Skip to content

Commit 0e37c99

Browse files
hassaanphassaanp
committed
deps: upgrade openssl sources to 1.1.1k+quic
This updates all sources in deps/openssl/openssl by: $ git clone https://github.com/quictls/openssl $ cd openssl $ git checkout OpenSSL_1_1_1k+quic $ cd ../node/deps/openssl $ rm -rf openssl $ cp -R ../openssl openssl $ git add --all openssl $ git commit openssl
1 parent d1e2184 commit 0e37c99

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

46 files changed

+802
-208
lines changed

‎deps/openssl/openssl/.gitattributes

+12
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
*.der binary
2+
/fuzz/corpora/** binary
3+
*.pfx binary
4+
5+
# For git archive
6+
fuzz/corpora/** export-ignore
7+
Configurations/*.norelease.conf export-ignore
8+
.* export-ignore
9+
util/mktar.sh export-ignore
10+
boringssl export-ignore
11+
krb5 export-ignore
12+
pyca-cryptography export-ignore

‎deps/openssl/openssl/.github/PULL_REQUEST_TEMPLATE.md

+14
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
<!--
2+
Thank you for your pull request. Please review these requirements:
3+
4+
Contributors guide: https://github.com/openssl/openssl/blob/master/CONTRIBUTING
5+
6+
Other than that, provide a description above this comment if there isn't one already
7+
8+
If this fixes a github issue, make sure to have a line saying 'Fixes #XXXX' (without quotes) in the commit message.
9+
-->
10+
11+
##### Checklist
12+
<!-- Remove items that do not apply. For completed items, change [ ] to [x]. -->
13+
- [ ] documentation is added or updated
14+
- [ ] tests are added or updated

