Skip to content

Commit 05d8a5f

Browse files
RafaelGSSRafaelGSS
committed
deps: upgrade openssl sources to quictls/openssl-3.0.5+quic
This updates all sources in deps/openssl/openssl by: $ git clone git@github.com:quictls/openssl.git $ cd openssl $ git checkout openssl-3.0.5+quic $ cd ../node/deps/openssl $ rm -rf openssl $ cp -R ../../../openssl openssl $ rm -rf openssl/.git* openssl/.travis* $ git add --all openssl $ git commit openssl Reviewed-By: Luigi Pinca <luigipinca@gmail.com> Reviewed-By: Richard Lau <rlau@redhat.com> PR-URL: #43693
1 parent 46093c4 commit 05d8a5f

304 files changed

Lines changed: 53140 additions & 2721 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎deps/openssl/openssl/CHANGES.md‎

Lines changed: 65 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -28,14 +28,76 @@ breaking changes, and mappings for the large list of deprecated functions.
2828

2929
[Migration guide]: https://github.com/openssl/openssl/tree/master/doc/man7/migration_guide.pod
3030

31-
### Changes between 3.0.3 and 3.0.3+quic [3 May 2022]
31+
### Changes between 3.0.5 and 3.0.5+quic [5 Jul 2022]
3232

3333
* Add QUIC API support from BoringSSL.
3434

3535
*Todd Short*
3636

37+
### Changes between 3.0.4 and 3.0.5 [5 Jul 2022]
38+
39+
* The OpenSSL 3.0.4 release introduced a serious bug in the RSA
40+
implementation for X86_64 CPUs supporting the AVX512IFMA instructions.
41+
This issue makes the RSA implementation with 2048 bit private keys
42+
incorrect on such machines and memory corruption will happen during
43+
the computation. As a consequence of the memory corruption an attacker
44+
may be able to trigger a remote code execution on the machine performing
45+
the computation.
46+
47+
SSL/TLS servers or other servers using 2048 bit RSA private keys running
48+
on machines supporting AVX512IFMA instructions of the X86_64 architecture
49+
are affected by this issue.
50+
([CVE-2022-2274])
51+
52+
*Xi Ruoyao*
53+
54+
* AES OCB mode for 32-bit x86 platforms using the AES-NI assembly optimised
55+
implementation would not encrypt the entirety of the data under some
56+
circumstances. This could reveal sixteen bytes of data that was
57+
preexisting in the memory that wasn't written. In the special case of
58+
"in place" encryption, sixteen bytes of the plaintext would be revealed.
59+
60+
Since OpenSSL does not support OCB based cipher suites for TLS and DTLS,
61+
they are both unaffected.
62+
([CVE-2022-2097])
63+
64+
*Alex Chernyakhovsky, David Benjamin, Alejandro Sedeño*
65+
66+
### Changes between 3.0.3 and 3.0.4 [21 Jun 2022]
67+
68+
* In addition to the c_rehash shell command injection identified in
69+
CVE-2022-1292, further bugs where the c_rehash script does not
70+
properly sanitise shell metacharacters to prevent command injection have been
71+
fixed.
72+
73+
When the CVE-2022-1292 was fixed it was not discovered that there
74+
are other places in the script where the file names of certificates
75+
being hashed were possibly passed to a command executed through the shell.
76+
77+
This script is distributed by some operating systems in a manner where
78+
it is automatically executed. On such operating systems, an attacker
79+
could execute arbitrary commands with the privileges of the script.
80+
81+
Use of the c_rehash script is considered obsolete and should be replaced
82+
by the OpenSSL rehash command line tool.
83+
(CVE-2022-2068)
84+
85+
*Daniel Fiala, Tomáš Mráz*
86+
87+
* Case insensitive string comparison no longer uses locales. It has instead
88+
been directly implemented.
89+
90+
*Paul Dale*
91+
3792
### Changes between 3.0.2 and 3.0.3 [3 May 2022]
3893

