8000 deps: upgrade openssl sources to 1.0.2k · nodejs/node@6a0f1fa · GitHub
[go: up one dir, main page]
Skip to content

Commit 6a0f1fa

Browse files
shigekiItalo A. Casas
shigeki
authored and
Italo A. Casas
committed
deps: upgrade openssl sources to 1.0.2k
This replaces all sources of openssl-1.0.2k.tar.gz into deps/openssl/openssl PR-URL: #11021 Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>
1 parent 580a453 commit 6a0f1fa
  • ui
  • demos/easy_tls
  • doc
  • engines/ccgost
  • include/openssl
  • openssl.spec
  • ssl
  • util

    • Some content is hidden

    Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

    181 files changed

    +1122
    -39081
    lines changed

    ‎deps/openssl/openssl/CHANGES‎

    Lines changed: 61 additions & 0 deletions
    Original file line numberDiff line numberDiff line change
    @@ -2,6 +2,67 @@
    22
    OpenSSL CHANGES
    33
    _______________
    44

    5+
    Changes between 1.0.2j and 1.0.2k [26 Jan 2017]
    6+
    7+
    *) Truncated packet could crash via OOB read
    8+
    9+
    If one side of an SSL/TLS path is running on a 32-bit host and a specific
    10+
    cipher is being used, then a truncated packet can cause that host to
    11+
    perform an out-of-bounds read, usually resulting in a crash.
    12+
    13+
    This issue was reported to OpenSSL by Robert Święcki of Google.
    14+
    (CVE-2017-3731)
    15+
    [Andy Polyakov]
    16+
    17+
    *) BN_mod_exp may produce incorrect results on x86_64
    18+
    19+
    There is a carry propagating bug in the x86_64 Montgomery squaring
    20+
    procedure. No EC algorithms are affected. Analysis suggests that attacks
    21+
    against RSA and DSA as a result of this defect would be very difficult to
    22+
    perform and are not believed likely. Attacks against DH are considered just
    23+
    feasible (although very difficult) because most of the work necessary to
    24+
    deduce information about a private key may be performed offline. The amount
    25+
    of resources required for such an attack would be very significant and
    26+
    likely only accessible to a limited number of attackers. An attacker would
    27+
    additionally need online access to an unpatched system using the target
    28+
    private key in a scenario with persistent DH parameters and a private
    29+
    key that is shared between multiple clients. For example this can occur by
    30+
    default in OpenSSL DHE based SSL/TLS ciphersuites. Note: This issue is very
    31+
    similar to CVE-2015-3193 but must be treated as a separate problem.
    32+
    33+
    This issue was reported to OpenSSL by the OSS-Fuzz project.
    34+
    (CVE-2017-3732)
    35+
    [Andy Polyakov]
    36+
    37+
    *) Montgomery multiplication may produce incorrect results
    38+
    39+
    There is a carry propagating bug in the Broadwell-specific Montgomery
    40+
    multiplication procedure that handles input lengths divisible by, but
    41+
    longer than 256 bits. Analysis suggests that attacks against RSA, DSA
    42+
    and DH private keys are impossible. This is because the subroutine in
    43+
    question is not used in operations with the private key itself and an input
    44+
    of the attacker's direct choice. Otherwise the bug can manifest itself as
    45+
    transient authentication and key negotiation failures or reproducible
    46+
    erroneous outcome of public-key operations with specially crafted input.
    47+
    Among EC algorithms only Brainpool P-512 curves are affected and one
    48+
    presumably can attack ECDH key negotiation. Impact was not analyzed in
    49+
    detail, because pre-requisites for attack are considered unlikely. Namely
    50+
    multiple clients have to choose the curve in question and the server has to
    51+
    share the private key among them, neither of which is default behaviour.
    52+
    Even then only clients that chose the curve will be affected.
    53+
    54+
    This issue was publicly reported as transient failures and was not
    55+
    initially recognized as a security issue. Thanks to Richard Morgan for
    56+
    providing reproducible case.
    57+
    (CVE-2016-7055)
    58+
    [Andy Polyakov]
    59+
    60+
    *) OpenSSL now fails if it receives an unrecognised record type in TLS1.0
    61+
    or TLS1.1. Previously this only happened in SSLv3 and TLS1.2. This is to
    62+
    prevent issues where no progress is being made and the peer continually
    63+
    sends unrecognised record types, using up resources processing them.
    64+
    [Matt Caswell]
    65+
    566
    Changes between 1.0.2i and 1.0.2j [26 Sep 2016]
    667

