OpenSSL-1.0.1h added

2014-06-05 18:40:09 +04:00 · 2014-06-05 18:40:09 +04:00 · 45f7c4c20d
parent 0836bef981
commit 45f7c4c20d
4 changed files with 701 additions and 17 deletions
--- a/dev-libs/openssl/Manifest
+++ b/dev-libs/openssl/Manifest
@ -1,2 +1,2 @@
-DIST openssl-1.0.1g.tar.gz 4509047 SHA256 53cb818c3b90e507a8348f4f5eaedb05d8bfe5358aabb508b7263cc670c3e028 SHA512 66ebbad3c8ad98a07b486d39d0c3ae62b00133f8f2877cf8b97c461e7c7f40b29cf9c3cae82cf73a92dcf1daa63d33aa76c910fbcbe60158589fc7cb48f41e6d WHIRLPOOL 6bfb30d1f41b051f794e2eb80ad9116b064f6d464c22698538c4e16b85739b80744387ca160fd1a86b92814b5b1b3fc7d0658a709942b7b31b198da8cce37056
+DIST openssl-1.0.1h.tar.gz 4475692 SHA256 9d1c8a9836aa63e2c6adb684186cbd4371c9e9dcc01d6e3bb447abf2d4d3d093 SHA512 687d12ae13e364b15622f68933894050d577a4f8647bd68c7e9e86eb9d9f49cd2ebb0da3c5d3ded0a8746cf7b87e23b167b536116aa9a0402d7e7cc2ee401a92 WHIRLPOOL d453aaf24c6e2c8d9c5c76f76acfdaf8b511719fe25a4748c1681ff1d9e8a64b88249270e94900336cd110e1d7ee53a5e6d778a701967b7addb3f80c8335e5b2
 DIST openssl-c_rehash.sh.1.7 4167 SHA256 4999ee79892f52bd6a4a7baba9fac62262454d573bbffd72685d3aae9e48cee0 SHA512 55e8c2e827750a4f375cb83c86bfe2d166c01ffa5d7e9b16657b72b38b747c8985dd2c98f854c911dfbbee2ff3e92aff39fdf089d979b2e3534b7685ee8b80da WHIRLPOOL c88f06a3b8651f76b6289552cccceb64e13f6697c5f0ce3ff114c781ce1c218912b8ee308af9d087cd76a9600fdacda1953175bff07d7d3eb21b0c0b7f4f1ce1
--- a/dev-libs/openssl/files/openssl-1.0.1h-ipv6.patch
+++ b/dev-libs/openssl/files/openssl-1.0.1h-ipv6.patch
@ -0,0 +1,675 @@
+http://rt.openssl.org/Ticket/Display.html?id=2051
+user/pass: guest/guest
+
+Forward ported from openssl-1.0.1e-ipv6.patch
+
+Signed-off-by: Lars Wendler <polynomial-c@gentoo.org>
+
+--- openssl-1.0.1h/apps/s_apps.h
+++ openssl-1.0.1h/apps/s_apps.h
+@@ -148,7 +148,7 @@
+ #define PORT_STR        "4433"
+ #define PROTOCOL        "tcp"
+ 
+-int do_server(int port, int type, int *ret, int (*cb) (char *hostname, int s, unsigned char *context), unsigned char *context);
+int do_server(int port, int type, int *ret, int (*cb) (char *hostname, int s, unsigned char *context), unsigned char *context, int use_ipv4, int use_ipv6);
+ #ifdef HEADER_X509_H
+ int MS_CALLBACK verify_callback(int ok, X509_STORE_CTX *ctx);
+ #endif
+@@ -156,7 +156,7 @@
+ int set_cert_stuff(SSL_CTX *ctx, char *cert_file, char *key_file);
+ int set_cert_key_stuff(SSL_CTX *ctx, X509 *cert, EVP_PKEY *key);
+ #endif
+-int init_client(int *sock, char *server, int port, int type);
+int init_client(int *sock, char *server, int port, int type, int use_ipv4, int use_ipv6);
+ int should_retry(int i);
+ int extract_port(char *str, short *port_ptr);
+ int extract_host_port(char *str,char **host_ptr,unsigned char *ip,short *p);
+--- openssl-1.0.1h/apps/s_client.c
+++ openssl-1.0.1h/apps/s_client.c
+@@ -285,6 +285,10 @@
+ 	{
+ 	BIO_printf(bio_err,"usage: s_client args\n");
+ 	BIO_printf(bio_err,"\n");
+	BIO_printf(bio_err," -4             - use IPv4 only\n");
+#if OPENSSL_USE_IPV6
+	BIO_printf(bio_err," -6             - use IPv6 only\n");
+#endif
+ 	BIO_printf(bio_err," -host host     - use -connect instead\n");
