Date: Mon, 28 Jan 2013 23:31:55 GMT From: "b.f." <bf@FreeBSD.org> To: freebsd-gnats-submit@FreeBSD.org Subject: ports/175663: [PATCH]security/openssl: enable optimized NIST ECC on 64-bit little-endian machines; minor clean-ups Message-ID: <201301282331.r0SNVtLi062720@red.freebsd.org> Resent-Message-ID: <201301282340.r0SNe0AJ073915@freefall.freebsd.org>
next in thread | raw e-mail | index | archive | help
>Number: 175663 >Category: ports >Synopsis: [PATCH]security/openssl: enable optimized NIST ECC on 64-bit little-endian machines; minor clean-ups >Confidential: no >Severity: non-critical >Priority: low >Responsible: freebsd-ports-bugs >State: open >Quarter: >Keywords: >Date-Required: >Class: change-request >Submitter-Id: current-users >Arrival-Date: Mon Jan 28 23:40:00 UTC 2013 >Closed-Date: >Last-Modified: >Originator: b.f. >Release: 10.0-CURRENT amd64 >Organization: - >Environment: >Description: Add an OPTION, enabled by default, to provide optimized versions of NIST ECC on 64-bit little-endian machines. While here, s/can not/cannot/, make the pkg-message respect PREFIX, and replace the deprecated NOPORTDOCS with the equivalent check under the new options framework. The optimized implementations should offer significant speed-ups and some added security. (See, e.g.,: https://static.googleusercontent.com/external_content/untrusted_dlcp/research.google.com/en/us/pubs/archive/37376.pdf ) >How-To-Repeat: >Fix: Patch attached with submission follows: Index: Makefile =================================================================== --- Makefile (revision 311136) +++ Makefile (working copy) @@ -4,7 +4,7 @@ PORTNAME= openssl PORTVERSION= 1.0.1 DISTVERSIONSUFFIX= c -PORTREVISION= 4 +PORTREVISION= 5 CATEGORIES= security devel MASTER_SITES= http://www.openssl.org/%SUBDIR%/ \ ftp://ftp.openssl.org/%SUBDIR%/ \ @@ -23,6 +23,15 @@ OPTIONS_DEFINE= SHARED THREADS I386 SSE2 ASM PADLOCK ZLIB SCTP MD2 RC5 RFC3779 GMP OPTIONS_DEFAULT=SHARED THREADS SSE2 ASM ZLIB SCTP MD2 +.for a in amd64 ia64 +OPTIONS_DEFINE_${a}= EC +OPTIONS_DEFAULT_${a}= EC +.endfor +TARGET_ARCH?= ${MACHINE_ARCH} +.if ${TARGET_ARCH} == "mips64el" +OPTIONS_DEFINE_mips= EC +OPTIONS_DEFAULT_mips= EC +.endif NO_OPTIONS_SORT=yes I386_DESC?= Optimize for i386 (instead of i486+) SSE2_DESC?= runtime SSE2 detection @@ -35,6 +44,7 @@ RC5_DESC?= RC5 chipher (patented) RFC3779_DESC?= RFC3779 support GMP_DESC?= gmp support (LGPLv3) +EC_DESC?= Optimize NIST elliptic curves MAKE_JOBS_UNSAFE= yes NOPRECIOUSMAKEVARS= Too many _MLINKS for fetch @@ -44,6 +54,7 @@ MAKE_ARGS+= WHOLE_ARCHIVE_FLAG=--whole-archive MAKE_ENV+= LIBRPATH="${PREFIX}/lib" OPENSSLDIR= ${PREFIX}/openssl +SUB_FILES= pkg-message MANPREFIX= ${PREFIX} MAN1= CA.pl.1 asn1parse.1 ca.1 ciphers.1 cms.1 crl.1 crl2pkcs7.1 dgst.1 \ @@ -1118,7 +1129,7 @@ .if ${PORT_OPTIONS:MGMP} EXTRACONFIGURE+= enable-gmp -IGNORE= GMP is LGPLv3 and can not be linked +IGNORE= GMP is LGPLv3 and cannot be linked .else EXTRACONFIGURE+= no-gmp .endif @@ -1129,6 +1140,12 @@ EXTRACONFIGURE+= no-rfc3779 .endif +.if ${PORT_OPTIONS:MEC} +EXTRACONFIGURE+= enable-ec_nistp_64_gcc_128 +.else +EXTRACONFIGURE+= no-ec_nistp_64_gcc_128 +.endif + .if ${OPENSSL_SHLIBVER_BASE} > ${OPENSSL_SHLIBVER} pre-everything:: @${ECHO_CMD} "#" @@ -1174,7 +1191,7 @@ @${LN} -sf $i.so.${OPENSSL_SHLIBVER} ${PREFIX}/lib/$i.so .endfor .endif -.if !defined(NOPORTDOCS) +.if ${PORT_OPTIONS:MDOCS} @${MKDIR} ${DOCSDIR} @${INSTALL_DATA} ${WRKSRC}/doc/openssl.txt ${DOCSDIR}/ .endif Index: files/pkg-message.in =================================================================== --- files/pkg-message.in (revision 0) +++ files/pkg-message.in (working copy) @@ -0,0 +1,4 @@ + +Copy %%PREFIX%%/openssl/openssl.cnf.sample to %%PREFIX%%/openssl/openssl.cnf +and edit it to fit your needs. + Property changes on: files/pkg-message.in ___________________________________________________________________ Added: fbsd:nokeywords ## -0,0 +1 ## +yes \ No newline at end of property Index: pkg-message =================================================================== --- pkg-message (revision 311136) +++ pkg-message (working copy) @@ -1,4 +0,0 @@ - -Copy /usr/local/openssl/openssl.cnf.sample to /usr/local/openssl/openssl.cnf -and edit it to fit your needs. - >Release-Note: >Audit-Trail: >Unformatted:
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201301282331.r0SNVtLi062720>