FazBrowse GitHub Viewer | Trending |
URL:
| Home
Tools: [Download Repo ZIP]   [Original HTTPS Page]

deps: upgrade openssl sources to 1.0.2n · nodejs/node@b3afedf · GitHub

/ node Public

Commit b3afedf

Browse files
shigeki
authored and
MylesBorins
committed
deps: upgrade openssl sources to 1.0.2n
This replaces all sources of openssl-1.0.2n.tar.gz into deps/openssl/openssl PR-URL: #17526 Reviewed-By: Tobias Nießen <tniessen@tnie.de> Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl> Reviewed-By: Colin Ihrig <cjihrig@gmail.com> Reviewed-By: Myles Borins <myles.borins@gmail.com> Reviewed-By: Michael Dawson <michael_dawson@ca.ibm.com> Reviewed-By: Daniel Bevenius <daniel.bevenius@gmail.com>
1 parent a7c4fab commit b3afedf

118 files changed

Lines changed: 592 additions & 38647 deletions

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎deps/openssl/openssl/CHANGES‎

Lines changed: 45 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,51 @@
77
https://github.com/openssl/openssl/commits/ and pick the appropriate
88
release branch.
99

10+
Changes between 1.0.2m and 1.0.2n [7 Dec 2017]
11+
12+
*) Read/write after SSL object in error state
13+
14+
OpenSSL 1.0.2 (starting from version 1.0.2b) introduced an "error state"
15+
mechanism. The intent was that if a fatal error occurred during a handshake
16+
then OpenSSL would move into the error state and would immediately fail if
17+
you attempted to continue the handshake. This works as designed for the
18+
explicit handshake functions (SSL_do_handshake(), SSL_accept() and
19+
SSL_connect()), however due to a bug it does not work correctly if
20+
SSL_read() or SSL_write() is called directly. In that scenario, if the
21+
handshake fails then a fatal error will be returned in the initial function
22+
call. If SSL_read()/SSL_write() is subsequently called by the application
23+
for the same SSL object then it will succeed and the data is passed without
24+
being decrypted/encrypted directly from the SSL/TLS record layer.
25+
26+
In order to exploit this issue an application bug would have to be present
27+
that resulted in a call to SSL_read()/SSL_write() being issued after having
28+
already received a fatal error.
29+
30+
This issue was reported to OpenSSL by David Benjamin (Google).
31+
(CVE-2017-3737)
32+
[Matt Caswell]
33+
34+
*) rsaz_1024_mul_avx2 overflow bug on x86_64
35+
36+
There is an overflow bug in the AVX2 Montgomery multiplication procedure
37+
used in exponentiation with 1024-bit moduli. No EC algorithms are affected.
38+
Analysis suggests that attacks against RSA and DSA as a result of this
39+
defect would be very difficult to perform and are not believed likely.
40+
Attacks against DH1024 are considered just feasible, because most of the
41+
work necessary to deduce information about a private key may be performed
42+
offline. The amount of resources required for such an attack would be
43+
significant. However, for an attack on TLS to be meaningful, the server
44+
would have to share the DH1024 private key among multiple clients, which is
45+
no longer an option since CVE-2016-0701.
46+
47+
This only affects processors that support the AVX2 but not ADX extensions
48+
like Intel Haswell (4th generation).
49+
50+
This issue was reported to OpenSSL by David Benjamin (Google). The issue
51+
was originally found via the OSS-Fuzz project.
52+
(CVE-2017-3738)
53+
[Andy Polyakov]
54+
1055
Changes between 1.0.2l and 1.0.2m [2 Nov 2017]
1156