+ 	BIO_printf(bio_err," -port port     - use -connect instead\n");
+ 	BIO_printf(bio_err," -connect host:port - who to connect to (default is %s:%s)\n",SSL_HOST_NAME,PORT_STR);
+@@ -568,6 +572,7 @@
+ 	int sbuf_len,sbuf_off;
+ 	fd_set readfds,writefds;
+ 	short port=PORT;
+	int use_ipv4, use_ipv6;
+ 	int full_log=1;
+ 	char *host=SSL_HOST_NAME;
+ 	char *cert_file=NULL,*key_file=NULL;
+@@ -613,7 +618,11 @@
+ #endif
+ 	char *sess_in = NULL;
+ 	char *sess_out = NULL;
+-	struct sockaddr peer;
+#if OPENSSL_USE_IPV6
+	struct sockaddr_storage peer;
+#else
+	struct sockaddr_in peer;
+#endif
+ 	int peerlen = sizeof(peer);
+ 	int enable_timeouts = 0 ;
+ 	long socket_mtu = 0;
+@@ -628,6 +637,12 @@
+ 
+ 	meth=SSLv23_client_method();
+ 
+	use_ipv4 = 1;
+#if OPENSSL_USE_IPV6
+	use_ipv6 = 1;
+#else
+	use_ipv6 = 0;
+#endif
+ 	apps_startup();
+ 	c_Pause=0;
+ 	c_quiet=0;
+@@ -949,6 +964,18 @@
+ 			jpake_secret = *++argv;
+ 			}
+ #endif
+		else if (strcmp(*argv,"-4") == 0)
+			{
+			use_ipv4 = 1;
+			use_ipv6 = 0;
+			}
+#if OPENSSL_USE_IPV6
+		else if (strcmp(*argv,"-6") == 0)
+			{
+			use_ipv4 = 0;
+			use_ipv6 = 1;
+			}
+#endif
+ #ifndef OPENSSL_NO_SRTP
+ 		else if (strcmp(*argv,"-use_srtp") == 0)
+ 			{
+@@ -1260,7 +1287,7 @@
+ 
+ re_start:
+ 
+-	if (init_client(&s,host,port,socket_type) == 0)
+	if (init_client(&s,host,port,socket_type,use_ipv4,use_ipv6) == 0)
+ 		{
+ 		BIO_printf(bio_err,"connect:errno=%d\n",get_last_socket_error());
+ 		SHUTDOWN(s);
+@@ -1286,7 +1313,7 @@
+ 		{
+ 
+ 		sbio=BIO_new_dgram(s,BIO_NOCLOSE);
+-		if (getsockname(s, &peer, (void *)&peerlen) < 0)
+		if (getsockname(s, (struct sockaddr *)&peer, (void *)&peerlen) < 0)
+ 			{
+ 			BIO_printf(bio_err, "getsockname:errno=%d\n",
+ 				get_last_socket_error());
+--- openssl-1.0.1h/apps/s_server.c
+++ openssl-1.0.1h/apps/s_server.c
+@@ -560,6 +560,10 @@
+         BIO_printf(bio_err," -use_srtp profiles - Offer SRTP key management with a colon-separated profile list\n");
+ # endif
+ #endif
+	BIO_printf(bio_err," -4            - use IPv4 only\n");
+#if OPENSSL_USE_IPV6
+	BIO_printf(bio_err," -6            - use IPv6 only\n");
+#endif
+ 	BIO_printf(bio_err," -keymatexport label   - Export keying material using label\n");
+ 	BIO_printf(bio_err," -keymatexportlen len  - Export len bytes of keying material (default 20)\n");
+ 	}
+@@ -947,6 +951,7 @@
+ 	int state=0;
+ 	const SSL_METHOD *meth=NULL;
+ 	int socket_type=SOCK_STREAM;
+	int use_ipv4, use_ipv6;
+ 	ENGINE *e=NULL;
+ 	char *inrand=NULL;
+ 	int s_cert_format = FORMAT_PEM, s_key_format = FORMAT_PEM;
+@@ -975,6 +980,12 @@
+ #endif
+ 	meth=SSLv23_server_method();
+ 
+	use_ipv4 = 1;
+#if OPENSSL_USE_IPV6
+	use_ipv6 = 1;
+#else
+	use_ipv6 = 0;
+#endif
+ 	local_argc=argc;
+ 	local_argv=argv;
+ 
+@@ -1323,6 +1334,18 @@
+ 			jpake_secret = *(++argv);
+ 			}
+ #endif
+		else if (strcmp(*argv,"-4") == 0)
+			{
+			use_ipv4 = 1;
+			use_ipv6 = 0;
+			}
+#if OPENSSL_USE_IPV6
+		else if (strcmp(*argv,"-6") == 0)
+			{
+			use_ipv4 = 0;
+			use_ipv6 = 1;
+			}
+#endif
+ #ifndef OPENSSL_NO_SRTP
+ 		else if (strcmp(*argv,"-use_srtp") == 0)
