diff --git a/README.md b/README.md index 0a86dda..4bf6af8 100644 --- a/README.md +++ b/README.md @@ -13,7 +13,7 @@ **Latest patch : openssl-equal-pre8.patch, openssl-equal-pre8_ciphers.patch** -[View Tree (OpenSSL)](https://github.com/openssl/openssl/tree/5eb774324a14b03835020bb3ae2e1c6c92515db0) +[View Tree (OpenSSL, 22318 commits)](https://github.com/openssl/openssl/tree/10bda8f8dd359b3db39a5157be0e72afe9f05eea) [Original source](https://boringssl.googlesource.com/boringssl/+/858a88daf27975f67d9f63e18f95645be2886bfb%5E%21) by [BoringSSL](https://github.com/google/boringssl) & [buik](https://gitlab.com/buik/openssl/blob/openssl-patch/openssl-1.1/OpenSSL1.1h-equal-preference-cipher-groups.patch) diff --git a/openssl-equal-pre8.patch b/openssl-equal-pre8.patch index 28683a2..8e697b6 100644 --- a/openssl-equal-pre8.patch +++ b/openssl-equal-pre8.patch @@ -25,10 +25,10 @@ index 3786e9a028..8dd0d2c028 100644 The following lists give the SSL or TLS cipher suites names from the diff --git a/include/openssl/ssl.h b/include/openssl/ssl.h -index db0a2d5d82..a26cd1cd82 100644 +index 280250ad83..9a61045186 100644 --- a/include/openssl/ssl.h +++ b/include/openssl/ssl.h -@@ -174,12 +174,12 @@ extern "C" { +@@ -173,12 +173,12 @@ extern "C" { # define SSL_DEFAULT_CIPHER_LIST "ALL:!COMPLEMENTOFDEFAULT:!eNULL" /* This is the default set of TLSv1.3 ciphersuites */ # if !defined(OPENSSL_NO_CHACHA) && !defined(OPENSSL_NO_POLY1305) @@ -966,7 +966,7 @@ index 22f729c284..c57c56e39a 100644 /* Dup the client_CA list */ if (s->ca_names != NULL) { diff --git a/ssl/ssl_locl.h b/ssl/ssl_locl.h -index 31e5cc8aa9..27374624df 100644 +index 86c250b695..757aa47f23 100644 --- a/ssl/ssl_locl.h +++ b/ssl/ssl_locl.h @@ -736,9 +736,46 @@ typedef struct ssl_ctx_ext_secure_st { @@ -1026,7 +1026,7 @@ index 31e5cc8aa9..27374624df 100644 STACK_OF(SSL_CIPHER) *cipher_list_by_id; /* TLSv1.3 specific ciphersuites */ STACK_OF(SSL_CIPHER) *tls13_ciphersuites; -@@ -2219,7 +2256,7 @@ __owur int ssl_cipher_ptr_id_cmp(const SSL_CIPHER *const *ap, +@@ -2221,7 +2258,7 @@ __owur int ssl_cipher_ptr_id_cmp(const SSL_CIPHER *const *ap, __owur int set_ciphersuites(STACK_OF(SSL_CIPHER) **currciphers, const char *str); __owur STACK_OF(SSL_CIPHER) *ssl_create_cipher_list(const SSL_METHOD *ssl_method, STACK_OF(SSL_CIPHER) *tls13_ciphersuites, @@ -1035,7 +1035,7 @@ index 31e5cc8aa9..27374624df 100644 STACK_OF(SSL_CIPHER) **cipher_list_by_id, const char *rule_str, CERT *c); -@@ -2229,6 +2266,13 @@ __owur int bytes_to_cipher_list(SSL *s, PACKET *cipher_suites, +@@ -2231,6 +2268,13 @@ __owur int bytes_to_cipher_list(SSL *s, PACKET *cipher_suites, STACK_OF(SSL_CIPHER) **scsvs, int sslv2format, int fatal); void ssl_update_cache(SSL *s, int mode); @@ -1049,7 +1049,7 @@ index 31e5cc8aa9..27374624df 100644 __owur int ssl_cipher_get_evp(const SSL_SESSION *s, const EVP_CIPHER **enc, const EVP_MD **md, int *mac_pkey_type, size_t *mac_secret_size, SSL_COMP **comp, -@@ -2311,7 +2355,7 @@ __owur unsigned long ssl3_output_cert_chain(SSL *s, WPACKET *pkt, +@@ -2313,7 +2357,7 @@ __owur unsigned long ssl3_output_cert_chain(SSL *s, WPACKET *pkt, CERT_PKEY *cpk); __owur const SSL_CIPHER *ssl3_choose_cipher(SSL *ssl, STACK_OF(SSL_CIPHER) *clnt, @@ -1100,10 +1100,10 @@ index 91d304e2b4..1f2eecad0b 100644 && orig_candidate > candidate_vers) continue; diff --git a/ssl/statem/statem_srvr.c b/ssl/statem/statem_srvr.c -index ce8cec185a..1a12a9c1a0 100644 +index c2976b7a32..5a0afcf5d7 100644 --- a/ssl/statem/statem_srvr.c +++ b/ssl/statem/statem_srvr.c -@@ -1708,7 +1708,7 @@ static int tls_early_post_process_client_hello(SSL *s) +@@ -1710,7 +1710,7 @@ static int tls_early_post_process_client_hello(SSL *s) /* For TLSv1.3 we must select the ciphersuite *before* session resumption */ if (SSL_IS_TLS13(s)) { const SSL_CIPHER *cipher = @@ -1112,7 +1112,7 @@ index ce8cec185a..1a12a9c1a0 100644 if (cipher == NULL) { SSLfatal(s, SSL_AD_HANDSHAKE_FAILURE, -@@ -1889,7 +1889,7 @@ static int tls_early_post_process_client_hello(SSL *s) +@@ -1891,7 +1891,7 @@ static int tls_early_post_process_client_hello(SSL *s) /* check if some cipher was preferred by call back */ if (pref_cipher == NULL) pref_cipher = ssl3_choose_cipher(s, s->session->ciphers, @@ -1121,7 +1121,7 @@ index ce8cec185a..1a12a9c1a0 100644 if (pref_cipher == NULL) { SSLfatal(s, SSL_AD_HANDSHAKE_FAILURE, SSL_F_TLS_EARLY_POST_PROCESS_CLIENT_HELLO, -@@ -1898,8 +1898,9 @@ static int tls_early_post_process_client_hello(SSL *s) +@@ -1900,8 +1900,9 @@ static int tls_early_post_process_client_hello(SSL *s) } s->session->cipher = pref_cipher; @@ -1133,7 +1133,7 @@ index ce8cec185a..1a12a9c1a0 100644 sk_SSL_CIPHER_free(s->cipher_list_by_id); s->cipher_list_by_id = sk_SSL_CIPHER_dup(s->session->ciphers); } -@@ -2211,7 +2212,7 @@ WORK_STATE tls_post_process_client_hello(SSL *s, WORK_STATE wst) +@@ -2213,7 +2214,7 @@ WORK_STATE tls_post_process_client_hello(SSL *s, WORK_STATE wst) /* In TLSv1.3 we selected the ciphersuite before resumption */ if (!SSL_IS_TLS13(s)) { cipher = diff --git a/openssl-equal-pre8_ciphers.patch b/openssl-equal-pre8_ciphers.patch index ae01dde..6b36407 100644 --- a/openssl-equal-pre8_ciphers.patch +++ b/openssl-equal-pre8_ciphers.patch @@ -1001,7 +1001,7 @@ index 22f729c284..c57c56e39a 100644 /* Dup the client_CA list */ if (s->ca_names != NULL) { diff --git a/ssl/ssl_locl.h b/ssl/ssl_locl.h -index 31e5cc8aa9..27374624df 100644 +index 86c250b695..757aa47f23 100644 --- a/ssl/ssl_locl.h +++ b/ssl/ssl_locl.h @@ -736,9 +736,46 @@ typedef struct ssl_ctx_ext_secure_st { @@ -1061,7 +1061,7 @@ index 31e5cc8aa9..27374624df 100644 STACK_OF(SSL_CIPHER) *cipher_list_by_id; /* TLSv1.3 specific ciphersuites */ STACK_OF(SSL_CIPHER) *tls13_ciphersuites; -@@ -2219,7 +2256,7 @@ __owur int ssl_cipher_ptr_id_cmp(const SSL_CIPHER *const *ap, +@@ -2221,7 +2258,7 @@ __owur int ssl_cipher_ptr_id_cmp(const