Skip to content

Commit b8d0906

Browse files
hassaanprichardlau
hassaanp
authored and
richardlau
committed
deps: upgrade openssl sources to quictls/openssl-3.0.2+quic
This updates all sources in deps/openssl/openssl by: $ git clone [email protected]:quictls/openssl.git $ cd openssl $ cd ../node/deps/openssl $ rm -rf openssl $ cp -R ../openssl openssl $ rm -rf openssl/.git* openssl/.travis* $ git add --all openssl $ git commit openssl PR-URL: #42356 Refs: https://mta.openssl.org/pipermail/openssl-announce/2022-March/000217.html Reviewed-By: Richard Lau <[email protected]> Reviewed-By: Antoine du Hamel <[email protected]> Reviewed-By: Darshan Sen <[email protected]> Reviewed-By: Tobias Nießen <[email protected]> Reviewed-By: Michael Dawson <[email protected]>
1 parent 457e31e commit b8d0906

File tree

301 files changed

+5458
-1187
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

301 files changed

+5458
-1187
lines changed

‎deps/openssl/openssl/CHANGES.md

+57-1
Original file line numberDiff line numberDiff line change
@@ -28,12 +28,68 @@ breaking changes, and mappings for the large list of deprecated functions.
2828

2929
[Migration guide]: https://github.com/openssl/openssl/tree/master/doc/man7/migration_guide.pod
3030

31-
### Changes between 3.0.0 and 3.0.0+quic [7 Sun 2021]
31+
### Changes between 3.0.2 and 3.0.2+quic [15 Mar 2022]
3232

3333
* Add QUIC API support from BoringSSL.
3434

3535
*Todd Short*
3636

37+
### Changes between 3.0.1 and 3.0.2 [15 Mar 2022]
38+
39+
* Fixed a bug in the BN_mod_sqrt() function that can cause it to loop forever
40+
for non-prime moduli.
41+
42+
Internally this function is used when parsing certificates that contain
43+
elliptic curve public keys in compressed form or explicit elliptic curve
44+
parameters with a base point encoded in compressed form.
45+
46+
It is possible to trigger the infinite loop by crafting a certificate that
47+
has invalid explicit curve parameters.
48+
49+
Since certificate parsing happens prior to verification of the certificate
50+
signature, any process that parses an externally supplied certificate may thus
51+
be subject to a denial of service attack. The infinite loop can also be
52+
reached when parsing crafted private keys as they can contain explicit
53+
elliptic curve parameters.
54+
55+
Thus vulnerable situations include:
56+
57+
- TLS clients consuming server certificates
58+
- TLS servers consuming client certificates
59+
- Hosting providers taking certificates or private keys from customers
60+
- Certificate authorities parsing certification requests from subscribers
61+
- Anything else which parses ASN.1 elliptic curve parameters
62+
63+
Also any other applications that use the BN_mod_sqrt() where the attacker
64+
can control the parameter values are vulnerable to this DoS issue.
65+
([CVE-2022-0778])
66+
67+
*Tomáš Mráz*
68+
69+
* Add ciphersuites based on DHE_PSK (RFC 4279) and ECDHE_PSK (RFC 5489)
70+
to the list of ciphersuites providing Perfect Forward Secrecy as
71+
required by SECLEVEL >= 3.
72+
73+
*Dmitry Belyavskiy, Nicola Tuveri*
74+
75+
* Made the AES constant time code for no-asm configurations
76+
optional due to the resulting 95% performance degradation.
77+
The AES constant time code can be enabled, for no assembly
78+
builds, with: ./config no-asm -DOPENSSL_AES_CONST_TIME
79+
80+
*Paul Dale*
81+
82+
* Fixed PEM_write_bio_PKCS8PrivateKey() to make it possible to use empty
83+
passphrase strings.
84+
85+
*Darshan Sen*
86+
87+
* The negative return value handling of the certificate verification callback
88+
was reverted. The replacement is to set the verification retry state with
89+
the SSL_set_retry_verify() function.
90+
91+
*Tomáš Mráz*
92+
3793
### Changes between 3.0.0 and 3.0.1 [14 Dec 2021]
3894

