8000 deps: upgrade openssl sources to 1.1.1k+quic · nodejs/node@bbdcdad · GitHub
[go: up one dir, main page]
Skip to content
8000

Commit bbdcdad

Browse files
hassaanpMylesBorins
hassaanp
authored and
MylesBorins
committed
deps: upgrade openssl sources to 1.1.1k+quic
This updates all sources in deps/openssl/openssl by: $ git clone https://github.com/quictls/openssl $ cd openssl $ git checkout OpenSSL_1_1_1k+quic $ cd ../node/deps/openssl $ rm -rf openssl $ cp -R ../openssl openssl $ cd openssl && rm -rf .gitattributes .github/ .gitmodules .travis-apt-pin.preferences .travis-create-release.sh $ cd .. $ git add --all openssl $ git commit openssl PR-URL: #37916 Fixes: #37913 Reviewed-By: Tobias Nießen <tniessen@tnie.de> Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
1 parent 13c3924 commit bbdcdad

File tree

40 files changed

+600
-208
lines changed
  • rsa
  • x509
  • doc/man3
  • fuzz
  • include
  • ssl
  • test
  • tools
  • util

    • 40 files changed

    +600
    -208
    lines changed

    ‎deps/op A3E2 enssl/openssl/CHANGES‎

    Lines changed: 44 additions & 0 deletions
    Original file line numberDiff line numberDiff line change
    @@ -7,6 +7,50 @@
    77
    https://github.com/openssl/openssl/commits/ and pick the appropriate
    88
    release branch.
    99

    10+
    Changes between 1.1.1j and 1.1.1k [25 Mar 2021]
    11+
    12+
    *) Fixed a problem with verifying a certificate chain when using the
    13+
    X509_V_FLAG_X509_STRICT flag. This flag enables additional security checks
    14+
    of the certificates present in a certificate chain. It is not set by
    15+
    default.
    16+
    17+
    Starting from OpenSSL version 1.1.1h a check to disallow certificates in
    18+
    the chain that have explicitly encoded elliptic curve parameters was added
    19+
    as an additional strict check.
    20+
    21+
    An error in the implementation of this check meant that the result of a
    22+
    previous check to confirm that certificates in the chain are valid CA
    23+
    certificates was overwritten. This effectively bypasses the check
    24+
    that non-CA certificates must not be able to issue other certificates.
    25+
    26+
    If a "purpose" has been configured then there is a subsequent opportunity
    27+
    for checks that the certificate is a valid CA. All of the named "purpose"
    28+
    values implemented in libcrypto perform this check. Therefore, where
    29+
    a purpose is set the certificate chain will still be rejected even when the
    30+
    strict flag has been used. A purpose is set by default in libssl client and
    31+
    server certificate verification routines, but it can be overridden or
    32+
    removed by an application.
    33+
    34+
    In order to be affected, an application must explicitly set the
    35+
    X509_V_FLAG_X509_STRICT verification flag and either not set a purpose
    36+
    for the certificate verification or, in the case of TLS client or server
    37+
    applications, override the default purpose.
    38+
    (CVE-2021-3450)
    39+
    [Tomáš Mráz]
    40+
    41+
    *) Fixed an issue where an OpenSSL TLS server may crash if sent a maliciously
    42+
    crafted renegotiation ClientHello message from a client. If a TLSv1.2
    43+
    renegotiation ClientHello omits the signature_algorithms extension (where
    44+
    it was present in the initial ClientHello), but includes a
    45+
    signature_algorithms_cert extension then a NULL pointer dereference will
    46+
    result, leading to a crash and a denial of service attack.
    47+
    48+
    A server is only vulnerable if it has TLSv1.2 and renegotiation enabled
    49+
    (which is the default configuration). OpenSSL TLS clients are not impacted
    50+
    by this issue.
    51+
    (CVE-2021-3449)
    52+
    [Peter Kästle and Samuel Sapalski]
    53+
    1054
    Changes between 1.1.1i and 1.1.1j [16 Feb 2021]
    1155

