Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly
Appearance settings

Commit 11629fe

Browse filesBrowse files
RafaelGSSRafaelGSS
committed
deps: upgrade openssl sources to 1.1.1s
This updates all sources in deps/openssl/openssl by: $ cd deps/openssl/ $ rm -rf openssl $ tar zxf ~/tmp/openssl-1.1.1s.tar.gz $ mv openssl-1.1.1s openssl $ git add --all openssl $ git commit openssl PR-URL: #45272 Refs: https://mta.openssl.org/pipermail/openssl-announce/2022-November/000242.html Reviewed-By: Richard Lau <rlau@redhat.com> Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
1 parent fe444a8 commit 11629fe
Copy full SHA for 11629fe

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.
Dismiss banner
Expand file treeCollapse file tree

63 files changed

+1297
-442
lines changed
Open diff view settings
Collapse file

‎deps/openssl/openssl/CHANGES‎

Copy file name to clipboardExpand all lines: deps/openssl/openssl/CHANGES
+46Lines changed: 46 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,52 @@
77
https://github.com/openssl/openssl/commits/ and pick the appropriate
88
release branch.
99

10+
Changes between 1.1.1r and 1.1.1s [1 Nov 2022]
11+
12+
*) Fixed a regression introduced in 1.1.1r version not refreshing the
13+
certificate data to be signed before signing the certificate.
14+
15+
[Gibeom Gwon]
16+
17+
Changes between 1.1.1q and 1.1.1r [11 Oct 2022]
18+
19+
*) Fixed the linux-mips64 Configure target which was missing the
20+
SIXTY_FOUR_BIT bn_ops flag. This was causing heap corruption on that
21+
platform.
22+
[Adam Joseph]
23+
24+
*) Fixed a strict aliasing problem in bn_nist. Clang-14 optimisation was
25+
causing incorrect results in some cases as a result.
26+
[Paul Dale]
27+
28+
*) Fixed SSL_pending() and SSL_has_pending() with DTLS which were failing to
29+
report correct results in some cases
30+
[Matt Caswell]
31+
32+
*) Fixed a regression introduced in 1.1.1o for re-signing certificates with
33+
different key sizes
34+
[Todd Short]
35+
36+
*) Added the loongarch64 target
37+
[Shi Pujin]
38+
39+
*) Fixed a DRBG seed propagation thread safety issue
40+
[Bernd Edlinger]
41+
42+
*) Fixed a memory leak in tls13_generate_secret
43+
[Bernd Edlinger]
44+
45+
*) Fixed reported performance degradation on aarch64. Restored the
46+
implementation prior to commit 2621751 ("aes/asm/aesv8-armx.pl: avoid
47+
32-bit lane assignment in CTR mode") for 64bit targets only, since it is
48+
reportedly 2-17% slower and the silicon errata only affects 32bit targets.
49+
The new algorithm is still used for 32 bit targets.
50+
[Bernd Edlinger]
51+
52+
*) Added a missing header for memcmp that caused compilation failure on some
53+
platforms
54+
[Gregor Jasny]
55+
1056
Changes between 1.1.1p and 1.1.1q [5 Jul 2022]
1157

1258
*) AES OCB mode for 32-bit x86 platforms using the AES-NI assembly optimised
Collapse file

‎deps/openssl/openssl/Configurations/10-main.conf‎

Copy file name to clipboardExpand all lines: deps/openssl/openssl/Configurations/10-main.conf
+8-1Lines changed: 8 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -742,7 +742,7 @@ my %targets = (
742742
inherit_from => [ "linux-generic32", asm("mips64_asm") ],
743743
cflags => add("-mabi=n32"),
744744
cxxflags => add("-mabi=n32"),
745-
bn_ops => "RC4_CHAR",
745+
bn_ops => "RC4_CHAR SIXTY_FOUR_BIT",
746746
perlasm_scheme => "n32",
747747
multilib => "32",
748748
},
@@ -761,6 +761,13 @@ my %targets = (
761761
perlasm_scheme => "linux64",
762762
},
763763

764+
# loongarch64 below refers to contemporary LoongArch Architecture
765+
# specifications,
766+
"linux64-loongarch64" => {
767+
inherit_from => [ "linux-generic64"],
768+
perlasm_scheme => "linux64",
769+
},
770+
764771
#### IA-32 targets...
765772
#### These two targets are a bit aged and are to be used on older Linux
766773
#### machines where gcc doesn't understand -m32 and -m64
Collapse file

