Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

Commitae8aba4

Browse files
committed
Import OpenSSL 1.1.1i
1 parent7f34c30 commitae8aba4

File tree

344 files changed

+4255
-4159
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

344 files changed

+4255
-4159
lines changed

‎CHANGES‎

Lines changed: 63 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,69 @@
77
https://github.com/openssl/openssl/commits/ and pick the appropriate
88
release branch.
99

10+
Changes between 1.1.1h and 1.1.1i [8 Dec 2020]
11+
12+
*) Fixed NULL pointer deref in the GENERAL_NAME_cmp function
13+
This function could crash if both GENERAL_NAMEs contain an EDIPARTYNAME.
14+
If an attacker can control both items being compared then this could lead
15+
to a possible denial of service attack. OpenSSL itself uses the
16+
GENERAL_NAME_cmp function for two purposes:
17+
1) Comparing CRL distribution point names between an available CRL and a
18+
CRL distribution point embedded in an X509 certificate
19+
2) When verifying that a timestamp response token signer matches the
20+
timestamp authority name (exposed via the API functions
21+
TS_RESP_verify_response and TS_RESP_verify_token)
22+
(CVE-2020-1971)
23+
[Matt Caswell]
24+
25+
*) Add support for Apple Silicon M1 Macs with the darwin64-arm64-cc target.
26+
[Stuart Carnie]
27+
28+
*) The security callback, which can be customised by application code, supports
29+
the security operation SSL_SECOP_TMP_DH. This is defined to take an EVP_PKEY
30+
in the "other" parameter. In most places this is what is passed. All these
31+
places occur server side. However there was one client side call of this
32+
security operation and it passed a DH object instead. This is incorrect
33+
according to the definition of SSL_SECOP_TMP_DH, and is inconsistent with all
34+
of the other locations. Therefore this client side call has been changed to
35+
pass an EVP_PKEY instead.
36+
[Matt Caswell]
37+
38+
*) In 1.1.1h, an expired trusted (root) certificate was not anymore rejected
39+
when validating a certificate path. This check is restored in 1.1.1i.
40+
[David von Oheimb]
41+
42+
Changes between 1.1.1g and 1.1.1h [22 Sep 2020]
43+
44+
*) Certificates with explicit curve parameters are now disallowed in
45+
verification chains if the X509_V_FLAG_X509_STRICT flag is used.
46+
[Tomas Mraz]
47+
48+
*) The 'MinProtocol' and 'MaxProtocol' configuration commands now silently
49+
ignore TLS protocol version bounds when configuring DTLS-based contexts, and
50+
conversely, silently ignore DTLS protocol version bounds when configuring
51+
TLS-based contexts. The commands can be repeated to set bounds of both
52+
types. The same applies with the corresponding "min_protocol" and
53+
"max_protocol" command-line switches, in case some application uses both TLS
54+
and DTLS.
55+
56+
SSL_CTX instances that are created for a fixed protocol version (e.g.
57+
TLSv1_server_method()) also silently ignore version bounds. Previously
58+
attempts to apply bounds to these protocol versions would result in an
59+
error. Now only the "version-flexible" SSL_CTX instances are subject to
60+
limits in configuration files in command-line options.
61+
[Viktor Dukhovni]
62+
63+
*) Handshake now fails if Extended Master Secret extension is dropped
64+
on renegotiation.
65+
[Tomas Mraz]
66+
67+
*) Accidentally, an expired trusted (root) certificate is not anymore rejected
68+
when validating a certificate path.
69+
[David von Oheimb]
70+
71+
*) The Oracle Developer Studio compiler will start reporting deprecated APIs
72+
1073
Changes between 1.1.1f and 1.1.1g [21 Apr 2020]
1174

1275
*) Fixed segmentation fault in SSL_check_chain()