+ 			{
+@@ -1881,9 +1904,9 @@
+ 	BIO_printf(bio_s_out,"ACCEPT\n");
+ 	(void)BIO_flush(bio_s_out);
+ 	if (www)
+-		do_server(port,socket_type,&accept_socket,www_body, context);
+		do_server(port,socket_type,&accept_socket,www_body, context, use_ipv4, use_ipv6);
+ 	else
+-		do_server(port,socket_type,&accept_socket,sv_body, context);
+		do_server(port,socket_type,&accept_socket,sv_body, context, use_ipv4, use_ipv6);
+ 	print_stats(bio_s_out,ctx);
+ 	ret=0;
+ end:
+--- openssl-1.0.1h/apps/s_socket.c
+++ openssl-1.0.1h/apps/s_socket.c
+@@ -97,16 +97,16 @@
+ #include "netdb.h"
+ #endif
+ 
+-static struct hostent *GetHostByName(char *name);
+static struct hostent *GetHostByName(char *name, int domain);
+ #if defined(OPENSSL_SYS_WINDOWS) || (defined(OPENSSL_SYS_NETWARE) && !defined(NETWARE_BSDSOCK))
+ static void ssl_sock_cleanup(void);
+ #endif
+ static int ssl_sock_init(void);
+-static int init_client_ip(int *sock,unsigned char ip[4], int port, int type);
+-static int init_server(int *sock, int port, int type);
+-static int init_server_long(int *sock, int port,char *ip, int type);
+static int init_client_ip(int *sock,unsigned char *ip, int port, int type, int domain);
+static int init_server(int *sock, int port, int type, int use_ipv4, int use_ipv6);
+static int init_server_long(int *sock, int port,char *ip, int type, int use_ipv4, int use_ipv6);
+ static int do_accept(int acc_sock, int *sock, char **host);
+-static int host_ip(char *str, unsigned char ip[4]);
+static int host_ip(char *str, unsigned char *ip, int domain);
+ 
+ #ifdef OPENSSL_SYS_WIN16
+ #define SOCKET_PROTOCOL	0 /* more microsoft stupidity */
+@@ -234,38 +234,68 @@
+ 	return(1);
+ 	}
+ 
+-int init_client(int *sock, char *host, int port, int type)
+int init_client(int *sock, char *host, int port, int type, int use_ipv4, int use_ipv6)
+ 	{
+#if OPENSSL_USE_IPV6
+	unsigned char ip[16];
+#else
+ 	unsigned char ip[4];
+#endif
+ 
+-	memset(ip, '\0', sizeof ip);
+-	if (!host_ip(host,&(ip[0])))
+-		return 0;
+-	return init_client_ip(sock,ip,port,type);
+-	}
+-
+-static int init_client_ip(int *sock, unsigned char ip[4], int port, int type)
+-	{
+-	unsigned long addr;
+	if (use_ipv4)
+		if (host_ip(host,ip,AF_INET))
+			return(init_client_ip(sock,ip,port,type,AF_INET));
+#if OPENSSL_USE_IPV6
+	if (use_ipv6)
+		if (host_ip(host,ip,AF_INET6))
+			return(init_client_ip(sock,ip,port,type,AF_INET6));
+#endif
+	return 0;
+	}
+
+static int init_client_ip(int *sock, unsigned char ip[4], int port, int type, int domain)
+	{
+#if OPENSSL_USE_IPV6
+	struct sockaddr_storage them;
+	struct sockaddr_in *them_in = (struct sockaddr_in *)&them;
+	struct sockaddr_in6 *them_in6 = (struct sockaddr_in6 *)&them;
+#else
+ 	struct sockaddr_in them;
+	struct sockaddr_in *them_in = &them;
+#endif
+	socklen_t addr_len;
+ 	int s,i;
+ 
+ 	if (!ssl_sock_init()) return(0);
+ 
+ 	memset((char *)&them,0,sizeof(them));
+-	them.sin_family=AF_INET;
+-	them.sin_port=htons((unsigned short)port);
+-	addr=(unsigned long)
+-		((unsigned long)ip[0]<<24L)|
+-		((unsigned long)ip[1]<<16L)|
+-		((unsigned long)ip[2]<< 8L)|