‎deps/openssl/openssl/NEWS‎

Copy file name to clipboardExpand all lines: deps/openssl/openssl/NEWS
+10Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,16 @@
55
This file gives a brief overview of the major changes between each OpenSSL
66
release. For more details please read the CHANGES file.
77

8+
Major changes between OpenSSL 1.1.1r and OpenSSL 1.1.1s [1 Nov 2022]
9+
10+
o Fixed a regression introduced in OpenSSL 1.1.1r not refreshing the
11+
certificate data to be signed before signing the certificate.
12+
13+
Major changes between OpenSSL 1.1.1q and OpenSSL 1.1.1r [11 Oct 2022]
14+
15+
o Added a missing header for memcmp that caused compilation failure on
16+
some platforms
17+
818
Major changes between OpenSSL 1.1.1p and OpenSSL 1.1.1q [5 Jul 2022]
919

1020
o Fixed AES OCB failure to encrypt some bytes on 32-bit x86 platforms
Collapse file

‎deps/openssl/openssl/README‎

Copy file name to clipboardExpand all lines: deps/openssl/openssl/README
+1-1Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11

2-
OpenSSL 1.1.1q 5 Jul 2022
2+
OpenSSL 1.1.1s 1 Nov 2022
33

44
Copyright (c) 1998-2022 The OpenSSL Project
55
Copyright (c) 1995-1998 Eric A. Young, Tim J. Hudson
Collapse file

‎deps/openssl/openssl/apps/apps.c‎

Copy file name to clipboardExpand all lines: deps/openssl/openssl/apps/apps.c
+13-2Lines changed: 13 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1376,7 +1376,8 @@ static IMPLEMENT_LHASH_HASH_FN(index_name, OPENSSL_CSTRING)
13761376
static IMPLEMENT_LHASH_COMP_FN(index_name, OPENSSL_CSTRING)
13771377
#undef BSIZE
13781378
#define BSIZE 256
1379-
BIGNUM *load_serial(const char *serialfile, int create, ASN1_INTEGER **retai)
1379+
BIGNUM *load_serial(const char *serialfile, int *exists, int create,
1380+
ASN1_INTEGER **retai)
13801381
{
13811382
BIO *in = NULL;
13821383
BIGNUM *ret = NULL;
@@ -1388,15 +1389,23 @@ BIGNUM *load_serial(const char *serialfile, int create, ASN1_INTEGER **retai)
13881389
goto err;
13891390

13901391
in = BIO_new_file(serialfile, "r");
1392+
if (exists != NULL)
1393+
*exists = in != NULL;
13911394
if (in == NULL) {
13921395
if (!create) {
13931396
perror(serialfile);
13941397
goto err;
13951398
}
13961399
ERR_clear_error();
13971400
ret = BN_new();
1398-
if (ret == NULL || !rand_serial(ret, ai))
1401+
if (ret == NULL) {
13991402
BIO_printf(bio_err, "Out of memory\n");
1403+
} else if (!rand_serial(ret, ai)) {
1404+
BIO_printf(bio_err, "Error creating random number to store in %s\n",
1405+
serialfile);
1406+
BN_free(ret);
1407+
ret = NULL;
1408+
}
14001409
} else {
14011410
if (!a2i_ASN1_INTEGER(in, ai, buf, 1024)) {
14021411
BIO_printf(bio_err, "unable to load number from %s\n",
@@ -1416,6 +1425,8 @@ BIGNUM *load_serial(const char *serialfile, int create, ASN1_INTEGER **retai)
14161425
ai = NULL;
14171426
}
14181427
err:
1428+
if (ret == NULL)
1429+
ERR_print_errors(bio_err);
14191430
BIO_free(in);
14201431
ASN1_INTEGER_free(ai);
14211432
return ret;
Collapse file

‎deps/openssl/openssl/apps/apps.h‎

Copy file name to clipboardExpand all lines: deps/openssl/openssl/apps/apps.h
+7-4Lines changed: 7 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright 1995-2019 The OpenSSL Project Authors. All Rights Reserved.
2+
* Copyright 1995-2022 The OpenSSL Project Authors. All Rights Reserved.
33
*
44
* Licensed under the OpenSSL license (the "License"). You may not use
55
* this file except in compliance with the License. You can obtain a copy
@@ -527,9 +527,12 @@ typedef struct ca_db_st {
527527
} CA_DB;
528528