‎Configurations/10-main.conf‎

Lines changed: 16 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -741,7 +741,7 @@ my %targets = (
741741
inherit_from=> ["linux-generic32", asm("mips64_asm") ],
742742
cflags=> add("-mabi=n32"),
743743
cxxflags=> add("-mabi=n32"),
744-
bn_ops=>"SIXTY_FOUR_BITRC4_CHAR",
744+
bn_ops=>"RC4_CHAR",
745745
perlasm_scheme=>"n32",
746746
multilib=>"32",
747747
},
@@ -1125,7 +1125,7 @@ my %targets = (
11251125
CFLAGS=> picker(debug=>"-O0 -g",
11261126
release=>"-O"),
11271127
cflags=> add(threads("-pthread")),
1128-
ex_libs=> threads("-pthread"),
1128+
ex_libs=>add(threads("-pthread")),
11291129
bn_ops=>"BN_LLONG RC4_CHAR",
11301130
perlasm_scheme=>"aix32",
11311131
shared_ldflag=> add_before("-shared -static-libgcc"),
@@ -1138,7 +1138,7 @@ my %targets = (
11381138
CFLAGS=> picker(debug=>"-O0 -g",
11391139
release=>"-O"),
11401140
cflags=> combine("-maix64", threads("-pthread")),
1141-
ex_libs=> threads("-pthread"),
1141+
ex_libs=>add(threads("-pthread")),
11421142
bn_ops=>"SIXTY_FOUR_BIT_LONG RC4_CHAR",
11431143
perlasm_scheme=>"aix64",
11441144
shared_ldflag=> add_before("-shared -static-libgcc"),
@@ -1154,7 +1154,7 @@ my %targets = (
11541154
cflags=> combine("-q32 -qmaxmem=16384 -qro -qroconst",
11551155
threads("-qthreaded")),
11561156
cppflags=> threads("-D_THREAD_SAFE"),
1157-
ex_libs=> threads("-lpthreads"),
1157+
ex_libs=>add(threads("-lpthreads")),
11581158
bn_ops=>"BN_LLONG RC4_CHAR",
11591159
perlasm_scheme=>"aix32",
11601160
shared_cflag=>"-qpic",
@@ -1169,7 +1169,7 @@ my %targets = (
11691169
cflags=> combine("-q64 -qmaxmem=16384 -qro -qroconst",
11701170
threads("-qthreaded")),
11711171
cppflags=> threads("-D_THREAD_SAFE"),
1172-
ex_libs=> threads("-lpthreads"),
1172+
ex_libs=>add(threads("-lpthreads")),
11731173
bn_ops=>"SIXTY_FOUR_BIT_LONG RC4_CHAR",
11741174
perlasm_scheme=>"aix64",
11751175
dso_scheme=>"dlfcn",
@@ -1365,9 +1365,9 @@ my %targets = (
13651365
}
13661366
push@ex_libs,'$(PORTSDK_LIBPATH)/portlib.lib'
13671367
if (defined(env('PORTSDK_LIBPATH')));
1368-
push@ex_libs,'/nodefaultlib coredll.lib corelibc.lib'
1369-
if (env('TARGETCPU')eq"X86");
1370-
return@ex_libs;
1368+
push@ex_libs,'/nodefaultlib coredll.lib corelibc.lib'
1369+
if (env('TARGETCPU')=~/^X86|^ARMV4[IT]/);
1370+
returnjoin("",@ex_libs);
13711371
}),
13721372
},
13731373

@@ -1557,6 +1557,14 @@ my %targets = (
15571557
bn_ops=>"SIXTY_FOUR_BIT_LONG",
15581558
perlasm_scheme=>"macosx",
15591559
},
1560+
"darwin64-arm64-cc"=> {
1561+
inherit_from=> ["darwin-common", asm("aarch64_asm") ],
1562+
CFLAGS=> add("-Wall"),
1563+
cflags=> add("-arch arm64"),
1564+
lib_cppflags=> add("-DL_ENDIAN"),
1565+
bn_ops=>"SIXTY_FOUR_BIT_LONG",
1566+
perlasm_scheme=>"ios64",
1567+
},
15601568

15611569
##### GNU Hurd
15621570
"hurd-x86"=> {

‎Configurations/windows-makefile.tmpl‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -211,8 +211,8 @@ CNF_CPPFLAGS={- our $cppfags2 =
211211
join(' ', $target{cppflags} || (),
212212
(map { '-D'.quotify1($_) } @{$target{defines}},
213213
@{$config{defines}}),
214-
(map { '-I'.quotify1($_) } @{$target{includes}},
215-
@{$config{includes}}),
214+
(map { '-I'.'"'.$_.'"' } @{$target{includes}},
215+
@{$config{includes}}),
216216
@{$config{cppflags}}) -}
217217
CNF_CFLAGS={- join(' ', $target{cflags} || (),
218218
@{$config{cflags}}) -}

