Skip to content

Commit 250d8f6

Browse files
richardlauLinkgoron
richardlau
authored and
Linkgoron
committed
deps: upgrade openssl sources to quictls/openssl-3.0.1+quic
This updates all sources in deps/openssl/openssl by: $ git clone git@github.com:quictls/openssl.git $ cd openssl $ cd ../node/deps/openssl $ rm -rf openssl $ cp -R ../openssl openssl $ rm -rf openssl/.git* openssl/.travis* $ git add --all openssl $ git commit openssl PR-URL: nodejs#41177 Refs: quictls/openssl#69 Refs: https://mta.openssl.org/pipermail/openssl-announce/2021-December/000212.html Reviewed-By: Danielle Adams <adamzdanielle@gmail.com> Reviewed-By: Colin Ihrig <cjihrig@gmail.com> Reviewed-By: Matteo Collina <matteo.collina@gmail.com> Reviewed-By: Tobias Nießen <tniessen@tnie.de> Reviewed-By: Derek Lewis <DerekNonGeneric@inf.is>
1 parent 663edba commit 250d8f6

509 files changed

Lines changed: 6380 additions & 2405 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎deps/openssl/openssl/CHANGES.md‎

Lines changed: 90 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -34,6 +34,80 @@ breaking changes, and mappings for the large list of deprecated functions.
3434

3535
*Todd Short*
3636

37+
### Changes between 3.0.0 and 3.0.1 [14 Dec 2021]
38+
39+
* Fixed invalid handling of X509_verify_cert() internal errors in libssl
40+
Internally libssl in OpenSSL calls X509_verify_cert() on the client side to
41+
verify a certificate supplied by a server. That function may return a
42+
negative return value to indicate an internal error (for example out of
43+
memory). Such a negative return value is mishandled by OpenSSL and will cause
44+
an IO function (such as SSL_connect() or SSL_do_handshake()) to not indicate
45+
success and a subsequent call to SSL_get_error() to return the value
46+
SSL_ERROR_WANT_RETRY_VERIFY. This return value is only supposed to be
47+
returned by OpenSSL if the application has previously called
48+
SSL_CTX_set_cert_verify_callback(). Since most applications do not do this
49+
the SSL_ERROR_WANT_RETRY_VERIFY return value from SSL_get_error() will be
50+
totally unexpected and applications may not behave correctly as a result. The
51+
exact behaviour will depend on the application but it could result in
52+
crashes, infinite loops or other similar incorrect responses.
53+
54+
This issue is made more serious in combination with a separate bug in OpenSSL
55+
3.0 that will cause X509_verify_cert() to indicate an internal error when
56+
processing a certificate chain. This will occur where a certificate does not
57+
include the Subject Alternative Name extension but where a Certificate
58+
Authority has enforced name constraints. This issue can occur even with valid
59+
chains.
60+
([CVE-2021-4044])
61+
62+
*Matt Caswell*
63+
64+
* Corrected a few file name and file reference bugs in the build,
65+
installation and setup scripts, which lead to installation verification
66+
failures. Slightly enhanced the installation verification script.
67+
68+
*Richard Levitte*
69+
70+
* Fixed EVP_PKEY_eq() to make it possible to use it with strictly private
71+
keys.
72+
73+
*Richard Levitte*
74+
75+
* Fixed PVK encoder to properly query for the passphrase.
76+
77+
*Tomáš Mráz*
78+
79+
* Multiple fixes in the OSSL_HTTP API functions.
80+
81+
*David von Oheimb*
82+
83+
* Allow sign extension in OSSL_PARAM_allocate_from_text() for the
84+
OSSL_PARAM_INTEGER data type and return error on negative numbers
85+
used with the OSSL_PARAM_UNSIGNED_INTEGER data type. Make
86+
OSSL_PARAM_BLD_push_BN{,_pad}() return an error on negative numbers.
87+
88+
*Richard Levitte*
89+
90+
* Allow copying uninitialized digest contexts with EVP_MD_CTX_copy_ex.
91+
92+
*Tomáš Mráz*
93+
94+
* Fixed detection of ARMv7 and ARM64 CPU features on FreeBSD.
95+
96+
*Allan Jude*
97+
98+
* Multiple threading fixes.
99+
100+
*Matt Caswell*
101+
102+
* Added NULL digest implementation to keep compatibility with 1.1.1 version.
103+
104+
*Tomáš Mráz*
105+
106+
* Allow fetching an operation from the provider that owns an unexportable key
107+
as a fallback if that is still allowed by the property query.
108+
109+
*Richard Levitte*
110+
37111
### Changes between 1.1.1 and 3.0.0 [7 sep 2021]
38112

