Skip to content

Commit 553246c

Browse files
richardlaurichardlau
committed
deps: upgrade openssl sources to OpenSSL_1_1_1m+quic
This updates all sources in deps/openssl/openssl by: $ git clone https://github.com/quictls/openssl $ cd openssl $ git checkout OpenSSL_1_1_1m+quic $ cd ../node/deps/openssl $ rm -rf openssl $ cp -R ../openssl openssl $ rm -rf openssl/.git* openssl/.travis* $ git add --all openssl $ git commit openssl PR-URL: #41175 Refs: quictls/openssl#68 Refs: https://mta.openssl.org/pipermail/openssl-announce/2021-December/000212.html Reviewed-By: Tobias Nießen <[email protected]> Reviewed-By: Matteo Collina <[email protected]> Reviewed-By: Derek Lewis <[email protected]> Reviewed-By: Michael Dawson <[email protected]>
1 parent 2c84c3e commit 553246c

102 files changed

Lines changed: 1279 additions & 353 deletions

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎deps/openssl/openssl/CHANGES‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,26 @@
77
https://github.com/openssl/openssl/commits/ and pick the appropriate
88
release branch.
99

10+
Changes between 1.1.1l and 1.1.1m [14 Dec 2021]
11+
12+
*) Avoid loading of a dynamic engine twice.
13+
14+
[Bernd Edlinger]
15+
16+
*) Fixed building on Debian with kfreebsd kernels
17+
18+
[Mattias Ellert]
19+
20+
*) Prioritise DANE TLSA issuer certs over peer certs
21+
22+
[Viktor Dukhovni]
23+
24+
*) Fixed random API for MacOS prior to 10.12
25+
26+
These MacOS versions don't support the CommonCrypto APIs
27+
28+
[Lenny Primak]
29+
1030
Changes between 1.1.1k and 1.1.1l [24 Aug 2021]
1131

1232
*) Fixed an SM2 Decryption Buffer Overflow.

‎deps/openssl/openssl/Configure‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -486,7 +486,7 @@ my @disable_cascades = (
486486
"ssl3-method" => [ "ssl3" ],
487487
"zlib" => [ "zlib-dynamic" ],
488488
"des" => [ "mdc2" ],
489-
"ec" => [ "ecdsa", "ecdh" ],
489+
"ec" => [ "ecdsa", "ecdh", "quic" ],
490490

491491
"dgram" => [ "dtls", "sctp" ],
492492
"sock" => [ "dgram" ],
@@ -1307,16 +1307,19 @@ if ($disabled{"dynamic-engine"}) {
13071307

13081308
unless ($disabled{asan}) {
13091309
push @{$config{cflags}}, "-fsanitize=address";
1310+
push @{$config{cxxflags}}, "-fsanitize=address" if $config{CXX};
13101311
}
13111312

13121313
unless ($disabled{ubsan}) {
13131314
# -DPEDANTIC or -fnosanitize=alignment may also be required on some
13141315
# platforms.
13151316
push @{$config{cflags}}, "-fsanitize=undefined", "-fno-sanitize-recover=all";
1317+
push @{$config{cxxflags}}, "-fsanitize=undefined", "-fno-sanitize-recover=all" if $config{CXX};
13161318
}
13171319

13181320
unless ($disabled{msan}) {
13191321
push @{$config{cflags}}, "-fsanitize=memory";
1322+
push @{$config{cxxflags}}, "-fsanitize=memory" if $config{CXX};
13201323
}
13211324

13221325
unless ($disabled{"fuzz-libfuzzer"} && $disabled{"fuzz-afl"}

‎deps/openssl/openssl/NEWS‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,10 @@
55
This file gives a brief overview of the major changes between each OpenSSL
66
release. For more details please read the CHANGES file.
77

8+
Major changes between OpenSSL 1.1.1l and OpenSSL 1.1.1m [14 Dec 2021]
9+
10+
o None
11+
812
Major changes between OpenSSL 1.1.1k and OpenSSL 1.1.1l [24 Aug 2021]
913

1014
o Fixed an SM2 Decryption Buffer Overflow (CVE-2021-3711)

‎deps/openssl/openssl/README-OpenSSL.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11

2-
OpenSSL 1.1.1l 24 Aug 2021
2+
OpenSSL 1.1.1m 14 Dec 2021
33

44
Copyright (c) 1998-2021 The OpenSSL Project
55
Copyright (c) 1995-1998 Eric A. Young, Tim J. Hudson

‎deps/openssl/openssl/README.md‎

Lines changed: 19 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -1,29 +1,31 @@
11
What This Is
22
============
33

