8000 deps: upgrade openssl sources to openssl-3.5.2 · nodejs/node@33b06df · GitHub
[go: up one dir, main page]
Skip to content

Commit 33b06df

Browse files
nodejs-github-botRafaelGSS
nodejs-github-bot
authored and
RafaelGSS
committed
deps: upgrade openssl sources to openssl-3.5.2
PR-URL: #59371 Reviewed-By: Richard Lau <richard.lau@ibm.com> Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Filip Skokan <panva.ip@gmail.com> Reviewed-By: Luigi Pinca <luigipinca@gmail.com> Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>
1 parent fa70f1a commit 33b06df

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

72 files changed

+438
-198
lines changed

‎deps/openssl/openssl/CHANGES.md‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -28,6 +28,13 @@ OpenSSL Releases
2828
OpenSSL 3.5
2929
-----------
3030

31+
### Changes between 3.5.1 and 3.5.2 [5 Aug 2025]
32+
33+
* The FIPS provider now performs a PCT on key import for RSA, EC and ECX.
34+
This is mandated by FIPS 140-3 IG 10.3.A additional comment 1.
35+
36+
*Dr Paul Dale*
37+
3138
### Changes between 3.5.0 and 3.5.1 [1 Jul 2025]
3239

3340
* Fix x509 application adds trusted use instead of rejected use.

‎deps/openssl/openssl/NEWS.md‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -23,6 +23,10 @@ OpenSSL Releases
2323
OpenSSL 3.5
2424
-----------
2525

26+
### Major changes between OpenSSL 3.5.1 and OpenSSL 3.5.2 [5 Aug 2025]
27+
28+
* none
29+
2630
### Major changes between OpenSSL 3.5.0 and OpenSSL 3.5.1 [1 Jul 2025]
2731

2832
OpenSSL 3.5.1 is a security patch release. The most severe CVE fixed in this

‎deps/openssl/openssl/VERSION.dat‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
MAJOR=3
22
MINOR=5
3-
PATCH=1
3+
PATCH=2
44
PRE_RELEASE_TAG=
55
BUILD_METADATA=
6-
RELEASE_DATE="1 Jul 2025"
6+
RELEASE_DATE="5 Aug 2025"
77
SHLIB_VERSION=3

‎deps/openssl/openssl/apps/asn1parse.c‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -40,8 +40,8 @@ const OPTIONS asn1parse_options[] = {
4040
{"length", OPT_LENGTH, 'p', "length of section in file"},
4141
{"strparse", OPT_STRPARSE, 'p',
4242
"offset; a series of these can be used to 'dig'"},
43-
{"genstr", OPT_GENSTR, 's', "string to generate ASN1 structure from"},
4443
{OPT_MORE_STR, 0, 0, "into multiple ASN1 blob wrappings"},
44+
{"genstr", OPT_GENSTR, 's', "string to generate ASN1 structure from"},
4545
{"genconf", OPT_GENCONF, 's', "file to generate ASN1 structure from"},
4646
{"strictpem", OPT_STRICTPEM, 0,
4747
"equivalent to '-inform pem' (obsolete)"},

‎deps/openssl/openssl/apps/rand.c‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright 1998-2022 The OpenSSL Project Authors. All Rights Reserved.
2+
* Copyright 1998-2025 The OpenSSL Project Authors. All Rights Reserved.
33
*
44
* Licensed under the Apache License 2.0 (the "License"). You may not use
55
* this file except in compliance with the License. You can obtain a copy
@@ -199,7 +199,7 @@ int rand_main(int argc, char **argv)
199199
int chunk;
200200

201201
chunk = scaled_num > buflen ? (int)buflen : (int)scaled_num;
202-
r = RAND_bytes(buf, chunk);
202+
r = RAND_bytes_ex(app_get0_libctx(), buf, chunk, 0);
203203
if (r <= 0)
204204
goto end;
205205
if (format != FORMAT_TEXT) {

‎deps/openssl/openssl/crypto/dh/dh_check.c‎

Lines changed: 32 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright 1995-2024 The OpenSSL Project Authors. All Rights Reserved.
2+
* Copyright 1995-2025 The OpenSSL Project Authors. All Rights Reserved.
33
*
44
* Licensed under the Apache License 2.0 (the "License"). You may not use
55
* this file except in compliance with the License. You can obtain a copy
@@ -16,6 +16,7 @@
1616
#include <stdio.h>
1717
#include "internal/cryptlib.h"
1818
#include <openssl/bn.h>
19+
#include <openssl/self_test.h>
1920
#include "dh_local.h"
2021
#include "crypto/dh.h"
2122