    768
    *) Missing CRL sanity check

    ‎deps/openssl/openssl/CONTRIBUTING‎

    Lines changed: 17 additions & 38 deletions
    Original file line numberDiff line numberDiff line change
    @@ -1,4 +1,4 @@
    1-
    HOW TO CONTRIBUTE TO PATCHES OpenSSL
    1+
    HOW TO CONTRIBUTE PATCHES TO OpenSSL
    22
    ------------------------------------
    33

    44
    (Please visit https://www.openssl.org/community/getting-started.html for
    @@ -11,34 +11,12 @@ OpenSSL community you might want to discuss it on the openssl-dev mailing
    1111
    list first. Someone may be already working on the same thing or there
    1212
    may be a good reason as to why that feature isn't implemented.
    1313

    14-
    The best way to submit a patch is to make a pull request on GitHub.
    15-
    (It is not necessary to send mail to rt@openssl.org to open a ticket!)
    16-
    If you think the patch could use f 436E eedback from the community, please
    17-
    start a thread on openssl-dev.
    14+
    To submit a patch, make a pull request on GitHub. If you think the patch
    15+
    could use feedback from the community, please start a thread on openssl-dev
    16+
    to discuss it.
    1817

    19-
    You can also submit patches by sending it as mail to rt@openssl.org.
    20-
    Please include the word "PATCH" and an explanation of what the patch
    21-
    does in the subject line. If you do this, our preferred format is "git
    22-
    format-patch" output. For example to provide a patch file containing the
    23-
    last commit in your local git repository use the following command:
    24-
    25-
    % git format-patch --stdout HEAD^ >mydiffs.patch
    26-
    27-
    Another method of creating an acceptable patch file without using git is as
    28-
    follows:
    29-
    30-
    % cd openssl-work
    31-
    ...make your changes...
    32-
    % ./Configure dist; make clean
    33-
    % cd ..
    34-
    % diff -ur openssl-orig openssl-work >mydiffs.patch
    35-
    36-
    Note that pull requests are generally easier for the team, and community, to
    37-
    work with. Pull requests benefit from all of the standard GitHub features,
    38-
    including code review tools, simpler integration, and CI build support.
    39-
    40-
    No matter how a patch is submitted, the following items will help make
    41-
    the acceptance and review process faster:
    18+
    Having addressed the following items before the PR will help make the
    19+
    acceptance and review process faster:
    4220

    4321
    1. Anything other than trivial contributions will require a contributor
    4422
    licensing agreement, giving us permission to use your code. See
    @@ -55,21 +33,22 @@ the acceptance and review process faster:
    5533
    in the file LICENSE in the source distribution or at
    5634
    https://www.openssl.org/source/license.html
    5735

    58-
    3. Patches should be as current as possible. When using GitHub, please
    59-
    expect to have to rebase and update often. Note that we do not accept merge
    60-
    commits. You will be asked to remove them before a patch is considered
    61-
    acceptable.
    36+
    3. Patches should be as current as possible; expect to have to rebase
    37+
    often. We do not accept merge commits; You will be asked to remove
    38+
    them before a patch is considered acceptable.
    6239

