Skip to content

Commit ebf3994

Browse files
shigekirvagg
shigeki
authored and
rvagg
committed
deps: upgrade openssl sources to 1.0.2p
This replaces all sources of openssl-1.0.2p.tar.gz into deps/openssl/openssl PR-URL: #22320 Reviewed-By: Rod Vagg <[email protected]>
1 parent 0c047c4 commit ebf3994

File tree

209 files changed

+2072
-39529
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

209 files changed

+2072
-39529
lines changed

‎deps/openssl/openssl/CHANGES

Lines changed: 58 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,64 @@
77
https://github.com/openssl/openssl/commits/ and pick the appropriate
88
release branch.
99

10+
Changes between 1.0.2o and 1.0.2p [14 Aug 2018]
11+
12+
*) Client DoS due to large DH parameter
13+
14+
During key agreement in a TLS handshake using a DH(E) based ciphersuite a
15+
malicious server can send a very large prime value to the client. This will
16+
cause the client to spend an unreasonably long period of time generating a
17+
key for this prime resulting in a hang until the client has finished. This
18+
could be exploited in a Denial Of Service attack.
19+
20+
This issue was reported to OpenSSL on 5th June 2018 by Guido Vranken
21+
(CVE-2018-0732)
22+
[Guido Vranken]
23+
24+
*) Cache timing vulnerability in RSA Key Generation
25+
26+
The OpenSSL RSA Key generation algorithm has been shown to be vulnerable to
27+
a cache timing side channel attack. An attacker with sufficient access to
28+
mount cache timing attacks during the RSA key generation process could
29+
recover the private key.
30+
31+
This issue was reported to OpenSSL on 4th April 2018 by Alejandro Cabrera
32+
Aldaya, Billy Brumley, Cesar Pereida Garcia and Luis Manuel Alvarez Tapia.
33+
(CVE-2018-0737)
34+
[Billy Brumley]
35+
36+
*) Make EVP_PKEY_asn1_new() a bit stricter about its input. A NULL pem_str
37+
parameter is no longer accepted, as it leads to a corrupt table. NULL
38+
pem_str is reserved for alias entries only.
39+
[Richard Levitte]
40+
41+
*) Revert blinding in ECDSA sign and instead make problematic addition
42+
length-invariant. Switch even to fixed-length Montgomery multiplication.
43+
[Andy Polyakov]
44+
45+
*) Change generating and checking of primes so that the error rate of not
46+
being prime depends on the intended use based on the size of the input.
47+
For larger primes this will result in more rounds of Miller-Rabin.
48+
The maximal error rate for primes with more than 1080 bits is lowered
49+
to 2^-128.
50+
[Kurt Roeckx, Annie Yousar]
51+
52+
*) Increase the number of Miller-Rabin rounds for DSA key generating to 64.
53+
[Kurt Roeckx]
54+
55+
*) Add blinding to ECDSA and DSA signatures to protect against side channel
56+
attacks discovered by Keegan Ryan (NCC Group).
57+
[Matt Caswell]
58+
59+
*) When unlocking a pass phrase protected PEM file or PKCS#8 container, we
60+
now allow empty (zero character) pass phrases.
61+
[Richard Levitte]
62+
63+
*) Certificate time validation (X509_cmp_time) enforces stricter
64+
compliance with RFC 5280. Fractional seconds and timezone offsets
65+
are no longer allowed.
66+
[Emilia Käsper]
67+
1068
Changes between 1.0.2n and 1.0.2o [27 Mar 2018]
1169

1270
*) Constructed ASN.1 types with a recursive definition could exceed the stack

‎deps/openssl/openssl/CONTRIBUTING

Lines changed: 25 additions & 25 deletions
Original file line numberDiff line numberDiff line change
@@ -1,26 +1,26 @@
1-
HOW TO CONTRIBUTE PATCHES TO OpenSSL
2-
------------------------------------
1+
HOW TO CONTRIBUTE TO OpenSSL
2+
----------------------------
33

44
(Please visit https://www.openssl.org/community/getting-started.html for
55
other ideas about how to contribute.)
66

7-
Development is coordinated on the openssl-dev mailing list (see the
8-
above link or https://mta.openssl.org for information on subscribing).
9-
If you are unsure as to whether a feature will be useful for the general
10-
OpenSSL community you might want to discuss it on the openssl-dev mailing
11-
list first. Someone may be already working on the same thing or there
12-
may be a good reason as to why that feature isn't implemented.
7+
Development is done on GitHub, https://github.com/openssl/openssl.
138