‎deps/openssl/openssl/.github/workflows/ci.yml

+147
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,147 @@
1+
name: GitHub CI
2+
3+
on: [pull_request, push]
4+
5+
# for some reason, this does not work:
6+
# variables:
7+
# BUILDOPTS: "-j4"
8+
9+
# not implemented for v1.1.1: HARNESS_JOBS: "${HARNESS_JOBS:-4}"
10+
11+
# for some reason, this does not work:
12+
# before_script:
13+
# - make="make -s"
14+
15+
jobs:
16+
check_update:
17+
runs-on: ubuntu-latest
18+
steps:
19+
- uses: actions/checkout@v2
20+
- name: config
21+
run: ./config --strict-warnings && perl configdata.pm --dump
22+
- name: make build_generated
23+
run: make -s build_generated
24+
- name: make update
25+
run: make -s update
26+
- name: git diff
27+
run: git diff --exit-code
28+
29+
check_docs:
30+
runs-on: ubuntu-latest
31+
steps:
32+
- uses: actions/checkout@v2
33+
- name: config
34+
run: ./config --strict-warnings && perl configdata.pm --dump
35+
- name: make build_generated
36+
run: make -s build_generated
37+
- name: make doc-nits
38+
run: make doc-nits
39+
40+
basic_gcc:
41+
runs-on: ubuntu-latest
42+
steps:
43+
- uses: actions/checkout@v2
44+
- name: config
45+
run: ./config --strict-warnings && perl configdata.pm --dump
46+
- name: make
47+
run: make -s -j4
48+
- name: make test
49+
run: make test
50+
51+
basic_clang:
52+
runs-on: ubuntu-latest
53+
steps:
54+
- uses: actions/checkout@v2
55+
- name: config
56+
run: CC=clang ./config --strict-warnings && perl configdata.pm --dump
57+
- name: make
58+
run: make -s -j4
59+
- name: make test
60+
run: make test
61+
62+
minimal:
63+
runs-on: ubuntu-latest
64+
steps:
65+
- uses: actions/checkout@v2
66+
- name: config
67+
run: ./config --strict-warnings no-shared no-dso no-pic no-aria no-async no-autoload-config no-blake2 no-bf no-camellia no-cast no-chacha no-cmac no-cms no-comp no-ct no-des no-dgram no-dh no-dsa no-dtls no-ec2m no-engine no-filenames no-gost no-idea no-mdc2 no-md4 no-multiblock no-nextprotoneg no-ocsp no-ocb no-poly1305 no-psk no-rc2 no-rc4 no-rmd160 no-seed no-siphash no-sm2 no-sm3 no-sm4 no-srp no-srtp no-ssl3 no-ssl3-method no-ts no-ui-console no-whirlpool no-asm -DOPENSSL_NO_SECURE_MEMORY -DOPENSSL_SMALL_FOOTPRINT && perl configdata.pm --dump
68+
- name: make
69+
run: make -s -j4
70+
- name: make test
71+
run: make test
72+
73+
out-of-tree_build:
74+
runs-on: ubuntu-latest
75+
steps:
76+
- uses: actions/checkout@v2
77+
- name: setup build dir
78+
run: |
79+
set -eux
80+
mkdir -p ${myblddir:=../_build/nest/a/little/more}
81+
echo "mysrcdir=$(realpath .)" | tee -a $GITHUB_ENV
82+
echo "myblddir=$(realpath $myblddir)" | tee -a $GITHUB_ENV
83+
- name: config
84+
run: set -eux ; cd ${{ env.myblddir }} && ${{ env.mysrcdir }}/config --strict-warnings && perl configdata.pm --dump
85+
- name: make build_generated
86+
run: set -eux; cd ${{ env.myblddir }} && make -s build_generated
87+
- name: make update
88+
run: set -eux; cd ${{ env.myblddir }} && make update
89+
- name: make
90+
run: set -eux; cd ${{ env.myblddir }} && make -s -j4
91+
- name: make test (minimal subset)
92+
run: set -eux; cd ${{ env.myblddir }} && make test TESTS='0[0-9]'
93+
94+
no-deprecated:
95+
runs-on: ubuntu-latest
96+
steps:
97+
- uses: actions/checkout@v2
98+
- name: config
99+
run: ./config --strict-warnings no-deprecated && perl configdata.pm --dump
100+
- name: make
101+
run: make -s -j4
102+
- name: make test
103+
run: make test
104+
105+
sanitizers:
106+
runs-on: ubuntu-latest
107+
steps:
108+
- uses: actions/checkout@v2
109+
- name: config
110+
run: ./config --debug enable-asan enable-ubsan enable-rc5 enable-md2 enable-ec_nistp_64_gcc_128 && perl configdata.pm --dump
111+
- name: make
112+
run: make -s -j4
113+
- name: make test
114+
run: make test OPENSSL_TEST_RAND_ORDER=0
115+
116+
enable_non-default_options:
117+
runs-on: ubuntu-latest
118+
steps:
119+
- uses: actions/checkout@v2
120+
- name: config
121+
run: ./config --strict-warnings no-ec enable-ssl-trace enable-zlib enable-zlib-dynamic enable-crypto-mdebug enable-crypto-mdebug-backtrace enable-egd && perl configdata.pm --dump
122+
- name: make
123+
run: make -s -j4
124+
- name: make test
125+
run: make test
126+
127+
legacy:
128+
runs-on: ubuntu-latest
129+
steps:
130+
- uses: actions/checkout@v2
131+
- name: config
132+
run: ./config -Werror --debug no-afalgeng no-shared enable-crypto-mdebug enable-rc5 enable-md2 enable-ssl3 enable-ssl3-method enable-weak-ssl-ciphers enable-zlib enable-ec_nistp_64_gcc_128 && perl configdata.pm --dump
133+
- name: make
134+
run: make -s -j4
135+
- name: make test
136+
run: make test
137+
138+
buildtest:
139+
runs-on: ubuntu-latest
140+
steps:
141+
- uses: actions/checkout@v2
142+
- name: config
143+
run: ./config no-makedepend enable-buildtest-c++ --strict-warnings -D_DEFAULT_SOURCE && perl configdata.pm --dump
144+
- name: make
145+
run: make -s -j4
146+
- name: make test
147+
run: make test

‎deps/openssl/openssl/.gitmodules

+11
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
[submodule "boringssl"]
2+
path = boringssl
3+
url = https://boringssl.googlesource.com/boringssl
4+
5+
[submodule "pyca.cryptography"]
6+
path = pyca-cryptography
7+
url = https://github.com/pyca/cryptography.git
8+
9+
[submodule "krb5"]
10+
path = krb5
11+
url = https://github.com/krb5/krb5

‎deps/openssl/openssl/.travis-apt-pin.preferences

+15
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
Package: clang-3.9
2+
Pin: release o=Ubuntu
3+
Pin-Priority: -1
4+
5+
Package: libclang-common-3.9-dev
6+
Pin: release o=Ubuntu
7+
Pin-Priority: -1
8+
9+
Package: libclang1-3.9
10+
Pin: release o=Ubuntu
11+
Pin-Priority: -1
12+
13+
Package: libllvm3.9v4
14+
Pin: release o=Ubuntu
15+
Pin-Priority: -1

‎deps/openssl/openssl/.travis-create-release.sh

+3
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
#! /bin/sh
2+
3+
./util/mktar.sh --name=_srcdist

‎deps/openssl/openssl/CHANGES

+44
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,50 @@
77
https://github.com/openssl/openssl/commits/ and pick the appropriate
88
release branch.
99

