Skip to content

Commit

Permalink
deps: upgrade openssl sources to quictls/openssl-3.0.2+quic
Browse files Browse the repository at this point in the history
This updates all sources in deps/openssl/openssl by:
    $ git clone [email protected]:quictls/openssl.git
    $ cd openssl
    $ cd ../node/deps/openssl
    $ rm -rf openssl
    $ cp -R ../openssl openssl
    $ rm -rf openssl/.git* openssl/.travis*
    $ git add --all openssl
    $ git commit openssl

PR-URL: nodejs#42356
Refs: https://mta.openssl.org/pipermail/openssl-announce/2022-March/000217.html
Reviewed-By: Richard Lau <[email protected]>
Reviewed-By: Antoine du Hamel <[email protected]>
Reviewed-By: Darshan Sen <[email protected]>
Reviewed-By: Tobias Nießen <[email protected]>
Reviewed-By: Michael Dawson <[email protected]>
  • Loading branch information
hassaanp authored and xtx1130 committed Apr 25, 2022
1 parent f8527a3 commit 4e089c6
Show file tree
Hide file tree
Showing 301 changed files with 5,458 additions and 1,187 deletions.
58 changes: 57 additions & 1 deletion deps/openssl/openssl/CHANGES.md
Original file line number Diff line number Diff line change
Expand Up @@ -28,12 +28,68 @@ breaking changes, and mappings for the large list of deprecated functions.

[Migration guide]: https://github.com/openssl/openssl/tree/master/doc/man7/migration_guide.pod

### Changes between 3.0.0 and 3.0.0+quic [7 Sun 2021]
### Changes between 3.0.2 and 3.0.2+quic [15 Mar 2022]

* Add QUIC API support from BoringSSL.

*Todd Short*

### Changes between 3.0.1 and 3.0.2 [15 Mar 2022]

* Fixed a bug in the BN_mod_sqrt() function that can cause it to loop forever
for non-prime moduli.

Internally this function is used when parsing certificates that contain
elliptic curve public keys in compressed form or explicit elliptic curve
parameters with a base point encoded in compressed form.

It is possible to trigger the infinite loop by crafting a certificate that
has invalid explicit curve parameters.

Since certificate parsing happens prior to verification of the certificate
signature, any process that parses an externally supplied certificate may thus
be subject to a denial of service attack. The infinite loop can also be
reached when parsing crafted private keys as they can contain explicit
elliptic curve parameters.

Thus vulnerable situations include:

- TLS clients consuming server certificates
- TLS servers consuming client certificates
- Hosting providers taking certificates or private keys from customers
- Certificate authorities parsing certification requests from subscribers
- Anything else which parses ASN.1 elliptic curve parameters

Also any other applications that use the BN_mod_sqrt() where the attacker
can control the parameter values are vulnerable to this DoS issue.
([CVE-2022-0778])

*Tomáš Mráz*

* Add ciphersuites based on DHE_PSK (RFC 4279) and ECDHE_PSK (RFC 5489)
to the list of ciphersuites providing Perfect Forward Secrecy as
required by SECLEVEL >= 3.

*Dmitry Belyavskiy, Nicola Tuveri*

* Made the AES constant time code for no-asm configurations
optional due to the resulting 95% performance degradation.
The AES constant time code can be enabled, for no assembly
builds, with: ./config no-asm -DOPENSSL_AES_CONST_TIME

*Paul Dale*

* Fixed PEM_write_bio_PKCS8PrivateKey() to make it possible to use empty
passphrase strings.

*Darshan Sen*

* The negative return value handling of the certificate verification callback
was reverted. The replacement is to set the verification retry state with
the SSL_set_retry_verify() function.

*Tomáš Mráz*

### Changes between 3.0.0 and 3.0.1 [14 Dec 2021]

* Fixed invalid handling of X509_verify_cert() internal errors in libssl
Expand Down
7 changes: 7 additions & 0 deletions deps/openssl/openssl/Configurations/10-main.conf
Original file line number Diff line number Diff line change
Expand Up @@ -1062,6 +1062,13 @@ my %targets = (
perlasm_scheme => "elf",
},

# riscv64 below refers to contemporary RISCV Architecture
# specifications,
"BSD-riscv64" => {
inherit_from => [ "BSD-generic64"],
perlasm_scheme => "linux64",
},

