Skip to content

Commit ca93f7f

Browse files
Shigeki Ohtsubnoordhuis
Shigeki Ohtsu
authored and
bnoordhuis
committed
deps: upgrade openssl sources to 1.0.2d
This just replaces all sources of openssl-1.0.2d.tar.gz into deps/openssl/openssl deps: copy all openssl header files to include dir All symlink files in `deps/openssl/openssl/include/openssl/` are removed and replaced with real header files to avoid issues on Windows. deps: fix openssl assembly error on ia32 win32 `x86masm.pl` was mistakenly using .486 instruction set, why `cpuid` (and perhaps others) are requiring .686 . Fixes: #589 PR-URL: #1389 Reviewed-By: Fedor Indutny <[email protected]> Reviewed-By: Ben Noordhuis <[email protected]> Reviewed-By: Shigeki Ohtsu <[email protected]> deps: fix asm build error of openssl in x86_win32 See https://mta.openssl.org/pipermail/openssl-dev/2015-February/000651.html iojs needs to stop using masm and move to nasm or yasm on Win32. Fixes: #589 PR-URL: #1389 Reviewed-By: Fedor Indutny <[email protected]> Reviewed-By: Ben Noordhuis <[email protected]> openssl: fix keypress requirement in apps on win32 Reapply b910613 . Fixes: #589 PR-URL: #1389 Reviewed-By: Fedor Indutny <[email protected]> Reviewed-By: Ben Noordhuis <[email protected]> deps: add -no_rand_screen to openssl s_client In openssl s_client on Windows, RAND_screen() is invoked to initialize random state but it takes several seconds in each connection. This added -no_rand_screen to openssl s_client on Windows to skip RAND_screen() and gets a better performance in the unit test of test-tls-server-verify. Do not enable this except to use in the unit test. Fixes: #1461 PR-URL: #1836 Reviewed-By: Ben Noordhuis <[email protected]> PR-URL: #2141 Reviewed-By: Ben Noordhuis <[email protected]>
1 parent 6bef15a commit ca93f7f

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

54 files changed

+965
-270
lines changed

‎deps/openssl/openssl/CHANGES

+15
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,21 @@
22
OpenSSL CHANGES
33
_______________
44

5+
Changes between 1.0.2c and 1.0.2d [9 Jul 2015]
6+
7+
*) Alternate chains certificate forgery
8+
9+
During certificate verfification, OpenSSL will attempt to find an
10+
alternative certificate chain if the first attempt to build such a chain
11+
fails. An error in the implementation of this logic can mean that an
12+
attacker could cause certain checks on untrusted certificates to be
13+
bypassed, such as the CA flag, enabling them to use a valid leaf
14+
certificate to act as a CA and "issue" an invalid certificate.
15+
16+
This issue was reported to OpenSSL by Adam Langley/David Benjamin
17+
(Google/BoringSSL).
18+
[Matt Caswell]
19+
520
Changes between 1.0.2b and 1.0.2c [12 Jun 2015]
621

722
*) Fix HMAC ABI incompatibility. The previous version introduced an ABI

‎deps/openssl/openssl/Makefile

+7-6
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@
44
## Makefile for OpenSSL
55
##
66

7-
VERSION=1.0.2c
7+
VERSION=1.0.2d
88
MAJOR=1
99
MINOR=0.2
1010
SHLIB_VERSION_NUMBER=1.0.0
@@ -271,6 +271,7 @@ reflect:
271271
@[ -n "$(THIS)" ] && $(CLEARENV) && $(MAKE) $(THIS) -e $(BUILDENV)
272272

273273
sub_all: build_all
274+
274275
build_all: build_libs build_apps build_tests build_tools
275276

276277
build_libs: build_libcrypto build_libssl openssl.pc
@@ -280,15 +281,15 @@ build_libssl: build_ssl libssl.pc
280281

