11 files changed, 183 insertions, 32 deletions

diff --git a/patches/crypto_arch.h.patch b/patches/crypto_arch.h.patch
new file mode 100644
index 0000000..6c889e5
--- /dev/null
+++ b/patches/crypto_arch.h.patch
@@ -0,0 +1,34 @@
+--- crypto/arch/amd64/crypto_arch.h.orig        Fri Feb 14 06:00:43 2025
++++ crypto/arch/amd64/crypto_arch.h     Fri Feb 14 06:01:13 2025
+@@ -40,6 +40,7 @@ extern uint64_t crypto_cpu_caps_amd64;
+ #define HAVE_RC4_INTERNAL
+ #define HAVE_RC4_SET_KEY_INTERNAL
+ 
++#if 0
+ #define HAVE_SHA1_BLOCK_DATA_ORDER
+ #define HAVE_SHA1_BLOCK_GENERIC
+ 
+@@ -48,6 +49,7 @@ extern uint64_t crypto_cpu_caps_amd64;
+ 
+ #define HAVE_SHA512_BLOCK_DATA_ORDER
+ #define HAVE_SHA512_BLOCK_GENERIC
++#endif
+ 
+ #endif
+ 
+--- crypto/arch/aarch64/crypto_arch.h.orig      Thu Mar 13 05:42:37 2025
++++ crypto/arch/aarch64/crypto_arch.h   Thu Mar 13 05:47:39 2025
+@@ -33,11 +33,13 @@
+ #define CRYPTO_CPU_CAPS_AARCH64_SHA512 (1ULL << 4)
+ #define CRYPTO_CPU_CAPS_AARCH64_SHA3   (1ULL << 5)
+ 
++#if 0
+ #ifndef OPENSSL_NO_ASM
+ 
+ #define HAVE_SHA256_BLOCK_DATA_ORDER
+ #define HAVE_SHA512_BLOCK_DATA_ORDER
+ 
++#endif
+ #endif
+ 
+ #endif
diff --git a/patches/crypto_namespace.h.patch b/patches/crypto_namespace.h.patch
index c18f0da..400030f 100644
--- a/patches/crypto_namespace.h.patch
+++ b/patches/crypto_namespace.h.patch
@@ -1,5 +1,5 @@
---- crypto/hidden/crypto_namespace.h.orig       2024-04-09 10:12:22.320737957 +0200
-+++ crypto/hidden/crypto_namespace.h    2024-04-11 09:09:31.163350515 +0200
+--- crypto/hidden/crypto_namespace.h.orig       Fri Aug  2 23:52:55 2024
++++ crypto/hidden/crypto_namespace.h    Fri Aug  2 23:53:17 2024
 @@ -24,6 +24,12 @@
   * external calls use the latter name.
   */
@@ -13,7 +13,7 @@
  #ifdef LIBRESSL_NAMESPACE
  #ifdef LIBRESSL_CRYPTO_NAMESPACE
  #  define LCRYPTO_UNUSED(x)    __attribute__((deprecated))             \
-@@ -43,5 +49,6 @@
+@@ -47,5 +53,6 @@
  # define LCRYPTO_ALIAS1(pre,x)
  # define LCRYPTO_ALIAS(x)      asm("")
  #endif
diff --git a/patches/netcat.c.patch b/patches/netcat.c.patch
index 9c3a450..319aca6 100644
--- a/patches/netcat.c.patch
+++ b/patches/netcat.c.patch
@@ -1,5 +1,5 @@
---- apps/nc/netcat.c.orig       Tue Aug 15 15:17:28 2023
-+++ apps/nc/netcat.c    Tue Aug 15 15:17:54 2023
+--- apps/nc/netcat.c.orig       Sat Aug 17 03:21:05 2024
++++ apps/nc/netcat.c    Sat Aug 17 03:28:50 2024
 @@ -93,9 +93,13 @@ int  zflag;                                  /* Port Scan Flag */
  int    Dflag;                                  /* sodebug */
  int    Iflag;                                  /* TCP receive buffer size */
@@ -53,7 +53,7 @@
  
