Update "openssl" package to version 1.0.2. Changes since version 1.0.2a:

- ClientHello sigalgs DoS fix

  If a client connects to an OpenSSL 1.0.2 server and renegotiates with an
  invalid signature algorithms extension a NULL pointer dereference will
  occur. This can be exploited in a DoS attack against the server.

  This issue was was reported to OpenSSL by David Ramos of Stanford
  University.
  (CVE-2015-0291)
  [Stephen Henson and Matt Caswell]

- Multiblock corrupted pointer fix

  OpenSSL 1.0.2 introduced the "multiblock" performance improvement. This
  feature only applies on 64 bit x86 architecture platforms that support AES
  NI instructions. A defect in the implementation of "multiblock" can cause
  OpenSSL's internal write buffer to become incorrectly set to NULL when
  using non-blocking IO. Typically, when the user application is using a
  socket BIO for writing, this will only result in a failed connection.
  However if some other BIO is used then it is likely that a segmentation
  fault will be triggered, thus enabling a potential DoS attack.

  This issue was reported to OpenSSL by Daniel Danner and Rainer Mueller.
  (CVE-2015-0290)
  [Matt Caswell]

- Segmentation fault in DTLSv1_listen fix

  The DTLSv1_listen function is intended to be stateless and processes the
  initial ClientHello from many peers. It is common for user code to loop
  over the call to DTLSv1_listen until a valid ClientHello is received with
  an associated cookie. A defect in the implementation of DTLSv1_listen means
  that state is preserved in the SSL object from one invocation to the next
  that can lead to a segmentation fault. Errors processing the initial
  ClientHello can trigger this scenario. An example of such an error could be
  that a DTLS1.0 only client is attempting to connect to a DTLS1.2 only
  server.

  This issue was reported to OpenSSL by Per Allansson.
  (CVE-2015-0207)
  [Matt Caswell]

- Segmentation fault in ASN1_TYPE_cmp fix

  The function ASN1_TYPE_cmp will crash with an invalid read if an attempt is
  made to compare ASN.1 boolean types. Since ASN1_TYPE_cmp is used to check
  certificate signature algorithm consistency this can be used to crash any
  certificate verification operation and exploited in a DoS attack. Any
  application which performs certificate verification is vulnerable including
  OpenSSL clients and servers which enable client authentication.
  (CVE-2015-0286)
  [Stephen Henson]

- Segmentation fault for invalid PSS parameters fix

  The signature verification routines will crash with a NULL pointer
  dereference if presented with an ASN.1 signature using the RSA PSS
  algorithm and invalid parameters. Since these routines are used to verify
  certificate signature algorithms this can be used to crash any
  certificate verification operation and exploited in a DoS attack. Any
  application which performs certificate verification is vulnerable including
  OpenSSL clients and servers which enable client authentication.

  This issue was was reported to OpenSSL by Brian Carpenter.
  (CVE-2015-0208)
  [Stephen Henson]

- ASN.1 structure reuse memory corruption fix

  Reusing a structure in ASN.1 parsing may allow an attacker to cause
  memory corruption via an invalid write. Such reuse is and has been
  strongly discouraged and is believed to be rare.

  Applications that parse structures containing CHOICE or ANY DEFINED BY
  components may be affected. Certificate parsing (d2i_X509 and related
  functions) are however not affected. OpenSSL clients and servers are
  not affected.
  (CVE-2015-0287)
  [Stephen Henson]

- PKCS7 NULL pointer dereferences fix

  The PKCS#7 parsing code does not handle missing outer ContentInfo
  correctly. An attacker can craft malformed ASN.1-encoded PKCS#7 blobs with
  missing content and trigger a NULL pointer dereference on parsing.

  Applications that verify PKCS#7 signatures, decrypt PKCS#7 data or
  otherwise parse PKCS#7 structures from untrusted sources are
  affected. OpenSSL clients and servers are not affected.