4-
This is a fork of [OpenSSL](https://www.openssl.org) to enable QUIC. In addition to the
5-
website, the official source distribution is at https://github.com/openssl/openssl.
6-
The OpenSSL `README` can be found at [README-OpenSSL.md](README-OpenSSL.md).
4+
This is a fork of [OpenSSL](https://www.openssl.org) to enable QUIC. In addition
5+
to the website, the official source distribution is at
6+
<https://github.com/openssl/openssl>. The OpenSSL `README` can be found at
7+
[README-OpenSSL.md](https://github.com/quictls/openssl/blob/OpenSSL_1_1_1m%2Bquic/README-OpenSSL.md).
78

8-
This fork adds API that can be used by QUIC implementations for connection
9+
This fork adds APIs that can be used by QUIC implementations for connection
910
handshakes. Quoting the IETF Working group
1011
[charter](https://datatracker.ietf.org/wg/quic/about/), QUIC is a "UDP-based,
1112
stream-multiplexing, encrypted transport protocol." If you don't need QUIC, you
1213
should use the official OpenSSL distributions.
1314

14-
This API's here are used by Microsoft's
15+
The APIs here are used by Microsoft's
1516
[MsQuic](https://github.com/microsoft/msquic) and Google's
1617
[Chromium QUIC](https://chromium.googlesource.com/chromium/src/+/master/net/quic/)
1718

1819
We are not in competition with OpenSSL project. We informed them of
1920
our plans to fork the code before we went public. We do not speak for the
2021
OpenSSL project, and can only point to a
21-
[blog post](https://www.openssl.org/blog/blog/2020/02/17/QUIC-and-OpenSSL/) that
22-
provides their view of QUIC support.
22+
[blog post](https://www.openssl.org/blog/blog/2020/02/17/QUIC-and-OpenSSL/) and
23+
[openssl-project email](https://github.com/quictls/openssl/discussions/54)
24+
that provides their view of QUIC support.
2325

2426
As stated in their blog post, the OpenSSL team is focused on their 3.0 release
25-
which is still in alpha, and does not intend to add QUIC functionality to 1.1.x.
26-
There is a community need for a QUIC capable TLS library. This fork is intended
27+
(released 2021-09-07), and does not intend to add QUIC functionality to 1.1.x.
28+
There is a community need for a QUIC-capable TLS library. This fork is intended
2729
as stopgap solution to enable higher level frameworks and runtimes to use QUIC
2830
with the proven and reliable TLS functionality from OpenSSL. This fork will be
2931
maintained until OpenSSL officially provides reasonable support for QUIC
@@ -40,8 +42,8 @@ What about branches?
4042
--------------------
4143
We don't want to conflict with OpenSSL branch names. Our current plan is to append
4244
`+quic`. Release tags are likely to be the QUIC branch with `-releaseX` appended.
43-
For example, the OpenSSL tag `openssl-3.0.0-alpha12` would have a branch named
44-
`openssl-3.0.0-alpha12+quic` and a release tag of `openssl-3.0.0-alpha12+quic-release1`
45+
For example, the OpenSSL tag `openssl-3.0.0` would have a branch named
46+
`openssl-3.0.0+quic` and a release tag of `openssl-3.0.0+quic-release1`.
4547

4648
How are you keeping current with OpenSSL?
4749
-----------------------------------------
@@ -60,13 +62,14 @@ What about library names?
6062
-------------------------
6163
Library names will be the same, but will use a different version number. The version
6264
numbers for the current OpenSSL libraries are `1.1` (for the 1.1.0 and 1.1.1 branches)
63-
and `3` (for the to-be-3.0 branch). We will be prefixing 81 (ASCII for 'Q') to
65+
and `3` (for the 3.0 branch). We will be prefixing `81` (ASCII for 'Q') to
6466
the version numbers to generate a unique version number.
6567

66-
```
67-
libcrypto.so.81.3 libcrypto.so.81.1.1 libcrypto.so.1.1 libcrypto.so.3
68-
libssl.so.81.3 libssl.so.81.1.1 libsslo.so.1.1 libssl.so.3
69-
```
68+
- `libcrypto.so.81.3` vs `libcrypto.so.3`
69+
- `libcrypto.so.81.1.1` vs `libcrypto.so.1.1`
70+
- `libssl.so.81.3` vs `libssl.so.3`
71+
- `libssl.so.81.1.1` vs `libssl.so.1.1`
72+
7073
The SONAME of these libraries are all different, guaranteeing the correct library
7174
will be used.
7275

