=sprof; +- *al=0; +- ret=0; +- goto done; +- } +- } +- } +- +- ret=0; +- +-done: +- if(clnt) sk_SRTP_PROTECTION_PROFILE_free(clnt); +- +- return ret; ++ return 0; + } + + int ssl_add_serverhello_use_srtp_ext(SSL *s, unsigned char *p, int *len, int maxlen) +Index: crypto/openssl/ssl/dtls1.h +=================================================================== +--- crypto/openssl/ssl/dtls1.h (revision 273303) ++++ crypto/openssl/ssl/dtls1.h (working copy) +@@ -84,6 +84,8 @@ extern "C" { + #endif + + #define DTLS1_VERSION 0xFEFF ++#define DTLS_MAX_VERSION DTLS1_VERSION ++ + #define DTLS1_BAD_VER 0x0100 + + #if 0 +@@ -284,4 +286,3 @@ typedef struct dtls1_record_data_st + } + #endif + #endif +- +Index: crypto/openssl/ssl/s23_clnt.c +=================================================================== +--- crypto/openssl/ssl/s23_clnt.c (revision 273303) ++++ crypto/openssl/ssl/s23_clnt.c (working copy) +@@ -125,9 +125,11 @@ static const SSL_METHOD *ssl23_get_client_method(i + if (ver == SSL2_VERSION) + return(SSLv2_client_method()); + #endif ++#ifndef OPENSSL_NO_SSL3 + if (ver == SSL3_VERSION) + return(SSLv3_client_method()); +- else if (ver == TLS1_VERSION) ++#endif ++ if (ver == TLS1_VERSION) + return(TLSv1_client_method()); + else if (ver == TLS1_1_VERSION) + return(TLSv1_1_client_method()); +@@ -698,6 +700,7 @@ static int ssl23_get_server_hello(SSL *s) + { + /* we have sslv3 or tls1 (server hello or alert) */ + ++#ifndef OPENSSL_NO_SSL3 + if ((p[2] == SSL3_VERSION_MINOR) && + !(s->options & SSL_OP_NO_SSLv3)) + { +@@ -712,7 +715,9 @@ static int ssl23_get_server_hello(SSL *s) + s->version=SSL3_VERSION; + s->method=SSLv3_client_method(); + } +- else if ((p[2] == TLS1_VERSION_MINOR) && ++ else ++#endif ++ if ((p[2] == TLS1_VERSION_MINOR) && + !(s->options & SSL_OP_NO_TLSv1)) + { + s->version=TLS1_VERSION; +@@ -736,6 +741,9 @@ static int ssl23_get_server_hello(SSL *s) + goto err; + } + ++ /* ensure that TLS_MAX_VERSION is up-to-date */ ++ OPENSSL_assert(s->version <= TLS_MAX_VERSION); ++ + if (p[0] == SSL3_RT_ALERT && p[5] != SSL3_AL_WARNING) + { + /* fatal alert */ +Index: crypto/openssl/ssl/s23_srvr.c +=================================================================== +--- crypto/openssl/ssl/s23_srvr.c (revision 273303) ++++ crypto/openssl/ssl/s23_srvr.c (working copy) +@@ -127,9 +127,11 @@ static const SSL_METHOD *ssl23_get_server_method(i + if (ver == SSL2_VERSION) + return(SSLv2_server_method()); + #endif ++#ifndef OPENSSL_NO_SSL3 + if (ver == SSL3_VERSION) + return(SSLv3_server_method()); +- else if (ver == TLS1_VERSION) ++#endif ++ if (ver == TLS1_VERSION) + return(TLSv1_server_method()); + else if (ver == TLS1_1_VERSION) + return(TLSv1_1_server_method()); +@@ -421,6 +423,9 @@ int ssl23_get_client_hello(SSL *s) + } + } + ++ /* ensure that TLS_MAX_VERSION is up-to-date */ ++ OPENSSL_assert(s->version <= TLS_MAX_VERSION); ++ + #ifdef OPENSSL_FIPS + if (FIPS_mode() && (s->version < TLS1_VERSION)) + { +@@ -597,6 +602,12 @@ int ssl23_get_client_hello(SSL *s) + if ((type == 2) || (type == 3)) + { + /* we have SSLv3/TLSv1 (type 2: SSL2 style, type 3: SSL3/TLS style) */ ++ s->method = ssl23_get_server_method(s->version); ++ if (s->method == NULL) ++ { ++ SSLerr(SSL_F_SSL23_GET_CLIENT_HELLO,SSL_R_UNSUPPORTED_PROTOCOL); ++ goto err; ++ } + + if (!ssl_init_wbio_buffer(s,1)) goto err; + +@@ -624,14 +635,6 @@ int ssl23_get_client_hello(SSL *s) + s->s3->rbuf.left=0; + s->s3->rbuf.offset=0; + } +- if (s->version == TLS1_2_VERSION) +- s->method = TLSv1_2_server_method(); +- else if (s->version == TLS1_1_VERSION) +- s->method = TLSv1_1_server_method(); +- else if (s->version == TLS1_VERSION) +- s->method = TLSv1_server_method(); +- else +- s->method = SSLv3_server_method(); + #if 0 /* ssl3_get_client_hello does this */ + s->client_version=(v[0]<<8)|v[1]; + #endif +Index: crypto/openssl/ssl/s2_lib.c +=================================================================== +--- crypto/openssl/ssl/s2_lib.c (revision 273303) ++++ crypto/openssl/ssl/s2_lib.c (working copy) +@@ -391,6 +391,8 @@ long ssl2_ctrl(SSL *s, int cmd, long larg, void *p + case SSL_CTRL_GET_SESSION_REUSED: + ret=s->hit; + break; ++ case SSL_CTRL_CHECK_PROTO_VERSION: ++ return ssl3_ctrl(s, SSL_CTRL_CHECK_PROTO_VERSION, larg, parg); + default: + break; + } +@@ -437,7 +439,7 @@ int ssl2_put_cipher_by_char(const SSL_CIPHER *c, u + if (p != NULL) + { + l=c->id; +- if ((l & 0xff000000) != 0x02000000) return(0); ++ if ((l & 0xff000000) != 0x02000000 && l != SSL3_CK_FALLBACK_SCSV) return(0); + p[0]=((unsigned char)(l>>16L))&0xFF; + p[1]=((unsigned char)(l>> 8L))&0xFF; + p[2]=((unsigned char)(l ))&0xFF; +Index: crypto/openssl/ssl/s3_cbc.c +=================================================================== +--- crypto/openssl/ssl/s3_cbc.c (revision 273303) ++++ crypto/openssl/ssl/s3_cbc.c (working copy) +@@ -53,6 +53,7 @@ + * + */ + ++#include "../crypto/constant_time_locl.h" + #include "ssl_locl.h" + + #include +@@ -67,37 +68,6 @@ + * supported by TLS.) */ + #define MAX_HASH_BLOCK_SIZE 128 + +-/* Some utility functions are needed: +- * +- * These macros return the given value with the MSB copied to all the other +- * bits. They use the fact that arithmetic shift shifts-in the sign bit. +- * However, this is not ensured by the C standard so you may need to replace +- * them with something else on odd CPUs. */ +-#define DUPLICATE_MSB_TO_ALL(x) ( (unsigned)( (int)(x) >> (sizeof(int)*8-1) ) ) +-#define DUPLICATE_MSB_TO_ALL_8(x) ((unsigned char)(DUPLICATE_MSB_TO_ALL(x))) +- +-/* constant_time_lt returns 0xff if a=b and 0x00 otherwise. */ +-static unsigned constant_time_ge(unsigned a, unsigned b) +- { +- a -= b; +- return DUPLICATE_MSB_TO_ALL(~a); +- } +- +-/* constant_time_eq_8 returns 0xff if a==b and 0x00 otherwise. */ +-static unsigned char constant_time_eq_8(unsigned a, unsigned b) +- { +- unsigned c = a ^ b; +- c--; +- return DUPLICATE_MSB_TO_ALL_8(c); +- } +- + /* ssl3_cbc_remove_padding removes padding from the decrypted, SSLv3, CBC + * record in |rec| by updating |rec->length| in constant time. + * +@@ -126,8 +96,8 @@ int ssl3_cbc_remove_padding(const SSL* s, + padding_length = good & (padding_length+1); + rec->length -= padding_length; + rec->type |= padding_length<<8; /* kludge: pass padding length */ +- return (int)((good & 1) | (~good & -1)); +-} ++ return constant_time_select_int(good, 1, -1); ++ } + + /* tls1_cbc_remove_padding removes the CBC padding from the decrypted, TLS, CBC + * record in |rec| in constant time and returns 1 if the padding is valid and +@@ -208,7 +178,7 @@ int tls1_cbc_remove_padding(const SSL* s, + + for (i = 0; i < to_check; i++) + { +- unsigned char mask = constant_time_ge(padding_length, i); ++ unsigned char mask = constant_time_ge_8(padding_length, i); + unsigned char b = rec->data[rec->length-1-i]; + /* The final |padding_length+1| bytes should all have the value + * |padding_length|. Therefore the XOR should be zero. */ +@@ -216,20 +186,14 @@ int tls1_cbc_remove_padding(const SSL* s, + } + + /* If any of the final |padding_length+1| bytes had the wrong value, +- * one or more of the lower eight bits of |good| will be cleared. We +- * AND the bottom 8 bits together and duplicate the result to all the +- * bits. */ +- good &= good >> 4; +- good &= good >> 2; +- good &= good >> 1; +- good <<= sizeof(good)*8-1; +- good = DUPLICATE_MSB_TO_ALL(good); +- ++ * one or more of the lower eight bits of |good| will be cleared. ++ */ ++ good = constant_time_eq(0xff, good & 0xff); + padding_length = good & (padding_length+1); + rec->length -= padding_length; + rec->type |= padding_length<<8; /* kludge: pass padding length */ + +- return (int)((good & 1) | (~good & -1)); ++ return constant_time_select_int(good, 1, -1); + } + + /* ssl3_cbc_copy_mac copies |md_size| bytes from the end of |rec| to |out| in +@@ -296,8 +260,8 @@ void ssl3_cbc_copy_mac(unsigned char* out, + memset(rotated_mac, 0, md_size); + for (i = scan_start, j = 0; i < orig_len; i++) + { +- unsigned char mac_started = constant_time_ge(i, mac_start); +- unsigned char mac_ended = constant_time_ge(i, mac_end); ++ unsigned char mac_started = constant_time_ge_8(i, mac_start); ++ unsigned char mac_ended = constant_time_ge_8(i, mac_end); + unsigned char b = rec->data[i]; + rotated_mac[j++] |= b & mac_started & ~mac_ended; + j &= constant_time_lt(j,md_size); +@@ -683,12 +647,12 @@ void ssl3_cbc_digest_record( + b = data[k-header_length]; + k++; + +- is_past_c = is_block_a & constant_time_ge(j, c); +- is_past_cp1 = is_block_a & constant_time_ge(j, c+1); ++ is_past_c = is_block_a & constant_time_ge_8(j, c); ++ is_past_cp1 = is_block_a & constant_time_ge_8(j, c+1); + /* If this is the block containing the end of the + * application data, and we are at the offset for the + * 0x80 value, then overwrite b with 0x80. */ +- b = (b&~is_past_c) | (0x80&is_past_c); ++ b = constant_time_select_8(is_past_c, 0x80, b); + /* If this the the block containing the end of the + * application data and we're past the 0x80 value then + * just write zero. */ +@@ -704,7 +668,8 @@ void ssl3_cbc_digest_record( + if (j >= md_block_size - md_length_size) + { + /* If this is index_b, write a length byte. */ +- b = (b&~is_block_b) | (is_block_b&length_bytes[j-(md_block_size-md_length_size)]); ++ b = constant_time_select_8( ++ is_block_b, length_bytes[j-(md_block_size-md_length_size)], b); + } + block[j] = b; + } +Index: crypto/openssl/ssl/s3_clnt.c +=================================================================== +--- crypto/openssl/ssl/s3_clnt.c (revision 273303) ++++ crypto/openssl/ssl/s3_clnt.c (working copy) +@@ -326,9 +326,9 @@ int ssl3_connect(SSL *s) + break; + } + #endif +- /* Check if it is anon DH/ECDH */ ++ /* Check if it is anon DH/ECDH, SRP auth */ + /* or PSK */ +- if (!(s->s3->tmp.new_cipher->algorithm_auth & SSL_aNULL) && ++ if (!(s->s3->tmp.new_cipher->algorithm_auth & (SSL_aNULL|SSL_aSRP)) && + !(s->s3->tmp.new_cipher->algorithm_mkey & SSL_kPSK)) + { + ret=ssl3_get_server_certificate(s); +@@ -1277,8 +1277,8 @@ int ssl3_get_key_exchange(SSL *s) + #endif + EVP_MD_CTX md_ctx; + unsigned char *param,*p; +- int al,i,j,param_len,ok; +- long n,alg_k,alg_a; ++ int al,j,ok; ++ long i,param_len,n,alg_k,alg_a; + EVP_PKEY *pkey=NULL; + const EVP_MD *md = NULL; + #ifndef OPENSSL_NO_RSA +@@ -1354,19 +1354,29 @@ int ssl3_get_key_exchange(SSL *s) + s->session->sess_cert=ssl_sess_cert_new(); + } + ++ /* Total length of the parameters including the length prefix */ + param_len=0; ++ + alg_k=s->s3->tmp.new_cipher->algorithm_mkey; + alg_a=s->s3->tmp.new_cipher->algorithm_auth; + EVP_MD_CTX_init(&md_ctx); + ++ al=SSL_AD_DECODE_ERROR; ++ + #ifndef OPENSSL_NO_PSK + if (alg_k & SSL_kPSK) + { + char tmp_id_hint[PSK_MAX_IDENTITY_LEN+1]; + +- al=SSL_AD_HANDSHAKE_FAILURE; ++ param_len = 2; ++ if (param_len > n) ++ { ++ SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE, ++ SSL_R_LENGTH_TOO_SHORT); ++ goto f_err; ++ } + n2s(p,i); +- param_len=i+2; ++ + /* Store PSK identity hint for later use, hint is used + * in ssl3_send_client_key_exchange. Assume that the + * maximum length of a PSK identity hint can be as +@@ -1373,17 +1383,19 @@ int ssl3_get_key_exchange(SSL *s) + * long as the maximum length of a PSK identity. */ + if (i > PSK_MAX_IDENTITY_LEN) + { ++ al=SSL_AD_HANDSHAKE_FAILURE; + SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE, + SSL_R_DATA_LENGTH_TOO_LONG); + goto f_err; + } +- if (param_len > n) ++ if (i > n - param_len) + { +- al=SSL_AD_DECODE_ERROR; + SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE, + SSL_R_BAD_PSK_IDENTITY_HINT_LENGTH); + goto f_err; + } ++ param_len += i; ++ + /* If received PSK identity hint contains NULL + * characters, the hint is truncated from the first + * NULL. p may not be ending with NULL, so create a +@@ -1395,6 +1407,7 @@ int ssl3_get_key_exchange(SSL *s) + s->ctx->psk_identity_hint = BUF_strdup(tmp_id_hint); + if (s->ctx->psk_identity_hint == NULL) + { ++ al=SSL_AD_HANDSHAKE_FAILURE; + SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE, ERR_R_MALLOC_FAILURE); + goto f_err; + } +@@ -1407,14 +1420,22 @@ int ssl3_get_key_exchange(SSL *s) + #ifndef OPENSSL_NO_SRP + if (alg_k & SSL_kSRP) + { +- n2s(p,i); +- param_len=i+2; ++ param_len = 2; + if (param_len > n) + { +- al=SSL_AD_DECODE_ERROR; ++ SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE, ++ SSL_R_LENGTH_TOO_SHORT); ++ goto f_err; ++ } ++ n2s(p,i); ++ ++ if (i > n - param_len) ++ { + SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,SSL_R_BAD_SRP_N_LENGTH); + goto f_err; + } ++ param_len += i; ++ + if (!(s->srp_ctx.N=BN_bin2bn(p,i,NULL))) + { + SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,ERR_R_BN_LIB); +@@ -1422,14 +1443,24 @@ int ssl3_get_key_exchange(SSL *s) + } + p+=i; + ++ ++ if (2 > n - param_len) ++ { ++ SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE, ++ SSL_R_LENGTH_TOO_SHORT); ++ goto f_err; ++ } ++ param_len += 2; ++ + n2s(p,i); +- param_len+=i+2; +- if (param_len > n) ++ ++ if (i > n - param_len) + { +- al=SSL_AD_DECODE_ERROR; + SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,SSL_R_BAD_SRP_G_LENGTH); + goto f_err; + } ++ param_len += i; ++ + if (!(s->srp_ctx.g=BN_bin2bn(p,i,NULL))) + { + SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,ERR_R_BN_LIB); +@@ -1437,15 +1468,25 @@ int ssl3_get_key_exchange(SSL *s) + } + p+=i; + ++ ++ if (1 > n - param_len) ++ { ++ SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE, ++ SSL_R_LENGTH_TOO_SHORT); ++ goto f_err; ++ } ++ param_len += 1; ++ + i = (unsigned int)(p[0]); + p++; +- param_len+=i+1; +- if (param_len > n) ++ ++ if (i > n - param_len) + { +- al=SSL_AD_DECODE_ERROR; + SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,SSL_R_BAD_SRP_S_LENGTH); + goto f_err; + } ++ param_len += i; ++ + if (!(s->srp_ctx.s=BN_bin2bn(p,i,NULL))) + { + SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,ERR_R_BN_LIB); +@@ -1453,14 +1494,23 @@ int ssl3_get_key_exchange(SSL *s) + } + p+=i; + ++ if (2 > n - param_len) ++ { ++ SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE, ++ SSL_R_LENGTH_TOO_SHORT); ++ goto f_err; ++ } ++ param_len += 2; ++ + n2s(p,i); +- param_len+=i+2; +- if (param_len > n) ++ ++ if (i > n - param_len) + { +- al=SSL_AD_DECODE_ERROR; + SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,SSL_R_BAD_SRP_B_LENGTH); + goto f_err; + } ++ param_len += i; ++ + if (!(s->srp_ctx.B=BN_bin2bn(p,i,NULL))) + { + SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,ERR_R_BN_LIB); +@@ -1498,14 +1548,23 @@ int ssl3_get_key_exchange(SSL *s) + SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,ERR_R_MALLOC_FAILURE); + goto err; + } +- n2s(p,i); +- param_len=i+2; ++ ++ param_len = 2; + if (param_len > n) + { +- al=SSL_AD_DECODE_ERROR; ++ SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE, ++ SSL_R_LENGTH_TOO_SHORT); ++ goto f_err; ++ } ++ n2s(p,i); ++ ++ if (i > n - param_len) ++ { + SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,SSL_R_BAD_RSA_MODULUS_LENGTH); + goto f_err; + } ++ param_len += i; ++ + if (!(rsa->n=BN_bin2bn(p,i,rsa->n))) + { + SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,ERR_R_BN_LIB); +@@ -1513,14 +1572,23 @@ int ssl3_get_key_exchange(SSL *s) + } + p+=i; + ++ if (2 > n - param_len) ++ { ++ SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE, ++ SSL_R_LENGTH_TOO_SHORT); ++ goto f_err; ++ } ++ param_len += 2; ++ + n2s(p,i); +- param_len+=i+2; +- if (param_len > n) ++ ++ if (i > n - param_len) + { +- al=SSL_AD_DECODE_ERROR; + SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,SSL_R_BAD_RSA_E_LENGTH); + goto f_err; + } ++ param_len += i; ++ + if (!(rsa->e=BN_bin2bn(p,i,rsa->e))) + { + SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,ERR_R_BN_LIB); +@@ -1552,14 +1620,23 @@ int ssl3_get_key_exchange(SSL *s) + SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,ERR_R_DH_LIB); + goto err; + } +- n2s(p,i); +- param_len=i+2; ++ ++ param_len = 2; + if (param_len > n) + { +- al=SSL_AD_DECODE_ERROR; ++ SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE, ++ SSL_R_LENGTH_TOO_SHORT); ++ goto f_err; ++ } ++ n2s(p,i); ++ ++ if (i > n - param_len) ++ { + SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,SSL_R_BAD_DH_P_LENGTH); + goto f_err; + } ++ param_len += i; ++ + if (!(dh->p=BN_bin2bn(p,i,NULL))) + { + SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,ERR_R_BN_LIB); +@@ -1567,14 +1644,23 @@ int ssl3_get_key_exchange(SSL *s) + } + p+=i; + ++ if (2 > n - param_len) ++ { ++ SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE, ++ SSL_R_LENGTH_TOO_SHORT); ++ goto f_err; ++ } ++ param_len += 2; ++ + n2s(p,i); +- param_len+=i+2; +- if (param_len > n) ++ ++ if (i > n - param_len) + { +- al=SSL_AD_DECODE_ERROR; + SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,SSL_R_BAD_DH_G_LENGTH); + goto f_err; + } ++ param_len += i; ++ + if (!(dh->g=BN_bin2bn(p,i,NULL))) + { + SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,ERR_R_BN_LIB); +@@ -1582,14 +1668,23 @@ int ssl3_get_key_exchange(SSL *s) + } + p+=i; + ++ if (2 > n - param_len) ++ { ++ SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE, ++ SSL_R_LENGTH_TOO_SHORT); ++ goto f_err; ++ } ++ param_len += 2; ++ + n2s(p,i); +- param_len+=i+2; +- if (param_len > n) ++ ++ if (i > n - param_len) + { +- al=SSL_AD_DECODE_ERROR; + SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,SSL_R_BAD_DH_PUB_KEY_LENGTH); + goto f_err; + } ++ param_len += i; ++ + if (!(dh->pub_key=BN_bin2bn(p,i,NULL))) + { + SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,ERR_R_BN_LIB); +@@ -1641,13 +1736,20 @@ int ssl3_get_key_exchange(SSL *s) + */ + + /* XXX: For now we only support named (not generic) curves +- * and the ECParameters in this case is just three bytes. ++ * and the ECParameters in this case is just three bytes. We ++ * also need one byte for the length of the encoded point + */ +- param_len=3; +- if ((param_len > n) || +- (*p != NAMED_CURVE_TYPE) || +- ((curve_nid = tls1_ec_curve_id2nid(*(p + 2))) == 0)) ++ param_len=4; ++ if (param_len > n) + { ++ SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE, ++ SSL_R_LENGTH_TOO_SHORT); ++ goto f_err; ++ } ++ ++ if ((*p != NAMED_CURVE_TYPE) || ++ ((curve_nid = tls1_ec_curve_id2nid(*(p + 2))) == 0)) ++ { + al=SSL_AD_INTERNAL_ERROR; + SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,SSL_R_UNABLE_TO_FIND_ECDH_PARAMETERS); + goto f_err; +@@ -1688,15 +1790,15 @@ int ssl3_get_key_exchange(SSL *s) + + encoded_pt_len = *p; /* length of encoded point */ + p+=1; +- param_len += (1 + encoded_pt_len); +- if ((param_len > n) || ++ ++ if ((encoded_pt_len > n - param_len) || + (EC_POINT_oct2point(group, srvr_ecpoint, + p, encoded_pt_len, bn_ctx) == 0)) + { +- al=SSL_AD_DECODE_ERROR; + SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,SSL_R_BAD_ECPOINT); + goto f_err; + } ++ param_len += encoded_pt_len; + + n-=param_len; + p+=encoded_pt_len; +@@ -1739,7 +1841,15 @@ int ssl3_get_key_exchange(SSL *s) + { + if (TLS1_get_version(s) >= TLS1_2_VERSION) + { +- int sigalg = tls12_get_sigid(pkey); ++ int sigalg; ++ if (2 > n) ++ { ++ SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE, ++ SSL_R_LENGTH_TOO_SHORT); ++ goto f_err; ++ } ++ ++ sigalg = tls12_get_sigid(pkey); + /* Should never happen */ + if (sigalg == -1) + { +@@ -1757,7 +1867,6 @@ int ssl3_get_key_exchange(SSL *s) + if (md == NULL) + { + SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,SSL_R_UNKNOWN_DIGEST); +- al=SSL_AD_DECODE_ERROR; + goto f_err; + } + #ifdef SSL_DEBUG +@@ -1768,15 +1877,21 @@ fprintf(stderr, "USING TLSv1.2 HASH %s\n", EVP_MD_ + } + else + md = EVP_sha1(); +- ++ ++ if (2 > n) ++ { ++ SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE, ++ SSL_R_LENGTH_TOO_SHORT); ++ goto f_err; ++ } + n2s(p,i); + n-=2; + j=EVP_PKEY_size(pkey); + ++ /* Check signature length. If n is 0 then signature is empty */ + if ((i != n) || (n > j) || (n <= 0)) + { + /* wrong packet length */ +- al=SSL_AD_DECODE_ERROR; + SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,SSL_R_WRONG_SIGNATURE_LENGTH); + goto f_err; + } +@@ -1785,6 +1900,7 @@ fprintf(stderr, "USING TLSv1.2 HASH %s\n", EVP_MD_ + if (pkey->type == EVP_PKEY_RSA && TLS1_get_version(s) < TLS1_2_VERSION) + { + int num; ++ unsigned int size; + + j=0; + q=md_buf; +@@ -1797,9 +1913,9 @@ fprintf(stderr, "USING TLSv1.2 HASH %s\n", EVP_MD_ + EVP_DigestUpdate(&md_ctx,&(s->s3->client_random[0]),SSL3_RANDOM_SIZE); + EVP_DigestUpdate(&md_ctx,&(s->s3->server_random[0]),SSL3_RANDOM_SIZE); + EVP_DigestUpdate(&md_ctx,param,param_len); +- EVP_DigestFinal_ex(&md_ctx,q,(unsigned int *)&i); +- q+=i; +- j+=i; ++ EVP_DigestFinal_ex(&md_ctx,q,&size); ++ q+=size; ++ j+=size; + } + i=RSA_verify(NID_md5_sha1, md_buf, j, p, n, + pkey->pkey.rsa); +@@ -1835,8 +1951,8 @@ fprintf(stderr, "USING TLSv1.2 HASH %s\n", EVP_MD_ + } + else + { +- if (!(alg_a & SSL_aNULL) && !(alg_k & SSL_kPSK)) +- /* aNULL or kPSK do not need public keys */ ++ /* aNULL, aSRP or kPSK do not need public keys */ ++ if (!(alg_a & (SSL_aNULL|SSL_aSRP)) && !(alg_k & SSL_kPSK)) + { + SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,ERR_R_INTERNAL_ERROR); + goto err; +@@ -1844,7 +1960,6 @@ fprintf(stderr, "USING TLSv1.2 HASH %s\n", EVP_MD_ + /* still data left over */ + if (n != 0) + { +- al=SSL_AD_DECODE_ERROR; + SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,SSL_R_EXTRA_DATA_IN_MESSAGE); + goto f_err; + } +@@ -2846,7 +2961,11 @@ int ssl3_send_client_key_exchange(SSL *s) + #ifndef OPENSSL_NO_PSK + else if (alg_k & SSL_kPSK) + { +- char identity[PSK_MAX_IDENTITY_LEN]; ++ /* The callback needs PSK_MAX_IDENTITY_LEN + 1 bytes ++ * to return a \0-terminated identity. The last byte ++ * is for us for simulating strnlen. */ ++ char identity[PSK_MAX_IDENTITY_LEN + 2]; ++ size_t identity_len; + unsigned char *t = NULL; + unsigned char psk_or_pre_ms[PSK_MAX_PSK_LEN*2+4]; + unsigned int pre_ms_len = 0, psk_len = 0; +@@ -2860,8 +2979,9 @@ int ssl3_send_client_key_exchange(SSL *s) + goto err; + } + ++ memset(identity, 0, sizeof(identity)); + psk_len = s->psk_client_callback(s, s->ctx->psk_identity_hint, +- identity, PSK_MAX_IDENTITY_LEN, ++ identity, sizeof(identity) - 1, + psk_or_pre_ms, sizeof(psk_or_pre_ms)); + if (psk_len > PSK_MAX_PSK_LEN) + { +@@ -2875,7 +2995,14 @@ int ssl3_send_client_key_exchange(SSL *s) + SSL_R_PSK_IDENTITY_NOT_FOUND); + goto psk_err; + } +- ++ identity[PSK_MAX_IDENTITY_LEN + 1] = '\0'; ++ identity_len = strlen(identity); ++ if (identity_len > PSK_MAX_IDENTITY_LEN) ++ { ++ SSLerr(SSL_F_SSL3_SEND_CLIENT_KEY_EXCHANGE, ++ ERR_R_INTERNAL_ERROR); ++ goto psk_err; ++ } + /* create PSK pre_master_secret */ + pre_ms_len = 2+psk_len+2+psk_len; + t = psk_or_pre_ms; +@@ -2909,14 +3036,13 @@ int ssl3_send_client_key_exchange(SSL *s) + s->session->master_key_length = + s->method->ssl3_enc->generate_master_secret(s, + s->session->master_key, +- psk_or_pre_ms, pre_ms_len); +- n = strlen(identity); +- s2n(n, p); +- memcpy(p, identity, n); +- n+=2; ++ psk_or_pre_ms, pre_ms_len); ++ s2n(identity_len, p); ++ memcpy(p, identity, identity_len); ++ n = 2 + identity_len; + psk_err = 0; + psk_err: +- OPENSSL_cleanse(identity, PSK_MAX_IDENTITY_LEN); ++ OPENSSL_cleanse(identity, sizeof(identity)); + OPENSSL_cleanse(psk_or_pre_ms, sizeof(psk_or_pre_ms)); + if (psk_err != 0) + { +Index: crypto/openssl/ssl/s3_enc.c +=================================================================== +--- crypto/openssl/ssl/s3_enc.c (revision 273303) ++++ crypto/openssl/ssl/s3_enc.c (working copy) +@@ -900,7 +900,7 @@ int ssl3_alert_code(int code) + case SSL_AD_BAD_CERTIFICATE_STATUS_RESPONSE: return(SSL3_AD_HANDSHAKE_FAILURE); + case SSL_AD_BAD_CERTIFICATE_HASH_VALUE: return(SSL3_AD_HANDSHAKE_FAILURE); + case SSL_AD_UNKNOWN_PSK_IDENTITY:return(TLS1_AD_UNKNOWN_PSK_IDENTITY); ++ case SSL_AD_INAPPROPRIATE_FALLBACK:return(TLS1_AD_INAPPROPRIATE_FALLBACK); + default: return(-1); + } + } +- +Index: crypto/openssl/ssl/s3_lib.c +=================================================================== +--- crypto/openssl/ssl/s3_lib.c (revision 273303) ++++ crypto/openssl/ssl/s3_lib.c (working copy) +@@ -3355,6 +3355,33 @@ long ssl3_ctrl(SSL *s, int cmd, long larg, void *p + #endif + + #endif /* !OPENSSL_NO_TLSEXT */ ++ ++ case SSL_CTRL_CHECK_PROTO_VERSION: ++ /* For library-internal use; checks that the current protocol ++ * is the highest enabled version (according to s->ctx->method, ++ * as version negotiation may have changed s->method). */ ++ if (s->version == s->ctx->method->version) ++ return 1; ++ /* Apparently we're using a version-flexible SSL_METHOD ++ * (not at its highest protocol version). */ ++ if (s->ctx->method->version == SSLv23_method()->version) ++ { ++#if TLS_MAX_VERSION != TLS1_2_VERSION ++# error Code needs update for SSLv23_method() support beyond TLS1_2_VERSION. ++#endif ++ if (!(s->options & SSL_OP_NO_TLSv1_2)) ++ return s->version == TLS1_2_VERSION; ++ if (!(s->options & SSL_OP_NO_TLSv1_1)) ++ return s->version == TLS1_1_VERSION; ++ if (!(s->options & SSL_OP_NO_TLSv1)) ++ return s->version == TLS1_VERSION; ++ if (!(s->options & SSL_OP_NO_SSLv3)) ++ return s->version == SSL3_VERSION; ++ if (!(s->options & SSL_OP_NO_SSLv2)) ++ return s->version == SSL2_VERSION; ++ } ++ return 0; /* Unexpected state; fail closed. */ ++ + default: + break; + } +@@ -3714,6 +3741,7 @@ long ssl3_ctx_callback_ctrl(SSL_CTX *ctx, int cmd, + break; + #endif + #endif ++ + default: + return(0); + } +@@ -3822,10 +3850,15 @@ SSL_CIPHER *ssl3_choose_cipher(SSL *s, STACK_OF(SS + emask_k = cert->export_mask_k; + emask_a = cert->export_mask_a; + #ifndef OPENSSL_NO_SRP +- mask_k=cert->mask_k | s->srp_ctx.srp_Mask; +- emask_k=cert->export_mask_k | s->srp_ctx.srp_Mask; ++ if (s->srp_ctx.srp_Mask & SSL_kSRP) ++ { ++ mask_k |= SSL_kSRP; ++ emask_k |= SSL_kSRP; ++ mask_a |= SSL_aSRP; ++ emask_a |= SSL_aSRP; ++ } + #endif +- ++ + #ifdef KSSL_DEBUG + /* printf("ssl3_choose_cipher %d alg= %lx\n", i,c->algorithms);*/ + #endif /* KSSL_DEBUG */ +@@ -4291,4 +4324,3 @@ long ssl_get_algorithm2(SSL *s) + return SSL_HANDSHAKE_MAC_SHA256 | TLS1_PRF_SHA256; + return alg2; + } +- +Index: crypto/openssl/ssl/s3_pkt.c +=================================================================== +--- crypto/openssl/ssl/s3_pkt.c (revision 273303) ++++ crypto/openssl/ssl/s3_pkt.c (working copy) +@@ -273,6 +273,12 @@ int ssl3_read_n(SSL *s, int n, int max, int extend + return(n); + } + ++/* MAX_EMPTY_RECORDS defines the number of consecutive, empty records that will ++ * be processed per call to ssl3_get_record. Without this limit an attacker ++ * could send empty records at a faster rate than we can process and cause ++ * ssl3_get_record to loop forever. */ ++#define MAX_EMPTY_RECORDS 32 ++ + /* Call this to get a new input record. + * It will return <= 0 if more data is needed, normally due to an error + * or non-blocking IO. +@@ -293,6 +299,7 @@ static int ssl3_get_record(SSL *s) + short version; + unsigned mac_size, orig_len; + size_t extra; ++ unsigned empty_record_count = 0; + + rr= &(s->s3->rrec); + sess=s->session; +@@ -523,7 +530,17 @@ printf("\n"); + s->packet_length=0; + + /* just read a 0 length packet */ +- if (rr->length == 0) goto again; ++ if (rr->length == 0) ++ { ++ empty_record_count++; ++ if (empty_record_count > MAX_EMPTY_RECORDS) ++ { ++ al=SSL_AD_UNEXPECTED_MESSAGE; ++ SSLerr(SSL_F_SSL3_GET_RECORD,SSL_R_RECORD_TOO_SMALL); ++ goto f_err; ++ } ++ goto again; ++ } + + #if 0 + fprintf(stderr, "Ultimate Record type=%d, Length=%d\n", rr->type, rr->length); +Index: crypto/openssl/ssl/s3_srvr.c +=================================================================== +--- crypto/openssl/ssl/s3_srvr.c (revision 273303) ++++ crypto/openssl/ssl/s3_srvr.c (working copy) +@@ -154,6 +154,7 @@ + #include + #include "ssl_locl.h" + #include "kssl_lcl.h" ++#include "../crypto/constant_time_locl.h" + #include + #include + #include +@@ -410,9 +411,8 @@ int ssl3_accept(SSL *s) + case SSL3_ST_SW_CERT_B: + /* Check if it is anon DH or anon ECDH, */ + /* normal PSK or KRB5 or SRP */ +- if (!(s->s3->tmp.new_cipher->algorithm_auth & SSL_aNULL) +- && !(s->s3->tmp.new_cipher->algorithm_mkey & SSL_kPSK) +- && !(s->s3->tmp.new_cipher->algorithm_auth & SSL_aKRB5)) ++ if (!(s->s3->tmp.new_cipher->algorithm_auth & (SSL_aNULL|SSL_aKRB5|SSL_aSRP)) ++ && !(s->s3->tmp.new_cipher->algorithm_mkey & SSL_kPSK)) + { + ret=ssl3_send_server_certificate(s); + if (ret <= 0) goto end; +@@ -515,7 +515,9 @@ int ssl3_accept(SSL *s) + * (against the specs, but s3_clnt.c accepts this for SSL 3) */ + !(s->verify_mode & SSL_VERIFY_FAIL_IF_NO_PEER_CERT)) || + /* never request cert in Kerberos ciphersuites */ +- (s->s3->tmp.new_cipher->algorithm_auth & SSL_aKRB5) ++ (s->s3->tmp.new_cipher->algorithm_auth & SSL_aKRB5) || ++ /* don't request certificate for SRP auth */ ++ (s->s3->tmp.new_cipher->algorithm_auth & SSL_aSRP) + /* With normal PSK Certificates and + * Certificate Requests are omitted */ + || (s->s3->tmp.new_cipher->algorithm_mkey & SSL_kPSK)) +@@ -1846,7 +1848,7 @@ int ssl3_send_server_key_exchange(SSL *s) + n+=2+nr[i]; + } + +- if (!(s->s3->tmp.new_cipher->algorithm_auth & SSL_aNULL) ++ if (!(s->s3->tmp.new_cipher->algorithm_auth & (SSL_aNULL|SSL_aSRP)) + && !(s->s3->tmp.new_cipher->algorithm_mkey & SSL_kPSK)) + { + if ((pkey=ssl_get_sign_pkey(s,s->s3->tmp.new_cipher,&md)) +@@ -2166,6 +2168,10 @@ int ssl3_get_client_key_exchange(SSL *s) + #ifndef OPENSSL_NO_RSA + if (alg_k & SSL_kRSA) + { ++ unsigned char rand_premaster_secret[SSL_MAX_MASTER_KEY_LENGTH]; ++ int decrypt_len; ++ unsigned char decrypt_good, version_good; ++ + /* FIX THIS UP EAY EAY EAY EAY */ + if (s->s3->tmp.use_rsa_tmp) + { +@@ -2213,54 +2219,61 @@ int ssl3_get_client_key_exchange(SSL *s) + n=i; + } + +- i=RSA_private_decrypt((int)n,p,p,rsa,RSA_PKCS1_PADDING); ++ /* We must not leak whether a decryption failure occurs because ++ * of Bleichenbacher's attack on PKCS #1 v1.5 RSA padding (see ++ * RFC 2246, section 7.4.7.1). The code follows that advice of ++ * the TLS RFC and generates a random premaster secret for the ++ * case that the decrypt fails. See ++ * https://tools.ietf.org/html/rfc5246#section-7.4.7.1 */ + +- al = -1; +- +- if (i != SSL_MAX_MASTER_KEY_LENGTH) ++ /* should be RAND_bytes, but we cannot work around a failure. */ ++ if (RAND_pseudo_bytes(rand_premaster_secret, ++ sizeof(rand_premaster_secret)) <= 0) ++ goto err; ++ decrypt_len = RSA_private_decrypt((int)n,p,p,rsa,RSA_PKCS1_PADDING); ++ ERR_clear_error(); ++ ++ /* decrypt_len should be SSL_MAX_MASTER_KEY_LENGTH. ++ * decrypt_good will be 0xff if so and zero otherwise. */ ++ decrypt_good = constant_time_eq_int_8(decrypt_len, SSL_MAX_MASTER_KEY_LENGTH); ++ ++ /* If the version in the decrypted pre-master secret is correct ++ * then version_good will be 0xff, otherwise it'll be zero. ++ * The Klima-Pokorny-Rosa extension of Bleichenbacher's attack ++ * (http://eprint.iacr.org/2003/052/) exploits the version ++ * number check as a "bad version oracle". Thus version checks ++ * are done in constant time and are treated like any other ++ * decryption error. */ ++ version_good = constant_time_eq_8(p[0], (unsigned)(s->client_version>>8)); ++ version_good &= constant_time_eq_8(p[1], (unsigned)(s->client_version&0xff)); ++ ++ /* The premaster secret must contain the same version number as ++ * the ClientHello to detect version rollback attacks ++ * (strangely, the protocol does not offer such protection for ++ * DH ciphersuites). However, buggy clients exist that send the ++ * negotiated protocol version instead if the server does not ++ * support the requested protocol version. If ++ * SSL_OP_TLS_ROLLBACK_BUG is set, tolerate such clients. */ ++ if (s->options & SSL_OP_TLS_ROLLBACK_BUG) + { +- al=SSL_AD_DECODE_ERROR; +- /* SSLerr(SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE,SSL_R_BAD_RSA_DECRYPT); */ ++ unsigned char workaround_good; ++ workaround_good = constant_time_eq_8(p[0], (unsigned)(s->version>>8)); ++ workaround_good &= constant_time_eq_8(p[1], (unsigned)(s->version&0xff)); ++ version_good |= workaround_good; + } + +- if ((al == -1) && !((p[0] == (s->client_version>>8)) && (p[1] == (s->client_version & 0xff)))) ++ /* Both decryption and version must be good for decrypt_good ++ * to remain non-zero (0xff). */ ++ decrypt_good &= version_good; ++ ++ /* Now copy rand_premaster_secret over p using ++ * decrypt_good_mask. */ ++ for (i = 0; i < (int) sizeof(rand_premaster_secret); i++) + { +- /* The premaster secret must contain the same version number as the +- * ClientHello to detect version rollback attacks (strangely, the +- * protocol does not offer such protection for DH ciphersuites). +- * However, buggy clients exist that send the negotiated protocol +- * version instead if the server does not support the requested +- * protocol version. +- * If SSL_OP_TLS_ROLLBACK_BUG is set, tolerate such clients. */ +- if (!((s->options & SSL_OP_TLS_ROLLBACK_BUG) && +- (p[0] == (s->version>>8)) && (p[1] == (s->version & 0xff)))) +- { +- al=SSL_AD_DECODE_ERROR; +- /* SSLerr(SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE,SSL_R_BAD_PROTOCOL_VERSION_NUMBER); */ +- +- /* The Klima-Pokorny-Rosa extension of Bleichenbacher's attack +- * (http://eprint.iacr.org/2003/052/) exploits the version +- * number check as a "bad version oracle" -- an alert would +- * reveal that the plaintext corresponding to some ciphertext +- * made up by the adversary is properly formatted except +- * that the version number is wrong. To avoid such attacks, +- * we should treat this just like any other decryption error. */ +- } ++ p[i] = constant_time_select_8(decrypt_good, p[i], ++ rand_premaster_secret[i]); + } + +- if (al != -1) +- { +- /* Some decryption failure -- use random value instead as countermeasure +- * against Bleichenbacher's attack on PKCS #1 v1.5 RSA padding +- * (see RFC 2246, section 7.4.7.1). */ +- ERR_clear_error(); +- i = SSL_MAX_MASTER_KEY_LENGTH; +- p[0] = s->client_version >> 8; +- p[1] = s->client_version & 0xff; +- if (RAND_pseudo_bytes(p+2, i-2) <= 0) /* should be RAND_bytes, but we cannot work around a failure */ +- goto err; +- } +- + s->session->master_key_length= + s->method->ssl3_enc->generate_master_secret(s, + s->session->master_key, +Index: crypto/openssl/ssl/srtp.h +=================================================================== +--- crypto/openssl/ssl/srtp.h (revision 273303) ++++ crypto/openssl/ssl/srtp.h (working copy) +@@ -130,6 +130,8 @@ extern "C" { + #define SRTP_NULL_SHA1_80 0x0005 + #define SRTP_NULL_SHA1_32 0x0006 + ++#ifndef OPENSSL_NO_SRTP ++ + int SSL_CTX_set_tlsext_use_srtp(SSL_CTX *ctx, const char *profiles); + int SSL_set_tlsext_use_srtp(SSL *ctx, const char *profiles); + SRTP_PROTECTION_PROFILE *SSL_get_selected_srtp_profile(SSL *s); +@@ -136,6 +138,8 @@ SRTP_PROTECTION_PROFILE *SSL_get_selected_srtp_pro + + STACK_OF(SRTP_PROTECTION_PROFILE) *SSL_get_srtp_profiles(SSL *ssl); + ++#endif ++ + #ifdef __cplusplus + } + #endif +Index: crypto/openssl/ssl/ssl.h +=================================================================== +--- crypto/openssl/ssl/ssl.h (revision 273303) ++++ crypto/openssl/ssl/ssl.h (working copy) +@@ -653,6 +653,10 @@ struct ssl_session_st + */ + #define SSL_MODE_SEND_CLIENTHELLO_TIME 0x00000020L + #define SSL_MODE_SEND_SERVERHELLO_TIME 0x00000040L ++/* Send TLS_FALLBACK_SCSV in the ClientHello. ++ * To be set by applications that reconnect with a downgraded protocol ++ * version; see draft-ietf-tls-downgrade-scsv-00 for details. */ ++#define SSL_MODE_SEND_FALLBACK_SCSV 0x00000080L + + /* Note: SSL[_CTX]_set_{options,mode} use |= op on the previous value, + * they cannot be used to clear bits. */ +@@ -1511,6 +1515,7 @@ DECLARE_PEM_rw(SSL_SESSION, SSL_SESSION) + #define SSL_AD_BAD_CERTIFICATE_STATUS_RESPONSE TLS1_AD_BAD_CERTIFICATE_STATUS_RESPONSE + #define SSL_AD_BAD_CERTIFICATE_HASH_VALUE TLS1_AD_BAD_CERTIFICATE_HASH_VALUE + #define SSL_AD_UNKNOWN_PSK_IDENTITY TLS1_AD_UNKNOWN_PSK_IDENTITY /* fatal */ ++#define SSL_AD_INAPPROPRIATE_FALLBACK TLS1_AD_INAPPROPRIATE_FALLBACK /* fatal */ + + #define SSL_ERROR_NONE 0 + #define SSL_ERROR_SSL 1 +@@ -1621,6 +1626,8 @@ DECLARE_PEM_rw(SSL_SESSION, SSL_SESSION) + #define SSL_CTRL_GET_EXTRA_CHAIN_CERTS 82 + #define SSL_CTRL_CLEAR_EXTRA_CHAIN_CERTS 83 + ++#define SSL_CTRL_CHECK_PROTO_VERSION 119 ++ + #define DTLSv1_get_timeout(ssl, arg) \ + SSL_ctrl(ssl,DTLS_CTRL_GET_TIMEOUT,0, (void *)arg) + #define DTLSv1_handle_timeout(ssl) \ +@@ -2379,6 +2386,7 @@ void ERR_load_SSL_strings(void); + #define SSL_R_HTTPS_PROXY_REQUEST 155 + #define SSL_R_HTTP_REQUEST 156 + #define SSL_R_ILLEGAL_PADDING 283 ++#define SSL_R_INAPPROPRIATE_FALLBACK 373 + #define SSL_R_INCONSISTENT_COMPRESSION 340 + #define SSL_R_INVALID_CHALLENGE_LENGTH 158 + #define SSL_R_INVALID_COMMAND 280 +@@ -2525,6 +2533,7 @@ void ERR_load_SSL_strings(void); + #define SSL_R_TLSV1_ALERT_DECRYPTION_FAILED 1021 + #define SSL_R_TLSV1_ALERT_DECRYPT_ERROR 1051 + #define SSL_R_TLSV1_ALERT_EXPORT_RESTRICTION 1060 ++#define SSL_R_TLSV1_ALERT_INAPPROPRIATE_FALLBACK 1086 + #define SSL_R_TLSV1_ALERT_INSUFFICIENT_SECURITY 1071 + #define SSL_R_TLSV1_ALERT_INTERNAL_ERROR 1080 + #define SSL_R_TLSV1_ALERT_NO_RENEGOTIATION 1100 +Index: crypto/openssl/ssl/ssl3.h +=================================================================== +--- crypto/openssl/ssl/ssl3.h (revision 273303) ++++ crypto/openssl/ssl/ssl3.h (working copy) +@@ -128,9 +128,14 @@ + extern "C" { + #endif + +-/* Signalling cipher suite value: from draft-ietf-tls-renegotiation-03.txt */ ++/* Signalling cipher suite value from RFC 5746 ++ * (TLS_EMPTY_RENEGOTIATION_INFO_SCSV) */ + #define SSL3_CK_SCSV 0x030000FF + ++/* Signalling cipher suite value from draft-ietf-tls-downgrade-scsv-00 ++ * (TLS_FALLBACK_SCSV) */ ++#define SSL3_CK_FALLBACK_SCSV 0x03005600 ++ + #define SSL3_CK_RSA_NULL_MD5 0x03000001 + #define SSL3_CK_RSA_NULL_SHA 0x03000002 + #define SSL3_CK_RSA_RC4_40_MD5 0x03000003 +Index: crypto/openssl/ssl/ssl_err.c +=================================================================== +--- crypto/openssl/ssl/ssl_err.c (revision 273303) ++++ crypto/openssl/ssl/ssl_err.c (working copy) +@@ -383,6 +383,7 @@ static ERR_STRING_DATA SSL_str_reasons[]= + {ERR_REASON(SSL_R_HTTPS_PROXY_REQUEST) ,"https proxy request"}, + {ERR_REASON(SSL_R_HTTP_REQUEST) ,"http request"}, + {ERR_REASON(SSL_R_ILLEGAL_PADDING) ,"illegal padding"}, ++{ERR_REASON(SSL_R_INAPPROPRIATE_FALLBACK),"inappropriate fallback"}, + {ERR_REASON(SSL_R_INCONSISTENT_COMPRESSION),"inconsistent compression"}, + {ERR_REASON(SSL_R_INVALID_CHALLENGE_LENGTH),"invalid challenge length"}, + {ERR_REASON(SSL_R_INVALID_COMMAND) ,"invalid command"}, +@@ -529,6 +530,7 @@ static ERR_STRING_DATA SSL_str_reasons[]= + {ERR_REASON(SSL_R_TLSV1_ALERT_DECRYPTION_FAILED),"tlsv1 alert decryption failed"}, + {ERR_REASON(SSL_R_TLSV1_ALERT_DECRYPT_ERROR),"tlsv1 alert decrypt error"}, + {ERR_REASON(SSL_R_TLSV1_ALERT_EXPORT_RESTRICTION),"tlsv1 alert export restriction"}, ++{ERR_REASON(SSL_R_TLSV1_ALERT_INAPPROPRIATE_FALLBACK),"tlsv1 alert inappropriate fallback"}, + {ERR_REASON(SSL_R_TLSV1_ALERT_INSUFFICIENT_SECURITY),"tlsv1 alert insufficient security"}, + {ERR_REASON(SSL_R_TLSV1_ALERT_INTERNAL_ERROR),"tlsv1 alert internal error"}, + {ERR_REASON(SSL_R_TLSV1_ALERT_NO_RENEGOTIATION),"tlsv1 alert no renegotiation"}, +Index: crypto/openssl/ssl/ssl_lib.c +=================================================================== +--- crypto/openssl/ssl/ssl_lib.c (revision 273303) ++++ crypto/openssl/ssl/ssl_lib.c (working copy) +@@ -1387,6 +1387,8 @@ int ssl_cipher_list_to_bytes(SSL *s,STACK_OF(SSL_C + + if (sk == NULL) return(0); + q=p; ++ if (put_cb == NULL) ++ put_cb = s->method->put_cipher_by_char; + + for (i=0; isrp_ctx.srp_Mask & SSL_kSRP)) + continue; + #endif /* OPENSSL_NO_SRP */ +- j = put_cb ? put_cb(c,p) : ssl_put_cipher_by_char(s,c,p); ++ j = put_cb(c,p); + p+=j; + } +- /* If p == q, no ciphers and caller indicates an error. Otherwise +- * add SCSV if not renegotiating. +- */ +- if (p != q && !s->renegotiate) ++ /* If p == q, no ciphers; caller indicates an error. ++ * Otherwise, add applicable SCSVs. */ ++ if (p != q) + { +- static SSL_CIPHER scsv = ++ if (!s->renegotiate) + { +- 0, NULL, SSL3_CK_SCSV, 0, 0, 0, 0, 0, 0, 0, 0, 0 +- }; +- j = put_cb ? put_cb(&scsv,p) : ssl_put_cipher_by_char(s,&scsv,p); +- p+=j; ++ static SSL_CIPHER scsv = ++ { ++ 0, NULL, SSL3_CK_SCSV, 0, 0, 0, 0, 0, 0, 0, 0, 0 ++ }; ++ j = put_cb(&scsv,p); ++ p+=j; + #ifdef OPENSSL_RI_DEBUG +- fprintf(stderr, "SCSV sent by client\n"); ++ fprintf(stderr, "TLS_EMPTY_RENEGOTIATION_INFO_SCSV sent by client\n"); + #endif +- } ++ } + ++ if (s->mode & SSL_MODE_SEND_FALLBACK_SCSV) ++ { ++ static SSL_CIPHER scsv = ++ { ++ 0, NULL, SSL3_CK_FALLBACK_SCSV, 0, 0, 0, 0, 0, 0, 0, 0, 0 ++ }; ++ j = put_cb(&scsv,p); ++ p+=j; ++ } ++ } ++ + return(p-q); + } + +@@ -1439,11 +1453,12 @@ STACK_OF(SSL_CIPHER) *ssl_bytes_to_cipher_list(SSL + const SSL_CIPHER *c; + STACK_OF(SSL_CIPHER) *sk; + int i,n; ++ + if (s->s3) + s->s3->send_connection_binding = 0; + + n=ssl_put_cipher_by_char(s,NULL,NULL); +- if ((num%n) != 0) ++ if (n == 0 || (num%n) != 0) + { + SSLerr(SSL_F_SSL_BYTES_TO_CIPHER_LIST,SSL_R_ERROR_IN_RECEIVED_CIPHER_LIST); + return(NULL); +@@ -1458,7 +1473,7 @@ STACK_OF(SSL_CIPHER) *ssl_bytes_to_cipher_list(SSL + + for (i=0; is3 && (n != 3 || !p[0]) && + (p[n-2] == ((SSL3_CK_SCSV >> 8) & 0xff)) && + (p[n-1] == (SSL3_CK_SCSV & 0xff))) +@@ -1478,6 +1493,23 @@ STACK_OF(SSL_CIPHER) *ssl_bytes_to_cipher_list(SSL + continue; + } + ++ /* Check for TLS_FALLBACK_SCSV */ ++ if ((n != 3 || !p[0]) && ++ (p[n-2] == ((SSL3_CK_FALLBACK_SCSV >> 8) & 0xff)) && ++ (p[n-1] == (SSL3_CK_FALLBACK_SCSV & 0xff))) ++ { ++ /* The SCSV indicates that the client previously tried a higher version. ++ * Fail if the current version is an unexpected downgrade. */ ++ if (!SSL_ctrl(s, SSL_CTRL_CHECK_PROTO_VERSION, 0, NULL)) ++ { ++ SSLerr(SSL_F_SSL_BYTES_TO_CIPHER_LIST,SSL_R_INAPPROPRIATE_FALLBACK); ++ if (s->s3) ++ ssl3_send_alert(s,SSL3_AL_FATAL,SSL_AD_INAPPROPRIATE_FALLBACK); ++ goto err; ++ } ++ continue; ++ } ++ + c=ssl_get_cipher_by_char(s,p); + p+=n; + if (c != NULL) +@@ -2944,6 +2976,7 @@ SSL_CTX *SSL_get_SSL_CTX(const SSL *ssl) + + SSL_CTX *SSL_set_SSL_CTX(SSL *ssl, SSL_CTX* ctx) + { ++ CERT *ocert = ssl->cert; + if (ssl->ctx == ctx) + return ssl->ctx; + #ifndef OPENSSL_NO_TLSEXT +@@ -2950,9 +2983,19 @@ SSL_CTX *SSL_set_SSL_CTX(SSL *ssl, SSL_CTX* ctx) + if (ctx == NULL) + ctx = ssl->initial_ctx; + #endif +- if (ssl->cert != NULL) +- ssl_cert_free(ssl->cert); + ssl->cert = ssl_cert_dup(ctx->cert); ++ if (ocert != NULL) ++ { ++ int i; ++ /* Copy negotiated digests from original */ ++ for (i = 0; i < SSL_PKEY_NUM; i++) ++ { ++ CERT_PKEY *cpk = ocert->pkeys + i; ++ CERT_PKEY *rpk = ssl->cert->pkeys + i; ++ rpk->digest = cpk->digest; ++ } ++ ssl_cert_free(ocert); ++ } + CRYPTO_add(&ctx->references,1,CRYPTO_LOCK_SSL_CTX); + if (ssl->ctx != NULL) + SSL_CTX_free(ssl->ctx); /* decrement reference count */ +Index: crypto/openssl/ssl/t1_enc.c +=================================================================== +--- crypto/openssl/ssl/t1_enc.c (revision 273303) ++++ crypto/openssl/ssl/t1_enc.c (working copy) +@@ -1241,6 +1241,7 @@ int tls1_alert_code(int code) + case SSL_AD_BAD_CERTIFICATE_STATUS_RESPONSE: return(TLS1_AD_BAD_CERTIFICATE_STATUS_RESPONSE); + case SSL_AD_BAD_CERTIFICATE_HASH_VALUE: return(TLS1_AD_BAD_CERTIFICATE_HASH_VALUE); + case SSL_AD_UNKNOWN_PSK_IDENTITY:return(TLS1_AD_UNKNOWN_PSK_IDENTITY); ++ case SSL_AD_INAPPROPRIATE_FALLBACK:return(TLS1_AD_INAPPROPRIATE_FALLBACK); + #if 0 /* not appropriate for TLS, not used for DTLS */ + case DTLS1_AD_MISSING_HANDSHAKE_MESSAGE: return + (DTLS1_AD_MISSING_HANDSHAKE_MESSAGE); +Index: crypto/openssl/ssl/t1_lib.c +=================================================================== +--- crypto/openssl/ssl/t1_lib.c (revision 273303) ++++ crypto/openssl/ssl/t1_lib.c (working copy) +@@ -643,7 +643,7 @@ unsigned char *ssl_add_clienthello_tlsext(SSL *s, + #endif + + #ifndef OPENSSL_NO_SRTP +- if(SSL_get_srtp_profiles(s)) ++ if(SSL_IS_DTLS(s) && SSL_get_srtp_profiles(s)) + { + int el; + +@@ -806,7 +806,7 @@ unsigned char *ssl_add_serverhello_tlsext(SSL *s, + #endif + + #ifndef OPENSSL_NO_SRTP +- if(s->srtp_profile) ++ if(SSL_IS_DTLS(s) && s->srtp_profile) + { + int el; + +@@ -1444,7 +1444,8 @@ int ssl_parse_clienthello_tlsext(SSL *s, unsigned + + /* session ticket processed earlier */ + #ifndef OPENSSL_NO_SRTP +- else if (type == TLSEXT_TYPE_use_srtp) ++ else if (SSL_IS_DTLS(s) && SSL_get_srtp_profiles(s) ++ && type == TLSEXT_TYPE_use_srtp) + { + if(ssl_parse_clienthello_use_srtp_ext(s, data, size, + al)) +@@ -1698,7 +1699,7 @@ int ssl_parse_serverhello_tlsext(SSL *s, unsigned + } + #endif + #ifndef OPENSSL_NO_SRTP +- else if (type == TLSEXT_TYPE_use_srtp) ++ else if (SSL_IS_DTLS(s) && type == TLSEXT_TYPE_use_srtp) + { + if(ssl_parse_serverhello_use_srtp_ext(s, data, size, + al)) +@@ -2347,7 +2348,10 @@ static int tls_decrypt_ticket(SSL *s, const unsign + HMAC_Final(&hctx, tick_hmac, NULL); + HMAC_CTX_cleanup(&hctx); + if (CRYPTO_memcmp(tick_hmac, etick + eticklen, mlen)) ++ { ++ EVP_CIPHER_CTX_cleanup(&ctx); + return 2; ++ } + /* Attempt to decrypt session data */ + /* Move p after IV to start of encrypted ticket, update length */ + p = etick + 16 + EVP_CIPHER_CTX_iv_length(&ctx); +Index: crypto/openssl/ssl/tls1.h +=================================================================== +--- crypto/openssl/ssl/tls1.h (revision 273303) ++++ crypto/openssl/ssl/tls1.h (working copy) +@@ -159,17 +159,19 @@ extern "C" { + + #define TLS1_ALLOW_EXPERIMENTAL_CIPHERSUITES 0 + ++#define TLS1_VERSION 0x0301 ++#define TLS1_1_VERSION 0x0302 + #define TLS1_2_VERSION 0x0303 +-#define TLS1_2_VERSION_MAJOR 0x03 +-#define TLS1_2_VERSION_MINOR 0x03 ++#define TLS_MAX_VERSION TLS1_2_VERSION + +-#define TLS1_1_VERSION 0x0302 ++#define TLS1_VERSION_MAJOR 0x03 ++#define TLS1_VERSION_MINOR 0x01 ++ + #define TLS1_1_VERSION_MAJOR 0x03 + #define TLS1_1_VERSION_MINOR 0x02 + +-#define TLS1_VERSION 0x0301 +-#define TLS1_VERSION_MAJOR 0x03 +-#define TLS1_VERSION_MINOR 0x01 ++#define TLS1_2_VERSION_MAJOR 0x03 ++#define TLS1_2_VERSION_MINOR 0x03 + + #define TLS1_get_version(s) \ + ((s->version >> 8) == TLS1_VERSION_MAJOR ? s->version : 0) +@@ -187,6 +189,7 @@ extern "C" { + #define TLS1_AD_PROTOCOL_VERSION 70 /* fatal */ + #define TLS1_AD_INSUFFICIENT_SECURITY 71 /* fatal */ + #define TLS1_AD_INTERNAL_ERROR 80 /* fatal */ ++#define TLS1_AD_INAPPROPRIATE_FALLBACK 86 /* fatal */ + #define TLS1_AD_USER_CANCELLED 90 + #define TLS1_AD_NO_RENEGOTIATION 100 + /* codes 110-114 are from RFC3546 */ +Index: crypto/openssl/util/mk1mf.pl +=================================================================== +--- crypto/openssl/util/mk1mf.pl (revision 273303) ++++ crypto/openssl/util/mk1mf.pl (working copy) +@@ -1145,6 +1145,7 @@ sub read_options + "dll" => \$shlib, + "shared" => 0, + "no-sctp" => 0, ++ "no-srtp" => 0, + "no-gmp" => 0, + "no-rfc3779" => 0, + "no-montasm" => 0, +Index: crypto/openssl/util/mkdef.pl +=================================================================== +--- crypto/openssl/util/mkdef.pl (revision 273303) ++++ crypto/openssl/util/mkdef.pl (working copy) +@@ -117,6 +117,8 @@ my @known_algorithms = ( "RC2", "RC4", "RC5", "IDE + "SSL_INTERN", + # SCTP + "SCTP", ++ # SRTP ++ "SRTP", + # Unit testing + "UNIT_TEST"); + +@@ -138,7 +140,7 @@ my $no_ec; my $no_ecdsa; my $no_ecdh; my $no_engin + my $no_fp_api; my $no_static_engine=1; my $no_gmp; my $no_deprecated; + my $no_rfc3779; my $no_psk; my $no_tlsext; my $no_cms; my $no_capieng; + my $no_jpake; my $no_srp; my $no_ssl2; my $no_ec2m; my $no_nistp_gcc; +-my $no_nextprotoneg; my $no_sctp; ++my $no_nextprotoneg; my $no_sctp; my $no_srtp; + my $no_unit_test; + + my $fips; +@@ -238,6 +240,7 @@ foreach (@ARGV, split(/ /, $options)) + elsif (/^no-jpake$/) { $no_jpake=1; } + elsif (/^no-srp$/) { $no_srp=1; } + elsif (/^no-sctp$/) { $no_sctp=1; } ++ elsif (/^no-srtp$/) { $no_srtp=1; } + elsif (/^no-unit-test$/){ $no_unit_test=1; } + } + +@@ -1209,6 +1212,7 @@ sub is_valid + if ($keyword eq "JPAKE" && $no_jpake) { return 0; } + if ($keyword eq "SRP" && $no_srp) { return 0; } + if ($keyword eq "SCTP" && $no_sctp) { return 0; } ++ if ($keyword eq "SRTP" && $no_srtp) { return 0; } + if ($keyword eq "UNIT_TEST" && $no_unit_test) { return 0; } + if ($keyword eq "DEPRECATED" && $no_deprecated) { return 0; } + +Index: crypto/openssl/util/ssleay.num +=================================================================== +--- crypto/openssl/util/ssleay.num (revision 273303) ++++ crypto/openssl/util/ssleay.num (working copy) +@@ -310,14 +310,14 @@ TLSv1_2_method 350 EXIST: + SSL_SESSION_get_id_len 351 NOEXIST::FUNCTION: + kssl_ctx_get0_client_princ 352 EXIST::FUNCTION:KRB5 + SSL_export_keying_material 353 EXIST::FUNCTION:TLSEXT +-SSL_set_tlsext_use_srtp 354 EXIST::FUNCTION: ++SSL_set_tlsext_use_srtp 354 EXIST::FUNCTION:SRTP + SSL_CTX_set_next_protos_advertised_cb 355 EXIST:!VMS:FUNCTION:NEXTPROTONEG + SSL_CTX_set_next_protos_adv_cb 355 EXIST:VMS:FUNCTION:NEXTPROTONEG + SSL_get0_next_proto_negotiated 356 EXIST::FUNCTION:NEXTPROTONEG +-SSL_get_selected_srtp_profile 357 EXIST::FUNCTION: +-SSL_CTX_set_tlsext_use_srtp 358 EXIST::FUNCTION: ++SSL_get_selected_srtp_profile 357 EXIST::FUNCTION:SRTP ++SSL_CTX_set_tlsext_use_srtp 358 EXIST::FUNCTION:SRTP + SSL_select_next_proto 359 EXIST::FUNCTION:NEXTPROTONEG +-SSL_get_srtp_profiles 360 EXIST::FUNCTION: ++SSL_get_srtp_profiles 360 EXIST::FUNCTION:SRTP + SSL_CTX_set_next_proto_select_cb 361 EXIST:!VMS:FUNCTION:NEXTPROTONEG + SSL_CTX_set_next_proto_sel_cb 361 EXIST:VMS:FUNCTION:NEXTPROTONEG + SSL_SESSION_get_compress_id 362 EXIST::FUNCTION: +Index: secure/lib/libcrypto/Makefile.inc +=================================================================== +--- secure/lib/libcrypto/Makefile.inc (revision 273303) ++++ secure/lib/libcrypto/Makefile.inc (working copy) +@@ -3,8 +3,8 @@ + .include + + # OpenSSL version used for manual page generation +-OPENSSL_VER= 1.0.1i +-OPENSSL_DATE= 2014-08-06 ++OPENSSL_VER= 1.0.1j ++OPENSSL_DATE= 2014-10-15 + + LCRYPTO_SRC= ${.CURDIR}/../../../crypto/openssl + LCRYPTO_DOC= ${.CURDIR}/../../../crypto/openssl/doc +Index: secure/lib/libcrypto/Makefile.man +=================================================================== +--- secure/lib/libcrypto/Makefile.man (revision 273303) ++++ secure/lib/libcrypto/Makefile.man (working copy) +@@ -47,6 +47,7 @@ MAN+= BN_swap.3 + MAN+= BN_zero.3 + MAN+= CMS_add0_cert.3 + MAN+= CMS_add1_recipient_cert.3 ++MAN+= CMS_add1_signer.3 + MAN+= CMS_compress.3 + MAN+= CMS_decrypt.3 + MAN+= CMS_encrypt.3 +@@ -56,7 +57,6 @@ MAN+= CMS_get0_SignerInfos.3 + MAN+= CMS_get0_type.3 + MAN+= CMS_get1_ReceiptRequest.3 + MAN+= CMS_sign.3 +-MAN+= CMS_sign_add1_signer.3 + MAN+= CMS_sign_receipt.3 + MAN+= CMS_uncompress.3 + MAN+= CMS_verify.3 +@@ -397,6 +397,7 @@ MLINKS+= CMS_add0_cert.3 CMS_get1_certs.3 + MLINKS+= CMS_add0_cert.3 CMS_add0_crl.3 + MLINKS+= CMS_add0_cert.3 CMS_get1_crls.3 + MLINKS+= CMS_add1_recipient_cert.3 CMS_add0_recipient_key.3 ++MLINKS+= CMS_add1_signer.3 CMS_SignerInfo_sign.3 + MLINKS+= CMS_get0_RecipientInfos.3 CMS_RecipientInfo_type.3 + MLINKS+= CMS_get0_RecipientInfos.3 CMS_RecipientInfo_ktri_get0_signer_id.3 + MLINKS+= CMS_get0_RecipientInfos.3 CMS_RecipientInfo_ktri_cert_cmp.3 +@@ -413,7 +414,6 @@ MLINKS+= CMS_get0_type.3 CMS_get0_eContentType.3 + MLINKS+= CMS_get1_ReceiptRequest.3 CMS_ReceiptRequest_create0.3 + MLINKS+= CMS_get1_ReceiptRequest.3 CMS_add1_ReceiptRequest.3 + MLINKS+= CMS_get1_ReceiptRequest.3 CMS_ReceiptRequest_get0_values.3 +-MLINKS+= CMS_sign_add1_signer.3 CMS_SignerInfo_sign.3 + MLINKS+= CONF_modules_free.3 CONF_modules_finish.3 + MLINKS+= CONF_modules_free.3 CONF_modules_unload.3 + MLINKS+= CONF_modules_load_file.3 CONF_modules_load.3 +Index: secure/lib/libcrypto/man/ASN1_OBJECT_new.3 +=================================================================== +--- secure/lib/libcrypto/man/ASN1_OBJECT_new.3 (revision 273303) ++++ secure/lib/libcrypto/man/ASN1_OBJECT_new.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "ASN1_OBJECT_new 3" +-.TH ASN1_OBJECT_new 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH ASN1_OBJECT_new 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/ASN1_STRING_length.3 +=================================================================== +--- secure/lib/libcrypto/man/ASN1_STRING_length.3 (revision 273303) ++++ secure/lib/libcrypto/man/ASN1_STRING_length.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "ASN1_STRING_length 3" +-.TH ASN1_STRING_length 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH ASN1_STRING_length 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/ASN1_STRING_new.3 +=================================================================== +--- secure/lib/libcrypto/man/ASN1_STRING_new.3 (revision 273303) ++++ secure/lib/libcrypto/man/ASN1_STRING_new.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "ASN1_STRING_new 3" +-.TH ASN1_STRING_new 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH ASN1_STRING_new 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/ASN1_STRING_print_ex.3 +=================================================================== +--- secure/lib/libcrypto/man/ASN1_STRING_print_ex.3 (revision 273303) ++++ secure/lib/libcrypto/man/ASN1_STRING_print_ex.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "ASN1_STRING_print_ex 3" +-.TH ASN1_STRING_print_ex 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH ASN1_STRING_print_ex 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/ASN1_generate_nconf.3 +=================================================================== +--- secure/lib/libcrypto/man/ASN1_generate_nconf.3 (revision 273303) ++++ secure/lib/libcrypto/man/ASN1_generate_nconf.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "ASN1_generate_nconf 3" +-.TH ASN1_generate_nconf 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH ASN1_generate_nconf 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/BIO_ctrl.3 +=================================================================== +--- secure/lib/libcrypto/man/BIO_ctrl.3 (revision 273303) ++++ secure/lib/libcrypto/man/BIO_ctrl.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "BIO_ctrl 3" +-.TH BIO_ctrl 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH BIO_ctrl 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/BIO_f_base64.3 +=================================================================== +--- secure/lib/libcrypto/man/BIO_f_base64.3 (revision 273303) ++++ secure/lib/libcrypto/man/BIO_f_base64.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "BIO_f_base64 3" +-.TH BIO_f_base64 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH BIO_f_base64 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/BIO_f_buffer.3 +=================================================================== +--- secure/lib/libcrypto/man/BIO_f_buffer.3 (revision 273303) ++++ secure/lib/libcrypto/man/BIO_f_buffer.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "BIO_f_buffer 3" +-.TH BIO_f_buffer 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH BIO_f_buffer 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/BIO_f_cipher.3 +=================================================================== +--- secure/lib/libcrypto/man/BIO_f_cipher.3 (revision 273303) ++++ secure/lib/libcrypto/man/BIO_f_cipher.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "BIO_f_cipher 3" +-.TH BIO_f_cipher 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH BIO_f_cipher 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/BIO_f_md.3 +=================================================================== +--- secure/lib/libcrypto/man/BIO_f_md.3 (revision 273303) ++++ secure/lib/libcrypto/man/BIO_f_md.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "BIO_f_md 3" +-.TH BIO_f_md 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH BIO_f_md 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/BIO_f_null.3 +=================================================================== +--- secure/lib/libcrypto/man/BIO_f_null.3 (revision 273303) ++++ secure/lib/libcrypto/man/BIO_f_null.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "BIO_f_null 3" +-.TH BIO_f_null 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH BIO_f_null 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/BIO_f_ssl.3 +=================================================================== +--- secure/lib/libcrypto/man/BIO_f_ssl.3 (revision 273303) ++++ secure/lib/libcrypto/man/BIO_f_ssl.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "BIO_f_ssl 3" +-.TH BIO_f_ssl 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH BIO_f_ssl 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/BIO_find_type.3 +=================================================================== +--- secure/lib/libcrypto/man/BIO_find_type.3 (revision 273303) ++++ secure/lib/libcrypto/man/BIO_find_type.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "BIO_find_type 3" +-.TH BIO_find_type 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH BIO_find_type 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/BIO_new.3 +=================================================================== +--- secure/lib/libcrypto/man/BIO_new.3 (revision 273303) ++++ secure/lib/libcrypto/man/BIO_new.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "BIO_new 3" +-.TH BIO_new 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH BIO_new 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/BIO_new_CMS.3 +=================================================================== +--- secure/lib/libcrypto/man/BIO_new_CMS.3 (revision 273303) ++++ secure/lib/libcrypto/man/BIO_new_CMS.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "BIO_new_CMS 3" +-.TH BIO_new_CMS 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH BIO_new_CMS 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/BIO_push.3 +=================================================================== +--- secure/lib/libcrypto/man/BIO_push.3 (revision 273303) ++++ secure/lib/libcrypto/man/BIO_push.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "BIO_push 3" +-.TH BIO_push 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH BIO_push 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/BIO_read.3 +=================================================================== +--- secure/lib/libcrypto/man/BIO_read.3 (revision 273303) ++++ secure/lib/libcrypto/man/BIO_read.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "BIO_read 3" +-.TH BIO_read 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH BIO_read 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/BIO_s_accept.3 +=================================================================== +--- secure/lib/libcrypto/man/BIO_s_accept.3 (revision 273303) ++++ secure/lib/libcrypto/man/BIO_s_accept.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "BIO_s_accept 3" +-.TH BIO_s_accept 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH BIO_s_accept 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +@@ -187,8 +187,8 @@ the accept socket. See \fIBIO_s_fd\fR\|(3) + \&\fIBIO_set_accept_port()\fR uses the string \fBname\fR to set the accept + port. The port is represented as a string of the form \*(L"host:port\*(R", + where \*(L"host\*(R" is the interface to use and \*(L"port\*(R" is the port. +-Either or both values can be \*(L"*\*(R" which is interpreted as meaning +-any interface or port respectively. \*(L"port\*(R" has the same syntax ++The host can be can be \*(L"*\*(R" which is interpreted as meaning ++any interface; \*(L"port\*(R" has the same syntax + as the port specified in \fIBIO_set_conn_port()\fR for connect BIOs, + that is it can be a numerical port string or a string to lookup + using \fIgetservbyname()\fR and a string table. +Index: secure/lib/libcrypto/man/BIO_s_bio.3 +=================================================================== +--- secure/lib/libcrypto/man/BIO_s_bio.3 (revision 273303) ++++ secure/lib/libcrypto/man/BIO_s_bio.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "BIO_s_bio 3" +-.TH BIO_s_bio 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH BIO_s_bio 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/BIO_s_connect.3 +=================================================================== +--- secure/lib/libcrypto/man/BIO_s_connect.3 (revision 273303) ++++ secure/lib/libcrypto/man/BIO_s_connect.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "BIO_s_connect 3" +-.TH BIO_s_connect 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH BIO_s_connect 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/BIO_s_fd.3 +=================================================================== +--- secure/lib/libcrypto/man/BIO_s_fd.3 (revision 273303) ++++ secure/lib/libcrypto/man/BIO_s_fd.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "BIO_s_fd 3" +-.TH BIO_s_fd 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH BIO_s_fd 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/BIO_s_file.3 +=================================================================== +--- secure/lib/libcrypto/man/BIO_s_file.3 (revision 273303) ++++ secure/lib/libcrypto/man/BIO_s_file.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "BIO_s_file 3" +-.TH BIO_s_file 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH BIO_s_file 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/BIO_s_mem.3 +=================================================================== +--- secure/lib/libcrypto/man/BIO_s_mem.3 (revision 273303) ++++ secure/lib/libcrypto/man/BIO_s_mem.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "BIO_s_mem 3" +-.TH BIO_s_mem 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH BIO_s_mem 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/BIO_s_null.3 +=================================================================== +--- secure/lib/libcrypto/man/BIO_s_null.3 (revision 273303) ++++ secure/lib/libcrypto/man/BIO_s_null.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "BIO_s_null 3" +-.TH BIO_s_null 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH BIO_s_null 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/BIO_s_socket.3 +=================================================================== +--- secure/lib/libcrypto/man/BIO_s_socket.3 (revision 273303) ++++ secure/lib/libcrypto/man/BIO_s_socket.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "BIO_s_socket 3" +-.TH BIO_s_socket 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH BIO_s_socket 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/BIO_set_callback.3 +=================================================================== +--- secure/lib/libcrypto/man/BIO_set_callback.3 (revision 273303) ++++ secure/lib/libcrypto/man/BIO_set_callback.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "BIO_set_callback 3" +-.TH BIO_set_callback 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH BIO_set_callback 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/BIO_should_retry.3 +=================================================================== +--- secure/lib/libcrypto/man/BIO_should_retry.3 (revision 273303) ++++ secure/lib/libcrypto/man/BIO_should_retry.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "BIO_should_retry 3" +-.TH BIO_should_retry 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH BIO_should_retry 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/BN_BLINDING_new.3 +=================================================================== +--- secure/lib/libcrypto/man/BN_BLINDING_new.3 (revision 273303) ++++ secure/lib/libcrypto/man/BN_BLINDING_new.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "BN_BLINDING_new 3" +-.TH BN_BLINDING_new 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH BN_BLINDING_new 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/BN_CTX_new.3 +=================================================================== +--- secure/lib/libcrypto/man/BN_CTX_new.3 (revision 273303) ++++ secure/lib/libcrypto/man/BN_CTX_new.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "BN_CTX_new 3" +-.TH BN_CTX_new 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH BN_CTX_new 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/BN_CTX_start.3 +=================================================================== +--- secure/lib/libcrypto/man/BN_CTX_start.3 (revision 273303) ++++ secure/lib/libcrypto/man/BN_CTX_start.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "BN_CTX_start 3" +-.TH BN_CTX_start 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH BN_CTX_start 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/BN_add.3 +=================================================================== +--- secure/lib/libcrypto/man/BN_add.3 (revision 273303) ++++ secure/lib/libcrypto/man/BN_add.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "BN_add 3" +-.TH BN_add 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH BN_add 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/BN_add_word.3 +=================================================================== +--- secure/lib/libcrypto/man/BN_add_word.3 (revision 273303) ++++ secure/lib/libcrypto/man/BN_add_word.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "BN_add_word 3" +-.TH BN_add_word 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH BN_add_word 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/BN_bn2bin.3 +=================================================================== +--- secure/lib/libcrypto/man/BN_bn2bin.3 (revision 273303) ++++ secure/lib/libcrypto/man/BN_bn2bin.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "BN_bn2bin 3" +-.TH BN_bn2bin 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH BN_bn2bin 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/BN_cmp.3 +=================================================================== +--- secure/lib/libcrypto/man/BN_cmp.3 (revision 273303) ++++ secure/lib/libcrypto/man/BN_cmp.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "BN_cmp 3" +-.TH BN_cmp 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH BN_cmp 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/BN_copy.3 +=================================================================== +--- secure/lib/libcrypto/man/BN_copy.3 (revision 273303) ++++ secure/lib/libcrypto/man/BN_copy.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "BN_copy 3" +-.TH BN_copy 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH BN_copy 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/BN_generate_prime.3 +=================================================================== +--- secure/lib/libcrypto/man/BN_generate_prime.3 (revision 273303) ++++ secure/lib/libcrypto/man/BN_generate_prime.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "BN_generate_prime 3" +-.TH BN_generate_prime 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH BN_generate_prime 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/BN_mod_inverse.3 +=================================================================== +--- secure/lib/libcrypto/man/BN_mod_inverse.3 (revision 273303) ++++ secure/lib/libcrypto/man/BN_mod_inverse.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "BN_mod_inverse 3" +-.TH BN_mod_inverse 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH BN_mod_inverse 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/BN_mod_mul_montgomery.3 +=================================================================== +--- secure/lib/libcrypto/man/BN_mod_mul_montgomery.3 (revision 273303) ++++ secure/lib/libcrypto/man/BN_mod_mul_montgomery.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "BN_mod_mul_montgomery 3" +-.TH BN_mod_mul_montgomery 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH BN_mod_mul_montgomery 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/BN_mod_mul_reciprocal.3 +=================================================================== +--- secure/lib/libcrypto/man/BN_mod_mul_reciprocal.3 (revision 273303) ++++ secure/lib/libcrypto/man/BN_mod_mul_reciprocal.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "BN_mod_mul_reciprocal 3" +-.TH BN_mod_mul_reciprocal 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH BN_mod_mul_reciprocal 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/BN_new.3 +=================================================================== +--- secure/lib/libcrypto/man/BN_new.3 (revision 273303) ++++ secure/lib/libcrypto/man/BN_new.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "BN_new 3" +-.TH BN_new 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH BN_new 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/BN_num_bytes.3 +=================================================================== +--- secure/lib/libcrypto/man/BN_num_bytes.3 (revision 273303) ++++ secure/lib/libcrypto/man/BN_num_bytes.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "BN_num_bytes 3" +-.TH BN_num_bytes 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH BN_num_bytes 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/BN_rand.3 +=================================================================== +--- secure/lib/libcrypto/man/BN_rand.3 (revision 273303) ++++ secure/lib/libcrypto/man/BN_rand.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "BN_rand 3" +-.TH BN_rand 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH BN_rand 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/BN_set_bit.3 +=================================================================== +--- secure/lib/libcrypto/man/BN_set_bit.3 (revision 273303) ++++ secure/lib/libcrypto/man/BN_set_bit.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "BN_set_bit 3" +-.TH BN_set_bit 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH BN_set_bit 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/BN_swap.3 +=================================================================== +--- secure/lib/libcrypto/man/BN_swap.3 (revision 273303) ++++ secure/lib/libcrypto/man/BN_swap.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "BN_swap 3" +-.TH BN_swap 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH BN_swap 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/BN_zero.3 +=================================================================== +--- secure/lib/libcrypto/man/BN_zero.3 (revision 273303) ++++ secure/lib/libcrypto/man/BN_zero.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "BN_zero 3" +-.TH BN_zero 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH BN_zero 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/CMS_add0_cert.3 +=================================================================== +--- secure/lib/libcrypto/man/CMS_add0_cert.3 (revision 273303) ++++ secure/lib/libcrypto/man/CMS_add0_cert.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "CMS_add0_cert 3" +-.TH CMS_add0_cert 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH CMS_add0_cert 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/CMS_add1_recipient_cert.3 +=================================================================== +--- secure/lib/libcrypto/man/CMS_add1_recipient_cert.3 (revision 273303) ++++ secure/lib/libcrypto/man/CMS_add1_recipient_cert.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "CMS_add1_recipient_cert 3" +-.TH CMS_add1_recipient_cert 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH CMS_add1_recipient_cert 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/CMS_add1_signer.3 +=================================================================== +--- secure/lib/libcrypto/man/CMS_add1_signer.3 (revision 0) ++++ secure/lib/libcrypto/man/CMS_add1_signer.3 (working copy) +@@ -0,0 +1,224 @@ ++.\" Automatically generated by Pod::Man 2.25 (Pod::Simple 3.28) ++.\" ++.\" Standard preamble: ++.\" ======================================================================== ++.de Sp \" Vertical space (when we can't use .PP) ++.if t .sp .5v ++.if n .sp ++.. ++.de Vb \" Begin verbatim text ++.ft CW ++.nf ++.ne \\$1 ++.. ++.de Ve \" End verbatim text ++.ft R ++.fi ++.. ++.\" Set up some character translations and predefined strings. \*(-- will ++.\" give an unbreakable dash, \*(PI will give pi, \*(L" will give a left ++.\" double quote, and \*(R" will give a right double quote. \*(C+ will ++.\" give a nicer C++. Capital omega is used to do unbreakable dashes and ++.\" therefore won't be available. \*(C` and \*(C' expand to `' in nroff, ++.\" nothing in troff, for use with C<>. ++.tr \(*W- ++.ds C+ C\v'-.1v'\h'-1p'\s-2+\h'-1p'+\s0\v'.1v'\h'-1p' ++.ie n \{\ ++. ds -- \(*W- ++. ds PI pi ++. if (\n(.H=4u)&(1m=24u) .ds -- \(*W\h'-12u'\(*W\h'-12u'-\" diablo 10 pitch ++. if (\n(.H=4u)&(1m=20u) .ds -- \(*W\h'-12u'\(*W\h'-8u'-\" diablo 12 pitch ++. ds L" "" ++. ds R" "" ++. ds C` "" ++. ds C' "" ++'br\} ++.el\{\ ++. ds -- \|\(em\| ++. ds PI \(*p ++. ds L" `` ++. ds R" '' ++'br\} ++.\" ++.\" Escape single quotes in literal strings from groff's Unicode transform. ++.ie \n(.g .ds Aq \(aq ++.el .ds Aq ' ++.\" ++.\" If the F register is turned on, we'll generate index entries on stderr for ++.\" titles (.TH), headers (.SH), subsections (.SS), items (.Ip), and index ++.\" entries marked with X<> in POD. Of course, you'll have to process the ++.\" output yourself in some meaningful fashion. ++.ie \nF \{\ ++. de IX ++. tm Index:\\$1\t\\n%\t"\\$2" ++.. ++. nr % 0 ++. rr F ++.\} ++.el \{\ ++. de IX ++.. ++.\} ++.\" ++.\" Accent mark definitions (@(#)ms.acc 1.5 88/02/08 SMI; from UCB 4.2). ++.\" Fear. Run. Save yourself. No user-serviceable parts. ++. \" fudge factors for nroff and troff ++.if n \{\ ++. ds #H 0 ++. ds #V .8m ++. ds #F .3m ++. ds #[ \f1 ++. ds #] \fP ++.\} ++.if t \{\ ++. ds #H ((1u-(\\\\n(.fu%2u))*.13m) ++. ds #V .6m ++. ds #F 0 ++. ds #[ \& ++. ds #] \& ++.\} ++. \" simple accents for nroff and troff ++.if n \{\ ++. ds ' \& ++. ds ` \& ++. ds ^ \& ++. ds , \& ++. ds ~ ~ ++. ds / ++.\} ++.if t \{\ ++. ds ' \\k:\h'-(\\n(.wu*8/10-\*(#H)'\'\h"|\\n:u" ++. ds ` \\k:\h'-(\\n(.wu*8/10-\*(#H)'\`\h'|\\n:u' ++. ds ^ \\k:\h'-(\\n(.wu*10/11-\*(#H)'^\h'|\\n:u' ++. ds , \\k:\h'-(\\n(.wu*8/10)',\h'|\\n:u' ++. ds ~ \\k:\h'-(\\n(.wu-\*(#H-.1m)'~\h'|\\n:u' ++. ds / \\k:\h'-(\\n(.wu*8/10-\*(#H)'\z\(sl\h'|\\n:u' ++.\} ++. \" troff and (daisy-wheel) nroff accents ++.ds : \\k:\h'-(\\n(.wu*8/10-\*(#H+.1m+\*(#F)'\v'-\*(#V'\z.\h'.2m+\*(#F'.\h'|\\n:u'\v'\*(#V' ++.ds 8 \h'\*(#H'\(*b\h'-\*(#H' ++.ds o \\k:\h'-(\\n(.wu+\w'\(de'u-\*(#H)/2u'\v'-.3n'\*(#[\z\(de\v'.3n'\h'|\\n:u'\*(#] ++.ds d- \h'\*(#H'\(pd\h'-\w'~'u'\v'-.25m'\f2\(hy\fP\v'.25m'\h'-\*(#H' ++.ds D- D\\k:\h'-\w'D'u'\v'-.11m'\z\(hy\v'.11m'\h'|\\n:u' ++.ds th \*(#[\v'.3m'\s+1I\s-1\v'-.3m'\h'-(\w'I'u*2/3)'\s-1o\s+1\*(#] ++.ds Th \*(#[\s+2I\s-2\h'-\w'I'u*3/5'\v'-.3m'o\v'.3m'\*(#] ++.ds ae a\h'-(\w'a'u*4/10)'e ++.ds Ae A\h'-(\w'A'u*4/10)'E ++. \" corrections for vroff ++.if v .ds ~ \\k:\h'-(\\n(.wu*9/10-\*(#H)'\s-2\u~\d\s+2\h'|\\n:u' ++.if v .ds ^ \\k:\h'-(\\n(.wu*10/11-\*(#H)'\v'-.4m'^\v'.4m'\h'|\\n:u' ++. \" for low resolution devices (crt and lpr) ++.if \n(.H>23 .if \n(.V>19 \ ++\{\ ++. ds : e ++. ds 8 ss ++. ds o a ++. ds d- d\h'-1'\(ga ++. ds D- D\h'-1'\(hy ++. ds th \o'bp' ++. ds Th \o'LP' ++. ds ae ae ++. ds Ae AE ++.\} ++.rm #[ #] #H #V #F C ++.\" ======================================================================== ++.\" ++.IX Title "CMS_add1_signer 3" ++.TH CMS_add1_signer 3 "2014-10-15" "1.0.1j" "OpenSSL" ++.\" For nroff, turn off justification. Always turn off hyphenation; it makes ++.\" way too many mistakes in technical documents. ++.if n .ad l ++.nh ++.SH "NAME" ++.Vb 1 ++\& CMS_add1_signer, CMS_SignerInfo_sign \- add a signer to a CMS_ContentInfo signed data structure. ++.Ve ++.SH "SYNOPSIS" ++.IX Header "SYNOPSIS" ++.Vb 1 ++\& #include ++\& ++\& CMS_SignerInfo *CMS_add1_signer(CMS_ContentInfo *cms, X509 *signcert, EVP_PKEY *pkey, const EVP_MD *md, unsigned int flags); ++\& ++\& int CMS_SignerInfo_sign(CMS_SignerInfo *si); ++.Ve ++.SH "DESCRIPTION" ++.IX Header "DESCRIPTION" ++\&\fICMS_add1_signer()\fR adds a signer with certificate \fBsigncert\fR and private ++key \fBpkey\fR using message digest \fBmd\fR to CMS_ContentInfo SignedData ++structure \fBcms\fR. ++.PP ++The CMS_ContentInfo structure should be obtained from an initial call to ++\&\fICMS_sign()\fR with the flag \fB\s-1CMS_PARTIAL\s0\fR set or in the case or re-signing a ++valid CMS_ContentInfo SignedData structure. ++.PP ++If the \fBmd\fR parameter is \fB\s-1NULL\s0\fR then the default digest for the public ++key algorithm will be used. ++.PP ++Unless the \fB\s-1CMS_REUSE_DIGEST\s0\fR flag is set the returned CMS_ContentInfo ++structure is not complete and must be finalized either by streaming (if ++applicable) or a call to \fICMS_final()\fR. ++.PP ++The \fICMS_SignerInfo_sign()\fR function will explicitly sign a CMS_SignerInfo ++structure, its main use is when \fB\s-1CMS_REUSE_DIGEST\s0\fR and \fB\s-1CMS_PARTIAL\s0\fR flags ++are both set. ++.SH "NOTES" ++.IX Header "NOTES" ++The main purpose of \fICMS_add1_signer()\fR is to provide finer control ++over a \s-1CMS\s0 signed data structure where the simpler \fICMS_sign()\fR function defaults ++are not appropriate. For example if multiple signers or non default digest ++algorithms are needed. New attributes can also be added using the returned ++CMS_SignerInfo structure and the \s-1CMS\s0 attribute utility functions or the ++\&\s-1CMS\s0 signed receipt request functions. ++.PP ++Any of the following flags (ored together) can be passed in the \fBflags\fR ++parameter. ++.PP ++If \fB\s-1CMS_REUSE_DIGEST\s0\fR is set then an attempt is made to copy the content ++digest value from the CMS_ContentInfo structure: to add a signer to an existing ++structure. An error occurs if a matching digest value cannot be found to copy. ++The returned CMS_ContentInfo structure will be valid and finalized when this ++flag is set. ++.PP ++If \fB\s-1CMS_PARTIAL\s0\fR is set in addition to \fB\s-1CMS_REUSE_DIGEST\s0\fR then the ++CMS_SignerInfo structure will not be finalized so additional attributes ++can be added. In this case an explicit call to \fICMS_SignerInfo_sign()\fR is ++needed to finalize it. ++.PP ++If \fB\s-1CMS_NOCERTS\s0\fR is set the signer's certificate will not be included in the ++CMS_ContentInfo structure, the signer's certificate must still be supplied in ++the \fBsigncert\fR parameter though. This can reduce the size of the signature if ++the signers certificate can be obtained by other means: for example a ++previously signed message. ++.PP ++The SignedData structure includes several \s-1CMS\s0 signedAttributes including the ++signing time, the \s-1CMS\s0 content type and the supported list of ciphers in an ++SMIMECapabilities attribute. If \fB\s-1CMS_NOATTR\s0\fR is set then no signedAttributes ++will be used. If \fB\s-1CMS_NOSMIMECAP\s0\fR is set then just the SMIMECapabilities are ++omitted. ++.PP ++OpenSSL will by default identify signing certificates using issuer name ++and serial number. If \fB\s-1CMS_USE_KEYID\s0\fR is set it will use the subject key ++identifier value instead. An error occurs if the signing certificate does not ++have a subject key identifier extension. ++.PP ++If present the SMIMECapabilities attribute indicates support for the following ++algorithms in preference order: 256 bit \s-1AES\s0, Gost R3411\-94, Gost 28147\-89, 192 ++bit \s-1AES\s0, 128 bit \s-1AES\s0, triple \s-1DES\s0, 128 bit \s-1RC2\s0, 64 bit \s-1RC2\s0, \s-1DES\s0 and 40 bit \s-1RC2\s0. ++If any of these algorithms is not available then it will not be included: for example the \s-1GOST\s0 algorithms will not be included if the \s-1GOST\s0 \s-1ENGINE\s0 is ++not loaded. ++.PP ++\&\fICMS_add1_signer()\fR returns an internal pointer to the CMS_SignerInfo ++structure just added, this can be used to set additional attributes ++before it is finalized. ++.SH "RETURN VALUES" ++.IX Header "RETURN VALUES" ++\&\fICMS_add1_signer()\fR returns an internal pointer to the CMS_SignerInfo ++structure just added or \s-1NULL\s0 if an error occurs. ++.SH "SEE ALSO" ++.IX Header "SEE ALSO" ++\&\fIERR_get_error\fR\|(3), \fICMS_sign\fR\|(3), ++\&\fICMS_final\fR\|(3), ++.SH "HISTORY" ++.IX Header "HISTORY" ++\&\fICMS_add1_signer()\fR was added to OpenSSL 0.9.8 + +Property changes on: secure/lib/libcrypto/man/CMS_add1_signer.3 +___________________________________________________________________ +Added: svn:eol-style +## -0,0 +1 ## ++native +\ No newline at end of property +Added: svn:mime-type +## -0,0 +1 ## ++text/plain +\ No newline at end of property +Added: svn:keywords +## -0,0 +1 ## ++FreeBSD=%H +\ No newline at end of property +Index: secure/lib/libcrypto/man/CMS_compress.3 +=================================================================== +--- secure/lib/libcrypto/man/CMS_compress.3 (revision 273303) ++++ secure/lib/libcrypto/man/CMS_compress.