libressl: security fix for OpenBSD 5.9 errata 11.

srcpkgs/libressl/patches/011_crypto.patch

@@ -0,0 +1,32 @@
+OpenBSD 5.9 errata 11, June 6, 2016:
+
+Correct a problem that prevents the DSA signing algorithm from running
+in constant time even if the flag BN_FLG_CONSTTIME is set. This issue
+was reported by Cesar Pereida (Aalto University), Billy Brumley
+(Tampere University of Technology), and Yuval Yarom (The University of
+Adelaide and NICTA). The fix was developed by Cesar Pereida.
+
+--- crypto/dsa/dsa_ossl.c	10 Sep 2015 07:58:28 -0000	1.23
++++ crypto/dsa/dsa_ossl.c	5 Jun 2016 20:17:11 -0000
+@@ -247,9 +247,6 @@ dsa_sign_setup(DSA *dsa, BN_CTX *ctx_in,
+ 		if (!BN_rand_range(&k, dsa->q))
+ 			goto err;
+ 	} while (BN_is_zero(&k));
+-	if ((dsa->flags & DSA_FLAG_NO_EXP_CONSTTIME) == 0) {
+-		BN_set_flags(&k, BN_FLG_CONSTTIME);
+-	}
+ 
+ 	if (dsa->flags & DSA_FLAG_CACHE_MONT_P) {
+ 		if (!BN_MONT_CTX_set_locked(&dsa->method_mont_p,
+@@ -283,6 +280,11 @@ dsa_sign_setup(DSA *dsa, BN_CTX *ctx_in,
+ 	} else {
+ 		K = &k;
+ 	}
++
++	if ((dsa->flags & DSA_FLAG_NO_EXP_CONSTTIME) == 0) {
++		BN_set_flags(&k, BN_FLG_CONSTTIME);
++	}
++
+ 	DSA_BN_MOD_EXP(goto err, dsa, r, dsa->g, K, dsa->p, ctx,
+ 	    dsa->method_mont_p);
+ 	if (!BN_mod(r,r,dsa->q,ctx))

srcpkgs/libressl/template

@@ -1,7 +1,7 @@
 # Template file for 'libressl'
 pkgname=libressl
 version=2.3.5
-revision=1
+revision=2
 bootstrap=yes
 build_style=gnu-configure
 short_desc="Version of the TLS/crypto stack forked from OpenSSL"