‎Configure‎

Lines changed: 36 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -217,12 +217,22 @@ sub resolve_config;
217217
# Unified build supports separate build dir
218218
my$srcdir = catdir(absolutedir(dirname($0)));# catdir ensures local syntax
219219
my$blddir = catdir(absolutedir("."));# catdir ensures local syntax
220+
221+
# File::Spec::Unix doesn't detect case insensitivity, so we make sure to
222+
# check if the source and build directory are really the same, and make
223+
# them so. This avoids all kinds of confusion later on.
224+
# We must check @File::Spec::ISA rather than using File::Spec->isa() to
225+
# know if File::Spec ended up loading File::Spec::Unix.
226+
$srcdir =$blddir
227+
if (grep(/::Unix$/,@File::Spec::ISA)
228+
&& samedir($srcdir,$blddir));
229+
220230
my$dofile = abs2rel(catfile($srcdir,"util/dofile.pl"));
221231

222232
my$local_config_envname ='OPENSSL_LOCAL_CONFIG_DIR';
223233

224-
$config{sourcedir} = abs2rel($srcdir);
225-
$config{builddir} = abs2rel($blddir);
234+
$config{sourcedir} = abs2rel($srcdir,$blddir);
235+
$config{builddir} = abs2rel($blddir,$blddir);
226236

227237
# Collect reconfiguration information if needed
228238
my@argvcopy=@ARGV;
@@ -1049,6 +1059,9 @@ if (scalar(@seed_sources) == 0) {
10491059
print"Using os-specific seed configuration\n";
10501060
push@seed_sources,'os';
10511061
}
1062+
if (scalar(grep {$_eq'egd' }@seed_sources) > 0) {
1063+
delete$disabled{'egd'};
1064+
}
10521065
if (scalar(grep {$_eq'none' }@seed_sources) > 0) {
10531066
die"Cannot seed with none and anything else"ifscalar(@seed_sources) > 1;
10541067
warn<<_____ifscalar(@seed_sources) == 1;
@@ -3424,6 +3437,27 @@ sub absolutedir {
34243437
return realpath($dir);
34253438
}
34263439

3440+
# Check if all paths are one and the same, using stat. They must both exist
3441+
# We need this for the cases when File::Spec doesn't detect case insensitivity
3442+
# (File::Spec::Unix assumes case sensitivity)
3443+
subsamedir {
3444+
die"samedir expects two arguments\n"unlessscalar@_ == 2;
3445+
3446+
my@stat0 =stat($_[0]);# First argument
3447+
my@stat1 =stat($_[1]);# Second argument
3448+
3449+
die"Couldn't stat$_[0]"unless@stat0;
3450+
die"Couldn't stat$_[1]"unless@stat1;
3451+
3452+
# Compare device number
3453+
return 0unless ($stat0[0] ==$stat1[0]);
3454+
# Compare "inode". The perl manual recommends comparing as
3455+
# string rather than as number.
3456+
return 0unless ($stat0[1]eq$stat1[1]);
3457+
3458+
return 1;# All the same
3459+
}
3460+
34273461
subquotify {
34283462
my%processors = (
34293463
perl=>sub {my$x =shift;

‎NEWS‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,18 @@
55
This file gives a brief overview of the major changes between each OpenSSL
66
release. For more details please read the CHANGES file.
77

8+
Major changes between OpenSSL 1.1.1h and OpenSSL 1.1.1i [8 Dec 2020]
9+
10+
o Fixed NULL pointer deref in GENERAL_NAME_cmp (CVE-2020-1971)
11+
12+
Major changes between OpenSSL 1.1.1g and OpenSSL 1.1.1h [22 Sep 2020]
13+
14+
o Disallow explicit curve parameters in verifications chains when
15+
X509_V_FLAG_X509_STRICT is used
16+
o Enable 'MinProtocol' and 'MaxProtocol' to configure both TLS and DTLS
17+
contexts
18+
o Oracle Developer Studio will start reporting deprecation warnings
19+
820
Major changes between OpenSSL 1.1.1f and OpenSSL 1.1.1g [21 Apr 2020]
921