14-
To submit a patch, make a pull request on GitHub. If you think the patch
15-
could use feedback from the community, please start a thread on openssl-dev
16-
to discuss it.
9+
To request new features or report bugs, please open an issue on GitHub
1710

18-
Having addressed the following items before the PR will help make the
19-
acceptance and review process faster:
11+
To submit a patch, please open a pull request on GitHub. If you are thinking
12+
of making a large contribution, open an issue for it before starting work,
13+
to get comments from the community. Someone may be already working on
14+
the same thing or there may be reasons why that feature isn't implemented.
2015

21-
1. Anything other than trivial contributions will require a contributor
22-
licensing agreement, giving us permission to use your code. See
23-
https://www.openssl.org/policies/cla.html for details.
16+
To make it easier to review and accept your pull request, please follow these
17+
guidelines:
18+
19+
1. Anything other than a trivial contribution requires a Contributor
20+
License Agreement (CLA), giving us permission to use your code. See
21+
https://www.openssl.org/policies/cla.html for details. If your
22+
contribution is too small to require a CLA, put "CLA: trivial" on a
23+
line by itself in your commit message body.
2424

2525
2. All source files should start with the following text (with
2626
appropriate comment characters at the start of each line and the
@@ -34,21 +34,21 @@ acceptance and review process faster:
3434
https://www.openssl.org/source/license.html
3535

3636
3. Patches should be as current as possible; expect to have to rebase
37-
often. We do not accept merge commits; You will be asked to remove
38-
them before a patch is considered acceptable.
37+
often. We do not accept merge commits, you will have to remove them
38+
(usually by rebasing) before it will be acceptable.
3939

4040
4. Patches should follow our coding style (see
41-
https://www.openssl.org/policies/codingstyle.html) and compile without
42-
warnings. Where gcc or clang is availble you should use the
41+
https://www.openssl.org/policies/codingstyle.html) and compile
42+
without warnings. Where gcc or clang is available you should use the
4343
--strict-warnings Configure option. OpenSSL compiles on many varied
44-
platforms: try to ensure you only use portable features.
45-
Clean builds via Travis and AppVeyor are expected, and done whenever
46-
a PR is created or updated.
44+
platforms: try to ensure you only use portable features. Clean builds
45+
via Travis and AppVeyor are required, and they are started automatically
46+
whenever a PR is created or updated.
4747

4848
5. When at all possible, patches should include tests. These can
4949
either be added to an existing test, or completely new. Please see
5050
test/README for information on the test framework.
5151

5252
6. New features or changed functionality must include
53-
documentation. Please look at the "pod" files in doc/apps, doc/crypto
54-
and doc/ssl for examples of our style.
53+
documentation. Please look at the "pod" files in doc for
54+
examples of our style.

‎deps/openssl/openssl/Configure

Lines changed: 10 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1173,6 +1173,7 @@ foreach (sort (keys %disabled))
11731173
$depflags .= " -DOPENSSL_NO_$ALGO";
11741174
}
11751175
}
1176+
if (/^comp$/) { $zlib = 0; }
11761177
}
11771178

11781179
print "\n";
@@ -1671,6 +1672,13 @@ while (<PIPE>) {
16711672
}
16721673
close(PIPE);
16731674

1675+
# Xcode did not handle $cc -M before clang support
1676+
my $cc_as_makedepend = 0;
1677+
if ($predefined{__GNUC__} >= 3 && !(defined($predefined{__APPLE_CC__})
1678+
&& !defined($predefined{__clang__}))) {
1679+
$cc_as_makedepend = 1;
1680+
}
1681+
16741682
if ($strict_warnings)
16751683
{
16761684
my $wopt;
@@ -1730,14 +1738,14 @@ while (<IN>)
17301738
s/^NM=\s*/NM= \$\(CROSS_COMPILE\)/;
17311739
s/^RANLIB=\s*/RANLIB= \$\(CROSS_COMPILE\)/;
17321740
s/^RC=\s*/RC= \$\(CROSS_COMPILE\)/;
1733-
s/^MAKEDEPPROG=.*$/MAKEDEPPROG= \$\(CROSS_COMPILE\)$cc/ if $predefined{__GNUC__} >= 3;
1741+
s/^MAKEDEPPROG=.*$/MAKEDEPPROG= \$\(CROSS_COMPILE\)$cc/ if $cc_as_makedepend;
17341742
}
17351743
else {
17361744
s/^CC=.*$/CC= $cc/;
17371745
s/^AR=\s*ar/AR= $ar/;
17381746
s/^RANLIB=.*/RANLIB= $ranlib/;
17391747
s/^RC=.*/RC= $windres/;
1740-
s/^MAKEDEPPROG=.*$/MAKEDEPPROG= $cc/ if $predefined{__GNUC__} >= 3;
1748+
s/^MAKEDEPPROG=.*$/MAKEDEPPROG= $cc/ if $cc_as_makedepend;
17411749
}
17421750
s/^CFLAG=.*$/CFLAG= $cflags/;
17431751
s/^DEPFLAG=.*$/DEPFLAG=$depflags/;