    6340
    4. Patches should follow our coding style (see
    6441
    https://www.openssl.org/policies/codingstyle.html) and compile without
    6542
    warnings. Where gcc or clang is availble you should use the
    6643
    --strict-warnings Configure option. OpenSSL compiles on many varied
    6744
    platforms: try to ensure you only use portable features.
    45+
    Clean builds via Travis and AppVeyor are expected, and done whenever
    46+
    a PR is created or updated.
    6847

    69-
    5. When at all possible, patches should include tests. These can either be
    70-
    added to an existing test, or completely new. Please see test/README
    71-
    for information on the test framework.
    48+
    5. When at all possible, patches should include tests. These can
    49+
    either be added to an existing test, or completely new. Please see
    50+
    test/README for information on the test framework.
    7251

    73-
    6. New features or changed functionality must include documentation. Please
    74-
    look at the "pod" files in doc/apps, doc/crypto and doc/ssl for examples of
    75-
    our style.
    52+
    6. New features or changed functionality must include
    53+
    documentation. Please look at the "pod" files in doc/apps, doc/crypto
    54+
    and doc/ssl for examples of our style.

    ‎deps/openssl/openssl/Configure‎

    Lines changed: 27 additions & 7 deletions
    7
    Original file line numberDiff line numberDiff line change
    @@ -7,6 +7,7 @@ eval 'exec perl -S $0 ${1+"$@"}'
    7

    88
    require 5.000;
    99
    use strict;
    10+
    use File::Compare;
    1011

    1112
    # see INSTALL for instructions.
    1213

    @@ -57,12 +58,13 @@ my $usage="Usage: Configure [no-<cipher> ...] [enable-<cipher> ...] [experimenta
    5758
    # zlib-dynamic Like "zlib", but the zlib library is expected to be a shared
    5859
    # library and will be loaded in run-time by the OpenSSL library.
    5960
    # sctp include SCTP support
    60-
    # 386 generate 80386 code
    6161
    # enable-weak-ssl-ciphers
    6262
    # Enable EXPORT and LOW SSLv3 ciphers that are disabled by
    6363
    # default. Note, weak SSLv2 ciphers are unconditionally
    6464
    # disabled.
    65-
    # no-sse2 disables IA-32 SSE2 code, above option implies no-sse2
    65+
    # 386 generate 80386 code in assembly modules
    66+
    # no-sse2 disables IA-32 SSE2 code in assembly modules, the above
    67+
    # mentioned '386' option implies this one
    6668
    # no-<cipher> build without specified algorithm (rsa, idea, rc5, ...)
    6769
    # -<xxx> +<xxx> compiler options are passed through
    6870
    #
    @@ -1792,8 +1794,16 @@ while (<IN>)
    17921794
    }
    17931795
    close(IN);
    17941796
    close(OUT);
    1795-
    rename($Makefile,"$Makefile.bak") || die "unable to rename $Makefile\n" if -e $Makefile;
    1796-
    rename("$Makefile.new",$Makefile) || die "unable to rename $Makefile.new\n";
    1797+
    if ((compare($Makefile, "$Makefile.new"))
    1798+
    or file_newer('Configure', $Makefile)
    1799+
    or file_newer('config', $Makefile)
    1800+
    or file_newer('Makefile.org', $Makefile))
    1801+
    {
    1802+
    rename($Makefile,"$Makefile.bak") || die "unable to rename $Makefile\n" if -e $Makefile;
    1803+
    rename("$Makefile.new",$Makefile) || die "unable to rename $Makefile.new\n";
    1804+
    }
    1805+
    else
    1806+
    { unlink("$Makefile.new"); }
    17971807