         /* Cruft to make sure options are clean, and used properly. */
         if (argc == 1 && family == AF_UNIX) {
-@@ -927,7 +937,10 @@ remote_connect(const char *host, const char *port, str
+@@ -923,7 +933,10 @@ remote_connect(const char *host, const char *port, str
      char *ipaddr)
  {
         struct addrinfo *res, *res0;
@@ -65,7 +65,7 @@
  
         if ((error = getaddrinfo(host, port, &hints, &res0)))
                 errx(1, "getaddrinfo for host \"%s\" port %s: %s", host,
-@@ -942,8 +955,10 @@ remote_connect(const char *host, const char *port, str
+@@ -938,8 +951,10 @@ remote_connect(const char *host, const char *port, str
                 if (sflag || pflag) {
                         struct addrinfo ahints, *ares;
  
@@ -76,7 +76,7 @@
                         memset(&ahints, 0, sizeof(struct addrinfo));
                         ahints.ai_family = res->ai_family;
                         ahints.ai_socktype = uflag ? SOCK_DGRAM : SOCK_STREAM;
-@@ -1035,7 +1050,10 @@ int
+@@ -1031,7 +1046,10 @@ int
  local_listen(const char *host, const char *port, struct addrinfo hints)
  {
         struct addrinfo *res, *res0;
@@ -88,7 +88,7 @@
         int error;
  
         /* Allow nodename to be null. */
-@@ -1056,9 +1074,11 @@ local_listen(const char *host, const char *port, struc
+@@ -1052,9 +1070,11 @@ local_listen(const char *host, const char *port, struc
                     res->ai_protocol)) == -1)
                         continue;
  
@@ -100,7 +100,7 @@
  
                 set_common_sockopts(s, res->ai_family);
  
-@@ -1563,11 +1583,13 @@ set_common_sockopts(int s, int af)
+@@ -1559,11 +1579,13 @@ set_common_sockopts(int s, int af)
  {
         int x = 1;
  
@@ -114,7 +114,7 @@
         if (Dflag) {
                 if (setsockopt(s, SOL_SOCKET, SO_DEBUG,
                     &x, sizeof(x)) == -1)
-@@ -1578,9 +1600,16 @@ set_common_sockopts(int s, int af)
+@@ -1574,9 +1596,16 @@ set_common_sockopts(int s, int af)
                     IP_TOS, &Tflag, sizeof(Tflag)) == -1)
                         err(1, "set IP ToS");
  
@@ -131,7 +131,7 @@
         }
         if (Iflag) {
                 if (setsockopt(s, SOL_SOCKET, SO_RCVBUF,
-@@ -1604,13 +1633,17 @@ set_common_sockopts(int s, int af)
+@@ -1600,13 +1629,17 @@ set_common_sockopts(int s, int af)
         }
  
         if (minttl != -1) {
@@ -150,7 +150,7 @@
         }
  }
  
-@@ -1835,15 +1868,19 @@ help(void)
+@@ -1831,15 +1864,19 @@ help(void)
         \t-P proxyuser\tUsername for proxy authentication\n\
         \t-p port\t     Specify local port for remote connects\n\
         \t-R CAfile     CA bundle\n\
diff --git a/patches/openssl.c.patch b/patches/openssl.c.patch
index 15afb78..5ba5ac6 100644
--- a/patches/openssl.c.patch
+++ b/patches/openssl.c.patch
@@ -1,6 +1,6 @@
---- apps/openssl/openssl.c.orig Mon Mar  4 13:39:56 2024
-+++ apps/openssl/openssl.c      Mon Mar  4 13:40:15 2024
-@@ -348,7 +348,9 @@
+--- apps/openssl/openssl.c.orig Thu Jan  2 08:27:54 2025
++++ apps/openssl/openssl.c      Thu Jan  2 08:28:04 2025
+@@ -344,7 +344,9 @@ BIO *bio_err = NULL;
  static void
  openssl_startup(void)
  {
diff --git a/patches/opensslfeatures.h.patch b/patches/opensslfeatures.h.patch
index 618de73..77df5dc 100644
--- a/patches/opensslfeatures.h.patch
+++ b/patches/opensslfeatures.h.patch
@@ -14,3 +14,25 @@
  #define OPENSSL_THREADS
  