‎deps/openssl/openssl/Makefile

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@
44
## Makefile for OpenSSL
55
##
66

7-
VERSION=1.0.2o
7+
VERSION=1.0.2p
88
MAJOR=1
99
MINOR=0.2
1010
SHLIB_VERSION_NUMBER=1.0.0

‎deps/openssl/openssl/Makefile.bak

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@
44
## Makefile for OpenSSL
55
##
66

7-
VERSION=1.0.2o
7+
VERSION=1.0.2p
88
MAJOR=1
99
MINOR=0.2
1010
SHLIB_VERSION_NUMBER=1.0.0

‎deps/openssl/openssl/NEWS

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,11 @@
55
This file gives a brief overview of the major changes between each OpenSSL
66
release. For more details please read the CHANGES file.
77

8+
Major changes between OpenSSL 1.0.2o and OpenSSL 1.0.2p [14 Aug 2018]
9+
10+
o Client DoS due to large DH parameter (CVE-2018-0732)
11+
o Cache timing vulnerability in RSA Key Generation (CVE-2018-0737)
12+
813
Major changes between OpenSSL 1.0.2n and OpenSSL 1.0.2o [27 Mar 2018]
914

1015
o Constructed ASN.1 types with a recursive definition could exceed the

‎deps/openssl/openssl/README

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11

2-
OpenSSL 1.0.2o 27 Mar 2018
2+
OpenSSL 1.0.2p 14 Aug 2018
33

4-
Copyright (c) 1998-2015 The OpenSSL Project
4+
Copyright (c) 1998-2018 The OpenSSL Project
55
Copyright (c) 1995-1998 Eric A. Young, Tim J. Hudson
66
All rights reserved.
77

‎deps/openssl/openssl/apps/app_rand.c

Lines changed: 1 addition & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -124,16 +124,7 @@ int app_RAND_load_file(const char *file, BIO *bio_e, int dont_warn)
124124
char buffer[200];
125125

126126
#ifdef OPENSSL_SYS_WINDOWS
127-
/*
128-
* allocate 2 to dont_warn not to use RAND_screen() via
129-
* -no_rand_screen option in s_client
130-
*/
131-
if (dont_warn != 2) {
132-
BIO_printf(bio_e, "Loading 'screen' into random state -");
133-
BIO_flush(bio_e);
134-
RAND_screen();
135-
BIO_printf(bio_e, " done\n");
136-
}
127+
RAND_screen();
137128
#endif
138129

139130
if (file == NULL)

‎deps/openssl/openssl/apps/apps.c

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -56,7 +56,7 @@
5656
* [including the GNU Public Licence.]
5757
*/
5858
/* ====================================================================
59-
* Copyright (c) 1998-2001 The OpenSSL Project. All rights reserved.
59+
* Copyright (c) 1998-2018 The OpenSSL Project. All rights reserved.
6060
*
6161
* Redistribution and use in source and binary forms, with or without
6262
* modification, are permitted provided that the following conditions
@@ -1359,7 +1359,8 @@ int set_name_ex(unsigned long *flags, const char *arg)
13591359
};
13601360
if (set_multi_opts(flags, arg, ex_tbl) == 0)
13611361
return 0;
1362-
if ((*flags & XN_FLAG_SEP_MASK) == 0)
1362+
if (*flags != XN_FLAG_COMPAT
1363+
&& (*flags & XN_FLAG_SEP_MASK) == 0)
13631364
*flags |= XN_FLAG_SEP_CPLUS_SPC;
13641365
return 1;
13651366
}