    17981808
    print "CC =$cc\n";
    17991809
    print "CFLAG =$cflags\n";
    @@ -1985,9 +1995,13 @@ print OUT "#ifdef __cplusplus\n";
    19851995
    print OUT "}\n";
    19861996
    print OUT "#endif\n";
    19871997
    close(OUT);
    1988-
    rename("crypto/opensslconf.h","crypto/opensslconf.h.bak") || die "unable to rename crypto/opensslconf.h\n" if -e "crypto/opensslconf.h";
    1989-
    rename("crypto/opensslconf.h.new","crypto/opensslconf.h") || die "unable to rename crypto/opensslconf.h.new\n";
    1990-
    1998+
    if (compare("crypto/opensslconf.h.new","crypto/opensslconf.h"))
    1999+
    {
    2000+
    rename("crypto/opensslconf.h","crypto/opensslconf.h.bak") || die "unable to rename crypto/opensslconf.h\n" if -e "crypto/opensslconf.h";
    2001+
    rename("crypto/opensslconf.h.new","crypto/opensslconf.h") || die "unable to rename crypto/opensslconf.h.new\n";
    2002+
    }
    2003+
    else
    2004+
    { unlink("crypto/opensslconf.h.new"); }
    19912005

    19922006
    # Fix the date
    19932007

    @@ -2289,3 +2303,9 @@ sub test_sanity
    22892303
    print STDERR "No sanity errors detected!\n" if $errorcnt == 0;
    22902304
    return $errorcnt;
    22912305
    }
    2306+
    2307+
    sub file_newer
    2308+
    {
    2309+
    my ($file1, $file2) = @_;
    2310+
    return (stat($file1))[9] > (stat($file2))[9]
    2311+
    }

    ‎deps/openssl/openssl/INSTALL‎

    Lines changed: 38 additions & 31 deletions
    Original file line numberDiff line numberDiff line change
    @@ -74,24 +74,26 @@
    7474

    7575
    no-asm Do not use assembler code.
    7676

    77-
    386 Use the 80386 instruction set only (the default x86 code is
    78-
    more efficient, but requires at least a 486). Note: Use
    79-
    compiler flags for any other CPU specific configuration,
    80-
    e.g. "-m32" to build x86 code on an x64 system.
    81-
    82-
    no-sse2 Exclude SSE2 code pathes. Normally SSE2 extention is
    83-
    detected at run-time, but the decision whether or not the
    84-
    machine code will be executed is taken solely on CPU
    85-
    capability vector. This means that if you happen to run OS
    86-
    kernel which does not support SSE2 extension on Intel P4
    87-
    processor, then your application might be exposed to
    88-
    "illegal instruction" exception. There might be a way
    89-
    to enable support in kernel, e.g. FreeBSD kernel can be
    90-
    compiled with CPU_ENABLE_SSE, and there is a way to
    91-
    disengage SSE2 code pathes upon application start-up,
    92-
    but if you aim for wider "audience" running such kernel,
    93-
    consider no-sse2. Both 386 and no-asm options above imply
    94-
    no-sse2.
    77+
    386 In 32-bit x86 builds, when generating assembly modules,
    78+
    use the 80386 instruction set only (the default x86 code
    79+
    is more efficient, but requires at least a 486). Note:
    80+
    This doesn't affect code generated by compiler, you're
    81+
    likely to complement configuration command line with
    82+
    suitable compiler-specific option.
    83+
    84+
    no-sse2 Exclude SSE2 code paths from 32-bit x86 assembly modules.
    85+
    Normally SSE2 extension is detected at run-time, but the
    86+
    decision whether or not the machine code will be executed
    87+
    is taken solely on CPU capability vector. This means that
    88+
    if you happen to run OS kernel which does not support SSE2
    89+
    extension on Intel P4 processor, then your application
    90+
    might be exposed to "illegal instruction" exception.
    91+
    There might be a way to enable support in kernel, e.g.
    92+
    FreeBSD kernel can be compiled with CPU_ENABLE_SSE, and
    93+
    there is a way to disengage SSE2 code paths upon application
    94+
    start-up, but if you aim for wider "audience" running
    95+
    such kernel, consider no-sse2. Both the 386 and
    96+
    no-asm options imply no-sse2.
    9597