  #define OPENSSL_NO_BUF_FREELISTS
+--- crypto/crypto_internal.h.orig       Sat Dec 14 14:15:39 2024
++++ crypto/crypto_internal.h    Sat Dec 14 14:15:52 2024
+@@ -15,6 +15,8 @@
+  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+  */
+ 
++#include <openssl/opensslfeatures.h>
++
+ #include <endian.h>
+ #include <stddef.h>
+ #include <stdint.h>
+--- tests/parse_test_file.h.orig        Thu Dec 26 01:13:00 2024
++++ tests/parse_test_file.h     Thu Dec 26 01:13:27 2024
+@@ -22,6 +22,8 @@
+ #include <stdint.h>
+ #include <stdio.h>
+ 
++#include <openssl/opensslfeatures.h>
++
+ #include "bytestring.h"
+ 
+ #if defined(__cplusplus)
diff --git a/patches/patch-aarch64-crypto-cpu-caps.c.patch b/patches/patch-aarch64-crypto-cpu-caps.c.patch
new file mode 100644
index 0000000..dcfbdc0
--- /dev/null
+++ b/patches/patch-aarch64-crypto-cpu-caps.c.patch
@@ -0,0 +1,39 @@
+Disable feature detection until we find a more portable way.
+
+--- crypto/arch/aarch64/crypto_cpu_caps.c.orig  Sat Dec 14 13:45:16 2024
++++ crypto/arch/aarch64/crypto_cpu_caps.c       Sat Dec 14 13:54:06 2024
+@@ -16,9 +16,12 @@
+  */
+ 
+ #include <sys/types.h>
++
++#if defined(__OpenBSD__)
+ #include <sys/sysctl.h>
+ 
+ #include <machine/cpu.h>
++#endif
+ 
+ #include <stddef.h>
+ #include <stdio.h>
+@@ -67,6 +70,7 @@ parse_isar0(uint64_t isar0)
+        return caps;
+ }
+ 
++#if defined(__OpenBSD__)
+ static int
+ read_isar0(uint64_t *isar0)
+ {
+@@ -84,6 +88,13 @@ read_isar0(uint64_t *isar0)
+ 
+        return 1;
+ }
++#else
++static int
++read_isar0(uint64_t *isar0)
++{
++       return 0;
++}
++#endif
+ 
+ void
+ crypto_cpu_caps_init(void)
diff --git a/patches/patch-amd64-crypto-cpu-caps.c.patch b/patches/patch-amd64-crypto-cpu-caps.c.patch
new file mode 100644
index 0000000..5fd7524
--- /dev/null
+++ b/patches/patch-amd64-crypto-cpu-caps.c.patch
@@ -0,0 +1,20 @@
+--- crypto/arch/amd64/crypto_cpu_caps.c.orig    Sat Dec 14 13:45:16 2024
++++ crypto/arch/amd64/crypto_cpu_caps.c Sat Dec 14 13:54:06 2024
+@@ -37,7 +37,7 @@ cpuid(uint32_t eax, uint32_t *out_eax, uint32_t *out_e
+ {
+        uint32_t ebx = 0, ecx = 0, edx = 0;
+ 
+-#ifndef OPENSSL_NO_ASM
++#if defined(__GNUC__) && !defined(OPENSSL_NO_ASM)
+        __asm__ ("cpuid": "+a"(eax), "+b"(ebx), "+c"(ecx), "+d"(edx));
+ #else
+        eax = 0;
+@@ -58,7 +58,7 @@ xgetbv(uint32_t ecx, uint32_t *out_eax, uint32_t *out_
+ {
+        uint32_t eax = 0, edx = 0;
+ 
+-#ifndef OPENSSL_NO_ASM
++#if defined(__GNUC__) && !defined(OPENSSL_NO_ASM)
+        __asm__ ("xgetbv": "+a"(eax), "+c"(ecx), "+d"(edx));
+ #endif
+ 
diff --git a/patches/patch-i386-crypto-cpu-caps.c.patch b/patches/patch-i386-crypto-cpu-caps.c.patch
new file mode 100644
index 0000000..c85e33c
--- /dev/null
+++ b/patches/patch-i386-crypto-cpu-caps.c.patch
@@ -0,0 +1,20 @@
+--- crypto/arch/i386/crypto_cpu_caps.c.orig     Fri Oct 18 17:35:20 2024
++++ crypto/arch/i386/crypto_cpu_caps.c  Fri Oct 18 17:39:13 2024
+@@ -33,7 +33,7 @@ cpuid(uint32_t eax, uint32_t *out_eax, uint32_t *out_e
+ {
+        uint32_t ebx = 0, ecx = 0, edx = 0;
+ 
+-#ifndef OPENSSL_NO_ASM
++#if defined(__GNUC__) && !defined(OPENSSL_NO_ASM)
+        __asm__ ("cpuid": "+a"(eax), "+b"(ebx), "+c"(ecx), "+d"(edx));
+ #else
+        eax = 0;
+@@ -54,7 +54,7 @@ xgetbv(uint32_t ecx, uint32_t *out_eax, uint32_t *out_
+ {
+        uint32_t eax = 0, edx = 0;
+ 
+-#ifndef OPENSSL_NO_ASM
++#if defined(__GNUC__) && !defined(OPENSSL_NO_ASM)
+        __asm__ ("xgetbv": "+a"(eax), "+c"(ecx), "+d"(edx));
+ #endif
+ 
diff --git a/patches/speed.c.patch b/patches/speed.c.patch
index c29ef4d..e1f1698 100644
--- a/patches/speed.c.patch
+++ b/patches/speed.c.patch
@@ -1,6 +1,6 @@
---- apps/openssl/speed.c.orig   Sat Jul 13 11:02:51 2024
-+++ apps/openssl/speed.c        Sat Jul 13 10:27:25 2024
-@@ -161,7 +161,16 @@
+--- apps/openssl/speed.c.orig   Thu Jan  2 08:04:28 2025
++++ apps/openssl/speed.c        Thu Jan  2 08:04:38 2025
+@@ -158,7 +158,16 @@ static void
  pkey_print_message(const char *str, const char *str2,
      long num, int bits, int sec);
  static void print_result(int alg, int run_no, int count, double time_used);
@@ -17,7 +17,7 @@
  