39113
* TLS_MAX_VERSION, DTLS_MAX_VERSION and DTLS_MIN_VERSION constants are now
@@ -1459,6 +1533,22 @@ breaking changes, and mappings for the large list of deprecated functions.
14591533
OpenSSL 1.1.1
14601534
-------------
14611535

1536+
### Changes between 1.1.1l and 1.1.1m [xx XXX xxxx]
1537+
1538+
* Avoid loading of a dynamic engine twice.
1539+
1540+
*Bernd Edlinger*
1541+
1542+
* Prioritise DANE TLSA issuer certs over peer certs
1543+
1544+
*Viktor Dukhovni*
1545+
1546+
* Fixed random API for MacOS prior to 10.12
1547+
1548+
These MacOS versions don't support the CommonCrypto APIs
1549+
1550+
*Lenny Primak*
1551+
14621552
### Changes between 1.1.1k and 1.1.1l [24 Aug 2021]
14631553

14641554
* Fixed an SM2 Decryption Buffer Overflow.

‎deps/openssl/openssl/Configurations/10-main.conf‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -857,6 +857,7 @@ my %targets = (
857857
inherit_from => [ "linux-x86" ],
858858
CC => "clang",
859859
CXX => "clang++",
860+
ex_libs => add(threads("-latomic")),
860861
},
861862
"linux-x86_64" => {
862863
inherit_from => [ "linux-generic64" ],

‎deps/openssl/openssl/Configurations/15-ios.conf‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@ my %targets = (
1010
template => 1,
1111
inherit_from => [ "darwin-common" ],
1212
sys_id => "iOS",
13-
disable => [ "engine", "async" ],
13+
disable => [ "shared", "async" ],
1414
},
1515
"ios-xcrun" => {
1616
inherit_from => [ "ios-common" ],

‎deps/openssl/openssl/Configurations/descrip.mms.tmpl‎

Lines changed: 22 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,7 @@
99
(our $osslprefix_q = platform->osslprefix()) =~ s/\$/\\\$/;
1010

1111
our $sover_dirname = platform->shlib_version_as_filename();
12-
our $osslver = sprintf "%02d%02d", split(/\./, $config{version});
12+
our $osslver = sprintf "%02d", split(/\./, $config{version});
1313

1414
our $sourcedir = $config{sourcedir};
1515
our $builddir = $config{builddir};
@@ -110,9 +110,9 @@
110110
@cnf_defines,
111111
'OPENSSLDIR="""$(OPENSSLDIR_C)"""',
112112
'ENGINESDIR="""$(ENGINESDIR_C)"""',
113-
'MODULESDIR="""$(MODULESDIR_C)"""',
114-
#'$(DEFINES)'
113+
'MODULESDIR="""$(MODULESDIR_C)"""'
115114
)
115+
. '$(DEFINES)'
116116
. "'extradefines'";
117117
our $lib_asflags =
118118
join(' ', $target{lib_asflags} || (), @{$config{lib_asflags}},
@@ -144,8 +144,8 @@
144144
join(',', @{$target{dso_defines}}, @{$target{module_defines}},
145145
@{$config{dso_defines}}, @{$config{module_defines}},
146146
@cnf_defines,
147-
#'$(DEFINES)'
148147
)
148+
. '$(DEFINES)'
149149
. "'extradefines'";
150150
our $dso_asflags =
151151
join(' ', $target{dso_asflags} || (), $target{module_asflags} || (),
@@ -180,8 +180,8 @@
180180
join(',', @{$target{bin_defines}},
181181
@{$config{bin_defines}},
182182
@cnf_defines,
183-
#'$(DEFINES)'
184183
)
184+
. '$(DEFINES)'
185185
. "'extradefines'";
186186
our $bin_asflags =
187187
join(' ', $target{bin_asflags} || (),
@@ -267,6 +267,7 @@ VERBOSE=$(V)
267267
VERBOSE_FAILURE=$(VF)
268268