    1256
    *) Fixed the X509_issuer_and_serial_hash() function. It attempts to

    ‎deps/openssl/openssl/Configurations/unix-Makefile.tmpl‎

    Lines changed: 2 additions & 2 deletions
    Original file line numberDiff line numberDiff line change
    @@ -917,8 +917,8 @@ errors:
    917917
    done )
    918918

    919919
    ordinals:
    920-
    ( b=`pwd`; cd $(SRCDIR); $(PERL) -I$$b util/mkdef.pl crypto update )
    921-
    ( b=`pwd`; cd $(SRCDIR); $(PERL) -I$$b util/mkdef.pl ssl update )
    920+
    $(PERL) $(SRCDIR)/util/mkdef.pl crypto update
    921+
    $(PERL) $(SRCDIR)/util/mkdef.pl ssl update
    922922

    923923
    test_ordinals:
    924924
    ( cd test; \

    ‎deps/openssl/openssl/NEWS‎

    Lines changed: 8 additions & 0 deletions
    Original file line numberDiff line numberDiff line change
    @@ -5,6 +5,14 @@
    55
    This file gives a brief overview of the major changes between each OpenSSL
    66
    release. For more details please read the CHANGES file.
    77

    8+
    Major changes between OpenSSL 1.1.1j and OpenSSL 1.1.1k [25 Mar 2021]
    9+
    10+
    o Fixed a problem with verifying a certificate chain when using the
    11+
    X509_V_FLAG_X509_STRICT flag (CVE-2021-3450)
    12+
    o Fixed an issue where an OpenSSL TLS server may crash if sent a
    13+
    maliciously crafted renegotiation ClientHello message from a client
    14+
    (CVE-2021-3449)
    15+
    816
    Major changes between OpenSSL 1.1.1i and OpenSSL 1.1.1j [16 Feb 2021]
    917

    1018
    o Fixed a NULL pointer deref in the X509_issuer_and_serial_hash()

    ‎deps/openssl/openssl/README‎

    Lines changed: 0 additions & 93 deletions
    This file was deleted.

    ‎deps/openssl/openssl/README-OpenSSL.md‎

    Lines changed: 2 additions & 2 deletions
    Original file line numberDiff line numberDiff line change
    @@ -1,7 +1,7 @@
    11

    2-
    OpenSSL 1.1.1j 16 Feb 2021
    2+
    OpenSSL 1.1.1k 25 Mar 2021
    33

    4-
    Copyright (c) 1998-2020 The OpenSSL Project
    4+
    Copyright (c) 1998-2021 The OpenSSL Project
    55
    Copyright (c) 1995-1998 Eric A. Young, Tim J. Hudson
    66
    All rights reserved.
    77

    ‎deps/openssl/openssl/README.md‎

    Lines changed: 1 addition & 1 deletion
    Original file line numberDiff line numberDiff line change
    @@ -47,7 +47,7 @@ How are you keeping current with OpenSSL?
    4747
    -----------------------------------------
    4848
    (In other words, "What about rebasing?")
    4949

    50-
    Our plan it to always rebase on top of an upstream release tag. In particular:
    50+
    Our plan is to always rebase on top of an upstream release tag. In particular:
    5151
    - The changes for QUIC will always be at the tip of the branch -- you will know what
    5252
    is from the original OpenSSL and what is for QUIC.
    5353
    - New versions are quickly created once upstream creates a new tag.

