Hakase/openssl-patch
1
0 Fork 0
Code Issues Pull Requests Releases Activity

Update 3.0.0-dev patches.

Browse Source
This commit is contained in:
Hakase
2019-01-18 00:54:40 +09:00
parent 0709965a2d
commit 5146f0934a
3 changed files with 96 additions and 96 deletions
Download Patch File Download Diff File Expand all files Collapse all files
openssl-equal-3.0.0-dev.patch
+38 -38
View File
@@ -1,5 +1,5 @@
diff --git a/doc/man1/ciphers.pod b/doc/man1/ciphers.pod
index 4a2deccd24..43680fb7ec 100644
index e29c5d7ced..b5bca974c9 100644
--- a/doc/man1/ciphers.pod
+++ b/doc/man1/ciphers.pod
@@ -400,6 +400,21 @@ permissible.
@@ -71,12 +71,12 @@ index f8783717bc..0e7ad2818b 100644
# define SSL_R_UNINITIALIZED 276
# define SSL_R_UNKNOWN_ALERT_TYPE 246
diff --git a/include/openssl/tls1.h b/include/openssl/tls1.h
index c57344ca0e..ca2c892ed6 100644
index 166f15ad5c..3205f1cbfb 100644
--- a/include/openssl/tls1.h
+++ b/include/openssl/tls1.h
@@ -30,6 +30,16 @@ extern "C" {
# define TLS1_3_VERSION 0x0304
# define TLS_MAX_VERSION TLS1_3_VERSION
@@ -32,6 +32,16 @@ extern "C" {
# define TLS_MAX_VERSION TLS1_3_VERSION
# endif
+/* TODO(TLS1.3) REMOVE ME: Version indicators for draft version */
+# define TLS1_3_VERSION_DRAFT_23 0x7f17
@@ -352,10 +352,10 @@ index a5b3dbbfd5..505c32d18e 100644
}
diff --git a/ssl/ssl_ciph.c b/ssl/ssl_ciph.c
index bd97c0fdab..add5843bfb 100644
index 461a9debab..c8d8517735 100644
--- a/ssl/ssl_ciph.c
+++ b/ssl/ssl_ciph.c
@@ -190,6 +190,7 @@ typedef struct cipher_order_st {
@@ -192,6 +192,7 @@ typedef struct cipher_order_st {
const SSL_CIPHER *cipher;
int active;
int dead;
@@ -363,7 +363,7 @@ index bd97c0fdab..add5843bfb 100644
struct cipher_order_st *next, *prev;
} CIPHER_ORDER;
@@ -679,6 +680,7 @@ static void ssl_cipher_collect_ciphers(const SSL_METHOD *ssl_method,
@@ -681,6 +682,7 @@ static void ssl_cipher_collect_ciphers(const SSL_METHOD *ssl_method,
co_list[co_list_num].next = NULL;
co_list[co_list_num].prev = NULL;
co_list[co_list_num].active = 0;
@@ -371,7 +371,7 @@ index bd97c0fdab..add5843bfb 100644
co_list_num++;
}
@@ -772,8 +774,8 @@ static void ssl_cipher_apply_rule(uint32_t cipher_id, uint32_t alg_mkey,
@@ -774,8 +776,8 @@ static void ssl_cipher_apply_rule(uint32_t cipher_id, uint32_t alg_mkey,
uint32_t alg_auth, uint32_t alg_enc,
uint32_t alg_mac, int min_tls,
uint32_t algo_strength, int rule,
@@ -382,7 +382,7 @@ index bd97c0fdab..add5843bfb 100644
{
CIPHER_ORDER *head, *tail, *curr, *next, *last;
const SSL_CIPHER *cp;
@@ -781,9 +783,9 @@ static void ssl_cipher_apply_rule(uint32_t cipher_id, uint32_t alg_mkey,
@@ -783,9 +785,9 @@ static void ssl_cipher_apply_rule(uint32_t cipher_id, uint32_t alg_mkey,
#ifdef CIPHER_DEBUG
fprintf(stderr,
@@ -394,7 +394,7 @@ index bd97c0fdab..add5843bfb 100644
#endif
if (rule == CIPHER_DEL || rule == CIPHER_BUMP)
@@ -860,6 +862,7 @@ static void ssl_cipher_apply_rule(uint32_t cipher_id, uint32_t alg_mkey,
@@ -862,6 +864,7 @@ static void ssl_cipher_apply_rule(uint32_t cipher_id, uint32_t alg_mkey,
if (!curr->active) {
ll_append_tail(&head, curr, &tail);
curr->active = 1;
@@ -402,7 +402,7 @@ index bd97c0fdab..add5843bfb 100644
}
}
/* Move the added cipher to this location */
@@ -867,6 +870,7 @@ static void ssl_cipher_apply_rule(uint32_t cipher_id, uint32_t alg_mkey,
@@ -869,6 +872,7 @@ static void ssl_cipher_apply_rule(uint32_t cipher_id, uint32_t alg_mkey,
/* reverse == 0 */
if (curr->active) {
ll_append_tail(&head, curr, &tail);