‎deps/openssl/openssl/apps/ciphers.c‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright 1995-2018 The OpenSSL Project Authors. All Rights Reserved.
2+
* Copyright 1995-2021 The OpenSSL Project Authors. All Rights Reserved.
33
*
44
* Licensed under the OpenSSL license (the "License"). You may not use
55
* this file except in compliance with the License. You can obtain a copy
@@ -172,6 +172,7 @@ int ciphers_main(int argc, char **argv)
172172
if (convert != NULL) {
173173
BIO_printf(bio_out, "OpenSSL cipher name: %s\n",
174174
OPENSSL_cipher_name(convert));
175+
ret = 0;
175176
goto end;
176177
}
177178

‎deps/openssl/openssl/apps/dgst.c‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright 1995-2019 The OpenSSL Project Authors. All Rights Reserved.
2+
* Copyright 1995-2021 The OpenSSL Project Authors. All Rights Reserved.
33
*
44
* Licensed under the OpenSSL license (the "License"). You may not use
55
* this file except in compliance with the License. You can obtain a copy
@@ -316,7 +316,7 @@ int dgst_main(int argc, char **argv)
316316
EVP_MD_CTX *mctx = NULL;
317317
EVP_PKEY_CTX *pctx = NULL;
318318
int r;
319-
if (!BIO_get_md_ctx(bmd, &mctx)) {
319+
if (BIO_get_md_ctx(bmd, &mctx) <= 0) {
320320
BIO_printf(bio_err, "Error getting context\n");
321321
ERR_print_errors(bio_err);
322322
goto end;
@@ -345,7 +345,7 @@ int dgst_main(int argc, char **argv)
345345
/* we use md as a filter, reading from 'in' */
346346
else {
347347
EVP_MD_CTX *mctx = NULL;
348-
if (!BIO_get_md_ctx(bmd, &mctx)) {
348+
if (BIO_get_md_ctx(bmd, &mctx) <= 0) {
349349
BIO_printf(bio_err, "Error getting context\n");
350350
ERR_print_errors(bio_err);
351351
goto end;

‎deps/openssl/openssl/apps/s_cb.c‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -819,7 +819,9 @@ int generate_stateless_cookie_callback(SSL *ssl, unsigned char *cookie,
819819
{
820820
unsigned int temp;
821821
int res = generate_cookie_callback(ssl, cookie, &temp);
822-
*cookie_len = temp;
822+
823+
if (res != 0)
824+
*cookie_len = temp;
823825
return res;
824826
}
825827

‎deps/openssl/openssl/apps/s_client.c‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright 1995-2020 The OpenSSL Project Authors. All Rights Reserved.
2+
* Copyright 1995-2021 The OpenSSL Project Authors. All Rights Reserved.
33
* Copyright 2005 Nokia. All rights reserved.
44
*
55
* Licensed under the OpenSSL license (the "License"). You may not use
@@ -3151,6 +3151,8 @@ int s_client_main(int argc, char **argv)
31513151
#endif
31523152
OPENSSL_free(connectstr);
31533153
OPENSSL_free(bindstr);
3154+
OPENSSL_free(bindhost);
3155+
OPENSSL_free(bindport);
31543156
OPENSSL_free(host);
31553157
OPENSSL_free(port);
31563158
X509_VERIFY_PARAM_free(vpm);

‎deps/openssl/openssl/apps/s_server.c‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -134,12 +134,12 @@ static unsigned int psk_server_cb(SSL *ssl, const char *identity,
134134
if (s_debug)
135135
BIO_printf(bio_s_out, "psk_server_cb\n");
136136

137-
if (SSL_version(ssl) >= TLS1_3_VERSION) {
137+
if (!SSL_is_dtls(ssl) && SSL_version(ssl) >= TLS1_3_VERSION) {
138138
/*
139-
* This callback is designed for use in TLSv1.2. It is possible to use
140-
* a single callback for all protocol versions - but it is preferred to
141-
* use a dedicated callback for TLSv1.3. For TLSv1.3 we have
142-
* psk_find_session_cb.
139+
* This callback is designed for use in (D)TLSv1.2 (or below). It is
140+
* possible to use a single callback for all protocol versions - but it
141+
* is preferred to use a dedicated callback for TLSv1.3. For TLSv1.3 we
142+
* have psk_find_session_cb.
143143
*/
144144
return 0;
145145
}

0 commit comments

Comments
 (0)