* [PR PATCH] openssl: update to 3.1.5
@ 2024-01-31 16:55 dkwo
2024-02-08 14:50 ` dkwo
2024-02-12 14:00 ` [PR PATCH] [Merged]: " leahneukirchen
0 siblings, 2 replies; 3+ messages in thread
From: dkwo @ 2024-01-31 16:55 UTC (permalink / raw)
To: ml
[-- Attachment #1: Type: text/plain, Size: 407 bytes --]
There is a new pull request by dkwo against master on the void-packages repository
https://github.com/dkwo/void-packages ssl
https://github.com/void-linux/void-packages/pull/48458
openssl: update to 3.1.5
- I tested the changes in this PR: yes
- I built this PR locally for my native architecture, (x86_64-glibc)
A patch file from https://github.com/void-linux/void-packages/pull/48458.patch is attached
[-- Warning: decoded text below may be mangled, UTF-8 assumed --]
[-- Attachment #2: github-pr-ssl-48458.patch --]
[-- Type: text/x-diff, Size: 8713 bytes --]
From 714dbf7820bf8f4c5f612e394b988e131786f279 Mon Sep 17 00:00:00 2001
From: dkwo <nicolopiazzalunga@gmail.com>
Date: Wed, 31 Jan 2024 11:53:04 -0500
Subject: [PATCH] openssl: update to 3.1.5
---
srcpkgs/openssl/patches/CVE-2023-5678.patch | 175 --------------------
srcpkgs/openssl/template | 6 +-
2 files changed, 3 insertions(+), 178 deletions(-)
delete mode 100644 srcpkgs/openssl/patches/CVE-2023-5678.patch
diff --git a/srcpkgs/openssl/patches/CVE-2023-5678.patch b/srcpkgs/openssl/patches/CVE-2023-5678.patch
deleted file mode 100644
index f9d15b5d55ac1..0000000000000
--- a/srcpkgs/openssl/patches/CVE-2023-5678.patch
+++ /dev/null
@@ -1,175 +0,0 @@
-From ddeb4b6c6d527e54ce9a99cba785c0f7776e54b6 Mon Sep 17 00:00:00 2001
-From: Richard Levitte <levitte@openssl.org>
-Date: Fri, 20 Oct 2023 09:18:19 +0200
-Subject: [PATCH] Make DH_check_pub_key() and DH_generate_key() safer yet
-
-We already check for an excessively large P in DH_generate_key(), but not in
-DH_check_pub_key(), and none of them check for an excessively large Q.
-
-This change adds all the missing excessive size checks of P and Q.
-
-It's to be noted that behaviours surrounding excessively sized P and Q
-differ. DH_check() raises an error on the excessively sized P, but only
-sets a flag for the excessively sized Q. This behaviour is mimicked in
-DH_check_pub_key().
-
-Reviewed-by: Tomas Mraz <tomas@openssl.org>
-Reviewed-by: Matt Caswell <matt@openssl.org>
-Reviewed-by: Hugo Landau <hlandau@openssl.org>
-(Merged from https://github.com/openssl/openssl/pull/22518)
----
- crypto/dh/dh_check.c | 12 ++++++++++++
- crypto/dh/dh_err.c | 3 ++-
- crypto/dh/dh_key.c | 12 ++++++++++++
- crypto/err/openssl.txt | 1 +
- include/crypto/dherr.h | 2 +-
- include/openssl/dh.h | 6 +++---
- include/openssl/dherr.h | 3 ++-
- 7 files changed, 33 insertions(+), 6 deletions(-)
-
-diff --git a/crypto/dh/dh_check.c b/crypto/dh/dh_check.c
-index 7ba2beae7f..e20eb62081 100644
---- a/crypto/dh/dh_check.c
-+++ b/crypto/dh/dh_check.c
-@@ -249,6 +249,18 @@ int DH_check_pub_key_ex(const DH *dh, const BIGNUM *pub_key)
- */
- int DH_check_pub_key(const DH *dh, const BIGNUM *pub_key, int *ret)
- {
-+ /* Don't do any checks at all with an excessively large modulus */
-+ if (BN_num_bits(dh->params.p) > OPENSSL_DH_CHECK_MAX_MODULUS_BITS) {
-+ ERR_raise(ERR_LIB_DH, DH_R_MODULUS_TOO_LARGE);
-+ *ret = DH_MODULUS_TOO_LARGE | DH_CHECK_PUBKEY_INVALID;
-+ return 0;
-+ }
-+
-+ if (dh->params.q != NULL && BN_ucmp(dh->params.p, dh->params.q) < 0) {
-+ *ret |= DH_CHECK_INVALID_Q_VALUE | DH_CHECK_PUBKEY_INVALID;
-+ return 1;
-+ }
-+
- return ossl_ffc_validate_public_key(&dh->params, pub_key, ret);
- }
-
-diff --git a/crypto/dh/dh_err.c b/crypto/dh/dh_err.c
-index 4152397426..f76ac0dd14 100644
---- a/crypto/dh/dh_err.c
-+++ b/crypto/dh/dh_err.c
-@@ -1,6 +1,6 @@
- /*
- * Generated by util/mkerr.pl DO NOT EDIT
-- * Copyright 1995-2021 The OpenSSL Project Authors. All Rights Reserved.