  This issue was reported to OpenSSL by Michal Zalewski (Google).
  (CVE-2015-0289)
  [Emilia Käsper]

- DoS via reachable assert in SSLv2 servers fix

  A malicious client can trigger an OPENSSL_assert (i.e., an abort) in
  servers that both support SSLv2 and enable export cipher suites by sending
  a specially crafted SSLv2 CLIENT-MASTER-KEY message.

  This issue was discovered by Sean Burford (Google) and Emilia Käsper
  (OpenSSL development team).
  (CVE-2015-0293)
  [Emilia Käsper]

- Empty CKE with client auth and DHE fix

  If client auth is used then a server can seg fault in the event of a DHE
  ciphersuite being selected and a zero length ClientKeyExchange message
  being sent by the client. This could be exploited in a DoS attack.
  (CVE-2015-1787)
  [Matt Caswell]

- Handshake with unseeded PRNG fix

  Under certain conditions an OpenSSL 1.0.2 client can complete a handshake
  with an unseeded PRNG. The conditions are:
  - The client is on a platform where the PRNG has not been seeded
  automatically, and the user has not seeded manually
  - A protocol specific client method version has been used (i.e. not
  SSL_client_methodv23)
  - A ciphersuite is used that does not require additional random data from
  the PRNG beyond the initial ClientHello client random (e.g. PSK-RC4-SHA).

  If the handshake succeeds then the client random that has been used will
  have been generated from a PRNG with insufficient entropy and therefore the
  output may be predictable.

  For example using the following command with an unseeded openssl will
  succeed on an unpatched platform:

  openssl s_client -psk 1a2b3c4d -tls1_2 -cipher PSK-RC4-SHA
  (CVE-2015-0285)
  [Matt Caswell]

- Use After Free following d2i_ECPrivatekey error fix

  A malformed EC private key file consumed via the d2i_ECPrivateKey function
  could cause a use after free condition. This, in turn, could cause a double
  free in several private key parsing functions (such as d2i_PrivateKey
  or EVP_PKCS82PKEY) and could lead to a DoS attack or memory corruption
  for applications that receive EC private keys from untrusted
  sources. This scenario is considered rare.

  This issue was discovered by the BoringSSL project and fixed in their
  commit 517073cd4b.
  (CVE-2015-0209)
  [Matt Caswell]

- X509_to_X509_REQ NULL pointer deref fix

  The function X509_to_X509_REQ will crash with a NULL pointer dereference if
  the certificate key is invalid. This function is rarely used in practice.

  This issue was discovered by Brian Carpenter.
  (CVE-2015-0288)
  [Stephen Henson]

- Removed the export ciphers from the DEFAULT ciphers
  [Kurt Roeckx]

4 files changed, 56 insertions, 22 deletions

diff --git a/security/openssl/Makefile b/security/openssl/Makefile
index 399540d3766..30c28e335cf 100644
--- a/security/openssl/Makefile
+++ b/security/openssl/Makefile
@@ -1,8 +1,8 @@
-# $NetBSD: Makefile,v 1.203 2015/03/11 22:49:40 tnn Exp $
+# $NetBSD: Makefile,v 1.204 2015/03/19 22:11:22 tron Exp $
 
-DISTNAME=	openssl-1.0.2
+DISTNAME=	openssl-1.0.2a
 CATEGORIES=	security
-MASTER_SITES=	http://ftp.openssl.org/source/
+MASTER_SITES=	http://www.openssl.org/source/
 