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "CMS_compress 3" +-.TH CMS_compress 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH CMS_compress 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/CMS_decrypt.3 +=================================================================== +--- secure/lib/libcrypto/man/CMS_decrypt.3 (revision 273303) ++++ secure/lib/libcrypto/man/CMS_decrypt.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "CMS_decrypt 3" +-.TH CMS_decrypt 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH CMS_decrypt 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/CMS_encrypt.3 +=================================================================== +--- secure/lib/libcrypto/man/CMS_encrypt.3 (revision 273303) ++++ secure/lib/libcrypto/man/CMS_encrypt.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "CMS_encrypt 3" +-.TH CMS_encrypt 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH CMS_encrypt 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/CMS_final.3 +=================================================================== +--- secure/lib/libcrypto/man/CMS_final.3 (revision 273303) ++++ secure/lib/libcrypto/man/CMS_final.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "CMS_final 3" +-.TH CMS_final 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH CMS_final 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/CMS_get0_RecipientInfos.3 +=================================================================== +--- secure/lib/libcrypto/man/CMS_get0_RecipientInfos.3 (revision 273303) ++++ secure/lib/libcrypto/man/CMS_get0_RecipientInfos.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "CMS_get0_RecipientInfos 3" +-.TH CMS_get0_RecipientInfos 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH CMS_get0_RecipientInfos 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/CMS_get0_SignerInfos.3 +=================================================================== +--- secure/lib/libcrypto/man/CMS_get0_SignerInfos.3 (revision 273303) ++++ secure/lib/libcrypto/man/CMS_get0_SignerInfos.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "CMS_get0_SignerInfos 3" +-.TH CMS_get0_SignerInfos 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH CMS_get0_SignerInfos 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/CMS_get0_type.3 +=================================================================== +--- secure/lib/libcrypto/man/CMS_get0_type.3 (revision 273303) ++++ secure/lib/libcrypto/man/CMS_get0_type.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "CMS_get0_type 3" +-.TH CMS_get0_type 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH CMS_get0_type 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/CMS_get1_ReceiptRequest.3 +=================================================================== +--- secure/lib/libcrypto/man/CMS_get1_ReceiptRequest.3 (revision 273303) ++++ secure/lib/libcrypto/man/CMS_get1_ReceiptRequest.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "CMS_get1_ReceiptRequest 3" +-.TH CMS_get1_ReceiptRequest 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH CMS_get1_ReceiptRequest 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/CMS_sign.3 +=================================================================== +--- secure/lib/libcrypto/man/CMS_sign.3 (revision 273303) ++++ secure/lib/libcrypto/man/CMS_sign.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "CMS_sign 3" +-.TH CMS_sign 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH CMS_sign 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/CMS_sign_add1_signer.3 +=================================================================== +--- secure/lib/libcrypto/man/CMS_sign_add1_signer.3 (revision 273303) ++++ secure/lib/libcrypto/man/CMS_sign_add1_signer.3 (working copy) +@@ -1,224 +0,0 @@ +-.\" Automatically generated by Pod::Man 2.25 (Pod::Simple 3.28) +-.\" +-.\" Standard preamble: +-.\" ======================================================================== +-.de Sp \" Vertical space (when we can't use .PP) +-.if t .sp .5v +-.if n .sp +-.. +-.de Vb \" Begin verbatim text +-.ft CW +-.nf +-.ne \\$1 +-.. +-.de Ve \" End verbatim text +-.ft R +-.fi +-.. +-.\" Set up some character translations and predefined strings. \*(-- will +-.\" give an unbreakable dash, \*(PI will give pi, \*(L" will give a left +-.\" double quote, and \*(R" will give a right double quote. \*(C+ will +-.\" give a nicer C++. Capital omega is used to do unbreakable dashes and +-.\" therefore won't be available. \*(C` and \*(C' expand to `' in nroff, +-.\" nothing in troff, for use with C<>. +-.tr \(*W- +-.ds C+ C\v'-.1v'\h'-1p'\s-2+\h'-1p'+\s0\v'.1v'\h'-1p' +-.ie n \{\ +-. ds -- \(*W- +-. ds PI pi +-. if (\n(.H=4u)&(1m=24u) .ds -- \(*W\h'-12u'\(*W\h'-12u'-\" diablo 10 pitch +-. if (\n(.H=4u)&(1m=20u) .ds -- \(*W\h'-12u'\(*W\h'-8u'-\" diablo 12 pitch +-. ds L" "" +-. ds R" "" +-. ds C` "" +-. ds C' "" +-'br\} +-.el\{\ +-. ds -- \|\(em\| +-. ds PI \(*p +-. ds L" `` +-. ds R" '' +-'br\} +-.\" +-.\" Escape single quotes in literal strings from groff's Unicode transform. +-.ie \n(.g .ds Aq \(aq +-.el .ds Aq ' +-.\" +-.\" If the F register is turned on, we'll generate index entries on stderr for +-.\" titles (.TH), headers (.SH), subsections (.SS), items (.Ip), and index +-.\" entries marked with X<> in POD. Of course, you'll have to process the +-.\" output yourself in some meaningful fashion. +-.ie \nF \{\ +-. de IX +-. tm Index:\\$1\t\\n%\t"\\$2" +-.. +-. nr % 0 +-. rr F +-.\} +-.el \{\ +-. de IX +-.. +-.\} +-.\" +-.\" Accent mark definitions (@(#)ms.acc 1.5 88/02/08 SMI; from UCB 4.2). +-.\" Fear. Run. Save yourself. No user-serviceable parts. +-. \" fudge factors for nroff and troff +-.if n \{\ +-. ds #H 0 +-. ds #V .8m +-. ds #F .3m +-. ds #[ \f1 +-. ds #] \fP +-.\} +-.if t \{\ +-. ds #H ((1u-(\\\\n(.fu%2u))*.13m) +-. ds #V .6m +-. ds #F 0 +-. ds #[ \& +-. ds #] \& +-.\} +-. \" simple accents for nroff and troff +-.if n \{\ +-. ds ' \& +-. ds ` \& +-. ds ^ \& +-. ds , \& +-. ds ~ ~ +-. ds / +-.\} +-.if t \{\ +-. ds ' \\k:\h'-(\\n(.wu*8/10-\*(#H)'\'\h"|\\n:u" +-. ds ` \\k:\h'-(\\n(.wu*8/10-\*(#H)'\`\h'|\\n:u' +-. ds ^ \\k:\h'-(\\n(.wu*10/11-\*(#H)'^\h'|\\n:u' +-. ds , \\k:\h'-(\\n(.wu*8/10)',\h'|\\n:u' +-. ds ~ \\k:\h'-(\\n(.wu-\*(#H-.1m)'~\h'|\\n:u' +-. ds / \\k:\h'-(\\n(.wu*8/10-\*(#H)'\z\(sl\h'|\\n:u' +-.\} +-. \" troff and (daisy-wheel) nroff accents +-.ds : \\k:\h'-(\\n(.wu*8/10-\*(#H+.1m+\*(#F)'\v'-\*(#V'\z.\h'.2m+\*(#F'.\h'|\\n:u'\v'\*(#V' +-.ds 8 \h'\*(#H'\(*b\h'-\*(#H' +-.ds o \\k:\h'-(\\n(.wu+\w'\(de'u-\*(#H)/2u'\v'-.3n'\*(#[\z\(de\v'.3n'\h'|\\n:u'\*(#] +-.ds d- \h'\*(#H'\(pd\h'-\w'~'u'\v'-.25m'\f2\(hy\fP\v'.25m'\h'-\*(#H' +-.ds D- D\\k:\h'-\w'D'u'\v'-.11m'\z\(hy\v'.11m'\h'|\\n:u' +-.ds th \*(#[\v'.3m'\s+1I\s-1\v'-.3m'\h'-(\w'I'u*2/3)'\s-1o\s+1\*(#] +-.ds Th \*(#[\s+2I\s-2\h'-\w'I'u*3/5'\v'-.3m'o\v'.3m'\*(#] +-.ds ae a\h'-(\w'a'u*4/10)'e +-.ds Ae A\h'-(\w'A'u*4/10)'E +-. \" corrections for vroff +-.if v .ds ~ \\k:\h'-(\\n(.wu*9/10-\*(#H)'\s-2\u~\d\s+2\h'|\\n:u' +-.if v .ds ^ \\k:\h'-(\\n(.wu*10/11-\*(#H)'\v'-.4m'^\v'.4m'\h'|\\n:u' +-. \" for low resolution devices (crt and lpr) +-.if \n(.H>23 .if \n(.V>19 \ +-\{\ +-. ds : e +-. ds 8 ss +-. ds o a +-. ds d- d\h'-1'\(ga +-. ds D- D\h'-1'\(hy +-. ds th \o'bp' +-. ds Th \o'LP' +-. ds ae ae +-. ds Ae AE +-.\} +-.rm #[ #] #H #V #F C +-.\" ======================================================================== +-.\" +-.IX Title "CMS_sign_add1_signer 3" +-.TH CMS_sign_add1_signer 3 "2014-08-06" "1.0.1i" "OpenSSL" +-.\" For nroff, turn off justification. Always turn off hyphenation; it makes +-.\" way too many mistakes in technical documents. +-.if n .ad l +-.nh +-.SH "NAME" +-.Vb 1 +-\& CMS_sign_add1_signer, CMS_SignerInfo_sign \- add a signer to a CMS_ContentInfo signed data structure. +-.Ve +-.SH "SYNOPSIS" +-.IX Header "SYNOPSIS" +-.Vb 1 +-\& #include +-\& +-\& CMS_SignerInfo *CMS_sign_add1_signer(CMS_ContentInfo *cms, X509 *signcert, EVP_PKEY *pkey, const EVP_MD *md, unsigned int flags); +-\& +-\& int CMS_SignerInfo_sign(CMS_SignerInfo *si); +-.Ve +-.SH "DESCRIPTION" +-.IX Header "DESCRIPTION" +-\&\fICMS_sign_add1_signer()\fR adds a signer with certificate \fBsigncert\fR and private +-key \fBpkey\fR using message digest \fBmd\fR to CMS_ContentInfo SignedData +-structure \fBcms\fR. +-.PP +-The CMS_ContentInfo structure should be obtained from an initial call to +-\&\fICMS_sign()\fR with the flag \fB\s-1CMS_PARTIAL\s0\fR set or in the case or re-signing a +-valid CMS_ContentInfo SignedData structure. +-.PP +-If the \fBmd\fR parameter is \fB\s-1NULL\s0\fR then the default digest for the public +-key algorithm will be used. +-.PP +-Unless the \fB\s-1CMS_REUSE_DIGEST\s0\fR flag is set the returned CMS_ContentInfo +-structure is not complete and must be finalized either by streaming (if +-applicable) or a call to \fICMS_final()\fR. +-.PP +-The \fICMS_SignerInfo_sign()\fR function will explicitly sign a CMS_SignerInfo +-structure, its main use is when \fB\s-1CMS_REUSE_DIGEST\s0\fR and \fB\s-1CMS_PARTIAL\s0\fR flags +-are both set. +-.SH "NOTES" +-.IX Header "NOTES" +-The main purpose of \fICMS_sign_add1_signer()\fR is to provide finer control +-over a \s-1CMS\s0 signed data structure where the simpler \fICMS_sign()\fR function defaults +-are not appropriate. For example if multiple signers or non default digest +-algorithms are needed. New attributes can also be added using the returned +-CMS_SignerInfo structure and the \s-1CMS\s0 attribute utility functions or the +-\&\s-1CMS\s0 signed receipt request functions. +-.PP +-Any of the following flags (ored together) can be passed in the \fBflags\fR +-parameter. +-.PP +-If \fB\s-1CMS_REUSE_DIGEST\s0\fR is set then an attempt is made to copy the content +-digest value from the CMS_ContentInfo structure: to add a signer to an existing +-structure. An error occurs if a matching digest value cannot be found to copy. +-The returned CMS_ContentInfo structure will be valid and finalized when this +-flag is set. +-.PP +-If \fB\s-1CMS_PARTIAL\s0\fR is set in addition to \fB\s-1CMS_REUSE_DIGEST\s0\fR then the +-CMS_SignerInfo structure will not be finalized so additional attributes +-can be added. In this case an explicit call to \fICMS_SignerInfo_sign()\fR is +-needed to finalize it. +-.PP +-If \fB\s-1CMS_NOCERTS\s0\fR is set the signer's certificate will not be included in the +-CMS_ContentInfo structure, the signer's certificate must still be supplied in +-the \fBsigncert\fR parameter though. This can reduce the size of the signature if +-the signers certificate can be obtained by other means: for example a +-previously signed message. +-.PP +-The SignedData structure includes several \s-1CMS\s0 signedAttributes including the +-signing time, the \s-1CMS\s0 content type and the supported list of ciphers in an +-SMIMECapabilities attribute. If \fB\s-1CMS_NOATTR\s0\fR is set then no signedAttributes +-will be used. If \fB\s-1CMS_NOSMIMECAP\s0\fR is set then just the SMIMECapabilities are +-omitted. +-.PP +-OpenSSL will by default identify signing certificates using issuer name +-and serial number. If \fB\s-1CMS_USE_KEYID\s0\fR is set it will use the subject key +-identifier value instead. An error occurs if the signing certificate does not +-have a subject key identifier extension. +-.PP +-If present the SMIMECapabilities attribute indicates support for the following +-algorithms in preference order: 256 bit \s-1AES\s0, Gost R3411\-94, Gost 28147\-89, 192 +-bit \s-1AES\s0, 128 bit \s-1AES\s0, triple \s-1DES\s0, 128 bit \s-1RC2\s0, 64 bit \s-1RC2\s0, \s-1DES\s0 and 40 bit \s-1RC2\s0. +-If any of these algorithms is not available then it will not be included: for example the \s-1GOST\s0 algorithms will not be included if the \s-1GOST\s0 \s-1ENGINE\s0 is +-not loaded. +-.PP +-\&\fICMS_sign_add1_signer()\fR returns an internal pointer to the CMS_SignerInfo +-structure just added, this can be used to set additional attributes +-before it is finalized. +-.SH "RETURN VALUES" +-.IX Header "RETURN VALUES" +-\&\fICMS_sign1_add_signers()\fR returns an internal pointer to the CMS_SignerInfo +-structure just added or \s-1NULL\s0 if an error occurs. +-.SH "SEE ALSO" +-.IX Header "SEE ALSO" +-\&\fIERR_get_error\fR\|(3), \fICMS_sign\fR\|(3), +-\&\fICMS_final\fR\|(3), +-.SH "HISTORY" +-.IX Header "HISTORY" +-\&\fICMS_sign_add1_signer()\fR was added to OpenSSL 0.9.8 +Index: secure/lib/libcrypto/man/CMS_sign_receipt.3 +=================================================================== +--- secure/lib/libcrypto/man/CMS_sign_receipt.3 (revision 273303) ++++ secure/lib/libcrypto/man/CMS_sign_receipt.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "CMS_sign_receipt 3" +-.TH CMS_sign_receipt 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH CMS_sign_receipt 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/CMS_uncompress.3 +=================================================================== +--- secure/lib/libcrypto/man/CMS_uncompress.3 (revision 273303) ++++ secure/lib/libcrypto/man/CMS_uncompress.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "CMS_uncompress 3" +-.TH CMS_uncompress 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH CMS_uncompress 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/CMS_verify.3 +=================================================================== +--- secure/lib/libcrypto/man/CMS_verify.3 (revision 273303) ++++ secure/lib/libcrypto/man/CMS_verify.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "CMS_verify 3" +-.TH CMS_verify 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH CMS_verify 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/CMS_verify_receipt.3 +=================================================================== +--- secure/lib/libcrypto/man/CMS_verify_receipt.3 (revision 273303) ++++ secure/lib/libcrypto/man/CMS_verify_receipt.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "CMS_verify_receipt 3" +-.TH CMS_verify_receipt 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH CMS_verify_receipt 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/CONF_modules_free.3 +=================================================================== +--- secure/lib/libcrypto/man/CONF_modules_free.3 (revision 273303) ++++ secure/lib/libcrypto/man/CONF_modules_free.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "CONF_modules_free 3" +-.TH CONF_modules_free 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH CONF_modules_free 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/CONF_modules_load_file.3 +=================================================================== +--- secure/lib/libcrypto/man/CONF_modules_load_file.3 (revision 273303) ++++ secure/lib/libcrypto/man/CONF_modules_load_file.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "CONF_modules_load_file 3" +-.TH CONF_modules_load_file 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH CONF_modules_load_file 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/CRYPTO_set_ex_data.3 +=================================================================== +--- secure/lib/libcrypto/man/CRYPTO_set_ex_data.3 (revision 273303) ++++ secure/lib/libcrypto/man/CRYPTO_set_ex_data.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "CRYPTO_set_ex_data 3" +-.TH CRYPTO_set_ex_data 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH CRYPTO_set_ex_data 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/DH_generate_key.3 +=================================================================== +--- secure/lib/libcrypto/man/DH_generate_key.3 (revision 273303) ++++ secure/lib/libcrypto/man/DH_generate_key.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "DH_generate_key 3" +-.TH DH_generate_key 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH DH_generate_key 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/DH_generate_parameters.3 +=================================================================== +--- secure/lib/libcrypto/man/DH_generate_parameters.3 (revision 273303) ++++ secure/lib/libcrypto/man/DH_generate_parameters.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "DH_generate_parameters 3" +-.TH DH_generate_parameters 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH DH_generate_parameters 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/DH_get_ex_new_index.3 +=================================================================== +--- secure/lib/libcrypto/man/DH_get_ex_new_index.3 (revision 273303) ++++ secure/lib/libcrypto/man/DH_get_ex_new_index.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "DH_get_ex_new_index 3" +-.TH DH_get_ex_new_index 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH DH_get_ex_new_index 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/DH_new.3 +=================================================================== +--- secure/lib/libcrypto/man/DH_new.3 (revision 273303) ++++ secure/lib/libcrypto/man/DH_new.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "DH_new 3" +-.TH DH_new 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH DH_new 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/DH_set_method.3 +=================================================================== +--- secure/lib/libcrypto/man/DH_set_method.3 (revision 273303) ++++ secure/lib/libcrypto/man/DH_set_method.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "DH_set_method 3" +-.TH DH_set_method 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH DH_set_method 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/DH_size.3 +=================================================================== +--- secure/lib/libcrypto/man/DH_size.3 (revision 273303) ++++ secure/lib/libcrypto/man/DH_size.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "DH_size 3" +-.TH DH_size 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH DH_size 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/DSA_SIG_new.3 +=================================================================== +--- secure/lib/libcrypto/man/DSA_SIG_new.3 (revision 273303) ++++ secure/lib/libcrypto/man/DSA_SIG_new.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "DSA_SIG_new 3" +-.TH DSA_SIG_new 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH DSA_SIG_new 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/DSA_do_sign.3 +=================================================================== +--- secure/lib/libcrypto/man/DSA_do_sign.3 (revision 273303) ++++ secure/lib/libcrypto/man/DSA_do_sign.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "DSA_do_sign 3" +-.TH DSA_do_sign 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH DSA_do_sign 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/DSA_dup_DH.3 +=================================================================== +--- secure/lib/libcrypto/man/DSA_dup_DH.3 (revision 273303) ++++ secure/lib/libcrypto/man/DSA_dup_DH.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "DSA_dup_DH 3" +-.TH DSA_dup_DH 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH DSA_dup_DH 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/DSA_generate_key.3 +=================================================================== +--- secure/lib/libcrypto/man/DSA_generate_key.3 (revision 273303) ++++ secure/lib/libcrypto/man/DSA_generate_key.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "DSA_generate_key 3" +-.TH DSA_generate_key 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH DSA_generate_key 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/DSA_generate_parameters.3 +=================================================================== +--- secure/lib/libcrypto/man/DSA_generate_parameters.3 (revision 273303) ++++ secure/lib/libcrypto/man/DSA_generate_parameters.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "DSA_generate_parameters 3" +-.TH DSA_generate_parameters 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH DSA_generate_parameters 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/DSA_get_ex_new_index.3 +=================================================================== +--- secure/lib/libcrypto/man/DSA_get_ex_new_index.3 (revision 273303) ++++ secure/lib/libcrypto/man/DSA_get_ex_new_index.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "DSA_get_ex_new_index 3" +-.TH DSA_get_ex_new_index 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH DSA_get_ex_new_index 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/DSA_new.3 +=================================================================== +--- secure/lib/libcrypto/man/DSA_new.3 (revision 273303) ++++ secure/lib/libcrypto/man/DSA_new.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "DSA_new 3" +-.TH DSA_new 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH DSA_new 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/DSA_set_method.3 +=================================================================== +--- secure/lib/libcrypto/man/DSA_set_method.3 (revision 273303) ++++ secure/lib/libcrypto/man/DSA_set_method.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "DSA_set_method 3" +-.TH DSA_set_method 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH DSA_set_method 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/DSA_sign.3 +=================================================================== +--- secure/lib/libcrypto/man/DSA_sign.3 (revision 273303) ++++ secure/lib/libcrypto/man/DSA_sign.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "DSA_sign 3" +-.TH DSA_sign 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH DSA_sign 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/DSA_size.3 +=================================================================== +--- secure/lib/libcrypto/man/DSA_size.3 (revision 273303) ++++ secure/lib/libcrypto/man/DSA_size.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "DSA_size 3" +-.TH DSA_size 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH DSA_size 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/ERR_GET_LIB.3 +=================================================================== +--- secure/lib/libcrypto/man/ERR_GET_LIB.3 (revision 273303) ++++ secure/lib/libcrypto/man/ERR_GET_LIB.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "ERR_GET_LIB 3" +-.TH ERR_GET_LIB 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH ERR_GET_LIB 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/ERR_clear_error.3 +=================================================================== +--- secure/lib/libcrypto/man/ERR_clear_error.3 (revision 273303) ++++ secure/lib/libcrypto/man/ERR_clear_error.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "ERR_clear_error 3" +-.TH ERR_clear_error 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH ERR_clear_error 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/ERR_error_string.3 +=================================================================== +--- secure/lib/libcrypto/man/ERR_error_string.3 (revision 273303) ++++ secure/lib/libcrypto/man/ERR_error_string.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "ERR_error_string 3" +-.TH ERR_error_string 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH ERR_error_string 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/ERR_get_error.3 +=================================================================== +--- secure/lib/libcrypto/man/ERR_get_error.3 (revision 273303) ++++ secure/lib/libcrypto/man/ERR_get_error.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "ERR_get_error 3" +-.TH ERR_get_error 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH ERR_get_error 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/ERR_load_crypto_strings.3 +=================================================================== +--- secure/lib/libcrypto/man/ERR_load_crypto_strings.3 (revision 273303) ++++ secure/lib/libcrypto/man/ERR_load_crypto_strings.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "ERR_load_crypto_strings 3" +-.TH ERR_load_crypto_strings 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH ERR_load_crypto_strings 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/ERR_load_strings.3 +=================================================================== +--- secure/lib/libcrypto/man/ERR_load_strings.3 (revision 273303) ++++ secure/lib/libcrypto/man/ERR_load_strings.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "ERR_load_strings 3" +-.TH ERR_load_strings 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH ERR_load_strings 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/ERR_print_errors.3 +=================================================================== +--- secure/lib/libcrypto/man/ERR_print_errors.3 (revision 273303) ++++ secure/lib/libcrypto/man/ERR_print_errors.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "ERR_print_errors 3" +-.TH ERR_print_errors 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH ERR_print_errors 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/ERR_put_error.3 +=================================================================== +--- secure/lib/libcrypto/man/ERR_put_error.3 (revision 273303) ++++ secure/lib/libcrypto/man/ERR_put_error.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "ERR_put_error 3" +-.TH ERR_put_error 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH ERR_put_error 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/ERR_remove_state.3 +=================================================================== +--- secure/lib/libcrypto/man/ERR_remove_state.3 (revision 273303) ++++ secure/lib/libcrypto/man/ERR_remove_state.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "ERR_remove_state 3" +-.TH ERR_remove_state 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH ERR_remove_state 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/ERR_set_mark.3 +=================================================================== +--- secure/lib/libcrypto/man/ERR_set_mark.3 (revision 273303) ++++ secure/lib/libcrypto/man/ERR_set_mark.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "ERR_set_mark 3" +-.TH ERR_set_mark 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH ERR_set_mark 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/EVP_BytesToKey.3 +=================================================================== +--- secure/lib/libcrypto/man/EVP_BytesToKey.3 (revision 273303) ++++ secure/lib/libcrypto/man/EVP_BytesToKey.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "EVP_BytesToKey 3" +-.TH EVP_BytesToKey 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH EVP_BytesToKey 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/EVP_DigestInit.3 +=================================================================== +--- secure/lib/libcrypto/man/EVP_DigestInit.3 (revision 273303) ++++ secure/lib/libcrypto/man/EVP_DigestInit.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "EVP_DigestInit 3" +-.TH EVP_DigestInit 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH EVP_DigestInit 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +@@ -154,13 +154,13 @@ EVP digest routines + \& int EVP_MD_CTX_cleanup(EVP_MD_CTX *ctx); + \& void EVP_MD_CTX_destroy(EVP_MD_CTX *ctx); + \& +-\& int EVP_MD_CTX_copy_ex(EVP_MD_CTX *out,const EVP_MD_CTX *in); ++\& int EVP_MD_CTX_copy_ex(EVP_MD_CTX *out,const EVP_MD_CTX *in); + \& + \& int EVP_DigestInit(EVP_MD_CTX *ctx, const EVP_MD *type); + \& int EVP_DigestFinal(EVP_MD_CTX *ctx, unsigned char *md, + \& unsigned int *s); + \& +-\& int EVP_MD_CTX_copy(EVP_MD_CTX *out,EVP_MD_CTX *in); ++\& int EVP_MD_CTX_copy(EVP_MD_CTX *out,EVP_MD_CTX *in); + \& + \& #define EVP_MAX_MD_SIZE 64 /* SHA512 */ + \& +@@ -267,7 +267,7 @@ structures for the \s-1MD2\s0, \s-1MD5\s0, \s-1SHA + and \s-1RIPEMD160\s0 digest algorithms respectively. + .PP + \&\fIEVP_dss()\fR and \fIEVP_dss1()\fR return \fB\s-1EVP_MD\s0\fR structures for \s-1SHA\s0 and \s-1SHA1\s0 digest +-algorithms but using \s-1DSS\s0 (\s-1DSA\s0) for the signature algorithm. Note: there is ++algorithms but using \s-1DSS\s0 (\s-1DSA\s0) for the signature algorithm. Note: there is + no need to use these pseudo-digests in OpenSSL 1.0.0 and later, they are + however retained for compatibility. + .PP +@@ -303,15 +303,15 @@ The \fB\s-1EVP\s0\fR interface to message digests + preference to the low level interfaces. This is because the code then becomes + transparent to the digest used and much more flexible. + .PP +-New applications should use the \s-1SHA2\s0 digest algorithms such as \s-1SHA256\s0. ++New applications should use the \s-1SHA2\s0 digest algorithms such as \s-1SHA256\s0. + The other digest algorithms are still in common use. + .PP + For most applications the \fBimpl\fR parameter to \fIEVP_DigestInit_ex()\fR will be + set to \s-1NULL\s0 to use the default digest implementation. + .PP +-The functions \fIEVP_DigestInit()\fR, \fIEVP_DigestFinal()\fR and \fIEVP_MD_CTX_copy()\fR are ++The functions \fIEVP_DigestInit()\fR, \fIEVP_DigestFinal()\fR and \fIEVP_MD_CTX_copy()\fR are + obsolete but are retained to maintain compatibility with existing code. New +-applications should use \fIEVP_DigestInit_ex()\fR, \fIEVP_DigestFinal_ex()\fR and ++applications should use \fIEVP_DigestInit_ex()\fR, \fIEVP_DigestFinal_ex()\fR and + \&\fIEVP_MD_CTX_copy_ex()\fR because they can efficiently reuse a digest context + instead of initializing and cleaning it up on each call and allow non default + implementations of digests to be specified. +@@ -374,15 +374,19 @@ digest name passed on the command line. + \& EVP_MD_CTX_destroy(mdctx); + \& + \& printf("Digest is: "); +-\& for(i = 0; i < md_len; i++) printf("%02x", md_value[i]); ++\& for(i = 0; i < md_len; i++) ++\& printf("%02x", md_value[i]); + \& printf("\en"); ++\& ++\& /* Call this once before exit. */ ++\& EVP_cleanup(); ++\& exit(0); + \& } + .Ve + .SH "SEE ALSO" + .IX Header "SEE ALSO" +-\&\fIevp\fR\|(3), \fIhmac\fR\|(3), \fImd2\fR\|(3), +-\&\fImd5\fR\|(3), \fImdc2\fR\|(3), \fIripemd\fR\|(3), +-\&\fIsha\fR\|(3), \fIdgst\fR\|(1) ++\&\fIdgst\fR\|(1), ++\&\fIevp\fR\|(3) + .SH "HISTORY" + .IX Header "HISTORY" + \&\fIEVP_DigestInit()\fR, \fIEVP_DigestUpdate()\fR and \fIEVP_DigestFinal()\fR are +@@ -397,7 +401,7 @@ and \fIEVP_DigestFinal_ex()\fR were added in OpenS + changed to return truely const \s-1EVP_MD\s0 * in OpenSSL 0.9.7. + .PP + The link between digests and signing algorithms was fixed in OpenSSL 1.0 and +-later, so now \fIEVP_sha1()\fR can be used with \s-1RSA\s0 and \s-1DSA\s0, there is no need to ++later, so now \fIEVP_sha1()\fR can be used with \s-1RSA\s0 and \s-1DSA\s0; there is no need to + use \fIEVP_dss1()\fR any more. + .PP + OpenSSL 1.0 and later does not include the \s-1MD2\s0 digest algorithm in the +Index: secure/lib/libcrypto/man/EVP_DigestSignInit.3 +=================================================================== +--- secure/lib/libcrypto/man/EVP_DigestSignInit.3 (revision 273303) ++++ secure/lib/libcrypto/man/EVP_DigestSignInit.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "EVP_DigestSignInit 3" +-.TH EVP_DigestSignInit 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH EVP_DigestSignInit 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/EVP_DigestVerifyInit.3 +=================================================================== +--- secure/lib/libcrypto/man/EVP_DigestVerifyInit.3 (revision 273303) ++++ secure/lib/libcrypto/man/EVP_DigestVerifyInit.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "EVP_DigestVerifyInit 3" +-.TH EVP_DigestVerifyInit 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH EVP_DigestVerifyInit 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +@@ -165,7 +165,7 @@ or a negative value for failure. In particular a r + the operation is not supported by the public key algorithm. + .PP + Unlike other functions the return value 0 from \fIEVP_DigestVerifyFinal()\fR only +-indicates that the signature did not not verify successfully (that is tbs did ++indicates that the signature did not verify successfully (that is tbs did + not match the original data or the signature was of invalid form) it is not an + indication of a more serious error. + .PP +@@ -185,7 +185,7 @@ For some key types and parameters the random numbe + or the operation will fail. + .PP + The call to \fIEVP_DigestVerifyFinal()\fR internally finalizes a copy of the digest +-context. This means that calls to \fIEVP_VerifyUpdate()\fR and \fIEVP_VerifyFinal()\fR can ++context. This means that \fIEVP_VerifyUpdate()\fR and \fIEVP_VerifyFinal()\fR can + be called later to digest and verify additional data. + .PP + Since only a copy of the digest context is ever finalized the context must +Index: secure/lib/libcrypto/man/EVP_EncryptInit.3 +=================================================================== +--- secure/lib/libcrypto/man/EVP_EncryptInit.3 (revision 273303) ++++ secure/lib/libcrypto/man/EVP_EncryptInit.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "EVP_EncryptInit 3" +-.TH EVP_EncryptInit 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH EVP_EncryptInit 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +@@ -493,37 +493,9 @@ The \s-1ASN1\s0 code is incomplete (and sometimes + for certain common S/MIME ciphers (\s-1RC2\s0, \s-1DES\s0, triple \s-1DES\s0) in \s-1CBC\s0 mode. + .SH "EXAMPLES" + .IX Header "EXAMPLES" +-Get the number of rounds used in \s-1RC5:\s0 ++Encrypt a string using \s-1IDEA:\s0 + .PP +-.Vb 2 +-\& int nrounds; +-\& EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_GET_RC5_ROUNDS, 0, &nrounds); +-.Ve +-.PP +-Get the \s-1RC2\s0 effective key length: +-.PP +-.Vb 2 +-\& int key_bits; +-\& EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_GET_RC2_KEY_BITS, 0, &key_bits); +-.Ve +-.PP +-Set the number of rounds used in \s-1RC5:\s0 +-.PP +-.Vb 2 +-\& int nrounds; +-\& EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_SET_RC5_ROUNDS, nrounds, NULL); +-.Ve +-.PP +-Set the effective key length used in \s-1RC2:\s0 +-.PP +-.Vb 2 +-\& int key_bits; +-\& EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_SET_RC2_KEY_BITS, key_bits, NULL); +-.Ve +-.PP +-Encrypt a string using blowfish: +-.PP +-.Vb 10 ++.Vb 12 + \& int do_crypt(char *outfile) + \& { + \& unsigned char outbuf[1024]; +@@ -536,8 +508,9 @@ for certain common S/MIME ciphers (\s-1RC2\s0, \s- + \& char intext[] = "Some Crypto Text"; + \& EVP_CIPHER_CTX ctx; + \& FILE *out; ++\& + \& EVP_CIPHER_CTX_init(&ctx); +-\& EVP_EncryptInit_ex(&ctx, EVP_bf_cbc(), NULL, key, iv); ++\& EVP_EncryptInit_ex(&ctx, EVP_idea_cbc(), NULL, key, iv); + \& + \& if(!EVP_EncryptUpdate(&ctx, outbuf, &outlen, intext, strlen(intext))) + \& { +@@ -567,31 +540,37 @@ for certain common S/MIME ciphers (\s-1RC2\s0, \s- + .Ve + .PP + The ciphertext from the above example can be decrypted using the \fBopenssl\fR +-utility with the command line: ++utility with the command line (shown on two lines for clarity): + .PP +-.Vb 1 +-\& S ++.Vb 2 ++\& openssl idea \-d + \& + \& EVP_PKEY_CTX *ctx; ++\& /* md is a SHA\-256 digest in this example. */ + \& unsigned char *md, *sig; +-\& size_t mdlen, siglen; ++\& size_t mdlen = 32, siglen; + \& EVP_PKEY *signing_key; +-\& /* NB: assumes signing_key, md and mdlen are already set up +-\& * and that signing_key is an RSA private key ++\& ++\& /* ++\& * NB: assumes signing_key and md are set up before the next ++\& * step. signing_key must be an RSA private key and md must ++\& * point to the SHA\-256 digest to be signed. + \& */ +-\& ctx = EVP_PKEY_CTX_new(signing_key); ++\& ctx = EVP_PKEY_CTX_new(signing_key, NULL /* no engine */); + \& if (!ctx) + \& /* Error occurred */ + \& if (EVP_PKEY_sign_init(ctx) <= 0) +@@ -208,6 +217,7 @@ Sign data using \s-1RSA\s0 with PKCS#1 padding and + .SH "SEE ALSO" + .IX Header "SEE ALSO" + \&\fIEVP_PKEY_CTX_new\fR\|(3), ++\&\fIEVP_PKEY_CTX_ctrl\fR\|(3), + \&\fIEVP_PKEY_encrypt\fR\|(3), + \&\fIEVP_PKEY_decrypt\fR\|(3), + \&\fIEVP_PKEY_verify\fR\|(3), +Index: secure/lib/libcrypto/man/EVP_PKEY_verify.3 +=================================================================== +--- secure/lib/libcrypto/man/EVP_PKEY_verify.3 (revision 273303) ++++ secure/lib/libcrypto/man/EVP_PKEY_verify.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "EVP_PKEY_verify 3" +-.TH EVP_PKEY_verify 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH EVP_PKEY_verify 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/EVP_PKEY_verify_recover.3 +=================================================================== +--- secure/lib/libcrypto/man/EVP_PKEY_verify_recover.3 (revision 273303) ++++ secure/lib/libcrypto/man/EVP_PKEY_verify_recover.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "EVP_PKEY_verify_recover 3" +-.TH EVP_PKEY_verify_recover 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH EVP_PKEY_verify_recover 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/EVP_SealInit.3 +=================================================================== +--- secure/lib/libcrypto/man/EVP_SealInit.3 (revision 273303) ++++ secure/lib/libcrypto/man/EVP_SealInit.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "EVP_SealInit 3" +-.TH EVP_SealInit 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH EVP_SealInit 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/EVP_SignInit.3 +=================================================================== +--- secure/lib/libcrypto/man/EVP_SignInit.3 (revision 273303) ++++ secure/lib/libcrypto/man/EVP_SignInit.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "EVP_SignInit 3" +-.TH EVP_SignInit 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH EVP_SignInit 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/EVP_VerifyInit.3 +=================================================================== +--- secure/lib/libcrypto/man/EVP_VerifyInit.3 (revision 273303) ++++ secure/lib/libcrypto/man/EVP_VerifyInit.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "EVP_VerifyInit 3" +-.TH EVP_VerifyInit 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH EVP_VerifyInit 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/OBJ_nid2obj.3 +=================================================================== +--- secure/lib/libcrypto/man/OBJ_nid2obj.3 (revision 273303) ++++ secure/lib/libcrypto/man/OBJ_nid2obj.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "OBJ_nid2obj 3" +-.TH OBJ_nid2obj 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH OBJ_nid2obj 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/OPENSSL_Applink.3 +=================================================================== +--- secure/lib/libcrypto/man/OPENSSL_Applink.3 (revision 273303) ++++ secure/lib/libcrypto/man/OPENSSL_Applink.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "OPENSSL_Applink 3" +-.TH OPENSSL_Applink 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH OPENSSL_Applink 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/OPENSSL_VERSION_NUMBER.3 +=================================================================== +--- secure/lib/libcrypto/man/OPENSSL_VERSION_NUMBER.3 (revision 273303) ++++ secure/lib/libcrypto/man/OPENSSL_VERSION_NUMBER.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "OPENSSL_VERSION_NUMBER 3" +-.TH OPENSSL_VERSION_NUMBER 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH OPENSSL_VERSION_NUMBER 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/OPENSSL_config.3 +=================================================================== +--- secure/lib/libcrypto/man/OPENSSL_config.3 (revision 273303) ++++ secure/lib/libcrypto/man/OPENSSL_config.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "OPENSSL_config 3" +-.TH OPENSSL_config 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH OPENSSL_config 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/OPENSSL_ia32cap.3 +=================================================================== +--- secure/lib/libcrypto/man/OPENSSL_ia32cap.3 (revision 273303) ++++ secure/lib/libcrypto/man/OPENSSL_ia32cap.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "OPENSSL_ia32cap 3" +-.TH OPENSSL_ia32cap 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH OPENSSL_ia32cap 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/OPENSSL_load_builtin_modules.3 +=================================================================== +--- secure/lib/libcrypto/man/OPENSSL_load_builtin_modules.3 (revision 273303) ++++ secure/lib/libcrypto/man/OPENSSL_load_builtin_modules.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "OPENSSL_load_builtin_modules 3" +-.TH OPENSSL_load_builtin_modules 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH OPENSSL_load_builtin_modules 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/OpenSSL_add_all_algorithms.3 +=================================================================== +--- secure/lib/libcrypto/man/OpenSSL_add_all_algorithms.3 (revision 273303) ++++ secure/lib/libcrypto/man/OpenSSL_add_all_algorithms.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "OpenSSL_add_all_algorithms 3" +-.TH OpenSSL_add_all_algorithms 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH OpenSSL_add_all_algorithms 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/PEM_write_bio_CMS_stream.3 +=================================================================== +--- secure/lib/libcrypto/man/PEM_write_bio_CMS_stream.3 (revision 273303) ++++ secure/lib/libcrypto/man/PEM_write_bio_CMS_stream.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "PEM_write_bio_CMS_stream 3" +-.TH PEM_write_bio_CMS_stream 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH PEM_write_bio_CMS_stream 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/PEM_write_bio_PKCS7_stream.3 +=================================================================== +--- secure/lib/libcrypto/man/PEM_write_bio_PKCS7_stream.3 (revision 273303) ++++ secure/lib/libcrypto/man/PEM_write_bio_PKCS7_stream.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "PEM_write_bio_PKCS7_stream 3" +-.TH PEM_write_bio_PKCS7_stream 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH PEM_write_bio_PKCS7_stream 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/PKCS12_create.3 +=================================================================== +--- secure/lib/libcrypto/man/PKCS12_create.3 (revision 273303) ++++ secure/lib/libcrypto/man/PKCS12_create.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "PKCS12_create 3" +-.TH PKCS12_create 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH PKCS12_create 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/PKCS12_parse.3 +=================================================================== +--- secure/lib/libcrypto/man/PKCS12_parse.3 (revision 273303) ++++ secure/lib/libcrypto/man/PKCS12_parse.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "PKCS12_parse 3" +-.TH PKCS12_parse 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH PKCS12_parse 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/PKCS7_decrypt.3 +=================================================================== +--- secure/lib/libcrypto/man/PKCS7_decrypt.3 (revision 273303) ++++ secure/lib/libcrypto/man/PKCS7_decrypt.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "PKCS7_decrypt 3" +-.TH PKCS7_decrypt 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH PKCS7_decrypt 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/PKCS7_encrypt.3 +=================================================================== +--- secure/lib/libcrypto/man/PKCS7_encrypt.3 (revision 273303) ++++ secure/lib/libcrypto/man/PKCS7_encrypt.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "PKCS7_encrypt 3" +-.TH PKCS7_encrypt 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH PKCS7_encrypt 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/PKCS7_sign.3 +=================================================================== +--- secure/lib/libcrypto/man/PKCS7_sign.3 (revision 273303) ++++ secure/lib/libcrypto/man/PKCS7_sign.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "PKCS7_sign 3" +-.TH PKCS7_sign 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH PKCS7_sign 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/PKCS7_sign_add_signer.3 +=================================================================== +--- secure/lib/libcrypto/man/PKCS7_sign_add_signer.3 (revision 273303) ++++ secure/lib/libcrypto/man/PKCS7_sign_add_signer.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "PKCS7_sign_add_signer 3" +-.TH PKCS7_sign_add_signer 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH PKCS7_sign_add_signer 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/PKCS7_verify.3 +=================================================================== +--- secure/lib/libcrypto/man/PKCS7_verify.3 (revision 273303) ++++ secure/lib/libcrypto/man/PKCS7_verify.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "PKCS7_verify 3" +-.TH PKCS7_verify 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH PKCS7_verify 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/RAND_add.3 +=================================================================== +--- secure/lib/libcrypto/man/RAND_add.3 (revision 273303) ++++ secure/lib/libcrypto/man/RAND_add.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "RAND_add 3" +-.TH RAND_add 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH RAND_add 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/RAND_bytes.3 +=================================================================== +--- secure/lib/libcrypto/man/RAND_bytes.3 (revision 273303) ++++ secure/lib/libcrypto/man/RAND_bytes.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "RAND_bytes 3" +-.TH RAND_bytes 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH RAND_bytes 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/RAND_cleanup.3 +=================================================================== +--- secure/lib/libcrypto/man/RAND_cleanup.3 (revision 273303) ++++ secure/lib/libcrypto/man/RAND_cleanup.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "RAND_cleanup 3" +-.TH RAND_cleanup 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH RAND_cleanup 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/RAND_egd.3 +=================================================================== +--- secure/lib/libcrypto/man/RAND_egd.3 (revision 273303) ++++ secure/lib/libcrypto/man/RAND_egd.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "RAND_egd 3" +-.TH RAND_egd 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH RAND_egd 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/RAND_load_file.3 +=================================================================== +--- secure/lib/libcrypto/man/RAND_load_file.3 (revision 273303) ++++ secure/lib/libcrypto/man/RAND_load_file.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "RAND_load_file 3" +-.TH RAND_load_file 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH RAND_load_file 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/RAND_set_rand_method.3 +=================================================================== +--- secure/lib/libcrypto/man/RAND_set_rand_method.3 (revision 273303) ++++ secure/lib/libcrypto/man/RAND_set_rand_method.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "RAND_set_rand_method 3" +-.TH RAND_set_rand_method 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH RAND_set_rand_method 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/RSA_blinding_on.3 +=================================================================== +--- secure/lib/libcrypto/man/RSA_blinding_on.3 (revision 273303) ++++ secure/lib/libcrypto/man/RSA_blinding_on.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "RSA_blinding_on 3" +-.TH RSA_blinding_on 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH RSA_blinding_on 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/RSA_check_key.3 +=================================================================== +--- secure/lib/libcrypto/man/RSA_check_key.3 (revision 273303) ++++ secure/lib/libcrypto/man/RSA_check_key.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "RSA_check_key 3" +-.TH RSA_check_key 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH RSA_check_key 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/RSA_generate_key.3 +=================================================================== +--- secure/lib/libcrypto/man/RSA_generate_key.3 (revision 273303) ++++ secure/lib/libcrypto/man/RSA_generate_key.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "RSA_generate_key 3" +-.TH RSA_generate_key 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH RSA_generate_key 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/RSA_get_ex_new_index.3 +=================================================================== +--- secure/lib/libcrypto/man/RSA_get_ex_new_index.3 (revision 273303) ++++ secure/lib/libcrypto/man/RSA_get_ex_new_index.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "RSA_get_ex_new_index 3" +-.TH RSA_get_ex_new_index 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH RSA_get_ex_new_index 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/RSA_new.3 +=================================================================== +--- secure/lib/libcrypto/man/RSA_new.3 (revision 273303) ++++ secure/lib/libcrypto/man/RSA_new.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "RSA_new 3" +-.TH RSA_new 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH RSA_new 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/RSA_padding_add_PKCS1_type_1.3 +=================================================================== +--- secure/lib/libcrypto/man/RSA_padding_add_PKCS1_type_1.3 (revision 273303) ++++ secure/lib/libcrypto/man/RSA_padding_add_PKCS1_type_1.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "RSA_padding_add_PKCS1_type_1 3" +-.TH RSA_padding_add_PKCS1_type_1 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH RSA_padding_add_PKCS1_type_1 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/RSA_print.3 +=================================================================== +--- secure/lib/libcrypto/man/RSA_print.3 (revision 273303) ++++ secure/lib/libcrypto/man/RSA_print.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "RSA_print 3" +-.TH RSA_print 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH RSA_print 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/RSA_private_encrypt.3 +=================================================================== +--- secure/lib/libcrypto/man/RSA_private_encrypt.3 (revision 273303) ++++ secure/lib/libcrypto/man/RSA_private_encrypt.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "RSA_private_encrypt 3" +-.TH RSA_private_encrypt 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH RSA_private_encrypt 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/RSA_public_encrypt.3 +=================================================================== +--- secure/lib/libcrypto/man/RSA_public_encrypt.3 (revision 273303) ++++ secure/lib/libcrypto/man/RSA_public_encrypt.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "RSA_public_encrypt 3" +-.TH RSA_public_encrypt 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH RSA_public_encrypt 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/RSA_set_method.3 +=================================================================== +--- secure/lib/libcrypto/man/RSA_set_method.3 (revision 273303) ++++ secure/lib/libcrypto/man/RSA_set_method.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "RSA_set_method 3" +-.TH RSA_set_method 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH RSA_set_method 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/RSA_sign.3 +=================================================================== +--- secure/lib/libcrypto/man/RSA_sign.3 (revision 273303) ++++ secure/lib/libcrypto/man/RSA_sign.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "RSA_sign 3" +-.TH RSA_sign 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH RSA_sign 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/RSA_sign_ASN1_OCTET_STRING.3 +=================================================================== +--- secure/lib/libcrypto/man/RSA_sign_ASN1_OCTET_STRING.3 (revision 273303) ++++ secure/lib/libcrypto/man/RSA_sign_ASN1_OCTET_STRING.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "RSA_sign_ASN1_OCTET_STRING 3" +-.TH RSA_sign_ASN1_OCTET_STRING 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH RSA_sign_ASN1_OCTET_STRING 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/RSA_size.3 +=================================================================== +--- secure/lib/libcrypto/man/RSA_size.3 (revision 273303) ++++ secure/lib/libcrypto/man/RSA_size.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "RSA_size 3" +-.TH RSA_size 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH RSA_size 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/SMIME_read_CMS.3 +=================================================================== +--- secure/lib/libcrypto/man/SMIME_read_CMS.3 (revision 273303) ++++ secure/lib/libcrypto/man/SMIME_read_CMS.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "SMIME_read_CMS 3" +-.TH SMIME_read_CMS 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH SMIME_read_CMS 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/SMIME_read_PKCS7.3 +=================================================================== +--- secure/lib/libcrypto/man/SMIME_read_PKCS7.3 (revision 273303) ++++ secure/lib/libcrypto/man/SMIME_read_PKCS7.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "SMIME_read_PKCS7 3" +-.TH SMIME_read_PKCS7 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH SMIME_read_PKCS7 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/SMIME_write_CMS.3 +=================================================================== +--- secure/lib/libcrypto/man/SMIME_write_CMS.3 (revision 273303) ++++ secure/lib/libcrypto/man/SMIME_write_CMS.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "SMIME_write_CMS 3" +-.TH SMIME_write_CMS 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH SMIME_write_CMS 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/SMIME_write_PKCS7.3 +=================================================================== +--- secure/lib/libcrypto/man/SMIME_write_PKCS7.3 (revision 273303) ++++ secure/lib/libcrypto/man/SMIME_write_PKCS7.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "SMIME_write_PKCS7 3" +-.TH SMIME_write_PKCS7 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH SMIME_write_PKCS7 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/X509_NAME_ENTRY_get_object.3 +=================================================================== +--- secure/lib/libcrypto/man/X509_NAME_ENTRY_get_object.3 (revision 273303) ++++ secure/lib/libcrypto/man/X509_NAME_ENTRY_get_object.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "X509_NAME_ENTRY_get_object 3" +-.TH X509_NAME_ENTRY_get_object 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH X509_NAME_ENTRY_get_object 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/X509_NAME_add_entry_by_txt.3 +=================================================================== +--- secure/lib/libcrypto/man/X509_NAME_add_entry_by_txt.3 (revision 273303) ++++ secure/lib/libcrypto/man/X509_NAME_add_entry_by_txt.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "X509_NAME_add_entry_by_txt 3" +-.TH X509_NAME_add_entry_by_txt 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH X509_NAME_add_entry_by_txt 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/X509_NAME_get_index_by_NID.3 +=================================================================== +--- secure/lib/libcrypto/man/X509_NAME_get_index_by_NID.3 (revision 273303) ++++ secure/lib/libcrypto/man/X509_NAME_get_index_by_NID.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "X509_NAME_get_index_by_NID 3" +-.TH X509_NAME_get_index_by_NID 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH X509_NAME_get_index_by_NID 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/X509_NAME_print_ex.3 +=================================================================== +--- secure/lib/libcrypto/man/X509_NAME_print_ex.3 (revision 273303) ++++ secure/lib/libcrypto/man/X509_NAME_print_ex.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "X509_NAME_print_ex 3" +-.TH X509_NAME_print_ex 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH X509_NAME_print_ex 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/X509_STORE_CTX_get_error.3 +=================================================================== +--- secure/lib/libcrypto/man/X509_STORE_CTX_get_error.3 (revision 273303) ++++ secure/lib/libcrypto/man/X509_STORE_CTX_get_error.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "X509_STORE_CTX_get_error 3" +-.TH X509_STORE_CTX_get_error 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH X509_STORE_CTX_get_error 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/X509_STORE_CTX_get_ex_new_index.3 +=================================================================== +--- secure/lib/libcrypto/man/X509_STORE_CTX_get_ex_new_index.3 (revision 273303) ++++ secure/lib/libcrypto/man/X509_STORE_CTX_get_ex_new_index.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "X509_STORE_CTX_get_ex_new_index 3" +-.TH X509_STORE_CTX_get_ex_new_index 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH X509_STORE_CTX_get_ex_new_index 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/X509_STORE_CTX_new.3 +=================================================================== +--- secure/lib/libcrypto/man/X509_STORE_CTX_new.3 (revision 273303) ++++ secure/lib/libcrypto/man/X509_STORE_CTX_new.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "X509_STORE_CTX_new 3" +-.TH X509_STORE_CTX_new 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH X509_STORE_CTX_new 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/X509_STORE_CTX_set_verify_cb.3 +=================================================================== +--- secure/lib/libcrypto/man/X509_STORE_CTX_set_verify_cb.3 (revision 273303) ++++ secure/lib/libcrypto/man/X509_STORE_CTX_set_verify_cb.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "X509_STORE_CTX_set_verify_cb 3" +-.TH X509_STORE_CTX_set_verify_cb 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH X509_STORE_CTX_set_verify_cb 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/X509_STORE_set_verify_cb_func.3 +=================================================================== +--- secure/lib/libcrypto/man/X509_STORE_set_verify_cb_func.3 (revision 273303) ++++ secure/lib/libcrypto/man/X509_STORE_set_verify_cb_func.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "X509_STORE_set_verify_cb_func 3" +-.TH X509_STORE_set_verify_cb_func 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH X509_STORE_set_verify_cb_func 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/X509_VERIFY_PARAM_set_flags.3 +=================================================================== +--- secure/lib/libcrypto/man/X509_VERIFY_PARAM_set_flags.3 (revision 273303) ++++ secure/lib/libcrypto/man/X509_VERIFY_PARAM_set_flags.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "X509_VERIFY_PARAM_set_flags 3" +-.TH X509_VERIFY_PARAM_set_flags 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH X509_VERIFY_PARAM_set_flags 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/X509_new.3 +=================================================================== +--- secure/lib/libcrypto/man/X509_new.3 (revision 273303) ++++ secure/lib/libcrypto/man/X509_new.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "X509_new 3" +-.TH X509_new 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH X509_new 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/X509_verify_cert.3 +=================================================================== +--- secure/lib/libcrypto/man/X509_verify_cert.3 (revision 273303) ++++ secure/lib/libcrypto/man/X509_verify_cert.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "X509_verify_cert 3" +-.TH X509_verify_cert 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH X509_verify_cert 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/bio.3 +=================================================================== +--- secure/lib/libcrypto/man/bio.3 (revision 273303) ++++ secure/lib/libcrypto/man/bio.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "bio 3" +-.TH bio 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH bio 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/blowfish.3 +=================================================================== +--- secure/lib/libcrypto/man/blowfish.3 (revision 273303) ++++ secure/lib/libcrypto/man/blowfish.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "blowfish 3" +-.TH blowfish 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH blowfish 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/bn.3 +=================================================================== +--- secure/lib/libcrypto/man/bn.3 (revision 273303) ++++ secure/lib/libcrypto/man/bn.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "bn 3" +-.TH bn 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH bn 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/bn_internal.3 +=================================================================== +--- secure/lib/libcrypto/man/bn_internal.3 (revision 273303) ++++ secure/lib/libcrypto/man/bn_internal.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "bn_internal 3" +-.TH bn_internal 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH bn_internal 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/buffer.3 +=================================================================== +--- secure/lib/libcrypto/man/buffer.3 (revision 273303) ++++ secure/lib/libcrypto/man/buffer.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "buffer 3" +-.TH buffer 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH buffer 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/crypto.3 +=================================================================== +--- secure/lib/libcrypto/man/crypto.3 (revision 273303) ++++ secure/lib/libcrypto/man/crypto.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "crypto 3" +-.TH crypto 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH crypto 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/d2i_ASN1_OBJECT.3 +=================================================================== +--- secure/lib/libcrypto/man/d2i_ASN1_OBJECT.3 (revision 273303) ++++ secure/lib/libcrypto/man/d2i_ASN1_OBJECT.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "d2i_ASN1_OBJECT 3" +-.TH d2i_ASN1_OBJECT 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH d2i_ASN1_OBJECT 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/d2i_DHparams.3 +=================================================================== +--- secure/lib/libcrypto/man/d2i_DHparams.3 (revision 273303) ++++ secure/lib/libcrypto/man/d2i_DHparams.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "d2i_DHparams 3" +-.TH d2i_DHparams 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH d2i_DHparams 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/d2i_DSAPublicKey.3 +=================================================================== +--- secure/lib/libcrypto/man/d2i_DSAPublicKey.3 (revision 273303) ++++ secure/lib/libcrypto/man/d2i_DSAPublicKey.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "d2i_DSAPublicKey 3" +-.TH d2i_DSAPublicKey 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH d2i_DSAPublicKey 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/d2i_PKCS8PrivateKey.3 +=================================================================== +--- secure/lib/libcrypto/man/d2i_PKCS8PrivateKey.3 (revision 273303) ++++ secure/lib/libcrypto/man/d2i_PKCS8PrivateKey.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "d2i_PKCS8PrivateKey 3" +-.TH d2i_PKCS8PrivateKey 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH d2i_PKCS8PrivateKey 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/d2i_RSAPublicKey.3 +=================================================================== +--- secure/lib/libcrypto/man/d2i_RSAPublicKey.3 (revision 273303) ++++ secure/lib/libcrypto/man/d2i_RSAPublicKey.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "d2i_RSAPublicKey 3" +-.TH d2i_RSAPublicKey 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH d2i_RSAPublicKey 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/d2i_X509.3 +=================================================================== +--- secure/lib/libcrypto/man/d2i_X509.3 (revision 273303) ++++ secure/lib/libcrypto/man/d2i_X509.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "d2i_X509 3" +-.TH d2i_X509 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH d2i_X509 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/d2i_X509_ALGOR.3 +=================================================================== +--- secure/lib/libcrypto/man/d2i_X509_ALGOR.3 (revision 273303) ++++ secure/lib/libcrypto/man/d2i_X509_ALGOR.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "d2i_X509_ALGOR 3" +-.TH d2i_X509_ALGOR 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH d2i_X509_ALGOR 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/d2i_X509_CRL.3 +=================================================================== +--- secure/lib/libcrypto/man/d2i_X509_CRL.3 (revision 273303) ++++ secure/lib/libcrypto/man/d2i_X509_CRL.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "d2i_X509_CRL 3" +-.TH d2i_X509_CRL 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH d2i_X509_CRL 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/d2i_X509_NAME.3 +=================================================================== +--- secure/lib/libcrypto/man/d2i_X509_NAME.3 (revision 273303) ++++ secure/lib/libcrypto/man/d2i_X509_NAME.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "d2i_X509_NAME 3" +-.TH d2i_X509_NAME 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH d2i_X509_NAME 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/d2i_X509_REQ.3 +=================================================================== +--- secure/lib/libcrypto/man/d2i_X509_REQ.3 (revision 273303) ++++ secure/lib/libcrypto/man/d2i_X509_REQ.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "d2i_X509_REQ 3" +-.TH d2i_X509_REQ 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH d2i_X509_REQ 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/d2i_X509_SIG.3 +=================================================================== +--- secure/lib/libcrypto/man/d2i_X509_SIG.3 (revision 273303) ++++ secure/lib/libcrypto/man/d2i_X509_SIG.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "d2i_X509_SIG 3" +-.TH d2i_X509_SIG 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH d2i_X509_SIG 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/des.3 +=================================================================== +--- secure/lib/libcrypto/man/des.3 (revision 273303) ++++ secure/lib/libcrypto/man/des.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "des 3" +-.TH des 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH des 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/dh.3 +=================================================================== +--- secure/lib/libcrypto/man/dh.3 (revision 273303) ++++ secure/lib/libcrypto/man/dh.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "dh 3" +-.TH dh 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH dh 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/dsa.3 +=================================================================== +--- secure/lib/libcrypto/man/dsa.3 (revision 273303) ++++ secure/lib/libcrypto/man/dsa.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "dsa 3" +-.TH dsa 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH dsa 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/ecdsa.3 +=================================================================== +--- secure/lib/libcrypto/man/ecdsa.3 (revision 273303) ++++ secure/lib/libcrypto/man/ecdsa.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "ecdsa 3" +-.TH ecdsa 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH ecdsa 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/engine.3 +=================================================================== +--- secure/lib/libcrypto/man/engine.3 (revision 273303) ++++ secure/lib/libcrypto/man/engine.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "engine 3" +-.TH engine 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH engine 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/err.3 +=================================================================== +--- secure/lib/libcrypto/man/err.3 (revision 273303) ++++ secure/lib/libcrypto/man/err.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "err 3" +-.TH err 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH err 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/evp.3 +=================================================================== +--- secure/lib/libcrypto/man/evp.3 (revision 273303) ++++ secure/lib/libcrypto/man/evp.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "evp 3" +-.TH evp 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH evp 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/hmac.3 +=================================================================== +--- secure/lib/libcrypto/man/hmac.3 (revision 273303) ++++ secure/lib/libcrypto/man/hmac.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "hmac 3" +-.TH hmac 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH hmac 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/i2d_CMS_bio_stream.3 +=================================================================== +--- secure/lib/libcrypto/man/i2d_CMS_bio_stream.3 (revision 273303) ++++ secure/lib/libcrypto/man/i2d_CMS_bio_stream.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "i2d_CMS_bio_stream 3" +-.TH i2d_CMS_bio_stream 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH i2d_CMS_bio_stream 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/i2d_PKCS7_bio_stream.3 +=================================================================== +--- secure/lib/libcrypto/man/i2d_PKCS7_bio_stream.3 (revision 273303) ++++ secure/lib/libcrypto/man/i2d_PKCS7_bio_stream.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "i2d_PKCS7_bio_stream 3" +-.TH i2d_PKCS7_bio_stream 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH i2d_PKCS7_bio_stream 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/lh_stats.3 +=================================================================== +--- secure/lib/libcrypto/man/lh_stats.3 (revision 273303) ++++ secure/lib/libcrypto/man/lh_stats.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "lh_stats 3" +-.TH lh_stats 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH lh_stats 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/lhash.3 +=================================================================== +--- secure/lib/libcrypto/man/lhash.3 (revision 273303) ++++ secure/lib/libcrypto/man/lhash.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "lhash 3" +-.TH lhash 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH lhash 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/md5.3 +=================================================================== +--- secure/lib/libcrypto/man/md5.3 (revision 273303) ++++ secure/lib/libcrypto/man/md5.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "md5 3" +-.TH md5 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH md5 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/mdc2.3 +=================================================================== +--- secure/lib/libcrypto/man/mdc2.3 (revision 273303) ++++ secure/lib/libcrypto/man/mdc2.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "mdc2 3" +-.TH mdc2 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH mdc2 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/pem.3 +=================================================================== +--- secure/lib/libcrypto/man/pem.3 (revision 273303) ++++ secure/lib/libcrypto/man/pem.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "pem 3" +-.TH pem 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH pem 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/rand.3 +=================================================================== +--- secure/lib/libcrypto/man/rand.3 (revision 273303) ++++ secure/lib/libcrypto/man/rand.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "rand 3" +-.TH rand 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH rand 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/rc4.3 +=================================================================== +--- secure/lib/libcrypto/man/rc4.3 (revision 273303) ++++ secure/lib/libcrypto/man/rc4.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "rc4 3" +-.TH rc4 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH rc4 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/ripemd.3 +=================================================================== +--- secure/lib/libcrypto/man/ripemd.3 (revision 273303) ++++ secure/lib/libcrypto/man/ripemd.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "ripemd 3" +-.TH ripemd 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH ripemd 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/rsa.3 +=================================================================== +--- secure/lib/libcrypto/man/rsa.3 (revision 273303) ++++ secure/lib/libcrypto/man/rsa.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "rsa 3" +-.TH rsa 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH rsa 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/sha.3 +=================================================================== +--- secure/lib/libcrypto/man/sha.3 (revision 273303) ++++ secure/lib/libcrypto/man/sha.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "sha 3" +-.TH sha 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH sha 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/threads.3 +=================================================================== +--- secure/lib/libcrypto/man/threads.3 (revision 273303) ++++ secure/lib/libcrypto/man/threads.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "threads 3" +-.TH threads 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH threads 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/ui.3 +=================================================================== +--- secure/lib/libcrypto/man/ui.3 (revision 273303) ++++ secure/lib/libcrypto/man/ui.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "ui 3" +-.TH ui 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH ui 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/ui_compat.3 +=================================================================== +--- secure/lib/libcrypto/man/ui_compat.3 (revision 273303) ++++ secure/lib/libcrypto/man/ui_compat.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "ui_compat 3" +-.TH ui_compat 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH ui_compat 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libcrypto/man/x509.3 +=================================================================== +--- secure/lib/libcrypto/man/x509.3 (revision 273303) ++++ secure/lib/libcrypto/man/x509.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "x509 3" +-.TH x509 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH x509 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libssl/man/SSL_CIPHER_get_name.3 +=================================================================== +--- secure/lib/libssl/man/SSL_CIPHER_get_name.3 (revision 273303) ++++ secure/lib/libssl/man/SSL_CIPHER_get_name.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "SSL_CIPHER_get_name 3" +-.TH SSL_CIPHER_get_name 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH SSL_CIPHER_get_name 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libssl/man/SSL_COMP_add_compression_method.3 +=================================================================== +--- secure/lib/libssl/man/SSL_COMP_add_compression_method.3 (revision 273303) ++++ secure/lib/libssl/man/SSL_COMP_add_compression_method.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "SSL_COMP_add_compression_method 3" +-.TH SSL_COMP_add_compression_method 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH SSL_COMP_add_compression_method 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libssl/man/SSL_CTX_add_extra_chain_cert.3 +=================================================================== +--- secure/lib/libssl/man/SSL_CTX_add_extra_chain_cert.3 (revision 273303) ++++ secure/lib/libssl/man/SSL_CTX_add_extra_chain_cert.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "SSL_CTX_add_extra_chain_cert 3" +-.TH SSL_CTX_add_extra_chain_cert 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH SSL_CTX_add_extra_chain_cert 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libssl/man/SSL_CTX_add_session.3 +=================================================================== +--- secure/lib/libssl/man/SSL_CTX_add_session.3 (revision 273303) ++++ secure/lib/libssl/man/SSL_CTX_add_session.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "SSL_CTX_add_session 3" +-.TH SSL_CTX_add_session 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH SSL_CTX_add_session 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libssl/man/SSL_CTX_ctrl.3 +=================================================================== +--- secure/lib/libssl/man/SSL_CTX_ctrl.3 (revision 273303) ++++ secure/lib/libssl/man/SSL_CTX_ctrl.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "SSL_CTX_ctrl 3" +-.TH SSL_CTX_ctrl 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH SSL_CTX_ctrl 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libssl/man/SSL_CTX_flush_sessions.3 +=================================================================== +--- secure/lib/libssl/man/SSL_CTX_flush_sessions.3 (revision 273303) ++++ secure/lib/libssl/man/SSL_CTX_flush_sessions.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "SSL_CTX_flush_sessions 3" +-.TH SSL_CTX_flush_sessions 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH SSL_CTX_flush_sessions 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libssl/man/SSL_CTX_free.3 +=================================================================== +--- secure/lib/libssl/man/SSL_CTX_free.3 (revision 273303) ++++ secure/lib/libssl/man/SSL_CTX_free.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "SSL_CTX_free 3" +-.TH SSL_CTX_free 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH SSL_CTX_free 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libssl/man/SSL_CTX_get_ex_new_index.3 +=================================================================== +--- secure/lib/libssl/man/SSL_CTX_get_ex_new_index.3 (revision 273303) ++++ secure/lib/libssl/man/SSL_CTX_get_ex_new_index.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "SSL_CTX_get_ex_new_index 3" +-.TH SSL_CTX_get_ex_new_index 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH SSL_CTX_get_ex_new_index 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libssl/man/SSL_CTX_get_verify_mode.3 +=================================================================== +--- secure/lib/libssl/man/SSL_CTX_get_verify_mode.3 (revision 273303) ++++ secure/lib/libssl/man/SSL_CTX_get_verify_mode.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "SSL_CTX_get_verify_mode 3" +-.TH SSL_CTX_get_verify_mode 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH SSL_CTX_get_verify_mode 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libssl/man/SSL_CTX_load_verify_locations.3 +=================================================================== +--- secure/lib/libssl/man/SSL_CTX_load_verify_locations.3 (revision 273303) ++++ secure/lib/libssl/man/SSL_CTX_load_verify_locations.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "SSL_CTX_load_verify_locations 3" +-.TH SSL_CTX_load_verify_locations 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH SSL_CTX_load_verify_locations 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libssl/man/SSL_CTX_new.3 +=================================================================== +--- secure/lib/libssl/man/SSL_CTX_new.3 (revision 273303) ++++ secure/lib/libssl/man/SSL_CTX_new.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "SSL_CTX_new 3" +-.TH SSL_CTX_new 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH SSL_CTX_new 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libssl/man/SSL_CTX_sess_number.3 +=================================================================== +--- secure/lib/libssl/man/SSL_CTX_sess_number.3 (revision 273303) ++++ secure/lib/libssl/man/SSL_CTX_sess_number.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "SSL_CTX_sess_number 3" +-.TH SSL_CTX_sess_number 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH SSL_CTX_sess_number 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libssl/man/SSL_CTX_sess_set_cache_size.3 +=================================================================== +--- secure/lib/libssl/man/SSL_CTX_sess_set_cache_size.3 (revision 273303) ++++ secure/lib/libssl/man/SSL_CTX_sess_set_cache_size.