+-		((unsigned long)ip[3]);
+-	them.sin_addr.s_addr=htonl(addr);
+	if (domain == AF_INET)
+		{
+		addr_len = (socklen_t)sizeof(struct sockaddr_in);
+		them_in->sin_family=AF_INET;
+		them_in->sin_port=htons((unsigned short)port);
+#ifndef BIT_FIELD_LIMITS
+		memcpy(&them_in->sin_addr.s_addr, ip, 4);
+#else
+		memcpy(&them_in->sin_addr, ip, 4);
+#endif
+		}
+	else
+#if OPENSSL_USE_IPV6
+		{
+		addr_len = (socklen_t)sizeof(struct sockaddr_in6);
+		them_in6->sin6_family=AF_INET6;
+		them_in6->sin6_port=htons((unsigned short)port);
+		memcpy(&(them_in6->sin6_addr), ip, sizeof(struct in6_addr));
+		}
+#else
+		return(0);
+#endif
+ 
+ 	if (type == SOCK_STREAM)
+-		s=socket(AF_INET,SOCK_STREAM,SOCKET_PROTOCOL);
+		s=socket(domain,SOCK_STREAM,SOCKET_PROTOCOL);
+ 	else /* ( type == SOCK_DGRAM) */
+-		s=socket(AF_INET,SOCK_DGRAM,IPPROTO_UDP);
+		s=socket(domain,SOCK_DGRAM,IPPROTO_UDP);
+ 			
+ 	if (s == INVALID_SOCKET) { perror("socket"); return(0); }
+ 
+@@ -277,29 +307,27 @@
+ 		if (i < 0) { closesocket(s); perror("keepalive"); return(0); }
+ 		}
+ #endif
+-
+-	if (connect(s,(struct sockaddr *)&them,sizeof(them)) == -1)
+	if (connect(s,(struct sockaddr *)&them,addr_len) == -1)
+ 		{ closesocket(s); perror("connect"); return(0); }
+ 	*sock=s;
+ 	return(1);
+ 	}
+ 
+-int do_server(int port, int type, int *ret, int (*cb)(char *hostname, int s, unsigned char *context), unsigned char *context)
+int do_server(int port, int type, int *ret, int (*cb)(char *hostname, int s, unsigned char *context), unsigned char *context, int use_ipv4, int use_ipv6)
+ 	{
+ 	int sock;
+ 	char *name = NULL;
+ 	int accept_socket = 0;
+ 	int i;
+ 
+-	if (!init_server(&accept_socket,port,type)) return(0);
+-
+	if (!init_server(&accept_socket,port,type, use_ipv4, use_ipv6)) return(0);
+ 	if (ret != NULL)
+ 		{
+ 		*ret=accept_socket;
+ 		/* return(1);*/
+ 		}
+-  	for (;;)
+-  		{
+	for (;;)
+		{
+ 		if (type==SOCK_STREAM)
+ 			{
+ 			if (do_accept(accept_socket,&sock,&name) == 0)
+@@ -322,41 +350,88 @@
+ 		}
+ 	}
+ 
+-static int init_server_long(int *sock, int port, char *ip, int type)
+static int init_server_long(int *sock, int port, char *ip, int type, int use_ipv4, int use_ipv6)
+ 	{
+ 	int ret=0;
+	int domain;
+#if OPENSSL_USE_IPV6
+	struct sockaddr_storage server;
+	struct sockaddr_in *server_in = (struct sockaddr_in *)&server;
+	struct sockaddr_in6 *server_in6 = (struct sockaddr_in6 *)&server;
+#else
+ 	struct sockaddr_in server;
+	struct sockaddr_in *server_in = &server;
+#endif
+	socklen_t addr_len;
+ 	int s= -1;
+ 
+	if (!use_ipv4 && !use_ipv6)
+		goto err;
+#if OPENSSL_USE_IPV6
+	/* we are fine here */
+#else
+	if (use_ipv6)
+		goto err;
+#endif
+ 	if (!ssl_sock_init()) return(0);
+ 
+-	memset((char *)&server,0,sizeof(server));
+-	server.sin_family=AF_INET;
+-	server.sin_port=htons((unsigned short)port);
+-	if (ip == NULL)
+-		server.sin_addr.s_addr=INADDR_ANY;
+-	else
+-/* Added for T3E, address-of fails on bit field (beckman@acl.lanl.gov) */
+-#ifndef BIT_FIELD_LIMITS
+-		memcpy(&server.sin_addr.s_addr,ip,4);
+#if OPENSSL_USE_IPV6
