7 files changed, 26 insertions, 60 deletions

diff --git a/patches/aeadtest.c.patch b/patches/aeadtest.c.patch
index ce62107..09838bc 100644
--- a/patches/aeadtest.c.patch
+++ b/patches/aeadtest.c.patch
@@ -1,6 +1,6 @@
 --- tests/aeadtest.c.orig       2016-10-18 17:03:33.845870889 +0900
 +++ tests/aeadtest.c    2016-10-18 17:11:19.880841283 +0900
-@@ -75,6 +75,12 @@
+@@ -76,6 +76,12 @@
  
  #define BUF_MAX 1024
  
diff --git a/patches/bio.h.patch b/patches/bio.h.patch
index 7212b54..9bfd43a 100644
--- a/patches/bio.h.patch
+++ b/patches/bio.h.patch
@@ -1,6 +1,6 @@
 --- include/openssl/bio.h.orig  Mon Oct  3 06:09:28 2016
 +++ include/openssl/bio.h       Sun Nov  6 04:24:57 2016
-@@ -678,8 +678,24 @@
+@@ -713,8 +713,24 @@
 
  /*long BIO_ghbn_ctrl(int cmd,int iarg,char *parg);*/
 
@@ -25,7 +25,7 @@
         __attribute__((__format__(__printf__, 2, 3), __nonnull__(2)));
  int
  BIO_vprintf(BIO *bio, const char *format, va_list args)
-@@ -692,6 +708,8 @@
+@@ -727,6 +743,8 @@
  BIO_vsnprintf(char *buf, size_t n, const char *format, va_list args)
         __attribute__((__deprecated__, __format__(__printf__, 3, 0),
             __nonnull__(3)));
diff --git a/patches/http.c.patch b/patches/http.c.patch
deleted file mode 100644
index 0e620cf..0000000
--- a/patches/http.c.patch
+++ /dev/null
@@ -1,12 +0,0 @@
---- apps/ocspcheck/http.c.orig  Sun Jun  4 00:45:29 2017
-+++ apps/ocspcheck/http.c       Sun Jun  4 00:45:57 2017
-@@ -35,7 +35,9 @@
- #include "http.h"
- #include <tls.h>
- 
-+#ifndef DEFAULT_CA_FILE
- #define DEFAULT_CA_FILE "/etc/ssl/cert.pem"
-+#endif
- 
- /*
-  * A buffer for transferring HTTP/S data.
diff --git a/patches/netcat.c.patch b/patches/netcat.c.patch
index 35f88db..2965ea7 100644
--- a/patches/netcat.c.patch
+++ b/patches/netcat.c.patch
@@ -1,16 +1,6 @@
 --- apps/nc/netcat.c.orig       Mon Jul 17 06:06:51 2017
 +++ apps/nc/netcat.c    Mon Jul 17 06:11:24 2017
-@@ -66,7 +66,9 @@
- #define POLL_NETIN     2
- #define POLL_STDOUT    3
- #define BUFSIZE                16384
-+#ifndef DEFAULT_CA_FILE
- #define DEFAULT_CA_FILE        "/etc/ssl/cert.pem"
-+#endif
- 
- #define TLS_ALL        (1 << 1)
- #define TLS_NOVERIFY   (1 << 2)
-@@ -95,9 +97,13 @@
+@@ -92,9 +92,13 @@
  int    Dflag;                                  /* sodebug */
  int    Iflag;                                  /* TCP receive buffer size */
  int    Oflag;                                  /* TCP send buffer size */
@@ -24,7 +14,7 @@
  
  int    usetls;                                 /* use TLS */
  char    *Cflag;                                        /* Public cert file */
-@@ -266,12 +272,14 @@
+@@ -266,12 +270,14 @@
                 case 'u':
                         uflag = 1;
                         break;
@@ -39,7 +29,7 @@
                 case 'v':
                         vflag = 1;
                         break;
-@@ -318,9 +326,11 @@
+@@ -318,9 +324,11 @@
                 case 'o':
                         oflag = optarg;
                         break;
@@ -51,7 +41,7 @@
                 case 'T':
                         errstr = NULL;
                         errno = 0;
-@@ -344,9 +354,11 @@
+@@ -344,9 +352,11 @@
         argc -= optind;
         argv += optind;
  