@@ -329,17 +330,27 @@ int ossl_dh_check_priv_key(const DH *dh, const BIGNUM *priv_key, int *ret)
329330
* FFC pairwise check from SP800-56A R3.
330331
* Section 5.6.2.1.4 Owner Assurance of Pair-wise Consistency
331332
*/
332-
int ossl_dh_check_pairwise(const DH *dh)
333+
int ossl_dh_check_pairwise(const DH *dh, int return_on_null_numbers)
333334
{
334335
int ret = 0;
335336
BN_CTX *ctx = NULL;
336337
BIGNUM *pub_key = NULL;
338+
OSSL_SELF_TEST *st = NULL;
339+
OSSL_CALLBACK *stcb = NULL;
340+
void *stcbarg = NULL;
337341

338342
if (dh->params.p == NULL
339343
|| dh->params.g == NULL
340344
|| dh->priv_key == NULL
341345
|| dh->pub_key == NULL)
342-
return 0;
346+
return return_on_null_numbers;
347+
348+
OSSL_SELF_TEST_get_callback(dh->libctx, &stcb, &stcbarg);
349+
st = OSSL_SELF_TEST_new(stcb, stcbarg);
350+
if (st == NULL)
351+
goto err;
352+
OSSL_SELF_TEST_onbegin(st, OSSL_SELF_TEST_TYPE_PCT,
353+
OSSL_SELF_TEST_DESC_PCT_DH);
343354

344355
ctx = BN_CTX_new_ex(dh->libctx);
345356
if (ctx == NULL)
@@ -351,10 +362,27 @@ int ossl_dh_check_pairwise(const DH *dh)
351362
/* recalculate the public key = (g ^ priv) mod p */
352363
if (!ossl_dh_generate_public_key(ctx, dh, dh->priv_key, pub_key))
353364
goto err;
365+
366+
#ifdef FIPS_MODULE
367+
{
368+
int len;
369+
unsigned char bytes[1024] = {0}; /* Max key size of 8192 bits */
370+
371+
if (BN_num_bytes(pub_key) > (int)sizeof(bytes))
372+
goto err;
373+
len = BN_bn2bin(pub_key, bytes);
374+
OSSL_SELF_TEST_oncorrupt_byte(st, bytes);
375+
if (BN_bin2bn(bytes, len, pub_key) == NULL)
376+
goto err;
377+
}
378+
#endif
354379
/* check it matches the existing public_key */
355380
ret = BN_cmp(pub_key, dh->pub_key) == 0;
356-
err:
381+
err:
357382
BN_free(pub_key);
358383
BN_CTX_free(ctx);
384+
385+
OSSL_SELF_TEST_onend(st, ret);
386+
OSSL_SELF_TEST_free(st);
359387
return ret;
360388
}

‎deps/openssl/openssl/crypto/encode_decode/decoder_lib.c‎

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -537,6 +537,14 @@ static void collect_extra_decoder(OSSL_DECODER *decoder, void *arg)
537537
}
538538
}
539539

540+
static int decoder_sk_cmp(const OSSL_DECODER_INSTANCE *const *a,
541+
const OSSL_DECODER_INSTANCE *const *b)
542+
{
543+
if ((*a)->score == (*b)->score)
544+
return (*a)->order - (*b)->order;
545+
return (*a)->score - (*b)->score;
546+
}
547+
540548
int OSSL_DECODER_CTX_add_extra(OSSL_DECODER_CTX *ctx,
541549
OSSL_LIB_CTX *libctx, const char *propq)
542550
{
@@ -595,6 +603,26 @@ int OSSL_DECODER_CTX_add_extra(OSSL_DECODER_CTX *ctx,
595603
OSSL_DECODER_do_all_provided(libctx, collect_all_decoders, skdecoders);
596604
numdecoders = sk_OSSL_DECODER_num(skdecoders);
597605

606+
/*
607+
* If there are provided or default properties, sort the initial decoder list
608+
* by property matching score so that the highest scored provider is selected
609+
* first.
610+
*/
611+
if (propq != NULL || ossl_ctx_global_properties(libctx, 0) != NULL) {
612+
int num_decoder_insts = sk_OSSL_DECODER_INSTANCE_num(ctx->decoder_insts);
613+
int i;
614+
OSSL_DECODER_INSTANCE *di;
615+
sk_OSSL_DECODER_INSTANCE_compfunc old_cmp =
616+
sk_OSSL_DECODER_INSTANCE_set_cmp_func(ctx->decoder_insts, decoder_sk_cmp);
617+
618+
for (i = 0; i < num_decoder_insts; i++) {
619+
di = sk_OSSL_DECODER_INSTANCE_value(ctx->decoder_insts, i);
620+
di->order = i;
621+
}
622+
sk_OSSL_DECODER_INSTANCE_sort(ctx->decoder_insts);
623+
sk_OSSL_DECODER_INSTANCE_set_cmp_func(ctx->decoder_insts, old_cmp);
624+
}
625+
598626
memset(&data, 0, sizeof(data));
599627
data.ctx = ctx;
600628
data.w_prev_start = 0;