+	domain = use_ipv6 ? AF_INET6 : AF_INET;
+ #else
+-		memcpy(&server.sin_addr,ip,4);
+	domain = AF_INET;
+ #endif
+-	
+-		if (type == SOCK_STREAM)
+-			s=socket(AF_INET,SOCK_STREAM,SOCKET_PROTOCOL);
+-		else /* type == SOCK_DGRAM */
+-			s=socket(AF_INET, SOCK_DGRAM,IPPROTO_UDP);
+	if (type == SOCK_STREAM)
+		s=socket(domain,SOCK_STREAM,SOCKET_PROTOCOL);
+	else /* type == SOCK_DGRAM */
+		s=socket(domain, SOCK_DGRAM,IPPROTO_UDP);
+ 
+ 	if (s == INVALID_SOCKET) goto err;
+ #if defined SOL_SOCKET && defined SO_REUSEADDR
+	{
+	int j = 1;
+	setsockopt(s, SOL_SOCKET, SO_REUSEADDR,
+		   (void *) &j, sizeof j);
+	}
+#endif
+#if OPENSSL_USE_IPV6
+	if ((use_ipv4 == 0) && (use_ipv6 == 1))
+		{
+		const int on = 1;
+
+		setsockopt(s, IPPROTO_IPV6, IPV6_V6ONLY,
+		           (const void *) &on, sizeof(int));
+		}
+#endif
+	if (domain == AF_INET)
+		{
+		addr_len = (socklen_t)sizeof(struct sockaddr_in);
+		memset(server_in, 0, sizeof(struct sockaddr_in));
+		server_in->sin_family=AF_INET;
+		server_in->sin_port = htons((unsigned short)port);
+		if (ip == NULL)
+			server_in->sin_addr.s_addr = htonl(INADDR_ANY);
+		else
+/* Added for T3E, address-of fails on bit field (beckman@acl.lanl.gov) */
+#ifndef BIT_FIELD_LIMITS
+			memcpy(&server_in->sin_addr.s_addr, ip, 4);
+#else
+			memcpy(&server_in->sin_addr, ip, 4);
+#endif
+		}
+#if OPENSSL_USE_IPV6
+	else
+ 		{
+-		int j = 1;
+-		setsockopt(s, SOL_SOCKET, SO_REUSEADDR,
+-			   (void *) &j, sizeof j);
+		addr_len = (socklen_t)sizeof(struct sockaddr_in6);
+		memset(server_in6, 0, sizeof(struct sockaddr_in6));
+		server_in6->sin6_family = AF_INET6;
+		server_in6->sin6_port = htons((unsigned short)port);
+		if (ip == NULL)
+			server_in6->sin6_addr = in6addr_any;
+		else
+			memcpy(&server_in6->sin6_addr, ip, sizeof(struct in6_addr));
+ 		}
+ #endif
+-	if (bind(s,(struct sockaddr *)&server,sizeof(server)) == -1)
+	if (bind(s, (struct sockaddr *)&server, addr_len) == -1)
+ 		{
+ #ifndef OPENSSL_SYS_WINDOWS
+ 		perror("bind");
+@@ -375,16 +450,23 @@
+ 	return(ret);
+ 	}
+ 
+-static int init_server(int *sock, int port, int type)
+static int init_server(int *sock, int port, int type, int use_ipv4, int use_ipv6)
+ 	{
+-	return(init_server_long(sock, port, NULL, type));
+	return(init_server_long(sock, port, NULL, type, use_ipv4, use_ipv6));
+ 	}
+ 
+ static int do_accept(int acc_sock, int *sock, char **host)
+ 	{
+ 	int ret;
+ 	struct hostent *h1,*h2;
+-	static struct sockaddr_in from;
+#if OPENSSL_USE_IPV6
+	struct sockaddr_storage from;
+	struct sockaddr_in *from_in = (struct sockaddr_in *)&from;
+	struct sockaddr_in6 *from_in6 = (struct sockaddr_in6 *)&from;
+#else
+	struct sockaddr_in from;
+	struct sockaddr_in *from_in = &from;
+#endif
+ 	int len;
+ /*	struct linger ling; */
+ 
+@@ -431,13 +513,23 @@
+ */
+ 
+ 	if (host == NULL) goto end;
+#if OPENSSL_USE_IPV6
+	if (from.ss_family == AF_INET)
+#else
+	if (from.sin_family == AF_INET)
+#endif
+ #ifndef BIT_FIELD_LIMITS
+-	/* I should use WSAAsyncGetHostByName() under windows */
+-	h1=gethostbyaddr((char *)&from.sin_addr.s_addr,
+-		sizeof(from.sin_addr.s_addr),AF_INET);