@@ -61,9 +51,9 @@
                         err(1, "setrtable");
 +#endif
  
-        if (family == AF_UNIX) {
-                if (pledge("stdio rpath wpath cpath tmppath unix", NULL) == -1)
-@@ -892,7 +904,10 @@
+        /* Cruft to make sure options are clean, and used properly. */
+        if (argv[0] && !argv[1] && family == AF_UNIX) {
+@@ -909,7 +919,10 @@
  remote_connect(const char *host, const char *port, struct addrinfo hints)
  {
         struct addrinfo *res, *res0;
@@ -75,7 +65,7 @@
  
         if ((error = getaddrinfo(host, port, &hints, &res0)))
                 errx(1, "getaddrinfo for host \"%s\" port %s: %s", host,
-@@ -907,8 +922,10 @@
+@@ -924,8 +937,10 @@
                 if (sflag || pflag) {
                         struct addrinfo ahints, *ares;
  
@@ -86,8 +76,8 @@
                         memset(&ahints, 0, sizeof(struct addrinfo));
                         ahints.ai_family = res->ai_family;
                         ahints.ai_socktype = uflag ? SOCK_DGRAM : SOCK_STREAM;
-@@ -979,7 +996,10 @@
- local_listen(char *host, char *port, struct addrinfo hints)
+@@ -996,7 +1011,10 @@
+ local_listen(const char *host, const char *port, struct addrinfo hints)
  {
         struct addrinfo *res, *res0;
 -       int s = -1, ret, x = 1, save_errno;
@@ -98,7 +88,7 @@
         int error;
  
         /* Allow nodename to be null. */
-@@ -1000,9 +1020,11 @@
+@@ -1017,9 +1035,11 @@
                     res->ai_protocol)) < 0)
                         continue;
  
@@ -110,7 +100,7 @@
  
                 set_common_sockopts(s, res->ai_family);
  
-@@ -1458,11 +1480,13 @@
+@@ -1475,11 +1495,13 @@
  {
         int x = 1;
  
@@ -124,7 +114,7 @@
         if (Dflag) {
                 if (setsockopt(s, SOL_SOCKET, SO_DEBUG,
                         &x, sizeof(x)) == -1)
-@@ -1473,9 +1497,16 @@
+@@ -1490,9 +1512,16 @@
                     IP_TOS, &Tflag, sizeof(Tflag)) == -1)
                         err(1, "set IP ToS");
  
@@ -141,7 +131,7 @@
         }
         if (Iflag) {
                 if (setsockopt(s, SOL_SOCKET, SO_RCVBUF,
-@@ -1499,13 +1530,17 @@
+@@ -1516,13 +1545,17 @@
         }
  
         if (minttl != -1) {
@@ -160,7 +150,7 @@
         }
  }
  
-@@ -1714,14 +1749,22 @@
+@@ -1748,14 +1781,22 @@
         \t-P proxyuser\tUsername for proxy authentication\n\
         \t-p port\t     Specify local port for remote connects\n\
         \t-R CAfile     CA bundle\n\
diff --git a/patches/ocsp_test.c.patch b/patches/ocsp_test.c.patch
index aa427db..03e02ac 100644
--- a/patches/ocsp_test.c.patch
+++ b/patches/ocsp_test.c.patch
@@ -1,6 +1,6 @@
 --- tests/ocsp_test.c.orig      2016-10-18 18:12:39.854607509 +0900
 +++ tests/ocsp_test.c   2016-10-18 18:14:29.261600559 +0900
-@@ -16,6 +16,11 @@
+@@ -35,6 +35,11 @@
         hints.ai_family = AF_INET;
         hints.ai_socktype = SOCK_STREAM;
  