    9698
    no-<cipher> Build without the specified cipher (bf, cast, des, dh, dsa,
    9799
    hmac, md2, md5, mdc2, rc2, rc4, rc5, rsa, sha).
    @@ -101,7 +103,12 @@
    101103
    -Dxxx, -lxxx, -Lxxx, -fxxx, -mXXX, -Kxxx These system specific options will
    102104
    be passed through to the compiler to allow you to
    103105
    define preprocessor symbols, specify additional libraries,
    104-
    library directories or other compiler options.
    106+
    library directories or other compiler options. It might be
    107+
    worth noting that some compilers generate code specifically
    108+
    for processor the compiler currently executes on. This is
    109+
    not necessarily what you might have in mind, since it might
    110+
    be unsuitable for execution on other, typically older,
    111+
    processor. Consult your compiler documentation.
    105112

    106113
    -DHAVE_CRYPTODEV Enable the BSD cryptodev engine even if we are not using
    107114
    BSD. Useful if you are running ocf-linux or something
    @@ -159,18 +166,18 @@
    159166
    OpenSSL binary ("openssl"). The libraries will be built in the top-level
    160167
    directory, and the binary will be in the "apps" directory.
    161168

    162-
    If "make" fails, look at the output. There may be reasons for
    163-
    the failure that aren't problems in OpenSSL itself (like missing
    164-
    standard headers). If it is a problem with OpenSSL itself, please
    165-
    report the problem to <openssl-bugs@openssl.org> (note that your
    166-
    message will be recorded in the request tracker publicly readable
    167-
    at https://www.openssl.org/community/index.html#bugs and will be
    168-
    forwarded to a public mailing list). Include the output of "make
    169-
    report" in your message. Please check out the request tracker. Maybe
    170-
    the bug was already reported or has already been fixed.
    171-
    172-
    [If you encounter assembler error messages, try the "no-asm"
    173-
    configuration option as an immediate fix.]
    169+
    If the build fails, look at the output. There may be reasons
    170+
    for the failure that aren't problems in OpenSSL itself (like
    171+
    missing standard headers). If you are having problems you can
    172+
    get help by sending an email to the openssl-users email list (see
    173+
    https://www.openssl.org/community/mailinglists.html for details). If
    174+
    it is a bug with OpenSSL itself, please open an issue on GitHub, at
    175+
    https://github.com/openssl/openssl/issues. Please review the existing
    176+
    ones first; maybe the bug was already reported or has already been
    177+
    fixed.
    178+
    179+
    (If you encounter assembler error messages, try the "no-asm"
    180+
    configuration option as an immediate fix.)
    174181

    175182
    Compiling parts of OpenSSL with gcc and others with the system
    176183
    compiler will result in unresolved symbols on some systems.

    ‎deps/openssl/openssl/Makefile‎

    Lines changed: 3 additions & 2 deletions
    Original file line numberDiff line numberDiff line change
    @@ -4,7 +4,7 @@
    44
    ## Makefile for OpenSSL
    55
    ##
    66

    7-
    VERSION=1.0.2j
    7+
    VERSION=1.0.2k
    88
    MAJOR=1
    99
    MINOR=0.2
    1010
    SHLIB_VERSION_NUMBER=1.0.0
    @@ -203,7 +203,8 @@ CLEARENV= TOP= && unset TOP $${LIB+LIB} $${LIBS+LIBS} \
    203203
    $${ASFLAGS+ASFLAGS} $${AFLAGS+AFLAGS} \
    204204
    $${LDCMD+LDCMD} $${LDFLAGS+LDFLAGS} $${SCRIPTS+SCRIPTS} \
    205205
    $${SHAREDCMD+SHAREDCMD} $${SHAREDFLAGS+SHAREDFLAGS} \
    206-
    $${SHARED_LIB+SHARED_LIB} $${LIBEXTRAS+LIBEXTRAS}
    206+
    $${SHARED_LIB+SHARED_LIB} $${LIBEXTRAS+LIBEXTRAS} \
    207+
    $${APPS+APPS}
    207208

    208209
    # LC_ALL=C ensures that error [and other] messages are delivered in
    209210
    # same language for uniform treatment.