‎deps/openssl/openssl/crypto/encode_decode/decoder_pkey.c‎

Lines changed: 60 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -222,15 +222,21 @@ struct collect_data_st {
222222
int total; /* number of matching results */
223223
char error_occurred;
224224
char keytype_resolved;
225+
OSSL_PROPERTY_LIST *pq;
225226

226227
STACK_OF(EVP_KEYMGMT) *keymgmts;
227228
};
228229

229-
static void collect_decoder_keymgmt(EVP_KEYMGMT *keymgmt, OSSL_DECODER *decoder,
230-
void *provctx, struct collect_data_st *data)
230+
/*
231+
* Add decoder instance to the decoder context if it is compatible. Returns 1
232+
* if a decoder was added, 0 otherwise.
233+
*/
234+
static int collect_decoder_keymgmt(EVP_KEYMGMT *keymgmt, OSSL_DECODER *decoder,
235+
void *provctx, struct collect_data_st *data)
231236
{
232237
void *decoderctx = NULL;
233238
OSSL_DECODER_INSTANCE *di = NULL;
239+
const OSSL_PROPERTY_LIST *props;
234240

235241
/*
236242
* We already checked the EVP_KEYMGMT is applicable in check_keymgmt so we
@@ -239,17 +245,17 @@ static void collect_decoder_keymgmt(EVP_KEYMGMT *keymgmt, OSSL_DECODER *decoder,
239245

240246
if (keymgmt->name_id != decoder->base.id)
241247
/* Mismatch is not an error, continue. */
242-
return;
248+
return 0;
243249

244250
if ((decoderctx = decoder->newctx(provctx)) == NULL) {
245251
data->error_occurred = 1;
246-
return;
252+
return 0;
247253
}
248254

249255
if ((di = ossl_decoder_instance_new(decoder, decoderctx)) == NULL) {
250256
decoder->freectx(decoderctx);
251257
data->error_occurred = 1;
252-
return;
258+
return 0;
253259
}
254260

255261
/*
@@ -263,7 +269,7 @@ static void collect_decoder_keymgmt(EVP_KEYMGMT *keymgmt, OSSL_DECODER *decoder,
263269
|| OPENSSL_strcasecmp(data->ctx->start_input_type, "PEM") != 0)) {
264270
/* Mismatch is not an error, continue. */
265271
ossl_decoder_instance_free(di);
266-
return;
272+
return 0;
267273
}
268274

269275
OSSL_TRACE_BEGIN(DECODER) {
@@ -275,13 +281,30 @@ static void collect_decoder_keymgmt(EVP_KEYMGMT *keymgmt, OSSL_DECODER *decoder,
275281
OSSL_DECODER_get0_properties(decoder));
276282
} OSSL_TRACE_END(DECODER);
277283

284+
/*
285+
* Get the property match score so the decoders can be prioritized later.
286+
*/
287+
props = ossl_decoder_parsed_properties(decoder);
288+
if (data->pq != NULL && props != NULL) {
289+
di->score = ossl_property_match_count(data->pq, props);
290+
/*
291+
* Mismatch of mandatory properties is not an error, the decoder is just
292+
* ignored, continue.
293+
*/
294+
if (di->score < 0) {
295+
ossl_decoder_instance_free(di);
296+
return 0;
297+
}
298+
}
299+
278300
if (!ossl_decoder_ctx_add_decoder_inst(data->ctx, di)) {
279301
ossl_decoder_instance_free(di);
280302
data->error_occurred = 1;
281-
return;
303+
return 0;
282304
}
283305

284306
++data->total;
307+
return 1;
285308
}
286309

287310
static void collect_decoder(OSSL_DECODER *decoder, void *arg)
@@ -321,7 +344,9 @@ static void collect_decoder(OSSL_DECODER *decoder, void *arg)
321344
for (i = 0; i < end_i; ++i) {
322345
keymgmt = sk_EVP_KEYMGMT_value(keymgmts, i);
323346

324-
collect_decoder_keymgmt(keymgmt, decoder, provctx, data);
347+
/* Only add this decoder once */
348+
if (collect_decoder_keymgmt(keymgmt, decoder, provctx, data))
349+
break;
325350
if (data->error_occurred)
326351
return;
327352
}
@@ -407,6 +432,8 @@ static int ossl_decoder_ctx_setup_for_pkey(OSSL_DECODER_CTX *ctx,
407432
struct decoder_pkey_data_st *process_data = NULL;
408433
struct collect_data_st collect_data = { NULL };
409434
STACK_OF(EVP_KEYMGMT) *keymgmts = NULL;
435+
OSSL_PROPERTY_LIST **plp;
436+
OSSL_PROPERTY_LIST *pq = NULL, *p2 = NULL;
410437