+		/* I should use WSAAsyncGetHostByName() under windows */
+		h1=gethostbyaddr((char *)&from_in->sin_addr.s_addr,
+		                 sizeof(from_in->sin_addr.s_addr), AF_INET);
+ #else
+-	h1=gethostbyaddr((char *)&from.sin_addr,
+-		sizeof(struct in_addr),AF_INET);
+		h1=gethostbyaddr((char *)&from_in->sin_addr,
+		                 sizeof(struct in_addr), AF_INET);
+#endif
+#if OPENSSL_USE_IPV6
+	else
+		h1=gethostbyaddr((char *)&from_in6->sin6_addr,
+		                 sizeof(struct in6_addr), AF_INET6);
+ #endif
+ 	if (h1 == NULL)
+ 		{
+@@ -455,16 +547,25 @@
+ 			}
+ 		BUF_strlcpy(*host,h1->h_name,strlen(h1->h_name)+1);
+ 
+-		h2=GetHostByName(*host);
+#if OPENSSL_USE_IPV6		
+		h2=GetHostByName(*host, from.ss_family);
+#else
+		h2=GetHostByName(*host, from.sin_family);
+#endif
+
+ 		if (h2 == NULL)
+ 			{
+ 			BIO_printf(bio_err,"gethostbyname failure\n");
+ 			closesocket(ret);
+ 			return(0);
+ 			}
+-		if (h2->h_addrtype != AF_INET)
+#if OPENSSL_USE_IPV6
+		if (h2->h_addrtype != from.ss_family)
+#else
+		if (h2->h_addrtype != from.sin_family)
+#endif
+ 			{
+-			BIO_printf(bio_err,"gethostbyname addr is not AF_INET\n");
+			BIO_printf(bio_err,"gethostbyname addr address is not correct\n");
+ 			closesocket(ret);
+ 			return(0);
+ 			}
+@@ -480,7 +581,7 @@
+ 	char *h,*p;
+ 
+ 	h=str;
+-	p=strchr(str,':');
+	p=strrchr(str,':');
+ 	if (p == NULL)
+ 		{
+ 		BIO_printf(bio_err,"no port defined\n");
+@@ -488,7 +589,7 @@
+ 		}
+ 	*(p++)='\0';
+ 
+-	if ((ip != NULL) && !host_ip(str,ip))
+	if ((ip != NULL) && !host_ip(str,ip,AF_INET))
+ 		goto err;
+ 	if (host_ptr != NULL) *host_ptr=h;
+ 
+@@ -499,48 +600,58 @@
+ 	return(0);
+ 	}
+ 
+-static int host_ip(char *str, unsigned char ip[4])
+static int host_ip(char *str, unsigned char *ip, int domain)
+ 	{
+-	unsigned int in[4]; 
+	unsigned int in[4];
+	unsigned long l;
+ 	int i;
+ 
+-	if (sscanf(str,"%u.%u.%u.%u",&(in[0]),&(in[1]),&(in[2]),&(in[3])) == 4)
+	if ((domain == AF_INET) &&
+	    (sscanf(str,"%u.%u.%u.%u",&(in[0]),&(in[1]),&(in[2]),&(in[3])) == 4))
+ 		{
+		
+ 		for (i=0; i<4; i++)
+ 			if (in[i] > 255)
+ 				{
+ 				BIO_printf(bio_err,"invalid IP address\n");
+ 				goto err;
+ 				}
+-		ip[0]=in[0];
+-		ip[1]=in[1];
+-		ip[2]=in[2];
+-		ip[3]=in[3];
+-		}
+		l=htonl((in[0]<<24L)|(in[1]<<16L)|(in[2]<<8L)|in[3]);
+		memcpy(ip, &l, 4);
+		return 1;
+		}
+#if OPENSSL_USE_IPV6
+	else if ((domain == AF_INET6) &&
+	         (inet_pton(AF_INET6, str, ip) == 1))
+	         return 1;
+#endif
+ 	else
+ 		{ /* do a gethostbyname */
+ 		struct hostent *he;
+ 
+ 		if (!ssl_sock_init()) return(0);
+ 
+-		he=GetHostByName(str);
+		he=GetHostByName(str,domain);
+ 		if (he == NULL)
+ 			{
+ 			BIO_printf(bio_err,"gethostbyname failure\n");
+ 			goto err;
+ 			}
+ 		/* cast to short because of win16 winsock definition */
+-		if ((short)he->h_addrtype != AF_INET)
+		if ((short)he->h_addrtype != domain)
+ 			{
+-			BIO_printf(bio_err,"gethostbyname addr is not AF_INET\n");
+			BIO_printf(bio_err,"gethostbyname addr family is not correct\n");
+ 			return(0);
+ 			}
+-		ip[0]=he->h_addr_list[0][0];