  #define ALGOR_NUM      32
  #define SIZE_NUM       5
-@@ -430,8 +439,10 @@
+@@ -1129,8 +1138,10 @@ speed_main(int argc, char **argv)
         const EVP_CIPHER *evp_cipher = NULL;
         const EVP_MD *evp_md = NULL;
         int decrypt = 0;
@@ -28,7 +28,7 @@
         const char *errstr = NULL;
  
         if (pledge("stdio proc", NULL) == -1) {
-@@ -506,6 +517,7 @@
+@@ -1205,6 +1216,7 @@ speed_main(int argc, char **argv)
                         decrypt = 1;
                         j--;    /* Otherwise, -decrypt gets confused with an
                                  * algorithm. */
@@ -36,7 +36,7 @@
                 } else if (argc > 0 && strcmp(*argv, "-multi") == 0) {
                         argc--;
                         argv++;
-@@ -520,6 +532,7 @@
+@@ -1219,6 +1231,7 @@ speed_main(int argc, char **argv)
                         }
                         j--;    /* Otherwise, -multi gets confused with an
                                  * algorithm. */
@@ -44,7 +44,7 @@
                 } else if (argc > 0 && strcmp(*argv, "-unaligned") == 0) {
                         argc--;
                         argv++;
-@@ -851,7 +864,9 @@
+@@ -1542,7 +1555,9 @@ speed_main(int argc, char **argv)
                         BIO_printf(bio_err, "-evp e          use EVP e.\n");
                         BIO_printf(bio_err, "-decrypt        time decryption instead of encryption (only EVP).\n");
                         BIO_printf(bio_err, "-mr             produce machine readable output.\n");
@@ -54,7 +54,7 @@
                         BIO_printf(bio_err, "-unaligned n    use buffers with offset n from proper alignment.\n");
                         goto end;
                 }
-@@ -860,8 +875,10 @@
+@@ -1551,8 +1566,10 @@ speed_main(int argc, char **argv)
                 j++;
         }
  