    ‎deps/openssl/openssl/apps/s_cb.c‎

    Lines changed: 3 additions & 2 deletions
    Original file line numberDiff line numberDiff line change
    @@ -1,5 +1,5 @@
    11
    /*
    2-
    * Copyright 1995-2020 The OpenSSL Project Authors. All Rights Reserved.
    2+
    * Copyright 1995-2021 The OpenSSL Project Authors. All Rights Reserved.
    33
    *
    44
    * Licensed under the OpenSSL license (the "License"). You may not use
    55
    * this file except in compliance with the License. You can obtain a copy
    @@ -934,7 +934,8 @@ static int set_cert_cb(SSL *ssl, void *arg)
    934934
    if (!SSL_build_cert_chain(ssl, 0))
    935935
    return 0;
    936936
    } else if (exc->chain != NULL) {
    937-
    SSL_set1_chain(ssl, exc->chain);
    937+
    if (!SSL_set1_chain(ssl, exc->chain))
    938+
    return 0;
    938939
    }
    939940
    }
    940941
    exc = exc->prev;

    ‎deps/openssl/openssl/apps/s_time.c‎

    Lines changed: 3 additions & 2 deletions
    Original file line numberDiff line numberDiff line change
    @@ -1,5 +1,5 @@
    11
    /*
    2-
    * Copyright 1995-2020 The OpenSSL Project Authors. All Rights Reserved.
    2+
    * Copyright 1995-2021 The OpenSSL Project Authors. All Rights Reserved.
    33
    *
    44
    * Licensed under the OpenSSL license (the "License"). You may not use
    55
    * this file except in compliance with the License. You can obtain a copy
    @@ -263,7 +263,8 @@ int s_time_main(int argc, char **argv)
    263263
    nConn, totalTime, ((double)nConn / totalTime), bytes_read);
    264264
    printf
    265265
    ("%d connections in %ld real seconds, %ld bytes read per connection\n",
    266-
    nConn, (long)time(NULL) - finishtime + maxtime, bytes_read / nConn);
    266+
    nConn, (long)time(NULL) - finishtime + maxtime,
    267+
    nConn > 0 ? bytes_read / nConn : 0l);
    267268

    268269
    /*
    269270
    * Now loop and time connections using the same session id over and over

    ‎deps/openssl/openssl/crypto/asn1/asn1_par.c‎

    Lines changed: 2 additions & 1 deletion
    Original file line numberDiff line numberDiff line change
    @@ -1,5 +1,5 @@
    11
    /*
    2-
    * Copyright 1995-2020 The OpenSSL Project Authors. All Rights Reserved.
    2+
    * Copyright 1995-2021 The OpenSSL Project Authors. All Rights Reserved.
    33
    *
    44
    * Licensed under the OpenSSL license (the "License"). You may not use
    55
    * this file except in compliance with the License. You can obtain a copy
    @@ -325,6 +325,7 @@ static int asn1_parse2(BIO *bp, const unsigned char **pp, long length,
    325325
    }
    326326
    if (BIO_puts(bp, "]") <= 0)
    327327
    goto end;
    328+
    dump_cont = 0;
    328329
    }
    329330

    330331
    if (!nl) {

    ‎deps/openssl/openssl/crypto/asn1/bio_ndef.c‎

    Lines changed: 3 additions & 1 deletion
    Original file line numberDiff line numberDiff line change
    @@ -1,5 +1,5 @@
    11
    /*
    2-
    * Copyright 2008-2018 The OpenSSL Project Authors. All Rights Reserved.
    2+
    * Copyright 2008-2021 The OpenSSL Project Authors. All Rights Reserved.
    33
    *
    44
    * Licensed under the OpenSSL license (the "License"). You may not use
    55
    * this file except in compliance with the License. You can obtain a copy
    @@ -113,6 +113,8 @@ static int ndef_prefix(BIO *b, unsigned char **pbuf, int *plen, void *parg)
    113113
    ndef_aux = *(NDEF_SUPPORT **)parg;
    114114

    115115
    derlen = ASN1_item_ndef_i2d(ndef_aux->val, NULL, ndef_aux->it);
    116+
    if (derlen < 0)
    117+
    return 0;
    116118
    if ((p = OPENSSL_malloc(derlen)) == NULL) {
    117119
    ASN1err(ASN1_F_NDEF_PREFIX, ERR_R_MALLOC_FAILURE);
    118120
    return 0;

    0 commit comments

    Comments
     (0)
    0