3995
* Fixed invalid handling of X509_verify_cert() internal errors in libssl

‎deps/openssl/openssl/Configurations/10-main.conf

+7
Original file line numberDiff line numberDiff line change
@@ -1062,6 +1062,13 @@ my %targets = (
10621062
perlasm_scheme => "elf",
10631063
},
10641064

1065+
# riscv64 below refers to contemporary RISCV Architecture
1066+
# specifications,
1067+
"BSD-riscv64" => {
1068+
inherit_from => [ "BSD-generic64"],
1069+
perlasm_scheme => "linux64",
1070+
},
1071+
10651072
"bsdi-elf-gcc" => {
10661073
inherit_from => [ "BASE_unix" ],
10671074
CC => "gcc",

‎deps/openssl/openssl/Configurations/15-android.conf

+1
Original file line numberDiff line numberDiff line change
@@ -261,6 +261,7 @@ my %targets = (
261261
bn_ops => add("RC4_INT"),
262262
asm_arch => 'x86',
263263
perlasm_scheme => "android",
264+
ex_libs => add(threads("-latomic")),
264265
},
265266
"android-x86_64" => {
266267
inherit_from => [ "android" ],

‎deps/openssl/openssl/Configurations/descrip.mms.tmpl

+70-3
Original file line numberDiff line numberDiff line change
@@ -553,7 +553,6 @@ distclean : clean
553553
- DELETE descrip.mms;*
554554

555555
depend : descrip.mms
556-
descrip.mms : FORCE
557556
@ ! {- output_off() if $disabled{makedepend}; "" -}
558557
@ $(PERL) {- sourcefile("util", "add-depends.pl") -} "{- $config{makedep_scheme} -}"
559558
@ ! {- output_on() if $disabled{makedepend}; "" -}
@@ -755,7 +754,16 @@ debug_logicals :
755754

756755
# Building targets ###################################################
757756

758-
configdata.pm : $(SRCDIR)Configure $(SRCDIR)config.com {- join(" ", @{$config{build_file_templates}}, @{$config{build_infos}}, @{$config{conf_files}}) -}
757+
descrip.mms : configdata.pm {- join(" ", @{$config{build_file_templates}}) -}
758+
perl configdata.pm
759+
@ WRITE SYS$OUTPUT "*************************************************"
760+
@ WRITE SYS$OUTPUT "*** ***"
761+
@ WRITE SYS$OUTPUT "*** Please run the same mms command again ***"
762+
@ WRITE SYS$OUTPUT "*** ***"
763+
@ WRITE SYS$OUTPUT "*************************************************"
764+
@ PIPE ( EXIT %X10000000 )
765+
766+
configdata.pm : $(SRCDIR)Configure $(SRCDIR)config.com {- join(" ", @{$config{build_infos}}, @{$config{conf_files}}) -}
759767
perl configdata.pm -r
760768
@ WRITE SYS$OUTPUT "*************************************************"
761769
@ WRITE SYS$OUTPUT "*** ***"
@@ -871,6 +879,59 @@ EOF
871879
return ($filename, $scripture);
872880
}
873881