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "SSL_CTX_sess_set_cache_size 3" +-.TH SSL_CTX_sess_set_cache_size 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH SSL_CTX_sess_set_cache_size 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libssl/man/SSL_CTX_sess_set_get_cb.3 +=================================================================== +--- secure/lib/libssl/man/SSL_CTX_sess_set_get_cb.3 (revision 273303) ++++ secure/lib/libssl/man/SSL_CTX_sess_set_get_cb.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "SSL_CTX_sess_set_get_cb 3" +-.TH SSL_CTX_sess_set_get_cb 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH SSL_CTX_sess_set_get_cb 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libssl/man/SSL_CTX_sessions.3 +=================================================================== +--- secure/lib/libssl/man/SSL_CTX_sessions.3 (revision 273303) ++++ secure/lib/libssl/man/SSL_CTX_sessions.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "SSL_CTX_sessions 3" +-.TH SSL_CTX_sessions 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH SSL_CTX_sessions 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libssl/man/SSL_CTX_set_cert_store.3 +=================================================================== +--- secure/lib/libssl/man/SSL_CTX_set_cert_store.3 (revision 273303) ++++ secure/lib/libssl/man/SSL_CTX_set_cert_store.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "SSL_CTX_set_cert_store 3" +-.TH SSL_CTX_set_cert_store 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH SSL_CTX_set_cert_store 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libssl/man/SSL_CTX_set_cert_verify_callback.3 +=================================================================== +--- secure/lib/libssl/man/SSL_CTX_set_cert_verify_callback.3 (revision 273303) ++++ secure/lib/libssl/man/SSL_CTX_set_cert_verify_callback.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "SSL_CTX_set_cert_verify_callback 3" +-.TH SSL_CTX_set_cert_verify_callback 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH SSL_CTX_set_cert_verify_callback 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libssl/man/SSL_CTX_set_cipher_list.3 +=================================================================== +--- secure/lib/libssl/man/SSL_CTX_set_cipher_list.3 (revision 273303) ++++ secure/lib/libssl/man/SSL_CTX_set_cipher_list.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "SSL_CTX_set_cipher_list 3" +-.TH SSL_CTX_set_cipher_list 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH SSL_CTX_set_cipher_list 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libssl/man/SSL_CTX_set_client_CA_list.3 +=================================================================== +--- secure/lib/libssl/man/SSL_CTX_set_client_CA_list.3 (revision 273303) ++++ secure/lib/libssl/man/SSL_CTX_set_client_CA_list.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "SSL_CTX_set_client_CA_list 3" +-.TH SSL_CTX_set_client_CA_list 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH SSL_CTX_set_client_CA_list 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libssl/man/SSL_CTX_set_client_cert_cb.3 +=================================================================== +--- secure/lib/libssl/man/SSL_CTX_set_client_cert_cb.3 (revision 273303) ++++ secure/lib/libssl/man/SSL_CTX_set_client_cert_cb.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "SSL_CTX_set_client_cert_cb 3" +-.TH SSL_CTX_set_client_cert_cb 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH SSL_CTX_set_client_cert_cb 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libssl/man/SSL_CTX_set_default_passwd_cb.3 +=================================================================== +--- secure/lib/libssl/man/SSL_CTX_set_default_passwd_cb.3 (revision 273303) ++++ secure/lib/libssl/man/SSL_CTX_set_default_passwd_cb.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "SSL_CTX_set_default_passwd_cb 3" +-.TH SSL_CTX_set_default_passwd_cb 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH SSL_CTX_set_default_passwd_cb 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libssl/man/SSL_CTX_set_generate_session_id.3 +=================================================================== +--- secure/lib/libssl/man/SSL_CTX_set_generate_session_id.3 (revision 273303) ++++ secure/lib/libssl/man/SSL_CTX_set_generate_session_id.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "SSL_CTX_set_generate_session_id 3" +-.TH SSL_CTX_set_generate_session_id 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH SSL_CTX_set_generate_session_id 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libssl/man/SSL_CTX_set_info_callback.3 +=================================================================== +--- secure/lib/libssl/man/SSL_CTX_set_info_callback.3 (revision 273303) ++++ secure/lib/libssl/man/SSL_CTX_set_info_callback.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "SSL_CTX_set_info_callback 3" +-.TH SSL_CTX_set_info_callback 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH SSL_CTX_set_info_callback 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libssl/man/SSL_CTX_set_max_cert_list.3 +=================================================================== +--- secure/lib/libssl/man/SSL_CTX_set_max_cert_list.3 (revision 273303) ++++ secure/lib/libssl/man/SSL_CTX_set_max_cert_list.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "SSL_CTX_set_max_cert_list 3" +-.TH SSL_CTX_set_max_cert_list 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH SSL_CTX_set_max_cert_list 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libssl/man/SSL_CTX_set_mode.3 +=================================================================== +--- secure/lib/libssl/man/SSL_CTX_set_mode.3 (revision 273303) ++++ secure/lib/libssl/man/SSL_CTX_set_mode.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "SSL_CTX_set_mode 3" +-.TH SSL_CTX_set_mode 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH SSL_CTX_set_mode 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libssl/man/SSL_CTX_set_msg_callback.3 +=================================================================== +--- secure/lib/libssl/man/SSL_CTX_set_msg_callback.3 (revision 273303) ++++ secure/lib/libssl/man/SSL_CTX_set_msg_callback.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "SSL_CTX_set_msg_callback 3" +-.TH SSL_CTX_set_msg_callback 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH SSL_CTX_set_msg_callback 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libssl/man/SSL_CTX_set_options.3 +=================================================================== +--- secure/lib/libssl/man/SSL_CTX_set_options.3 (revision 273303) ++++ secure/lib/libssl/man/SSL_CTX_set_options.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "SSL_CTX_set_options 3" +-.TH SSL_CTX_set_options 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH SSL_CTX_set_options 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libssl/man/SSL_CTX_set_psk_client_callback.3 +=================================================================== +--- secure/lib/libssl/man/SSL_CTX_set_psk_client_callback.3 (revision 273303) ++++ secure/lib/libssl/man/SSL_CTX_set_psk_client_callback.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "SSL_CTX_set_psk_client_callback 3" +-.TH SSL_CTX_set_psk_client_callback 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH SSL_CTX_set_psk_client_callback 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libssl/man/SSL_CTX_set_quiet_shutdown.3 +=================================================================== +--- secure/lib/libssl/man/SSL_CTX_set_quiet_shutdown.3 (revision 273303) ++++ secure/lib/libssl/man/SSL_CTX_set_quiet_shutdown.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "SSL_CTX_set_quiet_shutdown 3" +-.TH SSL_CTX_set_quiet_shutdown 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH SSL_CTX_set_quiet_shutdown 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libssl/man/SSL_CTX_set_session_cache_mode.3 +=================================================================== +--- secure/lib/libssl/man/SSL_CTX_set_session_cache_mode.3 (revision 273303) ++++ secure/lib/libssl/man/SSL_CTX_set_session_cache_mode.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "SSL_CTX_set_session_cache_mode 3" +-.TH SSL_CTX_set_session_cache_mode 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH SSL_CTX_set_session_cache_mode 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libssl/man/SSL_CTX_set_session_id_context.3 +=================================================================== +--- secure/lib/libssl/man/SSL_CTX_set_session_id_context.3 (revision 273303) ++++ secure/lib/libssl/man/SSL_CTX_set_session_id_context.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "SSL_CTX_set_session_id_context 3" +-.TH SSL_CTX_set_session_id_context 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH SSL_CTX_set_session_id_context 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libssl/man/SSL_CTX_set_ssl_version.3 +=================================================================== +--- secure/lib/libssl/man/SSL_CTX_set_ssl_version.3 (revision 273303) ++++ secure/lib/libssl/man/SSL_CTX_set_ssl_version.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "SSL_CTX_set_ssl_version 3" +-.TH SSL_CTX_set_ssl_version 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH SSL_CTX_set_ssl_version 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libssl/man/SSL_CTX_set_timeout.3 +=================================================================== +--- secure/lib/libssl/man/SSL_CTX_set_timeout.3 (revision 273303) ++++ secure/lib/libssl/man/SSL_CTX_set_timeout.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "SSL_CTX_set_timeout 3" +-.TH SSL_CTX_set_timeout 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH SSL_CTX_set_timeout 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libssl/man/SSL_CTX_set_tlsext_ticket_key_cb.3 +=================================================================== +--- secure/lib/libssl/man/SSL_CTX_set_tlsext_ticket_key_cb.3 (revision 273303) ++++ secure/lib/libssl/man/SSL_CTX_set_tlsext_ticket_key_cb.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "SSL_CTX_set_tlsext_ticket_key_cb 3" +-.TH SSL_CTX_set_tlsext_ticket_key_cb 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH SSL_CTX_set_tlsext_ticket_key_cb 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libssl/man/SSL_CTX_set_tmp_dh_callback.3 +=================================================================== +--- secure/lib/libssl/man/SSL_CTX_set_tmp_dh_callback.3 (revision 273303) ++++ secure/lib/libssl/man/SSL_CTX_set_tmp_dh_callback.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "SSL_CTX_set_tmp_dh_callback 3" +-.TH SSL_CTX_set_tmp_dh_callback 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH SSL_CTX_set_tmp_dh_callback 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +@@ -175,12 +175,13 @@ even if he gets hold of the normal (certified) key + only used for signing. + .PP + In order to perform a \s-1DH\s0 key exchange the server must use a \s-1DH\s0 group +-(\s-1DH\s0 parameters) and generate a \s-1DH\s0 key. The server will always generate a new +-\&\s-1DH\s0 key during the negotiation, when the \s-1DH\s0 parameters are supplied via +-callback and/or when the \s-1SSL_OP_SINGLE_DH_USE\s0 option of +-\&\fISSL_CTX_set_options\fR\|(3) is set. It will +-immediately create a \s-1DH\s0 key, when \s-1DH\s0 parameters are supplied via +-\&\fISSL_CTX_set_tmp_dh()\fR and \s-1SSL_OP_SINGLE_DH_USE\s0 is not set. In this case, ++(\s-1DH\s0 parameters) and generate a \s-1DH\s0 key. ++The server will always generate a new \s-1DH\s0 key during the negotiation ++if either the \s-1DH\s0 parameters are supplied via callback or the ++\&\s-1SSL_OP_SINGLE_DH_USE\s0 option of \fISSL_CTX_set_options\fR\|(3) is set (or both). ++It will immediately create a \s-1DH\s0 key if \s-1DH\s0 parameters are supplied via ++\&\fISSL_CTX_set_tmp_dh()\fR and \s-1SSL_OP_SINGLE_DH_USE\s0 is not set. ++In this case, + it may happen that a key is generated on initialization without later + being needed, while on the other hand the computer time during the + negotiation is being saved. +@@ -266,7 +267,7 @@ partly left out.) + \& dh_tmp = dh_512; + \& break; + \& case 1024: +-\& if (!dh_1024) ++\& if (!dh_1024) + \& dh_1024 = get_dh1024(); + \& dh_tmp = dh_1024; + \& break; +Index: secure/lib/libssl/man/SSL_CTX_set_tmp_rsa_callback.3 +=================================================================== +--- secure/lib/libssl/man/SSL_CTX_set_tmp_rsa_callback.3 (revision 273303) ++++ secure/lib/libssl/man/SSL_CTX_set_tmp_rsa_callback.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "SSL_CTX_set_tmp_rsa_callback 3" +-.TH SSL_CTX_set_tmp_rsa_callback 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH SSL_CTX_set_tmp_rsa_callback 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libssl/man/SSL_CTX_set_verify.3 +=================================================================== +--- secure/lib/libssl/man/SSL_CTX_set_verify.3 (revision 273303) ++++ secure/lib/libssl/man/SSL_CTX_set_verify.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "SSL_CTX_set_verify 3" +-.TH SSL_CTX_set_verify 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH SSL_CTX_set_verify 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libssl/man/SSL_CTX_use_certificate.3 +=================================================================== +--- secure/lib/libssl/man/SSL_CTX_use_certificate.3 (revision 273303) ++++ secure/lib/libssl/man/SSL_CTX_use_certificate.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "SSL_CTX_use_certificate 3" +-.TH SSL_CTX_use_certificate 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH SSL_CTX_use_certificate 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libssl/man/SSL_CTX_use_psk_identity_hint.3 +=================================================================== +--- secure/lib/libssl/man/SSL_CTX_use_psk_identity_hint.3 (revision 273303) ++++ secure/lib/libssl/man/SSL_CTX_use_psk_identity_hint.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "SSL_CTX_use_psk_identity_hint 3" +-.TH SSL_CTX_use_psk_identity_hint 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH SSL_CTX_use_psk_identity_hint 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libssl/man/SSL_SESSION_free.3 +=================================================================== +--- secure/lib/libssl/man/SSL_SESSION_free.3 (revision 273303) ++++ secure/lib/libssl/man/SSL_SESSION_free.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "SSL_SESSION_free 3" +-.TH SSL_SESSION_free 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH SSL_SESSION_free 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libssl/man/SSL_SESSION_get_ex_new_index.3 +=================================================================== +--- secure/lib/libssl/man/SSL_SESSION_get_ex_new_index.3 (revision 273303) ++++ secure/lib/libssl/man/SSL_SESSION_get_ex_new_index.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "SSL_SESSION_get_ex_new_index 3" +-.TH SSL_SESSION_get_ex_new_index 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH SSL_SESSION_get_ex_new_index 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libssl/man/SSL_SESSION_get_time.3 +=================================================================== +--- secure/lib/libssl/man/SSL_SESSION_get_time.3 (revision 273303) ++++ secure/lib/libssl/man/SSL_SESSION_get_time.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "SSL_SESSION_get_time 3" +-.TH SSL_SESSION_get_time 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH SSL_SESSION_get_time 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libssl/man/SSL_accept.3 +=================================================================== +--- secure/lib/libssl/man/SSL_accept.3 (revision 273303) ++++ secure/lib/libssl/man/SSL_accept.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "SSL_accept 3" +-.TH SSL_accept 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH SSL_accept 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libssl/man/SSL_alert_type_string.3 +=================================================================== +--- secure/lib/libssl/man/SSL_alert_type_string.3 (revision 273303) ++++ secure/lib/libssl/man/SSL_alert_type_string.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "SSL_alert_type_string 3" +-.TH SSL_alert_type_string 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH SSL_alert_type_string 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libssl/man/SSL_clear.3 +=================================================================== +--- secure/lib/libssl/man/SSL_clear.3 (revision 273303) ++++ secure/lib/libssl/man/SSL_clear.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "SSL_clear 3" +-.TH SSL_clear 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH SSL_clear 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libssl/man/SSL_connect.3 +=================================================================== +--- secure/lib/libssl/man/SSL_connect.3 (revision 273303) ++++ secure/lib/libssl/man/SSL_connect.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "SSL_connect 3" +-.TH SSL_connect 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH SSL_connect 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libssl/man/SSL_do_handshake.3 +=================================================================== +--- secure/lib/libssl/man/SSL_do_handshake.3 (revision 273303) ++++ secure/lib/libssl/man/SSL_do_handshake.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "SSL_do_handshake 3" +-.TH SSL_do_handshake 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH SSL_do_handshake 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libssl/man/SSL_free.3 +=================================================================== +--- secure/lib/libssl/man/SSL_free.3 (revision 273303) ++++ secure/lib/libssl/man/SSL_free.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "SSL_free 3" +-.TH SSL_free 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH SSL_free 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libssl/man/SSL_get_SSL_CTX.3 +=================================================================== +--- secure/lib/libssl/man/SSL_get_SSL_CTX.3 (revision 273303) ++++ secure/lib/libssl/man/SSL_get_SSL_CTX.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "SSL_get_SSL_CTX 3" +-.TH SSL_get_SSL_CTX 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH SSL_get_SSL_CTX 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libssl/man/SSL_get_ciphers.3 +=================================================================== +--- secure/lib/libssl/man/SSL_get_ciphers.3 (revision 273303) ++++ secure/lib/libssl/man/SSL_get_ciphers.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "SSL_get_ciphers 3" +-.TH SSL_get_ciphers 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH SSL_get_ciphers 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libssl/man/SSL_get_client_CA_list.3 +=================================================================== +--- secure/lib/libssl/man/SSL_get_client_CA_list.3 (revision 273303) ++++ secure/lib/libssl/man/SSL_get_client_CA_list.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "SSL_get_client_CA_list 3" +-.TH SSL_get_client_CA_list 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH SSL_get_client_CA_list 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libssl/man/SSL_get_current_cipher.3 +=================================================================== +--- secure/lib/libssl/man/SSL_get_current_cipher.3 (revision 273303) ++++ secure/lib/libssl/man/SSL_get_current_cipher.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "SSL_get_current_cipher 3" +-.TH SSL_get_current_cipher 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH SSL_get_current_cipher 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libssl/man/SSL_get_default_timeout.3 +=================================================================== +--- secure/lib/libssl/man/SSL_get_default_timeout.3 (revision 273303) ++++ secure/lib/libssl/man/SSL_get_default_timeout.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "SSL_get_default_timeout 3" +-.TH SSL_get_default_timeout 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH SSL_get_default_timeout 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libssl/man/SSL_get_error.3 +=================================================================== +--- secure/lib/libssl/man/SSL_get_error.3 (revision 273303) ++++ secure/lib/libssl/man/SSL_get_error.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "SSL_get_error 3" +-.TH SSL_get_error 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH SSL_get_error 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libssl/man/SSL_get_ex_data_X509_STORE_CTX_idx.3 +=================================================================== +--- secure/lib/libssl/man/SSL_get_ex_data_X509_STORE_CTX_idx.3 (revision 273303) ++++ secure/lib/libssl/man/SSL_get_ex_data_X509_STORE_CTX_idx.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "SSL_get_ex_data_X509_STORE_CTX_idx 3" +-.TH SSL_get_ex_data_X509_STORE_CTX_idx 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH SSL_get_ex_data_X509_STORE_CTX_idx 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libssl/man/SSL_get_ex_new_index.3 +=================================================================== +--- secure/lib/libssl/man/SSL_get_ex_new_index.3 (revision 273303) ++++ secure/lib/libssl/man/SSL_get_ex_new_index.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "SSL_get_ex_new_index 3" +-.TH SSL_get_ex_new_index 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH SSL_get_ex_new_index 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libssl/man/SSL_get_fd.3 +=================================================================== +--- secure/lib/libssl/man/SSL_get_fd.3 (revision 273303) ++++ secure/lib/libssl/man/SSL_get_fd.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "SSL_get_fd 3" +-.TH SSL_get_fd 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH SSL_get_fd 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libssl/man/SSL_get_peer_cert_chain.3 +=================================================================== +--- secure/lib/libssl/man/SSL_get_peer_cert_chain.3 (revision 273303) ++++ secure/lib/libssl/man/SSL_get_peer_cert_chain.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "SSL_get_peer_cert_chain 3" +-.TH SSL_get_peer_cert_chain 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH SSL_get_peer_cert_chain 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libssl/man/SSL_get_peer_certificate.3 +=================================================================== +--- secure/lib/libssl/man/SSL_get_peer_certificate.3 (revision 273303) ++++ secure/lib/libssl/man/SSL_get_peer_certificate.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "SSL_get_peer_certificate 3" +-.TH SSL_get_peer_certificate 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH SSL_get_peer_certificate 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libssl/man/SSL_get_psk_identity.3 +=================================================================== +--- secure/lib/libssl/man/SSL_get_psk_identity.3 (revision 273303) ++++ secure/lib/libssl/man/SSL_get_psk_identity.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "SSL_get_psk_identity 3" +-.TH SSL_get_psk_identity 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH SSL_get_psk_identity 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libssl/man/SSL_get_rbio.3 +=================================================================== +--- secure/lib/libssl/man/SSL_get_rbio.3 (revision 273303) ++++ secure/lib/libssl/man/SSL_get_rbio.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "SSL_get_rbio 3" +-.TH SSL_get_rbio 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH SSL_get_rbio 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libssl/man/SSL_get_session.3 +=================================================================== +--- secure/lib/libssl/man/SSL_get_session.3 (revision 273303) ++++ secure/lib/libssl/man/SSL_get_session.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "SSL_get_session 3" +-.TH SSL_get_session 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH SSL_get_session 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libssl/man/SSL_get_verify_result.3 +=================================================================== +--- secure/lib/libssl/man/SSL_get_verify_result.3 (revision 273303) ++++ secure/lib/libssl/man/SSL_get_verify_result.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "SSL_get_verify_result 3" +-.TH SSL_get_verify_result 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH SSL_get_verify_result 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libssl/man/SSL_get_version.3 +=================================================================== +--- secure/lib/libssl/man/SSL_get_version.3 (revision 273303) ++++ secure/lib/libssl/man/SSL_get_version.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "SSL_get_version 3" +-.TH SSL_get_version 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH SSL_get_version 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libssl/man/SSL_library_init.3 +=================================================================== +--- secure/lib/libssl/man/SSL_library_init.3 (revision 273303) ++++ secure/lib/libssl/man/SSL_library_init.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "SSL_library_init 3" +-.TH SSL_library_init 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH SSL_library_init 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libssl/man/SSL_load_client_CA_file.3 +=================================================================== +--- secure/lib/libssl/man/SSL_load_client_CA_file.3 (revision 273303) ++++ secure/lib/libssl/man/SSL_load_client_CA_file.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "SSL_load_client_CA_file 3" +-.TH SSL_load_client_CA_file 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH SSL_load_client_CA_file 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libssl/man/SSL_new.3 +=================================================================== +--- secure/lib/libssl/man/SSL_new.3 (revision 273303) ++++ secure/lib/libssl/man/SSL_new.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "SSL_new 3" +-.TH SSL_new 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH SSL_new 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libssl/man/SSL_pending.3 +=================================================================== +--- secure/lib/libssl/man/SSL_pending.3 (revision 273303) ++++ secure/lib/libssl/man/SSL_pending.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "SSL_pending 3" +-.TH SSL_pending 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH SSL_pending 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libssl/man/SSL_read.3 +=================================================================== +--- secure/lib/libssl/man/SSL_read.3 (revision 273303) ++++ secure/lib/libssl/man/SSL_read.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "SSL_read 3" +-.TH SSL_read 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH SSL_read 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libssl/man/SSL_rstate_string.3 +=================================================================== +--- secure/lib/libssl/man/SSL_rstate_string.3 (revision 273303) ++++ secure/lib/libssl/man/SSL_rstate_string.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "SSL_rstate_string 3" +-.TH SSL_rstate_string 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH SSL_rstate_string 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libssl/man/SSL_session_reused.3 +=================================================================== +--- secure/lib/libssl/man/SSL_session_reused.3 (revision 273303) ++++ secure/lib/libssl/man/SSL_session_reused.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "SSL_session_reused 3" +-.TH SSL_session_reused 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH SSL_session_reused 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libssl/man/SSL_set_bio.3 +=================================================================== +--- secure/lib/libssl/man/SSL_set_bio.3 (revision 273303) ++++ secure/lib/libssl/man/SSL_set_bio.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "SSL_set_bio 3" +-.TH SSL_set_bio 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH SSL_set_bio 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libssl/man/SSL_set_connect_state.3 +=================================================================== +--- secure/lib/libssl/man/SSL_set_connect_state.3 (revision 273303) ++++ secure/lib/libssl/man/SSL_set_connect_state.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "SSL_set_connect_state 3" +-.TH SSL_set_connect_state 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH SSL_set_connect_state 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libssl/man/SSL_set_fd.3 +=================================================================== +--- secure/lib/libssl/man/SSL_set_fd.3 (revision 273303) ++++ secure/lib/libssl/man/SSL_set_fd.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "SSL_set_fd 3" +-.TH SSL_set_fd 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH SSL_set_fd 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libssl/man/SSL_set_session.3 +=================================================================== +--- secure/lib/libssl/man/SSL_set_session.3 (revision 273303) ++++ secure/lib/libssl/man/SSL_set_session.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "SSL_set_session 3" +-.TH SSL_set_session 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH SSL_set_session 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libssl/man/SSL_set_shutdown.3 +=================================================================== +--- secure/lib/libssl/man/SSL_set_shutdown.3 (revision 273303) ++++ secure/lib/libssl/man/SSL_set_shutdown.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "SSL_set_shutdown 3" +-.TH SSL_set_shutdown 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH SSL_set_shutdown 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libssl/man/SSL_set_verify_result.3 +=================================================================== +--- secure/lib/libssl/man/SSL_set_verify_result.3 (revision 273303) ++++ secure/lib/libssl/man/SSL_set_verify_result.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "SSL_set_verify_result 3" +-.TH SSL_set_verify_result 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH SSL_set_verify_result 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libssl/man/SSL_shutdown.3 +=================================================================== +--- secure/lib/libssl/man/SSL_shutdown.3 (revision 273303) ++++ secure/lib/libssl/man/SSL_shutdown.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "SSL_shutdown 3" +-.TH SSL_shutdown 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH SSL_shutdown 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libssl/man/SSL_state_string.3 +=================================================================== +--- secure/lib/libssl/man/SSL_state_string.3 (revision 273303) ++++ secure/lib/libssl/man/SSL_state_string.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "SSL_state_string 3" +-.TH SSL_state_string 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH SSL_state_string 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libssl/man/SSL_want.3 +=================================================================== +--- secure/lib/libssl/man/SSL_want.3 (revision 273303) ++++ secure/lib/libssl/man/SSL_want.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "SSL_want 3" +-.TH SSL_want 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH SSL_want 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libssl/man/SSL_write.3 +=================================================================== +--- secure/lib/libssl/man/SSL_write.3 (revision 273303) ++++ secure/lib/libssl/man/SSL_write.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "SSL_write 3" +-.TH SSL_write 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH SSL_write 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libssl/man/d2i_SSL_SESSION.3 +=================================================================== +--- secure/lib/libssl/man/d2i_SSL_SESSION.3 (revision 273303) ++++ secure/lib/libssl/man/d2i_SSL_SESSION.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "d2i_SSL_SESSION 3" +-.TH d2i_SSL_SESSION 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH d2i_SSL_SESSION 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/lib/libssl/man/ssl.3 +=================================================================== +--- secure/lib/libssl/man/ssl.3 (revision 273303) ++++ secure/lib/libssl/man/ssl.3 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "ssl 3" +-.TH ssl 3 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH ssl 3 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/usr.bin/openssl/Makefile.man +=================================================================== +--- secure/usr.bin/openssl/Makefile.man (revision 273303) ++++ secure/usr.bin/openssl/Makefile.man (working copy) +@@ -2,6 +2,7 @@ + # DO NOT EDIT: generated from man-makefile-update target + MAN+= CA.pl.1 + MAN+= asn1parse.1 ++MAN+= c_rehash.1 + MAN+= ca.1 + MAN+= ciphers.1 + MAN+= cms.1 +@@ -45,10 +46,15 @@ MAN+= verify.1 + MAN+= version.1 + MAN+= x509.1 + MAN+= x509v3_config.1 +-MLINKS+= dgst.1 md5.1 +-MLINKS+= dgst.1 md4.1 +-MLINKS+= dgst.1 md2.1 ++MLINKS+= dgst.1 sha.1 + MLINKS+= dgst.1 sha1.1 +-MLINKS+= dgst.1 sha.1 + MLINKS+= dgst.1 mdc2.1 + MLINKS+= dgst.1 ripemd160.1 ++MLINKS+= dgst.1 sha224.1 ++MLINKS+= dgst.1 sha256.1 ++MLINKS+= dgst.1 sha384.1 ++MLINKS+= dgst.1 sha512.1 ++MLINKS+= dgst.1 md2.1 ++MLINKS+= dgst.1 md4.1 ++MLINKS+= dgst.1 md5.1 ++MLINKS+= dgst.1 dss1.1 +Index: secure/usr.bin/openssl/man/CA.pl.1 +=================================================================== +--- secure/usr.bin/openssl/man/CA.pl.1 (revision 273303) ++++ secure/usr.bin/openssl/man/CA.pl.1 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "CA.PL 1" +-.TH CA.PL 1 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH CA.PL 1 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/usr.bin/openssl/man/asn1parse.1 +=================================================================== +--- secure/usr.bin/openssl/man/asn1parse.1 (revision 273303) ++++ secure/usr.bin/openssl/man/asn1parse.1 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "ASN1PARSE 1" +-.TH ASN1PARSE 1 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH ASN1PARSE 1 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/usr.bin/openssl/man/c_rehash.1 +=================================================================== +--- secure/usr.bin/openssl/man/c_rehash.1 (revision 0) ++++ secure/usr.bin/openssl/man/c_rehash.1 (working copy) +@@ -0,0 +1,199 @@ ++.\" Automatically generated by Pod::Man 2.25 (Pod::Simple 3.28) ++.\" ++.\" Standard preamble: ++.\" ======================================================================== ++.de Sp \" Vertical space (when we can't use .PP) ++.if t .sp .5v ++.if n .sp ++.. ++.de Vb \" Begin verbatim text ++.ft CW ++.nf ++.ne \\$1 ++.. ++.de Ve \" End verbatim text ++.ft R ++.fi ++.. ++.\" Set up some character translations and predefined strings. \*(-- will ++.\" give an unbreakable dash, \*(PI will give pi, \*(L" will give a left ++.\" double quote, and \*(R" will give a right double quote. \*(C+ will ++.\" give a nicer C++. Capital omega is used to do unbreakable dashes and ++.\" therefore won't be available. \*(C` and \*(C' expand to `' in nroff, ++.\" nothing in troff, for use with C<>. ++.tr \(*W- ++.ds C+ C\v'-.1v'\h'-1p'\s-2+\h'-1p'+\s0\v'.1v'\h'-1p' ++.ie n \{\ ++. ds -- \(*W- ++. ds PI pi ++. if (\n(.H=4u)&(1m=24u) .ds -- \(*W\h'-12u'\(*W\h'-12u'-\" diablo 10 pitch ++. if (\n(.H=4u)&(1m=20u) .ds -- \(*W\h'-12u'\(*W\h'-8u'-\" diablo 12 pitch ++. ds L" "" ++. ds R" "" ++. ds C` "" ++. ds C' "" ++'br\} ++.el\{\ ++. ds -- \|\(em\| ++. ds PI \(*p ++. ds L" `` ++. ds R" '' ++'br\} ++.\" ++.\" Escape single quotes in literal strings from groff's Unicode transform. ++.ie \n(.g .ds Aq \(aq ++.el .ds Aq ' ++.\" ++.\" If the F register is turned on, we'll generate index entries on stderr for ++.\" titles (.TH), headers (.SH), subsections (.SS), items (.Ip), and index ++.\" entries marked with X<> in POD. Of course, you'll have to process the ++.\" output yourself in some meaningful fashion. ++.ie \nF \{\ ++. de IX ++. tm Index:\\$1\t\\n%\t"\\$2" ++.. ++. nr % 0 ++. rr F ++.\} ++.el \{\ ++. de IX ++.. ++.\} ++.\" ++.\" Accent mark definitions (@(#)ms.acc 1.5 88/02/08 SMI; from UCB 4.2). ++.\" Fear. Run. Save yourself. No user-serviceable parts. ++. \" fudge factors for nroff and troff ++.if n \{\ ++. ds #H 0 ++. ds #V .8m ++. ds #F .3m ++. ds #[ \f1 ++. ds #] \fP ++.\} ++.if t \{\ ++. ds #H ((1u-(\\\\n(.fu%2u))*.13m) ++. ds #V .6m ++. ds #F 0 ++. ds #[ \& ++. ds #] \& ++.\} ++. \" simple accents for nroff and troff ++.if n \{\ ++. ds ' \& ++. ds ` \& ++. ds ^ \& ++. ds , \& ++. ds ~ ~ ++. ds / ++.\} ++.if t \{\ ++. ds ' \\k:\h'-(\\n(.wu*8/10-\*(#H)'\'\h"|\\n:u" ++. ds ` \\k:\h'-(\\n(.wu*8/10-\*(#H)'\`\h'|\\n:u' ++. ds ^ \\k:\h'-(\\n(.wu*10/11-\*(#H)'^\h'|\\n:u' ++. ds , \\k:\h'-(\\n(.wu*8/10)',\h'|\\n:u' ++. ds ~ \\k:\h'-(\\n(.wu-\*(#H-.1m)'~\h'|\\n:u' ++. ds / \\k:\h'-(\\n(.wu*8/10-\*(#H)'\z\(sl\h'|\\n:u' ++.\} ++. \" troff and (daisy-wheel) nroff accents ++.ds : \\k:\h'-(\\n(.wu*8/10-\*(#H+.1m+\*(#F)'\v'-\*(#V'\z.\h'.2m+\*(#F'.\h'|\\n:u'\v'\*(#V' ++.ds 8 \h'\*(#H'\(*b\h'-\*(#H' ++.ds o \\k:\h'-(\\n(.wu+\w'\(de'u-\*(#H)/2u'\v'-.3n'\*(#[\z\(de\v'.3n'\h'|\\n:u'\*(#] ++.ds d- \h'\*(#H'\(pd\h'-\w'~'u'\v'-.25m'\f2\(hy\fP\v'.25m'\h'-\*(#H' ++.ds D- D\\k:\h'-\w'D'u'\v'-.11m'\z\(hy\v'.11m'\h'|\\n:u' ++.ds th \*(#[\v'.3m'\s+1I\s-1\v'-.3m'\h'-(\w'I'u*2/3)'\s-1o\s+1\*(#] ++.ds Th \*(#[\s+2I\s-2\h'-\w'I'u*3/5'\v'-.3m'o\v'.3m'\*(#] ++.ds ae a\h'-(\w'a'u*4/10)'e ++.ds Ae A\h'-(\w'A'u*4/10)'E ++. \" corrections for vroff ++.if v .ds ~ \\k:\h'-(\\n(.wu*9/10-\*(#H)'\s-2\u~\d\s+2\h'|\\n:u' ++.if v .ds ^ \\k:\h'-(\\n(.wu*10/11-\*(#H)'\v'-.4m'^\v'.4m'\h'|\\n:u' ++. \" for low resolution devices (crt and lpr) ++.if \n(.H>23 .if \n(.V>19 \ ++\{\ ++. ds : e ++. ds 8 ss ++. ds o a ++. ds d- d\h'-1'\(ga ++. ds D- D\h'-1'\(hy ++. ds th \o'bp' ++. ds Th \o'LP' ++. ds ae ae ++. ds Ae AE ++.\} ++.rm #[ #] #H #V #F C ++.\" ======================================================================== ++.\" ++.IX Title "C_REHASH 1" ++.TH C_REHASH 1 "2014-10-15" "1.0.1j" "OpenSSL" ++.\" For nroff, turn off justification. Always turn off hyphenation; it makes ++.\" way too many mistakes in technical documents. ++.if n .ad l ++.nh ++.SH "NAME" ++c_rehash \- Create symbolic links to files named by the hash values ++.SH "SYNOPSIS" ++.IX Header "SYNOPSIS" ++\&\fBc_rehash\fR ++[ \fIdirectory\fR...] ++.SH "DESCRIPTION" ++.IX Header "DESCRIPTION" ++\&\fBc_rehash\fR scans directories and calculates a hash value of each \f(CW\*(C`.pem\*(C'\fR ++file in the specified directory list and creates symbolic links ++for each file, where the name of the link is the hash value. ++This utility is useful as many programs that use OpenSSL require ++directories to be set up like this in order to find certificates. ++.PP ++If any directories are named on the command line, then those are ++processed in turn. If not, then the \fB\s-1SSL_CERT_DIR\s0\fR environment variable ++is consulted; this shold be a colon-separated list of directories, ++like the Unix \fB\s-1PATH\s0\fR variable. ++If that is not set then the default directory (installation-specific ++but often \fB/usr/local/ssl/certs\fR) is processed. ++.PP ++In order for a directory to be processed, the user must have write ++permissions on that directory, otherwise it will be skipped. ++The links created are of the form \f(CW\*(C`HHHHHHHH.D\*(C'\fR, where each \fBH\fR ++is a hexadecimal character and \fBD\fR is a single decimal digit. ++When processing a directory, \fBc_rehash\fR will first remove all links ++that have a name in that syntax. If you have links in that format ++used for other purposes, they will be removed. ++Hashes for \s-1CRL\s0's look similar except the letter \fBr\fR appears after ++the period, like this: \f(CW\*(C`HHHHHHHH.rD\*(C'\fR. ++.PP ++Multiple objects may have the same hash; they will be indicated by ++incrementing the \fBD\fR value. Duplicates are found by comparing the ++full \s-1SHA\-1\s0 fingerprint. A warning will be displayed if a duplicate ++is found. ++.PP ++A warning will also be displayed if there are \fB.pem\fR files that ++cannot be parsed as either a certificate or a \s-1CRL\s0. ++.PP ++The program uses the \fBopenssl\fR program to compute the hashes and ++fingerprints. If not found in the user's \fB\s-1PATH\s0\fR, then set the ++\&\fB\s-1OPENSSL\s0\fR environment variable to the full pathname. ++Any program can be used, it will be invoked as follows for either ++a certificate or \s-1CRL:\s0 ++.PP ++.Vb 2 ++\& $OPENSSL x509 \-hash \-fingerprint \-noout \-in FFFFFF ++\& $OPENSSL crl \-hash \-fingerprint \-noout \-in FFFFFF ++.Ve ++.PP ++where \fB\s-1FFFFFF\s0\fR is the filename. It must output the hash of the ++file on the first line, and the fingerprint on the second, ++optionally prefixed with some text and an equals sign. ++.SH "ENVIRONMENT" ++.IX Header "ENVIRONMENT" ++.IP "\fB\s-1OPENSSL\s0\fR" 4 ++.IX Item "OPENSSL" ++The path to an executable to use to generate hashes and ++fingerprints (see above). ++.IP "\fB\s-1SSL_CERT_DIR\s0\fR" 4 ++.IX Item "SSL_CERT_DIR" ++Colon separated list of directories to operate on. ++Ignored if directories are listed on the command line. ++.SH "SEE ALSO" ++.IX Header "SEE ALSO" ++\&\fIopenssl\fR\|(1), ++\&\fIcrl\fR\|(1). ++\&\fIx509\fR\|(1). + +Property changes on: secure/usr.bin/openssl/man/c_rehash.1 +___________________________________________________________________ +Added: svn:keywords +## -0,0 +1 ## ++FreeBSD=%H +\ No newline at end of property +Added: svn:eol-style +## -0,0 +1 ## ++native +\ No newline at end of property +Added: svn:mime-type +## -0,0 +1 ## ++text/plain +\ No newline at end of property +Index: secure/usr.bin/openssl/man/ca.1 +=================================================================== +--- secure/usr.bin/openssl/man/ca.1 (revision 273303) ++++ secure/usr.bin/openssl/man/ca.1 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "CA 1" +-.TH CA 1 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH CA 1 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/usr.bin/openssl/man/ciphers.1 +=================================================================== +--- secure/usr.bin/openssl/man/ciphers.1 (revision 273303) ++++ secure/usr.bin/openssl/man/ciphers.1 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "CIPHERS 1" +-.TH CIPHERS 1 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH CIPHERS 1 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/usr.bin/openssl/man/cms.1 +=================================================================== +--- secure/usr.bin/openssl/man/cms.1 (revision 273303) ++++ secure/usr.bin/openssl/man/cms.1 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "CMS 1" +-.TH CMS 1 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH CMS 1 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/usr.bin/openssl/man/crl.1 +=================================================================== +--- secure/usr.bin/openssl/man/crl.1 (revision 273303) ++++ secure/usr.bin/openssl/man/crl.1 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "CRL 1" +-.TH CRL 1 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH CRL 1 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/usr.bin/openssl/man/crl2pkcs7.1 +=================================================================== +--- secure/usr.bin/openssl/man/crl2pkcs7.1 (revision 273303) ++++ secure/usr.bin/openssl/man/crl2pkcs7.1 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "CRL2PKCS7 1" +-.TH CRL2PKCS7 1 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH CRL2PKCS7 1 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/usr.bin/openssl/man/dgst.1 +=================================================================== +--- secure/usr.bin/openssl/man/dgst.1 (revision 273303) ++++ secure/usr.bin/openssl/man/dgst.1 (working copy) +@@ -124,21 +124,22 @@ + .\" ======================================================================== + .\" + .IX Title "DGST 1" +-.TH DGST 1 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH DGST 1 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l + .nh + .SH "NAME" +-dgst, md5, md4, md2, sha1, sha, mdc2, ripemd160 \- message digests ++dgst, sha, sha1, mdc2, ripemd160, sha224, sha256, sha384, sha512, md2, md4, md5, dss1 \- message digests + .SH "SYNOPSIS" + .IX Header "SYNOPSIS" + \&\fBopenssl\fR \fBdgst\fR +-[\fB\-md5|\-md4|\-md2|\-sha1|\-sha|\-mdc2|\-ripemd160|\-dss1\fR] ++[\fB\-sha|\-sha1|\-mdc2|\-ripemd160|\-sha224|\-sha256|\-sha384|\-sha512|\-md2|\-md4|\-md5|\-dss1\fR] + [\fB\-c\fR] + [\fB\-d\fR] + [\fB\-hex\fR] + [\fB\-binary\fR] ++[\fB\-r\fR] + [\fB\-out filename\fR] + [\fB\-sign filename\fR] + [\fB\-keyform arg\fR] +@@ -147,16 +148,18 @@ + [\fB\-prverify filename\fR] + [\fB\-signature filename\fR] + [\fB\-hmac key\fR] ++[\fB\-non\-fips\-allow\fR] ++[\fB\-fips\-fingerprint\fR] + [\fBfile...\fR] + .PP +-[\fBmd5|md4|md2|sha1|sha|mdc2|ripemd160\fR] +-[\fB\-c\fR] +-[\fB\-d\fR] +-[\fBfile...\fR] ++\&\fBopenssl\fR ++[\fIdigest\fR] ++[\fB...\fR] + .SH "DESCRIPTION" + .IX Header "DESCRIPTION" + The digest functions output the message digest of a supplied file or files +-in hexadecimal form. They can also be used for digital signing and verification. ++in hexadecimal. The digest functions also generate and verify digital ++signatures using message digests. + .SH "OPTIONS" + .IX Header "OPTIONS" + .IP "\fB\-c\fR" 4 +@@ -169,10 +172,14 @@ print out \s-1BIO\s0 debugging information. + .IP "\fB\-hex\fR" 4 + .IX Item "-hex" + digest is to be output as a hex dump. This is the default case for a \*(L"normal\*(R" +-digest as opposed to a digital signature. ++digest as opposed to a digital signature. See \s-1NOTES\s0 below for digital ++signatures using \fB\-hex\fR. + .IP "\fB\-binary\fR" 4 + .IX Item "-binary" + output the digest or signature in binary form. ++.IP "\fB\-r\fR" 4 ++.IX Item "-r" ++output the digest in the \*(L"coreutils\*(R" format used by programs like \fBsha1sum\fR. + .IP "\fB\-out filename\fR" 4 + .IX Item "-out filename" + filename to output to, or standard output by default. +@@ -181,8 +188,8 @@ filename to output to, or standard output by defau + digitally sign the digest using the private key in \*(L"filename\*(R". + .IP "\fB\-keyform arg\fR" 4 + .IX Item "-keyform arg" +-Specifies the key format to sign digest with. Only \s-1PEM\s0 and \s-1ENGINE\s0 +-formats are supported by the \fBdgst\fR command. ++Specifies the key format to sign digest with. The \s-1DER\s0, \s-1PEM\s0, P12, ++and \s-1ENGINE\s0 formats are supported. + .IP "\fB\-engine id\fR" 4 + .IX Item "-engine id" + Use engine \fBid\fR for operations (including private key storage). +@@ -241,20 +248,46 @@ generator, or an \s-1EGD\s0 socket (see \fIRAND_eg + Multiple files can be specified separated by a OS-dependent character. + The separator is \fB;\fR for MS-Windows, \fB,\fR for OpenVMS, and \fB:\fR for + all others. ++.IP "\fB\-non\-fips\-allow\fR" 4 ++.IX Item "-non-fips-allow" ++enable use of non-FIPS algorithms such as \s-1MD5\s0 even in \s-1FIPS\s0 mode. ++.IP "\fB\-fips\-fingerprint\fR" 4 ++.IX Item "-fips-fingerprint" ++compute \s-1HMAC\s0 using a specific key ++for certain OpenSSL-FIPS operations. + .IP "\fBfile...\fR" 4 + .IX Item "file..." + file or files to digest. If no files are specified then standard input is + used. ++.SH "EXAMPLES" ++.IX Header "EXAMPLES" ++To create a hex-encoded message digest of a file: ++ openssl dgst \-md5 \-hex file.txt ++.PP ++To sign a file using \s-1SHA\-256\s0 with binary file output: ++ openssl dgst \-sha256 \-sign privatekey.pem \-out signature.sign file.txt ++.PP ++To verify a signature: ++ openssl dgst \-sha256 \-verify publickey.pem \e ++ \-signature signature.sign \e ++ file.txt + .SH "NOTES" + .IX Header "NOTES" + The digest of choice for all new applications is \s-1SHA1\s0. Other digests are + however still widely used. + .PP +-If you wish to sign or verify data using the \s-1DSA\s0 algorithm then the dss1 +-digest must be used. ++When signing a file, \fBdgst\fR will automatically determine the algorithm ++(\s-1RSA\s0, \s-1ECC\s0, etc) to use for signing based on the private key's \s-1ASN\s0.1 info. ++When verifying signatures, it only handles the \s-1RSA\s0, \s-1DSA\s0, or \s-1ECDSA\s0 signature ++itself, not the related data to identify the signer and algorithm used in ++formats such as x.509, \s-1CMS\s0, and S/MIME. + .PP + A source of random numbers is required for certain signing algorithms, in +-particular \s-1DSA\s0. ++particular \s-1ECDSA\s0 and \s-1DSA\s0. + .PP + The signing and verify options should only be used if a single file is + being signed or verified. ++.PP ++Hex signatures cannot be verified using \fBopenssl\fR. Instead, use \*(L"xxd \-r\*(R" ++or similar program to transform the hex signature into a binary signature ++prior to verification. +Index: secure/usr.bin/openssl/man/dhparam.1 +=================================================================== +--- secure/usr.bin/openssl/man/dhparam.1 (revision 273303) ++++ secure/usr.bin/openssl/man/dhparam.1 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "DHPARAM 1" +-.TH DHPARAM 1 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH DHPARAM 1 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/usr.bin/openssl/man/dsa.1 +=================================================================== +--- secure/usr.bin/openssl/man/dsa.1 (revision 273303) ++++ secure/usr.bin/openssl/man/dsa.1 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "DSA 1" +-.TH DSA 1 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH DSA 1 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/usr.bin/openssl/man/dsaparam.1 +=================================================================== +--- secure/usr.bin/openssl/man/dsaparam.1 (revision 273303) ++++ secure/usr.bin/openssl/man/dsaparam.1 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "DSAPARAM 1" +-.TH DSAPARAM 1 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH DSAPARAM 1 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/usr.bin/openssl/man/ec.1 +=================================================================== +--- secure/usr.bin/openssl/man/ec.1 (revision 273303) ++++ secure/usr.bin/openssl/man/ec.1 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "EC 1" +-.TH EC 1 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH EC 1 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/usr.bin/openssl/man/ecparam.1 +=================================================================== +--- secure/usr.bin/openssl/man/ecparam.1 (revision 273303) ++++ secure/usr.bin/openssl/man/ecparam.1 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "ECPARAM 1" +-.TH ECPARAM 1 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH ECPARAM 1 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/usr.bin/openssl/man/enc.1 +=================================================================== +--- secure/usr.bin/openssl/man/enc.1 (revision 273303) ++++ secure/usr.bin/openssl/man/enc.1 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "ENC 1" +-.TH ENC 1 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH ENC 1 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/usr.bin/openssl/man/errstr.1 +=================================================================== +--- secure/usr.bin/openssl/man/errstr.1 (revision 273303) ++++ secure/usr.bin/openssl/man/errstr.1 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "ERRSTR 1" +-.TH ERRSTR 1 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH ERRSTR 1 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/usr.bin/openssl/man/gendsa.1 +=================================================================== +--- secure/usr.bin/openssl/man/gendsa.1 (revision 273303) ++++ secure/usr.bin/openssl/man/gendsa.1 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "GENDSA 1" +-.TH GENDSA 1 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH GENDSA 1 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/usr.bin/openssl/man/genpkey.1 +=================================================================== +--- secure/usr.bin/openssl/man/genpkey.1 (revision 273303) ++++ secure/usr.bin/openssl/man/genpkey.1 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "GENPKEY 1" +-.TH GENPKEY 1 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH GENPKEY 1 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/usr.bin/openssl/man/genrsa.1 +=================================================================== +--- secure/usr.bin/openssl/man/genrsa.1 (revision 273303) ++++ secure/usr.bin/openssl/man/genrsa.1 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "GENRSA 1" +-.TH GENRSA 1 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH GENRSA 1 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/usr.bin/openssl/man/nseq.1 +=================================================================== +--- secure/usr.bin/openssl/man/nseq.1 (revision 273303) ++++ secure/usr.bin/openssl/man/nseq.1 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "NSEQ 1" +-.TH NSEQ 1 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH NSEQ 1 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/usr.bin/openssl/man/ocsp.1 +=================================================================== +--- secure/usr.bin/openssl/man/ocsp.1 (revision 273303) ++++ secure/usr.bin/openssl/man/ocsp.1 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "OCSP 1" +-.TH OCSP 1 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH OCSP 1 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/usr.bin/openssl/man/openssl.1 +=================================================================== +--- secure/usr.bin/openssl/man/openssl.1 (revision 273303) ++++ secure/usr.bin/openssl/man/openssl.1 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "OPENSSL 1" +-.TH OPENSSL 1 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH OPENSSL 1 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/usr.bin/openssl/man/passwd.1 +=================================================================== +--- secure/usr.bin/openssl/man/passwd.1 (revision 273303) ++++ secure/usr.bin/openssl/man/passwd.1 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "PASSWD 1" +-.TH PASSWD 1 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH PASSWD 1 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/usr.bin/openssl/man/pkcs12.1 +=================================================================== +--- secure/usr.bin/openssl/man/pkcs12.1 (revision 273303) ++++ secure/usr.bin/openssl/man/pkcs12.1 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "PKCS12 1" +-.TH PKCS12 1 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH PKCS12 1 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/usr.bin/openssl/man/pkcs7.1 +=================================================================== +--- secure/usr.bin/openssl/man/pkcs7.1 (revision 273303) ++++ secure/usr.bin/openssl/man/pkcs7.1 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "PKCS7 1" +-.TH PKCS7 1 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH PKCS7 1 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/usr.bin/openssl/man/pkcs8.1 +=================================================================== +--- secure/usr.bin/openssl/man/pkcs8.1 (revision 273303) ++++ secure/usr.bin/openssl/man/pkcs8.1 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "PKCS8 1" +-.TH PKCS8 1 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH PKCS8 1 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/usr.bin/openssl/man/pkey.1 +=================================================================== +--- secure/usr.bin/openssl/man/pkey.1 (revision 273303) ++++ secure/usr.bin/openssl/man/pkey.1 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "PKEY 1" +-.TH PKEY 1 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH PKEY 1 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/usr.bin/openssl/man/pkeyparam.1 +=================================================================== +--- secure/usr.bin/openssl/man/pkeyparam.1 (revision 273303) ++++ secure/usr.bin/openssl/man/pkeyparam.1 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "PKEYPARAM 1" +-.TH PKEYPARAM 1 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH PKEYPARAM 1 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/usr.bin/openssl/man/pkeyutl.1 +=================================================================== +--- secure/usr.bin/openssl/man/pkeyutl.1 (revision 273303) ++++ secure/usr.bin/openssl/man/pkeyutl.1 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "PKEYUTL 1" +-.TH PKEYUTL 1 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH PKEYUTL 1 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/usr.bin/openssl/man/rand.1 +=================================================================== +--- secure/usr.bin/openssl/man/rand.1 (revision 273303) ++++ secure/usr.bin/openssl/man/rand.1 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "RAND 1" +-.TH RAND 1 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH RAND 1 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/usr.bin/openssl/man/req.1 +=================================================================== +--- secure/usr.bin/openssl/man/req.1 (revision 273303) ++++ secure/usr.bin/openssl/man/req.1 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "REQ 1" +-.TH REQ 1 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH REQ 1 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/usr.bin/openssl/man/rsa.1 +=================================================================== +--- secure/usr.bin/openssl/man/rsa.1 (revision 273303) ++++ secure/usr.bin/openssl/man/rsa.1 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "RSA 1" +-.TH RSA 1 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH RSA 1 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/usr.bin/openssl/man/rsautl.1 +=================================================================== +--- secure/usr.bin/openssl/man/rsautl.1 (revision 273303) ++++ secure/usr.bin/openssl/man/rsautl.1 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "RSAUTL 1" +-.TH RSAUTL 1 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH RSAUTL 1 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/usr.bin/openssl/man/s_client.1 +=================================================================== +--- secure/usr.bin/openssl/man/s_client.1 (revision 273303) ++++ secure/usr.bin/openssl/man/s_client.1 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "S_CLIENT 1" +-.TH S_CLIENT 1 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH S_CLIENT 1 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/usr.bin/openssl/man/s_server.1 +=================================================================== +--- secure/usr.bin/openssl/man/s_server.1 (revision 273303) ++++ secure/usr.bin/openssl/man/s_server.1 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "S_SERVER 1" +-.TH S_SERVER 1 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH S_SERVER 1 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/usr.bin/openssl/man/s_time.1 +=================================================================== +--- secure/usr.bin/openssl/man/s_time.1 (revision 273303) ++++ secure/usr.bin/openssl/man/s_time.1 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "S_TIME 1" +-.TH S_TIME 1 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH S_TIME 1 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/usr.bin/openssl/man/sess_id.1 +=================================================================== +--- secure/usr.bin/openssl/man/sess_id.1 (revision 273303) ++++ secure/usr.bin/openssl/man/sess_id.1 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "SESS_ID 1" +-.TH SESS_ID 1 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH SESS_ID 1 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/usr.bin/openssl/man/smime.1 +=================================================================== +--- secure/usr.bin/openssl/man/smime.1 (revision 273303) ++++ secure/usr.bin/openssl/man/smime.1 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "SMIME 1" +-.TH SMIME 1 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH SMIME 1 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/usr.bin/openssl/man/speed.1 +=================================================================== +--- secure/usr.bin/openssl/man/speed.1 (revision 273303) ++++ secure/usr.bin/openssl/man/speed.1 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "SPEED 1" +-.TH SPEED 1 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH SPEED 1 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/usr.bin/openssl/man/spkac.1 +=================================================================== +--- secure/usr.bin/openssl/man/spkac.1 (revision 273303) ++++ secure/usr.bin/openssl/man/spkac.1 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "SPKAC 1" +-.TH SPKAC 1 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH SPKAC 1 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/usr.bin/openssl/man/ts.1 +=================================================================== +--- secure/usr.bin/openssl/man/ts.1 (revision 273303) ++++ secure/usr.bin/openssl/man/ts.1 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "TS 1" +-.TH TS 1 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH TS 1 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/usr.bin/openssl/man/tsget.1 +=================================================================== +--- secure/usr.bin/openssl/man/tsget.1 (revision 273303) ++++ secure/usr.bin/openssl/man/tsget.1 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "TSGET 1" +-.TH TSGET 1 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH TSGET 1 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/usr.bin/openssl/man/verify.1 +=================================================================== +--- secure/usr.bin/openssl/man/verify.1 (revision 273303) ++++ secure/usr.bin/openssl/man/verify.1 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "VERIFY 1" +-.TH VERIFY 1 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH VERIFY 1 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/usr.bin/openssl/man/version.1 +=================================================================== +--- secure/usr.bin/openssl/man/version.1 (revision 273303) ++++ secure/usr.bin/openssl/man/version.1 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "VERSION 1" +-.TH VERSION 1 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH VERSION 1 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/usr.bin/openssl/man/x509.1 +=================================================================== +--- secure/usr.bin/openssl/man/x509.1 (revision 273303) ++++ secure/usr.bin/openssl/man/x509.1 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "X509 1" +-.TH X509 1 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH X509 1 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l +Index: secure/usr.bin/openssl/man/x509v3_config.1 +=================================================================== +--- secure/usr.bin/openssl/man/x509v3_config.1 (revision 273303) ++++ secure/usr.bin/openssl/man/x509v3_config.1 (working copy) +@@ -124,7 +124,7 @@ + .\" ======================================================================== + .\" + .IX Title "X509V3_CONFIG 1" +-.TH X509V3_CONFIG 1 "2014-08-06" "1.0.1i" "OpenSSL" ++.TH X509V3_CONFIG 1 "2014-10-15" "1.0.1j" "OpenSSL" + .\" For nroff, turn off justification. Always turn off hyphenation; it makes + .\" way too many mistakes in technical documents. + .if n .ad l Index: user/cperciva/freebsd-update-build/patches/10.1-RC2/2-EN-14:11.crypt =================================================================== --- user/cperciva/freebsd-update-build/patches/10.1-RC2/2-EN-14:11.crypt (nonexistent) +++ user/cperciva/freebsd-update-build/patches/10.1-RC2/2-EN-14:11.crypt (revision 293366) @@ -0,0 +1,49 @@ +Index: lib/libcrypt/crypt.c +=================================================================== +--- lib/libcrypt/crypt.c (revision 273303) ++++ lib/libcrypt/crypt.c (working copy) +@@ -37,8 +37,13 @@ __FBSDID("$FreeBSD$"); + #include "crypt.h" + + /* +- * List of supported crypt(3) formats. The first element in the list will +- * be the default. ++ * List of supported crypt(3) formats. ++ * ++ * The default algorithm is the last entry in the list (second-to-last ++ * array element since the last is a sentinel). The reason for placing ++ * the default last rather than first is that DES needs to be at the ++ * bottom for the algorithm guessing logic in crypt(3) to work correctly, ++ * and it needs to be the default for backward compatibility. + */ + static const struct crypt_format { + const char *const name; +@@ -45,10 +50,6 @@ static const struct crypt_format { + char *(*const func)(const char *, const char *); + const char *const magic; + } crypt_formats[] = { +- /* default format */ +- { "sha512", crypt_sha512, "$6$" }, +- +- /* other supported formats */ + { "md5", crypt_md5, "$1$" }, + #ifdef HAS_BLOWFISH + { "blf", crypt_blowfish, "$2" }, +@@ -55,6 +56,7 @@ static const struct crypt_format { + #endif + { "nth", crypt_nthash, "$3$" }, + { "sha256", crypt_sha256, "$5$" }, ++ { "sha512", crypt_sha512, "$6$" }, + #ifdef HAS_DES + { "des", crypt_des, "_" }, + #endif +@@ -63,7 +65,8 @@ static const struct crypt_format { + { NULL, NULL, NULL } + }; + +-static const struct crypt_format *crypt_format = &crypt_formats[0]; ++static const struct crypt_format *crypt_format = ++ &crypt_formats[(sizeof crypt_formats / sizeof *crypt_formats) - 2]; + + #define DES_SALT_ALPHABET \ + "./0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz" Index: user/cperciva/freebsd-update-build/patches/10.1-RC2/3-SA-14:25.setlogin =================================================================== --- user/cperciva/freebsd-update-build/patches/10.1-RC2/3-SA-14:25.setlogin (nonexistent) +++ user/cperciva/freebsd-update-build/patches/10.1-RC2/3-SA-14:25.setlogin (revision 293366) @@ -0,0 +1,64 @@ +Index: sys/kern/kern_prot.c +=================================================================== +--- sys/kern/kern_prot.c.orig ++++ sys/kern/kern_prot.c +@@ -2066,21 +2066,20 @@ + int + sys_getlogin(struct thread *td, struct getlogin_args *uap) + { +- int error; + char login[MAXLOGNAME]; + struct proc *p = td->td_proc; ++ size_t len; + + if (uap->namelen > MAXLOGNAME) + uap->namelen = MAXLOGNAME; + PROC_LOCK(p); + SESS_LOCK(p->p_session); +- bcopy(p->p_session->s_login, login, uap->namelen); ++ len = strlcpy(login, p->p_session->s_login, uap->namelen) + 1; + SESS_UNLOCK(p->p_session); + PROC_UNLOCK(p); +- if (strlen(login) + 1 > uap->namelen) ++ if (len > uap->namelen) + return (ERANGE); +- error = copyout(login, uap->namebuf, uap->namelen); +- return (error); ++ return (copyout(login, uap->namebuf, len)); + } + + /* +@@ -2099,21 +2098,23 @@ + int error; + char logintmp[MAXLOGNAME]; + ++ CTASSERT(sizeof(p->p_session->s_login) >= sizeof(logintmp)); ++ + error = priv_check(td, PRIV_PROC_SETLOGIN); + if (error) + return (error); + error = copyinstr(uap->namebuf, logintmp, sizeof(logintmp), NULL); +- if (error == ENAMETOOLONG) +- error = EINVAL; +- else if (!error) { +- PROC_LOCK(p); +- SESS_LOCK(p->p_session); +- (void) memcpy(p->p_session->s_login, logintmp, +- sizeof(logintmp)); +- SESS_UNLOCK(p->p_session); +- PROC_UNLOCK(p); ++ if (error != 0) { ++ if (error == ENAMETOOLONG) ++ error = EINVAL; ++ return (error); + } +- return (error); ++ PROC_LOCK(p); ++ SESS_LOCK(p->p_session); ++ strcpy(p->p_session->s_login, logintmp); ++ SESS_UNLOCK(p->p_session); ++ PROC_UNLOCK(p); ++ return (0); + } + + void Index: user/cperciva/freebsd-update-build/patches/10.1-RC2/3-SA-14:26.ftp =================================================================== --- user/cperciva/freebsd-update-build/patches/10.1-RC2/3-SA-14:26.ftp (nonexistent) +++ user/cperciva/freebsd-update-build/patches/10.1-RC2/3-SA-14:26.ftp (revision 293366) @@ -0,0 +1,69 @@ +Index: contrib/tnftp/src/fetch.c +=================================================================== +--- contrib/tnftp/src/fetch.c.orig ++++ contrib/tnftp/src/fetch.c +@@ -547,7 +547,7 @@ + url_decode(decodedpath); + + if (outfile) +- savefile = ftp_strdup(outfile); ++ savefile = outfile; + else { + cp = strrchr(decodedpath, '/'); /* find savefile */ + if (cp != NULL) +@@ -571,8 +571,7 @@ + rangestart = rangeend = entitylen = -1; + mtime = -1; + if (restartautofetch) { +- if (strcmp(savefile, "-") != 0 && *savefile != '|' && +- stat(savefile, &sb) == 0) ++ if (stat(savefile, &sb) == 0) + restart_point = sb.st_size; + } + if (urltype == FILE_URL_T) { /* file:// URLs */ +@@ -1098,17 +1097,25 @@ + } /* end of ftp:// or http:// specific setup */ + + /* Open the output file. */ +- if (strcmp(savefile, "-") == 0) { +- fout = stdout; +- } else if (*savefile == '|') { +- oldintp = xsignal(SIGPIPE, SIG_IGN); +- fout = popen(savefile + 1, "w"); +- if (fout == NULL) { +- warn("Can't execute `%s'", savefile + 1); +- goto cleanup_fetch_url; ++ ++ /* ++ * Only trust filenames with special meaning if they came from ++ * the command line ++ */ ++ if (outfile == savefile) { ++ if (strcmp(savefile, "-") == 0) { ++ fout = stdout; ++ } else if (*savefile == '|') { ++ oldintp = xsignal(SIGPIPE, SIG_IGN); ++ fout = popen(savefile + 1, "w"); ++ if (fout == NULL) { ++ warn("Can't execute `%s'", savefile + 1); ++ goto cleanup_fetch_url; ++ } ++ closefunc = pclose; + } +- closefunc = pclose; +- } else { ++ } ++ if (fout == NULL) { + if ((rangeend != -1 && rangeend <= restart_point) || + (rangestart == -1 && filesize != -1 && filesize <= restart_point)) { + /* already done */ +@@ -1318,7 +1325,8 @@ + (*closefunc)(fout); + if (res0) + freeaddrinfo(res0); +- FREEPTR(savefile); ++ if (savefile != outfile) ++ FREEPTR(savefile); + FREEPTR(uuser); + if (pass != NULL) + memset(pass, 0, strlen(pass)); Index: user/cperciva/freebsd-update-build/patches/10.1-RC3/1-SA-14:25.setlogin =================================================================== --- user/cperciva/freebsd-update-build/patches/10.1-RC3/1-SA-14:25.setlogin (nonexistent) +++ user/cperciva/freebsd-update-build/patches/10.1-RC3/1-SA-14:25.setlogin (revision 293366) @@ -0,0 +1,64 @@ +Index: sys/kern/kern_prot.c +=================================================================== +--- sys/kern/kern_prot.c.orig ++++ sys/kern/kern_prot.c +@@ -2066,21 +2066,20 @@ + int + sys_getlogin(struct thread *td, struct getlogin_args *uap) + { +- int error; + char login[MAXLOGNAME]; + struct proc *p = td->td_proc; ++ size_t len; + + if (uap->namelen > MAXLOGNAME) + uap->namelen = MAXLOGNAME; + PROC_LOCK(p); + SESS_LOCK(p->p_session); +- bcopy(p->p_session->s_login, login, uap->namelen); ++ len = strlcpy(login, p->p_session->s_login, uap->namelen) + 1; + SESS_UNLOCK(p->p_session); + PROC_UNLOCK(p); +- if (strlen(login) + 1 > uap->namelen) ++ if (len > uap->namelen) + return (ERANGE); +- error = copyout(login, uap->namebuf, uap->namelen); +- return (error); ++ return (copyout(login, uap->namebuf, len)); + } + + /* +@@ -2099,21 +2098,23 @@ + int error; + char logintmp[MAXLOGNAME]; + ++ CTASSERT(sizeof(p->p_session->s_login) >= sizeof(logintmp)); ++ + error = priv_check(td, PRIV_PROC_SETLOGIN); + if (error) + return (error); + error = copyinstr(uap->namebuf, logintmp, sizeof(logintmp), NULL); +- if (error == ENAMETOOLONG) +- error = EINVAL; +- else if (!error) { +- PROC_LOCK(p); +- SESS_LOCK(p->p_session); +- (void) memcpy(p->p_session->s_login, logintmp, +- sizeof(logintmp)); +- SESS_UNLOCK(p->p_session); +- PROC_UNLOCK(p); ++ if (error != 0) { ++ if (error == ENAMETOOLONG) ++ error = EINVAL; ++ return (error); + } +- return (error); ++ PROC_LOCK(p); ++ SESS_LOCK(p->p_session); ++ strcpy(p->p_session->s_login, logintmp); ++ SESS_UNLOCK(p->p_session); ++ PROC_UNLOCK(p); ++ return (0); + } + + void Index: user/cperciva/freebsd-update-build/patches/10.1-RC3/1-SA-14:26.ftp =================================================================== --- user/cperciva/freebsd-update-build/patches/10.1-RC3/1-SA-14:26.ftp (nonexistent) +++ user/cperciva/freebsd-update-build/patches/10.1-RC3/1-SA-14:26.ftp (revision 293366) @@ -0,0 +1,69 @@ +Index: contrib/tnftp/src/fetch.c +=================================================================== +--- contrib/tnftp/src/fetch.c.orig ++++ contrib/tnftp/src/fetch.c +@@ -547,7 +547,7 @@ + url_decode(decodedpath); + + if (outfile) +- savefile = ftp_strdup(outfile); ++ savefile = outfile; + else { + cp = strrchr(decodedpath, '/'); /* find savefile */ + if (cp != NULL) +@@ -571,8 +571,7 @@ + rangestart = rangeend = entitylen = -1; + mtime = -1; + if (restartautofetch) { +- if (strcmp(savefile, "-") != 0 && *savefile != '|' && +- stat(savefile, &sb) == 0) ++ if (stat(savefile, &sb) == 0) + restart_point = sb.st_size; + } + if (urltype == FILE_URL_T) { /* file:// URLs */ +@@ -1098,17 +1097,25 @@ + } /* end of ftp:// or http:// specific setup */ + + /* Open the output file. */ +- if (strcmp(savefile, "-") == 0) { +- fout = stdout; +- } else if (*savefile == '|') { +- oldintp = xsignal(SIGPIPE, SIG_IGN); +- fout = popen(savefile + 1, "w"); +- if (fout == NULL) { +- warn("Can't execute `%s'", savefile + 1); +- goto cleanup_fetch_url; ++ ++ /* ++ * Only trust filenames with special meaning if they came from ++ * the command line ++ */ ++ if (outfile == savefile) { ++ if (strcmp(savefile, "-") == 0) { ++ fout = stdout; ++ } else if (*savefile == '|') { ++ oldintp = xsignal(SIGPIPE, SIG_IGN); ++ fout = popen(savefile + 1, "w"); ++ if (fout == NULL) { ++ warn("Can't execute `%s'", savefile + 1); ++ goto cleanup_fetch_url; ++ } ++ closefunc = pclose; + } +- closefunc = pclose; +- } else { ++ } ++ if (fout == NULL) { + if ((rangeend != -1 && rangeend <= restart_point) || + (rangestart == -1 && filesize != -1 && filesize <= restart_point)) { + /* already done */ +@@ -1318,7 +1325,8 @@ + (*closefunc)(fout); + if (res0) + freeaddrinfo(res0); +- FREEPTR(savefile); ++ if (savefile != outfile) ++ FREEPTR(savefile); + FREEPTR(uuser); + if (pass != NULL) + memset(pass, 0, strlen(pass)); Index: user/cperciva/freebsd-update-build/patches/10.1-RC4/0-volume-label =================================================================== --- user/cperciva/freebsd-update-build/patches/10.1-RC4/0-volume-label (nonexistent) +++ user/cperciva/freebsd-update-build/patches/10.1-RC4/0-volume-label (revision 293366) @@ -0,0 +1,17 @@ +Index: release/Makefile +=================================================================== +--- release/Makefile.orig ++++ release/Makefile +@@ -56,10 +56,10 @@ + .for _V in ${TARGET_ARCH} + .if !empty(TARGET:M${_V}) + OSRELEASE= ${TYPE}-${REVISION}-${BRANCH}-${TARGET} +-VOLUME_LABEL= ${REVISION:C/\./_/g:}_${BRANCH}_${TARGET} ++VOLUME_LABEL= ${REVISION:C/[.-]/_/g}_${BRANCH:C/[.-]/_/g}_${TARGET} + .else + OSRELEASE= ${TYPE}-${REVISION}-${BRANCH}-${TARGET}-${TARGET_ARCH} +-VOLUME_LABEL= ${REVISION:C/\./_/g:}_${BRANCH}_${TARGET_ARCH} ++VOLUME_LABEL= ${REVISION:C/[.-]/_/g}_${BRANCH:C/[.