FazBrowse GitHub Viewer | Trending |
URL:
| Home
Tools: [Download Repo ZIP]   [Original HTTPS Page]

deps: upgrade openssl sources to quictls/openssl-3.0.3 · nodejs/node@6365bf8 · GitHub

deps: upgrade openssl sources to quictls/openssl-3.0.3 · nodejs/node@6365bf8 · GitHub
Skip to content

Navigation Menu

Sign in
Sign in
Sign up

Commit 6365bf8

Browse files
RafaelGSS
authored and
BethGriggs
committed
deps: upgrade openssl sources to quictls/openssl-3.0.3
This updates all sources in deps/openssl/openssl by: $ git clone git@github.com:quictls/openssl.git $ cd openssl $ git checkout openssl-3.0.3+quic $ cd ../node/deps/openssl $ rm -rf openssl $ cp -R ../../../openssl openssl $ rm -rf openssl/.git* openssl/.travis* $ git add --all openssl $ git commit openssl PR-URL: #43022 Refs: https://mta.openssl.org/pipermail/openssl-announce/2022-May/000223.html Reviewed-By: Richard Lau <rlau@redhat.com> Reviewed-By: Beth Griggs <bgriggs@redhat.com>
1 parent 330e267 commit 6365bf8

220 files changed

Lines changed: 2187 additions & 913 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎deps/openssl/openssl/CHANGES.md‎

Lines changed: 109 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -28,12 +28,120 @@ breaking changes, and mappings for the large list of deprecated functions.
2828

2929
[Migration guide]: https://github.com/openssl/openssl/tree/master/doc/man7/migration_guide.pod
3030

31-
### Changes between 3.0.2 and 3.0.2+quic [15 Mar 2022]
31+
### Changes between 3.0.3 and 3.0.3+quic [3 May 2022]
3232