SSL_CIPHER *const *ap, __owur int set_ciphersuites(STACK_OF(SSL_CIPHER) **currciphers, const char *str); __owur STACK_OF(SSL_CIPHER) *ssl_create_cipher_list(const SSL_METHOD *ssl_method, STACK_OF(SSL_CIPHER) *tls13_ciphersuites, @@ -1070,7 +1070,7 @@ index 31e5cc8aa9..27374624df 100644 STACK_OF(SSL_CIPHER) **cipher_list_by_id, const char *rule_str, CERT *c); -@@ -2229,6 +2266,13 @@ __owur int bytes_to_cipher_list(SSL *s, PACKET *cipher_suites, +@@ -2231,6 +2268,13 @@ __owur int bytes_to_cipher_list(SSL *s, PACKET *cipher_suites, STACK_OF(SSL_CIPHER) **scsvs, int sslv2format, int fatal); void ssl_update_cache(SSL *s, int mode); @@ -1084,7 +1084,7 @@ index 31e5cc8aa9..27374624df 100644 __owur int ssl_cipher_get_evp(const SSL_SESSION *s, const EVP_CIPHER **enc, const EVP_MD **md, int *mac_pkey_type, size_t *mac_secret_size, SSL_COMP **comp, -@@ -2311,7 +2355,7 @@ __owur unsigned long ssl3_output_cert_chain(SSL *s, WPACKET *pkt, +@@ -2313,7 +2357,7 @@ __owur unsigned long ssl3_output_cert_chain(SSL *s, WPACKET *pkt, CERT_PKEY *cpk); __owur const SSL_CIPHER *ssl3_choose_cipher(SSL *ssl, STACK_OF(SSL_CIPHER) *clnt, @@ -1135,10 +1135,10 @@ index 91d304e2b4..1f2eecad0b 100644 && orig_candidate > candidate_vers) continue; diff --git a/ssl/statem/statem_srvr.c b/ssl/statem/statem_srvr.c -index ce8cec185a..1a12a9c1a0 100644 +index c2976b7a32..5a0afcf5d7 100644 --- a/ssl/statem/statem_srvr.c +++ b/ssl/statem/statem_srvr.c -@@ -1708,7 +1708,7 @@ static int tls_early_post_process_client_hello(SSL *s) +@@ -1710,7 +1710,7 @@ static int tls_early_post_process_client_hello(SSL *s) /* For TLSv1.3 we must select the ciphersuite *before* session resumption */ if (SSL_IS_TLS13(s)) { const SSL_CIPHER *cipher = @@ -1147,7 +1147,7 @@ index ce8cec185a..1a12a9c1a0 100644 if (cipher == NULL) { SSLfatal(s, SSL_AD_HANDSHAKE_FAILURE, -@@ -1889,7 +1889,7 @@ static int tls_early_post_process_client_hello(SSL *s) +@@ -1891,7 +1891,7 @@ static int tls_early_post_process_client_hello(SSL *s) /* check if some cipher was preferred by call back */ if (pref_cipher == NULL) pref_cipher = ssl3_choose_cipher(s, s->session->ciphers, @@ -1156,7 +1156,7 @@ index ce8cec185a..1a12a9c1a0 100644 if (pref_cipher == NULL) { SSLfatal(s, SSL_AD_HANDSHAKE_FAILURE, SSL_F_TLS_EARLY_POST_PROCESS_CLIENT_HELLO, -@@ -1898,8 +1898,9 @@ static int tls_early_post_process_client_hello(SSL *s) +@@ -1900,8 +1900,9 @@ static int tls_early_post_process_client_hello(SSL *s) } s->session->cipher = pref_cipher; @@ -1168,7 +1168,7 @@ index ce8cec185a..1a12a9c1a0 100644 sk_SSL_CIPHER_free(s->cipher_list_by_id); s->cipher_list_by_id = sk_SSL_CIPHER_dup(s->session->ciphers); } -@@ -2211,7 +2212,7 @@ WORK_STATE tls_post_process_client_hello(SSL *s, WORK_STATE wst) +@@ -2213,7 +2214,7 @@ WORK_STATE tls_post_process_client_hello(SSL *s, WORK_STATE wst) /* In TLSv1.3 we selected the ciphersuite before resumption */ if (!SSL_IS_TLS13(s)) { cipher =