94+
* Case insensitive string comparison is reimplemented via new locale-agnostic
95+
comparison functions OPENSSL_str[n]casecmp always using the POSIX locale for
96+
comparison. The previous implementation had problems when the Turkish locale
97+
was used.
98+
99+
*Dmitry Belyavskiy*
100+
39101
* Fixed a bug in the c_rehash script which was not properly sanitising shell
40102
metacharacters to prevent command injection. This script is distributed by
41103
some operating systems in a manner where it is automatically executed. On
@@ -19202,6 +19264,8 @@ ndif
1920219264

1920319265
<!-- Links -->
1920419266

19267+
[CVE-2022-2274]: https://www.openssl.org/news/vulnerabilities.html#CVE-2022-2274
19268+
[CVE-2022-2097]: https://www.openssl.org/news/vulnerabilities.html#CVE-2022-2274
1920519269
[CVE-2020-1971]: https://www.openssl.org/news/vulnerabilities.html#CVE-2020-1971
1920619270
[CVE-2020-1967]: https://www.openssl.org/news/vulnerabilities.html#CVE-2020-1967
1920719271
[CVE-2019-1563]: https://www.openssl.org/news/vulnerabilities.html#CVE-2019-1563

‎deps/openssl/openssl/Configurations/10-main.conf‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1062,6 +1062,14 @@ my %targets = (
10621062
perlasm_scheme => "elf",
10631063
},
10641064

1065+
"BSD-aarch64" => {
1066+
inherit_from => [ "BSD-generic64" ],
1067+
lib_cppflags => add("-DL_ENDIAN"),
1068+
bn_ops => "SIXTY_FOUR_BIT_LONG",
1069+
asm_arch => 'aarch64',
1070+
perlasm_scheme => "linux64",
1071+
},
1072+
10651073
# riscv64 below refers to contemporary RISCV Architecture
10661074
# specifications,
10671075
"BSD-riscv64" => {

‎deps/openssl/openssl/Configurations/descrip.mms.tmpl‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -549,6 +549,7 @@ clean : libclean
549549
- DELETE []vmsconfig.pm;*
550550

551551
distclean : clean
552+
- DELETE [.include.openssl]configuration.h;*
552553
- DELETE configdata.pm;*
553554
- DELETE descrip.mms;*
554555

@@ -981,7 +982,7 @@ EOF
981982
? '' : ' --case-insensitive';
982983
return <<"EOF";
983984
$target : $gen0 $deps $mkdef
984-
\$(PERL) $mkdef$ord_ver --ordinals $gen0 --name $ord_name "--OS" "VMS"$case_insensitive > $target
985+
\$(PERL) $mkdef$ord_ver --type $args{intent} --ordinals $gen0 --name $ord_name "--OS" "VMS"$case_insensitive > $target
985986
EOF
986987
} elsif (platform->isasm($args{src})) {
987988
#

‎deps/openssl/openssl/Configurations/gentemplate.pm‎

Lines changed: 9 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -56,7 +56,8 @@ sub emit {
5656
my $fh = $self->{output};
5757

5858
die "No name?" unless $name;
59-
print $fh "{-\n ", $name, '(', dump_data(\%opts), ');', " \n-}";
59+
print $fh "{-\n ", $name, '(', dump_data(\%opts), ');', " \n-}"
60+
unless defined $opts{attrs}->{skip};
6061
}
6162

6263
my $debug_resolvedepends = $ENV{BUILDFILE_DEBUG_DEPENDS};
@@ -200,7 +201,7 @@ sub dogenerate {
200201
my $self = shift;
201202
my $src = shift;
202203
# Safety measure
203-
return "" unless defined $self->{info}->{generate}->{$_};
204+
return "" unless defined $self->{info}->{generate}->{$src};
204205
return "" if $cache{$src};
205206
my $obj = shift;
206207
my $bin = shift;
@@ -209,6 +210,7 @@ sub dogenerate {
209210
die "$src is generated by Configure, should not appear in build file\n"
210211
if ref $self->{info}->{generate}->{$src} eq "";
211212
my $script = $self->{info}->{generate}->{$src}->[0];
213+
my %attrs = %{$self->{info}->{attributes}->{generate}->{$src} // {}};
212214
$self->emit('generatesrc',
213215
src => $src,
214216
product => $bin,
@@ -220,10 +222,15 @@ sub dogenerate {
220222
defined $bin ? @{$self->{info}->{includes}->{$bin} // []} : () ],
221223
defs => [ defined $obj ? @{$self->{info}->{defines}->{$obj} // []} : (),
222224
defined $bin ? @{$self->{info}->{defines}->{$bin} // []} : () ],
225+
attrs => { %attrs },
223226
%opts);
224227
foreach (@{$self->{info}->{depends}->{$src} // []}) {
225228
$self->dogenerate($_, $obj, $bin, %opts);
226229
}
230+
# The generator itself may be is generated
231+
if ($self->{info}->{generate}->{$script}) {
232+
$self->dogenerate($script, $obj, $bin, %opts);
233+
}
227234
}
228235
$cache{$src} = 1;
229236
}