3333
* Add QUIC API support from BoringSSL.
3434

3535
*Todd Short*
3636

37+
### Changes between 3.0.2 and 3.0.3 [3 May 2022]
38+
39+
* Fixed a bug in the c_rehash script which was not properly sanitising shell
40+
metacharacters to prevent command injection. This script is distributed by
41+
some operating systems in a manner where it is automatically executed. On
42+
such operating systems, an attacker could execute arbitrary commands with the
43+
privileges of the script.
44+
45+
Use of the c_rehash script is considered obsolete and should be replaced
46+
by the OpenSSL rehash command line tool.
47+
(CVE-2022-1292)
48+
49+
*Tomáš Mráz*
50+
51+
* Fixed a bug in the function `OCSP_basic_verify` that verifies the signer
52+
certificate on an OCSP response. The bug caused the function in the case
53+
where the (non-default) flag OCSP_NOCHECKS is used to return a postivie
54+
response (meaning a successful verification) even in the case where the
55+
response signing certificate fails to verify.
56+
57+
It is anticipated that most users of `OCSP_basic_verify` will not use the
58+
OCSP_NOCHECKS flag. In this case the `OCSP_basic_verify` function will return
59+
a negative value (indicating a fatal error) in the case of a certificate
60+
verification failure. The normal expected return value in this case would be
61+
0.
62+
63+
This issue also impacts the command line OpenSSL "ocsp" application. When
64+
verifying an ocsp response with the "-no_cert_checks" option the command line
65+
application will report that the verification is successful even though it
66+
has in fact failed. In this case the incorrect successful response will also
67+
be accompanied by error messages showing the failure and contradicting the
68+
apparently successful result.
69+
([CVE-2022-1343])
70+
71+
*Matt Caswell*
72+
73+
* Fixed a bug where the RC4-MD5 ciphersuite incorrectly used the
74+
AAD data as the MAC key. This made the MAC key trivially predictable.
75+
76+
An attacker could exploit this issue by performing a man-in-the-middle attack
77+
to modify data being sent from one endpoint to an OpenSSL 3.0 recipient such
78+
that the modified data would still pass the MAC integrity check.
79+
80+
Note that data sent from an OpenSSL 3.0 endpoint to a non-OpenSSL 3.0
81+
endpoint will always be rejected by the recipient and the connection will
82+
fail at that point. Many application protocols require data to be sent from
83+
the client to the server first. Therefore, in such a case, only an OpenSSL
84+
3.0 server would be impacted when talking to a non-OpenSSL 3.0 client.
85+
86+
If both endpoints are OpenSSL 3.0 then the attacker could modify data being
87+
sent in both directions. In this case both clients and servers could be
88+
affected, regardless of the application protocol.
89+
90+
Note that in the absence of an attacker this bug means that an OpenSSL 3.0
91+
endpoint communicating with a non-OpenSSL 3.0 endpoint will fail to complete
92+
the handshake when using this ciphersuite.
93+
94+
The confidentiality of data is not impacted by this issue, i.e. an attacker
95+
cannot decrypt data that has been encrypted using this ciphersuite - they can
96+
only modify it.
97+
98+
In order for this attack to work both endpoints must legitimately negotiate
99+
the RC4-MD5 ciphersuite. This ciphersuite is not compiled by default in
100+
OpenSSL 3.0, and is not available within the default provider or the default
101+
ciphersuite list. This ciphersuite will never be used if TLSv1.3 has been
102+
negotiated. In order for an OpenSSL 3.0 endpoint to use this ciphersuite the
103+
following must have occurred:
104+
105+
1) OpenSSL must have been compiled with the (non-default) compile time option
106+
enable-weak-ssl-ciphers
107+
108+
2) OpenSSL must have had the legacy provider explicitly loaded (either
109+
through application code or via configuration)
110+
111+
3) The ciphersuite must have been explicitly added to the ciphersuite list
112+
113+
4) The libssl security level must have been set to 0 (default is 1)
114+
115+
5) A version of SSL/TLS below TLSv1.3 must have been negotiated
116+
117+
6) Both endpoints must negotiate the RC4-MD5 ciphersuite in preference to any
118+
others that both endpoints have in common
119+
(CVE-2022-1434)
120+
121+
*Matt Caswell*
122+
123+
* Fix a bug in the OPENSSL_LH_flush() function that breaks reuse of the memory
124+
occuppied by the removed hash table entries.
125+
126+
This function is used when decoding certificates or keys. If a long lived
127+
process periodically decodes certificates or keys its memory usage will
128+
expand without bounds and the process might be terminated by the operating
129+
system causing a denial of service. Also traversing the empty hash table
130+
entries will take increasingly more time.
131+
132+
Typically such long lived processes might be TLS clients or TLS servers
133+
configured to accept client certificate authentication.
134+
(CVE-2022-1473)
135+
136+
*Hugo Landau, Aliaksei Levin*
137+
138+
* The functions `OPENSSL_LH_stats` and `OPENSSL_LH_stats_bio` now only report
139+
the `num_items`, `num_nodes` and `num_alloc_nodes` statistics. All other
140+
statistics are no longer supported. For compatibility, these statistics are
141+
still listed in the output but are now always reported as zero.
142+
143+
*Hugo Landau*
144+
37145
### Changes between 3.0.1 and 3.0.2 [15 Mar 2022]
38146

39147
* Fixed a bug in the BN_mod_sqrt() function that can cause it to loop forever

‎deps/openssl/openssl/CONTRIBUTING.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -60,7 +60,7 @@ guidelines:
6060
GitHub Actions and AppVeyor are required, and they are started automatically
6161
whenever a PR is created or updated.
6262
63-
[coding style]: https://www.openssl.org/policies/codingstyle.html
63+
[coding style]: https://www.openssl.org/policies/technical/coding-style.html
6464
6565
5. When at all possible, patches should include tests. These can
6666
either be added to an existing test, or completely new. Please see

‎deps/openssl/openssl/Configurations/platform/AIX.pm‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -25,5 +25,5 @@ sub staticname {
2525
return $in_libname
2626
if $unified_info{attributes}->{libraries}->{$_[1]}->{noinst};
2727

28-
return platform::BASE->staticname($_[1]) . '_a';
28+
return platform::BASE->staticname($_[1]) . ($disabled{shared} ? '' : '_a');
2929
}

‎deps/openssl/openssl/NEWS.md‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,17 @@ OpenSSL Releases
1818
OpenSSL 3.0
1919
-----------
2020

21+
### Major changes between OpenSSL 3.0.2 and OpenSSL 3.0.3 [3 May 2022]
22+
23+
* Fixed a bug in the c_rehash script which was not properly sanitising shell
24+
metacharacters to prevent command injection ([CVE-2022-1292])
25+
* Fixed a bug in the function `OCSP_basic_verify` that verifies the signer
26+
certificate on an OCSP response ([CVE-2022-1343])
27+
* Fixed a bug where the RC4-MD5 ciphersuite incorrectly used the
28+
AAD data as the MAC key ([CVE-2022-1434])
29+
* Fix a bug in the OPENSSL_LH_flush() function that breaks reuse of the memory
30+
occuppied by the removed hash table entries ([CVE-2022-1473])
31+
2132
### Major changes between OpenSSL 3.0.1 and OpenSSL 3.0.2 [15 Mar 2022]
2233