-]/_/g}_${TARGET_ARCH} + .endif + .endfor + .endif Index: user/cperciva/freebsd-update-build/patches/10.1-RC4/1-SA-14:25.setlogin =================================================================== --- user/cperciva/freebsd-update-build/patches/10.1-RC4/1-SA-14:25.setlogin (nonexistent) +++ user/cperciva/freebsd-update-build/patches/10.1-RC4/1-SA-14:25.setlogin (revision 293366) @@ -0,0 +1,64 @@ +Index: sys/kern/kern_prot.c +=================================================================== +--- sys/kern/kern_prot.c.orig ++++ sys/kern/kern_prot.c +@@ -2066,21 +2066,20 @@ + int + sys_getlogin(struct thread *td, struct getlogin_args *uap) + { +- int error; + char login[MAXLOGNAME]; + struct proc *p = td->td_proc; ++ size_t len; + + if (uap->namelen > MAXLOGNAME) + uap->namelen = MAXLOGNAME; + PROC_LOCK(p); + SESS_LOCK(p->p_session); +- bcopy(p->p_session->s_login, login, uap->namelen); ++ len = strlcpy(login, p->p_session->s_login, uap->namelen) + 1; + SESS_UNLOCK(p->p_session); + PROC_UNLOCK(p); +- if (strlen(login) + 1 > uap->namelen) ++ if (len > uap->namelen) + return (ERANGE); +- error = copyout(login, uap->namebuf, uap->namelen); +- return (error); ++ return (copyout(login, uap->namebuf, len)); + } + + /* +@@ -2099,21 +2098,23 @@ + int error; + char logintmp[MAXLOGNAME]; + ++ CTASSERT(sizeof(p->p_session->s_login) >= sizeof(logintmp)); ++ + error = priv_check(td, PRIV_PROC_SETLOGIN); + if (error) + return (error); + error = copyinstr(uap->namebuf, logintmp, sizeof(logintmp), NULL); +- if (error == ENAMETOOLONG) +- error = EINVAL; +- else if (!error) { +- PROC_LOCK(p); +- SESS_LOCK(p->p_session); +- (void) memcpy(p->p_session->s_login, logintmp, +- sizeof(logintmp)); +- SESS_UNLOCK(p->p_session); +- PROC_UNLOCK(p); ++ if (error != 0) { ++ if (error == ENAMETOOLONG) ++ error = EINVAL; ++ return (error); + } +- return (error); ++ PROC_LOCK(p); ++ SESS_LOCK(p->p_session); ++ strcpy(p->p_session->s_login, logintmp); ++ SESS_UNLOCK(p->p_session); ++ PROC_UNLOCK(p); ++ return (0); + } + + void Index: user/cperciva/freebsd-update-build/patches/10.1-RC4/1-SA-14:26.ftp =================================================================== --- user/cperciva/freebsd-update-build/patches/10.1-RC4/1-SA-14:26.ftp (nonexistent) +++ user/cperciva/freebsd-update-build/patches/10.1-RC4/1-SA-14:26.ftp (revision 293366) @@ -0,0 +1,69 @@ +Index: contrib/tnftp/src/fetch.c +=================================================================== +--- contrib/tnftp/src/fetch.c.orig ++++ contrib/tnftp/src/fetch.c +@@ -547,7 +547,7 @@ + url_decode(decodedpath); + + if (outfile) +- savefile = ftp_strdup(outfile); ++ savefile = outfile; + else { + cp = strrchr(decodedpath, '/'); /* find savefile */ + if (cp != NULL) +@@ -571,8 +571,7 @@ + rangestart = rangeend = entitylen = -1; + mtime = -1; + if (restartautofetch) { +- if (strcmp(savefile, "-") != 0 && *savefile != '|' && +- stat(savefile, &sb) == 0) ++ if (stat(savefile, &sb) == 0) + restart_point = sb.st_size; + } + if (urltype == FILE_URL_T) { /* file:// URLs */ +@@ -1098,17 +1097,25 @@ + } /* end of ftp:// or http:// specific setup */ + + /* Open the output file. */ +- if (strcmp(savefile, "-") == 0) { +- fout = stdout; +- } else if (*savefile == '|') { +- oldintp = xsignal(SIGPIPE, SIG_IGN); +- fout = popen(savefile + 1, "w"); +- if (fout == NULL) { +- warn("Can't execute `%s'", savefile + 1); +- goto cleanup_fetch_url; ++ ++ /* ++ * Only trust filenames with special meaning if they came from ++ * the command line ++ */ ++ if (outfile == savefile) { ++ if (strcmp(savefile, "-") == 0) { ++ fout = stdout; ++ } else if (*savefile == '|') { ++ oldintp = xsignal(SIGPIPE, SIG_IGN); ++ fout = popen(savefile + 1, "w"); ++ if (fout == NULL) { ++ warn("Can't execute `%s'", savefile + 1); ++ goto cleanup_fetch_url; ++ } ++ closefunc = pclose; + } +- closefunc = pclose; +- } else { ++ } ++ if (fout == NULL) { + if ((rangeend != -1 && rangeend <= restart_point) || + (rangestart == -1 && filesize != -1 && filesize <= restart_point)) { + /* already done */ +@@ -1318,7 +1325,8 @@ + (*closefunc)(fout); + if (res0) + freeaddrinfo(res0); +- FREEPTR(savefile); ++ if (savefile != outfile) ++ FREEPTR(savefile); + FREEPTR(uuser); + if (pass != NULL) + memset(pass, 0, strlen(pass)); Index: user/cperciva/freebsd-update-build/patches/10.2-BETA1/1-SA-15:13.tcp =================================================================== --- user/cperciva/freebsd-update-build/patches/10.2-BETA1/1-SA-15:13.tcp (nonexistent) +++ user/cperciva/freebsd-update-build/patches/10.2-BETA1/1-SA-15:13.tcp (revision 293366) @@ -0,0 +1,31 @@ +Index: sys/netinet/tcp_output.c +=================================================================== +--- sys/netinet/tcp_output.c (revision 285435) ++++ sys/netinet/tcp_output.c (working copy) +@@ -400,7 +400,7 @@ after_sack_rexmit: + flags &= ~TH_FIN; + } + +- if (len < 0) { ++ if (len <= 0) { + /* + * If FIN has been sent but not acked, + * but we haven't been called to retransmit, +@@ -410,9 +410,16 @@ after_sack_rexmit: + * to (closed) window, and set the persist timer + * if it isn't already going. If the window didn't + * close completely, just wait for an ACK. ++ * ++ * We also do a general check here to ensure that ++ * we will set the persist timer when we have data ++ * to send, but a 0-byte window. This makes sure ++ * the persist timer is set even if the packet ++ * hits one of the "goto send" lines below. + */ + len = 0; +- if (sendwin == 0) { ++ if ((sendwin == 0) && (TCPS_HAVEESTABLISHED(tp->t_state)) && ++ (off < (int) so->so_snd.sb_cc)) { + tcp_timer_activate(tp, TT_REXMT, 0); + tp->t_rxtshift = 0; + tp->snd_nxt = tp->snd_una; Index: user/cperciva/freebsd-update-build/patches/10.2-BETA2/1-SA-15:13.tcp =================================================================== --- user/cperciva/freebsd-update-build/patches/10.2-BETA2/1-SA-15:13.tcp (nonexistent) +++ user/cperciva/freebsd-update-build/patches/10.2-BETA2/1-SA-15:13.tcp (revision 293366) @@ -0,0 +1,31 @@ +Index: sys/netinet/tcp_output.c +=================================================================== +--- sys/netinet/tcp_output.c (revision 285435) ++++ sys/netinet/tcp_output.c (working copy) +@@ -400,7 +400,7 @@ after_sack_rexmit: + flags &= ~TH_FIN; + } + +- if (len < 0) { ++ if (len <= 0) { + /* + * If FIN has been sent but not acked, + * but we haven't been called to retransmit, +@@ -410,9 +410,16 @@ after_sack_rexmit: + * to (closed) window, and set the persist timer + * if it isn't already going. If the window didn't + * close completely, just wait for an ACK. ++ * ++ * We also do a general check here to ensure that ++ * we will set the persist timer when we have data ++ * to send, but a 0-byte window. This makes sure ++ * the persist timer is set even if the packet ++ * hits one of the "goto send" lines below. + */ + len = 0; +- if (sendwin == 0) { ++ if ((sendwin == 0) && (TCPS_HAVEESTABLISHED(tp->t_state)) && ++ (off < (int) so->so_snd.sb_cc)) { + tcp_timer_activate(tp, TT_REXMT, 0); + tp->t_rxtshift = 0; + tp->snd_nxt = tp->snd_una; Index: user/cperciva/freebsd-update-build/patches/10.2-BETA2/2-SA-15:14.tcp =================================================================== --- user/cperciva/freebsd-update-build/patches/10.2-BETA2/2-SA-15:14.tcp (nonexistent) +++ user/cperciva/freebsd-update-build/patches/10.2-BETA2/2-SA-15:14.tcp (revision 293366) @@ -0,0 +1,194 @@ +Index: sys/netinet/tcp_reass.c +=================================================================== +--- sys/netinet/tcp_reass.c (revision 285923) ++++ sys/netinet/tcp_reass.c (working copy) +@@ -79,25 +79,22 @@ static int tcp_reass_sysctl_qsize(SYSCTL_HANDLER_A + static SYSCTL_NODE(_net_inet_tcp, OID_AUTO, reass, CTLFLAG_RW, 0, + "TCP Segment Reassembly Queue"); + +-static VNET_DEFINE(int, tcp_reass_maxseg) = 0; +-#define V_tcp_reass_maxseg VNET(tcp_reass_maxseg) +-SYSCTL_VNET_INT(_net_inet_tcp_reass, OID_AUTO, maxsegments, CTLFLAG_RDTUN, +- &VNET_NAME(tcp_reass_maxseg), 0, ++static int tcp_reass_maxseg = 0; ++SYSCTL_INT(_net_inet_tcp_reass, OID_AUTO, maxsegments, CTLFLAG_RDTUN, ++ &tcp_reass_maxseg, 0, + "Global maximum number of TCP Segments in Reassembly Queue"); + +-SYSCTL_VNET_PROC(_net_inet_tcp_reass, OID_AUTO, cursegments, ++SYSCTL_PROC(_net_inet_tcp_reass, OID_AUTO, cursegments, + (CTLTYPE_INT | CTLFLAG_RD), NULL, 0, &tcp_reass_sysctl_qsize, "I", + "Global number of TCP Segments currently in Reassembly Queue"); + +-static VNET_DEFINE(int, tcp_reass_overflows) = 0; +-#define V_tcp_reass_overflows VNET(tcp_reass_overflows) +-SYSCTL_VNET_INT(_net_inet_tcp_reass, OID_AUTO, overflows, ++static int tcp_reass_overflows = 0; ++SYSCTL_INT(_net_inet_tcp_reass, OID_AUTO, overflows, + CTLFLAG_RD, +- &VNET_NAME(tcp_reass_overflows), 0, ++ &tcp_reass_overflows, 0, + "Global number of TCP Segment Reassembly Queue Overflows"); + +-static VNET_DEFINE(uma_zone_t, tcp_reass_zone); +-#define V_tcp_reass_zone VNET(tcp_reass_zone) ++static uma_zone_t tcp_reass_zone; + + /* Initialize TCP reassembly queue */ + static void +@@ -105,37 +102,28 @@ tcp_reass_zone_change(void *tag) + { + + /* Set the zone limit and read back the effective value. */ +- V_tcp_reass_maxseg = nmbclusters / 16; +- V_tcp_reass_maxseg = uma_zone_set_max(V_tcp_reass_zone, +- V_tcp_reass_maxseg); ++ tcp_reass_maxseg = nmbclusters / 16; ++ tcp_reass_maxseg = uma_zone_set_max(tcp_reass_zone, ++ tcp_reass_maxseg); + } + + void +-tcp_reass_init(void) ++tcp_reass_global_init(void) + { + +- V_tcp_reass_maxseg = nmbclusters / 16; ++ tcp_reass_maxseg = nmbclusters / 16; + TUNABLE_INT_FETCH("net.inet.tcp.reass.maxsegments", +- &V_tcp_reass_maxseg); +- V_tcp_reass_zone = uma_zcreate("tcpreass", sizeof (struct tseg_qent), ++ &tcp_reass_maxseg); ++ tcp_reass_zone = uma_zcreate("tcpreass", sizeof (struct tseg_qent), + NULL, NULL, NULL, NULL, UMA_ALIGN_PTR, UMA_ZONE_NOFREE); + /* Set the zone limit and read back the effective value. */ +- V_tcp_reass_maxseg = uma_zone_set_max(V_tcp_reass_zone, +- V_tcp_reass_maxseg); ++ tcp_reass_maxseg = uma_zone_set_max(tcp_reass_zone, ++ tcp_reass_maxseg); + EVENTHANDLER_REGISTER(nmbclusters_change, + tcp_reass_zone_change, NULL, EVENTHANDLER_PRI_ANY); + } + +-#ifdef VIMAGE + void +-tcp_reass_destroy(void) +-{ +- +- uma_zdestroy(V_tcp_reass_zone); +-} +-#endif +- +-void + tcp_reass_flush(struct tcpcb *tp) + { + struct tseg_qent *qe; +@@ -145,7 +133,7 @@ tcp_reass_flush(struct tcpcb *tp) + while ((qe = LIST_FIRST(&tp->t_segq)) != NULL) { + LIST_REMOVE(qe, tqe_q); + m_freem(qe->tqe_m); +- uma_zfree(V_tcp_reass_zone, qe); ++ uma_zfree(tcp_reass_zone, qe); + tp->t_segqlen--; + } + +@@ -159,7 +147,7 @@ tcp_reass_sysctl_qsize(SYSCTL_HANDLER_ARGS) + { + int qsize; + +- qsize = uma_zone_get_cur(V_tcp_reass_zone); ++ qsize = uma_zone_get_cur(tcp_reass_zone); + return (sysctl_handle_int(oidp, &qsize, 0, req)); + } + +@@ -207,7 +195,7 @@ tcp_reass(struct tcpcb *tp, struct tcphdr *th, int + */ + if ((th->th_seq != tp->rcv_nxt || !TCPS_HAVEESTABLISHED(tp->t_state)) && + tp->t_segqlen >= (so->so_rcv.sb_hiwat / tp->t_maxseg) + 1) { +- V_tcp_reass_overflows++; ++ tcp_reass_overflows++; + TCPSTAT_INC(tcps_rcvmemdrop); + m_freem(m); + *tlenp = 0; +@@ -226,7 +214,7 @@ tcp_reass(struct tcpcb *tp, struct tcphdr *th, int + * Use a temporary structure on the stack for the missing segment + * when the zone is exhausted. Otherwise we may get stuck. + */ +- te = uma_zalloc(V_tcp_reass_zone, M_NOWAIT); ++ te = uma_zalloc(tcp_reass_zone, M_NOWAIT); + if (te == NULL) { + if (th->th_seq != tp->rcv_nxt || !TCPS_HAVEESTABLISHED(tp->t_state)) { + TCPSTAT_INC(tcps_rcvmemdrop); +@@ -277,7 +265,7 @@ tcp_reass(struct tcpcb *tp, struct tcphdr *th, int + TCPSTAT_ADD(tcps_rcvdupbyte, *tlenp); + m_freem(m); + if (te != &tqs) +- uma_zfree(V_tcp_reass_zone, te); ++ uma_zfree(tcp_reass_zone, te); + tp->t_segqlen--; + /* + * Try to present any queued data +@@ -314,7 +302,7 @@ tcp_reass(struct tcpcb *tp, struct tcphdr *th, int + nq = LIST_NEXT(q, tqe_q); + LIST_REMOVE(q, tqe_q); + m_freem(q->tqe_m); +- uma_zfree(V_tcp_reass_zone, q); ++ uma_zfree(tcp_reass_zone, q); + tp->t_segqlen--; + q = nq; + } +@@ -353,7 +341,7 @@ present: + else + sbappendstream_locked(&so->so_rcv, q->tqe_m); + if (q != &tqs) +- uma_zfree(V_tcp_reass_zone, q); ++ uma_zfree(tcp_reass_zone, q); + tp->t_segqlen--; + q = nq; + } while (q && q->tqe_th->th_seq == tp->rcv_nxt); +Index: sys/netinet/tcp_subr.c +=================================================================== +--- sys/netinet/tcp_subr.c (revision 285923) ++++ sys/netinet/tcp_subr.c (working copy) +@@ -376,7 +376,6 @@ tcp_init(void) + tcp_tw_init(); + syncache_init(); + tcp_hc_init(); +- tcp_reass_init(); + + TUNABLE_INT_FETCH("net.inet.tcp.sack.enable", &V_tcp_do_sack); + V_sack_hole_zone = uma_zcreate("sackhole", sizeof(struct sackhole), +@@ -386,6 +385,8 @@ tcp_init(void) + if (!IS_DEFAULT_VNET(curvnet)) + return; + ++ tcp_reass_global_init(); ++ + /* XXX virtualize those bellow? */ + tcp_delacktime = TCPTV_DELACK; + tcp_keepinit = TCPTV_KEEP_INIT; +@@ -433,7 +434,6 @@ void + tcp_destroy(void) + { + +- tcp_reass_destroy(); + tcp_hc_destroy(); + syncache_destroy(); + tcp_tw_destroy(); +Index: sys/netinet/tcp_var.h +=================================================================== +--- sys/netinet/tcp_var.h (revision 285923) ++++ sys/netinet/tcp_var.h (working copy) +@@ -679,11 +679,8 @@ char *tcp_log_addrs(struct in_conninfo *, struct t + char *tcp_log_vain(struct in_conninfo *, struct tcphdr *, void *, + const void *); + int tcp_reass(struct tcpcb *, struct tcphdr *, int *, struct mbuf *); +-void tcp_reass_init(void); ++void tcp_reass_global_init(void); + void tcp_reass_flush(struct tcpcb *); +-#ifdef VIMAGE +-void tcp_reass_destroy(void); +-#endif + void tcp_input(struct mbuf *, int); + u_long tcp_maxmtu(struct in_conninfo *, struct tcp_ifcap *); + u_long tcp_maxmtu6(struct in_conninfo *, struct tcp_ifcap *); Index: user/cperciva/freebsd-update-build/patches/10.2-BETA2/2-SA-15:15.bsdpatch =================================================================== --- user/cperciva/freebsd-update-build/patches/10.2-BETA2/2-SA-15:15.bsdpatch (nonexistent) +++ user/cperciva/freebsd-update-build/patches/10.2-BETA2/2-SA-15:15.bsdpatch (revision 293366) @@ -0,0 +1,188 @@ +Index: usr.bin/patch/common.h +=================================================================== +--- usr.bin/patch/common.h (revision 285926) ++++ usr.bin/patch/common.h (working copy) +@@ -43,12 +43,10 @@ + #define LINENUM_MAX LONG_MAX + + #define SCCSPREFIX "s." +-#define GET "get -e %s" +-#define SCCSDIFF "get -p %s | diff - %s >/dev/null" + + #define RCSSUFFIX ",v" +-#define CHECKOUT "co -l %s" +-#define RCSDIFF "rcsdiff %s > /dev/null" ++#define CHECKOUT "/usr/bin/co" ++#define RCSDIFF "/usr/bin/rcsdiff" + + #define ORIGEXT ".orig" + #define REJEXT ".rej" +Index: usr.bin/patch/inp.c +=================================================================== +--- usr.bin/patch/inp.c (revision 285926) ++++ usr.bin/patch/inp.c (working copy) +@@ -31,8 +31,10 @@ + #include + #include + #include ++#include + + #include ++#include + #include + #include + #include +@@ -133,12 +135,14 @@ reallocate_lines(size_t *lines_allocated) + static bool + plan_a(const char *filename) + { +- int ifd, statfailed; ++ int ifd, statfailed, devnull, pstat; + char *p, *s, lbuf[INITLINELEN]; + struct stat filestat; + ptrdiff_t sz; + size_t i; + size_t iline, lines_allocated; ++ pid_t pid; ++ char *argp[4] = {NULL}; + + #ifdef DEBUGGING + if (debug & 8) +@@ -166,13 +170,14 @@ plan_a(const char *filename) + } + if (statfailed && check_only) + fatal("%s not found, -C mode, can't probe further\n", filename); +- /* For nonexistent or read-only files, look for RCS or SCCS versions. */ ++ /* For nonexistent or read-only files, look for RCS versions. */ ++ + if (statfailed || + /* No one can write to it. */ + (filestat.st_mode & 0222) == 0 || + /* I can't write to it. */ + ((filestat.st_mode & 0022) == 0 && filestat.st_uid != getuid())) { +- const char *cs = NULL, *filebase, *filedir; ++ char *filebase, *filedir; + struct stat cstat; + char *tmp_filename1, *tmp_filename2; + +@@ -180,43 +185,26 @@ plan_a(const char *filename) + tmp_filename2 = strdup(filename); + if (tmp_filename1 == NULL || tmp_filename2 == NULL) + fatal("strdupping filename"); ++ + filebase = basename(tmp_filename1); + filedir = dirname(tmp_filename2); + +- /* Leave room in lbuf for the diff command. */ +- s = lbuf + 20; +- + #define try(f, a1, a2, a3) \ +- (snprintf(s, buf_size - 20, f, a1, a2, a3), stat(s, &cstat) == 0) ++ (snprintf(lbuf, sizeof(lbuf), f, a1, a2, a3), stat(lbuf, &cstat) == 0) + +- if (try("%s/RCS/%s%s", filedir, filebase, RCSSUFFIX) || +- try("%s/RCS/%s%s", filedir, filebase, "") || +- try("%s/%s%s", filedir, filebase, RCSSUFFIX)) { +- snprintf(buf, buf_size, CHECKOUT, filename); +- snprintf(lbuf, sizeof lbuf, RCSDIFF, filename); +- cs = "RCS"; +- } else if (try("%s/SCCS/%s%s", filedir, SCCSPREFIX, filebase) || +- try("%s/%s%s", filedir, SCCSPREFIX, filebase)) { +- snprintf(buf, buf_size, GET, s); +- snprintf(lbuf, sizeof lbuf, SCCSDIFF, s, filename); +- cs = "SCCS"; +- } else if (statfailed) +- fatal("can't find %s\n", filename); +- +- free(tmp_filename1); +- free(tmp_filename2); +- + /* + * else we can't write to it but it's not under a version + * control system, so just proceed. + */ +- if (cs) { ++ if (try("%s/RCS/%s%s", filedir, filebase, RCSSUFFIX) || ++ try("%s/RCS/%s%s", filedir, filebase, "") || ++ try("%s/%s%s", filedir, filebase, RCSSUFFIX)) { + if (!statfailed) { + if ((filestat.st_mode & 0222) != 0) + /* The owner can write to it. */ + fatal("file %s seems to be locked " +- "by somebody else under %s\n", +- filename, cs); ++ "by somebody else under RCS\n", ++ filename); + /* + * It might be checked out unlocked. See if + * it's safe to check out the default version +@@ -224,21 +212,59 @@ plan_a(const char *filename) + */ + if (verbose) + say("Comparing file %s to default " +- "%s version...\n", +- filename, cs); +- if (system(lbuf)) ++ "RCS version...\n", filename); ++ ++ switch (pid = fork()) { ++ case -1: ++ fatal("can't fork: %s\n", ++ strerror(errno)); ++ case 0: ++ devnull = open("/dev/null", O_RDONLY); ++ if (devnull == -1) { ++ fatal("can't open /dev/null: %s", ++ strerror(errno)); ++ } ++ (void)dup2(devnull, STDOUT_FILENO); ++ argp[0] = strdup(RCSDIFF); ++ argp[1] = strdup(filename); ++ execv(RCSDIFF, argp); ++ exit(127); ++ } ++ pid = waitpid(pid, &pstat, 0); ++ if (pid == -1 || WEXITSTATUS(pstat) != 0) { + fatal("can't check out file %s: " +- "differs from default %s version\n", +- filename, cs); ++ "differs from default RCS version\n", ++ filename); ++ } + } ++ + if (verbose) +- say("Checking out file %s from %s...\n", +- filename, cs); +- if (system(buf) || stat(filename, &filestat)) +- fatal("can't check out file %s from %s\n", +- filename, cs); ++ say("Checking out file %s from RCS...\n", ++ filename); ++ ++ switch (pid = fork()) { ++ case -1: ++ fatal("can't fork: %s\n", strerror(errno)); ++ case 0: ++ argp[0] = strdup(CHECKOUT); ++ argp[1] = strdup("-l"); ++ argp[2] = strdup(filename); ++ execv(CHECKOUT, argp); ++ exit(127); ++ } ++ pid = waitpid(pid, &pstat, 0); ++ if (pid == -1 || WEXITSTATUS(pstat) != 0 || ++ stat(filename, &filestat)) { ++ fatal("can't check out file %s from RCS\n", ++ filename); ++ } ++ } else if (statfailed) { ++ fatal("can't find %s\n", filename); + } ++ free(tmp_filename1); ++ free(tmp_filename2); + } ++ + filemode = filestat.st_mode; + if (!S_ISREG(filemode)) + fatal("%s is not a normal file--can't patch\n", filename); Index: user/cperciva/freebsd-update-build/patches/10.2-BETA2/2-SA-15:16.openssh =================================================================== --- user/cperciva/freebsd-update-build/patches/10.2-BETA2/2-SA-15:16.openssh (nonexistent) +++ user/cperciva/freebsd-update-build/patches/10.2-BETA2/2-SA-15:16.openssh (revision 293366) @@ -0,0 +1,90 @@ +Index: crypto/openssh/auth2-chall.c +=================================================================== +--- crypto/openssh/auth2-chall.c (revision 285923) ++++ crypto/openssh/auth2-chall.c (working copy) +@@ -82,6 +82,7 @@ struct KbdintAuthctxt + void *ctxt; + KbdintDevice *device; + u_int nreq; ++ u_int devices_done; + }; + + #ifdef USE_PAM +@@ -168,11 +169,15 @@ kbdint_next_device(Authctxt *authctxt, KbdintAuthc + if (len == 0) + break; + for (i = 0; devices[i]; i++) { +- if (!auth2_method_allowed(authctxt, ++ if ((kbdintctxt->devices_done & (1 << i)) != 0 || ++ !auth2_method_allowed(authctxt, + "keyboard-interactive", devices[i]->name)) + continue; +- if (strncmp(kbdintctxt->devices, devices[i]->name, len) == 0) ++ if (strncmp(kbdintctxt->devices, devices[i]->name, ++ len) == 0) { + kbdintctxt->device = devices[i]; ++ kbdintctxt->devices_done |= 1 << i; ++ } + } + t = kbdintctxt->devices; + kbdintctxt->devices = t[len] ? xstrdup(t+len+1) : NULL; +Index: crypto/openssh/sshconnect.c +=================================================================== +--- crypto/openssh/sshconnect.c (revision 285923) ++++ crypto/openssh/sshconnect.c (working copy) +@@ -1247,29 +1247,39 @@ verify_host_key(char *host, struct sockaddr *hosta + { + int flags = 0; + char *fp; ++ Key *plain = NULL; + + fp = key_fingerprint(host_key, SSH_FP_MD5, SSH_FP_HEX); + debug("Server host key: %s %s", key_type(host_key), fp); + free(fp); + +- /* XXX certs are not yet supported for DNS */ +- if (!key_is_cert(host_key) && options.verify_host_key_dns && +- verify_host_key_dns(host, hostaddr, host_key, &flags) == 0) { +- if (flags & DNS_VERIFY_FOUND) { +- +- if (options.verify_host_key_dns == 1 && +- flags & DNS_VERIFY_MATCH && +- flags & DNS_VERIFY_SECURE) +- return 0; +- +- if (flags & DNS_VERIFY_MATCH) { +- matching_host_key_dns = 1; +- } else { +- warn_changed_key(host_key); +- error("Update the SSHFP RR in DNS with the new " +- "host key to get rid of this message."); ++ if (options.verify_host_key_dns) { ++ /* ++ * XXX certs are not yet supported for DNS, so downgrade ++ * them and try the plain key. ++ */ ++ plain = key_from_private(host_key); ++ if (key_is_cert(plain)) ++ key_drop_cert(plain); ++ if (verify_host_key_dns(host, hostaddr, plain, &flags) == 0) { ++ if (flags & DNS_VERIFY_FOUND) { ++ if (options.verify_host_key_dns == 1 && ++ flags & DNS_VERIFY_MATCH && ++ flags & DNS_VERIFY_SECURE) { ++ key_free(plain); ++ return 0; ++ } ++ if (flags & DNS_VERIFY_MATCH) { ++ matching_host_key_dns = 1; ++ } else { ++ warn_changed_key(plain); ++ error("Update the SSHFP RR in DNS " ++ "with the new host key to get rid " ++ "of this message."); ++ } + } + } ++ key_free(plain); + } + + return check_host_key(host, hostaddr, options.port, host_key, RDRW, Index: user/cperciva/freebsd-update-build/patches/10.2-BETA2/3-SA-15:18.bsdpatch =================================================================== --- user/cperciva/freebsd-update-build/patches/10.2-BETA2/3-SA-15:18.bsdpatch (nonexistent) +++ user/cperciva/freebsd-update-build/patches/10.2-BETA2/3-SA-15:18.bsdpatch (revision 293366) @@ -0,0 +1,57 @@ +Index: usr.bin/patch/pathnames.h +=================================================================== +--- usr.bin/patch/pathnames.h (revision 286254) ++++ usr.bin/patch/pathnames.h (working copy) +@@ -9,4 +9,4 @@ + + #include + +-#define _PATH_ED "/bin/ed" ++#define _PATH_RED "/bin/red" +Index: usr.bin/patch/pch.c +=================================================================== +--- usr.bin/patch/pch.c (revision 286254) ++++ usr.bin/patch/pch.c (working copy) +@@ -1,4 +1,3 @@ +- + /*- + * Copyright 1986, Larry Wall + * +@@ -1409,6 +1408,7 @@ do_ed_script(void) + char *t; + off_t beginning_of_this_line; + FILE *pipefp = NULL; ++ int continuation; + + if (!skip_rest_of_patch) { + if (copy_file(filearg[0], TMPOUTNAME) < 0) { +@@ -1415,7 +1415,7 @@ do_ed_script(void) + unlink(TMPOUTNAME); + fatal("can't create temp file %s", TMPOUTNAME); + } +- snprintf(buf, buf_size, "%s%s%s", _PATH_ED, ++ snprintf(buf, buf_size, "%s%s%s", _PATH_RED, + verbose ? " " : " -s ", TMPOUTNAME); + pipefp = popen(buf, "w"); + } +@@ -1433,7 +1433,19 @@ do_ed_script(void) + (*t == 'a' || *t == 'c' || *t == 'd' || *t == 'i' || *t == 's')) { + if (pipefp != NULL) + fputs(buf, pipefp); +- if (*t != 'd') { ++ if (*t == 's') { ++ for (;;) { ++ continuation = 0; ++ t = strchr(buf, '\0') - 1; ++ while (--t >= buf && *t == '\\') ++ continuation = !continuation; ++ if (!continuation || ++ pgets(true) == 0) ++ break; ++ if (pipefp != NULL) ++ fputs(buf, pipefp); ++ } ++ } else if (*t != 'd') { + while (pgets(true)) { + p_input_line++; + if (pipefp != NULL) Index: user/cperciva/freebsd-update-build/patches/10.2-BETA2/3-SA-15:19.routed =================================================================== --- user/cperciva/freebsd-update-build/patches/10.2-BETA2/3-SA-15:19.routed (nonexistent) +++ user/cperciva/freebsd-update-build/patches/10.2-BETA2/3-SA-15:19.routed (revision 293366) @@ -0,0 +1,17 @@ +Index: sbin/routed/input.c +=================================================================== +--- sbin/routed/input.c (revision 286262) ++++ sbin/routed/input.c (working copy) +@@ -160,6 +160,12 @@ input(struct sockaddr_in *from, /* received from + + trace_rip("Recv", "from", from, sifp, rip, cc); + ++ if (sifp == 0) { ++ trace_pkt(" discard a request from an indirect router" ++ " (possibly an attack)"); ++ return; ++ } ++ + if (rip->rip_vers == 0) { + msglim(&bad_router, FROM_NADDR, + "RIP version 0, cmd %d, packet received from %s", Index: user/cperciva/freebsd-update-build/patches/10.2-RC1/0-ntp =================================================================== --- user/cperciva/freebsd-update-build/patches/10.2-RC1/0-ntp (nonexistent) +++ user/cperciva/freebsd-update-build/patches/10.2-RC1/0-ntp (revision 293366) @@ -0,0 +1,28 @@ +Index: usr.sbin/ntp/config.h +=================================================================== +--- usr.sbin/ntp/config.h (revision 285843) ++++ usr.sbin/ntp/config.h (working copy) +@@ -1785,3 +1785,8 @@ typedef union mpinfou { + # endif + #endif /* !defined(_KERNEL) && !defined(PARSESTREAM) */ + ++/* ++ * FreeBSD specific: Explicitly specify date/time for reproducible build. ++ */ ++#define MKREPRO_DATE "Jul 04 2015" ++#define MKREPRO_TIME "15:42:16" +Index: usr.sbin/ntp/ntpd/Makefile +=================================================================== +--- usr.sbin/ntp/ntpd/Makefile (revision 285843) ++++ usr.sbin/ntp/ntpd/Makefile (working copy) +@@ -27,8 +27,8 @@ SRCS= cmd_args.c ntp_config.c ntp_control.c ntp_cr + refclock_tt560.c refclock_ulink.c refclock_wwv.c refclock_wwvb.c \ + refclock_zyfer.c version.c + +-DPADD= ${LIBPARSE} ${LIBNTP} ${LIBM} ${LIBMD} ${LIBOPTS} ${LIBPTHREAD} +-LDADD= ${LIBPARSE} ${LIBNTP} -lm -lmd ${LIBOPTS} -lpthread ++DPADD= ${LIBPARSE} ${LIBNTP} ${LIBM} ${LIBOPTS} ${LIBPTHREAD} ++LDADD= ${LIBPARSE} ${LIBNTP} -lm ${LIBOPTS} -lpthread + + CFLAGS+= -I${.CURDIR}/../../../contrib/ntp/ntpd \ + -I${.CURDIR}/../../../contrib/ntp/include \ Index: user/cperciva/freebsd-update-build/patches/10.2-RC1/1-SA-15:14.tcp =================================================================== --- user/cperciva/freebsd-update-build/patches/10.2-RC1/1-SA-15:14.tcp (nonexistent) +++ user/cperciva/freebsd-update-build/patches/10.2-RC1/1-SA-15:14.tcp (revision 293366) @@ -0,0 +1,194 @@ +Index: sys/netinet/tcp_reass.c +=================================================================== +--- sys/netinet/tcp_reass.c (revision 285923) ++++ sys/netinet/tcp_reass.c (working copy) +@@ -79,25 +79,22 @@ static int tcp_reass_sysctl_qsize(SYSCTL_HANDLER_A + static SYSCTL_NODE(_net_inet_tcp, OID_AUTO, reass, CTLFLAG_RW, 0, + "TCP Segment Reassembly Queue"); + +-static VNET_DEFINE(int, tcp_reass_maxseg) = 0; +-#define V_tcp_reass_maxseg VNET(tcp_reass_maxseg) +-SYSCTL_VNET_INT(_net_inet_tcp_reass, OID_AUTO, maxsegments, CTLFLAG_RDTUN, +- &VNET_NAME(tcp_reass_maxseg), 0, ++static int tcp_reass_maxseg = 0; ++SYSCTL_INT(_net_inet_tcp_reass, OID_AUTO, maxsegments, CTLFLAG_RDTUN, ++ &tcp_reass_maxseg, 0, + "Global maximum number of TCP Segments in Reassembly Queue"); + +-SYSCTL_VNET_PROC(_net_inet_tcp_reass, OID_AUTO, cursegments, ++SYSCTL_PROC(_net_inet_tcp_reass, OID_AUTO, cursegments, + (CTLTYPE_INT | CTLFLAG_RD), NULL, 0, &tcp_reass_sysctl_qsize, "I", + "Global number of TCP Segments currently in Reassembly Queue"); + +-static VNET_DEFINE(int, tcp_reass_overflows) = 0; +-#define V_tcp_reass_overflows VNET(tcp_reass_overflows) +-SYSCTL_VNET_INT(_net_inet_tcp_reass, OID_AUTO, overflows, ++static int tcp_reass_overflows = 0; ++SYSCTL_INT(_net_inet_tcp_reass, OID_AUTO, overflows, + CTLFLAG_RD, +- &VNET_NAME(tcp_reass_overflows), 0, ++ &tcp_reass_overflows, 0, + "Global number of TCP Segment Reassembly Queue Overflows"); + +-static VNET_DEFINE(uma_zone_t, tcp_reass_zone); +-#define V_tcp_reass_zone VNET(tcp_reass_zone) ++static uma_zone_t tcp_reass_zone; + + /* Initialize TCP reassembly queue */ + static void +@@ -105,37 +102,28 @@ tcp_reass_zone_change(void *tag) + { + + /* Set the zone limit and read back the effective value. */ +- V_tcp_reass_maxseg = nmbclusters / 16; +- V_tcp_reass_maxseg = uma_zone_set_max(V_tcp_reass_zone, +- V_tcp_reass_maxseg); ++ tcp_reass_maxseg = nmbclusters / 16; ++ tcp_reass_maxseg = uma_zone_set_max(tcp_reass_zone, ++ tcp_reass_maxseg); + } + + void +-tcp_reass_init(void) ++tcp_reass_global_init(void) + { + +- V_tcp_reass_maxseg = nmbclusters / 16; ++ tcp_reass_maxseg = nmbclusters / 16; + TUNABLE_INT_FETCH("net.inet.tcp.reass.maxsegments", +- &V_tcp_reass_maxseg); +- V_tcp_reass_zone = uma_zcreate("tcpreass", sizeof (struct tseg_qent), ++ &tcp_reass_maxseg); ++ tcp_reass_zone = uma_zcreate("tcpreass", sizeof (struct tseg_qent), + NULL, NULL, NULL, NULL, UMA_ALIGN_PTR, UMA_ZONE_NOFREE); + /* Set the zone limit and read back the effective value. */ +- V_tcp_reass_maxseg = uma_zone_set_max(V_tcp_reass_zone, +- V_tcp_reass_maxseg); ++ tcp_reass_maxseg = uma_zone_set_max(tcp_reass_zone, ++ tcp_reass_maxseg); + EVENTHANDLER_REGISTER(nmbclusters_change, + tcp_reass_zone_change, NULL, EVENTHANDLER_PRI_ANY); + } + +-#ifdef VIMAGE + void +-tcp_reass_destroy(void) +-{ +- +- uma_zdestroy(V_tcp_reass_zone); +-} +-#endif +- +-void + tcp_reass_flush(struct tcpcb *tp) + { + struct tseg_qent *qe; +@@ -145,7 +133,7 @@ tcp_reass_flush(struct tcpcb *tp) + while ((qe = LIST_FIRST(&tp->t_segq)) != NULL) { + LIST_REMOVE(qe, tqe_q); + m_freem(qe->tqe_m); +- uma_zfree(V_tcp_reass_zone, qe); ++ uma_zfree(tcp_reass_zone, qe); + tp->t_segqlen--; + } + +@@ -159,7 +147,7 @@ tcp_reass_sysctl_qsize(SYSCTL_HANDLER_ARGS) + { + int qsize; + +- qsize = uma_zone_get_cur(V_tcp_reass_zone); ++ qsize = uma_zone_get_cur(tcp_reass_zone); + return (sysctl_handle_int(oidp, &qsize, 0, req)); + } + +@@ -207,7 +195,7 @@ tcp_reass(struct tcpcb *tp, struct tcphdr *th, int + */ + if ((th->th_seq != tp->rcv_nxt || !TCPS_HAVEESTABLISHED(tp->t_state)) && + tp->t_segqlen >= (so->so_rcv.sb_hiwat / tp->t_maxseg) + 1) { +- V_tcp_reass_overflows++; ++ tcp_reass_overflows++; + TCPSTAT_INC(tcps_rcvmemdrop); + m_freem(m); + *tlenp = 0; +@@ -226,7 +214,7 @@ tcp_reass(struct tcpcb *tp, struct tcphdr *th, int + * Use a temporary structure on the stack for the missing segment + * when the zone is exhausted. Otherwise we may get stuck. + */ +- te = uma_zalloc(V_tcp_reass_zone, M_NOWAIT); ++ te = uma_zalloc(tcp_reass_zone, M_NOWAIT); + if (te == NULL) { + if (th->th_seq != tp->rcv_nxt || !TCPS_HAVEESTABLISHED(tp->t_state)) { + TCPSTAT_INC(tcps_rcvmemdrop); +@@ -277,7 +265,7 @@ tcp_reass(struct tcpcb *tp, struct tcphdr *th, int + TCPSTAT_ADD(tcps_rcvdupbyte, *tlenp); + m_freem(m); + if (te != &tqs) +- uma_zfree(V_tcp_reass_zone, te); ++ uma_zfree(tcp_reass_zone, te); + tp->t_segqlen--; + /* + * Try to present any queued data +@@ -314,7 +302,7 @@ tcp_reass(struct tcpcb *tp, struct tcphdr *th, int + nq = LIST_NEXT(q, tqe_q); + LIST_REMOVE(q, tqe_q); + m_freem(q->tqe_m); +- uma_zfree(V_tcp_reass_zone, q); ++ uma_zfree(tcp_reass_zone, q); + tp->t_segqlen--; + q = nq; + } +@@ -353,7 +341,7 @@ present: + else + sbappendstream_locked(&so->so_rcv, q->tqe_m); + if (q != &tqs) +- uma_zfree(V_tcp_reass_zone, q); ++ uma_zfree(tcp_reass_zone, q); + tp->t_segqlen--; + q = nq; + } while (q && q->tqe_th->th_seq == tp->rcv_nxt); +Index: sys/netinet/tcp_subr.c +=================================================================== +--- sys/netinet/tcp_subr.c (revision 285923) ++++ sys/netinet/tcp_subr.c (working copy) +@@ -376,7 +376,6 @@ tcp_init(void) + tcp_tw_init(); + syncache_init(); + tcp_hc_init(); +- tcp_reass_init(); + + TUNABLE_INT_FETCH("net.inet.tcp.sack.enable", &V_tcp_do_sack); + V_sack_hole_zone = uma_zcreate("sackhole", sizeof(struct sackhole), +@@ -386,6 +385,8 @@ tcp_init(void) + if (!IS_DEFAULT_VNET(curvnet)) + return; + ++ tcp_reass_global_init(); ++ + /* XXX virtualize those bellow? */ + tcp_delacktime = TCPTV_DELACK; + tcp_keepinit = TCPTV_KEEP_INIT; +@@ -433,7 +434,6 @@ void + tcp_destroy(void) + { + +- tcp_reass_destroy(); + tcp_hc_destroy(); + syncache_destroy(); + tcp_tw_destroy(); +Index: sys/netinet/tcp_var.h +=================================================================== +--- sys/netinet/tcp_var.h (revision 285923) ++++ sys/netinet/tcp_var.h (working copy) +@@ -679,11 +679,8 @@ char *tcp_log_addrs(struct in_conninfo *, struct t + char *tcp_log_vain(struct in_conninfo *, struct tcphdr *, void *, + const void *); + int tcp_reass(struct tcpcb *, struct tcphdr *, int *, struct mbuf *); +-void tcp_reass_init(void); ++void tcp_reass_global_init(void); + void tcp_reass_flush(struct tcpcb *); +-#ifdef VIMAGE +-void tcp_reass_destroy(void); +-#endif + void tcp_input(struct mbuf *, int); + u_long tcp_maxmtu(struct in_conninfo *, struct tcp_ifcap *); + u_long tcp_maxmtu6(struct in_conninfo *, struct tcp_ifcap *); Index: user/cperciva/freebsd-update-build/patches/10.2-RC1/1-SA-15:15.bsdpatch =================================================================== --- user/cperciva/freebsd-update-build/patches/10.2-RC1/1-SA-15:15.bsdpatch (nonexistent) +++ user/cperciva/freebsd-update-build/patches/10.2-RC1/1-SA-15:15.bsdpatch (revision 293366) @@ -0,0 +1,188 @@ +Index: usr.bin/patch/common.h +=================================================================== +--- usr.bin/patch/common.h (revision 285926) ++++ usr.bin/patch/common.h (working copy) +@@ -43,12 +43,10 @@ + #define LINENUM_MAX LONG_MAX + + #define SCCSPREFIX "s." +-#define GET "get -e %s" +-#define SCCSDIFF "get -p %s | diff - %s >/dev/null" + + #define RCSSUFFIX ",v" +-#define CHECKOUT "co -l %s" +-#define RCSDIFF "rcsdiff %s > /dev/null" ++#define CHECKOUT "/usr/bin/co" ++#define RCSDIFF "/usr/bin/rcsdiff" + + #define ORIGEXT ".orig" + #define REJEXT ".rej" +Index: usr.bin/patch/inp.c +=================================================================== +--- usr.bin/patch/inp.c (revision 285926) ++++ usr.bin/patch/inp.c (working copy) +@@ -31,8 +31,10 @@ + #include + #include + #include ++#include + + #include ++#include + #include + #include + #include +@@ -133,12 +135,14 @@ reallocate_lines(size_t *lines_allocated) + static bool + plan_a(const char *filename) + { +- int ifd, statfailed; ++ int ifd, statfailed, devnull, pstat; + char *p, *s, lbuf[INITLINELEN]; + struct stat filestat; + ptrdiff_t sz; + size_t i; + size_t iline, lines_allocated; ++ pid_t pid; ++ char *argp[4] = {NULL}; + + #ifdef DEBUGGING + if (debug & 8) +@@ -166,13 +170,14 @@ plan_a(const char *filename) + } + if (statfailed && check_only) + fatal("%s not found, -C mode, can't probe further\n", filename); +- /* For nonexistent or read-only files, look for RCS or SCCS versions. */ ++ /* For nonexistent or read-only files, look for RCS versions. */ ++ + if (statfailed || + /* No one can write to it. */ + (filestat.st_mode & 0222) == 0 || + /* I can't write to it. */ + ((filestat.st_mode & 0022) == 0 && filestat.st_uid != getuid())) { +- const char *cs = NULL, *filebase, *filedir; ++ char *filebase, *filedir; + struct stat cstat; + char *tmp_filename1, *tmp_filename2; + +@@ -180,43 +185,26 @@ plan_a(const char *filename) + tmp_filename2 = strdup(filename); + if (tmp_filename1 == NULL || tmp_filename2 == NULL) + fatal("strdupping filename"); ++ + filebase = basename(tmp_filename1); + filedir = dirname(tmp_filename2); + +- /* Leave room in lbuf for the diff command. */ +- s = lbuf + 20; +- + #define try(f, a1, a2, a3) \ +- (snprintf(s, buf_size - 20, f, a1, a2, a3), stat(s, &cstat) == 0) ++ (snprintf(lbuf, sizeof(lbuf), f, a1, a2, a3), stat(lbuf, &cstat) == 0) + +- if (try("%s/RCS/%s%s", filedir, filebase, RCSSUFFIX) || +- try("%s/RCS/%s%s", filedir, filebase, "") || +- try("%s/%s%s", filedir, filebase, RCSSUFFIX)) { +- snprintf(buf, buf_size, CHECKOUT, filename); +- snprintf(lbuf, sizeof lbuf, RCSDIFF, filename); +- cs = "RCS"; +- } else if (try("%s/SCCS/%s%s", filedir, SCCSPREFIX, filebase) || +- try("%s/%s%s", filedir, SCCSPREFIX, filebase)) { +- snprintf(buf, buf_size, GET, s); +- snprintf(lbuf, sizeof lbuf, SCCSDIFF, s, filename); +- cs = "SCCS"; +- } else if (statfailed) +- fatal("can't find %s\n", filename); +- +- free(tmp_filename1); +- free(tmp_filename2); +- + /* + * else we can't write to it but it's not under a version + * control system, so just proceed. + */ +- if (cs) { ++ if (try("%s/RCS/%s%s", filedir, filebase, RCSSUFFIX) || ++ try("%s/RCS/%s%s", filedir, filebase, "") || ++ try("%s/%s%s", filedir, filebase, RCSSUFFIX)) { + if (!statfailed) { + if ((filestat.st_mode & 0222) != 0) + /* The owner can write to it. */ + fatal("file %s seems to be locked " +- "by somebody else under %s\n", +- filename, cs); ++ "by somebody else under RCS\n", ++ filename); + /* + * It might be checked out unlocked. See if + * it's safe to check out the default version +@@ -224,21 +212,59 @@ plan_a(const char *filename) + */ + if (verbose) + say("Comparing file %s to default " +- "%s version...\n", +- filename, cs); +- if (system(lbuf)) ++ "RCS version...\n", filename); ++ ++ switch (pid = fork()) { ++ case -1: ++ fatal("can't fork: %s\n", ++ strerror(errno)); ++ case 0: ++ devnull = open("/dev/null", O_RDONLY); ++ if (devnull == -1) { ++ fatal("can't open /dev/null: %s", ++ strerror(errno)); ++ } ++ (void)dup2(devnull, STDOUT_FILENO); ++ argp[0] = strdup(RCSDIFF); ++ argp[1] = strdup(filename); ++ execv(RCSDIFF, argp); ++ exit(127); ++ } ++ pid = waitpid(pid, &pstat, 0); ++ if (pid == -1 || WEXITSTATUS(pstat) != 0) { + fatal("can't check out file %s: " +- "differs from default %s version\n", +- filename, cs); ++ "differs from default RCS version\n", ++ filename); ++ } + } ++ + if (verbose) +- say("Checking out file %s from %s...\n", +- filename, cs); +- if (system(buf) || stat(filename, &filestat)) +- fatal("can't check out file %s from %s\n", +- filename, cs); ++ say("Checking out file %s from RCS...\n", ++ filename); ++ ++ switch (pid = fork()) { ++ case -1: ++ fatal("can't fork: %s\n", strerror(errno)); ++ case 0: ++ argp[0] = strdup(CHECKOUT); ++ argp[1] = strdup("-l"); ++ argp[2] = strdup(filename); ++ execv(CHECKOUT, argp); ++ exit(127); ++ } ++ pid = waitpid(pid, &pstat, 0); ++ if (pid == -1 || WEXITSTATUS(pstat) != 0 || ++ stat(filename, &filestat)) { ++ fatal("can't check out file %s from RCS\n", ++ filename); ++ } ++ } else if (statfailed) { ++ fatal("can't find %s\n", filename); + } ++ free(tmp_filename1); ++ free(tmp_filename2); + } ++ + filemode = filestat.st_mode; + if (!S_ISREG(filemode)) + fatal("%s is not a normal file--can't patch\n", filename); Index: user/cperciva/freebsd-update-build/patches/10.2-RC1/1-SA-15:16.openssh =================================================================== --- user/cperciva/freebsd-update-build/patches/10.2-RC1/1-SA-15:16.openssh (nonexistent) +++ user/cperciva/freebsd-update-build/patches/10.2-RC1/1-SA-15:16.openssh (revision 293366) @@ -0,0 +1,90 @@ +Index: crypto/openssh/auth2-chall.c +=================================================================== +--- crypto/openssh/auth2-chall.c (revision 285923) ++++ crypto/openssh/auth2-chall.c (working copy) +@@ -82,6 +82,7 @@ struct KbdintAuthctxt + void *ctxt; + KbdintDevice *device; + u_int nreq; ++ u_int devices_done; + }; + + #ifdef USE_PAM +@@ -168,11 +169,15 @@ kbdint_next_device(Authctxt *authctxt, KbdintAuthc + if (len == 0) + break; + for (i = 0; devices[i]; i++) { +- if (!auth2_method_allowed(authctxt, ++ if ((kbdintctxt->devices_done & (1 << i)) != 0 || ++ !auth2_method_allowed(authctxt, + "keyboard-interactive", devices[i]->name)) + continue; +- if (strncmp(kbdintctxt->devices, devices[i]->name, len) == 0) ++ if (strncmp(kbdintctxt->devices, devices[i]->name, ++ len) == 0) { + kbdintctxt->device = devices[i]; ++ kbdintctxt->devices_done |= 1 << i; ++ } + } + t = kbdintctxt->devices; + kbdintctxt->devices = t[len] ? xstrdup(t+len+1) : NULL; +Index: crypto/openssh/sshconnect.c +=================================================================== +--- crypto/openssh/sshconnect.c (revision 285923) ++++ crypto/openssh/sshconnect.c (working copy) +@@ -1247,29 +1247,39 @@ verify_host_key(char *host, struct sockaddr *hosta + { + int flags = 0; + char *fp; ++ Key *plain = NULL; + + fp = key_fingerprint(host_key, SSH_FP_MD5, SSH_FP_HEX); + debug("Server host key: %s %s", key_type(host_key), fp); + free(fp); + +- /* XXX certs are not yet supported for DNS */ +- if (!key_is_cert(host_key) && options.verify_host_key_dns && +- verify_host_key_dns(host, hostaddr, host_key, &flags) == 0) { +- if (flags & DNS_VERIFY_FOUND) { +- +- if (options.verify_host_key_dns == 1 && +- flags & DNS_VERIFY_MATCH && +- flags & DNS_VERIFY_SECURE) +- return 0; +- +- if (flags & DNS_VERIFY_MATCH) { +- matching_host_key_dns = 1; +- } else { +- warn_changed_key(host_key); +- error("Update the SSHFP RR in DNS with the new " +- "host key to get rid of this message."); ++ if (options.verify_host_key_dns) { ++ /* ++ * XXX certs are not yet supported for DNS, so downgrade ++ * them and try the plain key. ++ */ ++ plain = key_from_private(host_key); ++ if (key_is_cert(plain)) ++ key_drop_cert(plain); ++ if (verify_host_key_dns(host, hostaddr, plain, &flags) == 0) { ++ if (flags & DNS_VERIFY_FOUND) { ++ if (options.verify_host_key_dns == 1 && ++ flags & DNS_VERIFY_MATCH && ++ flags & DNS_VERIFY_SECURE) { ++ key_free(plain); ++ return 0; ++ } ++ if (flags & DNS_VERIFY_MATCH) { ++ matching_host_key_dns = 1; ++ } else { ++ warn_changed_key(plain); ++ error("Update the SSHFP RR in DNS " ++ "with the new host key to get rid " ++ "of this message."); ++ } + } + } ++ key_free(plain); + } + + return check_host_key(host, hostaddr, options.port, host_key, RDRW, Index: user/cperciva/freebsd-update-build/patches/10.2-RC1/2-SA-15:18.bsdpatch =================================================================== --- user/cperciva/freebsd-update-build/patches/10.2-RC1/2-SA-15:18.bsdpatch (nonexistent) +++ user/cperciva/freebsd-update-build/patches/10.2-RC1/2-SA-15:18.bsdpatch (revision 293366) @@ -0,0 +1,57 @@ +Index: usr.bin/patch/pathnames.h +=================================================================== +--- usr.bin/patch/pathnames.h (revision 286254) ++++ usr.bin/patch/pathnames.h (working copy) +@@ -9,4 +9,4 @@ + + #include + +-#define _PATH_ED "/bin/ed" ++#define _PATH_RED "/bin/red" +Index: usr.bin/patch/pch.c +=================================================================== +--- usr.bin/patch/pch.c (revision 286254) ++++ usr.bin/patch/pch.c (working copy) +@@ -1,4 +1,3 @@ +- + /*- + * Copyright 1986, Larry Wall + * +@@ -1409,6 +1408,7 @@ do_ed_script(void) + char *t; + off_t beginning_of_this_line; + FILE *pipefp = NULL; ++ int continuation; + + if (!skip_rest_of_patch) { + if (copy_file(filearg[0], TMPOUTNAME) < 0) { +@@ -1415,7 +1415,7 @@ do_ed_script(void) + unlink(TMPOUTNAME); + fatal("can't create temp file %s", TMPOUTNAME); + } +- snprintf(buf, buf_size, "%s%s%s", _PATH_ED, ++ snprintf(buf, buf_size, "%s%s%s", _PATH_RED, + verbose ? " " : " -s ", TMPOUTNAME); + pipefp = popen(buf, "w"); + } +@@ -1433,7 +1433,19 @@ do_ed_script(void) + (*t == 'a' || *t == 'c' || *t == 'd' || *t == 'i' || *t == 's')) { + if (pipefp != NULL) + fputs(buf, pipefp); +- if (*t != 'd') { ++ if (*t == 's') { ++ for (;;) { ++ continuation = 0; ++ t = strchr(buf, '\0') - 1; ++ while (--t >= buf && *t == '\\') ++ continuation = !continuation; ++ if (!continuation || ++ pgets(true) == 0) ++ break; ++ if (pipefp != NULL) ++ fputs(buf, pipefp); ++ } ++ } else if (*t != 'd') { + while (pgets(true)) { + p_input_line++; + if (pipefp != NULL) Index: user/cperciva/freebsd-update-build/patches/10.2-RC1/2-SA-15:19.routed =================================================================== --- user/cperciva/freebsd-update-build/patches/10.2-RC1/2-SA-15:19.routed (nonexistent) +++ user/cperciva/freebsd-update-build/patches/10.2-RC1/2-SA-15:19.routed (revision 293366) @@ -0,0 +1,17 @@ +Index: sbin/routed/input.c +=================================================================== +--- sbin/routed/input.c (revision 286262) ++++ sbin/routed/input.c (working copy) +@@ -160,6 +160,12 @@ input(struct sockaddr_in *from, /* received from + + trace_rip("Recv", "from", from, sifp, rip, cc); + ++ if (sifp == 0) { ++ trace_pkt(" discard a request from an indirect router" ++ " (possibly an attack)"); ++ return; ++ } ++ + if (rip->rip_vers == 0) { + msglim(&bad_router, FROM_NADDR, + "RIP version 0, cmd %d, packet received from %s", Index: user/cperciva/freebsd-update-build/patches/10.2-RC2/1-SA-15:18.bsdpatch =================================================================== --- user/cperciva/freebsd-update-build/patches/10.2-RC2/1-SA-15:18.bsdpatch (nonexistent) +++ user/cperciva/freebsd-update-build/patches/10.2-RC2/1-SA-15:18.bsdpatch (revision 293366) @@ -0,0 +1,57 @@ +Index: usr.bin/patch/pathnames.h +=================================================================== +--- usr.bin/patch/pathnames.h (revision 286254) ++++ usr.bin/patch/pathnames.h (working copy) +@@ -9,4 +9,4 @@ + + #include + +-#define _PATH_ED "/bin/ed" ++#define _PATH_RED "/bin/red" +Index: usr.bin/patch/pch.c +=================================================================== +--- usr.bin/patch/pch.c (revision 286254) ++++ usr.bin/patch/pch.c (working copy) +@@ -1,4 +1,3 @@ +- + /*- + * Copyright 1986, Larry Wall + * +@@ -1409,6 +1408,7 @@ do_ed_script(void) + char *t; + off_t beginning_of_this_line; + FILE *pipefp = NULL; ++ int continuation; + + if (!skip_rest_of_patch) { + if (copy_file(filearg[0], TMPOUTNAME) < 0) { +@@ -1415,7 +1415,7 @@ do_ed_script(void) + unlink(TMPOUTNAME); + fatal("can't create temp file %s", TMPOUTNAME); + } +- snprintf(buf, buf_size, "%s%s%s", _PATH_ED, ++ snprintf(buf, buf_size, "%s%s%s", _PATH_RED, + verbose ? " " : " -s ", TMPOUTNAME); + pipefp = popen(buf, "w"); + } +@@ -1433,7 +1433,19 @@ do_ed_script(void) + (*t == 'a' || *t == 'c' || *t == 'd' || *t == 'i' || *t == 's')) { + if (pipefp != NULL) + fputs(buf, pipefp); +- if (*t != 'd') { ++ if (*t == 's') { ++ for (;;) { ++ continuation = 0; ++ t = strchr(buf, '\0') - 1; ++ while (--t >= buf && *t == '\\') ++ continuation = !continuation; ++ if (!continuation || ++ pgets(true) == 0) ++ break; ++ if (pipefp != NULL) ++ fputs(buf, pipefp); ++ } ++ } else if (*t != 'd') { + while (pgets(true)) { + p_input_line++; + if (pipefp != NULL) Index: user/cperciva/freebsd-update-build/patches/10.2-RC2/1-SA-15:19.routed =================================================================== --- user/cperciva/freebsd-update-build/patches/10.2-RC2/1-SA-15:19.routed (nonexistent) +++ user/cperciva/freebsd-update-build/patches/10.2-RC2/1-SA-15:19.routed (revision 293366) @@ -0,0 +1,17 @@ +Index: sbin/routed/input.c +=================================================================== +--- sbin/routed/input.c (revision 286262) ++++ sbin/routed/input.c (working copy) +@@ -160,6 +160,12 @@ input(struct sockaddr_in *from, /* received from + + trace_rip("Recv", "from", from, sifp, rip, cc); + ++ if (sifp == 0) { ++ trace_pkt(" discard a request from an indirect router" ++ " (possibly an attack)"); ++ return; ++ } ++ + if (rip->rip_vers == 0) { + msglim(&bad_router, FROM_NADDR, + "RIP version 0, cmd %d, packet received from %s", Index: user/cperciva/freebsd-update-build/patches/10.2-RC3/1-EN-15:11.toolchain =================================================================== --- user/cperciva/freebsd-update-build/patches/10.2-RC3/1-EN-15:11.toolchain (nonexistent) +++ user/cperciva/freebsd-update-build/patches/10.2-RC3/1-EN-15:11.toolchain (revision 293366) @@ -0,0 +1,15 @@ +Index: Makefile.inc1 +=================================================================== +--- Makefile.inc1 (revision 286847) ++++ Makefile.inc1 (working copy) +@@ -133,8 +133,8 @@ OSRELDATE= 0 + .endif + + .if !defined(VERSION) +-REVISION!= make -C ${SRCDIR}/release -V REVISION +-BRANCH!= make -C ${SRCDIR}/release -V BRANCH ++REVISION!= ${MAKE} -C ${SRCDIR}/release -V REVISION ++BRANCH!= ${MAKE} -C ${SRCDIR}/release -V BRANCH + SRCRELDATE!= awk '/^\#define[[:space:]]*__FreeBSD_version/ { print $$3 }' \ + ${SRCDIR}/sys/sys/param.h + VERSION= FreeBSD ${REVISION}-${BRANCH:C/-p[0-9]+$//} ${TARGET_ARCH} ${SRCRELDATE} Index: user/cperciva/freebsd-update-build/patches/10.2-RC3/1-EN-15:12.netstat =================================================================== --- user/cperciva/freebsd-update-build/patches/10.2-RC3/1-EN-15:12.netstat (nonexistent) +++ user/cperciva/freebsd-update-build/patches/10.2-RC3/1-EN-15:12.netstat (revision 293366) @@ -0,0 +1,42 @@ +Index: usr.bin/netstat/main.c +=================================================================== +--- usr.bin/netstat/main.c (revision 286847) ++++ usr.bin/netstat/main.c (working copy) +@@ -785,19 +785,31 @@ kread_counter(u_long addr) + int + kread_counters(u_long addr, void *buf, size_t size) + { +- uint64_t *c = buf; ++ uint64_t *c; ++ u_long *counters; ++ size_t i, n; + + if (kvmd_init() < 0) + return (-1); + +- if (kread(addr, buf, size) < 0) ++ if (size % sizeof(uint64_t) != 0) { ++ warnx("kread_counters: invalid counter set size"); + return (-1); ++ } + +- while (size != 0) { +- *c = kvm_counter_u64_fetch(kvmd, *c); +- size -= sizeof(*c); +- c++; ++ n = size / sizeof(uint64_t); ++ if ((counters = malloc(n * sizeof(u_long))) == NULL) ++ err(-1, "malloc"); ++ if (kread(addr, counters, n * sizeof(u_long)) < 0) { ++ free(counters); ++ return (-1); + } ++ ++ c = buf; ++ for (i = 0; i < n; i++) ++ c[i] = kvm_counter_u64_fetch(kvmd, counters[i]); ++ ++ free(counters); + return (0); + } + Index: user/cperciva/freebsd-update-build/patches/10.2-RC3/1-EN-15:13.vidcontrol =================================================================== --- user/cperciva/freebsd-update-build/patches/10.2-RC3/1-EN-15:13.vidcontrol (nonexistent) +++ user/cperciva/freebsd-update-build/patches/10.2-RC3/1-EN-15:13.vidcontrol (revision 293366) @@ -0,0 +1,13 @@ +Index: usr.sbin/vidcontrol/vidcontrol.c +=================================================================== +--- usr.sbin/vidcontrol/vidcontrol.c (revision 286847) ++++ usr.sbin/vidcontrol/vidcontrol.c (working copy) +@@ -1343,7 +1343,7 @@ main(int argc, char **argv) + if (vt4_mode) + opts = "b:Cc:fg:h:Hi:M:m:pPr:S:s:T:t:x"; + else +- opts = "b:Cc:df:g:h:Hi:l:LM:m:pPr:S:s:T:t:x"; ++ opts = "b:Cc:dfg:h:Hi:l:LM:m:pPr:S:s:T:t:x"; + + while ((opt = getopt(argc, argv, opts)) != -1) + switch(opt) { Index: user/cperciva/freebsd-update-build/patches/10.2-RC3/1-SA-15:20.expat =================================================================== --- user/cperciva/freebsd-update-build/patches/10.2-RC3/1-SA-15:20.expat (nonexistent) +++ user/cperciva/freebsd-update-build/patches/10.2-RC3/1-SA-15:20.expat (revision 293366) @@ -0,0 +1,49 @@ +Index: contrib/expat/lib/xmlparse.c +=================================================================== +--- contrib/expat/lib/xmlparse.c (revision 286868) ++++ contrib/expat/lib/xmlparse.c (working copy) +@@ -1678,6 +1678,12 @@ XML_ParseBuffer(XML_Parser parser, int len, int is + void * XMLCALL + XML_GetBuffer(XML_Parser parser, int len) + { ++/* BEGIN MOZILLA CHANGE (sanity check len) */ ++ if (len < 0) { ++ errorCode = XML_ERROR_NO_MEMORY; ++ return NULL; ++ } ++/* END MOZILLA CHANGE */ + switch (ps_parsing) { + case XML_SUSPENDED: + errorCode = XML_ERROR_SUSPENDED; +@@ -1689,8 +1695,13 @@ XML_GetBuffer(XML_Parser parser, int len) + } + + if (len > bufferLim - bufferEnd) { +- /* FIXME avoid integer overflow */ + int neededSize = len + (int)(bufferEnd - bufferPtr); ++/* BEGIN MOZILLA CHANGE (sanity check neededSize) */ ++ if (neededSize < 0) { ++ errorCode = XML_ERROR_NO_MEMORY; ++ return NULL; ++ } ++/* END MOZILLA CHANGE */ + #ifdef XML_CONTEXT_BYTES + int keep = (int)(bufferPtr - buffer); + +@@ -1719,7 +1730,15 @@ XML_GetBuffer(XML_Parser parser, int len) + bufferSize = INIT_BUFFER_SIZE; + do { + bufferSize *= 2; +- } while (bufferSize < neededSize); ++/* BEGIN MOZILLA CHANGE (prevent infinite loop on overflow) */ ++ } while (bufferSize < neededSize && bufferSize > 0); ++/* END MOZILLA CHANGE */ ++/* BEGIN MOZILLA CHANGE (sanity check bufferSize) */ ++ if (bufferSize <= 0) { ++ errorCode = XML_ERROR_NO_MEMORY; ++ return NULL; ++ } ++/* END MOZILLA CHANGE */ + newBuf = (char *)MALLOC(bufferSize); + if (newBuf == 0) { + errorCode = XML_ERROR_NO_MEMORY; Index: user/cperciva/freebsd-update-build/patches/10.2-RC3/2-EN-15:15.pkg =================================================================== --- user/cperciva/freebsd-update-build/patches/10.2-RC3/2-EN-15:15.pkg (nonexistent) +++ user/cperciva/freebsd-update-build/patches/10.2-RC3/2-EN-15:15.pkg (revision 293366) @@ -0,0 +1,34 @@ +Index: usr.sbin/pkg/pkg.c +=================================================================== +--- usr.sbin/pkg/pkg.c (revision 286787) ++++ usr.sbin/pkg/pkg.c (working copy) +@@ -749,7 +749,13 @@ bootstrap_pkg(bool force) + goto fetchfail; + + if (signature_type != NULL && +- strcasecmp(signature_type, "FINGERPRINTS") == 0) { ++ strcasecmp(signature_type, "NONE") != 0) { ++ if (strcasecmp(signature_type, "FINGERPRINTS") != 0) { ++ warnx("Signature type %s is not supported for " ++ "bootstrapping.", signature_type); ++ goto cleanup; ++ } ++ + snprintf(tmpsig, MAXPATHLEN, "%s/pkg.txz.sig.XXXXXX", + getenv("TMPDIR") ? getenv("TMPDIR") : _PATH_TMP); + snprintf(url, MAXPATHLEN, "%s/Latest/pkg.txz.sig", +@@ -834,7 +840,13 @@ bootstrap_pkg_local(const char *pkgpath, bool forc + return (-1); + } + if (signature_type != NULL && +- strcasecmp(signature_type, "FINGERPRINTS") == 0) { ++ strcasecmp(signature_type, "NONE") != 0) { ++ if (strcasecmp(signature_type, "FINGERPRINTS") != 0) { ++ warnx("Signature type %s is not supported for " ++ "bootstrapping.", signature_type); ++ goto cleanup; ++ } ++ + snprintf(path, sizeof(path), "%s.sig", pkgpath); + + if ((fd_sig = open(path, O_RDONLY)) == -1) { Index: user/cperciva/freebsd-update-build/patches/10.2-RC3/2-SA-15:22.openssh =================================================================== --- user/cperciva/freebsd-update-build/patches/10.2-RC3/2-SA-15:22.openssh (nonexistent) +++ user/cperciva/freebsd-update-build/patches/10.2-RC3/2-SA-15:22.openssh (revision 293366) @@ -0,0 +1,68 @@ +Index: crypto/openssh/monitor.c +=================================================================== +--- crypto/openssh/monitor.c (revision 286787) ++++ crypto/openssh/monitor.c (working copy) +@@ -1027,9 +1027,7 @@ extern KbdintDevice sshpam_device; + int + mm_answer_pam_init_ctx(int sock, Buffer *m) + { +- + debug3("%s", __func__); +- authctxt->user = buffer_get_string(m, NULL); + sshpam_ctxt = (sshpam_device.init_ctx)(authctxt); + sshpam_authok = NULL; + buffer_clear(m); +@@ -1111,14 +1109,16 @@ mm_answer_pam_respond(int sock, Buffer *m) + int + mm_answer_pam_free_ctx(int sock, Buffer *m) + { ++ int r = sshpam_authok != NULL && sshpam_authok == sshpam_ctxt; + + debug3("%s", __func__); + (sshpam_device.free_ctx)(sshpam_ctxt); ++ sshpam_ctxt = sshpam_authok = NULL; + buffer_clear(m); + mm_request_send(sock, MONITOR_ANS_PAM_FREE_CTX, m); + auth_method = "keyboard-interactive"; + auth_submethod = "pam"; +- return (sshpam_authok == sshpam_ctxt); ++ return r; + } + #endif + +Index: crypto/openssh/monitor_wrap.c +=================================================================== +--- crypto/openssh/monitor_wrap.c (revision 286787) ++++ crypto/openssh/monitor_wrap.c (working copy) +@@ -820,7 +820,6 @@ mm_sshpam_init_ctx(Authctxt *authctxt) + + debug3("%s", __func__); + buffer_init(&m); +- buffer_put_cstring(&m, authctxt->user); + mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_PAM_INIT_CTX, &m); + debug3("%s: waiting for MONITOR_ANS_PAM_INIT_CTX", __func__); + mm_request_receive_expect(pmonitor->m_recvfd, MONITOR_ANS_PAM_INIT_CTX, &m); +Index: crypto/openssh/mux.c +=================================================================== +--- crypto/openssh/mux.c (revision 286787) ++++ crypto/openssh/mux.c (working copy) +@@ -635,7 +635,8 @@ process_mux_open_fwd(u_int rid, Channel *c, Buffer + u_int lport, cport; + int i, ret = 0, freefwd = 1; + +- fwd.listen_host = fwd.connect_host = NULL; ++ memset(&fwd, 0, sizeof(fwd)); ++ + if (buffer_get_int_ret(&ftype, m) != 0 || + (fwd.listen_host = buffer_get_string_ret(m, NULL)) == NULL || + buffer_get_int_ret(&lport, m) != 0 || +@@ -785,7 +786,8 @@ process_mux_close_fwd(u_int rid, Channel *c, Buffe + int i, listen_port, ret = 0; + u_int lport, cport; + +- fwd.listen_host = fwd.connect_host = NULL; ++ memset(&fwd, 0, sizeof(fwd)); ++ + if (buffer_get_int_ret(&ftype, m) != 0 || + (fwd.listen_host = buffer_get_string_ret(m, NULL)) == NULL || + buffer_get_int_ret(&lport, m) != 0 || Index: user/cperciva/freebsd-update-build/patches/6.2-BETA1/1-SA-06:21.gzip =================================================================== --- user/cperciva/freebsd-update-build/patches/6.2-BETA1/1-SA-06:21.gzip (nonexistent) +++ user/cperciva/freebsd-update-build/patches/6.2-BETA1/1-SA-06:21.gzip (revision 293366) @@ -0,0 +1,200 @@ +Index: gnu/usr.bin/gzip/gzip.h +=================================================================== +RCS file: /home/ncvs/src/gnu/usr.bin/gzip/gzip.h,v +retrieving revision 1.4 +diff -u -d -r1.4 gzip.h +--- gnu/usr.bin/gzip/gzip.h 2 May 2004 23:07:49 -0000 1.4 ++++ gnu/usr.bin/gzip/gzip.h 17 Sep 2006 10:58:37 -0000 +@@ -202,6 +202,8 @@ + extern int to_stdout; /* output to stdout (-c) */ + extern int save_orig_name; /* set if original name must be saved */ + ++#define MIN(a,b) ((a) <= (b) ? (a) : (b)) ++ + #define get_byte() (inptr < insize ? inbuf[inptr++] : fill_inbuf(0)) + #define try_byte() (inptr < insize ? inbuf[inptr++] : fill_inbuf(1)) + +Index: gnu/usr.bin/gzip/inflate.c +=================================================================== +RCS file: /home/ncvs/src/gnu/usr.bin/gzip/inflate.c,v +retrieving revision 1.9 +diff -u -d -r1.9 inflate.c +--- gnu/usr.bin/gzip/inflate.c 13 Aug 2004 05:38:44 -0000 1.9 ++++ gnu/usr.bin/gzip/inflate.c 17 Sep 2006 10:58:37 -0000 +@@ -316,7 +316,7 @@ + { + *t = (struct huft *)NULL; + *m = 0; +- return 0; ++ return 2; + } + + +Index: gnu/usr.bin/gzip/unlzh.c +=================================================================== +RCS file: /home/ncvs/src/gnu/usr.bin/gzip/unlzh.c,v +retrieving revision 1.5 +diff -u -d -r1.5 unlzh.c +--- gnu/usr.bin/gzip/unlzh.c 27 Aug 1999 23:35:53 -0000 1.5 ++++ gnu/usr.bin/gzip/unlzh.c 17 Sep 2006 10:58:37 -0000 +@@ -148,13 +148,17 @@ + unsigned i, k, len, ch, jutbits, avail, nextcode, mask; + + for (i = 1; i <= 16; i++) count[i] = 0; +- for (i = 0; i < (unsigned)nchar; i++) count[bitlen[i]]++; ++ for (i = 0; i < (unsigned)nchar; i++) { ++ if (bitlen[i] > 16) ++ error("Bad table (case a)\n"); ++ else count[bitlen[i]]++; ++ } + + start[1] = 0; + for (i = 1; i <= 16; i++) + start[i + 1] = start[i] + (count[i] << (16 - i)); +- if ((start[17] & 0xffff) != 0) +- error("Bad table\n"); ++ if ((start[17] & 0xffff) != 0 || tablebits > 16) /* 16 for weight below */ ++ error("Bad table (case b)\n"); + + jutbits = 16 - tablebits; + for (i = 1; i <= (unsigned)tablebits; i++) { +@@ -168,15 +172,15 @@ + + i = start[tablebits + 1] >> jutbits; + if (i != 0) { +- k = 1 << tablebits; +- while (i != k) table[i++] = 0; ++ k = MIN(1 << tablebits, DIST_BUFSIZE); ++ while (i < k) table[i++] = 0; + } + + avail = nchar; + mask = (unsigned) 1 << (15 - tablebits); + for (ch = 0; ch < (unsigned)nchar; ch++) { + if ((len = bitlen[ch]) == 0) continue; +- nextcode = start[len] + weight[len]; ++ nextcode = MIN(start[len] + weight[len], DIST_BUFSIZE); + if (len <= (unsigned)tablebits) { + for (i = start[len]; i < nextcode; i++) table[i] = ch; + } else { +@@ -217,7 +221,7 @@ + for (i = 0; i < 256; i++) pt_table[i] = c; + } else { + i = 0; +- while (i < n) { ++ while (i < MIN(n,NPT)) { + c = bitbuf >> (BITBUFSIZ - 3); + if (c == 7) { + mask = (unsigned) 1 << (BITBUFSIZ - 1 - 3); +@@ -227,7 +231,7 @@ + pt_len[i++] = c; + if (i == i_special) { + c = getbits(2); +- while (--c >= 0) pt_len[i++] = 0; ++ while (--c >= 0 && i < NPT) pt_len[i++] = 0; + } + } + while (i < nn) pt_len[i++] = 0; +@@ -247,7 +251,7 @@ + for (i = 0; i < 4096; i++) c_table[i] = c; + } else { + i = 0; +- while (i < n) { ++ while (i < MIN(n,NC)) { + c = pt_table[bitbuf >> (BITBUFSIZ - 8)]; + if (c >= NT) { + mask = (unsigned) 1 << (BITBUFSIZ - 1 - 8); +@@ -255,14 +259,14 @@ + if (bitbuf & mask) c = right[c]; + else c = left [c]; + mask >>= 1; +- } while (c >= NT); ++ } while (c >= NT && (mask || c != left[c])); + } + fillbuf((int) pt_len[c]); + if (c <= 2) { + if (c == 0) c = 1; + else if (c == 1) c = getbits(4) + 3; + else c = getbits(CBIT) + 20; +- while (--c >= 0) c_len[i++] = 0; ++ while (--c >= 0 && i < NC) c_len[i++] = 0; + } else c_len[i++] = c - 2; + } + while (i < NC) c_len[i++] = 0; +@@ -291,7 +295,7 @@ + if (bitbuf & mask) j = right[j]; + else j = left [j]; + mask >>= 1; +- } while (j >= NC); ++ } while (j >= NC && (mask || j != left[j])); + } + fillbuf((int) c_len[j]); + return j; +@@ -308,7 +312,7 @@ + if (bitbuf & mask) j = right[j]; + else j = left [j]; + mask >>= 1; +- } while (j >= NP); ++ } while (j >= NP && (mask || j != left[j])); + } + fillbuf((int) pt_len[j]); + if (j != 0) j = ((unsigned) 1 << (j - 1)) + getbits((int) (j - 1)); +@@ -355,7 +359,7 @@ + while (--j >= 0) { + buffer[r] = buffer[i]; + i = (i + 1) & (DICSIZ - 1); +- if (++r == count) return r; ++ if (++r >= count) return r; + } + for ( ; ; ) { + c = decode_c(); +@@ -365,14 +369,14 @@ + } + if (c <= UCHAR_MAX) { + buffer[r] = c; +- if (++r == count) return r; ++ if (++r >= count) return r; + } else { + j = c - (UCHAR_MAX + 1 - THRESHOLD); + i = (r - decode_p() - 1) & (DICSIZ - 1); + while (--j >= 0) { + buffer[r] = buffer[i]; + i = (i + 1) & (DICSIZ - 1); +- if (++r == count) return r; ++ if (++r >= count) return r; + } + } + } +Index: gnu/usr.bin/gzip/unpack.c +=================================================================== +RCS file: /home/ncvs/src/gnu/usr.bin/gzip/unpack.c,v +retrieving revision 1.6 +diff -u -d -r1.6 unpack.c +--- gnu/usr.bin/gzip/unpack.c 27 Aug 1999 23:35:54 -0000 1.6 ++++ gnu/usr.bin/gzip/unpack.c 17 Sep 2006 10:58:37 -0000 +@@ -12,7 +12,6 @@ + #include "gzip.h" + #include "crypt.h" + +-#define MIN(a,b) ((a) <= (b) ? (a) : (b)) + /* The arguments must not have side effects. */ + + #define MAX_BITLEN 25 +@@ -132,7 +131,7 @@ + /* Remember where the literals of this length start in literal[] : */ + lit_base[len] = base; + /* And read the literals: */ +- for (n = leaves[len]; n > 0; n--) { ++ for (n = leaves[len]; n > 0 && base < LITERALS; n--) { + literal[base++] = (uch)get_byte(); + } + } +@@ -168,7 +167,7 @@ + prefixp = &prefix_len[1< prefix_len) *--prefixp = (uch)len; + } + /* The length of all other codes is unknown: */ + while (prefixp > prefix_len) *--prefixp = 0; Index: user/cperciva/freebsd-update-build/patches/6.2-BETA1/2-SA-06:23.openssl =================================================================== --- user/cperciva/freebsd-update-build/patches/6.2-BETA1/2-SA-06:23.openssl (nonexistent) +++ user/cperciva/freebsd-update-build/patches/6.2-BETA1/2-SA-06:23.openssl (revision 293366) @@ -0,0 +1,313 @@ +Index: crypto/openssl/crypto/asn1/tasn_dec.c +=================================================================== +RCS file: /home/ncvs/src/crypto/openssl/crypto/asn1/tasn_dec.c,v +retrieving revision 1.1.1.2 +diff -u -I__FBSDID -r1.1.1.2 tasn_dec.c +--- crypto/openssl/crypto/asn1/tasn_dec.c 1 Oct 2003 12:32:37 -0000 1.1.1.2 ++++ crypto/openssl/crypto/asn1/tasn_dec.c 27 Sep 2006 07:03:22 -0000 +@@ -628,6 +628,9 @@ + ASN1err(ASN1_F_ASN1_D2I_EX_PRIMITIVE, ERR_R_NESTED_ASN1_ERROR); + return 0; + } else if(ret == -1) return -1; ++ ++ ret = 0; ++ + /* SEQUENCE, SET and "OTHER" are left in encoded form */ + if((utype == V_ASN1_SEQUENCE) || (utype == V_ASN1_SET) || (utype == V_ASN1_OTHER)) { + /* Clear context cache for type OTHER because the auto clear when +Index: crypto/openssl/crypto/dh/dh.h +=================================================================== +RCS file: /home/ncvs/src/crypto/openssl/crypto/dh/dh.h,v +retrieving revision 1.1.1.6 +diff -u -I__FBSDID -r1.1.1.6 dh.h +--- crypto/openssl/crypto/dh/dh.h 28 Jan 2003 21:21:24 -0000 1.1.1.6 ++++ crypto/openssl/crypto/dh/dh.h 27 Sep 2006 07:03:22 -0000 +@@ -70,6 +70,10 @@ + #include + #include + ++#ifndef OPENSSL_DH_MAX_MODULUS_BITS ++# define OPENSSL_DH_MAX_MODULUS_BITS 10000 ++#endif ++ + #define DH_FLAG_CACHE_MONT_P 0x01 + + #ifdef __cplusplus +@@ -200,6 +204,7 @@ + /* Reason codes. */ + #define DH_R_BAD_GENERATOR 101 + #define DH_R_NO_PRIVATE_VALUE 100 ++#define DH_R_MODULUS_TOO_LARGE 103 + + #ifdef __cplusplus + } +Index: crypto/openssl/crypto/dh/dh_err.c +=================================================================== +RCS file: /home/ncvs/src/crypto/openssl/crypto/dh/dh_err.c,v +retrieving revision 1.1.1.5 +diff -u -I__FBSDID -r1.1.1.5 dh_err.c +--- crypto/openssl/crypto/dh/dh_err.c 25 Feb 2005 05:34:36 -0000 1.1.1.5 ++++ crypto/openssl/crypto/dh/dh_err.c 27 Sep 2006 07:03:22 -0000 +@@ -78,6 +78,7 @@ + static ERR_STRING_DATA DH_str_reasons[]= + { + {DH_R_BAD_GENERATOR ,"bad generator"}, ++{DH_R_MODULUS_TOO_LARGE ,"modulus too large"}, + {DH_R_NO_PRIVATE_VALUE ,"no private value"}, + {0,NULL} + }; +Index: crypto/openssl/crypto/dh/dh_key.c +=================================================================== +RCS file: /home/ncvs/src/crypto/openssl/crypto/dh/dh_key.c,v +retrieving revision 1.1.1.9 +diff -u -I__FBSDID -r1.1.1.9 dh_key.c +--- crypto/openssl/crypto/dh/dh_key.c 25 Feb 2005 05:34:37 -0000 1.1.1.9 ++++ crypto/openssl/crypto/dh/dh_key.c 27 Sep 2006 07:03:22 -0000 +@@ -164,6 +164,12 @@ + BIGNUM *tmp; + int ret= -1; + ++ if (BN_num_bits(dh->p) > OPENSSL_DH_MAX_MODULUS_BITS) ++ { ++ DHerr(DH_F_DH_COMPUTE_KEY,DH_R_MODULUS_TOO_LARGE); ++ goto err; ++ } ++ + ctx = BN_CTX_new(); + if (ctx == NULL) goto err; + BN_CTX_start(ctx); +Index: crypto/openssl/crypto/dsa/dsa.h +=================================================================== +RCS file: /home/ncvs/src/crypto/openssl/crypto/dsa/dsa.h,v +retrieving revision 1.1.1.7 +diff -u -I__FBSDID -r1.1.1.7 dsa.h +--- crypto/openssl/crypto/dsa/dsa.h 25 Feb 2005 05:34:39 -0000 1.1.1.7 ++++ crypto/openssl/crypto/dsa/dsa.h 27 Sep 2006 07:03:23 -0000 +@@ -79,6 +79,10 @@ + # include + #endif + ++#ifndef OPENSSL_DSA_MAX_MODULUS_BITS ++# define OPENSSL_DSA_MAX_MODULUS_BITS 10000 ++#endif ++ + #define DSA_FLAG_CACHE_MONT_P 0x01 + + #if defined(OPENSSL_FIPS) +@@ -245,8 +249,10 @@ + #define DSA_F_SIG_CB 114 + + /* Reason codes. */ ++#define DSA_R_BAD_Q_VALUE 102 + #define DSA_R_DATA_TOO_LARGE_FOR_KEY_SIZE 100 + #define DSA_R_MISSING_PARAMETERS 101 ++#define DSA_R_MODULUS_TOO_LARGE 103 + + #ifdef __cplusplus + } +Index: crypto/openssl/crypto/dsa/dsa_err.c +=================================================================== +RCS file: /home/ncvs/src/crypto/openssl/crypto/dsa/dsa_err.c,v +retrieving revision 1.1.1.4 +diff -u -I__FBSDID -r1.1.1.4 dsa_err.c +--- crypto/openssl/crypto/dsa/dsa_err.c 28 Jan 2003 21:21:31 -0000 1.1.1.4 ++++ crypto/openssl/crypto/dsa/dsa_err.c 27 Sep 2006 07:03:23 -0000 +@@ -85,8 +85,10 @@ + + static ERR_STRING_DATA DSA_str_reasons[]= + { ++{DSA_R_BAD_Q_VALUE ,"bad q value"}, + {DSA_R_DATA_TOO_LARGE_FOR_KEY_SIZE ,"data too large for key size"}, + {DSA_R_MISSING_PARAMETERS ,"missing parameters"}, ++{DSA_R_MODULUS_TOO_LARGE ,"modulus too large"}, + {0,NULL} + }; + +Index: crypto/openssl/crypto/dsa/dsa_ossl.c +=================================================================== +RCS file: /home/ncvs/src/crypto/openssl/crypto/dsa/dsa_ossl.c,v +retrieving revision 1.1.1.8 +diff -u -I__FBSDID -r1.1.1.8 dsa_ossl.c +--- crypto/openssl/crypto/dsa/dsa_ossl.c 25 Feb 2005 05:34:40 -0000 1.1.1.8 ++++ crypto/openssl/crypto/dsa/dsa_ossl.c 27 Sep 2006 07:03:23 -0000 +@@ -245,6 +245,18 @@ + return -1; + } + ++ if (BN_num_bits(dsa->q) != 160) ++ { ++ DSAerr(DSA_F_DSA_DO_VERIFY,DSA_R_BAD_Q_VALUE); ++ return -1; ++ } ++ ++ if (BN_num_bits(dsa->p) > OPENSSL_DSA_MAX_MODULUS_BITS) ++ { ++ DSAerr(DSA_F_DSA_DO_VERIFY,DSA_R_MODULUS_TOO_LARGE); ++ return -1; ++ } ++ + BN_init(&u1); + BN_init(&u2); + BN_init(&t1); +Index: crypto/openssl/crypto/rsa/rsa.h +=================================================================== +RCS file: /home/ncvs/src/crypto/openssl/crypto/rsa/rsa.h,v +retrieving revision 1.11 +diff -u -I__FBSDID -r1.11 rsa.h +--- crypto/openssl/crypto/rsa/rsa.h 25 Feb 2005 05:49:43 -0000 1.11 ++++ crypto/openssl/crypto/rsa/rsa.h 27 Sep 2006 07:03:23 -0000 +@@ -155,6 +155,17 @@ + BN_BLINDING *blinding; + }; + ++#ifndef OPENSSL_RSA_MAX_MODULUS_BITS ++# define OPENSSL_RSA_MAX_MODULUS_BITS 16400 ++#endif ++ ++#ifndef OPENSSL_RSA_SMALL_MODULUS_BITS ++# define OPENSSL_RSA_SMALL_MODULUS_BITS 4112 ++#endif ++#ifndef OPENSSL_RSA_MAX_PUBEXP_BITS ++# define OPENSSL_RSA_MAX_PUBEXP_BITS 72 /* exponent limit enforced for "large" modulus only */ ++#endif ++ + #define RSA_3 0x3L + #define RSA_F4 0x10001L + +@@ -348,6 +359,7 @@ + #define RSA_R_INVALID_MESSAGE_LENGTH 131 + #define RSA_R_IQMP_NOT_INVERSE_OF_Q 126 + #define RSA_R_KEY_SIZE_TOO_SMALL 120 ++#define RSA_R_MODULUS_TOO_LARGE 105 + #define RSA_R_NULL_BEFORE_BLOCK_MISSING 113 + #define RSA_R_N_DOES_NOT_EQUAL_P_Q 127 + #define RSA_R_OAEP_DECODING_ERROR 121 +Index: crypto/openssl/crypto/rsa/rsa_eay.c +=================================================================== +RCS file: /home/ncvs/src/crypto/openssl/crypto/rsa/rsa_eay.c,v +retrieving revision 1.13 +diff -u -I__FBSDID -r1.13 rsa_eay.c +--- crypto/openssl/crypto/rsa/rsa_eay.c 25 Feb 2005 05:49:43 -0000 1.13 ++++ crypto/openssl/crypto/rsa/rsa_eay.c 27 Sep 2006 07:03:24 -0000 +@@ -105,6 +105,28 @@ + unsigned char *buf=NULL; + BN_CTX *ctx=NULL; + ++ if (BN_num_bits(rsa->n) > OPENSSL_RSA_MAX_MODULUS_BITS) ++ { ++ RSAerr(RSA_F_RSA_EAY_PUBLIC_ENCRYPT, RSA_R_MODULUS_TOO_LARGE); ++ return -1; ++ } ++ ++ if (BN_ucmp(rsa->n, rsa->e) <= 0) ++ { ++ RSAerr(RSA_F_RSA_EAY_PUBLIC_ENCRYPT, RSA_R_BAD_E_VALUE); ++ return -1; ++ } ++ ++ /* for large moduli, enforce exponent limit */ ++ if (BN_num_bits(rsa->n) > OPENSSL_RSA_SMALL_MODULUS_BITS) ++ { ++ if (BN_num_bits(rsa->e) > OPENSSL_RSA_MAX_PUBEXP_BITS) ++ { ++ RSAerr(RSA_F_RSA_EAY_PUBLIC_ENCRYPT, RSA_R_BAD_E_VALUE); ++ return -1; ++ } ++ } ++ + BN_init(&f); + BN_init(&ret); + if ((ctx=BN_CTX_new()) == NULL) goto err; +@@ -505,6 +527,28 @@ + unsigned char *buf=NULL; + BN_CTX *ctx=NULL; + ++ if (BN_num_bits(rsa->n) > OPENSSL_RSA_MAX_MODULUS_BITS) ++ { ++ RSAerr(RSA_F_RSA_EAY_PUBLIC_DECRYPT, RSA_R_MODULUS_TOO_LARGE); ++ return -1; ++ } ++ ++ if (BN_ucmp(rsa->n, rsa->e) <= 0) ++ { ++ RSAerr(RSA_F_RSA_EAY_PUBLIC_DECRYPT, RSA_R_BAD_E_VALUE); ++ return -1; ++ } ++ ++ /* for large moduli, enforce exponent limit */ ++ if (BN_num_bits(rsa->n) > OPENSSL_RSA_SMALL_MODULUS_BITS) ++ { ++ if (BN_num_bits(rsa->e) > OPENSSL_RSA_MAX_PUBEXP_BITS) ++ { ++ RSAerr(RSA_F_RSA_EAY_PUBLIC_DECRYPT, RSA_R_BAD_E_VALUE); ++ return -1; ++ } ++ } ++ + BN_init(&f); + BN_init(&ret); + ctx=BN_CTX_new(); +Index: crypto/openssl/crypto/rsa/rsa_err.c +=================================================================== +RCS file: /home/ncvs/src/crypto/openssl/crypto/rsa/rsa_err.c,v +retrieving revision 1.1.1.4 +diff -u -I__FBSDID -r1.1.1.4 rsa_err.c +--- crypto/openssl/crypto/rsa/rsa_err.c 28 Jan 2003 21:28:58 -0000 1.1.1.4 ++++ crypto/openssl/crypto/rsa/rsa_err.c 27 Sep 2006 07:03:24 -0000 +@@ -116,6 +116,7 @@ + {RSA_R_INVALID_MESSAGE_LENGTH ,"invalid message length"}, + {RSA_R_IQMP_NOT_INVERSE_OF_Q ,"iqmp not inverse of q"}, + {RSA_R_KEY_SIZE_TOO_SMALL ,"key size too small"}, ++{RSA_R_MODULUS_TOO_LARGE ,"modulus too large"}, + {RSA_R_NULL_BEFORE_BLOCK_MISSING ,"null before block missing"}, + {RSA_R_N_DOES_NOT_EQUAL_P_Q ,"n does not equal p q"}, + {RSA_R_OAEP_DECODING_ERROR ,"oaep decoding error"}, +Index: crypto/openssl/ssl/s2_clnt.c +=================================================================== +RCS file: /home/ncvs/src/crypto/openssl/ssl/s2_clnt.c,v +retrieving revision 1.13 +diff -u -I__FBSDID -r1.13 s2_clnt.c +--- crypto/openssl/ssl/s2_clnt.c 25 Feb 2005 05:49:43 -0000 1.13 ++++ crypto/openssl/ssl/s2_clnt.c 27 Sep 2006 07:03:24 -0000 +@@ -538,7 +538,8 @@ + CRYPTO_add(&s->session->peer->references, 1, CRYPTO_LOCK_X509); + } + +- if (s->session->peer != s->session->sess_cert->peer_key->x509) ++ if (s->session->sess_cert == NULL ++ || s->session->peer != s->session->sess_cert->peer_key->x509) + /* can't happen */ + { + ssl2_return_error(s, SSL2_PE_UNDEFINED_ERROR); +Index: crypto/openssl/ssl/s3_srvr.c +=================================================================== +RCS file: /home/ncvs/src/crypto/openssl/ssl/s3_srvr.c,v +retrieving revision 1.1.1.14 +diff -u -I__FBSDID -r1.1.1.14 s3_srvr.c +--- crypto/openssl/ssl/s3_srvr.c 25 Feb 2005 05:38:27 -0000 1.1.1.14 ++++ crypto/openssl/ssl/s3_srvr.c 27 Sep 2006 07:03:25 -0000 +@@ -1733,7 +1733,7 @@ + + if (kssl_ctx->client_princ) + { +- int len = strlen(kssl_ctx->client_princ); ++ size_t len = strlen(kssl_ctx->client_princ); + if ( len < SSL_MAX_KRB5_PRINCIPAL_LENGTH ) + { + s->session->krb5_client_princ_len = len; +Index: crypto/openssl/ssl/ssl_lib.c +=================================================================== +RCS file: /home/ncvs/src/crypto/openssl/ssl/ssl_lib.c,v +retrieving revision 1.1.1.12 +diff -u -I__FBSDID -r1.1.1.12 ssl_lib.c +--- crypto/openssl/ssl/ssl_lib.c 25 Feb 2005 05:38:37 -0000 1.1.1.12 ++++ crypto/openssl/ssl/ssl_lib.c 27 Sep 2006 07:03:26 -0000 +@@ -1167,7 +1167,7 @@ + c=sk_SSL_CIPHER_value(sk,i); + for (cp=c->name; *cp; ) + { +- if (len-- == 0) ++ if (len-- <= 0) + { + *p='\0'; + return(buf); Index: user/cperciva/freebsd-update-build/patches/6.2-BETA1/3-SA-06:23.openssl-correction =================================================================== --- user/cperciva/freebsd-update-build/patches/6.2-BETA1/3-SA-06:23.openssl-correction (nonexistent) +++ user/cperciva/freebsd-update-build/patches/6.2-BETA1/3-SA-06:23.openssl-correction (revision 293366) @@ -0,0 +1,16 @@ +Index: crypto/openssl/crypto/dh/dh_key.c +=================================================================== +RCS file: /home/ncvs/src/crypto/openssl/crypto/dh/dh_key.c,v +retrieving revision 1.1.1.9.2.1 +diff -u -I__FBSDID -r1.1.1.9.2.1 dh_key.c +--- crypto/openssl/crypto/dh/dh_key.c 28 Sep 2006 13:02:36 -0000 1.1.1.9.2.1 ++++ crypto/openssl/crypto/dh/dh_key.c 29 Sep 2006 06:52:54 -0000 +@@ -167,7 +167,7 @@ + if (BN_num_bits(dh->p) > OPENSSL_DH_MAX_MODULUS_BITS) + { + DHerr(DH_F_DH_COMPUTE_KEY,DH_R_MODULUS_TOO_LARGE); +- goto err; ++ return -1; + } + + ctx = BN_CTX_new(); Index: user/cperciva/freebsd-update-build/patches/6.2-BETA1/4-SA-06:22.openssh =================================================================== --- user/cperciva/freebsd-update-build/patches/6.2-BETA1/4-SA-06:22.openssh (nonexistent) +++ user/cperciva/freebsd-update-build/patches/6.2-BETA1/4-SA-06:22.openssh (revision 293366) @@ -0,0 +1,295 @@ +Index: crypto/openssh/auth.h +=================================================================== +RCS file: /home/ncvs/src/crypto/openssh/auth.h,v +retrieving revision 1.15.2.1 +diff -u -d -r1.15.2.1 auth.h +--- crypto/openssh/auth.h 11 Sep 2005 16:50:34 -0000 1.15.2.1 ++++ crypto/openssh/auth.h 30 Sep 2006 16:38:10 -0000 +@@ -50,6 +50,7 @@ + + struct Authctxt { + int success; ++ int authenticated; /* authenticated and alarms cancelled */ + int postponed; /* authentication needs another step */ + int valid; /* user exists and is allowed to login */ + int attempt; +Index: crypto/openssh/deattack.c +=================================================================== +RCS file: /home/ncvs/src/crypto/openssh/deattack.c,v +retrieving revision 1.1.1.7 +diff -u -d -r1.1.1.7 deattack.c +--- crypto/openssh/deattack.c 7 Jan 2004 11:10:03 -0000 1.1.1.7 ++++ crypto/openssh/deattack.c 30 Sep 2006 16:38:10 -0000 +@@ -27,6 +27,24 @@ + #include "xmalloc.h" + #include "deattack.h" + ++/* ++ * CRC attack detection has a worst-case behaviour that is O(N^3) over ++ * the number of identical blocks in a packet. This behaviour can be ++ * exploited to create a limited denial of service attack. ++ * ++ * However, because we are dealing with encrypted data, identical ++ * blocks should only occur every 2^35 maximally-sized packets or so. ++ * Consequently, we can detect this DoS by looking for identical blocks ++ * in a packet. ++ * ++ * The parameter below determines how many identical blocks we will ++ * accept in a single packet, trading off between attack detection and ++ * likelihood of terminating a legitimate connection. A value of 32 ++ * corresponds to an average of 2^40 messages before an attack is ++ * misdetected ++ */ ++#define MAX_IDENTICAL 32 ++ + /* SSH Constants */ + #define SSH_MAXBLOCKS (32 * 1024) + #define SSH_BLOCKSIZE (8) +@@ -87,7 +105,7 @@ + static u_int16_t *h = (u_int16_t *) NULL; + static u_int32_t n = HASH_MINSIZE / HASH_ENTRYSIZE; + u_int32_t i, j; +- u_int32_t l; ++ u_int32_t l, same; + u_char *c; + u_char *d; + +@@ -133,7 +151,7 @@ + if (IV) + h[HASH(IV) & (n - 1)] = HASH_IV; + +- for (c = buf, j = 0; c < (buf + len); c += SSH_BLOCKSIZE, j++) { ++ for (c = buf, same = j = 0; c < (buf + len); c += SSH_BLOCKSIZE, j++) { + for (i = HASH(c) & (n - 1); h[i] != HASH_UNUSED; + i = (i + 1) & (n - 1)) { + if (h[i] == HASH_IV) { +@@ -144,6 +162,8 @@ + break; + } + } else if (!CMP(c, buf + h[i] * SSH_BLOCKSIZE)) { ++ if (++same > MAX_IDENTICAL) ++ return (DEATTACK_DOS_DETECTED); + if (check_crc(c, buf, len, IV)) + return (DEATTACK_DETECTED); + else +Index: crypto/openssh/deattack.h +=================================================================== +RCS file: /home/ncvs/src/crypto/openssh/deattack.h,v +retrieving revision 1.1.1.3 +diff -u -d -r1.1.1.3 deattack.h +--- crypto/openssh/deattack.h 18 Mar 2002 09:54:55 -0000 1.1.1.3 ++++ crypto/openssh/deattack.h 30 Sep 2006 16:38:10 -0000 +@@ -25,6 +25,7 @@ + /* Return codes */ + #define DEATTACK_OK 0 + #define DEATTACK_DETECTED 1 ++#define DEATTACK_DOS_DETECTED 2 + + int detect_attack(u_char *, u_int32_t, u_char[8]); + #endif +Index: crypto/openssh/defines.h +=================================================================== +RCS file: /home/ncvs/src/crypto/openssh/defines.h,v +retrieving revision 1.1.1.9.2.1 +diff -u -d -r1.1.1.9.2.1 defines.h +--- crypto/openssh/defines.h 11 Sep 2005 16:50:34 -0000 1.1.1.9.2.1 ++++ crypto/openssh/defines.h 30 Sep 2006 16:38:10 -0000 +@@ -540,6 +540,11 @@ + # undef HAVE_UPDWTMPX + #endif + ++#if defined(HAVE_OPENLOG_R) && defined(SYSLOG_DATA_INIT) && \ ++ defined(SYSLOG_R_SAFE_IN_SIGHAND) ++# define DO_LOG_SAFE_IN_SIGHAND ++#endif ++ + #if !defined(HAVE_MEMMOVE) && defined(HAVE_BCOPY) + # define memmove(s1, s2, n) bcopy((s2), (s1), (n)) + #endif /* !defined(HAVE_MEMMOVE) && defined(HAVE_BCOPY) */ +Index: crypto/openssh/log.c +=================================================================== +RCS file: /home/ncvs/src/crypto/openssh/log.c,v +retrieving revision 1.1.1.13 +diff -u -d -r1.1.1.13 log.c +--- crypto/openssh/log.c 5 Jun 2005 15:41:49 -0000 1.1.1.13 ++++ crypto/openssh/log.c 30 Sep 2006 16:38:10 -0000 +@@ -130,6 +130,20 @@ + va_end(args); + } + ++void ++sigdie(const char *fmt,...) ++{ ++ va_list args; ++ ++#ifdef DO_LOG_SAFE_IN_SIGHAND ++ va_start(args, fmt); ++ do_log(SYSLOG_LEVEL_FATAL, fmt, args); ++ va_end(args); ++#endif ++ _exit(1); ++} ++ ++ + /* Log this message (information that usually should go to the log). */ + + void +Index: crypto/openssh/log.h +=================================================================== +RCS file: /home/ncvs/src/crypto/openssh/log.h,v +retrieving revision 1.6 +diff -u -d -r1.6 log.h +--- crypto/openssh/log.h 28 Oct 2004 16:11:28 -0000 1.6 ++++ crypto/openssh/log.h 30 Sep 2006 16:38:10 -0000 +@@ -64,6 +64,7 @@ + + void fatal(const char *, ...) __dead __attribute__((format(printf, 1, 2))); + void error(const char *, ...) __attribute__((format(printf, 1, 2))); ++void sigdie(const char *, ...) __attribute__((format(printf, 1, 2))); + void logit(const char *, ...) __attribute__((format(printf, 1, 2))); + void verbose(const char *, ...) __attribute__((format(printf, 1, 2))); + void debug(const char *, ...) __attribute__((format(printf, 1, 2))); +Index: crypto/openssh/packet.c +=================================================================== +RCS file: /home/ncvs/src/crypto/openssh/packet.c,v +retrieving revision 1.1.1.16.2.1 +diff -u -d -r1.1.1.16.2.1 packet.c +--- crypto/openssh/packet.c 11 Sep 2005 16:50:34 -0000 1.1.1.16.2.1 ++++ crypto/openssh/packet.c 30 Sep 2006 18:26:30 -0000 +@@ -978,9 +978,16 @@ + * (C)1998 CORE-SDI, Buenos Aires Argentina + * Ariel Futoransky(futo@core-sdi.com) + */ +- if (!receive_context.plaintext && +- detect_attack(buffer_ptr(&input), padded_len, NULL) == DEATTACK_DETECTED) +- packet_disconnect("crc32 compensation attack: network attack detected"); ++ if (!receive_context.plaintext) { ++ switch (detect_attack(buffer_ptr(&input), padded_len, NULL)) { ++ case DEATTACK_DETECTED: ++ packet_disconnect("crc32 compensation attack: " ++ "network attack detected"); ++ case DEATTACK_DOS_DETECTED: ++ packet_disconnect("deattack denial of " ++ "service detected"); ++ } ++ } + + /* Decrypt data to incoming_packet. */ + buffer_clear(&incoming_packet); +Index: crypto/openssh/session.c +=================================================================== +RCS file: /home/ncvs/src/crypto/openssh/session.c,v +retrieving revision 1.46.2.1 +diff -u -d -r1.46.2.1 session.c +--- crypto/openssh/session.c 11 Sep 2005 16:50:34 -0000 1.46.2.1 ++++ crypto/openssh/session.c 30 Sep 2006 16:38:10 -0000 +@@ -2472,7 +2472,7 @@ + return; + called = 1; + +- if (authctxt == NULL) ++ if (authctxt == NULL || !authctxt->authenticated) + return; + #ifdef KRB5 + if (options.kerberos_ticket_cleanup && +Index: crypto/openssh/ssh_config +=================================================================== +RCS file: /home/ncvs/src/crypto/openssh/ssh_config,v +retrieving revision 1.27.2.1 +diff -u -d -r1.27.2.1 ssh_config +--- crypto/openssh/ssh_config 11 Sep 2005 16:50:35 -0000 1.27.2.1 ++++ crypto/openssh/ssh_config 30 Sep 2006 16:38:10 -0000 +@@ -38,4 +38,4 @@ + # Cipher 3des + # Ciphers aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour,aes192-cbc,aes256-cbc + # EscapeChar ~ +-# VersionAddendum FreeBSD-20050903 ++# VersionAddendum FreeBSD-20060930 +Index: crypto/openssh/ssh_config.5 +=================================================================== +RCS file: /home/ncvs/src/crypto/openssh/ssh_config.5,v +retrieving revision 1.17.2.1 +diff -u -d -r1.17.2.1 ssh_config.5 +--- crypto/openssh/ssh_config.5 11 Sep 2005 16:50:35 -0000 1.17.2.1 ++++ crypto/openssh/ssh_config.5 30 Sep 2006 16:38:10 -0000 +@@ -900,7 +900,7 @@ + Specifies a string to append to the regular version string to identify + OS- or site-specific modifications. + The default is +-.Dq FreeBSD-20050903 . ++.Dq FreeBSD-20060930 . + .It Cm XAuthLocation + Specifies the full pathname of the + .Xr xauth 1 +Index: crypto/openssh/sshd.c +=================================================================== +RCS file: /home/ncvs/src/crypto/openssh/sshd.c,v +retrieving revision 1.39.2.1 +diff -u -d -r1.39.2.1 sshd.c +--- crypto/openssh/sshd.c 11 Sep 2005 16:50:35 -0000 1.39.2.1 ++++ crypto/openssh/sshd.c 30 Sep 2006 16:38:10 -0000 +@@ -317,7 +317,7 @@ + kill(pmonitor->m_pid, SIGALRM); + + /* Log error and exit. */ +- fatal("Timeout before authentication for %s", get_remote_ipaddr()); ++ sigdie("Timeout before authentication for %s", get_remote_ipaddr()); + } + + /* +@@ -1730,6 +1730,7 @@ + } + + authenticated: ++ authctxt->authenticated = 1; + #ifdef SSH_AUDIT_EVENTS + audit_event(SSH_AUTH_SUCCESS); + #endif +Index: crypto/openssh/sshd_config +=================================================================== +RCS file: /home/ncvs/src/crypto/openssh/sshd_config,v +retrieving revision 1.42.2.1 +diff -u -d -r1.42.2.1 sshd_config +--- crypto/openssh/sshd_config 11 Sep 2005 16:50:35 -0000 1.42.2.1 ++++ crypto/openssh/sshd_config 30 Sep 2006 16:38:10 -0000 +@@ -14,7 +14,7 @@ + # Note that some of FreeBSD's defaults differ from OpenBSD's, and + # FreeBSD has a few additional options. + +-#VersionAddendum FreeBSD-20050903 ++#VersionAddendum FreeBSD-20060930 + + #Port 22 + #Protocol 2 +Index: crypto/openssh/sshd_config.5 +=================================================================== +RCS file: /home/ncvs/src/crypto/openssh/sshd_config.5,v +retrieving revision 1.23.2.1 +diff -u -d -r1.23.2.1 sshd_config.5 +--- crypto/openssh/sshd_config.5 11 Sep 2005 16:50:35 -0000 1.23.2.1 ++++ crypto/openssh/sshd_config.5 30 Sep 2006 16:38:10 -0000 +@@ -725,7 +725,7 @@ + Specifies a string to append to the regular version string to identify + OS- or site-specific modifications. + The default is +-.Dq FreeBSD-20050903 . ++.Dq FreeBSD-20060930 . + .It Cm X11DisplayOffset + Specifies the first display number available for + .Nm sshd Ns 's +Index: crypto/openssh/version.h +=================================================================== +RCS file: /home/ncvs/src/crypto/openssh/version.h,v +retrieving revision 1.30.2.1 +diff -u -d -r1.30.2.1 version.h +--- crypto/openssh/version.h 11 Sep 2005 16:50:35 -0000 1.30.2.1 ++++ crypto/openssh/version.h 30 Sep 2006 16:38:10 -0000 +@@ -6,7 +6,7 @@ + #define SSH_VERSION (ssh_version_get()) + #define SSH_RELEASE (ssh_version_get()) + #define SSH_VERSION_BASE "OpenSSH_4.2p1" +-#define SSH_VERSION_ADDENDUM "FreeBSD-20050903" ++#define SSH_VERSION_ADDENDUM "FreeBSD-20060930" + + const char *ssh_version_get(void); + void ssh_version_set_addendum(const char *add); Index: user/cperciva/freebsd-update-build/patches/6.2-BETA3/1-SA-06:24.libarchive =================================================================== --- user/cperciva/freebsd-update-build/patches/6.2-BETA3/1-SA-06:24.libarchive (nonexistent) +++ user/cperciva/freebsd-update-build/patches/6.2-BETA3/1-SA-06:24.libarchive (revision 293366) @@ -0,0 +1,55 @@ +Index: lib/libarchive/archive_read_support_compression_none.c +=================================================================== +RCS file: /home/ncvs/src/lib/libarchive/archive_read_support_compression_none.c,v +retrieving revision 1.8 +diff -u -I__FBSDID -r1.8 archive_read_support_compression_none.c +--- lib/libarchive/archive_read_support_compression_none.c 29 Aug 2006 04:59:25 -0000 1.8 ++++ lib/libarchive/archive_read_support_compression_none.c 2 Nov 2006 05:17:28 -0000 +@@ -257,7 +257,9 @@ + } + + /* +- * Skip at most request bytes. Skipped data is marked as consumed. ++ * Skip forward by exactly the requested bytes or else return ++ * ARCHIVE_FATAL. Note that this differs from the contract for ++ * read_ahead, which does not gaurantee a minimum count. + */ + static ssize_t + archive_decompressor_none_skip(struct archive *a, size_t request) +@@ -287,9 +289,7 @@ + if (request == 0) + return (total_bytes_skipped); + /* +- * If no client_skipper is provided, just read the old way. It is very +- * likely that after skipping, the request has not yet been fully +- * satisfied (and is still > 0). In that case, read as well. ++ * If a client_skipper was provided, try that first. + */ + if (a->client_skipper != NULL) { + bytes_skipped = (a->client_skipper)(a, a->client_data, +@@ -307,6 +307,12 @@ + a->raw_position += bytes_skipped; + state->client_avail = state->client_total = 0; + } ++ /* ++ * Note that client_skipper will usually not satisfy the ++ * full request (due to low-level blocking concerns), ++ * so even if client_skipper is provided, we may still ++ * have to use ordinary reads to finish out the request. ++ */ + while (request > 0) { + const void* dummy_buffer; + ssize_t bytes_read; +@@ -314,6 +320,12 @@ + &dummy_buffer, request); + if (bytes_read < 0) + return (bytes_read); ++ if (bytes_read == 0) { ++ /* We hit EOF before we satisfied the skip request. */ ++ archive_set_error(a, ARCHIVE_ERRNO_MISC, ++ "Truncated input file (need to skip %d bytes)", (int)request); ++ return (ARCHIVE_FATAL); ++ } + assert(bytes_read >= 0); /* precondition for cast below */ + min = minimum((size_t)bytes_read, request); + bytes_read = archive_decompressor_none_read_consume(a, min); Index: user/cperciva/freebsd-update-build/patches/6.2-RC1/1-SA-06:25.kmem =================================================================== --- user/cperciva/freebsd-update-build/patches/6.2-RC1/1-SA-06:25.kmem (nonexistent) +++ user/cperciva/freebsd-update-build/patches/6.2-RC1/1-SA-06:25.kmem (revision 293366) @@ -0,0 +1,16 @@ +Index: sys/dev/firewire/fwdev.c +=================================================================== +RCS file: /home/ncvs/src/sys/dev/firewire/fwdev.c,v +retrieving revision 1.47 +diff -u -I__FBSDID -r1.47 fwdev.c +--- sys/dev/firewire/fwdev.c 8 Aug 2005 19:55:30 -0000 1.47 ++++ sys/dev/firewire/fwdev.c 30 Nov 2006 22:15:06 -0000 +@@ -712,7 +712,7 @@ + else + len = fwdev->rommax - CSRROMOFF + 4; + } +- if (crom_buf->len < len) ++ if (crom_buf->len < len && crom_buf->len >= 0) + len = crom_buf->len; + else + crom_buf->len = len; Index: user/cperciva/freebsd-update-build/patches/6.2-RC1/2-SA-07:01.jail =================================================================== --- user/cperciva/freebsd-update-build/patches/6.2-RC1/2-SA-07:01.jail (nonexistent) +++ user/cperciva/freebsd-update-build/patches/6.2-RC1/2-SA-07:01.jail (revision 293366) @@ -0,0 +1,214 @@ +Index: etc/rc.d/jail +=================================================================== +RCS file: /home/ncvs/src/etc/rc.d/jail,v +retrieving revision 1.23.2.8 +diff -u -d -r1.23.2.8 jail +--- etc/rc.d/jail 2 Jan 2007 11:14:07 -0000 1.23.2.8 ++++ etc/rc.d/jail 9 Jan 2007 21:34:33 -0000 +@@ -67,6 +67,8 @@ + [ -z "${_fstab}" ] && _fstab="/etc/fstab.