1257
*) bn_sqrx8x_internal carry bug on x86_64

‎deps/openssl/openssl/Configure‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -592,9 +592,9 @@ my %table=(
592592
"debug-VC-WIN64A","cl:-W3 -Gs0 -Gy -Zi -nologo -DOPENSSL_SYSNAME_WIN32 -DWIN32_LEAN_AND_MEAN -DL_ENDIAN -DUNICODE -D_UNICODE -D_CRT_SECURE_NO_DEPRECATE:::WIN64A::SIXTY_FOUR_BIT RC4_CHUNK_LL DES_INT EXPORT_VAR_AS_FN:".eval{my $asm=$x86_64_asm;$asm=~s/x86_64-gcc\.o/bn_asm.o/;$asm}.":auto:win32",
593593
# x86 Win32 target defaults to ANSI API, if you want UNICODE, complement
594594
# 'perl Configure VC-WIN32' with '-DUNICODE -D_UNICODE'
595-
"VC-WIN32","cl:-W3 -Gs0 -GF -Gy -nologo -DOPENSSL_SYSNAME_WIN32 -DWIN32_LEAN_AND_MEAN -DL_ENDIAN -D_CRT_SECURE_NO_DEPRECATE:::WIN32::BN_LLONG RC4_INDEX EXPORT_VAR_AS_FN ${x86_gcc_opts}:${x86_asm}:win32n:win32",
595+
"VC-WIN32","cl:-W3 -WX -Gs0 -GF -Gy -nologo -DOPENSSL_SYSNAME_WIN32 -DWIN32_LEAN_AND_MEAN -DL_ENDIAN -D_CRT_SECURE_NO_DEPRECATE -D_WINSOCK_DEPRECATED_NO_WARNINGS:::WIN32::BN_LLONG RC4_INDEX EXPORT_VAR_AS_FN ${x86_gcc_opts}:${x86_asm}:win32n:win32",
596596
# Unified CE target
597-
"debug-VC-WIN32","cl:-W3 -Gs0 -GF -Gy -Zi -nologo -DOPENSSL_SYSNAME_WIN32 -DWIN32_LEAN_AND_MEAN -DL_ENDIAN -D_CRT_SECURE_NO_DEPRECATE:::WIN32::BN_LLONG RC4_INDEX EXPORT_VAR_AS_FN ${x86_gcc_opts}:${x86_asm}:win32n:win32",
597+
"debug-VC-WIN32","cl:-W3 -WX -Gs0 -GF -Gy -Zi -nologo -DOPENSSL_SYSNAME_WIN32 -DWIN32_LEAN_AND_MEAN -DL_ENDIAN -D_CRT_SECURE_NO_DEPRECATE -D_WINSOCK_DEPRECATED_NO_WARNINGS:::WIN32::BN_LLONG RC4_INDEX EXPORT_VAR_AS_FN ${x86_gcc_opts}:${x86_asm}:win32n:win32",
598598
"VC-CE","cl::::WINCE::BN_LLONG RC4_INDEX EXPORT_VAR_AS_FN ${x86_gcc_opts}:${no_asm}:win32",
599599

600600
# Borland C++ 4.5

‎deps/openssl/openssl/Makefile‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@
44
## Makefile for OpenSSL
55
##
66

7-
VERSION=1.0.2m
7+
VERSION=1.0.2n
88
MAJOR=1
99
MINOR=0.2
1010
SHLIB_VERSION_NUMBER=1.0.0

‎deps/openssl/openssl/Makefile.bak‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@
44
## Makefile for OpenSSL
55
##
66

7-
VERSION=1.0.2m
7+
VERSION=1.0.2n
88
MAJOR=1
99
MINOR=0.2
1010
SHLIB_VERSION_NUMBER=1.0.0

‎deps/openssl/openssl/NEWS‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,11 @@
55
This file gives a brief overview of the major changes between each OpenSSL
66
release. For more details please read the CHANGES file.
77

8+
Major changes between OpenSSL 1.0.2m and OpenSSL 1.0.2n [7 Dec 2017]
9+
10+
o Read/write after SSL object in error state (CVE-2017-3737)
11+
o rsaz_1024_mul_avx2 overflow bug on x86_64 (CVE-2017-3738)
12+
813
Major changes between OpenSSL 1.0.2l and OpenSSL 1.0.2m [2 Nov 2017]
914

1015
o bn_sqrx8x_internal carry bug on x86_64 (CVE-2017-3736)

‎deps/openssl/openssl/README‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11

