X Tutup
Skip to content

Commit 0633ae7

Browse files
danbevrichardlau
danbev
authored and
richardlau
committed
deps: upgrade openssl sources to 1.1.1j
This updates all sources in deps/openssl/openssl by: $ cd deps/openssl/ $ rm -rf openssl $ tar zxf ~/tmp/openssl-1.1.1j.tar.gz $ mv openssl-1.1.1j openssl $ git add --all openssl $ git commit openssl PR-URL: #37413 Reviewed-By: Richard Lau <rlau@redhat.com> Reviewed-By: Beth Griggs <bgriggs@redhat.com>
1 parent 75fd447 commit 0633ae7

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

90 files changed

+824
-322
lines changed

‎deps/openssl/openssl/AUTHORS‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,8 @@ Ben Kaduk
1313
Bernd Edlinger
1414
Bodo Möller
1515
David Benjamin
16+
David von Oheimb
17+
Dmitry Belyavskiy (Дмитрий Белявский)
1618
Emilia Käsper
1719
Eric Young
1820
Geoff Thorpe
@@ -22,14 +24,19 @@ Lutz Jänicke
2224
Mark J. Cox
2325
Matt Caswell
2426
Matthias St. Pierre
27+
Nicola Tuveri
2528
Nils Larsch
29+
Patrick Steuer
2630
Paul Dale
2731
Paul C. Sutton
32+
Paul Yang
2833
Ralf S. Engelschall
2934
Rich Salz
3035
Richard Levitte
36+
Shane Lontis
3137
Stephen Henson
3238
Steve Marquess
3339
Tim Hudson
40+
Tomáš Mráz
3441
Ulf Möller
3542
Viktor Dukhovni

‎deps/openssl/openssl/CHANGES‎

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,43 @@
77
https://github.com/openssl/openssl/commits/ and pick the appropriate
88
release branch.
99

10+
Changes between 1.1.1i and 1.1.1j [16 Feb 2021]
11+
12+
*) Fixed the X509_issuer_and_serial_hash() function. It attempts to
13+
create a unique hash value based on the issuer and serial number data
14+
contained within an X509 certificate. However it was failing to correctly
15+
handle any errors that may occur while parsing the issuer field (which might
16+
occur if the issuer field is maliciously constructed). This may subsequently
17+
result in a NULL pointer deref and a crash leading to a potential denial of
18+
service attack.
19+
(CVE-2021-23841)
20+
[Matt Caswell]
21+
22+
*) Fixed the RSA_padding_check_SSLv23() function and the RSA_SSLV23_PADDING
23+
padding mode to correctly check for rollback attacks. This is considered a
24+
bug in OpenSSL 1.1.1 because it does not support SSLv2. In 1.0.2 this is
25+
CVE-2021-23839.
26+
[Matt Caswell]
27+
28+
*) Fixed the EVP_CipherUpdate, EVP_EncryptUpdate and EVP_DecryptUpdate
29+
functions. Previously they could overflow the output length argument in some
30+
cases where the input length is close to the maximum permissable length for
31+
an integer on the platform. In such cases the return value from the function
32+
call would be 1 (indicating success), but the output length value would be
33+
negative. This could cause applications to behave incorrectly or crash.
34+
(CVE-2021-23840)
35+
[Matt Caswell]
36+
37+
*) Fixed SRP_Calc_client_key so that it runs in constant time. The previous
38+
implementation called BN_mod_exp without setting BN_FLG_CONSTTIME. This
39+
could be exploited in a side channel attack to recover the password. Since
40+
the attack is local host only this is outside of the current OpenSSL
41+
threat model and therefore no CVE is assigned.
42+
43+
Thanks to Mohammed Sabt and Daniel De Almeida Braga for reporting this
44+
issue.
45+
[Matt Caswell]
46+
1047
Changes between 1.1.1h and 1.1.1i [8 Dec 2020]
1148

1249
*) Fixed NULL pointer deref in the GENERAL_NAME_cmp function

‎deps/openssl/openssl/CONTRIBUTING‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -41,8 +41,8 @@ guidelines:
4141
https://www.openssl.org/policies/codingstyle.html) and compile
4242
without warnings. Where gcc or clang is available you should use the
4343
--strict-warnings Configure option. OpenSSL compiles on many varied
44-
platforms: try to ensure you only use portable features. Clean builds
45-
via Travis and AppVeyor are required, and they are started automatically
44+
platforms: try to ensure you only use portable features. Clean builds via
45+
GitHub Actions and AppVeyor are required, and they are started automatically
4646
whenever a PR is created or updated.
4747