882+
# On VMS, (some) header file directories include the files
883+
# __DECC_INCLUDE_EPILOGUE.H and __DECC_INCLUDE_PROLOGUE.H.
884+
# When header files are generated, and the build directory
885+
# isn't the same as the source directory, these files must
886+
# be copied alongside the generated header file, or their
887+
# effect will be lost.
888+
# We use the same include file cache as make_includefile
889+
# to check if the scripture to copy these files has already
890+
# been generated.
891+
sub make_decc_include_files {
892+
my $outd = shift;
893+
my $ind = shift;
894+
895+
# If the build directory and the source directory are the
896+
# same, there's no need to copy the prologue and epilogue
897+
# files.
898+
return ('') if $outd eq $ind;
899+
900+
my $outprologue = catfile($outd, '__DECC_INCLUDE_PROLOGUE.H');
901+
my $outepilogue = catfile($outd, '__DECC_INCLUDE_EPILOGUE.H');
902+
my $inprologue = catfile($ind, '__DECC_INCLUDE_PROLOGUE.H');
903+
my $inepilogue = catfile($ind, '__DECC_INCLUDE_EPILOGUE.H');
904+
my @filenames = ();
905+
my $scripture = '';
906+
907+
if ($includefile_cache{$outprologue}) {
908+
push @filenames, $outprologue;
909+
} elsif (-f $inprologue) {
910+
my $local_scripture .= <<"EOF";
911+
$outprologue : $inprologue
912+
COPY $inprologue $outprologue
913+
EOF
914+
$includefile_cache{$outprologue} = $local_scripture;
915+
916+
push @filenames, $outprologue;
917+
$scripture .= $local_scripture;
918+
}
919+
if ($includefile_cache{$outepilogue}) {
920+
push @filenames, $outepilogue;
921+
} elsif (-f $inepilogue) {
922+
my $local_scripture .= <<"EOF";
923+
$outepilogue : $inepilogue
924+
COPY $inepilogue $outepilogue
925+
EOF
926+
$includefile_cache{$outepilogue} = $local_scripture;
927+
928+
push @filenames, $outepilogue;
929+
$scripture .= $local_scripture;
930+
}
931+
932+
return (@filenames, $scripture);
933+
}
934+
874935
sub generatetarget {
875936
my %args = @_;
876937
my $deps = join(" ", compute_platform_depends(@{$args{deps}}));
@@ -984,12 +1045,18 @@ EOF
9841045
my @perlmodules = ( 'configdata.pm',
9851046
grep { $_ =~ m|\.pm$| } @{$args{deps}} );
9861047
my %perlmoduleincs = map { '"-I'.dirname($_).'"' => 1 } @perlmodules;
987-
$deps = join(' ', $deps, compute_platform_depends(@perlmodules));
1048+
my @decc_include_data
1049+
= make_decc_include_files(dirname($args{src}), dirname($gen0));
1050+
my $decc_include_scripture = pop @decc_include_data;
1051+
$deps = join(' ', $deps, @decc_include_data,
1052+
compute_platform_depends(@perlmodules));
9881053
@perlmodules = map { '"-M'.basename($_, '.pm').'"' } @perlmodules;
9891054
my $perlmodules = join(' ', '', sort keys %perlmoduleincs, @perlmodules);
1055+
9901056
return <<"EOF";
9911057
$args{src} : $gen0 $deps
9921058
\$(PERL)$perlmodules $dofile "-o$target{build_file}" $gen0$gen_args > \$\@
1059+
$decc_include_scripture
9931060
EOF
9941061
} elsif (grep { $_ eq $gen0 } @{$unified_info{programs}}) {
9951062
#

‎deps/openssl/openssl/Configurations/unix-Makefile.tmpl

+20-7
Original file line numberDiff line numberDiff line change
@@ -582,7 +582,7 @@ clean: libclean
582582
$(RM) $(MANDOCS3)
583583
$(RM) $(MANDOCS5)
584584
$(RM) $(MANDOCS7)
585-
$(RM) $(PROGRAMS) $(TESTPROGS) $(MODULES) $(SCRIPTS)
585+
$(RM) $(PROGRAMS) $(TESTPROGS) $(MODULES) $(FIPSMODULE) $(SCRIPTS)
586586
$(RM) $(GENERATED_MANDATORY) $(GENERATED)
587587
-find . -name '*{- platform->depext() -}' \! -name '.*' \! -type d -exec $(RM) {} \;
588588
-find . -name '*{- platform->objext() -}' \! -name '.*' \! -type d -exec $(RM) {} \;
@@ -599,7 +599,7 @@ distclean: clean
599599

600600
# We check if any depfile is newer than Makefile and decide to
601601
# concatenate only if that is true.
602-
depend:
602+
depend: Makefile
603603
@: {- output_off() if $disabled{makedepend}; "" -}
604604
@$(PERL) $(SRCDIR)/util/add-depends.pl "{- $makedep_scheme -}"
605605
@: {- output_on() if $disabled{makedepend}; "" -}
@@ -1153,7 +1153,7 @@ generate_crypto_objects:
11531153
crypto/objects/obj_mac.num \
11541154
crypto/objects/obj_xref.txt \
11551155
> crypto/objects/obj_xref.h )
1156-
( cd $(SRCDIR); cat crypto/objects/obj_compat.h >> include/openssl/obj_mac.h )
1156+
( cd $(SRCDIR); sed -e '1,8d' crypto/objects/obj_compat.h >> include/openssl/obj_mac.h )
11571157