${_j}" + eval _flags=\"\${jail_${_j}_flags:-${jail_flags}}\" + [ -z "${_flags}" ] && _flags="-l -U root" ++ eval _consolelog=\"\${jail_${_j}_consolelog:-${jail_consolelog}}\" ++ [ -z "${_consolelog}" ] && _consolelog="/var/log/jail_${_j}_console.log" + + # Debugging aid + # +@@ -86,6 +88,7 @@ + debug "$_j exec start: $_exec_start" + debug "$_j exec stop: $_exec_stop" + debug "$_j flags: $_flags" ++ debug "$_j consolelog: $_consolelog" + + if [ -z "${_hostname}" ]; then + err 3 "$name: No hostname has been defined for ${_j}" +@@ -126,6 +129,56 @@ + fi + } + ++# is_current_mountpoint() ++# Is the directory mount point for a currently mounted file ++# system? ++# ++is_current_mountpoint() ++{ ++ local _dir _dir2 ++ ++ _dir=$1 ++ ++ _dir=`echo $_dir | sed -Ee 's#//+#/#g' -e 's#/$##'` ++ [ ! -d "${_dir}" ] && return 1 ++ _dir2=`df ${_dir} | tail +2 | awk '{ print $6 }'` ++ [ "${_dir}" = "${_dir2}" ] ++ return $? ++} ++ ++# is_symlinked_mountpoint() ++# Is a mount point, or any of its parent directories, a symlink? ++# ++is_symlinked_mountpoint() ++{ ++ local _dir ++ ++ _dir=$1 ++ ++ [ -L "$_dir" ] && return 0 ++ [ "$_dir" = "/" ] && return 1 ++ is_symlinked_mountpoint `dirname $_dir` ++ return $? ++} ++ ++# secure_umount ++# Try to unmount a mount point without being vulnerable to ++# symlink attacks. ++# ++secure_umount() ++{ ++ local _dir ++ ++ _dir=$1 ++ ++ if is_current_mountpoint ${_dir}; then ++ umount -f ${_dir} >/dev/null 2>&1 ++ else ++ debug "Nothing mounted on ${_dir} - not unmounting" ++ fi ++} ++ ++ + # jail_umount_fs + # This function unmounts certain special filesystems in the + # currently selected jail. The caller must call the init_variables() +@@ -133,27 +186,65 @@ + # + jail_umount_fs() + { ++ local _device _mountpt _rest ++ + if checkyesno _fdescfs; then + if [ -d "${_fdescdir}" ] ; then +- umount -f ${_fdescdir} >/dev/null 2>&1 ++ secure_umount ${_fdescdir} + fi + fi + if checkyesno _devfs; then + if [ -d "${_devdir}" ] ; then +- umount -f ${_devdir} >/dev/null 2>&1 ++ secure_umount ${_devdir} + fi + fi + if checkyesno _procfs; then + if [ -d "${_procdir}" ] ; then +- umount -f ${_procdir} >/dev/null 2>&1 ++ secure_umount ${_procdir} + fi + fi + if checkyesno _mount; then + [ -f "${_fstab}" ] || warn "${_fstab} does not exist" +- umount -a -F "${_fstab}" >/dev/null 2>&1 ++ tail -r ${_fstab} | while read _device _mountpt _rest; do ++ case ":${_device}" in ++ :#* | :) ++ continue ++ ;; ++ esac ++ secure_umount ${_mountpt} ++ done + fi + } + ++# jail_mount_fstab() ++# Mount file systems from a per jail fstab while trying to ++# secure against symlink attacks at the mount points. ++# ++# If we are certain we cannot secure against symlink attacks we ++# do not mount all of the file systems (since we cannot just not ++# mount the file system with the problematic mount point). ++# ++# The caller must call the init_variables() routine before ++# calling this one. ++# ++jail_mount_fstab() ++{ ++ local _device _mountpt _rest ++ ++ while read _device _mountpt _rest; do ++ case ":${_device}" in ++ :#* | :) ++ continue ++ ;; ++ esac ++ if is_symlinked_mountpoint ${_mountpt}; then ++ warn "${_mountpt} has symlink as parent - not mounting from ${_fstab}" ++ return ++ fi ++ done <${_fstab} ++ mount -a -F "${_fstab}" ++} ++ + jail_start() + { + echo -n 'Configuring jails:' +@@ -183,12 +274,16 @@ + if [ ! -f "${_fstab}" ]; then + err 3 "$name: ${_fstab} does not exist" + fi +- mount -a -F "${_fstab}" ++ jail_mount_fstab + fi + if checkyesno _devfs; then + # If devfs is already mounted here, skip it. + df -t devfs "${_devdir}" >/dev/null + if [ $? -ne 0 ]; then ++ if is_symlinked_mountpoint ${_devdir}; then ++ warn "${_devdir} has symlink as parent - not starting jail ${_jail}" ++ continue ++ fi + info "Mounting devfs on ${_devdir}" + devfs_mount_jail "${_devdir}" ${_ruleset} + # Transitional symlink for old binaries +@@ -209,13 +304,21 @@ + # cd "$__pwd" + fi + if checkyesno _fdescfs; then +- info "Mounting fdescfs on ${_fdescdir}" +- mount -t fdescfs fdesc "${_fdescdir}" ++ if is_symlinked_mountpoint ${_fdescdir}; then ++ warn "${_fdescdir} has symlink as parent, not mounting" ++ else ++ info "Mounting fdescfs on ${_fdescdir}" ++ mount -t fdescfs fdesc "${_fdescdir}" ++ fi + fi + if checkyesno _procfs; then +- info "Mounting procfs onto ${_procdir}" +- if [ -d "${_procdir}" ] ; then +- mount -t procfs proc "${_procdir}" ++ if is_symlinked_mountpoint ${_procdir}; then ++ warn "${_procdir} has symlink as parent, not mounting" ++ else ++ info "Mounting procfs onto ${_procdir}" ++ if [ -d "${_procdir}" ] ; then ++ mount -t procfs proc "${_procdir}" ++ fi + fi + fi + _tmp_jail=${_tmp_dir}/jail.$$ +@@ -224,7 +327,7 @@ + if [ "$?" -eq 0 ] ; then + echo -n " $_hostname" + _jail_id=$(head -1 ${_tmp_jail}) +- tail +2 ${_tmp_jail} >${_rootdir}/var/log/console.log ++ tail +2 ${_tmp_jail} >${_consolelog} + echo ${_jail_id} > /var/run/jail_${_jail}.id + else + jail_umount_fs +@@ -251,7 +354,7 @@ + init_variables $_jail + if [ -n "${_exec_stop}" ]; then + eval env -i /usr/sbin/jexec ${_jail_id} ${_exec_stop} \ +- >> ${_rootdir}/var/log/console.log 2>&1 ++ >> ${_consolelog} 2>&1 + fi + killall -j ${_jail_id} -TERM > /dev/null 2>&1 + sleep 1 Index: user/cperciva/freebsd-update-build/patches/6.2-RC2/1-SA-07:01.jail =================================================================== --- user/cperciva/freebsd-update-build/patches/6.2-RC2/1-SA-07:01.jail (nonexistent) +++ user/cperciva/freebsd-update-build/patches/6.2-RC2/1-SA-07:01.jail (revision 293366) @@ -0,0 +1,214 @@ +Index: etc/rc.d/jail +=================================================================== +RCS file: /home/ncvs/src/etc/rc.d/jail,v +retrieving revision 1.23.2.8 +diff -u -d -r1.23.2.8 jail +--- etc/rc.d/jail 2 Jan 2007 11:14:07 -0000 1.23.2.8 ++++ etc/rc.d/jail 9 Jan 2007 21:34:33 -0000 +@@ -67,6 +67,8 @@ + [ -z "${_fstab}" ] && _fstab="/etc/fstab.${_j}" + eval _flags=\"\${jail_${_j}_flags:-${jail_flags}}\" + [ -z "${_flags}" ] && _flags="-l -U root" ++ eval _consolelog=\"\${jail_${_j}_consolelog:-${jail_consolelog}}\" ++ [ -z "${_consolelog}" ] && _consolelog="/var/log/jail_${_j}_console.log" + + # Debugging aid + # +@@ -86,6 +88,7 @@ + debug "$_j exec start: $_exec_start" + debug "$_j exec stop: $_exec_stop" + debug "$_j flags: $_flags" ++ debug "$_j consolelog: $_consolelog" + + if [ -z "${_hostname}" ]; then + err 3 "$name: No hostname has been defined for ${_j}" +@@ -126,6 +129,56 @@ + fi + } + ++# is_current_mountpoint() ++# Is the directory mount point for a currently mounted file ++# system? ++# ++is_current_mountpoint() ++{ ++ local _dir _dir2 ++ ++ _dir=$1 ++ ++ _dir=`echo $_dir | sed -Ee 's#//+#/#g' -e 's#/$##'` ++ [ ! -d "${_dir}" ] && return 1 ++ _dir2=`df ${_dir} | tail +2 | awk '{ print $6 }'` ++ [ "${_dir}" = "${_dir2}" ] ++ return $? ++} ++ ++# is_symlinked_mountpoint() ++# Is a mount point, or any of its parent directories, a symlink? ++# ++is_symlinked_mountpoint() ++{ ++ local _dir ++ ++ _dir=$1 ++ ++ [ -L "$_dir" ] && return 0 ++ [ "$_dir" = "/" ] && return 1 ++ is_symlinked_mountpoint `dirname $_dir` ++ return $? ++} ++ ++# secure_umount ++# Try to unmount a mount point without being vulnerable to ++# symlink attacks. ++# ++secure_umount() ++{ ++ local _dir ++ ++ _dir=$1 ++ ++ if is_current_mountpoint ${_dir}; then ++ umount -f ${_dir} >/dev/null 2>&1 ++ else ++ debug "Nothing mounted on ${_dir} - not unmounting" ++ fi ++} ++ ++ + # jail_umount_fs + # This function unmounts certain special filesystems in the + # currently selected jail. The caller must call the init_variables() +@@ -133,27 +186,65 @@ + # + jail_umount_fs() + { ++ local _device _mountpt _rest ++ + if checkyesno _fdescfs; then + if [ -d "${_fdescdir}" ] ; then +- umount -f ${_fdescdir} >/dev/null 2>&1 ++ secure_umount ${_fdescdir} + fi + fi + if checkyesno _devfs; then + if [ -d "${_devdir}" ] ; then +- umount -f ${_devdir} >/dev/null 2>&1 ++ secure_umount ${_devdir} + fi + fi + if checkyesno _procfs; then + if [ -d "${_procdir}" ] ; then +- umount -f ${_procdir} >/dev/null 2>&1 ++ secure_umount ${_procdir} + fi + fi + if checkyesno _mount; then + [ -f "${_fstab}" ] || warn "${_fstab} does not exist" +- umount -a -F "${_fstab}" >/dev/null 2>&1 ++ tail -r ${_fstab} | while read _device _mountpt _rest; do ++ case ":${_device}" in ++ :#* | :) ++ continue ++ ;; ++ esac ++ secure_umount ${_mountpt} ++ done + fi + } + ++# jail_mount_fstab() ++# Mount file systems from a per jail fstab while trying to ++# secure against symlink attacks at the mount points. ++# ++# If we are certain we cannot secure against symlink attacks we ++# do not mount all of the file systems (since we cannot just not ++# mount the file system with the problematic mount point). ++# ++# The caller must call the init_variables() routine before ++# calling this one. ++# ++jail_mount_fstab() ++{ ++ local _device _mountpt _rest ++ ++ while read _device _mountpt _rest; do ++ case ":${_device}" in ++ :#* | :) ++ continue ++ ;; ++ esac ++ if is_symlinked_mountpoint ${_mountpt}; then ++ warn "${_mountpt} has symlink as parent - not mounting from ${_fstab}" ++ return ++ fi ++ done <${_fstab} ++ mount -a -F "${_fstab}" ++} ++ + jail_start() + { + echo -n 'Configuring jails:' +@@ -183,12 +274,16 @@ + if [ ! -f "${_fstab}" ]; then + err 3 "$name: ${_fstab} does not exist" + fi +- mount -a -F "${_fstab}" ++ jail_mount_fstab + fi + if checkyesno _devfs; then + # If devfs is already mounted here, skip it. + df -t devfs "${_devdir}" >/dev/null + if [ $? -ne 0 ]; then ++ if is_symlinked_mountpoint ${_devdir}; then ++ warn "${_devdir} has symlink as parent - not starting jail ${_jail}" ++ continue ++ fi + info "Mounting devfs on ${_devdir}" + devfs_mount_jail "${_devdir}" ${_ruleset} + # Transitional symlink for old binaries +@@ -209,13 +304,21 @@ + # cd "$__pwd" + fi + if checkyesno _fdescfs; then +- info "Mounting fdescfs on ${_fdescdir}" +- mount -t fdescfs fdesc "${_fdescdir}" ++ if is_symlinked_mountpoint ${_fdescdir}; then ++ warn "${_fdescdir} has symlink as parent, not mounting" ++ else ++ info "Mounting fdescfs on ${_fdescdir}" ++ mount -t fdescfs fdesc "${_fdescdir}" ++ fi + fi + if checkyesno _procfs; then +- info "Mounting procfs onto ${_procdir}" +- if [ -d "${_procdir}" ] ; then +- mount -t procfs proc "${_procdir}" ++ if is_symlinked_mountpoint ${_procdir}; then ++ warn "${_procdir} has symlink as parent, not mounting" ++ else ++ info "Mounting procfs onto ${_procdir}" ++ if [ -d "${_procdir}" ] ; then ++ mount -t procfs proc "${_procdir}" ++ fi + fi + fi + _tmp_jail=${_tmp_dir}/jail.$$ +@@ -224,7 +327,7 @@ + if [ "$?" -eq 0 ] ; then + echo -n " $_hostname" + _jail_id=$(head -1 ${_tmp_jail}) +- tail +2 ${_tmp_jail} >${_rootdir}/var/log/console.log ++ tail +2 ${_tmp_jail} >${_consolelog} + echo ${_jail_id} > /var/run/jail_${_jail}.id + else + jail_umount_fs +@@ -251,7 +354,7 @@ + init_variables $_jail + if [ -n "${_exec_stop}" ]; then + eval env -i /usr/sbin/jexec ${_jail_id} ${_exec_stop} \ +- >> ${_rootdir}/var/log/console.log 2>&1 ++ >> ${_consolelog} 2>&1 + fi + killall -j ${_jail_id} -TERM > /dev/null 2>&1 + sleep 1 Index: user/cperciva/freebsd-update-build/patches/6.3-BETA1/1-SA-07:09.random =================================================================== --- user/cperciva/freebsd-update-build/patches/6.3-BETA1/1-SA-07:09.random (nonexistent) +++ user/cperciva/freebsd-update-build/patches/6.3-BETA1/1-SA-07:09.random (revision 293366) @@ -0,0 +1,15 @@ +Index: sys/dev/random/yarrow.c +=================================================================== +RCS file: /usr/ncvs/src/sys/dev/random/yarrow.c,v +retrieving revision 1.47 +diff -u -r1.47 yarrow.c +--- sys/dev/random/yarrow.c 27 May 2007 18:54:58 -0000 1.47 ++++ sys/dev/random/yarrow.c 27 Nov 2007 17:17:29 -0000 +@@ -296,6 +296,7 @@ + random_state.outputblocks = 0; + } + retval += (int)tomove; ++ cur = 0; + } + } + else { Index: user/cperciva/freebsd-update-build/patches/6.3-BETA2/1-SA-07:09.random =================================================================== --- user/cperciva/freebsd-update-build/patches/6.3-BETA2/1-SA-07:09.random (nonexistent) +++ user/cperciva/freebsd-update-build/patches/6.3-BETA2/1-SA-07:09.random (revision 293366) @@ -0,0 +1,15 @@ +Index: sys/dev/random/yarrow.c +=================================================================== +RCS file: /usr/ncvs/src/sys/dev/random/yarrow.c,v +retrieving revision 1.47 +diff -u -r1.47 yarrow.c +--- sys/dev/random/yarrow.c 27 May 2007 18:54:58 -0000 1.47 ++++ sys/dev/random/yarrow.c 27 Nov 2007 17:17:29 -0000 +@@ -296,6 +296,7 @@ + random_state.outputblocks = 0; + } + retval += (int)tomove; ++ cur = 0; + } + } + else { Index: user/cperciva/freebsd-update-build/patches/6.3-RC1/1-SA-07:09.random =================================================================== --- user/cperciva/freebsd-update-build/patches/6.3-RC1/1-SA-07:09.random (nonexistent) +++ user/cperciva/freebsd-update-build/patches/6.3-RC1/1-SA-07:09.random (revision 293366) @@ -0,0 +1,15 @@ +Index: sys/dev/random/yarrow.c +=================================================================== +RCS file: /usr/ncvs/src/sys/dev/random/yarrow.c,v +retrieving revision 1.47 +diff -u -r1.47 yarrow.c +--- sys/dev/random/yarrow.c 27 May 2007 18:54:58 -0000 1.47 ++++ sys/dev/random/yarrow.c 27 Nov 2007 17:17:29 -0000 +@@ -296,6 +296,7 @@ + random_state.outputblocks = 0; + } + retval += (int)tomove; ++ cur = 0; + } + } + else { Index: user/cperciva/freebsd-update-build/patches/6.3-RC2/1-SA-08:01.pty =================================================================== --- user/cperciva/freebsd-update-build/patches/6.3-RC2/1-SA-08:01.pty (nonexistent) +++ user/cperciva/freebsd-update-build/patches/6.3-RC2/1-SA-08:01.pty (revision 293366) @@ -0,0 +1,93 @@ +Index: lib/libc/stdlib/grantpt.c +=================================================================== +RCS file: /home/ncvs/src/lib/libc/stdlib/grantpt.c,v +retrieving revision 1.4.10.1 +diff -u -I__FBSDID -I$FreeBSD -r1.4.10.1 grantpt.c +--- lib/libc/stdlib/grantpt.c 18 Dec 2007 00:36:21 -0000 1.4.10.1 ++++ lib/libc/stdlib/grantpt.c 10 Jan 2008 20:54:30 -0000 +@@ -214,24 +214,30 @@ + ptsname(int fildes) + { + static char slave[] = _PATH_DEV PTS_PREFIX "XY"; +- char *retval; ++ const char *master; + struct stat sbuf; + +- retval = NULL; +- +- if (_fstat(fildes, &sbuf) == 0) { +- if (!ISPTM(sbuf)) +- errno = EINVAL; +- else { +- (void)snprintf(slave, sizeof(slave), +- _PATH_DEV PTS_PREFIX "%s", +- devname(sbuf.st_rdev, S_IFCHR) + +- strlen(PTM_PREFIX)); +- retval = slave; +- } +- } +- +- return (retval); ++ /* All master pty's must be char devices. */ ++ if (_fstat(fildes, &sbuf) == -1) ++ goto invalid; ++ if (!S_ISCHR(sbuf.st_mode)) ++ goto invalid; ++ ++ /* Check to see if this device is a pty(4) master. */ ++ master = devname(sbuf.st_rdev, S_IFCHR); ++ if (strlen(master) != strlen(PTM_PREFIX "XY")) ++ goto invalid; ++ if (strncmp(master, PTM_PREFIX, strlen(PTM_PREFIX)) != 0) ++ goto invalid; ++ ++ /* It is, so generate the corresponding pty(4) slave name. */ ++ (void)snprintf(slave, sizeof(slave), _PATH_DEV PTS_PREFIX "%s", ++ master + strlen(PTM_PREFIX)); ++ return (slave); ++ ++invalid: ++ errno = EINVAL; ++ return (NULL); + } + + /* +@@ -240,18 +246,14 @@ + int + unlockpt(int fildes) + { +- int retval; +- struct stat sbuf; + + /* + * Unlocking a master/slave pseudo-terminal pair has no meaning in a + * non-streams PTY environment. However, we do ensure fildes is a + * valid master pseudo-terminal device. + */ +- if ((retval = _fstat(fildes, &sbuf)) == 0 && !ISPTM(sbuf)) { +- errno = EINVAL; +- retval = -1; +- } ++ if (ptsname(fildes) == NULL) ++ return (-1); + +- return (retval); ++ return (0); + } +Index: lib/libutil/pty.c +=================================================================== +RCS file: /home/ncvs/src/lib/libutil/pty.c,v +retrieving revision 1.15.20.1 +diff -u -I__FBSDID -I$FreeBSD -r1.15.20.1 pty.c +--- lib/libutil/pty.c 27 Nov 2007 18:43:09 -0000 1.15.20.1 ++++ lib/libutil/pty.c 10 Jan 2008 20:54:30 -0000 +@@ -76,8 +76,7 @@ + break; /* try the next pty group */ + } else { + line[5] = 't'; +- (void) chown(line, getuid(), ttygid); +- (void) chmod(line, S_IRUSR|S_IWUSR|S_IWGRP); ++ (void) grantpt(master); + (void) revoke(line); + if ((slave = open(line, O_RDWR, 0)) != -1) { + *amaster = master; Index: user/cperciva/freebsd-update-build/patches/6.3-RC2/1-SA-08:02.libc =================================================================== --- user/cperciva/freebsd-update-build/patches/6.3-RC2/1-SA-08:02.libc (nonexistent) +++ user/cperciva/freebsd-update-build/patches/6.3-RC2/1-SA-08:02.libc (revision 293366) @@ -0,0 +1,19 @@ +Index: lib/libc/inet/inet_network.c +=================================================================== +RCS file: /home/ncvs/src/lib/libc/inet/inet_network.c,v +retrieving revision 1.4 +diff -u -u -r1.4 inet_network.c +--- lib/libc/inet/inet_network.c 3 Jun 2007 17:20:26 -0000 1.4 ++++ lib/libc/inet/inet_network.c 6 Jan 2008 15:38:28 -0000 +@@ -82,9 +82,9 @@ + } + if (!digit) + return (INADDR_NONE); ++ if (pp >= parts + 4 || val > 0xffU) ++ return (INADDR_NONE); + if (*cp == '.') { +- if (pp >= parts + 4 || val > 0xffU) +- return (INADDR_NONE); + *pp++ = val, cp++; + goto again; + } Index: user/cperciva/freebsd-update-build/patches/6.3-RELEASE/3-SA-08:03.bind =================================================================== --- user/cperciva/freebsd-update-build/patches/6.3-RELEASE/3-SA-08:03.bind (nonexistent) +++ user/cperciva/freebsd-update-build/patches/6.3-RELEASE/3-SA-08:03.bind (revision 293366) @@ -0,0 +1,1220 @@ +Index: contrib/bind9/bin/named/client.c +=================================================================== +RCS file: /usr/ncvs/src/contrib/bind9/bin/named/client.c,v +retrieving revision 1.1.1.2.2.3 +diff -u -r1.1.1.2.2.3 client.c +--- contrib/bind9/bin/named/client.c 25 Jul 2007 08:23:07 -0000 1.1.1.2.2.3 ++++ contrib/bind9/bin/named/client.c 10 Jul 2008 16:07:20 -0000 +@@ -1349,14 +1349,6 @@ + } + + /* +- * Hash the incoming request here as it is after +- * dns_dispatch_importrecv(). +- */ +- dns_dispatch_hash(&client->now, sizeof(client->now)); +- dns_dispatch_hash(isc_buffer_base(buffer), +- isc_buffer_usedlength(buffer)); +- +- /* + * It's a request. Parse it. + */ + result = dns_message_parse(client->message, buffer, 0); +Index: contrib/bind9/bin/named/server.c +=================================================================== +RCS file: /usr/ncvs/src/contrib/bind9/bin/named/server.c,v +retrieving revision 1.1.1.2.2.2 +diff -u -r1.1.1.2.2.2 server.c +--- contrib/bind9/bin/named/server.c 13 Dec 2006 09:46:50 -0000 1.1.1.2.2.2 ++++ contrib/bind9/bin/named/server.c 10 Jul 2008 16:07:20 -0000 +@@ -477,6 +477,14 @@ + attrs |= DNS_DISPATCHATTR_IPV6; + break; + } ++ ++ if (isc_sockaddr_getport(&sa) != 0) { ++ INSIST(obj != NULL); ++ cfg_obj_log(obj, ns_g_lctx, ISC_LOG_INFO, ++ "using specific query-source port suppresses port " ++ "randomization and can be insecure."); ++ } ++ + attrmask = 0; + attrmask |= DNS_DISPATCHATTR_UDP; + attrmask |= DNS_DISPATCHATTR_TCP; +@@ -486,7 +494,7 @@ + disp = NULL; + result = dns_dispatch_getudp(ns_g_dispatchmgr, ns_g_socketmgr, + ns_g_taskmgr, &sa, 4096, +- 1000, 32768, 16411, 16433, ++ 1024, 32768, 16411, 16433, + attrs, attrmask, &disp); + if (result != ISC_R_SUCCESS) { + isc_sockaddr_t any; +@@ -1858,7 +1866,9 @@ + } + + static isc_result_t +-add_listenelt(isc_mem_t *mctx, ns_listenlist_t *list, isc_sockaddr_t *addr) { ++add_listenelt(isc_mem_t *mctx, ns_listenlist_t *list, isc_sockaddr_t *addr, ++ isc_boolean_t wcardport_ok) ++{ + ns_listenelt_t *lelt = NULL; + dns_acl_t *src_acl = NULL; + dns_aclelement_t aelt; +@@ -1868,7 +1878,8 @@ + REQUIRE(isc_sockaddr_pf(addr) == AF_INET6); + + isc_sockaddr_any6(&any_sa6); +- if (!isc_sockaddr_equal(&any_sa6, addr)) { ++ if (!isc_sockaddr_equal(&any_sa6, addr) && ++ (wcardport_ok || isc_sockaddr_getport(addr) != 0)) { + aelt.type = dns_aclelementtype_ipprefix; + aelt.negative = ISC_FALSE; + aelt.u.ip_prefix.prefixlen = 128; +@@ -1927,7 +1938,16 @@ + result = dns_dispatch_getlocaladdress(dispatch6, &addr); + if (result != ISC_R_SUCCESS) + goto fail; +- result = add_listenelt(mctx, list, &addr); ++ ++ /* ++ * We always add non-wildcard address regardless of whether ++ * the port is 'any' (the fourth arg is TRUE): if the port is ++ * specific, we need to add it since it may conflict with a ++ * listening interface; if it's zero, we'll dynamically open ++ * query ports, and some of them may override an existing ++ * wildcard IPv6 port. ++ */ ++ result = add_listenelt(mctx, list, &addr, ISC_TRUE); + if (result != ISC_R_SUCCESS) + goto fail; + } +@@ -1957,12 +1977,12 @@ + continue; + + addrp = dns_zone_getnotifysrc6(zone); +- result = add_listenelt(mctx, list, addrp); ++ result = add_listenelt(mctx, list, addrp, ISC_FALSE); + if (result != ISC_R_SUCCESS) + goto fail; + + addrp = dns_zone_getxfrsource6(zone); +- result = add_listenelt(mctx, list, addrp); ++ result = add_listenelt(mctx, list, addrp, ISC_FALSE); + if (result != ISC_R_SUCCESS) + goto fail; + } +Index: contrib/bind9/lib/dns/api +=================================================================== +RCS file: /usr/ncvs/src/contrib/bind9/lib/dns/api,v +retrieving revision 1.1.1.2.2.3 +diff -u -r1.1.1.2.2.3 api +--- contrib/bind9/lib/dns/api 7 Feb 2007 00:42:08 -0000 1.1.1.2.2.3 ++++ contrib/bind9/lib/dns/api 10 Jul 2008 16:07:28 -0000 +@@ -1,3 +1,3 @@ +-LIBINTERFACE = 23 +-LIBREVISION = 0 +-LIBAGE = 1 ++LIBINTERFACE = 24 ++LIBREVISION = 2 ++LIBAGE = 2 +Index: contrib/bind9/lib/dns/dispatch.c +=================================================================== +RCS file: /usr/ncvs/src/contrib/bind9/lib/dns/dispatch.c,v +retrieving revision 1.1.1.1.4.2 +diff -u -r1.1.1.1.4.2 dispatch.c +--- contrib/bind9/lib/dns/dispatch.c 25 Jul 2007 08:23:07 -0000 1.1.1.1.4.2 ++++ contrib/bind9/lib/dns/dispatch.c 10 Jul 2008 16:07:28 -0000 +@@ -27,6 +27,7 @@ + #include + #include + #include ++#include + #include + #include + #include +@@ -43,25 +44,22 @@ + + typedef ISC_LIST(dns_dispentry_t) dns_displist_t; + +-typedef struct dns_nsid { +- isc_uint16_t nsid_state; +- isc_uint16_t *nsid_vtable; +- isc_uint16_t *nsid_pool; +- isc_uint16_t nsid_a1, nsid_a2, nsid_a3; +- isc_uint16_t nsid_c1, nsid_c2, nsid_c3; +- isc_uint16_t nsid_state2; +- isc_boolean_t nsid_usepool; +-} dns_nsid_t; +- + typedef struct dns_qid { + unsigned int magic; + unsigned int qid_nbuckets; /* hash table size */ + unsigned int qid_increment; /* id increment on collision */ + isc_mutex_t lock; +- dns_nsid_t nsid; + dns_displist_t *qid_table; /* the table itself */ + } dns_qid_t; + ++/* ARC4 Random generator state */ ++typedef struct arc4ctx { ++ isc_uint8_t i; ++ isc_uint8_t j; ++ isc_uint8_t s[256]; ++ int count; ++} arc4ctx_t; ++ + struct dns_dispatchmgr { + /* Unlocked. */ + unsigned int magic; +@@ -74,6 +72,10 @@ + unsigned int state; + ISC_LIST(dns_dispatch_t) list; + ++ /* Locked by arc4_lock. */ ++ isc_mutex_t arc4_lock; ++ arc4ctx_t arc4ctx; /*%< ARC4 context for QID */ ++ + /* locked by buffer lock */ + dns_qid_t *qid; + isc_mutex_t buffer_lock; +@@ -100,6 +102,7 @@ + unsigned int magic; + dns_dispatch_t *disp; + dns_messageid_t id; ++ in_port_t port; + unsigned int bucket; + isc_sockaddr_t host; + isc_task_t *task; +@@ -119,6 +122,7 @@ + isc_task_t *task; /* internal task */ + isc_socket_t *socket; /* isc socket attached to */ + isc_sockaddr_t local; /* local address */ ++ in_port_t localport; /* local UDP port */ + unsigned int maxrequests; /* max requests */ + isc_event_t *ctlevent; + +@@ -161,14 +165,14 @@ + * Statics. + */ + static dns_dispentry_t *bucket_search(dns_qid_t *, isc_sockaddr_t *, +- dns_messageid_t, unsigned int); ++ dns_messageid_t, in_port_t, unsigned int); + static isc_boolean_t destroy_disp_ok(dns_dispatch_t *); + static void destroy_disp(isc_task_t *task, isc_event_t *event); + static void udp_recv(isc_task_t *, isc_event_t *); + static void tcp_recv(isc_task_t *, isc_event_t *); + static void startrecv(dns_dispatch_t *); +-static dns_messageid_t dns_randomid(dns_nsid_t *); +-static isc_uint32_t dns_hash(dns_qid_t *, isc_sockaddr_t *, dns_messageid_t); ++static isc_uint32_t dns_hash(dns_qid_t *, isc_sockaddr_t *, dns_messageid_t, ++ in_port_t); + static void free_buffer(dns_dispatch_t *disp, void *buf, unsigned int len); + static void *allocate_udp_buffer(dns_dispatch_t *disp); + static inline void free_event(dns_dispatch_t *disp, dns_dispatchevent_t *ev); +@@ -188,12 +192,8 @@ + static isc_boolean_t destroy_mgr_ok(dns_dispatchmgr_t *mgr); + static void destroy_mgr(dns_dispatchmgr_t **mgrp); + static isc_result_t qid_allocate(dns_dispatchmgr_t *mgr, unsigned int buckets, +- unsigned int increment, isc_boolean_t usepool, +- dns_qid_t **qidp); ++ unsigned int increment, dns_qid_t **qidp); + static void qid_destroy(isc_mem_t *mctx, dns_qid_t **qidp); +-static isc_uint16_t nsid_next(dns_nsid_t *nsid); +-static isc_result_t nsid_init(isc_mem_t *mctx, dns_nsid_t *nsid, isc_boolean_t usepool); +-static void nsid_destroy(isc_mem_t *mctx, dns_nsid_t *nsid); + + #define LVL(x) ISC_LOG_DEBUG(x) + +@@ -274,26 +274,152 @@ + } + + /* +- * Return an unpredictable message ID. ++ * ARC4 random number generator obtained from OpenBSD + */ +-static dns_messageid_t +-dns_randomid(dns_nsid_t *nsid) { +- isc_uint32_t id; ++static void ++dispatch_arc4init(arc4ctx_t *actx) { ++ int n; ++ for (n = 0; n < 256; n++) ++ actx->s[n] = n; ++ actx->i = 0; ++ actx->j = 0; ++ actx->count = 0; ++} ++ ++static void ++dispatch_arc4addrandom(arc4ctx_t *actx, unsigned char *dat, int datlen) { ++ int n; ++ isc_uint8_t si; ++ ++ actx->i--; ++ for (n = 0; n < 256; n++) { ++ actx->i = (actx->i + 1); ++ si = actx->s[actx->i]; ++ actx->j = (actx->j + si + dat[n % datlen]); ++ actx->s[actx->i] = actx->s[actx->j]; ++ actx->s[actx->j] = si; ++ } ++ actx->j = actx->i; ++} ++ ++static inline isc_uint8_t ++dispatch_arc4get8(arc4ctx_t *actx) { ++ isc_uint8_t si, sj; ++ ++ actx->i = (actx->i + 1); ++ si = actx->s[actx->i]; ++ actx->j = (actx->j + si); ++ sj = actx->s[actx->j]; ++ actx->s[actx->i] = sj; ++ actx->s[actx->j] = si; ++ ++ return (actx->s[(si + sj) & 0xff]); ++} ++ ++static inline isc_uint16_t ++dispatch_arc4get16(arc4ctx_t *actx) { ++ isc_uint16_t val; ++ ++ val = dispatch_arc4get8(actx) << 8; ++ val |= dispatch_arc4get8(actx); ++ ++ return (val); ++} ++ ++static void ++dispatch_arc4stir(dns_dispatchmgr_t *mgr) { ++ int i; ++ union { ++ unsigned char rnd[128]; ++ isc_uint32_t rnd32[32]; ++ } rnd; ++ isc_result_t result; + +- id = nsid_next(nsid); ++ if (mgr->entropy != NULL) { ++ /* ++ * We accept any quality of random data to avoid blocking. ++ */ ++ result = isc_entropy_getdata(mgr->entropy, rnd.rnd, ++ sizeof(rnd), NULL, 0); ++ RUNTIME_CHECK(result == ISC_R_SUCCESS); ++ } else { ++ for (i = 0; i < 32; i++) ++ isc_random_get(&rnd.rnd32[i]); ++ } ++ dispatch_arc4addrandom(&mgr->arc4ctx, rnd.rnd, sizeof(rnd.rnd)); + +- return ((dns_messageid_t)id); ++ /* ++ * Discard early keystream, as per recommendations in: ++ * http://www.wisdom.weizmann.ac.il/~itsik/RC4/Papers/Rc4_ksa.ps ++ */ ++ for (i = 0; i < 256; i++) ++ (void)dispatch_arc4get8(&mgr->arc4ctx); ++ ++ /* ++ * Derived from OpenBSD's implementation. The rationale is not clear, ++ * but should be conservative enough in safety, and reasonably large ++ * for efficiency. ++ */ ++ mgr->arc4ctx.count = 1600000; ++} ++ ++static isc_uint16_t ++dispatch_arc4random(dns_dispatchmgr_t *mgr) { ++ isc_uint16_t result; ++ ++ LOCK(&mgr->arc4_lock); ++ mgr->arc4ctx.count -= sizeof(isc_uint16_t); ++ if (mgr->arc4ctx.count <= 0) ++ dispatch_arc4stir(mgr); ++ result = dispatch_arc4get16(&mgr->arc4ctx); ++ UNLOCK(&mgr->arc4_lock); ++ return (result); ++} ++ ++static isc_uint16_t ++dispatch_arc4uniformrandom(dns_dispatchmgr_t *mgr, isc_uint16_t upper_bound) { ++ isc_uint16_t min, r; ++ /* The caller must hold the manager lock. */ ++ ++ if (upper_bound < 2) ++ return (0); ++ ++ /* ++ * Ensure the range of random numbers [min, 0xffff] be a multiple of ++ * upper_bound and contain at least a half of the 16 bit range. ++ */ ++ ++ if (upper_bound > 0x8000) ++ min = 1 + ~upper_bound; /* 0x8000 - upper_bound */ ++ else ++ min = (isc_uint16_t)(0x10000 % (isc_uint32_t)upper_bound); ++ ++ /* ++ * This could theoretically loop forever but each retry has ++ * p > 0.5 (worst case, usually far better) of selecting a ++ * number inside the range we need, so it should rarely need ++ * to re-roll. ++ */ ++ for (;;) { ++ r = dispatch_arc4random(mgr); ++ if (r >= min) ++ break; ++ } ++ ++ return (r % upper_bound); + } + + /* + * Return a hash of the destination and message id. + */ + static isc_uint32_t +-dns_hash(dns_qid_t *qid, isc_sockaddr_t *dest, dns_messageid_t id) { ++dns_hash(dns_qid_t *qid, isc_sockaddr_t *dest, dns_messageid_t id, ++ in_port_t port) ++{ + unsigned int ret; + + ret = isc_sockaddr_hash(dest, ISC_TRUE); +- ret ^= id; ++ ret ^= (id << 16) | port; + ret %= qid->qid_nbuckets; + + INSIST(ret < qid->qid_nbuckets); +@@ -410,7 +536,7 @@ + */ + static dns_dispentry_t * + bucket_search(dns_qid_t *qid, isc_sockaddr_t *dest, dns_messageid_t id, +- unsigned int bucket) ++ in_port_t port, unsigned int bucket) + { + dns_dispentry_t *res; + +@@ -419,8 +545,10 @@ + res = ISC_LIST_HEAD(qid->qid_table[bucket]); + + while (res != NULL) { +- if ((res->id == id) && isc_sockaddr_equal(dest, &res->host)) ++ if ((res->id == id) && isc_sockaddr_equal(dest, &res->host) && ++ res->port == port) { + return (res); ++ } + res = ISC_LIST_NEXT(res, link); + } + +@@ -622,13 +750,10 @@ + goto restart; + } + +- dns_dispatch_hash(&ev->timestamp, sizeof(&ev->timestamp)); +- dns_dispatch_hash(ev->region.base, ev->region.length); +- + /* response */ +- bucket = dns_hash(qid, &ev->address, id); ++ bucket = dns_hash(qid, &ev->address, id, disp->localport); + LOCK(&qid->lock); +- resp = bucket_search(qid, &ev->address, id, bucket); ++ resp = bucket_search(qid, &ev->address, id, disp->localport, bucket); + dispatch_log(disp, LVL(90), + "search for response in bucket %d: %s", + bucket, (resp == NULL ? "not found" : "found")); +@@ -859,14 +984,13 @@ + goto restart; + } + +- dns_dispatch_hash(tcpmsg->buffer.base, tcpmsg->buffer.length); +- + /* + * Response. + */ +- bucket = dns_hash(qid, &tcpmsg->address, id); ++ bucket = dns_hash(qid, &tcpmsg->address, id, disp->localport); + LOCK(&qid->lock); +- resp = bucket_search(qid, &tcpmsg->address, id, bucket); ++ resp = bucket_search(qid, &tcpmsg->address, id, disp->localport, ++ bucket); + dispatch_log(disp, LVL(90), + "search for response in bucket %d: %s", + bucket, (resp == NULL ? "not found" : "found")); +@@ -1015,6 +1139,8 @@ + DESTROYLOCK(&mgr->lock); + mgr->state = 0; + ++ DESTROYLOCK(&mgr->arc4_lock); ++ + isc_mempool_destroy(&mgr->epool); + isc_mempool_destroy(&mgr->rpool); + isc_mempool_destroy(&mgr->dpool); +@@ -1093,10 +1219,14 @@ + if (result != ISC_R_SUCCESS) + goto deallocate; + +- result = isc_mutex_init(&mgr->buffer_lock); ++ result = isc_mutex_init(&mgr->arc4_lock); + if (result != ISC_R_SUCCESS) + goto kill_lock; + ++ result = isc_mutex_init(&mgr->buffer_lock); ++ if (result != ISC_R_SUCCESS) ++ goto kill_arc4_lock; ++ + result = isc_mutex_init(&mgr->pool_lock); + if (result != ISC_R_SUCCESS) + goto kill_buffer_lock; +@@ -1147,6 +1277,8 @@ + if (entropy != NULL) + isc_entropy_attach(entropy, &mgr->entropy); + ++ dispatch_arc4init(&mgr->arc4ctx); ++ + *mgrp = mgr; + return (ISC_R_SUCCESS); + +@@ -1158,6 +1290,8 @@ + DESTROYLOCK(&mgr->pool_lock); + kill_buffer_lock: + DESTROYLOCK(&mgr->buffer_lock); ++ kill_arc4_lock: ++ DESTROYLOCK(&mgr->arc4_lock); + kill_lock: + DESTROYLOCK(&mgr->lock); + deallocate: +@@ -1244,7 +1378,7 @@ + isc_mempool_setmaxalloc(mgr->bpool, maxbuffers); + isc_mempool_associatelock(mgr->bpool, &mgr->pool_lock); + +- result = qid_allocate(mgr, buckets, increment, ISC_TRUE, &mgr->qid); ++ result = qid_allocate(mgr, buckets, increment, &mgr->qid); + if (result != ISC_R_SUCCESS) + goto cleanup; + +@@ -1283,20 +1417,27 @@ + } + + static isc_boolean_t +-blacklisted(dns_dispatchmgr_t *mgr, isc_socket_t *sock) { ++blacklisted(dns_dispatchmgr_t *mgr, isc_socket_t *sock, ++ isc_sockaddr_t *sockaddrp) ++{ + isc_sockaddr_t sockaddr; + isc_result_t result; + ++ REQUIRE(sock != NULL || sockaddrp != NULL); ++ + if (mgr->portlist == NULL) + return (ISC_FALSE); + +- result = isc_socket_getsockname(sock, &sockaddr); +- if (result != ISC_R_SUCCESS) +- return (ISC_FALSE); ++ if (sock != NULL) { ++ sockaddrp = &sockaddr; ++ result = isc_socket_getsockname(sock, sockaddrp); ++ if (result != ISC_R_SUCCESS) ++ return (ISC_FALSE); ++ } + + if (mgr->portlist != NULL && +- dns_portlist_match(mgr->portlist, isc_sockaddr_pf(&sockaddr), +- isc_sockaddr_getport(&sockaddr))) ++ dns_portlist_match(mgr->portlist, isc_sockaddr_pf(sockaddrp), ++ isc_sockaddr_getport(sockaddrp))) + return (ISC_TRUE); + return (ISC_FALSE); + } +@@ -1317,7 +1458,7 @@ + if (disp->mgr->portlist != NULL && + isc_sockaddr_getport(addr) == 0 && + isc_sockaddr_getport(&disp->local) == 0 && +- blacklisted(disp->mgr, disp->socket)) ++ blacklisted(disp->mgr, disp->socket, NULL)) + return (ISC_FALSE); + + /* +@@ -1390,7 +1531,7 @@ + + static isc_result_t + qid_allocate(dns_dispatchmgr_t *mgr, unsigned int buckets, +- unsigned int increment, isc_boolean_t usepool, dns_qid_t **qidp) ++ unsigned int increment, dns_qid_t **qidp) + { + dns_qid_t *qid; + unsigned int i; +@@ -1411,16 +1552,8 @@ + return (ISC_R_NOMEMORY); + } + +- if (nsid_init(mgr->mctx, &qid->nsid, usepool) != ISC_R_SUCCESS) { +- isc_mem_put(mgr->mctx, qid->qid_table, +- buckets * sizeof(dns_displist_t)); +- isc_mem_put(mgr->mctx, qid, sizeof(*qid)); +- return (ISC_R_NOMEMORY); +- } +- + if (isc_mutex_init(&qid->lock) != ISC_R_SUCCESS) { + UNEXPECTED_ERROR(__FILE__, __LINE__, "isc_mutex_init failed"); +- nsid_destroy(mgr->mctx, &qid->nsid); + isc_mem_put(mgr->mctx, qid->qid_table, + buckets * sizeof(dns_displist_t)); + isc_mem_put(mgr->mctx, qid, sizeof(*qid)); +@@ -1448,7 +1581,6 @@ + + *qidp = NULL; + qid->magic = 0; +- nsid_destroy(mctx, &qid->nsid); + isc_mem_put(mctx, qid->qid_table, + qid->qid_nbuckets * sizeof(dns_displist_t)); + DESTROYLOCK(&qid->lock); +@@ -1485,6 +1617,7 @@ + disp->refcount = 1; + disp->recv_pending = 0; + memset(&disp->local, 0, sizeof(disp->local)); ++ disp->localport = 0; + disp->shutting_down = 0; + disp->shutdown_out = 0; + disp->connected = 0; +@@ -1592,7 +1725,7 @@ + return (result); + } + +- result = qid_allocate(mgr, buckets, increment, ISC_FALSE, &disp->qid); ++ result = qid_allocate(mgr, buckets, increment, &disp->qid); + if (result != ISC_R_SUCCESS) + goto deallocate_dispatch; + +@@ -1657,7 +1790,7 @@ + dns_dispatch_t **dispp) + { + isc_result_t result; +- dns_dispatch_t *disp; ++ dns_dispatch_t *disp = NULL; + + REQUIRE(VALID_DISPATCHMGR(mgr)); + REQUIRE(sockmgr != NULL); +@@ -1677,6 +1810,11 @@ + + LOCK(&mgr->lock); + ++ if ((attributes & DNS_DISPATCHATTR_RANDOMPORT) != 0) { ++ REQUIRE(isc_sockaddr_getport(localaddr) == 0); ++ goto createudp; ++ } ++ + /* + * First, see if we have a dispatcher that matches. + */ +@@ -1705,6 +1843,7 @@ + return (ISC_R_SUCCESS); + } + ++ createudp: + /* + * Nope, create one. + */ +@@ -1740,7 +1879,9 @@ + dns_dispatch_t *disp; + isc_socket_t *sock = NULL; + isc_socket_t *held[DNS_DISPATCH_HELD]; +- unsigned int i = 0, j = 0; ++ unsigned int i = 0, j = 0, k = 0; ++ isc_sockaddr_t localaddr_bound; ++ in_port_t localport = 0; + + /* + * dispatch_allocate() checks mgr for us. +@@ -1756,11 +1897,34 @@ + * from returning the same port to us too quickly. + */ + memset(held, 0, sizeof(held)); ++ localaddr_bound = *localaddr; + getsocket: +- result = create_socket(sockmgr, localaddr, &sock); ++ if ((attributes & DNS_DISPATCHATTR_RANDOMPORT) != 0) { ++ in_port_t prt; ++ ++ /* XXX: should the range be configurable? */ ++ prt = 1024 + dispatch_arc4uniformrandom(mgr, 65535 - 1023); ++ isc_sockaddr_setport(&localaddr_bound, prt); ++ if (blacklisted(mgr, NULL, &localaddr_bound)) { ++ if (++k == 1024) ++ attributes &= ~DNS_DISPATCHATTR_RANDOMPORT; ++ goto getsocket; ++ } ++ result = create_socket(sockmgr, &localaddr_bound, &sock); ++ if (result == ISC_R_ADDRINUSE) { ++ if (++k == 1024) ++ attributes &= ~DNS_DISPATCHATTR_RANDOMPORT; ++ goto getsocket; ++ } ++ localport = prt; ++ } else ++ result = create_socket(sockmgr, localaddr, &sock); + if (result != ISC_R_SUCCESS) + goto deallocate_dispatch; +- if (isc_sockaddr_getport(localaddr) == 0 && blacklisted(mgr, sock)) { ++ if ((attributes & DNS_DISPATCHATTR_RANDOMPORT) == 0 && ++ isc_sockaddr_getport(localaddr) == 0 && ++ blacklisted(mgr, sock, NULL)) ++ { + if (held[i] != NULL) + isc_socket_detach(&held[i]); + held[i++] = sock; +@@ -1781,6 +1945,7 @@ + disp->socktype = isc_sockettype_udp; + disp->socket = sock; + disp->local = *localaddr; ++ disp->localport = localport; + + disp->task = NULL; + result = isc_task_create(taskmgr, 0, &disp->task); +@@ -1911,19 +2076,20 @@ + /* + * Try somewhat hard to find an unique ID. + */ ++ id = (dns_messageid_t)dispatch_arc4random(disp->mgr); + qid = DNS_QID(disp); + LOCK(&qid->lock); +- id = dns_randomid(&qid->nsid); +- bucket = dns_hash(qid, dest, id); ++ bucket = dns_hash(qid, dest, id, disp->localport); + ok = ISC_FALSE; + for (i = 0; i < 64; i++) { +- if (bucket_search(qid, dest, id, bucket) == NULL) { ++ if (bucket_search(qid, dest, id, disp->localport, bucket) == ++ NULL) { + ok = ISC_TRUE; + break; + } + id += qid->qid_increment; + id &= 0x0000ffff; +- bucket = dns_hash(qid, dest, id); ++ bucket = dns_hash(qid, dest, id, disp->localport); + } + + if (!ok) { +@@ -1945,6 +2111,7 @@ + isc_task_attach(task, &res->task); + res->disp = disp; + res->id = id; ++ res->port = disp->localport; + res->bucket = bucket; + res->host = *dest; + res->action = action; +@@ -2256,409 +2423,3 @@ + } + } + #endif +- +-/* +- * Allow the user to pick one of two ID randomization algorithms. +- * +- * The first algorithm is an adaptation of the sequence shuffling +- * algorithm discovered by Carter Bays and S. D. Durham [ACM Trans. Math. +- * Software 2 (1976), 59-64], as documented as Algorithm B in Chapter +- * 3.2.2 in Volume 2 of Knuth's "The Art of Computer Programming". We use +- * a randomly selected linear congruential random number generator with a +- * modulus of 2^16, whose increment is a randomly picked odd number, and +- * whose multiplier is picked from a set which meets the following +- * criteria: +- * Is of the form 8*n+5, which ensures "high potency" according to +- * principle iii in the summary chapter 3.6. This form also has a +- * gcd(a-1,m) of 4 which is good according to principle iv. +- * +- * Is between 0.01 and 0.99 times the modulus as specified by +- * principle iv. +- * +- * Passes the spectral test "with flying colors" (ut >= 1) in +- * dimensions 2 through 6 as calculated by Algorithm S in Chapter +- * 3.3.4 and the ratings calculated by formula 35 in section E. +- * +- * Of the multipliers that pass this test, pick the set that is +- * best according to the theoretical bounds of the serial +- * correlation test. This was calculated using a simplified +- * version of Knuth's Theorem K in Chapter 3.3.3. +- * +- * These criteria may not be important for this use, but we might as well +- * pick from the best generators since there are so many possible ones and +- * we don't have that many random bits to do the picking. +- * +- * We use a modulus of 2^16 instead of something bigger so that we will +- * tend to cycle through all the possible IDs before repeating any, +- * however the shuffling will perturb this somewhat. Theoretically there +- * is no minimimum interval between two uses of the same ID, but in +- * practice it seems to be >64000. +- * +- * Our adaptatation of Algorithm B mixes the hash state which has +- * captured various random events into the shuffler to perturb the +- * sequence. +- * +- * One disadvantage of this algorithm is that if the generator parameters +- * were to be guessed, it would be possible to mount a limited brute force +- * attack on the ID space since the IDs are only shuffled within a limited +- * range. +- * +- * The second algorithm uses the same random number generator to populate +- * a pool of 65536 IDs. The hash state is used to pick an ID from a window +- * of 4096 IDs in this pool, then the chosen ID is swapped with the ID +- * at the beginning of the window and the window position is advanced. +- * This means that the interval between uses of the ID will be no less +- * than 65536-4096. The ID sequence in the pool will become more random +- * over time. +- * +- * For both algorithms, two more linear congruential random number generators +- * are selected. The ID from the first part of algorithm is used to seed +- * the first of these generators, and its output is used to seed the second. +- * The strategy is use these generators as 1 to 1 hashes to obfuscate the +- * properties of the generator used in the first part of either algorithm. +- * +- * The first algorithm may be suitable for use in a client resolver since +- * its memory requirements are fairly low and it's pretty random out of +- * the box. It is somewhat succeptible to a limited brute force attack, +- * so the second algorithm is probably preferable for a longer running +- * program that issues a large number of queries and has time to randomize +- * the pool. +- */ +- +-#define NSID_SHUFFLE_TABLE_SIZE 100 /* Suggested by Knuth */ +-/* +- * Pick one of the next 4096 IDs in the pool. +- * There is a tradeoff here between randomness and how often and ID is reused. +- */ +-#define NSID_LOOKAHEAD 4096 /* Must be a power of 2 */ +-#define NSID_SHUFFLE_ONLY 1 /* algorithm 1 */ +-#define NSID_USE_POOL 2 /* algorithm 2 */ +-#define NSID_HASHSHIFT 3 +-#define NSID_HASHROTATE(v) \ +- (((v) << NSID_HASHSHIFT) | ((v) >> ((sizeof(v) * 8) - NSID_HASHSHIFT))) +- +-static isc_uint32_t nsid_hash_state; +- +-/* +- * Keep a running hash of various bits of data that we'll use to +- * stir the ID pool or perturb the ID generator +- */ +-static void +-nsid_hash(void *data, size_t len) { +- unsigned char *p = data; +- /* +- * Hash function similar to the one we use for hashing names. +- * We don't fold case or toss the upper bit here, though. +- * This hash doesn't do much interesting when fed binary zeros, +- * so there may be a better hash function. +- * This function doesn't need to be very strong since we're +- * only using it to stir the pool, but it should be reasonably +- * fast. +- */ +- /* +- * We don't care about locking access to nsid_hash_state. +- * In fact races make the result even more non deteministic. +- */ +- while (len-- > 0U) { +- nsid_hash_state = NSID_HASHROTATE(nsid_hash_state); +- nsid_hash_state += *p++; +- } +-} +- +-/* +- * Table of good linear congruential multipliers for modulus 2^16 +- * in order of increasing serial correlation bounds (so trim from +- * the end). +- */ +-static const isc_uint16_t nsid_multiplier_table[] = { +- 17565, 25013, 11733, 19877, 23989, 23997, 24997, 25421, +- 26781, 27413, 35901, 35917, 35973, 36229, 38317, 38437, +- 39941, 40493, 41853, 46317, 50581, 51429, 53453, 53805, +- 11317, 11789, 12045, 12413, 14277, 14821, 14917, 18989, +- 19821, 23005, 23533, 23573, 23693, 27549, 27709, 28461, +- 29365, 35605, 37693, 37757, 38309, 41285, 45261, 47061, +- 47269, 48133, 48597, 50277, 50717, 50757, 50805, 51341, +- 51413, 51581, 51597, 53445, 11493, 14229, 20365, 20653, +- 23485, 25541, 27429, 29421, 30173, 35445, 35653, 36789, +- 36797, 37109, 37157, 37669, 38661, 39773, 40397, 41837, +- 41877, 45293, 47277, 47845, 49853, 51085, 51349, 54085, +- 56933, 8877, 8973, 9885, 11365, 11813, 13581, 13589, +- 13613, 14109, 14317, 15765, 15789, 16925, 17069, 17205, +- 17621, 17941, 19077, 19381, 20245, 22845, 23733, 24869, +- 25453, 27213, 28381, 28965, 29245, 29997, 30733, 30901, +- 34877, 35485, 35613, 36133, 36661, 36917, 38597, 40285, +- 40693, 41413, 41541, 41637, 42053, 42349, 45245, 45469, +- 46493, 48205, 48613, 50861, 51861, 52877, 53933, 54397, +- 55669, 56453, 56965, 58021, 7757, 7781, 8333, 9661, +- 12229, 14373, 14453, 17549, 18141, 19085, 20773, 23701, +- 24205, 24333, 25261, 25317, 27181, 30117, 30477, 34757, +- 34885, 35565, 35885, 36541, 37957, 39733, 39813, 41157, +- 41893, 42317, 46621, 48117, 48181, 49525, 55261, 55389, +- 56845, 7045, 7749, 7965, 8469, 9133, 9549, 9789, +- 10173, 11181, 11285, 12253, 13453, 13533, 13757, 14477, +- 15053, 16901, 17213, 17269, 17525, 17629, 18605, 19013, +- 19829, 19933, 20069, 20093, 23261, 23333, 24949, 25309, +- 27613, 28453, 28709, 29301, 29541, 34165, 34413, 37301, +- 37773, 38045, 38405, 41077, 41781, 41925, 42717, 44437, +- 44525, 44613, 45933, 45941, 47077, 50077, 50893, 52117, +- 5293, 55069, 55989, 58125, 59205, 6869, 14685, 15453, +- 16821, 17045, 17613, 18437, 21029, 22773, 22909, 25445, +- 25757, 26541, 30709, 30909, 31093, 31149, 37069, 37725, +- 37925, 38949, 39637, 39701, 40765, 40861, 42965, 44813, +- 45077, 45733, 47045, 50093, 52861, 52957, 54181, 56325, +- 56365, 56381, 56877, 57013, 5741, 58101, 58669, 8613, +- 10045, 10261, 10653, 10733, 11461, 12261, 14069, 15877, +- 17757, 21165, 23885, 24701, 26429, 26645, 27925, 28765, +- 29197, 30189, 31293, 39781, 39909, 40365, 41229, 41453, +- 41653, 42165, 42365, 47421, 48029, 48085, 52773, 5573, +- 57037, 57637, 58341, 58357, 58901, 6357, 7789, 9093, +- 10125, 10709, 10765, 11957, 12469, 13437, 13509, 14773, +- 15437, 15773, 17813, 18829, 19565, 20237, 23461, 23685, +- 23725, 23941, 24877, 25461, 26405, 29509, 30285, 35181, +- 37229, 37893, 38565, 40293, 44189, 44581, 45701, 47381, +- 47589, 48557, 4941, 51069, 5165, 52797, 53149, 5341, +- 56301, 56765, 58581, 59493, 59677, 6085, 6349, 8293, +- 8501, 8517, 11597, 11709, 12589, 12693, 13517, 14909, +- 17397, 18085, 21101, 21269, 22717, 25237, 25661, 29189, +- 30101, 31397, 33933, 34213, 34661, 35533, 36493, 37309, +- 40037, 4189, 42909, 44309, 44357, 44389, 4541, 45461, +- 46445, 48237, 54149, 55301, 55853, 56621, 56717, 56901, +- 5813, 58437, 12493, 15365, 15989, 17829, 18229, 19341, +- 21013, 21357, 22925, 24885, 26053, 27581, 28221, 28485, +- 30605, 30613, 30789, 35437, 36285, 37189, 3941, 41797, +- 4269, 42901, 43293, 44645, 45221, 46893, 4893, 50301, +- 50325, 5189, 52109, 53517, 54053, 54485, 5525, 55949, +- 56973, 59069, 59421, 60733, 61253, 6421, 6701, 6709, +- 7101, 8669, 15797, 19221, 19837, 20133, 20957, 21293, +- 21461, 22461, 29085, 29861, 30869, 34973, 36469, 37565, +- 38125, 38829, 39469, 40061, 40117, 44093, 47429, 48341, +- 50597, 51757, 5541, 57629, 58405, 59621, 59693, 59701, +- 61837, 7061, 10421, 11949, 15405, 20861, 25397, 25509, +- 25893, 26037, 28629, 28869, 29605, 30213, 34205, 35637, +- 36365, 37285, 3773, 39117, 4021, 41061, 42653, 44509, +- 4461, 44829, 4725, 5125, 52269, 56469, 59085, 5917, +- 60973, 8349, 17725, 18637, 19773, 20293, 21453, 22533, +- 24285, 26333, 26997, 31501, 34541, 34805, 37509, 38477, +- 41333, 44125, 46285, 46997, 47637, 48173, 4925, 50253, +- 50381, 50917, 51205, 51325, 52165, 52229, 5253, 5269, +- 53509, 56253, 56341, 5821, 58373, 60301, 61653, 61973, +- 62373, 8397, 11981, 14341, 14509, 15077, 22261, 22429, +- 24261, 28165, 28685, 30661, 34021, 34445, 39149, 3917, +- 43013, 43317, 44053, 44101, 4533, 49541, 49981, 5277, +- 54477, 56357, 57261, 57765, 58573, 59061, 60197, 61197, +- 62189, 7725, 8477, 9565, 10229, 11437, 14613, 14709, +- 16813, 20029, 20677, 31445, 3165, 31957, 3229, 33541, +- 36645, 3805, 38973, 3965, 4029, 44293, 44557, 46245, +- 48917, 4909, 51749, 53709, 55733, 56445, 5925, 6093, +- 61053, 62637, 8661, 9109, 10821, 11389, 13813, 14325, +- 15501, 16149, 18845, 22669, 26437, 29869, 31837, 33709, +- 33973, 34173, 3677, 3877, 3981, 39885, 42117, 4421, +- 44221, 44245, 44693, 46157, 47309, 5005, 51461, 52037, +- 55333, 55693, 56277, 58949, 6205, 62141, 62469, 6293, +- 10101, 12509, 14029, 17997, 20469, 21149, 25221, 27109, +- 2773, 2877, 29405, 31493, 31645, 4077, 42005, 42077, +- 42469, 42501, 44013, 48653, 49349, 4997, 50101, 55405, +- 56957, 58037, 59429, 60749, 61797, 62381, 62837, 6605, +- 10541, 23981, 24533, 2701, 27333, 27341, 31197, 33805, +- 3621, 37381, 3749, 3829, 38533, 42613, 44381, 45901, +- 48517, 51269, 57725, 59461, 60045, 62029, 13805, 14013, +- 15461, 16069, 16157, 18573, 2309, 23501, 28645, 3077, +- 31541, 36357, 36877, 3789, 39429, 39805, 47685, 47949, +- 49413, 5485, 56757, 57549, 57805, 58317, 59549, 62213, +- 62613, 62853, 62933, 8909, 12941, 16677, 20333, 21541, +- 24429, 26077, 26421, 2885, 31269, 33381, 3661, 40925, +- 42925, 45173, 4525, 4709, 53133, 55941, 57413, 57797, +- 62125, 62237, 62733, 6773, 12317, 13197, 16533, 16933, +- 18245, 2213, 2477, 29757, 33293, 35517, 40133, 40749, +- 4661, 49941, 62757, 7853, 8149, 8573, 11029, 13421, +- 21549, 22709, 22725, 24629, 2469, 26125, 2669, 34253, +- 36709, 41013, 45597, 46637, 52285, 52333, 54685, 59013, +- 60997, 61189, 61981, 62605, 62821, 7077, 7525, 8781, +- 10861, 15277, 2205, 22077, 28517, 28949, 32109, 33493, +- 4661, 49941, 62757, 7853, 8149, 8573, 11029, 13421, +- 21549, 22709, 22725, 24629, 2469, 26125, 2669, 34253, +- 36709, 41013, 45597, 46637, 52285, 52333, 54685, 59013, +- 60997, 61189, 61981, 62605, 62821, 7077, 7525, 8781, +- 10861, 15277, 2205, 22077, 28517, 28949, 32109, 33493, +- 3685, 39197, 39869, 42621, 44997, 48565, 5221, 57381, +- 61749, 62317, 63245, 63381, 23149, 2549, 28661, 31653, +- 33885, 36341, 37053, 39517, 42805, 45853, 48997, 59349, +- 60053, 62509, 63069, 6525, 1893, 20181, 2365, 24893, +- 27397, 31357, 32277, 33357, 34437, 36677, 37661, 43469, +- 43917, 50997, 53869, 5653, 13221, 16741, 17893, 2157, +- 28653, 31789, 35301, 35821, 61613, 62245, 12405, 14517, +- 17453, 18421, 3149, 3205, 40341, 4109, 43941, 46869, +- 48837, 50621, 57405, 60509, 62877, 8157, 12933, 12957, +- 16501, 19533, 3461, 36829, 52357, 58189, 58293, 63053, +- 17109, 1933, 32157, 37701, 59005, 61621, 13029, 15085, +- 16493, 32317, 35093, 5061, 51557, 62221, 20765, 24613, +- 2629, 30861, 33197, 33749, 35365, 37933, 40317, 48045, +- 56229, 61157, 63797, 7917, 17965, 1917, 1973, 20301, +- 2253, 33157, 58629, 59861, 61085, 63909, 8141, 9221, +- 14757, 1581, 21637, 26557, 33869, 34285, 35733, 40933, +- 42517, 43501, 53653, 61885, 63805, 7141, 21653, 54973, +- 31189, 60061, 60341, 63357, 16045, 2053, 26069, 33997, +- 43901, 54565, 63837, 8949, 17909, 18693, 32349, 33125, +- 37293, 48821, 49053, 51309, 64037, 7117, 1445, 20405, +- 23085, 26269, 26293, 27349, 32381, 33141, 34525, 36461, +- 37581, 43525, 4357, 43877, 5069, 55197, 63965, 9845, +- 12093, 2197, 2229, 32165, 33469, 40981, 42397, 8749, +- 10853, 1453, 18069, 21693, 30573, 36261, 37421, 42533 +-}; +- +-#define NSID_MULT_TABLE_SIZE \ +- ((sizeof nsid_multiplier_table)/(sizeof nsid_multiplier_table[0])) +-#define NSID_RANGE_MASK (NSID_LOOKAHEAD - 1) +-#define NSID_POOL_MASK 0xFFFF /* used to wrap the pool index */ +-#define NSID_SHUFFLE_ONLY 1 +-#define NSID_USE_POOL 2 +- +-static isc_uint16_t +-nsid_next(dns_nsid_t *nsid) { +- isc_uint16_t id, compressed_hash; +- isc_uint16_t j; +- +- compressed_hash = ((nsid_hash_state >> 16) ^ +- (nsid_hash_state)) & 0xFFFF; +- +- if (nsid->nsid_usepool) { +- isc_uint16_t pick; +- +- pick = compressed_hash & NSID_RANGE_MASK; +- pick = (nsid->nsid_state + pick) & NSID_POOL_MASK; +- id = nsid->nsid_pool[pick]; +- if (pick != 0) { +- /* Swap two IDs to stir the pool */ +- nsid->nsid_pool[pick] = +- nsid->nsid_pool[nsid->nsid_state]; +- nsid->nsid_pool[nsid->nsid_state] = id; +- } +- +- /* increment the base pointer into the pool */ +- if (nsid->nsid_state == 65535) +- nsid->nsid_state = 0; +- else +- nsid->nsid_state++; +- } else { +- /* +- * This is the original Algorithm B +- * j = ((u_long) NSID_SHUFFLE_TABLE_SIZE * nsid_state2) >> 16; +- * +- * We'll perturb it with some random stuff ... +- */ +- j = ((isc_uint32_t) NSID_SHUFFLE_TABLE_SIZE * +- (nsid->nsid_state2 ^ compressed_hash)) >> 16; +- nsid->nsid_state2 = id = nsid->nsid_vtable[j]; +- nsid->nsid_state = (((isc_uint32_t) nsid->nsid_a1 * nsid->nsid_state) + +- nsid->nsid_c1) & 0xFFFF; +- nsid->nsid_vtable[j] = nsid->nsid_state; +- } +- +- /* Now lets obfuscate ... */ +- id = (((isc_uint32_t) nsid->nsid_a2 * id) + nsid->nsid_c2) & 0xFFFF; +- id = (((isc_uint32_t) nsid->nsid_a3 * id) + nsid->nsid_c3) & 0xFFFF; +- +- return (id); +-} +- +-static isc_result_t +-nsid_init(isc_mem_t *mctx, dns_nsid_t *nsid, isc_boolean_t usepool) { +- isc_time_t now; +- pid_t mypid; +- isc_uint16_t a1ndx, a2ndx, a3ndx, c1ndx, c2ndx, c3ndx; +- int i; +- +- isc_time_now(&now); +- mypid = getpid(); +- +- /* Initialize the state */ +- memset(nsid, 0, sizeof(*nsid)); +- nsid_hash(&now, sizeof now); +- nsid_hash(&mypid, sizeof mypid); +- +- /* +- * Select our random number generators and initial seed. +- * We could really use more random bits at this point, +- * but we'll try to make a silk purse out of a sows ear ... +- */ +- /* generator 1 */ +- a1ndx = ((isc_uint32_t) NSID_MULT_TABLE_SIZE * +- (nsid_hash_state & 0xFFFF)) >> 16; +- nsid->nsid_a1 = nsid_multiplier_table[a1ndx]; +- c1ndx = (nsid_hash_state >> 9) & 0x7FFF; +- nsid->nsid_c1 = 2 * c1ndx + 1; +- +- /* generator 2, distinct from 1 */ +- a2ndx = ((isc_uint32_t) (NSID_MULT_TABLE_SIZE - 1) * +- ((nsid_hash_state >> 10) & 0xFFFF)) >> 16; +- if (a2ndx >= a1ndx) +- a2ndx++; +- nsid->nsid_a2 = nsid_multiplier_table[a2ndx]; +- c2ndx = nsid_hash_state % 32767; +- if (c2ndx >= c1ndx) +- c2ndx++; +- nsid->nsid_c2 = 2*c2ndx + 1; +- +- /* generator 3, distinct from 1 and 2 */ +- a3ndx = ((isc_uint32_t) (NSID_MULT_TABLE_SIZE - 2) * +- ((nsid_hash_state >> 20) & 0xFFFF)) >> 16; +- if (a3ndx >= a1ndx || a3ndx >= a2ndx) +- a3ndx++; +- if (a3ndx >= a1ndx && a3ndx >= a2ndx) +- a3ndx++; +- nsid->nsid_a3 = nsid_multiplier_table[a3ndx]; +- c3ndx = nsid_hash_state % 32766; +- if (c3ndx >= c1ndx || c3ndx >= c2ndx) +- c3ndx++; +- if (c3ndx >= c1ndx && c3ndx >= c2ndx) +- c3ndx++; +- nsid->nsid_c3 = 2*c3ndx + 1; +- +- nsid->nsid_state = +- ((nsid_hash_state >> 16) ^ (nsid_hash_state)) & 0xFFFF; +- +- nsid->nsid_usepool = usepool; +- if (nsid->nsid_usepool) { +- nsid->nsid_pool = isc_mem_get(mctx, 0x10000 * sizeof(isc_uint16_t)); +- if (nsid->nsid_pool == NULL) +- return (ISC_R_NOMEMORY); +- for (i = 0; ; i++) { +- nsid->nsid_pool[i] = nsid->nsid_state; +- nsid->nsid_state = +- (((u_long) nsid->nsid_a1 * nsid->nsid_state) + +- nsid->nsid_c1) & 0xFFFF; +- if (i == 0xFFFF) +- break; +- } +- } else { +- nsid->nsid_vtable = isc_mem_get(mctx, NSID_SHUFFLE_TABLE_SIZE * +- (sizeof(isc_uint16_t)) ); +- if (nsid->nsid_vtable == NULL) +- return (ISC_R_NOMEMORY); +- +- for (i = 0; i < NSID_SHUFFLE_TABLE_SIZE; i++) { +- nsid->nsid_vtable[i] = nsid->nsid_state; +- nsid->nsid_state = +- (((isc_uint32_t) nsid->nsid_a1 * nsid->nsid_state) + +- nsid->nsid_c1) & 0xFFFF; +- } +- nsid->nsid_state2 = nsid->nsid_state; +- } +- return (ISC_R_SUCCESS); +-} +- +-static void +-nsid_destroy(isc_mem_t *mctx, dns_nsid_t *nsid) { +- if (nsid->nsid_usepool) +- isc_mem_put(mctx, nsid->nsid_pool, +- 0x10000 * sizeof(isc_uint16_t)); +- else +- isc_mem_put(mctx, nsid->nsid_vtable, +- NSID_SHUFFLE_TABLE_SIZE * (sizeof(isc_uint16_t)) ); +- memset(nsid, 0, sizeof(*nsid)); +-} +- +-void +-dns_dispatch_hash(void *data, size_t len) { +- nsid_hash(data, len); +-} +Index: contrib/bind9/lib/dns/resolver.c +=================================================================== +RCS file: /usr/ncvs/src/contrib/bind9/lib/dns/resolver.c,v +retrieving revision 1.1.1.2.2.6 +diff -u -r1.1.1.2.2.6 resolver.c +--- contrib/bind9/lib/dns/resolver.c 7 Feb 2007 00:42:08 -0000 1.1.1.2.2.6 ++++ contrib/bind9/lib/dns/resolver.c 10 Jul 2008 16:07:28 -0000 +@@ -1054,17 +1054,50 @@ + * A dispatch will be created once the connect succeeds. + */ + } else { ++ isc_sockaddr_t localaddr; ++ unsigned int attrs, attrmask; ++ dns_dispatch_t *disp_base; ++ ++ attrs = 0; ++ attrs |= DNS_DISPATCHATTR_UDP; ++ attrs |= DNS_DISPATCHATTR_RANDOMPORT; ++ ++ attrmask = 0; ++ attrmask |= DNS_DISPATCHATTR_UDP; ++ attrmask |= DNS_DISPATCHATTR_TCP; ++ attrmask |= DNS_DISPATCHATTR_IPV4; ++ attrmask |= DNS_DISPATCHATTR_IPV6; ++ + switch (isc_sockaddr_pf(&addrinfo->sockaddr)) { +- case PF_INET: +- dns_dispatch_attach(res->dispatchv4, &query->dispatch); ++ case AF_INET: ++ disp_base = res->dispatchv4; ++ attrs |= DNS_DISPATCHATTR_IPV4; + break; +- case PF_INET6: +- dns_dispatch_attach(res->dispatchv6, &query->dispatch); ++ case AF_INET6: ++ disp_base = res->dispatchv6; ++ attrs |= DNS_DISPATCHATTR_IPV6; + break; + default: + result = ISC_R_NOTIMPLEMENTED; + goto cleanup_query; + } ++ ++ result = dns_dispatch_getlocaladdress(disp_base, &localaddr); ++ if (result != ISC_R_SUCCESS) ++ goto cleanup_query; ++ if (isc_sockaddr_getport(&localaddr) == 0) { ++ result = dns_dispatch_getudp(res->dispatchmgr, ++ res->socketmgr, ++ res->taskmgr, ++ &localaddr, ++ 4096, 1000, 32768, ++ 16411, 16433, ++ attrs, attrmask, ++ &query->dispatch); ++ if (result != ISC_R_SUCCESS) ++ goto cleanup_query; ++ } else ++ dns_dispatch_attach(disp_base, &query->dispatch); + /* + * We should always have a valid dispatcher here. If we + * don't support a protocol family, then its dispatcher +Index: contrib/bind9/lib/dns/include/dns/dispatch.h +=================================================================== +RCS file: /usr/ncvs/src/contrib/bind9/lib/dns/include/dns/dispatch.h,v +retrieving revision 1.1.1.1.4.1 +diff -u -r1.1.1.1.4.1 dispatch.h +--- contrib/bind9/lib/dns/include/dns/dispatch.h 25 Jul 2007 08:23:07 -0000 1.1.1.1.4.1 ++++ contrib/bind9/lib/dns/include/dns/dispatch.h 10 Jul 2008 16:07:28 -0000 +@@ -112,6 +112,9 @@ + * _MAKEQUERY + * The dispatcher can be used to issue queries to other servers, and + * accept replies from them. ++ * ++ * _RANDOMPORT ++ * Allocate UDP port randomly. + */ + #define DNS_DISPATCHATTR_PRIVATE 0x00000001U + #define DNS_DISPATCHATTR_TCP 0x00000002U +@@ -121,6 +124,7 @@ + #define DNS_DISPATCHATTR_NOLISTEN 0x00000020U + #define DNS_DISPATCHATTR_MAKEQUERY 0x00000040U + #define DNS_DISPATCHATTR_CONNECTED 0x00000080U ++#define DNS_DISPATCHATTR_RANDOMPORT 0x00000100U + + isc_result_t + dns_dispatchmgr_create(isc_mem_t *mctx, isc_entropy_t *entropy, +@@ -437,13 +441,6 @@ + * event != NULL + */ + +-void +-dns_dispatch_hash(void *data, size_t len); +-/*%< +- * Feed 'data' to the dispatch query id generator where 'len' is the size +- * of 'data'. +- */ +- + ISC_LANG_ENDDECLS + + #endif /* DNS_DISPATCH_H */ Index: user/cperciva/freebsd-update-build/patches/6.4-BETA/1-SA-08:10.nd6 =================================================================== --- user/cperciva/freebsd-update-build/patches/6.4-BETA/1-SA-08:10.nd6 (nonexistent) +++ user/cperciva/freebsd-update-build/patches/6.4-BETA/1-SA-08:10.nd6 (revision 293366) @@ -0,0 +1,86 @@ +Index: sys/netinet6/in6.h +=================================================================== +RCS file: /home/ncvs/src/sys/netinet6/in6.h,v +retrieving revision 1.36.2.9 +diff -u -p -r1.36.2.9 in6.h +--- sys/netinet6/in6.h 1 Sep 2008 22:57:56 -0000 1.36.2.9 ++++ sys/netinet6/in6.h 28 Sep 2008 21:27:09 -0000 +@@ -575,7 +575,8 @@ struct ip6_mtuinfo { + /* to define items, should talk with KAME guys first, for *BSD compatibility */ + #define IPV6CTL_STEALTH 45 + #define IPV6CTL_RTHDR0_ALLOWED 46 +-#define IPV6CTL_MAXID 47 ++#define ICMPV6CTL_ND6_ONLINKNSRFC4861 47 ++#define IPV6CTL_MAXID 48 + #endif /* __BSD_VISIBLE */ + + /* +Index: sys/netinet6/in6_proto.c +=================================================================== +RCS file: /home/ncvs/src/sys/netinet6/in6_proto.c,v +retrieving revision 1.32.2.9 +diff -u -p -r1.32.2.9 in6_proto.c +--- sys/netinet6/in6_proto.c 1 Sep 2008 22:57:56 -0000 1.32.2.9 ++++ sys/netinet6/in6_proto.c 28 Sep 2008 21:26:24 -0000 +@@ -354,6 +354,7 @@ DOMAIN_SET(inet6); + #ifndef IPV6_SENDREDIRECTS + #define IPV6_SENDREDIRECTS 1 + #endif ++int nd6_onlink_ns_rfc4861 = 0; /* allow 'on-link' nd6 NS (as in RFC 4861) */ + + int ip6_forwarding = IPV6FORWARDING; /* act as router? */ + int ip6_sendredirects = IPV6_SENDREDIRECTS; +@@ -553,3 +554,6 @@ SYSCTL_INT(_net_inet6_icmp6, ICMPV6CTL_N + nd6_maxnudhint, CTLFLAG_RW, &nd6_maxnudhint, 0, ""); + SYSCTL_INT(_net_inet6_icmp6, ICMPV6CTL_ND6_DEBUG, + nd6_debug, CTLFLAG_RW, &nd6_debug, 0, ""); ++SYSCTL_INT(_net_inet6_icmp6, ICMPV6CTL_ND6_ONLINKNSRFC4861, ++ nd6_onlink_ns_rfc4861, CTLFLAG_RW, &nd6_onlink_ns_rfc4861, 0, ++ "Accept 'on-link' nd6 NS in compliance with RFC 4861."); +Index: sys/netinet6/nd6.h +=================================================================== +RCS file: /home/ncvs/src/sys/netinet6/nd6.h,v +retrieving revision 1.19.2.3 +diff -u -p -r1.19.2.3 nd6.h +--- sys/netinet6/nd6.h 1 Sep 2008 22:57:56 -0000 1.19.2.3 ++++ sys/netinet6/nd6.h 28 Sep 2008 21:26:24 -0000 +@@ -339,6 +339,7 @@ extern struct llinfo_nd6 llinfo_nd6; + extern struct nd_drhead nd_defrouter; + extern struct nd_prhead nd_prefix; + extern int nd6_debug; ++extern int nd6_onlink_ns_rfc4861; + + #define nd6log(x) do { if (nd6_debug) log x; } while (/*CONSTCOND*/ 0) + +Index: sys/netinet6/nd6_nbr.c +=================================================================== +RCS file: /home/ncvs/src/sys/netinet6/nd6_nbr.c,v +retrieving revision 1.29.2.10 +diff -u -p -r1.29.2.10 nd6_nbr.c +--- sys/netinet6/nd6_nbr.c 1 Sep 2008 22:57:56 -0000 1.29.2.10 ++++ sys/netinet6/nd6_nbr.c 28 Sep 2008 21:26:24 -0000 +@@ -148,6 +148,24 @@ nd6_ns_input(m, off, icmp6len) + "(wrong ip6 dst)\n")); + goto bad; + } ++ } else if (!nd6_onlink_ns_rfc4861) { ++ struct sockaddr_in6 src_sa6; ++ ++ /* ++ * According to recent IETF discussions, it is not a good idea ++ * to accept a NS from an address which would not be deemed ++ * to be a neighbor otherwise. This point is expected to be ++ * clarified in future revisions of the specification. ++ */ ++ bzero(&src_sa6, sizeof(src_sa6)); ++ src_sa6.sin6_family = AF_INET6; ++ src_sa6.sin6_len = sizeof(src_sa6); ++ src_sa6.sin6_addr = saddr6; ++ if (!nd6_is_addr_neighbor(&src_sa6, ifp)) { ++ nd6log((LOG_INFO, "nd6_ns_input: " ++ "NS packet from non-neighbor\n")); ++ goto bad; ++ } + } + + if (IN6_IS_ADDR_MULTICAST(&taddr6)) { Index: user/cperciva/freebsd-update-build/patches/6.4-RC2/1-SA-08:11.arc4random =================================================================== --- user/cperciva/freebsd-update-build/patches/6.4-RC2/1-SA-08:11.arc4random (nonexistent) +++ user/cperciva/freebsd-update-build/patches/6.4-RC2/1-SA-08:11.arc4random (revision 293366) @@ -0,0 +1,81 @@ +Index: sys/dev/random/randomdev.c +=================================================================== +--- sys/dev/random/randomdev.c (revision 185214) ++++ sys/dev/random/randomdev.c (working copy) +@@ -89,6 +89,7 @@ + && (securelevel_gt(td->td_ucred, 0) == 0)) { + (*random_systat.reseed)(); + random_systat.seeded = 1; ++ arc4rand(NULL, 0, 1); /* Reseed arc4random as well. */ + } + + return (0); +Index: sys/dev/random/randomdev_soft.c +=================================================================== +--- sys/dev/random/randomdev_soft.c (revision 185214) ++++ sys/dev/random/randomdev_soft.c (working copy) +@@ -61,6 +61,7 @@ + u_int, u_int, enum esource); + static int random_yarrow_poll(int event,struct thread *td); + static int random_yarrow_block(int flag); ++static void random_yarrow_flush_reseed(void); + + struct random_systat random_yarrow = { + .ident = "Software, Yarrow", +@@ -70,7 +71,7 @@ + .read = random_yarrow_read, + .write = random_yarrow_write, + .poll = random_yarrow_poll, +- .reseed = random_yarrow_reseed, ++ .reseed = random_yarrow_flush_reseed, + .seeded = 1, + }; + +@@ -96,7 +97,7 @@ + /* Harvested entropy */ + static struct entropyfifo harvestfifo[ENTROPYSOURCE]; + +-/* <0 to end the kthread, 0 to let it run */ ++/* <0 to end the kthread, 0 to let it run, 1 to flush the harvest queues */ + static int random_kthread_control = 0; + + static struct proc *random_kthread_proc; +@@ -247,7 +248,7 @@ + local_count = 0; + + /* Process until told to stop */ +- for (; random_kthread_control == 0;) { ++ for (; random_kthread_control >= 0;) { + + active = 0; + +@@ -282,6 +283,13 @@ + KASSERT(local_count == 0, ("random_kthread: local_count %d", + local_count)); + ++ /* ++ * If a queue flush was commanded, it has now happened, ++ * and we can mark this by resetting the command. ++ */ ++ if (random_kthread_control == 1) ++ random_kthread_control = 0; ++ + /* Found nothing, so don't belabour the issue */ + if (!active) + tsleep(&harvestfifo, 0, "-", hz / 10); +@@ -406,3 +414,15 @@ + + return error; + } ++ ++/* Helper routine to perform explicit reseeds */ ++static void ++random_yarrow_flush_reseed(void) ++{ ++ /* Command a entropy queue flush and wait for it to finish */ ++ random_kthread_control = 1; ++ while (random_kthread_control) ++ tsleep(&harvestfifo, 0, "-", hz / 10); ++ ++ random_yarrow_reseed(); ++} Index: user/cperciva/freebsd-update-build/patches/7.0-BETA2/1-SA-07:09.random =================================================================== --- user/cperciva/freebsd-update-build/patches/7.0-BETA2/1-SA-07:09.random (nonexistent) +++ user/cperciva/freebsd-update-build/patches/7.0-BETA2/1-SA-07:09.random (revision 293366) @@ -0,0 +1,15 @@ +Index: sys/dev/random/yarrow.c +=================================================================== +RCS file: /usr/ncvs/src/sys/dev/random/yarrow.c,v +retrieving revision 1.47 +diff -u -r1.47 yarrow.c +--- sys/dev/random/yarrow.c 27 May 2007 18:54:58 -0000 1.47 ++++ sys/dev/random/yarrow.c 27 Nov 2007 17:17:29 -0000 +@@ -296,6 +296,7 @@ + random_state.outputblocks = 0; + } + retval += (int)tomove; ++ cur = 0; + } + } + else { Index: user/cperciva/freebsd-update-build/patches/7.0-BETA3/1-SA-07:09.random =================================================================== --- user/cperciva/freebsd-update-build/patches/7.0-BETA3/1-SA-07:09.random (nonexistent) +++ user/cperciva/freebsd-update-build/patches/7.0-BETA3/1-SA-07:09.random (revision 293366) @@ -0,0 +1,15 @@ +Index: sys/dev/random/yarrow.c +=================================================================== +RCS file: /usr/ncvs/src/sys/dev/random/yarrow.c,v +retrieving revision 1.47 +diff -u -r1.47 yarrow.c +--- sys/dev/random/yarrow.c 27 May 2007 18:54:58 -0000 1.47 ++++ sys/dev/random/yarrow.c 27 Nov 2007 17:17:29 -0000 +@@ -296,6 +296,7 @@ + random_state.outputblocks = 0; + } + retval += (int)tomove; ++ cur = 0; + } + } + else { Index: user/cperciva/freebsd-update-build/patches/7.0-RC1/1-SA-08:01.pty =================================================================== --- user/cperciva/freebsd-update-build/patches/7.0-RC1/1-SA-08:01.pty (nonexistent) +++ user/cperciva/freebsd-update-build/patches/7.0-RC1/1-SA-08:01.pty (revision 293366) @@ -0,0 +1,289 @@ +Index: lib/libc/stdlib/grantpt.c +=================================================================== +RCS file: /home/ncvs/src/lib/libc/stdlib/grantpt.c,v +retrieving revision 1.7.2.2 +diff -u -d -r1.7.2.2 grantpt.c +--- lib/libc/stdlib/grantpt.c 18 Dec 2007 00:35:01 -0000 1.7.2.2 ++++ lib/libc/stdlib/grantpt.c 13 Jan 2008 22:23:58 -0000 +@@ -56,18 +56,19 @@ + #include + #include "un-namespace.h" + +-#define PTM_PREFIX "pty" /* pseudo tty master naming convention */ +-#define PTS_PREFIX "tty" /* pseudo tty slave naming convention */ +-#define NEWPTS_PREFIX "pts" ++#define PTYM_PREFIX "pty" /* pty(4) master naming convention */ ++#define PTYS_PREFIX "tty" /* pty(4) slave naming convention */ ++#define PTMXM_PREFIX "ptc/" /* pts(4) master naming convention */ ++#define PTMXS_PREFIX "pts/" /* pts(4) slave naming convention */ + #define PTMX "ptmx" + + /* + * The following are range values for pseudo TTY devices. Pseudo TTYs have a + * name of /dev/[pt]ty[l-sL-S][0-9a-v], yielding 256 combinations per major. + */ +-#define PT_MAX 256 +-#define PT_DEV1 "pqrsPQRSlmnoLMNO" +-#define PT_DEV2 "0123456789abcdefghijklmnopqrstuv" ++#define PTY_MAX 256 ++#define PTY_DEV1 "pqrsPQRSlmnoLMNO" ++#define PTY_DEV2 "0123456789abcdefghijklmnopqrstuv" + + /* + * grantpt(3) support utility. +@@ -80,16 +81,8 @@ + */ + #define ISPTM(x) (S_ISCHR((x).st_mode) && \ + minor((x).st_rdev) >= 0 && \ +- minor((x).st_rdev) < PT_MAX) +- +- +-static int +-is_pts(int fd) +-{ +- int nb; ++ minor((x).st_rdev) < PTY_MAX) + +- return (_ioctl(fd, TIOCGPTN, &nb) == 0); +-} + + #if 0 + int +@@ -104,7 +97,7 @@ + if (error) { + struct stat sb; + +- if (stat("/dev/ptmx", &sb) != 0) ++ if (stat(_PATH_DEV PTMX, &sb) != 0) + return (0); + use_pts = 1; + } +@@ -199,7 +192,7 @@ + int + posix_openpt(int oflag) + { +- char *mc1, *mc2, master[] = _PATH_DEV PTM_PREFIX "XY"; ++ char *mc1, *mc2, master[] = _PATH_DEV PTYM_PREFIX "XY"; + const char *pc1, *pc2; + int fildes, bflag, serrno; + +@@ -220,12 +213,12 @@ + return (fildes); + } + #endif +- mc1 = master + strlen(_PATH_DEV PTM_PREFIX); ++ mc1 = master + strlen(_PATH_DEV PTYM_PREFIX); + mc2 = mc1 + 1; + + /* Cycle through all possible master PTY devices. */ +- for (pc1 = PT_DEV1; !bflag && (*mc1 = *pc1); ++pc1) +- for (pc2 = PT_DEV2; (*mc2 = *pc2) != '\0'; ++pc2) { ++ for (pc1 = PTY_DEV1; !bflag && (*mc1 = *pc1); ++pc1) ++ for (pc2 = PTY_DEV2; (*mc2 = *pc2) != '\0'; ++pc2) { + /* + * Break out if we successfully open a PTY, + * or if open() fails due to limits. +@@ -253,34 +246,44 @@ + char * + ptsname(int fildes) + { +- static char slave[] = _PATH_DEV PTS_PREFIX "XY"; +- static char new_slave[] = _PATH_DEV NEWPTS_PREFIX "4294967295"; +- char *retval; ++ static char pty_slave[] = _PATH_DEV PTYS_PREFIX "XY"; ++#if 0 ++ static char ptmx_slave[] = _PATH_DEV PTMXS_PREFIX "4294967295"; ++#endif ++ const char *master; + struct stat sbuf; ++#if 0 ++ int ptn; + +- retval = NULL; +- +- if (_fstat(fildes, &sbuf) == 0) { +- if (!ISPTM(sbuf)) +- errno = EINVAL; +- else { +- if (!is_pts(fildes)) { +- (void)snprintf(slave, sizeof(slave), +- _PATH_DEV PTS_PREFIX "%s", +- devname(sbuf.st_rdev, S_IFCHR) + +- strlen(PTM_PREFIX)); +- retval = slave; +- } else { +- (void)snprintf(new_slave, sizeof(new_slave), +- _PATH_DEV NEWPTS_PREFIX "%s", +- devname(sbuf.st_rdev, S_IFCHR) + +- strlen(PTM_PREFIX)); +- retval = new_slave; +- } +- } ++ /* Handle pts(4) masters first. */ ++ if (_ioctl(fildes, TIOCGPTN, &ptn) == 0) { ++ (void)snprintf(ptmx_slave, sizeof(ptmx_slave), ++ _PATH_DEV PTMXS_PREFIX "%d", ptn); ++ return (ptmx_slave); + } ++#endif + +- return (retval); ++ /* All master pty's must be char devices. */ ++ if (_fstat(fildes, &sbuf) == -1) ++ goto invalid; ++ if (!S_ISCHR(sbuf.st_mode)) ++ goto invalid; ++ ++ /* Check to see if this device is a pty(4) master. */ ++ master = devname(sbuf.st_rdev, S_IFCHR); ++ if (strlen(master) != strlen(PTYM_PREFIX "XY")) ++ goto invalid; ++ if (strncmp(master, PTYM_PREFIX, strlen(PTYM_PREFIX)) != 0) ++ goto invalid; ++ ++ /* It is, so generate the corresponding pty(4) slave name. */ ++ (void)snprintf(pty_slave, sizeof(pty_slave), _PATH_DEV PTYS_PREFIX "%s", ++ master + strlen(PTYM_PREFIX)); ++ return (pty_slave); ++ ++invalid: ++ errno = EINVAL; ++ return (NULL); + } + + /* +@@ -289,18 +292,14 @@ + int + unlockpt(int fildes) + { +- int retval; +- struct stat sbuf; + + /* + * Unlocking a master/slave pseudo-terminal pair has no meaning in a + * non-streams PTY environment. However, we do ensure fildes is a + * valid master pseudo-terminal device. + */ +- if ((retval = _fstat(fildes, &sbuf)) == 0 && !ISPTM(sbuf)) { +- errno = EINVAL; +- retval = -1; +- } ++ if (ptsname(fildes) == NULL) ++ return (-1); + +- return (retval); ++ return (0); + } +Index: lib/libutil/pty.c +=================================================================== +RCS file: /home/ncvs/src/lib/libutil/pty.c,v +retrieving revision 1.17.2.2 +diff -u -d -r1.17.2.2 pty.c +--- lib/libutil/pty.c 6 Dec 2007 10:15:29 -0000 1.17.2.2 ++++ lib/libutil/pty.c 9 Jan 2008 14:41:48 -0000 +@@ -49,13 +49,11 @@ + #include + #include + +-#if 0 +-int __use_pts(void); +- +-static int +-new_openpty(int *amaster, int *aslave, char *name, struct termios *termp, ++int ++openpty(int *amaster, int *aslave, char *name, struct termios *termp, + struct winsize *winp) + { ++ const char *slavename; + int master, slave; + + master = posix_openpt(O_RDWR); +@@ -67,7 +65,18 @@ + return (-1); + } + +- slave = open(ptsname(master), O_RDWR); ++ slavename = ptsname(master); ++ if (slavename == NULL) { ++ close(master); ++ return (-1); ++ } ++ ++ if (revoke(slavename) == -1) { ++ close(master); ++ return (-1); ++ } ++ ++ slave = open(slavename, O_RDWR); + if (slave == -1) { + close(master); + return (-1); +@@ -83,7 +92,7 @@ + *aslave = slave; + + if (name) +- strcpy(name, ptsname(master)); ++ strcpy(name, slavename); + if (termp) + tcsetattr(slave, TCSAFLUSH, termp); + if (winp) +@@ -91,59 +100,6 @@ + + return (0); + } +-#endif +- +-int +-openpty(int *amaster, int *aslave, char *name, struct termios *termp, struct winsize *winp) +-{ +- char line[] = "/dev/ptyXX"; +- const char *cp1, *cp2; +- int master, slave, ttygid; +- struct group *gr; +- +-#if 0 +- if (__use_pts()) +- return (new_openpty(amaster, aslave, name, termp, winp)); +-#endif +- +- if ((gr = getgrnam("tty")) != NULL) +- ttygid = gr->gr_gid; +- else +- ttygid = -1; +- +- for (cp1 = "pqrsPQRSlmnoLMNO"; *cp1; cp1++) { +- line[8] = *cp1; +- for (cp2 = "0123456789abcdefghijklmnopqrstuv"; *cp2; cp2++) { +- line[5] = 'p'; +- line[9] = *cp2; +- if ((master = open(line, O_RDWR, 0)) == -1) { +- if (errno == ENOENT) +- break; /* try the next pty group */ +- } else { +- line[5] = 't'; +- (void) chown(line, getuid(), ttygid); +- (void) chmod(line, S_IRUSR|S_IWUSR|S_IWGRP); +- (void) revoke(line); +- if ((slave = open(line, O_RDWR, 0)) != -1) { +- *amaster = master; +- *aslave = slave; +- if (name) +- strcpy(name, line); +- if (termp) +- (void) tcsetattr(slave, +- TCSAFLUSH, termp); +- if (winp) +- (void) ioctl(slave, TIOCSWINSZ, +- (char *)winp); +- return (0); +- } +- (void) close(master); +- } +- } +- } +- errno = ENOENT; /* out of ptys */ +- return (-1); +-} + + int + forkpty(int *amaster, char *name, struct termios *termp, struct winsize *winp) Index: user/cperciva/freebsd-update-build/patches/7.0-RC1/1-SA-08:02.libc =================================================================== --- user/cperciva/freebsd-update-build/patches/7.0-RC1/1-SA-08:02.libc (nonexistent) +++ user/cperciva/freebsd-update-build/patches/7.0-RC1/1-SA-08:02.libc (revision 293366) @@ -0,0 +1,19 @@ +Index: lib/libc/inet/inet_network.c +=================================================================== +RCS file: /home/ncvs/src/lib/libc/inet/inet_network.c,v +retrieving revision 1.4 +diff -u -u -r1.4 inet_network.c +--- lib/libc/inet/inet_network.c 3 Jun 2007 17:20:26 -0000 1.4 ++++ lib/libc/inet/inet_network.c 6 Jan 2008 15:38:28 -0000 +@@ -82,9 +82,9 @@ + } + if (!digit) + return (INADDR_NONE); ++ if (pp >= parts + 4 || val > 0xffU) ++ return (INADDR_NONE); + if (*cp == '.') { +- if (pp >= parts + 4 || val > 0xffU) +- return (INADDR_NONE); + *pp++ = val, cp++; + goto again; + } Index: user/cperciva/freebsd-update-build/patches/7.0-RC2/1-SA-08:03.sendfile =================================================================== --- user/cperciva/freebsd-update-build/patches/7.0-RC2/1-SA-08:03.sendfile (nonexistent) +++ user/cperciva/freebsd-update-build/patches/7.0-RC2/1-SA-08:03.sendfile (revision 293366) @@ -0,0 +1,61 @@ +Index: sys/kern/kern_descrip.c +=================================================================== +RCS file: /home/ncvs/src/sys/kern/kern_descrip.c,v +retrieving revision 1.313 +diff -u -d -r1.313 kern_descrip.c +--- sys/kern/kern_descrip.c 6 Aug 2007 14:26:00 -0000 1.313 ++++ sys/kern/kern_descrip.c 4 Feb 2008 19:05:42 -0000 +@@ -2046,7 +2046,7 @@ + int error; + + *vpp = NULL; +- if ((error = _fget(td, fd, &fp, 0, 0)) != 0) ++ if ((error = _fget(td, fd, &fp, flags, 0)) != 0) + return (error); + if (fp->f_vnode == NULL) { + error = EINVAL; +Index: sys/kern/uipc_syscalls.c +=================================================================== +RCS file: /home/ncvs/src/sys/kern/uipc_syscalls.c,v +retrieving revision 1.259.2.1 +diff -u -d -r1.259.2.1 uipc_syscalls.c +--- sys/kern/uipc_syscalls.c 1 Feb 2008 22:51:39 -0000 1.259.2.1 ++++ sys/kern/uipc_syscalls.c 4 Feb 2008 19:05:42 -0000 +@@ -1796,20 +1796,23 @@ + goto out; + vfslocked = VFS_LOCK_GIANT(vp->v_mount); + vn_lock(vp, LK_EXCLUSIVE | LK_RETRY, td); +- obj = vp->v_object; +- if (obj != NULL) { +- /* +- * Temporarily increase the backing VM object's reference +- * count so that a forced reclamation of its vnode does not +- * immediately destroy it. +- */ +- VM_OBJECT_LOCK(obj); +- if ((obj->flags & OBJ_DEAD) == 0) { +- vm_object_reference_locked(obj); +- VM_OBJECT_UNLOCK(obj); +- } else { +- VM_OBJECT_UNLOCK(obj); +- obj = NULL; ++ if (vp->v_type == VREG) { ++ obj = vp->v_object; ++ if (obj != NULL) { ++ /* ++ * Temporarily increase the backing VM ++ * object's reference count so that a forced ++ * reclamation of its vnode does not ++ * immediately destroy it. ++ */ ++ VM_OBJECT_LOCK(obj); ++ if ((obj->flags & OBJ_DEAD) == 0) { ++ vm_object_reference_locked(obj); ++ VM_OBJECT_UNLOCK(obj); ++ } else { ++ VM_OBJECT_UNLOCK(obj); ++ obj = NULL; ++ } + } + } + VOP_UNLOCK(vp, 0, td); Index: user/cperciva/freebsd-update-build/patches/7.0-RELEASE/4-SA-08:09.icmp =================================================================== --- user/cperciva/freebsd-update-build/patches/7.0-RELEASE/4-SA-08:09.icmp (nonexistent) +++ user/cperciva/freebsd-update-build/patches/7.0-RELEASE/4-SA-08:09.icmp (revision 293366) @@ -0,0 +1,23 @@ +Index: sys/netinet6/icmp6.c +=================================================================== +RCS file: /home/ncvs/src/sys/netinet6/icmp6.c,v +retrieving revision 1.80.2.4 +diff -u -p -r1.80.2.4 icmp6.c +--- sys/netinet6/icmp6.c 31 Aug 2008 21:54:24 -0000 1.80.2.4 ++++ sys/netinet6/icmp6.c 1 Sep 2008 23:03:44 -0000 +@@ -1117,6 +1117,15 @@ icmp6_mtudisc_update(struct ip6ctlparam + if (!validated) + return; + ++ /* ++ * In case the suggested mtu is less than IPV6_MMTU, we ++ * only need to remember that it was for above mentioned ++ * "alwaysfrag" case. ++ * Try to be as close to the spec as possible. ++ */ ++ if (mtu < IPV6_MMTU) ++ mtu = IPV6_MMTU - 8; ++ + bzero(&inc, sizeof(inc)); + inc.inc_flags = 1; /* IPv6 */ + inc.inc6_faddr = *dst; Index: user/cperciva/freebsd-update-build/patches/7.1-BETA/0-openssh.man =================================================================== --- user/cperciva/freebsd-update-build/patches/7.1-BETA/0-openssh.man (nonexistent) +++ user/cperciva/freebsd-update-build/patches/7.1-BETA/0-openssh.man (revision 293366) @@ -0,0 +1,169 @@ +Index: crypto/openssh/scp.1 +=================================================================== +--- crypto/openssh/scp.1 (revision 183457) ++++ crypto/openssh/scp.1 (working copy) +@@ -11,7 +11,7 @@ + .