4848
5. When at all possible, patches should include tests. These can

‎deps/openssl/openssl/Configurations/10-main.conf‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -663,6 +663,7 @@ my %targets = (
663663
"linux-ppc" => {
664664
inherit_from => [ "linux-generic32", asm("ppc32_asm") ],
665665
perlasm_scheme => "linux32",
666+
lib_cppflags => add("-DB_ENDIAN"),
666667
},
667668
"linux-ppc64" => {
668669
inherit_from => [ "linux-generic64", asm("ppc64_asm") ],

‎deps/openssl/openssl/Configurations/descrip.mms.tmpl‎

Lines changed: 15 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -377,8 +377,13 @@ NODEBUG=@
377377
$(NODEBUG) !
378378
$(NODEBUG) ! Installation logical names
379379
$(NODEBUG) !
380-
$(NODEBUG) installtop = F$PARSE(staging_instdir,"$(INSTALLTOP)","[]A.;",,"SYNTAX_ONLY,NO_CONCEAL") - ".][000000" - "[000000." - "][" - "]A.;" + ".]"
381-
$(NODEBUG) datatop = F$PARSE(staging_datadir,"$(OPENSSLDIR)","[]A.;",,"SYNTAX_ONLY,NO_CONCEAL") - ".][000000" - "[000000." - "][" - "]A.;" + ".]"
380+
$(NODEBUG) ! This also creates a few DCL variables that are used for
381+
$(NODEBUG) ! the "install_msg" target.
382+
$(NODEBUG) !
383+
$(NODEBUG) installroot = F$PARSE(staging_instdir,"$(INSTALLTOP)","[]A.;",,"SYNTAX_ONLY,NO_CONCEAL") - ".][000000" - "[000000." - "][" - "]A.;"
384+
$(NODEBUG) installtop = installroot + ".]"
385+
$(NODEBUG) dataroot = F$PARSE(staging_datadir,"$(OPENSSLDIR)","[]A.;",,"SYNTAX_ONLY,NO_CONCEAL") - ".][000000" - "[000000." - "][" - "]A.;"
386+
$(NODEBUG) datatop = dataroot + ".]"
382387
$(NODEBUG) DEFINE ossl_installroot 'installtop'
383388
$(NODEBUG) DEFINE ossl_dataroot 'datatop'
384389
$(NODEBUG) !
@@ -455,30 +460,19 @@ list-tests :
455460
@ WRITE SYS$OUTPUT "Tests are not supported with your chosen Configure options"
456461
@ ! {- output_on() if !$disabled{tests}; "" -}
457462

458-
install : install_sw install_ssldirs install_docs
463+
install : install_sw install_ssldirs install_docs install_msg
464+
@ !
465+
466+
install_msg :
459467
@ WRITE SYS$OUTPUT ""
460468
@ WRITE SYS$OUTPUT "######################################################################"
461469
@ WRITE SYS$OUTPUT ""
462470
@ IF "$(DESTDIR)" .EQS. "" THEN -
463-
PIPE ( WRITE SYS$OUTPUT "Installation complete" ; -
464-
WRITE SYS$OUTPUT "" ; -
465-
WRITE SYS$OUTPUT "Run @$(SYSTARTUP)openssl_startup{- $osslver -} to set up logical names" ; -
466-
WRITE SYS$OUTPUT "then run @$(SYSTARTUP)openssl_utils{- $osslver -} to define commands" ; -
467-
WRITE SYS$OUTPUT "" )
471+
@{- sourcefile("VMS", "msg_install.com") -} "$(SYSTARTUP)" "{- $osslver -}"
468472
@ IF "$(DESTDIR)" .NES. "" THEN -
469-
PIPE ( WRITE SYS$OUTPUT "Staging installation complete" ; -
470-
WRITE SYS$OUTPUT "" ; -
471-
WRITE SYS$OUTPUT "Finish or package in such a way that the contents of the directory tree" ; -
472-
WRITE SYS$OUTPUT staging_instdir ; -
473-
WRITE SYS$OUTPUT "ends up in $(INSTALLTOP)," ; -
474-
WRITE SYS$OUTPUT "and that the contents of the contents of the directory tree" ; -
475-
WRITE SYS$OUTPUT staging_datadir ; -
476-
WRITE SYS$OUTPUT "ends up in $(OPENSSLDIR)" ; -
477-
WRITE SYS$OUTPUT "" ; -
478-
WRITE SYS$OUTPUT "When in its final destination," ; -
479-
WRITE SYS$OUTPUT "Run @$(SYSTARTUP)openssl_startup{- $osslver -} to set up logical names" ; -
480-
WRITE SYS$OUTPUT "then run @$(SYSTARTUP)openssl_utils{- $osslver -} to define commands" ; -
481-
WRITE SYS$OUTPUT "" )
473+
@{- sourcefile("VMS", "msg_staging.com") -} -
474+
"''installroot']" "''dataroot']" "$(INSTALLTOP)" "$(OPENSSLDIR)" -
475+
"$(SYSTARTUP)" "{- $osslver -}"
482476