2334
* Fixed a bug in the BN_mod_sqrt() function that can cause it to loop forever

‎deps/openssl/openssl/NOTES-WINDOWS.md‎

Lines changed: 47 additions & 37 deletions
Original file line numberDiff line numberDiff line change
@@ -28,12 +28,12 @@ For this option you can use Cygwin.
2828
Native builds using Visual C++
2929
==============================
3030

31-
The native builds using Visual C++ have a VC-* prefix.
31+
The native builds using Visual C++ have a `VC-*` prefix.
3232

3333
Requirement details
3434
-------------------
3535

36-
In addition to the requirements and instructions listed in INSTALL.md,
36+
In addition to the requirements and instructions listed in `INSTALL.md`,
3737
these are required as well:
3838

3939
### Perl
@@ -64,22 +64,26 @@ Quick start
6464

6565
4. Use Visual Studio Developer Command Prompt with administrative privileges,
6666
choosing one of its variants depending on the intended architecture.
67-
Or run "cmd" and execute "vcvarsall.bat" with one of the options x86,
68-
x86_amd64, x86_arm, x86_arm64, amd64, amd64_x86, amd64_arm, or amd64_arm64.
69-
This sets up the environment variables needed for nmake.exe, cl.exe, etc.
67+
Or run `cmd` and execute `vcvarsall.bat` with one of the options `x86`,
68+
`x86_amd64`, `x86_arm`, `x86_arm64`, `amd64`, `amd64_x86`, `amd64_arm`,
69+
or `amd64_arm64`.
70+
This sets up the environment variables needed for `nmake.exe`, `cl.exe`,
71+
etc.
7072
See also
7173
<https://docs.microsoft.com/cpp/build/building-on-the-command-line>
7274

7375
5. From the root of the OpenSSL source directory enter
74-
perl Configure VC-WIN32 if you want 32-bit OpenSSL or
75-
perl Configure VC-WIN64A if you want 64-bit OpenSSL or
76-
perl Configure to let Configure figure out the platform
76+
- `perl Configure VC-WIN32` if you want 32-bit OpenSSL or
77+
- `perl Configure VC-WIN64A` if you want 64-bit OpenSSL or
78+
- `perl Configure VC-WIN64-ARM` if you want Windows on Arm (win-arm64)
79+
OpenSSL or
80+
- `perl Configure` to let Configure figure out the platform
7781

78-
6. nmake
82+
6. `nmake`
7983

80-
7. nmake test
84+
7. `nmake test`
8185

82-
8. nmake install
86+
8. `nmake install`
8387

8488
For the full installation instructions, or if anything goes wrong at any stage,
8589
check the INSTALL.md file.
@@ -109,37 +113,37 @@ installation for examples), these fallbacks are used:
109113
ALSO NOTE that those directories are usually write protected, even if
110114
your account is in the Administrators group. To work around that,
111115
start the command prompt by right-clicking on it and choosing "Run as
112-
Administrator" before running 'nmake install'. The other solution
116+
Administrator" before running `nmake install`. The other solution
113117
is, of course, to choose a different set of directories by using
114-
--prefix and --openssldir when configuring.
118+
`--prefix` and `--openssldir` when configuring.
115119

116-
Special notes for Universal Windows Platform builds, aka VC-*-UWP
117-
--------------------------------------------------------------------
120+
Special notes for Universal Windows Platform builds, aka `VC-*-UWP`
121+
-------------------------------------------------------------------
118122

119123
- UWP targets only support building the static and dynamic libraries.
120124

121-
- You should define the platform type to "uwp" and the target arch via
122-
"vcvarsall.bat" before you compile. For example, if you want to build
123-
"arm64" builds, you should run "vcvarsall.bat x86_arm64 uwp".
125+
- You should define the platform type to `uwp` and the target arch via
126+
`vcvarsall.bat` before you compile. For example, if you want to build
127+
`arm64` builds, you should run `vcvarsall.bat x86_arm64 uwp`.
124128