@@ -410,7 +410,7 @@ index bd97c0fdab..add5843bfb 100644
}
} else if (rule == CIPHER_DEL) {
/* reverse == 1 */
@@ -878,6 +882,7 @@ static void ssl_cipher_apply_rule(uint32_t cipher_id, uint32_t alg_mkey,
@@ -880,6 +884,7 @@ static void ssl_cipher_apply_rule(uint32_t cipher_id, uint32_t alg_mkey,
*/
ll_append_head(&head, curr, &tail);
curr->active = 0;
@@ -418,7 +418,7 @@ index bd97c0fdab..add5843bfb 100644
}
} else if (rule == CIPHER_BUMP) {
if (curr->active)
@@ -945,8 +950,8 @@ static int ssl_cipher_strength_sort(CIPHER_ORDER **head_p,
@@ -947,8 +952,8 @@ static int ssl_cipher_strength_sort(CIPHER_ORDER **head_p,
*/
for (i = max_strength_bits; i >= 0; i--)
if (number_uses[i] > 0)
@@ -429,7 +429,7 @@ index bd97c0fdab..add5843bfb 100644
OPENSSL_free(number_uses);
return 1;
@@ -960,7 +965,7 @@ static int ssl_cipher_process_rulestr(const char *rule_str,
@@ -962,7 +967,7 @@ static int ssl_cipher_process_rulestr(const char *rule_str,
uint32_t alg_mkey, alg_auth, alg_enc, alg_mac, algo_strength;
int min_tls;
const char *l, *buf;
@@ -438,7 +438,7 @@ index bd97c0fdab..add5843bfb 100644
uint32_t cipher_id = 0;
char ch;
@@ -971,18 +976,66 @@ static int ssl_cipher_process_rulestr(const char *rule_str,
@@ -973,18 +978,66 @@ static int ssl_cipher_process_rulestr(const char *rule_str,
if (ch == '\0')
break; /* done */
@@ -506,7 +506,7 @@ index bd97c0fdab..add5843bfb 100644
} else {
rule = CIPHER_ADD;
}
@@ -1024,7 +1077,7 @@ static int ssl_cipher_process_rulestr(const char *rule_str,
@@ -1026,7 +1079,7 @@ static int ssl_cipher_process_rulestr(const char *rule_str,
* alphanumeric, so we call this an error.
*/
SSLerr(SSL_F_SSL_CIPHER_PROCESS_RULESTR, SSL_R_INVALID_COMMAND);
@@ -515,7 +515,7 @@ index bd97c0fdab..add5843bfb 100644
l++;
break;
}
@@ -1203,8 +1256,8 @@ static int ssl_cipher_process_rulestr(const char *rule_str,
@@ -1205,8 +1258,8 @@ static int ssl_cipher_process_rulestr(const char *rule_str,
} else if (found) {
ssl_cipher_apply_rule(cipher_id,
alg_mkey, alg_auth, alg_enc, alg_mac,
@@ -526,7 +526,7 @@ index bd97c0fdab..add5843bfb 100644
} else {
while ((*l != '\0') && !ITEM_SEP(*l))
l++;
@@ -1213,6 +1266,11 @@ static int ssl_cipher_process_rulestr(const char *rule_str,
@@ -1215,6 +1268,11 @@ static int ssl_cipher_process_rulestr(const char *rule_str,
break; /* done */
}
@@ -538,7 +538,7 @@ index bd97c0fdab..add5843bfb 100644
return retval;
}
@@ -1377,7 +1435,7 @@ int SSL_CTX_set_ciphersuites(SSL_CTX *ctx, const char *str)
@@ -1379,7 +1437,7 @@ int SSL_CTX_set_ciphersuites(SSL_CTX *ctx, const char *str)
if (ret && ctx->cipher_list != NULL) {
/* We already have a cipher_list, so we need to update it */
@@ -547,7 +547,7 @@ index bd97c0fdab..add5843bfb 100644
ctx->tls13_ciphersuites);
}
@@ -1390,7 +1448,7 @@ int SSL_set_ciphersuites(SSL *s, const char *str)
@@ -1392,7 +1450,7 @@ int SSL_set_ciphersuites(SSL *s, const char *str)
if (ret && s->cipher_list != NULL) {
/* We already have a cipher_list, so we need to update it */
@@ -556,7 +556,7 @@ index bd97c0fdab..add5843bfb 100644
s->tls13_ciphersuites);
}
@@ -1399,17 +1457,20 @@ int SSL_set_ciphersuites(SSL *s, const char *str)
@@ -1401,17 +1459,20 @@ int SSL_set_ciphersuites(SSL *s, const char *str)
STACK_OF(SSL_CIPHER) *ssl_create_cipher_list(const SSL_METHOD *ssl_method,
STACK_OF(SSL_CIPHER) *tls13_ciphersuites,
@@ -581,7 +581,7 @@ index bd97c0fdab..add5843bfb 100644
/*
* Return with error if nothing to do.