‎deps/openssl/openssl/Configurations/unix-Makefile.tmpl‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -594,6 +594,7 @@ clean: libclean
594594
-find . -type l \! -name '.*' -exec $(RM) {} \;
595595
596596
distclean: clean
597+
$(RM) include/openssl/configuration.h
597598
$(RM) configdata.pm
598599
$(RM) Makefile
599600
@@ -1399,6 +1400,7 @@ libcrypto.pc:
13991400
fi; \
14001401
echo 'includedir=$${prefix}/include'; \
14011402
echo 'enginesdir=$${libdir}/engines-{- $sover_dirname -}'; \
1403+
echo 'modulesdir=$${libdir}/ossl-modules'; \
14021404
echo ''; \
14031405
echo 'Name: OpenSSL-libcrypto'; \
14041406
echo 'Description: OpenSSL cryptography library'; \
@@ -1548,7 +1550,7 @@ EOF
15481550
my $ord_name = $args{generator}->[1] || $args{product};
15491551
return <<"EOF";
15501552
$target: $gen0 $deps \$(SRCDIR)/util/mkdef.pl
1551-
\$(PERL) \$(SRCDIR)/util/mkdef.pl$ord_ver --ordinals $gen0 --name $ord_name --OS $mkdef_os > $target
1553+
\$(PERL) \$(SRCDIR)/util/mkdef.pl$ord_ver --type $args{intent} --ordinals $gen0 --name $ord_name --OS $mkdef_os > $target
15521554
EOF
15531555
} elsif (platform->isasm($args{src})) {
15541556
#

‎deps/openssl/openssl/Configurations/windows-makefile.tmpl‎

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -478,6 +478,7 @@ clean: libclean
478478
-rd /Q /S test\test-runs
479479

480480
distclean: clean
481+
-del /Q /F include\openssl\configuration.h
481482
-del /Q /F configdata.pm
482483
-del /Q /F makefile
483484

@@ -744,7 +745,7 @@ EOF
744745
$args{generator}->[1] || platform->dsoname($args{product});
745746
return <<"EOF";
746747
$target: $gen0 $deps $mkdef
747-
"\$(PERL)" $mkdef$ord_ver --ordinals $gen0 --name $ord_name --OS windows > $target
748+
"\$(PERL)" "$mkdef"$ord_ver --type $args{intent} --ordinals $gen0 --name $ord_name --OS windows > $target
748749
EOF
749750
} elsif (platform->isasm($args{src})) {
750751
#
@@ -760,7 +761,7 @@ EOF
760761

761762
my $generator;
762763
if ($gen0 =~ /\.pl$/) {
763-
$generator = '"$(PERL)"'.$gen_incs.' '.$gen0.$gen_args
764+
$generator = '"$(PERL)"'.$gen_incs.' "'.$gen0.'"'.$gen_args
764765
.' "$(PERLASM_SCHEME)"'.$incs.' '.$cppflags.$defs.' $(PROCESSSOR)';
765766
} elsif ($gen0 =~ /\.S$/) {
766767
$generator = undef;
@@ -817,15 +818,15 @@ EOF
817818
$gen0 = platform->bin($gen0);
818819
return <<"EOF";
819820
$args{src}: $gen0 $deps "\$(BLDDIR)\\util\\wrap.pl"
820-
"\$(PERL)" "\$(BLDDIR)\\util\\wrap.pl" $gen0$gen_args > \$@
821+
"\$(PERL)" "\$(BLDDIR)\\util\\wrap.pl" "$gen0"$gen_args > \$@
821822
EOF
822823
} else {
823824
#
824825
# Generic generator using Perl
825826
#
826827
return <<"EOF";
827828
$args{src}: "$gen0" $deps
828-
"\$(PERL)"$gen_incs $gen0$gen_args > \$@
829+
"\$(PERL)"$gen_incs "$gen0"$gen_args > \$@
829830
EOF
830831
}
831832
}