\" + .\" $OpenBSD: scp.1,v 1.46 2008/07/12 05:33:41 djm Exp $ + .\" +-.Dd $Mdocdate: July 12 2008 $ ++.Dd July 12 2008 + .Dt SCP 1 + .Os + .Sh NAME +Index: crypto/openssh/ssh-agent.1 +=================================================================== +--- crypto/openssh/ssh-agent.1 (revision 183457) ++++ crypto/openssh/ssh-agent.1 (working copy) +@@ -34,7 +34,7 @@ + .\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF + .\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. + .\" +-.Dd $Mdocdate: June 5 2007 $ ++.Dd June 5 2007 + .Dt SSH-AGENT 1 + .Os + .Sh NAME +Index: crypto/openssh/moduli.5 +=================================================================== +--- crypto/openssh/moduli.5 (revision 183457) ++++ crypto/openssh/moduli.5 (working copy) +@@ -13,7 +13,7 @@ + .\" WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN + .\" ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF + .\" OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. +-.Dd $Mdocdate: June 26 2008 $ ++.Dd June 26 2008 + .Dt MODULI 5 + .Os + .Sh NAME +Index: crypto/openssh/ssh.1 +=================================================================== +--- crypto/openssh/ssh.1 (revision 183457) ++++ crypto/openssh/ssh.1 (working copy) +@@ -36,7 +36,7 @@ + .\" + .\" $OpenBSD: ssh.1,v 1.277 2008/07/02 13:47:39 djm Exp $ + .\" $FreeBSD: src/crypto/openssh/ssh.1,v 1.35.2.1 2008/09/01 20:03:13 des Exp $ +-.Dd $Mdocdate: July 2 2008 $ ++.Dd July 2 2008 + .Dt SSH 1 + .Os + .Sh NAME +Index: crypto/openssh/ssh-keyscan.1 +=================================================================== +--- crypto/openssh/ssh-keyscan.1 (revision 183457) ++++ crypto/openssh/ssh-keyscan.1 (working copy) +@@ -6,7 +6,7 @@ + .\" permitted provided that due credit is given to the author and the + .\" OpenBSD project by leaving this copyright notice intact. + .\" +-.Dd $Mdocdate: April 30 2008 $ ++.Dd April 30 2008 + .Dt SSH-KEYSCAN 1 + .Os + .Sh NAME +Index: crypto/openssh/sshd.8 +=================================================================== +--- crypto/openssh/sshd.8 (revision 183457) ++++ crypto/openssh/sshd.8 (working copy) +@@ -36,7 +36,7 @@ + .\" + .\" $OpenBSD: sshd.8,v 1.246 2008/07/02 02:24:18 djm Exp $ + .\" $FreeBSD: src/crypto/openssh/sshd.8,v 1.34.2.1 2008/09/01 20:03:13 des Exp $ +-.Dd $Mdocdate: July 2 2008 $ ++.Dd July 2 2008 + .Dt SSHD 8 + .Os + .Sh NAME +Index: crypto/openssh/sftp.1 +=================================================================== +--- crypto/openssh/sftp.1 (revision 183457) ++++ crypto/openssh/sftp.1 (working copy) +@@ -22,7 +22,7 @@ + .\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF + .\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. + .\" +-.Dd $Mdocdate: July 15 2008 $ ++.Dd July 15 2008 + .Dt SFTP 1 + .Os + .Sh NAME +Index: crypto/openssh/sftp-server.8 +=================================================================== +--- crypto/openssh/sftp-server.8 (revision 183457) ++++ crypto/openssh/sftp-server.8 (working copy) +@@ -22,7 +22,7 @@ + .\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF + .\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. + .\" +-.Dd $Mdocdate: July 18 2008 $ ++.Dd July 18 2008 + .Dt SFTP-SERVER 8 + .Os + .Sh NAME +Index: crypto/openssh/ssh-keysign.8 +=================================================================== +--- crypto/openssh/ssh-keysign.8 (revision 183457) ++++ crypto/openssh/ssh-keysign.8 (working copy) +@@ -22,7 +22,7 @@ + .\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF + .\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. + .\" +-.Dd $Mdocdate: May 31 2007 $ ++.Dd May 31 2007 + .Dt SSH-KEYSIGN 8 + .Os + .Sh NAME +Index: crypto/openssh/ssh-add.1 +=================================================================== +--- crypto/openssh/ssh-add.1 (revision 183457) ++++ crypto/openssh/ssh-add.1 (working copy) +@@ -37,7 +37,7 @@ + .\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF + .\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. + .\" +-.Dd $Mdocdate: June 12 2007 $ ++.Dd June 12 2007 + .Dt SSH-ADD 1 + .Os + .Sh NAME +Index: crypto/openssh/sshd_config.5 +=================================================================== +--- crypto/openssh/sshd_config.5 (revision 183457) ++++ crypto/openssh/sshd_config.5 (working copy) +@@ -36,7 +36,7 @@ + .\" + .\" $OpenBSD: sshd_config.5,v 1.96 2008/07/02 02:24:18 djm Exp $ + .\" $FreeBSD: src/crypto/openssh/sshd_config.5,v 1.29.2.1 2008/09/01 20:03:13 des Exp $ +-.Dd $Mdocdate: July 2 2008 $ ++.Dd July 2 2008 + .Dt SSHD_CONFIG 5 + .Os + .Sh NAME +Index: crypto/openssh/ssh-keygen.1 +=================================================================== +--- crypto/openssh/ssh-keygen.1 (revision 183457) ++++ crypto/openssh/ssh-keygen.1 (working copy) +@@ -37,7 +37,7 @@ + .\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF + .\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. + .\" +-.Dd $Mdocdate: June 12 2008 $ ++.Dd June 12 2008 + .Dt SSH-KEYGEN 1 + .Os + .Sh NAME +Index: crypto/openssh/ssh_config.5 +=================================================================== +--- crypto/openssh/ssh_config.5 (revision 183457) ++++ crypto/openssh/ssh_config.5 (working copy) +@@ -36,7 +36,7 @@ + .\" + .\" $OpenBSD: ssh_config.5,v 1.111 2008/06/26 11:46:31 grunk Exp $ + .\" $FreeBSD: src/crypto/openssh/ssh_config.5,v 1.23.2.2 2008/09/01 23:49:34 des Exp $ +-.Dd $Mdocdate: June 26 2008 $ ++.Dd June 26 2008 + .Dt SSH_CONFIG 5 + .Os + .Sh NAME Index: user/cperciva/freebsd-update-build/patches/7.1-BETA/1-SA-08:10.nd6 =================================================================== --- user/cperciva/freebsd-update-build/patches/7.1-BETA/1-SA-08:10.nd6 (nonexistent) +++ user/cperciva/freebsd-update-build/patches/7.1-BETA/1-SA-08:10.nd6 (revision 293366) @@ -0,0 +1,87 @@ +Index: sys/netinet6/in6.h +=================================================================== +RCS file: /home/ncvs/src/sys/netinet6/in6.h,v +retrieving revision 1.51.2.1 +diff -u -p -r1.51.2.1 in6.h +--- sys/netinet6/in6.h 1 Sep 2008 19:23:04 -0000 1.51.2.1 ++++ sys/netinet6/in6.h 28 Sep 2008 21:07:34 -0000 +@@ -599,7 +599,9 @@ struct ip6_mtuinfo { + /* New entries should be added here from current IPV6CTL_MAXID value. */ + /* to define items, should talk with KAME guys first, for *BSD compatibility */ + #define IPV6CTL_STEALTH 45 +-#define IPV6CTL_MAXID 46 ++ ++#define ICMPV6CTL_ND6_ONLINKNSRFC4861 47 ++#define IPV6CTL_MAXID 48 + #endif /* __BSD_VISIBLE */ + + /* +Index: sys/netinet6/in6_proto.c +=================================================================== +RCS file: /home/ncvs/src/sys/netinet6/in6_proto.c,v +retrieving revision 1.46.2.2 +diff -u -p -r1.46.2.2 in6_proto.c +--- sys/netinet6/in6_proto.c 1 Sep 2008 19:23:04 -0000 1.46.2.2 ++++ sys/netinet6/in6_proto.c 28 Sep 2008 21:14:27 -0000 +@@ -394,6 +394,7 @@ time_t ip6_log_time = (time_t)0L; + #ifdef IPSTEALTH + int ip6stealth = 0; + #endif ++int nd6_onlink_ns_rfc4861 = 0; /* allow 'on-link' nd6 NS (as in RFC 4861) */ + + /* icmp6 */ + /* +@@ -567,3 +568,6 @@ SYSCTL_INT(_net_inet6_icmp6, ICMPV6CTL_N + nd6_maxnudhint, CTLFLAG_RW, &nd6_maxnudhint, 0, ""); + SYSCTL_INT(_net_inet6_icmp6, ICMPV6CTL_ND6_DEBUG, + nd6_debug, CTLFLAG_RW, &nd6_debug, 0, ""); ++SYSCTL_INT(_net_inet6_icmp6, ICMPV6CTL_ND6_ONLINKNSRFC4861, ++ nd6_onlink_ns_rfc4861, CTLFLAG_RW, &nd6_onlink_ns_rfc4861, 0, ++ "Accept 'on-link' nd6 NS in compliance with RFC 4861."); +Index: sys/netinet6/nd6.h +=================================================================== +RCS file: /home/ncvs/src/sys/netinet6/nd6.h,v +retrieving revision 1.21.2.1 +diff -u -p -r1.21.2.1 nd6.h +--- sys/netinet6/nd6.h 1 Sep 2008 19:23:04 -0000 1.21.2.1 ++++ sys/netinet6/nd6.h 28 Sep 2008 21:18:01 -0000 +@@ -339,6 +339,7 @@ extern struct llinfo_nd6 llinfo_nd6; + extern struct nd_drhead nd_defrouter; + extern struct nd_prhead nd_prefix; + extern int nd6_debug; ++extern int nd6_onlink_ns_rfc4861; + + #define nd6log(x) do { if (nd6_debug) log x; } while (/*CONSTCOND*/ 0) + +Index: sys/netinet6/nd6_nbr.c +=================================================================== +RCS file: /home/ncvs/src/sys/netinet6/nd6_nbr.c,v +retrieving revision 1.47.2.2 +diff -u -p -r1.47.2.2 nd6_nbr.c +--- sys/netinet6/nd6_nbr.c 1 Sep 2008 19:23:04 -0000 1.47.2.2 ++++ sys/netinet6/nd6_nbr.c 28 Sep 2008 21:14:44 -0000 +@@ -145,6 +145,24 @@ nd6_ns_input(struct mbuf *m, int off, in + "(wrong ip6 dst)\n")); + goto bad; + } ++ } else if (!nd6_onlink_ns_rfc4861) { ++ struct sockaddr_in6 src_sa6; ++ ++ /* ++ * According to recent IETF discussions, it is not a good idea ++ * to accept a NS from an address which would not be deemed ++ * to be a neighbor otherwise. This point is expected to be ++ * clarified in future revisions of the specification. ++ */ ++ bzero(&src_sa6, sizeof(src_sa6)); ++ src_sa6.sin6_family = AF_INET6; ++ src_sa6.sin6_len = sizeof(src_sa6); ++ src_sa6.sin6_addr = saddr6; ++ if (!nd6_is_addr_neighbor(&src_sa6, ifp)) { ++ nd6log((LOG_INFO, "nd6_ns_input: " ++ "NS packet from non-neighbor\n")); ++ goto bad; ++ } + } + + if (IN6_IS_ADDR_MULTICAST(&taddr6)) { Index: user/cperciva/freebsd-update-build/patches/7.1-BETA2/1-SA-08:11.arc4random =================================================================== --- user/cperciva/freebsd-update-build/patches/7.1-BETA2/1-SA-08:11.arc4random (nonexistent) +++ user/cperciva/freebsd-update-build/patches/7.1-BETA2/1-SA-08:11.arc4random (revision 293366) @@ -0,0 +1,81 @@ +Index: sys/dev/random/randomdev.c +=================================================================== +--- sys/dev/random/randomdev.c (revision 185214) ++++ sys/dev/random/randomdev.c (working copy) +@@ -90,6 +90,7 @@ + && (securelevel_gt(td->td_ucred, 0) == 0)) { + (*random_systat.reseed)(); + random_systat.seeded = 1; ++ arc4rand(NULL, 0, 1); /* Reseed arc4random as well. */ + } + + return (0); +Index: sys/dev/random/randomdev_soft.c +=================================================================== +--- sys/dev/random/randomdev_soft.c (revision 185214) ++++ sys/dev/random/randomdev_soft.c (working copy) +@@ -61,6 +61,7 @@ + u_int, u_int, enum esource); + static int random_yarrow_poll(int event,struct thread *td); + static int random_yarrow_block(int flag); ++static void random_yarrow_flush_reseed(void); + + struct random_systat random_yarrow = { + .ident = "Software, Yarrow", +@@ -70,7 +71,7 @@ + .read = random_yarrow_read, + .write = random_yarrow_write, + .poll = random_yarrow_poll, +- .reseed = random_yarrow_reseed, ++ .reseed = random_yarrow_flush_reseed, + .seeded = 1, + }; + +@@ -96,7 +97,7 @@ + /* Harvested entropy */ + static struct entropyfifo harvestfifo[ENTROPYSOURCE]; + +-/* <0 to end the kthread, 0 to let it run */ ++/* <0 to end the kthread, 0 to let it run, 1 to flush the harvest queues */ + static int random_kthread_control = 0; + + static struct proc *random_kthread_proc; +@@ -241,7 +242,7 @@ + local_count = 0; + + /* Process until told to stop */ +- for (; random_kthread_control == 0;) { ++ for (; random_kthread_control >= 0;) { + + active = 0; + +@@ -276,6 +277,13 @@ + KASSERT(local_count == 0, ("random_kthread: local_count %d", + local_count)); + ++ /* ++ * If a queue flush was commanded, it has now happened, ++ * and we can mark this by resetting the command. ++ */ ++ if (random_kthread_control == 1) ++ random_kthread_control = 0; ++ + /* Found nothing, so don't belabour the issue */ + if (!active) + pause("-", hz / 10); +@@ -400,3 +408,15 @@ + + return error; + } ++ ++/* Helper routine to perform explicit reseeds */ ++static void ++random_yarrow_flush_reseed(void) ++{ ++ /* Command a entropy queue flush and wait for it to finish */ ++ random_kthread_control = 1; ++ while (random_kthread_control) ++ pause("-", hz / 10); ++ ++ random_yarrow_reseed(); ++} Index: user/cperciva/freebsd-update-build/patches/7.1-RC1/1-SA-08:12.ftpd =================================================================== --- user/cperciva/freebsd-update-build/patches/7.1-RC1/1-SA-08:12.ftpd (nonexistent) +++ user/cperciva/freebsd-update-build/patches/7.1-RC1/1-SA-08:12.ftpd (revision 293366) @@ -0,0 +1,113 @@ +Index: libexec/ftpd/ftpcmd.y +=================================================================== +--- libexec/ftpd/ftpcmd.y (revision 185134) ++++ libexec/ftpd/ftpcmd.y (working copy) +@@ -1191,7 +1191,7 @@ + /* + * getline - a hacked up version of fgets to ignore TELNET escape codes. + */ +-char * ++int + getline(char *s, int n, FILE *iop) + { + int c; +@@ -1207,7 +1207,7 @@ + if (ftpdebug) + syslog(LOG_DEBUG, "command: %s", s); + tmpline[0] = '\0'; +- return(s); ++ return(0); + } + if (c == 0) + tmpline[0] = '\0'; +@@ -1244,13 +1244,24 @@ + } + } + *cs++ = c; +- if (--n <= 0 || c == '\n') ++ if (--n <= 0) { ++ /* ++ * If command doesn't fit into buffer, discard the ++ * rest of the command and indicate truncation. ++ * This prevents the command to be split up into ++ * multiple commands. ++ */ ++ while (c != '\n' && (c = getc(iop)) != EOF) ++ ; ++ return (-2); ++ } ++ if (c == '\n') + break; + } + got_eof: + sigprocmask(SIG_SETMASK, &osset, NULL); + if (c == EOF && cs == s) +- return (NULL); ++ return (-1); + *cs++ = '\0'; + if (ftpdebug) { + if (!guest && strncasecmp("pass ", s, 5) == 0) { +@@ -1270,7 +1281,7 @@ + syslog(LOG_DEBUG, "command: %.*s", len, s); + } + } +- return (s); ++ return (0); + } + + static void +@@ -1300,9 +1311,14 @@ + case CMD: + (void) signal(SIGALRM, toolong); + (void) alarm(timeout); +- if (getline(cbuf, sizeof(cbuf)-1, stdin) == NULL) { ++ n = getline(cbuf, sizeof(cbuf)-1, stdin); ++ if (n == -1) { + reply(221, "You could at least say goodbye."); + dologout(0); ++ } else if (n == -2) { ++ reply(500, "Command too long."); ++ (void) alarm(0); ++ continue; + } + (void) alarm(0); + #ifdef SETPROCTITLE +Index: libexec/ftpd/extern.h +=================================================================== +--- libexec/ftpd/extern.h (revision 185134) ++++ libexec/ftpd/extern.h (working copy) +@@ -46,7 +46,7 @@ + void ftpd_logwtmp(char *, char *, struct sockaddr *addr); + int ftpd_pclose(FILE *); + FILE *ftpd_popen(char *, char *); +-char *getline(char *, int, FILE *); ++int getline(char *, int, FILE *); + void lreply(int, const char *, ...) __printflike(2, 3); + void makedir(char *); + void nack(char *); +Index: libexec/ftpd/ftpd.c +=================================================================== +--- libexec/ftpd/ftpd.c (revision 185134) ++++ libexec/ftpd/ftpd.c (working copy) +@@ -2794,15 +2794,20 @@ + myoob(void) + { + char *cp; ++ int ret; + + if (!transflag) { + syslog(LOG_ERR, "Internal: myoob() while no transfer"); + return (0); + } + cp = tmpline; +- if (getline(cp, 7, stdin) == NULL) { ++ ret = getline(cp, 7, stdin); ++ if (ret == -1) { + reply(221, "You could at least say goodbye."); + dologout(0); ++ } else if (ret == -2) { ++ /* Ignore truncated command. */ ++ return (0); + } + upper(cp); + if (strcmp(cp, "ABOR\r\n") == 0) { Index: user/cperciva/freebsd-update-build/patches/7.1-RC1/1-SA-08:13.protosw =================================================================== --- user/cperciva/freebsd-update-build/patches/7.1-RC1/1-SA-08:13.protosw (nonexistent) +++ user/cperciva/freebsd-update-build/patches/7.1-RC1/1-SA-08:13.protosw (revision 293366) @@ -0,0 +1,23 @@ +Index: sys/kern/uipc_domain.c +=================================================================== +--- sys/kern/uipc_domain.c (revision 186366) ++++ sys/kern/uipc_domain.c (working copy) +@@ -112,13 +112,18 @@ + + #define DEFAULT(foo, bar) if ((foo) == NULL) (foo) = (bar) + DEFAULT(pu->pru_accept, pru_accept_notsupp); ++ DEFAULT(pu->pru_bind, pru_bind_notsupp); + DEFAULT(pu->pru_connect, pru_connect_notsupp); + DEFAULT(pu->pru_connect2, pru_connect2_notsupp); + DEFAULT(pu->pru_control, pru_control_notsupp); ++ DEFAULT(pu->pru_disconnect, pru_disconnect_notsupp); + DEFAULT(pu->pru_listen, pru_listen_notsupp); ++ DEFAULT(pu->pru_peeraddr, pru_peeraddr_notsupp); + DEFAULT(pu->pru_rcvd, pru_rcvd_notsupp); + DEFAULT(pu->pru_rcvoob, pru_rcvoob_notsupp); + DEFAULT(pu->pru_sense, pru_sense_null); ++ DEFAULT(pu->pru_shutdown, pru_shutdown_notsupp); ++ DEFAULT(pu->pru_sockaddr, pru_sockaddr_notsupp); + DEFAULT(pu->pru_sosend, sosend_generic); + DEFAULT(pu->pru_soreceive, soreceive_generic); + DEFAULT(pu->pru_sopoll, sopoll_generic); Index: user/cperciva/freebsd-update-build/patches/7.1-RC2/1-09:01.lukemftpd =================================================================== --- user/cperciva/freebsd-update-build/patches/7.1-RC2/1-09:01.lukemftpd (nonexistent) +++ user/cperciva/freebsd-update-build/patches/7.1-RC2/1-09:01.lukemftpd (revision 293366) @@ -0,0 +1,135 @@ +Index: contrib/lukemftpd/src/ftpcmd.y +=================================================================== +--- contrib/lukemftpd/src/ftpcmd.y (revision 186403) ++++ contrib/lukemftpd/src/ftpcmd.y (working copy) +@@ -1363,8 +1363,12 @@ + + /* + * getline - a hacked up version of fgets to ignore TELNET escape codes. ++ * `s' is the buffer to read into. ++ * `n' is the 1 less than the size of the buffer, to allow trailing NUL ++ * `iop' is the FILE to read from. ++ * Returns 0 on success, -1 on EOF, -2 if the command was too long. + */ +-char * ++int + getline(char *s, int n, FILE *iop) + { + int c; +@@ -1379,7 +1383,7 @@ + if (ftpd_debug) + syslog(LOG_DEBUG, "command: %s", s); + tmpline[0] = '\0'; +- return(s); ++ return(0); + } + if (c == 0) + tmpline[0] = '\0'; +@@ -1418,11 +1422,25 @@ + } + } + *cs++ = c; +- if (--n <= 0 || c == '\n') ++ if (--n <= 0) { ++ /* ++ * If command doesn't fit into buffer, discard the ++ * rest of the command and indicate truncation. ++ * This prevents the command to be split up into ++ * multiple commands. ++ */ ++ if (ftpd_debug) ++ syslog(LOG_DEBUG, ++ "command too long, last char: %d", c); ++ while (c != '\n' && (c = getc(iop)) != EOF) ++ continue; ++ return (-2); ++ } ++ if (c == '\n') + break; + } + if (c == EOF && cs == s) +- return (NULL); ++ return (-1); + *cs++ = '\0'; + if (ftpd_debug) { + if ((curclass.type != CLASS_GUEST && +@@ -1444,7 +1462,7 @@ + syslog(LOG_DEBUG, "command: %.*s", len, s); + } + } +- return (s); ++ return (0); + } + + void +@@ -1458,15 +1476,20 @@ + void + ftp_loop(void) + { ++ int ret; + + while (1) { + (void) alarm(curclass.timeout); +- if (getline(cbuf, sizeof(cbuf)-1, stdin) == NULL) { ++ ret = getline(cbuf, sizeof(cbuf)-1, stdin); ++ (void) alarm(0); ++ if (ret == -1) { + reply(221, "You could at least say goodbye."); + dologout(0); ++ } else if (ret == -2) { ++ reply(500, "Command too long."); ++ } else { ++ ftp_handle_line(cbuf); + } +- (void) alarm(0); +- ftp_handle_line(cbuf); + } + /*NOTREACHED*/ + } +Index: contrib/lukemftpd/src/extern.h +=================================================================== +--- contrib/lukemftpd/src/extern.h (revision 186403) ++++ contrib/lukemftpd/src/extern.h (working copy) +@@ -139,7 +139,7 @@ + void format_path(char *, const char *); + int ftpd_pclose(FILE *); + FILE *ftpd_popen(char *[], const char *, int); +-char *getline(char *, int, FILE *); ++int getline(char *, int, FILE *); + void init_curclass(void); + void logxfer(const char *, off_t, const char *, const char *, + const struct timeval *, const char *); +Index: contrib/lukemftpd/src/ftpd.c +=================================================================== +--- contrib/lukemftpd/src/ftpd.c (revision 186403) ++++ contrib/lukemftpd/src/ftpd.c (working copy) +@@ -1,4 +1,4 @@ +-/* $NetBSD: ftpd.c,v 1.176 2006/05/09 20:18:06 mrg Exp $ */ ++/* $NetBSD: ftpd.c,v 1.187 2008/09/13 03:30:35 lukem Exp $ */ + + /* + * Copyright (c) 1997-2004 The NetBSD Foundation, Inc. +@@ -2896,6 +2896,7 @@ + handleoobcmd() + { + char *cp; ++ int ret; + + if (!urgflag) + return (0); +@@ -2904,9 +2905,14 @@ + if (!transflag) + return (0); + cp = tmpline; +- if (getline(cp, sizeof(tmpline), stdin) == NULL) { ++ ret = getline(cp, sizeof(tmpline)-1, stdin); ++ if (ret == -1) { + reply(221, "You could at least say goodbye."); + dologout(0); ++ } else if (ret == -2) { ++ /* Ignore truncated command */ ++ /* XXX: abort xfer with "500 command too long", & return 1 ? */ ++ return 0; + } + /* + * Manually parse OOB commands, because we can't Index: user/cperciva/freebsd-update-build/patches/7.1-RC2/1-09:02.openssl =================================================================== --- user/cperciva/freebsd-update-build/patches/7.1-RC2/1-09:02.openssl (nonexistent) +++ user/cperciva/freebsd-update-build/patches/7.1-RC2/1-09:02.openssl (revision 293366) @@ -0,0 +1,149 @@ +Index: crypto/openssl/apps/speed.c +=================================================================== +--- crypto/openssl/apps/speed.c (revision 186740) ++++ crypto/openssl/apps/speed.c (working copy) +@@ -2038,7 +2038,7 @@ + { + ret=RSA_verify(NID_md5_sha1, buf,36, buf2, + rsa_num, rsa_key[j]); +- if (ret == 0) ++ if (ret <= 0) + { + BIO_printf(bio_err, + "RSA verify failure\n"); +Index: crypto/openssl/apps/verify.c +=================================================================== +--- crypto/openssl/apps/verify.c (revision 186740) ++++ crypto/openssl/apps/verify.c (working copy) +@@ -266,7 +266,7 @@ + + ret=0; + end: +- if (i) ++ if (i > 0) + { + fprintf(stdout,"OK\n"); + ret=1; +@@ -367,4 +367,3 @@ + ERR_clear_error(); + return(ok); + } +- +Index: crypto/openssl/apps/x509.c +=================================================================== +--- crypto/openssl/apps/x509.c (revision 186740) ++++ crypto/openssl/apps/x509.c (working copy) +@@ -1144,7 +1144,7 @@ + /* NOTE: this certificate can/should be self signed, unless it was + * a certificate request in which case it is not. */ + X509_STORE_CTX_set_cert(&xsc,x); +- if (!reqfile && !X509_verify_cert(&xsc)) ++ if (!reqfile && X509_verify_cert(&xsc) <= 0) + goto end; + + if (!X509_check_private_key(xca,pkey)) +Index: crypto/openssl/apps/spkac.c +=================================================================== +--- crypto/openssl/apps/spkac.c (revision 186740) ++++ crypto/openssl/apps/spkac.c (working copy) +@@ -285,7 +285,7 @@ + pkey = NETSCAPE_SPKI_get_pubkey(spki); + if(verify) { + i = NETSCAPE_SPKI_verify(spki, pkey); +- if(i) BIO_printf(bio_err, "Signature OK\n"); ++ if (i > 0) BIO_printf(bio_err, "Signature OK\n"); + else { + BIO_printf(bio_err, "Signature Failure\n"); + ERR_print_errors(bio_err); +Index: crypto/openssl/ssl/s2_srvr.c +=================================================================== +--- crypto/openssl/ssl/s2_srvr.c (revision 186740) ++++ crypto/openssl/ssl/s2_srvr.c (working copy) +@@ -1054,7 +1054,7 @@ + + i=ssl_verify_cert_chain(s,sk); + +- if (i) /* we like the packet, now check the chksum */ ++ if (i > 0) /* we like the packet, now check the chksum */ + { + EVP_MD_CTX ctx; + EVP_PKEY *pkey=NULL; +@@ -1083,7 +1083,7 @@ + EVP_PKEY_free(pkey); + EVP_MD_CTX_cleanup(&ctx); + +- if (i) ++ if (i > 0) + { + if (s->session->peer != NULL) + X509_free(s->session->peer); +Index: crypto/openssl/ssl/s3_clnt.c +=================================================================== +--- crypto/openssl/ssl/s3_clnt.c (revision 186740) ++++ crypto/openssl/ssl/s3_clnt.c (working copy) +@@ -883,7 +883,7 @@ + } + + i=ssl_verify_cert_chain(s,sk); +- if ((s->verify_mode != SSL_VERIFY_NONE) && (!i) ++ if ((s->verify_mode != SSL_VERIFY_NONE) && (i <= 0) + #ifndef OPENSSL_NO_KRB5 + && (s->s3->tmp.new_cipher->algorithms & (SSL_MKEY_MASK|SSL_AUTH_MASK)) + != (SSL_aKRB5|SSL_kKRB5) +@@ -1368,7 +1368,7 @@ + EVP_VerifyUpdate(&md_ctx,&(s->s3->client_random[0]),SSL3_RANDOM_SIZE); + EVP_VerifyUpdate(&md_ctx,&(s->s3->server_random[0]),SSL3_RANDOM_SIZE); + EVP_VerifyUpdate(&md_ctx,param,param_len); +- if (!EVP_VerifyFinal(&md_ctx,p,(int)n,pkey)) ++ if (EVP_VerifyFinal(&md_ctx,p,(int)n,pkey) <= 0) + { + /* bad signature */ + al=SSL_AD_DECRYPT_ERROR; +@@ -1386,7 +1386,7 @@ + EVP_VerifyUpdate(&md_ctx,&(s->s3->client_random[0]),SSL3_RANDOM_SIZE); + EVP_VerifyUpdate(&md_ctx,&(s->s3->server_random[0]),SSL3_RANDOM_SIZE); + EVP_VerifyUpdate(&md_ctx,param,param_len); +- if (!EVP_VerifyFinal(&md_ctx,p,(int)n,pkey)) ++ if (EVP_VerifyFinal(&md_ctx,p,(int)n,pkey) <= 0) + { + /* bad signature */ + al=SSL_AD_DECRYPT_ERROR; +Index: crypto/openssl/ssl/s3_srvr.c +=================================================================== +--- crypto/openssl/ssl/s3_srvr.c (revision 186740) ++++ crypto/openssl/ssl/s3_srvr.c (working copy) +@@ -2481,7 +2481,7 @@ + else + { + i=ssl_verify_cert_chain(s,sk); +- if (!i) ++ if (i <= 0) + { + al=ssl_verify_alarm_type(s->verify_result); + SSLerr(SSL_F_SSL3_GET_CLIENT_CERTIFICATE,SSL_R_NO_CERTIFICATE_RETURNED); +Index: crypto/openssl/ssl/ssltest.c +=================================================================== +--- crypto/openssl/ssl/ssltest.c (revision 186740) ++++ crypto/openssl/ssl/ssltest.c (working copy) +@@ -2072,7 +2072,7 @@ + + if (cb_arg->proxy_auth) + { +- if (ok) ++ if (ok > 0) + { + const char *cond_end = NULL; + +Index: crypto/openssl/ssl/s2_clnt.c +=================================================================== +--- crypto/openssl/ssl/s2_clnt.c (revision 186740) ++++ crypto/openssl/ssl/s2_clnt.c (working copy) +@@ -1044,7 +1044,7 @@ + + i=ssl_verify_cert_chain(s,sk); + +- if ((s->verify_mode != SSL_VERIFY_NONE) && (!i)) ++ if ((s->verify_mode != SSL_VERIFY_NONE) && (i <= 0)) + { + SSLerr(SSL_F_SSL2_SET_CERTIFICATE,SSL_R_CERTIFICATE_VERIFY_FAILED); + goto err; Index: user/cperciva/freebsd-update-build/patches/7.1-RC2/2-09:03.ntpd =================================================================== --- user/cperciva/freebsd-update-build/patches/7.1-RC2/2-09:03.ntpd (nonexistent) +++ user/cperciva/freebsd-update-build/patches/7.1-RC2/2-09:03.ntpd (revision 293366) @@ -0,0 +1,13 @@ +Index: contrib/ntp/ntpd/ntp_crypto.c +=================================================================== +--- contrib/ntp/ntpd/ntp_crypto.c (revision 186734) ++++ contrib/ntp/ntpd/ntp_crypto.c (working copy) +@@ -1612,7 +1612,7 @@ + */ + EVP_VerifyInit(&ctx, peer->digest); + EVP_VerifyUpdate(&ctx, (u_char *)&ep->tstamp, vallen + 12); +- if (!EVP_VerifyFinal(&ctx, (u_char *)&ep->pkt[i], siglen, pkey)) ++ if (EVP_VerifyFinal(&ctx, (u_char *)&ep->pkt[i], siglen, pkey) <= 0) + return (XEVNT_SIG); + + if (peer->crypto & CRYPTO_FLAG_VRFY) { Index: user/cperciva/freebsd-update-build/patches/7.1-RC2/2-09:04.bind =================================================================== --- user/cperciva/freebsd-update-build/patches/7.1-RC2/2-09:04.bind (nonexistent) +++ user/cperciva/freebsd-update-build/patches/7.1-RC2/2-09:04.bind (revision 293366) @@ -0,0 +1,26 @@ +Index: contrib/bind9/lib/dns/opensslrsa_link.c +=================================================================== +--- contrib/bind9/lib/dns/opensslrsa_link.c (revision 187056) ++++ contrib/bind9/lib/dns/opensslrsa_link.c (working copy) +@@ -246,7 +246,7 @@ + + status = RSA_verify(type, digest, digestlen, sig->base, + RSA_size(rsa), rsa); +- if (status == 0) ++ if (status != 1) + return (dst__openssl_toresult(DST_R_VERIFYFAILURE)); + + return (ISC_R_SUCCESS); +Index: contrib/bind9/lib/dns/openssldsa_link.c +=================================================================== +--- contrib/bind9/lib/dns/openssldsa_link.c (revision 187056) ++++ contrib/bind9/lib/dns/openssldsa_link.c (working copy) +@@ -133,7 +133,7 @@ + + status = DSA_do_verify(digest, ISC_SHA1_DIGESTLENGTH, dsasig, dsa); + DSA_SIG_free(dsasig); +- if (status == 0) ++ if (status != 1) + return (dst__openssl_toresult(DST_R_VERIFYFAILURE)); + + return (ISC_R_SUCCESS); Index: user/cperciva/freebsd-update-build/patches/7.2-RC1/1-SA-09:08.openssl =================================================================== --- user/cperciva/freebsd-update-build/patches/7.2-RC1/1-SA-09:08.openssl (nonexistent) +++ user/cperciva/freebsd-update-build/patches/7.2-RC1/1-SA-09:08.openssl (revision 293366) @@ -0,0 +1,63 @@ +Index: crypto/openssl/crypto/asn1/asn1_err.c +=================================================================== +--- crypto/openssl/crypto/asn1/asn1_err.c (revision 191346) ++++ crypto/openssl/crypto/asn1/asn1_err.c (working copy) +@@ -188,6 +188,7 @@ + {ERR_REASON(ASN1_R_BAD_OBJECT_HEADER) ,"bad object header"}, + {ERR_REASON(ASN1_R_BAD_PASSWORD_READ) ,"bad password read"}, + {ERR_REASON(ASN1_R_BAD_TAG) ,"bad tag"}, ++{ERR_REASON(ASN1_R_BMPSTRING_IS_WRONG_LENGTH),"bmpstring is wrong length"}, + {ERR_REASON(ASN1_R_BN_LIB) ,"bn lib"}, + {ERR_REASON(ASN1_R_BOOLEAN_IS_WRONG_LENGTH),"boolean is wrong length"}, + {ERR_REASON(ASN1_R_BUFFER_TOO_SMALL) ,"buffer too small"}, +@@ -267,6 +268,7 @@ + {ERR_REASON(ASN1_R_UNABLE_TO_DECODE_RSA_KEY),"unable to decode rsa key"}, + {ERR_REASON(ASN1_R_UNABLE_TO_DECODE_RSA_PRIVATE_KEY),"unable to decode rsa private key"}, + {ERR_REASON(ASN1_R_UNEXPECTED_EOC) ,"unexpected eoc"}, ++{ERR_REASON(ASN1_R_UNIVERSALSTRING_IS_WRONG_LENGTH),"universalstring is wrong length"}, + {ERR_REASON(ASN1_R_UNKNOWN_FORMAT) ,"unknown format"}, + {ERR_REASON(ASN1_R_UNKNOWN_MESSAGE_DIGEST_ALGORITHM),"unknown message digest algorithm"}, + {ERR_REASON(ASN1_R_UNKNOWN_OBJECT_TYPE) ,"unknown object type"}, +Index: crypto/openssl/crypto/asn1/tasn_dec.c +=================================================================== +--- crypto/openssl/crypto/asn1/tasn_dec.c (revision 191346) ++++ crypto/openssl/crypto/asn1/tasn_dec.c (working copy) +@@ -1012,6 +1012,18 @@ + case V_ASN1_SET: + case V_ASN1_SEQUENCE: + default: ++ if (utype == V_ASN1_BMPSTRING && (len & 1)) ++ { ++ ASN1err(ASN1_F_ASN1_EX_C2I, ++ ASN1_R_BMPSTRING_IS_WRONG_LENGTH); ++ goto err; ++ } ++ if (utype == V_ASN1_UNIVERSALSTRING && (len & 3)) ++ { ++ ASN1err(ASN1_F_ASN1_EX_C2I, ++ ASN1_R_UNIVERSALSTRING_IS_WRONG_LENGTH); ++ goto err; ++ } + /* All based on ASN1_STRING and handled the same */ + if (!*pval) + { +Index: crypto/openssl/crypto/asn1/asn1.h +=================================================================== +--- crypto/openssl/crypto/asn1/asn1.h (revision 191346) ++++ crypto/openssl/crypto/asn1/asn1.h (working copy) +@@ -1134,6 +1134,7 @@ + #define ASN1_R_BAD_OBJECT_HEADER 102 + #define ASN1_R_BAD_PASSWORD_READ 103 + #define ASN1_R_BAD_TAG 104 ++#define ASN1_R_BMPSTRING_IS_WRONG_LENGTH 210 + #define ASN1_R_BN_LIB 105 + #define ASN1_R_BOOLEAN_IS_WRONG_LENGTH 106 + #define ASN1_R_BUFFER_TOO_SMALL 107 +@@ -1213,6 +1214,7 @@ + #define ASN1_R_UNABLE_TO_DECODE_RSA_KEY 157 + #define ASN1_R_UNABLE_TO_DECODE_RSA_PRIVATE_KEY 158 + #define ASN1_R_UNEXPECTED_EOC 159 ++#define ASN1_R_UNIVERSALSTRING_IS_WRONG_LENGTH 211 + #define ASN1_R_UNKNOWN_FORMAT 160 + #define ASN1_R_UNKNOWN_MESSAGE_DIGEST_ALGORITHM 161 + #define ASN1_R_UNKNOWN_OBJECT_TYPE 162 Index: user/cperciva/freebsd-update-build/patches/8.0-BETA1/0-man9 =================================================================== --- user/cperciva/freebsd-update-build/patches/8.0-BETA1/0-man9 (nonexistent) +++ user/cperciva/freebsd-update-build/patches/8.0-BETA1/0-man9 (revision 293366) @@ -0,0 +1,13 @@ +Index: share/man/man9/Makefile +=================================================================== +--- share/man/man9/Makefile (revision 195386) ++++ share/man/man9/Makefile (working copy) +@@ -698,7 +698,7 @@ + kobj.9 kobj_init.9 + MLINKS+=kproc.9 kproc_create.9 \ + kproc.9 kproc_exit.9 \ +- kproc.9 kproc_resume,.9 \ ++ kproc.9 kproc_resume.9 \ + kproc.9 kproc_shutdown.9 \ + kproc.9 kproc_start.9 \ + kproc.9 kproc_suspend.9 \ Index: user/cperciva/freebsd-update-build/patches/8.0-BETA1/0-nc.1 =================================================================== --- user/cperciva/freebsd-update-build/patches/8.0-BETA1/0-nc.1 (nonexistent) +++ user/cperciva/freebsd-update-build/patches/8.0-BETA1/0-nc.1 (revision 293366) @@ -0,0 +1,13 @@ +Index: contrib/netcat/nc.1 +=================================================================== +--- contrib/netcat/nc.1 (revision 195344) ++++ contrib/netcat/nc.1 (working copy) +@@ -27,7 +27,7 @@ + .\" + .\" $FreeBSD$ + .\" +-.Dd $Mdocdate: May 6 2008 $ ++.Dd May 6 2008 + .Dt NC 1 + .Os + .Sh NAME Property changes on: user/cperciva/freebsd-update-build/patches/8.0-BETA1/0-nc.1 ___________________________________________________________________ Added: svn:eol-style ## -0,0 +1 ## +native \ No newline at end of property Added: svn:keywords ## -0,0 +1 ## +FreeBSD=%H \ No newline at end of property Added: svn:mime-type ## -0,0 +1 ## +text/plain \ No newline at end of property Index: user/cperciva/freebsd-update-build/patches/8.0-BETA1/1-SA-09:12.bind =================================================================== --- user/cperciva/freebsd-update-build/patches/8.0-BETA1/1-SA-09:12.bind (nonexistent) +++ user/cperciva/freebsd-update-build/patches/8.0-BETA1/1-SA-09:12.bind (revision 293366) @@ -0,0 +1,17 @@ +Index: contrib/bind9/bin/named/update.c +=================================================================== +--- contrib/bind9/bin/named/update.c (revision 195863) ++++ contrib/bind9/bin/named/update.c (working copy) +@@ -979,7 +979,11 @@ + if (type == dns_rdatatype_rrsig || + type == dns_rdatatype_sig) + covers = dns_rdata_covers(&t->rdata); +- else ++ else if (type == dns_rdatatype_any) { ++ dns_db_detachnode(db, &node); ++ dns_diff_clear(&trash); ++ return (DNS_R_NXRRSET); ++ } else + covers = 0; + + /* Index: user/cperciva/freebsd-update-build/patches/8.0-BETA2/1-SA-09:12.bind =================================================================== --- user/cperciva/freebsd-update-build/patches/8.0-BETA2/1-SA-09:12.bind (nonexistent) +++ user/cperciva/freebsd-update-build/patches/8.0-BETA2/1-SA-09:12.bind (revision 293366) @@ -0,0 +1,17 @@ +Index: contrib/bind9/bin/named/update.c +=================================================================== +--- contrib/bind9/bin/named/update.c (revision 195863) ++++ contrib/bind9/bin/named/update.c (working copy) +@@ -979,7 +979,11 @@ + if (type == dns_rdatatype_rrsig || + type == dns_rdatatype_sig) + covers = dns_rdata_covers(&t->rdata); +- else ++ else if (type == dns_rdatatype_any) { ++ dns_db_detachnode(db, &node); ++ dns_diff_clear(&trash); ++ return (DNS_R_NXRRSET); ++ } else + covers = 0; + + /* Index: user/cperciva/freebsd-update-build/patches/8.0-BETA4/1-EN-09:05.null =================================================================== --- user/cperciva/freebsd-update-build/patches/8.0-BETA4/1-EN-09:05.null (nonexistent) +++ user/cperciva/freebsd-update-build/patches/8.0-BETA4/1-EN-09:05.null (revision 293366) @@ -0,0 +1,45 @@ +Index: sys/kern/kern_exec.c +=================================================================== +--- sys/kern/kern_exec.c (revision 197682) ++++ sys/kern/kern_exec.c (working copy) +@@ -122,6 +122,11 @@ + SYSCTL_ULONG(_kern, OID_AUTO, ps_arg_cache_limit, CTLFLAG_RW, + &ps_arg_cache_limit, 0, ""); + ++static int map_at_zero = 1; ++TUNABLE_INT("security.bsd.map_at_zero", &map_at_zero); ++SYSCTL_INT(_security_bsd, OID_AUTO, map_at_zero, CTLFLAG_RW, &map_at_zero, 0, ++ "Permit processes to map an object at virtual address 0."); ++ + static int + sysctl_kern_ps_strings(SYSCTL_HANDLER_ARGS) + { +@@ -939,7 +944,7 @@ + int error; + struct proc *p = imgp->proc; + struct vmspace *vmspace = p->p_vmspace; +- vm_offset_t stack_addr; ++ vm_offset_t sv_minuser, stack_addr; + vm_map_t map; + u_long ssiz; + +@@ -955,13 +960,17 @@ + * not disrupted + */ + map = &vmspace->vm_map; +- if (vmspace->vm_refcnt == 1 && vm_map_min(map) == sv->sv_minuser && ++ if (map_at_zero) ++ sv_minuser = sv->sv_minuser; ++ else ++ sv_minuser = MAX(sv->sv_minuser, PAGE_SIZE); ++ if (vmspace->vm_refcnt == 1 && vm_map_min(map) == sv_minuser && + vm_map_max(map) == sv->sv_maxuser) { + shmexit(vmspace); + pmap_remove_pages(vmspace_pmap(vmspace)); + vm_map_remove(map, vm_map_min(map), vm_map_max(map)); + } else { +- error = vmspace_exec(p, sv->sv_minuser, sv->sv_maxuser); ++ error = vmspace_exec(p, sv_minuser, sv->sv_maxuser); + if (error) + return (error); + vmspace = p->p_vmspace; Index: user/cperciva/freebsd-update-build/patches/8.0-RC1/1-EN-09:05.null =================================================================== --- user/cperciva/freebsd-update-build/patches/8.0-RC1/1-EN-09:05.null (nonexistent) +++ user/cperciva/freebsd-update-build/patches/8.0-RC1/1-EN-09:05.null (revision 293366) @@ -0,0 +1,45 @@ +Index: sys/kern/kern_exec.c +=================================================================== +--- sys/kern/kern_exec.c (revision 197682) ++++ sys/kern/kern_exec.c (working copy) +@@ -122,6 +122,11 @@ + SYSCTL_ULONG(_kern, OID_AUTO, ps_arg_cache_limit, CTLFLAG_RW, + &ps_arg_cache_limit, 0, ""); + ++static int map_at_zero = 1; ++TUNABLE_INT("security.bsd.map_at_zero", &map_at_zero); ++SYSCTL_INT(_security_bsd, OID_AUTO, map_at_zero, CTLFLAG_RW, &map_at_zero, 0, ++ "Permit processes to map an object at virtual address 0."); ++ + static int + sysctl_kern_ps_strings(SYSCTL_HANDLER_ARGS) + { +@@ -939,7 +944,7 @@ + int error; + struct proc *p = imgp->proc; + struct vmspace *vmspace = p->p_vmspace; +- vm_offset_t stack_addr; ++ vm_offset_t sv_minuser, stack_addr; + vm_map_t map; + u_long ssiz; + +@@ -955,13 +960,17 @@ + * not disrupted + */ + map = &vmspace->vm_map; +- if (vmspace->vm_refcnt == 1 && vm_map_min(map) == sv->sv_minuser && ++ if (map_at_zero) ++ sv_minuser = sv->sv_minuser; ++ else ++ sv_minuser = MAX(sv->sv_minuser, PAGE_SIZE); ++ if (vmspace->vm_refcnt == 1 && vm_map_min(map) == sv_minuser && + vm_map_max(map) == sv->sv_maxuser) { + shmexit(vmspace); + pmap_remove_pages(vmspace_pmap(vmspace)); + vm_map_remove(map, vm_map_min(map), vm_map_max(map)); + } else { +- error = vmspace_exec(p, sv->sv_minuser, sv->sv_maxuser); ++ error = vmspace_exec(p, sv_minuser, sv->sv_maxuser); + if (error) + return (error); + vmspace = p->p_vmspace; Index: user/cperciva/freebsd-update-build/patches/8.0-RC2/1-SA-09:15.ssl =================================================================== --- user/cperciva/freebsd-update-build/patches/8.0-RC2/1-SA-09:15.ssl (nonexistent) +++ user/cperciva/freebsd-update-build/patches/8.0-RC2/1-SA-09:15.ssl (revision 293366) @@ -0,0 +1,57 @@ +Index: crypto/openssl/ssl/s3_pkt.c +=================================================================== +--- crypto/openssl/ssl/s3_pkt.c (revision 199950) ++++ crypto/openssl/ssl/s3_pkt.c (working copy) +@@ -983,9 +983,7 @@ + if (s->msg_callback) + s->msg_callback(0, s->version, SSL3_RT_HANDSHAKE, s->s3->handshake_fragment, 4, s, s->msg_callback_arg); + +- if (SSL_is_init_finished(s) && +- !(s->s3->flags & SSL3_FLAGS_NO_RENEGOTIATE_CIPHERS) && +- !s->s3->renegotiate) ++ if (0) + { + ssl3_renegotiate(s); + if (ssl3_renegotiate_check(s)) +@@ -1116,8 +1114,7 @@ + /* Unexpected handshake message (Client Hello, or protocol violation) */ + if ((s->s3->handshake_fragment_len >= 4) && !s->in_handshake) + { +- if (((s->state&SSL_ST_MASK) == SSL_ST_OK) && +- !(s->s3->flags & SSL3_FLAGS_NO_RENEGOTIATE_CIPHERS)) ++ if (0) + { + #if 0 /* worked only because C operator preferences are not as expected (and + * because this is not really needed for clients except for detecting +Index: crypto/openssl/ssl/s3_srvr.c +=================================================================== +--- crypto/openssl/ssl/s3_srvr.c (revision 199950) ++++ crypto/openssl/ssl/s3_srvr.c (working copy) +@@ -718,6 +718,13 @@ + #endif + STACK_OF(SSL_CIPHER) *ciphers=NULL; + ++ if (s->new_session) ++ { ++ al=SSL_AD_HANDSHAKE_FAILURE; ++ SSLerr(SSL_F_SSL3_GET_CLIENT_HELLO, ERR_R_INTERNAL_ERROR); ++ goto f_err; ++ } ++ + /* We do this so that we will respond with our native type. + * If we are TLSv1 and we get SSLv3, we will respond with TLSv1, + * This down switching should be handled by a different method. +Index: crypto/openssl/ssl/s3_lib.c +=================================================================== +--- crypto/openssl/ssl/s3_lib.c (revision 199950) ++++ crypto/openssl/ssl/s3_lib.c (working copy) +@@ -2592,6 +2592,9 @@ + if (s->s3->flags & SSL3_FLAGS_NO_RENEGOTIATE_CIPHERS) + return(0); + ++ if (1) ++ return(0); ++ + s->s3->renegotiate=1; + return(1); + } Index: user/cperciva/freebsd-update-build/patches/8.0-RC2/1-SA-09:16.rtld =================================================================== --- user/cperciva/freebsd-update-build/patches/8.0-RC2/1-SA-09:16.rtld (nonexistent) +++ user/cperciva/freebsd-update-build/patches/8.0-RC2/1-SA-09:16.rtld (revision 293366) @@ -0,0 +1,23 @@ +Index: libexec/rtld-elf/rtld.c +=================================================================== +--- libexec/rtld-elf/rtld.c (revision 199978) ++++ libexec/rtld-elf/rtld.c (revision 199979) +@@ -366,12 +366,12 @@ + * future processes to honor the potentially un-safe variables. + */ + if (!trust) { +- unsetenv(LD_ "PRELOAD"); +- unsetenv(LD_ "LIBMAP"); +- unsetenv(LD_ "LIBRARY_PATH"); +- unsetenv(LD_ "LIBMAP_DISABLE"); +- unsetenv(LD_ "DEBUG"); +- unsetenv(LD_ "ELF_HINTS_PATH"); ++ if (unsetenv(LD_ "PRELOAD") || unsetenv(LD_ "LIBMAP") || ++ unsetenv(LD_ "LIBRARY_PATH") || unsetenv(LD_ "LIBMAP_DISABLE") || ++ unsetenv(LD_ "DEBUG") || unsetenv(LD_ "ELF_HINTS_PATH")) { ++ _rtld_error("environment corrupt; aborting"); ++ die(); ++ } + } + ld_debug = getenv(LD_ "DEBUG"); + libmap_disable = getenv(LD_ "LIBMAP_DISABLE") != NULL; Index: user/cperciva/freebsd-update-build/patches/8.0-RC2/1-SA-09:17.freebsd-update =================================================================== --- user/cperciva/freebsd-update-build/patches/8.0-RC2/1-SA-09:17.freebsd-update (nonexistent) +++ user/cperciva/freebsd-update-build/patches/8.0-RC2/1-SA-09:17.freebsd-update (revision 293366) @@ -0,0 +1,25 @@ +Index: usr.sbin/freebsd-update/freebsd-update.sh +=================================================================== +--- usr.sbin/freebsd-update/freebsd-update.sh (revision 199972) ++++ usr.sbin/freebsd-update/freebsd-update.sh (working copy) +@@ -603,6 +603,7 @@ + echo ${WORKDIR} + exit 1 + fi ++ chmod 700 ${WORKDIR} + cd ${WORKDIR} || exit 1 + + # Generate release number. The s/SECURITY/RELEASE/ bit exists +Index: etc/mtree/BSD.var.dist +=================================================================== +--- etc/mtree/BSD.var.dist (revision 200019) ++++ etc/mtree/BSD.var.dist (working copy) +@@ -32,7 +32,7 @@ + db + entropy uname=operator gname=operator mode=0700 + .. +- freebsd-update ++ freebsd-update mode=0700 + .. + ipf mode=0700 + .. Index: user/cperciva/freebsd-update-build/patches/8.0-RC3/1-SA-09:15.ssl =================================================================== --- user/cperciva/freebsd-update-build/patches/8.0-RC3/1-SA-09:15.ssl (nonexistent) +++ user/cperciva/freebsd-update-build/patches/8.0-RC3/1-SA-09:15.ssl (revision 293366) @@ -0,0 +1,57 @@ +Index: crypto/openssl/ssl/s3_pkt.c +=================================================================== +--- crypto/openssl/ssl/s3_pkt.c (revision 199950) ++++ crypto/openssl/ssl/s3_pkt.c (working copy) +@@ -983,9 +983,7 @@ + if (s->msg_callback) + s->msg_callback(0, s->version, SSL3_RT_HANDSHAKE, s->s3->handshake_fragment, 4, s, s->msg_callback_arg); + +- if (SSL_is_init_finished(s) && +- !(s->s3->flags & SSL3_FLAGS_NO_RENEGOTIATE_CIPHERS) && +- !s->s3->renegotiate) ++ if (0) + { + ssl3_renegotiate(s); + if (ssl3_renegotiate_check(s)) +@@ -1116,8 +1114,7 @@ + /* Unexpected handshake message (Client Hello, or protocol violation) */ + if ((s->s3->handshake_fragment_len >= 4) && !s->in_handshake) + { +- if (((s->state&SSL_ST_MASK) == SSL_ST_OK) && +- !(s->s3->flags & SSL3_FLAGS_NO_RENEGOTIATE_CIPHERS)) ++ if (0) + { + #if 0 /* worked only because C operator preferences are not as expected (and + * because this is not really needed for clients except for detecting +Index: crypto/openssl/ssl/s3_srvr.c +=================================================================== +--- crypto/openssl/ssl/s3_srvr.c (revision 199950) ++++ crypto/openssl/ssl/s3_srvr.c (working copy) +@@ -718,6 +718,13 @@ + #endif + STACK_OF(SSL_CIPHER) *ciphers=NULL; + ++ if (s->new_session) ++ { ++ al=SSL_AD_HANDSHAKE_FAILURE; ++ SSLerr(SSL_F_SSL3_GET_CLIENT_HELLO, ERR_R_INTERNAL_ERROR); ++ goto f_err; ++ } ++ + /* We do this so that we will respond with our native type. + * If we are TLSv1 and we get SSLv3, we will respond with TLSv1, + * This down switching should be handled by a different method. +Index: crypto/openssl/ssl/s3_lib.c +=================================================================== +--- crypto/openssl/ssl/s3_lib.c (revision 199950) ++++ crypto/openssl/ssl/s3_lib.c (working copy) +@@ -2592,6 +2592,9 @@ + if (s->s3->flags & SSL3_FLAGS_NO_RENEGOTIATE_CIPHERS) + return(0); + ++ if (1) ++ return(0); ++ + s->s3->renegotiate=1; + return(1); + } Index: user/cperciva/freebsd-update-build/patches/8.0-RC3/1-SA-09:16.rtld =================================================================== --- user/cperciva/freebsd-update-build/patches/8.0-RC3/1-SA-09:16.rtld (nonexistent) +++ user/cperciva/freebsd-update-build/patches/8.0-RC3/1-SA-09:16.rtld (revision 293366) @@ -0,0 +1,23 @@ +Index: libexec/rtld-elf/rtld.c +=================================================================== +--- libexec/rtld-elf/rtld.c (revision 199978) ++++ libexec/rtld-elf/rtld.c (revision 199979) +@@ -366,12 +366,12 @@ + * future processes to honor the potentially un-safe variables. + */ + if (!trust) { +- unsetenv(LD_ "PRELOAD"); +- unsetenv(LD_ "LIBMAP"); +- unsetenv(LD_ "LIBRARY_PATH"); +- unsetenv(LD_ "LIBMAP_DISABLE"); +- unsetenv(LD_ "DEBUG"); +- unsetenv(LD_ "ELF_HINTS_PATH"); ++ if (unsetenv(LD_ "PRELOAD") || unsetenv(LD_ "LIBMAP") || ++ unsetenv(LD_ "LIBRARY_PATH") || unsetenv(LD_ "LIBMAP_DISABLE") || ++ unsetenv(LD_ "DEBUG") || unsetenv(LD_ "ELF_HINTS_PATH")) { ++ _rtld_error("environment corrupt; aborting"); ++ die(); ++ } + } + ld_debug = getenv(LD_ "DEBUG"); + libmap_disable = getenv(LD_ "LIBMAP_DISABLE") != NULL; Index: user/cperciva/freebsd-update-build/patches/8.0-RC3/1-SA-09:17.freebsd-update =================================================================== --- user/cperciva/freebsd-update-build/patches/8.0-RC3/1-SA-09:17.freebsd-update (nonexistent) +++ user/cperciva/freebsd-update-build/patches/8.0-RC3/1-SA-09:17.freebsd-update (revision 293366) @@ -0,0 +1,25 @@ +Index: usr.sbin/freebsd-update/freebsd-update.sh +=================================================================== +--- usr.sbin/freebsd-update/freebsd-update.sh (revision 199972) ++++ usr.sbin/freebsd-update/freebsd-update.sh (working copy) +@@ -603,6 +603,7 @@ + echo ${WORKDIR} + exit 1 + fi ++ chmod 700 ${WORKDIR} + cd ${WORKDIR} || exit 1 + + # Generate release number. The s/SECURITY/RELEASE/ bit exists +Index: etc/mtree/BSD.var.dist +=================================================================== +--- etc/mtree/BSD.var.dist (revision 200019) ++++ etc/mtree/BSD.var.dist (working copy) +@@ -32,7 +32,7 @@ + db + entropy uname=operator gname=operator mode=0700 + .. +- freebsd-update ++ freebsd-update mode=0700 + .. + ipf mode=0700 + .. Index: user/cperciva/freebsd-update-build/patches/8.1-BETA1/0-ssh-pkcs11-helper.patch =================================================================== --- user/cperciva/freebsd-update-build/patches/8.1-BETA1/0-ssh-pkcs11-helper.patch (nonexistent) +++ user/cperciva/freebsd-update-build/patches/8.1-BETA1/0-ssh-pkcs11-helper.patch (revision 293366) @@ -0,0 +1,13 @@ +Index: crypto/openssh/ssh-pkcs11-helper.8 +=================================================================== +--- crypto/openssh/ssh-pkcs11-helper.8 (revision 208605) ++++ crypto/openssh/ssh-pkcs11-helper.8 (working copy) +@@ -14,7 +14,7 @@ + .\" ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF + .\" OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. + .\" +-.Dd $Mdocdate: February 10 2010 $ ++.Dd February 10, 2010 + .Dt SSH-PKCS11-HELPER 8 + .Os + .Sh NAME Index: user/cperciva/freebsd-update-build/patches/8.1-RC1/1-SA-10:07.mbuf =================================================================== --- user/cperciva/freebsd-update-build/patches/8.1-RC1/1-SA-10:07.mbuf (nonexistent) +++ user/cperciva/freebsd-update-build/patches/8.1-RC1/1-SA-10:07.mbuf (revision 293366) @@ -0,0 +1,12 @@ +Index: sys/kern/uipc_mbuf.c +=================================================================== +--- sys/kern/uipc_mbuf.c (revision 209948) ++++ sys/kern/uipc_mbuf.c (working copy) +@@ -302,6 +302,7 @@ + n->m_ext.ref_cnt = m->m_ext.ref_cnt; + n->m_ext.ext_type = m->m_ext.ext_type; + n->m_flags |= M_EXT; ++ n->m_flags |= m->m_flags & M_RDONLY; + } + + /* Index: user/cperciva/freebsd-update-build/patches/8.1-RC2/1-SA-10:07.mbuf =================================================================== --- user/cperciva/freebsd-update-build/patches/8.1-RC2/1-SA-10:07.mbuf (nonexistent) +++ user/cperciva/freebsd-update-build/patches/8.1-RC2/1-SA-10:07.mbuf (revision 293366) @@ -0,0 +1,12 @@ +Index: sys/kern/uipc_mbuf.c +=================================================================== +--- sys/kern/uipc_mbuf.c (revision 209948) ++++ sys/kern/uipc_mbuf.c (working copy) +@@ -302,6 +302,7 @@ + n->m_ext.ref_cnt = m->m_ext.ref_cnt; + n->m_ext.ext_type = m->m_ext.ext_type; + n->m_flags |= M_EXT; ++ n->m_flags |= m->m_flags & M_RDONLY; + } + + /* Index: user/cperciva/freebsd-update-build/patches/8.1-RELEASE/12-SA-12:04.sysret =================================================================== --- user/cperciva/freebsd-update-build/patches/8.1-RELEASE/12-SA-12:04.sysret (nonexistent) +++ user/cperciva/freebsd-update-build/patches/8.1-RELEASE/12-SA-12:04.sysret (revision 293366) @@ -0,0 +1,48 @@ +--- sys/amd64/amd64/trap.c 2012/06/18 20:19:07 237240 ++++ sys/amd64/amd64/trap.c 2012/06/18 20:48:21 237241 +@@ -972,23 +972,6 @@ + ksi.ksi_code = TRAP_TRACE; + ksi.ksi_addr = (void *)frame->tf_rip; + trapsignal(td, &ksi); +- +- /* +- * If the user-supplied value of %rip is not a canonical +- * address, then some CPUs will trigger a ring 0 #GP during +- * the sysret instruction. However, the fault handler would +- * execute with the user's %gs and %rsp in ring 0 which would +- * not be safe. Instead, preemptively kill the thread with a +- * SIGBUS. +- */ +- if (td->td_frame->tf_rip >= VM_MAXUSER_ADDRESS) { +- ksiginfo_init_trap(&ksi); +- ksi.ksi_signo = SIGBUS; +- ksi.ksi_code = BUS_OBJERR; +- ksi.ksi_trapno = T_PROTFLT; +- ksi.ksi_addr = (void *)td->td_frame->tf_rip; +- trapsignal(td, &ksi); +- } + } + + /* +@@ -1027,4 +1010,21 @@ + STOPEVENT(p, S_SCX, sa.code); + + PTRACESTOP_SC(p, td, S_PT_SCX); ++ ++ /* ++ * If the user-supplied value of %rip is not a canonical ++ * address, then some CPUs will trigger a ring 0 #GP during ++ * the sysret instruction. However, the fault handler would ++ * execute with the user's %gs and %rsp in ring 0 which would ++ * not be safe. Instead, preemptively kill the thread with a ++ * SIGBUS. ++ */ ++ if (td->td_frame->tf_rip >= VM_MAXUSER_ADDRESS) { ++ ksiginfo_init_trap(&ksi); ++ ksi.ksi_signo = SIGBUS; ++ ksi.ksi_code = BUS_OBJERR; ++ ksi.ksi_trapno = T_PROTFLT; ++ ksi.ksi_addr = (void *)td->td_frame->tf_rip; ++ trapsignal(td, &ksi); ++ } + } Index: user/cperciva/freebsd-update-build/patches/8.4-BETA1/1-SA-13:04.bind =================================================================== --- user/cperciva/freebsd-update-build/patches/8.4-BETA1/1-SA-13:04.bind (nonexistent) +++ user/cperciva/freebsd-update-build/patches/8.4-BETA1/1-SA-13:04.bind (revision 293366) @@ -0,0 +1,13 @@ +Index: lib/bind/config.h +=================================================================== +--- lib/bind/config.h (revision 248771) ++++ lib/bind/config.h (working copy) +@@ -281,7 +281,7 @@ int sigwait(const unsigned int *set, int *sig); + /* #undef HAVE_OPENSSL_GOST */ + + /* Define to 1 if you have the header file. */ +-#define HAVE_REGEX_H 1 ++/* #undef HAVE_REGEX_H */ + + /* Define to 1 if you have the `setegid' function. */ + #define HAVE_SETEGID 1 Index: user/cperciva/freebsd-update-build/patches/8.4-RC1/1-SA-13:05.nfsserver =================================================================== --- user/cperciva/freebsd-update-build/patches/8.4-RC1/1-SA-13:05.nfsserver (nonexistent) +++ user/cperciva/freebsd-update-build/patches/8.4-RC1/1-SA-13:05.nfsserver (revision 293366) @@ -0,0 +1,13 @@ +Index: sys/fs/nfsserver/nfs_nfsdport.c +=================================================================== +--- sys/fs/nfsserver/nfs_nfsdport.c (revision 249651) ++++ sys/fs/nfsserver/nfs_nfsdport.c (working copy) +@@ -1568,6 +1568,8 @@ nfsrvd_readdir(struct nfsrv_descript *nd, int isdg + nd->nd_repstat = NFSERR_BAD_COOKIE; + #endif + } ++ if (!nd->nd_repstat && vp->v_type != VDIR) ++ nd->nd_repstat = NFSERR_NOTDIR; + if (nd->nd_repstat == 0 && cnt == 0) { + if (nd->nd_flag & ND_NFSV2) + /* NFSv2 does not have NFSERR_TOOSMALL */ Index: user/cperciva/freebsd-update-build/patches/8.4-RC2/1-SA-13:05.nfsserver =================================================================== --- user/cperciva/freebsd-update-build/patches/8.4-RC2/1-SA-13:05.nfsserver (nonexistent) +++ user/cperciva/freebsd-update-build/patches/8.4-RC2/1-SA-13:05.nfsserver (revision 293366) @@ -0,0 +1,13 @@ +Index: sys/fs/nfsserver/nfs_nfsdport.c +=================================================================== +--- sys/fs/nfsserver/nfs_nfsdport.c (revision 249651) ++++ sys/fs/nfsserver/nfs_nfsdport.c (working copy) +@@ -1568,6 +1568,8 @@ nfsrvd_readdir(struct nfsrv_descript *nd, int isdg + nd->nd_repstat = NFSERR_BAD_COOKIE; + #endif + } ++ if (!nd->nd_repstat && vp->v_type != VDIR) ++ nd->nd_repstat = NFSERR_NOTDIR; + if (nd->nd_repstat == 0 && cnt == 0) { + if (nd->nd_flag & ND_NFSV2) + /* NFSv2 does not have NFSERR_TOOSMALL */ Index: user/cperciva/freebsd-update-build/patches/8.4-RELEASE/31-EN-15:08.sendmail =================================================================== --- user/cperciva/freebsd-update-build/patches/8.4-RELEASE/31-EN-15:08.sendmail (nonexistent) +++ user/cperciva/freebsd-update-build/patches/8.4-RELEASE/31-EN-15:08.sendmail (revision 293366) @@ -0,0 +1,24 @@ +Index: contrib/sendmail/src/tls.c +=================================================================== +--- contrib/sendmail/src/tls.c ++++ contrib/sendmail/src/tls.c +@@ -650,7 +650,7 @@ + ** 1024 generate 1024 bit parameters + ** 2048 generate 2048 bit parameters + ** /file/name read parameters from /file/name +- ** default is: 1024 for server, 512 for client (OK? XXX) ++ ** default is: 1024 + */ + + if (bitset(TLS_I_TRY_DH, req)) +@@ -676,8 +676,8 @@ + } + if (dhparam == NULL) + { +- dhparam = srv ? "1" : "5"; +- req |= (srv ? TLS_I_DH1024 : TLS_I_DH512); ++ dhparam = "1"; ++ req |= TLS_I_DH1024; + } + else if (*dhparam == '/') + { Index: user/cperciva/freebsd-update-build/patches/8.4-RELEASE/32-EN-15:08.sendmail =================================================================== --- user/cperciva/freebsd-update-build/patches/8.4-RELEASE/32-EN-15:08.sendmail (nonexistent) +++ user/cperciva/freebsd-update-build/patches/8.4-RELEASE/32-EN-15:08.sendmail (revision 293366) @@ -0,0 +1,13 @@ +Index: contrib/sendmail/src/sendmail.h +=================================================================== +--- contrib/sendmail/src/sendmail.h (revision 284940) ++++ contrib/sendmail/src/sendmail.h (working copy) +@@ -1935,7 +1935,7 @@ struct termescape + + /* server requirements */ + #define TLS_I_SRV (TLS_I_SRV_CERT | TLS_I_RSA_TMP | TLS_I_VRFY_PATH | \ +- TLS_I_VRFY_LOC | TLS_I_TRY_DH | TLS_I_DH512 | \ ++ TLS_I_VRFY_LOC | TLS_I_TRY_DH | TLS_I_DH1024 | \ + TLS_I_CACHE) + + /* client requirements */ Index: user/cperciva/freebsd-update-build/patches/8.4-RELEASE/33-SA-15:11.bind =================================================================== --- user/cperciva/freebsd-update-build/patches/8.4-RELEASE/33-SA-15:11.bind (nonexistent) +++ user/cperciva/freebsd-update-build/patches/8.4-RELEASE/33-SA-15:11.bind (revision 293366) @@ -0,0 +1,21 @@ +Index: contrib/bind9/lib/dns/validator.c +=================================================================== +--- contrib/bind9/lib/dns/validator.c (revision 284940) ++++ contrib/bind9/lib/dns/validator.c (working copy) +@@ -1406,7 +1406,6 @@ compute_keytag(dns_rdata_t *rdata, dns_rdata_dnske + */ + static isc_boolean_t + isselfsigned(dns_validator_t *val) { +- dns_fixedname_t fixed; + dns_rdataset_t *rdataset, *sigrdataset; + dns_rdata_t rdata = DNS_RDATA_INIT; + dns_rdata_t sigrdata = DNS_RDATA_INIT; +@@ -1461,7 +1460,7 @@ isselfsigned(dns_validator_t *val) { + + result = dns_dnssec_verify2(name, rdataset, dstkey, + ISC_TRUE, mctx, &sigrdata, +- dns_fixedname_name(&fixed)); ++ NULL); + dst_key_free(&dstkey); + if (result != ISC_R_SUCCESS) + continue; Index: user/cperciva/freebsd-update-build/patches/8.4-RELEASE/34-SA-15:13.tcp =================================================================== --- user/cperciva/freebsd-update-build/patches/8.4-RELEASE/34-SA-15:13.tcp (nonexistent) +++ user/cperciva/freebsd-update-build/patches/8.4-RELEASE/34-SA-15:13.tcp (revision 293366) @@ -0,0 +1,31 @@ +Index: sys/netinet/tcp_output.c +=================================================================== +--- sys/netinet/tcp_output.c (revision 285435) ++++ sys/netinet/tcp_output.c (working copy) +@@ -397,7 +397,7 @@ after_sack_rexmit: + flags &= ~TH_FIN; + } + +- if (len < 0) { ++ if (len <= 0) { + /* + * If FIN has been sent but not acked, + * but we haven't been called to retransmit, +@@ -407,9 +407,16 @@ after_sack_rexmit: + * to (closed) window, and set the persist timer + * if it isn't already going. If the window didn't + * close completely, just wait for an ACK. ++ * ++ * We also do a general check here to ensure that ++ * we will set the persist timer when we have data ++ * to send, but a 0-byte window. This makes sure ++ * the persist timer is set even if the packet ++ * hits one of the "goto send" lines below. + */ + len = 0; +- if (sendwin == 0) { ++ if ((sendwin == 0) && (TCPS_HAVEESTABLISHED(tp->t_state)) && ++ (off < (int) so->so_snd.sb_cc)) { + tcp_timer_activate(tp, TT_REXMT, 0); + tp->t_rxtshift = 0; + tp->snd_nxt = tp->snd_una; Index: user/cperciva/freebsd-update-build/patches/8.4-RELEASE/35-SA-15:14.tcp =================================================================== --- user/cperciva/freebsd-update-build/patches/8.4-RELEASE/35-SA-15:14.tcp (nonexistent) +++ user/cperciva/freebsd-update-build/patches/8.4-RELEASE/35-SA-15:14.tcp (revision 293366) @@ -0,0 +1,203 @@ +Index: sys/netinet/tcp_reass.c +=================================================================== +--- sys/netinet/tcp_reass.c (revision 285923) ++++ sys/netinet/tcp_reass.c (working copy) +@@ -80,29 +80,25 @@ static int tcp_reass_sysctl_qsize(SYSCTL_HANDLER_A + SYSCTL_NODE(_net_inet_tcp, OID_AUTO, reass, CTLFLAG_RW, 0, + "TCP Segment Reassembly Queue"); + +-static VNET_DEFINE(int, tcp_reass_maxseg) = 0; +-#define V_tcp_reass_maxseg VNET(tcp_reass_maxseg) ++static int tcp_reass_maxseg = 0; + SYSCTL_VNET_PROC(_net_inet_tcp_reass, OID_AUTO, maxsegments, + CTLTYPE_INT | CTLFLAG_RDTUN, +- &VNET_NAME(tcp_reass_maxseg), 0, &tcp_reass_sysctl_maxseg, "I", ++ &tcp_reass_maxseg, 0, &tcp_reass_sysctl_maxseg, "I", + "Global maximum number of TCP Segments in Reassembly Queue"); + +-static VNET_DEFINE(int, tcp_reass_qsize) = 0; +-#define V_tcp_reass_qsize VNET(tcp_reass_qsize) +-SYSCTL_VNET_PROC(_net_inet_tcp_reass, OID_AUTO, cursegments, ++static int tcp_reass_qsize = 0; ++SYSCTL_PROC(_net_inet_tcp_reass, OID_AUTO, cursegments, + CTLTYPE_INT | CTLFLAG_RD, +- &VNET_NAME(tcp_reass_qsize), 0, &tcp_reass_sysctl_qsize, "I", ++ &tcp_reass_qsize, 0, &tcp_reass_sysctl_qsize, "I", + "Global number of TCP Segments currently in Reassembly Queue"); + +-static VNET_DEFINE(int, tcp_reass_overflows) = 0; +-#define V_tcp_reass_overflows VNET(tcp_reass_overflows) +-SYSCTL_VNET_INT(_net_inet_tcp_reass, OID_AUTO, overflows, ++static int tcp_reass_overflows = 0; ++SYSCTL_INT(_net_inet_tcp_reass, OID_AUTO, overflows, + CTLTYPE_INT | CTLFLAG_RD, +- &VNET_NAME(tcp_reass_overflows), 0, ++ &tcp_reass_overflows, 0, + "Global number of TCP Segment Reassembly Queue Overflows"); + +-static VNET_DEFINE(uma_zone_t, tcp_reass_zone); +-#define V_tcp_reass_zone VNET(tcp_reass_zone) ++static uma_zone_t tcp_reass_zone; + + /* Initialize TCP reassembly queue */ + static void +@@ -109,34 +105,25 @@ static void + tcp_reass_zone_change(void *tag) + { + +- V_tcp_reass_maxseg = nmbclusters / 16; +- uma_zone_set_max(V_tcp_reass_zone, V_tcp_reass_maxseg); ++ tcp_reass_maxseg = nmbclusters / 16; ++ uma_zone_set_max(tcp_reass_zone, tcp_reass_maxseg); + } + + void +-tcp_reass_init(void) ++tcp_reass_global_init(void) + { + +- V_tcp_reass_maxseg = nmbclusters / 16; ++ tcp_reass_maxseg = nmbclusters / 16; + TUNABLE_INT_FETCH("net.inet.tcp.reass.maxsegments", +- &V_tcp_reass_maxseg); +- V_tcp_reass_zone = uma_zcreate("tcpreass", sizeof (struct tseg_qent), ++ &tcp_reass_maxseg); ++ tcp_reass_zone = uma_zcreate("tcpreass", sizeof (struct tseg_qent), + NULL, NULL, NULL, NULL, UMA_ALIGN_PTR, UMA_ZONE_NOFREE); +- uma_zone_set_max(V_tcp_reass_zone, V_tcp_reass_maxseg); ++ uma_zone_set_max(tcp_reass_zone, tcp_reass_maxseg); + EVENTHANDLER_REGISTER(nmbclusters_change, + tcp_reass_zone_change, NULL, EVENTHANDLER_PRI_ANY); + } + +-#ifdef VIMAGE + void +-tcp_reass_destroy(void) +-{ +- +- uma_zdestroy(V_tcp_reass_zone); +-} +-#endif +- +-void + tcp_reass_flush(struct tcpcb *tp) + { + struct tseg_qent *qe; +@@ -146,7 +133,7 @@ tcp_reass_flush(struct tcpcb *tp) + while ((qe = LIST_FIRST(&tp->t_segq)) != NULL) { + LIST_REMOVE(qe, tqe_q); + m_freem(qe->tqe_m); +- uma_zfree(V_tcp_reass_zone, qe); ++ uma_zfree(tcp_reass_zone, qe); + tp->t_segqlen--; + } + +@@ -158,7 +145,7 @@ tcp_reass_flush(struct tcpcb *tp) + static int + tcp_reass_sysctl_maxseg(SYSCTL_HANDLER_ARGS) + { +- V_tcp_reass_maxseg = uma_zone_get_max(V_tcp_reass_zone); ++ tcp_reass_maxseg = uma_zone_get_max(tcp_reass_zone); + return (sysctl_handle_int(oidp, arg1, arg2, req)); + } + +@@ -165,7 +152,7 @@ tcp_reass_sysctl_maxseg(SYSCTL_HANDLER_ARGS) + static int + tcp_reass_sysctl_qsize(SYSCTL_HANDLER_ARGS) + { +- V_tcp_reass_qsize = uma_zone_get_cur(V_tcp_reass_zone); ++ tcp_reass_qsize = uma_zone_get_cur(tcp_reass_zone); + return (sysctl_handle_int(oidp, arg1, arg2, req)); + } + +@@ -213,7 +200,7 @@ tcp_reass(struct tcpcb *tp, struct tcphdr *th, int + */ + if ((th->th_seq != tp->rcv_nxt || !TCPS_HAVEESTABLISHED(tp->t_state)) && + tp->t_segqlen >= (so->so_rcv.sb_hiwat / tp->t_maxseg) + 1) { +- V_tcp_reass_overflows++; ++ tcp_reass_overflows++; + TCPSTAT_INC(tcps_rcvmemdrop); + m_freem(m); + *tlenp = 0; +@@ -232,7 +219,7 @@ tcp_reass(struct tcpcb *tp, struct tcphdr *th, int + * Use a temporary structure on the stack for the missing segment + * when the zone is exhausted. Otherwise we may get stuck. + */ +- te = uma_zalloc(V_tcp_reass_zone, M_NOWAIT); ++ te = uma_zalloc(tcp_reass_zone, M_NOWAIT); + if (te == NULL) { + if (th->th_seq != tp->rcv_nxt || !TCPS_HAVEESTABLISHED(tp->t_state)) { + TCPSTAT_INC(tcps_rcvmemdrop); +@@ -283,7 +270,7 @@ tcp_reass(struct tcpcb *tp, struct tcphdr *th, int + TCPSTAT_ADD(tcps_rcvdupbyte, *tlenp); + m_freem(m); + if (te != &tqs) +- uma_zfree(V_tcp_reass_zone, te); ++ uma_zfree(tcp_reass_zone, te); + tp->t_segqlen--; + /* + * Try to present any queued data +@@ -320,7 +307,7 @@ tcp_reass(struct tcpcb *tp, struct tcphdr *th, int + nq = LIST_NEXT(q, tqe_q); + LIST_REMOVE(q, tqe_q); + m_freem(q->tqe_m); +- uma_zfree(V_tcp_reass_zone, q); ++ uma_zfree(tcp_reass_zone, q); + tp->t_segqlen--; + q = nq; + } +@@ -359,7 +346,7 @@ present: + else + sbappendstream_locked(&so->so_rcv, q->tqe_m); + if (q != &tqs) +- uma_zfree(V_tcp_reass_zone, q); ++ uma_zfree(tcp_reass_zone, q); + tp->t_segqlen--; + q = nq; + } while (q && q->tqe_th->th_seq == tp->rcv_nxt); +Index: sys/netinet/tcp_subr.c +=================================================================== +--- sys/netinet/tcp_subr.c (revision 285923) ++++ sys/netinet/tcp_subr.c (working copy) +@@ -375,7 +375,6 @@ tcp_init(void) + tcp_tw_init(); + syncache_init(); + tcp_hc_init(); +- tcp_reass_init(); + + TUNABLE_INT_FETCH("net.inet.tcp.sack.enable", &V_tcp_do_sack); + V_sack_hole_zone = uma_zcreate("sackhole", sizeof(struct sackhole), +@@ -385,6 +384,8 @@ tcp_init(void) + if (!IS_DEFAULT_VNET(curvnet)) + return; + ++ tcp_reass_global_init(); ++ + /* XXX virtualize those bellow? */ + tcp_delacktime = TCPTV_DELACK; + tcp_keepinit = TCPTV_KEEP_INIT; +@@ -424,7 +425,6 @@ void + tcp_destroy(void) + { + +- tcp_reass_destroy(); + tcp_hc_destroy(); + syncache_destroy(); + tcp_tw_destroy(); +Index: sys/netinet/tcp_var.h +=================================================================== +--- sys/netinet/tcp_var.h (revision 285923) ++++ sys/netinet/tcp_var.h (working copy) +@@ -653,11 +653,8 @@ char *tcp_log_addrs(struct in_conninfo *, struct + char *tcp_log_vain(struct in_conninfo *, struct tcphdr *, void *, + const void *); + int tcp_reass(struct tcpcb *, struct tcphdr *, int *, struct mbuf *); +-void tcp_reass_init(void); ++void tcp_reass_global_init(void); + void tcp_reass_flush(struct tcpcb *); +-#ifdef VIMAGE +-void tcp_reass_destroy(void); +-#endif + void tcp_input(struct mbuf *, int); + u_long tcp_maxmtu(struct in_conninfo *, int *); + u_long tcp_maxmtu6(struct in_conninfo *, int *); Index: user/cperciva/freebsd-update-build/patches/8.4-RELEASE/35-SA-15:16.openssh =================================================================== --- user/cperciva/freebsd-update-build/patches/8.4-RELEASE/35-SA-15:16.openssh (nonexistent) +++ user/cperciva/freebsd-update-build/patches/8.4-RELEASE/35-SA-15:16.openssh (revision 293366) @@ -0,0 +1,89 @@ +Index: crypto/openssh/auth2-chall.c +=================================================================== +--- crypto/openssh/auth2-chall.c (revision 285923) ++++ crypto/openssh/auth2-chall.c (working copy) +@@ -82,6 +82,7 @@ struct KbdintAuthctxt + void *ctxt; + KbdintDevice *device; + u_int nreq; ++ u_int devices_done; + }; + + #ifdef USE_PAM +@@ -169,9 +170,14 @@ kbdint_next_device(KbdintAuthctxt *kbdintctxt) + + if (len == 0) + break; +- for (i = 0; devices[i]; i++) +- if (strncmp(kbdintctxt->devices, devices[i]->name, len) == 0) ++ for (i = 0; devices[i]; i++) { ++ if ((kbdintctxt->devices_done & (1 << i)) != 0) ++ continue; ++ if (strncmp(kbdintctxt->devices, devices[i]->name, len) == 0) { + kbdintctxt->device = devices[i]; ++ kbdintctxt->devices_done |= 1 << i; ++ } ++ } + t = kbdintctxt->devices; + kbdintctxt->devices = t[len] ? xstrdup(t+len+1) : NULL; + xfree(t); +Index: crypto/openssh/sshconnect.c +=================================================================== +--- crypto/openssh/sshconnect.c (revision 285923) ++++ crypto/openssh/sshconnect.c (working copy) +@@ -1141,29 +1141,39 @@ verify_host_key(char *host, struct sockaddr *hosta + { + int flags = 0; + char *fp; ++ Key *plain = NULL; + + fp = key_fingerprint(host_key, SSH_FP_MD5, SSH_FP_HEX); + debug("Server host key: %s %s", key_type(host_key), fp); + xfree(fp); + +- /* XXX certs are not yet supported for DNS */ +- if (!key_is_cert(host_key) && options.verify_host_key_dns && +- verify_host_key_dns(host, hostaddr, host_key, &flags) == 0) { +- if (flags & DNS_VERIFY_FOUND) { +- +- if (options.verify_host_key_dns == 1 && +- flags & DNS_VERIFY_MATCH && +- flags & DNS_VERIFY_SECURE) +- return 0; +- +- if (flags & DNS_VERIFY_MATCH) { +- matching_host_key_dns = 1; +- } else { +- warn_changed_key(host_key); +- error("Update the SSHFP RR in DNS with the new " +- "host key to get rid of this message."); ++ if (options.verify_host_key_dns) { ++ /* ++ * XXX certs are not yet supported for DNS, so downgrade ++ * them and try the plain key. ++ */ ++ plain = key_from_private(host_key); ++ if (key_is_cert(plain)) ++ key_drop_cert(plain); ++ if (verify_host_key_dns(host, hostaddr, plain, &flags) == 0) { ++ if (flags & DNS_VERIFY_FOUND) { ++ if (options.verify_host_key_dns == 1 && ++ flags & DNS_VERIFY_MATCH && ++ flags & DNS_VERIFY_SECURE) { ++ key_free(plain); ++ return 0; ++ } ++ if (flags & DNS_VERIFY_MATCH) { ++ matching_host_key_dns = 1; ++ } else { ++ warn_changed_key(plain); ++ error("Update the SSHFP RR in DNS " ++ "with the new host key to get rid " ++ "of this message."); ++ } + } + } ++ key_free(plain); + } + + return check_host_key(host, hostaddr, options.port, host_key, RDRW, Index: user/cperciva/freebsd-update-build/patches/8.4-RELEASE/35-SA-15:17.bind =================================================================== --- user/cperciva/freebsd-update-build/patches/8.4-RELEASE/35-SA-15:17.bind (nonexistent) +++ user/cperciva/freebsd-update-build/patches/8.4-RELEASE/35-SA-15:17.bind (revision 293366) @@ -0,0 +1,12 @@ +Index: contrib/bind9/lib/dns/tkey.c +=================================================================== +--- contrib/bind9/lib/dns/tkey.c (revision 285922) ++++ contrib/bind9/lib/dns/tkey.c (working copy) +@@ -650,6 +650,7 @@ dns_tkey_processquery(dns_message_t *msg, dns_tkey + * Try the answer section, since that's where Win2000 + * puts it. + */ ++ name = NULL; + if (dns_message_findname(msg, DNS_SECTION_ANSWER, qname, + dns_rdatatype_tkey, 0, &name, + &tkeyset) != ISC_R_SUCCESS) { Index: user/cperciva/freebsd-update-build/patches/8.4-RELEASE/36-SA-15:16.openssh =================================================================== --- user/cperciva/freebsd-update-build/patches/8.4-RELEASE/36-SA-15:16.openssh (nonexistent) +++ user/cperciva/freebsd-update-build/patches/8.4-RELEASE/36-SA-15:16.openssh (revision 293366) @@ -0,0 +1,12 @@ +Index: crypto/openssh/auth2-chall.c +=================================================================== +--- crypto/openssh/auth2-chall.c (revision 286066) ++++ crypto/openssh/auth2-chall.c (working copy) +@@ -131,6 +131,7 @@ kbdint_alloc(const char *devs) + kbdintctxt->ctxt = NULL; + kbdintctxt->device = NULL; + kbdintctxt->nreq = 0; ++ kbdintctxt->devices_done = 0; + + return kbdintctxt; + } Index: user/cperciva/freebsd-update-build/patches/9.0-BETA1/0-clang.patch =================================================================== --- user/cperciva/freebsd-update-build/patches/9.0-BETA1/0-clang.patch (nonexistent) +++ user/cperciva/freebsd-update-build/patches/9.0-BETA1/0-clang.patch (revision 293366) @@ -0,0 +1,11 @@ +Index: lib/clang/clang.build.mk +--- lib/clang/clang.build.mk 2011-10-20 05:42:19.000000000 -0700 ++++ lib/clang/clang.build.mk 2011-10-20 05:42:54.000000000 -0700 +@@ -6,6 +6,7 @@ + -I${LLVM_SRCS}/${SRCDIR} ${INCDIR:C/^/-I${LLVM_SRCS}\//} -I. \ + -I${LLVM_SRCS}/../../lib/clang/include \ + -DLLVM_ON_UNIX -DLLVM_ON_FREEBSD \ ++ -frandom-seed=RepeatabilityConsideredGood \ + -D__STDC_LIMIT_MACROS -D__STDC_CONSTANT_MACROS #-DNDEBUG + + # Correct for gcc miscompilation when compiling on PPC with -O2 Index: user/cperciva/freebsd-update-build/patches/9.0-BETA1/1-EN-12:01.freebsd-update =================================================================== --- user/cperciva/freebsd-update-build/patches/9.0-BETA1/1-EN-12:01.freebsd-update (nonexistent) +++ user/cperciva/freebsd-update-build/patches/9.0-BETA1/1-EN-12:01.freebsd-update (revision 293366) @@ -0,0 +1,13 @@ +Index: usr.sbin/freebsd-update/freebsd-update.sh +=================================================================== +--- usr.sbin/freebsd-update/freebsd-update.sh (revision 226649) ++++ usr.sbin/freebsd-update/freebsd-update.sh (revision 226650) +@@ -1200,7 +1200,7 @@ + # Some aliases to save space later: ${P} is a character which can + # appear in a path; ${M} is the four numeric metadata fields; and + # ${H} is a sha256 hash. +- P="[-+./:=_[[:alnum:]]" ++ P="[-+./:=%@_[[:alnum:]]" + M="[0-9]+\|[0-9]+\|[0-9]+\|[0-9]+" + H="[0-9a-f]{64}" + Index: user/cperciva/freebsd-update-build/patches/9.0-BETA2/0-clang.patch =================================================================== --- user/cperciva/freebsd-update-build/patches/9.0-BETA2/0-clang.patch (nonexistent) +++ user/cperciva/freebsd-update-build/patches/9.0-BETA2/0-clang.patch (revision 293366) @@ -0,0 +1,11 @@ +Index: lib/clang/clang.build.mk +--- lib/clang/clang.build.mk 2011-10-20 05:42:19.000000000 -0700 ++++ lib/clang/clang.build.mk 2011-10-20 05:42:54.000000000 -0700 +@@ -6,6 +6,7 @@ + -I${LLVM_SRCS}/${SRCDIR} ${INCDIR:C/^/-I${LLVM_SRCS}\//} -I. \ + -I${LLVM_SRCS}/../../lib/clang/include \ + -DLLVM_ON_UNIX -DLLVM_ON_FREEBSD \ ++ -frandom-seed=RepeatabilityConsideredGood \ + -D__STDC_LIMIT_MACROS -D__STDC_CONSTANT_MACROS #-DNDEBUG + + # Correct for gcc miscompilation when compiling on PPC with -O2 Index: user/cperciva/freebsd-update-build/patches/9.0-BETA2/1-EN-12:01.freebsd-update =================================================================== --- user/cperciva/freebsd-update-build/patches/9.0-BETA2/1-EN-12:01.freebsd-update (nonexistent) +++ user/cperciva/freebsd-update-build/patches/9.0-BETA2/1-EN-12:01.freebsd-update (revision 293366) @@ -0,0 +1,13 @@ +Index: usr.sbin/freebsd-update/freebsd-update.sh +=================================================================== +--- usr.sbin/freebsd-update/freebsd-update.sh (revision 226649) ++++ usr.sbin/freebsd-update/freebsd-update.sh (revision 226650) +@@ -1200,7 +1200,7 @@ + # Some aliases to save space later: ${P} is a character which can + # appear in a path; ${M} is the four numeric metadata fields; and + # ${H} is a sha256 hash. +- P="[-+./:=_[[:alnum:]]" ++ P="[-+./:=%@_[[:alnum:]]" + M="[0-9]+\|[0-9]+\|[0-9]+\|[0-9]+" + H="[0-9a-f]{64}" + Index: user/cperciva/freebsd-update-build/patches/9.0-BETA3/0-clang.patch =================================================================== --- user/cperciva/freebsd-update-build/patches/9.0-BETA3/0-clang.patch (nonexistent) +++ user/cperciva/freebsd-update-build/patches/9.0-BETA3/0-clang.patch (revision 293366) @@ -0,0 +1,11 @@ +Index: lib/clang/clang.build.mk +--- lib/clang/clang.build.mk 2011-10-20 05:42:19.000000000 -0700 ++++ lib/clang/clang.build.mk 2011-10-20 05:42:54.000000000 -0700 +@@ -6,6 +6,7 @@ + -I${LLVM_SRCS}/${SRCDIR} ${INCDIR:C/^/-I${LLVM_SRCS}\//} -I. \ + -I${LLVM_SRCS}/../../lib/clang/include \ + -DLLVM_ON_UNIX -DLLVM_ON_FREEBSD \ ++ -frandom-seed=RepeatabilityConsideredGood \ + -D__STDC_LIMIT_MACROS -D__STDC_CONSTANT_MACROS #-DNDEBUG + + # Correct for gcc miscompilation when compiling on PPC with -O2 Index: user/cperciva/freebsd-update-build/patches/9.0-BETA3/1-EN-12:01.freebsd-update =================================================================== --- user/cperciva/freebsd-update-build/patches/9.0-BETA3/1-EN-12:01.freebsd-update (nonexistent) +++ user/cperciva/freebsd-update-build/patches/9.0-BETA3/1-EN-12:01.freebsd-update (revision 293366) @@ -0,0 +1,13 @@ +Index: usr.sbin/freebsd-update/freebsd-update.sh +=================================================================== +--- usr.sbin/freebsd-update/freebsd-update.sh (revision 226649) ++++ usr.sbin/freebsd-update/freebsd-update.sh (revision 226650) +@@ -1200,7 +1200,7 @@ + # Some aliases to save space later: ${P} is a character which can + # appear in a path; ${M} is the four numeric metadata fields; and + # ${H} is a sha256 hash. +- P="[-+./:=_[[:alnum:]]" ++ P="[-+./:=%@_[[:alnum:]]" + M="[0-9]+\|[0-9]+\|[0-9]+\|[0-9]+" + H="[0-9a-f]{64}" + Index: user/cperciva/freebsd-update-build/patches/9.0-RC1/0-clang.patch =================================================================== --- user/cperciva/freebsd-update-build/patches/9.0-RC1/0-clang.patch (nonexistent) +++ user/cperciva/freebsd-update-build/patches/9.0-RC1/0-clang.patch (revision 293366) @@ -0,0 +1,11 @@ +Index: lib/clang/clang.build.mk +--- lib/clang/clang.build.mk 2011-10-20 05:42:19.000000000 -0700 ++++ lib/clang/clang.build.mk 2011-10-20 05:42:54.000000000 -0700 +@@ -6,6 +6,7 @@ + -I${LLVM_SRCS}/${SRCDIR} ${INCDIR:C/^/-I${LLVM_SRCS}\//} -I. \ + -I${LLVM_SRCS}/../../lib/clang/include \ + -DLLVM_ON_UNIX -DLLVM_ON_FREEBSD \ ++ -frandom-seed=RepeatabilityConsideredGood \ + -D__STDC_LIMIT_MACROS -D__STDC_CONSTANT_MACROS #-DNDEBUG + + # Correct for gcc miscompilation when compiling on PPC with -O2 Index: user/cperciva/freebsd-update-build/patches/9.0-RC1/1-EN-12:01.freebsd-update =================================================================== --- user/cperciva/freebsd-update-build/patches/9.0-RC1/1-EN-12:01.freebsd-update (nonexistent) +++ user/cperciva/freebsd-update-build/patches/9.0-RC1/1-EN-12:01.freebsd-update (revision 293366) @@ -0,0 +1,13 @@ +Index: usr.sbin/freebsd-update/freebsd-update.sh +=================================================================== +--- usr.sbin/freebsd-update/freebsd-update.sh (revision 226649) ++++ usr.sbin/freebsd-update/freebsd-update.sh (revision 226650) +@@ -1200,7 +1200,7 @@ + # Some aliases to save space later: ${P} is a character which can + # appear in a path; ${M} is the four numeric metadata fields; and + # ${H} is a sha256 hash. +- P="[-+./:=_[[:alnum:]]" ++ P="[-+./:=%@_[[:alnum:]]" + M="[0-9]+\|[0-9]+\|[0-9]+\|[0-9]+" + H="[0-9a-f]{64}" + Index: user/cperciva/freebsd-update-build/patches/9.0-RC2/0-clang.patch =================================================================== --- user/cperciva/freebsd-update-build/patches/9.0-RC2/0-clang.patch (nonexistent) +++ user/cperciva/freebsd-update-build/patches/9.0-RC2/0-clang.patch (revision 293366) @@ -0,0 +1,11 @@ +Index: lib/clang/clang.build.mk +--- lib/clang/clang.build.mk 2011-10-20 05:42:19.000000000 -0700 ++++ lib/clang/clang.build.mk 2011-10-20 05:42:54.000000000 -0700 +@@ -6,6 +6,7 @@ + -I${LLVM_SRCS}/${SRCDIR} ${INCDIR:C/^/-I${LLVM_SRCS}\//} -I. \ + -I${LLVM_SRCS}/../../lib/clang/include \ + -DLLVM_ON_UNIX -DLLVM_ON_FREEBSD \ ++ -frandom-seed=RepeatabilityConsideredGood \ + -D__STDC_LIMIT_MACROS -D__STDC_CONSTANT_MACROS #-DNDEBUG + + # Correct for gcc miscompilation when compiling on PPC with -O2 Index: user/cperciva/freebsd-update-build/patches/9.0-RC2/1-SA-11:06.bind =================================================================== --- user/cperciva/freebsd-update-build/patches/9.0-RC2/1-SA-11:06.bind (nonexistent) +++ user/cperciva/freebsd-update-build/patches/9.0-RC2/1-SA-11:06.bind (revision 293366) @@ -0,0 +1,66 @@ +Index: contrib/bind9/lib/dns/rbtdb.c +=================================================================== +--- contrib/bind9/lib/dns/rbtdb.c (revision 228188) ++++ contrib/bind9/lib/dns/rbtdb.c (revision 228189) +@@ -5053,7 +5053,7 @@ + rdataset); + if (need_headerupdate(found, search.now)) + update = found; +- if (foundsig != NULL) { ++ if (!NEGATIVE(found) && foundsig != NULL) { + bind_rdataset(search.rbtdb, node, foundsig, search.now, + sigrdataset); + if (need_headerupdate(foundsig, search.now)) +@@ -5685,7 +5685,7 @@ + } + if (found != NULL) { + bind_rdataset(rbtdb, rbtnode, found, now, rdataset); +- if (foundsig != NULL) ++ if (!NEGATIVE(found) && foundsig != NULL) + bind_rdataset(rbtdb, rbtnode, foundsig, now, + sigrdataset); + } +Index: contrib/bind9/bin/named/query.c +=================================================================== +--- contrib/bind9/bin/named/query.c (revision 228188) ++++ contrib/bind9/bin/named/query.c (revision 228189) +@@ -1393,11 +1393,9 @@ + goto addname; + if (result == DNS_R_NCACHENXRRSET) { + dns_rdataset_disassociate(rdataset); +- /* +- * Negative cache entries don't have sigrdatasets. +- */ +- INSIST(sigrdataset == NULL || +- ! dns_rdataset_isassociated(sigrdataset)); ++ if (sigrdataset != NULL && ++ dns_rdataset_isassociated(sigrdataset)) ++ dns_rdataset_disassociate(sigrdataset); + } + if (result == ISC_R_SUCCESS) { + mname = NULL; +@@ -1438,8 +1436,9 @@ + goto addname; + if (result == DNS_R_NCACHENXRRSET) { + dns_rdataset_disassociate(rdataset); +- INSIST(sigrdataset == NULL || +- ! dns_rdataset_isassociated(sigrdataset)); ++ if (sigrdataset != NULL && ++ dns_rdataset_isassociated(sigrdataset)) ++ dns_rdataset_disassociate(sigrdataset); + } + if (result == ISC_R_SUCCESS) { + mname = NULL; +@@ -1889,10 +1888,8 @@ + goto setcache; + if (result == DNS_R_NCACHENXRRSET) { + dns_rdataset_disassociate(rdataset); +- /* +- * Negative cache entries don't have sigrdatasets. +- */ +- INSIST(! dns_rdataset_isassociated(sigrdataset)); ++ if (dns_rdataset_isassociated(sigrdataset)) ++ dns_rdataset_disassociate(sigrdataset); + } + if (result == ISC_R_SUCCESS) { + /* Remember the result as a cache */ Index: user/cperciva/freebsd-update-build/patches/9.0-RC2/1-SA-11:07.chroot =================================================================== --- user/cperciva/freebsd-update-build/patches/9.0-RC2/1-SA-11:07.chroot (nonexistent) +++ user/cperciva/freebsd-update-build/patches/9.0-RC2/1-SA-11:07.chroot (revision 293366) @@ -0,0 +1,217 @@ +Index: include/unistd.h +=================================================================== +--- include/unistd.h (revision 228798) ++++ include/unistd.h (working copy) +@@ -511,6 +511,7 @@ + int iruserok(unsigned long, int, const char *, const char *); + int iruserok_sa(const void *, int, int, const char *, const char *); + int issetugid(void); ++void __FreeBSD_libc_enter_restricted_mode(void); + long lpathconf(const char *, int); + #ifndef _MKDTEMP_DECLARED + char *mkdtemp(char *); +Index: lib/libc/include/libc_private.h +=================================================================== +--- lib/libc/include/libc_private.h (revision 228798) ++++ lib/libc/include/libc_private.h (working copy) +@@ -44,6 +44,17 @@ + extern int __isthreaded; + + /* ++ * libc should use libc_dlopen internally, which respects a global ++ * flag where loading of new shared objects can be restricted. ++ */ ++void *libc_dlopen(const char *, int); ++ ++/* ++ * For dynamic linker. ++ */ ++void _rtld_error(const char *fmt, ...); ++ ++/* + * File lock contention is difficult to diagnose without knowing + * where locks were set. Allow a debug library to be built which + * records the source file and line number of each lock call. +Index: lib/libc/Versions.def +=================================================================== +--- lib/libc/Versions.def (revision 228798) ++++ lib/libc/Versions.def (working copy) +@@ -19,6 +19,10 @@ + FBSD_1.2 { + } FBSD_1.1; + ++# This version was first added to 10.0-current. ++FBSD_1.3 { ++} FBSD_1.2; ++ + # This is our private namespace. Any global interfaces that are + # strictly for use only by other FreeBSD applications and libraries + # are listed here. We use a separate namespace so we can write +@@ -26,4 +30,4 @@ + # + # Please do NOT increment the version of this namespace. + FBSDprivate_1.0 { +-} FBSD_1.2; ++} FBSD_1.3; +Index: lib/libc/net/nsdispatch.c +=================================================================== +--- lib/libc/net/nsdispatch.c (revision 228798) ++++ lib/libc/net/nsdispatch.c (working copy) +@@ -384,7 +384,7 @@ + confmod = statbuf.st_mtime; + + #ifdef NS_CACHING +- handle = dlopen(NULL, RTLD_LAZY | RTLD_GLOBAL); ++ handle = libc_dlopen(NULL, RTLD_LAZY | RTLD_GLOBAL); + if (handle != NULL) { + nss_cache_cycle_prevention_func = dlsym(handle, + "_nss_cache_cycle_prevention_function"); +@@ -497,7 +497,7 @@ + if (snprintf(buf, sizeof(buf), "nss_%s.so.