11581158
generate_crypto_conf:
11591159
( cd $(SRCDIR); $(PERL) crypto/conf/keysets.pl \
@@ -1371,13 +1371,13 @@ tar:
13711371

13721372
link-utils: $(BLDDIR)/util/opensslwrap.sh $(BLDDIR)/apps/openssl.cnf
13731373

1374-
$(BLDDIR)/util/opensslwrap.sh: configdata.pm
1374+
$(BLDDIR)/util/opensslwrap.sh: Makefile
13751375
@if [ "$(SRCDIR)" != "$(BLDDIR)" ]; then \
13761376
mkdir -p "$(BLDDIR)/util"; \
13771377
ln -sf "../$(SRCDIR)/util/`basename "$@"`" "$(BLDDIR)/util"; \
13781378
fi
13791379

1380-
$(BLDDIR)/apps/openssl.cnf: configdata.pm
1380+
$(BLDDIR)/apps/openssl.cnf: Makefile
13811381
@if [ "$(SRCDIR)" != "$(BLDDIR)" ]; then \
13821382
mkdir -p "$(BLDDIR)/apps"; \
13831383
ln -sf "../$(SRCDIR)/apps/`basename "$@"`" "$(BLDDIR)/apps"; \
@@ -1387,7 +1387,8 @@ FORCE:
13871387

13881388
# Building targets ###################################################
13891389

1390-
libcrypto.pc libssl.pc openssl.pc: configdata.pm $(LIBS) {- join(" ",map { platform->sharedlib_simple($_) // platform->sharedlib_import($_) // platform->sharedlib($_) // () } @{$unified_info{libraries}}) -}
1390+
libcrypto.pc libssl.pc openssl.pc: Makefile $(LIBS) {- join(" ",map { platform->sharedlib_simple($_) // platform->sharedlib_import($_) // platform->sharedlib($_) // () } @{$unified_info{libraries}}) -}
1391+
13911392
libcrypto.pc:
13921393
@ ( echo 'prefix=$(INSTALLTOP)'; \
13931394
echo 'exec_prefix=$${prefix}'; \
@@ -1438,10 +1439,22 @@ openssl.pc:
14381439
echo 'Version: '$(VERSION); \
14391440
echo 'Requires: libssl libcrypto' ) > openssl.pc
14401441

1442+
Makefile: configdata.pm \
1443+
{- join(" \\\n" . ' ' x 10,
1444+
fill_lines(" ", $COLUMNS - 10,
1445+
@{$config{build_file_templates}})) -}
1446+
@echo "Detected changed: $?"
1447+
$(PERL) configdata.pm
1448+
@echo "**************************************************"
1449+
@echo "*** ***"
1450+
@echo "*** Please run the same make command again ***"
1451+
@echo "*** ***"
1452+
@echo "**************************************************"
1453+
@false
1454+
14411455
configdata.pm: $(SRCDIR)/Configure $(SRCDIR)/config \
14421456
{- join(" \\\n" . ' ' x 15,
14431457
fill_lines(" ", $COLUMNS - 15,
1444-
@{$config{build_file_templates}},
14451458
@{$config{build_infos}},
14461459
@{$config{conf_files}})) -}
14471460
@echo "Detected changed: $?"

‎deps/openssl/openssl/Configurations/windows-makefile.tmpl

+13-3
Original file line numberDiff line numberDiff line change
@@ -481,7 +481,7 @@ distclean: clean
481481
-del /Q /F configdata.pm
482482
-del /Q /F makefile
483483

484-
depend:
484+
depend: makefile
485485
@ {- output_off() if $disabled{makedepend}; "\@rem" -}
486486
@ "$(PERL)" "$(SRCDIR)\util\add-depends.pl" "{- $target{makedep_scheme} -}"
487487
@ {- output_on() if $disabled{makedepend}; "\@rem" -}
@@ -643,13 +643,23 @@ uninstall_image_docs:
643643

644644
copy-utils: $(BLDDIR)\apps\openssl.cnf
645645

646-
$(BLDDIR)\apps\openssl.cnf: configdata.pm
646+
$(BLDDIR)\apps\openssl.cnf: makefile
647647
@if NOT EXIST "$(BLDDIR)\apps" mkdir "$(BLDDIR)\apps"
648648
@if NOT "$(SRCDIR)"=="$(BLDDIR)" copy "$(SRCDIR)\apps\$(@F)" "$(BLDDIR)\apps"
649649