1022
o Fixed segmentation fault in SSL_check_chain() (CVE-2020-1967)

‎NOTES.ANDROID‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -6,8 +6,8 @@
66
-------------------
77

88
Beside basic tools like perl and make you'll need to download the Android
9-
NDK. It's available for Linux,Mac OS X and Windows, but only Linux
10-
version was actually tested. There is no reason to believe thatMac OS X
9+
NDK. It's available for Linux,macOS and Windows, but only Linux
10+
version was actually tested. There is no reason to believe thatmacOS
1111
wouldn't work. And as for Windows, it's unclear which "shell" would be
1212
suitable, MSYS2 might have best chances. NDK version should play lesser
1313
role, the goal is to support a range of most recent versions.

‎NOTES.PERL‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -109,7 +109,7 @@
109109

110110
$ cpan-f -i Text::Template
111111

112-
Note: on VMS, you must quote any argument that containsuppercase
112+
Note: on VMS, you must quote any argument that containsuppercase
113113
characters, so the lines above would be:
114114

115115
$ cpan -i"Text::Template"

‎NOTES.VMS‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,7 @@
1818
An ANSI C compiled is needed among other things. This means that
1919
VAX C is not and will not be supported.
2020

21-
We have only tested with DEC C (a.k.a HP VMS C / VSI C) and require
21+
We have only tested with DEC C (aka HP VMS C / VSI C) and require
2222
version 7.1 or later. Compiling with a different ANSI C compiler may
2323
require some work.
2424

‎NOTES.WIN‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -12,11 +12,11 @@
1212
and require --cross-compile-prefix option. While on MSYS[2] it's solved
1313
rather by placing gcc that produces "MinGW binary" code 1st on $PATH.
1414
This is customarily source of confusion. "Hosted" applications "live" in
15-
emulatedfile system name space with POSIX-y root, mount points, /dev
15+
emulatedfilesystem name space with POSIX-y root, mount points, /dev
1616
and even /proc. Confusion is intensified by the fact that MSYS2 shell
1717
(or rather emulated execve(2) call) examines the binary it's about to
1818
start, and if it's found *not* to be linked with MSYS2 POSIX-y thing,
19-
command line arguments that look likefile names get translated from
19+
command line arguments that look likefilenames get translated from
2020
emulated name space to "native". For example '/c/some/where' becomes
2121
'c:\some\where', '/dev/null' - 'nul'. This creates an illusion that
2222
there is no difference between MSYS2 shell and "MinGW binary", but
@@ -26,7 +26,7 @@
2626
it's referred to in quotes here, as "MinGW binary", it's just as
2727
"native" as it can get.)
2828

29-
Visual C++ builds,a.k.a. VC-*
29+
Visual C++ builds,aka VC-*
3030
==============================
3131

3232
Requirement details
@@ -47,7 +47,7 @@
4747
the other hand oldest one is known not to work. Everything between
4848
falls into best-effort category.
4949

50-
- Netwide Assembler,a.k.a. NASM, available from https://www.nasm.us,
50+
- Netwide Assembler,aka NASM, available from https://www.nasm.us,
5151
is required. Note that NASM is the only supported assembler. Even
5252
though Microsoft provided assembler is NOT supported, contemporary
5353
64-bit version is exercised through continuous integration of
@@ -132,7 +132,7 @@
132132
If you link with static OpenSSL libraries then you're expected to
133133
additionally link your application with WS2_32.LIB, GDI32.LIB,
134134
ADVAPI32.LIB, CRYPT32.LIB and USER32.LIB. Those developing
135-
non-interactive service applications might feel concerned about
135+
noninteractive service applications might feel concerned about
136136
linking with GDI32.LIB and USER32.LIB, as they are justly associated
137137
with interactive desktop, which is not available to service
138138
processes. The toolkit is designed to detect in which context it's

‎README‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11

2-
OpenSSL 1.1.1g 21 Apr 2020
2+
OpenSSL 1.1.1i 8 Dec 2020
33

44
Copyright (c) 1998-2020 The OpenSSL Project
55
Copyright (c) 1995-1998 Eric A. Young, Tim J. Hudson

0 commit comments

Comments
 (0)
[8]ページ先頭
©2009-2025 Movatter.jp