%d", mod.name, + NSS_MODULE_INTERFACE_VERSION) >= (int)sizeof(buf)) + goto fin; +- mod.handle = dlopen(buf, RTLD_LOCAL|RTLD_LAZY); ++ mod.handle = libc_dlopen(buf, RTLD_LOCAL|RTLD_LAZY); + if (mod.handle == NULL) { + #ifdef _NSS_DEBUG + /* This gets pretty annoying since the built-in +Index: lib/libc/gen/Symbol.map +=================================================================== +--- lib/libc/gen/Symbol.map (revision 228798) ++++ lib/libc/gen/Symbol.map (working copy) +@@ -380,6 +380,10 @@ + setutxent; + }; + ++FBSD_1.3 { ++ __FreeBSD_libc_enter_restricted_mode; ++}; ++ + FBSDprivate_1.0 { + /* needed by thread libraries */ + __thr_jtable; +Index: lib/libc/gen/Makefile.inc +=================================================================== +--- lib/libc/gen/Makefile.inc (revision 228798) ++++ lib/libc/gen/Makefile.inc (working copy) +@@ -20,6 +20,7 @@ + getpeereid.c getprogname.c getpwent.c getttyent.c \ + getusershell.c getutxent.c getvfsbyname.c glob.c \ + initgroups.c isatty.c isinf.c isnan.c jrand48.c lcong48.c \ ++ libc_dlopen.c \ + lockf.c lrand48.c mrand48.c nftw.c nice.c \ + nlist.c nrand48.c opendir.c \ + pause.c pmadvise.c popen.c posix_spawn.c \ +Index: lib/libc/gen/libc_dlopen.c +=================================================================== +--- lib/libc/gen/libc_dlopen.c (revision 0) ++++ lib/libc/gen/libc_dlopen.c (working copy) +@@ -0,0 +1,61 @@ ++/*- ++ * Copyright (c) 2011 Xin Li ++ * All rights reserved. ++ * ++ * Redistribution and use in source and binary forms, with or without ++ * modification, are permitted provided that the following conditions ++ * are met: ++ * 1. Redistributions of source code must retain the above copyright ++ * notice, this list of conditions and the following disclaimer. ++ * 2. Redistributions in binary form must reproduce the above copyright ++ * notice, this list of conditions and the following disclaimer in the ++ * documentation and/or other materials provided with the distribution. ++ * ++ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND ++ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE ++ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ++ * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE ++ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL ++ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS ++ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) ++ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT ++ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY ++ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF ++ * SUCH DAMAGE. ++ * ++ * $FreeBSD$ ++ */ ++ ++#include ++__FBSDID("$FreeBSD$"); ++ ++#include ++#include ++#include ++ ++#include "libc_private.h" ++ ++/* ++ * Whether we want to restrict dlopen()s. ++ */ ++static int __libc_restricted_mode = 0; ++ ++void * ++libc_dlopen(const char *path, int mode) ++{ ++ ++ if (__libc_restricted_mode) { ++ _rtld_error("Service unavailable -- libc in restricted mode"); ++ return (NULL); ++ } else ++ return (dlopen(path, mode)); ++} ++ ++void ++__FreeBSD_libc_enter_restricted_mode(void) ++{ ++ ++ __libc_restricted_mode = 1; ++ return; ++} ++ +Index: lib/libc/iconv/citrus_module.c +=================================================================== +--- lib/libc/iconv/citrus_module.c (revision 228798) ++++ lib/libc/iconv/citrus_module.c (working copy) +@@ -109,6 +109,7 @@ + #include "citrus_namespace.h" + #include "citrus_bcs.h" + #include "citrus_module.h" ++#include "libc_private.h" + + static int _getdewey(int[], char *); + static int _cmpndewey(int[], int, int[], int); +@@ -294,7 +295,7 @@ + p = _findshlib(path, &maj, &min); + if (!p) + return (EINVAL); +- handle = dlopen(p, RTLD_LAZY); ++ handle = libc_dlopen(p, RTLD_LAZY); + if (!handle) { + printf("%s", dlerror()); + return (EINVAL); +Index: libexec/ftpd/popen.c +=================================================================== +--- libexec/ftpd/popen.c (revision 228798) ++++ libexec/ftpd/popen.c (working copy) +@@ -143,6 +143,9 @@ + } + (void)close(pdes[1]); + } ++ /* Drop privileges before proceeding */ ++ if (getuid() != geteuid() && setuid(geteuid()) < 0) ++ _exit(1); + if (strcmp(gargv[0], _PATH_LS) == 0) { + /* Reset getopt for ls_main() */ + optreset = optind = optopt = 1; +Index: libexec/ftpd/ftpd.c +=================================================================== +--- libexec/ftpd/ftpd.c (revision 228798) ++++ libexec/ftpd/ftpd.c (working copy) +@@ -1562,6 +1562,7 @@ + reply(550, "Can't change root."); + goto bad; + } ++ __FreeBSD_libc_enter_restricted_mode(); + } else /* real user w/o chroot */ + homedir = pw->pw_dir; + /* Index: user/cperciva/freebsd-update-build/patches/9.0-RC2/1-SA-11:08.telnetd =================================================================== --- user/cperciva/freebsd-update-build/patches/9.0-RC2/1-SA-11:08.telnetd (nonexistent) +++ user/cperciva/freebsd-update-build/patches/9.0-RC2/1-SA-11:08.telnetd (revision 293366) @@ -0,0 +1,28 @@ +Index: crypto/heimdal/appl/telnet/libtelnet/encrypt.c +=================================================================== +--- crypto/heimdal/appl/telnet/libtelnet/encrypt.c (revision 228798) ++++ crypto/heimdal/appl/telnet/libtelnet/encrypt.c (working copy) +@@ -736,6 +736,9 @@ + int dir = kp->dir; + int ret = 0; + ++ if (len > MAXKEYLEN) ++ len = MAXKEYLEN; ++ + if (!(ep = (*kp->getcrypt)(*kp->modep))) { + if (len == 0) + return; +Index: contrib/telnet/libtelnet/encrypt.c +=================================================================== +--- contrib/telnet/libtelnet/encrypt.c (revision 228798) ++++ contrib/telnet/libtelnet/encrypt.c (working copy) +@@ -721,6 +721,9 @@ + int dir = kp->dir; + int ret = 0; + ++ if (len > MAXKEYLEN) ++ len = MAXKEYLEN; ++ + if (!(ep = (*kp->getcrypt)(*kp->modep))) { + if (len == 0) + return; Index: user/cperciva/freebsd-update-build/patches/9.0-RC2/1-SA-11:09.pam_ssh =================================================================== --- user/cperciva/freebsd-update-build/patches/9.0-RC2/1-SA-11:09.pam_ssh (nonexistent) +++ user/cperciva/freebsd-update-build/patches/9.0-RC2/1-SA-11:09.pam_ssh (revision 293366) @@ -0,0 +1,64 @@ +Index: lib/libpam/modules/pam_ssh/pam_ssh.c +=================================================================== +--- lib/libpam/modules/pam_ssh/pam_ssh.c (revision 227756) ++++ lib/libpam/modules/pam_ssh/pam_ssh.c (revision 227757) +@@ -93,7 +93,8 @@ + * struct pam_ssh_key containing the key and its comment. + */ + static struct pam_ssh_key * +-pam_ssh_load_key(const char *dir, const char *kfn, const char *passphrase) ++pam_ssh_load_key(const char *dir, const char *kfn, const char *passphrase, ++ int nullok) + { + struct pam_ssh_key *psk; + char fn[PATH_MAX]; +@@ -103,7 +104,21 @@ + if (snprintf(fn, sizeof(fn), "%s/%s", dir, kfn) > (int)sizeof(fn)) + return (NULL); + comment = NULL; +- key = key_load_private(fn, passphrase, &comment); ++ /* ++ * If the key is unencrypted, OpenSSL ignores the passphrase, so ++ * it will seem like the user typed in the right one. This allows ++ * a user to circumvent nullok by providing a dummy passphrase. ++ * Verify that the key really *is* encrypted by trying to load it ++ * with an empty passphrase, and if the key is not encrypted, ++ * accept only an empty passphrase. ++ */ ++ key = key_load_private(fn, NULL, &comment); ++ if (key != NULL && !(*passphrase == '\0' && nullok)) { ++ key_free(key); ++ return (NULL); ++ } ++ if (key == NULL) ++ key = key_load_private(fn, passphrase, &comment); + if (key == NULL) { + openpam_log(PAM_LOG_DEBUG, "failed to load key from %s", fn); + return (NULL); +@@ -170,9 +185,6 @@ + if (pam_err != PAM_SUCCESS) + return (pam_err); + +- if (*passphrase == '\0' && !nullok) +- goto skip_keys; +- + /* switch to user credentials */ + pam_err = openpam_borrow_cred(pamh, pwd); + if (pam_err != PAM_SUCCESS) +@@ -180,7 +192,7 @@ + + /* try to load keys from all keyfiles we know of */ + for (kfn = pam_ssh_keyfiles; *kfn != NULL; ++kfn) { +- psk = pam_ssh_load_key(pwd->pw_dir, *kfn, passphrase); ++ psk = pam_ssh_load_key(pwd->pw_dir, *kfn, passphrase, nullok); + if (psk != NULL) { + pam_set_data(pamh, *kfn, psk, pam_ssh_free_key); + ++nkeys; +@@ -190,7 +202,6 @@ + /* switch back to arbitrator credentials */ + openpam_restore_cred(pamh); + +- skip_keys: + /* + * If we tried an old token and didn't get anything, and + * try_first_pass was specified, try again after prompting the Index: user/cperciva/freebsd-update-build/patches/9.0-RC2/1-SA-11:10.pam =================================================================== --- user/cperciva/freebsd-update-build/patches/9.0-RC2/1-SA-11:10.pam (nonexistent) +++ user/cperciva/freebsd-update-build/patches/9.0-RC2/1-SA-11:10.pam (revision 293366) @@ -0,0 +1,18 @@ +Index: contrib/openpam/lib/openpam_configure.c +=================================================================== +--- contrib/openpam/lib/openpam_configure.c (revision 228383) ++++ contrib/openpam/lib/openpam_configure.c (revision 228384) +@@ -285,6 +285,13 @@ + size_t len; + int r; + ++ /* don't allow to escape from policy_path */ ++ if (strchr(service, '/')) { ++ openpam_log(PAM_LOG_ERROR, "invalid service name: %s", ++ service); ++ return (-PAM_SYSTEM_ERR); ++ } ++ + for (path = openpam_policy_path; *path != NULL; ++path) { + len = strlen(*path); + if ((*path)[len - 1] == '/') { Index: user/cperciva/freebsd-update-build/patches/9.0-RC3/0-clang.patch =================================================================== --- user/cperciva/freebsd-update-build/patches/9.0-RC3/0-clang.patch (nonexistent) +++ user/cperciva/freebsd-update-build/patches/9.0-RC3/0-clang.patch (revision 293366) @@ -0,0 +1,11 @@ +Index: lib/clang/clang.build.mk +--- lib/clang/clang.build.mk 2011-10-20 05:42:19.000000000 -0700 ++++ lib/clang/clang.build.mk 2011-10-20 05:42:54.000000000 -0700 +@@ -6,6 +6,7 @@ + -I${LLVM_SRCS}/${SRCDIR} ${INCDIR:C/^/-I${LLVM_SRCS}\//} -I. \ + -I${LLVM_SRCS}/../../lib/clang/include \ + -DLLVM_ON_UNIX -DLLVM_ON_FREEBSD \ ++ -frandom-seed=RepeatabilityConsideredGood \ + -D__STDC_LIMIT_MACROS -D__STDC_CONSTANT_MACROS #-DNDEBUG + + # Correct for gcc miscompilation when compiling on PPC with -O2 Index: user/cperciva/freebsd-update-build/patches/9.0-RC3/1-SA-11:07.chroot =================================================================== --- user/cperciva/freebsd-update-build/patches/9.0-RC3/1-SA-11:07.chroot (nonexistent) +++ user/cperciva/freebsd-update-build/patches/9.0-RC3/1-SA-11:07.chroot (revision 293366) @@ -0,0 +1,217 @@ +Index: include/unistd.h +=================================================================== +--- include/unistd.h (revision 228798) ++++ include/unistd.h (working copy) +@@ -511,6 +511,7 @@ + int iruserok(unsigned long, int, const char *, const char *); + int iruserok_sa(const void *, int, int, const char *, const char *); + int issetugid(void); ++void __FreeBSD_libc_enter_restricted_mode(void); + long lpathconf(const char *, int); + #ifndef _MKDTEMP_DECLARED + char *mkdtemp(char *); +Index: lib/libc/include/libc_private.h +=================================================================== +--- lib/libc/include/libc_private.h (revision 228798) ++++ lib/libc/include/libc_private.h (working copy) +@@ -44,6 +44,17 @@ + extern int __isthreaded; + + /* ++ * libc should use libc_dlopen internally, which respects a global ++ * flag where loading of new shared objects can be restricted. ++ */ ++void *libc_dlopen(const char *, int); ++ ++/* ++ * For dynamic linker. ++ */ ++void _rtld_error(const char *fmt, ...); ++ ++/* + * File lock contention is difficult to diagnose without knowing + * where locks were set. Allow a debug library to be built which + * records the source file and line number of each lock call. +Index: lib/libc/Versions.def +=================================================================== +--- lib/libc/Versions.def (revision 228798) ++++ lib/libc/Versions.def (working copy) +@@ -19,6 +19,10 @@ + FBSD_1.2 { + } FBSD_1.1; + ++# This version was first added to 10.0-current. ++FBSD_1.3 { ++} FBSD_1.2; ++ + # This is our private namespace. Any global interfaces that are + # strictly for use only by other FreeBSD applications and libraries + # are listed here. We use a separate namespace so we can write +@@ -26,4 +30,4 @@ + # + # Please do NOT increment the version of this namespace. + FBSDprivate_1.0 { +-} FBSD_1.2; ++} FBSD_1.3; +Index: lib/libc/net/nsdispatch.c +=================================================================== +--- lib/libc/net/nsdispatch.c (revision 228798) ++++ lib/libc/net/nsdispatch.c (working copy) +@@ -384,7 +384,7 @@ + confmod = statbuf.st_mtime; + + #ifdef NS_CACHING +- handle = dlopen(NULL, RTLD_LAZY | RTLD_GLOBAL); ++ handle = libc_dlopen(NULL, RTLD_LAZY | RTLD_GLOBAL); + if (handle != NULL) { + nss_cache_cycle_prevention_func = dlsym(handle, + "_nss_cache_cycle_prevention_function"); +@@ -497,7 +497,7 @@ + if (snprintf(buf, sizeof(buf), "nss_%s.so.%d", mod.name, + NSS_MODULE_INTERFACE_VERSION) >= (int)sizeof(buf)) + goto fin; +- mod.handle = dlopen(buf, RTLD_LOCAL|RTLD_LAZY); ++ mod.handle = libc_dlopen(buf, RTLD_LOCAL|RTLD_LAZY); + if (mod.handle == NULL) { + #ifdef _NSS_DEBUG + /* This gets pretty annoying since the built-in +Index: lib/libc/gen/Symbol.map +=================================================================== +--- lib/libc/gen/Symbol.map (revision 228798) ++++ lib/libc/gen/Symbol.map (working copy) +@@ -380,6 +380,10 @@ + setutxent; + }; + ++FBSD_1.3 { ++ __FreeBSD_libc_enter_restricted_mode; ++}; ++ + FBSDprivate_1.0 { + /* needed by thread libraries */ + __thr_jtable; +Index: lib/libc/gen/Makefile.inc +=================================================================== +--- lib/libc/gen/Makefile.inc (revision 228798) ++++ lib/libc/gen/Makefile.inc (working copy) +@@ -20,6 +20,7 @@ + getpeereid.c getprogname.c getpwent.c getttyent.c \ + getusershell.c getutxent.c getvfsbyname.c glob.c \ + initgroups.c isatty.c isinf.c isnan.c jrand48.c lcong48.c \ ++ libc_dlopen.c \ + lockf.c lrand48.c mrand48.c nftw.c nice.c \ + nlist.c nrand48.c opendir.c \ + pause.c pmadvise.c popen.c posix_spawn.c \ +Index: lib/libc/gen/libc_dlopen.c +=================================================================== +--- lib/libc/gen/libc_dlopen.c (revision 0) ++++ lib/libc/gen/libc_dlopen.c (working copy) +@@ -0,0 +1,61 @@ ++/*- ++ * Copyright (c) 2011 Xin Li ++ * All rights reserved. ++ * ++ * Redistribution and use in source and binary forms, with or without ++ * modification, are permitted provided that the following conditions ++ * are met: ++ * 1. Redistributions of source code must retain the above copyright ++ * notice, this list of conditions and the following disclaimer. ++ * 2. Redistributions in binary form must reproduce the above copyright ++ * notice, this list of conditions and the following disclaimer in the ++ * documentation and/or other materials provided with the distribution. ++ * ++ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND ++ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE ++ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ++ * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE ++ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL ++ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS ++ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) ++ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT ++ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY ++ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF ++ * SUCH DAMAGE. ++ * ++ * $FreeBSD$ ++ */ ++ ++#include ++__FBSDID("$FreeBSD$"); ++ ++#include ++#include ++#include ++ ++#include "libc_private.h" ++ ++/* ++ * Whether we want to restrict dlopen()s. ++ */ ++static int __libc_restricted_mode = 0; ++ ++void * ++libc_dlopen(const char *path, int mode) ++{ ++ ++ if (__libc_restricted_mode) { ++ _rtld_error("Service unavailable -- libc in restricted mode"); ++ return (NULL); ++ } else ++ return (dlopen(path, mode)); ++} ++ ++void ++__FreeBSD_libc_enter_restricted_mode(void) ++{ ++ ++ __libc_restricted_mode = 1; ++ return; ++} ++ +Index: lib/libc/iconv/citrus_module.c +=================================================================== +--- lib/libc/iconv/citrus_module.c (revision 228798) ++++ lib/libc/iconv/citrus_module.c (working copy) +@@ -109,6 +109,7 @@ + #include "citrus_namespace.h" + #include "citrus_bcs.h" + #include "citrus_module.h" ++#include "libc_private.h" + + static int _getdewey(int[], char *); + static int _cmpndewey(int[], int, int[], int); +@@ -294,7 +295,7 @@ + p = _findshlib(path, &maj, &min); + if (!p) + return (EINVAL); +- handle = dlopen(p, RTLD_LAZY); ++ handle = libc_dlopen(p, RTLD_LAZY); + if (!handle) { + printf("%s", dlerror()); + return (EINVAL); +Index: libexec/ftpd/popen.c +=================================================================== +--- libexec/ftpd/popen.c (revision 228798) ++++ libexec/ftpd/popen.c (working copy) +@@ -143,6 +143,9 @@ + } + (void)close(pdes[1]); + } ++ /* Drop privileges before proceeding */ ++ if (getuid() != geteuid() && setuid(geteuid()) < 0) ++ _exit(1); + if (strcmp(gargv[0], _PATH_LS) == 0) { + /* Reset getopt for ls_main() */ + optreset = optind = optopt = 1; +Index: libexec/ftpd/ftpd.c +=================================================================== +--- libexec/ftpd/ftpd.c (revision 228798) ++++ libexec/ftpd/ftpd.c (working copy) +@@ -1562,6 +1562,7 @@ + reply(550, "Can't change root."); + goto bad; + } ++ __FreeBSD_libc_enter_restricted_mode(); + } else /* real user w/o chroot */ + homedir = pw->pw_dir; + /* Index: user/cperciva/freebsd-update-build/patches/9.0-RC3/1-SA-11:08.telnetd =================================================================== --- user/cperciva/freebsd-update-build/patches/9.0-RC3/1-SA-11:08.telnetd (nonexistent) +++ user/cperciva/freebsd-update-build/patches/9.0-RC3/1-SA-11:08.telnetd (revision 293366) @@ -0,0 +1,28 @@ +Index: crypto/heimdal/appl/telnet/libtelnet/encrypt.c +=================================================================== +--- crypto/heimdal/appl/telnet/libtelnet/encrypt.c (revision 228798) ++++ crypto/heimdal/appl/telnet/libtelnet/encrypt.c (working copy) +@@ -736,6 +736,9 @@ + int dir = kp->dir; + int ret = 0; + ++ if (len > MAXKEYLEN) ++ len = MAXKEYLEN; ++ + if (!(ep = (*kp->getcrypt)(*kp->modep))) { + if (len == 0) + return; +Index: contrib/telnet/libtelnet/encrypt.c +=================================================================== +--- contrib/telnet/libtelnet/encrypt.c (revision 228798) ++++ contrib/telnet/libtelnet/encrypt.c (working copy) +@@ -721,6 +721,9 @@ + int dir = kp->dir; + int ret = 0; + ++ if (len > MAXKEYLEN) ++ len = MAXKEYLEN; ++ + if (!(ep = (*kp->getcrypt)(*kp->modep))) { + if (len == 0) + return; Index: user/cperciva/freebsd-update-build/patches/9.0-RC3/1-SA-11:09.pam_ssh =================================================================== --- user/cperciva/freebsd-update-build/patches/9.0-RC3/1-SA-11:09.pam_ssh (nonexistent) +++ user/cperciva/freebsd-update-build/patches/9.0-RC3/1-SA-11:09.pam_ssh (revision 293366) @@ -0,0 +1,64 @@ +Index: lib/libpam/modules/pam_ssh/pam_ssh.c +=================================================================== +--- lib/libpam/modules/pam_ssh/pam_ssh.c (revision 227756) ++++ lib/libpam/modules/pam_ssh/pam_ssh.c (revision 227757) +@@ -93,7 +93,8 @@ + * struct pam_ssh_key containing the key and its comment. + */ + static struct pam_ssh_key * +-pam_ssh_load_key(const char *dir, const char *kfn, const char *passphrase) ++pam_ssh_load_key(const char *dir, const char *kfn, const char *passphrase, ++ int nullok) + { + struct pam_ssh_key *psk; + char fn[PATH_MAX]; +@@ -103,7 +104,21 @@ + if (snprintf(fn, sizeof(fn), "%s/%s", dir, kfn) > (int)sizeof(fn)) + return (NULL); + comment = NULL; +- key = key_load_private(fn, passphrase, &comment); ++ /* ++ * If the key is unencrypted, OpenSSL ignores the passphrase, so ++ * it will seem like the user typed in the right one. This allows ++ * a user to circumvent nullok by providing a dummy passphrase. ++ * Verify that the key really *is* encrypted by trying to load it ++ * with an empty passphrase, and if the key is not encrypted, ++ * accept only an empty passphrase. ++ */ ++ key = key_load_private(fn, NULL, &comment); ++ if (key != NULL && !(*passphrase == '\0' && nullok)) { ++ key_free(key); ++ return (NULL); ++ } ++ if (key == NULL) ++ key = key_load_private(fn, passphrase, &comment); + if (key == NULL) { + openpam_log(PAM_LOG_DEBUG, "failed to load key from %s", fn); + return (NULL); +@@ -170,9 +185,6 @@ + if (pam_err != PAM_SUCCESS) + return (pam_err); + +- if (*passphrase == '\0' && !nullok) +- goto skip_keys; +- + /* switch to user credentials */ + pam_err = openpam_borrow_cred(pamh, pwd); + if (pam_err != PAM_SUCCESS) +@@ -180,7 +192,7 @@ + + /* try to load keys from all keyfiles we know of */ + for (kfn = pam_ssh_keyfiles; *kfn != NULL; ++kfn) { +- psk = pam_ssh_load_key(pwd->pw_dir, *kfn, passphrase); ++ psk = pam_ssh_load_key(pwd->pw_dir, *kfn, passphrase, nullok); + if (psk != NULL) { + pam_set_data(pamh, *kfn, psk, pam_ssh_free_key); + ++nkeys; +@@ -190,7 +202,6 @@ + /* switch back to arbitrator credentials */ + openpam_restore_cred(pamh); + +- skip_keys: + /* + * If we tried an old token and didn't get anything, and + * try_first_pass was specified, try again after prompting the Index: user/cperciva/freebsd-update-build/patches/9.0-RC3/1-SA-11:10.pam =================================================================== --- user/cperciva/freebsd-update-build/patches/9.0-RC3/1-SA-11:10.pam (nonexistent) +++ user/cperciva/freebsd-update-build/patches/9.0-RC3/1-SA-11:10.pam (revision 293366) @@ -0,0 +1,18 @@ +Index: contrib/openpam/lib/openpam_configure.c +=================================================================== +--- contrib/openpam/lib/openpam_configure.c (revision 228383) ++++ contrib/openpam/lib/openpam_configure.c (revision 228384) +@@ -285,6 +285,13 @@ + size_t len; + int r; + ++ /* don't allow to escape from policy_path */ ++ if (strchr(service, '/')) { ++ openpam_log(PAM_LOG_ERROR, "invalid service name: %s", ++ service); ++ return (-PAM_SYSTEM_ERR); ++ } ++ + for (path = openpam_policy_path; *path != NULL; ++path) { + len = strlen(*path); + if ((*path)[len - 1] == '/') { Index: user/cperciva/freebsd-update-build/patches/9.1-RC1/0-clang.patch =================================================================== --- user/cperciva/freebsd-update-build/patches/9.1-RC1/0-clang.patch (nonexistent) +++ user/cperciva/freebsd-update-build/patches/9.1-RC1/0-clang.patch (revision 293366) @@ -0,0 +1,11 @@ +Index: lib/clang/clang.build.mk +--- lib/clang/clang.build.mk 2011-10-20 05:42:19.000000000 -0700 ++++ lib/clang/clang.build.mk 2011-10-20 05:42:54.000000000 -0700 +@@ -6,6 +6,7 @@ + -I${LLVM_SRCS}/${SRCDIR} ${INCDIR:C/^/-I${LLVM_SRCS}\//} -I. \ + -I${LLVM_SRCS}/../../lib/clang/include \ + -DLLVM_ON_UNIX -DLLVM_ON_FREEBSD \ ++ -frandom-seed=RepeatabilityConsideredGood \ + -D__STDC_LIMIT_MACROS -D__STDC_CONSTANT_MACROS #-DNDEBUG + + # Correct for gcc miscompilation when compiling on PPC with -O2 Index: user/cperciva/freebsd-update-build/patches/9.1-RC1/1-SA-12:06.bind =================================================================== --- user/cperciva/freebsd-update-build/patches/9.1-RC1/1-SA-12:06.bind (nonexistent) +++ user/cperciva/freebsd-update-build/patches/9.1-RC1/1-SA-12:06.bind (revision 293366) @@ -0,0 +1,184 @@ +Index: contrib/bind9/bin/named/query.c +=================================================================== +--- contrib/bind9/bin/named/query.c (revision 241362) ++++ contrib/bind9/bin/named/query.c (working copy) +@@ -1140,7 +1140,0 @@ query_isduplicate(ns_client_t *client, dns_name_t +- /* +- * If the dns_name_t we're looking up is already in the message, +- * we don't want to trigger the caller's name replacement logic. +- */ +- if (name == mname) +- mname = NULL; +- +@@ -1341,6 +1334,7 @@ query_addadditional(void *arg, dns_name_t *name, d + if (dns_rdataset_isassociated(rdataset) && + !query_isduplicate(client, fname, type, &mname)) { + if (mname != NULL) { ++ INSIST(mname != fname); + query_releasename(client, &fname); + fname = mname; + } else +@@ -1401,11 +1395,13 @@ query_addadditional(void *arg, dns_name_t *name, d + mname = NULL; + if (!query_isduplicate(client, fname, + dns_rdatatype_a, &mname)) { ++ if (mname != fname) { + if (mname != NULL) { + query_releasename(client, &fname); + fname = mname; + } else + need_addname = ISC_TRUE; ++ } + ISC_LIST_APPEND(fname->list, rdataset, link); + added_something = ISC_TRUE; + if (sigrdataset != NULL && +@@ -1444,11 +1440,13 @@ query_addadditional(void *arg, dns_name_t *name, d + mname = NULL; + if (!query_isduplicate(client, fname, + dns_rdatatype_aaaa, &mname)) { ++ if (mname != fname) { + if (mname != NULL) { + query_releasename(client, &fname); + fname = mname; + } else + need_addname = ISC_TRUE; ++ } + ISC_LIST_APPEND(fname->list, rdataset, link); + added_something = ISC_TRUE; + if (sigrdataset != NULL && +@@ -1960,6 +1958,7 @@ query_addadditional2(void *arg, dns_name_t *name, + crdataset->type == dns_rdatatype_aaaa) { + if (!query_isduplicate(client, fname, crdataset->type, + &mname)) { ++ if (mname != fname) { + if (mname != NULL) { + /* + * A different type of this name is +@@ -1976,6 +1975,7 @@ query_addadditional2(void *arg, dns_name_t *name, + mname0 = mname; + } else + need_addname = ISC_TRUE; ++ } + ISC_LIST_UNLINK(cfname.list, crdataset, link); + ISC_LIST_APPEND(fname->list, crdataset, link); + added_something = ISC_TRUE; +Index: contrib/bind9/lib/dns/include/dns/rdata.h +=================================================================== +--- contrib/bind9/lib/dns/include/dns/rdata.h (revision 241362) ++++ contrib/bind9/lib/dns/include/dns/rdata.h (working copy) +@@ -147,6 +147,17 @@ struct dns_rdata { + (((rdata)->flags & ~(DNS_RDATA_UPDATE|DNS_RDATA_OFFLINE)) == 0) + + /* ++ * The maximum length of a RDATA that can be sent on the wire. ++ * Max packet size (65535) less header (12), less name (1), type (2), ++ * class (2), ttl(4), length (2). ++ * ++ * None of the defined types that support name compression can exceed ++ * this and all new types are to be sent uncompressed. ++ */ ++ ++#define DNS_RDATA_MAXLENGTH 65512U ++ ++/* + * Flags affecting rdata formatting style. Flags 0xFFFF0000 + * are used by masterfile-level formatting and defined elsewhere. + * See additional comments at dns_rdata_tofmttext(). +Index: contrib/bind9/lib/dns/master.c +=================================================================== +--- contrib/bind9/lib/dns/master.c (revision 241362) ++++ contrib/bind9/lib/dns/master.c (working copy) +@@ -75,7 +75,7 @@ + /*% + * max message size - header - root - type - class - ttl - rdlen + */ +-#define MINTSIZ (65535 - 12 - 1 - 2 - 2 - 4 - 2) ++#define MINTSIZ DNS_RDATA_MAXLENGTH + /*% + * Size for tokens in the presentation format, + * The largest tokens are the base64 blocks in KEY and CERT records, +Index: contrib/bind9/lib/dns/rdata.c +=================================================================== +--- contrib/bind9/lib/dns/rdata.c (revision 241362) ++++ contrib/bind9/lib/dns/rdata.c (working copy) +@@ -425,6 +425,7 @@ dns_rdata_fromwire(dns_rdata_t *rdata, dns_rdatacl + isc_buffer_t st; + isc_boolean_t use_default = ISC_FALSE; + isc_uint32_t activelength; ++ size_t length; + + REQUIRE(dctx != NULL); + if (rdata != NULL) { +@@ -455,6 +456,14 @@ dns_rdata_fromwire(dns_rdata_t *rdata, dns_rdatacl + } + + /* ++ * Reject any rdata that expands out to more than DNS_RDATA_MAXLENGTH ++ * as we cannot transmit it. ++ */ ++ length = isc_buffer_usedlength(target) - isc_buffer_usedlength(&st); ++ if (result == ISC_R_SUCCESS && length > DNS_RDATA_MAXLENGTH) ++ result = DNS_R_FORMERR; ++ ++ /* + * We should have consumed all of our buffer. + */ + if (result == ISC_R_SUCCESS && !buffer_empty(source)) +@@ -462,8 +471,7 @@ dns_rdata_fromwire(dns_rdata_t *rdata, dns_rdatacl + + if (rdata != NULL && result == ISC_R_SUCCESS) { + region.base = isc_buffer_used(&st); +- region.length = isc_buffer_usedlength(target) - +- isc_buffer_usedlength(&st); ++ region.length = length; + dns_rdata_fromregion(rdata, rdclass, type, ®ion); + } + +@@ -598,6 +606,7 @@ dns_rdata_fromtext(dns_rdata_t *rdata, dns_rdatacl + unsigned long line; + void (*callback)(dns_rdatacallbacks_t *, const char *, ...); + isc_result_t tresult; ++ size_t length; + + REQUIRE(origin == NULL || dns_name_isabsolute(origin) == ISC_TRUE); + if (rdata != NULL) { +@@ -670,10 +679,13 @@ dns_rdata_fromtext(dns_rdata_t *rdata, dns_rdatacl + } + } while (1); + ++ length = isc_buffer_usedlength(target) - isc_buffer_usedlength(&st); ++ if (result == ISC_R_SUCCESS && length > DNS_RDATA_MAXLENGTH) ++ result = ISC_R_NOSPACE; ++ + if (rdata != NULL && result == ISC_R_SUCCESS) { + region.base = isc_buffer_used(&st); +- region.length = isc_buffer_usedlength(target) - +- isc_buffer_usedlength(&st); ++ region.length = length; + dns_rdata_fromregion(rdata, rdclass, type, ®ion); + } + if (result != ISC_R_SUCCESS) { +@@ -781,6 +793,7 @@ dns_rdata_fromstruct(dns_rdata_t *rdata, dns_rdata + isc_buffer_t st; + isc_region_t region; + isc_boolean_t use_default = ISC_FALSE; ++ size_t length; + + REQUIRE(source != NULL); + if (rdata != NULL) { +@@ -795,10 +808,13 @@ dns_rdata_fromstruct(dns_rdata_t *rdata, dns_rdata + if (use_default) + (void)NULL; + ++ length = isc_buffer_usedlength(target) - isc_buffer_usedlength(&st); ++ if (result == ISC_R_SUCCESS && length > DNS_RDATA_MAXLENGTH) ++ result = ISC_R_NOSPACE; ++ + if (rdata != NULL && result == ISC_R_SUCCESS) { + region.base = isc_buffer_used(&st); +- region.length = isc_buffer_usedlength(target) - +- isc_buffer_usedlength(&st); ++ region.length = length; + dns_rdata_fromregion(rdata, rdclass, type, ®ion); + } + if (result != ISC_R_SUCCESS) Index: user/cperciva/freebsd-update-build/patches/9.1-RC1/1-SA-12:07.hostapd =================================================================== --- user/cperciva/freebsd-update-build/patches/9.1-RC1/1-SA-12:07.hostapd (nonexistent) +++ user/cperciva/freebsd-update-build/patches/9.1-RC1/1-SA-12:07.hostapd (revision 293366) @@ -0,0 +1,19 @@ +Index: contrib/wpa/src/eap_server/eap_server_tls_common.c +=================================================================== +--- contrib/wpa/src/eap_server/eap_server_tls_common.c (revision 240924) ++++ contrib/wpa/src/eap_server/eap_server_tls_common.c (working copy) +@@ -225,6 +225,14 @@ static int eap_server_tls_process_fragment(struct + return -1; + } + ++ if (len > message_length) { ++ wpa_printf(MSG_INFO, "SSL: Too much data (%d bytes) in " ++ "first fragment of frame (TLS Message " ++ "Length %d bytes)", ++ (int) len, (int) message_length); ++ return -1; ++ } ++ + data->tls_in = wpabuf_alloc(message_length); + if (data->tls_in == NULL) { + wpa_printf(MSG_DEBUG, "SSL: No memory for message"); Index: user/cperciva/freebsd-update-build/patches/9.1-RC1/1-SA-12:08.linux =================================================================== --- user/cperciva/freebsd-update-build/patches/9.1-RC1/1-SA-12:08.linux (nonexistent) +++ user/cperciva/freebsd-update-build/patches/9.1-RC1/1-SA-12:08.linux (revision 293366) @@ -0,0 +1,16 @@ +Index: sys/compat/linux/linux_ioctl.c +=================================================================== +--- sys/compat/linux/linux_ioctl.c (revision 242578) ++++ sys/compat/linux/linux_ioctl.c (working copy) +@@ -2260,8 +2260,9 @@ again: + + ifc.ifc_len = valid_len; + sbuf_finish(sb); +- memcpy(PTRIN(ifc.ifc_buf), sbuf_data(sb), ifc.ifc_len); +- error = copyout(&ifc, uifc, sizeof(ifc)); ++ error = copyout(sbuf_data(sb), PTRIN(ifc.ifc_buf), ifc.ifc_len); ++ if (error == 0) ++ error = copyout(&ifc, uifc, sizeof(ifc)); + sbuf_delete(sb); + CURVNET_RESTORE(); + Index: user/cperciva/freebsd-update-build/patches/9.1-RC2/0-clang.patch =================================================================== --- user/cperciva/freebsd-update-build/patches/9.1-RC2/0-clang.patch (nonexistent) +++ user/cperciva/freebsd-update-build/patches/9.1-RC2/0-clang.patch (revision 293366) @@ -0,0 +1,11 @@ +Index: lib/clang/clang.build.mk +--- lib/clang/clang.build.mk 2011-10-20 05:42:19.000000000 -0700 ++++ lib/clang/clang.build.mk 2011-10-20 05:42:54.000000000 -0700 +@@ -6,6 +6,7 @@ + -I${LLVM_SRCS}/${SRCDIR} ${INCDIR:C/^/-I${LLVM_SRCS}\//} -I. \ + -I${LLVM_SRCS}/../../lib/clang/include \ + -DLLVM_ON_UNIX -DLLVM_ON_FREEBSD \ ++ -frandom-seed=RepeatabilityConsideredGood \ + -D__STDC_LIMIT_MACROS -D__STDC_CONSTANT_MACROS #-DNDEBUG + + # Correct for gcc miscompilation when compiling on PPC with -O2 Index: user/cperciva/freebsd-update-build/patches/9.1-RC2/1-SA-12:07.hostapd =================================================================== --- user/cperciva/freebsd-update-build/patches/9.1-RC2/1-SA-12:07.hostapd (nonexistent) +++ user/cperciva/freebsd-update-build/patches/9.1-RC2/1-SA-12:07.hostapd (revision 293366) @@ -0,0 +1,19 @@ +Index: contrib/wpa/src/eap_server/eap_server_tls_common.c +=================================================================== +--- contrib/wpa/src/eap_server/eap_server_tls_common.c (revision 240924) ++++ contrib/wpa/src/eap_server/eap_server_tls_common.c (working copy) +@@ -225,6 +225,14 @@ static int eap_server_tls_process_fragment(struct + return -1; + } + ++ if (len > message_length) { ++ wpa_printf(MSG_INFO, "SSL: Too much data (%d bytes) in " ++ "first fragment of frame (TLS Message " ++ "Length %d bytes)", ++ (int) len, (int) message_length); ++ return -1; ++ } ++ + data->tls_in = wpabuf_alloc(message_length); + if (data->tls_in == NULL) { + wpa_printf(MSG_DEBUG, "SSL: No memory for message"); Index: user/cperciva/freebsd-update-build/patches/9.1-RC2/1-SA-12:08.linux =================================================================== --- user/cperciva/freebsd-update-build/patches/9.1-RC2/1-SA-12:08.linux (nonexistent) +++ user/cperciva/freebsd-update-build/patches/9.1-RC2/1-SA-12:08.linux (revision 293366) @@ -0,0 +1,16 @@ +Index: sys/compat/linux/linux_ioctl.c +=================================================================== +--- sys/compat/linux/linux_ioctl.c (revision 242578) ++++ sys/compat/linux/linux_ioctl.c (working copy) +@@ -2260,8 +2260,9 @@ again: + + ifc.ifc_len = valid_len; + sbuf_finish(sb); +- memcpy(PTRIN(ifc.ifc_buf), sbuf_data(sb), ifc.ifc_len); +- error = copyout(&ifc, uifc, sizeof(ifc)); ++ error = copyout(sbuf_data(sb), PTRIN(ifc.ifc_buf), ifc.ifc_len); ++ if (error == 0) ++ error = copyout(&ifc, uifc, sizeof(ifc)); + sbuf_delete(sb); + CURVNET_RESTORE(); + Index: user/cperciva/freebsd-update-build/patches/9.1-RC3/0-clang.patch =================================================================== --- user/cperciva/freebsd-update-build/patches/9.1-RC3/0-clang.patch (nonexistent) +++ user/cperciva/freebsd-update-build/patches/9.1-RC3/0-clang.patch (revision 293366) @@ -0,0 +1,11 @@ +Index: lib/clang/clang.build.mk +--- lib/clang/clang.build.mk 2011-10-20 05:42:19.000000000 -0700 ++++ lib/clang/clang.build.mk 2011-10-20 05:42:54.000000000 -0700 +@@ -6,6 +6,7 @@ + -I${LLVM_SRCS}/${SRCDIR} ${INCDIR:C/^/-I${LLVM_SRCS}\//} -I. \ + -I${LLVM_SRCS}/../../lib/clang/include \ + -DLLVM_ON_UNIX -DLLVM_ON_FREEBSD \ ++ -frandom-seed=RepeatabilityConsideredGood \ + -D__STDC_LIMIT_MACROS -D__STDC_CONSTANT_MACROS #-DNDEBUG + + # Correct for gcc miscompilation when compiling on PPC with -O2 Index: user/cperciva/freebsd-update-build/patches/9.1-RC3/1-SA-12:07.hostapd =================================================================== --- user/cperciva/freebsd-update-build/patches/9.1-RC3/1-SA-12:07.hostapd (nonexistent) +++ user/cperciva/freebsd-update-build/patches/9.1-RC3/1-SA-12:07.hostapd (revision 293366) @@ -0,0 +1,19 @@ +Index: contrib/wpa/src/eap_server/eap_server_tls_common.c +=================================================================== +--- contrib/wpa/src/eap_server/eap_server_tls_common.c (revision 240924) ++++ contrib/wpa/src/eap_server/eap_server_tls_common.c (working copy) +@@ -225,6 +225,14 @@ static int eap_server_tls_process_fragment(struct + return -1; + } + ++ if (len > message_length) { ++ wpa_printf(MSG_INFO, "SSL: Too much data (%d bytes) in " ++ "first fragment of frame (TLS Message " ++ "Length %d bytes)", ++ (int) len, (int) message_length); ++ return -1; ++ } ++ + data->tls_in = wpabuf_alloc(message_length); + if (data->tls_in == NULL) { + wpa_printf(MSG_DEBUG, "SSL: No memory for message"); Index: user/cperciva/freebsd-update-build/patches/9.1-RC3/1-SA-12:08.linux =================================================================== --- user/cperciva/freebsd-update-build/patches/9.1-RC3/1-SA-12:08.linux (nonexistent) +++ user/cperciva/freebsd-update-build/patches/9.1-RC3/1-SA-12:08.linux (revision 293366) @@ -0,0 +1,16 @@ +Index: sys/compat/linux/linux_ioctl.c +=================================================================== +--- sys/compat/linux/linux_ioctl.c (revision 242578) ++++ sys/compat/linux/linux_ioctl.c (working copy) +@@ -2260,8 +2260,9 @@ again: + + ifc.ifc_len = valid_len; + sbuf_finish(sb); +- memcpy(PTRIN(ifc.ifc_buf), sbuf_data(sb), ifc.ifc_len); +- error = copyout(&ifc, uifc, sizeof(ifc)); ++ error = copyout(sbuf_data(sb), PTRIN(ifc.ifc_buf), ifc.ifc_len); ++ if (error == 0) ++ error = copyout(&ifc, uifc, sizeof(ifc)); + sbuf_delete(sb); + CURVNET_RESTORE(); + Index: user/cperciva/freebsd-update-build/patches/9.2-RC1/1-SA-13:09.ip_multicast =================================================================== --- user/cperciva/freebsd-update-build/patches/9.2-RC1/1-SA-13:09.ip_multicast (nonexistent) +++ user/cperciva/freebsd-update-build/patches/9.2-RC1/1-SA-13:09.ip_multicast (revision 293366) @@ -0,0 +1,26 @@ +Index: sys/netinet/in_mcast.c +=================================================================== +--- sys/netinet/in_mcast.c (revision 254252) ++++ sys/netinet/in_mcast.c (working copy) +@@ -1648,6 +1648,8 @@ + * has asked for, but we always tell userland how big the + * buffer really needs to be. + */ ++ if (msfr.msfr_nsrcs > in_mcast_maxsocksrc) ++ msfr.msfr_nsrcs = in_mcast_maxsocksrc; + tss = NULL; + if (msfr.msfr_srcs != NULL && msfr.msfr_nsrcs > 0) { + tss = malloc(sizeof(struct sockaddr_storage) * msfr.msfr_nsrcs, +Index: sys/netinet6/in6_mcast.c +=================================================================== +--- sys/netinet6/in6_mcast.c (revision 254252) ++++ sys/netinet6/in6_mcast.c (working copy) +@@ -1625,6 +1625,8 @@ + * has asked for, but we always tell userland how big the + * buffer really needs to be. + */ ++ if (msfr.msfr_nsrcs > in6_mcast_maxsocksrc) ++ msfr.msfr_nsrcs = in6_mcast_maxsocksrc; + tss = NULL; + if (msfr.msfr_srcs != NULL && msfr.msfr_nsrcs > 0) { + tss = malloc(sizeof(struct sockaddr_storage) * msfr.msfr_nsrcs, Index: user/cperciva/freebsd-update-build/patches/9.2-RC1/1-SA-13:10.sctp =================================================================== --- user/cperciva/freebsd-update-build/patches/9.2-RC1/1-SA-13:10.sctp (nonexistent) +++ user/cperciva/freebsd-update-build/patches/9.2-RC1/1-SA-13:10.sctp (revision 293366) @@ -0,0 +1,19 @@ +Index: sys/netinet/sctp_output.c +=================================================================== +--- sys/netinet/sctp_output.c (revision 254337) ++++ sys/netinet/sctp_output.c (revision 254338) +@@ -5406,6 +5406,14 @@ + } + SCTP_BUF_LEN(m) = sizeof(struct sctp_init_chunk); + ++ /* ++ * We might not overwrite the identification[] completely and on ++ * some platforms time_entered will contain some padding. Therefore ++ * zero out the cookie to avoid putting uninitialized memory on the ++ * wire. ++ */ ++ memset(&stc, 0, sizeof(struct sctp_state_cookie)); ++ + /* the time I built cookie */ + (void)SCTP_GETTIME_TIMEVAL(&stc.time_entered); + Index: user/cperciva/freebsd-update-build/patches/9.2-RC1/2-SA-13:11.sendfile =================================================================== --- user/cperciva/freebsd-update-build/patches/9.2-RC1/2-SA-13:11.sendfile (nonexistent) +++ user/cperciva/freebsd-update-build/patches/9.2-RC1/2-SA-13:11.sendfile (revision 293366) @@ -0,0 +1,20 @@ +Index: sys/kern/uipc_syscalls.c +=================================================================== +--- sys/kern/uipc_syscalls.c (revision 253912) ++++ sys/kern/uipc_syscalls.c (working copy) +@@ -2087,11 +2087,10 @@ + * or the passed in nbytes. + */ + pgoff = (vm_offset_t)(off & PAGE_MASK); +- if (uap->nbytes) +- rem = (uap->nbytes - fsbytes - loopbytes); +- else +- rem = va.va_size - +- uap->offset - fsbytes - loopbytes; ++ rem = obj->un_pager.vnp.vnp_size - uap->offset; ++ if (uap->nbytes != 0) ++ rem = omin(rem, uap->nbytes); ++ rem -= fsbytes + loopbytes; + xfsize = omin(PAGE_SIZE - pgoff, rem); + xfsize = omin(space - loopbytes, xfsize); + if (xfsize <= 0) { Index: user/cperciva/freebsd-update-build/patches/9.2-RC1/2-SA-13:12.ifioctl =================================================================== --- user/cperciva/freebsd-update-build/patches/9.2-RC1/2-SA-13:12.ifioctl (nonexistent) +++ user/cperciva/freebsd-update-build/patches/9.2-RC1/2-SA-13:12.ifioctl (revision 293366) @@ -0,0 +1,89 @@ +Index: sys/net/if.c +=================================================================== +--- sys/net/if.c (revision 254941) ++++ sys/net/if.c (working copy) +@@ -2553,11 +2553,23 @@ + CURVNET_RESTORE(); + return (EOPNOTSUPP); + } ++ ++ /* ++ * Pass the request on to the socket control method, and if the ++ * latter returns EOPNOTSUPP, directly to the interface. ++ * ++ * Make an exception for the legacy SIOCSIF* requests. Drivers ++ * trust SIOCSIFADDR et al to come from an already privileged ++ * layer, and do not perform any credentials checks or input ++ * validation. ++ */ + #ifndef COMPAT_43 + error = ((*so->so_proto->pr_usrreqs->pru_control)(so, cmd, + data, + ifp, td)); +- if (error == EOPNOTSUPP && ifp != NULL && ifp->if_ioctl != NULL) ++ if (error == EOPNOTSUPP && ifp != NULL && ifp->if_ioctl != NULL && ++ cmd != SIOCSIFADDR && cmd != SIOCSIFBRDADDR && ++ cmd != SIOCSIFDSTADDR && cmd != SIOCSIFNETMASK) + error = (*ifp->if_ioctl)(ifp, cmd, data); + #else + { +@@ -2601,7 +2613,9 @@ + data, + ifp, td)); + if (error == EOPNOTSUPP && ifp != NULL && +- ifp->if_ioctl != NULL) ++ ifp->if_ioctl != NULL && ++ cmd != SIOCSIFADDR && cmd != SIOCSIFBRDADDR && ++ cmd != SIOCSIFDSTADDR && cmd != SIOCSIFNETMASK) + error = (*ifp->if_ioctl)(ifp, cmd, data); + switch (ocmd) { + +Index: sys/netinet6/in6.c +=================================================================== +--- sys/netinet6/in6.c (revision 254941) ++++ sys/netinet6/in6.c (working copy) +@@ -431,6 +431,18 @@ + case SIOCGIFSTAT_ICMP6: + sa6 = &ifr->ifr_addr; + break; ++ case SIOCSIFADDR: ++ case SIOCSIFBRDADDR: ++ case SIOCSIFDSTADDR: ++ case SIOCSIFNETMASK: ++ /* ++ * Although we should pass any non-INET6 ioctl requests ++ * down to driver, we filter some legacy INET requests. ++ * Drivers trust SIOCSIFADDR et al to come from an already ++ * privileged layer, and do not perform any credentials ++ * checks or input validation. ++ */ ++ return (EINVAL); + default: + sa6 = NULL; + break; +Index: sys/netnatm/natm.c +=================================================================== +--- sys/netnatm/natm.c (revision 254941) ++++ sys/netnatm/natm.c (working copy) +@@ -339,6 +339,21 @@ + npcb = (struct natmpcb *)so->so_pcb; + KASSERT(npcb != NULL, ("natm_usr_control: npcb == NULL")); + ++ switch (cmd) { ++ case SIOCSIFADDR: ++ case SIOCSIFBRDADDR: ++ case SIOCSIFDSTADDR: ++ case SIOCSIFNETMASK: ++ /* ++ * Although we should pass any non-ATM ioctl requests ++ * down to driver, we filter some legacy INET requests. ++ * Drivers trust SIOCSIFADDR et al to come from an already ++ * privileged layer, and do not perform any credentials ++ * checks or input validation. ++ */ ++ return (EINVAL); ++ } ++ + if (ifp == NULL || ifp->if_ioctl == NULL) + return (EOPNOTSUPP); + return ((*ifp->if_ioctl)(ifp, cmd, arg)); Index: user/cperciva/freebsd-update-build/patches/9.2-RC1/2-SA-13:13.nullfs =================================================================== --- user/cperciva/freebsd-update-build/patches/9.2-RC1/2-SA-13:13.nullfs (nonexistent) +++ user/cperciva/freebsd-update-build/patches/9.2-RC1/2-SA-13:13.nullfs (revision 293366) @@ -0,0 +1,28 @@ +Index: sys/fs/nullfs/null_vnops.c +=================================================================== +--- sys/fs/nullfs/null_vnops.c (revision 254941) ++++ sys/fs/nullfs/null_vnops.c (working copy) +@@ -858,6 +858,15 @@ + return (error); + } + ++static int ++null_link(struct vop_link_args *ap) ++{ ++ ++ if (ap->a_tdvp->v_mount != ap->a_vp->v_mount) ++ return (EXDEV); ++ return (null_bypass((struct vop_generic_args *)ap)); ++} ++ + /* + * Global vfs data structures + */ +@@ -871,6 +880,7 @@ + .vop_getwritemount = null_getwritemount, + .vop_inactive = null_inactive, + .vop_islocked = vop_stdislocked, ++ .vop_link = null_link, + .vop_lock1 = null_lock, + .vop_lookup = null_lookup, + .vop_open = null_open, Index: user/cperciva/freebsd-update-build/patches/9.2-RC2/1-SA-13:09.ip_multicast =================================================================== --- user/cperciva/freebsd-update-build/patches/9.2-RC2/1-SA-13:09.ip_multicast (nonexistent) +++ user/cperciva/freebsd-update-build/patches/9.2-RC2/1-SA-13:09.ip_multicast (revision 293366) @@ -0,0 +1,26 @@ +Index: sys/netinet/in_mcast.c +=================================================================== +--- sys/netinet/in_mcast.c (revision 254252) ++++ sys/netinet/in_mcast.c (working copy) +@@ -1648,6 +1648,8 @@ + * has asked for, but we always tell userland how big the + * buffer really needs to be. + */ ++ if (msfr.msfr_nsrcs > in_mcast_maxsocksrc) ++ msfr.msfr_nsrcs = in_mcast_maxsocksrc; + tss = NULL; + if (msfr.msfr_srcs != NULL && msfr.msfr_nsrcs > 0) { + tss = malloc(sizeof(struct sockaddr_storage) * msfr.msfr_nsrcs, +Index: sys/netinet6/in6_mcast.c +=================================================================== +--- sys/netinet6/in6_mcast.c (revision 254252) ++++ sys/netinet6/in6_mcast.c (working copy) +@@ -1625,6 +1625,8 @@ + * has asked for, but we always tell userland how big the + * buffer really needs to be. + */ ++ if (msfr.msfr_nsrcs > in6_mcast_maxsocksrc) ++ msfr.msfr_nsrcs = in6_mcast_maxsocksrc; + tss = NULL; + if (msfr.msfr_srcs != NULL && msfr.msfr_nsrcs > 0) { + tss = malloc(sizeof(struct sockaddr_storage) * msfr.msfr_nsrcs, Index: user/cperciva/freebsd-update-build/patches/9.2-RC2/2-SA-13:11.sendfile =================================================================== --- user/cperciva/freebsd-update-build/patches/9.2-RC2/2-SA-13:11.sendfile (nonexistent) +++ user/cperciva/freebsd-update-build/patches/9.2-RC2/2-SA-13:11.sendfile (revision 293366) @@ -0,0 +1,20 @@ +Index: sys/kern/uipc_syscalls.c +=================================================================== +--- sys/kern/uipc_syscalls.c (revision 253912) ++++ sys/kern/uipc_syscalls.c (working copy) +@@ -2087,11 +2087,10 @@ + * or the passed in nbytes. + */ + pgoff = (vm_offset_t)(off & PAGE_MASK); +- if (uap->nbytes) +- rem = (uap->nbytes - fsbytes - loopbytes); +- else +- rem = va.va_size - +- uap->offset - fsbytes - loopbytes; ++ rem = obj->un_pager.vnp.vnp_size - uap->offset; ++ if (uap->nbytes != 0) ++ rem = omin(rem, uap->nbytes); ++ rem -= fsbytes + loopbytes; + xfsize = omin(PAGE_SIZE - pgoff, rem); + xfsize = omin(space - loopbytes, xfsize); + if (xfsize <= 0) { Index: user/cperciva/freebsd-update-build/patches/9.2-RC2/2-SA-13:12.ifioctl =================================================================== --- user/cperciva/freebsd-update-build/patches/9.2-RC2/2-SA-13:12.ifioctl (nonexistent) +++ user/cperciva/freebsd-update-build/patches/9.2-RC2/2-SA-13:12.ifioctl (revision 293366) @@ -0,0 +1,89 @@ +Index: sys/net/if.c +=================================================================== +--- sys/net/if.c (revision 254941) ++++ sys/net/if.c (working copy) +@@ -2553,11 +2553,23 @@ + CURVNET_RESTORE(); + return (EOPNOTSUPP); + } ++ ++ /* ++ * Pass the request on to the socket control method, and if the ++ * latter returns EOPNOTSUPP, directly to the interface. ++ * ++ * Make an exception for the legacy SIOCSIF* requests. Drivers ++ * trust SIOCSIFADDR et al to come from an already privileged ++ * layer, and do not perform any credentials checks or input ++ * validation. ++ */ + #ifndef COMPAT_43 + error = ((*so->so_proto->pr_usrreqs->pru_control)(so, cmd, + data, + ifp, td)); +- if (error == EOPNOTSUPP && ifp != NULL && ifp->if_ioctl != NULL) ++ if (error == EOPNOTSUPP && ifp != NULL && ifp->if_ioctl != NULL && ++ cmd != SIOCSIFADDR && cmd != SIOCSIFBRDADDR && ++ cmd != SIOCSIFDSTADDR && cmd != SIOCSIFNETMASK) + error = (*ifp->if_ioctl)(ifp, cmd, data); + #else + { +@@ -2601,7 +2613,9 @@ + data, + ifp, td)); + if (error == EOPNOTSUPP && ifp != NULL && +- ifp->if_ioctl != NULL) ++ ifp->if_ioctl != NULL && ++ cmd != SIOCSIFADDR && cmd != SIOCSIFBRDADDR && ++ cmd != SIOCSIFDSTADDR && cmd != SIOCSIFNETMASK) + error = (*ifp->if_ioctl)(ifp, cmd, data); + switch (ocmd) { + +Index: sys/netinet6/in6.c +=================================================================== +--- sys/netinet6/in6.c (revision 254941) ++++ sys/netinet6/in6.c (working copy) +@@ -431,6 +431,18 @@ + case SIOCGIFSTAT_ICMP6: + sa6 = &ifr->ifr_addr; + break; ++ case SIOCSIFADDR: ++ case SIOCSIFBRDADDR: ++ case SIOCSIFDSTADDR: ++ case SIOCSIFNETMASK: ++ /* ++ * Although we should pass any non-INET6 ioctl requests ++ * down to driver, we filter some legacy INET requests. ++ * Drivers trust SIOCSIFADDR et al to come from an already ++ * privileged layer, and do not perform any credentials ++ * checks or input validation. ++ */ ++ return (EINVAL); + default: + sa6 = NULL; + break; +Index: sys/netnatm/natm.c +=================================================================== +--- sys/netnatm/natm.c (revision 254941) ++++ sys/netnatm/natm.c (working copy) +@@ -339,6 +339,21 @@ + npcb = (struct natmpcb *)so->so_pcb; + KASSERT(npcb != NULL, ("natm_usr_control: npcb == NULL")); + ++ switch (cmd) { ++ case SIOCSIFADDR: ++ case SIOCSIFBRDADDR: ++ case SIOCSIFDSTADDR: ++ case SIOCSIFNETMASK: ++ /* ++ * Although we should pass any non-ATM ioctl requests ++ * down to driver, we filter some legacy INET requests. ++ * Drivers trust SIOCSIFADDR et al to come from an already ++ * privileged layer, and do not perform any credentials ++ * checks or input validation. ++ */ ++ return (EINVAL); ++ } ++ + if (ifp == NULL || ifp->if_ioctl == NULL) + return (EOPNOTSUPP); + return ((*ifp->if_ioctl)(ifp, cmd, arg)); Index: user/cperciva/freebsd-update-build/patches/9.2-RC2/2-SA-13:13.nullfs =================================================================== --- user/cperciva/freebsd-update-build/patches/9.2-RC2/2-SA-13:13.nullfs (nonexistent) +++ user/cperciva/freebsd-update-build/patches/9.2-RC2/2-SA-13:13.nullfs (revision 293366) @@ -0,0 +1,28 @@ +Index: sys/fs/nullfs/null_vnops.c +=================================================================== +--- sys/fs/nullfs/null_vnops.c (revision 254941) ++++ sys/fs/nullfs/null_vnops.c (working copy) +@@ -858,6 +858,15 @@ + return (error); + } + ++static int ++null_link(struct vop_link_args *ap) ++{ ++ ++ if (ap->a_tdvp->v_mount != ap->a_vp->v_mount) ++ return (EXDEV); ++ return (null_bypass((struct vop_generic_args *)ap)); ++} ++ + /* + * Global vfs data structures + */ +@@ -871,6 +880,7 @@ + .vop_getwritemount = null_getwritemount, + .vop_inactive = null_inactive, + .vop_islocked = vop_stdislocked, ++ .vop_link = null_link, + .vop_lock1 = null_lock, + .vop_lookup = null_lookup, + .vop_open = null_open, Index: user/cperciva/freebsd-update-build/patches/9.2-RC3/1-SA-13:12.ifioctl =================================================================== --- user/cperciva/freebsd-update-build/patches/9.2-RC3/1-SA-13:12.ifioctl (nonexistent) +++ user/cperciva/freebsd-update-build/patches/9.2-RC3/1-SA-13:12.ifioctl (revision 293366) @@ -0,0 +1,89 @@ +Index: sys/net/if.c +=================================================================== +--- sys/net/if.c (revision 254941) ++++ sys/net/if.c (working copy) +@@ -2553,11 +2553,23 @@ + CURVNET_RESTORE(); + return (EOPNOTSUPP); + } ++ ++ /* ++ * Pass the request on to the socket control method, and if the ++ * latter returns EOPNOTSUPP, directly to the interface. ++ * ++ * Make an exception for the legacy SIOCSIF* requests. Drivers ++ * trust SIOCSIFADDR et al to come from an already privileged ++ * layer, and do not perform any credentials checks or input ++ * validation. ++ */ + #ifndef COMPAT_43 + error = ((*so->so_proto->pr_usrreqs->pru_control)(so, cmd, + data, + ifp, td)); +- if (error == EOPNOTSUPP && ifp != NULL && ifp->if_ioctl != NULL) ++ if (error == EOPNOTSUPP && ifp != NULL && ifp->if_ioctl != NULL && ++ cmd != SIOCSIFADDR && cmd != SIOCSIFBRDADDR && ++ cmd != SIOCSIFDSTADDR && cmd != SIOCSIFNETMASK) + error = (*ifp->if_ioctl)(ifp, cmd, data); + #else + { +@@ -2601,7 +2613,9 @@ + data, + ifp, td)); + if (error == EOPNOTSUPP && ifp != NULL && +- ifp->if_ioctl != NULL) ++ ifp->if_ioctl != NULL && ++ cmd != SIOCSIFADDR && cmd != SIOCSIFBRDADDR && ++ cmd != SIOCSIFDSTADDR && cmd != SIOCSIFNETMASK) + error = (*ifp->if_ioctl)(ifp, cmd, data); + switch (ocmd) { + +Index: sys/netinet6/in6.c +=================================================================== +--- sys/netinet6/in6.c (revision 254941) ++++ sys/netinet6/in6.c (working copy) +@@ -431,6 +431,18 @@ + case SIOCGIFSTAT_ICMP6: + sa6 = &ifr->ifr_addr; + break; ++ case SIOCSIFADDR: ++ case SIOCSIFBRDADDR: ++ case SIOCSIFDSTADDR: ++ case SIOCSIFNETMASK: ++ /* ++ * Although we should pass any non-INET6 ioctl requests ++ * down to driver, we filter some legacy INET requests. ++ * Drivers trust SIOCSIFADDR et al to come from an already ++ * privileged layer, and do not perform any credentials ++ * checks or input validation. ++ */ ++ return (EINVAL); + default: + sa6 = NULL; + break; +Index: sys/netnatm/natm.c +=================================================================== +--- sys/netnatm/natm.c (revision 254941) ++++ sys/netnatm/natm.c (working copy) +@@ -339,6 +339,21 @@ + npcb = (struct natmpcb *)so->so_pcb; + KASSERT(npcb != NULL, ("natm_usr_control: npcb == NULL")); + ++ switch (cmd) { ++ case SIOCSIFADDR: ++ case SIOCSIFBRDADDR: ++ case SIOCSIFDSTADDR: ++ case SIOCSIFNETMASK: ++ /* ++ * Although we should pass any non-ATM ioctl requests ++ * down to driver, we filter some legacy INET requests. ++ * Drivers trust SIOCSIFADDR et al to come from an already ++ * privileged layer, and do not perform any credentials ++ * checks or input validation. ++ */ ++ return (EINVAL); ++ } ++ + if (ifp == NULL || ifp->if_ioctl == NULL) + return (EOPNOTSUPP); + return ((*ifp->if_ioctl)(ifp, cmd, arg)); Index: user/cperciva/freebsd-update-build/patches/9.2-RC3/1-SA-13:13.nullfs =================================================================== --- user/cperciva/freebsd-update-build/patches/9.2-RC3/1-SA-13:13.nullfs (nonexistent) +++ user/cperciva/freebsd-update-build/patches/9.2-RC3/1-SA-13:13.nullfs (revision 293366) @@ -0,0 +1,28 @@ +Index: sys/fs/nullfs/null_vnops.c +=================================================================== +--- sys/fs/nullfs/null_vnops.c (revision 254941) ++++ sys/fs/nullfs/null_vnops.c (working copy) +@@ -858,6 +858,15 @@ + return (error); + } + ++static int ++null_link(struct vop_link_args *ap) ++{ ++ ++ if (ap->a_tdvp->v_mount != ap->a_vp->v_mount) ++ return (EXDEV); ++ return (null_bypass((struct vop_generic_args *)ap)); ++} ++ + /* + * Global vfs data structures + */ +@@ -871,6 +880,7 @@ + .vop_getwritemount = null_getwritemount, + .vop_inactive = null_inactive, + .vop_islocked = vop_stdislocked, ++ .vop_link = null_link, + .vop_lock1 = null_lock, + .vop_lookup = null_lookup, + .vop_open = null_open, Index: user/cperciva/freebsd-update-build/patches/9.2-RC3/2-EN-13:04.freebsd-update =================================================================== --- user/cperciva/freebsd-update-build/patches/9.2-RC3/2-EN-13:04.freebsd-update (nonexistent) +++ user/cperciva/freebsd-update-build/patches/9.2-RC3/2-EN-13:04.freebsd-update (revision 293366) @@ -0,0 +1,78 @@ +Index: usr.sbin/freebsd-update/freebsd-update.sh +=================================================================== +--- usr.sbin/freebsd-update/freebsd-update.sh ++++ usr.sbin/freebsd-update/freebsd-update.sh +@@ -1200,7 +1200,7 @@ + # Some aliases to save space later: ${P} is a character which can + # appear in a path; ${M} is the four numeric metadata fields; and + # ${H} is a sha256 hash. +- P="[-+./:=%@_[[:alnum:]]" ++ P="[-+./:=%@_[~[:alnum:]]" + M="[0-9]+\|[0-9]+\|[0-9]+\|[0-9]+" + H="[0-9a-f]{64}" + +@@ -2814,16 +2814,24 @@ + + # If we haven't already dealt with the world, deal with it. + if ! [ -f $1/worlddone ]; then ++ # Create any necessary directories first ++ grep -vE '^/boot/' $1/INDEX-NEW | ++ grep -E '^[^|]+\|d\|' > INDEX-NEW ++ install_from_index INDEX-NEW || return 1 ++ + # Install new shared libraries next + grep -vE '^/boot/' $1/INDEX-NEW | +- grep -E '/lib/.*\.so\.[0-9]+\|' > INDEX-NEW ++ grep -vE '^[^|]+\|d\|' | ++ grep -E '^[^|]*/lib/[^|]*\.so\.[0-9]+\|' > INDEX-NEW + install_from_index INDEX-NEW || return 1 + + # Deal with everything else + grep -vE '^/boot/' $1/INDEX-OLD | +- grep -vE '/lib/.*\.so\.[0-9]+\|' > INDEX-OLD ++ grep -vE '^[^|]+\|d\|' | ++ grep -vE '^[^|]*/lib/[^|]*\.so\.[0-9]+\|' > INDEX-OLD + grep -vE '^/boot/' $1/INDEX-NEW | +- grep -vE '/lib/.*\.so\.[0-9]+\|' > INDEX-NEW ++ grep -vE '^[^|]+\|d\|' | ++ grep -vE '^[^|]*/lib/[^|]*\.so\.[0-9]+\|' > INDEX-NEW + install_from_index INDEX-NEW || return 1 + install_delete INDEX-OLD INDEX-NEW || return 1 + +@@ -2844,11 +2852,11 @@ + + # Do we need to ask the user to portupgrade now? + grep -vE '^/boot/' $1/INDEX-NEW | +- grep -E '/lib/.*\.so\.[0-9]+\|' | ++ grep -E '^[^|]*/lib/[^|]*\.so\.[0-9]+\|' | + cut -f 1 -d '|' | + sort > newfiles + if grep -vE '^/boot/' $1/INDEX-OLD | +- grep -E '/lib/.*\.so\.[0-9]+\|' | ++ grep -E '^[^|]*/lib/[^|]*\.so\.[0-9]+\|' | + cut -f 1 -d '|' | + sort | + join -v 1 - newfiles | +@@ -2868,11 +2876,20 @@ + + # Remove old shared libraries + grep -vE '^/boot/' $1/INDEX-NEW | +- grep -E '/lib/.*\.so\.[0-9]+\|' > INDEX-NEW ++ grep -vE '^[^|]+\|d\|' | ++ grep -E '^[^|]*/lib/[^|]*\.so\.[0-9]+\|' > INDEX-NEW + grep -vE '^/boot/' $1/INDEX-OLD | +- grep -E '/lib/.*\.so\.[0-9]+\|' > INDEX-OLD ++ grep -vE '^[^|]+\|d\|' | ++ grep -E '^[^|]*/lib/[^|]*\.so\.[0-9]+\|' > INDEX-OLD + install_delete INDEX-OLD INDEX-NEW || return 1 + ++ # Remove old directories ++ grep -vE '^/boot/' $1/INDEX-OLD | ++ grep -E '^[^|]+\|d\|' > INDEX-OLD ++ grep -vE '^/boot/' $1/INDEX-OLD | ++ grep -E '^[^|]+\|d\|' > INDEX-OLD ++ install_delete INDEX-OLD INDEX-NEW || return 1 ++ + # Remove temporary files + rm INDEX-OLD INDEX-NEW + } Index: user/cperciva/freebsd-update-build/patches/9.2-RC3/3-EN-13:05.freebsd-update =================================================================== --- user/cperciva/freebsd-update-build/patches/9.2-RC3/3-EN-13:05.freebsd-update (nonexistent) +++ user/cperciva/freebsd-update-build/patches/9.2-RC3/3-EN-13:05.freebsd-update (revision 293366) @@ -0,0 +1,17 @@ +Index: usr.sbin/freebsd-update/freebsd-update.sh +=================================================================== +--- usr.sbin/freebsd-update/freebsd-update.sh (revision 257878) ++++ usr.sbin/freebsd-update/freebsd-update.sh (revision 257879) +@@ -2884,10 +2884,10 @@ + install_delete INDEX-OLD INDEX-NEW || return 1 + + # Remove old directories ++ grep -vE '^/boot/' $1/INDEX-NEW | ++ grep -E '^[^|]+\|d\|' > INDEX-NEW + grep -vE '^/boot/' $1/INDEX-OLD | + grep -E '^[^|]+\|d\|' > INDEX-OLD +- grep -vE '^/boot/' $1/INDEX-OLD | +- grep -E '^[^|]+\|d\|' > INDEX-OLD + install_delete INDEX-OLD INDEX-NEW || return 1 + + # Remove temporary files Index: user/cperciva/freebsd-update-build/patches/9.2-RC4/0-mergemaster.patch =================================================================== --- user/cperciva/freebsd-update-build/patches/9.2-RC4/0-mergemaster.patch (nonexistent) +++ user/cperciva/freebsd-update-build/patches/9.2-RC4/0-mergemaster.patch (revision 293366) @@ -0,0 +1,26 @@ +Index: usr.sbin/mergemaster/mergemaster.sh +=================================================================== +--- usr.sbin/mergemaster/mergemaster.sh (revision 255476) ++++ usr.sbin/mergemaster/mergemaster.sh (working copy) +@@ -707,7 +707,7 @@ case "${RERUN}" in + # Build the mtree database in a temporary location. + case "${PRE_WORLD}" in + '') MTREENEW=`mktemp -t mergemaster.mtree` +- mtree -ci -p ${TEMPROOT} -k size,md5digest > ${MTREENEW} 2>/dev/null ++ mtree -nci -p ${TEMPROOT} -k size,md5digest > ${MTREENEW} 2>/dev/null + ;; + *) # We don't want to mess with the mtree database on a pre-world run or + # when re-scanning a previously-built tree. +Index: usr.sbin/mtree/create.c +=================================================================== +--- usr.sbin/mtree/create.c (revision 255476) ++++ usr.sbin/mtree/create.c (working copy) +@@ -208,7 +208,7 @@ statf(int indent, FTSENT *p) + output(indent, &offset, "mode=%#o", p->fts_statp->st_mode & MBITS); + if (keys & F_NLINK && p->fts_statp->st_nlink != 1) + output(indent, &offset, "nlink=%u", p->fts_statp->st_nlink); +- if (keys & F_SIZE) ++ if (keys & F_SIZE && S_ISREG(p->fts_statp->st_mode)) + output(indent, &offset, "size=%jd", + (intmax_t)p->fts_statp->st_size); + if (keys & F_TIME) Index: user/cperciva/freebsd-update-build/patches/9.2-RC4/1-EN-13:04.freebsd-update =================================================================== --- user/cperciva/freebsd-update-build/patches/9.2-RC4/1-EN-13:04.freebsd-update (nonexistent) +++ user/cperciva/freebsd-update-build/patches/9.2-RC4/1-EN-13:04.freebsd-update (revision 293366) @@ -0,0 +1,78 @@ +Index: usr.sbin/freebsd-update/freebsd-update.sh +=================================================================== +--- usr.sbin/freebsd-update/freebsd-update.sh ++++ usr.sbin/freebsd-update/freebsd-update.sh +@@ -1200,7 +1200,7 @@ + # Some aliases to save space later: ${P} is a character which can + # appear in a path; ${M} is the four numeric metadata fields; and + # ${H} is a sha256 hash. +- P="[-+./:=%@_[[:alnum:]]" ++ P="[-+./:=%@_[~[:alnum:]]" + M="[0-9]+\|[0-9]+\|[0-9]+\|[0-9]+" + H="[0-9a-f]{64}" + +@@ -2814,16 +2814,24 @@ + + # If we haven't already dealt with the world, deal with it. + if ! [ -f $1/worlddone ]; then ++ # Create any necessary directories first ++ grep -vE '^/boot/' $1/INDEX-NEW | ++ grep -E '^[^|]+\|d\|' > INDEX-NEW ++ install_from_index INDEX-NEW || return 1 ++ + # Install new shared libraries next + grep -vE '^/boot/' $1/INDEX-NEW | +- grep -E '/lib/.*\.so\.[0-9]+\|' > INDEX-NEW ++ grep -vE '^[^|]+\|d\|' | ++ grep -E '^[^|]*/lib/[^|]*\.so\.[0-9]+\|' > INDEX-NEW + install_from_index INDEX-NEW || return 1 + + # Deal with everything else + grep -vE '^/boot/' $1/INDEX-OLD | +- grep -vE '/lib/.*\.so\.[0-9]+\|' > INDEX-OLD ++ grep -vE '^[^|]+\|d\|' | ++ grep -vE '^[^|]*/lib/[^|]*\.so\.[0-9]+\|' > INDEX-OLD + grep -vE '^/boot/' $1/INDEX-NEW | +- grep -vE '/lib/.*\.so\.[0-9]+\|' > INDEX-NEW ++ grep -vE '^[^|]+\|d\|' | ++ grep -vE '^[^|]*/lib/[^|]*\.so\.[0-9]+\|' > INDEX-NEW + install_from_index INDEX-NEW || return 1 + install_delete INDEX-OLD INDEX-NEW || return 1 + +@@ -2844,11 +2852,11 @@ + + # Do we need to ask the user to portupgrade now? + grep -vE '^/boot/' $1/INDEX-NEW | +- grep -E '/lib/.*\.so\.[0-9]+\|' | ++ grep -E '^[^|]*/lib/[^|]*\.so\.[0-9]+\|' | + cut -f 1 -d '|' | + sort > newfiles + if grep -vE '^/boot/' $1/INDEX-OLD | +- grep -E '/lib/.*\.so\.[0-9]+\|' | ++ grep -E '^[^|]*/lib/[^|]*\.so\.[0-9]+\|' | + cut -f 1 -d '|' | + sort | + join -v 1 - newfiles | +@@ -2868,11 +2876,20 @@ + + # Remove old shared libraries + grep -vE '^/boot/' $1/INDEX-NEW | +- grep -E '/lib/.*\.so\.[0-9]+\|' > INDEX-NEW ++ grep -vE '^[^|]+\|d\|' | ++ grep -E '^[^|]*/lib/[^|]*\.so\.[0-9]+\|' > INDEX-NEW + grep -vE '^/boot/' $1/INDEX-OLD | +- grep -E '/lib/.*\.so\.[0-9]+\|' > INDEX-OLD ++ grep -vE '^[^|]+\|d\|' | ++ grep -E '^[^|]*/lib/[^|]*\.so\.[0-9]+\|' > INDEX-OLD + install_delete INDEX-OLD INDEX-NEW || return 1 + ++ # Remove old directories ++ grep -vE '^/boot/' $1/INDEX-OLD | ++ grep -E '^[^|]+\|d\|' > INDEX-OLD ++ grep -vE '^/boot/' $1/INDEX-OLD | ++ grep -E '^[^|]+\|d\|' > INDEX-OLD ++ install_delete INDEX-OLD INDEX-NEW || return 1 ++ + # Remove temporary files + rm INDEX-OLD INDEX-NEW + } Index: user/cperciva/freebsd-update-build/patches/9.2-RC4/2-EN-13:05.freebsd-update =================================================================== --- user/cperciva/freebsd-update-build/patches/9.2-RC4/2-EN-13:05.freebsd-update (nonexistent) +++ user/cperciva/freebsd-update-build/patches/9.2-RC4/2-EN-13:05.freebsd-update (revision 293366) @@ -0,0 +1,17 @@ +Index: usr.sbin/freebsd-update/freebsd-update.sh +=================================================================== +--- usr.sbin/freebsd-update/freebsd-update.sh (revision 257878) ++++ usr.sbin/freebsd-update/freebsd-update.sh (revision 257879) +@@ -2884,10 +2884,10 @@ + install_delete INDEX-OLD INDEX-NEW || return 1 + + # Remove old directories ++ grep -vE '^/boot/' $1/INDEX-NEW | ++ grep -E '^[^|]+\|d\|' > INDEX-NEW + grep -vE '^/boot/' $1/INDEX-OLD | + grep -E '^[^|]+\|d\|' > INDEX-OLD +- grep -vE '^/boot/' $1/INDEX-OLD | +- grep -E '^[^|]+\|d\|' > INDEX-OLD + install_delete INDEX-OLD INDEX-NEW || return 1 + + # Remove temporary files Index: user/cperciva/freebsd-update-build/patches/9.3-BETA1/1-SA-14:12.ktrace =================================================================== --- user/cperciva/freebsd-update-build/patches/9.3-BETA1/1-SA-14:12.ktrace (nonexistent) +++ user/cperciva/freebsd-update-build/patches/9.3-BETA1/1-SA-14:12.ktrace (revision 293366) @@ -0,0 +1,12 @@ +Index: sys/kern/kern_ktrace.c +=================================================================== +--- sys/kern/kern_ktrace.c (revision 266771) ++++ sys/kern/kern_ktrace.c (working copy) +@@ -119,6 +119,7 @@ static int data_lengths[] = { + 0, /* KTR_SYSCTL */ + sizeof(struct ktr_proc_ctor), /* KTR_PROCCTOR */ + 0, /* KTR_PROCDTOR */ ++ 0, /* unused */ + sizeof(struct ktr_fault), /* KTR_FAULT */ + sizeof(struct ktr_faultend), /* KTR_FAULTEND */ + }; Index: user/cperciva/freebsd-update-build/patches/9.3-BETA1/1-SA-14:13.pam =================================================================== --- user/cperciva/freebsd-update-build/patches/9.3-BETA1/1-SA-14:13.pam (nonexistent) +++ user/cperciva/freebsd-update-build/patches/9.3-BETA1/1-SA-14:13.pam (revision 293366) @@ -0,0 +1,126 @@ +Index: contrib/openpam/lib/libpam/openpam_configure.c +=================================================================== +--- contrib/openpam/lib/libpam/openpam_configure.c.orig ++++ contrib/openpam/lib/libpam/openpam_configure.c +@@ -1,6 +1,6 @@ + /*- + * Copyright (c) 2001-2003 Networks Associates Technology, Inc. +- * Copyright (c) 2004-2012 Dag-Erling Smørgrav ++ * Copyright (c) 2004-2014 Dag-Erling Smørgrav + * All rights reserved. + * + * This software was developed for the FreeBSD Project by ThinkSec AS and +@@ -193,6 +193,7 @@ + openpam_log(PAM_LOG_ERROR, + "%s(%d): missing or invalid facility", + filename, lineno); ++ errno = EINVAL; + goto fail; + } + if (facility != fclt && facility != PAM_FACILITY_ANY) { +@@ -208,6 +209,7 @@ + openpam_log(PAM_LOG_ERROR, + "%s(%d): missing or invalid service name", + filename, lineno); ++ errno = EINVAL; + goto fail; + } + if (wordv[i] != NULL) { +@@ -214,12 +216,21 @@ + openpam_log(PAM_LOG_ERROR, + "%s(%d): garbage at end of line", + filename, lineno); ++ errno = EINVAL; + goto fail; + } + ret = openpam_load_chain(pamh, servicename, fclt); + FREEV(wordc, wordv); +- if (ret < 0) ++ if (ret < 0) { ++ /* ++ * Bogus errno, but this ensures that the ++ * outer loop does not just ignore the ++ * error and keep searching. ++ */ ++ if (errno == ENOENT) ++ errno = EINVAL; + goto fail; ++ } + continue; + } + +@@ -229,6 +240,7 @@ + openpam_log(PAM_LOG_ERROR, + "%s(%d): missing or invalid control flag", + filename, lineno); ++ errno = EINVAL; + goto fail; + } + +@@ -238,6 +250,7 @@ + openpam_log(PAM_LOG_ERROR, + "%s(%d): missing or invalid module name", + filename, lineno); ++ errno = EINVAL; + goto fail; + } + +@@ -247,8 +260,11 @@ + this->flag = ctlf; + + /* load module */ +- if ((this->module = openpam_load_module(modulename)) == NULL) ++ if ((this->module = openpam_load_module(modulename)) == NULL) { ++ if (errno == ENOENT) ++ errno = ENOEXEC; + goto fail; ++ } + + /* + * The remaining items in wordv are the module's +@@ -281,7 +297,11 @@ + * The loop ended because openpam_readword() returned NULL, which + * can happen for four different reasons: an I/O error (ferror(f) + * is true), a memory allocation failure (ferror(f) is false, +- * errno is non-zero) ++ * feof(f) is false, errno is non-zero), the file ended with an ++ * unterminated quote or backslash escape (ferror(f) is false, ++ * feof(f) is true, errno is non-zero), or the end of the file was ++ * reached without error (ferror(f) is false, feof(f) is true, ++ * errno is zero). + */ + if (ferror(f) || errno != 0) + goto syserr; +@@ -402,6 +422,9 @@ + } + ret = openpam_load_file(pamh, service, facility, + filename, style); ++ /* success */ ++ if (ret > 0) ++ RETURNN(ret); + /* the file exists, but an error occurred */ + if (ret == -1 && errno != ENOENT) + RETURNN(ret); +@@ -411,7 +434,8 @@ + } + + /* no hit */ +- RETURNN(0); ++ errno = ENOENT; ++ RETURNN(-1); + } + + /* +@@ -432,8 +456,10 @@ + openpam_log(PAM_LOG_ERROR, "invalid service name"); + RETURNC(PAM_SYSTEM_ERR); + } +- if (openpam_load_chain(pamh, service, PAM_FACILITY_ANY) < 0) +- goto load_err; ++ if (openpam_load_chain(pamh, service, PAM_FACILITY_ANY) < 0) { ++ if (errno != ENOENT) ++ goto load_err; ++ } + for (fclt = 0; fclt < PAM_NUM_FACILITIES; ++fclt) { + if (pamh->chains[fclt] != NULL) + continue; Index: user/cperciva/freebsd-update-build/patches/9.3-BETA1/2-SA-14:14.openssl =================================================================== --- user/cperciva/freebsd-update-build/patches/9.3-BETA1/2-SA-14:14.openssl (nonexistent) +++ user/cperciva/freebsd-update-build/patches/9.3-BETA1/2-SA-14:14.openssl (revision 293366) @@ -0,0 +1,135 @@ +Index: crypto/openssl/ssl/d1_both.c +=================================================================== +--- crypto/openssl/ssl/d1_both.c (revision 267031) ++++ crypto/openssl/ssl/d1_both.c (working copy) +@@ -620,8 +620,17 @@ dtls1_reassemble_fragment(SSL *s, struct hm_header + frag->msg_header.frag_off = 0; + } + else ++ { + frag = (hm_fragment*) item->data; ++ if (frag->msg_header.msg_len != msg_hdr->msg_len) ++ { ++ item = NULL; ++ frag = NULL; ++ goto err; ++ } ++ } + ++ + /* If message is already reassembled, this must be a + * retransmit and can be dropped. + */ +@@ -777,6 +786,7 @@ dtls1_get_message_fragment(SSL *s, int st1, int st + int i,al; + struct hm_header_st msg_hdr; + ++ redo: + /* see if we have the required fragment already */ + if ((frag_len = dtls1_retrieve_buffered_fragment(s,max,ok)) || *ok) + { +@@ -835,8 +845,7 @@ dtls1_get_message_fragment(SSL *s, int st1, int st + s->msg_callback_arg); + + s->init_num = 0; +- return dtls1_get_message_fragment(s, st1, stn, +- max, ok); ++ goto redo; + } + else /* Incorrectly formated Hello request */ + { +Index: crypto/openssl/ssl/s3_clnt.c +=================================================================== +--- crypto/openssl/ssl/s3_clnt.c (revision 267031) ++++ crypto/openssl/ssl/s3_clnt.c (working copy) +@@ -491,6 +491,7 @@ int ssl3_connect(SSL *s) + case SSL3_ST_CR_FINISHED_A: + case SSL3_ST_CR_FINISHED_B: + ++ s->s3->flags |= SSL3_FLAGS_CCS_OK; + ret=ssl3_get_finished(s,SSL3_ST_CR_FINISHED_A, + SSL3_ST_CR_FINISHED_B); + if (ret <= 0) goto end; +@@ -777,6 +778,7 @@ int ssl3_get_server_hello(SSL *s) + SSLerr(SSL_F_SSL3_GET_SERVER_HELLO,SSL_R_ATTEMPT_TO_REUSE_SESSION_IN_DIFFERENT_CONTEXT); + goto f_err; + } ++ s->s3->flags |= SSL3_FLAGS_CCS_OK; + s->hit=1; + } + else /* a miss or crap from the other end */ +@@ -2170,6 +2172,13 @@ int ssl3_send_client_key_exchange(SSL *s) + int ecdh_clnt_cert = 0; + int field_size = 0; + ++ if (s->session->sess_cert == NULL) ++ { ++ ssl3_send_alert(s,SSL3_AL_FATAL,SSL_AD_UNEXPECTED_MESSAGE); ++ SSLerr(SSL_F_SSL3_SEND_CLIENT_KEY_EXCHANGE,SSL_R_UNEXPECTED_MESSAGE); ++ goto err; ++ } ++ + /* Did we send out the client's + * ECDH share for use in premaster + * computation as part of client certificate? +Index: crypto/openssl/ssl/s3_pkt.c +=================================================================== +--- crypto/openssl/ssl/s3_pkt.c (revision 267031) ++++ crypto/openssl/ssl/s3_pkt.c (working copy) +@@ -1147,6 +1147,15 @@ start: + goto f_err; + } + ++ if (!(s->s3->flags & SSL3_FLAGS_CCS_OK)) ++ { ++ al=SSL_AD_UNEXPECTED_MESSAGE; ++ SSLerr(SSL_F_SSL3_READ_BYTES,SSL_R_CCS_RECEIVED_EARLY); ++ goto f_err; ++ } ++ ++ s->s3->flags &= ~SSL3_FLAGS_CCS_OK; ++ + rr->length=0; + + if (s->msg_callback) +@@ -1278,7 +1287,7 @@ int ssl3_do_change_cipher_spec(SSL *s) + + if (s->s3->tmp.key_block == NULL) + { +- if (s->session == NULL) ++ if (s->session == NULL || s->session->master_key_length == 0) + { + /* might happen if dtls1_read_bytes() calls this */ + SSLerr(SSL_F_SSL3_DO_CHANGE_CIPHER_SPEC,SSL_R_CCS_RECEIVED_EARLY); +Index: crypto/openssl/ssl/s3_srvr.c +=================================================================== +--- crypto/openssl/ssl/s3_srvr.c (revision 267031) ++++ crypto/openssl/ssl/s3_srvr.c (working copy) +@@ -523,6 +523,7 @@ int ssl3_accept(SSL *s) + case SSL3_ST_SR_CERT_VRFY_A: + case SSL3_ST_SR_CERT_VRFY_B: + ++ s->s3->flags |= SSL3_FLAGS_CCS_OK; + /* we should decide if we expected this one */ + ret=ssl3_get_cert_verify(s); + if (ret <= 0) goto end; +@@ -533,6 +534,7 @@ int ssl3_accept(SSL *s) + + case SSL3_ST_SR_FINISHED_A: + case SSL3_ST_SR_FINISHED_B: ++ s->s3->flags |= SSL3_FLAGS_CCS_OK; + ret=ssl3_get_finished(s,SSL3_ST_SR_FINISHED_A, + SSL3_ST_SR_FINISHED_B); + if (ret <= 0) goto end; +Index: crypto/openssl/ssl/ssl3.h +=================================================================== +--- crypto/openssl/ssl/ssl3.h (revision 267031) ++++ crypto/openssl/ssl/ssl3.h (working copy) +@@ -344,6 +344,7 @@ typedef struct ssl3_buffer_st + * effected, but we can't prevent that. + */ + #define SSL3_FLAGS_SGC_RESTART_DONE 0x0040 ++#define SSL3_FLAGS_CCS_OK 0x0080 + + typedef struct ssl3_state_st + { Index: user/cperciva/freebsd-update-build/patches/9.3-BETA1/3-SA-14:16.file =================================================================== --- user/cperciva/freebsd-update-build/patches/9.3-BETA1/3-SA-14:16.file (nonexistent) +++ user/cperciva/freebsd-update-build/patches/9.3-BETA1/3-SA-14:16.file (revision 293366) @@ -0,0 +1,276 @@ +Index: contrib/file/Magdir/commands +=================================================================== +--- contrib/file/Magdir/commands (revision 267806) ++++ contrib/file/Magdir/commands (working copy) +@@ -49,7 +49,8 @@ + !:mime text/x-awk + 0 string/wt #!\ /usr/bin/awk awk script text executable + !:mime text/x-awk +-0 regex =^\\s*BEGIN\\s*[{] awk script text ++0 regex =^\\s{0,100}BEGIN\\s{0,100}[{] awk script text ++!:strength - 12 + + # AT&T Bell Labs' Plan 9 shell + 0 string/wt #!