‎deps/openssl/openssl/apps/asn1pars.c

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -295,7 +295,7 @@ int MAIN(int argc, char **argv)
295295
ASN1_TYPE *atmp;
296296
int typ;
297297
j = atoi(sk_OPENSSL_STRING_value(osk, i));
298-
if (j == 0) {
298+
if (j <= 0 || j >= tmplen) {
299299
BIO_printf(bio_err, "'%s' is an invalid number\n",
300300
sk_OPENSSL_STRING_value(osk, i));
301301
continue;
@@ -327,14 +327,14 @@ int MAIN(int argc, char **argv)
327327
num = tmplen;
328328
}
329329

330-
if (offset >= num) {
331-
BIO_printf(bio_err, "Error: offset too large\n");
330+
if (offset < 0 || offset >= num) {
331+
BIO_printf(bio_err, "Error: offset out of range\n");
332332
goto end;
333333
}
334334

335335
num -= offset;
336336

337-
if ((length == 0) || ((long)length > num))
337+
if (length == 0 || length > (unsigned int)num)
338338
length = (unsigned int)num;
339339
if (derout) {
340340
if (BIO_write(derout, str + offset, length) != (int)length) {

‎deps/openssl/openssl/apps/ca.c

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1176,10 +1176,13 @@ int MAIN(int argc, char **argv)
11761176
if (j > 0) {
11771177
total_done++;
11781178
BIO_printf(bio_err, "\n");
1179-
if (!BN_add_word(serial, 1))
1179+
if (!BN_add_word(serial, 1)) {
1180+
X509_free(x);
11801181
goto err;
1182+
}
11811183
if (!sk_X509_push(cert_sk, x)) {
11821184
BIO_printf(bio_err, "Memory allocation failure\n");
1185+
X509_free(x);
11831186
goto err;
11841187
}
11851188
}

‎deps/openssl/openssl/apps/ocsp.c

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@
44
* 2000.
55
*/
66
/* ====================================================================
7-
* Copyright (c) 1999 The OpenSSL Project. All rights reserved.
7+
* Copyright (c) 1999-2018 The OpenSSL Project. All rights reserved.
88
*
99
* Redistribution and use in source and binary forms, with or without
1010
* modification, are permitted provided that the following conditions
@@ -787,7 +787,6 @@ int MAIN(int argc, char **argv)
787787
OCSP_response_status_str(i), i);
788788
if (ignore_err)
789789
goto redo_accept;
790-
ret = 0;
791790
goto end;
792791
}
793792

‎deps/openssl/openssl/apps/passwd.c

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -306,9 +306,9 @@ static char *md5crypt(const char *passwd, const char *magic, const char *salt)
306306
out_buf[0] = '$';
307307
out_buf[1] = 0;
308308
assert(strlen(magic) <= 4); /* "1" or "apr1" */
309-
strncat(out_buf, magic, 4);
310-
strncat(out_buf, "$", 1);
311-
strncat(out_buf, salt, 8);
309+
BUF_strlcat(out_buf, magic, sizeof(out_buf));
310+
BUF_strlcat(out_buf, "$", sizeof(out_buf));
311+
BUF_strlcat(out_buf, salt, sizeof(out_buf));
312312
assert(strlen(out_buf) <= 6 + 8); /* "$apr1$..salt.." */
313313
salt_out = out_buf + 2 + strlen(magic);
314314
salt_len = strlen(salt_out);

‎deps/openssl/openssl/apps/s_apps.h

Lines changed: 3 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -56,7 +56,7 @@
5656
* [including the GNU Public Licence.]
5757
*/
5858
/* ====================================================================
59-
* Copyright (c) 1998-2001 The OpenSSL Project. All rights reserved.
59+
* Copyright (c) 1998-2018 The OpenSSL Project. All rights reserved.
6060
*
6161
* Redistribution and use in source and binary forms, with or without
6262
* modification, are permitted provided that the following conditions
@@ -152,9 +152,8 @@ typedef fd_mask fd_set;
152152
#define PROTOCOL "tcp"
153153

154154
int do_server(int port, int type, int *ret,
155-
int (*cb) (char *hostname, int s, int stype,
156-
unsigned char *context), unsigned char *context,
157-
int naccept);
155+
int (*cb) (int s, int stype, unsigned char *context),
156+
unsigned char *context, int naccept);
158157
#ifdef HEADER_X509_H
159158
int MS_CALLBACK verify_callback(int ok, X509_STORE_CTX *ctx);
160159
#endif

0 commit comments

Comments
 (0)