deps: upgrade openssl sources to OpenSSL_1_1_1p+quic · nodejs/node@e9084a3 · GitHub
Skip to content

Commit e9084a3

Browse files
RafaelGSSdanielleadams
RafaelGSS
authored and
danielleadams
committed
deps: upgrade openssl sources to OpenSSL_1_1_1p+quic
This updates all sources in deps/openssl/openssl by: $ git clone https://github.com/quictls/openssl $ cd openssl $ git checkout OpenSSL_1_1_1p+quic $ cd ../node/deps/openssl $ rm -rf openssl $ cp -R ../openssl openssl $ rm -rf openssl/.git* openssl/.travis* $ git add --all openssl $ git commit openssl PR-URL: #43535 Refs: https://mta.openssl.org/pipermail/openssl-announce/2022-June/000228.html Reviewed-By: Richard Lau <rlau@redhat.com> Reviewed-By: Tobias Nießen <tniessen@tnie.de> Reviewed-By: Danielle Adams <adamzdanielle@gmail.com>
1 parent 0284901 commit e9084a3

56 files changed

Lines changed: 1312 additions & 840 deletions

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎deps/openssl/openssl/CHANGES‎

Lines changed: 35 additions & 9 deletions

‎deps/openssl/openssl/Configurations/10-main.conf‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -995,6 +995,13 @@ my %targets = (
995995
perlasm_scheme => "linux64",
996996
},
997997

998+
"BSD-aarch64" => {
999+
inherit_from => [ "BSD-generic64", asm("aarch64_asm") ],
1000+
lib_cppflags => add("-DL_ENDIAN"),
1001+
bn_ops => "SIXTY_FOUR_BIT_LONG",
1002+
perlasm_scheme => "linux64",
1003+
},
1004+
9981005
"bsdi-elf-gcc" => {
9991006
inherit_from => [ "BASE_unix", asm("x86_elf_asm") ],
10001007
CC => "gcc",

‎deps/openssl/openssl/NEWS‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,12 @@
55
This file gives a brief overview of the major changes between each OpenSSL
66
release. For more details please read the CHANGES file.
77

8+
Major changes between OpenSSL 1.1.1o and OpenSSL 1.1.1p [21 Jun 2022]
9+
10+
o Fixed additional bugs in the c_rehash script which was not properly
11+
sanitising shell metacharacters to prevent command injection
12+
(CVE-2022-2068)
13+
814
Major changes between OpenSSL 1.1.1n and OpenSSL 1.1.1o [3 May 2022]
915

1016
o Fixed a bug in the c_rehash script which was not properly sanitising

‎deps/openssl/openssl/README-OpenSSL.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11

2-
OpenSSL 1.1.1o 3 May 2022
2+
OpenSSL 1.1.1p 21 Jun 2022
33

44
Copyright (c) 1998-2022 The OpenSSL Project
55
Copyright (c) 1995-1998 Eric A. Young, Tim J. Hudson

‎deps/openssl/openssl/README.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@ What This Is
44
This is a fork of [OpenSSL](https://www.openssl.org) to enable QUIC. In addition
55
to the website, the official source distribution is at
66
<https://github.com/openssl/openssl>. The OpenSSL `README` can be found at
7-
[README-OpenSSL.md](https://github.com/quictls/openssl/blob/OpenSSL_1_1_1o%2Bquic/README-OpenSSL.md).
7+
[README-OpenSSL.md](https://github.com/quictls/openssl/blob/OpenSSL_1_1_1p%2Bquic/README-OpenSSL.md).
88

99
This fork adds APIs that can be used by QUIC implementations for connection
1010
handshakes. Quoting the IETF Working group

‎deps/openssl/openssl/apps/s_server.c‎

Lines changed: 44 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright 1995-2021 The OpenSSL Project Authors. All Rights Reserved.
2+
* Copyright 1995-2022 The OpenSSL Project Authors. All Rights Reserved.
33
* Copyright (c) 2002, Oracle and/or its affiliates. All rights reserved
44
* Copyright 2005 Nokia. All rights reserved.
55
*
@@ -2236,6 +2236,30 @@ static void print_stats(BIO *bio, SSL_CTX *ssl_ctx)
22362236
SSL_CTX_sess_get_cache_size(ssl_ctx));
22372237
}
22382238

2239+
static long int count_reads_callback(BIO *bio, int cmd, const char *argp,
2240+
int argi, long int argl, long int ret)
2241+
{
2242+
unsigned int *p_counter = (unsigned int *)BIO_get_callback_arg(bio);
2243+
2244+
switch (cmd) {
2245+
case BIO_CB_READ: /* No break here */
2246+
case BIO_CB_GETS:
2247+
if (p_counter != NULL)
2248+
++*p_counter;
2249+
break;
2250+
default:
2251+
break;
2252+
}
2253+
2254+
if (s_debug) {
2255+
BIO_set_callback_arg(bio, (char *)bio_s_out);
2256+
ret = bio_dump_callback(bio, cmd, argp, argi, argl, ret);
2257+
BIO_set_callback_arg(bio, (char *)p_counter);
2258+
}
2259+
2260+
return ret;
2261+
}
2262+
22392263
static int sv_body(int s, int stype, int prot, unsigned char *context)
22402264
{
22412265
char *buf = NULL;
@@ -2353,10 +2377,7 @@ static int sv_body(int s, int stype, int prot, unsigned char *context)
23532377
SSL_set_accept_state(con);
23542378
/* SSL_set_fd(con,s); */
23552379

2356-
if (s_debug) {
2357-
BIO_set_callback(SSL_get_rbio(con), bio_dump_callback);
2358-
BIO_set_callback_arg(SSL_get_rbio(con), (char *)bio_s_out);
2359-
}
2380+
BIO_set_callback(SSL_get_rbio(con), count_reads_callback);
23602381
if (s_msg) {
23612382
#ifndef OPENSSL_NO_SSL_TRACE
23622383
if (s_msg == 2)
@@ -2648,7 +2669,25 @@ static int sv_body(int s, int stype, int prot, unsigned char *context)
26482669
*/
26492670
if ((!async || !SSL_waiting_for_async(con))
26502671
&& !SSL_is_init_finished(con)) {
2672+
/*
2673+
* Count number of reads during init_ssl_connection.
2674+
* It helps us to distinguish configuration errors from errors
2675+
* caused by a client.
2676+
*/
2677+
unsigned int read_counter = 0;
2678+
2679+
BIO_set_callback_arg(SSL_get_rbio(con), (char *)&read_counter);
26512680
i = init_ssl_connection(con);
2681+
BIO_set_callback_arg(SSL_get_rbio(con), NULL);
2682+
2683+
/*
2684+
* If initialization fails without reads, then
2685+
* there was a fatal error in configuration.
2686+
*/
2687+
if (i <= 0 && read_counter == 0) {
2688+
ret = -1;
2689+
goto err;
2690+
}
26522691

26532692
if (i < 0) {
26542693
ret = 0;

‎deps/openssl/openssl/config‎

Lines changed: 2 additions & 1 deletion

0 commit comments

Comments
 (0)