269269
VERSION={- "$config{full_version}" -}
270+
VERSION_NUMBER={- "$config{version}" -}
270271
MAJOR={- $config{major} -}
271272
MINOR={- $config{minor} -}
272273
SHLIB_VERSION_NUMBER={- $config{shlib_version} -}
@@ -355,7 +356,7 @@ OPENSSLDIR_C={- platform->osslprefix() -}DATAROOT:[000000]
355356
# Where installed ENGINE modules reside, for C
356357
ENGINESDIR_C={- platform->osslprefix() -}ENGINES{- $sover_dirname.$target{pointer_size} -}:
357358
# Where modules reside, for C
358-
MODULESDIR_C={- platform->osslprefix() -}MODULES{- $sover_dirname.$target{pointer_size} -}:
359+
MODULESDIR_C={- platform->osslprefix() -}MODULES{- $target{pointer_size} -}:
359360

360361
##### User defined commands and flags ################################
361362

@@ -428,7 +429,9 @@ NODEBUG=@
428429
$(NODEBUG) ! them, so we create it instead. This is an unfortunate
429430
$(NODEBUG) ! necessity.
430431
$(NODEBUG) !
431-
$(NODEBUG) DEFINE openssl "{- sourcedir('include/openssl') -}
432+
$(NODEBUG) openssl_inc1 = F$PARSE("[.include.openssl]","A.;",,,"syntax_only") - "A.;"
433+
$(NODEBUG) openssl_inc2 = F$PARSE("sourcetop:[include.openssl]","A.;",,,"SYNTAX_ONLY") - "A.;"
434+
$(NODEBUG) DEFINE openssl 'openssl_inc1','openssl_inc2'
432435
$(NODEBUG) !
433436
$(NODEBUG) ! Figure out the architecture
434437
$(NODEBUG) !
@@ -441,9 +444,10 @@ NODEBUG=@
441444

442445
.LAST :
443446
$(NODEBUG) {- join("\n\t\$(NODEBUG) ", map { "DEASSIGN ".uc($_) } @shlibs) || "!" -}
447+
$(NODEBUG) DEASSIGN openssl
444448
$(NODEBUG) DEASSIGN ossl_dataroot
445449
$(NODEBUG) DEASSIGN ossl_installroot
446-
$(NODEBUG) DEASSIGN openssl
450+
$(NODEBUG) DEASSIGN ossl_sourceroot
447451
.DEFAULT :
448452
@ ! MMS cannot handle no actions...
449453

@@ -569,16 +573,18 @@ uninstall_docs : uninstall_html_docs
569573
{- output_off() if $disabled{fips}; "" -}
570574
install_fips : build_sw $(INSTALL_FIPSMODULECONF)
571575
@ WRITE SYS$OUTPUT "*** Installing FIPS module"
576+
- CREATE/DIR ossl_installroot:[MODULES{- $target{pointer_size} -}.'arch']
577+
- CREATE/DIR/PROT=(S:RWED,O:RWE,G:RE,W:RE) OSSL_DATAROOT:[000000]
572578
COPY/PROT=W:RE $(INSTALL_FIPSMODULES) -
573-
ossl_installroot:[MODULES{- $sover_dirname.$target{pointer_size} -}.'arch']$(FIPSMODULENAME)
579+
ossl_installroot:[MODULES{- $target{pointer_size} -}.'arch']$(FIPSMODULENAME)
574580
@ WRITE SYS$OUTPUT "*** Installing FIPS module configuration"
575581
COPY/PROT=W:RE $(INSTALL_FIPSMODULECONF) OSSL_DATAROOT:[000000]
576582