281282
build_crypto:
282283
@dir=crypto; target=all; $(BUILD_ONE_CMD)
283-
build_ssl:
284+
build_ssl: build_crypto
284285
@dir=ssl; target=all; $(BUILD_ONE_CMD)
285-
build_engines:
286+
build_engines: build_crypto
286287
@dir=engines; target=all; $(BUILD_ONE_CMD)
287-
build_apps:
288+
build_apps: build_libs
288289
@dir=apps; target=all; $(BUILD_ONE_CMD)
289-
build_tests:
290+
build_tests: build_libs
290291
@dir=test; target=all; $(BUILD_ONE_CMD)
291-
build_tools:
292+
build_tools: build_libs
292293
@dir=tools; target=all; $(BUILD_ONE_CMD)
293294

294295
all_testapps: build_libs build_testapps

‎deps/openssl/openssl/Makefile.bak

+7-6
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@
44
## Makefile for OpenSSL
55
##
66

7-
VERSION=1.0.2c-dev
7+
VERSION=1.0.2d-dev
88
MAJOR=1
99
MINOR=0.2
1010
SHLIB_VERSION_NUMBER=1.0.0
@@ -271,6 +271,7 @@ reflect:
271271
@[ -n "$(THIS)" ] && $(CLEARENV) && $(MAKE) $(THIS) -e $(BUILDENV)
272272

273273
sub_all: build_all
274+
274275
build_all: build_libs build_apps build_tests build_tools
275276

276277
build_libs: build_libcrypto build_libssl openssl.pc
@@ -280,15 +281,15 @@ build_libssl: build_ssl libssl.pc
280281

281282
build_crypto:
282283
@dir=crypto; target=all; $(BUILD_ONE_CMD)
283-
build_ssl:
284+
build_ssl: build_crypto
284285
@dir=ssl; target=all; $(BUILD_ONE_CMD)
285-
build_engines:
286+
build_engines: build_crypto
286287
@dir=engines; target=all; $(BUILD_ONE_CMD)
287-
build_apps:
288+
build_apps: build_libs
288289
@dir=apps; target=all; $(BUILD_ONE_CMD)
289-
build_tests:
290+
build_tests: build_libs
290291
@dir=test; target=all; $(BUILD_ONE_CMD)
291-
build_tools:
292+
build_tools: build_libs
292293
@dir=tools; target=all; $(BUILD_ONE_CMD)
293294

294295
all_testapps: build_libs build_testapps

‎deps/openssl/openssl/Makefile.org

+6-5
Original file line numberDiff line numberDiff line change
@@ -269,6 +269,7 @@ reflect:
269269
@[ -n "$(THIS)" ] && $(CLEARENV) && $(MAKE) $(THIS) -e $(BUILDENV)
270270

271271
sub_all: build_all
272+
272273
build_all: build_libs build_apps build_tests build_tools
273274

274275
build_libs: build_libcrypto build_libssl openssl.pc
@@ -278,15 +279,15 @@ build_libssl: build_ssl libssl.pc
278279

279280
build_crypto:
280281
@dir=crypto; target=all; $(BUILD_ONE_CMD)
281-
build_ssl:
282+
build_ssl: build_crypto
282283
@dir=ssl; target=all; $(BUILD_ONE_CMD)
283-
build_engines:
284+
build_engines: build_crypto
284285
@dir=engines; target=all; $(BUILD_ONE_CMD)
285-
build_apps:
286+
build_apps: build_libs
286287
@dir=apps; target=all; $(BUILD_ONE_CMD)
287-
build_tests:
288+
build_tests: build_libs
288289
@dir=test; target=all; $(BUILD_ONE_CMD)
289-
build_tools:
290+
build_tools: build_libs
290291
@dir=tools; target=all; $(BUILD_ONE_CMD)
291292

292293
all_testapps: build_libs build_testapps

‎deps/openssl/openssl/NEWS

+4
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,10 @@
55
This file gives a brief overview of the major changes between each OpenSSL
66
release. For more details please read the CHANGES file.
77

8+
Major changes between OpenSSL 1.0.2c and OpenSSL 1.0.2d [9 Jul 2015]
9+
10+
o Alternate chains certificate forgery (CVE-2015-1793)
11+
812
Major changes between OpenSSL 1.0.2b and OpenSSL 1.0.2c [12 Jun 2015]
913