2-
OpenSSL 1.0.2m 2 Nov 2017
2+
OpenSSL 1.0.2n 7 Dec 2017
33

44
Copyright (c) 1998-2015 The OpenSSL Project
55
Copyright (c) 1995-1998 Eric A. Young, Tim J. Hudson

‎deps/openssl/openssl/apps/app_rand.c‎

Lines changed: 1 addition & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -124,16 +124,7 @@ int app_RAND_load_file(const char *file, BIO *bio_e, int dont_warn)
124124
char buffer[200];
125125

126126
#ifdef OPENSSL_SYS_WINDOWS
127-
/*
128-
* allocate 2 to dont_warn not to use RAND_screen() via
129-
* -no_rand_screen option in s_client
130-
*/
131-
if (dont_warn != 2) {
132-
BIO_printf(bio_e, "Loading 'screen' into random state -");
133-
BIO_flush(bio_e);
134-
RAND_screen();
135-
BIO_printf(bio_e, " done\n");
136-
}
127+
RAND_screen();
137128
#endif
138129

139130
if (file == NULL)

‎deps/openssl/openssl/apps/apps.c‎

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -148,6 +148,10 @@
148148
#ifdef _WIN32
149149
static int WIN32_rename(const char *from, const char *to);
150150
# define rename(from,to) WIN32_rename((from),(to))
151+
# ifdef fileno
152+
# undef fileno
153+
# endif
154+
# define fileno(a) (int)_fileno(a)
151155
#endif
152156

153157
typedef struct {
@@ -2788,13 +2792,13 @@ unsigned char *next_protos_parse(unsigned short *outlen, const char *in)
27882792
OPENSSL_free(out);
27892793
return NULL;
27902794
}
2791-
out[start] = i - start;
2795+
out[start] = (unsigned char)(i - start);
27922796
start = i + 1;
27932797
} else
27942798
out[i + 1] = in[i];
27952799
}
27962800

2797-
*outlen = len + 1;
2801+
*outlen = (unsigned char)(len + 1);
27982802
return out;
27992803
}
28002804
#endif /* ndef OPENSSL_NO_TLSEXT */

‎deps/openssl/openssl/apps/dsa.c‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -327,6 +327,9 @@ int MAIN(int argc, char **argv)
327327
} else if (outformat == FORMAT_MSBLOB || outformat == FORMAT_PVK) {
328328
EVP_PKEY *pk;
329329
pk = EVP_PKEY_new();
330+
if (pk == NULL)
331+
goto end;
332+
330333
EVP_PKEY_set1_DSA(pk, dsa);
331334
if (outformat == FORMAT_PVK)
332335
i = i2b_PVK_bio(out, pk, pvk_encr, 0, passout);

‎deps/openssl/openssl/apps/s_client.c‎

Lines changed: 13 additions & 27 deletions
Original file line numberDiff line numberDiff line change
@@ -180,13 +180,6 @@ typedef unsigned int u_int;
180180
# include <fcntl.h>
181181
#endif
182182

183-
/* Use Windows API with STD_INPUT_HANDLE when checking for input?
184-
Don't look at OPENSSL_SYS_MSDOS for this, since it is always defined if
185-
OPENSSL_SYS_WINDOWS is defined */
186-
#if defined(OPENSSL_SYS_WINDOWS) && !defined(OPENSSL_SYS_WINCE) && defined(STD_INPUT_HANDLE)
187-
#define OPENSSL_USE_STD_INPUT_HANDLE
188-
#endif
189-
190183
#undef PROG
191184
#define PROG s_client_main
192185

@@ -236,7 +229,6 @@ static BIO *bio_c_msg = NULL;
236229
static int c_quiet = 0;
237230
static int c_ign_eof = 0;
238231
static int c_brief = 0;
239-
static int c_no_rand_screen = 0;
240232

241233
#ifndef OPENSSL_NO_PSK
242234
/* Default PSK identity and key */
@@ -452,10 +444,6 @@ static void sc_usage(void)
452444
" -keymatexport label - Export keying material using label\n");
453445
BIO_printf(bio_err,
454446
" -keymatexportlen len - Export len bytes of keying material (default 20)\n");
455-
#ifdef OPENSSL_SYS_WINDOWS
456-
BIO_printf(bio_err,
457-
" -no_rand_screen - Do not use RAND_screen() to initialize random state\n");
458-
#endif
459447
}
460448