@@ -1458,16 +1519,16 @@ STACK_OF(SSL_CIPHER) *ssl_create_cipher_list(const SSL_METHOD *ssl_method,
@@ -1460,16 +1521,16 @@ STACK_OF(SSL_CIPHER) *ssl_create_cipher_list(const SSL_METHOD *ssl_method,
* preference).
*/
ssl_cipher_apply_rule(0, SSL_kECDHE, SSL_aECDSA, 0, 0, 0, 0, CIPHER_ADD,
@@ -605,7 +605,7 @@ index bd97c0fdab..add5843bfb 100644
&head, &tail);
/*
@@ -1476,13 +1537,13 @@ STACK_OF(SSL_CIPHER) *ssl_create_cipher_list(const SSL_METHOD *ssl_method,
@@ -1478,13 +1539,13 @@ STACK_OF(SSL_CIPHER) *ssl_create_cipher_list(const SSL_METHOD *ssl_method,
* strength.
*/
ssl_cipher_apply_rule(0, 0, 0, SSL_AES ^ SSL_AESGCM, 0, 0, 0, CIPHER_ADD,
@@ -622,7 +622,7 @@ index bd97c0fdab..add5843bfb 100644
&tail);
/*
@@ -1490,16 +1551,16 @@ STACK_OF(SSL_CIPHER) *ssl_create_cipher_list(const SSL_METHOD *ssl_method,
@@ -1492,16 +1553,16 @@ STACK_OF(SSL_CIPHER) *ssl_create_cipher_list(const SSL_METHOD *ssl_method,
* disabled. (For applications that allow them, they aren't too bad, but
* we prefer authenticated ciphers.)
*/
@@ -643,7 +643,7 @@ index bd97c0fdab..add5843bfb 100644
&tail);
/*
@@ -1515,7 +1576,7 @@ STACK_OF(SSL_CIPHER) *ssl_create_cipher_list(const SSL_METHOD *ssl_method,
@@ -1517,7 +1578,7 @@ STACK_OF(SSL_CIPHER) *ssl_create_cipher_list(const SSL_METHOD *ssl_method,
* Partially overrule strength sort to prefer TLS 1.2 ciphers/PRFs.
* TODO(openssl-team): is there an easier way to accomplish all this?
*/
@@ -652,7 +652,7 @@ index bd97c0fdab..add5843bfb 100644
&head, &tail);
/*
@@ -1531,15 +1592,15 @@ STACK_OF(SSL_CIPHER) *ssl_create_cipher_list(const SSL_METHOD *ssl_method,
@@ -1533,15 +1594,15 @@ STACK_OF(SSL_CIPHER) *ssl_create_cipher_list(const SSL_METHOD *ssl_method,
* Because we now bump ciphers to the top of the list, we proceed in
* reverse order of preference.
*/
@@ -672,7 +672,7 @@ index bd97c0fdab..add5843bfb 100644
/*
* We also need cipher aliases for selecting based on the rule_str.