diff --git a/patches/tls_internal.h.patch b/patches/tls_internal.h.patch
deleted file mode 100644
index e82bf96..0000000
--- a/patches/tls_internal.h.patch
+++ /dev/null
@@ -1,12 +0,0 @@
---- tls/tls_internal.h.orig     Sun Jul  9 06:16:17 2017
-+++ tls/tls_internal.h  Mon Jul 17 06:10:01 2017
-@@ -26,7 +26,9 @@
- 
- __BEGIN_HIDDEN_DECLS
- 
-+#ifndef _PATH_SSL_CA_FILE
- #define _PATH_SSL_CA_FILE "/etc/ssl/cert.pem"
-+#endif
- 
- #define TLS_CIPHERS_DEFAULT    "TLSv1.2+AEAD+ECDHE:TLSv1.2+AEAD+DHE"
- #define TLS_CIPHERS_COMPAT     "HIGH:!aNULL"
diff --git a/patches/tlsexttest.c.patch b/patches/tlsexttest.c.patch
index 981fc95..6a4184d 100644
--- a/patches/tlsexttest.c.patch
+++ b/patches/tlsexttest.c.patch
@@ -1,6 +1,6 @@
 --- tests/tlsexttest.c.orig     2017-12-30 20:03:09.279079726 +0900
 +++ tests/tlsexttest.c  2017-12-30 20:07:21.849939140 +0900
-@@ -1676,7 +1676,9 @@ static unsigned char tlsext_sni_clienthe
+@@ -1676,7 +1676,9 @@
  };
  
  static unsigned char tlsext_sni_serverhello[] = {
@@ -10,7 +10,7 @@
  
  static int
  test_tlsext_sni_clienthello(void)
-@@ -1839,9 +1841,9 @@ test_tlsext_sni_serverhello(void)
+@@ -1841,9 +1843,9 @@
         if (!CBB_finish(&cbb, &data, &dlen))
                 errx(1, "failed to finish CBB");
  
@@ -22,7 +22,7 @@
                 goto err;
         }
  
-@@ -1850,14 +1852,14 @@ test_tlsext_sni_serverhello(void)
+@@ -1852,14 +1854,14 @@
                 fprintf(stderr, "received:\n");
                 hexdump(data, dlen);
                 fprintf(stderr, "test data:\n");
@@ -39,7 +39,7 @@
         if (!tlsext_sni_serverhello_parse(ssl, &cbs, &alert)) {
                 FAIL("failed to parse serverhello SNI\n");
                 goto err;
-@@ -2741,7 +2743,10 @@ unsigned char tlsext_clienthello_default
+@@ -2744,7 +2746,10 @@
         0x03, 0x01, 0x03, 0x03, 0x02, 0x01, 0x02, 0x03,
  };
  
@@ -51,7 +51,7 @@
  
  static int
  test_tlsext_clienthello_build(void)
-@@ -2806,18 +2811,18 @@ test_tlsext_clienthello_build(void)
+@@ -2811,18 +2816,18 @@
         if (!CBB_finish(&cbb, &data, &dlen))
                 errx(1, "failed to finish CBB");
  
@@ -74,7 +74,7 @@
                 goto err;
         }
  
-@@ -2832,7 +2837,10 @@ test_tlsext_clienthello_build(void)
+@@ -2837,7 +2842,10 @@
         return (failure);
  }
  
@@ -86,7 +86,7 @@
  
  unsigned char tlsext_serverhello_enabled[] = {
         0x00, 0x13, 0xff, 0x01, 0x00, 0x01, 0x00, 0x00,
-@@ -2872,18 +2880,18 @@ test_tlsext_serverhello_build(void)
+@@ -2877,18 +2885,18 @@
         if (!CBB_finish(&cbb, &data, &dlen))
                 errx(1, "failed to finish CBB");