411438
OSSL_TRACE_BEGIN(DECODER) {
412439
const char *input_type = ctx->start_input_type;
@@ -442,6 +469,25 @@ static int ossl_decoder_ctx_setup_for_pkey(OSSL_DECODER_CTX *ctx,
442469
process_data->selection = ctx->selection;
443470
process_data->keymgmts = keymgmts;
444471

472+
/*
473+
* Collect passed and default properties to prioritize the decoders.
474+
*/
475+
if (propquery != NULL)
476+
p2 = pq = ossl_parse_query(libctx, propquery, 1);
477+
478+
plp = ossl_ctx_global_properties(libctx, 0);
479+
if (plp != NULL && *plp != NULL) {
480+
if (pq == NULL) {
481+
pq = *plp;
482+
} else {
483+
p2 = ossl_property_merge(pq, *plp);
484+
ossl_property_free(pq);
485+
if (p2 == NULL)
486+
goto err;
487+
pq = p2;
488+
}
489+
}
490+
445491
/*
446492
* Enumerate all keymgmts into a stack.
447493
*
@@ -457,10 +503,11 @@ static int ossl_decoder_ctx_setup_for_pkey(OSSL_DECODER_CTX *ctx,
457503
* upfront, as this ensures that the names for all loaded providers have
458504
* been registered by the time we try to resolve the keytype string.
459505
*/
460-
collect_data.ctx = ctx;
461-
collect_data.libctx = libctx;
462-
collect_data.keymgmts = keymgmts;
463-
collect_data.keytype = keytype;
506+
collect_data.ctx = ctx;
507+
collect_data.libctx = libctx;
508+
collect_data.keymgmts = keymgmts;
509+
collect_data.keytype = keytype;
510+
collect_data.pq = pq;
464511
EVP_KEYMGMT_do_all_provided(libctx, collect_keymgmt, &collect_data);
465512

466513
if (collect_data.error_occurred)
@@ -496,6 +543,7 @@ static int ossl_decoder_ctx_setup_for_pkey(OSSL_DECODER_CTX *ctx,
496543
ok = 1;
497544
err:
498545
decoder_clean_pkey_construct_arg(process_data);
546+
ossl_property_free(p2);
499547
return ok;
500548
}
501549

‎deps/openssl/openssl/crypto/encode_decode/encoder_local.h‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -109,6 +109,8 @@ struct ossl_decoder_instance_st {
109109
const char *input_type; /* Never NULL */
110110
const char *input_structure; /* May be NULL */
111111
int input_type_id;
112+
int order; /* For stable ordering of decoders wrt proqs */
113+
int score; /* For ordering decoders wrt proqs */
112114

113115
unsigned int flag_input_structure_was_set : 1;
114116
};

‎deps/openssl/openssl/crypto/evp/asymcipher.c‎

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -261,10 +261,12 @@ int EVP_PKEY_encrypt(EVP_PKEY_CTX *ctx,
261261

262262
cipher = ctx->op.ciph.cipher;
263263
desc = cipher->description != NULL ? cipher->description : "";
264+
ERR_set_mark();
264265
ret = cipher->encrypt(ctx->op.ciph.algctx, out, outlen, (out == NULL ? 0 : *outlen), in, inlen);
265-
if (ret <= 0)
266+
if (ret <= 0 && ERR_count_to_mark() == 0)
266267
ERR_raise_data(ERR_LIB_EVP, EVP_R_PROVIDER_ASYM_CIPHER_FAILURE,
267268
"%s encrypt:%s", cipher->type_name, desc);
269+
ERR_clear_last_mark();
268270
return ret;
269271

270272
legacy:
@@ -309,10 +311,12 @@ int EVP_PKEY_decrypt(EVP_PKEY_CTX *ctx,
309311

310312
cipher = ctx->op.ciph.cipher;
311313
desc = cipher->description != NULL ? cipher->description : "";
314+
ERR_set_mark();
312315
ret = cipher->decrypt(ctx->op.ciph.algctx, out, outlen, (out == NULL ? 0 : *outlen), in, inlen);
313-
if (ret <= 0)
316+
if (ret <= 0 && ERR_count_to_mark() == 0)
314317
ERR_raise_data(ERR_LIB_EVP, EVP_R_PROVIDER_ASYM_CIPHER_FAILURE,
315318
"%s decrypt:%s", cipher->type_name, desc);
319+
ERR_clear_last_mark();
316320

317321
return ret;
318322

0 commit comments

Comments
 (0)
0