 MAINTAINER=	pkgsrc-users@NetBSD.org
 HOMEPAGE=	http://www.openssl.org/
diff --git a/security/openssl/PLIST.common b/security/openssl/PLIST.common
index 2bafb0e7846..3c93ef2b743 100644
--- a/security/openssl/PLIST.common
+++ b/security/openssl/PLIST.common
@@ -1,4 +1,4 @@
-@comment $NetBSD: PLIST.common,v 1.22 2015/02/12 13:08:53 adam Exp $
+@comment $NetBSD: PLIST.common,v 1.23 2015/03/19 22:11:22 tron Exp $
 bin/c_rehash
 bin/openssl
 include/openssl/aes.h
@@ -168,6 +168,12 @@ man/man3/ASN1_STRING_set.3
 man/man3/ASN1_STRING_to_UTF8.3
 man/man3/ASN1_STRING_type.3
 man/man3/ASN1_STRING_type_new.3
+man/man3/ASN1_TIME_adj.3
+man/man3/ASN1_TIME_check.3
+man/man3/ASN1_TIME_diff.3
+man/man3/ASN1_TIME_print.3
+man/man3/ASN1_TIME_set.3
+man/man3/ASN1_TIME_set_string.3
 man/man3/ASN1_add_oid_module.3
 man/man3/ASN1_generate_nconf.3
 man/man3/ASN1_generate_v3.3
@@ -440,6 +446,7 @@ man/man3/CMS_encrypt.3
 man/man3/CMS_final.3
 man/man3/CMS_get0_RecipientInfos.3
 man/man3/CMS_get0_SignerInfos.3
+man/man3/CMS_get0_content.3
 man/man3/CMS_get0_eContentType.3
 man/man3/CMS_get0_signers.3
 man/man3/CMS_get0_type.3
@@ -1092,6 +1099,22 @@ man/man3/SHA1.3
 man/man3/SHA1_Final.3
 man/man3/SHA1_Init.3
 man/man3/SHA1_Update.3
+man/man3/SHA224.3
+man/man3/SHA224_Final.3
+man/man3/SHA224_Init.3
+man/man3/SHA224_Update.3
+man/man3/SHA256.3
+man/man3/SHA256_Final.3
+man/man3/SHA256_Init.3
+man/man3/SHA256_Update.3
+man/man3/SHA384.3
+man/man3/SHA384_Final.3
+man/man3/SHA384_Init.3
+man/man3/SHA384_Update.3
+man/man3/SHA512.3
+man/man3/SHA512_Final.3
+man/man3/SHA512_Init.3
+man/man3/SHA512_Update.3
 man/man3/SMIME_read_CMS.3
 man/man3/SMIME_read_PKCS7.3
 man/man3/SMIME_write_CMS.3
@@ -1130,6 +1153,7 @@ man/man3/SSL_CTX_get0_chain_certs.3
 man/man3/SSL_CTX_get_cert_store.3
 man/man3/SSL_CTX_get_client_CA_list.3
 man/man3/SSL_CTX_get_client_cert_cb.3
+man/man3/SSL_CTX_get_default_read_ahead.3
 man/man3/SSL_CTX_get_ex_data.3
 man/man3/SSL_CTX_get_ex_new_index.3
 man/man3/SSL_CTX_get_info_callback.3
@@ -1137,6 +1161,7 @@ man/man3/SSL_CTX_get_max_cert_list.3
 man/man3/SSL_CTX_get_mode.3
 man/man3/SSL_CTX_get_options.3
 man/man3/SSL_CTX_get_quiet_shutdown.3
+man/man3/SSL_CTX_get_read_ahead.3
 man/man3/SSL_CTX_get_session_cache_mode.3
 man/man3/SSL_CTX_get_timeout.3
 man/man3/SSL_CTX_get_verify_callback.3
@@ -1186,6 +1211,7 @@ man/man3/SSL_CTX_set_current_cert.3
 man/man3/SSL_CTX_set_custom_cli_ext.3
 man/man3/SSL_CTX_set_default_passwd_cb.3
 man/man3/SSL_CTX_set_default_passwd_cb_userdata.3
+man/man3/SSL_CTX_set_default_read_ahead.3
 man/man3/SSL_CTX_set_ecdh_auto.3
 man/man3/SSL_CTX_set_ex_data.3
 man/man3/SSL_CTX_set_generate_session_id.3
@@ -1198,6 +1224,7 @@ man/man3/SSL_CTX_set_options.3
 man/man3/SSL_CTX_set_psk_client_callback.3
 man/man3/SSL_CTX_set_psk_server_callback.3
 man/man3/SSL_CTX_set_quiet_shutdown.3
+man/man3/SSL_CTX_set_read_ahead.3
 man/man3/SSL_CTX_set_session_cache_mode.3
 man/man3/SSL_CTX_set_session_id_context.3
 man/man3/SSL_CTX_set_ssl_version.3
@@ -1278,6 +1305,7 @@ man/man3/SSL_get_psk_identity.3
 man/man3/SSL_get_psk_identity_hint.3
 man/man3/SSL_get_quiet_shutdown.3
 man/man3/SSL_get_rbio.3
+man/man3/SSL_get_read_ahead.3
 man/man3/SSL_get_secure_renegotiation_support.3
 man/man3/SSL_get_session.3
 man/man3/SSL_get_shared_curve.3
@@ -1327,6 +1355,7 @@ man/man3/SSL_set_options.3
 man/man3/SSL_set_psk_client_callback.3
 man/man3/SSL_set_psk_server_callback.3
 man/man3/SSL_set_quiet_shutdown.3
+man/man3/SSL_set_read_ahead.3
 man/man3/SSL_set_session.3
 man/man3/SSL_set_session_id_context.3
 man/man3/SSL_set_shutdown.3
@@ -1484,6 +1513,7 @@ man/man3/bn_sqr_words.3
 man/man3/bn_sub_words.3
 man/man3/bn_wexpand.3
 man/man3/d2i_ASN1_OBJECT.3
+man/man3/d2i_CMS_ContentInfo.3
 man/man3/d2i_DHparams.3
 man/man3/d2i_DSAPrivateKey.3
 man/man3/d2i_DSAPublicKey.3
@@ -1494,6 +1524,8 @@ man/man3/d2i_ECDSA_SIG.3
 man/man3/d2i_ECPKParameters.3
 man/man3/d2i_ECPKParameters_bio.3
 man/man3/d2i_ECPKParameters_fp.3
+man/man3/d2i_ECPrivateKey.3
+man/man3/d2i_ECPrivate_key.3
 man/man3/d2i_Netscape_RSA.3
 man/man3/d2i_PKCS8PrivateKey.3
 man/man3/d2i_PKCS8PrivateKey_bio.3
@@ -1519,6 +1551,7 @@ man/man3/des_read_password.3
 man/man3/des_read_pw.3
 man/man3/des_read_pw_string.3
 man/man3/i2d_ASN1_OBJECT.3
+man/man3/i2d_CMS_ContentInfo.3
 man/man3/i2d_CMS_bio_stream.3
 man/man3/i2d_DHparams.3
 man/man3/i2d_DSAPrivateKey.3
@@ -1529,7 +1562,8 @@ man/man3/i2d_DSAparams.3
 man/man3/i2d_ECDSA_SIG.3
 man/man3/i2d_ECPKParameters.3
 man/man3/i2d_ECPKParameters_bio.3
-man/man3/i2d_ECPKParameters_fp(fp.3
+man/man3/i2d_ECPKParameters_fp.3
+man/man3/i2d_ECPrivateKey.3
 man/man3/i2d_Netscape_RSA.3
 man/man3/i2d_PKCS7_bio_stream.3
 man/man3/i2d_PKCS8PrivateKey_bio.3
@@ -1594,7 +1628,6 @@ man/man3/openssl_ssl.3
 man/man3/openssl_threads.3
 man/man3/openssl_ui.3
 man/man3/openssl_ui_compat.3
-man/man3/openssl_x).3
 man/man3/openssl_x509.3
 man/man5/openssl_config.5
 man/man5/openssl_x509v3_config.5
diff --git a/security/openssl/distinfo b/security/openssl/distinfo
index 2b815c12c85..ffe588f7335 100644
--- a/security/openssl/distinfo
+++ b/security/openssl/distinfo
@@ -1,9 +1,9 @@
-$NetBSD: distinfo,v 1.111 2015/02/12 13:08:53 adam Exp $
+$NetBSD: distinfo,v 1.112 2015/03/19 22:11:22 tron Exp $
 