-+ * Copyright 1995-2023 The OpenSSL Project Authors. All Rights Reserved.
- *
- * Licensed under the Apache License 2.0 (the "License"). You may not use
- * this file except in compliance with the License. You can obtain a copy
-@@ -54,6 +54,7 @@ static const ERR_STRING_DATA DH_str_reasons[] = {
- {ERR_PACK(ERR_LIB_DH, 0, DH_R_PARAMETER_ENCODING_ERROR),
- "parameter encoding error"},
- {ERR_PACK(ERR_LIB_DH, 0, DH_R_PEER_KEY_ERROR), "peer key error"},
-+ {ERR_PACK(ERR_LIB_DH, 0, DH_R_Q_TOO_LARGE), "q too large"},
- {ERR_PACK(ERR_LIB_DH, 0, DH_R_SHARED_INFO_ERROR), "shared info error"},
- {ERR_PACK(ERR_LIB_DH, 0, DH_R_UNABLE_TO_CHECK_GENERATOR),
- "unable to check generator"},
-diff --git a/crypto/dh/dh_key.c b/crypto/dh/dh_key.c
-index d84ea99241..afc49f5cdc 100644
---- a/crypto/dh/dh_key.c
-+++ b/crypto/dh/dh_key.c
-@@ -49,6 +49,12 @@ int ossl_dh_compute_key(unsigned char *key, const BIGNUM *pub_key, DH *dh)
- goto err;
- }
-
-+ if (dh->params.q != NULL
-+ && BN_num_bits(dh->params.q) > OPENSSL_DH_MAX_MODULUS_BITS) {
-+ ERR_raise(ERR_LIB_DH, DH_R_Q_TOO_LARGE);
-+ goto err;
-+ }
-+
- if (BN_num_bits(dh->params.p) < DH_MIN_MODULUS_BITS) {
- ERR_raise(ERR_LIB_DH, DH_R_MODULUS_TOO_SMALL);
- return 0;
-@@ -267,6 +273,12 @@ static int generate_key(DH *dh)
- return 0;
- }
-
-+ if (dh->params.q != NULL
-+ && BN_num_bits(dh->params.q) > OPENSSL_DH_MAX_MODULUS_BITS) {
-+ ERR_raise(ERR_LIB_DH, DH_R_Q_TOO_LARGE);
-+ return 0;
-+ }
-+
- if (BN_num_bits(dh->params.p) < DH_MIN_MODULUS_BITS) {
- ERR_raise(ERR_LIB_DH, DH_R_MODULUS_TOO_SMALL);
- return 0;
-diff --git a/crypto/err/openssl.txt b/crypto/err/openssl.txt
-index a1e6bbb617..69e4f61aa1 100644
---- a/crypto/err/openssl.txt
-+++ b/crypto/err/openssl.txt
-@@ -513,6 +513,7 @@ DH_R_NO_PARAMETERS_SET:107:no parameters set
- DH_R_NO_PRIVATE_VALUE:100:no private value
- DH_R_PARAMETER_ENCODING_ERROR:105:parameter encoding error
- DH_R_PEER_KEY_ERROR:111:peer key error
-+DH_R_Q_TOO_LARGE:130:q too large
- DH_R_SHARED_INFO_ERROR:113:shared info error
- DH_R_UNABLE_TO_CHECK_GENERATOR:121:unable to check generator
- DSA_R_BAD_FFC_PARAMETERS:114:bad ffc parameters
-diff --git a/include/crypto/dherr.h b/include/crypto/dherr.h
-index bb24d131eb..519327f795 100644
---- a/include/crypto/dherr.h
-+++ b/include/crypto/dherr.h
-@@ -1,6 +1,6 @@
- /*
- * Generated by util/mkerr.pl DO NOT EDIT
-- * Copyright 2020-2021 The OpenSSL Project Authors. All Rights Reserved.
-+ * Copyright 2020-2023 The OpenSSL Project Authors. All Rights Reserved.
- *
- * Licensed under the Apache License 2.0 (the "License"). You may not use
- * this file except in compliance with the License. You can obtain a copy
-diff --git a/include/openssl/dh.h b/include/openssl/dh.h
-index 8bc17448a0..f1c0ed06b3 100644
---- a/include/openssl/dh.h
-+++ b/include/openssl/dh.h
-@@ -144,7 +144,7 @@ DECLARE_ASN1_ITEM(DHparams)
- # define DH_GENERATOR_3 3
- # define DH_GENERATOR_5 5
-
--/* DH_check error codes */
-+/* DH_check error codes, some of them shared with DH_check_pub_key */
- /*
- * NB: These values must align with the equivalently named macros in
- * internal/ffc.h.