1014
o Fix HMAC ABI incompatibility

‎deps/openssl/openssl/README

+1-1
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11

2-
OpenSSL 1.0.2c 12 Jun 2015
2+
OpenSSL 1.0.2d 9 Jul 2015
33

44
Copyright (c) 1998-2011 The OpenSSL Project
55
Copyright (c) 1995-1998 Eric A. Young, Tim J. Hudson

‎deps/openssl/openssl/apps/ocsp.c

+1
Original file line numberDiff line numberDiff line change
@@ -209,6 +209,7 @@ int MAIN(int argc, char **argv)
209209
OPENSSL_free(tport);
210210
if (tpath)
211211
OPENSSL_free(tpath);
212+
thost = tport = tpath = NULL;
212213
if (args[1]) {
213214
args++;
214215
if (!OCSP_parse_url(*args, &host, &port, &path, &use_ssl)) {

‎deps/openssl/openssl/crypto/bio/bio.h

+1-1
Original file line numberDiff line numberDiff line change
@@ -291,7 +291,7 @@ void BIO_clear_flags(BIO *b, int flags);
291291
* BIO_CB_RETURN flag indicates if it is after the call
292292
*/
293293
# define BIO_CB_RETURN 0x80
294-
# define BIO_CB_return(a) ((a)|BIO_CB_RETURN))
294+
# define BIO_CB_return(a) ((a)|BIO_CB_RETURN)
295295
# define BIO_cb_pre(a) (!((a)&BIO_CB_RETURN))
296296
# define BIO_cb_post(a) ((a)&BIO_CB_RETURN)
297297

‎deps/openssl/openssl/crypto/bn/Makefile

+1
Original file line numberDiff line numberDiff line change
@@ -253,6 +253,7 @@ bn_exp.o: ../../include/openssl/lhash.h ../../include/openssl/opensslconf.h
253253
bn_exp.o: ../../include/openssl/opensslv.h ../../include/openssl/ossl_typ.h
254254
bn_exp.o: ../../include/openssl/safestack.h ../../include/openssl/stack.h
255255
bn_exp.o: ../../include/openssl/symhacks.h ../cryptlib.h bn_exp.c bn_lcl.h
256+
bn_exp.o: rsaz_exp.h
256257
bn_exp2.o: ../../e_os.h ../../include/openssl/bio.h ../../include/openssl/bn.h
257258
bn_exp2.o: ../../include/openssl/buffer.h ../../include/openssl/crypto.h
258259
bn_exp2.o: ../../include/openssl/e_os2.h ../../include/openssl/err.h

‎deps/openssl/openssl/crypto/bn/bn_exp.c

+1-7
Original file line numberDiff line numberDiff line change
@@ -126,13 +126,7 @@
126126
# include <alloca.h>
127127
#endif
128128

129-
#undef RSAZ_ENABLED
130-
#if defined(OPENSSL_BN_ASM_MONT) && \
131-
(defined(__x86_64) || defined(__x86_64__) || \
132-
defined(_M_AMD64) || defined(_M_X64))
133-
# include "rsaz_exp.h"
134-
# define RSAZ_ENABLED
135-
#endif
129+
#include "rsaz_exp.h"
136130

137131
#undef SPARC_T4_MONT
138132
#if defined(OPENSSL_BN_ASM_MONT) && (defined(__sparc__) || defined(__sparc))

‎deps/openssl/openssl/crypto/bn/bntest.c

+1-2
Original file line numberDiff line numberDiff line change
@@ -1042,15 +1042,13 @@ int test_mod_exp_mont_consttime(BIO *bp, BN_CTX *ctx)
10421042
int test_mod_exp_mont5(BIO *bp, BN_CTX *ctx)
10431043
{
10441044
BIGNUM *a, *p, *m, *d, *e;
1045-
10461045
BN_MONT_CTX *mont;
10471046

10481047
a = BN_new();
10491048
p = BN_new();
10501049
m = BN_new();
10511050
d = BN_new();
10521051
e = BN_new();
1053-
10541052
mont = BN_MONT_CTX_new();
10551053