"bsdi-elf-gcc" => {
inherit_from => [ "BASE_unix" ],
CC => "gcc",
Expand Down
1 change: 1 addition & 0 deletions deps/openssl/openssl/Configurations/15-android.conf
Original file line number Diff line number Diff line change
Expand Up @@ -261,6 +261,7 @@ my %targets = (
bn_ops => add("RC4_INT"),
asm_arch => 'x86',
perlasm_scheme => "android",
ex_libs => add(threads("-latomic")),
},
"android-x86_64" => {
inherit_from => [ "android" ],
Expand Down
73 changes: 70 additions & 3 deletions deps/openssl/openssl/Configurations/descrip.mms.tmpl
Original file line number Diff line number Diff line change
Expand Up @@ -553,7 +553,6 @@ distclean : clean
- DELETE descrip.mms;*

depend : descrip.mms
descrip.mms : FORCE
@ ! {- output_off() if $disabled{makedepend}; "" -}
@ $(PERL) {- sourcefile("util", "add-depends.pl") -} "{- $config{makedep_scheme} -}"
@ ! {- output_on() if $disabled{makedepend}; "" -}
Expand Down Expand Up @@ -755,7 +754,16 @@ debug_logicals :

# Building targets ###################################################

configdata.pm : $(SRCDIR)Configure $(SRCDIR)config.com {- join(" ", @{$config{build_file_templates}}, @{$config{build_infos}}, @{$config{conf_files}}) -}
descrip.mms : configdata.pm {- join(" ", @{$config{build_file_templates}}) -}
perl configdata.pm
@ WRITE SYS$OUTPUT "*************************************************"
@ WRITE SYS$OUTPUT "*** ***"
@ WRITE SYS$OUTPUT "*** Please run the same mms command again ***"
@ WRITE SYS$OUTPUT "*** ***"
@ WRITE SYS$OUTPUT "*************************************************"
@ PIPE ( EXIT %X10000000 )

configdata.pm : $(SRCDIR)Configure $(SRCDIR)config.com {- join(" ", @{$config{build_infos}}, @{$config{conf_files}}) -}
perl configdata.pm -r
@ WRITE SYS$OUTPUT "*************************************************"
@ WRITE SYS$OUTPUT "*** ***"
Expand Down Expand Up @@ -871,6 +879,59 @@ EOF
return ($filename, $scripture);
}

# On VMS, (some) header file directories include the files
# __DECC_INCLUDE_EPILOGUE.H and __DECC_INCLUDE_PROLOGUE.H.
# When header files are generated, and the build directory
# isn't the same as the source directory, these files must
# be copied alongside the generated header file, or their
# effect will be lost.
# We use the same include file cache as make_includefile
# to check if the scripture to copy these files has already
# been generated.
sub make_decc_include_files {
my $outd = shift;
my $ind = shift;

# If the build directory and the source directory are the
# same, there's no need to copy the prologue and epilogue
# files.
return ('') if $outd eq $ind;

my $outprologue = catfile($outd, '__DECC_INCLUDE_PROLOGUE.H');
my $outepilogue = catfile($outd, '__DECC_INCLUDE_EPILOGUE.H');
my $inprologue = catfile($ind, '__DECC_INCLUDE_PROLOGUE.H');
my $inepilogue = catfile($ind, '__DECC_INCLUDE_EPILOGUE.H');
my @filenames = ();
my $scripture = '';

if ($includefile_cache{$outprologue}) {
push @filenames, $outprologue;
} elsif (-f $inprologue) {
my $local_scripture .= <<"EOF";
$outprologue : $inprologue
COPY $inprologue $outprologue
EOF
$includefile_cache{$outprologue} = $local_scripture;

push @filenames, $outprologue;
$scripture .= $local_scripture;
}
if ($includefile_cache{$outepilogue}) {
push @filenames, $outepilogue;
} elsif (-f $inepilogue) {
my $local_scripture .= <<"EOF";
$outepilogue : $inepilogue
COPY $inepilogue $outepilogue
EOF
$includefile_cache{$outepilogue} = $local_scripture;

push @filenames, $outepilogue;
$scripture .= $local_scripture;
}

return (@filenames, $scripture);
}

sub generatetarget {
my %args = @_;
my $deps = join(" ", compute_platform_depends(@{$args{deps}}));
Expand Down Expand Up @@ -984,12 +1045,18 @@ EOF
my @perlmodules = ( 'configdata.pm',
grep { $_ =~ m|\.pm$| } @{$args{deps}} );
my %perlmoduleincs = map { '"-I'.dirname($_).'"' => 1 } @perlmodules;
$deps = join(' ', $deps, compute_platform_depends(@perlmodules));
my @decc_include_data
= make_decc_include_files(dirname($args{src}), dirname($gen0));
my $decc_include_scripture = pop @decc_include_data;
$deps = join(' ', $deps, @decc_include_data,
compute_platform_depends(@perlmodules));
@perlmodules = map { '"-M'.basename($_, '.pm').'"' } @perlmodules;
my $perlmodules = join(' ', '', sort keys %perlmoduleincs, @perlmodules);