+-		ip[1]=he->h_addr_list[0][1];
+-		ip[2]=he->h_addr_list[0][2];
+-		ip[3]=he->h_addr_list[0][3];
+		if (domain == AF_INET)
+			memset(ip, 0, 4);
+#if OPENSSL_USE_IPV6
+		else
+			memset(ip, 0, 16);
+#endif
+		memcpy(ip, he->h_addr_list[0], he->h_length);
+		return 1;
+ 		}
+-	return(1);
+ err:
+ 	return(0);
+ 	}
+@@ -577,7 +688,7 @@
+ static unsigned long ghbn_hits=0L;
+ static unsigned long ghbn_miss=0L;
+ 
+-static struct hostent *GetHostByName(char *name)
+static struct hostent *GetHostByName(char *name, int domain)
+ 	{
+ 	struct hostent *ret;
+ 	int i,lowi=0;
+@@ -592,14 +703,20 @@
+ 			}
+ 		if (ghbn_cache[i].order > 0)
+ 			{
+-			if (strncmp(name,ghbn_cache[i].name,128) == 0)
+			if ((strncmp(name,ghbn_cache[i].name,128) == 0) &&
+			    (ghbn_cache[i].ent.h_addrtype == domain))
+ 				break;
+ 			}
+ 		}
+ 	if (i == GHBN_NUM) /* no hit*/
+ 		{
+ 		ghbn_miss++;
+-		ret=gethostbyname(name);
+		if (domain == AF_INET)
+			ret=gethostbyname(name);
+#if OPENSSL_USE_IPV6
+		else
+			ret=gethostbyname2(name, AF_INET6);
+#endif
+ 		if (ret == NULL) return(NULL);
+ 		/* else add to cache */
+ 		if(strlen(name) < sizeof ghbn_cache[0].name)
+--- openssl-1.0.1h/apps/s_socket.c.rej
+++ openssl-1.0.1h/apps/s_socket.c.rej
+@@ -0,0 +1,29 @@
+--- apps/s_socket.c	2 Dec 2011 14:39:40 -0000	1.43.2.3.2.2
++++ apps/s_socket.c	28 Dec 2011 00:28:14 -0000
+@@ -546,15 +646,23 @@
+ 			}
+ 		BUF_strlcpy(*host,h1->h_name,strlen(h1->h_name)+1);
+ 
+-		h2=GetHostByName(*host);
++#if OPENSSL_USE_IPV6
++		h2=GetHostByName(*host, from.ss_family);
++#else
++		h2=GetHostByName(*host, from.sin_family);
++#endif
+ 		if (h2 == NULL)
+ 			{
+ 			BIO_printf(bio_err,"gethostbyname failure\n");
+ 			return(0);
+ 			}
+-		if (h2->h_addrtype != AF_INET)
++#if OPENSSL_USE_IPV6
++		if (h2->h_addrtype != from.ss_family)
++#else
++		if (h2->h_addrtype != from.sin_family)
++#endif
+ 			{
+-			BIO_printf(bio_err,"gethostbyname addr is not AF_INET\n");
++			BIO_printf(bio_err,"gethostbyname addr address is not correct\n");
+ 			return(0);
+ 			}
+ 		}
--- a/dev-libs/openssl/openssl-1.0.1h.ebuild
+++ b/dev-libs/openssl/openssl-1.0.1h.ebuild
@ -1,10 +1,10 @@
 # Copyright 1999-2014 Gentoo Foundation
 # Distributed under the terms of the GNU General Public License v2
-# $Header: /var/cvsroot/gentoo-x86/dev-libs/openssl/openssl-1.0.1g.ebuild,v 1.1 2014/04/07 18:10:03 vapier Exp $
+# $Header: /var/cvsroot/gentoo-x86/dev-libs/openssl/openssl-1.0.1h.ebuild,v 1.1 2014/06/05 12:53:23 polynomial-c Exp $

 EAPI="4"

-inherit eutils flag-o-matic toolchain-funcs multilib
+inherit eutils flag-o-matic toolchain-funcs multilib multilib-minimal

 REV="1.7"
 DESCRIPTION="full-strength general purpose cryptography library (including SSL and TLS)"
@ -17,16 +17,16 @@ SLOT="0"
 KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~s390 ~sh ~sparc ~x86 ~amd64-fbsd ~sparc-fbsd ~x86-fbsd ~arm-linux ~x86-linux"
 IUSE="bindist gmp kerberos rfc3779 sse2 static-libs test +tls-heartbeat vanilla zlib"

-# Have the sub-libs in RDEPEND with [static-libs] since, logically,
-# our libssl.a depends on libz.a/etc... at runtime.