483477
check_install :
484478
spawn/nolog @ossl_installroot:[SYSTEST]openssl_ivp{- $osslver -}.com

‎deps/openssl/openssl/Configure‎

Lines changed: 16 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
#! /usr/bin/env perl
22
# -*- mode: perl; -*-
3-
# Copyright 2016-2020 The OpenSSL Project Authors. All Rights Reserved.
3+
# Copyright 2016-2021 The OpenSSL Project Authors. All Rights Reserved.
44
#
55
# Licensed under the OpenSSL license (the "License"). You may not use
66
# this file except in compliance with the License. You can obtain a copy
@@ -1201,6 +1201,10 @@ foreach (keys %useradd) {
12011201
# At this point, we can forget everything about %user and %useradd,
12021202
# because it's now all been merged into the corresponding $config entry
12031203

1204+
if (grep { $_ eq '-static' } @{$config{LDFLAGS}}) {
1205+
disable('static', 'pic', 'threads');
1206+
}
1207+
12041208
# Allow overriding the build file name
12051209
$config{build_file} = env('BUILDFILE') || $target{build_file} || "Makefile";
12061210

@@ -1521,10 +1525,6 @@ if ($strict_warnings)
15211525
}
15221526
}
15231527

1524-
if (grep { $_ eq '-static' } @{$config{LDFLAGS}}) {
1525-
disable('static', 'pic', 'threads');
1526-
}
1527-
15281528
$config{CFLAGS} = [ map { $_ eq '--ossl-strict-warnings'
15291529
? @strict_warnings_collection
15301530
: ( $_ ) }
@@ -2611,19 +2611,22 @@ _____
26112611
}
26122612
print "\nEnabled features:\n\n";
26132613
foreach my $what (@disablables) {
2614-
print " $what\n" unless $disabled{$what};
2614+
print " $what\n"
2615+
unless grep { $_ =~ /^${what}$/ } keys %disabled;
26152616
}
26162617
print "\nDisabled features:\n\n";
26172618
foreach my $what (@disablables) {
2618-
if ($disabled{$what}) {
2619-
print " $what", ' ' x ($longest - length($what) + 1),
2620-
"[$disabled{$what}]", ' ' x ($longest2 - length($disabled{$what}) + 1);
2621-
print $disabled_info{$what}->{macro}
2622-
if $disabled_info{$what}->{macro};
2619+
my @what2 = grep { $_ =~ /^${what}$/ } keys %disabled;
2620+
my $what3 = $what2[0];
2621+
if ($what3) {
2622+
print " $what3", ' ' x ($longest - length($what3) + 1),
2623+
"[$disabled{$what3}]", ' ' x ($longest2 - length($disabled{$what3}) + 1);
2624+
print $disabled_info{$what3}->{macro}
2625+
if $disabled_info{$what3}->{macro};
26232626
print ' (skip ',
2624-
join(', ', @{$disabled_info{$what}->{skipped}}),
2627+
join(', ', @{$disabled_info{$what3}->{skipped}}),
26252628
')'
2626-
if $disabled_info{$what}->{skipped};
2629+
if $disabled_info{$what3}->{skipped};
26272630
print "\n";
26282631
}
26292632
}

‎deps/openssl/openssl/INSTALL‎

Lines changed: 8 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -106,8 +106,7 @@
106106
This will build and install OpenSSL in the default location, which is:
107107