529529
void* app_malloc(int sz, const char *what);
530-
BIGNUM *load_serial(const char *serialfile, int create, ASN1_INTEGER **retai);
531-
int save_serial(const char *serialfile, const char *suffix, const BIGNUM *serial,
532-
ASN1_INTEGER **retai);
530+
531+
/* load_serial, save_serial, and rotate_serial are also used for CRL numbers */
532+
BIGNUM *load_serial(const char *serialfile, int *exists, int create,
533+
ASN1_INTEGER **retai);
534+
int save_serial(const char *serialfile, const char *suffix,
535+
const BIGNUM *serial, ASN1_INTEGER **retai);
533536
int rotate_serial(const char *serialfile, const char *new_suffix,
534537
const char *old_suffix);
535538
int rand_serial(BIGNUM *b, ASN1_INTEGER *ai);
Collapse file

‎deps/openssl/openssl/apps/ca.c‎

Copy file name to clipboardExpand all lines: deps/openssl/openssl/apps/ca.c
+5-3Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright 1995-2021 The OpenSSL Project Authors. All Rights Reserved.
2+
* Copyright 1995-2022 The OpenSSL Project Authors. All Rights Reserved.
33
*
44
* Licensed under the OpenSSL license (the "License"). You may not use
55
* this file except in compliance with the License. You can obtain a copy
@@ -842,7 +842,8 @@ int ca_main(int argc, char **argv)
842842
goto end;
843843
}
844844
} else {
845-
if ((serial = load_serial(serialfile, create_ser, NULL)) == NULL) {
845+
serial = load_serial(serialfile, NULL, create_ser, NULL);
846+
if (serial == NULL) {
846847
BIO_printf(bio_err, "error while loading serial number\n");
847848
goto end;
848849
}
@@ -1078,7 +1079,8 @@ int ca_main(int argc, char **argv)
10781079

10791080
if ((crlnumberfile = NCONF_get_string(conf, section, ENV_CRLNUMBER))
10801081
!= NULL)
1081-
if ((crlnumber = load_serial(crlnumberfile, 0, NULL)) == NULL) {
1082+
if ((crlnumber = load_serial(crlnumberfile, NULL, 0, NULL))
1083+
== NULL) {
10821084
BIO_printf(bio_err, "error while loading CRL number\n");
10831085
goto end;
10841086
}
Collapse file

‎deps/openssl/openssl/apps/ocsp.c‎

Copy file name to clipboardExpand all lines: deps/openssl/openssl/apps/ocsp.c
+2-2Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright 2001-2020 The OpenSSL Project Authors. All Rights Reserved.
2+
* Copyright 2001-2022 The OpenSSL Project Authors. All Rights Reserved.
33
*
44
* Licensed under the OpenSSL license (the "License"). You may not use
55
* this file except in compliance with the License. You can obtain a copy
@@ -176,7 +176,7 @@ const OPTIONS ocsp_options[] = {
176176
{"no_intern", OPT_NO_INTERN, '-',
177177
"Don't search certificates contained in response for signer"},
178178
{"badsig", OPT_BADSIG, '-',
179-
"Corrupt last byte of loaded OSCP response signature (for test)"},
179+
"Corrupt last byte of loaded OCSP response signature (for test)"},
180180
{"text", OPT_TEXT, '-', "Print text form of request and response"},
181181
{"req_text", OPT_REQ_TEXT, '-', "Print text form of request"},
182182
{"resp_text", OPT_RESP_TEXT, '-', "Print text form of response"},
Collapse file