‎deps/openssl/openssl/Configure‎

Lines changed: 65 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
#! /usr/bin/env perl
22
# -*- mode: perl; -*-
3-
# Copyright 2016-2021 The OpenSSL Project Authors. All Rights Reserved.
3+
# Copyright 2016-2022 The OpenSSL Project Authors. All Rights Reserved.
44
#
55
# Licensed under the Apache License 2.0 (the "License"). You may not use
66
# this file except in compliance with the License. You can obtain a copy
@@ -17,6 +17,7 @@ use lib "$FindBin::Bin/util/perl";
1717
use File::Basename;
1818
use File::Spec::Functions qw/:DEFAULT abs2rel rel2abs splitdir/;
1919
use File::Path qw/mkpath/;
20+
use File::Compare qw(compare_text);
2021
use OpenSSL::fallback "$FindBin::Bin/external/perl/MODULES.txt";
2122
use OpenSSL::Glob;
2223
use OpenSSL::Template;
@@ -2214,9 +2215,10 @@ if ($builder eq "unified") {
22142215
\$attributes{depends}, $+{ATTRIBS},
22152216
tokenize($expand_variables->($+{VALUE})))
22162217
if !@skip || $skip[$#skip] > 0; },
2217-
qr/^\s* GENERATE ${index_re} \s* = \s* ${value_re} \s* $/x
2218+
qr/^\s* GENERATE ${index_re} ${attribs_re} \s* = \s* ${value_re} \s* $/x
22182219
=> sub { $push_to->(\%generate, $expand_variables->($+{INDEX}),
2219-
undef, undef, $expand_variables->($+{VALUE}))
2220+
\$attributes{generate}, $+{ATTRIBS},
2221+
$expand_variables->($+{VALUE}))
22202222
if !@skip || $skip[$#skip] > 0; },
22212223
qr/^\s* (?:\#.*)? $/x => sub { },
22222224
"OTHERWISE" => sub { die "Something wrong with this line:\n$_\nat $sourced/$f" },
@@ -2384,6 +2386,10 @@ EOF
23842386
$check_generate{$ddest}->{$generator[0]}++;
23852387

23862388
$unified_info{generate}->{$ddest} = [ @generator ];
2389+
# Fix up associated attributes
2390+
$unified_info{attributes}->{generate}->{$ddest} =
2391+
$attributes{generate}->{$dest}->{$gen}
2392+
if defined $attributes{generate}->{$dest}->{$gen};
23872393
}
23882394