-LIB_DEPEND="gmp? ( dev-libs/gmp[static-libs(+)] )
-	zlib? ( sys-libs/zlib[static-libs(+)] )
-	kerberos? ( app-crypt/mit-krb5 )"
 # The blocks are temporary just to make sure people upgrade to a
 # version that lack runtime version checking.  We'll drop them in
 # the future.
-RDEPEND="static-libs? ( ${LIB_DEPEND} )
-	!static-libs? ( ${LIB_DEPEND//\[static-libs(+)]} )
+RDEPEND="gmp? ( dev-libs/gmp[static-libs(+)?,${MULTILIB_USEDEP}] )
+	zlib? ( sys-libs/zlib[static-libs(+)?,${MULTILIB_USEDEP}] )
+	kerberos? ( app-crypt/mit-krb5[${MULTILIB_USEDEP}] )
+	abi_x86_32? (
+		!<=app-emulation/emul-linux-x86-baselibs-20140406-r3
+		!app-emulation/emul-linux-x86-baselibs[-abi_x86_32(-)]
+	)
 	!<net-misc/openssh-5.9_p1-r4
 	!<net-libs/neon-0.29.6-r1"
 DEPEND="${RDEPEND}
@ -45,6 +45,10 @@ src_unpack() {
 		> "${WORKDIR}"/c_rehash || die #416717
 }

+MULTILIB_WRAPPED_HEADERS=(
+	usr/include/openssl/opensslconf.h
+)
+
 src_prepare() {
 	# Make sure we only ever touch Makefile.org and avoid patching a file
 	# that gets blown away anyways by the Configure script in src_configure
@ -56,8 +60,7 @@ src_prepare() {
 		epatch "${FILESDIR}"/${PN}-1.0.0h-pkg-config.patch
 		epatch "${FILESDIR}"/${PN}-1.0.1-parallel-build.patch
 		epatch "${FILESDIR}"/${PN}-1.0.1-x32.patch
-		epatch "${FILESDIR}"/${PN}-1.0.1e-ipv6.patch
-		epatch "${FILESDIR}"/${PN}-1.0.1f-perl-5.18.patch #497286
+		epatch "${FILESDIR}"/${PN}-1.0.1h-ipv6.patch
 		epatch "${FILESDIR}"/${PN}-1.0.1e-s_client-verify.patch #472584
 		epatch "${FILESDIR}"/${PN}-1.0.1f-revert-alpha-perl-generation.patch #499086
 		epatch_user #332661
@ -89,9 +92,11 @@ src_prepare() {
 	# The config script does stupid stuff to prompt the user.  Kill it.
 	sed -i '/stty -icanon min 0 time 50; read waste/d' config || die
 	./config --test-sanity || die "I AM NOT SANE"
+
+	multilib_copy_sources
 }

-src_configure() {
+multilib_src_configure() {
 	unset APPS #197996
 	unset SCRIPTS #312551
 	unset CROSS_COMPILE #311473
@ -125,6 +130,7 @@ src_configure() {
 	einfo "Use configuration ${sslout:-(openssl knows best)}"
 	local config="Configure"
 	[[ -z ${sslout} ]] && config="config"
+
 	echoit \
 	./${config} \
 		${sslout} \
@ -162,7 +168,7 @@ src_configure() {
 		Makefile || die
 }

-src_compile() {
+multilib_src_compile() {
 	# depend is needed to use $confopts; it also doesn't matter
 	# that it's -j1 as the code itself serializes subdirs
 	emake -j1 depend
@ -172,12 +178,15 @@ src_compile() {
 	emake rehash
 }

-src_test() {
+multilib_src_test() {
 	emake -j1 test
 }

-src_install() {
+multilib_src_install() {
 	emake INSTALL_PREFIX="${D}" install
+}
+
+multilib_src_install_all() {
 	dobin "${WORKDIR}"/c_rehash #333117
 	dodoc CHANGES* FAQ NEWS README doc/*.txt doc/c-indentation.el
 	dohtml -r doc/*
--- a/profiles/default/linux/amd64/13.0/backbone/desktop/package.accept_keywords
+++ b/profiles/default/linux/amd64/13.0/backbone/desktop/package.accept_keywords
@ -90,7 +90,7 @@ dev-libs/libmirage ~amd64
 dev-libs/libpeas ~amd64
 dev-libs/nspr ~amd64
 <dev-libs/nss-3.17 ~amd64
-=dev-libs/openssl-1.0.1g ~amd64
+<dev-libs/openssl-1.1 ~amd64
 <dev-libs/rasqal-0.9.31 ~amd64
 <dev-libs/tinyxml2-2.1 ~amd64
 dev-libs/vala-common ~amd64