577583
uninstall_fips :
578584
@ WRITE SYS$OUTPUT "*** Uninstalling FIPS module configuration"
579585
DELETE OSSL_DATAROOT:[000000]fipsmodule.cnf;*
580586
@ WRITE SYS$OUTPUT "*** Uninstalling FIPS module"
581-
DELETE ossl_installroot:[MODULES{- $sover_dirname.$target{pointer_size} -}.'arch']$(FIPSMODULENAME);*
587+
DELETE ossl_installroot:[MODULES{- $target{pointer_size} -}.'arch']$(FIPSMODULENAME);*
582588
{- output_on() if $disabled{fips}; "" -}
583589

584590
install_ssldirs : check_INSTALLTOP
@@ -607,7 +613,9 @@ install_dev : check_INSTALLTOP install_runtime_libs
607613
@ WRITE SYS$OUTPUT "*** Installing development files"
608614
@ ! Install header files
609615
- CREATE/DIR ossl_installroot:[include.openssl]
610-
COPY/PROT=W:R openssl:*.h ossl_installroot:[include.openssl]
616+
COPY/PROT=W:R ossl_sourceroot:[include.openssl]*.h -
617+
ossl_installroot:[include.openssl]
618+
COPY/PROT=W:R [.include.openssl]*.h ossl_installroot:[include.openssl]
611619
@ ! Install static (development) libraries
612620
- CREATE/DIR ossl_installroot:[LIB.'arch']
613621
{- join("\n ",
@@ -626,9 +634,9 @@ install_engines : check_INSTALLTOP install_runtime_libs build_modules
626634
install_modules : check_INSTALLTOP install_runtime_libs build_modules
627635
@ {- output_off() unless scalar @install_modules; "" -} !
628636
@ WRITE SYS$OUTPUT "*** Installing modules"
629-
- CREATE/DIR ossl_installroot:[MODULES{- $sover_dirname.$target{pointer_size} -}.'arch']
637+
- CREATE/DIR ossl_installroot:[MODULES{- $target{pointer_size} -}.'arch']
630638
{- join("\n ",
631-
map { "COPY/PROT=W:RE $_.EXE ossl_installroot:[MODULES$sover_dirname$target{pointer_size}.'arch']" }
639+
map { "COPY/PROT=W:RE $_.EXE ossl_installroot:[MODULES$target{pointer_size}.'arch']" }
632640
@install_modules) -}
633641
@ {- output_on() unless scalar @install_modules; "" -} !
634642

@@ -904,7 +912,7 @@ EOF
904912
#
905913
my $target = platform->def($args{src});
906914
my $mkdef = sourcefile('util', 'mkdef.pl');
907-
my $ord_ver = $args{intent} eq 'lib' ? ' --version $(VERSION)' : '';
915+
my $ord_ver = $args{intent} eq 'lib' ? ' --version $(VERSION_NUMBER)' : '';
908916
my $ord_name =
909917
$args{generator}->[1] || basename($args{product}, '.EXE');
910918
my $case_insensitive =

‎deps/openssl/openssl/Configurations/platform/Unix.pm‎

Lines changed: 15 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -63,9 +63,21 @@ sub sharedname_simple {
6363
}
6464