@@ -65,7 +65,7 @@
  
         if (j == 0) {
                 for (i = 0; i < ALGOR_NUM; i++) {
-@@ -933,11 +950,13 @@
+@@ -1624,11 +1641,13 @@ speed_main(int argc, char **argv)
  #define COND(c)        (run && count<0x7fffffff)
  #define COUNT(d) (count)
  
@@ -79,7 +79,7 @@
  
  #ifndef OPENSSL_NO_MD4
         if (doit[D_MD4]) {
-@@ -1743,7 +1762,9 @@
+@@ -2434,7 +2453,9 @@ speed_main(int argc, char **argv)
                                 ecdh_doit[j] = 0;
                 }
         }
@@ -89,7 +89,7 @@
         if (!mr) {
                 fprintf(stdout, "%s\n", SSLeay_version(SSLEAY_VERSION));
                 fprintf(stdout, "%s\n", SSLeay_version(SSLEAY_BUILT_ON));
-@@ -1899,11 +1920,15 @@
+@@ -2590,11 +2611,15 @@ pkey_print_message(const char *str, const char *str2, 
  static void
  print_result(int alg, int run_no, int count, double time_used)
  {
@@ -105,9 +105,10 @@
  static char *
  sstrsep(char **string, const char *delim)
  {
-@@ -2104,4 +2129,5 @@
+@@ -2795,5 +2820,6 @@ do_multi(int multi)
         free(fds);
         return 1;
  }
 +#endif
- #endif
+ 
+ #endif /* OPENSSL_NO_SPEED */
diff --git a/patches/ssl_namespace.h.patch b/patches/ssl_namespace.h.patch
index 758f8dc..eb9c7a2 100644
--- a/patches/ssl_namespace.h.patch
+++ b/patches/ssl_namespace.h.patch
@@ -1,5 +1,5 @@
---- openbsd/src/lib/libssl/hidden/ssl_namespace.h       2023-03-15 11:41:52.481641800 -0600
-+++ ssl/hidden/ssl_namespace.h  2023-03-15 17:28:04.685309300 -0600
+--- ssl/hidden/ssl_namespace.h.orig     Fri Aug  2 23:52:55 2024
++++ ssl/hidden/ssl_namespace.h  Fri Aug  2 23:53:17 2024
 @@ -23,6 +23,11 @@
   * and we alias that to the normal name.
   */
@@ -12,7 +12,7 @@
  #ifdef LIBRESSL_NAMESPACE
  #define LSSL_UNUSED(x)         typeof(x) x __attribute__((deprecated))
  #define LSSL_USED(x)           __attribute__((visibility("hidden")))   \
-@@ -33,5 +38,6 @@
+@@ -37,5 +42,6 @@
  #define LSSL_USED(x)
  #define LSSL_ALIAS(x)          asm("")
  #endif
diff --git a/patches/tls_config.c.patch b/patches/tls_config.c.patch
new file mode 100644
index 0000000..1342a60
--- /dev/null
+++ b/patches/tls_config.c.patch
@@ -0,0 +1,15 @@
+uid_t can be 64-bit
+
+--- tls/tls_config.c.orig       2024-11-02 21:19:47.090322191 +0100
++++ tls/tls_config.c    2024-11-02 21:38:22.527071689 +0100
+@@ -742,8 +742,8 @@
+ 
+        if (sb.st_uid != getuid()) {
+                tls_config_set_errorx(config, TLS_ERROR_UNKNOWN,
+-                   "session file has incorrect owner (uid %u != %u)",
+-                   sb.st_uid, getuid());
++                   "session file has incorrect owner (uid %llu != %llu)",
++                   (unsigned long long)sb.st_uid, (unsigned long long)getuid());
+                return (-1);
+        }
+        mugo = sb.st_mode & (S_IRWXU|S_IRWXG|S_IRWXO);