23892395
foreach (keys %depends) {
@@ -2774,7 +2780,7 @@ EOF
27742780
keys %{$unified_info{htmldocs} // {}}),
27752781
(map { @{$unified_info{mandocs}->{$_} // []} }
27762782
keys %{$unified_info{mandocs} // {}}) ] );
2777-
foreach my $type (keys %loopinfo) {
2783+
foreach my $type (sort keys %loopinfo) {
27782784
foreach my $product (@{$loopinfo{$type}}) {
27792785
my %dirs = ();
27802786
my $pd = dirname($product);
@@ -2795,7 +2801,7 @@ EOF
27952801
push @{$unified_info{dirinfo}->{$d}->{deps}}, $_
27962802
if $d ne $pd;
27972803
}
2798-
foreach (keys %dirs) {
2804+
foreach (sort keys %dirs) {
27992805
push @{$unified_info{dirinfo}->{$_}->{products}->{$type}},
28002806
$product;
28012807
}
@@ -2830,7 +2836,6 @@ my %template_vars = (
28302836
user_crossable => \@user_crossable,
28312837
);
28322838
my $configdata_outname = 'configdata.pm';
2833-
print "Creating $configdata_outname\n";
28342839
open CONFIGDATA, ">$configdata_outname.new"
28352840
or die "Trying to create $configdata_outname.new: $!";
28362841
my $configdata_tmplname = cleanfile($srcdir, "configdata.pm.in", $blddir);
@@ -2846,19 +2851,60 @@ $configdata_tmpl->fill_in(
28462851
] }
28472852
) or die $Text::Template::ERROR;
28482853
close CONFIGDATA;
2849-
rename "$configdata_outname.new", $configdata_outname;
2850-
if ($builder_platform eq 'unix') {
2851-
my $mode = (0755 & ~umask);
2852-
chmod $mode, 'configdata.pm'
2853-
or warn sprintf("WARNING: Couldn't change mode for 'configdata.pm' to 0%03o: %s\n",$mode,$!);
2854-
}
2855-
2856-
print "Running $configdata_outname\n";
2857-
my $perlcmd = (quotify("maybeshell", $config{PERL}))[0];
2858-
my $cmd = "$perlcmd $configdata_outname";
2859-
#print STDERR "DEBUG[run_dofile]: \$cmd = $cmd\n";
2860-
system($cmd);
2861-
exit 1 if $? != 0;
2854+
2855+
# When using stat() on Windows, we can get it to perform better by avoid some
2856+
# data. This doesn't affect the mtime field, so we're not losing anything...
2857+
${^WIN32_SLOPPY_STAT} = 1;
2858+
2859+
my $update_configdata = 0;
2860+
my $run_configdata = 0;
2861+
if (-f $configdata_outname) {
2862+
my $Configure_mtime = (stat($0))[9];
2863+
my $configdata_mtime = (stat($configdata_outname))[9];
2864+
2865+
# If this script was updated after the last configdata.pm, or if
2866+
# configdata.pm.new differs from configdata.pm, we update configdata.pm
2867+
if ($configdata_mtime < $Configure_mtime
2868+
|| compare_text("$configdata_outname.new", $configdata_outname) != 0) {
2869+
$update_configdata = 1;
2870+
} else {
2871+
# If nothing has changed, let's just drop the new one and pretend
2872+
# like nothing happened
2873+
unlink "$configdata_outname.new";
2874+
2875+
# We still run configdata.pm if one of the build file (Makefile) or
2876+
# the configuration header file are missing
2877+
$run_configdata =
2878+
!( -f $target{build_file} )
2879+
|| !( -f catfile('include', 'openssl', 'configuration.h') );
2880+
}
2881+
} else {
2882+
$update_configdata = 1;
2883+
}
2884+
2885+
if ($update_configdata) {
2886+
# If something did change, or there was no previous configdata.pm, we
2887+
# rename the new one, set permissions as needed, and run it.
2888+
rename "$configdata_outname.new", $configdata_outname;
2889+
if ($builder_platform eq 'unix') {
2890+
my $mode = (0755 & ~umask);
2891+
chmod $mode, 'configdata.pm'
2892+
or warn sprintf("WARNING: Couldn't change mode for 'configdata.pm' to 0%03o: %s\n",$mode,$!);
2893+
}
2894+
$run_configdata = 1;
2895+
print "Created $configdata_outname\n";
2896+
}
2897+
2898+
if ($run_configdata) {
2899+
print "Running $configdata_outname\n";
2900+
my $perlcmd = (quotify("maybeshell", $config{PERL}))[0];
2901+
my $cmd = "$perlcmd $configdata_outname";
2902+
#print STDERR "DEBUG[run_dofile]: \$cmd = $cmd\n";
2903+
system($cmd);
2904+
exit 1 if $? != 0;
2905+
} else {
2906+
print "No changes in $configdata_outname, no need to run it\n";
2907+
}
28622908

28632909
$SIG{__DIE__} = $orig_death_handler;
28642910

0 commit comments

Comments
 (0)