-SHA1 (openssl-1.0.2.tar.gz) = 2f264f7f6bb973af444cd9fc6ee65c8588f610cc
-RMD160 (openssl-1.0.2.tar.gz) = a5452cd1fd380dcbc1dd53d8e50da6ec632ebd6e
-Size (openssl-1.0.2.tar.gz) = 5265809 bytes
-SHA1 (patch-Configure) = b2b1b5e9f9cffde8814297fac88c84388c86694a
+SHA1 (openssl-1.0.2a.tar.gz) = 46ecd325b8e587fa491f6bb02ad4a9fb9f382f5f
+RMD160 (openssl-1.0.2a.tar.gz) = 2974a0a8cc469d85a5391a64aa0a2b2c5b00acfa
+Size (openssl-1.0.2a.tar.gz) = 5262089 bytes
+SHA1 (patch-Configure) = d57986a34cd88a27c5d94df5a3cc3e2c12bf8bbe
 SHA1 (patch-Makefile.org) = 72f023aeead660decaa09b6664936bd73a214069
 SHA1 (patch-Makefile.shared) = 709283ba4bb4bd568e289fe111b8dea319968328
 SHA1 (patch-apps_Makefile) = 745e01fb967979f5105896f8a728fd7a041af6c9
diff --git a/security/openssl/patches/patch-Configure b/security/openssl/patches/patch-Configure
index fc228fcf5e0..cb83dd7609f 100644
--- a/security/openssl/patches/patch-Configure
+++ b/security/openssl/patches/patch-Configure
@@ -1,12 +1,12 @@
-$NetBSD: patch-Configure,v 1.3 2015/02/12 13:08:53 adam Exp $
+$NetBSD: patch-Configure,v 1.4 2015/03/19 22:11:22 tron Exp $
 