6565
sub sharedlib_simple {
66-
return undef if $_[0]->shlibext() eq $_[0]->shlibextsimple();
67-
return platform::BASE::__concat($_[0]->sharedname_simple($_[1]),
68-
$_[0]->shlibextsimple());
66+
# This function returns the simplified shared library name (no version
67+
# or variant in the shared library file name) if the simple variants of
68+
# the base name or the suffix differ from the full variants of the same.
69+
70+
# Note: if $_[1] isn't a shared library name, then $_[0]->sharedname()
71+
# and $_[0]->sharedname_simple() will return undef. This needs being
72+
# accounted for.
73+
my $name = $_[0]->sharedname($_[1]);
74+
my $simplename = $_[0]->sharedname_simple($_[1]);
75+
my $ext = $_[0]->shlibext();
76+
my $simpleext = $_[0]->shlibextsimple();
77+
78+
return undef unless defined $simplename && defined $name;
79+
return undef if ($name eq $simplename && $ext eq $simpleext);
80+
return platform::BASE::__concat($simplename, $simpleext);
6981
}
7082

7183
sub sharedlib_import {

‎deps/openssl/openssl/Configurations/unix-Makefile.tmpl‎

Lines changed: 11 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -67,6 +67,7 @@ BLDDIR={- $config{builddir} -}
6767
FIPSKEY={- $config{FIPSKEY} -}
6868