461449
#ifndef OPENSSL_NO_TLSEXT
@@ -642,10 +630,11 @@ static int serverinfo_cli_parse_cb(SSL *s, unsigned int ext_type,
642630
unsigned char ext_buf[4 + 65536];
643631

644632
/* Reconstruct the type/len fields prior to extension data */
645-
ext_buf[0] = ext_type >> 8;
646-
ext_buf[1] = ext_type & 0xFF;
647-
ext_buf[2] = inlen >> 8;
648-
ext_buf[3] = inlen & 0xFF;
633+
inlen &= 0xffff; /* for formal memcpy correctness */
634+
ext_buf[0] = (unsigned char)(ext_type >> 8);
635+
ext_buf[1] = (unsigned char)(ext_type);
636+
ext_buf[2] = (unsigned char)(inlen >> 8);
637+
ext_buf[3] = (unsigned char)(inlen);
649638
memcpy(ext_buf + 4, in, inlen);
650639

651640
BIO_snprintf(pem_name, sizeof(pem_name), "SERVERINFO FOR EXTENSION %d",
@@ -1148,10 +1137,6 @@ int MAIN(int argc, char **argv)
11481137
keymatexportlen = atoi(*(++argv));
11491138
if (keymatexportlen == 0)
11501139
goto bad;
1151-
#ifdef OPENSSL_SYS_WINDOWS
1152-
} else if (strcmp(*argv, "-no_rand_screen") == 0) {
1153-
c_no_rand_screen = 1;
1154-
#endif
11551140
} else {
11561141
BIO_printf(bio_err, "unknown option %s\n", *argv);
11571142
badop = 1;
@@ -1268,7 +1253,7 @@ int MAIN(int argc, char **argv)
12681253
if (!load_excert(&exc, bio_err))
12691254
goto end;
12701255
1271-
if (!app_RAND_load_file(NULL, bio_err, ++c_no_rand_screen) && inrand == NULL
1256+
if (!app_RAND_load_file(NULL, bio_err, 1) && inrand == NULL
12721257
&& !RAND_status()) {
12731258
BIO_printf(bio_err,
12741259
"warning, not much extra random data, consider using the -rand option\n");
@@ -1808,16 +1793,17 @@ int MAIN(int argc, char **argv)
18081793
tv.tv_usec = 0;
18091794
i = select(width, (void *)&readfds, (void *)&writefds,
18101795
NULL, &tv);
1811-
#if defined(OPENSSL_USE_STD_INPUT_HANDLE)
1796+
# if defined(OPENSSL_SYS_WINCE) || defined(OPENSSL_SYS_MSDOS)
1797+
if (!i && (!_kbhit() || !read_tty))
1798+
continue;
1799+
# else
18121800
if (!i && (!((_kbhit())
18131801
|| (WAIT_OBJECT_0 ==
18141802
WaitForSingleObject(GetStdHandle
18151803
(STD_INPUT_HANDLE),
18161804
0)))
18171805
|| !read_tty))
18181806
continue;
1819-
#else
1820-
if(!i && (!_kbhit() || !read_tty) ) continue;
18211807
# endif
18221808
} else
18231809
i = select(width, (void *)&readfds, (void *)&writefds,
@@ -2019,12 +2005,12 @@ int MAIN(int argc, char **argv)
20192005
}
20202006
}
20212007
#if defined(OPENSSL_SYS_WINDOWS) || defined(OPENSSL_SYS_MSDOS)
2022-
#if defined(OPENSSL_USE_STD_INPUT_HANDLE)
2008+
# if defined(OPENSSL_SYS_WINCE) || defined(OPENSSL_SYS_MSDOS)
2009+
else if (_kbhit())
2010+
# else
20232011
else if ((_kbhit())
20242012
|| (WAIT_OBJECT_0 ==
20252013
WaitForSingleObject(GetStdHandle(STD_INPUT_HANDLE), 0)))
2026-
#else
2027-
else if (_kbhit())
20282014
# endif
20292015
#elif defined (OPENSSL_SYS_NETWARE)
20302016
else if (_kbhit())

0 commit comments

Comments
 (0)
Back | FazBrowse Home | New Git URL