10561054
BN_bntest_rand(m, 1024, 0, 1); /* must be odd for montgomery */
@@ -1099,6 +1097,7 @@ int test_mod_exp_mont5(BIO *bp, BN_CTX *ctx)
10991097
fprintf(stderr, "Modular exponentiation test failed!\n");
11001098
return 0;
11011099
}
1100+
BN_MONT_CTX_free(mont);
11021101
BN_free(a);
11031102
BN_free(p);
11041103
BN_free(m);

‎deps/openssl/openssl/crypto/bn/rsaz_exp.c

+10
Original file line numberDiff line numberDiff line change
@@ -42,6 +42,8 @@
4242

4343
#include "rsaz_exp.h"
4444

45+
#ifdef RSAZ_ENABLED
46+
4547
/*
4648
* See crypto/bn/asm/rsaz-avx2.pl for further details.
4749
*/
@@ -334,3 +336,11 @@ void RSAZ_512_mod_exp(BN_ULONG result[8],
334336

335337
OPENSSL_cleanse(storage, sizeof(storage));
336338
}
339+
340+
#else
341+
342+
# if defined(PEDANTIC) || defined(__DECC) || defined(__clang__)
343+
static void *dummy = &dummy;
344+
# endif
345+
346+
#endif

‎deps/openssl/openssl/crypto/bn/rsaz_exp.h

+10-1
Original file line numberDiff line numberDiff line change
@@ -31,7 +31,13 @@
3131
#ifndef RSAZ_EXP_H
3232
# define RSAZ_EXP_H
3333

34-
# include <openssl/bn.h>
34+
# undef RSAZ_ENABLED
35+
# if defined(OPENSSL_BN_ASM_MONT) && \
36+
(defined(__x86_64) || defined(__x86_64__) || \
37+
defined(_M_AMD64) || defined(_M_X64))
38+
# define RSAZ_ENABLED
39+
40+
# include <openssl/bn.h>
3541

3642
void RSAZ_1024_mod_exp_avx2(BN_ULONG result[16],
3743
const BN_ULONG base_norm[16],
@@ -44,4 +50,7 @@ void RSAZ_512_mod_exp(BN_ULONG result[8],
4450
const BN_ULONG base_norm[8], const BN_ULONG exponent[8],
4551
const BN_ULONG m_norm[8], BN_ULONG k0,
4652
const BN_ULONG RR[8]);
53+
54+
# endif
55+
4756
#endif

‎deps/openssl/openssl/crypto/cms/cms_smime.c

+2-1
Original file line numberDiff line numberDiff line change
@@ -374,7 +374,7 @@ int CMS_verify(CMS_ContentInfo *cms, STACK_OF(X509) *certs,
374374
tmpin = BIO_new_mem_buf(ptr, len);
375375
if (tmpin == NULL) {
376376
CMSerr(CMS_F_CMS_VERIFY, ERR_R_MALLOC_FAILURE);
377-
return 0;
377+
goto err2;
378378
}
379379
} else
380380
tmpin = dcont;
@@ -405,6 +405,7 @@ int CMS_verify(CMS_ContentInfo *cms, STACK_OF(X509) *certs,
405405
else
406406
BIO_free_all(cmsbio);
407407

408+
err2:
408409
if (cms_certs)
409410
sk_X509_pop_free(cms_certs, X509_free);
410411
if (crls)

‎deps/openssl/openssl/crypto/evp/e_aes.c

+1-1
Original file line numberDiff line numberDiff line change
@@ -1771,7 +1771,7 @@ static int aes_ccm_ctrl(EVP_CIPHER_CTX *c, int type, int arg, void *ptr)
17711771
case EVP_CTRL_CCM_SET_TAG:
17721772
if ((arg & 1) || arg < 4 || arg > 16)
17731773
return 0;
1774-
if ((c->encrypt && ptr) || (!c->encrypt && !ptr))
1774+
if (c->encrypt && ptr)
17751775
return 0;
17761776
if (ptr) {
17771777
cctx->tag_set = 1;