\ /bin/rc Plan 9 rc shell script text executable +Index: contrib/file/ascmagic.c +=================================================================== +--- contrib/file/ascmagic.c (revision 267806) ++++ contrib/file/ascmagic.c (working copy) +@@ -147,7 +147,7 @@ file_ascmagic_with_encoding(struct magic_set *ms, + == NULL) + goto done; + if ((rv = file_softmagic(ms, utf8_buf, +- (size_t)(utf8_end - utf8_buf), TEXTTEST, text)) == 0) ++ (size_t)(utf8_end - utf8_buf), 0, TEXTTEST, text)) == 0) + rv = -1; + } + +Index: contrib/file/file.h +=================================================================== +--- contrib/file/file.h (revision 267806) ++++ contrib/file/file.h (working copy) +@@ -414,7 +414,7 @@ protected int file_encoding(struct magic_set *, co + unichar **, size_t *, const char **, const char **, const char **); + protected int file_is_tar(struct magic_set *, const unsigned char *, size_t); + protected int file_softmagic(struct magic_set *, const unsigned char *, size_t, +- int, int); ++ size_t, int, int); + protected struct mlist *file_apprentice(struct magic_set *, const char *, int); + protected uint64_t file_signextend(struct magic_set *, struct magic *, + uint64_t); +Index: contrib/file/funcs.c +=================================================================== +--- contrib/file/funcs.c (revision 267806) ++++ contrib/file/funcs.c (working copy) +@@ -228,7 +228,7 @@ file_buffer(struct magic_set *ms, int fd, const ch + + /* try soft magic tests */ + if ((ms->flags & MAGIC_NO_CHECK_SOFT) == 0) +- if ((m = file_softmagic(ms, ubuf, nb, BINTEST, ++ if ((m = file_softmagic(ms, ubuf, nb, 0, BINTEST, + looks_text)) != 0) { + if ((ms->flags & MAGIC_DEBUG) != 0) + (void)fprintf(stderr, "softmagic %d\n", m); +Index: contrib/file/softmagic.c +=================================================================== +--- contrib/file/softmagic.c (revision 267806) ++++ contrib/file/softmagic.c (working copy) +@@ -43,9 +43,9 @@ FILE_RCSID("@(#)$File: softmagic.c,v 1.147 2011/11 + + + private int match(struct magic_set *, struct magic *, uint32_t, +- const unsigned char *, size_t, int, int); ++ const unsigned char *, size_t, int, int, int); + private int mget(struct magic_set *, const unsigned char *, +- struct magic *, size_t, unsigned int, int); ++ struct magic *, size_t, unsigned int, int, int); + private int magiccheck(struct magic_set *, struct magic *); + private int32_t mprint(struct magic_set *, struct magic *); + private int32_t moffset(struct magic_set *, struct magic *); +@@ -60,6 +60,7 @@ private void cvt_16(union VALUETYPE *, const struc + private void cvt_32(union VALUETYPE *, const struct magic *); + private void cvt_64(union VALUETYPE *, const struct magic *); + ++#define OFFSET_OOB(n, o, i) ((n) < (o) || (i) > ((n) - (o))) + /* + * softmagic - lookup one file in parsed, in-memory copy of database + * Passed the name and FILE * of one file to be typed. +@@ -67,13 +68,13 @@ private void cvt_64(union VALUETYPE *, const struc + /*ARGSUSED1*/ /* nbytes passed for regularity, maybe need later */ + protected int + file_softmagic(struct magic_set *ms, const unsigned char *buf, size_t nbytes, +- int mode, int text) ++ size_t level, int mode, int text) + { + struct mlist *ml; + int rv; + for (ml = ms->mlist->next; ml != ms->mlist; ml = ml->next) + if ((rv = match(ms, ml->magic, ml->nmagic, buf, nbytes, mode, +- text)) != 0) ++ text, level)) != 0) + return rv; + + return 0; +@@ -108,7 +109,8 @@ file_softmagic(struct magic_set *ms, const unsigne + */ + private int + match(struct magic_set *ms, struct magic *magic, uint32_t nmagic, +- const unsigned char *s, size_t nbytes, int mode, int text) ++ const unsigned char *s, size_t nbytes, int mode, int text, ++ int recursion_level) + { + uint32_t magindex = 0; + unsigned int cont_level = 0; +@@ -140,7 +142,7 @@ match(struct magic_set *ms, struct magic *magic, u + ms->line = m->lineno; + + /* if main entry matches, print it... */ +- switch (mget(ms, s, m, nbytes, cont_level, text)) { ++ switch (mget(ms, s, m, nbytes, cont_level, text, recursion_level + 1)) { + case -1: + return -1; + case 0: +@@ -223,7 +225,7 @@ match(struct magic_set *ms, struct magic *magic, u + continue; + } + #endif +- switch (mget(ms, s, m, nbytes, cont_level, text)) { ++ switch (mget(ms, s, m, nbytes, cont_level, text, recursion_level + 1)) { + case -1: + return -1; + case 0: +@@ -1018,12 +1020,18 @@ mcopy(struct magic_set *ms, union VALUETYPE *p, in + + private int + mget(struct magic_set *ms, const unsigned char *s, +- struct magic *m, size_t nbytes, unsigned int cont_level, int text) ++ struct magic *m, size_t nbytes, unsigned int cont_level, int text, ++ int recursion_level) + { + uint32_t offset = ms->offset; + uint32_t count = m->str_range; + union VALUETYPE *p = &ms->ms_value; + ++ if (recursion_level >= 20) { ++ file_error(ms, 0, "recursion nesting exceeded"); ++ return -1; ++ } ++ + if (mcopy(ms, p, m->type, m->flag & INDIR, s, offset, nbytes, count) == -1) + return -1; + +@@ -1073,7 +1081,7 @@ mget(struct magic_set *ms, const unsigned char *s, + } + switch (m->in_type) { + case FILE_BYTE: +- if (nbytes < (offset + 1)) ++ if (OFFSET_OOB(nbytes, offset, 1)) + return 0; + if (off) { + switch (m->in_op & FILE_OPS_MASK) { +@@ -1108,7 +1116,7 @@ mget(struct magic_set *ms, const unsigned char *s, + offset = ~offset; + break; + case FILE_BESHORT: +- if (nbytes < (offset + 2)) ++ if (OFFSET_OOB(nbytes, offset, 2)) + return 0; + if (off) { + switch (m->in_op & FILE_OPS_MASK) { +@@ -1160,7 +1168,7 @@ mget(struct magic_set *ms, const unsigned char *s, + offset = ~offset; + break; + case FILE_LESHORT: +- if (nbytes < (offset + 2)) ++ if (OFFSET_OOB(nbytes, offset, 2)) + return 0; + if (off) { + switch (m->in_op & FILE_OPS_MASK) { +@@ -1212,7 +1220,7 @@ mget(struct magic_set *ms, const unsigned char *s, + offset = ~offset; + break; + case FILE_SHORT: +- if (nbytes < (offset + 2)) ++ if (OFFSET_OOB(nbytes, offset, 2)) + return 0; + if (off) { + switch (m->in_op & FILE_OPS_MASK) { +@@ -1249,7 +1257,7 @@ mget(struct magic_set *ms, const unsigned char *s, + break; + case FILE_BELONG: + case FILE_BEID3: +- if (nbytes < (offset + 4)) ++ if (OFFSET_OOB(nbytes, offset, 4)) + return 0; + if (off) { + switch (m->in_op & FILE_OPS_MASK) { +@@ -1320,7 +1328,7 @@ mget(struct magic_set *ms, const unsigned char *s, + break; + case FILE_LELONG: + case FILE_LEID3: +- if (nbytes < (offset + 4)) ++ if (OFFSET_OOB(nbytes, offset, 4)) + return 0; + if (off) { + switch (m->in_op & FILE_OPS_MASK) { +@@ -1390,7 +1398,7 @@ mget(struct magic_set *ms, const unsigned char *s, + offset = ~offset; + break; + case FILE_MELONG: +- if (nbytes < (offset + 4)) ++ if (OFFSET_OOB(nbytes, offset, 4)) + return 0; + if (off) { + switch (m->in_op & FILE_OPS_MASK) { +@@ -1460,7 +1468,7 @@ mget(struct magic_set *ms, const unsigned char *s, + offset = ~offset; + break; + case FILE_LONG: +- if (nbytes < (offset + 4)) ++ if (OFFSET_OOB(nbytes, offset, 4)) + return 0; + if (off) { + switch (m->in_op & FILE_OPS_MASK) { +@@ -1527,7 +1535,7 @@ mget(struct magic_set *ms, const unsigned char *s, + /* Verify we have enough data to match magic type */ + switch (m->type) { + case FILE_BYTE: +- if (nbytes < (offset + 1)) /* should alway be true */ ++ if (OFFSET_OOB(nbytes, offset, 1)) + return 0; + break; + +@@ -1534,7 +1542,7 @@ mget(struct magic_set *ms, const unsigned char *s, + case FILE_SHORT: + case FILE_BESHORT: + case FILE_LESHORT: +- if (nbytes < (offset + 2)) ++ if (OFFSET_OOB(nbytes, offset, 2)) + return 0; + break; + +@@ -1553,7 +1561,7 @@ mget(struct magic_set *ms, const unsigned char *s, + case FILE_FLOAT: + case FILE_BEFLOAT: + case FILE_LEFLOAT: +- if (nbytes < (offset + 4)) ++ if (OFFSET_OOB(nbytes, offset, 4)) + return 0; + break; + +@@ -1560,7 +1568,7 @@ mget(struct magic_set *ms, const unsigned char *s, + case FILE_DOUBLE: + case FILE_BEDOUBLE: + case FILE_LEDOUBLE: +- if (nbytes < (offset + 8)) ++ if (OFFSET_OOB(nbytes, offset, 8)) + return 0; + break; + +@@ -1567,7 +1575,7 @@ mget(struct magic_set *ms, const unsigned char *s, + case FILE_STRING: + case FILE_PSTRING: + case FILE_SEARCH: +- if (nbytes < (offset + m->vallen)) ++ if (OFFSET_OOB(nbytes, offset, m->vallen)) + return 0; + break; + +@@ -1577,6 +1585,8 @@ mget(struct magic_set *ms, const unsigned char *s, + break; + + case FILE_INDIRECT: ++ if (offset == 0) ++ return 0; + if ((ms->flags & (MAGIC_MIME|MAGIC_APPLE)) == 0 && + file_printf(ms, "%s", m->desc) == -1) + return -1; +@@ -1583,7 +1593,7 @@ mget(struct magic_set *ms, const unsigned char *s, + if (nbytes < offset) + return 0; + return file_softmagic(ms, s + offset, nbytes - offset, +- BINTEST, text); ++ recursion_level, BINTEST, text); + + case FILE_DEFAULT: /* nothing to check */ + default: Index: user/cperciva/freebsd-update-build/patches/9.3-BETA2/1-SA-14:16.file =================================================================== --- user/cperciva/freebsd-update-build/patches/9.3-BETA2/1-SA-14:16.file (nonexistent) +++ user/cperciva/freebsd-update-build/patches/9.3-BETA2/1-SA-14:16.file (revision 293366) @@ -0,0 +1,276 @@ +Index: contrib/file/Magdir/commands +=================================================================== +--- contrib/file/Magdir/commands (revision 267806) ++++ contrib/file/Magdir/commands (working copy) +@@ -49,7 +49,8 @@ + !:mime text/x-awk + 0 string/wt #!\ /usr/bin/awk awk script text executable + !:mime text/x-awk +-0 regex =^\\s*BEGIN\\s*[{] awk script text ++0 regex =^\\s{0,100}BEGIN\\s{0,100}[{] awk script text ++!:strength - 12 + + # AT&T Bell Labs' Plan 9 shell + 0 string/wt #!\ /bin/rc Plan 9 rc shell script text executable +Index: contrib/file/ascmagic.c +=================================================================== +--- contrib/file/ascmagic.c (revision 267806) ++++ contrib/file/ascmagic.c (working copy) +@@ -147,7 +147,7 @@ file_ascmagic_with_encoding(struct magic_set *ms, + == NULL) + goto done; + if ((rv = file_softmagic(ms, utf8_buf, +- (size_t)(utf8_end - utf8_buf), TEXTTEST, text)) == 0) ++ (size_t)(utf8_end - utf8_buf), 0, TEXTTEST, text)) == 0) + rv = -1; + } + +Index: contrib/file/file.h +=================================================================== +--- contrib/file/file.h (revision 267806) ++++ contrib/file/file.h (working copy) +@@ -414,7 +414,7 @@ protected int file_encoding(struct magic_set *, co + unichar **, size_t *, const char **, const char **, const char **); + protected int file_is_tar(struct magic_set *, const unsigned char *, size_t); + protected int file_softmagic(struct magic_set *, const unsigned char *, size_t, +- int, int); ++ size_t, int, int); + protected struct mlist *file_apprentice(struct magic_set *, const char *, int); + protected uint64_t file_signextend(struct magic_set *, struct magic *, + uint64_t); +Index: contrib/file/funcs.c +=================================================================== +--- contrib/file/funcs.c (revision 267806) ++++ contrib/file/funcs.c (working copy) +@@ -228,7 +228,7 @@ file_buffer(struct magic_set *ms, int fd, const ch + + /* try soft magic tests */ + if ((ms->flags & MAGIC_NO_CHECK_SOFT) == 0) +- if ((m = file_softmagic(ms, ubuf, nb, BINTEST, ++ if ((m = file_softmagic(ms, ubuf, nb, 0, BINTEST, + looks_text)) != 0) { + if ((ms->flags & MAGIC_DEBUG) != 0) + (void)fprintf(stderr, "softmagic %d\n", m); +Index: contrib/file/softmagic.c +=================================================================== +--- contrib/file/softmagic.c (revision 267806) ++++ contrib/file/softmagic.c (working copy) +@@ -43,9 +43,9 @@ FILE_RCSID("@(#)$File: softmagic.c,v 1.147 2011/11 + + + private int match(struct magic_set *, struct magic *, uint32_t, +- const unsigned char *, size_t, int, int); ++ const unsigned char *, size_t, int, int, int); + private int mget(struct magic_set *, const unsigned char *, +- struct magic *, size_t, unsigned int, int); ++ struct magic *, size_t, unsigned int, int, int); + private int magiccheck(struct magic_set *, struct magic *); + private int32_t mprint(struct magic_set *, struct magic *); + private int32_t moffset(struct magic_set *, struct magic *); +@@ -60,6 +60,7 @@ private void cvt_16(union VALUETYPE *, const struc + private void cvt_32(union VALUETYPE *, const struct magic *); + private void cvt_64(union VALUETYPE *, const struct magic *); + ++#define OFFSET_OOB(n, o, i) ((n) < (o) || (i) > ((n) - (o))) + /* + * softmagic - lookup one file in parsed, in-memory copy of database + * Passed the name and FILE * of one file to be typed. +@@ -67,13 +68,13 @@ private void cvt_64(union VALUETYPE *, const struc + /*ARGSUSED1*/ /* nbytes passed for regularity, maybe need later */ + protected int + file_softmagic(struct magic_set *ms, const unsigned char *buf, size_t nbytes, +- int mode, int text) ++ size_t level, int mode, int text) + { + struct mlist *ml; + int rv; + for (ml = ms->mlist->next; ml != ms->mlist; ml = ml->next) + if ((rv = match(ms, ml->magic, ml->nmagic, buf, nbytes, mode, +- text)) != 0) ++ text, level)) != 0) + return rv; + + return 0; +@@ -108,7 +109,8 @@ file_softmagic(struct magic_set *ms, const unsigne + */ + private int + match(struct magic_set *ms, struct magic *magic, uint32_t nmagic, +- const unsigned char *s, size_t nbytes, int mode, int text) ++ const unsigned char *s, size_t nbytes, int mode, int text, ++ int recursion_level) + { + uint32_t magindex = 0; + unsigned int cont_level = 0; +@@ -140,7 +142,7 @@ match(struct magic_set *ms, struct magic *magic, u + ms->line = m->lineno; + + /* if main entry matches, print it... */ +- switch (mget(ms, s, m, nbytes, cont_level, text)) { ++ switch (mget(ms, s, m, nbytes, cont_level, text, recursion_level + 1)) { + case -1: + return -1; + case 0: +@@ -223,7 +225,7 @@ match(struct magic_set *ms, struct magic *magic, u + continue; + } + #endif +- switch (mget(ms, s, m, nbytes, cont_level, text)) { ++ switch (mget(ms, s, m, nbytes, cont_level, text, recursion_level + 1)) { + case -1: + return -1; + case 0: +@@ -1018,12 +1020,18 @@ mcopy(struct magic_set *ms, union VALUETYPE *p, in + + private int + mget(struct magic_set *ms, const unsigned char *s, +- struct magic *m, size_t nbytes, unsigned int cont_level, int text) ++ struct magic *m, size_t nbytes, unsigned int cont_level, int text, ++ int recursion_level) + { + uint32_t offset = ms->offset; + uint32_t count = m->str_range; + union VALUETYPE *p = &ms->ms_value; + ++ if (recursion_level >= 20) { ++ file_error(ms, 0, "recursion nesting exceeded"); ++ return -1; ++ } ++ + if (mcopy(ms, p, m->type, m->flag & INDIR, s, offset, nbytes, count) == -1) + return -1; + +@@ -1073,7 +1081,7 @@ mget(struct magic_set *ms, const unsigned char *s, + } + switch (m->in_type) { + case FILE_BYTE: +- if (nbytes < (offset + 1)) ++ if (OFFSET_OOB(nbytes, offset, 1)) + return 0; + if (off) { + switch (m->in_op & FILE_OPS_MASK) { +@@ -1108,7 +1116,7 @@ mget(struct magic_set *ms, const unsigned char *s, + offset = ~offset; + break; + case FILE_BESHORT: +- if (nbytes < (offset + 2)) ++ if (OFFSET_OOB(nbytes, offset, 2)) + return 0; + if (off) { + switch (m->in_op & FILE_OPS_MASK) { +@@ -1160,7 +1168,7 @@ mget(struct magic_set *ms, const unsigned char *s, + offset = ~offset; + break; + case FILE_LESHORT: +- if (nbytes < (offset + 2)) ++ if (OFFSET_OOB(nbytes, offset, 2)) + return 0; + if (off) { + switch (m->in_op & FILE_OPS_MASK) { +@@ -1212,7 +1220,7 @@ mget(struct magic_set *ms, const unsigned char *s, + offset = ~offset; + break; + case FILE_SHORT: +- if (nbytes < (offset + 2)) ++ if (OFFSET_OOB(nbytes, offset, 2)) + return 0; + if (off) { + switch (m->in_op & FILE_OPS_MASK) { +@@ -1249,7 +1257,7 @@ mget(struct magic_set *ms, const unsigned char *s, + break; + case FILE_BELONG: + case FILE_BEID3: +- if (nbytes < (offset + 4)) ++ if (OFFSET_OOB(nbytes, offset, 4)) + return 0; + if (off) { + switch (m->in_op & FILE_OPS_MASK) { +@@ -1320,7 +1328,7 @@ mget(struct magic_set *ms, const unsigned char *s, + break; + case FILE_LELONG: + case FILE_LEID3: +- if (nbytes < (offset + 4)) ++ if (OFFSET_OOB(nbytes, offset, 4)) + return 0; + if (off) { + switch (m->in_op & FILE_OPS_MASK) { +@@ -1390,7 +1398,7 @@ mget(struct magic_set *ms, const unsigned char *s, + offset = ~offset; + break; + case FILE_MELONG: +- if (nbytes < (offset + 4)) ++ if (OFFSET_OOB(nbytes, offset, 4)) + return 0; + if (off) { + switch (m->in_op & FILE_OPS_MASK) { +@@ -1460,7 +1468,7 @@ mget(struct magic_set *ms, const unsigned char *s, + offset = ~offset; + break; + case FILE_LONG: +- if (nbytes < (offset + 4)) ++ if (OFFSET_OOB(nbytes, offset, 4)) + return 0; + if (off) { + switch (m->in_op & FILE_OPS_MASK) { +@@ -1527,7 +1535,7 @@ mget(struct magic_set *ms, const unsigned char *s, + /* Verify we have enough data to match magic type */ + switch (m->type) { + case FILE_BYTE: +- if (nbytes < (offset + 1)) /* should alway be true */ ++ if (OFFSET_OOB(nbytes, offset, 1)) + return 0; + break; + +@@ -1534,7 +1542,7 @@ mget(struct magic_set *ms, const unsigned char *s, + case FILE_SHORT: + case FILE_BESHORT: + case FILE_LESHORT: +- if (nbytes < (offset + 2)) ++ if (OFFSET_OOB(nbytes, offset, 2)) + return 0; + break; + +@@ -1553,7 +1561,7 @@ mget(struct magic_set *ms, const unsigned char *s, + case FILE_FLOAT: + case FILE_BEFLOAT: + case FILE_LEFLOAT: +- if (nbytes < (offset + 4)) ++ if (OFFSET_OOB(nbytes, offset, 4)) + return 0; + break; + +@@ -1560,7 +1568,7 @@ mget(struct magic_set *ms, const unsigned char *s, + case FILE_DOUBLE: + case FILE_BEDOUBLE: + case FILE_LEDOUBLE: +- if (nbytes < (offset + 8)) ++ if (OFFSET_OOB(nbytes, offset, 8)) + return 0; + break; + +@@ -1567,7 +1575,7 @@ mget(struct magic_set *ms, const unsigned char *s, + case FILE_STRING: + case FILE_PSTRING: + case FILE_SEARCH: +- if (nbytes < (offset + m->vallen)) ++ if (OFFSET_OOB(nbytes, offset, m->vallen)) + return 0; + break; + +@@ -1577,6 +1585,8 @@ mget(struct magic_set *ms, const unsigned char *s, + break; + + case FILE_INDIRECT: ++ if (offset == 0) ++ return 0; + if ((ms->flags & (MAGIC_MIME|MAGIC_APPLE)) == 0 && + file_printf(ms, "%s", m->desc) == -1) + return -1; +@@ -1583,7 +1593,7 @@ mget(struct magic_set *ms, const unsigned char *s, + if (nbytes < offset) + return 0; + return file_softmagic(ms, s + offset, nbytes - offset, +- BINTEST, text); ++ recursion_level, BINTEST, text); + + case FILE_DEFAULT: /* nothing to check */ + default: Index: user/cperciva/freebsd-update-build/patches/9.3-BETA3/1-SA-14:16.file =================================================================== --- user/cperciva/freebsd-update-build/patches/9.3-BETA3/1-SA-14:16.file (nonexistent) +++ user/cperciva/freebsd-update-build/patches/9.3-BETA3/1-SA-14:16.file (revision 293366) @@ -0,0 +1,276 @@ +Index: contrib/file/Magdir/commands +=================================================================== +--- contrib/file/Magdir/commands (revision 267806) ++++ contrib/file/Magdir/commands (working copy) +@@ -49,7 +49,8 @@ + !:mime text/x-awk + 0 string/wt #!\ /usr/bin/awk awk script text executable + !:mime text/x-awk +-0 regex =^\\s*BEGIN\\s*[{] awk script text ++0 regex =^\\s{0,100}BEGIN\\s{0,100}[{] awk script text ++!:strength - 12 + + # AT&T Bell Labs' Plan 9 shell + 0 string/wt #!\ /bin/rc Plan 9 rc shell script text executable +Index: contrib/file/ascmagic.c +=================================================================== +--- contrib/file/ascmagic.c (revision 267806) ++++ contrib/file/ascmagic.c (working copy) +@@ -147,7 +147,7 @@ file_ascmagic_with_encoding(struct magic_set *ms, + == NULL) + goto done; + if ((rv = file_softmagic(ms, utf8_buf, +- (size_t)(utf8_end - utf8_buf), TEXTTEST, text)) == 0) ++ (size_t)(utf8_end - utf8_buf), 0, TEXTTEST, text)) == 0) + rv = -1; + } + +Index: contrib/file/file.h +=================================================================== +--- contrib/file/file.h (revision 267806) ++++ contrib/file/file.h (working copy) +@@ -414,7 +414,7 @@ protected int file_encoding(struct magic_set *, co + unichar **, size_t *, const char **, const char **, const char **); + protected int file_is_tar(struct magic_set *, const unsigned char *, size_t); + protected int file_softmagic(struct magic_set *, const unsigned char *, size_t, +- int, int); ++ size_t, int, int); + protected struct mlist *file_apprentice(struct magic_set *, const char *, int); + protected uint64_t file_signextend(struct magic_set *, struct magic *, + uint64_t); +Index: contrib/file/funcs.c +=================================================================== +--- contrib/file/funcs.c (revision 267806) ++++ contrib/file/funcs.c (working copy) +@@ -228,7 +228,7 @@ file_buffer(struct magic_set *ms, int fd, const ch + + /* try soft magic tests */ + if ((ms->flags & MAGIC_NO_CHECK_SOFT) == 0) +- if ((m = file_softmagic(ms, ubuf, nb, BINTEST, ++ if ((m = file_softmagic(ms, ubuf, nb, 0, BINTEST, + looks_text)) != 0) { + if ((ms->flags & MAGIC_DEBUG) != 0) + (void)fprintf(stderr, "softmagic %d\n", m); +Index: contrib/file/softmagic.c +=================================================================== +--- contrib/file/softmagic.c (revision 267806) ++++ contrib/file/softmagic.c (working copy) +@@ -43,9 +43,9 @@ FILE_RCSID("@(#)$File: softmagic.c,v 1.147 2011/11 + + + private int match(struct magic_set *, struct magic *, uint32_t, +- const unsigned char *, size_t, int, int); ++ const unsigned char *, size_t, int, int, int); + private int mget(struct magic_set *, const unsigned char *, +- struct magic *, size_t, unsigned int, int); ++ struct magic *, size_t, unsigned int, int, int); + private int magiccheck(struct magic_set *, struct magic *); + private int32_t mprint(struct magic_set *, struct magic *); + private int32_t moffset(struct magic_set *, struct magic *); +@@ -60,6 +60,7 @@ private void cvt_16(union VALUETYPE *, const struc + private void cvt_32(union VALUETYPE *, const struct magic *); + private void cvt_64(union VALUETYPE *, const struct magic *); + ++#define OFFSET_OOB(n, o, i) ((n) < (o) || (i) > ((n) - (o))) + /* + * softmagic - lookup one file in parsed, in-memory copy of database + * Passed the name and FILE * of one file to be typed. +@@ -67,13 +68,13 @@ private void cvt_64(union VALUETYPE *, const struc + /*ARGSUSED1*/ /* nbytes passed for regularity, maybe need later */ + protected int + file_softmagic(struct magic_set *ms, const unsigned char *buf, size_t nbytes, +- int mode, int text) ++ size_t level, int mode, int text) + { + struct mlist *ml; + int rv; + for (ml = ms->mlist->next; ml != ms->mlist; ml = ml->next) + if ((rv = match(ms, ml->magic, ml->nmagic, buf, nbytes, mode, +- text)) != 0) ++ text, level)) != 0) + return rv; + + return 0; +@@ -108,7 +109,8 @@ file_softmagic(struct magic_set *ms, const unsigne + */ + private int + match(struct magic_set *ms, struct magic *magic, uint32_t nmagic, +- const unsigned char *s, size_t nbytes, int mode, int text) ++ const unsigned char *s, size_t nbytes, int mode, int text, ++ int recursion_level) + { + uint32_t magindex = 0; + unsigned int cont_level = 0; +@@ -140,7 +142,7 @@ match(struct magic_set *ms, struct magic *magic, u + ms->line = m->lineno; + + /* if main entry matches, print it... */ +- switch (mget(ms, s, m, nbytes, cont_level, text)) { ++ switch (mget(ms, s, m, nbytes, cont_level, text, recursion_level + 1)) { + case -1: + return -1; + case 0: +@@ -223,7 +225,7 @@ match(struct magic_set *ms, struct magic *magic, u + continue; + } + #endif +- switch (mget(ms, s, m, nbytes, cont_level, text)) { ++ switch (mget(ms, s, m, nbytes, cont_level, text, recursion_level + 1)) { + case -1: + return -1; + case 0: +@@ -1018,12 +1020,18 @@ mcopy(struct magic_set *ms, union VALUETYPE *p, in + + private int + mget(struct magic_set *ms, const unsigned char *s, +- struct magic *m, size_t nbytes, unsigned int cont_level, int text) ++ struct magic *m, size_t nbytes, unsigned int cont_level, int text, ++ int recursion_level) + { + uint32_t offset = ms->offset; + uint32_t count = m->str_range; + union VALUETYPE *p = &ms->ms_value; + ++ if (recursion_level >= 20) { ++ file_error(ms, 0, "recursion nesting exceeded"); ++ return -1; ++ } ++ + if (mcopy(ms, p, m->type, m->flag & INDIR, s, offset, nbytes, count) == -1) + return -1; + +@@ -1073,7 +1081,7 @@ mget(struct magic_set *ms, const unsigned char *s, + } + switch (m->in_type) { + case FILE_BYTE: +- if (nbytes < (offset + 1)) ++ if (OFFSET_OOB(nbytes, offset, 1)) + return 0; + if (off) { + switch (m->in_op & FILE_OPS_MASK) { +@@ -1108,7 +1116,7 @@ mget(struct magic_set *ms, const unsigned char *s, + offset = ~offset; + break; + case FILE_BESHORT: +- if (nbytes < (offset + 2)) ++ if (OFFSET_OOB(nbytes, offset, 2)) + return 0; + if (off) { + switch (m->in_op & FILE_OPS_MASK) { +@@ -1160,7 +1168,7 @@ mget(struct magic_set *ms, const unsigned char *s, + offset = ~offset; + break; + case FILE_LESHORT: +- if (nbytes < (offset + 2)) ++ if (OFFSET_OOB(nbytes, offset, 2)) + return 0; + if (off) { + switch (m->in_op & FILE_OPS_MASK) { +@@ -1212,7 +1220,7 @@ mget(struct magic_set *ms, const unsigned char *s, + offset = ~offset; + break; + case FILE_SHORT: +- if (nbytes < (offset + 2)) ++ if (OFFSET_OOB(nbytes, offset, 2)) + return 0; + if (off) { + switch (m->in_op & FILE_OPS_MASK) { +@@ -1249,7 +1257,7 @@ mget(struct magic_set *ms, const unsigned char *s, + break; + case FILE_BELONG: + case FILE_BEID3: +- if (nbytes < (offset + 4)) ++ if (OFFSET_OOB(nbytes, offset, 4)) + return 0; + if (off) { + switch (m->in_op & FILE_OPS_MASK) { +@@ -1320,7 +1328,7 @@ mget(struct magic_set *ms, const unsigned char *s, + break; + case FILE_LELONG: + case FILE_LEID3: +- if (nbytes < (offset + 4)) ++ if (OFFSET_OOB(nbytes, offset, 4)) + return 0; + if (off) { + switch (m->in_op & FILE_OPS_MASK) { +@@ -1390,7 +1398,7 @@ mget(struct magic_set *ms, const unsigned char *s, + offset = ~offset; + break; + case FILE_MELONG: +- if (nbytes < (offset + 4)) ++ if (OFFSET_OOB(nbytes, offset, 4)) + return 0; + if (off) { + switch (m->in_op & FILE_OPS_MASK) { +@@ -1460,7 +1468,7 @@ mget(struct magic_set *ms, const unsigned char *s, + offset = ~offset; + break; + case FILE_LONG: +- if (nbytes < (offset + 4)) ++ if (OFFSET_OOB(nbytes, offset, 4)) + return 0; + if (off) { + switch (m->in_op & FILE_OPS_MASK) { +@@ -1527,7 +1535,7 @@ mget(struct magic_set *ms, const unsigned char *s, + /* Verify we have enough data to match magic type */ + switch (m->type) { + case FILE_BYTE: +- if (nbytes < (offset + 1)) /* should alway be true */ ++ if (OFFSET_OOB(nbytes, offset, 1)) + return 0; + break; + +@@ -1534,7 +1542,7 @@ mget(struct magic_set *ms, const unsigned char *s, + case FILE_SHORT: + case FILE_BESHORT: + case FILE_LESHORT: +- if (nbytes < (offset + 2)) ++ if (OFFSET_OOB(nbytes, offset, 2)) + return 0; + break; + +@@ -1553,7 +1561,7 @@ mget(struct magic_set *ms, const unsigned char *s, + case FILE_FLOAT: + case FILE_BEFLOAT: + case FILE_LEFLOAT: +- if (nbytes < (offset + 4)) ++ if (OFFSET_OOB(nbytes, offset, 4)) + return 0; + break; + +@@ -1560,7 +1568,7 @@ mget(struct magic_set *ms, const unsigned char *s, + case FILE_DOUBLE: + case FILE_BEDOUBLE: + case FILE_LEDOUBLE: +- if (nbytes < (offset + 8)) ++ if (OFFSET_OOB(nbytes, offset, 8)) + return 0; + break; + +@@ -1567,7 +1575,7 @@ mget(struct magic_set *ms, const unsigned char *s, + case FILE_STRING: + case FILE_PSTRING: + case FILE_SEARCH: +- if (nbytes < (offset + m->vallen)) ++ if (OFFSET_OOB(nbytes, offset, m->vallen)) + return 0; + break; + +@@ -1577,6 +1585,8 @@ mget(struct magic_set *ms, const unsigned char *s, + break; + + case FILE_INDIRECT: ++ if (offset == 0) ++ return 0; + if ((ms->flags & (MAGIC_MIME|MAGIC_APPLE)) == 0 && + file_printf(ms, "%s", m->desc) == -1) + return -1; +@@ -1583,7 +1593,7 @@ mget(struct magic_set *ms, const unsigned char *s, + if (nbytes < offset) + return 0; + return file_softmagic(ms, s + offset, nbytes - offset, +- BINTEST, text); ++ recursion_level, BINTEST, text); + + case FILE_DEFAULT: /* nothing to check */ + default: Index: user/cperciva/freebsd-update-build/patches/9.3-BETA3/2-SA-14:17.kmem =================================================================== --- user/cperciva/freebsd-update-build/patches/9.3-BETA3/2-SA-14:17.kmem (nonexistent) +++ user/cperciva/freebsd-update-build/patches/9.3-BETA3/2-SA-14:17.kmem (revision 293366) @@ -0,0 +1,263 @@ +Index: sys/kern/uipc_sockbuf.c +=================================================================== +--- sys/kern/uipc_sockbuf.c (revision 268273) ++++ sys/kern/uipc_sockbuf.c (working copy) +@@ -1045,6 +1045,11 @@ sbcreatecontrol(caddr_t p, int size, int type, int + m->m_len = 0; + KASSERT(CMSG_SPACE((u_int)size) <= M_TRAILINGSPACE(m), + ("sbcreatecontrol: short mbuf")); ++ /* ++ * Don't leave the padding between the msg header and the ++ * cmsg data and the padding after the cmsg data un-initialized. ++ */ ++ bzero(cp, CMSG_SPACE((u_int)size)); + if (p != NULL) + (void)memcpy(CMSG_DATA(cp), p, size); + m->m_len = CMSG_SPACE(size); +Index: sys/netinet/sctp_auth.c +=================================================================== +--- sys/netinet/sctp_auth.c (revision 268273) ++++ sys/netinet/sctp_auth.c (working copy) +@@ -1790,6 +1790,7 @@ sctp_notify_authentication(struct sctp_tcb *stcb, + + SCTP_BUF_LEN(m_notify) = 0; + auth = mtod(m_notify, struct sctp_authkey_event *); ++ memset(auth, 0, sizeof(struct sctp_authkey_event)); + auth->auth_type = SCTP_AUTHENTICATION_EVENT; + auth->auth_flags = 0; + auth->auth_length = sizeof(*auth); +Index: sys/netinet/sctp_indata.c +=================================================================== +--- sys/netinet/sctp_indata.c (revision 268273) ++++ sys/netinet/sctp_indata.c (working copy) +@@ -250,6 +250,11 @@ sctp_build_ctl_nchunk(struct sctp_inpcb *inp, stru + + /* We need a CMSG header followed by the struct */ + cmh = mtod(ret, struct cmsghdr *); ++ /* ++ * Make sure that there is no un-initialized padding between the ++ * cmsg header and cmsg data and after the cmsg data. ++ */ ++ memset(cmh, 0, len); + if (sctp_is_feature_on(inp, SCTP_PCB_FLAGS_RECVRCVINFO)) { + cmh->cmsg_level = IPPROTO_SCTP; + cmh->cmsg_len = CMSG_LEN(sizeof(struct sctp_rcvinfo)); +Index: sys/netinet/sctputil.c +=================================================================== +--- sys/netinet/sctputil.c (revision 268273) ++++ sys/netinet/sctputil.c (working copy) +@@ -2622,6 +2622,7 @@ sctp_notify_assoc_change(uint16_t state, struct sc + } + SCTP_BUF_NEXT(m_notify) = NULL; + sac = mtod(m_notify, struct sctp_assoc_change *); ++ memset(sac, 0, notif_len); + sac->sac_type = SCTP_ASSOC_CHANGE; + sac->sac_flags = 0; + sac->sac_length = sizeof(struct sctp_assoc_change); +@@ -2835,11 +2836,10 @@ sctp_notify_send_failed(struct sctp_tcb *stcb, uin + if (m_notify == NULL) + /* no space left */ + return; +- length += chk->send_size; +- length -= sizeof(struct sctp_data_chunk); + SCTP_BUF_LEN(m_notify) = 0; + if (sctp_stcb_is_feature_on(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_RECVNSENDFAILEVNT)) { + ssfe = mtod(m_notify, struct sctp_send_failed_event *); ++ memset(ssfe, 0, length); + ssfe->ssfe_type = SCTP_SEND_FAILED_EVENT; + if (sent) { + ssfe->ssfe_flags = SCTP_DATA_SENT; +@@ -2846,10 +2846,11 @@ sctp_notify_send_failed(struct sctp_tcb *stcb, uin + } else { + ssfe->ssfe_flags = SCTP_DATA_UNSENT; + } ++ length += chk->send_size; ++ length -= sizeof(struct sctp_data_chunk); + ssfe->ssfe_length = length; + ssfe->ssfe_error = error; + /* not exactly what the user sent in, but should be close :) */ +- bzero(&ssfe->ssfe_info, sizeof(ssfe->ssfe_info)); + ssfe->ssfe_info.snd_sid = chk->rec.data.stream_number; + ssfe->ssfe_info.snd_flags = chk->rec.data.rcv_flags; + ssfe->ssfe_info.snd_ppid = chk->rec.data.payloadtype; +@@ -2859,6 +2860,7 @@ sctp_notify_send_failed(struct sctp_tcb *stcb, uin + SCTP_BUF_LEN(m_notify) = sizeof(struct sctp_send_failed_event); + } else { + ssf = mtod(m_notify, struct sctp_send_failed *); ++ memset(ssf, 0, length); + ssf->ssf_type = SCTP_SEND_FAILED; + if (sent) { + ssf->ssf_flags = SCTP_DATA_SENT; +@@ -2865,6 +2867,8 @@ sctp_notify_send_failed(struct sctp_tcb *stcb, uin + } else { + ssf->ssf_flags = SCTP_DATA_UNSENT; + } ++ length += chk->send_size; ++ length -= sizeof(struct sctp_data_chunk); + ssf->ssf_length = length; + ssf->ssf_error = error; + /* not exactly what the user sent in, but should be close :) */ +@@ -2948,16 +2952,16 @@ sctp_notify_send_failed2(struct sctp_tcb *stcb, ui + /* no space left */ + return; + } +- length += sp->length; + SCTP_BUF_LEN(m_notify) = 0; + if (sctp_stcb_is_feature_on(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_RECVNSENDFAILEVNT)) { + ssfe = mtod(m_notify, struct sctp_send_failed_event *); ++ memset(ssfe, 0, length); + ssfe->ssfe_type = SCTP_SEND_FAILED_EVENT; + ssfe->ssfe_flags = SCTP_DATA_UNSENT; ++ length += sp->length; + ssfe->ssfe_length = length; + ssfe->ssfe_error = error; + /* not exactly what the user sent in, but should be close :) */ +- bzero(&ssfe->ssfe_info, sizeof(ssfe->ssfe_info)); + ssfe->ssfe_info.snd_sid = sp->stream; + if (sp->some_taken) { + ssfe->ssfe_info.snd_flags = SCTP_DATA_LAST_FRAG; +@@ -2971,12 +2975,13 @@ sctp_notify_send_failed2(struct sctp_tcb *stcb, ui + SCTP_BUF_LEN(m_notify) = sizeof(struct sctp_send_failed_event); + } else { + ssf = mtod(m_notify, struct sctp_send_failed *); ++ memset(ssf, 0, length); + ssf->ssf_type = SCTP_SEND_FAILED; + ssf->ssf_flags = SCTP_DATA_UNSENT; ++ length += sp->length; + ssf->ssf_length = length; + ssf->ssf_error = error; + /* not exactly what the user sent in, but should be close :) */ +- bzero(&ssf->ssf_info, sizeof(ssf->ssf_info)); + ssf->ssf_info.sinfo_stream = sp->stream; + ssf->ssf_info.sinfo_ssn = 0; + if (sp->some_taken) { +@@ -3038,6 +3043,7 @@ sctp_notify_adaptation_layer(struct sctp_tcb *stcb + return; + SCTP_BUF_LEN(m_notify) = 0; + sai = mtod(m_notify, struct sctp_adaptation_event *); ++ memset(sai, 0, sizeof(struct sctp_adaptation_event)); + sai->sai_type = SCTP_ADAPTATION_INDICATION; + sai->sai_flags = 0; + sai->sai_length = sizeof(struct sctp_adaptation_event); +@@ -3093,6 +3099,7 @@ sctp_notify_partial_delivery_indication(struct sct + return; + SCTP_BUF_LEN(m_notify) = 0; + pdapi = mtod(m_notify, struct sctp_pdapi_event *); ++ memset(pdapi, 0, sizeof(struct sctp_pdapi_event)); + pdapi->pdapi_type = SCTP_PARTIAL_DELIVERY_EVENT; + pdapi->pdapi_flags = 0; + pdapi->pdapi_length = sizeof(struct sctp_pdapi_event); +@@ -3202,6 +3209,7 @@ sctp_notify_shutdown_event(struct sctp_tcb *stcb) + /* no space left */ + return; + sse = mtod(m_notify, struct sctp_shutdown_event *); ++ memset(sse, 0, sizeof(struct sctp_shutdown_event)); + sse->sse_type = SCTP_SHUTDOWN_EVENT; + sse->sse_flags = 0; + sse->sse_length = sizeof(struct sctp_shutdown_event); +@@ -3252,6 +3260,7 @@ sctp_notify_sender_dry_event(struct sctp_tcb *stcb + } + SCTP_BUF_LEN(m_notify) = 0; + event = mtod(m_notify, struct sctp_sender_dry_event *); ++ memset(event, 0, sizeof(struct sctp_sender_dry_event)); + event->sender_dry_type = SCTP_SENDER_DRY_EVENT; + event->sender_dry_flags = 0; + event->sender_dry_length = sizeof(struct sctp_sender_dry_event); +@@ -3284,7 +3293,6 @@ sctp_notify_stream_reset_add(struct sctp_tcb *stcb + struct mbuf *m_notify; + struct sctp_queued_to_read *control; + struct sctp_stream_change_event *stradd; +- int len; + + if ((stcb == NULL) || + (sctp_stcb_is_feature_off(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_STREAM_CHANGEEVNT))) { +@@ -3297,25 +3305,20 @@ sctp_notify_stream_reset_add(struct sctp_tcb *stcb + return; + } + stcb->asoc.peer_req_out = 0; +- m_notify = sctp_get_mbuf_for_msg(MCLBYTES, 0, M_DONTWAIT, 1, MT_DATA); ++ m_notify = sctp_get_mbuf_for_msg(sizeof(struct sctp_stream_change_event), 0, M_DONTWAIT, 1, MT_DATA); + if (m_notify == NULL) + /* no space left */ + return; + SCTP_BUF_LEN(m_notify) = 0; +- len = sizeof(struct sctp_stream_change_event); +- if (len > M_TRAILINGSPACE(m_notify)) { +- /* never enough room */ +- sctp_m_freem(m_notify); +- return; +- } + stradd = mtod(m_notify, struct sctp_stream_change_event *); ++ memset(stradd, 0, sizeof(struct sctp_stream_change_event)); + stradd->strchange_type = SCTP_STREAM_CHANGE_EVENT; + stradd->strchange_flags = flag; +- stradd->strchange_length = len; ++ stradd->strchange_length = sizeof(struct sctp_stream_change_event); + stradd->strchange_assoc_id = sctp_get_associd(stcb); + stradd->strchange_instrms = numberin; + stradd->strchange_outstrms = numberout; +- SCTP_BUF_LEN(m_notify) = len; ++ SCTP_BUF_LEN(m_notify) = sizeof(struct sctp_stream_change_event); + SCTP_BUF_NEXT(m_notify) = NULL; + if (sctp_sbspace(&stcb->asoc, &stcb->sctp_socket->so_rcv) < SCTP_BUF_LEN(m_notify)) { + /* no space */ +@@ -3346,7 +3349,6 @@ sctp_notify_stream_reset_tsn(struct sctp_tcb *stcb + struct mbuf *m_notify; + struct sctp_queued_to_read *control; + struct sctp_assoc_reset_event *strasoc; +- int len; + + if ((stcb == NULL) || + (sctp_stcb_is_feature_off(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_ASSOC_RESETEVNT))) { +@@ -3353,25 +3355,20 @@ sctp_notify_stream_reset_tsn(struct sctp_tcb *stcb + /* event not enabled */ + return; + } +- m_notify = sctp_get_mbuf_for_msg(MCLBYTES, 0, M_DONTWAIT, 1, MT_DATA); ++ m_notify = sctp_get_mbuf_for_msg(sizeof(struct sctp_assoc_reset_event), 0, M_DONTWAIT, 1, MT_DATA); + if (m_notify == NULL) + /* no space left */ + return; + SCTP_BUF_LEN(m_notify) = 0; +- len = sizeof(struct sctp_assoc_reset_event); +- if (len > M_TRAILINGSPACE(m_notify)) { +- /* never enough room */ +- sctp_m_freem(m_notify); +- return; +- } + strasoc = mtod(m_notify, struct sctp_assoc_reset_event *); ++ memset(strasoc, 0, sizeof(struct sctp_assoc_reset_event)); + strasoc->assocreset_type = SCTP_ASSOC_RESET_EVENT; + strasoc->assocreset_flags = flag; +- strasoc->assocreset_length = len; ++ strasoc->assocreset_length = sizeof(struct sctp_assoc_reset_event); + strasoc->assocreset_assoc_id = sctp_get_associd(stcb); + strasoc->assocreset_local_tsn = sending_tsn; + strasoc->assocreset_remote_tsn = recv_tsn; +- SCTP_BUF_LEN(m_notify) = len; ++ SCTP_BUF_LEN(m_notify) = sizeof(struct sctp_assoc_reset_event); + SCTP_BUF_NEXT(m_notify) = NULL; + if (sctp_sbspace(&stcb->asoc, &stcb->sctp_socket->so_rcv) < SCTP_BUF_LEN(m_notify)) { + /* no space */ +@@ -3424,6 +3421,7 @@ sctp_notify_stream_reset(struct sctp_tcb *stcb, + return; + } + strreset = mtod(m_notify, struct sctp_stream_reset_event *); ++ memset(strreset, 0, len); + strreset->strreset_type = SCTP_STREAM_RESET_EVENT; + strreset->strreset_flags = flag; + strreset->strreset_length = len; +@@ -6236,9 +6234,12 @@ sctp_soreceive(struct socket *so, + fromlen = 0; + } + ++ if (filling_sinfo) { ++ memset(&sinfo, 0, sizeof(struct sctp_extrcvinfo)); ++ } + error = sctp_sorecvmsg(so, uio, mp0, from, fromlen, flagsp, + (struct sctp_sndrcvinfo *)&sinfo, filling_sinfo); +- if ((controlp) && (filling_sinfo)) { ++ if (controlp != NULL) { + /* copy back the sinfo in a CMSG format */ + if (filling_sinfo) + *controlp = sctp_build_ctl_nchunk(inp, Index: user/cperciva/freebsd-update-build/patches/9.3-RC1/1-SA-14:16.file =================================================================== --- user/cperciva/freebsd-update-build/patches/9.3-RC1/1-SA-14:16.file (nonexistent) +++ user/cperciva/freebsd-update-build/patches/9.3-RC1/1-SA-14:16.file (revision 293366) @@ -0,0 +1,276 @@ +Index: contrib/file/Magdir/commands +=================================================================== +--- contrib/file/Magdir/commands (revision 267806) ++++ contrib/file/Magdir/commands (working copy) +@@ -49,7 +49,8 @@ + !:mime text/x-awk + 0 string/wt #!\ /usr/bin/awk awk script text executable + !:mime text/x-awk +-0 regex =^\\s*BEGIN\\s*[{] awk script text ++0 regex =^\\s{0,100}BEGIN\\s{0,100}[{] awk script text ++!:strength - 12 + + # AT&T Bell Labs' Plan 9 shell + 0 string/wt #!\ /bin/rc Plan 9 rc shell script text executable +Index: contrib/file/ascmagic.c +=================================================================== +--- contrib/file/ascmagic.c (revision 267806) ++++ contrib/file/ascmagic.c (working copy) +@@ -147,7 +147,7 @@ file_ascmagic_with_encoding(struct magic_set *ms, + == NULL) + goto done; + if ((rv = file_softmagic(ms, utf8_buf, +- (size_t)(utf8_end - utf8_buf), TEXTTEST, text)) == 0) ++ (size_t)(utf8_end - utf8_buf), 0, TEXTTEST, text)) == 0) + rv = -1; + } + +Index: contrib/file/file.h +=================================================================== +--- contrib/file/file.h (revision 267806) ++++ contrib/file/file.h (working copy) +@@ -414,7 +414,7 @@ protected int file_encoding(struct magic_set *, co + unichar **, size_t *, const char **, const char **, const char **); + protected int file_is_tar(struct magic_set *, const unsigned char *, size_t); + protected int file_softmagic(struct magic_set *, const unsigned char *, size_t, +- int, int); ++ size_t, int, int); + protected struct mlist *file_apprentice(struct magic_set *, const char *, int); + protected uint64_t file_signextend(struct magic_set *, struct magic *, + uint64_t); +Index: contrib/file/funcs.c +=================================================================== +--- contrib/file/funcs.c (revision 267806) ++++ contrib/file/funcs.c (working copy) +@@ -228,7 +228,7 @@ file_buffer(struct magic_set *ms, int fd, const ch + + /* try soft magic tests */ + if ((ms->flags & MAGIC_NO_CHECK_SOFT) == 0) +- if ((m = file_softmagic(ms, ubuf, nb, BINTEST, ++ if ((m = file_softmagic(ms, ubuf, nb, 0, BINTEST, + looks_text)) != 0) { + if ((ms->flags & MAGIC_DEBUG) != 0) + (void)fprintf(stderr, "softmagic %d\n", m); +Index: contrib/file/softmagic.c +=================================================================== +--- contrib/file/softmagic.c (revision 267806) ++++ contrib/file/softmagic.c (working copy) +@@ -43,9 +43,9 @@ FILE_RCSID("@(#)$File: softmagic.c,v 1.147 2011/11 + + + private int match(struct magic_set *, struct magic *, uint32_t, +- const unsigned char *, size_t, int, int); ++ const unsigned char *, size_t, int, int, int); + private int mget(struct magic_set *, const unsigned char *, +- struct magic *, size_t, unsigned int, int); ++ struct magic *, size_t, unsigned int, int, int); + private int magiccheck(struct magic_set *, struct magic *); + private int32_t mprint(struct magic_set *, struct magic *); + private int32_t moffset(struct magic_set *, struct magic *); +@@ -60,6 +60,7 @@ private void cvt_16(union VALUETYPE *, const struc + private void cvt_32(union VALUETYPE *, const struct magic *); + private void cvt_64(union VALUETYPE *, const struct magic *); + ++#define OFFSET_OOB(n, o, i) ((n) < (o) || (i) > ((n) - (o))) + /* + * softmagic - lookup one file in parsed, in-memory copy of database + * Passed the name and FILE * of one file to be typed. +@@ -67,13 +68,13 @@ private void cvt_64(union VALUETYPE *, const struc + /*ARGSUSED1*/ /* nbytes passed for regularity, maybe need later */ + protected int + file_softmagic(struct magic_set *ms, const unsigned char *buf, size_t nbytes, +- int mode, int text) ++ size_t level, int mode, int text) + { + struct mlist *ml; + int rv; + for (ml = ms->mlist->next; ml != ms->mlist; ml = ml->next) + if ((rv = match(ms, ml->magic, ml->nmagic, buf, nbytes, mode, +- text)) != 0) ++ text, level)) != 0) + return rv; + + return 0; +@@ -108,7 +109,8 @@ file_softmagic(struct magic_set *ms, const unsigne + */ + private int + match(struct magic_set *ms, struct magic *magic, uint32_t nmagic, +- const unsigned char *s, size_t nbytes, int mode, int text) ++ const unsigned char *s, size_t nbytes, int mode, int text, ++ int recursion_level) + { + uint32_t magindex = 0; + unsigned int cont_level = 0; +@@ -140,7 +142,7 @@ match(struct magic_set *ms, struct magic *magic, u + ms->line = m->lineno; + + /* if main entry matches, print it... */ +- switch (mget(ms, s, m, nbytes, cont_level, text)) { ++ switch (mget(ms, s, m, nbytes, cont_level, text, recursion_level + 1)) { + case -1: + return -1; + case 0: +@@ -223,7 +225,7 @@ match(struct magic_set *ms, struct magic *magic, u + continue; + } + #endif +- switch (mget(ms, s, m, nbytes, cont_level, text)) { ++ switch (mget(ms, s, m, nbytes, cont_level, text, recursion_level + 1)) { + case -1: + return -1; + case 0: +@@ -1018,12 +1020,18 @@ mcopy(struct magic_set *ms, union VALUETYPE *p, in + + private int + mget(struct magic_set *ms, const unsigned char *s, +- struct magic *m, size_t nbytes, unsigned int cont_level, int text) ++ struct magic *m, size_t nbytes, unsigned int cont_level, int text, ++ int recursion_level) + { + uint32_t offset = ms->offset; + uint32_t count = m->str_range; + union VALUETYPE *p = &ms->ms_value; + ++ if (recursion_level >= 20) { ++ file_error(ms, 0, "recursion nesting exceeded"); ++ return -1; ++ } ++ + if (mcopy(ms, p, m->type, m->flag & INDIR, s, offset, nbytes, count) == -1) + return -1; + +@@ -1073,7 +1081,7 @@ mget(struct magic_set *ms, const unsigned char *s, + } + switch (m->in_type) { + case FILE_BYTE: +- if (nbytes < (offset + 1)) ++ if (OFFSET_OOB(nbytes, offset, 1)) + return 0; + if (off) { + switch (m->in_op & FILE_OPS_MASK) { +@@ -1108,7 +1116,7 @@ mget(struct magic_set *ms, const unsigned char *s, + offset = ~offset; + break; + case FILE_BESHORT: +- if (nbytes < (offset + 2)) ++ if (OFFSET_OOB(nbytes, offset, 2)) + return 0; + if (off) { + switch (m->in_op & FILE_OPS_MASK) { +@@ -1160,7 +1168,7 @@ mget(struct magic_set *ms, const unsigned char *s, + offset = ~offset; + break; + case FILE_LESHORT: +- if (nbytes < (offset + 2)) ++ if (OFFSET_OOB(nbytes, offset, 2)) + return 0; + if (off) { + switch (m->in_op & FILE_OPS_MASK) { +@@ -1212,7 +1220,7 @@ mget(struct magic_set *ms, const unsigned char *s, + offset = ~offset; + break; + case FILE_SHORT: +- if (nbytes < (offset + 2)) ++ if (OFFSET_OOB(nbytes, offset, 2)) + return 0; + if (off) { + switch (m->in_op & FILE_OPS_MASK) { +@@ -1249,7 +1257,7 @@ mget(struct magic_set *ms, const unsigned char *s, + break; + case FILE_BELONG: + case FILE_BEID3: +- if (nbytes < (offset + 4)) ++ if (OFFSET_OOB(nbytes, offset, 4)) + return 0; + if (off) { + switch (m->in_op & FILE_OPS_MASK) { +@@ -1320,7 +1328,7 @@ mget(struct magic_set *ms, const unsigned char *s, + break; + case FILE_LELONG: + case FILE_LEID3: +- if (nbytes < (offset + 4)) ++ if (OFFSET_OOB(nbytes, offset, 4)) + return 0; + if (off) { + switch (m->in_op & FILE_OPS_MASK) { +@@ -1390,7 +1398,7 @@ mget(struct magic_set *ms, const unsigned char *s, + offset = ~offset; + break; + case FILE_MELONG: +- if (nbytes < (offset + 4)) ++ if (OFFSET_OOB(nbytes, offset, 4)) + return 0; + if (off) { + switch (m->in_op & FILE_OPS_MASK) { +@@ -1460,7 +1468,7 @@ mget(struct magic_set *ms, const unsigned char *s, + offset = ~offset; + break; + case FILE_LONG: +- if (nbytes < (offset + 4)) ++ if (OFFSET_OOB(nbytes, offset, 4)) + return 0; + if (off) { + switch (m->in_op & FILE_OPS_MASK) { +@@ -1527,7 +1535,7 @@ mget(struct magic_set *ms, const unsigned char *s, + /* Verify we have enough data to match magic type */ + switch (m->type) { + case FILE_BYTE: +- if (nbytes < (offset + 1)) /* should alway be true */ ++ if (OFFSET_OOB(nbytes, offset, 1)) + return 0; + break; + +@@ -1534,7 +1542,7 @@ mget(struct magic_set *ms, const unsigned char *s, + case FILE_SHORT: + case FILE_BESHORT: + case FILE_LESHORT: +- if (nbytes < (offset + 2)) ++ if (OFFSET_OOB(nbytes, offset, 2)) + return 0; + break; + +@@ -1553,7 +1561,7 @@ mget(struct magic_set *ms, const unsigned char *s, + case FILE_FLOAT: + case FILE_BEFLOAT: + case FILE_LEFLOAT: +- if (nbytes < (offset + 4)) ++ if (OFFSET_OOB(nbytes, offset, 4)) + return 0; + break; + +@@ -1560,7 +1568,7 @@ mget(struct magic_set *ms, const unsigned char *s, + case FILE_DOUBLE: + case FILE_BEDOUBLE: + case FILE_LEDOUBLE: +- if (nbytes < (offset + 8)) ++ if (OFFSET_OOB(nbytes, offset, 8)) + return 0; + break; + +@@ -1567,7 +1575,7 @@ mget(struct magic_set *ms, const unsigned char *s, + case FILE_STRING: + case FILE_PSTRING: + case FILE_SEARCH: +- if (nbytes < (offset + m->vallen)) ++ if (OFFSET_OOB(nbytes, offset, m->vallen)) + return 0; + break; + +@@ -1577,6 +1585,8 @@ mget(struct magic_set *ms, const unsigned char *s, + break; + + case FILE_INDIRECT: ++ if (offset == 0) ++ return 0; + if ((ms->flags & (MAGIC_MIME|MAGIC_APPLE)) == 0 && + file_printf(ms, "%s", m->desc) == -1) + return -1; +@@ -1583,7 +1593,7 @@ mget(struct magic_set *ms, const unsigned char *s, + if (nbytes < offset) + return 0; + return file_softmagic(ms, s + offset, nbytes - offset, +- BINTEST, text); ++ recursion_level, BINTEST, text); + + case FILE_DEFAULT: /* nothing to check */ + default: Index: user/cperciva/freebsd-update-build/patches/9.3-RC1/2-SA-14:17.kmem =================================================================== --- user/cperciva/freebsd-update-build/patches/9.3-RC1/2-SA-14:17.kmem (nonexistent) +++ user/cperciva/freebsd-update-build/patches/9.3-RC1/2-SA-14:17.kmem (revision 293366) @@ -0,0 +1,263 @@ +Index: sys/kern/uipc_sockbuf.c +=================================================================== +--- sys/kern/uipc_sockbuf.c (revision 268273) ++++ sys/kern/uipc_sockbuf.c (working copy) +@@ -1045,6 +1045,11 @@ sbcreatecontrol(caddr_t p, int size, int type, int + m->m_len = 0; + KASSERT(CMSG_SPACE((u_int)size) <= M_TRAILINGSPACE(m), + ("sbcreatecontrol: short mbuf")); ++ /* ++ * Don't leave the padding between the msg header and the ++ * cmsg data and the padding after the cmsg data un-initialized. ++ */ ++ bzero(cp, CMSG_SPACE((u_int)size)); + if (p != NULL) + (void)memcpy(CMSG_DATA(cp), p, size); + m->m_len = CMSG_SPACE(size); +Index: sys/netinet/sctp_auth.c +=================================================================== +--- sys/netinet/sctp_auth.c (revision 268273) ++++ sys/netinet/sctp_auth.c (working copy) +@@ -1790,6 +1790,7 @@ sctp_notify_authentication(struct sctp_tcb *stcb, + + SCTP_BUF_LEN(m_notify) = 0; + auth = mtod(m_notify, struct sctp_authkey_event *); ++ memset(auth, 0, sizeof(struct sctp_authkey_event)); + auth->auth_type = SCTP_AUTHENTICATION_EVENT; + auth->auth_flags = 0; + auth->auth_length = sizeof(*auth); +Index: sys/netinet/sctp_indata.c +=================================================================== +--- sys/netinet/sctp_indata.c (revision 268273) ++++ sys/netinet/sctp_indata.c (working copy) +@@ -250,6 +250,11 @@ sctp_build_ctl_nchunk(struct sctp_inpcb *inp, stru + + /* We need a CMSG header followed by the struct */ + cmh = mtod(ret, struct cmsghdr *); ++ /* ++ * Make sure that there is no un-initialized padding between the ++ * cmsg header and cmsg data and after the cmsg data. ++ */ ++ memset(cmh, 0, len); + if (sctp_is_feature_on(inp, SCTP_PCB_FLAGS_RECVRCVINFO)) { + cmh->cmsg_level = IPPROTO_SCTP; + cmh->cmsg_len = CMSG_LEN(sizeof(struct sctp_rcvinfo)); +Index: sys/netinet/sctputil.c +=================================================================== +--- sys/netinet/sctputil.c (revision 268273) ++++ sys/netinet/sctputil.c (working copy) +@@ -2622,6 +2622,7 @@ sctp_notify_assoc_change(uint16_t state, struct sc + } + SCTP_BUF_NEXT(m_notify) = NULL; + sac = mtod(m_notify, struct sctp_assoc_change *); ++ memset(sac, 0, notif_len); + sac->sac_type = SCTP_ASSOC_CHANGE; + sac->sac_flags = 0; + sac->sac_length = sizeof(struct sctp_assoc_change); +@@ -2835,11 +2836,10 @@ sctp_notify_send_failed(struct sctp_tcb *stcb, uin + if (m_notify == NULL) + /* no space left */ + return; +- length += chk->send_size; +- length -= sizeof(struct sctp_data_chunk); + SCTP_BUF_LEN(m_notify) = 0; + if (sctp_stcb_is_feature_on(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_RECVNSENDFAILEVNT)) { + ssfe = mtod(m_notify, struct sctp_send_failed_event *); ++ memset(ssfe, 0, length); + ssfe->ssfe_type = SCTP_SEND_FAILED_EVENT; + if (sent) { + ssfe->ssfe_flags = SCTP_DATA_SENT; +@@ -2846,10 +2846,11 @@ sctp_notify_send_failed(struct sctp_tcb *stcb, uin + } else { + ssfe->ssfe_flags = SCTP_DATA_UNSENT; + } ++ length += chk->send_size; ++ length -= sizeof(struct sctp_data_chunk); + ssfe->ssfe_length = length; + ssfe->ssfe_error = error; + /* not exactly what the user sent in, but should be close :) */ +- bzero(&ssfe->ssfe_info, sizeof(ssfe->ssfe_info)); + ssfe->ssfe_info.snd_sid = chk->rec.data.stream_number; + ssfe->ssfe_info.snd_flags = chk->rec.data.rcv_flags; + ssfe->ssfe_info.snd_ppid = chk->rec.data.payloadtype; +@@ -2859,6 +2860,7 @@ sctp_notify_send_failed(struct sctp_tcb *stcb, uin + SCTP_BUF_LEN(m_notify) = sizeof(struct sctp_send_failed_event); + } else { + ssf = mtod(m_notify, struct sctp_send_failed *); ++ memset(ssf, 0, length); + ssf->ssf_type = SCTP_SEND_FAILED; + if (sent) { + ssf->ssf_flags = SCTP_DATA_SENT; +@@ -2865,6 +2867,8 @@ sctp_notify_send_failed(struct sctp_tcb *stcb, uin + } else { + ssf->ssf_flags = SCTP_DATA_UNSENT; + } ++ length += chk->send_size; ++ length -= sizeof(struct sctp_data_chunk); + ssf->ssf_length = length; + ssf->ssf_error = error; + /* not exactly what the user sent in, but should be close :) */ +@@ -2948,16 +2952,16 @@ sctp_notify_send_failed2(struct sctp_tcb *stcb, ui + /* no space left */ + return; + } +- length += sp->length; + SCTP_BUF_LEN(m_notify) = 0; + if (sctp_stcb_is_feature_on(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_RECVNSENDFAILEVNT)) { + ssfe = mtod(m_notify, struct sctp_send_failed_event *); ++ memset(ssfe, 0, length); + ssfe->ssfe_type = SCTP_SEND_FAILED_EVENT; + ssfe->ssfe_flags = SCTP_DATA_UNSENT; ++ length += sp->length; + ssfe->ssfe_length = length; + ssfe->ssfe_error = error; + /* not exactly what the user sent in, but should be close :) */ +- bzero(&ssfe->ssfe_info, sizeof(ssfe->ssfe_info)); + ssfe->ssfe_info.snd_sid = sp->stream; + if (sp->some_taken) { + ssfe->ssfe_info.snd_flags = SCTP_DATA_LAST_FRAG; +@@ -2971,12 +2975,13 @@ sctp_notify_send_failed2(struct sctp_tcb *stcb, ui + SCTP_BUF_LEN(m_notify) = sizeof(struct sctp_send_failed_event); + } else { + ssf = mtod(m_notify, struct sctp_send_failed *); ++ memset(ssf, 0, length); + ssf->ssf_type = SCTP_SEND_FAILED; + ssf->ssf_flags = SCTP_DATA_UNSENT; ++ length += sp->length; + ssf->ssf_length = length; + ssf->ssf_error = error; + /* not exactly what the user sent in, but should be close :) */ +- bzero(&ssf->ssf_info, sizeof(ssf->ssf_info)); + ssf->ssf_info.sinfo_stream = sp->stream; + ssf->ssf_info.sinfo_ssn = 0; + if (sp->some_taken) { +@@ -3038,6 +3043,7 @@ sctp_notify_adaptation_layer(struct sctp_tcb *stcb + return; + SCTP_BUF_LEN(m_notify) = 0; + sai = mtod(m_notify, struct sctp_adaptation_event *); ++ memset(sai, 0, sizeof(struct sctp_adaptation_event)); + sai->sai_type = SCTP_ADAPTATION_INDICATION; + sai->sai_flags = 0; + sai->sai_length = sizeof(struct sctp_adaptation_event); +@@ -3093,6 +3099,7 @@ sctp_notify_partial_delivery_indication(struct sct + return; + SCTP_BUF_LEN(m_notify) = 0; + pdapi = mtod(m_notify, struct sctp_pdapi_event *); ++ memset(pdapi, 0, sizeof(struct sctp_pdapi_event)); + pdapi->pdapi_type = SCTP_PARTIAL_DELIVERY_EVENT; + pdapi->pdapi_flags = 0; + pdapi->pdapi_length = sizeof(struct sctp_pdapi_event); +@@ -3202,6 +3209,7 @@ sctp_notify_shutdown_event(struct sctp_tcb *stcb) + /* no space left */ + return; + sse = mtod(m_notify, struct sctp_shutdown_event *); ++ memset(sse, 0, sizeof(struct sctp_shutdown_event)); + sse->sse_type = SCTP_SHUTDOWN_EVENT; + sse->sse_flags = 0; + sse->sse_length = sizeof(struct sctp_shutdown_event); +@@ -3252,6 +3260,7 @@ sctp_notify_sender_dry_event(struct sctp_tcb *stcb + } + SCTP_BUF_LEN(m_notify) = 0; + event = mtod(m_notify, struct sctp_sender_dry_event *); ++ memset(event, 0, sizeof(struct sctp_sender_dry_event)); + event->sender_dry_type = SCTP_SENDER_DRY_EVENT; + event->sender_dry_flags = 0; + event->sender_dry_length = sizeof(struct sctp_sender_dry_event); +@@ -3284,7 +3293,6 @@ sctp_notify_stream_reset_add(struct sctp_tcb *stcb + struct mbuf *m_notify; + struct sctp_queued_to_read *control; + struct sctp_stream_change_event *stradd; +- int len; + + if ((stcb == NULL) || + (sctp_stcb_is_feature_off(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_STREAM_CHANGEEVNT))) { +@@ -3297,25 +3305,20 @@ sctp_notify_stream_reset_add(struct sctp_tcb *stcb + return; + } + stcb->asoc.peer_req_out = 0; +- m_notify = sctp_get_mbuf_for_msg(MCLBYTES, 0, M_DONTWAIT, 1, MT_DATA); ++ m_notify = sctp_get_mbuf_for_msg(sizeof(struct sctp_stream_change_event), 0, M_DONTWAIT, 1, MT_DATA); + if (m_notify == NULL) + /* no space left */ + return; + SCTP_BUF_LEN(m_notify) = 0; +- len = sizeof(struct sctp_stream_change_event); +- if (len > M_TRAILINGSPACE(m_notify)) { +- /* never enough room */ +- sctp_m_freem(m_notify); +- return; +- } + stradd = mtod(m_notify, struct sctp_stream_change_event *); ++ memset(stradd, 0, sizeof(struct sctp_stream_change_event)); + stradd->strchange_type = SCTP_STREAM_CHANGE_EVENT; + stradd->strchange_flags = flag; +- stradd->strchange_length = len; ++ stradd->strchange_length = sizeof(struct sctp_stream_change_event); + stradd->strchange_assoc_id = sctp_get_associd(stcb); + stradd->strchange_instrms = numberin; + stradd->strchange_outstrms = numberout; +- SCTP_BUF_LEN(m_notify) = len; ++ SCTP_BUF_LEN(m_notify) = sizeof(struct sctp_stream_change_event); + SCTP_BUF_NEXT(m_notify) = NULL; + if (sctp_sbspace(&stcb->asoc, &stcb->sctp_socket->so_rcv) < SCTP_BUF_LEN(m_notify)) { + /* no space */ +@@ -3346,7 +3349,6 @@ sctp_notify_stream_reset_tsn(struct sctp_tcb *stcb + struct mbuf *m_notify; + struct sctp_queued_to_read *control; + struct sctp_assoc_reset_event *strasoc; +- int len; + + if ((stcb == NULL) || + (sctp_stcb_is_feature_off(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_ASSOC_RESETEVNT))) { +@@ -3353,25 +3355,20 @@ sctp_notify_stream_reset_tsn(struct sctp_tcb *stcb + /* event not enabled */ + return; + } +- m_notify = sctp_get_mbuf_for_msg(MCLBYTES, 0, M_DONTWAIT, 1, MT_DATA); ++ m_notify = sctp_get_mbuf_for_msg(sizeof(struct sctp_assoc_reset_event), 0, M_DONTWAIT, 1, MT_DATA); + if (m_notify == NULL) + /* no space left */ + return; + SCTP_BUF_LEN(m_notify) = 0; +- len = sizeof(struct sctp_assoc_reset_event); +- if (len > M_TRAILINGSPACE(m_notify)) { +- /* never enough room */ +- sctp_m_freem(m_notify); +- return; +- } + strasoc = mtod(m_notify, struct sctp_assoc_reset_event *); ++ memset(strasoc, 0, sizeof(struct sctp_assoc_reset_event)); + strasoc->assocreset_type = SCTP_ASSOC_RESET_EVENT; + strasoc->assocreset_flags = flag; +- strasoc->assocreset_length = len; ++ strasoc->assocreset_length = sizeof(struct sctp_assoc_reset_event); + strasoc->assocreset_assoc_id = sctp_get_associd(stcb); + strasoc->assocreset_local_tsn = sending_tsn; + strasoc->assocreset_remote_tsn = recv_tsn; +- SCTP_BUF_LEN(m_notify) = len; ++ SCTP_BUF_LEN(m_notify) = sizeof(struct sctp_assoc_reset_event); + SCTP_BUF_NEXT(m_notify) = NULL; + if (sctp_sbspace(&stcb->asoc, &stcb->sctp_socket->so_rcv) < SCTP_BUF_LEN(m_notify)) { + /* no space */ +@@ -3424,6 +3421,7 @@ sctp_notify_stream_reset(struct sctp_tcb *stcb, + return; + } + strreset = mtod(m_notify, struct sctp_stream_reset_event *); ++ memset(strreset, 0, len); + strreset->strreset_type = SCTP_STREAM_RESET_EVENT; + strreset->strreset_flags = flag; + strreset->strreset_length = len; +@@ -6236,9 +6234,12 @@ sctp_soreceive(struct socket *so, + fromlen = 0; + } + ++ if (filling_sinfo) { ++ memset(&sinfo, 0, sizeof(struct sctp_extrcvinfo)); ++ } + error = sctp_sorecvmsg(so, uio, mp0, from, fromlen, flagsp, + (struct sctp_sndrcvinfo *)&sinfo, filling_sinfo); +- if ((controlp) && (filling_sinfo)) { ++ if (controlp != NULL) { + /* copy back the sinfo in a CMSG format */ + if (filling_sinfo) + *controlp = sctp_build_ctl_nchunk(inp, Index: user/cperciva/freebsd-update-build/patches/9.3-RC2/1-SA-14:17.kmem =================================================================== --- user/cperciva/freebsd-update-build/patches/9.3-RC2/1-SA-14:17.kmem (nonexistent) +++ user/cperciva/freebsd-update-build/patches/9.3-RC2/1-SA-14:17.kmem (revision 293366) @@ -0,0 +1,263 @@ +Index: sys/kern/uipc_sockbuf.c +=================================================================== +--- sys/kern/uipc_sockbuf.c (revision 268273) ++++ sys/kern/uipc_sockbuf.c (working copy) +@@ -1045,6 +1045,11 @@ sbcreatecontrol(caddr_t p, int size, int type, int + m->m_len = 0; + KASSERT(CMSG_SPACE((u_int)size) <= M_TRAILINGSPACE(m), + ("sbcreatecontrol: short mbuf")); ++ /* ++ * Don't leave the padding between the msg header and the ++ * cmsg data and the padding after the cmsg data un-initialized. ++ */ ++ bzero(cp, CMSG_SPACE((u_int)size)); + if (p != NULL) + (void)memcpy(CMSG_DATA(cp), p, size); + m->m_len = CMSG_SPACE(size); +Index: sys/netinet/sctp_auth.c +=================================================================== +--- sys/netinet/sctp_auth.c (revision 268273) ++++ sys/netinet/sctp_auth.c (working copy) +@@ -1790,6 +1790,7 @@ sctp_notify_authentication(struct sctp_tcb *stcb, + + SCTP_BUF_LEN(m_notify) = 0; + auth = mtod(m_notify, struct sctp_authkey_event *); ++ memset(auth, 0, sizeof(struct sctp_authkey_event)); + auth->auth_type = SCTP_AUTHENTICATION_EVENT; + auth->auth_flags = 0; + auth->auth_length = sizeof(*auth); +Index: sys/netinet/sctp_indata.c +=================================================================== +--- sys/netinet/sctp_indata.c (revision 268273) ++++ sys/netinet/sctp_indata.c (working copy) +@@ -250,6 +250,11 @@ sctp_build_ctl_nchunk(struct sctp_inpcb *inp, stru + + /* We need a CMSG header followed by the struct */ + cmh = mtod(ret, struct cmsghdr *); ++ /* ++ * Make sure that there is no un-initialized padding between the ++ * cmsg header and cmsg data and after the cmsg data. ++ */ ++ memset(cmh, 0, len); + if (sctp_is_feature_on(inp, SCTP_PCB_FLAGS_RECVRCVINFO)) { + cmh->cmsg_level = IPPROTO_SCTP; + cmh->cmsg_len = CMSG_LEN(sizeof(struct sctp_rcvinfo)); +Index: sys/netinet/sctputil.c +=================================================================== +--- sys/netinet/sctputil.c (revision 268273) ++++ sys/netinet/sctputil.c (working copy) +@@ -2622,6 +2622,7 @@ sctp_notify_assoc_change(uint16_t state, struct sc + } + SCTP_BUF_NEXT(m_notify) = NULL; + sac = mtod(m_notify, struct sctp_assoc_change *); ++ memset(sac, 0, notif_len); + sac->sac_type = SCTP_ASSOC_CHANGE; + sac->sac_flags = 0; + sac->sac_length = sizeof(struct sctp_assoc_change); +@@ -2835,11 +2836,10 @@ sctp_notify_send_failed(struct sctp_tcb *stcb, uin + if (m_notify == NULL) + /* no space left */ + return; +- length += chk->send_size; +- length -= sizeof(struct sctp_data_chunk); + SCTP_BUF_LEN(m_notify) = 0; + if (sctp_stcb_is_feature_on(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_RECVNSENDFAILEVNT)) { + ssfe = mtod(m_notify, struct sctp_send_failed_event *); ++ memset(ssfe, 0, length); + ssfe->ssfe_type = SCTP_SEND_FAILED_EVENT; + if (sent) { + ssfe->ssfe_flags = SCTP_DATA_SENT; +@@ -2846,10 +2846,11 @@ sctp_notify_send_failed(struct sctp_tcb *stcb, uin + } else { + ssfe->ssfe_flags = SCTP_DATA_UNSENT; + } ++ length += chk->send_size; ++ length -= sizeof(struct sctp_data_chunk); + ssfe->ssfe_length = length; + ssfe->ssfe_error = error; + /* not exactly what the user sent in, but should be close :) */ +- bzero(&ssfe->ssfe_info, sizeof(ssfe->ssfe_info)); + ssfe->ssfe_info.snd_sid = chk->rec.data.stream_number; + ssfe->ssfe_info.snd_flags = chk->rec.data.rcv_flags; + ssfe->ssfe_info.snd_ppid = chk->rec.data.payloadtype; +@@ -2859,6 +2860,7 @@ sctp_notify_send_failed(struct sctp_tcb *stcb, uin + SCTP_BUF_LEN(m_notify) = sizeof(struct sctp_send_failed_event); + } else { + ssf = mtod(m_notify, struct sctp_send_failed *); ++ memset(ssf, 0, length); + ssf->ssf_type = SCTP_SEND_FAILED; + if (sent) { + ssf->ssf_flags = SCTP_DATA_SENT; +@@ -2865,6 +2867,8 @@ sctp_notify_send_failed(struct sctp_tcb *stcb, uin + } else { + ssf->ssf_flags = SCTP_DATA_UNSENT; + } ++ length += chk->send_size; ++ length -= sizeof(struct sctp_data_chunk); + ssf->ssf_length = length; + ssf->ssf_error = error; + /* not exactly what the user sent in, but should be close :) */ +@@ -2948,16 +2952,16 @@ sctp_notify_send_failed2(struct sctp_tcb *stcb, ui + /* no space left */ + return; + } +- length += sp->length; + SCTP_BUF_LEN(m_notify) = 0; + if (sctp_stcb_is_feature_on(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_RECVNSENDFAILEVNT)) { + ssfe = mtod(m_notify, struct sctp_send_failed_event *); ++ memset(ssfe, 0, length); + ssfe->ssfe_type = SCTP_SEND_FAILED_EVENT; + ssfe->ssfe_flags = SCTP_DATA_UNSENT; ++ length += sp->length; + ssfe->ssfe_length = length; + ssfe->ssfe_error = error; + /* not exactly what the user sent in, but should be close :) */ +- bzero(&ssfe->ssfe_info, sizeof(ssfe->ssfe_info)); + ssfe->ssfe_info.snd_sid = sp->stream; + if (sp->some_taken) { + ssfe->ssfe_info.snd_flags = SCTP_DATA_LAST_FRAG; +@@ -2971,12 +2975,13 @@ sctp_notify_send_failed2(struct sctp_tcb *stcb, ui + SCTP_BUF_LEN(m_notify) = sizeof(struct sctp_send_failed_event); + } else { + ssf = mtod(m_notify, struct sctp_send_failed *); ++ memset(ssf, 0, length); + ssf->ssf_type = SCTP_SEND_FAILED; + ssf->ssf_flags = SCTP_DATA_UNSENT; ++ length += sp->length; + ssf->ssf_length = length; + ssf->ssf_error = error; + /* not exactly what the user sent in, but should be close :) */ +- bzero(&ssf->ssf_info, sizeof(ssf->ssf_info)); + ssf->ssf_info.sinfo_stream = sp->stream; + ssf->ssf_info.sinfo_ssn = 0; + if (sp->some_taken) { +@@ -3038,6 +3043,7 @@ sctp_notify_adaptation_layer(struct sctp_tcb *stcb + return; + SCTP_BUF_LEN(m_notify) = 0; + sai = mtod(m_notify, struct sctp_adaptation_event *); ++ memset(sai, 0, sizeof(struct sctp_adaptation_event)); + sai->sai_type = SCTP_ADAPTATION_INDICATION; + sai->sai_flags = 0; + sai->sai_length = sizeof(struct sctp_adaptation_event); +@@ -3093,6 +3099,7 @@ sctp_notify_partial_delivery_indication(struct sct + return; + SCTP_BUF_LEN(m_notify) = 0; + pdapi = mtod(m_notify, struct sctp_pdapi_event *); ++ memset(pdapi, 0, sizeof(struct sctp_pdapi_event)); + pdapi->pdapi_type = SCTP_PARTIAL_DELIVERY_EVENT; + pdapi->pdapi_flags = 0; + pdapi->pdapi_length = sizeof(struct sctp_pdapi_event); +@@ -3202,6 +3209,7 @@ sctp_notify_shutdown_event(struct sctp_tcb *stcb) + /* no space left */ + return; + sse = mtod(m_notify, struct sctp_shutdown_event *); ++ memset(sse, 0, sizeof(struct sctp_shutdown_event)); + sse->sse_type = SCTP_SHUTDOWN_EVENT; + sse->sse_flags = 0; + sse->sse_length = sizeof(struct sctp_shutdown_event); +@@ -3252,6 +3260,7 @@ sctp_notify_sender_dry_event(struct sctp_tcb *stcb + } + SCTP_BUF_LEN(m_notify) = 0; + event = mtod(m_notify, struct sctp_sender_dry_event *); ++ memset(event, 0, sizeof(struct sctp_sender_dry_event)); + event->sender_dry_type = SCTP_SENDER_DRY_EVENT; + event->sender_dry_flags = 0; + event->sender_dry_length = sizeof(struct sctp_sender_dry_event); +@@ -3284,7 +3293,6 @@ sctp_notify_stream_reset_add(struct sctp_tcb *stcb + struct mbuf *m_notify; + struct sctp_queued_to_read *control; + struct sctp_stream_change_event *stradd; +- int len; + + if ((stcb == NULL) || + (sctp_stcb_is_feature_off(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_STREAM_CHANGEEVNT))) { +@@ -3297,25 +3305,20 @@ sctp_notify_stream_reset_add(struct sctp_tcb *stcb + return; + } + stcb->asoc.peer_req_out = 0; +- m_notify = sctp_get_mbuf_for_msg(MCLBYTES, 0, M_DONTWAIT, 1, MT_DATA); ++ m_notify = sctp_get_mbuf_for_msg(sizeof(struct sctp_stream_change_event), 0, M_DONTWAIT, 1, MT_DATA); + if (m_notify == NULL) + /* no space left */ + return; + SCTP_BUF_LEN(m_notify) = 0; +- len = sizeof(struct sctp_stream_change_event); +- if (len > M_TRAILINGSPACE(m_notify)) { +- /* never enough room */ +- sctp_m_freem(m_notify); +- return; +- } + stradd = mtod(m_notify, struct sctp_stream_change_event *); ++ memset(stradd, 0, sizeof(struct sctp_stream_change_event)); + stradd->strchange_type = SCTP_STREAM_CHANGE_EVENT; + stradd->strchange_flags = flag; +- stradd->strchange_length = len; ++ stradd->strchange_length = sizeof(struct sctp_stream_change_event); + stradd->strchange_assoc_id = sctp_get_associd(stcb); + stradd->strchange_instrms = numberin; + stradd->strchange_outstrms = numberout; +- SCTP_BUF_LEN(m_notify) = len; ++ SCTP_BUF_LEN(m_notify) = sizeof(struct sctp_stream_change_event); + SCTP_BUF_NEXT(m_notify) = NULL; + if (sctp_sbspace(&stcb->asoc, &stcb->sctp_socket->so_rcv) < SCTP_BUF_LEN(m_notify)) { + /* no space */ +@@ -3346,7 +3349,6 @@ sctp_notify_stream_reset_tsn(struct sctp_tcb *stcb + struct mbuf *m_notify; + struct sctp_queued_to_read *control; + struct sctp_assoc_reset_event *strasoc; +- int len; + + if ((stcb == NULL) || + (sctp_stcb_is_feature_off(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_ASSOC_RESETEVNT))) { +@@ -3353,25 +3355,20 @@ sctp_notify_stream_reset_tsn(struct sctp_tcb *stcb + /* event not enabled */ + return; + } +- m_notify = sctp_get_mbuf_for_msg(MCLBYTES, 0, M_DONTWAIT, 1, MT_DATA); ++ m_notify = sctp_get_mbuf_for_msg(sizeof(struct sctp_assoc_reset_event), 0, M_DONTWAIT, 1, MT_DATA); + if (m_notify == NULL) + /* no space left */ + return; + SCTP_BUF_LEN(m_notify) = 0; +- len = sizeof(struct sctp_assoc_reset_event); +- if (len > M_TRAILINGSPACE(m_notify)) { +- /* never enough room */ +- sctp_m_freem(m_notify); +- return; +- } + strasoc = mtod(m_notify, struct sctp_assoc_reset_event *); ++ memset(strasoc, 0, sizeof(struct sctp_assoc_reset_event)); + strasoc->assocreset_type = SCTP_ASSOC_RESET_EVENT; + strasoc->assocreset_flags = flag; +- strasoc->assocreset_length = len; ++ strasoc->assocreset_length = sizeof(struct sctp_assoc_reset_event); + strasoc->assocreset_assoc_id = sctp_get_associd(stcb); + strasoc->assocreset_local_tsn = sending_tsn; + strasoc->assocreset_remote_tsn = recv_tsn; +- SCTP_BUF_LEN(m_notify) = len; ++ SCTP_BUF_LEN(m_notify) = sizeof(struct sctp_assoc_reset_event); + SCTP_BUF_NEXT(m_notify) = NULL; + if (sctp_sbspace(&stcb->asoc, &stcb->sctp_socket->so_rcv) < SCTP_BUF_LEN(m_notify)) { + /* no space */ +@@ -3424,6 +3421,7 @@ sctp_notify_stream_reset(struct sctp_tcb *stcb, + return; + } + strreset = mtod(m_notify, struct sctp_stream_reset_event *); ++ memset(strreset, 0, len); + strreset->strreset_type = SCTP_STREAM_RESET_EVENT; + strreset->strreset_flags = flag; + strreset->strreset_length = len; +@@ -6236,9 +6234,12 @@ sctp_soreceive(struct socket *so, + fromlen = 0; + } + ++ if (filling_sinfo) { ++ memset(&sinfo, 0, sizeof(struct sctp_extrcvinfo)); ++ } + error = sctp_sorecvmsg(so, uio, mp0, from, fromlen, flagsp, + (struct sctp_sndrcvinfo *)&sinfo, filling_sinfo); +- if ((controlp) && (filling_sinfo)) { ++ if (controlp != NULL) { + /* copy back the sinfo in a CMSG format */ + if (filling_sinfo) + *controlp = sctp_build_ctl_nchunk(inp, Index: user/cperciva/freebsd-update-build/patches/9.3-RC3/1-SA-14:17.kmem =================================================================== --- user/cperciva/freebsd-update-build/patches/9.3-RC3/1-SA-14:17.kmem (nonexistent) +++ user/cperciva/freebsd-update-build/patches/9.3-RC3/1-SA-14:17.kmem (revision 293366) @@ -0,0 +1,263 @@ +Index: sys/kern/uipc_sockbuf.c +=================================================================== +--- sys/kern/uipc_sockbuf.c (revision 268273) ++++ sys/kern/uipc_sockbuf.c (working copy) +@@ -1045,6 +1045,11 @@ sbcreatecontrol(caddr_t p, int size, int type, int + m->m_len = 0; + KASSERT(CMSG_SPACE((u_int)size) <= M_TRAILINGSPACE(m), + ("sbcreatecontrol: short mbuf")); ++ /* ++ * Don't leave the padding between the msg header and the ++ * cmsg data and the padding after the cmsg data un-initialized. ++ */ ++ bzero(cp, CMSG_SPACE((u_int)size)); + if (p != NULL) + (void)memcpy(CMSG_DATA(cp), p, size); + m->m_len = CMSG_SPACE(size); +Index: sys/netinet/sctp_auth.c +=================================================================== +--- sys/netinet/sctp_auth.c (revision 268273) ++++ sys/netinet/sctp_auth.c (working copy) +@@ -1790,6 +1790,7 @@ sctp_notify_authentication(struct sctp_tcb *stcb, + + SCTP_BUF_LEN(m_notify) = 0; + auth = mtod(m_notify, struct sctp_authkey_event *); ++ memset(auth, 0, sizeof(struct sctp_authkey_event)); + auth->auth_type = SCTP_AUTHENTICATION_EVENT; + auth->auth_flags = 0; + auth->auth_length = sizeof(*auth); +Index: sys/netinet/sctp_indata.c +=================================================================== +--- sys/netinet/sctp_indata.c (revision 268273) ++++ sys/netinet/sctp_indata.c (working copy) +@@ -250,6 +250,11 @@ sctp_build_ctl_nchunk(struct sctp_inpcb *inp, stru + + /* We need a CMSG header followed by the struct */ + cmh = mtod(ret, struct cmsghdr *); ++ /* ++ * Make sure that there is no un-initialized padding between the ++ * cmsg header and cmsg data and after the cmsg data. ++ */ ++ memset(cmh, 0, len); + if (sctp_is_feature_on(inp, SCTP_PCB_FLAGS_RECVRCVINFO)) { + cmh->cmsg_level = IPPROTO_SCTP; + cmh->cmsg_len = CMSG_LEN(sizeof(struct sctp_rcvinfo)); +Index: sys/netinet/sctputil.c +=================================================================== +--- sys/netinet/sctputil.c (revision 268273) ++++ sys/netinet/sctputil.c (working copy) +@@ -2622,6 +2622,7 @@ sctp_notify_assoc_change(uint16_t state, struct sc + } + SCTP_BUF_NEXT(m_notify) = NULL; + sac = mtod(m_notify, struct sctp_assoc_change *); ++ memset(sac, 0, notif_len); + sac->sac_type = SCTP_ASSOC_CHANGE; + sac->sac_flags = 0; + sac->sac_length = sizeof(struct sctp_assoc_change); +@@ -2835,11 +2836,10 @@ sctp_notify_send_failed(struct sctp_tcb *stcb, uin + if (m_notify == NULL) + /* no space left */ + return; +- length += chk->send_size; +- length -= sizeof(struct sctp_data_chunk); + SCTP_BUF_LEN(m_notify) = 0; + if (sctp_stcb_is_feature_on(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_RECVNSENDFAILEVNT)) { + ssfe = mtod(m_notify, struct sctp_send_failed_event *); ++ memset(ssfe, 0, length); + ssfe->ssfe_type = SCTP_SEND_FAILED_EVENT; + if (sent) { + ssfe->ssfe_flags = SCTP_DATA_SENT; +@@ -2846,10 +2846,11 @@ sctp_notify_send_failed(struct sctp_tcb *stcb, uin + } else { + ssfe->ssfe_flags = SCTP_DATA_UNSENT; + } ++ length += chk->send_size; ++ length -= sizeof(struct sctp_data_chunk); + ssfe->ssfe_length = length; + ssfe->ssfe_error = error; + /* not exactly what the user sent in, but should be close :) */ +- bzero(&ssfe->ssfe_info, sizeof(ssfe->ssfe_info)); + ssfe->ssfe_info.snd_sid = chk->rec.data.stream_number; + ssfe->ssfe_info.snd_flags = chk->rec.data.rcv_flags; + ssfe->ssfe_info.snd_ppid = chk->rec.data.payloadtype; +@@ -2859,6 +2860,7 @@ sctp_notify_send_failed(struct sctp_tcb *stcb, uin + SCTP_BUF_LEN(m_notify) = sizeof(struct sctp_send_failed_event); + } else { + ssf = mtod(m_notify, struct sctp_send_failed *); ++ memset(ssf, 0, length); + ssf->ssf_type = SCTP_SEND_FAILED; + if (sent) { + ssf->ssf_flags = SCTP_DATA_SENT; +@@ -2865,6 +2867,8 @@ sctp_notify_send_failed(struct sctp_tcb *stcb, uin + } else { + ssf->ssf_flags = SCTP_DATA_UNSENT; + } ++ length += chk->send_size; ++ length -= sizeof(struct sctp_data_chunk); + ssf->ssf_length = length; + ssf->ssf_error = error; + /* not exactly what the user sent in, but should be close :) */ +@@ -2948,16 +2952,16 @@ sctp_notify_send_failed2(struct sctp_tcb *stcb, ui + /* no space left */ + return; + } +- length += sp->length; + SCTP_BUF_LEN(m_notify) = 0; + if (sctp_stcb_is_feature_on(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_RECVNSENDFAILEVNT)) { + ssfe = mtod(m_notify, struct sctp_send_failed_event *); ++ memset(ssfe, 0, length); + ssfe->ssfe_type = SCTP_SEND_FAILED_EVENT; + ssfe->ssfe_flags = SCTP_DATA_UNSENT; ++ length += sp->length; + ssfe->ssfe_length = length; + ssfe->ssfe_error = error; + /* not exactly what the user sent in, but should be close :) */ +- bzero(&ssfe->ssfe_info, sizeof(ssfe->ssfe_info)); + ssfe->ssfe_info.snd_sid = sp->stream; + if (sp->some_taken) { + ssfe->ssfe_info.snd_flags = SCTP_DATA_LAST_FRAG; +@@ -2971,12 +2975,13 @@ sctp_notify_send_failed2(struct sctp_tcb *stcb, ui + SCTP_BUF_LEN(m_notify) = sizeof(struct sctp_send_failed_event); + } else { + ssf = mtod(m_notify, struct sctp_send_failed *); ++ memset(ssf, 0, length); + ssf->ssf_type = SCTP_SEND_FAILED; + ssf->ssf_flags = SCTP_DATA_UNSENT; ++ length += sp->length; + ssf->ssf_length = length; + ssf->ssf_error = error; + /* not exactly what the user sent in, but should be close :) */ +- bzero(&ssf->ssf_info, sizeof(ssf->ssf_info)); + ssf->ssf_info.sinfo_stream = sp->stream; + ssf->ssf_info.sinfo_ssn = 0; + if (sp->some_taken) { +@@ -3038,6 +3043,7 @@ sctp_notify_adaptation_layer(struct sctp_tcb *stcb + return; + SCTP_BUF_LEN(m_notify) = 0; + sai = mtod(m_notify, struct sctp_adaptation_event *); ++ memset(sai, 0, sizeof(struct sctp_adaptation_event)); + sai->sai_type = SCTP_ADAPTATION_INDICATION; + sai->sai_flags = 0; + sai->sai_length = sizeof(struct sctp_adaptation_event); +@@ -3093,6 +3099,7 @@ sctp_notify_partial_delivery_indication(struct sct + return; + SCTP_BUF_LEN(m_notify) = 0; + pdapi = mtod(m_notify, struct sctp_pdapi_event *); ++ memset(pdapi, 0, sizeof(struct sctp_pdapi_event)); + pdapi->pdapi_type = SCTP_PARTIAL_DELIVERY_EVENT; + pdapi->pdapi_flags = 0; + pdapi->pdapi_length = sizeof(struct sctp_pdapi_event); +@@ -3202,6 +3209,7 @@ sctp_notify_shutdown_event(struct sctp_tcb *stcb) + /* no space left */ + return; + sse = mtod(m_notify, struct sctp_shutdown_event *); ++ memset(sse, 0, sizeof(struct sctp_shutdown_event)); + sse->sse_type = SCTP_SHUTDOWN_EVENT; + sse->sse_flags = 0; + sse->sse_length = sizeof(struct sctp_shutdown_event); +@@ -3252,6 +3260,7 @@ sctp_notify_sender_dry_event(struct sctp_tcb *stcb + } + SCTP_BUF_LEN(m_notify) = 0; + event = mtod(m_notify, struct sctp_sender_dry_event *); ++ memset(event, 0, sizeof(struct sctp_sender_dry_event)); + event->sender_dry_type = SCTP_SENDER_DRY_EVENT; + event->sender_dry_flags = 0; + event->sender_dry_length = sizeof(struct sctp_sender_dry_event); +@@ -3284,7 +3293,6 @@ sctp_notify_stream_reset_add(struct sctp_tcb *stcb + struct mbuf *m_notify; + struct sctp_queued_to_read *control; + struct sctp_stream_change_event *stradd; +- int len; + + if ((stcb == NULL) || + (sctp_stcb_is_feature_off(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_STREAM_CHANGEEVNT))) { +@@ -3297,25 +3305,20 @@ sctp_notify_stream_reset_add(struct sctp_tcb *stcb + return; + } + stcb->asoc.peer_req_out = 0; +- m_notify = sctp_get_mbuf_for_msg(MCLBYTES, 0, M_DONTWAIT, 1, MT_DATA); ++ m_notify = sctp_get_mbuf_for_msg(sizeof(struct sctp_stream_change_event), 0, M_DONTWAIT, 1, MT_DATA); + if (m_notify == NULL) + /* no space left */ + return; + SCTP_BUF_LEN(m_notify) = 0; +- len = sizeof(struct sctp_stream_change_event); +- if (len > M_TRAILINGSPACE(m_notify)) { +- /* never enough room */ +- sctp_m_freem(m_notify); +- return; +- } + stradd = mtod(m_notify, struct sctp_stream_change_event *); ++ memset(stradd, 0, sizeof(struct sctp_stream_change_event)); + stradd->strchange_type = SCTP_STREAM_CHANGE_EVENT; + stradd->strchange_flags = flag; +- stradd->strchange_length = len; ++ stradd->strchange_length = sizeof(struct sctp_stream_change_event); + stradd->strchange_assoc_id = sctp_get_associd(stcb); + stradd->strchange_instrms = numberin; + stradd->strchange_outstrms = numberout; +- SCTP_BUF_LEN(m_notify) = len; ++ SCTP_BUF_LEN(m_notify) = sizeof(struct sctp_stream_change_event); + SCTP_BUF_NEXT(m_notify) = NULL; + if (sctp_sbspace(&stcb->asoc, &stcb->sctp_socket->so_rcv) < SCTP_BUF_LEN(m_notify)) { + /* no space */ +@@ -3346,7 +3349,6 @@ sctp_notify_stream_reset_tsn(struct sctp_tcb *stcb + struct mbuf *m_notify; + struct sctp_queued_to_read *control; + struct sctp_assoc_reset_event *strasoc; +- int len; + + if ((stcb == NULL) || + (sctp_stcb_is_feature_off(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_ASSOC_RESETEVNT))) { +@@ -3353,25 +3355,20 @@ sctp_notify_stream_reset_tsn(struct sctp_tcb *stcb + /* event not enabled */ + return; + } +- m_notify = sctp_get_mbuf_for_msg(MCLBYTES, 0, M_DONTWAIT, 1, MT_DATA); ++ m_notify = sctp_get_mbuf_for_msg(sizeof(struct sctp_assoc_reset_event), 0, M_DONTWAIT, 1, MT_DATA); + if (m_notify == NULL) + /* no space left */ + return; + SCTP_BUF_LEN(m_notify) = 0; +- len = sizeof(struct sctp_assoc_reset_event); +- if (len > M_TRAILINGSPACE(m_notify)) { +- /* never enough room */ +- sctp_m_freem(m_notify); +- return; +- } + strasoc = mtod(m_notify, struct sctp_assoc_reset_event *); ++ memset(strasoc, 0, sizeof(struct sctp_assoc_reset_event)); + strasoc->assocreset_type = SCTP_ASSOC_RESET_EVENT; + strasoc->assocreset_flags = flag; +- strasoc->assocreset_length = len; ++ strasoc->assocreset_length = sizeof(struct sctp_assoc_reset_event); + strasoc->assocreset_assoc_id = sctp_get_associd(stcb); + strasoc->assocreset_local_tsn = sending_tsn; + strasoc->assocreset_remote_tsn = recv_tsn; +- SCTP_BUF_LEN(m_notify) = len; ++ SCTP_BUF_LEN(m_notify) = sizeof(struct sctp_assoc_reset_event); + SCTP_BUF_NEXT(m_notify) = NULL; + if (sctp_sbspace(&stcb->asoc, &stcb->sctp_socket->so_rcv) < SCTP_BUF_LEN(m_notify)) { + /* no space */ +@@ -3424,6 +3421,7 @@ sctp_notify_stream_reset(struct sctp_tcb *stcb, + return; + } + strreset = mtod(m_notify, struct sctp_stream_reset_event *); ++ memset(strreset, 0, len); + strreset->strreset_type = SCTP_STREAM_RESET_EVENT; + strreset->strreset_flags = flag; + strreset->strreset_length = len; +@@ -6236,9 +6234,12 @@ sctp_soreceive(struct socket *so, + fromlen = 0; + } + ++ if (filling_sinfo) { ++ memset(&sinfo, 0, sizeof(struct sctp_extrcvinfo)); ++ } + error = sctp_sorecvmsg(so, uio, mp0, from, fromlen, flagsp, + (struct sctp_sndrcvinfo *)&sinfo, filling_sinfo); +- if ((controlp) && (filling_sinfo)) { ++ if (controlp != NULL) { + /* copy back the sinfo in a CMSG format */ + if (filling_sinfo) + *controlp = sctp_build_ctl_nchunk(inp,