openssl: upgrade to 0.9.8m (patch by Peter Wagner)

[openwrt.git] / package / openssl / patches / 900-CVE-2009-2409.patch

diff --git a/package/openssl/patches/900-CVE-2009-2409.patch b/package/openssl/patches/900-CVE-2009-2409.patch
deleted file mode 100644 (file)
index 4800968..0000000
--- a/package/openssl/patches/900-CVE-2009-2409.patch
+++ /dev/null
@@ -1,59 +0,0 @@
-http://bugs.gentoo.org/280591
-
-fix from upstream
-
-http://cvs.openssl.org/chngview?cn=18260
-
---- a/crypto/evp/c_alld.c
-+++ b/crypto/evp/c_alld.c
-@@ -64,9 +64,6 @@
- 
- void OpenSSL_add_all_digests(void)
-       {
--#ifndef OPENSSL_NO_MD2
--      EVP_add_digest(EVP_md2());
--#endif
- #ifndef OPENSSL_NO_MD4
-       EVP_add_digest(EVP_md4());
- #endif
---- a/crypto/x509/x509_vfy.c
-+++ b/crypto/x509/x509_vfy.c
-@@ -986,7 +986,11 @@ static int internal_verify(X509_STORE_CT
-       while (n >= 0)
-               {
-               ctx->error_depth=n;
--              if (!xs->valid)
-+
-+              /* Skip signature check for self signed certificates. It
-+               * doesn't add any security and just wastes time.
-+               */
-+              if (!xs->valid && xs != xi)
-                       {
-                       if ((pkey=X509_get_pubkey(xi)) == NULL)
-                               {
-@@ -996,13 +1000,6 @@ static int internal_verify(X509_STORE_CT
-                               if (!ok) goto end;
-                               }
-                       else if (X509_verify(xs,pkey) <= 0)
--                              /* XXX  For the final trusted self-signed cert,
--                               * this is a waste of time.  That check should
--                               * optional so that e.g. 'openssl x509' can be
--                               * used to detect invalid self-signatures, but
--                               * we don't verify again and again in SSL
--                               * handshakes and the like once the cert has
--                               * been declared trusted. */
-                               {
-                               ctx->error=X509_V_ERR_CERT_SIGNATURE_FAILURE;
-                               ctx->current_cert=xs;
---- a/ssl/ssl_algs.c
-+++ b/ssl/ssl_algs.c
-@@ -92,9 +92,6 @@ int SSL_library_init(void)
-       EVP_add_cipher(EVP_seed_cbc());
- #endif
- 
--#ifndef OPENSSL_NO_MD2
--      EVP_add_digest(EVP_md2());
--#endif
- #ifndef OPENSSL_NO_MD5
-       EVP_add_digest(EVP_md5());
-       EVP_add_digest_alias(SN_md5,"ssl2-md5");