    ‎deps/openssl/openssl/Makef CF16 ile.bak‎

    Lines changed: 3 additions & 2 deletions
    Original file line numberDiff line numberDiff line change
    @@ -4,7 +4,7 @@
    44
    ## Makefile for OpenSSL
    55
    ##
    66

    7-
    VERSION=1.0.2j
    7+
    VERSION=1.0.2k
    88
    MAJOR=1
    99
    MINOR=0.2
    1010
    SHLIB_VERSION_NUMBER=1.0.0
    @@ -203,7 +203,8 @@ CLEARENV= TOP= && unset TOP $${LIB+LIB} $${LIBS+LIBS} \
    203203
    $${ASFLAGS+ASFLAGS} $${AFLAGS+AFLAGS} \
    204204
    $${LDCMD+LDCMD} $${LDFLAGS+LDFLAGS} $${SCRIPTS+SCRIPTS} \
    205205
    $${SHAREDCMD+SHAREDCMD} $${SHAREDFLAGS+SHAREDFLAGS} \
    206-
    $${SHARED_LIB+SHARED_LIB} $${LIBEXTRAS+LIBEXTRAS}
    206+
    $${SHARED_LIB+SHARED_LIB} $${LIBEXTRAS+LIBEXTRAS} \
    207+
    $${APPS+APPS}
    207208

    208209
    # LC_ALL=C ensures that error [and other] messages are delivered in
    209210
    # same language for uniform treatment.

    ‎deps/openssl/openssl/Makefile.org‎

    Lines changed: 2 additions & 1 deletion
    Original file line numberDiff line numberDiff line change
    @@ -201,7 +201,8 @@ CLEARENV= TOP= && unset TOP $${LIB+LIB} $${LIBS+LIBS} \
    201201
    $${ASFLAGS+ASFLAGS} $${AFLAGS+AFLAGS} \
    202202
    $${LDCMD+LDCMD} $${LDFLAGS+LDFLAGS} $${SCRIPTS+SCRIPTS} \
    203203
    $${SHAREDCMD+SHAREDCMD} $${SHAREDFLAGS+SHAREDFLAGS} \
    204-
    $${SHARED_LIB+SHARED_LIB} $${LIBEXTRAS+LIBEXTRAS}
    204+
    $${SHARED_LIB+SHARED_LIB} $${LIBEXTRAS+LIBEXTRAS} \
    205+
    $${APPS+APPS}
    205206

    206207
    # LC_ALL=C ensures that error [and other] messages are delivered in
    207208
    # same language for uniform treatment.

    ‎deps/openssl/openssl/NEWS‎

    Lines changed: 7 additions & 1 deletion
    Original file line numberDiff line numberDiff line change
    @@ -5,9 +5,15 @@
    55
    This file gives a brief overview of the major changes between each OpenSSL
    66
    release. For more details please read the CHANGES file.
    77

    8+
    Major changes between OpenSSL 1.0.2j and OpenSSL 1.0.2k [26 Jan 2017]
    9+
    10+
    o Truncated packet could crash via OOB read (CVE-2017-3731)
    11+
    o BN_mod_exp may produce incorrect results on x86_64 (CVE-2017-3732)
    12+
    o Montgomery multiplication may produce incorrect results (CVE-2016-7055)
    13+
    814
    Major changes between OpenSSL 1.0.2i and OpenSSL 1.0.2j [26 Sep 2016]
    915

    10-
    o Fix Use After Free for large message sizes (CVE-2016-6309)
    16+
    o Missing CRL sanity check (CVE-2016-7052)
    1117

    1218
    Major changes between OpenSSL 1.0.2h and OpenSSL 1.0.2i [22 Sep 2016]
    1319

    0 commit comments

    Comments
     (0)
    0