 * Avoid -fast on Solaris, creates non-portable packages which depend on
   host-specific CPU features.
 * Add GNU/kFreeBSD support.
 
---- Configure.orig	2015-01-22 14:58:32.000000000 +0000
-+++ Configure
-@@ -341,6 +341,7 @@ my %table=(
+--- Configure.orig	2015-03-19 13:30:36.000000000 +0000
++++ Configure	2015-03-19 20:58:06.000000000 +0000
+@@ -341,6 +341,7 @@
  #
  "osf1-alpha-gcc", "gcc:-O3::(unknown):::SIXTY_FOUR_BIT_LONG RC4_CHUNK DES_UNROLL DES_RISC1:${alpha_asm}:dlfcn:alpha-osf1-shared:::.so",
  "osf1-alpha-cc",  "cc:-std1 -tune host -O4 -readonly_strings::(unknown):::SIXTY_FOUR_BIT_LONG RC4_CHUNK:${alpha_asm}:dlfcn:alpha-osf1-shared:::.so",
@@ -14,10 +14,10 @@ $NetBSD: patch-Configure,v 1.3 2015/02/12 13:08:53 adam Exp $
  "tru64-alpha-cc", "cc:-std1 -tune host -fast -readonly_strings::-pthread:::SIXTY_FOUR_BIT_LONG RC4_CHUNK:${alpha_asm}:dlfcn:alpha-osf1-shared::-msym:.so",
  