125129
Native builds using Embarcadero C++Builder
126130
=========================================
127131

128132
This toolchain (a descendant of Turbo/Borland C++) is an alternative to MSVC.
129133
OpenSSL currently includes an experimental 32-bit configuration targeting the
130-
Clang-based compiler (bcc32c.exe) in v10.3.3 Community Edition.
134+
Clang-based compiler (`bcc32c.exe`) in v10.3.3 Community Edition.
131135
<https://www.embarcadero.com/products/cbuilder/starter>
132136

133137
1. Install Perl.
134138

135139
2. Open the RAD Studio Command Prompt.
136140

137141
3. Go to the root of the OpenSSL source directory and run:
138-
perl Configure BC-32 --prefix=%CD%
142+
`perl Configure BC-32 --prefix=%CD%`
139143

140-
4. make -N
144+
4. `make -N`
141145

142-
5. make -N test
146+
5. `make -N test`
143147

144148
6. Build your program against this OpenSSL:
145149
* Set your include search path to the "include" subdirectory of OpenSSL.
@@ -166,32 +170,38 @@ MinGW offers an alternative way to build native OpenSSL, by cross compilation.
166170

167171
- Perl, at least version 5.10.0, which usually comes pre-installed with MSYS2
168172

169-
- make, installed using "pacman -S make" into the MSYS2 environment
173+
- make, installed using `pacman -S make` into the MSYS2 environment
170174

171-
- MinGW[64] compiler: mingw-w64-i686-gcc and/or mingw-w64-x86_64-gcc.
175+
- MinGW[64] compiler: `mingw-w64-i686-gcc` and/or `mingw-w64-x86_64-gcc`.
172176
These compilers must be on your MSYS2 $PATH.
173177
A common error is to not have these on your $PATH.
174178
The MSYS2 version of gcc will not work correctly here.
175179

176180
In the MSYS2 shell do the configuration depending on the target architecture:
177181

178182
./Configure mingw ...
183+
179184
or
185+
180186
./Configure mingw64 ...
187+
181188
or
189+
182190
./Configure ...
183191

184192
for the default architecture.
185193

186-
Apart from that, follow the Unix / Linux instructions in INSTALL.md.
194+
Apart from that, follow the Unix / Linux instructions in `INSTALL.md`.
187195

188196
* It is also possible to build mingw[64] on Linux or Cygwin.
189197

190-
In this case configure with the corresponding --cross-compile-prefix= option.
191-
For example
198+
In this case configure with the corresponding `--cross-compile-prefix=`
199+
option. For example
192200

193201
./Configure mingw --cross-compile-prefix=i686-w64-mingw32- ...
202+
194203
or
204+
195205
./Configure mingw64 --cross-compile-prefix=x86_64-w64-mingw32- ...
196206

197207
This requires that you've installed the necessary add-on packages for
@@ -203,18 +213,18 @@ Linking native applications
203213
This section applies to all native builds.
204214

205215
If you link with static OpenSSL libraries then you're expected to
206-
additionally link your application with WS2_32.LIB, GDI32.LIB,
207-
ADVAPI32.LIB, CRYPT32.LIB and USER32.LIB. Those developing
216+
additionally link your application with `WS2_32.LIB`, `GDI32.LIB`,
217+
`ADVAPI32.LIB`, `CRYPT32.LIB` and `USER32.LIB`. Those developing
208218
non-interactive service applications might feel concerned about
209-
linking with GDI32.LIB and USER32.LIB, as they are justly associated
219+
linking with `GDI32.LIB` and `USER32.LIB`, as they are justly associated
210220
with interactive desktop, which is not available to service
211221
processes. The toolkit is designed to detect in which context it's
212222
currently executed, GUI, console app or service, and act accordingly,
213223
namely whether or not to actually make GUI calls. Additionally those
214-
who wish to /DELAYLOAD:GDI32.DLL and /DELAYLOAD:USER32.DLL and
224+
who wish to `/DELAYLOAD:GDI32.DLL` and `/DELAYLOAD:USER32.DLL` and
215225
actually keep them off service process should consider implementing
216-
and exporting from .exe image in question own _OPENSSL_isservice not
217-
relying on USER32.DLL. E.g., on Windows Vista and later you could:
226+
and exporting from .exe image in question own `_OPENSSL_isservice` not
227+
relying on `USER32.DLL`. E.g., on Windows Vista and later you could:
218228

