diff options
| author | Pierre Pronchery <pierre@freebsdfoundation.org> | 2023-09-22 14:52:58 +0000 |
|---|---|---|
| committer | Ed Maste <emaste@FreeBSD.org> | 2023-09-22 15:55:26 +0000 |
| commit | 315108b81694de474bbc273c0050b195047f5eed (patch) | |
| tree | e3f2a313c74d0ae64bb2f0da5ecd9edb258e361f /ssl | |
| parent | cf2fc1b0f5ce501f5a29d307294e5637e0f5aba6 (diff) | |
openssl: Vendor import of OpenSSL 3.0.11vendor/openssl/3.0.11
Major changes between OpenSSL 3.0.10 and OpenSSL 3.0.11:
* Fix POLY1305 MAC implementation corrupting XMM registers on Windows
([CVE-2023-4807])
Release notes can otherwise be found at
https://www.openssl.org/news/openssl-3.0-notes.html.
Obtained from: https://www.openssl.org/source/openssl-3.0.11.tar.gz
Sponsored by: The FreeBSD Foundation
Test Plan:
```
$ git status
On branch vendor/openssl-3.0
Your branch is up to date with 'origin/vendor/openssl-3.0'.
nothing to commit, working tree clean
$ OSSLVER=3.0.11
$ XLIST=FREEBSD-Xlist
$ (cd ..; fetch https://www.openssl.org/source/openssl-${OSSLVER}.tar.gz https://www.openssl.org/source/openssl-${OSSLVER}.tar.gz.asc)
openssl-3.0.11.tar.gz 14 MB 17 MBps 01s
openssl-3.0.11.tar.gz.asc 833 B 8301 kBps 00s
$ gpg --list-keys
/home/khorben/.gnupg/pubring.kbx
--------------------------------
pub rsa4096 2011-03-01 [SCA]
DC34EE5DB2417BCC151E5100E5F8F8212F77A498
uid [ unknown] Willem Toorop <willem@nlnetlabs.nl>
sub rsa4096 2011-03-01 [E]
pub rsa4096 2014-10-04 [SC] [expires: 2024-01-30]
EFC0A467D613CB83C7ED6D30D894E2CE8B3D79F5
uid [ unknown] OpenSSL security team <openssl-security@openssl.org>
uid [ unknown] OpenSSL OMC <openssl-omc@openssl.org>
uid [ unknown] OpenSSL Security <openssl-security@openssl.org>
sub rsa4096 2014-10-04 [E] [expires: 2024-01-30]
$ gpg --verify ../openssl-${OSSLVER}.tar.gz.asc ../openssl-${OSSLVER}.tar.gz
gpg: Signature made Tue Sep 19 15:02:51 2023 CEST
gpg: using RSA key EFC0A467D613CB83C7ED6D30D894E2CE8B3D79F5
gpg: Good signature from "OpenSSL security team <openssl-security@openssl.org>" [unknown]
gpg: aka "OpenSSL OMC <openssl-omc@openssl.org>" [unknown]
gpg: aka "OpenSSL Security <openssl-security@openssl.org>" [unknown]
gpg: WARNING: This key is not certified with a trusted signature!
gpg: There is no indication that the signature belongs to the owner.
Primary key fingerprint: EFC0 A467 D613 CB83 C7ED 6D30 D894 E2CE 8B3D 79F5
$ tar -x -X $XLIST -f ../openssl-${OSSLVER}.tar.gz -C ..
$ rsync --exclude FREEBSD.* --delete -av ../openssl-${OSSLVER}/* .
[...]
$ diff -arq ../openssl-${OSSLVER} .
Only in .: .git
Only in .: FREEBSD-Xlist
Only in .: FREEBSD-upgrade
Only in .: appveyor.yml
$ git status FREEBSD*
On branch vendor/openssl-3.0
Your branch is up to date with 'origin/vendor/openssl-3.0'.
nothing to commit, working tree clean
```
Diffstat (limited to 'ssl')
| -rw-r--r-- | ssl/ssl_lib.c | 10 | ||||
| -rw-r--r-- | ssl/ssl_sess.c | 5 | ||||
| -rw-r--r-- | ssl/statem/extensions_srvr.c | 4 |
3 files changed, 11 insertions, 8 deletions
diff --git a/ssl/ssl_lib.c b/ssl/ssl_lib.c index 214884b0f1ef..81a9f0728dbf 100644 --- a/ssl/ssl_lib.c +++ b/ssl/ssl_lib.c @@ -1,5 +1,5 @@ /* - * Copyright 1995-2022 The OpenSSL Project Authors. All Rights Reserved. + * Copyright 1995-2023 The OpenSSL Project Authors. All Rights Reserved. * Copyright (c) 2002, Oracle and/or its affiliates. All rights reserved * Copyright 2005 Nokia. All rights reserved. * @@ -582,7 +582,7 @@ int SSL_clear(SSL *s) OPENSSL_free(s->psksession_id); s->psksession_id = NULL; s->psksession_id_len = 0; - s->hello_retry_request = 0; + s->hello_retry_request = SSL_HRR_NONE; s->sent_tickets = 0; s->error = 0; @@ -2809,14 +2809,14 @@ char *SSL_get_shared_ciphers(const SSL *s, char *buf, int size) if (sk_SSL_CIPHER_find(srvrsk, c) < 0) continue; - n = strlen(c->name); - if (n + 1 > size) { + n = OPENSSL_strnlen(c->name, size); + if (n >= size) { if (p != buf) --p; *p = '\0'; return buf; } - strcpy(p, c->name); + memcpy(p, c->name, n); p += n; *(p++) = ':'; size -= n + 1; diff --git a/ssl/ssl_sess.c b/ssl/ssl_sess.c index c322a11d9c52..d836b33ed0e8 100644 --- a/ssl/ssl_sess.c +++ b/ssl/ssl_sess.c @@ -198,8 +198,11 @@ SSL_SESSION *ssl_session_dup(const SSL_SESSION *src, int ticket) dest->references = 1; dest->lock = CRYPTO_THREAD_lock_new(); - if (dest->lock == NULL) + if (dest->lock == NULL) { + OPENSSL_free(dest); + dest = NULL; goto err; + } if (!CRYPTO_new_ex_data(CRYPTO_EX_INDEX_SSL_SESSION, dest, &dest->ex_data)) goto err; diff --git a/ssl/statem/extensions_srvr.c b/ssl/statem/extensions_srvr.c index 16765a5a5b6f..1fab5a3d1295 100644 --- a/ssl/statem/extensions_srvr.c +++ b/ssl/statem/extensions_srvr.c @@ -1,5 +1,5 @@ /* - * Copyright 2016-2022 The OpenSSL Project Authors. All Rights Reserved. + * Copyright 2016-2023 The OpenSSL Project Authors. All Rights Reserved. * * Licensed under the Apache License 2.0 (the "License"). You may not use * this file except in compliance with the License. You can obtain a copy @@ -883,7 +883,7 @@ int tls_parse_ctos_cookie(SSL *s, PACKET *pkt, unsigned int context, X509 *x, } /* Act as if this ClientHello came after a HelloRetryRequest */ - s->hello_retry_request = 1; + s->hello_retry_request = SSL_HRR_PENDING; s->ext.cookieok = 1; #endif |