650650
# Building targets ###################################################
651651

652-
configdata.pm: "$(SRCDIR)\Configure" {- join(" ", map { '"'.$_.'"' } @{$config{build_file_templates}}, @{$config{build_infos}}, @{$config{conf_files}}) -}
652+
makefile: configdata.pm {- join(" ", map { '"'.$_.'"' } @{$config{build_file_templates}}) -}
653+
@$(ECHO) "Detected changed: $?"
654+
"$(PERL)" configdata.pm
655+
@$(ECHO) "**************************************************"
656+
@$(ECHO) "*** ***"
657+
@$(ECHO) "*** Please run the same make command again ***"
658+
@$(ECHO) "*** ***"
659+
@$(ECHO) "**************************************************"
660+
@exit 1
661+
662+
configdata.pm: "$(SRCDIR)\Configure" {- join(" ", map { '"'.$_.'"' } @{$config{build_infos}}, @{$config{conf_files}}) -}
653663
@$(ECHO) "Detected changed: $?"
654664
"$(PERL)" configdata.pm -r
655665
@$(ECHO) "**************************************************"

‎deps/openssl/openssl/Configure

+11-11
Original file line numberDiff line numberDiff line change
@@ -3172,25 +3172,25 @@ sub resolve_config {
31723172
}
31733173
}
31743174

3175-
foreach (sort keys %all_keys) {
3176-
my $previous = $combined_inheritance{$_};
3175+
foreach my $key (sort keys %all_keys) {
3176+
my $previous = $combined_inheritance{$key};
31773177

31783178
# Current target doesn't have a value for the current key?
31793179
# Assign it the default combiner, the rest of this loop body
31803180
# will handle it just like any other coderef.
3181-
if (!exists $table{$target}->{$_}) {
3182-
$table{$target}->{$_} = $default_combiner;
3181+
if (!exists $table{$target}->{$key}) {
3182+
$table{$target}->{$key} = $default_combiner;
31833183
}
31843184

3185-
$table{$target}->{$_} = process_values($table{$target}->{$_},
3186-
$combined_inheritance{$_},
3187-
$target, $_);
3188-
unless(defined($table{$target}->{$_})) {
3189-
delete $table{$target}->{$_};
3185+
$table{$target}->{$key} = process_values($table{$target}->{$key},
3186+
$combined_inheritance{$key},
3187+
$target, $key);
3188+
unless(defined($table{$target}->{$key})) {
3189+
delete $table{$target}->{$key};
31903190
}
31913191
# if ($extra_checks &&
3192-
# $previous && !($add_called || $previous ~~ $table{$target}->{$_})) {
3193-
# warn "$_ got replaced in $target\n";
3192+
# $previous && !($add_called || $previous ~~ $table{$target}->{$key})) {
3193+
# warn "$key got replaced in $target\n";
31943194
# }
31953195
}
31963196

‎deps/openssl/openssl/NEWS.md

+5
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,11 @@ OpenSSL Releases
1818
OpenSSL 3.0
1919
-----------
2020

21+
### Major changes between OpenSSL 3.0.1 and OpenSSL 3.0.2 [15 Mar 2022]
22+
23+
* Fixed a bug in the BN_mod_sqrt() function that can cause it to loop forever
24+
for non-prime moduli ([CVE-2022-0778])
25+
2126
### Major changes between OpenSSL 3.0.0 and OpenSSL 3.0.1 [14 Dec 2021]
2227

2328
* Fixed invalid handling of X509_verify_cert() internal errors in libssl

‎deps/openssl/openssl/README-FIPS.md

+1-1
Original file line numberDiff line numberDiff line change
@@ -64,4 +64,4 @@ Using the FIPS Module in applications
6464
Documentation about using the FIPS module is available on the [fips_module(7)]
6565
manual page.
6666

67-
[fips_module(7)]: https://www.openssl.org/docs/manmaster/man7/fips_module.html
67+
[fips_module(7)]: https://www.openssl.org/docs/man3.0/man7/fips_module.html

0 commit comments

Comments
 (0)