  ####
-@@ -463,6 +464,28 @@ my %table=(
- "BSD-sparc64",	"gcc:-DB_ENDIAN -DTERMIOS -O3 -DMD32_REG_T=int -Wall::${BSDthreads}:::BN_LLONG RC2_CHAR RC4_CHUNK DES_INT DES_PTR DES_RISC2 BF_PTR:${sparcv9_asm}:dlfcn:bsd-gcc-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
- "BSD-ia64",	"gcc:-DL_ENDIAN -DTERMIOS -O3 -Wall::${BSDthreads}:::SIXTY_FOUR_BIT_LONG RC4_CHUNK DES_UNROLL DES_INT:${ia64_asm}:dlfcn:bsd-gcc-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
- "BSD-x86_64",	"gcc:-DL_ENDIAN -DTERMIOS -O3 -Wall::${BSDthreads}:::SIXTY_FOUR_BIT_LONG RC4_CHUNK DES_INT DES_UNROLL:${x86_64_asm}:elf:dlfcn:bsd-gcc-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
+@@ -464,6 +465,29 @@
+ "BSD-ia64",	"gcc:-DL_ENDIAN -O3 -Wall::${BSDthreads}:::SIXTY_FOUR_BIT_LONG RC4_CHUNK DES_UNROLL DES_INT:${ia64_asm}:dlfcn:bsd-gcc-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
+ "BSD-x86_64",	"gcc:-DL_ENDIAN -O3 -Wall::${BSDthreads}:::SIXTY_FOUR_BIT_LONG RC4_CHUNK DES_INT DES_UNROLL:${x86_64_asm}:elf:dlfcn:bsd-gcc-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
+ 
 +"NetBSD","gcc:-DTERMIOS -O2 -Wall::(unknown):::BN_LLONG MD2_CHAR RC4_INDEX DES_UNROLL:${no_asm}:dlfcn:bsd-gcc-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
 +"NetBSD-alpha", "gcc:-DTERMIOS -DL_ENDIAN -O2 -Wall::(unknown):::SIXTY_FOUR_BIT_LONG DES_INT DES_PTR DES_RISC2:${no_asm}:dlfcn:bsd-gcc-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
 +"NetBSD-arm", "gcc:-DTERMIOS -DL_ENDIAN -O2 -Wall::(unknown):::BN_LLONG MD2_CHAR RC4_INDEX DES_UNROLL:${no_asm}:dlfcn:bsd-gcc-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
@@ -40,10 +40,11 @@ $NetBSD: patch-Configure,v 1.3 2015/02/12 13:08:53 adam Exp $
 +"GNU/kFreeBSD-x86_64", "gcc:-m64 -DL_ENDIAN -DTERMIOS -DMD32_REG_T=int::-D_REENTRANT::-ldl:SIXTY_FOUR_BIT_LONG RC4_CHUNK DES_INT DES_UNROLL:${x86_64_asm}:elf:dlfcn:linux-shared:-fPIC:-m64:.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
 +"GNU/kFreeBSD-i386", "gcc:-DL_ENDIAN -DTERMIOS -march=i486::-D_REENTRANT::-ldl:BN_LLONG ${x86_gcc_des} ${x86_gcc_opts}:${x86_elf_asm}:dlfcn:linux-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
 +
- 
++
  "bsdi-elf-gcc",     "gcc:-DPERL5 -DL_ENDIAN -fomit-frame-pointer -O3 -march=i486 -Wall::(unknown)::-ldl:BN_LLONG ${x86_gcc_des} ${x86_gcc_opts}:${x86_elf_asm}:dlfcn:bsd-gcc-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
  
-@@ -915,7 +938,7 @@ PROCESS_ARGS:
+ "nextstep",	"cc:-O -Wall:<libc.h>:(unknown):::BN_LLONG ${x86_gcc_des} ${x86_gcc_opts}:::",
+@@ -915,7 +939,7 @@
  			# The check for the option is there so scripts aren't
  			# broken
  			}
@@ -52,7 +53,7 @@ $NetBSD: patch-Configure,v 1.3 2015/02/12 13:08:53 adam Exp $
  			{
  			if (/^--prefix=(.*)$/)
  				{
-@@ -1737,7 +1760,7 @@ while (<IN>)
+@@ -1737,7 +1761,7 @@
  	elsif ($shared_extension ne "" && $shared_extension =~ /^\.s([ol])\.[^\.]*\.[^\.]*$/)
  		{
  		my $sotmp = $1;