return <<"EOF";
$args{src} : $gen0 $deps
\$(PERL)$perlmodules $dofile "-o$target{build_file}" $gen0$gen_args > \$\@
$decc_include_scripture
EOF
} elsif (grep { $_ eq $gen0 } @{$unified_info{programs}}) {
#
Expand Down
27 changes: 20 additions & 7 deletions deps/openssl/openssl/Configurations/unix-Makefile.tmpl
Original file line number Diff line number Diff line change
Expand Up @@ -582,7 +582,7 @@ clean: libclean
$(RM) $(MANDOCS3)
$(RM) $(MANDOCS5)
$(RM) $(MANDOCS7)
$(RM) $(PROGRAMS) $(TESTPROGS) $(MODULES) $(SCRIPTS)
$(RM) $(PROGRAMS) $(TESTPROGS) $(MODULES) $(FIPSMODULE) $(SCRIPTS)
$(RM) $(GENERATED_MANDATORY) $(GENERATED)
-find . -name '*{- platform->depext() -}' \! -name '.*' \! -type d -exec $(RM) {} \;
-find . -name '*{- platform->objext() -}' \! -name '.*' \! -type d -exec $(RM) {} \;
Expand All @@ -599,7 +599,7 @@ distclean: clean

# We check if any depfile is newer than Makefile and decide to
# concatenate only if that is true.
depend:
depend: Makefile
@: {- output_off() if $disabled{makedepend}; "" -}
@$(PERL) $(SRCDIR)/util/add-depends.pl "{- $makedep_scheme -}"
@: {- output_on() if $disabled{makedepend}; "" -}
Expand Down Expand Up @@ -1153,7 +1153,7 @@ generate_crypto_objects:
crypto/objects/obj_mac.num \
crypto/objects/obj_xref.txt \
> crypto/objects/obj_xref.h )
( cd $(SRCDIR); cat crypto/objects/obj_compat.h >> include/openssl/obj_mac.h )
( cd $(SRCDIR); sed -e '1,8d' crypto/objects/obj_compat.h >> include/openssl/obj_mac.h )

generate_crypto_conf:
( cd $(SRCDIR); $(PERL) crypto/conf/keysets.pl \
Expand Down Expand Up @@ -1371,13 +1371,13 @@ tar:

link-utils: $(BLDDIR)/util/opensslwrap.sh $(BLDDIR)/apps/openssl.cnf

$(BLDDIR)/util/opensslwrap.sh: configdata.pm
$(BLDDIR)/util/opensslwrap.sh: Makefile
@if [ "$(SRCDIR)" != "$(BLDDIR)" ]; then \
mkdir -p "$(BLDDIR)/util"; \
ln -sf "../$(SRCDIR)/util/`basename "$@"`" "$(BLDDIR)/util"; \
fi

$(BLDDIR)/apps/openssl.cnf: configdata.pm
$(BLDDIR)/apps/openssl.cnf: Makefile
@if [ "$(SRCDIR)" != "$(BLDDIR)" ]; then \
mkdir -p "$(BLDDIR)/apps"; \
ln -sf "../$(SRCDIR)/apps/`basename "$@"`" "$(BLDDIR)/apps"; \
Expand All @@ -1387,7 +1387,8 @@ FORCE:

# Building targets ###################################################

libcrypto.pc libssl.pc openssl.pc: configdata.pm $(LIBS) {- join(" ",map { platform->sharedlib_simple($_) // platform->sharedlib_import($_) // platform->sharedlib($_) // () } @{$unified_info{libraries}}) -}
libcrypto.pc libssl.pc openssl.pc: Makefile $(LIBS) {- join(" ",map { platform->sharedlib_simple($_) // platform->sharedlib_import($_) // platform->sharedlib($_) // () } @{$unified_info{libraries}}) -}

libcrypto.pc:
@ ( echo 'prefix=$(INSTALLTOP)'; \
echo 'exec_prefix=$${prefix}'; \
Expand Down Expand Up @@ -1438,10 +1439,22 @@ openssl.pc:
echo 'Version: '$(VERSION); \
echo 'Requires: libssl libcrypto' ) > openssl.pc

Makefile: configdata.pm \
{- join(" \\\n" . ' ' x 10,
fill_lines(" ", $COLUMNS - 10,
@{$config{build_file_templates}})) -}
@echo "Detected changed: $?"
$(PERL) configdata.pm
@echo "**************************************************"
@echo "*** ***"
@echo "*** Please run the same make command again ***"
@echo "*** ***"
@echo "**************************************************"
@false

configdata.pm: $(SRCDIR)/Configure $(SRCDIR)/config \
{- join(" \\\n" . ' ' x 15,
fill_lines(" ", $COLUMNS - 15,
@{$config{build_file_templates}},
@{$config{build_infos}},
@{$config{conf_files}})) -}
@echo "Detected changed: $?"
Expand Down
16 changes: 13 additions & 3 deletions deps/openssl/openssl/Configurations/windows-makefile.tmpl
Original file line number Diff line number Diff line change
Expand Up @@ -481,7 +481,7 @@ distclean: clean
-del /Q /F configdata.pm
-del /Q /F makefile