6969
VERSION={- "$config{full_version}" -}
70+
VERSION_NUMBER={- "$config{version}" -}
7071
MAJOR={- $config{major} -}
7172
MINOR={- $config{minor} -}
7273
SHLIB_VERSION_NUMBER={- $config{shlib_version} -}
@@ -618,6 +619,7 @@ uninstall_docs: uninstall_man_docs uninstall_html_docs
618619
install_fips: build_sw $(INSTALL_FIPSMODULECONF)
619620
@[ -n "$(INSTALLTOP)" ] || (echo INSTALLTOP should not be empty; exit 1)
620621
@$(PERL) $(SRCDIR)/util/mkdir-p.pl $(DESTDIR)$(MODULESDIR)
622+
@$(PERL) $(SRCDIR)/util/mkdir-p.pl $(DESTDIR)$(OPENSSLDIR)
621623
@$(ECHO) "*** Installing FIPS module"
622624
@$(ECHO) "install $(INSTALL_FIPSMODULE) -> $(DESTDIR)$(MODULESDIR)/$(FIPSMODULENAME)"
623625
@cp "$(INSTALL_FIPSMODULE)" $(DESTDIR)$(MODULESDIR)/$(FIPSMODULENAME).new
@@ -691,11 +693,11 @@ install_dev: install_runtime_libs
691693
@[ -n "$(INSTALLTOP)" ] || (echo INSTALLTOP should not be empty; exit 1)
692694
@$(ECHO) "*** Installing development files"
693695
@$(PERL) $(SRCDIR)/util/mkdir-p.pl $(DESTDIR)$(INSTALLTOP)/include/openssl
694-
@ : {- output_off() unless grep { $_ eq "OPENSSL_USE_APPLINK" } (@{$target{defines}}, @{$config{defines}}); "" -}
696+
@ : {- output_off() if $disabled{uplink}; "" -}
695697
@$(ECHO) "install $(SRCDIR)/ms/applink.c -> $(DESTDIR)$(INSTALLTOP)/include/openssl/applink.c"
696698
@cp $(SRCDIR)/ms/applink.c $(DESTDIR)$(INSTALLTOP)/include/openssl/applink.c
697699
@chmod 644 $(DESTDIR)$(INSTALLTOP)/include/openssl/applink.c
698-
@ : {- output_on() unless grep { $_ eq "OPENSSL_USE_APPLINK" } (@{$target{defines}}, @{$config{defines}}); "" -}
700+
@ : {- output_on() if $disabled{uplink}; "" -}
699701
@set -e; for i in $(SRCDIR)/include/openssl/*.h \
700702
$(BLDDIR)/include/openssl/*.h; do \
701703
fn=`basename $$i`; \
@@ -765,10 +767,10 @@ install_dev: install_runtime_libs
765767
766768
uninstall_dev: uninstall_runtime_libs
767769
@$(ECHO) "*** Uninstalling development files"
768-
@ : {- output_off() unless grep { $_ eq "OPENSSL_USE_APPLINK" } (@{$target{defines}}, @{$config{defines}}); "" -}
770+
@ : {- output_off() if $disabled{uplink}; "" -}
769771
@$(ECHO) "$(RM) $(DESTDIR)$(INSTALLTOP)/include/openssl/applink.c"
770772
@$(RM) $(DESTDIR)$(INSTALLTOP)/include/openssl/applink.c
771-
@ : {- output_on() unless grep { $_ eq "OPENSSL_USE_APPLINK" } (@{$target{defines}}, @{$config{defines}}); "" -}
773+
@ : {- output_on() if $disabled{uplink}; "" -}
772774
@set -e; for i in $(SRCDIR)/include/openssl/*.h \
773775
$(BLDDIR)/include/openssl/*.h; do \
774776
fn=`basename $$i`; \
@@ -1305,23 +1307,23 @@ SSLHEADERS={- join(" \\\n" . ' ' x 11,
13051307
fill_lines(" ", $COLUMNS - 11, sort keys %sslheaders)) -}
13061308
13071309
renumber: build_generated
1308-
$(PERL) $(SRCDIR)/util/mknum.pl --version $(VERSION) --no-warnings \
1310+
$(PERL) $(SRCDIR)/util/mknum.pl --version $(VERSION_NUMBER) --no-warnings \
13091311
--ordinals $(SRCDIR)/util/libcrypto.num \
13101312
--symhacks $(SRCDIR)/include/openssl/symhacks.h \
13111313
--renumber \
13121314
$(CRYPTOHEADERS)
1313-
$(PERL) $(SRCDIR)/util/mknum.pl --version $(VERSION) --no-warnings \
1315+
$(PERL) $(SRCDIR)/util/mknum.pl --version $(VERSION_NUMBER) --no-warnings \
13141316
--ordinals $(SRCDIR)/util/libssl.num \
13151317
--symhacks $(SRCDIR)/include/openssl/symhacks.h \
13161318
--renumber \
13171319
$(SSLHEADERS)
13181320
13191321
ordinals: build_generated
1320-
$(PERL) $(SRCDIR)/util/mknum.pl --version $(VERSION) --no-warnings \
1322+
$(PERL) $(SRCDIR)/util/mknum.pl --version $(VERSION_NUMBER) --no-warnings \
13211323
--ordinals $(SRCDIR)/util/libcrypto.num \
13221324
--symhacks $(SRCDIR)/include/openssl/symhacks.h \
13231325
$(CRYPTOHEADERS)
1324-
$(PERL) $(SRCDIR)/util/mknum.pl --version $(VERSION) --no-warnings \
1326+
$(PERL) $(SRCDIR)/util/mknum.pl --version $(VERSION_NUMBER) --no-warnings \
13251327
--ordinals $(SRCDIR)/util/libssl.num \
13261328
--symhacks $(SRCDIR)/include/openssl/symhacks.h \
13271329
$(SSLHEADERS)
@@ -1529,7 +1531,7 @@ EOF
15291531
#
15301532
my $target = platform->def($args{src});
15311533
(my $mkdef_os = $target{shared_target}) =~ s|-shared$||;
1532-
my $ord_ver = $args{intent} eq 'lib' ? ' --version $(VERSION)' : '';
1534+
my $ord_ver = $args{intent} eq 'lib' ? ' --version $(VERSION_NUMBER)' : '';
15331535
my $ord_name = $args{generator}->[1] || $args{product};
15341536
return <<"EOF";
15351537
$target: $gen0 $deps \$(SRCDIR)/util/mkdef.pl

0 commit comments

Comments
 (0)