‎deps/openssl/openssl/crypto/hmac/hmactest.c

+3
Original file line numberDiff line numberDiff line change
@@ -195,6 +195,7 @@ int main(int argc, char *argv[])
195195
}
196196
printf("test 4 ok\n");
197197
test5:
198+
HMAC_CTX_cleanup(&ctx);
198199
HMAC_CTX_init(&ctx);
199200
if (HMAC_Init_ex(&ctx, test[4].key, test[4].key_len, NULL, NULL)) {
200201
printf("Should fail to initialise HMAC with empty MD (test 5)\n");
@@ -284,6 +285,7 @@ int main(int argc, char *argv[])
284285
printf("test 5 ok\n");
285286
}
286287
test6:
288+
HMAC_CTX_cleanup(&ctx);
287289
HMAC_CTX_init(&ctx);
288290
if (!HMAC_Init_ex(&ctx, test[7].key, test[7].key_len, EVP_sha1(), NULL)) {
289291
printf("Failed to initialise HMAC (test 6)\n");
@@ -314,6 +316,7 @@ int main(int argc, char *argv[])
314316
printf("test 6 ok\n");
315317
}
316318
end:
319+
HMAC_CTX_cleanup(&ctx);
317320
EXIT(err);
318321
return (0);
319322
}

‎deps/openssl/openssl/crypto/opensslconf.h.in

+1-1
Original file line numberDiff line numberDiff line change
@@ -101,7 +101,7 @@
101101
#endif
102102

103103
#if defined(DES_RISC1) && defined(DES_RISC2)
104-
YOU SHOULD NOT HAVE BOTH DES_RISC1 AND DES_RISC2 DEFINED!!!!!
104+
#error YOU SHOULD NOT HAVE BOTH DES_RISC1 AND DES_RISC2 DEFINED!!!!!
105105
#endif
106106

107107
/* Unroll the inner loop, this sometimes helps, sometimes hinders.

‎deps/openssl/openssl/crypto/opensslv.h

+3-3
Original file line numberDiff line numberDiff line change
@@ -30,11 +30,11 @@ extern "C" {
3030
* (Prior to 0.9.5a beta1, a different scheme was used: MMNNFFRBB for
3131
* major minor fix final patch/beta)
3232
*/
33-
# define OPENSSL_VERSION_NUMBER 0x1000203fL
33+
# define OPENSSL_VERSION_NUMBER 0x1000204fL
3434
# ifdef OPENSSL_FIPS
35-
# define OPENSSL_VERSION_TEXT "OpenSSL 1.0.2c-fips 12 Jun 2015"
35+
# define OPENSSL_VERSION_TEXT "OpenSSL 1.0.2d-fips 9 Jul 2015"
3636
# else
37-
# define OPENSSL_VERSION_TEXT "OpenSSL 1.0.2c 12 Jun 2015"
37+
# define OPENSSL_VERSION_TEXT "OpenSSL 1.0.2d 9 Jul 2015"
3838
# endif
3939
# define OPENSSL_VERSION_PTEXT " part of " OPENSSL_VERSION_TEXT
4040

‎deps/openssl/openssl/crypto/pkcs12/p12_kiss.c

+2
Original file line numberDiff line numberDiff line change
@@ -135,10 +135,12 @@ int PKCS12_parse(PKCS12 *p12, const char *pass, EVP_PKEY **pkey, X509 **cert,
135135

136136
while ((x = sk_X509_pop(ocerts))) {
137137
if (pkey && *pkey && cert && !*cert) {
138+
ERR_set_mark();
138139
if (X509_check_private_key(x, *pkey)) {
139140
*cert = x;
140141
x = NULL;
141142
}
143+
ERR_pop_to_mark();
142144
}
143145

144146
if (ca && x) {

‎deps/openssl/openssl/crypto/srp/srptest.c

+1
Original file line numberDiff line numberDiff line change
@@ -148,6 +148,7 @@ int main(int argc, char **argv)
148148
ERR_remove_thread_state(NULL);
149149
ERR_free_strings();
150150
CRYPTO_mem_leaks(bio_err);
151+
BIO_free(bio_err);
151152

152153
return 0;
153154
}

0 commit comments

Comments
 (0)