depend:
depend: makefile
@ {- output_off() if $disabled{makedepend}; "\@rem" -}
@ "$(PERL)" "$(SRCDIR)\util\add-depends.pl" "{- $target{makedep_scheme} -}"
@ {- output_on() if $disabled{makedepend}; "\@rem" -}
Expand Down Expand Up @@ -643,13 +643,23 @@ uninstall_image_docs:

copy-utils: $(BLDDIR)\apps\openssl.cnf

$(BLDDIR)\apps\openssl.cnf: configdata.pm
$(BLDDIR)\apps\openssl.cnf: makefile
@if NOT EXIST "$(BLDDIR)\apps" mkdir "$(BLDDIR)\apps"
@if NOT "$(SRCDIR)"=="$(BLDDIR)" copy "$(SRCDIR)\apps\$(@F)" "$(BLDDIR)\apps"

# Building targets ###################################################

configdata.pm: "$(SRCDIR)\Configure" {- join(" ", map { '"'.$_.'"' } @{$config{build_file_templates}}, @{$config{build_infos}}, @{$config{conf_files}}) -}
makefile: configdata.pm {- join(" ", map { '"'.$_.'"' } @{$config{build_file_templates}}) -}
@$(ECHO) "Detected changed: $?"
"$(PERL)" configdata.pm
@$(ECHO) "**************************************************"
@$(ECHO) "*** ***"
@$(ECHO) "*** Please run the same make command again ***"
@$(ECHO) "*** ***"
@$(ECHO) "**************************************************"
@exit 1

configdata.pm: "$(SRCDIR)\Configure" {- join(" ", map { '"'.$_.'"' } @{$config{build_infos}}, @{$config{conf_files}}) -}
@$(ECHO) "Detected changed: $?"
"$(PERL)" configdata.pm -r
@$(ECHO) "**************************************************"
Expand Down
22 changes: 11 additions & 11 deletions deps/openssl/openssl/Configure
Original file line number Diff line number Diff line change
Expand Up @@ -3172,25 +3172,25 @@ sub resolve_config {
}
}

foreach (sort keys %all_keys) {
my $previous = $combined_inheritance{$_};
foreach my $key (sort keys %all_keys) {
my $previous = $combined_inheritance{$key};

# Current target doesn't have a value for the current key?
# Assign it the default combiner, the rest of this loop body
# will handle it just like any other coderef.
if (!exists $table{$target}->{$_}) {
$table{$target}->{$_} = $default_combiner;
if (!exists $table{$target}->{$key}) {
$table{$target}->{$key} = $default_combiner;
}

$table{$target}->{$_} = process_values($table{$target}->{$_},
$combined_inheritance{$_},
$target, $_);
unless(defined($table{$target}->{$_})) {
delete $table{$target}->{$_};
$table{$target}->{$key} = process_values($table{$target}->{$key},
$combined_inheritance{$key},
$target, $key);
unless(defined($table{$target}->{$key})) {
delete $table{$target}->{$key};
}
# if ($extra_checks &&
# $previous && !($add_called || $previous ~~ $table{$target}->{$_})) {
# warn "$_ got replaced in $target\n";
# $previous && !($add_called || $previous ~~ $table{$target}->{$key})) {
# warn "$key got replaced in $target\n";
# }
}

Expand Down
5 changes: 5 additions & 0 deletions deps/openssl/openssl/NEWS.md
Original file line number Diff line number Diff line change
Expand Up @@ -18,6 +18,11 @@ OpenSSL Releases
OpenSSL 3.0
-----------

### Major changes between OpenSSL 3.0.1 and OpenSSL 3.0.2 [15 Mar 2022]

* Fixed a bug in the BN_mod_sqrt() function that can cause it to loop forever
for non-prime moduli ([CVE-2022-0778])

### Major changes between OpenSSL 3.0.0 and OpenSSL 3.0.1 [14 Dec 2021]

* Fixed invalid handling of X509_verify_cert() internal errors in libssl
Expand Down
2 changes: 1 addition & 1 deletion deps/openssl/openssl/README-FIPS.md
Original file line number Diff line number Diff line change
Expand Up @@ -64,4 +64,4 @@ Using the FIPS Module in applications
Documentation about using the FIPS module is available on the [fips_module(7)]
manual page.

[fips_module(7)]: https://www.openssl.org/docs/manmaster/man7/fips_module.html
[fips_module(7)]: https://www.openssl.org/docs/man3.0/man7/fips_module.html
Loading

0 comments on commit 4e089c6

Please sign in to comment.