‎deps/openssl/openssl/apps/s_cb.c‎

Copy file name to clipboardExpand all lines: deps/openssl/openssl/apps/s_cb.c
+17-11Lines changed: 17 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright 1995-2021 The OpenSSL Project Authors. All Rights Reserved.
2+
* Copyright 1995-2022 The OpenSSL Project Authors. All Rights Reserved.
33
*
44
* Licensed under the OpenSSL license (the "License"). You may not use
55
* this file except in compliance with the License. You can obtain a copy
@@ -74,22 +74,28 @@ int verify_callback(int ok, X509_STORE_CTX *ctx)
7474
}
7575
switch (err) {
7676
case X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT:
77-
BIO_puts(bio_err, "issuer= ");
78-
X509_NAME_print_ex(bio_err, X509_get_issuer_name(err_cert),
79-
0, get_nameopt());
80-
BIO_puts(bio_err, "\n");
77+
if (err_cert != NULL) {
78+
BIO_puts(bio_err, "issuer= ");
79+
X509_NAME_print_ex(bio_err, X509_get_issuer_name(err_cert),
80+
0, get_nameopt());
81+
BIO_puts(bio_err, "\n");
82+
}
8183
break;
8284
case X509_V_ERR_CERT_NOT_YET_VALID:
8385
case X509_V_ERR_ERROR_IN_CERT_NOT_BEFORE_FIELD:
84-
BIO_printf(bio_err, "notBefore=");
85-
ASN1_TIME_print(bio_err, X509_get0_notBefore(err_cert));
86-
BIO_printf(bio_err, "\n");
86+
if (err_cert != NULL) {
87+
BIO_printf(bio_err, "notBefore=");
88+
ASN1_TIME_print(bio_err, X509_get0_notBefore(err_cert));
89+
BIO_printf(bio_err, "\n");
90+
}
8791
break;
8892
case X509_V_ERR_CERT_HAS_EXPIRED:
8993
case X509_V_ERR_ERROR_IN_CERT_NOT_AFTER_FIELD:
90-
BIO_printf(bio_err, "notAfter=");
91-
ASN1_TIME_print(bio_err, X509_get0_notAfter(err_cert));
92-
BIO_printf(bio_err, "\n");
94+
if (err_cert != NULL) {
95+
BIO_printf(bio_err, "notAfter=");
96+
ASN1_TIME_print(bio_err, X509_get0_notAfter(err_cert));
97+
BIO_printf(bio_err, "\n");
98+
}
9399
break;
94100
case X509_V_ERR_NO_EXPLICIT_POLICY:
95101
if (!verify_args.quiet)
Collapse file

‎deps/openssl/openssl/apps/x509.c‎

Copy file name to clipboardExpand all lines: deps/openssl/openssl/apps/x509.c
+11-5Lines changed: 11 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -400,7 +400,7 @@ int x509_main(int argc, char **argv)
400400
aliasout = ++num;
401401
break;
402402
case OPT_CACREATESERIAL:
403-
CA_createserial = ++num;
403+
CA_createserial = 1;
404404
break;
405405
case OPT_CLREXT:
406406
clrext = 1;
@@ -590,7 +590,7 @@ int x509_main(int argc, char **argv)
590590
xca = load_cert(CAfile, CAformat, "CA Certificate");
591591
if (xca == NULL)
592592
goto end;
593-
if (!X509_set_issuer_name(x, X509_get_subject_name(xca)))
593+
if (reqfile && !X509_set_issuer_name(x, X509_get_subject_name(xca)))
594594
goto end;
595595
}
596596

@@ -916,6 +916,7 @@ static ASN1_INTEGER *x509_load_serial(const char *CAfile,
916916
char *buf = NULL;
917917
ASN1_INTEGER *bs = NULL;
918918
BIGNUM *serial = NULL;
919+
int defaultfile = 0, file_exists;
919920

920921
if (serialfile == NULL) {
921922
const char *p = strrchr(CAfile, '.');
@@ -925,9 +926,10 @@ static ASN1_INTEGER *x509_load_serial(const char *CAfile,
925926
memcpy(buf, CAfile, len);
926927
memcpy(buf + len, POSTFIX, sizeof(POSTFIX));
927928
serialfile = buf;
929+
defaultfile = 1;
928930
}
929931

930-
serial = load_serial(serialfile, create, NULL);
932+
serial = load_serial(serialfile, &file_exists, create || defaultfile, NULL);
931933
if (serial == NULL)
932934
goto end;
933935

@@ -936,8 +938,10 @@ static ASN1_INTEGER *x509_load_serial(const char *CAfile,
936938
goto end;
937939
}
938940

939-
if (!save_serial(serialfile, NULL, serial, &bs))
940-
goto end;
941+
if (file_exists || create)
942+
save_serial(serialfile, NULL, serial, &bs);
943+
else
944+
bs = BN_to_ASN1_INTEGER(serial, NULL);
941945

942946
end:
943947
OPENSSL_free(buf);
@@ -989,6 +993,8 @@ static int x509_certify(X509_STORE *ctx, const char *CAfile, const EVP_MD *diges
989993
goto end;
990994
}
991995

996+
if (!X509_set_issuer_name(x, X509_get_subject_name(xca)))
997+
goto end;
992998
if (!X509_set_serialNumber(x, bs))
993999
goto end;
9941000

0 commit comments

Comments
0 (0)
Morty Proxy This is a proxified and sanitized view of the page, visit original site.