108108
Unix: normal installation directories under /usr/local
109-
OpenVMS: SYS$COMMON:[OPENSSL-'version'...], where 'version' is the
110-
OpenSSL version number with underscores instead of periods.
109+
OpenVMS: SYS$COMMON:[OPENSSL]
111110
Windows: C:\Program Files\OpenSSL or C:\Program Files (x86)\OpenSSL
112111

113112
The installation directory should be appropriately protected to ensure
@@ -116,7 +115,9 @@
116115
your Operating System it is recommended that you do not overwrite the system
117116
version and instead install to somewhere else.
118117

119-
If you want to install it anywhere else, run config like this:
118+
If you want to install it anywhere else, run config like this (the options
119+
--prefix and --openssldir are explained further down, and the values shown
120+
here are mere examples):
120121

121122
On Unix:
122123

@@ -198,7 +199,7 @@
198199
Unix: /usr/local
199200
Windows: C:\Program Files\OpenSSL
200201
or C:\Program Files (x86)\OpenSSL
201-
OpenVMS: SYS$COMMON:[OPENSSL-'version']
202+
OpenVMS: SYS$COMMON:[OPENSSL]
202203

203204
--release
204205
Build OpenSSL without debugging symbols. This is the default.
@@ -961,9 +962,9 @@
961962
share/doc/openssl/html/man7
962963
Contains the HTML rendition of the man-pages.
963964

964-
OpenVMS ('arch' is replaced with the architecture name, "Alpha"
965-
or "ia64", 'sover' is replaced with the shared library version
966-
(0101 for 1.1), and 'pz' is replaced with the pointer size
965+
OpenVMS ('arch' is replaced with the architecture name, "ALPHA"
966+
or "IA64", 'sover' is replaced with the shared library version
967+
(0101 for 1.1.x), and 'pz' is replaced with the pointer size
967968
OpenSSL was built with):
968969

969970
[.EXE.'arch'] Contains the openssl binary.

‎deps/openssl/openssl/NEWS‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,16 @@
55
This file gives a brief overview of the major changes between each OpenSSL
66
release. For more details please read the CHANGES file.
77

8+
Major changes between OpenSSL 1.1.1i and OpenSSL 1.1.1j [16 Feb 2021]
9+
10+
o Fixed a NULL pointer deref in the X509_issuer_and_serial_hash()
11+
function (CVE-2021-23841)
12+
o Fixed the RSA_padding_check_SSLv23() function and the RSA_SSLV23_PADDING
13+
padding mode to correctly check for rollback attacks
14+
o Fixed an overflow in the EVP_CipherUpdate, EVP_EncryptUpdate and
15+
EVP_DecryptUpdate functions (CVE-2021-23840)
16+
o Fixed SRP_Calc_client_key so that it runs in constant time
17+
818
Major changes between OpenSSL 1.1.1h and OpenSSL 1.1.1i [8 Dec 2020]
919

1020
o Fixed NULL pointer deref in GENERAL_NAME_cmp (CVE-2020-1971)

‎deps/openssl/openssl/NOTES.VMS‎

Lines changed: 10 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -90,9 +90,9 @@
9090
Unix mount point.
9191

9292
The easiest way to check if everything got through as it should is to
93-
check for one of the following files:
93+
check that this file exists:
9494

95-
[.crypto]opensslconf^.h.in
95+
[.include.openssl]opensslconf^.h.in
9696

9797
The best way to get a correct distribution is to download the gzipped
9898
tar file from ftp://ftp.openssl.org/source/, use GZIP -d to uncompress
@@ -105,3 +105,11 @@
105105
Should you need it, you can find UnZip for VMS here:
106106

107107
http://www.info-zip.org/UnZip.html
108+
109+
110+
How the value of 'arch' is determined
111+
-------------------------------------
112+
113+
'arch' is mentioned in INSTALL. It's value is determined like this:
114+
115+
arch = f$edit( f$getsyi( "arch_name"), "upcase")

‎deps/openssl/openssl/NOTES.WIN‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -62,8 +62,8 @@
6262

6363
For VC-WIN32, the following defaults are use:
6464

65-
PREFIX: %ProgramFiles(86)%\OpenSSL
66-
OPENSSLDIR: %CommonProgramFiles(86)%\SSL
65+
PREFIX: %ProgramFiles(x86)%\OpenSSL
66+
OPENSSLDIR: %CommonProgramFiles(x86)%\SSL
6767

6868
For VC-WIN64, the following defaults are use:
6969

0 commit comments

Comments
 (0)
X Tutup