@@ -1553,9 +1614,8 @@ STACK_OF(SSL_CIPHER) *ssl_create_cipher_list(const SSL_METHOD *ssl_method,
@@ -1555,9 +1616,8 @@ STACK_OF(SSL_CIPHER) *ssl_create_cipher_list(const SSL_METHOD *ssl_method,
num_of_alias_max = num_of_ciphers + num_of_group_aliases + 1;
ca_list = OPENSSL_malloc(sizeof(*ca_list) * num_of_alias_max);
if (ca_list == NULL) {
@@ -683,7 +683,7 @@ index bd97c0fdab..add5843bfb 100644
}
ssl_cipher_collect_aliases(ca_list, num_of_group_aliases,
disabled_mkey, disabled_auth, disabled_enc,
@@ -1580,27 +1640,35 @@ STACK_OF(SSL_CIPHER) *ssl_create_cipher_list(const SSL_METHOD *ssl_method,
@@ -1582,27 +1642,35 @@ STACK_OF(SSL_CIPHER) *ssl_create_cipher_list(const SSL_METHOD *ssl_method,
OPENSSL_free(ca_list); /* Not needed anymore */
@@ -731,7 +731,7 @@ index bd97c0fdab..add5843bfb 100644
}
/*
@@ -1609,26 +1677,50 @@ STACK_OF(SSL_CIPHER) *ssl_create_cipher_list(const SSL_METHOD *ssl_method,
@@ -1611,26 +1679,50 @@ STACK_OF(SSL_CIPHER) *ssl_create_cipher_list(const SSL_METHOD *ssl_method,
*/
for (curr = head; curr != NULL; curr = curr->next) {
if (curr->active) {
@@ -971,10 +971,10 @@ index ba606e35ed..59ae36a554 100644
/* Dup the client_CA list */
if (!dup_ca_names(&ret->ca_names, s->ca_names)
diff --git a/ssl/ssl_locl.h b/ssl/ssl_locl.h
index c2e6474f86..8fbede969c 100644
index 2d68691a0f..92821b7df0 100644
--- a/ssl/ssl_locl.h
+++ b/ssl/ssl_locl.h
@@ -742,9 +742,46 @@ typedef struct ssl_ctx_ext_secure_st {
@@ -745,9 +745,46 @@ typedef struct ssl_ctx_ext_secure_st {
unsigned char tick_aes_key[TLSEXT_TICK_KEY_LENGTH];
} SSL_CTX_EXT_SECURE;
@@ -1022,7 +1022,7 @@ index c2e6474f86..8fbede969c 100644
/* same as above but sorted for lookup */
STACK_OF(SSL_CIPHER) *cipher_list_by_id;
/* TLSv1.3 specific ciphersuites */
@@ -1081,6 +1118,8 @@ struct ssl_st {
@@ -1084,6 +1121,8 @@ struct ssl_st {
* DTLS1_VERSION)
*/
int version;
@@ -1031,7 +1031,7 @@ index c2e6474f86..8fbede969c 100644
/* SSLv3 */
const SSL_METHOD *method;
/*
@@ -1139,7 +1178,7 @@ struct ssl_st {
@@ -1142,7 +1181,7 @@ struct ssl_st {
/* Per connection DANE state */
SSL_DANE dane;
/* crypto */
@@ -1040,7 +1040,7 @@ index c2e6474f86..8fbede969c 100644
STACK_OF(SSL_CIPHER) *cipher_list_by_id;
/* TLSv1.3 specific ciphersuites */
STACK_OF(SSL_CIPHER) *tls13_ciphersuites;
@@ -2266,7 +2305,7 @@ __owur int ssl_cipher_ptr_id_cmp(const SSL_CIPHER *const *ap,
@@ -2269,7 +2308,7 @@ __owur int ssl_cipher_ptr_id_cmp(const SSL_CIPHER *const *ap,
const SSL_CIPHER *const *bp);
__owur STACK_OF(SSL_CIPHER) *ssl_create_cipher_list(const SSL_METHOD *ssl_method,
STACK_OF(SSL_CIPHER) *tls13_ciphersuites,
@@ -1049,7 +1049,7 @@ index c2e6474f86..8fbede969c 100644
STACK_OF(SSL_CIPHER) **cipher_list_by_id,
const char *rule_str,
CERT *c);
@@ -2276,6 +2315,13 @@ __owur int bytes_to_cipher_list(SSL *s, PACKET *cipher_suites,
@@ -2279,6 +2318,13 @@ __owur int bytes_to_cipher_list(SSL *s, PACKET *cipher_suites,
STACK_OF(SSL_CIPHER) **scsvs, int sslv2format,
int fatal);
void ssl_update_cache(SSL *s, int mode);
@@ -1063,7 +1063,7 @@ index c2e6474f86..8fbede969c 100644
__owur int ssl_cipher_get_evp(const SSL_SESSION *s, const EVP_CIPHER **enc,
const EVP_MD **md, int *mac_pkey_type,
size_t *mac_secret_size, SSL_COMP **comp,
@@ -2359,7 +2405,7 @@ __owur unsigned long ssl3_output_cert_chain(SSL *s, WPACKET *pkt,
@@ -2362,7 +2408,7 @@ __owur unsigned long ssl3_output_cert_chain(SSL *s, WPACKET *pkt,
CERT_PKEY *cpk);
__owur const SSL_CIPHER *ssl3_choose_cipher(SSL *ssl,
STACK_OF(SSL_CIPHER) *clnt,
@@ -1144,7 +1144,7 @@ index 6545f5727d..15786a7bfc 100644
SSLfatal(s, SSL_AD_INTERNAL_ERROR,
SSL_F_TLS_CONSTRUCT_STOC_SUPPORTED_VERSIONS,
diff --git a/ssl/statem/statem_lib.c b/ssl/statem/statem_lib.c
index 9e68e05ccf..d05fa9f532 100644
index 1a9aa41b99..a08f4fa013 100644
--- a/ssl/statem/statem_lib.c
+++ b/ssl/statem/statem_lib.c
@@ -1788,6 +1788,8 @@ int ssl_choose_server_version(SSL *s, CLIENTHELLO_MSG *hello, DOWNGRADE *dgrd)