10+
Changes between 1.1.1j and 1.1.1k [25 Mar 2021]
11+
12+
*) Fixed a problem with verifying a certificate chain when using the
13+
X509_V_FLAG_X509_STRICT flag. This flag enables additional security checks
14+
of the certificates present in a certificate chain. It is not set by
15+
default.
16+
17+
Starting from OpenSSL version 1.1.1h a check to disallow certificates in
18+
the chain that have explicitly encoded elliptic curve parameters was added
19+
as an additional strict check.
20+
21+
An error in the implementation of this check meant that the result of a
22+
previous check to confirm that certificates in the chain are valid CA
23+
certificates was overwritten. This effectively bypasses the check
24+
that non-CA certificates must not be able to issue other certificates.
25+
26+
If a "purpose" has been configured then there is a subsequent opportunity
27+
for checks that the certificate is a valid CA. All of the named "purpose"
28+
values implemented in libcrypto perform this check. Therefore, where
29+
a purpose is set the certificate chain will still be rejected even when the
30+
strict flag has been used. A purpose is set by default in libssl client and
31+
server certificate verification routines, but it can be overridden or
32+
removed by an application.
33+
34+
In order to be affected, an application must explicitly set the
35+
X509_V_FLAG_X509_STRICT verification flag and either not set a purpose
36+
for the certificate verification or, in the case of TLS client or server
37+
applications, override the default purpose.
38+
(CVE-2021-3450)
39+
[Tomáš Mráz]
40+
41+
*) Fixed an issue where an OpenSSL TLS server may crash if sent a maliciously
42+
crafted renegotiation ClientHello message from a client. If a TLSv1.2
43+
renegotiation ClientHello omits the signature_algorithms extension (where
44+
it was present in the initial ClientHello), but includes a
45+
signature_algorithms_cert extension then a NULL pointer dereference will
46+
result, leading to a crash and a denial of service attack.
47+
48+
A server is only vulnerable if it has TLSv1.2 and renegotiation enabled
49+
(which is the default configuration). OpenSSL TLS clients are not impacted
50+
by this issue.
51+
(CVE-2021-3449)
52+
[Peter Kästle and Samuel Sapalski]
53+
1054
Changes between 1.1.1i and 1.1.1j [16 Feb 2021]
1155

1256
*) Fixed the X509_issuer_and_serial_hash() function. It attempts to

‎deps/openssl/openssl/Configurations/unix-Makefile.tmpl

+2-2
Original file line numberDiff line numberDiff line change
@@ -917,8 +917,8 @@ errors:
917917
done )
918918

919919
ordinals:
920-
( b=`pwd`; cd $(SRCDIR); $(PERL) -I$$b util/mkdef.pl crypto update )
921-
( b=`pwd`; cd $(SRCDIR); $(PERL) -I$$b util/mkdef.pl ssl update )
920+
$(PERL) $(SRCDIR)/util/mkdef.pl crypto update
921+
$(PERL) $(SRCDIR)/util/mkdef.pl ssl update
922922

923923
test_ordinals:
924924
( cd test; \

‎deps/openssl/openssl/NEWS

+8
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,14 @@
55
This file gives a brief overview of the major changes between each OpenSSL
66
release. For more details please read the CHANGES file.
77

8+
Major changes between OpenSSL 1.1.1j and OpenSSL 1.1.1k [25 Mar 2021]
9+
10+
o Fixed a problem with verifying a certificate chain when using the
11+
X509_V_FLAG_X509_STRICT flag (CVE-2021-3450)
12+
o Fixed an issue where an OpenSSL TLS server may crash if sent a
13+
maliciously crafted renegotiation ClientHello message from a client
14+
(CVE-2021-3449)
15+
816
Major changes between OpenSSL 1.1.1i and OpenSSL 1.1.1j [16 Feb 2021]
917

1018
o Fixed a NULL pointer deref in the X509_issuer_and_serial_hash()

‎deps/openssl/openssl/README

-93
This file was deleted.

‎deps/openssl/openssl/README-OpenSSL.md

+2-2
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11

2-
OpenSSL 1.1.1j 16 Feb 2021
2+
OpenSSL 1.1.1k 25 Mar 2021
33

4-
Copyright (c) 1998-2020 The OpenSSL Project
4+
Copyright (c) 1998-2021 The OpenSSL Project
55
Copyright (c) 1995-1998 Eric A. Young, Tim J. Hudson
66
All rights reserved.
77

‎deps/openssl/openssl/README.md

+1-1
Original file line numberDiff line numberDiff line change
@@ -47,7 +47,7 @@ How are you keeping current with OpenSSL?
4747
-----------------------------------------
4848
(In other words, "What about rebasing?")
4949

50-
Our plan it to always rebase on top of an upstream release tag. In particular:
50+
Our plan is to always rebase on top of an upstream release tag. In particular:
5151
- The changes for QUIC will always be at the tip of the branch -- you will know what
5252
is from the original OpenSSL and what is for QUIC.
5353
- New versions are quickly created once upstream creates a new tag.

0 commit comments

Comments
 (0)