-@@ -154,10 +154,10 @@ DECLARE_ASN1_ITEM(DHparams)
- # define DH_UNABLE_TO_CHECK_GENERATOR 0x04
- # define DH_NOT_SUITABLE_GENERATOR 0x08
- # define DH_CHECK_Q_NOT_PRIME 0x10
--# define DH_CHECK_INVALID_Q_VALUE 0x20
-+# define DH_CHECK_INVALID_Q_VALUE 0x20 /* +DH_check_pub_key */
- # define DH_CHECK_INVALID_J_VALUE 0x40
- # define DH_MODULUS_TOO_SMALL 0x80
--# define DH_MODULUS_TOO_LARGE 0x100
-+# define DH_MODULUS_TOO_LARGE 0x100 /* +DH_check_pub_key */
-
- /* DH_check_pub_key error codes */
- # define DH_CHECK_PUBKEY_TOO_SMALL 0x01
-diff --git a/include/openssl/dherr.h b/include/openssl/dherr.h
-index 5d2a762a96..074a70145f 100644
---- a/include/openssl/dherr.h
-+++ b/include/openssl/dherr.h
-@@ -1,6 +1,6 @@
- /*
- * Generated by util/mkerr.pl DO NOT EDIT
-- * Copyright 1995-2021 The OpenSSL Project Authors. All Rights Reserved.
-+ * Copyright 1995-2023 The OpenSSL Project Authors. All Rights Reserved.
- *
- * Licensed under the Apache License 2.0 (the "License"). You may not use
- * this file except in compliance with the License. You can obtain a copy
-@@ -50,6 +50,7 @@
- # define DH_R_NO_PRIVATE_VALUE 100
- # define DH_R_PARAMETER_ENCODING_ERROR 105
- # define DH_R_PEER_KEY_ERROR 111
-+# define DH_R_Q_TOO_LARGE 130
- # define DH_R_SHARED_INFO_ERROR 113
- # define DH_R_UNABLE_TO_CHECK_GENERATOR 121
-
---
-2.34.1
-
diff --git a/srcpkgs/openssl/template b/srcpkgs/openssl/template
index da84cdb3bfb64..51a138eee2002 100644
--- a/srcpkgs/openssl/template
+++ b/srcpkgs/openssl/template
@@ -1,7 +1,7 @@
# Template file for 'openssl'
pkgname=openssl
-version=3.1.4
-revision=2
+version=3.1.5
+revision=1
bootstrap=yes
build_style=configure
configure_script="./Configure"
@@ -17,7 +17,7 @@ maintainer="John <me@johnnynator.dev>"
license="Apache-2.0"
homepage="https://www.openssl.org"
distfiles="https://www.openssl.org/source/openssl-${version}.tar.gz"
-checksum=840af5366ab9b522bde525826be3ef0fb0af81c6a9ebd84caa600fea1731eee3
+checksum=6ae015467dabf0469b139ada93319327be24b98251ffaeceda0221848dc09262
conf_files="/etc/ssl/openssl.cnf"
replaces="libressl>=0"
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: openssl: update to 3.1.5
2024-01-31 16:55 [PR PATCH] openssl: update to 3.1.5 dkwo
@ 2024-02-08 14:50 ` dkwo
2024-02-12 14:00 ` [PR PATCH] [Merged]: " leahneukirchen
1 sibling, 0 replies; 3+ messages in thread
From: dkwo @ 2024-02-08 14:50 UTC (permalink / raw)
To: ml
[-- Attachment #1: Type: text/plain, Size: 153 bytes --]
New comment by dkwo on void-packages repository
https://github.com/void-linux/void-packages/pull/48458#issuecomment-1934281350
Comment:
@classabbyamp
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PR PATCH] [Merged]: openssl: update to 3.1.5
2024-01-31 16:55 [PR PATCH] openssl: update to 3.1.5 dkwo
2024-02-08 14:50 ` dkwo
@ 2024-02-12 14:00 ` leahneukirchen
1 sibling, 0 replies; 3+ messages in thread
From: leahneukirchen @ 2024-02-12 14:00 UTC (permalink / raw)
To: ml
[-- Attachment #1: Type: text/plain, Size: 266 bytes --]
There's a merged pull request on the void-packages repository
openssl: update to 3.1.5
https://github.com/void-linux/void-packages/pull/48458
Description:
- I tested the changes in this PR: yes
- I built this PR locally for my native architecture, (x86_64-glibc)
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2024-02-12 14:00 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2024-01-31 16:55 [PR PATCH] openssl: update to 3.1.5 dkwo
2024-02-08 14:50 ` dkwo
2024-02-12 14:00 ` [PR PATCH] [Merged]: " leahneukirchen
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).