219229
__declspec(dllexport) __cdecl BOOL _OPENSSL_isservice(void)
220230
{
@@ -233,7 +243,7 @@ See also the OPENSSL_Applink manual page.
233243
Hosted builds using Cygwin
234244
==========================
235245

236-
Cygwin implements a POSIX/Unix runtime system (cygwin1.dll) on top of the
246+
Cygwin implements a POSIX/Unix runtime system (`cygwin1.dll`) on top of the
237247
Windows subsystem and provides a Bash shell and GNU tools environment.
238248
Consequently, a build of OpenSSL with Cygwin is virtually identical to the
239249
Unix procedure.
@@ -249,7 +259,7 @@ To build OpenSSL using Cygwin, you need to:
249259

250260
Apart from that, follow the Unix / Linux instructions in INSTALL.md.
251261

252-
NOTE: "make test" and normal file operations may fail in directories
253-
mounted as text (i.e. mount -t c:\somewhere /home) due to Cygwin
262+
NOTE: `make test` and normal file operations may fail in directories
263+
mounted as text (i.e. `mount -t c:\somewhere /home`) due to Cygwin
254264
stripping of carriage returns. To avoid this ensure that a binary
255-
mount is used, e.g. mount -b c:\somewhere /home.
265+
mount is used, e.g. `mount -b c:\somewhere /home`.

‎deps/openssl/openssl/README.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@ What This Is
44
This is a fork of [OpenSSL](https://www.openssl.org) to enable QUIC. In addition
55
to the website, the official source distribution is at
66
<https://github.com/openssl/openssl>. The OpenSSL `README` can be found at
7-
[README-OpenSSL.md](https://github.com/quictls/openssl/blob/openssl-3.0.2%2Bquic/README-OpenSSL.md)
7+
[README-OpenSSL.md](https://github.com/quictls/openssl/blob/openssl-3.0.3%2Bquic/README-OpenSSL.md)
88

99
This fork adds APIs that can be used by QUIC implementations for connection
1010
handshakes. Quoting the IETF Working group

‎deps/openssl/openssl/VERSION.dat‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
MAJOR=3
22
MINOR=0
3-
PATCH=2
3+
PATCH=3
44
PRE_RELEASE_TAG=
55
BUILD_METADATA=quic
6-
RELEASE_DATE="15 Mar 2022"
6+
RELEASE_DATE="3 May 2022"
77
SHLIB_VERSION=81.3

‎deps/openssl/openssl/apps/ca.c‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright 1995-2021 The OpenSSL Project Authors. All Rights Reserved.
2+
* Copyright 1995-2022 The OpenSSL Project Authors. All Rights Reserved.
33
*
44
* Licensed under the Apache License 2.0 (the "License"). You may not use
55
* this file except in compliance with the License. You can obtain a copy
@@ -2367,7 +2367,7 @@ static char *make_revocation_str(REVINFO_TYPE rev_type, const char *rev_arg)
23672367

23682368
case REV_CRL_REASON:
23692369
for (i = 0; i < 8; i++) {
2370-
if (strcasecmp(rev_arg, crl_reasons[i]) == 0) {
2370+
if (OPENSSL_strcasecmp(rev_arg, crl_reasons[i]) == 0) {
23712371
reason = crl_reasons[i];
23722372
break;
23732373
}
@@ -2584,7 +2584,7 @@ int unpack_revinfo(ASN1_TIME **prevtm, int *preason, ASN1_OBJECT **phold,
25842584
}
25852585
if (reason_str) {
25862586
for (i = 0; i < NUM_REASONS; i++) {
2587-
if (strcasecmp(reason_str, crl_reasons[i]) == 0) {
2587+
if (OPENSSL_strcasecmp(reason_str, crl_reasons[i]) == 0) {
25882588
reason_code = i;
25892589
break;
25902590
}

‎deps/openssl/openssl/apps/cmp.c‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1745,7 +1745,7 @@ static int handle_opt_geninfo(OSSL_CMP_CTX *ctx)
17451745
valptr[0] = '\0';
17461746
valptr++;
17471747

1748-
if (strncasecmp(valptr, "int:", 4) != 0) {
1748+
if (OPENSSL_strncasecmp(valptr, "int:", 4) != 0) {
17491749
CMP_err("missing 'int:' in -geninfo option");
17501750
return 0;
17511751
}

0 commit comments

Comments
 (0)

Footer

© 2026 GitHub, Inc.
Back | FazBrowse Home | New Git URL